# Artifacts Policy

## Purpose

Define which files are source-of-truth and which are generated runtime/research artifacts that must not block or pollute production rollouts.

## Source of Truth

Tracked and reviewable:

- `ansible/`
- `aw-server/`
- `windows/`
- `scripts/`
- `docs/`
- install-kit templates and manifests under `windows/installkit/innosetup/`

## Generated / Volatile Artifacts

Not for production commits:

- `.graphify_*` cache/analysis outputs
- `graphify-out/cache/*`
- `graphify-out/shellcheck-*.txt`
- `graphify-out/validate_dryrun_out*.txt`
- `graphify-out/powershell-parse-results*.json`
- `graphify-out/powershell-pssa-warn-results.json`
- `graphify-out/pssa_diffs.txt`
- `reports/*`
- `tmp/*`

These paths are ignored by `.gitignore` and additionally guarded by `scripts/quality-gate.sh`.

## Rollout Gate

`scripts/prod_rollout.sh` must run only when:

1. `AW_MAINTENANCE_ACK=YES` is set.
2. `scripts/quality-gate.sh` passes.
3. Preflight checks pass:
   - `ansible ping`/`win_ping`
   - `./check-aw-data.sh`
   - `./check-aw-full.sh`

If any gate fails, rollout stops.

## Notes

- Secrets policy remains temporary by operator choice; credentials may still exist in local `inventory.ini` during this phase.
- Dedicated secrets hardening (vault/env-only enforcement) is a separate follow-up track.