hypertwist/docs/MODEL_B_SOURCE_ACCESS_BOUNDARY.md

Model B Source Access Boundary

Created on 2026-04-23

Purpose:

• make the clean-room Model B boundary explicit for HyperTwist work
• prevent accidental reading of restrictive mirrors or unrelated sensitive ops material

Allowed for clean-room Model B

• C:\HyperTwist first-party product materials required for the assigned subsystem
• C:\Workspaces\HyperTwist\clean-room-specs\*
• C:\Workspaces\HyperTwist\repos.manifest.json
• first-party acceptance tests and public compatibility requirements

Forbidden for clean-room Model B

• C:\Workspaces\HyperTwist\mirrors\restrictive\*
• mixed-license restricted subtrees inside otherwise partially permissive repos, for example:
  • C:\Workspaces\HyperTwist\mirrors\restrictive\PostHog\posthog\ee\*
  • C:\Workspaces\HyperTwist\mirrors\restrictive\screenpipe\screenpipe\ee\*
• copied sensitive ops references such as:
  • C:\HyperTwist\docs\refs\FORGEJO_WOODPECKER_VPS_A_TO_Z_SENSITIVE_RUNBOOK.md
• unrelated product ops folders, SSH material, or secret-bearing runbooks

Operational rule

• if a file exists only because Model A inspected a restrictive repo, Model B must not read it unless it was explicitly scrubbed into clean-room-specs
• benchmark oracles remain source-forbidden to Model B
• this rule still applies when the upstream repo says all rights reserved, has no explicit license, or contains contradictory license notices; those repos may still inform Model A, but never become direct Model B source input
• if a repo mixes permissive and restricted trees, default to forbidding the whole mirrored repo to Model B unless a narrower allowlist has been explicitly created in writing

Brownan / Oracle clarification

Brownan's solver mirror is allowed for Model A research and oracle derivation only. It does not justify Model B access to any VPS runbook, CI document, SSH key, or other unrelated operations material.