Public release channel

Project Brain source stays private in Neusis-AI-Org/project-brain. Customer installs use the public release mirror:

https://github.com/Neusis-AI-Org/project-brain-releases

What is public

Docker Compose files
Caddyfile
.env.example
install, upgrade, restore, and air-gap bundle scripts
install, upgrade, and backup docs
GitHub Releases with signed SBOM assets
GHCR container images for web, worker, migrate, graphify-sidecar, and graphify-egress-proxy

No app source, workspace packages, Dockerfiles, build scripts, or lockfiles are mirrored.

The public repository is:

https://github.com/Neusis-AI-Org/project-brain-releases

If it ever needs to be recreated, create it as public:

gh repo create Neusis-AI-Org/project-brain-releases --public --description "Public installer release mirror for Project Brain"

Create a fine-grained token or GitHub App token with write access to that repository contents, then add it to the private source repo as:

RELEASES_REPO_TOKEN

The release workflow uses this token to push installer assets, create/move the matching release tag, and publish the public GitHub Release.

The release workflow publishes images to ghcr.io/neusis-ai-org. Make the five container packages public in GitHub Packages:

project-brain-web
project-brain-worker
project-brain-migrate
project-brain-graphify-sidecar
project-brain-graphify-egress-proxy

Stable semver tags (vX.Y.Z) also update latest. Prerelease tags only publish their immutable version tag.