# .gate — access sign-post for this directory tree.
# Convention: nearest .gate walking up from a path governs it.
# policy is one of: read-write | read-only | write-only | none
# Sign-post, not cathedral: this file states consent; guards check against it.
policy: read-write
reason: pub/ — the hub's public shelf; cleared for the open internet by
  construction (no secrets, no third parties, nothing embargoed). Signed
  artifacts verify against corwin.asc (ECE7...F007). The rest of the hub is
  NOT public; a peek elsewhere earns the finger-wag.
since: 2026-07-02
