# Publish-target repo + lapse-proof canonical URL

<!-- [doc->REQ-REL-1] delivered M6-D1: SaberMage/spt-releases created (private), README + LICENSE-MIT/LICENSE-BINARY pushed (2debda8); Pages goes live at the D7 flip -->


The `spt-core` source repo stays **private long-term** (clean-room rebuild; internal planning corpus). All dev-facing artifacts publish to a separate repo, **`SaberMage/spt-releases`** — README, GitHub Releases (binaries + dev assets), and the rendered dev docs via GitHub Pages. It is a pure publish target: doc truth and CI doc-generation live in the source repo; a pipeline pushes rendered output. Created private; flips public anytime (Pages goes live at the flip — no Pro plan).

**Canonical URL = `https://sabermage.github.io/spt-releases`, with no custom domain configured on Pages.** This URL is what gets baked everywhere: docs cross-links, `llms.txt`, the install one-liner in the README, and every adapter's pack-in install logic.

## Considered options

- **Custom domain (`spt-core.decidel.com`) as Pages canonical** — rejected. Configuring a Pages custom domain makes GitHub redirect all github.io URLs to it, so the domain becomes canonical for *everything*, including the install one-liner baked into third-party adapters. A lapsed/transferred domain then hands arbitrary code execution (`curl | sh`) to whoever registers it next. The github.io URL is account-bound, free, and cannot lapse.
- `spt-core.decidel.com` survives only as an optional **human-facing redirect → Pages** (marketing/vanity). It never appears in install commands, adapter code, or doc cross-links.

## Consequences

- Install scripts are served from the Pages URL (not `raw.githubusercontent.com`), keeping hosting swappable behind the stable URL.
- DOCS-STRATEGY principle 9 (never-renamed URLs; agents cache links) is anchored to the github.io origin permanently.
- Everything authored in `spt-releases` must be public-safe from day one.