# Trace First Publish Checklist

## Human upload path (short)

1. Run curated build:
   - `npm run trace:first-publication`
   - optional reproducible single-trace sample: `npm run trace:sample-infer`
2. Review curated subset only:
   - `trace-pack/release/first-publication/traces/`
3. Confirm verification:
   - `npm run trace:verify-publication`
4. Inspect publication files:
   - `README.md`
   - `manifest.json`
   - `REDACTION_SUMMARY.md`
   - export `verification-report.md`
5. Spot-check traces manually (at least 2):
   - one success trace
   - the invalid-input trace
6. Confirm no obvious secrets remain:
   - run `npm run trace:verify`
7. Upload curated folder contents to Hugging Face dataset.
8. Open HF viewer and confirm trace rendering.
9. Update local URL status:
   - edit `trace-pack/hf-publication.json` (`status`, `dataset_url`, `last_updated`)
10. Re-open `/tokenstopia/trace-gallery.html` and confirm live link state.

## Privacy checks

- Never upload `trace-pack/source/raw/`.
- Never upload unreviewed logs or environment dumps.
- If a leak is found:
  1. stop publication
  2. fix redaction rules
  3. rerun `npm run trace:first-publication`

## Publish decision rule

Publish only if:
- curated subset is understandable to first-time external developers
- verification scripts pass
- manual spot-check passes