# Python
__pycache__/
*.py[cod]
*.egg-info/
.eggs/
dist/
build/
.venv/
venv/
.pytest_cache/
.ruff_cache/
.mypy_cache/
.coverage
htmlcov/

# Env / secrets
.env
.env.*
!.env.example
*.local
# The audit sink's AWS credentials file and Kafka password (CTO-757), mounted by compose.
infra/audit-sink/secrets/
# The local Google sign-in recipe's client secret, code key and dev certificates (oauth-dev).
infra/oauth-dev/secrets/
infra/oauth-dev/ca-private/

# OS / editor
.DS_Store
.idea/
.vscode/

# uv
uv.lock

# The pen test harness's run output: reports and raw response bodies (docs/specs/pentest-harness.md).
security/pentest/out/

# Claude Code worktrees
.claude/worktrees/
.aider.*
keys.txt

# Model auto-discovery cache (CTO-109)
.tally/

# Scratch output from Claude sessions. Never committed: this repo is public (CTO-433 review).
Claude outputs/

# Vitest cache (CTO-434, CTO-436). It normally lands in web/node_modules/.vite, which
# node_modules/ already covers, but a root-level .vite/ has appeared here in practice. Both
# branches that hit it guessed at the cause and guessed differently, and neither guess reproduces:
# running the suite from web/ caches under web/node_modules, and running it from the root with
# --root web creates nothing here. So the trigger is not known, only that it happens. Ignored
# regardless, because this repo is public and a build artefact must not be one stray `git add -A`
# away from being published.
.vite/
sdk/python/compat-results/
