# ── Internal design docs — NEVER committed (workspace policy) ──
# Strategy, methodology internals, and project memory stay local-only.
CLAUDE.md
# Glob, not `STATE.md` + `STATE-archive.md`: an enumerated ignore leaks through
# the entry someone forgets to add, which is how `.claude/hooks/` let the rig
# guardrails into 4 repos (base.md). The inverse risk — a legitimate
# STATE-prefixed doc silently untracked — is the cheaper failure. Do not narrow.
STATE*.md
.claude/
/[0-9][0-9]-*.md
/adrs/
SPEC*.md
/scratch/

# ── Python ──
__pycache__/
*.py[cod]
*.egg-info/
.eggs/
build/
dist/
.venv/
venv/
env/
.pytest_cache/
.mypy_cache/
.ruff_cache/
.coverage
htmlcov/
.python-version

# ── Node / Astro (site/) ──
node_modules/
site/dist/
site/.astro/
.astro/

# ── Env / secrets ──
.env
.env.*
!.env.example
*.local

# ── OS / editor ──
.DS_Store
Thumbs.db
*.swp
.idea/
.vscode/

# Wrapper-managed state file: indicates origin push is failing
ops/autonomous/.push-broken

# Run-log scratch file — local-only, like STATE.md
RUNLOG.md

# Playwright MCP screenshots — local design review artifacts, not deliverables.
.playwright-mcp/

# Workers-extra venv: semgrep + osv-scanner live here, NOT in .venv, because
# CI's `test` job builds `[dev]` only and a workers dep on the dev path is
# exactly what hid a red CI for a day (v0.19.1).
.venv-workers/

# `cohort.atomic_write` writes `<name>.tmp` and renames. A crash between the
# two leaves the temp file behind, and both files it governs — ops/cohort.json
# and the site data — are COMMITTED, so `git add -A` would stage a partial
# write of the published record next to the real one.
*.tmp
