# Secrets / env
.env
.env.*
!.env.example
!.env.staging.example
*.pem
*.key

# ops/profiles/*.env (renamed from ops/env/ — these are frontend TOPOLOGY profiles, a wholly
# different thing from the runtime `.env` above, and the near-identical names kept inviting the
# confusion): single.env/subdomain.env are GENERIC topology templates, no real domain committed
# — see ops/profiles/README.md. A same-topology instance (e.g. a personal tunnel) just exports
# FAHD_SITE_ORIGIN over single.env's `${VAR:-placeholder}` fallback — no file needed. A
# genuinely different NAMED deployment (staging, a future real prod) gets its own gitignored
# profile file instead — same shape, real domain filled in. Ignore each one here as it's added.
ops/profiles/staging.env

# Playwright MCP tool output (screenshots/traces from local browser-driven QA)
.playwright-mcp/

# /design-sync: staged converter scripts + deps, build output, and machine-generated
# sync state. .design-sync/config.json, NOTES.md, conventions.md, previews/, and
# overrides/ are the durable, committed set.
.ds-sync/
ds-bundle/
**/.design-sync/.cache/
**/.design-sync/learnings/
**/.design-sync/node_modules

# Live LMS tenant credentials for the seed script (real values, per-machine /
# secrets manager). Ignore the dir CONTENTS but keep the tracked .example template
# (must be `secrets/*` not `secrets/`, or Git can't re-include the example).
secrets/*
!secrets/*.example

# Python
__pycache__/
*.py[cod]
.venv/
venv/
.pytest_cache/
.mypy_cache/
.ruff_cache/
*.egg-info/
.coverage
htmlcov/

# uv
.uv/

# Node / build caches (fahd-frontend/, design-prototype/)
node_modules/
.next/
out/
.turbo/

# CodeGraph local DB/cache (config is committed; the index is per-machine)
.codegraph/*.db
.codegraph/*.db-*
.codegraph/cache/
.codegraph/*.log
.codegraph/.dirty

# Eval scorecards are committed in PRs intentionally; ignore only scratch runs
tests/eval/results/_scratch/

# API Capture Tool — dev/staging debug output, can contain real conversation
# content (docs/superpowers/specs/2026-07-16-api-capture-tool-design.md)
docs/qa/api-capture/

# Local dev server logs (backend/frontend run output — per-machine, never committed)
*.log

# TM1 profile live-test harnesses — kept LOCAL only (hit real LMS instances + need
# secrets/live_tenants.env). Not part of the PR / CI. The mocked contract tests in
# tests/contract/ are the committed coverage.
scripts/_livetest_env.py
scripts/seed_live_edx.py
scripts/livetest_profile.py
scripts/livetest_profile_bb.py
scripts/livetest_profile_moodle.py

# OS / editor
.DS_Store
Thumbs.db
*.swp

# NOTE: fahd-agent-v1/ is vendored reference code (its nested .git was removed; original history
# lives at github.com/QusaiiSaleem/eduarabia-agent). It is tracked as plain files in this repo.

settings.local.json
# Agent-tool worktrees (never commit)
.claude/worktrees/

# preview:prod local release tree (never committed)
.preview/

# subagent-driven-development run artifacts (task briefs/reports, review diffs) — local
# working exhaust, never committed. (.superpowers/sdd/ already self-ignores via its own
# nested .gitignore; this covers the directory itself and any sibling subfolder.)
.superpowers/
# Live-test debug evidence — contains live tokens in captured curl (never commit)
Notes/live-test-runs/evidence/

# Benchmark run artifacts (scripts/bench). The COMMITTED outputs live under
# docs/perf/baselines/; these are per-run scratch files.
.bench-counts.json
# Under pytest-xdist each worker writes its own file (S2-P2) — .bench-counts.gw0.json etc.
.bench-counts.*.json
.bench-quick.json
.livetest/
# S2-P2 run logs / coverage captures.
.s2p2-*.log
.s2p2-*.txt
