# Byte-compiled / optimized / DLL files
__pycache__/
*.py[cod]
*$py.class

# Distribution / packaging
dist/
build/
*.egg-info/
*.egg

# Virtual environments
.venv/
venv/

# IDE
.vscode/
.idea/

# mypy
.mypy_cache/

# pytest
.pytest_cache/

# Scratch / test output (keep the dir, ignore its contents)
/tmp/
!/tmp/.gitkeep

# Training corpora — third-party datasets are NOT redistributed (only the
# trained model.json is vendored). Ignore the downloaded data files; keep the
# provenance docs and fetch helper tracked.
/data-raw/*
!/data-raw/README.md
!/data-raw/SOURCES.md
!/data-raw/fetch_datasets.py
!/data-raw/pinned-revisions.json

# Coverage
htmlcov/
.coverage
coverage.xml

# OS
.DS_Store
Thumbs.db

# Locked deps
# uv.lock is committed for reproducibility

# Session recordings — local only; not published to this repo (may contain
# transcripts from other projects + local dev tokens). See flush 2026-07-27.
.specstory/

# Claude Code per-machine settings
.claude/settings.local.json

# Linked git worktrees for non-trivial work. NOT ignored until 2026-07-31, which meant
# a worktree created under the repo root — the documented convention — was one
# `git add -A` away from committing an entire second checkout into a PUBLIC repo.
# Same shape as the untracked-and-unignored hazard described below, minus the luck.
/worktrees/

# Legal working papers — NEVER commit these to THIS repository. It is PUBLIC.
#
# The canonical CLA counsel brief lives in the PRIVATE repo
# Warnes-Innovations/contribution-gates, under legal/. A working copy showed up here
# untracked and unignored on 2026-07-29; it had never been committed (verified across
# all refs and all history), but nothing stood between it and the next `git add -A`.
#
# The DIRECTORY is excluded rather than the single filename, so a second working paper
# dropped alongside it is covered without anyone having to remember this rule.
#
# The patterns below extend that to material that lands under a different name or path.
# They are a SECOND LAYER: legal working papers, vulnerability assessments, security
# reviews and incident notes belong in the PRIVATE repo Warnes-Innovations/confidential,
# outside this working tree entirely. That separation is the real control. One mechanism
# is a single point of failure; this is the one that catches a copy that lands anyway.
#
# If a file legitimately matches, `git add -f` it and narrow the pattern — do not widen
# the rule.
docs/legal/
**/*counsel*
**/*vulnerability-assessment*
**/*pentest*
**/*incident-report*
CONFIDENTIAL*

# OneByOne (OBO) session state — same principle, applied to work-in-progress notes.
#
# An OBO session records whatever task happens to be in flight: item titles,
# descriptions, and the shell commands to run them. In a PUBLIC repo that is an
# open-ended disclosure channel, because nobody chooses in advance what a future
# session will contain — a client name, an unreleased plan, a credential pasted
# into a command, or NDA-bound material are all one ordinary session away.
#
# Canonical store is Warnes-Innovations/confidential (oboe_sessions/<repo>/), with
# a symlink into it here. As with the block above, the separation of stores is the
# control and these patterns are the second layer.
#
# The LINK must be named `.github/oboe_sessions`: oboe-mcp hardcodes
# base_dir/.github/oboe_sessions and no flag selects another name, so a store
# reached only as `obo_sessions` is invisible to the tooling (flow-guard listed 2
# of 11 sessions that way). `obo_sessions` remains listed as the legacy name — as
# a compat symlink, and as a real directory in any repo not yet migrated.
#
# BOTH forms of BOTH names are listed on purpose. A trailing slash restricts a
# pattern to DIRECTORIES, and git does not treat a symlink as a directory — so the
# slash form alone would stop matching the moment the directory became a symlink,
# which is exactly what the migration does. (That failure was found for real in
# agent-config, where the slash-only rule had been silently matching nothing.)
.github/oboe_sessions
.github/oboe_sessions/
.github/obo_sessions
.github/obo_sessions/

# Committee-review output — the same principle again, and THIS REPO IS PUBLIC.
#
# `/committee-review` (a MANDATORY step of `/flush`) writes `persona-reviews/` into
# whatever tree it runs in: a consolidated report plus one file per persona. Its own
# prompt says that output "routinely enumerates control gaps across the fleet" — an
# inventory of where our defenses are weak, which is precisely what must not be
# published, and unlike a credential it cannot be rotated afterwards.
#
# The rule existed ONLY in agent-config (always-private), and the prompt described
# that arrangement as though every repo inherited it. Verified 2026-08-11 with
# `git check-ignore --no-index -v persona-reviews`: agent-config matched on both
# forms, flow-guard matched nothing, and this repo — the PUBLIC one — matched
# nothing. Nothing had been written yet; that was luck, not a control, and it stopped
# being luck the moment `/flush` gained standing approval to spawn that step.
#
# BOTH forms again, for the reason given above: in agent-config `persona-reviews` is
# a SYMLINK into the private store, and a trailing-slash pattern does not match a
# symlink. A slash-only rule here would fail the instant anyone mirrored that layout.
#
# This is the SECOND layer. The first is not writing review output into a public tree
# at all — see the precondition now stated in committee-review.prompt.md Step 4.
persona-reviews
persona-reviews/
