.venv/
__pycache__/
*.pyc
*.pyo
*.egg-info/
dist/
build/
sbom.json
*.sigstore.json
.pytest_cache/
.mypy_cache/
.ruff_cache/
.coverage
htmlcov/
.DS_Store
.vaner/
.vaner_data/

# Cockpit (frontend) build + dependency caches
node_modules/
.vite/

# Rust workspace (crates/vaner-contract). We commit Cargo.toml files at
# workspace + crate level, but not the lockfile (library crate; the
# Tauri app that consumes it has its own Cargo.lock) nor build outputs.
target/
# Generated TypeScript bindings from `cargo test --features ts-rs` —
# the SvelteKit app vendors these on demand; the Rust crate treats them
# as transient.
crates/vaner-contract/bindings/

# Secrets: ignore every .env variant, globally and under subtrees.
# Only sanitized *.env.sample templates are allowed to be committed.
.env
.env.*
**/.env
**/.env.*
!**/.env.sample

# Private training/evaluation repos and infrastructure.
eval/
!src/vaner/eval/
!src/vaner/eval/**
scripts/*
!scripts/e2e/
!scripts/e2e/**
scripts/e2e/__pycache__/
!scripts/install.sh
!scripts/sync-plugin-skill.sh
!scripts/sync-plugin-primer.sh
!scripts/bump-plugin-version.sh
!scripts/sync_agents_primer.py
!scripts/__init__.py
!scripts/release/
!scripts/release/*.py
# CI-only bootstrap lockfiles — tracked so Scorecard's Pinned-Dependencies
# check can verify integrity hashes on npm installs (alert #212).
!scripts/ci/
!scripts/ci/**
infra/
apps/vaner-daemon/

# Local engineering scratchpad (handover docs, review notes)
docs/engineering/

# Claude Code personal state — project CLAUDE.md is committed, personal
# overrides and session locks are not.
.claude/settings.local.json
.claude/scheduled_tasks.lock
