# Hard rule (portfolio-wide): never commit real work-domain data or secrets.

# Never commit
samples/
.identifiers-denylist.local

# Dry-run audit artifacts — contain raw identifiers, never committed
docs/history-identifier-audit.md
scripts/filter-repo-replacements.txt
secrets/
.env
suite.env
certs/
*.env.local
*.db
*.sqlite3
*.sqlite3-wal
*.sqlite3-shm
keys.json
users.json
deploy/winsw/dossier-env.cmd

# Python
__pycache__/
*.py[cod]
.venv/
venv/
*.egg-info/
.ruff_cache/
.mypy_cache/
.pytest_cache/
.coverage
htmlcov/

# OS / editor
.DS_Store
*.swp
*~

# Vendored patina is committed; local design-system build caches are not
.patina-cache/
deploy/k8s/secret-suite-env.yaml
deploy/k8s/secret-regista-keys.yaml
deploy/k8s/configmap-ad-root-ca.yaml
