# Generated data
git-stats.json
.jinja_cache/
chroma_db/

# Runtime state (deploy lock, monitor heartbeats, watchdog tickfiles)
.deploy-state/
.wallet_authorized

# Runtime tracker files — written in-place by the live service (atomic tmp+rename).
# Tracking these jammed every git pull (stash/reset --hard churn -> stash_pop_failures).
# Writers: src/services/syndication/orchestrator.py, comment_replier.py
data/centcom/comment_replies_tracker.json
data/distribution/syndication_tracker.json
data/centcom/blog_similarity.lock

# Generated in-place by scripts/session-guard.sh on every session register/release
# (the full template incl. static sections lives in that script's heredoc, so
# nothing is lost by untracking). Tracking it dirtied the index on every session
# and auto_fix_cycle.sh re-committed the churn — same §5 pull-jam as the trackers.
DEVELOPERS.md

# NOC runtime artifacts (sqlite WAL/SHM, strict_* scratch files, .bak rolls)
noc/*.db-shm
noc/*.db-wal
noc/*.db.bak
noc/strict_*.json

# Security
stella-4/
data/stella_passwords.txt
data/distribution/social_credentials.json
# Python
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
lib64/
parts/
sdist/
# Keep ignoring Python-package `lib/` dirs ANYWHERE except the repo-root MM
# toolkit at /lib. The leading slash on the un-ignore below scopes it to root.
lib/
!/lib/
# NOTE: the bare `lib/` ignore above is overridden ONLY for the MM toolkit at
# /lib (repo root) so it can be tracked. Other nested lib/ dirs stay ignored. Python build artifacts named lib/ still get caught by the *.so /
# *.pyc / __pycache__ / site-packages / venv rules below. The /lib toolkit's
# own venvs, logs, caches, data blobs and binaries are excluded explicitly here:
/lib/**/site-packages/
/lib/**/dist-packages/
/lib/**/env/
/lib/**/venv/
/lib/**/.venv/
/lib/**/*.log
/lib/**/*.log-*
/lib/**/log
/lib/**/*.dat
/lib/**/*.dat-*
/lib/**/*.npz
/lib/**/*.npy
/lib/**/*.wav
/lib/**/*.sav
/lib/**/*.arff
/lib/**/*.cache
/lib/**/*.db
/lib/**/*.db-shm
/lib/**/*.db-wal
/lib/**/*.swp
/lib/**/*.orig
# but keep the mm2.orig source directory (the .orig here is a name, not a backup)
!/lib/**/mm2.orig/
!/lib/**/mm2.orig/**
/lib/**/*.pem
/lib/**/*.key
/lib/**/*.crt
/lib/**/*-20[0-9][0-9][0-9][0-9]*
# Never track real secret env files inside the toolkit
/lib/**/.env
/lib/**/.env.*
# Scratch / diff-output / backup files in the toolkit (single-letter names,
# stray quote-named files, LLM-prompt notebooks) — these held raw private keys,
# evt_ API keys and user PII, and are not real source. Keep them out for good.
/lib/**/a
/lib/**/c
/lib/**/d
/lib/**/e
/lib/**/j
/lib/**/x
/lib/**/s2
/lib/**/s3
/lib/**/[\"']
/lib/**/TEST_LLM_prompts.ipynb
var/
wheels/
*.egg-info/
.installed.cfg
*.egg

# Virtual Environment
venv/
env/
ENV/
.venv

# IDE
.vscode/
.idea/
*.swp
*.swo
*~

# Environment
.env
.env.*
!.env.example
!.env.production.template
# Service-specific secret env files (actual secrets, never commit)
docker/env/*.env
# Templates are safe to commit — they contain no real secrets
!docker/env/*.env.template

# Database
*.db
*.sqlite
*.sqlite3

# Testing
.pytest_cache/
.coverage
htmlcov/
*.cover
test-results/
playwright-report/
node_modules/
# Also ignore a node_modules SYMLINK (deploy-src links node_modules ->
# /home/deploy/node_modules for the frontend build). A trailing-slash pattern
# matches directories ONLY, so without this the symlink shows as untracked and
# wedges the deploy gate (dirty-tree block) on every poll tick.
node_modules

# Logs
*.log
logs/

# OS
.DS_Store
Thumbs.db

# Documentation
site/

# Docker
docker-compose.override.yml

# Backups
backups/
*.sql
*.sql.gz

# Screenshots and QA results (large files - removed from git history)
# These are generated by tests and should not be committed
screenshots/
qa_results/

# Large sync dump files
data/sync_dumps/*.tar.gz
tuatara.tar.gz
*.backup
data/sync_dumps.backup/
data/assets_vectordb.backup/

# Test fixtures (browser profile artifacts)
tests/fixtures/metamask-profile/DeferredBrowserMetrics/

# Contracts build artifacts
contracts/artifacts/
.playwright-mcp/
test_results/

# Telegram session files (contain auth tokens - never commit)
*.session
*.session-journal
telegram_bot/sessions/
tests/e2e/.cache-synpress/
contracts/deployments/WinnerTakesAllMarket_verify.json
.protected_volumes

# Volume backups (large files)
data/volume_backups/
tests/e2e/mobile_user_journey/.env.test

# E2E test environment (contains private keys)
tests/e2e/mobile_user_journey/.env.test

# Test reports and screenshots
reports/

# Claude Code — ignore local state, track shared config
.claude/*
!.claude/settings.json
!.claude/rules/
!.claude/rules/**
!.claude/skills/
!.claude/skills/**
!.claude/agents/
!.claude/agents/**
!.claude/commands/
!.claude/commands/**
.claude/settings.local.json
.claude/hooks/
.claude/locks/
.claude/session-start.md
.claude/conflict-prevention.md
.claude.json
.claude.json.*
.claude.dev-*/
.claude.orig/

node_modules/
dist/
build/
vendor/
target/

# Frontend build output (content-hashed bundles) — regenerated by
# scripts/build-frontend.mjs during deploy (deploy-bluegreen rm -rf + rebuilds),
# so committing it only churns the working tree and breaks the deploy stash/pop.
static/dist/

# Process PID files — runtime ephemera, never source. Committing them churns the
# shared /home/deploy tree on every restart and breaks concurrent deploys.
*.pid
data/irc_logs/

# Ad-hoc QA / test screenshots dropped here by Playwright runs
static/tmp/

# Home directory files (project root is /home/deploy)
.bashrc
.bash_history
.bash_logout
.profile
.ssh/
.docker/
.cache/
.config/
.local/
.gnupg/
.npm/
.nvm/
.pki/
.mcp.json
.sudo_as_admin_successful
.viminfo
.wget-hsts
.gitconfig
.pwd.swp
snap/
secure-backups/
screenshots/
test-results/
.playwright-mcp/
img/
/prod3/
test_venv/

# Home directory scripts (not part of project)
populate_stock_data.py
populate_stock_data_fmp.py
populate_top_cryptos.py
build_stock_symbols.py
update_descriptions.py
start-claude.sh
setup_nginx_ssl.sh
fix_docker_env.sh
stock_symbols.txt
test_symbols.txt
schema.sql
requirements.txt
FMP_SETUP_GUIDE.md
STOCK_DATABASE_README.md
event_trader_export_*.sql.gz
.worktrees/
worktrees/
DEVELOPERS.md

# Large media (videos served via CDN, not git)
static/video/

# Stale/archived service code (kept for reference, not deployed)
src/services/.token_radar_old_STALE/

# Performance benchmark artifacts (measured data, not checked in)
tests/performance/_artifacts/*.json

# SDK tooling side-effects (npm lock generated during napi build, not committed)
sdk/typescript/package-lock.json
dist-sdk/

# Local-only security working notes — never track (R88/R104)
*-LOCAL-ONLY.md
data/assets_vectordb/*.bak*

# Confidential BD / allocation notes — LOCAL ONLY, never push (V#300)
*.local.md
docs/bd/

# Fenced ET10 CLOB test-account secrets (buyclob10/sellclob10) — never commit
scripts/.clob10_creds.json
# Fenced AIB clob100 test-account secrets (buyclob100/sellclob100) — never commit
lib/prod3/mm2/.clob100_creds.json
lib/prod3/mm2/.clob200_creds.json
lib/prod3/mm2/.clob300_creds.json
.clob300_creds.json
.clob200_creds.json
.clob100_creds.json
.env.sandbox

# SECURITY-AUDIT-2026-06-10 #21 — never commit the substack-mcp-plus at-rest encryption key
.substack-mcp-plus/.key

# Wallet census reports: internal ops data, LOCAL ONLY (never commit)
reports/
data/market-history/_coverage_*.json
runs/
# performance-history runs ARE tracked — they accumulate for later analysis (operator deliverable)
!static/performance_history/runs/
!static/performance_history/runs/*.json

# LEVI #3 auto-applied basket params (runtime artifact, not source)
data/basket_tuned_params.json
scripts/seed_tokenized_stocks_harvested.json

# trendlaunch kit credentials (never commit)
lib/prod3/trendlaunch/.trendlaunch_creds.json
