.venv/
.venv-*/
__pycache__/
*.py[cod]
.pytest_cache/
.pytest-*/
pytest-cache-files-*/
.pytest-tmp/
.review-basetemp-*/
.tmp-product-benchmark/
.bench-*/
.benchmark-*/
.semantic-latency-*/
benchmarks/corpus/generated/
benchmarks/runs/
benchmarks/private/
.codex-manual-cache/
.python-write-probe/
.surface-probe/
.superpowers/
.task/
.uv-cache-*/
.og-previews/
.push-clone-test/
.pypi-*-test-*/
.coverage
.env
logs/*
!logs/.gitkeep
analysis/
*.tmp
dist/
build/
.exomem-private/
*.egg-info/

# Local-only maintainer scratch that may hold real personal tokens — never commit.
scripts/generic/leakguard.txt
scripts/generic/substitutions.txt

# Agent / session scratch — never publish (holds absolute machine paths,
# session transcripts, and project memory). Untracked but present in working
# checkouts; ignored so a stray `git add` can't leak them into the public repo.
.omc/
*.storage-state.json
# Ignore everything under .claude/ EXCEPT shared tooling that should travel with
# the repo (OpenSpec's /opsx: commands). settings.local.json, skills/, and
# worktrees/ (machine paths) stay ignored.
.claude/*
!.claude/commands/

# Hosted IaC: state, plans, generated inventory, and plaintext secret material.
**/.terraform/*
*.tfstate
*.tfstate.*
*.tfplan
*.plan.json
*.auto.tfvars
*.tfvars
*.tfbackend
!*.tfbackend.example
!*.tfvars.example
infra/ansible/inventory.yml
infra/ansible/group_vars/hosted_nodes.yml
infra/helm/*/charts/
infra/secrets/*.dec.yaml
infra/secrets/*.plain.yaml
infra/secrets/**/*.dec.*
infra/secrets/**/*.plain.*
infra/secrets/**/*.decrypted.*
infra/secrets/age.key
infra/secrets/*.agekey
infra/secrets/**/*.agekey
infra/secrets/receipts/**/*.handoff.lock
infra/provisioner/.mypy_cache/
infra/provisioner/.ruff_cache/
infra/provisioner/.pytest_cache/
infra/provisioner/*.sqlite*
.refs.sqlite
.lexical.sqlite*
snapshot_report.html
