# Python
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
/build/
/dist/
*.egg-info/
.eggs/

# Virtual environments
.venv/
venv/
env/

# Testing & coverage
.pytest_cache/
.coverage
.coverage.*
htmlcov/
coverage.xml
.hypothesis/

# Editors / OS
.DS_Store
.idea/
.vscode/
*.swp

# Secrets / env
.env
.env.local
*.pem

# Run artifacts (regenerated by the CLI report and dataset commands)
/reports/
/datasets/
/eval-results.xml

# Claude (local settings stay ignored; versioned skills/hooks are tracked)
.claude/*
!.claude/skills/
# The InstructionsLoaded probe (#547) must exist in a FRESH CHECKOUT — a cloud
# session clones the repo, so an untracked hook simply does not exist in the
# sessions #544 needs it for. `settings.local.json` deliberately stays ignored.
!.claude/settings.json
# Re-include the directory, then ignore its contents, then negate the one file:
# git cannot re-include a file whose parent is excluded, so the order matters.
# Negating the whole directory would make a contributor's private hook script
# untracked-and-visible, and `git add -A` sweeps those.
!.claude/hooks/
.claude/hooks/*
!.claude/hooks/log_instructions_loaded.py
# ...the probe's OUTPUT is never tracked. Left ignored by `.claude/*` above.

# npm install output, at ANY depth. Path-specific rules missed a root-level
# node_modules/.vite cache written by a vitest run whose cwd was the repo root.
node_modules/

# Console frontend (built assets ship in wheel, not committed)
sengol/console_static/
console/*.tsbuildinfo

# Vitest browser-project output: a failing test writes a screenshot beside
# itself and an attachment under the project root. Both are run artifacts of
# a failure, not fixtures — the browser tests assert computed styles and
# layout, never a stored image.
console/.vitest-attachments/
console/src/**/__screenshots__/

# @sengol/instrument (built dist/ ships to npm, not committed)
typescript/instrument/dist/

# Terraform runtime artifacts — never commit (plans embed variable values)
terraform/aws/.terraform/
terraform/aws/.terraform.tfstate.lock.info
terraform/aws/*.tfstate
terraform/aws/*.tfstate.*
terraform/aws/tfplan*
# Generated by the internal Terraform pipeline (never committed — keeps the
# customer-facing terraform/aws free of sengol-internal backend config).
terraform/aws/backend_override.tf
terraform/internal/bootstrap/.terraform/
terraform/internal/bootstrap/*.tfstate
terraform/internal/bootstrap/*.tfstate.*
terraform/internal/bootstrap/.terraform.tfstate.lock.info
.sengol/

# Licence trust anchors are public keys and must ship in the wheel.
!sengol/governance/trusted_keys/*.pub.pem
.pytest_run*.log

# Scratch spec the CI oasdiff step generates; the tracked baseline is openapi.yaml
sengol/api/openapi_ci.yaml
