# Python
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
venv/
ENV/
.env
.env.*
!.env.example

# Sensitive files - NEVER COMMIT
ACHIEVEMENT_REPORT.md
IDENTITY_MAP_PRIVATE.md
*.secret
*.credentials
key.properties
.secrets/

# Archive dirs — preserved on external SSD per archive-only convention.
# Re-create from /Volumes/Samsung SSD 990 PRO 2TB Media/Archives/ if needed.
_attic/
ai_buddy_web_backup/
*_backup/

# Flutter/Dart
.dart_tool/
.flutter-plugins
.flutter-plugins-dependencies
.packages
.pub-cache/
.pub/
# Exclude all build directories except web
ai_buddy_web/build/
!ai_buddy_web/build/web/
!ai_buddy_web/build/web/**
.metadata
*.iml
.idea/
.vscode/

# macOS
.DS_Store
.AppleDouble
.LSOverride

# IDE
*.swp
*.swo
*~

# Logs
*.log
logs/
*.log.prev
backend.log.prev

# Local development
instance/
.webassets-cache
.env.local
.env.development.local
.env.test.local
.env.production.local

# Local signing env file for Android release scripts
scripts/android_signing.env
# Local signing env file for iOS release scripts
scripts/ios_signing.env
*.db

# Dependencies
node_modules/
jspm_packages/

#Miscellaneous
full_project.md

# Local private documents (not committed, accessible to Windsurf)
.local/

# Archive and debug files
archive/

# iOS local overrides (do not commit)
ai_buddy_web/ios/Config/local-overrides.xcconfig

# Android signing files (also ignored in android/.gitignore)
ai_buddy_web/android/key.properties
**/*.keystore
**/*.jks
# MDR_008: Private Brain (entire folder except required synthesis docs)
.brain/*
!.brain/
!.brain/.gitkeep
!.brain/artifacts/
.brain/artifacts/*
!.brain/artifacts/synthesis/
.brain/artifacts/synthesis/*
!.brain/artifacts/synthesis/ARCHITECTURE_MAP.md
!.brain/artifacts/synthesis/OPERATIONS_PLAYBOOK.md
!.brain/artifacts/synthesis/API_CONTRACTS.md
!.brain/artifacts/synthesis/EXTENSION_GUIDE.md
!.brain/artifacts/synthesis/DECISION_LOG.md
!.brain/artifacts/synthesis/ENVIRONMENT_MATRIX.md
!.brain/artifacts/synthesis/CRITICAL_PATHS.md
!.brain/artifacts/synthesis/TECH_DEBT_REGISTRY.md
!.brain/artifacts/synthesis/MASTER_CONTEXT_INDEX.md
!.brain/artifacts/synthesis/TESTING_STRATEGY.md
!.brain/artifacts/synthesis/SECURITY_CHECKLIST.md
!.brain/artifacts/synthesis/AI_PROVIDER_SPECS.md

# Phase E ambient supervisors — install source for ~/.hammerspoon/. Checked in
# so the wedge travels with the repo (see Install: header in each .lua).
!.brain/hammerspoon/
!.brain/hammerspoon/*.lua

# Phase D contract + tag vocabulary. Not runtime state — checked in so the
# substrate contract travels with the repo. Buckets themselves stay ignored.
!.brain/wiring/
!.brain/wiring/*.md
!.brain/relay/
.brain/relay/*
!.brain/relay/tag_log.jsonl
# Common Problem Board (ADR-0033 SCOPE A) — README + seed posts are tracked
# fleet docs. _claims (atomic-mkdir sentinels) and _archive (TTL'd) stay out.
!.brain/relay/board/
!.brain/relay/board/README.md
!.brain/relay/board/*.json
.brain/relay/board/_claims/
.brain/relay/board/_archive/

# CC-behavior policies — repo-visible mirror of load-bearing CC-agent rules
# previously visible only in Cowork's auto-memory sandbox. See AGENTS.md Pointers.
!.brain/policies/
!.brain/policies/*.md


# Nuclear Brain runtime (legacy specific rules)
.brain/.flywheel.pid
.brain/flywheel.log
.brain/.state.lock
.brain/.sync_state.json
secret/service_account.json
backend_config.env
venv_39/

# Build artifacts
release_v1.0.0.zip

# Brain archive and backups (local only)
.brain-archive/
.brain-backup-*/

# Nucleus MCP Sync Metadata
**/*.meta
**/*.conflict
.nucleus_agent
.sync_last

# Demos - Ignore large media and temp frames
demos/*/frames/
demos/*/*.mov
demos/*/*.mp4
demos/**/temp_shorts/
demos/**/*_frames/
demos/**/captions/
demos/**/production/

# Test output artifacts
test_output/

# Health check artifacts (auto-generated)
meta/health_checks/

# Conversation exports (private)
claude project export data-*/

# Temp files
tmp/

# ============================================================
# PUBLICATION PROTOCOL — SOVEREIGN (never public)
# ============================================================
# Moat strategy docs
DATA_MOAT_SUMMARY.md
*MOAT*.md
*MOAT*.ipynb
*SUPER_PROMPT*.md
*HANDOFF*.md

# Competitive analysis
*COMPETITIVE*.md
*OPENCLAW*.md

# Launch internals (strategy, not product)
nucleus-launch-internal/

# Internal prompts and agent workflows
.agent/

# Test brain instances and local state
.brain_test*/
.telemetry/
engrams/

# Cloudflare local dev cache
.wrangler/

# Sync transient data
nucleus-launch-internal/sync/inbox/
nucleus-launch-internal/sync/outbox/

# Demo generated assets
demos/**/sovereign_test/
demos/**/one_shot_output/

# Individual scratch/temp files at root
*.mp4
*.txt
!README*.txt
gemini-conversation-*.json
.gemini-sessions.json
.nucleus_heartbeat

# Session/context local state
session/

# GCP service account keys (NEVER commit)
key.json
*.json.key
service_account*.json
# never track anything under secret/ — bespoke-named key files dodged the old patterns (2026-07-02)
secret/

# Database backups (local only)
*.sql
!**/migrations/*.sql

# iOS build artifacts (binary)
release_artifacts/
*.ipa
*.apk
*.aab

# Temp test files at root (anchored: bare test_*.py silently ignored every
# new test file repo-wide, e.g. mcp-server-nucleus/tests/ — negations below
# were root-relative and did not cover subprojects)
/test_*.py
twin_spyglass_test.py
tmux_live_fire_test_2.py
update_tasks.py
billion_dollar_script.py
perfect_sync_test.py
nightly_auditor.py
ssl_monitor.py
db_monitor.py
task_005_db_monitor.py
task_006_env_script.sh
redeploy_hud.py
redeploy_hud.sh
gemini_proxy.py
fix-gemini-auth.sh
fix_cloudbuild_password.py
force_trigger_env_test.py
force_trigger_test.py
patch_cron.py
compliance_demo.html

# Temp root-level markdown (one-off reports)
CURRENT_STATUS.md
DNS_HARDENING_COMPLETE.md
PR_CHECK_ANALYSIS.md
REMINDERS.md
ROOT_README.md
SECURITY_RECOVERY_REPORT.md
SELF_HEAL_COORDINATOR_TEST_SUITE.md
VERTEX_AI_SETUP.md
cli_changes.md
shortcut_plan.md

# Temp directories
-d
.brain-id
metrics/
notebooks/
orchestration/
launch/
training/

# Nucleus test/temp files
nucleus/.brain/
nucleus/agents/
nucleus_accuracy_receipt.json
openclaw_benchmark_results.json
models.json
gemini-policy.json
ledger/

# Test screenshots and artifacts
test/screenshots/
test/all_results.json
test/chat_latency_results.json

# Duplicate app directory (if exists) — leading slash so we only ignore
# the duplicate at repo root, not legitimate `app/` subdirs like the
# Flutter Android module's `android/app/`.
/app/

# One-off test scripts at root
test_autonomic_blocker.sh
test_genai.js
test_nucleus_engram.sh

# One-off test directory (not tests/) — leading slash so we only ignore
# the root-level `test/` scratch dir, not legitimate `test/` subdirs like
# `ai_buddy_web/test/` (Flutter's standard test location).
/test/

# Lock files
mcp-server-nucleus/test_metadata.lock

# Nucleus public assets (separate repo)
nucleus-public-assets/

# Backend duplicate
backend/

# Stale third-party clone path — @michaellatman/mcp-get is deprecated
# (publisher recommends Smithery). The dir was once a nested clone; the
# gitlink has been untracked. Keep this entry so any future re-clone into
# the same path is silently ignored instead of becoming a new orphan.
mcp-get/

# Drift-cleanup hygiene (2026-04-24) — local env dirs, per-user caches,
# coverage artifacts, and build output that should never reach origin.
.venv/
.nucleus/
.gemini/
.worktrees/
.claude/skills/
settings.json
.coverage
scripts/.probe_test
nucleus-scan/build/
nucleus-scan/dist/
nucleus-scan/*.egg-info/

# Stray .vsix build outputs in mcp-server-nucleus/ root (wrong location —
# tracked builds live in extensions/nucleus-bridge/ + archives/). Local
# rebuilds drop them in the parent dir which clutters `git status`.
mcp-server-nucleus/*.vsix

# Root-level *.vsix build outputs (mcp-server-nucleus/*.vsix is also gitignored per PR #190)
/*.vsix

# Pseudonymity Guard (WS5 addition)
.helm-diag/
ai_buddy_web/build_log_*.txt
ai_buddy_web/ios/Flutter/Generated.xcconfig
ai_buddy_web/ios/Flutter/flutter_export_environment.sh
claude project export data-2026-01-22-*

# 2026-06-18 burn closeout: ephemeral session/scratch paths
.claude/scheduled_tasks.lock
.devin/
mcp-server-nucleus/scratch/
mcp-server-nucleus/src/scratch/**
scratch/
extensions/nucleus-bridge-chrome/node_modules/
docs/design/refs/screenshots/oracle-run-*/
# Session-event log accumulates per session; tracked at fixed seed only
.brain/ledger/events.jsonl
.brain/ledger/activity_summary.json
mcp-server-nucleus/src/scratch/stranger_repo
mcp-server-nucleus/src/scratch/stranger_repo/
ai_buddy_web/build
ai_buddy_web/build/
scripts/distribution-officer/queue/_paused_until_operator_unpause/

# Agent tool worktree-isolation dir (Claude Code Agent tool, isolation: worktree)
.claude/worktrees/

# Playwright MCP browser artifacts (QA screenshots/page dumps)
.playwright-mcp/

# Backup files
*.bak
.env.zoho-mail
wrong_type/

# Unified secret resolver pointer (per-repo, never commit)
.secrets-map.json
