# Python
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
.venv/
venv/
env/
*.egg-info/
.pytest_cache/
.mypy_cache/
.ruff_cache/

# Node
node_modules/
.npm/

# Build artifacts
dist/
build/
*.whl

# Local secrets / state
.env
.env.local
*.token
*.key

# OS
.DS_Store
Thumbs.db

# Editor
.vscode/
.idea/

# Forensic corpora (big binaries — pulled by scripts, never committed)
corpus/
*.E01
*.dd
*.raw
*.vmem
*.mem
*.lime
*.dmp

# Volatility 3 symbol packs
symbols/

# Working state
.pair/
tmp/
*.log
logs/*.jsonl

# Benchmark intermediate output
benchmarks/runs/
benchmarks/cache/

# But keep these
!logs/.gitkeep
!corpus/.gitkeep
!symbols/.gitkeep

# Sandboxed local forensic tools (large, machine-specific)
.oath-tools/

# Per-run logs / envelope store / signing keys (machine-specific)
logs/
.oath/
keys/
.claude/
log2timeline-*.log.gz
psort-*.log.gz

# Paper-build artifacts (source + PDF are archived on Zenodo, not in-repo)
oath.tex
oath.pdf
oath.aux
oath.bbl
oath.blg
oath.log
oath.out
oath.bib
oath_*.png

# Local video composition (the recording lives outside the public repo)
video/
