# Python
__pycache__/
*.py[cod]
*.egg-info/
build/
# `dist/` at any depth, which deliberately covers `node/dist/` — the Node read
# plane's BUNDLE, generated by `python -m fux.store.nodebundle` and shipped from
# the release workflow (L10, records/0011_LAW-10-bundled-output.md). Build
# output is never committed; the wheel builds its own copy through hatch_build.py.
dist/
.venv/
venv/

# macOS
.DS_Store

# Fux's own directory is NOT blanket-ignored. Committed: index/, sources/,
# fetchers/, decoders/, enrich/, tune.toml, output.toml, pii.toml,
# refusals.toml, .fuxignore, README.md and .gitignore. Only runtime/ (derived)
# and acquired/ (re-acquirable) are ignored, and they are listed BY NAME in
# .fux/.gitignore, which fux writes — a `.fux/*` blanket here would silently
# drop a committed plane, which is exactly what `fux doctor`'s check-ignore
# assertion exists to catch. See SR-DOTFUX (records/0003_fux-directory.md).
#
# Corrected 2026-09-05: this named `middleware/`, which has never existed under
# `.fux/`, and cited "ADR-0011" — a number, from the archived v0.26 line, which
# CLAUDE.md forbids in a live document. The list above is `store/fuxdir.py`'s
# COMMITTED + COMMITTED_FILES, read from source.
.pytest_cache/

.session-lock
.locks/
.progress-nudged

# Per-machine Claude Code settings — a local permission cache, never shared.
.claude/settings.local.json

_to_delete/

# The golden benchmark's answer key — Arpit's, and no agent reads it by any
# route. That is LAW L11 — records/0012_LAW-11-sealed-answer-key.md, generated
# into CLAUDE.md §Non-negotiable constraints.
#
# ⚠ Since L11 decision 3 (Arpit, 2026-09-18) a key MAY exist on his machine, at
# ONE address — `work/golden/golden-answers/`, the plural, canonical spelling.
# Staying out of git is half of what makes that permission safe: never in
# history, never on a remote, and skipped by `rg` and Claude Code's Grep by
# default. Back it up by hand. The singular line below stays because a guard
# that covers only the live spelling is a guard that reads green while the other
# one is open. This entry is ONE OF FIVE GUARDS and not one of them is a
# guarantee — records/0066_WORK-golden.md; the process is work/golden/README.md,
# and tests/test_golden_key_guards.py fails if any of the five narrows.
work/golden/golden-answers/
work/golden/golden-answer/

# 🔴 AND ANYWHERE ELSE IT LANDS — added 2026-09-12 after the rule above was
# found to be one path and the key was somewhere else. A copy of it was written
# to `Claude outputs/golden-answer/` and was STAGED, one `git commit -a` from
# being in history permanently and in every clone. The path rule above did not
# reach it because the path rule is a path.
#
# ⚠ The name is the thing to ignore, not the location. A key that leaks does not
# fail loudly — it yields a benchmark number that looks clean, forever.
# ⚠ NO TRAILING SLASH, and that is the whole point of this line. A pattern
# ending in `/` matches a DIRECTORY, so `**/golden-answer/` covered the singular
# spelling only while the directory existed — after Arpit deleted it on
# 2026-09-15 the pattern matched nothing, and a key written back to that exact
# path would have been trackable. Found by tests/test_golden_key_guards.py on
# 2026-09-20. This form matches a file or a directory, on either spelling, at
# any depth.
**/golden-answer*
**/golden-answer/
**/golden-answers*
**/answers.jsonl
