# Local-only scratch (rescued from ~/nrouter/.scratch, 2026-07-17) — never commit
.scratch/
.agents/
.codex/

# macOS
.DS_Store
__pycache__/

# Real env files — the ONLY source of secrets is the vault at
# ~/.nrouter_admin_keys/env-creds/, and in-repo .env files are symlinks into it
# (skill: dot-env). The brain holds no service env of its own, so anything
# matching here is a stray — but the brain had NO .env pattern at all until
# 2026-08-03, so a stray dropped at this level would have been committed
# silently. Templates stay tracked.
.env
.env.*
!.env*.example

# Nested product repos (2026-08-02) — nrouter-brain is the workspace root you work
# FROM, so the product repos live here rather than as siblings of it. They are
# INDEPENDENT git repos with their own remotes and lifecycle; never track them
# here (a bare `git add -A` would otherwise commit them as gitlinks).
# NOT to be confused with nrouter-<domain>/ at this level, which ARE vendored
# --squash subtrees and ARE tracked.
/nrouter-app/
# The frontend left the mono repo 2026-08-14 and became /nrouter-app/ above;
# what remains (00-nrouter-db, 03-nrouter-backend, 04-nroutersdk, 98-profiling,
# tests) reverted to this name. Both are nested repos with their own remotes.
/nrouter-manage-company/
/nrouter-brand-marketing/
/nrouter-infra-cicd/
/nrouter-ent-ai-hub/
/nrouter-model-catalog-research/
/nrouter-rust-gateway/

# ⚠️ IF YOU ADD A REFERENCE CLONE AT THIS LEVEL, WRITE IT WITHOUT A TRAILING
# SLASH — the distinction is mechanical, not editorial.
# `nested-repo-list-parity.test.sh` derives the nested-repo list from this file
# with
#     grep -E '^/[A-Za-z0-9._-]+/$'
# so ANY root-anchored entry written WITH a trailing slash is read as another
# nested repo and turns that gate red (it did, 2026-08-13, on the first clone).
# Git treats `/name` and `/name/` identically here; the parity extractor does not.
# Follow-up worth doing: make that extractor block-scoped so this depends on a
# mechanism rather than on reading this comment.
#
# All read-only upstreams and frozen systems live here. The one tracked file is
# the gateway-clone inventory; nothing below it is a brain asset.
/reference/*
!/reference/gateway-examples/
/reference/gateway-examples/*
!/reference/gateway-examples/README.md

# Supabase CLI scratch — recreated in the cwd on every `supabase` invocation.
# Ignored rather than deleted repeatedly; holds only a linked-project pointer.
supabase/.temp/

# Playwright MCP page snapshots — written to the CWD by the browser tools on
# every navigate (e.g. verifying a prod deploy from the brain root). Transient
# verification output, never work product; Rule #18 bans repo-root writes, and
# the tool gives no way to redirect them, so ignore rather than fight it.
.playwright-mcp/
