# ============================================================================
# COHESION — gitignore
# Principle: nothing sensitive or machine-specific gets committed.
# ============================================================================

# --- OS / editor cruft ------------------------------------------------------
.DS_Store
Thumbs.db
.obsidian/workspace.json
.obsidian/cache/
.vscode/
.idea/
nul

# --- Session ephemeral caches ------------------------------------------------
.tmp-audit/
.tmp-prdiffs/
.tmp-sessions/

# --- Logs -------------------------------------------------------------------
*.log
*.pid
*.seed

# G06 memory-reliability: probe-history logs MUST commit so diff-vs-yesterday works.
!scripts/probe-history/*.log

# --- Secrets / credentials (defense in depth) -------------------------------
.env
.env.*
*.env
!.env.example
secrets.json
secrets.local
credentials.json
credentials.local
*.key
*.pem
# SSO test fixtures need to be checked in (CI module-load requires them); never use real keys here
!scoring-api/tests/fixtures/sso-saml/*.pem
*.p12
*.pfx
*.crt
*.cer
*.der

# --- Cloudflare wrangler local caches (contain account id + geolocation) ---
.wrangler/
**/.wrangler/

# --- Claude Code per-machine tool allowlists (may contain demo keys) --------
**/.claude/settings.local.json
.claude/settings.local.json

# --- Claude worktrees (git manages these via .git/worktrees metadata) --------
.claude/worktrees/
**/.claude/worktrees/

# --- Claude agentic-os runtime state (hook ring buffers, not source) --------
.claude/agentic-os/state/
**/.claude/agentic-os/state/
.claude/agentic-os/_state/
**/.claude/agentic-os/_state/

# --- Dependencies -----------------------------------------------------------
node_modules/
.venv/
venv/
__pycache__/
*.pyc

# --- Test / coverage / build artifacts --------------------------------------
coverage/
# Dashboard buildout 2026-05-14 — /coverage is the customer-facing
# Coverage Telemetry route, not a test-coverage report artifact. Tracked.
!dashboard-app/src/pages/coverage/
!dashboard-app/src/pages/coverage/**
test-results/
playwright-report/
*.lcov
.nyc_output/
.coverage
.coverage.*
.pytest_cache/
.ruff_cache/
htmlcov/
.tox/
.mypy_cache/

# --- Lighthouse CI ----------------------------------------------------------
.lighthouseci/
.lhci-chrome-profile/
.lhci-tmp/
website/.lighthouseci/
website/.lhci-chrome-profile/
website/.lhci-tmp/
lighthouse-*.json

# --- Seed script machine-readable output (gitignored per spec §A5.4) ---------
.tmp/

# --- Local scratch / deploy staging -----------------------------------------
.deploy-stage/
.deploy-prod/
.superpowers/

# --- Backup + swap files ----------------------------------------------------
*.bak
*.swp
*.swo
*~

# build artifacts
sdk/python/dist/
website-dist/

# local tooling
.gstack/
.obsidian/

# Transient orchestration debris (codebase quality scan working files, PR diff dumps)
.scan-tmp*
.tmp-*.diff

# Codex/Gemini adversarial review artifacts (per executor binding rules)
scratch/

# Design-drop scaffolding (claude.ai integration brief + standalone preview)
preview.html
DROP_NOTES.md
e2e-scratch/
docs/audits/_e2e_sources/
tmp/
probe_*.txt
tmp_gitstate.txt
_*.txt
*.vtt
*.bak-*
.parity-diag/

# raw three-brain CLI transcripts (huge, quote test fixtures that trip gitleaks); curated outputs are committed
three-brain-out/**/codex-review.md
three-brain-out/**/codex-fold-validation.md
scoring-api/wpa-m1-pre-apply-*.sql
