.venv/
__pycache__/
*.pyc
.pytest_cache/

# Hidden-pool probes must NEVER be committed to this PUBLIC repo. The real boundary is a
# separate PRIVATE hidden-probe catalog repo; this is only a backstop.
**/hidden/
catalog-hidden/

# GRADING OUTPUT MUST NOT BE PUBLISHED. A results file names real third-party apps and carries, per finding, a
# paste-to-reproduce request against a live deployment — the v9/v10 corpus runs alone held 1,709 named Devpost
# projects and 8,825 repro blocks. Black-box scanning of a public URL is one thing; publishing per-app
# reproduction steps against someone else's submission is a different act, and it contradicts the product's own
# guardrail (hand the builder back a private report, upside-only).
#
# THIS FILE IS THE SOURCE OF TRUTH FOR BOTH REPOS, and that is the whole point. The league -> mirror sync is
# `rsync --delete` followed by `git add -A`, so rsync OVERWRITES the mirror's .gitignore with this one on every
# sync — a fix applied only on the mirror side survives until the next sync and then silently un-ignores
# everything (observed, not hypothesised). The sync command also carries matching --exclude flags; this is the
# backstop for when one is forgotten.
#
# *.jsonl and NOT *.json: validation/benchmark-curve.json is the frozen scoring curve and must stay tracked.
*.jsonl
*.log
*.tsv
v9-baseline-stats.json
nextjs-trace-sample.txt
sprint-sample.txt
terminal output of test.md

# Diagnostic URL worklists carry hundreds of named third-party apps (the v11 session-gap list is 311). Same
# reasoning as the grading output above: black-box scanning a public URL is one thing, publishing the list of
# who we scanned is another. Keep the *pattern* here so a regenerated list is covered without anyone rememb-
# ering to add it.
*.urls.txt
