# Python
*.pyc
__pycache__/
.coverage
*.py[cod]
*$py.class
.pytest_cache/
*.egg-info/
dist/
build/
.eggs/

# Virtual environments
.venv/
venv/
env/

# IDE
.idea/
.vscode/
*.swp
*.swo

# OS
.DS_Store
Thumbs.db
*.tmp
*.log

# PactKit - generated artifacts (auto-regenerated; not versioned).
# Named files, NOT the whole directory: the authored diagrams
# (system_design.mmd, workflow_graph.mmd, reverse_call_graph.mmd) live in the
# same directory and MUST stay tracked. A directory-wide rule is what let 7
# generated files stay tracked for four months — .gitignore does not apply to
# already-tracked paths (STORY-slim-2026091893aad6f3d8ac R3).
docs/architecture/graphs/call_graph.mmd
docs/architecture/graphs/class_graph.mmd
docs/architecture/graphs/code_graph.mmd
docs/architecture/graphs/module_graph.mmd
docs/architecture/graphs/report.html
docs/architecture/graphs/call_graph.db
docs/architecture/graphs/focus_file_graph.mmd
# Whole directory is safe HERE (unlike graphs/ above): every file is a
# version-stamped machine artifact ({version}_{mode}.mmd) — no authored
# asset lives here. Untracked 2026-09-18; 53 files were tracked while the
# rule said otherwise (STORY-slim-2026091893aad6f3d8ac).
docs/architecture/snapshots/

# PactKit - previously excluded for IP protection (repo is now private, all tracked)

# Claude Code local config
.claude/

# Codex CLI local config
.codex/

# GitHub Copilot deployment artifacts (generated by pactkit update).
# `.github/*` rather than `.github/`: git cannot re-include a file whose
# parent *directory* is excluded, so `!.github/workflows/` matched nothing
# and every new workflow file silently needed `git add -f` — the shape that
# would have dropped this repo's own drift gate without a word.
.github/*
!.github/workflows/

# Office files
~$*
*.pptx

# Secrets
.pypirc

# Playwright MCP
.playwright-mcp/

# Backup
*.bak
.mcp.json
.pactkit/
coder/
docker/
docs/slides/


# Call graph SQLite output (STORY-slim-121)
docs/architecture/graphs/*.db

# 准入的**待审内容**是中间产物，不是记录——`--prepare` 的产物每次都会被重写，
# 而它内嵌回执摘要（高熵串，会被 secrets 门当成凭据）。进 git 的是签核后的
# `<id>.json` 记录，那才是长期证据。
docs/architecture/governance/contract-admissions/*.proposed.json
