ansible/provisioning/artifacts/
.retry
ansible/provisioning/env/extravars
ansible/provisioning/debug_paths.yml
.env
.DS_Store

*.sql
*.tar.gz
*.zip

# Python
__pycache__/
*.py[cod]
*$py.class
.env
.venv
env/
venv/
ENV/
env.bak/
venv.bak/

# Node
node_modules/
dist/
dist-ssr/
*.local
.vite/
coverage/

# IDEs
.idea/
.vscode/
*.swp
*.swo
config/.ghcr-token
config/.hcloud
.vault_pass

# Project Specific
*.db
tmp/

# LLM dashboard tool (install locally with npm install)
.llm/dashboard/node_modules/

# Claude Code project config — only local overrides ignored
.claude/settings.local.json
.env.secret.new
agent/.dockerignore
analyze_vault.py
backend/app/features/identity/notifications.py.remote
backend/app/main.py.remote
backend/app/services/openbao.py.remote
backend/provision_all_vaults.py
backend/scripts/migrate_vault_to_namespaces.py
backend/scripts/verify_vault_migration.py
# backend/tests/ — promoted to tracked 2026-05-01 so .woodpecker.yml's pytest
# step has files to run. Only artifacts stay ignored.
backend/tests/__pycache__/
backend/container_collector_bundle/
check_orphimuse_vault.py
# frontend/src/test/ + frontend/vitest.config.ts — promoted to tracked
# 2026-09-06 for the same reason as backend/tests/ above: both were silently
# ignored, so vitest's real config (globals/jsdom/setupFiles/coverage) and
# its setup file only ever existed on one local checkout and were never
# committed. Every *.test.tsx in the repo failed with "ReferenceError:
# expect is not defined" under the documented `npm test` as a result.
grafana_vault_audit.json
infra/promtail/
monitoring.yml.tmp
scripts/backfill_platform_vault.py
scripts/vault_logrotate.conf
test_local_vault.sh
tmp_cleanup_vault.py
validator/
validator_design.md
vault/
vault_analysis_report.json
*.tfstate*
.env.builder
.terraform/
# Added by code-review-graph
.code-review-graph/

# Local MCP config (contains tokens)
.mcp.json

# Resend API key
config/.resend

# TypeScript build artifacts
*.tsbuildinfo

# Local static-site artifacts (dev bind mount)
.data/

# Shared packages WIP — canonical home is ~/Development/mozbridge-packages/
mozbridge-packages/

# Claude skill directories (nested git repos, not submodules)
tmp-ai-skills/
.agent/skills/

# GitHub App private key (operator credential — never commit)
*.private-key.pem

# CruxHive: local knowledge index + usage log (do not commit)
.llm/cruxhive.db
.llm/cruxhive.db-shm
.llm/cruxhive.db-wal

# CruxHive: generated / ephemeral local state (regenerated per session)
.envrc
.llm/pending/
.llm/digests/
.llm/lore/
.llm/memory/platform_refs.md
.llm/extracted/

# generated by scripts/sync-agent-toolchain.sh — do not commit
.opencode/commands/
.agents/skills/

# Untracked 2026-07-12 after gitleaks found committed Vault keys — see security-findings.md
.env.secret
.env.db_provisioned

# CI runtime secrets. `fetch-secrets` writes the GHCR PAT and deploy params
# here inside the pipeline's git workspace, and later steps run `npm ci` /
# `pip install` as root in that same directory — so any dependency lifecycle
# script could read it. Never commit it; chmod 600 is not a boundary when
# the reader is root in the same container.
.secrets

# iOS archives / TestFlight export (regenerated by deploy-ios.sh)
ios/MozbridgeMobile/build/
ios/MozbridgeMobile/*.xcarchive

# Apple APNs Auth Keys (download once from developer.apple.com — never commit)
AuthKey_*.p8
**/AuthKey_*.p8

# Daemon runtime state. These were tracked, so a running daemon rewrote a tracked
# file every 30s and committed a machine-specific PID. Runtime state, not source.
.llm/daemons/*.pid
.llm/daemons/*.heartbeat.json
