# Python
__pycache__/
*.py[cod]
.venv/
*.egg-info/
.pytest_cache/
.ruff_cache/

# Dagster
.dagster_home/
tmp_dagster*/

# dbt
dbt/target/
dbt/dbt_packages/
dbt/logs/
logs/

# DuckDB / local data (raw is in R2, never in repo)
*.duckdb
*.duckdb.wal
.localstore/
# Pre-R2 staged objects moved out of .localstore on 2026-09-07 so a local gold build
# agrees with CI. Data, and the ONLY copy of it — never commit, never delete.
# See docs/ops/UNREADABLE_COHORT.md.
.localstore-prer2-quarantine/

# Source filings are copyrighted — S009 extracts facts only; PDFs never enter the repo.
# (filings/v1_issuers.csv, the issuer list, stays tracked.)
filings/*.pdf
quality/results/*.json

# Secrets — never in repo (hard rule)
# Every .env variant, not just the bare name. A `.env.bak` written while editing is
# NOT covered by `.env` alone, and it holds the same secrets — one `git add .` away
# from a committed credential. Nearly happened on 2026-08-24.
.env
.env.*
!.env.example
*.pem
credentials*

# OS
.DS_Store
Thumbs.db
dbt/.user.yml

# Phase 0 remote-tooling workarounds — obsolete now the CI files live in .github/
_protected_copy/
dataco.git.bundle

# Node (services/*)
node_modules/

# Cloudflare wrangler local cache/state (contains account metadata; regenerated on demand)
.wrangler/

# Deployed-container runtime state (deploy/*/docker-compose.yml + RUNBOOKs stay tracked).
# Holds live secrets/auth — changedetection's secret.txt, ntfy's auth.db — so it must never
# enter the repo; the containers recreate it on start.
deploy/changedetection/datastore/
deploy/ntfy/cache/

# Dagster ephemeral home dirs
.tmp_dagster_home_*/

# Generated release artifacts (regenerate via pipelines.publish.release / reports.quarterly)
dist/

# PHASE-16A release-gate runtime state — staged signed artifacts and Datarade kits ARE regenerated
# by each gate/release run, so they are build output and belong here.
#
# THE DELIVERY LOG IS NOT, AND SAT HERE UNTIL 2026-09-04 UNDER EXACTLY THAT CLAIM. It is append-only
# history — the only record that a given version reached a given platform. Nothing regenerates it,
# because nothing can: the evidence is the act of publishing. `already_published()` reads it for
# idempotency and STATE.md's `last_published` block is rendered from it, so on a checkout without it
# the block renders "nothing was ever published" and a re-release re-publishes rather than no-ops.
# It lived on one laptop while STATE.md asserted three live datasets and outreach cited them.
#
# Now TRACKED. See .gitattributes for the union merge that keeps two machines' appends from
# conflicting, and exports/tests/test_delivery_log_is_tracked.py for the guard that keeps a future
# tidy-up from re-ignoring it.
#
# The schema baseline (exports/state/released_schema/) is the schema-tripwire's memory of the last
# released schema and IS tracked for the same reason, so a schema change flips RED in CI on every
# machine.
exports/state/staging/
exports/state/datarade_kit/

# trained model + training artifacts (never commit — >100MB, regenerable)
# ANCHORED with a leading slash on purpose: bare `models/` matches a directory at ANY depth, so it
# also swallowed dbt/models/. Tracked dbt models still staged fine (ignore rules do not apply to
# tracked files), which is why this went unnoticed — but every NEW dbt model was silently skipped by
# `git add`, with no error, and needed `git add -f`. gold_tender_party_name_map.sql hit exactly that.
/models/
/checkpoints/

# stray local export (not a data product)
/gold_tender-selected-columns.csv

# PHASE-10A: locally-generated live shadow cases embed raw filing page text (S009: extract
# facts, never reproduce the document) — never commit. Regenerate with learning.canaries.shadow_cases.
learning/canaries/frozen/canary_cases.jsonl

# Pre-change backups written by in-flight edits — git history is the backup.
*.pre-*.bak  # any pre-edit backup: .pre-ns, .pre-6c, .pre-val ... history IS the backup

# PHASE-8C: recorded planner responses. Model OUTPUT, not fixtures — kept out of git so it
# never becomes a review diff or gets hand-edited in a PR. Re-record with
# `python -m copilot.cassettes --record`; staleness is a gate, see copilot/cassettes.py.
copilot/.cassettes/

# Backups of live KV auth records, written by services/backfill_key_acct.py before it writes.
# Operational safety copies, not repo content.
dist/kv_keys_backup_*.json

# Dated investor artifacts — regenerate with `make value-report`; not repo content.
reports/value_report_*.pdf

# Verification fetch cache — immutable filings, re-downloadable. Not repo content.
dist/.fetch_cache/
quality/results/runs/

# Schemathesis example database (quality/api_schemathesis.py); local run state, never committed.
.schemathesis/
