# Credentials and local state — never committed.
# platform/.gitignore also applies to its own subtree; these are the root-level rules.
.env
.env.*
!.env.example
**/secrets/
*.pem
*.key

# Local tooling and caches
**/venv/
**/.venv/
**/__pycache__/
*.pyc
.pytest_cache/
**/node_modules/

# Large binaries fetched by scripts, not source
platform/bin/

# Local data and scratch
*.duckdb
**/tmp/
.DS_Store

# Local agent/session state (worktrees, settings.local.json) is not project content. The project-level
# Claude Code settings, slash commands and skills ARE: they must reach every checkout, including the
# cloud environments where most development happens (docs/cloud-environment.md).
.claude/*
!.claude/README.md
!.claude/settings.json
!.claude/commands/
!.claude/skills/

# Receipts and documents with personal identifiers or account numbers: kept locally, never committed
**/private/

# OpenTofu (infrastructure/tofu): provider cache, local state, generated scratch
.terraform/
*.tfstate
*.tfstate.*
*.tfplan
infrastructure/tofu/**/generated.tf
.terraform.lock.hcl.tmp

# OpenTofu variable files with values (infrastructure/tofu/*)
*.auto.tfvars
*.tfvars.json
