# Byte-compiled / optimized / DLL files
__pycache__/
*.py[cod]
*$py.class

/.ruff_cache/

# C extensions
*.so
*.pyd

# Distribution / packaging
.Python
build/
develop-eggs/
dist/
# Per-purpose maturin --out directories. `dist/` alone does not cover them, so
# every local gate run left `dist-gates/`/`numdist-gates/` untracked in the repo
# root — the exact shape that turns a careless `git add -A` into a committed
# 1.6MB of wheels. The gates job (ci.yml) writes the first pair; the
# suffix varies by purpose, so match the family rather than chasing each new one.
dist-*/
numdist-*/
eggs/
.eggs/
lib/
lib64/
parts/
sdist/
var/
wheels/
# Keep the docker/wheels/ placeholder tracked — it is the COPY target in
# docker/Dockerfile so the image installs the CI-built wheel (no PyPI round-trip).
# Any actual built wheels dropped there (in CI) stay ignored.
!docker/wheels/
docker/wheels/*
!docker/wheels/.gitkeep
pip-wheel-metadata/
share/python-wheels/
*.egg-info/
.installed.cfg
*.egg
MANIFEST

# Unit test / coverage reports
htmlcov/
.tox/
.nox/
.coverage
.coverage.*
.cache
nosetests.xml
coverage.xml
*.cover
*.py,cover
.hypothesis/
.pytest_cache/

# Environments
.env
.venv
env/
venv/
ENV/
env.bak/
venv.bak/

# mypy
.mypy_cache/
.dmypy.json
dmypy.json

# Rust target directory and backups
target/

# Worktree-local build dir (`cargo ... --target-dir ./target-isolated`) — the
# shared global CARGO_TARGET_DIR both serializes and corrupts concurrent
# worktree builds, so every worktree build uses its own isolated target dir.
target-isolated/
# Worktree-local isolated build dirs (per-worktree cargo target-dir; see AGENTS.md)
target-*/
debug/
**/*.rs.bk
*.pdb
**/mutants.out*/
.idea/

# Model-generated transient scripts at root level
/test_*.py
/fix_*.py
/debug_*.py
/scratch_*.py
/temp_*.py
/*-BASELINE-NOTES.md
/*-WORKING-NOTES.md
/*-HANDOFF-NOTES.md
/*-SCRATCHPAD.md

# Transient logs, traces, patch files, and test outputs
*.orig
*.rej
*.patch
*.log
*output*.txt
*errors*.txt
failed_tests.txt
trace.txt

# SI agent scratch (do not commit) — keep repo roots pristine
/.specify/
!/.specify/
/.specify/*
!/.specify/memory/
/.specify/memory/*
!/.specify/memory/constitution.md
.agent/
.agents/
.agent_data/
.tmp/
.pytest_tmp/
.hypothesis/
site/

# Generated analysis output and scratch — these belong in the workspace-level
# reports/ directory, never in a package's commit history. A 3.0G build dir was
# one `git add -A` away from being committed here.
reports/
target-isolated/
target-*/
scratch/
.scratch/
*.log
*.orig
*.rej

# Maturin's per-target build lock. NOT covered by the `target-*/` rules above —
# those match DIRECTORIES; this is a dotfile at the repo root, named
# `.target.<name>-maturin.lock` when `CARGO_TARGET_DIR` is the default `target`,
# or `.<target-dir-basename>.<name>-maturin.lock` (e.g.
# `.target-isolated.epistemic-graph-maturin.lock`) when it's overridden — which
# it always is here, since `.cargo/config.toml` commits `target-dir =
# "target-isolated"` as this repo's own default. A stale zero-byte one from
# 2026-08-02 sat untracked in the canonical checkout and silently blocked EVERY
# epistemic-graph merge-queue drain, because the queue refuses to fast-forward a
# canonical checkout carrying uncommitted changes and an untracked file counts
# as one. `.target.*` alone never matched the `target-isolated` naming, so the
# same class of stray file recurred under this repo's own committed default.
.target.*
.target-isolated.*

# clients/js (D-EGTC-2's sibling gate): `npm install` materializes this from
# the committed package-lock.json every gate run — never commit the tree itself.
node_modules/

# CX-HYG-01 (check_gitignore_convergence.py, fleet-shared REQUIRED set):
# `kiss check` writes a self-calibrating .kissconfig the first time it runs --
# a ratchet that installs itself the moment it is trackable. Twin of
# check_root_hygiene.py's FORBIDDEN_ANYWHERE (which catches it if it is ever
# tracked anyway); this stops it from becoming stageable in the first place.
.kissconfig
# `kiss check` also writes a .kiss/ working directory of regenerated analysis
# caches; the hand-authored thresholds are tracked in .config/kiss.toml (not a
# baseline), so nothing under .kiss/ is ever committed.
.kiss/
# Root-hygiene: maturin's per-target build locks (<target>.<name>-maturin.lock),
# ad-hoc gate virtualenvs, security-harness evidence and the shared pipelines
# checkouts the Pages workflow (and a local docs build) creates.
*maturin.lock
.gates-wheel-venv/
security-results/
.pipeline-theme/
.pipeline-contract/
