# Secrets — .env is kept locally for testing but must never be committed
.env
.env.*
!.env.example

# Vault artifacts (may contain ciphertext + wrapped keys; never commit)
*.db
*.db-wal
*.db-shm
*.sqlite
*.sqlite3
*.rdb
*.aof

# Audit logs (token ids only, but not for the repo)
*.jsonl
var/
audit*.log

# Model + dataset caches
.cache/
models/
*.onnx
*.onnx_data*
*.safetensors

# Python
__pycache__/
*.py[cod]
.venv/
venv/
*.egg-info/
build/
dist/
.mypy_cache/
.pytest_cache/
.ruff_cache/
.hypothesis/

# Eval outputs / ratchets
eval-ratchet.json
report.md
out.json
out.md
