# Rust
target/
**/*.rs.bk
# Cargo.lock is committed — required for reproducible Docker builds

# TypeScript
node_modules/
dist/
*.js.map

# Python
__pycache__/
*.pyc
.venv/
venv/

# IDE
.idea/
.vscode/
*.swp
*.swo

# Environment
.env
.env.local
.env.*.local

# Credentials / Service Account Keys
*-credentials.json
*-key.json
*.keyfile.json
*.pem
service-account*.json

# OS
.DS_Store
Thumbs.db

# Build
*.o
*.so
*.dylib
out/

# Compiled binaries
terraform/terraform-provider-scalix

# Backup files
*.orig
*.bak
*.old

# Coverage
coverage/
.coverage
coverage.xml
htmlcov/
.pytest_cache/

# Docker
.docker/

# Mesh-TLS certs + private keys — host-local, NEVER commit (deploy/certs/*.key)
deploy/certs/

# Host build caches (Rust)
.cargo-cache/
.cargo-musl-cache/

# Tool-generated
.scalix/
CLAUDE.md
.claude/settings.json
graphify-out/

CLAUDE.md
.obsidian/console/e2e-report/
console/e2e-results/
crates/node-agent/Cargo.lock
tests/production-sim/Cargo.lock
.playwright-mcp/

# Alertmanager notification secrets (Slack webhook, SMTP, PagerDuty)
monitoring/prometheus/secrets/

# OpenBao secrets store: commit ONLY the age-encrypted break-glass copy + the
# public recipients list — NEVER a plaintext secret here.
deploy/secrets/*
!deploy/secrets/*.age
!deploy/secrets/age-recipients.txt

# Agent coordination (multi-agent task tracking)
TODO.md

# Staged at docs-site build time by deploy/rebuild-all.sh (source of truth: sdk/openapi.json)
docs-site/openapi.json

# Benchmarking harness — run artifacts, secrets, live status (engine code is tracked)
benchmarks/*.db
benchmarks/.bench-secrets
benchmarks/results/
benchmarks/BENCHMARK_LIVE_STATUS.md
