# Secrets & keys
.env
# Secret-bearing backups. Plain `.env` does NOT match `.env.bak-*`, so a
# `git add -A` after any env repair would have committed live credentials.
.env.bak*
.env.*.bak
.env.age
.env.local
.env*.local
.env.meta.json
.env.*.bak
.env.*.backup
.env.pre-live-*
.env.post-live-*
.env.public-sandbox
.env.sandbox
.env.*-sandbox
!.env.example
*.key
OPENROUTER_API_KEY*
OPENAI_API_KEY*

# Environment dumps & inventory
src/mcp/docs/inventory/

# SQLite databases
*.db
*.db-shm
*.db-wal
*.db.backup
*.db.latest
*.db.new
stacks/bifrost/config.db.*

# Runtime data & volumes. data/* (not data/) so the eval-corpus
# exception below can re-include a subtree — git cannot re-include
# children of an excluded DIRECTORY, only of an excluded glob.
data/*
# Exception: the frozen synthetic eval corpus is CI input
# (eval-exploratory seeds it on GH runners — gitignored data/
# meant the workflow could never pass remotely; 2026-07-10).
!data/eval-corpus/
src/mcp/data/
.cerid-state/
src/mcp/.cerid-state/

# contextplus MCP local index (Ollama-backed; regenerated by `npx -y contextplus init claude`)
.contextplus/
contextplus.db
contextplus.db-*
.mcp_data/
# Bifrost provider config is safe to commit (uses env.OPENROUTER_API_KEY, no secrets)
!stacks/bifrost/data/
stacks/bifrost/data/*
!stacks/bifrost/data/config.json
uploads/
logs/
/neo4j/
/chroma/
/redis/
stacks/infrastructure/data/
artifacts/
artifacts
# Nested runtime data dirs (the old bare `data` rule matched any depth;
# scoped to the known ones so the root data/eval-corpus carve-out works).
src/mcp/app/data/
src/mcp/tests/eval/longmemeval/data/

# Node
# No trailing slash: `node_modules/` matches directories only, so a worktree's
# node_modules SYMLINK slipped past it and was committed by a merge on
# 2026-09-20 — an absolute link that pointed at itself in the main checkout.
node_modules

# Next.js / Vercel build artifacts
.next/
.vercel/

# Python / build
__pycache__/
*.pyc
*.pyo
*.pyd
.coverage
.coverage.*
htmlcov/
.pytest_cache/
.mypy_cache/
.ruff_cache/
env/
venv/
.venv/
# no trailing slash: also match a .venv SYMLINK (a worktree pointing at the
# main checkout venv), which ".venv/" does not cover
.venv
src/mcp/VERSION

# macOS / temp
.DS_Store
*.swp
*~
Thumbs.db

# Runtime logs
**/*.log
**/diagnostic.data/
**/journal/

# User documents - never commit
*.pdf
*.docx
*.xlsx
*.csv
/archive/
cerid-archive/
/inbox/
.worktrees/
backups/

# Electron build output
packages/desktop/out/
packages/desktop/release/

# Swift helper build output — SPM's per-target .build/, and the staging dir
# that `make` / `make universal` populates for package.json extraResources.
packages/desktop/swift/build/
packages/desktop/swift/*/.build/

# TypeScript SDK build output (regenerated by `npm run build`)
packages/sdk/typescript/dist/
packages/cli/dist/
*.egg-info/

# AI assistant artifacts
.superpowers/
.internal/
tests/beta/reports/
tests/beta/eval/reports/

# Internal task tracking & plans (not for public repo)
tasks/
.claude/plans/
# Claude Code session lock files — runtime artifacts, expire on session end
.claude/*.lock
# Agent worktrees — live `git worktree` checkouts (184MB as of 2026-07-30).
# Registered in .git/worktrees, so they are real checkouts, never repo content.
.claude/worktrees/

# Runtime log artifacts
src/mcp/rag-api-logs.txt

# Working documents (not for public repo)
tests/BUG_REPORT.md

# Smoke test scratch directory (host path, outside repo)
/tmp/cerid-smoke/
test-results/

# Playwright MCP runtime output
.playwright-mcp/
docker-compose.override.yml

# Eval harness outputs (Phase 0 quality program)
src/mcp/tests/eval/out/
scripts/out/
.mutation-check.lock
.ci-artifacts/

# Extension build output (vite). Never tracked; a stray `npm run build`
# during dependency work put it in a commit once.
packages/extension/dist/

# Hub UI build output. Rebuild with `make -C stacks/gateway/hub web`.
stacks/gateway/hub/web/dist/
stacks/gateway/hub/desktop/node_modules/
stacks/gateway/hub/desktop/out/
stacks/gateway/hub/desktop/release/
