.venv/
__pycache__/
*.pyc
*.egg-info/
build/
dist/
.pytest_cache/
.ruff_cache/
# Written when a worktree's venv is provisioned. Untracked-and-unignored, it made
# `git status` permanently non-empty, which pinned the worktree against the local
# worktree-GC's "no uncommitted work" guard — a build artifact must never look like work.
.provision.log
.tickets-tracker/
bridge_state/
# The standing per-criterion effectiveness ledger (epic 6982) is a local, growing artifact
# regenerated by `criterion_effectiveness.py --record --backfill` over the live sidecar store —
# it is ~8 MB over the current corpus, far over the 500 KB check-added-large-files cap, so it is
# NOT committed (analogous to .tickets-tracker/). The committed CI-visible baseline is the small
# computed metrics artifact runs/criterion_effectiveness.json.
docs/experiments/plan-review-gate/runs/criterion_firings.jsonl
# Ignore local .rebar state (session-log pointer, HLC cache, …) but TRACK the out-of-band
# trusted-environment pin (story 76d2): trusted_environments.yaml lives on the code branch
# (Gerrit-gated + CODEOWNERS-protected), NEVER the auto-pushed tickets branch.
.rebar/*
!.rebar/metrics-snapshots.ndjson
!.rebar/backfill-close-class.ndjson
!.rebar/trusted_environments.yaml
# Project plan-review criteria overlay (epic jira-reb-1003): these live on the code
# branch (Gerrit-gated), like trusted_environments.yaml — NOT the auto-pushed tickets
# branch. Un-ignore each committed overlay file surgically; sibling local overrides stay
# ignored.
!.rebar/criteria_routing.json
!.rebar/plan_review_moves.json
!.rebar/prompts/
.rebar/prompts/*
!.rebar/prompts/plan-review-project-portability.md
!.rebar/prompts/code-review-project-review-phase-boundaries.md
!.rebar/prompts/plan-review-project-symbol-reference-completeness.md
!.rebar/prompts/plan-review-project-engine-layer-enforcement.md
!.rebar/prompts/plan-review-project-measurement-provenance.md
!.rebar/evals/
.rebar/evals/*
!.rebar/evals/plan-review-project-portability.eval.yaml
!.rebar/evals/code-review-project-review-phase-boundaries.eval.yaml
!.rebar/evals/plan-review-project-engine-layer-enforcement.eval.yaml
# .claude/ itself can't stay excluded, or the negation below can't re-include a file inside
# it (git won't descend into an excluded directory) — so ignore its contents individually
# and un-ignore the one tracked project setting.
.claude/*
!.claude/settings.json
session-logs/
CLAUDE.local.md

# local test/build scratch (never commit)
.pytest-tmp/

# lint / type-check / coverage artifacts
.mypy_cache/
.coverage
.coverage.*
coverage.xml
htmlcov/
# pytest --store-durations / pytest-split timings (perf logging, task 9ad9) — never committed
.test_durations

# uv.lock IS committed (ticket ce5d — uv-canonical repo envs): published metadata keeps
# loose `>=` floors for PyPI consumers, while the committed lock pins the repo's OWN envs
# (make install, CI, the reviewbot/opcert images) to a verified-importable set. CI enforces
# freshness with `uv lock --check`; Dependabot's `uv` ecosystem keeps it bumped.

# Serena MCP (local code-navigation tooling; per-developer)
.serena/

# tokensave MCP (local code-graph cache; per-developer)
.tokensave/

# mutmut mutation-testing working copy + result DB (docs/mutation-testing.md)
mutants/
.mutmut-cache
html/

# Hybrid Logical Clock per-clone cache (P2.1) — disposable, rebuilt from the log
.rebar/hlc.state
.rebar/hlc.lock

# Ephemeral container secrets — regenerated each boot from SSM by
# infra/scripts/fetch-secrets.sh (ADR-0008); 0600, NEVER committed.
infra/compose/.env
# Materialized private signing keys (materialize-to-file precedent) + their mktemp temp files —
# fetch-secrets.sh writes these 0600 each boot; a committed private key would be a leak.
infra/compose/opcert-ed25519-key
infra/compose/opcert-ed25519-key.*
infra/compose/rebar-bot-signing-key
infra/compose/rebar-bot-signing-key.*
# Materialized MCP static-tokens file (epic jira-reb-3527 / ADR 0104 §1) — fetch-secrets.sh
# emits this 0600 JSON from the per-client PATs each boot; token_env records only (no raw
# PAT), but it is a per-box materialized artifact, never committed. Its mktemp temp files too.
infra/compose/mcp-static-tokens.json
infra/compose/mcp-static-tokens.json.*
# The operator's REAL local client-credential config (rendered from the committed
# mcp-clients.local.example.json placeholder). Holds real bearer PATs — NEVER commit it.
/mcp-clients.local.json

# Build-baked gate-code commit SHA, generated by hatch_build.py at wheel/sdist build
# (epic jira-reb-596). Generated, never committed; force-included in the wheel.
src/rebar/_build_info.py

# d01e live-validation run artifacts (CI artifacts, not source)
/reports/
/leaked-artifacts.log

# terraform plan artifacts (generated)
infra/terraform/tf.plan
infra/terraform/tf.plan.json
infra/terraform/.terraform/
.tools/
