# Screenshots (testing artifacts)
/*.png

# graphify code-mapping output (generated graph; eval 2026-06-07 — never commit)
graphify-out/
**/graphify-out/

# Python
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
*.egg-info/
dist/
build/

# Virtual Environments
venv/
venv_*/
.venv/
env/
ENV/

# Ansible Vault Passwords (SECURITY: Never commit vault passwords)
system/infrastructure/ansible/vault_password
**/vault_password
**/vault_pass

# Jupyter Notebook
.ipynb_checkpoints/
*.ipynb_checkpoints

# PyTorch
*.pth
*.pt

# TensorBoard
logs/
runs/

# IDE
.vscode/
.idea/
*.swp
*.swo
*~

# Claude Code
.claude/conversation-logs/
.claude/session_*.jsonl
.claude/exports/
.claude/settings.json
.claude/settings.local.json
# NOTE: .claude-job-queue/ is TRACKED (not ignored) - jobs are archival records
# Only ignore truly ephemeral files within job queue
.claude-job-queue/jobs_backup_*/
.claude-job-queue/*.tmp

# PERMANENTLY FORBIDDEN - Auto-sync daemons cause commit spam
# These patterns prevent recreation of deleted auto-sync infrastructure
scripts/*auto-sync*
scripts/*autosync*
*auto-sync-daemon*
*autosync-daemon*

# User uploaded files (indexed to vector DB, not source)
myvault/uploads/*
!myvault/uploads/.gitkeep

# OS
.DS_Store
Thumbs.db
desktop.ini

# Python installers
*.exe

# Compiled shaders (keep source, ignore binary)
*.spv

# Large model files
*.onnx
*.pb
*.h5
*.safetensors

# Ollama models (project-local storage, large files)
localai/models/
localai/venvs/

# Temporary files
*.tmp
*.log
*.bak

# Node.js
node_modules/
package-lock.json

# TypeScript incremental build cache (not source)
*.tsbuildinfo

# Environment files (secrets)
.env
.hausai.env
.env.local
.env.*.local

# Obsidian plugin data holding secrets (untracked 2026-07-04 — the local REST API apiKey must not be committed)
myvault/.obsidian/plugins/obsidian-local-rest-api/data.json

# UAT and deployment environment files (secrets)
scripts/uat-deployment/.env.uat
scripts/uat-deployment/.env.production
scripts/ssl-deployment/.env
scripts/ssl-deployment/.env.local
projects/n8n/.env
projects/n8n/.env.local
projects/n8n/.env.bak*
projects/n8n/.env.docker-archive
system/*/production.env
system/*/.env.production

# SSH keys and credentials (NEVER commit private keys)
.ssh/
.secrets/
*.pem
*.key
id_rsa*
id_ed25519*
wsl_hausai*
known_hosts

# Workspace temp folder (ignore contents but keep folder)
tmp/*
!tmp/.gitkeep
!tmp/README.md

# Test artifacts
test-results/
playwright-report/
# Playwright storage state — regenerated by global-setup on every run; it holds a
# live test-account JWT, so it must NOT be tracked (was committing a fresh token
# each session). Already excluded from the finder gate; gitignored 2026-06-20.
tests/full-suite/.auth-state.json

# Database backups (use dedicated backup storage)
system/backups/

# Temporary SQL scripts
scripts/temp_*.sql

# Electron build artifacts
**/release/
**/dist-electron/
squashfs-root/
*.AppImage

# UI test artifacts
data/

# Coverage reports
.coverage
*.coverage
htmlcov/

# Obsidian community plugins (installed separately)
myvault/.obsidian/plugins/*/

# Obsidian state files
myvault/.obsidian/workspace.json
myvault/.obsidian/graph.json

# Backup files
*.backup-*
system/queen-bee/tmp/
mcp-crawl4ai-rag/

# Database files (SQLite, etc.)
*.db

# Local agent temporary files  
system/local-agents/tmp/

# Migration reports (generated)
system/infrastructure/migrations/reports/

# Dual Claude Worktrees (code isolation)
.worktrees/
# Ephemeral harness-managed agent worktrees (Agent/Workflow isolation:'worktree' — job-144409/agent-fleet).
# These are auto-created per task-agent under .claude/worktrees/agent-<id>; they must NEVER leak into
# main's git status/staging (orchestrator commits only the retrieved diff from main; worktrees are
# removed + branches deleted on cleanup). Keeps the single-writer-to-main flow clean (CEO 2026-06-24).
.claude/worktrees/

# Terraform binaries and cache (added 2026-01-10)
**/.terraform/providers/
**/.terraform.lock.hcl

# All backup files
*.backup

# Large archive files in infrastructure
system/infrastructure/backups/*.backup

# Environment backups
.env.backup
.env.backup.*
CLAUDE.md.backup

# Archive tar files
myvault/_thisproject/archive/**/*.tar
*.v11-fraud-backup
# Artifacts directory - runtime generated files
artifacts/

# Archive directories (session reports, test artifacts - tracked for history)
# archive/ is intentionally tracked

# Large generated files (prevent accidental commit)
token-inventory*.json
doc-coverage-analysis.json
*-load-test-report.json

# Security: Prevent env backups from being tracked
.env.backup*
.hausai.env.*
*.BACKUP_*
system/security/rotation_data/
# Token-rotation encrypted env snapshots + per-run keyfiles — NEVER commit
# (the whole .hausai.env is copied here pre-rotation; the dir is gitignored so
#  a future rotation run can't leak a decryptable secret snapshot into git)
system/security/token-management/backups/
.secrets/stripe-live-keys-*.txt
.claude/_backups/
myvault/_thisproject/ACHIEVEMENTS.md
reports/api-gateway-load-test-report.json

# Backups of .git/ (created during filter-repo etc.) — never commit
.git.bak*/

# Path B predictability redesign — ephemeral session state
.claude/session-state/context-snapshot/
.claude/session-state/active-session.lock
# baseline-accuracy gate markers — session-ephemeral; a committed marker could
# pre-satisfy the gate in an unrelated session (finder 2026-06-24)
.claude/session-state/baseline/
# reaped-worktree recovery patches — un-reviewed crashed-agent output (possibly secrets/
# customer data); MUST never be committed/pushed (finder 2026-06-24, Rule #27)
.claude/session-state/reaped-worktrees/
# Runtime lock files — never commit (ss/ew would otherwise sweep them via git add of the dir)
*.rwlock

# Security (2026-06-16): never track real-secret env files — found live secrets in git
.env.bak-*
*.bak-*credrot*
**/secrets/generated.env
.env.supabase
system/infrastructure/.env.supabase

# n8n decommissioned — real DB cred was tracked (2026-06-16 leak review)
projects/n8n/.env.override

# Broken gitlink (job-20260620001416) — external comet-browser MCP, NOT vendored.
# Suppress its 57 on-disk files from status/VS Code until proper handling (submodule/remove/CEO call).
system/mcp-servers/mcp-comet-browser/
.anthropic-key

# conduct-scan candidate cache — transient per-session pre-filter; durable record is findings.jsonl (job-20260625003048)
.claude/session-state/finder/conduct-pending/
# Ignore only the TRANSIENT current-state grant files — NOT the append-only audit ledger
# (_ledger.jsonl stays git-tracked: it's the audit trail the coordinator-switch design depends on,
# so it must be backed up + tamper-evident via git diff — v2 finder #3).
.claude/session-state/resource-grants/*.json
!.claude/session-state/resource-grants/_ledger.jsonl
# archived grants are transient recovery snapshots (recover via `resource-grant restore`); the durable
# audit is _ledger.jsonl. Ignore them so revoke/expire/overwrite don't pollute git status (finder MED 2026-07-01).
.claude/session-state/resource-grants/archived/

# targeting-machine hotlist — regenerated by the timer; derived state, not source
.claude/session-state/targeting/

# Kernel action-WAL (job-20260626194521) — per-session provenance ledger + seen-map
# + current-intent. Ephemeral/churning + self-referential (the WAL writing about
# itself); durable tamper-evident anchoring = inc-4. Read at session-end by `wal`.
.claude/session-state/action-wal/
.claude/session-state/current-intent/

# pre-delete reversibility artifact (regenerable derivative — kept on disk, not committed)
myvault/_thisproject/intel/adhoc/2026-06-28-retrieval-kernel-fusion-panel/knowledge_chunks-backup-20260628.sql
