# Python
__pycache__/
*.py[cod]
.venv/
venv/
*.egg-info/
build/
dist/
.mypy_cache/
.pytest_cache/
.ruff_cache/
.coverage
htmlcov/
uv.lock

# Engine working state -- never committed
#
# `output/` is where a run puts its per-unit workspace, its candidates and its
# evidence store, one directory per source project. `.recast/` is the same
# thing before that move, and stays ignored so an older checkout stays quiet.
# No pattern, anywhere, is what stops an embargoed Finding from being committed:
# the findings store resolves outside the project and refuses a root inside a
# checkout, because a .gitignore entry is a line anyone can delete and this one
# would be protecting an unpatched vulnerability. See docs/disclosure-ledger.md,
# row 5. These entries are about noise -- a run should not leave a dozen
# untracked directories in `git status`. Unanchored, so they cover a run made
# from inside a subdirectory too.
output/
.recast/
workspace/
evidence-local/
findings-local/
*.log

# The SBOM the hygiene workflow generates. CI uploads it as an artifact and
# throws the runner away; tools/ci_local.sh writes it here instead, and a
# generated inventory of the tree is not a fact about the tree worth keeping.
recast-engine.cdx.json

# Compiled oracles and native artifacts
*.so
*.o
*.mod
*.gcda
*.gcno
*.gcov

# Anything site-specific belongs in a case repo, not here
.env
config.local.*
