# Secrets & keys
.env
.env.age
.env.local
.env*.local
.env.meta.json
.env.*.bak
.env.*.backup
.env.pre-live-*
.env.post-live-*
.env.public-sandbox
.env.sandbox
.env.*-sandbox
!.env.example
*.key
OPENROUTER_API_KEY*
OPENAI_API_KEY*

# Environment dumps & inventory
src/mcp/docs/inventory/

# SQLite databases
*.db
*.db-shm
*.db-wal
*.db.backup
*.db.latest
*.db.new
stacks/bifrost/config.db.*

# Runtime data & volumes. data/* (not data/) so the eval-corpus
# exception below can re-include a subtree — git cannot re-include
# children of an excluded DIRECTORY, only of an excluded glob.
data/*
# Exception: the frozen synthetic eval corpus is CI input
# (eval-exploratory seeds it on GH runners — gitignored data/
# meant the workflow could never pass remotely; 2026-07-10).
!data/eval-corpus/
src/mcp/data/
.cerid-state/
src/mcp/.cerid-state/

# contextplus MCP local index (Ollama-backed; regenerated by `npx -y contextplus init claude`)
.contextplus/
contextplus.db
contextplus.db-*
.mcp_data/
# Bifrost provider config is safe to commit (uses env.OPENROUTER_API_KEY, no secrets)
!stacks/bifrost/data/
stacks/bifrost/data/*
!stacks/bifrost/data/config.json
uploads/
logs/
/neo4j/
/chroma/
/redis/
stacks/infrastructure/data/
artifacts/
artifacts
# Nested runtime data dirs (the old bare `data` rule matched any depth;
# scoped to the known ones so the root data/eval-corpus carve-out works).
src/mcp/app/data/
src/mcp/tests/eval/longmemeval/data/

# Node
node_modules/

# Next.js / Vercel build artifacts
.next/
.vercel/

# Python / build
__pycache__/
*.pyc
*.pyo
*.pyd
.coverage
.coverage.*
htmlcov/
.pytest_cache/
.mypy_cache/
.ruff_cache/
env/
venv/
.venv/
src/mcp/VERSION

# macOS / temp
.DS_Store
*.swp
*~
Thumbs.db

# Runtime logs
**/*.log
**/diagnostic.data/
**/journal/

# User documents - never commit
*.pdf
*.docx
*.xlsx
*.csv
/archive/
cerid-archive/
inbox/
.worktrees/
backups/

# Electron build output
packages/desktop/out/
packages/desktop/release/

# TypeScript SDK build output (regenerated by `npm run build`)
packages/sdk/typescript/dist/

# AI assistant artifacts
.superpowers/
.internal/
tests/beta/reports/
tests/beta/eval/reports/

# Internal task tracking & plans (not for public repo)
tasks/
.claude/plans/
# Claude Code session lock files — runtime artifacts, expire on session end
.claude/*.lock
# Agent worktrees — live `git worktree` checkouts (184MB as of 2026-07-30).
# Registered in .git/worktrees, so they are real checkouts, never repo content.
.claude/worktrees/

# Runtime log artifacts
src/mcp/rag-api-logs.txt

# Working documents (not for public repo)
tests/BUG_REPORT.md

# Smoke test scratch directory (host path, outside repo)
/tmp/cerid-smoke/
test-results/

# Playwright MCP runtime output
.playwright-mcp/
docker-compose.override.yml

# Eval harness outputs (Phase 0 quality program)
src/mcp/tests/eval/out/
scripts/out/
.mutation-check.lock
.ci-artifacts/
