.gitignore

# Probe outputs (generated by scripts/, redirected via `tee`) — ignore ad-hoc ones at the
# repo root, but keep the curated AR-0002 evidence committed under docs/reviews/.
fathom-*.txt
!docs/reviews/probe-evidence/fathom-*.txt

# OS / editor cruft
.DS_Store
Thumbs.db
*.swp
.idea/
.vscode/

# Environment / secrets — but example/template env files are documentation and stay tracked.
.env
.env.*
!*.env.example
!.env.example
*.local

# Claude Code session settings (contain operator-specific allowlists/paths — never publish)
.claude/settings.json
.claude/settings.local.json

# Python
__pycache__/
*.py[cod]
.venv/
venv/
*.egg-info/
.mypy_cache/
.ruff_cache/
.pytest_cache/
dist/
build/
htmlcov/
.coverage

# Local agent staging (SQLite WAL) — disposable, re-derived by a re-scan (ADD 09 §7)
*.sqlite
*.sqlite-wal
*.sqlite-shm

# Deploy secrets — NEVER commit private keys or the live agent config. Covers every per-host
# cert bundle (CA copy + client cert/key minted by deploy/mint-agent-cert.sh).
deploy/*/certs/
deploy/*/agent/agent.config.yaml

# Local dev SQLite catalogue (generated by scripts/localdev/run.sh)
scripts/localdev/*.db
scripts/localdev/*.db-*
# Editor local-history extension snapshots
.history/

# host-only preview grant keys (never commit)
deploy/*/secrets/
deploy/*/agent/agent.*-serve.config.yaml

# --- Private content (publish, Model B): kept on disk, NOT tracked or published.
# Version-controlled home: the private dev repo. Deep history also in the dev repo + backup.
# Host-agnostic: ignore every per-host deploy dir/file, keep only the public quickstart + Dockerfile.
/deploy/*
!/deploy/quickstart/
!/deploy/Dockerfile
/docs/templates/
/docs/reviews/
/docs/branding/
/PUBLISHING.md
/scripts/release/

# Local demo media (screenshots + demo video) — regenerated, not versioned
demo-media/