.gitignore

dist/
node_modules/
.env
.env.*
!.env.example

# Claude Code local settings (not committed)
.claude/settings.local.json
.claude/scheduled_tasks.lock
.mcp.json
.DS_Store
*.local
*.tar.gz
*.bak.*

# Astro generated (regenerates on build/dev)
.astro/

# Playwright test output
test-results/

# Cursor IDE workspace state
.cursor/

# Adhoc/debug scripts (one-off, not part of release)
apply_docs_updates.sh
fix_tribes_deliverables.sh
hash_menu_debug.sh
nav_section_inspect.sh
supabase/migrations.skip/
supabase/.temp/
*.bak
*.skip

# Legacy binary assets (too large for git; serve from CDN/Storage)
public/legacy-assets/photos/
public/legacy-assets/infographics/
public/legacy-assets/presentations/*.pptx
public/legacy-assets/logos/
data/legacy-imports/calendar/
data/legacy-imports/docs/*.pdf
data/legacy-imports/docs/*.docx

# Data Governance: entire data/ directory (raw exports, staging, PII, logs)
data/
Sensitive/
sensitive/
docs/project-governance/DATA_INGESTION_POLICY.md

# Diagnosis screenshots: scraped from prod UI, contain member PII (names/photos:
# CPMAI mural, team gallery, tribe leaders). NEVER commit to the PUBLIC repo. See #816.
docs/strategy/diagnosis/screenshots/
# Scratch playwright capture scripts (throwaway one-off diagnosis tooling). Kept local.
docs/strategy/diagnosis/_*.mjs

# Data Science: local-only analysis scripts and sensitive inputs
scripts/data_science/

# ETL manifests and local outputs
scripts/bulk_knowledge_ingestion/upload_manifest.json
scripts/bulk_knowledge_ingestion/upload_manifest_curated.json

# Audit raw reports (inflated, see filtered summary)
docs/audit/archive/

# Local dry-runs of release provenance artifacts; GitHub Release assets are generated in CI.
release-provenance/

# Wrangler local state
.wrangler/

# Non-project files (accidentally extracted/downloaded)
# PII: extracao de assinaturas do Termo de Voluntariado (92 pessoas, 3 CPFs em CN de
# certificado). Artefato de auditoria, nunca deveria ter sido versionado.
scripts/docusign-signers-extracted.json
ventoy-*/
packages.microsoft.gpg
DISCREPANCY_REPORT.md
MIGRATION_PROPOSAL.md
REPO_INVENTORY.md
.pdf

# Tooling installers (gh CLI, etc. — installed via .deb not committed)
*.deb
*.rpm
*.AppImage
tmp/

# === #816 — Public-repo governance: keep internal / PII / legal-draft / partner docs out of the PUBLIC tree ===
# This repo is PUBLIC. Sensitive material lives in the private org wiki (nucleo-ia-gp/wiki) + Sensitive/ + data/.
# NOTE: .gitignore only blocks FUTURE untracked adds. Already-tracked sensitive files are purged separately
#       (see #816 — history rewrite). Signed/public-final versions can be force-added with `git add -f`.
# NOTE: docs/legal/ is intentionally KEPT public — compliance/transparency SSOT under contract tests
#       (638 runbook, 641 annex, 642 DPA sub-processor inventory, RoPA). Do NOT add it here.

# Internal meetings, agendas, briefings (named people + strategy)
#
# ⚠️ #1960: these were anchored at the START of the name and covered 0 of the 1031 files in
# docs/, because the house convention prefixes a date (2026-08-07_ata_lideranca_...) and
# sometimes a project (p269_briefing_...). Three real files sat untracked and unignored in a
# PUBLIC repo. The token therefore needs a BOUNDARY: start of name, or right after a "_".
#
# ⚠️ Do NOT "simplify" these to *ATA_*. "DATA_" CONTAINS "ATA_", so that pattern swallows
# docs/legal/, docs/specs/ and docs/archive/ files that are public on purpose and under
# contract tests. The negative control in tests/contracts/1960-*.test.mjs asserts exactly that.
#
# .gitignore is case-sensitive by default and the real files mix cases (lowercase "ata",
# uppercase "BRIEFING"), so the classes below carry both.
docs/**/ATA_*
docs/**/PAUTA_*
docs/**/BRIEFING_*
docs/**/DEMO_SCRIPT_*
docs/**/*briefing_reuniao*
docs/**/[Aa][Tt][Aa]_*
docs/**/[Pp][Aa][Uu][Tt][Aa]_*
docs/**/[Bb][Rr][Ii][Ee][Ff][Ii][Nn][Gg]_*
docs/**/*_[Aa][Tt][Aa]_*
docs/**/*_[Pp][Aa][Uu][Tt][Aa]_*
docs/**/*_[Bb][Rr][Ii][Ee][Ff][Ii][Nn][Gg]_*
docs/**/*_[Dd][Ee][Mm][Oo]_[Ss][Cc][Rr][Ii][Pp][Tt]_*

# Unsigned legal / IP instrument drafts + legal opinions (pareceres) — NOT the docs/legal/ compliance SSOT
docs/instrumentos-ip/
docs/council/cr-050-*-source/
docs/council/**/*legal-counsel*
docs/**/*_DRAFT.html
docs/drafts/*termo_voluntario*
docs/drafts/*ip_policy*
docs/drafts/p148_external_reviewer_agreement*
docs/drafts/r3c3-clause*
docs/drafts/v2.7_*
docs/drafts/p269_*

# Partner dossiers, commercial pitch decks, BSP/commercial outreach, multi-client/whitelabel + directorate intel
docs/strategy/partnerships/
docs/strategy/deck/
docs/strategy/whatsapp_bsp_*
docs/strategy/*_multi_client_gaps.md
docs/strategy/*_directorate_mapping.md

# Applicant / member PII audits, extractions, peer-review briefings
docs/**/*GMAIL_DATA*
docs/**/*VIDEO_SCREENING*
docs/**/*selection-journey-audit*
docs/**/*peer_review_briefing*
docs/**/*WHATSAPP_CROSS_GROUP*
docs/drafts/p131_email_*
docs/drafts/p277_*
# === END #816 === (sentinel: tests/contracts/938-sensitive-docs-not-tracked.test.mjs parses the block above)

# === #1939 — Barreira de higiene contra `git add -A` (repo PUBLICO) ===
# DELIBERADAMENTE FORA do bloco #816 acima: aquele bloco e parseado pelo guard
# tests/contracts/938-sensitive-docs-not-tracked.test.mjs, que (a) exige todo padrao
# ancorado em `docs/` e (b) REPROVA qualquer arquivo ja rastreado que case com o padrao.
# `docs/_deliverables/` tem 5 arquivos publicos legitimos rastreados (copy de webinar,
# comunicado de mudanca de leitura de presenca) — coloca-los la dentro os transformaria
# em ofensores do guard. A barreira aqui e de HIGIENE (impedir captura acidental por um
# `add` largo), nao de proibicao: item curado ainda entra com `git add -f`.

# Comunicados, campanhas e assets operacionais. Trazem nome de membro (inclusive no nome
# do arquivo), link de grupo de WhatsApp e e-mail. NUNCA capturar em massa no repo PUBLICO.
docs/_deliverables/

# Saida da ferramenta Playwright MCP (logs de console + snapshots de pagina). Descartavel.
.playwright-mcp/

# Residuo solto na raiz (screenshot de diagnostico avulso).
/time-700p.png
# === END #1939 ===

# Deno lockfile — EF deps are managed by the Supabase bundler; CI runs lockless (#1106)
deno.lock

# Python bytecode dos scripts de skill
__pycache__/
*.pyc

# === #2239 — Links vivos para o mount do Google Drive (rclone/FUSE) ===
# `_drive/` sao symlinks para `~/gdrive`, criados por `drive-link.sh`; `_drive-docs/` e a
# materializacao local de docs nativos. Fora do git por conteudo (e da nuvem, nunca do repo),
# e fora do BUILD por desempenho: o scanner de fontes anda a arvore do projeto, segue os links,
# entra no FUSE e passa a esperar ida e volta de rede por diretorio. Medido em 11/09/2026: com
# `_drive/` visivel o `astro build` PENDURA; com estas linhas, termina em 4,5 s. A barreira ja
# existia no ignore GLOBAL do usuario, que o git honra e o scanner do build nao le.
_drive/
_drive-docs/