.gitignore

# Python
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
/lib/
/lib64/
parts/
sdist/
var/
wheels/
*.egg-info/
.installed.cfg
*.egg

# Virtual environments
.venv/
venv/
venv313/
ENV/
env/

# Runtime data
data/.mcp_server.pid
data/.mcp_server_http.pid
data/.mcp_server_sse.pid
data/.mcp_server_sse.lock
data/.mcp_server.lock
data/.last_active_agent
data/.metadata.lock
data/locks/
data/processes/
data/watcher/

# Claude Code / Cursor local state (machine-specific, never commit)
.claude/
.hypothesis/
data/gov-data-preserve/
*.log

# Superpowers workflow artifacts (brainstorm/spec/plan outputs) — local only
.local-docs/

# Session history files (archived, not tracked)
data/*history*.json
data/*history*.csv
data/history/
data/claude_*.json
data/claude_*.csv
data/composer_*.json
data/composer_*.csv
data/cursor_*.json
data/cursor_*.csv
data/hackathon_*.json
data/hackathon_*.csv
data/portal_*.json
data/portal_*.csv
data/archive/

# Agent state files (runtime data, not tracked)
data/agents/

# Knowledge layer (may contain sensitive discoveries)
data/knowledge/
data/knowledge_graph.json

# Dialectic sessions (runtime data)
data/dialectic_sessions/
data/dialectic_sessions_archive/

# Archives (backups, old data — all runtime)
data/agents_archived/
data/archives/
data/backups/
data/analysis/
# Generated analysis plots (regenerable via scripts/analysis/plot_eisv_trajectories.py)
scripts/analysis/*.png
tests/fixtures/*
# Wave 3a §2.6 golden parity fixtures are committed (load-bearing contract).
# Use the directory-contents pattern: ignore the parent's contents broadly,
# then re-include this subtree. Git's negation does NOT work if the parent
# itself matches an ignore rule, so we ignore `tests/fixtures/*` (not
# `tests/fixtures/`) and selectively unignore.
!tests/fixtures/wave3a_response_golden/
!tests/fixtures/wave3a_response_golden/**
tests/data/
data/exports/
data/mcp_server_sse*.log

# Agent metadata (contains API keys)
data/agent_metadata.json
data/agent_metadata.json.bak

# SQLite databases (runtime data)
data/*.db
data/*.db-shm
data/*.db-wal
data/*.db-journal
data/*.db-shm.__migrated__
data/*.db-wal.__migrated__

# Activity tracking (runtime data)
data/activity/

# Calibration backups
data/calibration_state.json
data/calibration_state_backup_*.json
data/sequential_calibration_state.json

# Audit logs (may contain sensitive information)
data/audit_log.jsonl
data/tool_usage.jsonl
data/audit_log_archive/
data/tool_usage_archive/

# Runtime data
data/logs/
data/telemetry/

# IDE
.vscode/
.idea/
.ruff_cache/
*.swp
*.swo
*~

# macOS
.DS_Store
.AppleDouble
.LSOverride

# Testing
.pytest_cache/
.coverage
coverage.xml
htmlcov/
site/
.tox/
*.pyc
*.lock
# ...but Elixir mix.lock files ARE tracked. The blanket *.lock rule above sits
# in the Python section and swept them up as collateral, so every machine
# resolved Elixir deps independently: CI ran a fresh resolve while the deploy
# box kept whatever it locked months earlier. That is how production ended up
# on plug 1.20.1 (retired 2026-06-23) while CI was already green on 1.20.3 —
# a green build proving nothing about the dependency set actually running.
# mix.lock is meant to be committed for applications; these are applications.
!elixir/*/mix.lock
#
# uv.lock stays ignored, and that IS the decision, not more collateral. Nothing
# consumes it: CI installs Python deps with `pip install -r requirements-*.txt`
# (tracked), Dependabot scans the tracked pip ecosystem, and no workflow calls
# uv at all. Committing a 450KB lockfile that no build reads would assert a
# reproducibility guarantee nothing enforces. If exact Python pinning is ever
# wanted, the change is `uv sync` in CI plus a tracked lock together — one
# without the other is decoration. Note that Python deps are range-pinned by
# design here: the repo guarantees a plain `pip install -e .` works for anyone.
tests/security_audit_report.json
tests/additional_security_report.json

# Jupyter
.ipynb_checkpoints

# Environment variables
.env
.env.local
secrets/

# LaunchAgent plists (contain secrets — installed copy lives in ~/Library/LaunchAgents/)
scripts/ops/*.plist

# Documentation — docs/ subtrees are TRACKED by default (operations, ontology,
# proposals, integration, install, dev, guides, assets). The entries below are
# the explicit exceptions kept local-only: machine config, retired/handoff docs,
# any *.local.md file, and personal workflow notes under docs/personal/.
docs/INTERNAL_CONFIG.md
docs/archive/
docs/handoffs/
*.local.md
# Personal workflow patterns — local-only, never committed. Drop any file here
# (no naming discipline needed) and it stays on your machine; intended for
# non-coder operators keeping their own workflow notes.
docs/personal/

# Agent guides (generated onboarding docs, not project documentation)
.agent-guides/

# Local session state (written by gov-session-cache hook)
.unitares/

# Archived scripts
scripts/archive/

# Temporary files
*.tmp
*.bak
*.old

# Prevent test/demo script proliferation in root
/test_*.py
/demo_*.py

# Session files
.governance_session
.mcp_session
.kimi_governance_session
.vigil_session
.vigil_state
.sentinel_session
.sentinel_state
.sentinel_state.*
.watcher_session
.watcher_session.*

# Generated config
config/generated-*.json

# Test cache (tree-hash pytest results)
.test-cache/

# Git worktrees
.worktrees/

# Local-only directories
sketch/
wiggum/
papers/
examples/
src/data/

# Operator-local: Schmidt proposal figures + venv
schmidt-proposal-figures/

# v7 F-hat: corpus parquets are reproducible from sql/ + DB; don't track binaries
data/v7-fhat/corpus/

# Lease-plane runtime state — written by the resident process every cycle,
# accidentally committed via `git add -A` in PR #349 ship.
data/lease_plane/

# superpowers plugin planning artifacts
docs/superpowers/

# ephemeral session scratch (not for commit)
.scratch/