.DS_Store
.env
.env.*
!.env.lite.example
!.env.example
.venv/
node_modules/
__pycache__/
*.py[cod]
.pytest_cache/
.ruff_cache/
.mypy_cache/
.coverage
htmlcov/
dist/
build/
*.egg-info/
.citadel/
.claude/
.cognee_system/
.data_storage/
.cognee_cache/
logs/
.brand-preview/
# Personal, machine-specific workspace ingester (POSTs local docs to prod) — not for the shared repo.
scripts/ingest_masumi_workspace.py
.pip-audit-cache/
.superstack/
.local-review/

# ---------------------------------------------------------------------------
# Vault data must never enter this public repository
# ---------------------------------------------------------------------------
# The application is public; the Organization Vault is not. Everything below is
# a shape that carries vault CONTENT rather than application source. See
# docs/public-and-private.md and SECURITY.md.
#
# Note that gitleaks cannot inspect binary formats, so these path rules are the
# only thing standing between a local database or export and a public commit.
*.db
*.db-journal
*.sqlite
*.sqlite3
*.sql
*.dump
kuzu_data/
pgdata/
postgres-data/
*-export.json
*-export.md
*-export.csv
vault-export.*
backup.tar.gz
# Bench run JSONs enumerate every served hit identity and tracked source
# name. scripts/bench/.gitignore already covers scripts/bench/runs/; this
# catches a runs/ created anywhere else by a copy-pasted bench command.
runs/

# ---------------------------------------------------------------------------
# Editor and agent tool configs that commonly hold inline tokens
# ---------------------------------------------------------------------------
# `.claude/` is already ignored above. `.cursor/` and `.windsurf/` were not,
# even though Cursor writes MCP server configs — frequently containing a live
# `Authorization: Bearer` value — to `.cursor/mcp.json`.
#
# The `rules/` subdirectories ARE legitimate tracked project source (the shared
# Citadel agent policy), so they are re-included rather than ignored.
.cursor/*
!.cursor/rules/
.windsurf/*
!.windsurf/rules/

# superpowers brainstorm mockups (local only)
.superpowers/

# Next.js build scratch. The *export* is committed, at kb/webui/, because a
# self-hoster installs a wheel and never runs Node; these two are the working
# directories that produce it.
web/.next/
web/out/
*.tsbuildinfo
