# Dependencies
node_modules/

# RFC-0042 Phase 1 — reviewer subagent transcripts
# Per RFC-0042 OQ-1: local-disk default, 90-day retention. Transcripts may
# contain PR diff content; the Merkle leaf index (.ai-sdlc/transcript-leaves.jsonl)
# is the durable committed artifact, not the raw transcripts.
.ai-sdlc/transcripts/

# Build output
dist/
*.tsbuildinfo
.next/

# AISDLC-75: the ai-sdlc-plugin MCP server is loaded by the plugin manifest at
# `mcp-server/dist/bin.js`. Marketplace clones do NOT run `pnpm install`, so
# this bundled artifact MUST ship in the source tree. The bundle is produced
# by `pnpm --filter @ai-sdlc/plugin-mcp-server build` (esbuild --packages=bundle)
# and gated by `scripts/verify-bundle.mjs` in CI.
!ai-sdlc-plugin/mcp-server/dist/
ai-sdlc-plugin/mcp-server/dist/*
!ai-sdlc-plugin/mcp-server/dist/bin.js

# Coverage
coverage/
.nyc_output/

# Environment
.env
.env.*
!.env.example

# IDE
.idea/
.vscode/
*.swp
*.swo
*~

# OS
.DS_Store
Thumbs.db

# Logs
*.log
npm-debug.log*
pnpm-debug.log*

# AI-SDLC runtime artifacts
.ai-sdlc/audit.jsonl
.ai-sdlc/state.db
.ai-sdlc/state.db-shm
.ai-sdlc/state.db-wal
.ai-sdlc/state/
.ai-sdlc/memory/
# AISDLC-320: RFC-0024 Refit Phase 1 — draft captures are operator-local (OQ-1).
# Explicit submit (`cli-capture submit`) promotes to team-shared backlog/captures/.
.ai-sdlc/captures-drafts/
# AISDLC-133: per-task reviewer verdict files written by /ai-sdlc execute
# Step 10 and consumed by `.husky/pre-push` (scripts/check-attestation-sign.sh)
# to auto-sign the DSSE attestation. Ephemeral, per-worktree — never
# committed; the signed envelope at .ai-sdlc/attestations/<sha>.dsse.json is
# the durable artifact.
.ai-sdlc/verdicts/
# AISDLC-462: per-task session files for execute-parallel coordination.
# Runtime-only, per-machine — never committed. Gitkeep preserves the
# sessions/ directory structure so the wrapper can write files immediately.
.ai-sdlc/dispatch/sessions/*.session.json
.ai-sdlc/dispatch/sessions/archived/
# AISDLC-383.1 / RFC-0042 Phase 1: full conversation transcripts captured by
# reviewer subagents. Gitignored per RFC-0042 §Design Layer 1 — operator
# retains locally for 90 days by default (OQ-1). Remote storage opt-in via
# `.ai-sdlc/config.yaml transcript_storage_url` (OQ-5).
# See docs/operations/transcript-management.md for retention + GC runbook.
.ai-sdlc/transcripts/
# AISDLC-568: SubagentStart hook markers used for verdictClass detection
# (independent vs. self-authored transcript leaves). Ephemeral, per-machine,
# consumed (deleted) by `cli-attestation emit-leaf` on a match — never
# committed. See pipeline-cli/src/attestation/verdict-class.ts.
.ai-sdlc/subagent-sessions/
# AISDLC-155: per-worktree active-task sentinel (AISDLC-81). The sentinel
# lives INSIDE each worktree at `<worktree>/.active-task` and is read by the
# PreToolUse hook to resolve which task's `permittedExternalPaths` apply for
# cross-repo writes. Ephemeral, per-worktree — never committed. Was tracked
# by accident in earlier commits and kept causing merge conflicts on every
# rebase as parallel worktrees each tried to write their own task ID.
.active-task
.enterprise.yaml

# AISDLC-559: parent-repo lock file for the worktree-aware backlog task ID
# allocator (`next_task_id` MCP tool + `task_create`'s cross-source collision
# check). Lives under the PARENT repo's `.ai-sdlc/locks/` — never inside a
# worktree — so every sibling worktree racing for the same ID sees it. This
# is the one sanctioned exception to "the parent working tree is read-only";
# it is ephemeral (created + removed within a single tool call) and must
# never be committed.
.ai-sdlc/locks/

# AISDLC-122: pipeline-cli writes the DoR calibration log to
# `artifacts/_dor/calibration.jsonl` by default. The log captures issue
# titles + body previews + LLM-derived `finding` / `clarificationQuestion`
# strings that may quote pasted secrets. Combined with the dogfood
# pipeline's `git add -A` practice (per `feedback_stash_completely_before_pipelines.md`),
# an unscrubbed paste of an API key in an issue body could be committed
# to git history through this log. Three layers of defense:
#   1. Ignore the directory entirely (this rule).
#   2. Lower BODY_INLINE_LIMIT in pipeline-cli/src/dor/calibration-log.ts
#      (80 chars), so most bodies become a SHA reference.
#   3. Regex redaction in pipeline-cli/src/dor/secret-redact.ts.
artifacts/

# Package manager
.pnpm-store/

# Python
__pycache__/
*.py[cod]
*.egg-info/
*.egg
*.whl
.venv/
.mypy_cache/
.pytest_cache/
.ruff_cache/
build/
*.pyz
orchestrator/.gitignore
.worktrees/

# AISDLC-681: pre-push coverage gate lock (machine-local runtime state in the main checkout)
.ai-sdlc/runtime/

# AISDLC-557: orchestrator gate-failure backoff state (runtime, per-machine)
.ai-sdlc/dispatch/gate-failure-count

# Session hierarchy roster (machine-local)
.ai-sdlc/dispatch/hierarchy.json
.ai-sdlc/dispatch/hierarchy.json.tmp*

# Dispatch briefs written by cli-hierarchy brief (machine-local runtime output)
.ai-sdlc/dispatch/briefs/
