# Project-specific
evidence/outbox/*
agent-progress.txt
ops/logs/

# Deploy-time OAuth provider manifest (#4328) — written by deploy-landing
# from the live /api/v1/auth/oauth/config response. Never checked in:
# the source of truth is the backend at deploy time, not a static file.
apps/landing/public/auth/provider-manifest.js

# Screenshots (except recon/)
/screenshots/*.png
!/screenshots/recon/

# One-shot CLI artifacts that historically slipped into the working tree
/~/
/api_sweep_*.json
/api_sweep_*.txt
/.context/codex-session-id

# Scratch dirs that previously slipped into the working tree as tracked files.
# Contents are transient (per-PR session notes / orphan test residue); keep them out.
/.data/
/.pipeline/

# Terraform
.terraform/
# Shared provider plugin cache (TF_PLUGIN_CACHE_DIR) used by the
# portable-cloud-terraform gate to fetch each provider once (#7825).
.plugin-cache/
# Repo-local Terraform temp dir; avoids quota-starved system /tmp on runners.
.tf-tmp/
*.tfstate
*.tfstate.*
*.tfplan
tfplan
crash.log
override.tf
override.tf.json
*_override.tf
*_override.tf.json
.terraformrc
terraform.rc
!evidence/outbox/.gitkeep
tests/playwright/artifacts/*
!tests/playwright/artifacts/uat-videos/
!tests/playwright/artifacts/uat-report.json
tests/playwright/videos/
# Generated playwright run scaffold (real specs live in tests/playwright/specs/).
# UAT/e2e runs with a misconfigured outputDir nest a second tree here.
tests/playwright/tests/
artifacts/security/
artifacts/performance/
artifacts/memorybench/*
!artifacts/memorybench/baseline/
!artifacts/memorybench/canonical/
!artifacts/memorybench/adapter/
artifacts/demo-flow/
artifacts/evals/
artifacts/language-coverage/
!artifacts/evals/baseline.json
# Harness certification canonical report (#7531) — workflow artifact only.
# The dashboard surface is apps/dashboard/admin/harness-certification/data.json
# (projected by scripts/evals/refresh_harness_certification_data.py); the raw
# canonical report lives in the workflow run artifact, not the repo.
artifacts/harness-certification/

# Local scratch and superseded worktree leftovers
.steward/
/research/
My Factory/
workweaver-strategic-analysis.md
.env
.env.local
.env.*.local

# Per-machine self-hosted runner sizing override (#6312) — PC-specific docker
# pool replicas/memory/cpus live here, never committed. Template:
# infra/runners/runner-config.local.example.yaml
infra/runners/runner-config.local.yaml
infra/runners/runner-config.*.local.yaml
infra/runners/.env
infra/runners/*.local.env

# Product-health audit derived artifacts
scripts/audit/data/*
!scripts/audit/data/feature-registry.seed.json
!scripts/audit/data/revenue-proof-runs.json

# Python
.venv
.venv/
.venv-*/
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
build/
develop-eggs/
dist/
# Issue #4336 — keep the vendored dashboard tarball tracked so slim wheel
# builds can fall back to it. CI rebuilds via dashboard-tarball-check.
!apps/dashboard/dist/
!apps/dashboard/dist/dashboard.tar.gz
# Fleet-join installers (`make join-installer`) bake a live registration token +
# a heartbeat PAT into dist/join/ — NEVER commit them. Explicit even though dist/
# is already ignored, so a future `!dist/...` exception can never un-ignore them.
dist/join/
downloads/
eggs/
.eggs/
lib/
!apps/dashboard/lib/
lib64/
parts/
sdist/
var/
wheels/
# Vendored cp314 arm64 wheels (biscuit-python) — committed so Docker/Lambda/CI
# builds resolve them via `pip --find-links vendor/wheels` without network or
# private-repo release-asset auth. See apps/backend/requirements.runtime.txt.
!vendor/wheels/
!vendor/wheels/*.whl
share/python-wheels/
*.egg-info/
.installed.cfg
*.egg
MANIFEST

# PyInstaller
*.manifest
*.spec

# Installer logs
pip-log.txt
pip-delete-this-directory.txt

# Unit test / coverage reports
htmlcov/
.tox/
.nox/
.coverage
.coverage.*
.cache
# Claude-harness session cache (cache/projects.json) lands untracked at repo root.
/cache/
.ruff_cache/
.uv-cache/
nosetests.xml
coverage.xml
*.cover
*.py,cover
.hypothesis/
.pytest_cache/
cover/

# Node.js/TypeScript
node_modules/
.npm-cache/
npm-debug.log*
yarn-debug.log*
yarn-error.log*
lerna-debug.log*

# TypeScript
*.tsbuildinfo

# Next.js
.next/
out/
next-env.d.ts
.turbo/

# Vercel
.vercel/

# Playwright
test-results/
playwright-report/
output/
.playwright-cli/

# MCP Artifacts - Unified storage for all MCP server outputs
.mcp-artifacts/
.factory/
.*-mcp/
.claude/playwright-output/
.claude/model-reviews/
playwright-output/
.workweaver/toolchains/
**/playwright-screenshots/
**/playwright-traces/
**/*.playwright.png
**/*.playwright.jpg

# macOS
.DS_Store
.DS_Store?
._*
.Spotlight-V100
.Trashes
ehthumbs.db
Thumbs.db

# IDE
.vscode/*
# share only the worktree/watcher exclusions repo-wide; keep personal IDE configs (launch.json, etc.) local
!.vscode/settings.json
# Claude Code / preview launch config: auto-created locally by the preview tool and
# inherently machine-specific (absolute node/python paths differ per dev), so it must
# stay local — never tracked. Tracking it leaked one machine's paths and dirtied main.
.claude/launch.json
# Claude-only rule files are not a doctrine surface: all dev doctrine is canonical in
# AGENTS.md + skills/ (read by every harness). A tracked .claude/rules/ would be Claude-only,
# stale-prone parallel doctrine — exactly what AGENTS.md forbids. Keep any local rules local.
.claude/rules/
.idea/
*.swp
*.swo
*~

# Docker
.dockerignore

# Logs
*.log
logs/

# Runtime data
pids
*.pid
*.seed
*.pid.lock

# Quarantine telemetry fixtures are pure tracked data: never let the *.log
# rule silently drop a fixture tail again (#14351 CI red — the .log sibling
# never committed and the suite only passed on machines holding it untracked).
!tests/ci/fixtures/*/

# Temporary files
*.tmp
*.temp

# Voice Agent Test Artifacts (generated from apps/voice-agent/tests/)
voice-test-*.png
voice-test-logs.json
console-logs.json
voice-test-screenshot.png

# codebase-memory-mcp: team artifact tracked, raw cache ignored
.codebase-memory/
!.codebase-memory/graph.db.zst

# Temporary directories from failed commands (repo-root only — do not
# ignore infra/terraform/cd product-CD module).
--no-deps/
aiobotocore==*/
/cd/
/download/
/pip/

# Agent service (LiveKit)
apps/agent-service/.env.secrets
apps/agent-service/*.zip

# Backup files that may contain secrets
*.env.bak
*.env.backup
*.env.old
.env.secrets

# Never commit editor/duplicate backups or evidence bundles (hash in manifest is canonical)
*.backup
*.tgz

# MCP secrets (NEVER commit)
.claude/.env.mcp

# Lambda deployment packages (should not be in git)
apps/backend/lambda/**/*.zip
apps/backend/lambda/**/packaging_env/
*.zip
!**/node_modules/**/*.zip

# Retired capability census aggregate (#12255). Source modules are the shards;
# assemble with ops/scripts/generate_capability_manifest.py. Do not recommit.
apps/backend/CAPABILITIES.json

# Local working files (personal notes, drafts, scripts)
/Compliance/
Self_Learning_Claude/
learnings/
update_mip.py
.agent-local/
# Optional per-delivery plans live at .agent-local/workplans/<issue-or-pr>.md
# and are never tracked authority.
# Per-harness mapping registries are local-only drift; repo-owned skill routing
# lives in skills/catalog.json plus generated skills/index.json.
.codex/AGENT_SKILL_MAPPING.md
.claude/AGENT_SKILL_MAPPING.md
AGENT_SKILL_MAPPING.md
.claude/local/
.codex/local/
.cursor/local/

# Ralph generated files (computed from WORKPLAN.md)
RALPH/workspaces/*/progress.json
RALPH/workspaces/*/status.md
workweaver-runtime/

# Claude Code worktrees, session artifacts, and runtime logs
.claude/worktrees/
# Codex harness worktrees (sibling to .claude/worktrees/; same isolation pattern)
.codex/worktrees/
!.claude/logs/
.claude/logs/*.jsonl
.claire/
vendor/gstack/browse/
.gstack/

# Local generated prototype artifacts; canonical benchmark/proof artifacts remain tracked.
artifacts/landing-sovereignty-prototype/

# Council session temp files (prompts/briefs generated during LLM council runs)
.tmp-council-*.md
.tmp-*-council-*.md
.cursor-tmp-*.md
.claude/council-*.md
.claude/council-prompt.md
.cursor/council-*.md
.cursor/tmp-*.md
tmp/
tfplan-hardening-sprint
site/

# UAT runtime artifacts (canonical)
UAT/results/
!UAT/results/README.md
UAT/runner/cassettes/
!UAT/runner/cassettes/README.md
UAT/runner/__pycache__/

# Legacy Ralph artifacts (pre-migration; harmless if absent)
.claude/uat/results/

# Local uv resolver lockfile (repo does not standardize on committed uv.lock)
uv.lock
# Flattened uv --with-requirements helper written by ops/scripts/run_repo_python.sh
.generated/uv-requirements-no-find-links.txt
# #14996: publish-time staging of fingerprinted room documents (the served
# form); the source tree apps/dashboard/rooms/ stays the tracked SSOT.
.generated/published-rooms/
# #15638: product-CD publisher prune workspace (recorded published key set,
# prune bucket listings, and delete batches); runtime artifacts, not SSOT.
.generated/published-keys.txt
.generated/existing-keys.txt
.generated/prune-batches/
# #15965: content-hashed immutable-asset staging + manifests + scoped
# invalidation paths. Publisher/check scratch regenerated on every
# publish-dashboard-edge run (including the pre-push publisher checks);
# the source trees stay the tracked SSOT.
.generated/asset-manifest-raw.tsv
.generated/asset-manifest.tsv
.generated/hashed-assets-map.tsv
.generated/hashed-assets/
/.generated/invalidation-paths.txt
.generated/previous-asset-manifest.tsv
.generated/previous-manifest-fetch.log

# Scheduled tasks runtime lock (per-session runtime artifact)
.claude/scheduled_tasks.lock

# External projects (not part of Workweaver repo)
gbrain/
qmd/

# Surface-substrate wiring manifest (#7573): generated artifact published per
# CI run, never committed. The frozen baseline.json IS committed.
tests/conformance/surface_contract/wiring-manifest.json

# .gap-audit runtime artifacts (the SDLC-loop scratchpad — NOT source).
# DEPENDENCY-MAP.md / SKILL-DECONFLICTION.md / lesson-log.jsonl ARE tracked (committed).
# These are transient runtime state the burn/drain/loss ticks write + must not commit:
.gap-audit/burn-stop
.gap-audit/burn-active.lock
.gap-audit/burn-active*.lock
.gap-audit/regen.lock
.gap-audit/burn-cpu-sample.json
.gap-audit/burn-channel-failures.json
.gap-audit/burn-checkpoint.json
.gap-audit/burn-spend.json
.gap-audit/burn-tick.jsonl
.gap-audit/red-tick.jsonl
.gap-audit/improve-tick.jsonl
.gap-audit/canonical-maintenance.lock
.gap-audit/canonical-maintenance.approved
.gap-audit/canonical-maintenance.pause
.gap-audit/canonical-maintenance.jsonl
.gap-audit/canonical-maintenance-state.json
.gap-audit/eval-feedback/
.gap-audit/sdlc-loss.jsonl
.gap-audit/loss-actuation.json
.gap-audit/supervisory.jsonl
.gap-audit/bottleneck-trajectory.jsonl
.gap-audit/measure-tick.jsonl
.gap-audit/measure-results.json
.gap-audit/proposed-scenarios/
.gap-audit/MAIN-RED.signal
.gap-audit/red-main-debounce.json
.gap-audit/janitor-flake-reruns.json
.gap-audit/janitor-red-fixers.json
.gap-audit/bottleneck-history.json
.gap-audit/measure-stop

# autoresearch session state (harness-agnostic optimization loop)
.auto/

# Vendored helm chart dependencies (hermetic CD — repo-rot proof, #18006)
!infra/helm/**/charts/*.tgz

# Stray PR-body scratch files at the repo root (#18065)
/.pr-body-*.md
