# OS
.DS_Store
Thumbs.db

# Editor
.vscode/
.idea/
*.swp
*.swo

# Python server
__pycache__/
*.py[cod]

# Coverage artifacts
.coverage
coverage.json
htmlcov/
.pytest_cache/

# Local notes / scratch
*.local.*
scratch/
# superpowers SDD scratch (task briefs, review packages, progress ledger) — never committed
.superpowers/

.venv
.venv-py39-backup/
# Every .env variant, not just the canonical name: a `.env.bak-<date>` slipped past a bare
# `.env` rule and reached a commit on 2026-08-23. That one held only paths, but the next one
# would hold whatever the file held.
.env
.env.*
!.env.example
node_modules/

# ─────────────────────────────────────────────────────────────────────────────
# RUNTIME DATA — must NEVER be committed.
# This is a self-hosted app: everything under backend/data/ (ledger, connector
# credentials, auth secrets, AI memory/sessions, caches, logs, checkpoints,
# backups, the SQLite database itself...) is one instance's own live data.
# backend/data/ is ALSO the pre-2026-08-23 legacy default DATA_DIR — a local dev
# boot with no .env can still write here (see
# docs/adr/2026-08-23-zero-config-default-data-dir.md) — so a per-file allowlist
# leaks by construction: every new store/secret needs its own line, and a missed
# one commits a credential. Ignore the whole directory instead; un-ignore only
# this repo's own git-tracked seed/reference content below, each of which is
# read from a path fixed to this repo (core/paths.py), never from DATA_DIR — so
# un-ignoring it can never expose live instance data.
backend/data/*
# Shipped/built-in extension packs — read-only bundled content, not user-installed.
!backend/data/extensions/
# Tax-jurisdiction rule tables — bundled reference data, not user data.
!backend/data/tax_jurisdictions/

# Migration backups (local safety copies) wherever they land.
backend/*.bak-*
# Bank statement uploads / scratch files
*.xlsx
*.xls
*.csv.bak
/ignore

# Stale instance data removed in the data-cleanup pass — never track these again.
# dev-data/ and data_backup_*/ were experiment snapshots of REAL finances; the live
# instance now lives in DATA_DIR (~/.open-net-worth/data). test_transactions/ is a
# scratch drop for bank-statement uploads (PDFs). All hold personal data.
backend/dev-data/
backend/data_backup_*/
test_transactions/
# Agent git-worktrees (isolated build lanes) — large repo copies, never committed
.claude/worktrees/
.claude/scheduled_tasks.lock
.claude/launch.json
backend/cache/
# Application log files (rotating; runtime-only — never committed)
backend/logs/
frontend/_*.mjs

# browser-use QA harness — isolated venv + generated artifacts
qa/browser-use/.venv/
qa/browser-use/artifacts/
qa/browser-use/.qa_pids
# Deterministic CMD-01 production-build screenshots — local review evidence, never source.
qa/artifacts/crypto-market-data-failover/

# Runtime logs captured while driving QA harnesses — never source, and a stray log line is
# exactly the kind of accidental leak this project has to guard against (2026-08-24).
qa/artifacts/logs/
.qa/artifacts/logs/

# Dedup engine eval artifact (generated by make dedup-eval)
dedup-eval-report.json

# Tool caches (defense-in-depth — these self-ignore via tool-generated nested
# .gitignore files today, but a root-level rule guards against accidental tracking).
.mypy_cache/
.pytest_cache/
.ruff_cache/
.import_linter_cache/

# design-sync (claude.ai/design sync) — staged scripts, build output, machine state
.ds-sync/
ds-bundle/
.design-sync/.cache/
.design-sync/learnings/
.design-sync/node_modules
frontend/dist/types/
/node_modules

# Playwright MCP scratch output (console logs, page dumps, screenshots) — written
# into the repo by the browser server at runtime, never source.
.playwright-mcp/

# docs-site (Astro + Starlight public docs, reads docs/product/ — never holds
# its own copy) — build output and content-layer cache, both regenerated by
# `npm run build` / `astro dev`, never source.
docs-site/dist/
# The app-embedded build of the same site (backend/main.py mounts it at /docs).
docs-site/dist-embed/
docs-site/.astro/

# The publish audit catalogues real personal data by necessity (name, DOB, address,
# account numbers). It is an INTERNAL artifact and must never ship in a public repo —
# keeping it tracked would defeat its own remediation. It stays on disk for the owner.
docs/launch/PUBLISH_CHECKLIST.md
# Internal launch-tracking board — not part of the public project.
docs/launch/BOARD.md
docs/launch/LAUNCH_CHECKLIST.md
# Generated design-canvas payload (~2MB of editor code baked in at publish time).
# The .dc.html artboard sources beside it ARE tracked — the canvas is rebuilt from them.
design/*.html

# Design handoffs stay local (privacy: real figures leaked via prototypes once; commit da8e0cb72)
frontend/design_handoffs/
**.generated.*

# Wheel-only copies of frontend/dist, docs-site/dist-embed and docs/product (scripts/bundle_assets.py)
backend/_bundled/
# `uv build` output
/dist/

# Native desktop build outputs and isolated QA evidence.
desktop/runtime/
desktop/runtime-next/
desktop/runtime-windows-x64/
desktop/out-windows/
desktop/.runtime-build-*/
desktop/dist/
desktop/out/
desktop/.cache/
desktop/qa/artifacts/

# QA evidence (screenshots of real or test books) never enters the repo
docs/qa/evidence/
docs/qa/screenshots/
docs/qa/artifacts/
qa/artifacts/

# Internal working material, kept out of the public repo
/.claude/rfcs/
/.codex/rfcs/
/docs/superpowers/
/docs/rfc/
/docs/prd/
/docs/research/
/docs/review/
/docs/security/
/docs/launch/
/.design-sync/
