# Claude Code (AI assistant settings — never commit)
.claude/

# CITADEL governance runtime (local governance state — not for VCS)
.citadel/

# Environment
.env
.env.local
.env.*.local
**/.env
**/.env.local
**/.env.*.local

# Secrets / keys
*.key
*.pem
*.p12
*.pfx
*.cert
*.crt
secrets/
**/secrets/

# IDE
.idea/
.vscode/
*.swp
*.swo
*~
.project
.classpath
.settings/

# OS
.DS_Store
Thumbs.db
Desktop.ini
ehthumbs.db

# Docker volumes
pgdata/
redisdata/

# Build artifacts
*.exe
*.exe~
*.dll
*.so
*.dylib

# Go
/bin/

# Rust
**/target/

# Node
**/node_modules/
**/dist/
**/build/

# Python
__pycache__/
*.pyc
*.pyo
**/venv/
**/.venv/

# Coverage
coverage.out
coverage.html
*.coverprofile
tarpaulin-report.html
lcov.info
# go test -coverprofile=coverage_<name>.out / cov.out (per-track scratch
# profiles from local/agent coverage runs — coverage.out alone above
# doesn't catch these prefixed/suffixed variants)
coverage_*.out
*_coverage.out
*_cov.out
cov.out
cover_*.out
coverage*.xml

# Crash artifacts (e.g. a shell crashing mid-command)
*.stackdump

# Reports (generated)
**/reports/*.html
**/reports/*.pdf
**/reports/*.json
**/reports/*.sarif

# Logs
*.log

# Temporary files
*.tmp
*.bak
*.orig

# SDK build output
sdk/dist/
sdk/pkg/

# Helm environment overrides (contain real hostnames, endpoints, tuning)
# Commit only *.example files; keep actual values local.
deploy/helm/opensecstack/values.prod.yaml
deploy/helm/opensecstack/values.staging.yaml

# Website build output
website/.next/
website/out/
website/public/build/
