# Byte-compiled / cache
__pycache__/
*.py[cod]
*$py.class

# Distribution / packaging
build/
dist/
*.egg-info/
*.egg
wheels/
pip-wheel-metadata/

# Virtual environments
.venv/
venv/
env/
ENV/

# Test / coverage / type-check caches
.pytest_cache/
.mypy_cache/
.ruff_cache/
.hypothesis/
.coverage
.coverage.*
coverage.xml
htmlcov/

# Runtime scratch dirs created by zeo_core's fs service
.zeo/

# Editors / OS
.idea/
.vscode/
*.swp
.DS_Store

# Secrets
.env
.env.*
!.env.example
*.pem

# Credential artefacts the LIBRARY ITSELF writes (RULING-407 item 0).
# zeo_config.yaml and .env were already covered; these two were NOT, so the
# SETTINGS file was protected while the LIVE OAUTH TOKEN was committable.
# Unanchored on purpose: google/config.py defaults these CWD-RELATIVE, so they
# land under whatever directory the user was standing in, not only ./config/.
# DEFENCE-IN-DEPTH ONLY -- NOT the root fix. A PyPI user has no git at all;
# the real fix is moving the defaults out of cwd (RULING-407 item 1/2).
google_credentials.json
google_client_secret.json
*.key

# ZeoCore default config-YAML locations (RULING-356 s4.2 / config-secrets-hardening
# charter item 2). Defense in depth: config YAML is not the documented home for
# secrets (that's .env), but a junior who ignores the docs and types a key here
# must be stopped by a rule, not by their own attention. Covers the two default
# locations that are actually repo-relative per config/loader.py:52-57
# (DEFAULT_CONFIG_LOCATIONS); ~/.zeo/config.yaml and /etc/zeo/config.yaml are
# outside any repo tree and cannot be covered by a repo-local .gitignore.
# Narrowed to the exact default filename/path so a legitimately-tracked file
# under examples/ (e.g. a sample config meant to be committed) is unaffected.
/zeo_config.yaml
/config/zeo_config.yaml

# Jupyter
.ipynb_checkpoints/

# Machine-local doctrine symlinks -> sibling zeroemployeeorg/org checkout.
# zeocore is an implementation repo; canonical doctrine lives in the org corpus.
# These links escape the repo and would DANGLE in any clone without org as a
# sibling, so they are deliberately never tracked (see CLAUDE.md).
/roles
/authoring
