
!/.npmrc
!plugins/**/.mcp.json
!plugins/mcp/*/.mcp.json
!plugins/saas-packs/databricks-pack/000-docs/
!plugins/saas-packs/databricks-pack/000-docs/**
#
#    NOTE: the pattern below uses `**/*/000-docs/` (requires at least one parent
#    canonical cross-repo standards via `!` rules below.
#    defeated every `!000-docs/...` re-include rule below. Repaired 2026-05-21.
#    directory before `000-docs/`) so it ONLY matches nested 000-docs, not the
#    root. The original `**/000-docs/` rule matched root too, which silently
#    — these are per-pack private docs, never tracked.
#   v3.x legacy:   6767-* prefix (kept tracked during transition; will deprecate)
#   v4.3 standard: 000-* prefix (current — see 000-DR-STND-document-filing-system.md)
# 1) Ignore nested 000-docs/ everywhere (e.g. plugins/saas-packs/*/000-docs/)
# 2) For ROOT-level 000-docs/, ignore at file level so we can re-include the
# Beads / Dolt files (added by bd init)
# Beads task management (development tooling only - never ship to production)
# Both the issue bodies and any external reply links into this directory; the
# Build outputs
# CLAUDE.md § "Auto-cowork contract" + Doc Filing Standard v4.3.
# Claude Code to know how to spawn the server. Without this, mirrored
# Cowork download zips (generated at build time by build-cowork-zips.mjs)
# Databricks pack research catalog — explicitly published as the public design
# Dependencies
# Dolt database files (added by bd init)
# EXCEPT root-level canonical cross-repo standards:
# Environment
# External repositories and reference materials (do not commit)
# Filed once per release ceremony; references the GitHub Release + tag (already
# IDEs
# IMPORTANT: scrub tokens/webhooks before commit. If a session involved a leaked
# ISEDC Decision Records — the council skill's mandatory final step is /doc-filing
# Internal planning and research documents (do not commit to public repo)
# Internal-only AT-DECRs — records explicitly held out of the public re-include
# Logs
# Misc
# NPM configuration files (local overrides)
# OS files
# Pattern matches any *-AT-DECR-*.md at the root 000-docs/ level.
# Per-package .npmrc files remain ignored to allow per-developer overrides.
# Private documentation and business documents (NEVER commit)
# Re-include MCP server configs for plugins that ship them — required for
# Release Reports — /release Phase 8 AAR per Doc Filing Standard v4.3.
# Root .npmrc IS tracked — it holds workspace-wide pnpm hoist patterns
# Session AARs — After-Action Comprehensive Reviews per Doc Filing Standard v4.3.
# Session logs of multi-task work sessions (what was done, what's deferred, what
# Spec snapshots read by JRig Tier 3A (refreshed quarterly via PR, NOT live-fetch)
# Temporary migration preservation (do not commit)
# Testing
# The session JSONL under ~/.claude/skills/exec-decision-council/sessions/ is the
# Two-part rule because git can't re-include files inside an excluded *directory*:
# Workspace lab directory (safe sandbox for experiments)
# allowlist because their content is internal-only per a separate filing posture.
# and lessons-learned.
# and stays local. Add new internal records by their filing number as filed.
# artifact and the MCP handshake fails (see #645).
# doc-type for adversarial-technical decision records per Doc Filing Standard v4.3.
# durable source of truth for these records; the 000-docs copy is convenience-only
# files must be tracked for the cross-references to resolve. See repo
# into 000-docs/; without this allowlist that step copies the file into a gitignored
# location and the public record never exists in git. AT-DECR is the canonical 4-letter
# metrics, quality gates, beads <-> GH <-> Plane mirror, rollback procedure,
# needed for CI (bun-types resolution for vendored bun-native plugins).
# plugins under plugins/mcp/* end up missing .mcp.json in the install
# public) so no secrets risk. Documents pre-release state, what was applied,
# record backing the v2-rebuild community design review (GH issues #789-#795).
# secret in chat, redact it in the AAR (use `<REDACTED>` placeholder + flag for rotation).
# was explicitly NOT done). No inherent secrets risk; transparency is the point.
**/*/000-docs/
**/*/000-docs/**
# EXCEPTION: Grammarly v2 public contract research, architecture decisions,
# and release evidence ship with the operator pack.
!plugins/saas-packs/grammarly-pack/000-docs/
!plugins/saas-packs/grammarly-pack/000-docs/**
# EXCEPTION: Agent Systems Toolkit public research, architecture, threat model,
# and implementation evidence ship with the repository-owned toolkit.
!plugins/skill-enhancers/agent-systems-toolkit/000-docs/
!plugins/skill-enhancers/agent-systems-toolkit/000-docs/**
# EXCEPTION: Snowflake operator research and architecture records are published
# with the curated pack, like the Databricks benchmark corpus.
!plugins/saas-packs/snowflake-pack/000-docs/
!plugins/saas-packs/snowflake-pack/000-docs/**
# EXCEPTION: the consistency-validator golden fixtures deliberately ship
# miniature 000-docs/ trees — they ARE the test corpus for the
# index-vs-filesystem and dead-reference checks (GH #991 Phase 1).
!plugins/productivity/000-jeremy-content-consistency-validator/fixtures/**/000-docs/
!plugins/productivity/000-jeremy-content-consistency-validator/fixtures/**/000-docs/**
**/.npmrc
# Intentionally-synced upstream .npmrc files (load-bearing CI inputs from the
# external-sync pipeline). Scoped per-path so per-developer plugin .npmrc
# overrides stay ignored. Keep in sync with sources.yaml include lists.
!plugins/mcp/slack-channel/.npmrc
**/skills/*/data/
*.db
*.egg-info/
*.log
*.pyc
*.swo
*.swp
*.tmp
*~
.DS_Store
.DS_Store?
.Spotlight-V100
.Trashes
._*
.beads-credential-key
.beads/
.beads/*.db
.beads/*.db-shm
.beads/*.db-wal
.beads/.local_version
.beads/daemon.*
.cache/
.classpath
.dolt/
.env
.env.*.local
.env.local
.firebase/
.idea/
.lycheecache
.lycheecache/
# Root-anchored: ignore ONLY the repo-root local MCP config. Plugin-shipped
# .mcp.json files under plugins/** are product content and MUST be tracked —
# the unanchored form here silently re-ignored them (last-match-wins beat the
# !plugins/**/.mcp.json negations above; #985, llm-box casualty in sync #998).
/.mcp.json
.project
.pytest_cache/
.settings/
.venv
.venv/
.vscode/
/tmp/*.md
/tmp/*.sh

# Kernel-shadow advisory validator output (generated; CI artifact, not source)
scripts/.kernel-shadow/

# Kernel-vendor version-coupling advisory output (generated; CI artifact, not source)
scripts/.kernel-vendor-hash/

# Root 000-docs ignore policy lives in 000-docs/.gitignore (ownership + filing
# ledger — see that file's header; Mission 01 docs 720/726, bead claude-5awj.6).
EXECUTIVE-SUMMARY.md
MARKETPLACE-READY.md
PHASE-1-STATUS.md
PHASED-DEVELOPMENT-PLAN.md
PLUGIN-CATEGORIZATION-MATRIX.md
RESEARCH-FINDINGS.md
TOP-TIER-PLUGIN-IDEAS.md
Thumbs.db
_PRESERVE_MIGRATION/
__pycache__/
adk-python/
adk-samples/
build/
claudes-docs/
coverage/
.coverage
.coverage.*
dist/
# a2a-client is distributed as a self-contained marketplace/npm runtime. Its
# deterministic bundle is intentionally tracked so a plugin install has a real
# entrypoint before any package-manager lifecycle runs.
!plugins/mcp/a2a-client/dist/
!plugins/mcp/a2a-client/dist/index.js
ehthumbs.db
google-adk-reference/
logs/
marketplace/.firebase/
marketplace/backup-*/
marketplace/public/downloads/
# public/data/*.json is a PROJECTION of the canonical marketplace/src/data/*.json,
# regenerated on every build (and on `predev`) by scripts/copy-public-data.mjs.
# Tracking it duplicated ~28.5MB and gave a second, silently-divergeable claimant
# to a fact src/data/ already owns. Enforced by scripts/check-generated-artifacts.mjs.
marketplace/public/data/*.json
# Epic 1.7: this build-only projection has no supported checkout-level
# consumer. `npm run dev` regenerates readme-sections before Astro starts.
# Tracking is rejected by
# scripts/check-generated-artifacts.mjs.
marketplace/src/data/readme-sections.json
marketplace/src/data/cowork-manifest.json
node_modules/
npm-debug.log
package-lock.json
!plugins/mcp/governed-second-brain/plugin-runtime/package-lock.json
playwright-report/
playwright/.cache/
reports/
# ...but freshie's per-run delta reports are a tracked export (see
# freshie/README.md § "Run-delta & regression signal")
!freshie/reports/
skill-name-mappings.json
temp/
test-marketplace/
test-results/
tmp/
website/
# workspace/ stays a scratch sandbox by default — but NOT as `workspace/`, which
# excludes the directory itself so git never descends and no `!` rule inside can
# ever fire. `workspace/*` excludes the CONTENTS, leaving the dir walkable.
workspace/*
# ...EXCEPT the Learning Lab, which is published teaching material: root README
# L917/925/926 and the eight /learning/* site pages link these files on GitHub, so
# untracking them 404s public links. They were already wiped once by an unrelated
# sync commit and needed a CRITICAL RECOVERY (da09e99d7, 2025-12-21). Two-part
# rule because git cannot re-include files inside an excluded directory.
!workspace/lab/
!workspace/lab/**
yarn-error.log
yarn.lock

# Freshie CMDB — SQLite is the local runtime format; the versioned system of
# record is the Dolt repo (freshie/dolt/, local) pushed to public DoltHub
# (jeremylongshore/freshie-inventory). Neither belongs in git. The tracked
# compact export (freshie/grades.csv + grade-histogram.json) stays committed.
freshie/inventory.sqlite
freshie/inventory.sqlite-shm
freshie/inventory.sqlite-wal
freshie/dolt/
# Primary j-rig eval JSON is retained locally or in the configured artifact
# store; its digest and URI are recorded in forge_proofs, not the payload.
freshie/eval-artifacts/
# Archived inventory snapshots are local runtime evidence, not source
# (Mission 01 baseline, 2026-08: 42M untracked with zero consumers)
freshie/archives/*.sqlite

# Backup files created by freshie/scripts/batch-remediate.py during --execute
*.bak

# HF dataset build artifact (regenerate via freshie/scripts/build-hf-dataset.py)
freshie/hf-dataset/skills.jsonl

# SOPS-encrypted machine-local env (E1.14): ciphertext of live credentials
# stays off the public remote; scripts/sops-env decrypts it in-process.
# Named .sops.env so `sops exec-env` infers the dotenv format; the older
# .env.sops spelling stays ignored for compatibility.
.sops.env
.env.sops
