# Dependencies
node_modules/

# Environment & secrets
.env
.env.*
!.env.example
.dev.vars

# Local secrets — never commit
.api-key.local.txt
*.local.txt

# Build tools (binaries)
mcp-publisher.exe
mcp-publisher

# MCP Registry credentials
.mcpregistry_*
.mcp_publisher_token

# Database backups (local snapshots only)
backup.sql
backup-*.sql
*.sqlite
*.db

# Build artefacts
dist/
*.js.map
.wrangler/

# OS junk
.DS_Store
Thumbs.db

# IDE
.vscode/
.idea/

# Internal audit / report material — NEVER commit. Standing rule, 2026-09-02.
# These name still-open findings and internal strategy; the repo is public.
AUDIT*.md
*_AUDIT_*.md
*_AUDIT.md
EVIDENCE_PASS_*.md
*_FIXLIST*.md
CURRENT_STATE_MAP*.md
*_REVIEW.md
docs/SECURITY_AUDIT_*.md
docs/FRESHCONTEXT_*_AUDIT_*.md
docs/FRESHCONTEXT_MATH_SPINE_REVIEW.md

# Internal / strategic notes — not for public repo
# These contain session continuity, strategy, financial context, etc.
CLAUDE.md
HANDOFF.md
ROADMAP.md
docs/TRUST_ROADMAP.md
TIME_CHECK_README.md
SESSION_SAVE_*.md
_archive/
.claude/
FreshContext-Private-Data-Room/
Private-Data-Room/
private-data-room/

# Local logs and package artifacts
logs/
tmp/
*.log
npm-debug.log*
*.tgz

# Python bytecode. scripts/verify_offline.py is loaded as a module by
# tests/offlineVerification.test.ts to run the RFC 8032 vectors, which makes CPython
# write __pycache__ next to it.
__pycache__/
*.py[cod]

# Output of scripts/prove-live-attestation.mjs (live verdict bytes, regenerated per run).
proof/
.attestation-proof/

# TypeScript project-reference build state (packages/core -> dist/core)
.tsbuildinfo/

# Service-kit evidence output. The four service:* runners write client evaluation
# evidence here — the client's own fixtures, source URLs and document content.
# It is engagement material, not repository material, and git history makes a
# mistaken `git add -A` during delivery effectively permanent. SOP-009 requires
# client data stay out of this repository; this is the mechanical half of that.
# The default output root, plus any operator-chosen private path under it.
service-output/

# Private commercial registers are maintained outside this public repository.
# Ignore them here so normal Git add flows do not accidentally stage a copied or
# regenerated private register. This is a guardrail, not a security boundary:
# an explicit force-add can still override .gitignore.
# SERVICE_READINESS.md remains deliberately public.
CLAIMS_MATRIX.md
GAP_REGISTER.md
