# DQIII8 .gitignore

# ── Knowledge base — content not versioned; populate locally ──────────
# Only the two policy/stub docs are committed; all corpus content is local.
knowledge/*
!knowledge/README.md
!knowledge/AUDIT_REPORT.md

# ── Session history — personal handover notes & chat logs ─────────────
sessions/

# ── Operational / ephemeral state ─────────────────────────────────────
zones/SESSION.md
claude-progress.txt
.claude/settings.local.json
objectives/
uploads/
var/
archived-projects/
.obsidian/
.stfolder
.stignore
.aider.input.history
.aider.chat.history.md

# ── Private projects — only README + .gitkeep allowed ─────────────────
my-projects/*
!my-projects/README.md
!my-projects/.gitkeep

# Database files — never commit binary DBs (use schema_v2.sql for fresh installs)
*.db
*.db-wal
*.db-shm
database/*.db
database/*.db-wal
database/*.db-shm

# Backup/dump chain — wholesale, not a narrow pattern (plaintext SQL dumps of the
# production DB live here and don't match any *.db* pattern above)
database/backups/
database/dqiii8.db.bak-*
# Ad-hoc pre-fix snapshots (e.g. dqiii8_history.db.pre-fix-<timestamp>) don't
# end in .db so *.db/database/*.db above miss them — real gap found live
# 2026-08-13 (Opus red-team review, round 2 P1-2): a 32MB untracked snapshot
# of this file sat unignored, one `git add -A` away from landing in a public
# repo with two prior secret-leak incidents.
database/*.db.pre-fix-*
database/*_history.db*

# Astro artifact of unknown provenance — no astro.config/package.json anywhere
# references it; gitignored rather than committed blind
.astro/

# Benchmark results (use schema_v2.sql for fresh installs)
database/benchmarks/*.json

# database/migrations/*.sql WAS gitignored here — reverted 2026-08-13 (Opus
# red-team review P1): schema_v2.sql is the fresh-install SSOT, but a changed
# VIEW needs a migration to actually apply to an existing DB (CREATE VIEW IF
# NOT EXISTS no-ops otherwise, see 01_database_mutations.md P3-9) — an
# ignored migrations/ dir made every such fix uncommittable and untracked.

# Plaintext SQL dumps of the production DB (e.g. database/legacy/*.sql) can
# contain secrets/PII from agent_actions rows — never commit them un-audited.
database/legacy/*.sql

# Config with real keys (example file IS committed, real file is NOT)
config/.env

# Root-level .env (all variants)
.env
.env.local
.env.*.local
*.env

# Auth & credentials — never commit
.claude/.credentials.json
credentials.json
auth/
*.pem
*.key
*.p12
*.pfx
id_rsa
id_ed25519

# Dashboard auth token
database/.dashboard_token
database/system_profile.json

# Pytest
.pytest_cache/

# Nightly report (regenerated each run)
tasks/nightly-report.md

# Agent worktrees (ephemeral)
.claude/worktrees/

# Skills cache (downloaded via /skills-sync — external repos, do not version)
skills-registry/cache/

# Ephemeral state flags
tasks/audit_pending.flag
tasks/status.md

# Session results (rotate)
tasks/results/

# Python
__pycache__/
*.pyc
*.pyo
.venv/
venv/
venvs/
*.egg-info/

# Windows
Thumbs.db
desktop.ini
*.lnk

# Aider
.aider.chat.history.md
.aider.input.history
.aider*

# Internal logs
database/system_metrics.log
database/audit_reports/jarvis_bot.log
database/audit_reports/*.md
database/audit-*.md

# Internal task directories (do not publish)
tasks/integration_proposals/
tasks/research/

# Internal system files
.jarvis_proposito
.dqiii8_proposito
objectives/active/
objectives/failed/

# Ephemeral task reports (regenerated — do not version)
tasks/gemini_reports/
tasks/github_reports/
tasks/precompact_state.json

# Premium features (not included in free tier)
knowledge/*/user_uploads/
knowledge/**/PREMIUM_*
knowledge/*/PREMIUM_*
knowledge/*/*/PREMIUM_*
knowledge/**/templates/
tasks/diagnostic_*.md
tasks/jarvis_architecture_v1.*
tasks/*.zip
tasks/*.pdf
tasks/*.html

# Large temporary files
*.zip
*.tar.gz

# Automatically generated decision files
decisions/adr-compliance.json
tasks/permission_rejection.json

# Node (Claude Code)
node_modules/
.mcp.json

# OMC plugin runtime state
.omc/

# === Internal/Private — never push to public repo ===
CLAUDE.md.save*
claude-progress.txt
PLAN_MAESTRO.md
00_DASHBOARD.md
CHANGELOG.md
!docs/CHANGELOG.md

# Internal directories
context/
sessions/
projects/
tasks/
decisions/
database/audit_reports/*
database/qdrant/

# Red-team / Opus adversarial review reports, panel reviews, disaster-test
# reports — private, may reference real infra/credentials/findings.
# Root cause of F-26 (2026-08-17): docs/audits/*.md was NOT gitignored,
# so a stress-test report with a raw VPS IP + DB credentials landed in
# public history. Never again: this whole category is private by default.
docs/audits/

# Internal implementation plans (private roadmaps/scope, may reference
# real infra or findings not meant for the public repo)
.claude/plans/

# spec-kit specs (internal feature specs — same rationale as plans/)
specs/

# User projects — track placeholder only, never project contents
my-projects/*/

# Archive — not for public consumption
bin/archive/

# Personal skills — only README.md is public
skills-registry/custom/*
!skills-registry/custom/README.md

# MCP local config
.claude/.mcp.json
.claude/settings.json

# Internal bin scripts
bin/script_benchmark.py

# OS files
.DS_Store
*.swp
*.swo
*~

# Editor files
.idea/
.vscode/
*.sublime-project
*.sublime-workspace
.project
.classpath
.settings/

# Temporary files
tmp/
temp/
*.tmp
*.bak
*.backup

# Build outputs
dist/
build/
.cache/

# Test coverage
coverage/
.nyc_output/

# Logs (generic)
logs/

# Project private context (never commit)
my-projects/PROJECT.md
my-projects/*/PROJECT.md

# Docs with internal info (premium-only)
docs/CHECKPOINT_*.md
docs/dqiii8_guide.html

# Personal / server-specific files (never commit)
server-hostinger.md
server-netcup.md
Guion-Sesion-Canon-Genesis-Chaos.md
my-projects/ANOVA-PLAN-v2.md
var/
database/legacy/*.db
docs/ROADMAP_TO_10.md
docs/PRO_CANDIDATES.md
docs/ARCHITECTURE.md

# Chat uploads (private)
uploads/

# Audit reports (private)
tasks/audit/

# Superpowers plans/specs (private — internal roadmaps)
docs/superpowers/

# Security — never commit credentials or purge logs
secrets_to_purge.txt
*.purge.txt

# Obsidian workspace artifacts
*.canvas
.obsidian/

# Gitleaks runtime state (keep local)
.stfolder

# === Client/vendor material — intentionally untracked (never publish) ===
# Confirmed 2026-08-12: NOT previously gitignored, so nightly.sh's unattended
# `git add -A && git commit` would have staged all of this into the public
# senda-labs/DQIII8 repo at its next scheduled run (03:05 UTC).
assets/branding/
docs/plglobal/
ops/plglobal/
docs/reference/fable5-world-demo/
