# Python
__pycache__/
*.py[cod]
*$py.class
*.so
.Python
env/
venv/
*.egg-info/
dist/
build/

# Test outputs
red_team_report_*.json
red_team_tests.log
*.log

# IDE
.vscode/
.idea/
*.swp
*.swo
*~

# OS
.DS_Store
Thumbs.db
desktop.ini

# Credentials
*.env
.env.local
credentials.json
secrets.yaml

# Temporary files
*.tmp
*.bak
november-meeting-extracted.txt

# Test run artifacts
*.json
!package.json
!pyproject.json
!schemas/*.json
# Published fixture sets are deliverables, not run artifacts. Without this the
# blanket *.json above silently drops them from `git add -A` (see PR #299).
!fixtures/**/*.json
# Same reason, third time: the generated coverage JSON is a published artifact
# that CI asserts is committed. The blanket *.json above dropped it silently and
# `git add -A` reported success (see PR #316).
!docs/coverage/*.json
# Published fixture sets are deliverables, not run artifacts: they are versioned,
# byte-stable, and meant to be consumed by external evaluation harnesses.
!reports/round_26/rcl-oracle-fixtures-*.json
# Same reason, fourth time (see PR #299, #316): the release-claims manifest is the
# artifact scripts/verify_release_claims.py and testing/test_release_claims.py both
# read. `git add -A` reported success and committed the validator and its test while
# silently dropping the file they validate; CI failed on FileNotFoundError. The
# manifest's own "must be present and non-empty" assertion is what caught it.
!docs/release-claims.json
# Fifth time (see PR #299, #316, and the two above). The result-semantics
# declaration is the file scripts/validate_result_semantics.py and
# tests/test_result_semantics_predeclared.py both read; without this negation
# `git add -A` commits the validator and its test and silently drops the
# declaration they validate.
!docs/result-semantics.json
# Sixth time. The one sample report the evidence-pack docs, the review briefs
# and every "regenerated against the real report" verification used was never
# in the public tree -- an external reviewer got a 404 from the tag. It carries
# no target URL and no credential (checked); it is the reproducibility fixture.
!reports/mcpstandard-dev-20260327.json
# Fourth time, 2026-09-02. Deposited evidence runs are the artifact that makes a
# reported verdict auditable rather than merely repeatable, so they are
# deliverables, not run output. The blanket *.json above dropped one silently and
# the commit reported success -- with a PR body already claiming the file was
# there. The pattern is now: any NEW directory of published JSON needs a negation
# here, and the check is `git status` after adding, not the exit code of `git add`.
!docs/evidence/**/*.json

# LaTeX build artifacts (docs/paper-dgb/ -- source of truth is main.tex +
# references.bib; compiled output is regenerated locally per its README)
*.aux
*.bbl
*.blg
*.out
*.fls
*.fdb_latexmk
*.synctex.gz
*.pdf

# Attestation records are deliverables, not run output. #384
!attestations/**/*.json
