# Python
__pycache__/
*.py[cod]
*.egg-info/
.eggs/
build/
dist/

# Virtualenvs / caches
.venv/
venv/
.pytest_cache/
.ruff_cache/
.mypy_cache/

# Debian build artifacts
debian/proximo/
debian/proximo-dbgsym/
debian/.debhelper/
debian/files
debian/*.substvars
debian/*.log
debian/*.debhelper
debian/debhelper-build-stamp
*.deb
*.buildinfo
*.changes

# Proximo runtime — never commit audit logs or real config
*.log
audit.log
*.env
!*.env.example

# uv.lock is TRACKED, deliberately. It used to be ignored on the reasoning "library,
# consumers resolve their own deps" — true for PyPI consumers, and committing the lock
# does not change that, because the lock never enters the wheel. But this repo also ships
# a hash-pinned container and an SBOM built from requirements/*.txt, which are exports of
# the lock. With the lock ignored, that chain started at a file living on one machine, and
# any other clone regenerated the pins from a fresh resolution. Guarded by
# tests/test_requirements_lock.py::test_uv_lock_is_tracked_by_git.

# Throwaway verification/smoke scratch (may hold local paths; never commit)
.scratch/

# internal session scratch — never publish
.remember/
.claude/

# Coverage artifacts — local-only, regenerable (`uv run pytest --cov=proximo --cov-report=html`).
# A stale htmlcov/ sat here 4 weeks reading as current coverage; never let it look tracked.
htmlcov/
.coverage
.coverage.*
.venv-mcp2/

# mcp-publisher writes its registry session token beside the server.json it publishes.
# Untracked is not the same as ignored: `git add -A` would stage it, and this session used
# exactly that. Ignore it before a successful login can create it.
.mcpregistry_token
