node_modules/
dist/
coverage/
reports/
.tsbuildinfo/
.tmp/
test-results/
*.tsbuildinfo
.stryker-tmp/
.prompt-language/
scripts/eval/results/
.dolt/
.beads-credential-key
.claude/worktrees/
experiments/full-saas-factory/e4-codex-crm-factory/workspaces/incomplete/
experiments/full-saas-factory/e4-codex-crm-factory/workspaces/runs/
experiments/aider-vs-pl/rescue-viability/runs/r9/r9-review-repeats-*/rep*-qwen3-8b-review-v*/
experiments/aider-vs-pl/results/h12-h14-local-*/h*/
experiments/aider-vs-pl/results/h15-api-endpoint-local-*/h15-api-endpoint-*/workspace/
experiments/aider-vs-pl/results/h15-local-*/h15-*/workspace/
experiments/results/harness-arena/

# Beads / Dolt files (added by bd init)
*.db

# Agent-shim runtime cache (never commit; only used when PL_SHIM_TRUST_CACHE=1)
scripts/eval/agent-shim/.binary-cache.json
.aider*

# Operator signer keys (NEVER commit private keys)
# Caught 2026-05-11: docs/security/provenance-attestation.md:289 claims
# .attest-keys/ is gitignored but it wasn't.
scripts/eval/.attest-keys/
**/.attest-keys/
*.key
*.pem
