# Secrets
.env
.env.*
!.env.example
*.pem
*.key
secrets/

# Python
__pycache__/
*.py[cod]
*.so
.Python
.venv/
venv*/
env*/
.pytest_cache/
.mypy_cache/
.ruff_cache/

# Data
data/
data-lab/
logs/
logs-lab/
*.log
.cb26-data/
.cb26-env/*
!.cb26-env/env.sh.example
*.sqlite
*.sqlite3
*.sqlite-wal
*.sqlite-shm
*.sqlite3-wal
*.sqlite3-shm

# Binarky
*.onnx
*.bin
*.deb

# Zalohy
*.bak
*.bak-*
*.bak_*
*.premigrate

# OS
.DS_Store
Thumbs.db

# ptah:harness:begin
# Managed by Ptah. Derived copies of ~/.ptah/user — edit the source, not these.
# Delete this whole block to opt out, or set harness.manageGitignore to false.
.claude/commands/
.claude/skills/
# ptah:harness:end

# Coverage (pytest-cov / coverage.py)
.coverage
.coverage.*
coverage.xml
htmlcov/
coverage.json
parallel-covered/

# Build artefacts (hatchling)
dist/
build/
*.egg-info/
wheels/
.eggs/

# Environment / direnv
.envrc
.direnv/

# node_modules (Kilo plugin dependencies)
node_modules/

# Agent Manager worktrees. These are CHECKOUTS of this repository, including
# their own .kilo/ config copies. Tracking them would duplicate the tree inside
# the tree, and a recursive clean here can destroy an in-progress session.
.kilo/worktrees/

# Stray SQLite artifacts produced by the ':memory:' / 'file:' DSN path bug
# that was fixed on 2026-10-04. The file in the repo root is evidence of the
# reproduction and is kept on disk deliberately; new ones must never be tracked.
file:*cache=shared*

# Superseded local snapshots and backup copies.
# These are NOT source: they are local copies of src/ that went stale and are
# still tracked. Ignoring them stops NEW ones from being committed; the already
# tracked copies are left in place deliberately - removal is a maintainer
# decision, not an automated one.
*.phase6-backup
security_plane_backup_*

# NOTE ON THE ptah:harness BLOCK ABOVE
# =====================================
# The block between `# ptah:harness:begin` and `# ptah:harness:end` is written
# by an external tool (Ptah), not by hand. It injects `.claude/commands/` and
# `.claude/skills/` rules into this file.
#
# This is a SMELL and is recorded here deliberately rather than "fixed":
#   * `.gitignore` is part of the security boundary of this repository - it is
#     what keeps secrets, local data and backups out of the tree. A file under
#     automated management is a file whose security-relevant contents can change
#     without appearing in a diff a reviewer would think to read.
#   * A managed block that appends ignore RULES can, if the tool is ever
#     re-run with different inputs, silently change what is tracked.
#   * There is a real (currently latent) risk of pattern collision between a
#     tool-injected rule and a project rule.
#
# Not removed, because it is tool-managed and removing it will simply be undone
# on the tool's next run. The fix belongs in the Ptah configuration
# (`harness.manageGitignore = false`), followed by a reviewed manual edit.