# ── Secrets ───────────────────────────────────────────────────────────────
.env
.env.*
!.env.example

# ── Python ────────────────────────────────────────────────────────────────
__pycache__/
*.py[cod]
.venv/
venv/
.pytest_cache/
.ruff_cache/
.mypy_cache/
*.egg-info/
dist/
build/

# ── Node / Next.js ────────────────────────────────────────────────────────
node_modules/
.next/
out/
.turbo/
*.tsbuildinfo

# ── Foundry ───────────────────────────────────────────────────────────────
cache/
broadcast/
# NOTE: contracts/out is intentionally NOT ignored — Lane A publishes ABIs from
# there and every other lane consumes them (master plan §10 Lane A).

# ── Local runtime state ───────────────────────────────────────────────────
*.log
.anvil-state.json
scratch/
# Lane B: persisted mandates and AgentAction journals (agent/config.py state_dir)
.agent-state/
# Wave 0: e2e runs against an isolated AGENT_STATE_DIR so they never share a
# journal with a running agent — two writers corrupt line-count-derived ids.
.agent-state-*/

# ── OS / editor ───────────────────────────────────────────────────────────
.DS_Store
Thumbs.db
.idea/
.vscode/*
!.vscode/extensions.json

# A verbatim copy of .env — never track it (see docs/active-work.md)
env.txt

# Match the shape, not one filename. `.env*` did not cover `env.txt`, which is
# how a full copy of the real .env reached a commit via `git add -A`. The next
# one will be called something else.
*env.txt
env*.txt
*.env.local
secrets.*

# ...but the document that explains the rotation is not a secret, and `secrets.*` was quietly
# swallowing it. Narrow exception for exactly that path, which is safe now for a reason:
# `scripts/check-secrets.sh` scans staged content and is installed as a pre-commit hook, so a
# credential pasted into this file would be caught by shape rather than by filename. Do not widen
# this to a directory or a glob — the pattern above exists because the last leak had a name nobody
# had thought of.
!docs/secrets.md
