# Deployment secrets — never commit. versions.env IS committed (pins only, no secrets).
.env
*.env.local
/.seed-demo.env
# Materialised suite-identity secret files (mode 0600 bind sources): the
# materialiser writes them under compose/secrets/ (the include-relative bind
# path), and the pre-#635 cwd-relative secrets/ legacy location must stay
# uncommittable too. A materialised keyring must never reach a runner commit.
/secrets/
/compose/secrets/
# Agent enrollment token drop (mode-0600 bind source, VF_ENROLLMENT_TOKEN_DIR).
# The seeder mints a real environment-scoped credential into this directory.
/.suite/

# Editor / OS noise
.DS_Store
.vscode/

# E2E harness (Node/Playwright)
node_modules/
.next/
*.tsbuildinfo
/test-results/
/playwright-report/
/blob-report/
/.playwright/
# Repository agent instructions are intentionally versioned.
!CLAUDE.md
!AGENTS.md

# suite manifest build artifacts
dist/
__pycache__/
