# Data cache (disposable — rebuildable from provenance)
# Ignore contents but track README
data/*
!data/README.md
data/*/

# Python
__pycache__/
*.py[cod]
*.egg-info/
dist/
build/
.eggs/

# Virtual environments
.venv/
venv/

# IDE
.idea/
.vscode/
*.swp
*.swo

# OS
.DS_Store
Thumbs.db

# mypy
.mypy_cache/

# pytest
.pytest_cache/

# ruff
.ruff_cache/

# Generated HTML (status page output)
status.html

# Operational artifacts (regenerable)
provenance/
reports/audit/
reports/audit_acled/
reports/audit_ghsbuilts/
reports/audit_ghspop/
reports/audit_vdem/
reports/presentation/

# Graphify output (generated knowledge graph artifacts)
graphify-out/

# Credentials (never commit secrets)
.env
.env.*
credentials.toml

# Pipeline logs — NEVER commit these.
# refresh.log aggregates every pipeline run's stdout, which is the sink
# that carried the C-322 credential leak. The repo is public; a single
# `git add -A` would publish it. Security audit 2026-07-31.
logs/
*.log

# Session
resume_session.md

# Claude Code
.claude/

# Operator-local agent instructions. Untracked from 2026-07-31 — it carries
# working conventions and authority boundaries that belong to whoever is
# running the session, not to the published package. Existing history is
# left alone deliberately; nothing in it is sensitive.
CLAUDE.md
