venv
.venv
.idea
node_modules
.next
.env
.env.local
# Catch per-env files and hand-made backups (.env.backup-*, .env.qa, ...).
# The bare `.env` pattern matches that exact name only, so a copy taken before
# an edit was committable — with every secret in it.
.env.*
!.env.example
*.pckl
.langgraph_api
__pycache__
*.pyc
*.duckdb
# SOC CoResolve corpus-builder output — may contain real customer alert data
soc-coresolve/corpus-builder/discovery_report.json
soc-coresolve/corpus-builder/probe_*.json
soc-coresolve/corpus-builder/corpus/
soc-coresolve/corpus-builder/raw/
soc-coresolve/corpus-builder/checkpoints/
# ...including archived generations and other-phase scopes. Match any raw/
# checkpoint sibling regardless of separator — a data dir that is merely
# untracked (not ignored) is one `git add .` away from committing customer data.
soc-coresolve/corpus-builder/raw[-_]*/
soc-coresolve/corpus-builder/checkpoints[-_]*/
soc-coresolve/corpus-builder/*.log
# S4 backtest reports stay local until report-retention is decided (gate-spec open q #3)
soc-coresolve/backtest/reports/
# Ignore Claude local state anywhere (settings.local.json, nested backend/.claude)...
.claude/
# ...but track the shared project commands at the repo root (personal *.local.md stay ignored).
!/.claude/
/.claude/*
!/.claude/commands/
!/.claude/dev-flow.md
/.claude/commands/*.local.md
!/.claude/skills/
*.png
# ...except the training UI guide's screenshots, which are documentation assets
!docs/training-manifests/ui-guide/img/*.png
data/
# ...except the dyno-coresolve pack's shipped Fleet Baseline V2.1 (real package
# data checked into the repo, not a local/scratch dump).
!backend/api/services/agent_tools/dyno_pkg/data/
!backend/api/services/agent_tools/dyno_pkg/data/baseline_v2_1/
!backend/api/services/agent_tools/dyno_pkg/data/baseline_v2_1/*
logs/
test_users_dev.json
.env.test
.envrc
*.pem
*.tfstate
.terraform
.terraform*
!.terraform.lock.hcl
*.tar
*.tar.gz
**/.DS_Store
*.log
*.backup
# new_agents/
/agents/
/agents_bkp/
/core/
.python-version
.workspace

# CLI state and test files
.fp/
*_logs.txt
test-*.csv
test-*.yaml
*.whl

# Local platform startup/shutdown scripts and runtime state
start-platform.sh
stop-platform.sh
.platform-pids/
.vscode/
/graphify-out

# Research/analysis docs not part of the codebase
docs/AR_CoreSolve_v2_Competitive_Analysis.md
.playwright-mcp

# graphify (personal, local-only — do not push)
CLAUDE.md
graphify-out/
**/graphify-out/
.graphify_*
.graphifyignore
.mcp.json

# Serena MCP — entire project-local cache, config, and memories (do not push)
.serena/

# Generated test reports + git/tooling caches (do not commit)
*test_report*.html
*test_report*.json
FETCH_HEAD
.pytest_cache/
.import_linter_cache/

# MCP tool local state (Playwright browser profile, Serena project cache)
.playwright-mcp/
.serena/

# local/ — per-developer scratch space that must never be committed.
# Use it for anything that's useful while working but doesn't belong in the repo:
# generated docs/diagrams, exported spreadsheets, throwaway scripts, sample
# payloads, integration experiments, scratch notes, etc. Anything under local/
# is git-ignored, so it stays on your machine only. Keep real source, packs, and
# shared assets in their proper tracked locations — not here.
local/
.pnpm-store/

# Local agent instructions and tool state
AGENTS.md
.agents/
.codex/
# NOTE: no bare `.claude/` here — it would defeat the `!/.claude/skills/`
# and `!/.claude/commands/` carve-outs at the top of this file (later rules
# win). Nested/local Claude state is already ignored by the block up top.
.claude/

# Okta MCP server signing key (never commit real private keys)
servers/okta_fastmcp/private_key.json

# Local connector/pack credentials must be supplied through credential storage.
/servers/google_drive/auth.json
/workspace_packs/recruiter-coresolve/auth.json

scripts/livekit-webrtc-tester

# process-runtime lab working copies (scripts/qa/process_labs.py)
.labs/
