Initial curated itworx-knowledge-hub source from 3b1751d0d9dee551aa6994eee0093704dc334817

.gitignore

@@ -0,0 +1,108 @@
+# Secrets and local configuration
+.env
+.env.*
+!.env.example
+secrets/
+*.pem
+*.key
+*.pfx
+*.p12
+
+# Local docker-compose bind-mount data root (see docker-compose.yml's
+# KNOWLEDGE_HUB_APPDATA_ROOT — real Postgres/attachment/key data for local
+# verification only, never committed).
+/.local-appdata/
+
+# Build-time-generated release identity (scripts/generate-release-manifest.mjs,
+# docs/adr/ADR-029-v2-r5-final-hardening.md) — regenerated fresh on every build, never
+# a source-controlled file. Anchored to the repo root only (M8's .gitignore lesson:
+# an unanchored pattern here would also match any nested release-manifest.json under
+# src/tests, which must never happen).
+/release-manifest.json
+
+# .NET
+**/bin/
+**/obj/
+*.user
+*.suo
+TestResults/
+coverage/
+artifacts/
+# Versioned product-design evidence. Runtime/test artifacts remain ignored.
+!artifacts/
+artifacts/*
+!artifacts/design/
+artifacts/design/*
+!artifacts/design/v2/
+artifacts/design/v2/*
+!artifacts/design/v2/current-product/
+!artifacts/design/v2/current-product/**
+!artifacts/stitch/
+artifacts/stitch/*
+!artifacts/stitch/v2/
+!artifacts/stitch/v2/**
+.nuget/
+
+# Node
+node_modules/
+.pnpm-store/
+dist/
+.vite/
+playwright-report/
+test-results/
+blob-report/
+coverage-final.json
+
+# Agent-local state and private operational memory
+/.claude/agent-memory/
+.claude/settings.local.json
+CLAUDE.local.md
+
+# IDE and OS
+.vs/
+.vscode/*
+!.vscode/extensions.json
+!.vscode/settings.json
+.idea/
+.DS_Store
+Thumbs.db
+
+# Runtime data — anchored to the repository root (leading `/`) so these never
+# match same-named *source* directories at any depth (e.g.
+# src/backend/ItWorx.KnowledgeHub.Domain/Attachments/, .../Application/Attachments/):
+# an earlier unanchored `attachments/` pattern here matched those directories too
+# (worse, case-insensitively on Windows/macOS default git configs, since git's
+# default core.ignorecase silently matched "Attachments" as well), which meant every
+# file under them was silently never committed from M4 onward despite building and
+# testing successfully in every working copy that already had them on disk. Found via
+# a real clean-room clone failing to build (M8 release gate), not by inspection —
+# see ADR-017.
+/data/
+/backups/
+/imports/
+/attachments/
+/postgres-data/
+*.db
+*.sqlite
+*.sqlite3
+*.dump
+*.backup
+
+# Local logs
+*.log
+logs/
+
+# Python
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.venv/
+
+# Temporary
+tmp/
+temp/
+*.tmp
+
+# Local one-off repository export/backup snapshots — never a deployable or
+# reviewable artifact; see docs/v2/V2_HANDOFF.md §4.
+/itworx-knowledge-hub.zip