# Secrets and local configuration
.env
.env.*
!.env.example
secrets/
*.pem
*.key
*.pfx
*.p12

# Local docker-compose bind-mount data root (see docker-compose.yml's
# KNOWLEDGE_HUB_APPDATA_ROOT — real Postgres/attachment/key data for local
# verification only, never committed).
/.local-appdata/

# Build-time-generated release identity (scripts/generate-release-manifest.mjs,
# docs/adr/ADR-029-v2-r5-final-hardening.md) — regenerated fresh on every build, never
# a source-controlled file. Anchored to the repo root only (M8's .gitignore lesson:
# an unanchored pattern here would also match any nested release-manifest.json under
# src/tests, which must never happen).
/release-manifest.json

# .NET
**/bin/
**/obj/
*.user
*.suo
TestResults/
coverage/
artifacts/
# Versioned product-design evidence. Runtime/test artifacts remain ignored.
!artifacts/
artifacts/*
!artifacts/design/
artifacts/design/*
!artifacts/design/v2/
artifacts/design/v2/*
!artifacts/design/v2/current-product/
!artifacts/design/v2/current-product/**
!artifacts/stitch/
artifacts/stitch/*
!artifacts/stitch/v2/
!artifacts/stitch/v2/**
.nuget/

# Node
node_modules/
.pnpm-store/
dist/
.vite/
playwright-report/
test-results/
blob-report/
coverage-final.json

# Agent-local state and private operational memory
/.claude/agent-memory/
.claude/settings.local.json
CLAUDE.local.md

# IDE and OS
.vs/
.vscode/*
!.vscode/extensions.json
!.vscode/settings.json
.idea/
.DS_Store
Thumbs.db

# Runtime data — anchored to the repository root (leading `/`) so these never
# match same-named *source* directories at any depth (e.g.
# src/backend/ItWorx.KnowledgeHub.Domain/Attachments/, .../Application/Attachments/):
# an earlier unanchored `attachments/` pattern here matched those directories too
# (worse, case-insensitively on Windows/macOS default git configs, since git's
# default core.ignorecase silently matched "Attachments" as well), which meant every
# file under them was silently never committed from M4 onward despite building and
# testing successfully in every working copy that already had them on disk. Found via
# a real clean-room clone failing to build (M8 release gate), not by inspection —
# see ADR-017.
/data/
/backups/
/imports/
/attachments/
/postgres-data/
*.db
*.sqlite
*.sqlite3
*.dump
*.backup

# Local logs
/.local-test-results/
*.log
logs/

# Python
__pycache__/
*.py[cod]
.pytest_cache/
.venv/

# Temporary
tmp/
temp/
*.tmp

# Local one-off repository export/backup snapshots — never a deployable or
# reviewable artifact; see docs/v2/V2_HANDOFF.md §4.
/itworx-knowledge-hub.zip