.gitignore

# ── macOS ─────────────────────────────────────────────────────────────────────────────────────────
.DS_Store
.AppleDouble
.LSOverride
._*

# ── Windows ───────────────────────────────────────────────────────────────────────────────────────
Thumbs.db
ehthumbs.db
Desktop.ini
$RECYCLE.BIN/

# ── Bazel ─────────────────────────────────────────────────────────────────────────────────────────
# Bazel creates these convenience symlinks at the workspace root
bazel-*

# Local user overrides (don't commit — each dev has their own)
.bazelrc.user

# ── Secrets ───────────────────────────────────────────────────────────────────────────────────────
secrets/*
!secrets/secrets.md

# ── Python ────────────────────────────────────────────────────────────────────────────────────────
__pycache__/
*.py[cod]
*.pyo
.venv/
venv/
*.egg-info/
dist/
.pytest_cache/

# ── Go ────────────────────────────────────────────────────────────────────────────────────────────
/vendor/
*.test
*.out

# ── Java ──────────────────────────────────────────────────────────────────────────────────────────
*.class
*.jar
*.war
*.ear
target/

# ── Editors ───────────────────────────────────────────────────────────────────────────────────────
.idea/
*.iml
.vscode/*
!.vscode/settings.json
!.vscode/tasks.json
!.vscode/launch.json
!.vscode/extensions.json
*.swp
*.swo
*~

# ── Devcontainer host-plumbing (see .devcontainer/.git-plumbing/README.md) ────────────────────────
# Runtime artifacts written by .devcontainer/initialize.sh on every `devcontainer
# up`. The .git-plumbing/ directory itself IS tracked (via its README); only the
# runtime-written files inside are ignored.
/.devcontainer/.host-git-common
/.devcontainer/.host-known-hosts
/.devcontainer/.host-allowed-signers
/.devcontainer/.git-plumbing/host-git-common-path
/.devcontainer/.git-plumbing/host-timezone
/.devcontainer/.git-plumbing/host-gitconfig
/.devcontainer/.git-plumbing/empty-allowed-signers
# TEND(migration): drop these two once every checkout has run an `up` on or after the
# bind-mount switch. No longer written (known_hosts and allowed_signers are bind-mounted);
# kept so a stale checkout can't stage its leftover copy of the user's known_hosts.
# initialize.sh deletes them on the next `up`.
/.devcontainer/.git-plumbing/host-known-hosts
/.devcontainer/.git-plumbing/host-allowed-signers

# ── Claude Code ───────────────────────────────────────────────────────────────────────────────────
# settings.local.json holds per-developer overrides — never shared
# worktrees/ is ephemeral scratch space used during development
.claude/settings.local.json
.claude/worktrees/