.gitignore

# Claude temporary files (per-developer; exceptions below for shared assets)
.claude/*
# Exception: project-local QA failure-mode library is shared with collaborators
# (see CLAUDE.md "Synthetic Fixtures" and ~/.claude/docs/SECOND_PASS_REVIEW.md)
!.claude/qa-failure-modes.md
# Exception: tracked TEMPLATE for the project's hook configuration. Copy to
# .claude/settings.json (gitignored) to opt in to the project's hook set.
!.claude/settings.example.json
.mcp.json
.superpowers/

# Build and distribution
dist/
build/
*.egg-info/
*.egg
*.dist-info/

# Python
__pycache__/
*.pyc
*.pyo
*.pyd
.Python
*.so
.pytest_cache/
.coverage
htmlcov/
coverage.json

# Splunk local configuration (should not be committed)
local/
metadata/local/
metadata/local.meta

# Demo/Test rule lookups (not production rules)
lookups/DR777_*.csv
lookups/DR778_*.csv
lookups/DR998_*.csv
lookups/_detection_rules.json
lookups/_versions/
# Soft-delete state — populated when users (or tests) trash CSVs.
# Phase 3.1 audit F-C2 (2026-05-18) found this previously tracked.
lookups/_trash/

# Runtime state files (generated by app at runtime)
lookups/_daily_limits.json
lookups/_approval_queue.json
lookups/_notifications.json
lookups/_col_widths.json
lookups/_presence.json

# Build artifacts
*.spl
*.tar.gz

# Development/testing files
# Note: tests/ directory is committed to git; only cache excluded via .pytest_cache
# test_*.py patterns are excluded only for ad-hoc test files in root, not in tests/
CLAUDE.md
login-check
081-after-rule-select
*.log
*.patch

# Session debris — screenshots taken during dev / Playwright runs end up
# at the repo root and accumulate. Canonical product screenshots live
# under docs/screenshots/ (still tracked because they don't match this
# root-only pattern). Round 9 (2026-04-29) — was 17 untracked PNGs at
# the root from past sessions, all session debris.
/*.png

# Build 638 (2026-05-01) — Chrome browser tool's `screenshot` action
# saves PNG dumps WITHOUT file extension when the user passes a bare
# name (e.g., "build-637-final" not "build-637-final.png"). The /*.png
# rule above doesn't catch them. These patterns cover the kebab-case
# naming conventions observed during the design audit chain.
/build-*
/cp-[0-9]*-*
/wm-[0-9]*-*
/at-[0-9]*-*
/[0-9][0-9][0-9]-*
/post-login-state
/post-token-set
/rule-selected
/light-theme
/lockdown-modal

# OS files
.DS_Store
.DS_Store?
._*
.Spotlight-V100
.Trashes
ehthumbs.db
Thumbs.db

# IDE files
.vscode/
.idea/
*.swp
*.swo
*~
.project
.pydevproject
.settings/

# Environment
.env
.env.local
.env.*.local

# Package managers
node_modules/
npm-debug.log
yarn-error.log
test-results/

# Graphify knowledge-graph tooling (local-only audit artifacts)
.graphifyignore
graphify-out/

# One-shot audit scratch (Semgrep rules pulled from external sources, raw scan output)
.audit/

# Backup artifacts produced by scripts/backup_data.sh — keep them
# out of the repo. Restore from a real backup target (S3, NAS,
# admin's offsite store), not from a checked-in tarball.
backups/

# Smoke-test temp dirs created by scripts/test_backup_restore.sh —
# auto-cleaned on success but leftover after a failed run.
.tmp_smoke_*/
.tmp_restore_*/

# Visual regression diagnostic artifacts (Ring 2 Day 6). Screenshots
# saved on every run for post-failure inspection; baselines (the
# actual contract) live under tests/e2e/visual_baselines/ and ARE
# committed.
tests/e2e/visual_artifacts/

# Screenshot output from the manual E2E scripts at tests/ root.
# Both test_e2e_realworld.py and test_e2e_manual_browser.py write
# e2e_phase*.png + screenshot_debug.png to their own dir at runtime.
# Phase 3.1 audit V2 finding F-L8 (2026-05-18) — 6 of these were
# previously tracked from an old March-29 run; they were dev debris,
# not pixel-diff baselines.
tests/e2e_phase*.png
tests/screenshot_debug.png

# Internal planning artifacts (GSD-style phase plans, research, ADR
# drafts, etc.). Phase 3.1 audit V2 finding F-M6 (2026-05-18) — 152
# tracked files contained 170 hardcoded `c:/Users/PC/wl_manager/...`
# and `c:/Users/PC/.claude/...` references at the maintainer's local
# layout, exposing Windows username + working-dir + home-dir tooling
# layout to any visitor of the public repo. Per user decision (Phase G
# batch authorization 2026-05-18), the whole directory becomes
# local-only working artifacts. Contents preserved on disk; just
# untracked.
.planning/

# Playwright MCP output (interactive ad-hoc browser drives). Stores
# session-local screenshots, snapshots, and console logs from
# mcp__playwright-iso__* tool calls. Local-only by design.
.playwright-mcp/

# Mutation-testing cache (Ring 3 Day 2). Local-only; the harness
# (`scripts/mutmut.sh`) recreates it on each `run` invocation
# inside the wl_manager_mutmut container.
.mutmut-cache

# Performance benchmark output (Ring 3 Day 5). The harness
# (`scripts/bench.py`) writes timestamped JSON files for each
# run under bench_results/. Local-only by default; users who
# want to commit a reference baseline override the ignore for
# specific files (e.g. `bench_results/!cold_start_baseline.json`).
bench_results/*.json

# ZAP baseline-scan local triage reports (Ring 5 Day 3 follow-up).
# The CI workflow uploads its own report artifacts; locally-run
# reports under tests/zap-reports/ are scratch for one-shot
# triage rounds. Keep .gitignore'd so we don't commit point-in-time
# HTML/JSON dumps (which are large + drift on every Splunk update).
tests/zap-reports/

# Same shape for a11y reports — JSON per-page output is scratch.
# The baseline.json contract is committed; the raw reports are not.
tests/a11y/reports/

# MemPalace per-project files (issue #185)
mempalace.yaml
entities.json

# Firecrawl scratch — page scrapes from research/competitor-analysis
# sessions land here; not project content. Phase 3.1 pre-public audit
# removed 3 unrelated career-page scrapes that had been accidentally
# tracked (2026-05-18).
.firecrawl/
scripts/screenshot_prep.py