.gitignore

# ── IDE & OS ──────────────────────────────────────────────
*.iml
.DS_Store
Thumbs.db
Desktop.ini
/.idea
.kotlin

# ── Claude Code ───────────────────────────────────────────
.claude/settings.json
.claude/settings.local.json
.claude/worktrees/
.claude/scheduled_tasks.lock
.mcp.json
!plugins/*/.mcp.json
# Private session artefacts (CDI-safety: do not expose employer/maintainer identity)
# .claude/STATE.md = the single live session-state source of truth (methodology v2).
# Gitignored on purpose: the IN-FLIGHT claim ledger mutates on every parallel session,
# so tracking it would mean constant merge conflicts (same class as GeneratedDemos.kt
# / llms-txt.ts). The durable cross-host shadow is the GitHub `in-progress` label.
.claude/STATE.md
# .claude/data/ = local runtime evidence for the Evidence-Stamped Claim Gate (#2346):
# last-store-probe.json, the /store-status live-probe record that claim-gate.sh reads on
# the git-push hook to block unevidenced claims. Same policy as STATE.md — same-host,
# mutates constantly, never committed. (It also held claim-ledger.tsv until 2026-08-13;
# that ledger and its /caught command are gone, and claim-gate.sh never read it.)
.claude/data/
.claude/handoff*.md
.claude/handoff-archive/
.claude/SESSION_*.md
.claude/SESSION-*.md
.claude/NEXT_SESSION_PROMPT.md
.claude/NOTICE-*.md
.claude/active-branches.md
.claude/audit-*.md
.claude/pixel9-*.md
.claude/website-review-*.md
.claude/launch.json
.claude/plans/
.claude/marketplace-submissions/
.claude/reports/
.claude/qa-evidence/
RERUN-CHECK.md

# ── Flutter tooling artefacts ─────────────────────────────
# `.dart_tool/` was ignored but the rest of the build output was not, and
# `flutter pub publish` ships every non-ignored file: one `flutter build`
# inside flutter/sceneview_flutter/example was enough to put
# example/build/flutter_assets/* into the pub.dev tarball and take it from
# ~1 MB to 16 MB. Ignore the artefacts an example build actually produces.
flutter/**/.dart_tool/
flutter/**/build/
flutter/**/.flutter-plugins-dependencies
flutter/*/example/pubspec.lock

# ── Off-topic personal-portfolio code (NEVER in sceneview org) ──
hub-gateway/
hub-mcp/
mcp/docs/registry-submission-guide.md
mcp/docs/strategy-report.md
marketing/mcp-registry-submissions.md
marketing/articles/article-2-mcp-servers-3d.md
mcp-gaming/
mcp-interior/

# ── Gradle ────────────────────────────────────────────────
/local.properties
/.gradle
/build
/captures
.externalNativeBuild
.cxx
samples/*/build/
sceneview-core/build/
sceneview-web/build/
sceneview-desktop/build/
tools/snippets-check/build/

# Standalone RN Android bridge compile gate (#3042). It is its own Gradle
# BUILD, not a module of the root one, so it grows a `.gradle/` of its own
# next to the `build/` the root patterns above would not have matched either.
tools/rn-android-compile/build/
tools/rn-android-compile/.gradle/
# Belt and braces: the harness redirects the module's output into itself, but
# anything that opens `react-native/react-native-sceneview/android` directly
# (Android Studio, a host app's build) writes here — and npm SHIPS that
# directory (`package.json` → `files: [… "android" …]`), so a stray build dir
# would end up inside the published tarball.
react-native/react-native-sceneview/android/build/
react-native/react-native-sceneview/android/.gradle/

# ── Kotlin/JS ─────────────────────────────────────────────
kotlin-js-store/

# ── Node.js ───────────────────────────────────────────────
**/node_modules/
hub-mcp/package-lock.json

# ── MCP ───────────────────────────────────────────────────
mcp/.DS_Store
mcp/demo/*.mp4
# `mcp/dist/` is a build artefact — `tsc` output regenerated by the
# `prebuild` / `prepare` / `test` lifecycle scripts on every `npm install` /
# `npm run build` / `npm test` / `npm publish`. Committing it meant the
# compiled JS silently drifted from `src/` (issue #2047 — committed
# `dist/generated/llms-txt.js` embedded a stale SceneView SDK version). The
# npm tarball is always built fresh on publish via `npm run prepare`, so the
# committed copy was never used by anything. Same "no committed generated
# artefact" decision as #1928 (`mcp/src/generated/llms-txt.ts`).
mcp/dist/
mcp/llms.txt
mcp/.mcpregistry_*
.mcpregistry_*
# `mcp/src/generated/llms-txt.ts` embeds the entire root `llms.txt` as a
# ~230 KB string literal. Committing it produced a guaranteed merge conflict
# on every parallel PR that also touched `llms.txt` (issue #1928). It is now
# generated at build time — `npm install` / `npm run build` / `npm test` /
# `npm publish` all run `scripts/generate-llms-txt.js` via the
# `prepare` / `prebuild` / `test` lifecycle scripts.
mcp/src/generated/llms-txt.ts
# `mcp/src/generated/symbols.ts` is the public-API symbol index parsed from
# the committed `.api` dumps by `scripts/generate-symbols.js` (#2760). Same
# no-committed-generated-artefact decision as above: any PR that changes the
# public API would conflict on it, and the dumps it derives from are already
# committed and CI-gated (`apiCheck`).
mcp/src/generated/symbols.ts

# ── Swift / Xcode ─────────────────────────────────────────
SceneViewSwift/.build/
SceneViewSwift/.swiftpm/
DerivedData/
*.xcodeproj/xcuserdata/
*.xcworkspace/xcuserdata/
samples/ios-demo/.build/
# Xcode-resolved SPM checkout/state — generated, and `workspace-state.json`
# bakes in absolute machine paths, so it must never be committed.
samples/ios-demo/SourcePackages/
# SwiftPM build dir at any depth (root `.build/` appears when `swift build` is
# run from the worktree root).
.build/
# XcodeBuildMCP: config.yaml is tracked project config (it enables the
# ui-automation + device workflows the iOS demo QA needs — AR cannot run on a
# simulator). Anything else the tool drops in that directory is a local cache.
.xcodebuildmcp/*
!.xcodebuildmcp/config.yaml

# ── Android artifacts ─────────────────────────────────────
*.apk
*.aab

# `GeneratedDemos.kt` is the collated output of the append-only DemoRegistry
# fragments (issue #1797). Committing it produced a guaranteed merge conflict
# on every parallel demo-adding PR (issue #1976) — the same conflict class
# #1928 killed for `mcp/src/generated/llms-txt.ts`. It is now generated at
# build time: the `generateDemoRegistry` Gradle task runs
# `samples/android-demo/scripts/collate-demos.sh --kt-only` before
# `:samples:android-demo` Kotlin compilation.
samples/android-demo/src/main/java/io/github/sceneview/demo/fragments/GeneratedDemos.kt

# `GeneratedScenes.swift` is the iOS counterpart of `GeneratedDemos.kt` —
# collated from per-demo `*Scene.swift` files by
# `samples/ios-demo/scripts/collate-ios-demos.sh`. Same rationale: committing
# it causes guaranteed merge conflicts on parallel demo-adding PRs (issue #1872).
# Xcode regenerates it before each build via the "Collate iOS demos" Run Script
# phase in `SceneViewDemo.xcodeproj`.
samples/ios-demo/SceneViewDemo/Views/Demos/GeneratedScenes.swift

# ── MkDocs ────────────────────────────────────────────────
docs/.cache/
docs/site/
site/

# `docs/docs/llms.txt` is a byte-for-byte mirror of the root `llms.txt`,
# served by mkdocs at `/docs/llms.txt` (issue #899). Committing the mirror
# meant every PR touching root `llms.txt` had to remember to update the copy
# (or run `sync-versions.sh --fix`) — drift landed on `main` repeatedly
# (#1822 → #1847) and turned the quality gate red on otherwise-clean PRs.
# It is now generated from root `llms.txt` at docs-build time by
# `.github/workflows/docs.yml` (the "Mirror root llms.txt into docs" step,
# before `mkdocs build`) and `.gitignore`d. Being a copy made fresh on every
# build, it is fresh-by-construction and cannot drift — the same
# "no committed generated artefact" decision as #1928
# (`mcp/src/generated/llms-txt.ts`) and #1976 (`GeneratedDemos.kt`).
docs/docs/llms.txt

# ── Environment & secrets ─────────────────────────────────
.env
.env.local
.secrets/

# ── Signing & keystore artefacts (defense in depth) ───────
# The Play Store keystore is decoded transiently in CI (.github/workflows/play-store.yml)
# and rm'd in `if: always()`, but a workflow interrupted between decode and rm could
# leak it via failure artifacts. These patterns also block accidental `git add -A`
# after running release tooling locally.
**/*.keystore
**/*.jks
**/google-services.json
# iOS demo Sketchfab key — the REAL key lives here (gitignored). The committed
# `Secrets.xcconfig.template` (placeholder) is intentionally NOT matched — do
# NOT widen this to `**/Secrets.xcconfig*` or the template stops being
# committable. See samples/ios-demo/SceneViewDemo/Config.xcconfig (#2356).
**/Secrets.xcconfig
**/*.p12
**/*.mobileprovision
# Exception: React Native debug keystore is the well-known shared dev key,
# safe to track and required for RN Android dev builds.
!samples/react-native-demo/android/app/debug.keystore

# ── Private / strategy ────────────────────────────────────
pro/
marketing/
branding/SECRETS.md
branding/SPONSOR_TIERS.md
.claude/handoff.md
.claude/branding.md
# Business positioning / partnership pitches must NOT ship via public mkdocs
# (reachable by direct URL even when not in nav). Originals live in
# ~/Projects/profile-private/sceneview-strategy/.
docs/docs/anthropic-*.md
docs/docs/*-pitch.md
docs/docs/*-contribution.md

# ── Large media (binaries, not source) ────────────────────
/video/

# ── Shared asset catalog (downloaded via tools/download-assets.sh) ──
/assets/models/
/assets/environments/
/assets/textures/

# ── Platform demo assets (copied via .claude/scripts/sync-assets.sh) ──
# Note: android-demo-assets is NOT ignored (Play Asset Delivery, must be in git)
# Note: the web demo's self-hosted GLB catalog + IBL (#1573) now live under
# samples/web-demo/site/, which is force-added (`git add -f`) like the rest of
# site/ — see the kotlin-bundle note below. The old Kotlin/JS source set at
# samples/web-demo/src/jsMain/resources/ was deleted with the dead source set
# in #1946/#1950; anything reappearing there is a stale local copy of
# assets/models/glb/, not source. Do not re-add a rule for it.
samples/android-tv-demo/src/main/assets/
samples/flutter-demo/models/
samples/react-native-demo/assets/models/
samples/react-native-demo/ios/Models/

# ── Playwright web-demo QA artifacts ──
samples/web-demo/test-results/
samples/web-demo/playwright-report/

# Kotlin/JS bundle smoke-test staging: the built bundle + version-matched
# Filament runtime that .claude/scripts/web-bundle-smoke.sh copies into
# samples/web-demo/site/kotlin-bundle/ are build artifacts. They are already
# covered by the broad `site/` rule above; the fixture pages in that directory
# (index.html, splat.html — #2646) and the splat asset
# site/models/splats/rainbow_sphere.ply are force-added (`git add -f`), matching
# how the rest of site/ is tracked.

# samples/web-demo/site/js/model-sources.js is SOURCE, not a build artifact —
# the multi-source Explore catalog layer (#2722). It sits under the broad
# `site/` ignore above, so like the kotlin-bundle fixture page it is
# force-added (`git add -f`); this note exists because `git status` will
# NEVER show it as modified-untracked — always `git add -f` after editing it.

# Local MCP workspace artifacts (not canonical — canonical code is in mcp/packages/)
mcp-automotive/
mcp-healthcare/
mcp-gaming/
mcp-interior/
mcp-strategy-report.md

# AR test fixtures — actual MP4 recordings stay LOCAL only.
# Public fixtures must be vetted for PII (camera frames) before commit.
# Treat each MP4 like the device screenshots from the 2026-05-07 incident:
# fully audit content before promoting to a tracked file.
samples/android-demo/src/androidTest/assets/ar-recordings/*.mp4
samples/screenshots/qa_log*.txt

# QA / device-test artifacts (transient screenshots)
tools/qa-screenshots/*
# but keep dated targeted-evidence folders (one per umbrella audit)
!tools/qa-screenshots/2026-05-14-targeted
# keep the v4.3.5 emulator QA sweep evidence (#1241)
!tools/qa-screenshots/android
tools/qa-screenshots/android/*
!tools/qa-screenshots/android/v4.3.5-qa
# keep the before/after overlap evidence for the legend-chip fix (#2957) — a
# "fixed on the emulator" claim with no frame anyone opened is what #2931 shipped
!tools/qa-screenshots/2957-legend-overlap

# Google Drive / iCloud Drive sync-conflict duplicates.
# When the same file is touched concurrently in two checkouts of a synced
# folder, Drive creates "filename (1).ext" (and (2), (3)…) on disk. These
# pollute `git status` and have caused build failures (duplicate Swift
# symbols when xcodebuild scans the entire SceneViewDemo/ subtree) and
# stash-pop conflicts on tracked files. They are NEVER source — drop them
# on sight. Surfaced by the 2026-05-13 upbeat-kare iOS visual smoke test.
**/* (1)*
**/* (2)*
**/* (3)*


# Local branch/worktree archives (diffs of dead worktrees) — never commit
.claude/worktree-archives/

# Python bytecode caches (store-sync self-test runs py_compile)
__pycache__/
*.pyc

# Store-screenshot capture artefacts. `capture-play-store-screenshots.sh` writes
# a preview mosaic (outside the listing dir) purely so a human can eyeball the run
# before pushing — it is a review aid, not a listing asset (#2796). The broad
# pattern also covers any legacy `.mosaic.png` left inside the graphics dir.
.mosaic*.png

# Device-QA harness output — a *result*, never a source. Committed by accident in
# #3050, which silently froze the release gate: release-checklist.sh takes the
# fast path whenever this file exists, so every release was graded against one
# 2026-07-12 run instead of dispatching its own.
device-qa-report.json