# Common — language-agnostic baseline. Python dev-artefacts are in the
# "Python" section; financial data (local vaults / *.db), tooling caches, and
# packaging output (*.dmg / AppImage / Flatpak / build / dist) follow below
# (FIBR-0002).

# Python — bytecode caches and the local dev virtualenv (.venv is also
# allowlisted in .gitleaks.toml and excluded by bandit).
__pycache__/
*.py[cod]
.venv/

# Financial data / local vaults — the SQLCipher vault and any database, plus
# the SQLite runtime sidecars (-wal/-shm/-journal) a live vault writes next to
# it. Must never reach the public repo (security-model T6/A7; FIBR-0002).
*.db
*.sqlite
*.sqlite3
*.db-*
*.sqlite-*
# Exception: the FIBR-0015 cross-package upgrade-path fixture is a SYNTHETIC,
# throwaway vault (documented test keys, no real financial data) committed on
# purpose so a test proves an old-package vault still opens after the swap.
!tests/fixtures/windows_build/vault.db
*.sqlite3-*
# The kept demo vault from scripts/capture_screenshots.py — SYNTHETIC throwaway
# data (FIBR-0082), but a full vault dir (vault.db + vault.kdf.json sidecar), so
# ignore the whole dir. Regenerated on each capture run; never committed.
.demo-vault/

# Tooling caches
.pytest_cache/
.ruff_cache/
.mypy_cache/
.audit_cache/

# Packaging / build output — PyInstaller (build/, dist/), setuptools metadata
# (*.egg-info/), and the platform installers: macOS .dmg, Linux AppImage,
# Flatpak bundle + its build tree (FIBR-0002 / FIBR-0015).
build/
dist/
*.egg-info/
*.dmg
*.AppImage
*.flatpak
.flatpak-builder/

# Release-signing private key — the Ed25519 key scripts/gen-signing-key.py
# writes (release/finbreak-signing.key) and any other private-key material must
# NEVER be committed (FIBR-0054 INV-14; only the public key lives in
# services/update_key.py). A test (test_INV14_no_private_key_material_is_tracked)
# fails the gate if a *.key or PEM private-key block is ever tracked.
release/
*.key

# OS
.DS_Store
Thumbs.db
desktop.ini
*.bak
*.orig
*.rej

# Editor / IDE
.idea/
.vscode/
*.code-workspace
*.swp
*.swo
*~
.#*
\#*\#

# Secrets / local env
.env
.env.*
!.env.example

# Claude Code (local settings, history, allowlist — mostly personal).
# Drop the trailing slash so the negations below can re-include
# specific files; with `.claude/` git short-circuits at the
# directory and ignores the !.claude/foo lines.
.claude/*
# Team-shared Claude Code config that SHOULD be in version control:
!.claude/settings.json
!.claude/bump.json
!.claude/rules/

# Logs / runtime
*.log
*.pid
*.sock

# Coverage / sanitizers
*.gcda
*.gcno
*.gcov
coverage.*
.coverage
lcov.info

# Core dumps
core
core.*
*.core
vgcore.*

# Scratch
scratch/
tmp/
Screenshot_*.png
screenshot*.png

# Roadmap ID counter — re-derived from ROADMAP.md when absent; not tracked (user 2026-07-14)
.roadmap-counter

# OBS packaging build artifacts (FIBR-0155) — never committed to git; the wheel
# closure is huge and host-specific, the osc checkout is a working copy.
/vendor.tar.gz
/vendor/
/build-obs/

# Real corpus account numbers for the FIBR-0086 INV-8 leak guard (FIBR-0248).
# These ARE the secret the guard looks for, so the file must never be tracked —
# committing it would plant in a PUBLIC repo exactly what the test exists to
# catch. `FINBREAK_CORPUS_NUMBERS` overrides it for a one-off run.
/.corpus-numbers

# Per-lane subagent cost log, written by a machine-local hook on every run.
# Grows in any project that dispatches agents; the figures that mattered are
# quoted in docs/reviews/<gate-id>.md.
docs/reviews/agent-costs.jsonl
