# OS / editor
.DS_Store
*.swp
*~
.idea/
.vscode/

# Secrets — SOPS-encrypted only; never commit plaintext (spec docs/07)
*.dec.yaml
*.decrypted.*
*.key
age.key
*.kubeconfig
kubeconfig

# IaC state / local runtime
.terraform/
*.tfstate
*.tfstate.*
.terraform.lock.hcl
*.tfvars
!*.example.tfvars
# tofu apply/plan run logs (tee'd locally; never commit)
apply.log
plan.log

# Test / build artifacts
/results/
/reports/
*.junit.xml
coverage/

# RETIRED plaintext Tofu secret files. Superseded by the COMMITTED, SOPS/age-encrypted
# infra/tofu/secrets.sops.env + the wrapper infra/tofu/tf.sh (see REMOTE-STATE.md). These
# lines are KEPT as a safety net so any leftover plaintext copy on an operator's machine can
# NEVER be committed; delete the local files once you've migrated to the encrypted flow.
infra/tofu/backend.hcl
infra/tofu/.r2.env

# Claude Code local scratch: agent worktrees + session state. Nothing here is tracked;
# ignoring it keeps `git add -A` from staging embedded worktree repos and keeps the lint
# stage (which scans untracked files) from tripping on .claude/worktrees/.
.claude/

# Vendored ansible collections (installed by ansible-galaxy for node re-provision; not tracked or linted)
infra/ansible/collections/

# standup.sh DNS snapshots — run artifacts, not authored state
.standup-dns/
