# OS / editor
.DS_Store
*.swp
*~
.idea/
.vscode/

# Secrets — SOPS-encrypted only; never commit plaintext (spec docs/07)
*.dec.yaml
*.decrypted.*
*.key
age.key
*.kubeconfig
kubeconfig

# IaC state / local runtime
.terraform/
*.tfstate
*.tfstate.*
.terraform.lock.hcl
*.tfvars
!*.example.tfvars
# tofu apply/plan run logs (tee'd locally; never commit)
apply.log
plan.log

# Test / build artifacts
/results/
/reports/
*.junit.xml
coverage/

# Tofu remote-state secrets (R2 creds + encryption passphrase + account-specific backend cfg).
# The *.example templates ARE committed; the real files are not.
infra/tofu/backend.hcl
infra/tofu/.r2.env

# Claude Code local scratch: agent worktrees + session state. Nothing here is tracked;
# ignoring it keeps `git add -A` from staging embedded worktree repos and keeps the lint
# stage (which scans untracked files) from tripping on .claude/worktrees/.
.claude/