.gitignore

# Agent workspace bind-mount (per-project scratch / tool-outputs / jobs)
agentic/agent-workspace/*
!agentic/agent-workspace/.gitkeep

# Memory-governor calibration output (host-specific measured envelopes). Each
# host generates its own via `bash tests/redamon_mem_calibrate.sh`; the governor
# falls back to safe built-in constants when absent. Never commit one host's
# numbers for another host to inherit.
**/resource_profile.json

# Byte-compiled / optimized / DLL files
__pycache__/
*.py[cod]
*$py.class

# C extensions
*.so

# Distribution / packaging
.Python
build/
develop-eggs/
dist/
downloads/
eggs/
.eggs/
/lib/
/lib64/
parts/
sdist/
var/
wheels/
share/python-wheels/
*.egg-info/
.installed.cfg
*.egg
MANIFEST

# PyInstaller
*.manifest
*.spec

# Installer logs
pip-log.txt
pip-delete-this-directory.txt

# Unit test / coverage reports
htmlcov/
.tox/
.nox/
.coverage
.coverage.*
.cache
nosetests.xml
coverage.xml
*.cover
*.py,cover
.hypothesis/
.pytest_cache/

# Translations
*.mo
*.pot

# Virtual environments
venv/
ENV/
env/
.venv/
services/knowledge_base/.redamon-venv/
.env.local

# Environment variables / Secrets
.env
*.env
.env.*
!.env.example

# IDE / Editor settings
.idea/
.vscode/
# .claude/ is intentionally tracked for project guidelines
*.swp
*.swo
*~
.project
.pydevproject
.settings/
*.sublime-workspace
*.sublime-project

# Jupyter Notebook
.ipynb_checkpoints/

# pyenv
.python-version

# mypy
.mypy_cache/
.dmypy.json
dmypy.json

# Pyre type checker
.pyre/

# Recon data files (downloaded at runtime)
recon/data/resolvers.txt
# MITRE CVE database refresh marker. Written by add_mitre.py inside the spawned
# recon container, which volume-mounts the host's recon/ — so every scan dirtied
# a tracked file and `./redamon.sh update` then refused to fast-forward.
recon/main_recon_modules/data/mitre_db/.last_update

# Recon output files (contain sensitive scan data)
recon/output/*.json
scanners/gvm_scan/output/*.json
scanners/github_secret_hunt/output/*.json
scanners/trufflehog_scan/output/*.json
scanners/supply_chain_scan/output/*.json
!recon/output/.gitkeep
!scanners/gvm_scan/output/.gitkeep
!scanners/github_secret_hunt/output/.gitkeep
!scanners/trufflehog_scan/output/.gitkeep
!scanners/supply_chain_scan/output/.gitkeep
# AI Attack Surface scan output (garak/pyrit/giskard/promptfoo reports + transcripts)
scanners/ai_attack_surface_scan/output/

# Nmap scan results
*.nmap
*.xml
*.gnmap

# Log files
*.log
/logs/
agentic/logs/
agentic/cypherfix_codefix/logs/
agentic/cypherfix_triage/logs/

# Certificates & cryptographic key material
*.pem
*.key
*.crt
*.cer
*.csr
*.p12
*.pfx
*.jks
*.keystore

# SSH / PuTTY private keys (default filenames)
id_rsa
id_dsa
id_ecdsa
id_ed25519
*.ppk

# Cloud / cluster credentials
.netrc
.pgpass
.kube/
kubeconfig
*.kubeconfig
.aws/credentials

# Password / secret stores
*.kdbx
*.kdb

# Database dumps & local DB files
# NOTE: *.sql is intentionally NOT ignored — Prisma migrations live in
# webapp/prisma/migrations/**/migration.sql and must stay tracked.
*.sqlite
*.sqlite3
*.sqlite-journal
*.dump
*.sql.gz
*.sql.bz2
*.bak
*.backup

# Terraform state & vars (frequently contain plaintext secrets)
*.tfstate
*.tfstate.*
*.tfvars
.terraform/

# Crash dumps
*.dmp

# OS generated files
.DS_Store
.DS_Store?
._*
.Spotlight-V100
.Trashes
ehthumbs.db
Thumbs.db

# Node dependencies + tool caches. Anchored nowhere on purpose: running
# vitest/npm from the repo root (instead of webapp/ or e2e/) plants a stray
# node_modules/.vite cache here.
node_modules/

# Next.js build output
.next/
out/

# Docker
*.pid
docker-compose.override.yml

# Private strategy docs
agentic/readmes/README.EMPOWER.md
agentic/readmes/README.CYPHERFIX.md
agentic/readmes/README.FULLFIX.md
agentic/readmes/README.TOOL_PLUGINS.md
docs/readmes/README.EMPOWER.md
docs/readmes/README.FULLFIX.md
docs/readmes/README.TOOL_PLUGINS.md
docs/readmes/README.ATTACK_PATHS.md
docs/readmes/AGENT.PROMPTS.md
docs/readmes/agent_prompts/


# Local-only working dirs (untracked; not part of the repo)
# Anchored so they do not also ignore nested dirs of the same name,
# e.g. webapp/src/app/api/internal/
/_local/
/internal/
/validation-benchmarks/

# DevergoLabs (separate local project kept at repo root, untracked)
/DevergoLabs/

# RedAmon local config (created by redamon.sh)
.gvm-enabled
.kbase-enabled
.kbase-disabled
.skipkbase

# Claude Code config
.claude/

# Benchmark data
bmark/

# Knowledge base runtime data
services/knowledge_base/data/
**/.file_hashes.json

# Deploy plan (local only)
tooling/deploy/DEPLOY_PLAN_EC2.md
tooling/deploy/single-host/E2E_DEPLOY_TEST_PROMPT.md
redamon-session-*.md

# supply-chain guinea pig dry-run scratch output
testing/guinea_pigs/supply_chain_target/.dryrun/

# transient dir used by tests/redamon_env_block_test.sh (docker must see it,
# so it cannot live in /tmp); always removed by the test itself
.envblock-test.*

# XBEN benchmark slot state (local only)
/.xben-slots/