__pycache__/
*.py[cod]
.venv/
venv/

.env
.env.*
!.env.example

# Terraform. State lives in S3 (see pipeline/pipeline.yml), never on disk here.
#
# .terraform.lock.hcl is deliberately NOT ignored -- it is the provider version lock, and
# committing it is what makes a laptop, PR checks and CodeBuild resolve identical provider
# versions. Ignoring it lets them drift silently.
.terraform/
*.tfstate
*.tfstate.*
*.tfplan
tfplan
# Variable files can hold credentials, and Terraform state holds the .p12 password whenever the
# SharePoint Entra module runs.
terraform.tfvars
*.auto.tfvars

# Certificate material for the SharePoint connector -- generated by hand, never committed. See
# blueprints/knowledgebase/docs/sharepoint-source.md. This repo is public and has NO secret
# scanning, so these patterns are the only thing standing between a stray `git add -A` and a
# published private key.
.certs/
*.p12
*.pfx
*.pem
*.cer
*.key

# Claude Code personal settings. Never commit: this repo is public, and these files hold
# machine-specific paths and per-user permission grants.
#
# .mcp.json is deliberately NOT listed. It is a tracked file (it declares the cornell-builder
# server), so a gitignore entry for it would be inert -- ignore rules do not apply to tracked
# paths. To keep a personal copy with extra servers or credentials in it, mark it local-only
# instead, which git actually honours:
#
#     git update-index --skip-worktree .mcp.json
#
# Never put a token in it without that flag set: an ignore entry will not save you.
.claude/settings.local.json
# Claude Code puts git worktrees here. A worktree is a second checkout of this repo, so
# committing one would duplicate every file in it.
.claude/worktrees/

# Local working notes and workshop handouts. Untracked but not ignored is how these get swept
# up by `git add -A`.
SCRATCHPAD.md
# Source walkthrough handed over by hand; folded into
# blueprints/knowledgebase/docs/sharepoint-source.md.
sharepoint-blueprint.md
PARTICIPANT_BRIEF.md
aidlc-docs/
DEMO.md
good-morning.sh

# asciinema recordings of demo/demo.sh. A rehearsal artifact by default: committing one means
# it goes stale silently while still looking authoritative. Commit a specific .cast with
# `git add -f` when you deliberately want a fixed recording for a session.
demo/*.cast

.DS_Store
.idea/
*.swp

# Playwright MCP session artifacts (snapshots, console logs)
.playwright-mcp/

# Local deploy previews from packages/builder-mcp/devtools/preview_deploy.py -- the template,
# parameters and pipeline diff a deployment_create PR would carry. Regenerable from the
# checkout, so there is nothing to keep.
#
# NOT outputs/, which is the deployment shell the Builder writes through a PR and which IS
# committed. Ignoring that would hide real deployment records.
#
# Also listed in validate_stacks.py's SKIP_DIRS: that scan walks the filesystem, not git, and
# these are verbatim copies of blueprint templates.
outputs-preview/

# Alternate data streams Windows attaches to downloaded files, which surface as separate
# junk files on the WSL side. One accompanies every file saved from a browser.
*:Zone.Identifier

# The workshop participant brief, whatever it is called this time. Upstream ignores
# PARTICIPANT_BRIEF.md; the copy here arrived from a browser under a different name, so the
# existing rule missed it and left it untracked-but-visible -- which is how it would have been
# swept back in by `git add .`.
docs/Participant Brief*

# ---------------------------------------------------------------------------------------
# Credential material
#
# This repository is PUBLIC and secret scanning is disabled by an enforced org security
# configuration (cu-aaii-org-config-1), which cannot be overridden per repository. Nothing
# will stop a credential being pushed, so these patterns are the only mechanical guard.
#
# They are a backstop, NOT remediation. A credential that has already existed in a working
# tree must be treated as needing rotation on its own schedule — ignoring the file that
# holds it changes nothing about that.
#
# Secrets belong in AWS Secrets Manager. Blueprints are configured to *use* credentials
# without ever containing them.

# Private keys, certificates with keys, keystores
*.pem
*.pfx
*.p12
*.pkcs12
*.key
*.keystore
*.jks
id_rsa
id_ed25519

# Secret and credential dumps
secrets.*
*-secrets.*
*.secrets
credentials.json

# Cloud CLI credential caches, if anyone ever runs a tool with HOME pointed at the repo
.azure/
.msal_token_cache.json

# Research document holding a live Entra client secret, a test-user password and a Bot
# Framework JWT. Ignored to prevent an accidental `git add .` from publishing them.
#
# This entry is a stopgap and should be removed, not kept: the intent is to rotate the
# credentials, replace the values with placeholders, and commit the document, which has
# real research value. Until then it stays out of the index.
docs/teams-chatbot-docs/Research into in-tenant setup.md
