.gitignore

.assets
.env
secrets.env
# Any secrets.env backup/variant (e.g. secrets.env.pre-*-bak-*) must never be
# committable — only the tracked template is allowed.
secrets.env.*
!secrets.env.example
secrets.json
*.pyc
dist/
build/
*.egg-info/
*.egg
*.pyc
*.pyo
*.pyd
*.pyw
*.pyz
*.pywz
*.pyzz
.venv/
venv/
__pycache__/
poetry.lock
.pytest_cache/
.pytest_tmp/
botpy.log
.worktrees/
.claude/worktrees/
.claude/.session-locks/
# Local tooling artifacts written into the repo tree (keep the tree clean)
.claude/database.db
.claude/hookify.*.local.md
.serena/
# Malformed sqlite path artifacts (e.g. genesis.db?mode=ro used as a literal file)
data/*mode=ro
# Background sessions now live at ~/.genesis/background-sessions/ (outside repo)
data/sqlite/*.db
data/sqlite/*.db-journal
data/sqlite/*.db-wal
data/sqlite/*.db-shm
data/*.db
data/*.db-journal
data/cc-memory-backup/
data/*.db-wal
data/*.db-shm
data/*.pre-update
data/*.png
*.egg-info/
node_modules/
firebase-debug.log
.firecrawl/
.firecrawl/
scripts/cc_cli_output/
.firecrawl/
.mcp.json
config/.generated/
# Auto-generated identity files (runtime-regenerated, seeds in .example)
src/genesis/identity/TRIAGE_CALIBRATION.md
src/genesis/identity/USER_KNOWLEDGE.md
src/genesis/identity/EGO_NOTEPAD.md
# User-edited identity profile (per-install, seeded from USER.md.example) — never public
src/genesis/identity/USER.md
# Task-scoped notepad (ephemeral, seeded per-task in worktrees)
TASK_NOTEPAD.md
config/*.local.yaml
# Install-specific generated state — regenerated from the DB by seed_procedures.py
# / the procedure promoter; must not ship a stale cache whose IDs aren't DB rows.
config/procedure_triggers.yaml
config/procedure_triggers.json
.gstack/
.context/
.playwright-mcp/
logs/
genesis.db
*.bak.*
data/telegram/
# Action item tracking — structure tracked, contents gitignored
docs/actions/genesis/*.md
docs/actions/user/*.md
!docs/actions/README.md
data/genesis.db
data/genesis.sql
*.jsonl
# Golden sets for the eval-judge calibration framework MUST be in the
# repo — every install needs them to calibrate rubrics. Allow .jsonl
# files under tests/eval/golden/ explicitly.
!tests/eval/golden/*.jsonl
# Synthetic bench fixtures (obviously-fake exemplar tasks) MUST be in the
# repo — the bench test suite loads them. The REAL task set stays private
# under ~/.genesis/eval/ and is refused by the loader if found in-repo.
!tests/test_eval/bench_fixtures/*.jsonl
# Synthetic skill-replay golden fixtures (fake voice tasks) MUST be in the repo —
# the skill-replay test suite loads them. Real per-skill golden suites stay
# private under ~/.genesis/eval/skill_golden/ and are refused if found in-repo.
!tests/test_eval/skill_golden_fixtures/*.jsonl
.config/
.claude/settings.local.json
.claude/scheduled_tasks.lock
*.bak

# Local-only modules (not for public repo)
src/genesis/modules/automaton_supervisor/
config/modules/automaton-supervisor.yaml
# Install-local DirectSession profile overlay (registers gitignored profiles
# like automaton-brain; the generic loader in direct_session.py is upstream).
src/genesis/cc/profile_overlay.py

# Docs are private by default — opt-in for public.
# Only directories listed with ! are tracked.
# NOTE: must be docs/* (not docs/) — excluding the parent dir itself makes
# the ! re-inclusions below dead (git never descends into an excluded dir),
# which silently forced `git add -f` for every new file in the opt-in dirs.
docs/*
!docs/architecture/
!docs/decisions/
!docs/case-studies/
!docs/eval/
!docs/images/
!docs/journey/
!docs/reference/
!docs/actions/
# Private files within allowed dirs
docs/reference/2026-*.md
docs/reference/backup-history-migration.md
# Dated docs are WORKING ARTIFACTS — design notes, decision drafts, migration
# plans — and belong in ~/.genesis/output/specs/, never in the public tree.
# Generalises the docs/reference/2026-*.md rule above to every opt-in dir,
# because the opt-in above is per-DIRECTORY: anything dropped into one of them
# inherits public-by-default, so an allowed dir doubles as a scratch pad and
# `git add -A` publishes it. MEASURED 2026-09-02: 8 such files had accumulated
# under docs/decisions/ (none ever pushed — caught first), while 0 of 92
# tracked docs files carry a year prefix. So this excludes nothing currently
# public and no legitimate naming convention.
#
# The prefix is a YEAR, not a full date, because that is what the rule above
# actually is — an earlier draft required YYYY-MM-DD- and so did NOT generalise
# it: docs/decisions/2026-private-strategy.md stayed publishable while the
# identically-named file under reference/ was ignored (Codex P1, #1611).
# Written 20[0-9][0-9] rather than [0-9][0-9][0-9][0-9] to avoid colliding with
# sequentially-numbered ADRs — docs/decisions/ uses 001-…007- today, but a
# 4-digit ADR scheme would otherwise be silently swallowed.
# No extension suffix, deliberately: the fail-safe direction for a PRIVACY rule
# is to ignore too much (visible, recoverable with `git add -f`) rather than too
# little (a silent leak). A dated .svg or .txt is a working artifact too.
# A genuinely-public dated doc is still possible with an explicit `git add -f`.
docs/**/20[0-9][0-9]-*

# Career-ops interop (private — lives at ~/.genesis/interop/)
config/interop_system_prompt.md
scripts/cops_interop.sh

.gitnexus
# codebase-memory-mcp --persistence artifact (regenerable share DB, in-repo)
.codebase-memory/

# Personal skills (user-level data, lives at ~/.claude/skills/)
.claude/skills/code-voice/