# Rendered by gbrain bootstrap — the deny side of the persistence contract.
# `gbrain sources push` and `bootstrap verify` also enforce a deny-glob list
# independently of this file (a truncated .gitignore must not leak secrets).

# Credentials and secrets — never committed
.env
.env.*
*.pem
*.key
*.p12
*.pfx
.netrc
.npmrc
.pypirc

# Local databases and engine state — derived, machine-local
.gbrain/
*.pglite
*.sqlite
*.sqlite3
*.db

# Machine-local state (committed state/ files are allowlisted explicitly)
state/*.local
state/*.local.json
state/heartbeat-state.local.json

# Hook + harness wiring (machine-specific; regenerated by `bootstrap hooks --repair`)
.claude/settings.local.json

# Caches, logs, scratch
logs/
.cache/
node_modules/
.DS_Store
Thumbs.db
