.gitignore

 # Dependencies
node_modules/
__pycache__/
*.pyc

# Tokensave
.tokensave/

# Environment
.env
.env.*
!.env.example

# Credentials and secrets (never commit; services read them from the environment)
.aws/
.kube/
.gcloud/
.boto
*.pem
*.key
*.p12
*.pfx
credentials.json
*credentials*.json
secrets.yaml
secrets.yml
secrets.json
.auth/
.tokens/
# Provider + MCP credential stores. These normally live in the data dir
# (Global.Path.data), never in the repo — ignored so a debugging copy dragged
# into the tree cannot be committed to a public repository.
auth.json
mcp-auth.json
id_rsa
id_rsa.pub
id_ed25519
id_ed25519.pub
# Spinosa home metadata copied in for debugging. Tests must build this in a
# temp dir (SPINOSA_METADATA_DIR), not as a tracked fixture.
metadata/config.yaml

# OS junk
.DS_Store
Thumbs.db
*.swp
*.swo
*~
.idea/
.vscode/
*.sublime-*

# Bun
.bun/

# Build output
dist/
framework/bin/.build/
.build/

# Generated embedded template pack blobs (rebuilt by scripts/pack-workspace-template.ts)
/packages/spinosa-kernel/src/generated/template-blobs/
/packages/spinosa-kernel/src/generated/template-files/
/packages/spinosa-kernel/src/generated/template-pack-meta.json
# template-pack.gen.ts / canvas-native.gen.ts keep tracked stubs; builds overwrite on disk then restore stubs
# canvas skia .node for Bun --compile (NAPI_RS_NATIVE_LIBRARY_PATH staging)
/packages/spinosa-kernel/src/generated/canvas-libs/

# Local checkout launcher symlink (use `bun run spinosa` / `bun run dev`)
/spinosa
/spinosa-local
/scripts/local-spinosa.sh
/.spinosa-local-branch

# Framework (generated per-workspace)
framework/spinosa/manifest.tsv
framework/spinosa/workspace
framework/spinosa/update-report.md
framework/logs/*.log

# Never commit research data
framework/trash/framework-purge-*/
framework/trash/**/raw/
framework/trash/**/maps/
framework/trash/**/previous-trash/

# Agent adapter mirrors bundled in workspace-template
.opencode/agents/
.opencode/skills/
.claude/agents/
.claude/skills/
.codex/skills/

# Vendor lock files
.opencode/package-lock.json
.opencode/.gitignore

# Workspace artifacts (generated during use)
framework/agent_reports/*.md
!framework/agent_reports/AGENTS.md

# Bundled vendor binaries (populated by package-release.sh)
framework/bin/lib/vendor/

# Runtime debris generated in the repo root when running Spinosa locally
# (the shipped copies live under workspace-template/ and are tracked)
/.spinosa/
/.trash/
/agent_reports/
.quality/
.stryker-tmp/
/reports/mutation/
.tui-agent/
.spinosa-migration-report.json
/packages/spinosa-kernel/.spinosa/
/packages/spinosa-kernel/.spinosa-migration-report.json
/.serena/
*.tsbuildinfo

# Personal editor config
.obsidian/

# OpenCode editor plans (tracked in docs/ instead)
.opencode/plans/

# Local audit scratchpads
local:/

# Runtime token metadata (already gitignored but was committed before)
.tokensave/branch-meta.json
.tokensave/config.json

# Processing artifacts and logs (risk of personal/research data leaks)
*ocr-processed*
*.jsonl
*.bak

# Workspace operational log output (never commit runtime traces)
**/.logs/*
!workspace-template/.logs/
!workspace-template/.logs/**

# Legacy visible logs/ dir from older workspaces (runtime output only)
logs/**

# Prevent workspace data files from being accidentally committed
workspace-template/raw/*.log
workspace-template/raw/*.tsv
workspace-template/raw/*.jsonl

# Compiled JS output alongside TS sources
*.js

# Local real-file test corpus (built by scripts/anonymize-fixtures.ts from
# personal files; contains redacted-but-real data — NEVER commit)
packages/spinosa-core/test/fixtures-real/
packages/spinosa-core/test/fixtures-real-staging/