# Secrets — NEVER commit
.testenv
*.tfstate
*.tfstate.*
*.key
*.pem

# Loop runtime / working clones (created at launch by launch.sh)
/cc-ci/
/cc-ci-adv/
/.cc-ci-watch/
/.cc-ci-logs/

# More secrets / local state — NEVER commit
/.sops/            # master recovery age key
/cc-ci-secrets/    # separate sops-secrets repo, cloned in
/.claude/*         # local claude session/project state (history, cache, locks)
!/.claude/skills/  # ...but DO track shareable skills (e.g. ci-test-review)
*.tmp.*            # editor temp files
.sops/
*age*.txt
*.age
master-age.txt

# Runtime completion markers
/cc-ci-plan/phase6-phase7.done

# Python bytecode cache
__pycache__/
*.pyc

# Local API tokens — never committed (advisory-scan / hetzner recovery)
.github-token
.hcloud-token
