# Rust build artifacts
/target/

# Docs site built by `zensical build`
/site/
ebpf/target/
**/*.rs.bk

# IDE / Editor files
.vscode/
.idea/
*.swp
*.swo
*~
.DS_Store

# Test coverage
*.profraw
*.profdata

# Temporary files
tmp/
temp/
repomix-output.xml

# Claude AI files
.claude/

# Documentation files
CLAUDE.md
AGENTS.md

# Logs
*.log
logs/
ebpf/rustinel-ebpf.o
ebpf/Cargo.lock

tests/**/*
!tests/**/
!tests/**/*.rs
!tests/native_capture_contract.py
!tests/ebpf_load_smoke.py
!tests/test_ebpf_load_smoke.py
!tests/ebpf_live_tests.sh
!tests/ebpf_expected_degradations_5.10.txt
!tests/ebpf_process_cache_soak.py
!tests/linux_dns_fixture.py
# The golden replay fixture is checked in on purpose: the recording, its
# manifest, the rules it must fire, and the script that produced it are the
# regression, not build output. See docs/development.md (Replay fixture).
!tests/fixtures/replay/**
# Stable Sigma doctor schema and condition-analysis fixture.
!tests/fixtures/sigma_compatibility/**
# One recorded event per Windows and Linux event shape, read by the Sigma
# adapter tests and the sigma_engine benchmark.
!tests/fixtures/field_views/**
# ETW records recorded on real Windows hosts, read by the decoder tests in
# src/sensor/windows/etw/fixture_tests.rs. See docs/development.md.
!tests/fixtures/etw/**
!tests/fixtures/linux_ring/**

*.exe
*.pdb

.codex
*.zip

rules-bench/
*.pyc
__pycache__/
# Endpoint Security messages recorded on a real Mac, read by the decoder tests
# in src/sensor/macos/esf/fixture_tests.rs. See docs/development.md.
!tests/fixtures/esf/**
