# Rust build artifacts (the whole workspace builds into the root target/)
/target
**/target
**/*.rs.bk

# Redundant per-member lockfiles: a workspace only uses the root Cargo.lock.
/*/Cargo.lock

# sqlx offline cache (these crates don't use sqlx; kept as a safety net)
.sqlx/

# Local scan state / databases the tools write at runtime
*.db
*.sqlite
*.sqlite3

# Secrets / local environment. NEVER commit these, especially in a public repo.
.env
.env.*
*.env

# Editor / OS cruft
.DS_Store
Thumbs.db
*.swp
*.swo
*~
.idea/
.vscode/

# Private tuned drop-in for the `adaptive` crate + its local paths-override.
# NEVER commit these: the committed `adaptive/` is the open baseline that ships.
# No trailing slash on purpose. With one, the pattern matches a directory only,
# and the drop-in is now a symlink into its private origin, so it went back to
# showing up as untracked in this public repository.
/adaptive-private
/.cargo/

# Private isolated-egress drop-in (netns/tunnel/tor). NEVER commit: the committed
# baseline.rs is the open direct-egress build. build.rs compiles this if present.
/core/src/egress/private.rs

# Private authorization-oracle drop-in (BOLA/BFLA/BOPLA differential engine). NEVER
# commit: the committed baseline.rs is the open no-oracle build. plessor/build.rs
# compiles this if present. The engine's directory was `cortex/` before 0.1.31, and
# a checkout made before then may still have the drop-in there, so both paths are
# ignored for one more release.
/plessor/src/authz/private.rs
/cortex/src/authz/private.rs

# Python bytecode from the oracle regression harness.
__pycache__/
*.pyc
