# Build artifacts
target/
/target-*/
**/*.rs.bk
Cargo.lock.bak
# Transient model rollback copy written by ml/retrain_loop.sh --write. The
# shipped model is weights.bin; the .bak is local-only and never committed.
crates/scanner/src/weights.bin.bak
crates/scanner/src/model_card.json.bak

# IDE / editor noise
.vscode/
.idea/
.claude/
*.swp
*.swo
.DS_Store
Thumbs.db

# mdBook local build output. The deploy workflow publishes its own
# build to GitHub Pages; nobody should be committing this dir.
docs/book/

# Local scratch + dogfood output
*.local
*.dogfood
dogfood-output*.json
metrics/generated/
/vendor/

# Generated benchmark corpora; reproducible with `make -C benchmarks mirror`
# and full of synthetic secret-shaped fixtures.
benchmarks/corpora/
# Raw per-run RunResult JSONs are host-specific and regenerable with
# `make -C benchmarks bench`; the committed, human-facing rollups live in
# benchmarks/reports/ and the injected ../README.md tables.
benchmarks/results/
/benchmarks/results-*/

# Retired bench trees. The generators moved to benchmarks/generators/, the
# committed baselines to benchmarks/baselines/, and the scorer/differential
# logic to benchmarks/bench/. Only reproducible/generated leftovers (mirror
# corpus, ad-hoc result dumps) may still sit on disk here (never commit them).
tools/secretbench/
tools/diff_bench/

# Pre-existing local-noise paths
**/__pycache__/
**/.pytest_cache/
.ruff_cache/
*.pyc
.keyhog-cache.json
detectors/.keyhog-cache.json
# Stray ImageMagick render misdirected into a top-level path (12 MB .ps named
# "pathlib"); generated junk, never part of the source tree.
/pathlib

# Accidental root-level scratch belongs outside this standalone prod repo.
/coordination/
/scratchpad/
/planning/
/BACKLOG.md
/.internal/

# Root-level review output, throwaway compiler probes, and process state.
# Operator working notes stay outside the public release tree. Durable product
# behavior belongs in code, tests, or canonical docs; source patches belong in
# Git commits.
/*.patch
/diff*.txt
/full_diff*.txt
/relevant_diff.txt
/.git_diff_staged.txt
/.git_status.txt
/out_dec.json
/parse_diff.py
/test_abort_handle.rs
/test_as_ref
/test_memmem
/test_tokio_id.rs
/wp.pid
/*.sock
/test_out.log
/-

# Bazel scaffolding, currently a PoC stub (every per-crate BUILD.bazel
# is comment-only, MODULE.bazel pinned to 0.5.7 while we're shipping
# 0.5.28). `bazel build //...` does not produce a working keyhog
# binary today; cargo is the real build system. Untracking until
# Bazel is fully wired and tested end-to-end, so we don't advertise a
# capability that doesn't exist.
.bazelrc
.bazelversion
BUILD.bazel
**/BUILD.bazel
MODULE.bazel
MODULE.bazel.lock
WORKSPACE
WORKSPACE.bazel
# Top-level scratch/audit/plan files that belong in the backup monorepo
# (santhreal/Santh) and local audit scratch, not in the standalone prod repo.
/ROUNDS.md
/TODO.md
/TESTING_PROGRAM.md
/KEYHOG_LINUX_QUALITY_PROGRAM.md
/WAVE*_AGENT_PUSH.md
/WAVE*.md
/*_AUDIT*.md
/*_AUDIT*.toml
/FP_AUDIT_REPORT.md
/*_PROGRAM.md
/KIMI_AUDIT_*.md
/CURSOR_AUDIT_*.md
/CLAUDE_AUDIT_*.md
/plan.md
/PLAN.md
plans/
.audits

# Runtime vyre JIT/PTX + pipeline caches written next to the binary during scans.
.cache/
NUL

# Per-host cross-device bench raw JSONs (regenerable via benchmarks/cross_device.sh).
# The committed, human-facing snapshot is benchmarks/reports/cross-device.md.
benchmarks/results-cross-device/

# Unified backlog (STANDARD.md)
IMPROVEMENT_PLAN.md

# Local axiomexec / self-hosted runner ops. Registration tokens, runner
# identity files, and host-local service config must never enter the
# public tree (credential exfiltration / runner hijack surface).
.axiomexec/
axiomexec/
**/actions-runner*/
**/.credentials
**/.credentials_rsaparams
**/.runner
**/.runner_file
**/runsvc.sh
**/svc.sh
.github/runner-tokens/
.github/self-hosted/
*.runner.json
runner-*.token
APLXTN*
.test-tmp/
