.gitignore

# HelixCode Docker Setup Git Ignore

# Environment files
.env
.env.local
.env.production

# Docker volumes and data
/workspace/
projects/
shared/

# Temporary files
*.tmp
*.temp

# Log files
*.log
logs/

# ...EXCEPT captured QA evidence (§11.4.83). The blanket `*.log` above was
# silently swallowing evidence: 38 directories under docs/qa/ hold .log files
# that were never committed, so their runs exist only on the machine that
# produced them. Three of those back items closed on 2026-07-31, meaning the
# closure cited evidence a fresh clone cannot see — a §11.4.5 gap created by a
# repository-hygiene rule, not by anyone's carelessness.
#
# Evidence is the ONE class of file that must never be ignored: the whole point
# of docs/qa/<run-id>/ is that a PASS is auditable after the fact by someone
# else. An ignored transcript is indistinguishable from a transcript that was
# never captured.
#
# Agents kept hitting this and working around it by renaming to .txt (1445
# committed .txt vs 0 .log). That workaround only helps whoever remembers it,
# which is why the rule is fixed here instead.
!docs/qa/**/*.log

# Backup files
*.bak
*.backup

# Build derivatives — regenerate from source (§11.4.77, CONST-053)
scratchpad/
.git-backups/

# IDE files
.vscode/
.idea/
*.swp
*.swo

# OS files
.DS_Store
Thumbs.db

# Test files
.env.test

# PenPot token
penpot.txt

# Build artifacts
bin/
*.exe
*.dll
*.so
*.dylib

# Go build cache
.cache/

# Submodule directories (ignored if not cloned)
Example_Projects/OpenCode/OpenCode/
Example_Projects/OpenCode/Homebrew-Tap/
Example_Projects/Ollama_Code/
Example_Projects/Qwen_Code/
Example_Projects/Codename_Goose/
Example_Projects/Claude_Code/
dependencies/LLama_CPP/
dependencies/Ollama/
dependencies/HuggingFace_Hub/
Example_Projects/DeepSeek_CLI/
Example_Projects/Mistral_Code/
Github-Pages-website/
Example_Projects/Gemini_CLI/
Example_Projects/Forge/
Example_Projects/Plandex/
Example_Projects/GPT_Engineer/
Example_Projects/Aider/
Example_Projects/Cline/
awesome-ai-memory/

# External memory provider repositories (cloned on demand)
helix_code/external/memory/mem0/
helix_code/external/memory/zep/
helix_code/external/memory/memonto/
helix_code/external/memory/baseai/

# Generated test challenges and results (but not the framework)
helix_code/challenges/
/challenges/

# CodeGraph Phase-C anti-bluff Challenge scripts + bank are first-party
# source (committed) — exempt from the broad challenges/ ignore (CONST-053
# recreatable-content test: these are the generator/source, not artefacts).
!tools/codegraph/challenges/

# Allow the e2e challenge testing framework but ignore test results
!helix_code/tests/e2e/challenges/
helix_code/tests/e2e/challenges/test-results/
helix_code/tests/e2e/challenges/.DS_Store

# Allow per-submodule anti-bluff challenge framework (CONST-035 / CONST-050(B))
# — round-305 minimal enrichment template exempts owned-static-content
!assets/challenges/
!assets/challenges/**


reports/demos/
governance-cascade-report-*.txt

# === Secret hygiene (CONST-041) — added P0-06 ===
.env
.env.*
!.env.example
*.pem
*.key
*.crt
id_rsa
id_rsa.pub
id_ed25519
id_ed25519.pub
helix.security.json
# === END Secret hygiene ===

# Worktrees created by HelixCode P1-F04 EnterWorktree (do NOT commit)
.helix-worktrees/

# P1.5 cleanup: leftover phase-1 development artefacts
helix_code/p1f*_challenge
helix_code/security-scan
helix_code/testhelper
helix_code/.helixcode/
# .claude/ personal + local state is ignored, but the PROJECT-shared
# settings.json (§11.4.109 PreToolUse hook wiring, §11.4.182 remediation
# 2026-07-11) MUST be tracked so the guard hook applies to every clone/
# contributor, not just a local working copy. `.claude/*` (not the bare
# `.claude/` directory pattern) is required so the negation below can work —
# git will not descend into a directory excluded via a bare `dir/` pattern.
.claude/*
!.claude/settings.json

# P1.5-WP5: .env API-key dedup backups
.env.backup_p1-5
.env.diff_p1-5
**/*.env.backup_p1-5
**/*.env.diff_p1-5

# ============================================================================
# helix_qa evidence — screenshots, recordings, traces (NEVER committed)
# ============================================================================
# Per operator mandate 2026-05-13: "Created screenshots and video recording
# materials during the helix_qa QA sessions MUST BE Git ignored!"
# These directories collect runtime evidence used for anti-bluff verification
# (CONST-035 / Article XI §11.9). Evidence files are inherently per-run, can
# be very large, and may contain sensitive UI state — they MUST stay local
# and never reach upstream.
# Ignore everything under qa_evidence/ EXCEPT the README that documents
# the directory layout. The README MUST stay tracked so a fresh clone
# explains where evidence lands without needing prior context.
docs/qa_evidence/*
!docs/qa_evidence/README.md
helix_code/qa_evidence/*
helix_code/docs/qa_evidence/*
helix_qa/qa_evidence/*
**/qa_session_*/
**/*.qa-screenshot.png
**/*.qa-screenshot.jpg
**/*.qa-recording.mp4
**/*.qa-recording.webm
**/*.qa-trace.json
/helix_code/examples/multi_agent_system/multi_agent_system

# CONST-053: untrack stray binaries from earlier accidental commits
/core.test
/security-test
/security_test

# CONST-053: SQLite db files (helix_qa session memory etc.)
*.db
*.db-shm
*.db-wal
# §11.4.95 (HXC-013): the workable-items SQLite DB is the TRACKED single source of
# truth — NEVER gitignored (it IS authoritative source data, not a build artefact).
# Its transient WAL/SHM sidecars stay ignored (WAL-checkpointed before each commit).
!docs/workable_items.db
/HelixQA/
/qa-results/

# Replica configs generated for multi-instance testing
helix_code/config/replica-*.yaml

# === CodeGraph incorporation (CONST-053) — added CG2 ===
# CodeGraph runtime is a vendored npm dependency installed via
# `npm install --prefix tools/codegraph` — a build/dependency artefact,
# fully recreatable by tools/codegraph/install.sh. NEVER versioned.
tools/codegraph/node_modules/
tools/codegraph/package.json
tools/codegraph/package-lock.json
# CodeGraph: the scanned graph DB + caches are generated by `codegraph index`
# (recreatable per §11.4.77) and NEVER versioned. BUT `.codegraph/config.json`
# IS tracked (§11.4.78 — it is the source-of-truth index config, not a build
# artefact). Submodules' own `.codegraph/` dirs stay fully ignored.
**/.codegraph/
!/.codegraph/
/.codegraph/*
!/.codegraph/config.json
!/.codegraph/.gitignore
# === END CodeGraph incorporation ===

# docs_chain runtime artifacts (§11.4.77) — contexts/*.yaml stay tracked
.docs_chain/state.json
*.docs_chain.tmp
.playwright-mcp/

# transient PID files (§11.4.30)
*.pid

# OpenDesign supervised bring-up runtime artifacts (§11.4.162, §11.4.30)
scripts/opendesign/run/

# Scratchpad: temp files, AI model downloads, discovery notes (§11.4.30)
helix_code/scratchpad/

# Compiled root-level helper binaries (§11.4.53 no-versioned-build-artifacts).
# Identified from the binaries' own embedded module metadata, not guessed:
#   `go version -m ./bridge` -> path dev.helix.code/meta/scripts/bridge
#   `go version -m ./qa`     -> path dev.helix.code/meta/scripts/qa
# §11.4.77 regeneration mechanism (sources are tracked, so a fresh clone can
# rebuild both with no network and no credentials):
#   go build -o bridge ./scripts/bridge
#   go build -o qa     ./scripts/qa
# Patterns are ROOT-ANCHORED on purpose: a bare `qa` would also swallow the
# `docs/qa/` §11.4.83 evidence tree and the `scripts/qa/` source package.
/bridge
/qa

# Three oversized raw captures, excluded by PATH (§11.4.30 / §11.4.77).
# The `!docs/qa/**/*.log` rule above deliberately un-ignores evidence, because an
# ignored transcript is indistinguishable from one that was never captured. These
# three are the exception on SIZE alone, not on kind — together they are 404 MB of
# the 413 MB untracked evidence corpus, and committing them would bloat every
# future clone permanently to preserve raw output nobody reads.
#
# They are NOT deleted; they remain on the machine that produced them. Their
# verdicts are summarised in their sibling evidence files, which ARE committed.
# Regeneration mechanism (§11.4.77): re-run the originating suite named in each
# directory's siblings — these are raw stdout captures, not build inputs.
# Tracked as HXC-216.
docs/qa/phase0_router_build/fix_evidence/hf_https_test_20260706.log
docs/qa/phase0_gpu/p0t3_gpu_inference.log
docs/qa/infra_fulltest_20260712/integration_full_tests.log