.directory

# Local agent/plan state — never committed
.hermes/

# Scratch scripts and build experiments (package collection, pin extraction).
# Nothing here ships; the reviewed tooling lives in provisioning/offline-repo/.
/tmp/

# Python bytecode caches. Every .pyc is regenerated on import, so tracking them
# only produces noisy diffs and a stale artifact in the checkout.
__pycache__/
*.py[cod]

# ---------------------------------------------------------------------------
# Field OS build artifacts.
# These are large, generated, and reproducible from a verified upstream ISO.
# The upstream ISO itself is NOT stored in git (2.9 GB); its SHA256 is recorded
# in the release manifest instead. See docs/26 and docs/30.
# ---------------------------------------------------------------------------
.build-lab/
dist/
*.iso
*.iso.sha256
*.iso.boot-report.txt

# Offline APT repository.
#
# IMPORTANT: the built bundle IS committed on purpose. The whole point of this
# repository is that an operator installing a field device never downloads
# anything: the packages travel with the repo. `provisioning/offline-repo/built/`
# is therefore allowed through the rules below, while a scratch bundle built
# anywhere else stays untracked.
provisioning/offline-repo/out/
provisioning/offline-repo/pool/
Packages
Packages.gz
packages.lock.tsv
# ...but never inside the committed bundle.
!provisioning/offline-repo/built/
!provisioning/offline-repo/built/**
#
# Except the bundle's own pool/ copy of the .deb files: those packages are
# already tracked once under provisioning/offline-repo/packages/, and the same
# ~890 MB does not need a second path in the repository. What the installer
# needs from this directory is the index (Packages, Packages.gz,
# packages.lock.tsv, SHA256SUMS) plus repo-manifest.yaml.
provisioning/offline-repo/built/pool/

# Documentation site (generated)
docs-site/node_modules/
docs-site/build/
docs-site/.docusaurus/
docs-site/docs/
fetched-logs/

# Secrets must never be committed — belt and braces alongside the secret scan
# in tests/. Any private key, token file, or credential store belongs in a
# root-owned path on the host, never in this repository.
*.key
*.pem
*.p12
*.pfx
id_rsa*
id_ed25519*
*credentials*
*[-_.]token*
*.secret

# Credential files delivered by `admin/bf-creds --fetch` (<dealer-number>.txt).
# They live only in the checkout that runs the delivery, are root-owned on the
# device (mode 0600 inside a mode 0700 directory), and are never committed.
admin/secrets/