.directory

# Local agent/plan state — never committed
.hermes/

# ---------------------------------------------------------------------------
# Field OS build artifacts.
# These are large, generated, and reproducible from a verified upstream ISO.
# The upstream ISO itself is NOT stored in git (2.9 GB); its SHA256 is recorded
# in the release manifest instead. See docs/26 and docs/30.
# ---------------------------------------------------------------------------
.build-lab/
dist/
*.iso
*.iso.sha256
*.iso.boot-report.txt

# Offline APT repository output (generated by provisioning/offline-repo)
provisioning/offline-repo/out/
provisioning/offline-repo/pool/
Packages
Packages.gz
packages.lock.tsv

# Documentation site (generated)
docs-site/node_modules/
docs-site/build/
docs-site/.docusaurus/
docs-site/docs/
fetched-logs/

# Secrets must never be committed — belt and braces alongside the secret scan
# in tests/. Any private key, token file, or credential store belongs in a
# root-owned path on the host, never in this repository.
*.key
*.pem
*.p12
*.pfx
id_rsa*
id_ed25519*
*credentials*
*token*
*.secret

# Credential files delivered by `admin/bf-creds --fetch` (<dealer-number>.txt).
# They live only in the checkout that runs the delivery, are root-owned on the
# device (mode 0600 inside a mode 0700 directory), and are never committed.
admin/secrets/