# build output
/credrot
/dist/
/incredigo-map.html

# never commit secrets or backup bundles (any sealer: age / hmac / openssl)
*.credrot.enc
*.credrot.age
*.age
*.env
.env.*

# local-only design docs (kept on disk, never pushed upstream)
docs/ROTATION.md
docs/ROTATION-REAL-CRED-RUNBOOK.md

# maintainer-local: AI session directive (tailnet detail) + stale dev handoff
CLAUDE.md
HANDOFF.md

# lab kit: ship the scripts, never the binaries or real-host / runbook material
lab/incredigo
lab/gitea
lab/*.age
lab/rung1-*

# editor / OS
*.swp
.DS_Store