# secrets + runtime — NEVER commit (a pack may be public)
.env
.hermes-data/
config.yaml
raw/            # feed_fetch output: scraped third-party article bodies, not source-of-truth

# python / editor / scratch
__pycache__/
*.pyc
*.bak
*.bak.*
.DS_Store
.serena/

.okengine/

# GENERATED + SECRET .okengine/ artifacts (extension/deploy machinery writes these). The committed
# enable-state (.okengine/extensions.yaml) + model config (.okengine/model-profiles.yaml,
# .okengine/cron-models.json) ARE tracked; everything below is regenerated or holds injected MCP
# tokens, so committing it leaks secrets + a stale composed-schema (okengine invariant-audit).
.okengine/composed-schema.yaml
.okengine/extensions-effective.yaml
.okengine/reader-panels.json
.okengine/extension-tokens.json
.okengine/extension-secrets.json
.okengine/generated/
