# secrets + runtime — NEVER commit (a pack may be public)
.env
.hermes-data/
config.yaml
# raw/ holds runtime ingest INPUT/OUTPUT (scraped article bodies + reports you drop in) — content is
# NEVER committed (third-party / not source-of-truth). Only the drop-zone structure (.gitkeep) and
# raw/README.md are tracked, so the dirs exist on a fresh clone. See raw/README.md.
raw/**
!raw/**/
!raw/README.md
!raw/**/.gitkeep

# tooling caches
.serena/

# python / editor / scratch
__pycache__/
*.pyc
*.bak
*.bak.*
.DS_Store

# deploy-time runtime (extension enablement, model routing) — ships INERT
.okengine/

# GENERATED + SECRET .okengine/ artifacts (extension/deploy machinery writes these). The committed
# enable-state (.okengine/extensions.yaml) + model config (.okengine/model-profiles.yaml,
# .okengine/cron-models.json) ARE tracked; everything below is regenerated or holds injected MCP
# tokens, so committing it leaks secrets + a stale composed-schema (okengine invariant-audit).
.okengine/composed-schema.yaml
.okengine/extensions-effective.yaml
.okengine/reader-panels.json
.okengine/extension-tokens.json
.okengine/extension-secrets.json
.okengine/generated/
