.gitignore

bin/
web/dist/
web/node_modules/
*.env
*.env.local
.DS_Store

# Compiled binary — built via `make build`, never committed
/matrixctrl
matrixctrl-*
!cmd/matrixctrl/

# Local dev artifacts
*.log
/tmp/

# Instance-specific Helm values (contain real secrets) — never commit
deploy/helm/*/values.*.yaml
!deploy/helm/*/values.yaml

# Local list of strings that must never be committed (P0-1c).
# Deliberately untracked: the needles cannot live in the repo they guard.
.sensitive-patterns

# The compiled frontend embedded into the binary. Generated by `make build`
# (web-build + copy-dist), never committed — the tracked copy was found sixteen days
# and ~15 etappes stale, so a bare `go build` served a UI with no moderation screen
# and reported nothing (etappe 50, DESIGN §4.49).
#
# .gitkeep is tracked and must stay: `//go:embed all:dist` is a build error on an
# empty directory, which would break `go test ./...` on a clean checkout.
cmd/matrixctrl/dist/*
!cmd/matrixctrl/dist/.gitkeep