.gitignore

/.idea/
/*.iml
*.Identifier
.phphunit.result.cache

/vendor/
/vendor-bin/*/vendor/

/.php-cs-fixer.cache
/tests/.phpunit.cache
/.phpunit.cache
.phpunit.cache/

# No trailing slash, deliberately. A pattern ending in `/` matches a DIRECTORY
# only, so `node_modules` created as a SYMLINK (what you get when you point a
# git worktree at a sibling checkout's install) is not ignored and lands in
# `git add -A`. That is how a symlink to one machine's absolute path reached
# this repository. Slashless patterns match a symlink too.
/node_modules
/website/node_modules
/website/.docusaurus/
/js/
/custom_apps/
/config/

/coverage/
/coverage-frontend/

# Quality reports
/quality-reports/
quality-baseline.json
/phpmetrics/
/phpmetrics-deps/

# PHPCS/Psalm output files (not config files)
phpcs-*.json
phpcs-*.txt
psalm-errors.json
psalm-output.json
psalm-full-output.json
phpqa_output.log

# Data files
*.csv
*.xls
*.xlsx

# Files with unusual extensions or no extensions that could be mistakes
**/PR *
**/adds *
**/implements *
**/ALL *
**/endpoints *
#
# SOURCE-EXTENSION NEGATIONS. Every substring glob in this block is meant to
# catch stray agent scratch files with no extension ("PR adds …", "endpoints
# …"). Left unqualified they also swallow real source, silently: `git add`
# says nothing, the file never reaches a commit, and the first symptom is a
# fatal error in CI on a class that is simply absent.
#
# This is not hypothetical here — the repo already lost this argument once.
# `**/*references*` swallowed src/components/userSettings/userPreferences.js
# and *PreferencesSection.vue (observed 2026-06-12, user-settings-v1) because
# "Preferences" embeds "references".
#
# MEASURED 2026-08-09, on this tree, with the only instruments that answer
# honestly — `git ls-files --others --exclude-standard` and
# `git status --porcelain --ignored`. (`git check-ignore -q` is NOT usable
# here: it exits 0 when a NEGATION matches, so it reports a path as ignored
# after it has been rescued.) Four plausible source names were created and
# their real status read back:
#
#   lib/Service/VotingAnalysisService.php   !!  IGNORED  <- **/*Analysis*
#   src/utils/updateUserSettings.js         !!  IGNORED  <- **/update*Settings*
#   lib/Service/encodingHelper.php          !!  IGNORED  <- **/*encoding*
#   src/utils/dataAnalysisChart.vue         !!  IGNORED  <- **/*Analysis*
#
# The negations below pair each glob with the source extensions this repo
# actually ships, matching the reference treatment in openregister/.gitignore.
# A negation cannot resurrect a file inside an ignored DIRECTORY, but every
# glob here matches files, so each one takes effect.
**/*Analysis*
# Junk note files named "references ..." — anchored to the filename START so
# legitimate sources containing "…Preferences…" (which embeds the substring
# "references") are not silently ignored. Observed 2026-06-12: the old
# `**/*references*` pattern swallowed src/components/userSettings/
# userPreferences.js + *PreferencesSection.vue (user-settings-v1).
**/references*
**/*encoding*
**/ter
**/clearCache*
**/update*Settings*
**/rebase*
**/setup*

# Rescue real source from every substring glob above. Keep this list in sync
# with the extensions the repo ships; a new source extension needs a new line.
!**/*.php
!**/*.js
!**/*.ts
!**/*.vue
!**/*.json
!**/*.md
!**/*.css
!**/*.scss
!**/*.xml
!**/*.yml
!**/*.yaml

# Temporary test files that shouldn't be committed
simple-solr-test.php
test-solr-connection.php

# Files with unusual extensions or no extensions that could be mistakes
**/PR *
**/adds *
**/implements *

phpqa/

# Docker AI models (too large for git)
docker/dolphin/models/

# Issues folder should be tracked
!issues/
!issues/**

/docusaurus/node_modules/
/docusaurus/build/
/docusaurus/.docusaurus/

# Docusaurus documentation site (docs/ — journeydoc / ADR-030)
/docs/node_modules/
/docs/build/
/docs/.docusaurus/
/docs/.cache-loader/
# Generated translation files — re-enable when a Dutch translation pass ships
/docs/i18n/nl/

# Playwright (journeydoc capture + future e2e)
/tests/e2e/.auth/
/tests/e2e/test-results/
/tests/e2e/playwright-report/
/playwright-report/
/playwright/.cache/

# AI pipeline prompt files — must not be tracked to prevent prompt injection via PRs
.specter-prompt.txt
# Test screenshots — images generated by browser test commands (test-app, run-test-scenario)
# Only images are ignored; markdown reports and scenario files are kept in git.
test-results/**/*.png
test-results/**/*.jpg
test-results/**/*.jpeg
test-results/**/*.gif
test-results/**/*.webp
openspec/test-site-results/**/*.png
openspec/test-site-results/**/*.jpg
openspec/test-site-results/**/*.jpeg
openspec/test-site-results/**/*.gif
openspec/test-site-results/**/*.webp
/coverage-vitest/

# SBOM is generated per run and published as the sbom-<app> workflow artifact
# and a stable-release asset — never stored in the repo (hydra sbom-generation
# spec; ConductionNL/.github#572).
sbom.cdx.json
bom-php.cdx.json
bom-npm.cdx.json

# Agent/test scratch and tool caches — generated, never source.
# Added by the 2026-08-25 fleet hygiene sweep (ADR-100 Decision 2).
.stale/
/.e2e-state/
.phpunit.result.cache
test-results/

# Build and test transcripts written at the repo ROOT by local tooling. These
# were tracked, so every local build produced a commit-shaped diff, and every
# such commit triggered the full Code Quality suite — 34 jobs deciding a
# changed log file. Root-anchored on purpose: .claude/skills/*/examples/*.log
# are gate FIXTURES, not artefacts, and must stay tracked.
/*.log
/changed.tsv

# Claude Code's per-machine settings — permissions and local overrides, never
# shared. It has to sit AFTER the `!**/*.json` rescue above, which otherwise
# re-includes it and makes a machine-local file committable.
/.claude/settings.local.json