# Per-installation state produced by install.sh / install.ps1.
# None of this belongs in the repository or in a distributed bundle.

# Generated secrets
.env
.env.local
.env.*.local
secrets/

# Key material generated at install time. The *-dev filenames are the paths the
# services are configured to read; the contents are installation-specific.
config/etc/authority/keys/*.pem
config/etc/authority/keys/*.pfx
config/etc/scanner/keys/*.pem
config/etc/release-orchestrator/keys/*.pem
config/etc/jobengine/keys/*.pem
config/etc/exportcenter/keys/

# Operator-supplied content
airgap-import/
offline/
plugins/
config/contracts/*.zip
config/seed/*
!config/seed/.gitkeep

# Installer records (the vulnerability-data seed import result, SPRINT_20260925_004 DAY-7)
state/

# Offline vulnerability-data seed: staged by tools/build-and-publish.sh from a
# `stella mirror seed export` directory at release time, never committed.
data/

# Release outputs
# LICENSE-CHANGE-DATE.txt is computed per release by tools/write-manifest.py
# and shipped in the bundle. A committed copy would go stale against the
# version it names, which for a licence date is worse than absent.
LICENSE-CHANGE-DATE.txt
docker-compose.pinned.yml
release-manifest.yaml.sig
release-manifest.yaml.pem
release-signing.pub
*.tar.gz

__pycache__/
