# Plaintext secrets (never commit)
.env

# Encrypted secrets — safe to commit (.env.enc is SOPS-encrypted)
!.env.enc
!.sops.yaml

# Per-box project config (generated by disinto init)
projects/*.toml

# Runtime state
*.log
*.log.*
*.log.old
state.json
*.lock
*.pid
metrics/supervisor-metrics.jsonl

# OS
.DS_Store
dev/ci-fixes-*.json
gardener/dust.jsonl