# ── CARGO BUILD DIRECTORIES, AT ANY DEPTH ────────────────────────────────────
#
# One rule, not a list. Until 2026-08-23 this was six enumerated paths (/target,
# bench/target, installtest/target, crates/gunnar-build-thing/target, crates/
# gunnar-znippy/target and one with a space in it) — which means every new crate
# with its own target dir had to be REMEMBERED here, and one was not:
# `vendor/gix-features/target`, 62 files of libc build script output, which is
# what made the release gate refuse this repo as carrying uncommitted source.
#
# `target/` (trailing slash, no leading slash) matches a directory called target
# at ANY depth, so a vendored crate or a detached sub-workspace is covered the
# day it appears rather than the day someone notices. Verified safe before
# changing: `git ls-files | grep -c '/target/\|^target/'` is 0, so no tracked
# path is swallowed. Same reasoning as the iso-root/ note below — the failure
# mode there was also "it was simply never listed".
target/
**/*.rs.bk
# `nornir bench run <repo>` drops a receipt beside the manifest after it has
# persisted the run into the warehouse. The warehouse is the record; this file
# is a local trail of it, one line per run, and committing it would make every
# measurement a merge conflict.
bench_history.jsonl
# The appliance ISO the `[[build.iso]]` cell masters, plus the staging tree and
# client key that arm it. Derived, large (~29 MiB per ISO, ~800 MiB of work
# dir), and rebuilt in ~80 s by the declared cell — never a repository object.
.iso-out/
# The INSTALLER cell's staging tree. `korp_installer::isocompose::compose_and_master`
# lays `<repo>/iso-root/` (BOOTX64.EFI, vmlinuz, efiboot.img, korp-start,
# app.znippy, app.sig, root.pub — ~59 MiB measured 2026-08-15) beside the
# mastered medium, in the CALLING product's root rather than under `.iso-out/`.
# Derived, rebuilt by the cell, and exactly the same law as the two entries
# around it — it was simply never listed, because until 2026-08-15 nothing in
# this repository had ever composed the declared `gunnar-installer` cell.
iso-root/
# The container archive the `[[build.container]]` cell exports (`archive = …`,
# the distributable docker-archive tar). Same law as .iso-out: derived, ~19 MiB,
# rebuilt in seconds by the declared cell.
.container-out/
# `nornir docs book` used to historize each rendered book into a LOCAL warehouse
# here (redb + Iceberg metadata, ~5 MB and growing per render), because
# nornir.toml pinned `[storage] local_path = ".nornir"`. That pin is gone as of
# 2026-08-13 — it gave gunnar two warehouses, one per config file, and the
# rendered front page read the empty one; see the long note in nornir.toml. The
# render trail now lands in the same home-derived warehouse every reader opens.
#
# The entry stays because the directory is still on disk from before the change
# and nothing derived belongs in the repository either way.
.nornir/warehouse/
# local editor state, never the repository's business
.idea/
# `gunnar issuer init` and `gunnar key issue` write here when they are run from
# the repository root, which is how an operator tries them out — and
# `admin.key.pem` is a private key. Root-anchored and named: `*.pem`
# repository-wide would also hide FIXTURES that a test is supposed to notice
# going missing.
#
# There used to be three more rules here — `/crates/gunnar-cli/*.pem`,
# `/*.key.pem`, `/*.cert.pem` — hiding what `gunnar control bootstrap` dropped
# into the CURRENT directory: this crate's, on every test run, and the checkout
# root, on 2026-08-30 and again on 2026-09-10 with a real key. Since 2026-09-10
# bootstrap writes to `~/.config/gunnar/<server>/` and the rules are gone ON
# PURPOSE: a regression shows up as an untracked private key in `git status`,
# which is the alarm, not a thing to silence.
/admin.key.pem
/admin.cert.pem
/gunnar-issuer.pem
# The re-image receipt: what `cargo xtask reinstall-appliance` read back off the
# box, written per run. An artifact of a deploy, not a description of one.
.deploy-out/
# THE SITE FACTS. `cargo xtask reinstall-appliance` needs the uuid of the box it
# destroys, the address it reads the verdict from and the front whose services
# it restarts. Those describe ONE deployment, not gunnar, and they used to be
# constants in `deploy/upcloud/src`. They are required input now
# (`--server-uuid` / `--verify-addr` / `--front`, or this file named by
# `--site` / `$GUNNAR_SITE`), and a run that has none of them refuses by name.
# Keep the file outside the repository; this rule is the second lock.
/site.toml
/gunnar-site.toml
docs/unsorted.pdf
# gunnar's own signed monetize plugin, staged for a METERED medium by
# `cargo xtask iso-installer` (xtask/src/plugin_stage.rs) and embedded by
# gunnar-server's build.rs. Built and signed by the Build Thing each compose —
# never a repository object.
.plugin-out/
# The signed `gunnar` CLI a front medium serves under /download/ (E4), staged by
# `cargo xtask iso-installer` (xtask/src/cli_stage.rs) and embedded by
# gunnar-front's build.rs. Built and signed by the Build Thing each compose —
# never a repository object. The directory itself is kept (its `.gitkeep`) so
# the build script can watch it without rerunning on every build.
.cli-out/*
!.cli-out/.gitkeep
# The estate's old sibling table (before G-B7, 2026-10-26, nothing includes it any more).
# A stale copy in an older checkout stays ignored: committed, it would break every lone
# clone, since cargo refuses a [patch] whose path is missing.
/.cargo/siblings.toml