a636efd7ae
Some antivirus engines heuristically flag the self-signed, low-prevalence Windows installer (issue #198). Give downloaders a way to confirm assets are exactly what CI built: a checksum manifest plus signed SLSA provenance verifiable via gh attestation verify, with triage + code-signing policy docs linked from the README and release notes.
67 lines
1.2 KiB
Plaintext
67 lines
1.2 KiB
Plaintext
node_modules
|
|
.DS_Store
|
|
*.local
|
|
count.txt
|
|
.env
|
|
.nitro
|
|
.tanstack
|
|
.wrangler
|
|
.vinxi
|
|
__unconfig*
|
|
todos.json
|
|
.openpencil-tmp/
|
|
.superpowers/
|
|
.playwright-cli/
|
|
.playwright-mcp/
|
|
editor-*.png
|
|
scripts/ab-corpus/runs/
|
|
|
|
docs/
|
|
# Keep internal planning documents ignored, but publish the reviewed
|
|
# collaboration security contract with the open implementation.
|
|
!/docs/
|
|
/docs/*
|
|
!/docs/security/
|
|
/docs/security/*
|
|
!/docs/security/p2p-collaboration-threat-model.md
|
|
!/docs/security/antivirus-false-positives.md
|
|
!/docs/security/code-signing-policy.md
|
|
!/docs/testing/
|
|
/docs/testing/*
|
|
!/docs/testing/p2p-collaboration-platform-acceptance.md
|
|
|
|
# The bare `docs/` pattern above also shadows this test-fixture dir, which
|
|
# MUST be tracked (the CI diagnostics-golden drift guard reads it).
|
|
!crates/op-design-lint/tests/fixtures/docs/
|
|
|
|
# Build outputs
|
|
out/
|
|
dist/
|
|
apps/cli/src/commands/skill-bundle.json
|
|
dist-ssr/
|
|
electron-dist/
|
|
dist-electron/
|
|
.claude
|
|
.omx
|
|
.worktrees/
|
|
.omx/
|
|
|
|
# Rust
|
|
/target
|
|
**/*.rs.bk
|
|
Cargo.lock.merge-conflict
|
|
/crates/*/target
|
|
/vendor/agent/target
|
|
|
|
# Never stage local collaboration/HSM private-key containers.
|
|
**/relay-x25519-keys*.json
|
|
**/*private-keys*.json
|
|
**/*private_keys*.json
|
|
**/locator-signing-key*.json
|
|
|
|
tools/__pycache__/
|
|
__pycache__/
|
|
*.pyc
|
|
openpencil-docs
|
|
output
|