# macOS

.DS_Store

._*

# Xcode

build/

DerivedData/

DerivedData-*/

*.xcuserstate

*.xcuserdatad/

xcuserdata/

*.xccheckout

*.xcscmblueprint

*.xcactivitylog

*.moved-aside

*.hmap

*.ipa

*.pkg

*.bcsymbolmap

*.dSYM.zip

*.dSYM

*.xcarchive/

*.xcresult/

*.xcdistributionlogs/

*.xctestrun

TestResults/

*.app/

# Xcode project user-specific

*.xcodeproj/*

!*.xcodeproj/project.pbxproj

!*.xcodeproj/xcshareddata/

!*.xcodeproj/project.xcworkspace/

*.xcworkspace/xcuserdata/

# Swift Package Manager

.build/

.build-*/

.swiftpm/

# Package.resolved is committed (app) so CI + contributors pin the same dependency versions.

# Code coverage

*.profraw

*.profdata

*.coverage

# Signing material / secrets — NEVER commit

*.p12

*.p12.b64

*.pem

*.key

*.cer

*.certSigningRequest

*.mobileprovision

*.provisionprofile

*.env

.env.*

!.env.example

secrets*

ExportOptions.plist

# Release pipeline output

# Exact-candidate release gates are source, even when a checkout's private exclude file hides

# untracked scripts by default.

!/scripts/desktop-linux-live-gate.sh

release-build*/

/release/

/dist/

/archives/

/notarization/

/Dory-*.zip

/Dory-*.dmg

/dory-engine-*.tar.gz

*.notarization-log.json

*.notary.json

notarytool-*.json

*.spctl.log

*.stapler.log

*.log

*.tmp

tmp/

.cache/

# Guest build artifacts (kernel Image, compiled agent) — rebuilt via guest/kernel/build.sh + guest/agent/build.sh

guest/out/

guest/.cache/

# Dory runtime data

.dory/

# Local tooling

.vscode/

.idea/

.zed/

.cursor/

.xcode.env.local

*.swp

*.swo

*~

.claude/settings.local.json

.claude/*.local.json

.claude/launch.json

.playwright-mcp/

benchmark-results.json

.benchmark-results/

.benchmark-smoke/

benchmark-results/

dory-benchmark/

appcast.xml.tmp

examples/readiness/tmp/

# Python caches

__pycache__/

*.py[cod]

*$py.class

.pytest_cache/

.mypy_cache/

.ruff_cache/

.coverage

.coverage.*

htmlcov/

.venv/

venv/

# Node / website build output

node_modules/

npm-debug.log*

yarn-debug.log*

yarn-error.log*

pnpm-debug.log*

website/dist/

website/.vite/

website/.cache/

# Private cloud backend — separate repo, never in the public Dory repo

cloud/

# Private usedory.dev marketing site — maintained outside the public Dory repository

/usedory-site/

# Claude Code session artifacts

.claude-tasks.md

.claude/

# Website build output (source lives in website/; built into docs/ via `npm run build`)

docs-build/

# Go build artifact (build.sh writes the real output to guest/out/)

guest/agent/agent

# Built GitHub Pages site (CI builds website/ and deploys the output directly) plus local-only

# planning notes. Keep the source platform ADR and its Linux execution contracts under docs/.

docs/

!/docs/

/docs/*

!/docs/virtual-workspace-platform.md

!/docs/linux-virtual-workspace-architecture.md

!/docs/linux-virtual-workspace-delivery-plan.md

!/docs/linux-capability-and-qualification-matrix.md

!/docs/linux-vm-performance-contract.md

!/docs/linux-iso-and-gpu-recovery-review.md

!/docs/container-engine-performance-qualification.md

!/docs/architecture-gates/

/docs/architecture-gates/*

!/docs/architecture-gates/virtiofs-worker-xpc.json

!/docs/architecture-gates/vz-custom-virtio-gpu.json

!/docs/architecture-gates/vulkan-13-application-readiness.md

!website/public/docs/

!website/public/docs/**

# Source-level renderer build and ABI verification are release inputs, not local scripts.

!/scripts/build-renderer-production-dependencies.sh

!/scripts/build-virglrenderer.sh

!/scripts/assemble-renderer-production-worker.sh

!/scripts/renderer-release-identity.py

!/scripts/renderer-production-tuple.py

!/scripts/renderer-build-tools/

/scripts/renderer-build-tools/*

!/scripts/renderer-build-tools/xcodebuild

!/scripts/verify-virgl-resource-info-abi.c

# Candidate-bound physical Linux developer smoke (fail-closed; never release qualification).

!/scripts/linux-local-runtime-smoke.sh

# Canonical Linux VM performance evidence validation, signed-bundle verification, and their

# public-key-only adversarial fixtures are release source. Private collector output and signing

# keys remain excluded.

!/scripts/qualify-container-engine-performance.sh

!/scripts/validate-linux-vm-performance-evidence.py

!/scripts/verify-linux-vm-performance-bundle.py

!/scripts/test-linux-vm-performance-bundle.py

!/scripts/fixtures/

/scripts/fixtures/*

!/scripts/fixtures/linux-vm-performance-bundle-schema1/

!/scripts/fixtures/linux-vm-performance-bundle-schema1/**

!/scripts/fixtures/hostshare_guest_probe.py

!/scripts/fixtures/hostshare_nonping_probe.py

# Internal engine notes (not published)

Packages/ContainerizationEngine/Docs/

# Python bytecode from the doctor helpers

scripts/__pycache__/

# Rust build output — the dory-core workspace + the de-risking spikes.

# (Nested .gitignore files in those dirs cover the same; these are belt-and-suspenders.)

/dory-core/target/

/dory-core/ffi/generated/

/dory-core-swift/.build/

/dory-core-swift/artifacts/

/dory-core-swift/Sources/DoryCore/generated/

/spikes/*/target/

/spikes/*/Cargo.lock

#codex

.codex-bench/

.dory-build/

# Internal planning and qualification documents

/ARCHITECTURE.md

/COMPETITOR_ISSUE_COVERAGE.md

/DESTRUCTIVE_ACTIONS.md

/DORY_V0.4_RESEARCH_REPORT.md

/MACHINE_IMAGE_CONTRACT.md

/POST_V0.4_PRODUCT_DESIGNS.md

/RELEASE_READINESS.md