# Deny by default. File-only exceptions keep credentials and caches out of the context.
**
!app/app.py
!app/audit_github_tokens.py
!app/capacity_model.py
!app/child_bootstrap.py
!app/console_runner.py
!app/container_import.py
!app/container_import_config.py
!app/container_projection_recovery.py
!app/container_runtime.py
!app/dashboard.py
!app/db_backend.py
!app/admin_api.py
!app/docker_depth_experiment.py
!app/docker_depth_operator.py
!app/docker_depth_report.py
!app/docker_shadow.py
!app/host_agent_client.py
!app/host_agent_apply.py
!app/host_agent_lifecycle.py
!app/host_agent_protocol.py
!app/host_agent_reconcile.py
!app/host_agent_runtime.py
!app/host_agent_server.py
!app/host_agent_state.py
!app/janitor.py
!app/jsonl_projector.py
!app/keycheck_accounting_smoke.py
!app/keycheck_candidates.py
!app/keycheck_runner.py
!app/keycheckers/__init__.py
!app/keycheckers/keycheck_common.py
!app/keycheckers/provider_resolution.py
!app/keycheckers/anthropic/anthropicKeycheck.py
!app/keycheckers/aws/awsKeycheck.py
!app/keycheckers/azure/azureKeycheck.py
!app/keycheckers/deepseek/deepseekKeycheck.py
!app/keycheckers/dockerhub/dockerhubKeycheck.py
!app/keycheckers/gcp/gcpKeycheck.py
!app/keycheckers/gemini/geminiKeycheck.py
!app/keycheckers/github/githubKeycheck.py
!app/keycheckers/gitlab/gitlabKeycheck.py
!app/keycheckers/groq/groqKeycheck.py
!app/keycheckers/huggingface/huggingfaceKeycheck.py
!app/keycheckers/kimi/kimiKeycheck.py
!app/keycheckers/openai/Keycheck.py
!app/keycheckers/openrouter/OpenrouterKeycheck.py
!app/keycheckers/provider_resolver/providerResolverKeycheck.py
!app/keycheckers/qwen/qwenKeycheck.py
!app/keycheckers/replicate/replicateKeycheck.py
!app/keycheckers/xai/xaiKeycheck.py
!app/keycheckers/zai/zaiKeycheck.py
!app/lifecycle_authority.py
!app/managed_files.py
!app/migrate_layout.py
!app/migrate_observability_db.py
!app/migrate_runtime_safety.py
!app/optimize_dashboard_db.py
!app/owned_process.py
!app/paths.py
!app/postgres_runtime.py
!app/process_identity.py
!app/query_policy.py
!app/result_bundle.py
!app/result_ingester.py
!app/result_spool.py
!app/runtime_bootstrap.py
!app/runtime_document.py
!app/runtime_document_io.py
!app/runtime_security.py
!app/scan_manager.py
!app/scanner.py
!app/scan_execution.py
!app/scanner_db.py
!app/scanner_error_policy_smoke.py
!app/supervisor.py
!app/supervisor_instance.py
!app/sync_alive_github_tokens.py
!app/target_identity.py
!app/ui_components.py
!app/worker_api.py
!app/worker_assignment.py
!app/worker_assignment_runner.py
!app/worker_cli.py
!app/worker_contracts.py
!app/worker_local_state.py
!app/worker_package.py
!app/worker_package_builder.py
!app/worker_supervisor.py
!app/remote_worker_bootstrap.py
!app/remote_worker_client.py
!app/requirements.txt
!app/requirements-keycheckers.txt
!app/config.linux.yaml
!app/trufflehog-custom-detectors.yaml
!app/.streamlit/config.toml
!start_runtime.ps1
!start_core_runtime.ps1
!stop_runtime.ps1
!Dockerfile
!.dockerignore
!compose.yaml
!compose.edge.yaml
!compose.shared-host.yaml
!docs/remote-worker-quickstart-ru.md
!docs/remote-worker-cheatsheet-windows-ru.md
!docs/remote-worker-cheatsheet-linux-ru.md
!docs/remote-worker-cheatsheet-docker-ru.md
!deploy/edge/Dockerfile
!deploy/edge/Caddyfile
!deploy/edge/Caddyfile.shared-host
!deploy/edge/host-caddy-shared.caddy
!deploy/edge/entrypoint.sh
!deploy/edge/README.md
!deploy/edge/admin-denylist.caddy
!deploy/edge/automatic-tls.caddy
!deploy/fail2ban/truf_caddy_admin_denylist.py
!deploy/fail2ban/Dockerfile.edge-e2e
!deploy/fail2ban/edge_e2e_docker_shim.py
!deploy/fail2ban/fail2ban.d-edge-e2e.local
!deploy/fail2ban/filter.d-truf-admin-auth.conf
!deploy/fail2ban/jail.d-truf-admin-auth.local
!deploy/fail2ban/action.d-truf-caddy-admin-denylist.conf
!deploy/fail2ban/fail2ban.d-truf-persistence.local
!deploy/host-agent/truf_host_agent.py
!deploy/host-agent/truf_host_agent_install.py
!deploy/host-agent/truf-host-agent.conf
!deploy/host-agent/truf-host-agent.service
!deploy/host-agent/truf-host-agent.socket
!deploy/systemd/truf-caddy-admin-denylist-expire.service
!deploy/systemd/truf-caddy-admin-denylist-expire.timer
!docker/requirements.in
!docker/requirements.lock
!docker/Dockerfile.edge-e2e
!docker/requirements-test.in
!docker/requirements-test.lock
!docker/requirements-worker.in
!docker/requirements-worker.lock
!docker/worker-package-pins.json
!docker/verify.py
!docker/build-dependencies/requirements.in
!docker/build-dependencies/requirements.lock
!tests/container_unit.py
!tests/container_e2e.py
!tests/container_import_stop_e2e.py
!tests/container_projection_recovery_e2e.py
!tests/owned_process_helper.py
!tests/parity_helpers.py
!tests/packaged_worker_e2e_server.py
!tests/edge_e2e_backend.py
!tests/edge_e2e_client.py
!tests/test_synthetic_llm_pipeline.py
!tests/test_docker_foundation.py
!tests/test_db_backend_safety.py
!tests/test_owned_process.py
!tests/test_owned_process_linux.py
!tests/test_owned_process_boundary.py
!tests/test_runtime_bootstrap_authority.py
!tests/test_runtime_document.py
!tests/test_runtime_document_io.py
!tests/test_managed_files.py
!tests/test_operations_schema.py
!tests/test_operations_control.py
!tests/test_host_agent_protocol.py
!tests/test_host_agent_linux.py
!tests/test_host_agent_apply.py
!tests/test_host_agent_deploy.py
!tests/test_host_agent_lifecycle.py
!tests/test_host_agent_reconcile.py
!tests/test_host_agent_runtime.py
!tests/test_host_agent_state.py
!tests/test_supervisor_foreground_shutdown.py
!tests/test_supervisor_startup_rollback.py
!tests/test_supervisor_managed_postgres_gate.py
!tests/test_observer_only_coordinated_shutdown.py
!tests/test_supervisor_safety.py
!tests/test_discovery_producer_supervisor.py
!tests/test_distributed_core_profile.py
!tests/test_discovery_only_cycle.py
!tests/test_discovery_request_budgets.py
!tests/test_operations_service.py
!tests/test_postgres_runtime.py
!tests/test_container_security.py
!tests/test_runtime_security.py
!tests/test_postgres_empty_initialization.py
!tests/test_container_migration_paths.py
!tests/test_container_provider_portability.py
!tests/test_container_e2e_helpers.py
!tests/test_container_runtime.py
!tests/test_container_import.py
!tests/test_container_import_config.py
!tests/test_container_projection_recovery.py
!tests/test_result_bundle_v2.py
!tests/test_pipeline_cutover_invariants.py
!tests/test_custom_provider_detector_compatibility.py
!tests/test_scan_execution.py
!tests/test_worker_api.py
!tests/test_worker_api_runtime.py
!tests/test_worker_assignment.py
!tests/test_worker_cli.py
!tests/test_worker_contracts.py
!tests/test_worker_local_state.py
!tests/test_worker_package.py
!tests/test_worker_supervisor.py
!tests/test_multisource_execution_snapshot.py
!tests/test_remote_direct_credentials.py
!tests/test_docker_staging_bounds.py
!tests/test_remote_worker_db.py
!tests/test_admin_api.py
!tests/test_edge_deployment.py
!tests/fixtures/worker_tls_cert.pem
!tests/fixtures/worker_tls_key.pem

# Defense in depth if the allowlist is expanded later.
**/.env*
**/secrets*
**/credentials*
**/*service-account*
**/__pycache__/
**/.venv/
**/venv/
**/node_modules/
**/*.py[cod]
**/*.db*
**/*.sqlite*
**/*.jsonl*
**/*.log*
.git/
.opencode/
runtime/
tmp/
state/
logs/
data/
docker/imports/
truf-cluster-authority-*/