Repository hygiene — ignore local environment files

[Flow-Fly]

Goal

Prevent local server environment files containing database or future service credentials from being committed accidentally.

Context

The server now documents local configuration through server/.env.example, including DATABASE_URL. The repository ignores *.local, but does not currently ignore .env or .env.* files.

Scope

• Ignore local .env files at the repository root and within workspaces.
• Keep documented example/template files such as .env.example trackable.
• Check the repository for already tracked or accidentally committed local environment files.
• Add a focused regression check if the repository has an existing configuration-residue test pattern.

Acceptance criteria

• .env and environment-specific local variants are ignored.
• .env.example files remain trackable.
• No existing tracked example or CI configuration is hidden.
• git check-ignore demonstrates both the protected local-file case and the retained example case.

Agent Assessment

Risk: low. This is a narrow repository-hygiene change with objective git check-ignore verification.

Worker-ready: no. Queue behind the active architectural slice unless intentionally bundled with workspace/container hardening.

Non-goals

• No credential rotation or secret-manager integration.
• No changes to runtime configuration behavior.

[Flow-Fly]

Workflow Director handoff

Selected as the next independent low-risk delivery slice while #430 awaits its automatic Codex review.

• Implementation permission: granted
• Risk: low
• Start from the exact current origin/develop; do not base on or modify fix(guided): preserve setup after palette creation #430
• Open a draft pull request early targeting develop, with #388 in the canonical Linked task issues list
• Keep scope to repository ignore rules, tracked-file audit, and focused objective verification
• Preserve .env.example and any explicit CI/example configuration
• No credential rotation, runtime configuration change, secret-manager work, or unrelated repository cleanup
• Observability: no product telemetry required; this is repository hygiene enforced by version-control behavior and tests/checks

Run the complete repository verification gates and hand the ready exact head to the automatic Codex review. Do not post an @codex review trigger.

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.