cleanup

.gitignore

@@ -80,4 +80,41 @@ devops/ci-local/.env
 # Act artifacts
 out/act-artifacts/
 
-docs/implplan/audits/**/*
+docs/implplan/audits/**/*
+
+# QA run build artifacts (agents must not commit compiled output as evidence)
+docs/qa/feature-checks/runs/**/tier1-test-out/
+docs/qa/feature-checks/runs/**/tier1-test-out-detailed/
+docs/qa/feature-checks/runs/**/tier1-build-out/
+docs/qa/feature-checks/runs/**/tier2-test-out/
+docs/qa/feature-checks/runs/**/tier2-harness/bin/
+docs/qa/feature-checks/runs/**/tier2-harness/obj/
+docs/qa/feature-checks/runs/**/TestResults/
+
+# Playwright MCP screenshots (ephemeral)
+.playwright-mcp/
+
+# Publish outputs
+publish/
+publish-platform/
+.tmp-authority-publish/
+
+# Private keys and certificates (never commit)
+*.key
+*.pfx
+stella-ops.crt
+
+# SDK tools (download at build time)
+src/Sdk/StellaOps.Sdk.Generator/tools/*.tar.gz
+src/Sdk/StellaOps.Sdk.Generator/tools/*.jar
+
+# OpenCode agent tool
+.opencode/
+
+# Misc scratch
+tmp-openapi-metadata/
+test-results/
+qa-evidence/
+screenshots/
+offline-kits/
+network-requests.log