diff --git a/.gitignore b/.gitignore
index 651a2fe8db..cd474ded99 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,184 +1,49 @@
-
-!apps/desktop/src/global.d.ts
-!apps/desktop/src/plugins/*/plugin.js
-!apps/desktop/src/vite-env.d.ts
-!hermes_cli/data/
-# — ignore so `git status` stays clean and update's autostash skips them.
-# (launch-time stale-bytecode sweep). Runtime state, never a code change.
-# `data/` pattern above would otherwise swallow it.
-# `npm run sync-assets` (see web/package.json).
-# also created in-repo when an agent operates in this checkout). Plans, audit
-# and `hermes update`'s untracked autostash does not treat it as a local edit (#66189 / #54855).
-# automation-blueprints-index.json is a build artifact emitted by
-# bootstrap installer. It is Hermes-managed runtime state, never a code change —
-# Bundled community plugin index seed (shipped as package data) — the bare
-# by `hermes update` / launch-time self-heal. Runtime state, never a code change
-# by accident via 3a69e34702, removed in the #72002 salvage).
-# Checkout fingerprint the __pycache__ tree was last validated against
-# CLI config (may contain sensitive SSH paths)
-# committed to the repo root. See the hermes-release skill.
-# Cross-process web UI build lock (flock target, always empty)
-# cut (passed to `gh release create --notes-file`); the GitHub Release itself
-# Desktop demo-run scratch output (hermes writes demo/*.txt during recorded
-# Desktop/bootstrap install marker written into the managed checkout root by the
-# e.g. hermes-bots): plugin.js IS the source, not tsc output. No .tsx
-# every build).
-# EXCEPT bundled plain-ESM plugin entries (adopted SDK-consumer plugins,
-# git for the same reason as skills-index.json (large, generated, change
-# ignore it so `hermes update`'s `git stash push --include-untracked` does not
-# image-provider (fal.media) URL — they are NEVER committed to the repo. The
-# infographic-check CI job is what actually enforces this.
-# Installer-written method stamp in the managed checkout root (scripts/install.sh).
-# interrupted; consumed by launch-time recovery. Never commit it (was tracked
-# Interrupted-update breadcrumb + recovery lock written next to the shared venv
-# Local editor / agent tooling (machine-specific; keep in global config, not the repo)
-# logs, and per-session caches are never artifacts of the codebase.
-# Nix
-# No trailing slash: also matches node_modules SYMLINKS (worktrees often
-# Per-release changelog drafts. These exist only transiently during a release
-# Persistent dev sandbox dir (scripts/dev-sandbox.sh --persistent)
-# Playwright visual regression baselines — cached from main in CI, not committed
-# PR body is the archive. See the hermes-agent-dev skill's
-# PR infographics are rendered locally and embedded in PR descriptions via the
-# pr-infographic-workflow reference (storage rule + lapse #8 / #COMMIT-1).
-# Private keys
-# regenerated by scripts/tool_search_livetest.py. Never an artifact of the repo.
-# Release script temp files
-# Repo-root build/debug artifacts that must never be committed
-# resolves the stale .js OVER the .tsx — never track these)
-# Runtime marker written by hermes update when a lazy dependency refresh is
-# Runtime metadata only — never a code change. Ignore so `git status` stays clean
-# Sandbox dirs used by the install/update E2E (tests/install/). The suffix is
-# sibling exists, so the stale-shadow hazard above cannot apply.
-# sidestepped by an `infograficos/` directory (#70552). .gitignore is only
-# Skills Hub state (lives in ~/.hermes/skills/.hub/ at runtime, but just in case)
-# skills.json + skills-meta.json are build artifacts emitted by
-# slip into a commit and break `npm ci` on CI with ENOTDIR).
-# Spelling variants are listed because a single `infographic/` pattern was
-# stores the published notes. They are not a build artifact and must never be
-# symlink node_modules to the main checkout; the dir-only pattern let one
-# the first line of defence and cannot stop `git add -f` at all — the
-# the route name, so each route gets its own tree and two can run at once.
-# Tool Search live-test harness output — non-deterministic model transcripts,
-# treat it as a local edit and autostash it on every run (#38529).
-# tsc-emitted artifacts (a stray `tsc -b` compiles into src/, and vite then
-# walkthroughs). Throwaway artifacts, never part of the app.
-# Web UI assets — synced from @nous-research/ui at build time via
-# Web UI build output
-# website/scripts/extract-automation-blueprints.py during prebuild.
-# website/scripts/extract-skills.py during prebuild — keep them out of
-# Working directory for the Hermes Agent's session state (~/.hermes/ at runtime;
-#
-%SystemDrive%/
-*.pem
-*.ppk
-*.pyc*
-*.tsbuildinfo
-*-snapshots/
-.act-sandbox-agent.*
-.build/
-.cache/
-.bytecode-fingerprint
-.bytecode-fingerprint.tmp
-.codex/
-.cursor/
-.direnv/
 .DS_Store
-.env
-.env.development
-.env.development.local
-.env.local
-.env.production.local
-.env.test
-.env.test.local
-.gemini/
-.hermes/
-.hermes-bootstrap-complete
-.hermes-docker/
-.hermes-sandbox/
-.hermes-sandbox-e2e*/
-.lazy-refresh-incomplete
-.mcp.json
-.nix-stamps/
-.notebooklm-cli-venv/
-.notebooklm-home/
-.notebooklm-playwright/
-.op.env
-.pip-cache/
-.pytest_cache/
-.pytest-cache/
-.release_notes.md
-.skills_prompt_snapshot.json
-.update-incomplete
-.update-incomplete.lock
-.uv-cache/
-.venv
-.venv/
-.vscode/
-.web_ui_build.lock
-.worktrees/
-.zed/
-/*.png.bak
-/.hermes-runtime/
-/.install_method
-/_pycache/
-/bin/
-/pm/.lock.json.lock
-/default.tar.gz
-/log.txt
-/sqlite_leak_fix.png
+/venv/
 /venv.old/
 /venv.stale.runtime-*/
-/venv/
+/bin/
+/.hermes-runtime/
+/_pycache/
+*.pyc*
 __pycache__/
+act/
+.act-sandbox-agent.*
+.venv/
+.venv
+.vscode/
+.env
+.op.env
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+.env.development
+.env.test
+.hermes-docker/
+.notebooklm-home/
+.notebooklm-cli-venv/
+.notebooklm-playwright/
+.pip-cache/
+.uv-cache/
+compose.hermes.local.yml
+export*
 __pycache__/model_tools.cpython-310.pyc
 __pycache__/web_tools.cpython-310.pyc
-act/
-agent-browser/
-apps/desktop/build/
-apps/desktop/demo/
-apps/desktop/dist/
-apps/desktop/release/
-apps/desktop/electron/**/*.d.ts
-apps/desktop/electron/**/*.js
-apps/desktop/electron/**/*.js.map
-apps/desktop/src/**/*.d.ts
-apps/desktop/src/**/*.js
-apps/desktop/src/**/*.js.map
-apps/shared/src/**/*.d.ts
-apps/shared/src/**/*.js
-apps/shared/src/**/*.js.map
-browser-use/
-cli-config.yaml
-compose.hermes.local.yml
-config/mcporter.json
-data/
-data/*
-docs/superpowers/*
-environments/benchmarks/evals/
-examples/
-export*
-hermes-*/*
-hermes_agent.egg-info/
-hermes_cli/scripts/
-hermes_cli/tui_dist/*
-hermes_cli/web_dist/
-ignored/
-images/
-infografico/
-infograficos/
-infographic/
-infographics/
 logs/
-mini-swe-agent/
-models-dev-upstream/
-native/fts5_cjk/*.so
-node_modules
-opencode.json
-playwright-report/
-privvy*
-RELEASE_v*.md
-result
+data/
+# Bundled community plugin index seed (shipped as package data) — the bare
+# `data/` pattern above would otherwise swallow it.
+!hermes_cli/data/
+.pytest_cache/
+test_durations.json
+.pytest-cache/
+tmp/
+temp_vision_images/
+hermes-*/*
+examples/
+tests/quick_test_dataset.jsonl
+tests/sample_dataset.jsonl
 run_datagen_kimik2-thinking.sh
 run_datagen_megascience_glm4-6.sh
 run_datagen_sonnet.sh
@@ -227,6 +92,9 @@ apps/desktop/dist/
 apps/desktop/src/**/*.js
 apps/desktop/src/**/*.js.map
 apps/desktop/src/**/*.d.ts
+apps/desktop/electron/**/*.js
+apps/desktop/electron/**/*.js.map
+apps/desktop/electron/**/*.d.ts
 # EXCEPT bundled plain-ESM plugin entries (adopted SDK-consumer plugins,
 # e.g. hermes-bots): plugin.js IS the source, not tsc output. No .tsx
 # sibling exists, so the stale-shadow hazard above cannot apply.
@@ -269,7 +137,8 @@ website/static/api/skills-index.json
 # every build).
 website/static/api/skills.json
 website/static/api/skills-meta.json
-# Plugin catalog JSON is generated from plugin-catalog/ during prebuild.
+# plugins.json + plugins-meta.json are build artifacts emitted by
+# website/scripts/extract-plugins.py during prebuild (Plugin Catalog page).
 website/static/api/plugins.json
 website/static/api/plugin-stars.json
 website/static/api/plugin-catalog.json
@@ -401,18 +270,18 @@ docs/superpowers/*
 install-stamp.json
 
 # Tool Search live-test harness output — non-deterministic model transcripts,
-# regenerated by scripts/tool_search_livetest.py. Never an artifact of the repo.
-
-scripts/out/
+# regenerated by evals/tool_search/tool_search_livetest*.py. Never an artifact of the repo.
 evals/tool_search/out*/
 
 # Per-release changelog drafts. These exist only transiently during a release
 # cut (passed to `gh release create --notes-file`); the GitHub Release itself
 # stores the published notes. They are not a build artifact and must never be
 # committed to the repo root. See the hermes-release skill.
+RELEASE_v*.md
 
 # Desktop demo-run scratch output (hermes writes demo/*.txt during recorded
 # walkthroughs). Throwaway artifacts, never part of the app.
+apps/desktop/demo/
 
 # PR infographics are rendered locally and embedded in PR descriptions via the
 # image-provider (fal.media) URL — they are NEVER committed to the repo. The
@@ -423,32 +292,29 @@ evals/tool_search/out*/
 # sidestepped by an `infograficos/` directory (#70552). .gitignore is only
 # the first line of defence and cannot stop `git add -f` at all — the
 # infographic-check CI job is what actually enforces this.
+infographic/
+infographics/
+infograficos/
+infografico/
+native/fts5_cjk/*.so
 # Runtime marker written by hermes update when a lazy dependency refresh is
 # interrupted; consumed by launch-time recovery. Never commit it (was tracked
 # by accident via 3a69e34702, removed in the #72002 salvage).
+.lazy-refresh-incomplete
+.skills_prompt_snapshot.json
 
 # Disposable profile created by scripts/probe_active_session_exclusivity.py
 .probe-home/
-skills/.hub/
-source-data/*
-temp_vision_images/
-test_durations.json
-testlogs
-test-results/
-tests/quick_test_dataset.jsonl
-tests/sample_dataset.jsonl
-tmp/
-wandb/
-web/public/ds-assets/
-web/public/fonts/
-website/static/api/automation-blueprints-index.json
-website/static/api/skills.json
-website/static/api/skills-index.json
-website/static/api/skills-meta.json
-# ── generated icon assets (see scripts/generate_icons.py) ──────────────────
-# Regenerated on demand by every consuming pipeline (website/desktop/
-# installer/web prebuild via scripts/generate-icons.mjs). Sources of truth:
-# assets/nous-girl-*.svg + assets/backgrounds/.
+
+# Bundle/build scratch roots (scripts/bundles/, scripts/build/frontend-common.mjs)
+.build/
+.cache/
+
+# PM lockfile advisory lock; kept in place so waiting writers share its inode
+/pm/.lock.json.lock
+
+# Generated icon assets (scripts/generate_icons.py). Regenerated on demand by
+# every consuming pipeline; sources of truth: assets/nous-girl-*.svg + assets/backgrounds/.
 assets/icon-master.svg
 assets/icon-master-dark.svg
 apps/desktop/assets/icon.png