.gitignore

# dependencies
node_modules/
.venv/
venv/
__pycache__/
*.pyc

# build / dist (electron-builder output → published to GitHub Releases, not git)
dist/
apps/*/dist/
dist-renderer/
apps/*/dist-renderer/
build/
out/

# data (lives on the local swf-node, not in repo)
*.db
*.sqlite
*.sqlite3
data/

# logs / scratch
*.log
apps/os/src/renderer/__collab_harness__/
tmp/
tmp/github-progress-audit.json
tmp/github-progress-audit.md
tmp/github-progress-cache/
.DS_Store
.vscode/
.idea/
.claude/
.context-vault/

# env / secrets
.env
.env.local
.env.*.local
calendar-ingress-seed.sql
calendar-ingress-deploy-plan.md

# private signing keys — NEVER commit
cohort-data/.private/

# local-only reference material (boss's meeting notes etc.) — NEVER commit or deploy.
# Real names + raw quotes; lives outside apps/web/ so it can't reach the site.
references/

# generated transcript catalog — build output only, written under cohort-data/.private/
# by scripts/build-transcript-talk-index-html.mjs; not tracked in this repo.
docs/INFORMATION_INDEX.html
docs/INFORMATION_INDEX.md
docs/INFORMATION_INDEX_preview.pdf

# screenshots
screenshots/
*.png
!docs/**/*.png
!apps/web/**/*.png

# website vendored build artifacts — regenerated by `npm run vendor:web`
apps/web/shape-ui/
apps/web/cohort-surface.json
apps/web/calendar.json
apps/web/calendar.ics

# live calendar grid — carries Google Meet join links for the app's live Supabase
# source ONLY. Published to Supabase; MUST NOT be committed to this public repo
# (the committed calendar.json / .ics / cohort-surface.json stay Meet-free).
cohort-data/calendar.live-grid.json

# cohort-internal transcript evidence — generated locally from the private
# vault (consent: cohort-internal, max_surface: cohort). MUST NOT be committed
# to this public repo. The app reads reviewed evidence from the gated Supabase
# app_transcript_evidence_cards view at runtime; build:cohort tolerates absence.
cohort-data/artifacts/transcript-evidence/generated/
cohort-data/artifacts/transcript-distillations/generated/

# local cohort-internal working artifacts (drafts / working models) — not for the public repo
cohort-data/artifacts/midterm-awards/
Midterm Awards Mobile Copies/

# cohort-internal per-session distillations (consent: cohort-internal /
# speaker-pending). Same boundary as the evidence above: distilled from the
# private vault, must not live in the public repo. Source copies are kept under
# cohort-data/.private/ (gitignored). build:cohort no longer embeds these and
# tolerates absence; the app will read reviewed distillations from the gated
# Supabase view at runtime once the engine + cohort auth land.
cohort-data/session-insights.json
cohort-data/constellation-cues.json
cohort-data/session-readouts/

# vercel cli local link metadata
.vercel

# Supabase CLI local state
supabase/.temp/

# CI-fetched single-file PyInstaller binaries (populated at build time
# by scripts/fetch-swf-node.sh + scripts/fetch-research-swarm.sh; the
# per-arch _staging/ tree is flattened into the dirs below by the
# beforePack hook, apps/os/scripts/before-pack-stage-binaries.cjs)
apps/os/build-resources/_staging/
apps/os/build-resources/swf-node/
apps/os/build-resources/research-swarm/
# whisper.cpp voice backend — large model + per-platform binary, staged by
# apps/os/scripts/fetch-whisper-cpp.sh (not committed)
apps/os/build-resources/whisper/

# cohort_app Supabase JWT, baked into the packaged app by the beforePack hook
# (apps/os/scripts/before-pack-stage-binaries.cjs) from the SRFG_COHORT_KEY build
# env. Gates the T2 evidence view — the secret must NEVER be committed to this
# public repo; it is regenerated on every packaged build.
apps/os/build-resources/cohort-app-key.json