# === Secrets — never commit ===
*.p12
*.pem
*.key
*.keystore
*.jks
.env
.env.*
!.env.example
secrets/
config/credentials/*.key
config/master.key
*openrouter*key*
*hf_token*

# === Call data (PII — never commit) ===
recordings/
*.wav
*.flac
*.m4a
*.ogg
*.opus
transcripts-private/

# === Ruby backend (bundler / runtime artifacts, if any) ===
components/backend/tmp/
components/backend/log/
components/backend/.bundle/
components/backend/vendor/bundle/

# === Android / Dialer patch build artifacts ===
components/dialer-patch/**/build/
*.apk
*.aab
.gradle/
local.properties

# === GrapheneOS / AOSP source (huge — fetched via script, never committed) ===
resources/aosp/
resources/grapheneos/
out/

# === Python (transcription worker) ===
**/.venv/
**/__pycache__/
*.pyc

# === OS / editor ===
.DS_Store
*.swp
.idea/
.vscode/
components/backend/wiki/wiki_index.json
components/backend/wiki/wiki_fulltext.txt

# local backend runtime env (secrets)
.claude/env.local

# Transcription A/B corpus and its cached output: real call recordings and transcripts are caller PII
# and must never be committed. Keep the recordings on the dev box only.
components/transcription-worker/bench/corpus/
components/transcription-worker/bench/out/