Keep customer uploads out of this public repository by rule, not by luck

data/spaces holds 157k real user images that the private raiw-app retention
checks materialize here. The only thing keeping them out of a commit was an
untracked .gitignore inside the directory, which a fresh clone does not
have.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.gitignore

@@ -23,6 +23,13 @@ Thumbs.db
 # Generated calibration inputs
 data/synthid_corpus/refs/
 
+# Real user uploads pulled from DO Spaces by the private raiw-app retention
+# checks (see raiw-app/.claude/rules/spaces-retention.md). Customer data has
+# no place in this public repository's history. Until 2026-09-07 the only
+# thing keeping 157k of these files out of a commit was an untracked
+# .gitignore inside the directory, which a fresh clone would not have.
+data/spaces/
+
 # Reference materials
 _refs/
 

CLAUDE.md

@@ -47,7 +47,7 @@ Research and current constraints are routed through [`docs/index.md`](docs/index
 
 ## Data safety
 
-Follow [`data/README.md`](data/README.md) for public fixture, calibration, oracle, and evaluation layout. Store each tracked binary once and keep generated evaluation outputs outside the repository.
+Follow [`data/README.md`](data/README.md) for public fixture, calibration, oracle, and evaluation layout. Real customer uploads never enter this repository: the private `raiw-app` retention checks materialize them under `data/spaces/`, which is gitignored here for that reason, and nothing under it may be committed, quoted, or turned into a fixture. Store each tracked binary once and keep generated evaluation outputs outside the repository.
 
 ## Rules and conventions