chore: make repository open-source contribution ready

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,37 @@
+---
+name: Bug report
+about: Report something that isn't working as expected
+title: "[Bug]: "
+labels: bug
+assignees: ''
+---
+
+## Describe the bug
+A clear and concise description of what the bug is.
+
+## To reproduce
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '...'
+3. See error
+
+## Expected behavior
+What you expected to happen instead.
+
+## Component
+- [ ] Backend (API / scheduler)
+- [ ] Web app (`web/`)
+- [ ] Chrome extension (`extension/`)
+- [ ] Email brief
+- [ ] Other / not sure
+
+## Environment
+- OS: [e.g. Windows 11, macOS 14]
+- Browser + version (if extension/web): [e.g. Chrome 126]
+- Commit / version: [e.g. `abe83a0` or v1.9]
+
+## Logs / screenshots
+Paste any relevant logs or screenshots. **Redact tokens, emails, and secrets.**
+
+## Additional context
+Anything else that might help.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/Aarav261/Ontracker/security/advisories/new
+    about: Please report security issues privately — do not open a public issue.
+  - name: Questions & discussion
+    url: https://github.com/Aarav261/Ontracker/discussions
+    about: Ask questions or discuss ideas here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,27 @@
+---
+name: Feature request
+about: Suggest an idea or improvement
+title: "[Feature]: "
+labels: enhancement
+assignees: ''
+---
+
+## Problem / motivation
+What problem does this solve? Is it related to a frustration you have? E.g.
+"I'm always frustrated when..."
+
+## Proposed solution
+A clear and concise description of what you want to happen.
+
+## Alternatives considered
+Any alternative solutions or features you've considered.
+
+## Component
+- [ ] Backend (API / scheduler)
+- [ ] Web app (`web/`)
+- [ ] Chrome extension (`extension/`)
+- [ ] Email brief
+- [ ] Other
+
+## Additional context
+Mockups, links, or any other context.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,23 @@
+## Summary
+<!-- What does this PR do and why? -->
+
+## Related issue
+<!-- e.g. Closes #123 -->
+
+## Type of change
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Refactor / cleanup
+- [ ] Documentation
+- [ ] Other:
+
+## Checklist
+- [ ] My branch is based on the latest `main`
+- [ ] `ruff check .` passes
+- [ ] `pytest` passes (if backend changes)
+- [ ] `npm run lint` passes in `extension/` (if extension changes)
+- [ ] I added/updated tests where it makes sense
+- [ ] I did not commit secrets, `.env` files, tokens, or database files
+
+## Notes for reviewers
+<!-- Anything reviewers should pay special attention to -->

.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  backend:
+    name: Backend (ruff + pytest)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          pip install pytest
+
+      - name: Ruff lint
+        run: ruff check .
+
+      - name: Run tests
+        run: pytest -q
+
+  extension:
+    name: Extension (lint)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: extension/package-lock.json
+
+      - name: Install dependencies
+        working-directory: extension
+        run: npm install
+
+      - name: Lint
+        working-directory: extension
+        run: npm run lint

.gitignore

@@ -14,9 +14,8 @@ venv/
 .ruff_cache/
 .pytest_cache/
 *.egg-info/
-# Kept out of the public repo (design doc + local-dev compose)
+# Kept out of the public repo (internal design doc)
 ARCHITECTURE.md
-docker-compose.yml
 
 # Node / extension
 node_modules/

CODE_OF_CONDUCT.md

@@ -0,0 +1,61 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes
+* Focusing on what is best for the overall community
+
+Examples of unacceptable behavior:
+
+* The use of sexualized language or imagery, and sexual attention or advances
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards and
+will take appropriate and fair corrective action in response to any behavior
+they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement via GitHub at
+[@Aarav261](https://github.com/Aarav261). All complaints will be reviewed and
+investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.
+
+[homepage]: https://www.contributor-covenant.org

CONTRIBUTING.md

@@ -0,0 +1,129 @@
+# Contributing to OnTrack(er)
+
+Thanks for your interest in contributing! OnTrack(er) sends students a prioritised
+weekday morning email brief of their [OnTrack](https://github.com/doubtfire-lms/doubtfire-web)
+tasks, with a companion Chrome extension. This guide explains how to get set up and
+submit changes.
+
+By contributing, you agree that your contributions are licensed under the
+[MIT License](LICENSE).
+
+---
+
+## Ways to contribute
+
+- **Report a bug** — open a [bug report](https://github.com/Aarav261/Ontracker/issues/new?template=bug_report.md).
+- **Suggest a feature** — open a [feature request](https://github.com/Aarav261/Ontracker/issues/new?template=feature_request.md).
+- **Submit code** — fix a bug, add a feature, improve docs. See the workflow below.
+- **Report a security issue** — please **do not** open a public issue; see [SECURITY.md](SECURITY.md).
+
+If you're planning a non-trivial change, please open an issue first to discuss it so
+we don't duplicate effort.
+
+---
+
+## Project layout
+
+| Area | Path | Stack |
+|------|------|-------|
+| Backend (API + scheduler) | `app.py`, `core/`, `routes/` | Flask · APScheduler · SQLAlchemy |
+| Web app (sign-in host) | `web/` | React 18 + Vite |
+| Chrome extension (MV3) | `extension/` | React 18 + Vite |
+| Tests | `tests/` | pytest |
+
+---
+
+## Local development setup
+
+### Prerequisites
+- Python 3.11+
+- Node.js 18+
+- Docker (for the backend + Postgres), or SQLite for a lighter setup
+
+### 1. Clone and configure
+```bash
+git clone https://github.com/Aarav261/Ontracker.git
+cd Ontracker
+cp .env.example .env.dev   # then fill in the values
+```
+See [`.env.example`](.env.example) for every variable. You'll need your own
+Clerk, Resend, and (optionally) Postgres credentials — none are provided.
+
+### 2. Backend
+```bash
+# With Docker (backend + Postgres, reads .env.dev)
+docker compose up -d --build
+
+# Or run directly against SQLite
+python -m venv venv && source venv/bin/activate   # Windows: venv\Scripts\activate
+pip install -r requirements.txt
+python app.py
+```
+
+### 3. Web app
+```bash
+cd web && npm install && npm run dev    # http://localhost:5173
+```
+
+### 4. Extension
+```bash
+cd extension && npm install && npm run build    # dev build -> extension/dist
+```
+Load `extension/dist` via **chrome://extensions → Load unpacked**.
+
+---
+
+## Code style & checks
+
+Run these locally before opening a PR — CI runs the same checks.
+
+```bash
+# Python: lint (ruff) — enforced in CI
+ruff check .
+
+# Python tests
+pip install pytest
+pytest
+
+# Extension: lint
+cd extension && npm run lint
+```
+
+- Python: line length 100, target py311. Config in [`ruff.toml`](ruff.toml).
+- `ruff format .` is available if you'd like autoformatting, but it isn't enforced —
+  match the style of the surrounding code and keep changes focused.
+
+---
+
+## Pull request workflow
+
+1. **Fork** the repo and create a branch off `main`:
+   `git checkout -b fix/short-description`
+2. Make your change, with tests where it makes sense.
+3. Ensure `ruff check .`, `pytest`, and `npm run lint` (in `extension/`) all pass.
+4. Commit with a clear message and open a PR against `main`, filling in the
+   PR template.
+5. A maintainer will review. Please be responsive to feedback.
+
+Keep PRs small and single-purpose where possible — they're far easier to review
+and merge.
+
+---
+
+## Commit messages
+
+Use clear, imperative subject lines, optionally with a type prefix you'll see in
+the history, e.g.:
+
+```
+feat(extension): capture rotated token from response headers
+fix(brief): don't skip users with no captured tasks on cold start
+docs: clarify local setup in CONTRIBUTING
+```
+
+---
+
+## Questions
+
+Open a [discussion or issue](https://github.com/Aarav261/Ontracker/issues) — happy
+to help you get started.

LICENSE

@@ -1,28 +1,21 @@
-OnTrack(er) — Proprietary License
-Copyright (c) 2026 Aarav (github.com/Aarav261). All Rights Reserved.
+MIT License
 
-This source code is made publicly viewable for reference, evaluation, and
-portfolio purposes ONLY. Viewing this repository does NOT grant any license to
-use it.
+Copyright (c) 2026 Aarav (github.com/Aarav261)
 
-You MAY:
-  - View and read the source code.
-  - Reference it for learning or evaluation.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
 
-You MAY NOT, without the prior written permission of the copyright holder:
-  - Use, run, host, or deploy this software or any service based on it.
-  - Copy, reproduce, or republish the source code, in whole or in part.
-  - Modify, adapt, translate, or create derivative or competing works.
-  - Distribute, sublicense, sell, or otherwise commercialise it.
-  - Remove or alter this license or any copyright notices.
-
-The name "OnTrack(er)", the associated logo, and the domain on-tracker.com are
-the property of the copyright holder and may not be used without permission.
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
-FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHOR BE
-LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM THE USE OF THIS
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
-
-For licensing or commercial enquiries, contact the copyright holder via GitHub.