Relicense under Apache-2.0 and add contributor docs

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -0,0 +1,53 @@
+name: Bug report
+description: Something in Burst does not work as it should.
+labels: [bug]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened
+      description: What you did, what you expected, and what happened instead.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Open channel '...'
+        2. Send a message containing '...'
+        3. See the error
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Burst version
+      description: A release tag or commit hash.
+      placeholder: 0.2.0
+    validations:
+      required: true
+  - type: dropdown
+    id: deployment
+    attributes:
+      label: Deployment
+      options:
+        - Local development (make all)
+        - Docker, all-in-one
+        - Docker, multi-service
+        - Helm chart
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: browser
+    attributes:
+      label: Browser and OS
+      description: For UI bugs.
+      placeholder: Firefox 131 on Ubuntu 24.04
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Relevant server, gateway or browser console output. Redact tokens and personal data.
+      render: text

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Question or idea
+    url: https://github.com/barbacane-dev/burst/discussions
+    about: Ask a question, share an idea, or show what you built.
+  - name: Security vulnerability
+    url: https://github.com/barbacane-dev/burst/security/advisories/new
+    about: Report a vulnerability privately. Do not open a public issue.

.github/ISSUE_TEMPLATE/feature-request.yml

@@ -0,0 +1,33 @@
+name: Feature request
+description: Suggest a feature or an improvement.
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Burst is deliberately focused on messaging ([ADR-001](https://github.com/barbacane-dev/burst/blob/main/adr/001-project-vision-and-scope.md)). Requests that keep it simple to run are the most likely to be accepted.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What you are trying to do, and what gets in the way today.
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+      description: How you would like it to work.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Workarounds, or how other tools handle it.
+  - type: checkboxes
+    id: contribute
+    attributes:
+      label: Contributing
+      options:
+        - label: I would like to implement this myself.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,17 @@
+## Summary
+
+What this change does and why.
+
+Closes #
+
+## Testing
+
+How you verified it: tests added or run, manual steps, screenshots for UI changes.
+
+## Checklist
+
+- [ ] `make check` and `make lint-spec` pass
+- [ ] UI changes: `npm run lint`, `npm test` and `npm run build` pass in `ui/`
+- [ ] Tests cover the change
+- [ ] Docs in `docs/` are updated for user-visible changes
+- [ ] Commits follow Conventional Commits and are signed off (`git commit --signoff`)

.github/SECURITY.md

@@ -0,0 +1,37 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+**Do not open a public GitHub issue for a security vulnerability.**
+
+Report it privately, either through [GitHub's private vulnerability reporting](https://github.com/barbacane-dev/burst/security/advisories/new) or by email to **security@barbacane.dev**.
+
+Please include:
+
+- A description of the vulnerability and its impact
+- Steps to reproduce it
+- The affected version or commit
+- A suggested fix, if you have one
+
+## Response
+
+- **Acknowledgement:** within 48 hours
+- **Initial assessment:** within 7 days
+- **Fix:** critical vulnerabilities are targeted within 30 days
+
+We credit reporters in the security advisory unless you prefer to remain anonymous, and ask that you allow reasonable time for a fix before public disclosure.
+
+## Supported versions
+
+Security fixes are released for the latest minor version.
+
+| Version | Supported |
+|---------|-----------|
+| 0.2.x   | Yes       |
+| < 0.2   | No        |
+
+## Scope
+
+In scope: the Burst server and UI in this repository, the Barbacane gateway configuration it ships (`specs/`, `barbacane*.yaml`), and the Docker images and Helm chart built from it.
+
+Out of scope: vulnerabilities in the Barbacane gateway itself (report those to the [Barbacane project](https://github.com/barbacane-dev/barbacane/security)), in other third-party dependencies, and issues that require physical access to the server or social engineering.

CODE_OF_CONDUCT.md

@@ -0,0 +1,83 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. Examples of representing our community include using an official e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at contact@barbacane.dev. All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.1, available at [https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at [https://www.contributor-covenant.org/faq][FAQ]. Translations are available at [https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations

CONTRIBUTING.md

@@ -0,0 +1,89 @@
+# Contributing to Burst
+
+Thanks for your interest in Burst. Bug reports, fixes, features, docs and questions are all welcome.
+
+## Where to start
+
+- **Issues labelled [`good first issue`](https://github.com/barbacane-dev/burst/labels/good%20first%20issue)** are self-contained and come with pointers to the code involved.
+- **[`help wanted`](https://github.com/barbacane-dev/burst/labels/help%20wanted)** marks larger items we would like help with.
+- **[Discussions](https://github.com/barbacane-dev/burst/discussions)** are for questions, ideas and show-and-tell.
+- For anything larger than a bug fix, open an issue or a discussion first so we can agree on the approach before you write the code.
+
+Comment on an issue to claim it, so two people don't work on the same thing.
+
+## Development setup
+
+Prerequisites: Rust (stable), Node.js 20+, Docker (or Podman), and [overmind](https://github.com/DarthSim/overmind) or hivemind to run the process set (`make install` installs overmind with Homebrew).
+
+```bash
+make all      # PostgreSQL + mock OIDC, gateway compile, then gateway + server + UI
+make seed     # first time only: sample users
+```
+
+Open http://localhost:5173 and sign in as `alice` with any password. `make help` lists every target; the [README](README.md) describes the architecture and the individual processes.
+
+The Makefile downloads the pinned Barbacane gateway binary into `.barbacane/`. To use a local Barbacane build instead, set `BARBACANE_BIN=../barbacane/target/release/barbacane`.
+
+## Project layout
+
+| Path | Contents |
+|------|----------|
+| `crates/burst` | Binary: CLI entry point, config loading |
+| `crates/burst-core` | Domain types, events, pure logic (no I/O) |
+| `crates/burst-server` | Axum handlers, database (sqlx), WebSocket, file storage |
+| `ui/` | React 19, Vite, Tailwind, TanStack Query |
+| `specs/burst-api.yaml` | The OpenAPI spec: the API contract and the gateway configuration |
+| `migrations/` | PostgreSQL migrations |
+| `adr/` | Architecture Decision Records |
+| `docs/` | User, deployment and admin documentation (mdBook) |
+| `deploy/helm/` | Helm chart |
+
+The [ADRs](adr/) explain why Burst is built the way it is. Read the ones an issue references before starting on it. A change that contradicts an ADR needs a discussion first, and possibly a new ADR.
+
+## Before opening a pull request
+
+Run the same checks CI runs:
+
+```bash
+make check                          # cargo fmt, clippy -D warnings, cargo test (needs PostgreSQL from `make services`)
+make lint-spec                      # OpenAPI lint; a hard gate in CI
+cd ui && npm run lint && npm test && npm run build
+```
+
+- After changing `specs/burst-api.yaml`, run `make gateway-compile`.
+- Integration tests live in `crates/burst-server/tests/` and use `#[sqlx::test]` against a real database.
+- UI changes: include a screenshot or short recording in the PR.
+- User-visible changes: update the relevant page in `docs/`.
+
+Rust conventions: no `unwrap()` or `panic!()` in production code, `thiserror` for library errors and `anyhow` in the binary, and errors returned as RFC 9457 problem details with `urn:burst:error:<type>` URNs.
+
+## Commits and pull requests
+
+Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/). Releases and the changelog are generated from them:
+
+```
+fix(ui): show custom emojis as images in reactions
+feat(search): filter messages by author
+```
+
+Common types: `feat`, `fix`, `docs`, `refactor`, `test`, `ci`, `chore`. A breaking change adds `!` after the type.
+
+Sign off every commit to certify the [Developer Certificate of Origin](https://developercertificate.org/), which states that you wrote the change or otherwise have the right to submit it:
+
+```bash
+git commit --signoff
+```
+
+Keep each pull request to one logical change. A maintainer reviews every PR, and CI must pass before merge.
+
+## Reporting security issues
+
+Do not open a public issue for a vulnerability. See [SECURITY.md](.github/SECURITY.md).
+
+## Code of conduct
+
+Everyone taking part is expected to follow the [Code of Conduct](CODE_OF_CONDUCT.md).
+
+## License
+
+Burst is licensed under the [Apache License 2.0](LICENSE). By contributing, you agree that your contributions are licensed under the same terms.

Cargo.toml

@@ -5,7 +5,7 @@ resolver = "2"
 [workspace.package]
 version = "0.2.0"
 edition = "2024"
-license = "AGPL-3.0-only"
+license = "Apache-2.0"
 
 [workspace.dependencies]
 burst-core = { path = "crates/burst-core" }