Skip to content

Commit c81b6b8

Browse files
gbrlpzzgbrlpzz
authored
chore: add OSS credibility metadata, security policy, citation format, and prepare initial public release (#46)
* docs: add community, security, and contribution policies * docs: add software citation metadata and legal notices * chore: expand formatting checks to all github issue templates * fix(auth): preserve admin surface across OAuth and magic link sign-in * fix(auth): isolate admin workspaces by institutional domain and provision personal orgs for generic emails
1 parent 86829b1 commit c81b6b8

35 files changed

Lines changed: 1044 additions & 62 deletions

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: Bug report
2+
description: Report a reproducible defect or unexpected behavior in collect
3+
title: "fix: "
4+
labels: ["bug"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Thank you for reporting an issue.
10+
11+
> [!CAUTION]
12+
> **Do not include sensitive research data, live GPS coordinates, private media URLs, session tokens, or credentials in public issues.**
13+
> For security vulnerabilities, report privately via [Security Advisories](https://github.com/gbrlpzz/collect/security/advisories/new).
14+
- type: dropdown
15+
id: surface
16+
attributes:
17+
label: Affected surface
18+
description: Which part of the application is affected?
19+
options:
20+
- "Guided Field Capture (Collector / PWA)"
21+
- "Local Ledger / Persistence (IndexedDB)"
22+
- "Synchronization Lifecycle & Receipts"
23+
- "Administrator Dashboard & Schema Editor"
24+
- "Authentication, Invitations & Device Linking"
25+
- "FAIR Checkpoint Export & Data Package"
26+
- "Edge Functions & Database Migrations"
27+
- "Marketing / Demo Homepage"
28+
- "Documentation & Provisioning Scripts"
29+
- "Other"
30+
validations:
31+
required: true
32+
- type: input
33+
id: environment
34+
attributes:
35+
label: Environment
36+
description: Browser, device model, and operating system (e.g. Safari on iOS 18, Chrome 130 on macOS).
37+
placeholder: "e.g., Safari 18 on iPhone 15 Pro (iOS 18.2)"
38+
validations:
39+
required: true
40+
- type: input
41+
id: version
42+
attributes:
43+
label: Collect version or commit
44+
description: Version number or commit hash (see Profile menu or package version).
45+
placeholder: "e.g., v0.1.2 or commit abc1234"
46+
validations:
47+
required: true
48+
- type: textarea
49+
id: reproduction
50+
attributes:
51+
label: Steps to reproduce
52+
description: What steps lead to the behavior?
53+
placeholder: |
54+
1. Open the project '...'
55+
2. Record an observation while offline
56+
3. Tap Submit
57+
4. Observe ...
58+
validations:
59+
required: true
60+
- type: textarea
61+
id: behavior
62+
attributes:
63+
label: Expected vs. observed behavior
64+
description: What did you expect to happen, and what happened instead?
65+
placeholder: "Expected local receipt 'Saved on this device', but observed ..."
66+
validations:
67+
required: true
68+
- type: dropdown
69+
id: offline_state
70+
attributes:
71+
label: Network & sync state
72+
description: Was the device offline, transitioning, or online during the issue?
73+
options:
74+
- "Offline throughout"
75+
- "Online throughout"
76+
- "Transitioned from offline to online"
77+
- "Intermittent / unstable connection"
78+
- "Not applicable"
79+
validations:
80+
required: false
81+
- type: checkboxes
82+
id: data_integrity
83+
attributes:
84+
label: Data safety check
85+
description: Please verify that no sensitive data is included.
86+
options:
87+
- label: "I confirmed that all logs, screenshots, and payloads are stripped of sensitive research data, live coordinates, and credentials."
88+
required: true

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
blank_issues_enabled: true
2+
contact_links:
3+
- name: Security Vulnerability Reporting
4+
url: https://github.com/gbrlpzz/collect/security/advisories/new
5+
about: Privately report security-sensitive issues or vulnerability disclosures.

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Feature request / Fieldwork proposal
2+
description: Propose a capability, field requirement, or improvement for collect
3+
title: "feat: "
4+
labels: ["enhancement"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
`collect` is infrastructure for trustworthy field evidence. Proposals should preserve local durability, receipt clarity, accessibility, and schema immutability.
10+
- type: textarea
11+
id: problem
12+
attributes:
13+
label: Fieldwork context & problem
14+
description: What field research scenario or operational need motivates this request?
15+
placeholder: "When conducting surveys in areas with ..."
16+
validations:
17+
required: true
18+
- type: textarea
19+
id: proposed_solution
20+
attributes:
21+
label: Proposed behavior
22+
description: How should the feature work for contributors or administrators?
23+
placeholder: "The interface should allow ..."
24+
validations:
25+
required: true
26+
- type: textarea
27+
id: alternatives
28+
attributes:
29+
label: Alternatives considered / current workaround
30+
description: How is this handled currently? What alternative designs were considered?
31+
validations:
32+
required: false
33+
- type: textarea
34+
id: invariants
35+
attributes:
36+
label: Invariant & trust boundary impact
37+
description: How does this change affect offline durability, receipt semantics, schema immutability, or export packaging?
38+
validations:
39+
required: false

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
## Summary
2+
3+
<!-- Describe the problem solved or capability introduced. -->
4+
5+
## Invariant & trust boundary impact
6+
7+
<!--
8+
Explain how this change preserves collect's core invariants:
9+
- Local durability: records and media commit to IndexedDB before showing 'Saved on this device'.
10+
- Receipts: SYNCED is only set on verified server finalization receipt.
11+
- Immutability: published schema versions and finalized evidence are not mutated.
12+
- Security & RLS: server-side authorization remains the source of truth.
13+
-->
14+
15+
## Verification
16+
17+
<!--
18+
List verification performed:
19+
- [ ] npm run check (formatting, doc links, unit/a11y tests, typecheck, build)
20+
- [ ] deno check supabase/functions/**/*.ts
21+
- [ ] git diff --check
22+
- [ ] Added failure-oriented or behavioral tests for new logic
23+
- [ ] Verified at a mobile viewport (touch targets, keyboard-aware layout, accessibility)
24+
-->
25+
26+
## Documentation
27+
28+
<!--
29+
List updated documentation (spec, architecture, flows, deployment, export format, etc.):
30+
-->

‎CITATION.cff‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
cff-version: 1.2.0
2+
message: "If you use this software, please cite it using the metadata from this file."
3+
title: "Collect"
4+
type: software
5+
authors:
6+
- family-names: Pizzi
7+
given-names: Gabriele
8+
repository-code: "https://github.com/gbrlpzz/collect"
9+
url: "https://collect.gbrlpzz.com/"
10+
license: Apache-2.0
11+
version: 0.1.2
12+
date-released: "2026-08-15"
13+
abstract: "Offline-first field data collection web application for trustworthy research evidence."
14+
keywords:
15+
- "field-data"
16+
- "data-collection"
17+
- "offline-first"
18+
- "pwa"
19+
- "research-software"
20+
- "open-science"
21+
- "fair-data"
22+
- "geospatial"

‎CODE_OF_CONDUCT.md‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our Pledge
4+
5+
We as members, contributors, and leaders pledge to make participation in our
6+
community a harassment-free experience for everyone, regardless of age, body
7+
size, visible or invisible disability, ethnicity, sex characteristics, gender
8+
identity and expression, level of experience, education, socio-economic status,
9+
nationality, personal appearance, race, caste, color, religion, or sexual
10+
identity and orientation.
11+
12+
We pledge to act and interact in ways that contribute to an open, welcoming,
13+
diverse, inclusive, and healthy community.
14+
15+
## Our Standards
16+
17+
Examples of behavior that contributes to a positive environment for our
18+
community include:
19+
20+
- Demonstrating empathy and kindness toward other people
21+
- Being respectful of differing opinions, viewpoints, and experiences
22+
- Giving and gracefully accepting constructive feedback
23+
- Accepting responsibility and apologizing to those affected by our mistakes,
24+
and learning from the experience
25+
- Focusing on what is best not just for us as individuals, but for the overall
26+
community
27+
28+
Examples of unacceptable behavior include:
29+
30+
- The use of sexualized language or imagery, and sexual attention or advances of
31+
any kind
32+
- Trolling, insulting or derogatory comments, and personal or political attacks
33+
- Public or private harassment
34+
- Publishing others' private information, such as a physical or email address,
35+
without their explicit permission
36+
- Other conduct which could reasonably be considered inappropriate in a
37+
professional setting
38+
39+
## Enforcement Responsibilities
40+
41+
The project maintainer, Gabriele Pizzi, is responsible for clarifying and
42+
enforcing our standards of acceptable behavior and will take appropriate and
43+
fair corrective action in response to any behavior that they deem inappropriate,
44+
threatening, offensive, or harmful.
45+
46+
The project maintainer has the right and responsibility to remove, edit, or
47+
reject comments, commits, code, wiki edits, issues, and other contributions that
48+
are not aligned to this Code of Conduct, and will communicate reasons for
49+
moderation decisions when appropriate.
50+
51+
## Scope
52+
53+
This Code of Conduct applies within all project spaces, and also applies when an
54+
individual is officially representing the project in public spaces. Examples of
55+
representing the project include using an official project email address,
56+
posting via an official social media account, or acting as an appointed
57+
representative at an online or offline event.
58+
59+
## Enforcement
60+
61+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
62+
reported to the project maintainer, Gabriele Pizzi, through GitHub
63+
([@gbrlpzz](https://github.com/gbrlpzz)) or via maintainer contact at
64+
[https://gabrielepizzi.com](https://gabrielepizzi.com). All complaints will be
65+
reviewed and investigated promptly and fairly.
66+
67+
The project maintainer is obligated to respect the privacy and security of the
68+
reporter of any incident.
69+
70+
## Enforcement Guidelines
71+
72+
The project maintainer will follow these Community Impact Guidelines in
73+
determining the consequences for any action they deem in violation of this Code
74+
of Conduct:
75+
76+
### 1. Correction
77+
78+
**Community Impact:** Use of inappropriate language or other behavior deemed
79+
unprofessional or unwelcome in the community.
80+
81+
**Consequence:** A private, written warning from the project maintainer,
82+
providing clarity around the nature of the violation and an explanation of why
83+
the behavior was inappropriate. A public apology may be requested.
84+
85+
### 2. Warning
86+
87+
**Community Impact:** A violation through a single incident or series of
88+
actions.
89+
90+
**Consequence:** A warning with consequences for continued behavior. No
91+
interaction with the people involved, including unsolicited interaction with
92+
those enforcing the Code of Conduct, for a specified period of time. This
93+
includes avoiding interactions in community spaces as well as external channels
94+
like social media. Violating these terms may lead to a temporary or permanent
95+
ban.
96+
97+
### 3. Temporary Ban
98+
99+
**Community Impact:** A serious violation of community standards, including
100+
sustained inappropriate behavior.
101+
102+
**Consequence:** A temporary ban from any sort of interaction or public
103+
communication with the community for a specified period of time. No public or
104+
private interaction with the people involved, including unsolicited interaction
105+
with those enforcing the Code of Conduct, is allowed during this period.
106+
Violating these terms may lead to a permanent ban.
107+
108+
### 4. Permanent Ban
109+
110+
**Community Impact:** Demonstrating a pattern of violation of community
111+
standards, including sustained inappropriate behavior, harassment of an
112+
individual, or aggression toward or disparagement of classes of individuals.
113+
114+
**Consequence:** A permanent ban from any sort of public interaction within the
115+
project community.
116+
117+
## Attribution
118+
119+
This Code of Conduct is adapted from the [Contributor Covenant][homepage],
120+
version 2.1, available at
121+
[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
122+
123+
Community Impact Guidelines were inspired by
124+
[Mozilla's code of conduct enforcement ladder][mozilla-coc].
125+
126+
[homepage]: https://www.contributor-covenant.org
127+
[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
128+
[mozilla-coc]: https://github.com/mozilla/diversity

‎CONTRIBUTING.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,10 @@ Read:
1010
2. [Architecture](docs/architecture.md)
1111
3. [Product specification](docs/spec.md)
1212
4. [Agent guidance](AGENTS.md)
13-
5. The document for the subsystem you plan to change
13+
5. [Code of Conduct](CODE_OF_CONDUCT.md)
14+
6. The document for the subsystem you plan to change
15+
16+
For security vulnerabilities, see the [Security policy](SECURITY.md). Do not report vulnerabilities in public issues or pull requests.
1417

1518
Open an issue or draft pull request early for changes to the synchronization protocol, database model, export format, consent model, or schema compatibility.
1619

‎README.md‎

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ React and TypeScript. It stores data locally in IndexedDB and uses a Supabase
1313
backend (PostgreSQL, storage, and Edge Functions). The project is licensed
1414
under Apache-2.0.
1515

16+
[Live Demo](https://collect.gbrlpzz.com/) · [Documentation](docs/README.md) · [Contributing](CONTRIBUTING.md) · [Security](SECURITY.md) · [Code of Conduct](CODE_OF_CONDUCT.md) · [Citation](#citation) · [License](LICENSE)
17+
1618
## Why it exists
1719

1820
Field surveys must keep working without connectivity, and the data they
@@ -210,9 +212,27 @@ Start with the [documentation index](docs/README.md). Core guides:
210212

211213
## Contributing
212214

213-
Read [CONTRIBUTING.md](CONTRIBUTING.md) and `AGENTS.md` before making changes.
214-
Changes to persistence, synchronization, authorization, schema versioning, or
215-
exports must include failure-oriented tests and pass `npm run check`.
215+
Read [CONTRIBUTING.md](CONTRIBUTING.md), [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md),
216+
and `AGENTS.md` before making changes. For vulnerability reporting, see
217+
[SECURITY.md](SECURITY.md). Changes to persistence, synchronization,
218+
authorization, schema versioning, or exports must include failure-oriented tests
219+
and pass `npm run check`.
220+
221+
## Citation
222+
223+
If you use `collect` in research, fieldwork, or scientific publications, please
224+
cite the software using the metadata in [CITATION.cff](CITATION.cff):
225+
226+
```bibtex
227+
@software{Pizzi_Collect_2026,
228+
author = {Pizzi, Gabriele},
229+
title = {{Collect: Offline-first field data collection for trustworthy research evidence}},
230+
url = {https://collect.gbrlpzz.com/},
231+
version = {0.1.2},
232+
year = {2026},
233+
license = {Apache-2.0}
234+
}
235+
```
216236

217237
## License
218238

0 commit comments

Comments
 (0)