ci + docs: test gate on PRs, TestFlight install, landing page, contributor on-ramp

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+# GitHub's funding config only accepts URLs, not raw wallet addresses, so the
+# "Sponsor" button points at DONATE.md where the BTC/EVM addresses live.
+custom:
+  - https://github.com/OpenStrap/edge/blob/main/DONATE.md

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,94 @@
+name: Bug report
+description: Something in the app is broken or wrong
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting. A couple of things make bugs much faster to fix:
+        the app version, and whether the number is *wrong* or *missing* — those
+        are usually different causes.
+
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened?
+      description: What you saw, and what you expected instead.
+      placeholder: |
+        Readiness showed "—" all morning even though the band synced overnight.
+        I expected a score by the time I woke up.
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: If you can. "It just happens every morning" is a valid answer.
+      placeholder: |
+        1. Wear the band overnight
+        2. Open the app in the morning
+        3. Today screen shows "—"
+    validations:
+      required: false
+
+  - type: input
+    id: version
+    attributes:
+      label: App version
+      description: Profile → scroll to the bottom, or the release you installed.
+      placeholder: "0.9.20"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform
+      options:
+        - iOS (TestFlight)
+        - iOS (sideloaded IPA)
+        - Android (APK)
+    validations:
+      required: true
+
+  - type: input
+    id: device
+    attributes:
+      label: Phone model and OS version
+      placeholder: "Pixel 8, Android 15 / iPhone 15 Pro, iOS 18.5"
+    validations:
+      required: false
+
+  - type: dropdown
+    id: band
+    attributes:
+      label: Which band?
+      options:
+        - WHOOP 4.0
+        - WHOOP 5.0 / MG (experimental — expect breakage)
+        - Not sure
+    validations:
+      required: true
+
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots
+      description: >-
+        Very helpful for anything visual. Note this issue is PUBLIC and stays
+        public — please redact health data, dates, names, and any device or
+        account identifiers before uploading. Blurring the numbers is fine;
+        we usually only need the layout and the state of the screen.
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Quick checks
+      options:
+        - label: The official WHOOP app is not also connected to this band
+          required: false
+        - label: I've searched existing issues for this
+          required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,31 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Protocol / byte-level finding
+    url: https://github.com/OpenStrap/protocol/issues/new
+    about: >-
+      A new record type, opcode, event, or a field we decode wrongly. Those live
+      in the protocol repo, not here.
+
+  - name: A new metric, or how one is computed
+    url: https://github.com/OpenStrap/analytics/issues/new
+    about: >-
+      The math lives in the analytics repo. Open it there if you're proposing a
+      method rather than reporting an app bug.
+
+  - name: Questions and general discussion
+    url: https://github.com/OpenStrap/edge/discussions
+    about: >-
+      Not sure whether something's a bug? Want to ask how a metric works, or
+      show what you built? Start here.
+
+  - name: Installing on iOS
+    url: https://github.com/OpenStrap/edge/blob/main/guides/IOS_SIDELOAD.md
+    about: >-
+      Install trouble is usually covered by the guide — TestFlight is the easy
+      path now.
+
+  - name: Report a security vulnerability (private)
+    url: https://github.com/OpenStrap/edge/security/advisories/new
+    about: >-
+      Please don't open a public issue for a security problem — this reports it
+      privately instead. See SECURITY.md for what's in scope.

.github/ISSUE_TEMPLATE/wrong_number.yml

@@ -0,0 +1,85 @@
+name: A metric looks wrong
+description: A number is displayed, but you think it's incorrect
+labels: ["analytics", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Worth saying up front, so nobody wastes time: **OpenStrap's numbers are
+        not meant to match WHOOP's.** Different algorithms, published methods,
+        computed from a reverse-engineered byte stream. "It doesn't match the
+        WHOOP app" on its own isn't a bug.
+
+        What *is* a bug: a number that's physiologically implausible, one that
+        contradicts the app's own raw data, one that jumps around without
+        cause, or one that's confidently wrong when the underlying data is
+        clearly missing.
+
+  - type: input
+    id: metric
+    attributes:
+      label: Which metric?
+      placeholder: "Readiness / RHR / Sleep stages / Strain / Steps / …"
+    validations:
+      required: true
+
+  - type: textarea
+    id: shown
+    attributes:
+      label: What it showed, and why you think it's wrong
+      description: >-
+        Include the value, the day, and what you'd have expected. If another
+        screen in the app disagrees with it, that's a strong signal — say so.
+      placeholder: |
+        Readiness 100 after about 10 minutes of wear. There's no overnight data
+        yet, so it shouldn't be able to produce a confident score at all.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: kind
+    attributes:
+      label: What kind of wrong?
+      options:
+        - Physiologically implausible (impossible value)
+        - Contradicts other screens in this app
+        - Confident number where the data is missing (should show "—")
+        - Shows "—" where there clearly is data
+        - Jumps or changes without new data
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: App version
+      placeholder: "0.9.20"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: band
+    attributes:
+      label: Which band?
+      description: >-
+        Matters more than it looks — WHOOP 5.0 / MG feeds a thinner record than
+        4.0 does, so a metric can be wrong on one and fine on the other.
+      options:
+        - WHOOP 4.0
+        - WHOOP 5.0 / MG (experimental — expect breakage)
+        - Not sure
+    validations:
+      required: true
+
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots
+      description: >-
+        The metric screen plus its trend view is ideal. This issue is PUBLIC and
+        stays public — redact health values, dates, names, and any device or
+        account identifiers first. The shape of a chart is usually enough; we
+        don't need your actual numbers to debug this.
+    validations:
+      required: false

.github/workflows/test.yml

@@ -0,0 +1,67 @@
+name: test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: test-${{ github.ref }}
+  cancel-in-progress: true
+
+# Read-only: this job only builds and tests. Nothing here needs write access,
+# and it executes code from pull requests.
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Don't leave GITHUB_TOKEN in .git/config where PR-authored test code
+          # could read it. Nothing in this job pushes back to the repo.
+          persist-credentials: false
+
+      # PINNED, not `channel: stable`. Two reasons, both found the hard way when
+      # this workflow first ran:
+      #
+      #  1. The repo does NOT currently build on Flutter 3.44.x. phosphor_flutter
+      #     2.1.0 extends IconData, which became a `final class` in 3.44, so
+      #     every widget test fails to compile:
+      #       "The class 'IconData' can't be extended outside of its library
+      #        because it's a final class."
+      #     Upgrading past 3.41.x needs phosphor_flutter bumped or dropped first.
+      #  2. CupertinoPageTransitionsBuilder moved between cupertino.dart and
+      #     material.dart across those versions, so theme.dart's imports are
+      #     version-sensitive too.
+      #
+      # A floating channel means the toolchain changes underneath an already
+      # reviewed commit — the same reasoning as the commit-SHA pins for sibling
+      # packages in pubspec.yaml. Bump this deliberately, with the phosphor
+      # dependency sorted out in the same change.
+      - uses: subosito/flutter-action@v2
+        with:
+          flutter-version: 3.41.6
+          channel: stable
+          cache: true
+
+      # Sibling packages resolve from their pinned commit SHAs in pubspec.yaml.
+      # There is no pubspec_overrides.yaml here — that file is gitignored and
+      # local-dev only — so CI tests exactly the pins a release would ship.
+      - name: Install dependencies
+        run: flutter pub get
+
+      - name: Analyze
+        run: flutter analyze
+
+      # --concurrency=1: the suite uses sqflite_common_ffi against real database
+      # files, and parallel workers race on them.
+      #
+      # The golden capture (whoop_hist.jsonl) is a real band recording kept
+      # beside the repo rather than committed to it, so the two derivation-replay
+      # tests SKIP here and run locally.
+      - name: Test
+        run: flutter test --concurrency=1 --reporter=expanded