Harden repository for production maintenance

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @BTheCoderr

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,40 @@
+---
+name: Bug report
+about: Report a reproducible DeenNotes problem
+title: "[Bug] "
+labels: bug
+assignees: ""
+---
+
+## What happened?
+
+## What did you expect?
+
+## Where did it happen?
+
+- [ ] iPhone/iPad app
+- [ ] Web companion
+- [ ] Authentication
+- [ ] Reflect / AI
+- [ ] Quran / audio
+- [ ] Prayer / Salah Planner / Qibla
+- [ ] Premium / purchases
+- [ ] Other
+
+## Steps to reproduce
+
+1.
+2.
+3.
+
+## Device / version
+
+- DeenNotes version:
+- iOS / browser:
+- Device:
+
+## Evidence
+
+Screenshots, screen recordings, console output, or error text are helpful.
+
+> Do not post passwords, API keys, Supabase tokens, private notes, or other sensitive account data.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,23 @@
+---
+name: Feature request
+about: Suggest a product or engineering improvement
+title: "[Feature] "
+labels: enhancement
+assignees: ""
+---
+
+## Problem
+
+What user problem or workflow should improve?
+
+## Proposed experience
+
+What should happen from the user's point of view?
+
+## Why it belongs in DeenNotes
+
+How does this support reflection, Quran study, prayer planning, journaling, reminders, or related productivity?
+
+## Notes / constraints
+
+Include accessibility, privacy, subscription, device, or religious-scope considerations when relevant.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,30 @@
+## What changed
+
+<!-- Describe the product or engineering change. -->
+
+## Why
+
+<!-- What problem does this solve or what outcome does it improve? -->
+
+## Verification
+
+- [ ] Web typecheck passes
+- [ ] Tests pass
+- [ ] Mobile typecheck passes when mobile code changed
+- [ ] Production build passes when web/server code changed
+- [ ] No secrets, credentials, private keys, or real service-role values were committed
+- [ ] User-facing copy stays within DeenNotes' reflection/study scope and does not present AI output as a religious ruling
+
+## Product surfaces checked
+
+- [ ] Sign in / account
+- [ ] Reflect
+- [ ] Quran / audio
+- [ ] Prayer / Salah Planner / Qibla
+- [ ] Premium / restore purchases
+- [ ] Settings / account
+- [ ] Not applicable
+
+## Deployment
+
+<!-- A code merge and a production deployment are separate decisions. Do not assume this PR should deploy automatically. -->

.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+    commit-message:
+      prefix: deps
+
+  - package-ecosystem: npm
+    directory: /apps/mobile
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+    commit-message:
+      prefix: deps-mobile

.github/workflows/ci.yml

@@ -0,0 +1,85 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  web-quality:
+    name: Web quality
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Use Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: TypeScript
+        run: npm run typecheck
+
+      - name: Tests
+        run: npm test
+
+  mobile-quality:
+    name: Mobile quality
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Use Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Mobile TypeScript
+        run: npm run mobile:typecheck
+
+  web-build:
+    name: Web production build
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      NEXT_PUBLIC_SITE_URL: https://deennotesai.netlify.app
+      NEXT_PUBLIC_APP_STORE_URL: https://apps.apple.com/us/app/deennotes-ai/id6767057471
+      NEXT_PUBLIC_SUPABASE_URL: https://example.supabase.co
+      NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY: ci-placeholder-key
+      MOCK_QURAN_API: "true"
+      QURAN_GRACEFUL_MOCK_FALLBACK: "true"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Use Node.js 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build

CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+Notable DeenNotes AI changes are tracked here alongside the App Store release history.
+
+## [1.0.4] - Current production release
+
+### Product
+
+- Salah Planner improvements
+- beginner-friendly Learning Mode
+- Quran reading and audio experience improvements
+- prayer and reminder experience improvements
+- khutbah / reminder recording improvements
+- ongoing reliability and polish across the mobile experience
+
+### Platform
+
+- Expo / React Native mobile client
+- Supabase-backed authenticated account data with RLS
+- RevenueCat-backed iOS subscriptions
+- Next.js web companion and API
+- pluggable AI-provider architecture
+
+## Earlier releases
+
+Earlier production versions predate this repository changelog. Their exact historical notes should be sourced from the App Store release record rather than reconstructed from memory.
+
+## Changelog policy
+
+New production releases should add a dated entry before or alongside release work. Keep user-facing product changes separate from infrastructure/security changes where practical.

CODE_OF_CONDUCT.md

@@ -0,0 +1,17 @@
+# Code of Conduct
+
+DeenNotes contributors should keep technical discussion respectful, specific, and focused on the work.
+
+## Expected behavior
+
+- discuss code and product decisions without personal attacks
+- assume good faith while still reviewing critically
+- protect user privacy and never post sensitive account or journal data
+- respect the product's faith-sensitive context
+- distinguish personal religious opinions from product requirements
+
+## Unacceptable behavior
+
+Harassment, threats, discriminatory attacks, deliberate disclosure of private information, credential sharing, or attempts to use the project to present AI output as authoritative religious rulings are not acceptable.
+
+Repository maintainers may remove content or participation that violates these expectations.

CONTRIBUTING.md

@@ -0,0 +1,40 @@
+# Contributing to DeenNotes AI
+
+DeenNotes AI is a shipped mobile product with an Expo/React Native client, a Next.js web companion/API, Supabase-backed accounts, RevenueCat subscriptions, Quran/audio features, prayer utilities, and AI-assisted reflection organization.
+
+## Product scope
+
+Contributions should support the product's role as a reflection, study, journaling, and productivity companion. AI-generated content must not be presented as a fatwa, authoritative religious ruling, or substitute for qualified scholarship.
+
+## Before opening a pull request
+
+1. Create a focused branch.
+2. Keep secrets out of tracked files. Use the documented environment-variable examples.
+3. Run:
+   ```bash
+   npm ci
+   npm run typecheck
+   npm test
+   npm run mobile:typecheck
+   ```
+4. If web/server behavior changed, also run:
+   ```bash
+   npm run build
+   ```
+5. Test the product surface you changed.
+
+## Pull requests
+
+Keep PRs small enough to review. Explain what changed, why it changed, and how it was verified. A merged code change does not automatically mean it should be deployed to production.
+
+## Security
+
+Do not open a public issue containing credentials, tokens, personal journal content, or a vulnerability that could expose user data. See [SECURITY.md](SECURITY.md).
+
+## Database changes
+
+Treat `supabase/migrations/` as the source of truth. Preserve RLS on account-owned data and avoid broad grants to public roles.
+
+## Mobile releases
+
+For App Store changes, follow the current mobile and release documentation under [docs/](docs/README.md). Versioned mobile configuration lives under `apps/mobile/`.

LICENSE

@@ -0,0 +1,7 @@
+Copyright (c) 2026 Baheem Ferrell
+
+All rights reserved.
+
+This source code is publicly viewable for portfolio, review, and collaboration purposes. No permission is granted to copy, modify, distribute, sublicense, sell, or create derivative works from this repository except with the copyright holder's prior written permission.
+
+Third-party dependencies and assets remain subject to their own licenses and terms.

README.md

@@ -1,5 +1,19 @@
 # DeenNotes AI
 
+<p>
+  <img src="apps/mobile/assets/icon.png" alt="DeenNotes AI app icon" width="96" />
+</p>
+
+[![CI](https://github.com/BTheCoderr/DeenNotesAI/actions/workflows/ci.yml/badge.svg)](https://github.com/BTheCoderr/DeenNotesAI/actions/workflows/ci.yml)
+![App Store](https://img.shields.io/badge/App%20Store-Live-000000?logo=apple)
+![iOS](https://img.shields.io/badge/iOS-1.0.4-000000?logo=apple)
+![Expo](https://img.shields.io/badge/Expo-54-000020?logo=expo)
+![React Native](https://img.shields.io/badge/React%20Native-0.81-61DAFB?logo=react)
+![TypeScript](https://img.shields.io/badge/TypeScript-5.x-3178C6?logo=typescript&logoColor=white)
+
+**App Store:** https://apps.apple.com/us/app/deennotes-ai/id6767057471 · **Web companion:** https://deennotesai.netlify.app/
+
+
 <!-- repo-intro:start -->
 **Project snapshot:** DeenNotes AI is a shipped iPhone/iPad app for Islamic reflection, Quran study, prayer planning, journaling, reminders, and AI-assisted note organization. The product is intentionally scoped as a reflection and productivity companion—not a source of fatwas or religious rulings.
 
@@ -27,6 +41,33 @@
 5. Save account-owned reflections securely with Supabase Auth + RLS.
 6. Unlock premium features through RevenueCat-backed App Store subscriptions.
 
+## Architecture
+
+```text
+iPhone / iPad (React Native + Expo)
+              │
+              ├──────────────► RevenueCat ─────► App Store subscriptions
+              │
+              ▼
+        Next.js web/API
+          │     │     │
+          ▼     ▼     ▼
+      Supabase  AI   Quran services
+      Auth/DB   providers/content/audio
+       + RLS
+```
+
+See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) for the system boundaries and production responsibilities.
+
+## Repository guide
+
+- [CHANGELOG.md](CHANGELOG.md) — production release history
+- [ROADMAP.md](ROADMAP.md) — shipped, improving, and exploring
+- [docs/README.md](docs/README.md) — current vs. historical product documentation
+- [CONTRIBUTING.md](CONTRIBUTING.md) — development and review expectations
+- [SECURITY.md](SECURITY.md) — vulnerability and secret-handling policy
+- [.github/workflows/ci.yml](.github/workflows/ci.yml) — automated web/mobile verification
+
 ## Engineering highlights
 
 - React Native + Expo Router mobile app in `apps/mobile`
@@ -48,6 +89,19 @@ DeenNotes AI is mobile-first: the shipped React Native / Expo app is the primary
 
 Treat this repo as **safe to make public**: tracked files must not contain database passwords, Supabase **service_role** or **secret** keys, AI provider keys, JWTs, or real **Project Refs**. Clone [`.env.example`](.env.example) to **`.env.local`** (or `.env`), add your values only on your machine, and rely on **`.gitignore`** (`.env*` with an exception for `.env.example`). The Next.js app uses the **anon/publishable** client key with **RLS**; `SUPABASE_SERVICE_ROLE_KEY` is optional and **not** used by app routes—never prefix it with `NEXT_PUBLIC_`.
 
+## Repository quality gates
+
+Every pull request is set up to run GitHub CI for:
+
+- root TypeScript verification
+- Vitest tests
+- mobile TypeScript verification
+- a production-style Next.js build using safe CI placeholder configuration
+
+Dependency update PRs are managed by Dependabot. Pull requests and issues use repository templates, and CODEOWNERS routes changes to the maintainer.
+
+**Deployment is deliberately separate from CI.** A passing GitHub check or merged pull request is not treated as permission to publish a Netlify or App Store release.
+
 ## Production / release checklist
 
 For ongoing releases and maintenance:
@@ -219,3 +273,8 @@ From the repo you can also use **`npm run netlify:deploy:prod`** (see [Netlify C
 ## Product disclaimer
 
 DeenNotes is for organizing Islamic learning and personal reflection. It does not provide fatwas or religious rulings. Users should consult a qualified scholar or imam for religious decisions.
+
+## License
+
+Copyright © 2026 Baheem Ferrell. All rights reserved. This public repository is viewable for portfolio, review, and collaboration purposes; it is **not** released under an open-source license. See [LICENSE](LICENSE).
+