Prepare Shabbat 3.0.0-dev.9 with verified runtime, CI and migration guides

.dockerignore

@@ -0,0 +1,25 @@
+.git
+vendor
+data
+runtime
+dist
+.phpunit.cache
+.phpstan.cache
+.env
+.env.*
+!.env.example
+*.madeline*
+bot.shabbat*
+*.sqlite*
+*.db*
+*.log
+backups
+.work
+shabbat-*.zip
+SHA256SUMS*
+coverage
+.cache
+artifacts
+checks
+release-manifest*.json
+publication-manifest*.json

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 4
+trim_trailing_whitespace = true
+
+[*.{json,yml,yaml}]
+indent_size = 2

.env.example

@@ -1,4 +1,14 @@
-API_ID=your_api_id
-API_HASH=your_api_hash
-BOT_TOKEN=your_bot_token
-ADMIN=your_username_or_id
+API_ID=123456
+API_HASH=replace_with_32_hex_characters
+BOT_TOKEN=replace_with_BotFather_token
+ADMIN=123456789
+APP_DB_PATH=data/shabbat.sqlite
+SESSION_PATH=data/session/bot.shabbat
+DATA_DIR=data
+LEGACY_DATA_PATH=.
+HEARTBEAT_PATH=data/scheduler-heartbeat.json
+GEONAMES_USERNAME=
+GEONAMES_ENDPOINT=https://secure.geonames.org
+SOURCE_URL=
+
+CUSTOM_EMOJI_ENABLED=1

.gitattributes

@@ -0,0 +1,22 @@
+* text=auto
+*.php text eol=lf
+*.json text eol=lf
+*.md text eol=lf
+*.sh text eol=lf
+*.yml text eol=lf
+*.patch text eol=lf
+*.diff text eol=lf
+Dockerfile text eol=lf
+*.sql text eol=lf
+
+# Preserve exact reviewed upstream, diff, and manifest bytes across clones.
+patches/** -text
+patches/**/baseline/** whitespace=-blank-at-eol,-blank-at-eof,-space-before-tab,cr-at-eol
+
+# Distributed publisher license text hashes must remain stable too.
+LICENSES/** -text
+
+# Database checksums and bundled licensed/provider text use the original bytes.
+migrations/** -text
+resources/templates/** -text
+tests/Fixtures/** -text

.github/CODE_OF_CONDUCT.md

@@ -1,39 +1,39 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
-
-## Our Standards
-
-Examples of behavior that contributes to a positive environment for our community include:
-- Using welcoming and inclusive language
-- Being respectful of differing viewpoints and experiences
-- Gracefully accepting constructive criticism
-- Showing empathy towards other community members
-
-Examples of unacceptable behavior include:
-- The use of sexualized language or imagery and unwelcome sexual attention or advances
-- Trolling, insulting or derogatory comments, and personal or political attacks
-- Public or private harassment
-- Publishing others’ private information, such as a physical or electronic address, without explicit permission
-
-## Our Responsibilities
-
-Project maintainers are responsible for clarifying the standards of acceptable behavior and will take appropriate and fair corrective action in response to any instances of unacceptable behavior.
-
-## Scope
-
-This Code of Conduct applies within all project spaces and in public spaces when an individual is representing the project or its community.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at [@WizardLoop on Telegram](https://t.me/WizardLoop) or contact@wizardloop.com.
-
-All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.1, available at https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
-
-[homepage]: https://www.contributor-covenant.org
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our community include:
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experiences
+- Gracefully accepting constructive criticism
+- Showing empathy towards other community members
+
+Examples of unacceptable behavior include:
+- The use of sexualized language or imagery and unwelcome sexual attention or advances
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others’ private information, such as a physical or electronic address, without explicit permission
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable behavior and will take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+
+## Scope
+
+This Code of Conduct applies within all project spaces and in public spaces when an individual is representing the project or its community.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at [@WizardLoop on Telegram](https://t.me/WizardLoop) or contact@wizardloop.com.
+
+All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.1, available at https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+
+[homepage]: https://www.contributor-covenant.org

.github/CONTRIBUTING.md

@@ -1,19 +1,15 @@
 # Contributing to WizardLoop Shabbat
 
-Thank you for your interest!
+Work on a separate branch and preserve the existing MadelineProto bot identity and session. Use the issue templates for reports; never include tokens, API credentials, session files, real databases or private group/user lists.
 
-## How to Contribute
+Install the real Composer lock, then run `composer validate --strict --no-check-all`, `composer check-platform-reqs`, `composer lint`, `composer style`, `composer test`, `composer analyse`, `composer check-locales`, `composer check-docs`, `composer dependencies` and `composer self-check`. PSR-12 errors are mandatory for new services/scripts/tests; `composer style-review` also reports advisory line-length warnings. The original legacy handler layout is retained during incremental migration.
 
-- **Bug Reports**: Use the issue template (Bug Report) and provide details and steps to reproduce.
-- **Feature Requests**: Suggest features with as much detail as possible.
-- **Pull Requests**: Fork the repo, create a branch, submit a PR. Please describe the change, link to issues if relevant, and follow PSR-12 code style.
+Tests use isolated SQLite, injected clocks, fake Telegram and provider fixtures. Live tests are explicitly opt-in in a separate staging bot/group. Do not run production migrations, broadcast to real subscribers, or publish releases as part of tests. Review dependency scripts/plugins and patch provenance before updating the lock. Unknown or partial MadelineProto patch sources must fail verification.
 
-## Guidelines
+Translations must include every key and identical placeholders in all six catalogs: he, en, ru, fr, es and pt-br. Command/callback IDs remain stable across languages. Every sensitive group write must recheck current admin authority and consume a user/group/revision-bound token.
 
-- Follow [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)
-- Ensure your code is tested.
-- Use clear commit messages.
+Follow [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md). Explain the problem, resulting behavior, actual validation and remaining limits in a pull request. Preserve SPDX and third-party attribution, including historical MIT grants. Corresponding source for deployed changes must match the actual build.
 
----
+Existing project contact: [@WizardLoop on Telegram](https://t.me/WizardLoop).
 
-Questions? Contact [@WizardLoop on Telegram](https://t.me/WizardLoop)
+Composer validation uses --strict --no-check-all because MadelineProto is intentionally pinned to the exact reviewed source version. This retains schema and lock validation; only generic version-range recommendations are omitted.

.github/FUNDING.yml

@@ -1,2 +1,2 @@
-github: ['WizardLoop']
-custom: ['https://WizardLoop.t.me']
+github: ['WizardLoop']
+custom: ['https://WizardLoop.t.me']

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,34 +1,39 @@
-name: "🐞 Bug report"
-description: "Report a reproducible bug"
-labels: [bug]
-body:
+name: "🐞 Bug report"
+description: "Report a reproducible bug"
+labels: [bug]
+body:
+  - type: textarea
+    attributes:
+      label: "Describe the bug"
+      description: "A clear and concise description of what the bug is."
+      placeholder: "Bug description"
+  - type: textarea
+    attributes:
+      label: "Steps to Reproduce"
+      description: "What steps did you take that led to the bug?"
+      placeholder: "1. Go to ...\n2. Click ...\n3. See error"
+  - type: textarea
+    attributes:
+      label: "Expected behavior"
+      description: "What did you expect to happen?"
+      placeholder: "Expected behavior"
+  - type: textarea
+    attributes:
+      label: "Screenshots/Logs"
+      description: "Use synthetic examples and redact tokens, sessions, private group/user IDs, payment data and live databases."
+  - type: input
+    attributes:
+      label: "Bot Version / Commit"
+      description: "What version or commit are you using?"
+  - type: dropdown
+    attributes:
+      label: "Environment"
+      options:
+        - Self-hosted Linux
+        - Windows
+        - Other
+
   - type: textarea
     attributes:
-      label: "Describe the bug"
-      description: "A clear and concise description of what the bug is."
-      placeholder: "Bug description"
-  - type: textarea
-    attributes:
-      label: "Steps to Reproduce"
-      description: "What steps did you take that led to the bug?"
-      placeholder: "1. Go to ...\n2. Click ...\n3. See error"
-  - type: textarea
-    attributes:
-      label: "Expected behavior"
-      description: "What did you expect to happen?"
-      placeholder: "Expected behavior"
-  - type: textarea
-    attributes:
-      label: "Screenshots/Logs"
-      description: "Add any screenshots or logs to help explain your problem."
-  - type: input
-    attributes:
-      label: "Bot Version / Commit"
-      description: "What version or commit are you using?"
-  - type: dropdown
-    attributes:
-      label: "Environment"
-      options:
-        - Self-hosted Linux
-        - Windows
-        - Other
+      label: "Runtime and verification"
+      description: "PHP version, SQLite loaded by PHP, patch verification, failing offline test and whether this is isolated staging. Do not attach secrets."

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security report
+    url: https://t.me/WizardLoop
+    about: Report vulnerabilities privately to the existing WizardLoop contact; redact credentials and private data.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,18 +1,18 @@
-name: "✨ Feature request"
-description: "Suggest an idea or improvement"
-labels: [enhancement]
-body:
-  - type: textarea
-    attributes:
-      label: "Feature description"
-      description: "What would you like to see added?"
-      placeholder: "Feature details"
-  - type: textarea
-    attributes:
-      label: "Use case"
-      description: "Describe a real scenario where this feature would help."
-      placeholder: "Use case"
-  - type: textarea
-    attributes:
-      label: "Additional context"
-      description: "Anything else?"
+name: "✨ Feature request"
+description: "Suggest an idea or improvement"
+labels: [enhancement]
+body:
+  - type: textarea
+    attributes:
+      label: "Feature description"
+      description: "What would you like to see added?"
+      placeholder: "Feature details"
+  - type: textarea
+    attributes:
+      label: "Use case"
+      description: "Describe a real scenario where this feature would help."
+      placeholder: "Use case"
+  - type: textarea
+    attributes:
+      label: "Additional context"
+      description: "Anything else?"

.github/ISSUE_TEMPLATE/improvement_question.yml

@@ -1,14 +1,14 @@
-name: "❓ Improvement / Question"
-description: "Suggest an improvement or ask a question"
-labels: [question]
-body:
-  - type: textarea
-    attributes:
-      label: "Improvement or Question"
-      description: "Describe your suggestion or question."
-      placeholder: "Your suggestion/question"
-  - type: textarea
-    attributes:
-      label: "Context"
-      description: "Where in the project do you want to see this?"
-      placeholder: "Relevant files, code, or context"
+name: "❓ Improvement / Question"
+description: "Suggest an improvement or ask a question"
+labels: [question]
+body:
+  - type: textarea
+    attributes:
+      label: "Improvement or Question"
+      description: "Describe your suggestion or question."
+      placeholder: "Your suggestion/question"
+  - type: textarea
+    attributes:
+      label: "Context"
+      description: "Where in the project do you want to see this?"
+      placeholder: "Relevant files, code, or context"

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,21 +1,16 @@
-# Pull Request
+## Problem and resulting behavior
 
-## What does this PR do?
+<!-- Describe the trigger and the behavior a reviewer will observe. -->
 
-- [ ] Bug fix
-- [ ] Feature
-- [ ] Code style/Refactoring
-- [ ] Documentation
+## Validation
 
-## Description
+<!-- Record actual checks, fixture coverage and live staging limits. Do not include secrets or private data. -->
 
-<!-- Please describe your change in detail -->
+- [ ] Composer lock, patch hashes and dependencies verified
+- [ ] Lint, mandatory style, tests and static analysis pass
+- [ ] Six locale catalogs and local documentation links pass
+- [ ] Migration/backup/recovery implications documented when applicable
+- [ ] Third-party notices and corresponding-source inputs preserved
+- [ ] No production data, session or credentials included
 
-## Checklist
-
-- [ ] Code builds and passes tests
-- [ ] PR follows project guidelines
-
----
-
-Related Issues: #
+Related issue:

.github/SECURITY.md

@@ -1,10 +1,16 @@
-# Security Policy
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you find a security issue, **do not open an issue on GitHub**.  
+Please report privately to [@WizardLoop on Telegram](https://t.me/WizardLoop) or via email: contact@wizardloop.com
+
+---
+
+We will address all reports promptly and responsibly.
 
-## Reporting a Vulnerability
+## Safe reproduction information
 
-If you find a security issue, **do not open an issue on GitHub**.  
-Please report privately to [@WizardLoop on Telegram](https://t.me/WizardLoop) or via email: contact@wizardloop.com
+Include the affected build version/commit, PHP-loaded SQLite version and a minimal synthetic reproduction. Redact bot tokens, API credentials, GeoNames account details, session files, private user/group identifiers, payment payloads/charges and real database/backups. Use a staging bot or the offline fixture tests; do not send test messages to real groups.
 
----
-
-We will address all reports promptly and responsibly.
+Dependency advisory checks and license/source review are separate. Report unknown patch hashes or partial vendor changes; do not bypass verification or edit a running container. The 3.0.0-dev snapshot is not a stable release. See [acceptance status](../docs/IMPLEMENTATION_STATUS.md) for checks not yet performed.