docs: add issue and PR labels guide (closes #185)

CONTRIBUTING.md

@@ -1,79 +1,45 @@
-# Contributing
-
-Thanks for helping make DepRadar better. Start with an open issue labelled
-`good first issue` or `help wanted`, comment that you're picking it up, and
-open a PR that references it.
-
-## Development Setup
-
-Prerequisites: a stable Rust toolchain, the `wasm32v1-none` target (for the
-contract), and Node.js 22+ (for `client/`).
-
-```bash
-rustup target add wasm32v1-none
-
-# Off-chain toolkit + contract unit tests
-cargo test --workspace --locked
-
-# Lints — CI runs both and fails on any warning
-cargo fmt --all -- --check
-cargo clippy --workspace --all-targets --locked -- -D warnings
-
-# Build the contract to wasm
-cargo build -p deprader-router --target wasm32v1-none --release --locked
-
-# Try the typosquat scanner
-cargo run --bin scan -- expresss
-
-# Testnet read client
-cd client && npm ci && npm run typecheck && npm start
-
-# Web dashboard (http://localhost:5173)
-cd frontend && npm ci && npm run dev
-npm run lint && npm run typecheck && npm test && npm run build
-```
-
-Frontend conventions (contract access only through `lib/contract.ts`,
-loading/error/empty states everywhere, CSS tokens only) are in
-[frontend/README.md](frontend/README.md).
-
-Some tests in `src/cve/` call the live [OSV API](https://osv.dev); they skip
-(rather than fail) when the network is unavailable.
-
-## Pull Requests
-
-- One issue per PR where possible, with `Closes #N` in the description.
-- Keep CI green: fmt, clippy, tests, the wasm build, and the client
-  typecheck all run on every PR.
-- If you change `contracts/`, commit the regenerated files under
-  `contracts/deprader_router/test_snapshots/`.
-- Security-sensitive findings go through [SECURITY.md](SECURITY.md), not
-  public issues.
-
-## Closing Issues
-
-No issue is closed without an entry in [PROGRESS.md](PROGRESS.md)
-describing what was built, by whom, and which issue it closes. This is
-called out explicitly in the Definition of Done on the issue templates
-(`.github/ISSUE_TEMPLATE/`), but it applies to any issue, templated or not.
-
-## Testnet Identities
-
-Don't share or commit Stellar secret keys, including testnet ones. Generate
-your own local identity instead:
-
-```bash
-stellar keys generate <name> --network testnet --fund
-```
-
-This creates a keypair under your local Stellar CLI config (see
-`.gitignore` — `.stellar/`, `.soroban/`, and `**/identity/*.toml` are all
-excluded from the repo) and funds it via friendbot. Use `<name>` wherever
-these docs or scripts expect a `--source` or `--admin` identity.
-
-The current `deprader_router` testnet deployment
-(`CCPRQANY467KKE4ROKCNW6TH3LY3EPVFRXIXJ5V4VCYHLJKWZPOZYQJQ`) uses a fresh
-admin identity, replacing the one exposed by the original v1 deployment.
-Testnet funds have no real value, but don't reuse identities across
-testnet and mainnet — the contract supports `propose_admin` /
-`accept_admin` precisely so the admin can be rotated without a redeploy.
+# Contributing to DepRadar
+
+## Getting Started
+1. Fork the repository
+2. Clone: `git clone https://github.com/YOUR_USERNAME/DepRadar.git`
+3. Create a branch: `git checkout -b fix/your-feature`
+4. Make changes
+5. Run tests
+6. Commit: `git commit -m "fix: description"`
+7. Push and open a PR
+
+## PR Submission Checklist
+- [ ] Code passes all CI checks
+- [ ] Tests included for new functionality
+- [ ] Documentation updated
+- [ ] Commit messages follow conventional commits
+- [ ] PR description references the issue (`closes #N`)
+
+## PR Review Process
+### Review Criteria
+1. Correctness
+2. Test coverage
+3. Documentation
+4. Code quality
+5. Security
+6. Backward compatibility
+
+### Review Timeline
+- Initial review: 3-5 business days
+- Follow-up reviews: 2-3 business days
+
+### Addressing Feedback
+1. Read all comments carefully
+2. Make requested changes
+3. Push to same branch (do NOT close/reopen PR)
+4. Re-request review
+
+## Stellar Wave Bounty Process
+1. Find issues labeled `Stellar Wave` + `good first issue`
+2. Submit PR referencing the issue
+3. On merge, bounty is paid via Soroban escrow + Drips
+4. Add your wallet to PR description
+
+## Questions?
+Open an issue with the `documentation` label.

docs/labels-guide.md

@@ -0,0 +1,54 @@
+# Issue and PR Labels Guide
+
+## Issue Labels
+
+### Difficulty
+| Label | Description |
+|-------|-------------|
+| `good first issue` | Beginner-friendly task, suitable for new contributors |
+| `Stellar Wave` | Funded bounty task — payout on merge via Soroban escrow |
+
+### Area
+| Label | Description |
+|-------|-------------|
+| `frontend` | Web frontend (React/TypeScript) |
+| `contract` | Soroban smart contract (Rust) |
+| `cli` | Command-line interface |
+| `scanner` | Package scanning engine |
+| `cve` | CVE database integration |
+| `typosquat` | Typosquatting detection |
+| `docs` | Documentation |
+| `ci` | Continuous integration |
+| `testing` | Test coverage |
+| `design` | UI/UX design |
+
+### Type
+| Label | Description |
+|-------|-------------|
+| `enhancement` | New feature or improvement |
+| `bug` | Something is broken |
+| `documentation` | Documentation improvement |
+| `security` | Security-related change |
+| `performance` | Performance improvement |
+
+## PR Labels
+
+PRs inherit labels from the issues they resolve. Additionally:
+
+| Label | Description |
+|-------|-------------|
+| `needs-review` | Awaiting maintainer review |
+| `approved` | Approved by maintainer |
+| `changes-requested` | Changes requested by reviewer |
+
+## Workflow
+
+1. Find an issue with `good first issue` + `Stellar Wave` labels
+2. Fork the repo, create a branch, make changes
+3. Open a PR referencing the issue (`closes #N`)
+4. Address review feedback
+5. On merge — bounty is paid via Soroban escrow + Drips
+
+## Questions?
+
+Open an issue with the `documentation` label.