Consolidate community configuration and independent verified releases

.github/workflows/check.yml

@@ -1,10 +1,33 @@
 name: Check Food Help
 on:
   workflow_dispatch:
+  pull_request:
+  push:
+    branches: [main]
 permissions:
   contents: read
 jobs:
+  select:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.matrix.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .node-version
+      - id: matrix
+        env:
+          FOOD_HELP_CHECK_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+          FOOD_HELP_CHECK_HEAD: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: node scripts/select-checks.ts
   check:
+    needs: select
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.select.outputs.matrix) }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
@@ -15,11 +38,13 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npx playwright install --with-deps chromium firefox webkit
-      - run: npm run check
+      - run: npm run check -- --site "$FOOD_HELP_CHECK_SITE"
+        env:
+          FOOD_HELP_CHECK_SITE: ${{ matrix.site }}
       - uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: food-help-verification
+          name: food-help-verification-${{ strategy.job-index }}
           path: |
             playwright-report/
             artifacts/reports/

AGENTS.md

@@ -4,10 +4,10 @@ Inspection and planning are read-only until implementation is explicitly authori
 
 ## Authority
 
-- `site/site.json` defines this deployment; `site/resources.json` holds authoritative reviewed resource facts.
+- The selected `deployments/<community>/site.json` defines that deployment; its `resources.json` holds authoritative reviewed resource facts. `examples/exampleville/` is a fictional starter, not a real deployment.
 - `schemas/` plus shared semantic validation define the contract. `src/` is generic application behaviour.
 - `.generated/`, `artifacts/` and `dist/` are disposable output. Never maintain generated projections manually.
-- Read `site/AGENTS.md` for narrower deployment rules. Keep private review material outside public source.
+- Read the selected deployment's `AGENTS.md` for narrower rules. Independently configured `--site` folders may supply the same file. Keep private review material outside public source.
 
 Never fix a deployment-specific requirement by adding community-specific logic to generic platform code.
 
@@ -24,6 +24,7 @@ Never fix a deployment-specific requirement by adding community-specific logic t
 
 - Use locked, justified development dependencies and no runtime package dependencies. Review dependency changes.
 - Preserve keyboard access, readable contrast, native controls, print and no-JavaScript access.
-- Run `npm run check`. Worker changes require first visit, offline cold restart, update, failed install, rollback and stale-cache cleanup evidence.
+- Run `npm run check -- --site <folder>` for the affected deployment and `npm run check -- --all` for shared changes. Worker changes require first visit, offline cold restart, update, failed install, rollback and stale-cache cleanup evidence.
+- Keep shared development on `main`; releases explicitly select one community and exact source revision. Adding a folder or merging shared code must not publish communities automatically. Retain the previous complete artifact and source availability for per-community rollback.
 - Before consequential changes, report exact scope, visible/data/privacy/cache effects, tests and unresolved risks, artifact identity, and whether external publication would occur.
 - Do not infer external authorization from credentials, prior unrelated work or passing tests.

CONTRIBUTING.md

@@ -1,11 +1,13 @@
 # Contributing
 
-Read `AGENTS.md` and `site/AGENTS.md`. Changes to platform behaviour belong in generic source; community facts and choices belong in `site/`. Never solve a community requirement with a locality branch in application code.
+Read `AGENTS.md` and the selected `deployments/<community>/AGENTS.md`. Changes to platform behaviour belong in generic source; community facts and choices belong in that deployment folder. Never solve a community requirement with a locality branch in application code.
 
-Use the supported Node version, `npm ci`, and install Playwright browsers. Run `npm run check` before requesting review. Explain the problem, resulting behaviour, verification and any effects on public data, privacy, caches or deployment. Keep dependencies minimal; development-only tools still need a reason and a lockfile change.
+Use the supported Node version, `npm ci`, and install Playwright browsers. Run `npm run check -- --site deployments/<community>` for a local change or `npm run check -- --all` for shared software before requesting review. Explain the problem, resulting behaviour, verification and any effects on public data, privacy, caches or deployment. Keep dependencies minimal; development-only tools still need a reason and a lockfile change. Validation does not deploy; publishing selects one community and an exact source revision.
 
 Provider suggestions are review leads. Supply source links, what was checked and when, uncertainties and the proposed fact change. Do not submit private correspondence, personal contact details or credentials. A maintainer/operator must approve facts before publication. Automated checks never make that editorial decision.
 
 Test changes through the Exampleville and second-community fixtures. Worker changes require the full offline/update/rollback suite. New UI copy belongs in the copy pack. New categories or schema meanings require a version/migration decision, not an unannounced enum expansion in an operator file.
 
-Contributions use the applicable existing software/documentation licence; dataset contributions require a separately stated right to redistribute. Keep review proportionate. A focused pull request and passing evidence are preferable to additional process files.
+Contributions use the applicable existing software/documentation licence, MPL-2.0. Submit only material you have the right to contribute, retain upstream notices, and identify copied material and its licence. Dataset contributions require separately stated rights and factual review; a public source link alone does not authorize relicensing. You retain your copyright. No CLA or copyright transfer is required; maintainers cannot promise alternative licensing of every contribution without the relevant rights. See [licensing](docs/licensing.md).
+
+Keep review proportionate. A focused pull request and passing evidence are preferable to additional process files. Never place credentials, internal hosting receipts or private provider correspondence in a pull request or public repository.

GOVERNANCE.md

@@ -2,10 +2,14 @@
 
 Food Help maintains generic directory software. Each deployment operator owns local inclusion criteria, evidence review, publication decisions, correction handling, data rights, optional analytics policy and hosting approvals.
 
-The root `AGENTS.md` defines platform boundaries. A narrower `site/AGENTS.md` may add local review and operational rules, but may not turn generated files into authority or introduce community-specific platform logic. Keep private research notes and credentials outside the public repository.
+The root `AGENTS.md` defines platform boundaries. A narrower `deployments/<community>/AGENTS.md` may add local review and operational rules, but may not turn generated files into authority or introduce community-specific platform logic. A self-hosted configuration outside `deployments/` can carry the same narrower instruction file beside its `site.json`. Keep private research notes and credentials outside the public repository.
 
 The authority order is explicit user/owner direction within the task, applicable repository instructions, authoritative site facts/configuration and schema/domain contracts. Generated reports demonstrate a build; they do not override reviewed source facts or authorize external actions.
 
 Ordinary code fixes can follow normal maintainer review. Publication of provider facts, licence changes, enabling collection, deployment/DNS/domain actions and public repository creation need the appropriate operator/owner approval. A passing check is necessary engineering evidence, not that approval.
 
 Before a consequential change, hand off its exact scope, source/data difference, public and privacy effects, cache/update implications, test results, remaining limitations, artifact hash and proposed external action. Keep this in the relevant review or release record. Do not create a parallel historical “source of truth” archive inside generic source.
+
+`main` contains shared software and independently selectable community folders. A community release identifies one exact commit and one target. Merging a shared change or adding a folder is not approval to publish all communities. Keep a per-community release/rollback record without storing account receipts or credentials in public source. The historical `kingston` branch is retained for recovery, not ongoing development after the new release arrangement is verified.
+
+Contributors retain their rights under the applicable licences. Governance does not require a copyright assignment or imply that True Good Craft owns every contribution. Data grants, third-party notices and trademark rights remain separate; see [NOTICE](NOTICE.md).

LICENSE

@@ -35,7 +35,7 @@ Mozilla Public License Version 2.0
     means any form of the work other than Source Code Form.
 
 1.7. "Larger Work"
-    means a work that combines Covered Software with other material, in 
+    means a work that combines Covered Software with other material, in
     a separate file or files, that is not Covered Software.
 
 1.8. "License"
@@ -357,7 +357,7 @@ Exhibit A - Source Code Form License Notice
 
   This Source Code Form is subject to the terms of the Mozilla Public
   License, v. 2.0. If a copy of the MPL was not distributed with this
-  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+  file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 If it is not possible or desirable to put the notice in a particular
 file, then You may include the notice in a location (such as a LICENSE

NOTICE.md

@@ -1,13 +1,17 @@
 # Licensing and attribution
 
-Food Help application source, build/test tooling and repository documentation are offered under the Mozilla Public License 2.0; see `LICENSE`. Preserve applicable notices when redistributing modified source and make covered source available when distributing an executable build. MPL does not automatically grant trademark rights.
+Food Help application source, schemas, build/test tooling and supporting repository documentation are offered under the unmodified Mozilla Public License 2.0; see [LICENSE](LICENSE). Preserve applicable notices and provide the corresponding covered source when distributing executable browser code, including your deployed modifications. This notice defines the scope for project files that cannot conveniently contain a source comment. Separately identified data and third-party material retain their own terms.
 
-The bowl/spoon visual identity, icon PNGs and base CSS were reused from the project owner’s reference implementation at their direction. The generic SVG description and application identity have been updated. These project-supplied assets accompany the source licence; users should not imply endorsement by another deployment or operator.
+The bowl/spoon artwork, icon PNGs and base CSS were brought forward from the owner's Kingston Food Help reference implementation at their direction. The owner has authorized their inclusion in Food Help under MPL-2.0. The generic SVG description and application identity have been updated. This grant for the included material does not change historical releases or override another contributor's rights. No municipal mark is included. Independent operators may replace these assets; neither their use nor the software licence grants rights to another operator's name, trademarks, official domains or endorsement.
 
-Atkinson Hyperlegible Next is Copyright 2020–2024 The Atkinson Hyperlegible Next Project Authors. Its unmodified local WOFF2 and full SIL Open Font License 1.1 are in `src/assets/fonts/`. The build distributes the font licence. No third-party font host is contacted.
+Atkinson Hyperlegible Next is Copyright 2020–2024 The Atkinson Hyperlegible Next Project Authors. Its unmodified local WOFF2 and full SIL Open Font License 1.1 are in `src/assets/fonts/`. The build distributes the font licence. The font remains OFL-1.1, not MPL-2.0. No third-party font host is contacted. Source provenance and the matching legacy-file audit are recorded in [licensing](docs/licensing.md).
 
-Exampleville and the synthetic test fixtures are newly authored fictional examples, offered under CC0-1.0 as indicated in their configuration. This does not license any real provider dataset. Operators must establish and state their own dataset rights; source URLs and public availability alone do not prove redistribution permission. Real Kingston data is not included here.
+Exampleville and the synthetic test datasets are fictional examples, dedicated under [CC0-1.0](https://creativecommons.org/publicdomain/zero/1.0/) as indicated in their configurations. Test software remains MPL-2.0. These fixture grants do not cover real provider records.
+
+Real Kingston resource data is included in `deployments/kingston/resources.json`. Its source references, qualifications and review dates must remain with it. No separate open-data licence is asserted for the whole Kingston dataset. Original provider and third-party rights remain applicable; public visibility and a source link alone do not establish permission to relicense imported text or a database. See the deployment's `data_rights` statement and the [rights review](docs/licensing.md#real-community-data).
 
 Development tools retain their own package licences in the lockfile installation. Ajv generates self-contained schema validation code; Food Help supplies the small code-point-length and structural-equality helpers so no Ajv runtime package is shipped. No application code from the standards/prior-art projects in `docs/interoperability.md` is copied.
 
-Before initial public repository publication, review the complete file list, attribution, actual asset rights and any contributor-supplied material. Do not import the reference repository’s Git history, operational records or private integration files.
+Contributors retain their rights. There is no compulsory CLA or copyright transfer. A maintainer cannot promise alternative licensing of all contributions without the rights needed to do so. Self-hosting and commercial use of the software do not require a TGC service purchase. Third-party hosting or support is separate from this licence.
+
+Before each public release, review included files, source availability and attribution. Keep private operational records, credentials, correspondence and hosting receipts outside this repository.