Add private Kingston Food Help aggregate analytics

[truegoodcraft]

Kingston Food Help needs useful community-use reporting without collecting sensitive food-provider or visitor histories. This draft adds an isolated daily aggregate profile and a protected Kingston report for Agent Smith’s /kfh command.

• Strict production origins and payload allowlists; default-off consent is a producer requirement. Unknown fields, identifiers, provider context, action attribution and privacy-suppressed requests are rejected.
• Six broad activity counters plus separate page-view source/campaign/content totals. No raw events, identities, source-to-action joins or confirmed-human claims.
• Additive migration 0016, atomic writes, 400 UTC-day aggregate retention and scope-separated two-day abuse buckets. Existing cron cadence is preserved.
• Exact report contract 1.0 and producer fixtures; partial today is separate from two complete seven-day windows. Failed storage is unavailable/null, while empty observed data is explicitly limited.

Validation: typecheck and all 208 tests pass locally, including real SQLite SQL constraints/rollback, privacy rejection, suppression/rate failure, retention, auth and report windows. sql.js is test-only; production dependencies remain unchanged. Native Cloudflare/D1 execution is a rollout check, not a local proof. Existing BUS Core/TGC and CEO suites pass.

Review/rollout: this PR does not activate website analytics. The default-off website emitter/consent wording requires its separate reviewed change. Migration 0016 needs explicit approval and remote verification before any Lighthouse promotion. Preserve the existing CEO consumer-parity gate and external Workers Builds verification before merge. Branch publication may upload a non-promoting preview/version; production promotion remains separately controlled. No merge, production request, migration, deployment or secret operation was performed.

Companion consumer: Agent Smith PR #8 — private /kfh. Lighthouse GitHub Governance Validation run 33931575258 passed.

Governance: behavior changed; SOT, CHANGELOG, operations and contract updated; 1.31.0 → 1.32.0 with package/lock parity. AGENTS.md unchanged. Diagnostic access: local tests and approved GitHub repository reads only. External mutation: this review branch/PR, with possible CI/preview/version effects. No production analytics evidence was written.

Changed files:

• CHANGELOG.md
• KFH_ANALYTICS_CONTRACT.md
• OPERATIONS.md
• README.md
• SOT.md
• contracts/kfh-v1/empty.json
• contracts/kfh-v1/sample.json
• contracts/kfh-v1/unavailable.json
• migrations/0016_add_kfh_daily.sql
• package-lock.json
• package.json
• src/index.ts
• src/kfhAnalytics.ts
• src/kfhContract.ts
• tests/kfh-analytics.test.mjs
• tests/release-control.test.mjs

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	buscore-lighthouse	af0757c	Commit Preview URL Branch Preview URL	Sep 05 2026, 12:01 AM