Split the Enterprise Edition out into its own repository

.github/maven-settings.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- CI-only Maven settings: SRDC Nexus credentials come from repository secrets, never from this file. -->
+<settings xmlns="http://maven.apache.org/SETTINGS/1.2.0"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.2.0 https://maven.apache.org/xsd/settings-1.2.0.xsd">
+    <servers>
+        <server>
+            <id>srdc-maven-snapshots</id>
+            <username>${env.NEXUS_USERNAME}</username>
+            <password>${env.NEXUS_PASSWORD}</password>
+        </server>
+        <server>
+            <id>srdc-maven-releases</id>
+            <username>${env.NEXUS_USERNAME}</username>
+            <password>${env.NEXUS_PASSWORD}</password>
+        </server>
+    </servers>
+</settings>

.github/workflows/maven.yml

@@ -7,6 +7,9 @@
 # stays short and Docker-free; run `mvn verify -DskipITs=false` when you want it) and mandatory on
 # every pull request. Pushes only get the two fast jobs, since anything reaching a protected branch
 # has already been through a PR that ran the long tier.
+#
+# A push to main also deploys the community -SNAPSHOT modules to SRDC Nexus, which is where the
+# enterprise edition resolves them from between releases. Releases are deployed by hand (RELEASING.md).
 
 name: Java CI with Maven
 
@@ -71,3 +74,34 @@ jobs:
       # lets ${revision} stay a snapshot. RELEASING.md runs it with --release at release time.
       - name: Release readiness - jar contents and licensing
         run: bash test-flow/check-release-ready.sh
+
+  # The enterprise edition builds against whatever community snapshot is on SRDC Nexus, so main's
+  # snapshot is republished after every push that passed the short tier. Needs the NEXUS_USERNAME /
+  # NEXUS_PASSWORD repository secrets; without them the job says so and succeeds, rather than turning
+  # main red on a fork or before the secrets are configured.
+  deploy-snapshot:
+    name: Deploy snapshot to SRDC Nexus
+    needs: [ tiers, short ]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    env:
+      NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
+      NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up JDK 11
+        uses: actions/setup-java@v3
+        with:
+          java-version: '11'
+          distribution: 'temurin'
+      - name: Deploy
+        run: |
+          if [ -z "$NEXUS_USERNAME" ] || [ -z "$NEXUS_PASSWORD" ]; then
+            echo "::warning::NEXUS_USERNAME/NEXUS_PASSWORD secrets are not set; skipping the snapshot deploy"
+            exit 0
+          fi
+          case "$(grep -m1 -oE '<revision>[^<]+</revision>' pom.xml)" in
+            *-SNAPSHOT*) ;;
+            *) echo "::notice::\${revision} is a release version; releases are deployed by hand (RELEASING.md)"; exit 0 ;;
+          esac
+          mvn -B -s .github/maven-settings.xml -DskipTests deploy

AGENTS.md

@@ -4,20 +4,22 @@ Ignifyr (formerly **toFHIR**) — a FHIR-first ETL engine. Scala 2.13 · JDK 11
 Maven multi-module.
 
 Full agent/contributor guidance lives in **[CLAUDE.md](CLAUDE.md)** (root) and per-module `CLAUDE.md`
-files (`ignifyr-engine/`, `ignifyr-server/`, `ignifyr-server-common/`, `ignifyr-common/`, `ignifyr-rxnorm/`).
+files (`ignifyr-engine/`, `ignifyr-common/`, `ignifyr-cli/`, `ignifyr-connector-file/`, `ignifyr-sink-fhir/`,
+`ignifyr-sink-file/`, `ignifyr-testkit/`). This is the Community Edition; the enterprise modules (server,
+streaming, scheduling, Kafka, REDCap, …) live in a separate private repository.
 Read those first. The essentials:
 
 1. **Naming.** The toFHIR → Ignifyr rename is complete: packages (`io.ignifyr.*`), modules
    (`ignifyr-*`), config keys, and Docker tags all use the new name. The legacy `tofhir` name remains
    only in references to not-yet-renamed sibling artifacts (`srdc/tofhir-web` image, `tofhir-redcap`
    service) — don't reintroduce it in new code.
-2. **Verify with Maven.** `mvn test` for unit tests (fast, no Docker); `mvn -B verify` for the full build
-   incl. integration tests — which **need Docker running** (MongoDB/Kafka/onFHIR via TestContainers).
+2. **Verify with Maven.** `mvn test` for unit tests (fast, no Docker); `mvn -B verify -DskipITs=false` for
+   the full build incl. integration tests — which **need Docker running** (MongoDB/onFHIR via TestContainers).
    Report test results before claiming a change works.
 3. **Commit format (SRDC semantic commits):** `<emoji> <type>(<scope>): <subject>` — `:sparkles:` feat,
    `:bug:` fix, `:memo:` docs, `:recycle:` refactor, `:construction_worker:` build, `:white_check_mark:`
    test, `:green_heart:` ci, `:art:` style, `:wrench:` chore, `:zap:` perf. Imperative subject; optional
    `Fixes #N`.
 4. **Format before committing:** `mvn scalafmt:format`.
 
-PRs target `main`; CI runs `mvn -B verify`.
+PRs target `main`; CI runs the short tier on every push and the long tier on every PR.