Plan: ADR-041 — configurable structured logging + jurisdiction-owned field redaction; retire the FTI-special hash chain

The external anchor — and then the hash chain itself — is special-cased tamper-evidence for one log type. Tamper-evidence + retention are general logging-infrastructure properties, satisfied per-deployment by standard logging facilities.

Principle: canopy provides the mechanism, the deployment provides the policy. A general configurable structured-logging facility in every service, with per-field redaction. Fully jurisdiction-overridable — the deployment owns all compliance risk (maintainer decision): canopy ships safe defaults + the mechanism; a deployment can override anything (including the FTI/PHI defaults); a malformed policy fails closed (config error), an explicit override to a weaker policy is the deployment’s accountable, documented choice. No canopy-enforced floor.

§1075 scope (maintainer-confirmed): a metadata-only FTI access log is not itself FTI, and forwarding it to a general collector does not expand the FTI data boundary. But the collector is relied on as audit evidence, so it needs completeness, integrity, retention, and access controls — see the audit-channel contract.

One JSON→stdout init: canopy_common::telemetry::init (telemetry.rs:71), but fmt and otel are sibling layers (telemetry.rs:158/164/178) — a passive Layer CANNOT rewrite an event before they serialize it. Redaction needs a custom FormatEvent/field visitor for stdout plus separate OTEL span/attribute sanitization.

EnvFilter sits at the registry root (telemetry.rs:73) — it can suppress audit records entirely. An audit channel must be UNFILTERABLE.

NOT "one seam, every service": canopy-portal runs its own tracing_subscriber::fmt().init() (services/canopy-portal/src/main.rs:65-70, non-JSON, own filter); bootstrap reads secrets BEFORE telemetry init (bootstrap.rs:90-91 vs :94) so the earliest events are uncovered (Child A reorders init ahead of secret reads).

Config-as-data template: rulesets/{jurisdiction}/jurisdiction.toml + citations.toml, array-of-records precedent (), selected by CANOPY_<SVC>__JURISDICTION. ServiceSettings has jurisdiction but NO ruleset root (settings.rs:39); Child A needs a common policy-root/bootstrap contract.

FOUR live v1 hash-chain instances across THREE families, all shipped + running: TANF FTI + Medicaid FTI (fti_audit_log, off-bus, appended INSIDE the determination commit, fail-closed hot path — append_determination_chain_entries); general audit (audit_events, on-bus wildcard subscriber); ELE (ele_grant_events, medicaid, last_event_hash WRITTEN by grant/transition/renewal upserts store/ele.rs:582, live GET /v1/ele/chain-status). #1248 was the deferred chain-v2 migration of ELE — NOT this live v1 chain.

Chain-v2’s append/verification DATA PLANE is dormant (default-off), but schemas are migrated, HTTP routes registered, and staging/control-plane components run — the live contracts/routes/background components are part of the retirement.

Three SEPARATE FTI/PII controls that STAY distinct (only the field vocabulary is shared): scrub_fti_fields (mutates RabbitMQ payloads, fti_audit.rs:784), the publisher fail-closed guard (publisher.rs:296), and data-tenancy-authorisation.toml (service tenancy + CI scan). A tracing formatter cannot sanitize RabbitMQ or enforce tenancy.

The in-app Pub 1075 §9 detector is INERT: detection.rs dispatch handles only "event_count" (detection.rs:52-57); the seeded rule is 'failed_auth' → skipped; it reads only shared audit_events. It must be REPAIRED, not "retained" as working.

Citation ALREADY fail-closes in production: chain/attest returns verifier_unavailable while chain-v2 is dormant, so "Cite for hearing" 502s today. Re-homing RESTORES a broken feature — but flipping 502→success IS a live API/UI change.

Reporting owns its audit rows (ADR-004 Am 1 A6, #1256). Retention: Pub 1075 AU-11 is 7 years (the ADR-004 "5 years" statement is stale and is CORRECTED, not reaffirmed); ato-readiness.adoc carries the per-family envelope.

Policy model — mechanism + secure default; fully jurisdiction-overridable; missing→default, malformed→fail-closed, explicit override honored (even weaker), no canopy floor.

Redaction mechanism — custom stdout FormatEvent/visitor and a separate OTEL sanitizer (span fields + updates, nested, Display/Debug, error chains, message-string secrets); installed in the common init AND canopy-portal; init reordered ahead of secret reads.

Audit-export channel — UNFILTERABLE, versioned+schema’d, stable ID, commit-coupled attempt/completion/crash, complete-row digest + policy version, dedup/flush/gap-reconciliation/ collector-health; audit DB rows stay system-of-record; production conformance gate before any retirement.

Three separate controls stay — scrub_fti_fields, the publisher guard, the tenancy matrix; only the field vocabulary becomes shared config.

§9 detection repaired — dispatch/seed fixed; FTI + reporting inputs; in-app + config-driven.

Citation — a canopy-signed rendering of the current system-of-record row (ADR-029), removing the chain-state fail-closed matrix.

Reporting A6 preserved — reporting-owned rows + export; A7 chain-family withdrawn; A8 stays (#1256).

ADR-014 supersession — orig Decision + Am 1/3/4 + C1–C6 + Am 5–11 chain/anchor bindings; C7/C8 surviving non-chain obligations re-ratified.

Threat model — detects a privileged post-hoc DB row edit via off-box digest comparison; does NOT defeat an attacker controlling BOTH the DB AND the deployment logging control plane; no in-app cryptographic anti-privileged-rewrite claim.