Plan: Quarantine applicant uploads until a real malware scan passes (#1006, epic &52)

scan_status ∈ {pending, clean, infected, skipped, error}; the 'noop' value dies entirely.

Content-identity binding. The worker fetches the object and checks len == size_bytes and sha256(bytes) == row.sha256 BEFORE scanning. get_document_content stops streaming blind: it reads the object fully (bounded by the existing 10 MiB upload cap), re-verifies sha256 == row.sha256, and only then serves — a replaced object is unservable regardless of scan state (500-class + ERROR log on mismatch). All content responses — success and error, origin and BFF relay — carry Cache-Control: no-store so a browser can never replay bytes past a later quarantine.

Claim protocol. Claim sets scan_claim_token = uuidv7() (+ claimed_at/claimed_by for observability), captures scan_generation, increments scan_attempts. EVERY subsequent mutation — settle, defer, terminal error, orphan error — is fenced WHERE id=$ AND scan_claim_token=$ AND scan_generation=$ AND scan_status='pending': a stale worker (lease-reclaimed or pre-requeue) can never mutate or emit events for a newer claim. Claim order ORDER BY scan_due_at, id; stale-lease eligibility scan_claimed_at < now() - lease. The whole attempt (fetch + hash + scan) runs under one deadline (scan_attempt_timeout_secs); config validation requires lease > attempt timeout. Attempts count claims; terminal at attempts >= scan_max_attempts evaluated at claim (notices >= semantics); tests at max−1 / max / max+1 / crash-after-claim.

Defined once in applications domain.rs, unit-tested, surfaced on the wire as derived scan_viewable: bool:

get_document_content, accept_document, reject_document refuse 409 unless viewable. For accept/reject the predicate lives inside the UPDATE … WHERE (no check-then-update race); a typed outcome distinguishes Updated / Missing (404) / Quarantined (409). Verification auto-resolution therefore only ever fires on viewable documents. The web BFF’s proxy_error_status gains a Some(409) ⇒ CONFLICT arm + quarantine copy.

Accepted-row reconciliation policy. Acceptance is only ever valid for a viewable document — enforced by DB CHECK, by revocation-on-settle, and by revocation-on-requeue. Linked verification facts are NOT auto-unresolved in this MR: the acceptance_revoked event + the flagged document UI route it to human review; the cross-service automation is #1416. Covered-path test: accepted legacy row → backfilled pending → scans infected ⇒ acceptance revoked + event + never servable.

POST /v1/applications/{id}/documents/{document_id}/scan-override: service caller + verified actor whose roles include supervisor or admin — enforced at the origin from the actor JWT’s roles (403 otherwise); the BFF additionally gates the action and renders the affordance only for WorkerRole >= Supervisor. Body ScanOverrideRequest { reason: String } — trimmed, 8..=500 chars, 422 outside bounds. Guarded UPDATE … WHERE scan_status='skipped' AND scan_override_at IS NULL RETURNING; row-missing ⇒ 404, wrong-state/duplicate ⇒ 409 (duplicate POST is a clean 409). Response = the updated ApplicationDocument. The same tx stages application_document.scan_overridden {application_id, document_id, overridden_by, reason_sha256} — the digest tamper-binds the free-text reason (stored in scan_override_reason) without putting operator prose in the immutable chain.

New crate crates/canopy-scanner-clamd (scanner.rs:3-8 keeps real impls out of canopy-store). Trait change (pre-1.0): scan() returns ScanReport { result: ScanResult, backend_version: Option<String> } — provenance is observed WITH the verdict. ClamdScanner: INSTREAM scan then VERSION on the same flow; VERSION failure after a verdict ⇒ ScanError::Backend (a clamav clean verdict without provenance never settles). The VERSION string carries the definition generation + date; parsed age > scanner_max_definition_age_days ⇒ ScanError::Backend("definitions stale…") — scanning fails closed, serving (D5) unaffected. Definition-age gauge + WARN.

Strict framing: exactly one NUL/newline-terminated response line, ≤512 bytes, valid UTF-8 — anything else is Backend. The response-line parser carries a proptest (total, panic-free, grammar round-trip). The fake clamd validates real wire format (zINSTREAM\0, 4-byte big-endian chunk lengths, zero terminator) and scripts every row above plus oversized / multi-line / invalid-UTF-8 responses and connection drops.

ScannerBackend { #[default] Clamav, Noop } (verification AdapterSelection idiom). The Noop backend settles clean with scan_backend='noop' provenance (honest via provenance; production-blocked by the guard). Backend-switch requeue: on boot with backend ≠ Noop, a startup sweep requeues scan_backend='noop' rows in bounded batches (logged) — switching a database off noop re-scans everything noop ever touched.

services/canopy-applications/src/guard.rs, #1265 clone: pure evaluate(env, allow), called only when backend == Noop, before scanner wiring; refusal names the hazard (unscanned citizen uploads served to workers), #1006, and the exact override var; the override warns every boot. Test matrix transplanted (dev-permissive ×2, all non-dev tiers refused, override boots, unset env ⇒ production).

Single tx (Migrator’s per-DB lock + DDL table locks suffice; no extra advisory lock):

Header cites #1006 + ADR-016 + the rolling-deploy note (an old binary’s 'noop' INSERT fails loudly; accepted pre-1.0, no shims). Proof test (bare schema + single-connection pool per the migration_phase_test.rs precedent; one schema reused across cells): partial-apply (temp dir minus this file) → seed noop + accepted-clean legacy rows → full apply → both pending, acceptance cleared, fresh 'noop' INSERT rejected, CHECKs active.

WorkerDeps { db, store, scanner, publisher }, spawned per concurrency slot. Loop: claim → fetch + hash-verify + scan under the attempt deadline, outside any tx → settle in one short tx fenced on (token, generation, pending) → stage application_document.scan_completed {application_id, document_id, scan_status, scan_backend, scan_backend_version} (a PII-safe allowlist — enum-class tokens, no free text) in the settle tx; acceptance revocation folds into the same UPDATE when applicable. Telemetry: outcome counter, scan_pending_count, scan_oldest_pending_age_secs (WARN over threshold), definition-age gauge, scan_worker_disabled. Backlog policy: uploads stay admitted during outages (that IS D4/D5 — size-capped; count quotas explicitly out of scope), alerting via the pending-age gauge + runbook.

POST /v1/applications/{id}/documents/{document_id}/rescan — service-caller only; the atomic requeue (generation bump); valid from any settled state (pending ⇒ 409 already-queued); stages application_document.scan_requeued {application_id, document_id, cause="manual"}. Supported recovery for terminal error rows — no direct SQL. CLI parity in this MR.

canopy-security event_parsing.rs gains recognized arms: document_id in the resource-id key list; overridden_by in the actor key list. Producer→parser integration test (stage each new event type, run the parser, assert resource/actor extraction). Events: scan_completed (incl. terminal error + identity-mismatch causes), scan_overridden (+reason_sha256), acceptance_revoked {ids, cause}, scan_requeued {ids, cause}. Backend-bypass (guard override) is boot-time WARN per D3.