Plan: Per-Program Determine-Input Requirements Coverage (epic &63)

On this page
NOTE

Implements ADR-034 Decision 6, the enforcement spine of the per-program determination context-mapping contract (epic &63, #859). A fourth machine-checkable axis in the ADR-031 policy-coverage family, alongside action-coverage and scenario-coverage.

Status

MR Description Status

MR1 (manifest + gate, advisory)

Per-program input-requirements manifests at compliance/input-requirements/{program}.toml: each declares every field of the program’s /v1/determine ApplicationContext — name, requirement (required|optional), policy_material, source_class, and a gap_issue for not-yet-satisfiable inputs — plus a [meta] block (program, version, contract, OpenAPI binding). Schema + evaluation in canopy-policy (pub mod input_requirements). New cargo xtask policy input-coverage: load manifests → for each, classify satisfiability + (when the determine schema is exported) cross-check the field set + required-ness against the committed OpenAPI snapshot → report covered / tracked-gap / findings, exit 1 on any finding. CI job adr-031-input-coverage lands allow_failure: true (advisory).

Done (2026-06-15) — canopy_policy::input_requirements (schema + evaluate, 10 unit tests), xtask policy_input runner, CI job advisory. Findings: UNGAPPED (policy-material gap with no issue) / MIS-CLASSIFIED (gap_issue on a non-gap class) / DRIFT (snapshot property undeclared) / STALE (manifest field not in snapshot) / REQUIREMENT (required-ness mismatch) / EXPORT (non-exported without an export_issue) / SNAPSHOT (exported contract absent). First run: 59 satisfied · 38 tracked gaps · 0 findings — snap clean (0 gaps, the wired UAT baseline), tanf 1 (deprivation capture #858), medicaid 31 (21 worker-facts #858 + 2 resource/medical #856 + 8 restricted SSA/Medicare #858), caps 3 (#857), wic 3 (#769). snap/tanf/medicaid drift-checked; caps/wic drift-skipped (schema not exported, #862). Live-proven: clean run exit 0; removed gap_issue → UNGAPPED finding exit 1; restored → clean.

MR2+ (burndown via the mapper slices)

Each later ADR-034 mapper slice flips fields from a tracked gap to satisfied: #856 (Medicaid resources/medical), #857 (CAPS mapper), #769 (WIC mapper), #858 (untracked worker-facts via the ADR-027 corpus), #860 (per-member subject), #861 (frequency normalization), #862 (export CAPS/WIC schemas → uniform drift-check). When the ADR-027 corpus lands (epic &56) the gate flips to blocking per ADR-034 Decision 2.

Not started

Design — decisions

  • Manifest is data, schema is code. Schema lives in canopy-policy (xtask-only crate, zero runtime dependents — same placement as the citation + action schemas); data lives under compliance/input-requirements/ per program, sibling to the other ADR-031 compliance TOMLs. Mirrors action-coverage exactly.

  • source_class is the satisfiability taxonomy. request / persons / policy / inference / derived are satisfiable today (the data source exists; only the per-program mapper is unbuilt — that is the epic). worker-fact (needs the ADR-027 corpus, epic &56) and restricted (ADR-004 SSA/Medicare, out of mapper scope per Decision 10) are gaps — each policy-material gap field must carry a tracking issue. The gap count is the burndown each mapper slice shrinks.

  • Drift cross-check where the contract is exported. snap/tanf/medicaid export ApplicationContext to their snapshots, so the gate enforces that the manifest field-set and required-ness match the real contract — a new required determine-input that the orchestrator cannot supply is caught here, not as an opaque dispatch 422. CAPS/WIC determine schemas are internal (not exported); their drift-check is skipped and tracked by #862, with manifest completeness hand-authored from the contract struct.

  • Advisory first, blocking post-corpus. Per ADR-034 Decision 2 the satisfiability invariant is only fully enforceable against the worker-authored fact corpus (post-UAT, epic &56); pre-corpus the gate checks against today’s persons reads + named inference shims and runs advisory, mirroring how policy drift stays advisory.

Verification

  • Unit tests for the gate (clean manifest → satisfied; ungapped material gap → finding; drift missing/stale/requirement-mismatch → findings; non-exported requires export_issue) following the action-coverage fixture pattern.

  • Live: cargo xtask policy input-coverage against the real committed snapshots — clean; mutate a manifest (drop a field / a gap_issue) → finding, exit 1; restore → clean.

Edit this page · default