# Canopy Documentation

> Canopy Documentation — generated from Antora. Every page has a Markdown mirror at the same URL with a .md extension.

## Canopy
- [ADR-001: Program Service Isolation](/canopy/adrs/adr-001-program-service-isolation.md): Each benefit program operates as an independent service with its own database. No cross-program database access is permitted.
- [ADR-002: Black-Box Determination Contract](/canopy/adrs/adr-002-black-box-determination-contract.md): Program services return signed determinations, not data. The eligibility orchestrator consumes outcomes, not inputs. Inter-service trust is established via cryptographic signatures on determination objects.
- [ADR-003: Ruleset-as-Data](/canopy/adrs/adr-003-ruleset-as-data.md): Program-specific eligibility logic lives in versioned ruleset files evaluated by a shared rules engine. No per-program rules engine implementation.
- [ADR-004: Legally-Scoped Data Tenancy](/canopy/adrs/adr-004-legally-scoped-data-tenancy.md): Federal data sources with statutory use restrictions are isolated to the program service authorized to use them, with independent audit logging satisfying the governing federal requirement.
- [ADR-005: Modular Deployment Profiles](/canopy/adrs/adr-005-modular-deployment-profiles.md): Canopy services are composable. Any jurisdiction may deploy any subset of programs without deploying all services. Deployment profiles define minimum required service sets per program.
- [ADR-006: Jurisdiction-Agnostic Ruleset Organization](/canopy/adrs/adr-006-jurisdiction-agnostic-ruleset-organization.md): Eligibility rulesets are organized per jurisdiction under rulesets/{jurisdiction}/. Federal-floor constants are expressed as jurisdiction-overridable inputs, not hardcoded values.
- [ADR-007: CLI/API/UI Parity](/canopy/adrs/adr-007-cli-api-ui-parity.md): Every operation exposed by the API must be available through the CLI and the portal UI.
- [ADR-008: Applicant Portal Architecture (Dioxus Fullstack)](/canopy/adrs/adr-008-applicant-portal-architecture.md): The applicant-facing portal (canopy-portal) uses Dioxus fullstack (SSR + WASM hydration) to deliver a unified, accessible, multi-language application experience across web, kiosk, and future mobile platforms.
- [ADR-009: PostgreSQL-Backed Session Storage](/canopy/adrs/adr-009-postgresql-session-storage.md)
- [ADR-010: Typst for Document Generation](/canopy/adrs/adr-010-typst-document-generation.md)
- [ADR-011 Policy-Trace ATO Evidence Statement (Closes #413)](/canopy/compliance/adr-011-ato-evidence.md): Formal compliance posture for ADR-011 — every policy value in Canopy is either cited, federal-pinned, or explicitly allowlisted with a written rationale. The CI gates below constitute the auditable evidence.
- [ADR-011: Policy-to-Rules Traceability Pipeline](/canopy/adrs/adr-011-policy-to-rules-pipeline.md)
- [ADR-012: Layered YAML Configuration with Environment Overrides](/canopy/adrs/adr-012-layered-yaml-configuration.md)
- [ADR-013: Plan Lifecycle and Status Vocabulary](/canopy/adrs/adr-013-plan-lifecycle-and-status-vocabulary.md)
- [ADR-014: FTI Audit Hash-Chain Integrity](/canopy/adrs/adr-014-fti-audit-hash-chain.md): Mandates SHA-256 hash chaining over `fti_audit_log` rows in canopy-tanf and canopy-medicaid to provide tamper-evident IRS Pub 1075 §4 audit logs and a Pub 1075 §9 reportable detection pathway. Amends ADR-004.
- [ADR-015: Containerized Integration Tests](/canopy/adrs/adr-015-containerized-integration-tests.md)
- [ADR-016: Forward-Only Schema Migrations](/canopy/adrs/adr-016-forward-only-migrations.md)
- [ADR-017: Encrypted Secrets at Rest with SOPS + age](/canopy/adrs/adr-017-encrypted-secrets-at-rest.md)
- [ADR-018: Persistent Per-Service Event Outbox](/canopy/adrs/adr-018-persistent-outbox.md)
- [ADR-019: canopy-identity — Identity-Service Contract for Workers and Services](/canopy/adrs/adr-019-service-identity-and-on-behalf-of.md)
- [ADR-020: Cross-Process Chaos Observability via In-Process Production Fixtures](/canopy/adrs/adr-020-cross-process-chaos-observability.md)
- [ADR-021: Worker Portal Composability Runtime + Plugin Model](/canopy/adrs/adr-021-composability-runtime-and-plugin-model.md)
- [ADR-022: Composition Override Storage Layering](/canopy/adrs/adr-022-composition-override-storage-layering.md)
- [ADR-023: OIDC Validation at Service Boundaries, Token Exchange, and Citizen-Upload Isolation](/canopy/adrs/adr-023-oidc-at-services-and-citizen-upload-isolation.md): Tightens canopy's auth model to push OIDC validation to every program service, narrow service-class credentials to background jobs, and isolate citizen-upload processing under scoped credentials derived via RFC 8693 token exchange. Amends ADR-019.
- [ADR-024: User-Layer Semantic Delta Schema for Dashboard Composition](/canopy/adrs/adr-024-user-layer-semantic-delta-schema.md): Narrows ADR-022's "all override bodies are RFC 6902 JSON Patch op lists" to permit a slug-based semantic envelope (`user_delta_v1`) on the user-layer of dashboard surfaces only. Forward-compatible with baseline panel additions. Amends ADR-022.
- [ADR-025: Cross-Service Referential Integrity at the HTTP Boundary](/canopy/adrs/adr-025-cross-service-referential-integrity.md)
- [ADR-026: Privacy-First Applicant Portal (Client-Encrypted Drafts + Redis-Primary Sessions)](/canopy/adrs/adr-026-privacy-first-applicant-portal.md): The applicant portal owns no operator-readable durable state until an application becomes an official record. In-progress applications are client-side-encrypted JSONB drafts under a reserved application ID; sessions move to Redis; the portal becomes Postgres-free. Amends ADR-009.
- [ADR-027: Worker Fact Authoring, Provenance, and Valid-Time Versioning](/canopy/adrs/adr-027-worker-fact-authoring-and-provenance.md): Human actors (a worker's Keycloak subject, or the applicant) are the only authors of record for eligibility facts. Automated sources emit claims a human must accept or reject. Facts are valid-time-versioned and append-only in canopy-persons; the transaction-time change history (who/when/old→new + accept/reject) is recorded in canopy-security as attributed events. Amends ADR-001.
- [ADR-028: Determination Input Snapshot](/canopy/adrs/adr-028-determination-input-snapshot.md): At the moment it renders a verdict, each program service freezes the inputs it evaluated — the proven facts with provenance, the resolved policy parameters, and the ruleset corpus version — into a read-only artifact bound to the signed determination. v1 is a flat, signature-bound input snapshot; the self-explaining derivation graph is a later layer. Amends ADR-002.
- [ADR-029: General Signed-Document Renderer](/canopy/adrs/adr-029-general-document-renderer.md): canopy-typst + canopy-notices are the project's general signed-document renderer, not only a notice service. A generic render path (allow-listed template + free-form JSON inputs) sits beside the NOA manifest path; documents are signed over their canonical data (the determination pattern). The audit "Cite for hearing" citation is the first non-NOA consumer. Centralizing all PDF rendering is unconstrained by ADR-004 because no PDF ever carries FTI. Amends ADR-010.
- [ADR-030: Code-Quality Gating — Enforced Lint Posture and Debt Ratchet](/canopy/adrs/adr-030-code-quality-gating.md): Adopt an enforced, centralized code-quality gate — a strict `[workspace.lints]` posture (panic-free, no-index-panic, no-overflow, pedantic+cargo+nursery at deny), a 40-line function ceiling, and a monotonic `quality-budgets` debt ratchet — at least as strict as the sibling CCWIS project (craig), wired into the pre-push validate battery + CI parity. Existing violations are grandfathered via `#[expect(reason=…)]` + a seeded ratchet so the gate goes live without a big-bang fix; debt is frozen and burned down monotonically. Ports craig's lint-promotion/triage pattern.
- [ADR-031: Policy Coverage Assurance — Currency, Actions, Scenarios](/canopy/adrs/adr-031-policy-coverage-assurance.md): Extend ADR-011's "policy is the spec; coverage is enforced" discipline from policy values to three further axes — source currency, action coverage, and scenario coverage — each backed by a versioned, machine-checkable artifact and a staged advisory-to-blocking gate.
- [ADR-032: Two-Tier Scenario Corpus — Synthetic Engine Fixtures + Per-Jurisdiction Conformance Packs](/canopy/adrs/adr-032-two-tier-scenario-corpus.md): Scenario-based E2E testing splits into an engine corpus (synthetic adversarial test jurisdictions exercising the federal option space, run in canopy CI) and per-jurisdiction conformance packs (real-policy scenario suites each deployment ships). Georgia policy is the first conformance pack, not the default engine corpus.
- [ADR-033: Constraint-Driven Generative Seeding + Journey Execution Model](/canopy/adrs/adr-033-generative-seed-harness.md): Test seeding converges on one generative engine that produces random-but-valid data under two constraint layers (domain invariants + per-scenario preconditions resolved against the policy layer by parameter NAME, never value), journeys reach their starting states through real endpoints, time is modeled in three tiers (backdate → effective-date → gated clock), and the harness's own policy references are audited. The harness is as data-driven as canopy itself.
- [ADR-034: Per-Program Determination Context-Mapping](/canopy/adrs/adr-034-per-program-determination-context-mapping.md): The eligibility orchestrator builds each program's determination input via an explicit, typed, per-program context mapping that is complete-or-provisional — every policy-material required input is satisfied from the worker-authored fact corpus + policy, or the determination is marked provisional naming the missing input — replacing the single generic-context broadcast that today silently 422s (CAPS/WIC) or silently defaults (Medicaid/TANF). Amends ADR-002.
- [ADR-035: Per-Subject Determination + Per-Program Context Mappers](/canopy/adrs/adr-035-per-member-determination-and-program-mappers.md): Implements ADR-034's per-program context-mapping contract — typed map_<program>_context mappers replace the generic broadcast. There are two determination cardinalities — household-level (SNAP/TANF) and per-subject/multi-subject (Medicaid per-member, CAPS per-child, WIC per-participant). Each per-subject program owns its own subject enumeration + AU composition and returns N independently-signed per-subject determinations (the orchestrator never runs program AU code or selects subjects). A complete-or-provisional + input-unsatisfiable carrier replaces the silent 422. Resolves #860; supersedes ADR-034 Decision 8's single-subject framing for CAPS/WIC. Amends ADR-002; implements ADR-034.
- [ADR-036: Crypto-Shred Redaction & Signing-Key Retention](/canopy/adrs/adr-036-crypto-shred-redaction.md): PII-bearing values across facts, events, and determination snapshots are sealed in per-value AEAD envelopes; redaction destroys the value's key (crypto-shredding), leaving the hash over the ciphertext — and any signature binding it — verifiable. Signing verification keys are retained persistently so any determination ever signed stays verifiable. Amends ADR-027, ADR-028, ADR-014, ADR-017.
- [ADR-037: Signing-Key-Aware Service-Token Acquisition](/canopy/adrs/adr-037-service-token-key-aware-acquisition.md): A canopy service self-heals when its cached client_credentials token is signed by an IdP OIDC key the issuer has deleted — by revalidating the cached token against a bounded-freshness JWKS (single-flighted, refresh_lock-serialized) and re-minting on failure, so sender-validity equals receiver-validity. Amends ADR-019.
- [ADR-038: Concurrency-Safe, Recoverable Applicant Finalization](/canopy/adrs/adr-038-concurrency-safe-applicant-finalization.md): Applicant-draft finalization makes idempotent, recoverable cross-service writes by moving idempotency to the persons layer (a transactional receipt keyed on operation/generation/step), governing recovery with a linearizable draft-row-locking saga, compensating partial graphs by crypto-shred (never a hard delete) with a shared-graph quarantine, and holding persons events until the application commits. Amends ADR-026 §5 and §6.
- [ADR-039: Single-Source Outbox Schema + First-Class Event-Hold](/canopy/adrs/adr-039-single-source-outbox-schema-and-event-hold.md): The per-service event_outbox schema is single-sourced in canopy-mq (canonical migrations generated into each service + a parity gate), and the outbox gains a first-class event-hold capability — an event can be staged held in the producer's transaction and released (or dropped) later, so the drainer never publishes the events of a partial or aborted multi-step operation. Amends ADR-018.
- [ADR-040: Build-Once, Gate-Complete Artifact Promotion](/canopy/adrs/adr-040-build-once-artifact-promotion.md): Both deployable container images are built once per artifact-affecting main/tag commit under immutable commit-SHA staging refs; production registry tags are only ever registry-side retags of those tested digests, performed by a promote job that waits on the entire test stage. latest moves only from the current main head; every production digest has a retained per-image SBOM; the invariants are statically gated by cargo xtask ci-config-lint.
- [ADR-041: Configurable Structured Logging + Jurisdiction-Owned Field Redaction](/canopy/adrs/adr-041-configurable-logging-field-redaction.md): Every canopy service gets a general, configurable structured-logging facility with per-field, jurisdiction-owned redaction. The special-cased FTI-audit hash chain (ADR-014) and the chain-v2 external-anchor machinery are being retired (gated behind #1304); external tamper-evidence and retention of the exported audit copy are delegated to the deployment's logging facility. canopy provides the mechanism; the deployment provides the policy.
- [ADR-042: Upload Scan Quarantine — clamd Backend, Async Promotion, Content-Identity-Bound Verdicts](/canopy/adrs/adr-042-upload-scan-quarantine.md): Applicant uploads land durable at scan_status='pending'; a fenced promotion worker settles verdicts bound to content identity; serving and review gate on viewability (clean, or skipped with an audited supervisor override).
- [ADR-043: OIDC Program Amendments — Citizen-Path Credential, Exchange Semantics, and the Frozen Rejection Contract](/canopy/adrs/adr-043-oidc-program-amendments.md): The 2026-08-10 maintainer ruling's amendments to ADR-023, recorded on the program's first implementing MR (F1b): the citizen path runs on a dedicated narrow IdP service account (no citizen token exists to exchange); GA exchange semantics (sub preserved, azp visible, act unused); 401/403 frozen; D3 narrowed to credential+data isolation; RFC 7009 revokes token values, not JTIs.
- [ADR-044: Worker Program Scope Is a Required IdP Claim](/canopy/adrs/adr-044-worker-program-scope-required-claim.md): A worker's `primary_programs` claim is a required authorization attribute, not an optional hint. A token carrying no usable claim is refused at admission — no canopy-side override, no role-tier bypass. The claim yields a non-empty `WorkerProgramScope` that every scope decision in canopy-web reads.
- [ADR-045: Blind-Broker Exchange Partner-Evidence Architecture](/canopy/adrs/adr-045-exchange-partner-evidence-architecture.md): canopy-exchange becomes the single partner integration layer — a blind broker holding recipient public keys only. Three layers: canonical evidence/command contracts (L1), grant-checked aggregation/routing (L2), per-partner wire connectors (L3). Every durable or returned evidence object is a signed, recipient-sealed HPKE envelope exchange cannot decrypt. Restricted matching, merge-persistence, and raw storage stay inside statutorily authorized program services.
- [Applicant Portal Design Reference](/canopy/design/applicant-portal.md): Faithful reference translation of the canopy-portal (applicant/customer) design handoff. Captures the locked auth model, information architecture, voice rules, implied schemas, API sketch, persistence boundaries, customer-worker wiring, accessibility commitments, and hard implementation rules. Section numbering (3.7, 4.5, 6.5, ...) is preserved verbatim so code comments and other docs so the §X.Y subsection cross-references in code and docs resolve here.
- [Applicant Portal Seed Credentials](/canopy/runbooks/demo-applicant-credentials.md)
- [Architecture](/canopy/architecture.md): Canopy system-architecture overview — service topology, data tenancy, event bus, and the ADR index.
- [asciidoctor-lint — in-house AsciiDoc linter](/canopy/tooling/asciidoctor-lint.md)
- [ATO Readiness & Compliance Certification Matrix](/canopy/ato-readiness.md): Federal compliance control mapping for IRS Pub 1075, HIPAA, IEVS, and NIST SP 800-53.
- [Audit: Hardcoded Policy Values That Should Move to jurisdiction.toml / JDM Rulesets (2026-04-20)](/canopy/plans/archive/hardcoded-policy-values-audit-2026-04-20.md): Cross-codebase audit for ADR-011 compliance. Five parallel contextless subagents reviewed SNAP, TANF, Medicaid/CHIP, CAPS/WIC, and shared crates + cross-program services for numeric literals that encode federal or jurisdiction-specific policy and should be extrapolated to `jurisdiction.toml` + `citations.toml` (parameters) or `rulesets/` (eligibility logic) rather than living in Rust source.
- [Auditor Handbook](/canopy/auditor-handbook.md): Single-page reference for federal partners and auditors. Indexes every artefact required for IRS Pub 1075, HIPAA, NIST SP 800-53, and ATO review.
- [Bulk COLA Runs — Scaling & Operations Runbook (#1213)](/canopy/runbooks/bulk-cola-scaling.md)
- [Canopy](/canopy/index.md): Georgia DHS's open-source integrated eligibility system.
- [Canopy API Reference](/canopy/api/index.md): OpenAPI specifications for canopy program and infrastructure services.
- [Canopy for State Agency Evaluators](/canopy/evaluator-guide.md): Executive overview of Canopy for state CIOs, program directors, and procurement officers evaluating adoption.
- [Canopy Service Catalog](/canopy/services.md): The canonical index of every Canopy service — topology, ports, databases, restricted-data scope, cross-cutting concerns, and per-service capability summaries.
- [canopy-appeals API Reference](/canopy/api/canopy-appeals.md): REST API reference for canopy-appeals — fair hearings, IPV/ADH proceedings, continued benefits, and cross-program disqualification.
- [canopy-appeals Data Model](/canopy/data-models/canopy-appeals.md): PostgreSQL schema for fair hearings (7 CFR 273.15), IPV / ADH enforcement (7 CFR 273.16), and the continued-benefits assessment entity (epic &72 Phase 4). 10 tables (migration inventory below); ADR-001 owns this schema in canopy-appeals's own database.
- [canopy-applications API Reference](/canopy/api/canopy-applications.md): REST API reference for canopy-applications — ACA §1413 single-streamlined application intake, authorized-representative CRUD, expedited SNAP screening.
- [canopy-applications Data Model](/canopy/data-models/canopy-applications.md): PostgreSQL schema for the single-streamlined application intake service (ACA §1413). 14 tables across eighteen migration files; ADR-001 owns this schema in canopy-applications's own database.
- [canopy-caps API Reference](/canopy/api/canopy-caps.md): REST API reference for canopy-caps — Childcare and Parent Services (CAPS / CCDF) eligibility determination, copayment tiers, and provider authorization.
- [canopy-caps Data Model](/canopy/data-models/canopy-caps.md): PostgreSQL schema for the CAPS (Childcare and Parent Services) program service. 7 tables across six migration files; ADR-001 owns this schema in canopy-caps's own database.
- [canopy-eligibility API Reference](/canopy/api/canopy-eligibility.md): REST API reference for canopy-eligibility — orchestrates parallel program determinations with JWS verification.
- [canopy-eligibility Data Model](/canopy/data-models/canopy-eligibility.md): PostgreSQL schema for the cross-program eligibility orchestrator (ADR-002 black-box determination contract). 5 tables across five migration files; ADR-001 owns this schema in canopy-eligibility's own database.
- [canopy-enrollment API Reference](/canopy/api/canopy-enrollment.md): REST API reference for canopy-enrollment — post-determination enrollment, EBT benefit issuance, and expungement tracking.
- [canopy-enrollment Data Model](/canopy/data-models/canopy-enrollment.md): PostgreSQL schema for post-determination SNAP enrollment + EBT benefit issuance. 10 tables across 13 migration files; ADR-001 owns this schema in canopy-enrollment's own database.
- [canopy-medicaid API Reference](/canopy/api/canopy-medicaid.md): REST API reference for canopy-medicaid — Medicaid/CHIP eligibility across 38 Categories of Assistance (COAs), TMA cross-program coverage, Express Lane Eligibility, FTI audit, and overpayment recovery.
- [canopy-medicaid Data Model](/canopy/data-models/canopy-medicaid.md): PostgreSQL schema for the Medicaid + CHIP program service. 26 tables across twelve migration files; ADR-001 owns this schema in canopy-medicaid's own database. FTI (IRC §6103(l)(12)), FDSH, and HIPAA-scoped clinical data are sited here per ADR-004; the FTI audit log carries an ADR-014 hash chain that the ADR-028 determination-input snapshots join.
- [canopy-notices API Reference](/canopy/api/canopy-notices.md): REST API reference for canopy-notices — PDF notice generation via Typst, S3 storage, and delivery tracking.
- [canopy-notices Data Model](/canopy/data-models/canopy-notices.md): PostgreSQL schema for notice metadata + appeal-rights companions, the #1091 work-item queue, plus the shared event outbox/inbox. PDF bodies are object-storage artifacts in S3, not DB rows. 5 tables across ten migration files; ADR-001 owns this schema in canopy-notices's own database.
- [canopy-persons API Reference](/canopy/api/canopy-persons.md): REST API reference for canopy-persons — person, household, income, asset, expense, and address management.
- [canopy-persons Data Model](/canopy/data-models/canopy-persons.md): PostgreSQL schema for the person + household master-data service backing every program determination. 9 tables across eleven migration files; ADR-001 owns this schema in canopy-persons's own database.
- [canopy-portal Fluent i18n](/canopy/services/canopy-portal-i18n.md): Contributor guide for canopy-portal's Fluent-based internationalization. Adding keys, adding locales, translation review path.
- [canopy-renewals API Reference](/canopy/api/canopy-renewals.md): REST API reference for canopy-renewals — certification periods, interim contacts, change reports, and renewal scheduling.
- [canopy-renewals Data Model](/canopy/data-models/canopy-renewals.md): PostgreSQL schema for SNAP certification periods, interim contacts, change reporting, recertification nudges, periodic-report cycles, and the re-determination worker queue. 7 tables; ADR-001 owns this schema in canopy-renewals's own database.
- [canopy-reporting API Reference](/canopy/api/canopy-reporting.md): REST API reference for canopy-reporting — SNAP (FNS-388, FNS-7176 QC), TANF (ACF-199, ACF-196, WPR), and Medicaid (T-MSIS, CMS-64, CMS-416) federal reports on the durable report-run pipeline, plus the cross-program overpayment roll-up.
- [canopy-reporting Data Model](/canopy/data-models/canopy-reporting.md): PostgreSQL schema for federal reporting submission records (SNAP FNS-388/7176, TANF ACF-199/ACF-196/WPR, Medicaid T-MSIS/CMS-64/CMS-416) plus the #1202 report-run substrate and the per-service event outbox. 12 core tables (this page's inventory; further infrastructure migrations — outbox, inbox, index-only — live alongside); ADR-001 owns this schema in canopy-reporting's own database.
- [canopy-rules API Reference](/canopy/api/canopy-rules.md): REST API reference for the canopy-rules service — JDM ruleset management and evaluation.
- [canopy-rules Data Model](/canopy/data-models/canopy-rules.md): PostgreSQL schema for the zen-engine ruleset audit trail, the ADR-018 event outbox, and the T2-7 corpus-version history. 3 tables across five migration files (rule_sets created then dropped; rule_evaluations + event_outbox + ruleset_corpus_versions surviving); ADR-001 owns this schema in canopy-rules's own database. Per ADR-003, the ruleset content itself lives in `rulesets/` as JSON files on the filesystem; `ruleset_corpus_versions` additionally retains the winning content of each booted corpus so a historical version can be replayed.
- [canopy-security API Reference](/canopy/api/canopy-security.md): REST API reference for canopy-security — audit event management, NIST controls, breach detection, and hash chain verification.
- [canopy-security Data Model](/canopy/data-models/canopy-security.md): PostgreSQL schema for the system-wide wildcard event subscriber, NIST control mappings, breach detection rules, and the per-service FTI hash-chain verification ledger. 8 core tables plus the dormant chain-v2 substrate / staging / verification objects; ADR-001 owns this schema in canopy-security's own database. Per ADR-004, FTI itself is held by canopy-tanf and canopy-medicaid; canopy-security stores only the audit-event metadata about FTI access.
- [canopy-snap API Reference](/canopy/api/canopy-snap.md): REST API reference for canopy-snap — SNAP eligibility determination, ABAWD tracking, categorical eligibility, student status, TSNAP certifications, IEVS verification, overpayment recovery, bulk export, and parameters.
- [canopy-snap Data Model](/canopy/data-models/canopy-snap.md): PostgreSQL schema for the SNAP (Supplemental Nutrition Assistance Program) program service. 22 tables across fifteen migration files; ADR-001 owns this schema in canopy-snap's own database. IEVS data is sited here per ADR-004 — 7 USC §2025(e) authorizes IEVS use for SNAP only.
- [canopy-tanf API Reference](/canopy/api/canopy-tanf.md): REST API reference for canopy-tanf — TANF eligibility determination, work requirements, time limits, personal responsibility, GRG payments, FTI audit, overpayment recovery.
- [canopy-tanf Data Model](/canopy/data-models/canopy-tanf.md): PostgreSQL schema for the TANF (Temporary Assistance for Needy Families) program service. 21 tables across fourteen migration files; ADR-001 owns this schema in canopy-tanf's own database. FTI data (IRC §6103(l)(7)) and SSA SOLQ/BINDEX data are sited here per ADR-004; the FTI audit log carries an ADR-014 hash chain that the ADR-028 determination-input snapshots join.
- [canopy-verification API Reference](/canopy/api/canopy-verification.md): REST API reference for canopy-verification — IEVS and SAVE adapter service for federal/state income verification.
- [canopy-verification Data Model](/canopy/data-models/canopy-verification.md): PostgreSQL schema for the verification orchestration service (IEVS / SAVE / SSA SOLQ adapter callbacks + worker-portal verification work items + applicant/worker responses). 4 tables across four migration files; ADR-001 owns this schema in canopy-verification's own database.
- [canopy-web API Reference](/canopy/api/canopy-web.md): Reference for the canopy-web worker portal BFF — server-rendered pages and caseworker action endpoints.
- [canopy-web Data Model](/canopy/data-models/canopy-web.md): PostgreSQL schema for the worker-portal BFF (server-rendered Askama + htmx). 4 tables across four migration files; ADR-001 owns this schema in canopy-web's own database. canopy-web holds no domain/benefit data — only BFF infrastructure: HTTP sessions, the transactional event outbox, and the dashboard/case-detail composition-override layers (epic &51).
- [canopy-wic API Reference](/canopy/api/canopy-wic.md): REST API reference for canopy-wic — Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) eligibility, certification, and nutritional risk assessment.
- [canopy-wic Data Model](/canopy/data-models/canopy-wic.md): PostgreSQL schema for the WIC (Women, Infants, and Children) program service per 7 CFR Part 246. 7 tables across six migration files; ADR-001 owns this schema in canopy-wic's own database.
- [cargo xtask Subcommand Catalog](/canopy/tooling/xtask-catalog.md)
- [Chaos Observability Contracts: Adding a New Contract](/canopy/runbooks/chaos-observability-contract.md)
- [CLI Reference](/canopy/cli.md): All cargo xtask subcommands for Canopy development, testing, and operations.
- [CMD Change-Report Pipeline — Rollout & Operations](/canopy/runbooks/cmd-change-report-rollout.md): Deployment ordering, broker ACLs, and operational surfaces for the determination-order substrate (#1504) and the medicaid CMD subsystem (#1506), epic &77.
- [Coding Conventions (Canopy)](/canopy/coding-conventions.md): Canopy's project-specific coding-convention overlay — Askama 0.15 quirks, DHS CI runner tags, the 201-Created create-endpoint override, secure-by-default env behavior, the Axum 0.8 framework patterns, canopy-specific conventions (event-bus/FTI/sessions/secrets/composition), the pre-commit Q1–Q8 checklist, and the quality-budgets gate.
- [Completed Plans Archive](/canopy/plans/archive.md): Index of all completed implementation plans with cross-references to merge requests.
- [Configuration Reference](/canopy/configuration-reference.md): All environment variables for Canopy services with defaults and descriptions.
- [Contributor Workflow Conventions](/canopy/contributor-workflow.md): Canopy's project-specific GitLab/MR and delivery working agreements — the CI-broken force-merge procedure, phased-issue pattern, work-list ordering, doc-drift surfaces, and agent delivery defaults that overlay the universal standards.
- [Cross-Program Alerts Scoping — Cutover & Operations (#596)](/canopy/runbooks/alerts-scoping-cutover.md)
- [CSP + Alpine x-transition: modals need explicit CSS transitions](/canopy/runbooks/csp-modal-transitions.md)
- [Dashboard E2E Flake (#578)](/canopy/runbooks/dashboard-e2e-flake.md)
- [Data Export API (FOIA, audit, portability)](/canopy/runbooks/data-export.md)
- [Data Models](/canopy/data-models/index.md): Per-service PostgreSQL schema documentation. ADR-001 isolates each service's schema in its own database; cross-service references are application-level FKs only.
- [Database Backup & Restore](/canopy/runbooks/database-backup-restore.md)
- [Database Migrations](/canopy/migrations.md): How to write, ship, and recover schema migrations in canopy. Forward-only per ADR-016.
- [Demo Dataset Baselines](/canopy/plans/archive/demo-dataset-baselines/README.md): Captured orphan-ref measurements from `cargo xtask demo verify` against successive seed configurations.
- [Demo Runbook: driving the SNAP journey walkthroughs live](/canopy/runbooks/demo-runbook.md)
- [Design Reference](/canopy/design/index.md): The canonical design reference for the canopy worker + applicant portals — the published prose (decisions, tokens, schemas, hard rules) plus a map of the source-of-truth artifacts under design/.
- [Developer Guide](/canopy/developer-guide.md): Getting started with Canopy development — environment setup, architecture overview, and how-to guides.
- [Devstack Migration Snapshot & Rollback](/canopy/runbooks/devstack-migrate-snapshot.md)
- [Domain Glossary](/canopy/glossary.md): Key terms, acronyms, and regulatory references used throughout the Canopy platform.
- [Event-Delivery Protocol](/canopy/event-delivery-protocol.md): The guarantees rights-bearing events ride on — durable topology, the parked-state inbox, envelope schema versioning, binding-first deployment, and the queue-migration procedure.
- [Federal Requirements Mapping](/canopy/federal-requirements.md): Maps federal statutes and regulations to Canopy implementation for SNAP and planned programs.
- [Finalize Reconciler: stuck applicant-finalize operations](/canopy/runbooks/finalize-reconciler.md)
- [Finalize-Orphan Sweep: pre-saga orphaned PII graphs](/canopy/runbooks/finalize-orphan-sweep.md)
- [Fleet authorization-branch inventory (OIDC F1a)](/canopy/authorization-inventory.md)
- [Georgia Gateway External Partner Interface Catalog](/canopy/gateway-partner-interfaces.md): Evidence-based catalog of every external partner interface discovered in the Georgia Gateway legacy source — the mock surface for canopy (epic &79, #1527).
- [IdP Integration](/canopy/idp-integration.md): Configuring Canopy with any RFC 6749 + OIDC-discovery-compliant identity provider.
- [Implementation Guide](/canopy/implementation-guide.md): Technical specification for implementing Canopy services. Companion to the Roadmap — the Roadmap tracks what and when; this guide explains how.
- [Incident Response](/canopy/runbooks/incident-response.md)
- [Journey Walkthroughs](/canopy/walkthroughs/index.md)
- [Journey: a change reported through the TANF case counts as a SNAP report](/canopy/walkthroughs/journey-snap-cross-program-report.md)
- [Journey: A lapsed SNAP certification churns back through reapplication](/canopy/walkthroughs/journey-snap-recert-churn.md)
- [Journey: A retroactive income correction recomputes a SNAP overpayment](/canopy/walkthroughs/journey-snap-overpayment-recompute.md)
- [Journey: a TANF case closing for employment freezes SNAP into a transitional certification](/canopy/walkthroughs/journey-snap-transitional-benefits-on-tanf-closure.md)
- [Journey: An upheld SNAP hearing turns continued benefits into an overpayment](/canopy/walkthroughs/journey-snap-upheld-decision-overpayment.md)
- [Journey: SNAP address change → shelter-cost cascade → benefit recompute](/canopy/walkthroughs/journey-snap-shelter-cascade.md)
- [Journey: SNAP approval + family consent grants the children Medicaid (Express Lane)](/canopy/walkthroughs/journey-snap-ele-grant.md)
- [Journey: SNAP change of circumstances during a pending fair hearing](/canopy/walkthroughs/journey-snap-change-during-pending-hearing.md)
- [Journey: SNAP intake → determination → Notice of Action (within 30 days)](/canopy/walkthroughs/journey-snap-thirty-day-determination-noa.md)
- [Journey: SNAP mid-certification material income change → recert nudge → notice](/canopy/walkthroughs/journey-snap-income-materiality.md)
- [Journey: SNAP substantial lottery/gambling winnings → adverse action](/canopy/walkthroughs/journey-snap-lifecycle.md)
- [Journey: The 3730 periodic-report calendar closes a nonfiling case](/canopy/walkthroughs/journey-snap-periodic-report-calendar.md)
- [Jurisdiction Onboarding Runbook](/canopy/jurisdiction-onboarding.md): Step-by-step guide for deploying Canopy in a new jurisdiction. Companion to ADR-006 (Jurisdiction-Agnostic Ruleset Organization).
- [Known Issues and Lessons Learned](/canopy/known-issues.md): Operator-facing catalogue of gotchas discovered during Canopy development. Check here before debugging deployment, devstack, testing, or runtime issues.
- [Local Development](/canopy/local-dev.md): Canopy local-dev bootstrap — host dependencies, devstack bring-up, and the most-used commands.
- [NIST SP 800-53 Architecture Mapping](/canopy/nist-architecture-mapping.md): Control-by-control mapping of NIST SP 800-53 Rev 5 security controls to Canopy implementation.
- [Orchard Design System](/canopy/design/design-system.md): The durable design-system contract for the canopy worker portal — color tokens, type scale, spacing, radii, motion, voice, components, and accessibility commitments. Plugin authors and maintainers treat this as canon.
- [Plan Archive](/canopy/plans/archive/README.md): Completed plans. Audit trail, not discovery surface.
- [Plan: #1208 — async, durable, archive-aware v1 audit archival](/canopy/plans/archive/audit-archive-async.md): A durable audit_archive_runs record makes POST /v1/security/archive an async 202 enqueue with a poll endpoint; a DB-clock, explicit-column, chunked mover archives audit_events losslessly under a token-fenced lease; every FROM audit_events read is classified archive-union or designated hot-only.
- [Plan: <code>test-results/validate-report.json</code> — a trustworthy, self-describing validate report (#1253)](/canopy/plans/archive/validate-report.md): Make `cargo xtask validate` (the pre-push battery core) emit one always-present, atomically-written, self-describing per-stage report so that after `git push` a single file tells you exactly which stage failed and why — no log-grep, no stale-green trap.
- [Plan: 100% Integration &amp; E2E Test Coverage](/canopy/plans/archive/test-coverage-100-pct.md): Achieve 100% endpoint coverage across all 14 active services (137 endpoints) with happy paths, sad paths, RBAC checks, and strong assertions. Fix all weak E2E patterns and add workflow tests.
- [Plan: 100% Test Coverage — Supplemental (Sad Paths, Dark Theme, RBAC)](/canopy/plans/archive/test-coverage-100-pct-supplemental.md): Close remaining test gaps: integration sad paths (409/400), RBAC 403 tests for all services, dark theme accessibility audits, missing happy paths, and E2E action effect verification.
- [Plan: A8b — reporting least-privilege restricted DB role + credential cutover (#1456, epic &amp;73)](/canopy/plans/archive/reporting-least-privilege-role-a8b.md): Give canopy-reporting's restricted holdings a least-privilege owner/app DB-role split (ADR-004 A8b) — per-object grant matrix, SECURITY DEFINER janitor, superuser-rejecting boot guard, devstack real-login cutover — adopting the shipped chain-v2 role pattern, gated on two fleet-canopy-api prerequisites.
- [Plan: ACF-196 Expenditures Pipeline (Issue #378)](/canopy/plans/acf-196-expenditures-pipeline.md): Add the TANF cash-assistance expenditure roll-up + ACF-196 CSV export, mirroring the existing ACF-199 pipeline. Adds the missing tanf_expenditures table. Resolves #378.
- [Plan: Action/Verb Coverage Matrix (epic &amp;60)](/canopy/plans/archive/action-coverage-matrix.md): Implement ADR-031 axis 2 — a schema-validated catalogue of policy-mandated actions bound to endpoint + HTTP verb + CLI command, cross-checked against the committed OpenAPI snapshots by a staged CI gate — the audit that would have caught epic &amp;56 by construction.
- [Plan: ADH IPV-not-established reprocesses the over-issuance as a non-fraud (IHE) claim (#981)](/canopy/plans/adh-ipv-not-established-ihe-claim.md): When an Administrative Disqualification Hearing finds no IPV, reprocess the related over-issuance as a non-fraud inadvertent-household-error claim and emit the 7 CFR 273.18 demand notice — the missing behavior that unblocks scenario snap.integrity.adh-not-established-reverts-claim.
- [Plan: ADR-001 Amendment 1 — sanctioned bulk-read contracts + reporting job model (#1235, epic &amp;73)](/canopy/plans/scale-audit-adr001-bulk-read.md): Codify the cross-service bulk-read contract ADR-001 never had (keyset universe reads + :batchGet + first-class projection + an async report-run job model), enforce completeness at the single federal consumer via a typed marker, and surface the reporting-PHI/ADR-004 tenancy gap.
- [Plan: ADR-002 Amendment 1 — async/bulk determination variant (mass-change machinery) (#1237, epic &amp;73)](/canopy/plans/scale-audit-adr002-async-bulk.md): Amend the black-box determination contract with an async/system-initiated determination path (queued determination.requested, byte-identical JWS, stable idempotency, durable checkpoint/resume, one-pending-slot deferral) and a signed supersedes initial-vs-re-determination discriminator — the contract keystone the #1213 COLA driver and #1133 enrollment apply-semantics build against.
- [Plan: ADR-003 Compliance Remediation](/canopy/plans/archive/adr-003-compliance-remediation.md): Extract all hardcoded federal regulations from Rust code into jurisdiction.toml and federal JSON rulesets
- [Plan: ADR-004 Amendment 1 — authorize canopy-reporting PHI tenancy (T-MSIS / CMS-416) (#1250, epic &amp;73)](/canopy/plans/archive/scale-audit-adr004-reporting-phi-tenancy.md): Close the shipped compliance gap ADR-001 Amendment 1 §B8 surfaced — canopy-reporting persists person-level T-MSIS PHI at rest but is absent from ADR-004's isolation map — by authorizing it as a restricted-data consumer scoped to the T-MSIS/CMS-416 federal extracts, minimum-necessary, under the Pub 1075 §4 control set with encryption at rest, a restricted role, and facility-adopted audit rows (post-Amendment-2).
- [Plan: ADR-004 SSA / IEVS / FTI Authorization Audit](/canopy/plans/archive/adr-004-ssa-authorization-audit.md): Verify — and enforce via a persistent CI gate — that SSA SOLQ/BINDEX, IEVS, and FTI data flow only to services legally authorised to receive each category per ADR-004. Converts the 2026-04-18 review's "unverified" finding into an always-green (or always-noisy) check.
- [Plan: ADR-005 Graceful-Degradation Verification](/canopy/plans/archive/adr-005-graceful-degradation-verification.md): Prove — via explicit per-capability tests and a conformance matrix — that canopy-eligibility degrades gracefully when optional program services are not deployed, per ADR-005. Converts the current "deployment-profiles-event-wiring.adoc Step 3 Complete" claim into verifiable coverage and closes the 2026-04-18 review finding.
- [Plan: ADR-011 Hardcoded Policy Values Sweep](/canopy/plans/archive/adr-011-hardcoded-policy-values-sweep.md): Sequence the ~90 findings from the 2026-04-20 hardcoded-policy-values audit into phased, executable work. Phase 1 raises a CI floor so new violations cannot land; Phase 2 does the two highest-impact consolidations; Phases 3-4 are parallelizable per-ruleset / per-reporting-domain work; Phase 5 is the long tail of single-service externalizations. Every step is scoped to one MR and cites its source finding by file:line.
- [Plan: ADR-014 chain-v2 — scale-safe, tamper-evident audit hash chains (#1236, epic &amp;73)](/canopy/plans/scale-audit-adr014-chain-v2.md): Replace the timestamp-ordered, full-walk audit/FTI hash chains with chain-v2 — a hash-bound sequence + durable head, sharded for write scale, incrementally verified, and anchored to an external notarized authority — via a coordinated-downtime reset (pre-1.0, no back-compat).
- [Plan: ADR-041 — configurable structured logging + jurisdiction-owned field redaction; retire the FTI-special hash chain](/canopy/plans/adr-041-configurable-logging-redaction.md): The implementation plan realizing xref:../adrs/adr-041-configurable-logging-field-redaction.adoc[ADR-041] — a general configurable structured-logging facility with per-field jurisdiction-owned redaction in every service, and the sequenced, gated retirement of the FTI-audit hash chain (ADR-014) + chain-v2 machinery. Decision-contract level; byte-level design is authored per child.
- [Plan: Adverse Actions, Hearings &amp; the 273.15(k)/PAMMS Pipeline (epic &amp;72)](/canopy/plans/archive/adverse-action-pipeline.md): Make adverse actions first-class — an adverse_action_id spine from decision through notice, appeal, stay, enactment, and continued-benefits assessment — with the policy layer rebuilt from the Georgia policy cache and the event substrate hardened to carry rights-bearing flows.
- [Plan: Applicant intake + verification (Dioxus 0.7+ canopy-portal)](/canopy/plans/archive/applicant-intake-and-verification.md): Dioxus 0.7+ applicant portal + document upload + verification round-trip + lost-credential recovery. Plan 3 of the SNAP+TANF+ELE demo-video three-plan split.
- [Plan: Application Intake (canopy-applications)](/canopy/plans/archive/application-intake.md): Implement canopy-applications as the ACA §1413 single-streamlined-application service — the entry point for all program applications in Canopy.
- [Plan: Applications — Authorized Representatives CRUD (Issue #401)](/canopy/plans/archive/applications-authorized-representatives.md): Add CRUD endpoints for the existing authorized_representatives table in canopy-applications. The table and FK exist; only the API and store layer are missing. Resolves #401.
- [Plan: Attributed Fact-Mutation Events — T1-5 (#673, epic &amp;56)](/canopy/plans/archive/worker-fact-authoring-t1-5-attributed-events.md): Emit attributed income/asset/expense .claimed + income.closed events from the canopy-persons write handlers via the ADR-018 transactional outbox, carrying typed author/claim_source/claim_status/before/after in the payload; index them correctly in the canopy-security audit parser.
- [Plan: Audit-Events Hash-Chain Verification Tests](/canopy/plans/archive/fti-audit-hash-chain-test.md): Close the test-coverage gap on canopy-security's `audit_events` hash chain — append N events and verify, tamper with a row and assert the chain breaks at the right place, exercise the advisory-lock serialization under concurrency. Corrects the original "FTI Audit Hash-Chain Verification" framing, which conflated two separate audit logs.
- [Plan: Backlog Cleanup Campaign — clear the genuine loose ends](/canopy/plans/backlog-cleanup-campaign.md): Ship the genuinely-orphaned standalone-backlog "loose ends" as ~24 themed, dependency-ordered MRs; close what is already done; epic-group the rest. Rev. 2 after an external review removed issues already owned/deferred by active plans.
- [Plan: battery wave 2 — lane partition, topology helpers, run-scoped cleanup, honest coverage (#1377/#1381/#1379/#1382, epic &amp;76)](/canopy/plans/archive/battery-wave2.md): Partition every test lane on an explicit infra_tests classification, centralize test-topology URL resolution, make ephemeral-schema cleanup run-scoped and evidence-gated, and rebaseline coverage honestly — three stacked MRs.
- [Plan: BFF Edge Security — Working Per-IP Rate Limit, HSTS, and Session-Fixation Defense](/canopy/plans/archive/bff-edge-security-hardening.md): Fix the silently-broken per-IP rate limiter (it has been a single global bucket across all services since inception because ConnectInfo was never wired into `ApiServer::serve`), add HSTS + per-IP limiting to the canopy-web worker portal, and rotate the session ID + CSRF token on authentication to defeat session fixation (#625, #550).
- [Plan: BFF Token Refresh (Issue #411)](/canopy/plans/archive/bff-token-refresh.md): Make canopy-web's BFF → upstream service-to-service calls survive a worker's access-token TTL by capturing + using the OIDC refresh_token. Builds on the OIDC-pluggability refactor (#422 / oidc-pluggability-refactor.adoc), so the refresh path uses a discovered token endpoint, not hardcoded Keycloak paths. Resolves #411.
- [Plan: Build + verify the worker SNAP+TANF+ELE demo workflow (+ applicant closure)](/canopy/plans/archive/demo-workflow-build-and-e2e.md): Close the real build gaps in the worker SNAP+TANF+ELE determination/NOA/ELE/queue-lifecycle workflow, then prove the whole demo (worker + applicant) end-to-end with E2E. Plan 4 of the SNAP+TANF+ELE demo-video split.
- [Plan: Canopy CLI](/canopy/plans/archive/canopy-cli.md): Implement the canopy CLI binary with full API parity per ADR-007. The CLI is a thin reqwest client over the REST API with profile-based config, Keycloak auth, and table/json output.
- [Plan: canopy-api hardening + canopy-mq consumer inbox (Issues #437 #433)](/canopy/plans/canopy-api-mq-hardening.md): Port CRAIG's production hardening into canopy-api (livez/readyz split, HSTS, /admin/* family) and canopy-mq (durable consumer-side `event_inbox`, transactional handler API, replay endpoint). Coupled because the admin replay endpoint surface (canopy-api #437) and the replay logic (canopy-mq #433) are interdependent. Pre-1.0; no back-compat shims. Resolves #437 + #433.
- [Plan: canopy-caps List Endpoints + Authorization Field Reconciliation](/canopy/plans/archive/canopy-caps-list-endpoints.md): Add the two GET list endpoints the worker portal's CAPS case-detail tabs need (`/determinations?household_id=X` and `/determinations/{id}/authorizations`), and reconcile the field-name mismatch between `CapsAuthorization` and the Askama template (`authorization_status` vs `care_type`, `rate_cents_per_hour` vs `rate_display`, `end_date` vs `expiration_date`). Unblocks the two Tier 5.5 canopy-web CAPS gaps.
- [Plan: canopy-cli ADR-007 Parity Catchup (Issue #385)](/canopy/plans/archive/canopy-cli-adr-007-catchup.md): Add household, income, asset, interview, and determine root-level subcommands to canopy-cli to satisfy ADR-007's CLI parity mandate. The API has all of them; the CLI is missing them. Resolves #385.
- [Plan: canopy-common fail-closed encryption-mode guard (Issue #438)](/canopy/plans/archive/canopy-common-fail-closed-encryption-guard.md): Move the production-vs-development encryption-key guard from `canopy-persons/main.rs` into `canopy-common::crypto` as a typed function so every future ADR-017 consumer inherits the fail-closed posture. Resolves #438.
- [Plan: canopy-enrollment Household-Scoped Issuance Listing](/canopy/plans/archive/canopy-enrollment-household-issuances.md): Add `GET /v1/households/{household_id}/issuances?from=...&amp;to=...` so canopy-appeals can compute real continued-benefits overpayments instead of the current `monthly_benefit / 30 * days` placeholder at `services/canopy-appeals/src/continued_benefits.rs:29`. Unblocks the Tier 5.5 continued-benefits gap.
- [Plan: canopy-identity contract + service-identity migration (Issue #424, ADR-019)](/canopy/plans/service-identity-and-on-behalf-of.md): Replace JWT pass-through across canopy services with the canopy-identity contract. canopy services depend on a per-stack OIDC issuer; operators choose any compliant backend. X-Canopy-Actor for on-behalf-of. Implements ADR-019. Resolves #424.
- [Plan: canopy-mq Lapin Auto-Reconnect (Issue #313)](/canopy/plans/archive/canopy-mq-lapin-auto-reconnect.md): Add Connection-level reconnect supervisor + bounded in-memory publish buffer + subscriber re-attach to canopy-mq, so the canopy-* service mesh survives RabbitMQ restarts without losing events. Resolves https://gitlab.com/gadhs/application/eligibility/canopy/-/issues/313[#313].
- [Plan: canopy-mq Persistent Outbox (Issue #388, ADR-018)](/canopy/plans/archive/canopy-mq-persistent-outbox.md): Replace the bounded in-memory VecDeque in canopy-mq with a per-service event_outbox table so events survive broker outages and process restarts. Implements ADR-018. Resolves #388.
- [Plan: canopy-persons Batch Expansion Endpoint — Eliminate the N+1 Fan-Out](/canopy/plans/archive/persons-batch-expansion-endpoint.md): Add a set-based household (and optionally person) batch-expansion endpoint to canopy-persons so the income tab, eligibility orchestrator, and CMS-416 reporter stop doing per-member N+1 HTTPS fan-out. Built on the existing `ANY($1)` batch idiom with Rust-side SSN decryption — NOT the single JSON-aggregation query the issue prescribes.
- [Plan: canopy-persons Income Mutation Endpoints (Issue #446)](/canopy/plans/archive/canopy-persons-income-mutations.md): Add `PUT /v1/persons/{id}/income/{income_id}` and `DELETE /v1/persons/{id}/income/{income_id}` to canopy-persons. Prereq for #409 (canopy-web income editing UI). Resolves #446.
- [Plan: canopy-portal Fluent i18n (Issue #381)](/canopy/plans/archive/canopy-portal-fluent-i18n.md): Replace the LocaleManager TODO stub in canopy-portal with a real Fluent-bundle implementation supporting en + es. Establishes i18n plumbing per ADR-008. Resolves #381.
- [Plan: canopy-seed CAPS + WIC Fixtures &amp; Playwright E2E Follow-up](/canopy/plans/archive/canopy-seed-caps-wic-fixtures.md): Extend canopy-seed to generate deterministic CAPS + WIC determinations, authorizations, and nutritional-risk assessments; land the two Playwright E2E specs (`caps.spec.ts`, `wic.spec.ts`) deferred from Tier 2A (MRs !102 and !103).
- [Plan: canopy-store upload validation — full port (Issue #435)](/canopy/plans/canopy-store-upload-validation.md): Port CRAIG's upload-validation pipeline into canopy-store — magic-byte verification, sha256 integrity hash, Unicode filename normalization, RFC 6266 Content-Disposition helper, AV scanner trait, and storage-vs-DB reconciliation. Hardens the object store now in zero-trust posture before user-upload endpoints land. Resolves #435.
- [Plan: canopy-tanf Work Activities List Endpoint + Aggregation](/canopy/plans/archive/canopy-tanf-work-activities-list.md): Add a read path for `tanf_work_activities` so reporting and the worker portal can retrieve per-activity hour totals. Replaces the hardcoded `30`/`20` placeholders at `services/canopy-reporting/src/reporting/tanf.rs:81` and unblocks the ACF-199 WPR calculation listed in `tanf-federal-reporting.adoc`'s errata.
- [Plan: canopy-test-lib world-class testing port (closes #436)](/canopy/plans/archive/canopy-test-lib-port.md): Port CRAIG's contracts-crate + typed-client + fault-injection + multi-replica fixture pattern into canopy-test-lib, extended with 7 world-class adds (snapshot testing, proptest, time mocking, per-test DB isolation, PDF goldenfile, coverage gating, observability assertions). Per-MR scope grows; phase boundaries unchanged.
- [Plan: canopy-web — Wire Existing canopy-persons Endpoints for Income and Names](/canopy/plans/archive/canopy-web-persons-wiring.md): The Tier 5.5 "truncated UUIDs" and "program-specific income display" gaps are not blocked on new upstream endpoints — canopy-persons already exposes `GET /v1/persons/{id}` (with `first_name`, `last_name`, `disability_status`) and `GET /v1/persons/{id}/income`. This plan wires those existing endpoints through canopy-web's case-detail views and removes the stale TODO at `services/canopy-web/src/api/case_detail.rs:800` that claims no GET endpoint exists.
- [Plan: canopy-web Income Editing UI (Issue #409)](/canopy/plans/archive/canopy-web-income-editing-ui.md): Add htmx-based add/edit/remove income forms to canopy-web's case-detail income tab. Depends on #446 (canopy-persons PUT/DELETE income endpoints) landing first. Resolves #409.
- [Plan: canopy-wic List Endpoints for Determinations and Nutritional-Risk Assessments](/canopy/plans/archive/canopy-wic-list-endpoints.md): Add `GET /v1/determinations?household_id=X` and `GET /v1/nutritional-risk-assessments?person_id=X` on canopy-wic so the worker portal's WIC case-detail tabs can show live data. Unblocks the two Tier 5.5 canopy-web WIC gaps.
- [Plan: CAPS Eligibility (canopy-caps)](/canopy/plans/archive/caps-eligibility.md): Implement CAPS (Childcare and Parent Services / CCDF) eligibility determination in canopy-caps with income evaluation against SMI thresholds, activity requirements, copayment determination, and provider authorization.
- [Plan: CAPS Provider Registry (Issue #396)](/canopy/plans/archive/caps-provider-registry.md): Replace the bare TEXT provider_id in caps_applications + caps_authorizations with a real caps_providers table and FK constraint. Pre-1.0 forward-only migration drops the old columns. Resolves #396.
- [Plan: Caseload-trend daily rollup + cache_ttl_seconds enforcement (#1218, epic &amp;73)](/canopy/plans/archive/caseload-trend-rollup.md): Replace the per-render 12-bucket × ~1M-cert caseload-depth aggregate with a window-fenced daily rollup (honest 503 before first materialization, 48h freshness gate), make the applications inflow twin sargable, and enforce the ratified-but-ignored Plugin.toml cache_ttl_seconds via a bounded panel-data TTL cache with per-item composition-layer overrides.
- [Plan: Caseworker Workflow Guidance Templates](/canopy/plans/archive/workflow-guidance-templates.md): Create PAMMS-derived workflow templates per ADR-011 Layer 4. Templates inform but never constrain worker portal actions.
- [Plan: chain-v2 append transport — durable staging, per-shard drainer, FTI shard-order primitive (#1207, epic &amp;73)](/canopy/plans/archive/chain-v2-append-transport.md): The chain-v2 append transport: durable audit-event staging with a structurally-leased, bounded, rotating per-shard drainer in canopy-security, plus the FTI multi-shard in-transaction append primitive for canopy-tanf/-medicaid — landed dormant ahead of the #1279 cutover.
- [Plan: chain-v2 external anchor authority — enumerable transparency frontier, signed manifests, verifier confirmation (#1278, epic &amp;73)](/canopy/plans/archive/chain-v2-anchor-authority.md): Makes chain-v2 anchoring REAL: an S3-backed, Object-Locked, INDEPENDENTLY-ENUMERABLE external notarized-anchor authority (the tamper-evident high-water mark a privileged-DB attacker cannot roll back), a dedicated emitter deployable that signs and conditionally-stores head manifests, the verifier's ordered/linked/fenced confirmation with version-pinned external reads, the RFC 7638 anchor-key identity, per-jurisdiction ruleset retention, and ADR-014 Amendment 10 ratifying the authority selection.
- [Plan: chain-v2 external anchor authority — WORM-tier trust model (#1278, epic &amp;73)](/canopy/plans/chain-v2-anchor-worm.md): The corrected byte-level implementation plan for the chain-v2 external notarized-anchor authority, on the WORM capability-tier trust model ratified by ADR-014 Amendment 11 — replacing the deferred v2 "enumerable transparency frontier" design.
- [Plan: chain-v2 substrate — schema, KAT vectors, restricted roles, empty-genesis install (#1246, epic &amp;73)](/canopy/plans/archive/chain-v2-substrate.md): The storage + cryptographic substrate for chain-v2 (ADR-014 Amendments 5–6, C1–C8): the canopy-chain crate (RFC 8785-conforming canonicalization, hash, routing, manifest encoding, independently-seeded frozen KATs), the dormant v2 schema in the three chain-owning databases, the migration/runtime identity split that makes C8's restricted roles real, and the operator-driven empty-genesis install.
- [Plan: chain-v2 verifiers — family-leased tail + scrub engine, token-confidential fencing, the unified chain namespace, citation attestation (#1205 audit, #1206 FTI, epic &amp;73)](/canopy/plans/archive/chain-v2-verifiers.md): The chain-v2 verification children: a shared bounded batch-walk verify engine in canopy-common covering the WHOLE hashed preimage over archive ∪ live in single-snapshot reads, a per-family FAMILY lease ordering every pass (manifest + census + shard loops + manual jobs under one holder), token-confidential DB-enforced fencing, the C6 status state machine with staging/inbox/DLQ backlog inputs and proven health stamps, the unified /v1/security/chain/* wire surface with CLI parity, durable token-claimed verify jobs, the JSON number fence closing #1285, and the event-specific citation attestation — landed dormant ahead of the #1279 cutover.
- [Plan: CMD change-report pipeline — facts → order → signed re-determination (#575, epic &amp;77)](/canopy/plans/archive/cmd-change-report-pipeline.md): Root-cause fix for the dead CMD ingest: the worker CMD action writes the authoritative disability fact through canopy-persons, medicaid stages a typed determination.requested Order, eligibility executes it on a durable idempotent order substrate (ADR-002 A1 D1/D4/D5/D6), and the signed change-report re-determination settles the CMD row under a real 10-day clock.
- [Plan: CMS-416 EPSDT Pipeline (Issue #380)](/canopy/plans/cms-416-epsdt-pipeline.md): Replace the CMS-416 stub at canopy-reporting/medicaid.rs:269-349 with real EPSDT screening data, sourced from a new epsdt_screenings table in canopy-medicaid. Resolves #380.
- [Plan: CMS-64 Expenditure Aggregation (Issue #379)](/canopy/plans/cms-64-expenditure-aggregation.md): Replace the enrolled-count proxy in canopy-reporting's CMS-64 path with real Medicaid expenditure aggregation, sourced from a new medicaid_expenditures table. Resolves #379.
- [Plan: Code Quality Audit Remediation](/canopy/plans/archive/code-quality-audit-remediation.md): Fix all issues identified by the 6-agent codebase audit: unify competing traits, standardize error handling, extract shared utilities, update stale documentation, and eliminate code duplication.
- [Plan: Code Quality Remediation](/canopy/plans/archive/code-quality-remediation.md): Address code quality findings from codebase audit: structured error types, expect() propagation, silent error discards, serde_json::Value typing, and function decomposition.
- [Plan: Code-Quality Gating](/canopy/plans/code-quality-gating.md): Stand up canopy's enforced code-quality gate (ADR-030) — a strict centralized `[workspace.lints]` posture, a 40-line function ceiling, and a monotonic `quality-budgets` debt ratchet, at least as strict as craig — by tiering the lint families on (each tier: enable at deny, grandfather existing violations via `#[expect(reason)]`, allow-list &gt;10-emission lints per the ADR-031 pattern), then burning the grandfathered debt and the review-surfaced hotspots down. Phase A (M1–M6) lands the gate at status quo BEFORE the &amp;56/&amp;58 feature work; Phase B burns down during/after it.
- [Plan: Concurrency-safe, recoverable applicant-draft finalization](/canopy/plans/archive/concurrency-safe-applicant-finalization.md): Make canopy-applications draft finalization concurrency-safe and crash-recoverable by moving idempotency to the persons layer (a transactional receipt), governing recovery with a linearizable draft-row-locking saga, compensating partial graphs by crypto-shred (never a hard delete), and holding persons events until the application commits. Introduces ADR-038.
- [Plan: Constraint-Driven Generative Seed Harness (ADR-033, re-specs #716)](/canopy/plans/generative-seed-harness.md): Converge the demo/default seed split into one constraint-driven generative engine — random-but-valid data under domain invariants + scenario preconditions resolved against the policy layer by parameter name, endpoint-driven journey prerequisites, three-tier time control, per-program registries, and a self-auditing harness.
- [Plan: Containerized Integration Tests](/canopy/plans/archive/containerized-integration-tests.md): Move the Rust integration test runner into the docker network so tests reach services by compose service name, matching production parity and removing host.docker.internal / localhost-port-forward fragility on Linux Docker Engine.
- [Plan: Crate Quality Parity](/canopy/plans/archive/crate-quality-parity.md): Add doc comments to all public APIs in shared crates, expand canopy-auth defensive test coverage, and modularize canopy-test-lib. Security headers, rate limiting, CORS, and newtype IDs already complete.
- [Plan: cross-process chaos observability harness (#480) + contested-environment parity (epic &amp;80)](/canopy/plans/cross-process-chaos-observability-harness.md)
- [Plan: cross-program alerts scoped by household assignments (#596)](/canopy/plans/cross-program-alerts-scoping.md)
- [Plan: Cross-Program Functional Testing](/canopy/plans/archive/cross-program-functional-testing.md): Complete TSNAP subscriber wiring, Express Lane event publishing, and deliver E2E tests proving cross-program event chains (TSNAP, TMA, Express Lane) work end-to-end against running devstack services.
- [Plan: Cross-Program Integration Framework](/canopy/plans/archive/cross-program-integration.md): Implement PAMMS-documented cross-program interactions: TSNAP, TMA, Express Lane Eligibility, TCOS categorical eligibility, and mandatory referral workflows.
- [Plan: Demo Dataset Seed Profile](/canopy/plans/archive/demo-dataset-seed.md): Hand-curated, deterministic seed dataset that makes every worker-portal dashboard panel render coherent, click-through-traceable data for stakeholder demos.
- [Plan: Demo-ready, live-verified, dual-persona journey walkthroughs](/canopy/plans/archive/demo-ready-journeys.md): Make every published SNAP journey walkthrough a complete, live-verified, dual-persona (applicant + caseworker) manual script, plus a Demo Runbook, for a live side-by-side demo.
- [Plan: Demo-Review Hardening (Epic &amp;57)](/canopy/plans/demo-review-hardening.md): Land the implementable findings from the validated external UI/UX/demo-sprint review — household-scoped Activity-tab audit (the one prod-blocker), the multi-program case-search label/status mismatch, the verification-gate fail-safe, and the program-badge CSS class — and record the one finding that is genuinely blocked on epic &amp;56.
- [Plan: Deployment Profiles and Event Bus Wiring](/canopy/plans/archive/deployment-profiles-event-wiring.md): Implement ADR-005 Docker Compose deployment profiles (snap-only, tanf-only, medicaid-chip, etc.), xtask --profile flag, capability flags for optional services, and wire the event bus publishers that all domain plans depend on.
- [Plan: Determination Envelope Normalisation (Issue #387)](/canopy/plans/archive/determination-envelope-normalisation.md): Introduce a shared `SignableDetermination` envelope so all 5 program services sign a byte-stable wire schema and the orchestrator's signature verification stops quarantining Medicaid determinations. Resolves #387.
- [Plan: Deterministic Seed Data Tool](/canopy/plans/archive/seed-data-tool.md): Standalone Rust binary generating FK-consistent seed data across all 11 databases + TypeScript manifest for Playwright E2E tests. Jurisdiction-neutral, deterministic from seed parameter.
- [Plan: Devstack Staleness Guard](/canopy/plans/archive/devstack-staleness-guard.md): Automatic staleness detection and minimum-action refresh for xtask devstack commands
- [Plan: Directive Compliance Remediation](/canopy/plans/archive/directive-compliance-remediation.md): Address all 89 findings from the 33-agent directive compliance audit. Every finding gets a verification step regardless of assumed validity — trust the audit, verify everything.
- [Plan: Disability Status on Persons](/canopy/plans/archive/disability-status-persons.md): Add disability_status column to persons table to support SNAP ABAWD exemptions, certification period length, and elderly/disabled shelter deduction rules.
- [Plan: Documentation Completeness](/canopy/plans/documentation-completeness.md): Scaffold and populate 17 missing documentation categories identified by cross-project audit: user guides, API reference, operations, data models, state machines, design mockups, configuration reference, troubleshooting, federal requirements mapping, NIST controls, ATO readiness, screenshots, CLI reference, known issues, security operations, UI module map, and user testing guide.
- [Plan: Documentation Pass — UAT Readiness for All Audiences](/canopy/plans/archive/documentation-pass.md): Create and update all documentation required for SNAP UAT across 6 audiences: developers, state evaluators, security auditors, caseworkers, operators, and applicants. Modeled after CRAIG's documentation patterns.
- [Plan: ELE 1-year-flag expansion (SNAP+TANF demo video)](/canopy/plans/archive/ele-1-year-flag-extension.md): Express Lane Eligibility 1-year durable flag + renewal scheduler + JDM rulesets + identity hero badge in canopy-medicaid. Plan 2 of the SNAP+TANF+ELE demo-video three-plan split.
- [Plan: Eligibility Orchestrator](/canopy/plans/archive/eligibility-orchestrator.md): Implement canopy-eligibility as the determination orchestrator that receives applications, dispatches to program services in parallel, verifies signed determinations, applies the federal eligibility hierarchy, and publishes combined results per ADR-002.
- [Plan: Eligibility Request Idempotency + Composition Graceful Degradation](/canopy/plans/archive/eligibility-and-composition-correctness.md): Two backend correctness fixes — make the eligibility-request lifecycle idempotent under concurrency and failure (#588), and make the dashboard/case-detail composition loader degrade gracefully on unknown override-layer slugs instead of 500-ing the whole surface (#658).
- [Plan: Enforce write-role authorization on every case mutation (#1004)](/canopy/plans/archive/write-authz-enforcement.md): Close the canopy-web write-authorization gaps, make role resolution fail closed, sweep the UI to the same predicate, and add a route-inventory guard so it cannot regress.
- [Plan: Enrollment Household RBAC (Issue #408)](/canopy/plans/archive/enrollment-household-rbac.md): Restrict the household-scoped issuance list in canopy-enrollment to assigned caseworkers (or supervisor-or-above) by introducing a household_assignments table in canopy-applications and gating the `GET /v1/households/{id}/issuances` handler on an assignment lookup. Closes a Pub 1075 §9.3.1 least-privilege gap. Resolves #408.
- [Plan: Enrollment Partial-Month Retention (Issue #407)](/canopy/plans/archive/enrollment-partial-month-retention.md): Extend snap_enrollments with partial_retention + retained_through so mid-month closures surface that already-issued benefits stay with the household per PAMMS 2415. Resolves #407.
- [Plan: Ephemeral Port Allocation](/canopy/plans/archive/ephemeral-port-allocation.md): Replace hardcoded host port mappings in devstack with OS-assigned ephemeral ports so multiple canopy instances can run simultaneously without conflicts
- [Plan: Event Bus Data Enforcement](/canopy/plans/archive/event-bus-enforcement.md): Enforce that event payloads published to canopy.events never contain restricted federal data (FTI, IEVS, SSN, HIPAA fields) through compile-time, runtime, and CI lint layers.
- [Plan: Exchange partner architecture + Gateway-derived interface mocks (epic &amp;79)](/canopy/plans/gateway-partner-interface-mocks.md): Grow canopy-exchange into the blind-broker partner integration layer (ADR-045) and build wire-faithful devstack mocks for the catalogued Georgia Gateway partner interfaces, SNAP-first. Retires the fabricated-data adapters in canopy-verification and canopy-enrollment.
- [Plan: Fair Hearings and Appeals](/canopy/plans/archive/fair-hearings-appeals.md): Implement canopy-appeals with fair hearing request intake, continued benefits logic, 90-day decision clock, and timeline enforcement. SNAP hearings are in scope for UAT.
- [Plan: Federal Parameter Data Completion](/canopy/plans/archive/federal-parameter-completion.md): Update all federal parameter files to FY2026 values per PAMMS Appendix A and FNS published tables. Add missing data files for conversion factors, proration tables, and BOI tables.
- [Plan: FFE/SBM Account Transfer (canopy-exchange)](/canopy/plans/ffe-account-transfer.md): Implement inbound and outbound account transfers between Canopy and the health insurance exchange (Georgia Access SBM-FP / HealthCare.gov) per 42 CFR 435.1200. This is a SKELETON plan — detailed ACPT XML field mappings will be added when Georgia Access integration documentation is available.
- [Plan: Frequency-Normalization Foundation (#861, epic &amp;63)](/canopy/plans/archive/frequency-normalization.md): One shared Decimal frequency→monthly converter (canopy_reference::money), factors sourced from the cited federal ruleset, and normalization moved to the eligibility orchestrator's input-building seam so every program's monthly_amount contract holds.
- [Plan: FTI Audit Logging](/canopy/plans/archive/fti-audit-logging.md): Implement IRS Publication 1075 compliant FTI audit logging in canopy-tanf and canopy-medicaid, with direct database writes (not via the event bus) and independent availability for IRS on-site inspection.
- [Plan: generation-published report runs + bulk extract contracts (#1202 + #1203, epic &amp;73)](/canopy/plans/archive/report-run-generations.md): Durable report_runs jobs publish into atomic output generations; the universe is materialized per run; seven read-only batch endpoints kill the serial N+1; a closed skip taxonomy makes every dropped or degraded row countable.
- [Plan: Input Validation Hardening](/canopy/plans/archive/input-validation-hardening.md): Fix SSN regex validation, expense frequency normalization, program name validation, and submitted_by_role validation across services.
- [Plan: Intentional Program Violations (IPV) and Administrative Disqualification Hearings (ADH)](/canopy/plans/archive/ipv-disqualification.md): Implement IPV case tracking, ADH workflow, disqualification penalty enforcement, and cross-program prior offense counting in canopy-appeals. Covers agency-initiated disqualification proceedings as required by 7 CFR 273.16.
- [Plan: JDM Ruleset End-to-End Happy-Path Tests](/canopy/plans/archive/jdm-ruleset-happy-path-tests.md): Add one end-to-end happy-path test per active JDM ruleset (12 rulesets across SNAP, TANF, Medicaid MAGI/Non-MAGI/CHIP/hierarchy, CAPS, WIC) exercising canopy-rules over HTTP with a canonical seed context per program. Replaces the current "smoke tests only" gap flagged by the 2026-04-18 test audit.
- [Plan: JDM Ruleset Schema Rewrite](/canopy/plans/archive/jdm-ruleset-rewrite.md): Rewrite every JDM ruleset file in `rulesets/` against zen-engine 0.55's actual schema, fix pre-existing rules-client bugs in canopy-tanf/medicaid, migrate canopy-medicaid off inline Rust evaluators per ADR-003, and add a CI gate that prevents schema regression.
- [Plan: JWS Determination Signing Infrastructure](/canopy/plans/archive/determination-signing.md): Implement the ECDSA P-256 JWS signing and verification infrastructure that enables the black-box determination contract defined in ADR-002.
- [Plan: Layered Config + Encrypted Secrets Migration (ADR-012 + ADR-017)](/canopy/plans/archive/secret-and-config-migration.md): Coordinated per-service migration of canopy's env-var sprawl into layered YAML config files (ADR-012) plus SOPS+age-encrypted secrets at rest (ADR-017). Supersedes #291 and #346.
- [Plan: Library-API Docs Burn-down (#463)](/canopy/plans/archive/library-api-docs-burndown.md): Finish #463 — roll #![warn(missing_docs)] + #![warn(unreachable_pub)] across the in-scope library crates and document/fix every emission, as an epic-grouped per-crate-batch MR campaign (epic &amp;68).
- [Plan: Medicaid COA Phase B — Q-Track (QMB/SLMB/QI-1) + Family Medically Needy Spenddown](/canopy/plans/archive/medicaid-coa-phase-b-q-track-spenddown.md): Implement full income/resource evaluation for Q-Track COAs (QMB, SLMB, QI-1) and Family Medically Needy spenddown (FM-MN, Pregnant-MN) in the medicaid-non-magi ruleset, replacing the age/disability-only stub expressions.
- [Plan: Medicaid COA Phase C — TMA (Transitional Medical Assistance)](/canopy/plans/archive/medicaid-coa-phase-c-tma.md): Implement TMA COA evaluation end-to-end: tanf.case_closed event publishing, tma_coverage migration and store layer, MAGI ruleset expression, Phase 1/Phase 2 income gating in eligible_fn, and subscriber wiring.
- [Plan: Medicaid COA Phase D — ABD FBR SSA-Linked COAs](/canopy/plans/archive/medicaid-coa-phase-d-abd-fbr-ssa.md): Implement Pickle, DAC, Disabled Widow, Widow 60-64, and Former SSI Disabled Child COAs with SSA data flags from canopy-verification, non-MAGI ruleset expressions, and orchestrator data flow wiring.
- [Plan: Medicaid COA Phase E — ABD Non-FBR Waivers + AMN](/canopy/plans/archive/medicaid-coa-phase-e-abd-waivers-amn.md): Implement 9 ABD non-FBR COAs (EDWP, NOW Waiver, COMP Waiver, TEFRA/Katie Beckett, Hospice, Hospital, ICWP, QDWI, AMN) with waiver slot gating, institutional criteria, and ABD medically needy spenddown in the non-MAGI ruleset.
- [Plan: Medicaid COA Phase F — Foster Care, Adoption, Chafee](/canopy/plans/archive/medicaid-coa-phase-f-foster-adoption-chafee.md): Implement FosterCare, Adoption, and Chafee COAs in the non-MAGI ruleset with boolean flag gating, age restriction for Chafee, and hierarchy wiring.
- [Plan: Medicaid Eligibility Service](/canopy/plans/archive/medicaid-eligibility.md): Implement canopy-medicaid as the Medicaid/CHIP program service with CMD cascade, MAGI/non-MAGI dual-track budgeting, 30+ COA evaluations per PAMMS Chapter 2100, MAGI budget group composition per PAMMS 2610, MAGI budgeting per PAMMS 2669, PeachCare premium schedule, Pathways work requirements, FTI/FDSH/HIPAA compliance, and EE15 hierarchy assignment.
- [Plan: Medicaid JDM Completion (Issue #386)](/canopy/plans/archive/medicaid-jdm-completion.md): Move three remaining pieces of Medicaid logic from Rust to JDM rulesets — CMD cascade priority, TMA phase, and denial-reason synthesis — to satisfy ADR-003 ruleset-as-data. Resolves #386.
- [Plan: Medicaid Orchestrator EE15 Hierarchy Wiring](/canopy/plans/archive/medicaid-orchestrator-ee15-wiring.md): Propagate the EE15 `assigned_coa` that canopy-medicaid already computes internally through the orchestrator into `CombinedResult.medicaid_assigned_group`. Closes the orchestrator.rs:565 TODO that survived Medicaid COA Phase F.
- [Plan: Medicaid Resource/Medical Aggregation (#856, epic &amp;63)](/canopy/plans/archive/medicaid-resource-medical-aggregation.md): Aggregate the Medicaid MN-spenddown medical_expenses_monthly from the orchestrator-threaded ctx.expenses and the Q-Track countable_resources from ctx.assets (conservative SSI category projection) in the determination handler.
- [Plan: Medicaid SSA Orchestrator Wiring (Issue #384)](/canopy/plans/archive/medicaid-ssa-orchestrator-wiring.md): Wire canopy-eligibility's orchestrator to fetch SSA SOLQ/BINDEX records from canopy-verification and forward them into canopy-medicaid's non-MAGI dispatch payload, so the ABD FBR SSA-linked COAs (Pickle, DAC, Disabled Widow, Widow 60-64, Former SSI Disabled Child) and the related waiver/institutional COAs can evaluate against real SSA data rather than orchestrator-side `None` defaults. Deliverable (a) ships the full plumbing against the NoopSolqAdapter; deliverable (b) (real SSA cutover) stays Blocked on CMA execution. Resolves #384.
- [Plan: Medicaid/CHIP Federal Reporting — T-MSIS, CMS-64, CMS-416 (canopy-reporting)](/canopy/plans/archive/medicaid-federal-reporting.md): Enrich T-MSIS monthly eligibility extraction with person demographics and determination-derived fields, implement CMS-64 enrollment aggregation and CMS-416 EPSDT child enrollment, add CSV export endpoints, and deliver 10 content-level integration tests.
- [Plan: Minor Refactors](/canopy/plans/archive/minor-refactors.md): Parse trusted proxies at startup, bundle orchestrator determine() parameters, and centralize age calculation utility.
- [Plan: Notice Generation (SNAP First)](/canopy/plans/archive/notice-generation.md): Implement canopy-notices with NOA generation, 10-day advance notice enforcement, Askama templates, and delivery queue. SNAP notices are in scope for UAT; other programs follow in later phases.
- [Plan: October-COLA bulk re-determination — program decomposition (#1213, epic &amp;73)](/canopy/plans/archive/scale-audit-1213-cola-program.md): Six prerequisite issues + a redesigned core for the queued bulk re-determination driver, replacing the single-MR plan the external review rejected.
- [Plan: OIDC Pluggability Refactor (Issue #422)](/canopy/plans/archive/oidc-pluggability-refactor.md): Switch canopy-auth + canopy-web from hardcoded Keycloak paths to RFC-standard OIDC `.well-known/openid-configuration` discovery; rename every `keycloak_*` identifier (struct fields, config keys, env vars) to `oidc_*` so the codebase becomes provider-neutral end-to-end. Foundation for the BFF token-refresh fix (#411). Resolves #422.
- [Plan: OIDC Validation at Service Boundaries + Citizen-Upload Isolation](/canopy/plans/archive/oidc-at-services-and-citizen-upload-isolation.md): Program plan for epic &amp;52 — per-target exchanged tokens for user-context requests, portal credential isolation, and the receiver-first migration of the service fleet (15 receiver slices; exchange and rules have nothing to migrate) per ADR-023 as amended by ADR-043.
- [Plan: OpenAPI / Swagger Documentation](/canopy/plans/archive/openapi-swagger.md): Annotate all 87 API endpoints with utoipa macros and wire Swagger UI into every JSON API service so each service serves interactive API documentation at /swagger-ui.
- [Plan: OpenAPI Contract Hygiene — Query-Param Location + Response Annotations](/canopy/plans/api-contract-hygiene.md): Make the published OpenAPI snapshots match the real surface — annotate every `IntoParams` query struct with `parameter_in = Query` so it stops emitting `in:path` (#593), and reconcile the per-service `#[utoipa::path]` response/request_body gaps surfaced by the #620 doc refresh (#633). Both regenerate the same 15 committed snapshots.
- [Plan: OpenAPI Contract Testing](/canopy/plans/archive/openapi-contract-testing.md): Extend the existing cargo xtask api-docs command with breaking-change detection, CI enforcement, and coverage for all 14 active services.
- [Plan: Operational Infrastructure Remediation](/canopy/plans/archive/operational-infrastructure.md): Address shared operational gaps across CI enforcement, encryption at rest, backup/DR, migration rollback, secret management, API versioning, retry resilience, connection pool tuning, real-time push, accessibility testing, data export, distributed caching, and documentation testing.
- [Plan: Operational Runbooks](/canopy/plans/archive/operational-runbooks.md): Create AsciiDoc runbooks for signing key rotation, incident response, database backup/restore, and service scaling. Integrate into Antora nav under Operations section.
- [Plan: Orchestrator Parallel-Dispatch and Circuit-Breaker Tests](/canopy/plans/archive/orchestrator-dispatch-tests.md): Add explicit test coverage for canopy-eligibility orchestrator dispatch semantics — parallel fan-out, per-service timeout, circuit-breaker open/half-open/closed transitions, and signature-verification rejection. Replaces the implicit coverage that the 2026-04-18 review flagged as missing.
- [Plan: outbox-drainer lease-based three-phase refactor](/canopy/plans/archive/outbox-drainer-lease-refactor.md): Remove the held-tx-across-broker-roundtrip antipattern in `OutboxDrainer::drain_once` by splitting it into three short transactions with a `claimed_at` lease. Fixes the cascade of multi-second COMMITs observed under workspace integration concurrency.
- [Plan: Overpayment Recovery Pipeline (Issue #382)](/canopy/plans/archive/overpayment-recovery-pipeline.md): Add cross-program overpayment claim, repayment plan, and recoupment ledger via a new shared canopy-overpayments crate. Each program service gets its own per-DB tables. PAMMS 9000 + 7 CFR 273.18. Resolves #382.
- [Plan: Per-Program Determine-Input Requirements Coverage (epic &amp;63)](/canopy/plans/input-requirements-coverage.md): Implement ADR-034 Decision 6 — a machine-checkable manifest of every program's determination-input requirements, classified by source, cross-checked against the committed OpenAPI snapshots by a staged CI gate that reports the policy-material satisfiability burndown.
- [Plan: Per-Subject Determination + Program Mappers (ADR-035 Slice 1, #857, epic &amp;63)](/canopy/plans/archive/adr-035-per-subject-determination.md): Make program determinations per-subject (Medicaid per member, CAPS per child, WIC per participant) on CAPS first — the shared per-subject machinery built once and reused, sub-sliced into five forward-only MRs (MR3 sub-sliced into 3a/3b).
- [Plan: Person and Household Data Model](/canopy/plans/archive/persons-household-model.md): Implement the shared person, household, and demographic data model in canopy-persons — the foundational service all program services depend on.
- [Plan: Playwright E2E Test Suite](/canopy/plans/archive/playwright-e2e.md): Comprehensive browser-based E2E tests for the worker portal using Playwright in Docker, covering authentication, dashboard, case search, case detail (6 tabs), application processing, renewals, navigation, RBAC, and accessibility.
- [Plan: Policy Currency &amp; Federal Source Consumption (epic &amp;59)](/canopy/plans/archive/policy-currency-drift.md): Implement ADR-031 axis 1 — source pinning + drift detection for PAMMS, federal citations brought under audit, reverse-completeness, and an explicit annual federal indexing model — so "are our cited values current and complete?" is a command, not a sticky note.
- [Plan: Policy-to-Rules Traceability Pipeline](/canopy/plans/archive/policy-to-rules-pipeline.md): Implement ADR-011 — citation manifests, policy source adapters, drift detection tooling, and PAMMS-verified jurisdiction configuration.
- [Plan: Portal Design-Fidelity Follow-ups](/canopy/plans/archive/portal-fidelity-followups.md): One ADR-013 plan grouping the five workable follow-ups spun out of the completed Portal Design-Fidelity Pass (epic &amp;53). Each ships MR-by-MR with concrete e2e scenarios + light/dark screenshots verified against the committed design/ renders. Every item carries a real backend/data decision, settled here before building.
- [Plan: Portal Design-Fidelity Pass (Epic &amp;53)](/canopy/plans/archive/portal-design-fidelity.md): Close the gap between the shipped worker (canopy-web) + applicant (canopy-portal) portals and the committed design (design/canopy-web/renders + the worker &amp; applicant design references). Sequenced tokens → consume-primitives → data → new-surfaces, grounded in a re-baselined gap analysis against fresh current-build screenshots.
- [Plan: Program-Specific AU Composition Engine](/canopy/plans/archive/au-composition-engine.md): Formalize Assistance Unit composition rules as a shared concern with per-program logic derived from PAMMS SNAP 3205, TANF 1205, and Medicaid 2610/2620.
- [Plan: Quarantine applicant uploads until a real malware scan passes (#1006, epic &amp;52)](/canopy/plans/archive/upload-scan-quarantine.md): Replace the always-clean NoopScanner with a clamd-backed async quarantine lifecycle — uploads land durable at scan_status='pending', an idempotent promotion worker settles verdicts bound to content identity, and every serve/review path gates on viewable state (clean, or skipped with an audited supervisor override).
- [Plan: Reference Type Extensions](/canopy/plans/archive/reference-extensions.md): Extend canopy-reference with missing enum variants and struct fields required for regulatory compliance. Must complete in week 1 — blocks all domain implementation.
- [Plan: retry observability contract (#462 narrowed)](/canopy/plans/canopy-api-retry-middleware.md): Bounded exponential-backoff retry middleware for outbound `reqwest` calls in canopy-api, with `target: "retry"` observability span. Closes the retry portion of #462. Splits the rest of the chaos observability work into a new epic.
- [Plan: Rules Engine Implementation](/canopy/plans/archive/rules-engine.md): Implement the zen-engine rules evaluation service in canopy-rules — the shared rules engine all program services call for eligibility logic per ADR-003.
- [Plan: SameSite=Strict Session Cookies](/canopy/plans/archive/samesite-strict.md): Upgrade canopy-web session cookies from SameSite=Lax to SameSite=Strict by implementing a double-redirect pattern after the Keycloak OIDC callback.
- [Plan: SAVE (Systematic Alien Verification for Entitlements) Adapter](/canopy/plans/archive/save-adapter.md): Implement the SAVE adapter for immigration status verification in canopy-verification, with SNAP-specific alien eligibility rules in canopy-snap. SAVE is mandatory for SNAP, Medicaid, TANF, CHIP, and CCDF under 8 USC 1642 and PRWORA 121. SAVE data is transient in canopy-verification per ADR-004; each program service stores its own citizenship_verification outcome.
- [Plan: Scenario Inventory &amp; Human-Fidelity E2E (epic &amp;61)](/canopy/plans/scenario-inventory-e2e.md): Implement ADR-031 axis 3 — a schema-validated inventory of the casework scenario space derived from policy, a per-scenario coverage gate, multi-life-event E2E journeys that mirror real lives, and a second-jurisdiction fixture that makes "works everywhere" testable.
- [Plan: Security Audit Subscriber](/canopy/plans/archive/security-audit-subscriber.md): Implement canopy-security's wildcard event subscriber that captures all events from canopy.events for system-wide audit logging, breach detection, and NIST control mapping per ADR-004.
- [Plan: Security, CI/CD &amp; Documentation Remediation](/canopy/plans/archive/security-ci-remediation.md): Address all critical findings from the 6-agent codebase audit: enforce RBAC, fix CORS/CSRF/JWT gaps, add CI test jobs, improve test coverage, correct aspirational documentation claims, and harden security posture.
- [Plan: Session Middleware Wiring](/canopy/plans/archive/session-middleware.md): Wire tower-sessions-sqlx-store session middleware into canopy-web and canopy-portal. MemoryStore is banned; this is a security gap that must close before any user-facing routes are added.
- [Plan: Shared Database Mode for Devstack](/canopy/plans/archive/shared-db-devstack.md): Add a --shared-db flag to cargo xtask dev start that runs all databases on a single PostgreSQL instance instead of one per program service, reducing container count from 24 to 19.
- [Plan: Signing-key-aware service-token acquisition (self-heal on rotated/deleted key)](/canopy/plans/archive/service-token-key-aware-acquisition.md): A canopy service self-heals when its cached client_credentials token is signed by an IdP key the issuer has deleted — by revalidating the cached token against a bounded-freshness JWKS and re-minting on failure, so sender-validity equals receiver-validity.
- [Plan: Single-flight Idempotency-Key execution across replicas](/canopy/plans/archive/idempotency-single-flight.md): Make the shared canopy-api Idempotency-Key middleware execute each key's handler exactly once (happy path) across concurrent requests and replicas, with defined follower/conflict/crash-recovery semantics.
- [Plan: SNAP + TANF + ELE end-to-end demo video — full simple-case workflow](/canopy/plans/archive/snap-tanf-ele-demo-video.md): Wire a two-person household through the SNAP intake workflow (15 data-collection sections, 9-step process), then independently through the TANF intake (same sections + ~5 TANF-specific). Demonstrate program independence + automatic ELE flag on first-approved program. Target: 10-minute recorded deep-dive video.
- [Plan: SNAP ABAWD Work Requirements](/canopy/plans/archive/snap-abawd.md): Implement ABAWD (Able-Bodied Adults Without Dependents) identification, 3-month time limit tracking, discretionary exemption management, and waiver area support in canopy-snap.
- [Plan: SNAP Categorical Eligibility and BBCE](/canopy/plans/archive/snap-categorical-eligibility.md): Implement SNAP categorical eligibility (standard and BBCE) and student exclusion rules in canopy-snap. Runs as a pre-screen before income and asset tests.
- [Plan: SNAP Eligibility — First Program Service](/canopy/plans/archive/snap-eligibility.md): Implement canopy-snap as the first fully functional program service, proving the ADR-001 isolation pattern, ADR-002 determination contract, and ADR-003 rules evaluation end-to-end.
- [Plan: SNAP Enrollment and EBT Issuance](/canopy/plans/archive/snap-enrollment-ebt.md): Implement canopy-enrollment with SNAP EBT account provisioning, benefit issuance, proration, 12-month stale benefit expungement, and Conduent adapter interface. SNAP issuance is in scope for UAT.
- [Plan: SNAP Federal Reporting — FNS-388 and FNS-7176 QC Universe](/canopy/plans/archive/snap-federal-reporting.md): Implement monthly FNS-388 SNAP participation and issuance reporting and on-demand FNS-7176 Quality Control universe snapshot assembly in canopy-reporting, per 7 CFR 272.11 and 7 CFR Part 275.
- [Plan: SNAP IEVS Verification](/canopy/plans/archive/snap-verification-ievs.md): Implement SNAP-specific IEVS income verification against Georgia DOL wage records, unemployment insurance, and SSA SDX/BENDEX. IEVS data is physically isolated to canopy-snap per ADR-004.
- [Plan: SNAP Income Deduction Calculation and Benefit Amount](/canopy/plans/archive/snap-deduction-calculation.md): Implement the six mandatory SNAP income deductions (7 CFR 273.9(d)), Standard Utility Allowance election, net income test, and SNAP allotment calculation. This is the core benefit amount engine — without it, every determination produces a wrong benefit amount.
- [Plan: SNAP Renewals and Certification Period Management](/canopy/plans/archive/snap-renewals-certification.md): Implement certification period assignment, simplified reporting enforcement, 6-month interim contact workflow, and recertification processing in canopy-renewals per 7 CFR 273.10(f), 273.12, and 273.14.
- [Plan: SNAP Ruleset &amp; Configuration Alignment](/canopy/plans/archive/snap-pamms-alignment.md): Align SNAP rulesets and jurisdiction.toml with PAMMS source of truth. Fill citation gaps, fix remaining incorrect values, add ABAWD time clock, verification thresholds.
- [Plan: SNAP Self-Employment Standard Deduction (Issue #414)](/canopy/plans/archive/snap-self-employment-standard-deduction.md): Wire the 40% standard self-employment expense deduction (PAMMS 3425, 7 CFR 273.11(a)(2)) through the canopy-snap deduction pipeline so applicants reporting zero actual expenses are not penalized. Resolves #414.
- [Plan: SNAP Special Household Situations — Drug Felon, Fleeing Felon, and Striker Rules](/canopy/plans/archive/snap-special-situations.md): Implement SNAP special household situation disqualification screenings: drug felon prohibition (7 CFR 273.11(m)), fleeing felon / probation violator prohibition (7 CFR 273.11(n)), and striker household pre-strike income comparison (7 CFR 273.11(e)). These are categorical eligibility disqualifiers evaluated before income and asset tests.
- [Plan: SSR aggregate request deadline + honest degraded states (#1306, epic &amp;73)](/canopy/plans/archive/ssr-aggregate-deadline.md): One absolute per-call cutoff bounds every canopy-web SSR upstream read (gate-wait, retries, body/decode); typed ServiceError kinds; honest populated/empty/partial/error/timeout states inventoried across every stamped surface.
- [Plan: Startup Hardening](/canopy/plans/archive/startup-hardening.md): Validate DATABASE_URL contains expected database name on startup and add SPDX header check to pre-commit hook.
- [Plan: TANF Denial-Reason Code Emitted from JDM Ruleset](/canopy/plans/archive/tanf-denial-reason-code-from-jdm.md): Replace the brittle substring-matching `categorize_closure_reason()` hack at `services/canopy-tanf/src/api/handlers.rs:177-190` with a canonical `denial_reason_code` emitted directly from the `tanf-eligibility` JDM ruleset. Puts the policy mapping where the rules already live (ADR-003), eliminates the "unemployment" false positive, and gives TSNAP/TMA subscribers a stable exact-match string instead of a string derived from free-form policy prose.
- [Plan: TANF Eligibility Service](/canopy/plans/archive/tanf-eligibility.md): Implement canopy-tanf as the second program service, introducing FTI complexity and validating the ADR-001/002/003/004 pattern with time limits, work requirements, and deprivation requirements.
- [Plan: TANF Federal Reporting — ACF-199, ACF-196, and Work Participation Rate](/canopy/plans/archive/tanf-federal-reporting.md): Enrich ACF-199 case-level extraction with work/sanction/time-limit data, add ACF-196 stub generation endpoint, implement WPR computation from snapshots, add CSV export for all three reports, and replace structural-only tests with content-level integration tests.
- [Plan: TANF Ruleset &amp; Configuration Alignment](/canopy/plans/archive/tanf-pamms-alignment.md): Align TANF implementation with PAMMS source of truth. Add responsibility budgeting (deeming), lump sum calculator, GRG CRISP, personal responsibility tracking, proration, and integration tests.
- [Plan: TANF Sanction → Denial / Sanctioned Path (Issue #416)](/canopy/plans/archive/tanf-sanction-denial-path.md): Extend the tanf-eligibility JDM ruleset to gate determinations on active work-requirement sanctions and personal-responsibility failures, so sanctioned applicants are not silently approved. Resolves #416.
- [Plan: TANF Self-Employment Net Income — PAMMS 1540 Cost-of-Doing-Business Deduction](/canopy/plans/archive/tanf-self-employment-net-disregard.md): Fix canopy-tanf so the `self_employment` (gross) income type gets business expenses deducted before joining the earned-income pool that feeds PAMMS 1615's $250 flat disregard. Today, gross SE is pooled as-is — overstating countable income and potentially denying eligibility. `self_employment_net` (already-net) keeps its current treatment.
- [Plan: Test Coverage &amp; Quality Remediation](/canopy/plans/archive/test-coverage-remediation.md): Achieve 100% public function test coverage across all implemented services and shared crates. Fix silent error swallowing, add database constraints, implement integration tests with Keycloak authentication, and fix devstack infrastructure.
- [Plan: Test Coverage Phase 2](/canopy/plans/archive/test-coverage-phase2.md): Add integration tests for persons GET endpoints, P1 fix coverage, and silent test skip reporting.
- [Plan: Test-Seed Harness Refactor (Issue #450)](/canopy/plans/archive/test-seed-harness.md): Replace the dual-entry-point seed pipeline (xtask seed + xtask e2e) with a single source of truth, default to random seeds with replay capture, and migrate Playwright fixtures off positional UUID access onto predicate-query helpers. Resolves the entire flake class observed during the 2026-05-12 #392 push cycle.
- [Plan: TMA Subscriber Person Lookup](/canopy/plans/archive/tma-subscriber-person-lookup.md): Replace the household_id placeholder in canopy-medicaid's tanf.case_closed subscriber with a real per-member persons lookup so one TMA coverage row exists per affected person. Fixes the errata on medicaid-coa-phase-c-tma.adoc and closes the Tier 5.5 placeholder tracked at canopy-medicaid/src/main.rs:138.
- [Plan: Typed <code>Path&lt;*Id&gt;</code> rollout — workspace-wide (#627)](/canopy/plans/archive/typed-path-id-rollout.md): Replace every raw `Path&lt;Uuid&gt;` HTTP extractor in the workspace with a typed newtype, then land a lint that bans new ones.
- [Plan: Typst Document Generation Architecture](/canopy/plans/archive/typst-document-generation.md): Replace Askama plain-text notice templates with Typst-based PDF generation. Introduces canopy-typst shared crate, composable Orchard-branded templates under rulesets/{jurisdiction}/notices/, and PDF storage via canopy-store (S3). Supports 400+ document types across 5 programs.
- [Plan: Typst Form-Building Components (Issue #405)](/canopy/plans/archive/typst-form-components-form-297.md): Audit and resolve #405. The components named in the issue body already exist; the first consumer (SNAP recertification form) ships against them. Closes #405.
- [Plan: validate In-Network Runner (Issue #339)](/canopy/plans/archive/validate-in-network-runner.md): Add `cargo xtask validate-in-network` so pre-push validation runs inside the docker network with PG-touching tests, satisfying ADR-015. Pre-push hook stays on the host runner; this is opt-in. Resolves #339.
- [Plan: WIC Eligibility (canopy-wic)](/canopy/plans/archive/wic-eligibility.md): Implement WIC (Special Supplemental Nutrition Program for Women, Infants, and Children) eligibility determination in canopy-wic with categorical evaluation, income/adjunctive eligibility, nutritional risk recording, food package assignment, certification periods, JWS signing, and event publishing.
- [Plan: Worker Fact Authoring and Provenance](/canopy/plans/archive/worker-fact-authoring-and-provenance.md): Make the worker portal able to author the facts a determination reads — claim→accept pipeline, valid-time fact versioning, provenance, and a determination input snapshot — delivered in a SNAP-UAT-minimum track and a post-UAT correctness track.
- [Plan: Worker intake + program independence (SNAP + TANF)](/canopy/plans/archive/worker-intake-program-independence.md): Worker intake page + per-program independence + case-detail Audit section. Plan 1 of the SNAP+TANF+ELE demo-video three-plan split.
- [Plan: Worker Portal — Multi-Program Expansion (canopy-web)](/canopy/plans/archive/worker-portal-expansion.md): Expand canopy-web from SNAP-only case management to multi-program support (TANF, Medicaid/CHIP, CAPS, WIC) with program-dispatched clients, per-program tab definitions, program-specific determination views, and graceful degradation when services are unavailable.
- [Plan: Worker Portal — SNAP Case Management (canopy-web)](/canopy/plans/archive/worker-portal-snap.md): Implement SNAP caseworker workflows in canopy-web — dashboard, case search, case detail, application processing, notice review, ABAWD management, and renewal queue — using Axum, Askama, htmx, and Alpine.js.
- [Plan: Worker Portal Design Mockups (Issue #420)](/canopy/plans/archive/worker-portal-design-mockups.md): Document the eight worker-portal pages plus login with Mermaid layout diagrams + Orchard color tokens, providing visual reference for new contributors and UAT prep. Resolves #420.
- [Plan: Worker Portal Handler Remediation](/canopy/plans/archive/worker-portal-remediation.md): Wire all stubbed canopy-web handlers to upstream service APIs. Currently 5/6 case detail tabs, application processing, renewal queue, and dashboard aggregations return empty/hardcoded data.
- [Plan: Worker portal household/person address editor (#983)](/canopy/plans/archive/worker-address-editor.md): Add a worker-portal action to edit a household member's residential/mailing address as an effective-dated fact via the existing canopy-persons /claims surface, closing the fidelity gap the address-change-shelter-cascade journey works around.
- [Plan: Worker Portal Program Action Handlers (Issue #392)](/canopy/plans/archive/worker-portal-program-action-handlers.md): Add caseworker action handlers for TANF, Medicaid, CAPS, and WIC in canopy-web, mirroring the existing SNAP-only handlers in services/canopy-web/src/api/actions.rs. Resolves #392.
- [Plan: Worker Portal Redesign — Stage 5 MR3: Customize My Dashboard](/canopy/plans/archive/worker-portal-redesign-stage5-customize-my-dashboard.md): Customize UI for worker / supervisor / analyst dashboards: hide, reorder, resize panels persisted via user_delta_v1 semantic schema (ADR-024).
- [Plan: Worker Portal Redesign — Stage 5 MR4: Case Detail Composition](/canopy/plans/archive/worker-portal-redesign-stage5-case-detail.md): Wire the composition runtime through the case-detail surface across three atomic MRs (MR4a composition pipeline + MR4b scroll shell + 20 sections + MR4c card_grid + 27-action shell-aware redirect). Last Stage 5 surface before Stage 6 Studio.
- [Plan: worker program scope, enforced (#742)](/canopy/plans/program-scope-enforcement.md)
- [Policy Currency Runbook](/canopy/compliance/policy-currency-runbook.md): Operating the ADR-031 §1 currency tooling — sync, pin, drift, re-verify — so cited policy values provably match their authoritative sources.
- [Portal Modules and Role Access](/canopy/portal-modules.md): UI module → role authorisation matrix for canopy-web (worker portal) and canopy-portal (applicant portal). Companion to the endpoint-level RBAC matrix.
- [Production Deployment Guide](/canopy/deployment-guide.md): How to deploy Canopy to a production environment for state agency use.
- [Project Conventions (Canopy)](/canopy/project-conventions.md): Index of Canopy's project-specific conventions — framework patterns, database, styling, auth, accessibility, testing, and delivery — overlaying the universal synced standards.
- [RBAC Matrix](/canopy/rbac-matrix.md): Real role names, hierarchy, and per-endpoint authorisation enforcement across all canopy-* services. Auditor reference.
- [Report Runs — Operations Runbook](/canopy/report-runs-runbook.md): Operating the durable report-run pipeline — enqueue, poll, observe, disabled mode, stuck runs, reclaim, the attempts cap, and reap/janitor semantics.
- [Roadmap](/canopy/roadmap.md): Phased implementation plan for Canopy, sequenced by architectural dependencies. The Month 1–6 SNAP-UAT critical path is complete; the current phase is scale-hardening + correctness ahead of the September 2026 SNAP UAT.
- [Rulesets: JDM Format, Jurisdiction Config, and Authoring](/canopy/rulesets.md): The JDM (JSON Decision Model) ruleset format, jurisdiction.toml structure, and how to add a ruleset — per ADR-003.
- [Runbook: Appeals Reconciliation (receipts vs links, parked elections)](/canopy/runbooks/appeals-reconciliation.md): Responding to the #1100 reconciliation scanner's alerts — receipt/link disagreement, lingering stays on terminal appeals, and CB elections parked in pending_stay past SLA.
- [Runbook: clamav (clamd) Sidecar Operations](/canopy/runbooks/clamav-operations.md): Operating the #1006 content-scan sidecar — definition freshness, outage recovery, backlog alerting, rescan, override audit, resource behavior, isolation.
- [Scaling &amp; Deployment](/canopy/runbooks/scaling-deployment.md)
- [Secret Management &amp; Rotation](/canopy/runbooks/secret-management.md)
- [Security](/canopy/security.md): Canopy safety-critical security quick-reference — data tenancy, CSP, auth, secrets.
- [Security Operations &amp; Runbooks](/canopy/security-operations.md): Incident response, key rotation, deployment rollback, and breach notification procedures for Canopy.
- [Shared Crates Reference](/canopy/shared-crates.md): Public API surface of Canopy's shared crates under crates/ — read before using them in service code.
- [Signing Key Rotation](/canopy/runbooks/signing-key-rotation.md)
- [SNAP Caseworker Guide](/canopy/guide/caseworker.md): Step-by-step guide for caseworkers using the Canopy worker portal to process SNAP cases.
- [Stale JWKS Recovery: blanket 401s from long-running program services](/canopy/runbooks/jwks-stale-recovery.md)
- [State Machines](/canopy/state-machines.md): Valid state transitions for all stateful entities in Canopy.
- [sweep_orphans Schema-Drop Race](/canopy/runbooks/sweep-orphans-race.md)
- [T1-10 — SNAP Determination Input Snapshot (flat + corpus-hash, program-signed) (#678)](/canopy/plans/archive/worker-fact-authoring-t1-10-snap-input-snapshot.md)
- [T1-6 — Scoped Fact Change-History Endpoint (#674)](/canopy/plans/archive/worker-fact-authoring-t1-6-change-history.md)
- [T1-7 — Applications Finalize Authors Applicant Asset/Expense Claims (#675)](/canopy/plans/archive/worker-fact-authoring-t1-7-applications-finalize.md)
- [T1-8 — Worker Fact-Authoring UI: Asset/Expense + Member Editors + #632 Gate (#676)](/canopy/plans/archive/worker-fact-authoring-t1-8-worker-editors.md)
- [T1-9 — IEVS Resolution → Worker Accept/Reject → Verified Income Write-Back (#677)](/canopy/plans/archive/worker-fact-authoring-t1-9-ievs-write-back.md)
- [T2-1 A1 — Address valid-time versioning (canopy-persons) (#683)](/canopy/plans/archive/worker-fact-authoring-t2-1-address-versioning.md)
- [T2-1 A2 — Household-member valid-time versioning (canopy-persons) (#683)](/canopy/plans/archive/worker-fact-authoring-t2-1-a2-household-member-versioning.md)
- [T2-1 CONTRACT — Drop legacy address + household-member tables (#890)](/canopy/plans/archive/worker-fact-authoring-t2-1-contract-drop-legacy-tables.md)
- [T2-1 Half B — Determination supersession (canopy-snap + shared envelope) (#683)](/canopy/plans/archive/worker-fact-authoring-t2-1-half-b-determination-supersession.md)
- [T2-2 — Snapshot v2: derivation-edge graph + per-rule traceability (#679)](/canopy/plans/archive/worker-fact-authoring-t2-2-snapshot-v2-derivation-graph.md)
- [T2-3 — Determination Snapshot: Cross-Program Input Capture (raw SOLQ) (#684)](/canopy/plans/archive/worker-fact-authoring-t2-3-cross-program-capture.md)
- [T2-4 — FTI-bearing Determination Snapshots + Program Fan-out (tanf/medicaid/caps/wic) (#685)](/canopy/plans/archive/worker-fact-authoring-t2-4-program-snapshots.md)
- [T2-5 — Audit Chain-Hash Hardening (actor + before/after tamper-evidence) (#686)](/canopy/plans/archive/worker-fact-authoring-t2-5-audit-hardening.md)
- [T2-6 — Crypto-shred redaction/expungement + JWS signing-key retention (#687)](/canopy/plans/archive/worker-fact-authoring-t2-6-crypto-shred-redaction.md)
- [T2-7 — Reported-change → dry-run materiality → recert nudge + change-of-circumstance notices (#680)](/canopy/plans/archive/worker-fact-authoring-t2-7-materiality-recert.md)
- [T2-8 — Overpayment recompute-from-snapshot + in-boundary hearing-view + OverpaymentNotice (#681)](/canopy/plans/archive/worker-fact-authoring-t2-8-overpayment-recompute.md)
- [Testing (Canopy)](/canopy/testing.md): Canopy's project-specific testing guide — the seed harness, contracts-crate proptest round-trips, coverage gate, multi-replica/ephemeral-schema anti-flake primitives, fault injection, observability assertions, time mocking, goldenfile + snapshot patterns, typed service clients, and invariant drift gates.
- [Troubleshooting Guide](/canopy/troubleshooting.md): Common issues and solutions when developing or operating Canopy.
- [UAT Facilitator Guide](/canopy/user-testing-guide.md): Operational guide for facilitators running User Acceptance Testing on Canopy. Covers environment setup, role-based scenarios, accessibility protocols, and feedback collection.
- [validate-in-network — running the full validate suite inside the docker network](/canopy/validate-in-network.md): Opt-in `cargo xtask validate-in-network` for contributors without host postgres. Pre-push hook stays on host (#339, ADR-015).
- [Why Canopy?](/canopy/why-canopy.md): The political, legal, and technical rationale for Canopy — Georgia DHS's open-source integrated eligibility system.
- [Worker Portal Design Reference](/canopy/design/worker-portal.md): Reference for the worker-portal design package — the architectural decisions ratified during design, the TOML schemas the composition runtime loads, and the hard rules plugin authors must follow. Distilled from design/canopy-web/; the design-system contract (tokens, type, components) lives on its own page.
- [Worker Portal Mockups](/canopy/design/worker-portal-mockups.md): Visual reference for the eight worker-portal pages plus login. Layouts captured as Mermaid diagrams; colors annotated against the Orchard design tokens in rulesets/georgia/notices/components/orchard.typ. Documents production surfaces as they exist today (#420); a real design refresh would land separately.
- [Worker portal redesign — composability runtime + design-system extraction](/canopy/plans/worker-portal-redesign.md)
- [Worker portal redesign — Stage 1 design-system extraction](/canopy/plans/archive/worker-portal-redesign-stage1-design-system.md)
- [Worker portal redesign — Stage 1.5 panel-state primitives upgrade](/canopy/plans/archive/worker-portal-redesign-stage1-5-panel-state-primitives.md)
- [Worker portal redesign — Stage 3 MR1 (DB migrations + composition loader)](/canopy/plans/archive/worker-portal-redesign-stage3-composition-runtime.md)
- [Worker portal redesign — Stage 3 MR2 (HTTP live-override APIs)](/canopy/plans/archive/worker-portal-redesign-stage3-mr2-live-override-apis.md)
- [Worker Portal Redesign — Stage 4: IDP loader + IDP-aware sign-in](/canopy/plans/archive/worker-portal-redesign-stage4-idp-loader-and-sign-in.md)
- [Worker Portal Redesign — Stage 5 MR1: Composition-driven worker dashboard](/canopy/plans/archive/worker-portal-redesign-stage5-worker-dashboard.md)
- [Worker Portal Redesign — Stage 5 MR2: Supervisor + Analyst Dashboards](/canopy/plans/archive/worker-portal-redesign-stage5-supervisor-analyst-dashboards.md)
- [Worker Portal Screenshots](/canopy/screenshots.md): Visual reference for the canopy-web worker portal modules. Captured by `cargo xtask docs screenshots` against a seeded devstack — refresh whenever a module's UI changes.
- [Worker Program Scope — Cutover &amp; Operations (#1515 / ADR-044)](/canopy/runbooks/worker-program-scope-cutover.md)

## Standards
- [Agency Standards](/canopy/standards/index.md): GADHS agency-wide engineering standards, distributed from the claude-quickstart template
- [CLAUDE.md Skeleton](/canopy/standards/claude-md-skeleton.md): What belongs in .claude/CLAUDE.md vs the synced rules and standards
- [Coding Conventions](/canopy/standards/coding-conventions.md): Rust style, errors, types, dependencies, lints, and service patterns
- [Delivery Protocol](/canopy/standards/delivery-protocol.md): Preflight, recommendations, debugging, and the delivery checklist
- [Git Workflow](/canopy/standards/git-workflow.md): Branching, commits, signing, hooks, and versioning
- [GitLab Workflow Standards](/canopy/standards/gitlab-workflow.md): Issue, MR, and epic standards
- [Migration Runbook](/canopy/standards/migration-runbook.md): Step-by-step downstream migration/re-sync onto the synced deterministic-first layout
- [Security Baseline](/canopy/standards/security-baseline.md): Kerckhoffs's principle and public-visibility enforcement
- [Testing](/canopy/standards/testing.md): Test strategy, runners, categories, and the pre-push battery

## Optional
- [Full corpus](/llms-full.txt)
- [Search index](/search-index.js)