Plan: craig-intake Interface — Hardening & Total Test Coverage

Mechanism — split the single shared CACHE_TTL into separate positive/negative TTLs (or add a positive-specific TTL), reducing only the positive (approved) lifetime to a small bounded window (default ≤ 10 s) while preserving the negative-cache duration (60 s). Full evict-on-revoke (a keyring→verifier revocation signal) is deferred as a separate issue. A short ADR records the accepted positive window (a child-welfare signing system may want it near-zero).

Test seam — make the TTL injectable (e.g. SignerAuthClient::with_ttl(…​)) so the boundary test sets a tiny TTL; no real sleep, no new dependency.

The shared CACHE_TTL is split so the positive (approved) lifetime is ≤ the ADR-ratified window while the negative (404/pending) duration is explicitly preserved.

Cache-module unit tests cover the positive, negative, and post-revocation transitions via the injectable TTL.

An ADR captures the revocation posture (extend ADR-042 or a new ADR).

Header nav a uses --primary → 2.0:1 in dark mode (fails WCAG 1.4.3; --link gives 8.32:1).

The post-submit success view neither moves focus nor announces the report id.

status.html / keys.html / keygen.html async result + error boxes have no role/aria-live.

Small nav/step targets fail WCAG 2.2 target-size (2.5.8).

No field-level aria-invalid / aria-describedby / aria-required.

Busy states (submitting/uploading/generating/checking) lack aria-busy.

Status badges / the review alleged-victim tag may rely on colour alone.

forced-colors (Windows High Contrast) unsupported.

Live regions are persistent wrappers, not x-show-converted boxes. Several async boxes deref a nullable object (status.html’s `result.id); under x-show that throws while hidden. So each announce-on-change box is wrapped in an always-present role+aria-live container around the existing <template x-if> (the SR observes the region before content is inserted) rather than converting the box itself to x-show. Whole-block reveals (success view, keygen done) use the heading focus-move idiom instead.

Field labels: the row controls nest the input inside <label> (implicit association), not :id/:for. The SHINES and None per-profile blocks bind the same x-model fields, so explicit ids would collide across the two x-show blocks (an axe duplicate-id-active risk). Nesting needs no ids, survives both profiles, and preserves the positional e2e selectors (.adult-entry input). The 4 validated row controls additionally carry per-row aria-invalid/aria-describedby keyed by a (stepErrorField, stepErrorIndex) pair.

A11Y-13 was a test-gap, not a product defect — the review tags + status/key badges already carry their state as visible text, so no markup change; the non-colour assertion (a computed forced-colors border ≥1px) is the Step-10 deliverable. The forced-colors border is added only to the background-bearing badges (not the inline .review-tag).

request structs lack #[serde(deny_unknown_fields)] (a mistyped field is silently dropped — the same class as #743);

concern_description min-length counts bytes, not chars;

admin_unit has no value/allowlist validation;

the public AND partner forward paths use to_value(body).unwrap_or(Value::Null) (silent failure — public.rs, partner.rs);

attachment filename/content-type are forwarded verbatim;

the keyring accepts an unvalidated public_key_jwk;

Submit-Another (resetForm) is not proven to clear prior-reporter PII before a second submission.

Unknown-field rejection is profile-aware, not a blanket deny. The submission body is multi-owner — the core SubmitReportRequest keys PLUS, under the SHINES profile, the 15 SHINES-only ExtraFields top-level keys (ADR-042 §D3; 935 added is_any_one_ill). A blanket [serde(deny_unknown_fields)] on the core contract would 400 every valid SHINES (and SDK-flatten) body. Two mechanisms instead: (a) per-entry [serde(deny_unknown_fields)] on the typed AdultEntry/ChildEntry views (a misspelled per-person key is a loud 400); (b) a top-level key-set diff in prepare_submission whose allowlist = the core key set (derived from to_value(body) — the contract has no skip_serializing_if, so the derived set is complete) unioned with SHINES_EXTRA_KEYS only under the SHINES profile. SHINES_EXTRA_KEYS lives in backend/shines/extra.rs (SHINES-owned, "strip cleanly"), pinned to the struct + cross-language fixture by a drift test. A [serde(flatten)] catch-all is rejected (utoipa renders it additionalProperties: true).

Widen the entry structs to the full None-form + SDK key set so the per-entry deny is safe: AdultEntry gains relationship_to_child/phone/email/county/is_primary_caregiver/dob_approximate; ChildEntry gains dob_approximate/age. age is capture-only (the chindInfo[] mapper has no age slot; DOB is canonical), range-validated 0..=21. The SDK Adult/Child mirror the additions.

admin_unit allowlist is jurisdiction-parameterized, all channels. When settings.jurisdiction resolves to a US state/territory, admin_unit is allowlist-validated against it on every submit channel (no partner exemption); a tribal/territory key (no AdminUnit table) is format-bounded only (Plan-S neutrality — never hardcode a state). reporter_county is NOT allowlisted (a reporter may be out-of-jurisdiction).

COMP-09 (kiosk reset) is defense-in-depth, not a live-bleed fix (MR-2, as-built). Implementation found both file <input>`s already sit inside Alpine `x-if blocks (#attach-file in the success view, #sign-key-file in the form), so Alpine destroys + recreates them empty on every "Submit Another" reset — there is no current cross-reporter file bleed, and the model fields were already cleared by blankForm(). resetForm() clears the two file inputs explicitly anyway (cheap belt-and-suspenders) and an e2e locks the post-reset no-residue invariant, so a future x-if→x-show refactor cannot silently reintroduce a bleed. The acceptance criterion’s "kiosk cross-submission PII-clear test" is satisfied by that invariant e2e.

EVIL-08 keyring JWK validation lands as a small extracted helper (MR-2). craig-intake-keyring register validates public_key_jwk as a P-256 key via a validate_signer_jwk helper (p256::PublicKey::from_jwk_str), proptest-covered (arbitrary JWK never panics); bogus inline fixtures migrated to real keys via craig_test_lib::signing::generate_test_keypair(). Recorded as-built in the ADR-042 #750 amendment B4.

SAD-01 — maltreater_relationship_to_victim exists on AdultEntry (validation.rs:79) and is server-required when alleged, but the SHINES form never renders it and SHINES_ADULT_KEYS omits it → an alleged-maltreater submission is unsatisfiable from the SHINES form.

SAD-02 — the per-adult relationship_to_child is collected + sent under SHINES (it is in SHINES_ADULT_KEYS) but AdultEntry has no such field and no deny_unknown_fields, so serde silently drops it — entered data is lost.

SAD-13 — the maltreater cross-field 400 (server-required relationship) has no test on the channel that can reach it.

SAD-01 — render maltreater_relationship_to_victim in the SHINES per-adult block + add it to SHINES_ADULT_KEYS (satisfiable). It is not mapped to the CpsRequest: PersonInfo/OtherHouseholdInfo (mapper.rs:258/283) have no relationship field, and adding one to the SHINES wire is gated on the authoritative contract (#691). The value reaches cases/audit, not the SHINES wire, until #691.

SAD-02 — stop collecting relationship_to_child under SHINES: drop it from SHINES_ADULT_KEYS AND gate the input out of the shared adult block under SHINES (x-show, report.html:335) so it isn’t collected-then-discarded. SHINES uses rel_to_primary_caretaker. Keep render + key for None/cases. Step 4’s deny_unknown_fields then makes any future silent drop loud.

The SHINES alleged-maltreater path is satisfiable end-to-end (field rendered + keyed + an intake-ui-shines e2e for the alleged-maltreater case).

relationship_to_child is neither rendered nor sent under SHINES (form input gated + removed from SHINES_ADULT_KEYS); a test pins that None/cases still renders + carries it.

A signed_submit_alleged_maltreater_without_relationship → 400 integration test (the signed channel reaches the cross-field rule).

An ADR-042 amendment records the SHINES adult-field forwarding decisions.

Rust unit (cases sink + SHINES mapper). A new cases_forwarder test module asserts the forwarded cases body field-by-field (partner context, reporter fields, narrative, children/adults/raw_submission verbatim), the anonymous-omits-reporter-keys case, the authenticated-partner-id case, and get_report_status (screened disposition / pending fallback / 404). The cases-forwarded body has NO oracle at the tests/api or e2e layers — the devstack container runs the capture-less router() — so a host-owned cases route was added to craig-mock-server (the cases twin of the SHINES mock; happy routes only, the existing global fault layer is #754’s seam). The reporter-type → SHINES repType crosswalk is asserted in the conformed CpsRequest for all six reporter types at the mapper.

tests/api (SHINES public, #713 debug panel). The forwarded CpsRequest core fields, the multi-person arrays, the 15 ExtraFields, and the incident_datetime → incidentDate date-only derivation are asserted via the debug panel. These use concerned_citizen: on the SHINES Signed profile the public edge accepts only {Anonymous, ConcernedCitizen} (mandated routes to /signed; law_enforcement/self_report/professional are never public), and the signed path emits no debug panel (ADR-042 §D9) — so the signed channel is proven to accept + forward each canonical reporter type, with the forwarded repType value covered by the mapper test above. The None path proves concerned-citizen acceptance + that the status response carries well-formed timestamps.

e2e. County forwarding (SHINES), the first integrated-mode submission + status round-trip, the success-view confirmation copy + Check-Status CTA (None), and view-keys metadata + a two-layer no-leak check (SHINES).

Sink unit (backend/shines/sink.rs, SAD-03). forward() is called directly (it parses typed views from raw and maps before any POST, bypassing validation), so the MapError → 422 conversion (sink.rs unprocessable("submission", …)) is proven for a duplicate mother / non-numeric SSN / unmappable race.

Validation unit (api/validation.rs, SAD-09). The AFCARS male/female-only Gender reject is pinned for validate_children_array + validate_adults_array over {non_binary, other, unknown} (the generic invalid-gender path was already covered; this locks the specific cross-system values).

HTTP edge (tests/api). SHINES public 422s an unanswered is_in_military_parent when is_in_military=true (SAD-04) and surfaces the mandated-signing 422 ahead of a concurrent concern_type 400 (SAD-07, handler ordering); the signed channel 422s a non-numeric SSN at the mapper and 400s a bogus race at validation (SAD-08); the public form 400s a curated-out reporter type with the typed INVALID_ENUM_VALUE problem (SAD-10, the public-rejects half of the #639 contrast — the signed-accepts half already exists).

MR-1 — outbound-fault redaction matrix (!856): CHAOS-01 (cases-forwarder fault matrix), CHAOS-04 (attachment-proxy faults, router-level), CHAOS-06 (signed replay-check outage), COMP-11 (signer-auth security-service outage). Lifted the duplicated spawn_oidc test helper into craig_mock_server::oidc::spawn_oidc (no new dependency).

MR-2 — intake concurrency & cache bounds (!857): CHAOS-03 (negative-cache TTL bound), CHAOS-07 (debug-slot isolation under concurrency), CHAOS-10 (rate-limit burst race). The races use concurrent_fire_synchronized (barrier-released) on a multi_thread runtime.

MR-3 — keyring restart durability & capacity race (!858): CHAOS-08 (restart preserves approval + replay state at the router level), CHAOS-09 (concurrent distinct-kid registration respects max_keys).

MR-4 — signed-path concurrent exactly-once (!859, this MR): CHAOS-05 (devstack-gated) — N parallel identical-JWS signed submits yield exactly one 200 + the rest 401.

CHAOS-01 was narrower than the 2026-06-28 audit stated. The audit’s "CasesForwarderSink has no test module" was stale (Step 8 added a happy-path module); the fault matrix was the real, still-missing gap.

CHAOS-04 surfaced a real defect, filed separately (not fixed here). The attachment upload/download/delete proxy relays upstream error status + body verbatim (via relay_response), unlike list_attachments which redacts via redact_upstream_error — a likely info-leak on the unauthenticated public upload route. CHAOS-04 ships a characterization test locking the current behavior; the remediation is tracked as #933, which will flip that test to assert redaction. Per the bugs-mid-impl rule it was filed as a separate fix: issue, not folded into this tests-only program.

incomplete failing is scoped to the edge scans. failIncomplete gates only the edge calls (A11Y-08); the pre-existing caseworker/admin auditPage calls capture incomplete for the report but do not gate on it (broadening to those is out of scope). color-contrast incomplete is auto-allowlisted under forced-colors (axe cannot evaluate contrast when the OS overrides colors — expected, not a gap).

No xtask change was needed for the integrated sweep (A11Y-14). CRAIG_INTAKE_URL is already exported by xtask (docker.rs); the audit just consumes it. The non-default-jurisdiction palette sweep (needs a 2nd themed bundle instance = devstack infra) is out of scope and tracked as a follow-up: #902 (the single-palette integrated sweep landed here).