Plan: Standalone Intake Backend Plugin (SHINES Alignment)

enum BackendProfile { None, Shines } resolved only in boot_standalone (services/craig-intake/src/main.rs:216). All SHINES code lives under services/craig-intake/src/backend/shines/. Stripping SHINES = BackendProfile::Shines → None + delete the directory. The core SubmitReportRequest (crates/craig-intake-contracts/src/report.rs) gains zero new top-level SHINES scalars; integrated/native mode is byte-for-byte unchanged.

pub(crate) trait IntakeSink: Send + Sync (#[async_trait], matching AuthzEngine/RulesetSource) in services/craig-intake/src/sink/mod.rs:

ForwardRequest<'a> bundles today’s forward params (partner_context, received_request_id, body: &SubmitReportRequest, description, ip_hash) plus raw: &serde_json::Value — the full submitted body intake already computes for raw_submission forwarding. The trait references NO SHINES type: ShinesSink deserializes its typed ExtraFields/NarrativeView/entry-extensions from raw internally (a // PARTNER-EDGE-UNTYPED boundary inside backend/shines/), so deleting backend/shines/ leaves the generic seam compiling — the "strip cleanly" guarantee holds. CasesForwarderSink uses raw as the forwarded raw_submission value (its only consumer of raw); it parses no backend-specific extra fields. The handlers compute raw once (serde_json::to_value(&body)) and pass it by reference, so cases-mode behavior is byte-identical to the pre-refactor sink (which computed the same value internally). CasesForwarderSink and ShinesSink are the two impls; the cases-specific BOLA/attachment methods
accessors stay on the concrete cases type (verified: no handler mixes a trait method with a BOLA method except partner-status, which can hold both via two `Extension`s).

TrackingReference — a String newtype (SHINES record IDs are legacy NUMBER`s, not UUIDs). Full blast radius (verified — pre-1.0 contract change → `CHANGELOG Changed): the server AcceptedReport (sink/cases_forwarder.rs:23), ReportStatusResult (:30), the inline server ReportConfirmation (api/public.rs:27 — NOT in craig-intake-contracts), CasesForwarderSink::get_report_status(id: Uuid)’s signature, and the status route `Path<Uuid> params (public.rs:123, partner.rs:243). Plus three SDK surfaces in lockstep — Rust (craig-intake-sdk dto.rs:437 ReportConfirmation.id, :449 ReportStatus), Python (sdks/python/…​/types.py — already str), and TypeScript (sdks/typescript/src/types.ts:53). Each SDK’s check_status(…​) client method param also changes from Uuid to the string tracking reference (crates/craig-intake-sdk/src/client.rs:182 + its doc comment, client.ts, client.py). Cases backend wraps TrackingReference(uuid.to_string()).

The SHINES report shape is captured in typed views, never the narrative: Value bag:

SHINES wants discrete singular motherInfo/fatherInfo; CRAIG has a generic adults[] with no parent axis. The designation is captured, not derived: a per-adult shines_household_role: Option<ShinesHouseholdRole> (Mother|Father|Other) on AdultEntry, populated only in standalone-SHINES (form + API). The mapper selects the adult with Mother → motherInfo, Father → fatherInfo, all others → otherHouseholdInfo[]. Validation (MR3 fidelity / MR7 rules): at most one Mother and one Father; a missing designated parent yields an omitted SHINES object unless the required-field manifest marks it required (then a typed 422).

backend/shines/crosswalk.rs: a RefValCrosswalk trait + a GaRefVals impl on the craig-reference::afcars::gender_to_afcars pattern (crates/craig-reference/src/afcars.rs:13). Five net-new crosswalks the mapper needs, none of which exist today; placeholder integers are pinned in this plan (appendix B) so the MR3 hash-pinned mapper test is reproducible across implementers, each marked // PLACEHOLDER REFVAL — replace with authoritative SHINES RefVals (#692):

backend/shines/mapper.rs: typed CpsRequest + pure fn map(body, entries, narrative, extra) → Result<CpsRequest, MapError> (thiserror). MapError arms: SsnNotNumeric (digits-only after stripping dashes; the proposed SHINES contract uses a string ssn to avoid the leading-zero loss an integer would cause — flagged for SHINES confirmation, #691), MissingDesignatedParent, UnmappedRefVal. No silent unwrap_or(0). backend/shines/fidelity.rs: a typed required-field manifest (conservative stub from the docx; flagged dependency #693) + a boot_standalone gate that fails closed via anyhow (never panic) when a required field has no source or a crosswalk enum is unmapped.

backend/shines/sink.rs: impl IntakeSink for ShinesSink. forward runs the mapper, POSTs CpsRequest synchronously to shines_url, parses the proposed response { "record_id": "<string>", "status": "accepted" }, and returns AcceptedReport { tracking: TrackingReference(record_id), submitted_at }. get_report_status returns a typed Unsupported error (SHINES has no status-read contract in v1), and the status-lookup route is NOT mounted under Shines — the tracking reference is a durable submission receipt the reporter keeps, not a lookup key. This also moots the enumeration concern: SHINES legacy record IDs are not the unguessable UUIDs the cases-mode status endpoint relied on, so exposing a status lookup over them would be an enumeration vector — not offering it is the correct posture. Reuses redact_upstream_error
with_service_identity for the forward POST.

A new minimal workspace member + binary (Alpine/musl/rustls; non-root; HEALTHCHECK), standalone-only, port 8010. Store: an unencrypted JSON flat file (atomic write via temp-file + rename; an in-process parking_lot::RwLock; single instance). It exposes the existing contracts so intake reuses its clients:

Reuse the JWK/types from craig-signing / the existing partner_signer_keys DTOs where they fit. Devstack: add a craig-intake-keyring service + a standalone-SHINES intake profile via cargo xtask dev (never docker compose).

build_router (main.rs:262) gains a BackendProfile param. Under Shines the partner router is assembled differently — not "drop one middleware." A DISTINCT signed-submit path is required because the existing submit_report_partner cannot be reused: it enforces a partner-id binding verification.partner_id == api_key.id (partner.rs:95) and runs the public-only reporter-type validator (validation.rs:87 via prepare_submission, partner.rs:183). Under Shines:

services/craig-intake/src/relevance/: FieldRule { field: FieldId, relevant_when: Predicate, required_when_relevant: bool }; a typed Predicate over already-captured top-level scalars with a typed operand: enum Predicate { Always, Eq(FieldId, ScalarValue), In(FieldId, Vec<ScalarValue>), IsTrue(FieldId), Present(FieldId), Not(Box<..>), And(Vec<..>), Or(Vec<..>) }, enum ScalarValue { Str(String), Bool(bool) }. Pure evaluate_relevance(rules, body, extra) → RelevanceOutcome (relevant set + missing-required → typed ApiError). The FieldId space spans core SubmitReportRequest scalars and ExtraFields top-level scalars (so appendix C rules referencing is_in_foster_care/is_in_military resolve); under Shines the handler parses + sanitizes ExtraFields from raw (D3) before evaluation, so the same sanitized values feed the rules and the sink. Consumed by prepare_submission (validation.rs:429), the schema endpoint, and the form driver.

Parity rule (exact): today’s report.html:39 x-if="form.reporter_type !== 'anonymous'" gates the four optional reporter-contact fields. Encode as 4 rows: for each of reporter_first_name, reporter_last_name, reporter_phone, reporter_email → relevant_when: Not(Eq(reporter_type, Str("anonymous"))), required_when_relevant: false (they are Option today — relevance hides them; nothing becomes required, so no regression). The per-entry adult conditionals (is_active_duty → military_branch, validation.rs:345) stay in validate_adult_entry (already DRY server-side); entry-scoped rules are out of scope.

GET /public/v1/intake-schema (public, un-authed, rate-limited; Kerckhoffs-fine — schema is not a secret), utoipa-annotated, returns { backend_profile, fields: [{ field, relevant_when: <Predicate JSON>, required_when_relevant }] } (per-rule key is field, matching FieldRule.field — the wire shape MR5 shipped + hash-pin-locked). Profile-aware (MR7/#687): field_rules(profile) returns the 4 core rows under None and core + the 5 appendix-C SHINES rows under Shines; the response carries backend_profile ("none"/"shines") so the form (MR7a/#695) can gate the SHINES section (no rule ⇒ shown is the MR6 default, so the section is gated on the profile flag, not on rule-absence). The form driver (static/js/intake-schema.js, loaded after config.js, before alpine.min.js) fetches it and toggles x-show/required — strict CSP (script-src 'self') already permits a static fetch driver.

Files: services/craig-intake/src/sink/{mod.rs,cases_forwarder.rs}, main.rs:262, api/{public,partner}.rs (the inline ReportConfirmation + Path<Uuid>→string status params), the three SDKs (crates/craig-intake-sdk/src/types/dto.rs, sdks/python/…​/types.py, sdks/typescript/src/types.ts). Per D2 (full blast radius listed there). Move AcceptedReport/ReportStatusResult to sink/mod.rs; introduce TrackingReference; change get_report_status(id: Uuid)→`(&TrackingReference); install `Extension(Arc<dyn IntakeSink>) on submit/status + keep concrete Extension(CasesForwarderSink) on the partner router. Verify: cargo nextest run -p craig-intake -p craig-intake-sdk green; both modes still forward to cases; the public report→status round-trip still works with the string tracking reference.

Files: backend/mod.rs (BackendProfile), services/craig-intake/src/main.rs (mod backend), config.rs, crates/craig-reference/src/enums.rs (ShinesHouseholdRole), crates/craig-intake-sdk/…​/dto.rs. Per D1+D4 + the SDK side of D3. config.rs: restructure the unconditional cases_url.is_none() guard to a (mode, backend_profile) match — standalone-Shines requires shines_url+keyring_url (not cases_url), Shines+integrated is rejected, every other config requires cases_url; add backend_profile
shines_url + keyring_url; update Debug; rewrite the standalone_requires_cases_url test
add the SHINES-mode cases. SDK (Rust): Child += grade; Adult += shines_household_role (ShinesHouseholdRole), contact_number, alt_contact_info, rel_to_primary_caretaker, is_other_member; Narrative += occur_again, child_danger. (Python/TS SDKs model children/adults/narrative as untyped bags, so the per-person/narrative lockstep is vacuous there — no change.)

Files: crates/craig-reference/src/shines.rs (new) + lib.rs. Per D5 + appendix B. A set of pub fn crosswalks (race_to_shines_id / marital_status_to_shines_id / language_to_shines_id placeholders; gender_to_shines_code / reporter_type_to_shines_rep_type / bool_to_shines_yn / opt_bool_to_shines_yn stable) modeled on the afcars pattern, each placeholder marked // PLACEHOLDER REFVAL … (#692). Verify: exhaustive variant-iteration tests (total coverage — strictly stronger than a proptest sample for a finite enum): every variant maps to a non-sentinel code; language ids unique; appendix-B placeholder pins.

Files: backend/shines/{mod.rs,extra.rs,narrative.rs,mapper.rs,fidelity.rs,sink.rs}, api/validation.rs (ChildEntry/AdultEntry extensions consumed by the mapper), api/{mod.rs,public.rs} (public_routes(mount_status)), main.rs boot wiring (boot_standalone branches on the backend profile → select ShinesSink + run the fidelity gate under Shines; build_router takes the public IntakeSink + optional partner wiring; do NOT mount the status route — D7), a host-owned SHINES CPS-intake mock in tools/craig-mock-server (shines.rs, merged like the broker — SHINES is a backend, not a registry partner). Per D3 (server side)
D6 + D7 + appendix A. The server ExtraFields/NarrativeView/extended entries + mapper + fidelity are defined here, where the mapper + ShinesSink consume them (the R2 resequencing above — no dead-code window). ShinesSink parses its typed views from ForwardRequest.raw (D2 — no SHINES type on the trait); get_report_status returns Unsupported (503; its route is unmounted). NOTE (2026-06-23): the SDK client-side ExtraFields (top-level merge) + the proposed-SHINES OpenAPI schema are deferred to MR7/MR10 (their consumers — the form/typed submitter and the published spec — land there); MR4 is the server-consumed surface only. Verify: mapper hash-pinned unit test (fixed input → CpsRequest JSON SHA256, NCANDS-TSV precedent); SsnNotNumeric/MissingDesignatedParent sad-paths; fidelity boot-gate sad-path; mock integration via craig_mock_server::spawn_for_test() (submit → mock received the mapped CpsRequest, tracking reference returned + echoed); status route absent under Shines.

Files: relevance/mod.rs (new), api/validation.rs (prepare_submission enforces the rules post-sanitize), api/public.rs (new GET /intake-schema + IntakeSchema DTO), api/mod.rs (ApiDoc), main.rs (mod relevance). Per D10. Verify: evaluator unit + proptest (a hidden-because-irrelevant field is never required); a wire-shape lock test on the /intake-schema JSON (the form-driver contract); the parity rule reproduces today’s anonymous-hides-contact-fields behavior with no new required field.

NOTE (MR5 reconciliation, 2026-06-23): (1) evaluate_relevance(rules, body) does NOT take the extra (ExtraFields) param D10 sketched — no MR5 rule resolves an ExtraFields field id, so the param + those field ids land in MR7 (687) with the appendix-C rows that use them (define-where-consumed; avoids a dead param). (2) RelevanceOutcome carries missing_required only, not the "relevant set" — the relevant set has no server consumer (the form driver computes visibility client-side from the schema); it can be added in MR7 if a server need appears. (3) The Predicate grammar ships whole (the schema + form-driver wire contract): the In/IsTrue/Present/And/Or/Always arms are unit-tested but gain their first production FieldRule consumers in MR7, carried by a [cfg_attr(not(test), expect(dead_code, …))] that self-clears.

Files: static/js/intake-schema.js (new) + ui.rs route, static/report.html (replace the hand-coded x-if). Per D10. Verify: DOM/e2e check that visibility + required track reporter_type from the schema; no regression vs. the hand-coded conditional; CSP unchanged.

R2 (2026-06-24): split 3 ways. As originally scoped MR7 spanned five subsystems (relevance engine, profile-aware schema, server capture/sanitization, the form + a devstack SHINES instance + e2e, and a 3-SDK lockstep) — past one reviewable unit. #687 is now the server core; the form/devstack/e2e moves to #695 (MR7a) and the 3-SDK ExtraFields lockstep to #696 (MR7b). Producer→consumer boundary: #687 makes the server enforce/serve/forward the SHINES rules; #695 makes a form render them (proved over HTTP); #696 gives typed SDK submitters parity.

#687 files: relevance/mod.rs (the appendix-C FieldRule rows in a profile-aware field_rules(profile), IsTrue/Present predicates over new ExtraFields/ICWA FieldId`s + an `extra: &ExtraFields resolve source; require_satisfied now returns 422 to match garde validation), backend/mod.rs + backend/shines/extra.rs (Serialize/ToSchema derives), api/validation.rs (prepare_submission(body, extra, profile)
parse_extra_fields + sanitize_extra_fields + sanitize_forwarded_freetext_in_place over the untyped children/adults/narrative free text — D3; without it those bypass HTML/control-char stripping), api/public.rs (the Bytes read so the public path can parse ExtraFields like the partner path — Shines-gated so a None body’s SHINES-shaped keys are ignored as today; profile-aware intake_schema
IntakeSchema.backend_profile; raw-merge of sanitized core + populated ExtraFields), api/partner.rs
main.rs (profile Extension) + api/mod.rs (OpenAPI). No "badge number" — that field exists in neither schema; the ADR example is illustrative only. Verify (Rust unit + integration, bin-only crate): GET /intake-schema returns core-only under None and core+SHINES under Shines + a backend_profile field; a required-when-relevant SHINES field left blank ⇒ 422 via prepare_submission under Shines; an ExtraFields/per-person/narrative string with embedded HTML is stripped; a None submission carrying SHINES keys stays unaffected (no 4xx, raw core-only).

Files: static/report.html + static/js/report-form.js (render the ExtraFields + per-person inputs in a section gated on the Shines profile via the backend_profile from /intake-schema; merge ExtraFields as top-level keys + reset), a devstack craig-intake-standalone-shines instance (shines_url→mock SHINES route, keyring_url→placeholder — the public form never contacts the keyring; not dependent on #688)
a Playwright intake-ui-shines project. Verify: e2e — SHINES fields render only under Shines; required-when-relevant blank ⇒ 422 on the form.

Files: crates/craig-intake-sdk (an ExtraFields struct merged top-level into the submit body), sdks/python + sdks/typescript (the untyped ExtraFields merge, per the existing per-person/narrative design). Verify: the public-intake drift/integration tests guard SDK↔server ExtraFields parity.

Files: new services/craig-intake-keyring/ (Cargo member, main.rs, flat-file store, the 4 routes), Dockerfile, devstack wiring, xtask service registration as needed. Per D8. Verify: register → lookup-by-kid round-trip; replay-check dedups by jti; approve/revoke lifecycle; atomic-write crash-safety test; cargo nextest run -p craig-intake-keyring.

Files: main.rs build_router (BackendProfile param; under Shines mount the new submit_report_signed route, omit api-key middleware + the cases-bound status/attachment routes) boot_standalone (point SignerAuthClient/JwsReplayClient at keyring_url); backend/shines/signed_submit.rs (the distinct handler — JWS-verify, replay-by-jti, NO partner-id binding, full reporter-type set); api/validation.rs (prepare_submission gains the ReporterTypeSet param); the three SDK clients (signature-only submit, no X-Api-Key); api/mod.rs (X-JWS-Signature OpenAPI security scheme); ui.rs + copies of craig-sign.js
key-registration.js into services/craig-intake/static/js/ + a registration page. Per D9. Verify: a browser-generated key registers → admin-approves → a JWS-signed API submission with that active kid (and a professional/law_enforcement reporter type) is accepted and forwarded to SHINES; an unknown/revoked kid, a replayed jti, or an unsigned submission is rejected; the public-form path still uses the public reporter-type subset.

Files: tests/e2e/specs/, docs/modules/ROOT/pages/ (proposed SHINES API spec + sidecar page + intake architecture + services.adoc + the ADR-042 finalize edits), CHANGELOG.adoc. Verify: Playwright (form
signed-API submit against the SHINES mock + sidecar) via cargo xtask e2e --no-refresh; check-docs clean.