Plan: SSA Benefit Verification (SOLQ / SDX / BENDEX) for IV-E Eligibility

A1 (M) crates/craig-partner-ssa-solq from the WIC template with two departures: closed categorical error enum (Display emits no upstream bytes — S2; at most the bounded numeric HTTP status), and no in-crate mock/mock feature (S10). As built, "bounded-read and discarded" is split per the plan’s own traceability: the adapter DISCARDS every upstream-controlled byte at its mapping boundary (transport bodies, reqwest text, serde decode context — canary-tested through the full send path), while the transport-level response byte-CAP lands with B4’s S13 egress controls (V9 "response byte-cap") — the transport hands adapters an already-fully-read Vec<u8>, so A1 alone cannot bound the read. Wire types are FIELD-FREE #[non_exhaustive] placeholders pending the real Gateway contract (inventing fields would fabricate a contract, the S9-class hazard; unknown fields tolerated on decode so the first real response cannot fail on unmodeled fields). The typed_only erased registration (A2’s innermost layer) is adopted in-crate with refusal + probe-forward tests. Workspace member + deps; the #492 dto-length walk gains the crate (the 3 pre-existing missing partners = #1461). Blockers: none.

A2 (M) DispatchClass::{Generic, TypedOnly} as a REQUIRED ErasedAdapter::dispatch_class() method (craig-exchange-contracts/src/erased.rs) — as built, the metadata rides the erased trait via the impl_erased_adapter! arms (existing two arms Generic, new typed_only arm), NOT the factory-entry tuples: registries materialize adapters at boot, so ExchangeRegistries::dispatch_class_of(kind) derives from the materialized map with zero bundle-contract changes. The typed_only arm’s erased send_value/audit_value also refuse unconditionally (ErasedAdapterError::TypedOnlyDispatch, categorical) — a 4th, innermost layer under the three checkpoints. Hard rejection (typed 422 / worker terminal-categorical typed-only-dispatch) in api/transactions.rs send pre-claim, /retry in-tx pre-restage, and send_worker dispatch pre-resolve — all keyed on the PARTNER-ROW kind via dispatch_class_of (never resolve(), whose noop:// substitution would mask the kind). Synthetic-kind unit tests pin the macro arms (incl. the categorical-refusal canary), the registry lookup (incl. the noop-masking contrast), and the shared ingress guard (422 shape/field); the WORKER checkpoint’s wiring is deliberately untestable pre-A3 (no TypedOnly kind is registrable in a real boot), so its proof — a #1195-style direct-SQL worker terminal test — rides A3 together with the live ingress-rejection lockstep extension. Blockers: none.

A3 (S) Registration: GeorgiaBundle factory + audit codec entries (craig-state-ga/src/lib.rs:104–129), PINNED_KINDS 11→12 + lockstep test extended to assert generic-path rejection for every TypedOnly kind (adapters/mod.rs:38–68) + the deferred A2 worker-checkpoint proof (a #1195-style direct-SQL flip to the registered TypedOnly kind must terminal-fail typed-only-dispatch, never dispatch — as built, ordering INVERTED vs t1195: stage under a generic kind first, then CAS-flip the partner row inside the worker’s poll window, because the registered kind 422s at ingress), craig-partner-audit closed enum + decode_jsonb arm, seed inventory — as built, a DELIBERATE ABSENCE with the reason committed at the inventory site: seeded partners are born active (no active flag in the seed model), so any seeded ssa_solq row would violate this unit’s own refusal; the B-phase seeds the SSA partner when the typed pipeline exists — mock-route token test (flipped to adapters-minus-ssa_solq; the first adapters↔mocks count desync, by S10 design), GA feature wiring (dep only — no mock forward; the crate has no mock feature), and the partner active=true refusal for every TypedOnly kind (keyed on dispatch_class_of, NOT the literal token, so future TypedOnly kinds inherit it; 403 FEATURE_DISABLED naming the lift; covers create (rows born active), kind-flip-while-active, and PATCH {active: true} resurrection; {adapter_kind, active: false} stage-ahead stays legal; lifted for non-prod in B4, for prod in Phase P). Blockers: A1, A2.

A4 (S) SsnDigest newtype per SD12 in crates/craig-cases-contracts. As built: canonical wire form is ONE string v{version}:{44-char base64} (serde try_from/into String — a stable byte form the B1 cohort hash binds to); PartialEq IS the constant-time compare over the full canonical bytes (version + digest together; .version() exists so B2 classifies a rotated-away version as its own refusal per V2); redacted Debug, no Display, categorical errors. Wire-only — NO sqlx::Type yet (B1 decides tagged-single-TEXT vs digest+version columns when its DDL lands; the one-string canonical form keeps both trivial); no ToSchema (consuming DTO fields annotate value_type = String, the Sha256Hex precedent). The three PRE-EXISTING bare-String digest wire fields in persons.rs (SsnVerificationStatus.digest, AttestSsnRequest.digest, FederalExportRow.ssn_digest) retype in #1435 (after B2, so the emit-side version-stamping seam exists once), not this unit. Blockers: none.

A5 (M) ADR-065 + ADR-066 (numbers free after adr-064) with UD1–UD3 drafted as options; ratified 2026-08-14 (#1434) and the ADR-051 amendment applied in the ratification commit. Blockers: none.

B1 (L) Screening schema in craig-exchange: ssa_screening_runs / ssa_screening_members / typed job table. DDL invariants (H11): status CHECKs, timestamp ordering, status-dependent nullability, FKs, one-active-run-per-case partial unique index, unique txn↔member. Cohort binding (H1): cohort hash over (member set, versioned digests, as-of), freshness horizon (UD11), invalidation marker. Rows are provenance-grade (H3/H14), not prunable transport. As built (#1462): the A4-deferred digest column shape is the tagged single TEXT (ssn_digest stores SsnDigest::as_str() verbatim under a mirroring grammar CHECK); the invalidation marker is ORTHOGONAL to run status (a one-way invalidated_at
invalidation_reason pair — it can stamp a completed run, and either completion or invalidation releases the one-active slot); member.transaction_id is a logical fk (ADR-065 §D4 makes SSA transaction rows prunable transport, so provenance must not enforce-FK them), unique fleet-wide; the typed job table ships the exchange_send_jobs lease shape (claimed_at/claim_generation) day-one plus the H16 paused status, and NO payload column (H18/SD14). cohort_hash + SCREENING_FRESHNESS_MONTHS (12, a const not a knob)
the stale-on-anniversary screening_is_fresh live in craig_cases_contracts::screening_cohort (the ADR-057 shared-crate precedent — D3 recomputes the same bytes); status enums in craig-reference. Store modules deliberately deferred to their consumers (B3 staging, B4 worker) — B1 is schema + DDL-invariant probes against the real migration file. Blocker: A4.

B2 (L) Cases custody extension: S2S plaintext release taking person_id
expected_digest + purpose + run correlation; release only on exact current-digest match (S3); mismatch → typed 409, member terminally ssn_stale. Exchange-only allowlist (S6); dedicated custody-purpose gate, fail-closed for plaintext regardless of UD3 (H21); full audit; As built (#1463): POST /v1/cases/persons/{id}/ssn-release — allowlist is a handler const (NOT a ruleset row, per H21); version checked BEFORE bytes so a rotated-away blind-index version refuses as its own 409 (ssn-digest-version-rotated) distinct from ssn-digest-mismatch; the compare is SsnDigest constant-time equality against the stored digest stamped with the effective registry version (the #1435 emit-side seam); one row snapshot feeds compare AND decrypt; unverified emission per §D5’s carve-out; releases ride case.person_pii_exported (purpose = ssa_solq_screening + correlation trio), digest-class refusals stage the categorical case.person_ssn_release_refused in their own tx; the caseworker attribution rides the BODY (requested_by = the run’s stage-time actor — a B4 background release has no live actor to relay; ADR-065 §D2 as-built). Member ssn_stale terminalization is the CALLER’s move (B4) — cases returns the typed 409. actor propagation (caseworker actor for audit, service identity for authn). Blockers: A4, A5.

B3 (L) Request path: cases-owned per-case, BOLA-checked screening intent (caseworker actor); cases forwards to a cases-only exchange endpoint; WEB mints and retains client_request_id, cases forwards unchanged, exchange claim_first creates run + members
transactions + typed jobs atomically (H4, reusing request_claims). New ResourceType::{ScreeningRun, BenefitFact} (craig-authz/src/types.rs:45) + GA/TX authz fixtures + boot coverage. Partner resolution zero/one/many fail-closed + active/DSA check at stage time (H15). Blockers: B1, B2, A3. As built (#1464): POST /v1/cases/cases/{id}/ssa-screening (human-only intent — deny_pure_service + per-case Action::Update BOLA; cohort assembled SERVER-side from active household members, every member’s digest version-stamped through the B2 seam; members without an SSN refuse typed naming the persons — skipping them would fabricate a complete UD1 witness) → POST /v1/exchange/ssa-screening-runs (SD5 allowlist = handler const craig-cases; the UD3 knob CRAIG_EXCHANGESSA_SCREENINGENABLED default OFF gates this one write). The staging wire DTOs live in craig_cases_contracts::screening_wire (the cohort in motion — craig-exchange-contracts stays the pristine Plan-T3.1 leaf); the caseworker attribution rides the body (requested_by/requested_by_name, the §D2 as-built posture — cases authenticates as ITSELF via its OIDC principal, the first cases→exchange client). Exchange re-derives everything derivable: ordinals from the canonical cohort sort (never wire order), the cohort hash recomputed via the ONE shared fn and refused on mismatch; the one-ACTIVE-run-per-case check runs POST-claim so replays short-circuit at the claim; H15’s DSA validity consult is the first in the codebase (status active + unexpired on the business date). Exchange refusals relay VERBATIM through cases (status + problem body, no translation). The WEB mint lands with E1’s form — B3 proved the protocol end-to-end (full-chain replay test: same client-held id → the same run through both services). Runtime staging stays operationally dark until B4 lifts the A3 activation lock; tests reach it via the documented direct-SQL partner flip, serialized under the ssa-partner-slot nextest group (the slot is deployment-global state). NO events yet (B6). Rulesets for the two new ResourceTypes are deliberately deny-all in BOTH jurisdictions until D4 defines reads (recorded in the files + pinned in L3).

B4 (XL) Typed SSA worker (never the generic dispatcher): claim typed job → last-responsible-moment re-check of gate + partner-active + DSA + endpoint/adapter drift (H15/H16, pause-vs-terminal table) → value-bound JIT custody call (S3) → minimal wire payload built separately from the persisted job (H18; modeled correlation field) → send under egress controls (S13). Dedicated lease budget with compile-time floor lease ≥ 3 × (custody_timeout + send_timeout) or heartbeat extension (H17); failure-mode classification (custody timeout ≠ partner timeout ≠ stale digest ≠ auth failure). Non-prod ssa_solq activation unblocks here only for the dev loopback/mock allowlist; the production block stays code-level (S4). Blockers: B3, A2. As built (1465): services/craig-exchange/src/ssa_worker.rs + the NEW craig_exchange_transport::EgressControlledTransport (S13: https-only with a literal-loopback http dev carve-out; exact-host allowlist where EMPTY denies all; DNS resolve-then-vet-then-PIN via the client resolver override — https-class hosts must not resolve into internal space; redirects surface as BadStatus, never followed; the A1-deferred 1 MiB response byte-cap on success AND error bodies, chunked-read). The worker processes claims SEQUENTIALLY (CLAIM_BATCH = 2) so the lease math is compile-provable: CLAIM_LEASE_SECS = 120 ≥ 3 × (5s custody + 30s send) AND batch × worst-case < lease, both const asserts (the H17 floor branch; heartbeat not needed at this volume). Pause classes (H16, job paused + categorical last_error, re-admitted by direct operator UPDATE until resume tooling lands): gate-disabled / partner-unavailable / dsa-not-active / egress-refused — the egress pre-check runs BEFORE the custody call so plaintext is never released for a refused send. Custody classification: digest-class 409s → member terminally ssn_stale + job ssn-stale; person 404 → person-missing; cases outage → retryable custody-unavailable within the lease (V5). Partner errors classify per closed adapter variant (partner-timeout/-connect/-transport/-status/ -malformed) and retry to the cap. The wire payload is the extended SolqScreeningRequest (ssn wire-transient + modeled correlation_id + schema_version; Debug redacts; [non_exhaustive] so C0 extends additively); on sent the member STAYS pending — the response hand-off is B5’s. The activation lift is ENDPOINT-SHAPED (noop:// or literal-loopback http(s) hosts pass refuse_typed_only_activation; anything else remains code-blocked naming Phase P) — a host-literal check, deliberately not DNS. The exchange→cases custody client is the second S2S client (CRAIG_EXCHANGE__CASES_BASE_URL); the worker registers Observed + knob-gated (WORKER_POLL_SECONDS, 0 = Disabled — the devstack posture, so in-process test workers are the only claimers; the ssa-partner-slot group also covers the worker + activation suites). The exchange lib seam grew to carry the worker/store modules for the in-process tests (the #1185 doctrine).

B5 (L) Results + benefit facts, per the RATIFIED #1479 design (2026-08-17 — all six forks; working record on #1479, carried AC on #1466; decision record: ADR-065 § Amendment #1479 + ADR-066 § Amendment #1479): categorical per-member outcomes with per-member ambiguous fail-closed (digest-lookup ordinals/chunking moved to C2 per D21); the SD10 fact model in cases — ssa_benefit_facts born insert-only, pointer-forward supersession chain, structural exactly-one-current, widened replay key with beneficiary_role in the chain identity — plus the ssa_screening_outcomes projection row (insert-only, no digests); the ONE cases-side outcome tx (POST /v1/cases/ssa-screening-outcomes: identity-hash claim → classification-only digest verify → authority refusal → fact chain with split-23505 → the guarded persons.ssn_verified CAS per UD2 with defined 0-row dispositions → projection insert); fenced aggregate run-state updates under worker claim generation (H2) — completion fires from EVERY member-terminal writer (complete_run_if_final); the pre-contract send-authority witness (SolqSendAuthority, no pre-P constructor) with the contract-pending pause as precondition #0; run invalidation writers (cohort_changed via producer-carried cohort_revision
watermark-hardened staging with fork-3 auto-supersede, freshness_expired, and operator_cancelled via the fork-1 audited human-only cancel endpoint), one-tx sweep of the paused/pending graph, freshness-bounded for completed runs (fork 2); model-level V7 tests via internal outcome fixtures; retention: runs/members admitted mutation-quiescent (the scoped ADR-058 amendment ships with this unit), specs/floor land in E3. Blockers: B4 (done; UD2/UD6 ratified 2026-08-14; UD4 ratified 2026-08-16; #1479 design ratified 2026-08-17).

B6 (M) Domain events (screening requested/completed/failed, benefit recorded/superseded) — PII-safe categorical payloads only; exchange.failed for SSA carries category codes only; catalog + parser deploy ordering per #1479 D17 (parsers before producers): B6a = event catalog (ADR-003 additions: case.screening_cohort_changed AND exchange.screening_run_invalidated) + security parser arms; B6b = the producers (publish_screening_cohort_changed at the cases seam; exchange emits exchange.screening_run_invalidated). The cohort-revision bumps and the exchange inbox consumer/binding ship in B5 (consumers-before-producers); the case.screening_cohort_changed payload is MINIMAL per fork 5 (case UUID
cohort_revision + categorical change token — no person_id, no digest). Blockers: B4, B5.

B7 (L) Phase-B verification battery: matrix rows V1–V5 + V7 + V9 (see Verification matrix (by invariant)). The battery adds the #1479 B5 lifecycle rows: witness unconstructibility, pause/resume/attempts-reset, invalidation races (event-before-staging 409, supersede, in_flight convergence), completion-from-every-terminal-path, the watermark invariant probe, V7 fact-chain assertions incl. successor-replay idempotency, and the retention fixpoint/PruneCountMismatch injections (the #1479 §6 matrix). Nothing downstream consumes screening results before B7 is green. Blockers: B4, B5, B6.

C0 (external, BLOCKED) Real fixed-width record contracts from Gateway/DHS. Interim: import endpoints refuse with a typed error naming this blocker; the persistence allowlist (SD9) finalizes only here.

C1 (XL) Import schema + state machine, ADR-057-exact: staging ledger (ssa_import_batches/ssa_import_records), finalize under advisory lease — 409 only for a concurrent lease holder, deterministic 200 for completed replay (H8); aborted/failed/retry/ crash-resume arms (H7); parse_error rows carry line number + bounded categorical error, never the raw line; attested_sha256 verified in memory, no blob persistence (raw files carry SSNs); cross-batch replay blocked by (source identity, record key) uniqueness + unique record→benefit provenance (H9); resource limits (bytes/rows/line/field/wall-time) + zeroize on SSN-bearing parse buffers (H10); terminal timestamps for retention (H14) — PLUS the E3 slices recorded 2026-08-22 (#1566): the ssa_import_batches/ssa_import_records archive specs on the exchange engine, BATCH-granularity UD10 holds (the run-granularity mechanism
events generalize), and the ssa_import_stale_finalizing gauge (C2 adds ssa_unmatched_rate/ssa_ambiguous_rate with the matching semantics). Admin-only, writes gated. Structure may land pre-C0; parsing refuses until C0 closes. Blocker: B1.

C2 (L) Matching + reconciliation: chunked digest lookup with per-item ordinals and invalid-SSN results; ambiguity fail-closed (H5); SSN-correction supersession — re-affirm digest at fact-read time or consume correction events (H13); late-matching REMOVED per UD8 (ratified 2026-08-16: dropped from v1) — C2 instead defines unmatched-record terminal behavior (finalize vs abort vs remediable, plus retention/metrics treatment) and the UD12 assembly-time association semantics (authz, ambiguity, correction, multi-case). Blockers: C1.

C3 (S) Test-only fixture generation (mock-server/xtask/cfg(test)); non-authoritative provenance; production hard-refusal. Blocker: C1.

D1 (M) zen-engine semantics spike: committed executable fixtures proving absent-key behavior on first-hit tables with "" catch-alls (S7) — tested, never assumed. Then the deprivation-table design: SSA-derived rows with explicit order/precedence before the catch-all (S8, UD13); byte-identical baselines for all existing non-SSA inputs. May start immediately.

D2 (L) Ruleset rollout mechanics: DB rule_sets rows are runtime truth (H23) — promotion/import, revision handling, cache convergence, canary, evaluation version pinning, rollback, audit. Blocker: D1.

D3 (L) Orchestration per UD1 (ratified 2026-08-14: cases-side authoritative assembly — screening witness freshness-checked per H1 + benefit facts loaded server-side; generic evaluate callers cannot claim the witness). Carries the UD5 worklist design (ratified 2026-08-16: notify, never silent re-eval — ownership, person→case fan-out, dedupe, assignment, dismissal, authz). Blockers: B7, D1.

D4 (L) Read APIs + DTOs: case-scoped list/latest, indexes, stable pagination, exactly-one-of filters (H12); DTO layer per ADR-065 (never serialize store models — H24); web reads proxied through cases authorization; the 202 relay never exposes internal exchange URLs (H22). Blockers: B5, A5.

E1 (M) Web UI via the cases proxy. Blocker: D4.

E2 (L) e2e under the caseworker-per-case identity (P7): actor relay, assignment, BOLA refusal; admin project only for import surfaces; gate-flip + partner-inactive scenarios. Blockers: E1, B7.

E3 (M) Ops: Operational acceptance acceptance + retention wiring (H14) for the LIVE Phase-B surfaces; horizons per UD4 (ratified 2026-08-16 — classification + the ≤90d bound are closed; the provenance handoff relation shape, FK direction, horizon clock, archive-success precondition, and hold interaction are designed HERE; the external DFCS schedule is #1480), FK deletion order, claims coordination, legal holds per UD10 (ratified 2026-08-16 — transitive-hold scope, set/clear authority + audit, sweeper-race semantics designed here). Blocker: B5. Scope split, recorded 2026-08-22 (#1566): the original C1 blocker edge is DISSOLVED — E3 ships the live-surface wiring now, and the import-side slices ride C1/C2 where the plan already places their mechanics (C1 owns "terminal timestamps for retention (H14)"): ssa_import_batches/ssa_import_records retention specs, BATCH-granularity UD10 holds, the ssa_import_stale_finalizing gauge, and ssa_unmatched_rate/ssa_ambiguous_rate (C2 matching). Deferring the ratified UD4/UD10 wiring behind a Not-started XL unit would have stranded the live tables' retention posture.

E4 (M) Georgia case-section export via the existing plugin runtime (P4 corrected: case_section contracts/runtime exist; only a shipped Georgia export is missing). federal-export is explicitly not touched (H19: no production caller exists; any future federal projection is a narrow per-purpose endpoint with its own contract). Blocker: D4.