{"id":"https://example.org/dc-hcv/acceptance-policy.json","version":"0.1.0","status":"proposed-not-DCHA-policy","language":"dc-hcv-evidence-policy/v0.1-declarative-only","scope":"accept employment evidence for one employment stream; never determine eligibility","ownership":"agency-controlled; never accept a trust policy supplied by an applicant","sourceRequirements":{"consecutiveStubCount":{"weekly":4,"biweekly":2,"semimonthly":2,"monthly":2},"documentWindow":{"reference":"agencyContext.requestDate","maximumPriorDays":60,"futureDocuments":"manual-review"},"source":{"url":"https://www.dchousing.org/wp-content/uploads/2026/09/Final-Housing-Authority-Administrative-Plan-7-10-2026.pdf","sections":["5500.34","5500.36","5502.3"]},"additionalChecks":"Staff may request more evidence; required EIV review remains separate."},"trust":{"mode":"exact-leaf-certificate-sha256-pins","certificates":[{"id":"synthetic-payroll-signer","sha256Der":"756600abc8c809e409008a10405c0ea35bf5fec3dd9a81da1b7f82c7581208ea","authorizedEmployerIds":["example-employer"],"authorizedEvidenceTypes":["signed_pay_stub"]}],"fixtureOnly":true,"certificateValidation":{"validateAt":"agencyContext.evaluationTime","requireValidityPeriod":true,"requireDigitalSignatureKeyUsage":true,"requireRevocationStatus":"good","unknownRevocationStatus":"manual-review","allowedSignatureAlgorithms":["rsa-pss-sha256","ecdsa-p256-sha256"],"algorithmParameters":"RFC 4055 SHA-256/MGF1-SHA-256/saltLength 32 for RSA-PSS; P-256/SHA-256 for ECDSA","minimumRsaBits":2048,"timestampPolicy":"Do not use an untrusted signingTime attribute to bypass expiry or revocation."}},"automaticAcceptance":{"allChecksRequired":["submission_schema_valid","unique_ids_and_references_resolve","stream_member_and_employer_match_authority_records","every_selected_evidence_is_a_signed_pay_stub","cms_signature_valid_for_rfc8785_payload_bytes","actual_signer_certificate_matches_one_authorized_pin","certificate_valid_and_not_revoked","signer_authorized_for_payload_employer_and_evidence_type","employee_reference_matches_stream_member_via_authority_binding","signed_payload_evidence_id_matches_outer_id","source_document_bytes_match_signed_sha256","pay_frequency_and_employer_match_stream","dates_are_ordered_and_not_in_the_future","document_within_request_date_window","enough_distinct_current_consecutive_pay_stubs","no_known_conflict_or_staff_hold"],"onAllPass":"accept-employment-evidence","otherwise":"manual-review","onMissingEvidence":"request-additional-evidence","onVerificationUnavailable":"manual-review","eligibilityEffect":"none"},"consecutiveDefinition":{"groupBy":["memberId","employerId","payFrequency"],"distinctBy":["payload.payrollSequence","payload.sourceDocument.sha256"],"require":"Select at least the required count with adjacent signed payrollSequence values and nonoverlapping pay periods consistent with the frequency.","current":"The selected sequence must end at the most recently completed payroll period according to an authority-verified employer pay calendar as of requestDate.","calendarUnavailable":"manual-review","note":"Payroll sequence and calendar checks are proposed interoperability rules, not quoted DCHA requirements."},"trustedRuntimeInputs":["agency-generated requestDate and evaluationTime","authenticated applicant-to-member binding","authority-maintained employer employeeReference-to-member mapping","authority-verified employer payroll calendar","agency-controlled pins, revocation information, conflict flags and staff holds"],"decisionRecordRequired":["policyId","policyVersion","applicationId","employmentStreamId","evidenceIds","verifiedPayloadSha256","actualSignerCertificateSha256","evaluatedAt","checkResults","outcome","reasonCodes"],"implementationStatus":"The versioned employment-evidence evaluator runs the declared checks with CMS/JCS verification and SHACL document-age validation. Automatic acceptance requires every required check to pass using configured runtime and policy pins plus trusted agency dates, identity/employment bindings, payroll calendars, and clearance. Default demo startup has no authority-context provider and routes to review. Identity-provider login, OAuth delegation issuance, wallet verification, and human approval ceremonies remain separate integrations.","runtime":{"signatureVerifier":"CMS/JCS exact-leaf profile","configuredPins":[{"sha256Der":"756600abc8c809e409008a10405c0ea35bf5fec3dd9a81da1b7f82c7581208ea","authorizedEmployerIds":["example-employer"]}],"fullPolicyEvaluator":true,"authorityContextProviderConfigured":true,"revocationProviderConfigured":true}}