Worker portal redesign: composability runtime + design-system extraction
## Summary
Reframe canopy-web from a fixed worker portal into a composition-driven runtime where jurisdictions edit TOML in `rulesets/{jurisdiction}/` rather than fork canopy. Five-layer storage model (user delta → role override → jurisdiction live override → TOML baseline → system defaults). Three composition surfaces (dashboard, case-detail, identity) all follow the same composition + override pattern.
Driven by external design package delivered 2026-05-14 (354 KB, 15 HTML canvases, ~13,700 LOC of `.jsx` reference, full `HANDOFF.md`).
## Plan link
[Worker portal redesign plan](https://gitlab.com/gadhs/application/eligibility/canopy/-/blob/main/docs/modules/ROOT/pages/plans/worker-portal-redesign.adoc) — canonical plan per ADR-013.
## Tracking issue
[#460 Worker portal redesign — composability runtime + design-system extraction](https://gitlab.com/gadhs/application/eligibility/canopy/-/issues/460)
## Stage 2 update (2026-05-20)
ADR-021 (composability runtime + plugin model) and ADR-022 (composition override storage layering) ratified. ADR-023 (promote-PR mechanism) **deferred** — the underlying question (where does composition baseline storage live + how does the promote workflow work?) was reframed as a canopy-wide config-backend concern, not composition-specific. Filed as **#507** (unified config backend across canopy domains). Composition v1 ships using the existing filesystem `rulesets/{juris}/` pattern; Studio promote affordance descoped from v1 (see #500 update).
#488 closed-deferred; #492 closed-deferred (Stage-3 promote-live-to-baseline implementation that depended on ADR-023).
## Out of v1 (per the design package's own deferrals + the reframe)
Plugin marketplace federation, applicant portal (ADR-008 separate Dioxus project), worker-journey microspec, determination sign-and-authorize ceremony, notice compose/preview UX, mobile/tablet, print views. Plus: Studio promote modal (descoped pending #507).
## Task list (19 active children, total weight 64; 2 deferred)
### Stage 1 — Design system extraction (1 MR, independent, low risk)
- [ ] #485 Worker portal Stage 1 — design system extraction (Askama partials + CSS utility classes) (weight: 3)
### Stage 1.5 — Panel-state primitives upgrade (1 MR, follow-up to #485, non-blocking)
- [ ] #505 Worker portal Stage 1.5 — upgrade panel-state utility classes to 4 Askama-macro primitives (weight: 3)
### Stage 2 — ADR ratification (2 of 3 MRs shipped; 3rd deferred)
- [x] #486 Worker portal Stage 2 ADR — composability runtime + plugin model (ADR-021, ratified 2026-05-20) (weight: 2)
- [x] #487 Worker portal Stage 2 ADR — composition override storage layering (ADR-022, ratified 2026-05-20) (weight: 2)
- [~] ~~#488 Worker portal Stage 2 ADR — promote-PR mechanism~~ **deferred → #507** (weight removed)
### Stage 3 — Composability runtime + storage layering (3 active MRs; 1 deferred)
- [ ] #489 Worker portal Stage 3 — DB migrations for composition override layers (weight: 3)
- [ ] #490 Worker portal Stage 3 — composition loader (TOML parse + role filter + override merge) (weight: 5)
- [ ] #491 Worker portal Stage 3 — live override APIs (read/write/archive endpoints) (weight: 3)
- [~] ~~#492 Worker portal Stage 3 — promote-live-to-baseline (git-host PR generation)~~ **deferred → #507** (weight removed)
### Stage 4 — Identity rework (2 MRs)
- [ ] #493 Worker portal Stage 4 — generic IDP loader from idp.toml (weight: 3)
- [ ] #494 Worker portal Stage 4 — IDP-aware sign-in template (weight: 2)
### Stage 5 — Core surfaces (4 MRs)
- [ ] #495 Worker portal Stage 5 — worker dashboard (12-panel kit, composition-driven) (weight: 5)
- [ ] #496 Worker portal Stage 5 — supervisor + analyst dashboards (role overrides) (weight: 3)
- [ ] #497 Worker portal Stage 5 — case detail (3 shell strategies + 13 section types) (weight: 8)
- [ ] #498 Worker portal Stage 5 — customize my dashboard (per-worker deltas) (weight: 3)
### Stage 6 — Maintainer surfaces / Jurisdiction Studio (3 MRs)
- [ ] #499 Worker portal Stage 6 — Studio onboarding wizard (weight: 3)
- [ ] #500 Worker portal Stage 6 — Studio live-mode composer (weight: 3; was 5 before promote modal descoped to #507)
- [ ] #501 Worker portal Stage 6 — Plugin Studio (developer view) (weight: 5)
### Stage 7 — Polish (3 MRs)
- [ ] #502 Worker portal Stage 7 — ⌘K command palette (weight: 3)
- [ ] #503 Worker portal Stage 7 — audit log unified surface (system + case scopes) (weight: 3)
- [ ] #504 Worker portal Stage 7 — first-impression states (splash / maintenance / expired / 404) (weight: 2)
## Cross-cutting follow-up
- [ ] #507 (separate issue, not part of this epic) — unified config backend ADR across canopy domains. Unblocks Studio promote modal + composition write-capable backends in v2.
epic