OSCER-657: denial response form and task (#678)

## Ticket

Step 2 of #657

## Changes

Add the `DenialResponseApplicationForm` model and route its submission
into staff review. This is
the member-submits → case-enters-review half of the denial-response
flow; the staff approve/deny
decisions land in the follow-up `denial-response-decisions` PR.

- **`DenialResponseApplicationForm`** (`Strata::ApplicationForm`) — a
`comment` text attribute plus
  optional `has_many_attached :supporting_documents`.
- **`ReviewDenialResponseTask`** (`OscerTask`) — binds to its
`DenialResponseApplicationForm`
- **`CertificationBusinessProcess`** — new `review_denial_response`
staff-task step and the
`DenialResponseApplicationFormSubmitted` → `review_denial_response`
transition.
- **`MemberStatusService`** — the `review_denial_response` step maps to
`pending_review`, like the
  other review steps.
- Factories for the form and the review task.

## Context for reviewers

Second PR in the denial-response stack -- broken up to prevent review
fatigue. The design
deliberately follows the existing application-form + review-task pattern
(activity reports,
exemptions) so the flow plugs into the certification business process
the same way.

Note the scope boundary: this PR adds **submission and routing into
review only**. The form has no
`flow_status` and there are no approve/deny transitions yet — those are
added in the next PR, where
they can be exercised end to end. Keeping them out here avoids untested
or defensively-stubbed
behavior; every line added in this PR is covered by a spec.

## Testing

- New model specs for `DenialResponseApplicationForm`
- New `ReviewDenialResponseTask` specs
- New business-process example: submitting a denial response moves the
case to
`review_denial_response`, sets member status to `pending_review`, keeps
the case open, and
  creates the review task.
- `make lint` — no offenses.
- `make test` — 2272 examples, 0 failures (96.06% line / 82.48% branch
coverage).

<!-- reporting-app - begin PR environment info -->
## Preview environment for reporting-app
- Service endpoint:
https://p-678-reporting-app-dev-669935554.us-east-1.elb.amazonaws.com
- Deployed commit: 57100f5
<!-- reporting-app - end PR environment info -->

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jdettmannnava

reporting-app/app/business_processes/certification_business_process.rb

@@ -9,6 +9,7 @@ class CertificationBusinessProcess < Strata::BusinessProcess
   REPORT_ACTIVITIES_STEP = "report_activities"
   REVIEW_ACTIVITY_REPORT_STEP = "review_activity_report"
   REVIEW_EXEMPTION_CLAIM_STEP = "review_exemption_claim"
+  REVIEW_DENIAL_RESPONSE_STEP = "review_denial_response"
 
   END_STEP = "end"
 
@@ -27,6 +28,7 @@ class CertificationBusinessProcess < Strata::BusinessProcess
   applicant_task(REPORT_ACTIVITIES_STEP)
   staff_task(REVIEW_ACTIVITY_REPORT_STEP, ReviewActivityReportTask)
   staff_task(REVIEW_EXEMPTION_CLAIM_STEP, ReviewExemptionClaimTask)
+  staff_task(REVIEW_DENIAL_RESPONSE_STEP, ReviewDenialResponseTask)
 
   # --- Start ---
   start(EXTERNAL_EXEMPTION_CHECK_STEP, on: "CertificationCreated") do |event|
@@ -58,4 +60,7 @@ class CertificationBusinessProcess < Strata::BusinessProcess
   transition(REPORT_ACTIVITIES_STEP, "ExemptionApplicationFormSubmitted", REVIEW_EXEMPTION_CLAIM_STEP)
   transition(REVIEW_EXEMPTION_CLAIM_STEP, "DeterminedExempt", END_STEP)
   transition(REVIEW_EXEMPTION_CLAIM_STEP, "DeterminedNotExempt", REPORT_ACTIVITIES_STEP)
+
+  # --- Transitions: Denial response workflow ---
+  transition(REPORT_ACTIVITIES_STEP, "DenialResponseApplicationFormSubmitted", REVIEW_DENIAL_RESPONSE_STEP)
 end

reporting-app/app/models/denial_response_application_form.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+# A denial response is a lightweight way for a member to resolve a denied certification case while
+# their verification window is still open: a short written comment plus optional supporting
+# documents that a staff reviewer approves or denies.
+class DenialResponseApplicationForm < Strata::ApplicationForm
+  include FormApprovalStatus
+  has_review_task "ReviewDenialResponseTask"
+
+  strata_attribute :comment, :text
+
+  has_many_attached :supporting_documents
+
+  default_scope { with_attached_supporting_documents.includes(:determinations) }
+
+  validates :certification_case_id, presence: true
+  validate :case_not_closed, on: :create
+  validate :no_pending_forms, on: :create
+
+  # Include the case id so the submitted event routes to the case in the business process.
+  def event_payload
+    super.merge(case_id: certification_case_id)
+  end
+
+  def self.has_pending_form(certification_case_id)
+    DenialResponseApplicationForm.where(certification_case_id:, status: :in_progress).exists? ||
+    ReviewDenialResponseTask.where(application_form: DenialResponseApplicationForm.where(certification_case_id:).all,
+                                   status: [ :on_hold, :pending ]).exists?
+  end
+
+  private
+
+  def case_not_closed
+    certification_case = CertificationCase.find_by(id: certification_case_id)
+    if certification_case.blank?
+      errors.add(:certification_case_id, "is invalid")
+    elsif certification_case.closed?
+      errors.add(:certification_case_id, "has closed")
+    elsif certification_case.verification_window_ended?
+      errors.add(:certification_case_id, "verification window has ended")
+    end
+  end
+
+  def no_pending_forms
+    errors.add(:certification_case_id, "has already been taken") if DenialResponseApplicationForm.has_pending_form(certification_case_id)
+  end
+end

reporting-app/app/models/review_denial_response_task.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+class ReviewDenialResponseTask < OscerTask
+  before_validation :ensure_application_form
+
+  belongs_to :application_form, class_name: DenialResponseApplicationForm.name, inverse_of: :review_task, strict_loading: false
+
+  # Records the staff review decision. Nil until decided, distinguishable from approved/denied.
+  enum :approval_status, { approved: "approved", denied: "denied" }
+
+  def self.application_form_class
+    DenialResponseApplicationForm
+  end
+end

reporting-app/app/services/member_status_service.rb

@@ -175,7 +175,8 @@ def status_from_case_step(certification_case)
       case certification_case.business_process_current_step
       when CertificationBusinessProcess::REPORT_ACTIVITIES_STEP
         awaiting_report_status
-      when CertificationBusinessProcess::REVIEW_ACTIVITY_REPORT_STEP, CertificationBusinessProcess::REVIEW_EXEMPTION_CLAIM_STEP
+      when CertificationBusinessProcess::REVIEW_ACTIVITY_REPORT_STEP, CertificationBusinessProcess::REVIEW_EXEMPTION_CLAIM_STEP,
+           CertificationBusinessProcess::REVIEW_DENIAL_RESPONSE_STEP
         pending_review_status
       when CertificationBusinessProcess::END_STEP
         not_compliant_status

reporting-app/spec/business_processes/certification_business_process_spec.rb

@@ -240,6 +240,27 @@
     end
   end
 
+  describe 'denial response workflow' do
+    it 'moves the case into review and creates the review task on submit' do
+      # Step 1: Case starts on report_activities
+      expect(certification_case.business_process_instance.current_step).to eq(CertificationBusinessProcess::REPORT_ACTIVITIES_STEP)
+      expect(certification_case.member_status).to eq(MemberStatus::AWAITING_REPORT)
+      expect(certification_case).to be_open
+
+      # Step 2: Member submits a denial response
+      denial_response = create(:denial_response_application_form,
+        certification_case_id: certification_case.id
+      )
+      denial_response.submit_application
+      certification_case.reload
+
+      expect(certification_case.business_process_instance.current_step).to eq(CertificationBusinessProcess::REVIEW_DENIAL_RESPONSE_STEP)
+      expect(certification_case.member_status).to eq(MemberStatus::PENDING_REVIEW)
+      expect(certification_case).to be_open
+      expect(ReviewDenialResponseTask.find_by(application_form: denial_response)).to be_present
+    end
+  end
+
   describe 'business process events' do
     it 'publishes correct events throughout the workflow' do
       # Create and submit activity report

reporting-app/spec/factories/denial_response_application_form_factory.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :denial_response_application_form do
+    id { SecureRandom.uuid }
+    comment { "Here is my explanation for why my case should be reconsidered." }
+    certification_case_id { create(:certification_case, certification: create(:certification)).id }
+
+    trait :with_submitted_status do
+      after(:create) do |denial_response_application_form|
+        denial_response_application_form.submit_application
+      end
+    end
+  end
+end

reporting-app/spec/factories/strata_task_factory.rb

@@ -28,4 +28,13 @@
     type { "ReviewActivityReportTask" }
     association :application_form, factory: :activity_report_application_form
   end
+
+  factory :review_denial_response_task, parent: :oscer_task, class: ReviewDenialResponseTask do
+    type { "ReviewDenialResponseTask" }
+  end
+
+  factory :review_denial_response_task_with_form, parent: :oscer_task, class: ReviewDenialResponseTask do
+    type { "ReviewDenialResponseTask" }
+    association :application_form, factory: :denial_response_application_form
+  end
 end

reporting-app/spec/models/denial_response_application_form_spec.rb

@@ -0,0 +1,161 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe DenialResponseApplicationForm, type: :model do
+  describe "attributes" do
+    it "stores the member comment" do
+      form = build(:denial_response_application_form, comment: "I have a good reason.")
+      expect(form.comment).to eq("I have a good reason.")
+    end
+
+    it "accepts optional supporting documents" do
+      form = create(:denial_response_application_form)
+      form.supporting_documents.attach(
+        io: StringIO.new("doc"), filename: "evidence.pdf", content_type: "application/pdf"
+      )
+
+      expect(form.supporting_documents).to be_attached
+    end
+  end
+
+  describe "lifecycle" do
+    before { allow(Strata::EventManager).to receive(:publish) }
+
+    it "starts in progress" do
+      form = create(:denial_response_application_form)
+      expect(form).to be_in_progress
+    end
+
+    it "transitions to submitted and records submitted_at on submit" do
+      form = create(:denial_response_application_form)
+
+      expect(form.submit_application).to be(true)
+      expect(form).to be_submitted
+      expect(form.submitted_at).to be_present
+    end
+
+    it "publishes a submitted event carrying the case id" do
+      form = create(:denial_response_application_form)
+      form.submit_application
+
+      expect(Strata::EventManager).to have_received(:publish).with(
+        "DenialResponseApplicationFormSubmitted",
+        hash_including(application_form_id: form.id, case_id: form.certification_case_id)
+      )
+    end
+  end
+
+  describe "validations" do
+    let(:certification) { create(:certification) }
+    let(:certification_case) { create(:certification_case, certification: certification) }
+
+    it "requires a certification case" do
+      form = build(:denial_response_application_form, certification_case_id: nil)
+      expect(form.save).to be(false)
+      expect(form.errors[:certification_case_id]).to include("can't be blank")
+    end
+
+    it "allows only one in-progress form per case" do
+      create(:denial_response_application_form, certification_case_id: certification_case.id)
+      second_form = build(:denial_response_application_form, certification_case_id: certification_case.id)
+
+      expect(second_form.save).to be(false)
+      expect(second_form.errors[:certification_case_id]).to include("has already been taken")
+    end
+
+    it "allows different certification_case_ids" do
+      certification_case_2 = create(:certification_case)
+      create(:denial_response_application_form, certification_case_id: certification_case.id)
+      second_form = build(:denial_response_application_form, certification_case_id: certification_case_2.id)
+
+      expect(second_form.save).to be(true)
+    end
+
+    # Submitting moves the case to review and the business process creates the review task, so the
+    # prior form here is submitted (not in progress) — isolating the review-task branch of
+    # has_pending_form.
+    context "with a prior submitted form whose review task is still open" do
+      let!(:first_form) { create(:denial_response_application_form, :with_submitted_status, certification_case_id: certification_case.id) }
+      let(:review_task) { ReviewDenialResponseTask.find_by(application_form: first_form) }
+
+      it "does not allow a new form while the review task is pending" do
+        second_form = build(:denial_response_application_form, certification_case_id: certification_case.id)
+
+        expect(second_form.save).to be(false)
+        expect(second_form.errors[:certification_case_id]).to include("has already been taken")
+      end
+
+      it "does not allow a new form while the review task is on hold" do
+        review_task.on_hold!
+        second_form = build(:denial_response_application_form, certification_case_id: certification_case.id)
+
+        expect(second_form.save).to be(false)
+      end
+
+      it "allows a new form once the review task is completed" do
+        review_task.completed!
+        second_form = build(:denial_response_application_form, certification_case_id: certification_case.id)
+
+        expect(second_form.save).to be(true)
+      end
+    end
+
+    context "when case is closed" do
+      before { certification_case.close! }
+
+      it "does not allow creation" do
+        form = build(:denial_response_application_form, certification_case_id: certification_case.id)
+        expect(form.save).to be(false)
+        expect(form.errors[:certification_case_id]).to include("has closed")
+      end
+    end
+
+    context "when verification window has ended" do
+      before { certification_case.update_attribute(:verification_window_end_date, 1.day.ago) }
+
+      it "does not allow creation" do
+        form = build(:denial_response_application_form, certification_case_id: certification_case.id)
+        expect(form.save).to be(false)
+        expect(form.errors[:certification_case_id]).to include("verification window has ended")
+      end
+    end
+
+    context "when verification window is open" do
+      before { certification_case.update_attribute(:verification_window_end_date, 1.day.from_now) }
+
+      it "allows creation" do
+        form = build(:denial_response_application_form, certification_case_id: certification_case.id)
+        expect(form.save).to be(true)
+      end
+    end
+  end
+
+  describe "#approval_status" do
+    it "has no outcome when there is no review task, distinguishable from approved/denied" do
+      form = create(:denial_response_application_form)
+
+      expect(form.approval_status).to be_nil
+      expect(form).not_to be_approved
+      expect(form).not_to be_denied
+    end
+
+    it "reports its review task's approved outcome" do
+      task = create(:review_denial_response_task_with_form, case: create(:certification_case))
+      task.update!(approval_status: :approved)
+
+      form = described_class.find(task.application_form_id)
+      expect(form.approval_status).to eq("approved")
+      expect(form).to be_approved
+    end
+
+    it "reports its review task's denied outcome" do
+      task = create(:review_denial_response_task_with_form, case: create(:certification_case))
+      task.update!(approval_status: :denied)
+
+      form = described_class.find(task.application_form_id)
+      expect(form.approval_status).to eq("denied")
+      expect(form).to be_denied
+    end
+  end
+end

reporting-app/spec/models/review_denial_response_task_spec.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require 'rails_helper'
+
+RSpec.describe ReviewDenialResponseTask, type: :model do
+  describe "inheritance" do
+    it "inherits from Strata::Task" do
+      expect(described_class < Strata::Task).to be true
+    end
+
+    it "has a case_type of CertificationCase" do
+      task = create(:review_denial_response_task_with_form, case: create(:certification_case))
+      expect(task.case_type).to eq("CertificationCase")
+    end
+  end
+
+  describe "create" do
+    let(:certification_case) { create(:certification_case) }
+    let!(:denial_response_application_form) { create(:denial_response_application_form, certification_case_id: certification_case.id) }
+
+    it "binds to the application form" do
+      task = described_class.create!(case: certification_case)
+      expect(task.application_form_id).to eq(denial_response_application_form.id)
+    end
+  end
+
+  describe "#approval_status" do
+    let(:certification_case) { create(:certification_case) }
+
+    it "is nil (undecided) by default, distinguishable from approved/denied" do
+      task = create(:review_denial_response_task_with_form, case: certification_case)
+
+      expect(task.approval_status).to be_nil
+      expect(task).not_to be_approved
+      expect(task).not_to be_denied
+    end
+
+    it "records an approved decision" do
+      task = create(:review_denial_response_task_with_form, case: certification_case, approval_status: :approved)
+
+      expect(task.approval_status).to eq("approved")
+      expect(task).to be_approved
+    end
+
+    it "records a denied decision" do
+      task = create(:review_denial_response_task_with_form, case: certification_case, approval_status: :denied)
+
+      expect(task.approval_status).to eq("denied")
+      expect(task).to be_denied
+    end
+  end
+end