Initial YPMS planning and ATO artifacts

Pre-development state; no code yet.

Delivery model: in-house build by DOES OIT on Azure Government,
matching the DCYWP / OWC / Employer 360 pattern.

Stack decision (2026-09-30): Python 3.12 / FastAPI / SQLAlchemy /
Postgres, aligning with OWC.

System Owner / ISSO / AO: Chris Tonjes (DOES CIO). Role concentration
recorded in SSP §5 with risk-acceptance rationale.

Source functional and security requirements derived from the prior
YPMS RFP (Solicitation Docxxxxx, April 2025) — 54 C.5.7 security
requirements and Appendix E non-functional requirements — treated as
source specifications, not as Contractor obligations.

Documents included:

- CLAUDE.md, OVERVIEW.md — project router and program-level summary
- SYSTEM_SECURITY_PLAN.md v0.3 — NIST 800-53 Moderate baseline SSP
- NIST_800_53_CONTROL_MAPPING.md v0.2 — full control-family mapping
  with in-house ownership tags and evidence-artifact expectations
- POAM.md v0.1 — 62-item POA&M seeded from tailorings, open decisions,
  missing companion docs, and pre-ATO deliverables; two items closed
- PRIVACY_IMPACT_ASSESSMENT.md v0.1 — full PIA covering minors, SSN,
  banking, FERPA-covered OSSE records, CFSA foster/ward flags, and
  the dormant emergency health-record path
- ARCHITECTURE.md v0.1 — forward-looking design blueprint, OWC-aligned
- PHASE0_PLAN.md v0.1 — framework vendor-in, auth, RBAC, audit,
  Registrant vertical slice, 501 stubs for remaining entities
- TODO.md — 12-section working checklist tied to POA&M IDs
- OLA_RESPONSE_2026-09-30.md — Q&A for OLA / City Administrator

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -0,0 +1,62 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+venv/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.pyre/
+.pytype/
+
+# Test / coverage
+.coverage
+.coverage.*
+htmlcov/
+coverage.xml
+.tox/
+
+# Build
+dist/
+build/
+*.whl
+
+# Environment / secrets
+.env
+.env.*
+!.env.example
+
+# Local DB
+*.db
+*.sqlite
+*.sqlite3
+pg_data/
+
+# Docker
+.docker/
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Editors / IDEs
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# Node (if we end up with a client/ later)
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+.pnpm-debug.log*
+
+# Logs
+*.log
+logs/
+
+# Alembic scratch (real migrations are checked in under migrations/versions/)
+alembic/