ReadonlyauthorizeResolves the principal's current authority for one days-served or certificate command on the caller's transaction, with the command's locks, before a stored response can replay.
ReadonlyconfirmAppends the next confirmation of one assistant's total under the department lock, after the transport precondition on the fresh entry. Never changes an earlier confirmation or a service fact. The callback grants no authority and must not write business state.
ReadonlyexecuteRuns on the caller's transaction after current authority and receipt lookup. Holds the department lock across the snapshot precondition, transition, audit, history, and outbox writes. The callback checks a transport-owned precondition; it does not authorize the command or perform business writes. Success returns a snapshot before the caller commits its transaction. Callback failures propagate unchanged; execute does not retry or deliver notifications.
ReadonlyissueRecords one issue of the current certificate under the department lock, after the transport precondition on the fresh preview: who, when, the authorizing seat, and the content hash.
ReadonlylistOne bounded page of the assistants with service facts in a department; issuers only.
ReadonlylistProjects management availability from supplied authority; does not authenticate it.
ReadonlyreadReads the scoped board after caller authorization.
ReadonlyreadThe certificate that the principal would issue now, and the semesters it leaves out.
ReadonlyreadThe departments where the principal confirms days served or issues certificates. Either capability in one department grants the read; a principal with neither is denied.
ReadonlyreadReads coordinator coverage after caller authorization. Coverage lists current records only.
ReadonlyreadOne bounded page of the assistants of a department and semester: everyone with counted
attendance, an accepted legacy total, an active placement, or a confirmation there. Requires
placements.days-served in the department.
ReadonlyreadDrafts placements for the scoped board after caller authorization. The draft reads demand, placements, capacity plans, and current availability, and writes nothing; the same facts give the same draft.
ReadonlyreadReturns Absent at revision zero when a known department has no affiliation.
ReadonlyreadReads one person's coverage after caller authorization. Current placements include only active rows for that person, department, and semester. Placements, confirmed roster slots, and dated commitments remain separate facts. Commitments are those where the person is scheduled or covers a recorded absence. Coverers are listed only while the person has an absence in an open commitment.
Trusted server operations, not an authentication boundary. The placement operations expect callers to authorize reads and writes before invocation. The days-served and certificate operations resolve the principal's current Organization authority themselves, on the caller's transaction connection; commands hold their locks, facts, and history in that transaction. The concrete Layer captures Database; execute also retains callback requirements.