- Ya
- 15 Agosti 2026, 05:58 UTC
- Mwandishi
- kamo
- Ahadi ya
- 54f058e
The first cluster whose honest answer is "no action", and two of the six looked deletable until the last check. TimecardService has one authentication boundary, a cluster-internal shared secret, and its javadoc states the contract: SecurityService resolves the session, checks rights and relays. So HR rights live in SecurityService's relay controllers and no check belongs inside TimecardService — grepping it for hasRight returns nothing, and that is correct rather than a gap. VIEW_SCHEDULES and MANAGE_SCHEDULES are superseded, not decorative. The schedule feature is real — TimecardSchedule, its repository, TimecardConfigController, AttendanceService — and is gated by MANAGE_TIMECARDS deliberately: hrTabs.ts records that Attendance used to open on VIEW_SCHEDULES and that each tab was given one right of its own to remove an inconsistent bar, with holders carried across by NEW_RIGHT_SEEDS. Adding a schedule gate would put the second bar back. CREATE_EMPLOYEES and DELETE_EMPLOYEES are superseded by MANAGE_MEMBERS: an employee is a member with an employment record, so creating one is creating a member, and there is no employee CRUD endpoint. VIEW_TIME_OFF and MANAGE_TIME_OFF were nearly deleted. No table in any schema, no entity, no repository, no controller, no UI, no frontend reference — on the standard applied to VIEW_EMAIL_LOGS that is a delete. It is not: time off is a first-class payroll-provider capability, PayrollFeature.PTO_BALANCES and PayrollPtoBalanceProvider, implemented against Paychex Flex, BambooHR, ADP and Paycor. The noun is modelled; only the Kamo endpoint and screen are missing. The lesson worth carrying: "no table" is not the test. A capability can be modelled entirely as a provider interface, which is how this platform builds meetings, payroll and telephony. Check the provider abstractions before concluding a noun does not exist.