# System boundary — account ↔ mathapi

Two separate codebases, two separate databases. Identity is **not yet federated** between them (see Gates). Consult this file before building anything cross-cutting.

## Apps
- **account** — `c:\projects\account` — SSO / identity / School of Record. Front door (portal.allgifted.com).
- **mathapi** — `c:\allgifted\mathapi11v2` — math learning product + attainment data API. Origin `2ppaamm/capstoneapi`.

## Ownership — one owner per domain

| Domain | Owner |
|---|---|
| Identity / SSO / org membership (token-issuing) | account |
| Certified records, transcripts, credentials, corrections | account |
| AGS oversight / compliance / flagged-corrections sign-off | account |
| Engagement records (provisional) | account |
| Unified licensee + AGS dashboard portal (UI) | account |
| Math learning product (student UI) | mathapi |
| Live attainment (System B Maxile, bands, skills, seats) | mathapi |
| B2B tenancy / entitlements (enforced via account token once federated) | mathapi |
| Accreditation-floor config + compliance eval + org product-config UI | mathapi |
| Assessment condition tags | mathapi |

Note: the accreditation *policy* is conceptually account's; it sits in mathapi for now because that is where org config lives. Revisit when the floor must govern non-math subjects.

## Cross-app rules
1. UI never reaches across the boundary — it calls an API.
2. Reads are one-directional: **account → mathapi** (attainment rollups, compliance status, condition tags).
3. **Certified / corrections are account-local** — never replicated in mathapi.
4. **Attainment is mathapi-local** — never replicated in account.
5. Join keys are **org external ref** and **student external_id** — all cross-app APIs key on these, never internal IDs.

## API contract (mathapi exposes; account consumes)
- Attainment rollup, org-scoped: level distribution, avg Maxile, at-risk A/B/C, roster (+ level_source).
- Org compliance status: `eligible | below_floor` + failing params, resolvable at a point in time.
- Assessment condition tags for a learner/assessment.

All org-scoped from the identity context. Client-supplied org ids rejected. Isolation-tested (a scoped read returns zero rows from any other org, including under param tampering).

## Gates (foundational, in order — nothing cross-app wires until these exist)
1. **SSO federation** — account (IdP) ↔ mathapi/portal (relying party). **Not linked today.** Prerequisite for any shared-identity flow.
2. **Org-identity reconciliation** — account org membership ↔ mathapi tenancy orgs (shared org external ref).
3. **Student external_id mapping** — account students ↔ mathapi user ids. Pre-deploy gate for real cohorts.

Until 1–3 exist, the two apps run separate auth; the unified portal and cross-app dashboards cannot be wired.

## Retired / forbidden (kill the fork)
- mathapi MUST NOT hold a certified substrate. Retire `certifications`, `issued_credentials`, `CredentialIssuanceService`, and the certified panels in mathapi dashboards.
- The licensee + licensor dashboard **UI** is account's; mathapi serves the data as API only. Freeze mathapi's `/cp` and licensee dashboard UI; convert their logic to API.
- Neither app rebuilds the other's domain.

---
_Source: authored in `account` (SoR); mirrored here for mathapi contributors. account is canonical if they diverge._