House Desk is one product with three distinct responsibilities: resident-facing pages, reviewed publication workflows, and private calendar delivery. Keeping those responsibilities separate prevents an intake, login, or website change from silently becoming published resident information.
Responsibility flow
flowchart LR SOURCES["Newsletters, messages, documents"] --> REVIEW["Operator review"] REVIEW --> PROGRAMS["Published Programs"] REVIEW --> BULLETIN["Published Bulletin"] PROGRAMS --> FEED["Private calendar subscription"] BULLETIN --> SEARCH["Public notice search"]
An intake creates reviewable material, not public truth. Authorized operators resolve source discrepancies, duplicates, dates, privacy concerns, and publication state before residents see the result.
Access boundaries
- Resident pages are public, but a Programs feed requires its own private subscription URL.
- Email-action pages use short-lived links for the specific resident task.
- Staff entry is protected at the edge, and House Desk separately checks the person’s product role for each action.
- Pub receives only a narrow projection of published event information; it does not share House Desk’s resident or authorization data.
Failure behavior
If a protected dependency is unavailable, staff mutations fail closed. Resident-facing pages should either continue with the last safe published state or explain that a task is temporarily unavailable. An incomplete intake never publishes itself.
What this page leaves private
Exact storage layout, permission catalogs, recovery precedence, deployment configuration, and production procedures are maintained privately. Public documentation records the promises another system or reader may safely rely on.