# Architecture Notes

SoftSuite CMS is organized as a Laravel modular monolith. Authentication and authorization sit at the HTTP boundary. Workforce identity is separated into `employees` and `interns`, each linked one-to-one to a `users` account. Projects and tasks reference the shared user identity only after role/workforce authorization.

Attendance follows: authenticated user -> active worker profile -> assigned office -> active IP/CIDR rules -> duplicate/state validation -> database transaction -> attendance record + audit event. Failed network validation creates only an `attendance_attempts` + audit record.

Financial history uses effective-dated salary revisions and payroll snapshots. Employee payroll and intern stipends use separate batch/item tables to prevent accidental crossover.