Module accounting_ops_handler 

Non-CRUD HTTP surface for accounting operations: bank reconciliation + the fiscal period lifecycle.

Hand-authored (user-owned; see metaphor.codegen.yaml). POST /accounting/reconcile (body = ReconcileRequest) POST /accounting/periods/:period_id/close (body = { retained_earnings_account_id }) POST /accounting/periods/:period_id/lock (body = { reason }) POST /accounting/periods/:period_id/reopen (body = { reason })

A period’s status moves only through these verbs; generic writes refuse it. The person acting is the authenticated principal (OrgContext), never a field of the body, so the trail on the period names who really acted. A request without one is refused before the handler runs. Which role may call which verb is the composing service’s gate.

Tenancy (ADR-0029): the wire bodies carry no tenant field. The composing service’s tenancy decorator scopes every read and write from the request’s own scope, so a tenant sent in the body could only ever agree with it or contradict it — and a field that cannot change the answer is a field that invites someone to think it can.

Structs

ClosePeriodBody

PeriodReasonBody

The body of a lock or reopen: why. A blank reason is refused.

Functions

create_bank_reconciliation_routes

create_period_close_routes

The routine close. Lock and reopen live in create_period_finality_routes, so the two can sit behind different roles.

create_period_finality_routes

The lock and reopen verbs: the ones that make a period final or undo a close. A separate router so the composing service can put them behind a stricter role than the routine close.