“Reachable” is a source-layer claim: a registered Fastify route calls this function. It does not mean a tenant has switched the module on, and it does not mean a counselor role exists to log in and use it — the roles section below is exact about that gap.
Daily check-in and screening scoring
The check-in scorer — a structured signal in, a concern band out, and a crisis item that cannot be averaged away
A daily check-in or a structured screening instrument reports a 0-to-4 mood score, a count of distinct distress indicators, and an optional 0-to-100 SEL competency rating — never free-text narrative. Those fold into a single 0-to-100 concern score, which maps to a closed band: ok, monitor, elevated, or urgent. One field overrides the whole composite: a critical-item flag — a self-harm, harm-to-others, or abuse disclosure item — hard-escalates the check-in to urgent regardless of the arithmetic, because a crisis answer sitting next to three calm ones should never average out to “monitor.” The engine reads structured signal only, runs in the tenant’s own VPC, and calls no cloud model and no in-VPC model either — it is a deterministic, SME-configurable rubric, not a diagnosis.
Referral to support workflow
The wellness referral state machine — a flag becomes a documented support, never a dead survey
A concerning check-in opens a referral in the open state. From there the only legal moves are the five this engine names: triage (an internal review, no consent boundary crossed), begin_support (an active in-school counseling support — crosses the disclosure boundary), escalate (a clinical-partner or crisis handoff — also crosses it), and resolve. A crisis fast-path lets open jump straight to escalated without forcing an intermediate triage step. The two boundary-crossing transitions are marked requiresConsent: true in the engine’s own return value, so the route verifies the directory_info consent basis before applying either — and an illegal transition (skipping a state, reopening a resolved referral) is refused outright. A client can never drive an arbitrary state.
The wellness PII emit gate
One consent chokepoint, three fail-closed arms, and a narrative that is never returned when redacted
Every emit of a student’s wellness name or narrative routes through one function with three arms, checked in order. No resolvable consent context for the student: suppressed. The master-30 do_not_publish kill-switch, read directly off the record: suppressed, on every purpose, no exceptions. The directory_info disclosure basis — opt-in, default-deny, expiry included — not currently granted: suppressed. When any arm fires, the score or tier may still be written and audited as a non-emit triage signal, but the narrative comes back as null, not as a redacted placeholder that still leaks a phrase or two. A prior version of this gate also suppressed on a declined or lapsed school-photo permission — a picture-day form deciding whether a counselor could read a crisis note. That arm is gone; a photo decision no longer governs a health record.
Early-warning risk score and tier
Attendance, behavior, and grades fold into one composite risk score — and a tier, not a verdict
Attendance rate, a count of behavior incidents, a count of failing grades, and — where available — a GPA and a normalized benchmark-assessment percentile combine into a single 0-to-100 risk score, which maps to Tier 1 (universal), Tier 2 (targeted), or Tier 3 (intensive) against a published cut-point table. That table is stated, in the code’s own comment, as a defensible default, not a per-state truth — a state may mandate different cut points or a different non-response window, and every decision carries an engineVersion stamp so a threshold change is attributable rather than silent. The engine assigns a tier and opens the referral flow below it; it does not invent the intervention content a tier would prescribe — that library is partner-curated and not shipped here.
Referral, evaluation, and the IEP handoff
Referred to eligible under a closed law, and the terminal state opens a real special-education plan
A student flagged for evaluation moves through referred → eval_consent → evaluating → a terminal eligible or not_eligible, and no other order is legal. Two of those transitions stamp an IDEA-clock anchor — eval_consent_received when parental consent for the evaluation is captured, and eligibility_determined at the terminal state, either way. When the determination is eligible, the same transition returns opensIepPlan: true, and the route opens a real special-education plan on the platform’s IEP spine. This module is the handoff into that product, not a second copy of it — the flag becomes a plan on the same student record, never a parallel file.
Discipline and referral-note consent gate
The same chokepoint the wellness gate uses — plus a wall a consented adviser still cannot cross
A behavior or discipline record carries a student’s name and the incident narrative — among the most FERPA-sensitive and equity-fraught data a school holds, and this gate is the single chokepoint every emit of it routes through, reusing the exact directory_info basis and do_not_publish kill-switch the wellness gate uses rather than a second, driftable copy of the rule. On top of that: an incident flagged isSensitive — self-harm, Title IX, or a law-enforcement referral — is redacted even to a consented adviser unless the caller is explicitly cleared for it, which the route grants only on the single-record, role-elevated read, never on a roster-wide export or dashboard pull. This gate redacts; it never invents the family’s consent choice, and it never derives from the photo/publication basis.
College and career counseling
The per-college application ladder, the counseling request queue, and an 8-milestone readiness dashboard
Each college on a student’s list carries its own status — considering, applying, submitted, admitted, waitlisted, denied, deferred, enrolled, or withdrawn — and its own decision plan (early decision, early action, regular, rolling, priority). A counseling request is its own tracked object: a transcript send, a recommendation, a counselor letter, a mid-year report, or a final report, each moving through requested → in_progress → sent, declined, or cancelled. Readiness is tracked as eight named milestones — FAFSA filed, SAT/ACT taken, college list built, essay drafted, recommendations secured, applications submitted, financial aid reviewed, decision finalized — rolled up into the dashboard a counselor actually opens each morning. Access runs through a route-local gate that admits an admin role or the adviser/co-adviser staff role and hard-denies any minor-held session outright.
Recommendation and transcript send
The send request rides the platform’s own transcript issuer — it never reimplements credentialing
A transcript-send or recommendation request does not mint its own document. It builds a descriptor and hands it to the platform’s shipped, key-gated transcript issuer, which is the single place a credential is actually signed anywhere in this system. An unsigned result — no signing key configured — is honest-off: the request stays in_progress with no issuer reference, rather than a fabricated confirmation. We never mint or fake a credential on this surface, and there is no second, weaker issuance path a counseling request could take instead of the real one.
SAT / ACT / AP score intake
College-admissions scores land on the readiness dashboard — deliberately never on the risk tier
An inbound SAT, ACT, or AP score is parsed against its own closed range (SAT 200-800 per section or 400-1600 total; ACT 1-36; AP 1-5) and, once valid, marks the sat_act_taken readiness milestone. A score outside its exam’s valid range, an unknown exam, or an exam its vendor does not offer is rejected with a reason, never coerced onto the record — a wrong college score would misadvise a real student. And it is kept structurally separate from the early-warning risk engine on purpose: a college-admissions test is not a risk signal, and this module does not route into the same re-tier a benchmark assessment does, so a strong or weak SAT can never accidentally move a child’s MTSS tier.
The crisis and mandated-reporter signal
This raises and records a crisis signal. It does not file the legal report that follows one.
A critical-item check-in trips a shared detection path that also feeds the schoolwide safety system, and a wellness referral’s escalate transition hands off toward a clinical partner or the crisis path. Both are named here in the terms the engine itself uses: detection is not the compliance act. This surface raises the signal and records that it was raised; the mandated-reporter filing to a state child-welfare authority is a human, legal act this product does not perform. The clinical-partner handoff is config that is born disabled — no teletherapy partner is wired, an escalation would record the intended handoff and its student-location licensure constraint, and nothing here books a session or fabricates a clinical service.