Channels
Email, form, telephone, and future peer envelopes are ways to admit a client contact and project a reviewed result. They do not own the case, product truth, or staff authority.
| Surface | Office |
|---|---|
| Business Console | staff work with cases, product releases, drafts, approvals, deadlines, and corrections |
| Client Web | a client submits bounded material and sees only authorized records and choices |
| Altar | the technical operator inspects Runs, evidence, readiness, consent, and recovery |
These are separate typed projections, not recoloured Altar screens, and none talks directly to PostgreSQL, a model server, or an insurer.
Inbound prose, documents, mail, audio, and provider material remain hostile data. Credentials and raw client secrets stay outside model Context. Local inference does not waive access, retention, backup, export, or deletion rules; a remote route requires the exact privacy and egress decision owned by Context and Security.
An outbound effect pins recipient, channel, payload digest, product and case revisions, current authority, expiry, and idempotency identity. Unknown acknowledgement is reconciled before retry. Deletion fences new admission, drains or contains atomic work, and removes governed local derivatives while preserving explicit legal holds and third-party custody.
The first proving slice uses email intake only. Telephone and public client routes remain outside it until their authentication, recording, disclosure, and delivery boundaries are separately proved.