An integration you cannot reason about is an integration you will be paged about.

Every call carries a tier

There is exactly one entry point for work. Nothing reaches a model, an engine or a queue around it — not a screen, not a phone, not a partner. Governance, interaction logging, quota and the tenant boundary ride that path once, which is why a new capability inherits them instead of re-implementing them.

POST /api/v1/dispatch
{
  "jobType": "chamber.deliberate",
  "tier": 2,                      // 1..5 — see the ladder
  "scope": {                      // resolved from the AUTHENTICATED request,
    "organizationId": "…",        // never from a body field, never from an env var
    "ownerUserId": "…",
    "businessUnitId": "…"         // optional third axis
  },
  "payload": { … }
}

Refusals are typed

A refusal is a machine code and a verbose message, never a placeholder value and never a silently widened read. Quote the code at us and we can find the exact decision. Capacity refuses; it never evicts — the eviction policy is not tuned, it does not exist.

• SCOPE_PREDICATE_MISSING
• SCOPE_REFUSED
• GATE_DISAGREEMENT
• HASH_MISMATCH
• SIG_INVALID
• CHAIN_DIVERGENCE
• DEADLINE_EXCEEDED
• OFFLINE_NO_COMPUTE
• CLOCK_SKEW
• STORE_CEILING_REACHED
• CAPTURE_MODALITY_UNAVAILABLE
• AUTHORITY_EXCEEDED

Agent-to-agent