One event envelope

Every event — activity, audit, or notification — lands in the same chronological store through one envelope. Notification intent is just a per-event policy decision, not a different kind of event.

Multi-tenant from day one

tenant_id is derived from the authenticated principal, never client-supplied. Every store query, channel, and policy is tenant-partitioned — isolation is an access rule, not a convention.

Six adapter seams

Store, bus, realtime, identity, channel, and secrets each sit behind a Go interface. One deployment = one Profile. Swap infrastructure without touching the product's semantics.

Explicit trust model

Events are either backend-verified (audit-grade, server-anchored) or client-asserted (telemetry-grade) — never ambiguous. Render-tokens let a client-only-looking event earn a server anchor after the fact.