channel-exit

channel-exit is the estate's single controlled exit to a person's inbox or phone. Services that need to reach a human POST to its /send endpoint (bearer-token authenticated) instead of each carrying a provider key of their own — credentials live in one place, one service can be turned off or rate-limited, and a bug in a worker cannot become a bill.

It supports email and sms channels (whatsapp/push return 501), binds only to 127.0.0.1 on the host, and never logs message subjects, bodies, or credentials. GET /healthz reports which channels are wired without a token. Its first consumer is reminders-service.

Full contract, deployment notes, and operating rules: the channel-exit repository.