The DaC surface. Every table is a class-library read; every action calls the same objects the tests gate; refusals appear verbatim — the engine's own words, never translated. Locally you act as an explicitly selected seeded principal; deployed, every act is signed by your authenticated identity (the server derives it from your session — it cannot be spoofed) and two-party ceremonies are staged server-side for a second signed-in user to close.