Channel releases
Customer-facing knowledge is an approved immutable snapshot for one managed channel, not a public view of canonical memory.
Three independent decisions
A well-evidenced claim can still be confidential, wrong for one audience, or unsafe to publish. Titen therefore keeps three decisions separate.
| Axis | Question | Values |
|---|---|---|
| trust | How authoritative is the evidence? | unverified, asserted, verified, policy_approved |
| visibility | Who inside the organization may retrieve it? | private, team, organization |
| release | May this exact snapshot be served here? | draft, approved, active, suspended, replaced, expired, revoked |
Similarity, feedback, tags and model output cannot publish a claim. Release operations need an explicit scope plus an active organization role. A wildcard root key is reserved for bootstrap and recovery.
The gateway compiles released snapshots only. It cannot search observations, claims or customer memory, and a release never contains source evidence. Fetch live balances, inventory, payments and ticket state from the system that owns them.
Create a channel
POST /v1/channels creates a managed CRM, website, support or partner channel. The request
sets its allowed audiences, minimum claim trust and one bound service principal.
curl -X POST http://127.0.0.1:8787/v1/channels \
-H "authorization: Bearer $TITEN_API_KEY" -H 'content-type: application/json' \
-d '{"label":"support-site","kind":"website",
"allowed_audiences":["anonymous"],"minimum_trust":"verified",
"gateway_principal_id":"service_support_gateway"}'GET /v1/channels returns channel metadata, never assertion secrets or released content.
PATCH /v1/channels/:id sets active, paused or disabled with
expected_version. A non-active channel makes every release ineligible on the next compile.
An authenticated_customer channel additionally needs an assertion secret of at least 32
characters. Titen stores only its hash and an encrypted keyring-wrapped copy.
Draft one immutable snapshot
POST /v1/knowledge-releases binds released text to one exact current claim version.
{
"claim_id": "claim_product_return_window",
"claim_version": 4,
"channel_id": "channel_support_site",
"audience": "anonymous",
"released_content": "Returns are accepted within 30 days under the published terms.",
"locale": "en",
"valid_from": "2026-08-01T00:00:00Z",
"valid_to": null,
"proposal_reason": "Prepared from the current returns policy."
}The proposer must own the exact claim and its visible supporting evidence. Titen records
the source hashes but does not copy evidence into the release. GET /v1/knowledge-releases lists authorized release rows in stable creation order.
Approve, activate, revoke
| Route | Scope | Rule |
|---|---|---|
POST /v1/knowledge-releases/:id/approve |
releases:approve |
Independent approver accepts the exact draft hash and version |
POST /v1/knowledge-releases/:id/activate |
releases:approve |
Activates an approved release while its source remains eligible |
POST /v1/knowledge-releases/:id/revoke |
releases:approve |
Ends eligibility and retains the audit trail |
Each transition takes expected_version and a bounded reason. A stale version is 409
without a partial transition. The proposer cannot approve its own release. Approval and
activation also fail if the source claim version changed, became disputed, expired, was
superseded or was revoked.
Source eligibility is checked again at read time. It can suspend an active release without waiting for a maintenance write, so a stale release cache could not make an invalid source publishable.
Compile for a gateway
POST /v1/channels/:id/context/compile requires channel:compile and a service principal
bound to that channel.
{
"audience": "anonymous",
"task": "answer the customer's returns question",
"max_tokens": 900
}The result contains active, valid snapshots matching that channel and audience. Citation metadata identifies the release and claim version; it cannot be used to walk into source evidence.
For authenticated_customer, the gateway signs a short-lived HMAC assertion containing
v, channel_id, audience, subject, expiry and a single-use jti. Expiry may be at most 15
minutes ahead. The gateway derives the subject from its authenticated upstream session; it
must never sign a user-controlled id.