# ALSTC → Admin Stage bridge — v38

## Safety boundary

- This package is prepared locally only; it has not been deployed to `alstc.co`.
- The existing consultation form keeps its original database-only path unless all three Stage variables are present.
- The only permitted destination in `stage_only` mode is `https://stage-admin.alstc.co/api/integrations/public-intake`.
- No secret is included in source control or in this package.
- No operational or synthetic request is created during tests.

## Delivery design

1. The consultation request is stored locally first.
2. When the bridge is explicitly enabled, an outbox event is stored in the same database transaction.
3. A separate relay signs the exact body with HMAC-SHA256 and sends it to Admin Stage.
4. HTTP 200/202 marks delivery complete, permanent 4xx responses are quarantined, and temporary failures are retried with backoff.
5. Admin still requires manual conversion of a validated event into a lead or appointment.

## Activation prerequisites (not performed)

- Apply the `integration_outbox` table migration to a non-live copy of the public-site database.
- Set `ALSTC_ADMIN_INTAKE_MODE=stage_only`.
- Set the exact Stage receiver URL.
- Generate one shared secret of at least 32 characters and set it on both Stage applications.
- Change the Admin Stage control from `disabled` to `stage_only` only for a supervised UAT window.
- Submit one explicitly approved test request, verify the queue, then disable the control again.

## Verification completed locally

- Public payload validates against the Admin receiver contract.
- Persian and Arabic digits normalize consistently.
- Stable payload hashes match across both applications.
- HMAC signatures generated by the bridge verify in Admin.
- Live Admin targets and `live` mode are rejected by the Stage safety gate.