A fresh install sends nothing anywhere: zero channel documents means zero outbound connections, by construction — there is no feature flag to turn off because there is nothing to turn off. When you are ready, a NotificationChannel document points goca at what your team already watches: Slack, Microsoft Teams, email, ntfy.sh, or a generic webhook. One event can fan out to several channels; different audiences get different slices.
Delivery is honest in three specific ways. Events are recorded in the same database transaction as the change they describe, so a rolled-back operation can never notify. Delivery is at-least-once with retry and backoff — a receiver may rarely see a duplicate, and the X-GOCA-Delivery header is its dedup key. And every outcome — delivered, retrying, dead, even suppressed by noise control — is a row you can read: "why didn't I get notified" always has an answer in the product.
Applying a channel needs system-admin, a harder gate than most configuration — a channel points goca's own egress at a URL of your choosing, and that is a harder surface than the rest of the config API.
Now I can route CA events to the channels my team already watches.