Hybrid exchange — one file, two audiences

The QI Ops workspace is the admin interface for the customer side. Every pair below is the same exchange record rendered twice: dense and decision-oriented for the coordinator, spacious and guided for the exchanger. The centre column states which way the change travels and what is deliberately withheld. Nothing here is a second copy of the data — there is one row in Supabase per fact, and two renderings of it.

QI → Exchanger The coordinator acts; the exchanger's portal reflects it.
Exchanger → QI The customer acts; it lands in the coordinator's queue.
Both ways Either side can move it; both see the result.
QI only Internal by design — never rendered to the customer.
QI Ops workspace Tom Bottenberg · Exchange Coordinator
Shared record
Exchanger portal Matt Belcher · Exchanger
Identity & AML clearance
Matt Belcherexchanger Verified 07/26 · Persona
OFAC / SDN4 subjects Rescreened 08/12
Cascade Titlepayee Screening pending
1 Identity & AML Both ways profiles.kyc_status
is_identity_verified
Your identity
Identity confirmed Verified

We confirmed your identity on July 26. This is required before we can hold exchange funds for you — it is the first step on every 1031 exchange.

Not shown to the exchanger: sanctions-screening results, counterparty screening status, match dispositions, and the review reason. The customer sees their own identity state and nothing about how anyone is screened.
Sales — required documents
Settlement Statement (HUD-1) Requested 08/06 — 8 days
Requesting a document creates the exchanger's task, the reminder cadence, and the audit entry in one action. When it arrives it is scanned, classified, and queued for your review — you never chase a file through email.
2 Document request Both ways documents
exchange_tasks
Action needed
Neela read the document — awaiting your review
Closing date08/02/2026High
Net to QI$251,633.89High
Buyer of recordSharmain Holdings LLCLow
Nothing is written to the file until the coordinator accepts. The exchanger is never asked to adjudicate an extraction confidence score.
3 Extraction review QI only extracted_fields
(pending accept)
Your view
Settlement statement received Received

Thanks — we have it. Your coordinator is reviewing it now. Nothing further needed from you.

Confidence scores, field-by-field extraction, and the accept/discard decision stay on the QI side. The customer sees an outcome, not a machine's working.
Signature status
Matt Belcherexchanger08/11 · 9:06 AM
Sandra OsmanQI countersign08/11 · 11:40 AM
Assignment of Replacement Sent 08/12 · waiting 2d
4 E-signature Both ways signature_requests
eSign Act audit trail
Awaiting your signature
Identification formSigned & countersigned
Disbursement pipeline
Ready to wire $25,000.00earnest Proposed TB · approved SO
Proposed $326,246.11closing Blocked · screening
Four-eyes is enforced in the database — approver can never equal proposer. No coordinator moves money from this screen, and no code path lets the exchanger initiate a disbursement.
5 Funds movement QI → Exchanger disbursement_proposals
(outcome only)
Your exchange funds
$357,802.73 Held in qualified escrow

Held in a segregated qualified escrow account in your name. By law these funds cannot be released to you during the exchange period — that restriction is what preserves your tax deferral.

Committed to earnest money$25,000.00
Available for your purchase$332,802.73
Withheld: proposer/approver identities, four-eyes state, screening blocks, and internal wire instructions. The customer sees their money and its constraints — never the QI's internal control machinery.
Statutory clocks
45th day Adjusted Oct 15, 2026
180th dayJan 29, 2027
Day of exchange period12 of 180
Adjusted under IRS Notice 2026-17 (federal disaster relief), approved by Sandra Osman on 08/09 — four-eyes approval, full legal basis recorded, audit-logged. The original date is retained, never overwritten.
6 Deadlines QI → Exchanger deadline_override_
requests (approved)
Your deadlines
Day 12 of 180 168 days to complete your purchase
Identification deadlineMet on Aug 11

The IRS extended your deadline. Because your property is in a federally declared disaster area, the IRS extended your 45-day deadline to October 15. We applied this for you — no action needed.

Exchanger portal access
Not yet invited Opened 08/01 from manual intake
A file can run entirely coordinator-led — every step above is doable on the exchanger's behalf. Inviting the exchanger flips the same file to self-serve without changing a single record; declining to invite is a supported end state, not an incomplete setup.
7 Portal access QI → Exchanger exchange_participants
invitations
Portal — not yet active
No portal until the coordinator invites. The file is complete and workable without it — the exchanger side is an amplifier, never a dependency.

Operating modes — the same file, three ways to run it

Mode is a property of the exchange, changeable at any time, and it changes who does the work — never what the file contains. A coordinator-led file is complete and compliant with the exchanger never touching a keyboard. Switching modes mid-file is normal: most exchanges start coordinator-led and open up once the exchanger is comfortable.

Coordinator-led Default
The QI does everything. The exchanger watches — or does not log in at all.
QI 92%Exchanger 8%
What the exchanger sees
Your exchange is being handled
Tom Bottenberg is managing this for you. There is nothing you need to do right now — we will contact you if we need something.
Relinquished sale closed Aug 2
Replacement property identified Aug 11
Purchase in progress Day 12 of 180
All 10 documents view & download
Read-only, on purpose
No upload prompts, no task list, no "action needed" nags. Transparency without obligation — the customer can see and download everything on their file, and is asked for nothing.
Hybrid — per step Most common
Ownership set step by step. The exchanger does what they are good at; the QI absorbs the rest.
QI 58%Exchanger 42%
What the exchanger sees
1 thing needs you
Everything else is with your coordinator.
Sign the assignment 2 min
Settlement statement handled by your QI
Title report handled by your QI
Delegated steps read as handled
A step the QI owns shows as handled by your QI — never as an incomplete item on the customer's list. A delegated step must never look like the exchanger is behind.
Self-serve Today's exchanger app
The exchanger drives their own hubs. The QI officer supervises and countersigns.
QI 26%Exchanger 74%
What the exchanger sees
Your 1031 exchange
Day 12 of 180 · next step: purchase
Sale · Identification complete
The experience we are protecting
This is the consumer app as it exists today — hubs, completion, next-step. Nothing in the QI build may degrade it; the QI console is an addition to this, not a replacement for it.
Who does each step, by mode
Step Coordinator-led Hybrid Self-serve Note
Open the exchange QI QI Either Manual intake, CRM push, or exchanger self-signup.
Identity verification (KYC) Exchanger must Exchanger must Exchanger Identity cannot be proven by proxy. Coordinator-led means assisted — link sent, walked through on a call.
Upload documents QI Either Exchanger QI can file on the exchanger's behalf; attribution records who actually uploaded.
Sign documents Exchanger must Exchanger must Exchanger eSign Act / UETA requires the signer's own intent. Coordinator-led falls back to wet-sign + upload.
Identify replacement property QI Either Exchanger QI records the exchanger's written designation; the form still carries their signature.
Propose / approve disbursement QI only QI only QI only Never the exchanger, in any mode — constructive receipt.
Countersign as QI QI only QI only QI only Fiduciary act. MFA-gated officer role.
Two steps coordinator-led cannot absorb — and how the mode handles them honestly

Signatures. The eSign Act and UETA require the signer's own intent; a coordinator cannot e-sign as the exchanger, and no "sign on behalf" affordance may ever be built. In coordinator-led mode the file therefore offers two compliant paths: send a single-purpose signing link (no portal account required — one document, one signature, no login), or record a wet-signed original the coordinator uploads with attribution.

Identity verification. KYC cannot be completed by proxy. Coordinator-led means assisted, not delegated — the coordinator sends the verification link and walks the exchanger through it on a call. The UI must never present a control that looks like the coordinator can mark identity verified themselves.

Everything else — uploads, document requests, identification recording, deadline management, funds, closing — is fully absorbable by the coordinator with no exchanger involvement at all.

Build contract — hybrid interface
1 · One record, two renderings. There is exactly one row per fact in Supabase. The QI view and the exchanger view are two components over the same query — never two tables, never a sync job, never a copy that can drift. If a value disagrees between the two panes, that is a bug, not a sync delay.
2 · Visibility is a property of the record, not of the screen. Every document, note, task, and proposal carries an explicit audience. Internal notes, extraction confidence, four-eyes state, screening results and wire internals are never rendered to the customer — enforced by RLS and by the serializer, not by hiding a component. A reviewer must be able to point at the policy, not at the JSX.
3 · Coordinator-led is a first-class end state. Every step works with no exchanger present. Inviting the exchanger changes who does the work, not what the file contains. "Not yet invited" must never render as an error, a warning, or an incomplete-setup nag.
4 · Asymmetric by design where the law is asymmetric. The exchanger sees their funds and the constraint on them; they never see the control machinery that keeps constructive receipt away. No code path lets an exchanger initiate a disbursement, and the four-eyes rule (approver never equals proposer) is enforced in the database, not in the component.
5 · A statutory clock is never "extended" by a user. Row 6 renders an adjusted date only because an approved four-eyes override carries a legal basis (IRS Notice 2026-17); the original date is retained and the change is audit-logged. The customer voice may say the deadline moved — it may never imply a user moved it.
6 · The customer voice is not the coordinator voice. Same fact, different register — QI reads "45th day · Adjusted · Oct 15 · IRS Notice 2026-17"; exchanger reads "Your deadline moved… no action needed." Porting coordinator density into the portal would destroy the consumer experience, which is the thing we are explicitly protecting.
7 · Both themes are designed, from one token contract. Every colour on this page resolves through ../tokens.css. The two column bands are the only permanently-dark chrome (--band-admin / --band-consumer); every filled button takes its label from an -on token so it never carries a hardcoded white that fails in dark.

Honest constraint — there is no realtime today. The app has no Supabase realtime subscriptions anywhere; sync is invalidateQueries on the acting client only. Both sides read the same tables, so an exchanger who reloads sees the coordinator's change — but "live" bidirectional push is new work. This page shows the data model being bidirectional, which is true today; it does not claim live push, which is not.
Blocked on API. Row 1 needs KYC and screening state on the single-exchange endpoint — QiExchangeParticipant currently carries no such fields.
All names, addresses, and amounts are synthetic demo data.