An Atrium app is an HTTPS service you run (yourself, or later on Atrium Hosting). COHO never contains your business logic.
Manager connects the app in the Store -> COHO POSTs signed lifecycle.setup to you -> you store the API key + signing secret -> COHO may POST signed events/schedules -> you call Public API v1.1 with the API key -> you write Store logs -> optional: COHO loads your quick view URL in an iframeSame runtime contract for COHO-built apps, private org URL apps, and (later) Partners.