A useful system should explain its constraints. The services here are built to make their security boundary, retention behavior, and failure mode visible before an operator has to discover them during an incident.

Public endpoints accept the least possible input. Objects has no listing or user-controlled storage paths. Trace does not become a proxy. Sandbox tunnels are opt-in and every returned URL is public.

The intent is risk reduction through shape, not a promise that a hostname is private. When origin privacy matters, use a real ingress boundary and verify it end to end.

Clients describe a workload; they do not grant themselves privileges. Sandbox uses its AEGIS policy and worker capabilities to select isolation. The object API fails closed when upload protection is unavailable. Trace intentionally keeps custom request headers, bodies, and server-side fetching out of its surface.

This makes a client easier to reason about: its job is to be explicit, not clever. Read Sandbox security for the full isolation boundary.

Time, bytes, concurrency, retention, and output need ceilings. Sandbox limits workload resources and TTL. Objects caps uploads at 10 MB and expires them after seven days. Watchman bounds its collection, request, and report workflows instead of collecting arbitrary host data.

Boundaries make failures predictable enough to operate. A rejected request is often better than a partial request that quietly changes the system's shape.

Health means observable evidence, not a green label. Watchman records telemetry-source completeness, Status keeps recent probe samples, and Sandbox operations expose explicit asynchronous state. The normal response to an ambiguous mutation is to inspect it before trying again.

Read Status for the public check surface and Watchman rollouts for a concrete inference workflow.