N-Lab Systems
Controlled preview Release hold · Noindex

Systems · Runtime · Machine Interfaces

Governed systems & runtime for N-Lab.

The technical front door for bounded applications, machine interfaces, runtime projections and operational endpoints as they are admitted. Production admission is not established.

Explore interface classes Read surface contract

Apex principle

Public-safe index at the apex. Child surfaces graduate only when a durable audience, security, runtime or lifecycle boundary is proven.

Interface map

Boundaries before hostnames.

These names are architectural candidates. They do not imply live DNS, public availability or execution authority.

app

Human Operating Surface

Canonical target residence for the authenticated N-Lab operator experience.

Target adopted · runtime / IAM / DNS hold
auth

Identity & access

OIDC, SSO and authentication boundary.

Reserved · security gate
api

Machine API

Versioned external machine contract when a stable caller boundary exists.

Reserved · contract gate
status

Service status

Operational availability and incident projection from qualified sources.

Reserved · source-contract gate
gateway

Gateway

Governed provider and runtime gateway boundary.

Private-by-default
registry

Registry projection

Serving interface for qualified institutional registry projections.

Private projection first
twin

Twin projection

Interaction boundary for selected Institutional Twin projections.

Private projection first
agents

Agent runtime

Governed agent interaction boundary after runtime identity is qualified.

Private-by-default
ops

Operations

Operator and control-plane interfaces.

Private · no public DNS by default
data

Data services

Private data-plane interfaces with explicit source and access boundaries.

Private · no public DNS by default

Trust boundary

Transport does not create authority.

  • 01

    Provider deployment does not establish institutional authority or operating mandate.

  • 02

    Endpoint availability does not grant caller authorization, data rights or execution permission.

  • 03

    Registry or Twin projection does not replace competent source systems or currentness qualification.

  • 04

    Policy permit, technical access and successful execution remain separate from Decision, authorization, outcome and assurance.

Machine-readable

The surface describes itself.

Bounded machine endpoints expose the apex contract and provider-health projection without promoting them into institutional truth.

/.well-known/nlab-surface.jsonSurface identity, release posture and child-surface policy. /health.jsonProvider-level availability projection for this deployed shell.
Release boundary

This apex is a controlled preview. Public indexing, child-hostname materialization, production admission and consequential runtime activation remain separately gated.