Public Surface Policy

Public surfaces should be policy-driven, not random.

Wrap a Capability When It Is

• stable enough to explain clearly
• useful in automation or application workflows
• able to report provenance, evidence, events, or audit state
• best understood through platform nouns instead of app-local implementation details

Keep a Capability Deeper When It Is

• low-level and easy to misuse
• still changing shape quickly
• app-internal or demo-internal
• mostly a compatibility shim
• unable to participate in the proof chain

Current Recommendation

• lead with CLI JSON for automation
• keep Python as a thin wrapper over that CLI
• treat review packets as the external interchange surface and run bundles as raw/reopenable run evidence
• keep Rust as the deepest exact surface
• avoid notebook, widget, or wrapper-only SDK stories as product identity