hiloop run. It
registers a run, starts a local OTLP receiver, and forwards the child’s spans and logs with the
trusted organization, project, and run identity attached.
Sandbox boundary
The sandbox runtime injects nothing: noHILOOP_API_KEY, no telemetry bearer token, and no
trusted run identity reaches a sandbox environment on its own. The platform-managed capture
session described in capture inside a sandbox
records the sandbox without placing a Hiloop credential in the workload.
Do not copy a Hiloop credential, raw provider API key, or platform-managed model credential into a
sandbox environment, image, command, or workspace. Anything running there could read it, and durable
paths may carry it into snapshots and forks. Compatible provider-subscription login state may be
tool-owned, but model traffic is supported only through the proof-bound gateway, never by direct
provider egress. Until that path is available, model access is not a supported sandbox capability.
Platform lifecycle and execution records remain available independently.
Failure behavior
- Oversized exports are rejected rather than truncated.
- Invalid identity or malformed batches store nothing.
- Backpressure is retryable and must use bounded backoff.
- Organization and project scope are derived from authenticated platform context, never from arbitrary payload attributes.