/api/v1/environments/{id}/services

Projection of the last template service startup sequence: per-service state and

lastCheckedAt. gatewayUrl is an HMAC-signed scoped gateway URL (operator channels

get an owner-dimension URL; principal sessions get a URL embedding their session-bound

principalId — another principal's URL fails verification). Raw Pod IPs are never

exposed. Access is gated to running/degraded and the TTL window. Template probes

require 2 consecutive successes (interval 500ms, per-probe timeout 1s, 30s startup

budget), run in parallel with sandbox readiness, and an exec-able carrier that keeps

failing probes from never-success fails fast instead of burning the full 30s window.

The Gateway forwarding service that consumes these URLs is a Gate B+ deliverable.