> Production API availability: use /api/v1/help?view=guides and the resource operations catalog before following a recipe. Some localhost capabilities are not deployed yet; an absent operation is unavailable.
What this module owns
Training intent, evaluation plans, run manifests and metrics. The kernel/runtime repository owns execution; a plan is not an executed training run.
Read the training schema first
The machine API allowlist in app/plugins/Security.php covers selected training and metrics actions. It accepts X-Antsand-Labs-Token or Bearer against ANTSAND_LABS_API_TOKEN, with a configured local token-file fallback. This is a separate shared machine-token mechanism, not the per-user scoped /api/v1 key system.
curl --fail-with-body "$API_ORIGIN/labs/training/schema" -H "X-Antsand-Labs-Token: $LABS_TOKEN"The schema describes templates, create, plans, update, preflight, evaluator, artifact, ready, start, runbook and event operations. Start creates a run request manifest; it does not prove runtime execution. Current training plan storage uses a local /tmp directory and lacks the same per-owner contract as the versioned APIs. Review isolation, durable storage, command execution boundaries and authorization before using it as a multi-tenant production control plane.
Agent access status
No explicit /api/v1 route for this module was found in the route inventory. No supported scoped agent adapter is currently documented. The special interface above must be reviewed separately.
Access boundary
External agents use only the versioned operations documented above and returned by the deployed catalog. Browser actions and internal controllers are not substitutes for missing API operations.
Verification before automation
Read back the owned record after a write. On a dedicated local fixture, test missing input, wrong owner, missing scope and stale revisions where supported. Confirm the request did not change state when rejected. Check the generated projection separately from the source record. Never replay sends, payments or deletion requests merely to test connectivity.
See API validation and remaining gaps for the shared test strategy.
HTTP discovery and safety contract
Read GET /api/v1/help?view=guide&resource=labs for this module's machine-readable guidance. Discover supported operations through its discovery_url when present. A null discovery_url means no direct resource API is documented; related endpoints, when provided, have their own ownership and scope requirements.
Use GET /api/v1/me with your key to confirm identity and scopes. Only request methods and fields supported by this deployment. The shared transport boundary rejects unsupported methods and malformed JSON on covered routes, but field schemas and revision checks remain resource-specific. Notes and Carousels expose typed save schemas and payload-only validation; other modules must not be assumed to share that contract.
Create, update, replace, patch, delete, send and publish are distinct capabilities. An operation absent from the returned catalog is unavailable, not permission to guess a URL. Read back after writes; after a timeout inspect the result before retrying. Never automatically replay a payment, message, deployment or deletion.