Build one capability for the Space.
A Service owns one shared infrastructure capability and exposes narrow, authenticated operations to authorized Capsules. It keeps provider and administrator credentials outside every Assistant.
Shared process, isolated authority
- One Service instance serves one Space instead of being duplicated in every Capsule.
- The Service authenticates the caller and derives the exact Capsule resource server-side.
- The future binding lets Assistants request named operations without receiving a Service control credential.
- BYOK is optional and remains encrypted, Capsule-bound, rotatable, and revocable in the Service.
- PostgreSQL and Cloudflare R2 are the current Spec v1 references.