Concepts / provider evidence

Useful estimates, explicit gaps, reproducible comparisons.

Provider pricing, measured usage, and final invoice cost are different facts. Wildflower keeps them separate in the API, analytics schema, and benchmark output so a convenient estimate cannot quietly become a billing claim.

Read cost fidelity from the API

Usage remains available after sandbox deletion because the estimate uses the project-scoped registry and captured pricing evidence, not another provider lifecycle request. A later catalog refresh cannot rewrite a new sandbox’s historical estimate. Older rows without a creation snapshot explicitly report current_catalog_fallback.

1curl -fsS \2  -H "Authorization: Bearer $WILDFLOWER_API_KEY" \3  "$WILDFLOWER_URL/v1/sandboxes/$SANDBOX_ID/usage"

1{2  "schemaVersion": "wildflower.sandbox-usage.v2",3  "status": "estimated",4  "confidence": "low",5  "listPriceEstimateUsd": "0.041400",6  "providerReported": {7    "status": "unavailable",8    "amountUsd": null,9    "reason": "No authoritative per-sandbox amount is integrated."10  },11  "invoiceReconciled": {12    "status": "unavailable",13    "amountUsd": null,14    "reason": "No finalized invoice amount is reconciled."15  },16  "priceSource": {17    "basis": "sandbox_creation_snapshot",18    "capturedAt": "2026-07-28T00:00:00Z",19    "url": "https://e2b.dev/pricing",20    "digest": "<sha256>"21  }22}

Provider billing-signal coverage

This table is synchronized from the API repository. “Unavailable” can mean the provider has no documented signal, the signal is aggregate-only, or a distinct billing credential and identity are required. Those cases are not collapsed into one optimistic boolean.

1curl -fsS \2  -H "Authorization: Bearer $WILDFLOWER_API_KEY" \3  "$WILDFLOWER_URL/v1/provider-observability"

Partial credentials degrade by operation

Connecting a key does not prove it can create, execute, delete, or read billing data. The safe profile test makes no provider request and leaves a new profile unverified. Deep verification is explicit because it mutates provider state and may cost money.

1# Creates, executes in, and deletes a provider sandbox.2# This can incur provider charges.3wildflower provider verify e2b

• Verified create, get, exec, and delete with missing optional usage:degraded; working operations remain available.
• A known failed operation is rejected locally withprovider_operation_unavailable, a reason, and remediation.
• Cleanup not proven: unsafe; future creates are blocked and the provider-native orphan ID and a reconciliation operation ID are returned.
• A create with an unknown outcome and no routing ID is alsounsafe; automated cleanup is impossible, so the reconciliation operation ID is the durable investigation handle.
• Successful readiness evidence expires after 24 hours. Replacing or disconnecting a key while verification runs cannot be overwritten by the stale result.
• A runtime authentication failure invalidates only the affected operation. Transport and temporary provider failures do not erase credential evidence.

Run a bounded live canary first

1corepack pnpm providers:canary -- \2  --confirm-live \3  --max-estimated-cost-usd 0.10 \4  --providers e2b,daytona

The canary requires fresh deep-verification evidence, a comparable normalized price, explicit live confirmation, and an estimated-cost ceiling before any network mutation. It uses stored profiles, attempts cleanup after every post-create failure, and writes evidence without credentials, sandbox IDs, provider-native IDs, or command output. The ceiling is an estimate, not a provider guarantee.

Four latency boundaries, not one vague speed number

Run the neutral provider benchmark

1export WILDFLOWER_URL="https://wildflower.computer"2export WILDFLOWER_API_KEY="<project-key>"34corepack pnpm providers:bench -- \5  --providers e2b,daytona,modal \6  --samples 100 \7  --warmup-samples 3 \8  --workloads noop,shell_cpu,filesystem_cache,filesystem_durable \9  --region us-east \10  --seed published-comparison-1 \11  --publishable

Protocol 2 fixes noop, a portable shell loop namedshell_cpu (not a hardware-normalized “single-core” score), cached filesystem work, and a separate fsync filesystem workload. Warm runs use a new sandbox per provider and workload, record three unmeasured warmups, and clean that workload before moving on. Provider order is seeded and interleaved; timeouts plus HTTP, workload, and cleanup failures remain in the artifact.

Statistics fail closed when the sample count cannot support them: p50 requires 2 measurements, p95 20, p99 100, the p50 bootstrap interval 20, and the p95 interval 100. Publication mode also requires a named region, fresh readiness, a clean source equal to local origin/main, and a commit-shaped API build revision.

The provider-default cohort is available. The normalized-resource cohort is deliberately unavailable until every provider can be assigned equivalent declared vCPU, memory, architecture, and image contents. No cross-workload composite score or overall winner is produced.

• Download the provider benchmark protocol
• Download the result schema
• Download provider observability coverage
• Download provider-neutral billing fixtures
• Download the observability vocabulary
• Download the cost snapshot v2 schema

Telemetry delivery is observable too

Create, delete, and usage-read boundaries emitwildflower.telemetry.sandbox-cost-snapshot.v2 under the canonicalwildflower.sandbox.cost_snapshot.captured event name. Every event has a UUIDv7 ID and an immutable price-source basis, so equal-millisecond rows resolve to one complete deterministic snapshot instead of mixing fields. Public/metrics and/healthz expose only process-wide attempt, sink-rejection, and ClickHouse dropped-row counters. They contain no project, sandbox, provider, request, or credential dimensions.