Sources report what they can observe locally: sb-platform instances report VPS/platform facts, starter-kit projects report app readiness, and external services can provide their own checks.
The central watcher owns outside-in public checks such as DNS, TLS, HTTP reachability, latency, and expected auth protection. Unknown sources are sampled in a discovery inbox until an admin accepts them and issues a per-source token.