Comment by marcosdumay

#4 is a reasonable request. If the client wants to verify the lower level ops instead of higher level application and deployment, the instrumentation would be counterproductive. That could happen if he was thinking something on the lines of "there's a guy here that compiles his own kernel on a personal laptop, I wonder what impact this has".

The other ones could be explained by him being afraid of leaking PII, and most PII being on that system.