Central interface, independent storage
Moving all telemetry storage to the monitored host would couple evidence availability to that host's health. The portal centralizes investigation while Grafana Cloud remains the source of historical metrics and logs. Local outages are therefore visible externally even when the portal cannot render.
Public contracts
Stripping labels is necessary but not sufficient: the public API also chooses which measurements can be queried. It must not expose arbitrary PromQL, LogQL, or Grafana proxy paths. Owner endpoints are authenticated and responses are not publicly cacheable.
Honest failure states
Transport failure, an empty series, and a stale sample have different meanings. The UI retains these distinctions. Reachability banners are explicitly scoped to public endpoints; they are not fleet-wide health assertions.
Operational cost
Caching protects provider quotas and CPU headroom. Query fan-out is bounded; multi-series panels truncate predictably instead of attempting unbounded dashboard reproduction.
Query identity
Imported dashboards often depend on template variables and multiple datasources. A local-server view must bind host identity explicitly. Provider quota series live in a separate usage datasource and cannot be assumed to exist alongside application metrics.
Identity boundary and rollout
Google proves identity; the owner email allowlist separately decides access. OAuth state is bound to a short-lived browser cookie and consumed once; PKCE protects the code exchange and nonce binds the signed ID token to that login. A signed host-only session is checked on every private request. Failed callbacks disclose no tokens. Logout requires a same-origin POST. Signing-key replacement invalidates existing sessions. During migration the pipeline activates and checks the Google-enabled backend before removing only the two portal Access applications. SSH machine Access and the production AI route remain intact. An old portal release that depended on Access should not be used as an authentication rollback after migration; roll forward with a corrected Google-enabled release.