Authentication and copies
The existing Google OAuth flow uses PKCE, nonce, browser-bound state and verified owner email claims. Only a verified session causes the proxy to set the trusted Grafana identity. User-supplied identity and authorization headers are discarded. Same-origin validation protects mutation requests. Grafana provisioning uses allowUiUpdates=false for source originals.
Publish contract
POST /api/owner/publish requires an owner session and the production Origin. It reads the saved dashboard from owner Grafana, rejects provisioned originals, oversized content, unsupported panel types and unregistered queries, then creates a branch and PR in local-server-observability. Public output contains approved opaque query IDs and no private links or annotations.
Synchronization boundary
Published dashboards have new published-prefixed identities. Scheduled Cloud synchronization writes only source originals and never saves back into editable workspace dashboards. GitHub remains the reviewed publishing path; public API routes cannot save, publish, change alerts or trigger an inspection.
Provisioning identities
Owner datasource names are preserved by UID from the existing SQLite database. Deployment verifies both native Grafana health endpoints after synchronization.
Infrastructure-only deployments restart the portal to refresh its runtime configuration and coordinated release manifest, even when the portal Git revision is unchanged.