Each host should be able to write only its own data/<host>/ and raw/<host>/. Hosts sharing the production instance role currently keep prefix-wide access; recorded as an accepted exception in specs/000-status-page-baseline/tasks.md (T014). Splitting the role means changing instance profiles on running production machines. Mitigation in place: uploads are served as inert JSON.
Each host should be able to write only its own
data/<host>/andraw/<host>/. Hosts sharing the production instance role currently keep prefix-wide access; recorded as an accepted exception inspecs/000-status-page-baseline/tasks.md(T014). Splitting the role means changing instance profiles on running production machines. Mitigation in place: uploads are served as inert JSON.