Infrastructure Access

REFERENCE — runtime routing to access control references.

Path validation

Before any write operation, validate the target against the canonical path list:

→ Approved File Paths

The delegation-gate.sh PreToolUse hook enforces this at runtime. Commands targeting only permitted paths should auto-accept.

Network access

Before SSH, API calls, or tunnel configuration, consult the node registry:

→ Approved IP Addresses

Z2 storage sweep (2026-06-11)

Michael ruling: Z2 /mnt/data (2TB) is Hinata's predominant home — the Mac keeps the vault, OneDrive inbox + trackers, and Apple-dependency runtime only. The git mirror moves code only (151MB); the data plane in Sandpit/hinata-sandpit/ (11.3 GiB measured 2026-06-11) is gitignored by design and never had a migration vehicle. Execution: task 800143 (Jimmy Neutron). Standing pressure: scan-sandpit-mass.py, session-end Batch 2. Law: container-storage-strategy.

Quick reference

Need	Go to
"Can I write to this path?"	approved-file-paths
"What's the IP for Z2?"	approved-ip-addresses
"What are the deploy rules?"	deploy-policy
"How does delegation work?"	runtime-workflow
"Where does data mass live?"	Z2 /mnt/data/hinata — see §Z2 storage sweep above