Technical Concepts
Private link delivery
How a board pack reaches a customer without ever being public, and why the download credential is separate from the session.
What it is
The pack is stored privately and served through a short-lived signed link, issued only after a valid, authenticated request.
Why the download credential is not the session
A browser navigation cannot carry a header, so the one route a browser navigates to must accept a credential in the URL.
That credential is therefore a one-minute, single-use ticket, not the session. Accepting either mechanism on one route is how the weaker one ends up sufficient.
What is re-checked at redemption
Ownership, report state, expiry, the ticket's own identity, and the derived storage key. Nothing is taken on the ticket's word.
What is never stored or logged
The signed link itself. It is issued, redirected to, and not retained.
The resolver fails closed
A pointer naming a report that is missing, belongs to another engagement, is not deliverable, or has expired results in a refusal, never a quiet substitution of an older pack.
What it does not mean
Nothing here is public, and no part of the path is reachable without an authenticated session first.