HYBRID EXECUTIVE BOARD — 2026-10-03-01

PURPOSE
This is the matched CRM-side stack. Core, Boards and the Receiver remain on the
same CRM server. A separate Hybrid login site may issue a signed, expiring
session through the Receiver and open only the assigned Boards or Calendar.

INSTALL
1. Back up the three existing module folders and database.
2. Upload the contents of this package's modules directory into /crm/modules/.
3. Replace these folders completely:
   - hybrid_core
   - hybrid_board_workspace
   - hybrid_access_receiver
4. In Perfex Modules, activate Core, Boards and Receiver.
5. Do not uninstall them and do not delete their tables.
6. Open Hybrid Receiver and set the exact external login-site origin.
7. Copy the Receiver secret into protected configuration on the login server.
   Never place it in browser JavaScript, a URL, source control or a screenshot.

CALENDAR
- The Board Calendar is built into Hybrid Boards and works without the separate
  hybrid_calendar module.
- If Board-linked Hybrid Calendar 5.9.0 or newer is active, Calendar opens that
  expanded view.
- If Calendar is absent or version 5.8.0 is active, Calendar opens the Board's
  built-in scheduling view. It does not produce a 404.

EXTERNAL LOGIN SESSION
- The login server sends a signed launch to:
  /crm/hybrid_access_receiver/sso_launch
- native_route may target only hybrid_board_workspace or hybrid_calendar.
- The Receiver creates an opaque expiring session.
- Receiver-launched users are confined to Boards and Calendar.
- Revoked or expired Receiver sessions return to CRM authentication.
- Native administrator logins are not changed.

IMPORTANT
This package supplies the CRM-side signed session endpoint. The separate
password + email-OTP login website is a different deployment artifact and is
not included in this CRM module archive.

