HYBRID BOARD ACCESS — 5.1.0-1003-02

Native public route
- Module folder: hybrid
- Controller: Boards
- Native URL: /crm/hybrid/boards
- Does not depend on custom module route loading.

Security
- Active CRM staff password plus email OTP.
- Active Hybrid identity and explicit Board assignment required.
- Random 256-bit portal session; only its SHA-256 hash is stored.
- Session expiration, server-side revocation and secure logout.
- Login throttling uses hashed email and hashed IP.
- Direct unauthorized Board IDs return 404.
- Public views expose no CRM /admin navigation.

Runtime requirements
- Hybrid Core identity and Board tables.
- Hybrid Identity OTP tables.
- Active Board assignments.
- Working CRM email transport.

RUNTIME VERIFICATION REQUIRED
- Activate on target Perfex/PHP.
- Test password hashing compatibility and email delivery.
- Test assigned and unassigned users, direct Board URLs and logout.

