6- HYBRID SECURE BOARD PORTAL 5.1.0-0922-01 — PORTABLE STAGING PREVIEW

Purpose
- Separate the public Board user experience from Hybrid Core management.
- Test on the same staging CRM now without exposing Perfex admin navigation.
- Preserve public route shapes and Board IDs for later deployment to a dedicated HTTPS origin.

Public paths
- /hybrid_secure_boards/access/{DIGITAL-ID-TOKEN}
- /hybrid_secure_boards/boards
- /hybrid_secure_boards/board/{BOARD-ID}
- /hybrid_secure_boards/logout

Security
- Existing Hybrid Identity and Digital ID records are authoritative.
- Email OTP is single-use, expires after 10 minutes and locks after 5 failed attempts.
- Portal sessions use random 256-bit tokens; only SHA-256 hashes are stored.
- Sessions expire, can be revoked and are never Perfex administrator sessions.
- Every Board page revalidates the portal session and explicit hybrid_board_user_access assignment.
- Security headers deny framing, caching and referrer leakage.
- Merchant data is fail-closed in this preview until ownership mappings pass isolation QA.
- Board workspace uses a fixed one-window layout; only the active center panel scrolls.
- A right-side function rail renders only functions authorized for that Board member.
- Recruiting and Add Recruit are separate in-window views rather than a long stacked page.

Dependencies
- 1- Hybrid Core 5.1.0
- 3- Hybrid Identity 5.1.0
- 4- Hybrid HR & Partnerships / Board Access 5.1.0

Deployment boundary
- Same-server staging uses the existing central database.
- Public origin is configurable and contains no hardcoded domain.
- Moving to a dedicated server preserves public path names and Board IDs.
- Remote data activation still requires the signed management API and ownership-router release; this preview does not claim that bridge is complete.

QA required on staging
- Module activation and migration.
- SMTP delivery.
- OTP expiry, replay and five-attempt lockout.
- Assigned vs unassigned Board access.
- Direct URL rejection for unauthorized Board IDs.
- Session expiry and logout.
- Breadcrumb and link verification under the configured origin.
