HYBRID BOARD ACCESS LOGIN — 5.1.0-1003-01

Canonical public URL
- /crm/hybrid/boards when Perfex is installed in /crm.
- The route inherits any installed domain and CRM base path.
- No public Board view contains an /admin link.

Authentication
- Active Perfex staff email and password are the first factor.
- The same email must resolve to one active Hybrid identity.
- At least one active Board assignment is required.
- A single-use six-digit email code is the second factor.
- OTP expires after ten minutes and locks after five failed attempts.

Sessions and authorization
- Successful verification creates a random 256-bit portal session.
- Only the SHA-256 session hash is stored.
- Sessions expire and Secure Logout revokes the server-side session.
- Every Board request revalidates the session and explicit Board assignment.
- Direct unassigned Board IDs return 404.
- Login failures are rate-limited by hashed email and hashed IP.

Static checks
- PASS route inventory.
- PASS public-link scan.
- PASS brace-balance scan.
- PASS archive structure and integrity required before release.
- RUNTIME VERIFICATION REQUIRED on target PHP/Perfex: password hashing helper,
  SMTP delivery, OTP, session cookie, assigned/unassigned Board access, logout.

