Auth Boundary

Uploads require an authenticated session. There is no pre-auth baseline handoff of schedule residency (ADR 0054). CSP third-party allowlists are documented in ADR 0056.