Attachments

Attachment bytes remain in customer storage for BYO and Hosted. Persist opaque file references with scoped metadata, not long-lived signed URLs. Host hooks perform authorized upload and short-lived download resolution. References must belong to the RFQ and the permitted uploader. Private supplier files remain buyer plus that supplier only.

Bootstrapware servers must not fetch arbitrary user-supplied links or pass bytes to MCP. Hosted structured payload storage is capped at 1 GiB per environment. Attachment bytes do not count toward that cap.