Stream one attachment to any holder of the signed URL. No auth by design.

This exists because a human-handoff provider needs a URL that still resolves when an agent reopens the conversation days later, and a presigned S3 GET cannot do that: SigV4 caps expiry at 7 days, and a URL signed with ECS task-role credentials dies with the STS session (hours). So the bucket stays private and we proxy.

The HMAC in sig is the whole capability; org rides along because the conversation_attachments RLS policy keys off the JWT's organization claim, and a global-scope client would silently read zero rows rather than error. It is inside the MAC, so it cannot be swapped for another org's.