A private review layer being built inside the AfterPlaySports media system, designed to make consent, derivative identity, reviewer access, and revocation verifiable at every request.
Improving recording and future workout-intelligence features may require carefully controlled human review. AfterPlaySports treats that as a high-risk workflow: every view must prove that the recording is currently authorized, transformed for review, and still eligible at the moment of access.
Production delivery is committed off by default. A missing enable flag, stale authorization revision, absent per-recording consent, or unverified derivative returns a private not-found response even after authentication. Legacy account-wide consent does not authorize current review media.
The review Worker has no binding to original audio-bearing footage. It can read only a separate private R2 bucket containing verified video-only derivatives, while D1 pins the authorization revision, derivative revision, object key, version, ETag, and size.
Cloudflare Access verifies the application token and an exact reviewer allowlist before the private portal is reachable. Discord receives only a generic portal link: no footage, account or session metadata, recording details, embeds, or mentions.
Withdrawal removes review eligibility immediately and detaches the minimal Discord message pointers into a cleanup queue. Failed deletion remains retryable with bounded backoff; unresolved pointers are retained rather than being reinterpreted as success during webhook rotation or retention work.