Artifact hosting and retention

Both artifact download routes are private. Authenticate with a dashboard JWT or an nfy_ key carrying artifact:read; the service also authorizes the exact task immediately before returning bytes. For a project task, the effective project policy must grant artifact:output:read (including an ARTIFACT_CONSUMER grant). Legacy or ad-hoc tasks retain their exact-owner fallback. If no custom hostingPath is supplied, the task is assigned artifacts/{taskId}/native.jar; address the hosted route as https://nativify.javavirtualenvironment.com/api/v1/hosted/{hostingPath}. The task response carries hostingPath, not a separate URL.

hostingPath only chooses a URL-safe custom path; it does not grant access or replace authentication. Hosted responses use Cache-Control: private, no-store and are returned as attachments. Anonymous requests and paths that are missing, invalid, expired, or outside the caller's authorized resource boundary resolve as not found, so callers must not use path obscurity as an authorization mechanism.

Completed terminal tasks are retained from completedAt according to the verified subscription entitlement, with a configured fallback where entitlement cannot be resolved. Active tasks are not removed by retention cleanup. Abandoned upload drafts use the separate task TTL. Retention values are plan-dependent and operationally changeable, so copy the artifact into your release storage before its entitlement window ends.