{"version":"2.1.274","anchor":"asset-reads-from-artifacts-can-now-hit-a-public-path-outside","canonical_anchor":"asset-reads-from-artifacts-can-now-hit-a-public-path-outside","heading":"Artifacts support a public read path for readers outside the owner's org","tier":"notice","area":"Artifacts","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.274\/e\/asset-reads-from-artifacts-can-now-hit-a-public-path-outside","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.274","markdown":"### Artifacts support a public read path for readers outside the owner's org\n\nReading an artifact's asset now has a dedicated public path and refusal message for readers outside the owning organization\n\n**What**\n\n- Reading an asset from an artifact (`read_asset`) now supports a distinct \"public read\" path used when the requester is outside the artifact owner's organization. The read result gains a `public_read`\/`public` marker, the underlying fetch function takes a new `admitPublicRead` callback and returns `publicRead` in its result, and a dedicated `public_refused` error reason covers the case where a public artifact doesn't serve that asset to outside readers.\n\n- A companion refusal path gains a `public_outside_org` case, returning the same message text used in the resume_replies flow. Share-status records now also track an `outsideOrgReader` flag, cleared whenever the account boundary changes, alongside the existing `probeErrorCode` and `role` fields.\n\n**Why** This gives artifacts a defined public-read path for people outside the owner's organization, with clear refusal messages when that access isn't available, instead of treating all outside-org reads the same way.\n\n- Area: Artifacts\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}