- Shipped
- October 5, 2026 at 10:16 AM UTC
- Author
- Kamo
- Commit
- 9581238
Every run's PERCEIVE calls notifications_list, mail_list_unread and calendar_list_events with the run id. All three are untrusted and none said where its content came from, so every run was tainted EXTERNAL by its own perception, D20 check 7 answered TAINTED for every onRequestOf, and neither item 12 (ON_REQUEST, 'Done, as you asked') nor D3a's CALLEE_REQUEST consent could fire in production. - notifications_list taints INTERNAL when every card is a colleague's chat line (CHAT_MESSAGE/MENTIONED whose actor is an active team member of the caller's org) or the org's own work (TASK_*, APPROVAL_*, AI_ALERT raised by the platform or a colleague); an empty page too. Mail, texts, voicemail, calendar, leads, meetings, general cards and any kind added later stay EXTERNAL, as does a failed lookup. - mail_list_unread/mail_search with no message, and calendar_list_events with no event, hand over nothing: INTERNAL. Any message or event is EXTERNAL, a colleague's mail included. - ChatPack's insider check moves to packs/Insiders, shared. PerceiveThenRequestTest replays kamoai-service's exact PERCEIVE calls through the real packs, RunTaint and RequestVerifier: the owner's DM then stands as the approval (accepted:true, an ON_REQUEST row, the planner holds the verified request); unread outside mail, a NEW_EMAIL card, an event, or an email read later in the run still gives TAINTED.