- Shipped
- August 24, 2026 at 9:58 PM UTC
- Author
- Kamo
- Commit
- b6c6e29
PhiTenantGuard runs at feature-enable time and nowhere else — three call sites, all in FeatureService. Now that PhiModule is capability-grained, an app whose core is permitted can still contain a capability that is not, and enable-time checking cannot see the difference. Same deliberate signature as PhiTenantGuard: a pure function of (status, module) with no caller, right or god-mode parameter, so there is nothing to elevate. Plain class rather than a stereotype — a shared-lib @Component needing an unscanned repository has crash-looped services four times; each consuming service declares its own @Bean. NOTE: MEETING_RECORDING and VOIP_RECORDING are now unbound from any ServiceType but not yet guarded at their call sites — that is the next commit touching MediaService and VOIPService. This is inert in production meanwhile because every org currently has handlesPhi=false, but the call sites must land before any tenant is flagged.