- Shipped
- September 7, 2026 at 8:30 AM UTC
- Author
- Kamo
- Commit
- a31a3fb
Same door and same reasoning as its sibling one line above: X-Internal-Auth, constant-time, fail-closed. Genuinely pre-session — a mobile sign-in is reported by the sign-in path before a session exists, and a Kamo Universe session happens in a service that has no Kamo session at all. What limits it is its SHAPE rather than its guard. It awards single actions whose trigger is EVENT and refuses everything else, so the worst a caller reaching it can do is give somebody a ten-point badge for opening the mobile app.