- Shipped
- August 8, 2026 at 5:15 PM UTC
- Author
- Kamo
- Commit
- 6407612
Turns kamo.entitlement.fail-open off now that AppEntitlementCatalogMigration has run against prod and every active plan on both entitlement roots (KamoCRM, Sign Pink) carries an explicit row for all 21 non-core apps — verified zero uncovered plan-by-app combinations, so there is nothing left for a deny-by-default to catch except a genuinely unpriced app. This does not change what any org can use today: shipped apps are explicitly included, and MLOS and the personal-loan app were already denied by explicit isIncluded=false rows, which bind regardless of this flag. What it closes is an app slipping through unpriced by never appearing in a plan's matrix at all. Flip back to true if a new entitlement root is added before the migration has run for it.