GD alone no longer grants every right on proxy routes

Shipped

October 14, 2026 at 4:28 PM UTC

Author

Kamo

Commit

0d3c604

ksemHasRight treated GD (god-mode ELIGIBILITY) as an all-rights bypass, so every god-eligible operator held every right on the 18 proxy routes that use it, with no window, reason or expiry. The bypass now applies only to an open window: GD and godModeActive and an unexpired godModeExpiresAt, the same rule as AIService, EmailService and BillingService (ksemGodWindowOpen).