- Shipped
- November 15, 2026 at 5:44 AM UTC
- Author
- Kamo
- Commit
- d42165b
Owner 2026-11-14: 'God is god. Nothing should ever block god from anything.' - **************** is THE god bypass: GD (or an open window) passes in every organization. A delegated session (SUDO_MEMBER_ID: System User / impersonation) passes only inside a window - the System User identity is god by construction, so its GD is not the operator's. - Every bypass now uses it, including the formerly window-only gates: account delete, org destroy/update/branding, PHI audit + PHI boundary, child-org options, member security (access level, promote, leadership), theme backgrounds, dev machines, MLOS operator, SessionRights.hasOrGod / TenantRightInterceptor, ClinicalRightsGuard, BaseLosController, security roles, org setup wizard, subdomain branches, domains, marketing sites, user-account edit policy, impersonation (same-org door), and platform rights (PlatformRightsService -> /network impersonate door; SystemUserEntryPolicy). - A pass in a tenant org (not PlatformOrgIdCache's org) is audited by GodAccessAudit: one phi_access_log row per request (GOD_ACCESS: <method> <path>, platform_staff), written off-thread behind a bounded queue, never blocking or throwing into a gate. - Removed refusals that blocked god: MlosConfigController SI-loan-access refusal under god mode, KamoOAuthConsentService refusal of god-window sessions, RpmWriteGate refusal of GD sessions. Impersonated sessions stay refused in all three (an attestation or consent would carry someone else's name). - Tests updated from 'GD alone is refused' to 'GD alone passes; non-GD refused'; new GodAccessAuditTest and ****************