God is never blocked - GD alone passes every KB/notes gate, audited in tenant orgs

Shipped

November 15, 2026 at 5:16 AM UTC

Author

Kamo

Commit

4a54ec3

SessionHelper.hasRight answers true for a GD session and SessionHelper.rights hands a GD caller every right (so CallerResolver, MemoryCaller, **************** DecisionService clearers and note provenance all pass); KbReaderScope treats GD as a maintainer. A GD pass in a tenant org writes a phi_access_log row (platformStaff) through the existing PhiAccessRecorder, once per gate per request; platform org = configured kamo.kb.platform-org-id, no lookup. Never throws.