- Shipped
- August 25, 2026 at 12:55 AM UTC
- Author
- Kamo
- Commit
- dfdd9cc
SOCIAL_MESSAGING, CANVA, MCP_GATEWAY and ANALYTICS_EXPORT were each declared outside the compliance boundary, bound to no ServiceType, and checked by nothing — the declaration was the entire control. They were baselined when PhiCapabilityGuardCallSiteTest first found them; all four now have real call sites and the baseline is empty. PhiTenantResolver removes the three lines every service was about to duplicate — load the org, map the flag, ask the guard — where getting the middle one wrong is silent: a missing row must resolve to UNKNOWN, and spelling it false turns an unresolvable tenant into a permitted one. assertPlatformWidePermitted exists for surfaces with no single org, like a corpus export that deliberately crosses every tenant. Asking the per-org question there would deny on UNKNOWN for the wrong reason and read as a bug; the question that actually applies is whether ANY tenant handles PHI. KNOWN_UNGUARDED is kept as an empty set rather than deleted, because the mechanism is the point: adding a name back is possible but deliberate and visible in review. 1597 tests green.