- Shipped
- October 26, 2026 at 7:47 PM UTC
- Author
- Kamo
- Commit
- d71e101
Owner 2026-10-26: direct orders must be authenticated. Someone who only claims to be a teammate (phone, text, unproven email, website chat, meeting) is asked, through kamoai-service, to confirm in their signed-in Kamo app; the SI is told in plain words what to say next. Once confirmed, RequestVerifier answers the run's order and request from that confirmation (auth:<id>): the member vouched for it, so the channel's taint does not count and its own expiry is the window. SI_AUTH_REQUEST never reaches an SI.