- Shipped
- August 24, 2026 at 11:21 PM UTC
- Author
- Kamo
- Commit
- bca5c10
Splitting an app from the capability inside it is what lets a clinic hold a phone system and a video room at all, but it moves the enforcement burden. PhiModule does not enforce itself and PhiTenantGuard only runs at feature-enable time, so a capability bound to no ServiceType is reachable only through code. Reclassifying without a guard reads as compliant and enforces nothing — strictly worse than the blunt refusal it replaces. It found a pre-existing hole on its first run. SOCIAL_MESSAGING, CANVA, MCP_GATEWAY and ANALYTICS_EXPORT are each declared outside the boundary, bound to no app, and checked by nothing: the declaration IS the whole control. Not introduced here — they have never had an enforcement point. Baselined on the **************** principle rather than tolerated: the build fails on any NEW unguarded capability, and fails on a STALE baseline entry too, so guarding one requires deleting its line and the list can only shrink. Being on it means declared-but-unenforced, not safe — each needs a real guard before any tenant is flagged handlesPhi. 1597 tests green.