- Shipped
- August 4, 2026 at 4:43 AM UTC
- Author
- Kamo
- Commit
- 672b1a5
PhiAuditController.hasRight() bypassed the right check on session GD alone. GD means "may activate god mode"; godModeActive means "has activated it, deliberately, now". Honouring the first by itself let any god-eligible platform account read a tenant's entire PHI access history without ever passing through break-glass — no typed justification, no time-box, no deliberate act. That is self-defeating in a way worth spelling out: this controller exists to make access to PHI reviewable, and break-glass shipped in the same batch to make staff access deliberate and bounded. A bypass on eligibility routed around both, on the one screen where staff access matters most. It also repeats a defect this platform has had before, where god gates keyed off eligibility and were effectively dead. The gate now matches **************** GD AND godModeActive. Three tests replace the one that asserted the old behaviour: eligibility alone is 403, the activation toggle alone is 403 (symmetric, or the toggle silently becomes the whole gate), and an activated god session reads and is recorded as platformStaff. Mutation-proven — restoring the GD-only check fails **************** Found by the adversarial verifier on the audit-viewer work, which flagged it rather than silently changing it. Verified in a detached worktree because a concurrent session has GodModeSession.java deleted in the shared tree.