- Shipped
- 2026년 11월 15일 오전 12:15 UTC
- Author
- Kamo
- Commit
- 7bd86bf
GD is eligibility; a bypass needs GD AND an unexpired godModeActive. ~30 gates treated GD alone as a bypass (ClinicalRightsGuard PHI gate, BaseLosController.hasGod and its ~75 subclasses, LeadController, LeadViewGate, AccountController, Feature, GeoBlock, AccessRule, AccessLog, DetectionRule, MemberSecurityAction, POS, CommerceMarket, EventSound, ContactEffect, LeadImport, LeadIntake, LeadTask, MarketingEmailRecipient, MemberController, PictureFrame, MobileDeviceAdmin, SecurityModelMarket, PageTransition, RightsDiagnostics, Impersonation same-org door, MemberInteractionService). One helper: **************** (GD + godModeActive + unexpired stamp; tolerant of Redis string forms). Inline both-flag checks now route through it too. Deliberate eligibility reads use GodModeSession.isGodEligible and are named at the call site: PasswordChangeController (owner 2026-06-15), DesktopSsoController (KamoDesktop provisioned to god-eligible staff), RpmWriteGate and PhiAccessAuditor (refuse/label only - the wider set is the safe side).