- Shipped
- August 6, 2026 at 5:38 PM UTC
- Author
- Kamo
- Commit
- b64ed48
**************** now take the triple. The public controller keeps resolving it from SIGNSESH, so the signer app is unchanged; a staff-authenticated member surface can now reach the SAME code instead of growing a second signing implementation with a second set of audit bugs. The session's stepUpVerified flag is dropped because it was always redundant: stepUpVerify() writes recipient.stepUpVerifiedAt AND markStepUpVerified in one branch, so the row was already authoritative. orgId is now CHECKED. Under the old signature it came from a session minted off the envelope itself, so a check would have compared a value to itself; a staff caller supplies an org that was never derived from the envelope, and without the check a member of one tenant reaches another tenant's agreement by uid. 404, not 403 — existence is tenant information.