Index member_notifications by (source_type, source_id) for withdrawal across members (IoT close-out F15)
The withdraw-by-source read (findBySourceTypeAndSourceId) and the IoT alarm's withdraw-by-prefix (StartingWith -> LIKE 'x%') had only the member-led index, so b...
KamoCameras in the entitlement catalog, on the platform's own plan only (totality test green)
KamoCameras (ServiceType 39, shipped 2026-10-13, TESTING) shipped without an AppEntitlementCatalogMigration entry, so **************** two totality checks have ...
AiAutonomyModeTest pins CP07's RELEASE_PROPOSAL draft kind, and no @Immutable entity may carry a database-generated value
- **************** was red on main since KamoCollab CP07 Task 5 (8bd0f67c) appended **************** (spec D25, a disclosure_request's approval) without updat...
Sms_read_attachment, and sms_read_thread names what was texted in (SITP MMS)
TP11 deferred sms_read_attachment because VOIPService kept no inbound MMS media; it does now (voipservice@8eda899). So: - sms_read_thread lists each inbound pa...
The alert chat leg resolves its people per organization; an IoT alarm update is quiet on iOS
F12 (IoT close-out, SP14 routing): AlertChatService defaulted to organization 1 and the aliases "sage" / "kamo-monitor", which name nobody in production, so eve...
Keep the pictures and files people text in, for every provider (SITP MMS)
VOIPService stored only the words of an inbound MMS, so nobody (person or SI) could see what was texted in. Now every inbound rail reads its media and VOIPServi...
A dat's object key also asks the inbound MMS parts that hold it (SITP MMS)
VOIPService now keeps the pictures and files people text in (VOIP_MESSAGE_ATTACHMENT) through storeContentAddressed, with no Img row. storageExtension found a d...
Master section 10 R7 — the owner's round-3 answers and what shipped [skip ci]
An SI on a teammate's order can find and operate just the function the order needs; on god's order also unverified ones (IoT R7 round 3)
- IotPack.planSend: when the SI's own view lacks the device or the function (or may not OPERATE it) and the caller is on an order-scoped session, IoTService's...
An order's tool call runs on a per-call scoped order session that lends only what the tool needs (No Insubordination Rule, IoT R7 round 3)
OrderDelegation.resolve takes a CallScope: the tools/list keeps the session lending the requester's whole standing (kamo:tool:order:<runId>), so the SI knows wh...
God eligibility alone passes CONFIGURE_SYSTEM only in the platform org; elsewhere only an open window (IoT R7 round 3)
**************** let GD (eligibility, no window) pass every tenant right in every org, so the System User held CONFIGURE_SYSTEM (organization sounds) in every t...
An order lends only the rights the called tool needs (No Insubordination Rule, IoT R7 round 3)
POST **************** takes an optional neededRights (RoleRightType names; an unknown one is a right nobody holds). With it, OrderDelegationService.lend borrows...
God eligibility alone passes a right only in the platform org; elsewhere only an open window (IoT R7 round 3)
AuthHelper.hasRight / requireRight let GD (god ELIGIBILITY, no window at all) pass EVERY tenant right in every org (24 controllers: reports, social media, acces...
GodPassesRightChecks — god eligibility alone counts only in the platform org (IoT R7 round 3)
Owner rule (2026-10-18): outside the platform organization god acts only through break-glass. **************** an open window always passes a tenant-right check...
Master section 10 R7 — the owner's answers of 2026-10-18 and what shipped [skip ci]
Index loan_files.loan_transaction_id, applied to production 2026-10-18 [skip ci]
Owner approved. The deal -> loans lookup in **************** (deal status, pipeline summary, retireIfEmpty) moves from a sequential scan to an index scan. Same ...
Index loan_files.loan_transaction_id on LoanFile
The deal -> loans lookup **************** deal status, pipeline summary, and the retireIfEmpty check after an application is deleted) was a sequential scan. The...
The activity says "as god, break-glass <window>", and god's own window may share (master section 10 R7)
Owner 2026-10-18: every action is visible to the tenant. actorText appends iot.actorStanding.asGod / asGodBreakGlass (dictionary e7519fa8) for god's rows and an...
Fixtures stamp the god-mode window's end; an elapsed window is not elevated (shared SessionPlatformFacts expiry)
**************** now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1), so the open-window fixtures of the 28 test classes whose gates read it (Sess...
A closed god-mode window is closed here too (shared SessionPlatformFacts reader)
Seventeen VOIPService gates (CallController, the VoIP admin controllers, the SMS inventory and bulk-text controllers, DoNotContactController, RecordingAccessSer...
The IoT live-topic check carries the subscriber's session, so god's break-glass window can be honoured (IoT R7)
A god-mode window is a property of the session, not the member, and the STOMP authz calls to iot-service named only the member, so god in another org could not ...
A closed god-mode window is closed here too (shared SessionPlatformFacts reader)
ViewerPlatformFacts (the ENTER AS SYSTEM USER verdict on support tickets) read GD && godModeActive itself. SecurityService masks an elapsed 30-minute break-glas...
A closed god-mode window is closed here too (shared SessionPlatformFacts reader)
**************** read GD && godModeActive itself. SecurityService masks an elapsed 30-minute break-glass window only for its own gates, so this service, reading...
An SI on god's order sees and can ask for god's devices (IoT R7, No Insubordination Rule)
IotViewRules: an SI's manifest whose caller block names god's standing (caller.god PLATFORM | BREAK_GLASS) and the requester (caller.godOnOrderOf) keeps SAFETY_...
Fixtures stamp the god-mode window's end; an elapsed window is not elevated (shared SessionPlatformFacts expiry)
**************** now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1). **************** god fixture carries the stamp, and a new case pins that an ...
GodModeVerifier judges the god-mode window at its own clock (shared SessionPlatformFacts expiry)
**************** now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1). windowOpen(session, memberId, now) asked the shared reader at the system clo...
AiCaller judges the god-mode window at its own clock (shared SessionPlatformFacts expiry)
**************** now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1). AiCaller.fromSession(session, now) asked the shared reader at the system clo...
Fixtures stamp the god-mode window's end; an elapsed window is not elevated (shared SessionPlatformFacts expiry)
LosRightsFilter reads the window through the shared SessionPlatformFacts, which now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1). The open-wind...
GodWindows finds a member's open break-glass window among their sessions (IoT R7)
Pure (no stereotype, no Redis client): the caller reads ***UIDX<userId> and hands the sessions in. A window counts only in the member's own session (not imperso...
A god-mode window is open only until its stamped end (SessionPlatformFacts)
godModeActive() now also needs godModeExpiresAt (epoch millis, number or string) to be after now. SecurityService masks an elapsed window only for its own gates...
The endpoint ratchet sees @RequireRight; the org-graph ratchet allows two read-only hits (SITP TPGUARD)
**************** flagged the TP02 billing and commerce-invoice relays. Not a hole: every commerce-invoice handler carries @RequireRight (TenantRightInterceptor ...
Deleting an application that must be kept shows why instead of doing nothing (SITP TP21FU)
SecurityService now answers 409 for a received mortgage application (a record of business, withdraw it instead). The delete handler had no catch, so the rejecti...
Master section 10 R7 — god has total control (owner 2026-10-18) [skip ci]
Staff can delete a never-received mortgage application; a received one answers 409 (SITP TP21FU)
DELETE **************** went through AppMortgageService.delete, which 500'd for every application (borrower satellite rows left behind). The shared library now ...
Every clinical audit row names its patient; pick up the shared-lib audit and updated_at fixes (SITP TP23FU)
Production phi_access_log rows from the clinical audit methods carried no purpose, basis or patient: the shared PhiAccessRecorder dropped them while stamping th...
Clinical audit rows keep purpose/basis/patient; updated_at stamped on every save (SITP TP23FU)
PhiAccessRecorder stamped occurredAt by rebuilding each event from a field list written before the clinical columns existed, and no caller sets occurredAt, so e...
Deleting a mortgage application no longer 500s, and a received one is kept (SITP TP21FU)
DELETE **************** failed for every application: AppMortgageService.delete removed the borrowers through the JPA cascade while borrower_declarations / borr...
God's controls are usable and need no co-signer (master section 10 R7)
Owner 2026-10-18: god (the platform owner) operates every IoT function; in another org only inside break-glass. The manifest's caller.god (@kamo/iot-core 0.9.0 ...
Rebuild for the owner's legal decisions and the real referral cookie names
The text is in kamo-translation-dictionary b6d42a87 (Privacy 4, 7, 9; Terms 2, 8; Cookie Policy referral rows).
The deploy-safety audit accepts a reasoned 'spread' exemption for a node-pinned Deployment
Every KlusterServices deploy since run #337 ended red on kamoai-voice (3 replicas pinned to k3m1 by nodeSelector, so no hostname spread is possible). The rule h...
Mlos_update_section keeps what the call does not give (SITP TP21 live smoke)
The loan, property, declarations, military and row saves replace their whole section in SecurityService, so a partial edit would have cleared the fields it left...
Kamo_app is a NOLOGIN group role; services log in as kamo_app_202610
The YugabyteDB application password was exposed (com.zaxxer.hikari DEBUG in ten services' logs, and securityservice's committed diagnose-output.txt), so it was ...
Starting a clinical note no longer fails on updated_at (SITP TP23 live smoke)
ClinicalBaseEntity.updated_at is NOT NULL and defaulted by the database on INSERT only (insertable = false), so a note just inserted holds null in memory and th...
The command audit and the activity say when god acted, and under which break-glass window (R7)
Owner 2026-10-18 (IoT master section 10 R7): god, the platform owner, has total control of IoT devices, and every god action outside the platform org is audited...
Each break-glass window has its own id, so other services can audit under it (IoT R7)
A god-mode window now carries godModeSessionId (a random UUID) in ***: minted when it opens, cleared when it closes, and added to a window that was opened befor...
Mortgage loan files for SIs: pipeline, the application, readiness, conditions, documents, disclosures, pricing and locks, AUS, vendor orders, consent and the edits (SITP TP21)
43 mlos_* tools (MlosPack) through SecurityService's loan-officer door **************** SITP TP21 securityservice@27e06020) as the SI member, never the MLOS ser...
Booking an appointment no longer fails on an untyped null in the conflict check (SITP TP23 live smoke)
findConflicts' (:excludeId IS NULL OR a.uid <> :excludeId) with a null UUID is an untyped parameter on Postgres/Yugabyte ('could not determine data type of para...
Patient Records for SIs: the schedule, the front desk, chart and FHIR reads, note drafts and the revenue cycle, with payment posting (SITP TP23)
18 ehr_* tools (EhrPack) over SecurityService's EHR controllers as the SI member; each names the right SecurityService checks there, and anything inside one cha...
Probe only www.kamocrm.com; the platform's surfaces are on kamouniverse.com
kamocrm.com is a marketing site only (owner 2026-10-18). The blackbox prober is now deployed, and apply.kamocrm.com was already failing its probe; the kamocrm.c...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.