- Shipped
- August 15, 2026 at 7:07 AM UTC
- Author
- kamo
- Commit
- a6112b5
§12 concluded that KamoLOS had no deployment and that gating it was therefore free, and the LOS proxy repeated the claim in a comment. Both are wrong. The service runs as kamowslos-deployment, following the same kamows* convention as every other backend, and the check that concluded otherwise looked for kamolos-deployment. kamolos-service — the one that genuinely has no pods — is the borrower-facing app behind the myloan.* route, a different thing entirely. Same failure mode as the chat-channel grep and the sales-agent analyzer blind spot, for the third time: a tool answered a slightly different question than the one being asked and returned a confident wrong answer. What it changes. The org-scoping fix landed earlier today is load-bearing rather than precautionary — LoanController.get(uid) had been returning any loan by id to any caller on a service holding 15 real loans, for 78 days. ProxyHmacFilter is off in production: no LOS_PROXY_HMAC_ENABLED on the deployment and no LOS secret in the namespace, so X-Org-Id is unsigned. And the ~15 controllers still lacking org scoping are a live exposure, not a future one. Bounded, and worth being precise rather than alarming: kamowslos-service is ClusterIP with no IngressRoute, and the proxy builds its headers from scratch and takes X-Org-Id from the session, so a browser cannot inject it. The gap is exploitable from inside the cluster, not from the internet. Nobody was locked out by the PLOS gate — those rights are held by the same 14 administrator roles a seed would have targeted. That was luck rather than judgement, and the document says so. Enabling HMAC is an ordered two-repo rollout, not a flag: kamo-internal must start signing before KamoLOS starts validating, or every loan request breaks. Recorded rather than done, because it is live infrastructure with real loans on it.