- Shipped
- September 23, 2026 at 6:44 AM UTC
- Author
- Kamo
- Commit
- 429139a
Members - Create, create-team-member and bulk-create accept `intelligenceType`, `namePhonetic` (new accounts only, like the name), and for AI accounts `aiSupervisorMemberId` + `aiModel`. The supervisor must be an active, human team member of the org and never the account itself; when none is named the creator stands in if they qualify (AiSupervisorPolicy). Every refusal names its field before anything is written. - PUT /members/{id}: `namePhonetic` is a user-identity field (same authority as the legal name). `intelligenceType`, `aiSupervisorMemberId`, `aiModel` need MANAGE_MEMBERS or an open god window, and are refused on your own membership (CANNOT_RELABEL_SELF) so an AI cannot relabel itself human. Switching to HUMAN clears supervisor and model. - GET /members/{id}, /members/{id}/card, the by-department roster and the account list rows carry `intelligenceType` and `namePhonetic` (the profile also gets supervisor id/name and model). - org-config's job titles and departments carry description + requirements for the create form. Job titles and departments - POST/PUT/DELETE now require CONFIGURE_SYSTEM (or an open god window) — the settings pages that write them already did; the server accepted any signed-in member of the org. Reads unchanged. - Description and requirements flow through the shared services (see kamo-shared-library). Fix: PUT /member-security/{id} replaced roles, direct rights and the session timeout even when the request did not name them. The profile's Position card sends only department / job title / official title / manager, so every position edit wiped the member's custom roles, direct rights and timeout override. Each is now replaced only when its key is present; the security editor sends all three. DDL: **************** (applied by hand as the owner before this push; zero schema-mismatch errors in security/email/media over the following 15 minutes).