Labels with the principal-private fallback, the source ledger with encrypted excerpts, withheld items and held decisions; mount the platform key (KamoCollab CP07 Task 16)

Shipped: October 11, 2026 at 11:33 AM UTC
Author: Kamo
Commit: a1ec8d3

LabelService resolves labels through CP05's DisclosureLabelClient over the six owners (60 s cache per org and ref; inherited refs to depth 3); a ref no owner labels, and every AI_RUN ref, is private to the run's principal. SourceLedger, WithheldStore and HeldDecisions hold kamo:tool:sources/withheld (24 h) and kamo:tool:held (8 days). ExcerptCipher encrypts excerpts (cut to 4,000 characters) with PlatformSecretCipher; Secret platform-enc-key is mounted and mapped to platform.enc-key. Nothing calls these yet.

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free Forever View Pricing