Draw the org's logo from its pre-sized variant, the original only if it is missing
A signing page drew the org's uploaded logo — crm's logo-full.svg is 2.95 MB — at 28-44px tall. The theme service now cuts img/sized/<stem>/h<rung>.webp beside ...
Logos ask for a pre-sized variant, and fall back to the original
An organization's logo is drawn 30-180px tall here but downloaded whole: crm's logo-full.png is 2.2 MB, its .svg stand-in 2.95 MB. ThemeLogo now asks for img/si...
Reserve 768M for the OS so --memory 3G fits in the 4Gi pod
Seastar keeps max(1.5 GiB, 7%) of the cgroup limit plus ~94 MiB per shard back for the OS and refuses to start when --memory does not fit in what is left. With ...
/image/logo-variants cuts a logo into pre-sized PNG + WebP rungs
Org logos are uploaded once and drawn everywhere at 24-120px, and every surface downloaded the original: crm's logo-full.png is 2.2 MB (its .svg stand-in 2.95 M...
SP00-T49 fix round 1 — the kamo node password goes on the owner checklist
Task 52 Step 9 gains item 4: rotate the kamo node password, after Task 49 Step 3 and followed by a memory update. The item lists every copy that a value-keyed s...
SP00-T22 ship ruling — RingCentral's verificationToken cap is 32 characters; follow-up c43ec04
SP00-T46 rulings — Scylla's init container makes the pod Guaranteed; libretranslate rolls one pod at a time
SP00-T49 rulings — the worldgen agent's unit is installed before its env file; NATS violation checks grep what the server logs
Task 49 Step 3 now deploys universe-earthdata's unit on k3m1 (the live one points at 127.0.0.1 and reads no env file), logs in as kamo@k3m1, and carries its own...
Scylla to 2 CPU / 4Gi, libretranslate request to 10Gi (32 GiB, 6 CPU released)
Scylla: --smp 2 --memory 3G in a Guaranteed 2 CPU / 4Gi pod (14-day peak 0.66 GiB, 0.05 CPU; the database is 2.93 MB). The init container now has requests == li...
Mint a RingCentral webhook verificationToken RingCentral accepts
RingCentral refuses a deliveryMode.verificationToken longer than 32 characters with CMN-101 "Parameter **************** value is invalid" (measured against the ...
Own NATS login
kamo-internal's three NATS connections (org changes, worldgen, world live) present svc_kamo_internal from the nats-user-kamo-internal Secret instead of the shar...
SP00-T44 fix round 1 — the OTA step reads memory only through a value-keyed redactor, and never under set -x
Phase A printed the node password twice, reading two memories the step cites. Step 3 now sources a preamble that holds commands only, reads memory through memre...
SP00-T21 ship ruling — the KB backlog catch-up is blocked by the embedding model's sizing; parked
A socket's one-time key is not a sign-in hand-off
Since 46191c47 every browser WebSocket authenticates with ?otk=<key>. The EmailService sockets connect through the same-origin /email-ws rewrite, so they pass t...
SP00-T31 ruling — the eleven MLOS repos roll back without restoring the unbuildable 1.6.0 pin
New mail shows on /messages as soon as the badge counts it
The badge and the list hear the same socket, and EmailService relays every arrival (verified on NATS: email.changed ARRIVED from both pods, then the unread snap...
SP00-T23 plan text — the event gate sits behind EventRequest.invitesByEmail(); tests beside the brief's
SP00-T45 ruling — the rollback deletes the Qdrant NetworkPolicy; the network check needs curl's 000
SP00-T23 ruling — a calendar save needs a seat only when it invites by email; SP07/SP08 keep the seat gate
SP00 plan — log checks read every line (kubectl logs -l prints only the last 10)
Task 29's daemon and compute checks and Task 45's RAG check now pass --tail=-1. With a label selector, kubectl logs defaults to the last 10 lines, so the daemon...
Sending mail needs a seat, for people and AI members alike
A member without a licensed seat is refused with the shared 403 SEAT_REQUIRED body before anything is sent: POST /api/email/send, the shared-mailbox send, and t...
SP00-T42 ruling — the help-center import Usage block reads the Redis login
The Redis login
The pod logs in to Redis as the platform ACL user (Secret redis-auth: REDIS_USERNAME, REDIS_PASSWORD), which app/lib/redis.ts already reads, so sign-in keeps wo...
Own NATS login, Redis login, KamoAI secret
NatsConfig's comment now names where the login comes from: svc_kb, from the nats-user-kb Secret, which overrides the shared kamo_svc keys.
SP00-T21 ruling — gRPC at compile scope, wiring tests beside the brief's, replay trade-off recorded
Present Qdrant's API key, and recreate the consumers so KB and notes are embedded again
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.