An SI reads its own and its managed members' work, and cancels its own queued sends (SITP TP20)
Owner decision 2 (2026-10-18). Eleven AI_ONLY tools, each calling the owning service as the SI itself (its own session; new KamoService.KAMOAI door), which scop...
Plans & Billing for SIs: plan, catalogue, accounts, seats, invoices, usage, provider status, seat assign and remove (SITP TP18)
Nine billing_* tools (BillingPack) through SecurityService's billing door (SITP TP02's BillingRelayController; TP18 added the licensee step and the usage reads)...
Timecards, leave, breaks and attendance, payroll reads and commission reads for SIs (SITP TP18)
25 tools, so an SI does in HR -> Attendance, Payroll and My Commissions what a person does, within its rights, through SecurityService's TimecardController, Pay...
A scheduled report reaches a colleague who signs in on another domain (SITP TP16 live smoke)
reports_schedule judged a colleague by the organization's mail domains alone, so in sp00verify the owner's own sign-in address was refused as an outsider. A rec...
Quotes, service work, orders, the commerce pipeline and catalog, subscriptions and reserved opportunities for SIs (SITP TP17)
86 tools over SecurityService as the SI member, each right checked there as well as here: - quotes_*: find, read (share links never carry their address), create...
Binders_create sends what CreateBinderRequest reads; scripts_create names a market by its leads_list_markets id (SITP TP14 live smoke)
DocsService refused every binders_create: CreateBinderRequest's primitive isTemplate binds as "template", so the body's isTemplate was an unknown field (400). A...
The tool lists gain exactly SITP TP16's 30 tools and reports_run's page
Snapshots regenerated (-Dtoolplane.parity.write / -Dtoolplane.golden.write) on top of TP14: the only changed entry is reports_run (page, and its description); e...
Report options, export, paging and schedules; rights explained; org structure; settings screens by their rights (SITP TP16)
30 new SI tools, each asking the right the screen's endpoint checks (rights enforced twice): - reports_options (a picker's live choices), reports_run pages thro...
Documents, KB writing and review, careers screening, checklists, sales scripts and binders for SIs (SITP TP14)
84 tools and docs_search filters, so an SI can do in Docs, the knowledge base, HR careers, checklists, sales scripts and binders what a person does, within its ...
Chat_send_file posts a text document DocsService typed octet-stream as text/plain (SITP TP13)
DocsService records Markdown, YAML, logs and other text without an ImageMimeType as application/octet-stream, which chat's attachment allow-list refuses. A docu...
StrictReadTest expects a withheld SI card to be passed on as the DM it learned from
Since c13c47b (ruling CP07-T43-1/-7) a withheld record no person owns or takes part in stands in the withheld store for its inherited sources the audience may n...
The tool lists gain exactly SITP TP12's 25 tools, calendarId and the IoT/RPM notification kinds
Snapshots regenerated (-Dtoolplane.parity.write / -Dtoolplane.golden.write): the only changed entries are calendar_create_event (calendarId) and notifications_l...
An SI records or withdraws a lead's call consent (SITP TP11)
leads_record_voice_consent and leads_withdraw_voice_consent over SecurityService's PUT/DELETE /leads/{id}/ai-voice-consent (authorized there like editing the le...
Meetings history and transcripts, calendar answers, presence, notification dismiss/snooze, webinars (SITP TP12)
25 new SI tools, each checked by the same rights at the gateway and at the owning service: - meetings_history, meetings_get, meetings_get_transcript (MEETING, p...
Lead callbacks take MANAGE_LEAD_CALLBACKS, as SecurityService now does (SITP TP10, after TP01)
Files_upload sends the type and digests ConversionService checks (SITP TP13)
ConversionService detects a file's type from its bytes and name and refuses a declared type that differs, then compares the client's Blake3 and SHA3-256 digests...
Files_upload files into My Docs by its ordinal (SITP TP13)
ConversionService refuses an upload whose metadata names no assocType (values()[assocType]), and its own no-metadata default (4) is MEET_RECORDING's ordinal. fi...
Leads, accounts and communications timelines for SIs (SITP TP10)
54 tools over SecurityService as the SI member, each right checked there as well as here: - leads: create, edit (masked values never written back), assign, bulk...
Shared mailboxes, folders, stars, Trash, labels, attachments in and out, group chats, drips, files_upload, contact groups (SITP TP13)
27 tools and two new arguments, so an SI can work its mail and chat as a person does: - mail: mail_list_folders, mail_flag, mail_delete (to Trash only; a messa...
The phone inbox, the do-not-contact list, contact call consent, text templates and MMS (SITP TP11)
22 new SI tools, each checked by the same rights at the gateway and at VOIPService/EmailService: - phone_list_voicemail, phone_voicemail_mark_read, phone_voicem...
Every SI gets the report tools by its rights; config_* gated by rights, not audience
SITP TP00, owner decisions 2026-10-18: - reports_list, reports_run and metrics_get drop CP14's WATCH charter switch: an SI is offered them by VIEW_REPORTS and...
Stop logging the database password at startup
com.zaxxer.hikari at DEBUG makes HikariConfig print its whole configuration on every start, including dataSourceProperties {password=...} and password......; Pr...
Classify the ten iot tools; the catalogue guards move 101 to 111 (SP11 P12)
The three iot writes are NOT_DISCLOSING and the seven reads NOT_CONTENT with the spec's reasons (pinned in ContentReadToolsCoverageTest too). RegistryCompletene...
IotCallerView and the pure view rules V1-V11 (SP11 §4.4)
A key a device lists twice is a manifest defect and is never used (fail closed).
IotManifestClient, a per-session ETag-validated manifest cache with single flight (SP11 §4.4)
Per-caller schemas and availability for the ten iot tools (SP11 §4.5)
IoT error map, value checks, class check, whitelisted results and the command watch (SP11 §4.7, §4.9)
Downstream approval headers, conditional GET with ETag, opt-in error fields (SP11 P11)
CallerSchema per caller after visibility; PHYSICAL after outside content always asks a person; the approval travels on the plan (SP11 P4-P7)
A static tool's schema and availability may depend on the caller (CallerSchema): viewed after visibility for tools/list (one 3 s budget shared by the list) and ...
ToolRisk.PHYSICAL, the iot_ prefix, two charter classes, the IOT door and ApprovalRef (SP11 P1-P3, P8-P10)
"list…", "show…", "give me…" and "pull up…" are orders too, and a run with no order says why in the log
Live check in sp00verify (2026-10-15): a peer's "Nell, list the open tasks assigned to you and tell me how many there are." verified as their request (author, a...
The No Insubordination Rule — an SI carries out a teammate's direct order on their rights
Owner 2026-10-15, refined the same day: "It should apply to any team member. But just because a team member (human or SI) has more rights, does not mean that au...
A team member's call to a number on the do-not-contact list reads as who asked not to be called, and since when
kamoai-service 8b7b8d5 added the organization's do-not-contact list for calls (K6 409 DO_NOT_CONTACT), and a team member's call now carries the day the number w...
An uncited wake stands for an outside call only when its words ask for a call
The run's own wake (RequestVerifier.inferFromRun) is the request for a call to a colleague, but someone outside the org is rung on a teammate's name, with no co...
Phone_call calls whoever a team member named, looked up by name, with no approval and no consent gate, and never anyone else
Owner 2026-10-15: "When a supervisor, or any team member for that matter, tells SI to call someone else on the team, they should call them. No questions asked, ...
Meetings_join is JOIN_MEETING, not PLACE_CALL, and an unnamed JOIN_MEETING does not ask
Owner 2026-10-14: Luna (crm) asked the owner to approve joining a meeting he had told her to join; meetings_join was classed PLACE_CALL, so the charter's "Placi...
Meetings_join is "Join a meeting", not a phone call, and a meeting's link is joined as the room it names
Owner, 2026-10-14: SIs asked to join a meeting answered that they could not "join by phone" because "there's no dial-in", and asked for a room with dial-in enab...
An SI acts on the request its run was woken by without having to cite it, and K3 hears the tool's rights so a colleague who may do it themselves can direct it
Owner 2026-10-14: Luna (crm) asked the owner to approve joining the meeting he had just told her to join. Evidence: run 47cc1908 (NEW_CHAT, woken by his message...
An AUDIT org's SI is shown the record-link kinds every SI saw before KamoCollab
CP97 Task 17's Luna compare found her tools/list changed by KamoCollab: CP05 Task 7 appended TASK, DOCUMENT, KB_ARTICLE, MEMBER, AI_RUN and SMS_THREAD to Record...
Stamp a communication-policy refusal of a tool with no intent COLLAB_DENY interaction:<ruleId>
An SI's chat_find_or_create_dm refused by the interaction policy answered COLLAB_DENIED INTERACTION_POLICY but left its audit row's policy_decision and policy_r...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.