Approving a card order grants paid access too
AUTO_BILL orders waited for a Stripe checkout that subscription invoicing no longer uses; the ledger charges the saved card on each billing day instead.
Card auto-charge bookkeeping on subscription invoices
AUTO_BILL invoices are charged on their billing day once approved and retried every three days, up to four attempts. Each attempt is numbered before it is made ...
Subscription events store JSON states; billing steps run one row per transaction
**************** are jsonb, and every caller wrote a bare status like ACTIVE - an invalid JSON insert that rolled back whatever it was auditing (order activatio...
License-based add-on pricing and a real subscription invoice lifecycle
One rule for add-on quantity (AddOnLicenses): every add-on bills the licenses PURCHASED, like seats - per-user add-ons default to the seat count, storage to the...
Name the organization that owns a subscription catalog row
The catalog update/delete methods take a uid alone, so a caller holding the catalog right in any organization could edit another organization's plans, prices, a...
Standing permissions from an approval (Approve and always allow)
A member's own APPROVAL item may now name one tool (tool_name) and record the approval it came from, who granted it and when (item_origin APPROVAL). The resolve...
Index member_notifications by (source_type, source_id) for withdrawal across members (IoT close-out F15)
The withdraw-by-source read (findBySourceTypeAndSourceId) and the IoT alarm's withdraw-by-prefix (StartingWith -> LIKE 'x%') had only the member-led index, so b...
AiAutonomyModeTest pins CP07's RELEASE_PROPOSAL draft kind, and no @Immutable entity may carry a database-generated value
- **************** was red on main since KamoCollab CP07 Task 5 (8bd0f67c) appended **************** (spec D25, a disclosure_request's approval) without updat...
A dat's object key also asks the inbound MMS parts that hold it (SITP MMS)
VOIPService now keeps the pictures and files people text in (VOIP_MESSAGE_ATTACHMENT) through storeContentAddressed, with no Img row. storageExtension found a d...
GodPassesRightChecks — god eligibility alone counts only in the platform org (IoT R7 round 3)
Owner rule (2026-10-18): outside the platform organization god acts only through break-glass. **************** an open window always passes a tenant-right check...
Index loan_files.loan_transaction_id on LoanFile
The deal -> loans lookup **************** deal status, pipeline summary, and the retireIfEmpty check after an application is deleted) was a sequential scan. The...
GodWindows finds a member's open break-glass window among their sessions (IoT R7)
Pure (no stereotype, no Redis client): the caller reads ***UIDX<userId> and hands the sessions in. A window counts only in the member's own session (not imperso...
A god-mode window is open only until its stamped end (SessionPlatformFacts)
godModeActive() now also needs godModeExpiresAt (epoch millis, number or string) to be after now. SecurityService masks an elapsed window only for its own gates...
Clinical audit rows keep purpose/basis/patient; updated_at stamped on every save (SITP TP23FU)
PhiAccessRecorder stamped occurredAt by rebuilding each event from a field list written before the clinical columns existed, and no caller sets occurredAt, so e...
Deleting a mortgage application no longer 500s, and a received one is kept (SITP TP21FU)
DELETE **************** failed for every application: AppMortgageService.delete removed the borrowers through the JPA cascade while borrower_declarations / borr...
The command audit and the activity say when god acted, and under which break-glass window (R7)
Owner 2026-10-18 (IoT master section 10 R7): god, the platform owner, has total control of IoT devices, and every god action outside the platform org is audited...
The kamo-iot host label is devices, not iot
DomainAliasType.IOT keeps its internal name but now carries the customer-facing label "devices" (owner 2026-10-18: "iot" is a technical term; URLs say devices)....
PREPARE_COMMISSION_PAYOUTS (570), compose a draft payout batch without sending it (SITP TP18)
MANAGE_ORG_FINANCES composes and sends a commission payout batch, and an SI can never hold it (AiRightsFloor), so a finance SI could prepare nothing for a perso...
SITP TP02 rights — MANAGE_ANALYTICS (440), VIEW_ORG_BILLING (441), MANAGE_ORG_BILLING (442)
MANAGE_ANALYTICS: Analytics signed every caller in as one shared analytics administrator, so VIEW_ANALYTICS let anyone create, edit and delete every tracked web...
SITP TP01 rights for formerly session-only endpoints (410-418)
Nine rights in the TP01 block for endpoints that answered any signed-in member of the organization: - MANAGE_PRODUCTS, MANAGE_INVENTORY, MANAGE_RETAIL_CUSTOMER...
An SI never signs, prescribes, orders, immunizes, breaks the glass, merges charts or bulk-exports patients
SITP TP00, owner decision 2026-10-18: in Patient Records an SI drafts only (and may post payments behind approval). Nine EHR rights join AiRightsFloor.NEVER_GRA...
IotConnectionCheck is append-only without @Immutable (every link failed with a 500)
Hibernate 6.5 reads the database-generated checked_at back after the INSERT and then sets a lock mode on the entry; an immutable entry refuses it **************...
KAMO_SIMULATOR, the 22nd provider type (test-only; SP14)
Appended last; the client catalogue JSON keeps the 21 program types (@kamo/iot-core is unchanged).
IoT Sharing Access report, registry guards, fifteen seed reports
IotReportSupport (SI clamp, vendor retention, lookups) and IotAlarmReportMapping
ReportDefinition.exportRight — a per-report export right on top of EXPORT_REPORTS
SP13 service-job link entity, repository and six activity kinds
On-device vocabulary and iot_on_device_links entity (SP10)
The link entity keeps only the SHA-256 of the phone's link secret, and that hash is @JsonIgnore so it never reaches a response or an event.
OPERATE_DEVICE and OPERATE_SECURITY_DEVICE charter classes (SP11-D2)
IoT SP11 (master §6.14, §10 SP11-D2): physical actions through the Tool Plane's iot_ pack are charter-approved per class. AiActionClass appends OPERATE_DEVICE (...
Keep hook-token and share-token hashes out of JSON; the OAuth secret prefix is a label
**************** was red on main: **************** and previousHookTokenHash, **************** and previousHookTokenHash, and IotShare.tokenHash had no @JsonIgn...
Alexa link, virtual sensor and endpoint entities; IotCommand.voiceLinkId; ALEXA_* activity kinds (IoT SP09)
OAuth server entities, repositories, read-only token verifier and access-log event types (IoT SP09)
Token generation, PKCE S256 and scope parsing for the Kamo OAuth server (IoT SP09)
**************** and **************** (SP04 Tasks 21-22)
The column exists in production (SP04 DDL, default TRUE).
Iot.share_link and iot.share_code canonical templates, IotShareEmail
SP06 alarm logic — ISA-18.2 state machine, escalation, suppression, schedule, flood
SP06 rule logic — loop maths, fingerprints, fire keys, templating, reasons
SP06 rule logic — solar, schedules, site days, conditions, triggers
SP06 vocabulary, entities and read-only repositories
25 enums (stored by name), IotServiceJobOrigin (SP13 ships on it), 17 entities matching the SP06 DDL and their read-only repositories; IotActivityKind += AUTOMA...
The do-not-block list, the allowlist beside the do-not-contact list
Owner 2026-10-15: "remove it and add it to a do-not-block list" (the company's own main line had been put on the do-not-contact list by a test call). For an org...
The organization's do-not-contact list, per channel
One company-wide list per organization (owner 2026-10-15), scoped per channel: a CALL entry blocks calls only, SMS texts only, EMAIL email only. Package com.kam...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.