The manager line reads the org graph — cycle checks on a fresh graph, the directory on the cached one, and a member's own manager needs MANAGE_MEMBER_SECURITY to change (KamoCollab CP02 T12)
- MemberSecurityController: rejectManager keeps the self, org and record-active refusals and tests the loop with **************** the ten-level bound goes. ...
Reports read the org graph — a TEAM scope and a TEAM share reach the whole subtree, supervised AIs included (KamoCollab CP02 T11)
ReportScopeResolver.reportsTo is reports(member, true) of the cached graph: transitive and unbounded (the old walk stopped after ten levels), following the repo...
Teams at member creation — teamIds on create-team-member, checked before anything is written, joined inside the creation transaction before the first applied rights, announced after the commit (KamoCollab CP01 T14A)
POST **************** (and the /create and /bulk-create paths that share MemberCreationService.create) take an optional teamIds for a person or an AI (master R1...
SecurityService's chat policy reads member facts from the org graph, a graph loaded per snapshot (KamoCollab CP02 T10)
ChatPolicyBeanConfig builds ChatPolicySnapshotLoader with the graph constructor and orgGraphCache::fresh (ruling CP02-T17-3), as MediaService does, so the roste...
Every SecurityService graph write announces the change, the team seam listens, and a ratchet keeps it so (KamoCollab CP02 T8)
Each write path of CP02 spec §3.5 (W1-W15) calls **************** cause) with §5.4.2's causes: member security (roles, department, job title, manager, level, ow...
Teams on the member card and in the directory search — [{id, title}] by title, one team read per page (KamoCollab CP01 T16)
GET /api/security/members/{id}/card names a team member's teams ([] in no team; left out when the read fails, as on the profile). GET **************** gives eac...
Teams in the effective-rights views — the diagnostics cascade's teams level, and Team: sources on the applied rights (KamoCollab CP01 T15)
The diagnostics cascade (GET **************** lists a team member's teams between the job title and the member, {teamId, title, roles, rights}, in the waterfall...
A member's teams from the profile — GET|PUT **************** and teams on the profile and the security view (KamoCollab CP01 T14)
PUT **************** — a team's charter-only save through TeamWriter, announced after the commit (KamoCollab CP01 T13)
The team charter endpoint of spec §5.6/§5.7 on LayerCharterController, beside the role, department and job-title ones: CONFIGURE_SYSTEM or god; the path id, unk...
The TEAM charter layer — a member's teams after the job title, the TEAM subject, teamIds, and team hide markers (KamoCollab CP01 T12)
A member's teams become TEAM layers between the job title and the member, all at one rank and ordered by lower-case title then id; the teams' roles join the ROL...
The team sub-resources (members, rights, roles) and the recalculation endpoint (KamoCollab CP01 T11)
GET|PUT **************** /rights and /roles, and POST **************** (spec §5.7). Reads are open to any session of the org; writes need CONFIGURE_SYSTEM or an...
TeamController — list, create, read, update and delete (KamoCollab CP01 T10)
GET|POST /api/security/teams and GET|PUT|DELETE /api/security/teams/{id} (spec §5.7). Every handler resolves the caller first (401 without an org); reads are op...
The team domain — wire, validation, writer, service and the org-graph seam (KamoCollab CP01 T9)
TeamWire reads a team body tri-state (absent / null / value); TeamValidator checks titles, descriptions, timeouts, roles, rights (normalized as a level), staff-...
SecurityService's org graph beans, the after-commit change publisher, its listener and the two internal routes (KamoCollab CP02 T7)
OrgGraphBeanConfig declares the loader (a read-only TransactionTemplate of its own, Clock.systemUTC()) and the 60 s OrgGraphCache. OrgGraphChangePublisher colle...
Right-table housekeeping covers org_team_rights (KamoCollab CP01 T8)
RoleRightsSyncService names org_team_rights in all three of its lists, so on every boot a frozen CHECK on it is dropped, a row naming a removed right is deleted...
The hand-applied DDL for department heads and the org-graph load indexes, and its contract test (KamoCollab CP02 T1)
The hand-applied DDL for teams, and its contract test (KamoCollab CP01 T2)
**************** is spec §5.1's block verbatim: org_teams, org_team_members, org_team_roles, org_team_rights (type INT4, unique (team_id, type), master CP-D3) a...
Impersonation and Enter-As write access-log rows (KamoCollab CP00 T9)
Both impersonation doors write IMPERSONATION_STARTED (HIGH) in the target's org with logEventSync after every refusal check and before the session is minted; a ...
Cap the org's two phonetic name spellings on the settings PUT (SP94 T4)
titlePhonetic and titleShortPhonetic ride PUT /api/security/org/{id} under the same rights as title/titleShort (ownership or CONFIGURE_SYSTEM, never god-mode on...
A rename reaches the member's mailboxes (SP95 T36)
After a committed change of a person's "First Last", SecurityService posts {previous, current} to EmailService's **************** once per membership of the use...
A charter save reaches the AI runtime at once, and the charter profile names the company (SP95 T6)
**************** now carries a cause. The rights path sends RIGHTS; a committed charter save sends CHARTER for each affected AI member, with the member's curren...
SP94 DDL for the org's two phonetic name columns, pinned by a contract test
orgs.title_phonetic and orgs.title_short_phonetic, both nullable VARCHAR(255) with no default and no CHECK, the same shape as users.name_phonetic. Hand-applied ...
A colleague's call card for AI calls, and consent to AI calls on one's own profile (SP95 T5)
- GET **************** (X-Internal-Auth): a team member's name, kind, whether they are still here, their effective zone (work site, member, org, UTC), the E...
SP96 hire options to leave out the phone extension and the workstation
An AI hire's create body takes aiPhoneExtension and aiWorkstation (JSON booleans, true when absent). A step left out is created SKIPPED with NOT_REQUESTED_AT_HI...
SP96 sex on the member profile and at creation, gated as personal data
GET /api/security/members/{id} names sex (FEMALE, MALE or null) only to a caller who may read it (MemberSexAccess, spec D3); the key is absent for anyone else. ...
SP96 DDL for members.sex, pinned by a contract test
A member's sex is a nullable VARCHAR(16) (FEMALE | MALE, NULL = not specified), hand-applied in SP96 Task 3. The contract test keeps the file re-runnable, with ...
Theme folders still showing the retired KamoCRM placeholder move to the KamoUniverse one
Every new org's theme folder is seeded from public/default/. Until today its full logo was the KamoCRM wordmark. The seed is now the KamoUniverse wordmark, buil...
New authenticator enrollments are labelled KamoUniverse
The otpauth issuer was the literal "KamoCRM". Only new enrollments change. An existing authenticator entry keeps its label and keeps working, because the code c...
Kamouniverse.com is the primary apex, and a domain is verified by where it resolves
"Changed the domain from kamocrm.com to kamouniverse.com on /setup/dns. It said it set it but could not verify anything, and after a refresh it still said kamoc...
A feed names the stream it lists (streamGuid)
The browser's feed reloads when /topic/media/feed/<orgId> says a note was written in its own stream. A lead with no notes yet has no post whose guid names that ...
Organizations are created in a KamoUniverse universe and bill from its catalog
KamoUniverse sells Business, Family, Community and Personal plan ladders from the platform org. SecurityService decides which ladder an organization is on, and ...
Kamouniverse.com is a platform apex, not a tenant domain
login.kamouniverse.com and register.kamouniverse.com become the platform's KamoUniverse sign-in and sign-up doors, backed by a root org_domains row on the platf...
Internal resolve for KamoAI and the charter source behind SP02's routes
I2 POST **************** answers S3's resolution for the org it is given, behind the KamoAI secret, with S3's draft reader and S3's org-checked department walk ...
Charter items on role, department and job-title CRUD; charter-only PUTs
Member charter read and edit; nobody edits their own
S4 reads a member's effective charter, S5 its own items with whether the caller may change them, and S6 replaces them (diffed by id). A write runs in MemberChar...
Catalogue and resolve endpoints for the charter editor
S1 GET /api/security/charter/catalog and S3 POST /api/security/charter/resolve (spec 4.8). A member draft refused by S6's edit rule answers with S6's bodies (re...
Write-time checks for hide markers and escalation targets
A refusal leaves a caller's transaction committable, so the member charter PUT still answers 400; a hide marker cannot target another hide marker; a malformed e...
Internal auth and charter access rules
CharterInternalAuth applies SP02's KamoaiInternalAuth rule to the same secret, so the per-handler guard and the prefix interceptor cannot disagree. CharterAcces...
VNC links, AI state reads and a supervisor-session pause for AI workstations
Hire-step owner URLs and sweep tuning in the SecurityService ConfigMap
Audit role and security changes; ARTIFICIAL template and AI floor in model endpoints
Member profile AI state, relabel locks, immediate rights recalculation and audit
Internal routes for credentials, the exchange, the roster, profiles, the charter and the sweep
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.