Declare every right a tool's service enforces; plain words for unseen records and numbers
Approval follow-up 2026-10-21 (controller review of the approvals UI). Rights (item 4): an audit of every tool's declared rights against the rights its downstr...
Corner ribbons on every edge, on tabs, and on the top bar's open pages
Following the left-edge round, the other three edges get the same treatment, on a fixed mapping: a top rule becomes a top-left ribbon, a right rule a bottom-rig...
A charter item's tool is behavior; its grant provenance is not
CharterItem gained toolName and the standing-permission provenance (53e6e2cd6), so the compile-time check that every field is listed failed the build. toolName ...
S-I1 accepts REPLACED, so IoTService revokes a superseded Alexa link's grant
Owner 2026-10-21. KamoOAuthRevokeReason.REPLACED already exists (STRING-persisted, no CHECK on revoked_reason), so no shared-lib or DDL change; the internal rev...
Corner ribbons replace every left-edge accent rail
The System Bugs page went first. This change does the rest of kamo-internal: about 120 files where an item was marked by a coloured rule down its left edge — a ...
Approve and always allow, the named why, the SI's own picture, the org's own colours
Always allow: from the decision bar, the approver picks just this action or the whole kind (in plain words), reads exactly what changes in the SI's job descript...
Honour standing permissions; offer Approve and always allow on the card
CharterPolicy reads resolved.toolApprovals and each rule's standing flag. A member's rule about one tool stands for its class's rule for that tool; a standing p...
Approve and always allow, from an SI's approval
GET **************** POST **************** {approvalId, scope TOOL|CLASS, grantRights?} DELETE **************** (Ask me again) The approval names the tool and...
Standing permissions from an approval (Approve and always allow)
A member's own APPROVAL item may now name one tool (tool_name) and record the approval it came from, who granted it and when (item_origin APPROVAL). The resolve...
Corner ribbons replace the left-edge accent rails on System Bugs
CornerRibbon is the indicator form of kamo-login's sign-in pane ribbon: a thin shaded diagonal band across an item's top-left corner, in any colour, at three si...
Master §10 SP14 execution rows E1-E10; IoT Devices published 2026-10-21 [skip ci]
Svc_iot may subscribe to iot.live.device.> — the IoT production canary watches its own live frame (SP14)
Announce IoT Devices — the /features category, the capabilities group and /device-compatibility go live (SP14 T+0)
IoT Devices was published on 2026-10-21 03:47 UTC (catalog override COMPLETED + available, owner-approved). The compatibility page reads the live feed: 8 servic...
Plain-language approval cards and a premium approvals inbox
Owner order 2026-10-20: the Interaction Center's Approvals tab and the approval popups showed members GUIDs and JSON. Every approval now reads as a card a non-t...
The Devices (IoT) menu counts open alarms and pulses until they are acknowledged
Completes 0ee2be7b3 (IoT close-out F12).
The Devices (IoT) nav option badges open alarms, pulses while one waits, and its menu leads to Alarms
Owner, 2026-10-20 (IoT close-out F12): IoT alerts stay e-mail only; alarms reach people in the app. - Devices (IoT) is a menu (toolKey iot) of its pages, the ta...
An approval card sends every parameter its phrase names
next-intl refuses an ICU select or plural with no value, so a phrase about an argument the SI left out (a contact with no formatted name, a new document categor...
An approval about a record the reader may not see never leaves a dangling 'for'
Phrases that named a patient, a customer, a purchaser, an envelope or a document after a preposition now say 'for a patient' (or nothing) when the reader may no...
Desktop alerts go by e-mail only; the MediaService chat leg is gone
Owner, 2026-10-20 (IoT close-out F12): no chat sender. A chat thread needs a sender member besides the recipient and the platform organization has none by desig...
Approval cards say SI in every label, write phone numbers and choices as people do, and keep a note beside an action a field
A humanised field name said 'Ai companion…' (now SI, with a guard that no phrase, label, noun or risk sentence says AI); a US number reads (512) 555-0142 in the...
KamoCameras is included in Business and up, and on every universe's Premium rung and above
Owner, 2026-10-20 (IoT close-out F11): Business, Enterprise and their equivalents in the other universes. - PlatformTierMatrixMigration: Business gains KAMO_CAM...
A carrier-only organization can hold text threads again (SITP CARRIERSMS)
VOIP_CONVERSATIONS.INSTANCE_ID was NOT NULL in production, although the entity and **************** both say an org that texts through a carrier and runs no pho...
Stop forcing a phone server onto every text conversation (SITP CARRIERSMS)
MultiInstancePhoneMigration runs on every KamoInitializer start. Its conversation step deleted each voip_conversations row without an instance (and that thread'...
Plain-language approval cards, worded as the reader may see them
Owner order 2026-10-20: approvals showed members GUIDs and JSON. POST **************** (internal auth) words each approval for a non-technical person: one sente...
IoT articles follow the fixed product — Sign in again keeps settings, SolarEdge app asks its sites, Tuya asks its region
solaredge, geotab, shelly, samsara, tuya, iot-relink-a-connection, iot-open-shared-access (Devices shared with you in the menu). Help re-import needed for these...
Vendor sign-ins ask their settings, Sign in again keeps them, and the SP14 audit's web findings
- Link wizard: a vendor sign-in (SolarEdge app site IDs, Tuya region) asks the provider's declared settings before the vendor opens; a refusal to start reads ...
An MMS part is stored in one transaction of its own (SITP MMS)
Live check in sp00verify: the picture was fetched and its object written, then the dat's final 'published' save failed (JpaSystemException) because the backgrou...
The texting window shows the pictures, recordings and files people text in (SITP MMS)
Each message's inbound parts (VOIPService now keeps them) draw inside its bubble: pictures in place (tap to open), voice notes and video with players, PDFs and ...
The web Alexa section, its virtual sensors, and Alexa links as the who of a grant
- Settings -> Devices (IoT) -> Connections gains a Voice section (only while Alexa is usable by the organization): the Alexa links, how to link one, and a lin...
Brand and state colours read at AA in both themes; grid header strips are not scroll regions; AgentSelector chips are not inside a button
- StateChip/Kicker (patients, knowledge base, attendance, chat policies): the ink is the tone's own hue with its OKLCH lightness capped (light) or floored (da...
The MMS part claim names its states as parameters, so Hibernate 6.2 can read it at boot (SITP MMS)
8eda899's deploy never rolled: Spring Data validates every @Query at startup and Hibernate 6.2 cannot interpret a nested enum's FQN literal **************** so ...
Restrict from Disabled says what it does; site modes article states the previous-mode return (IoT close-out F10, F9e)
- The platform connector dialog's Restrict confirmation, on a DISABLED connector (now offered for every provider with platform setup after a fresh test, iot-s...
Index member_notifications by (source_type, source_id) for withdrawal across members (IoT close-out F15)
The withdraw-by-source read (findBySourceTypeAndSourceId) and the IoT alarm's withdraw-by-prefix (StartingWith -> LIKE 'x%') had only the member-led index, so b...
KamoCameras in the entitlement catalog, on the platform's own plan only (totality test green)
KamoCameras (ServiceType 39, shipped 2026-10-13, TESTING) shipped without an AppEntitlementCatalogMigration entry, so **************** two totality checks have ...
AiAutonomyModeTest pins CP07's RELEASE_PROPOSAL draft kind, and no @Immutable entity may carry a database-generated value
- **************** was red on main since KamoCollab CP07 Task 5 (8bd0f67c) appended **************** (spec D25, a disclosure_request's approval) without updat...
Sms_read_attachment, and sms_read_thread names what was texted in (SITP MMS)
TP11 deferred sms_read_attachment because VOIPService kept no inbound MMS media; it does now (voipservice@8eda899). So: - sms_read_thread lists each inbound pa...
The alert chat leg resolves its people per organization; an IoT alarm update is quiet on iOS
F12 (IoT close-out, SP14 routing): AlertChatService defaulted to organization 1 and the aliases "sage" / "kamo-monitor", which name nobody in production, so eve...
Keep the pictures and files people text in, for every provider (SITP MMS)
VOIPService stored only the words of an inbound MMS, so nobody (person or SI) could see what was texted in. Now every inbound rail reads its media and VOIPServi...
A dat's object key also asks the inbound MMS parts that hold it (SITP MMS)
VOIPService now keeps the pictures and files people text in (VOIP_MESSAGE_ATTACHMENT) through storeContentAddressed, with no Img row. storageExtension found a d...
Master section 10 R7 — the owner's round-3 answers and what shipped [skip ci]
An SI on a teammate's order can find and operate just the function the order needs; on god's order also unverified ones (IoT R7 round 3)
- IotPack.planSend: when the SI's own view lacks the device or the function (or may not OPERATE it) and the caller is on an order-scoped session, IoTService's...
An order's tool call runs on a per-call scoped order session that lends only what the tool needs (No Insubordination Rule, IoT R7 round 3)
OrderDelegation.resolve takes a CallScope: the tools/list keeps the session lending the requester's whole standing (kamo:tool:order:<runId>), so the SI knows wh...
God eligibility alone passes CONFIGURE_SYSTEM only in the platform org; elsewhere only an open window (IoT R7 round 3)
**************** let GD (eligibility, no window) pass every tenant right in every org, so the System User held CONFIGURE_SYSTEM (organization sounds) in every t...
An order lends only the rights the called tool needs (No Insubordination Rule, IoT R7 round 3)
POST **************** takes an optional neededRights (RoleRightType names; an unknown one is a right nobody holds). With it, OrderDelegationService.lend borrows...
God eligibility alone passes a right only in the platform org; elsewhere only an open window (IoT R7 round 3)
AuthHelper.hasRight / requireRight let GD (god ELIGIBILITY, no window at all) pass EVERY tenant right in every org (24 controllers: reports, social media, acces...
GodPassesRightChecks — god eligibility alone counts only in the platform org (IoT R7 round 3)
Owner rule (2026-10-18): outside the platform organization god acts only through break-glass. **************** an open window always passes a tenant-right check...
Master section 10 R7 — the owner's answers of 2026-10-18 and what shipped [skip ci]
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.