An owner's storage position, carried on a payload that already exists
The launchpad is getting a storage meter, and the obvious way to feed it is a request of its own on every page load. The numbers do not deserve one: "used" come...
Award SPREAD_THE_WORD from the Growth Hub
**************** counts a member's APPROVED Growth Hub submissions and settles their SPREAD_THE_WORD level against that count. It RECOUNTS rather than being to...
Award Join The Team to everybody, without a backfill
SecurityService owns the member, so it owns the achievement. It awards, reads, acknowledges and publishes; MediaService only relays. EVERY MEMBER GETS JOIN THE...
A callback can invite the lead it is with
Scheduling a callback told the lead nothing. The dialog said so outright — "The lead is not notified" — and the only way to get a customer the time in writing w...
Send To AI tells everybody on the thread, not just the reporter
The dispatch sends the same letter MediaService does, so its audience has to move the same way: every participant in the report's thread minus whoever acted, ea...
Only a god may administer a god, and no god is impersonable
MANAGE_USERS reached the break-glass identity. UserAdminController guarded only the System User, so a non-god holder could disable a god account and revoke its ...
Say which plan an organization is on, and who may change it
The console could tell that a trial was running and nothing else. entitlementSource is "TRIAL" or null, so free, expired-trial, paid and comped organizations we...
An administrator may grant a peer or a lesser, never a superior
MANAGE_PLATFORM_ADMINS is the right to administer the platform's access list, not a right to invent access. Without a ceiling it was silently every right at onc...
Sweep the dev machine for coder usage and publish what moved
Feeds the two meters the Linux Desktop menu now draws — how much of a member's A sweep rather than a push, because the numbers are born on the machine and stat...
Deliver ribbon wording, and generate favicons from a tab icon
Provisioning learns two things: what an organization wants its public corner ribbons to say, and which artwork its browser-tab icons should be cut from. **Ribb...
Record the advert for a candidate who signs in instead of registering
Registration already wrote recentlyAppliedForId when an account was CREATED. This is the other half of the same funnel: plenty of people who press Apply on the ...
Record the advert a candidate registered for, and welcome them when hired
Registration on the /team path now accepts appliedJobId — the uid kamo-register parked when the careers board sent the candidate to /team?jobId= — and writes it...
Publish an application deliberately, and give its page a chat key
`PUT **************** publishes or retires a product's public page and records which web chat its support widget speaks through. Enabling without one is refused...
Serve the public mortgage application, addressed by product
Three unauthenticated endpoints under **************** plus the CRUD behind the organization's own state licences. **The organization is named by the PATH, nev...
Expose what a seat change will cost before it is made
Raising a subscription's seat count now raises an invoice — a per-seat startup fee follows the person, so ten hires on a $99 plan is $990 and a large account ru...
Record which domains authorize us, so their mail can go out as them
Transactional mail currently picks its From address by asking who hosts an organization's MAILBOXES. That is the wrong question. Whether we may send as chinilaw...
Carry a terminal's activity state to the console
TerminalSummary gains `state`: busy, or waiting for its member. Read off the session's transcript — neither of which is knowable from here, which is why it trav...
Carry the member's model and effort to a coder session
and deliberately not examined here. `coder_flags` on the agent is the one thing that decides what a session runs with — its own comment calls it "the security ...
Refuse a sign-in whose host names no organization
Such a host could sign in until now. It fell through to the workspace-choice path and succeeded on membership alone, which made it a door where none of the tena...
Progressive sign-in lockout, escalating to a permanent IP block
A wrong password now costs something, and the cost climbs. Counted since the subject's last successful sign-in: the first five failures are free, the sixth and ...
Serve each org the callback URL on its own domain
This endpoint is where a member finds the string they paste into Google's console, so it is the endpoint that was wrong: it returned only the redirect the org h...
User-account details belong to their owner, or to an operator
One rule, in one place, for the three endpoints that write a USER account: the profile's member update, the profile's personal address, and the platform Users t...
Let a god operator and the System User set somebody's address
The personal address was self-only. It is also the address an administrator has to be able to correct — a member who has lost the mailbox on their account canno...
Lock the shared sweeps, and run two pods
Sixteen of SecurityService's seventeen scheduled sweeps have a shared effect and now take a named distributed lease before running. There is no ShedLock anywher...
List a member's coder sessions, and open one in a terminal
Two endpoints beside the terminal ones, and they follow the same rule those do: the Linux account is resolved from the CALLER'S OWN SESSION and no account name ...
Bake the sign-in and sign-up logo overlays into config.json
kamo-login and kamo-register run on their own hosts with no OrgContext, so this file is the only route their branding takes - the same one KamoMeet already uses...
Change a personal address by proving it, and administer accounts
Two surfaces on the USER account, which until now had no server of its own — the account's fields were reachable only through MemberController, an endpoint scop...
Read a domain's live SPF record and say what it actually needs
GET /api/security/domains/{id}/spf, for the SPF step on /setup/dns. The setup page cannot give one set of SPF instructions to everybody, because the right inst...
Force KamoMobile Logout — revoke a member's mobile devices
Force-logout deletes *** sessions, which ends a browser. It does NOT end a phone: KamoMobile holds a durable device token and mints a fresh *** from it the mome...
Org-side CRUD for an organization's own OAuth2 client
The org-scoped twin of PlatformOAuthClientController, behind **************** Same DTO shape, same encrypt-on-write, same never-return-a-secret rule, plus platf...
Serve an org's branding from the host it is browsed on
A white-label sign-in screen is reached at login.<customer domain> with no ?org= on the URL and nothing in sessionStorage, so the front end has no way to name t...
Send to AI now runs in a Remote Terminal the operator can watch
The dispatch prepares the hand-off on the dev machine — screenshots, video and the composed prompt written to disk — and answers with the terminal it will run i...
Seed the two careers rights onto HR's existing authoring group
MANAGE_JOB_POSTINGS and VIEW_JOB_LISTINGS are inserted as NOT_SPECIFIED like every new right, so without a seed the /hr/careers tab and the member Careers tab w...
List, rename and end a member's terminals
GET **************** DELETE and PATCH on /terminals/{id}. Every one of them resolves the Linux account from the CALLER'S OWN SESSION and passes no account name...
Serve the widened accept gate, add self-assignment, and close two contact-mask bypasses
**Endpoints for the new gate.** /leads/available-summary and /leads/available now report both reasons a member is blocked — leads owed a note since they were as...
Serve Remote Terminal — a real shell over a WebSocket
Bridges a browser to a PTY on the member's own dev machine. Binary frames are the terminal, text frames are control; on the far hop an HTTP 101 onto a length-pr...
Send the company alongside the contact wherever a record is labelled
A record that is both an organisation and a person is named "Harmony Home Loans (Nickolas McGarry)" — the company leads, the contact qualifies. That rule lives ...
A communications timeline over the whole /leads filter, not one lead
GET **************** takes the SAME query string GET the lead detail page draws — across every lead the filter bar matches. "What has been said to the leads I a...
Enter a tenant organization as one of its members, from /network
A second door beside the same-org god-mode one. Gated on the new IMPERSONATE platform right via @RequirePlatformRight, where the existing door is gated on the s...
A member address signs you into its own org, not every org
A member who signs in with the org mailbox flagged Primary on their member settings was being offered every workspace their user account belongs to. The address...
Enforce the platform's visibility, and let it be edited
GET/PUT /api/security/reports/catalog, both gated on MANAGE_REPORTS on the platform spine. The list comes from the REGISTRY, not the override table: an operator...
Run the reports that are due, and send them
One internal endpoint, X-Internal-Auth gated and constant-time compared, that DaemonService ticks. The cron stays in the daemon because it is replicas: 1 with s...
The lists a share dialog picks from, and a share target that fits every id
GET **************** returns the organization's people, departments and roles as picker options, in one call and in one shape. Built on the reporting option pro...
Run, export and schedule the Report Studio's reports
The service half of the framework: the catalogue, the run, the pickers, four exporters, saved views and schedules. Authorization is explicit on every path, bec...
Honour a market's contact rule wherever a quote names somebody
The staff detail, the staff preview and the customer's own page now resolve the contact through one method, so they cannot disagree about who is printed on the ...
Page and search the org directory, and stop two row builders drifting
The networks endpoints answer with the whole set in one body. That is fine for a member of a dozen orgs and impossible for an operator on an estate meant to rea...
Put the report title in the message, and let it be corrected
A dispatch composed the operator's instruction and the bug description with the separator between them. The title was never in it, so the session opening the me...
Bulk-create members and team members, one transaction per record
The two bulk-add screens need to create a spreadsheet of people in one submission and report on each of them individually. That could not be built on the existi...
Store the org's deposit account, and print it on quotes
`/api/security/receivables` is where Settings → Account → Receivables reads and writes. Two rights, not one: VIEW_RECEIVABLES reads the tab, MANAGE_RECEIVABLES ...
Carry the team member's department in the session
The browser tab is being retitled "{Org} - {role} Portal", and a team member's role is their department — the specific thing they identify with day to day ("Sal...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.