Live Change Log

kamo13.mp4 uploaded to MinIO at public/kamo13.mp4 (30 MB, sha256 174aaec6…, verified byte-identical to the local source after transfer — this link has a history...

The tab was two AG Grids under a tab bar: accurate and mute. It now opens on the org's whole training obligation and lets an admin act on the gaps. - A masthea...

Five fixes, all of them things that looked present but did nothing. OFFER BANNER — HeroOfferBanner was dead code; nothing imported it. Restored, but driven by ...

The left column was a generic headline, a security platitude and a pile of ambient decoration (dot grid, floating orbs, a pulsing dash). Replace it with one sha...

The reel was a centred rounded rectangle with a drop shadow — an object placed on the design rather than part of it — and it was the ONLY thing in the hero: ff0...

The hero pointed a bare <video src> at a single 3.9 Mbps 720p24 MP4, so a phone on a weak connection downloaded exactly the same stream as a desktop on fibre, a...

MediaMTX serves live channels over HLS, WebRTC, RTSP and RTMP, and loops the marketing reel as an always-available channel via alwaysAvailableFile — no ffmpeg s...

NFSv4 over the NodePort, mounted soft with a systemd automount so an unreachable cluster returns an error instead of hanging every process that touches the fold...

- Add poster image for instant visual feedback during video load - Implement loading skeleton with pulsing animation - Start video muted (browser autoplay polic...

desktop-1 hosts /srv/kamoteam and exports it over NFSv4; every VM user gets ~/Desktop/KAMOTEAM as a symlink (via /etc/skel for new accounts and the agent for ex...

Swap the homepage hero copy, CTAs, and stats for a looping muted video while keeping the rotating background treatment.

Nothing was watching memory. MediaService was OOMKilled every few hours for most of a day and EmailService six times, and the way anyone found out was a chat wi...

Outbound tcp/22 is rejected for every uid except root and sage, keyed on socket owner so future accounts are covered without re-running anything. Reapplied at b...

Adds krita and maven **************** were already present), pins Chrome, VS Code, Kate, Spectacle and Krita to the taskbar for every user, and lets dev users i...

The icon now appears exactly when the connection behind it will work — the SSO endpoint enforces the same rule, so the two cannot disagree. Windows and Master s...

Keeps three states apart that one toggle would collapse: never provisioned (needs a password), provisioned but locked (needs only the switch), and failed (needs...

*** is forwarded explicitly — buildForwardHeaders sets X-OTK but not the session token, and the dev-machine endpoints resolve the caller from it. The action seg...

Linux is gated on an enabled provision rather than god, and served with the member's own credentials. The connection is omitted from the token entirely when the...

Username derives from the member ACCOUNT email, not the TeamMember work email — a work address can sit on another domain and would silently produce a different ...

health() swallows transport failures and answers false so the SSO preflight can return an actionable 503 rather than a 500.

Codec is deliberately reversible — RDP auto-login needs a real password — and uses GCM so a tampered or wrong-key row fails loudly rather than decrypting to noi...

status and enabled are deliberately separate: a provisioned-but-disabled account keeps its home directory, so re-enabling restores access rather than rebuilding...

Alert expressions verified against the live Prometheus. Uses kube-state-metrics rather than kubevirt_* — the KubeVirt metrics endpoint is not scraped here, so r...

Staged under /opt/kamo-desktop-agent so install-agent.sh has a distinct source and destination. Covers netplan-by-driver, cloud-init network disable, xrdp sessi...

Python 3 stdlib only. Every mutation runs subprocess with an argv list, never a shell string; passwords go to chpasswd on stdin so they stay out of /proc.

CockroachDB unique_rowid() ids are 19 digits, past Number.MAX_SAFE_INTEGER, so an id sent as a JSON number arrives in the browser with its low digits rounded aw...

The inline sign-in messages ("Login successful! Redirecting...", "Invalid username and/or password.") used MUI's default Alert, whose pastel fill plus matching ...

Two placements, both chosen for where the claim is already being made: Footer — 60px, beside "© 2001–<year> ... established 2025". Site-wide, ...

Renders "© 2001–<year> KamoCRM. KamoCRM Inc. established 2025. All rights reserved." The range start is hard-coded next to the dynamic end year rather than livi...

Zoom and Microsoft Teams for meetings, and the ten payroll vendors — ADP Workforce Now, BambooHR, Dayforce, Gusto, Paychex Flex, Paycor, Paylocity, Rippling, UK...

"Apps & Integrations" was one tile reading 31+. It is now two, each with a figure that can be re-derived rather than estimated: Apps 64 — Forgejo pro...

los.proxy-hmac.enabled has been falling through to its false default since this service deployed, so ProxyHmacFilter existed and never ran. X-Org-Id — the heade...

KamoLOS trusts X-Org-Id and X-Member-Id from this proxy. ProxyHmacFilter exists to prove those headers really came from here, but it is disabled in production: ...

KamoMeet is a Meet fork with no access to OrgContext, so it learns org branding from the theme config.json this service bakes. The org stores an overlay TOKEN; ...

Third overlay surface: the KamoMeet pre-meeting screen. Same shape as the other two — nullable, no backfill, no DEFAULT. The drift guard needed only its field ...

Third and last overlay surface, same vocabulary as its two siblings, plus its branch in the generic patch path. This one is different in where it ends up. The ...

Third and last surface, offered next to the other two — same thirteen options, its own setting, default No Overlay. Hidden unless the org can actually reach th...

VIEW_DASHBOARD (0), VIEW_REPORTS (1) and EXPORT_REPORTS (2) were deleted from RoleRightType today, along with the two pages they named. This removes what they l...

All three named pages that existed on disk and were backed by nothing: app/dashboard rendered sample posts straight out of i18n, app/reports imported framer-mot...

The create-network wizard drew each app as the first letter of its name, so the same app was a storefront on Settings -> Features and an "S" here. The icons alr...

Adds "Loading Screen Logo Overlay" directly under the home page one on **************** with the same thirteen options, applying to the logo on the screen shown...

Second surface for the logo overlay feature: the loading screen shown between page navigations, alongside the home page masthead. Both ALTERs live in the one r...

The same overlay vocabulary as homeLogoOverlay, applied instead to the logo on the loading screen shown between page navigations, plus its branch in the generic...

The Assigned Agent field is now the same control as Manager on a member's profile: a read-only field that opens the searchable member picker. A dropdown could o...

The lead assignment picker needs the directory to return only people who can actually work a lead, so /team-members/search takes a requiredRight. An unrecognise...

Two things the assignment picker needs. The directory queries take an allowed-id set so a caller can narrow the search to the people a thing may actually be gi...

One chip was carrying two different truths and misleading in opposite directions. Unbuilt means nothing checks the right and granting it does nothing. Supersede...

The solid colour an org can paint over the masthead logo on the kamo-internal home page, plus its branch in the generic patch path so the existing PUT /org/{id}...

Backs the Home Page Logo Overlay setting: the solid colour an org can paint over the masthead logo on the kamo-internal home page. Holds a token rather than a ...

Adds "Home Page Logo Overlay" to Branding on **************** directly above Background Watermark: No Overlay, White, Black, and every step of the org's own pri...