Index loan_files.loan_transaction_id, applied to production 2026-10-18 [skip ci]
Owner approved. The deal -> loans lookup in **************** (deal status, pipeline summary, retireIfEmpty) moves from a sequential scan to an index scan. Same ...
Index loan_files.loan_transaction_id on LoanFile
The deal -> loans lookup **************** deal status, pipeline summary, and the retireIfEmpty check after an application is deleted) was a sequential scan. The...
The activity says "as god, break-glass <window>", and god's own window may share (master section 10 R7)
Owner 2026-10-18: every action is visible to the tenant. actorText appends iot.actorStanding.asGod / asGodBreakGlass (dictionary e7519fa8) for god's rows and an...
Fixtures stamp the god-mode window's end; an elapsed window is not elevated (shared SessionPlatformFacts expiry)
**************** now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1), so the open-window fixtures of the 28 test classes whose gates read it (Sess...
A closed god-mode window is closed here too (shared SessionPlatformFacts reader)
Seventeen VOIPService gates (CallController, the VoIP admin controllers, the SMS inventory and bulk-text controllers, DoNotContactController, RecordingAccessSer...
The IoT live-topic check carries the subscriber's session, so god's break-glass window can be honoured (IoT R7)
A god-mode window is a property of the session, not the member, and the STOMP authz calls to iot-service named only the member, so god in another org could not ...
A closed god-mode window is closed here too (shared SessionPlatformFacts reader)
ViewerPlatformFacts (the ENTER AS SYSTEM USER verdict on support tickets) read GD && godModeActive itself. SecurityService masks an elapsed 30-minute break-glas...
A closed god-mode window is closed here too (shared SessionPlatformFacts reader)
**************** read GD && godModeActive itself. SecurityService masks an elapsed 30-minute break-glass window only for its own gates, so this service, reading...
An SI on god's order sees and can ask for god's devices (IoT R7, No Insubordination Rule)
IotViewRules: an SI's manifest whose caller block names god's standing (caller.god PLATFORM | BREAK_GLASS) and the requester (caller.godOnOrderOf) keeps SAFETY_...
Fixtures stamp the god-mode window's end; an elapsed window is not elevated (shared SessionPlatformFacts expiry)
**************** now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1). **************** god fixture carries the stamp, and a new case pins that an ...
GodModeVerifier judges the god-mode window at its own clock (shared SessionPlatformFacts expiry)
**************** now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1). windowOpen(session, memberId, now) asked the shared reader at the system clo...
AiCaller judges the god-mode window at its own clock (shared SessionPlatformFacts expiry)
**************** now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1). AiCaller.fromSession(session, now) asked the shared reader at the system clo...
Fixtures stamp the god-mode window's end; an elapsed window is not elevated (shared SessionPlatformFacts expiry)
LosRightsFilter reads the window through the shared SessionPlatformFacts, which now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1). The open-wind...
GodWindows finds a member's open break-glass window among their sessions (IoT R7)
Pure (no stereotype, no Redis client): the caller reads ***UIDX<userId> and hands the sessions in. A window counts only in the member's own session (not imperso...
A god-mode window is open only until its stamped end (SessionPlatformFacts)
godModeActive() now also needs godModeExpiresAt (epoch millis, number or string) to be after now. SecurityService masks an elapsed window only for its own gates...
The endpoint ratchet sees @RequireRight; the org-graph ratchet allows two read-only hits (SITP TPGUARD)
**************** flagged the TP02 billing and commerce-invoice relays. Not a hole: every commerce-invoice handler carries @RequireRight (TenantRightInterceptor ...
Deleting an application that must be kept shows why instead of doing nothing (SITP TP21FU)
SecurityService now answers 409 for a received mortgage application (a record of business, withdraw it instead). The delete handler had no catch, so the rejecti...
Master section 10 R7 — god has total control (owner 2026-10-18) [skip ci]
Staff can delete a never-received mortgage application; a received one answers 409 (SITP TP21FU)
DELETE **************** went through AppMortgageService.delete, which 500'd for every application (borrower satellite rows left behind). The shared library now ...
Every clinical audit row names its patient; pick up the shared-lib audit and updated_at fixes (SITP TP23FU)
Production phi_access_log rows from the clinical audit methods carried no purpose, basis or patient: the shared PhiAccessRecorder dropped them while stamping th...
Clinical audit rows keep purpose/basis/patient; updated_at stamped on every save (SITP TP23FU)
PhiAccessRecorder stamped occurredAt by rebuilding each event from a field list written before the clinical columns existed, and no caller sets occurredAt, so e...
Deleting a mortgage application no longer 500s, and a received one is kept (SITP TP21FU)
DELETE **************** failed for every application: AppMortgageService.delete removed the borrowers through the JPA cascade while borrower_declarations / borr...
God's controls are usable and need no co-signer (master section 10 R7)
Owner 2026-10-18: god (the platform owner) operates every IoT function; in another org only inside break-glass. The manifest's caller.god (@kamo/iot-core 0.9.0 ...
Rebuild for the owner's legal decisions and the real referral cookie names
The text is in kamo-translation-dictionary b6d42a87 (Privacy 4, 7, 9; Terms 2, 8; Cookie Policy referral rows).
The deploy-safety audit accepts a reasoned 'spread' exemption for a node-pinned Deployment
Every KlusterServices deploy since run #337 ended red on kamoai-voice (3 replicas pinned to k3m1 by nodeSelector, so no hostname spread is possible). The rule h...
Mlos_update_section keeps what the call does not give (SITP TP21 live smoke)
The loan, property, declarations, military and row saves replace their whole section in SecurityService, so a partial edit would have cleared the fields it left...
Kamo_app is a NOLOGIN group role; services log in as kamo_app_202610
The YugabyteDB application password was exposed (com.zaxxer.hikari DEBUG in ten services' logs, and securityservice's committed diagnose-output.txt), so it was ...
Starting a clinical note no longer fails on updated_at (SITP TP23 live smoke)
ClinicalBaseEntity.updated_at is NOT NULL and defaulted by the database on INSERT only (insertable = false), so a note just inserted holds null in memory and th...
The command audit and the activity say when god acted, and under which break-glass window (R7)
Owner 2026-10-18 (IoT master section 10 R7): god, the platform owner, has total control of IoT devices, and every god action outside the platform org is audited...
Each break-glass window has its own id, so other services can audit under it (IoT R7)
A god-mode window now carries godModeSessionId (a random UUID) in ***: minted when it opens, cleared when it closes, and added to a window that was opened befor...
Mortgage loan files for SIs: pipeline, the application, readiness, conditions, documents, disclosures, pricing and locks, AUS, vendor orders, consent and the edits (SITP TP21)
43 mlos_* tools (MlosPack) through SecurityService's loan-officer door **************** SITP TP21 securityservice@27e06020) as the SI member, never the MLOS ser...
Booking an appointment no longer fails on an untyped null in the conflict check (SITP TP23 live smoke)
findConflicts' (:excludeId IS NULL OR a.uid <> :excludeId) with a null UUID is an untyped parameter on Postgres/Yugabyte ('could not determine data type of para...
Patient Records for SIs: the schedule, the front desk, chart and FHIR reads, note drafts and the revenue cycle, with payment posting (SITP TP23)
18 ehr_* tools (EhrPack) over SecurityService's EHR controllers as the SI member; each names the right SecurityService checks there, and anything inside one cha...
Probe only www.kamocrm.com; the platform's surfaces are on kamouniverse.com
kamocrm.com is a marketing site only (owner 2026-10-18). The blackbox prober is now deployed, and apply.kamocrm.com was already failing its probe; the kamocrm.c...
The loan-officer door reaches the MLOS engines, writes take write rights, and an SI clears the MLOS walls (SITP TP21)
New relays on /api/security/mortgage-apps (MortgageLoanDeskController, @RequireRight, the caller's org's loan only): - GET /{uid}/qualification, /{uid}/engine-l...
The Canva routes take the right of the screen that calls them, not just a session (SITP TP23)
CanvaController checked only that a member was signed in: anyone in the organization could drive its Canva round trip (create, list, export, import, brand templ...
A booking or registration is always a new record in the caller's practice; SI note drafts say so; billing reads write the PHI trail (SITP TP23)
- SchedulingService.book: the body is the entity, so a uid in it made save() a merge onto that appointment in ANY practice (and moved it into the caller's); s...
A loan record's dateUpdated is a UTC instant too (SITP TP22 live smoke)
The live smoke answered loans_get_state_rule and loans_history with dateCreated as a UTC instant and dateUpdated as KamoLOS's offset-less text; both are now ins...
Reports_save_view does not answer empty settings for a view it just saved (SITP TP16 live smoke)
SecurityService answers a save without the view's stored request (the list carries it), so the tool said parameters {} for a view saved with parameters. A view ...
Never seed devices. anywhere under kamocrm.com
ccd50be skipped the devices sibling only when the parent WAS kamocrm.com, so a child-org web alias host **************** seen live) still queued ***************...
Support tickets, system bugs, marketing materials, Growth Hub, tracking codes and social pages for SIs (SITP TP15)
54 new SI tools, each checked by the same rights at the gateway and at MediaService (DocsService for the materials list): - support_*: list (with the queue's co...
IoT field-service reads and alarm handling for SIs: sites, a customer's and a work order's devices, history, commands, an alarm, the summary, acknowledge several, shelve, unshelve, note (SITP TP19)
Eleven iot_* tools in the IoT pack, by its own conventions: offered per caller from the manifest (IotTools.RIGHT, the view's withholding reasons), every device,...
A ticket can be read without joining its conversation (?join=false) (SITP TP15)
GET /api/support/tickets/{id} puts an entitled agent who is not yet in the ticket's conversation into it, as opening the window should. An SI reading the queue ...
Personal loans for SIs: the book, payments, payoff, history, statements, fees, offers, promises to pay and the money acts (SITP TP22)
27 loans_* tools (LoansPack) straight to KamoLOS through its one-time-key door (SITP TP02, new downstream LOS, X-OTK) as the SI member; KamoLOS checks the PLOS ...
A broken servicing rule answers 409 with its own words, not a 500 (SITP TP22)
The services refuse with plain exceptions (offer must be DRAFT to send, draw would exceed credit limit, reason is required, an unknown id's orElseThrow), which ...
E-signatures for SIs: read a template, track sent documents and a record's requests, send, remind, resend, void (SITP TP19)
Eight esign_* tools (EsignPack) through a new ESIG(OTK) door to ESigService's staff API, as the SI member; ESigService checks every right itself (SITP TP02) and...
The proxy settings live in HA's storage, promoted, not in YAML
Since 2026.10, Home Assistant migrates a YAML `http:` to its storage once, as a PENDING config. It reverts that config and restarts unless an admin promotes it ...
An SI prepares the draft commission payout batch, never sends it (SITP TP18)
commissions_draft_batch (open the DRAFT batch, or find the open one) and commissions_edit_draft_line (ADD / UPDATE / REMOVE a draft line; UPDATE restates the wh...
The iot.alexa client is named for the KamoUniverse skill; record the applied rename (SP09) [skip ci]
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.