Serve Tesla's partner key path and exempt it from access rules (IoT SP08-D2)
GET **************** forwards sessionless (identity headers and Authorization dropped) to IoTService **************** the exact path (container- normalised) is ...
An SI's own join (M1) carries the meeting's dial-in, for when it cannot be put straight into the room
2026-10-14: SIs asked to join a meeting told people "there's no dial-in" and asked for another way in. kamoai-service now picks the way in itself: straight into...
SP12 health enums, entities, repositories and monitoring-state derivation
SP12 pure vitals mapping — LOINC/UCUM, unit conversion, plausibility, opaque Validic uid
SP12 Observation source columns, FHIR device and tag, remote-reading queries
SP03 grant enums, device type rank and catalogue lookup
IotDeviceType (SP01's copy) gains HEALTH_VITALS, storedType and a position map; SP01's tests are kept beside SP03's.
SP12 enum appends — PhiAccessKind.CREATE, RPM_ENROLLMENT, three EHR rights, RPM_ALERT
Scrape kamowsiot-service on /actuator/prometheus
IoT SP01 Task 34: the kamo-actuator job keeps kamowsiot-service beside kamowssecurity-service, so the four IoT alerts (iot-service's own PrometheusRule) have da...
Daemon jobs for the IoTService tick (every 60 s) and nightly retention purge
IoT SP01 Task 30. Landed after SP02's 75007b2, which already mounts iot-internal-auth, sets iot.service.url and creates IotJobClient with a generic post(job, pa...
Network-backed STOMP authorisation, subscription registry and revocation for the IoT topics
IoT SP01 Task 33. k8s/deployment.yaml gains the iot-internal-auth envFrom (after mlos-internal-auth): origin/main did not mount it yet (Step 1 gate fallback).
Append STREAM_OPENED, STREAM_CLOSED, STREAM_REFUSED activity kinds
Iot.live.> to STOMP relay and the static guards for the IoT topics
IoT SP01 Task 32. The IoT SEND refusals sit just above the voicemail comment so that comment stays attached to its own line.
SP01 enums, safety rules, command transitions, event ids, geohash, device-type rank
IoT SP01 Task 2, on SP02's vocabulary and catalogue (a2cc3154, 36cc42b6).
SP01 value columns, org settings, connection, site, space entities and repositories
IoT SP01 Task 3. A whole number reads back at scale 0 (210, not 210.0) so a stored value round-trips equal.
SP01 device, function, state, activity and write-once command entities
IoT SP01 Task 4. IotDevice.providerDeviceType is the provider's suggested primary capability KEY (String): SP02 ships no device-type enum and DiscoveredDevice c...
Verify-password records a session re-check marker and limits wrong attempts
IoT SP01 Task 7 (marker half). KREAUTH<***Id> = member id for 3600 s after a correct password; five wrong passwords per session in 15 minutes answer 429 too_man...
Provider vocabulary, registry types 18-24 and the IoT callback path
ReauthMarkers and **************** (delayed naks, exhausted callback)
IoT SP01 Task 5. The plan's test used AssertJ fail() without importing it; import added.
The eight IoT kinds — gated like EmailService with the owner rule, one order, their own marks (IoT SP00)
The /api/iot BFF route; a guard that every notification kind has its label and hint (IoT SP00)
IotRights.ts, the browser mirror of IotRights, parity-checked against the Java set (IoT SP00)
The IoT Devices rights mirrored, their tree, and the IoT Devices permission group (IoT SP00)
IoT Devices in the app mirrors, Organization.isIot and its app icon (IoT SP00)
IoT vendor deliveries are not judged by an organization's IP and country rules (IoT SP00-D5)
IoT Devices in every paid plan, never Free; scan com.kamo.z.shared.iot (IoT SP00)
Gate the eight IoT kinds on their rights with the owner rule, in one display order (IoT SP00)
Seed the IoT administration rights to CONFIGURE_SYSTEM holders on the boot that introduces them (IoT SP00)
The IoT tour needs no lineage: every Show Tour right is already on for every role (fefd98c2).
IotRights, the one owner rule every IoT gate applies (IoT SP00)
An SI member never holds the six IoT management rights (IoT SP00-D4)
The IoT Devices rights (370-401) under VIEW_IOT_DEVICES, and SHOW_TOUR_IOT (IoT SP00)
IoT Devices app (40), inside the PHI boundary and never automatic (IoT SP00)
Api.* carve-out for vendor hooks and the Alexa relay with a webhook-sized limit; IoT secrets documented (IoT SP00)
Default-deny egress for kamowsiot and its disruption budget (IoT SP00)
NATS login svc_iot, svc_media iot.live.> grant, IOT_EVENTS work queue (IoT SP00)
The letter a triggered sign-in detection rule sends
SUSPICIOUS_SIGNIN_DETECTED joins the canonical templates. SecurityService's SuspiciousDetectionService sends it when a tenant-configured detection rule (failed-...
Branch Types moves to Platform Administration
Branch Types (the security models child organizations are created under, with their default security roles, apps and home screens) was a tab on every organizati...
Branch types and security models are the platform's to edit
Branch types, the security models behind them (default security roles, app availability, home screens, commerce markets, subdomain config) and the master model ...
MANAGE_BRANCH_TYPES
Branch types, and the security models behind them, move from every organization's Settings -> Account to Platform Administration -> Configuration. This is the p...
Email the accept-window audience when a new lead sits unclaimed for two minutes
LeadAvailableEmailSweep (every 15 s, singleton lease) finds leads that entered the pool 2-15 minutes ago and are still unclaimed, per org via ix_leads_org_creat...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.