DKIM and DMARC steps, so email we send for an org is fully authenticated
Two new steps after the existing SPF one, written for a non-technical owner the same way SpfCard already is — plain language, a "why this matters" box, and neve...
DKIM-sign transactional mail sent as an org's own domain
Once SecurityService confirms a domain's DKIM record is published (org_domains.dkim_verified), password resets, invitations and other transactional letters sent...
DKIM and DMARC advisory endpoints for /setup/dns
Adds two endpoints alongside the existing SPF one, so an org's transactional mail (password resets, invitations, notifications) can carry a DKIM signature and t...
DKIM key fields for an org domain's transactional mail
Adds **************** to org_domains, mirroring the spf_verified/spf_checked_at pair already there — so a domain can hold a generated DKIM keypair and whether i...
Narrow a campaign's all-leads audience and drip triggers by market, vendor, product and state
The campaign editor's "All Leads" box and the drip trigger's lead filter could only match every lead the sender can see, with no way to target a market, vendor,...
**************** filters on campaign leads and drip triggers
The campaign editor's "All leads" audience source had no way to narrow who it reached beyond visibility scope. Adds a filter panel (Market -> Vendor -> Vendor P...
An org's own computers host gets a certificate and a route
computers is a standard alias now — every white-label org is told to point one at Kamo on /setup/dns, the way it points meet and sign — so two things had to fol...
The computers record on the DNS studio
One more card on /setup/dns, so an org configuring its domain is told about the host its Hosted Computers open on. Without it an org could follow the page to th...
Computers is a standard alias, and the link uses the org's own
Every white-label org points a fixed set of labels at Kamo and computers was not one of them, so an org could follow /setup/dns to the letter and still have a H...
List only the Getting Started steps an organization is asked
An organization whose security model fixes every Compliance answer (no product a member may switch, one age range for each member type) was still counted agains...
A step the organization is not asked is not shown or counted
An organization whose security model fixes every Compliance answer (no product a member may switch, one age range for each member type) was still shown a ninth ...
Issue and mirror the certificate for computers.kamocrm.com
Opening a Hosted Computer produced a browser tab that appeared and vanished. The launch link is correct and so is the token: SecurityService builds ************...
The message list names a lead or contact, not their address
A row was headed by the sender's display name, or the part of the address before the @ when there was none, so a lead who wrote in read as "jlrivera1984" above ...
The message list names a lead or contact, not their address
A row was headed by the sender's display name, or the part of the address before the @ when there was none, so a lead who wrote in read as "rodarisdolgovanton" ...
A lead who writes in is named by the correspondent resolver
The mailbox list headed a lead's message with the part of their address before the @ ("jlrivera1984") when their mail client sent no display name, although the ...
A lead who writes in is named by the correspondent resolver
The mailbox list headed a lead's message with the part of their address before the @ ("rodarisdolgovanton") when their mail client sent no display name, althoug...
The member who caused a notification opens their card from it
"Dana Reyes dealt you in", "Weekly sync · Dana Reyes", an unread-chat card whose body is the sender: EmailService (29cb21e) now sends actorMemberId (as text) an...
The Notes app is "Notes & Checklists"
The Notes app holds checklists as well since 2026-09-23 (steps ticked off as they are done, a step that waits until the steps before it are finished, a checklis...
The Hold'em invite and the meeting reminder say who they are from
MemberNotificationClient.raise gains an overload carrying actorMemberId/actorName (the id sent as text; the old signature is unchanged and sends neither). Holde...
Who caused a notification travels with it, so the bell can draw them as a member
- NotificationRequest gains actorMemberId/actorName; the old constructor stays for every producer that predates them. - raise() keeps the pair only when both ...
A notification can say whose doing it is
MemberNotification gains ACTOR_MEMBER_ID (INT8) and ACTOR_NAME (255): the member who caused it - who dealt you in, whose meeting is starting, who wrote to you -...
The Notes plan feature is "Notes & Checklists"
The Notes app holds checklists as well since 2026-09-23 and is called "Notes & Checklists" everywhere it is named. The pricing page's comparison chart takes its...
A switched-to mailbox stays live, and the search box is polished
Live updates. The page asks EmailService to watch the mailbox it has open when it is not the member's own (/app/email/watch, re-sent after a reconnect, stopped ...
Audio lessons — upload a recording, and learners can really navigate it
Authors (/hr/training course editor) - "Upload file" on every slide, beside "Choose media": audio (MP3, M4A, AAC, WAV, OGG/Opus, FLAC), video or an image, thr...
A way to actually build the golden image
build-golden-image.sh said "Run by CI (see ../../.forgejo/workflows/)". No such workflow was ever written. It needs libguestfs, qemu-img and virt-customize, non...
Audio — a waveform thumbnail at upload, and peaks and transcripts on demand
An uploaded audio file fell through to the Docs PDF path, which cannot open one, so every audio upload ended "Conversion failed" with a blank library tile. Audi...
Audio slides — media metadata, and learners play media through their assignment
An audio slide's navigation lives in media_meta_json (duration, waveform peaks, chapters), which the editor writes and the player reads back verbatim. It is sav...
Audio uploads pass the MIME check, and slides carry media metadata
Every audio upload but MP3 was refused as a MIME mismatch. An upload is accepted only when the browser's type and Tika's sniff resolve to the same ImageMimeType...
A tool window's full title, however it is cut short
A title bar is one line, and a conversation, an email or ticket subject or a terminal's directory is regularly longer than the room it gets — the member could o...
Put the app in the entitlement catalog, add-on only
**************** asserts every sold app is categorised and sits somewhere on the tier ladder, because an app the catalog does not describe lands nowhere on the ...
Human/AI member accounts, phonetic names, job title and department requirements
Add Member / Add Team Member - A first "Person or AI" section: Human Intelligence (default) or Artificial Intelligence as two keyboard-operable choice cards. ...
Human/AI members, phonetic names, role requirements; fix position saves wiping security
Members - Create, create-team-member and bulk-create accept `intelligenceType`, `namePhonetic` (new accounts only, like the name), and for AI accounts `aiSupe...
Intelligence type, phonetic names, AI supervision, job title/department requirements
Members: `Member.intelligenceType` (HUMAN | ARTIFICIAL, STRING, defaults HUMAN on every construction path and in the column), `aiSupervisorMemberId` (plain id —...
The nav option, the settings section, and the storage figure
A member's own Linux computer, opened from the top bar. The app (ServiceType 37) and its three rights landed in the shared library; this is the half people see....
Checklists in the Notes app — prerequisites, stickies, home panes and the calendar
A note is memory; a checklist is work. /notes now has two halves — Notes and Checklists (?view=checklists) — and a checklist is its own record (/api/checklists,...
Forward /api/checklists to KBService
Checklists live in the Notes app and are served by KBService beside the notes themselves; without this route the whole feature answers 404 at the gateway.
The checklist API, with prerequisites the server enforces
/api/checklists: list, get, create, update, delete, duplicate, reset, clear-done, sequence ("do in order"), clear links, and per task add, edit, tick/untick, se...
Checklist and ChecklistItem entities, repository and DTOs
Checklists are the Notes app's second record type: work to get through, whose tasks can wait on other tasks. Three tables — checklists, checklist_items and chec...
The browser-facing surface, and the second Guacamole gateway
SecurityService is the trust boundary for Hosted Computers. It holds the session, the rights and the org chart; ComputeService holds the Kubernetes credentials ...
A member can put a checklist on their calendar, once
Checklists live in KBService and the calendar owns only WHEN, so a scheduled checklist is an ordinary member event carrying sourceType CHECKLIST, the checklist ...
Forward the Hosted Computer agent path, and only that path
/api/hosted-computers/agent/** -> ComputeService. A Hosted Computer's network policy denies the cluster entirely — no database, no service, not even cluster DN...
One query for an organization's whole reporting graph
findMemberAndManagerIds returns every (memberId, managerId) edge in one organization, for Hosted Computers' ACCESS_SUBORDINATE_COMPUTERS right — which reaches t...
A social inbox's quote of an older message names its author with their card
The quote now takes its author from the server (@kamo/chat-core's quote.senderMemberId), which withholds a social contact's id since mediaservice ceee73e — a co...
The card shows the member id to those who manage members
HR and support read a member's id off a tooltip on the HR rosters, which the member card replaced (the tooltip sat where the card opens). The card's details now...
The app, three rights, tier/state enums and the entities
ServiceType.HOSTED_COMPUTERS at id 37, TESTING rather than COMPLETED. The stage is carrying weight here rather than describing progress: AppCatalogService resol...
A reply to an older message names its author with their card too
Moves @kamo/chat-core to 0.1.19, whose reply quote carries senderMemberId: the server's parentSenderMemberId when it sent one (null for a web-chat visitor, whos...
Per-org VM islands, suspend-to-disk, and a white-labeled golden image
A member's own Linux computer, running as a KubeVirt VM in its organization's namespace and opened from the browser. Separate from desktop/ in every way that ma...
Let a caller resolve a MediaObjImg by the Img id alone
DocsService's imaging endpoints (download/stream/list/delete) know an Img's id but have no reason to hold the MediaObj it was attached to — until they need to h...
Fold the lead ledgers every 30 s and recount them nightly; the job trigger needs the cluster secret
The lead ledgers (securityservice create_lead_ledgers.sql, applied 2026-09-22) replace COUNT(*) over a 796k-lead pool and over lead_credits with maintained tota...
The card on reply quotes, hand histories, ticket events and bug-thread authors
The last four surfaces that named a member with nothing to open, now that MediaService sends the ids (fa25989): - Reply quotes: the quoted author's name opens t...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.