The AI Workforce app and its four rights; the app-mirror guard reads Java again
A private inbox prefix for new services, and the LOS webhook worker is opt-in
Services log in to Redis with a username and password when given one
One seat rule for the console and every service that enforces it
The resolver reads the member with its organization fetched and opens no transaction of its own, so a seat is decided correctly on a thread with no persistence ...
Log in to Redis as mail_rspamd
rspamd reads its password from Secret mail/rspamd-redis-auth, included into local.d/redis.conf. The pod gains fsGroup 11333: the image runs as 11333:11333 and a...
AI platform services and kill switch rights, and the switch's column
ACL users for the platform, rspamd and operators (default still open)
View, supervise, approve and manage the AI workforce (329-332)
AI Workforce app, outside the PHI boundary and never automatic
Choose how a published application asks its questions
"Publish this application" (Settings → Features → CRM → Vendors & Products) now carries three choices beside the chat, each a pair of cards that say what they m...
The lender's layout choices — squeeze, contact first or last, basic
The mortgage application now lays itself out as the product was published (Settings → Features → CRM → Publish this application): - Type. NORMAL is the five gr...
The session tab stops wearing Guacamole's icon
A session tab is Guacamole's document, so its own <link rel="icon" href="images/logo-64.png"> owns the tab, and a member opening their company's computer watche...
Arive in CRM markets, on the lead page, and on member profiles
- Markets: "Arive" joins the MLOS dropdown, and its Configure dialog holds the four Zapier hooks (write-only, masked), the Arive → Kamo addresses to paste i...
Layout choices, and saving contact details as they go
The publish dialog now chooses how the public mortgage application lays itself out (kamo-shared-library ac83bea1): NORMAL or SQUEEZE, contact details at the STA...
Layout choices for a published loan application
Three columns on LEAD_VENDOR_PRODUCTS, chosen on the publish dialog and read by kamo-apps to lay the public mortgage form out: - APPLICATION_LAYOUT NORM...
The columns and activity log the Arive integration maps
**************** (unique), the Arive link fields on lead_los_links (kind, GUID, deep link, stage, pending-since, last error) and los_sync_events. All nullable, ...
The public address Zapier posts Arive events to
POST **************** trigger> forwards to SecurityService's AriveInboundController, which owns the token check. The query string (the event) crosses the hop, a...
Arive through Zapier — connection, inbound events, and per-lead actions
A market bound to Arive gets a connection (four Zapier Catch Hooks for create-loan, update-loan, update-lead and convert-lead, plus one inbound URL whose token ...
Start a coder session in the cloud, and show it on the window
which lists the git checkouts on the dev machine (most recently worked in member's model and effort. The machine builds the command, with CCR_FORCE_BUNDLE=1 so ...
Start a coder session in the cloud, and say which terminals are
repository as cwd) and answers `cloud: true`; the machine builds the a cloud session can start from. The terminal listing carries the agent's `cloud` mark throu...
Start a coder session in the cloud from a local checkout
repository. The bundle is forced because our remotes are Forgejo, not GitHub, and the point is the checkout on this disk. No --permission-mode (the CLI drops by...
Attachments sit above the body, as the files themselves
An email whose only content was a PDF had no way to open or download the file: the paperclip showed on the list row, and the reading pane showed nothing. EmailS...
Arive as a second external LOS, and a provider seam that is real
Arive is reachable only through its invite-only Zapier app, so the connection is Zapier in both directions: Kamo posts commands (create loan, update loan stage,...
A designed launch screen, in the organization's own brand
Opening a computer showed one line of plain text on a white page, written straight into the tab with `document.body.textContent`. For up to ninety seconds — a r...
Point a member who typed their work email at their personal one
Forgot-password resets go to the address on the user account, usually a personal one, but members type the work address their organization gave them. SecuritySe...
A work address on forgot-password asks for the account's own, shown masked
Members open their account with a personal address (gmail, yahoo) and are later given a work address by their organization, which is the one they remember and t...
Move system mail and the platform org's own send domain to kamouniverse.com
platform.mail.domain now defaults to kamouniverse.com (config value, no code default change) and gates every unverified-domain org's transactional fallback From...
Add kamouniverse.com as a second regular-mail domain
Adds kamouniverse.com to postfix's virtual_alias_domains with a local-part-preserving regexp so any address on it lands in the identical kamocrm.com mailbox (no...
Forward kamouniverse.com to kamocrm.com
DNS for the apex and www now point at k1m1's public IP. Add a redirectRegex route on both entrypoints (301, path/query preserved, ACME challenge path excluded o...
Select-all/deselect-all for the states lead filter, default to all
The states dimension of the campaign audience panel's and drip trigger's lead filter showed nothing checked by default, even though an unset list already means ...
DKIM and DMARC steps, so email we send for an org is fully authenticated
Two new steps after the existing SPF one, written for a non-technical owner the same way SpfCard already is — plain language, a "why this matters" box, and neve...
DKIM-sign transactional mail sent as an org's own domain
Once SecurityService confirms a domain's DKIM record is published (org_domains.dkim_verified), password resets, invitations and other transactional letters sent...
DKIM and DMARC advisory endpoints for /setup/dns
Adds two endpoints alongside the existing SPF one, so an org's transactional mail (password resets, invitations, notifications) can carry a DKIM signature and t...
DKIM key fields for an org domain's transactional mail
Adds **************** to org_domains, mirroring the spf_verified/spf_checked_at pair already there — so a domain can hold a generated DKIM keypair and whether i...
Narrow a campaign's all-leads audience and drip triggers by market, vendor, product and state
The campaign editor's "All Leads" box and the drip trigger's lead filter could only match every lead the sender can see, with no way to target a market, vendor,...
**************** filters on campaign leads and drip triggers
The campaign editor's "All leads" audience source had no way to narrow who it reached beyond visibility scope. Adds a filter panel (Market -> Vendor -> Vendor P...
An org's own computers host gets a certificate and a route
computers is a standard alias now — every white-label org is told to point one at Kamo on /setup/dns, the way it points meet and sign — so two things had to fol...
The computers record on the DNS studio
One more card on /setup/dns, so an org configuring its domain is told about the host its Hosted Computers open on. Without it an org could follow the page to th...
Computers is a standard alias, and the link uses the org's own
Every white-label org points a fixed set of labels at Kamo and computers was not one of them, so an org could follow /setup/dns to the letter and still have a H...
List only the Getting Started steps an organization is asked
An organization whose security model fixes every Compliance answer (no product a member may switch, one age range for each member type) was still counted agains...
A step the organization is not asked is not shown or counted
An organization whose security model fixes every Compliance answer (no product a member may switch, one age range for each member type) was still shown a ninth ...
Issue and mirror the certificate for computers.kamocrm.com
Opening a Hosted Computer produced a browser tab that appeared and vanished. The launch link is correct and so is the token: SecurityService builds ************...
The message list names a lead or contact, not their address
A row was headed by the sender's display name, or the part of the address before the @ when there was none, so a lead who wrote in read as "jlrivera1984" above ...
The message list names a lead or contact, not their address
A row was headed by the sender's display name, or the part of the address before the @ when there was none, so a lead who wrote in read as "rodarisdolgovanton" ...
A lead who writes in is named by the correspondent resolver
The mailbox list headed a lead's message with the part of their address before the @ ("jlrivera1984") when their mail client sent no display name, although the ...
A lead who writes in is named by the correspondent resolver
The mailbox list headed a lead's message with the part of their address before the @ ("rodarisdolgovanton") when their mail client sent no display name, althoug...
The member who caused a notification opens their card from it
"Dana Reyes dealt you in", "Weekly sync · Dana Reyes", an unread-chat card whose body is the sender: EmailService (29cb21e) now sends actorMemberId (as text) an...
The Notes app is "Notes & Checklists"
The Notes app holds checklists as well since 2026-09-23 (steps ticked off as they are done, a step that waits until the steps before it are finished, a checklis...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.