LiabilityReconciler — agency payment-inclusion rules (WS6 core)
Pure/stateless computer turning each liability into the monthly payment that counts against DTI, with a cited rationale: omitted/paid-off excluded, leases alway...
Explicit-period quantity spec for delta successors
RequirementQuantity gains an explicit periods list (+ deltaJson builder); when present it IS the required set, so a successor can be scoped to "just send August...
**************** as the single period-key source
Adds periodKeyFor(date) so the write-path (satisfier stamping) and the coverage evaluator key periods identically; evaluator now delegates to it. Pure/additive,...
Period-coverage primitives for period-aware document collection
The pure, additive foundation of period-aware collection (doc 06 §4) — the first slice of the bank-statement "collect only the months I don't have yet" fix. Zer...
Replace forked chat with hosted <kamo-chat> embed; delete legacy proxy widget
Swaps the forked AI/live-support React chat (PublicChatWidget + AiChatPanel + LiveSupportPanel + the /api/chat/** server proxy routes) for the hosted, self-them...
Add install-QR (self-hosted APK) to Setup Mobile App tab
Install/Sign-in toggle: "Install" shows a QR to the signed release APK on the new phone can download+sideload it; "Sign in" keeps the password-gated OTK flow.
Web Chat Integration design customizer + live preview
Adds a Customize dialog to the Web Chat Integration tab: an editor form (colors, copy, layout, behavior, AI prompt) on the left and an instant, non-interactive ...
Web Chat Integration tab — list, create, snippet (BFF + UI)
Phase 2 core of the Web Chat Integration settings tab: BFF routes proxying to the Phase-1a MediaService CRUD, a typed client, and the /settings/features/chat ta...
Kamo-register honors software auth logo + name
- DynamicMetaLoader: read software identity + auth selectors from config.json, resolve tab title, persist auth logo/name state to sessionStorage - brand.ts + ...
Kamo-login honors software auth logo + tab title
- DynamicMetaLoader: read software identity + auth selectors from config.json, set tab title from resolved name (authNameBrandSource), persist auth-logo state...
LabelManager software identity UI + internal tab title
- Company Info: software name/short-name + login/register name + tab-title selectors - Branding: software full/simple logo uploads, override toggles, and per-su...
3-stage org onboarding guidance (create → finish DNS → enter)
Generalize the first-org hero into a single stage-aware guidance panel keyed on the member's owned-org count + DNS status (from /api/security/org/my-networks): ...
Dual company/software resolver + delivery + consumption
- Organization.ts: deliver software identity + per-surface selectors via OrgContext - brand.ts: **************** (+ vitest, 8 cases) - ThemeLogo: logoSoftware/l...
Software logo upload types + config.json bake
- uploadLogo: explicit object-key switch **************** with rejecting default so a software upload can never clobber the company logo.svg - copyFolder: pre...
Persist software branding fields via patchOrganization whitelist
First-org CTA hero for members on the platform org
Show an onboarding hero at the top of the home launchpad inviting a KamoCRM-platform member (not a team member) who hasn't yet created a child org to spin up th...
TURN-REST credentials endpoint for the mobile softphone
GET /api/voip/turn/credentials mints ephemeral coturn creds (HMAC-SHA1 over "<expiry>:<memberId>" with the shared static-auth-secret) so native/cellular WebRTC ...
Expose per-org primaryColor + logo URLs on /my-networks
Each org row now carries primaryColor (Organization.colors.colorPri, '#'-prefixed to match config.json) and derived logoUrl/logoSimpleUrl (theme.<domain>/public...
Snapshot web-chat integration id on support visitor + ticket
Resolves the WebChatIntegration by creatingKeyHash (enabled-filtered, consistent with bootstrap()/AI-prompt resolution) once in createSupportSession and stamps ...
Per-integration public AI prompt + session attribution
Upgrade the public-chat system-prompt waterfall from per-org to per-integration: PublicAiChatController now reads the X-Public-Chat-Key-Hash header (nullable) f...
GET /api/public-chat/bootstrap gateway route
Add bootstrap endpoint that reuses the existing proxyWithAuth pipeline (key validation + opt-in origin + PUBLIC_CHAT scope + rate-limit + X-Public-Chat-Key-Hash...
Public-chat bootstrap config resolver
Adds an internal GET **************** that resolves a WebChatIntegration by X-Public-Chat-Key-Hash and returns its resolved design/behavior config (default-fill...
WebChatIntegration CRUD (mints key + integration, org-scoped)
Org-facing management API for the Phase-2 web-chat settings tab. On create, mints the underlying PublicChatApiKey (same key-gen approach as PublicChatKeyControl...
Add WEB_CHAT_INTEGRATION_ID attribution columns to visitor/ticket/ai-session
WebChatIntegration entity + repo + DTO + default design config
Add "Access Copilot Mobile App" entry points on home + NavPri
Both surfaces dispatch an `open-interaction-center` event that NavTop listens for to open the Interaction Center on the Setup Mobile App tab. Home shows a label...
Password-gate the QR, single-line tab, logo-left header, 10-min code
- Member must re-enter their password (server-verified via /api/mobile-access-otk, which mints the OTK only on success) before the QR is revealed — prevents s...
POST **************** — gate Mobile Copilot QR
Verifies the caller's own password (passwordEncoder.matches against their session's user) without changing anything. Used by the mobile-access-otk BFF route so ...
Setup Mobile Access tab — QR to install + auto-configure Mobile Copilot
New 3rd tab in NavTopPanel (gated by ALLOW_MOBILE_ACCESS right): shows a branded QR encoding a short-lived OTK deep link (kamocopilot://configure) that signs th...
Add ALLOW_MOBILE_ACCESS (167) general right for Mobile Copilot
New RoleRightType (serviceType=null → General group) gating the 'Setup Mobile Access' interaction-center tab. RoleRightsSyncService backfills it to all roles on...
Per-org public prompt, human-handoff on no provider, anon daily message cap
Verify *** PoW at the edge on public session create (enforced when payload present)
Bust APIService key cache immediately on public-chat key toggle/delete
Persist creating key hash on public-chat visitor + ticket for attribution
Add publicDailyMessageCap to AiOrgSettings for anon web-chat quota
Add creating-key-hash attribution columns to PublicChatVisitor + SupportTicket
Add findOrganizationOwners for per-org public-chat system member
Mobile push dispatch (FCM data + direct APNs) with presence gate
chat incoming (MediaController), support ticket (SupportNotificationService), SMS/voicemail (VoipStompRelayController), social **************** Presence-gated l...
Expose AIService /ws/ai-chat via api.* hosts for mobile clients
IngressRoute (priority 100, websecure, ws-upgrade middleware sans compress) routes wss://api.<domain>/ws/ai-chat to kamowsai-service:80 — same pattern as the me...
Accept X-***-Token on REST + signed ?st= stream tokens on audio endpoints
OTKValidationFilter precedence: X-OTK → X-***-Token → ?st= (GET, audio streaming paths only, verified via shared StreamTokenCodec with internal.auth.secret; cla...
Accept X-***-Token on REST; slide TTL with per-session timeout
OTKPreAuthFilter resolves X-***-Token when no X-OTK is present (same call MediaService REST without the BFF. KSessionService now slides the Redis TTL with the s...
Device-token SSO **************** stream tokens, X-*** header parity
- DeviceAuthController: durable device credential per (user, device) with rotate-on-exchange + 60s grace; /device/exchange mints a per-org *** via PostAuth*...
Device-token + push-registration entities, HMAC stream-token codec
hashed secret, rotation grace, sliding expiry), push_device_registrations (one push destination per device+org+kind), and StreamTokenCodec — short-lived HMAC to...
Cache closed-loan docs across passes; retire on solve/exhaust
The trainer now refines a loan over multiple passes instead of one-and-done: - TrainingDocStore is a PERSISTENT, deterministically-keyed cache (key = hash of...
Multi-pass closed-loan training — pass counter + corpus upsert key
The closed-loan trainer now re-reads a loan on successive passes until its extraction reproduces the loan outcome, so: - LeadLosLink.closedLoanPasses drives a p...
Status-preserving progress write for the closed-loan trainer
run is RUNNING, without touching status. An operator pause (status → PAUSED) can no longer be clobbered by a full-row save from the pool thread — the guarded up...
Harden closed-loan trainer — concurrency, idempotency, limits
- Concurrency: in-process activeOrgs guard + the DB claim() so this instance never double-walks an org and two replicas can't overlap; a run whose heartbeat...
Harden closed-loan trainer — run lock + per-loan idempotency
- ClosedLoanTrainingRun.claim(): atomic conditional UPDATE that takes ownership of a run only when it is not already RUNNING or its heartbeat is stale (prev...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.