SP00-T45 ruling — the rollback deletes the Qdrant NetworkPolicy; the network check needs curl's 000
SP00-T23 ruling — a calendar save needs a seat only when it invites by email; SP07/SP08 keep the seat gate
SP00 plan — log checks read every line (kubectl logs -l prints only the last 10)
Task 29's daemon and compute checks and Task 45's RAG check now pass --tail=-1. With a label selector, kubectl logs defaults to the last 10 lines, so the daemon...
Sending mail needs a seat, for people and AI members alike
A member without a licensed seat is refused with the shared 403 SEAT_REQUIRED body before anything is sent: POST /api/email/send, the shared-mailbox send, and t...
SP00-T42 ruling — the help-center import Usage block reads the Redis login
The Redis login
The pod logs in to Redis as the platform ACL user (Secret redis-auth: REDIS_USERNAME, REDIS_PASSWORD), which app/lib/redis.ts already reads, so sign-in keeps wo...
Own NATS login, Redis login, KamoAI secret
NatsConfig's comment now names where the login comes from: svc_kb, from the nats-user-kb Secret, which overrides the shared kamo_svc keys.
SP00-T21 ruling — gRPC at compile scope, wiring tests beside the brief's, replay trade-off recorded
Present Qdrant's API key, and recreate the consumers so KB and notes are embedded again
Meetings, group chats, attachments and calls need the seat that includes them
SP00-T22 ruling — precondition counts configured instances; unscoped RC overloads removed; null-safe TURN member
Only verified RingCentral webhooks are processed; calling needs a seat
The legacy path that processed a RingCentral call or SMS event with no instanceId, trusting the payload's own to-number, is removed together with its 2026-10-13...
SP00-T27 ruling — anchored key pattern with its own test; platform-only catalog comment
No shared provider key in the seed; every app, AI Workforce included, has a catalog row
SP00 task 19 ruling — session fixtures carry userID, two admin-read tests beside the brief's
SP00 task 26 ruling — manifest secret pins, a startup flag for AIService's secret, python -m pytest
SP00 task 25 ruling — the sidecar image copies hostEligibility.js; mayHost; a 5 s fail-open bound; wiring tests
SP00-T14 ruling — a session-less kill-switch read is the interceptor's 403
SP00-T18 ruling — a socket turn runs in a persistence context, and a revoked tab stops receiving answers
The chat picker lists only the models the member may pick
The picker read the administrator's model list (403 without MANAGE_AI_MODELS) and offered providers, which never selected a model. It now reads GET /api/ai/mode...
SP00-T14 ruling — shared-lib pin restored to one version (1.6.1) before the securityservice push
Pin kamo-shared-library 1.6.1, the version the library stays at
1bb9801 pinned 1.6.2 together with the library bump in db737a54. That bump is reverted, because about thirty services pin 1.6.1 and each build can only resolve ...
Pin kamo-shared-library 1.6.1, the version the library stays at
39829f6 pinned 1.6.2 together with the library bump in db737a54. That bump is reverted: about thirty other services pin 1.6.1, and CI can only resolve the one v...
Keep kamo-shared-library at 1.6.1, the one version every consumer can resolve
db737a54 moved the library to 1.6.2, and only emailservice and initializerservice moved with it. About thirty other services pin 1.6.1. Their CI clones this rep...
SP00-T17 ruling — the ownership rule and both pin call sites get their own tests
Own NATS login, Redis login, KamoAI secret; host the LOS webhook worker
Migration for org_alias_domains, seeding the platform org's two
Creates **************** and seeds the platform org (is_top_level) with kamouniverse.com (default, carrying forward the old hardcoded platform.mail.domain) and ...
Read the composer's alias-domain default from org_alias_domains
**************** used one hardcoded domain (platform.mail.domain, kamouniverse.com) as a synthetic send-as default, and only for the platform org **************...
Add org_alias_domains, the per-org form of the platform mail domain
Generalizes the single hardcoded platform.mail.domain (kamouniverse.com, and only for the platform org) into a table any org can hold any number of rows in. Ema...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.