No live credentials in application.yml defaults
The local-development defaults carried the database OWNER's password (${DB_PASSWORD:<literal>}), and apiservice/securityservice also the live changelog webhook ...
A tool window's full title, however it is cut short
A title bar is one line, and a conversation, an email or ticket subject or a terminal's directory is regularly longer than the room it gets — the member could o...
Gate the API on the app, not only the screen
The settings page and the nav option both check organization.isHostedComputers, and until now that was the whole gate. AppAvailabilityInterceptor never mapped /...
Put the app in the entitlement catalog, add-on only
**************** asserts every sold app is categorised and sits somewhere on the tier ladder, because an app the catalog does not describe lands nowhere on the ...
A Hosted Computer is never provisioned automatically
Hosted Computers was reachable by both automatic provisioning paths, and either one would have put it in front of every organization on the platform at once. F...
The three templates that never got committed
service-template.yaml, cloud-init.userdata.yaml and cloud-init.networkdata.yaml. They were written into a second worktree and committed from neither — the earli...
Human/AI member accounts, phonetic names, job title and department requirements
Add Member / Add Team Member - A first "Person or AI" section: Human Intelligence (default) or Artificial Intelligence as two keyboard-operable choice cards. ...
Human/AI members, phonetic names, role requirements; fix position saves wiping security
Members - Create, create-team-member and bulk-create accept `intelligenceType`, `namePhonetic` (new accounts only, like the name), and for AI accounts `aiSupe...
Intelligence type, phonetic names, AI supervision, job title/department requirements
Members: `Member.intelligenceType` (HUMAN | ARTIFICIAL, STRING, defaults HUMAN on every construction path and in the column), `aiSupervisorMemberId` (plain id —...
SearchService marks its injection constructor, so the service starts
9809d4b gave SearchService a second constructor (a clock, for tests) and marked neither, so Spring chose neither, looked for a no-argument constructor, and the ...
The nav option, the settings section, and the storage figure
A member's own Linux computer, opened from the top bar. The app (ServiceType 37) and its three rights landed in the shared library; this is the half people see....
Checklists in the Notes app — prerequisites, stickies, home panes and the calendar
A note is memory; a checklist is work. /notes now has two halves — Notes and Checklists (?view=checklists) — and a checklist is its own record (/api/checklists,...
Every folder of a switched-to mailbox works, and search is rebuilt
Switching mailboxes. The folder sidebar always loaded the member's OWN folder tree, whatever mailbox was open - so a second mailbox showed the primary's folders...
Search that honours its query, and every mail action on the mailbox that is open
Two problems on /messages, fixed in the service. Search did not work. The index path threw a ClassCastException on every hit (Instant -> Timestamp, visible in ...
Forward /api/checklists to KBService
Checklists live in the Notes app and are served by KBService beside the notes themselves; without this route the whole feature answers 404 at the gateway.
The checklist API, with prerequisites the server enforces
/api/checklists: list, get, create, update, delete, duplicate, reset, clear-done, sequence ("do in order"), clear links, and per task add, edit, tick/untick, se...
Checklist and ChecklistItem entities, repository and DTOs
Checklists are the Notes app's second record type: work to get through, whose tasks can wait on other tasks. Three tables — checklists, checklist_items and chec...
Apply the shared infrastructure on deploy
The namespace, the single-replica StorageClass, the clusterwide seal, computeservice's RBAC and the tenant gateway. Guarded on the hosted-computers/ directory c...
The browser-facing surface, and the second Guacamole gateway
SecurityService is the trust boundary for Hosted Computers. It holds the session, the rights and the org chart; ComputeService holds the Kubernetes credentials ...
A member can put a checklist on their calendar, once
Checklists live in KBService and the calendar owns only WHEN, so a scheduled checklist is an ordinary member event carrying sourceType CHECKLIST, the checklist ...
Forward the Hosted Computer agent path, and only that path
/api/hosted-computers/agent/** -> ComputeService. A Hosted Computer's network policy denies the cluster entirely — no database, no service, not even cluster DN...
One query for an organization's whole reporting graph
findMemberAndManagerIds returns every (memberId, managerId) edge in one organization, for Hosted Computers' ACCESS_SUBORDINATE_COMPUTERS right — which reaches t...
Shared-mailbox **************** need a management right
**************** on /api/email/shared-mailboxes needed only a session — any authenticated member could create a shared mailbox, delete one, or grant themselves ...
Apply the per-party/issued/trashed checks everywhere byte-adjacent paths need them
**************** applied the issued-document check but not the per-party (ACCOUNT_MEMBER_VAULT/LOAN) or trashed-row checks that /download, /stream and the sibli...
Verify RingCentral webhooks before trusting them
RingCentral's inbound call/SMS webhooks were processed with zero verification: WebhookController routed telephony/message-store events straight into ***********...
An OAuth state token is a server-side record, not a blob the browser hands back
/api/email/oauth/callback and **************** are public and sessionless (the provider redirects the browser here with no Kamo session), so `state` was the onl...
A document share now actually reaches its recipient, and edit is gated
**************** matched an ImgShare by ImgShare.member — the SHARER, who created the row so they can list what THEY shared (getSharesByImage) — instead of ImgS...
A social inbox's quote of an older message names its author with their card
The quote now takes its author from the server (@kamo/chat-core's quote.senderMemberId), which withholds a social contact's id since mediaservice ceee73e — a co...
The card shows the member id to those who manage members
HR and support read a member's id off a tooltip on the HR rosters, which the member card replaced (the tooltip sat where the card opens). The card's details now...
The member card spec, as built
Corrects what changed on the way — the card's layer is 1305 (over MUI modals), useHoverCard stayed where it was, the header wears the desktop wallpaper, calenda...
A reply quoting a contact names the contact, not the connection owner
A social contact has no member row, so everything they send is stored under the connection owner's member. The history read already names such a row as the cont...
Re-check clearance when rendering a binder's document items
BinderItem pins the Img row it was built from at assembly time. BinderRenderer.renderItem handed that Img straight to **************** with no check at all for ...
A From override must be an address the caller may send as
POST /api/email/send took request.getFromAddress() straight into the header From and the SMTP envelope sender **************** -> EmailSmtpService.send, and the...
Bound and stream the byte-heavy imaging paths
/download loaded the whole file into a byte[] through ImageService.downloadDocument before serving it; /bulk-download built the whole ZIP (or merged PDF) as one...
Cap upload size and concurrent conversions on the unauthenticated pipeline endpoints
POST /convert-vector and WS /ws/pipeline take no auth (see this commit's companion report for why that is not fixed here) and, until now, read a caller's whole ...
The SOCIAL read gate refused every social session, not just cross-org ones
Regression in f7b2bd5, live on kamowsmedia. canReadSession (MediaController, copied into SessionFacesController and ChatSessionMembersController) admitted a mem...
Stop trusting any https://api.<anything> as a Docs WOPI host
k8s/Docs-deployment.yaml's aliasgroup1 was 'https://api\..*'. Docs's alias matcher (RegexUtil::getValue, std::regex_match) requires only that the WHOLE candidat...
The app, three rights, tier/state enums and the entities
ServiceType.HOSTED_COMPUTERS at id 37, TESTING rather than COMPLETED. The stage is carrying weight here rather than describing progress: AppCatalogService resol...
Don't load content_json to build the public tree index, and stop loading it twice
buildPublicTreeIndex builds a small structural index (parent/child, slug path, ancestors) from every public article in the org, but it was loading full KbArticl...
A media presigned URL was not scoped to the caller's org
GET /api/kb/media/{mediaId}/url looked the row up by uid alone (KbMediaService.getPresignedUrl -> **************** unlike every other media read here (presignAl...
WebRTC signaling, webinar management and Canva schedules stop trusting the caller's say-so
Three more of the same shape. - WebRTCSignalingController relayed **************** straight to **************** using only the payload's own sessionGuid, w...
Gate chat attachments, voicemails and call recordings by more than org+clearance
MediaService/telephony store chat attachments (CHAT_ATTACHMENT) and voicemail/call recordings (VM_RECORDING, CALL_RECORDING) at ACCESS_LEVEL 0. Every generic im...
A reply to an older message names its author with their card too
Moves @kamo/chat-core to 0.1.19, whose reply quote carries senderMemberId: the server's parentSenderMemberId when it sent one (null for a web-chat visitor, whos...
The member card can be reached from the keyboard
The card is portalled to the end of <body>, so in document order it follows the whole page: a member who opened it from a name with Enter or focus and pressed T...
Per-org VM islands, suspend-to-disk, and a white-labeled golden image
A member's own Linux computer, running as a KubeVirt VM in its organization's namespace and opened from the browser. Separate from desktop/ in every way that ma...
No job overlaps itself, and no HTTP call can hang a worker forever
Quartz here runs 10 in-memory worker threads on one replica. 17 of the 24 jobs had no @DisallowConcurrentExecution, so a run that overran its interval started a...
The lead-intake counters join the ledgers the daemon folds and recounts
The intake endpoints' received / imported counters are now a ledger (securityservice create_lead_intake_ledger.sql, applied 2026-09-22): a trigger on lead_intak...
Intake endpoints show exact received/imported counts from the intake ledger
The Lead Intake settings list showed total_received / total_processed / last_received_at straight off the endpoint row, where they were bumped once per payload ...
Intake endpoint counters come from a ledger and stop losing updates
**************** / total_processed / last_received_at were bumped on the endpoint row itself: once per inbound payload (~5/s during a farm import) and once per ...
Refuse to spawn STDIO for an unlisted config, and refuse to connect an SSE/HTTP one to the cluster network
Defense in depth alongside the AIService commit that closes AiMcpController's missing right checks and STDIO refusal at the source: this service is the one that...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.