A member is only told about apps they have
A notification kind belongs to an app — a lead callback is Leads, a meeting reminder is Meetings — but raise() asked only whether the member had muted it. So a ...
The console shows a reader what they may have, and no more
Two things the /kb page reported to anyone holding VIEW_KB_ARTICLES. The corpus. The audience chips an author ticks in the composer — Members, Team Members, Pu...
Enforce the audience chips on every human read
The composer has always offered an author three chips under "Visible to" — Members, Team Members, Public. They were written to the row and indexed into Qdrant s...
Restore the image-proxy and wallpaper work 266357d0 reverted, and land the permissions change it was meant to carry
266357d0 was built with the wrong index. Its tree came from a stale local HEAD rather than from the staged one, so it carried none of the permissions work its m...
A group per app, a console to grant them, and master notes as widgets
Three changes that turned out to be one. THE HOME PAGE. "My Master Note" and "Our Master Note" were bespoke panes rendered straight out of page.tsx, gated on n...
GET /master takes VIEW_NOTES, like every other read here
It was the one read in this controller that took no right, deliberately: the two master notes were called fixtures of the home launchpad rather than the Notes a...
Delete /api/auto-login, which no longer has a caller
The endpoint existed to turn an existing *** cookie into an OTK and a redirect so the login page could forward a signed-in member straight into their workspace....
Seed the master-note widgets from VIEW_NOTES
The two master-note panes shipped with no right at all — "My Master Note" and "Our Master Note" were on every member's launchpad unconditionally — and this is t...
A security group per app, and the master notes as widgets
Ten new rights, 278-287: NOTES_MASTER_MINE_WIDGET and NOTES_MASTER_OURS_WIDGET, each with the four policy children every home widget carries. Both hang off VIEW...
Swap the voicemail greeting to KamoCRM-LeaveVM
24.9s, down from 27.9s. Uploaded alongside the previous recording rather than over it, so rolling back is a one-line change to KAMO_VOICEMAIL_GREETING plus a di...
The invoice takes REVOKE DELETE, not REVOKE UPDATE
attachPdf writes PDF_BLOB_ID after the finalize transaction commits, on purpose: rendering inside it would hold the document-counter row lock across a MinIO rou...
Let a signed-in member reach the sign-in form, and back out of the workspace picker
Two halves of the same problem: the login page was a one-way street. It validated any existing *** cookie on load and, when the session was still good, redirec...
Stop force-cache pinning "this org has no wallpapers" forever
The console backdrop and the member Wallpaper editor both read the tenant's `config.json` for `backgroundImageCount`, and both asked for it with `cache: 'force-...
The grid fetched every page twice, then blanked itself to do it
Opening /leads showed the rows, dropped back to a loading state, and showed them again. It was fetching twice. STOMP raises onConnect on the INITIAL connect ex...
The credit note, the only correction path for a finalized invoice
B3: Kamo owns everything before finalize() and the provider owns everything after, and every provider on the roadmap treats a finalized invoice as immutable. So...
The document counter, and a number that cannot fork
Every existing document number on this platform is a check-then-insert race with no unique constraint behind it: quote numbers are COUNT(...)+1, subscription in...
The invoice entity, with every tax field and no tax engine
Kamo's own invoice, written only by InvoicingService. Nothing on it is supplied by a caller: every figure is derived from the lines on every write, which is the...
Stop the image proxy serving an hour-old copy of another org's branding
Theme asset URLs are stable and say nothing about their contents: an org's simple logo is always `<alias>/img/logo.svg`. Every org is also seeded with the base ...
Make seeded and uploaded branding revalidate, so an org stops being served the base theme it was seeded with
A new organization is seeded with the base theme — the platform's own logo and backgrounds copied to the new org's keys — and those keys never change when the o...
Plans for BL2 (the KAMO_NATIVE invoice) and SW8 (in-home contract compliance)
Choose the KamoDesktop resolution, and stop hiding why a launch failed
The remote desktop tracks the browser window and always has, so there was no way to have MORE desktop than window. A picker now sets a fixed size, stored per br...
Let the caller choose a fixed KamoDesktop resolution
The remote desktop was never locked to a resolution — it tracks the browser window, and always has. guacd honours the client's size and xorgxrdp resizes the X s...
Check in the useUserInfo shared-store handoff
The "no .md in repos" rule is retired. This handoff doc had been kept local-only; it belongs next to the code it describes.
Stop ignoring markdown
The "no .md in repos" rule is retired; docs, plans and READMEs are tracked like any other source file.
Stop ignoring markdown
The "no .md in repos" rule is retired; docs, plans and READMEs are tracked like any other source file.
The REVOKEs three entity javadocs already claimed existed
BillingWormGuard, BillingDispatch and BillingSyncIssue each cite "a REVOKE UPDATE, DELETE in the KamoInitializer migration". No such migration existed — the sta...
Format every phone number a signature prints
The company lines went out as whatever the org record stored — "5555555555" — next to a member's line in the same block, so a signature could show a formatted n...
One formatter for every number, US and international alike
The formatter every phone surface shared kept the LAST TEN DIGITS of whatever it was handed and dressed them as a NANP number, so "+44 20 7946 0958" rendered as...
The billing proxy route, and MANAGE_BILLING_PROVIDER's four TS mirrors
Task 8, the kamo-internal half. Six mirrors of the rights architecture; four of them live here. 3. app/lib/rightsHierarchy.ts MANAGE_BILLING_PROVIDER ...
The relay to InvoicingService, and the right that gates it
Task 8. SecurityService is the authorization boundary; InvoicingService is ClusterIP with no ingress, so this relay is the only way in. InvoicingServiceClient ...
MANAGE_BILLING_PROVIDER (277), a child of commerce settings
Task 8, mirror 1 of 6 (the Java enum) and mirror 2 (the parent(...) line). Id 277 was re-derived from origin/main immediately before allocating it, NOT taken f...
`?bug=<id>` opens that report's drawer
Where the new status-change email lands. It has to name the report rather than the tab: the status filter defaults to New, and that email is by definition about...
Glimmering unread cards, a live badge, and per-status counts
THE BADGE IS ABOUT YOU NOW, NOT ABOUT THE QUEUE. It counted every NEW report platform-wide, so it only ever fell when somebody moved a status — reading the queu...
A window only announces its own conversation
The messageReceived handler dispatches chat:message-received, which is what makes ChatNotificationListener raise a chat window, and plays the arrival tone. Neit...
A relay only forwards its own conversation
ChatSessionSubscriptionManager publishes to a topic named after the session it subscribed FOR, never after the session the frame came from. That is safe only wh...
Filter every durable consumer to its own subject
A durable created through NatsMessageService.subscribe carried no filter subject, so it received the WHOLE stream regardless of the subject it was asked for. Th...
State the company phone column defaults where IF NOT EXISTS cannot swallow them
The 2026-08-27 run proved the ADD COLUMN ... DEFAULT FALSE never applied: ddl-auto builds the SessionFactory before any CommandLineRunner, so Hibernate had alre...
Tell the reporter when Send To AI moves their report
MediaService now emails a reporter whenever their bug or enhancement changes status, but a dispatch applies a status of its own — usually In Progress — through ...
Preview variables for the bug-status-changed template
The admin preview renders a template against a sample variable map, and this one has no arm — so an org administrator opening SYSTEM_BUG_STATUS_CHANGED would se...
Email the reporter when their bug or enhancement changes status
Triage was silent. Somebody filed a report and then had to keep opening the tab to find out whether anyone had looked at it — which is the same as not being tol...
Per-viewer read state, a live badge, and per-status counts
THE BADGE WAS ABOUT THE QUEUE, NOT ABOUT YOU. /new-count counted every NEW report platform-wide, so it could only fall when somebody moved a status — reading th...
Announce the queue change when a report is dispatched to AI
A dispatch is the only thing that takes a report out of NEW from OUTSIDE MediaService, so without this it was the one transition the console's badge learned abo...
Show what THIS phone server costs, not just the org total
The extensions tab showed only the organization-wide figure, so an empty KamoPBX server displayed "21 billable extensions — $63.00 / month". The 21 were on a Fr...
Per-viewer read state for system bug reports
SystemBugView is per VIEWER, not per bug — a firstViewedAt column on SystemBug would let whoever opened a report first clear it off every other manager's badge....
The canonical letter a bug reporter gets when their report moves
A member who files a bug or an enhancement had no way to learn what happened to it short of opening the tab and looking. This adds the template that tells them,...
System_bug_view — who has read which report
Per VIEWER, not per bug, and that is the whole reason it is a table rather than a first_viewed_at column on system_bug: triage is worked by several people at on...
Per-server lines on the extensions summary
The phone server's extensions tab showed the organization-wide figure and nothing else, so an empty KamoPBX server displayed "21 billable extensions — $63.00 / ...
Keyword interception at step 0 on the RingCentral rail (MS1 Task 4)
Today a STOP to a number no MEMBER_VOIP_CONFIG row owns hits the "No member found for to-number" branch and vanishes — and that branch is EXACTLY where an opted...
SmsKeywordService — the one writer for inbound keywords (MS1 Task 3)
Closes the TODO Task 2 left behind. Until this commit a verified inbound STOP reached BulkTextInboundController, was recognised, was logged, and was then DROPPE...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.