The Tool Plane needs per-member sticky routing before a second replica
The replicas comment said scaling needed only a PodDisruptionBudget. Since SP05 Task 31 each pod pools its own clients, and an AI workstation's bridge runs one ...
An AI's task without an assignee is its own
tasks_create without an assignee left an AI's task unassigned in its Inbox. SP02's TASK_HANDOFF moves only tasks assigned to the retiring AI, so self-planned wo...
An approved action runs past its run's call cap; a dry run names read-all
SP98-K-1 (SP05 final review M1): SP10 re-executes an approved action under the run id that asked for it. A run that worked on to its maxToolCallsPerRun answered...
Calendar_free_busy answers who is busy when, never what the block is called
A busy block's title (and its event id) can come from an outside invitation, and calendar_free_busy is not an untrusted tool (SP13's voice bookings call it, and...
An MCP server's refresh no longer closes the client calls are using
The 10-minute refresh (I3) and an admin's test evicted the pooled client before listing, which dropped a legacy SSE stream or DELETEd a Streamable HTTP session ...
An org's alias mail domain is internal on both platform apexes
kamouniverse.com is now the platform's primary apex (kamo-shared-library 0e8cf90f), and **************** moved with it. - ForwardedHosts.internalDomains (the e...
A long workstation wake is asked about less often
An AI workstation's wake took 9 min 19 s against ComputeService's 75 s estimate (SP11 Task 30). Every computer_* call on a waking machine answered WORKSTATION_W...
Name K3's NOT_ENROLLED and a missing phone system instead of misreading them
Found by SP05 Task 36 in production (sp00verify): - ApprovalClient read every 404 from K3 as "not deployed". SP10's K3 is deployed and answers 404 {reason:"N...
An approved action that met a "try again" answer keeps its approval
An approved re-execution on its original key that answered a notice (WORKSTATION_WAKING) or a definitive UNAVAILABLE/RATE_LIMITED released the key and its :appr...
Documents, translation and OCR packs
docs_search, docs_read, translate_text and ocr_document (spec 4.20). A document is routed by DocsService's description before any byte is fetched: text is decod...
The AI's workstation — computer_* tools with auto-wake and lease, workstation pack
Approvals pack — decision-only approvals and approval status
approvals_request asks the AI's approver through kamoai-service K3 with toolName null (nothing is re-executed on APPROVE); a class the charter forbids is refuse...
Phone and SMS packs — consent-checked calls, call history, texting
phone_call posts K6 with the caller's run and key; a reason-less 404 is not deployed, a reasoned one (NOT_ENROLLED) is the endpoint's answer. sms_send opens the...
Knowledge base, sales scripts, RAG, directory and notifications packs
Contacts, leads and accounts packs — search, read, create, update, notes, status, claim, history
The 12 CRM tools of spec §4.20 against EmailService and SecurityService as they are on main (SP05-T27): a status without a sub-status clears the old one; a cont...
Calendar and meetings packs — events, availability, scheduled work, dial-in, invites
Beyond the brief (spec SP05-T26-build): no guessed zone (EmailService applies the member's effective zone); reminders only when asked on a create and never re-s...
Tasks pack — lists, create, update, status, assignment, comments, links
Beyond the brief (SP05-T25): an assignee is read as the member id KBService reads (beyond a long is INVALID_ARGUMENTS), an update that changes nothing or both s...
Notes pack — search, read, create, update, journal, links, master note
What KBService really answers shapes three choices (SP05-T24). notes_search matches the query over the title, body, category and tags as the Notes wall does, be...
Chat pack — conversations, unread, read, send, direct chats, mentions
Beyond the brief (SP05-T23): a mention into a support conversation is a web chat message like chat_send; only a team chat or a support conversation takes a post...
Mail pack — read, search, threads, send, reply, forward, drafts, move, flags
Text helpers, id-safe projections and the fake Kamo services harness for packs
HtmlText lays mail HTML out the way a browser shows it (one jsoup walk: collapsed source whitespace, br, block and paragraph breaks, cells, pre); ThreadIds repr...
Remove the execute-as-org tool endpoints now that AIService uses /mcp
/api/mcp/tools/list and /api/mcp/tools/execute answered for a whole org, which the Tool Plane forbids (D28). No deployed client could reach them (AIService call...
Org MCP servers as ext_* tools over Streamable HTTP and legacy SSE; STDIO retired
A server's own words reach a caller only inside the untrusted wrap; nothing sent is definitive (D45); the URL guard runs on every use; one session and one tool ...
MCP 2025-06-18 server at /mcp (stateless streamable HTTP, JSON responses)
One JSON-RPC message per POST: initialize, ping, tools/list, tools/call; notifications and responses answer 202; GET and DELETE answer 405. The body is read aft...
The tools/call pipeline — policy, approvals, limits, idempotency, dry run, taint, audit
A stored idempotency entry is answered before the planner reads again (SP05-T11-order); an approved call in a tainted run still answers to the capability and ch...
Tool call audit, 180-day retention purge and internal audit read
The insert's transaction is the repository's save (REQUIRES_NEW), begun and committed inside the writer's catch, so no audit failure reaches a tool call. Rows a...
Tool visibility by rights, apps, PHI, risk ceiling, taint, capability and charter
The capability gate caches the router's answer per member (SP04 filter 10 narrows candidates by the member's access policies), keeps a failure to get one for 30...
Charter policy, approvals, outreach gate and external recipients
The charter policy compiles SP03's resolved approvals and limits (fail closed when unreachable, refused or without a resolved block); approvals are created and ...
Downstream calls with the caller's session, internal client, live refresh
Kamo services are called through the BFF's own door per service (*** or a single-use OTK), with the org's workspace host, the actor/run/key headers and spec 4.1...
Idempotency, limits, run taint, rate limit and OTK minting on Redis
Tool descriptors, schema builder and validator, registry
A pattern in a tool's schema is untrusted input: ext_* tools carry their org MCP server's own schema. One Java cannot compile is left to the upstream (and refus...
The service template — Boot 3.3.4, secured internal surfaces, no scheduling
No live credentials in application.yml defaults
The local-development defaults carried the database OWNER's password (${DB_PASSWORD:<literal>}), and apiservice/securityservice also the live changelog webhook ...
Refuse to spawn STDIO for an unlisted config, and refuse to connect an SSE/HTTP one to the cluster network
Defense in depth alongside the AIService commit that closes AiMcpController's missing right checks and STDIO refusal at the source: this service is the one that...
Liveness probe on /actuator/health/liveness, not the DB-aware aggregate
The aggregate /actuator/health includes the DataSource indicator, so restarting the database failed liveness on every pod at once and restarted the whole platfo...
Release idle Hikari connections now that YSQL pooling is shared
The connection manager no longer pins sessions **************** so idle app connections no longer each hold a database backend. Keep the pool maximum, but stop ...
Accept OCI image indexes when resolving the built digest [skip ci]
The images are pushed as OCI image indexes, so asking the registry for a single image manifest only answered 404, the digest came back empty and the check faile...
Restart when a same-commit rebuild leaves pods on the old digest [skip ci]
The rollout step tried to detect a same-commit rebuild by comparing the Deployment's image reference before and after `set image`. "Apply manifests" has already...
Prove the deploy by digest, not by tag
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Say why this one cannot be scaled yet
McpServerManager runs each MCP server as a child process of THIS pod and tracks them in in-memory maps; McpHealthMonitor writes what it finds there into a SHARE...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Pin kamo-shared-library 1.6.0
The library moved to 1.6.0 while every consumer stayed on 1.5.0. Consumer CI builds the library from a fresh clone into a cold ~/.m2 and ci-settings.xml mirrors...
Refuse MCP tool execution for a tenant that handles PHI
executeTool forwards operator-supplied arguments to an operator-typed URL and can spawn a stdio process, with no allowlist, no SSRF guard and no destination aud...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.