SP96 sex on the member profile and at creation, gated as personal data
GET /api/security/members/{id} names sex (FEMALE, MALE or null) only to a caller who may read it (MemberSexAccess, spec D3); the key is absent for anyone else. ...
SP96 DDL for members.sex, pinned by a contract test
A member's sex is a nullable VARCHAR(16) (FEMALE | MALE, NULL = not specified), hand-applied in SP96 Task 3. The contract test keeps the file re-runnable, with ...
Theme folders still showing the retired KamoCRM placeholder move to the KamoUniverse one
Every new org's theme folder is seeded from public/default/. Until today its full logo was the KamoCRM wordmark. The seed is now the KamoUniverse wordmark, buil...
New authenticator enrollments are labelled KamoUniverse
The otpauth issuer was the literal "KamoCRM". Only new enrollments change. An existing authenticator entry keeps its label and keeps working, because the code c...
Kamouniverse.com is the primary apex, and a domain is verified by where it resolves
"Changed the domain from kamocrm.com to kamouniverse.com on /setup/dns. It said it set it but could not verify anything, and after a refresh it still said kamoc...
A feed names the stream it lists (streamGuid)
The browser's feed reloads when /topic/media/feed/<orgId> says a note was written in its own stream. A lead with no notes yet has no post whose guid names that ...
Organizations are created in a KamoUniverse universe and bill from its catalog
KamoUniverse sells Business, Family, Community and Personal plan ladders from the platform org. SecurityService decides which ladder an organization is on, and ...
Kamouniverse.com is a platform apex, not a tenant domain
login.kamouniverse.com and register.kamouniverse.com become the platform's KamoUniverse sign-in and sign-up doors, backed by a root org_domains row on the platf...
Internal resolve for KamoAI and the charter source behind SP02's routes
I2 POST **************** answers S3's resolution for the org it is given, behind the KamoAI secret, with S3's draft reader and S3's org-checked department walk ...
Charter items on role, department and job-title CRUD; charter-only PUTs
Member charter read and edit; nobody edits their own
S4 reads a member's effective charter, S5 its own items with whether the caller may change them, and S6 replaces them (diffed by id). A write runs in MemberChar...
Catalogue and resolve endpoints for the charter editor
S1 GET /api/security/charter/catalog and S3 POST /api/security/charter/resolve (spec 4.8). A member draft refused by S6's edit rule answers with S6's bodies (re...
Write-time checks for hide markers and escalation targets
A refusal leaves a caller's transaction committable, so the member charter PUT still answers 400; a hide marker cannot target another hide marker; a malformed e...
Internal auth and charter access rules
CharterInternalAuth applies SP02's KamoaiInternalAuth rule to the same secret, so the per-handler guard and the prefix interceptor cannot disagree. CharterAcces...
VNC links, AI state reads and a supervisor-session pause for AI workstations
Hire-step owner URLs and sweep tuning in the SecurityService ConfigMap
Audit role and security changes; ARTIFICIAL template and AI floor in model endpoints
Member profile AI state, relabel locks, immediate rights recalculation and audit
Internal routes for credentials, the exchange, the roster, profiles, the charter and the sweep
AI member state, pause/resume/retire and hiring checklist endpoints
Pause, resume and retire AI members; org pause-all; the platform kill switch
Hire AI members as seat-consuming team members with hire steps and no mail
Hire-step orchestrator with prerequisites, budget and replaceable handlers
One step's database failure no longer ends the sweep or a member's run: the step is logged and retried once due, and the steps behind it still run.
MANAGER step and remote clients for every owner hire step
MANAGER and the mailbox/extension copy-back write one column each with a conditional UPDATE (only while empty) instead of saving the member entity: the sweep's ...
Hire-step owner client with bounded timeouts that never throws
A final RuntimeException catch keeps the no-throw promise when the HTTP library rejects a URL before any I/O (a blank base URL leaves a relative one) or cannot ...
Hire-step store with claim, backoff record and retry
An outcome or a prerequisite wait lands only on a step that is still PENDING or WAITING, so a retire during an in-flight attempt keeps the step SKIPPED (SP02-T1...
Hire-step model, owner outcome mapping, backoff and the handler seam
AI members take and release a seat on the organization's primary plan
The claim never takes a spare row beyond the paid seat count (SP02-T17).
The Tasks tab is tasks — served by KBService, gated here like the lead itself
Pre-sized copies of every org logo beside the original
Every surface drew org logos from the original upload: 2.2 MB for crm's full logo at a 30-56px nav/header, 2.95 MB (its .svg stand-in) in the email composer, 4....
Layout choices, and saving contact details as they go
The publish dialog now chooses how the public mortgage application lays itself out (kamo-shared-library ac83bea1): NORMAL or SQUEEZE, contact details at the STA...
Arive through Zapier — connection, inbound events, and per-lead actions
A market bound to Arive gets a connection (four Zapier Catch Hooks for create-loan, update-loan, update-lead and convert-lead, plus one inbound URL whose token ...
Start a coder session in the cloud, and say which terminals are
repository as cwd) and answers `cloud: true`; the machine builds the a cloud session can start from. The terminal listing carries the agent's `cloud` mark throu...
A work address on forgot-password asks for the account's own, shown masked
Members open their account with a personal address (gmail, yahoo) and are later given a work address by their organization, which is the one they remember and t...
DKIM and DMARC advisory endpoints for /setup/dns
Adds two endpoints alongside the existing SPF one, so an org's transactional mail (password resets, invitations, notifications) can carry a DKIM signature and t...
Computers is a standard alias, and the link uses the org's own
Every white-label org points a fixed set of labels at Kamo and computers was not one of them, so an org could follow /setup/dns to the letter and still have a H...
List only the Getting Started steps an organization is asked
An organization whose security model fixes every Compliance answer (no product a member may switch, one age range for each member type) was still counted agains...
Human/AI members, phonetic names, role requirements; fix position saves wiping security
Members - Create, create-team-member and bulk-create accept `intelligenceType`, `namePhonetic` (new accounts only, like the name), and for AI accounts `aiSupe...
The browser-facing surface, and the second Guacamole gateway
SecurityService is the trust boundary for Hosted Computers. It holds the session, the rights and the org chart; ComputeService holds the Kubernetes credentials ...
The member card carries the wallpaper their desktop shows
GET /members/{id}/card gains "wallpaper" for the card's header, resolved the way the console backdrop and the profile hero resolve a member's desktop: none when...
One rule for what a member may do with another, served per member and per roster row
The same five actions — chat, call, email, meet, view profile — were offered from three places in kamo-internal (the Interaction Center row, the chat hex-head p...
The demos booked on a lead, on the lead
GET **************** The lead page's Webinars section has called /api/webinar/leads/{id} since it was written and nothing ever served it — the live API answers ...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.