CALENDAR_EVENT labels and thread keys on mail rows — the labels endpoint serves every resolver, CalendarEventLabelResolver labels an event of the org (owner, member, department and job-title audiences through the org graph, member attendees; others EMAIL:), and search and conversation rows carry threadKey (KamoCollab CP07 Task 7)
CalendarEventLabelReads reads the event by primary key and organization (live only), its audience and attendees by the event-id indexes, and users to members by...
Labels with the principal-private fallback, the source ledger with encrypted excerpts, withheld items and held decisions; mount the platform key (KamoCollab CP07 Task 16)
LabelService resolves labels through CP05's DisclosureLabelClient over the six owners (60 s cache per org and ref; inherited refs to depth 3); a ref no owner la...
HumanShareGate — one check of a person's deliberate share against DisclosurePolicy (D23's ALLOW, WARN or BLOCK; D24's mode, acknowledgement and dry run) and its one ledger event through DisclosureRecorder, written before the share and failing closed in ENFORCE (KamoCollab CP05 Task 27)
The org graph and its eviction, the disclosure settings cache, Redis hash operations and the run context endpoints (KamoCollab CP07 Task 15)
Decision 4 on every recording read — participants, their chain, VIEW_CALL_LOGS, a linked lead's readers, in every org (KamoCollab CP05 Task 21)
RecordingController now runs tenancy (404), then the PHI capability (403), then CallRecordingAccess through access/RecordingAccessService (403 RECORDING_NOT_PER...
The external field view of a lead, ?fieldAudience=EXTERNAL (KamoCollab CP07 Task 9)
LeadFieldMask.applyExternal keeps exactly spec §5.18's fields, reduces the assignee to name and title, and nulls every other LeadDTO field through a fail-closed...
The ORG charter endpoints — GET /api/security/org/charter for any org session (items, counts, editable with CONFIGURE_SYSTEM) and PUT with CONFIGURE_SYSTEM, a full replace by id in OrgCharterWriter's one transaction, announced to the org's SI members (KamoCollab CP03 T16)
CallRecordingAccess and LeadCommsReadRule — decision 4's one rule for every recording door (god, participant, VIEW_CALL_LOGS, VIEW_VOICEMAIL for a voicemail, the management chain under decision 3a, the lead Communications gate), its facts loader, and the lead read rule moved to shared-lib (KamoCollab CP05 Task 12)
The org graph in KBService and every note read through the one widened predicate — shared notes reach their audience read-only; create and update refuse a shared scope (USE_RELEASE) and the reserved categories (RESERVED_CATEGORY) (KamoCollab CP05 Task 15)
- orggraph/OrgGraphBeanConfig + OrgGraphEventListener: the loader, the 60 s cache, and a core subscription to security.orggraph.changed.* that evicts the or...
SourceClearance and ReleaseAuthority — the structural bases (self or participant, existing access, the management chain with decision 3a's setter) and release authority (participation, the Confidential setter, the releaser's span), with their records (KamoCollab CP05 Task 11)
Work links for tasks — POST **************** answers who has an open task on which records (KamoCollab CP04 Task 9)
TaskWorkLinkService implements WorkLinkResolver: an open task (not DONE, on a live checklist, in the org) links its assignee and creator to the task itself (TAS...
Confidential thread markers and EMAIL_THREAD labels — PUT …/thread-confidential on member and shared mailboxes, one audited writer, threadKey and threadConfidential on both message GETs, POST **************** the org graph (KamoCollab CP05 Task 20)
EmailThreadKeys is the one thread-naming rule **************** now calls it): root Message-ID, UUIDv5 thread id, and the EMAIL_THREAD key without angle brackets...
A person asks their manager to open a chat the communication policy holds for approval, and an approval opens a 30-day contact grant (KamoCollab CP04 T14)
Session endpoints POST|GET **************** GET …/{id}, POST …/{id}/decision; the administrator's GET **************** (MANAGE_CHAT_SETTINGS). CONTACT_REQUESTED...
Org disclosure settings, GET and PUT **************** (KamoCollab CP05 Task 13)
Spec §5.5, D6: reads by CONFIGURE_SYSTEM, MANAGE_ACCESS_RULES, VIEW_ACCESS_LOGS or MANAGE_AI_WORKFORCE (or an open god window); edits by CONFIGURE_SYSTEM or a g...
Validation accepts PERSONALITY and DocsTION — the trait rules per key type, ordered groups, linked tendencies that cannot be locked, archetype references in one spelling, the linted note, the seven Docstion kinds with their fields, ranges and per-layer uniqueness, org archetype items, and ROLE hide markers (KamoCollab CP03 T12)
RELEASE_TO_ORGANIZATION (333) under VIEW_NOTES, never grantable to an SI (KamoCollab CP05 Task 9)
Releasing a note or decision to the whole organization is an act on a note the releaser can read, so it hangs off VIEW_NOTES in the Notes app (spec D21). It is ...
Declare the disclosure ledger recorder, paired with its repository scan (KamoCollab CP08 Task 12)
DisclosureLedgerConfig declares DisclosureRecorder; EmailServiceApplication's @EnableJpaRepositories gains **************** in the same commit. DisclosureLedger...
Declare the disclosure ledger recorder, paired with its repository scan (KamoCollab CP08 Task 12)
DisclosureLedgerConfig declares DisclosureRecorder; MediaServiceApplication's @EnableJpaRepositories gains **************** in the same commit. DisclosureLedger...
Declare the disclosure ledger recorder, paired with its repository scan (KamoCollab CP08 Task 12)
DisclosureLedgerConfig declares DisclosureRecorder; KBServiceApplication's @EnableJpaRepositories gains **************** in the same commit. DisclosureLedgerWir...
Declare the disclosure recorder, carry the policy columns, and pre-mint the audit id in a CallLedger (KamoCollab CP08 Task 9)
DisclosureLedgerConfig declares DisclosureRecorder, with **************** joining @EnableJpaRepositories in the same commit. mcp_tool_call_audit gains policy_de...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.