Deleting a public API key needs MANAGE_ACCESS_RULES, like creating one
Any member of an org could delete the org's public chat / integration keys: deleteKey checked only that the key belonged to the caller's org.
IoT Devices program — master spec, 15 sub-project specs and plans, runbook [skip ci]
Connected-ecosystems design decided by the owner 2026-09-27: Kamo links the ecosystems an org already uses (official APIs only), per-function grants, consent-ba...
Branch Types moves to Platform Administration
Branch Types (the security models child organizations are created under, with their default security roles, apps and home screens) was a tab on every organizati...
Branch types and security models are the platform's to edit
Branch types, the security models behind them (default security roles, app availability, home screens, commerce markets, subdomain config) and the master model ...
MANAGE_BRANCH_TYPES
Branch types, and the security models behind them, move from every organization's Settings -> Account to Platform Administration -> Configuration. This is the p...
Sp00verify lane part 1 (T3, T8, T10, T5, T7): rulings and acceptance rows
A1, A2, A7, A14 PASS; A6 PASS with an environment note; A9 FAIL -> fixed (mcpgatewayservice c44ce1f, ruling CP97-T5-1 in CP12 §7) -> PASS.
Save answers before the rights fan-out, not after it
Saving a security model (e.g. its Default Security Roles) re-seeded and recalculated member rights for every org using the model before it responded. A model sh...
Stamp a communication-policy refusal of a tool with no intent COLLAB_DENY interaction:<ruleId>
An SI's chat_find_or_create_dm refused by the interaction policy answered COLLAB_DENIED INTERACTION_POLICY but left its audit row's policy_decision and policy_r...
Email the accept-window audience when a new lead sits unclaimed for two minutes
LeadAvailableEmailSweep (every 15 s, singleton lease) finds leads that entered the pool 2-15 minutes ago and are still unclaimed, per org via ix_leads_org_creat...
Preview the new-lead-available letter
Adds the LEADS_AVAILABLE arm to sampleVariables, built through the same shared-lib LeadsAvailableEmail helper SecurityService sends with, so the admin preview s...
A letter for an offered lead nobody accepted in two minutes
LEADS_AVAILABLE goes to everyone the accept-lead window offered a new lead to when it is still unclaimed two minutes later. It names the lead by last name and s...
@kamo/kamoai-core 0.2.1, the evaluation client (KamoCollab CP15 Task 18, ruling CP15-T16-4)
The tours really do start by themselves at sign-in
They never had, for anybody. The trigger waited for userInfo.tokenId, which the type declares but the web app's /api/user-info never sends — so it returned befo...
An image attachment that has not drawn holds a placeholder, and one that never answers fails over
An <img> reports load or error and nothing in between, so a request that never answered left an unsized element at 0x0 — a chat bubble with nothing in it. A mem...
An attachment whose bytes were already stored keeps the extension they were stored under
The content-addressed key is <imgDatId>.<ext>, and every reader builds it from the attaching Img's own fileExt. Dedup matches on the bytes, so the same screensh...
A docked chess window is as wide as its board
The window opened at a fixed 560 while the row decided its height, so at the default 690 row the board was 346px square in a 540px column: 97px of empty table e...
Drag-selecting up or left out of a text field scrolls it
WebKit (Safari, DuckDuckGo on macOS — the reporter's browser) only autoscrolls a text field toward the END of its text during a drag-select: dragging up out of ...
CP07 Task 43 ruling T43-9 (an SI's own record with nothing behind it names nobody to ask)
The Settings rail keeps your place in its tree
Choosing a row in the expanded rail ran close(), which also emptied every expanded branch, so each click folded Settings back to its own row and the next sub-to...
A card taller than the room it has scrolls instead of running off the screen
Opened from a name low on a laptop screen (the Interaction Center's "..." on a roster row), the member card was placed below it at full height; once "More" open...
The profile save stores the member's address
The My Profile Address card posted { address, addressDetails, locality, subdivision, postalCode, country } and PUT /members/{id} never read the key, so every sa...
Tours start by themselves at sign-in, a tour controller steers them, and every app on the App Shelf starts its own
- Sign-in: the tours with something new now START on the launchpad, once per sign-in — no offer to click through. God mode no longer stops them (it did, for t...
Related-article rows open the article
The Related Articles list under an open article drew each link as a plain box with no href or click handler, so nothing happened when a reader clicked one. A re...
Tiles recover on their own, a manager's Watch shows the camera, cloud logins never stored in clear
From an independent review of the shipped Cameras screens. Viewer: - A Settings "Watch" of a camera not shared with the manager showed "unavailable": the windo...
CP07 Task 43 ruling T43-8 (an event run carries disclosure_request in full)
Every Show Tour right is on by default — for every role, every branch-type template, and everyone already here
The first release seeded each tour only to roles already holding a right in its app and left every branch-type template at Not Specified: 2,416 role rows held n...
CP13 Task 14 rulings T14-1..9 (follow-ups open and continue after a send)
CP07 Task 43 ruling T43-4 (an approved re-execution is never refused INTENT_REQUIRED)
ExpirePendingForKey and findFirstByPublicKeyAndStatus for the enrollment fixes
KamoCameraService retires a connector's older pending codes when it hands out a new one (an old code read from a log could otherwise be claimed into another org...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.