Design for per-member dev machine provisioning
Covers the root cause of the 23-day KamoDesktop outage (netplan matching a first-boot MAC that KubeVirt regenerates on every VMI recreate), the live fix already...
Stop parsing the org id straight back into a rounded number
SecurityService now sends ids past Number.MAX_SAFE_INTEGER as strings so they survive JSON.parse. That was being undone one line into the client: OrganizationDT...
Send int64 ids to the browser as strings, without touching sessions
CockroachDB unique_rowid() ids are 19 digits, past Number.MAX_SAFE_INTEGER, so an id sent as a JSON number arrives in the browser with its low digits rounded aw...
Delete the dead Long-as-string config and pin why it must stay dead
JacksonConfig registered a **************** serializing Long as String -- the standard guard for CockroachDB ids, which run past JavaScript's MAX_SAFE_INTEGER. ...
Stop sending an address field the server no longer has
A department's contact address is derived from the assigned mailbox server-side, and `email` was dropped from the create and update requests when the mailbox po...
Stop rejecting request fields the DTO does not have
Declaring an ObjectMapper bean takes binding away from Spring Boot's auto-configured one, and a hand-built mapper carries Jackson's defaults rather than Boot's....
Replace the stock alert with an animated status plate
The inline sign-in messages ("Login successful! Redirecting...", "Invalid username and/or password.") used MUI's default Alert, whose pastel fill plus matching ...
Lift icon contrast where the mark sits on a tinted bubble
The reported case is the brand green on a tint of itself: --color-primary against rgba(107,142,58,0.15) is 3.43:1. That clears the 3:1 WCAG 1.4.11 floor for gra...
Add the 25-year anniversary seal
Two placements, both chosen for where the claim is already being made: Footer — 60px, beside "© 2001–<year> ... established 2025". Site-wide, ...
Show the 2001 copyright range and the incorporation year
Renders "© 2001–<year> KamoCRM. KamoCRM Inc. established 2025. All rights reserved." The range start is hard-coded next to the dynamic end year rather than livi...
Add the meeting and payroll integrations
Zoom and Microsoft Teams for meetings, and the ten payroll vendors — ADP Workforce Now, BambooHR, Dayforce, Gusto, Paychex Flex, Paycor, Paylocity, Rippling, UK...
Count apps and integrations separately with real numbers
"Apps & Integrations" was one tile reading 31+. It is now two, each with a figure that can be re-derived rather than estimated: Apps 64 — Forgejo pro...
Reset the home headline on a display face and one light pass
The h1 stacked four effects: a fade wrapper, mouse parallax on each line, per-character 3D rotation on line one, and a blue/purple/green gradient cycling across...
The result screen answers to the logo overlay too
The success/error screen shown briefly before redirect was the one logo in the sign-in flow still rendering untouched. It kept its own design rather than joinin...
Record the ProxyHmacFilter rollout and what it does not cover
Two ordered steps, the checks that made the second one safe, and the reason the order matters: kamo-internal had to be signing before KamoLOS started validating...
Enable ProxyHmacFilter — step 2, X-Org-Id is now a proven header
los.proxy-hmac.enabled has been falling through to its false default since this service deployed, so ProxyHmacFilter existed and never ran. X-Org-Id — the heade...
One loading screen instead of four, all on the full logo
There were four copies of the same full-screen loading markup — the navigation screen, both of /validate's pre-result screens, and /logout — identical down to t...
Sign the proxy identity headers — step 1 of enabling ProxyHmacFilter
KamoLOS trusts X-Org-Id and X-Member-Id from this proxy. ProxyHmacFilter exists to prove those headers really came from here, but it is disabled in production: ...
Scope statements, draws and payments to the caller's organization
Same bug as LoanController.get(uid), repeated: these controllers took a loan id off the path and handed it to a repository, so GET /api/los/statements/by-loan/4...
Resolve the KamoMeet logo overlay into config.json
KamoMeet is a Meet fork with no access to OrgContext, so it learns org branding from the theme config.json this service bakes. The org stores an overlay TOKEN; ...
Add the kamomeet_logo_overlay column
Third overlay surface: the KamoMeet pre-meeting screen. Same shape as the other two — nullable, no backfill, no DEFAULT. The drift guard needed only its field ...
Carry the KamoMeet logo overlay on Organization
Third and last overlay surface, same vocabulary as its two siblings, plus its branch in the generic patch path. This one is different in where it ends up. The ...
Correct the record — KamoLOS is deployed, and has been for 78 days
§12 concluded that KamoLOS had no deployment and that gating it was therefore free, and the LOS proxy repeated the claim in a comment. Both are wrong. The servi...
Restore the CRLF endings of the two files the last commit reflowed
3bfe883c rewrote PublicProvider.tsx and the org route wholesale — 1919 and 121 lines for what was a one-line addition to each. The content was intact; the endin...
A logo overlay for the KamoMeets pre-meeting screen
Third and last surface, offered next to the other two — same thirteen options, its own setting, default No Overlay. Hidden unless the org can actually reach th...
16 unenforced becomes 13 — reports and dashboard deleted, tasks kept
VIEW_DASHBOARD, VIEW_REPORTS and EXPORT_REPORTS are gone from the mirror, both parent maps, the pinned counts and useUserInfo's enumeration, and app/dashboard a...
Purge the reports and dashboard rows, and stop seeding VIEW_DASHBOARD
VIEW_DASHBOARD (0), VIEW_REPORTS (1) and EXPORT_REPORTS (2) were deleted from RoleRightType today, along with the two pages they named. This removes what they l...
Delete VIEW_DASHBOARD, VIEW_REPORTS and EXPORT_REPORTS
All three named pages that existed on disk and were backed by nothing: app/dashboard rendered sample posts straight out of i18n, app/reports imported framer-mot...
App icons on the wizard's Apps & Features step
The create-network wizard drew each app as the first letter of its name, so the same app was a storefront on Settings -> Features and an "S" here. The icons alr...
A solid-colour overlay for the loading screen logo too
Adds "Loading Screen Logo Overlay" directly under the home page one on **************** with the same thirteen options, applying to the logo on the screen shown...
Rebuild against the shared-lib loading_logo_overlay column
No source change. CI clones kamo-shared-library at build time, so Organization.loadingLogoOverlay is only mapped once this rebuilds — until then the generic PUT...
Add the loading_logo_overlay column
Second surface for the logo overlay feature: the loading screen shown between page navigations, alongside the home page masthead. Both ALTERs live in the one r...
Carry the loading screen logo overlay on Organization
The same overlay vocabulary as homeLogoOverlay, applied instead to the logo on the loading screen shown between page navigations, plus its branch in the generic...
17 unenforced becomes 16 — support topic creation takes its own right
POST /support/topics was gated on MANAGE_SUPPORT, the parent, so the child right looked dead while being the thing checked. It now takes CREATE_SUPPORT_TOPICS, ...
Creating a topic takes CREATE_SUPPORT_TOPICS, not its parent
The gate was already there and refusing callers — on MANAGE_SUPPORT, the parent — so CREATE_SUPPORT_TOPICS read as decorative in every editor while being exactl...
Campaigns take the bulk-email rights, like the recipient resolver already did
Bulk email was half-enforced and the halves were in different services. **************** in SecurityService has gated recipient resolution on MANAGE_BULK_EMAIL ...
18 unenforced becomes 17 — bulk email campaigns are gated
VIEW_BULK_EMAIL and MANAGE_BULK_EMAIL now cover the campaign and provider surfaces in EmailService, which checked nothing, joining the recipient resolver in Sec...
Stop losing the brand palette on the way to the browser
Organization.fromJSON could not read back its own output. It mapped the brand ramps only from the nested `colors` object SecurityService sends, but what it EMIT...
Pick the assigned agent from the directory, not a dropdown
The Assigned Agent field is now the same control as Manager on a member's profile: a read-only field that opens the searchable member picker. A dropdown could o...
Narrow the member search to holders of a given right
The lead assignment picker needs the directory to return only people who can actually work a lead, so /team-members/search takes a requiredRight. An unrecognise...
Let the directory filter by right, and let a lead be unassigned
Two things the assignment picker needs. The directory queries take an allowed-id set so a caller can narrow the search to the people a thing may actually be gi...
20 unenforced becomes 18 — marketing materials and social media are gated
VIEW_MATERIALS and VIEW_SOCIAL_MEDIA now have server enforcement, alongside their MANAGE counterparts which were client-only. 29 endpoints across seven MediaSer...
Materials and the social timeline take rights, not just ownership
MANAGE_MATERIALS and MANAGE_SOCIAL_MEDIA counted as enforced in the audit and every site was a .tsx file. Behind them 29 endpoints checked ownership and no righ...
The analyzer could not see nested arguments — six rights were never decorative
26 unenforced becomes 20, and none of it is new enforcement. The six sales-agent rights have been gated the whole time: AiSalesAgentController checks them acros...
The editors say "Enforced as MANAGE_TIMECARDS" instead of "Not yet enforced"
One chip was carrying two different truths and misleading in opposite directions. Unbuilt means nothing checks the right and granting it does nothing. Supersede...
Eleventh cluster triaged — employees, time off and schedules all stay
The first cluster whose honest answer is "no action", and two of the six looked deletable until the last check. TimecardService has one authentication boundary...
Let a failed branding save say what actually went wrong
"Save failed: Failed to save branding identity settings" discarded the status and body of a PUT that enforces the applied security model, so a 403 whose reason ...
Stop failing a branding save over compliance flags it never sent
PUT /org/{id} derived the age ranges and the three ATF flags from the stored row whenever a request omitted them, then asserted all five against the applied sec...
Judge the ATF flags a request changes, not the stored row
**************** judges all three flags every time, so an update path had no way to say "this request does not touch tobacco". Callers filled the gap by re-deri...
28 unenforced becomes 26 — AI models and usage are gated
MANAGE_AI_MODELS gates all four endpoints of AiModelController and VIEW_AI_USAGE both of AiUsageController. Neither checked a right before, only org ownership. ...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.