A live probe of every Kamo Speech capability, with a four-stream load check
The probe runs inside the pod and prints one JSON document for register.py: a TTS round trip per voice and language (recall >= 0.8), the batch STT row, a realti...
Kamo Speech on k3m1 — pinned Speaches, read-only models, DNS-only egress
Keys and NetworkPolicies on in-cluster inference; Kamo reranker and Kamo Local LLM
TEI embeddings and the new cross-encoder reranker require TEI_API_KEY; bergamot, LibreTranslate and the new Kamo-owned Ollama (qwen3:4b) sit behind the Kamo aut...
Pinned, hash-verified model fetch and a warm-up that holds the pod until every model is resident
The warm-up also drops a model whose load failed: Speaches 0.9.0-rc.3 keeps the entry of a failed load, so the next startupProbe would get 409 and /api/ps would...
Svc_ai publishes ai.registry.changed.> (KamoAI SP01 registry events)
Svc_security publishes kamoai.platform.state, svc_kamoai subscribes to it (KamoAI SP02)
SecurityService announces the platform AI kill switch on kamoai.platform.state and KamoAI Service listens for it. rt.org.<org>.ai-workforce needs no new grant: ...
Log in to Redis as mail_rspamd
rspamd reads its password from Secret mail/rspamd-redis-auth, included into local.d/redis.conf. The pod gains fsGroup 11333: the image runs as 11333:11333 and a...
ACL users for the platform, rspamd and operators (default still open)
Start a coder session in the cloud from a local checkout
repository. The bundle is forced because our remotes are Forgejo, not GitHub, and the point is the checkout on this disk. No --permission-mode (the CLI drops by...
Add kamouniverse.com as a second regular-mail domain
Adds kamouniverse.com to postfix's virtual_alias_domains with a local-part-preserving regexp so any address on it lands in the identical kamocrm.com mailbox (no...
Forward kamouniverse.com to kamocrm.com
DNS for the apex and www now point at k1m1's public IP. Add a redirectRegex route on both entrypoints (301, path/query preserved, ACME challenge path excluded o...
An org's own computers host gets a certificate and a route
computers is a standard alias now — every white-label org is told to point one at Kamo on /setup/dns, the way it points meet and sign — so two things had to fol...
Issue and mirror the certificate for computers.kamocrm.com
Opening a Hosted Computer produced a browser tab that appeared and vanished. The launch link is correct and so is the token: SecurityService builds ************...
A way to actually build the golden image
build-golden-image.sh said "Run by CI (see ../../.forgejo/workflows/)". No such workflow was ever written. It needs libguestfs, qemu-img and virt-customize, non...
Per-org VM islands, suspend-to-disk, and a white-labeled golden image
A member's own Linux computer, running as a KubeVirt VM in its organization's namespace and opened from the browser. Separate from desktop/ in every way that ma...
Encode the kamo14 reel
The marketing reel was recut (new closing logo shot) and uploaded as public/kamo14.mp4. It gets a new name instead of replacing kamo13 in place because the ladd...
Bounces for organizations' sending domains reach EmailService through postfix-k3m1-inbound
A campaign sent through the shared relay has its From at the organization's sending domain as its envelope sender, and that domain is a CNAME to contact.kamocrm...
Postmaster@ and abuse@contact.kamocrm.com reach KamoCRM — the shared relay's name receives its checks
contact.kamocrm.com is the shared org relay's name (47.181.8.86's PTR, MX contact.kamocrm.com), and its MX is 47.181.8.86 → k3m1, where postfix-k3m1-inbound ans...
Postfix-orgs, the shared bulk relay every organization sends through as 47.181.8.86
KamoCRM's own campaign mail keeps leaving through postfix-bulk (47.181.8.87) and regular mail through postfix (47.181.8.84). Every other organization's campaign...
Sign Feedback-ID in DKIM signatures
Gmail counts a campaign message toward its Feedback Loop only when the Feedback-ID header is covered by the sending domain's DKIM signature. local.d/dkim.conf k...
Receive postmaster@/abuse@stack.loans on k3m1 for the bulk IP's checks
47.181.8.87's reverse DNS is mail.stack.loans and the router forwards its port 25 to k3m1, but nothing there accepted mail, so a provider verifying who runs the...
Route fbl@/abuse@hello.kamocrm.com complaint reports to EmailService
Spam-complaint feedback-loop reports (ARF, RFC 5965) and abuse reports sent to fbl@ and abuse@hello.kamocrm.com are rewritten to complaints-mail.invalid and han...
Mail to unsubscribe@hello.kamocrm.com reaches EmailService
Every bulk and shared-article message offers an unsubscribe by email (List-Unsubscribe mailto), but mail to that address went to postmaster and was never acted ...
Postfix-bulk accepts any sender from EmailService [skip ci]
The relay is now a platform outbound host that every organization's campaign mail may go through, as whatever From that organization sends as. Only the null sen...
Sign hello.kamocrm.com with its own customer key, by the From domain itself
Campaign mail leaves as hello.kamocrm.com through postfix-bulk. It gets its own DKIM key (selector customer, published as customer._domainkey.hello), and use_es...
Postfix-bulk, a second outbound relay for campaign mail, with delivery results fed back
Campaign mail now leaves through its own relay on k3m1 (egress 47.181.8.87) as hello.kamocrm.com, so complaints about bulk mail never touch the reputation of ma...
Dial 911 and 933 from every extension, with an MLTS email notice
Extensions could not reach 911: no outbound route matched 911 or 933, so from-internal fell through to bad-number and played "cannot be completed as dialed" wit...
Report each account's coder allowance to the console
The Linux Desktop menu is getting two meters — how much of the member's numbers. transcripts do not carry them, and neither OTel metric is about the subscripti...
Say whether a terminal is working or waiting for its member
Every terminal in the listing now carries `state`: busy, or waiting. It is the one question somebody asks of a window they cannot see, and it is what a minimize...
Let a coder session run at the model and effort the member picked
for a new session and for a resumed one alike, since `--model` and `--effort` are per-session flags either way. They are the ONLY part of the command a caller ...
A coder terminal wears the name coder gave the conversation
running had long since been titled "Startup fee implementation and Harmony account adjustment". Two separate things were swallowing that name. **The listing.**...
Budget the last four services to gain a second replica
BillingService, EmailService, KamoLOS and SecurityService now run two pods, each having put its shared-effect scheduled sweeps behind a distributed lease first....
Budget the six services that just gained a second replica
AIService, KBService, ESigService, VOIPService, DocsService and TranslateService now run two pods, so a drain of either node must evict them one at a time rathe...
Measure whether a deploy actually costs anyone a request
Every fix in this programme is a claim about what happens during a rollout. Until now those claims were untested: MediaService shipped with strategy Recreate at...
coder sessions on the dev machine, listed and resumable
is here, because the machine is the only thing that knows any of it. ## The session index home, exactly as their terminals are whatever tmux is running. No ta...
Budget every drain, and fail a deploy that regresses rollout safety
PodDisruptionBudgets for the 25 Deployments that now genuinely run two replicas. minAvailable: 1 lets a drain evict one pod and wait for its replacement instead...
Pin the session id, and link the terminal session into VS Code
`--session-id <uuid>` is chosen at prepare time rather than left to the CLI, which is what makes the editor hand-off deterministic: the id is known before the s...
Host a Send-to-AI dispatch in a Remote Terminal
composed prompt — and answers with an opaque TOKEN. A terminal that connects command typed into it. THE TOKEN IS THE WHOLE SECURITY DESIGN. `bootstrap=<command...
List, rename and end a member's terminals
GET /terminals?user=X, POST /terminals/<id>/kill, POST /terminals/<id>/title. THERE IS NO DATABASE BEHIND THIS, and that is the design rather than a shortcut. ...
Give the agent a PTY endpoint for Remote Terminal
GET /pty upgrades the connection to `kamo-pty` and becomes a shell: one PTY per browser tool window, `su - <user>` into `tmux new-session -A`, frames pumped bot...
64G swap on the dev machine, and catch access that fails intermittently
The blank white page was the VM out of memory. 16Gi of guest RAM with NO swap means "out of memory" goes straight to the OOM killer: applications die mid-work, ...
Open Send To AI in a VS Code session tab, not a Konsole window
A dispatch now starts a BACKGROUND session and hands VS Code its session id, instead of running the CLI in a terminal window: Passing the prompt to the URI in...
Swap the voicemail greeting to KamoCRM-LeaveVM
24.9s, down from 27.9s. Uploaded alongside the previous recording rather than over it, so rolling back is a one-line change to KAMO_VOICEMAIL_GREETING plus a di...
Give every kamocrm extension WebRTC, and gate outbound calling
All 21 kamocrm team members now hold an 8XXX extension on the k1m1 PBX (Chris renumbered off 7255 to 8134). Two changes here back that. WebRTC endpoint blocks ...
Recorded-call notice on extension-to-extension calls
Completes the third call path. Staff-to-staff calls never touch the attendant — they go from-internal -> ext-local, where the Dial belongs to FreePBX — so [from...
Recorded-call notice on direct-dialled extensions too
A caller who dials an extension over the greeting now hears the notice as well. That path went through from-did-direct, where the Dial belongs to FreePBX's ext-...
Recorded-call notice to both parties at once, then a bridge tone
When an agent answers a queued call, the caller hears the client notice and the agent hears the agent notice at the same time, then a shared 1000Hz tone marks t...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.