Consent view and single-use decision bound to the sign-in session, pending grants and codes (IoT SP09)
O3 binds a fresh sign-in to the authorization request with an atomically spent one-time key (IoT SP09)
Authorization requests O1/O2 with RFC 6749 redirect rules, PKCE S256 and rate limits (IoT SP09)
Atomic one-time-key spend, request store, rate limits and redirect URLs (IoT SP09)
Reserve the iot alias; pin iot.<domain> resolution
The rebuild carries DomainAliasType.IOT from the shared library. KnownAliases / SSL_PROBE_LABELS follow only after iot.<apex> answers over TLS (a later commit),...
Kamo OAuth authorization server tables and the iot.alexa client (IoT SP09)
Patient-merge hooks run after the merge commits, so a failing hook can neither undo nor poison it
SP12 remote-monitoring endpoints, the portal connect-devices handler and their guards
SP12 enrollment, consent, pause/resume/end/revoke and the connect link
SP12 monitoring reads, the portal link, and home readings kept out of the chart's recent window
SP12 remote-monitoring foundations — write gate, access, audit, IoT client, merge hook
The No Insubordination Rule — a teammate's direct order lends an SI their rights for that run
Owner 2026-10-15, refined the same day: any team member (a person or another SI) who gives an SI a direct order lends it their rights for the work that carries ...
A person may let SI colleagues greet them with the short form on internal calls
SI call disclosure, owner decision 11 (2026-10-15): the colleague short form ("Hi Sage, it's Luna, the automated assistant.") is used only for active staff who ...
Rebuild to pick up kamo-shared-library 2d2f2efd (JOIN_MEETING action class) so admins can save a JOIN_MEETING charter rule
CreateClaim writes charge and units, sets the claim total, refuses a blank payer
The SP01 IoT entities map on Hibernate 6.2.13, the line SecurityService runs
IoT SP01 Task 7 (mapping half). EmbeddedAttributeMapping is not in org.hibernate.metamodel.mapping on 6.2; the test reads the address through EmbeddableValuedMo...
Verify-password records a session re-check marker and limits wrong attempts
IoT SP01 Task 7 (marker half). KREAUTH<***Id> = member id for 3600 s after a correct password; five wrong passwords per session in 15 minutes answer 429 too_man...
Seed the IoT administration rights to CONFIGURE_SYSTEM holders on the boot that introduces them (IoT SP00)
The IoT tour needs no lineage: every Show Tour right is already on for every role (fefd98c2).
Run the sign-in detection rules, and make their responses real
SuspiciousDetectionService was injected into SecurityController and evaluate() was never called, so every rule an organization configured on the Security screen...
Encrypt legacy signing secrets at boot; a refused target URL is a 400
The service side of kamo-shared-library e58f1a93 (target vetting + DNS pinning, failure categories, encrypted signing secrets). - **************** (re-runnable...
Seal Google/Microsoft calendar OAuth tokens at rest; re-seal legacy rows at boot
GoogleCalendarService and MicrosoftOutlookService stored the access and refresh tokens on third_party_integrations as the provider issued them, although the ent...
Branch types and security models are the platform's to edit
Branch types, the security models behind them (default security roles, app availability, home screens, commerce markets, subdomain config) and the master model ...
Save answers before the rights fan-out, not after it
Saving a security model (e.g. its Default Security Roles) re-seeded and recalculated member rights for every org using the model before it responded. A model sh...
Email the accept-window audience when a new lead sits unclaimed for two minutes
LeadAvailableEmailSweep (every 15 s, singleton lease) finds leads that entered the pool 2-15 minutes ago and are still unclaimed, per org via ix_leads_org_creat...
The profile save stores the member's address
The My Profile Address card posted { address, addressDetails, locality, subdivision, postalCode, country } and PUT /members/{id} never read the key, so every sa...
Every Show Tour right is on by default — for every role, every branch-type template, and everyone already here
The first release seeded each tour only to roles already holding a right in its app and left every branch-type template at Not Specified: 2,416 role rows held n...
The guided-tours read answers the member's CURRENT Show Tour rights
A session carries the rights it was issued with and the routine refresh does not re-read them, so everyone signed in before the Show Tour rights existed saw no ...
The boot-time rights sync inserts a role's missing rights in ONE statement
b8014ab3's deploy never became ready. The 31 Show Tour rights made the row-at-a-time insert loop 31 YugabyteDB round trips per role — ~3.5 s a role, ~490 s acro...
Remember guided-tour steps per person across organizations, and seed every Show Tour right
GET /api/security/guided-tours answers which tour steps the signed-in PERSON has been shown or skipped, as the union over every membership of the same user — a ...
/api/security/cameras/** — the KamoCameras relay (merge feat/kamo-cameras)
CameraController is the trust boundary for KamoCameraService: it resolves the session, checks VIEW_CAMERAS / MANAGE_CAMERAS / MANAGE_CAMERA_SITES (now 334-336; ...
/api/security/cameras relay to KamoCameraService with rights, org stamping and org-chart facts
Retiring an SI takes the admin's choice for its workstation — Delete now, Delete after N days, or Keep
Owner decision 2026-10-11. POST /members/{id}/ai/retire accepts {workstation: KEEP|DELETE_NOW|DELETE_AFTER, deleteAfterDays: 1-365, default 7}; no body or no wo...
An SI's charter read is retried on a YugabyteDB conflict instead of answering 503
GET **************** (I1) resolves the charter in one read-only transaction of 15-25 queries. One "Restart read required" (40001) answered 503 CHARTER_UNAVAILAB...
The member card reads the communication policy on every channel that binds the viewer — CHAT for a person, CHAT, calls, mail and meetings for an SI, grant-aware, with approvalRequired (KamoCollab CP04 Task 18)
ChatPolicyBeanConfig builds the loader with each rule's channels and the three-argument, grant-aware ChatPolicyService (cached graph for approvers), as MediaSer...
The disclosure ledger export — a CSV recorded as EXPORT before it is built (KamoCollab CP08 T8)
GET **************** takes the list's filters and answers the newest 10,000 events as disclosure-ledger.csv (every field quoted, UTC instants, recipients and so...
I2 resolves a draft of one of a member's layers, the ledger's daily counts per SI, and the disclosure settings hook to kamoai-service (KamoCollab CP15 T4)
- I2 draftLayer {level, id}: only with an existing MEMBER subject and draftItems; the draft is validated for the layer's level (department ancestors for DEPAR...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.