/api/security/cameras relay to KamoCameraService with rights, org stamping and org-chart facts
Retiring an SI takes the admin's choice for its workstation — Delete now, Delete after N days, or Keep
Owner decision 2026-10-11. POST /members/{id}/ai/retire accepts {workstation: KEEP|DELETE_NOW|DELETE_AFTER, deleteAfterDays: 1-365, default 7}; no body or no wo...
The member card reads the communication policy on every channel that binds the viewer — CHAT for a person, CHAT, calls, mail and meetings for an SI, grant-aware, with approvalRequired (KamoCollab CP04 Task 18)
ChatPolicyBeanConfig builds the loader with each rule's channels and the three-argument, grant-aware ChatPolicyService (cached graph for approvers), as MediaSer...
The disclosure ledger export — a CSV recorded as EXPORT before it is built (KamoCollab CP08 T8)
GET **************** takes the list's filters and answers the newest 10,000 events as disclosure-ledger.csv (every field quoted, UTC instants, recipients and so...
I2 resolves a draft of one of a member's layers, the ledger's daily counts per SI, and the disclosure settings hook to kamoai-service (KamoCollab CP15 T4)
- I2 draftLayer {level, id}: only with an existing MEMBER subject and draftItems; the draft is validated for the layer's level (department ancestors for DEPAR...
The disclosure ledger read API — list, stats, source and member endpoints, with the supervisor path (KamoCollab CP08 T7)
DisclosureLedgerController at /api/security/disclosures: GET (list), /stats (event counts per decision plus reads.WOULD_WITHHOLD, R1-19), /source/{kind}/{id} (c...
The DDL file for the metric indexes, with its contract test (KamoCollab CP14 T2)
Three per-organization date indexes for the SI business metrics (spec §5.1, D20): commerce_orders, commerce_quotes and accounts on (org_id, date_created). Hand-...
The disclosure ledger query service — keyset pages on one index per filter, the member union, labels and counts (KamoCollab CP08 T6)
DisclosureLedgerQueryService reads org_disclosure_events and its two child tables over NamedParameterJdbcTemplate. Each entry point builds one driving statement...
Declare the disclosure ledger recorder, with its repository scan (KamoCollab CP08 T5)
DisclosureLedgerConfig declares the shared DisclosureRecorder as bean disclosureLedgerRecorder: the name disclosureRecorder is the EHR's §164.528 @Component, an...
Who a layer save reaches — CharterLayerLoader.layerRefs and GET **************** (KamoCollab CP09 Task 5)
The non-retired SI team members of the caller's org whose charters are built from the layer (ORG, ROLE, DEPARTMENT, JOB_TITLE, TEAM or MEMBER), ordered by displ...
The item_origin DDL on the six charter owner tables, with its contract test (KamoCollab CP10 Task 1)
Records who drafted a charter item (NULL = a person, AI_DRAFT = the SI configure assistant). Hand-applied by CP10 Task 2, before shared-lib CP10 Task 3 is pushe...
Recipient preferences, GET|PUT **************** and POST **************** (KamoCollab CP12 Task 11)
How a person wants SI colleagues to reach them (spec §5.5, D36): a JDBC store over member_collab_preferences and member_collab_channel_order (keyed reads, at mo...
The external field view of a lead, ?fieldAudience=EXTERNAL (KamoCollab CP07 Task 9)
LeadFieldMask.applyExternal keeps exactly spec §5.18's fields, reduces the assignee to name and title, and nulls every other LeadDTO field through a fail-closed...
The ORG charter endpoints — GET /api/security/org/charter for any org session (items, counts, editable with CONFIGURE_SYSTEM) and PUT with CONFIGURE_SYSTEM, a full replace by id in OrgCharterWriter's one transaction, announced to the org's SI members (KamoCollab CP03 T16)
Org disclosure settings, GET and PUT **************** (KamoCollab CP05 Task 13)
Spec §5.5, D6: reads by CONFIGURE_SYSTEM, MANAGE_ACCESS_RULES, VIEW_ACCESS_LOGS or MANAGE_AI_WORKFORCE (or an open god window); edits by CONFIGURE_SYSTEM or a g...
The DDL for org disclosure settings and the two lead communication label indexes (KamoCollab CP05 T1)
org_disclosure_settings (eight columns, a missing row means the defaults, AUDIT by default) and ix_leadcomm_org_source / ix_leadcomm_org_email_thread, which the...
The DDL for the three append-only disclosure ledger tables (KamoCollab CP08 T1)
The hand-applied DDL of spec §5.1: org_disclosure_events, its recipients and sources, seven org-and-time indexes, and a closing REVOKE that takes UPDATE, DELETE...
Manual imports and the intake backlog through the shared mapping engine
LeadImportController maps every row with kamo-shared-library's LeadRequestMapper instead of its own switch, so manual and template imports get the full field se...
The hand-applied DDL for the charter ORG layer, the personality and Docstion columns and org archetypes, and its contract test (KamoCollab CP03 T2)
Spec §5.1's block, character for character: the twelve nullable trait/collab columns on the five charter owner tables, org_charter_items (cascading with its org...
The visible listing's inputs come from the org graph — subordinates, AI supervisees and AI members as id strings; the manager and AI supervisor pairs are gone (KamoCollab CP02 T15)
**************** now takes the caller and reads the organization's org graph from the 60 s cache (orgGraphCache.get): - subordinateMemberIds = reports(caller, t...
The manager line reads the org graph — cycle checks on a fresh graph, the directory on the cached one, and a member's own manager needs MANAGE_MEMBER_SECURITY to change (KamoCollab CP02 T12)
- MemberSecurityController: rejectManager keeps the self, org and record-active refusals and tests the loop with **************** the ten-level bound goes. ...
Reports read the org graph — a TEAM scope and a TEAM share reach the whole subtree, supervised AIs included (KamoCollab CP02 T11)
ReportScopeResolver.reportsTo is reports(member, true) of the cached graph: transitive and unbounded (the old walk stopped after ten levels), following the repo...
Teams at member creation — teamIds on create-team-member, checked before anything is written, joined inside the creation transaction before the first applied rights, announced after the commit (KamoCollab CP01 T14A)
POST **************** (and the /create and /bulk-create paths that share MemberCreationService.create) take an optional teamIds for a person or an AI (master R1...
SecurityService's chat policy reads member facts from the org graph, a graph loaded per snapshot (KamoCollab CP02 T10)
ChatPolicyBeanConfig builds ChatPolicySnapshotLoader with the graph constructor and orgGraphCache::fresh (ruling CP02-T17-3), as MediaService does, so the roste...
Every SecurityService graph write announces the change, the team seam listens, and a ratchet keeps it so (KamoCollab CP02 T8)
Each write path of CP02 spec §3.5 (W1-W15) calls **************** cause) with §5.4.2's causes: member security (roles, department, job title, manager, level, ow...
Teams on the member card and in the directory search — [{id, title}] by title, one team read per page (KamoCollab CP01 T16)
GET /api/security/members/{id}/card names a team member's teams ([] in no team; left out when the read fails, as on the profile). GET **************** gives eac...
Teams in the effective-rights views — the diagnostics cascade's teams level, and Team: sources on the applied rights (KamoCollab CP01 T15)
The diagnostics cascade (GET **************** lists a team member's teams between the job title and the member, {teamId, title, roles, rights}, in the waterfall...
A member's teams from the profile — GET|PUT **************** and teams on the profile and the security view (KamoCollab CP01 T14)
PUT **************** — a team's charter-only save through TeamWriter, announced after the commit (KamoCollab CP01 T13)
The team charter endpoint of spec §5.6/§5.7 on LayerCharterController, beside the role, department and job-title ones: CONFIGURE_SYSTEM or god; the path id, unk...
The TEAM charter layer — a member's teams after the job title, the TEAM subject, teamIds, and team hide markers (KamoCollab CP01 T12)
A member's teams become TEAM layers between the job title and the member, all at one rank and ordered by lower-case title then id; the teams' roles join the ROL...
The team sub-resources (members, rights, roles) and the recalculation endpoint (KamoCollab CP01 T11)
GET|PUT **************** /rights and /roles, and POST **************** (spec §5.7). Reads are open to any session of the org; writes need CONFIGURE_SYSTEM or an...
TeamController — list, create, read, update and delete (KamoCollab CP01 T10)
GET|POST /api/security/teams and GET|PUT|DELETE /api/security/teams/{id} (spec §5.7). Every handler resolves the caller first (401 without an org); reads are op...
The team domain — wire, validation, writer, service and the org-graph seam (KamoCollab CP01 T9)
TeamWire reads a team body tri-state (absent / null / value); TeamValidator checks titles, descriptions, timeouts, roles, rights (normalized as a level), staff-...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.