Plain-language approval cards, worded as the reader may see them
Owner order 2026-10-20: approvals showed members GUIDs and JSON. POST **************** (internal auth) words each approval for a non-technical person: one sente...
IoT articles follow the fixed product — Sign in again keeps settings, SolarEdge app asks its sites, Tuya asks its region
solaredge, geotab, shelly, samsara, tuya, iot-relink-a-connection, iot-open-shared-access (Devices shared with you in the menu). Help re-import needed for these...
Vendor sign-ins ask their settings, Sign in again keeps them, and the SP14 audit's web findings
- Link wizard: a vendor sign-in (SolarEdge app site IDs, Tuya region) asks the provider's declared settings before the vendor opens; a refusal to start reads ...
An MMS part is stored in one transaction of its own (SITP MMS)
Live check in sp00verify: the picture was fetched and its object written, then the dat's final 'published' save failed (JpaSystemException) because the backgrou...
The texting window shows the pictures, recordings and files people text in (SITP MMS)
Each message's inbound parts (VOIPService now keeps them) draw inside its bubble: pictures in place (tap to open), voice notes and video with players, PDFs and ...
The web Alexa section, its virtual sensors, and Alexa links as the who of a grant
- Settings -> Devices (IoT) -> Connections gains a Voice section (only while Alexa is usable by the organization): the Alexa links, how to link one, and a lin...
Brand and state colours read at AA in both themes; grid header strips are not scroll regions; AgentSelector chips are not inside a button
- StateChip/Kicker (patients, knowledge base, attendance, chat policies): the ink is the tone's own hue with its OKLCH lightness capped (light) or floored (da...
The MMS part claim names its states as parameters, so Hibernate 6.2 can read it at boot (SITP MMS)
8eda899's deploy never rolled: Spring Data validates every @Query at startup and Hibernate 6.2 cannot interpret a nested enum's FQN literal **************** so ...
Restrict from Disabled says what it does; site modes article states the previous-mode return (IoT close-out F10, F9e)
- The platform connector dialog's Restrict confirmation, on a DISABLED connector (now offered for every provider with platform setup after a fresh test, iot-s...
Index member_notifications by (source_type, source_id) for withdrawal across members (IoT close-out F15)
The withdraw-by-source read (findBySourceTypeAndSourceId) and the IoT alarm's withdraw-by-prefix (StartingWith -> LIKE 'x%') had only the member-led index, so b...
KamoCameras in the entitlement catalog, on the platform's own plan only (totality test green)
KamoCameras (ServiceType 39, shipped 2026-10-13, TESTING) shipped without an AppEntitlementCatalogMigration entry, so **************** two totality checks have ...
AiAutonomyModeTest pins CP07's RELEASE_PROPOSAL draft kind, and no @Immutable entity may carry a database-generated value
- **************** was red on main since KamoCollab CP07 Task 5 (8bd0f67c) appended **************** (spec D25, a disclosure_request's approval) without updat...
Sms_read_attachment, and sms_read_thread names what was texted in (SITP MMS)
TP11 deferred sms_read_attachment because VOIPService kept no inbound MMS media; it does now (voipservice@8eda899). So: - sms_read_thread lists each inbound pa...
The alert chat leg resolves its people per organization; an IoT alarm update is quiet on iOS
F12 (IoT close-out, SP14 routing): AlertChatService defaulted to organization 1 and the aliases "sage" / "kamo-monitor", which name nobody in production, so eve...
Keep the pictures and files people text in, for every provider (SITP MMS)
VOIPService stored only the words of an inbound MMS, so nobody (person or SI) could see what was texted in. Now every inbound rail reads its media and VOIPServi...
A dat's object key also asks the inbound MMS parts that hold it (SITP MMS)
VOIPService now keeps the pictures and files people text in (VOIP_MESSAGE_ATTACHMENT) through storeContentAddressed, with no Img row. storageExtension found a d...
Master section 10 R7 — the owner's round-3 answers and what shipped [skip ci]
An SI on a teammate's order can find and operate just the function the order needs; on god's order also unverified ones (IoT R7 round 3)
- IotPack.planSend: when the SI's own view lacks the device or the function (or may not OPERATE it) and the caller is on an order-scoped session, IoTService's...
An order's tool call runs on a per-call scoped order session that lends only what the tool needs (No Insubordination Rule, IoT R7 round 3)
OrderDelegation.resolve takes a CallScope: the tools/list keeps the session lending the requester's whole standing (kamo:tool:order:<runId>), so the SI knows wh...
God eligibility alone passes CONFIGURE_SYSTEM only in the platform org; elsewhere only an open window (IoT R7 round 3)
**************** let GD (eligibility, no window) pass every tenant right in every org, so the System User held CONFIGURE_SYSTEM (organization sounds) in every t...
An order lends only the rights the called tool needs (No Insubordination Rule, IoT R7 round 3)
POST **************** takes an optional neededRights (RoleRightType names; an unknown one is a right nobody holds). With it, OrderDelegationService.lend borrows...
God eligibility alone passes a right only in the platform org; elsewhere only an open window (IoT R7 round 3)
AuthHelper.hasRight / requireRight let GD (god ELIGIBILITY, no window at all) pass EVERY tenant right in every org (24 controllers: reports, social media, acces...
GodPassesRightChecks — god eligibility alone counts only in the platform org (IoT R7 round 3)
Owner rule (2026-10-18): outside the platform organization god acts only through break-glass. **************** an open window always passes a tenant-right check...
Master section 10 R7 — the owner's answers of 2026-10-18 and what shipped [skip ci]
Index loan_files.loan_transaction_id, applied to production 2026-10-18 [skip ci]
Owner approved. The deal -> loans lookup in **************** (deal status, pipeline summary, retireIfEmpty) moves from a sequential scan to an index scan. Same ...
Index loan_files.loan_transaction_id on LoanFile
The deal -> loans lookup **************** deal status, pipeline summary, and the retireIfEmpty check after an application is deleted) was a sequential scan. The...
The activity says "as god, break-glass <window>", and god's own window may share (master section 10 R7)
Owner 2026-10-18: every action is visible to the tenant. actorText appends iot.actorStanding.asGod / asGodBreakGlass (dictionary e7519fa8) for god's rows and an...
Fixtures stamp the god-mode window's end; an elapsed window is not elevated (shared SessionPlatformFacts expiry)
**************** now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1), so the open-window fixtures of the 28 test classes whose gates read it (Sess...
A closed god-mode window is closed here too (shared SessionPlatformFacts reader)
Seventeen VOIPService gates (CallController, the VoIP admin controllers, the SMS inventory and bulk-text controllers, DoNotContactController, RecordingAccessSer...
The IoT live-topic check carries the subscriber's session, so god's break-glass window can be honoured (IoT R7)
A god-mode window is a property of the session, not the member, and the STOMP authz calls to iot-service named only the member, so god in another org could not ...
A closed god-mode window is closed here too (shared SessionPlatformFacts reader)
ViewerPlatformFacts (the ENTER AS SYSTEM USER verdict on support tickets) read GD && godModeActive itself. SecurityService masks an elapsed 30-minute break-glas...
A closed god-mode window is closed here too (shared SessionPlatformFacts reader)
**************** read GD && godModeActive itself. SecurityService masks an elapsed 30-minute break-glass window only for its own gates, so this service, reading...
An SI on god's order sees and can ask for god's devices (IoT R7, No Insubordination Rule)
IotViewRules: an SI's manifest whose caller block names god's standing (caller.god PLATFORM | BREAK_GLASS) and the requester (caller.godOnOrderOf) keeps SAFETY_...
Fixtures stamp the god-mode window's end; an elapsed window is not elevated (shared SessionPlatformFacts expiry)
**************** now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1). **************** god fixture carries the stamp, and a new case pins that an ...
GodModeVerifier judges the god-mode window at its own clock (shared SessionPlatformFacts expiry)
**************** now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1). windowOpen(session, memberId, now) asked the shared reader at the system clo...
AiCaller judges the god-mode window at its own clock (shared SessionPlatformFacts expiry)
**************** now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1). AiCaller.fromSession(session, now) asked the shared reader at the system clo...
Fixtures stamp the god-mode window's end; an elapsed window is not elevated (shared SessionPlatformFacts expiry)
LosRightsFilter reads the window through the shared SessionPlatformFacts, which now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1). The open-wind...
GodWindows finds a member's open break-glass window among their sessions (IoT R7)
Pure (no stereotype, no Redis client): the caller reads ***UIDX<userId> and hands the sessions in. A window counts only in the member's own session (not imperso...
A god-mode window is open only until its stamped end (SessionPlatformFacts)
godModeActive() now also needs godModeExpiresAt (epoch millis, number or string) to be after now. SecurityService masks an elapsed window only for its own gates...
The endpoint ratchet sees @RequireRight; the org-graph ratchet allows two read-only hits (SITP TPGUARD)
**************** flagged the TP02 billing and commerce-invoice relays. Not a hole: every commerce-invoice handler carries @RequireRight (TenantRightInterceptor ...
Deleting an application that must be kept shows why instead of doing nothing (SITP TP21FU)
SecurityService now answers 409 for a received mortgage application (a record of business, withdraw it instead). The delete handler had no catch, so the rejecti...
Master section 10 R7 — god has total control (owner 2026-10-18) [skip ci]
Staff can delete a never-received mortgage application; a received one answers 409 (SITP TP21FU)
DELETE **************** went through AppMortgageService.delete, which 500'd for every application (borrower satellite rows left behind). The shared library now ...
Every clinical audit row names its patient; pick up the shared-lib audit and updated_at fixes (SITP TP23FU)
Production phi_access_log rows from the clinical audit methods carried no purpose, basis or patient: the shared PhiAccessRecorder dropped them while stamping th...
Clinical audit rows keep purpose/basis/patient; updated_at stamped on every save (SITP TP23FU)
PhiAccessRecorder stamped occurredAt by rebuilding each event from a field list written before the clinical columns existed, and no caller sets occurredAt, so e...
Deleting a mortgage application no longer 500s, and a received one is kept (SITP TP21FU)
DELETE **************** failed for every application: AppMortgageService.delete removed the borrowers through the JPA cascade while borrower_declarations / borr...
God's controls are usable and need no co-signer (master section 10 R7)
Owner 2026-10-18: god (the platform owner) operates every IoT function; in another org only inside break-glass. The manifest's caller.god (@kamo/iot-core 0.9.0 ...
Rebuild for the owner's legal decisions and the real referral cookie names
The text is in kamo-translation-dictionary b6d42a87 (Privacy 4, 7, 9; Terms 2, 8; Cookie Policy referral rows).
The deploy-safety audit accepts a reasoned 'spread' exemption for a node-pinned Deployment
Every KlusterServices deploy since run #337 ended red on kamoai-voice (3 replicas pinned to k3m1 by nodeSelector, so no hostname spread is possible). The rule h...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.