The agent runs the AI workstation profile when cloud-init asks for it
The agent loads kamo_hc_ai only for KAMO_HC_PROFILE=AI_WORKSTATION: the AI's paths on 9810 behind the agent bearer, the MCP bridge on 9811, the AI's activity re...
AI workstation profile applier, screen guard, software kit and runtime
MCP bridge from the Tool Plane to computer-use-linux
Streamable HTTP on 9811 (JSON answers only, GET 405, Origin 403, per-wake bearer 401, take-over 409) in front of one stdio computer-use-linux child per session....
AI workstation agent module — renderers, MCP token, lease, VNC passwords
The guest half of SP11's AI profile: the files the profile writes (LightDM autologin at 1280x800, kiosk, x11vnc and ydotoold units, Chrome wrapper and managed p...
The PBX speaks through Kamo Speech — kamo_tts.agi, Piper norman at 8 kHz, key from a secret volume
Six Whisper workers and six requested CPUs, so a batch chunk never queues a realtime turn
The acceptance run on k3m1 (4 realtime streams + 1 batch) measured p95 17.9 s: the batch held one of the 4 workers, so one turn waited behind a whole turn. Six ...
Size the reranker's TEI thread pools to its 1-CPU limit
The reranker runs embedding-model's TEI 1.9.4 under the same 1-CPU limit, so it takes the same sizing (KamoAI SP00 final review I-1): one tokenization worker, a...
Mirror GitHub kamouniverse main to Forgejo so a merge deploys
The KamoUniverse marketing site is now edited on GitHub GitHub, and PRs merge there. But the site deploys from Forgejo (kamo/kamouniverse-marketing), whose work...
Record live kontak.kamocrm.com, desktop-1 sizing and the Docs host list
A .forgejo/ change makes the next deploy a full reconcile, which applies every manifest over live state. Four had drifted from live by hand or by another repo's...
Certificate and disruption budget for dev.kamouniverse.com
dev.kamouniverse.com is the new KamoUniverse marketing site (repo kamouniverse-marketing; it carries its own Host() IngressRoute in namespace kamo). The kamouni...
Dovecot pushes mail events to EmailService (Lua push_notification); stop logging secrets
Size every TEI thread pool to the 1-CPU limit, and let probes outlast a batch
TEI 1.5's ONNX backend starts one inference thread per physical host core (24 on k1m1) and reads no thread setting, so under the pod's 1-CPU quota the CFS throt...
The default user may only PING
SP00 stage R3. Persists the runtime rule for a future start of redis-0: default keeps nopass for the unauthenticated readiness probe and may run PING and nothin...
Deploy Kamo Speech, and pre-add the livekit/ hook so SP13 needs no second full reconcile
Kamo Speech's registry facts and its registration through AIService's internal registry
The last wait needs VERIFIED to hold for 120 s. An attestation itself writes VERIFIED and #36 carries no probe time, so a first VERIFIED read cannot tell SP01's...
Transcribe realtime turns over the pod's own loopback
Speaches 0.9.0-rc.3 posts every realtime turn to /v1/audio/transcriptions. With LOOPBACK_HOST_URL unset it makes that call in-process through httpx's ASGITransp...
A live probe of every Kamo Speech capability, with a four-stream load check
The probe runs inside the pod and prints one JSON document for register.py: a TTS round trip per voice and language (recall >= 0.8), the batch STT row, a realti...
Kamo Speech on k3m1 — pinned Speaches, read-only models, DNS-only egress
Keys and NetworkPolicies on in-cluster inference; Kamo reranker and Kamo Local LLM
TEI embeddings and the new cross-encoder reranker require TEI_API_KEY; bergamot, LibreTranslate and the new Kamo-owned Ollama (qwen3:4b) sit behind the Kamo aut...
Pinned, hash-verified model fetch and a warm-up that holds the pod until every model is resident
The warm-up also drops a model whose load failed: Speaches 0.9.0-rc.3 keeps the entry of a failed load, so the next startupProbe would get 409 and /api/ps would...
Svc_ai publishes ai.registry.changed.> (KamoAI SP01 registry events)
Svc_security publishes kamoai.platform.state, svc_kamoai subscribes to it (KamoAI SP02)
SecurityService announces the platform AI kill switch on kamoai.platform.state and KamoAI Service listens for it. rt.org.<org>.ai-workforce needs no new grant: ...
Reserve 768M for the OS so --memory 3G fits in the 4Gi pod
Seastar keeps max(1.5 GiB, 7%) of the cgroup limit plus ~94 MiB per shard back for the OS and refuses to start when --memory does not fit in what is left. With ...
Scylla to 2 CPU / 4Gi, libretranslate request to 10Gi (32 GiB, 6 CPU released)
Scylla: --smp 2 --memory 3G in a Guaranteed 2 CPU / 4Gi pod (14-day peak 0.66 GiB, 0.05 CPU; the database is 2.93 MB). The init container now has requests == li...
Log in to Redis as mail_rspamd
rspamd reads its password from Secret mail/rspamd-redis-auth, included into local.d/redis.conf. The pod gains fsGroup 11333: the image runs as 11333:11333 and a...
ACL users for the platform, rspamd and operators (default still open)
X keeps counting through a sleep, so every resumed computer went straight back to sleep
A member opening their computer got a black tab. The launch was fine, the wake was fine, the resume was fine — and then the machine powered itself off before th...
A cloud session asks for its task in the terminal
description") unless the account has the interactive cloud backend, which this one does not; given one, it creates the session, prints its task for the cloud se...
Start a coder session in the cloud from a local checkout
repository. The bundle is forced because our remotes are Forgejo, not GitHub, and the point is the checkout on this disk. No --permission-mode (the CLI drops by...
ASCII in finalize.sh's log lines — jibri's logger printed the em dash as ???
Xrdp was told its session backend was itself, so nothing ever rendered
Opening a computer gave a black screen that never became a desktop. The cause is one unanchored sed in this file: sed -i 's/^port=.*/port=3389/' /etc/xrdp/...
Recording had never worked — jicofo never looked for jibri, and jibri never arrived
Four separate faults, each enough on its own to stop every recording: - jicofo had no ENABLE_RECORDING, so the image wrote no `jibri {}` block: it never watc...
Recreate, and probe the XMPP session — a surge left meetings with no focus for 18h
Every jicofo logs in to prosody as the same full JID, focus@auth.meet.Meet/focus. The maxSurge rollout from 9da0998 runs two of them at once, and prosody answer...
Two threads rebuilt the initrd at once and destroyed the machine
A computer provisioned, came up, and panicked on its next boot: Run /init as init process Failed to execute /init (error -2) Kernel panic - not syn...
The restart could land mid-initramfs and leave a computer unbootable
A brand new computer provisioned, came up, reported AWAKE, and ninety seconds later panicked: Kernel panic - not syncing: No working init found. I caused ...
Kamo-internal's session-handle secret
kamo-internal 3e3c3e7a mounts **************** (SESSION_HANDLE_SECRET), which seals the per-tab session handles that replace the *** id in page script. Created ...
A resumed computer went straight back to sleep
Thirty seconds after the first real resume, from the machine's own log: kamo-hc-agent: idle 13202s >= 1800s — going to sleep PM: hibernation: hibernati...
Kamouniverse.com redirect was losing to the www.* catch-all
www.kamouniverse.com was served by the kamocrm.com marketing app instead of redirecting: kamo-marketing-route's HostRegexp(\`^www[.].+\$\`) at priority 24 match...
Add kamouniverse.com as a second regular-mail domain
Adds kamouniverse.com to postfix's virtual_alias_domains with a local-part-preserving regexp so any address on it lands in the identical kamocrm.com mailbox (no...
Forward kamouniverse.com to kamocrm.com
DNS for the apex and www now point at k1m1's public IP. Add a redirectRegex route on both entrypoints (301, path/query preserved, ACME challenge path excluded o...
The login greeter was counting as a member using the computer
rdp_sessions() collected every Xorg process with a display argument. The image installs lightdm and lightdm-gtk-greeter, so lightdm runs its own Xorg on :0 on e...
A stale resume_offset would hibernate into the wrong place
resume_configured() checked that `resume=` and `resume_offset=` were present on the running kernel's command line. Present, not correct — and the difference is ...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.