The disclosure ledger read API — list, stats, source and member endpoints, with the supervisor path (KamoCollab CP08 T7)
DisclosureLedgerController at /api/security/disclosures: GET (list), /stats (event counts per decision plus reads.WOULD_WITHHOLD, R1-19), /source/{kind}/{id} (c...
The DDL file for the metric indexes, with its contract test (KamoCollab CP14 T2)
Three per-organization date indexes for the SI business metrics (spec §5.1, D20): commerce_orders, commerce_quotes and accounts on (org_id, date_created). Hand-...
The disclosure ledger query service — keyset pages on one index per filter, the member union, labels and counts (KamoCollab CP08 T6)
DisclosureLedgerQueryService reads org_disclosure_events and its two child tables over NamedParameterJdbcTemplate. Each entry point builds one driving statement...
The cross-table charter DDL guard pins item_origin on all six owner tables (KamoCollab CP10 Task 3, R1-4)
Red until shared-lib's CharterItem maps item_origin (CP10 Task 3), green with it and the CP10 Task 1 DDL file. Test-only; push after the shared-lib commit.
Declare the disclosure ledger recorder, with its repository scan (KamoCollab CP08 T5)
DisclosureLedgerConfig declares the shared DisclosureRecorder as bean disclosureLedgerRecorder: the name disclosureRecorder is the EHR's §164.528 @Component, an...
The S3 draft test builds CharterController with the affected-members service main added (KamoCollab CP03 T15)
Who a layer save reaches — CharterLayerLoader.layerRefs and GET **************** (KamoCollab CP09 Task 5)
The non-retired SI team members of the caller's org whose charters are built from the layer (ORG, ROLE, DEPARTMENT, JOB_TITLE, TEAM or MEMBER), ordered by displ...
The item_origin DDL on the six charter owner tables, with its contract test (KamoCollab CP10 Task 1)
Records who drafted a charter item (NULL = a person, AI_DRAFT = the SI configure assistant). Hand-applied by CP10 Task 2, before shared-lib CP10 Task 3 is pushe...
Recipient preferences, GET|PUT **************** and POST **************** (KamoCollab CP12 Task 11)
How a person wants SI colleagues to reach them (spec §5.5, D36): a JDBC store over member_collab_preferences and member_collab_channel_order (keyed reads, at mo...
The catalogue pins the disclosure engine's RELEASE_INFORMATION action class, twenty-one in all (KamoCollab CP03 T17)
The external field view of a lead, ?fieldAudience=EXTERNAL (KamoCollab CP07 Task 9)
LeadFieldMask.applyExternal keeps exactly spec §5.18's fields, reduces the assignee to name and title, and nulls every other LeadDTO field through a fail-closed...
The ORG charter endpoints — GET /api/security/org/charter for any org session (items, counts, editable with CONFIGURE_SYSTEM) and PUT with CONFIGURE_SYSTEM, a full replace by id in OrgCharterWriter's one transaction, announced to the org's SI members (KamoCollab CP03 T16)
Org disclosure settings, GET and PUT **************** (KamoCollab CP05 Task 13)
Spec §5.5, D6: reads by CONFIGURE_SYSTEM, MANAGE_ACCESS_RULES, VIEW_ACCESS_LOGS or MANAGE_AI_WORKFORCE (or an open god window); edits by CONFIGURE_SYSTEM or a g...
The catalogue pins CP04's SEND_INTERNAL_MESSAGE action class, twenty in all (KamoCollab CP03 T14)
The DDL for org disclosure settings and the two lead communication label indexes (KamoCollab CP05 T1)
org_disclosure_settings (eight columns, a missing row means the defaults, AUDIT by default) and ix_leadcomm_org_source / ix_leadcomm_org_email_thread, which the...
The DDL for the three append-only disclosure ledger tables (KamoCollab CP08 T1)
The hand-applied DDL of spec §5.1: org_disclosure_events, its recipients and sources, seven org-and-time indexes, and a closing REVOKE that takes UPDATE, DELETE...
Manual imports and the intake backlog through the shared mapping engine
LeadImportController maps every row with kamo-shared-library's LeadRequestMapper instead of its own switch, so manual and template imports get the full field se...
The lead page names its Vendor and Product
Lead.vendorProduct is @Transient — only VENDOR_PRODUCT_ID is a column — so nothing loads it unless someone asks, and LeadDTO.fromLead then leaves vendorProduct,...
A change to a member's teams is on the security access log — one SECURITY_SETTING_CHANGE/MEDIUM row per member who joined or left, from the team, the member's profile, a deleted team or creation (KamoCollab CP01 final review I1)
A team is a level of the rights waterfall, so joining one is a grant (CP01-T14-1). The department and job-title change on the same Position card writes an acces...
Pin the heads' names query onto users_pkey — /*+ IndexScan(u users_pkey) */ first in the statement, as loadMembers and the org chart's people query; without it the legacy planner seq-scans all of users per head row (KamoCollab CP02 final fix)
Production EXPLAIN (sp00verify, read-only): the unhinted literal plan was a nested loop over Seq Scan on users (106 rows) for 1 and 2 ids; with the hint every p...
**************** — every charter owner table carries every CharterItem column and its owner, from the docs/sql files in order and a dated legacy baseline (KamoCollab CP03 T7)
The program's one cross-table charter DDL guard (master R1-12). It reads every docs/sql/*.sql in filename order and collects what the six owner tables (dept_req...
The hand-applied DDL for the charter ORG layer, the personality and Docstion columns and org archetypes, and its contract test (KamoCollab CP03 T2)
Spec §5.1's block, character for character: the twelve nullable trait/collab columns on the five charter owner tables, org_charter_items (cascading with its org...
The visible listing's inputs come from the org graph — subordinates, AI supervisees and AI members as id strings; the manager and AI supervisor pairs are gone (KamoCollab CP02 T15)
**************** now takes the caller and reads the organization's org graph from the 60 s cache (orgGraphCache.get): - subordinateMemberIds = reports(caller, t...
The manager line reads the org graph — cycle checks on a fresh graph, the directory on the cached one, and a member's own manager needs MANAGE_MEMBER_SECURITY to change (KamoCollab CP02 T12)
- MemberSecurityController: rejectManager keeps the self, org and record-active refusals and tests the loop with **************** the ten-level bound goes. ...
Pin that a same-org Enter-As is refused before any audit row or session (KamoCollab CP00 final fix)
EnterAsController answers 400 'target is current session organization' before ImpersonationAudit.enteredAs runs, on both branches, so no same-org entry can writ...
Reports read the org graph — a TEAM scope and a TEAM share reach the whole subtree, supervised AIs included (KamoCollab CP02 T11)
ReportScopeResolver.reportsTo is reports(member, true) of the cached graph: transitive and unbounded (the old walk stopped after ten levels), following the repo...
Teams at member creation — teamIds on create-team-member, checked before anything is written, joined inside the creation transaction before the first applied rights, announced after the commit (KamoCollab CP01 T14A)
POST **************** (and the /create and /bulk-create paths that share MemberCreationService.create) take an optional teamIds for a person or an AI (master R1...
SecurityService's chat policy reads member facts from the org graph, a graph loaded per snapshot (KamoCollab CP02 T10)
ChatPolicyBeanConfig builds ChatPolicySnapshotLoader with the graph constructor and orgGraphCache::fresh (ruling CP02-T17-3), as MediaService does, so the roste...
Every SecurityService graph write announces the change, the team seam listens, and a ratchet keeps it so (KamoCollab CP02 T8)
Each write path of CP02 spec §3.5 (W1-W15) calls **************** cause) with §5.4.2's causes: member security (roles, department, job title, manager, level, ow...
Teams on the member card and in the directory search — [{id, title}] by title, one team read per page (KamoCollab CP01 T16)
GET /api/security/members/{id}/card names a team member's teams ([] in no team; left out when the read fails, as on the profile). GET **************** gives eac...
Teams in the effective-rights views — the diagnostics cascade's teams level, and Team: sources on the applied rights (KamoCollab CP01 T15)
The diagnostics cascade (GET **************** lists a team member's teams between the job title and the member, {teamId, title, roles, rights}, in the waterfall...
A member's teams from the profile — GET|PUT **************** and teams on the profile and the security view (KamoCollab CP01 T14)
PUT **************** — a team's charter-only save through TeamWriter, announced after the commit (KamoCollab CP01 T13)
The team charter endpoint of spec §5.6/§5.7 on LayerCharterController, beside the role, department and job-title ones: CONFIGURE_SYSTEM or god; the path id, unk...
The TEAM charter layer — a member's teams after the job title, the TEAM subject, teamIds, and team hide markers (KamoCollab CP01 T12)
A member's teams become TEAM layers between the job title and the member, all at one rank and ordered by lower-case title then id; the teams' roles join the ROL...
The team sub-resources (members, rights, roles) and the recalculation endpoint (KamoCollab CP01 T11)
GET|PUT **************** /rights and /roles, and POST **************** (spec §5.7). Reads are open to any session of the org; writes need CONFIGURE_SYSTEM or an...
The failed-recalculation log names the repair path as /teams/{id}/recalculate-rights
SLF4J has no brace escape, so "{{id}}" was logged literally. "{id}" is not a placeholder and prints as written; the test now pins the path an operator would typ...
TeamController — list, create, read, update and delete (KamoCollab CP01 T10)
GET|POST /api/security/teams and GET|PUT|DELETE /api/security/teams/{id} (spec §5.7). Every handler resolves the caller first (401 without an org); reads are op...
The team domain — wire, validation, writer, service and the org-graph seam (KamoCollab CP01 T9)
TeamWire reads a team body tri-state (absent / null / value); TeamValidator checks titles, descriptions, timeouts, roles, rights (normalized as a level), staff-...
SecurityService's org graph beans, the after-commit change publisher, its listener and the two internal routes (KamoCollab CP02 T7)
OrgGraphBeanConfig declares the loader (a read-only TransactionTemplate of its own, Clock.systemUTC()) and the 60 s OrgGraphCache. OrgGraphChangePublisher colle...
Right-table housekeeping covers org_team_rights (KamoCollab CP01 T8)
RoleRightsSyncService names org_team_rights in all three of its lists, so on every boot a frozen CHECK on it is dropped, a row naming a removed right is deleted...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.