Pin that a same-org Enter-As is refused before any audit row or session (KamoCollab CP00 final fix)
EnterAsController answers 400 'target is current session organization' before ImpersonationAudit.enteredAs runs, on both branches, so no same-org entry can writ...
The teams client — types, TeamsApiError and the ten calls over the team relays (KamoCollab CP01 T20)
app/lib/teams/teamsApi.ts: Team, TeamDetail, TeamMemberRow, TeamRef, TeamWrite, TeamSaved; parseTeam (tolerant: ids as strings, missing lists [], a right whose ...
A help article no longer OOMKills the Tamil engine
KBService sends a help article's Lexical JSON to be translated: one long line with few sentence ends, ~0.46 model tokens a character. A 3,980-character article ...
CP01-T14A-4 — the 14A ship check ran in a throwaway team (the cast team is Task 27's)
The charter client knows TEAM, and the BFF relays teams (KamoCollab CP01 T19)
CharterLevel gains TEAM and CharterSubject a hypothetical member's teamIds; saveLayer('TEAM') PUTs **************** Two relays: /api/security/teams/** (GET, POS...
Reports read the org graph — a TEAM scope and a TEAM share reach the whole subtree, supervised AIs included (KamoCollab CP02 T11)
ReportScopeResolver.reportsTo is reports(member, true) of the cached graph: transitive and unbounded (the old walk stopped after ten levels), following the repo...
Teams at member creation — teamIds on create-team-member, checked before anything is written, joined inside the creation transaction before the first applied rights, announced after the commit (KamoCollab CP01 T14A)
POST **************** (and the /create and /bulk-create paths that share MemberCreationService.create) take an optional teamIds for a person or an AI (master R1...
CP02 T9 ship ruling — cast ensure's heads step as one direct PUT; Vera heads Collab Sales
CP01 T18 rulings (three more refusal words, the placeholders the UI passes)
CP00 T11 rulings (access-log event list location, dictionary words, tests)
The access log filter offers impersonation and Enter-As (KamoCollab CP00 T11)
SecurityService now writes IMPERSONATION_STARTED, IMPERSONATION_ENDED and ENTER_AS into the org's access log. The event-type list (accessLogEvents.ts, which the...
CP02 T10 ruling — SecurityService's chat loader on orgGraphCache::fresh, and its wiring test
SecurityService's chat policy reads member facts from the org graph, a graph loaded per snapshot (KamoCollab CP02 T10)
ChatPolicyBeanConfig builds ChatPolicySnapshotLoader with the graph constructor and orgGraphCache::fresh (ruling CP02-T17-3), as MediaService does, so the roste...
CP02 T8 ship ruling — the closing cast check matches the opening one; the team drift is CP01 Task 27's
Every SecurityService graph write announces the change, the team seam listens, and a ratchet keeps it so (KamoCollab CP02 T8)
Each write path of CP02 spec §3.5 (W1-W15) calls **************** cause) with §5.4.2's causes: member security (roles, department, job title, manager, level, ow...
Teams on the member card and in the directory search — [{id, title}] by title, one team read per page (KamoCollab CP01 T16)
GET /api/security/members/{id}/card names a team member's teams ([] in no team; left out when the read fails, as on the profile). GET **************** gives eac...
Teams in the effective-rights views — the diagnostics cascade's teams level, and Team: sources on the applied rights (KamoCollab CP01 T15)
The diagnostics cascade (GET **************** lists a team member's teams between the job title and the member, {teamId, title, roles, rights}, in the waterfall...
SP95 VERIFIED — Task 29 verification (every step PASS or a written gap; fix SP95-T29-1 shipped)
SP95 Task 29 rulings SP95-T29-1..3; master §11 row SP95-T29-1 (a colleague call's consent and hours refusals)
A member's teams from the profile — GET|PUT **************** and teams on the profile and the security view (KamoCollab CP01 T14)
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.