MediaService internal chat-post and chat-target endpoints for IoT (SP13)
SP13 service-job link entity, repository and six activity kinds
IOT_ALARM phone push body and withdraw-with-update (SP10)
An IOT_ALARM event card (source **************** as iot-service's AlarmNotifier writes it, or <alarmUuid>:<seq>) is mirrored as an IOT_ALARM push: channel/colou...
Holder-only relay topic /topic/iot/relay/{connectionId} (SP10)
Core NATS iot.relay.{uuid} is relayed verbatim to /topic/iot/relay/{uuid}. The frame is a wake only **************** SUBSCRIBE needs iot-service I-OD1 (GET ****...
IOT_ALARM — exempt from the presence gate and the rate limit (IoT SP10)
An alarm is not seen because a browser tab is open, and every lifecycle step (raised, escalated, acknowledged) shares one collapse key, so the 15 s limit would ...
Iot.relay.> — svc_iot publishes, svc_media subscribes (IoT SP10)
The Google Home relay wakes the phone that holds a connection's lease: IoTService publishes a content-free frame on iot.relay.{connectionId} and MediaService fo...
On-device vocabulary and iot_on_device_links entity (SP10)
The link entity keeps only the SHA-256 of the phone's link secret, and that hash is @JsonIgnore so it never reaches a response or an event.
Charter editor lists OPERATE_DEVICE and OPERATE_SECURITY_DEVICE; KamoAI master §11 and IoT master §10 rows (SP11)
ACTION_CLASSES ends with the two IoT SP11 classes and APPROVAL holds 24 items (one per shared-lib AiActionClass). The KamoAI master gains its §11 row for the io...
Classify the ten iot tools; the catalogue guards move 101 to 111 (SP11 P12)
The three iot writes are NOT_DISCLOSING and the seven reads NOT_CONTENT with the spec's reasons (pinned in ContentReadToolsCoverageTest too). RegistryCompletene...
IotCallerView and the pure view rules V1-V11 (SP11 §4.4)
A key a device lists twice is a manifest defect and is never used (fail closed).
IotManifestClient, a per-session ETag-validated manifest cache with single flight (SP11 §4.4)
Per-caller schemas and availability for the ten iot tools (SP11 §4.5)
IoT error map, value checks, class check, whitelisted results and the command watch (SP11 §4.7, §4.9)
Downstream approval headers, conditional GET with ETag, opt-in error fields (SP11 P11)
CallerSchema per caller after visibility; PHYSICAL after outside content always asks a person; the approval travels on the plan (SP11 P4-P7)
A static tool's schema and availability may depend on the caller (CallerSchema): viewed after visibility for tools/list (one 3 s budget shared by the list) and ...
ToolRisk.PHYSICAL, the iot_ prefix, two charter classes, the IOT door and ApprovalRef (SP11 P1-P3, P8-P10)
Brief words for the two physical charter classes; copilot ceiling pinned (SP11)
CharterCompiler words OPERATE_DEVICE and OPERATE_SECURITY_DEVICE and keeps both silent while unnamed (as the two team classes of CP05 R1-3), so no existing SI's...
Purge sweep, OAuth configuration and the repository scan (IoT SP09)
Internal grant revocation for IoTService and platform client administration (IoT SP09)
OAuth mode — the standard page untouched, tenant chrome off (IoT SP09)
/?oauth_request=<64 hex> is the OAuth sign-in page by a beforeFiles rewrite in next.config.mjs to /oauth/sign-in (the browser keeps the URL), not by a switch in...
Token endpoint with PKCE, rotation with a 24-hour grace, reuse detection and RFC 7009 revocation (IoT SP09)
OPERATE_DEVICE and OPERATE_SECURITY_DEVICE charter classes (SP11-D2)
IoT SP11 (master §6.14, §10 SP11-D2): physical actions through the Tool Plane's iot_ pack are charter-approved per class. AiActionClass appends OPERATE_DEVICE (...
Consent view and single-use decision bound to the sign-in session, pending grants and codes (IoT SP09)
O3 binds a fresh sign-in to the authorization request with an atomically spent one-time key (IoT SP09)
Authorization requests O1/O2 with RFC 6749 redirect rules, PKCE S256 and rate limits (IoT SP09)
Atomic one-time-key spend, request store, rate limits and redirect URLs (IoT SP09)
The OAuth sign-in with the missing MFA step, and the consent screen (IoT SP09)
/api/login, /api/session/select and /api/login/mfa accept an optional oauthRequestId (64 hex). Absent, nothing changes (tests/***-cookie pins each route's answe...
Alexa link, virtual sensor and endpoint entities; IotCommand.voiceLinkId; ALEXA_* activity kinds (IoT SP09)
/oauth/authorize, /token and /revoke, one shared session-cookie writer (IoT SP09)
The Kamo OAuth server's public endpoints, relayed to SecurityService (O1, O6, O7) over cluster DNS at SECURITY_SERVICE_URL (default kamowssecurity-service, as a...
OAuth server entities, repositories, read-only token verifier and access-log event types (IoT SP09)
Token generation, PKCE S256 and scope parsing for the Kamo OAuth server (IoT SP09)
**************** and **************** (SP04 Tasks 21-22)
The column exists in production (SP04 DDL, default TRUE).
Google Trust Services issues the platform login host's certificate (IoT SP09)
Amazon's account linking refuses Let's Encrypt, so login.kamouniverse.com alone moves to a gts-prod ClusterIssuer (ACME with External Account Binding); every ot...
Google Trust Services issues the platform login host's certificate (IoT SP09)
Amazon's account linking refuses Let's Encrypt, so login.kamouniverse.com alone moves to a gts-prod ClusterIssuer (ACME with External Account Binding); every ot...
IOT in the NoReply audit subsystems
IoT Devices SP06: EmailService audits alarm letters (iot.alarm_notice) under NoReplySubsystem.IOT; the audit filter knows it.
Preview sample variables for the iot share letters
Rebuilt on the new shared library BEFORE IoTService sends (a missing template key 404s forever).
Reserve the iot alias; pin iot.<domain> resolution
The rebuild carries DomainAliasType.IOT from the shared library. KnownAliases / SSL_PROBE_LABELS follow only after iot.<apex> answers over TLS (a later commit),...
Voice-assistant paragraphs in the privacy policy and terms (IoT SP09)
Kamo OAuth authorization server tables and the iot.alexa client (IoT SP09)
Iot.share_link and iot.share_code canonical templates, IotShareEmail
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.