Four streams of four threads, and a lane that keeps one free for chat
Measured on the nodes' CPU class with the dictionary sync's own traffic (15-key chunks): one stream of eight threads did 1.5 keys/s, two of eight 1.8, four of f...
Write Romanian with comma-below s and t
The model mixes the legacy cedilla forms into Romanian (6 of 90 such letters in the chat widget's regenerated file) and the dictionary's earlier Romanian did to...
Drop the old engines' deploy steps, apply MADLAD's alias Services, update audit and docs
Completes 56b37fa, which removed the manifests: without this the workflow still ran steps for directories that no longer exist. The workflow now applies madlad/...
Remove LibreTranslate, Bergamot and IndicTrans; MADLAD serves every pair
TranslateService speaks only to madlad now (translateservice 5c7605b), verified end to end: every Kamo locale including Tamil and Swahili, inbound ru->en and ta...
Beam 4 only for labels, beam 2 up to 64 tokens
Cost is tokens x beam. Measured in the cluster with the old engines still running: one stream 77 chars/s and two 115 chars/s on short strings at beam 4. Sentenc...
One translation engine for every pair, MADLAD-400-3B on CPU
Replaces LibreTranslate (Argos), Bergamot and Kamo IndicTrans, whose language sets did not overlap and whose gaps came back as English. MADLAD-400-3B-MT (Apache...
Memory limit 14Gi -> 20Gi, request 10Gi -> 12Gi
Seven-day peak working set was 13.8 and 13.1 GiB against the 14Gi limit, so the kernel reclaimed the mmapped argos models and en->ru on a help article paid cold...
Svc_iot may subscribe to iot.live.device.> — the IoT production canary watches its own live frame (SP14)
Desktop alerts go by e-mail only; the MediaService chat leg is gone
Owner, 2026-10-20 (IoT close-out F12): no chat sender. A chat thread needs a sender member besides the recipient and the platform organization has none by desig...
The deploy-safety audit accepts a reasoned 'spread' exemption for a node-pinned Deployment
Every KlusterServices deploy since run #337 ended red on kamoai-voice (3 replicas pinned to k3m1 by nodeSelector, so no hostname spread is possible). The rule h...
Kamo_app is a NOLOGIN group role; services log in as kamo_app_202610
The YugabyteDB application password was exposed (com.zaxxer.hikari DEBUG in ten services' logs, and securityservice's committed diagnose-output.txt), so it was ...
Probe only www.kamocrm.com; the platform's surfaces are on kamouniverse.com
kamocrm.com is a marketing site only (owner 2026-10-18). The blackbox prober is now deployed, and apply.kamocrm.com was already failing its probe; the kamocrm.c...
Never seed devices. anywhere under kamocrm.com
ccd50be skipped the devices sibling only when the parent WAS kamocrm.com, so a child-org web alias host **************** seen live) still queued ***************...
The proxy settings live in HA's storage, promoted, not in YAML
Since 2026.10, Home Assistant migrates a YAML `http:` to its storage once, as a PENDING config. It reverts that config and restarts unless an admin promotes it ...
A Home Assistant lab instance at home.kamouniverse.com
One Home Assistant 2026.10.2 (digest-pinned) for IoT testing of Kamo's HOME_ASSISTANT connector and for the owner's own use under the HA account sajon. The demo...
Set the Google Trust Services EAB key id (IoT SP09 B1)
The gts-prod ClusterIssuer's external account binding names key id **************** from Google Cloud Public CA (project kamocrm-1755458510147). The HMAC key is...
The share host is devices.<domain>, and nothing on kamocrm.com
Owner 2026-10-18: "iot" is a technical term, so the customer-facing host alias for kamo-iot is `devices`, and kamocrm.com is a marketing site only. auto-cert do...
Iot.relay.> — svc_iot publishes, svc_media subscribes (IoT SP10)
The Google Home relay wakes the phone that holds a connection's lease: IoTService publishes a content-free frame on iot.relay.{connectionId} and MediaService fo...
Google Trust Services issues the platform login host's certificate (IoT SP09)
Amazon's account linking refuses Let's Encrypt, so login.kamouniverse.com alone moves to a gts-prod ClusterIssuer (ACME with External Account Binding); every ot...
Google Trust Services issues the platform login host's certificate (IoT SP09)
Amazon's account linking refuses Let's Encrypt, so login.kamouniverse.com alone moves to a gts-prod ClusterIssuer (ACME with External Account Binding); every ot...
Pre-issue iot.<apex> certificates, PDB kamowebiot, availability probe
iot joins BROWSER_ONLY_ALIASES and STATIC_DOMAINS on both platform apexes so the first share recipient never meets a missing certificate; monitoring/ is applied...
Postfix takes the name mail.kamouniverse.com once it resolves here
kamouniverse.com is the platform's sending domain, but the server still introduced itself as mail.kamocrm.com in its EHLO, Received headers and bounces. Postfix...
Scrape kamowsiot-service on /actuator/prometheus
IoT SP01 Task 34: the kamo-actuator job keeps kamowsiot-service beside kamowssecurity-service, so the four IoT alerts (iot-service's own PrometheusRule) have da...
IOT_EVENTS max-bytes in binary units — nats CLI 0.5 refuses the bare 10737418240 (IoT SP00)
Api.* carve-out for vendor hooks and the Alexa relay with a webhook-sized limit; IoT secrets documented (IoT SP00)
Default-deny egress for kamowsiot and its disruption budget (IoT SP00)
NATS login svc_iot, svc_media iot.live.> grant, IOT_EVENTS work queue (IoT SP00)
Svc_camera, KamoCameraService's own login
Publishes rt.org.> (the Cameras screens' live refresh) and cameras.site.> (a site RPC routed to the pod holding that site's connector socket), subscribes camera...
Auto-create standard IMAP folders for every mailbox
Dovecot now subscribes Drafts, Sent, Junk, Trash and Archive on first open with SPECIAL-USE flags so EmailService and the UI see real folders instead of client-...
A help article no longer OOMKills the Tamil engine
KBService sends a help article's Lexical JSON to be translated: one long line with few sentence ends, ~0.46 model tokens a character. A 3,980-character article ...
Pin that the SP93 host patch keeps the first pre-image as its backup
The existing re-run test patches nothing on its second run, so it never reaches the backup and could not catch a script that overwrote it. The new test rolls th...
Org-graph listeners may subscribe to the org-graph change subject
KamoCollab CP02 Task 6A (master R1-23, CP-D75). SecurityService publishes **************** after every org-graph write; each service that caches the org graph e...
Rotate the kamo_ops password
The operator password (Secret kamo/redis-ops-auth) reached an agent transcript in KamoAI SP01 Task 38 and had never been rotated (SP98-M-2). It was rotated live...
The outbound gate refuses a number the toll-fraud guards block (SP93 T9)
[kamo-outbound-gate] gains a GotoIf on kamo-asterisk-support's managed [kamo-toll-fraud-blocked] list, between the SP13 AI-transfer line and the Goto onward, an...
Nothing in the mail namespace reaches the session store
rspamd now keeps its data in its own Redis, so the platform Redis drops its mail_rspamd user and admits only the kamo namespace; rspamd's ConfigMap drops the ke...
Rspamd keeps its data in its own Redis
local.d/redis.conf is now the redis-own.conf key: rspamd-redis in mail, database 0, the same mail_rspamd login. The subPath change rolls the pod. The old key st...
A Redis of rspamd's own
rspamd parses untrusted mail and logs in to the platform Redis, beside every member's session, and no ACL can keep it from them there: a user cannot be scoped t...
A member's xrdp desktop shows the organization's wallpaper
xfdesktop draws the backdrop stored under the X server's RandR output name. A member works in an xrdp session, whose xorgxrdp server names its output rdp0, but ...
A take-over ends only once its VNC password is sealed
VncAccess cleared the take-over in memory and then wrote the password file. When the write failed, x11vnc kept accepting the take-over password while the agent ...
The platform main line survives a boot, and 8200 is the team line
Luna's go-live (2026-09-28) wrote [kamo-main-luna] into extensions_custom.conf and KAMO_LUNA_EXT / KAMO_LUNA_MAX_RING into globals_custom.conf by hand on the ho...
An AI workstation sleeps with its desktop stopped, and wakes to a fresh one
Measured on a throwaway -ai4 workstation (SP98 Task 16), the wake stalled because Xorg does not survive a resume: with no KMS driver it drives the console throu...
Media_timeout back to livekit-sip's default
957fc4f re-applied a 20-minute media timeout for a quiet meeting's AI leg. With the fail2ban ban on 47.181.8.84 lifted and FreePBX sending RTP straight over the...
A quiet meeting keeps its AI (media_timeout 20m), again
Reapplies 960331f, reverted in 5d70873 on the wrong suspicion: the RTP loss seen right after that deploy was fail2ban's ban on 47.181.8.84 (fixed in the previou...
Livekit-sip's RTP never takes the router, and its hairpin is never banned
FreePBX names its public address (pbx.k1.kluster.kamocrm.com) in the SDP and the Contact it gives livekit-sip, which is outside local_net, so RTP and in-dialog ...
An English-to-Tamil engine, so Tamil stops being English
LibreTranslate lists no Tamil and Bergamot serves German only, so every en->ta request (the dictionary sync, Help Center articles, chat) matched no provider and...
The heap fits the container, so a meeting is never OOMKilled
The image starts java -Xmx${JIGASI_MAX_MEMORY:-3072m} and the container was limited to 1Gi: the heap could outgrow the container, and Jigasi was OOMKilled mid-m...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.