One translation engine for every pair, MADLAD-400-3B on CPU
Replaces LibreTranslate (Argos), Bergamot and Kamo IndicTrans, whose language sets did not overlap and whose gaps came back as English. MADLAD-400-3B-MT (Apache...
Svc_iot may subscribe to iot.live.device.> — the IoT production canary watches its own live frame (SP14)
A Home Assistant lab instance at home.kamouniverse.com
One Home Assistant 2026.10.2 (digest-pinned) for IoT testing of Kamo's HOME_ASSISTANT connector and for the owner's own use under the HA account sajon. The demo...
The share host is devices.<domain>, and nothing on kamocrm.com
Owner 2026-10-18: "iot" is a technical term, so the customer-facing host alias for kamo-iot is `devices`, and kamocrm.com is a marketing site only. auto-cert do...
Iot.relay.> — svc_iot publishes, svc_media subscribes (IoT SP10)
The Google Home relay wakes the phone that holds a connection's lease: IoTService publishes a content-free frame on iot.relay.{connectionId} and MediaService fo...
Google Trust Services issues the platform login host's certificate (IoT SP09)
Amazon's account linking refuses Let's Encrypt, so login.kamouniverse.com alone moves to a gts-prod ClusterIssuer (ACME with External Account Binding); every ot...
Google Trust Services issues the platform login host's certificate (IoT SP09)
Amazon's account linking refuses Let's Encrypt, so login.kamouniverse.com alone moves to a gts-prod ClusterIssuer (ACME with External Account Binding); every ot...
Pre-issue iot.<apex> certificates, PDB kamowebiot, availability probe
iot joins BROWSER_ONLY_ALIASES and STATIC_DOMAINS on both platform apexes so the first share recipient never meets a missing certificate; monitoring/ is applied...
Postfix takes the name mail.kamouniverse.com once it resolves here
kamouniverse.com is the platform's sending domain, but the server still introduced itself as mail.kamocrm.com in its EHLO, Received headers and bounces. Postfix...
Scrape kamowsiot-service on /actuator/prometheus
IoT SP01 Task 34: the kamo-actuator job keeps kamowsiot-service beside kamowssecurity-service, so the four IoT alerts (iot-service's own PrometheusRule) have da...
Api.* carve-out for vendor hooks and the Alexa relay with a webhook-sized limit; IoT secrets documented (IoT SP00)
Default-deny egress for kamowsiot and its disruption budget (IoT SP00)
NATS login svc_iot, svc_media iot.live.> grant, IOT_EVENTS work queue (IoT SP00)
Svc_camera, KamoCameraService's own login
Publishes rt.org.> (the Cameras screens' live refresh) and cameras.site.> (a site RPC routed to the pod holding that site's connector socket), subscribes camera...
Org-graph listeners may subscribe to the org-graph change subject
KamoCollab CP02 Task 6A (master R1-23, CP-D75). SecurityService publishes **************** after every org-graph write; each service that caches the org graph e...
The outbound gate refuses a number the toll-fraud guards block (SP93 T9)
[kamo-outbound-gate] gains a GotoIf on kamo-asterisk-support's managed [kamo-toll-fraud-blocked] list, between the SP13 AI-transfer line and the Goto onward, an...
Rspamd keeps its data in its own Redis
local.d/redis.conf is now the redis-own.conf key: rspamd-redis in mail, database 0, the same mail_rspamd login. The subPath change rolls the pod. The old key st...
A Redis of rspamd's own
rspamd parses untrusted mail and logs in to the platform Redis, beside every member's session, and no ACL can keep it from them there: a user cannot be scoped t...
An English-to-Tamil engine, so Tamil stops being English
LibreTranslate lists no Tamil and Bergamot serves German only, so every en->ta request (the dictionary sync, Help Center articles, chat) matched no provider and...
Auto-cert pre-issues analytics, desktop and myloan on kamouniverse.com
- STATIC_DOMAINS gains analytics.kamouniverse.com, desktop.kamouniverse.com and myloan.kamouniverse.com, twins of kamocrm.com hosts that are reached only th...
Serve desktop.kamouniverse.com, and bounce a bare computers.kamouniverse.com to its login
desktop.kamouniverse.com had DNS but no route, so it answered Traefik's 404 behind the default certificate. It now serves KamoDesktop through desktop-https-kamo...
Svc_media may subscribe media.feed.* to relay the org feed to the browser
SecurityService and MediaService announce a new post or lead note on media.feed.<orgId>, and the browser's feed (the lead view's notes, the Clubhouse feed) list...
Kamo Meet bridge — Jigasi transport and endpoint, PIN dial-in on 7800, trusted entry for AI members
No user- or caller-typed text enters a dialplan expression: the room checks compare lengths and the AI's display name is filtered before it is tested (a quote i...
A workstation probe that never prints the MCP token
SP11's acceptance read an AI workstation's descriptor and probed its MCP bridge by hand, and one diagnostic line printed a live bearer token into a session tran...
Dev.kamouniverse.com forwards to www
The site is live on www.kamouniverse.com, so its pre-launch host stops serving it and 301s to https://www.kamouniverse.com with path and query kept, so existing...
Bring www.kamouniverse.com live; apex goes through kamo-nowww
KamoUniverse is now the primary marketing site. www.kamouniverse.com stops 301ing to www.kamocrm.com and is served by the kamouniverse-marketing app (its own In...
Certificates for every platform host on kamouniverse.com
login.kamouniverse.com and register.kamouniverse.com become the platform's KamoUniverse sign-in and sign-up doors, and from them a visitor reaches theme., capch...
Run IBM Granite 4.0 H-Tiny in place of qwen3:4b, on 16 cores
The owner asked for a local model that runs substantially better on k3m1's AVX2-only Xeons (2026-09-27, ruling SP01-LLM-granite4). granite4:tiny-h is a hybrid M...
Bring the worldchunks drive back into use after it drops
On 2026-09-23 the USB earth-tile drive on k3m1 dropped for a second. systemd unmounted it and stopped nfs-server, which nfs-utils makes require every exported p...
Forward the four audience domains' apex + www to www.kamouniverse.com
kamofamily.org, kamobusiness.com, kamopersonal.com and kamocommunity.org are registered and pointed at the cluster. Their apex and www now 301 to https://www.ka...
KamoBusiness, KamoPersonal, KamoCommunity sites; KamoFamily moves to dev.kamofamily.org
Three more audience sites set up like KamoFamily. Each is a Next.js repo edited on GitHub (pantherkamo/<Name>), synced to Forgejo kamo/<name> by a git-sync Cron...
KamoFamily (dev.kamofamily.com): cert, PDB, GitHub sync; auto-cert retries unissued static domains
KamoFamily is a new Next.js site (Forgejo kamo/kamofamily, edited on GitHub pantherkamo/KamoFamily), set up the same way as the KamoUniverse marketing site: - ...
AI extensions route to LiveKit; one recording path on every call; outside-calls list comes from Kamo
The host patch refuses until kamo-asterisk-support's recording subroutine and managed allow-list are on the node (and the list covers the hand-edited one), veri...
Svc_kamoai_voice follows the org pause and the kill switch (KamoAI SP13)
LiveKit server, SIP and Redis on k3m1 for KamoAI voice; signalling route; ports and secrets
The signalling EndpointSlice uses k3m1's node address 10.0.50.1 (k1m1's eno49 corrupts TCP payloads), the TURN secret volume is 0400 (livekit-server refuses a s...
Widen svc_kamoai for the KamoAI runtime (SP10)
kamoai-service creates and pulls its own KAMOAI_WORK work queue, runs up to four notify shards (kamoai-notify, kamoai-notify-1..3) on EMAIL_NOTIFICATIONS, publi...
Golden image AI layer — Chrome, x11vnc, computer-use-linux, ydotool
Chrome's source is kamo-google-chrome.list, not google-chrome.list: Chrome's postinst (154.0.8037.57) migrates a google-chrome.list into its own google-chrome.s...
The agent runs the AI workstation profile when cloud-init asks for it
The agent loads kamo_hc_ai only for KAMO_HC_PROFILE=AI_WORKSTATION: the AI's paths on 9810 behind the agent bearer, the MCP bridge on 9811, the AI's activity re...
AI workstation profile applier, screen guard, software kit and runtime
MCP bridge from the Tool Plane to computer-use-linux
Streamable HTTP on 9811 (JSON answers only, GET 405, Origin 403, per-wake bearer 401, take-over 409) in front of one stdio computer-use-linux child per session....
AI workstation agent module — renderers, MCP token, lease, VNC passwords
The guest half of SP11's AI profile: the files the profile writes (LightDM autologin at 1280x800, kiosk, x11vnc and ydotoold units, Chrome wrapper and managed p...
The PBX speaks through Kamo Speech — kamo_tts.agi, Piper norman at 8 kHz, key from a secret volume
Mirror GitHub kamouniverse main to Forgejo so a merge deploys
The KamoUniverse marketing site is now edited on GitHub GitHub, and PRs merge there. But the site deploys from Forgejo (kamo/kamouniverse-marketing), whose work...
Certificate and disruption budget for dev.kamouniverse.com
dev.kamouniverse.com is the new KamoUniverse marketing site (repo kamouniverse-marketing; it carries its own Host() IngressRoute in namespace kamo). The kamouni...
Dovecot pushes mail events to EmailService (Lua push_notification); stop logging secrets
The default user may only PING
SP00 stage R3. Persists the runtime rule for a future start of redis-0: default keeps nopass for the unauthenticated readiness probe and may run PING and nothin...
Kamo Speech's registry facts and its registration through AIService's internal registry
The last wait needs VERIFIED to hold for 120 s. An attestation itself writes VERIFIED and #36 carries no probe time, so a first VERIFIED read cannot tell SP01's...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.