Declare every right a tool's service enforces; plain words for unseen records and numbers
Approval follow-up 2026-10-21 (controller review of the approvals UI). Rights (item 4): an audit of every tool's declared rights against the rights its downstr...
An approval card sends every parameter its phrase names
next-intl refuses an ICU select or plural with no value, so a phrase about an argument the SI left out (a contact with no formatted name, a new document categor...
An approval about a record the reader may not see never leaves a dangling 'for'
Phrases that named a patient, a customer, a purchaser, an envelope or a document after a preposition now say 'for a patient' (or nothing) when the reader may no...
Approval cards say SI in every label, write phone numbers and choices as people do, and keep a note beside an action a field
A humanised field name said 'Ai companion…' (now SI, with a guard that no phrase, label, noun or risk sentence says AI); a US number reads (512) 555-0142 in the...
Mlos_update_section keeps what the call does not give (SITP TP21 live smoke)
The loan, property, declarations, military and row saves replace their whole section in SecurityService, so a partial edit would have cleared the fields it left...
A loan record's dateUpdated is a UTC instant too (SITP TP22 live smoke)
The live smoke answered loans_get_state_rule and loans_history with dateCreated as a UTC instant and dateUpdated as KamoLOS's offset-less text; both are now ins...
Reports_save_view does not answer empty settings for a view it just saved (SITP TP16 live smoke)
SecurityService answers a save without the view's stored request (the list carries it), so the tool said parameters {} for a view saved with parameters. A view ...
A scheduled report reaches a colleague who signs in on another domain (SITP TP16 live smoke)
reports_schedule judged a colleague by the organization's mail domains alone, so in sp00verify the owner's own sign-in address was refused as an outsider. A rec...
Binders_create sends what CreateBinderRequest reads; scripts_create names a market by its leads_list_markets id (SITP TP14 live smoke)
DocsService refused every binders_create: CreateBinderRequest's primitive isTemplate binds as "template", so the body's isTemplate was an unknown field (400). A...
Chat_send_file posts a text document DocsService typed octet-stream as text/plain (SITP TP13)
DocsService records Markdown, YAML, logs and other text without an ImageMimeType as application/octet-stream, which chat's attachment allow-list refuses. A docu...
Lead callbacks take MANAGE_LEAD_CALLBACKS, as SecurityService now does (SITP TP10, after TP01)
Files_upload sends the type and digests ConversionService checks (SITP TP13)
ConversionService detects a file's type from its bytes and name and refuses a declared type that differs, then compares the client's Blake3 and SHA3-256 digests...
Files_upload files into My Docs by its ordinal (SITP TP13)
ConversionService refuses an upload whose metadata names no assocType (values()[assocType]), and its own no-metadata default (4) is MEET_RECORDING's ordinal. fi...
Stop logging the database password at startup
com.zaxxer.hikari at DEBUG makes HikariConfig print its whole configuration on every start, including dataSourceProperties {password=...} and password......; Pr...
"list…", "show…", "give me…" and "pull up…" are orders too, and a run with no order says why in the log
Live check in sp00verify (2026-10-15): a peer's "Nell, list the open tasks assigned to you and tell me how many there are." verified as their request (author, a...
A team member's call to a number on the do-not-contact list reads as who asked not to be called, and since when
kamoai-service 8b7b8d5 added the organization's do-not-contact list for calls (K6 409 DO_NOT_CONTACT), and a team member's call now carries the day the number w...
An uncited wake stands for an outside call only when its words ask for a call
The run's own wake (RequestVerifier.inferFromRun) is the request for a call to a colleague, but someone outside the org is rung on a teammate's name, with no co...
Phone_call calls whoever a team member named, looked up by name, with no approval and no consent gate, and never anyone else
Owner 2026-10-15: "When a supervisor, or any team member for that matter, tells SI to call someone else on the team, they should call them. No questions asked, ...
Meetings_join is JOIN_MEETING, not PLACE_CALL, and an unnamed JOIN_MEETING does not ask
Owner 2026-10-14: Luna (crm) asked the owner to approve joining a meeting he had told her to join; meetings_join was classed PLACE_CALL, so the charter's "Placi...
Meetings_join is "Join a meeting", not a phone call, and a meeting's link is joined as the room it names
Owner, 2026-10-14: SIs asked to join a meeting answered that they could not "join by phone" because "there's no dial-in", and asked for a room with dial-in enab...
An SI acts on the request its run was woken by without having to cite it, and K3 hears the tool's rights so a colleague who may do it themselves can direct it
Owner 2026-10-14: Luna (crm) asked the owner to approve joining the meeting he had just told her to join. Evidence: run 47cc1908 (NEW_CHAT, woken by his message...
An AUDIT org's SI is shown the record-link kinds every SI saw before KamoCollab
CP97 Task 17's Luna compare found her tools/list changed by KamoCollab: CP05 Task 7 appended TASK, DOCUMENT, KB_ARTICLE, MEMBER, AI_RUN and SMS_THREAD to Record...
Stamp a communication-policy refusal of a tool with no intent COLLAB_DENY interaction:<ruleId>
An SI's chat_find_or_create_dm refused by the interaction policy answered COLLAB_DENIED INTERACTION_POLICY but left its audit row's policy_decision and policy_r...
An AUDIT hit of the communication policy is written once, as the call runs — not also when the charter asks a person first, and not for a decoderd approval (KamoCollab CP04 Task 31)
Found live in sp00verify: an SI's internal email under an AUDIT DENY rule, behind a charter approval (autonomy ceiling 1), wrote two chat_policy_event rows for ...
An SI's key, text or click aimed at an app reaches the window it is working in (SP97 T9)
The bridge sends a call that names only an app (app_id, wm_class or pid) to that app's first window, focusing it first. After a take-over, Kamo's old window sit...
Workstation_open_kamo says where Kamo opened and never to type a password (SP97 T9)
After a supervisor's take-over (which ends the SI's session) the older browser windows on an SI workstation show Kamo's sign-in page. On the next request Ava op...
A colleague call refused for consent or hours says how to cite their own request (SP95-T29-1)
Task 29 step 3, live: the owner asked an AUTONOMOUS AI to call them. The model called phone_call without onRequestOf (nothing needed approval), K6 refused NO_VO...
A perception read that hands over nothing from outside taints the run INTERNAL, so a cited request can stand (SP95-F-1)
Every run's PERCEIVE calls notifications_list, mail_list_unread and calendar_list_events with the run id. All three are untrusted and none said where its conten...
An upstream image follows the wrapped text instead of filling it (SP98 T25A)
A workstation screenshot is an MCP image block of about 250 KB of base64. The untrusted wrap serialized it into the result text, so the text budget held base64 ...
Use the RECIPIENTS_UNKNOWN constant instead of a string literal
Review round-1 NIT: the constant was declared and never referenced, so it and the literal in withDirectoryHint could silently drift apart if either were ever ed...
A rejected guessed recipient tells the model to look the person up
EmailService now refuses a send whose recipient names one of the organization's own mail domains but matches no mailbox, alias or member (RECIPIENTS_UNKNOWN, a ...
An AI's task without an assignee is its own
tasks_create without an assignee left an AI's task unassigned in its Inbox. SP02's TASK_HANDOFF moves only tasks assigned to the retiring AI, so self-planned wo...
An approved action runs past its run's call cap; a dry run names read-all
SP98-K-1 (SP05 final review M1): SP10 re-executes an approved action under the run id that asked for it. A run that worked on to its maxToolCallsPerRun answered...
Calendar_free_busy answers who is busy when, never what the block is called
A busy block's title (and its event id) can come from an outside invitation, and calendar_free_busy is not an untrusted tool (SP13's voice bookings call it, and...
An MCP server's refresh no longer closes the client calls are using
The 10-minute refresh (I3) and an admin's test evicted the pooled client before listing, which dropped a legacy SSE stream or DELETEd a Streamable HTTP session ...
An org's alias mail domain is internal on both platform apexes
kamouniverse.com is now the platform's primary apex (kamo-shared-library 0e8cf90f), and **************** moved with it. - ForwardedHosts.internalDomains (the e...
A long workstation wake is asked about less often
An AI workstation's wake took 9 min 19 s against ComputeService's 75 s estimate (SP11 Task 30). Every computer_* call on a waking machine answered WORKSTATION_W...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.