The alert chat leg resolves its people per organization; an IoT alarm update is quiet on iOS
F12 (IoT close-out, SP14 routing): AlertChatService defaulted to organization 1 and the aliases "sage" / "kamo-monitor", which name nobody in production, so eve...
God eligibility alone passes a right only in the platform org; elsewhere only an open window (IoT R7 round 3)
AuthHelper.hasRight / requireRight let GD (god ELIGIBILITY, no window at all) pass EVERY tenant right in every org (24 controllers: reports, social media, acces...
The IoT live-topic check carries the subscriber's session, so god's break-glass window can be honoured (IoT R7)
A god-mode window is a property of the session, not the member, and the STOMP authz calls to iot-service named only the member, so god in another org could not ...
A closed god-mode window is closed here too (shared SessionPlatformFacts reader)
ViewerPlatformFacts (the ENTER AS SYSTEM USER verdict on support tickets) read GD && godModeActive itself. SecurityService masks an elapsed 30-minute break-glas...
The Canva routes take the right of the screen that calls them, not just a session (SITP TP23)
CanvaController checked only that a member was signed in: anyone in the organization could drive its Canva round trip (create, list, export, import, brand templ...
A ticket can be read without joining its conversation (?join=false) (SITP TP15)
GET /api/support/tickets/{id} puts an entitled agent who is not yet in the ticket's conversation into it, as opening the window should. An SI reading the queue ...
Webinar booking checks its rights and the type's organisation; an SI brings SIs into its own meetings (SITP TP12)
Owner decision 5 (security gaps fixed with the tools that use them): - /api/webinar: booking (available types, bookable times, a type's sessions, schedule, join...
?session= pins an attachment read, an edit, an unsend and a reaction to one conversation (SITP TP13)
The Tool Plane checks a run's audience on the conversation an SI names. A message id or an attachment id alone could reach another conversation the SI also belo...
An IoT alarm names its iOS notification category (SP10)
Without aps.category iOS shows the alarm with no Acknowledge or Open buttons: the categoryId data key is only a custom property.
MediaService internal chat-post and chat-target endpoints for IoT (SP13)
Holder-only relay topic /topic/iot/relay/{connectionId} (SP10)
Core NATS iot.relay.{uuid} is relayed verbatim to /topic/iot/relay/{uuid}. The frame is a wake only **************** SUBSCRIBE needs iot-service I-OD1 (GET ****...
IOT_ALARM — exempt from the presence gate and the rate limit (IoT SP10)
An alarm is not seen because a browser tab is open, and every lifecycle step (raised, escalated, acknowledged) shares one collapse key, so the 15 s limit would ...
Share-card endpoint and server-only system events (IoT SP04)
POST **************** IoTService posts the IOT_SHARE card into a members' support ticket or Exec2Exec conversation as the sharer's system event, through the one...
Adding somebody never opens what was already said to them
POST /sessions/{guid}/members always grew the room in place, so a third person added to a two-person chat could read everything the first two had said. It now r...
Website visitors can attach files in Live Support — safe types only
A visitor on a lender's website can now send documents, images, zips and ordinary audio/video to the agent in the Live Support tab, and read back both their own...
An SI's own join (M1) carries the meeting's dial-in, for when it cannot be put straight into the room
2026-10-14: SIs asked to join a meeting told people "there's no dial-in" and asked for another way in. kamoai-service now picks the way in itself: straight into...
Every attachment of stored content records the key it was stored under, via the library
The chat-only StoredContentExtension (299a911) becomes ImageService.storageExtension in the shared library, and the other MediaService paths that attach content...
Network-backed STOMP authorisation, subscription registry and revocation for the IoT topics
IoT SP01 Task 33. k8s/deployment.yaml gains the iot-internal-auth envFrom (after mlos-internal-auth): origin/main did not mount it yet (Step 1 gate fallback).
Iot.live.> to STOMP relay and the static guards for the IoT topics
IoT SP01 Task 32. The IoT SEND refusals sit just above the voicemail comment so that comment stays attached to its own line.
Meeting-provider OAuth state is an opaque one-time Redis token; refresh is locked and committed on its own
state was base64 JSON {orgId, nonce, provider} built by the caller, the nonce was never stored or checked, and the sessionless callback trusted the decoded orgI...
Deleting a public API key needs MANAGE_ACCESS_RULES, like creating one
Any member of an org could delete the org's public chat / integration keys: deleteKey checked only that the key belonged to the caller's org.
An attachment whose bytes were already stored keeps the extension they were stored under
The content-addressed key is <imgDatId>.<ext>, and every reader builds it from the attaching Img's own fileExt. Dedup matches on the bytes, so the same screensh...
Security's MANAGE_ACCESS_RULES also administers the communication policy
The owner placed the communication policy "also under Security" so an organization without the Chat app can configure it. MANAGE_CHAT_SETTINGS is a Chat-app rig...
An SI shows "typing…" through an internal endpoint, and a message's badges are recounted off the sender's request
- POST /api/media/internal/chat/typing {memberId, conversationId, typing} (KamoAI internal secret, InteractionInternalAuth; under /api/media/internal, which the...
A person asks their manager to open a chat the communication policy holds for approval, and an approval opens a 30-day contact grant (KamoCollab CP04 T14)
Session endpoints POST|GET **************** GET …/{id}, POST …/{id}/decision; the administrator's GET **************** (MANAGE_CHAT_SETTINGS). CONTACT_REQUESTED...
Declare the disclosure ledger recorder, paired with its repository scan (KamoCollab CP08 Task 12)
DisclosureLedgerConfig declares DisclosureRecorder; MediaServiceApplication's @EnableJpaRepositories gains **************** in the same commit. DisclosureLedger...
REQUIRES_APPROVAL needs a CONTACT grant, an SI may answer the person who wrote first, overrides are recorded only when they lift a refusal, and AUDIT no longer blocks attachments (KamoCollab CP04 T13)
The chat chokepoints now ask the grant-aware communication policy. A REQUIRES_APPROVAL rule refuses find-or-create and send until a live CONTACT grant links the...
The CP05 DDL file — Confidential markers on chats and meetings, forwarded-message provenance (KamoCollab CP05 T3)
Webinar registrants' leads are indexed, so their calls, texts and emails link to them
PublicWebinarService creates a lead per public webinar registrant through LeadService.createLead, which indexes the lead's phones and addresses (LEAD_CONTACT_PO...
Pin what an org with no active chat-policy set answers (KamoCollab CP00 final fix)
sp00verify's only chat-policy set is CP02 Task 6's enforced version 1, now an inactive history row. The new test pins the facts CP00 Task 12's restore rests on ...
The wiring test no longer registers the legacy chat facts repository, which shared-lib removes (KamoCollab CP02 T18)
The CI image build compiles test sources (package -DskipTests), so this test must stop naming ChatPolicyFactsRepository before shared-lib drops it. It passes ag...
Build each chat snapshot from a graph loaded now, so a lost org-graph event costs one minute, not two (KamoCollab CP02 T17)
The chat policy snapshot is itself a 60 s cache of member facts. Built from OrgGraphCache.get, it could start from a graph already up to 60 s old and keep it fo...
The internal DM path goes through chat policy and the AI turn guard, and every chat line says who wrote it (KamoCollab CP00 T7)
POST **************** now requires source MEMBER or SYSTEM (else 400 SOURCE_REQUIRED). A MEMBER line is checked by chat policy as a member's own send (open-then...
MediaService caches the org graph, reads chat policy facts from it, and the managed tracking scope is the whole subtree (KamoCollab CP02 T17)
MediaService declares the org graph loader and its 60 s cache, and a listener on security.orggraph.changed.* that evicts the graph and then the chat policy snap...
The DDL for media_objs.source, who wrote a chat line (KamoCollab CP00 T1)
A nullable VARCHAR(16) column, re-runnable, with no CHECK and no backfill; NULL reads as MEMBER. Hand-applied by CP00 Task 3. **************** keeps the file ad...
The meeting page link is on the organization's console, chosen by OrgLinkHosts
MeetLinks.meetingPage read the console host off the Kamo Meet join URL: meet.<domain> became internal.<domain>. The join URL names whichever host the room's cre...
A reply may quote only a message in its own conversation
The member chat send resolved the client's parentId with a bare lookup by id and built the reply quote from whatever it found: the parent's text, its author's n...
A lender's website contact form files a ticket in their own queue
POST /api/media/public-chat/contact, reached through the gateway's site-key gate like every other public-chat call, so the key names the org and its allowed ori...
Trim the mirrored-alias check, and stop it forcing a lazy load per member
Review findings on the AI-full-name fix (4ea53c5): - LOW: the mirrored-username comparison didn't trim either side, so an alias saved with stray whitespace (...
An AI member's chat name is the full name, same as a human's
**************** trusted Member.usernameAlias over the account's own full name whenever the alias was non-blank. MemberCreationService mirrors the account's use...
The missed-message sweep reads the recipient's link hosts before its transaction
SP98-D-9. prepareSend read the recipient organization's domain rows lazily, as a late statement of the sweep's transaction, to choose the letter's console host;...
A turn-only fan-out reads no roster, ticket id or conversation title
SP98-D-6. ChatFanoutService.prepare resolved the roster, the support ticket's id and the conversation's title for every request, including the turn-only ones (a...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.