Invoices print the Receivables ACH details exactly as quotes do
The PDF and the email now carry the quote's remittance block, word for word: - Remit payment to - payee (legal name) - bank - routing number (ABA) - account num...
Endpoints for dated, prorated seat and license changes; the job applies them
New endpoints: - POST **************** - POST /subscriptions/{uid}/changes - GET /subscriptions/{uid}/changes - POST **************** The hourly billing job ap...
Customers pay invoices by card online; a bank's SCA request reaches the customer
On invoices sold by the platform org (the only seller whose Stripe account it is): - the public invoice offers Pay by card: POST **************** opens a Stri...
Refuse a department or contact mailbox past the email licenses
Owner rule 2026-10-22: per-user add-ons bill the licenses purchased; how many mailboxes may be in use is limited only by them. Under a 3rd-party provider a depa...
Record offline acceptance, log prints, convert quotes into subscriptions
- POST **************** (SEND_QUOTES or MANAGE_QUOTES) - POST **************** (VIEW_QUOTES or MANAGE_QUOTES) - POST .../{uid}/convert takes an optional body (t...
Endpoints to set a subscription's auto-renew and an order's notes in any status
Card customers are charged automatically on the billing day
For AUTO_BILL subscriptions the billing job charges each approved invoice to the customer's saved card on its billing day through BillingService's internal card...
Automatic subscription invoicing - drafts, owner review, email with PDF, payments, reminders
SubscriptionBillingJob (hourly, one pod, and at startup) runs the cycle: - raise each renewal invoice as a draft lead-days before its billing day - move subscri...
Approve and always allow checks the rights a tool needs in one case only
Approval follow-up 2026-10-21: the Tool Plane's card now names the rights a tool's service enforces in some cases only (alwaysAllow.rightsWhen: a colleague's le...
S-I1 accepts REPLACED, so IoTService revokes a superseded Alexa link's grant
Owner 2026-10-21. KamoOAuthRevokeReason.REPLACED already exists (STRING-persisted, no CHECK on revoked_reason), so no shared-lib or DDL change; the internal rev...
Approve and always allow, from an SI's approval
GET **************** POST **************** {approvalId, scope TOOL|CLASS, grantRights?} DELETE **************** (Ask me again) The approval names the tool and...
An order lends only the rights the called tool needs (No Insubordination Rule, IoT R7 round 3)
POST **************** takes an optional neededRights (RoleRightType names; an unknown one is a right nobody holds). With it, OrderDelegationService.lend borrows...
Each break-glass window has its own id, so other services can audit under it (IoT R7)
A god-mode window now carries godModeSessionId (a random UUID) in ***: minted when it opens, cleared when it closes, and added to a window that was opened befor...
The loan-officer door reaches the MLOS engines, writes take write rights, and an SI clears the MLOS walls (SITP TP21)
New relays on /api/security/mortgage-apps (MortgageLoanDeskController, @RequireRight, the caller's org's loan only): - GET /{uid}/qualification, /{uid}/engine-l...
PREPARE_COMMISSION_PAYOUTS composes the draft payout batch, seeded to every finance manager (SITP TP18)
Opening the draft batch and adding, changing or removing its lines now take MANAGE_ORG_FINANCES or PREPARE_COMMISSION_PAYOUTS (the owner always); sending a batc...
Devices is a standard alias
Required like careers and computers: the record is what makes shared device access open anywhere. The kamo-iot share pages are served at devices.<domain>; the l...
Reserve the devices alias, not iot
The kamo-iot share pages are served at devices.<domain> (owner 2026-10-18: "iot" is a technical term; anything customer-facing says devices). OrgAliasPolicy res...
The billing door makes a member a licensee before a seat, and reads usage for the org billing rights (SITP TP18)
BillingService's LicenseService.assign refuses anyone who is not already a licensee of the subscription, so the relay's seat assign alone could not seat a new m...
HR reads a member's leave balances, as it already spends and corrects them (SITP TP18)
GET **************** own on identity (as /me/accruals), anyone else's with MANAGE_TIMECARDS, the right that already gates /use and /adjust on the same balances;...
Rights-carrying doors to commerce invoices and billing, and the MANAGE_ANALYTICS backfill (SITP TP02)
Commerce invoices: InvoicingService's CommerceInvoiceController checks no right by design (it expects SecurityService to own the session and the rights) and not...
Report option providers and Account merge keeps tagged devices (SP13)
IoT reports — no god mode, the owner rule, and ReportDefinition.exportRight enforced at download, schedule and every run (SP13)
SecurityService opens Service Work jobs for IoT — endpoints, one-transaction opener, crossapp scan (SP13)
Purge sweep, OAuth configuration and the repository scan (IoT SP09)
Internal grant revocation for IoTService and platform client administration (IoT SP09)
Token endpoint with PKCE, rotation with a 24-hour grace, reuse detection and RFC 7009 revocation (IoT SP09)
Consent view and single-use decision bound to the sign-in session, pending grants and codes (IoT SP09)
O3 binds a fresh sign-in to the authorization request with an atomically spent one-time key (IoT SP09)
Authorization requests O1/O2 with RFC 6749 redirect rules, PKCE S256 and rate limits (IoT SP09)
Atomic one-time-key spend, request store, rate limits and redirect URLs (IoT SP09)
Reserve the iot alias; pin iot.<domain> resolution
The rebuild carries DomainAliasType.IOT from the shared library. KnownAliases / SSL_PROBE_LABELS follow only after iot.<apex> answers over TLS (a later commit),...
Kamo OAuth authorization server tables and the iot.alexa client (IoT SP09)
SP12 remote-monitoring endpoints, the portal connect-devices handler and their guards
SP12 enrollment, consent, pause/resume/end/revoke and the connect link
SP12 monitoring reads, the portal link, and home readings kept out of the chart's recent window
SP12 remote-monitoring foundations — write gate, access, audit, IoT client, merge hook
The No Insubordination Rule — a teammate's direct order lends an SI their rights for that run
Owner 2026-10-15, refined the same day: any team member (a person or another SI) who gives an SI a direct order lends it their rights for the work that carries ...
A person may let SI colleagues greet them with the short form on internal calls
SI call disclosure, owner decision 11 (2026-10-15): the colleague short form ("Hi Sage, it's Luna, the automated assistant.") is used only for active staff who ...
Verify-password records a session re-check marker and limits wrong attempts
IoT SP01 Task 7 (marker half). KREAUTH<***Id> = member id for 3600 s after a correct password; five wrong passwords per session in 15 minutes answer 429 too_man...
Seed the IoT administration rights to CONFIGURE_SYSTEM holders on the boot that introduces them (IoT SP00)
The IoT tour needs no lineage: every Show Tour right is already on for every role (fefd98c2).
Branch types and security models are the platform's to edit
Branch types, the security models behind them (default security roles, app availability, home screens, commerce markets, subdomain config) and the master model ...
Email the accept-window audience when a new lead sits unclaimed for two minutes
LeadAvailableEmailSweep (every 15 s, singleton lease) finds leads that entered the pool 2-15 minutes ago and are still unclaimed, per org via ix_leads_org_creat...
Every Show Tour right is on by default — for every role, every branch-type template, and everyone already here
The first release seeded each tour only to roles already holding a right in its app and left every branch-type template at Not Specified: 2,416 role rows held n...
Remember guided-tour steps per person across organizations, and seed every Show Tour right
GET /api/security/guided-tours answers which tour steps the signed-in PERSON has been shown or skipped, as the union over every membership of the same user — a ...
/api/security/cameras/** — the KamoCameras relay (merge feat/kamo-cameras)
CameraController is the trust boundary for KamoCameraService: it resolves the session, checks VIEW_CAMERAS / MANAGE_CAMERAS / MANAGE_CAMERA_SITES (now 334-336; ...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.