Changelog
What's new.
Every improvement to the platform, as it ships.
· MCPGatewayService
Plain-language approval cards, worded as the reader may see them
Owner order 2026-10-20: approvals showed members GUIDs and JSON. POST **************** (internal auth) words each approval for a non-technical person: one sentence of what the SI wants to do (an ICU phrase for every one of the 335 side-effecting tools, the same strings the dictionary carries), the records it touches named AS THE READER (their own session, the catalogue's READ tools through ToolVisibility, the service checking again; colleagues, departments, teams, job titles and markets from the org's own directory; vetted nouns otherwise), labelled fields with money, dates, phones and emails typed, the exact message it will send, the risk in plain words. A record the reader may not see is named by its noun; no id or JSON is ever a field. ApprovalCardCoverageTest fails for a write without a phrase or an id argument without a record kind.
· kamo-internal
The texting window shows the pictures, recordings and files people text in (SITP MMS)
Each message's inbound parts (VOIPService now keeps them) draw inside its bubble: pictures in place (tap to open), voice notes and video with players, PDFs and contact cards as named files, each through the chat's attachment recovery (cookie re-plant, then a 410/503 verdict). A part still being fetched says so and the thread reads itself again (2 s ... 60 s, then stops); one that was not kept says why. The live frame's attachmentsPending drives the first re-read, the paperclip in the conversation list and the voice's 'has attachments'. Screenshot- and axe-checked in a harness.
· kamo-internal
The web Alexa section, its virtual sensors, and Alexa links as the who of a grant
- Settings -> Devices (IoT) -> Connections gains a Voice section (only while Alexa is usable by the organization): the Alexa links, how to link one, and a link dialog with Update Alexa now, Rename, Remove, Give this link access, what Alexa sees and does not see, and its virtual sensors (add, edit, test, delete) — phone parity with KamoMobile's Alexa screens (SP09 V1-V14). - The access editor's Who step offers the organization's Alexa links as chips (iot-service V15, MANAGE_IOT_ACCESS) and the review lists what each link gains; ?add=voice:<id> deep link. - check-iot-copy now checks every iot.* sentence for the brand (vendor and sharing copy included), with the platform-only connector-card sentences exempt. - Help: iot-grant-access, iot-alexa-connect, iot-alexa-commands-and-limits describe the web screens. IoT close-out F9g, F13 (web), F9h guard.
· MCPGatewayService
Sms_read_attachment, and sms_read_thread names what was texted in (SITP MMS)
TP11 deferred sms_read_attachment because VOIPService kept no inbound MMS media; it does now (voipservice@8eda899). So: - sms_read_thread lists each inbound part of a message as attachments [{attachmentId, mimeType, fileName, sizeBytes, status, reason}] (hasAttachment covers them); the provider's link and the serving URL are never handed over. - **************** attachmentId): GET **************** with the caller's ***; VOIPService checks ACCESS_VOIP and that the thread is the caller's own (404 otherwise). Text and contact cards are read as text, PDFs and pictures through OCR, sound and video are named, not read. READ, untrusted, PHI-sensitive, ACCESS_VOIP; its content item is the SMS_THREAD, pre-checked on conversationId like sms_read_thread (ContentReadTools). Guards and golden tool lists regenerated for exactly this tool (catalogue 164).
· VOIPService
Keep the pictures and files people text in, for every provider (SITP MMS)
VOIPService stored only the words of an inbound MMS, so nobody (person or SI) could see what was texted in. Now every inbound rail reads its media and VOIPService keeps it: - Parsers: Twilio (MediaUrlN), Telnyx (payload.media, carrier and phone-server rail), Flowroute (JSON:API included media), RingCentral (MmsAttachment parts, message-store content address on the instance's platform), JustCall (sms_info.mms), on-premise phone systems (media[]). - Credentials only to the provider's own https host, asked per hop (Twilio Basic on api.twilio.com, RingCentral Bearer on *.ringcentral.com, JustCall key:secret on *.justcall.io); never to the CDN a link redirects to. - SSRF guard: https on 443 only, no user info; the HTTP client's DNS resolver refuses any name with a **************** answer, so the address checked is the one connected to; at most 3 redirects, each re-checked; 10 MiB cap (declared and streamed); connect 5 s, read 15 s, whole fetch 60 s. - Type from the bytes: pictures, PDF, audio, video and vCards only (no SVG); a page dressed as a picture is refused. - After the text commits, never in its way: parts are recorded in their own transaction and fetched by a small pool; a one-minute sweep retries (5 attempts over ~3 h) and takes over a dead pod's claim (one conditional UPDATE decides between replicas). A carrier redelivery re-offers parts the first delivery never recorded. - Stored through **************** (imaging bucket, org dedup scope, never an unwritten dat), keyed by the dat's real extension. - Thread page: each message carries attachments {id, status, mimeType, fileName, sizeBytes, url}; GET **************** serves one (ACCESS_VOIP + the thread's own member, Range, nosniff, sandbox CSP). The list row and the lead timeline show the paperclip; the live frame says attachmentsPending. Table VOIP_MESSAGE_ATTACHMENT: **************** applied.
· MCPGatewayService
An SI on a teammate's order can find and operate just the function the order needs; on god's order also unverified ones (IoT R7 round 3)
- IotPack.planSend: when the SI's own view lacks the device or the function (or may not OPERATE it) and the caller is on an order-scoped session, IoTService's GET **************** is asked whether the order's REQUESTER may operate it; its item is planned like any other (same value checks, class by safety class, summary), else the existing DEVICE_NOT_AVAILABLE / **************** IoTService lends the grant and audits it. - New read iot_order_devices (functionKey, optional name and deviceId), AI_ONLY and listed to an SI always: "Devices the person who gave you this order can operate with a function, while you carry out their order." NOT_ON_ORDER outside an order. Items are re-checked as an SI's view is (IotOrderFunctions / IotViewRules.orderFunction): never STREAM or camera.snapshot, SAFETY_CRITICAL and above the SI ceiling only on god's order, VERIFIED only (UNVERIFIED too on god's order, never FAILING), only the asked key, and none when the answer is not for this order's requester. - On an order iot_send_command is offered on its base deviceId/functionKey (no enum of the SI's own devices, never withheld IOT_NOTHING_AVAILABLE), so a device the lookup found can be named. - IotViewRules: a god-order view (Round 2) also keeps UNVERIFIED functions (V2), never FAILING. - Catalogue golden **************** regenerated: exactly one line added, iot_order_devices; registry size 163; ContentReadTools entry.
· MCPGatewayService
An order's tool call runs on a per-call scoped order session that lends only what the tool needs (No Insubordination Rule, IoT R7 round 3)
OrderDelegation.resolve takes a CallScope: the tools/list keeps the session lending the requester's whole standing (kamo:tool:order:<runId>), so the SI knows what it may be asked to do; a tools/call on an order mints/uses a session lending ONLY the called tool's needed rights: the rights it requires of a person (allOf and anyOf, the same K3 weighs as RequestContext rightsAllOf/AnyOf) and, for every iot_ tool, VIEW_IOT_DEVICES (IoTService's own gate; the iot tools declare no session rights). SecurityService gets them as neededRights and mints the session even when nothing is borrowed, so its delegation block (requesterMemberId, orderRef) reaches downstream services. Kept per run and tool **************** under the same TTL rules; audit rows keep authorityBasis, onBehalfOfMemberId and borrowedRights.
· SecurityService
An order lends only the rights the called tool needs (No Insubordination Rule, IoT R7 round 3)
POST **************** takes an optional neededRights (RoleRightType names; an unknown one is a right nobody holds). With it, OrderDelegationService.lend borrows only (neededRights, with the ancestors each needs to survive the hierarchy closure) of the requester's rights, less the SI's own, the SI floor (AiRightsFloor) and the SI's explicit NUKEs, and mints the order-scoped session even when nothing is borrowed: its delegation block (requesterMemberId, orderRef) is what IoTService weighs the order by. The answer says scoped:true; the audit line names the needed rights. Without neededRights (the Tool Plane's tools/list) the whole standing is lent, as before. The SI's stops, SELF and the requester checks are unchanged.
· kamo-shared-library
GodPassesRightChecks — god eligibility alone counts only in the platform org (IoT R7 round 3)
Owner rule (2026-10-18): outside the platform organization god acts only through break-glass. **************** an open window always passes a tenant-right check; GD eligibility alone only in the platform org. For the services whose "god bypasses" right checks read GD alone (MediaService AuthHelper, ConversionService).
· kamo-shared-library
Index loan_files.loan_transaction_id on LoanFile
The deal -> loans lookup **************** deal status, pipeline summary, and the retireIfEmpty check after an application is deleted) was a sequential scan. The index was applied to production by hand on 2026-10-18 (securityservice docs/sql/2026-10-18-loan-files- loan-transaction-id-index.sql) under the same name, so a KamoInitializer ddl-auto run finds it by name instead of building a second one.
· kamo-internal
The activity says "as god, break-glass <window>", and god's own window may share (master section 10 R7)
Owner 2026-10-18: every action is visible to the tenant. actorText appends iot.actorStanding.asGod / asGodBreakGlass (dictionary e7519fa8) for god's rows and an SI's on god's order, so the activity list, the device history and the activity grid all say it. "Share device access" (device page, row menu, chat windows) and the device page's access editing are hidden only in someone else's god-mode window (useNonGodWindow: a window open while the manifest's caller.god is null); god's own window may share — a share stays personal and the server judges it.
· MediaService
The IoT live-topic check carries the subscriber's session, so god's break-glass window can be honoured (IoT R7)
A god-mode window is a property of the session, not the member, and the STOMP authz calls to iot-service named only the member, so god in another org could not get live device/org updates. - WebSocketAuthInterceptor keeps the resolved *** id in the socket's session attributes (***Id; server-side only, never logged). - IotStompAuthz.allowDevice / allowOrg hand it to IotStompAuthzClient.device / org, which send it as X-Subscriber-Session on **************** and /org/{id}; no attribute, no header. The relay question is unchanged and the cache keys stay per (member, target). - IotSubscriptionRegistry keeps the id with each recorded subscription and its re-checks (access signal, 60 s sweep) carry it too: otherwise god's live view would be revoked by the first sweep after the cached allow expired, and with it a closed window is revoked as it should be.
· MCPGatewayService
An SI on god's order sees and can ask for god's devices (IoT R7, No Insubordination Rule)
IotViewRules: an SI's manifest whose caller block names god's standing (caller.god PLATFORM | BREAK_GLASS) and the requester (caller.godOnOrderOf) keeps SAFETY_CRITICAL functions (V6) and those above the SI class ceiling (V11), only on the order-scoped session of that very requester's order (IotManifestClient hands the session's delegation.requesterMemberId). Every other rule stays; a person's view and an SI's own session never read the fields. IotCallerView carries the GodOrder. IotPack.planSend asks a SAFETY_CRITICAL function under OPERATE_SECURITY_DEVICE, as SECURITY. The tool catalogue's declared classes are unchanged.
· kamo-shared-library
GodWindows finds a member's open break-glass window among their sessions (IoT R7)
Pure (no stereotype, no Redis client): the caller reads ***UIDX<userId> and hands the sessions in. A window counts only in the member's own session (not impersonated, not an SI's lent one), open per SessionPlatformFacts (GD, godModeActive, godModeExpiresAt ahead) and carrying godModeSessionId. Used when an SI acts on god's direct order (No Insubordination Rule, owner 2026-10-18).
· kamo-internal
God's controls are usable and need no co-signer (master section 10 R7)
Owner 2026-10-18: god (the platform owner) operates every IoT function; in another org only inside break-glass. The manifest's caller.god (@kamo/iot-core 0.9.0 manifestGod) now: - lets controlState draw a SAFETY_CRITICAL control no approver enabled (a manifest block and view-only still win); - drops the co-signer step from the command run (planSubmission(fn, god)); the confirmation and the password re-check stay; - lets god's own god-mode window edit access on the device page (someone else's window stays view-only, and the server's view-only verdict always wins).
· kamo-shared-library
The command audit and the activity say when god acted, and under which break-glass window (R7)
Owner 2026-10-18 (IoT master section 10 R7): god, the platform owner, has total control of IoT devices, and every god action outside the platform org is audited. IotCommand and IotActivity map god_basis (PLATFORM | BREAK_GLASS, IotGodBasis) and god_session_id (SecurityService's godModeSessionId); both nullable and null on every other row. The command audit and activity reports append "(as god)" / "(as god, break-glass <id>)" to the actor. DDL: iot-service **************** applied by hand before this.
· SecurityService
Each break-glass window has its own id, so other services can audit under it (IoT R7)
A god-mode window now carries godModeSessionId (a random UUID) in ***: minted when it opens, cleared when it closes, and added to a window that was opened before ids existed on its next re-assert (the id only; the expiry never moves). The activation and deactivation rows in phi_access_log name it, and GET/POST /session/god-mode report it as sessionId. IoTService writes it into the command audit and the activity of every god action taken in another organization (owner 2026-10-18, IoT master section 10 R7).
· MCPGatewayService
Mortgage loan files for SIs: pipeline, the application, readiness, conditions, documents, disclosures, pricing and locks, AUS, vendor orders, consent and the edits (SITP TP21)
43 mlos_* tools (MlosPack) through SecurityService's loan-officer door **************** SITP TP21 securityservice@27e06020) as the SI member, never the MLOS services' internal doors; the door checks the MLOS right and resolves every application under the caller's org; each tool names the same right. App gate: Mortgage Lending (MLOS). - Reads (MLOS_VIEW_PIPELINE): search, get application (+ pipeline position; no SSN, no HMDA demographics), transactions, readiness (+ closing readiness, payment), qualification, check a move, conditions, condition templates, document checklist, disclosures (+ envelopes), TRID timers, programs, score programs, pricing quote (the ladder's pricedResultId), rate lock (+ engine locks), lock recommendation, AUS (findings + agency runs), vendor orders (+ events), HMDA LAR issues (identifier + field only), resolve a loan number, borrower consent, communications, QC queue. - Writes: create (TAKE), update a section / add / remove a row (any write right; never an SSN, status or HMDA), transition (no closing, funding, denial or forced pass; off-ramps DELETE_RECORD), add / clear / waive conditions, refresh the checklist, accept / reject a document, order a vendor service or credit and lock a rate (COMMIT_PRICING, FINANCIAL), cancel an order, send disclosures (SHARE_DOCUMENT_EXTERNAL; consent checked before a set is issued), resend / void an envelope, ask the lock desk, run AUS (SHARE_DOCUMENT_EXTERNAL, UNDERWRITE), assign the loan officer (ASSIGN_WORK). - The door holds an SI's credit pull, AUS run, lock and electronic disclosure behind the MLOS kill switches, the lock autonomy wall and E-SIGN consent; refusals reach the SI as CONFLICT with the code. Guards: ContentReadTools (20 unlabeled loan-file reads; templates, programs, scores not content), DisclosingTools (9 note/send tools, 11 not disclosing), CollabTools NO_INTENT, RegistryCompleteness (TP21 sets, COMMIT_PRICING, ASSIGN_WORK, mlos_transition also DELETE_RECORD); goldens regenerated (+43, nothing else changed). Full suite 1869/1869.
· MCPGatewayService
Patient Records for SIs: the schedule, the front desk, chart and FHIR reads, note drafts and the revenue cycle, with payment posting (SITP TP23)
18 ehr_* tools (EhrPack) over SecurityService's EHR controllers as the SI member; each names the right SecurityService checks there, and anything inside one chart also needs the care relationship (a refusal is a 404 that confirms nothing). - Schedule: ehr_schedule_availability (open times + visit types), ehr_schedule_day, ehr_book_appointment, ehr_cancel_appointment (who and why), ehr_check_in. - Front desk: ehr_patients_search (identity only), ehr_patients_get (purpose of use), ehr_patients_register (duplicates checked first; registers only with confirmNotDuplicate). - Chart: ehr_chart_summary (chosen sections, minimum fields), ehr_fhir_read, ehr_fhir_search (one patient, at most 50; read as application/fhir+json). The purpose of use has no default. - Notes: ehr_notes_draft and ehr_notes_revise write UNSIGNED notes (SecurityService marks an SI's version SI-assisted); ehr_notes_list (a patient's, a note's versions, the SI's own drafts). - Revenue cycle: ehr_billing_worklist (nine worklists), ehr_claims_get, ehr_coverage_get (never a card image; may-bill with its reason); ehr_post_payment is money (FINANCIAL_TRANSACTION, the plan carries the amount, money sent as decimal strings). Never here: signing/co-signing, prescribing, orders, immunizations, break-glass, merge, export (the SI floor), claim create/submit, portal invites. Every tool is phiSensitive and offered only where the org has the Patient Records app AND has declared it handles PHI (new ToolVisibility rule PHI_TENANT: the capability guard says yes to NOT_PHI tenants), and refused for outside readers. Clinical text is untrusted; the billing ledger is trusted so a posting run keeps its money tool. Guards: ehr_ prefix, ContentReadTools, DisclosingTools (five NOTE/SHARE writes), CollabTools, catalogue counts, the schema golden (+18). The tools/list snapshots are NOT_PHI orgs, so they do not change.
· SecurityService
The loan-officer door reaches the MLOS engines, writes take write rights, and an SI clears the MLOS walls (SITP TP21)
New relays on /api/security/mortgage-apps (MortgageLoanDeskController, @RequireRight, the caller's org's loan only): - GET /{uid}/qualification, /{uid}/engine-locks, /{uid}/lock-recommendation, /{uid}/aus-runs, /resolve-identifier (another tenant's number reads as unresolved), /{uid}/communications (MLOS archive + outbox), /{uid}/consent (parties, current consent per scope/channel, preferences): MLOS_VIEW_PIPELINE. - POST /{uid}/rate-lock/commit (a priced result of THIS loan only; PROCESS or UNDERWRITE, as the door's other lock writes) and POST /{uid}/aus-runs (UNDERWRITE, as recording an AUS finding; never a fresh-credit attestation). Steward routes stay operator-only. Security fixes (no member held MLOS_VIEW_PIPELINE without a write right, so nobody loses access): - PUT **************** POST /{uid}/credit/order (staff) and the QC fact review took the view right for a write; they take an MLOS write right. - CreditOrderService loaded the application by id alone: another tenant's application now 404s. SI walls (MlosSiActGuard; a person is unaffected): an engaged MLOS kill switch for the task (RATE_LOCK, AUS_SUBMISSION, CREDIT_PULL_AND_ANALYSIS, DISCLOSURE_AND_TRID, a vendor category's task type) holds the SI's act (409 KILL_SWITCH, fail closed); a tenant whose lock autonomy turns auto-execution off keeps every lock a person's (AUTONOMY_WALL), and an engine LOCK_BLOCKED holds it; no credit pull or AUS on a draft; electronic disclosures (envelope create, resend) only when every customer party holds a current E-SIGN consent (NO_ECONSENT). Kill switches, the governor and the posture are read, never set.
· MCPGatewayService
Support tickets, system bugs, marketing materials, Growth Hub, tracking codes and social pages for SIs (SITP TP15)
54 new SI tools, each checked by the same rights at the gateway and at MediaService (DocsService for the materials list): - support_*: list (with the queue's counters), get (never joins: ?join=false), join, claim, assign/reassign (ASSIGN_WORK unless taken oneself), escalate (planned public when the topic's team is another organization's, carrying the conversation), status, priority, convert a pre-ticket, create (public when the topic routes to the provider), rate, topics, metrics. A ticket is its CHAT_SESSION; chat_send already answers its visitor (SEND_WEBCHAT_MESSAGE). - bugs_*: list + status counts, get + thread, report (published as a member's; screenshots from documents), edit own untriaged report (full-replace merge), void own, comment, vote, verify fix, issue persists, mute, react. Triage and publish stay with platform staff. What an SI writes there is planned public (the platform's team reads it). - materials_*: list (MATERIALS documents with tags, campaigns, review), share link (SHARE_DOCUMENT_EXTERNAL), links, revoke, campaigns (save/delete/items), tags (tag creates a missing one; delete), review (APPROVED is SHARE_DOCUMENT_EXTERNAL; never one's own upload), analytics. - growth_*: my queue, submit evidence, requests (list/save/archive), submissions, review (a rejection needs its reason). - tracking_*: codes, a code's results and visitors, a visitor (no IP address), scoreboard, mint/change, retire. - social_*: timeline + accounts, post (SHARE_DOCUMENT_EXTERNAL, public; materials go as 1h links), reply and react (SEND_WEBCHAT_MESSAGE), delete post. All APPROVE_BEFORE by default on an SI's own initiative. Guards: prefixes **************** **************** rulings, catalogue 490 -> 544; tool-list snapshots regenerated (the only change is the 54 new tools).
· MCPGatewayService
IoT field-service reads and alarm handling for SIs: sites, a customer's and a work order's devices, history, commands, an alarm, the summary, acknowledge several, shelve, unshelve, note (SITP TP19)
Eleven iot_* tools in the IoT pack, by its own conventions: offered per caller from the manifest (IotTools.RIGHT, the view's withholding reasons), every device, function and alarm checked against the caller's view, results whitelisted (no member's note, no customer name, no share label, no rule author's text), TEXT values taint the result. - Reads (VIEW_IOT_DEVICES): iot_list_sites (address and time zone, never a site's notes or an org-wide device count), iot_devices_for_customer (worst open alarm, newest work order), iot_devices_for_job, iot_get_history (a device's HISTORY functions only; withheld when none is in view), iot_list_commands (functions outside the view dropped), iot_get_alarm (timeline; a note is flagged, never quoted), iot_alarm_summary. - Alarm handling (ACKNOWLEDGE_IOT_ALARMS, WRITE_INTERNAL): iot_acknowledge_alarms (up to 25, the acknowledged skipped), iot_shelve_alarm: UPDATE_RECORD, re-classed OPERATE_SECURITY_DEVICE for a CRITICAL or MAJOR alarm, as acknowledging one is; iot_unshelve_alarm and iot_annotate_alarm: UPDATE_RECORD. A view-only session writes nothing; a class changed after approval is refused. Co-signing, retrying a command, grants, shares, safety overrides and IoT settings stay a person's; alarm rules, suppressions and KPIs need MANAGE_IOT_* (the SI floor).
· MediaService
A ticket can be read without joining its conversation (?join=false) (SITP TP15)
GET /api/support/tickets/{id} puts an entitled agent who is not yet in the ticket's conversation into it, as opening the window should. An SI reading the queue would join, and be paged for, every conversation it looks at, so ?join=false reads the ticket and nothing more. The console never sends it: the default (true) is unchanged.
· MCPGatewayService
Personal loans for SIs: the book, payments, payoff, history, statements, fees, offers, promises to pay and the money acts (SITP TP22)
27 loans_* tools (LoansPack) straight to KamoLOS through its one-time-key door (SITP TP02, new downstream LOS, X-OTK) as the SI member; KamoLOS checks the PLOS right on that session and scopes every id to the organization; each tool names the same right. App gate: Personal Lending (LOS). - Reads (PLOS_VIEW_PIPELINE): loans_search, loans_get, loans_payoff_quote, loans_list_payments, loans_history (by loan, by offer, or the organization's trail by kind/actor/time; untrusted: notes), loans_list_statements, loans_get_statement, loans_list_fees, loans_list_draws, loans_list_offers, loans_get_offer, loans_get_autopay, loans_list_payment_methods (kind, brand, last four only), loans_list_charge_off_queue, loans_list_products, loans_get_state_rule, loans_aging_report. - loans_record_promise_to_pay (CREATE_RECORD, PROCESS); loans_create_offer (draft, CREATE_RECORD), loans_send_offer (SHARE_DOCUMENT_EXTERNAL) and loans_rescind_offer (DELETE_RECORD): UNDERWRITE. - Money (FINANCIAL, FINANCIAL_TRANSACTION, the plan carries the amount): loans_record_payment (check, cash, wire), loans_adjust_balance, loans_waive_fee, loans_set_autopay (pause/cancel), loans_request_draw (CLOSE_AND_FUND), loans_confirm_charge_off (SUSPEND_OR_WITHDRAW). Never here: offer accept/decoder, signing, autopay enable (the borrower's mandate), Pay Now (KamoLOS v1 debits nothing), payment-method edits, Stripe Connect, product edits. Processor handles, mandates and blob ids are never answered. Loan reads are unlabeled items; reasons written on a loan are disclosures (NOTE/SHARE, no intent). The tool lists gain exactly the 21 tools a defaults charter offers (the six money acts stay hidden while FINANCIAL_TRANSACTION is forbidden).
· MCPGatewayService
E-signatures for SIs: read a template, track sent documents and a record's requests, send, remind, resend, void (SITP TP19)
Eight esign_* tools (EsignPack) through a new ESIG(OTK) door to ESigService's staff API, as the SI member; ESigService checks every right itself (SITP TP02) and bounds templates and envelopes by the session's clearance (esigservice@2533b2d): - esign_get_template (by its docs_list_templates documentId or templateUid: signer slots in order, pinned names/addresses), esign_list_envelopes (filtered, paged, newest first), esign_get_envelope (each signer's progress, decoder/delegation reasons cut), esign_list_requests (a record's Signature Requests tab with buckets and whether a reminder can go): VIEW_DOCUMENTS; untrusted. - esign_send: EDIT_DOCUMENTS, SHARE_DOCUMENT_EXTERNAL (a person approves an SI's own initiative), ad hoc only, signers fill the slots in order (inOrder = one routing tier each), outside addresses pass the outreach gate; refused before approval when it names more signers than the template has slots. - esign_nudge and esign_resend: SEND_EXTERNAL_EMAIL, or SEND_INTERNAL_EMAIL when every address is the organization's; a cooling-down or finished signer is refused before anyone is asked. esign_void: DELETE_RECORD; the outstanding signers read the reason. Signing an envelope oneself and template authoring are never built. Guards: the esign_ prefix, ContentReadTools, DisclosingTools (send and void disclose), CollabTools, catalogue counts; the tools/list snapshots grow by exactly these tools.
· MCPGatewayService
An SI prepares the draft commission payout batch, never sends it (SITP TP18)
commissions_draft_batch (open the DRAFT batch, or find the open one) and commissions_edit_draft_line (ADD / UPDATE / REMOVE a draft line; UPDATE restates the whole line; never a line crediting the SI) take PREPARE_COMMISSION_PAYOUTS or MANAGE_ORG_FINANCES, as SecurityService now does (securityservice@48904016). MANAGE_ORG_FINANCES is on the SI floor, so the new right is what lets a finance SI prepare a batch for a person to review and send. A line's description is a disclosure (NOTE/SHARE) to VIEW_ORG_FINANCES holders and the member it credits. Sending, voiding a line, payout accounts and withdrawals stay a person's.
· KlusterServices
A Home Assistant lab instance at home.kamouniverse.com
One Home Assistant 2026.10.2 (digest-pinned) for IoT testing of Kamo's HOME_ASSISTANT connector and for the owner's own use under the HA account sajon. The demo integration supplies about 120 test entities. - StatefulSet in `kamo`, /config on a 10Gi longhorn volume, 1Gi memory, startup/readiness/liveness probes, preStop 10s, minReadySeconds 15. - A CiliumNetworkPolicy admits only Traefik on 8123 and lets HA out to DNS and the public internet, never a private range. In `kamo` rather than a namespace of its own: Traefik watches a fixed namespace list, and extending it rolls Traefik, which serves its self-signed default to every org for a few seconds. - configuration.yaml trusts the pod network as proxies (use_x_forwarded_for), bans an address after 10 failed sign-ins, and leaves location and units in HA's storage so they stay editable. - IngressRoute Host(home.kamouniverse.com), TLS by SNI. auto-cert pre-issues the host from STATIC_DOMAINS once its DNS record exists. Nothing on kamocrm.com. home-assistant/ is applied by hand (apply.sh, README). A deploy step would edit .forgejo/, and that forces a full reconcile. This push runs only the auto-cert step. Its live state matched origin/main before the push.
· kamolos
A loan's assessed fees can be read, so a fee can be named to waive it (SITP TP22)
GET /api/los/fees/by-loan/{loanId}: the loan's fees (late, NSF, annual), newest first, waived or not; PLOS_VIEW_PIPELINE (LosRightsFilter, as every read) and the caller's organization's loan only (404 otherwise). POST **************** names a fee by uid and nothing handed the uids out.
· kamo-internal
Mirror PREPARE_COMMISSION_PAYOUTS (570) under VIEW_ORG_FINANCES (SITP TP18)
Composing the draft commission payout batch without sending it; display string matches RoleRightType.java exactly. Listed with the other finance rights under Accounting & Finance in the role editor. RIGHT_PARENT 278 -> 279.
· SecurityService
PREPARE_COMMISSION_PAYOUTS composes the draft payout batch, seeded to every finance manager (SITP TP18)
Opening the draft batch and adding, changing or removing its lines now take MANAGE_ORG_FINANCES or PREPARE_COMMISSION_PAYOUTS (the owner always); sending a batch and voiding an issued line still take MANAGE_ORG_FINANCES, and cancelling a withdrawal APPROVE_ORG_PAYOUTS. CommissionService keeps editing only DRAFT lines and refusing a line that credits the actor. Grant backfill: PREPARE_COMMISSION_PAYOUTS is seeded from MANAGE_ORG_FINANCES **************** so everyone who composes a batch today still can.
Your universe is waiting.
Start free in minutes. Add products whenever you are ready — no migration, no new logins.
Free forever — no credit card required