Changelog
What's new.
Every improvement to the platform, as it ships.
· kamo-internal
One Who It Applies To control for every layered SI setting
SIS3 (report mockup 4). **************** WhoItAppliesTo (the whole organization, then each department, job title, team or one member, with Change / Remove / Add A Different Setting), AddScopeDialog, WhoGetsWhat (what every SI or person uses now, with Set By), useSetBy and useScopeNames (names and department paths from the org vocabulary). Background Sound, Easter Eggs, Shift Reports and the Personal Assistant all use it; their four hand-made copies (override rows, add dialogs, hears/gets cards, ShiftOverrideDialog) are gone. Fixes: - Shift reports: the Which Setting Wins chips follow the server (the person who gets the report first: own choice, set for them, team, job title, department; then the SI); a person's own choice shows as its own read-only row. - Personal Assistant: a layer that could not be read never opens an editor, so an empty form can no longer be saved over real settings; switching layers with unsaved changes asks first. - One SI language list (/api/kamoai/languages) for calls and the assistant (the defaults tab and each member's own settings), keeping any stored language. - The assistant shows what each setting inherits, offers the organization's own personality styles, and has a Who Gets What for any member.
· kamo-internal
Settings › Super Intelligence in six tabs with drill-in pages at their own addresses (SIS2)
- **************** Overview · How They Work · Daily Work · Safety & Oversight · Brains & Tools · Personal Assistant. Each tab opens on a hub of cards; each card is a drill-in page (breadcrumb, Back one level with push, rooms with their own address) that mounts the EXISTING editor unchanged, with that editor's own Help & Tips. First-time intro per tab and page. - Every old /settings/ai?tab= link goes to its new home with its inner parameters; the SI Workforce tabs (workforce, si-status, workforce-controls, usage) still open as before until SIS5's /workforce page takes them. - ONE access map **************** for the menu, the landing section and the page; aiLandingAccess removed. Gate drift fixed: Workforce Controls needs the SI Workforce app; supervisors get SI Status and the topic; Spending opens for who can read or change budgets; usage follows VIEW_AI_USAGE. - Settings menu topic and landing cards follow the new map, named Super Intelligence. - Help Center: settings paths rewritten; new article Super Intelligence Settings. - Kit: brand ink readable on a dark palette; phone-width intro; info chip contrast.
· AIService
Organization personality styles and a Who Gets What preview
SIS3. The personal SI Assistant now accepts the organization's own personality styles (org:<uuid>) beside the built-in ones: validated, checked to exist in the org on save (gone = plain refusal, unreadable = try again), and spoken with that style's prose in the prompt, the settings view and the voice call. A style that is later removed adds no prose, as an unknown name always did. GET **************** (MANAGE_AI_SETTINGS, as every layer route) answers what one member's assistant uses and which layer set or locked each setting, for the shared Who Gets What table. Never memory, avatar or model. The layer model (locks, strictest limits) is unchanged.
· kamo-internal
The root MUI theme takes the organization's brand, never Material blue (SIS1)
There was no ThemeProvider above I18nProviders, so it built on MUI's stock theme and every color="primary" button, switch, slider, tab and spinner in the app drew #1976d2. - app/lib/brandColors.ts: read the RESOLVED **************** once the org theme stylesheet (#kamo-theme-globals-css) has loaded, and again whenever it is swapped (capturing load listener + kamo-theme-config-loaded). Hex/rgb parsed; oklch/hsl/names measured on a 1px canvas. Never reads before the sheet is in, so the grey default never flashes over the brand. - I18nProviders builds primary (and secondary) from it as a palette OPTION, so MUI derives the shades from the brand. The server's brand (when it can name the tab's org) is the first paint; otherwise globals.css's neutral default, never blue. - Text on brand fills: black or white by luminance (the same 0.179 line as ON_BRAND), AA for any brand. - Brand as text: darkPrimaryTextOverlay's dark lift kept; brandTextOverlay adds its light mirror (pale brands darkened as text) for primary and secondary; contained buttons keep the exact brand. - LightSurface keeps the org brand when it swaps a dark palette for light. - The per-screen scopes **************** stay: they paint from the variable with their own AA ink, so their look is unchanged.
· kamo-internal
The settings page kit (SIS2): hub grid, status cards, drill-in pages with rooms, save bar, unsaved-changes guard, first-time intro
HubGrid + HubCard (corner-ribbon state, plain-words chips, live summary), SubPage (breadcrumb, Back one level with push, hero, rooms with their own address), a sticky SaveBar that tells the unsaved-changes guard, the guard itself (kit navigation, in-app links, reload), SettingsIntro on the shared per-member feature-intro preference, side tips into the settings frame's help column, and one MotionConfig. SettingsView gains a controlled, path-routed tab mode so kit pages reuse the settings frame instead of copying it.
· kamo-internal
An example image on a requested document, and brand-coloured text buttons
The request card gains Add an Example Image, picked from the HR resource library (images only) and shown to the member beside the drop zone and in the live preview. Text buttons on the new surfaces take the org's brand colour instead of MUI's default blue.
· kamo-internal
Requested documents, HR review, the Review Studio and Quick Requests
Legal & Compliance packages can now ask members to upload documents and send what they finish to an HR reviewer, who approves it or returns it for corrections with notes and marks. - Review Studio **************** full-bleed, open to routed reviewers who hold no HR right — DocsService decides): item rail with round badges and corner ribbons per verdict; the document on the desk with PdfPages, zoom, drag-to-pan and page thumbnails; a markup bar (highlight, arrow, box, freehand, numbered pins, callouts, ink colour, undo/redo); per-item Accept / Needs Correction with comments and Quick Reasons; overall message, Include Comment With Approval, private note; Compare Rounds side by side or swipe; keyboard shortcuts (A, R, J/K, H, W, B, P, C, D, V, X, Cmd/Ctrl+Enter, ?) with a shortcut sheet; autosaved draft; a confirmation summary; Approve & Next / Return & Next through the queue; confetti on approval. SI suggestions render only when the workspace carries siPrecheck. - MarkupLayer: a store-agnostic marks-in/marks-out layer on annotationGeometry, used to draw in the Studio and read-only in the member's correction view. The esign designer is untouched. - Needs Review: a new ?sub=review tab (appended) shown to holders of REVIEW_LEGAL_SUBMISSIONS or anyone with a non-empty queue, a standalone queue page for routed reviewers, a needs_review bucket in the meter, a NavTop review badge, Review actions in the assignments grid, on the HR overview's late list and on a member's page. - Authoring: the package dialog is three steps — Details, Requested Documents (drag-to-reorder cards, Request Library, file types, counts, expiration, Use Package Setting / Review / No Review, live member preview) and Review (Requires Review, anyone with the right, specific people, their manager, business days to review). The request list is only sent once it has been read. - Quick Request: Request Documents on **************** (HR viewing someone else) sends one member a one-off request in a single call. - Member: an upload step per request (drop zone, camera on phones, per-file progress and thumbnails, example image, blurry/too-small photo warning, expiration date), correction mode for RETURNED (only flagged items; the previous upload with the reviewer's marks and numbered pins matched to notes; Upload Corrected Version), and a Submitted -> In Review -> Approved / Returned timeline with the reviewer, live, with confetti the first time an approval is seen. - Status mirrors: RETURNED is open (pending), AWAITING_REVIEW is its own in_review filter bucket, the registry gains needs_review, and every status label, ribbon and action knows both. - Settings: Quick Reasons and the Request Library under HRS > Legal & Compliance. - RoleRightType mirror: REVIEW_LEGAL_SUBMISSIONS (697, HRS, standalone root). - Help: three help-center articles, help links on every new surface, an HR tour step.
· DocsService
Requested documents, HR review, Quick Requests and the SI pre-check
Members can now be asked to UPLOAD documents in a Legal & Compliance package, and a package can require an HR review before it is executed. Authoring (/api/docs/legal/packages): reviewRequired, reviewerAnyRight, reviewerManager, reviewerMemberIds[], reviewDueBusinessDays and requests[] (full replace) on create/patch and GET. Publish freezes requests + the review switch into the version (fingerprint unchanged for packages that use neither, so no spurious Redeliver). A request-only package publishes and delivers. Member (/api/docs/legal/member): upload one file per call (ImageService content- addressed store; images -> PDF in-process, Office/HEIC via ConversionService; native PDFs serve the original), remove a draft file (soft, never deleted), set an expiration date, read own files, request sample image. Detail gains requests[], reviewRequired, reviewRound, latestReview, message; documents gain **************** Finish enforces required uploads, attests per round (supersedes link) and moves a reviewed package to AWAITING_REVIEW. Review (/api/docs/legal): reviews/queue + count, review-workspace, file and per-round document PDFs (one audit row per open), draft save, and the decision. Approve -> EXECUTED and files the merged PDF (signed docs + approved uploads + a Review Certificate page). Return -> RETURNED, flagged items reopen, returned signed documents get a fresh envelope (old one kept as history). Routing: REVIEW_LEGAL_SUBMISSIONS holders, named reviewers, or the member's manager by reporting line; never one's own assignment. Quick Requests: POST /quick-requests builds an ad-hoc package for one member, publishes and delivers it synchronously and answers the assignment. Notifications: hr.package_needs_review / returned / approved, reviewer SLA nudges in the daily sweep (business-day due dates); RETURNED is remindable. SI pre-check: OCR suggestions for reviewers, ONLY when the org has the SI app (ServiceType.AI_SUPPORT via FeatureService); otherwise siPrecheck is null and nothing runs. LIVE_STATES (open + in review) now drives delivery de-dup, void and redeliver; k8s: multipart limits (Spring's 1 MB default refused phone photos) and the optional OCR secret.
· EmailService
Preview samples for the legal review letters
hr.package_needs_review / hr.package_returned / hr.package_approved (seeded from kamo-shared-library's canonical templates) now preview with realistic whole sentences instead of the generic fallback. Rebuilding EmailService also brings the three new canonical templates onto its classpath so seedForOrg can create them.
· kamo-shared-library
Package description (Quick Request message) and one submission per round
- LegalPackage.description: HR's short note shown at the top of a package. - LegalPackageSubmission declares the unique (assignment_uid, version_request_uid, round) index already created in YugabyteDB.
· KlusterServices
Let DocsService reach ocrservice for the legal SI pre-check
Legal & Compliance reads uploaded documents with Kamo OCR to give reviewers suggestions (organizations with the SI app on only). Adds the kamowsdocs pod label to the ingress allow-list; applied to the cluster by hand.
· SecurityService
Seed REVIEW_LEGAL_SUBMISSIONS (697) from MANAGE_LEGAL_AND_COMPLIANCE
Whoever runs Legal & Compliance today reviews what members submit for it, so the new Needs Review queue is staffed on the boot that introduces the right. Seeded from the tab right only, never from the HR read set.
· kamo-shared-library
Requested documents, HR review and Quick Requests — entities, REVIEW_LEGAL_SUBMISSIONS (697)
Legal & Compliance packages can now ask members to UPLOAD documents and can route a finished assignment to an HR reviewer who approves it or returns items for correction. - New entities: LegalPackageRequest (template), LegalPackageVersionRequest (frozen at publish), LegalPackageReviewer (named reviewers), LegalPackageSubmission + LegalPackageSubmissionFile (per round, files never deleted), LegalPackageReview + LegalPackageReviewItem (DRAFT resumable, FINAL append-only), plus their enums. - LegalPackage: reviewRequired, reviewerAnyRight, reviewerManager, reviewDueBusinessDays, adhoc, adhocMemberId. Version freezes reviewRequired. Assignment: reviewRound, submittedAt, reviewDueAt. Document: round, priorEnvelopeUids. Attestation: round (unique per assignment+round). LegalSettings: returnReasons, requestLibrary (JSONB). - Assignment status += AWAITING_REVIEW (not open) and RETURNED (open); LIVE_STATES = OPEN_STATES + AWAITING_REVIEW for delivery/void/redeliver. Document status += SUBMITTED, RETURNED, ACCEPTED. - RoleRightType REVIEW_LEGAL_SUBMISSIONS (697, "Review Legal Submissions", HRS, standalone root). RoleRightHierarchyTest: values 442, standalone 102, roots 151. - Email templates hr.package_needs_review / hr.package_returned / hr.package_approved (org Team Member label, no tenant names). DDL already applied to YugabyteDB (idempotent, owner role).
· MCPGatewayService
After outside content, risky acts need a person's OK unless a supervisor ordered them (SIE3 follow-up)
Owner decision 2026-11-07 on SIE3's finding: once a run has read outside content (email, web page, document, text, call, meeting), a send to a new recipient, a delete, an external share, a settings change, money and shell commands wait for a person's approval for the rest of the run, whatever the charter makes autonomous. A reply to the person the run is conversing with (identity counterparty) or a plain reply to the email the run read stays automatic. An authenticated direct order of a supervisor in the SI's chain of command (SecurityService standing, or acting on their account) stands (No Insubordination); its scope and the never-grantable/human-only rules still apply. One rule in the policy decision point: OUTSIDE_CONTENT (ASK with the act as reason; LIFT SUPERVISOR_ORDER/ON_BEHALF; PASS **************** plain-language record explanation and approval card ("This task read an outside email; a person should OK sending to a new address."). Goldens: injection-gates.txt re-pinned (16 lines: EMAIL/DOCUMENT/CHAT/SMS sends and deletes now ask); SIE2 pipeline-scenarios.txt +180 appended tainted scenarios and tool-static-decisions.txt +88 appended per-tool act lines; every earlier SIE2 line unchanged.
· kamo-internal
SI Meeting Joins tab: let SIs join Zoom and Teams meetings as an app (SIE10)
Settings > Kamo Meets > SI Meeting Joins (MANAGE_MEET_SETTINGS; tab + menu entry + help article): one card per provider (Zoom, Microsoft Teams, Google Meet) with its state in plain words and a corner ribbon (Ready, Turned Off, Needs a Check, Not Set Up, Not Working, Coming Soon, Google Preview Only), how the last join went, the org's Join as an App switch (needs a passed check), and a setup drawer with the provider's own steps, write-only secret fields, Save and a live Check Connection. Brand colours from the theme, reduced motion honoured, phone bottom sheet. Goes through the existing /api/meet/provider BFF route to MediaService /si-join.
· kamo-internal
Quality — conversation reviews, customer satisfaction, KB gaps and guidelines learned from corrections (SIE9)
The Workforce hub's Quality view: each SI's sampled review score with its trend and its customers' satisfaction; every reviewed conversation's accuracy, tone, policy and outcome with a one-line note; satisfaction answers, their spread, the channels that are on and the latest comments; KB gaps (questions the knowledge base could not answer), each with a suggested article that goes to the Help Center review queue as a private draft. A workforce manager's settings: review share and daily cap, satisfaction channels (all off until turned on), wait and quiet period, the consent to learn from corrections, KB gaps. First-time help, Quick Tips and a Help Center article. A guideline learned from corrections shows in the SI's Tuning card and opens in the job description with the guideline added; saving records it as its own LEARNED version. The evaluation grid and the Command Center cards show quality and satisfaction. @kamo/kamoai-core 0.5.0. Fixes two hub tests left behind by the Red Team and Command Center tabs.
· kamo-internal
Languages And Accessibility tab with spoken line reviews (SIE8)
/settings/ai?tab=languages (tab + menu + landing card, gated like Call And Meeting Notices): the languages an organization's SIs may speak on calls and in meetings (language chips named in the reader's language; with any chosen, SIs follow the caller's language), clear speech on every call, relay-call support, a good-to-know panel, first-time help, and, for Kamo's own team (platform organization, MANAGE_AI_WORKFORCE), Spoken Line Reviews: every call and meeting line still in English in a language, a machine suggestion, words in braces checked, save and withdraw, Needs Review / Reviewed tabs with counts, English Changed when the English moved.
· MediaService
SI meeting-bot apps per org for Zoom, Teams and Google Meet (SIE10)
The org's apps for each provider's approved bot path, so its SIs can join outside meetings as an app instead of by phone: - Zoom: Meeting SDK join signature (HS256 JWT, signed here) + the On Behalf Of token of the member who asked (GET **************** minted with the org's Zoom account app or, when it has none, its Zoom meeting provider's Server-to-Server app (ZoomTokenService reused). - Teams: Azure Communication Services identity + VoIP token (HMAC-signed Identity REST API) for Teams interop as an external participant. - Google Meet: OAuth client kept and checked; joins stay by phone (Media API is a listen-only developer preview needing every participant enrolled). Secrets write-only, encrypted with the platform key. Platform switches meet.si-join.<p>.enabled (off by default) + the org's own switch, which needs a passed connection check. Session API /api/meet/provider/si-join (MANAGE_MEET_SETTINGS) and internal **************** (KAMOAI secret). DDL applied.
· kamo-shared-library
Meeting-bot apps per org and the external meeting's join path (SIE10)
OrgMeetingBotAppEntity **************** an organization's app for a provider's approved meeting-bot path (Zoom Meeting SDK, Teams via Azure Communication Services, Google Meet Media API), encrypted config, its own switch, status and last join. AiExternalMeeting gains JOIN_PATH (PHONE | APP) and NATIVE_REASON.
· kamo-shared-library
Reviewed translations of the SI's spoken lines (SIE8)
Declares ai_spoken_line_reviews (kamoai-service **************** applied) so KamoInitializer can recreate it.
· kamo-internal
Red Team tab — every surface Kamo attacks, the findings, the trend and a report (SIE3)
**************** a hero in the org's brand with the period (7/30/90 days), Refresh and Download Report (CSV in plain words); a first-time explanation (feature intro siRedTeam); four animated tiles (Protection Score ring, Needs Attention with Back Again, Fixed, Surfaces Covered); a card per surface (email, web page, document, team chat, website chat, task comment, phone call, video meeting, text message) with its verdict bar and corner ribbon when failing or on watch; the findings (scenario in plain words, the SI with the shared avatar and a link to its room, what went wrong, first and last seen, Failing / Failing Again / Watch / Fixed) filtered by Needs Attention / Fixed / All; Recent Checks as bars; and, for managers, CP15's Run a Check Now. SI Status's semantic colours for status, brand for chrome, reduced motion honoured. Help center article red-team-findings. Data: kamoai-service /api/kamoai/dashboards/redteam through the /api/kamoai BFF; @kamo/kamoai-core 0.4.0.
· SecurityService
A guideline learned from corrections is its own job description version (SIE9)
The member charter save may say it adds a guideline the SI learned from supervisors' corrections (source LEARNED, with a short note): the same validated write path, recorded as a LEARNED version (SIE6 history: diff, restore). Anything else stays the editor's own save.
· kamo-shared-library
Quality reviews, satisfaction checks and KB gap entities; learned guidelines in tuning (SIE9)
AiQualitySettings, AiQualityReview, AiCsatCheck, AiCsatOptOut and AiKbGap declare the tables of kamoai-service **************** (applied; kamoai-service reads and writes them over JDBC, no repository) so KamoInitializer can recreate them. AiTuningAxis.GUIDANCE and AiTuningKind.LEARNED (appended) carry a job-description guideline learned from supervisors' corrections in CP15's tuning suggestions.
· kamo-shared-library
AiRehearsalTrigger.SCHEDULED for the standing weekly red team (SIE3)
· kamo-shared-library
An org's SI call languages, clear speech and relay support on its voice notices row (SIE8)
Declares the columns **************** (kamoai-service) added, so KamoInitializer can recreate them.
· kamo-internal
Customer Handoffs — the customers an SI handed to a person, with everything they already said (SIE7)
Waiting / Mine / Taken / Done with counts; each handoff shows what the customer needs, what the SI did, the next step, the best time, how to reach them (PhoneNumber / EmailAddress) and, opened, their whole thread across phone, email, text, chat and meetings. I'll Take It (first come, first served), Put Back, Mark Done with a note. Org brand colours, corner ribbons, shared avatars, animated with reduced motion honoured; live on handoff cards and every 20 s. Under the SI menu for people who see or supervise SIs; the alert's link opens any one. Help topic + help center article.
· MCPGatewayService
Handoff_to_person — an SI hands the conversation to a person (SIE7)
A call back (also 'as soon as someone is free') or a place in line for the next free person, on any channel, so the customer never repeats themselves. kamoai-service keeps it (who the customer is comes from the run and its CP07 audience; the people are the colleague asked for or the SI's own). SEND_INTERNAL_MESSAGE, so open on unproven channels; CP07 plans it as a disclosure to the organization. New prefix handoff_; guards, phrases, ArgRefs and the golden files carry the one tool.
· kamo-internal
Websites and social profiles on a lead
The Contact card and the New Lead form take any number of websites (a + adds another) and a field each for LinkedIn, Facebook, Instagram, X, TikTok, YouTube, WhatsApp, Messenger and Telegram. A handle, a number or a pasted link all work; the lead view shows each as a link that opens in a new tab. Hidden from viewers who only see masked contact info, and a masked save never clears them.
· kamo-shared-library
Websites and social profiles on a lead
Two text columns on leads (WEBSITES one per line, SOCIAL_PROFILES JSON) exposed as a list and a map on LeadDTO, CreateLeadRequest and UpdateLeadRequest; null leaves them alone, empty clears. LeadWebPresence trims, de-duplicates and bounds them and keeps only the known networks. Masked with the other contact info; recorded in lead history. DDL (additive) already applied by hand.
· kamo-internal
Configurable tracking links, member links and a tracking script for other sites
- Marketing → Tracking Codes → Link settings (new page, MANAGE_REFERRAL_CODES): switch standard pages off, add the org's own links, and name the marketing site every link points at (so an org whose public site is not www.<console apex>, such as Kamo Universe, copies the right links). The tracking parameter is never typed anywhere; it is appended when a link is copied or previewed. - The Get links picker merges standard + org + the member's own links, and members can add or remove their own (a pasted URL on the site is stored as its path). - The same page generates a copy-paste script for sites Kamo does not host: same cookies, same self-exclusion, same payload, sent to the public beacon with the org's key. Tested by running it against a fake browser. - The catch-all marketing-tracking proxy now relays PUT (it only knew GET/POST/PATCH/DELETE). - API keys can be given the Marketing Tracking scope in Settings → Security. - The code strip, drawer and preview link honour the org's named site. Needs MediaService da07f59 (links endpoints; table already created) and the dictionary strings (12346cb5), both on origin.
Your universe is waiting.
Start free in minutes. Add products whenever you are ready — no migration, no new logins.
Free forever — no credit card required