Changelog
What's new.
Every improvement to the platform, as it ships.
· AIService
The web chat addendum for a configured SI — the chat length line and the visitor adaptation after the unchanged addendum (WEB_CHAT_ADDENDUM_V2), V1 byte-identical for every unconfigured member and every stored fallback brief, the persona path untouched, and the version on the resolution (KamoCollab CP06 Task 11)
· SecurityService
Every job template starts with a personality — one PERSONALITY ARCHETYPE item each (receptionist and support agent CONCIERGE, SDR and recruiting coordinator DIPLOMAT, scheduler and loan processing assistant OPERATOR, bookkeeper ANALYST), D24 (KamoCollab CP03 T19)
· kamo-internal
The rule editor speaks channels — channel chips with the SI-only caption, an 'Only when starting contact' switch, who approves for SI members (a specific person picked among APPROVE_AI_ACTIONS holders; people ask their manager), team, role and SI-or-people selectors, the six new qualifiers, and a REQUIRES_APPROVAL rule saved with its defaults (KamoCollab CP04 T25)
· SecurityService
The member card reads the communication policy on every channel that binds the viewer — CHAT for a person, CHAT, calls, mail and meetings for an SI, grant-aware, with approvalRequired (KamoCollab CP04 Task 18)
ChatPolicyBeanConfig builds the loader with each rule's channels and the three-argument, grant-aware ChatPolicyService (cached graph for approvers), as MediaService does. MemberInteractionPolicy: Viewer.ai, Interactions replaces Chat, Action.approvalRequired; a person's chat that needs an approval is CONTACT_APPROVAL_REQUIRED, an SI's call/email/meeting DENY is INTERACTION_POLICY and its REQUIRES_APPROVAL is allowed with approvalRequired. The roster stays CHAT-only. toJson writes approvalRequired only when true.
· kamo-internal
The communication policy's library — channels, team, role and SI selectors, six qualifiers, starting-only rules and approvers in the sentence; teams and roles in the tab's vocabulary; the contact-request notification kinds on ACCESS_CHAT; SEND_INTERNAL_MESSAGE in the charter editor; a Communication policy chip on SI approvals (KamoCollab CP04 T24)
· SecurityService
The disclosure ledger export — a CSV recorded as EXPORT before it is built (KamoCollab CP08 T8)
GET **************** takes the list's filters and answers the newest 10,000 events as disclosure-ledger.csv (every field quoted, UTC instants, recipients and sources joined by '; '), with X-Kamo-Export-Truncated. It needs EXPORT_ACCESS_LOGS (or an open god window); a refusal is recorded as a refused read of the ledger and is 403. Before the file is built, **************** writes one EXPORT row for REPORT/disclosure-ledger plus one per distinct source in the file, typed by spec section 5.4.6's table (any other kind is REPORT with the whole SourceRef). EXPORT fails closed: when the trail cannot take it the answer is 503 and no file. DisclosureLedgerExport holds the two pure halves (subjects, csv); the list and the export share one filter parser.
· SecurityService
I2 resolves a draft of one of a member's layers, the ledger's daily counts per SI, and the disclosure settings hook to kamoai-service (KamoCollab CP15 T4)
- I2 draftLayer {level, id}: only with an existing MEMBER subject and draftItems; the draft is validated for the layer's level (department ancestors for DEPARTMENT) and replaces that layer's own items (JOB_TITLE, DEPARTMENT and TEAM keep the description's PURPOSE); a layer the member does not hold is 400 DRAFT_LAYER_NOT_HELD. A body without draftLayer answers byte-for-byte as before (goldens). - GET **************** counts per decision and escalations for one SI and UTC day, one grouped statement on ix_ode_org_actor; KamoAI secret. - EvaluationNotifier: after a disclosure settings save commits with a changed posture, enforcement mode or leak check, POST kamoai-service **************** on a virtual thread (2 s / 3 s); a failure is one WARN and never affects the save.
· KBService
The blocked clock — a task entering BLOCKED stamps checklist_items.blocked_at and leaving clears it, in all three status writers (TaskService.setStatus, ChecklistService.tick and reopen), and a BLOCKED task's view carries blockedAt (its updated_at when blocked before the stamp) (KamoCollab CP13 Task 6)
· MediaService
Forward messages into a conversation or to people — POST /api/media/messages/forward checks the source (one readable CHAT, existence-safe 404), the target (seated, or the exact roster found or opened), the seat and chat policy, then a person's forward through the human share gate (event recorded first; ENFORCE 409/403); the writer adds the comment and each line as the forwarder's MEMBER line with its files linked again and a media_obj_forwards row; history rows and live frames carry forwardedFro...
· AIService
The configure endpoints — start, answer, show and discard a session with the SI configure assistant, streamed (KamoCollab CP10 Task 13)
· kamo-shared-library
The report metrics — ReportMeasures (paid revenue and orders, new customers, leads, issued quotes, quote decisions; one JPQL aggregate each, shared with the Business Overview), ReportMetric beans **************** for the seven business metrics, ReportMetricIndex checked at startup against the metric and report registries, ReportQuerySupport.scopeOnly, ReportResult.scopeLevel and withScopeLevel, and the (org_id, date_created) indexes on orders, quotes and ac...
· SecurityService
The disclosure ledger read API — list, stats, source and member endpoints, with the supervisor path (KamoCollab CP08 T7)
DisclosureLedgerController at /api/security/disclosures: GET (list), /stats (event counts per decision plus reads.WOULD_WITHHOLD, R1-19), /source/{kind}/{id} (canonicalized path) and /member/{memberId}. The session comes from OTKPreAuthFilter; no session is 401, the org comes only from the session, and every request records a REPORT/SEARCH row with resource id disclosure-ledger, allowed or refused. Filters answer 400 BAD_FILTER naming the field, BAD_SOURCE or WINDOW_TOO_LARGE. DisclosureLedgerAccess (pure) decides AUDITOR (VIEW_ACCESS_LOGS or an open god window), SUPERVISOR (a person supervising the SI, with SUPERVISE_AI_MEMBERS) or NONE; /member resolves the target in the caller's org first (404 MEMBER_NOT_FOUND) and redacts source refs on the supervisor path. PhiAuditController's boundary parsing moves, unchanged, to audit/AuditTimeBoundaries, which both controllers use.
· EmailService
The mail-forward check — a person's forward in both send paths goes through the HumanShareGate after prepare and before the dry run and the send (EMAIL/FORWARD; the thread label of the loaded original with the holders of its mailbox; To, Cc and Bcc as members by mailbox, alias, login address or shared-mailbox readers, the rest EMAIL:), 409/403/503 in ENFORCE, recorded first, a dry run records nothing and answers disclosure; PreparedSend.forwarded; forwardOf.sharedMailboxId reads the original fro...
· AIService
The configure assistant — an SI member, job title, team, department or the org described in words, drafted through the config pack as the creator (KamoCollab CP10 Task 12)
ConfigureAssistant (start, answer, view, discard) and ConfigureTurn run spec §5.8.3: the pre-flight config_current as the creator, the route with the config_* tools plus configure_ask_creator (at most two questions), up to twelve streamed rounds, every Tool Plane call with the creator's *** and a **************** key, a call naming another subject answered locally, the draft always the last config_propose's draftId, every round metered CONFIGURE. ConfigurePrompt (CONFIGURE_PROMPT_V1, SYSTEM_V1 verbatim), ConfigureRegistryGuide (one line per section, trait key, Docstion kind and archetype), ConfigureSessionStore (ai:configure:* keys, 1 MB cap), ConfigureEvent, ConfigureAskTool, ConfigureAccess. MemberChatRouter.Refusal now carries the router's exclusion reason, so PHI_BOUNDARY and POLICY map to PHI_NO_LOCAL_MODEL and POLICY without parsing text. Tests replay recorded models and a recorded Tool Plane (no live model).
· DocsService
The document share goes through the human share gate — the document's own label, its member, department or job title's holders as recipients, the event recorded before the save; ENFORCE answers 409 DISCLOSURE_WARNING until acknowledged, 503 when the ledger or the check cannot be read; AUDIT always saves; SI sessions are left to the Tool Plane (KamoCollab CP05 Task 32)
· kamo-shared-library
GOAL and WATCH read the metric registry, and a watch gets a direction — CharterItems validates metricKey by MetricRegistry and takes WATCH traitChoice WORSE|BETTER|EITHER (EITHER stored NULL); WatchRule.direction (7-arg constructor = EITHER); the resolver, profile view and stamp carry it (W| line gains |<direction> only when not EITHER); WatchKeys keys by it (KamoCollab CP14 Task 5)
· KBService
The hand-off endpoint — POST **************** {toMemberId, packet{summary, done, next, openQuestions, refs[]}, aiTurnLimit}: an SI's own session only (403 AI_ONLY), its manager or assignee, the new assignee held to VIEW_NOTES; one transaction reassigns as TaskService does (an Inbox task moving to the new assignee's Inbox) and writes a HANDOFF comment rendering the packet in fixed labels, the task-thread turn guard first (429, nothing written); TASK_ASSIGNED (handed over) an...
· MediaService
The communication policy's admin API speaks channels — rules carry channels (stored only when not just CHAT), initiator-only and an approver checked on save and preview (400 {error, ruleIndex, field}); the simulator takes channel and reply and names the approver; telemetry per channel; SI impact off CHAT; teams and roles are known references (KamoCollab CP04 T17)
· kamo-shared-library
The metric vocabulary, report sources and their labels — MetricRegistry (19 metrics), MetricWindows, MetricChange, WatchKeys, MetricCacheKeys, SignalReasons; **************** RecordLinkKind.REPORT served by LabelOwner.SECURITY; AiRunTrigger.SIGNAL; CharterMetric deprecated (KamoCollab CP14 Task 4)
· AIService
Config tools only when configuring an SI, and metering by usage kind (KamoCollab CP10 Task 10)
Member chat (CopilotMode.CHAT) no longer offers the Tool Plane's config_* pack; **************** lists only those for the configure assistant (CONFIGURE_AI), none without a session. MemberChatRouter.meter gains an overload naming the usage kind; the old signature meters CHAT.
· kamo-shared-library
The SI evaluation vocabulary, the graded rehearsal and tuning columns, and the rehearsal block of the run context — AiRehearsalSuite gains PERSONALITY_CONFORMANCE, DISCLOSURE_REDTEAM, COLLAB_ETIQUETTE; AiRehearsalVerdict/Result (of, **************** AiFeedbackReaction (negative, excludes per D22), AiTuningStatus/Kind/Axis; AiRehearsal's eight and AiRehearsalItem's seven CP15 columns with the nine-argument createSuite; **************** Rehea...
· KBService
The disagreement protocol on task threads — when two SI members' POSITION comments alternate in opposition up to the threshold (the SI's DISAGREEMENT bound, else 3), KBService hands the decision to a person: the task's creator, else the two SIs' lowest common manager, else the poster's supervisor (NO_DECISION_OWNER when none is an active person); a HIGH task in their Inbox created and assigned by the posting SI and linked to the disputed task, carrying both latest positions only when DisclosureP...
· SecurityService
The DDL file for the metric indexes, with its contract test (KamoCollab CP14 T2)
Three per-organization date indexes for the SI business metrics (spec §5.1, D20): commerce_orders, commerce_quotes and accounts on (org_id, date_created). Hand-applied by CP14 Task 3; re-runnable, non-unique, nothing on leads.
· AIService
The voices an SI not hired yet may speak with, for the hire wizard and the draft check (KamoCollab CP10 Task 4)
V1 GET /api/ai/voices/options (a person holding MANAGE_MEMBERS, MANAGE_MEMBER_SECURITY or MANAGE_AI_WORKFORCE, god counting; never an SI's own session) and its internal twin V2 GET **************** the router's TTS candidates for an SI actor without a member, in walk order, every voice with its gender and whether the chosen sex allows it, compatible first in the resolver's tiers.
· SecurityService
The disclosure ledger query service — keyset pages on one index per filter, the member union, labels and counts (KamoCollab CP08 T6)
DisclosureLedgerQueryService reads org_disclosure_events and its two child tables over NamedParameterJdbcTemplate. Each entry point builds one driving statement on one index (source > recipient > run > actor > decision > org time), with the org as the first predicate of every statement, ORDER BY occurred_at DESC, id DESC LIMIT size + 1, and the remaining filters as predicates. /member is the actor branch UNION the recipient branch, each bounded by its own limit. The page's recipients and sources are read by event_id IN (:ids), team and department titles in one batched read each. countsByDecision runs one range count per decision on ix_ode_org_decision; countReadOutcome counts the org's Tool Plane rows for one policy_decision on **************** (R1-19). DisclosureLedgercoder is base64url of <epoch micros>.<uuid>; DisclosureEventView is spec 5.4.4's item shape.
· kamo-shared-library
Who drafted a charter item — CharterItem.itemOrigin (item_origin), kept by apply while the item's fingerprint is unchanged; CharterItemFingerprint, CharterItems.identityKey and normalizedText; ConfigureSubjectKind; **************** (KamoCollab CP10 Task 3)
validate never reads an incoming origin; toData/toDto and the charter view carry it. validate's uniqueness now goes through identityKey, so the configure assistant's identity-replace and the validator never disagree. The stamp is unchanged (pinned by a golden value). Armed: push only after CP10 Task 2 applied the item_origin DDL.
· kamo-shared-library
Rehearsal suites in the vocabulary and the entity (KamoCollab CP09 Task 3)
AiRehearsalSuite { PERSONALITY_BASIC } persisted as STRING in ai_rehearsals.suite (NULL = the inbox replay), AiRehearsal.createSuite(...) with days 0 and windowStart = windowEnd = now, and AiRehearsalItemKind.SCENARIO appended after the four existing kinds.
· SecurityService
Declare the disclosure ledger recorder, with its repository scan (KamoCollab CP08 T5)
DisclosureLedgerConfig declares the shared DisclosureRecorder as bean disclosureLedgerRecorder: the name disclosureRecorder is the EHR's §164.528 @Component, and a second definition under it refuses to start the context (ruling CP08-T5-1). **************** joins @EnableJpaRepositories in the same commit.
· AIService
The approved prose — PUT /api/ai/personality/prose with the preview's rights and a draft, the subject's stored stamp checked, the prose validated, stored for the subject (PREVIEWED when it is the model's kept prose, else EDITED), passed to every MODEL and OUTLINE row of the stamp, and the briefs that use it compiled again (KamoCollab CP06 Task 10)
· SecurityService
Who a layer save reaches — CharterLayerLoader.layerRefs and GET **************** (KamoCollab CP09 Task 5)
The non-retired SI team members of the caller's org whose charters are built from the layer (ORG, ROLE, DEPARTMENT, JOB_TITLE, TEAM or MEMBER), ordered by display name then id; bounded by the org's SI seats, and no charter item is read.
Your universe is waiting.
Start free in minutes. Add products whenever you are ready — no migration, no new logins.
Free forever — no credit card required