Changelog

What's new.

Every improvement to the platform, as it ships.

October 11, 2026 · kamo-shared-library
CallRecordingAccess and LeadCommsReadRule — decision 4's one rule for every recording door (god, participant, VIEW_CALL_LOGS, VIEW_VOICEMAIL for a voicemail, the management chain under decision 3a, the lead Communications gate), its facts loader, and the lead read rule moved to shared-lib (KamoCollab CP05 Task 12)
October 11, 2026 · MediaService
Supervised conversations — a SUPERVISED rule records its subject's overseer, who may read the conversation (and its files) read-only while the reporting line holds, sees it listed at GET /api/media/chat/supervised, and policy-state says supervised (KamoCollab CP04 T15)
October 11, 2026 · KBService
The org graph in KBService and every note read through the one widened predicate — shared notes reach their audience read-only; create and update refuse a shared scope (USE_RELEASE) and the reserved categories (RESERVED_CATEGORY) (KamoCollab CP05 Task 15)
- orggraph/OrgGraphBeanConfig + OrgGraphEventListener: the loader, the 60 s cache, and a core subscription to security.orggraph.changed.* that evicts the org (svc_kb's permission is CP02 Task 6A's). - **************** team member and active, team ids, department path, levels up to the effective level; no node = own notes and the org master only. - NotesService: getNote, getAllNotes, searchNotes, getAllCategories, getVersionHistory, restoreVersion and getLinkedNotes read through the NoteRepository visible finders with the resolver's audience; restore and update stay owner-only (or the org master with its right); supervisee reads are the supervisee's own notes (findByMemberId / findByIdAndMemberId). NoteDTO carries knowledgeScope, scopeRef, sensitivity, confidential, confidentialSetByMemberId, owner, and audienceMemberIds for the owner of a NAMED note; editable = own note, or the org master with the right. - NoteVisibleQueryTest: the repository builds on this service's Hibernate and VISIBLE runs as one keyed UNION (ruling CP05-T15-1).
October 11, 2026 · kamo-shared-library
SourceClearance and ReleaseAuthority — the structural bases (self or participant, existing access, the management chain with decision 3a's setter) and release authority (participation, the Confidential setter, the releaser's span), with their records (KamoCollab CP05 Task 11)
October 11, 2026 · SecurityService
Reference checks for the ORG layer, org archetypes and escalation conditions, and org archetypes at resolution — every lower layer may hide an unlocked ORG item (a role only those), an org: archetype must be the org's own (archetypeRef), an ESCALATION_CONDITION target follows the escalation rules (escalateToRef), and CharterService resolves with OrgArchetypeLookup (KamoCollab CP03 T15)
October 11, 2026 · SecurityService
Work links for leads and accounts — POST **************** answers which members are assigned which leads and primary on which accounts (KamoCollab CP04 Task 10)
October 11, 2026 · KBService
Work links for tasks — POST **************** answers who has an open task on which records (KamoCollab CP04 Task 9)
TaskWorkLinkService implements WorkLinkResolver: an open task (not DONE, on a live checklist, in the org) links its assignee and creator to the task itself (TASK:<id>, by item id) and to every record it links to (checklist_item_links, matched by kind and ref). Behind KamoaiInternalAuthFilter; WorkLinkWire's strict request, 400 reason INVALID, the bare map with string ids.
October 11, 2026 · kamo-shared-library
One widened note predicate — NoteAudience, NoteRepository.VISIBLE and its eight visible finders; the seven old finders deprecated for removal (KamoCollab CP05 Task 10)
October 11, 2026 · EmailService
Confidential thread markers and EMAIL_THREAD labels — PUT …/thread-confidential on member and shared mailboxes, one audited writer, threadKey and threadConfidential on both message GETs, POST **************** the org graph (KamoCollab CP05 Task 20)
EmailThreadKeys is the one thread-naming rule **************** now calls it): root Message-ID, UUIDv5 thread id, and the EMAIL_THREAD key without angle brackets. email_thread_labels is JDBC-only (EmailThreadLabelStore): a set is a conditional upsert, a clear a conditional delete, keyed by (org_id, thread_key); a lost race is 409 MARKER_CHANGED. ThreadMarkerWriter writes the marker and its system_access_logs row in one @Transactional @RetryOnDbConflict transaction. ThreadMarkers decides with ConfidentialMarkerRule on the session org's graph: holders of the mailbox read from (own, assignees, shared-mailbox accessors) or members the From/To/Cc reach are participants; an all-mailboxes reader is not. EmailThreadLabelResolver labels a thread from the index (holders in the org, search-index addresses, company addresses excluded from externals, leads by root and thread id, the marker) and forMessage labels a loaded original for the mail-forward check. OrgGraphBeanConfig and OrgGraphEventListener follow CP02.
October 11, 2026 · kamo-shared-library
The team items repository counts the items selecting an org archetype, by its partial archetype_ref index — the sixth in-use count (KamoCollab CP03 T15)
October 11, 2026 · MCPGatewayService
DisclosureLedgerStep writes each disclosing call's ledger event at the gate, before or after the send, and DisclosingTools lists the disclosing tools (KamoCollab CP08 Task 10)
October 11, 2026 · MediaService
A person asks their manager to open a chat the communication policy holds for approval, and an approval opens a 30-day contact grant (KamoCollab CP04 T14)
Session endpoints POST|GET **************** GET …/{id}, POST …/{id}/decision; the administrator's GET **************** (MANAGE_CHAT_SETTINGS). CONTACT_REQUESTED and CONTACT_DECIDED after the commit; a ten-minute leader-only expiry sweep.
October 11, 2026 · SecurityService
Org disclosure settings, GET and PUT **************** (KamoCollab CP05 Task 13)
Spec §5.5, D6: reads by CONFIGURE_SYSTEM, MANAGE_ACCESS_RULES, VIEW_ACCESS_LOGS or MANAGE_AI_WORKFORCE (or an open god window); edits by CONFIGURE_SYSTEM or a god window. The defaults answer with stored:false until the first PUT inserts the row. Each sent field is validated (400 {field, reason:INVALID}); the upsert is its own @Transactional @RetryOnDbConflict bean; after it commits, DISCLOSURE_SETTINGS_CHANGED goes to the access log, HIGH on an enforcement-mode change, otherwise MEDIUM, listing only the changed fields. updatedByName follows the charter's display-name rule (CharterService.displayName, now public). OrgDisclosureSettingsReader is a bean here.
October 11, 2026 · kamo-shared-library
Validation accepts PERSONALITY and DocsTION — the trait rules per key type, ordered groups, linked tendencies that cannot be locked, archetype references in one spelling, the linted note, the seven Docstion kinds with their fields, ranges and per-layer uniqueness, org archetype items, and ROLE hide markers (KamoCollab CP03 T12)
October 11, 2026 · kamo-shared-library
RELEASE_TO_ORGANIZATION (333) under VIEW_NOTES, never grantable to an SI (KamoCollab CP05 Task 9)
Releasing a note or decision to the whole organization is an act on a note the releaser can read, so it hangs off VIEW_NOTES in the Notes app (spec D21). It is in AiRightsFloor.NEVER_GRANTABLE (master R1-32): an SI drafts a release through RELEASE_INFORMATION, and only a person releases, so no SI's applied rights change.
October 11, 2026 · MediaService
Confidential markers on chats and meetings, and their labels — GET|PUT **************** and **************** one audited writer, the CHAT_SESSION and MEETING label endpoint (KamoCollab CP05 Task 19)
October 11, 2026 · EmailService
Declare the disclosure ledger recorder, paired with its repository scan (KamoCollab CP08 Task 12)
DisclosureLedgerConfig declares DisclosureRecorder; EmailServiceApplication's @EnableJpaRepositories gains **************** in the same commit. DisclosureLedgerWiringTest drives Spring Data's registrar over the application's own annotation and fails when the scan entry is missing.
October 11, 2026 · MediaService
Declare the disclosure ledger recorder, paired with its repository scan (KamoCollab CP08 Task 12)
DisclosureLedgerConfig declares DisclosureRecorder; MediaServiceApplication's @EnableJpaRepositories gains **************** in the same commit. DisclosureLedgerWiringTest drives Spring Data's registrar over the application's own annotation and fails when the scan entry is missing.
October 11, 2026 · KBService
Declare the disclosure ledger recorder, paired with its repository scan (KamoCollab CP08 Task 12)
DisclosureLedgerConfig declares DisclosureRecorder; KBServiceApplication's @EnableJpaRepositories gains **************** in the same commit. DisclosureLedgerWiringTest drives Spring Data's registrar over the application's own annotation and fails when the scan entry is missing.
October 11, 2026 · MCPGatewayService
Declare the disclosure recorder, carry the policy columns, and pre-mint the audit id in a CallLedger (KamoCollab CP08 Task 9)
DisclosureLedgerConfig declares DisclosureRecorder, with **************** joining @EnableJpaRepositories in the same commit. mcp_tool_call_audit gains policy_decision, policy_rule and disclosure_event_id; the I2 read returns them. Each call's Run holds a CallLedger whose auditId is the audit row's id, and whose stamp (R1-17: only written, failed, DocstionOutcome or readOutcome, never a held release) fills the three columns.
October 11, 2026 · SecurityService
The ORG layer first for every charter subject, at rank -1 and only when the org has ORG items; ORG subjects on S3 and I2, the caller's org only (KamoCollab CP03 T14)
October 11, 2026 · MediaService
REQUIRES_APPROVAL needs a CONTACT grant, an SI may answer the person who wrote first, overrides are recorded only when they lift a refusal, and AUDIT no longer blocks attachments (KamoCollab CP04 T13)
The chat chokepoints now ask the grant-aware communication policy. A REQUIRES_APPROVAL rule refuses find-or-create and send until a live CONTACT grant links the pair on CHAT, and the 403 says CONTACT_APPROVAL_REQUIRED with the target member id; policy-state reports approvalRequired. An initiator-only rule no longer stops an SI answering a person who wrote to it first (ChatReplyDetector, asked only when the ruleset has such a rule). The OVERRIDE_CHAT_POLICY right is asked only after a refusal, and only a lifted refusal is recorded. An AUDIT rule with attachments off now records the attachment instead of refusing it (the defect CP02 Task 6 parked).
October 11, 2026 · AIService
The brief names team chat and releases only once a charter does (KamoCollab CP05 Task 8, R1-3)
CharterSnapshot.Approval reads the resolved approval's source level (absent reads DEFAULT). CharterCompiler renders no "What needs approval" line for SEND_INTERNAL_MESSAGE or RELEASE_INFORMATION while SecurityService resolves the class at its catalogue default; a charter item that names either renders it as any class. Matched by name, so this builds before shared-lib has RELEASE_INFORMATION. VERSION is unchanged: no existing brief's text changes, and the shared-lib push that adds RELEASE_INFORMATION (APPROVE_BEFORE) adds no line to any SI's brief.
October 11, 2026 · kamo-shared-library
Knowledge scopes, provenance, decisions, org settings and Confidential markers on the entities (KamoCollab CP05 Task 8)
Shared-lib model for CP05 (spec §5.1-§5.2, §5.15): - disclosure enums KnowledgeScope, LinkRelation, DerivedRecordKind, DecisionStatus, DisclosurePosture, DisclosureEnforcementMode; OrgDisclosureSettings (entity), its view with the defaults, and its reader; - ConfidentialMarkerRule (set, raise, clear by rank) and MarkerAuditRows (the system_access_logs row); - Note gains knowledge scope, scope ref, sensitivity and the carried marker; NoteAudienceMember and NoteDecision; NoteLink and ChecklistItemLink gain relation and created_by_run_id, with ABOUT-only deletes; - Recording and PhoneCallLog carry the call's marker; LeadCommunicationRepository gains the two label reads; - NoteDTO, the note requests and the link DTOs gain the label, owner and derived-record fields; ChatMessageDto gains forwardedFrom (absent when null); - AccessLogEventType appends CONFIDENTIAL_MARKER_SET, CONFIDENTIAL_MARKER_CLEARED, DISCLOSURE_SETTINGS_CHANGED; AiActionClass appends RELEASE_INFORMATION (APPROVE_BEFORE) after SEND_INTERNAL_MESSAGE; APPROVAL maxItems 21. Additive only. AIService's brief change (R1-3) deploys first, so no SI's brief text changes.
October 11, 2026 · kamo-shared-library
The disclosure ledger types, entities and DisclosureRecorder (KamoCollab CP08 Task 4)
Append-only org_disclosure_events and its recipient and source rows (String columns, no @Enumerated, @PreUpdate/@PreRemove refuse), the five ledger vocabularies, DisclosureLedgerValues' canonical forms, DisclosureEventDraft with its fail mode, and DisclosureRecorder: one REQUIRES_NEW transaction per call, retried outside it, fail-closed exactly for ENFORCE releases. No stereotype: each recording service declares the bean with its repository scan. PhoneCallLogRepository gains the bulk (instance, providerExternalId) lookup.
October 11, 2026 · kamo-shared-library
Wire the personality and Docstion resolvers into CharterResolver, the stamp and the view — the archetype-lookup overload, item marks, Resolved.personality/Docstion, the twelve fields and R| lines in the stamp with legacy lines unchanged, peer layers in a fixed stamp order (KamoCollab CP03 T11)
October 11, 2026 · MCPGatewayService
The link reference text names the six kinds CP05 appends (KamoCollab CP05 Task 7)
October 11, 2026 · kamo-shared-library
The disclosure label contract — SourceRef, DisclosureLabel, LabelOwner, the wire codec and the label client; six RecordLinkKind appends (KamoCollab CP05 Task 7)
October 11, 2026 · APIService
Carve out /api/docs/internal/** for the disclosure label endpoint
KamoCollab CP05 Task 23. DocsService gains POST **************** guarded only by the KamoAI internal secret and called in-cluster, so the public gateway ends the whole subtree with a 404 instead of forwarding it.
October 11, 2026 · kamo-shared-library
WorkLinkResolver and its wire, with SourceRef and RecordLinkKind.TASK (KamoCollab CP04 Task 8)

Your universe is waiting.

Start free in minutes. Add products whenever you are ready — no migration, no new logins.

Start free Build your universe

Free forever — no credit card required

What's new.

Supervised conversations — a SUPERVISED rule records its subject's overseer, who may read the conversation (and its files) read-only while the reporting line holds, sees it listed at GET /api/media/chat/supervised, and policy-state says supervised (KamoCollab CP04 T15)

The org graph in KBService and every note read through the one widened predicate — shared notes reach their audience read-only; create and update refuse a shared scope (USE_RELEASE) and the reserved categories (RESERVED_CATEGORY) (KamoCollab CP05 Task 15)

SourceClearance and ReleaseAuthority — the structural bases (self or participant, existing access, the management chain with decision 3a's setter) and release authority (participation, the Confidential setter, the releaser's span), with their records (KamoCollab CP05 Task 11)

Work links for leads and accounts — POST **************** answers which members are assigned which leads and primary on which accounts (KamoCollab CP04 Task 10)

Work links for tasks — POST **************** answers who has an open task on which records (KamoCollab CP04 Task 9)

One widened note predicate — NoteAudience, NoteRepository.VISIBLE and its eight visible finders; the seven old finders deprecated for removal (KamoCollab CP05 Task 10)

Confidential thread markers and EMAIL_THREAD labels — PUT …/thread-confidential on member and shared mailboxes, one audited writer, threadKey and threadConfidential on both message GETs, POST **************** the org graph (KamoCollab CP05 Task 20)

The team items repository counts the items selecting an org archetype, by its partial archetype_ref index — the sixth in-use count (KamoCollab CP03 T15)

DisclosureLedgerStep writes each disclosing call's ledger event at the gate, before or after the send, and DisclosingTools lists the disclosing tools (KamoCollab CP08 Task 10)

A person asks their manager to open a chat the communication policy holds for approval, and an approval opens a 30-day contact grant (KamoCollab CP04 T14)

Org disclosure settings, GET and PUT **************** (KamoCollab CP05 Task 13)

RELEASE_TO_ORGANIZATION (333) under VIEW_NOTES, never grantable to an SI (KamoCollab CP05 Task 9)

Confidential markers on chats and meetings, and their labels — GET|PUT **************** and **************** one audited writer, the CHAT_SESSION and MEETING label endpoint (KamoCollab CP05 Task 19)

Declare the disclosure ledger recorder, paired with its repository scan (KamoCollab CP08 Task 12)

Declare the disclosure ledger recorder, paired with its repository scan (KamoCollab CP08 Task 12)

Declare the disclosure ledger recorder, paired with its repository scan (KamoCollab CP08 Task 12)

Declare the disclosure recorder, carry the policy columns, and pre-mint the audit id in a CallLedger (KamoCollab CP08 Task 9)

The ORG layer first for every charter subject, at rank -1 and only when the org has ORG items; ORG subjects on S3 and I2, the caller's org only (KamoCollab CP03 T14)

REQUIRES_APPROVAL needs a CONTACT grant, an SI may answer the person who wrote first, overrides are recorded only when they lift a refusal, and AUDIT no longer blocks attachments (KamoCollab CP04 T13)

The brief names team chat and releases only once a charter does (KamoCollab CP05 Task 8, R1-3)

Knowledge scopes, provenance, decisions, org settings and Confidential markers on the entities (KamoCollab CP05 Task 8)

The disclosure ledger types, entities and DisclosureRecorder (KamoCollab CP08 Task 4)

Wire the personality and Docstion resolvers into CharterResolver, the stamp and the view — the archetype-lookup overload, item marks, Resolved.personality/Docstion, the twelve fields and R| lines in the stamp with legacy lines unchanged, peer layers in a fixed stamp order (KamoCollab CP03 T11)

The link reference text names the six kinds CP05 appends (KamoCollab CP05 Task 7)

The disclosure label contract — SourceRef, DisclosureLabel, LabelOwner, the wire codec and the label client; six RecordLinkKind appends (KamoCollab CP05 Task 7)

Carve out /api/docs/internal/** for the disclosure label endpoint

WorkLinkResolver and its wire, with SourceRef and RecordLinkKind.TASK (KamoCollab CP04 Task 8)

Your universe is waiting.

Confidential markers on chats and meetings, and their labels — GET|PUT and one audited writer, the CHAT_SESSION and MEETING label endpoint (KamoCollab CP05 Task 19)