Changelog
What's new.
Every improvement to the platform, as it ships.
· KlusterServices
Bring www.kamouniverse.com live; apex goes through kamo-nowww
KamoUniverse is now the primary marketing site. www.kamouniverse.com stops 301ing to www.kamocrm.com and is served by the kamouniverse-marketing app (its own IngressRoute, Host(www.kamouniverse.com) at priority 100 — above kamo-marketing's ^www[.] catch-all). The bare apex now routes to kamo-nowww, which 308s it to https://www.kamouniverse.com and passes ACME HTTP-01 challenges through, exactly how kamocrm.com reaches www.kamocrm.com; the http route keeps excluding /.well-known/acme-challenge/ so cert-manager's solver still answers renewals. The kamouniverse-to-kamocrm redirect middleware is gone from the file; `kubectl apply -f traefik/routes/` doesn't prune, so it is deleted from the cluster by hand after this deploys. The four audience domains already forward to www.kamouniverse.com, so they now land on the site in one hop instead of two.
· KlusterServices
Certificates for every platform host on kamouniverse.com
login.kamouniverse.com and register.kamouniverse.com become the platform's KamoUniverse sign-in and sign-up doors, and from them a visitor reaches theme., capcha., api., internal. and the rest. None of those hosts has a certificate today, so Traefik answers them with the kamocrm.com default and the browser refuses the page. theme., capcha. and media. are subresource-only and cannot bootstrap their own certificate through the access-log scan, and the platform's kamouniverse.com org_domains row may only carry ssl_confirmed once every KnownAliases host is certified, so all 13 labels are listed rather than waiting on traffic.
· kamo-shared-library
Meeting calls in AI_CALL telemetry — kind, meeting id, REMOVED, meeting events
AiCallKind {PHONE, MEETING} and AI_CALL.KIND / MEETING_ID (SP14 DDL **************** AiCallOutcome.REMOVED, the four meeting event types, and the member+meeting live-call finder. SP13's AiCallEntitiesTest now lists the two SP14 columns and the new finder.
· KlusterServices
Run IBM Granite 4.0 H-Tiny in place of qwen3:4b, on 16 cores
The owner asked for a local model that runs substantially better on k3m1's AVX2-only Xeons (2026-09-27, ruling SP01-LLM-granite4). granite4:tiny-h is a hybrid Mamba-2/transformer MoE (7B total, ~1B active): several times qwen3:4b's prompt and answer speed on CPU, native tool calling, and no thinking pass. - postStart pulls granite4:tiny-h; - CPU limit 8 -> 16 (LLAMA_ARG_THREADS follows it), request 2 -> 4; - OLLAMA_CONTEXT_LENGTH 8192 -> 16384 (agent steps run 3-5k tokens); - OLLAMA_FLASH_ATTENTION=1. Memory stays 8Gi.
· kamo-internal
Explain AI activity on the lead header (SP10)
· kamo-internal
The AI room — workbench, autonomy dial, runs and rehearsal (SP10)
· kamo-internal
Workforce hub tab with the AI team roster (SP10)
· KlusterServices
Bring the worldchunks drive back into use after it drops
On 2026-09-23 the USB earth-tile drive on k3m1 dropped for a second. systemd unmounted it and stopped nfs-server, which nfs-utils makes require every exported path, and nothing mounted it or started the server again when the disk came back. k1m1's hard NFS mount then hung statfs() for four days, until etcd stalled and the platform went down on 2026-09-28. worldchunks-reconcile runs every minute on both nodes and does nothing when all is well. On k3m1 it remounts the drive when it is present but unmounted or dead, and starts nfs-server when the drive is healthy. On k1m1 it remounts the share once the server answers. On both it restarts any container still bound to an old or empty /mnt/worldchunks, at most once per pod per 15 minutes, because until then DaemonService's scenery sampler reads a dead or empty directory. Installed on k1m1 and k3m1 by hand, like k3m1-ext. Verified live: a stopped mount and nfs-server came back in 36s, an unmounted k1m1 share in 55s, and a test pod left on a swapped-out filesystem was restarted onto the new one.
· AIService
Translation and OCR façades on the router for the Tool Plane
F1 POST /api/ai/v1/translations {text, to, from?} and F2 POST /api/ai/v1/ocr (multipart file, optional filename), SP05 spec §4.17: the caller's session, SP04's runtime and SP01's family adapters. TRANSLATION takes up to 2 attempts (from null is sent and answered as auto) and is metered CHARACTERS_1K in code points; OCR takes one attempt and is metered PAGES, at least one. A malformed field is a 400 naming it; a file with no name travels as "document". Ruling SP05-T32.
· MediaService
AI members join meetings — invite, auto-join at start, runtime state, companion context
· MediaService
Meeting history, meeting detail with dial-in and transcripts, inviteable AI members
M3 GET /api/meet/ai-candidates, M4 GET /api/meet/meetings, M5 GET /api/meet/meetings/{id} (spec §4.4.1). Every answer is application/json; a page never splits meetings that share an instant; a row with another UUID encoding is left out instead of failing the list; the AI flags follow M1's rule for who may invite.
· ConversionService
Detailed transcription — timed segments, speakers, language and model provenance
POST **************** (SP14 spec §4.4.3) answers a recording as timed segments with the language and the provider and model that heard it, for MediaService's persisted meeting transcripts. It cuts and measures exactly as /transcribe does and shares its request, retry, auth and scratch handling; a blank secret answers 503 (master §7 item 13). /transcribe is unchanged.
· MediaService
Recording transcripts and summaries persisted, routed through the org's AI services with provenance
· AIService
Member chat uses the Tool Plane with the member's own session; MCP server admin contract fixed
· AIService
SP04 router, executor, budget and realtime configuration
· AIService
Routing preference and AI-member budget endpoints
· AIService
Member and widget chat routed, policy-checked and metered by the router stack
· KlusterServices
Forward the four audience domains' apex + www to www.kamouniverse.com
kamofamily.org, kamobusiness.com, kamopersonal.com and kamocommunity.org are registered and pointed at the cluster. Their apex and www now 301 to https://www.kamouniverse.com with path and query preserved, the same way kamouniverse.com and www forward to www.kamocrm.com. That forward still applies, so visitors currently end up on kamocrm.com after two hops. dev.<domain> is each audience's own site and is not affected. - **************** one redirectRegex middleware plus http and https IngressRoutes at priority 300, above marketing-route's www.* catch-all. ACME challenge paths are excluded on :80. - auto-cert: the eight apex/www hosts in STATIC_DOMAINS. Six already had certs through the apex allowance. kamobusiness.com has no apex A record yet, so its two issue through the periodic retry once it does. kubectl diff over every target of the Traefik step: only the three new objects differ, so the Traefik deployment is not rolled.
· AIService
Realtime relay WebSocket with single-use tickets, session cap and metering
· AIService
Realtime tickets — relay tickets in Redis or OpenAI ephemeral secrets
Ephemeral secrets are minted through the gateway's shared family walk (every dialled mint metered, a rejected key marks the provider, budget alerts after the ticket); relay tickets take the first candidate whose endpoint may be reached, name the voice in the model's own spelling, and a 424 names the dominant exclusion. E8 refuses malformed fields with 400 (SP04-T30).
· KlusterServices
KamoBusiness, KamoPersonal, KamoCommunity sites; KamoFamily moves to dev.kamofamily.org
Three more audience sites set up like KamoFamily. Each is a Next.js repo edited on GitHub (pantherkamo/<Name>), synced to Forgejo kamo/<name> by a git-sync CronJob, and deployed by its own Forgejo workflow: KamoBusiness dev.kamobusiness.com KamoPersonal dev.kamopersonal.com KamoCommunity dev.kamocommunity.org KamoFamily's domain is kamofamily.org, so dev.kamofamily.com (which never resolved) is replaced by dev.kamofamily.org in STATIC_DOMAINS. - auto-cert: all four dev hosts in STATIC_DOMAINS. None of the four domains is registered yet, so each cert comes from the periodic retry added in 88b06ef once its dev CNAME resolves. - poddisruptionbudgets: one per site, maxUnavailable 1 - git-sync: CronJobs git-sync-kamobusiness, -kamopersonal and -kamocommunity, with their Secrets documented in SECRETS.md (applied by hand, like the others)
· kamo-internal
Routing & Budgets tab — model preference order and AI member budget defaults
· AIService
Image generation façade (base64 only), metered per image
· KlusterServices
KamoFamily (dev.kamofamily.com): cert, PDB, GitHub sync; auto-cert retries unissued static domains
KamoFamily is a new Next.js site (Forgejo kamo/kamofamily, edited on GitHub pantherkamo/KamoFamily), set up the same way as the KamoUniverse marketing site: - auto-cert: dev.kamofamily.com in STATIC_DOMAINS - poddisruptionbudgets: kamofamily, maxUnavailable 1 (2 replicas) - git-sync: CronJob git-sync-kamofamily fast-forwards Forgejo main to GitHub main every two minutes (applied by hand, like the first one) auto-cert only ever seeded STATIC_DOMAINS once, at startup, and that seed skips a host whose DNS does not resolve. Nothing revisited it, so a domain listed before its record existed waited for the next pod restart. dev.kamouniverse.com hit this two days ago and got its cert only because a request happened to land in the access log. dev.kamofamily.com is listed while kamofamily.com is still delegated to Yahoo's retired nameservers, so it would hit the same gap. The main loop now re-runs the seed about every 15 minutes for static hosts without a healthy certificate. When every host has one, it logs nothing.
· AIService
Transcription and speech façades metered in audio seconds and characters
E4 POST /api/ai/v1/audio/transcriptions and E5 POST /api/ai/v1/audio/speech, each with its internal twin, on SP01's family adapters. The WAV-header duration walk always ends; a model that lists voices gets its first when none is named and is skipped for one it does not list (Piper ignores the voice field); Speaches pcm is asked for at 24 kHz; malformed or streaming fields are refused; a text transcript is UTF-8; an upload over 25 MB is 413 JSON.
· DocsService
The document list searches file names when searchQuery is given
DocumentListRequest.searchQuery was accepted and never read, so a search returned the newest documents whatever was asked. A non-blank searchQuery now keeps the documents whose file name contains it (trimmed, ignoring case, LIKE wildcards taken literally), so the page and its total are the matches. The Docs manager never sends it; the Tool Plane's docs_search (KamoAI SP05) does.
· MCPGatewayService
Documents, translation and OCR packs
docs_search, docs_read, translate_text and ocr_document (spec 4.20). A document is routed by DocsService's description before any byte is fetched: text is decoded here (a Markdown or YAML file stored as octet-stream by its extension), the PDFs and images Kamo OCR reads go to AIService F2, a document of more than five pages is refused before its download, and anything else is not readable without one. Document ids are canonical longs; language codes are checked as F1 checks them.
· kamo-internal
Meeting page — dial-in, invite or remove AI members, transcripts and summaries
· AIService
Embeddings on the pinned model and rerank façades
Inputs and documents reach the model in batches it accepts (TEI refuses more than its client batch of 32 with 422; a reranker's maxDocuments); malformed fields are refused, never read as absent.
· MCPGatewayService
The AI's workstation — computer_* tools with auto-wake and lease, workstation pack
Your universe is waiting.
Start free in minutes. Add products whenever you are ready — no migration, no new logins.
Free forever — no credit card required