Changelog
What's new.
Every improvement to the platform, as it ships.
· kamo-shared-library
Live Changes — commit deployments and the VIEW_LIVE_CHANGES widget rights (690-695)
CommitDeployment (COMMIT_DEPLOYMENTS) is one push to main, keyed by its head commit, and how far CI has carried it. CommitLog.deploymentHash points each entry at the push that delivered it. Schema landed by KamoInitializer 2026-11-06. VIEW_LIVE_CHANGES (690) is a root with no ServiceType that gates the feed; the standard five widget rights (691-695) hang off it. RoleRightHierarchyTest counts move with them.
· KlusterServices
Let SecurityService read Forgejo's CI statuses for Live Changes
The Live Changes deployment tracker asks Forgejo (a host process on k1m1, port 3000) where each push is in its pipeline. avatar-resolver-egress allowed only YugabyteDB, NATS and MinIO on the node, so every request timed out.
· kamo-internal
Allow This Site on an SI's refused fill, in the vault's Activity (TPVAULT phase 2)
· MCPGatewayService
Vault_list, vault_fill and vault_run_shell, fill-only by reference (TPVAULT phase 2)
The SI names an item; the Tool Plane reads the focused window and the browser's address bar from the machine itself, asks VaultService (which checks the site binding and writes its activity row first), types the value into the SI's own workstation and tells the model only that it did. The value is never in arguments, plans, approval cards, results, memory or logs, and every workstation answer afterwards is scrubbed of it (keyed hashes in Redis, never the value). Shell secrets go in an environment variable. vault is never on behalf.
· kamo-shared-library
VaultItem.allowedHosts, the sites a supervisor approved for an SI's fills (TPVAULT phase 2)
· kamo-internal
Password Vault under Organizer (TPVAULT phase 1, with phase 3 screens)
/vault: your own vault and the vaults of SIs you supervise; items by type (sign-ins, API and SSH keys, recovery codes, authenticator keys, Wi-Fi, computer sign-ins, notes); Confirm It's You before a value is shown (password, plus authenticator when enrolled, or an emailed code), one value per request, hidden after 30 s, clipboard cleared after 30 s; generator, share one item, Password Health with the k-anonymity breach check, Activity in plain language, Emergency Access, import from **************** BFF /api/vault/** relays to SecurityService, no-store, never logs. Help article.
· SecurityService
Password Vault relay and 5-minute re-confirm; attempt limit on the hosted-computer password confirm (TPVAULT)
/api/security/vault/** resolves the session, refuses impersonation, computes the re-confirm freshness on every request (the KREAUTH password marker within 5 minutes, plus the authenticator when enrolled; an emailed code for accounts with no password) and relays an allowlist of people's paths to VaultService. The hosted-computer password confirm now shares the re-check limiter (5 wrong per session per 15 minutes).
· kamo-shared-library
VAULT_RECONFIRM_CODE canonical email for members without a password (TPVAULT)
· kamo-shared-library
Password Vault entities and VAULT_* access-log events (TPVAULT)
Seven tables for the Password Vault (vaults, items, encrypted fields, an append-only access log, shares, emergency requests, known devices), declared here so KamoInitializer can recreate them; DDL applied by hand first (vaultservice docs/sql). Ciphertext columns carry @JsonIgnore and are pinned in **************** which was red on main for three kamoai cipher columns that are now guarded too.
· kamo-internal
A Call Log page under Call / Text
Every call the member made or took and the calls of everyone below them on the reporting line (VOIPService GET /api/voip/calls/log decides the rows). Rows show the far side and our line as PhoneNumber, the member's avatar, time, length, how it ended (with the Call Floor's outcome), an inline player for a recording that truly exists (stored, or provider-held and streamed through VOIPService), a searchable transcript drawer, and the most recent lead, account and transaction as links, or Not Linked. Filters, order and dates live in the address bar; tiles count the whole filtered set and filter on a click; pages load as you scroll; new calls arrive through the call-log org-change domain. Quick Tips, the help popup and a help center article ****************
· kamo-internal
View Floor Reports opens the scoreboard and the manager panes
Mirrors VIEW_FLOOR_REPORTS (675) and lets it open the Leads > Scoreboard row and page and the Floor Pulse, Speed-to-Lead Report, Funnel by Lead Source and Coaching Flags panes, beside the call floor rights. Whose numbers show stays the reader's reporting line. Help: a new Floor Reports article (what the right opens, who sees whose rows, how to grant it) and updated scoreboard and home widget articles.
· SecurityService
Seed View Floor Reports to administrators and floor managers
VIEW_FLOOR_REPORTS (675) now opens Floor Activity. On the boot that introduces it, RoleRightsSyncService grants it wherever CONFIGURE_SYSTEM (an organization's administrators) or MANAGE_CALL_FLOOR (who opened the report before) is granted, in roles and in the department, job title, member and team overrides. Working the floor alone does not carry it. The organization owner holds it implicitly in report decisions, for a session and for a schedule's owner alike.
· VOIPService
A Call Log for the member and their reporting line
GET /api/voip/calls/log reads PHONE_CALL_LOG by the indexed time range of the members in view (self + everyone below on the manager field, the owner sees all, the same shared ReportingLine the Call Floor uses), filters, counts and pages on the server, and hydrates only the page's lead, account and deal (most recent of each) unless a filter needs them all. GET /api/voip/calls/log/{id}/audio streams a recording the provider keeps (JustCall) through this service, behind the call's scope, the PHI capability, the recording rule and the audit row. New calls signal the call-log domain.
· kamo-shared-library
View Floor Reports (675) opens Floor Activity
Floor reports are their own security right (owner, 2026-11-06). VIEW_FLOOR_REPORTS is a standalone CRM root taken from the calling workspace's reservation (676-680 stay reserved). Floor Activity now requires it instead of the two call floor rights; the reporting line still decides every row, and the owner holds it implicitly in SecurityService. RoleRightHierarchyTest: values 434, standalone 100, roots 148.
· KlusterServices
Rke2-unwedge, a watchdog for the rke2 log-pipe deadlock
The 2026-09-28 and 2026-10-25 platform outages were the same deadlock: rke2 loses its lease, its ExecStopPost kills containerd, nobody reads the container log FIFOs, and etcd/apiserver/traefik block on their next log line, so rke2 crashloops forever. Both were fixed by hand-draining FIFOs. This does that automatically: when rke2's containerd is gone AND a container process is blocked on a pipe for 30s, start one cat per log FIFO (into /var/log/rke2-unwedge/, /dev/null if disk is short), and stop each one once containerd re-opens its FIFO. It never signals etcd, rke2, containerd or containers. test.sh exercises it against a real blocked pipe; --scan on k1m1 finds 183 shims / 396 FIFOs, matching the 10-25 manual drain.
· KlusterServices
Alert on node link drops and speed fallback, routed to sysadmin email
The LAN switch shared by k1m1 eno49 and k3m1 eno49 has been resetting since 2026-10-29 (hundreds of carrier drops, 66 of 70 drop minutes shared by both nodes, k1m1 eno49 stuck at 1 Gb/s). node-exporter had the signal; nothing watched it and monitoring-namespace alerts all routed to null.
· kamo-internal
Narrow rights for Saved Texts and the mortgage automation switches
MANAGE_SAVED_TEXTS opens Phone settings at the Saved Texts tab alone, and MANAGE_MLOS_AUTOMATION opens a Mortgage Automation Switches tab on Commerce settings. Each sits beside the broad right (MANAGE_VOIP_SETTINGS, MANAGE_SUBSCRIPTION_SETTINGS), which keeps every tab it had. The other phone tabs and the SI autonomy sections stay with the broad rights. Mirrors both rights (688-689) in RoleRightType.ts, and the help articles say who can change the switches and saved texts.
· VOIPService
Let MANAGE_SAVED_TEXTS read and change saved texts
/api/voip/sms/text-templates accepts the narrow MANAGE_SAVED_TEXTS right beside MANAGE_VOIP_SETTINGS for its writes, and beside ACCESS_VOIP for its reads, so a holder of only the new right can work the Saved Texts tab. No other phone endpoint changes.
· SecurityService
Let MANAGE_MLOS_AUTOMATION open the mortgage automation switches
GET and PUT **************** now accept the narrow MANAGE_MLOS_AUTOMATION right beside MANAGE_SUBSCRIPTION_SETTINGS. Every other mortgage config endpoint keeps MANAGE_SUBSCRIPTION_SETTINGS alone, SI_LOAN_ACCESS stays the organization owner's decision, and changes still log to mlos_config_change_log through MlosAutomationSettingsService.
· kamo-shared-library
Add MANAGE_MLOS_AUTOMATION and MANAGE_SAVED_TEXTS narrow settings rights
Two standalone roots (688-689) so the mortgage Automation tab switches and the Phone Saved Texts tab can be granted without MANAGE_SUBSCRIPTION_SETTINGS or MANAGE_VOIP_SETTINGS. Each is accepted beside its broad right, never instead of it. RoleRightHierarchyTest: values 433, standalone 99, roots 147.
· EmailService
A task event links to My Tasks, under Organizer
· KBService
A task notification opens My Tasks, under Organizer
The old /notes?task= address still reaches it by a 307 in kamo-internal.
· SecurityService
Callbacks-due says which rows are return dates, for My Tasks
· kamo-internal
Organizer in the nav, and My Tasks shows every task assigned to me
Organizer is a new primary nav option holding My Tasks, Calendar, Contacts and Notes & Checklists, each row on the gate it had as an option, with the calendar's presenter marker on the Organizer icon. Routes stay; the old My Tasks addresses in Notes (?view=tasks, ?task=) are 307 redirects to /my-tasks. The command palette finds each row, and Automation Streams by "streams" or "automation", landing on its settings tab for those allowed. My Tasks (/my-tasks) builds on the task system and the lead Tasks tab's action plan rows: tasks and lead tasks (KBService, a stream's CREATE_TASK among them), drafts waiting in the send queue (scope=mine), the call list and callbacks due, filtered by source, due, lead, deal, priority and whose tasks, live on the checklists, automation, calling and floor-leads changes, with tick, send, call and done in place. Nothing is stored. Help article, tour steps and task links follow it.
· kamo-internal
The org's SI by face and personality on every floor page, and no typed voice
- Email Triage: the typed Your Voice box is gone. Who Writes Your Drafts chooses your organization's SI (its own personality) or your own SI Assistant (the voice from SI Assistant Settings, which Change Voice opens). Drafted by names the SI under a draft. - One org SI: OrgSiPicker on SI settings and Email settings, the same record SI calling edits on the Automation Streams page, which now says so and shows each SI's personality. The triage and capture panels no longer carry their own SI choice. A briefing marks the org's SI in its picker. - SiWorkStrip tops Email Triage, Today's Briefing and the Capture Inbox with the SI's photo, name and personality, or Put An SI To Work Here with Choose Your SI or Hire An SI for whoever may. Briefings show Written by. - Help: Email Triage, Capture Inbox, Today's Briefing and SI calling articles updated.
· SecurityService
An SI's personality on the AI members read, so its work can say who it is
Each /team-members/ai-members row carries personality: the archetype's title and description in force for that SI, or null. One resolve per SI, each in its own read-only transaction, so a failure leaves the list whole.
· MCPGatewayService
Inbox tools say a draft is in the SI's own personality, or the owner's SI Assistant's voice
No more owner's voice profile: si_inbox_next carries the owner's name and placeholder, and their own SI Assistant's voice when they chose it. The parity snapshots change only for these two descriptions.
· AIService
A member's own SI Assistant voice, for email triage drafts
POST **************** answers the assistant's name and how it sounds, resolved from SI Assistant Settings through the same waterfall the chat reads. Email triage writes a member's drafts in it when they chose their own assistant. Nothing is stored here, and there is no voice field anywhere else.
· kamo-internal
A Sales Floor kind members can mute on its own
SALES_FLOOR mirrors the Java kind (kamo-shared-library 3ea204a5): gated on VIEW_LEADS like EmailService, listed just before the lead callback, drawn with a headset. Its label (Sales Floor) and its settings hint are in kamo-translation-dictionary. Sound stays the normal notification tone.
· kamo-internal
The System User reaches the SI floor's setup, as automation-service now allows
automation-service (5a6a287) lets god mode and the System User read and change SI settings and briefings, recorded each time. God mode already reaches the tab through checkRight's open-window bypass; the System User is not in any session payload, so useSystemUserSession asks **************** once per page load (fails closed) and the SI floor gate, the settings menu, the settings cards and the email triage tab read it.
Your universe is waiting.
Start free in minutes. Add products whenever you are ready — no migration, no new logins.
Free forever — no credit card required