/image/logo-variants cuts a logo into pre-sized PNG + WebP rungs
Org logos are uploaded once and drawn everywhere at 24-120px, and every surface downloaded the original: crm's logo-full.png is 2.2 MB (its .svg stand-in 2.95 M...
SP00-T49 fix round 1 — the kamo node password goes on the owner checklist
Task 52 Step 9 gains item 4: rotate the kamo node password, after Task 49 Step 3 and followed by a memory update. The item lists every copy that a value-keyed s...
SP00-T22 ship ruling — RingCentral's verificationToken cap is 32 characters; follow-up c43ec04
SP00-T46 rulings — Scylla's init container makes the pod Guaranteed; libretranslate rolls one pod at a time
SP00-T49 rulings — the worldgen agent's unit is installed before its env file; NATS violation checks grep what the server logs
Task 49 Step 3 now deploys universe-earthdata's unit on k3m1 (the live one points at 127.0.0.1 and reads no env file), logs in as kamo@k3m1, and carries its own...
Scylla to 2 CPU / 4Gi, libretranslate request to 10Gi (32 GiB, 6 CPU released)
Scylla: --smp 2 --memory 3G in a Guaranteed 2 CPU / 4Gi pod (14-day peak 0.66 GiB, 0.05 CPU; the database is 2.93 MB). The init container now has requests == li...
Mint a RingCentral webhook verificationToken RingCentral accepts
RingCentral refuses a deliveryMode.verificationToken longer than 32 characters with CMN-101 "Parameter **************** value is invalid" (measured against the ...
Own NATS login
kamo-internal's three NATS connections (org changes, worldgen, world live) present svc_kamo_internal from the nats-user-kamo-internal Secret instead of the shar...
SP00-T44 fix round 1 — the OTA step reads memory only through a value-keyed redactor, and never under set -x
Phase A printed the node password twice, reading two memories the step cites. Step 3 now sources a preamble that holds commands only, reads memory through memre...
SP00-T21 ship ruling — the KB backlog catch-up is blocked by the embedding model's sizing; parked
A socket's one-time key is not a sign-in hand-off
Since 46191c47 every browser WebSocket authenticates with ?otk=<key>. The EmailService sockets connect through the same-origin /email-ws rewrite, so they pass t...
SP00-T31 ruling — the eleven MLOS repos roll back without restoring the unbuildable 1.6.0 pin
New mail shows on /messages as soon as the badge counts it
The badge and the list hear the same socket, and EmailService relays every arrival (verified on NATS: email.changed ARRIVED from both pods, then the unread snap...
SP00-T23 plan text — the event gate sits behind EventRequest.invitesByEmail(); tests beside the brief's
SP00-T45 ruling — the rollback deletes the Qdrant NetworkPolicy; the network check needs curl's 000
SP00-T23 ruling — a calendar save needs a seat only when it invites by email; SP07/SP08 keep the seat gate
SP00 plan — log checks read every line (kubectl logs -l prints only the last 10)
Task 29's daemon and compute checks and Task 45's RAG check now pass --tail=-1. With a label selector, kubectl logs defaults to the last 10 lines, so the daemon...
SP00-T43 ruling — the envelope test follows the selectable path; AiModel comment; build @kamo/net before the RED run
Sending mail needs a seat, for people and AI members alike
A member without a licensed seat is refused with the shared 403 SEAT_REQUIRED body before anything is sent: POST /api/email/send, the shared-mailbox send, and t...
SP00-T42 ruling — the help-center import Usage block reads the Redis login
The Redis login
The pod logs in to Redis as the platform ACL user (Secret redis-auth: REDIS_USERNAME, REDIS_PASSWORD), which app/lib/redis.ts already reads, so sign-in keeps wo...
Own NATS login, Redis login, KamoAI secret
NatsConfig's comment now names where the login comes from: svc_kb, from the nats-user-kb Secret, which overrides the shared kamo_svc keys.
SP00-T21 ruling — gRPC at compile scope, wiring tests beside the brief's, replay trade-off recorded
Present Qdrant's API key, and recreate the consumers so KB and notes are embedded again
Meetings, group chats, attachments and calls need the seat that includes them
SP00-T22 ruling — precondition counts configured instances; unscoped RC overloads removed; null-safe TURN member
Only verified RingCentral webhooks are processed; calling needs a seat
The legacy path that processed a RingCentral call or SMS event with no instanceId, trusting the payload's own to-number, is removed together with its 2026-10-13...
SP00-T27 ruling — anchored key pattern with its own test; platform-only catalog comment
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.