Delete a dead avatar studio that carried a live API key, and an open image route
SP00-T48 ruling — null-safe DataVolume check for the golden-image cleanup
SP00 preflight — contract check, conflict scan, 14 rulings
Pre-grant rt.org.> / email.notify.> in N1 (master §6.11), move kamo-internal's NATS login to N3, fix the §7.13 unforwarded-prefix rule for SP10's gateway routes...
AI Members + AI Provider Registry program — master spec, 15 sub-project specs and plans, runbook
Owner-approved 2026-09-23 (13 decisions, master spec §2). 15 sub-projects, 604 implementation tasks, cross-sub-project contracts in master §6 and the adopted de...
X keeps counting through a sleep, so every resumed computer went straight back to sleep
A member opening their computer got a black tab. The launch was fine, the wake was fine, the resume was fine — and then the machine powered itself off before th...
Choose how a published application asks its questions
"Publish this application" (Settings → Features → CRM → Vendors & Products) now carries three choices beside the chat, each a pair of cards that say what they m...
The lender's layout choices — squeeze, contact first or last, basic
The mortgage application now lays itself out as the product was published (Settings → Features → CRM → Publish this application): - Type. NORMAL is the five gr...
Signature previews show what the email will actually print
**************** drew the live preview and the Header/Signature thumbnails from data that raced itself. It also disagreed with the composer about what a signatu...
The session tab stops wearing Guacamole's icon
A session tab is Guacamole's document, so its own <link rel="icon" href="images/logo-64.png"> owns the tab, and a member opening their company's computer watche...
Point loan officers at the card they will actually find — Lender credentials
Both the MeridianLink and the Arive 'officer not linked' refusals named cards that no longer exist under those titles.
Arive in CRM markets, on the lead page, and on member profiles
- Markets: "Arive" joins the MLOS dropdown, and its Configure dialog holds the four Zapier hooks (write-only, masked), the Arive → Kamo addresses to paste i...
Layout choices, and saving contact details as they go
The publish dialog now chooses how the public mortgage application lays itself out (kamo-shared-library ac83bea1): NORMAL or SQUEEZE, contact details at the STA...
Layout choices for a published loan application
Three columns on LEAD_VENDOR_PRODUCTS, chosen on the publish dialog and read by kamo-apps to lay the public mortgage form out: - APPLICATION_LAYOUT NORM...
The session is navigated to, not framed — a framed one renders black
The launch screen put the session in a full-viewport iframe so the tab would keep the organization's icon and title instead of Guacamole's. It cannot work, and ...
An iPhone photo (HEIC) attaches to a bug report as a JPEG
A HEIC dropped on a bug report was refused with "must be a PNG, JPEG, WebP or GIF image" — the camera-roll format of every iPhone, AirDropped to a Mac as it is....
The password dialog passes the launch copy — main has not built since bf1e3312
bf1e3312 made `openHostedComputer`'s launch copy a required argument, and c224e20f, landing beside it, added a second caller in HostedComputerPasswordHost that ...
A cloud session asks for its task in the terminal
description") unless the account has the interactive cloud backend, which this one does not; given one, it creates the session, prints its task for the cloud se...
The columns and activity log the Arive integration maps
**************** (unique), the Arive link fields on lead_los_links (kind, GUID, deep link, stage, pending-since, last error) and los_sync_events. All nullable, ...
The public address Zapier posts Arive events to
POST **************** trigger> forwards to SecurityService's AriveInboundController, which owns the token check. The query string (the event) crosses the hop, a...
Arive through Zapier — connection, inbound events, and per-lead actions
A market bound to Arive gets a connection (four Zapier Catch Hooks for create-loan, update-loan, update-lead and convert-lead, plus one inbound URL whose token ...
Start a coder session in the cloud, and show it on the window
which lists the git checkouts on the dev machine (most recently worked in member's model and effort. The machine builds the command, with CCR_FORCE_BUNDLE=1 so ...
Start a coder session in the cloud, and say which terminals are
repository as cwd) and answers `cloud: true`; the machine builds the a cloud session can start from. The terminal listing carries the agent's `cloud` mark throu...
Start a coder session in the cloud from a local checkout
repository. The bundle is forced because our remotes are Forgejo, not GitHub, and the point is the checkout on this disk. No --permission-mode (the CLI drops by...
Attachments sit above the body, as the files themselves
An email whose only content was a PDF had no way to open or download the file: the paperclip showed on the list row, and the reading pane showed nothing. EmailS...
An attachment with a Content-ID is still an attachment
A PDF sent from the Gmail app had a paperclip on its list row and no download link in the reading pane. The app stamps every attachment with a Content-ID, and t...
Arive as a second external LOS, and a provider seam that is real
Arive is reachable only through its invite-only Zapier app, so the connection is Zapier in both directions: Kamo posts commands (create loan, update loan stage,...
A designed launch screen, in the organization's own brand
Opening a computer showed one line of plain text on a white page, written straight into the tab with `document.body.textContent`. For up to ninety seconds — a r...
ASCII in finalize.sh's log lines — jibri's logger printed the em dash as ???
Xrdp was told its session backend was itself, so nothing ever rendered
Opening a computer gave a black screen that never became a desktop. The cause is one unanchored sed in this file: sed -i 's/^port=.*/port=3389/' /etc/xrdp/...
A meeting recording no longer passes through heap, and a long one no longer times out
/transcribe read the upload with getBytes() on a 2Gi pod, and a meeting recording runs past a gigabyte. It now copies the spooled upload to the scratch volume a...
Stream the recording, and run the summary after commit — it ran inside the upload
Jibri's upload read the whole recording into heap (file.getBytes()) on the pod that also serves chat; a two-hour meeting is over a gigabyte. It is now streamed ...
Recording had never worked — jicofo never looked for jibri, and jibri never arrived
Four separate faults, each enough on its own to stop every recording: - jicofo had no ENABLE_RECORDING, so the image wrote no `jibri {}` block: it never watc...
Recreate, and probe the XMPP session — a surge left meetings with no focus for 18h
Every jicofo logs in to prosody as the same full JID, focus@auth.meet.Meet/focus. The maxSurge rollout from 9da0998 runs two of them at once, and prosody answer...
Two threads rebuilt the initrd at once and destroyed the machine
A computer provisioned, came up, and panicked on its next boot: Run /init as init process Failed to execute /init (error -2) Kernel panic - not syn...
The restart could land mid-initramfs and leave a computer unbootable
A brand new computer provisioned, came up, reported AWAKE, and ninety seconds later panicked: Kernel panic - not syncing: No working init found. I caused ...
Browser WebSockets authenticate with a one-time key, never the session token
The 15 places a hook opens a STOMP/SockJS connection to MediaService (media.<domain>/ws) or EmailService (via the /email-ws rewrite) put the raw 128-char *** se...
Accept a short-lived otk on the WebSocket handshake, alongside ***
Same change as mediaservice: kamo-internal is moving the *** session id out of browser JavaScript, off sessionStorage and off every WebSocket URL (`?***=<128-he...
Accept a short-lived otk on the WebSocket handshake, alongside ***
kamo-internal is moving the *** session id out of browser JavaScript: it currently sits in sessionStorage and rides every WebSocket URL as `?***=<128-hex id>`, ...
Kamo-internal's session-handle secret
kamo-internal 3e3c3e7a mounts **************** (SESSION_HANDLE_SECRET), which seals the per-tab session handles that replace the *** id in page script. Created ...
A tab's session is a sealed handle — the id never reaches page script
/api/validate is where a tab first learns its session, and it returned the 128-hex *** id for the page to keep in sessionStorage — readable by any script runnin...
The *** cookie on login.* is HttpOnly, and no log line carries half a session id
/api/login, /api/login/mfa and /api/session/select planted *** with httpOnly:false ("client- accessible for session checks") — but no browser code on login.* or...
The session id stops coming back to page script — groundwork for sealed handles
*** was set readable (httpOnly:false) and several responses handed the raw session id to the browser. Page script cannot use a cookie's HttpOnly flag if an endp...
A resumed computer went straight back to sleep
Thirty seconds after the first real resume, from the machine's own log: kamo-hc-agent: idle 13202s >= 1800s — going to sleep PM: hibernation: hibernati...
An org domain's DKIM private key never serializes
5de57705 added OrgDomain.dkimPrivateKey — the key that signs a domain's transactional mail — with a comment saying it is never sent to the browser, but nothing ...
History records what happens after a lead exists, not its starting form
recordCreated wrote the CREATED row and then diffed the new lead against an empty snapshot, so every non-null starting field became a FIELD_CHANGED row — and th...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.