Google Trust Services issues the platform login host's certificate (IoT SP09)
Amazon's account linking refuses Let's Encrypt, so login.kamouniverse.com alone moves to a gts-prod ClusterIssuer (ACME with External Account Binding); every ot...
Pre-issue iot.<apex> certificates, PDB kamowebiot, availability probe
iot joins BROWSER_ONLY_ALIASES and STATIC_DOMAINS on both platform apexes so the first share recipient never meets a missing certificate; monitoring/ is applied...
Postfix takes the name mail.kamouniverse.com once it resolves here
kamouniverse.com is the platform's sending domain, but the server still introduced itself as mail.kamocrm.com in its EHLO, Received headers and bounces. Postfix...
Scrape kamowsiot-service on /actuator/prometheus
IoT SP01 Task 34: the kamo-actuator job keeps kamowsiot-service beside kamowssecurity-service, so the four IoT alerts (iot-service's own PrometheusRule) have da...
IOT_EVENTS max-bytes in binary units — nats CLI 0.5 refuses the bare 10737418240 (IoT SP00)
Api.* carve-out for vendor hooks and the Alexa relay with a webhook-sized limit; IoT secrets documented (IoT SP00)
Default-deny egress for kamowsiot and its disruption budget (IoT SP00)
NATS login svc_iot, svc_media iot.live.> grant, IOT_EVENTS work queue (IoT SP00)
Svc_camera, KamoCameraService's own login
Publishes rt.org.> (the Cameras screens' live refresh) and cameras.site.> (a site RPC routed to the pod holding that site's connector socket), subscribes camera...
Auto-create standard IMAP folders for every mailbox
Dovecot now subscribes Drafts, Sent, Junk, Trash and Archive on first open with SPECIAL-USE flags so EmailService and the UI see real folders instead of client-...
A help article no longer OOMKills the Tamil engine
KBService sends a help article's Lexical JSON to be translated: one long line with few sentence ends, ~0.46 model tokens a character. A 3,980-character article ...
Pin that the SP93 host patch keeps the first pre-image as its backup
The existing re-run test patches nothing on its second run, so it never reaches the backup and could not catch a script that overwrote it. The new test rolls th...
Org-graph listeners may subscribe to the org-graph change subject
KamoCollab CP02 Task 6A (master R1-23, CP-D75). SecurityService publishes **************** after every org-graph write; each service that caches the org graph e...
Rotate the kamo_ops password
The operator password (Secret kamo/redis-ops-auth) reached an agent transcript in KamoAI SP01 Task 38 and had never been rotated (SP98-M-2). It was rotated live...
The outbound gate refuses a number the toll-fraud guards block (SP93 T9)
[kamo-outbound-gate] gains a GotoIf on kamo-asterisk-support's managed [kamo-toll-fraud-blocked] list, between the SP13 AI-transfer line and the Goto onward, an...
Nothing in the mail namespace reaches the session store
rspamd now keeps its data in its own Redis, so the platform Redis drops its mail_rspamd user and admits only the kamo namespace; rspamd's ConfigMap drops the ke...
Rspamd keeps its data in its own Redis
local.d/redis.conf is now the redis-own.conf key: rspamd-redis in mail, database 0, the same mail_rspamd login. The subPath change rolls the pod. The old key st...
A Redis of rspamd's own
rspamd parses untrusted mail and logs in to the platform Redis, beside every member's session, and no ACL can keep it from them there: a user cannot be scoped t...
A member's xrdp desktop shows the organization's wallpaper
xfdesktop draws the backdrop stored under the X server's RandR output name. A member works in an xrdp session, whose xorgxrdp server names its output rdp0, but ...
A take-over ends only once its VNC password is sealed
VncAccess cleared the take-over in memory and then wrote the password file. When the write failed, x11vnc kept accepting the take-over password while the agent ...
The platform main line survives a boot, and 8200 is the team line
Luna's go-live (2026-09-28) wrote [kamo-main-luna] into extensions_custom.conf and KAMO_LUNA_EXT / KAMO_LUNA_MAX_RING into globals_custom.conf by hand on the ho...
An AI workstation sleeps with its desktop stopped, and wakes to a fresh one
Measured on a throwaway -ai4 workstation (SP98 Task 16), the wake stalled because Xorg does not survive a resume: with no KMS driver it drives the console throu...
Media_timeout back to livekit-sip's default
957fc4f re-applied a 20-minute media timeout for a quiet meeting's AI leg. With the fail2ban ban on 47.181.8.84 lifted and FreePBX sending RTP straight over the...
A quiet meeting keeps its AI (media_timeout 20m), again
Reapplies 960331f, reverted in 5d70873 on the wrong suspicion: the RTP loss seen right after that deploy was fail2ban's ban on 47.181.8.84 (fixed in the previou...
Livekit-sip's RTP never takes the router, and its hairpin is never banned
FreePBX names its public address (pbx.k1.kluster.kamocrm.com) in the SDP and the Contact it gives livekit-sip, which is outside local_net, so RTP and in-dialog ...
An English-to-Tamil engine, so Tamil stops being English
LibreTranslate lists no Tamil and Bergamot serves German only, so every en->ta request (the dictionary sync, Help Center articles, chat) matched no provider and...
The heap fits the container, so a meeting is never OOMKilled
The image starts java -Xmx${JIGASI_MAX_MEMORY:-3072m} and the container was limited to 1Gi: the heap could outgrow the container, and Jigasi was OOMKilled mid-m...
Permanent forwards expire from the browser cache after an hour instead of never
From 2026-09-23 to 09-27 the kamouniverse-to-kamocrm redirectRegex 301'd kamouniverse.com to www.kamocrm.com. Traefik sends such a redirect with no Cache-Contro...
The meeting bridge trusts LiveKit from k3m1's node address too
livekit-sip is hostNetwork on k3m1, and k3m1 reaches 192.168.4.22 over its eno50 cable (192.168.4.22 via 10.0.50.0 dev eno50 src 10.0.50.1), so FreePBX sees eve...
An AI workstation goes to sleep with nothing on its desktop drawing
A page still drawing when the sleep image is written made the wake take minutes. SP11 Task 30's workstation slept with Kamo's sign-in page open (a full-screen z...
Never ban k3m1 — its node network joins the fail2ban allowlist
FreePBX runs with hostNetwork on k1m1. A pod on k3m1 reaches it SNATed to k3m1's InternalIP, 10.0.50.1, which none of the [DEFAULT] ignoreip ranges covered (the...
A lone call waits five minutes for company, not thirty seconds
Jigasi hangs up a call that nobody else joins within JIGASI_JVB_TIMEOUT (the image's default 30 s): Jicofo invites a participant only once there are two. An AI ...
Probe the kamouniverse.com surfaces next to the kamocrm.com ones
kamouniverse.com is the platform's primary apex, so the availability probe lists its internal, login, register, media, api, apply, careers and www endpoints. Al...
Auto-cert pre-issues analytics, desktop and myloan on kamouniverse.com
- STATIC_DOMAINS gains analytics.kamouniverse.com, desktop.kamouniverse.com and myloan.kamouniverse.com, twins of kamocrm.com hosts that are reached only th...
Serve desktop.kamouniverse.com, and bounce a bare computers.kamouniverse.com to its login
desktop.kamouniverse.com had DNS but no route, so it answered Traefik's 404 behind the default certificate. It now serves KamoDesktop through desktop-https-kamo...
Docs trusts api.kamouniverse.com as a WOPI host
A member signed in on internal.kamouniverse.com (the platform's primary apex since 2026-09-28) opens documents with **************** DocsService takes the last ...
Kamouniverse.com refuses unknown recipients at RCPT instead of bouncing them
kamouniverse.com, the platform's primary apex, is an alias domain of kamocrm.com: every <x>@kamouniverse.com is the <x>@kamocrm.com mailbox. It was mapped by a ...
The desktop-ws route reaches only the terminal socket, not every SecurityService path
**************** matched PathPrefix(`/desktop-ws`) on internal.* and stripped the prefix, so **************** reached ANY SecurityService path from the internet...
A caller an AI member transfers rings the person from its own channel
FreePBX sends every blind transfer to its global TRANSFER_CONTEXT, from-internal-xfer-dest, which dials the target through a Local channel. A Local channel take...
Cap llama-server's prompt cache below the memory limit, so it stops being OOMKilled
llama-server's host-RAM prompt cache defaults to 8192 MiB (--cache-ram), the container's whole limit, so it grew until the kernel killed ollama: on 2026-09-28 i...
The workstation probe shows its results and ends
Run live against an awake AI workstation, the probe printed the descriptor and then nothing: kubectl debug -i (1.36) returned as soon as it had sent the probe t...
The meet bridge writes the dial status at hangup, so answered calls record it
Once Jigasi answers, Dial never returns (no 'g' option): either side hanging up ends the channel, so the **************** after Dial ran only for calls that wer...
A call joins its room as jigasi@auth.meet.Meet, not anonymously; config changes restart it
Each call joins its room over its own XMPP login. Without ENABLE_AUTH the image makes that login ANONYMOUS on meet.Meet, which Prosody's JWT host refuses ("SASL...
Probe the XMPP session, not /about/health, which a SIP gateway answers 500
Jigasi 1.1.369's Health.check throws "GW not ready." whenever it has a SIP gateway and no HEALTH_CHECK_SIP_URI, registered or not, so the health probes restarte...
Svc_media may subscribe media.feed.* to relay the org feed to the browser
SecurityService and MediaService announce a new post or lead note on media.feed.<orgId>, and the browser's feed (the lead view's notes, the Clubhouse feed) list...
Kamo Meet bridge — Jigasi transport and endpoint, PIN dial-in on 7800, trusted entry for AI members
No user- or caller-typed text enters a dialplan expression: the room checks compare lengths and the AI's display name is filtered before it is tested (a quote i...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.