Booking an appointment no longer fails on an untyped null in the conflict check (SITP TP23 live smoke)
findConflicts' (:excludeId IS NULL OR a.uid <> :excludeId) with a null UUID is an untyped parameter on Postgres/Yugabyte ('could not determine data type of para...
The loan-officer door reaches the MLOS engines, writes take write rights, and an SI clears the MLOS walls (SITP TP21)
New relays on /api/security/mortgage-apps (MortgageLoanDeskController, @RequireRight, the caller's org's loan only): - GET /{uid}/qualification, /{uid}/engine-l...
A booking or registration is always a new record in the caller's practice; SI note drafts say so; billing reads write the PHI trail (SITP TP23)
- SchedulingService.book: the body is the entity, so a uid in it made save() a merge onto that appointment in ANY practice (and moved it into the caller's); s...
The iot.alexa client is named for the KamoUniverse skill; record the applied rename (SP09) [skip ci]
PREPARE_COMMISSION_PAYOUTS composes the draft payout batch, seeded to every finance manager (SITP TP18)
Opening the draft batch and adding, changing or removing its lines now take MANAGE_ORG_FINANCES or PREPARE_COMMISSION_PAYOUTS (the owner always); sending a batc...
Devices is a standard alias
Required like careers and computers: the record is what makes shared device access open anywhere. The kamo-iot share pages are served at devices.<domain>; the l...
Reserve the devices alias, not iot
The kamo-iot share pages are served at devices.<domain> (owner 2026-10-18: "iot" is a technical term; anything customer-facing says devices). OrgAliasPolicy res...
The billing door makes a member a licensee before a seat, and reads usage for the org billing rights (SITP TP18)
BillingService's LicenseService.assign refuses anyone who is not already a licensee of the subscription, so the relay's seat assign alone could not seat a new m...
HR reads a member's leave balances, as it already spends and corrects them (SITP TP18)
GET **************** own on identity (as /me/accruals), anyone else's with MANAGE_TIMECARDS, the right that already gates /use and /adjust on the same balances;...
Subscription records, market lists and order notes reach only the caller's organization (SITP TP17)
SubscriptionService reads a subscription, its order, invoice and agreement by uid alone, in any tenant. POSController now checks the record is the session organ...
Rights-carrying doors to commerce invoices and billing, and the MANAGE_ANALYTICS backfill (SITP TP02)
Commerce invoices: InvoicingService's CommerceInvoiceController checks no right by design (it expects SecurityService to own the session and the rights) and not...
State licences are read and replaced only within the caller's organization (SITP TP16)
GET/PUT **************** found the member by id alone, so a holder of STATE_LICENSING_VIEW_ALL / EDIT_ALL in one organization could read, replace or delete anot...
Rights on the session-only controllers, with the grant backfill (SITP TP01)
@RequireRight (any-of, tenant RoleRightType) enforced by TenantRightInterceptor before the handler, the tenant counterpart of @RequirePlatformRight: no session ...
Rights on the lead doors the SI tools use, and the caller's own callbacks due (SITP TP10)
- PUT /leads/{id} takes EDIT_LEADS; a create that assigns someone else takes ASSIGN_LEADS - the lead pool (/leads/available, /leads/accept) takes VIEW_LEADS or ...
A clinician's direct order never lends an SI the clinical acts
SITP TP00: pins the new SI floor (kamo-shared-library 645068bb) through the No Insubordination delegation: drafting notes, booking and posting payments are lent...
Remove a committed diagnostic log that carries the database password and the password pepper
k8s/diagnose-output.txt (2025-11-03) is a startup log captured with com.zaxxer.hikari at DEBUG. Nothing reads it. Removing it does not clear history; the values...
Report option providers and Account merge keeps tagged devices (SP13)
IoT reports — no god mode, the owner rule, and ReportDefinition.exportRight enforced at download, schedule and every run (SP13)
SecurityService opens Service Work jobs for IoT — endpoints, one-transaction opener, crossapp scan (SP13)
SecurityService resolves the two IoT charter classes (SP11)
The charter catalogue lists 24 action classes (the owner's JOIN_MEETING made 22; IoT SP11 appends OPERATE_DEVICE and OPERATE_SECURITY_DEVICE, both APPROVE_BEFOR...
Purge sweep, OAuth configuration and the repository scan (IoT SP09)
Internal grant revocation for IoTService and platform client administration (IoT SP09)
Token endpoint with PKCE, rotation with a 24-hour grace, reuse detection and RFC 7009 revocation (IoT SP09)
Consent view and single-use decision bound to the sign-in session, pending grants and codes (IoT SP09)
O3 binds a fresh sign-in to the authorization request with an atomically spent one-time key (IoT SP09)
Authorization requests O1/O2 with RFC 6749 redirect rules, PKCE S256 and rate limits (IoT SP09)
Atomic one-time-key spend, request store, rate limits and redirect URLs (IoT SP09)
Reserve the iot alias; pin iot.<domain> resolution
The rebuild carries DomainAliasType.IOT from the shared library. KnownAliases / SSL_PROBE_LABELS follow only after iot.<apex> answers over TLS (a later commit),...
Kamo OAuth authorization server tables and the iot.alexa client (IoT SP09)
Patient-merge hooks run after the merge commits, so a failing hook can neither undo nor poison it
SP12 remote-monitoring endpoints, the portal connect-devices handler and their guards
SP12 enrollment, consent, pause/resume/end/revoke and the connect link
SP12 monitoring reads, the portal link, and home readings kept out of the chart's recent window
SP12 remote-monitoring foundations — write gate, access, audit, IoT client, merge hook
The No Insubordination Rule — a teammate's direct order lends an SI their rights for that run
Owner 2026-10-15, refined the same day: any team member (a person or another SI) who gives an SI a direct order lends it their rights for the work that carries ...
A person may let SI colleagues greet them with the short form on internal calls
SI call disclosure, owner decision 11 (2026-10-15): the colleague short form ("Hi Sage, it's Luna, the automated assistant.") is used only for active staff who ...
Rebuild to pick up kamo-shared-library 2d2f2efd (JOIN_MEETING action class) so admins can save a JOIN_MEETING charter rule
CreateClaim writes charge and units, sets the claim total, refuses a blank payer
The SP01 IoT entities map on Hibernate 6.2.13, the line SecurityService runs
IoT SP01 Task 7 (mapping half). EmbeddedAttributeMapping is not in org.hibernate.metamodel.mapping on 6.2; the test reads the address through EmbeddableValuedMo...
Verify-password records a session re-check marker and limits wrong attempts
IoT SP01 Task 7 (marker half). KREAUTH<***Id> = member id for 3600 s after a correct password; five wrong passwords per session in 15 minutes answer 429 too_man...
Seed the IoT administration rights to CONFIGURE_SYSTEM holders on the boot that introduces them (IoT SP00)
The IoT tour needs no lineage: every Show Tour right is already on for every role (fefd98c2).
Run the sign-in detection rules, and make their responses real
SuspiciousDetectionService was injected into SecurityController and evaluate() was never called, so every rule an organization configured on the Security screen...
Encrypt legacy signing secrets at boot; a refused target URL is a 400
The service side of kamo-shared-library e58f1a93 (target vetting + DNS pinning, failure categories, encrypted signing secrets). - **************** (re-runnable...
Seal Google/Microsoft calendar OAuth tokens at rest; re-seal legacy rows at boot
GoogleCalendarService and MicrosoftOutlookService stored the access and refresh tokens on third_party_integrations as the provider issued them, although the ent...
Branch types and security models are the platform's to edit
Branch types, the security models behind them (default security roles, app availability, home screens, commerce markets, subdomain config) and the master model ...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.