Save answers before the rights fan-out, not after it
Saving a security model (e.g. its Default Security Roles) re-seeded and recalculated member rights for every org using the model before it responded. A model sh...
Email the accept-window audience when a new lead sits unclaimed for two minutes
LeadAvailableEmailSweep (every 15 s, singleton lease) finds leads that entered the pool 2-15 minutes ago and are still unclaimed, per org via ix_leads_org_creat...
The profile save stores the member's address
The My Profile Address card posted { address, addressDetails, locality, subdivision, postalCode, country } and PUT /members/{id} never read the key, so every sa...
Every Show Tour right is on by default — for every role, every branch-type template, and everyone already here
The first release seeded each tour only to roles already holding a right in its app and left every branch-type template at Not Specified: 2,416 role rows held n...
The guided-tours read answers the member's CURRENT Show Tour rights
A session carries the rights it was issued with and the routine refresh does not re-read them, so everyone signed in before the Show Tour rights existed saw no ...
The boot-time rights sync inserts a role's missing rights in ONE statement
b8014ab3's deploy never became ready. The 31 Show Tour rights made the row-at-a-time insert loop 31 YugabyteDB round trips per role — ~3.5 s a role, ~490 s acro...
Remember guided-tour steps per person across organizations, and seed every Show Tour right
GET /api/security/guided-tours answers which tour steps the signed-in PERSON has been shown or skipped, as the union over every membership of the same user — a ...
/api/security/cameras/** — the KamoCameras relay (merge feat/kamo-cameras)
CameraController is the trust boundary for KamoCameraService: it resolves the session, checks VIEW_CAMERAS / MANAGE_CAMERAS / MANAGE_CAMERA_SITES (now 334-336; ...
/api/security/cameras relay to KamoCameraService with rights, org stamping and org-chart facts
Retiring an SI takes the admin's choice for its workstation — Delete now, Delete after N days, or Keep
Owner decision 2026-10-11. POST /members/{id}/ai/retire accepts {workstation: KEEP|DELETE_NOW|DELETE_AFTER, deleteAfterDays: 1-365, default 7}; no body or no wo...
An SI's charter read is retried on a YugabyteDB conflict instead of answering 503
GET **************** (I1) resolves the charter in one read-only transaction of 15-25 queries. One "Restart read required" (40001) answered 503 CHARTER_UNAVAILAB...
The member card reads the communication policy on every channel that binds the viewer — CHAT for a person, CHAT, calls, mail and meetings for an SI, grant-aware, with approvalRequired (KamoCollab CP04 Task 18)
ChatPolicyBeanConfig builds the loader with each rule's channels and the three-argument, grant-aware ChatPolicyService (cached graph for approvers), as MediaSer...
The disclosure ledger export — a CSV recorded as EXPORT before it is built (KamoCollab CP08 T8)
GET **************** takes the list's filters and answers the newest 10,000 events as disclosure-ledger.csv (every field quoted, UTC instants, recipients and so...
I2 resolves a draft of one of a member's layers, the ledger's daily counts per SI, and the disclosure settings hook to kamoai-service (KamoCollab CP15 T4)
- I2 draftLayer {level, id}: only with an existing MEMBER subject and draftItems; the draft is validated for the layer's level (department ancestors for DEPAR...
The disclosure ledger read API — list, stats, source and member endpoints, with the supervisor path (KamoCollab CP08 T7)
DisclosureLedgerController at /api/security/disclosures: GET (list), /stats (event counts per decision plus reads.WOULD_WITHHOLD, R1-19), /source/{kind}/{id} (c...
The DDL file for the metric indexes, with its contract test (KamoCollab CP14 T2)
Three per-organization date indexes for the SI business metrics (spec §5.1, D20): commerce_orders, commerce_quotes and accounts on (org_id, date_created). Hand-...
The disclosure ledger query service — keyset pages on one index per filter, the member union, labels and counts (KamoCollab CP08 T6)
DisclosureLedgerQueryService reads org_disclosure_events and its two child tables over NamedParameterJdbcTemplate. Each entry point builds one driving statement...
The cross-table charter DDL guard pins item_origin on all six owner tables (KamoCollab CP10 Task 3, R1-4)
Red until shared-lib's CharterItem maps item_origin (CP10 Task 3), green with it and the CP10 Task 1 DDL file. Test-only; push after the shared-lib commit.
Declare the disclosure ledger recorder, with its repository scan (KamoCollab CP08 T5)
DisclosureLedgerConfig declares the shared DisclosureRecorder as bean disclosureLedgerRecorder: the name disclosureRecorder is the EHR's §164.528 @Component, an...
The S3 draft test builds CharterController with the affected-members service main added (KamoCollab CP03 T15)
Who a layer save reaches — CharterLayerLoader.layerRefs and GET **************** (KamoCollab CP09 Task 5)
The non-retired SI team members of the caller's org whose charters are built from the layer (ORG, ROLE, DEPARTMENT, JOB_TITLE, TEAM or MEMBER), ordered by displ...
The item_origin DDL on the six charter owner tables, with its contract test (KamoCollab CP10 Task 1)
Records who drafted a charter item (NULL = a person, AI_DRAFT = the SI configure assistant). Hand-applied by CP10 Task 2, before shared-lib CP10 Task 3 is pushe...
Recipient preferences, GET|PUT **************** and POST **************** (KamoCollab CP12 Task 11)
How a person wants SI colleagues to reach them (spec §5.5, D36): a JDBC store over member_collab_preferences and member_collab_channel_order (keyed reads, at mo...
The catalogue pins the disclosure engine's RELEASE_INFORMATION action class, twenty-one in all (KamoCollab CP03 T17)
The external field view of a lead, ?fieldAudience=EXTERNAL (KamoCollab CP07 Task 9)
LeadFieldMask.applyExternal keeps exactly spec §5.18's fields, reduces the assignee to name and title, and nulls every other LeadDTO field through a fail-closed...
The ORG charter endpoints — GET /api/security/org/charter for any org session (items, counts, editable with CONFIGURE_SYSTEM) and PUT with CONFIGURE_SYSTEM, a full replace by id in OrgCharterWriter's one transaction, announced to the org's SI members (KamoCollab CP03 T16)
Org disclosure settings, GET and PUT **************** (KamoCollab CP05 Task 13)
Spec §5.5, D6: reads by CONFIGURE_SYSTEM, MANAGE_ACCESS_RULES, VIEW_ACCESS_LOGS or MANAGE_AI_WORKFORCE (or an open god window); edits by CONFIGURE_SYSTEM or a g...
The catalogue pins CP04's SEND_INTERNAL_MESSAGE action class, twenty in all (KamoCollab CP03 T14)
The DDL for org disclosure settings and the two lead communication label indexes (KamoCollab CP05 T1)
org_disclosure_settings (eight columns, a missing row means the defaults, AUDIT by default) and ix_leadcomm_org_source / ix_leadcomm_org_email_thread, which the...
The DDL for the three append-only disclosure ledger tables (KamoCollab CP08 T1)
The hand-applied DDL of spec §5.1: org_disclosure_events, its recipients and sources, seven org-and-time indexes, and a closing REVOKE that takes UPDATE, DELETE...
Manual imports and the intake backlog through the shared mapping engine
LeadImportController maps every row with kamo-shared-library's LeadRequestMapper instead of its own switch, so manual and template imports get the full field se...
The lead page names its Vendor and Product
Lead.vendorProduct is @Transient — only VENDOR_PRODUCT_ID is a column — so nothing loads it unless someone asks, and LeadDTO.fromLead then leaves vendorProduct,...
A change to a member's teams is on the security access log — one SECURITY_SETTING_CHANGE/MEDIUM row per member who joined or left, from the team, the member's profile, a deleted team or creation (KamoCollab CP01 final review I1)
A team is a level of the rights waterfall, so joining one is a grant (CP01-T14-1). The department and job-title change on the same Position card writes an acces...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.