The vendor and product questions move off the field's border
A member reported "Description" on Create New Vendor (Settings → Client Relations Manager → Vendors & Products) with the field's border running through it: an M...
Keep the migration difficulty an enum in every locale
/alternatives/<competitor> labels the migration difficulty with **************** The collections extractor shipped `difficulty` to the dictionary as prose, so e...
A scanner probe no longer spends the catalogue rate limit
A dotted path (/info2.php, /.env) skips the locale middleware and reaches [locale]/page.tsx as locale "info2.php". The layout 404s it, but the page renders besi...
Hexhead side corners are no longer cut off
The hexagon's side points sit on the 0-100 viewBox edge while its flat top and bottom have 6.7 units to spare, so the clipping SVG shaved half the outline and t...
The keys tip on the tour card always shows in full
The "Tip: use the arrow keys to move" line shared the button row with Back and the primary button. A long label such as "Next tour: Service Work" left it no roo...
Patient-merge hooks run after the merge commits, so a failing hook can neither undo nor poison it
"list…", "show…", "give me…" and "pull up…" are orders too, and a run with no order says why in the log
Live check in sp00verify (2026-10-15): a peer's "Nell, list the open tasks assigned to you and tell me how many there are." verified as their request (author, a...
The do-not-contact screens read clearly to everyone — "Call anyway" and the history's Removed chips in the error colour (warning failed contrast), spinners named, the removal sentence names the channel as written
Follows 35421d4d. Found by the component-harness screenshots and axe (color-contrast on the warning-coloured text button and chip; aria-progressbar-name on the ...
A team member's call to a number on the do-not-contact list reads as who asked not to be called, and since when
kamoai-service 8b7b8d5 added the organization's do-not-contact list for calls (K6 409 DO_NOT_CONTACT), and a team member's call now carries the day the number w...
An uncited wake stands for an outside call only when its words ask for a call
The run's own wake (RequestVerifier.inferFromRun) is the request for a call to a colleague, but someone outside the org is rung on a teammate's name, with no co...
Phone_call calls whoever a team member named, looked up by name, with no approval and no consent gate, and never anyone else
Owner 2026-10-15: "When a supervisor, or any team member for that matter, tells SI to call someone else on the team, they should call them. No questions asked, ...
An edit that changes nothing cannot be saved
Opening an event and pressing Save without touching anything rewrote it — and, for a meeting with guests, could ask whether to tell them about a change that did...
Adding somebody never opens what was already said to them
POST /sessions/{guid}/members always grew the room in place, so a third person added to a two-person chat could read everything the first two had said. It now r...
An add the server moved to another chat opens in its own window
Adding somebody to a conversation that already has messages no longer grows that room (MediaService now moves the add to the chat for the new set of people). Op...
Seat the organization's existing staff when it starts paying
Turning PAID seated only the buyer; everyone else hit "This needs a licensed seat" on the product just bought until the owner assigned seats by hand. On the tra...
Seat an organization's existing staff when its subscription is set up
A comp, like a first purchase, created its seats UNASSIGNED and seated the owner alone. Everyone else waited for the owner to hand seats out in Billing, which n...
A member's mail carries the name on their member profile
9351aac named a nameless From with the mailbox row's display_name first, and kept any name the request sent. The composer sends that same row name, and rows can...
A member's mail goes out under their name, not a bare address
The From header carried a name only when the request did, and the composer sends the mailbox's display_name: set for an SI's mailbox when it is made, blank on a...
Meetings_join is JOIN_MEETING, not PLACE_CALL, and an unnamed JOIN_MEETING does not ask
Owner 2026-10-14: Luna (crm) asked the owner to approve joining a meeting he had told her to join; meetings_join was classed PLACE_CALL, so the charter's "Placi...
Picking a non-default alias domain From no longer fails the send
Every alias-domain row in the From picker is the member's primary mailbox under another domain, but only the default one was mapped to a primary From. Any other...
An alias-domain From row names the mailbox behind it
The From picker offers the member's primary mailbox again on each org alias domain, with an id like <mailbox>:alias-domain:<domain> to keep it unique in the lis...
Mirror the honest default Live Support welcome
Matches kamo-shared-library a82f3c78: the team is notified only once the visitor sends a message, so the default no longer says someone will be with them shortl...
The default Live Support welcome no longer promises someone 'shortly'
Nobody on the team is notified until the visitor sends their first message, so the default now says that: send a message to reach the team, they're notified whe...
Send the chosen From even when it is the primary row
The default org alias domain (kamouniverse.com) is offered in the From picker as the member's primary, and the composer left any primary From off the request. W...
CreateClaim writes charge and units, sets the claim total, refuses a blank payer
Meetings_join is "Join a meeting", not a phone call, and a meeting's link is joined as the room it names
Owner, 2026-10-14: SIs asked to join a meeting answered that they could not "join by phone" because "there's no dial-in", and asked for a room with dial-in enab...
An SI acts on the request its run was woken by without having to cite it, and K3 hears the tool's rights so a colleague who may do it themselves can direct it
Owner 2026-10-14: Luna (crm) asked the owner to approve joining the meeting he had just told her to join. Evidence: run 47cc1908 (NEW_CHAT, woken by his message...
SubscribeQueueBatch binds a WorkQueue stream with DeliverPolicy.All
IOT_EVENTS is a WorkQueue stream (IoT SP00-D6) and NATS refuses any other deliver policy there (10101), so iot-service crashlooped at boot. The policy is read f...
A resume whose bytes are already stored records the key they were stored under
Same rule as the other content-addressed attach paths (shared library abaec95b): fileExt is part of the storage key, so a resume already held under another name...
Every attachment of stored content records the key it was stored under, via the library
The chat-only StoredContentExtension (299a911) becomes ImageService.storageExtension in the shared library, and the other MediaService paths that attach content...
An Img keeps the extension its content is stored under — on dedup and on rename
fileExt is part of the storage key (<imgDatId>.<ext>) every reader builds, but dedup matches on the BYTES. Content already held arriving under another name (a ....
The lit Settings row follows the page's own tab
The rail lit the row the member last clicked, so switching tabs inside a settings page (Docs -> General from the page's tab strip) left the light on the old row...
An SI that sends a note with no level the internal default back changes nothing
CP97 Task 17's Luna compare found a live SI's own My Master Note, written before KamoCollab, carrying sensitivity MEMBER after one of her own appends in an AUDI...
An AUDIT org's SI is shown the record-link kinds every SI saw before KamoCollab
CP97 Task 17's Luna compare found her tools/list changed by KamoCollab: CP05 Task 7 appended TASK, DOCUMENT, KB_ARTICLE, MEMBER, AI_RUN and SMS_THREAD to Record...
Reopening a field shows the settings just saved
The stack's sorted field list was memoized on each field's id and order only, so a change from Save Field (Display on Intake, title, required…) never rebuilt it...
IOT_EVENTS max-bytes in binary units — nats CLI 0.5 refuses the bare 10737418240 (IoT SP00)
Run the sign-in detection rules, and make their responses real
SuspiciousDetectionService was injected into SecurityController and evaluate() was never called, so every rule an organization configured on the Security screen...
Encrypt legacy signing secrets at boot; a refused target URL is a 400
The service side of kamo-shared-library e58f1a93 (target vetting + DNS pinning, failure categories, encrypted signing secrets). - **************** (re-runnable...
GD alone no longer grants every right on proxy routes
ksemHasRight treated GD (god-mode ELIGIBILITY) as an all-rights bypass, so every god-eligible operator held every right on the 18 proxy routes that use it, with...
Seal Google/Microsoft calendar OAuth tokens at rest; re-seal legacy rows at boot
GoogleCalendarService and MicrosoftOutlookService stored the access and refresh tokens on third_party_integrations as the provider issued them, although the ent...
Seal member VoIP credentials at rest with PlatformSecretCipher; re-seal legacy rows at boot
**************** held each member's access token, refresh token (Teams, RingCentral OAuth) and RingCentral JWT assertion exactly as the provider issued them. Ev...
Never relay a browser-set X-God-Mode-Active
God mode is SERVER-owned. The billing and LOS proxies copied the browser's X-God-Mode-Active onto the upstream call, and BillingService treated it plus users.is...
God mode comes from the caller's own session window, never a header
BillingService took X-God-Mode-Active plus users.is_god as god mode, and kamo-internal copied that header straight off the browser, so a god-eligible operator h...
Meeting-provider OAuth state is an opaque one-time Redis token; refresh is locked and committed on its own
state was base64 JSON {orgId, nonce, provider} built by the caller, the nonce was never stored or checked, and the sessionless callback trusted the decoded orgI...
Vet and pin every webhook target, return only failure categories, encrypt signing secrets
The outbound webhook worker POSTed to whatever URL a subscriber stored, from inside the cluster, with no egress control - a subscription aimed at **************...
/api/voip/webhook answers a form post 415 and a non-JSON body 400, never a silent 200
A form-encoded post (Twilio, Sinch, Vonage pointed at the wrong address) fell into readTree(), failed, and was answered 200, so the carrier never retried and th...
No literal internal-auth secret fallback — a blank public-chat secret answers 503
Seven @Value sites and application.yml fell back to the literal dev-secret-change-in-prod when **************** was missing, so a pod without its Secret sent a ...
Read the bulk-export and exchange-document sweeps instead of reporting 0
OrgObjectStorageSweep writes BULK_EXPORTS and EXCHANGE_DOCUMENTS rows into object_storage_days, but OrgStorageAggregator only read that table for BRANDING and D...
Deleting a public API key needs MANAGE_ACCESS_RULES, like creating one
Any member of an org could delete the org's public chat / integration keys: deleteKey checked only that the key belonged to the caller's org.
Save answers before the rights fan-out, not after it
Saving a security model (e.g. its Default Security Roles) re-seeded and recalculated member rights for every org using the model before it responded. A model sh...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.