Announce a settled hold on core NATS (antivirus.content.settled)
When a held upload is stored after its check, or judged harmful, publish {blake3, sha3_256, size, imgDatIds, result, org, verdict{status,family}} so MediaServic...
Baseline scan of content stored before Antivirus; refusals name the file; flat scan fields
- AntivirusBaselineService: pages img_dats (is_missing=false, no verdict) NEWEST first, streams each object from MinIO to KamoAntivirus and records the verdic...
Turn Antivirus scanning on in conversionservice
KamoAntivirus is Ready (StatefulSet kamowsantivirus 2/2, /readyz ready, release 2026.11.08.0101); a direct scan from the cluster returns MALICIOUS/TEST_FILE for...
ConversionService checks uploads with Antivirus, completes held files, re-checks on new signatures
Replaces the in-service clamd client (malware/ package, UploadScanGuard, QuarantineStore, retro-scan) with the shared-library Antivirus: - /upload, /replace, /...
Convert iPhone HEIC photos to PDF, and turn phone photos upright
Every HEIC a member uploaded failed: convert-to-pdf only treated png/jpg/tiff/bmp/gif as images, so a .heic fell through to Docs, which cannot open HEIF and ans...
A trunk leg's heard side is our member, not the other party
When the only one-party files come from the trunk leg (a caller coming in), its rx is the caller and its tx is what the caller heard: us. Name that side after t...
Whole calls, timed turns with speakers, and a backfill
Owner report 2026-11-06: transcripts "do not reflect the entirety of the call recordings", and separate channels should say who is speaking. Measured on 180 pl...
God eligibility alone passes CONFIGURE_SYSTEM only in the platform org; elsewhere only an open window (IoT R7 round 3)
**************** let GD (eligibility, no window) pass every tenant right in every org, so the System User held CONFIGURE_SYSTEM (organization sounds) in every t...
A closed god-mode window is closed here too (shared SessionPlatformFacts reader)
**************** read GD && godModeActive itself. SecurityService masks an elapsed 30-minute break-glass window only for its own gates, so this service, reading...
A blank internal secret answers 503 on /transcribe too
/transcribe answered 403 when **************** is not configured; master §7 item 13 asks 503 of every internal endpoint, which its sibling /transcribe/detailed ...
Silence is never sent to the speech service, and no chunk reaches 30 s
Kamo Speech (Speaches) answers 500 'No clip timestamps found' for a chunk of 30 s or more in which its VAD finds no speech (faster-whisper's no-VAD path refuses...
Rebuild on the shared library that routes voip.recording.received
ConversionService still ran a kamo-shared-library older than 9e9357c9, whose NatsMessageService pinned every publish to CHAT_MESSAGES. Its voip.recording.receiv...
Claim a staged recording before processing it, so a long call is never stored twice
DaemonService hands ConversionService every row that is still unprocessed: on its poll tick, on every voip.recording.received message (which does not wait for a...
Detailed transcription — timed segments, speakers, language and model provenance
POST **************** (SP14 spec §4.4.3) answers a recording as timed segments with the language and the provider and model that heard it, for MediaService's pe...
Every recording is transcribed through AIService, per org — Kamo Speech replaces whisper-asr
Transcribe a chunk through AIService's internal façade, routed per org
/image/preview cuts a chat photo into one 480px WebP
A chat image attachment is drawn at most 240x240 CSS px and every viewer downloaded the original to do it — a phone photo is 3-8 MB. MediaService will store one...
Logo-variants runs ffmpeg single-threaded, one logo at a time
The first boot backfill OOM-killed BOTH ConversionService pods (23:04:39 and 23:05:47Z): a 3919x1373 PNG logo and a 4096-wide seeded SVG. ffmpeg gives every fil...
/image/logo-variants cuts a logo into pre-sized PNG + WebP rungs
Org logos are uploaded once and drawn everywhere at 24-120px, and every surface downloaded the original: crm's logo-full.png is 2.2 MB (its .svg stand-in 2.95 M...
A meeting recording no longer passes through heap, and a long one no longer times out
/transcribe read the upload with getBytes() on a 2Gi pod, and a meeting recording runs past a gigabyte. It now copies the spooled upload to the scratch volume a...
Pin kamo-shared-library 1.6.1, the only version that exists
The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...
Only the platform namespaces can call ConversionService
The public route is gone (28ba91b), but inside the cluster any pod could still reach this service, and several endpoints take no credential because none of its ...
ConversionService is no longer published to the internet
The conversion-api.kamocrm.com IngressRoute sent anyone on the internet to this service, where several endpoints (/image/resize-bg, /favicon/generate, /convert-...
Auth on the endpoints that can take it now, ffmpeg/Batik hardening on the rest
ResourceServerConfig permits every request (this service is reachable anonymously at conversion-api.kamocrm.com), and none of ImageOpsController's or Conversion...
Internal-auth secret comparisons are constant-time and fail closed
TranscriptionController, RecordingIngestController and RecordingProcessController all compared X-Internal-Auth with String.equals (a timing oracle on a shared s...
Audio — a waveform thumbnail at upload, and peaks and transcripts on demand
An uploaded audio file fell through to the Docs PDF path, which cannot open one, so every audio upload ended "Conversion failed" with a blank library tile. Audi...
No live credentials in application.yml defaults
The local-development defaults carried the database OWNER's password (${DB_PASSWORD:<literal>}), and apiservice/securityservice also the live changelog webhook ...
Release idle Hikari connections now that YSQL pooling is shared
The connection manager no longer pins sessions **************** so idle app connections no longer each hold a database backend. Keep the pool maximum, but stop ...
Accept OCI image indexes when resolving the built digest [skip ci]
The images are pushed as OCI image indexes, so asking the registry for a single image manifest only answered 404, the digest came back empty and the check faile...
Restart when a same-commit rebuild leaves pods on the old digest [skip ci]
The rollout step tried to detect a same-commit rebuild by comparing the Deployment's image reference before and after `set image`. "Apply manifests" has already...
Upload a new version of a document
The one way to change a file the document editor cannot open - a PDF above all, which is what most templates are. POST **************** takes the new file, scan...
Assert the contract the service actually has
**************** asserted that an image already inside the box comes back byte-identical to what went in. It has been failing since afee6fd in July, and the cod...
Stop an indexed source turning the tab icon into a black box
A tab icon uploaded as a transparent PNG-8 arrived in the browser tab as a black square with a ragged logo on it. Measured on the upload that exposed it: of the...
Prove the deploy by digest, not by tag
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Run two pods
replicas 1 -> 2. This service runs no @Scheduled work and binds no exclusive NATS durable, so a second pod duplicates nothing — it is stateless request serving,...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Resize an image by height, keeping its format and transparency
Backs the email signature footer badges, which are downscaled to 150px tall on upload. resize-bg could not be reused. It exists to make a wallpaper cheap to sh...
Rebuild against the storage dedup fix
Picks up kamo-shared-library d21e01ce. uploadDocument created its ImgDat with isMissing=false BEFORE sending the bytes, and its @Transactional did not roll back...
Pin kamo-shared-library 1.6.0
The library moved to 1.6.0 while every consumer stayed on 1.5.0. Consumer CI builds the library from a fresh clone into a cold ~/.m2 and ci-settings.xml mirrors...
Gate platform uploads on MANAGE_PLATFORM_SOUNDS, not org ownership
An operator granted "Manage Platform Sounds" on the Platform Administrators page saw the Sounds tab — the console gates on the right — opened the upload dialog,...
Uploading a file takes CREATE_DOCUMENTS, like every other way of making one
The document rights are enforced in DocsService as of this change, but the upload endpoints are not in DocsService — kamo-internal's app/api/imaging/upload prox...
Transcode uploaded sound effects to Opus
Extends the ffmpeg wrapper the VoIP recording pipeline already had — this image installs ffmpeg with libopus for it, so putting a second ffmpeg in another image...
Raise the document upload ceiling from 500MB to 3 GiB
Chat attachments have run at 3 GiB through this same imaging pipeline for a while; documents were capped at 500MB. The difference was not a policy, it was that ...
Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Reading a session no longer renews it
The expiration on the Redis record IS the session; when it lapses the member is signed out. This service holds its own copy of KSessionService against that SHAR...
Rebuild against shared-library @Lob LONGVARCHAR fix
Hibernate's PostgreSQL dialect read @Lob String columns as OIDs via getLong(). Affects notes, contacts, calendar, OAuth tokens, IMAP passwords, email campaign b...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.