SecurityService may consume BILLING_EVENTS (marketing sites follow billing.subscription.*)
Apply marketing/ from deploy-services like every other folder
A "Deploy Marketing Sites namespace" step runs marketing/apply.sh (namespace kamomarketing, marketing-ci and site-edge RBAC, Middlewares, secrets created-if-mis...
A prepared hand-off can start in a marketing site's checkout, with a WEB-<n> folder
~/Kamo/Marketing/<repo> on first use, through sage's own credential store), cwd (absolute, bounded to the home after resolving links) and workPrefix (BUG defaul...
Namespace kamomarketing for org marketing sites
- marketing/: namespace, SA marketing-ci (Role limited to kamomarketing, long-lived token), SA site-edge (IngressRoutes only), the edge's middleware chain wit...
Svc_site_edge login (subscribe marketing.site.changed); SecurityService may publish it
The marketing sites edge (kamomarketing/site-edge) refreshes its routing table when SecurityService announces a site change. Subscribe-only, publishes nothing; ...
MediaService may hear antivirus.content.settled (held chat attachments clear live)
ConversionService publishes a core event when a held upload's check finishes; MediaService consumes it in a core queue group and fans the new attachment state o...
DocsService may hear antivirus.hold.verdict (core queue, held legal uploads)
A requested-document upload held while Antivirus was busy is finished by DocsService the moment its hold is judged. Core subscription only: DocsService keeps Je...
Public MLOS vendor webhook routes on the platform API hosts (owner-approved)
POST-only, full-path regexes on api.kamouniverse.com / api.kamocrm.com, straight to their services: **************** -> kamomlosvendor-service and *************...
Svc_commission login (publish compliance.event.>), DocsService may hear compliance events
Compliance Requirements (2026-11-07): CommissionService announces commission.credited and **************** on core NATS; DocsService subscribes to compliance.ev...
KamoAntivirus mail filter first on inbound smtpd (port 25), tempfail when unreachable
smtpd_milters = { **************** default_action=tempfail }, then rspamd unchanged. Harmful attachments are replaced by a small placeholder part and the messag...
Antivirus alerts (scanner down, signatures stale, mirror gate failing, p95, detection spike, hold backlog)
Applied by hand (monitoring/ is not a CI target).
Svc_antivirus login + ANTIVIRUS stream; conversion/email may consume antivirus.>
- svc_antivirus: STREAM.INFO/CREATE ANTIVIRUS, publish antivirus.> and rt.org.>, subscribe antivirus.> and _INBOX.> (Secret kamo/nats-user-antivirus, SECRETS....
Let DocsService reach ocrservice for the legal SI pre-check
Legal & Compliance reads uploaded documents with Kamo OCR to give reviewers suggestions (organizations with the SI app on only). Adds the kamowsdocs pod label t...
SI infrastructure alerts, and LiveKit alerts page the SI on-call people (SIE1)
**************** (applied by hand, restarts nothing): a blackbox Probe of jicofo, prosody, the meeting ear, FreePBX's console, the Tool Plane, aiservice and kam...
Let SecurityService read Forgejo's CI statuses for Live Changes
The Live Changes deployment tracker asks Forgejo (a host process on k1m1, port 3000) where each push is in its pipeline. avatar-resolver-egress allowed only Yug...
Rke2-unwedge, a watchdog for the rke2 log-pipe deadlock
The 2026-09-28 and 2026-10-25 platform outages were the same deadlock: rke2 loses its lease, its ExecStopPost kills containerd, nobody reads the container log F...
Alert on node link drops and speed fallback, routed to sysadmin email
The LAN switch shared by k1m1 eno49 and k3m1 eno49 has been resetting since 2026-10-29 (hundreds of carrier drops, 66 of 70 drop minutes shared by both nodes, k...
Live sales floor events reach open screens
svc_voip and svc_daemon may publish rt.org.>, so a call the phone system reports and a lead a job creates reach the board at once. New svc_automation login, cor...
Postfix learns alias domains from the mail database
An organization's alias domains (Settings -> Email -> Domains) used to need virtual_alias_domains and a hand-written map edited here. EmailService now keeps an ...
Every meeting occupant's identity is its own verified session's (mod_kamo_presence_identity)
TPMEETAUTH (owner order 2026-10-26): the SI's ear reads who each endpoint is from its presence identity. The stock presence_identity strips a client's own <iden...
One translation engine for every pair, MADLAD-400-3B on CPU
Replaces LibreTranslate (Argos), Bergamot and Kamo IndicTrans, whose language sets did not overlap and whose gaps came back as English. MADLAD-400-3B-MT (Apache...
Svc_iot may subscribe to iot.live.device.> — the IoT production canary watches its own live frame (SP14)
A Home Assistant lab instance at home.kamouniverse.com
One Home Assistant 2026.10.2 (digest-pinned) for IoT testing of Kamo's HOME_ASSISTANT connector and for the owner's own use under the HA account sajon. The demo...
The share host is devices.<domain>, and nothing on kamocrm.com
Owner 2026-10-18: "iot" is a technical term, so the customer-facing host alias for kamo-iot is `devices`, and kamocrm.com is a marketing site only. auto-cert do...
Iot.relay.> — svc_iot publishes, svc_media subscribes (IoT SP10)
The Google Home relay wakes the phone that holds a connection's lease: IoTService publishes a content-free frame on iot.relay.{connectionId} and MediaService fo...
Google Trust Services issues the platform login host's certificate (IoT SP09)
Amazon's account linking refuses Let's Encrypt, so login.kamouniverse.com alone moves to a gts-prod ClusterIssuer (ACME with External Account Binding); every ot...
Google Trust Services issues the platform login host's certificate (IoT SP09)
Amazon's account linking refuses Let's Encrypt, so login.kamouniverse.com alone moves to a gts-prod ClusterIssuer (ACME with External Account Binding); every ot...
Pre-issue iot.<apex> certificates, PDB kamowebiot, availability probe
iot joins BROWSER_ONLY_ALIASES and STATIC_DOMAINS on both platform apexes so the first share recipient never meets a missing certificate; monitoring/ is applied...
Postfix takes the name mail.kamouniverse.com once it resolves here
kamouniverse.com is the platform's sending domain, but the server still introduced itself as mail.kamocrm.com in its EHLO, Received headers and bounces. Postfix...
Scrape kamowsiot-service on /actuator/prometheus
IoT SP01 Task 34: the kamo-actuator job keeps kamowsiot-service beside kamowssecurity-service, so the four IoT alerts (iot-service's own PrometheusRule) have da...
Api.* carve-out for vendor hooks and the Alexa relay with a webhook-sized limit; IoT secrets documented (IoT SP00)
Default-deny egress for kamowsiot and its disruption budget (IoT SP00)
NATS login svc_iot, svc_media iot.live.> grant, IOT_EVENTS work queue (IoT SP00)
Svc_camera, KamoCameraService's own login
Publishes rt.org.> (the Cameras screens' live refresh) and cameras.site.> (a site RPC routed to the pod holding that site's connector socket), subscribes camera...
Org-graph listeners may subscribe to the org-graph change subject
KamoCollab CP02 Task 6A (master R1-23, CP-D75). SecurityService publishes **************** after every org-graph write; each service that caches the org graph e...
The outbound gate refuses a number the toll-fraud guards block (SP93 T9)
[kamo-outbound-gate] gains a GotoIf on kamo-asterisk-support's managed [kamo-toll-fraud-blocked] list, between the SP13 AI-transfer line and the Goto onward, an...
Rspamd keeps its data in its own Redis
local.d/redis.conf is now the redis-own.conf key: rspamd-redis in mail, database 0, the same mail_rspamd login. The subPath change rolls the pod. The old key st...
A Redis of rspamd's own
rspamd parses untrusted mail and logs in to the platform Redis, beside every member's session, and no ACL can keep it from them there: a user cannot be scoped t...
An English-to-Tamil engine, so Tamil stops being English
LibreTranslate lists no Tamil and Bergamot serves German only, so every en->ta request (the dictionary sync, Help Center articles, chat) matched no provider and...
Auto-cert pre-issues analytics, desktop and myloan on kamouniverse.com
- STATIC_DOMAINS gains analytics.kamouniverse.com, desktop.kamouniverse.com and myloan.kamouniverse.com, twins of kamocrm.com hosts that are reached only th...
Serve desktop.kamouniverse.com, and bounce a bare computers.kamouniverse.com to its login
desktop.kamouniverse.com had DNS but no route, so it answered Traefik's 404 behind the default certificate. It now serves KamoDesktop through desktop-https-kamo...
Svc_media may subscribe media.feed.* to relay the org feed to the browser
SecurityService and MediaService announce a new post or lead note on media.feed.<orgId>, and the browser's feed (the lead view's notes, the Clubhouse feed) list...
Kamo Meet bridge — Jigasi transport and endpoint, PIN dial-in on 7800, trusted entry for AI members
No user- or caller-typed text enters a dialplan expression: the room checks compare lengths and the AI's display name is filtered before it is tested (a quote i...
A workstation probe that never prints the MCP token
SP11's acceptance read an AI workstation's descriptor and probed its MCP bridge by hand, and one diagnostic line printed a live bearer token into a session tran...
Dev.kamouniverse.com forwards to www
The site is live on www.kamouniverse.com, so its pre-launch host stops serving it and 301s to https://www.kamouniverse.com with path and query kept, so existing...
Bring www.kamouniverse.com live; apex goes through kamo-nowww
KamoUniverse is now the primary marketing site. www.kamouniverse.com stops 301ing to www.kamocrm.com and is served by the kamouniverse-marketing app (its own In...
Certificates for every platform host on kamouniverse.com
login.kamouniverse.com and register.kamouniverse.com become the platform's KamoUniverse sign-in and sign-up doors, and from them a visitor reaches theme., capch...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.