Record the 2026-10-30 public-IP hand patches so a full reconcile keeps them
coturn, MediaMTX, FreePBX (kamo-meet ACL + fail2ban) and KamoPBX were switched to k1m1's eno1 addresses 76.81.227.154/.155 by hand on 2026-10-30, and dovecot-im...
Only known preview hosts under the wildcard sites.kamouniverse.com zone
*.sites.kamouniverse.com resolves here (wildcard A), and kamouniverse.com is an always-allow apex, so any scanner label or browser-only sibling ****************...
Detach k1m1's NFS mount while k3m1 is not serving it
The worldchunks USB drive dropped off k3m1 on 2026-10-30 and has not come back, so nfs-server stopped. k1m1 kept its soft mount on the assumption the server ret...
Relay for an org domain whose SPF names us
An org that set up SPF correctly was refused by the relay's sender rule, so its NoReply mail fell back to the platform address. EmailService lists those domains...
An alias domain's senders may relay, and drop the dead Mailgun password
EmailService sends over port 25 from mynetworks without signing in, and relay_sender_domains refuses anything but kamocrm.com and kamouniverse.com with a 451. E...
V1.13.10, a room reaper and leak watchdog, metrics and alerts, no roll under live calls
livekit-server v1.13.7 kept 202 closed participants of 176 closed rooms alive (their publisher transport's StreamAllocator polled a closed ICE agent every 15 s,...
ICE on k3m1's LAN address only, so SIP legs stop resuming every 15 s
livekit-sip's same-host WebRTC legs to livekit-server failed ICE 15 s after connecting (the server's 10 s disconnected + 5 s failed timeouts) and resumed in a l...
Write Romanian with comma-below s and t
The model mixes the legacy cedilla forms into Romanian (6 of 90 such letters in the chat widget's regenerated file) and the dictionary's earlier Romanian did to...
Memory limit 14Gi -> 20Gi, request 10Gi -> 12Gi
Seven-day peak working set was 13.8 and 13.1 GiB against the 14Gi limit, so the kernel reclaimed the mmapped argos models and en->ru on a help article paid cold...
Desktop alerts go by e-mail only; the MediaService chat leg is gone
Owner, 2026-10-20 (IoT close-out F12): no chat sender. A chat thread needs a sender member besides the recipient and the platform organization has none by desig...
The deploy-safety audit accepts a reasoned 'spread' exemption for a node-pinned Deployment
Every KlusterServices deploy since run #337 ended red on kamoai-voice (3 replicas pinned to k3m1 by nodeSelector, so no hostname spread is possible). The rule h...
Kamo_app is a NOLOGIN group role; services log in as kamo_app_202610
The YugabyteDB application password was exposed (com.zaxxer.hikari DEBUG in ten services' logs, and securityservice's committed diagnose-output.txt), so it was ...
Never seed devices. anywhere under kamocrm.com
ccd50be skipped the devices sibling only when the parent WAS kamocrm.com, so a child-org web alias host **************** seen live) still queued ***************...
The proxy settings live in HA's storage, promoted, not in YAML
Since 2026.10, Home Assistant migrates a YAML `http:` to its storage once, as a PENDING config. It reverts that config and restarts unless an admin promotes it ...
IOT_EVENTS max-bytes in binary units — nats CLI 0.5 refuses the bare 10737418240 (IoT SP00)
Auto-create standard IMAP folders for every mailbox
Dovecot now subscribes Drafts, Sent, Junk, Trash and Archive on first open with SPECIAL-USE flags so EmailService and the UI see real folders instead of client-...
A help article no longer OOMKills the Tamil engine
KBService sends a help article's Lexical JSON to be translated: one long line with few sentence ends, ~0.46 model tokens a character. A 3,980-character article ...
Rotate the kamo_ops password
The operator password (Secret kamo/redis-ops-auth) reached an agent transcript in KamoAI SP01 Task 38 and had never been rotated (SP98-M-2). It was rotated live...
Nothing in the mail namespace reaches the session store
rspamd now keeps its data in its own Redis, so the platform Redis drops its mail_rspamd user and admits only the kamo namespace; rspamd's ConfigMap drops the ke...
A member's xrdp desktop shows the organization's wallpaper
xfdesktop draws the backdrop stored under the X server's RandR output name. A member works in an xrdp session, whose xorgxrdp server names its output rdp0, but ...
A take-over ends only once its VNC password is sealed
VncAccess cleared the take-over in memory and then wrote the password file. When the write failed, x11vnc kept accepting the take-over password while the agent ...
The platform main line survives a boot, and 8200 is the team line
Luna's go-live (2026-09-28) wrote [kamo-main-luna] into extensions_custom.conf and KAMO_LUNA_EXT / KAMO_LUNA_MAX_RING into globals_custom.conf by hand on the ho...
An AI workstation sleeps with its desktop stopped, and wakes to a fresh one
Measured on a throwaway -ai4 workstation (SP98 Task 16), the wake stalled because Xorg does not survive a resume: with no KMS driver it drives the console throu...
A quiet meeting keeps its AI (media_timeout 20m), again
Reapplies 960331f, reverted in 5d70873 on the wrong suspicion: the RTP loss seen right after that deploy was fail2ban's ban on 47.181.8.84 (fixed in the previou...
Livekit-sip's RTP never takes the router, and its hairpin is never banned
FreePBX names its public address (pbx.k1.kluster.kamocrm.com) in the SDP and the Contact it gives livekit-sip, which is outside local_net, so RTP and in-dialog ...
The heap fits the container, so a meeting is never OOMKilled
The image starts java -Xmx${JIGASI_MAX_MEMORY:-3072m} and the container was limited to 1Gi: the heap could outgrow the container, and Jigasi was OOMKilled mid-m...
Permanent forwards expire from the browser cache after an hour instead of never
From 2026-09-23 to 09-27 the kamouniverse-to-kamocrm redirectRegex 301'd kamouniverse.com to www.kamocrm.com. Traefik sends such a redirect with no Cache-Contro...
The meeting bridge trusts LiveKit from k3m1's node address too
livekit-sip is hostNetwork on k3m1, and k3m1 reaches 192.168.4.22 over its eno50 cable (192.168.4.22 via 10.0.50.0 dev eno50 src 10.0.50.1), so FreePBX sees eve...
An AI workstation goes to sleep with nothing on its desktop drawing
A page still drawing when the sleep image is written made the wake take minutes. SP11 Task 30's workstation slept with Kamo's sign-in page open (a full-screen z...
Never ban k3m1 — its node network joins the fail2ban allowlist
FreePBX runs with hostNetwork on k1m1. A pod on k3m1 reaches it SNATed to k3m1's InternalIP, 10.0.50.1, which none of the [DEFAULT] ignoreip ranges covered (the...
A lone call waits five minutes for company, not thirty seconds
Jigasi hangs up a call that nobody else joins within JIGASI_JVB_TIMEOUT (the image's default 30 s): Jicofo invites a participant only once there are two. An AI ...
Docs trusts api.kamouniverse.com as a WOPI host
A member signed in on internal.kamouniverse.com (the platform's primary apex since 2026-09-28) opens documents with **************** DocsService takes the last ...
Kamouniverse.com refuses unknown recipients at RCPT instead of bouncing them
kamouniverse.com, the platform's primary apex, is an alias domain of kamocrm.com: every <x>@kamouniverse.com is the <x>@kamocrm.com mailbox. It was mapped by a ...
The desktop-ws route reaches only the terminal socket, not every SecurityService path
**************** matched PathPrefix(`/desktop-ws`) on internal.* and stripped the prefix, so **************** reached ANY SecurityService path from the internet...
A caller an AI member transfers rings the person from its own channel
FreePBX sends every blind transfer to its global TRANSFER_CONTEXT, from-internal-xfer-dest, which dials the target through a Local channel. A Local channel take...
Cap llama-server's prompt cache below the memory limit, so it stops being OOMKilled
llama-server's host-RAM prompt cache defaults to 8192 MiB (--cache-ram), the container's whole limit, so it grew until the kernel killed ollama: on 2026-09-28 i...
The workstation probe shows its results and ends
Run live against an awake AI workstation, the probe printed the descriptor and then nothing: kubectl debug -i (1.36) returned as soon as it had sent the probe t...
The meet bridge writes the dial status at hangup, so answered calls record it
Once Jigasi answers, Dial never returns (no 'g' option): either side hanging up ends the channel, so the **************** after Dial ran only for calls that wer...
A call joins its room as jigasi@auth.meet.Meet, not anonymously; config changes restart it
Each call joins its room over its own XMPP login. Without ENABLE_AUTH the image makes that login ANONYMOUS on meet.Meet, which Prosody's JWT host refuses ("SASL...
Probe the XMPP session, not /about/health, which a SIP gateway answers 500
Jigasi 1.1.369's Health.check throws "GW not ready." whenever it has a SIP gateway and no HEALTH_CHECK_SIP_URI, registered or not, so the health probes restarte...
An AI's scroll scrolls Chrome
computer-use-linux 0.7.1 aims a scroll with ydotool, whose absolute move passes through 0,0 (the panel) on its way to the target, and sends the whole scroll as ...
Registry prune waits for CI before garbage-collect
garbage-collect sweeps every blob the tags didn't reference when it marked, so a push that lands mid-sweep keeps its tag and loses its manifest. On 2026-09-28 t...
The load verdict's budget is the amended acceptance bound, 9.0 s
Task 18 A-3 asked for p95 <= 4.0 s with 4 realtime streams and a batch. k3m1's Haswell CPU cannot reach it with faster-whisper-small: with the language given (S...
Measure realtime load as SP13 calls it, and give each transcription 8 threads
The load probe's realtime sessions sent no language, so every turn paid Whisper's language detection (9.4 s alone at 3 threads on k3m1), a call shape no product...
Run llama-server with one thread per core of its CPU limit
Ollama starts llama-server without --threads, so it counted k3m1's 24 physical cores and ran 24 compute threads inside the container's 8-core quota. The contain...
Ydotool's pointer lands where the AI aims it
ydotool 1.0 aims an absolute move by pushing its relative device to 0,0 and then by (x, y), and libinput's default adaptive profile doubled that second push. co...
The gateway may frame its own resize sensor
Guacamole 1.5.5 notices a resize through an <object> that loads its own **************** The gateway's X-Frame-Options: DENY blocked it (ERR_BLOCKED_BY_RESPONSE...
An AI workstation shows its organization's wallpaper
KubeVirt's console runs Xorg's VESA driver (RandR 1.1, no named output), so xfdesktop keys the AI desktop's backdrop by index, monitor0, and never read the moni...
The AI's console X server takes the AI's clicks
LightDM's Xorg on :0, the AI workstation's desktop, adds udev input devices only through an input driver, and the golden image had none. It logged 'No input dri...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.