Commerce_request_rental names the renter's account
SecurityService now refuses a rental request without a customer account (every rental has a renter), so the tool takes a required accountUid and passes it on. T...
Read the address bar's text.content, and pass a shell secret in run_shell's env map (TPVAULT phase 2, live)
Live on a test SI's workstation the address bar's text sat 372 characters after its name; read the node's own content first so a longer states list can't push i...
A floor duty's own bookkeeping asks no approval
A supervised SI asked a person to approve its briefing, which would mean an approval per email in triage. These writes are the duty the org set up; si_briefing_...
The on-behalf log flags patient information only for patient-record tools
Live: every notifications read was flagged as patient information (notifications_list is phiSensitive in general). The member-facing flag now follows the tool's...
Wake-up list carries ids, cancel one by id, never ask for a confirmation (TPWAKEUP)
Owner live test 2026-10-28: the SI asked him to approve before removing a duplicate wake-up. The tools say anyone may list and cancel for any number with no con...
Today:true answers only today's figures
Live (sp00verify 07:58Z): with today:true the answer carried receivedToday 0 beside the all-time total 12, and the SI reported 12. A today answer now holds rece...
Cancelling its own outside-meeting join is the SI's bookkeeping, no approval (TPEXTMEET)
Found live in sp00verify: a teammate's "cancel that join" went to the owner for approval (UPDATE_RECORD). Also passes whenInInvitationZone through. Goldens rege...
A signed-in supervisor's meeting request is their order even when terse ("Nell email Cole, supervisor test")
TPMEETAUTH live (sp00verify call 8daf1817): the supervisor's line was attributed SOLE / SUPERVISOR from their own stream, but DirectOrder did not read "Nell ema...
A weak citation never hides the member's confirmation (order and approval stand-in)
Live 2026-10-27 (sp00verify, approval bc7dfe20): after KC Vera confirmed, the SI cited the unproven email it was asked in; that soft-refused and replaced both t...
A member's confirmation in Kamo is the request an outside send carries (no approval for what their rights allow)
Live 2026-10-27 (sp00verify, request db6fff36): KC Vera confirmed in Kamo and the run ran on her order, yet mail to an outside address still went to the SI's su...
Every notification kind decided (BILLING_INVOICE not offered to SIs); ClockPack names its Spring constructor
NotificationsPackTest and KnowledgeAndPeoplePacksTest were red on main since shared-lib added BILLING_INVOICE. ClockPack keeps its test constructor; the one Spr...
Declare every right a tool's service enforces; plain words for unseen records and numbers
Approval follow-up 2026-10-21 (controller review of the approvals UI). Rights (item 4): an audit of every tool's declared rights against the rights its downstr...
An approval card sends every parameter its phrase names
next-intl refuses an ICU select or plural with no value, so a phrase about an argument the SI left out (a contact with no formatted name, a new document categor...
An approval about a record the reader may not see never leaves a dangling 'for'
Phrases that named a patient, a customer, a purchaser, an envelope or a document after a preposition now say 'for a patient' (or nothing) when the reader may no...
Approval cards say SI in every label, write phone numbers and choices as people do, and keep a note beside an action a field
A humanised field name said 'Ai companion…' (now SI, with a guard that no phrase, label, noun or risk sentence says AI); a US number reads (512) 555-0142 in the...
Mlos_update_section keeps what the call does not give (SITP TP21 live smoke)
The loan, property, declarations, military and row saves replace their whole section in SecurityService, so a partial edit would have cleared the fields it left...
A loan record's dateUpdated is a UTC instant too (SITP TP22 live smoke)
The live smoke answered loans_get_state_rule and loans_history with dateCreated as a UTC instant and dateUpdated as KamoLOS's offset-less text; both are now ins...
Reports_save_view does not answer empty settings for a view it just saved (SITP TP16 live smoke)
SecurityService answers a save without the view's stored request (the list carries it), so the tool said parameters {} for a view saved with parameters. A view ...
A scheduled report reaches a colleague who signs in on another domain (SITP TP16 live smoke)
reports_schedule judged a colleague by the organization's mail domains alone, so in sp00verify the owner's own sign-in address was refused as an outsider. A rec...
Binders_create sends what CreateBinderRequest reads; scripts_create names a market by its leads_list_markets id (SITP TP14 live smoke)
DocsService refused every binders_create: CreateBinderRequest's primitive isTemplate binds as "template", so the body's isTemplate was an unknown field (400). A...
Chat_send_file posts a text document DocsService typed octet-stream as text/plain (SITP TP13)
DocsService records Markdown, YAML, logs and other text without an ImageMimeType as application/octet-stream, which chat's attachment allow-list refuses. A docu...
Lead callbacks take MANAGE_LEAD_CALLBACKS, as SecurityService now does (SITP TP10, after TP01)
Files_upload sends the type and digests ConversionService checks (SITP TP13)
ConversionService detects a file's type from its bytes and name and refuses a declared type that differs, then compares the client's Blake3 and SHA3-256 digests...
Files_upload files into My Docs by its ordinal (SITP TP13)
ConversionService refuses an upload whose metadata names no assocType (values()[assocType]), and its own no-metadata default (4) is MEET_RECORDING's ordinal. fi...
Stop logging the database password at startup
com.zaxxer.hikari at DEBUG makes HikariConfig print its whole configuration on every start, including dataSourceProperties {password=...} and password......; Pr...
"list…", "show…", "give me…" and "pull up…" are orders too, and a run with no order says why in the log
Live check in sp00verify (2026-10-15): a peer's "Nell, list the open tasks assigned to you and tell me how many there are." verified as their request (author, a...
A team member's call to a number on the do-not-contact list reads as who asked not to be called, and since when
kamoai-service 8b7b8d5 added the organization's do-not-contact list for calls (K6 409 DO_NOT_CONTACT), and a team member's call now carries the day the number w...
An uncited wake stands for an outside call only when its words ask for a call
The run's own wake (RequestVerifier.inferFromRun) is the request for a call to a colleague, but someone outside the org is rung on a teammate's name, with no co...
Phone_call calls whoever a team member named, looked up by name, with no approval and no consent gate, and never anyone else
Owner 2026-10-15: "When a supervisor, or any team member for that matter, tells SI to call someone else on the team, they should call them. No questions asked, ...
Meetings_join is JOIN_MEETING, not PLACE_CALL, and an unnamed JOIN_MEETING does not ask
Owner 2026-10-14: Luna (crm) asked the owner to approve joining a meeting he had told her to join; meetings_join was classed PLACE_CALL, so the charter's "Placi...
Meetings_join is "Join a meeting", not a phone call, and a meeting's link is joined as the room it names
Owner, 2026-10-14: SIs asked to join a meeting answered that they could not "join by phone" because "there's no dial-in", and asked for a room with dial-in enab...
An SI acts on the request its run was woken by without having to cite it, and K3 hears the tool's rights so a colleague who may do it themselves can direct it
Owner 2026-10-14: Luna (crm) asked the owner to approve joining the meeting he had just told her to join. Evidence: run 47cc1908 (NEW_CHAT, woken by his message...
An AUDIT org's SI is shown the record-link kinds every SI saw before KamoCollab
CP97 Task 17's Luna compare found her tools/list changed by KamoCollab: CP05 Task 7 appended TASK, DOCUMENT, KB_ARTICLE, MEMBER, AI_RUN and SMS_THREAD to Record...
Stamp a communication-policy refusal of a tool with no intent COLLAB_DENY interaction:<ruleId>
An SI's chat_find_or_create_dm refused by the interaction policy answered COLLAB_DENIED INTERACTION_POLICY but left its audit row's policy_decision and policy_r...
An AUDIT hit of the communication policy is written once, as the call runs — not also when the charter asks a person first, and not for a decoderd approval (KamoCollab CP04 Task 31)
Found live in sp00verify: an SI's internal email under an AUDIT DENY rule, behind a charter approval (autonomy ceiling 1), wrote two chat_policy_event rows for ...
An SI's key, text or click aimed at an app reaches the window it is working in (SP97 T9)
The bridge sends a call that names only an app (app_id, wm_class or pid) to that app's first window, focusing it first. After a take-over, Kamo's old window sit...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.