God-only support topics, the website request ticket and its conversation hook
- Tickets under a god-only topic (SupportTopic.godOnly) are excluded from every support list, count, badge, metric, auto-open and claimable queue unless the v...
A YugabyteDB restart-read while the upload commits is retried, not fatal
Third live finding on the removed-after-hold path: the relay's lookup raced the upload's commit and got 40001 "Restart read required", which aborted the relay. ...
The live chat relay also finds a refused hold's attachment
Found by the live removed-after-hold re-test: findByBlake3AndSize is a dedup lookup and skips is_missing dats, and a refused hold's dat stays missing forever, s...
The live chat relay waits for an attachment whose verdict beat its commit
Found by the live removed-after-hold test (sp00verify): a held EICAR variant was judged ~260 ms before the visitor's upload answered; the hold completer's refus...
ATTACHMENT_SCAN names the attachment the way rows do (imgId + objImgIds)
Completes 27c9644. Found by the live test: message rows carry objImgId = the MediaObjImg link id and imgId = the Img id; the frame sent the Img id under objImgI...
A held chat attachment clears live for every viewer
ConversionService publishes antivirus.content.settled when a held upload is stored or refused. AttachmentScanRelay consumes it in a core queue group (media-anti...
Visitor chat attachments carry scan{}; refusals name the file
The public chat widget's send answer and history rows now carry the same scan {status, family, outcome} the member frames do (verdict as the conversation's orga...
Turn Antivirus scanning on in mediaservice
KamoAntivirus is Ready (StatefulSet kamowsantivirus 2/2, /readyz ready, release 2026.11.08.0101); a direct scan from the cluster returns MALICIOUS/TEST_FILE for...
MediaService checks attachments with Antivirus and refuses locked files on every read
- Chat attachments (member CHAT, web-chat visitor PUBLIC), system-bug files, Growth Hub images are checked inside storeContentAddressed with their context (me...
A refused Zoom Server-to-Server app is explained in plain words on the SI-joins check (SIE10FU)
The live check showed Zoom's raw "ZOOM returned 400: invalid_client" to the admin.
Zoom's Server-to-Server app is entered once; SI joins live in Provider Setup (SIE10FU)
Owner 2026-11-07: meeting providers are configured on Provider Setup; SIE10's separate SI Meeting Joins screen duplicated it. Backend side of folding it in: - Z...
SI meeting-bot apps per org for Zoom, Teams and Google Meet (SIE10)
The org's apps for each provider's approved bot path, so its SIs can join outside meetings as an app instead of by phone: - Zoom: Meeting SDK join signature (HS...
Org and member landing links for tracking codes
GET **************** returns the org's link configuration and the caller's own extra links; PUT /links/org (MANAGE_REFERRAL_CODES) and PUT /links/me (VIEW_REFER...
No client may SEND to /topic/platform/changelog
Live Changes is broadcast to every session; a forged frame would put a change that never happened on every launchpad at once. SecurityService is the only writer...
Pick up the shared library's status follow-ups and lead key lookups (5b273d8e)
A kick takes the SI out by member, not by the participant row's call id (TPENGAGE)
Found in the sanity run (call 7b3aa471): the row named an older call (the SI came back through kamoai-service's own join, which never updates it), so the kick h...
A kicked SI is out for good, the sweep's dials say they are automatic, and the SI's own picture rides to its tile (TPENGAGE)
- DELETE **************** a signed-in person in the meeting kicks an SI out (Prosody never lets anyone kick the SI's Jigasi leg, it is a server admin); REMOVE...
An SI invited to a new table is told, and a sweep retakes any SI turn a frame missed
Live check (sp00verify): a table created with an SI invited published no frame, so the SI never looked and never sat. createTable now raises the turn event, and...
An SI's one wake for a member's invitation reads the names inside a transaction
Live check (sp00verify): the greeting notification failed with a LazyInitializationException walking the inviter's user outside a session, so the SI joined and ...
CheddarLedger names its Spring constructor (the pod CrashLooped: no default constructor)
4b5d777's new pod could not build cheddarLedger: a second (test) constructor left Spring with no single constructor to use. The old pods kept serving. The bean ...
CheddarLedger names the constructor Spring builds it with
Two constructors and no @Autowired: Spring looked for a default one, so every MediaService pod since 4b5d777 failed to start (CrashLoopBackOff; the old pods kep...
The SI's own rights decide who may invite it into a meeting
Owner decision 2026-10-26, in the one shared check (MeetSiInvitePolicy) behind the in-meeting invite, M1, meeting create and the M3 picker: - the SI's superviso...
SIs play Texas Hold'em with members, and every member's Cheddar works again
SITP TPGAMES (owner 2026-10-26). Cheddar wallet: - The wallet's only door (universe-gateway -> universe-persistence) has had no endpoints since the KamoUnive...
Invite an SI from inside the meeting; who may invite an SI is the SI's own option
Kamo Meet "Invite an SI" (owner order 2026-10-26): - GET **************** for a signed-in person IN the meeting (creator, recorded participant, or handed this...
An SI plays a member's game with the member's PLAY_CHESS too (No Insubordination)
A game with a member is always at that member's request (they invited the SI, or told it to invite them), and a team member's direct order runs with the SI's ri...
An SI member plays chess with members, its moves chosen by Kamo's engine
SITP TPGAMES (owner 2026-10-26: an SI asked to play chess did not know how). - ChessSiPlayer: event-driven (ChessTurnEvent after each committed change). A me...
A medical practice's video visit room, created server to server
POST /api/internal/meet/telehealth (X-Internal-Auth = internal.auth.secret, MeetInternalAuth) creates a meeting on the organization's own provider and live doma...
The alert chat leg resolves its people per organization; an IoT alarm update is quiet on iOS
F12 (IoT close-out, SP14 routing): AlertChatService defaulted to organization 1 and the aliases "sage" / "kamo-monitor", which name nobody in production, so eve...
God eligibility alone passes a right only in the platform org; elsewhere only an open window (IoT R7 round 3)
AuthHelper.hasRight / requireRight let GD (god ELIGIBILITY, no window at all) pass EVERY tenant right in every org (24 controllers: reports, social media, acces...
The IoT live-topic check carries the subscriber's session, so god's break-glass window can be honoured (IoT R7)
A god-mode window is a property of the session, not the member, and the STOMP authz calls to iot-service named only the member, so god in another org could not ...
A closed god-mode window is closed here too (shared SessionPlatformFacts reader)
ViewerPlatformFacts (the ENTER AS SYSTEM USER verdict on support tickets) read GD && godModeActive itself. SecurityService masks an elapsed 30-minute break-glas...
The Canva routes take the right of the screen that calls them, not just a session (SITP TP23)
CanvaController checked only that a member was signed in: anyone in the organization could drive its Canva round trip (create, list, export, import, brand templ...
A ticket can be read without joining its conversation (?join=false) (SITP TP15)
GET /api/support/tickets/{id} puts an entitled agent who is not yet in the ticket's conversation into it, as opening the window should. An SI reading the queue ...
Webinar booking checks its rights and the type's organisation; an SI brings SIs into its own meetings (SITP TP12)
Owner decision 5 (security gaps fixed with the tools that use them): - /api/webinar: booking (available types, bookable times, a type's sessions, schedule, join...
?session= pins an attachment read, an edit, an unsend and a reaction to one conversation (SITP TP13)
The Tool Plane checks a run's audience on the conversation an SI names. A message id or an attachment id alone could reach another conversation the SI also belo...
An IoT alarm names its iOS notification category (SP10)
Without aps.category iOS shows the alarm with no Acknowledge or Open buttons: the categoryId data key is only a custom property.
MediaService internal chat-post and chat-target endpoints for IoT (SP13)
Holder-only relay topic /topic/iot/relay/{connectionId} (SP10)
Core NATS iot.relay.{uuid} is relayed verbatim to /topic/iot/relay/{uuid}. The frame is a wake only **************** SUBSCRIBE needs iot-service I-OD1 (GET ****...
IOT_ALARM — exempt from the presence gate and the rate limit (IoT SP10)
An alarm is not seen because a browser tab is open, and every lifecycle step (raised, escalated, acknowledged) shares one collapse key, so the 15 s limit would ...
Share-card endpoint and server-only system events (IoT SP04)
POST **************** IoTService posts the IOT_SHARE card into a members' support ticket or Exec2Exec conversation as the sharer's system event, through the one...
Adding somebody never opens what was already said to them
POST /sessions/{guid}/members always grew the room in place, so a third person added to a two-person chat could read everything the first two had said. It now r...
Website visitors can attach files in Live Support — safe types only
A visitor on a lender's website can now send documents, images, zips and ordinary audio/video to the agent in the Live Support tab, and read back both their own...
An SI's own join (M1) carries the meeting's dial-in, for when it cannot be put straight into the room
2026-10-14: SIs asked to join a meeting told people "there's no dial-in" and asked for another way in. kamoai-service now picks the way in itself: straight into...
Every attachment of stored content records the key it was stored under, via the library
The chat-only StoredContentExtension (299a911) becomes ImageService.storageExtension in the shared library, and the other MediaService paths that attach content...
Network-backed STOMP authorisation, subscription registry and revocation for the IoT topics
IoT SP01 Task 33. k8s/deployment.yaml gains the iot-internal-auth envFrom (after mlos-internal-auth): origin/main did not mount it yet (Step 1 gate fallback).
Iot.live.> to STOMP relay and the static guards for the IoT topics
IoT SP01 Task 32. The IoT SEND refusals sit just above the voicemail comment so that comment stays attached to its own line.
Meeting-provider OAuth state is an opaque one-time Redis token; refresh is locked and committed on its own
state was base64 JSON {orgId, nonce, provider} built by the caller, the nonce was never stored or checked, and the sessionless callback trusted the decoded orgI...
Deleting a public API key needs MANAGE_ACCESS_RULES, like creating one
Any member of an org could delete the org's public chat / integration keys: deleteKey checked only that the key belonged to the caller's org.
An attachment whose bytes were already stored keeps the extension they were stored under
The content-addressed key is <imgDatId>.<ext>, and every reader builds it from the attaching Img's own fileExt. Dedup matches on the bytes, so the same screensh...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.