God-only support topics, the website request ticket and its conversation hook
- Tickets under a god-only topic (SupportTopic.godOnly) are excluded from every support list, count, badge, metric, auto-open and claimable queue unless the v...
A held chat attachment clears live for every viewer
ConversionService publishes antivirus.content.settled when a held upload is stored or refused. AttachmentScanRelay consumes it in a core queue group (media-anti...
Visitor chat attachments carry scan{}; refusals name the file
The public chat widget's send answer and history rows now carry the same scan {status, family, outcome} the member frames do (verdict as the conversation's orga...
Turn Antivirus scanning on in mediaservice
KamoAntivirus is Ready (StatefulSet kamowsantivirus 2/2, /readyz ready, release 2026.11.08.0101); a direct scan from the cluster returns MALICIOUS/TEST_FILE for...
MediaService checks attachments with Antivirus and refuses locked files on every read
- Chat attachments (member CHAT, web-chat visitor PUBLIC), system-bug files, Growth Hub images are checked inside storeContentAddressed with their context (me...
SI meeting-bot apps per org for Zoom, Teams and Google Meet (SIE10)
The org's apps for each provider's approved bot path, so its SIs can join outside meetings as an app instead of by phone: - Zoom: Meeting SDK join signature (HS...
Org and member landing links for tracking codes
GET **************** returns the org's link configuration and the caller's own extra links; PUT /links/org (MANAGE_REFERRAL_CODES) and PUT /links/me (VIEW_REFER...
No client may SEND to /topic/platform/changelog
Live Changes is broadcast to every session; a forged frame would put a change that never happened on every launchpad at once. SecurityService is the only writer...
A kicked SI is out for good, the sweep's dials say they are automatic, and the SI's own picture rides to its tile (TPENGAGE)
- DELETE **************** a signed-in person in the meeting kicks an SI out (Prosody never lets anyone kick the SI's Jigasi leg, it is a server admin); REMOVE...
The SI's own rights decide who may invite it into a meeting
Owner decision 2026-10-26, in the one shared check (MeetSiInvitePolicy) behind the in-meeting invite, M1, meeting create and the M3 picker: - the SI's superviso...
SIs play Texas Hold'em with members, and every member's Cheddar works again
SITP TPGAMES (owner 2026-10-26). Cheddar wallet: - The wallet's only door (universe-gateway -> universe-persistence) has had no endpoints since the KamoUnive...
Invite an SI from inside the meeting; who may invite an SI is the SI's own option
Kamo Meet "Invite an SI" (owner order 2026-10-26): - GET **************** for a signed-in person IN the meeting (creator, recorded participant, or handed this...
An SI member plays chess with members, its moves chosen by Kamo's engine
SITP TPGAMES (owner 2026-10-26: an SI asked to play chess did not know how). - ChessSiPlayer: event-driven (ChessTurnEvent after each committed change). A me...
A medical practice's video visit room, created server to server
POST /api/internal/meet/telehealth (X-Internal-Auth = internal.auth.secret, MeetInternalAuth) creates a meeting on the organization's own provider and live doma...
The IoT live-topic check carries the subscriber's session, so god's break-glass window can be honoured (IoT R7)
A god-mode window is a property of the session, not the member, and the STOMP authz calls to iot-service named only the member, so god in another org could not ...
A ticket can be read without joining its conversation (?join=false) (SITP TP15)
GET /api/support/tickets/{id} puts an entitled agent who is not yet in the ticket's conversation into it, as opening the window should. An SI reading the queue ...
?session= pins an attachment read, an edit, an unsend and a reaction to one conversation (SITP TP13)
The Tool Plane checks a run's audience on the conversation an SI names. A message id or an attachment id alone could reach another conversation the SI also belo...
An IoT alarm names its iOS notification category (SP10)
Without aps.category iOS shows the alarm with no Acknowledge or Open buttons: the categoryId data key is only a custom property.
MediaService internal chat-post and chat-target endpoints for IoT (SP13)
Holder-only relay topic /topic/iot/relay/{connectionId} (SP10)
Core NATS iot.relay.{uuid} is relayed verbatim to /topic/iot/relay/{uuid}. The frame is a wake only **************** SUBSCRIBE needs iot-service I-OD1 (GET ****...
IOT_ALARM — exempt from the presence gate and the rate limit (IoT SP10)
An alarm is not seen because a browser tab is open, and every lifecycle step (raised, escalated, acknowledged) shares one collapse key, so the 15 s limit would ...
Share-card endpoint and server-only system events (IoT SP04)
POST **************** IoTService posts the IOT_SHARE card into a members' support ticket or Exec2Exec conversation as the sharer's system event, through the one...
Website visitors can attach files in Live Support — safe types only
A visitor on a lender's website can now send documents, images, zips and ordinary audio/video to the agent in the Live Support tab, and read back both their own...
An SI's own join (M1) carries the meeting's dial-in, for when it cannot be put straight into the room
2026-10-14: SIs asked to join a meeting told people "there's no dial-in" and asked for another way in. kamoai-service now picks the way in itself: straight into...
Network-backed STOMP authorisation, subscription registry and revocation for the IoT topics
IoT SP01 Task 33. k8s/deployment.yaml gains the iot-internal-auth envFrom (after mlos-internal-auth): origin/main did not mount it yet (Step 1 gate fallback).
Iot.live.> to STOMP relay and the static guards for the IoT topics
IoT SP01 Task 32. The IoT SEND refusals sit just above the voicemail comment so that comment stays attached to its own line.
Security's MANAGE_ACCESS_RULES also administers the communication policy
The owner placed the communication policy "also under Security" so an organization without the Chat app can configure it. MANAGE_CHAT_SETTINGS is a Chat-app rig...
A person asks their manager to open a chat the communication policy holds for approval, and an approval opens a 30-day contact grant (KamoCollab CP04 T14)
Session endpoints POST|GET **************** GET …/{id}, POST …/{id}/decision; the administrator's GET **************** (MANAGE_CHAT_SETTINGS). CONTACT_REQUESTED...
Declare the disclosure ledger recorder, paired with its repository scan (KamoCollab CP08 Task 12)
DisclosureLedgerConfig declares DisclosureRecorder; MediaServiceApplication's @EnableJpaRepositories gains **************** in the same commit. DisclosureLedger...
REQUIRES_APPROVAL needs a CONTACT grant, an SI may answer the person who wrote first, overrides are recorded only when they lift a refusal, and AUDIT no longer blocks attachments (KamoCollab CP04 T13)
The chat chokepoints now ask the grant-aware communication policy. A REQUIRES_APPROVAL rule refuses find-or-create and send until a live CONTACT grant links the...
The CP05 DDL file — Confidential markers on chats and meetings, forwarded-message provenance (KamoCollab CP05 T3)
The internal DM path goes through chat policy and the AI turn guard, and every chat line says who wrote it (KamoCollab CP00 T7)
POST **************** now requires source MEMBER or SYSTEM (else 400 SOURCE_REQUIRED). A MEMBER line is checked by chat policy as a member's own send (open-then...
MediaService caches the org graph, reads chat policy facts from it, and the managed tracking scope is the whole subtree (KamoCollab CP02 T17)
MediaService declares the org graph loader and its 60 s cache, and a listener on security.orggraph.changed.* that evicts the graph and then the chat policy snap...
The DDL for media_objs.source, who wrote a chat line (KamoCollab CP00 T1)
A nullable VARCHAR(16) column, re-runnable, with no CHECK and no backfill; NULL reads as MEMBER. Hand-applied by CP00 Task 3. **************** keeps the file ad...
A lender's website contact form files a ticket in their own queue
POST /api/media/public-chat/contact, reached through the gateway's site-key gate like every other public-chat call, so the key names the org and its allowed ori...
Meeting-provider connects send the api.kamouniverse.com redirect
The owner added **************** to the platform Microsoft app and kept the api.kamocrm.com one. Both hosts serve the path, so a connect started under either co...
Relay media.feed.<orgId> to /topic/media/feed/<orgId>, guarded by org
A new post or lead note is announced on media.feed.<orgId>, and kamo-internal's MediaStream (a lead's Notes, the Clubhouse feed) listens on /topic/media/feed/<o...
AI members join meetings — invite, auto-join at start, runtime state, companion context
Meeting history, meeting detail with dial-in and transcripts, inviteable AI members
M3 GET /api/meet/ai-candidates, M4 GET /api/meet/meetings, M5 GET /api/meet/meetings/{id} (spec §4.4.1). Every answer is application/json; a page never splits m...
Recording transcripts and summaries persisted, routed through the org's AI services with provenance
Encrypted meeting transcripts and summaries, companion upload, downloads, retention
M6-M9 answer JSON whatever the client accepts and ignore unknown body fields (MediaService's bare ObjectMapper fails on them); M6 is NOT_READY while a transcrip...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.