Live Change Log

Four separate faults, each enough on its own to stop every recording: - jicofo had no ENABLE_RECORDING, so the image wrote no `jibri {}` block: it never watc...

Every jicofo logs in to prosody as the same full JID, focus@auth.meet.Meet/focus. The maxSurge rollout from 9da0998 runs two of them at once, and prosody answer...

A computer provisioned, came up, and panicked on its next boot: Run /init as init process Failed to execute /init (error -2) Kernel panic - not syn...

A brand new computer provisioned, came up, reported AWAKE, and ninety seconds later panicked: Kernel panic - not syncing: No working init found. I caused ...

The 15 places a hook opens a STOMP/SockJS connection to MediaService (media.<domain>/ws) or EmailService (via the /email-ws rewrite) put the raw 128-char *** se...

Same change as mediaservice: kamo-internal is moving the *** session id out of browser JavaScript, off sessionStorage and off every WebSocket URL (`?***=<128-he...

kamo-internal is moving the *** session id out of browser JavaScript: it currently sits in sessionStorage and rides every WebSocket URL as `?***=<128-hex id>`, ...

kamo-internal 3e3c3e7a mounts **************** (SESSION_HANDLE_SECRET), which seals the per-tab session handles that replace the *** id in page script. Created ...

/api/validate is where a tab first learns its session, and it returned the 128-hex *** id for the page to keep in sessionStorage — readable by any script runnin...

/api/login, /api/login/mfa and /api/session/select planted *** with httpOnly:false ("client- accessible for session checks") — but no browser code on login.* or...

*** was set readable (httpOnly:false) and several responses handed the raw session id to the browser. Page script cannot use a cookie's HttpOnly flag if an endp...

Thirty seconds after the first real resume, from the machine's own log: kamo-hc-agent: idle 13202s >= 1800s — going to sleep PM: hibernation: hibernati...

5de57705 added OrgDomain.dkimPrivateKey — the key that signs a domain's transactional mail — with a comment saying it is never sent to the browser, but nothing ...

recordCreated wrote the CREATED row and then diffed the new lead against an empty snapshot, so every non-null starting field became a FIELD_CHANGED row — and th...

The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...

The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...

The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...

The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...

The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...

The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...

The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...

The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...

The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...

The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...

The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...

The address a work email is pointed at is whatever the user account holds. That can be a work address an administrator set, not only a personal one. The panel n...

d7ff5ed called the address on the user account "personal" everywhere: in the 409's message, the response field and the class. It is not always personal. An admi...

Forgot-password resets go to the address on the user account, usually a personal one, but members type the work address their organization gave them. SecuritySe...

Members open their account with a personal address (gmail, yahoo) and are later given a work address by their organization, which is the one they remember and t...

www.kamouniverse.com was served by the kamocrm.com marketing app instead of redirecting: kamo-marketing-route's HostRegexp(\`^www[.].+\$\`) at priority 24 match...

platform.mail.domain now defaults to kamouniverse.com (config value, no code default change) and gates every unverified-domain org's transactional fallback From...

Adds kamouniverse.com to postfix's virtual_alias_domains with a local-part-preserving regexp so any address on it lands in the identical kamocrm.com mailbox (no...

DNS for the apex and www now point at k1m1's public IP. Add a redirectRegex route on both entrypoints (301, path/query preserved, ACME challenge path excluded o...

813d175 moved the library to 1.6.1, and CI installs only the library's HEAD, so the 1.6.0 pin no longer resolves and 6084db9's image build failed. emailservice ...

rdp_sessions() collected every Xorg process with a display argument. The image installs lightdm and lightdm-gtk-greeter, so lightdm runs its own Xorg on :0 on e...

Campaign 8781b848 ended with 667 bounces and 1,258 failures. Three gaps in the existing eligibility engine let them through: - DomainMailCheck asked A and AAAA...

resume_configured() checked that `resume=` and `resume_offset=` were present on the running kernel's command line. Present, not correct — and the difference is ...

The first computer reported its idle time as 13.9, then 29.2, then 14.4 seconds over three minutes while nobody was touching it. That is not a person — it is a ...

Any product with a published application can be set as the org's primary (single-active, mirroring the existing MLOS-default toggle). Publishing an org's first ...

With the restart landing, the first computer came up with resumeConfigured true and stopped on the next precondition — which turns out to be unsatisfiable by co...

Renders the org's primary application at "/" instead of only at /loan/mortgage/{productId}: resolves the org from the request Host (same by-host lookup the bran...

PUT **************** designates (or clears) a product's published application as the org's primary, mirroring the existing mlos-default single-active toggle. Ne...

LeadVendorProduct gains isPrimaryApplication: at most one published application per org is "primary" and is the one kamo-apps renders at the root of the org's a...

The states dimension of the campaign audience panel's and drip trigger's lead filter showed nothing checked by default, even though an unset list already means ...

The first real Hosted Computer reached AWAKE and then stayed awake forever. Hibernation reported resumeConfigured: false, IdleWatcher only arms when readiness i...

Two new steps after the existing SPF one, written for a non-technical owner the same way SpfCard already is — plain language, a "why this matters" box, and neve...

**************** reads marketIds/vendorIds/ vendorProductIds/states as one comma-separated param each (splitList()), but campaignAudienceApi's appendLeadFilter(...

Once SecurityService confirms a domain's DKIM record is published (org_domains.dkim_verified), password resets, invitations and other transactional letters sent...

WAKE_TIMEOUT_MS was 180_000 and sat exactly on top of the VM's readiness probe, whose initialDelaySeconds was 180 and which KubeVirt renders as 190. A computer ...

Adds two endpoints alongside the existing SPF one, so an org's transactional mail (password resets, invitations, notifications) can carry a DKIM signature and t...