No anonymous write to the session Redis, and no session id in the sign-out log
POST /api/session stored any JSON under any KS= key, with a caller-chosen TTL and no authentication, through a Redis client pair of its own. The session Redis r...
The grids' empty sticky-row strips are no Tab stop on a phone
Chrome makes a scroller with nothing focusable inside a Tab stop of its own; at phone width ag-Grid's sticky-top strip (these grids have no sticky rows) took th...
The filter rail fits the screen with twenty kinds
The rail beside the notification history is sticky on wide screens. With the nine KamoAI kinds it lists up to twenty kinds (848px), taller than the 608px a 1440...
What the screens showed — readable chips and filters, labels clear of units, whole rail tabs, grids a keyboard can use
Found by rendering every SP01 screen at 1280 and 390 px with axe (Task 35): - warning chips (Degraded, Missing, Available, not verified) in amber ink, 5.0:1 - m...
A hot reassign always carries its call note; the note-less menu path is gone
Hot Reassign now makes one call: the note travels in the body of mark-reassignment, where SecurityService writes it and the mark together and refuses the mark w...
Security Models reads and saves real lists; the chat picker's choice is the conversation's
The access-policy BFF passes AIService's answers through unchanged, so a refused save shows its own reason.
No-seat banner's Plans & billing link takes its own line on a phone
At 390 px the Alert action squeezed the button into a three-line column ("PLANS / & / BILLING") beside the sentence. On xs the Alert now wraps and the action ta...
A QUERY key reaches the provider encoded once
ChatAuth.url returns a URI. WebClient reads a String as a URI template and encoded the already-encoded key again (+ became %252B), so any key holding +, /, = or...
A hot reassign's first note creates the lead's stream linked to the lead
The stream is created for the lead, as the lead view's feed creates it, so its MEDIA_SESSION_POST row carries LEAD_ID and POST_CREATED goes to media.feed.lead.<...
A hot reassign requires its call note on the server, not only in the dialog
Pin DaemonService to k3m1, where the earthdata drive lives [skip ci]
k1m1 reaches /mnt/worldchunks only through a hard NFS mount of k3m1. That mount has hung, so the kubelet on k1m1 cannot stat the earthdata hostPath. A rollout t...
Transcribe realtime turns over the pod's own loopback
Speaches 0.9.0-rc.3 posts every realtime turn to /v1/audio/transcriptions. With LOOPBACK_HOST_URL unset it makes that call in-process through httpx's ASGITransp...
The calendar's radios wear the organisation's colour
The Repeat field and the scope dialog bring the calendar its first radios. CalendarThemeScope painted buttons, checkboxes and switches in --color-primary but no...
Delete the second calendar reminder path — EmailService's sweep is the only one
Signature icons reach the recipient as small PNG parts
The signature's social-network icons, contact-line icons and header decorations are percent-encoded SVG data: URIs. extractInlineImages only decodes base64, so ...
Logo-variants runs ffmpeg single-threaded, one logo at a time
The first boot backfill OOM-killed BOTH ConversionService pods (23:04:39 and 23:05:47Z): a 3919x1373 PNG logo and a 4096-wide seeded SVG. ffmpeg gives every fil...
Draw member photos at the variant their size calls for
Every uploaded member photo has _sm (50px), _md (150px) and _lg (350px) beside the original, but surfaces picked them ad hoc: MemberAvatar drew _sm up to 40px (...
Reserve 768M for the OS so --memory 3G fits in the 4Gi pod
Seastar keeps max(1.5 GiB, 7%) of the cgroup limit plus ~94 MiB per shard back for the OS and refuses to start when --memory does not fit in what is left. With ...
Mint a RingCentral webhook verificationToken RingCentral accepts
RingCentral refuses a deliveryMode.verificationToken longer than 32 characters with CMN-101 "Parameter **************** value is invalid" (measured against the ...
A socket's one-time key is not a sign-in hand-off
Since 46191c47 every browser WebSocket authenticates with ?otk=<key>. The EmailService sockets connect through the same-origin /email-ws rewrite, so they pass t...
New mail shows on /messages as soon as the badge counts it
The badge and the list hear the same socket, and EmailService relays every arrival (verified on NATS: email.changed ARRIVED from both pods, then the unread snap...
Present Qdrant's API key, and recreate the consumers so KB and notes are embedded again
Only verified RingCentral webhooks are processed; calling needs a seat
The legacy path that processed a RingCentral call or SMS event with no instanceId, trusting the payload's own to-number, is removed together with its 2026-10-13...
No shared provider key in the seed; every app, AI Workforce included, has a catalog row
Pin kamo-shared-library 1.6.1, the version the library stays at
1bb9801 pinned 1.6.2 together with the library bump in db737a54. That bump is reverted, because about thirty services pin 1.6.1 and each build can only resolve ...
Pin kamo-shared-library 1.6.1, the version the library stays at
39829f6 pinned 1.6.2 together with the library bump in db737a54. That bump is reverted: about thirty other services pin 1.6.1, and CI can only resolve the one v...
Keep kamo-shared-library at 1.6.1, the one version every consumer can resolve
db737a54 moved the library to 1.6.2, and only emailservice and initializerservice moved with it. About thirty other services pin 1.6.1. Their CI clones this rep...
KamoAI internal endpoints never leave the gateway
Carves the seven KamoAI internal subtrees (master spec §7 item 13) out of the wildcard forwards, and with them the server-to-server endpoints that predate the p...
X keeps counting through a sleep, so every resumed computer went straight back to sleep
A member opening their computer got a black tab. The launch was fine, the wake was fine, the resume was fine — and then the machine powered itself off before th...
Signature previews show what the email will actually print
**************** drew the live preview and the Header/Signature thumbnails from data that raced itself. It also disagreed with the composer about what a signatu...
Point loan officers at the card they will actually find — Lender credentials
Both the MeridianLink and the Arive 'officer not linked' refusals named cards that no longer exist under those titles.
The session is navigated to, not framed — a framed one renders black
The launch screen put the session in a full-viewport iframe so the tab would keep the organization's icon and title instead of Guacamole's. It cannot work, and ...
An iPhone photo (HEIC) attaches to a bug report as a JPEG
A HEIC dropped on a bug report was refused with "must be a PNG, JPEG, WebP or GIF image" — the camera-roll format of every iPhone, AirDropped to a Mac as it is....
The password dialog passes the launch copy — main has not built since bf1e3312
bf1e3312 made `openHostedComputer`'s launch copy a required argument, and c224e20f, landing beside it, added a second caller in HostedComputerPasswordHost that ...
A cloud session asks for its task in the terminal
description") unless the account has the interactive cloud backend, which this one does not; given one, it creates the session, prints its task for the cloud se...
An attachment with a Content-ID is still an attachment
A PDF sent from the Gmail app had a paperclip on its list row and no download link in the reading pane. The app stamps every attachment with a Content-ID, and t...
ASCII in finalize.sh's log lines — jibri's logger printed the em dash as ???
Xrdp was told its session backend was itself, so nothing ever rendered
Opening a computer gave a black screen that never became a desktop. The cause is one unanchored sed in this file: sed -i 's/^port=.*/port=3389/' /etc/xrdp/...
A meeting recording no longer passes through heap, and a long one no longer times out
/transcribe read the upload with getBytes() on a 2Gi pod, and a meeting recording runs past a gigabyte. It now copies the spooled upload to the scratch volume a...
Stream the recording, and run the summary after commit — it ran inside the upload
Jibri's upload read the whole recording into heap (file.getBytes()) on the pod that also serves chat; a two-hour meeting is over a gigabyte. It is now streamed ...
Recording had never worked — jicofo never looked for jibri, and jibri never arrived
Four separate faults, each enough on its own to stop every recording: - jicofo had no ENABLE_RECORDING, so the image wrote no `jibri {}` block: it never watc...
Recreate, and probe the XMPP session — a surge left meetings with no focus for 18h
Every jicofo logs in to prosody as the same full JID, focus@auth.meet.Meet/focus. The maxSurge rollout from 9da0998 runs two of them at once, and prosody answer...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.