Live Change Log

GET **************** returns one date-ordered page across notes, calls, voicemails, texts, e-mails and chat; ?channel= narrows it. Three sources are merged. Ca...

The rules were stored, cached to Redis and never consulted. AccessCheckController was the only caller of the evaluation and nothing called AccessCheckController...

The geo section only ever denied: a country was blocked or it was absent. Orgs that want to serve one country had to enumerate every other one, which is unmaint...

An extension with no org line to hang it off is undialable, so the resolver falls back to a number the member actually has rather than publishing nothing.

Email comes from the member's primary mailbox rather than TeamMember.emailWork — that column is free text predating mailbox provisioning and routinely disagrees...

Pairs with the template fix in kamo-shared-library. Per-org template rows are insert-only, so the rows seeded before the markup change still wrap this variable ...

The actor was stripped from every audience, so an approver who raised a request was cut from their own notification about it — and in an organization with a sin...

Dates arrive as ISO strings and parse leniently: a filter the client sends badly should narrow nothing rather than 400 the whole grid. A date-only "to" bound co...

Both blocks come off the same lead, so the controllers fetch it once and derive each from it rather than hitting the service twice per render. Still org-scoped ...

An approver can now hand an opportunity to a different agent. The requester is never rewritten — applyPrimaryAgent records the move as its own history row with ...

The approver now records what the organization pays on the sale to the requesting agent and their group. Omit it on approve and the lead's market default applie...

Org-scoped in both places. On the public page the scope comes from the share link's own organization, so a token can never surface a lead belonging to another t...

market-config now tells the lead view whether to offer a Quotes tab and what wording a new quote starts with, and the market endpoints round-trip both fields. ...

REST surface behind /leads/opportunities/reserved and the Reserve Opportunity control in the lead header, plus the service that owns the invariants. Rights, en...

PhiAuditController.hasRight() bypassed the right check on session GD alone. GD means "may activate god mode"; godModeActive means "has activated it, deliberatel...

phi_access_log has been accumulating evidence nobody looks at. That satisfies §164.312(b) — the trail exists — and satisfies nothing about §164.308(a)(1)(ii)(D)...

The platform's only field mask was **************** applied by LeadController.getLeadById to a caller who is neither god nor the assignee and lacks VIEW_LEAD_CO...

The trail has been written for a while and nothing could read it, which left two obligations unmet: an accounting of disclosures for one individual's record (§1...

Organization.handlesPhi has existed as a column with no way to set it, so PhiTenantGuard has been enforcing a flag nobody could turn on. This is the missing hal...

GET /{uid}/preview returns the same PublicQuoteView the share link serves, from the same QuotePresentation resolution, so a previewed letterhead cannot differ f...

God mode activated silently and lasted as long as the session. That is the control a covered entity's security review pushes hardest on, because "your staff can...

Multi-option quotes cannot be accepted blind — the request now carries the chosen optionUid and the service refuses acceptance without one.

Operator-gated, session-stamped org+member, fail-closed ownership (no cross-org existence oracle). New endpoints baselined in the unauthenticated-endpoint ratch...

god-eligible, org server-stamped GET relays: **************** **************** MlosDocOrchestration **************** (fail-closed org filter, drops non-owned pa...

MlosCatalogController/Client gain promote-bulletin, mirroring promote-guideline (god-eligible gate, org server-stamped). Baselined promoteBulletin in the unguar...

Three things, all from trying to answer "why not just fix the context test?". 1. **************** declared `kamo:` TWICE and therefore did not parse at all ...

This service has @ComponentScan("com.kamo") but an EXPLICIT @EnableJpaRepositories list. The moment a bean here needs a repository outside that list, the reposi...

The §164.312(b) trail was going to Slf4jPhiAccessLogWriter: 14-day platform retention against a six-year obligation, and nothing that can be queried. The lead r...

KAMO_MFA_SECRET_KEY maps to kamo.mfa.secret-key by Spring's relaxed binding, and is what MfaEnrollmentService uses to encrypt stored TOTP secrets at rest. With...

Flaky customer authoritative servers (seen: migo.host for rodaris.md) intermittently answer SERVFAIL on healthy zones, which /setup/dns rendered as a red 'DNS l...

A bare `new RestTemplate()` has no connect or read timeout. When the *** service became unreachable today, every login thread blocked on this call indefinitely ...

MlosCatalogController/Client gain promote-guideline, mirroring promote- eligibility: god-eligible gate, organizationId server-stamped via write().

kamo-shared-library dropped @Service from MfaEnrollmentService so that ~40 services stop constructing an authentication component they do not use — that stereot...

Completing the register wizard's email verification (6-digit code or email link) already proves inbox possession, yet the new user was bounced to the login page...

@EnableJpaRepositories here is an EXPLICIT package list, not a wildcard. com.kamo.z.shared.mfa.repos was missing from it, so UserMfaEnrollmentRepository and Mfa...

Completes MFA. The core landed in kamo-shared-library; this is the wire that turns stored configuration into an actual gate. The gate is small because login al...

**************** gain promote-eligibility, mirroring promote-adjustments: god-eligible gate, organizationId server-stamped via write(), downstream 4xx relayed v...

ResourceServerConfig is anyRequest().permitAll() and @EnableMethodSecurity appears nowhere in this service, so every @PreAuthorize is inert and public is the de...

HIPAA §164.312(b) for SecurityService. The platform records every lead CHANGE (LeadHistory) and every login (SystemAccessLog) and records no READ at all, so "wh...

Staff endpoints at /api/security/commerce/quotes and an unauthenticated resolver at /api/security/public/quotes. QuoteController extends BaseLosController rath...

Every failure mode in this feature is silent. A latched circuit breaker, a worker queue discarding every task, a provider that started returning HTML — each loo...

**************** gain promote-adjustments, mirroring the promote-rate-sheet relay: god-eligible gate, organizationId server-stamped onto the payload via write()...

The settings endpoint required MANAGE_EMAIL_AVATAR_SETTINGS and nothing else, so it shipped dormant: a brand-new right is held by nobody until an admin assigns ...

Staged and committed as-is so nothing is left uncommitted in the working tree. 2 files changed, 435 insertions(+)

dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...

Resolves a correspondent's email address to a picture, working outward from what Kamo already knows: member photo, then a photo someone attached to a contact, t...

Two call sites of featureService.enableFeature now understand the HIPAA boundary: - /enable maps PhiModuleNotPermittedException to 403 carrying the reason, m...

The handler was `public void **************** Long id)` — no HttpServletRequest parameter at all, calling straight through to a bare deleteById. With ResourceSe...

PUT and DELETE on /api/security/job-titles/{id} and /api/security/departments/{id} resolved no session at all — they read a UUID off the path and called straigh...

Avatar object paths were prefixed with the domain of whatever host the request arrived on (getPublicBucketName → kamocrm-com, optionone-com, cluster-local, …), ...