Stop the mailbox pointer from failing startup platform-wide
DepartmentService is a @Service, and every service carries @ComponentScan("com.kamo"), so all ~40 of them construct it. Giving it a MailboxRepository therefore ...
The five envelope-lifecycle email templates that were never written
An e-signature envelope had exactly two templates: the invite and the step-up code. Nothing existed for anything that happens AFTER a signer signs — which is wh...
Let a department and an org point at one of their mailboxes
A department's contact email was free text, so it could name an address the org does not own -- two of the three departments with one set today do exactly that....
A manager, and a directory search that survives a big org
TeamMember gains an optional self-reference for who it reports to. columnDefinition is pinned to INT8 so Hibernate cannot copy Member.ID's DEFAULT unique_rowid(...
Let a department sit under a parent department
Departments were a flat list, so an org chart with Operations > Customer Success > Onboarding had no way to say so. Department gains an optional self-referencin...
Stamp AccountAddress dates so an address can actually be saved
DATE_CREATED is NOT NULL with a DEFAULT now(), but nothing ever set the field. Hibernate names every insertable column in its INSERT, so it sent an explicit NUL...
Make the atomic claims actually atomic, and stop starving the oldest payout
An adversarial review of the money path found the concurrency design was not running at all. @Modifying without @Transactional. Spring Data opens no transactio...
Find a member's commission splits for their own commissions view
Org-scoped rather than keyed on the member alone: ORG_ID is duplicated onto this table so a row can never be read cross-tenant by id, and a finder that ignored ...
Team-member commission ledger and Stripe payout domain
Adds com.kamo.z.shared.commission: an append-only signed ledger, a per-member balance row that exists purely to serialize concurrent withdrawals, the Commission...
Stop HTML-escaping the package title in the four HR subjects
EmailTemplateService renders a template's SUBJECT and BODY from ONE variable map, and all four canonical HR subjects carry {{packageTitle}} — which LegalNotific...
Four canonical HR legal-package templates
hr.package_assigned, hr.package_reminder, hr.package_voided and hr.package_completed, as {json,html} pairs plus four CANONICAL_KEYS entries. The CONSTANT is no...
Let a caller own the realtime announcement of the message it is still building
createMessage announced every new message on the session's realtime subject the moment the row was saved — inside the caller's transaction, before the caller ha...
One security right per Human Resources tab
The /hr tabs were gated on whichever pre-existing HR right happened to be an OR-term in the front end: Attendance opened on VIEW_SCHEDULES, Training on VIEW_EMP...
Expose the content-addressed store so chat attachments can dedup
Chat attachments never went through the hashing pipeline — they wrote a private "<imgId>/<fileName>" object per upload, so the same file attached three times oc...
Store every image in one bucket so dedup means one copy
Association is metadata, not a storage boundary. Each ImageAssocType used to name its own MinIO bucket, which contradicted the hashing pipeline: dedup is scoped...
Copy a deduplicated document's objects into its own association bucket
Object storage is bucket-per-association (every reader resolves img.getAssocId().getBucket()), but deduplication is scoped ORG-wide or GLOBALly and so crosses a...
Let sync progress and domain state be announced instead of polled
Two hooks for the push conversion in SecurityService, where several platform screens refreshed on timers because there was no way to tell them anything. Retail...
Make the audience FKs and the attested wording actually hold
Five defects from the whole-branch review, all in the evidence path. The audience FKs did not cascade. cascade = CascadeType.DETACH is a persistence-context ca...
Record package attestation as append-only evidence
The package-level 'I have read and agree' is a different legal instrument from the E-SIGN consent to transact and from any per-document signature, and it is the...
Add per-member assignments and per-document progress
The document row is the join that makes N e-sign envelopes read as one package. The badge count comes off the assignment status, not e-sign status: recipient st...
Freeze package content into immutable versions
Pins the ImgDat blob id and its SHA-256, not just imgId — a Docs save repoints the same Img at new bytes, so imgId alone would let two members sign different do...
Target a package at departments, job types or named members
Shaped on SystemUserAccess. Adds the audience resolver to TeamMemberRepo, which was an empty interface; the ACTIVE + recordState predicate is what keeps termina...
Add the legal package template entities
A package is an ordered set of binders plus an audience. Binder references are soft ids because binders are user-deletable and cascade their items. The attestat...
Narrow binder visibility to one document collection
Replaces findVisibleToMember with a scoped variant and drops the two unreferenced finders that sorted by the dead date_updated column.
Give a binder the document collection it belongs to
Binders had no assoc scoping, so every DocManager rendered the same global per-member pool and a binder built under Marketing could be filled with HR documents....
Map the metadata array columns as Java arrays, not List
Both entities declared their array columns as List<T> under an explicit @JdbcTypeCode(SqlTypes.ARRAY). On Hibernate 6.2.13 that combination resolves the array's...
Record the uploader on a deduplicated document
registerExistingDocument built its Img without .createdByMember(member), which the normal upload path sets. Every document registered through dedup therefore la...
Targeted conversion updates, so a detached ImgDat save cannot abort conversion
Conversion runs on a virtual thread against a DETACHED ImgDat. save() therefore merges an instance whose LAZY `images` collection is no longer the managed one, ...
Put unowned intake leads into the auto-assignment pool
Every lead-creation path funnels through LeadService.createLead — CSV import, the lead-intake endpoints and their scheduled DaemonService job, the public webina...
HR_RESOURCE assoc type for the org HR resource library
The /hr Resources tab publishes handbooks, policies, forms and reference material to the whole team, and no existing assoc type fits: MY_DOCS is a person's own ...
Pin the contact-point and linker invariants, and drop timeline count queries
The two classes the whole feature rests on had no tests, and all three properties they guarantee fail silently in production: an unmatched call is indistinguish...
Make communication source ids natural keys, not row ids
A source id derived from the source row's generated UUID is only stable if that row commits. The VOIP ingest paths write inside the sync transaction while LeadC...
Point-in-time contact-point index and lead communication links
Adds the spine the lead Communications tab reads from. LEAD_CONTACT_POINTS records every phone number and e-mail a lead has ever had, as a window with activeFr...
Public demo-request lead capture primitives
A visitor who fills in the marketing site's demo form but never books a time left no trace: the lead was only ever written inside the booking transaction. Captu...
MICROSOFT_TEAMS provider type
Appends MICROSOFT_TEAMS to VoipProviderType. The enum persists as ORDINAL on **************** so the position is load-bearing and the constant goes last; the cl...
Model meetings as provider-agnostic
Kamo Meets was the only possible backend: OrgMeetConfig was a flat Meet settings bag and a MeetingRecord held nothing but a room name. This adds the schema for ...
Read quality on adjustments and guideline versions
An assembled price is a base cell PLUS the adjustments stacked onto it, so judging only the cell judges half the number: a cleanly-read 99.875 with a misread -1...
Publish the agent's cell when it is the only number they have
An agent's number can live in any of three columns and commonly sits in only one: e_phone_number on the team member, m_phone_number and m_cell_number on the mem...
Per-cell extraction confidence + eligibility-matrix provenance
Two gaps in the confidence model, both on the money path. PER-CELL. A sheet-wide floor is the wrong grain for judging one price: a single badly-read coupon dra...
Publish every way to reach the agent, not just a name
Name and title alone tell a customer who owns the quote but not how to ask about it. The block now carries email and phone, resolved by the caller — the primary...
Extraction confidence on the catalog spine + auto sign-off basis
A price is only as trustworthy as the sheet it was assembled from, and nothing on the pricing path carried that signal: confidence existed ONLY on pre-promotion...
The opportunity templates own their own markup again
The company line was changed to arrive as a complete <p> element from the sender, so an absent company would not leave an empty paragraph. That was the wrong tr...
Page and filter an account's quotes in the database
An account view needs every quote across all its leads. Loading them to render a page degrades every month the account is in use, and any total shown would only...
Name the lead's assigned agent on the document
The letterhead identifies the org, but a customer with a question about a price needs the person who owns the relationship. The quote now carries the lead's ass...
Reassignable primary agent, and nine notification templates
An approver can hand an opportunity — and the commission with it — to a different agent. PRIMARY_AGENT_MEMBER_ID is who holds it now; REQUESTED_BY_MEMBER_ID is ...
The overall commission on a sale, and market defaults for it
A reserved opportunity now records what the organization pays out of the sale to the requesting agent and the group they share with — the pot the per-colleague ...
Carry lead ids as strings — a JS number silently corrupts them
Lead ids are CockroachDB unique_rowid() values above Number.MAX_SAFE_INTEGER: 1189175700550025222 becomes 1189175700550025200 the moment it touches a JS number....
Put the client's details on the document, read off the lead
Dropping the quote's own addressee fields left the document with nothing to say about the client: customerName only ever came from a linked Account, which lead-...
Quotes belong to leads, configured per market
Quotes were a commerce-pipeline artifact, which put them beside orders and carts rather than beside the client they are for. They now hang off the lead: the mar...
Entities for time-boxed lead opportunity reservations
An agent stakes an exclusive claim on closing a lead for a bounded window; an approver grants, edits or denies it, and colleagues can be offered a share of the ...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.