Four canonical HR legal-package templates
hr.package_assigned, hr.package_reminder, hr.package_voided and hr.package_completed, as {json,html} pairs plus four CANONICAL_KEYS entries. The CONSTANT is no...
React to ASSIGNED and stop trusting a channel that cannot replay
Three ways the support badge went stale, all of them silent. ASSIGNED was published on /topic/support/agent/{memberId} and this handler only branched on PENDIN...
Give every agent a live badge instead of one owner an unread count
The nav badge and /support?tab=tickets answered different questions. The page lists every ticket in the org; the badge counted unread chat messages belonging to...
Stop the badge costing portal members a request a minute
Three things, all of them about who the count is for. THE PROVIDER GATES ON THE SAME CONDITION AS THE BUTTON. It mounts in the root layout for every authentica...
Drop client SENDs to guarded topics, and repair the build at HEAD
TWO THINGS, both of which stop MediaService main from shipping. 1. main does not compile. MediaController:1361 calls **************** which does not exist: ...
Let a failed pending-count read out instead of downgrading it
publishFor caught Exception around countByTeamMemberIdAndStatusIn and turned it into a WARN. That catch was not only around the badge: the query runs inside the...
Signature button with a live legal-package badge
Hand-written into the fixed left cluster between My Profile and Log out. NAV_REGISTRY cannot express a position between two fixed controls and its badgeKey fiel...
Live pending-package count over the EXISTING chat socket
LegalPackageCountContext consumes **************** rather than opening a fourteenth STOMP connection for one integer, and subscribes to **************** — the d...
Relay the legal-package count and guard per-member SUBSCRIBEs
legal.packages.> -> **************** core NATS, no stream — the same shape SupportStompRelayController and PlatformStompRelayController already use. topicFor is...
Proxy the member's pending-package count
A static segment sibling to [uid] so App Router matches it first. PATH ONLY — forwardToApi owns the query string — and one upstream call, because the OTK is sin...
Serve the caller's own pending-package count
GET **************** through memberGuarded() and the identity funnel. No memberId and no orgId parameter — both come from the session, because an id in a path i...
Show a sent attachment without waiting for a reload
MediaService announced a new chat message twice — once when the row was saved, before any attachment existed, and once after the attachment rows committed. The ...
Emit the badge count on every transition that moves it
Four sites: delivery (none -> PENDING), void (open -> VOIDED), redelivery (open -> SUPERSEDED) and finish (open -> EXECUTED). Each passes the status it read BEF...
Announce a message once, when it is whole
Both callers that finish building a message after the row is saved now tell createMessage not to announce it: MediaController attaches the images and publishes ...
Let a caller own the realtime announcement of the message it is still building
createMessage announced every new message on the session's realtime subject the moment the row was saved — inside the caller's transaction, before the caller ha...
Publish the member's open-package count to core NATS
Connection.publish on legal.packages.{memberId}, NOT NatsMessageService: that service pins .expectedStream(CHAT_MESSAGES) in both publish and publishSync, so a ...
Lay the profile header's wallpaper chrome out in a row
The Source / Console / Tone pod was the Stage's stacked one, and stacked it is taller than the 100px avatar it sits beside — so it, not the identity block, set ...
Give the executed-package repair an actual button
POST **************** existed upstream and was tested, but nothing in the product could reach it: no proxy route, no helper, no button. Every failure branch in ...
Guard the destructive imaging paths and make the repair reachable
DELETE /imaging/delete/{imgId} is the one destructive imaging path and was not wired to the issued-document guard. ImageService.deleteDocument authorizes on org...
Forward the login host so recovery can resolve the org
Password recovery now accepts a member's primary mailbox address, which only names an account within one org. This proxy reaches SecurityService over cluster DN...
Accept a member's primary mailbox address as a login identifier
The address a member gives out is usually the org mailbox flagged Primary on their member settings, not whatever is on their user account — so typing it into th...
Restore the profile header wallpaper and wire its controls to the editor
The band behind the avatar on **************** had gone flat gradient. Not the wallpaper feature — ae85a8ae routed the header's photos through next/image + safe...
Sit the head tabs on the header's bottom edge and flatten the identity row
The tab strip was vertically centred in a row whose height was set by the action cluster beside it — a default-size More icon button (40px) plus the cluster's o...
Download the executed package from the grid and the member's own page
Both surfaces go through the LEGAL endpoints, keyed on the assignment, not /api/imaging/download/{imgId}: that path additionally needs organization.isDocs and V...
Stop colleagues reading a member's HR-issued documents
isPerPartyRestrictedAssoc covers only ACCOUNT_MEMBER_VAULT and LOAN, so assoc 1 — SERVICE_APPLICATION, what /settings/member/{id}?tab=docs renders — has no per-...
Draw non-image attachments with the document manager's file-type icons
A staged .docx or .xlsx was a grey MUI outline with the extension lettered underneath — a shape invented for the tray, and one that says less than the icon the ...
File after Finish, repair from HR, and download BY imgId
Filing is queued AFTER COMMIT and OFF the request thread. Finish is @Transactional in a service that also serves WOPI; holding a connection across N ESigService...
File the merged executed package into the member's own library
uploadDocument takes the SUBJECT'S Member, so Img.organization and Img.createdByMember derive from them and HR ends up having filed a document the member owns. ...
Cover the chat-routing propagation that broke assignLoanOfficer
assignLoanOfficer gained a step that looks up the loan's source lead to reroute the borrower's open public-chat session. That lookup runs a JPQL query through t...
Restore the files 2b23346 dropped, and answer an oversized send with 413
2b23346 was committed through a private index that was never seeded from HEAD, so its tree held only the three files staged into it and the commit deleted the o...
Say what is too big, instead of "Failed to send email"
A draft that outgrew the send endpoint's limits produced one flat line of red text after the whole payload had been uploaded — or, when the body itself was the ...
Gate each Human Resources tab on its own right
Overview needs VIEW_OVERVIEW, Attendance MANAGE_TIMECARDS, Legal & Compliance MANAGE_LEGAL_AND_COMPLIANCE, Training MANAGE_TRAINING and Resources MANAGE_RESOURC...
Enforce MANAGE_LEGAL_AND_COMPLIANCE on the package endpoints
LegalPackageAccess mirrors the Legal & Compliance tab gate, and that tab is now gated on one right of its own instead of VIEW_EMPLOYEES || EDIT_EMPLOYEES || MAN...
Carry existing HR holders onto the new per-tab rights
A right that gates something already reachable is a removal of access: new rights insert as NOT_SPECIFIED, so the /hr tabs would have vanished on deploy for eve...
One security right per Human Resources tab
The /hr tabs were gated on whichever pre-existing HR right happened to be an OR-term in the front end: Attendance opened on VIEW_SCHEDULES, Training on VIEW_EMP...
Measure a draft against the send limits before uploading it
A body carrying inline base64 — HTML pasted from a web page, a forward's quoted content, a signature's images — can pass the per-part ceiling on its own. The se...
The executed package certificate and the ordered merge
The certificate carries the package, the frozen version, the subject, the moment and address of execution, the attestation wording verbatim and both digests the...
Store attachments through the dedup pipeline instead of one object per upload
Attachments wrote their own "<imgId>/<fileName>" object on every upload, bypassing the content-addressed store entirely — the same logo-draft.png attached three...
Expose the content-addressed store so chat attachments can dedup
Chat attachments never went through the hashing pipeline — they wrote a private "<imgId>/<fileName>" object per upload, so the same file attached three times oc...
The two byte sources for the executed artifact
LegalPinnedPdf extracts the frozen-digest rule out of the member read path so the wizard and the filed artifact read the SAME bytes through the SAME check — con...
Stop capping every send at 1MB, so a pasted image can actually go out
Composing with a pasted image failed with a bare "Failed to send email". The composer inlines the paste into the body HTML as a base64 data URI, which rides in ...
Rebuild for the unified imaging bucket
Picks up kamo-shared-library 3045cc3: ImageAssocType.getBucket() now returns the single "imaging" bucket for every association, so a deduplicated file is stored...
Rebuild for the unified imaging bucket
Picks up kamo-shared-library 3045cc3: ImageAssocType.getBucket() now returns the single "imaging" bucket for every association, so a deduplicated file is stored...
Rebuild for the unified imaging bucket
Picks up kamo-shared-library 3045cc3: ImageAssocType.getBucket() now returns the single "imaging" bucket for every association, so a deduplicated file is stored...
Rebuild for the unified imaging bucket
Picks up kamo-shared-library 3045cc3: ImageAssocType.getBucket() now returns the single "imaging" bucket for every association, so a deduplicated file is stored...
Rebuild for the unified imaging bucket
Picks up kamo-shared-library 3045cc3: ImageAssocType.getBucket() now returns the single "imaging" bucket for every association, so a deduplicated file is stored...
Resolve the document bucket from ImageAssocType.BUCKET
DocumentService hardcoded "imaging-mydocs" while every other read path went through ImageAssocType.getBucket(). Now that storage is one bucket, point it at the ...
Store every image in one bucket so dedup means one copy
Association is metadata, not a storage boundary. Each ImageAssocType used to name its own MinIO bucket, which contradicted the hashing pipeline: dedup is scoped...
Wire DocsService to ESigService so Deliver stops 503ing
LegalEsignClient.isConfigured() was false in the cluster: neither internal.auth.secret nor legal.esig.service-url was supplied, so Deliver refused every package...
Add the legal package execution plan
Phase 5: the member self-service page, the execution wizard ported from kamo-signer, and WORM package attestation capture.
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.