MFA enrollment screen and the god-mode PHI boundary control
Two settings surfaces for backends that had none. MFA enrollment (settings → my profile → Sign-in Security, self only). SecurityService's /api/security/mfa end...
Endpoint to read and move an organization's HIPAA boundary
Organization.handlesPhi has existed as a column with no way to set it, so PhiTenantGuard has been enforcing a flag nobody could turn on. This is the missing hal...
Rebuild the quote form as a guided flow, add an output preview
The details tab was a flat stack of outlined boxes that gave every field the same weight, so nothing signalled which inputs actually change what the customer se...
Audit vocabulary for a change to the compliance boundary itself
Adds PhiResourceType.ORGANIZATION and PhiAccessKind.CONFIGURE so that turning Organization.handlesPhi on or off can be recorded as what it is. Every existing r...
Serve the customer-facing view to staff for preview
GET /{uid}/preview returns the same PublicQuoteView the share link serves, from the same QuotePresentation resolution, so a previewed letterhead cannot differ f...
Share the letterhead resolution between the public page and staff
The staff preview has to show exactly what the customer receives, so branding, the document term and the link host now resolve in one place. Two copies would dr...
Scan uploads for malware at ingest (§164.308(a)(5)(ii)(B))
The document vault accepted arbitrary uploads with no malware scanning anywhere on the platform, and it is multi-tenant — a file one org uploads is opened by an...
Retry npm ci in the Docker build against flaky runner egress
The k1m1 runner intermittently corrupts TLS streams mid-fetch **************** killing the image build in npm ci. Give npm fetch retries and retry the whole ins...
Break-glass god mode — justification + 30-minute time-box
God mode activated silently and lasted as long as the session. That is the control a covered entity's security review pushes hardest on, because "your staff can...
Reorder steward tabs; fold Identifiers into a pipeline find-loan popover
Tab order is now Pipeline, Documents, Underwriting, Pricing, Capital & Risk, Governance, Ingestion, Catalog — Pipeline becomes the default landing screen. The ...
Route the transaction pipeline screen through ConsoleShell
The Pipeline steward screen was the only console screen rendered without a layout wrapper, so its heading, filter labels, and table sat flush against the consol...
Take the percent sign from Intl, not the translated string
A literal "%" in the source text does not survive machine translation — zh returned "保存 {percent}" — so non-English users saw a bare number where a percentage w...
Repair the quote-option FK defaults ddl-auto cannot reach
The existing dynamic sweep only covers nullable FK columns that already carry a FOREIGN KEY constraint. commerce_quote_options.quote_id is NOT NULL, so it is ex...
Pin option FK column definitions so they do not inherit gen_random_uuid()
Hibernate copies the referenced id's columnDefinition onto a new @JoinColumn, so quote_id and option_id were both created DEFAULT gen_random_uuid(). An insert t...
Compare options on the public quote page
Options render as selectable cards rather than rows, because they are choices and not additions. The period total is the headline; the monthly equivalent sits b...
Author multi-option quotes from the editor
A quote is either a flat price sheet or a set of alternatives, so the editor offers a mode toggle rather than letting both exist at once — sending both would sh...
Accept an option on the public quote endpoint
Multi-option quotes cannot be accepted blind — the request now carries the chosen optionUid and the service refuses acceptance without one.
Multi-option quotes with per-option comparison totals
A quote can now present several mutually-exclusive ways to buy — monthly, annual, three-year — instead of forcing three separate documents that drift apart the ...
Delivery coverage, pricing sign-off, large-deposit panels
Replaces the final Coming-soon chips (Hedge & coverage, Pricing sign-off, Large-deposit) with live panels wired to the new steward proxies.
Steward proxies for coverage, pricing sign-off, large-deposit
Operator-gated, session-stamped org+member, fail-closed ownership (no cross-org existence oracle). New endpoints baselined in the unauthenticated-endpoint ratch...
WORM pricing sign-off entity (mlos_pricing_signoff)
Append-only steward APPROVE/REJECT judgement on a frozen priced result. @PreUpdate throws (a reversal is a new row). Table + 4 indexes (org, run, result, loan) ...
Steward console round 2 — exception queues, governance, MERS recon
- Capital + Underwriting: StewardExceptionQueue (shared panel) wired to the real steward-tasks endpoint — lock exceptions **************** and guideline exc...
Gateway relays for steward-tasks, calibration/funnel, MERS reconciliation
god-eligible, org server-stamped GET relays: **************** **************** MlosDocOrchestration **************** (fail-closed org filter, drops non-owned pa...
Build out the mortgage steward console coming-soon features
Replaces stubs with real, endpoint-backed panels + fixes a dead-write bug: - Underwriting: Income calculation panel (qualification: DTI/PITIA/reserves/LTV + A...
Gateway relay to promote a reviewed bulletin
MlosCatalogController/Client gain promote-bulletin, mirroring promote-guideline (god-eligible gate, org server-stamped). Baselined promoteBulletin in the unguar...
Unbreak application.yml, and replace the test that never ran
Three things, all from trying to answer "why not just fix the context test?". 1. **************** declared `kamo:` TWICE and therefore did not parse at all ...
Fail the build when a repository package is missing from the scan
This service has @ComponentScan("com.kamo") but an EXPLICIT @EnableJpaRepositories list. The moment a bean here needs a repository outside that list, the reposi...
Persist SecurityService PHI access trail to phi_access_log
The §164.312(b) trail was going to Slf4jPhiAccessLogWriter: 14-day platform retention against a six-year obligation, and nothing that can be queried. The lead r...
Complete a login that stopped at the second factor
SecurityService now gates login on a second factor (§164.312(d)). When one is owed it creates the session but withholds its one-time key, returning a short-live...
Persist the VOIP PHI trail to phi_access_log
Call recordings, voicemail audio and transcripts were audited into the log stream, which keeps 14 days against a six-year §164.528 obligation and cannot be quer...
Persist AI conversation PHI access trail to phi_access_log
Stored assistant conversations are the reads least able to afford a 14-day, unqueryable log stream: the module sits outside the compliance boundary, so prompts ...
Persist MediaService PHI access trail to phi_access_log
Chat message reads were recorded through the Slf4j default writer, which puts the §164.312(b) trail in a 14-day log stream against a six-year retention obligati...
Inject the TOTP secret-encryption key
KAMO_MFA_SECRET_KEY maps to kamo.mfa.secret-key by Spring's relaxed binding, and is what MfaEnrollmentService uses to encrypt stored TOTP secrets at rest. With...
Persist this service's PHI audit trail to the database
DocsService serves document bytes, so its trail is what an accounting of disclosures under §164.528 is actually assembled from. It was writing to a 14-day log s...
Durable audit trail — persist PHI access, append-only
Turns §164.312(b) from a log line into evidence. The capture layer has been wired across seven services for a while, but it wrote through Slf4jPhiAccessLogWrite...
Create phi_access_log — the durable §164.312(b) audit trail
Until now PHI access was recorded only to a log stream with 14-day retention against a six-year obligation, and with no query surface. An accounting of disclosu...
Surface quotes in every vertical, not just retail
The Quotes tab was only wired into the RETAIL sub-tab set, so on an org whose active markets are SUBSCRIPTION / MORTGAGE / PERSONAL_LOANS there was no way to re...
Treat SERVFAIL/timeout (TRY_AGAIN) as pending, not hard error
Flaky customer authoritative servers (seen: migo.host for rodaris.md) intermittently answer SERVFAIL on healthy zones, which /setup/dns rendered as a red 'DNS l...
Remove design-partner program page and links — no free-usage giveaways
Mint the Universal Loan Identifier (ULI) + store the org LEI
Adds the HMDA ULI to the LAR export. UliMinter builds the ULI = org LEI(20) + loan number + two ISO 7064 MOD 97-10 check digits (Mod97CheckDigit — the IBAN algo...
Set the org LEI in Company Info (activates the HMDA ULI)
The Company Info card gains a Legal Entity Identifier field (20-char, upper- cased), sent through the existing org PUT — OrganizationController deserializes it ...
Slug map in a plain module — client-reference proxy made server metadata render Article Not Found
Time out the *** call instead of hanging every login
A bare `new RestTemplate()` has no connect or read timeout. When the *** service became unreachable today, every login thread blocked on this call indefinitely ...
Stop the avatar-resolver policy blocking every login
This policy took the whole platform's login offline for hours. Cilium enforces egress against the RESOLVED BACKEND, after service DNAT, so the port it matches ...
Resolve the org from the real request host, not the internal address
checkAccess resolves the tenant by looking up `org:domain:<hostname>`, and was being handed request.nextUrl.hostname — which behind Traefik is 127.0.0.1. That k...
Annotate the injectable StewardNotifier constructor
DaemonService has been in CrashLoopBackOff for days — 1654 restarts on the pod before the last deploy, 60 on the current one — and never started: Failed to i...
Promote an ingested guideline version from the console
For a GUIDELINE source document the ingestion panel shows a "Promote as guideline version" card (product select + revision label). The rate-sheet card is now hi...
Gateway relay to promote an ingested guideline into a version
MlosCatalogController/Client gain promote-guideline, mirroring promote- eligibility: god-eligible gate, organizationId server-stamped via write().
500s on dynamic-segment pages + en fallback for missing locale keys
Removing the global force-dynamic made routes with generateStaticParams attempt static rendering for on-demand params, which throws DYNAMIC_SERVER_USAGE because...
Scan the shared MFA repositories
MfaEnrollmentService is a @Service in kamo-shared-library, so the wildcard @ComponentScan("com.kamo") in this application constructs it whether or not this serv...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.