Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Record byte access on the four document paths that recorded nothing
/download already logged through **************** and it was the platform's only byte-access injection site. The sibling endpoints serving the exact same bytes ...
Contain egress from the avatar resolver; note the Redis eviction pool
SecurityService now runs a fetcher whose target URL is chosen by an untrusted party — a BIMI record is DNS content published by whoever owns a sending domain, a...
Show sender and recipient photos
The mailbox rendered a single letter on a single shared gradient for everyone, so every row looked the same and the circle carried no information. It now shows ...
Avatar endpoints; fix unauthenticated reachability and contact tenancy
Adds the mailbox side of sender avatars, and fixes three pre-existing holes this work would otherwise have built on top of. AUTHENTICATION. OTKPreAuthFilter us...
Sender-avatar resolution chain for the mailbox
Resolves a correspondent's email address to a picture, working outward from what Kamo already knows: member photo, then a photo someone attached to a contact, t...
Sender identity model + org-scoped batch email lookups
Backing store and queries for the mailbox sender-avatar chain. SenderIdentityEntity is the durable tier of the avatar cache. org_id is part of the natural key ...
Audit spine for PHI access — §164.312(b)
The Security Rule requires recording access to ePHI, which means reads. The platform records changes well — LeadHistory, SystemAccessLog, UserHistory, LoanAudit...
403 rather than 500 when the compliance boundary refuses
Two call sites of featureService.enableFeature now understand the HIPAA boundary: - /enable maps PhiModuleNotPermittedException to 403 carrying the reason, m...
Enforce the compliance boundary at the feature switch
Wires PhiTenantGuard into FeatureService, the single choke point through which a module is switched on for an organization. This is where the boundary stops bei...
Auto-assign a MERS-compatible loan number at application creation
LoanFile.loanNumber was null on create (both blank-create and lead-promote) and only ever set when a steward typed one — which hard-blocked MERS MIN minting (a ...
Make the kubectl install resilient to flaky egress
With the PATH bug fixed, the deploy then failed on a transient TLS drop while downloading kubectl: curl: (56) OpenSSL SSL_read: error:0A000119:decryption fail...
Invoke kubectl by absolute path in the step that installs it
Root cause of deploy_k1m1 never succeeding. The install step did: echo "$BIN" >> "$GITHUB_PATH" kubectl version --client but $GITHUB_PATH only applies to SU...
Point the deploy kubeconfig at the LAN IP, not the k1m1 hostname
deploy_k1m1 had never succeeded (0/5 since the repo was created). The job rewrote the kubeconfig API server to https://k1m1:6443, but the runner's job container...
Re-trigger deploy after fixing K1M1_KUBECONFIG_B64
The deploy_k1m1 job had never succeeded (0/5) because the secret held k1m1's on-host kubeconfig verbatim, whose server is https://127.0.0.1:6443 — reachable fro...
Add missing CampaignController REST endpoints for /api/email/campaigns
The bulk-email workspace/editor call GET/POST /api/email/campaigns etc., but only CampaignService (the @Service) was ever created — no @RestController exposed i...
Render signer dates in the recipient's resolved timezone
SigningSession gains a required `timeZone` (IANA id) that ESigService resolves from the recipient's member zone, then the org's, then UTC. WelcomeScreen now pas...
Resolve signer display timezone from member, then org
Signing dates were rendered in whatever zone the client defaulted to, so an envelope expiring 2026-08-03T05:00Z could read "Aug 3" to a Pacific signer for whom ...
Create HANDLES_PHI and PHI_EFFECTIVE_DATE on orgs
Mirrors the two new Organization fields, following the OrgBrandingFieldsMigration convention, so the columns are reproducible on any environment rather than onl...
Persist handlesPhi and phiEffectiveDate on Organization
Backs PhiTenantGuard with a real column. HANDLES_PHI is NOT NULL DEFAULT FALSE following the **************** pattern, so every existing tenant is explicitly ou...
PhiTenantGuard and the module compliance boundary
The keystone of the HIPAA compliance boundary: which modules a tenant may reach, given whether that tenant handles protected health information. Everything down...
Disable hreflang alternates header; make LANGUAGE_NAMES total
- routing.ts: set alternateLinks: false — the app is noindex/nofollow with no consumer for the Link: rel=alternate header next-intl emits by default for all...
Revert "feat(phi): add the handlesPhi tenant flag and PhiTenantGuard"
This reverts commit ****************
Revert "feat(phi): create HANDLES_PHI and PHI_EFFECTIVE_DATE on orgs"
This reverts commit ****************
Create HANDLES_PHI and PHI_EFFECTIVE_DATE on orgs
Mirrors the two new fields on the Organization entity in kamo-shared-library, following the OrgBrandingFieldsMigration convention. HANDLES_PHI is NOT NULL DEFAU...
Emit the signer locale segment in signing links
Extracts the byte-for-byte duplicated buildSignLink into SignLinkBuilder and adds a locale segment sourced from Organization.language, falling back to English f...
Clone translations from the dictionary, stop tracking messages/
Adds the dictionary clone step before the Docker build and gitignores apps/kamo-signer/messages/, matching kamo-internal and kamo-marketing. Requires **********...
Add the handlesPhi tenant flag and PhiTenantGuard
The keystone of the HIPAA compliance boundary: a per-organization flag plus a guard deciding which modules that organization may reach. Everything downstream ke...
Require a session on POST ****************
The handler took an HttpServletRequest but never used it, carrying the comment "No auth required — internal admin maintenance endpoint". APIService relays /api/...
Require a session on POST /backfill-conversions
The handler was declared backfillConversions() — it took no request at all — under the comment "No auth — internal maintenance, mirrors /backfill-thumbnails". I...
Add language switcher to the signer top bar
Endonym-labelled menu over the 22 supported locales. Preserves the query string on switch — ?t= is the signer's only credential.
Mirror layout for RTL locales via stylis-plugin-rtl
The MUI theme direction alone flips component logic but leaves physical CSS properties untouched, so Arabic rendered with LTR spacing. Swaps the Emotion cache k...
Gate DELETE /api/security/org/{id} behind active god mode
The handler was `public void **************** Long id)` — no HttpServletRequest parameter at all, calling straight through to a bare deleteById. With ResourceSe...
Route the signer under /{locale} with next-intl middleware
Adds i18n/routing.ts (localePrefix always), i18n/navigation.ts, and middleware.ts, and moves the route tree under src/app/[locale]/. request.ts now resolves fro...
Delete /api/set-token and /api/get-jwt-token; add route guards
Both routes were dead — no caller anywhere in kamo-internal, kamo-login or kamo-register — and both leaked credentials. /api/set-token built its upstream URL f...
Require auth + org scope on job-title/department mutations
PUT and DELETE on /api/security/job-titles/{id} and /api/security/departments/{id} resolved no session at all — they read a UUID off the path and called straigh...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.