Transcript column on Recording + RecordingMetadata
Adds a TRANSCRIPT TEXT column to the Recording entity and threads a transcript through **************** (with backwards-compat constructors so existing 5- and 9...
Wrap recording upload so MediaService compiles
MinIOStorageService.upload throws a checked Exception that ingest() neither caught nor declared — build break on top of the isGuest fix. Wrap it and rethrow as ...
Verify return-nav JWT signature; tidy token refresh
- CanvaJwtVerifier: verify the correlation_jwt's Ed25519 signature against Canva's JWKS (/connect/keys), plus aud/exp/type; keys cached by kid. Return-nav n...
MeetingParticipant.isGuest() (was getGuest, won't compile); repoint transcribe to generic endpoint
MeetingParticipant exposes isGuest() (primitive boolean getter), not getGuest(). Also point the summary transcribe call at the shared /api/conversion/transcribe...
Make whisper-asr independently scalable (HPA, multi-node)
Remove the single-node pin and switch to a per-pod model cache so pods can schedule on any node, and add an HPA (min 1 / max 4, CPU 75%, deliberate scale-up giv...
Rebrand Guacamole client connection status text to KamoDesktop
Override **************** so the 'Connecting to Guacamole...' screen (and related status) reads KamoDesktop.
Correct Guacamole branding manifest version field
Manifest used guacManifestVersion:1.0; the bundled extensions use guacamoleVersion. The wrong field made Guacamole reject the branding extension ('Unable to rea...
Recording ingest, retention/quota, storage usage, summary pipeline
- MeetRecordingController: internal (X-Internal-Auth) ingest endpoint the jibri finalize.sh posts finished recordings to. - MeetRecordingService: uploads reco...
Sample vars for meeting-summary template preview
Adds a sampleVariables case for the new meeting-summary template so the steward preview UI renders realistic content.
Meeting-summary canonical template
Adds the "meeting-summary" transactional template (subject + branded HTML with {{roomName}} and raw {{summaryHtml}}) and registers it in CANONICAL_KEYS so it se...
Stop double-appending ?target in the SSO proxy route
forwardToApi already forwards the incoming query string, so passing the path with ?target= produced **************** -> target='linux?target=linux' -> 400 'Unkn...
Prosody moderator module, whisper-asr, jibri recording upload
- Meet-prosody: version-control the custom-plugins ConfigMap (captures the existing token_verification no-op override that was created out-of-band) and add ...
Recording transcription endpoint for post-meeting summaries
POST /api/conversion/meet/transcribe (X-Internal-Auth): normalizes an uploaded meeting recording to 16kHz mono WAV via a new additive FfmpegService helper, forw...
Calendar integration for scheduled meetings + real recording storage meter
- calendarIntegrationEnabled: when on, a scheduled clubhouse meeting is also added to the creator's calendar (via the existing calendar system) carrying the ...
MeetingRecording entity + repository for captured recordings
New MEETING_RECORDINGS table (org, meeting ref, room, MinIO bucket/object key, size, duration, captured/expiry timestamps, summary status) — the parent record f...
Resolve session from X-***-Token header in CallerSessionResolver
The kamo-internal -> APIService BFF path forwards the session as the X-***-Token header, but the resolver only read the X-OTK attribute or the *** cookie — so B...
Marketing app, settings hub, Canva materials
Make Marketing a first-class org-enableable app and ship the Canva-powered Materials experience. App-enablement: - AppType.MARKETING mirror, Organization.isMar...
PatchLoanFile is no longer a status backdoor; unblocking a condition needs the underwrite right; clear cascades
**************** status changes are the pipeline state machine's job (POST /transitions enforces legal arrows + per-arrow role gate + open-blocking-condition ga...
Video poster-frame thumbnails for marketing materials
Canva MP4 exports (and any video upload) skip the Docs PDF path and get a single ffmpeg poster-frame thumbnail (_thumb_p0.png) instead of failing. - **********...
Canva Connect OAuth + designs/export backend
- CanvaApiClient: PKCE authorize, token exchange/refresh/revoke, users, designs (create/list), export jobs, byte fetch - CanvaTokenService: encrypted per-memb...
Partial condition PATCH can't silently clear the blocking flag; template blocking default honored; publish after commit
**************** boolean -> Boolean so a PATCH that OMITS the field is distinguishable from an explicit false. LoanConditionService.update now null-guards *****...
Canva integration + Marketing as an org-enableable app
- **************** — platform Canva Connect client registration - ImageAssocType.MATERIALS(13, imaging-materials) — org marketing assets bucket - **************...
Enable Guacamole json-auth SSO + KamoDesktop rebrand
- JSON_SECRET_KEY (optional) on guacamole from the shared desktop-sso secret enables the bundled guacamole-auth-json extension the god-SSO links validate agai...
God-only KamoDesktop icons (Linux + Windows) opening auto-connected sessions
Two nav icons left of Analytics, shown only to god-eligible members (isGod added to NavGateContext). Each fetches a short-lived SSO link from SecurityService an...
Inject KamoDesktop SSO env directly + wire guac-sso into tracked k8s deployment
- @Value reads KAMO_GUAC_SIGNING_KEY / DESKTOP_PASSWORD from env directly (runtime application.yml is configmap-mounted, so property indirection wouldn't bind...
KamoDesktop SSO token endpoint for god members
GET **************** (god-eligible only) mints a 5-minute guacamole-auth-json token (HMAC-SHA256 + AES-128-CBC, per the extension's wire format) and returns an ...
Org-scoped room names, room-name format, calendar Kamo meetings, start reminders; i18n settings
- useMeeting/MeetingDialog: room names are now namespaced by org token so two orgs can never collide into the same Prosody conference, and honor the org's r...
Scheduled-meeting start reminders + guest-link expiry
- MeetingReminderSweep: @Scheduled sweeper that fires a realtime "meeting starting" reminder to invited members at (start − reminderMinutesBefore) on ******...
Show member availability in chats list; rename tab to Directory
1:1 chat rows now surface the counterpart's live presence + availability the same way the Directory tab does — same useAvailability/usePresence sources and the ...
Design spec for KamoDesktop god SSO icons + Guacamole rebrand
Two god-only nav icons (Linux/Windows) in kamo-internal that open Guacamole in a SecurityService (god-eligible gate), deep-linked straight to each instance. Reb...
Move guacd to pod network (MTU fix) + unicast WoL
guacd on hostNetwork (k1m1 eno49 MTU 1500) vs guacamole pod on cilium overlay (MTU 1420): RDP connected but large frames were dropped across the boundary -> 'Gu...
Sign invited members into meetings via click-time OTK join links
Invite links (chat + email) previously embedded a bare meet-room URL, so recipients landed as anonymous guests instead of themselves. An OTK can't be pre-embedd...
Persist invited participants, enforce MANAGE_MEET_SETTINGS, drop double-invite path
- createMeeting: invited members are numeric snowflake IDs, not UUID strings — route them through longToUUID like the creator. Previously UUID.fromString th...
Watch the desktop namespace for IngressRoutes
desktop.kamocrm.com IngressRoute lives in the desktop ns, but Traefik's CRD provider only watched **************** — so the route was ignored and requests fell ...
Import VM disk as Filesystem, not Block
CDI's block importer crashlooped: 'blockdev: cannot open /dev/cdi-block-volume: Permission denied' — it can't access the raw Longhorn block device. Filesystem v...
Borrower submit fires the Application-Taken side effects (doc checklist + notify)
The portal borrower submit is PATCH loan-file {statusId:2}, which bypassed the operator /transitions endpoint where the Application-Taken side effects live — so...
Reject negative loan amount / property values on section saves
updateLoan and updateProperty now reject a negative monetary amount on the LTV inputs (loan amount, estimated/purchase/appraised value) via requireNonNegative —...
Correct KubeVirt VM cloud-init field + modernize spec
- cloudInitNoCloud userdata secret field is 'secretRef' (not userDataSecretRef); KubeVirt v1.8.4 pruned the wrong field -> 'must have at least one userdatasou...
Never prepend www to subdomains, only to the bare apex
The catch-all redirected ANY non-alias host to https://www.<host>, which is correct for the bare apex (kamocrm.com -> www.kamocrm.com) but wrong for a subdomain...
Borrower cannot escalate loan-file status or edit the URLA after submission
Two related borrower-authorization holes on the self-service app endpoints: - Privilege escalation (#2): patchLoanFile applied any statusId with no caller-ri...
Loan-file status accessor for borrower edit-lock, borrower-delete cascade, gift-recipient app scoping
**************** orgId): read helper backing the borrower post-submission edit lock (a borrower may only edit the URLA while the file is DRAFT). **************...
Hardened KubeVirt remote desktop + Guacamole gateway
Adds a full remote-desktop stack, GitOps-applied via the deploy workflow: - KubeVirt + CDI installed at deploy time (pinned-stable release URLs) - desktop-1: K...
Sub-tabs for chat groups, remember last-open tab
The chats list filtered by a row of multi-select pill chips that looked out of place under the Chats tab. Replace them with a single-select sub-tab bar (one tab...
Design spec for hardened KubeVirt remote desktop + Guacamole gateway
KubeVirt Kubuntu VM (16Gi/500Gi Longhorn) behind Apache Guacamole HTML5, exposed at desktop.kamocrm.com via Traefik (TLS + rate-limit + IP-ban). Adds LAN Window...
Move status editor onto the tabs row; note callback auto-note
- Status/sub-status editor now shares the primary-tabs row: tabs left, status aligned right (removes the separate row under the action buttons). - Callback di...
Show member avatars in the Chats tab
MediaService returns chat-session member avatarUrl=null by design (avatars are resolved on the frontend), but the Chats tab never resolved them, so it always fe...
Borrower self-create idempotency + orphan compensation; don't relay an empty checklist as success
MortgageAppController.create() borrower self-create branch: - Idempotency (#2): resume an existing owned DRAFT via findOwnedDraft instead of minting a duplica...
Readiness banner refreshes with the Refresh button and never shows an empty market name
Two follow-ups on the MLOS default-lead-source readiness banner: - Refresh (IconButton) now also calls loadMlosReadiness(), so surfacing a newly-created marke...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.