Live Change Log

Scylla: --smp 2 --memory 3G in a Guaranteed 2 CPU / 4Gi pod (14-day peak 0.66 GiB, 0.05 CPU; the database is 2.93 MB). The init container now has requests == li...

ServiceType.NOTES is renamed in kamo-shared-library, in copy only: the display name is "Notes & Checklists" and the description now covers the checklists. Both ...

A sweep of every repo for the values of the cluster's live Secrets (2026-09-23) found copies here: the JWT signing secret as a `${JWT_SECRET:<literal>}` default...

A sweep of every repo for the values of the cluster's live Secrets (2026-09-23) found copies here: the JWT signing secret as a `${JWT_SECRET:<literal>}` default...

A sweep of every repo for the values of the cluster's live Secrets (2026-09-23) found copies here: the JWT signing secret as a `${JWT_SECRET:<literal>}` default...

A sweep of every repo for the values of the cluster's live Secrets (2026-09-23) found copies here: the JWT signing secret as a `${JWT_SECRET:<literal>}` default...

A sweep of every repo for the values of the cluster's live Secrets (2026-09-23) found copies here: the JWT signing secret as a `${JWT_SECRET:<literal>}` default...

A sweep of every repo for the values of the cluster's live Secrets (2026-09-23) found copies here: the JWT signing secret as a `${JWT_SECRET:<literal>}` default...

The local-development defaults carried the database OWNER's password (${DB_PASSWORD:<literal>}), and apiservice/securityservice also the live changelog webhook ...

The local-development defaults carried the database OWNER's password (${DB_PASSWORD:<literal>}), and apiservice/securityservice also the live changelog webhook ...

The local-development defaults carried the database OWNER's password (${DB_PASSWORD:<literal>}), and apiservice/securityservice also the live changelog webhook ...

The local-development defaults carried the database OWNER's password (${DB_PASSWORD:<literal>}), and apiservice/securityservice also the live changelog webhook ...

The local-development defaults carried the database OWNER's password (${DB_PASSWORD:<literal>}), and apiservice/securityservice also the live changelog webhook ...

The local-development defaults carried the database OWNER's password (${DB_PASSWORD:<literal>}), and apiservice/securityservice also the live changelog webhook ...

The local-development defaults carried the database OWNER's password (${DB_PASSWORD:<literal>}), and apiservice/securityservice also the live changelog webhook ...

The local-development defaults carried the database OWNER's password (${DB_PASSWORD:<literal>}), and apiservice/securityservice also the live changelog webhook ...

The prior image build failed check-i18n-keys; the English strings now live in kamo-translation-dictionary.

Eight migration statements created unique indexes on exactly the columns their entities already declare unique (BillingGroupMember, BillingGroup, MailboxBilling...

member_notification_preferences (member_id) got both a plain and a unique index from the same statement list; the unique index serves every lookup. The plain on...

Each of these indexes covered exactly the same columns as a unique constraint, a unique column or the primary key on the same table, so it added a tablet and wr...

kamo-translation-dictionary de9ab66f writes Domain Setup, Sending, Opt Out and Deliverability, and the campaign screens' new From picker and sending-domain stri...

kamo-translation-dictionary 93728a83 rewrites home.widgets.emailCampaigns by hand in 20 languages, replacing synced values such as de "Eins eins eins eins" for ...

59a13aa2 moved the comment beside the state it explains and left the original above rowsKey. Comment only; nothing to build.

CampaignWidgetView.groups carried those counts only for widget builds from before the stage tabs (kamo-internal d0b56adf). Every deployed build since 949d3889 r...

No code change. The label comes from kamo-translation-dictionary 649b24cb, which the image build clones into messages/ at build time, so it only reaches the sit...

`potTotal` and the component-level `t` were the only readers of the pot block I moved into the chip layer, and both survived it — read by nothing, flagged by no...

The lockfile is edited by hand — four lines: the root range, and the version, resolved URL and integrity of the one package. `npm install --package-lock-only` r...

Same door and same reasoning as its sibling one line above: X-Internal-Auth, constant-time, fail-closed. Genuinely pre-session — a mobile sign-in is reported by...

**************** caught the new internal endpoint, which is what it is for: with anyRequest().permitAll(), a handler that resolves no caller is reachable throug...

Finishing the sweep that started when my own billingDraft.ts committed as "Bin 0 -> 6882 bytes". Scanning every tracked text file for a NUL byte found three mor...

These were deleted in the working tree but never committed, so the repository still carried them and any fresh checkout brought them back. app/page.tsx was the...

The chat bubble needs a public site key, and these are origin-locked — the marketing site's own would be refused on apps.<domain>. So the variable is declared a...

The sign-in hop's redirect URI was only the @Value default. It belongs beside the other two redirect properties: unlike them it is never re-hosted onto the tena...

f0edd01 was pushed with the rest of the fleet-wide rollout-safety work and is the only one of that batch whose image never appeared: the deployment is still run...

The register endpoint caught a failed verification send and logged warn(e.getMessage()). For the fault it kept hitting — EmailService raising a Yugabyte read re...

kamo-careers serves the org's public job board at careers.<apex>. The list is informational — the log-scan mechanism is what actually mints certificates — but t...

**************** refused /org/public/by-host/{host}, which is exactly its job — a new mapping that resolves no session is reachable without credentials through ...

This repo's workflow applies exactly configmap.yaml, deployment.yaml and service.yaml, so a fourth manifest beside them was never applied by anything — the rout...

Run 5861 failed in two seconds, before any compilation: the runner could not reach data.forgejo.org to fetch actions/checkout. Nothing to do with the tree, and ...

Picks up entitlement-cache invalidation on comp provisioning. This service owns both halves: it approves the order and it serves the cached entitlements, so wit...

Picks up the draft-order reprice fix: changing a draft's seat count or billing cycle left every money field and line item describing the order's previous shape,...

Picks up the comp-provisioning fix. A comped order granted its plan and none of the add-ons it sold, because provisionCompSubscription never wrote active_addon_...

Ships the lead contact location fix, which lives in the shared library: LeadDTO now returns the lead's own country, subdivision and timezone, so the three Prima...

Ships the quote document work, all of which lives in the shared library: - a one-off setup fee on a single-price quote (commerce_quotes.setup_fee, which is a...

Ships the quote pricing fix: a unit price is a per-month rate, so a term multiplies it rather than the engine dividing down to it. An annual option quoted one m...

Ships the quote total fixes: a committed term now totals the term rather than one period of it, and a multi-option quote is no longer headlined by whichever alt...

Ships the quote money fixes, which live entirely in the shared library and so reach production only when this service is rebuilt: - a quote's headline total no...

**************** holds the saved views, shares, favorites, recents, schedules and schedule runs. The reports themselves are code rather than rows — only a membe...

The market writer landed one commit after this service was last built, and CI clones kamo-shared-library at image-build time — so the deployed jar still has the...