Add the System Bugs tab
Members report defects in the platform with screenshots and the sites they the dev machine. A tenant sees only its own organization's bugs and the platform org...
DS4P security labels, applied at write time (SP2)
The indexed projection of a resource's meta.security labels, and the thing that has to exist before the first clinical read path rather than after the first beh...
Extend the audit spine for clinical accounting (SP2)
Four fields the clinical read paths cannot work without, and none of which can be backfilled — each records something only knowable at the moment of access. pu...
The eight typed search-index tables (SP3)
Search runs over explicit typed tables, not JSONB with GIN. That is forced by the database, not chosen: Yugabyte's own docs state a GIN index cannot use more th...
Send To AI, gated on MANAGE_SYSTEM_BUGS
The class carries @RequirePlatformRight, so the interceptor resolves the caller and refuses before any handler runs — a per-method check would have been one for...
Bug CRUD, screenshots and the one visibility rule
A system bug crosses the tenancy line in one direction: the platform organization sees every tenant's, and no tenant sees another's. That rule lives in ********...
FHIR resource versioning and the reference-link backbone (SP3)
Three tables that between them make read, vread, _history, ETag and every form of _include work. fhir_resource_current is a pointer, one row per resource forev...
Show a member's photo on the scoreboard, not their initials
The face now comes from the same directory index every other member list on the platform reads (useMemberProfiles), so a person's picture on the scoreboard is i...
Turn the workspace picker on
A member of several organizations now chooses which one to open after their password, instead of it being chosen for them by the hostname. This is the switch th...
Turn the workspace picker on
A member of several organizations now chooses which one to open after their password, instead of having it chosen for them by the hostname. This is the switch t...
Show Google's OAuth callback URL on its registration card
An operator filling in the Google Workspace registration had nothing telling them what to put in the Google Cloud console's Authorized redirect URIs, and the Re...
Accept an explicit org, not only the host
Registration bound the account to whatever organization the host resolved to. On register.kamocrm.com — the signup page for every organization with no register ...
Forward /api/email/oauth/callback to EmailService
Google's OAuth redirect target. Same shape as the email and meet provider callbacks beside it: public and sessionless, because the popup lands on this gateway o...
Serve Google's OAuth callback on /api/email/oauth/callback
The platform console needs an address to show an operator setting up the Google Workspace registration, the way VOIP has /api/voip/oauth/callback. The only emai...
Brand and scope signup with ?org=
register.kamocrm.com is the signup page for every organization that has no register host of its own, so the hostname cannot say which one a visitor is signing u...
The FHIR datatype layer and its discipline harness (SP3)
The foundation every clinical entity reuses, and the build gate that stops it drifting. Both land together on purpose: a harness written before there is anythin...
Refuse the AI training corpus exports for PHI tenants
ANALYTICS_EXPORT is blocked because exports leave the boundary with no de-identification. Both training exports already had a fail-closed audit — there IS a rec...
Refuse MCP tool execution for a tenant that handles PHI
executeTool forwards operator-supplied arguments to an operator-typed URL and can spawn a stdio process, with no allowlist, no SSRF guard and no destination aud...
Guard social messaging and Canva at their credential chokepoints
SOCIAL_MESSAGING is enforced in SocialCredsResolver.resolve — the narrowest point covering every adapter and both directions. No credentials means no Telegram, ...
Guard the last four unenforced capabilities; the baseline is now empty
SOCIAL_MESSAGING, CANVA, MCP_GATEWAY and ANALYTICS_EXPORT were each declared outside the compliance boundary, bound to no ServiceType, and checked by nothing — ...
Rights, entities, repositories and DTOs
MANAGE_SYSTEM_BUGS is a PlatformRightType and must stay one: the dispatch it a tenant administrator can edit their own organization's security models. Screensh...
Add a global alias-uniqueness check
**************** scopes by provider, and that was right while an alias was only ever resolved as (security_provider_id, alias) — the pair behind a <alias>.<pare...
Dispatch a bug report into sage's open VS Code
URI handler that creates a conversation in a RUNNING window and pre-fills the input, which is the only way to reach the editor sage already has open instead of ...
Create the System Bugs tables
No CHECK constraint on the ordinal columns: support_ticket_status_check is what happens when Hibernate freezes one at an enum's size and the enum then grows, an...
Manage a custom domain from Company settings
A domain used to be the doorway into an organization: DNS had to be configured before anyone could sign in at all, which is why /setup/dns was reached from the ...
Send the tree on the app-catalog endpoint too
Branch Types → Allowed Apps builds its editor from /features/app-catalog, not from the tenant features listing, so it was the one surface that could not see whi...
Render the app tree, and confirm what a parent switch-off takes
Children now sit under their parent in the Apps & Features list, each with its own switch. Nesting is expressed by ORDER plus an indent rather than a nested con...
Price the commerce children and the EHR, with a totality guard
Neither pricing map had a totality check, and the two failure modes are different and both silent. Missing from CATALOG, an app lands nowhere on the pricing mat...
Stop counting a member's visits to their own link
A member checking that their own tracking link works is the most common first visit any code ever gets, and it is worse than useless: it inflates the number the...
The Affiliate Sales Scoreboard widget
One grid column wide and two rows tall: the ten people in the organisation bringing in the most through their tracking links, over today, this month, this year ...
The Affiliate Sales Scoreboard endpoint
GET **************** answers this organisation's top ten for one metric over one window, plus the caller's own standing when they are not on it. The counters o...
Add the Affiliate Sales Scoreboard widget rights
Five rights, 234-238, in the MARKETING group and hung off VIEW_REFERRAL_CODES: a leaderboard of referral numbers is tracking-code data, and a member who may not...
Brand and scope the sign-in screen with ?org=
login.kamocrm.com is the sign-in screen for every organization that has no host of its own, so the hostname cannot say which one is signing in. ?org= does: it n...
Serve an org's branding to a screen with no session
Login, registration and the meeting lobby paint an organization's colours before any session exists. They knew which one from the hostname, which is exactly wha...
Refuse meeting recording for a tenant that handles PHI
The capability split made ServiceType.MEET permitted — a live conference on self-hosted Meet never leaves the cluster — while MEETING_RECORDING stayed blocked, ...
The blocked capability now outranks the right, and god mode
PhiPlaybackAuthorizer gated PHI call playback on VIEW_CALL_LOGS. That was the whole check because ServiceType.VOIP mapped to the blocked VOIP_RECORDING module, ...
Serve the app tree, and fix the unguarded auto-enable
FeatureController now sends parent/children/isParent on every serialized app so the client can render children nested under their parent. Served rather than mir...
Mirror the six commerce child apps, and stop the mirrors drifting
Both TS mirrors are now GENERATED from ServiceType.java rather than hand-maintained. They had drifted badly from Java and from each other: stale "RAG integratio...
One scrollbar, three times as wide, down every conversation
The bar beside the messages was 8px in the member chat and SMS, 6px in support tickets and social, and in the AI chat it was nothing at all: that list declared ...
Extend market grandfathering into the app-tree backfill
grandfatherExistingGatedMarkets already walked each org's active markets, resolved getRequiredService() and enabled the missing app — it was just restricted to ...
Entitlement-check every vertical, not just the gated two
Every CommerceType now names its own child app under POS, so the isGated() short-circuit that waved retail, rentals, service, subscriptions and procurement stra...
The toolbar's search is a glyph that opens into a field
The member chat carried a permanent search box across the top of the window — the width of the whole toolbar, spent on a control that is empty almost all of the...
Every vertical names its own child app
requiredService becomes total now that each vertical has a child app under ServiceType.POS, which deletes the "null means POS alone is enough" special case and ...
Let the public config be addressed by org id, not only by host
The meet sidecar looks up an org's meet config to decide whether a guest needs a meeting password. It asked by hostname, which on the shared meet host resolves ...
Cascade feature enable/disable across the app tree
Enabling a child enables its parent; disabling a parent disables every child; disabling the last child disables the parent. Enabling a parent leaves children al...
Add PhiCapabilityGuard for call-time capability checks
PhiTenantGuard runs at feature-enable time and nowhere else — three call sites, all in FeatureService. Now that PhiModule is capability-grained, an app whose co...
Split PhiModule from app-grained to capability-grained
POS mapped to ECOMMERCE_SYNC (BLOCKED_NO_BAA) and the whole commerce surface hangs off POS, so an org with handlesPhi=true could not switch commerce on at all —...
Land inside a newly created org instead of at DNS setup
Creating an org routed the creator to /setup/dns, and the reason was real: entering meant an OTK redirect to internal.<new-domain>, and a brand-new org has no D...
Give ServiceType a two-level parent/child tree
Six commerce children at new ids 26-31, wired to POS in a static block on the RoleRightType pattern (an enum constant cannot reference another from its own cons...
Make an org without a domain enterable
Entering an org meant navigating to **************** With no domain that URL rendered as the literal **************** so Enter was disabled and owners were rout...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.