Durable audit trail — persist PHI access, append-only
Turns §164.312(b) from a log line into evidence. The capture layer has been wired across seven services for a while, but it wrote through Slf4jPhiAccessLogWrite...
Create phi_access_log — the durable §164.312(b) audit trail
Until now PHI access was recorded only to a log stream with 14-day retention against a six-year obligation, and with no query surface. An accounting of disclosu...
Mint the Universal Loan Identifier (ULI) + store the org LEI
Adds the HMDA ULI to the LAR export. UliMinter builds the ULI = org LEI(20) + loan number + two ISO 7064 MOD 97-10 check digits (Mod97CheckDigit — the IBAN algo...
Set the org LEI in Company Info (activates the HMDA ULI)
The Company Info card gains a Legal Entity Identifier field (20-char, upper- cased), sent through the existing org PUT — OrganizationController deserializes it ...
Promote an ingested guideline version from the console
For a GUIDELINE source document the ingestion panel shows a "Promote as guideline version" card (product select + revision label). The rate-sheet card is now hi...
Gateway relay to promote an ingested guideline into a version
MlosCatalogController/Client gain promote-guideline, mirroring promote- eligibility: god-eligible gate, organizationId server-stamped via write().
Auto-login after email verification via one-time key
When /verify-email responds with the additive otk + autoLoginHost fields (minted by SecurityService on first verification), deep-link straight to https://<host>...
Phase 3+4 — convert the traffic that already arrives
- changelog (#2 destination) gets a conversion block; careers shows the honest no-openings state - /subscribe page: post-registration plan intent lands somewher...
Mint auto-login OTK on first email verification
Completing the register wizard's email verification (6-digit code or email link) already proves inbox possession, yet the new user was bounced to the login page...
Related-content modules + signup CTA retargeting on programmatic templates
Solutions, integrations, alternatives, and glossary templates were organic dead ends: no internal related links and "Start free" CTAs pointing at /pricing inste...
Gate login on the second factor — §164.312(d)
Completes MFA. The core landed in kamo-shared-library; this is the wire that turns stored configuration into an actual gate. The gate is small because login al...
Phase 0+1 — instrument the real funnel, unblock first paint
- forward data-* props through MagneticButton/RippleButton (events never reached the DOM) - instrument SharedNavigation, Hero, PreviewBanner, section CTAs; ?ref...
TOTP second factor — §164.312(d)
The compliance assessment called the absence of any second factor disqualifying on its own, and under the 2025 Security Rule NPRM MFA stops being addressable at...
Add analytics analytics + ?registered=1 welcome notice
- Mount analyticsAnalytics client component in the root layout: next/script loader for analytics.kamocrm.com scoped via data-domains to login.kamocrm.com on...
Create the second-factor tables
Backs UserMfaEnrollment and MfaRecoveryCode in kamo-shared-library — §164.312(d) Person or Entity Authentication, the gap the compliance assessment called disqu...
Require VIEW_CALL_LOGS for call playback in PHI-handling orgs
Recording and voicemail playback checked tenancy and nothing else: any member of the owning org could pull any call in it, transcript included, on extensions th...
Automatic logoff after inactivity (HIPAA 164.312(a)(2)(iii))
A session left open on an unattended workstation stayed usable indefinitely. This terminates it after 15 minutes of no interaction, with a 60-second warning so ...
Audit WOPI content endpoints and close the last byte-serving gaps
WOPI serves whole documents to Docs and recorded nothing. GET /wopi/files/{id}/contents is the same disclosure as /download, relayed the same way through APISer...
Promote an ingested eligibility matrix from the console
For an ELIGIBILITY_MATRIX source document the ingestion panel now shows a "Promote as eligibility matrix" card: pick the product, limit type (MAX_LTV/CLTV/DTI),...
Gateway relay to promote an ingested eligibility matrix
**************** gain promote-eligibility, mirroring promote-adjustments: god-eligible gate, organizationId server-stamped via write(), downstream 4xx relayed v...
Authoring UI — list, line-item editor, share-link management
Completes the quote/estimate system: staff can now build a quote, price it, mint a share link and email it, all from the pipeline. app/lib/quotesApi.ts ...
Record lead reads and refuse un-auditable exports
HIPAA §164.312(b) for SecurityService. The platform records every lead CHANGE (LeadHistory) and every login (SystemAccessLog) and records no READ at all, so "wh...
Public branded quote/estimate document at /{locale}/q/{token}
The customer-facing surface for the commerce quote system. Server-rendered so the org's branding is in the first paint — an unbranded flash on a commercial docu...
Quote REST surface — staff management and public share links
Staff endpoints at /api/security/commerce/quotes and an unauthenticated resolver at /api/security/public/quotes. QuoteController extends BaseLosController rath...
Quote/estimate domain — entities, pricing engine, share links
Adds a first-class Quote alongside the existing commerce spine. The pre-existing "ServiceQuote" is an Intent plus a JSON blob carrying one offering and one flat...
Egress containment for the avatar resolver, as a CiliumNetworkPolicy
Reinstates what 8f6c672 reverted, in the only form that actually works here. The earlier attempt failed because a plain NetworkPolicy cannot express this clust...
Show a facepile for group conversations
A thread with five people on it was represented by one arbitrary face, which reads as a message from one person. Up to three participants now overlap, so "sever...
Instrument the chain, reap expired entries, record disclosures
Every failure mode in this feature is silent. A latched circuit breaker, a worker queue discarding every task, a provider that started returning HTML — each loo...
Promote an ingested LLPA matrix into adjustments from the console
The ingestion panel could only publish a rate sheet. For an LLPA_MATRIX source document it now shows a "Promote as LLPA adjustments" card: pick the existing rat...
Gateway relay to promote an LLPA matrix into conditional adjustments
**************** gain promote-adjustments, mirroring the promote-rate-sheet relay: god-eligible gate, organizationId server-stamped onto the payload via write()...
Record call recording, voicemail and transcript access
Recording playback left no trace. A recorded call is the densest PHI the platform stores — the unredacted conversation — and "who listened to this call" was una...
Record PHI access on every read of stored AI conversation history
Wires the shared §164.312(b) spine into the paths that read persisted prompts and completions. The assistant is the module the compliance assessment put OUTSIDE...
Record chat message reads on the endpoints that return bodies
Sending a message left a row; reading one left nothing. Every chat, support and social thread on the platform renders from a handful of endpoints here, and none...
Record byte access on the four document paths that recorded nothing
/download already logged through **************** and it was the platform's only byte-access injection site. The sibling endpoints serving the exact same bytes ...
Contain egress from the avatar resolver; note the Redis eviction pool
SecurityService now runs a fetcher whose target URL is chosen by an untrusted party — a BIMI record is DNS content published by whoever owns a sending domain, a...
Show sender and recipient photos
The mailbox rendered a single letter on a single shared gradient for everyone, so every row looked the same and the circle carried no information. It now shows ...
Avatar endpoints; fix unauthenticated reachability and contact tenancy
Adds the mailbox side of sender avatars, and fixes three pre-existing holes this work would otherwise have built on top of. AUTHENTICATION. OTKPreAuthFilter us...
Sender-avatar resolution chain for the mailbox
Resolves a correspondent's email address to a picture, working outward from what Kamo already knows: member photo, then a photo someone attached to a contact, t...
Sender identity model + org-scoped batch email lookups
Backing store and queries for the mailbox sender-avatar chain. SenderIdentityEntity is the durable tier of the avatar cache. org_id is part of the natural key ...
Audit spine for PHI access — §164.312(b)
The Security Rule requires recording access to ePHI, which means reads. The platform records changes well — LeadHistory, SystemAccessLog, UserHistory, LoanAudit...
403 rather than 500 when the compliance boundary refuses
Two call sites of featureService.enableFeature now understand the HIPAA boundary: - /enable maps PhiModuleNotPermittedException to 403 carrying the reason, m...
Enforce the compliance boundary at the feature switch
Wires PhiTenantGuard into FeatureService, the single choke point through which a module is switched on for an organization. This is where the boundary stops bei...
Auto-assign a MERS-compatible loan number at application creation
LoanFile.loanNumber was null on create (both blank-create and lead-promote) and only ever set when a steward typed one — which hard-blocked MERS MIN minting (a ...
Render signer dates in the recipient's resolved timezone
SigningSession gains a required `timeZone` (IANA id) that ESigService resolves from the recipient's member zone, then the org's, then UTC. WelcomeScreen now pas...
Resolve signer display timezone from member, then org
Signing dates were rendered in whatever zone the client defaulted to, so an envelope expiring 2026-08-03T05:00Z could read "Aug 3" to a Pacific signer for whom ...
Create HANDLES_PHI and PHI_EFFECTIVE_DATE on orgs
Mirrors the two new Organization fields, following the OrgBrandingFieldsMigration convention, so the columns are reproducible on any environment rather than onl...
Persist handlesPhi and phiEffectiveDate on Organization
Backs PhiTenantGuard with a real column. HANDLES_PHI is NOT NULL DEFAULT FALSE following the **************** pattern, so every existing tenant is explicitly ou...
PhiTenantGuard and the module compliance boundary
The keystone of the HIPAA compliance boundary: which modules a tenant may reach, given whether that tenant handles protected health information. Everything down...
Create HANDLES_PHI and PHI_EFFECTIVE_DATE on orgs
Mirrors the two new fields on the Organization entity in kamo-shared-library, following the OrgBrandingFieldsMigration convention. HANDLES_PHI is NOT NULL DEFAU...
Emit the signer locale segment in signing links
Extracts the byte-for-byte duplicated buildSignLink into SignLinkBuilder and adds a locale segment sourced from Organization.language, falling back to English f...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.