Invoices print the Receivables ACH details exactly as quotes do
The PDF and the email now carry the quote's remittance block, word for word: - Remit payment to - payee (legal name) - bank - routing number (ABA) - account num...
Rebuild - the previous run could not reach data.forgejo.org to fetch actions/checkout
Endpoints for dated, prorated seat and license changes; the job applies them
New endpoints: - POST **************** - POST /subscriptions/{uid}/changes - GET /subscriptions/{uid}/changes - POST **************** The hourly billing job ap...
Customers pay invoices by card online; a bank's SCA request reaches the customer
On invoices sold by the platform org (the only seller whose Stripe account it is): - the public invoice offers Pay by card: POST **************** opens a Stri...
The owners' invoice link opens on the workspace host the org can actually reach
Built internal.<domain> by hand, which OrgDomainRuleGuardTest forbids: an org whose own domain is not finished would get a link to a host that answers nothing. ...
Refuse a department or contact mailbox past the email licenses
Owner rule 2026-10-22: per-user add-ons bill the licenses purchased; how many mailboxes may be in use is limited only by them. Under a 3rd-party provider a depa...
Record offline acceptance, log prints, convert quotes into subscriptions
- POST **************** (SEND_QUOTES or MANAGE_QUOTES) - POST **************** (VIEW_QUOTES or MANAGE_QUOTES) - POST .../{uid}/convert takes an optional body (t...
Endpoints to set a subscription's auto-renew and an order's notes in any status
Card customers are charged automatically on the billing day
For AUTO_BILL subscriptions the billing job charges each approved invoice to the customer's saved card on its billing day through BillingService's internal card...
The billing job takes each subscription and invoice in its own transaction
Its first run raised Harmony's October invoice and lost it when one audit insert failed, because the whole prepare step was one transaction.
Automatic subscription invoicing - drafts, owner review, email with PDF, payments, reminders
SubscriptionBillingJob (hourly, one pod, and at startup) runs the cycle: - raise each renewal invoice as a draft lead-days before its billing day - move subscri...
Catalog edits reach only the caller's organization; own-order callers cannot comp or price themselves
Every update and delete of a subscription plan, price, feature, add-on, bundle, volume discount, promotion or agreement template now checks that the row belongs...
Creating a MORTGAGE market gives the organization its lender profile at once
A MORTGAGE market's lender profile (and its five config rows) was only created by the boot-time self-heal, so a market created while SecurityService was running...
The mortgage pipeline loads in a handful of queries, and a deal can be renamed and take a second loan
The pipeline's two reads were N+1 on the round trip: - GET /mortgage-apps loaded plain AppMortgage rows, and each one then fired a SELECT per inverse @OneToO...
Approve and always allow checks the rights a tool needs in one case only
Approval follow-up 2026-10-21: the Tool Plane's card now names the rights a tool's service enforces in some cases only (alwaysAllow.rightsWhen: a colleague's le...
S-I1 accepts REPLACED, so IoTService revokes a superseded Alexa link's grant
Owner 2026-10-21. KamoOAuthRevokeReason.REPLACED already exists (STRING-persisted, no CHECK on revoked_reason), so no shared-lib or DDL change; the internal rev...
Approve and always allow, from an SI's approval
GET **************** POST **************** {approvalId, scope TOOL|CLASS, grantRights?} DELETE **************** (Ask me again) The approval names the tool and...
An order lends only the rights the called tool needs (No Insubordination Rule, IoT R7 round 3)
POST **************** takes an optional neededRights (RoleRightType names; an unknown one is a right nobody holds). With it, OrderDelegationService.lend borrows...
Index loan_files.loan_transaction_id, applied to production 2026-10-18 [skip ci]
Owner approved. The deal -> loans lookup in **************** (deal status, pipeline summary, retireIfEmpty) moves from a sequential scan to an index scan. Same ...
Fixtures stamp the god-mode window's end; an elapsed window is not elevated (shared SessionPlatformFacts expiry)
**************** now also needs godModeExpiresAt ahead (kamo-shared-library 1.6.1), so the open-window fixtures of the 28 test classes whose gates read it (Sess...
The endpoint ratchet sees @RequireRight; the org-graph ratchet allows two read-only hits (SITP TPGUARD)
**************** flagged the TP02 billing and commerce-invoice relays. Not a hole: every commerce-invoice handler carries @RequireRight (TenantRightInterceptor ...
Staff can delete a never-received mortgage application; a received one answers 409 (SITP TP21FU)
DELETE **************** went through AppMortgageService.delete, which 500'd for every application (borrower satellite rows left behind). The shared library now ...
Every clinical audit row names its patient; pick up the shared-lib audit and updated_at fixes (SITP TP23FU)
Production phi_access_log rows from the clinical audit methods carried no purpose, basis or patient: the shared PhiAccessRecorder dropped them while stamping th...
Starting a clinical note no longer fails on updated_at (SITP TP23 live smoke)
ClinicalBaseEntity.updated_at is NOT NULL and defaulted by the database on INSERT only (insertable = false), so a note just inserted holds null in memory and th...
Each break-glass window has its own id, so other services can audit under it (IoT R7)
A god-mode window now carries godModeSessionId (a random UUID) in ***: minted when it opens, cleared when it closes, and added to a window that was opened befor...
Booking an appointment no longer fails on an untyped null in the conflict check (SITP TP23 live smoke)
findConflicts' (:excludeId IS NULL OR a.uid <> :excludeId) with a null UUID is an untyped parameter on Postgres/Yugabyte ('could not determine data type of para...
The loan-officer door reaches the MLOS engines, writes take write rights, and an SI clears the MLOS walls (SITP TP21)
New relays on /api/security/mortgage-apps (MortgageLoanDeskController, @RequireRight, the caller's org's loan only): - GET /{uid}/qualification, /{uid}/engine-l...
A booking or registration is always a new record in the caller's practice; SI note drafts say so; billing reads write the PHI trail (SITP TP23)
- SchedulingService.book: the body is the entity, so a uid in it made save() a merge onto that appointment in ANY practice (and moved it into the caller's); s...
The iot.alexa client is named for the KamoUniverse skill; record the applied rename (SP09) [skip ci]
PREPARE_COMMISSION_PAYOUTS composes the draft payout batch, seeded to every finance manager (SITP TP18)
Opening the draft batch and adding, changing or removing its lines now take MANAGE_ORG_FINANCES or PREPARE_COMMISSION_PAYOUTS (the owner always); sending a batc...
Devices is a standard alias
Required like careers and computers: the record is what makes shared device access open anywhere. The kamo-iot share pages are served at devices.<domain>; the l...
Reserve the devices alias, not iot
The kamo-iot share pages are served at devices.<domain> (owner 2026-10-18: "iot" is a technical term; anything customer-facing says devices). OrgAliasPolicy res...
The billing door makes a member a licensee before a seat, and reads usage for the org billing rights (SITP TP18)
BillingService's LicenseService.assign refuses anyone who is not already a licensee of the subscription, so the relay's seat assign alone could not seat a new m...
HR reads a member's leave balances, as it already spends and corrects them (SITP TP18)
GET **************** own on identity (as /me/accruals), anyone else's with MANAGE_TIMECARDS, the right that already gates /use and /adjust on the same balances;...
Subscription records, market lists and order notes reach only the caller's organization (SITP TP17)
SubscriptionService reads a subscription, its order, invoice and agreement by uid alone, in any tenant. POSController now checks the record is the session organ...
Rights-carrying doors to commerce invoices and billing, and the MANAGE_ANALYTICS backfill (SITP TP02)
Commerce invoices: InvoicingService's CommerceInvoiceController checks no right by design (it expects SecurityService to own the session and the rights) and not...
State licences are read and replaced only within the caller's organization (SITP TP16)
GET/PUT **************** found the member by id alone, so a holder of STATE_LICENSING_VIEW_ALL / EDIT_ALL in one organization could read, replace or delete anot...
Rights on the session-only controllers, with the grant backfill (SITP TP01)
@RequireRight (any-of, tenant RoleRightType) enforced by TenantRightInterceptor before the handler, the tenant counterpart of @RequirePlatformRight: no session ...
Rights on the lead doors the SI tools use, and the caller's own callbacks due (SITP TP10)
- PUT /leads/{id} takes EDIT_LEADS; a create that assigns someone else takes ASSIGN_LEADS - the lead pool (/leads/available, /leads/accept) takes VIEW_LEADS or ...
A clinician's direct order never lends an SI the clinical acts
SITP TP00: pins the new SI floor (kamo-shared-library 645068bb) through the No Insubordination delegation: drafting notes, booking and posting payments are lent...
Remove a committed diagnostic log that carries the database password and the password pepper
k8s/diagnose-output.txt (2025-11-03) is a startup log captured with com.zaxxer.hikari at DEBUG. Nothing reads it. Removing it does not clear history; the values...
Report option providers and Account merge keeps tagged devices (SP13)
IoT reports — no god mode, the owner rule, and ReportDefinition.exportRight enforced at download, schedule and every run (SP13)
SecurityService opens Service Work jobs for IoT — endpoints, one-transaction opener, crossapp scan (SP13)
SecurityService resolves the two IoT charter classes (SP11)
The charter catalogue lists 24 action classes (the owner's JOIN_MEETING made 22; IoT SP11 appends OPERATE_DEVICE and OPERATE_SECURITY_DEVICE, both APPROVE_BEFOR...
Purge sweep, OAuth configuration and the repository scan (IoT SP09)
Internal grant revocation for IoTService and platform client administration (IoT SP09)
Token endpoint with PKCE, rotation with a 24-hour grace, reuse detection and RFC 7009 revocation (IoT SP09)
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.