The owners' invoice link opens on the workspace host the org can actually reach
Built internal.<domain> by hand, which OrgDomainRuleGuardTest forbids: an org whose own domain is not finished would get a link to a host that answers nothing. ...
The billing job takes each subscription and invoice in its own transaction
Its first run raised Harmony's October invoice and lost it when one audit insert failed, because the whole prepare step was one transaction.
Catalog edits reach only the caller's organization; own-order callers cannot comp or price themselves
Every update and delete of a subscription plan, price, feature, add-on, bundle, volume discount, promotion or agreement template now checks that the row belongs...
Creating a MORTGAGE market gives the organization its lender profile at once
A MORTGAGE market's lender profile (and its five config rows) was only created by the boot-time self-heal, so a market created while SecurityService was running...
The endpoint ratchet sees @RequireRight; the org-graph ratchet allows two read-only hits (SITP TPGUARD)
**************** flagged the TP02 billing and commerce-invoice relays. Not a hole: every commerce-invoice handler carries @RequireRight (TenantRightInterceptor ...
Staff can delete a never-received mortgage application; a received one answers 409 (SITP TP21FU)
DELETE **************** went through AppMortgageService.delete, which 500'd for every application (borrower satellite rows left behind). The shared library now ...
Every clinical audit row names its patient; pick up the shared-lib audit and updated_at fixes (SITP TP23FU)
Production phi_access_log rows from the clinical audit methods carried no purpose, basis or patient: the shared PhiAccessRecorder dropped them while stamping th...
Starting a clinical note no longer fails on updated_at (SITP TP23 live smoke)
ClinicalBaseEntity.updated_at is NOT NULL and defaulted by the database on INSERT only (insertable = false), so a note just inserted holds null in memory and th...
Booking an appointment no longer fails on an untyped null in the conflict check (SITP TP23 live smoke)
findConflicts' (:excludeId IS NULL OR a.uid <> :excludeId) with a null UUID is an untyped parameter on Postgres/Yugabyte ('could not determine data type of para...
A booking or registration is always a new record in the caller's practice; SI note drafts say so; billing reads write the PHI trail (SITP TP23)
- SchedulingService.book: the body is the entity, so a uid in it made save() a merge onto that appointment in ANY practice (and moved it into the caller's); s...
Subscription records, market lists and order notes reach only the caller's organization (SITP TP17)
SubscriptionService reads a subscription, its order, invoice and agreement by uid alone, in any tenant. POSController now checks the record is the session organ...
State licences are read and replaced only within the caller's organization (SITP TP16)
GET/PUT **************** found the member by id alone, so a holder of STATE_LICENSING_VIEW_ALL / EDIT_ALL in one organization could read, replace or delete anot...
Rights on the session-only controllers, with the grant backfill (SITP TP01)
@RequireRight (any-of, tenant RoleRightType) enforced by TenantRightInterceptor before the handler, the tenant counterpart of @RequirePlatformRight: no session ...
Rights on the lead doors the SI tools use, and the caller's own callbacks due (SITP TP10)
- PUT /leads/{id} takes EDIT_LEADS; a create that assigns someone else takes ASSIGN_LEADS - the lead pool (/leads/available, /leads/accept) takes VIEW_LEADS or ...
Patient-merge hooks run after the merge commits, so a failing hook can neither undo nor poison it
CreateClaim writes charge and units, sets the claim total, refuses a blank payer
Run the sign-in detection rules, and make their responses real
SuspiciousDetectionService was injected into SecurityController and evaluate() was never called, so every rule an organization configured on the Security screen...
Encrypt legacy signing secrets at boot; a refused target URL is a 400
The service side of kamo-shared-library e58f1a93 (target vetting + DNS pinning, failure categories, encrypted signing secrets). - **************** (re-runnable...
Seal Google/Microsoft calendar OAuth tokens at rest; re-seal legacy rows at boot
GoogleCalendarService and MicrosoftOutlookService stored the access and refresh tokens on third_party_integrations as the provider issued them, although the ent...
Save answers before the rights fan-out, not after it
Saving a security model (e.g. its Default Security Roles) re-seeded and recalculated member rights for every org using the model before it responded. A model sh...
The profile save stores the member's address
The My Profile Address card posted { address, addressDetails, locality, subdivision, postalCode, country } and PUT /members/{id} never read the key, so every sa...
The guided-tours read answers the member's CURRENT Show Tour rights
A session carries the rights it was issued with and the routine refresh does not re-read them, so everyone signed in before the Show Tour rights existed saw no ...
The boot-time rights sync inserts a role's missing rights in ONE statement
b8014ab3's deploy never became ready. The 31 Show Tour rights made the row-at-a-time insert loop 31 YugabyteDB round trips per role — ~3.5 s a role, ~490 s acro...
An SI's charter read is retried on a YugabyteDB conflict instead of answering 503
GET **************** (I1) resolves the charter in one read-only transaction of 15-25 queries. One "Restart read required" (40001) answered 503 CHARTER_UNAVAILAB...
The lead page names its Vendor and Product
Lead.vendorProduct is @Transient — only VENDOR_PRODUCT_ID is a column — so nothing loads it unless someone asks, and LeadDTO.fromLead then leaves vendorProduct,...
A change to a member's teams is on the security access log — one SECURITY_SETTING_CHANGE/MEDIUM row per member who joined or left, from the team, the member's profile, a deleted team or creation (KamoCollab CP01 final review I1)
A team is a level of the rights waterfall, so joining one is a grant (CP01-T14-1). The department and job-title change on the same Position card writes an acces...
Pin the heads' names query onto users_pkey — /*+ IndexScan(u users_pkey) */ first in the statement, as loadMembers and the org chart's people query; without it the legacy planner seq-scans all of users per head row (KamoCollab CP02 final fix)
Production EXPLAIN (sp00verify, read-only): the unhinted literal plan was a nested loop over Seq Scan on users (106 rows) for 1 and 2 ids; with the hint every p...
The failed-recalculation log names the repair path as /teams/{id}/recalculate-rights
SLF4J has no brace escape, so "{{id}}" was logged literally. "{id}" is not a placeholder and prints as written; the test now pins the path an operator would typ...
A created member's activation welcome waits for the commit, so a swallowed 40001 can no longer turn the create into a silent rollback
POST **************** answered 200 with a member id and a user id that never existed (KamoCollab CP00 Task 0, 2026-10-05, sp00verify). The activation welcome ra...
A rename clears the phonetic spelling of the name it changed (SP94-F-1)
The AI's speech pairs the org's CURRENT name with whatever spelling is stored. The Getting-Started wizard renames through PUT /org/{id} without sending a spelli...
Assigning a computer reads the one member, not the whole organization
HostedComputerAccess.isMember loaded every member of the organization to test one id, and emailOf, called right after it on the same assign path, did the same t...
The AI-dispatch audit trail names people the same way chat does
**************** hand-duplicated MemberDisplayNames' pre-fix precedence (usernameAlias wins unconditionally over the real name), with its own comment warning th...
An address on either platform apex signs in to the account holding its twin
The owner signed in on login.kamouniverse.com with the brand's new address and was told "User does not exist". The account's address is Sage@KamoCRM.com. Since ...
A like is stamped, so it saves
media_obj_reports.date_created is NOT NULL, and the like was built without it: @ColumnDefault only shapes the DDL, so Hibernate wrote NULL and every like failed...
Edit, like and delete one post or note by its own id, never the whole stream
A feed, the organization's (the Clubhouse) or a lead's notes, is ONE POST session and every post or note is a message in it, so every item the feed lists carrie...
SPF advice recognises kamouniverse.com; the brand's aliases are reserved on both apexes
SPF: kamouniverse.com publishes the same record as spf.kamocrm.com (v=spf1 ip4:47.181.8.84 mx -all), so a customer who wrote include:kamouniverse.com has alread...
Platform fallbacks name the primary apex, not a kamocrm.com literal
Four places kept their own "kamocrm.com" literal as the platform host they fall back to, so they could never follow the brand to kamouniverse.com. Each now read...
One organization can no longer take another's <alias>.kamocrm.com routing
Any member of an organization with no root could add the root victim.kamocrm.com (POST /api/security/domains checked no right). Listing the domains then self-he...
A lead's notes stream, addressed by its guid, keeps the lead's own read rule
Every note on a lead now sends the lead stream's guid on /topic/media/feed/<orgId> (SP99-T3), which any member of the organization may subscribe to. The guid-ad...
A new commit log is translated at once, not behind the sweep's backlog
The first translation of a commit log and the sweep's retries shared one three-thread executor, first come first served. With the SP99 T6 repair's 326 commit lo...
The translation recount is the first statement of its own transaction
A locale save was an upsert and then a recount that reads the commit log's rows, in one transaction. Yugabyte restarts a read transparently only when it is the ...
One pod at a time translates a commit log, and a finished one is not redone
Both SecurityService pods run the translation sweep: its lock lasts only as long as the dispatch. Each took up the same 50 commit logs, and a pod's in-flight se...
A re-translation no longer deletes the translation it replaces
Since 1f715e4 (2026-09-23) saveLocaleTranslation loaded the locale's row to decide whether the count moved, bulk-deleted it and saved a new one. The load left t...
Close the AI identity edge cases the SP02 review left open
- A never-hired AI relabelled a person no longer keeps ai_state and the pause columns (master 6.1: NULL for a person). They are written only by SQL, so the ...
A lead you may not open takes no status change and no note
PUT /api/security/leads/{id} and POST /api/security/media/posts checked only the lead's organization, so a member without VIEW_UNASSIGNED_LEADS could change the...
CalDAV and CardDAV sign in with a username and password, through every sign-in gate
EmailService's DavAuthFilter posted Basic credentials to **************** a route that never existed (405), so since 2026-03-19 no phone (iOS, DAVx5) could add ...
Clear the session cookie on the bare apex, not ".apex"
Logout built the cookie domain as ".kamocrm.com". Tomcat's RFC 6265 cookie processor refuses a leading dot and throws, so logout answered 500 "Logout failed" af...
A platform apex can't be removed from the DNS page
The platform organization gained kamouniverse.com as a second root domain, and the DNS page then offered "Remove" on kamocrm.com. Deleting it took kamocrm.com a...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.