A broken servicing rule answers 409 with its own words, not a 500 (SITP TP22)
The services refuse with plain exceptions (offer must be DRAFT to send, draw would exceed credit limit, reason is required, an unknown id's orElseThrow), which ...
A loan offer is drafted only on the organization's own product and borrower, the aging report counts only its loans, and staff acts are the organization's (SITP TP22)
- POST /api/los/offers: the product must be the caller's organization's and the borrower a member of it (or of a child organization); a body naming another te...
KamoLOS checks the PLOS right and the organization on every route, and opens a one-time-key door (SITP TP02)
KamoLOS enforced no right: kamo-internal's /api/los proxy was the only gate. LosRightsFilter now applies the proxy's own requiredRight() table (LosRights) to ev...
Stop logging the database password at startup
com.zaxxer.hikari at DEBUG makes HikariConfig print its whole configuration on every start, including dataSourceProperties {password=...} and password......; Pr...
Accept OCI image indexes when resolving the built digest [skip ci]
The images are pushed as OCI image indexes, so asking the registry for a single image manifest only answered 404, the digest came back empty and the check faile...
Restart when a same-commit rebuild leaves pods on the old digest [skip ci]
The rollout step tried to detect a same-commit rebuild by comparing the Deployment's image reference before and after `set image`. "Apply manifests" has already...
Prove the deploy by digest, not by tag
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Scope statements, draws and payments to the caller's organization
Same bug as LoanController.get(uid), repeated: these controllers took a loan id off the path and handed it to a repository, so GET /api/los/statements/by-loan/4...
A loan id is not a credential — scope every LoanController read to the org
LoanController.get(uid) took a loan id and returned whatever it found. Any caller who reached the service got the loan, balances and borrower included, whicheve...
Declare security matchers explicitly before the next build breaks startup
kamo-shared-library 1.5.0 was republished today with spring-ws-core as a new transitive dependency, so Spring Boot now auto-registers a second servlet (MessageD...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Default empty STRIPE_CONNECT_WEBHOOK_SECRET so KamoLOS boots
The configmap referenced **************** without a default, so Spring's placeholder resolver threw before reaching the Java-level **************** which alread...
Track shared-lib LoanRepository → PersonalLoanRepository rename
Updates every import and field type from LoanRepository to PersonalLoanRepository across 20 KamoLOS source files + 1 test (Lombok-injected field names stay as l...
Tier 1 critical correctness pass
T1.1 Stripe disbursement strategy: TREASURY (stub — requires SDK upgrade or raw HTTP) / CONNECTED_ACCOUNT (Transfer.create — works in SDK 28.2.0) / MA...
Drive journey sky from SkyToggle, unstack from personality chip
- Move SkyToggle to its own top-right row at top-14 so the slider stops overlapping LoGuideChip, which is positioned at right-14 assuming it only needs to c...
Lift home CTA cluster above the LenderFooter
Buttons at bottom-12/sm:bottom-14 were clipped by the lender attribution footer (~76px tall on desktop). Bumped offsets so the cluster clears it.
Stop personality chip overlapping the SoundToggle
LoGuideChip was absolutely positioned at top-3/right-3 in JourneyHero and JourneyApplyLayout, the same spot as the global SoundToggle in app/layout.tsx. Shifted...
Stop racing hydration with a 404 — render the logo URL that actually exists
The tenant MinIO bucket holds logo-full.svg / logo.svg as canonical names; nobody uploads the -on-dark variants. We were trying the dark-mode URL first, 404'ing...
Unwrap SecurityService's nested color wire-format so tenant brand vars actually populate
SecurityService returns Organization with colors nested inside an EmbColorPalettePair ({ colors: { colorPri: { colorPri, colorLight, ... } } }) and stores hex w...
Render the logo img on the SSR pass — no more wordmark-only flash
ThemeLogo's empty-string initial logoSrc + useEffect-to-fill pattern meant the SSR render returned the wordmark fallback, then hydration populated the src. If a...
Kill fake-tenant defaults, render the actual org's branding only
Removes the Apex Mortgage demo I should never have added and the Kamo "default" fallback I replaced it with. Both were just papering over a missing-tenant condi...
Ship default logos so unbranded hosts render a real lockup
Ported ThemeLogo dropped the local-file fallback the kamo-internal original had, so any host whose tenant MinIO bucket hadn't been provisioned (or doesn't exist...
Preserve aspect ratio on sky atmospherics so clouds + sun + birds don't stretch on portrait
CloudsLayer, BirdsLayer and the sun/star portion of SkyLayer were using preserveAspectRatio="none" so on a tall portrait phone the SVG coordinate system stretch...
Mobile portrait tuning for hero illustration + chrome
On a portrait phone the 100x60 viewBox of every layer was being stretched into a tall narrow rectangle, which made the home and foreground look squashed and wei...
Illustration wrapper had no height — every layer rendered into a 0px strip
The JourneyIllustration root div was `relative overflow-hidden` with no explicit dimensions. Its parent was sized via absolute inset-0, but the relative child o...
Sky no longer washes to white — golden-hour default + tuned sky shader
Sky was reading white because: - toneMappingExposure 1.05 + Bloom@0.45 with luminanceThreshold 0.72 was blowing the bright procedural sky into the bloom buffe...
Post-porch borrower lands in the 3D world (/journey/persona then /journey), not the legacy MUI wizard
Reward gate + auto-resume now route to /journey/persona?app=<uid>, persona pick lands in /journey?app=...&persona=..., and a persistent 'Continue your applicati...
Welcome-back gate must only trigger for true returning visitors
Brand-new visitors were hitting the welcome-back gate the moment they entered their name, because hasPriorProgress was recomputed from current state on every re...
Default flow + remove isDone-only auto-advance to estimate
The real bug behind users landing on the estimate-reveal screen even after "Start over": the flow engine returns DONE when state.flow is null (no flow chosen → ...
Force-dynamic so fresh deploys aren't masked by cached HTML
The homepage was statically prerendered (○ / in the build output), which means the same HTML — and its embedded references to specific chunk hashes — was served...
Welcome-back gate + always-available "Start over"
Returning visitors with persisted IDB state were being dropped straight into whatever stage they last reached — including the estimate-reveal screen, which (wit...
Align Dockerfile with kamomarketing pattern (node:24-alpine, 2-stage)
CI build failed in node:20-alpine on `npm ci` because npm 10.8 (bundled with Node 20) resolves Next.js's @swc/helpers peerDep (>=0.5.17) to 0.5.21 while the loc...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.