Live Change Log

KamoCRM owns several markets **************** so resolveProductMarket must pick the SUBSCRIPTION-type (platform-access) market rather than the first active one....

EntitlementService now resolves each member's entitlement root via EntitlementRootResolver (nearest market-owning ancestor-or-self) instead of walking to the to...

provisionUpdate (run on every custom-labeling save) wrote config/css/manifest but never regenerated favicons — those were only produced by provisionFull. An org...

provisionUpdate (run on every color save) rewrote the org's css/globals.css in place, but that object only exists once provisionFull has copied it from the defa...

The SecurityService image at 761019b was built before shared-lib d14dc54 (which renamed the personal-loans Loan entity to JPA name "PersonalLoan" to resolve the...

The /Next.js/KamoLOS project (mortgage applicant flow) was renamed to KamoMLOS so the KamoLOS name could be reused for the new personal-loan service. These are ...

DataLoader now calls **************** after the AppMortgage-engagement backfill. Sweeps every existing MORTGAGE CommerceMarket and ensures its program Offerings...

The previous fix wired the applied-model projection into **************** but called org.setFeatures(projected) on the still-managed entity. The Organization.fe...

SecurityController had a second **************** that collided with **************** Spring rejected the request with "Ambiguous handler methods mapped" → 500 →...

- MortgageProgramController gains PUT **************** with body {"isActive": bool}, gated on LOS_TAKE_APPLICATION. Delegates to **************** which upse...

DataLoader now invokes **************** after rights sync and System User backfill. Idempotent — once an app is attached to its engagement+intent, subsequent bo...

- MortgageAppController: every endpoint now gates on RoleRightType. Reads require LOS_VIEW_PIPELINE; creating a new application requires LOS_TAKE_APPLICATIO...

Two changes that finish the kamo-los borrower-facing branding pipeline: 1. OrganizationController gains a public GET /api/security/org/domain/{host} endpoin...

Exposes the connect-first capture surface at **************** - GET/POST /connections + POST /connections/{id}/complete - GET/POST /verified-facts + POST /verif...

Adds micrometer-registry-prometheus and configures management.endpoints to expose /actuator/prometheus alongside health/info. Required so the counters/timer add...

Aggregates validation issues across the LAR for the given year and returns {errors, warns, rowsWithIssues} so the UI can render a one-line banner before the ope...

Surfaces **************** as an advisory pre-flight check the TransitionDialog fires when the user picks a target status.

Six LOS-area controllers (MortgageApp, MortgagePipeline, MortgagePricing, MortgageDisclosure, MortgageHmda, WebhookSubscription) each copied the same ~80 lines ...

Backs the JetStream durable consumer in WebhookDeliveryWorker. Env-var overrides for the durable name, deliver-policy (set to All to replay backlog one-time), m...

Pairs with the shared-lib optimistic-lock change: when LoanPipelineService throws "Concurrent modification: refresh and retry", surface a structured {error, cod...

- MortgageAppController: POST /{uid}/reos/{reoId}/liens, PATCH /{uid}/reo-liens/{id}, DELETE /{uid}/reo-liens/{id} — delegating to the new BorrowerSectionSe...

Three new REST controllers under /api/security/mortgage-apps: - MortgagePricingController: pricing snapshots, rate locks, AUS findings CRUD ({uid}/pricing, {...

Exposes the LOS pipeline backend under /api/security/mortgage-apps: - GET /pipeline — kanban summary - GET /{uid}/pipe...

New REST controller exposing the full URLA application lifecycle: GET /api/security/mortgage-apps list (summary) GET ***************...

The NavTop language picker did nothing for the System User signed into a sub-org: PUT **************** runs SystemUserGuard first, which 403s every System-User ...

Child orgs that picked a Kamo web alias (e.g. gnosia.demo.kamocrm.com) were getting "TXT record found but verification code doesn't match" in the DNS setup UI. ...

deleteDomain and updateDomain previously rejected platform admins operating on child-org domains because they checked isUserOwnerOfOrg against the target org di...

The endsWith(".kamocrm.com") guard blocked every demo org from swapping its platform subdomain (e.g. gmosia.demo.kamocrm.com) for a custom domain. The platform ...

Picks up: - HIGH: **************** refuses NUKE/FORCE_NUKE on admin-essential rights for the ADMINISTRATOR template. - MEDIUM: **************** now re-runs ...

This reverts commit ****************

When a user creates a child org they become its owner + admin (via **************** Their PARENT-org membership, however, is whatever it was before — typically ...

**************** / updateModel / deleteModel and **************** now invoke recalcAllMembersUsingModel after persisting changes — every org pointed at the mode...

Picks up the JPA fix that lets orgs.country (smallint) accept the int ordinal Hibernate writes for CountryType, unblocking POST /api/security/org from the /netw...

After **************** assigns the Administrator role and writes member_rights_applied, the OTK-minting block was re-reading those rows via **************** ins...

After createOrganizationOwner, mint a fresh *** bound to the new owner TeamMember and return its OTK alongside id/members. Without this the creator stays on the...

COMP orders are now provisioned automatically on SecurityService startup via SubscriptionService @PostConstruct. Manual endpoint no longer needed.

POST **************** calls **************** then invalidates entitlements for the target org via EntitlementService.

Backs the new hex-head popover size selector and any future small per- member UI preference. Endpoints under /api/security/members/me/ui- preferences resolve th...

This reverts commit ****************

Child-org admins (like GNosia's owner Daniel) have their COMP subscription orders on the root KamoCRM org, not on their own org. FeaturesManager was querying t...

Workflow-level concurrency serialized the whole pipeline (including kubectl rollouts). Move the group to the build job only so deploy jobs from different runs c...