Point the letterhead logo at the path the theme bucket actually serves
The logo URL was built as **************** which that host answers with a 308 rather than an image — so every quote, sent as well as previewed, silently fell ba...
Fail the build when a component calls a key messages/ does not define
next-intl renders the key path verbatim for a missing key, and messages/ is gitignored here — populated at image-build time from kamo-translation-dictionary — s...
Pin/unpin nav options from the navs and the home launchpad
Members could move an option between the side bar and the top bar, but never take one out of the navs entirely. Adds a third placement — NONE, "unpinned" — and ...
Directory sub-tabs pick up the same scrim as the Chats sub-tabs
The Chats sub-tabs have no shadow of their own — the soft edge under the tab strip is the panel's 16px top scroll scrim, which lands on them because they render...
Department contact fields showed raw i18n keys
The contact block added with the bulk-email work called departments.departmentEmail / departmentEmailHelper / departmentPhone / departmentExtension, but the dic...
Directory status filter adopts the Chats sub-tab treatment
The All/Online/Offline control was a pill segmented toggle while the Chats pane directly below used underline sub-tabs, so the two panes filtered their content ...
Deliver attached images, and stop two compose windows sharing a toolbar
AI chat attachments were never reaching the AI. AiChatInput sent the storage paths as `imageUrls`, but the REST body in AiChatWebSocketContext reads `imageObjec...
Stop tool windows losing and leaking member-typed content
Follow-up to the popup-window persistence work. Each of these was verified against real code first; three of the original reports turned out to be wrong or over...
Hide empty departments, move the status filter into the Directory
- Departments with no members no longer render. The by-department endpoint returns every department in the org including empty ones, so the roster was showi...
Departments no longer open invisible on first render
The Directory tab came up empty until you switched to Chats and back. The members were always there — every department was parked at opacity 0. Sections were r...
Stop losing popup tool windows (and unsent drafts) on page changes
Tool windows lived only in a module-level in-memory store, so any full document load destroyed every open window and everything typed into it. Several internal ...
Move break glass into the primary rail
The activation control was a fixed pill anchored to the bottom-left of the viewport. That put a privileged action somewhere nothing else lives, which reads as a...
Rebuild the slideout as one continuous surface
Member rows now form the department body directly — no card-on-card nesting — and departments run full-bleed with sticky bands, reclaiming ~30px of row width an...
Drop the dead 'just extended' UI from the timeout popup
justExtended was never set to true — the popup closes on extension rather than showing a success state — so the CheckCircle2/Shield branches, the alternate titl...
Require ACTIVATED god mode to read the trail, not eligibility
PhiAuditController.hasRight() bypassed the right check on session GD alone. GD means "may activate god mode"; godModeActive means "has activated it, deliberatel...
Selecting Quotes no longer bounces back to the first sub-tab
Clicking Quotes set the index to 2 and wrote ?sub=quotes, but the effect syncing state back from the URL mapped anything that was not "commitments" to 0 — so it...
Harden the original session-timeout stack
Review of the **************** path after removing the duplicate idle stack turned up four real defects: - sessionMonitor.start() left its 3s bootstrap setTime...
Let the stage grow so the chrome pod gets an even gap
The pod (now taller with the tone slider) becomes the stage's only in-flow child: fixed height becomes a minHeight, with 16px padding above and below the pod (c...
Remove duplicate idle-logoff stack; SessionManager already covers it
The Aug 2 HIPAA session added **************** as a second, parallel idle system. The layout already had the original one — ClientActivityTracker + SessionManag...
Detection and alerting over the record-access audit trail
phi_access_log has been accumulating evidence nobody looks at. That satisfies §164.312(b) — the trail exists — and satisfies nothing about §164.308(a)(1)(ii)(D)...
Preview variables for PHI_ACCESS_ALERT
Without a sampleVariables arm the admin Email Templates preview renders every placeholder blank, so whoever is asked to approve the wording of a security alert ...
PHI_ACCESS_ALERT canonical template
SecurityService's hourly review of phi_access_log needs somewhere to send what it finds. Rather than invent a channel it uses the existing transactional-email r...
Restore CRLF endings on CustomFormFieldsComponent
The previous commit rewrote the file whole and flattened its line endings, turning a nine-line change into a 633-line diff and setting up a needless conflict fo...
Mirror the lead minimum-necessary mask on the client (§164.502(b))
SecurityService now withholds custom-form answers from a caller who is not the lead's assignee (and, in a handlesPhi tenant, even from a holder of right 161). T...
Minimum-necessary masking of lead custom-form answers (§164.502(b))
The platform's only field mask was **************** applied by LeadController.getLeadById to a caller who is neither god nor the assignee and lacks VIEW_LEAD_CO...
PHI access audit viewer — org review and per-record accounting
The trail was being written and nothing could read it. This is the screen half: an org-wide access review under Settings → Security, and a "who has accessed thi...
Retitle member page to Profile, shorten tab labels, add tab icons
The member settings page header becomes "My {memberLabel} Profile" (or "{memberLabel} Profile" for another member) and the nav-top link becomes My Profile. Tab ...
Tone slider — whitewashed to full color to blacked out
A per-member backgroundTone ui-preference (0 white / 50 full color / 100 black) rendered as a wash above the readability scrim in both the console slideshow lay...
Launcher cards and hero use the org's brand color instead of per-module accents
The home launchpad's option cards, drag overlay, and first-org hero now take their accent from var(--color-primary) (the org's dynamically set theme color) rath...
Break-glass god mode — reason prompt, countdown, standing indicator
God mode had no UI at all in kamo-internal: a localStorage boolean that a mount effect mirrored into ***, re-asserted on every new tab forever. That made the br...
Read the PHI access trail — §164.528 accounting and activity review
The trail has been written for a while and nothing could read it, which left two obligations unmet: an accounting of disclosures for one individual's record (§1...
MFA enrollment screen and the god-mode PHI boundary control
Two settings surfaces for backends that had none. MFA enrollment (settings → my profile → Sign-in Security, self only). SecurityService's /api/security/mfa end...
Endpoint to read and move an organization's HIPAA boundary
Organization.handlesPhi has existed as a column with no way to set it, so PhiTenantGuard has been enforcing a flag nobody could turn on. This is the missing hal...
Rebuild the quote form as a guided flow, add an output preview
The details tab was a flat stack of outlined boxes that gave every field the same weight, so nothing signalled which inputs actually change what the customer se...
Audit vocabulary for a change to the compliance boundary itself
Adds PhiResourceType.ORGANIZATION and PhiAccessKind.CONFIGURE so that turning Organization.handlesPhi on or off can be recorded as what it is. Every existing r...
Serve the customer-facing view to staff for preview
GET /{uid}/preview returns the same PublicQuoteView the share link serves, from the same QuotePresentation resolution, so a previewed letterhead cannot differ f...
Share the letterhead resolution between the public page and staff
The staff preview has to show exactly what the customer receives, so branding, the document term and the link host now resolve in one place. Two copies would dr...
Scan uploads for malware at ingest (§164.308(a)(5)(ii)(B))
The document vault accepted arbitrary uploads with no malware scanning anywhere on the platform, and it is multi-tenant — a file one org uploads is opened by an...
Retry npm ci in the Docker build against flaky runner egress
The k1m1 runner intermittently corrupts TLS streams mid-fetch **************** killing the image build in npm ci. Give npm fetch retries and retry the whole ins...
Break-glass god mode — justification + 30-minute time-box
God mode activated silently and lasted as long as the session. That is the control a covered entity's security review pushes hardest on, because "your staff can...
Reorder steward tabs; fold Identifiers into a pipeline find-loan popover
Tab order is now Pipeline, Documents, Underwriting, Pricing, Capital & Risk, Governance, Ingestion, Catalog — Pipeline becomes the default landing screen. The ...
Route the transaction pipeline screen through ConsoleShell
The Pipeline steward screen was the only console screen rendered without a layout wrapper, so its heading, filter labels, and table sat flush against the consol...
Take the percent sign from Intl, not the translated string
A literal "%" in the source text does not survive machine translation — zh returned "保存 {percent}" — so non-English users saw a bare number where a percentage w...
Repair the quote-option FK defaults ddl-auto cannot reach
The existing dynamic sweep only covers nullable FK columns that already carry a FOREIGN KEY constraint. commerce_quote_options.quote_id is NOT NULL, so it is ex...
Pin option FK column definitions so they do not inherit gen_random_uuid()
Hibernate copies the referenced id's columnDefinition onto a new @JoinColumn, so quote_id and option_id were both created DEFAULT gen_random_uuid(). An insert t...
Compare options on the public quote page
Options render as selectable cards rather than rows, because they are choices and not additions. The period total is the headline; the monthly equivalent sits b...
Author multi-option quotes from the editor
A quote is either a flat price sheet or a set of alternatives, so the editor offers a mode toggle rather than letting both exist at once — sending both would sh...
Accept an option on the public quote endpoint
Multi-option quotes cannot be accepted blind — the request now carries the chosen optionUid and the service refuses acceptance without one.
Multi-option quotes with per-option comparison totals
A quote can now present several mutually-exclusive ways to buy — monthly, annual, three-year — instead of forcing three separate documents that drift apart the ...
Delivery coverage, pricing sign-off, large-deposit panels
Replaces the final Coming-soon chips (Hedge & coverage, Pricing sign-off, Large-deposit) with live panels wired to the new steward proxies.
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.