Live Change Log

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The expiration on the Redis record IS the session; when it lapses the member is signed out. This service holds its own copy of KSessionService against that SHAR...

Hibernate's PostgreSQL dialect read @Lob String columns as OIDs via getLong(). Affects notes, contacts, calendar, OAuth tokens, IMAP passwords, email campaign b...

CockroachDB has been replaced by YugabyteDB. Connection strings move from cockroachdb-public:26257 to yb-tserver-service:5433, and the Hibernate dialect from **...

Caught with redis MONITOR: this pod was issuing GET + PEXPIRE against a *** key whose owner had been idle for over an hour, seconds after SecurityService had co...

Opening **************** answered "Unknown status: **************** for every member. The member grid sent the bucket as one CSV value. A comma in a query valu...

The member surface asked for MAX_SIZE unconditionally and sliced the result in the browser, so a grid that showed a page had already downloaded a whole employme...

Two behavioural defects in the phase-8 notification path. 1. The reminder sweep ran over OPEN_STATES, which includes AWAITING_OTHERS — "this member finished...

The bucket is a pure function of (dueDate, today) and never of "when we last sent": UPCOMING_D{n} for the configured offsets, DUE_TODAY, then PAST_DUE_P{floor(d...

ONE hr.package_assigned per member per package, never one per document: that is what suppressInvite exists for, and 8 documents x 200 members is 1,600 envelopes...

Idempotency with NO schema change. The reminder bucket is a pure function of (dueDate, today) and never of "when we last sent", so the only durable state a noti...

DocsService has no service-to-service authentication: ResourceServerConfig is anyRequest().permitAll() and OTKPreAuthFilter CONTINUES the chain when X-OTK is ab...

publishFor caught Exception around countByTeamMemberIdAndStatusIn and turned it into a WARN. That catch was not only around the badge: the query runs inside the...

GET **************** through memberGuarded() and the identity funnel. No memberId and no orgId parameter — both come from the session, because an id in a path i...

Four sites: delivery (none -> PENDING), void (open -> VOIDED), redelivery (open -> SUPERSEDED) and finish (open -> EXECUTED). Each passes the status it read BEF...

Connection.publish on legal.packages.{memberId}, NOT NatsMessageService: that service pins .expectedStream(CHAT_MESSAGES) in both publish and publishSync, so a ...

DELETE /imaging/delete/{imgId} is the one destructive imaging path and was not wired to the issued-document guard. ImageService.deleteDocument authorizes on org...

isPerPartyRestrictedAssoc covers only ACCOUNT_MEMBER_VAULT and LOAN, so assoc 1 — SERVICE_APPLICATION, what /settings/member/{id}?tab=docs renders — has no per-...

Filing is queued AFTER COMMIT and OFF the request thread. Finish is @Transactional in a service that also serves WOPI; holding a connection across N ESigService...

uploadDocument takes the SUBJECT'S Member, so Img.organization and Img.createdByMember derive from them and HR ends up having filed a document the member owns. ...

LegalPackageAccess mirrors the Legal & Compliance tab gate, and that tab is now gated on one right of its own instead of VIEW_EMPLOYEES || EDIT_EMPLOYEES || MAN...

The certificate carries the package, the frozen version, the subject, the moment and address of execution, the attestation wording verbatim and both digests the...

LegalPinnedPdf extracts the frozen-digest rule out of the member read path so the wizard and the filed artifact read the SAME bytes through the SAME check — con...

DocumentService hardcoded "imaging-mydocs" while every other read path went through ImageAssocType.getBucket(). Now that storage is one bucket, point it at the ...

LegalEsignClient.isConfigured() was false in the cluster: neither internal.auth.secret nor legal.esig.service-url was supplied, so Deliver refused every package...

verify() compared the caller to assignment.teamMemberId but never to the ENVELOPE RECIPIENT's member — it trusted the recipientUid the delivery fan-out wrote. A...

A separate controller with a separate funnel, because authorization here is identity and not an HR right. Routing these through guarded() would mean either lock...

Writes the WORM LegalPackageAttestation: attestationTextSha256 from the FROZEN version (the package's draft wording is mutable and may already have been reworde...

LegalAssignmentOwnership is a SEPARATE guard from LegalPackageAccess on purpose: a member executing their own agreement holds no HR right, and widening the HR r...

manifestSha256 hashes the ordered [{documentUid, contentSha256, orderIndex}] the member was actually shown, length-prefixed so a crafted uid cannot imitate a fi...

Redeliver published the new version row, flipped every OPEN assignment to SUPERSEDED, and submitted the reissue from inside that same uncommitted transaction. T...

Built on the EntityManager rather than a shared-lib repository method: the filter set is dynamic and adding it to kamo-shared-library would force a shared-artif...

Per-assignment outcomes — voided, skipped-executed, not-found — because an admin voiding a package for six named people needs to know which had already executed...

Refused unless the live fingerprint differs from the published one. Binder.dateUpdated is dead and Img has no revision counter, so that fingerprint is the only ...

Plan on the request thread (two cheap queries, so the response is exact about who is included and who was skipped and why), write off it: 200 members x 8 docume...

Deliver is the new-hire path and is meant to be re-run, so members who already hold an assignment are subtracted rather than given a second copy of the same ins...

DocsService's first outbound service-to-service client. Posts to **************** (origin MANUAL, never metered) with suppressInvite=true — HR sends one notific...

LegalPackageAccess.requireRead demanded VIEW_EMPLOYEES alone while hrTabs.ts admits the Legal & Compliance tab on VIEW_EMPLOYEES || EDIT_EMPLOYEES || MANAGE_HRS...

All seven /api/docs/legal mappings authorized on org membership alone, so any authenticated member could list, edit, delete and publish legal packages — and aud...

Resolves a saved or draft audience through TeamMemberRepo.findAudience, which is the only reader carrying the mandatory ACTIVE + recordState eligibility predica...

Pins img_dat_id plus a content hash, not img_id: saveImgContent repoints the same Img at new bytes on every Docs save, and resolveSource walks to the dat live a...

List, create, get, update and delete, with ordered binder refs and audience rows replaced as a set. Org comes from the session on every path — DocsService is pe...

Ids cross as strings (unique_rowid exceeds MAX_SAFE_INTEGER). Binder order is the list order, de-duplicated, and a non-numeric entry 400s rather than being skip...

Binder.dateUpdated never moves after INSERT, so a package's content has no change signal to compare. Adds a SHA-256 over the canonical ordered binder/item tuple...

BinderService.addItem checked read access and refused VAULT/LOAN documents, but never compared the document's own collection to the binder's, so a hand-crafted ...

Scopes the visible-binder query to the DocManager's (assocType, assocObjectId), stamps the scope on create, inherits it on duplicate, and bumps last_modified fr...

The HR_RESOURCE rebuild failed on hibernate-core:6.5.3.Final with 'Tag mismatch' — a transfer corrupted in flight, not a missing artifact. The shared-lib stage ...

**************** resolve the assoc type with values()[ordinal]; without this rebuild values()[13] throws on the stale 13-constant array as soon as the HR Resour...