Live Change Log

Third steward tab, on the shipped MLOSPricingService reads via the new SecurityService proxy (+ the new org-scoped runs read). Org run inventory with a run sele...

MlosPricingController @ /api/security/mlos/pricing + MlosPricingClient to MLOSPricingService (/api/pricing). Reuses MlosBaseController. runs inventory injects t...

Settings › Engagement Types: - Archive markets (type "ARCHIVE" to confirm) instead of deleting; Active/Archived sub-tabs; restore from Archived. Market detail...

GET /api/security/commerce-markets now takes an optional status=active|archived|all (default active) so the settings Archived tab can load archived markets. Dro...

Add findArchivedByOrganizationId + findAllByOrganizationIdOrdered and the matching **************** service methods so Commerce settings can surface an Archived...

Apply review findings: localize frozen/yes/no + humanized aria-labels, humanize enum pills, phase title-case parity (shared titleCase), null-safe ausKindId, WCA...

Review found the org guard was a no-op on the common empty-list case for the by-id waivers/validations reads (which the MLOS service does not org-filter), leaki...

Second steward tab, on the shipped MLOSUnderwritingService reads via the new SecurityService proxy. Agency AUS runs inventory (DU/LP/GUS + decision) with a deta...

MlosUnderwritingController @ /api/security/mlos/underwriting + MlosUnderwritingClient to MLOSUnderwritingService (/api/underwriting, X-Internal-Auth). Reuses Ml...

Replace the fixture layer with the real end-to-end read-path: browser -> **************** route handler -> APIService -> SecurityService MlosCapitalMarketsContr...

Add an MLOS-named, read-only proxy that lets the kamo-internal Capital & Risk Command Center reach MLOSCapitalMarketsService without exposing the internal netwo...

Add the AI-native mortgage steward console under /commerce (MORTGAGE market tab), replacing the placeholder intents/commitments sub-tabs with MortgageStewardSec...

- /leads/credits: right-aligned 'System Wide:' Active/Suspended dropdown; Credit Balance uses the ∞-capable InfinityCell (lowering invalidates, ∞ leaves as-is...

- /credits/system-wide GET+PATCH (org credit-suspend), /credits/lead-viewers (VIEW_LEADS holders incl. grant-all) for the History member filter. - Credit-bala...

- OrgLeadConfig (new ORG_LEAD_CONFIG table): org-wide 'System Wide' switch that suspends CREDIT-BASED lead auto-assignment (FFA unaffected); gated in acceptNe...

The sub-tab labels already name the view, so remove the h4 title + subtitle from LeadImportTemplateManager and LeadImportHistoryManager; keep the refresh action...

- The base GET/POST /api/security/lead-imports had NO Next proxy route.ts (only sub-paths did), so Past Imports fetch (and the import POST) 500'd at the Next ...

available-summary now resolves the member's allotment and skips the product when suspended BEFORE the free-for-all short-circuit, and available() gates creditOk...

findApplicableAllotments filtered 'AND la.isActive = true', so getMostSpecificAllotment returned a less-specific ACTIVE fallback (or nothing) when a member's sp...

Reorders the /leads top-right actions to: Add New Lead, Leads Available (→/leads/available, Bolt icon + live availability indicator, shown with Spend/Receive), ...

- Remove the 'Import Leads' sub-tab; the import wizard now opens from an always-visible 'Import Leads' button in the page header. Only two sub-tabs remain: Im...

EmailService's InternalAuthFilter guards /api/email/templates/send + /seed-org on internal.auth.secret, which was unset (fail-closed 503). Share the existing pr...

SecurityService's internal-auth clients (recovery SMS -> VOIP, recovery email + template seed -> Email) send X-Internal-Auth from internal.auth.secret, which wa...

Guards the new /api/bulktext/send endpoint. Shares the existing production internal-auth value (mlos-internal-auth) so SecurityService's recovery SMS authentica...

SecurityService's BulkTextSmsClient (password-recovery + account-settings SMS) has always POSTed **************** to /api/bulktext/send, but the controller was ...

Media/lead-feed events (media.feed.*, media.post.*) had no JetStream stream, so publishes returned '503 No Responders Available For Request' (chat.> is covered ...

parseInt() rounded lead ids past JS MAX_SAFE_INTEGER, so the backend looked up a nonexistent lead and returned 404, surfacing as 'Failed to create post' on the ...

Lead IDs are CRDB unique_rowid() values that exceed JS MAX_SAFE_INTEGER. The frontend now sends leadId as a string; parse both String and numeric forms so findB...

The member column and filter showed raw ids because the name map was built from /api/security/members, whose CockroachDB Long ids serialize as JSON numbers and ...

The manual-import feature keys were added to kamo-translation-dictionary (en) which CI copies into messages/ at build time; this forces a rebuild so the deploye...

Adds an 'Inject Test Lead' button beside Accept for each vendor/product, shown only to members with MANAGE_CREDITS. Opens a confirmation dialog, then POSTs to t...

- New POST **************** (MANAGE_CREDITS): creates a synthetic 'Void > Test Lead' (John Doe / 555-555-5555 / noreply@<org base domain>) with requiresAssi...

Adds SOURCE_FILE_KEY + SOURCE_FILE_CONTENT_TYPE columns so a run references the original file archived in MinIO (KamoInitializer adds the columns on next run).

On Start Import the raw file is uploaded (best-effort) and its key passed to the import POST; Past Imports shows a Download button for runs with an archived fil...

Injects MinIOStorageService; POST /source-file stores the raw upload in the private internal bucket; GET /{id}/source-file streams it back (org-checked); the ke...

- Sub-tab bar in LeadManualImportManager: Import Leads | Import Templates | Past Imports - LeadImportTemplateManager: template list/create/edit/delete + upload-...

- LeadImportPersistenceService: header normalize+SHA3 fingerprint (ordered/unordered), mapping/row JSON round-trips, persist run + non-success records, templa...

Mirror the NavPri Leads indicator on the /leads 'Lead Credits' action: a green/red status dot (green = a lead is acceptable now via FFA or credit, red = none) a...

The assignment card passes `canReassignManually ? startEditAssignment : undefined` to EditableCard.onEdit, but onEdit was typed `() => void` (required), failing...

- LeadAlertProvider (global, mounted at NavPri level): WS-driven /available-summary; drives all state - NavPri Leads icon: green dot (can accept) / red (cannot)...

Aggregates the caller acceptability across all active markets (comment gate + credit/FFA/ daily-spend rules). Returns hasAcceptable / hasAcceptableCredit / bloc...

Replaces the empty stub entities with real @Entity classes (modeled on the LeadIntake* precedent: UUID id, gen_random_uuid, DB-default timestamps, statusId + @T...