Live Change Log

Adds public/img/hero-still.webp — 1280x720, matching the aperture's 16/9 exactly — and makes it what the hero shows until someone presses play. This also fixes...

buildTrackingLink emits the new parameter, and the link strip highlights the ?discount= segment it used to highlight as ?mrt=. The token itself is now an opaque...

Follows the marketing site: kdsc_vid / kdsc_src, with ?discount= as the query-param fallback for a visitor who lands on the register form with the link still in...

The link a member shares is **************** It used to be ?mrt=<memberId>.<iteration>, which put a real member id in every shared URL and let anyone enumerate ...

The register site now sends discountVisitorGuid / discountCode. Both names are read, new first, because the two services deploy independently — for the minutes ...

createCode generates the token itself, so there is nothing to read first and nothing for two tabs to collide over. That removes the whole apparatus the old sequ...

The public token was <memberId>.<iteration>, which was wrong on two counts. It published a real member id in every link anyone shared — on a business card, in a...

Tracking codes are shared as ?discount=<uuid> now. The old <memberId>.<n> token published a real member id in every shared link and made the space walkable — on...

Clears both remaining High findings on script-src: the 'unsafe-inline' one and "host allowlists can frequently be bypassed". Only a nonce with 'strict-dynamic'...

Clears the "No Content-Security-Policy header with Trusted Types directive found" finding by moving require-trusted-types-for into the enforced policy. This is...

The timeline gains ATTRIBUTION_MOVED, in the warn tone — not a conversion and not a failure, but the moment this visitor stopped being this member's to earn fro...

The ingest worker now calls reattributeWhileAnonymous after the traffic bumps. The repository method carries the entire rule, so there is nothing to check here ...

Attribution was frozen at first touch, which gets the common case wrong: someone who follows member A's link in March and member B's in June, and only then sign...

Both are Guacamole targets that share one credential between everybody, which makes them operator tooling rather than a member's own workspace. They were top-ba...

Re-lands the security headers after I took the site down with them, minus the one directive that did it, plus a build guard so it cannot happen again. WHAT BRO...

Adds the three headers the Trust and Safety audit asked for, plus Referrer-Policy and Permissions-Policy. Every origin in the policy was taken from what the sit...

/marketing/discounts was a ComingSoon stub; it is now /marketing/tracking, a working workspace, with the old path kept as a client redirect so existing bookmark...

The marketing site tags a referred visitor with kmrt_vid and kmrt_src on the shared apex, so register.<apex> can read them; handleFinish sends both in the reque...

A visitor who follows https://www.<apex>?mrt=<code> gets two first-party cookies from the edge middleware — an opaque GUID that lasts two years and the code its...

The register site now forwards the marketing visitor GUID and tracking code in the request body — not a header, because the proxy strips Cookie and the ingress ...

Both paths that stamp BillingSourceType.PAID now publish marketing.visitor.paid, because hooking only one silently misses half the traffic — AccountSubscription...

Clones forwardPublicWebinar rather than the generic forward(): that method prints every URI, header map and body length to stdout with no level, and a visitor b...

MediaService already backs the other marketing tabs, so it takes both halves of tracking codes: the authenticated CRUD and stats surface at /api/media/marketing...

A member mints a code, shares **************** and the six totals on the Tracking Codes tab answer what that link actually did: unique visitors, visits, page re...

Marketing tracking codes credit a partner for the signups, organizations and paid accounts their link produced, and those three moments happen in services that ...

The Description column shows {No Description} in place of "No description provided..". The string was hardcoded English, so it now comes from the dictionary — w...

The strip now reads Originals | Modify (n) | Modified | Binders | Common | Uploads, and Common trades the gear icon for a library one now that it no longer says...

The four knowledge-base screens were the last in the app still wearing the old look, and three of them stated things that were not true. /kb showed "Pinned Art...

Two halves of one incident. An account registered, verified an address at a disposable provider, took an auto-login session and created five organizations in th...

Four endpoints the rebuilt knowledge base needs, and three facts the API was unable to state. GET /api/kb/pins returned a Page of pin ROWS, and KbArticlePin.ar...

Mirrors the new `User.isFake` field. Four statements, and the order is the whole migration: YugabyteDB rejects `ADD COLUMN … NOT NULL` on a populated table — re...

A synthetic account — a test artifact, a seeded fixture, or a signup judged to be automated — now carries `users.is_fake`, and the platform stops acknowledging ...

Eight flat tabs over eight panels that each drew their own heading, table, skeleton, error line and Snackbar — and had drifted. The overhaul is three things at ...

The page was the last screen still wearing the old look — a flat gradient bar, white cards, a centred spinner, alert() for every failure — while the rest of the...

The network page has offered "Unsubscribe" since it was written. It opened a confirmation dialog and then said the feature would be implemented soon, because th...

The surface was a MUI tab strip over two AG Grids. Packages rendered as seven columns of counts and an actions cell of six unlabelled icon buttons, three of whi...

Points the hero at the new reel's ladder, MP4 fallback and poster. The source is spec-identical to the one it replaces (H.264 720p24, 66s, ~30 MB), so nothing a...

kamo13.mp4 uploaded to MinIO at public/kamo13.mp4 (30 MB, sha256 174aaec6…, verified byte-identical to the local source after transfer — this link has a history...

The tab was two AG Grids under a tab bar: accurate and mute. It now opens on the org's whole training obligation and lets an admin act on the gaps. - A masthea...

Five fixes, all of them things that looked present but did nothing. OFFER BANNER — HeroOfferBanner was dead code; nothing imported it. Restored, but driven by ...

The left column was a generic headline, a security platitude and a pile of ambient decoration (dot grid, floating orbs, a pulsing dash). Replace it with one sha...

The reel was a centred rounded rectangle with a drop shadow — an object placed on the design rather than part of it — and it was the ONLY thing in the hero: ff0...

The hero pointed a bare <video src> at a single 3.9 Mbps 720p24 MP4, so a phone on a weak connection downloaded exactly the same stream as a desktop on fibre, a...

MediaMTX serves live channels over HLS, WebRTC, RTSP and RTMP, and loops the marketing reel as an always-available channel via alwaysAvailableFile — no ffmpeg s...

NFSv4 over the NodePort, mounted soft with a systemd automount so an unreachable cluster returns an error instead of hanging every process that touches the fold...

- Add poster image for instant visual feedback during video load - Implement loading skeleton with pulsing animation - Start video muted (browser autoplay polic...

desktop-1 hosts /srv/kamoteam and exports it over NFSv4; every VM user gets ~/Desktop/KAMOTEAM as a symlink (via /etc/skel for new accounts and the agent for ex...

Swap the homepage hero copy, CTAs, and stats for a looping muted video while keeping the rotating background treatment.

Nothing was watching memory. MediaService was OOMKilled every few hours for most of a day and EmailService six times, and the way anyone found out was a chat wi...

Outbound tcp/22 is rejected for every uid except root and sage, keyed on socket owner so future accounts are covered without re-running anything. Reapplied at b...