Live Change Log

The gateway relayed only investorId, so the upstream had nothing to scope by and returned another tenant's version spine for a foreign investor id. Its siblings...

wildcard-kamocrm-com was a legacy multi-SAN secret that cert-manager orphaned when its Certificate was repointed at a per-host secret. Nothing renewed it and it...

The quote requires createdByMemberId and the browser must never supply it. memberId(req) is hoisted out of the party-check branch so it resolves for stewards to...

The vision-capability proxy authenticated with internal.auth.secret, but AIService validates **************** — a different secret. Confirmed live: the console ...

assignLoanOfficer now publishes the chat-routing event, so the service ctor takes a 10th arg (LeadRealtimePublisher). Update the unit test's direct instantiatio...

The ACTIVE-member login gate previously lived only in the password-login controller. Extend it to every session-minting path via the shared-lib ****************...

Verified defects from the session review: - CRITICAL: commitLock hardcoded **************** which the RCE commit engine rejects with a 400 (only LOCK_ELIGIBLE...

(1) BorrowerSignatureService now mirrors a terminal native envelope status back onto the locked disclosure stub (doc 05 §4.2 map) on the borrower's my-signature...

Per-member UI preferences (nav layout, hex-head sizes, etc.) are stored one row per (member_id, pref_key) in MEMBER_UI_PREFERENCES, guarded by the unique constr...

getMyNetworks/getAllNetworks only read the OTK request-attr or the *** cookie, — no org beyond the device-exchanged primary ever loaded, and the active org had ...

After the atomic claim() bulk-updates the row to RUNNING, mirror that in the in-memory entity — the pool thread has no open session, so a later full-row save wo...

EconsentService autowires DisclosureTextRepository **************** but that package was absent from @EnableJpaRepositories — the context failed to start, Crash...

Same constraint as in-cluster login: provider resolution keys on the canonical api host, not the portal alias, so a correct password still 401'd.

(1) The funnel's preferred name now writes nameFirstAKA AND stands in for nameFirst until the legal name arrives (owner rule) — it was landing on first name onl...

(1) PortalLeadService routes a portal lead into the credit-based assignment pool (requiresAssignment=true) the moment it has a contact point — portal leads were...

I1: view()/testConnection() now read via the shared-lib's active-filtered finder so a soft-deleted (market,provider) connection reads as "not configured" instea...

Reverts the store-original fallback: if ConversionService cannot resize the image, return 422 instead of storing the full-size original (a huge image would then...

ConversionService can native-crash (libwebp-imageio SIGSEGV) or be unavailable, which made every member wallpaper upload fail ("Failed to process image" -> 500)...

Each token carried only its own connection, so the browser's reused json session lacked the other one -> opening Windows after Linux gave 'connection does not e...

patchLoanFile's borrower submit (DRAFT->APPLICATION_TAKEN) now calls **************** instead of a raw updateLoanFile status set, so the submit produces the has...

The kamo-internal -> APIService BFF path forwards the session as the X-***-Token header, but the resolver only read the X-OTK attribute or the *** cookie — so B...

**************** status changes are the pipeline state machine's job (POST /transitions enforces legal arrows + per-arrow role gate + open-blocking-condition ga...

- @Value reads KAMO_GUAC_SIGNING_KEY / DESKTOP_PASSWORD from env directly (runtime application.yml is configmap-mounted, so property indirection wouldn't bind...

The portal borrower submit is PATCH loan-file {statusId:2}, which bypassed the operator /transitions endpoint where the Application-Taken side effects live — so...

Two related borrower-authorization holes on the self-service app endpoints: - Privilege escalation (#2): patchLoanFile applied any statusId with no caller-ri...

MortgageAppController.create() borrower self-create branch: - Idempotency (#2): resume an existing owned DRAFT via findOwnedDraft instead of minting a duplica...

Two prod issues from the securityProvider-mirror change: 1. Enter-as-System-Member failed with "No membership in the organization's security provider" for e...

dbNow() now returns DB-UTC wall-clock (now()::timestamp), so recover the absolute instant with toInstant(UTC) instead of the JVM default zone — keeps the browse...

/register bound the new member's org to the request Host, but the org signal never survived the hop: kamo-register proxies every signup to the shared api.kamocr...

The enriched /document-requirements read authorized any party to the app and returned EVERY party's requirements, so on a joint loan a borrower saw the co-borro...

The account vault held documents per-PARTY (shared human) but authorized access per-ACCOUNT — two HIGH multi-human defects on a joint loan: - PII leak / lockou...

TransactionSummaryDTO.loanUids carried LOAN-FILE uids, but the pipeline console keys rows on the APPLICATION uid — so grouping silently fell back to one row per...

The account-level imaging path had never actually run (0 vault Imgs in prod): uploadDocument was passed accessLevel=null. Pass CONFIDENTIAL for borrower PII (ID...

- HIGH: satisfy-across gated on the path partyId but fanned out over the DOCUMENT's own party downstream; verify the document belongs to the authorized party ...

listDocumentRequirements calls ensurePartyLinks so requirement rows always carry an accountBorrowerPartyId (the borrower upload/satisfy target).

setDefault used a bulk 'update LeadVendorProduct ... where p.vendor.id in (subquery)' — Hibernate bulk updates reject the implicit association join, so the call...

Sequence the borrower ownership stamp as a separate service call after createBlank commits, so the new borrower/declarations graph is flushed before the account...

Adversarial-review findings MLOS-W-01/03/04: - the 404-normalized empty list envelope now echoes the request's identity keys **************** so unknown, fore...

social.lead.new can be processed concurrently (old + new SecurityService pod both hold a core-NATS subscription during a RollingUpdate → one publish delivered t...

Review found the org guard was a no-op on the common empty-list case for the by-id waivers/validations reads (which the MLOS service does not org-filter), leaki...

available-summary now resolves the member's allotment and skips the product when suspended BEFORE the free-for-all short-circuit, and available() gates creditOk...

Lead IDs are CRDB unique_rowid() values that exceed JS MAX_SAFE_INTEGER. The frontend now sends leadId as a string; parse both String and numeric forms so findB...

- dedup via scoped LeadRepository query instead of findAll() over all tenants (was an OOM/DoS + cross-tenant exposure risk, re-run per 1000-row batch) - cap i...

- Add kamo.minio.region (MINIO_REGION, default us-west-ca-s-1) so SigV4 signatures match the server's enforced site region; fixes background upload and sett...

Reordering only re-uploaded new files to their new index, dropping reordered existing images and leaving imageBgCount claiming unpopulated slots; provisioning t...

getOrganizationById returned a bare null, which Spring serialized to HTTP 200 with an empty body; clients calling response.json() then threw 'Unexpected end of ...