Prove the deploy by digest, not by tag
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Lock the shared sweeps, and run two pods
Every @Scheduled sweep here whose effect is shared now takes a named distributed lease through SingletonTaskRunner before it does anything, so it runs once acro...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
A KB link goes to the article its text names
A member asked how to set their org up and got the setup checklist back, each step naming the article that explains it. All three links pointed at the same arti...
No upstream error text reaches a member, whichever provider failed
memberTextFor fell through to getMessage() for anything that was not an AiProviderException. Only the HuggingFace adapter classifies its refusals; every other o...
Retire a model the provider won't route, and stop quoting it at members
Follow-up to the router-catalogue fix. That stops unroutable models being LISTED; this stops one already in an org's catalogue from breaking the assistant and n...
List the Hugging Face models the router will actually serve
Chat goes to the Inference Providers router **************** but discoverModels asked the HUB for models that are "warm" somewhere — a different and much larger...
Remove the unreviewed-reply unread-count endpoints
Paired with the kamo-internal removal of the AI unread badge: the count never told the member anything actionable (no push channel backs it, so non-zero only ev...
Unreviewed-response counts and a mark-read
Keyed by session guid, which is what a tool window carries. Not audited as a disclosure: it returns counts and never a word of a transcript, and recording a bad...
Pin kamo-shared-library 1.6.0
The library moved to 1.6.0 while consumers stayed on 1.5.0. Consumer CI builds the library from a fresh clone into a cold ~/.m2 and ci-settings.xml mirrors Mave...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Administering models and reading usage take the rights that name them
AiModelController and AiUsageController checked organization ownership and no right. The 403s already in the model controller compare provider.getOrganizationId...
Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Rebuild against shared-library @Lob LONGVARCHAR fix
Hibernate's PostgreSQL dialect read @Lob String columns as OIDs via getLong(). Affects notes, contacts, calendar, OAuth tokens, IMAP passwords, email campaign b...
Point at YugabyteDB and use PostgreSQLDialect
CockroachDB has been replaced by YugabyteDB. Connection strings move from cockroachdb-public:26257 to yb-tserver-service:5433, and the Hibernate dialect from **...
Retry the shared-library build, which the LAN uplink keeps corrupting
Three builds died today on "Tag mismatch" pulling a jar — and the mirror added an hour ago did not help, because kbservice, mcpgatewayservice and ragservice hit...
Mirror Maven Central through the Google GCS copy
Every Docker stage starts from a cold ~/.m2 and refetches the whole dependency tree, so Central sees the full weight of every concurrent service build. It answe...
Persist AI conversation PHI access trail to phi_access_log
Stored assistant conversations are the reads least able to afford a 14-day, unqueryable log stream: the module sits outside the compliance boundary, so prompts ...
Scan the shared MFA repositories
MfaEnrollmentService is a @Service in kamo-shared-library, so the wildcard @ComponentScan("com.kamo") in this application constructs it whether or not this serv...
Record PHI access on every read of stored AI conversation history
Wires the shared §164.312(b) spine into the paths that read persisted prompts and completions. The assistant is the module the compliance assessment put OUTSIDE...
Commit outstanding work in progress
Staged and committed as-is so nothing is left uncommitted in the working tree. 4 files changed, 397 insertions(+), 3 deletions(-)
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Classify vision failures so the retry loop and circuit breaker actually work
Two bugs in visionComplete, both of which defeated machinery built to handle them. A blank-content response was returned as SUCCESS and ended the retry loop. E...
Per-agent scorecard
What each agent actually did: conversations, how often a person had to take over and why, outreach outcomes including the ones held back, and what it cost. Eve...
Never route vision to an adapter that cannot send an image
AiProvider.supportsVision is a hand-editable database flag, and routing trusted it alone. The HuggingFace and Cohere adapters never read imageUrls at all, and t...
Model pricing catalog, write path and backfill
Cost accounting could never work: AiModel has price columns, AiModelController reads them and ChatOrchestrationService reads them to compute costEstimate - but ...
Agent-initiated handoff to a human, with context
The AI could not previously ask for a person: escalation rules reached the model via the compiled prompt, but there was no machine-readable signal back, so the ...
Outbound triggers, scheduler and web-chat dispatch
Makes the outreach spine actually fire. The gate, contact state, consent and audit already existed; nothing caused a touch to be evaluated. - NATS enabled for ...
Persist org-wide required text and apply it immediately
AiOrgSettings gained forcedPreamble/forcedFooter and SalesAgentCompiler already folds them into every agent, but the settings controller neither read nor wrote ...
Anthropic dropped every system message but the last
buildRequestBody assigned rather than accumulated the system field, so with more than one system message only the final one reached the model. In practice that ...
Locked rules survive a section or whole-document override
An author taking over a rule section by hand replaced the entire section body, which silently discarded the locked pack rules inside it - so 'never quote a rate...
Sales-agent compiler, versioning, outreach gate; fix tool replay
Structured agent config compiles to the system prompt, freezes per published version, and gains the gate an agent must pass before initiating contact. Compiler...
Sales-agent CRUD, mortgage template, and agent-driven chat prompt
- AiSalesAgentController (/api/ai/sales-agents): org-scoped CRUD + GET /templates - SalesAgentTemplateRegistry: built-in starter templates, beginning with a m...
Streamed replies were dropped, persisting blank assistant messages
Every successful chat completion came back as an EMPTY assistant bubble. The assistant rows were being saved with content_len=0 and is_error=false, so there was...
Try the next model when a vision model rejects the image
Probing production again after the modality fix, routing moved from a text-to-speech model to o3-mini — an o-series reasoning model that also takes no image inp...
Stop routing vision to text-to-speech models
Found by probing production: org 1188756624575266822's vision calls resolved to gpt-4o-mini-tts-2025-03-20 — a TEXT-TO-SPEECH model — so every vision call retur...
Inline image vision + tier fallback that prefers stronger over weaker
Two limits made org-configured vision unusable for whole classes of caller. 1. Vision was URL-ONLY. Every caller had to stand up public, provider-fetchable ser...
Load history images via query, not lazy getImages() (WS path)
**************** runs on the WebSocket path (called from AiChatWebSocketHandler), which is NOT an HTTP request, so open-session-in-view does not apply. Iteratin...
Allow SWITCH_MODEL to reset a session to Auto
handleSwitchModel always UUID-parsed modelId and errored on null, so a session could never be reverted to automatic model selection mid-chat. Parse modelId as a...
Per-integration public AI prompt + session attribution
Upgrade the public-chat system-prompt waterfall from per-org to per-integration: PublicAiChatController now reads the X-Public-Chat-Key-Hash header (nullable) f...
Per-org public prompt, human-handoff on no provider, anon daily message cap
Tier-aware internal text completion (POST /api/ai/internal/text)
Mirrors the vision path: selectTextProvider picks the org's active provider tagged with the requested cost tier (LIGHT/MEDIUM/HEAVY), falling back by priority; ...
Robust vision provider/model selection across vendors
Two-pass selectVisionProvider: prefer any org provider that has an active vision-capable model adapter already emits image_url content and reports supportsVisio...
Provider cost-tier/vision passthrough + internal one-shot vision endpoint
AiProviderController reads/echoes costTier + supportsVision. ProviderRoutingService gains selectVisionProvider(orgId, tier). **************** runs a one-shot vi...
Use cluster MinIO service DNS; drop deprecated WireGuard/CGNAT IPs and retired k2m1/k0m1
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.