Link the steward to the console the org can reach
StewardRecipientResolver built the steward link from the org's first domain row whatever its state, so an org still setting up its white-label domain was mailed...
Stop reporting a catalog bump as a missing SystemConfiguration row
Three scheduled jobs read a row and skip the whole tick if they cannot. All three were skipping ticks during schema changes, and two of them said so in a way th...
Prove the deploy by digest, not by tag
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Fail a bad rollout instead of reporting it green
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Mark payload outcomes by column, not through the entity
payloadRepo.save() on a detached payload makes Hibernate walk its graph — organization pulls in org_domains — and that read lands in a transaction that has alre...
Stop overlapping runs importing the same payloads twice
The trigger fires every minute and each run claims work by selecting payloads still in RECEIVED. A backlog that takes longer than a minute therefore still had R...
Bump the processed counter instead of rewriting the endpoint
The job finished a batch by mutating totalProcessed on the endpoint entity it loaded before the batch began and saving the whole row. Two consequences: - it ...
Persist each payload's outcome as it happens, not in one batch
processEndpointPayloads looped over the batch mutating statuses in memory and saved them all at the end. createLead commits per lead, so any failure of that fin...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Annotate the injectable StewardNotifier constructor
DaemonService has been in CrashLoopBackOff for days — 1654 restarts on the pod before the last deploy, 60 on the current one — and never started: Failed to i...
Scan the shared MFA repositories
MfaEnrollmentService is a @Service in kamo-shared-library, so the wildcard @ComponentScan("com.kamo") in this application constructs it whether or not this serv...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Notify the ASSIGNED steward of a routed decision, via email
DECISION_ROUTED's steward notification was a record-only no-op: StewardNotifier fanned out over SMS to a static CSV **************** that is empty by default, a...
Crystalline/metamorphic basement classifies correctly (was VOLCANIC)
Macrostrat 'metamorphic and undivided crystalline (...may include volcanic...)' tripped the volcan substring; check metamorphic/crystalline before volcanic. Als...
Ridge petrology search to 25km, no relief gate
The gazetteer point often sits in the valley floor with the range 15-20km off; the 15km search + relief gate missed them (Yucca Valley returned alluvium despite...
Petrology reads the ridge bedrock, not the valley floor
A town centroid usually sits on valley ALLUVIUM while the mountains the scene draws are bedrock — so a granite-ringed desert town returned 'alluvium' and got no...
VoipGlobalSyncJob stamps the MLOS internal-auth secret VOIP actually validates
After the hostname fix the job 401'd: VOIP's InternalAuthFilter checks the mlos-internal-auth value, but the job read internal.auth.secret, which in DaemonServi...
VoipGlobalSyncJob targeted a nonexistent host — kamovoip-service, not voip-service
Every minute the job failed DNS on **************** the actual Service (and what StewardNotifier already uses) is kamovoip-service. Fixed the configmap default ...
Re-parent geolite config under daemon: so the weekly sync actually runs
Commit 53eed7b re-parented the geolite block under internal: while the code reads daemon.geolite.* — with SPRING_CONFIG_LOCATION replacing classpath defaults, G...
Boot crash — Ant matchers for the multi-servlet context (spring-ws /services/*)
MVC-implicit string requestMatchers are rejected by Spring Security 6 once the MeridianLink integration's MessageDispatcherServlet joins the DispatcherServlet —...
Drop poller link write so server-owned contentHash isn't clobbered; collision-safe poll-unit key
Consumer review findings - MLOS secret, HTTP timeouts, max-deliver clamp, 4xx skip, boot rebind
Adversarial review (2 lenses; 5 verifiers died on a session limit - adjudicated the 9 raw findings by hand, 6 real): - WRONG SECRET (confirmed by hash compariso...
Register JSR-310 on the consumer mappers - real envelopes carry an Instant occurredAt
E2E caught it: both real decision.routed events were dead-lettered as 'unparseable' because the bare ObjectMapper cannot deserialize java.time.Instant. findAndR...
Recreate deploy strategy so NATS durable consumers rebind on deploy
DaemonService binds EXCLUSIVE JetStream durable consumers (daemon-sync-trigger, **************** [the §2.8 breach loop], daemon-recording-received) in @PostCons...
Enable OutboxRelay @Scheduled backstop + @Async hot path
DaemonService activates the MLOS transactional outbox (mlos.outbox.enabled) and produces events (the compliance-timer breach emitter), but lacked @EnableSchedul...
Register com.kamo.z.shared.mlos.event repos (OutboxWriter dep)
Enabling mlos.outbox activates OutboxWriter, which requires MlosOutboxEventRepository (+ ProcessedEvent /DeadLetter) from com.kamo.z.shared.mlos.event — add tha...
Consume *** secret so X-Internal-Auth matches downstream services
DaemonService -> ConversionService **************** was returning 401 Unauthorized because DaemonService was stamping its X-Internal-Auth header from INTERNAL_A...
Enable JPA repos for commerce + email + dao.repositories packages
DaemonService crashed on startup with: Parameter 0 of constructor in **************** required a bean of type **************** that could not be found. A r...
Use imgRepository.findByDat() instead of lazy imgDat.getImages()
Quartz jobs run outside JPA sessions, so lazy collection access on ImgDat.images throws LazyInitializationException. Use explicit repository query instead.
Update WebinarReminderJob to use renamed repository method
Calls **************** with a 24-hour max window instead of the removed findWebinarsWithDueReminders method.
Enable redirect following for MaxMind download
MaxMind returns 302 redirect to the actual file. HttpClient wasn't following it, causing the sync to fail with HTTP 302.
Add SecurityConfig to permit daemon trigger and actuator endpoints
Spring Security defaults blocked all endpoints with 401. Added explicit config to permit /api/daemon/** and /actuator/** without authentication.
Rewrite GeoLite sync — correct download URL, streaming hash, batch inserts
- Use MaxMind's current permalink API with HTTP Basic Auth (account-id + license-key) - Streaming SHA-256 instead of Files.readAllBytes (prevents OOM on 100MB+ ...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.