Live Change Log

The Docs manager gets a Signature Requests tab: every document a collection's templates sent out for signature, in three buckets by signatures (nobody, some, or...

A template is a document with a layer of fields over it, and a version of it is both halves: its bytes and that layer. Its underlying file's saves already reach...

**************** settled for any active root domain, so an org still setting up its domain had signing links mailed to sign.<that domain>, which answered nothin...

Verified against a real completed envelope on the cluster, and the closing paragraph read "Each signer was shown, and accepted, the consumer disclosure required...

`buildSession` reported `stepUpRequired ? "AES" : "SES"`, so requiring a one-time passcode made every signing session assert an ADVANCED electronic signature — ...

What the flatten pipeline appended was one page per signature carrying seven lines: name, email, member id, timestamp, capture method, IP, user agent. No routin...

The unit tests around this cover the pieces — the format, the type predicate, the required-field exclusion — and none of them can see the wiring. A signature_da...

**No e-sign email had been leaving the cluster.** EmailService gates /api/email/templates/send on the cluster-wide internal-auth secret (mlos-internal-auth -> I...

The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...

The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...

Every @Scheduled sweep here whose effect is shared now takes a named distributed lease through SingletonTaskRunner before it does anything, so it runs once acro...

Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...

The redaction was applied at flatten time, which is after signing. Everything before that — the whole signing session — was served the raw source: fetchDocument...

— is processed by javac before the file is even tokenised, so it compiled to the same character it renders as here — but the source read as the escape.

flatten() applied blank pages, rotations, modifiers, field values, page order and certificates. It never drew the annotations. A rectangle, a highlight or an ar...

Broken on main since e9faf11. The image build runs mvn package -DskipTests, so nothing has been compiling the test tree and no red build ever said so — but it m...

Two separate ways the same wrong assumption showed up. The signing page's logo URL was https://<org fqdn>/theme/logo-full.<ext>, which is not a path anything s...

The library moved to 1.6.0 while every consumer stayed on 1.5.0. Consumer CI builds the library from a fresh clone into a cold ~/.m2 and ci-settings.xml mirrors...

**************** walked org.getDomains() filtering only on isActive. That collection holds the org's root domain AND its alias rows -- api, login, theme and the...

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

**************** required dat.convertedDat to be non-null. ConversionService only mints a second ImgDat when it actually converts something -- a document that a...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

Hibernate's PostgreSQL dialect read @Lob String columns as OIDs via getLong(). Affects notes, contacts, calendar, OAuth tokens, IMAP passwords, email campaign b...

CockroachDB has been replaced by YugabyteDB. Connection strings move from cockroachdb-public:26257 to yb-tserver-service:5433, and the Hibernate dialect from **...

ESigService is CrashLooping for a reason that has nothing to do with e-signatures: it rebuilt against a shared library whose DepartmentService had grown a Mailb...

@Transactional is applied by a proxy and sweep() called expireDue() on this, so the annotation was inert. The expiry notices read the envelope's organization do...

Everything after a signer presses Finish was incomplete. Notices: an envelope's last signature produced a flattened PDF in MinIO that only the final signer eve...

Picks up kamo-shared-library 3045cc3: ImageAssocType.getBucket() now returns the single "imaging" bucket for every association, so a deduplicated file is stored...

A caller that acts on a recipient's status has to be able to establish WHOSE status it is. DocsService's legal-package Finish writes a WORM attestation on the s...

OTKAuthFilter bypasses only /actuator, /api/esig/public and /api/esig/internal, so this prefix is behind staff OTK auth with orgId/memberId already on the reque...

**************** now take the triple. The public controller keeps resolving it from SIGNSESH, so the signer app is unchanged; a staff-authenticated member surfa...

The signer-count check added last round demanded an EXACT match against the template's declared slots, which would have silently stopped mortgage disclosures go...

envelopeComplete required a literal SIGNED from every recipient, but delegate() leaves the delegator DELEGATED forever and ADDS the replacement instead of subst...

Any single recipient declining set the whole envelope DEcoderD, so a counter-signer could destroy signatures the other parties had already given, with no recove...

Creating an envelope unconditionally emailed an invite, so a caller batching many envelopes behind one notification had no way to stay quiet. Null preserves the...

submit() validated only consent and step-up; it accepted an empty values list and still marked the recipient SIGNED. Ports validation.ts (esign-core), including...

No caller supplied signerUid, so recipients were created without one. buildSession filters a signer's fields by signerUid, so myFields came back empty, completi...

The designer has always offered page rotate, delete, reorder and add-blank, plus watermark, page-number and label modifiers, and the flatten read none of it: it...

target/ was committed here, alone among the Java services — every other one ignores it. Compiled classes and surefire reports churn on every build and can only ...

Staged and committed as-is so nothing is left uncommitted in the working tree. 76 files changed, 254 insertions(+)

dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...

Signing dates were rendered in whatever zone the client defaulted to, so an envelope expiring 2026-08-03T05:00Z could read "Aug 3" to a Pacific signer for whom ...

Extracts the byte-for-byte duplicated buildSignLink into SignLinkBuilder and adds a locale segment sourced from Organization.language, falling back to English f...

- GET **************** streams the executed (flattened) PDF for an org-owned envelope (404 until fully signed). - RecipientSummary carries **************** ...

- RecipientSummary now carries decoderReason + decoderdAt (persisted by the decoder ceremony but previously omitted from every projection), so a compliance-...

POST **************** re-mints a recipient's access token and RETURNS the signing deep-link (no invite-email round-trip), so the MLOS borrower portal can hand a...

Belt-and-braces with the shared-lib SoapClientOnlyGuard (c4a3b2c): the 891c58c build raced the guard's push into shared-lib main and kept crash-looping on 'more...