Prove the deploy by digest, not by tag
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Stop the sweep re-translating the twenty locales that already worked
An article holding 20 of its 21 locales is "incomplete", so the ten-minute sweep re-queued it — and the translator then re-translated all 21, paying twenty time...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Admit the organization owner, or nobody can turn this on
A brand-new right is granted to NOBODY on the day it deploys. These two are deliberately absent from **************** — seeding them from an existing right woul...
A list read shipped every article's body, and a category page listed nothing
Two defects on the public reads, both visible on kamocrm.com/help-center. The index served 3.9 MB of HTML. tree-by-parent-slug returns every node with its full...
Article translation has never worked
deleteByArticleUidAndLocale is a @Modifying query and JPA refuses to run one outside a transaction. Nothing on this path ever opened one, so every locale of eve...
Saving an article blocked on 21 translation calls
@Async was inert. **************** called translateArticle on the same bean, so the call went straight to this and never reached the proxy that makes it asynchr...
GET /master takes VIEW_NOTES, like every other read here
It was the one read in this controller that took no right, deliberately: the two master notes were called fixtures of the home launchpad rather than the Notes a...
Keep the encryption key across restarts instead of inventing one
Every note body in production was unreadable. NOTES_MASTER_ENCRYPTION_KEY was never set anywhere - not in the deployment, and the deployed ConfigMap carried no ...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Every notes endpoint takes the right that names it, and hasRight fails closed
NotesController checked no right on any of its ten endpoints. VIEW_NOTES was enforced in exactly one place — navRegistry.ts, hiding the Notes app in the browser...
Read and write notes as a member, never as an account
Every endpoint now requires memberID on the session — reads included — and refuses the request without one. The reads used to need only a userID, which is globa...
Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Use cluster MinIO service DNS; drop deprecated WireGuard/CGNAT IPs and retired k2m1/k0m1
Defer NATS event publishing until after transaction commits to prevent RAG race condition
Events were firing inside @Transactional methods, causing RAGService to read stale data from CockroachDB before the commit. Also auto-defaults aiVisibleToMember...
Return article guid/title in pending reviews response
The KbArticleReview entity has @JsonIgnore on article, so the pending reviews endpoint was returning reviews without article details (guid, title). Now uses eag...
Add error handling to createArticle endpoint
Wrap createArticle call in try-catch to return proper JSON error responses instead of Spring Boot's default HTML error page.
Correct hasRight to match flat rights array format and honor god mode
Session rights are stored as ["VIEW_DASHBOARD", ...] not [{name, setting}]. Also bypass right checks when GD (god mode) is true.
Accept parentGuid from frontend in article creation
Frontend sends parentGuid (string) not parentId (numeric). Resolve GUID to ID server-side via lookup.
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.