Prove the deploy by digest, not by tag
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Say why this one cannot be scaled yet
McpServerManager runs each MCP server as a child process of THIS pod and tracks them in in-memory maps; McpHealthMonitor writes what it finds there into a SHARE...
Let a rollout finish what the old pod was doing
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Pin kamo-shared-library 1.6.0
The library moved to 1.6.0 while every consumer stayed on 1.5.0. Consumer CI builds the library from a fresh clone into a cold ~/.m2 and ci-settings.xml mirrors...
Refuse MCP tool execution for a tenant that handles PHI
executeTool forwards operator-supplied arguments to an operator-typed URL and can spawn a stdio process, with no allowlist, no SSRF guard and no destination aud...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Rebuild against shared-library @Lob LONGVARCHAR fix
Hibernate's PostgreSQL dialect read @Lob String columns as OIDs via getLong(). Affects notes, contacts, calendar, OAuth tokens, IMAP passwords, email campaign b...
Point at YugabyteDB and use PostgreSQLDialect
CockroachDB has been replaced by YugabyteDB. Connection strings move from cockroachdb-public:26257 to yb-tserver-service:5433, and the Hibernate dialect from **...
Retry the shared-library build, which the LAN uplink keeps corrupting
Three builds died today on "Tag mismatch" pulling a jar — and the mirror added an hour ago did not help, because kbservice, mcpgatewayservice and ragservice hit...
Mirror Maven Central through the Google GCS copy
Every Docker stage starts from a cold ~/.m2 and refetches the whole dependency tree, so Central sees the full weight of every concurrent service build. It answe...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Constant-time internal-auth secret compare (timing oracle)
Replace String.equals with MessageDigest.isEqual so response latency cannot leak the X-Internal-Auth shared secret byte-by-byte. Fleet-wide sweep of the copy-pa...
Use cluster MinIO service DNS; drop deprecated WireGuard/CGNAT IPs and retired k2m1/k0m1
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Bump for kamo-shared-library 1.5.0 snapshot refresh (M2 programs catalog)
Scope concurrency to build jobs, not Kubernetes deploys
Workflow-level concurrency serialized the whole pipeline (including kubectl rollouts). Move the group to the build job only so deploy jobs from different runs c...
Rebuild for kamo-shared-library update (remove OrganizationType, add isTopLevel)
Rebuild for kamo-shared-library update (remove OrganizationType, add isTopLevel)
Rebuild for kamo-shared-library update (CREATE_CHILD_ORG right + apply-to flags)
Pulls the new RoleRightType.CREATE_CHILD_ORG (id 131), the three apply-to flags on ChildOrgSecurityModel, the two 13-arg service overloads, and the AppliedModel...
Rebuild for kamo-shared-library update (appConfig upsert-only fix)
Pulls the hardened **************** that no longer deletes appConfig rows whose service types are absent from the caller's payload — prevents silent data loss w...
Rebuild for kamo-shared-library update (effective-feature resolver)
Picks up the new AppliedModelEnforcementService methods (computeAvailabilitiesMap, isAppEffectivelyEnabled, getEffectivelyEnabledAppTypes, computeEffectiveFeatu...
Rebuild for kamo-shared-library update (applied-model enforcement + appConfigs + isPrivate)
Triggers a rebuild so this service pulls the updated kamo-shared-library containing AppliedModelEnforcementService, ChildOrgSecurityModelAppConfig entity, Servi...
Rebuild for kamo-shared-library update (runtime force rules + DEFAULT fallback in MemberRightsAppliedService)
Triggers a rebuild so this service picks up the updated **************** that applies template force rules and DEFAULT-template fallbacks on top of the existing...
Rebuild for kamo-shared-library update (master model, default role templates, force-rule resolver)
Triggers a rebuild so this service pulls the new kamo-shared-library revision containing Organization.branchTypeID, Organization.masterModelID, ****************...
Add concurrency group to prevent duplicate workflow runs
When a push triggers a workflow and workflow_dispatch is also fired (or two pushes arrive in quick succession), both runs would execute simultaneously. Adding a...
Scaffold MCPGatewayService with auth, controllers, transports, and health monitoring
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.