An order may be a teammate's proven email or a request they confirmed in Kamo
The Tool Plane now verifies orders given by a teammate's own email (email:<folder>/<uid> or the wake's email:<mailbox>|<folder>|<uid>) and by a request the memb...
A generated personality keeps everything the SI already holds
Only an earlier generation's items, named by id and still marked as drafted, are replaced; a configure-assistant draft or a person's item stays, and a generated...
Never push a stage to the external MLOS that the sync itself wrote
The Arive import walks a loan through Kamo's pipeline one step at a time; the 20s sync tick saw each half-walked status as a Kamo change and sent it to Arive, r...
Never send exception text (SQL included) to the browser
BaseLosController.error() put e.getMessage() in every 500 body; the pipeline page showed a full JDBC statement. The exception now goes to the log under a short ...
Pipeline reads retry on a Yugabyte read restart instead of failing the page
"We couldn't load the pipeline (JDBC … Restart read required)" appeared at random while the Arive import was writing loans. The deal and loan list reads are pur...
Retry the import's progress write on a Yugabyte read restart
The first live import stalled at RUNNING after page 1: saving the connection loads the org's domains, Yugabyte answered 40001, and the failure write hit the sam...
Billing write service starts again — the constructor keeps its @Autowired
The terminology commit inserted the code-checker field between @Autowired and the constructor, so the annotation moved onto the field and Spring found three una...
Room-and-start passes the request so visit grants are audited with the caller
The owners' invoice link opens on the workspace host the org can actually reach
Built internal.<domain> by hand, which OrgDomainRuleGuardTest forbids: an org whose own domain is not finished would get a link to a host that answers nothing. ...
The billing job takes each subscription and invoice in its own transaction
Its first run raised Harmony's October invoice and lost it when one audit insert failed, because the whole prepare step was one transaction.
Catalog edits reach only the caller's organization; own-order callers cannot comp or price themselves
Every update and delete of a subscription plan, price, feature, add-on, bundle, volume discount, promotion or agreement template now checks that the row belongs...
Creating a MORTGAGE market gives the organization its lender profile at once
A MORTGAGE market's lender profile (and its five config rows) was only created by the boot-time self-heal, so a market created while SecurityService was running...
The endpoint ratchet sees @RequireRight; the org-graph ratchet allows two read-only hits (SITP TPGUARD)
**************** flagged the TP02 billing and commerce-invoice relays. Not a hole: every commerce-invoice handler carries @RequireRight (TenantRightInterceptor ...
Staff can delete a never-received mortgage application; a received one answers 409 (SITP TP21FU)
DELETE **************** went through AppMortgageService.delete, which 500'd for every application (borrower satellite rows left behind). The shared library now ...
Every clinical audit row names its patient; pick up the shared-lib audit and updated_at fixes (SITP TP23FU)
Production phi_access_log rows from the clinical audit methods carried no purpose, basis or patient: the shared PhiAccessRecorder dropped them while stamping th...
Starting a clinical note no longer fails on updated_at (SITP TP23 live smoke)
ClinicalBaseEntity.updated_at is NOT NULL and defaulted by the database on INSERT only (insertable = false), so a note just inserted holds null in memory and th...
Booking an appointment no longer fails on an untyped null in the conflict check (SITP TP23 live smoke)
findConflicts' (:excludeId IS NULL OR a.uid <> :excludeId) with a null UUID is an untyped parameter on Postgres/Yugabyte ('could not determine data type of para...
A booking or registration is always a new record in the caller's practice; SI note drafts say so; billing reads write the PHI trail (SITP TP23)
- SchedulingService.book: the body is the entity, so a uid in it made save() a merge onto that appointment in ANY practice (and moved it into the caller's); s...
Subscription records, market lists and order notes reach only the caller's organization (SITP TP17)
SubscriptionService reads a subscription, its order, invoice and agreement by uid alone, in any tenant. POSController now checks the record is the session organ...
State licences are read and replaced only within the caller's organization (SITP TP16)
GET/PUT **************** found the member by id alone, so a holder of STATE_LICENSING_VIEW_ALL / EDIT_ALL in one organization could read, replace or delete anot...
Rights on the session-only controllers, with the grant backfill (SITP TP01)
@RequireRight (any-of, tenant RoleRightType) enforced by TenantRightInterceptor before the handler, the tenant counterpart of @RequirePlatformRight: no session ...
Rights on the lead doors the SI tools use, and the caller's own callbacks due (SITP TP10)
- PUT /leads/{id} takes EDIT_LEADS; a create that assigns someone else takes ASSIGN_LEADS - the lead pool (/leads/available, /leads/accept) takes VIEW_LEADS or ...
Patient-merge hooks run after the merge commits, so a failing hook can neither undo nor poison it
CreateClaim writes charge and units, sets the claim total, refuses a blank payer
Run the sign-in detection rules, and make their responses real
SuspiciousDetectionService was injected into SecurityController and evaluate() was never called, so every rule an organization configured on the Security screen...
Encrypt legacy signing secrets at boot; a refused target URL is a 400
The service side of kamo-shared-library e58f1a93 (target vetting + DNS pinning, failure categories, encrypted signing secrets). - **************** (re-runnable...
Seal Google/Microsoft calendar OAuth tokens at rest; re-seal legacy rows at boot
GoogleCalendarService and MicrosoftOutlookService stored the access and refresh tokens on third_party_integrations as the provider issued them, although the ent...
Save answers before the rights fan-out, not after it
Saving a security model (e.g. its Default Security Roles) re-seeded and recalculated member rights for every org using the model before it responded. A model sh...
The profile save stores the member's address
The My Profile Address card posted { address, addressDetails, locality, subdivision, postalCode, country } and PUT /members/{id} never read the key, so every sa...
The guided-tours read answers the member's CURRENT Show Tour rights
A session carries the rights it was issued with and the routine refresh does not re-read them, so everyone signed in before the Show Tour rights existed saw no ...
The boot-time rights sync inserts a role's missing rights in ONE statement
b8014ab3's deploy never became ready. The 31 Show Tour rights made the row-at-a-time insert loop 31 YugabyteDB round trips per role — ~3.5 s a role, ~490 s acro...
An SI's charter read is retried on a YugabyteDB conflict instead of answering 503
GET **************** (I1) resolves the charter in one read-only transaction of 15-25 queries. One "Restart read required" (40001) answered 503 CHARTER_UNAVAILAB...
The lead page names its Vendor and Product
Lead.vendorProduct is @Transient — only VENDOR_PRODUCT_ID is a column — so nothing loads it unless someone asks, and LeadDTO.fromLead then leaves vendorProduct,...
A change to a member's teams is on the security access log — one SECURITY_SETTING_CHANGE/MEDIUM row per member who joined or left, from the team, the member's profile, a deleted team or creation (KamoCollab CP01 final review I1)
A team is a level of the rights waterfall, so joining one is a grant (CP01-T14-1). The department and job-title change on the same Position card writes an acces...
Pin the heads' names query onto users_pkey — /*+ IndexScan(u users_pkey) */ first in the statement, as loadMembers and the org chart's people query; without it the legacy planner seq-scans all of users per head row (KamoCollab CP02 final fix)
Production EXPLAIN (sp00verify, read-only): the unhinted literal plan was a nested loop over Seq Scan on users (106 rows) for 1 and 2 ids; with the hint every p...
The failed-recalculation log names the repair path as /teams/{id}/recalculate-rights
SLF4J has no brace escape, so "{{id}}" was logged literally. "{id}" is not a placeholder and prints as written; the test now pins the path an operator would typ...
A created member's activation welcome waits for the commit, so a swallowed 40001 can no longer turn the create into a silent rollback
POST **************** answered 200 with a member id and a user id that never existed (KamoCollab CP00 Task 0, 2026-10-05, sp00verify). The activation welcome ra...
A rename clears the phonetic spelling of the name it changed (SP94-F-1)
The AI's speech pairs the org's CURRENT name with whatever spelling is stored. The Getting-Started wizard renames through PUT /org/{id} without sending a spelli...
Assigning a computer reads the one member, not the whole organization
HostedComputerAccess.isMember loaded every member of the organization to test one id, and emailOf, called right after it on the same assign path, did the same t...
The AI-dispatch audit trail names people the same way chat does
**************** hand-duplicated MemberDisplayNames' pre-fix precedence (usernameAlias wins unconditionally over the real name), with its own comment warning th...
An address on either platform apex signs in to the account holding its twin
The owner signed in on login.kamouniverse.com with the brand's new address and was told "User does not exist". The account's address is Sage@KamoCRM.com. Since ...
A like is stamped, so it saves
media_obj_reports.date_created is NOT NULL, and the like was built without it: @ColumnDefault only shapes the DDL, so Hibernate wrote NULL and every like failed...
Edit, like and delete one post or note by its own id, never the whole stream
A feed, the organization's (the Clubhouse) or a lead's notes, is ONE POST session and every post or note is a message in it, so every item the feed lists carrie...
SPF advice recognises kamouniverse.com; the brand's aliases are reserved on both apexes
SPF: kamouniverse.com publishes the same record as spf.kamocrm.com (v=spf1 ip4:47.181.8.84 mx -all), so a customer who wrote include:kamouniverse.com has alread...
Platform fallbacks name the primary apex, not a kamocrm.com literal
Four places kept their own "kamocrm.com" literal as the platform host they fall back to, so they could never follow the brand to kamouniverse.com. Each now read...
One organization can no longer take another's <alias>.kamocrm.com routing
Any member of an organization with no root could add the root victim.kamocrm.com (POST /api/security/domains checked no right). Listing the domains then self-he...
A lead's notes stream, addressed by its guid, keeps the lead's own read rule
Every note on a lead now sends the lead stream's guid on /topic/media/feed/<orgId> (SP99-T3), which any member of the organization may subscribe to. The guid-ad...
A new commit log is translated at once, not behind the sweep's backlog
The first translation of a commit log and the sweep's retries shared one three-thread executor, first come first served. With the SP99 T6 repair's 326 commit lo...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.