Mabadiliko ya Tabianchi

Three fixed, the rest explained. The headline number needed narrowing three times and the first two attempts were wrong the same way — enumerating helper names ...

A reachability probe that returned "SecurityRoleController test endpoint is working" to anybody. Nothing calls it — no reference in any service or in kamo-inter...

- Add poster image for instant visual feedback during video load - Implement loading skeleton with pulsing animation - Start video muted (browser autoplay polic...

desktop-1 hosts /srv/kamoteam and exports it over NFSv4; every VM user gets ~/Desktop/KAMOTEAM as a symlink (via /etc/skel for new accounts and the agent for ex...

SecurityService is anyRequest().permitAll() with @EnableMethodSecurity absent, so every @PreAuthorize is inert and public is the default; APIService relays /api...

Swap the homepage hero copy, CTAs, and stats for a looping muted video while keeping the rotating background treatment.

systemctl restart xrdp makes xrdp-sesman forget its in-memory session registry while the Xorg processes keep running. The next login cannot find the session so ...

The sticky's palette was a child of the title bar. Header and writing surface are siblings on the same layer, so the body — later in the DOM — paints over the h...

Nothing was watching memory. MediaService was OOMKilled every few hours for most of a day and EmailService six times, and the way anyone found out was a chat wi...

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...

Both sites took .getContent() and dropped the total on the floor, so both were paying for the same discarded COUNT over every object in the session that just 50...

The container ran with a 1Gi limit while the image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch. Read off the live process, that is MaxHeapSi...

Spring Data derives a second statement for every Page it returns, and the chat history read asked for one it never looked at: MediaController takes page.getCont...

Outbound tcp/22 is rejected for every uid except root and sage, keyed on socket owner so future accounts are covered without re-running anything. Reapplied at b...

Adds krita and maven **************** were already present), pins Chrome, VS Code, Kate, Spectacle and Krita to the taskbar for every user, and lets dev users i...

Cilium egress is default-deny for every endpoint it selects, and toEndpoints:[{}] is scoped to the policy's OWN namespace — so SecurityService could not reach d...

The icon now appears exactly when the connection behind it will work — the SSO endpoint enforces the same rule, so the two cannot disagree. Windows and Master s...

Keeps three states apart that one toggle would collapse: never provisioned (needs a password), provisioned but locked (needs only the switch), and failed (needs...

*** is forwarded explicitly — buildForwardHeaders sets X-OTK but not the session token, and the dev-machine endpoints resolve the caller from it. The action seg...

Linux is gated on an enabled provision rather than god, and served with the member's own credentials. The connection is omitted from the token entirely when the...

Username derives from the member ACCOUNT email, not the TeamMember work email — a work address can sit on another domain and would silently produce a different ...

health() swallows transport failures and answers false so the SSO preflight can return an actionable 503 rather than a 500.

Codec is deliberately reversible — RDP auto-login needs a real password — and uses GCM so a tampered or wrong-key row fails loudly rather than decrypting to noi...

status and enabled are deliberately separate: a provisioned-but-disabled account keeps its home directory, so re-enabling restores access rather than rebuilding...

Alert expressions verified against the live Prometheus. Uses kube-state-metrics rather than kubevirt_* — the KubeVirt metrics endpoint is not scraped here, so r...

Staged under /opt/kamo-desktop-agent so install-agent.sh has a distinct source and destination. Covers netplan-by-driver, cloud-init network disable, xrdp sessi...

Python 3 stdlib only. Every mutation runs subprocess with an argv list, never a shell string; passwords go to chpasswd on stdin so they stay out of /proc.

KubeVirt generates a random MAC per VMI when macAddress is absent. The guest's netplan matched on the first-boot MAC, so every VMI recreate silently orphaned th...

16 tasks across KlusterServices, kamo-shared-library, KamoInitializerService, SecurityService and kamo-internal.

Covers the root cause of the 23-day KamoDesktop outage (netplan matching a first-boot MAC that KubeVirt regenerates on every VMI recreate), the live fix already...

SecurityService now sends ids past Number.MAX_SAFE_INTEGER as strings so they survive JSON.parse. That was being undone one line into the client: OrganizationDT...

CockroachDB unique_rowid() ids are 19 digits, past Number.MAX_SAFE_INTEGER, so an id sent as a JSON number arrives in the browser with its low digits rounded aw...