Mabadiliko ya Tabianchi

The trial was seeded pending and started on the owner's first sign-in, because an org was unreachable until its DNS verified — starting the clock at creation wo...

Two gaps, both proven against the live cluster today. FIRST: every existing KamoDesktop alert measures whether a COMPONENT is alive. All four were green during...

Alertmanager webhook receiver at /api/internal/alerts/chat, so a KamoDesktop alert reaches a person instead of a dashboard. This is the BEST-EFFORT leg. Email ...

The KamoDesktop canary needs a link minted the way the icon mints one. It holds the same signing key, so it could build its own — and would then be testing itse...

likePattern turns an absent search term into '%' so no null parameter ever reaches a string expression, and escapes % and _ in the term so a search for a litera...

PostgreSQL cannot infer a type for a null parameter inside a string expression: LOWER(CONCAT('%', :search, '%')) with a null :search guessed bytea, and the list...

Completes the round trip: a resource can now be written, read back, read at a specific revision, and have its history walked. The JSON is SERVED rather than as...

A resource write is not one row: it is the domain rows, the canonical JSON, up to eight kinds of search-index row, a reference link per reference, and a securit...

sage's VS Code is a multi-root workspace holding all 63 repositories, so taking the first workspace folder rooted a bug about the login site in aiservice — the ...

claimNextVersion is an UPDATE ... SET current_version_id = current_version_id + 1 and must be the FIRST statement of a write transaction. The obvious alternativ...

The previous build failed on a class that had not been pushed to kamo-shared-library (fa243ae). Nothing to change here; this just re-runs the build against a li...

SecurityService's SystemBugAiDispatchController and SystemBugAiDispatchService are on main and import **************** but the record itself was never committed...

The entity everything clinical hangs off — a note, an order, a diagnosis and a charge all point at the encounter they arose in. Planned and actual times are se...

The create wizard is eleven steps long and the alias was only validated for FORMAT locally — whether anyone already held it was discovered when the form was sub...

The column was never constrained. Survivable while an alias was only resolved as (security_provider_id, alias) behind a host, since two orgs under different pro...

The org-creation wizard is eleven steps long and the alias was only checked when the form was submitted, so someone who picked a name another organization alrea...

A new entity rather than a reuse, and each rejection is concrete rather than stylistic. Not Member: GET /api/security/members/names returns every member of an o...

The comment called the link "short-lived, single-use" and "5-minute", which is what caused the token expiry to be set as if it were a URL redemption window. It ...

Guacamole's stock CLIENT.ERROR_TUNNEL_204 is "The requested connection does not exist. Please check the connection name and try again." There is no connection n...

"The requested connection does not exist. Please check the connection name and try again." on a KamoDesktop reconnect was not a missing connection. It was the S...

DisclosureLedger is separate from phi_access_log on purpose. The access log records every READ, and most reads are a clinician opening a chart; deriving an acco...

PhiAccessBasis gained CARE_TEAM and BREAK_GLASS last commit; without these two tables those values are decorative. Nothing on the platform modelled a provider-p...

The build has failed on every push since 2026-08-15 and it is not the code. The log shows npm ci dying with ERR_SSL_CIPHER_OPERATION_FAILED and ossl_gcm_stream_...

ddl-auto built PRIMARY KEY (logical_id, resource_type, tenant_id) on fhir_resource_current and fhir_resource_version, because Hibernate emits @EmbeddedId column...

The composite-key assertion passed while ddl-auto actually built PRIMARY KEY (logical_id, resource_type, tenant_id) — Hibernate emits @EmbeddedId columns ALPHAB...

Members report defects in the platform with screenshots and the sites they the dev machine. A tenant sees only its own organization's bugs and the platform org...

The indexed projection of a resource's meta.security labels, and the thing that has to exist before the first clinical read path rather than after the first beh...

Four fields the clinical read paths cannot work without, and none of which can be backfilled — each records something only knowable at the moment of access. pu...

Search runs over explicit typed tables, not JSONB with GIN. That is forced by the database, not chosen: Yugabyte's own docs state a GIN index cannot use more th...

The class carries @RequirePlatformRight, so the interceptor resolves the caller and refuses before any handler runs — a per-method check would have been one for...

A system bug crosses the tenancy line in one direction: the platform organization sees every tenant's, and no tenant sees another's. That rule lives in ********...

The Roundcube deployment/service and the mail.kamocrm.com IngressRoute were already dropped from the CI deploy list, but the MySQL bootstrap still created and g...

Three tables that between them make read, vread, _history, ETag and every form of _include work. fhir_resource_current is a pointer, one row per resource forev...

The face now comes from the same directory index every other member list on the platform reads (useMemberProfiles), so a person's picture on the scoreboard is i...

A member of several organizations now chooses which one to open after their password, instead of it being chosen for them by the hostname. This is the switch th...

vscode:// URI handler and sent a synthetic Return. Measured on desktop-1, that cannot work: KDE's screen locker holds an exclusive X input grab whenever the scr...

/api/config and /api/branding read the organization from the hostname. On the shared meet host that is the platform organization for every tenant, so each of th...

SignInCompletionService returned a relative /validate?otk=. That resolves against the host that served the SIGN-IN — login.<apex> — and kamo-login has a /valida...

The redirect is wrong. SignInCompletionService returns a relative /validate?otk=, which resolves against the host that served the sign-in -- login.<apex> -- and...

A member of several organizations now chooses which one to open after their password, instead of having it chosen for them by the hostname. This is the switch t...

An operator filling in the Google Workspace registration had nothing telling them what to put in the Google Cloud console's Authorized redirect URIs, and the Re...

Registration bound the account to whatever organization the host resolved to. On register.kamocrm.com — the signup page for every organization with no register ...

Google's OAuth redirect target. Same shape as the email and meet provider callbacks beside it: public and sessionless, because the popup lands on this gateway o...

The platform console needs an address to show an operator setting up the Google Workspace registration, the way VOIP has /api/voip/oauth/callback. The only emai...

register.kamocrm.com is the signup page for every organization that has no register host of its own, so the hostname cannot say which one a visitor is signing u...

The foundation every clinical entity reuses, and the build gate that stops it drifting. Both land together on purpose: a harness written before there is anythin...

Seven blocks across five controllers ended their org-resolution with, in effect: if the server name is localhost or a bare IP, return whichever organization the...

Creation checked the alias only within one security provider, and PUT /org/{id} checked nothing at all — it applied whatever it was given. Both were reasonable ...

ANALYTICS_EXPORT is blocked because exports leave the boundary with no de-identification. Both training exports already had a fail-closed audit — there IS a rec...