Mabadiliko ya Tabianchi

The backend now streams to 3 GiB, but three things in the browser and the BFF made that unreachable, each fatal on its own. The upload proxy did `await request...

Chat attachments have run at 3 GiB through this same imaging pipeline for a while; documents were capped at 500MB. The difference was not a policy, it was that ...

Registers com.kamo.z.shared.hr.training in the explicit @EnableJpaRepositories list — @EntityScan is broad so the entities are found either way, but repositorie...

ImageService gains uploadDocumentStreaming, the streaming counterpart of uploadDocument. The buffered form cannot express a large upload at all: readInputStream...

Picks up kamo-shared-library f3a7283. Eight members hold an email-ws-<id> consumer still filtered on email.inbox.<addr> from before subscribeToNats moved to ema...

A durable JetStream consumer keeps the filter subject it was created with for the life of the stream. When the owning code later changes that subject, jnats ref...

SettingsView declares an 8px primary-tinted scrollbar on the white card, but that card never overflows — every ancestor down to TabPanel is flex:1 with minHeigh...

The console rendered flush against the settings card on all four sides. Nothing in the container chain pads a tab child — SettingsView's card, its inner Box, Ta...

Loading the console makes four calls, and any one of them throwing produced "Couldn't load your billing" with nothing else on screen. The subscription list is t...

The entity moved from billing_groups to billing_pay_groups after it turned out the former is a live legacy table with a different shape. This service still hold...

Creating it in a migration rather than leaving it to ddl-auto, which produced a half-built table when the entity was pointed at the pre-existing billing_groups.

BillingGroup was mapped to billing_groups. That table already existed — one of a seven-table subsystem (billing_group_members, _subscriptions, _licenses, _invoi...

MINIO_SECRET_KEY was moved into the minio-app-credentials secret, but the envFrom supplying it was only applied live and never committed, so a CI reconcile woul...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...

StorageQuotaService took its five repositories as required constructor arguments. Services in this estate component-scan com.kamo with a wildcard but declare an...

The object-storage key sat in k8s/configmap.yaml, which kubectl will hand to anyone who can read the namespace, and the same string was hardcoded as the SSH pas...

Dovecot now enforces a per-mailbox limit, and nothing was setting the column it reads. This writes it nightly, after the storage snapshot so the capacity being ...

Dovecot needs a byte figure per mailbox, but storage is one organization-wide pool across eighteen domains. The division has to hold one property above all — th...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...

The mail MySQL password sat in plaintext across fourteen files here — in ConfigMaps that kubectl will hand to anyone who can read them, in two Jobs that CI appl...

The mail MySQL password sat in plaintext across fourteen files here — in ConfigMaps that kubectl will hand to anyone who can read them, in two Jobs that CI appl...

Object storage already refuses content that would take an organization past its ceiling, which covers every domain going through the object store. Inbound mail ...

Object storage already refuses content that would take an organization past its ceiling, which covers every domain going through the object store. Inbound mail ...

Object storage now refuses content that would take an organization past its ceiling, which covers every domain that goes through the object store. Inbound mail ...

Object storage now refuses content that would take an organization past its ceiling, which covers every domain that goes through the object store. Inbound mail ...

The panel that closes the loop on self-pay. It appears only where the organization's policy permits it, and only for people who are not already buying on the or...

The dunning that did not exist. invoice.payment_failed wrote a row and returned: no email, no flag, no state change, and billing.email-service-url was configure...

past_due_since and suspension_notified_at, both nullable. Null means paying and not-yet-told respectively.

PAST_DUE counted as fully live in both entitlement resolvers, with no timestamp and no cap, so a customer whose card failed kept every feature for as long as St...

Self-pay had no route inside the console. Everything on the billing surface is account-shaped — you must already hold an AccountMember row before Plans & Billin...

The owner had exactly one lever over self-payment and it was the wrong shape: an irreversible promote gesture, with no way to say in advance whether it was perm...

Who inside an organization may pay Kamo is now answerable and settable. Both routes are org-scoped and therefore deliberately outside /api/billing/accounts/** a...

There was no way to buy a first subscription anywhere in the product. Plan lists were reachable only through a subscription you already held, so an organization...