Merge duplicate kamo key that crashlooped EmailService
The new EmailService pod has been in CrashLoopBackOff since 16e8a05 — 22 restarts, never once started. snakeyaml raises DuplicateKeyException on a repeated top-...
Gate login on the second factor — §164.312(d)
Completes MFA. The core landed in kamo-shared-library; this is the wire that turns stored configuration into an actual gate. The gate is small because login al...
Pin matumizi ya Spring ya Uumbaji, na kuthibitisha muktadha huanza
Huduma ya MfaEnrollment ni @Huduma na kila sehemu ya huduma ya Kamo com.kamo, hivyo ni instantiated katika takriban 40 maombi. Alikuwa na mbili wajenzi - moja k...
Accept starter/enterprise plan handoff, carry promo code, target www /subscribe
kujiandikisha sasa whitelists starter | biashara | biashara na stashes sp checkout code; Kichujio cha zamani cha biashara kiliacha wanunuzi wa Starter kimya, na...
Tumia sera ya picha kwa kila ukurasa, sio tu wale waliothibitishwa
The policy was attached only at the final `NextResponse.next()`, so /logout and /validate — both real, browser-rendered documents — were served with no img-src ...
Awamu 0 + 1 - chombo cha funnel halisi, unblock rangi ya kwanza
- mbele data-* props kupitia MagneticButton/RippleButton (matukio kamwe kufikiwa DOM) - Chombo cha Ushirikiano, Hero, PreviewBanner, sehemu ya CTA; ?ref = kweny...
Unblock picha simu, kuongeza analytics funnel analytics analytics, kurekebisha mpango handoff
- Remove the portrait-phone gate and "rotate your phone" dialog that hid the entire wizard on portrait phones; the wizard now renders single-column below th...
TOTP second factor — §164.312(d)
The compliance assessment called the absence of any second factor disqualifying on its own, and under the 2025 Security Rule NPRM MFA stops being addressable at...
Add analytics analytics + ?registered=1 welcome notice
- Mount analyticsAnalytics client component in the root layout: next/script loader for analytics.kamocrm.com scoped via data-domains to login.kamocrm.com on...
Create the second-factor tables
Backs UserMfaEnrollment and MfaRecoveryCode in kamo-shared-library — §164.312(d) Person or Entity Authentication, the gap the compliance assessment called disqu...
Require VIEW_CALL_LOGS for call playback in PHI-handling orgs
Recording and voicemail playback checked tenancy and nothing else: any member of the owning org could pull any call in it, transcript included, on extensions th...
Automatic logoff after inactivity (HIPAA 164.312(a)(2)(iii))
A session left open on an unattended workstation stayed usable indefinitely. This terminates it after 15 minutes of no interaction, with a 60-second warning so ...
Audit WOPI content endpoints and close the last byte-serving gaps
WOPI serves whole documents to Docs and recorded nothing. GET /wopi/files/{id}/contents is the same disclosure as /download, relayed the same way through APISer...
Restore theme assets — CSP derived the wrong host and SVG was disabled
Avatars, org logos and backgrounds stopped loading for every tenant. Two separate regressions I introduced in 36ad904b, both live for hours. 1. The per-request...
Promote an ingested eligibility matrix from the console
For an ELIGIBILITY_MATRIX source document the ingestion panel now shows a "Promote as eligibility matrix" card: pick the product, limit type (MAX_LTV/CLTV/DTI),...
Gateway relay to promote an ingested eligibility matrix
**************** gain promote-eligibility, mirroring promote-adjustments: god-eligible gate, organizationId server-stamped via write(), downstream 4xx relayed v...
Ratchet on endpoints that resolve no session
ResourceServerConfig is anyRequest().permitAll() and @EnableMethodSecurity appears nowhere in this service, so every @PreAuthorize is inert and public is the de...
Authoring UI — list, line-item editor, share-link management
Completes the quote/estimate system: staff can now build a quote, price it, mint a share link and email it, all from the pipeline. app/lib/quotesApi.ts ...
Close the /_next/image open proxy
remotePatterns was [{ protocol: "https", hostname: "**" }]. That made the image optimizer a general-purpose fetcher: any caller could ask this server to retriev...
Record lead reads and refuse un-auditable exports
HIPAA § 164.312(b) kwa ajili ya huduma ya usalama. Orodha ya viongozi wote Kila kitu kinabadilika na hakuna mabadiliko. Soma yote, kwa hivyo "Nani aliyeangalia ...
Public branded quote/estimate document at /{locale}/q/{token}
The customer-facing surface for the commerce quote system. Server-rendered so the org's branding is in the first paint — an unbranded flash on a commercial docu...
Quote REST surface — staff management and public share links
Staff endpoints at /api/security/commerce/quotes and an unauthenticated resolver at /api/security/public/quotes. QuoteController extends BaseLosController rath...
Quote/estimate domain — entities, pricing engine, share links
Adds a first-class Quote alongside the existing commerce spine. The pre-existing "ServiceQuote" is an Intent plus a JSON blob carrying one offering and one flat...
Egress containment for the avatar resolver, as a CiliumNetworkPolicy
Inaelezea nini 8f6c672 ilirudi, kwa fomu pekee ambayo inafanya kazi hapa. Jaribio la awali lilishindwa kwa sababu mtandao wa wazi hauwezi kuelezea hili. Topolo...
Show a facepile for group conversations
A thread with five people on it was represented by one arbitrary face, which reads as a message from one person. Up to three participants now overlap, so "sever...
Instrument the chain, reap expired entries, record disclosures
Kila njia ya kushindwa katika kipengele hiki ni kimya. Mchezaji wa mpira wa miguu, mfanyakazi Kuweka foleni kila kazi, mtoa huduma ambaye alianza kurudi HTML - ...
Promote an ingested LLPA matrix into adjustments from the console
The ingestion panel could only publish a rate sheet. For an LLPA_MATRIX source document it now shows a "Promote as LLPA adjustments" card: pick the existing rat...
Gateway relay to promote an LLPA matrix into conditional adjustments
**************** gain promote-adjustments, mirroring the promote-rate-sheet relay: god-eligible gate, organizationId server-stamped onto the payload via write()...
Record call recording, voicemail and transcript access
Recording playback left no trace. A recorded call is the densest PHI the platform stores — the unredacted conversation — and "who listened to this call" was una...
Show the other party in Sent, not the reader's own face
Both list views keyed a row on its sender, so every row of the reader's own outbox showed the reader — their photo, their name, their address. The message list ...
Let org owners configure sender photos without a rights grant
The settings endpoint required MANAGE_EMAIL_AVATAR_SETTINGS and nothing else, so it shipped dormant: a brand-new right is held by nobody until an admin assigns ...
Rekodi upatikanaji wa PHI kwenye kila usomaji wa historia ya mazungumzo iliyohifadhiwa ya AI
Wires the shared §164.312(b) spine into the paths that read persisted prompts and completions. The assistant is the module the compliance assessment put OUTSIDE...
Record chat message reads on the endpoints that return bodies
Sending a message left a row; reading one left nothing. Every chat, support and social thread on the platform renders from a handful of endpoints here, and none...
Commit outstanding work in progress
Staged and committed as-is so nothing is left uncommitted in the working tree. 1 file changed, 1 insertion(+)
Commit outstanding work in progress
Staged and committed as-is so nothing is left uncommitted in the working tree. 16 files changed, 3396 insertions(+)
Commit outstanding work in progress
Staged and committed as-is so nothing is left uncommitted in the working tree. 4 files changed, 72 insertions(+)
Commit outstanding work in progress
Staged and committed as-is so nothing is left uncommitted in the working tree. 26 files changed, 7894 insertions(+), 8 deletions(-)
Commit outstanding work in progress
Staged and committed as-is so nothing is left uncommitted in the working tree. 5 files changed, 4879 insertions(+), 12 deletions(-)
Drop the avatar-resolver egress policy
Inarekebisha sera iliyoongezwa katika 06db7db na imewekwa katika 24f76ae. Ilichukua Huduma ya usalama chini ya dakika sita katika uzalishaji (pod 0/1, Hikari uh...
Commit outstanding work in progress
Staged and committed as-is so nothing is left uncommitted in the working tree. 31 files changed, 691 insertions(+)
Commit outstanding work in progress
Staged and committed as-is so nothing is left uncommitted in the working tree. 76 files changed, 254 insertions(+)
Commit outstanding work in progress
Staged and committed as-is so nothing is left uncommitted in the working tree. 5 files changed, 549 insertions(+), 2 deletions(-)
Commit outstanding work in progress
Staged and committed as-is so nothing is left uncommitted in the working tree. 4 files changed, 397 insertions(+), 3 deletions(-)
Commit outstanding work in progress
Staged and committed as-is so nothing is left uncommitted in the working tree. 1 file changed, 12 insertions(+)
Commit outstanding work in progress
Staged and committed as-is so nothing is left uncommitted in the working tree. 2 files changed, 435 insertions(+)
Commit outstanding work in progress
Staged and committed as-is so nothing is left uncommitted in the working tree. 3 files changed, 353 insertions(+), 4 deletions(-)
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Kuchochea kubectl download dhidi ya flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Je, unaona nini kuhusu usafiri?
Kila moja ya hizi updates ardhi katika nafasi yako ya kazi moja kwa moja. Kuanza bure na kuangalia kukua wiki baada ya wiki.