Live Change Log

Resolves the session, authorizes, and relays to CommissionService with the org and member stamped from that session — never from anything the caller sent. This ...

The profile's Personal Email Notifications card has to name the address missed-message notices actually reach, and that address is the user account's — not the ...

The three commission rights gate a feature that did not previously exist, so NEW_RIGHT_SEEDS deliberately says nothing about them - that mechanism carries an ex...

The Interaction Center needs a member's address to pre-fill a composer, and the only endpoint that carried one was the single-member detail fetch — one request ...

The address a member gives out is usually the org mailbox flagged Primary on their member settings, not whatever is on their user account — so typing it into th...

A right that gates something already reachable is a removal of access: new rights insert as NOT_SPECIFIED, so the /hr tabs would have vanished on deploy for eve...

Every platform screen backed by this service refreshed on a timer, because this service has no WebSocket and therefore no way to tell anyone anything: the close...

GET **************** returns one date-ordered page across notes, calls, voicemails, texts, e-mails and chat; ?channel= narrows it. Three sources are merged. Ca...

The rules were stored, cached to Redis and never consulted. AccessCheckController was the only caller of the evaluation and nothing called AccessCheckController...

The geo section only ever denied: a country was blocked or it was absent. Orgs that want to serve one country had to enumerate every other one, which is unmaint...

Email comes from the member's primary mailbox rather than TeamMember.emailWork — that column is free text predating mailbox provisioning and routinely disagrees...

Dates arrive as ISO strings and parse leniently: a filter the client sends badly should narrow nothing rather than 400 the whole grid. A date-only "to" bound co...

Both blocks come off the same lead, so the controllers fetch it once and derive each from it rather than hitting the service twice per render. Still org-scoped ...

An approver can now hand an opportunity to a different agent. The requester is never rewritten — applyPrimaryAgent records the move as its own history row with ...

The approver now records what the organization pays on the sale to the requesting agent and their group. Omit it on approve and the lead's market default applie...

Org-scoped in both places. On the public page the scope comes from the share link's own organization, so a token can never surface a lead belonging to another t...

market-config now tells the lead view whether to offer a Quotes tab and what wording a new quote starts with, and the market endpoints round-trip both fields. ...

REST surface behind /leads/opportunities/reserved and the Reserve Opportunity control in the lead header, plus the service that owns the invariants. Rights, en...

phi_access_log has been accumulating evidence nobody looks at. That satisfies §164.312(b) — the trail exists — and satisfies nothing about §164.308(a)(1)(ii)(D)...

The platform's only field mask was **************** applied by LeadController.getLeadById to a caller who is neither god nor the assignee and lacks VIEW_LEAD_CO...

The trail has been written for a while and nothing could read it, which left two obligations unmet: an accounting of disclosures for one individual's record (§1...

Organization.handlesPhi has existed as a column with no way to set it, so PhiTenantGuard has been enforcing a flag nobody could turn on. This is the missing hal...

GET /{uid}/preview returns the same PublicQuoteView the share link serves, from the same QuotePresentation resolution, so a previewed letterhead cannot differ f...

God mode activated silently and lasted as long as the session. That is the control a covered entity's security review pushes hardest on, because "your staff can...

Multi-option quotes cannot be accepted blind — the request now carries the chosen optionUid and the service refuses acceptance without one.

Operator-gated, session-stamped org+member, fail-closed ownership (no cross-org existence oracle). New endpoints baselined in the unauthenticated-endpoint ratch...

god-eligible, org server-stamped GET relays: **************** **************** MlosDocOrchestration **************** (fail-closed org filter, drops non-owned pa...

MlosCatalogController/Client gain promote-bulletin, mirroring promote-guideline (god-eligible gate, org server-stamped). Baselined promoteBulletin in the unguar...

The §164.312(b) trail was going to Slf4jPhiAccessLogWriter: 14-day platform retention against a six-year obligation, and nothing that can be queried. The lead r...

KAMO_MFA_SECRET_KEY maps to kamo.mfa.secret-key by Spring's relaxed binding, and is what MfaEnrollmentService uses to encrypt stored TOTP secrets at rest. With...

MlosCatalogController/Client gain promote-guideline, mirroring promote- eligibility: god-eligible gate, organizationId server-stamped via write().

Completing the register wizard's email verification (6-digit code or email link) already proves inbox possession, yet the new user was bounced to the login page...

Completes MFA. The core landed in kamo-shared-library; this is the wire that turns stored configuration into an actual gate. The gate is small because login al...

**************** gain promote-eligibility, mirroring promote-adjustments: god-eligible gate, organizationId server-stamped via write(), downstream 4xx relayed v...

HIPAA §164.312(b) for SecurityService. The platform records every lead CHANGE (LeadHistory) and every login (SystemAccessLog) and records no READ at all, so "wh...

Staff endpoints at /api/security/commerce/quotes and an unauthenticated resolver at /api/security/public/quotes. QuoteController extends BaseLosController rath...

Every failure mode in this feature is silent. A latched circuit breaker, a worker queue discarding every task, a provider that started returning HTML — each loo...

**************** gain promote-adjustments, mirroring the promote-rate-sheet relay: god-eligible gate, organizationId server-stamped onto the payload via write()...

Resolves a correspondent's email address to a picture, working outward from what Kamo already knows: member photo, then a photo someone attached to a contact, t...

Two call sites of featureService.enableFeature now understand the HIPAA boundary: - /enable maps PhiModuleNotPermittedException to 403 carrying the reason, m...

Phase L2 of the MeridianLink loan-officer mapping design (kamo-internal **************** §3.3-3.6), built on the L1 shared-lib schema/resolver (MarketLosUserCre...

- **************** POST /api/security/marketing-email/ recipients/resolve turns lead/account/application IDs into email recipients. Gated on MANAGE_BULK_EMA...

buildAutoConnectUrl now mints a Master Machine connection (KAMO_GUAC_MASTER_HOSTNAME, default 192.168.4.46); included in every token for session reuse. Kept in ...

POST **************** ownership-checked (requirePackageOrg) so a steward mints only for their own tenant. The upstream reads the 7-digit MERS Org ID from the te...

Maps `dateOfBirth` in the manual-import and vendor-intake field switches with a lenient multi-format parse (ISO plus common US M/d/yyyy forms; unparseable value...

Relays POST/GET/retire on **************** to MLOSDocService, with organizationId server-stamped from the operator session so a steward authors and lists only t...

Mirrors the bulk path for the lead-view Assignment card. When PUT /leads/{id} moves a lead to a different member, that member now gets the same LEADS_ASSIGNED e...

Relays POST **************** through the org-stamping write helper, so a steward authors conditional adjustments only for their own tenant.

POST **************** moves a batch of leads onto one team member and emails that member once for the whole batch. Authorization uses REASSIGN_LEADS_MANUALLY (...

Relays POST **************** through the existing org-stamping write helper, so a steward authors matrices only for their own tenant. This push also rebuilds a...