Live Change Log

PhiAuditController.hasRight() bypassed the right check on session GD alone. GD means "may activate god mode"; godModeActive means "has activated it, deliberatel...

phi_access_log has been accumulating evidence nobody looks at. That satisfies §164.312(b) — the trail exists — and satisfies nothing about §164.308(a)(1)(ii)(D)...

The platform's only field mask was **************** applied by LeadController.getLeadById to a caller who is neither god nor the assignee and lacks VIEW_LEAD_CO...

The trail has been written for a while and nothing could read it, which left two obligations unmet: an accounting of disclosures for one individual's record (§1...

Organization.handlesPhi has existed as a column with no way to set it, so PhiTenantGuard has been enforcing a flag nobody could turn on. This is the missing hal...

GET /{uid}/preview returns the same PublicQuoteView the share link serves, from the same QuotePresentation resolution, so a previewed letterhead cannot differ f...

God mode activated silently and lasted as long as the session. That is the control a covered entity's security review pushes hardest on, because "your staff can...

Multi-option quotes cannot be accepted blind — the request now carries the chosen optionUid and the service refuses acceptance without one.

Operator-gated, session-stamped org+member, fail-closed ownership (no cross-org existence oracle). New endpoints baselined in the unauthenticated-endpoint ratch...

god-eligible, org server-stamped GET relays: **************** **************** MlosDocOrchestration **************** (fail-closed org filter, drops non-owned pa...

MlosCatalogController/Client gain promote-bulletin, mirroring promote-guideline (god-eligible gate, org server-stamped). Baselined promoteBulletin in the unguar...

Three things, all from trying to answer "why not just fix the context test?". 1. **************** declared `kamo:` TWICE and therefore did not parse at all ...

This service has @ComponentScan("com.kamo") but an EXPLICIT @EnableJpaRepositories list. The moment a bean here needs a repository outside that list, the reposi...

The §164.312(b) trail was going to Slf4jPhiAccessLogWriter: 14-day platform retention against a six-year obligation, and nothing that can be queried. The lead r...

KAMO_MFA_SECRET_KEY maps to kamo.mfa.secret-key by Spring's relaxed binding, and is what MfaEnrollmentService uses to encrypt stored TOTP secrets at rest. With...

Flaky customer authoritative servers (seen: migo.host for rodaris.md) intermittently answer SERVFAIL on healthy zones, which /setup/dns rendered as a red 'DNS l...

A bare `new RestTemplate()` has no connect or read timeout. When the *** service became unreachable today, every login thread blocked on this call indefinitely ...

MlosCatalogController/Client gain promote-guideline, mirroring promote- eligibility: god-eligible gate, organizationId server-stamped via write().

kamo-shared-library dropped @Service from MfaEnrollmentService so that ~40 services stop constructing an authentication component they do not use — that stereot...

Completing the register wizard's email verification (6-digit code or email link) already proves inbox possession, yet the new user was bounced to the login page...

@EnableJpaRepositories here is an EXPLICIT package list, not a wildcard. com.kamo.z.shared.mfa.repos was missing from it, so UserMfaEnrollmentRepository and Mfa...

Completes MFA. The core landed in kamo-shared-library; this is the wire that turns stored configuration into an actual gate. The gate is small because login al...

**************** gain promote-eligibility, mirroring promote-adjustments: god-eligible gate, organizationId server-stamped via write(), downstream 4xx relayed v...

ResourceServerConfig is anyRequest().permitAll() and @EnableMethodSecurity appears nowhere in this service, so every @PreAuthorize is inert and public is the de...

HIPAA §164.312(b) for SecurityService. The platform records every lead CHANGE (LeadHistory) and every login (SystemAccessLog) and records no READ at all, so "wh...

Staff endpoints at /api/security/commerce/quotes and an unauthenticated resolver at /api/security/public/quotes. QuoteController extends BaseLosController rath...

Every failure mode in this feature is silent. A latched circuit breaker, a worker queue discarding every task, a provider that started returning HTML — each loo...

**************** gain promote-adjustments, mirroring the promote-rate-sheet relay: god-eligible gate, organizationId server-stamped onto the payload via write()...

The settings endpoint required MANAGE_EMAIL_AVATAR_SETTINGS and nothing else, so it shipped dormant: a brand-new right is held by nobody until an admin assigns ...

Staged and committed as-is so nothing is left uncommitted in the working tree. 2 files changed, 435 insertions(+)

dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...

Resolves a correspondent's email address to a picture, working outward from what Kamo already knows: member photo, then a photo someone attached to a contact, t...

Two call sites of featureService.enableFeature now understand the HIPAA boundary: - /enable maps PhiModuleNotPermittedException to 403 carrying the reason, m...

The handler was `public void **************** Long id)` — no HttpServletRequest parameter at all, calling straight through to a bare deleteById. With ResourceSe...

PUT and DELETE on /api/security/job-titles/{id} and /api/security/departments/{id} resolved no session at all — they read a UUID off the path and called straigh...

Avatar object paths were prefixed with the domain of whatever host the request arrived on (getPublicBucketName → kamocrm-com, optionone-com, cluster-local, …), ...

Phase L2 of the MeridianLink loan-officer mapping design (kamo-internal **************** §3.3-3.6), built on the L1 shared-lib schema/resolver (MarketLosUserCre...

The Manage-Credits pen edit only ever LOWERED a balance: updateAllotment routed creditBalance to invalidateCreditsToTarget, which no-ops when target >= current....

guacd cannot render KRdp's H.264-only RDP GFX. buildAutoConnectUrl now mints a vncConnection() for Master Machine (192.168.4.46:5900, shared password). Linux/Wi...

- **************** POST /api/security/marketing-email/ recipients/resolve turns lead/account/application IDs into email recipients. Gated on MANAGE_BULK_EMA...

buildAutoConnectUrl now mints a Master Machine connection (KAMO_GUAC_MASTER_HOSTNAME, default 192.168.4.46); included in every token for session reuse. Kept in ...

POST **************** ownership-checked (requirePackageOrg) so a steward mints only for their own tenant. The upstream reads the 7-digit MERS Org ID from the te...

Maps `dateOfBirth` in the manual-import and vendor-intake field switches with a lenient multi-format parse (ISO plus common US M/d/yyyy forms; unparseable value...

The god-via-kamo-internal SSO path defines its Guacamole connection inline in the json-auth token, so the color-depth pin must live here too (kept in sync with ...

Relays POST/GET/retire on **************** to MLOSDocService, with organizationId server-stamped from the operator session so a steward authors and lists only t...

Mirrors the bulk path for the lead-view Assignment card. When PUT /leads/{id} moves a lead to a different member, that member now gets the same LEADS_ASSIGNED e...

Relays POST **************** through the org-stamping write helper, so a steward authors conditional adjustments only for their own tenant.

POST **************** moves a batch of leads onto one team member and emails that member once for the whole batch. Authorization uses REASSIGN_LEADS_MANUALLY (...

Uploading a logo to a child org 403'd with no way to succeed: canManageOrgBranding only admitted the org owner, and the isGodModeActive fallback could never ret...

Relays POST **************** through the existing org-stamping write helper, so a steward authors matrices only for their own tenant. This push also rebuilds a...