Stop the avatar-resolver policy blocking every login
This policy took the whole platform's login offline for hours. Cilium enforces egress against the RESOLVED BACKEND, after service DNAT, so the port it matches ...
Resolve the org from the real request host, not the internal address
checkAccess resolves the tenant by looking up `org:domain:<hostname>`, and was being handed request.nextUrl.hostname — which behind Traefik is 127.0.0.1. That k...
Annotate the injectable StewardNotifier constructor
DaemonService has been in CrashLoopBackOff for days — 1654 restarts on the pod before the last deploy, 60 on the current one — and never started: Failed to i...
Promote an ingested guideline version from the console
For a GUIDELINE source document the ingestion panel shows a "Promote as guideline version" card (product select + revision label). The rate-sheet card is now hi...
Gateway relay to promote an ingested guideline into a version
MlosCatalogController/Client gain promote-guideline, mirroring promote- eligibility: god-eligible gate, organizationId server-stamped via write().
500s on dynamic-segment pages + en fallback for missing locale keys
Removing the global force-dynamic made routes with generateStaticParams attempt static rendering for on-demand params, which throws DYNAMIC_SERVER_USAGE because...
Scan the shared MFA repositories
MfaEnrollmentService is a @Service in kamo-shared-library, so the wildcard @ComponentScan("com.kamo") in this application constructs it whether or not this serv...
Scan the shared MFA repositories
MfaEnrollmentService is a @Service in kamo-shared-library, so the wildcard @ComponentScan("com.kamo") in this application constructs it whether or not this serv...
Scan the shared MFA repositories
MfaEnrollmentService is a @Service in kamo-shared-library, so the wildcard @ComponentScan("com.kamo") in this application constructs it whether or not this serv...
Scan the shared MFA repositories
MfaEnrollmentService is a @Service in kamo-shared-library, so the wildcard @ComponentScan("com.kamo") in this application constructs it whether or not this serv...
Scan the shared MFA repositories
MfaEnrollmentService is a @Service in kamo-shared-library, so the wildcard @ComponentScan("com.kamo") in this application constructs it whether or not this serv...
Declare the MFA bean here, since the library no longer does
kamo-shared-library dropped @Service from MfaEnrollmentService so that ~40 services stop constructing an authentication component they do not use — that stereot...
Drop @Service so 40 services stop constructing an auth bean
MfaEnrollmentService shipped with @Service. Every Kamo service carries @ComponentScan("com.kamo"), so all of them construct it — but each declares its own EXPLI...
Auto-login after email verification via one-time key
When /verify-email responds with the additive otk + autoLoginHost fields (minted by SecurityService on first verification), deep-link straight to https://<host>...
Phase 3+4 — convert the traffic that already arrives
- changelog (#2 destination) gets a conversion block; careers shows the honest no-openings state - /subscribe page: post-registration plan intent lands somewher...
Mint auto-login OTK on first email verification
Completing the register wizard's email verification (6-digit code or email link) already proves inbox possession, yet the new user was bounced to the login page...
Related-content modules + signup CTA retargeting on programmatic templates
Solutions, integrations, alternatives, and glossary templates were organic dead ends: no internal related links and "Start free" CTAs pointing at /pricing inste...
Add the MFA repositories to the JPA scan — unbreaks login
@EnableJpaRepositories here is an EXPLICIT package list, not a wildcard. com.kamo.z.shared.mfa.repos was missing from it, so UserMfaEnrollmentRepository and Mfa...
Merge duplicate kamo key that crashlooped EmailService
The new EmailService pod has been in CrashLoopBackOff since 16e8a05 — 22 restarts, never once started. snakeyaml raises DuplicateKeyException on a repeated top-...
Gate login on the second factor — §164.312(d)
Completes MFA. The core landed in kamo-shared-library; this is the wire that turns stored configuration into an actual gate. The gate is small because login al...
Pin the constructor Spring uses, and prove the context starts
MfaEnrollmentService is a @Service and every Kamo service component-scans com.kamo, so it is instantiated in roughly forty applications. It had two constructors...
Accept starter/enterprise plan handoff, carry promo code, target www /subscribe
kamo-register now whitelists starter|business|enterprise and stashes sp_checkout_code; the old pro|business filter silently dropped Starter buyers, and the apex...
Apply the image policy to every page, not just the authenticated ones
The policy was attached only at the final `NextResponse.next()`, so /logout and /validate — both real, browser-rendered documents — were served with no img-src ...
Phase 0+1 — instrument the real funnel, unblock first paint
- forward data-* props through MagneticButton/RippleButton (events never reached the DOM) - instrument SharedNavigation, Hero, PreviewBanner, section CTAs; ?ref...
Unblock portrait phones, add analytics funnel analytics, fix plan handoff
- Remove the portrait-phone gate and "rotate your phone" dialog that hid the entire wizard on portrait phones; the wizard now renders single-column below th...
TOTP second factor — §164.312(d)
The compliance assessment called the absence of any second factor disqualifying on its own, and under the 2025 Security Rule NPRM MFA stops being addressable at...
Add analytics analytics + ?registered=1 welcome notice
- Mount analyticsAnalytics client component in the root layout: next/script loader for analytics.kamocrm.com scoped via data-domains to login.kamocrm.com on...
Create the second-factor tables
Backs UserMfaEnrollment and MfaRecoveryCode in kamo-shared-library — §164.312(d) Person or Entity Authentication, the gap the compliance assessment called disqu...
Require VIEW_CALL_LOGS for call playback in PHI-handling orgs
Recording and voicemail playback checked tenancy and nothing else: any member of the owning org could pull any call in it, transcript included, on extensions th...
Automatic logoff after inactivity (HIPAA 164.312(a)(2)(iii))
A session left open on an unattended workstation stayed usable indefinitely. This terminates it after 15 minutes of no interaction, with a 60-second warning so ...
Audit WOPI content endpoints and close the last byte-serving gaps
WOPI serves whole documents to Docs and recorded nothing. GET /wopi/files/{id}/contents is the same disclosure as /download, relayed the same way through APISer...
Restore theme assets — CSP derived the wrong host and SVG was disabled
Avatars, org logos and backgrounds stopped loading for every tenant. Two separate regressions I introduced in 36ad904b, both live for hours. 1. The per-request...
Promote an ingested eligibility matrix from the console
For an ELIGIBILITY_MATRIX source document the ingestion panel now shows a "Promote as eligibility matrix" card: pick the product, limit type (MAX_LTV/CLTV/DTI),...
Gateway relay to promote an ingested eligibility matrix
**************** gain promote-eligibility, mirroring promote-adjustments: god-eligible gate, organizationId server-stamped via write(), downstream 4xx relayed v...
Ratchet on endpoints that resolve no session
ResourceServerConfig is anyRequest().permitAll() and @EnableMethodSecurity appears nowhere in this service, so every @PreAuthorize is inert and public is the de...
Authoring UI — list, line-item editor, share-link management
Completes the quote/estimate system: staff can now build a quote, price it, mint a share link and email it, all from the pipeline. app/lib/quotesApi.ts ...
Close the /_next/image open proxy
remotePatterns was [{ protocol: "https", hostname: "**" }]. That made the image optimizer a general-purpose fetcher: any caller could ask this server to retriev...
Record lead reads and refuse un-auditable exports
HIPAA §164.312(b) for SecurityService. The platform records every lead CHANGE (LeadHistory) and every login (SystemAccessLog) and records no READ at all, so "wh...
Public branded quote/estimate document at /{locale}/q/{token}
The customer-facing surface for the commerce quote system. Server-rendered so the org's branding is in the first paint — an unbranded flash on a commercial docu...
Quote REST surface — staff management and public share links
Staff endpoints at /api/security/commerce/quotes and an unauthenticated resolver at /api/security/public/quotes. QuoteController extends BaseLosController rath...
Quote/estimate domain — entities, pricing engine, share links
Adds a first-class Quote alongside the existing commerce spine. The pre-existing "ServiceQuote" is an Intent plus a JSON blob carrying one offering and one flat...
Egress containment for the avatar resolver, as a CiliumNetworkPolicy
Reinstates what 8f6c672 reverted, in the only form that actually works here. The earlier attempt failed because a plain NetworkPolicy cannot express this clust...
Show a facepile for group conversations
A thread with five people on it was represented by one arbitrary face, which reads as a message from one person. Up to three participants now overlap, so "sever...
Instrument the chain, reap expired entries, record disclosures
Every failure mode in this feature is silent. A latched circuit breaker, a worker queue discarding every task, a provider that started returning HTML — each loo...
Promote an ingested LLPA matrix into adjustments from the console
The ingestion panel could only publish a rate sheet. For an LLPA_MATRIX source document it now shows a "Promote as LLPA adjustments" card: pick the existing rat...
Gateway relay to promote an LLPA matrix into conditional adjustments
**************** gain promote-adjustments, mirroring the promote-rate-sheet relay: god-eligible gate, organizationId server-stamped onto the payload via write()...
Record call recording, voicemail and transcript access
Recording playback left no trace. A recorded call is the densest PHI the platform stores — the unredacted conversation — and "who listened to this call" was una...
Show the other party in Sent, not the reader's own face
Both list views keyed a row on its sender, so every row of the reader's own outbox showed the reader — their photo, their name, their address. The message list ...
Let org owners configure sender photos without a rights grant
The settings endpoint required MANAGE_EMAIL_AVATAR_SETTINGS and nothing else, so it shipped dormant: a brand-new right is held by nobody until an admin assigns ...
Record PHI access on every read of stored AI conversation history
Wires the shared §164.312(b) spine into the paths that read persisted prompts and completions. The assistant is the module the compliance assessment put OUTSIDE...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.