Commit outstanding work in progress
Staged and committed as-is so nothing is left uncommitted in the working tree. 76 files changed, 254 insertions(+)
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Resolve signer display timezone from member, then org
Signing dates were rendered in whatever zone the client defaulted to, so an envelope expiring 2026-08-03T05:00Z could read "Aug 3" to a Pacific signer for whom ...
Emit the signer locale segment in signing links
Extracts the byte-for-byte duplicated buildSignLink into SignLinkBuilder and adds a locale segment sourced from Organization.language, falling back to English f...
Internal signed-document download + recipient delegation fields
- GET **************** streams the executed (flattened) PDF for an org-owned envelope (404 until fully signed). - RecipientSummary carries **************** ...
Surface recipient decoder reason + internal resend endpoint
- RecipientSummary now carries decoderReason + decoderdAt (persisted by the decoder ceremony but previously omitted from every projection), so a compliance-...
Internal mint-sign-link primitive for first-party signing surfaces
POST **************** re-mints a recipient's access token and RETURNS the signing deep-link (no invite-email round-trip), so the MLOS borrower portal can hand a...
AntPathRequestMatcher — immune to multi-servlet contexts
Belt-and-braces with the shared-lib SoapClientOnlyGuard (c4a3b2c): the 891c58c build raced the guard's push into shared-lib main and kept crash-looping on 'more...
Rebuild for shared-lib SoapClientOnlyGuard (f8bcc82) — servlet guard clears the crash-loop
Rebuild for shared-lib client-only spring-ws (55eae0a) — clears the multi-servlet crash-loop
Non-metered internal platform-envelopes endpoint — DISCLOSURE-context signing rail
Platform-internal envelopes (mortgage disclosure/closing signing) are product, not the tenant's programmatic API usage: tagged MANUAL so completed signatures ne...
Use cluster MinIO service DNS; drop deprecated WireGuard/CGNAT IPs and retired k2m1/k0m1
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Wire internal-auth secret from ***
ESigService now validates X-Internal-Auth against the same shared secret APIService presents **************** from the *** k8s secret), hardening the programmat...
Internal programmatic envelope API (origin=API) for Business
- EsignInternalController (/api/esig/internal/*): X-Internal-Auth + X-Org-Id authed, called by APIService after it validates the API_SIGNATURE-scoped key; r...
Generic envelope create/send engine (sender side)
Add the OTK-authed /api/esig/envelopes API kamo-internal drives to send documents for signature, reusing the same shared-lib entities the public signing API rea...
Public signing API engine for sign.sign.pink
Implement the /api/esig/public/* signing API the kamo-signer app calls, turning the live signer from preview-stub into a working backend. - validate (recipient...
Scope concurrency to build jobs, not Kubernetes deploys
Workflow-level concurrency serialized the whole pipeline (including kubectl rollouts). Move the group to the build job only so deploy jobs from different runs c...
Rebuild for kamo-shared-library update (CREATE_CHILD_ORG right + apply-to flags)
Pulls the new RoleRightType.CREATE_CHILD_ORG (id 131), the three apply-to flags on ChildOrgSecurityModel, the two 13-arg service overloads, and the AppliedModel...
Rebuild for kamo-shared-library update (appConfig upsert-only fix)
Pulls the hardened **************** that no longer deletes appConfig rows whose service types are absent from the caller's payload — prevents silent data loss w...
Rebuild for kamo-shared-library update (effective-feature resolver)
Picks up the new AppliedModelEnforcementService methods (computeAvailabilitiesMap, isAppEffectivelyEnabled, getEffectivelyEnabledAppTypes, computeEffectiveFeatu...
Bump kamo-shared-library to 1.5.0 for applied-model enforcement
Brings this service onto kamo-shared-library 1.5.0 so it picks up the new AppliedModelEnforcementService, ChildOrgSecurityModelAppConfig entity, ServiceAvailabi...
Rebuild for kamo-shared-library update (runtime force rules + DEFAULT fallback in MemberRightsAppliedService)
Triggers a rebuild so this service picks up the updated **************** that applies template force rules and DEFAULT-template fallbacks on top of the existing...
Rebuild for kamo-shared-library update (master model, default role templates, force-rule resolver)
Triggers a rebuild so this service pulls the new kamo-shared-library revision containing Organization.branchTypeID, Organization.masterModelID, ****************...
Replace upsertSigners with full delete+insert to handle frontend temp UUIDs
The frontend assigns temporary crypto.randomUUID() values to newly-added signers before any backend call. The previous upsert-by-uid logic would throw 404 for t...
Add CockroachDB transaction retry for template init endpoint
CockroachDB serializable isolation can trigger RETRY_SERIALIZABLE on the read-then-write pattern in initTemplate. Retries up to 3 times with backoff when detect...
Correct OTK Redis key format and add imaging template list endpoint
OTK keys use OTK<id> and ***<id> (no colon) matching the Next.js proxy. Added POST /api/esig/templates/list to query imaging templates via shared library ImgRep...
Replace OTK auth with trusted session headers for internal K8s calls
ESigService is internal — the Next.js backend reads the session from Redis and passes orgId/memberId/userId as X-Org-Id, X-Member-Id, X-User-Id headers. No OTK ...
Add template init endpoint to find-or-create templates by imgId
The create page uploads to the imaging system and redirects with imgId. The edit page now calls POST /api/esig/templates/init with the imgId to find an existing...
Scan all shared library repository packages to resolve bean dependencies
ComponentScan picks up shared library services which depend on repos in donotmodify.dao.repos and commerce packages — must scan those too.
Remove .mvn/ copy from Dockerfile — directory does not exist in this project
Initial ESigService Spring Boot project for e-signature template management
New microservice with REST API for e-signature template CRUD, signer management, design version snapshots, and field link tracking. Includes OTK auth filter, Fo...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.