Live Change Log

Replaces stubs with real, endpoint-backed panels + fixes a dead-write bug: - Underwriting: Income calculation panel (qualification: DTI/PITIA/reserves/LTV + A...

MlosCatalogController/Client gain promote-bulletin, mirroring promote-guideline (god-eligible gate, org server-stamped). Baselined promoteBulletin in the unguar...

The §164.312(b) trail was going to Slf4jPhiAccessLogWriter: 14-day platform retention against a six-year obligation, and nothing that can be queried. The lead r...

SecurityService now gates login on a second factor (§164.312(d)). When one is owed it creates the session but withholds its one-time key, returning a short-live...

Call recordings, voicemail audio and transcripts were audited into the log stream, which keeps 14 days against a six-year §164.528 obligation and cannot be quer...

Stored assistant conversations are the reads least able to afford a 14-day, unqueryable log stream: the module sits outside the compliance boundary, so prompts ...

Chat message reads were recorded through the Slf4j default writer, which puts the §164.312(b) trail in a 14-day log stream against a six-year retention obligati...

KAMO_MFA_SECRET_KEY maps to kamo.mfa.secret-key by Spring's relaxed binding, and is what MfaEnrollmentService uses to encrypt stored TOTP secrets at rest. With...

DocsService serves document bytes, so its trail is what an accounting of disclosures under §164.528 is actually assembled from. It was writing to a 14-day log s...

Turns §164.312(b) from a log line into evidence. The capture layer has been wired across seven services for a while, but it wrote through Slf4jPhiAccessLogWrite...

Until now PHI access was recorded only to a log stream with 14-day retention against a six-year obligation, and with no query surface. An accounting of disclosu...

Adds the HMDA ULI to the LAR export. UliMinter builds the ULI = org LEI(20) + loan number + two ISO 7064 MOD 97-10 check digits (Mod97CheckDigit — the IBAN algo...

The Company Info card gains a Legal Entity Identifier field (20-char, upper- cased), sent through the existing org PUT — OrganizationController deserializes it ...

For a GUIDELINE source document the ingestion panel shows a "Promote as guideline version" card (product select + revision label). The rate-sheet card is now hi...

MlosCatalogController/Client gain promote-guideline, mirroring promote- eligibility: god-eligible gate, organizationId server-stamped via write().

When /verify-email responds with the additive otk + autoLoginHost fields (minted by SecurityService on first verification), deep-link straight to https://<host>...

- changelog (#2 destination) gets a conversion block; careers shows the honest no-openings state - /subscribe page: post-registration plan intent lands somewher...

Completing the register wizard's email verification (6-digit code or email link) already proves inbox possession, yet the new user was bounced to the login page...

Solutions, integrations, alternatives, and glossary templates were organic dead ends: no internal related links and "Start free" CTAs pointing at /pricing inste...

Completes MFA. The core landed in kamo-shared-library; this is the wire that turns stored configuration into an actual gate. The gate is small because login al...

- forward data-* props through MagneticButton/RippleButton (events never reached the DOM) - instrument SharedNavigation, Hero, PreviewBanner, section CTAs; ?ref...

The compliance assessment called the absence of any second factor disqualifying on its own, and under the 2025 Security Rule NPRM MFA stops being addressable at...

- Mount analyticsAnalytics client component in the root layout: next/script loader for analytics.kamocrm.com scoped via data-domains to login.kamocrm.com on...

Backs UserMfaEnrollment and MfaRecoveryCode in kamo-shared-library — §164.312(d) Person or Entity Authentication, the gap the compliance assessment called disqu...

Recording and voicemail playback checked tenancy and nothing else: any member of the owning org could pull any call in it, transcript included, on extensions th...

A session left open on an unattended workstation stayed usable indefinitely. This terminates it after 15 minutes of no interaction, with a 60-second warning so ...

WOPI serves whole documents to Docs and recorded nothing. GET /wopi/files/{id}/contents is the same disclosure as /download, relayed the same way through APISer...

For an ELIGIBILITY_MATRIX source document the ingestion panel now shows a "Promote as eligibility matrix" card: pick the product, limit type (MAX_LTV/CLTV/DTI),...

**************** gain promote-eligibility, mirroring promote-adjustments: god-eligible gate, organizationId server-stamped via write(), downstream 4xx relayed v...

Completes the quote/estimate system: staff can now build a quote, price it, mint a share link and email it, all from the pipeline. app/lib/quotesApi.ts ...

HIPAA §164.312(b) for SecurityService. The platform records every lead CHANGE (LeadHistory) and every login (SystemAccessLog) and records no READ at all, so "wh...

The customer-facing surface for the commerce quote system. Server-rendered so the org's branding is in the first paint — an unbranded flash on a commercial docu...

Staff endpoints at /api/security/commerce/quotes and an unauthenticated resolver at /api/security/public/quotes. QuoteController extends BaseLosController rath...

Adds a first-class Quote alongside the existing commerce spine. The pre-existing "ServiceQuote" is an Intent plus a JSON blob carrying one offering and one flat...

Reinstates what 8f6c672 reverted, in the only form that actually works here. The earlier attempt failed because a plain NetworkPolicy cannot express this clust...

A thread with five people on it was represented by one arbitrary face, which reads as a message from one person. Up to three participants now overlap, so "sever...

Every failure mode in this feature is silent. A latched circuit breaker, a worker queue discarding every task, a provider that started returning HTML — each loo...

The ingestion panel could only publish a rate sheet. For an LLPA_MATRIX source document it now shows a "Promote as LLPA adjustments" card: pick the existing rat...

**************** gain promote-adjustments, mirroring the promote-rate-sheet relay: god-eligible gate, organizationId server-stamped onto the payload via write()...

Recording playback left no trace. A recorded call is the densest PHI the platform stores — the unredacted conversation — and "who listened to this call" was una...

Wires the shared §164.312(b) spine into the paths that read persisted prompts and completions. The assistant is the module the compliance assessment put OUTSIDE...

Sending a message left a row; reading one left nothing. Every chat, support and social thread on the platform renders from a handful of endpoints here, and none...

/download already logged through **************** and it was the platform's only byte-access injection site. The sibling endpoints serving the exact same bytes ...

SecurityService now runs a fetcher whose target URL is chosen by an untrusted party — a BIMI record is DNS content published by whoever owns a sending domain, a...

The mailbox rendered a single letter on a single shared gradient for everyone, so every row looked the same and the circle carried no information. It now shows ...

Adds the mailbox side of sender avatars, and fixes three pre-existing holes this work would otherwise have built on top of. AUTHENTICATION. OTKPreAuthFilter us...

Resolves a correspondent's email address to a picture, working outward from what Kamo already knows: member photo, then a photo someone attached to a contact, t...

Backing store and queries for the mailbox sender-avatar chain. SenderIdentityEntity is the durable tier of the avatar cache. org_id is part of the natural key ...

The Security Rule requires recording access to ePHI, which means reads. The platform records changes well — LeadHistory, SystemAccessLog, UserHistory, LoanAudit...

Two call sites of featureService.enableFeature now understand the HIPAA boundary: - /enable maps PhiModuleNotPermittedException to 403 carrying the reason, m...