Live Change Log

This endpoint is where a member finds the string they paste into Google's console, so it is the endpoint that was wrong: it returned only the redirect the org h...

One rule, in one place, for the three endpoints that write a USER account: the profile's member update, the profile's personal address, and the platform Users t...

The member payload now carries accountOwnedByThisOrg. The console used to work this out for itself by comparing the READER's securityOrgId to the current organi...

Every SecurityService pod built since 4bd25e7 fails to start: The dependencies of some of the beans in the application context form a cycle: ┌──->──┐ ...

The console adopts this response as its new state. It returned the address and `canChange` but not `mode` or `isSelf`, so after a successful operator write `mod...

The tenancy rule refused a god-eligible caller on their OWN record whenever their session was in an organization other than the one that owns the account. That ...

The personal address was self-only. It is also the address an administrator has to be able to correct — a member who has lost the mailbox on their account canno...

The System User is god by construction, so every session minted for it carries GD and offers break glass. That is fine only because the identity does not compos...

Sixteen of SecurityService's seventeen scheduled sweeps have a shared effect and now take a named distributed lease before running. There is no ShedLock anywher...

Every "which networks can I reach" row carried logoUrl and logoSimpleUrl derived from the org's alias alone, for any org whose alias was path-safe — which is al...

Two endpoints beside the terminal ones, and they follow the same rule those do: the Linux account is resolved from the CALLER'S OWN SESSION and no account name ...

sendPasswordReset had no transaction, so the User came back detached and `securityProvider` stayed an unresolvable lazy proxy. Working out which organization's ...

kamo-login and kamo-register run on their own hosts with no OrgContext, so this file is the only route their branding takes - the same one KamoMeet already uses...

Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...

Two surfaces on the USER account, which until now had no server of its own — the account's fields were reachable only through MemberController, an endpoint scop...

GET /api/security/domains/{id}/spf, for the SPF step on /setup/dns. The setup page cannot give one set of SPF instructions to everybody, because the right inst...

Forgot-password resolved the address typed on the form against two sources: the account e-mail, and the org mailbox flagged Primary on the member's settings. Th...

Two things, one of which is the point of the commit. The comment: patchOrganization is an ALLOW-LIST and it lives in the shared library, not here. This control...

Force-logout deletes *** sessions, which ends a browser. It does NOT end a phone: KamoMobile holds a durable device token and mints a fresh *** from it the mome...

The org-scoped twin of PlatformOAuthClientController, behind **************** Same DTO shape, same encrypt-on-write, same never-return-a-secret rule, plus platf...

**************** refused /org/public/by-host/{host}, which is exactly its job — a new mapping that resolves no session is reachable without credentials through ...

A white-label sign-in screen is reached at login.<customer domain> with no ?org= on the URL and nothing in sessionStorage, so the front end has no way to name t...

The dispatch prepares the hand-off on the dev machine — screenshots, video and the composed prompt written to disk — and answers with the terminal it will run i...

MANAGE_JOB_POSTINGS and VIEW_JOB_LISTINGS are inserted as NOT_SPECIFIED like every new right, so without a seed the /hr/careers tab and the member Careers tab w...

GET **************** DELETE and PATCH on /terminals/{id}. Every one of them resolves the Linux account from the CALLER'S OWN SESSION and passes no account name...

MANAGE_MEMBER_SECURITY passed the change-password gate, which made "can administer members" and "can take over any member's account" the same right. They are no...

The reported symptom was a terminal that opened and immediately said "Disconnected", with nothing to act on. Reproduced end to end: the ticket mints fine (200) ...

LeadFieldMaskTest still expected a null e-mail. The mask now obfuscates rather than blanks — a blank field reads as "this lead has no e-mail", which is a differ...

**Endpoints for the new gate.** /leads/available-summary and /leads/available now report both reasons a member is blocked — leads owed a note since they were as...

This repo's workflow applies exactly configmap.yaml, deployment.yaml and service.yaml, so a fourth manifest beside them was never applied by anything — the rout...

Found by probing the deployed endpoint, not by reading it. Returning false from a HandshakeInterceptor aborts the handshake but sets nothing on the response, so...

Run 5861 failed in two seconds, before any compilation: the runner could not reach data.forgejo.org to fetch actions/checkout. Nothing to do with the tree, and ...

The agent parses the request with a buffered reader and then pumps the raw socket, so a byte sent ahead of the status line would be stranded in that buffer and ...

Bridges a browser to a PTY on the member's own dev machine. Binary frames are the terminal, text frames are control; on the far hop an HTTP 101 onto a length-pr...

A record that is both an organisation and a person is named "Harmony Home Loans (Nickolas McGarry)" — the company leads, the contact qualifies. That rule lives ...

GET **************** takes the SAME query string GET the lead detail page draws — across every lead the filter bar matches. "What has been said to the leads I a...

Picks up entitlement-cache invalidation on comp provisioning. This service owns both halves: it approves the order and it serves the cached entitlements, so wit...

Picks up the draft-order reprice fix: changing a draft's seat count or billing cycle left every money field and line item describing the order's previous shape,...

Picks up the comp-provisioning fix. A comped order granted its plan and none of the add-ons it sold, because provisionCompSubscription never wrote active_addon_...

A domain typed into the create form is a CLAIM, not a host. Ownership is proven by a DNS TXT record afterwards and a certificate is issued after that, so betwee...

MemberCreationService documented steps 4-6 as best effort, and for the emails it was not true. sendVerificationEmail is @Transactional, so it joined the member-...

A second door beside the same-org god-mode one. Gated on the new IMPERSONATE platform right via @RequirePlatformRight, where the existing door is gated on the s...

A member who signed in on login.kamocrm.com, picked a workspace from the chooser, and landed inside it — on internal.kamocrm.com, wearing the platform's hostnam...

Ships the lead contact location fix, which lives in the shared library: LeadDTO now returns the lead's own country, subdivision and timezone, so the three Prima...

The method rebuilds UpdateQuoteRequest positionally, so a field added to that record and forgotten here is dropped from every save by a member without EDIT_QUOT...

withTermsUnchanged rebuilds UpdateQuoteRequest positionally for a member who may not rewrite the terms. setupFee was added to that record and not added here, so...

Ships the quote document work, all of which lives in the shared library: - a one-off setup fee on a single-price quote (commerce_quotes.setup_fee, which is a...

"I created a link and got no email." Two independent silent drops, both of which return a swallowed false that the panel rendered as plain success. 1. kamo.ema...

Ships the quote pricing fix: a unit price is a per-month rate, so a term multiplies it rather than the engine dividing down to it. An annual option quoted one m...