Put memberId on RecipientSummary, and stop the IP check DNS-resolving
A caller that acts on a recipient's status has to be able to establish WHOSE status it is. DocsService's legal-package Finish writes a WORM attestation on the s...
Prove WHOSE signature Finish counts, and report the live one
verify() compared the caller to assignment.teamMemberId but never to the ENVELOPE RECIPIENT's member — it trusted the recipientUid the delivery fan-out wrote. A...
Let a member actually finish a package, and reach the page at all
canFinish required every document row to already be SIGNED/ACKNOWLEDGED, but **************** is the ONLY writer of those statuses — the delivery worker writes ...
Drop the outer padding around the member Docs tab
DocManager brings its own toolbar and grid chrome, so the p:4 inset just shrank the grid and left a visible gap the /hr/resources page does not have. Matches th...
Copy a deduplicated document's objects into its own association bucket
Object storage is bucket-per-association (every reader resolves img.getAssocId().getBucket()), but deduplication is scoped ORG-wide or GLOBALly and so crosses a...
Cap the legal audience roster, and refresh after Deliver
The Assigned Packages grid filled its team-member filter column by asking audience-preview for allTeamMembers:true on mount -- a name and an email address for e...
Commit before the fan-out, and stop redeliver reissuing nothing
Redeliver published the new version row, flipped every OPEN assignment to SUPERSEDED, and submitted the reissue from inside that same uncommitted transaction. T...
Widen the read gate to match hrTabs.ts, make a cleared due date actually clear
LegalPackageAccess.requireRead demanded VIEW_EMPLOYEES alone while hrTabs.ts admits the Legal & Compliance tab on VIEW_EMPLOYEES || EDIT_EMPLOYEES || MANAGE_HRS...
Wire publish and audience preview, and stop rendering a broken label
publishPackage, previewAudience and getPackage shipped with no caller. The templates grid now has a Publish row action — disabled when the package has no binder...
Enforce HR rights and make the fingerprint see the e-sign design
All seven /api/docs/legal mappings authorized on org membership alone, so any authenticated member could list, edit, delete and publish legal packages — and aud...
Restore external images in email bodies
External images stopped rendering when the page-level image policy shipped. The middleware sets `img-src 'self' data: blob: https://theme.<apex> https://*.<apex...
Cap the send dialog's recipients at the template's declared slots
The Send for signature dialog seeds one recipient row and offers an unbounded "Add recipient", but it never fetched the template's signer slots. ESigService rej...
Let a send under-fill a template's signer slots, keep rejecting over-fill
The signer-count check added last round demanded an EXACT match against the template's declared slots, which would have silently stopped mortgage disclosures go...
Complete delegated envelopes, and reject a bad signer count before sending
envelopeComplete required a literal SIGNED from every recipient, but delegate() leaves the delegator DELEGATED forever and ADDS the replacement instead of subst...
Scope a decoder to the recipient who decoderd
Any single recipient declining set the whole envelope DEcoderD, so a counter-signer could destroy signatures the other parties had already given, with no recove...
Enforce required fields on the server, not just in the browser
submit() validated only consent and step-up; it accepted an empty values list and still marked the recipient SIGNED. Ports validation.ts (esign-core), including...
Bind every recipient to a template signer slot
No caller supplied signerUid, so recipients were created without one. buildSession filters a signer's fields by signerUid, so myFields came back empty, completi...
Drive the mail badge from pushed unread counts, not a 30s poll
MailButton ran setInterval(fetchUnreadCount, 30_000) in every open tab, and each tick called /api/email/folders — an endpoint that opens every folder in the mai...
Fail the run when a required UNIQUE index cannot be created
ensure() caught Exception and logged, so a failed CREATE UNIQUE INDEX reported success and the service booted with no uniqueness guarantee at all — the one outc...
Make the audience FKs and the attested wording actually hold
Five defects from the whole-branch review, all in the evidence path. The audience FKs did not cascade. cascade = CascadeType.DETACH is a persistence-context ca...
Enforce document/binder collection scope in addItem
BinderService.addItem checked read access and refused VAULT/LOAN documents, but never compared the document's own collection to the binder's, so a hand-crafted ...
Scope empty binders to (MY_DOCS, '') not the owner's member id
The My Docs DocManager never passes an assocObjectId prop, so it always resolves and queries (3, ''). BACKFILL_EMPTY_SQL was scoping empty binders to (3, member...
Guard loadBinders by request identity, not scope value
sameBinderScope alone can't tell two in-flight requests for the SAME scope apart (A -> B -> A), so a slower older request could still overwrite a newer one. Tra...
Show only the binders belonging to the open collection
OrganizerTab already received assocType/assocObjectId and passed them to the editor's document picker, but loaded the binder LIST unscoped — so every DocManager...
Correct javadoc on Hibernate ddl-auto behavior for NOT NULL columns
CockroachDB rejects ADD COLUMN ... NOT NULL without a DEFAULT on a populated table, so Hibernate's ddl-auto attempt fails (logged, non-fatal) rather than no-opp...
Add a close button to the automated-imports manage dialog
The manage popup had no dismiss affordance in its header — only the backdrop and Esc closed it. Add an X icon button beside the edit action.
Tell a tool component when its window is maximized
Maximizing a tool window repaints the shell at 100vw/100vh but leaves the window's stored size untouched, and that stored size is what ToolDock hands the compon...
Keep fields on the page when a document opens at a remembered zoom
Reopening a document could draw every field small and up in the corner, until one click of the zoom control snapped them all into place. The page box that fiel...
Stop replies drawing a gridded copy of the quoted signature
Replying to a message sent from Kamo showed the signature twice: the live one, and above it a mangled version of the quoted original's, drawn as a bordered spre...
Number pages against the document the reader gets
Modifiers were keyed off a page's index in the design, which is an identity that survives deletion and reordering, not a position. So deleting page 2 left the p...
Load the number in the softphone without placing the call
Tapping an extension or a number on a correspondent card passed autoDial, so the call went out the moment the softphone registered. The card opens on hover, whi...
Give the card's readout labels room to breathe
The label column was a hand-picked 76px. DEPARTMENT is wider than that, so it overflowed its box and sat flush against its value with no gap, and LOCAL TIME wra...
Group an imported radio field's buttons natively
The buttons of one AcroForm radio field are imported as separate linked fields, one choice each, so each keeps its own box on the page. They were named after th...
Paint the correspondent card in the tenant's brand colour
The card was tinted with --accent-comms, the fixed indigo the instrument panel uses to mark the messages family. On the solid "New message" button that reads as...
Stop dark-mode pastes landing as invisible text in the composer
Copying an answer out of ChatGPT (or any dark-themed page) and pasting it into the compose body produced a large white block with nothing in it, and the message...
Share the public join link, not the members-only redirect
A meeting link written into an email was pointing at /meet/join/<id>, which mints a one-time key from the clicker's Kamo session — and redirects anyone without ...
Stop Hibernate mangling the "::" casts in the native SQL
Hibernate's native-query parser treats "::" as an escaped colon and forwards a single ":". CockroachDB received **************** ARRAY[]:text[]), ' ') and r...
Keep retrying the indexer's durable NATS consumer after a deploy
A rolling deploy overlaps pods and the outgoing one still holds the durable consumer, so the incoming pod's bind to "email-metadata-indexer" fails with [SUB-900...
Stop recipient names being clipped to a letter
The chips were inline-flex boxes whose label carried `truncate`. A flex child with overflow hidden is allowed to shrink below its own content, and nested inside...
Adapt the metadata indexers to array-typed columns
Follows the kamo-shared-library change that maps conversations/search_index array columns as String[]/UUID[] rather than List<T>, which is what stopped every in...
Map the metadata array columns as Java arrays, not List
Both entities declared their array columns as List<T> under an explicit @JdbcTypeCode(SqlTypes.ARRAY). On Hibernate 6.2.13 that combination resolves the array's...
Drop the inset around the Resources document manager
DocManager brings its own toolbar and grid chrome, so the 32px wrapper padding was only shrinking the grid inside an already-bounded pane. The wrapper stays as ...
Bound the bulk folder index and stop it on structural failure
Uncommitted work from a concurrent session, swept in so the tree is clean. The bulk index walked pages with totalPages set to Integer.MAX_VALUE and no ceiling,...
Show the full section-index rail instead of a nested scrollbar
The left nav rail was capped at calc(100vh - 128px) with overflowY: auto, so an org with most features enabled (up to 18 sections across 4 groups, ~710px) grew ...
Stop the passdb from splitting a mailbox across two maildirs
password_query returned `email as user`, which overwrote the %Lu-lowercased login name with the row's stored casing. user_query then interpolated %n from the re...
Portal the break-glass dialog to the body
Clicking break glass opened the dialog inside the nav rail instead of over the page. The overlay is a bare fixed-position motion.div, not a MUI Dialog, so it ha...
Mirror Maven Central and retry, so a corrupt transfer stops killing the build
The session security-level fix failed to deploy because bcprov-jdk18on:1.72 arrived corrupted — 'Tag mismatch' is a TLS auth-tag failure mid-transfer, not a mis...
Name the full logo correctly and resolve an org's domain deterministically
Three defects in how an organization's branding location is derived. my-networks named the full logo "logo-full." + logoFullExt, defaulting to "svg" when the c...
Record the uploader on a deduplicated document
registerExistingDocument built its Img without .createdByMember(member), which the normal upload path sets. Every document registered through dedup therefore la...
Proxy foreign org logos so the tenant img-src policy can't block them
/network is the one page that renders another tenant's branding: it lists every organization in the network and loads each logo from that org's own theme.<domai...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.