Live Change Log

PUT **************** designates (or clears) a product's published application as the org's primary, mirroring the existing mlos-default single-active toggle. Ne...

LeadVendorProduct gains isPrimaryApplication: at most one published application per org is "primary" and is the one kamo-apps renders at the root of the org's a...

The states dimension of the campaign audience panel's and drip trigger's lead filter showed nothing checked by default, even though an unset list already means ...

The first real Hosted Computer reached AWAKE and then stayed awake forever. Hibernation reported resumeConfigured: false, IdleWatcher only arms when readiness i...

Two new steps after the existing SPF one, written for a non-technical owner the same way SpfCard already is — plain language, a "why this matters" box, and neve...

**************** reads marketIds/vendorIds/ vendorProductIds/states as one comma-separated param each (splitList()), but campaignAudienceApi's appendLeadFilter(...

Once SecurityService confirms a domain's DKIM record is published (org_domains.dkim_verified), password resets, invitations and other transactional letters sent...

WAKE_TIMEOUT_MS was 180_000 and sat exactly on top of the VM's readiness probe, whose initialDelaySeconds was 180 and which KubeVirt renders as 190. A computer ...

Adds two endpoints alongside the existing SPF one, so an org's transactional mail (password resets, invitations, notifications) can carry a DKIM signature and t...

A woken computer is only reachable once its Service has endpoints, and that happens when the readiness probe on 3389 first passes. initialDelaySeconds was 180, ...

The org's loan-application/patient-portal host is renamed from apps.<domain> to apply.<domain>. Update the Traefik IngressRoute's HostRegexp, the org-branding-b...

auto-cert's SUBDOMAINS list, the availability health-check URL and the middleware comment now match the apps -> apply subdomain rename in kamo-internal and secu...

The apps.* host serves the loan-application and patient-portal pages (kamo-apps), not app downloads, so rename the alias everywhere it is enumerated: KnownAlias...

The apps.<domain> host serves the loan-application and patient-portal pages, not app downloads, so relabel the /setup/dns card and reserve "apply" instead of "a...

Adds **************** to org_domains, mirroring the spf_verified/spf_checked_at pair already there — so a domain can hold a generated DKIM keypair and whether i...

The campaign editor's "All Leads" box and the drip trigger's lead filter could only match every lead the sender can see, with no way to target a market, vendor,...

The campaign editor's "All leads" audience source had no way to narrow who it reached beyond visibility scope. Adds a filter panel (Market -> Vendor -> Vendor P...

Guacamole connected, authenticated, and was hung up on: guacd: Security mode: Negotiate (ANY) guacd: Loading keymap "en-us-qwerty" guacd: RDP serve...

Being signed in to Kamo is the authentication that matters; asking again at the door of your own machine is a password prompt for its own sake. ComputeService m...

Opening a computer landed on the redirect service's fallback page — "the request reached the fallback page instead of being redirected. Check the Host header." ...

Clicking a computer opened a browser tab that closed again, and said nothing. openHostedComputer opens its tab synchronously inside the click, because a popup ...

computers is a standard alias now — every white-label org is told to point one at Kamo on /setup/dns, the way it points meet and sign — so two things had to fol...

One more card on /setup/dns, so an org configuring its domain is told about the host its Hosted Computers open on. Without it an org could follow the page to th...

Every white-label org points a fixed set of labels at Kamo and computers was not one of them, so an org could follow /setup/dns to the letter and still have a H...

DDL: **************** (column + partial-friendly index, applied to production already) and **************** (one-time catch-up, already run — 19,373 rows, all l...

Caller half of the kamo-shared-library fix: switches every findById() call on LeadVendorProductRepository in securityservice to whichever lean method matches wh...

Adds CommitLog.translationCount and **************** the library side of replacing the changelog translation-backfill sweep's GROUP BY .. HAVING scan with a pla...

Two related fixes to MemberRightsAppliedService, both in the same file: 1. **************** (via recalcChunk) and **************** unconditionally deleted a...

findById() on LeadVendorProduct pulls its default-EAGER vendor, which itself eager-fetches its own org AND its market (which eager-fetches ITS org again) — and ...

An organization whose security model fixes every Compliance answer (no product a member may switch, one age range for each member type) was still counted agains...

An organization whose security model fixes every Compliance answer (no product a member may switch, one age range for each member type) was still shown a ninth ...

Applied to the cluster by hand when the gateway certificate was set up; this is the same grant in the deploy step, so a rebuilt cluster does not have to redisco...

Listing computers.kamocrm.com for issuance is only half of it. Traefik requires a TLS secret in the IngressRoute's OWN namespace, so the cert is issued in `kamo...

Opening a Hosted Computer produced a browser tab that appeared and vanished. The launch link is correct and so is the token: SecurityService builds ************...

prepare-sleep writes the swap file and the resume wiring, then reports readiness — and readiness reads `resume=` from /proc/cmdline, which the kernel fixed at b...

virt-resize renumbers partitions. Canonical's image is laid out p14 (BIOS boot), p15 (ESP), p16 (/boot) and then p1 (root) physically last, and virt-resize rewr...

pg_stat_statements: `SELECT COUNT(c) FROM CommitLog c WHERE c.project IN (:~33 public projects) [AND c.commitTypeId = :t]` ran ~140K times a day at 100-200 ms e...

securityservice's create_commit_log_ledger.sql (applied by hand as the owner) adds commit_log_counts / commit_log_count_deltas: a total per (project, commit typ...

Three queries pg_stat_statements showed as kbservice's top production DB cost, all from asking in a loop (or with a plan the legacy YugabyteDB planner picked ba...

kbservice's public KB endpoints and its translation-retry sweep both asked KbArticleTranslationRepository one row at a time. Production's pg_stat_statements sho...

The public route is gone (28ba91b), but inside the cluster any pod could still reach this service, and several endpoints take no credential because none of its ...

Listing gift cards, issuing one and editing one (including its balance, which the shared library sets again as of the companion kamo-shared-library commit) chec...

19505faf stopped updateGiftCard from reading currentBalance so a member of one org could not rewrite another org's card by uid. The org-scoped lookup already cl...

They used a real lead's name and address from the report.

They used a real lead's name and address from the report.

They used a real lead's name and address from the report.

They used a real lead's name and address from the report.

The job wrote the compressed qcow2 the build produces straight into the golden claim. KubeVirt attaches a Filesystem-PVC disk with <driver type='raw'> — always,...

A row was headed by the sender's display name, or the part of the address before the @ when there was none, so a lead who wrote in read as "jlrivera1984" above ...

A row was headed by the sender's display name, or the part of the address before the @ when there was none, so a lead who wrote in read as "rodarisdolgovanton" ...