The scenery sampler identifies as kamouniverse.com; the steward test follows the platform console
- FaunaClient's User-Agent to GBIF named https://kamocrm.com as the product's contact URL; it names https://kamouniverse.com, the platform's primary apex. - S...
Place the KamoAI voice cron keys clear of SP05's and SP10's
SP05's Tool Plane jobs add their cron fields after leadLedgerReconcileCron and their ConfigMap entries after kamoai-hire-steps, and SP10's tick adds its field a...
Pin DaemonService to k3m1, where the earthdata drive lives [skip ci]
k1m1 reaches /mnt/worldchunks only through a hard NFS mount of k3m1. That mount has hung, so the kubelet on k1m1 cannot stat the earthdata hostPath. A rollout t...
Delete the second calendar reminder path — EmailService's sweep is the only one
Pin kamo-shared-library 1.6.1, the only version that exists
The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...
No job overlaps itself, and no HTTP call can hang a worker forever
Quartz here runs 10 in-memory worker threads on one replica. 17 of the 24 jobs had no @DisallowConcurrentExecution, so a run that overran its interval started a...
The lead-intake counters join the ledgers the daemon folds and recounts
The intake endpoints' received / imported counters are now a ledger (securityservice create_lead_intake_ledger.sql, applied 2026-09-22): a trigger on lead_intak...
Skip enabled connections that are not filled in yet
An enabled MERIDIAN_LINK connection with no instance URL, appCode or secret collapsed to a null|null poll-unit and failed token exchange every tick, logging ERR...
Read the public-chat secret by its own key
This pod also mounts mlos-internal-auth, whose INTERNAL_AUTH_SECRET env var relaxed-binds onto internal.auth.secret and outranks the ConfigMap. Every caller rea...
Accept OCI image indexes when resolving the built digest [skip ci]
The images are pushed as OCI image indexes, so asking the registry for a single image manifest only answered 404, the digest came back empty and the check faile...
Restart when a same-commit rebuild leaves pods on the old digest [skip ci]
The rollout step tried to detect a same-commit rebuild by comparing the Deployment's image reference before and after `set image`. "Apply manifests" has already...
Link the steward to the console the org can reach
StewardRecipientResolver built the steward link from the org's first domain row whatever its state, so an org still setting up its white-label domain was mailed...
Stop reporting a catalog bump as a missing SystemConfiguration row
Three scheduled jobs read a row and skip the whole tick if they cannot. All three were skipping ticks during schema changes, and two of them said so in a way th...
Prove the deploy by digest, not by tag
The preceding commit stops `set image` being a silent no-op. This asserts the outcome: after the rollout, the tag is resolved to a digest at the registry and th...
A rebuild of the same commit deployed nothing and reported success
The image is tagged with the commit SHA, so rebuilding the same commit produces an identical image reference. `kubectl set image` then changes nothing, the Depl...
Fail a bad rollout instead of reporting it green
Deploys replaced the only pod of each service with nothing to catch the requests in flight. Three settings, applied across the fleet: - preStop sleeps 10s befo...
Mark payload outcomes by column, not through the entity
payloadRepo.save() on a detached payload makes Hibernate walk its graph — organization pulls in org_domains — and that read lands in a transaction that has alre...
Stop overlapping runs importing the same payloads twice
The trigger fires every minute and each run claims work by selecting payloads still in RECEIVED. A backlog that takes longer than a minute therefore still had R...
Bump the processed counter instead of rewriting the endpoint
The job finished a batch by mutating totalProcessed on the endpoint entity it loaded before the batch began and saving the whole row. Two consequences: - it ...
Persist each payload's outcome as it happens, not in one batch
processEndpointPayloads looped over the batch mutating statuses in memory and saved them all at the end. createLead commits per lead, so any failure of that fin...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Annotate the injectable StewardNotifier constructor
DaemonService has been in CrashLoopBackOff for days — 1654 restarts on the pod before the last deploy, 60 on the current one — and never started: Failed to i...
Scan the shared MFA repositories
MfaEnrollmentService is a @Service in kamo-shared-library, so the wildcard @ComponentScan("com.kamo") in this application constructs it whether or not this serv...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Notify the ASSIGNED steward of a routed decision, via email
DECISION_ROUTED's steward notification was a record-only no-op: StewardNotifier fanned out over SMS to a static CSV **************** that is empty by default, a...
Crystalline/metamorphic basement classifies correctly (was VOLCANIC)
Macrostrat 'metamorphic and undivided crystalline (...may include volcanic...)' tripped the volcan substring; check metamorphic/crystalline before volcanic. Als...
Ridge petrology search to 25km, no relief gate
The gazetteer point often sits in the valley floor with the range 15-20km off; the 15km search + relief gate missed them (Yucca Valley returned alluvium despite...
Petrology reads the ridge bedrock, not the valley floor
A town centroid usually sits on valley ALLUVIUM while the mountains the scene draws are bedrock — so a granite-ringed desert town returned 'alluvium' and got no...
VoipGlobalSyncJob stamps the MLOS internal-auth secret VOIP actually validates
After the hostname fix the job 401'd: VOIP's InternalAuthFilter checks the mlos-internal-auth value, but the job read internal.auth.secret, which in DaemonServi...
VoipGlobalSyncJob targeted a nonexistent host — kamovoip-service, not voip-service
Every minute the job failed DNS on **************** the actual Service (and what StewardNotifier already uses) is kamovoip-service. Fixed the configmap default ...
Re-parent geolite config under daemon: so the weekly sync actually runs
Commit 53eed7b re-parented the geolite block under internal: while the code reads daemon.geolite.* — with SPRING_CONFIG_LOCATION replacing classpath defaults, G...
Boot crash — Ant matchers for the multi-servlet context (spring-ws /services/*)
MVC-implicit string requestMatchers are rejected by Spring Security 6 once the MeridianLink integration's MessageDispatcherServlet joins the DispatcherServlet —...
Drop poller link write so server-owned contentHash isn't clobbered; collision-safe poll-unit key
Consumer review findings - MLOS secret, HTTP timeouts, max-deliver clamp, 4xx skip, boot rebind
Adversarial review (2 lenses; 5 verifiers died on a session limit - adjudicated the 9 raw findings by hand, 6 real): - WRONG SECRET (confirmed by hash compariso...
Register JSR-310 on the consumer mappers - real envelopes carry an Instant occurredAt
E2E caught it: both real decision.routed events were dead-lettered as 'unparseable' because the bare ObjectMapper cannot deserialize java.time.Instant. findAndR...
Recreate deploy strategy so NATS durable consumers rebind on deploy
DaemonService binds EXCLUSIVE JetStream durable consumers (daemon-sync-trigger, **************** [the §2.8 breach loop], daemon-recording-received) in @PostCons...
Enable OutboxRelay @Scheduled backstop + @Async hot path
DaemonService activates the MLOS transactional outbox (mlos.outbox.enabled) and produces events (the compliance-timer breach emitter), but lacked @EnableSchedul...
Register com.kamo.z.shared.mlos.event repos (OutboxWriter dep)
Enabling mlos.outbox activates OutboxWriter, which requires MlosOutboxEventRepository (+ ProcessedEvent /DeadLetter) from com.kamo.z.shared.mlos.event — add tha...
Consume *** secret so X-Internal-Auth matches downstream services
DaemonService -> ConversionService **************** was returning 401 Unauthorized because DaemonService was stamping its X-Internal-Auth header from INTERNAL_A...
Enable JPA repos for commerce + email + dao.repositories packages
DaemonService crashed on startup with: Parameter 0 of constructor in **************** required a bean of type **************** that could not be found. A r...
Use imgRepository.findByDat() instead of lazy imgDat.getImages()
Quartz jobs run outside JPA sessions, so lazy collection access on ImgDat.images throws LazyInitializationException. Use explicit repository query instead.
Update WebinarReminderJob to use renamed repository method
Calls **************** with a 24-hour max window instead of the removed findWebinarsWithDueReminders method.
Enable redirect following for MaxMind download
MaxMind returns 302 redirect to the actual file. HttpClient wasn't following it, causing the sync to fail with HTTP 302.
Add SecurityConfig to permit daemon trigger and actuator endpoints
Spring Security defaults blocked all endpoints with 401. Added explicit config to permit /api/daemon/** and /actuator/** without authentication.
Rewrite GeoLite sync — correct download URL, streaming hash, batch inserts
- Use MaxMind's current permalink API with HTTP Basic Auth (account-id + license-key) - Streaming SHA-256 instead of Files.readAllBytes (prevents OOM on 100MB+ ...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.