Live Change Log

Pairs with the shared-lib optimistic-lock change: when LoanPipelineService throws "Concurrent modification: refresh and retry", surface a structured {error, cod...

Concurrent "Advance" clicks could both write milestones. Adds @Version to LoanFile and an explicit flush in LoanPipelineService.transition so the OptimisticLock...

Polish pass aligning the frontend with the corresponding backend changes: - Components now render the resolved *MemberName fields from the backend (PipelineS...

- MortgageAppController: POST /{uid}/reos/{reoId}/liens, PATCH /{uid}/reo-liens/{id}, DELETE /{uid}/reo-liens/{id} — delegating to the new BorrowerSectionSe...

Cross-cutting polish pass across all LOS sub-projects: Member display name resolution (MemberNameResolver): - Single shared resolver service that follows the s...

Three more sub-projects shipped end-to-end: Sub-project 5 — Pricing & AUS section on the detail page: - Pricing snapshots list with add dialog (program, invest...

Three new REST controllers under /api/security/mortgage-apps: - MortgagePricingController: pricing snapshots, rate locks, AUS findings CRUD ({uid}/pricing, {...

Sub-projects 5, 6, and 7 backend shipped together: Sub-project 5 (pricing & locks): - LoanPricingSnapshot — append-only quotes (program, investor, rate, APR,...

Sub-project 4 frontend, end-to-end: - /applications/pipeline (PipelineBoardClient): kanban grouped by LoanFileStatus with off-ramp lanes below the happy-path...

Exposes the LOS pipeline backend under /api/security/mortgage-apps: - GET /pipeline — kanban summary - GET /{uid}/pipe...

Sub-project 4 (LOS pipeline & workflow) backend: - New enum LoanConditionStatus (OPEN/CLEARED/WAIVED) - New entities: LoanPipelineMilestone (append-only transi...

Closes out Sub-project 3: the originator route gets a two-block editor (individual NMLS + organization NMLS + org address) wired to patchOriginator with the sta...

Replaces the Coming-Soon placeholder for the hmda route. Ethnicity uses the tri-state lookup with an inline sub-checkbox block when Hispanic is selected (Mexica...

Replaces the Coming-Soon placeholder for the military route. The everServed switch upserts via mortgageAppsApi.putMilitary; toggling it off also clears the serv...

Replaces the Coming-Soon placeholder for the REO route. Each property card edits the address, occupancy/status/intended-use, market value, monthly insurance+tax...

Replaces the Coming-Soon placeholder for the liabilities route. Section 2c liabilities track unpaid balance, monthly payment, months remaining, and the three UR...

Replaces the Coming-Soon placeholder for the assets route. Splits the borrower's asset list into Section 2a (bank/retirement/other accounts, type id < 50) and S...

Replaces the Coming-Soon placeholder for the employment route with a full URLA Section 1d-1g editor. Per-borrower chip selector mirrors the declarations pattern...

Adds the new /applications route group, the typed mortgageAppsApi client that talks to SecurityService /api/security/mortgage-apps, full TS types mirroring the ...

New REST controller exposing the full URLA application lifecycle: GET /api/security/mortgage-apps list (summary) GET ***************...

Adds the full backend service layer for the URLA package introduced in the previous commit: repos/applications/ 20 JpaRepositories scoped per entity ...

Refactor AppMortgage into a full URLA package root supporting multiple 1003s per loan with up to two borrowers per pair (married/joint or unmarried). Replaces t...

getThemePath() was reducing the hostname to apex+tld for both the themed host and the bucket folder, so subdomain tenants like gnosia.demo.kamocrm.com loaded th...

getThemePath() was reducing the hostname to apex+tld for both the themed host and the bucket folder, so subdomain tenants like gnosia.demo.kamocrm.com loaded th...

The picker called the generic member PUT, which SystemUserGuard 403s for the System User signed into a sub-org. The catch logged silently, so the kamo-locale co...

The NavTop language picker did nothing for the System User signed into a sub-org: PUT **************** runs SystemUserGuard first, which 403s every System-User ...

getThemePath() was reducing the hostname to apex+tld (mainDomain.tld) for both the themed host AND the bucket folder. For subdomain tenants like gnosia.demo.kam...

Color picker rows had a hardcoded 280px wrapper inside a 1fr 1fr grid with overflow:hidden, so the input was chopped on narrow columns. Use flex:1 + minWidth:0 ...

The legacy getCurrentSubscription stub throws by design so callers fall back to the ungated path. StatsManager was surfacing the throw as "Could not load subscr...

StatsManager rendered <UsageMeters usage={null}> when the legacy stub resolved to null, crashing on usage.meters. Return { meters: [] } so the component takes t...

Hide the "My Account" menu from members who lack CONFIGURE_SYSTEM so they don't see links (Stats & Costs, Apps & Features, Branch Types, Automation Streams) tha...

This reverts commit ****************

When /settings/account loads for a user who lacks CONFIGURE_SYSTEM on the current org, the previous behavior was a silent redirect to /settings — a dead-end for...

registrableDomainFromAlias strips any multi-label subdomain (e.g. "gnosia.demo.kamocrm.com") down to its eTLD+1 ("kamocrm.com"). That was fine for the API base ...

organize_by_root() was extracting only the first label and the last two labels from each Traefik-logged hostname. For the common two-level case (login.b11capita...

Child orgs that picked a Kamo web alias (e.g. gnosia.demo.kamocrm.com) were getting "TXT record found but verification code doesn't match" in the DNS setup UI. ...

NavigationInterceptor's submit listener treated any form whose form.action was truthy and method=get as a navigation, and called setLoading(true) on the global ...

deleteDomain and updateDomain previously rejected platform admins operating on child-org domains because they checked isUserOwnerOfOrg against the target org di...

The endsWith(".kamocrm.com") guard blocked every demo org from swapping its platform subdomain (e.g. gmosia.demo.kamocrm.com) for a custom domain. The platform ...

Auto-cert now provisions and maintains the Let's Encrypt cert for mail.kamocrm.com (HTTP-01 via Traefik on port 80) and keeps the postfix consumer in sync acros...

Janus is no longer in use. Removes the orphaned KlusterServices/janus/ manifests (Janus was host-installed, not cluster-deployed, and is not running on k1m1). ...

JVB-k1m1 was advertising 75.83.113.11 and coturn was advertising the node's LAN IP via status.hostIP — both broke external WebRTC media now that the public WAN ...

Picks up: - HIGH: **************** refuses NUKE/FORCE_NUKE on admin-essential rights for the ADMINISTRATOR template. - MEDIUM: **************** now re-runs ...

HIGH: **************** now refuses to persist a NUKE or FORCE_NUKE setting on any of the ADMINISTRATOR template's admin-essential rights (CONFIGURE_SYSTEM, MANA...

This reverts commit ****************

This reverts commit ****************

When a user creates a child org they become its owner + admin (via **************** Their PARENT-org membership, however, is whatever it was before — typically ...

Adds a public, transactional ensureRoleAssigned(memberId, roleId) that: - No-ops if the role is already on the member. - Looks up the OrgRole and saves a ne...

Toolbar packed too much fixed-width content into a single non-wrapping flex row; with the parent main area set to overflow: hidden, the right section (New Event...

The previous fix had /api/user-info call /api/security/session/refresh before reading Redis, but the read went through readKsemJsonFromRedisWithRetry which uses...