Put the report title in the message, and let it be corrected
A dispatch composed the operator's instruction and the bug description with the separator between them. The title was never in it, so the session opening the me...
The agent health preflight must fail in seconds, not twenty
health() inherited the client's 20-second default. It is a liveness check in front of every KamoDesktop launch, and when the dev machine ran out of memory on 20...
Bulk-create members and team members, one transaction per record
The two bulk-add screens need to create a spreadsheet of people in one submission and report on each of them individually. That could not be built on the existi...
Store the org's deposit account, and print it on quotes
`/api/security/receivables` is where Settings → Account → Receivables reads and writes. Two rights, not one: VIEW_RECEIVABLES reads the tab, MANAGE_RECEIVABLES ...
Carry the team member's department in the session
The browser tab is being retitled "{Org} - {role} Portal", and a team member's role is their department — the specific thing they identify with day to day ("Sal...
Stop refusing a domain because somebody else typed it first
Creating an organization 409'd on any existing row for the domain, which meant the first organization to enter "acme.com" locked out every other one — including...
Give the generated favicons the same revalidation requirement as every other theme asset
Replacing an org's simple logo updated every surface that reads img/logo.svg and left the browser tab on the old mark. Generation was never the problem: provisi...
Say in the class contract that the gate can fall open
The header promised "a blocked app's endpoints all 403" without qualification, which is now true only while the entitlement tables can be read. The exception is...
A transient database fault must not 500 the request
The lead Communications tab reported "We couldn't load this lead's communications" for org 1168485648209608710 on 2026-08-28. The endpoint returned 500 five tim...
Carry the per-member-type home-screen defaults
Read on POST/PUT /security-models and PUT /master-model, and emitted from /applied-model's settings so the shell can decide where a member lands on "/". A sepa...
Send To AI straight off the report form
A holder of MANAGE_SYSTEM_BUGS gets a SEND TO AI switch on the Report Bug window, and submitting with it on hands the report to a session without the triage dia...
Require an open god-mode window, not eligibility alone, for CONFIGURE_SYSTEM
hasRight was granting the bypass on the raw GD session flag, which SessionPlatformFacts's own javadoc names as the exact anti-pattern it exists to prevent: GD i...
Add progress service and endpoints behind the Getting Started wizard
Org-scoped GET/PUT/DELETE under /api/security/org-setup-wizard track which of the nine Getting Started steps an organization has completed. A read never creates...
Put a real time budget on resend-verification
The endpoint had no limit of any kind. The *** the register screen demanded before enabling its resend button was never read here — the request body is three fi...
Seed the master-note widgets from VIEW_NOTES
The two master-note panes shipped with no right at all — "My Master Note" and "Our Master Note" were on every member's launchpad unconditionally — and this is t...
Make seeded and uploaded branding revalidate, so an org stops being served the base theme it was seeded with
A new organization is seeded with the base theme — the platform's own logo and backgrounds copied to the new org's keys — and those keys never change when the o...
Let the caller choose a fixed KamoDesktop resolution
The remote desktop was never locked to a resolution — it tracks the browser window, and always has. guacd honours the client's size and xorgxrdp resizes the X s...
The relay to InvoicingService, and the right that gates it
Task 8. SecurityService is the authorization boundary; InvoicingService is ClusterIP with no ingress, so this relay is the only way in. InvoicingServiceClient ...
Tell the reporter when Send To AI moves their report
MediaService now emails a reporter whenever their bug or enhancement changes status, but a dispatch applies a status of its own — usually In Progress — through ...
Announce the queue change when a report is dispatched to AI
A dispatch is the only thing that takes a report out of NEW from OUTSIDE MediaService, so without this it was the one transition the console's badge learned abo...
A video on a report never reaches an AI dispatch
file and cannot watch one. The desktop agent already magic-byte-checks every attachment, but it refuses the DISPATCH rather than the one file — so a single vide...
The Traefik per-IP limit will 429 a QHIN invisibly
Comment only, in the file somebody opens when a partner complains. Traefik rate-limits per source IP across the whole api.* host, and a QHIN sits behind a sing...
Pin the exact JSON the clinical client parses
Every field in these bodies is read by name in app/lib/patients/ehrApi.ts and nothing was checking the server still emits them. The service tests pin that the e...
POST /service-jobs, gated on MANAGE_SERVICE_WORK
The create verb the work-order surface never had. app/commerce/service/new is a seventeen-line placeholder because there was nothing to call. Gated on MANAGE_S...
Rebuild to seed the four order and pricing rights
An empty commit built out of tree from origin's own tree. RoleRightsSyncService seeds org_role_rights at boot, so a right shipped without a SecurityService rebu...
Gate the order and pricing surfaces on a right
Thirty-nine endpoints were protected only by "are you signed in". Every order handler on POSController and every pricing and tax handler on CommerceMarketContro...
The exchange status says what would make it connected
The status endpoint is asked before the UI offers a network query, so a practice that is not onboarded sees an explanation instead of a button that always fails...
Never auto-provision Patient Records into a tenant
Two of the three paths that would hand a clinical record system to orgs that never asked for one, now that ServiceType.EHR is COMPLETED and therefore available....
Disclose that drug interactions are not checked
Prescribing ran three checks the practice's own data can answer and no drug-drug interaction check at all. Declining to build one was right -- interaction knowl...
Rebuild against kamo-shared-library for SW6b work-order writes
An empty commit, built out of tree from origin's own tree — NOT 'git commit --allow-empty', which permits an empty result but does not force one and would have ...
Eight work-order endpoints for lines, notes, vendors, sign-off and the clock
SW6b Task 3, controller half. POST/PUT/DELETE /{jobUid}/lines/..., POST /{jobUid}/notes, POST/DELETE /{jobUid}/vendors/..., PATCH /{jobUid}/signoff and PATCH **...
Say why the transaction guard stops at ehr/
The two rules generalise and both shapes exist elsewhere in this service, so the obvious next move is to widen the scan — and doing that would fail the build on...
Say why the overload's @Transactional is inert on the afterCommit path
Prompted by a peer session finding a @Transactional(REQUIRES_NEW) Spring never advised — protected, and self-invoked, so the record of a failed query rolled bac...
Fail the build on a @Transactional Spring cannot advise
Two shapes get no transaction advice at all, and neither is visible at a call site or in a unit test: a non-public method, which the proxy cannot intercept, and...
The outbound audit row was written by an inert REQUIRES_NEW
It was a method on ExchangeQueryService annotated @Transactional(REQUIRES_NEW), called from two private helpers on the same class. Spring's transaction advice l...
Main did not test-compile — PhiExportAuditTest missed a constructor arg
SystemConfigurationController gained a twelfth parameter, PlatformSecretCipher, when platform secrets began being encrypted at rest. This test still passed elev...
Expose platform settings through the system-config API
toDto is an explicit allowlist and updateConfig takes a typed body, so the seven new SYSTEM_CONFIGURATION columns would have been invisible and unsettable — the...
The outbound half of TEFCA — ask, don't only answer
Everything built so far answers other people's queries: discovery, document query, document retrieve, the match-review queue, the accounting. A practice could b...
Right-gated service job API
**************** — list, get, update, and PATCH status. Copies ServiceTaskBookController's idiom: orgId(req) or 401, a right check or 403, a String path variabl...
A picture-frame image whose bytes are gone answers 410, not 500
The frame stream caught everything as stream_failed and returned 500, so a photo whose object is not in storage rendered as a broken image with no explanation -...
Withhold Enterprise pricing from the catalog
Enterprise is negotiated with KamoCRM directly, so its rate is not ours to publish. Every surface that quotes a plan price reads this one endpoint - the public ...
Check the chart before writing a prescription
Prescribing was added with the allergy table, the interaction-checking query and a "safety context" endpoint all sitting beside it, unread. A system that record...
A CCD preview is not a disclosure
Previewing a summary recorded a disclosure naming the recipient — so a patient asking who has their record under §164.528 would be told it went to somebody who ...
Rebuild for SubscriptionPlanFeatureDTO.unit
The catalog stores a unit per feature and the DTO now carries it, so the pricing page can render "15 GB per user" instead of a bare 15. Shared-lib reaches a ser...
One request-body parser, not three
The three clinical write controllers each grew their own string/uuid/integer/ date helpers within a week of each other — identical except for which ones each fi...
Rebuild against the storage dedup fix
Picks up kamo-shared-library d21e01ce. uploadDocument — the path behind member documents, mortgage disclosures, picture frames and media streams here — created ...
Rebuild against kamo-shared-library for the SW5 task book
An empty commit. ServiceTaskBookService and the four task-book entities live in the shared library; ServiceTaskBookController cannot resolve them until Security...
Right-gated task book API
SW5 Task 3, controller half. CRUD for books, categories, tasks and options, plus GET /{bookUid}/tasks/by-code/{code} - the lookup a quote or work order performs...
Find a claim by the number a payer quotes
Posting a remittance needs the claim it settles, and a remittance carries no internal id — only the number the practice sent. Without this lookup, applying mone...
Nothing returned an account id, so nothing could be withdrawn
Withdrawing portal access and granting a proxy both take an account id, and no endpoint ever returned one. A practice could invite a patient to the portal and t...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.