Nothing returned an account id, so nothing could be withdrawn
Withdrawing portal access and granting a proxy both take an account id, and no endpoint ever returned one. A practice could invite a patient to the portal and t...
Rebuild against shared-lib PricingModel.PER_EXTENSION
The running image predates the enum value, so reading the two seeded PBX catalog rows (pricing_model = 'PER_EXTENSION') throws on enum parse - and because Subsc...
Edit demographics, set up the schedule, bill and post
The last four rights that named operations which did not exist. EDIT_PATIENT_DEMOGRAPHICS: a patient's details could be entered once and never corrected. A fie...
Rebuild against kamo-shared-library for SW4 quote conversion
An empty commit. QuoteConversionService, QuoteConversionBilling and the five quote defect fixes all live in the shared library, and none of them reaches anyone ...
POST /quotes/{uid}/convert
On QuoteController rather than POSController: this controller enforces a right on every handler, POSController enforces none on any order endpoint, and it resol...
Prescribe, order and immunise
The chart could display medications, orders and vaccinations and could produce none of them. The read paths, the FHIR renderers and the safety queues were all b...
22 of the 26 clinical rights were never enforced
Only the four population-level rights — bulk export, quality measures, portal administration and EHR settings — were ever checked. Prescribe, sign, cosign, plac...
An organization can be looked up by the reference ?org= carries
GET /org/ref/{ref} — the same projected record as /org/domain/{host}, for an organization named by its id or its web alias. Nothing could answer for one. The s...
The config body carries a scalar, and absence means unchanged
updatePOSConfig bound Map<String, List<String>>, a shape that cannot carry quoteConversionBilling at all. Widened to Map<String, Object>. A key that is absent ...
Actually measure the bulk-export bucket
StorageDomain.BULK_EXPORTS shipped declared, documented as "measured by scanning the object store", and referenced by nothing. It reported zero for every practi...
Provision an organization's branding under its alias, and migrate what exists
The folder every logo, colour, favicon and background is written to was the organization's hostname with the dots turned into dashes. A domain is optional now, ...
$everything records a disclosure when a recipient is named
The whole chart in one response is the largest single thing this system hands out, and until now it wrote a PHI audit row and nothing else. That was right for t...
Rebuild against kamo-shared-library for the SW3 service work domain
An empty commit. A shared-library change reaches nobody until its consumers rebuild, and SecurityService hosts POSController and the order path — so without thi...
Create returns the domain its theme is provisioned under
The caller cannot work this out and must stop trying. GET /org/{id} answers with the entity, whose `domains` is LAZY and serializes as null outside a transactio...
The patient portal — sign-in, records, and proxy access
The §164.524 right of access, made real: a patient signs in and reads their own problems, medications, allergies, immunisations and appointments, and can downlo...
Commerce records as owners, and one place for the matching rules
The third owner the spine was widened for, and the one that was still defined and unused. A record's documents already hang off it through the document manager'...
A push token may be claimed by one device row, not every past sign-in
Companion to MediaService 8a809b3, which stopped members getting the same chat message three-plus times on their phone. That change made dispatch collapse dupli...
The TEFCA responder — discovery, document query, document retrieve
The three operations a partner actually calls, expressed over FHIR rather than SOAP: IHE's XCPD and XCA shapes, on the QHIN Technical Framework's FHIR path, bec...
Five real quality measures, and the engine that runs them
Measures are Java rather than CQL, and the trade is worth stating. The eCQM specifications are published in Clinical Quality Language, and an engine would let a...
Recover a lost background count from the images themselves
commitBackgroundOrder writes the images to STAGING, and imageBgCount is only a record of how many it wrote — which made that one column a single point of failur...
Gate the nine Service Work endpoints on a right
They shipped checking only that the caller had a session, so any member of an org could read and mutate every work order in it regardless of role. ASSIGN_SERVI...
Drop the nine Service Work endpoints from the unguarded baseline
They are gated as of e6e1d02, so their baseline entries no longer match an unguarded endpoint and **************** fails on the stale lines. Requiring the remov...
Stop the customer **************** rights reading every tenant's rows
Every endpoint that accepted a VIEW_OWN_* right as an OR-alternative loaded its record by primary key alone, never checking who it belonged to: getSubscription,...
Bulk export, C-CDA, and one accounting that covers every channel
BULK EXPORT. Kickoff answers 202 with a Content-Location and no body; polling answers 202 while running and 200 with the manifest when done. Returning a friendl...
Serve a tenant's assets from a host that resolves, and stop deleting its backgrounds
Two faults found while working out why a new org opened with no logo and no colours. THEME DELIVERY. Assets were requested from theme.<the org's own domain>. A...
Show one call once in a rollup, and stop 500ing on unworked leads
Two fixes the account rollup made visible. A phone number can be a contact point on more than one owner at the same time, and two leads on one account sharing ...
Map the account timeline beside the account's other things
Everything belonging to an account already lives under **************** — its leads, orders, members, notes and history. Communications was the one at a plural ...
Make the KamoDesktop SSO link redeemable exactly once
The link is delivered as a URL, so it lands in browser history and in the reopen-closed-tab list, where it long outlives the session it was minted for. Until no...
The account rollup must not widen what a reader may see
The account timeline I added last commit was a way around the per-lead read gate. A member refused a lead's messages on the page that names the lead could open ...
An account-level communications timeline
The level most people mean when they say "this customer's calls". The spine is already keyed on an owner, so the account endpoint is the same merged, component ...
A patient's calls, texts and email — on the platform's own spine
Not a second timeline. LeadCommunicationsService now takes a CommsSubject and the lead overload delegates to it, so /leads keeps its exact behaviour drift. A pa...
The sign-in response carries each workspace's logo
The picker drew two letters per row because the response held a name and an alias and no image. A list of workspaces is read by mark long before it is read by n...
Pin kamo-shared-library 1.6.0
The library moved to 1.6.0 while consumers stayed on 1.5.0. Consumer CI builds the library from a fresh clone into a cold ~/.m2 and ci-settings.xml mirrors Mave...
The visit and its documentation — the loop a practice runs on
Starting a visit is what grants the clinician the chart, and that is the design rather than a side effect. A clinician about to see a patient has no relationshi...
The FHIR R4 endpoint, with the same access rules as the chart
An interoperability endpoint is where a system is most likely to acquire a quiet bypass: it is machine-to-machine, nobody watches it, and "the integration needs...
/org/current stops depending on a live Hibernate session
This endpoint is what the workspace shell loads before it renders, and the client refuses a record it cannot read — Organization.fromJSON throws without a domai...
The revenue cycle worklists, and the one restriction that outranks them
Every list here exists because its failure mode is a MISSING row rather than a wrong one, which is why none of them show up in an ordinary report. A claim a cl...
A failed workspace selection no longer destroys the sign-in
Reported as being thrown back to the email field with "Your sign-in timed out. Please sign in again." after clicking Continue. The timeout had not happened — th...
Stop the logo pass starving backgrounds, and read <picture>
Diagnosed against a real site that returned six logos, brand colours and zero background images. Three separate causes, all ours. The logo pass could eat the e...
Seed MANAGE_WEBINAR_SCHEDULES from MANAGE_SUPPORT_SETTINGS
Until availability moved onto the member, MANAGE_SUPPORT_SETTINGS holders were the one group who set it — they authored the dated slots on each webinar type, wh...
Keep room for the compact mark among a pile of lockups
A straight "best six by score" is the wrong cap for this, and the reason is the shape of real sites: a company's wide lockup appears in the header, in JSON-LD a...
The clinical API — patients, schedule, chart, and the gate in front
The access rule is the part worth reading. Being logged in is not a reason to see a chart. The overwhelming majority of real HIPAA enforcement is not outside at...
Baseline the desktop probe, which is guarded where the scan cannot see
**************** has been failing on main since ba3f85c. DesktopProbeController#probe is not unguarded — it checks X-Internal-Auth through authorized(auth), con...
An unfinished domain picks a different host, not a refusal
Entering an org was refused outright unless its own custom domain had finished DNS and SSL. That was right while entering meant navigating to https://internal.<...
Expose the scan on /api/security/org/brand-scan
Its own controller rather than a method on OrganizationController, which already takes 25 constructor dependencies. The path still lands under the same prefix, ...
Orchestrate the scan behind one cached, budgeted call
One response rather than three endpoints because it is one scan: the logo must be downloaded before its pixels can contribute a colour, and the colours are want...
Take hero imagery, falling back to carousel slides
The fallback is conditional by design. A site with a hero has already chosen one picture to represent itself; sweeping its carousel too would bury that choice i...
Reconcile brand colours from five independent sources
Five because each is authoritative on a different kind of site and silent on the rest: a design system states everything in CSS variables, a PWA in its manifest...
Find a site's logo from twelve independent signals
Twelve rather than one because there is no single place a logo lives. A Shopify store declares it in JSON-LD; WordPress puts it in a header img; a React app ren...
Index a site's CSS and parse its page once
A declaration scanner rather than a CSS grammar: the scan has three questions (custom properties, background images, colours) and none needs the cascade resolve...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.