Live Change Log

Creating an org and opening it are different events. An org can be created and left sitting, and one nobody has walked into must not have spent its evaluation —...

Counting RGB values across a stylesheet elects the site's off-white page background every time -- it is the most-used colour on almost every site ever built. Wh...

Nothing here trusts the page. An HTML width attribute is a layout instruction, not a fact about the file -- a 2400px logo is routinely declared width="180" and ...

A bug says 'find out why and fix it' and points at the logs; an enhancement says 'this already works, build the better version' and points at the current behavi...

The member types the URL, so every request this issues is an SSRF primitive, and there is no egress NetworkPolicy and no forward proxy in this cluster -- Redis ...

A session that fixes a bug and leaves the change sitting on the dev machine has not fixed anything anybody else can see. The sentence is split out of the entit...

The trial was seeded pending and started on the owner's first sign-in, because an org was unreachable until its DNS verified — starting the clock at creation wo...

The KamoDesktop canary needs a link minted the way the icon mints one. It holds the same signing key, so it could build its own — and would then be testing itse...

The previous build failed on a class that had not been pushed to kamo-shared-library (fa243ae). Nothing to change here; this just re-runs the build against a li...

The org-creation wizard is eleven steps long and the alias was only checked when the form was submitted, so someone who picked a name another organization alrea...

"The requested connection does not exist. Please check the connection name and try again." on a KamoDesktop reconnect was not a missing connection. It was the S...

The class carries @RequirePlatformRight, so the interceptor resolves the caller and refuses before any handler runs — a per-method check would have been one for...

A member of several organizations now chooses which one to open after their password, instead of it being chosen for them by the hostname. This is the switch th...

SignInCompletionService returned a relative /validate?otk=. That resolves against the host that served the SIGN-IN — login.<apex> — and kamo-login has a /valida...

The redirect is wrong. SignInCompletionService returns a relative /validate?otk=, which resolves against the host that served the sign-in -- login.<apex> -- and...

A member of several organizations now chooses which one to open after their password, instead of having it chosen for them by the hostname. This is the switch t...

Registration bound the account to whatever organization the host resolved to. On register.kamocrm.com — the signup page for every organization with no register ...

Seven blocks across five controllers ended their org-resolution with, in effect: if the server name is localhost or a bare IP, return whichever organization the...

Creation checked the alias only within one security provider, and PUT /org/{id} checked nothing at all — it applied whatever it was given. Both were reasonable ...

ANALYTICS_EXPORT is blocked because exports leave the boundary with no de-identification. Both training exports already had a fail-closed audit — there IS a rec...

Branch Types → Allowed Apps builds its editor from /features/app-catalog, not from the tenant features listing, so it was the one surface that could not see whi...

No source change here. SecurityService is what enumerates RoleRightType.values() to serve the rights editor (SecurityRoleController) and to populate a grant-all...

Login, registration and the meeting lobby paint an organization's colours before any session exists. They knew which one from the hostname, which is exactly wha...

byAlias took LIMIT 1 over orgs.alias, which has no uniqueness constraint: the create path checks it per security provider and PUT /org/{id} does not check it at...

FeatureController now sends parent/children/isParent on every serialized app so the client can render children nested under their parent. Served rather than mir...

internal.kamocrm.com failed to render with "Invalid organization data: missing 'id' or 'domain'". Organization has no `domain` field -- it has a `domains` colle...

Every CommerceType now names its own child app under POS, so the isGated() short-circuit that waved retail, rentals, service, subscriptions and procurement stra...

Two gaps found by re-reading the original login tail against the new one, before enabling the picker. The form-encoded /login endpoint built its LoginRequest w...

kamo-internal's root layout reads the Host header, strips "internal." and fetches /org/domain/<that>. On a host serving one tenant that is the same question as ...

Adds the second half of the split: a sign-in that names no organization authenticates the user, then asks which workspace. POST /api/security/session/select tur...

Signing in was two questions fused into one query. "Are these credentials good" is answered by the users row -- the password lives there, so it was never org-sc...

OrgHostResolver.resolveByDomain filtered on od.is_dns_verified = TRUE, so a domain row that existed but had not finished verifying resolved to nothing and login...

printStackTrace() writes to stderr directly, so 186 of them survived the println sweep untouched — still unconditional, still unattributed, and now detached fro...

The remaining 853 println calls across 43 files, none of which could be turned off: println has no level, so every one of them printed on every code path that r...

With the session and Hibernate noise gone this was the largest recurring source left in the pod log: every CNAME lookup drew a seven-line box on stdout. That wa...

After the previous commit removed the Hibernate session-metrics blocks and MemberController's per-request tracing, this was 88% of what remained: every session ...

Roughly 4,600 lines in four minutes, so the retention window was a couple of minutes: chasing a certificate problem on 2026-08-22 the probe output had already r...

The endpoint skipped probing entirely when ssl_confirmed was already true, on the reasoning that under the all-hosts rule it could only have been set when every...

findAwaitingVerification filters confirmed domains out by design, so once ssl_confirmed was set nothing ever looked at that domain again. That was fine while th...

A @Transactional method called from **************** does not open a transaction of its own. Spring fires those callbacks from processCommit BEFORE cleanupAfter...

Certificates are minted one per FQDN -- a single dnsName each, so the leaf CN matches the hostname the browser connected to -- and auto-cert works through an or...

Every photo rendered as a broken image. The URL pointed at MediaService's **************** which I took for a general imaging proxy because it spoke HTTP Range....

Self only, and enforced in the QUERY. Every read and write resolves the member from the session and every repository call takes that id, including the single-fr...

Nothing in SecurityService has ever written users.last_login. The write lived in the retired AuthenticationService and was not carried over when authentication ...

kamo-internal polls GET /api/security/session/god-mode once on mount and every 60s thereafter. That endpoint was removed in 9c70cb7 along with the rest of the t...

Picks up MANAGE_ORG_MASTER_NOTE, the right that guards "Our Master Note". SecurityService is what enumerates RoleRightType for the role, job-title and departme...

UNIVERSALLY_SEEDED_RIGHTS is removed entirely. It existed only because the timecard widget had no parent right to inherit from, and now it has one — so the widg...

The mail and lead widgets follow their data rights exactly as the calendar ones do — ACCESS_MAIL and VIEW_LEADS — so a holder gains no data they could not alrea...

Both widgets show a member exactly what /calendar already shows them, so a calendar reader gains no data they could not reach — which is what makes this a safe ...

SecurityService serves the roster the chat UI is built from, so it has to answer with the same verdicts MediaService enforces with -- one shared evaluator, or t...