Gate mortgage and personal-loan verticals on app entitlement
A MORTGAGE market appeared on /commerce whenever POS was on, regardless of the MLOS app, and /features/enable had no billing check at all — the padlock in the s...
Only slide the *** TTL when a human is actually there
getSession() refreshed the Redis TTL on every read, and OTKPreAuthFilter resolves the session before any controller runs — so every API call renewed the session...
Keep co-borrowers on one routing order
deriveSigners numbered borrowers 1, 2, 3… as a display index. ESigService now ENFORCES routing order instead of merely reporting it, so leaving the counter in p...
Set a manager, and search the directory a page at a time
GET **************** answers one page of the session org's directory. Search, ordering and paging happen in the database; a hostile ?size= is capped. Words are ...
Thread the parent department through create and update
DepartmentService now takes its request DTO instead of eight positional arguments, so the parent joins the payload rather than becoming a ninth in a row of same...
Stop losing organizations to swallowed exceptions, and accept the full create payload
createOrganization could destroy a customer's signup and report nothing useful. Transaction integrity: - Five Docstors ran behind try/catch that only looked sa...
Make account creation atomic, org-scoped and rights-gated
createCustomer saved the Account before writing its addresses, and was not transactional — so when the address insert failed, the half-built Account stayed comm...
Scope the opportunities read, and give the relay client timeouts
/me/opportunities called reservationRepository.findAll() and filtered org and member in Java. That pulls every reservation on the platform — every tenant's — in...
Browser-facing relay for the commission feature
Resolves the session, authorizes, and relays to CommissionService with the org and member stamped from that session — never from anything the caller sent. This ...
Expose the user-account email on your own member profile
The profile's Personal Email Notifications card has to name the address missed-message notices actually reach, and that address is the user account's — not the ...
Seed the finance rights onto every branch model's ADMINISTRATOR template
The three commission rights gate a feature that did not previously exist, so NEW_RIGHT_SEEDS deliberately says nothing about them - that mechanism carries an ex...
Expose contact email in the by-department roster
The Interaction Center needs a member's address to pre-fill a composer, and the only endpoint that carried one was the single-member detail fetch — one request ...
Accept a member's primary mailbox address as a login identifier
The address a member gives out is usually the org mailbox flagged Primary on their member settings, not whatever is on their user account — so typing it into th...
Cover the chat-routing propagation that broke assignLoanOfficer
assignLoanOfficer gained a step that looks up the loan's source lead to reroute the borrower's open public-chat session. That lookup runs a JPQL query through t...
Carry existing HR holders onto the new per-tab rights
A right that gates something already reachable is a removal of access: new rights insert as NOT_SPECIFIED, so the /hr tabs would have vanished on deploy for eve...
Rebuild for the unified imaging bucket
Picks up kamo-shared-library 3045cc3: ImageAssocType.getBucket() now returns the single "imaging" bucket for every association, so a deduplicated file is stored...
Push platform-admin state changes instead of being polled for them
Every platform screen backed by this service refreshed on a timer, because this service has no WebSocket and therefore no way to tell anyone anything: the close...
Mirror Maven Central and retry, so a corrupt transfer stops killing the build
The session security-level fix failed to deploy because bcprov-jdk18on:1.72 arrived corrupted — 'Tag mismatch' is a TLS auth-tag failure mid-transfer, not a mis...
Name the full logo correctly and resolve an org's domain deterministically
Three defects in how an organization's branding location is derived. my-networks named the full logo "logo-full." + logoFullExt, defaulting to "svg" when the c...
Read the member security level the column actually stores
members.security_level is a VARCHAR holding the ImageAccessLevelType NAME — 'PRIVILEGED', 'MEMBER', 'TEAM_MEMBER'. The session builder tested the value with ins...
Rebuild against kamo-shared-library 8f3c1ec
Picks up the intake-pool fix: LeadService.createLead now flags unowned leads with requiresAssignment so imported leads are counted by countAssignablePool and ca...
Remove the god-mode time-box
Checking in work left uncommitted in this working tree by a concurrent session. Not authored here; committed so it is not lost and so main is not left with a tr...
Real chat direction, and stop the timeline mapper writing or fanning out
Chat entries claimed no direction and attributed every message to its row's author. Social conversations record BOTH sides against a Kamo Member — the visitor's...
State honestly why chat entries carry no direction
The javadoc claimed direction was derived from the author while the code hardcoded UNKNOWN. Social conversations record both sides against a Kamo Member — the v...
Unified communications timeline API
GET **************** returns one date-ordered page across notes, calls, voicemails, texts, e-mails and chat; ?channel= narrows it. Three sources are merged. Ca...
Actually enforce geo and IP access rules
The rules were stored, cached to Redis and never consulted. AccessCheckController was the only caller of the evaluation and nothing called AccessCheckController...
Allow-list countries alongside geo blocks
The geo section only ever denied: a country was blocked or it was absent. Orgs that want to serve one country had to enumerate every other one, which is unmaint...
Fall back through every number the agent holds
An extension with no org line to hang it off is undialable, so the resolver falls back to a number the member actually has rather than publishing nothing.
Resolve the agent's published contact details
Email comes from the member's primary mailbox rather than TeamMember.emailWork — that column is free text predating mailbox provisioning and routinely disagrees...
Send the company line as text, not markup
Pairs with the template fix in kamo-shared-library. Per-org template rows are insert-only, so the rows seeded before the markup change still wrap this variable ...
An approver who files a request still gets the approver email
The actor was stripped from every audience, so an approver who raised a request was cut from their own notification about it — and in an organization with a sin...
GET /quotes/account/{uid} — paged, filtered, sorted
Dates arrive as ISO strings and parse leniently: a filter the client sends badly should narrow nothing rather than 400 the whole grid. A date-only "to" bound co...
Resolve the agent alongside the customer, from one lead lookup
Both blocks come off the same lead, so the controllers fetch it once and derive each from it rather than hitting the service twice per render. Still org-scoped ...
Reassign the holding agent, and email everyone it affects
An approver can now hand an opportunity to a different agent. The requester is never rewritten — applyPrimaryAgent records the move as its own history row with ...
Agree an overall commission at approval, seeded from the market
The approver now records what the organization pays on the sale to the requesting agent and their group. Omit it on approve and the lead's market default applie...
Resolve the addressee lead for both the staff and customer views
Org-scoped in both places. On the public page the scope comes from the share link's own organization, so a token can never surface a lead belonging to another t...
Expose per-market quote settings; enforce the terms grant
market-config now tells the lead view whether to offer a Quotes tab and what wording a new quote starts with, and the market endpoints round-trip both fields. ...
Reserve, approve and audit lead opportunity claims
REST surface behind /leads/opportunities/reserved and the Reserve Opportunity control in the lead header, plus the service that owns the invariants. Rights, en...
Require ACTIVATED god mode to read the trail, not eligibility
PhiAuditController.hasRight() bypassed the right check on session GD alone. GD means "may activate god mode"; godModeActive means "has activated it, deliberatel...
Detection and alerting over the record-access audit trail
phi_access_log has been accumulating evidence nobody looks at. That satisfies §164.312(b) — the trail exists — and satisfies nothing about §164.308(a)(1)(ii)(D)...
Minimum-necessary masking of lead custom-form answers (§164.502(b))
The platform's only field mask was **************** applied by LeadController.getLeadById to a caller who is neither god nor the assignee and lacks VIEW_LEAD_CO...
Read the PHI access trail — §164.528 accounting and activity review
The trail has been written for a while and nothing could read it, which left two obligations unmet: an accounting of disclosures for one individual's record (§1...
Endpoint to read and move an organization's HIPAA boundary
Organization.handlesPhi has existed as a column with no way to set it, so PhiTenantGuard has been enforcing a flag nobody could turn on. This is the missing hal...
Serve the customer-facing view to staff for preview
GET /{uid}/preview returns the same PublicQuoteView the share link serves, from the same QuotePresentation resolution, so a previewed letterhead cannot differ f...
Break-glass god mode — justification + 30-minute time-box
God mode activated silently and lasted as long as the session. That is the control a covered entity's security review pushes hardest on, because "your staff can...
Accept an option on the public quote endpoint
Multi-option quotes cannot be accepted blind — the request now carries the chosen optionUid and the service refuses acceptance without one.
Steward proxies for coverage, pricing sign-off, large-deposit
Operator-gated, session-stamped org+member, fail-closed ownership (no cross-org existence oracle). New endpoints baselined in the unauthenticated-endpoint ratch...
Gateway relays for steward-tasks, calibration/funnel, MERS reconciliation
god-eligible, org server-stamped GET relays: **************** **************** MlosDocOrchestration **************** (fail-closed org filter, drops non-owned pa...
Gateway relay to promote a reviewed bulletin
MlosCatalogController/Client gain promote-bulletin, mirroring promote-guideline (god-eligible gate, org server-stamped). Baselined promoteBulletin in the unguar...
Unbreak application.yml, and replace the test that never ran
Three things, all from trying to answer "why not just fix the context test?". 1. **************** declared `kamo:` TWICE and therefore did not parse at all ...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.