Fail the build when a repository package is missing from the scan
This service has @ComponentScan("com.kamo") but an EXPLICIT @EnableJpaRepositories list. The moment a bean here needs a repository outside that list, the reposi...
Persist SecurityService PHI access trail to phi_access_log
The §164.312(b) trail was going to Slf4jPhiAccessLogWriter: 14-day platform retention against a six-year obligation, and nothing that can be queried. The lead r...
Inject the TOTP secret-encryption key
KAMO_MFA_SECRET_KEY maps to kamo.mfa.secret-key by Spring's relaxed binding, and is what MfaEnrollmentService uses to encrypt stored TOTP secrets at rest. With...
Treat SERVFAIL/timeout (TRY_AGAIN) as pending, not hard error
Flaky customer authoritative servers (seen: migo.host for rodaris.md) intermittently answer SERVFAIL on healthy zones, which /setup/dns rendered as a red 'DNS l...
Time out the *** call instead of hanging every login
A bare `new RestTemplate()` has no connect or read timeout. When the *** service became unreachable today, every login thread blocked on this call indefinitely ...
Gateway relay to promote an ingested guideline into a version
MlosCatalogController/Client gain promote-guideline, mirroring promote- eligibility: god-eligible gate, organizationId server-stamped via write().
Declare the MFA bean here, since the library no longer does
kamo-shared-library dropped @Service from MfaEnrollmentService so that ~40 services stop constructing an authentication component they do not use — that stereot...
Mint auto-login OTK on first email verification
Completing the register wizard's email verification (6-digit code or email link) already proves inbox possession, yet the new user was bounced to the login page...
Add the MFA repositories to the JPA scan — unbreaks login
@EnableJpaRepositories here is an EXPLICIT package list, not a wildcard. com.kamo.z.shared.mfa.repos was missing from it, so UserMfaEnrollmentRepository and Mfa...
Gate login on the second factor — §164.312(d)
Completes MFA. The core landed in kamo-shared-library; this is the wire that turns stored configuration into an actual gate. The gate is small because login al...
Gateway relay to promote an ingested eligibility matrix
**************** gain promote-eligibility, mirroring promote-adjustments: god-eligible gate, organizationId server-stamped via write(), downstream 4xx relayed v...
Ratchet on endpoints that resolve no session
ResourceServerConfig is anyRequest().permitAll() and @EnableMethodSecurity appears nowhere in this service, so every @PreAuthorize is inert and public is the de...
Record lead reads and refuse un-auditable exports
HIPAA §164.312(b) for SecurityService. The platform records every lead CHANGE (LeadHistory) and every login (SystemAccessLog) and records no READ at all, so "wh...
Quote REST surface — staff management and public share links
Staff endpoints at /api/security/commerce/quotes and an unauthenticated resolver at /api/security/public/quotes. QuoteController extends BaseLosController rath...
Instrument the chain, reap expired entries, record disclosures
Every failure mode in this feature is silent. A latched circuit breaker, a worker queue discarding every task, a provider that started returning HTML — each loo...
Gateway relay to promote an LLPA matrix into conditional adjustments
**************** gain promote-adjustments, mirroring the promote-rate-sheet relay: god-eligible gate, organizationId server-stamped onto the payload via write()...
Let org owners configure sender photos without a rights grant
The settings endpoint required MANAGE_EMAIL_AVATAR_SETTINGS and nothing else, so it shipped dormant: a brand-new right is held by nobody until an admin assigns ...
Commit outstanding work in progress
Staged and committed as-is so nothing is left uncommitted in the working tree. 2 files changed, 435 insertions(+)
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Sender-avatar resolution chain for the mailbox
Resolves a correspondent's email address to a picture, working outward from what Kamo already knows: member photo, then a photo someone attached to a contact, t...
403 rather than 500 when the compliance boundary refuses
Two call sites of featureService.enableFeature now understand the HIPAA boundary: - /enable maps PhiModuleNotPermittedException to 403 carrying the reason, m...
Gate DELETE /api/security/org/{id} behind active god mode
The handler was `public void **************** Long id)` — no HttpServletRequest parameter at all, calling straight through to a bare deleteById. With ResourceSe...
Require auth + org scope on job-title/department mutations
PUT and DELETE on /api/security/job-titles/{id} and /api/security/departments/{id} resolved no session at all — they read a UUID off the path and called straigh...
Store and read avatars under one domain-independent prefix
Avatar object paths were prefixed with the domain of whatever host the request arrived on (getPublicBucketName → kamocrm-com, optionone-com, cluster-local, …), ...
LO-scoped create (block if unmapped) + member MeridianLink credential API + market-config LO link status
Phase L2 of the MeridianLink loan-officer mapping design (kamo-internal **************** §3.3-3.6), built on the L1 shared-lib schema/resolver (MarketLosUserCre...
Credit-balance pen sets an absolute target (mint up / invalidate down)
The Manage-Credits pen edit only ever LOWERED a balance: updateAllotment routed creditBalance to invalidateCreditsToTarget, which no-ops when target >= current....
Master Machine SSO uses a VNC connection, not RDP
guacd cannot render KRdp's H.264-only RDP GFX. buildAutoConnectUrl now mints a vncConnection() for Master Machine (192.168.4.46:5900, shared password). Linux/Wi...
Bulk-email recipient resolution + department contact fields
- **************** POST /api/security/marketing-email/ recipients/resolve turns lead/account/application IDs into email recipients. Gated on MANAGE_BULK_EMA...
Add "master" target for Master Machine SSO deep-link
buildAutoConnectUrl now mints a Master Machine connection (KAMO_GUAC_MASTER_HOSTNAME, default 192.168.4.46); included in every token for session reuse. Kept in ...
Gateway relay to mint a MERS MIN for a closing package
POST **************** ownership-checked (requirePackageOrg) so a steward mints only for their own tenant. The upstream reads the 7-digit MERS Org ID from the te...
Accept and gate contact date-of-birth (DOB)
Maps `dateOfBirth` in the manual-import and vendor-intake field switches with a lenient multi-format parse (ISO plus common US M/d/yyyy forms; unparseable value...
Pin RDP color-depth so KamoDesktop SSO reuses one xrdp session
The god-via-kamo-internal SSO path defines its Guacamole connection inline in the json-auth token, so the color-depth pin must live here too (kept in sync with ...
Relay document-requirement overlay-rule authoring
Relays POST/GET/retire on **************** to MLOSDocService, with organizationId server-stamped from the operator session so a steward authors and lists only t...
Email the new owner when a single lead is reassigned
Mirrors the bulk path for the lead-view Assignment card. When PUT /leads/{id} moves a lead to a different member, that member now gets the same LEADS_ASSIGNED e...
Relay conditional-LLPA authoring
Relays POST **************** through the org-stamping write helper, so a steward authors conditional adjustments only for their own tenant.
Bulk-reassign endpoint, gated on REASSIGN_LEADS_MANUALLY
POST **************** moves a batch of leads onto one team member and emails that member once for the whole batch. Authorization uses REASSIGN_LEADS_MANUALLY (...
Make org branding authz reachable (owner, god mode, or right)
Uploading a logo to a child org 403'd with no way to succeed: canManageOrgBranding only admitted the org owner, and the isGodModeActive fallback could never ret...
Relay eligibility-matrix authoring; rebuild picks up the SUSPENDED resume
Relays POST **************** through the existing org-stamping write helper, so a steward authors matrices only for their own tenant. This push also rebuilds a...
Thread orgId into the rate-sheet version-spine read
The gateway relayed only investorId, so the upstream had nothing to scope by and returned another tenant's version spine for a foreign investor id. Its siblings...
Stop pinning the expired wildcard-kamocrm-com secret
wildcard-kamocrm-com was a legacy multi-SAN secret that cert-manager orphaned when its Certificate was repointed at a per-host secret. Nothing renewed it and it...
Stamp the borrower quote's actor from the session
The quote requires createdByMemberId and the browser must never supply it. memberId(req) is hoisted out of the party-check branch so it resolves for stewards to...
Enrich borrower chat routing + capture subject-property state
chat-routing now returns the assigned officer's NMLS, title, photo, phone, email and whether they hold a valid license for the subject-property state, plus the ...
Send AIService the secret it actually validates
The vision-capability proxy authenticated with internal.auth.secret, but AIService validates **************** — a different secret. Confirmed live: the console ...
LoanTransactionService ctor gained LeadRealtimePublisher param
assignLoanOfficer now publishes the chat-routing event, so the service ctor takes a 10th arg (LeadRealtimePublisher). Update the unit test's direct instantiatio...
Auto-provision platform-managed MLOS chat + serve site key by host
- ManagedChatIntegrationService: lazily mint the org's platform-managed SPECIFIC_AGENT WebChatIntegration on first access. KamoMLOS is first-party: org resolv...
Expose vision capability so the console can explain a missing provider
PDF rate sheets are read by the org's configured vision provider. When none is configured the AI call fails the same way a model error does, so the console had ...
Org-admin endpoints for mobile device policy + enrolled devices
Backs the new "Mobile Devices" sub-tab under Settings → Features → Phone → Devices (its sibling "Phone System(s) Devices" stays on VOIPService and covers - GET...
Gateway for candidate review + rate-sheet promotion
Exposes the two new catalog promotion writes to the steward console under the existing MLOS steward gate, with organizationId server-stamped from the operator s...
Steward gateway for ingestion (intake + staging area were unreachable)
MLOSIngestionService had no gateway presence, so no tenant could hand a rate sheet to the extractor and the candidates it stages had no reader on any reachable ...
Identifier gateway — steward can resolve an external number to its loan
MLOSIdentifierService had no gateway, so the typed identifier plane (the routing gate every inbound vendor/agency/AUS/e-sign callback uses) was unreachable from...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.