Point-in-time resolvers include SUPERSEDED windows (historical effective-resolution)
All three effective-version resolvers (rate-sheet, guideline, lock-policy) queried only status=ACTIVE, then window-filtered. But supersession flips the prior ve...
Bounds-check assoc-type ordinal lookups (fixes Materials list 500)
DocsService was running a shared-lib built before ImageAssocType.MATERIALS (ordinal 11) was added, so listDocuments' ImageAssocType.values()[11] threw ArrayInde...
Move data dir off MinIO FUSE mount to local disk
rspamd's /var/lib/rspamd was hostPath-backed by the rclone FUSE mount of the MinIO shared-files bucket. Every hyperscan recompile / map refresh rewrote files th...
Persist scheduled-material thumb flags via targeted update
Same detached-entity orphanRemoval issue as the conversion pipeline: the headless sweep held a detached ImgDat and save()/merge() cascaded into the images colle...
Persist thumb flags via targeted update, not detached save
The image/video/PDF thumbnail steps set thumb flags on a detached ImgDat and called save(), which merges and cascades into the orphanRemoval images collection —...
**************** targeted update
Async conversion (virtual threads) and scheduled sweeps hold a detached ImgDat; save()/merge() cascades into the orphanRemoval=true images collection and throws...
Add Reply All to the messages reading pane and thread view
Reply All was advertised (keyboard-shortcut label + i18n key) but had no handler. Wire it up: new computeReplyAllRecipients helper puts the sender in To and eve...
Reject negative income / asset / liability amounts on section saves
Extends the requireNonNegative guard (already on loan amount + property values) to the core DTI/asset inputs in BorrowerSectionService: employment income ******...
Partial-unique index enforcing one active closing package per loan (eClose double-close backstop)
CREATE UNIQUE INDEX uk_mlos_closing_pkg_active_loan ON mlos_closing_package (loan_file_uid) WHERE status <> 'CANCELLED'. Durable backstop behind the assembler's...
Stop uploads hanging on 'Converting...' — route NATS progress + direct image thumbnails
The conversion-progress publish used NatsMessageService.publish(), which asserts expectedStream=<this service's stream>. The subject **************** resolves t...
Add Marketing to the security-model app editor
The model editor's app list (SERVICE_TYPES) is a hand-maintained mirror of ServiceType.java and was missing MARKETING — so Marketing had no row in the apps tab,...
Show Canva actions only when Canva is usable
The page previously offered Create/Import/Generate-in-Canva next to a "Canva isn't set up" notice — incoherent. Now the toolbar reveals progressively by Canva s...
Thumbnail scheduled-generated materials in-process
A headless sweep can't drive ConversionService's OTK thumbnail pipeline, so generate a page-0 PNG thumbnail via ImageIO right after storing the export — schedul...
Constant-time internal-auth secret compare (timing oracle)
Replace String.equals with MessageDigest.isEqual so response latency cannot leak the X-Internal-Auth shared secret byte-by-byte. Fleet-wide sweep of the copy-pa...
Constant-time internal-auth secret compare (timing oracle)
Replace String.equals with MessageDigest.isEqual so response latency cannot leak the X-Internal-Auth shared secret byte-by-byte. Fleet-wide sweep of the copy-pa...
Constant-time internal-auth secret compare (timing oracle)
Replace String.equals with MessageDigest.isEqual so response latency cannot leak the X-Internal-Auth shared secret byte-by-byte. Fleet-wide sweep of the copy-pa...
Constant-time internal-auth secret compare (timing oracle)
Replace String.equals with MessageDigest.isEqual so response latency cannot leak the X-Internal-Auth shared secret byte-by-byte. Fleet-wide sweep of the copy-pa...
Recurring generation schedules UI
ScheduleManager: create/list/delete schedules (recipe + daily/weekly/monthly + hour/day + optional auto-post targets + caption); launched from Materials, gated ...
Scheduled generation — sweep runs recipes on a cadence
- CanvaScheduleController: CRUD for org schedules (recipe + cadence + hour/day + optional social targets), computes nextRunAt - CanvaGenerationService: headle...
CanvaSchedule entity + repo (recurring generation)
Org-scoped recurring schedule (recipe + cadence + optional social targets) with an atomic-claim query so a MediaService sweep runs each due schedule once.
Inline expandable Whisper transcript on softphone voicemail + call-history rows
Each recorded row (voicemail and call history) gets a 'Transcript' toggle that fetches the recording's Whisper transcript on demand and shows it inline, so memb...
Save + reuse autofill recipes
TemplateAutofill: "Saved recipes" chips load a template + prefilled mapping; "Save as recipe" persists the current template + field values org-wide. + canvaApi ...
Saved autofill recipes CRUD (org-scoped)
CanvaRecipeController: GET/POST /api/media/canva/recipes + DELETE /{id} — save/list/soft-delete a named brand-template + field mapping, scoped to the caller's o...
CanvaAutofillRecipe entity + repo (saved autofill recipes)
Org-shared named binding of a Canva brand template to field values (literal text or a Materials image), so stewards can re-run a standard data-merge.
/dev/shm 2Gi (headless Chrome needs >=2GB) + 6Gi mem limit
Jibri's 10-config init aborts with '/dev/shm must be at least 2GB' when shm is 512Mi, crash-looping the recorder. Bump the tmpfs to 2Gi and the memory limit to ...
Add Material ID field to create form, details page, and imports
Threads a nullable materialId (max 40) through the Lead type, leadsApi (create + update wire requests), and the shared leadFields system-field list — which driv...
Meet-secrets **************** for jibri recording ingest
Lets jibri finalize.sh authenticate its recording upload to MediaService; matches the cluster *** value MediaService validates against.
Give MediaService internal.auth.secret (mlos-internal-auth) for summary emails
MediaService -> EmailService /api/email/templates/send (meeting-summary) needs INTERNAL_AUTH_SECRET to match EmailService's internal.auth.secret.
Enterprise autofill UI — data-merge brand templates
TemplateAutofill: pick a Canva brand template, fill each field with literal text, an org/compliance token (NMLS #, Equal Housing disclosure, org name/phone/ web...
Enterprise autofill — data-merge brand templates
- CanvaApiClient: list brand templates (dataset=non_empty), get dataset, asset-upload jobs, create/get autofill jobs - CanvaController: GET /brand-templates, ...
Persist mapped Material ID on manual import + API intake
Both setDirectFieldOnCreateRequest switches lack a default case, so an unmapped systemFieldPath is silently dropped. Add a materialId case to the manual-import ...
Add Material ID field end-to-end in shared-lib
Adds a nullable, max-40-char materialId to the Lead entity (MATERIAL_ID VARCHAR(40)), registers it in LeadHistoryFieldRegistry (Profile category) so edits are a...
Social attach + email-a-material + public links
Distribution for marketing materials, built on the new signed public-URL seam. - materialsApi.publicLink(imgId) + /api/materials/link proxy - Materials: "Copy ...
Short-lived signed public URLs for marketing assets
Lets social providers (Meta) and email fetch a specific material for a bounded window without exposing the private imaging-materials bucket. - MaterialUrlSigne...
Include both desktops in every SSO token, deep-link to the chosen one
Each token carried only its own connection, so the browser's reused json session lacked the other one -> opening Windows after Linux gave 'connection does not e...
Route borrower submit through the pipeline so it fires **************** (audit #3)
patchLoanFile's borrower submit (DRAFT->APPLICATION_TAKEN) now calls **************** instead of a raw updateLoanFile status set, so the submit produces the has...
First-class borrower self-submit transition ****************
DRAFT→APPLICATION_TAKEN for a borrower (a loan party, not an operator, so no LOS_TAKE_APPLICATION). Routes through transition() with a scoped predicate that gra...
Delete + preview + import-file-to-Canva
- delete a material (gated on MANAGE_MATERIALS) with confirmation - click a thumbnail to preview it in a lightbox - "Import a file" turns a PDF/PPTX/image into ...
Import a file into Canva as an editable design
- **************** (binary design import) - CanvaController POST /imports (multipart) → create+poll import job → editor deep-link with correlation_state for r...
Shared TranscriptionService + generic endpoint; transcribe VOIP recordings
- Extract a reusable TranscriptionService (ffmpeg normalize -> whisper-asr) and a generic POST /api/conversion/transcribe endpoint, replacing the meet-specifi...
Transcript column on Recording + RecordingMetadata
Adds a TRANSCRIPT TEXT column to the Recording entity and threads a transcript through **************** (with backwards-compat constructors so existing 5- and 9...
Wrap recording upload so MediaService compiles
MinIOStorageService.upload throws a checked Exception that ingest() neither caught nor declared — build break on top of the isGuest fix. Wrap it and rethrow as ...
Verify return-nav JWT signature; tidy token refresh
- CanvaJwtVerifier: verify the correlation_jwt's Ed25519 signature against Canva's JWKS (/connect/keys), plus aud/exp/type; keys cached by kid. Return-nav n...
MeetingParticipant.isGuest() (was getGuest, won't compile); repoint transcribe to generic endpoint
MeetingParticipant exposes isGuest() (primitive boolean getter), not getGuest(). Also point the summary transcribe call at the shared /api/conversion/transcribe...
Make whisper-asr independently scalable (HPA, multi-node)
Remove the single-node pin and switch to a per-pod model cache so pods can schedule on any node, and add an HPA (min 1 / max 4, CPU 75%, deliberate scale-up giv...
Rebrand Guacamole client connection status text to KamoDesktop
Override **************** so the 'Connecting to Guacamole...' screen (and related status) reads KamoDesktop.
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.