Live Change Log

Sub-projects 5, 6, and 7 backend shipped together: Sub-project 5 (pricing & locks): - LoanPricingSnapshot — append-only quotes (program, investor, rate, APR,...

Sub-project 4 frontend, end-to-end: - /applications/pipeline (PipelineBoardClient): kanban grouped by LoanFileStatus with off-ramp lanes below the happy-path...

Exposes the LOS pipeline backend under /api/security/mortgage-apps: - GET /pipeline — kanban summary - GET /{uid}/pipe...

Sub-project 4 (LOS pipeline & workflow) backend: - New enum LoanConditionStatus (OPEN/CLEARED/WAIVED) - New entities: LoanPipelineMilestone (append-only transi...

Closes out Sub-project 3: the originator route gets a two-block editor (individual NMLS + organization NMLS + org address) wired to patchOriginator with the sta...

Replaces the Coming-Soon placeholder for the hmda route. Ethnicity uses the tri-state lookup with an inline sub-checkbox block when Hispanic is selected (Mexica...

Replaces the Coming-Soon placeholder for the military route. The everServed switch upserts via mortgageAppsApi.putMilitary; toggling it off also clears the serv...

Replaces the Coming-Soon placeholder for the REO route. Each property card edits the address, occupancy/status/intended-use, market value, monthly insurance+tax...

Replaces the Coming-Soon placeholder for the liabilities route. Section 2c liabilities track unpaid balance, monthly payment, months remaining, and the three UR...

Replaces the Coming-Soon placeholder for the assets route. Splits the borrower's asset list into Section 2a (bank/retirement/other accounts, type id < 50) and S...

Replaces the Coming-Soon placeholder for the employment route with a full URLA Section 1d-1g editor. Per-borrower chip selector mirrors the declarations pattern...

Adds the new /applications route group, the typed mortgageAppsApi client that talks to SecurityService /api/security/mortgage-apps, full TS types mirroring the ...

New REST controller exposing the full URLA application lifecycle: GET /api/security/mortgage-apps list (summary) GET ***************...

Adds the full backend service layer for the URLA package introduced in the previous commit: repos/applications/ 20 JpaRepositories scoped per entity ...

Refactor AppMortgage into a full URLA package root supporting multiple 1003s per loan with up to two borrowers per pair (married/joint or unmarried). Replaces t...

getThemePath() was reducing the hostname to apex+tld for both the themed host and the bucket folder, so subdomain tenants like gnosia.demo.kamocrm.com loaded th...

getThemePath() was reducing the hostname to apex+tld for both the themed host and the bucket folder, so subdomain tenants like gnosia.demo.kamocrm.com loaded th...

The picker called the generic member PUT, which SystemUserGuard 403s for the System User signed into a sub-org. The catch logged silently, so the kamo-locale co...

The NavTop language picker did nothing for the System User signed into a sub-org: PUT **************** runs SystemUserGuard first, which 403s every System-User ...

getThemePath() was reducing the hostname to apex+tld (mainDomain.tld) for both the themed host AND the bucket folder. For subdomain tenants like gnosia.demo.kam...

Color picker rows had a hardcoded 280px wrapper inside a 1fr 1fr grid with overflow:hidden, so the input was chopped on narrow columns. Use flex:1 + minWidth:0 ...

The legacy getCurrentSubscription stub throws by design so callers fall back to the ungated path. StatsManager was surfacing the throw as "Could not load subscr...

StatsManager rendered <UsageMeters usage={null}> when the legacy stub resolved to null, crashing on usage.meters. Return { meters: [] } so the component takes t...

Hide the "My Account" menu from members who lack CONFIGURE_SYSTEM so they don't see links (Stats & Costs, Apps & Features, Branch Types, Automation Streams) tha...

This reverts commit ****************

When /settings/account loads for a user who lacks CONFIGURE_SYSTEM on the current org, the previous behavior was a silent redirect to /settings — a dead-end for...

registrableDomainFromAlias strips any multi-label subdomain (e.g. "gnosia.demo.kamocrm.com") down to its eTLD+1 ("kamocrm.com"). That was fine for the API base ...

organize_by_root() was extracting only the first label and the last two labels from each Traefik-logged hostname. For the common two-level case (login.b11capita...

Child orgs that picked a Kamo web alias (e.g. gnosia.demo.kamocrm.com) were getting "TXT record found but verification code doesn't match" in the DNS setup UI. ...

NavigationInterceptor's submit listener treated any form whose form.action was truthy and method=get as a navigation, and called setLoading(true) on the global ...

deleteDomain and updateDomain previously rejected platform admins operating on child-org domains because they checked isUserOwnerOfOrg against the target org di...

The endsWith(".kamocrm.com") guard blocked every demo org from swapping its platform subdomain (e.g. gmosia.demo.kamocrm.com) for a custom domain. The platform ...

Auto-cert now provisions and maintains the Let's Encrypt cert for mail.kamocrm.com (HTTP-01 via Traefik on port 80) and keeps the postfix consumer in sync acros...

Janus is no longer in use. Removes the orphaned KlusterServices/janus/ manifests (Janus was host-installed, not cluster-deployed, and is not running on k1m1). ...

JVB-k1m1 was advertising 75.83.113.11 and coturn was advertising the node's LAN IP via status.hostIP — both broke external WebRTC media now that the public WAN ...

Picks up: - HIGH: **************** refuses NUKE/FORCE_NUKE on admin-essential rights for the ADMINISTRATOR template. - MEDIUM: **************** now re-runs ...

HIGH: **************** now refuses to persist a NUKE or FORCE_NUKE setting on any of the ADMINISTRATOR template's admin-essential rights (CONFIGURE_SYSTEM, MANA...

This reverts commit ****************

This reverts commit ****************

When a user creates a child org they become its owner + admin (via **************** Their PARENT-org membership, however, is whatever it was before — typically ...

Adds a public, transactional ensureRoleAssigned(memberId, roleId) that: - No-ops if the role is already on the member. - Looks up the OrgRole and saves a ne...

Toolbar packed too much fixed-width content into a single non-wrapping flex row; with the parent main area set to overflow: hidden, the right section (New Event...

The previous fix had /api/user-info call /api/security/session/refresh before reading Redis, but the read went through readKsemJsonFromRedisWithRetry which uses...

Two related navigation bugs that both manifest as "the wrong tab opens": 1. SettingsView tracked the active tab by *index*. childrenArray can recompose ...

The /etc/odbc.ini heredoc body sat at column 1, which dedented out of the surrounding startup.sh: | literal-block scalar and broke `kubectl apply` of the Config...

Without slave propagation the pod captures the FUSE bind mount once at container start; if rclone-mount.service restarts on the host, the pod keeps pointing at ...

k1m1 Traefik now terminates HTTPS for priceturbo.com and any *.priceturbo.com subdomain, forwarding plain HTTP to the upstream Traefik at 192.168.4.36:80 with t...

Mirrors the Email + Phone tab gates. A member without VIEW_DOCUMENTS (basic user-level access) and without MANAGE_DOCS_SETTINGS (admin) no longer sees the Docs ...

Adds the missing right-gating so a basic Member without ACCESS_MAIL / ACCESS_VOIP can no longer see the Email & Mailbox or Phone Settings tabs on their own acco...

**************** / updateModel / deleteModel and **************** now invoke recalcAllMembersUsingModel after persisting changes — every org pointed at the mode...