Related articles, and a public path that keeps the tree
Three things, all reaching the same page. Related articles. KbArticleRelationService owns the symmetric "see also" links: list, set, suggest, and a clear that ...
Enforce the audience chips on every human read
The composer has always offered an author three chips under "Visible to" — Members, Team Members, Public. They were written to the row and indexed into Qdrant s...
GET /master takes VIEW_NOTES, like every other read here
It was the one read in this controller that took no right, deliberately: the two master notes were called fixtures of the home launchpad rather than the Notes a...
Pin kamo-shared-library 1.6.0
The library moved to 1.6.0 while every consumer stayed on 1.5.0. Consumer CI builds the library from a fresh clone into a cold ~/.m2 and ci-settings.xml mirrors...
Stop seeding a palette colour on the org master note
Both master notes are painted from the ORGANISATION's brand now — primary for "Our Master Note", secondary for "My Master Note", each as a pastel — so a stored ...
Serve, provision and protect the two master notes
GET /api/notes/master answers both and provisions whichever is missing. PUT /api/notes/master/org writes "Our Master Note", addressed by organisation rather tha...
Keep the encryption key across restarts instead of inventing one
Every note body in production was unreadable. NOTES_MASTER_ENCRYPTION_KEY was never set anywhere - not in the deployment, and the deployed ConfigMap carried no ...
Serve what the knowledge console reads, and fix what it never could
Four endpoints the rebuilt knowledge base needs, and three facts the API was unable to state. GET /api/kb/pins returned a Page of pin ROWS, and KbArticlePin.ar...
Size the pod above its own JVM heap ceiling [skip ci]
The image starts the JVM with -XX:MaxRAMPercentage=70 -XX:+AlwaysPreTouch, so the heap alone may take 70% of the container limit and pre-touch keeps every commi...
Every notes endpoint takes the right that names it, and hasRight fails closed
NotesController checked no right on any of its ten endpoints. VIEW_NOTES was enforced in exactly one place — navRegistry.ts, hiding the Notes app in the browser...
Read and write notes as a member, never as an account
Every endpoint now requires memberID on the session — reads included — and refuses the request without one. The reads used to need only a userID, which is globa...
Carry a note's rich-text / plain-text mode through the API
Create honours the requested mode and defaults to rich, matching the editor a note is created in. Update is null-guarded like every other field on that endpoint...
Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Rebuild against shared-library @Lob LONGVARCHAR fix
Hibernate's PostgreSQL dialect read @Lob String columns as OIDs via getLong(). Affects notes, contacts, calendar, OAuth tokens, IMAP passwords, email campaign b...
Point at YugabyteDB and use PostgreSQLDialect
CockroachDB has been replaced by YugabyteDB. Connection strings move from cockroachdb-public:26257 to yb-tserver-service:5433, and the Hibernate dialect from **...
Retry the shared-library build, which the LAN uplink keeps corrupting
Three builds died today on "Tag mismatch" pulling a jar — and the mirror added an hour ago did not help, because kbservice, mcpgatewayservice and ragservice hit...
Mirror Maven Central through the Google GCS copy
Every Docker stage starts from a cold ~/.m2 and refetches the whole dependency tree, so Central sees the full weight of every concurrent service build. It answe...
Harden the kubectl download against flaky egress [skip ci]
dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...
Use cluster MinIO service DNS; drop deprecated WireGuard/CGNAT IPs and retired k2m1/k0m1
Migrate to k1m1 (clone+registry+kubeconfig from k1m1, drop k2m1, simple kubectl install)
Scope concurrency to build jobs, not Kubernetes deploys
Workflow-level concurrency serialized the whole pipeline (including kubectl rollouts). Move the group to the build job only so deploy jobs from different runs c...
Rebuild for kamo-shared-library update (remove OrganizationType, add isTopLevel)
Rebuild for kamo-shared-library update (remove OrganizationType, add isTopLevel)
Rebuild for kamo-shared-library update (CREATE_CHILD_ORG right + apply-to flags)
Pulls the new RoleRightType.CREATE_CHILD_ORG (id 131), the three apply-to flags on ChildOrgSecurityModel, the two 13-arg service overloads, and the AppliedModel...
Rebuild for kamo-shared-library update (appConfig upsert-only fix)
Pulls the hardened **************** that no longer deletes appConfig rows whose service types are absent from the caller's payload — prevents silent data loss w...
Rebuild for kamo-shared-library update (effective-feature resolver)
Picks up the new AppliedModelEnforcementService methods (computeAvailabilitiesMap, isAppEffectivelyEnabled, getEffectivelyEnabledAppTypes, computeEffectiveFeatu...
Rebuild for kamo-shared-library update (applied-model enforcement + appConfigs + isPrivate)
Triggers a rebuild so this service pulls the updated kamo-shared-library containing AppliedModelEnforcementService, ChildOrgSecurityModelAppConfig entity, Servi...
Rebuild for kamo-shared-library update (runtime force rules + DEFAULT fallback in MemberRightsAppliedService)
Triggers a rebuild so this service picks up the updated **************** that applies template force rules and DEFAULT-template fallbacks on top of the existing...
Rebuild for kamo-shared-library update (master model, default role templates, force-rule resolver)
Triggers a rebuild so this service pulls the new kamo-shared-library revision containing Organization.branchTypeID, Organization.masterModelID, ****************...
Remove translate config from application.yml — belongs in k8s/configmap.yaml
Add async translation for KB articles, add locale-aware public article APIs
Add concurrency group to prevent duplicate workflow runs
When a push triggers a workflow and workflow_dispatch is also fired (or two pushes arrive in quick succession), both runs would execute simultaneously. Adding a...
Add unauthenticated public endpoints for KB articles
Add KbPublicArticleController with endpoints for the marketing site to fetch published articles where aiVisibleToPublic=true, without requiring OTK authenticati...
Defer NATS event publishing until after transaction commits to prevent RAG race condition
Events were firing inside @Transactional methods, causing RAGService to read stale data from CockroachDB before the commit. Also auto-defaults aiVisibleToMember...
Support AI visibility toggles in KB article create/update
Accept aiEnabled and visibility flags in create/update endpoints. Handle AI toggle changes by publishing delete events when AI is disabled, triggering re-indexi...
Add notes management with RAG integration
Move notes CRUD from SecurityService to KBService. Add note encryption, NATS event publishing for RAG pipeline, and AI processing toggle support. Notes with AI ...
Update KB media and version ID references from Long to UUID
Article IDs (KbArticle) remain Long. Version, media, pin, and review IDs now use UUID for improved CockroachDB write performance.
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.