Record byte access on the four document paths that recorded nothing
/download already logged through **************** and it was the platform's only byte-access injection site. The sibling endpoints serving the exact same bytes ...
Contain egress from the avatar resolver; note the Redis eviction pool
SecurityService now runs a fetcher whose target URL is chosen by an untrusted party — a BIMI record is DNS content published by whoever owns a sending domain, a...
Show sender and recipient photos
The mailbox rendered a single letter on a single shared gradient for everyone, so every row looked the same and the circle carried no information. It now shows ...
Avatar endpoints; fix unauthenticated reachability and contact tenancy
Adds the mailbox side of sender avatars, and fixes three pre-existing holes this work would otherwise have built on top of. AUTHENTICATION. OTKPreAuthFilter us...
Sender-avatar resolution chain for the mailbox
Resolves a correspondent's email address to a picture, working outward from what Kamo already knows: member photo, then a photo someone attached to a contact, t...
Sender identity model + org-scoped batch email lookups
Backing store and queries for the mailbox sender-avatar chain. SenderIdentityEntity is the durable tier of the avatar cache. org_id is part of the natural key ...
Audit spine for PHI access — §164.312(b)
The Security Rule requires recording access to ePHI, which means reads. The platform records changes well — LeadHistory, SystemAccessLog, UserHistory, LoanAudit...
403 rather than 500 when the compliance boundary refuses
Two call sites of featureService.enableFeature now understand the HIPAA boundary: - /enable maps PhiModuleNotPermittedException to 403 carrying the reason, m...
Enforce the compliance boundary at the feature switch
Wires PhiTenantGuard into FeatureService, the single choke point through which a module is switched on for an organization. This is where the boundary stops bei...
Auto-assign a MERS-compatible loan number at application creation
LoanFile.loanNumber was null on create (both blank-create and lead-promote) and only ever set when a steward typed one — which hard-blocked MERS MIN minting (a ...
Render signer dates in the recipient's resolved timezone
SigningSession gains a required `timeZone` (IANA id) that ESigService resolves from the recipient's member zone, then the org's, then UTC. WelcomeScreen now pas...
Resolve signer display timezone from member, then org
Signing dates were rendered in whatever zone the client defaulted to, so an envelope expiring 2026-08-03T05:00Z could read "Aug 3" to a Pacific signer for whom ...
Create HANDLES_PHI and PHI_EFFECTIVE_DATE on orgs
Mirrors the two new Organization fields, following the OrgBrandingFieldsMigration convention, so the columns are reproducible on any environment rather than onl...
Persist handlesPhi and phiEffectiveDate on Organization
Backs PhiTenantGuard with a real column. HANDLES_PHI is NOT NULL DEFAULT FALSE following the **************** pattern, so every existing tenant is explicitly ou...
PhiTenantGuard and the module compliance boundary
The keystone of the HIPAA compliance boundary: which modules a tenant may reach, given whether that tenant handles protected health information. Everything down...
Create HANDLES_PHI and PHI_EFFECTIVE_DATE on orgs
Mirrors the two new fields on the Organization entity in kamo-shared-library, following the OrgBrandingFieldsMigration convention. HANDLES_PHI is NOT NULL DEFAU...
Emit the signer locale segment in signing links
Extracts the byte-for-byte duplicated buildSignLink into SignLinkBuilder and adds a locale segment sourced from Organization.language, falling back to English f...
Add the handlesPhi tenant flag and PhiTenantGuard
The keystone of the HIPAA compliance boundary: a per-organization flag plus a guard deciding which modules that organization may reach. Everything downstream ke...
Add language switcher to the signer top bar
Endonym-labelled menu over the 22 supported locales. Preserves the query string on switch — ?t= is the signer's only credential.
Mirror layout for RTL locales via stylis-plugin-rtl
The MUI theme direction alone flips component logic but leaves physical CSS properties untouched, so Arabic rendered with LTR spacing. Swaps the Emotion cache k...
Route the signer under /{locale} with next-intl middleware
Adds i18n/routing.ts (localePrefix always), i18n/navigation.ts, and middleware.ts, and moves the route tree under src/app/[locale]/. request.ts now resolves fro...
Blink the mail icon while an unread indicator is showing
The unread badge alone was easy to miss in the top bar. NavItemButton gains a blinkIcon prop that pulses the icon (and its badge) — kept distinct from the exist...
Starter capped at 5 users, Business at 25
Repositions the published seat caps on /pricing (and the calculator, JSON-LD offers, and llms.txt summaries) to match the subscription catalog: Starter 25 -> 5 ...
Clarify MeridianLink market secret is the inbound-sync service credential (per-LO logins on member profile)
MeridianLink loan-officer credential card on member profile + lead-button LO pre-warn
Phase L3 of the MeridianLink LOS loan-officer mapping (per §3.4-3.6 of the design spec): - New member-scoped LOS-credential proxy **************** and type...
LO-scoped create (block if unmapped) + member MeridianLink credential API + market-config LO link status
Phase L2 of the MeridianLink loan-officer mapping design (kamo-internal **************** §3.3-3.6), built on the L1 shared-lib schema/resolver (MarketLosUserCre...
Per-member MeridianLink credential (MarketLosUserCredential) + resolveForMember + LO-scoped outbound push
Bulk Email campaigns UI — grid, editor, provider tab, leads action
Adds the org-level bulk email marketing surface under /marketing/email: - Bulk Email tab (after Social Media) + campaigns AG Grid workspace with live status/s...
Bulk-email recipient resolution + department contact fields
- **************** POST /api/security/marketing-email/ recipients/resolve turns lead/account/application IDs into email recipients. Gated on MANAGE_BULK_EMA...
Shared-lib support for bulk-email recipient resolution + company contact email
- **************** contactEmail branch (company contact email editable via PUT /api/security/org, used as company-scope campaign From) - ApplicationRepository...
Bulk email campaign backend — provider, dispatcher, compliance, realtime
Backend for org-level bulk email campaigns, entirely separate from the everyday email provider so it can't be throttled/blocklisted alongside business mail: - ...
ECOA/FCRA adverse-action notice scaffolds + satisfy-timer
The issuance mechanism's shared-lib half. ComplianceTimerService gains **************** — flips only ARMED ECOA_AA timers to SATISFIED (leaves COUNTEROFFER/INCO...
Add Master Machine remote-desktop launcher (god-gated)
Third one-click desktop next to Linux/Windows: navRegistry entry (ComputerIcon), 'master' target through openKamoDesktop + the SSO proxy route, and dispatch in ...
Add "master" target for Master Machine SSO deep-link
buildAutoConnectUrl now mints a Master Machine connection (KAMO_GUAC_MASTER_HOSTNAME, default 192.168.4.46); included in every token for session reuse. Kept in ...
Add "Master Machine" (kamo-dev-1) RDP device to Guacamole
Local Kubuntu workstation shares its live Plasma/Wayland session over RDP via KRdp. Adds an idempotent bootstrap SQL connection (192.168.4.46:3389, sage/shared ...
Bulk-email campaign foundation entities + department/org contact fields
Adds the shared-library foundation for org-level bulk email campaigns: - OrgBulkEmailProviderEntity (separate from everyday provider; UNIQUE org_id) - EmailCamp...
STEWARD_TASK_ROUTED canonical template
The routed-decision steward notification needs a canonical email template. Registers STEWARD_TASK_ROUTED in CANONICAL_KEYS with its json/html pair; body carries...
Gateway relay to mint a MERS MIN for a closing package
POST **************** ownership-checked (requirePackageOrg) so a steward mints only for their own tenant. The upstream reads the 7-digit MERS Org ID from the te...
Date-of-birth on lead view + create form
Adds a "Date of Birth" field under Primary Contact on /leads/view/[id] using a MUI DatePicker that opens to the year grid first (openTo=year, disableFuture, min...
Accept and gate contact date-of-birth (DOB)
Maps `dateOfBirth` in the manual-import and vendor-intake field switches with a lenient multi-format parse (ISO plus common US M/d/yyyy forms; unparseable value...
Add nullable contact date-of-birth to Lead
Adds a contact-level `dateOfBirth` (java.time.LocalDate, DATE column) to the base Lead: entity + Create/Update/LeadDTO (fromLead), copied in LeadService create/...
Author document-requirement overlay rules from the steward console
The "what documents does this loan need" rule matrix had no authoring surface. This adds a Document-requirement rules section to the Documents & Conditions scre...
Relay document-requirement overlay-rule authoring
Relays POST/GET/retire on **************** to MLOSDocService, with organizationId server-stamped from the operator session so a steward authors and lists only t...
Author conditional LLPAs from the catalog panel
Adjustments could not vary by borrower: MlosAdjustmentCondition had no writer, and the pricing engine treats an adjustment with no conditions as always-applies,...
Confirm email when reassigning a lead from the lead-view
The Assignment card now reassigns via leadsApi.reassignLead, which surfaces the server's assigneeNotified flag. On a reassignment to a new member the toast read...
Email the new owner when a single lead is reassigned
Mirrors the bulk path for the lead-view Assignment card. When PUT /leads/{id} moves a lead to a different member, that member now gets the same LEADS_ASSIGNED e...
Relay conditional-LLPA authoring
Relays POST **************** through the org-stamping write helper, so a steward authors conditional adjustments only for their own tenant.
Bulk-reassign selected leads to a team member
The grid already had multi-select checkboxes but nothing to do with a selection. Checking rows now reveals a Reassign action beside the other lead actions, gate...
Bulk-reassign endpoint, gated on REASSIGN_LEADS_MANUALLY
POST **************** moves a batch of leads onto one team member and emails that member once for the whole batch. Authorization uses REASSIGN_LEADS_MANUALLY (...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.