Live Change Log

GET **************** through memberGuarded() and the identity funnel. No memberId and no orgId parameter — both come from the session, because an id in a path i...

MediaService announced a new chat message twice — once when the row was saved, before any attachment existed, and once after the attachment rows committed. The ...

Four sites: delivery (none -> PENDING), void (open -> VOIDED), redelivery (open -> SUPERSEDED) and finish (open -> EXECUTED). Each passes the status it read BEF...

Both callers that finish building a message after the row is saved now tell createMessage not to announce it: MediaController attaches the images and publishes ...

createMessage announced every new message on the session's realtime subject the moment the row was saved — inside the caller's transaction, before the caller ha...

Connection.publish on legal.packages.{memberId}, NOT NatsMessageService: that service pins .expectedStream(CHAT_MESSAGES) in both publish and publishSync, so a ...

The Source / Console / Tone pod was the Stage's stacked one, and stacked it is taller than the 100px avatar it sits beside — so it, not the identity block, set ...

POST **************** existed upstream and was tested, but nothing in the product could reach it: no proxy route, no helper, no button. Every failure branch in ...

DELETE /imaging/delete/{imgId} is the one destructive imaging path and was not wired to the issued-document guard. ImageService.deleteDocument authorizes on org...

Password recovery now accepts a member's primary mailbox address, which only names an account within one org. This proxy reaches SecurityService over cluster DN...

The address a member gives out is usually the org mailbox flagged Primary on their member settings, not whatever is on their user account — so typing it into th...

The band behind the avatar on **************** had gone flat gradient. Not the wallpaper feature — ae85a8ae routed the header's photos through next/image + safe...

The tab strip was vertically centred in a row whose height was set by the action cluster beside it — a default-size More icon button (40px) plus the cluster's o...

Both surfaces go through the LEGAL endpoints, keyed on the assignment, not /api/imaging/download/{imgId}: that path additionally needs organization.isDocs and V...

isPerPartyRestrictedAssoc covers only ACCOUNT_MEMBER_VAULT and LOAN, so assoc 1 — SERVICE_APPLICATION, what /settings/member/{id}?tab=docs renders — has no per-...

A staged .docx or .xlsx was a grey MUI outline with the extension lettered underneath — a shape invented for the tray, and one that says less than the icon the ...

Filing is queued AFTER COMMIT and OFF the request thread. Finish is @Transactional in a service that also serves WOPI; holding a connection across N ESigService...

uploadDocument takes the SUBJECT'S Member, so Img.organization and Img.createdByMember derive from them and HR ends up having filed a document the member owns. ...

assignLoanOfficer gained a step that looks up the loan's source lead to reroute the borrower's open public-chat session. That lookup runs a JPQL query through t...

2b23346 was committed through a private index that was never seeded from HEAD, so its tree held only the three files staged into it and the commit deleted the o...

A draft that outgrew the send endpoint's limits produced one flat line of red text after the whole payload had been uploaded — or, when the body itself was the ...

Overview needs VIEW_OVERVIEW, Attendance MANAGE_TIMECARDS, Legal & Compliance MANAGE_LEGAL_AND_COMPLIANCE, Training MANAGE_TRAINING and Resources MANAGE_RESOURC...

LegalPackageAccess mirrors the Legal & Compliance tab gate, and that tab is now gated on one right of its own instead of VIEW_EMPLOYEES || EDIT_EMPLOYEES || MAN...

A right that gates something already reachable is a removal of access: new rights insert as NOT_SPECIFIED, so the /hr tabs would have vanished on deploy for eve...

The /hr tabs were gated on whichever pre-existing HR right happened to be an OR-term in the front end: Attendance opened on VIEW_SCHEDULES, Training on VIEW_EMP...

A body carrying inline base64 — HTML pasted from a web page, a forward's quoted content, a signature's images — can pass the per-part ceiling on its own. The se...

The certificate carries the package, the frozen version, the subject, the moment and address of execution, the attestation wording verbatim and both digests the...

Attachments wrote their own "<imgId>/<fileName>" object on every upload, bypassing the content-addressed store entirely — the same logo-draft.png attached three...

Chat attachments never went through the hashing pipeline — they wrote a private "<imgId>/<fileName>" object per upload, so the same file attached three times oc...

LegalPinnedPdf extracts the frozen-digest rule out of the member read path so the wizard and the filed artifact read the SAME bytes through the SAME check — con...

Composing with a pasted image failed with a bare "Failed to send email". The composer inlines the paste into the body HTML as a base64 data URI, which rides in ...

Picks up kamo-shared-library 3045cc3: ImageAssocType.getBucket() now returns the single "imaging" bucket for every association, so a deduplicated file is stored...

Picks up kamo-shared-library 3045cc3: ImageAssocType.getBucket() now returns the single "imaging" bucket for every association, so a deduplicated file is stored...

Picks up kamo-shared-library 3045cc3: ImageAssocType.getBucket() now returns the single "imaging" bucket for every association, so a deduplicated file is stored...

Picks up kamo-shared-library 3045cc3: ImageAssocType.getBucket() now returns the single "imaging" bucket for every association, so a deduplicated file is stored...

Picks up kamo-shared-library 3045cc3: ImageAssocType.getBucket() now returns the single "imaging" bucket for every association, so a deduplicated file is stored...

DocumentService hardcoded "imaging-mydocs" while every other read path went through ImageAssocType.getBucket(). Now that storage is one bucket, point it at the ...

Association is metadata, not a storage boundary. Each ImageAssocType used to name its own MinIO bucket, which contradicted the hashing pipeline: dedup is scoped...

LegalEsignClient.isConfigured() was false in the cluster: neither internal.auth.secret nor legal.esig.service-url was supplied, so Deliver refused every package...

Phase 5: the member self-service page, the execution wizard ported from kamo-signer, and WORM package attestation capture.

A caller that acts on a recipient's status has to be able to establish WHOSE status it is. DocsService's legal-package Finish writes a WORM attestation on the s...

verify() compared the caller to assignment.teamMemberId but never to the ENVELOPE RECIPIENT's member — it trusted the recipientUid the delivery fan-out wrote. A...

canFinish required every document row to already be SIGNED/ACKNOWLEDGED, but **************** is the ONLY writer of those statuses — the delivery worker writes ...

Picks up kamo-shared-library 8db077c, which makes registerExistingDocument copy a reused ImgDat's objects into the target association's bucket. ConversionServic...

DocManager brings its own toolbar and grid chrome, so the p:4 inset just shrank the grid and left a visible gap the /hr/resources page does not have. Matches th...

Object storage is bucket-per-association (every reader resolves img.getAssocId().getBucket()), but deduplication is scoped ORG-wide or GLOBALly and so crosses a...

**************** is gated on identity (memberID === getMemberIdString(), compared as STRINGS because getMemberId() is lossy past MAX_SAFE_INTEGER) and includes ...

Eight 1:1 routes: /api/docs/legal/member/** through forwardToApi (PATH ONLY — forwardToApi owns the query string) and /api/esig/member/** direct to ESIG_SERVICE...

Every @kamo/* package is private:true with exports:"./src/index.ts" and no build step, so there is no publishable artifact — the files are copied and rewired on...

A separate controller with a separate funnel, because authorization here is identity and not an HR right. Routing these through guarded() would mean either lock...