Live Change Log

Writes the WORM LegalPackageAttestation: attestationTextSha256 from the FROZEN version (the package's draft wording is mutable and may already have been reworde...

LegalAssignmentOwnership is a SEPARATE guard from LegalPackageAccess on purpose: a member executing their own agreement holds no HR right, and widening the HR r...

manifestSha256 hashes the ordered [{documentUid, contentSha256, orderIndex}] the member was actually shown, length-prefixed so a crafted uid cannot imitate a fi...

OTKAuthFilter bypasses only /actuator, /api/esig/public and /api/esig/internal, so this prefix is behind staff OTK auth with orgId/memberId already on the reque...

**************** now take the triple. The public controller keeps resolving it from SIGNSESH, so the signer app is unchanged; a staff-authenticated member surfa...

Phase 4: Deliver / Redeliver / Void fan-out, assignment creation with e-sign envelopes, and the Assigned Packages sub-tab.

The Assigned Packages grid filled its team-member filter column by asking audience-preview for allTeamMembers:true on mount -- a name and an email address for e...

Redeliver published the new version row, flipped every OPEN assignment to SUPERSEDED, and submitted the reissue from inside that same uncommitted transaction. T...

AG Grid Community over a MUI-paginated fetch — Community has no server-side row model, so the server pages and the grid renders exactly what it was handed. The ...

Thin 1:1 forwardToApi routes — one upstream request each, because OTKAuthFilter does getAndDelete and a per-member loop in a Next route would need one OTK per m...

Built on the EntityManager rather than a shared-lib repository method: the filter set is dynamic and adding it to kamo-shared-library would force a shared-artif...

Per-assignment outcomes — voided, skipped-executed, not-found — because an admin voiding a package for six named people needs to know which had already executed...

Refused unless the live fingerprint differs from the published one. Binder.dateUpdated is dead and Img has no revision counter, so that fingerprint is the only ...

Plan on the request thread (two cheap queries, so the response is exact about who is included and who was skipped and why), write off it: 200 members x 8 docume...

Deliver is the new-hire path and is meant to be re-run, so members who already hold an assignment are subtracted rather than given a second copy of the same ins...

DocsService's first outbound service-to-service client. Posts to **************** (origin MANUAL, never metered) with suppressInvite=true — HR sends one notific...

Phase 3 of the HR Legal & Compliance series: DocsService package CRUD, the content fingerprint, publish freezing a byte-pinned version, audience preview, and th...

LegalPackageAccess.requireRead demanded VIEW_EMPLOYEES alone while hrTabs.ts admits the Legal & Compliance tab on VIEW_EMPLOYEES || EDIT_EMPLOYEES || MANAGE_HRS...

publishPackage, previewAudience and getPackage shipped with no caller. The templates grid now has a Publish row action — disabled when the package has no binder...

All seven /api/docs/legal mappings authorized on org membership alone, so any authenticated member could list, edit, delete and publish legal packages — and aud...

Replaces the HrTabPlaceholder body only — the route, the tab entry and the gate already exist in hrTabs.ts. AG Grid Community list plus a create/edit dialog wit...

Thin 1:1 forwardToApi routes under /api/docs/legal — one upstream request each, because OTKAuthFilter does getAndDelete and a fan-out loop in a Next route would...

Resolves a saved or draft audience through TeamMemberRepo.findAudience, which is the only reader carrying the mandatory ACTIVE + recordState eligibility predica...

Pins img_dat_id plus a content hash, not img_id: saveImgContent repoints the same Img at new bytes on every Docs save, and resolveSource walks to the dat live a...

List, create, get, update and delete, with ordered binder refs and audience rows replaced as a set. Org comes from the session on every path — DocsService is pe...

Ids cross as strings (unique_rowid exceeds MAX_SAFE_INTEGER). Binder order is the list order, de-duplicated, and a non-numeric entry 400s rather than being skip...

Binder.dateUpdated never moves after INSERT, so a package's content has no change signal to compare. Adds a SHA-256 over the canonical ordered binder/item tuple...

External images stopped rendering when the page-level image policy shipped. The middleware sets `img-src 'self' data: blob: https://theme.<apex> https://*.<apex...

Phase 2 of the HR Legal & Compliance series, shippable on its own: signer-slot binding, server-side required-field enforcement, invite suppression, and recipien...

The Send for signature dialog seeds one recipient row and offers an unbounded "Add recipient", but it never fetched the template's signer slots. ESigService rej...

The signer-count check added last round demanded an EXACT match against the template's declared slots, which would have silently stopped mortgage disclosures go...

envelopeComplete required a literal SIGNED from every recipient, but delegate() leaves the delegator DELEGATED forever and ADDS the replacement instead of subst...

Fifteen network polls across the app, replaced with the events that were already happening or with events added to the services that own the state. Mail — the ...

Every platform screen backed by this service refreshed on a timer, because this service has no WebSocket and therefore no way to tell anyone anything: the close...

The folder tree, conversation list and message list each ran their own 30-second timer, reloading on the chance that something had moved. The WebSocket already ...

SecurityService owns the platform-admin surface — system configuration, DNS provisioning, commerce sync — but has no WebSocket endpoint, so every screen backed ...

Two hooks for the push conversion in SecurityService, where several platform screens refreshed on timers because there was no way to tell them anything. Retail...

Any single recipient declining set the whole envelope DEcoderD, so a counter-signer could destroy signatures the other parties had already given, with no recove...

Creating an envelope unconditionally emailed an invite, so a caller batching many envelopes behind one notification had no way to stay quiet. Null preserves the...

submit() validated only consent and step-up; it accepted an empty values list and still marked the recipient SIGNED. Ports validation.ts (esign-core), including...

No caller supplied signerUid, so recipients were created without one. buildSession filters a signer's fields by signerUid, so myFields came back empty, completi...

Phase 1 of the HR Legal & Compliance series: the com.kamo.z.shared.hr.legal entity set and its schema migration.

MailButton ran setInterval(fetchUnreadCount, 30_000) in every open tab, and each tick called /api/email/folders — an endpoint that opens every folder in the mai...

The nav-top mail badge in kamo-internal refreshed itself by calling /api/email/folders every 30 seconds, per browser tab. That endpoint walks the entire folder ...

ensure() caught Exception and logged, so a failed CREATE UNIQUE INDEX reported success and the service booted with no uniqueness guarantee at all — the one outc...

Five defects from the whole-branch review, all in the evidence path. The audience FKs did not cascade. cascade = CascadeType.DETACH is a persistence-context ca...

Adds com.kamo.z.shared.hr.legal to the repository scan list and ensures the uniqueness and lookup indexes the entity mapping cannot express safely.

The package-level 'I have read and agree' is a different legal instrument from the E-SIGN consent to transact and from any per-document signature, and it is the...

The document row is the join that makes N e-sign envelopes read as one package. The badge count comes off the assignment status, not e-sign status: recipient st...

Pins the ImgDat blob id and its SHA-256, not just imgId — a Docs save repoints the same Img at new bytes, so imgId alone would let two members sign different do...