Live Change Log

God mode had no UI at all in kamo-internal: a localStorage boolean that a mount effect mirrored into ***, re-asserted on every new tab forever. That made the br...

The trail has been written for a while and nothing could read it, which left two obligations unmet: an accounting of disclosures for one individual's record (§1...

Two settings surfaces for backends that had none. MFA enrollment (settings → my profile → Sign-in Security, self only). SecurityService's /api/security/mfa end...

Organization.handlesPhi has existed as a column with no way to set it, so PhiTenantGuard has been enforcing a flag nobody could turn on. This is the missing hal...

The details tab was a flat stack of outlined boxes that gave every field the same weight, so nothing signalled which inputs actually change what the customer se...

Adds PhiResourceType.ORGANIZATION and PhiAccessKind.CONFIGURE so that turning Organization.handlesPhi on or off can be recorded as what it is. Every existing r...

GET /{uid}/preview returns the same PublicQuoteView the share link serves, from the same QuotePresentation resolution, so a previewed letterhead cannot differ f...

The document vault accepted arbitrary uploads with no malware scanning anywhere on the platform, and it is multi-tenant — a file one org uploads is opened by an...

God mode activated silently and lasted as long as the session. That is the control a covered entity's security review pushes hardest on, because "your staff can...

Tab order is now Pipeline, Documents, Underwriting, Pricing, Capital & Risk, Governance, Ingestion, Catalog — Pipeline becomes the default landing screen. The ...

Options render as selectable cards rather than rows, because they are choices and not additions. The period total is the headline; the monthly equivalent sits b...

A quote is either a flat price sheet or a set of alternatives, so the editor offers a mode toggle rather than letting both exist at once — sending both would sh...

Multi-option quotes cannot be accepted blind — the request now carries the chosen optionUid and the service refuses acceptance without one.

A quote can now present several mutually-exclusive ways to buy — monthly, annual, three-year — instead of forcing three separate documents that drift apart the ...

Replaces the final Coming-soon chips (Hedge & coverage, Pricing sign-off, Large-deposit) with live panels wired to the new steward proxies.

Operator-gated, session-stamped org+member, fail-closed ownership (no cross-org existence oracle). New endpoints baselined in the unauthenticated-endpoint ratch...

Append-only steward APPROVE/REJECT judgement on a frozen priced result. @PreUpdate throws (a reversal is a new row). Table + 4 indexes (org, run, result, loan) ...

- Capital + Underwriting: StewardExceptionQueue (shared panel) wired to the real steward-tasks endpoint — lock exceptions **************** and guideline exc...

god-eligible, org server-stamped GET relays: **************** **************** MlosDocOrchestration **************** (fail-closed org filter, drops non-owned pa...

Replaces stubs with real, endpoint-backed panels + fixes a dead-write bug: - Underwriting: Income calculation panel (qualification: DTI/PITIA/reserves/LTV + A...

MlosCatalogController/Client gain promote-bulletin, mirroring promote-guideline (god-eligible gate, org server-stamped). Baselined promoteBulletin in the unguar...

The §164.312(b) trail was going to Slf4jPhiAccessLogWriter: 14-day platform retention against a six-year obligation, and nothing that can be queried. The lead r...

SecurityService now gates login on a second factor (§164.312(d)). When one is owed it creates the session but withholds its one-time key, returning a short-live...

Call recordings, voicemail audio and transcripts were audited into the log stream, which keeps 14 days against a six-year §164.528 obligation and cannot be quer...

Stored assistant conversations are the reads least able to afford a 14-day, unqueryable log stream: the module sits outside the compliance boundary, so prompts ...

Chat message reads were recorded through the Slf4j default writer, which puts the §164.312(b) trail in a 14-day log stream against a six-year retention obligati...

KAMO_MFA_SECRET_KEY maps to kamo.mfa.secret-key by Spring's relaxed binding, and is what MfaEnrollmentService uses to encrypt stored TOTP secrets at rest. With...

DocsService serves document bytes, so its trail is what an accounting of disclosures under §164.528 is actually assembled from. It was writing to a 14-day log s...

Turns §164.312(b) from a log line into evidence. The capture layer has been wired across seven services for a while, but it wrote through Slf4jPhiAccessLogWrite...

Until now PHI access was recorded only to a log stream with 14-day retention against a six-year obligation, and with no query surface. An accounting of disclosu...

Adds the HMDA ULI to the LAR export. UliMinter builds the ULI = org LEI(20) + loan number + two ISO 7064 MOD 97-10 check digits (Mod97CheckDigit — the IBAN algo...

The Company Info card gains a Legal Entity Identifier field (20-char, upper- cased), sent through the existing org PUT — OrganizationController deserializes it ...

For a GUIDELINE source document the ingestion panel shows a "Promote as guideline version" card (product select + revision label). The rate-sheet card is now hi...

MlosCatalogController/Client gain promote-guideline, mirroring promote- eligibility: god-eligible gate, organizationId server-stamped via write().

When /verify-email responds with the additive otk + autoLoginHost fields (minted by SecurityService on first verification), deep-link straight to https://<host>...

- changelog (#2 destination) gets a conversion block; careers shows the honest no-openings state - /subscribe page: post-registration plan intent lands somewher...

Completing the register wizard's email verification (6-digit code or email link) already proves inbox possession, yet the new user was bounced to the login page...

Solutions, integrations, alternatives, and glossary templates were organic dead ends: no internal related links and "Start free" CTAs pointing at /pricing inste...

Completes MFA. The core landed in kamo-shared-library; this is the wire that turns stored configuration into an actual gate. The gate is small because login al...

- forward data-* props through MagneticButton/RippleButton (events never reached the DOM) - instrument SharedNavigation, Hero, PreviewBanner, section CTAs; ?ref...

The compliance assessment called the absence of any second factor disqualifying on its own, and under the 2025 Security Rule NPRM MFA stops being addressable at...

- Mount analyticsAnalytics client component in the root layout: next/script loader for analytics.kamocrm.com scoped via data-domains to login.kamocrm.com on...

Backs UserMfaEnrollment and MfaRecoveryCode in kamo-shared-library — §164.312(d) Person or Entity Authentication, the gap the compliance assessment called disqu...

Recording and voicemail playback checked tenancy and nothing else: any member of the owning org could pull any call in it, transcript included, on extensions th...

A session left open on an unattended workstation stayed usable indefinitely. This terminates it after 15 minutes of no interaction, with a 60-second warning so ...

WOPI serves whole documents to Docs and recorded nothing. GET /wopi/files/{id}/contents is the same disclosure as /download, relayed the same way through APISer...

For an ELIGIBILITY_MATRIX source document the ingestion panel now shows a "Promote as eligibility matrix" card: pick the product, limit type (MAX_LTV/CLTV/DTI),...

**************** gain promote-eligibility, mirroring promote-adjustments: god-eligible gate, organizationId server-stamped via write(), downstream 4xx relayed v...

Completes the quote/estimate system: staff can now build a quote, price it, mint a share link and email it, all from the pipeline. app/lib/quotesApi.ts ...

HIPAA §164.312(b) for SecurityService. The platform records every lead CHANGE (LeadHistory) and every login (SystemAccessLog) and records no READ at all, so "wh...