A held photo's PDF rendition is marked converted by a targeted update
Found by the live held-JPEG test: on LegalHeldUploads' background thread the stored rendition ImgDat is detached, and save() merged its orphan-removal 'images' ...
Held Office files and photos are first-class held legal uploads (no 45 s wait)
A requested-document upload Antivirus holds while busy is recorded at once for EVERY kind (antivirus_status PENDING, pinned by the original's content triple) an...
Adopt a newer library edition; matrix cells carry assignment uids
POST **************** **************** moves an adopted requirement to the newest preset edition (wording and switches; the org's enabled/audience kept) and its...
Compliance Requirements engine, Platform Library (Form W-9), withdrawal gate API
A generic engine: Requirement -> Compliance Record (on file) -> Triggers -> Gates. Its first configuration is the Form W-9 before a commission withdrawal. - Pl...
Legal uploads use the Antivirus hold path instead of 'try again'
A requested-document upload that Antivirus holds (engines busy) no longer answers 503. A native PDF is its own rendition, so it is recorded at once, pinned by i...
Turn Antivirus scanning on in docsservice
KamoAntivirus is Ready (StatefulSet kamowsantivirus 2/2, /readyz ready, release 2026.11.08.0101); a direct scan from the cluster returns MALICIOUS/TEST_FILE for...
Assignment rows say what the member still owes
Adds signableOutstandingCount (signable documents not yet signed) and uploadsOwedCount (required requests with no live file) to each assignment row, so the memb...
DocsService refuses locked documents everywhere and checks editor saves
- WOPI PutFile writes raw MinIO, so the save goes through AntivirusUploadGuard first: a harmful save writes nothing, keeps the document's last good content an...
Certificates name people by name and email, never by member id
The Executed Package Certificate and the Review Certificate printed raw member ids ("Sam Supervisor (1200096283021512387)"). They now show the name plus a human...
An approved package is filed, not left EXECUTION_INCOMPLETE
**************** called imgDatRepository.save on the ImgDat that uploadDocument returned from its own transaction. The entity is detached, so save() merges it a...
Reviewer notices skip the platform System User
The System User is an administrator of every organization, so it holds REVIEW_LEGAL_SUBMISSIONS everywhere and every submission in every org mailed hr.package_n...
The SI pre-check card settles when a package has a No Review item
The pre-check reads SUBMITTED submissions only, and an item whose review is off is sealed ACCEPTED at finish, so its files were never read. The review workspace...
Legal, careers and training emails present EmailService's own secret
DocsService sent X-Internal-Auth from internal.auth.secret, which is ESigService's secret (***). EmailService's InternalAuthFilter compares against mlos-interna...
A returned signed document comes back prefilled, and the member can see what was marked
When HR returns a signed document, the fresh envelope now carries the member's earlier answers (read from ESigService's new internal field-values route and sent...
Send phone JPEGs to ConversionService so they arrive upright
A portrait phone photo is stored on its side with an EXIF orientation tag. LegalUploadStore converted JPEGs in-process with ImageIO, which ignores the tag, so a...
Requested documents, HR review, Quick Requests and the SI pre-check
Members can now be asked to UPLOAD documents in a Legal & Compliance package, and a package can require an HR review before it is executed. Authoring (/api/doc...
Pick up the shared library's status follow-ups and lead key lookups (5b273d8e)
Binders and the share lists take VIEW_DOCUMENTS (SITP TP14)
Every BinderController route (list, get, create, scratch, update, duplicate, delete, items, reorder, shares, render) took a session alone, so a member without V...
/imaging/download answers its bytes again instead of 500 (SITP TP13)
Since d1a8762 the download body was a StreamingResponseBody inside the method's ResponseEntity<?>. Spring hands a StreamingResponseBody to its streaming handler...
Stop logging the database password at startup
com.zaxxer.hikari at DEBUG makes HikariConfig print its whole configuration on every start, including dataSourceProperties {password=...} and password......; Pr...
A resume whose bytes are already stored records the key they were stored under
Same rule as the other content-addressed attach paths (shared library abaec95b): fileExt is part of the storage key, so a resume already held under another name...
Declare the disclosure ledger recorder, paired with its repository scan (KamoCollab CP08 Task 13)
DisclosureLedgerConfig declares DisclosureRecorder; DocsServiceApplication's @EnableJpaRepositories gains **************** in the same commit. DisclosureLedgerW...
Tell TranslateService to stop before this client does
The careers client reads for 60 seconds, and TranslateService worked to its own default of 100, holding a LibreTranslate worker for 40 seconds after nobody was ...
The platform's careers site is careers.kamouniverse.com, and careers.kamocrm.com keeps its board
kamouniverse.com is the platform's primary apex; kamocrm.com stays a fully served legacy apex. - careers.platform-apex (where a job advert, an applicant's rece...
Docs trusts api.kamouniverse.com and serves docs.kamouniverse.com
A member signed in on internal.kamouniverse.com (the platform's primary apex since 2026-09-28) opens a document with **************** because DocumentController...
The document list searches file names when searchQuery is given
DocumentListRequest.searchQuery was accepted and never read, so a search returned the newest documents whatever was asked. A non-blank searchQuery now keeps the...
Show inherited qualifications on a posting's detail
A posting's public advert, the member's deep link and HR's editor now carry qualifications: [{category, importance, text}] (KamoAI SP03 D1) - the effective QUAL...
Pin kamo-shared-library 1.6.1, the only version that exists
The library moved to 1.6.1 and this service still asked for 1.6.0. There is no window in which both resolve: the library is never published to a remote, so the ...
DocsService is no longer published directly at docs-api.kamocrm.com
The docs-api-ingress IngressRoute sent the internet straight to DocsService, around the api gateway (and its identity-header stripping). Nothing used the host: ...
Require MANAGE_DOCS_SETTINGS on every doc-settings mutation, not just some
The settings page always sent a member without MANAGE_DOCS_SETTINGS away, but ten mutation endpoints in ImagingSettingsController never asked themselves: canMan...
Scope thumbnail backfill to the caller's org; gate history reads by clearance
Two independent gaps in ImagingController: - /backfill-thumbnails selected candidates platform-wide (no organization predicate at all; the last-resort tier w...
Throttle the anonymous careers talent-alert form
CareersPublicController's POST /{orgRef}/alerts is the one anonymous, unauthenticated endpoint in this service that sends an email on every accepted call, with ...
Audio slides — media metadata, and learners play media through their assignment
An audio slide's navigation lives in media_meta_json (duration, waveform peaks, chapters), which the editor writes and the player reads back verbatim. It is sav...
No live credentials in application.yml defaults
The local-development defaults carried the database OWNER's password (${DB_PASSWORD:<literal>}), and apiservice/securityservice also the live changelog webhook ...
Apply the per-party/issued/trashed checks everywhere byte-adjacent paths need them
**************** applied the issued-document check but not the per-party (ACCOUNT_MEMBER_VAULT/LOAN) or trashed-row checks that /download, /stream and the sibli...
A document share now actually reaches its recipient, and edit is gated
**************** matched an ImgShare by ImgShare.member — the SHARER, who created the row so they can list what THEY shared (getSharesByImage) — instead of ImgS...
Re-check clearance when rendering a binder's document items
BinderItem pins the Img row it was built from at assembly time. BinderRenderer.renderItem handed that Img straight to **************** with no check at all for ...
Bound and stream the byte-heavy imaging paths
/download loaded the whole file into a byte[] through ImageService.downloadDocument before serving it; /bulk-download built the whole ZIP (or merged PDF) as one...
Stop trusting any https://api.<anything> as a Docs WOPI host
k8s/Docs-deployment.yaml's aliasgroup1 was 'https://api\..*'. Docs's alias matcher (RegexUtil::getValue, std::regex_match) requires only that the WHOLE candidat...
Gate chat attachments, voicemails and call recordings by more than org+clearance
MediaService/telephony store chat attachments (CHAT_ATTACHMENT) and voicemail/call recordings (VM_RECORDING, CALL_RECORDING) at ACCESS_LEVEL 0. Every generic im...
Bind every WOPI endpoint to the document its token was minted for
CheckFileInfo was the only WOPI endpoint that both compared the access token's document against the request path and re-checked live access; GetFile, PutFile, P...
A document's history loads, and names the people on it and on its shares
GET /imaging/history/changes and /history/downloads built each row with Map.of, which throws on a null — and a row with no IPv6 address, no prior data or no mem...
The uploader's member id travels with the list and the history
The document list (/imaging/list) and a document's history carried the uploader's name only, so kamo-internal could show who uploaded a file but not open their ...
Liveness probe on /actuator/health/liveness, not the DB-aware aggregate
The aggregate /actuator/health includes the DataSource indicator, so restarting the database failed liveness on every pod at once and restarted the whole platfo...
Release idle Hikari connections now that YSQL pooling is shared
The connection manager no longer pins sessions **************** so idle app connections no longer each hold a database backend. Keep the pool maximum, but stop ...
Accept OCI image indexes when resolving the built digest [skip ci]
The images are pushed as OCI image indexes, so asking the registry for a single image manifest only answered 404, the digest came back empty and the check faile...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.