Changelog
What's new.
Every improvement to the platform, as it ships.
· kamo-shared-library
Commitment/loan-sale desk entities (runtime consumer for the shipped investor config)
Slice 2 foundation for the capital-markets loan-sale desk (doc 08) — the terminal origination stage. The shipped **************** had NO runtime consumer; these add the operational records: - MlosCommitment: an opened investor delivery commitment (investorConfigId, DeliveryCommitmentType BEST_EFFORTS/MANDATORY/AOT, CommitmentType INDIVIDUAL/BULK/FORWARD, notional/noteRate/price/expiry, status **************** / CANCELLED / EXPIRED). - MlosCommitmentAllocation: one locked loan's allocation to a commitment (commitmentId, mlosLockRecordId, loanFileUid, status PENDING->DELIVERED->PURCHASED / PAIRED_OFF). On PURCHASE the loan advances CLOSED->FUNDED. Plain operational entities (mutable lifecycle) extending BaseUuidEntity; the examiner-WORM lock decision stays RceCommitmentDecision. FK-by-id + denormalized org per the mlos.* pattern. NOTE: requires a KamoInitializer run to materialize mlos_commitment + mlos_commitment_allocation (ddl-auto update, additive) before the desk service can query them at runtime.
· DaemonService
Durable consumer forwards eClose completion to the loan-file pipeline
The DaemonService half of the eClose -> loan-file status seam. New MlosClosingCompletedConsumer subscribes **************** (durable daemon-mlos-closing-completed) and forwards each event to SecurityService's internal pipeline endpoint via SecurityPipelineClient, so a completed closing auto-advances the loan CLEAR_TO_CLOSE -> CLOSED. Reuses the shared-lib consumer-reliability core exactly as MlosDecisionRoutedConsumer: IdempotentEvent Processor (per-consumer dedup marker in the side-effect tx, nak-retry capped at the broker max-deliver, DLQ at the cap, unparseable bodies dead-lettered immediately) + boot-time rebind. The forward is idempotent server-side too (a loan already CLOSED/FUNDED is a 200 no-op). Deployment is already Recreate (durable-consumer requirement). configmap: **************** enabled, max-attempts 5.
· SecurityService
EClose completion advances the loan-file status machine (CLEAR_TO_CLOSE -> CLOSED)
Closes the terminal lifecycle seam: a fully executed/notarized/sealed eClose package emitted **************** but NOTHING consumed it, so the loan sat at CLEAR_TO_CLOSE until a human clicked. New internal server-to-server endpoint POST **************** (X-Internal-Auth, constant-time, mirrors LosInternalApplyController) resolves the loan's app and drives LoanPipelineService.transition CLEAR_TO_CLOSE -> CLOSED with a system actor granted exactly LOS_CLOSE_AND_FUND. Idempotent + at-least-once safe: already CLOSED/FUNDED -> 200 no-op; not-yet-CLEAR_TO_CLOSE -> logged skip (retry can't fix out-of-order); open blocking conditions -> held for the steward (a doc-completion event never auto-overrides a compliance blocker); only transient DB failures escape as 5xx to retry. Funding (CLOSED -> FUNDED) stays a separate money-disbursed fact for the capital-markets delivery desk.
· kamo-shared-library
ClosingArtifact provenance = one-time null->value stamp (enables after-commit eClose dispatch)
Splits the ClosingArtifact @PreUpdate WORM guard so the eClose vendor dispatch can move OUT of the assemble/advance transaction (doc 05 §6): the node commits FIRST, then the async dispatcher records which vendor it dispatched to + the vendor's resolution ref. - IDENTITY **************** stays HARD-frozen from birth. - PROVENANCE (providerName/externalRef) becomes a one-time null->value stamp: a null loaded-baseline may be set exactly once (the post-commit dispatch); once persisted it is loaded as the baseline on the next @PostLoad and frozen against CHANGE (a re-run is still a new row). Only the trusted dispatcher writes it, once, so the append-only guarantee holds across transactions. Also adds **************** for the dispatch reconciler's stranded-PENDING sweep.
· kamo-internal
Per-loan lock recommendation on the lock desk
Surfaces the RCE lock-vs-wait recommendation (Lock / Lock-with-steward-override / Do-not-lock) with rationale + a 'model uncalibrated -> steward decides' note when cold-start-clamped. Read-only; the commit stays the human action.
· SecurityService
Proxy the per-loan lock recommendation (read-only)
GET **************** (operator+org gated, org server-stamped) -> the RCE per-loan LOCK/WAIT/BLOCKED recommendation. The commit stays the existing human /locks action.
· kamo-internal
EClose vendor categories on the integrations tab (RON/eNote/eVault/MERS)
Surfaces the four notarized-leg categories with their vendor options (Proof/ DocuSign Notary, DocMagic/Snapdocs, eOriginal/DocMagic, MERS eRegistry/DocMagic) so an org configures its eClose vendors through the existing per-provider form.
· kamo-shared-library
EClose vendor categories (RON/ENOTE/EVAULT/MERS) + artifact-by-externalRef finder
- VendorCategory gains the four notarized-leg rails so the integrations tab can configure a per-org RON/eNote/eVault/MERS vendor (additive STRING enum, no CHECK churn). - **************** — fail-closed resolution for the async eClose vendor callback.
· kamo-internal
Steward audit/write surfaces — signed-doc download, delegation chips, vendor event timeline, AUS waiver/validation, non-QM stipulations, eligible-investor board, funding histogram, closing audit trail, catalog provenance, composer catalog
Residual-sweep UI: executed-PDF Download + delegation display + vendor-order event timeline; Offer-waiver/Record-validation actions on the AUS drawer; non-QM decision detail drawer (fired stipulations); eligible-investor board + funding-probability histogram on capital; closing-package audit trail (completedAt/SHA-256/template version); frozen catalog-version provenance + catalog-backed product picker in the pricing composer.
· SecurityService
Proxy signed-doc download, delegation passthrough, vendor events, AUS waiver/validation write, non-QM detail, condition-template write
- Disclosure: GET **************** (steward, LOS_VIEW_PIPELINE) + GET **************** (borrower party-scoped), both byte-relaying the executed PDF from ESigService; delegation fields threaded through DisclosureEnvelopeSyncService (delegatedToName resolved). - Vendor: GET **************** (requireView, loan-bound). - Underwriting: POST agency-aus-waivers / agency-aus-validations (org-stamped, ownership-verified); GET internal-rules-decisions/{id} (org fail-closed). - Docs: PUT **************** (operator, org server-stamped).
· ESigService
Internal signed-document download + recipient delegation fields
- GET **************** streams the executed (flattened) PDF for an org-owned envelope (404 until fully signed). - RecipientSummary carries **************** (populated in toSummary); mintLinkInternal now 409s a DELEGATED recipient.
· kamo-internal
Product picker for the non-QM run trigger
Replaces the plain productId input with a product selector populated from the org's active catalog (non-QM products first, NON-QM chip), falling back to the plain productId input when the catalog can't be read. Completes #13.
· SecurityService
Proxy the org product catalog for the run-trigger picker
GET **************** (operator+org gated; org-scoped by the downstream query, passthrough) → MLOSPricingService product list.
· kamo-internal
Disclosure void/sync/resend UI, workflow-template authoring, non-QM run, non-doc vendor orders, in-place config edit
Steward console UI for the remaining audited gaps: - #3/#8/#12/#17 DisclosuresSection: Void live native envelopes; 'Refresh status' hydrates per-recipient status chips; per-recipient Resend; decoderd recipients show reason + timestamp. - #10 Closing-workflow-template authoring: replaces the coming-soon chip with a real panel — list published versions, a detail drawer rendering the stepsJson graph, and an authoring form building the WorkflowStep[] (subsystem/required/ adapterCategory + scope/effectiveDate) that publishes; 400/409 surfaced. - #13 Non-QM run: a 'Run internal rules' card (loan + productId) mirroring Run AUS. - #15 Order non-document vendor services **************** via the existing place endpoint; honest NOT_CONFIGURED relayed. - #16 In-place edit for investor & sub-rule config (PUT), preserving row identity.
· SecurityService
Steward disclosure void + status-sync + resend (native eSign)
- Void (#3): POST /esign-envelopes/{id}/void voids the live KAMO_NATIVE envelope in ESigService THEN mirrors the local stub to EsignStatus.VOIDED (stub demoted only on a 2xx native void; ESig 4xx relayed). TRID timers untouched. - Status sync + per-recipient progress (#8): new DisclosureEnvelopeSyncService extracts the native-status mirroring **************** mapNativeStatus) out of BorrowerSignatureService (which now delegates, behaviour preserved); POST **************** mirrors every native stub in a set and returns each envelope with a full steward recipient roster **************** TRID timers are never auto-satisfied. - Resend (#17): POST **************** re-delivers a signing invite via the ESig internal resend endpoint. All gated hasAnyDisclosureRight, org server-stamped, downstream 4xx relayed.
· SecurityService
Proxy vendor-order cancel (staff, loan-bound)
Expose POST **************** — staff-only, org resolved server-side, and the order must belong to THIS application's loan (verified against the loan's order list) before the cancel is relayed to MLOSVendorService. The record-layer CANCELLED transition + its 409-on-terminal / 404-on-unknown are enforced downstream and relayed verbatim.
· ESigService
Surface recipient decoder reason + internal resend endpoint
- RecipientSummary now carries decoderReason + decoderdAt (persisted by the decoder ceremony but previously omitted from every projection), so a compliance-relevant signer objection is visible to downstream first-party surfaces (mortgage disclosure rail, borrower closing-desk). - Add POST **************** — first-party parity with the staff resend, so the mortgage disclosure rail can re-deliver a lost signing invite. Org ownership re-checked in the service.
· SecurityService
Proxy steward write/read gaps — AUS **************** lock lifecycle events, LLPA blast-radius, eClose RON-fallback + workflow-template publish/detail, loan clearability
Closes the SecurityService side of a batch of verified proxy gaps where an MLOS engine capability existed but no browser-reachable proxy did: - underwriting: GET adverse-action-reasons (Reg-B/ECOA principal reasons), POST agency-aus-steer, POST agency-aus-pick-best, POST internal-rules-runs (non-QM) — org + acting member server-stamped; facts server-derived downstream. - capital-markets: POST /locks/{id}/events — post-lock lifecycle (extend/float- **************** to the pricing engine, ownership fail- closed via the lock read, LOCK excluded from the whitelist, economics collected from the caller (never auto-derived), TRID timer left to the engine. - pricing: GET /adjustments/{id}/impacts — reverse LLPA blast-radius, per-line org-filtered (foreign lines dropped, re-counted). - doc-orchestration: POST ron-fallback (record alternative notarization), POST/GET closing-workflow-templates (publish + detail), org server-stamped. - doc: GET /loans/{id}/clearability — loan-wide clearability roll-up. All operator+org gated; downstream 4xx/409 relayed verbatim.
· SecurityService
Proxy closing-package retry-step + cancel (org-ownership checked)
· SecurityService
Proxy closing-package assemble (light up the eClose write side)
POST **************** (operator-gated, org-stamped) → MLOSDocOrchestration assembler: resolves the tenant closing-workflow template as of the closing date + materialises the artifact graph (eSign/RON/eNote/eVault/MERS) with honest pending states. The write side was built but had no caller.
· SecurityService
Transparent loan close-readiness endpoint (real milestones)
GET /mortgage-apps/{uid}/readiness (party-gated) → a weighted composite of REAL, explainable milestones (submitted / documents satisfied / conditions cleared / clear-to-close), each with its own progress. No ML/predictive fabrication.
· SecurityService
Carry mortgageInsuranceOmitted into the borrower payment view
· SecurityService
Borrower payment-estimate endpoint (full PITIA, safe subset)
GET **************** (party-gated) → the borrower's estimated full monthly housing payment + components, a BORROWER-SAFE subset of the underwriting qualification (payment only — never income/DTI/debts). available:false when not derivable.
· SecurityService
Proxy the loan qualification read (operator-gated)
· SecurityService
Extract self-employment income from K-1 and P&L statements
K1 and PL_STMT previously returned DOC_TYPE_NOT_SUPPORTED; add vision prompts (employment.employerName + employment.wagesAnnual) so a self-employed borrower's K-1 / profit-and-loss upload reconciles into the URLA the same way 1040/Sched-C does.
· SecurityService
Borrower request-rate-lock → steward pipeline queue
POST **************** (party-gated): the borrower asks to lock their rate; recorded as an OPEN non-blocking PRICING LoanCondition so it lands in the steward's pipeline, where the lock desk commits the real lock and clears it. Idempotent.
· SecurityService
Borrower rate-lock status endpoint (LOCKED/FLOATING)
GET /mortgage-apps/{uid}/rate-lock (party-gated) → the loan's SAFE lock posture: LOCKED (rate + expiry) when an active, non-expired commitment exists, else FLOATING. Fail-open to FLOATING — never claim a lock it can't confirm. Backs doc 05 §5.
· kamo-shared-library
Lock lookup by loan file (join through scenario)
**************** — locks key on scenario, so resolve a loan's locks via MlosLoanScenario.loanFileUid. Backs the borrower/steward 'is this loan rate-locked?' read.
· SecurityService
Steward rate-lock proxy — lock-decision + commit an eligible result
MlosCapitalMarketsController gains POST /lock-decision (preview) and POST /locks (commit) via MlosCapitalMarketsClient; the commit is a deliberate HUMAN steward lock recorded as **************** with the acting steward as lockedByMemberId — never a fabricated AI auto-lock. The engine's borrower-ack / AUS walls relay as honest 4xx.
· SecurityService
Borrower e-signature surface — real native sign links, no stub
GET **************** (party-gated) lists the loan's real KAMO_NATIVE disclosure/closing envelopes + recipient status via ESigService; POST **************** mints a fresh reachable signing deep-link (fail-closed: envelope must belong to the caller's loan). Backs the rebuilt closing-desk that deep-links to the native signing experience (doc 05 §5).
Your universe is waiting.
Start free in minutes. Add products whenever you are ready — no migration, no new logins.
Free forever — no credit card required