What's new.

July 1, 2026 · kamo-shared-library

§6.1 RON legal-wall grain — **************** (frozen WORM) + CLOSING_STEP_BLOCKED event

The property state is frozen identity on the closing package (a closing's property does not move) and is the grain the §6.1 RON state-eligibility legal wall reads. CLOSING_STEP_BLOCKED is the durable signal the closing-steward exception queue reacts to when RON is walled.

July 1, 2026 · kamo-shared-library

CLOSING_MERS_SUBMITTED event key (doc 05 §6.3)

The MERS signal: a MersRegistration **************** was appended for the loan (append-only, MIN never overwritten). Additive open String key (no DDL).

June 30, 2026 · SecurityService

Add kamp-apps, VectorService, kamolos, kamo-signer-monorepo to public changelog

June 30, 2026 · kamo-shared-library

CLOSING_STEP_RETRIED event key (doc 05 §6.4)

The steward-recovery signal: a BLOCKED_STEWARD package was unblocked and a fresh PENDING node materialized for the retried subsystem. Additive open String key (no DDL).

June 30, 2026 · kamo-shared-library

CLOSING_STEP_FAILED event key (doc 05 §6.4)

The drive-loop failure signal: a closing step FAILED/BLOCKED, the package is held BLOCKED_STEWARD; the closing-steward exception queue reacts. Additive open String key (no DDL).

June 30, 2026 · kamo-shared-library

CLOSING_STEP_COMPLETED + CLOSING_PACKAGE_COMPLETED event keys (doc 05 §6.4)

The drive-loop signals: a ClosingArtifact reached COMPLETED (next adapter), and all required steps done (investor-delivery / servicing-boarding). Additive open String keys (no DDL).

June 30, 2026 · InitializerService

NULLs-safe unique index for ClosingWorkflowTemplate versions (doc 05 §6.3)

One version per (organization_id, scope_level, scope_ref_id) grain. CRDB is NULLs-distinct, so split for the nullable scope_ref_id (mirrors mlos_aiptp_*): mlos_closing_wft_version_uniq (scope_ref_id IS NOT NULL) + **************** on (org, scope_level, version) (scope_ref_id IS NULL). The MLOSDocOrchestration publisher's read-then-write (versionNumber=max+1) backstop: a concurrent dup-version publish loses to a 409 (else the assembler resolver 409s on the dup, bricking assembly).

June 30, 2026 · kamo-shared-library

**************** event key (doc 05 §6.3)

The durable signal the doc-orchestration template publisher emits on a new ClosingWorkflowTemplate version. Additive open String key (no DDL).

June 30, 2026 · kamo-shared-library

CLOSING_PACKAGE_ASSEMBLED event key (doc 05 eClose)

The durable signal the doc-orchestration assembler emits when a ClosingPackage is created from a resolved ClosingWorkflowTemplate + its first artifact node. Additive open String key (no DDL).

June 30, 2026 · kamo-internal

Remove "Publish to World" stage; fix Run All

Generators now write tiles directly to the serving drive, so the worldgen pipeline no longer has a publish/push stage. - worldgenNats.ts + universe/types.ts: drop 'push' from WorldgenStageId, WORLDGEN_STAGES and STAGE_ORDER (pipeline = **************** - components.tsx: remove the push STAGE_META entry + unused CloudUploadIcon. - services/[stage]/start: accept 'all' as a command target so "Run All" works (it expands to prep->hydro->flora->transport on the agent) instead of 400ing.

June 30, 2026 · kamo-shared-library

PULL_THROUGH_POLICY_PUBLISHED event key + null-safe AiPTP backstop doc (doc 09 §8)

Adds the canonical **************** event-type key (the durable signal the Pull-Through engine reloads its active policy on) for the governance-plane AiPullThroughPolicy publisher. Updates the AiPullThroughPolicy WORM javadoc to document the split single-active backstop (per-market + NULLs-distinct-safe org-wide grain) and the writer's required demote-then-insert order.

June 29, 2026 · kamo-shared-library

LoanIdentifierEvent append-only audit entity (doc 11 §5.3/§10)

The LoanIdentifierEvent half of doc 11 §5.3 step-4 / §10 "audit completeness" (every mint/supersede emits a WORM event row). New **************** LoanIdentifierEventType, LoanIdentifierEventRepository}: a total-block append-only WORM entity (the AiDecision/DecisionInput idiom — all fields updatable=false, @PreUpdate throws, occurredAt = DB dateCreated) recording org/loanFileUid/ identifierId (the new ACTIVE row, soft UUID ref)/supersedesIdentifierId (the superseded prior, null for a mint)/eventType **************** + a nullable aiDecisionId for the paired WORM-decision half (deferred — no registry AiFunction exists yet). Soft refs by id only (no @ManyToOne), Long ids serialized as String. Table auto-creates on the KamoInitializer run (entity-declared indexes on loan_file_uid + identifier_id; no SchemaCleanupRunner change). Additive — shared-lib version unchanged (1.5.0).

June 29, 2026 · InitializerService

(loan_file_uid,type) native single-active partial-unique index (doc 11 §5.3/§6.2)

Closes a pre-existing double-active hole in the MLOS loan-identifier registry: index (a) **************** only constrains (org, type, VALUE) for the 10 REGISTRY-NATIVE single-active types, so two ACTIVE native rows of the SAME (loan_file_uid, type) but DIFFERENT values could both commit (e.g. a renumber racing a registerNative with a different value — distinct value keys, no conflict). New partial-unique index **************** (loan_file_uid, type) WHERE status='ACTIVE' AND external_system_reference IS NULL AND type IN (the 10 native types) enforces at most one ACTIVE native id per (loan, type) — the (loan,type) analogue of index (c) for OWNED_ELSEWHERE mirrors. The type IN(...) list mirrors index (a); keep in sync with **************** (the §6.2 drift guard). Idempotent CREATE … IF NOT EXISTS; prod has no violating duplicate-active native rows (verified).

June 29, 2026 · kamo-shared-library

Add IDENTIFIER_SUPERSEDED event type key

Additive open-String event key (doc 11 §5.3/§7.3) for the registry renumber/supersession signal — the COMPLIANCE_TIMER_BREACHED precedent (no enum/schema/KI). Consumed by MLOSIdentifierService.renumber.

June 29, 2026 · kamo-shared-library

**************** — resolve the auto_execute_enabled ceiling alongside the wall threshold

Adds effectiveAutonomy(orgId, stage, floor) → EffectiveAutonomy{threshold, autoExecuteEnabled}: one chain-walk (profile → config → stage-override) that returns BOTH the §6.2 floored confidence-wall threshold AND the auto_execute_enabled master switch (stage-override-aware). effectiveAutonomyThreshold now delegates to it (single source of truth). Lets the RCE lock gate honor a tenant that turns auto-execution OFF as an auto-act CEILING regardless of the request's autonomy level. Empty when no tenant config (caller uses the platform default; the request governs). Additive; only the gated MlosActivationService bean is affected. 4 tests.

June 28, 2026 · InitializerService

Anti-double-lock partial-unique index for RCE lock records (doc 08 §7.3)

SchemaCleanupRunner adds **************** — a partial UNIQUE index on mlos_lock_record (organization_id, loan_scenario_id) WHERE status IN **************** At most one live rate lock per loan scenario: the deterministic DB backstop to MLOSCapitalMarketsService's app-level anti-double-lock guard, closing the concurrent-commit TOCTOU race (a duplicate live lock is silent compliance corruption — the lock ledger has no supersedes_id). Idempotent (IF NOT EXISTS); already applied to prod CRDB.

June 28, 2026 · KlusterServices

Bootstrap universe-minio secret + ugc bucket note (§14)

Add step 6 to bootstrap-universe.sh: creates the universe-minio secret (ACCESS_KEY/SECRET_KEY from universe-backup-s3 root creds) and notes that the universe-ugc MinIO bucket must exist. Idempotent — skips if secret already present.

June 28, 2026 · DaemonService

MLOS compliance-timer escalation consumer (BLOCKED→STALE)

The consumer half of the compliance-timer breach loop (doc 03 §2.8; emit half already ships). ComplianceTimerBreachConsumer subscribes (durable JetStream) to **************** and, per breached loan, flips its BLOCKED orchestration coders to STALE via OrchestrationEscalationService (mutable, idempotent — already-STALE/GREEN/COMPLETE untouched). Adds **************** to @EnableJpaRepositories; enables mlos.outbox (so the sweep's emission is durably written + relayed) and the **************** flag. 5 unit tests.

June 28, 2026 · InitializerService

§2.4 anti-AUS-shopping partial-unique index on mlos_aus_run

One ACTIVE (non-superseded, non-frozen) AusRun per (loan_file_uid, source_label) — "duplicates look like AUS-shopping" (doc 10 §2.4/§2.5). Safe to land now that the MLOSUnderwritingService agency writer manages the superseded false→true flip before inserting the new active run. Applied to prod CRDB.

June 28, 2026 · kamo-shared-library

Persisted par_flag on MlosPricedProductResult + OrchestrationStepStatus.STALE

- MlosPricedProductResult gains par_flag (Boolean, default false): the §8.1-step-5 par cell of the row's lock-period ladder, frozen at insert (run-of-record persistence of the response-only par flag). - OrchestrationStepStatus gains STALE: a BLOCKED step whose compliance SLA timer breached + escalated (set by the DaemonService compliance-timer escalation consumer; doc 03 §2.8). Both additive; ddl-auto:update adds the column and the generic enum-CHECK sweep admits STALE on the next KamoInitializer run.

June 27, 2026 · kamo-shared-library

RateSheetSanityGate — §6.6 hard pre-publish sanity gate (range + monotonic)

A pure-logic ungated @Component (the PriceAssemblyEngine pattern) validating a candidate rate/price ladder BEFORE a rate-sheet version publishes (doc 02 §6.6): convention-aware price-range band [par±20] (par=100 PRICE_TO_100 / 0 POINTS_FROM_PAR — catches gross sign/convention errors), monotonic-ladder (price non-decreasing as note rate rises, per (lockPeriodDays,ioFlag) ladder), and structural well-formedness (non-empty / positive rate / positive lock / no duplicate rate). Reports ALL violations; fails closed. Reusable by the future ingestion candidate-stage (takes a decoupled RateSheetLadderCell record, not the JPA entity). 2-agent adversarial review → FIX_THEN_SHIP (1 must-fix applied): removed the par-sanity near-par-PRICE check — it false-rejected legal all-premium/all-discount coupon windows (par-RATE sanity needs rate labeling, deferred; the band already bounds prices to ±20 of par). Also: softened the sign-convention javadoc (explicit sign-convention check DEFERRED, band catches only gross magnitude errors), excluded null-rate cells from the duplicate/monotonic scan, and skip the monotonic compare on equal rates. 18 no-DB tests (TDD). No new entity → no KamoInitializer run.

June 27, 2026 · kamo-shared-library

LockPolicyVersionPublisher — §6.5 supersession completes the spine triad

The lock-policy-version sibling of **************** keyed per INVESTOR (ux_lock_policy_version_active = (organization_id, investor_id) WHERE status='ACTIVE' AND effective_until IS NULL). Same atomic prior-window close + saveAndFlush the prior's close BEFORE the candidate INSERT (the Hibernate insert-before-update flush-order trap). Deltas vs rate-sheet: scope key investorId; no revisionLabel/issuedAt; intraday sequence keys on effectiveFrom's day. Shared-lib @Component gated mlos.catalog.enabled + repo finder **************** 11 no-DB Mockito tests (TDD). With this, §6.5 effective-dating supersession is COMPLETE across all three WORM version spines (rate-sheet + guideline + lock-policy). Faithful mirror → CRDB e2e is the gate. No new entity/table → no KamoInitializer run.

June 27, 2026 · kamo-shared-library

GuidelineVersionPublisher — §6.5 supersession for the guideline spine

The guideline-version sibling of RateSheetVersionPublisher, keyed per PRODUCT (ux_guideline_version_active = (organization_id, product_id) WHERE status='ACTIVE' AND effective_until IS NULL). Same atomic prior-window close: ACTIVE→SUPERSEDED + effective_until = successor.effective_from, supersedes_id link, and saveAndFlush the prior's close BEFORE the candidate INSERT (the Hibernate insert-before-update flush-order trap). Deltas vs rate-sheet: scope key productId; validate revisionLabel + sourceDocumentId (no issuedAt); intraday sequence keys on effectiveFrom's day. Shared-lib @Component gated mlos.catalog.enabled + repo finder **************** 12 no-DB Mockito tests (TDD, incl. flush-order InOrder + WORM-guard re-run). Faithful mirror of the adversarially-reviewed rate-sheet publisher → gated by the behavioral e2e (guideline supersession flips pricing eligibility). No new entity/table → no KamoInitializer run.

June 27, 2026 · kamo-shared-library

RateSheetVersionPublisher — doc 02 §6.5 effective-dating supersession

The atomic prior-window close the MLOSCatalogService bootstrap bundle writer deferred. Publishing a new rate-sheet version for an existing (org, investor) scope now closes the predecessor (ACTIVE→SUPERSEDED + effective_until = successor.effective_from), links the successor (supersedes_id, next intraday sequence_no) and flushes the prior's close BEFORE the candidate INSERT — Hibernate orders INSERTs before UPDATEs in a flush, so saveAndFlush(prior) is required to avoid a self-inflicted ux_rate_sheet_version_active partial-unique violation. Shared-lib @Component gated mlos.catalog.enabled (the EffectiveVersionResolver sibling pattern); the close is WORM-legal by construction against the entity's @PreUpdate guard. 15 no-DB tests (Mockito) incl. flush-order InOrder + WORM-guard re-run. 2-agent adversarial review → FIX_THEN_SHIP (1 must-fix applied: sourceDocumentId validated up front → clean 400, not a post-side-effect 500). No new entity/table/repo-interface → no KamoInitializer run.

June 27, 2026 · kamo-shared-library

Add **************** for the PPE run event

June 27, 2026 · kamo-shared-library

EligibilityCellMatcher single-dimension reason-code attribution (ECOA specificity)

Closes the reason-code reachability gap the PriceAssemblyEngine review flagged: a cell miss on EXACTLY one containment dimension now becomes INELIGIBLE with its specific ECOA principal reason (FICO_BELOW_MIN / STATE_NOT_ELIGIBLE / PROPERTY_TYPE_NOT_ELIGIBLE / UNITS_NOT_ELIGIBLE / **************** instead of collapsing to generic NO_COVERAGE — making the 9 unreachable CELL codes reachable. Multi-dimensional / ambiguous misses, and numeric catalog gaps (FICO above a ceiling or between bands; a loan amount between disjoint bands), correctly stay NO_COVERAGE (a §6.6 coverage defect, never a borrower denial). Pure substrate — no live service consumes the matcher yet; no schema change, no KamoInitializer run. - EligibilityResult: carries the principal MlosAdverseActionReasonCode (the matcher owns it — only it holds the dimensional context). The reason-less 2-arg ineligible factory is REMOVED so reasonCode is null iff ELIGIBLE — the MlosPricedProductResult @PrePersist invariant holds by construction for any factory-built result. - EligibilityCellMatcher: failedDims + relax-one-dimension attributeNoCoverage; direction (BELOW/ABOVE/GAP) computed ONLY over the sole-on-that-dimension failers (not the whole matrix) so a too-large loan on disjoint bands is never mislabeled BELOW_MIN, and a FICO above-ceiling/gap is a coverage gap, not a false "score too low". Substrate contract documented: one true disqualifier; the LOE-Core consumer re-attributes the up-to-4 NOAA reasons. - PriceAssemblyEngine: additive reasonOr(cell, fallback) — prefers the matcher's owned code; cellReasonCode(matrixType) kept as the defensive raw-result fallback. 2-agent adversarial review → FIX_THEN_SHIP; applied both must-fixes (loan-amount & FICO direction mislabels, each proven with a worked example) + should-fixes (totalize the record invariant; substrate-contract + direction docs). 19 matcher + 33 engine tests green (89 catalog tests green).

June 27, 2026 · kamo-shared-library

ComplianceTimerService emits mlos.compliance.timer.breached on SLA breach (doc 03 §2.8)

The javadoc-named follow-up to the shipped Slice-2c timers: "event emission to a Compliance queue is a follow-up." expireBreached() now emits a COMPLIANCE_TIMER_BREACHED event per ARMED→EXPIRED timer, written to the outbox IN THE SAME TRANSACTION as the flip (the transactional-outbox guarantee: a breach is escalated iff it is durably recorded). The downstream consumer drives the HIGH steward escalation + the OrchestrationState BLOCKED→STALE abandonment (a later slice). - OutboxWriter injected as an OPTIONAL dependency **************** null disables emission so the service still expires timers when the outbox substrate isn't wired in the running service — graceful, backward-compatible with DaemonService's current autowiring (the 3-arg test seam is preserved). - Envelope: domain=compliance, aggregateId=loanFileId, payload carries **************** - New open String event-type constant **************** (no schema change → no KamoInitializer run). - 14 ComplianceTimerService tests green (12 existing unchanged + 2 emission tests). Faithful mirror of the shipped decision-spine/webhook-ingress outbox-producer pattern (review-exempt).

June 27, 2026 · kamo-shared-library

ConditionTemplateExtension — borrowerActionable flag for the portal (doc 09 §6.4)

The net-new data dependency the borrower portal's "What's Left" view needs: the locked LoanCondition carries only staff/org member ids, so the portal cannot tell which open conditions a BORROWER may act on. doc 09 §6.4 prescribes a borrowerActionable flag on the LoanConditionTemplate as a SIBLING entity — never a column on the locked core (doc 01 §1.1). The per-condition flag is DERIVED service-side from this template flag + the condition category. - ConditionTemplateExtension (com.kamo.z.shared.mlos.docs, mutable config/reference): soft FK loanConditionTemplateId → locked LoanConditionTemplate.id (UUID), DB-UNIQUE 1:1; denormalized organizationId (Long, String-serialized); borrowerActionable boolean @ColumnDefault false (fail-safe: internal-only unless curated actionable). - **************** (findByLoanConditionTemplateId + **************** mlos.docs already in @EnableJpaRepositories; the UNIQUE index is entity-declared (no SchemaCleanupRunner). - 3 no-DB tests green. Faithful mirror of the DocumentRequirement soft-FK-to-locked pattern (review-exempt).

June 27, 2026 · kamo-shared-library

PriceAssemblyEngine — the deterministic §8.1 PPE core (Phase 2 Slice 13)

The first pure-logic mlos slice: the capstone that composes the shipped catalog resolvers into the authoritative server-side pricing math (doc 02 §8.1 steps 2-4). Ungated stateless @Component (sibling to AdjustmentConditionEvaluator/ **************** — zero repository, no new entity, no schema change. The future MLOSPricingService wires repos + persistence + events. - mergeEligibility(): the §8.1 step-2/3 three-conjunct filter (cell AND guideline AND AUS gate) → EligibilityVerdict, most-severe-blocking precedence with a single principal MlosAdverseActionReasonCode (cell **************** → guideline → AUS-when-required → ELIGIBLE). - assemblePrice(): final_price = base + Σ ADDITIVE + Π MULTIPLICATIVE(stack_order) + margin, respecting cap_value. Additive summed (→ total_adjustments 9,6), then multiplicative factors scale the running subtotal in ascending stack_order (uid tie-break), then margin added last/outside the Π; single final HALF_UP to (9,4). - price(): orchestrates both; output satisfies the MlosPricedProductResult @PrePersist offerable-consistency invariant by construction. - cap_value = additive-only sign-preserving magnitude clamp (cap=0 ⇒ 0 contribution, intended); a multiplicative cap_value is a loud config defect (fail-closed, never mis-price). AUS PASS/NOT_APPLICABLE non-blocking (price-before-AUS; the §8.2 lock-stage hard-stop is the service's). - New: AusGateOutcome enum + **************** PricedProductComputation records. 33 no-DB JUnit5 tests green. Research Workflow (3-reader + synthesis) + 2-agent adversarial review (verdict FIX_THEN_SHIP, zero must-fix; applied the 5 should-fix hardening items: loud multiplicative-cap guard, reason-code-coverage-gap doc, cap=0 + lowest-ruleCode docs, and 6 coverage tests).

June 27, 2026 · InitializerService

Register pkg + RCE/pull-through DDL (docs 08/09)

@EnableJpaRepositories += **************** SchemaCleanupRunner: **************** (partial-unique) + rce_commit_ai_decision_fk + rce_commit_lock_record_fk + rce_commit_pricing_snapshot_fk (the §7.4 snapshot delete-guard) + mlos_aiptp_one_active_uniq (one ACTIVE pull-through policy per lender_profile+market). RCE table + constraints applied + verified.