- Shipped
- July 16, 2026 at 11:26 PM UTC
- Author
- Kamo
- Commit
- 2210f2d
Closes the SecurityService side of a batch of verified proxy gaps where an MLOS engine capability existed but no browser-reachable proxy did: - underwriting: GET adverse-action-reasons (Reg-B/ECOA principal reasons), POST agency-aus-steer, POST agency-aus-pick-best, POST internal-rules-runs (non-QM) — org + acting member server-stamped; facts server-derived downstream. - capital-markets: POST /locks/{id}/events — post-lock lifecycle (extend/float- **************** to the pricing engine, ownership fail- closed via the lock read, LOCK excluded from the whitelist, economics collected from the caller (never auto-derived), TRID timer left to the engine. - pricing: GET /adjustments/{id}/impacts — reverse LLPA blast-radius, per-line org-filtered (foreign lines dropped, re-counted). - doc-orchestration: POST ron-fallback (record alternative notarization), POST/GET closing-workflow-templates (publish + detail), org server-stamped. - doc: GET /loans/{id}/clearability — loan-wide clearability roll-up. All operator+org gated; downstream 4xx/409 relayed verbatim.