Live Change Log

SecurityService's hourly review of phi_access_log needs somewhere to send what it finds. Rather than invent a channel it uses the existing transactional-email r...

Adds PhiResourceType.ORGANIZATION and PhiAccessKind.CONFIGURE so that turning Organization.handlesPhi on or off can be recorded as what it is. Every existing r...

The staff preview has to show exactly what the customer receives, so branding, the document term and the link host now resolve in one place. Two copies would dr...

Hibernate copies the referenced id's columnDefinition onto a new @JoinColumn, so quote_id and option_id were both created DEFAULT gen_random_uuid(). An insert t...

A quote can now present several mutually-exclusive ways to buy — monthly, annual, three-year — instead of forcing three separate documents that drift apart the ...

Append-only steward APPROVE/REJECT judgement on a frozen priced result. @PreUpdate throws (a reversal is a new row). Table + 4 indexes (org, run, result, loan) ...

Turns §164.312(b) from a log line into evidence. The capture layer has been wired across seven services for a while, but it wrote through Slf4jPhiAccessLogWrite...

Adds the HMDA ULI to the LAR export. UliMinter builds the ULI = org LEI(20) + loan number + two ISO 7064 MOD 97-10 check digits (Mod97CheckDigit — the IBAN algo...

MfaEnrollmentService shipped with @Service. Every Kamo service carries @ComponentScan("com.kamo"), so all of them construct it — but each declares its own EXPLI...

MfaEnrollmentService is a @Service and every Kamo service component-scans com.kamo, so it is instantiated in roughly forty applications. It had two constructors...

The compliance assessment called the absence of any second factor disqualifying on its own, and under the 2025 Security Rule NPRM MFA stops being addressable at...

Adds a first-class Quote alongside the existing commerce spine. The pre-existing "ServiceQuote" is an Intent plus a JSON blob carrying one offering and one flat...

Backing store and queries for the mailbox sender-avatar chain. SenderIdentityEntity is the durable tier of the avatar cache. org_id is part of the natural key ...

The Security Rule requires recording access to ePHI, which means reads. The platform records changes well — LeadHistory, SystemAccessLog, UserHistory, LoanAudit...

Wires PhiTenantGuard into FeatureService, the single choke point through which a module is switched on for an organization. This is where the boundary stops bei...

LoanFile.loanNumber was null on create (both blank-create and lead-promote) and only ever set when a steward typed one — which hard-blocked MERS MIN minting (a ...

Backs PhiTenantGuard with a real column. HANDLES_PHI is NOT NULL DEFAULT FALSE following the **************** pattern, so every existing tenant is explicitly ou...

The keystone of the HIPAA compliance boundary: which modules a tenant may reach, given whether that tenant handles protected health information. Everything down...

This reverts commit ****************

The keystone of the HIPAA compliance boundary: a per-organization flag plus a guard deciding which modules that organization may reach. Everything downstream ke...

- **************** contactEmail branch (company contact email editable via PUT /api/security/org, used as company-scope campaign From) - ApplicationRepository...

The issuance mechanism's shared-lib half. ComplianceTimerService gains **************** — flips only ARMED ECOA_AA timers to SATISFIED (leaves COUNTEROFFER/INCO...

Adds the shared-library foundation for org-level bulk email campaigns: - OrgBulkEmailProviderEntity (separate from everyday provider; UNIQUE org_id) - EmailCamp...

The routed-decision steward notification needs a canonical email template. Registers STEWARD_TASK_ROUTED in CANONICAL_KEYS with its json/html pair; body carries...

Adds a contact-level `dateOfBirth` (java.time.LocalDate, DATE column) to the base Lead: entity + Create/Update/LeadDTO (fromLead), copied in LeadService create/...

Both templates ship as resource pairs on disk (welcome-member.{json,html}, **************** with matching templateKeys, and EmailService already has their sampl...

assignLead had zero callers and had never run in production. Before wiring the bulk reassignment path to it, give it the guarantees that path needs: - take org...

Org branding endpoints (logos, colors, backgrounds, theme provisioning) were owner-or-god only, leaving no way to delegate branding without handing over ownersh...

SUSPENDED is deliberately not terminal — LoanFileStatus.isTerminal excludes it, because a loan is suspended for a fixable reason. But it had no forward arrow, s...

The client field-initialized a bare `new RestTemplate()`, so no timeout applied on any AI call and no builder could reach it. A hung provider blocked the caller...

Twelve @Query aggregates across sessions, messages, usage records and outbound touches, so a scorecard is a handful of grouped queries rather than loading rows ...

Replaces the single training-context blob with a structured, versionable agent model, and adds the per-contact spine an agent needs before it may initiate conta...

Org-configurable AI sales agents: a named agent for a sales industry, programmed with a training context the org authors (from a template or by hand), assignabl...

Foundation for making the reusable public-chat widget handle the KamoMLOS borrower->loan-officer variant securely, and for propagating lead reassignment into an...

Investor rate sheets / LLPA + eligibility matrices / lock policies need somewhere to live: the ingest extracts from the blob, and the published rate-sheet versi...

personal phone or must be on a company-managed (Android Device Owner enrolled) device: - MobileDevicePolicy enum: PERSONAL_ALLOWED | COMPANY_MANAGED_REQUIRED. ...

Completes the owner-column lookups the MLOS identifier plane needs to route inbound callbacks: **************** (DU/LP/GUS run handle) and **************** Both...

The MLOS identifier plane resolves an inbound vendor/agency callback back to a loan; for OWNED_ELSEWHERE types the authoritative value lives on the OWNER's colu...

The borrower-facing half of the conditions loop: two generic checklist templates for the new condition notification consumer. Added to CANONICAL_KEYS with their...

Add **************** as the single source of truth for the "only ACTIVE members may sign in or appear as a live participant" invariant: base members must be rec...

- MlosCommitment.boardedAt: in-system marker for a PURCHASED commitment's loans boarded to servicing (the external servicing-system handoff is the blocked leg...

Slice 2 foundation for the capital-markets loan-sale desk (doc 08) — the terminal origination stage. The shipped **************** had NO runtime consumer; these...

Splits the ClosingArtifact @PreUpdate WORM guard so the eClose vendor dispatch can move OUT of the assemble/advance transaction (doc 05 §6): the node commits FI...

- VendorCategory gains the four notarized-leg rails so the integrations tab can configure a per-org RON/eNote/eVault/MERS vendor (additive STRING enum, no CHE...

**************** — locks key on scenario, so resolve a loan's locks via MlosLoanScenario.loanFileUid. Backs the borrower/steward 'is this loan rate-locked?' rea...

The per-borrower repeating sections were write-only; add read projections **************** so the borrower capture UIs can hydrate existing rows via GET endpoin...

VendorOrder extends BaseUuidEntity (key = uid, not id); the derived-query parse failed at boot ("No property 'id' for VendorOrder"), crash-looping MLOSVendorSer...

The greenfield 3rd-party order-of-record **************** SCRA). VendorOrder = partial-WORM async order (ClosingArtifact idiom: opaque vendorKey/externalRef, fr...