Live Change Log

OTKValidationFilter precedence: X-OTK → X-***-Token → ?st= (GET, audio streaming paths only, verified via shared StreamTokenCodec with internal.auth.secret; cla...

OTKPreAuthFilter resolves X-***-Token when no X-OTK is present (same call MediaService REST without the BFF. KSessionService now slides the Redis TTL with the s...

- DeviceAuthController: durable device credential per (user, device) with rotate-on-exchange + 60s grace; /device/exchange mints a per-org *** via PostAuth*...

hashed secret, rotation grace, sliding expiry), push_device_registrations (one push destination per device+org+kind), and StreamTokenCodec — short-lived HMAC to...

Drives ClosedLoanTrainerService across successive passes with the (pre-live) MeridianLink wire and vision read stubbed, locking the behaviour the design hinges ...

The trainer now refines a loan over multiple passes instead of one-and-done: - TrainingDocStore is a PERSISTENT, deterministically-keyed cache (key = hash of...

The closed-loan trainer now re-reads a loan on successive passes until its extraction reproduces the loan outcome, so: - LeadLosLink.closedLoanPasses drives a p...

After the atomic claim() bulk-updates the row to RUNNING, mirror that in the in-memory entity — the pool thread has no open session, so a later full-row save wo...

run is RUNNING, without touching status. An operator pause (status → PAUSED) can no longer be clobbered by a full-row save from the pool thread — the guarded up...

- Concurrency: in-process activeOrgs guard + the DB claim() so this instance never double-walks an org and two replicas can't overlap; a run whose heartbeat...

- ClosedLoanTrainingRun.claim(): atomic conditional UPDATE that takes ownership of a run only when it is not already RUNNING or its heartbeat is stale (prev...

Top-level owners can run + monitor the MeridianLink closed-loan trainer across every tenant from Settings → Platform → Document AI. Per-org rows show status, lo...

A closed loan is ground truth: its MeridianLink metadata is the answer key, its documents are the input. ClosedLoanTrainerService walks each MeridianLink org's ...

**************** gives the trainer every LOS-linked loan for an org+provider, each carrying the externalLoanName it reads status + documents for.

Foundation for training document extraction against funded loans (the answer key): - ClosedLoanTrainingRun entity+repo — per-org run control + live counters - E...

Both reject paths now pass **************** to the borrower's rejection email instead of the raw enum literal.

RejectionReasonType was a bare enum (the borrower literally saw "ILLEGIBLE"). Each value now carries a borrowerMessage() remediation string + a messageFor() map...

The Document AI tab now hosts the cross-tenant review queue: low-confidence extractions from every lender, lowest-confidence first, with inline confirm/correct/...

system-config gains a cross-tenant extraction review queue + confirm/correct/reject, gated to top-level owners — the central labeling surface for the shared mod...

A document is a document — extraction and the model are platform-level, not per lender. Adds a cross-tenant NEEDS_REVIEW queue + QcReviewService.platformReview ...

system-config GET/PUT now carries extractionAutoApplyConfidence + extractionModelId and reports the platform-wide corpus size + per-doc-type accuracy; adds a cr...

Adds a Document AI tab to **************** the auto-apply confidence threshold, the registered fine-tuned model id, the platform-wide training-corpus size + per...

Adds **************** (default 0.85) + EXTRACTION_MODEL_ID to the platform SystemConfiguration singleton — the platform-wide levers for the QC gate and the regi...

Adds a Document QC console to the mortgage steward strip (?sub=docqc): the org-wide queue of low-confidence AI extractions grouped by loan, with inline confirm/...

Adds an org-scoped NEEDS_REVIEW query + QcReviewService.orgQueue so employees can work every loan's low-confidence extractions from one portal, not one loan at ...

Adds a "Document QC" section to the loan detail: the queue of low-confidence AI extractions with confirm / correct / reject per field (each decision trains the ...

- QcController (/api/security/mlos/qc, LOS_VIEW_PIPELINE): review queue, review action (confirm/correct/reject), NDJSON training-data export, per-doc-type a...

QC engine (Phase 4 core): - VerifiedFact gains first-class EXTRACTION_CONFIDENCE, DOC_TYPE_CODE, QC_STATE columns (QcState: **************** Reconciliation ...

The Tomcat webapp idles near ~800Mi, so a 1Gi ceiling left almost no headroom. Opening an RDP session pushed RSS over 1Gi and the container was OOMKilled (exit ...

Adds extraction prompts for SSA_AWARD / PENSION / CHILD_SUP (AI reads the gross monthly amount + a label), and stamps the OtherIncomeSource id deterministically...

Extends fact reconciliation with an otherIncome.* branch: award/benefit documents (Social Security, pension/retirement, child support) land a real OtherIncome r...

A cheap LIGHT-tier "what is this document?" pass on the first page classifies the upload into a coarse family and compares it to the requirement's asserted type...

Widens vision extraction to two more borrower doc types that reuse the existing reconciliation vocabulary (zero reconciliation risk): BANK12MO reads as an asset...

The vision path was image-URL only, so a borrower's multi-page PDF (bank statement, tax return) couldn't be read. Now: - VaultDocPublicController serves ?page=...

Adds DocPageRenderService + POST /api/conversion/render-page (page N → PNG at 150 DPI, capped 300) and /page-count. This is the read-quality companion to the 30...

No SecurityService source change — this empty commit triggers the CI, which clones kamo-shared-library main at build time, so the deployed image picks up the ne...

The application posture needs the borrower's REAL Social, not a last-4 (a lender can't do anything with 4 digits). Borrower.ssnEncrypted existed but was never w...

The softphone CRM tab resolves an active caller number to a lead. Add an optional phone RequestParam that filters the org lead list by canonical (last-10-digit)...

Replace the mock CRM tab with a live reverse-phone-lookup panel. - Resolve the active call / dialpad number to a CRM lead via leadsApi.searchByPhone (new ?pho...

Adds a wildcard consent (allowAll / isAlwaysAllowed) so a member can opt to display external images in every message. Reuses the existing consent table via a re...

The external-images gate now offers two actions: Unblock (this message, as before) and Unblock forever, which displays external images in every message going fo...

A genuinely different preferred name (compared case-insensitively with outer spacing trimmed) is a different person, so create a brand-new lead instead of renam...

Drop the ACCEPT_SUPPORT_TICKETS requirement from assignToPreferredAgent: the borrower's assigned loan officer is reachable regardless of whether they're a confi...

The support-session proxy already forwards the raw body, so the merged widget's preferredAgentMemberId reaches MediaService untouched. Add the presence proxy so...

Powers the borrower portal's merged LO/chat widget: - **************** direct-assigns a public-chat ticket to a SPECIFIC agent (the borrower's assigned loan o...

The merged LO/chat widget needs to (a) target the assigned officer directly in the borrower's live-support session and (b) query the officer's live presence. Bo...

The borrower portal already creates the lead the instant a name is given, but enterAssignmentPoolIfActionable kept a name-only lead OUT of the credit accept poo...

- Root cause of empty chat history on long-lived tabs: media proxy routes forwarded only the *** cookie (lapses ~30min) instead of the per-tab X-***-Token; ...

Remove messagePreview computation, the ledger PREVIEW write, and the messagePreview template variable; drop the includePreview preference. Emails now carry send...