- Shipped
- November 11, 2026 at 9:06 AM UTC
- Author
- Kamo
- Commit
- afabf08
Owner decisions 2026-11-11 (KamoMLOS borrower-portal overhaul, stream S5). Borrower guide (one per lender): - BorrowerGuideService stores the guide's name, greeting and picture on the org's MORTGAGE LenderProfile (shared-lib cde97f42; DDL applied by hand). Pictures go to the public theme bucket under **************** — content-addressed, immutable cache, sniffed by magic bytes (PNG/JPEG/WebP/ GIF only, no SVG), 2 MB cap, Antivirus-screened, never deleted on replace. - MlosGuideController: GET/PUT /api/security/mlos/config/guide and POST/DELETE /guide/avatar, gated like the rest of the market's MLOS config (operator or MANAGE_SUBSCRIPTION_SETTINGS). - /portal/chat-config now also carries guide {name, greeting, avatarUrl} and talkItThrough (the org has the SI app) whenever the org resolves. Talk It Through (SI): - POST **************** the borrower's description goes through MlosAiClient on the LIGHT tier; the reply is held to a strict vocabulary of the funnel's answers (unknown keys, out-of-range or guessed values dropped). 404 {available:false} without the SI app (AI_SUPPORT); Redis rate limit 6/10 min per visitor and 30/h per IP; the borrower's words are never logged. Added to the unguarded-endpoint baseline as deliberately public, like the rest of /portal/*.