- Shipped
- October 18, 2026 at 9:19 PM UTC
- Author
- Kamo
- Commit
- 27e0602
New relays on /api/security/mortgage-apps (MortgageLoanDeskController, @RequireRight, the caller's org's loan only): - GET /{uid}/qualification, /{uid}/engine-locks, /{uid}/lock-recommendation, /{uid}/aus-runs, /resolve-identifier (another tenant's number reads as unresolved), /{uid}/communications (MLOS archive + outbox), /{uid}/consent (parties, current consent per scope/channel, preferences): MLOS_VIEW_PIPELINE. - POST /{uid}/rate-lock/commit (a priced result of THIS loan only; PROCESS or UNDERWRITE, as the door's other lock writes) and POST /{uid}/aus-runs (UNDERWRITE, as recording an AUS finding; never a fresh-credit attestation). Steward routes stay operator-only. Security fixes (no member held MLOS_VIEW_PIPELINE without a write right, so nobody loses access): - PUT **************** POST /{uid}/credit/order (staff) and the QC fact review took the view right for a write; they take an MLOS write right. - CreditOrderService loaded the application by id alone: another tenant's application now 404s. SI walls (MlosSiActGuard; a person is unaffected): an engaged MLOS kill switch for the task (RATE_LOCK, AUS_SUBMISSION, CREDIT_PULL_AND_ANALYSIS, DISCLOSURE_AND_TRID, a vendor category's task type) holds the SI's act (409 KILL_SWITCH, fail closed); a tenant whose lock autonomy turns auto-execution off keeps every lock a person's (AUTONOMY_WALL), and an engine LOCK_BLOCKED holds it; no credit pull or AUS on a draft; electronic disclosures (envelope create, resend) only when every customer party holds a current E-SIGN consent (NO_ECONSENT). Kill switches, the governor and the posture are read, never set.