- Ya
- 17 Julai 2026, 03:18 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 01d8d87
Verified defects from the session review: - CRITICAL: commitLock hardcoded **************** which the RCE commit engine rejects with a 400 (only LOCK_ELIGIBLE commits) — every steward lock commit was dead. A steward commit on an ELIGIBLE result IS the cleared path; the engine still enforces its walls; human-override provenance rides on decisionPath=STEWARD_OVERRIDE. Send LOCK_ELIGIBLE. - HIGH: loanFileUidForApp resolved the backing loan with NO org filter, and the operator branch of requireView(req,uid) authorized on the right alone — an operator with a foreign appUid could read another tenant's closing-readiness / vendor orders / conditions / readiness. Fail-closed via the org-scoped loanFileStatus; thread orgId through all 12 resolver call sites. - HIGH: the borrower vendor-orders read relayed the full operator VendorOrderView (internal categories CREDIT/AUS/FRAUD/SANCTIONS/... + vendorKey/externalRef/ factRef/lastError) to the borrower and filtered only client-side. Project server-side for a party caller (safe categories + safe fields); the raw-payload events endpoint is now operator-only.