# NACHO LOS — Product Requirements Document

### The lender-side half of the CLEAR mortgage platform

| | |
|---|---|
| **Document** | `LOS_version1.0.0` |
| **Product** | NACHO LOS — the loan origination system (where the loan is manufactured) |
| **Version** | **1.0.0** — the baseline. Every later change is versioned; see §12. |
| **Issued** | 2026-09-01 |
| **Subject-matter authority** | **Christa Votaw**, National Sales Director, CLEAR Home Loans. **Sharon LittleJohn**, Director of Operations, is the source of record for the operational line — the roster, the milestone spine, the fee sheet, closing and post-closing. |
| **Prepared by** | Willis, working from the live build and their specifications |
| **Audience** | The development team building the production system |
| **Companion documents** | `POS_version1.0.0` (the borrower-facing system) · `INTEGRATION_version1.0.0` (how the two connect). **All three are one specification.** |
| **Scope** | United States only. Retail, non-delegated correspondent, and brokered channels. Purchase and refinance. 1–4 unit residential. |
| **Reference build** | `https://nachomamas.pages.dev/los/` — working software, not a mockup. Where this document says a thing is BUILT, it is running there today. |

---

## Read this first

**You are not expected to know anything about mortgages.** §2 teaches the domain from zero, and it
is the same primer that appears in `POS_version1.0.0` — written once so the two halves can never
teach you two different things about the same regulation.

**What an LOS actually is.** It is not a database of loans. It is a **manufacturing line.** A loan
arrives from the borrower-facing system as raw material and leaves as a saleable asset. Between
those two points it passes through named stations, each staffed by a specific role, each with a
gate that must pass before the file may advance. When you are unsure how to model something, ask
what a factory would do — that is nearly always the right answer here.

**The mortgage judgment in this document is the deliverable.** Most of the rules are federal law
and several are the difference between a loan an investor will buy and a loan CLEAR is forced to
keep. Where a requirement exists because of a regulation it says so and cites it. **Do not optimise
those away.**

**Four things that are not negotiable:**

1. **Permissions are enforced on the server, never in the screen.** The tell that permissions are
   cosmetic is that a super-admin sees the same screen as everyone else.
2. **Deny by default.** A route is staff-only unless explicitly named public. A route written next
   month that forgets to check anything must **refuse**, not permit.
3. **A refusal names what to do next.** When the software turns somebody away it says which
   capability was required and which seat holds it. A gate that only says "no" teaches people to
   route around the system.
4. **Compliance gates block; they do not warn.** See §6 group CO. A warning is a suggestion, and a
   suggestion at the moment somebody is trying to ship is a suggestion that gets ignored.

---

## How this document is organised

| § | What it covers | Who needs it |
|---|---|---|
| **1** | What the LOS is, scope, and its relationship to the other two documents | Everyone |
| **2** | ⭐ **Mortgage fundamentals** — the domain, from zero | Everyone, first |
| **3** | Business context, the operating model, and how success is measured | Product, leadership |
| **4** | ⭐ Roles, capabilities, scope and coverage — **build this before any screen** | Everyone |
| **5** | The manufacturing line, station by station, and the 53-screen inventory | Everyone |
| **6** | ⭐ **Functional requirements** — 278, numbered and tiered | Engineering, QA |
| **7** | ⭐ **Non-functional requirements** | Engineering, QA, ops |
| **8** | The data model | Engineering |
| **9** | Compliance requirements, rule by rule | Engineering, QA, compliance |
| **10** | Integrations | Engineering |
| **11** | What is still open — decisions, conflicts, and known gaps | Product, leadership |
| **12** | Change control, versioning, glossary, appendices | Everyone |

⚠️ **§4 comes before §5 on purpose.** A screen that looks right sitting on top of a wrong permission
model is the most expensive kind of wrong, because it is invisible until an examiner or an incident
finds it.

**Requirement IDs never change and are never reused.** A requirement is referenced as `CO-06` or
`FE-04` for the life of the product. Where you need to be unambiguous across documents, write
`LOS-CO-06`.

---

# 1 · Introduction

## 1.1 What the LOS is

**LOS stands for "loan origination system."** It is the software CLEAR's own staff work in — the
processors, underwriters, closers, funders, post-closers, the lock desk, managers and
administrators.

⭐ **It is a manufacturing line, not a database.** A loan arrives from the POS and passes through
stations: intake, processing, underwriting, conditions, closing, funding, post-closing, and finally
sale to an investor. Each station has an owner, a gate, and a set of tasks it fires on entry.

| Half | Name | Who uses it | What it does |
|---|---|---|---|
| **Front** | **POS** — `POS_version1.0.0` | Borrower, referral partner, loan officer | Wins the loan, collects the application and documents, keeps the borrower informed |
| **Back** | **LOS** — this document | CLEAR staff | Verifies, decides, prices, closes, funds, insures, and sells the loan |

## 1.2 The one-sentence product goal

> Every operator opens one screen and knows what to do next; every file's next action is visible
> to whoever picks it up; and no loan advances past a gate it has not actually passed.

## 1.3 What the LOS is *not*

- **It is not a borrower-facing system.** ⛔ **The LOS never authenticates a borrower.** Borrower
  identity, the application experience, the referral partner and the AI borrower assistant all live
  in the POS.
- **It is not a servicing system.** CLEAR releases servicing. Post-close uploads go to whoever
  purchased the loan. This closes the scope cleanly and it stays closed.
- **It is not a CRM.** Leads and sales pipeline live in the LO Portal / POS and must never clutter
  the LOS.

## 1.4 ⭐ The rule of thumb for the seam

> **The POS owns the humans. The LOS owns the loan.**

The most expensive failure in a POS/LOS programme is both sides implementing the same logic and
then disagreeing at runtime. Every shared concern has **exactly one** system of record, listed in
`INTEGRATION_version1.0.0` §3. The two that matter most:

- ⭐ **Loan status / milestone is the LOS.** Authoritative. The POS mirrors and presents; **it never
  computes a stage.**
- ⭐ **Underwriting decisions are the LOS.** The POS decides nothing. This is a compliance boundary
  as much as an architectural one.

## 1.5 Scope

**In scope:**

- United States only. Purchase and refinance. 1–4 unit residential.
- Loan types: Conventional, FHA, VA, USDA, Jumbo, Non-QM.
- ⭐ **Three channels, not two:**

| Channel | Approximate share | What changes |
|---|---|---|
| **Retail** | Majority | The full line, in-house end to end |
| **Correspondent, non-delegated underwriting** | **~20–25%** | Disclose and process in-house → the processor uploads the package to the investor to underwrite → investor conditions come back and are mirrored internally → finish in-house with documents, wire and funding |
| **Brokered** | **~10–15%** | Disclose and hand off |

⚠️ **The brokered channel is a known gap** — it was absent from the prior blueprint entirely, which
left roughly one loan in eight without a home in the system. It is specified at minimum level in
§6 (PR-09) and named as an open item in §11.

**Out of scope:**

| Out of scope | Why it is named rather than omitted |
|---|---|
| **Loan servicing** | Servicing is released. Deliberate and settled. |
| Commercial and multifamily (5+ unit) | Different regulations, documents and underwriting |
| Reverse mortgages | A separate product with its own rulebook |
| Construction-to-permanent | Deferred, not cancelled |
| International and territory lending | Deferred by explicit scope decision |
| The borrower experience | That is `POS_version1.0.0` |

## 1.6 ⭐ The commercial ambition, and why it changes the architecture

CLEAR intends this platform to be **licensable to other lenders**, not merely used in-house. That
is not a phase-two concern — it is an architectural constraint from the first commit, and it is why
§6 carries a **Commercialisation** group and why §7 treats multi-tenancy as foundational.

The practical consequences: tenant onboarding without engineering; per-tenant branding, fee
templates, plan codes and investors; **tenant-scoped credentials**, so each lender uses their own
agency and vendor accounts; tenant data isolation **provable on demand**; and a third-party POS
slot, because a licensee may arrive with their own front end.

---

# 2 · Mortgage fundamentals — the domain from zero

**Read this section even if you are in a hurry.** Almost every strange-looking requirement in this
document is strange because of something in here. An engineer who skips this section will build
something that looks right and is illegal, and will not be able to tell the difference.

Nothing in this section is CLEAR-specific. This is how the American mortgage industry works.

## 2.1 What a mortgage actually is

A **mortgage** is a loan used to buy or refinance real estate, where the property itself is the
collateral. If the borrower stops paying, the lender can take the property.

Two documents do the work, and they are not the same thing:

- **The note** — the borrower's promise to repay. This is the debt.
- **The mortgage** (called a **deed of trust** in some states) — the document that pledges the
  property as security for that promise. This is the lien.

The **borrower** is the person taking the loan. A **co-borrower** is a second person equally on
the note. The **lender** is the company advancing the money — in this document, CLEAR Home Loans.

## 2.2 The five-minute version of how a loan happens

Here is the whole lifecycle. Everything in both documents is somewhere on this line.

```
  ①  Shopping        A person wonders what they can afford. No application, no credit
                     pull, no commitment. THIS IS WHERE THE POS STARTS.
        │
  ②  Pre-qualification   A rough estimate based on what they tell us. Not verified,
                     not a promise. Gives them a number and gives us a lead.
        │
  ③  Application     They formally apply. This is the "1003" (§2.6). The moment six
                     specific pieces of information exist, a legal clock starts (§2.9).
        │
  ④  Disclosures     Within 3 business days we must hand them a Loan Estimate — a
                     standard-format document showing the rate, payment and costs.
                     They then say "keep going" (Intent to Proceed). ⚠️ Before they
                     say it, we may not charge them for anything except the credit report.
        │
  ⑤  Processing      ← THE FILE CROSSES FROM POS TO LOS HERE
                     Staff verify everything: income, assets, employment, the property.
                     Documents are collected. An appraisal is ordered. Title is ordered.
        │
  ⑥  Underwriting    A licensed underwriter decides: approve, approve-with-conditions,
                     suspend, or deny. Almost always approve-with-conditions.
        │
  ⑦  Conditions      The list of things still needed. The single biggest source of delay
                     in the entire industry. Cleared one at a time.
        │
  ⑧  Clear to Close  All conditions satisfied. The loan may now be closed.
        │
  ⑨  Closing         Final numbers are disclosed (the Closing Disclosure) at least 3
                     business days before signing. Then the borrower signs.
        │
  ⑩  Funding         Money is wired. On a purchase this is same-day. On a refinance
                     of a primary residence the borrower has a 3-day right to cancel
                     first, which is why "Closed" and "Funded" are separate milestones.
        │
  ⑪  Post-closing    The file is completed, insured if government-backed, and packaged.
        │
  ⑫  Purchased       The loan is sold to an investor. CLEAR gets its money back and
                     lends it again. This is how the business actually works.
```

**Why ⑫ matters to you as an engineer:** CLEAR does not keep these loans. It sells them. An
investor will refuse to buy a loan whose paperwork is wrong, and will force CLEAR to buy it back
if a defect is found later. That is why this system is so obsessive about records, timestamps and
proof. Sloppy data is not untidy — it is unsaleable.

## 2.3 Who does what — the roles

These are real jobs held by real people. The software models them exactly.

| Role | Plain-English job | Where they work |
|---|---|---|
| **Borrower** | The customer | POS |
| **Referral partner** (real-estate agent, builder) | Sends CLEAR the customer. The growth engine of the business. | POS |
| **Loan Officer (LO)** | Licensed salesperson. Owns the relationship, takes the application, quotes terms. **Only a licensed LO may do these things** (§2.10, SAFE Act). | POS + LOS |
| **Loan Officer Assistant (LOA)** | Supports the LO. May not set terms. | POS + LOS |
| **Processor** | Assembles and verifies the file. Orders appraisal, title, verifications. The workhorse of the middle. | LOS |
| **Processing Manager** | Runs the processors. Assigns work, covers gaps. | LOS |
| **Underwriter** | Licensed decision-maker. The only role that may approve or deny. | LOS |
| **Closer** | Prepares the final numbers and the closing package. | LOS |
| **Funder** | Releases the money. **Only this role may release a wire.** | LOS |
| **Post-Closer** | Finishes the file after funding: insuring, MERS, investor delivery. | LOS |
| **Secondary / Lock Desk** | Owns the interest rate. **Only this role may confirm a rate lock.** | LOS |
| **Manager** | Oversight across a branch, region, or the company. | LOS |
| **Admin** | Configures the system: fee templates, rules, seats. | LOS |

⭐ **Separations that look like friction and are not.** Several of these splits exist so that no
single person controls a whole risk. The person who *orders* a credit report is not the person who
*reviews* it. The person who *decides* the loan is not the person who *releases the money*. Do not
"simplify" these — each one is listed in §4 with the reason it exists.

## 2.4 The money words

You will see these constantly. They are all simple.

| Term | What it means | Why it matters |
|---|---|---|
| **Principal** | The amount borrowed | — |
| **Interest / note rate** | The percentage charged annually | — |
| **P&I** | Principal and Interest — the loan payment alone | — |
| **PITI** | P&I **plus** property Taxes and homeowners Insurance | This is the real monthly payment. Quoting P&I alone makes a payment look 25–35% smaller than it is, which is why this system always breaks it out. |
| **Escrow / impounds** | The lender collects 1/12 of taxes and insurance each month and pays them when due | An "escrow waiver" means the borrower pays them directly |
| **LTV** — Loan-to-Value | Loan ÷ property value, as a % | Drives pricing and whether mortgage insurance is required |
| **CLTV** | Same, counting *all* liens including a second mortgage | — |
| **DTI** — Debt-to-Income | Monthly debts ÷ monthly gross income, as a % | The core affordability test. Most programs cap it around 43–50%. |
| **MI / PMI** — Mortgage Insurance | Insurance protecting the *lender* if the borrower defaults | Generally required when LTV > 80%. Can be borrower-paid or lender-paid. |
| **Points** | 1 point = 1% of the loan amount, paid up front to lower the rate | — |
| **Buydown** | Paying to reduce the rate, either permanently (points) or temporarily (e.g. a "2-1 buydown") | — |
| **APR** | A rate figure that folds in certain costs. **Not the same as the note rate.** | Legally defined. Never invent this number. |
| **Rate lock** | The lender guarantees a rate for a set number of days | Expires. An expired lock costs real money. |
| **Float** | The rate is not locked yet and moves with the market | — |
| **Cash to close** | What the borrower must actually bring on closing day | The number borrowers care about most |
| **Reserves** | Money left over after closing, measured in months of payments | Some programs require it |
| **Appraisal** | An independent professional opinion of the property's value | If it comes in below the purchase price, the deal is in trouble |
| **Title** | Legal ownership, and the search proving no one else has a claim | — |

## 2.5 The four loan types

| Type | Backed by | Notable | Typical borrower |
|---|---|---|---|
| **Conventional** | Fannie Mae / Freddie Mac (the "GSEs") | Best pricing for strong credit; MI required over 80% LTV | Most borrowers |
| **FHA** | Federal Housing Administration | Low down payment, lenient credit; mortgage insurance for the life of the loan in most cases | First-time and credit-challenged buyers |
| **VA** | Department of Veterans Affairs | No down payment, no MI, a one-time "funding fee"; requires a Certificate of Eligibility | Veterans, active duty, some surviving spouses |
| **USDA** | Department of Agriculture | No down payment; property must be in an eligible rural area and income must be under a cap | Rural buyers |

**FHA, VA and USDA are collectively called "government" or "GOVT" loans.** They each have extra
steps, extra documents and extra government systems to talk to. That is why the LOS has separate
government screens.

**Conforming vs jumbo:** the GSEs will only buy loans under an annually-set dollar limit. Under it
is *conforming*; over it is *jumbo* and is sold elsewhere with stricter terms.

## 2.6 The 1003 (say "ten-oh-three")

The **Uniform Residential Loan Application**, also called the **URLA**. It is the single
standardised mortgage application form used across the entire United States, and it has been
mandatory in its current form since **1 March 2021**.

- It carries **236 data fields across 9 sections.**
- Its data format is **MISMO 3.4 / ULAD** — an XML standard. This is how loan data moves between
  systems, including from the POS to the LOS and out to the agencies.
- The nine sections: ① personal information ② employment and income ③ real estate owned
  ④ the loan and the property ⑤ declarations ⑥ acknowledgments ⑦ military service
  ⑧ demographic information ⑨ the loan officer's own section.

⭐ **The part that makes it hard to build:** the form is heavily **conditional**. Whether a field
must be asked depends on prior answers. Under 24 months at the current address means prior
addresses are required until 24 months is continuously covered. Self-employment opens an entire
additional schedule. A "yes" on a declaration opens follow-up questions. Building the 1003 as a
flat form is the single most common way a POS ships looking fine and fails underwriting. §6 group B
specifies every trigger.

## 2.7 The documents that matter

| Document | When | What it is |
|---|---|---|
| **1003 / URLA** | Application | The application itself (§2.6) |
| **AUS findings** | After the file is assembled | The GSEs' automated underwriting verdict — Fannie's is **DU** (Desktop Underwriter), Freddie's is **LPA** (Loan Product Advisor). It returns Approve/Eligible, Refer, or Caution, plus the exact documents required. It is close to the law of the file. |
| **Loan Estimate (LE)** | Within 3 business days of application | Standard 3-page form: rate, payment, costs. Legally required, legally formatted. |
| **Closing Disclosure (CD)** | ≥3 business days before signing | The LE's final counterpart. Actual numbers. |
| **1008 / Transmittal** | Underwriting | The underwriter's summary of the decision |
| **Note** | Closing | The promise to repay |
| **Deed of Trust / Mortgage** | Closing | The lien on the property |
| **Closing package** | Closing | Everything signed at the table, typically 100–150 pages |

## 2.8 Conditions — where loans actually die

An underwriter almost never says a flat yes. They say **"approved, subject to these conditions."**
A condition is an outstanding item: a missing bank statement, an explanation for a large deposit,
proof that a debt was paid off.

- **PTD — Prior To Docs.** Must be satisfied before the closing package is drawn.
- **PTF — Prior To Funding.** Must be satisfied before money moves.
- **Clear to Close (CTC)** means every PTD condition is cleared.

Chasing conditions is the slowest part of every mortgage. A large share of both documents is
devoted to making it faster.

## 2.9 ⭐ The clocks — why timing is a feature

Several federal rules are expressed as **deadlines**, and missing one is a violation regardless of
intent. The software runs these clocks; humans are not trusted to remember them.

| Clock | Rule | Consequence of missing it |
|---|---|---|
| **LE within 3 business days** | Once an "application" exists (see below), the Loan Estimate must be delivered within 3 business days | A TRID violation |
| **CD at least 3 business days before consummation** | The borrower must have the final numbers 3 business days before signing | Closing must be delayed |
| **Adverse action within 30 days** | If an application is denied, the borrower must be told, with specific reasons | An ECOA violation |
| **⚠️ The counteroffer trap** | If we counteroffer and the borrower does not accept within 30 days, it *becomes* an adverse action needing a notice | Missed constantly, because the file still feels alive |
| **Appraisal copies** | Every valuation must be delivered promptly on completion, or ≥3 business days before consummation, whichever is earlier | An ECOA valuations violation |
| **Counseling list within 3 business days** | A list of local housing counsellors, **pulled from the CFPB source no more than 30 days before it is given** | A hardcoded list becomes a violation on a schedule |

⭐⭐ **What legally counts as an "application" — the six pieces.** This is the most important
definition in the entire document. Under TRID, an application exists the moment the lender has
received all six of:

1. The borrower's **name**
2. The borrower's **income**
3. The borrower's **Social Security number** (to pull credit)
4. The **property address**
5. An **estimate of the property's value**
6. The **loan amount** sought

The instant the sixth arrives, the 3-business-day Loan Estimate clock starts, whether anyone
noticed or not. The system must detect that moment and timestamp it. **Pulling credit does not
start this clock. Collecting the sixth piece does.**

⭐ **The fee rule that attaches to it.** Once an application exists, **the only fee that may be
charged before the borrower receives the Loan Estimate and separately indicates Intent to Proceed
is a bona fide credit-report fee.** No appraisal fee, no application fee, no processing deposit.
And documents may be *invited* but may not be *required* before Intent to Proceed. Both of these
are enforced at the data layer in this system, because a policy reminder is not a control.

**"Business day" has two different definitions inside TRID.** They are codified in the system, not
approximated. Getting this wrong silently shifts every deadline.

## 2.10 The regulators, and what each one wants

You do not need to read the regulations. You do need to recognise the names, because the
requirements cite them.

| Short name | Full name | What it governs, in one line |
|---|---|---|
| **TRID** | TILA-RESPA Integrated Disclosure | The LE and CD, and their timing. The big one. |
| **Reg Z** | Truth in Lending Act | Cost of credit, advertising, the disclaimer on estimates |
| **RESPA** | Real Estate Settlement Procedures Act | Settlement costs, and **§8**: no paying for referrals |
| **ECOA / Reg B** | Equal Credit Opportunity Act | No discrimination; adverse-action notices; appraisal delivery |
| **HMDA / Reg C** | Home Mortgage Disclosure Act | Collecting demographic data for government monitoring |
| **FCRA** | Fair Credit Reporting Act | Credit pulls need permissible purpose and consent |
| **HPPA** | Homebuyers Privacy Protection Act (effective **4 March 2026**) | Bans reselling a mortgage credit inquiry as a "trigger lead" unless a **two-part** test is met |
| **TCPA** | Telephone Consumer Protection Act | Texting and calling consent, quiet hours, opt-out |
| **CAN-SPAM** | — | Commercial email: postal address, working unsubscribe |
| **E-SIGN / UETA** | — | What makes an electronic signature legally count |
| **GLBA** | Gramm-Leach-Bliley Act | Safeguarding customer financial data; MFA and encryption |
| **SAFE Act** | — | **Only a licensed loan originator may take an application or offer/negotiate terms.** This is why the AI assistant may never quote a rate. |
| **UDAAP** | — | No unfair, deceptive or abusive practices. Governs tone and honesty, not just legality. |

⚠️ **Standing caveat.** This document is a product specification, not legal advice. Every control
described here is reviewed and signed off by CLEAR's compliance counsel before launch. Where
counsel's decision is still outstanding, §11 says so explicitly rather than guessing.

## 2.11 Vocabulary you will meet in the code

| Term | Meaning |
|---|---|
| **GSE** | Government-Sponsored Enterprise — Fannie Mae and Freddie Mac |
| **AUS** | Automated Underwriting System — DU or LPA |
| **DU / LPA** | Fannie's and Freddie's AUS |
| **MISMO** | The XML data standard for mortgage data |
| **MERS** | Mortgage Electronic Registration Systems — the national registry tracking who owns a loan; every loan gets a **MIN** number |
| **PPE** | Product & Pricing Engine — the system that returns real rates |
| **VOA / VOI / VOE** | Verification of Assets / Income / Employment |
| **RON** | Remote Online Notarization — closing by video. Legal in 49 states + DC. |
| **eNote** | An electronic promissory note, registered on the MERS eRegistry |
| **COC** | Change of Circumstance — a valid reason to re-issue a Loan Estimate |
| **ITP** | Intent to Proceed |
| **NMLS** | The national licensing registry. Every LO has an NMLS number that must be displayed. |
| **LE / CD** | Loan Estimate / Closing Disclosure |
| **CTC** | Clear to Close |
| **ICD** | Initial Closing Disclosure |
| **NOIA** | Notice of Incomplete Application |

---

# 3 · Business context and the operating model

## 3.1 The problem being solved

The work in a mortgage back office is inflated far beyond the loan itself by three things: **re-keying**
the same value into several systems, **portal-hopping** between a dozen external websites, and
**manual tracking** in spreadsheets that live beside the system rather than in it.

⭐ **The design intent is that growth is absorbed by removing touches, not by adding people.**

| Load today | Where it goes |
|---|---|
| A manual post-close spreadsheet and "twenty different buckets" of documents | The post-close screen and the document engine (§6 PC, DC) |
| Portal-hopping — FHA Connection, the GSE UCD portal, MERS, investor portals | In-system integrations (§10) |
| Re-keying between the LOS and the document vendor | True field and program sync (IN-03) |
| **20–25 minutes** per title-fee update | Templates and type-to-fill (FE-09, FE-11) |
| Manually built conditions | Enhanced Conditions fired from file attributes (§6 AC) |
| Manually tracked incompleteness notices and insuring aging | Clock-generated tasks (TK-05) |

⚠️ **The honest caveat, stated because it changes how you should build.** Every one of those
substitutions is software that has to be *right*. **Automation that is 90% right in operations does
not save 90% of the time — it saves much less, because now somebody has to check it.** That is why
every requirement group in §6 carries a "done = testable" statement, and why the acceptance script
(MAINT-07) is part of the deliverable rather than an afterthought.

## 3.2 ⭐ The roster, as the shop actually runs

This is not an org chart. These are the real seats, and getting them wrong reshapes screens.

| Role | Owns which milestones | Lives in | What matters |
|---|---|---|---|
| **Loan Officer** | Application Taken → Initial Disclosures Sent | LO Portal / POS | Originates. **Orders credit at pre-approval.** Sends initial disclosures and revised Loan Estimates. Leads and sales pipeline never clutter the LOS. |
| **Loan Officer Assistant** | — | LO Portal / POS | Sales-side support. Not an operations role. |
| **Processor** | Processing → Initial Submission → Resubmission | LOS | ⭐ **Reviews** the credit the LO ordered — **does not re-order it.** Orders appraisal, title, flood, VOE, 4506-C. Runs AUS. Clears conditions. Requests the Initial Closing Disclosure from the closer. |
| **Processing Manager** | — | LOS | Runs the processors; assigns work; covers gaps. |
| **Underwriter** | Approved / Suspended → Clear to Close | LOS | Assess, decide, condition, clear. Government panels appear when the loan type requires them. E-signs underwriting documents in-system. |
| **Closer / Funder** | Clear to Close → Docs Out → Funded | LOS | ⭐ **One seat, one person.** Balances the file, issues closing documents — the 2015 fee itemisation, aggregate escrow, vesting, exhibit/legal, the ICD — then the funding worksheet and the net wire. **Her only MERS involvement is confirming the MIN printed on the Deed of Trust.** |
| **Post-Closer** | Post Closing → Purchased | LOS | Insuring by program, document packaging, Investor Connect, **the entire MERS lifecycle**, the UCD, trailing documents, the post-close issue log. **Also backup closer/funder.** |
| **Secondary / Lock Desk** | Parallel: lock → commit → sell | LOS | Locks tied to the pricing engine at the correct plan code; commitments; best execution; delivery. |
| **Manager** | Oversight, no milestone | LOS | Scope-dependent views (branch / regional / national); dual pipeline views; touch counts; reporting. |
| **Admin** | Configuration | LOS | RBAC, business rules, fee templates, conditions, custom fields and forms, licences, investors, plan codes. |

⭐ **Three corrections that reshape screens if you get them wrong:**

1. **The loan officer orders credit, in the POS, at pre-approval.** Not the processor. A processing
   screen with an "order credit" button as its primary action is modelled on the wrong shop.
2. **Closer and funder are one seat, not two roles with a handoff.** That screen carries the
   balance-then-issue-then-fund arc without pretending somebody else picks it up.
3. **The post-closer owns the UCD, not the closer.** The natural-looking assignment is the wrong one.

## 3.3 ⭐ The milestone spine

This is canonical and its order is verbatim from the Director of Operations.

> **Application Taken (Initial Disclosures Sent) → Processing → Initial Submission → Approved /
> Suspended → Resubmitted / Condition Submission → Clear to Close → Docs Out (Sent) → Closed →
> Funded → Post Closing → Purchased**

**Withdrawn** and **Denied** are **first-class milestones, not error states.** Each is wired to its
own process.

Every milestone carries three things: **an owner**, **a gate that must pass before advancing**, and
**the task set it fires on entry.**

⭐ **"Closed" and "Funded" are separate on purpose.** On a refinance of a primary residence a
three-day rescission period sits between them. **Systems that collapse the two print wrong dates on
exactly the loans where dates matter most.**

## 3.4 ⭐ Backup coverage is a first-class requirement

Closing/funding and post-closing are **two people**, each with a designated backup, and the
Director of Operations backs up both. That is a concentration risk the software must **absorb**
rather than ignore.

What it means in the build:

- Every role screen is legible to a trained person who **did not build the file**.
- Task ownership is reassignable in one action, with the reason recorded.
- Requests between roles carry **who asked, for what, by when** — so a stand-in can answer them.
- The mobile companion is designed for **the covering person's day**, not for a generic phone user.
- ⭐ **Acceptance test:** hand a colleague a file mid-stage with no verbal briefing, and have them
  identify the next three actions **from the screen alone.**

## 3.5 Success measures

| Metric | Why | Target |
|---|---|---|
| ⭐ **Touches per loan** | The direct measure of whether the system removed work or moved it | Reduce against the current baseline |
| **Cycle time by stage** | Where files actually sit | Reduce; expose the bottleneck |
| **Pull-through** | Started → funded | Establish, then improve |
| **Cost to manufacture** | The dollar case | Beat the current baseline |
| ⭐ **Title-fee update time** | The stopwatch requirement (FE-11) | **20–25 min today → 5–10 min** |
| **Compliance gate pass rate and override count** | A gate that is always overridden is not a gate | Overrides reported weekly |
| **Files funded >X days without insuring** | The classic post-close leak | Zero aged beyond the agency clock |
| **Backup cold-start test** | §3.4 | Next three actions identified from the screen alone |

## 3.6 The competitive bar

The LOS is measured against **Encompass**, **Blue Sage**, **LendingPad**, **Byte** and
**MeridianLink**. On the compliance engine specifically the position is deliberately modest:
**match the market leader, do not try to beat it.** That is the audit and saleability floor and
there is no prize for novelty in it.

The differentiators are elsewhere: the document engine, the built-in worksheet library, Investor
Connect, the MERS lifecycle, the change-of-circumstance engine, and — most of all — **the seam**
with the POS, which no competitor has because no competitor owns both halves.

---

# 4 · Roles, capabilities, scope and coverage

⚠️ **Build this section before you build a screen.** Everything in §5 and §6 sits on top of it. A
screen that looks right on a wrong permission model is the most expensive kind of wrong.

## 4.1 The identity model — a person is not a role is not a scope

Three separate ideas that systems routinely collapse into one, and that collapse is where
permission bugs come from.

| Concept | What it is | Example |
|---|---|---|
| **Person** | A human being with a login | Toni |
| **Role** | What kind of work they do | Closer |
| **Scope** | Which files they may see | Branch · Region · National · Own |

A person may hold **more than one role** (a Closer who also covers as a Funder). A role does not
imply a scope — two processors can hold the same role and see different files. **A capability check
answers "may this act happen?"; a scope check answers "on this file?"** Both run, always, and both
run on the server.

## 4.2 The eleven roles

| Role | May be assigned a file | Summary |
|---|---|---|
| Loan Officer | ✅ | Originates; orders credit; runs AUS; requests locks |
| Loan Officer Assistant | ✅ | Sales-side support; runs AUS; no term-setting |
| Processor | ✅ | Reviews credit, orders services, builds the file, clears conditions |
| Processing Manager | ✅ | Processor capabilities plus assignment and channel |
| Underwriter | ✅ | The only role that decides; signs underwriting documents |
| Closer | ✅ | Fees, escrow, vesting, exhibits, the ICD, closing documents |
| Funder | ✅ | **The only role that releases a wire** |
| Post-Closer | ✅ | Insuring, MERS, UCD, investor delivery, trailing documents |
| Secondary / Lock Desk | ✅ | **The only role that confirms a lock** |
| Manager | ⛔ | Oversight, override, cross-branch visibility |
| Admin | ⛔ | Configuration |

⭐ **Manager and Admin are deliberately not assignable to a file.** They are **authorities over the
shop, not a desk a loan sits on.** Putting them in the assignment picker invites a file to be parked
on somebody whose job is to oversee it, and a file parked on an overseer is a file nobody is working.

## 4.3 The capability registry — 31 capabilities

Permissions are **capabilities, not roles**. A route checks `may(seat, 'release-wire')`, never
`seat.role === 'Funder'`. This is what makes coverage, delegation and multi-hat seats possible
without rewriting authorisation logic every time the shop changes.

| Capability | Held by |
|---|---|
| `order-credit` | Loan Officer |
| `review-credit` | Processor · Processing Manager · Underwriter |
| `order-services` | Processor · Processing Manager |
| `run-aus` | Loan Officer · LOA · Processor · Processing Manager · Underwriter |
| `decision` | Underwriter |
| `sign-uw` | Underwriter |
| `govt-file` | Processor · Processing Manager · Underwriter |
| `enter-fees` | Closer · Post-Closer · Admin |
| `fee-templates` | Admin |
| `issue-docs` | Closer · Post-Closer |
| `release-wire` | **Funder** |
| `mers` | Post-Closer |
| `ucd` | Post-Closer |
| `insuring` | Post-Closer · Funder |
| `investor-deliver` | Post-Closer · Manager |
| `lock-request` | Loan Officer · LOA · Secondary/Lock Desk · Manager · Admin |
| `lock-confirm` | **Secondary / Lock Desk** · Manager · Admin |
| `vesting` | LO · LOA · Processor · Processing Manager · Closer · Manager · Admin |
| `record-consent` | LO · LOA · Processor · Processing Manager · Manager · Admin |
| `clear-docs` | LO · LOA · Processor · Processing Manager · Underwriter · Manager · Admin |
| `file-docs` | LO · LOA · Processor · Processing Manager · Manager · Admin |
| `edit-1003` | LO · LOA · Processor · Processing Manager · Underwriter · Manager · Admin |
| `partner-write` | LO · Assistant · Processor · Manager · Admin |
| `advance` | Every operating role · Manager · Admin |
| `assign-team` | Admin · Manager · Processing Manager |
| `set-channel` | Processing Manager · Secondary · Manager · Admin |
| `lead-book` | LO · LOA · Manager · Admin |
| `view-all` | Manager · Processing Manager · Admin · Secondary · Processor · Underwriter · Closer · Funder · Post-Closer |
| `override-gate` | Manager · Admin |
| `configure` | Admin |
| `cross-surface` | Admin |

## 4.4 ⭐⭐ Deliberate separations — do not "simplify" these

Each of these looks like friction and is a control. Every one exists so that **no single person
owns a whole risk.** If a future requirement asks you to merge two of them, that is a decision for
CLEAR's compliance function, not a refactor.

| Separation | Why it exists |
|---|---|
| ⭐ **`order-credit` (LO) vs `review-credit` (Processor, PM, Underwriter — ⛔ not the LO)** | A shop where the person who orders the report also clears it has **no second pair of eyes on the one document the whole decision rests on.** |
| ⭐ **`decision` vs `sign-uw`** (both Underwriter) | **Deciding and signing are two acts.** The signature is what makes the decision a record. |
| ⭐ **`release-wire` (Funder only)** | The wire is the **highest-consequence act in the system**. An Admin who needs it uses `override-gate` and leaves a record. |
| ⭐ **`enter-fees` vs `fee-templates`** | An Admin may change the templates behind the fee sheet and the sheet on a file, but reaches anything else through a logged override. A blanket super-admin is exactly the cosmetic-permissions failure this model exists to prevent. |
| ⭐ **`mers` and `ucd` are separate, both Post-Closer** | The Closer **confirms the MIN prints on the Deed of Trust and stops there.** The Post-Closer owns the whole MERS lifecycle *and* the UCD. Registering a lien and filing a dataset are different acts. |
| ⭐ **`investor-deliver` separate from `mers` and `ucd`** | Delivering a closed loan to the party that buys it is a different act from registering a lien. The seat that delivers answers for the delivery. **The Manager holds it too, because a post-closer out for a week cannot mean a shop that cannot sell loans.** |
| ⭐ **`govt-file` (Processor, PM, Underwriter — ⛔ not the LO)** | The FHA case number, CAIVRS/LDP/GSA results, the VA Certificate of Eligibility and the USDA determination are ordered and recorded by the processor and read by the underwriter. **The seat that wants the loan approved does not get to type the eligibility result that approves it.** |
| ⭐ **`lock-request` vs `lock-confirm`** | Anyone may ask. **Only the lock desk makes a lock real.** |
| ⭐ **`partner-write` excludes Underwriting** | An underwriter talking directly to the buyer's agent about a file she is deciding is a conversation that should go through the loan officer. |

**And one deliberate widening, for the same kind of reason:**

⭐ **`run-aus` includes the Loan Officer and the LOA.** A loan officer who cannot run automated
underwriting is handing the processor a file that nobody has established is approvable — which is
the opposite of what the handoff is for. This is not a convenience widening; it is what makes the
handoff mean something.

**And one deliberate backup:** `insuring` includes the **Funder**, because a file that funds late on
a Friday gets its first trailing documents logged by the desk that funded it. That is coverage, not
a claim that closing owns insuring.

## 4.5 Data visibility — who sees which files

Scope is separate from capability (§4.1). A capability says *what act*; scope says *on which files*.

| Scope | Sees |
|---|---|
| **Own** | Files where this seat is on the assignment set |
| **Branch** | Every file in their branch |
| **Regional** | Every file across their branches |
| **National** | Every file in the tenant |

⛔ **Scope never crosses a tenant.** Tenant isolation is enforced at the data layer, not by a
`WHERE` clause a developer must remember (§7 SEC-10).

⚠️ **The branch and region groupings in the reference build are placeholders.** There is no
authoritative branch list in the source material and **no NMLS branch IDs are recorded.** This must
be replaced with CLEAR's real org chart before build. See §11 D4.

## 4.6 ⭐ Coverage — the thing a permanent permission map cannot express

A role × capability matrix describes the shop on a normal day. **It cannot describe Tuesday**, when
the closer is out and somebody has to issue documents anyway.

Coverage is therefore a **first-class, configured, time-bounded fact**, not an informal
arrangement and not a permanent permission widening:

- A seat may be designated to **cover** another seat, for a stated period.
- Coverage grants the covered seat's capabilities **for that period only**, and expires on its own.
- **Every act taken under coverage is stamped as such** — actor, covered-for, reason, time. An
  examiner asking "why did a Post-Closer issue closing documents on 14 March?" gets an answer.
- Coverage is **visible on the file**, so the borrower's next question does not go to somebody on
  holiday.

⭐ **This is why the Post-Closer permanently carries the closing capabilities** (`issue-docs`,
`enter-fees`, `insuring`). That is not coverage — it is a **configured fact** about how this shop
runs, because the post-closer *is* the designated backup closer/funder. Coverage handles the rest.

## 4.7 The escalation ladder

When a seat cannot act, the software must say **who can** — a refusal that only says "no" teaches
people to route around the system.

```
   Operating seat  ──cannot act──▶  names the capability required
                                    and the seat that holds it
                          │
                          ▼
              Processing Manager / Secondary
                          │
                          ▼
                       Manager  ──── override-gate, typed reason, logged
                          │
                          ▼
                        Admin   ──── configure; cross-surface
```

⭐ **Every override is role-restricted, requires a typed reason, and is reported to compliance
weekly.** A gate nobody can pass in an emergency gets worked around. A gate that records **who
passed it and why** gets respected.

## 4.8 The handoff ladder — who may move a file, and where

`advance` is held broadly, but it is **not** permission to move a file anywhere. A seat may advance
a file only into the stage its own role owns or hands off to (§3.2, §3.3). The compliance gate
(§6 CO-02) runs on every advance regardless of who requested it, and blocks on failure.

**Done = testable:** a Processor attempting to move a file from Processing directly to Clear to
Close is refused, told which seat owns that transition, and no state changes.

---

# 5 · The manufacturing line and the screen inventory

## 5.1 ⭐⭐ The two-screen pattern — every role has exactly two

This is the single most important interaction rule in the LOS, and it is what keeps the whole system
from becoming a widget wall.

| | **The landing screen** | **The in-file screen** |
|---|---|---|
| Scope | Every file you touch | This one loan |
| Opens on | ⭐ **Your task command centre** — never a file list | ⭐ **The Loan Summary** — never a blank form |
| Answers | *What do I do next?* | *What is going on with this one?* |
| Carries | Saved views on the left rail; sortable and filterable on any field | Section navigation on the left; that file's task panel on the right |
| Example | *"ICD not sent and closing ≤ 7 days"* → 4 files | Alvarez #100482 → tiles, custom fields, quick links |

⭐ **Clicking a task lands you inside that file at the right tab** — not at its front door. That
single behaviour is most of the felt difference between a system that runs the day and one you have
to drive.

**Why two and not three:** a third "dashboard" layer is where widget walls come from, and nobody
works from them. The cross-file view is a task list; the single-file view is the Loan Summary; there
is no third thing.

**Done = testable:** sign in as any operations role → land on tasks, not files. Click a task →
arrive in the file **at the tab that task concerns**. Open a file directly → arrive at the Loan
Summary.

## 5.2 ⭐ The navigation model inside a file

**One screen at a time, reached from the left rail.** The rail is the file's anatomy, and it stays
visible the entire time a seat is in the file.

⛔ **Do not build the loan file as one long scrolling page with every section stacked on it.** This
is an explicit correction from the subject-matter expert against the current reference build, and
the reasoning is operational rather than aesthetic:

> *"Once we are in a file, we should be able to use the left-hand menu screens to work through the
> file — one screen at a time. Scrolling to one section and then back up is not efficient. I don't
> want the processor, UW or closer to click on one of the screens and then leave this view — they
> should be able to move between screens easily."*

**The requirements this produces:**

1. Each left-rail entry is **its own screen**, not an anchor into a long page.
2. Moving between rail entries **keeps the rail** — a seat never has to navigate "back" to reach the
   next section.
3. The rail order matches the order the file is actually worked (§5.3), not the order the sections
   were built.
4. Nothing appears in two places. If a panel belongs on the Loan Summary it does not also live on
   the rail, and vice versa.

⚠️ This is tracked as an open correction in §11 because the rail ordering and the final placement of
two specific panels are still being settled with the subject-matter expert.

## 5.3 The line, station by station

```
 ①  INTAKE                                                            /los/intake
     A POS application becomes a loan file. The handoff is reconciled against the POS
     right now, and each field's owner is named. ⭐ The adapter boundary lives here, so
     the POS can be replaced without touching the LOS.
        │
 ②  SET IT UP                          /los/loan · /los/app · /los/credit · /los/vesting
     The Loan Summary is the story of the file. If it is wrong here, the disclosures go
     out wrong and the whole loan is affected. Credit is REVIEWED here — it was ORDERED
     in the POS by the loan officer.
        │
 ③  DISCLOSE                       /los/disclosures · /los/counseling · /los/fees · /los/coc
     ⛔ COMPLIANCE GATE #1 — blocking. The six-piece application test, the three-business-day
     Loan Estimate deadline, intent to proceed, the consent ledger, the counselling list.
        │
 ④  WORK IT              /los/orders · /los/income · /los/aus · /los/needslist · /los/conditions
     Order title, flood, VOE, 4506-C and the appraisal. Show the income arithmetic. Run
     AUS and log every run. Chase what is owed.
        │
 ⑤  SUBMIT                                                           /los/submitgate
     The required gate before underwriting, plus a touch count. "Submit" is never a guess.
        │
 ⑥  UNDERWRITE                                    /los/uw · /los/govt · /los/atrqm · /los/tbd
     ⛔ COMPLIANCE GATE #2 — blocking, notably before Clear to Close.
     The largest screen in the build. Approve · Suspend · Deny.
        │                                                    └──▶ /los/adverse  (ECOA)
        │
 ⑦  PRICE & LOCK                              /los/lock · /los/secondary · /los/buydown
     Requesting and confirming a lock are different capabilities on purpose.
        │
 ⑧  CLOSE                /los/cd · /los/escrow · /los/exhibits · /los/closing · /los/forms
     ⛔ COMPLIANCE GATE #3 — blocking. Closing documents cannot issue until it clears.
        │
 ⑨  FUND                                              /los/funding · /los/wire
     ⭐ The highest-consequence act in the system. Prior-to-funding conditions gate the release.
        │
 ⑩  POST-CLOSE                        /los/postclose · /los/packaging · /los/pcissues
     Insuring, MERS, the UCD round trip, Investor Connect, trailing documents.
        │
 ⑪  PURCHASED
     The loan is sold. MERS transfer → goodbye letter → payoff → finalise.
```

## 5.4 The screen inventory — 53 screens, built and live

### 5.4.1 The desk — where a seat lands

| Path | What it is for |
|---|---|
| `/los/` | The landing screen for every seat. Two things stacked: the **task list — which IS the working day**, grouped the way that seat groups it — and the pipeline of files that seat may see. Everything else is reached from here or from a file. |
| `/los/queue` | The same day reduced to one column of "what do I do next". Fed by the Life of a Loan engine rather than the task table, so the order is **the order the closing date demands**, not the order things were created. |
| `/los/tasks` | The task board: create, assign, and see every task on a file. The editing surface the desk deliberately does not carry. |
| `/los/mobile` | The phone companion. ⭐ Deliberately **not** the LOS — four read-mostly panels (your desk, files, alerts, who you are covering). Every real work screen redirects a phone to `/los/desktop-only`. |

### 5.4.2 The loan file — one loan, in the order it is worked

| Path | What it is for |
|---|---|
| `/los/loan` | ⭐⭐ **The single most important screen in the build.** Everything known about one loan: assignments, contacts, dates, notes, custom fields, the document folder, the audit of every field change, the compliance gate the file is standing at, the conditions it is waiting on, and the Life of a Loan card. Every other file screen is reached from its left rail. |
| `/los/timeline` | **Life of a Loan.** The closing date is an object with dependencies, not a text field: the backward plan from that date, what is holding it, who has the ball, and what happens if the date moves. The only screen that can answer *"will we actually close on the 14th?"* |
| `/los/app` | The 1003 / URLA itself, section by section, with an audit of every correction and who made it. **Reading it is every operations seat's job; the acts on it are server-refused** unless the seat holds `edit-1003`. |
| `/los/intake` | Where a POS application becomes a loan file. Shows the handoff that arrived, reconciles the two halves **right now**, and names which side owns which field. |
| `/los/credit` | Who may order credit, the consent that must exist first, the report on file, and the review. ⭐ **Ordering is the LO's act; reviewing is the Processor's — the server enforces the split.** |
| `/los/income` | Income and liabilities, **showing its work**: employers, each income source with the arithmetic visible, monthly obligations, and the DTI those produce. **A number a processor cannot defend is a number this screen will not print alone.** |
| `/los/aus` | Run findings, log every run, mark which run is operative, file an external certificate. States **what changed since the last run** — the question an underwriter actually asks. |
| `/los/orders` | Service orders: title, flood, VOE, 4506-C, appraisal. The Processor orders; **every seat can read the status**, because the LO is the one the borrower asks *"has title been ordered yet?"* |
| `/los/appraisal` | Appraisal and ECOA valuations: the right-to-receive notice, a log of **every** valuation (not just the appraisal), and the three-business-day waiver. |
| `/los/conditions` | PTA, PTD, PTF, plus title, appraisal and insurance conditions. Condition sets built once and applied in one action. ⭐ **A condition is an ADDRESS** — `/los/loan?id=X#need-bank2` lands on the row and rings it. |
| `/los/needslist` | The needs list and document inbox in one view: whose turn it is, what is owed, what is out for signature, who has been chased and when. **The screen that answers "why is this file quiet?"** |
| `/los/submitgate` | The required gate before underwriting, the advisory services that ought to be ordered, and a touch count. |
| `/los/uw` | ⭐ **The underwriting workstation — the largest screen in the build.** At-a-glance, key 1003 fields, AUS findings, income sources and the underwriter's own income decision, assets, appraisal, conditions, the decision, the e-signature of underwriting documents, the decision log, and the FHA / VA / USDA panels. Gated on `decision`. |
| `/los/govt` | FHA case numbers, CAIVRS / LDP / GSA, the VA COE, the USDA determination. **Reading is open to every seat** because the LO fields *"did my case number come back?"*; **filing is refused** without `govt-file`. |
| `/los/tbd` | TBD approval — approving a borrower before there is a property. Runs the three-day clock, **states plainly what the approval did NOT test**, lists the six pieces, and surfaces known disagreement rather than hiding it. |
| `/los/atrqm` | The ATR/QM path and the employee-loan check: safe harbour or rebuttable presumption, decision attempts recorded, and the HMDA record it feeds. **Reviewer-independence applies — a person cannot clear their own file.** |
| `/los/lock` | Rate lock on one file: request, confirm, asked-vs-confirmed, extensions and their cost, full lock history. |
| `/los/fees` | ⭐ Fee itemisation and the tolerance engine — §1026.19(e)(3) baselines, §1026.4 classification, the VA fee check, and an activity log stamping every change. Gated on `enter-fees`; an override is its own capability. |
| `/los/disclosures` | Initial disclosures: the application trigger, the six-piece test, the three-business-day deadline, re-disclosure, intent to proceed, and the consent ledger showing which of the four consents exist and what each permits. |
| `/los/cd` | The Closing Disclosure: summary, the LE-vs-CD tolerance check, the comparison, the rescission window on a refinance, and a CD event timeline. Gated on `issue-docs`. |
| `/los/coc` | ⭐ Changed circumstance: the COC log, recording a new one, the waiting-period tracker, and the tolerance structure a COC actually resets. **This is the screen a TRID examination opens first.** |
| `/los/escrow` | The RESPA §1024.17 escrow analysis: inputs, aggregate summary, the twelve-month disbursement schedule, the low-point cushion, a new-construction tax projection, and the CD page-2 preview the borrower will actually see. |
| `/los/exhibits` | Which security instrument by state, which riders this file triggers, manufactured-home affixation, what is open. **States clearly that it does not draft documents.** |
| `/los/vesting` | How title will be held, and **vesting history** — because vesting changes late and quietly. |
| `/los/closing` | The milestone timeline, the clear-to-close gate, the appointment tracker, final fee reconciliation, cash-to-close verification, the disbursement worksheet and net wire, and post-signing actions. |
| `/los/funding` | The funding worksheet and standard fee schedule: prefill from templates, second liens and down-payment assistance, the net wire, and an override log recording **who changed what, from what, to what**. |
| `/los/wire` | ⭐ Settlement and closing wire instructions, with the **wire-fraud warning first, because that is the order a human should read it in.** Gated on `release-wire`. |
| `/los/postclose` | Insuring, MERS, the UCD round trip, Investor Connect, the collateral stacking order, packages by label, what the Purchased event fired, and a stamped activity log. |
| `/los/packaging` | Assemble documents **by label** into a package, track e-signed returns, keep manifests. **Explicitly does not sign, send or transmit anything.** |
| `/los/pcissues` | Every defect found after closing, logged by step, seat and category — so recurring ones become training topics. ⭐ **It says out loud what these numbers are NOT, because a defect count read as a scoreboard is how you teach people to stop logging defects.** |
| `/los/adverse` | Adverse action and ECOA: three outcomes with three different obligations, the counteroffer clock, the notice of incompleteness, the notice with reason codes and delivery tracing, and the decision history. Gated on `decision`. |
| `/los/hmda` | HMDA collection under Regulation C, through to a LAR export preview. |
| `/los/counseling` | The HUD counselling list required by RESPA §1024.20 — generated for this file's location, with delivery logged. |
| `/los/preapproval` | ⭐ **A letter is a FROZEN COPY, not a live view** — changing the loan amount afterwards does not change an issued letter. Shows what the referral partner is authorised to issue, what the file has actually earned, and — when there is no letter — **why not**. |
| `/los/buydown` | The buydown calculator: parameters, side-by-side comparison, year-by-year schedule, escrow and cost breakdown, break-even. Open to every seat; **it computes, it does not commit.** |
| `/los/forms` | The standard form library, filtered to the forms that apply to this file. The API **refuses a form that does not apply, a blank required field, and the CD** (which `/los/cd` owns). |
| `/los/worksheets` | The worksheet and form library — all eight. ⭐ It also carries **a claim the page had to withdraw, kept visible rather than deleted.** |
| `/los/portals` | Exactly what goes to FHA Connection, the VA portal and the investor for **this** file. ⭐ **It is a packing list, not a connection — nothing is transmitted.** |

### 5.4.3 Shop-wide, oversight and the control plane

| Path | What it is for |
|---|---|
| `/los/secondary` | The lock pipeline, live position and expiry alerts **across every file in the shop**, best execution, commitments, the fallout tracker, the delivery checklist. Gated on `lock-confirm`. |
| `/los/manager` | Pipeline snapshot, pull-through, cycle time, channel mix, conversion funnel, by branch, by loan officer, aging detail, suspended files, compliance-gate distribution. Gated on `view-all`. |
| `/los/qc` | Quality control: why the module exists, **ENFORCED reviewer independence — not promised, enforced**, queues built from the live pipeline, the sampling plan, findings and corrective action, and an honest ordered list of what it still needs. |
| `/los/audit` | The system activity log — every event, every actor, every file. Manager and Admin only. |
| `/los/admin` | ⭐ The control plane. Twelve tabs: users and roles, fee templates, the condition library, condition sets, custom fields, coverage and escalation, plan codes, investors, automation rules, audit and compliance settings, referral partners, and the live surface list of every user face in the product. Gated on `configure`. |
| `/los/seats` | The roster: every seat and what each role may do. **Admin only** — this was open to a Processor until it was closed by explicit decision. |
| `/los/permissions` | Who can do what, person by person: what they can do, where they can go, **what they cannot do and who to ask instead**, plus what the borrower and referral partner may do without a CLEAR seat. Admin only. |
| `/los/settings` | A person's own seat record: profile, password, **which hats are on today**, how their task list groups, saved views, open files. Shows nobody else's anything. |

### 5.4.4 Wayfinding and refusal

| Path | What it is for |
|---|---|
| `/los/map` | Every built screen on both sides of the product, one click each. The review index, and how a tester reaches a screen with no rail row yet. |
| `/los/denied` | ⭐ **The refusal screen is a user face too**, and for some seats it is the only screen they will ever see on a gated path. It **names the capability they lack and who holds it**, rather than saying no. It carries **no gate of its own** — a gated denial page bounces to itself forever. |
| `/los/desktop-only` | An interstitial, not a destination: what a phone gets when it opens a desk screen. Declared a non-surface on purpose. |

## 5.5 What every LOS screen carries

Consistent chrome, so a covering seat is never lost (§3.4):

- **The file-detail band** — identical across every role. This is the backup's first read.
- **The left rail** — the file's anatomy, always visible while in a file.
- **The task panel for this file**, in the right rail, labelled plainly **Tasks (this file)**.
- **The compliance gate the file is standing at**, and what is blocking it.
- **Who the file is assigned to**, and who is covering.

---

# 6 · Functional requirements

## 6.0 How to read this section

There are **278 numbered functional requirements** in nineteen groups. Every one has an ID, a tier,
a type, and — for the ones where a reasonable engineer would build the wrong thing — an expanded
specification after its group's table.

**The IDs are stable and permanent.** `CO-06` means the same thing forever. They are the IDs already
used in the reference build and every prior conversation with CLEAR, carried forward unchanged
rather than renumbered. Where you need to be unambiguous across documents, write `LOS-CO-06`.

| Column | Meaning |
|---|---|
| **Tier** | **DEMO** — needed for the controlled demonstration. **PILOT** — needed for the first supervised real loan. **PROD** — needed to fully replace the current system. |
| **Type** | **Required** — the floor. **Desired** — the moat, not the floor. |
| **Done = testable** | Each group closes with the test that proves it. |

**Tier is a sequencing instruction, not a quality one.** A PROD-tier requirement is not optional; it
is not needed to fund the first loan. Build DEMO, then PILOT, then PROD, and do not let a PROD item
be quietly reclassified because it is hard.

| Group | Count | Tier spread |
|---|---|---|
| Data model and foundations | 10 | 1 DEMO · 2 PILOT · 7 PROD |
| Task engine | 12 | 5 DEMO · 6 PILOT · 1 PROD |
| Document engine | 9 | 1 DEMO · 3 PILOT · 5 PROD |
| ⭐ Compliance engine and gates | 25 | 13 PILOT · 12 PROD |
| QC / QA | 9 | 9 PROD |
| Origination, processing and conditions | 17 | — |
| Underwriting (incl. government) | 17 | — |
| Fees, closing and funding | 28 | — |
| Post-close, insuring and secondary | 21 | — |
| Worksheets and forms | 12 | 12 PROD |
| eClose / eNote / RON | 7 | 7 PROD |
| Controls the operations notes did not name | 10 | — |
| Admin, RBAC, pipeline and reporting | 21 | — |
| Integrations | 14 | — |
| AI | 12 | — |
| Commercialisation | 8 | 8 PROD |
| ⭐ The seam | 12 | — |
| Mobile companion | 9 | — |
| Loan-officer enablement, Loan Summary, CD | 25 | — |
| **Total** | **278** | **13 DEMO · 99 PILOT · 166 PROD** · 254 required, 24 desired |

---

## 6.1 The four engines

Four systems everything else stands on. **Build these right and every screen in §5 gets easier;
build them wrong and no amount of screen design rescues the product.**

---

## 6.2 Group DM — The one data model

**What this is.** One loan object is the single source of truth. Every screen is a view onto it. A
value entered at its source **flows outward and is never re-typed.**

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **DM-01** | Progressive 1003 / URLA (236 fields) fed from the POS — **no re-key** | DEMO | required |
| **DM-02** | ⭐ Copy a file from an existing loan **without** carrying AUS findings, MERS/MIN or the property address | PROD | required |
| **DM-03** | New-construction property-tax projection by state | PROD | required |
| **DM-04** | Area Median Income auto-pull on property entry, for program eligibility | PROD | required |
| **DM-05** | ⭐ USPS address verification — **warn, do not stop** | PILOT | required |
| **DM-06** | ⭐ `LinkedLoan` — a true second lien with **its own loan number**, linked to the first | PROD | required |
| **DM-07** | Representative credit-score logic, **program-configurable** | PILOT | required |
| **DM-08** | Pre-AUS data validations — required fields complete, construction type set, property type correct | PILOT | required |
| **DM-09** | `QCReview` as a first-class object on the loan, not a spreadsheet beside it | PROD | required |
| **DM-10** | Field-level lineage — every value knows its source | PROD | desired |

### ⭐ The mapping chains — these are the contract

Each row is a testable claim, not a description.

| Entered once | Mapped everywhere, with no re-key |
|---|---|
| **Property address** (POS) | USPS verify → appraisal order → title order → flood → CD → legal/exhibit → Deed of Trust → MERS. **Change it once; every one updates.** |
| **Income** (documents / VOE) | Income calculation → 1003 → AUS → DTI → conditions → CD affordability. One number, one source. |
| **Program + plan code** | Pricing → AUS → document set → fee sheet → disclosures. ⚠️ **This is the chain that is broken in the current system and it is what produces wrong Initial Closing Disclosures.** |
| **Fees** (the 2015 itemisation) | LE → ICD → CD → closing documents → funding worksheet. Each fee carries its LE section, CD section, tolerance bucket and finance-charge flag. |
| **Vesting and closing flags** | Conditions → document riders → the deed and security instrument. |

### ⭐ DM-06 — why `LinkedLoan` is a first-class object

A down-payment-assistance or piggyback second that needs its own TRID document set **is not a
credit line on the 1003.** The current system can create a standalone second but cannot link it,
and the result is a second lien that is **invisible on the funding screen**. Own object, own loan
number, own disclosures, linked to the first, **and it populates the funding worksheet** (FU-03).

### ⭐ DM-05 / DM-02 / DM-03 — three small rules with real consequences

- **USPS verification warns, never stops.** New construction frequently is not listed yet. A hard
  stop blocks disclosures on legitimate files.
- **Copy-a-file must know what must *not* travel.** The obvious implementation copies everything;
  the useful one refuses to carry AUS findings, the MERS number, and the property address.
- **New-construction taxes must project land *plus* the built structure.** The current-year
  assessment is land only. Getting this wrong understates the payment on exactly the loans where
  the borrower is most stretched.

**Done = testable:** change a borrower's property address once → the disclosures, appraisal order,
title order, CD and Deed of Trust all reflect it with **zero re-entry**, and the audit trail shows a
single edit with its downstream propagation.

---

## 6.3 Group TK — The task engine and command centre

**What this is.** Tasks are first-class objects the **system generates** — from milestones,
conditions, dates and rules. **Not a list a human maintains.** A system where a human keeps the real
list in a spreadsheet has not replaced the spreadsheet; it has added to it.

⭐ **Corollary that is worth taking literally: if a spreadsheet exists in operations today, it is a
screen the LOS is missing.**

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **TK-01** | Task command centre — all files, filterable, per role | DEMO | required |
| **TK-02** | In-file task panel on every role screen | DEMO | required |
| **TK-03** | Tasks generated from milestone entry | DEMO | required |
| **TK-04** | Tasks generated from condition creation — PTD → processor, PTF → funder | PILOT | required |
| **TK-05** | ⭐ Clock-generated tasks — TRID, lock expiry, incompleteness 30/60/90, grace period, insuring aging | PILOT | required |
| **TK-06** | Rule-generated tasks — state-specific and standard | PILOT | required |
| **TK-07** | ⭐ Cross-role requests from **Admin-defined standard-task lists** | PILOT | required |
| **TK-08** | Editable per-file due dates | DEMO | required |
| **TK-09** | Comments on your own task | DEMO | required |
| **TK-10** | Saved views per role, persisted | PILOT | required |
| **TK-11** | Self-created tasks | DEMO | required |
| **TK-12** | Skills-based / just-in-time routing | PROD | desired |

### Saved views are the feature, not a nicety

These are the actual hunts operators make, and each must be expressible:

*"ICD not sent and closing ≤ 7 days"* · *"funded > 30 days without an insuring certificate"* ·
*"AUS not run"* · *"waiting on borrower"* · *"non-delegated uploads pending investor underwriting"* ·
*"my rush files"*

### ⭐ TK-07 — why cross-role task wording is controlled

When one role sends work to another, the task text comes from **Admin-defined dropdown lists**, not
free text, plus a due date. It lands in the recipient's command centre attributed to the sender.

**Why it matters:** free-text task requests are unsearchable and unreportable. Controlled ones let a
manager ask *"how many ICD requests came in late this month?"* and get an answer.

**Three properties that are easy to miss:** tasks keep generating as the file moves (they are not a
punch list written at intake); any role can create tasks for themselves; and every task carries
owner, due date, status, comments, source (auto or manual), the linked loan and field, and priority.

**Done = testable:** a processor filters *"ICD not sent + closing ≤ 7 days"* and works the exact
list. Clearing a condition auto-closes its task **and** fires the next role's task with no manual
step. A request from the processor appears in the closer's command centre with the sender, due date
and standard wording intact.

---

## 6.4 Group DC — The document engine

**What this is.** Recognise, label and separate documents automatically, then let any role assemble
them by label into one package. This is one of the strongest differentiators in the build and the
direct answer to a post-closer's "twenty different buckets."

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **DC-01** | Auto-recognise and label inbound documents — **barcode-aware, and recognised when not barcoded** | PILOT | required |
| **DC-02** | Auto-separate into buckets — **no manual pulling-apart of a package** | PILOT | required |
| **DC-03** | ⭐ Package by label (FHA insuring, investor delivery) **in the correct stacking order** | PROD | required |
| **DC-04** | ⭐ Strip document security on package assembly; **log the event** | PROD | required |
| **DC-05** | Custom forms and templates **with data-field mapping** | PROD | required |
| **DC-06** | In-system e-signature for underwriting and internal documents | PROD | required |
| **DC-07** | Reclassify, or reject with a message back to the borrower | PILOT | required |
| **DC-08** | Trailing-document tracking — what is owed, from whom, how old | PROD | required |
| **DC-09** | ⭐ Correct CD terminology throughout — **never "preliminary"** | DEMO | required |

### ⭐ DC-04 — why stripping security is a requirement

Credit reports and similar documents arrive with PDF security that makes them **impossible to
upload to an investor.** Today somebody works around this by hand. The system strips security on
package assembly and **logs that it happened** — the log is what makes the strip defensible.

### ⭐ DC-05 — why custom forms need field mapping

Escrow holdback agreements, verbal verification of self-employment, specific power-of-attorney
forms: today these are **typed by hand** because the current system cannot map fields into a custom
form. That is the requirement — mapping, not a template library.

### DC-09 — vocabulary is a requirement, not pedantry

A Closing Disclosure is **initial, revised, final, or post-closing.** Never "preliminary." There are
no "tenants" in a mortgage file. Wrong vocabulary on screen teaches new hires wrong vocabulary in
front of borrowers and investors.

**Done = testable:** an e-signed closing package returns → documents auto-separate into the correct
buckets with **no manual sorting**; the FHA insuring package builds **in one action** in the right
stacking order; a credit report uploads to the investor with security stripped and the strip event
logged.

---

## 6.5 Group CO — The compliance engine and the three gates

**What this is.** ⭐⭐ **The audit and saleability floor.** It runs the full check set automatically
and **blocks the advance on a failure.**

### Why gates, not reports

Today the check runs when closing documents are requested, from the document vendor, plus a
compliance product that produces a large, hard-to-read output on manual request. The practical
effect is that **a problem surfaces at the moment you are trying to ship** — the most expensive
possible moment to find it.

| Gate | Fires at | Blocks |
|---|---|---|
| **#1** | Disclosure send | Initial disclosures and revised Loan Estimates |
| **#2** | Milestone change | Advancement past the gated milestone, notably **before Clear to Close** |
| **#3** | Final document request | **Issuance of closing documents** |

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **CO-01** | Gate #1 — disclosure send, **blocking** | PILOT | required |
| **CO-02** | Gate #2 — milestone change, **blocking** before Clear to Close | PILOT | required |
| **CO-03** | Gate #3 — final document request, **blocking** | PROD | required |
| **CO-04** | ⭐ A failure **names the check, names the figure, and assigns a cure task** | PILOT | required |
| **CO-05** | ⭐ Role-restricted override with a typed reason, **reported weekly** | PROD | required |
| **CO-06** | TRID clock engine and the six-piece application trigger | PILOT | required |
| **CO-07** | ⭐ Pre-Intent-to-Proceed fee gate, **enforced at the data layer** | PILOT | required |
| **CO-08** | Intent to Proceed as its own timestamped act | PILOT | required |
| **CO-09** | Tolerance buckets as **computed properties of a fee**, not a manual classification | PILOT | required |
| **CO-10** | CD three-business-day scheduling block, **across the seam** | PROD | required |
| **CO-11** | ATR/QM and points-and-fees threshold tests | PILOT | required |
| **CO-12** | HOEPA federal plus state and local high-cost tests | PROD | required |
| **CO-13** | HPML / rate-spread test **and its escrow consequence** | PROD | required |
| **CO-14** | Loan-officer compensation validation against the fee sheet | PROD | required |
| **CO-15** | Bona-fide discount-point check, automatic | PILOT | required |
| **CO-16** | HMDA collection and LAR with validity and quality edit checks | PROD | required |
| **CO-17** | Adverse-action timing with **specific, traceable** reasons | PILOT | required |
| **CO-18** | ⭐ Counteroffer → adverse-action clock | PROD | required |
| **CO-19** | Notice of incomplete application, 30/60/90, as tasks and reports | PILOT | required |
| **CO-20** | ⭐ Withdrawn ≠ denied; **automation halts on both** | PILOT | required |
| **CO-21** | Employee-loan compliance handling | PROD | required |
| **CO-22** | PACER check | PROD | desired |
| **CO-23** | Retention policy and legal hold | PROD | required |
| **CO-24** | Investor-approval documents retained — **non-delegated *and* brokered** | PILOT | required |
| **CO-25** | ⭐ One-action examination pull, exportable | PROD | required |

### ⭐⭐ CO-04 / CO-05 — how a gate must behave

A compliance panel shows pass/fail per category at each gate. A failure **blocks the milestone**,
**names the specific check and the number**, and **drops a cure task on the right role.** The result
is stored, timestamped and immutable.

Not *"validation failed"*. Instead:

> *"Points and fees exceed the 5% QM limit — reduce by $312 or re-price. A cure task has been
> assigned to the closer."*

**The anti-requirement, and it matters as much as the gate:** an override exists, it is
role-restricted, it requires a typed reason, and **every override is reported to compliance
weekly.** ⭐ **A gate nobody can pass in an emergency gets worked around; a gate that records who
passed it and why gets respected.**

### ⚠️ A verification note, stated honestly

The check list above originates in part as a competitor's **published coverage summary.** That is a
good *scope statement* and a poor *specification*. **Before build, each line must resolve to a
citation, an input, a threshold and a test case.**

⛔ **Coverage copied from marketing copy is not a compliance control.** Building to the list as
written is how you get a system that claims a check it does not really perform — which is **worse
than not claiming it**, because the shop then relies on it.

**Done = testable:** attempt Docs Out on a loan that breaches the points-and-fees limit → the system
blocks it, names the failed check with the actual figure and the limit, creates a cure task assigned
to the closer, and records the block in the audit trail — **before any document can issue.**

---

## 6.6 Group QC — Quality control and quality assurance

**What this is.** ⚠️ **This entire module was absent from the prior blueprint.** Investors and
agencies require a quality-control programme; a lender without one cannot sell loans reliably and
cannot survive an audit.

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **QC-01** | Scheduled monthly QC draw at a configured percentage | PROD | required |
| **QC-02** | Random **and** discretionary composition enforced | PROD | required |
| **QC-03** | Pre-close / pre-funding review **that can gate the milestone** | PROD | required |
| **QC-04** | Post-close review with agency deadline clocks | PROD | required |
| **QC-05** | ⭐ **Reviewer independence enforced** via touch history and RBAC | PROD | required |
| **QC-06** | Rejected-application review queue (ECOA and fair lending) | PROD | required |
| **QC-07** | Findings → severity → corrective action → closure | PROD | required |
| **QC-08** | QC findings feed the training report | PROD | desired |
| **QC-09** | Agency-format QC export | PROD | required |

### ⭐ QC-05 — enforced, not promised

**A person cannot review a file they touched.** This is checked against the file's actual touch
history, not against a role name — because the same person may have worn a different hat on that
file three weeks ago. This is the difference between a QC module and a QC theatre.

---

## 6.7 Group PR / AC — Origination, processing and conditions

**What this is.** The middle of the line. The processor assembles and verifies the file, orders
every outside service, runs automated underwriting, and works the condition list.

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **PR-01** | Order **all** services from the LOS; the response is recorded in the file | PILOT | required |
| **PR-02** | Auto-fire vendor orders on milestone entry | PILOT | required |
| **PR-03** | AUS run in-system, findings stored | PILOT | required |
| **PR-04** | ⭐ AUS re-run **diff** — what changed, not just the latest run | PROD | desired |
| **PR-05** | ⭐ Credit **review** (not re-order), with the representative-score rule shown | PILOT | required |
| **PR-06** | Credit supplements ordered in-system | PROD | required |
| **PR-07** | Submission checklist gate; touch count tracked | PROD | required |
| **PR-08** | ⭐ Non-delegated: upload the package to the investor, track it back | PROD | required |
| **PR-09** | ⚠️ **Brokered channel path** (~10–15% of volume) | PROD | required |
| **PR-10** | TBD-approval path **without triggering the three-day rule** | PROD | required |
| **AC-01** | Enhanced Conditions — automatic by product | PILOT | required |
| **AC-02** | Automatic conditions by state (e.g. Texas A(6) lock, South Carolina attorney) | PILOT | required |
| **AC-03** | Texas 50(a)(4) support alongside A(6) | PROD | required |
| **AC-04** | Automatic conditions from flags — trust, POA, manufactured home, buydown, DPA | PROD | required |
| **AC-05** | ⭐ Batch conditions built once, auto-applied | PROD | required |
| **AC-06** | Conditions tagged by source — `auto·FHA`, `auto·state`, `auto·flag` | PILOT | required |
| **AC-07** | PTA / PTD / PTC / PTF taxonomy **with gating behaviour** | PILOT | required |

### ⭐ PR-05 — the credit split, restated because it reshapes the screen

**The loan officer orders credit, in the POS, at pre-approval. The processor reviews it and does not
re-order it.** A processing screen with an "order credit" button as its primary action is modelled
on the wrong shop. The representative-score rule — the middle score of each applicant, then the
lowest of those, **program-configurable** — must be **shown**, not implied, because it drives
pricing, AUS and eligibility.

### ⭐ PR-08 / PR-09 — the two channels that are not retail

**Non-delegated correspondent (~20–25%).** Disclose and process in-house → the processor uploads the
package to the investor to underwrite → **the investor's approval PDF is OCR'd and its conditions
mirrored into the file, so the processor works one list, not two** (UW-07) → finish in-house with
documents, wire and funding. ⭐ **Every document used to approve the loan with the investor must be
retained in our file for audit** (CO-24).

**Brokered (~10–15%).** ⚠️ **This was absent from the prior blueprint entirely**, which left roughly
one loan in eight without a home in the system. At minimum it needs: a distinct milestone path, a
distinct disclosure-responsibility model, distinct compensation handling, and retention of the
approval documentation. **This is an open gap, not a solved one** — see §11.

### ⭐ AC-01 / AC-05 / AC-07 — conditions as a generated set

Conditions are **fired from the file's own attributes** — product, state, and flags — not built by
hand each time. The taxonomy carries gating behaviour, which is the part that makes it real:

| Tag | Means | Gates |
|---|---|---|
| **PTA** | Prior to Approval | The underwriting decision |
| **PTD** | Prior to Docs | Issuance of the closing package |
| **PTC** | Prior to Closing | The closing appointment |
| **PTF** | Prior to Funding | ⭐ **Release of the wire** (FU-04) |

⭐ **Conditions are addressable.** `/los/loan?id=X#need-bank2` lands on the row and rings it. This is
what lets a task, an email or a note point at one specific outstanding item rather than at a screen.

**Done = testable:** an FHA loan on a Texas cash-out refinance opens with its FHA conditions, its
Texas A(6) conditions and its flag-driven conditions already present, each tagged with its source,
and each PTF item visibly blocking the wire.

---

## 6.8 Group UW / GV — Underwriting, including the government panels

**What this is.** The decision. `/los/uw` is the largest screen in the build and it is gated on the
`decision` capability, held **only** by the Underwriter.

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **UW-01** | 1003 and AUS **side by side**; income, asset and collateral tabs | PILOT | required |
| **UW-02** | Condition builder — library, batch, custom | PILOT | required |
| **UW-03** | Decision: **Approve / Suspend / Deny** → the adverse-action path | PILOT | required |
| **UW-04** | Appraisal XML auto-populate | PROD | required |
| **UW-05** | Reconsideration-of-value forms and a defined process | PROD | required |
| **UW-06** | E-sign underwriting documents in-system | PROD | required |
| **UW-07** | OCR a non-delegated investor approval → mirror its conditions | PROD | desired |

### The government panels — FHA, VA, USDA

These appear **only when the loan type requires them.** Each government program has extra steps,
extra documents and extra government systems.

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **GV-01** | FHA panel — case number, CAIVRS, LDP/GSA, ADP code, identity of interest | PILOT | required |
| **GV-02** | ⭐ FHA mortgage-insurance premium auto-calculation by LTV and term, recalculating, **with pennies dropped** | PILOT | required |
| **GV-03** | FHA 203(k) fields when applicable | PROD | desired |
| **GV-04** | VA Certificate of Eligibility and entitlement, **including remaining entitlement** | PILOT | required |
| **GV-05** | ⭐ VA funding fee auto-calculated, **exemption drives it to $0**, recalculating | PILOT | required |
| **GV-06** | VA residual income **by region and household size** | PROD | required |
| **GV-07** | VA refinance comparison and net-tangible-benefit panel, auto-populated | PROD | required |
| **GV-08** | ⭐ VA non-allowable fees **enforced on the fee sheet** | PROD | required |
| **GV-09** | Veteran property-tax exemption flag with state logic | PROD | required |
| **GV-10** | USDA GUS, guarantee and annual fee, AMI and property eligibility | PROD | required |

⭐ **GV-02's "pennies dropped" is not a rounding preference.** FHA MIP calculation drops fractional
cents in a specific way; a generic rounding produces a figure that disagrees with FHA's own and the
loan fails insuring. Small rule, expensive to discover late.

⭐ **GV-08 is enforcement, not a warning.** Certain fees may not be charged to a VA borrower. The fee
sheet must **refuse** them, in the same way the pre-ITP fee gate refuses (CO-07).

**Done = testable:** a VA loan with an exempt veteran shows a $0 funding fee, refuses a non-allowable
fee on the 2015 itemisation with a named reason, and populates the net-tangible-benefit panel
without re-entry.

---

## 6.9 Group FE / CL / FU — Fees, closing and funding

**What this is.** ⭐ The densest and most consequential part of the LOS. The fee itemisation feeds
the Loan Estimate, the Initial Closing Disclosure, the Closing Disclosure, the closing documents and
the wire. **An error here is an error on all five.**

⭐ **The design rule for these screens, in the Director of Operations' own words:**

> *"The 2015 fee screen should look like an actual fee worksheet — dense, spreadsheet-like. Not an
> app on a phone."*

### The fee itemisation

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **FE-01** | The 2015 itemisation, by section | PILOT | required |
| **FE-02** | ⭐ Controlled fee-name dropdown — **no free-hand fee names** | PILOT | required |
| **FE-03** | ⭐ Type-to-fill title company; ⛔ **no vendor record created for a one-off payee** | PILOT | required |
| **FE-04** | Individual fee box — paid-by, can-shop / did-shop, and **it shows the LE section and the CD section** | PILOT | required |
| **FE-05** | B-box mark-all with per-line override | PILOT | required |
| **FE-06** | ICD title swap moves fees **out of the 10% tolerance bucket** | PILOT | required |
| **FE-07** | Finance-charge auto-flag with an admin override | PROD | required |
| **FE-08** | Smart-fee / national-title placeholder at initial disclosure → the service-provider list | PROD | required |
| **FE-09** | ⭐ **Branch × State × Product** fee templates load into the 2015 | PILOT | required |
| **FE-10** | Review ribbon → jump to the LE or CD page | PROD | desired |
| **FE-11** | ⏱ ⭐⭐ **A full fee sheet built in 5–10 minutes** | PILOT | required |

### ⭐⭐ FE-11 — the stopwatch is an acceptance criterion

**A title-fee update takes 20–25 minutes today and must take 5–10.** This is not a sentiment; it is
a test. **If a build passes the feature test and fails the stopwatch, it has not passed.**

What that requires, concretely:

- **Type-to-fill payees.** Type a title company; its whole fee block fills. ⛔ **No vendor record is
  created for a one-off payee** — an HOA we will never see again must not become permanent data.
- **Select-all with per-line override** — the B-box "mark all shopped" button *and* its exception.
- **Templates that pre-load.** The fee sheet does not start blank; the branch × state × product
  template fills it.
- **Keyboard-first.** Tab order follows **the form, not the DOM**. Enter commits. Numeric fields take
  a number without a mouse.
- **No modal for the common case.** The individual-fee box is where a fee is *refined*, not where
  every fee must be *entered*.

⭐ **FE-02 exists because free-hand fee names destroy the tolerance engine.** A fee whose name is
typed cannot be reliably classified into a tolerance bucket, cannot be reliably flagged as a finance
charge, and cannot be compared between the LE and the CD. The dropdown is the control that makes
CO-09 possible.

### Closing

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **CL-01** | Aggregate escrow **with the full CD visible** | PROD | required |
| **CL-02** | Two-month cushion; taxes due ≤ 30 days → line 907 | PROD | required |
| **CL-03** | Vesting panel — full type list, write-ins, title-holder-only | PROD | required |
| **CL-04** | Exhibit and legal — "see Exhibit A" default, trustee by state, riders | PROD | required |
| **CL-05** | ⭐ Closing checkboxes **with defined consequences** | PROD | required |
| **CL-06** | In-system closing checklist **as a gate** | PROD | required |
| **CL-07** | ⭐ ICD issuance **gated by compliance pass #3** | PROD | required |
| **CL-08** | Disclosure tracking screen, auto-dated | PILOT | required |
| **CL-09** | Change-of-circumstance reason table **with timing tests** | PILOT | required |
| **CL-10** | True document-vendor sync — all fields, all programs | PROD | required |
| **CL-11** | UCD round trip, in-system | PROD | required |

⭐ **CL-05 — "checkboxes with defined consequences."** Several closing checkboxes silently change
which documents generate and which riders attach. Each one must state, on screen, what it will do.
A checkbox whose effect is invisible is how a wrong document set reaches a closing table.

### Funding

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **FU-01** | Funding worksheet → total fees → net wire | PROD | required |
| **FU-02** | Standard fees prefill; override allowed and logged | PROD | required |
| **FU-03** | ⭐ Second liens and down-payment assistance **populate the wire** | PROD | required |
| **FU-04** | ⭐⭐ **PTF conditions gate the release** | PROD | required |
| **FU-05** | Wire request and confirmation logged | PROD | required |
| **FU-06** | MERS register → warehouse, with the warehouse-MERS field | PROD | required |

### ⭐⭐ The wire is the highest-consequence act in the system

`release-wire` is held by the **Funder alone** (§4.4). Beyond the capability check:

- **PTF conditions block the release** (FU-04). Not warn — block.
- **The wire-fraud warning appears first**, before the instructions, because that is the order a
  human should read it in.
- **Wire-fraud controls are mandatory** (RC-02): verified payee, callback verification, account
  validation.
- **Every override is logged with who changed what, from what, to what** (FU-02).
- ⛔ **A wire is not a phone action.** Building it as one is a risk decision disguised as a
  convenience feature (§7 DEV-07).

**Done = testable:** a file with one outstanding PTF condition cannot release a wire; the refusal
names the condition; clearing it releases the block and the whole sequence appears in the audit
trail with actor and timestamp.

---

## 6.10 Group PC — Post-close, insuring and investor delivery

**What this is.** The half of the process most systems abandon. The loan has funded; it is not yet
money. It must be insured if it is a government loan, registered with MERS, delivered to the
investor who buys it, and reconciled when they pay.

⭐ **This module's specification is a spreadsheet that exists today.** A post-closer's manual
tracker and government insuring log are **not workarounds to be tolerated — they are the
requirement.**

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **PC-01** | ⭐ Post-close tracker — **the spreadsheet becomes the screen** | PROD | required |
| **PC-02** | Dated event log, auto-timestamped | PROD | required |
| **PC-03** | Insuring by program — FHA MIC, VA LGC, USDA Loan Note Guarantee | PROD | required |
| **PC-04** | ⭐ Aging view: **funded > X days without insuring** | PROD | required |
| **PC-05** | VA funding-fee **15-day remittance clock** | PROD | required |
| **PC-06** | ⭐ Investor Connect — two-way delivery and tracking | PROD | required |
| **PC-07** | Per-investor delivery profiles | PROD | required |
| **PC-08** | Purchase conditions return as **routed in-file tasks** | PROD | required |
| **PC-09** | ⭐ Purchase Advice auto-reconciliation **with mismatch flags** | PROD | required |
| **PC-10** | ⭐ On Purchased: MERS transfer → goodbye letter → payoff → finalise | PROD | required |
| **PC-11** | Post-close issue log feeds the training report | PROD | desired |

### ⭐ PC-06 — the promise behind Investor Connect

**Zero investor-portal logins.** The seat that delivers a loan answers for that delivery, which is
why `investor-deliver` is its own capability separate from `mers` and `ucd` (§4.4). The Manager
holds it too, because a post-closer out for a week cannot mean a shop that cannot sell loans.

### ⭐ PC-09 — reconciliation is where money is silently lost

A Purchase Advice is the investor's statement of what they actually paid. **Auto-reconcile it
against what was expected and flag every mismatch.** Manual reconciliation of these is how a
lender discovers a pricing error six months and forty loans later.

### PC-11 and the defect log — read this before designing the screen

`/los/pcissues` logs every defect found after closing, by step, by seat and by category, so the
recurring ones become training topics.

⭐ **The screen must say out loud what these numbers are NOT.** A defect count read as a scoreboard
is how you teach people to stop logging defects — at which point the module actively makes the shop
worse than having no module. This framing is a requirement, not copy.

---

## 6.11 Group SE / BD — Secondary market and buydowns

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **SE-01** | Lock desk — lock, extend, re-lock **at the correct plan code** | PILOT | required |
| **SE-02** | ⭐ Extension cost captured **and attributed** | PROD | required |
| **SE-03** | Lock-expiration alerts routed to the loan officer | PILOT | required |
| **SE-04** | Position, commitments, best execution, delivery | PROD | required |
| **SE-05** | Hedging and pull-through analytics | PROD | desired |
| **BD-01** | Buydown radio, type dropdown, funding source | PILOT | required |
| **BD-02** | Subsidy schedule auto-calculated | PILOT | required |
| **BD-03** | ⭐ Qualifying-rate rule applied correctly to AUS and DTI | PILOT | required |
| **BD-04** | ⭐ Plan code maps to pricing **and** document generation | PILOT | required |
| **BD-05** | Buydown agreement generated; escrow custodial account funded | PROD | required |

⭐ **SE-02 — attribution decides who pays.** A lock extension costs money. Whether the delay was
**borrower-caused or lender-caused** determines who bears that cost, and it **will** be argued about
later. Capture it at the moment of extension, not in the argument.

⭐ **BD-03 — the buydown qualifying-rate trap.** A temporary buydown reduces the borrower's payment
in early years, but most programs require qualifying at the **note rate**, not the bought-down rate.
Applying the wrong one to DTI produces a file the AUS approves and the investor rejects.

⭐ **BD-04 — the plan code is the chain.** It must drive pricing **and** document generation. This is
the same broken chain named in DM's mapping table, and it is what produces wrong Initial Closing
Disclosures today.

---

## 6.12 Group WS — The worksheet and form library

**What this is.** ⭐ A genuine differentiator, and an unglamorous one. These are the calculations
operators do today **in Excel, beside the system**. Each one is a place where a wrong number reaches
a borrower or an agency.

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **WS-01** | FHA Streamline worksheet **with the full calculation chain** | PROD | required |
| **WS-02** | FHA streamline required wait-period calculator | PROD | required |
| **WS-03** | Upfront MIP refund calculator, from the endorsement date | PROD | required |
| **WS-04** | VA IRRRL / cash-out comparison with net tangible benefit | PROD | required |
| **WS-05** | VA Joint Applicants worksheet | PROD | required |
| **WS-06** | VA eligibility / entitlement worksheet | PROD | required |
| **WS-07** | Texas A(6) **2% fee-cap** worksheet | PROD | required |
| **WS-08** | Escrow Holdback Agreement for Repairs | PROD | required |
| **WS-09** | Verbal verification of employment form | PROD | required |
| **WS-10** | Specific power-of-attorney forms, **mapped** | PROD | required |
| **WS-11** | New-construction tax projection by state | PROD | required |
| **WS-12** | Closing matrix by state | PROD | desired |

⭐ **"With the full calculation chain" (WS-01) is the requirement.** A worksheet that prints an
answer is worth less than one that shows its arithmetic, because **a number an operator cannot
defend is a number they will not use** — they will go back to Excel, and the module will have failed
while appearing complete.

⚠️ **`/los/worksheets` currently carries a claim the page had to withdraw, kept visible rather than
deleted.** That is the correct behaviour and it should be preserved: a retracted claim left visible
is how a team stops re-making the same wrong assumption.

---

## 6.13 Group EC — eClose, eNote and RON

**What this is.** The digital closing spectrum. It is tiered PROD throughout — none of it is needed
to fund the first loan, and all of it is needed to compete.

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **EC-01** | eClosing room — hybrid, full eClose, and RON paths | PROD | required |
| **EC-02** | ⭐ MISMO eNote with a **real XMLDSIG signature** — not the string "UNSIGNED" | PROD | required |
| **EC-03** | eVault — tamper-evident authoritative-copy custody and transfer | PROD | required |
| **EC-04** | RON: notary session, identity proofing, recorded audio-video, journal | PROD | required |
| **EC-05** | eClose eligibility by **state, investor and county e-recording** | PROD | required |
| **EC-06** | E-recording submission and recorded-document return tracking | PROD | required |
| **EC-07** | eNote registered to the MERS eRegistry as controller and location | PROD | required |

⭐ **EC-02 is called out because a placeholder shipped once.** An eNote whose signature element
reads `UNSIGNED` is not an eNote; it is an XML file that will be rejected at delivery. **The
acceptance test is a successful MERS eRegistry registration, not a well-formed document.**

⭐ **EC-05 — eligibility is a three-way test.** A state may permit RON, an investor may refuse it,
and the county may not accept electronic recording. All three must pass, and the screen must say
**which one failed** when one does.

---

## 6.14 Group RC — Controls the operations notes did not name

**What this is.** ⚠️ **These are requirements nobody asked for, and their absence would each have
been discovered expensively.** They are listed separately rather than folded into other groups so
that the reason they exist is not lost.

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **RC-01** | ⭐ OFAC / SDN / watchlist screening **on all parties** | PILOT | required |
| **RC-02** | ⭐⭐ Wire-fraud control: verified payee, callback verification, account validation | PILOT | required |
| **RC-03** | NMLS Mortgage Call Report data and export | PROD | required |
| **RC-04** | US title-insurance rating — filed rates, simultaneous issue | PROD | required |
| **RC-05** | Investor-specific document stacking templates | PROD | required |
| **RC-06** | Hazard, flood and MI policy tracking with expiration alerts | PROD | required |
| **RC-07** | SSO / OAuth 2.0 (Okta, Azure AD, Google) | PILOT | required |
| **RC-08** | Document version control | PROD | required |
| **RC-09** | Flood-zone determination with **life-of-loan monitoring** | PROD | required |
| **RC-10** | ⭐ Right-of-rescission tracking on applicable refinances | PROD | required |

### Why each of these is here

- **RC-01 — OFAC screening on all parties.** Not just the borrower. Sellers, sometimes agents. A
  lender that closes a loan with a sanctioned party has a problem no amount of documentation fixes.
- **RC-02 — wire fraud is the largest single-loss risk in mortgage operations.** A verified payee, a
  callback to a known number, and account validation are the three controls that stop it. This is a
  PILOT-tier requirement, not a PROD one, because the first real loan moves real money.
- **RC-03 — the Mortgage Call Report** is a quarterly NMLS filing obligation. It is not optional and
  it needs its data captured all along, not reconstructed at quarter end.
- **RC-06 — insurance policies expire.** A funded loan with lapsed hazard coverage is an investor
  repurchase demand waiting to happen.
- **RC-09 — flood determination is life-of-loan**, not one-time. Zones are redrawn.
- ⭐ **RC-10 — the right of rescission** is why "Closed" and "Funded" are separate milestones
  (§3.3). On a refinance of a primary residence the borrower has three business days to cancel, and
  **funding before that window closes is a serious violation.** The tracker is the control.

---

## 6.15 Group BS — ⭐⭐ The Loan Summary screen

**What this is.** The screen a file opens to, and the most important single screen in the LOS after
the underwriting workstation. Every system calls it something different — an Overview screen, a
Borrower Summary. The name does not matter; the job does.

⭐ **In the subject-matter expert's own words:**

> *"This screen is the meat and potatoes — the story of the file. If things are incorrect here, the
> disclosures will go out incorrectly and could affect the overall loan if it isn't caught. This is
> the page that the file opens to and should not have other pages running on it. It is its own page."*

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **BS-01** | ⭐ **Loan Summary as the file-open screen** — role-scoped, organised in sections | DEMO | required |
| **BS-02** | ⭐ File-detail band **identical across roles** — the backup's first read | DEMO | required |
| **BS-03** | Role-scoped summary tiles — closer, post-closer, processor, underwriter, manager | PILOT | required |
| **BS-04** | ⭐ **Operations-defined custom fields as first-class data** — reportable, filterable, task-able | PILOT | required |
| **BS-05** | Quick links that open the target form **pre-populated**, including external tools in context | PILOT | required |
| **BS-06** | The two-screen pattern enforced per role: task landing + Loan Summary | DEMO | required |

### ⭐⭐ BS-01 — the specified field set

⚠️ **Section ordering is a preference, not a rule.** The subject-matter expert was explicit that
grouping these sensibly is open to design judgement. **The fields themselves are not.**

**① Borrowers and contact information**
Borrower and co-borrower names, **SSN, email, phone**. ⭐ This information **flows and is mapped
from the 1003** — it is never re-keyed here.

**② Loan number**
Generated when the file is either entered manually or arrives from the POS.

**③ Terms of the mortgage** — mostly standard dropdowns

| Field | Behaviour |
|---|---|
| Purpose | Dropdown |
| Occupancy | Dropdown |
| Loan Type | Dropdown — e.g. Conventional |
| Program | Dropdown — e.g. HomeReady FNMA 30-year Fixed. ⭐ **If the program is an ARM, a further panel opens to capture the ARM terms.** |
| **Term** | ⭐ **Its own field, separate from Program** — a borrower may choose a 25-year term on a 30-year fixed program, and the term decides payment and amortisation |
| Appraised Value | — |
| Purchase Price | When applicable |
| **Down Payment** | ⭐ **Both a % field and a $ field. Either may be entered and the other calculates.** |
| **Loan Amount** | Calculated from down payment against sale price |
| Note Rate | — |
| **Escrow waiver** | Yes / no radio |

⭐ **Refinances differ:** a refinance carries **Refinance Type** (No Cash Out · Rate/Term · Limited
Cash Out · Cash Out) and has **only an appraised value** — an estimate until the report arrives —
**and a loan amount, to determine LTV.** There is no purchase price.

**④ Mortgage insurance**

- ⭐ **Always use the percentage, so it moves with loan-amount changes.** A hardcoded dollar premium
  silently becomes wrong the moment the loan amount changes.
- A pop-up calculator when the premium percentage is being added manually.
- ⭐ **Integrate MI quotes** so that the quote chosen pulls its percentage in and calculates the
  monthly payment.
- **Lender-paid MI: yes / no radio.**
- The result must be **mappable into the Fannie Mae and Freddie Mac AUS**.
- ⭐ Show the **dollar amount if the borrower will pay upfront MIP in cash** — this **flows onto the
  fee sheet as a borrower fee.**
- A field for whether the upfront premium **will be financed into the loan.**

**⑤ Subject property**
Property address, with a **valid / invalid** indication.

> ⚠️ **INCOMPLETE — and deliberately not guessed.** The subject-matter expert's specification for
> this screen was **cut off mid-sentence at capture**, immediately after the subject-property
> address field. Everything from the remainder of the Subject Property section onward is **missing
> and has not been invented.**
>
> **Do not fill this gap from convention.** It is tracked as open item **Q3** in §11 and will be
> completed in a later version. Build sections ① through ④ and the property address; leave the
> section extensible.

### ⭐ BS-04 — custom fields must be real data

Operations-defined custom fields are **first-class**: reportable, filterable, and able to have tasks
raised against them. A custom field that is only a text box on a screen is a note; a custom field
that a manager can filter the whole pipeline by is a capability. This is the difference between the
system absorbing the shop's real vocabulary and the shop keeping a spreadsheet.

### ⭐ BS-02 — the file-detail band is the backup rule made visible

The band is **identical across every role**, because it is the first thing a covering seat reads
(§3.4). A band that reorders itself per role defeats its own purpose.

### ⚠️ Two placement corrections outstanding

Both are recorded rather than resolved, because they are the subject-matter expert's call:

1. **Life of a Loan must be removed from beneath the Loan Summary** — it already lives on the Tasks
   screen, and having it in both places is the duplication §5.2 rule 4 forbids.
2. **File Contacts moves onto the Loan Summary** and comes off the left rail.

---

## 6.16 Group CZ — The Closing Disclosure workspace

**What this is.** All five CD pages on one screen, directly beneath the 2015 fee itemisation, so the
closer never works from a second window.

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **CZ-01** | ⭐ **CDEZ — all five CD pages on one screen**, directly beneath the 2015 | PILOT | required |
| **CZ-02** | RegZ-CD control record: plan code, alternative lender, disclosure info, MI | PILOT | required |
| **CZ-03** | Closing vendor info — lender, title, **Docs-Prepared-By exactly as printed** | PILOT | required |
| **CZ-04** | CD page 3 Summaries of Transactions — prorations, payoffs, seller credits | PILOT | required |
| **CZ-05** | CD page 4 AP Table / AIR Table on adjustable loans | PROD | required |
| **CZ-06** | ⭐⭐ **The audit gates Order Docs** — disabled until the compliance audit clears | PILOT | required |
| **CZ-07** | ⭐ Audit findings **in red with go-to-field links**, not a report | PILOT | required |
| **CZ-08** | Reconcile the CD to the settlement statement **without a second window** | PROD | required |
| **CZ-09** | Closing conditions pull into the lender's closing instructions | PROD | required |

⭐⭐ **CZ-06 and CZ-07 together are the whole point of this group.** Compliance gate #3 (CO-03) is
not a report the closer reads and then decides about — **it disables the button.** And when it
fails, the findings are **red, in place, each linking to the field that caused them.** A finding
that arrives as a separate document is a finding somebody has to translate back into a screen
position, at the exact moment they are trying to ship.

---

## 6.17 Group LS — Loan-officer enablement

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **LS-01** | LO pricing and scenario comparison, using the program engine | PILOT | required |
| **LS-02** | Pre-qualification / pre-approval letter from the LO, POS-aligned | PILOT | required |
| **LS-03** | LO compensation and commission visibility per loan | PROD | desired |
| **LS-04** | Referral-source and partner attribution reporting | PROD | required |
| **LS-05** | ⭐ Lead → application conversion, **held in the Portal, not the LOS** | PROD | required |
| **LS-06** | LO co-pilot: next-best-action per file, with reasons | PROD | desired |
| **LS-07** | Production goals, pacing and forecast | PILOT | required |
| **LS-08** | Rate-watch, repeat-client and refinance-opportunity alerts | PROD | desired |

⭐ **LS-05 states a boundary, not a feature.** Leads and sales pipeline live in the LO Portal / POS.
**They must never clutter the LOS.** The LOS is where a loan is manufactured; it is not where a
lead is worked.

⭐ **LS-02 must stay aligned with the POS.** A pre-approval letter is **a frozen copy, not a live
view** — changing the loan amount afterwards does not change an issued letter. The POS owns issuance
to referral partners; this requirement is the LOS-side view of the same object. See
`INTEGRATION_version1.0.0` §3.

---

## 6.18 Group AD / PL / AU — Admin, pipeline, reporting and audit

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **AD-01** | ⭐ Real RBAC — the role × capability matrix, with a workspace per role | PILOT | required |
| **AD-02** | Users and loan officers with **state licences and expirations**; regions; branches | PILOT | required |
| **AD-03** | Fee templates by branch / state / product | PILOT | required |
| **AD-04** | Business rules and milestone gates | PROD | required |
| **AD-05** | Custom fields and forms with mapping | PROD | required |
| **AD-06** | Investors and delivery profiles | PROD | required |
| **AD-07** | ⭐ Program and plan codes mapped to **pricing and the document vendor** | PILOT | required |
| **AD-08** | Standard-task dropdown libraries | PILOT | required |
| **AD-09** | Per-role pipelines, saved views, task templates | PILOT | required |
| **AD-10** | ⭐ Configuration versioning and change audit | PROD | required |
| **AD-11** | ⭐ Sandbox — test a rule in staging **before it goes live** | PROD | required |
| **AD-12** | Closing document plan codes by investor, and stacking templates | PROD | required |
| **AD-13** | Compliance audit settings, including **default channel banked/brokered** | PILOT | required |
| **PL-01** | Dual pipeline views — data grid **and** loan summary | PILOT | required |
| **PL-02** | Scope-derived visibility — branch / regional / national | PILOT | required |
| **PL-03** | ⭐ Aging buckets with **non-colour-only** status | PILOT | required |
| **PL-04** | Touch counts by role | PROD | required |
| **PL-05** | Reporting — pull-through, cycle time, channel mix, exports | PROD | required |
| **PL-06** | KPI framework surfaced natively — turn times, error rates | PROD | desired |
| **PL-07** | AI bottleneck detection and SLA alerts | PROD | desired |
| **AU-01** | ⭐ Immutable audit trail — field, milestone, vendor, condition, permission | PILOT | required |
| **AU-02** | Compliance gate results **and overrides** recorded | PILOT | required |
| **AU-03** | Reconcile to the document vendor's disclosure trail | PROD | required |

⭐ **AD-10 and AD-11 exist because configuration is code.** A fee template, a business rule and a
milestone gate each change what the software does. They therefore need **versioning, a change
audit, and a place to be tested before going live.** A shop that can change a blocking compliance
gate in production with no version history has moved the risk, not removed it.

⭐ **AD-02 — licence expirations are load-bearing.** An LO whose state licence has lapsed must stop
being assignable **on the expiry date**, without anyone remembering. This is the LOS side of the
POS's H3.

⭐ **PL-03 — never colour alone.** An aging bucket that is communicated only by a red row is
invisible to a colour-blind operator and to anyone printing or exporting. Shape or label as well
(§7 A11Y-03).

---

## 6.19 Group IN — Integrations

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **IN-01** | Credit, flood and VOE via the credit vendor API | PILOT | required |
| **IN-02** | AUS — Fannie Mae DU and Freddie Mac LPA | PILOT | required |
| **IN-03** | ⭐ Document vendor **true sync — all fields, all programs** | PROD | required |
| **IN-04** | MERS OnLine / API register and transfer | PROD | required |
| **IN-05** | FHA Connection — case number, CAIVRS, insuring | PROD | required |
| **IN-06** | Appraisal order and XML return | PROD | required |
| **IN-07** | Title request through the LOS, with the action recorded | PROD | required |
| **IN-08** | MI quotes and certificates; the non-delegated upload path | PROD | required |
| **IN-09** | Fraud detection | PROD | required |
| **IN-10** | 4506-C / SSA-89 ordering | PROD | required |
| **IN-11** | GSE UCD collection | PROD | required |
| **IN-12** | Verification of assets | PROD | desired |
| **IN-13** | ⭐ Pricing engine plan codes, **both directions** | PILOT | required |
| **IN-14** | ⭐ Integration health **visible on screen when a vendor is down** | PROD | required |

⭐ **IN-03 — "all fields, all programs" is the requirement, and the current gap.** Partial document-
vendor sync is why values are re-keyed today and why wrong Initial Closing Disclosures are produced.
A sync that covers the common program and leaves the government programs to manual entry has not
satisfied this requirement.

⭐ **IN-14 — a vendor being down must be visible on the screen where the work is happening**, not
only on an operations dashboard. An operator who does not know title ordering is failing will
re-try it four times and then raise a support ticket.

---

## 6.20 Group AI — Artificial intelligence inside the line

⭐⭐ **The governing rule: AI in an LOS suggests; it never decides.** A licensed human makes every
decision that has a regulatory consequence.

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **AI-01** | Income calculator, **showing its work** | PROD | desired |
| **AI-02** | ⭐ The income calculator **states its own uncertainty and routes to a human** | PROD | desired |
| **AI-03** | Document classification and auto-label to a condition | PROD | desired |
| **AI-04** | ⭐ Condition-clearing **suggestions** — a human clears | PROD | desired |
| **AI-05** | Discrepancy flags — name versus W-2, employer mismatch | PROD | desired |
| **AI-06** | Next-best-action **with a stated reason** | PROD | desired |
| **AI-07** | ⭐⭐ Guardrail charter **enforced in code** | PROD | required |
| **AI-08** | Model governance — versioning, disparate-impact testing, traceability | PROD | required |
| **AI-09** | Written AI/ML governance framework — the six required elements | PILOT | required |
| **AI-10** | On-demand AI disclosure pack — types used, purpose, safeguards | PILOT | required |
| **AI-11** | ⭐ **Per-loan AI provenance** — what the model saw, its output, who reviewed it, what they did | PILOT | required |
| **AI-12** | Tenant-scoped governance — a licensee can satisfy the framework on their own instance | PROD | required |

⭐ **Notice the tier and type split.** Every *capability* here is **desired** and PROD. Every
*governance* requirement is **required**, and two of them are **PILOT** — meaning the governance
must exist before the first supervised real loan, whether or not any model is doing anything
interesting yet. Building the AI features first and the governance later is the failure mode this
split exists to prevent.

⭐ **AI-11 — per-loan provenance is what makes an examination survivable.** For any loan, the system
must answer: which model touched it, what did it see, what did it output, **who reviewed that
output, and what did they do about it.** This is also the direct answer to the CFPB's position that
a complex model does not excuse a creditor from giving specific adverse-action reasons (§9).

---

## 6.21 Group CM — Commercialisation

**What this is.** The requirements that make this a **licensable product** rather than one lender's
internal tool (§1.6). They are all PROD-tier and all required.

| ID | Requirement |
|---|---|
| **CM-01** | ⭐ Tenant onboarding — a new lender configured **without engineering** |
| **CM-02** | Per-tenant branding, fee templates, plan codes, investors |
| **CM-03** | ⭐ Tenant-scoped credentials — **each lender's own agency and vendor accounts** |
| **CM-04** | SOC 2 controls **evidenced by the platform, not asserted** |
| **CM-05** | ⭐ Tenant data isolation **provable on demand** |
| **CM-06** | Versioned release train with tenant-level upgrade control |
| **CM-07** | Support model — tiers, SLAs, escalation, status page |
| **CM-08** | ⭐ Third-party POS slot — **open in both directions** |

⭐ **CM-03 is the one most easily missed.** Agency credentials (DU, LPA, FHA Connection, MERS) are
issued **per lender**. A platform that holds one set of credentials centrally cannot be licensed at
all. This has to be in the data model from the start.

⭐ **CM-08 exists because a licensee may already have a front end.** The seam
(`INTEGRATION_version1.0.0`) must be an open contract in both directions, not a private channel
between two halves that only work together.

---

## 6.22 Group MB — The mobile companion

⭐⭐ **The honest position, and the one this document commits to:** the LOS is a **desktop platform
with a deliberate mobile companion.** Some screens shrink. Some must not. **Saying which is which is
the design decision** — and a specification that promises "fully responsive" and ships a fee
itemisation squeezed into 390 pixels has lied while appearing complete.

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **MB-01** | ⭐ Task command centre on a phone — **the single most valuable mobile surface** | PILOT | required |
| **MB-02** | Pipeline read and search **by borrower last name** | PILOT | required |
| **MB-03** | Approvals and single-tap decisions | PROD | required |
| **MB-04** | Comment on a task | PILOT | required |
| **MB-05** | Conditions review — read, and clear with a note | PROD | required |
| **MB-06** | ⭐ Alerts **that carry consequence** — lock expiring, grace period ending, insuring aging, ICD unsent with closing inside seven days | PILOT | required |
| **MB-07** | E-sign internal and underwriting documents | PROD | desired |
| **MB-08** | ⭐ Desktop-only screens show **read-only plus the reason** | PILOT | required |
| **MB-09** | ⭐ The **backup-coverage day** designed for the phone | PROD | required |

**Belongs on a phone:** the task command centre · pipeline read-and-filter · approvals and
single-tap decisions · commenting on a task · conditions review (the judgment call, not the document
deep-dive) · consequence-carrying alerts · e-signature of internal documents · the status answer
(*"where is the Alvarez file and who has it"*).

⛔ **Does not belong on a phone, and the specification refuses to fake it:** the 2015 fee itemisation
· aggregate escrow setup · **the funding worksheet and net wire** · document packaging and stacking
· the full 1003 review · admin configuration.

⭐ **MB-08 is the rule that holds it together.** Where a screen is desktop-only, the phone shows a
**clear, useful read-only view plus the one action that makes sense** — usually *"assign this to
me"* or *"ask someone to do it."* It never shows a broken miniature of a desktop form. A blocked
action **states why**: *"Fee entry is desktop-only — open on a computer."* **That is respect, not a
limitation.**

⭐ **MB-09 makes it concrete.** When the closer is out and the Director of Operations steps in from
her phone, what she needs is: **see the queue, know what is urgent, reassign, and tell someone.**
Not to issue an Initial Closing Disclosure from a car. **Design the companion for that person on
that day.**

---

## 6.23 Group SM — The seam

**What this is.** The twelve requirements that make the POS and the LOS one system. They are
specified in full in `INTEGRATION_version1.0.0`; they are listed here so that the LOS build plan
carries them.

| ID | Requirement | Tier | Type |
|---|---|---|---|
| **SM-01** | MISMO 3.4 push, **idempotent by POS loan UUID** | DEMO | required |
| **SM-02** | Event subscription with the full event set | PILOT | required |
| **SM-03** | Signed webhooks with replay protection | PROD | required |
| **SM-04** | ⭐ **Reconcile to truth**, not delta application | PILOT | required |
| **SM-05** | Dead-letter queue surfaced to a human | PROD | required |
| **SM-06** | Daily reconciliation sweep with drift alerting | PROD | required |
| **SM-07** | ⭐⭐ **Published, versioned stage mapping table** | DEMO | required |
| **SM-08** | `LosAdapter` interface with **two** implementations | PILOT | required |
| **SM-09** | ⭐ The TRID trigger timestamp carried **across the seam** | PILOT | required |
| **SM-10** | ⭐⭐ **Synchronous, confirmed adverse-action automation halt** | PILOT | required |
| **SM-11** | Multi-tenancy mapping across both systems | PROD | required |
| **SM-12** | Sandbox parity — the full flow without a real borrower | PILOT | required |

⭐⭐ **SM-10 is the one to read twice.** When a file is denied or withdrawn, the POS's borrower
automation must stop — and the LOS must **know that it stopped**, synchronously and confirmed. An
asynchronous "we sent the event" is not sufficient, because the failure mode is a marketing message
reaching a borrower who was denied an hour ago. That is a fair-lending problem, not a bug.

---

# 7 · Non-functional requirements

Functional requirements say what the system does. These say **how well**, and they are just as
testable. Every one has an ID of the form `LOS-NFR-<AREA>-<n>`.

⚠️ **The LOS's non-functional profile is the opposite of the POS's in one important way.** The POS
is optimised for a nervous stranger on a phone. **The LOS is optimised for a trained operator at a
desk for eight hours.** Do not carry POS instincts across; §7.7 is where they diverge most sharply.

## 7.1 ⭐⭐ Density and the speed standard

This is the LOS's defining non-functional requirement, and it is stated first because it is the one
most often lost.

An operator sits at a desk, often at two monitors, for eight hours. They are not scrolling — they
are **scanning, comparing and typing.** For them, whitespace is not calm, it is **distance**: every
inch of padding is a row of the fee sheet they now have to scroll to reach.

| ID | Requirement | Target |
|---|---|---|
| **DEN-01** | ⭐ **Tabular data renders as tables** — real columns, alignment on the decimal, rows that scan. ⛔ **Not stacked cards**, which are a phone pattern that wastes 60% of a monitor. | Every grid surface |
| **DEN-02** | ⭐ **Row density** on grid surfaces — pipeline, task centre, fee itemisation | **40–60 visible rows** on a 1080p screen |
| **DEN-03** | Section navigation is hyperlinked and always visible | Every multi-section screen |
| **DEN-04** | ⭐ **The left rail stays while in a file.** Losing it to a hamburger menu on a desktop is a downgrade dressed as minimalism. | Every file screen |
| **DEN-05** | ⭐⭐ **The stopwatch: a full fee sheet in 5–10 minutes**, down from 20–25 today | **Acceptance criterion, not a sentiment.** A build that passes the feature test and fails the stopwatch has not passed. |
| **DEN-06** | Keyboard-first | Tab order follows **the form, not the DOM**. Enter commits. Numeric fields take a number without a mouse. |
| **DEN-07** | No modal for the common case | The individual-fee box refines a fee; it is not where every fee must be entered |

**Test for DEN-02:** if a closer has to scroll to see the §1100 block while entering §800, **the
screen has failed.**

## 7.2 Performance

| ID | Requirement | Target | Verified by |
|---|---|---|---|
| **PERF-01** | Task command centre first render | **< 1.5 s** with a realistic dataset | Load test with seeded data |
| **PERF-02** | Loan Summary open | **< 1.5 s** | Load test |
| **PERF-03** | Grid render — pipeline at 5,000 files, task centre at 2,000 tasks | **< 2 s** p95, and the grid stays responsive while scrolling | Load test |
| **PERF-04** | Field-to-field response on the fee itemisation | **< 100 ms.** Perceptible lag here is what makes DEN-05 unreachable. | Instrumented |
| **PERF-05** | Search by borrower last name | **< 300 ms** p95 | Load test |
| **PERF-06** | Compliance gate evaluation | **< 2 s**, and never a silent timeout — a gate that fails open is worse than no gate | Test suite |
| **PERF-07** | API read / write | **< 300 ms** / **< 800 ms** p95 | APM |
| **PERF-08** | Document package assembly | Acknowledged **< 3 s**; assembly asynchronous with visible progress | Load test |
| **PERF-09** | Report and export generation | Interactive **< 5 s**; anything longer runs as a job with notification | APM |

## 7.3 Availability and reliability

| ID | Requirement | Target |
|---|---|---|
| **AVAIL-01** | LOS availability during business hours | **99.9%** |
| **AVAIL-02** | ⭐ Compliance gates **fail closed** | A gate that cannot evaluate **blocks and says so.** It never passes by default. |
| **AVAIL-03** | Graceful vendor degradation | A vendor being down degrades that function, is **visible on the working screen** (IN-14), and never corrupts file state |
| **AVAIL-04** | Idempotency | Every outbound call carries an idempotency key |
| **AVAIL-05** | Event delivery | At-least-once with consumer de-duplication; out-of-order reconciled |
| **AVAIL-06** | Dead-letter visibility | Failures land where **a human can see and act on them** |
| **AVAIL-07** | ⭐ Planned maintenance | Outside business hours, and **never during a CD delivery window or a funding day** |
| **AVAIL-08** | ⭐ Clocks survive an outage | A TRID, rescission, incompleteness or insuring deadline **does not pause because a service did.** Clock state is durable and recalculated on recovery. |

## 7.4 Scalability

| ID | Requirement | Target |
|---|---|---|
| **SCALE-01** | Volume | **50 → 5,000 loans/month is a configuration parameter, not a rebuild** |
| **SCALE-02** | Seats | Hundreds of operators across branches and regions |
| **SCALE-03** | ⭐⭐ Multi-tenancy is foundational | Tenant scoping on **every** record from the first migration. Not retrofittable, and §1.6 makes it a commercial requirement rather than a technical preference. |
| **SCALE-04** | Statelessness | Application services horizontally scalable, no local session state |
| **SCALE-05** | Asynchronous heavy work | Package assembly, exports, reconciliation sweeps and vendor calls run on queues |

## 7.5 Security

| ID | Requirement | Detail |
|---|---|---|
| **SEC-01** | ⭐⭐ Server-side authorisation, always | Every capability check on the server. **The tell that permissions are cosmetic is that a super-admin sees the same screen as everyone else.** |
| **SEC-02** | ⭐ Deny by default | A route is staff-only unless explicitly declared public. A new route that forgets to check anything **refuses**. |
| **SEC-03** | ⭐ Both checks, always | A capability check **and** a scope check. Holding `decision` does not entitle a seat to a file outside their scope. |
| **SEC-04** | Object-level authorisation | Every read of a loan verifies entitlement to **that** loan. An enumerable identifier with no ownership check is the defect class this prevents. |
| **SEC-05** | Encryption in transit | TLS 1.2 minimum, 1.3 preferred, including internal hops |
| **SEC-06** | Encryption at rest | All loan data; SSN and account numbers additionally field-level encrypted |
| **SEC-07** | Key management | Managed key service, rotatable, **never in source control**, never one master key for all data |
| **SEC-08** | MFA | Required for **every** staff seat, no exceptions by role |
| **SEC-09** | SSO | OAuth 2.0 / SAML against the corporate directory (RC-07) |
| **SEC-10** | ⭐ No PII in URLs, logs or analytics | SSNs never logged, never in a query string, never in an error message |
| **SEC-11** | Tenant isolation | Enforced at the data layer, **not by a `WHERE` clause a developer must remember** |
| **SEC-12** | ⭐ Wire-fraud controls | Verified payee, callback verification, account validation (RC-02). The largest single-loss risk in mortgage operations. |
| **SEC-13** | Watchlist screening | OFAC / SDN on **all parties**, not only the borrower (RC-01) |
| **SEC-14** | Upload safety | Type-verified, size-bounded, malware-scanned, served from a non-executing domain |
| **SEC-15** | Webhook hardening | Signature verification, replay protection, idempotency |
| **SEC-16** | Dependency and secret hygiene | Automated scanning; secret scanning that **blocks the commit** |
| **SEC-17** | Independent penetration test | Before launch and annually |
| **SEC-18** | SOC 2 Type II | ⭐ **Evidenced by the platform, not asserted** (CM-04) |
| **SEC-19** | Least privilege | Standing production data access is exceptional, logged and time-bound |
| **SEC-20** | Incident response | Written, tested, wired to the GLBA 30-day breach-notification posture |

## 7.6 Auditability and data integrity

| ID | Requirement | Detail |
|---|---|---|
| **DATA-01** | ⭐⭐ Append-only audit trail | Every field change, milestone, vendor order, condition, permission change, gate result and override. **No update path. No delete path.** |
| **DATA-02** | ⭐ One-action examination pull | The complete, timestamped story of any loan, exported in one action (CO-25) |
| **DATA-03** | ⭐ Auto-date on event; **never type a date** | Received, sent, viewed, signed, ordered, funded, purchased, registered, transferred — the system stamps them. **A date a human typed cannot support a compliance argument.** |
| **DATA-04** | Field-level lineage | Every value knows its source (DM-10) |
| **DATA-05** | ⭐ One data point, many views | The insuring log, the pipeline grid, the loan summary and the manager's report are **filtered views of one loan object.** If two of them can disagree, the system is broken. |
| **DATA-06** | Configuration is versioned | Fee templates, business rules and gates carry version history and a change audit (AD-10) |
| **DATA-07** | Backups | Encrypted, geographically separated, with **restores actually tested** |
| **DATA-08** | ⚠️ Transactional integrity | Paired writes must both succeed. **The reference build's storage engine has no transactions** — see §8 and §11 G3. |

## 7.7 ⭐ Device and platform — where the LOS diverges from the POS

| ID | Requirement | Detail |
|---|---|---|
| **DEV-01** | ⭐⭐ **Desktop-first, by decision** | Processors, underwriters, closers and funders work a file at a computer. A tablet at worst. **Never a phone.** Dense desktop layouts are **correct** here. |
| **DEV-02** | ⭐ A phone is redirected, not degraded | Real work screens send a phone to `/los/desktop-only` with a reason. This is a **declared non-surface**, not a failure. |
| **DEV-03** | The mobile companion is a separate product surface | Four read-mostly panels (MB-01 to MB-09). It is not "the LOS, smaller." |
| **DEV-04** | ⛔ Named phone exclusions | The 2015 fee itemisation · aggregate escrow · **the funding worksheet and net wire** · document packaging · the full 1003 review · admin configuration |
| **DEV-05** | Browsers | Current and previous major versions of Chrome, Edge, Firefox and Safari |
| **DEV-06** | Screen size | Designed for 1080p and above; usable at 1366×768 without horizontal scroll on primary grids |
| **DEV-07** | ⭐ Two-monitor use is a first-class case | Nothing may depend on a viewport-width assumption that breaks when a window is half a screen |

## 7.8 Accessibility and the eight-hour test

| ID | Requirement | Target |
|---|---|---|
| **A11Y-01** | WCAG 2.2 level AA as the floor | Independently audited pre-launch |
| **A11Y-02** | ⭐ Real focus states | Dense grids are unusable by keyboard without them |
| **A11Y-03** | ⭐ **No colour-only status** | An aging highlight needs a shape or a label too (PL-03) |
| **A11Y-04** | ⭐ Survives 125% Windows scaling | Without reflowing a grid into uselessness — the single most common accessibility failure in dense operational software |
| **A11Y-05** | Full keyboard operability of every grid | Including sort, filter, and row actions |
| **A11Y-06** | ⭐⭐ **The eight-hour test** | *Would a person be tired by this screen at 4pm?* **Contrast that is too high is as fatiguing as contrast that is too low.** |
| **A11Y-07** | ⭐ Errors state the rule and the cure | Not *"validation failed"*. Instead: *"Points and fees exceed the 5% QM limit — reduce by $312 or re-price. A cure task has been assigned to the closer."* |
| **A11Y-08** | ⭐ Industry words, correctly | A CD is **initial, revised, final or post-closing** — never "preliminary." There are no "tenants" in a mortgage file. **Wrong vocabulary on screen teaches new hires wrong vocabulary in front of borrowers and investors.** |

## 7.9 ⭐ Usability — the backup rule

| ID | Requirement | Detail |
|---|---|---|
| **UX-01** | ⭐⭐ **A trained person who did not build the file can use any screen** | Visible context — what stage, what is outstanding, what was requested and by whom — **not tribal knowledge held by whoever normally sits there** |
| **UX-02** | The task list is the day | Nobody opens a random file. The landing screen is tasks, never a file list. |
| **UX-03** | ⭐ Every field has a home | There is no "oops, forgot about this" page. **Orphan fields are how a system becomes unlearnable** — and how the same value gets entered twice, differently. |
| **UX-04** | A refusal names the next step | Which capability was required, and which seat holds it (§4.7) |
| **UX-05** | One screen at a time inside a file | Not one long scrolling page (§5.2) |
| **UX-06** | ⭐ **Acceptance test for UX-01** | Hand a colleague a file mid-stage **with no verbal briefing** and have them identify the next three actions **from the screen alone** |

## 7.10 Observability

| ID | Requirement | Detail |
|---|---|---|
| **OBS-01** | ⭐ Compliance-clock monitoring | Alert **before** a TRID, CD, rescission, incompleteness, insuring or funding-fee-remittance deadline is missed |
| **OBS-02** | ⭐ Override reporting | Every compliance-gate override reported to compliance **weekly** (CO-05) |
| **OBS-03** | Touch counts and cycle time instrumented | The §3.5 measures, from launch |
| **OBS-04** | Vendor health surfaced on the working screen | Not only on an operations dashboard (IN-14) |
| **OBS-05** | Distributed tracing | One operator action traceable end to end |
| **OBS-06** | Structured logs, no PII | SEC-10 holds absolutely |
| **OBS-07** | ⭐ Drift alerting on the seam | The daily POS↔LOS reconciliation reports **what it healed**, not merely that it ran |

## 7.11 Disaster recovery

| ID | Requirement | Target |
|---|---|---|
| **DR-01** | Recovery Time Objective | **4 hours** |
| **DR-02** | Recovery Point Objective | **15 minutes** |
| **DR-03** | Tested restore | At least annually, **with the result written down** |
| **DR-04** | Runbooks per failure mode | Including "the POS is unreachable", "the document vendor is down", "the pricing engine is down on a lock day" |
| **DR-05** | ⭐ Funding-day continuity | A funding cannot be silently deferred by an outage. Wires in flight, and their state, must be recoverable and reconcilable. |

## 7.12 Maintainability and testability

| ID | Requirement | Detail |
|---|---|---|
| **MAINT-01** | Vendors sit behind adapters | Including `LosAdapter` in the reverse direction for a third-party POS (CM-08) |
| **MAINT-02** | API-first, versioned | Breaking changes are versioned, never shipped in place |
| **MAINT-03** | ⭐⭐ Dedicated test suites for the violation surfaces | **The three compliance gates**, the **TRID clock**, the **tolerance engine**, and the **wire release**. These do not share coverage with ordinary features. |
| **MAINT-04** | Rules are testable in staging before going live | AD-11 |
| **MAINT-05** | Sandbox parity | The full flow, including the seam, without a real borrower (SM-12) |
| **MAINT-06** | ⛔ Synthetic data only outside production | **Real borrower data never enters a development or test environment.** |
| **MAINT-07** | ⭐ Browser-executable acceptance script | Click-by-click, **role-by-role**, expected-versus-actual, that a non-engineer at CLEAR can run. This is the acceptance gate. |
| **MAINT-08** | ⭐ The cold-start test is automated where it can be | UX-06 as a scripted scenario per role |

---

# 8 · The data model

## 8.1 Core entities

The loan object is the spine. **Every screen is a view onto it**, and a value entered at its source
flows outward and is never re-typed.

```
   Tenant
     └── Branch ── Region
           └── User ──(Role[], NMLS number, licensed states + expirations, scope)
                 ├── Coverage (covers → seat, from → to, reason)
                 └── assigned to ──▶ Loan

   Loan ─────────────────────────────────────────────────────────────────
     ├── Borrower[]              ├── Fees ──(LE §, CD §, tolerance bucket,
     ├── Property               │           finance-charge flag, paid-by,
     ├── Income / Employment    │           can-shop / did-shop)
     ├── Assets                 ├── Conditions ──(PTA | PTD | PTC | PTF, source tag)
     ├── Liabilities            ├── Documents ──(label, bucket, version)
     ├── Program + PlanCode     ├── Tasks ──(owner, due, source, comments)
     ├── Lock                   ├── VendorOrders
     ├── Investor               ├── Milestone / StateHistory
     ├── MERS / MIN             ├── Disclosures ──(sent, received, signed)
     ├── ⭐ QCReview            ├── ComplianceGateResult ──(gate, pass/fail, override)
     └── ⭐ LinkedLoan ─────────┴── AuditEntry  (append-only)
```

## 8.2 ⭐ The two entities the prior blueprint omitted

| Entity | Why it must be first-class |
|---|---|
| ⭐ **`LinkedLoan`** | A true **second lien with its own loan number**, linked to the first, with its own TRID document set. A down-payment-assistance or piggyback second **is not a credit line on the 1003.** The current system can create a standalone second but cannot link it, so the second is **invisible on the funding screen.** It must populate the funding worksheet (FU-03). |
| ⭐ **`QCReview`** | Pre-close and post-close quality control as a **real object on the loan**, not a spreadsheet beside it. Reviewer independence (QC-05) is checked against the loan's actual touch history, which requires the review to live on the loan. |

## 8.3 ⭐ The identity model in data

Three separate things (§4.1), and the schema must keep them separate:

| Concept | Entity | Note |
|---|---|---|
| **Person** | `User` | May hold **more than one role** |
| **Role** | `Role[]` on the user | A role does not imply a scope |
| **Scope** | `scope` on the user | Own · Branch · Regional · National |
| ⭐ **Coverage** | `Coverage` | **Time-bounded**, with a reason, and it **expires on its own.** Every act taken under it is stamped as such. |

⛔ **Coverage is not a permission edit.** A system that implements coverage by temporarily adding a
capability to a user has lost the ability to answer *"why did a Post-Closer issue closing documents
on 14 March?"* — which is precisely the question an examiner asks.

## 8.4 ⭐ The fee is the most structured object in the system

A fee is not a name and an amount. Each fee carries, as **computed properties, not manual
classifications**:

| Property | Why |
|---|---|
| **Fee name**, from a controlled list | ⭐ Free-hand names destroy the tolerance engine (FE-02) |
| **LE section** and **CD section** | Shown on the fee box itself (FE-04) |
| **Tolerance bucket** — zero, 10%, or unlimited | ⭐ **Computed** (CO-09), so it cannot drift from the name |
| **Finance-charge flag** | Auto-flagged with an admin override (FE-07) |
| **Paid-by** | Borrower, seller, lender, other |
| **Can-shop / did-shop** | Drives the bucket and the service-provider list |
| **Authorising act** | ⭐ The pre-ITP fee gate (CO-07) is enforced against this |
| **Change history** | Every change stamped with actor, from-value and to-value |

## 8.5 Modelling rules that are requirements

| # | Rule | Why |
|---|---|---|
| 1 | **Every record is tenant-scoped** | SCALE-03; and §1.6 makes it commercial, not merely technical |
| 2 | ⭐ **Credentials are tenant-scoped** | CM-03. Agency credentials are issued per lender. A central credential set cannot be licensed at all. |
| 3 | **The audit trail is append-only** | No update path, no delete path |
| 4 | ⭐ **Dates are stamped by the system, never typed** | DATA-03 |
| 5 | **Compliance gate results are immutable, including overrides** | AU-02 |
| 6 | **Configuration is versioned** | AD-10 — a fee template and a business rule change what the software does |
| 7 | **One data point, many views** | DATA-05. If the insuring log and the manager's aging report can disagree, they are not the same query. |
| 8 | ⭐ **Conditions are addressable** | `#need-bank2` must resolve to a row |
| 9 | **The POS's stage is mirrored from here, never computed there** | §1.4 |
| 10 | ⭐ **A pre-approval letter is a frozen copy** | Changing the loan amount does not change an issued letter |

## 8.6 ⚠️ A note on the storage engine

The reference build stores data in a key-value store that **has no transactions.** That was a
reference-implementation convenience and it is **explicitly not a recommendation.**

The LOS has more paired writes than the POS, and several of them are consequential:

- A **compliance gate result** and the **milestone change** it permits.
- A **fee change** and the **tolerance-bucket recomputation** it triggers.
- A **condition clearing**, the **task it closes**, and the **next role's task it fires**.
- A **wire release** and the **PTF conditions** that authorised it.
- A **MERS transfer**, the **goodbye letter** and the **payoff**, on Purchased.

Production requires either a transactional store or an **explicitly designed and reviewed
compensating pattern** for each of these. This is named in §11 as an open decision because it
belongs to the implementation team — but **leaving it undecided is not an option.**

---

# 9 · Compliance requirements

⚠️ **Standing caveat, binding on the whole section.** This is a product specification, not legal
advice. Every control is reviewed and signed off by CLEAR's compliance counsel before launch. Where
counsel's decision is outstanding, §11 names it rather than guessing.

⭐⭐ **The governing principle of the LOS's compliance posture, stated once:**

> **Gates block. They do not warn.** A warning is a suggestion, and a suggestion at the moment
> somebody is trying to ship is a suggestion that gets ignored. See §6 group CO.

## 9.1 The compliance map — rule to control

| Regime | The rule, short | The control |
|---|---|---|
| **TRID (Reg Z + RESPA)** | LE in 3 business days; Intent to Proceed; CD 3-day rule; tolerances | CO-06 to CO-10, the COC engine (CL-09), `/los/coc` |
| **Reg Z §1026.19(e)(3)** | Tolerance baselines — zero, 10%, unlimited | ⭐ CO-09, as **computed** fee properties |
| **Reg Z §1026.4** | Finance-charge classification | FE-07 |
| **Reg Z §1026.43 (ATR/QM)** | Ability to repay; points-and-fees limits | CO-11, `/los/atrqm` |
| **HOEPA §1026.32** | Federal high-cost thresholds, plus state and local | CO-12 |
| **HPML §1026.35** | Rate-spread test **and its escrow consequence** | CO-13 |
| **Reg Z §1026.23** | ⭐ Right of rescission on applicable refinances | RC-10, and why Closed ≠ Funded |
| **RESPA §1024.17** | Escrow analysis, aggregate accounting, cushion | `/los/escrow`, CL-01, CL-02 |
| **RESPA §1024.20** | Homeownership counselling list | `/los/counseling` |
| **ECOA / Reg B** | Adverse action, incompleteness, counteroffer, valuations | CO-17 to CO-20, `/los/adverse`, `/los/appraisal` |
| **HMDA / Reg C** | Collection and the LAR, with edit checks | CO-16, `/los/hmda` |
| **LO compensation rules** | Compensation may not vary with loan terms | CO-14 |
| **NMLS** | Licensing, and the Mortgage Call Report | AD-02, RC-03 |
| **GLBA Safeguards** | Security program, MFA, encryption, breach notice | §7.5 |
| **OFAC / BSA** | Watchlist screening on all parties | RC-01 |
| **State law** | Texas A(6) and 50(a)(4); South Carolina attorney; permissible fees | AC-02, AC-03, WS-07 |
| **VA 38 CFR §36.4313** | Non-allowable fees | ⭐ GV-08, **enforced on the fee sheet** |
| **Agency / investor** | Insuring deadlines, delivery requirements, QC programme | PC-03 to PC-05, §6 group QC |
| **Records retention** | ECOA 25 months, plus HMDA, TILA and state | CO-23, CO-25 |

## 9.2 ⭐⭐ The three gates, restated

| Gate | Fires at | Blocks | Requirement |
|---|---|---|---|
| **#1** | Disclosure send | Initial disclosures and revised LEs | CO-01 |
| **#2** | Milestone change | Advancement, notably before Clear to Close | CO-02 |
| **#3** | Final document request | ⭐ **Issuance of closing documents** — it disables the Order Docs button (CZ-06) | CO-03 |

**On failure, a gate must do four things, not one** (CO-04):

1. **Block** the advance.
2. **Name the specific check.**
3. **Name the actual figure and the limit.**
4. **Drop a cure task on the correct role.**

And the result is stored, timestamped and **immutable**, including overrides (AU-02).

**The override, and why it exists** (CO-05): role-restricted, requires a typed reason, and **every
override is reported to compliance weekly.** ⭐ A gate nobody can pass in an emergency gets worked
around; a gate that records **who passed it and why** gets respected.

⚠️ **The verification debt, stated plainly.** Part of the check list in CO-11 to CO-16 originates as
a competitor's **published coverage summary**. That is a good scope statement and a poor
specification. **Before build, each line must resolve to a citation, an input, a threshold and a
test case.** ⛔ **Coverage copied from marketing copy is not a compliance control** — and a system
that claims a check it does not perform is worse than one that claims nothing, because the shop then
relies on it.

## 9.3 ⭐ The TRID clock, and who owns which half

⚠️ **This is an open conflict, resolved provisionally. Read §11 D-02 before implementing.**

The three source documents disagree about who sends disclosures. The provisional split, which
satisfies all three concerns:

| Responsibility | Owner |
|---|---|
| ⭐ **Detect and timestamp the six-piece application trigger** | **POS** — the six pieces land there, so that is where "an application now exists" becomes knowable |
| ⭐ **Generate and deliver disclosures, through the document vendor** | **LOS** |
| ⭐ **Own the three-business-day deadline** | **LOS** |
| Log the whole sequence | **Both**, and the seam carries the trigger timestamp as a first-class event (SM-09) |

> ⭐⭐ **Whoever owns delivery owns the deadline.** That sentence is the whole point of the split.

**The pre-ITP fee gate (CO-07)** is enforced **at the data layer** on this side too: before Intent to
Proceed, the fee model accepts exactly one fee type — a bona fide, reasonable credit-report fee.
Every other fee is rejected by the model, not by a policy reminder.

**Business-day arithmetic** has two different definitions inside TRID. They are codified, never
approximated.

## 9.4 ECOA — the three outcomes with three obligations

`/los/adverse` exists because these are genuinely different, and systems that treat them as one
produce violations.

| Outcome | Obligation | Requirement |
|---|---|---|
| **Denied** | Adverse-action notice within **30 days** of a completed application, with **specific principal reasons** — never a generic code | CO-17 |
| ⭐ **Counteroffer not accepted within 30 days** | **Becomes** an adverse action, and the notice is then due. **The timer everyone forgets, because the file still feels alive.** | CO-18 |
| **Incomplete** | A **notice of incompleteness naming exactly what is missing**, with a reasonable deadline — or an adverse-action notice. **Silence is not an option.** | CO-19 |
| **Withdrawn** | ⛔ **Not the same as denied.** All automation halts, on both. | CO-20, SM-10 |

⭐ **AI reason codes.** Where any model contributes to a decision, the principal reasons must be
**specific and accurate**. The CFPB has been explicit that *"the algorithm did it"* is not a reason.
This is why AI-11 (per-loan provenance) is a **required, PILOT-tier** requirement rather than a
nice-to-have: it is the evidence that satisfies this rule.

## 9.5 Valuations — Reg B §1002.14

| Obligation | Requirement |
|---|---|
| Notice of the right to receive a copy, within **3 business days of application** | `/los/appraisal` |
| ⭐ Copies of **every** appraisal and written valuation — **including AVMs and desk reviews** — delivered **promptly on completion, or ≥3 business days before consummation, whichever is earlier** | `/los/appraisal` |
| The applicant may waive the 3-day timing but must still receive copies at or before consummation, as **its own consented, timestamped act** | `/los/appraisal` |

⭐ **The screen logs every valuation, not just the appraisal.** This is the single most common way
the rule is breached — an AVM or a desk review is obtained, is not treated as a "valuation", and is
never delivered.

## 9.6 QC as a compliance obligation

Investors and agencies **require** a quality-control programme. §6 group QC is therefore not an
efficiency feature:

- A monthly draw at a configured percentage, with **random and discretionary composition enforced**.
- Pre-close and post-close reviews, with **agency deadline clocks**.
- ⭐ **Reviewer independence enforced against the file's touch history**, not against a role name —
  because the same person may have worn a different hat on that file three weeks ago.
- ⭐ A **rejected-application review queue**, which is an ECOA and fair-lending control, not a
  quality one.
- Findings → severity → corrective action → closure, and an agency-format export.

## 9.7 Records, retention and the examination

- Retention codified **per record type**: ECOA 25 months, plus HMDA, TILA and state requirements,
  retaining to the longest applicable.
- **Legal hold** freezes deletion on a matter, and the freeze is itself auditable.
- ⭐ **Investor-approval documents are retained for non-delegated *and* brokered loans** (CO-24).
  **Every document used to approve the loan with the investor must be in our file.**
- ⭐ **One-action examination pull** (CO-25): the complete, timestamped story of any loan, exported
  in a single action.

## 9.8 The audit trail as the product's spine

Not plumbing. It is what makes every claim in this document provable:

Every field change, milestone, vendor order, condition, permission change, gate result, override,
coverage act, and wire release — **append-only**, with actor and timestamp, reconciled against the
document vendor's own disclosure trail (AU-03).

⭐ **This is how CLEAR proves the gates held, the clocks were honoured, and the person who released
the wire was entitled to.** It is also, per §1.6, part of what makes the platform licensable: CM-04
requires SOC 2 controls **evidenced by the platform, not asserted.**

---

# 10 · Integrations

⭐ **The design goal of this entire section, in one sentence: zero external portal logins.** Today an
operator hops between FHA Connection, the GSE UCD portal, MERS, investor portals and a document
vendor. Every hop is a re-key, a delay, and a place a value diverges.

## 10.1 The integration map

```
                            ┌──────────────────────────┐
     POS  ◀────seam────────▶│        NACHO LOS         │
   (INTEGRATION_v1.0.0)     └────────────┬─────────────┘
        ┌──────────┬──────────┬──────────┼──────────┬──────────┬──────────┐
        ▼          ▼          ▼          ▼          ▼          ▼          ▼
     Credit      AUS       Document   Appraisal   Title       MI        Fraud
    + flood   (DU / LPA)    vendor    + XML                            + 4506-C
     + VOE                (LE/CD/docs)
        │          │          │          │          │          │          │
        └──────────┴──────────┴────┬─────┴──────────┴──────────┴──────────┘
                                   ▼
        ┌──────────────┬───────────┴────────────┬──────────────────┐
        ▼              ▼                        ▼                  ▼
   FHA Connection   MERS                   GSE UCD           Investors
   (case #,      (register,              (collection)      (Investor Connect:
    CAIVRS,       transfer,                                  delivery, purchase
    insuring)     eRegistry)                                 conditions, advice)
                                   ▲
                                   │
                            Pricing engine (plan codes, both directions)
```

## 10.2 The integrations

| # | Integration | What crosses | Requirement |
|---|---|---|---|
| 1 | **Credit vendor** | Credit report re-issue, flood determination, VOE | IN-01 |
| 2 | **AUS — DU and LPA** | MISMO 3.4 in, findings out; every run logged, the operative run marked | IN-02, PR-03, PR-04 |
| 3 | ⭐ **Document vendor** | **True sync — all fields, all programs.** Generates the LE, ICD and CD and the closing package. | IN-03, CL-10 |
| 4 | **MERS** | Register, transfer, and the eRegistry for eNotes | IN-04, EC-07, PC-10 |
| 5 | **FHA Connection** | Case number, CAIVRS, insuring | IN-05, GV-01 |
| 6 | **Appraisal** | Order out, **XML back and auto-populated** | IN-06, UW-04 |
| 7 | **Title** | Request through the LOS, with the action recorded | IN-07 |
| 8 | **Mortgage insurance** | Quotes and certificates; the non-delegated upload path | IN-08, and the Loan Summary MI panel (BS-01) |
| 9 | **Fraud** | Screening | IN-09 |
| 10 | **IRS transcripts** | 4506-C and SSA-89 ordering | IN-10 |
| 11 | **GSE UCD** | Collection, round-trip | IN-11, CL-11 |
| 12 | **Verification of assets** | — | IN-12 (desired) |
| 13 | ⭐ **Pricing engine** | **Plan codes in both directions** | IN-13 |
| 14 | ⭐ **Investor Connect** | Two-way delivery, purchase conditions back as routed tasks, Purchase Advice reconciliation | PC-06 to PC-09 |
| 15 | **Watchlist** | OFAC / SDN on all parties | RC-01 |
| 16 | **Flood** | Determination **and life-of-loan monitoring** | RC-09 |

## 10.3 ⭐ Rules that apply to every integration

| # | Rule | Requirement |
|---|---|---|
| 1 | **Idempotency keys on every outbound call** | AVAIL-04 |
| 2 | **Exponential-backoff retries with a dead-letter queue a human can see** | AVAIL-06 |
| 3 | ⭐ **Integration health visible on the screen where the work is happening** — not only on an operations dashboard | IN-14 |
| 4 | ⭐ **A vendor being down never corrupts file state.** It degrades that function and says so. | AVAIL-03 |
| 5 | **Inbound webhooks are hardened** — signature verification, replay protection, idempotency | SEC-15 |
| 6 | ⭐ **Every vendor response is recorded in the file**, not merely acted upon | PR-01 |
| 7 | **Every integration sits behind an adapter** — the vendor choice must stay reversible | MAINT-01 |
| 8 | **Full sandbox parity**, including the seam | MAINT-05, SM-12 |
| 9 | ⭐ **Tenant-scoped credentials** — each lender's own agency and vendor accounts | CM-03 |

## 10.4 ⭐⭐ The credential checklist — CLEAR's responsibility, not the developer's

**Every one of these is sourced by CLEAR and none can be unblocked by writing code.** This exact
category of gap has stalled prior mortgage builds, so it is named explicitly and tracked in §11.

| Credential | Needed for | Lead time |
|---|---|---|
| **Fannie Mae DU** (via Desktop Originator) | IN-02 | ⭐ Long — start first |
| **Freddie Mac LPA** (server-to-server) | IN-02 | ⭐ Long |
| **FHA Connection** access | IN-05, GV-01 | Long |
| **MERS** organisation ID, plus eRegistry and eVault | IN-04, EC-03, EC-07 | ⭐ Long |
| **GSE UCD** collection access | IN-11 | Long |
| Credit vendor account | IN-01 | Medium |
| Document vendor account, **with all programs enabled** | IN-03 | ⭐ Medium — and the "all programs" part is the one that gets missed |
| Appraisal management account | IN-06 | Medium |
| Title vendor integration | IN-07 | Medium |
| MI provider accounts | IN-08 | Medium |
| Fraud vendor account | IN-09 | Medium |
| IRS transcript vendor | IN-10 | Medium |
| **Pricing engine** credentials | IN-13 | ⭐ Also blocks the POS entirely — see `POS_version1.0.0` §11 D1 |
| Investor delivery credentials, per investor | PC-06, PC-07 | ⭐ Ongoing, one per investor |
| Flood vendor account | RC-09 | Medium |
| Watchlist screening | RC-01 | Short |

⚠️ **The agency credentials are the critical path.** DU, LPA, FHA Connection and MERS each require an
institutional application, not an API key purchase. **Start them before the first line of
integration code is written**, because no amount of engineering shortens them.

---

# 11 · Open decisions, conflicts and known gaps

⭐ **A specification that hides its own uncertainty cannot be trusted on the parts it is confident
about.** Nothing here is padding. Each item names what is undecided, who decides it, and what it
blocks.

## 11.1 ⚠️ Conflicts — where source documents actively disagree

These need settling **by a person, before code**, not by whichever developer writes it first.

### ⭐⭐ D-02 · Who sends disclosures

Three sources give three answers:

| Source | Position |
|---|---|
| **The Director of Operations**, verbatim | *"Currently the LO sends initial disclosures and revised LEs while the ICD is sent by the Closer — my team/processor sends the Revised LE if needed and closer sends ICD. **ALL are sent in the LOS — not the POS.**"* |
| **The prior NachoLOS blueprint** | The LO sends initial disclosures from the POS / LO Portal |
| **The POS specification** | Assumed a POS-side delivery experience with the TRID trigger timestamped there |

**Recommendation, for the decision-maker to accept or reject: follow the Director of Operations.**
She is describing what a licensed shop does today under an existing compliance regime, and
**disclosure delivery is not a place to introduce novelty for architectural tidiness.**

**The provisional split now written into §9.3:** the **POS** detects and timestamps the six-piece
trigger; the **LOS** generates, delivers and **owns the three-business-day deadline**; both log; the
seam carries the trigger timestamp as a first-class event.

⭐ **Whoever owns delivery owns the deadline.**

**Blocks:** the disclosure screens on both sides, and SM-09.

### D-06 · The brokered channel

⚠️ **Absent from the prior blueprint entirely**, which leaves roughly **one loan in eight** with no
home in the system. Source material exists — a Broker Milestone Process and a Broker Channel Process
document — and has not been incorporated.

**At minimum it needs:** a distinct milestone path, a distinct disclosure-responsibility model,
distinct compensation handling, and retention of the approval documentation (CO-24).

**Blocks:** PR-09 and the channel dimension of AD-13.

## 11.2 Decisions that require CLEAR, not engineering

| # | Open decision | Blocks |
|---|---|---|
| **D1** | ⭐ **The agency credentials** — DU, LPA, FHA Connection, MERS. Institutional applications, not API-key purchases. | IN-02, IN-04, IN-05, and the entire government path. **Critical path — start before any integration code.** |
| **D2** | ⭐ **Pricing engine credentials.** Also blocks the POS entirely. | IN-13, and the POS's payment playground |
| **D3** | The rest of the credential checklist (§10.4) | The corresponding integrations |
| **D4** | ⭐ **The real branch and region structure.** No authoritative branch list exists in the source material and **no NMLS branch IDs are recorded.** Any grouping in the reference build is a placeholder. | §4.5 scope, PL-02, AD-02, and every manager view |
| **D5** | **The investor list and per-investor delivery profiles** | PC-06, PC-07, AD-06, AD-12 |
| **D6** | **The QC sampling percentage and plan** | QC-01, QC-02 |
| **D7** | **Which document vendor**, and confirmation that **all programs** are enabled on the contract | IN-03 — the "all programs" clause is the one that gets missed |
| **D8** | **The transactional storage decision** (§8.6) | Owned by the implementation team, but **leaving it undecided is not an option** |

## 11.3 Decisions that require compliance counsel

⚠️ Each is a place where the engineering team must **not** infer an answer.

| # | Question | Blocks |
|---|---|---|
| **C1** | ⭐⭐ **The compliance check list must resolve to citations.** Part of CO-11 to CO-16 originates as a competitor's published coverage summary. **Each line needs a citation, an input, a threshold and a test case** before it is built. | The scope of gates #1–#3. ⛔ **Building to the list as written produces a system that claims a check it does not perform.** |
| **C2** | **State-specific condition and fee rules** beyond Texas and South Carolina — which states, which rules | AC-02, AC-03, WS-07, WS-12 |
| **C3** | **The override policy** — which roles, which gates, and what the weekly report must contain | CO-05 |
| **C4** | **Retention schedule sign-off** per record type | CO-23 |
| **C5** | **The AI governance framework's six elements**, as counsel wants them expressed | AI-09, AI-10 |

## 11.4 ⚠️ Open requirements from the subject-matter expert

These are live and unresolved. Two of them are substantial.

### ⭐⭐ Q3 · The Loan Summary specification is incomplete

The specification for the Loan Summary screen (§6 BS-01) was **cut off mid-sentence at capture**,
immediately after the subject-property address field. Everything from the remainder of the Subject
Property section onward is **missing.**

⛔ **It has not been guessed, and it must not be.** Her own framing of this screen — *"the meat and
potatoes, the story of the file; if things are incorrect here the disclosures will go out
incorrectly"* — is exactly why inventing the remainder would be the wrong kind of helpful.

**What is specified and buildable now:** borrowers and contact information · loan number · terms of
the mortgage including the ARM panel, the separate Term field and the dual %/$ down payment ·
refinance types and their LTV-only path · the full mortgage-insurance panel · note rate · escrow
waiver · the subject-property address with valid/invalid.

**What is outstanding:** the rest of the Subject Property section, and any sections that followed it.

**Blocks:** completion of BS-01 only. Build what is specified and leave the section extensible.

### Q4 · The in-file navigation correction

The loan file currently renders as **one long scrolling page** with sections stacked on it. The
correction is recorded in §5.2 and is unambiguous in principle — one screen at a time, reached from
a persistent left rail. **Two placement details remain open:**

1. **Life of a Loan** is to be removed from beneath the Loan Summary (it already lives on the Tasks
   screen).
2. **File Contacts** moves onto the Loan Summary and comes off the rail.

The **final rail order** is still being walked through screen by screen by the subject-matter
expert. **Blocks:** the rail configuration, not the navigation model.

### Q5 · Seat roster details

Several real people's name spellings, and one instruction that did not transcribe cleanly, are
outstanding before any roster is typed into a production system. **Blocks:** seeding real seats. It
does not block the roles or capability model, which are settled.

## 11.5 Known gaps in the reference build

Stated rather than hidden, so nobody reads a working demo as a finished product.

| # | Gap | Consequence |
|---|---|---|
| **G1** | ⭐ **It transmits nothing.** No email, no SMS, no wire, no investor delivery, no agency filing. Every send is modelled and recorded as *owed*. | Deliberate — every integration seam is **unwired rather than half-wired**, which is the safer state to hand over. But **no delivery path in §10 has been exercised against a live vendor.** |
| **G2** | **The loan files are demo data.** | Correct and required (MAINT-06). §7.2 figures are targets, not measurements. |
| **G3** | ⭐ **The storage engine has no transactions.** | See §8.6. The LOS has more consequential paired writes than the POS. **Must be decided, not inherited.** |
| **G4** | **Branch → region groupings are placeholders.** | See D4 |
| **G5** | ⭐ **A live defect: an anonymous read of a loan by ID returns borrower information.** | An object-level authorisation failure (§7 SEC-04). **This is the first thing to fix**, and it is named here rather than quietly patched because the *class* of defect matters more than the instance. |
| **G6** | **`/los/worksheets` carries a claim the page had to withdraw**, kept visible rather than deleted. | Correct behaviour — preserve it. A retracted claim left visible is how a team stops re-making the same wrong assumption. |
| **G7** | **QC module is specified but thinly built.** `/los/qc` states its own honest ordered list of what it still needs. | Group QC is entirely PROD-tier; this is sequencing, not a surprise. |

## 11.6 Assumptions

If any of these is false, say so — several change the design rather than the schedule.

1. **The LOS is the system of record for loan status and for underwriting decisions.** The POS
   mirrors. If this inverts, the seam changes shape entirely.
2. **Servicing is released.** No retention. This closes the scope cleanly and stays closed.
3. **Three channels: retail, non-delegated correspondent, brokered.** US only, 1–4 unit.
4. ⭐ **The platform will be licensed to other lenders.** This is why multi-tenancy and tenant-scoped
   credentials are foundational rather than phase two.
5. **The LOS is desktop-first, with a deliberate mobile companion** — not a responsive version of
   itself.
6. **Real borrower data never enters a non-production environment.**
7. **The closer and funder are one seat; the post-closer is the designated backup.** Coverage
   handles everything else.

## 11.7 How an open item gets closed

An item leaves this section when it is answered **in a numbered section of a numbered version** —
not in a message, a call, or a comment. The answer moves into the body, the item is struck, and the
change appears in the changelog. **If it is not in a numbered section of a numbered version, it did
not happen.**

---

# 12 · Change control, versioning and appendices

## 12.1 ⭐⭐ How this document changes

The subject-matter experts will keep refining these requirements. That is normal and expected. What
kills a build is not changing requirements — it is **untracked** changes.

**1 · Every change gets an ID.** `CHG-001`, forever, never reused.

**2 · A change record has a fixed shape:** ID · date raised · status (`draft` → `ready` → `sent` →
`accepted` / `rejected` / `superseded`) · area (POS or LOS, and the exact §-number and screen) ·
**Today** (what it does now) · **Wanted** (what it should do) · **Why** (the business reason —
**this is what stops a developer "fixing" it wrong**) · priority · acceptance criteria · mockup.

**3 · ⭐⭐ Changing your mind creates a NEW version, never a silent edit.** `CHG-014` becomes
`CHG-014 v2`, and the old text stays visible, marked superseded.

> **The development team must never find that a specification they already read has quietly changed
> underneath them.** This is the single most important rule in this section.

**4 · One dated artefact per batch** — a changelog of only what is new, plus the current full
document.

**5 · If it is not in a numbered section of a numbered version, it did not happen.**

## 12.2 Version numbering

| Bump | When | Example |
|---|---|---|
| **PATCH** — 1.0.**x** | A description corrected or sharpened. **No behaviour changed.** | A requirement's wording clarified; an open item answered with no new work |
| **MINOR** — 1.**x**.0 | Something new exists. Nothing already handed over changed meaning. | A new requirement; a new screen; a new integration |
| **MAJOR** — **x**.0.0 | A contract already handed over changes meaning. | The stage table version changes; a capability moves between roles; a requirement is withdrawn |

**The three documents version independently** — except the seam. ⚠️ **A change to anything in
`INTEGRATION_version*` forces at least a MINOR bump in both POS and LOS**, because by definition
both halves are affected.

⭐ **A capability moving between roles is a MAJOR change**, not a minor one. §4.4 exists because
those separations are controls; moving one silently is exactly the kind of change this rule is
designed to catch.

## 12.3 Changelog

| Version | Date | What changed |
|---|---|---|
| **1.0.0** | 2026-09-01 | First delivery. The complete lender side: the mortgage primer, the role and capability model, all 278 functional requirements, the full non-functional set, the data model, the compliance map, integrations, and the open register — including the two unresolved conflicts (disclosure ownership, the brokered channel) and the incomplete Loan Summary specification, all named rather than guessed. |

## 12.4 Appendix A — Requirements by tier

**DEMO — 13.** DM-01 · TK-01, TK-02, TK-03, TK-08, TK-09, TK-11 · DC-09 · SM-01, SM-07 · BS-01,
BS-02, BS-06

**PILOT — 99.** The first supervised real loan. Notably includes the whole compliance-gate spine
(CO-01, CO-02, CO-04, CO-06 to CO-09, CO-11, CO-15, CO-17, CO-19, CO-20, CO-24), the wire-fraud
control (RC-02), OFAC screening (RC-01), the AI governance requirements (AI-09, AI-10, AI-11), the
fee-sheet stopwatch (FE-11), and the seam (SM-02, SM-04, SM-08 to SM-10, SM-12).

**PROD — 166.** Everything needed to fully replace the current system, including the entire QC
module, eClose, commercialisation, and the post-close and secondary groups.

⭐ **Tier is sequencing, not importance.** A PROD requirement is not optional; it is not needed to
fund the first loan. **Do not let a PROD item be quietly reclassified because it is hard.**

## 12.5 Appendix B — Compliance citation table

| Citation | Subject | Requirements |
|---|---|---|
| 12 CFR §1026.19(e)(1)(iii) | LE within 3 business days | CO-06 |
| 12 CFR §1026.19(e)(2)(i) | Fee restriction before LE and ITP | CO-07 |
| 12 CFR §1026.19(e)(2)(iii) | Documents not required before ITP | CO-07 |
| 12 CFR §1026.19(e)(3) | Tolerance baselines | CO-09, FE-04, FE-06 |
| 12 CFR §1026.19(f) | CD 3-business-day rule | CO-10 |
| 12 CFR §1026.4 | Finance-charge classification | FE-07 |
| 12 CFR §1026.23 | Right of rescission | RC-10 |
| 12 CFR §1026.32 | HOEPA high-cost | CO-12 |
| 12 CFR §1026.35 | HPML / rate spread, escrow consequence | CO-13 |
| 12 CFR §1026.43 | ATR/QM, points and fees | CO-11, `/los/atrqm` |
| 12 CFR §1002.9 | Adverse action, 30 days, specific reasons; counteroffer | CO-17, CO-18 |
| 12 CFR §1002.9(c) | Notice of incompleteness | CO-19 |
| 12 CFR §1002.14 | Valuations — right, delivery timing, waiver | `/los/appraisal` |
| 12 CFR §1024.17 | Escrow analysis, aggregate accounting, cushion | CL-01, CL-02 |
| 12 CFR §1024.20 | Homeownership counselling list | `/los/counseling` |
| Regulation C (HMDA) | Collection and the LAR | CO-16 |
| 38 CFR §36.4313 | VA non-allowable fees | GV-08 |
| Texas Constitution art. XVI §50(a)(6), §50(a)(4) | Cash-out limits, 2% fee cap | AC-02, AC-03, WS-07 |
| GLBA Safeguards Rule | Security program, MFA, encryption, breach notice | §7.5 |
| OFAC / SDN | Watchlist screening | RC-01 |
| SAFE Act / NMLS | Licensing; Mortgage Call Report | AD-02, RC-03 |
| CFPB Circulars 2022-03, 2023-03 | Specific adverse-action reasons from complex models | CO-17, AI-11 |

## 12.6 Appendix C — Glossary

See **§2.4, §2.10 and §2.11** for the full domain glossary. LOS-specific terms most likely to be
misunderstood:

| Term | The trap |
|---|---|
| **Milestone** | Carries an owner, a gate, and a task set. Not a status label. |
| ⭐ **Closed vs Funded** | **Separate**, because rescission sits between them on a refinance |
| **Withdrawn vs Denied** | ⛔ Different obligations. Not interchangeable. |
| **PTA / PTD / PTC / PTF** | Prior to Approval / Docs / Closing / Funding — **each gates a different thing** |
| **ICD** | Initial Closing Disclosure. ⛔ Never "preliminary". |
| **The 2015** | The fee itemisation, named for the year the form was adopted |
| **Tolerance bucket** | Zero, 10%, or unlimited. ⭐ A **computed** property, never typed. |
| **COC** | Change of Circumstance — a valid reason to re-issue and reset a baseline |
| **MIN** | The MERS identification number that prints on the Deed of Trust |
| **UCD** | Uniform Closing Dataset, delivered to the GSE collection solution |
| **Purchase Advice** | The investor's statement of what they actually paid |
| **Non-delegated** | We process; **the investor underwrites** |
| **Brokered** | We disclose and hand off |
| **Coverage** | ⭐ Time-bounded, logged, expires on its own. **Not a permission edit.** |
| **Representative score** | Middle of each applicant, then lowest of those — **program-configurable** |

## 12.7 Appendix D — Where this document came from

1. **The live build** — 53 LOS screens, the capability model, the stage spine and the enforced gates,
   read out of the running system rather than remembered.
2. **The subject-matter experts** — Christa Votaw's specifications and live review notes, and Sharon
   LittleJohn's operational blueprint and raw notes as the source of record for the line.
3. **Federal and state regulation**, cited inline and collected in Appendix B.
4. **The honest gaps** — where a source contradicted another, §11 says so; where a specification was
   truncated, §11 says exactly where.

⭐ Where a requirement exists because a real operator tripped over something — the pennies dropped on
FHA MIP, the one-off payee that must not become a vendor record, the security stripped on package
assembly, the defect log that says what it is not — **that history is preserved in the requirement
text on purpose. A control whose reason has been forgotten is a control that gets removed in the
next refactor.**

---

_NACHO LOS PRD · version 1.0.0 · issued 2026-09-01 · generated by `node assemble.mjs` — do not hand-edit._