v0.12.0 — point-and-click spreadsheet setup

• Set up a lender's spreadsheet by pointing. Upload today's sheet, drag across each rate table and adjustment
  grid, click the effective date and each one-off adjustment, test it on the sheet, and save. The builder reads
  lock periods from the header row, terms from product names, and bands from labels like 780+, 60.01-75, and
  <620, and guesses which grid axis is credit score, LTV, or loan amount. No JSON needed; the JSON editor is
  still there for advanced templates (docs/IMPORT.md).
• Licensing at every step: a loan officer can't start a loan, or move an assigned loan's property, to a state
  they aren't licensed in (when their licenses are entered). Same rule in the app and the API. Closes the last
  open medium finding in the October 2026 security review.
• Fixes from the first end-to-end test on Render:
  • Sign-in limits and the sign-in log now see the visitor's real address on Render (OPENLOS_CLIENT_IP_HEADER,
    set by the Render deploy); before, everyone arriving through the same Cloudflare server was counted together.
  • Pricing fills in DTI from the 1003 (housing payment plus debts over income, rounded up), like LTV.
  • The spreadsheet import keeps the chosen file after a preview, so Import works without picking it again.
  • A new loan opens at the top of its page; "Add your company" opens the company form.
  • "1 lender" on the loan options disclosure; the credit panel reads right when no credit provider is set up.
• The website is now https://openlos.org. Hosting on Render is about $18 a month at Render's current prices.

Upgrading on Render: after you deploy, Render lists the new OPENLOS_CLIENT_IP_HEADER setting under
Blueprints → Syncs with an Approve button; approve it. Other hosts: nothing to change unless a CDN sits in
front (see "Visitor addresses" in docs/SELF_HOSTING.md).

Verify: git tag -v v0.12.0 and gh attestation verify oci://ghcr.io/openlos-project/openlos:0.12.0 --owner openlos-project (see docs/VERIFYING.md).

v0.11.0 — security review

An internal review of every area of the app; the full list of what was checked, found, and fixed is in
docs/AUDIT-2026-10.md. Highlights:

• Workflow gates can't be skipped by moving a loan to Withdrawn and back out.
• Records stay put: loan history, the sign-in log, comp records, disclosures, credit authorizations and
  reports, AUS results, and rate sheets refuse TRUNCATE, and the last four refuse edits and deletes (migration
  0018).
• Two-step sign-in needs your password to turn on. Lost recovery codes can be replaced from Account security.
• Sign-in limits: a successful sign-in clears earlier failures; one address is limited across all emails;
  wrong passwords while signed in no longer lock you out of signing in.
• Setup codes are counted in the database and must be 16+ characters.
• Security headers on every page (Content-Security-Policy, no framing, HSTS, and more).
• Encryption keys: the app refuses to start with a key that can't read existing data, even before any loan
  has an SSN; key rotation never overwrites a value changed while it runs.
• Uploads: spreadsheets that lie about their size are refused; credit files can't stall the server;
  documents up to the full 25 MB now upload.
• TRID: a hand-edited application date can move the clock earlier, never later; calendar changes are
  logged; a closing inside the CD's wait is flagged even with no LE date on file.
• Pricing: sheets with no expiry are flagged after 36 hours and not priced after 7 days; comp plans can't be
  backdated or negative; LTV rounds up.
• Options disclosures keep the borrower, originator, and company as of archiving, and store a credit score
  band rather than the score; viewing one needs pricing access.
• Only loan officers and owners can be assigned to a loan; history records who it moved from.
• API: write-only keys no longer receive loan data back; outbound requests have an overall deadline;
  webhooks are never delivered twice by two instances.
• ORSF reference code updated to v0.4.1 (the spreadsheet import hardening).

Upgrading: migration 0018 runs on its own. Rate sheets with no expiry stop pricing after 7 days, comp plans
can't start in the past, and turning on two-step asks for your password. See "For self-hosters" in the review.

Verify: git tag -v v0.11.0 and gh attestation verify oci://ghcr.io/openlos-project/openlos:0.11.0 --owner openlos-project (see docs/VERIFYING.md).

v0.10.0 — design, first run, and the 1003 in steps

• Setup without the logs: the Render deploy asks for a setup code (OPENLOS_SETUP_CODE, 12+ characters);
  a new copy's first page asks for it and creates the owner account. The one-time log link still works. Wrong
  codes are limited (20 an hour pause code entry), and setup closes once any account exists.

• Get set up: a checklist on the pipeline for a new shop's owner (company and NMLS ID, a lender and rate
  sheet, the team, business days, two-step sign-in, the first loan), until it's done or hidden.

• The setup form keeps your name and email if something needs fixing.

• The 1003 in six steps: Loan & property, Borrowers, Assets & debts, Real estate & gifts, Declarations, and
  Payment & cash, with a sticky step bar. Moving between steps never loses anything; "Save and continue" saves
  as you go, and a new loan is created at the last step. A save that finds a problem opens the step it's on,
  marks the step in the bar, and every problem in the list links to its step. The current step is kept in the
  address, so it survives reloads.

• A new look across the app: system type (SF on Apple devices), Apple's gray and white surfaces, cards without
  borders, pill buttons, a frosted top bar, sentence-case labels, and a quieter demo banner.

• The loan page header shows the loan at a glance with Export and Pricing on the right; what's left before
  submission is a checklist; collapsible panels have clear headings.

• The pipeline shows its count and volume with a New loan button.

• TRID dates read as "Fri, Oct 30".

• The demo's landing page explains each role.

• Fresh screenshots in docs/screenshots.

Upgrading: pull and restart; no database migration. New copies on Render are asked for a setup code (OPENLOS_SETUP_CODE); existing copies don't need one. Step-by-step setup: https://openlos-project.github.io/start.html. Verify the tag with git tag -v v0.10.0.

v0.9.0 — credit and automated underwriting

• Credit on every loan (docs/CREDIT.md): record each borrower's authorization (required
  before any order or import), order through a credit provider or upload the vendor's MISMO credit file
  (2.3.1 or 3.4), scores by bureau with each borrower's middle score and the lowest as the qualifying score,
  which fills in Pricing, and open accounts not yet on the application added to the liabilities in one step.
• A provider interface for credit vendors, with a fictional Example Credit Bureau for the demo and testing
  (900–999 SSNs only; off outside the demo unless OPENLOS_TEST_CREDIT=true).
• AUS results (DU, LPA, GUS): record the recommendation, casefile number, date, and findings document.
• Readiness asks for a credit report (flagging one over 120 days old) and AUS findings.
• Credit is visible only to roles that see SSNs; the stored report is encrypted and included in key rotation;
  history and partner API events (loan.credit_authorized, loan.credit_received, loan.aus_recorded) never
  carry scores or accounts.
• Checked by an independent security review before release; its fixes: a report on anyone not on the loan is
  refused (scores were matched by position as a fallback), no qualifying score until every borrower has one,
  a cap on entries in a credit file (a crafted file could stall the server for ~50 seconds), each bureau's
  classic FICO score rather than its highest model, report and AUS dates can't be in the future, uploads need
  a length, the test bureau refuses ITIN-range numbers and never prices outside the demo, the scores summary
  is encrypted too, the browser gets only what the panel shows, and read-only users don't see credit events.
• The credit and TRID panels stay open or closed the way you left them after saving.
• The synthetic test loan's co-borrower number moved out of an ITIN range (900-45-4321).
• Migration 0017_credit_aus adds credit_authorizations, credit_reports, and aus_results.

Upgrading: pull and restart; migration 0017_credit_aus runs on start (Docker) or with npm run db:migrate. Owners, loan officers, and processors get the new credit.order permission. See docs/CREDIT.md. Verify the tag with git tag -v v0.9.0.

v0.8.1 — fix for upgraded installs

• Fixed: after upgrading to v0.7.0 or v0.8.0, opening a loan saved by an earlier version failed with a
  server error, because it lacked the fields v0.7.0 added. Loans now gain those fields' defaults when they're
  read, so the loan page, readiness checks, figures, and export work on older loans. Upgrade from v0.7.0 or
  v0.8.0 to this release.

If you're on v0.7.0 or v0.8.0, upgrade now: pull and restart. Verify the tag with git tag -v v0.8.1.

v0.8.0 — the TRID clock

Superseded by v0.8.1. After an upgrade, this release fails to open loans saved by earlier versions. Use v0.8.1 or later.

• TRID clock on every loan (docs/TRID.md): the application date (set automatically when
  the sixth piece of information arrives, in the office's time zone), Loan Estimate due three business days
  after, intent to proceed and the fee rule, a revised LE after a rate lock, the Closing Disclosure, and the
  earliest allowed closing from the seven-, four-, and three-day waits, with the mailbox rule. A planned
  closing date shows when the CD must be received and mailed.
• Business days both ways: the office's own days and time zone (Workflow → Business days) for the LE deadline,
  and every day but Sundays and federal holidays for the waits before closing.
• The pipeline board flags each open loan's most urgent TRID item ("LE due Oct 21", "CD overdue").
• Partner API: GET and PUT /api/v1/loans/{id}/trid, and loan.trid_changed events. Every change is in the
  loan's history; the automatic application date is recorded with the save that completed the application.
• The demo's loans carry dates that show each point on the clock.
• Checked by an independent review before release; its fixes: the application date can't be wiped or
  re-stamped by omission, unknown API fields and out-of-range dates are refused, deadlines for a Sunday or
  holiday closing, zero amounts don't make an application, any applicant's SSN counts, and US time zones only.
• Migration 0016_trid_clock adds the trid_clocks table.

Upgrading: pull and restart; migration 0016_trid_clock runs on start (Docker) or with npm run db:migrate. Existing loans that are already complete applications get their application date the next time they're saved; set it by hand on the loan page if it was earlier. Set your office's days and time zone under Workflow → Business days. See docs/TRID.md; it's a working aid, not legal advice. Verify the tag with git tag -v v0.8.0.

v0.7.0 — the full URLA, lender pages included

Superseded by v0.8.1. After an upgrade, this release fails to open loans saved by earlier versions. Use v0.8.1 or later.

• The rest of the 1003, on the loan form, in readiness checks, and in MISMO export and import:

  • Former addresses, mailing address, and rent (1a); employer address and phone, time in line of work, and
    previous jobs with their income (1b–1d); income from other sources (1e).
  • Real estate owned (Section 3), with each mortgage linked to its property.
  • Gifts and grants (4d).
  • Declarations (Section 5), with follow-ups for yes answers.
  • Military service (Section 7).

• Readiness now asks for two years of residence and employment history, every declaration, military service,
  rent when renting, links between mortgages and owned properties, and the subject property on a refinance. A
  VA loan needs a borrower with military service, and the checklist flags a primary borrower who won't occupy
  a primary residence.

• The rest of the URLA, including the lender pages:

  • 2a account types (mutual funds, stock options, bridge loan proceeds, trust accounts, life insurance cash
    value, and more); 2b other assets and credits (earnest money, proceeds, borrowed funds, employer assistance,
    lot, sweat, and trade equity, and others); 2d alimony, child support, and other expenses.
  • 4b other new mortgages on the property; 4c expected rent on a 2–4 unit or investment purchase.
  • L1 refinance type and program, renovation, construction-conversion, contract-for-deed, energy improvement,
    project type, and community property states; L2 title names, manner, estate, and leasehold expiration; L3
    ARM periods, loan features, and proposed taxes, insurance, MI, and dues.
  • L3 proposed monthly payment and L4 funds to close, worked out live on the loan form.

• Readiness adds the L1–L3 items and checks that assets and cash gifts cover the cash needed to close.

• The demo's loans are filled in to match, with purchase prices that fit each loan.

• ORSF updated to v0.4.0: spreadsheet uploads are checked for zip bombs before unpacking (a 2 MB .xlsx could
  expand to 500 MB and crash the server), and import templates are capped at 200,000 cells.

Upgrading: pull and restart (no database migration in this release; existing loans gain the new fields empty, so the readiness checklist will ask for them). Some new fields aren't in the MISMO export yet; see docs/MISMO.md. Verify the tag with git tag -v v0.7.0 (docs/VERIFYING.md).

v0.6.0 — compliance basics

• Pre-Loan Estimate statement: the loan options disclosure now opens with the Reg Z §1026.19(e)(2)(ii)
  statement in 12-point bold ("Your actual rate, payment, and costs could be higher. Get an official Loan
  Estimate before choosing a loan."), and names the broker and loan originator with their NMLS IDs.
• NMLS IDs and state licensing (Users → Company and licensing): the company's legal name, NMLS ID, and state
  licenses, and each loan officer's NMLS ID and licensed states. Exported in MISMO as the URLA L4 loan
  originator parties. Loans can't be assigned to someone licensed only in other states, the assign menu marks
  them, and the readiness checklist flags missing IDs and licenses. Changes are recorded in the sign-in log.
• URLA Section 8 demographic information on each borrower: ethnicity, race, and sex with subgroups, "declined"
  for each part, how it was collected, and visual-observation flags for face-to-face applications. The
  readiness checklist asks for it (declining counts as answered). Not used anywhere in pricing or routing, and
  not in the MISMO export yet (docs/MISMO.md).
• The demo seeds fictional NMLS IDs outside the issued range.
• Migration 0015_originator_licensing adds users.nmls_id and users.state_licenses.
• Security: postcss pinned to 8.5.30 (advisories reached through Next.js).

Upgrading: pull, then run migrations (npm run db:migrate, or restart the Docker image, which migrates on start). Verify the tag with git tag -v v0.6.0 (docs/VERIFYING.md).

OpenLOS v0.5.1

Credibility release: no app behavior changes beyond the demo's role page.

• Governance (GOVERNANCE.md): who decides, rules that don't change, and a continuity plan if the maintainer disappears.
• Signed releases: this tag and its commit are signed with the project SSH key (.github/allowed_signers). Docker images now carry signed build provenance from the build workflow (Sigstore). See docs/VERIFYING.md.
• FTC Safeguards Rule self-assessment (docs/SAFEGUARDS.md): each element of 16 CFR 314.4 mapped to what OpenLOS provides and what a shop must do, including known gaps.
• Architecture and self-hosting docs brought up to date.

Verify: git tag -v v0.5.1 with gpg.ssh.allowedSignersFile=.github/allowed_signers.

OpenLOS v0.5.0

Try it: https://openlos-demo.netlify.app (fictional data, no sign-up), or docker run --rm -p 3000:3000 -e OPENLOS_DEMO=true ghcr.io/openlos-project/openlos.

Highlights since v0.4.0:

• Live pricing straight from lenders through ORSF feeds (signed, per-broker keys), plus ORSF Publisher so any lender can publish without engineers.
• Best fit: pick the borrower's goal (lowest payment, lowest cost over the years they'll keep the loan, lowest cash to close, lowest rate) and OpenLOS names the loan and says why in dollars. Compensation is never a ranking factor.
• Product routing: conforming, high-balance, jumbo, FHA/VA/USDA, or non-QM, and which lenders take it; income documentation and DSCR in the scenario.
• Ways to price better: the smallest real changes (down payment, credit score band, DTI, lock) that would help the borrower.
• Partner API v1: scoped keys, loans in JSON or MISMO 3.4, stage moves, signed webhooks, event polling, OpenAPI.
• New design across the app, with light and dark mode.
• Security fixes from an internal review (SSRF guard for IPv6-embedded addresses, no PII guessing through updates, ordered events).
• Hosted demo mode for Vercel/Netlify, a published multi-arch Docker image, and spreadsheet import now shared with ORSF.

Still alpha, with no independent security review yet: don't use it with real borrowers yet. Full details in CHANGELOG.md.