APIv1.4.0-moat2026-06-08
Defensibility moat-widening · 4 migrations, 12 endpoints, 14 surfaces
- Defense Ledger tamper-evident signoff: every MLRO signature now binds to a SHA-256 hash over canonical-JSON of evidence_pack + narrative + decision + signoff payload (migration 164). New /api/v1/defense/{id}/verify endpoint recomputes the hash from the live row for examiner-grade tamper detection. Canonicalization algorithm published verbatim at /products/defense-ledger/verification so regulators can verify without trusting OilFlow.
- Pre-Deal data-class partitioning: predeal_checks gains a data_class column ('aggregable' | 'private') via migration 165. Set X-OilFlow-Data-Class: private to keep individual deals out of cross-customer aggregations. Bank Enterprise tier defaults to private. All cross-customer reader paths (precedents, pulse, defense generate peer context, counterparty_intel daemon) now filter aggregable-only.
- Customer cluster contribution: new cluster_submissions table (migration 166) + POST /api/v1/clusters/submit (auth) + POST /api/public/clusters/submit (anon, IP-rate-limited) + GET /api/v1/clusters/submissions/{request_id} (status). Admin triage at /admin/cluster-submissions promotes confirmed submissions into broker_scam_blocklist with provenance attribution to OilFlow's named investigator. Submitter never named publicly.
- Document-backed verified profiles: verified_profiles gains documents, reference_contacts, document_count columns (migration 167). The /api/v1/verified/submit endpoint accepts arrays of HTTPS-URL-validated supporting docs (UBO disclosure, company registration, reference letters, trade-history samples, licenses, audited financials) and reference contacts. Confirmed-fraud cluster cross-check rejects scammer self-verification; likely/suspected hits surface as soft-match flags in the admin queue.
- Verified counterparty self-update: POST /api/v1/verified/{slug}/update-documents lets approved counterparties refresh documents incrementally. Submitter-email match auth, IP rate-limited 3/hr, fires verified_profile.documents_updated webhook.
- 8 new webhook event types: cluster.contribution_accepted | _rejected | _duplicate, verified_profile.approved | _rejected | _documents_updated, defense_pack.signed | _rescinded. enqueueEvent now supports broadcast events (memberId: null) for cross-customer events.
- Embeddable Verified-by-OilFlow SVG badge at /verified/{slug}/badge.svg with 6h-fresh + 24h-SWR caching. Counterparties embed via <a><img></a> for inbound-link brand network effect.
- Public anyone-can-check lookup at /verified/lookup + GET /api/public/verified/lookup. D&B-style recommendation tier (block / caution / verified / unknown).
- Outlook task pane add-in scaffolded: sideloadable manifest at /outlook-addin/manifest.xml + Office.js task pane at /outlook-addin/taskpane. RM highlights a deal email, gets a sub-30s Pre-Deal verdict in the reading pane.
- Live transparency surfaces: /intelligence/clusters (live cluster directory), /intelligence/corpus-metrics (live aggregations across 5 corpus tables, refreshed every 30 minutes), /intelligence/simar-chahal-cluster (flagship CEO-impersonation teardown).
- Email notifications fire on every triage outcome (cluster accept / reject / duplicate, verified approve / reject) via the existing Resend infrastructure. Closes the 'Wave B email worker' TODO.
- Terms of Service § 18 published: SKU #3 cluster contribution licensing, SKU #5 outcome telemetry license, SKU #6 MLRO attestation binding. 30-day customer notice cycle begins on TOS rollout email send.
- Stripe SKU: oilflow_verified_counterparty_plus at $499/yr (USD/EUR/GBP/AED). First 1,000 counterparties remain on permanent free Tier 0; subsequent default to paid Verified+.
Affected endpoints
- GET /api/v1/defense/{id}/verify
- POST /api/v1/clusters/submit
- GET /api/v1/clusters/submissions/{request_id}
- POST /api/v1/verified/{slug}/update-documents
- POST /api/public/clusters/submit
- GET /api/public/verified/lookup
- GET /verified/{slug}/badge.svg
- GET /intelligence/clusters
- GET /intelligence/corpus-metrics
- GET /intelligence/corpus-metrics.json
- GET /intelligence/clusters/rss.xml
- GET /outlook-addin/manifest.xml
- GET /outlook-addin/taskpane