# Status for S. Romer — ATTOM Middleware (2026-09-08)

**From:** Mukesh Ahuja / Inteligenz  
**Repo:** `https://github.com/Inteligenz-codebase/WestrockAttom.git`  
**Canonical checkout:** `C:\Users\ahuja\Westrock\WestrockAttom`  
**ShareSync checkout:** `Claude\Tech Tools\WestrockAttom`  
**HEAD (both copies):** `c157645` — *Add Step 1 API with scoped tokens and admin key management.*

This replaces the 2026-09-07 ShareSync-sync status note. That note is out of date.

---

## 1. What is no longer blocked

The previous status said the ShareSync git sync had not run, and that the three 2026-09-06 code fixes plus B.1–B.5 were still outstanding on Mukesh's end. That was the state of a session that could not start a shell. A shell is available now, and the check against both checkouts shows:

- **ShareSync and Westrock are on the same commit.** Both are `c157645`, tracking `origin/main`. The older `composer.lock` / missing handoff-docs gap is gone.
- **The 2026-09-06 Part A fixes are already in that commit** (landed 2026-09-07 as `fb5347e`).
- **Handoff #2 work is already in that commit** (`c649ca3` + `c157645`): NJ block/lot APN variants, Transportation Noise disabled, Step 1 `/api/v1` token API.

Nothing in this document overstates production. These commits are in the two local checkouts and on GitHub. They still need a deliberate deploy to `attom.westrockappraisal.com`.

---

## 2. 2026-09-06 memo — current status

### Part A — code fixes

| Item | Status | Evidence |
|------|--------|----------|
| **A.1** Unauthenticated `/api/getAddressdata` and `/api/salescomparables` | **Done in git** (`fb5347e`) | Both routes wrapped in session `auth`. Unauthenticated callers get 302 to `/login`. The later Step 1 machine API is a separate, token-gated `/api/v1/*` surface — see B.1. |
| **A.2** TLS verify disabled on ATTOM in `AttomSearchFallbackService` | **Done in git** for that service. **Follow-up done today (uncommitted)** for the remaining ATTOM `Http` callers | `AppServiceProvider` sets a real CA bundle via `composer/ca-bundle`. Remaining ATTOM `verify => false` overrides in controllers/services/console commands were removed today. Elasticsearch calls to the self-signed cluster **still** use `verify => false` on purpose (IP `ELASTIC_URL`). |
| **A.3** AddressNormalizer for hyphenated house numbers | **Done in git** | `13-27 Race Street` expands to `13 Race Street # 27` first. Queens `72-10` is not decomposed. `php artisan test --filter AddressNormalizerTest` — 11 tests, 18 assertions, all passing (re-run 2026-09-08). |

**Post-deploy still needed from A.3:** success rate over the next 50 production lookups. That number has not been collected yet.

### Part B — information

| Item | Status |
|------|--------|
| **B.1 Programmatic API** | **No longer blocking.** `/api/v1/property/resolve`, `.../verification-bundle`, `.../comparables`, `.../assessment-history` exist, Bearer-token gated, job-number required, logged. Issue a dedicated production token with `php artisan api:issue-token step1-client --step1` and send the plaintext once through a secure channel. Do not reuse a dashboard session. |
| **B.2 Comp population** | **Answered 2026-09-07.** This middleware exports a user-selected ATTOM shortlist, not the 100+ CoStar/Main365 population. Handoff #2 corrected the Oversight inference: ATTOM verifies **per parcel**, not per population. |
| **B.3 ATTOM Ts&Cs PDF §4.3** | **Still blocked.** `https://dla.attomdata.com/v2501.pdf` is behind ATTOM Contract Center. Caching design for raw JSON in the job folder cannot be signed off until that PDF is in `Claude_Private_Steve\`. |
| **B.4 Residential-only licence + unlicensed packages** | **Reported, not a build decision.** Schedule language is "residential real property." Escalate to Catherine Berlin (`catherine.berlin@attomdata.com`) and S. Romer. Building Permits command is not on the signed schedule. Transportation Noise is now **disabled by default** (`ATTOM_TRANSPORTATION_NOISE_ENABLED=false`). Parcel Tiles not in repo. |
| **B.5 Housekeeping** | **`nohup.out` done** (gitignored; rotated to `nohup.out.20260907.bak` on the Westrock machine only). **ShareSync has no `.env` and no `nohup.out`.** The Westrock checkout has a local `.env` (correct for a private working copy; it is gitignored). |

---

## 3. Handoff #2 / Handoff #3

Handoff #3 asked for the two finished Handoff #2 files to be dropped into ShareSync because GitHub was not reachable from the WestRock side.

**They are in the ShareSync tree now** (same commit). Copies and a patch are also in:

`Claude\Tech Tools\WestrockAttom\Claude outputs\Handoff3_Two_Pending_Fixes_20260908\`

- `ParcelLookupService.php` — NJ `{muni}-{block5}-0000-{lot5}` variants
- `attom.php` — Transportation Noise flag, default off
- `c649ca3_nj_blocklot_and_transportation_noise.patch` — apply only if production is *behind* `c649ca3`

Live-tested Handoff #2 result (dev): Bloomfield NJ Block **313** Lot **32** (not 1000/26) resolves to AttomId `190242422` / `13 RACE ST # 27` via ATTOM APN, without Elasticsearch.

---

## 4. What was done today (2026-09-08)

Verified both checkouts, confirmed HEAD match, then did the remaining safe work from A.2 and Handoff #3:

1. **Removed ATTOM `verify => false` overrides** in the live controllers/services (`PropertySearchController`, `ComparablesController`, `AreaLookupService`, `BatchLookupService`, `CountyLocationLookupService`, `TestController`) and removed hardcoded `ATTOM_API_KEY` fallbacks from console commands and those controllers. ATTOM calls now use the CA bundle from A.2. Elasticsearch self-signed calls were left unverified.
2. **Stopped a test view from echoing the ATTOM key** (`resources/views/testing/test.blade.php`).
3. **Copied those file-level fixes into the ShareSync checkout** so Steve's copy is not missing them.
4. **Repaired a ShareSync merge conflict in `bootstrap/app.php`.** A conflicted copy had dropped the Step 1 aliases `api.token` and `api.job` and kept only `internal.api`. Both sets of aliases are restored. Steve's credentials path (`Claude_Private_Steve\_CREDENTIALS`) is unchanged.
5. **Placed the Handoff #3 file drop** in `Claude outputs\Handoff3_Two_Pending_Fixes_20260908\`.

These TLS/key edits are **in the working trees, not committed, not pushed.** Say if they should go to GitHub.

**Key-rotation recommendation:** a fallback ATTOM API key had been hardcoded in many PHP files and was in git history. The fallback is removed from the working tree. The key that was in source should be rotated with ATTOM; git history still contains it.

---

## 5. ShareSync working-tree caveats (do not treat as clean production)

On top of `c157645`, the ShareSync checkout still has **local** changes that are not on GitHub:

| Path | What it is |
|------|------------|
| `routes/api.php` | Legacy `/getAddressdata` and `/salescomparables` gated by `internal.api` (`X-Internal-Api-Key`) instead of session `auth`. GitHub/Westrock uses session `auth`. Step 1 `/api/v1/*` is present in both. |
| `app/Http/Middleware/VerifyInternalApiKey.php` | Untracked. Steve-side A.1 experiment. Not in GitHub. |
| `.env.example` | Extra `INTERNAL_API_KEY=` placeholder for that experiment. |
| `bootstrap/app.php` | Steve credentials path + all four middleware aliases (fixed today). |
| `bootstrap/app(Conflicted copy 2026-09-07 - for Mukesh Ahuja).php` | Leftover ShareSync conflict file. Safe to delete after confirming the repaired `bootstrap/app.php`. |
| `app/Http/Controllers/ComparablesController.php` | Uncommitted buyer/seller export enrichment (same WIP on Westrock). Not part of the 2026-09-06 memo. |

If production should match GitHub, deploy from `c157645` and do **not** take the ShareSync-only `internal.api` layer unless you have already issued `INTERNAL_API_KEY` to a real caller.

---

## 6. Still on Steve / contracts — not build

1. **Retrieve ATTOM Ts&Cs** (`dla.attomdata.com/v2501.pdf`) into `Claude_Private_Steve\` — blocks JSON-archive caching design (B.3).
2. **Residential vs commercial licence** — Catherine Berlin / S. Romer (B.4).
3. **Deploy** `c157645` (and, if you want today's TLS/key cleanup, a follow-up commit) to production.
4. **Issue production Step 1 token** (`php artisan api:issue-token step1-client --step1`) and deliver the plaintext once, securely.
5. **GitHub access** from the WestRock side so future pulls do not depend on ShareSync file drops.
6. **After deploy:** incognito check that `/api/getAddressdata` and `/api/salescomparables` are closed; re-test Race Street and Queens; report ATTOM success rate on the next 50 lookups.

---

## 7. What I am not claiming

- I did not deploy to `attom.westrockappraisal.com`.
- I did not collect the 50-lookup success rate.
- I did not retrieve the Ts&Cs PDF.
- I did not commit or push today's TLS/key cleanup.
- Elasticsearch is still unreachable from this environment (connection timeout); block/lot for NJ does not depend on it after `c649ca3`.

---

*Prepared 2026-09-08 — Mukesh Ahuja / Inteligenz*