# Reply for S. Romer — ATTOM middleware tasks (2026-09-06 through Handoff #2)

**From:** Mukesh Ahuja / Inteligenz  
**Date:** 2026-09-08  
**Production:** `https://attom.westrockappraisal.com`  
**Repo:** `https://github.com/Inteligenz-codebase/WestrockAttom.git`  
**Live SHA:** `1ef9e35` (deployed 2026-09-08 to `/var/www/html/WestrockAttom`)

This is the status of the actual asks. Billing (`payment-westrock` on the same VM) was not changed.

---

## Part A — the three code fixes (2026-09-06)

### A.1 Unauthenticated API endpoints — DONE, live

`/api/getAddressdata` and `/api/salescomparables` require a logged-in session.

Checked on production just after deploy: unauthenticated request returns **302 → `/login`**. Those routes no longer serve ATTOM data to anyone who finds the URL.

The machine interface for Step 1 is separate: `/api/v1/*` with Bearer tokens (B.1).

### A.2 TLS verification on ATTOM calls — DONE, live

Certificate verification is on for ATTOM HTTPS, using `composer/ca-bundle`. The leftover `verify => false` overrides on ATTOM callers were removed and deployed in `1ef9e35`.

Elasticsearch on the self-signed cluster still has TLS verify off on purpose. Turning that on would break block/lot when ES is used. That is not an ATTOM-key exposure.

### A.3 Hyphenated address lookup (Race Street / Queens) — DONE, live

`AddressNormalizer` is integrated. `13-27 Race Street` is tried as `13 Race Street # 27` first. Queens house numbers such as `72-10` are not split.

Tests: 11 tests / 18 assertions, all passing.

**50-lookup success rate (run 2026-09-08 on production after `1ef9e35`):** **48 / 50 = 96%**. Sample was 50 unique addresses from `property_search_logs` plus the known Race Street / Queens cases. Logged under job number `RATE-50-20260908`.

- `13-27 Race Street, Bloomfield, NJ` → `13 RACE ST # 27, BLOOMFIELD, NJ 07003` (the old failure)
- `72-10 41st Ave, Woodside, NY` → still resolves (no Queens regression)

Two misses: `1961 NJ-27, Edison, NJ` (hyphenated highway form; `State Route 27` spelling succeeds) and `5218 Main St, South Amboy, NJ` (that parcel is South Fallsburg, NY — wrong city in the query). A few of the 48 hits are nearest-street / fuzzy matches rather than exact house numbers; that is the remaining gap, not hyphenated ranges.

---

## Part B — information asked (2026-09-06)

### B.1 Programmatic API — DONE, live (was blocking)

There is now an authenticated machine API. It is live.

| Method | Path | Scope |
|--------|------|--------|
| POST | `/api/v1/property/resolve` | `property:resolve` |
| GET | `/api/v1/property/{attomId}/verification-bundle` | `property:verification` |
| GET | `/api/v1/property/{attomId}/comparables` | `property:comparables` |
| GET | `/api/v1/property/{attomId}/assessment-history` | `property:assessment` |

Every call needs a job number (`job_number`, query, or `X-WestRock-Job-Number`) and `Authorization: Bearer wrk_...`. Checked on production: POST resolve with no job number returns **422**.

Issue a dedicated production token when you are ready:

```
php artisan api:issue-token step1-client --step1
```

Send the plaintext once through a secure channel. Do not reuse a dashboard session.

The dashboard “API Keys” panel is now backed by this token table (not a second ATTOM client).

### B.2 Where the comparable population lives — ANSWERED

This middleware exports a **user-selected ATTOM shortlist**, not the 100+ CoStar/Main365 population.

- `AttomSales_*.xlsx` — checkbox-selected comps  
- `AttomSP_*.xlsx` — subject only (1 row)  
- `CostarSales*`, `CapRateMaster*`, `Rentals Leased/Market Master*` — **not produced here**

Handoff #2 correction accepted: Oversight verifies **per parcel** via ATTOM (`saleshistory/expandedhistory`, assessment history), not by re-deriving the full population from this app.

### B.3 ATTOM Ts&Cs PDF §4.3 — STILL BLOCKED (needs you)

`https://dla.attomdata.com/v2501.pdf` is behind ATTOM Contract Center. We cannot sign off caching raw JSON in the job folder until that PDF is in `Claude_Private_Steve\`.

### B.4 Residential-only licence / unlicensed packages — REPORTED (needs you + ATTOM)

Schedule §2.1 / §2.2 say “residential real property.” That is a contracts question for Catherine Berlin (`catherine.berlin@attomdata.com`) and you. Not a build decision.

| Package | Code | Production |
|---------|------|------------|
| Building Permits | artisan command only | Not in the UI; not on the signed schedule |
| Transportation Noise | UI + command | **Disabled.** `ATTOM_TRANSPORTATION_NOISE_ENABLED=false` is in production `.env`. `fetchSoundscoreData()` returns null and does not call ATTOM. |
| Parcel Tiles | Not in the repo | — |

### B.5 Housekeeping

- `nohup.out` gitignored and rotated. Not in ShareSync.  
- ShareSync checkout has **no `.env`**.  
- Production `.env` was left in place (not overwritten). Only the Transportation Noise flag was appended.

---

## Handoff #2 — block/lot and Step 1 API

### Block and lot — DONE, live

NJ APN fallback now emits `{muni}-{block5}-0000-{lot5}` (e.g. `02-00313-0000-00032`).

Live-tested on the Race Street subject as **Bloomfield NJ, Block 313, Lot 32** (not 1000/26). Resolves to AttomId `190242422` / `13 RACE ST # 27` via ATTOM with Elasticsearch down.

UI tab is **Legal ID**. User must pick State + County in the header for non-NYC.

### Step 1 API + pagination — DONE, live

See B.1. Comparables endpoint supports `page`, `per_page` (max 500), `miles`, `sale_date_range`.

### Handoff #3 file drop

The two files you asked to be placed in ShareSync (NJ APN + Transportation Noise) are in the ShareSync tree **and on production** at `1ef9e35`. GitHub from the WestRock side is still not a pull path on the VM; this deploy used a bundle. That does not change what is running.

---

## What is live vs still yours

| Task | Status |
|------|--------|
| A.1 Close open ATTOM proxy routes | Live |
| A.2 TLS on ATTOM calls | Live |
| A.3 Hyphenated address variants | Live |
| B.1 Step 1 `/api/v1` token API | Live — needs a production `step1-client` token issued to you |
| B.2 Comp population inventory | Answered |
| B.3 Ts&Cs PDF §4.3 | **You** — Contract Center → `Claude_Private_Steve\` |
| B.4 Residential vs commercial licence | **You + Catherine Berlin** |
| Transportation Noise off | Live |
| NJ block/lot APN | Live |
| 50-lookup success rate | **48 / 50 = 96%** (job `RATE-50-20260908`, 2026-09-08) |
| GitHub access from the WestRock pull side | Still useful so we are not on bundles |

Checked after deploy: `/up` 200, login 200, billing 302 (unchanged).