Secure package drop

Ijarah OS hosts the engine. The bank receives a package and keeps every formal gate. Phase 1 does not sit inside Temenos, iMAL, or Flexcube.

• HTTPS webhook. Ijarah OS POSTs the package to a bank URL. HMAC-SHA256 over the body. Bank replies 202. Retry with backoff.
• SFTP drop zone. Encrypted JSON + document list land in a bank-controlled folder. Bank IT already knows this pattern. No core change.

One JSON object per submitted file. Documents listed, not dumped as a zip of internals. Confidence score and reasons — not raw ranking weights.

{
  "schema": "ijarahos.package.v1",
  "sentAt": "2026-08-22T08:00:00.000Z",
  "bank": {
    "tenantSlug": "ajman-bank",
    "bankName": "Ajman Bank"
  },
  "case": {
    "id": "case-example",
    "reference": "ALT-2026-6619",
    "submittedAt": "2026-08-22T07:58:00.000Z",
    "product": "ijarah",
    "track": "standard",
    "policyVersion": "1.4"
  },
  "customer": {
    "name": "Layla Hassan",
    "mobile": "+97150XXXXXXX",
    "employment": "salaried",
    "emirate": "Ajman"
  },
  "facility": {
    "propertyValueAed": 1450000,
    "financeAmountAed": 1160000,
    "tenureYears": 25,
    "ftvPct": 80
  },
  "confidence": {
    "score": 78,
    "reasons": [
      "Government identity source",
      "Salary rail requestable",
      "Ready property SPA from registry",
      "Policy pack v1.4 obeyed"
    ]
  },
  "documents": [
    {
      "code": "emirates_id",
      "source": "uae_pass_vault",
      "trust": "government",
      "status": "verified"
    },
    {
      "code": "salary_certificate",
      "source": "mohre_wps",
      "trust": "employer",
      "status": "received"
    },
    {
      "code": "bank_statements",
      "source": "customer_upload",
      "trust": "customer",
      "status": "received"
    },
    {
      "code": "spa",
      "source": "dld_registry",
      "trust": "registry",
      "status": "verified"
    }
  ],
  "gates": {
    "valuation": "pending",
    "shariah": "pending",
    "credit": "pending",
    "fund": "blocked_until_officer"
  },
  "partner": null,
  "notInThisPackage": [
    "Source-ranking weights",
    "Policy engine internals",
    "Helper scoring code",
    "Other banks’ files"
  ]
}

• valuation.lock — Bank locked the panel report. File may move to Shariah.
• shariah.confirm — Officer confirmed the structure sample.
• credit.confirm — Officer confirmed credit. Closing checklist opens.
• fund.ack — Bank booked the asset. Platform invoices the success fee.

• TLS in transit. HMAC-SHA256 on webhook body. Rotate secrets per tenant.
• Signature header: X-IjarahOS-Signature = sha256=<hex>. Over raw UTF-8 JSON body, no whitespace rewrite after signing.
• SFTP: bank-controlled keys. Drop-only account. No shell.
• PII in the package is Bank data. Retention follows the DPA.
• UAE region hosting is the residency story for the engine. Confirm on the live tenant.

• Source ranking weights
• Policy engine code
• Other tenants’ files
• A fund instruction that bypasses their officer