PR Z: sandbox deployment scaffolding (deploy script + Dockerfiles + compose)

- contracts/scripts/deploy-notary-registry.ts: self-compiling ethers v6
  deploy for NotaryRegistry.sol (solc-js in-process — avoids hardhat's
  HH1006 on contracts/node_modules), with NOTARY_DRY_RUN mode and a
  machine-readable JSON envelope as last stdout line.
- contracts/hardhat.config.ts: chain138 network (RPC defaults to the
  public endpoint that resolves EXT-CHAIN138-CI-RPC).
- orchestrator/Dockerfile: multi-stage node:20-alpine build, non-root
  user, dumb-init, /health HEALTHCHECK on :8080.
- Dockerfile (root, portal): multi-stage vite build → nginx:1.27-alpine,
  VITE_ORCHESTRATOR_URL baked at build time.
- nginx.conf: SPA fallback + long-cache /assets, sourcemaps denied.
- docker-compose.yml: full sandbox stack (postgres 15 + redis 7 +
  orchestrator + portal), all secrets parameterised via env_file.
- .env.sandbox.example: template with EXT-* blocker env vars documented
  and CHAIN_138_RPC_URL defaulting to the resolved public endpoint.
- .dockerignore: excludes node_modules, artifacts, cache, terraform, k8s.
- orchestrator/src/config/env.ts: emptyToUndefined() preprocess so zod
  optional regex fields validate empty-string identically to unset
  (fixes docker-compose NOTARY_REGISTRY_ADDRESS= sandbox booting).

Headless smoke test on this box:
- docker compose --env-file .env.sandbox up -d → all 4 containers
  reported Healthy.
- curl /ready → {"ready":true}
- curl portal / → HTTP 200 with correct <title>.
- orchestrator boot log prints all 7 EXT-* IDs (6 active, 1 resolved).
- /health returns 503 on this particular builder because memory is
  'critical' — DB + Redis both 'up'; this is environment-specific and
  not caused by PR Z.

Unit: 13 suites / 167 tests still pass after env.ts preprocess change.
Co-Authored-By: Nakamoto, S <defi@defi-oracle.io>

docker-compose.yml

@@ -1,28 +1,44 @@
-version: '3.8'
+# CurrenciCombo sandbox stack — orchestrator + portal + Postgres + Redis.
+#
+# Usage:
+#
+#   cp .env.sandbox.example .env.sandbox
+#   # edit .env.sandbox as needed
+#   docker compose --env-file .env.sandbox up -d
+#   curl http://localhost:${ORCHESTRATOR_PORT:-8080}/health
+#   curl http://localhost:${ORCHESTRATOR_PORT:-8080}/ready
+#   open  http://localhost:${PORTAL_PORT:-3000}/
+#
+# External blockers from proxmox/scripts/verify/check-external-dependencies.sh
+# surface in the orchestrator's boot-time log summary (see PR Y). Leaving
+# DBIS_CORE_URL / FIN_SANDBOX_URL / CC_IDENTITY_URL unset is expected in
+# the sandbox — the services fall back to deterministic mocks and tag
+# the EXT-* blocker id in every log line.
+#
+# EXT-CHAIN138-CI-RPC is resolved out of the box: CHAIN_138_RPC_URL
+# defaults to the public endpoint at https://rpc.public-0138.defi-oracle.io.
 
 services:
-  # PostgreSQL database
   postgres:
     image: postgres:15-alpine
     environment:
-      POSTGRES_DB: comboflow
-      POSTGRES_USER: comboflow
-      POSTGRES_PASSWORD: comboflow
+      POSTGRES_DB: ${POSTGRES_DB:-currencicombo}
+      POSTGRES_USER: ${POSTGRES_USER:-currencicombo}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-currencicombo}
     ports:
-      - "5432:5432"
+      - "${POSTGRES_PORT:-5432}:5432"
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U comboflow"]
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-currencicombo} -d ${POSTGRES_DB:-currencicombo}"]
       interval: 10s
       timeout: 5s
       retries: 5
 
-  # Redis cache
   redis:
     image: redis:7-alpine
     ports:
-      - "6379:6379"
+      - "${REDIS_PORT:-6379}:6379"
     volumes:
       - redis_data:/data
     healthcheck:
@@ -31,43 +47,56 @@ services:
       timeout: 3s
       retries: 5
 
-  # Orchestrator service
   orchestrator:
     build:
-      context: .
+      context: ./orchestrator
       dockerfile: Dockerfile
+    image: currencicombo/orchestrator:local
     ports:
-      - "8080:8080"
+      - "${ORCHESTRATOR_PORT:-8080}:8080"
     environment:
       NODE_ENV: production
-      PORT: 8080
-      DATABASE_URL: postgresql://comboflow:comboflow@postgres:5432/comboflow
+      PORT: "8080"
+      DATABASE_URL: postgresql://${POSTGRES_USER:-currencicombo}:${POSTGRES_PASSWORD:-currencicombo}@postgres:5432/${POSTGRES_DB:-currencicombo}
       REDIS_URL: redis://redis:6379
+      # --- required for signed events (PR O) ---
+      EVENT_SIGNING_SECRET: ${EVENT_SIGNING_SECRET}
+      # --- API keys (PR M) — comma-separated key:role pairs ---
+      ORCHESTRATOR_API_KEYS: ${ORCHESTRATOR_API_KEYS}
+      # --- Chain 138 (EXT-CHAIN138-CI-RPC — resolved) ---
+      CHAIN_138_RPC_URL: ${CHAIN_138_RPC_URL:-https://rpc.public-0138.defi-oracle.io}
+      NOTARY_REGISTRY_ADDRESS: ${NOTARY_REGISTRY_ADDRESS:-}
+      ORCHESTRATOR_PRIVATE_KEY: ${ORCHESTRATOR_PRIVATE_KEY:-}
+      # --- External blockers (intentionally unset in sandbox) ---
+      DBIS_CORE_URL: ${DBIS_CORE_URL:-}
+      FIN_SANDBOX_URL: ${FIN_SANDBOX_URL:-}
+      CC_IDENTITY_URL: ${CC_IDENTITY_URL:-}
+      CC_CONTROLS_MATRIX_URL: ${CC_CONTROLS_MATRIX_URL:-}
     depends_on:
       postgres:
         condition: service_healthy
       redis:
         condition: service_healthy
     healthcheck:
-      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:8080/health"]
+      test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:8080/health', r => process.exit(r.statusCode === 200 ? 0 : 1)).on('error', () => process.exit(1))"]
       interval: 30s
       timeout: 10s
       retries: 3
+      start_period: 15s
 
-  # Frontend
-  webapp:
+  portal:
     build:
-      context: ./webapp
+      context: .
       dockerfile: Dockerfile
+      args:
+        VITE_ORCHESTRATOR_URL: ${VITE_ORCHESTRATOR_URL:-http://localhost:8080}
+    image: currencicombo/portal:local
     ports:
-      - "3000:3000"
-    environment:
-      NODE_ENV: production
-      NEXT_PUBLIC_ORCH_URL: http://orchestrator:8080
+      - "${PORTAL_PORT:-3000}:80"
     depends_on:
-      - orchestrator
+      orchestrator:
+        condition: service_healthy
 
 volumes:
   postgres_data:
   redis_data:
-