Mirrors the external-dependency blocker gate added to the proxmox
repo (scripts/verify/check-external-dependencies.sh + docs/03-
deployment/EXTERNAL_DEPENDENCY_BLOCKERS.md) so orchestrator startup
logs and provider-switch mock-mode logs surface the same EXT-* IDs
the deployment pipeline already tracks.
Central registry:
- src/config/externalBlockers.ts — typed EXT_BLOCKER_IDS union
(EXT-DBIS-CORE, EXT-CC-PAYMENT-ADAPTERS, EXT-CC-AUDIT-LEDGER,
EXT-CC-SHARED-EVENTS, EXT-CC-SHARED-SCHEMAS, EXT-FIN-GATEWAY,
EXT-CHAIN138-CI-RPC), BLOCKER_DETAILS map with per-id resolving
env var, evaluateBlockers(env) / activeBlockers() / and
logBlockerStatusAtBoot(logger) for a single-line structured
startup summary.
Wired sites:
- src/index.ts — logs the full blocker summary after validateEnv().
- services/dbisCore/client.ts — mock-mode log now carries
blockerId: EXT-DBIS-CORE.
- services/finLink/client.ts — getFinLinkClient() now logs live vs.
in-process sandbox decisions; sandbox path carries
blockerId: EXT-FIN-GATEWAY.
- services/bank.ts — migrated from console.log to pino; mock-mode
(no DBIS_CORE_URL) carries blockerId: EXT-DBIS-CORE because
dbis_core is the bank's real back-end.
- services/completeCredential/identityClient.ts — mock log tagged
'upstream cc-identity-core ships code but not yet deployed' to
distinguish 'env not set' from the cc-* scaffold blockers.
Unit tests: tests/config/externalBlockers.test.ts — 11 tests
covering registry shape, evaluation across env permutations (empty
env, each resolving env set, scaffold blockers remain active,
empty-string treated as unset), and log emission.
Full unit suite: 13 suites / 167 tests passing. tsc --noEmit clean.
No UI changes.
