Backfill Phoenix deploy API env on install

- configure-explorer-d-bis-dns-wan.sh: PATCH explorer A (default 76.53.10.36), preserve proxied unless EXPLORER_D_BIS_CF_PROXIED set
- set-d-bis-org-zone-ssl-mode.sh: same SSL API as sankofa script for d-bis.org (fixes Flexible+NPM loops)
- TOKEN_AGGREGATION_REPORT_API_RUNBOOK: operator sequence for 502/522/loops + LAN fallback pointer

Made-with: Cursor

.cursor/mcp.json

@@ -0,0 +1,9 @@
+{
+  "mcpServers": {
+    "wormhole-docs": {
+      "command": "node",
+      "args": ["./mcp-wormhole-docs/index.js"],
+      "cwd": "${workspaceFolder}"
+    }
+  }
+}

.cursor/rules/chain138-tokens-and-pmm.mdc

@@ -10,24 +10,16 @@ alwaysApply: true
 - **cUSDT:** `0x93E66202A11B1772E55407B32B44e5Cd8eda7f22` (6 decimals)
 - **cUSDC:** `0xf22258f57794CC8E06237084b353Ab30fFfa640b` (6 decimals)
 
-**DODOPMMIntegration (live, traded):** `0x86ADA6Ef91A3B450F89f2b751e93B1b7A3218895` — confirmed live via on-chain probe (2026-04-22): `compliantUSDT()` / `compliantUSDC()` return the canonical cUSDT/cUSDC above; `pools[][]` mapping resolves to the live funded pool set below; `isRegisteredPool` is TRUE for all 8 pools listed under "PMM pools (live, traded)". `0x5BDc62f1ae7D630c37A8B363a1d49845356Ee72d` is a parallel deployment of the same source with different immutables and seeded but un-traded pools — do not wire dApps or routers to it.
+**DODOPMMIntegration (canonical, official DVM-backed stack):** `0x86ADA6Ef91A3B450F89f2b751e93B1b7A3218895` — use for stable-pool routing, token-aggregation, explorer fallbacks, and `info-defi-oracle-138` swaps. **`DODOPMMProvider`:** `0x3f729632E9553EBacCdE2e9b4c8F2B285b014F2e`. **`DODO_VENDING_MACHINE_ADDRESS`:** `0xb6D9EF3575bc48De3f011C310DC24d87bEC6087C`. Single source: `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md` and `ADDRESS_MATRIX_AND_STATUS.md` (on-chain verification 2026-04-02).
 
-**DODOPMMProvider (ILiquidityProvider, live):** `0x3f729632E9553EBacCdE2e9b4c8F2B285b014F2e` — `dodoIntegration() == 0x86ADA6Ef…`, `providerName() == "DODO PMM"`, `isKnownPool` TRUE for all 8 live pools. Use this address as `dodoLiquidityProvider` when deploying `EnhancedSwapRouter`; see `docs/11-references/PMM_DEX_ROUTING_STATUS.md`.
+**Older PMM integration (historical / supplemental only):** `0x5BDc62f1ae7D630c37A8B363a1d49845356Ee72d` — do **not** treat as canonical for stable routing or explorer reads; retained for older XAU-phase references and probes.
 
-**PMM pools (live, traded — 2026-04-22 on-chain probe):**
-- cUSDT/cUSDC `0x9e89bAe009adf128782E19e8341996c596ac40dC` (~983k cUSDT / ~1.016M cUSDC, asymmetric — actively traded)
-- cUSDT/USDT  `0x866Cb44b59303d8dc5f4F9E3E7A8e8b0bf238d66` (~1M / ~1M)
-- cUSDC/USDC  `0xc39B7D0F40838cbFb54649d327f49a6DAC964062` (~1M / ~1M)
-- cBTC/cUSDT  `0x67049e7333481e2cac91af61403ac7bddfab7bcd` (10k cBTC base / 9M cUSDT quote)
-- cBTC/cUSDC  `0x72f1a0794153c3b8a1e8a731f1d8e1a52cb10dc5` (10k cBTC base / 9M cUSDC quote)
-- WETH/USDC   `0xb53a0508940b1ff90f1aad4f6cb50a7012fe5593` (~10.1M USDC quote)
-- WETH/USDT   `0xe227f6c0520c0c6e8786fe56fa76c4914f861533` (~10.1M USDT quote)
-- cBTC/cXAUC  `0xf3e8a07d419b61f002114e64d79f7cf8f7989433` (10k cBTC base / 1.7k cXAUC quote)
+**PMM pools (live funded public):** cUSDT/cUSDC `0xff8d3b8fDF7B112759F076B69f4271D4209C0849` | cUSDT/USDT `0x6fc60DEDc92a2047062294488539992710b99D71` | cUSDC/USDC `0x9f74Be42725f2Aa072a9E0CdCce0E7203C510263` — see `docs/11-references/ADDRESS_MATRIX_AND_STATUS.md` / `PMM_DEX_ROUTING_STATUS.md`.
 
-The earlier rule's pool addresses (`0xff8d3b8f…`, `0x6fc60D…`, `0x9f74Be…`) belong to the **parallel** integration `0x5BDc62f1…` (Stack B) and are seeded 10M/10M flat or 0/0 — they are not the live PMM trading set. Source-of-truth corrections to follow in `ADDRESS_MATRIX_AND_STATUS.md` and `PMM_DEX_ROUTING_STATUS.md`.
-
-**cBTC:** `0xe94260c555ac1d9d3cc9e1632883452ebdf0082e` (8 decimals) — base token of the three cBTC pools above.
+**Public cW\* mesh (cross-chain):** treat as **execution / corridor capacity** against reference-anchored GRU policy, not shadow FX — `docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md`, `cross-chain-pmm-lps/config/peg-bands.json` **`gruPolicyIntegration`**.
 
 **cXAUC / cXAUT (XAU):** `0x290E52a8819A4fbD0714E517225429aA2B70EC6b`, `0x94e408E26c6FD8F4ee00b54dF19082FDA07dC96E` (6 decimals). **1 full token = 1 troy ounce Au** — not USD face value; see `EXPLORER_TOKEN_LIST_CROSSCHECK.md` section 5.1.
 
 **RPC (deploy):** `RPC_URL_138=http://192.168.11.211:8545`. **Deployer:** `0x4A666F96fC8764181194447A7dFdb7d471b301C8`. Add-liquidity reads tokens from the integration contract, not env. Do not use non-canonical Blockscout addresses (§2 of EXPLORER_TOKEN_LIST_CROSSCHECK).
+
+**Token symbol grammar (UTRNF vs GRU `c*`):** DBIS **`c*`** (e.g. cUSDC) is **compliant GRU base money**, not Universal Token Role Naming Framework “`c` = collateral.” For prefix collision rules, registry fields, and bridges, use `docs/04-configuration/naming-conventions/02_DBIS_NAMESPACE_AND_UTRNF_MAPPING.md` and `docs/04-configuration/naming-conventions/README.md`.

.cursor/rules/operator-context-lan-proxmox.mdc

@@ -8,10 +8,10 @@ alwaysApply: true
 **Remember:** This machine **is** LAN/operator — it has LAN and Proxmox access to 192.168.11.x. Operator scripts **can and should** be run from here when the user asks to run operator tasks.
 
 - **Dotenv:** `run-all-operator-tasks-from-lan.sh` and `run-operator-tasks-from-lan.sh` **always load dotenv** via `scripts/lib/load-project-env.sh` (repo `.env` + `smom-dbis-138/.env`). No need to `source .env` before running.
-- **Proxmox hosts:** 192.168.11.10 (ML110), .11 (R630-01), .12 (R630-02). Chain 138 RPC: 192.168.11.211:8545.
+- **Proxmox hosts (IPs):** 192.168.11.10–.14 (ML110, R630-01..04). **Canonical FQDNs:** `ml110.sankofa.nexus`, `r630-01.sankofa.nexus`, … `r630-04.sankofa.nexus` (`config/ip-addresses.conf` `PROXMOX_FQDN_*`). Chain 138 RPC: 192.168.11.211:8545.
 - **NPMplus password:** In **project root** `.env` — variable `NPM_PASSWORD` (with `NPM_EMAIL`, `NPM_URL`). Operator scripts load it via `load-project-env.sh`; NPMplus API: 192.168.11.167:81 or .166:81.
 - **Continue and complete:** (1) `./scripts/run-completable-tasks-from-anywhere.sh` then (2) `./scripts/run-all-operator-tasks-from-lan.sh` (use `--skip-backup` if NPM_PASSWORD not set; add `--deploy` or `--create-vms` as needed).
 
-When suggesting or running operator/LAN tasks (e.g. `run-all-operator-tasks-from-lan.sh`, contract verification, NPMplus backup, nginx/VMID 5000, token-aggregation DB, E2E checks), assume this host can reach Proxmox hosts (192.168.11.10–12), Chain 138 RPC, NPMplus, and Blockscout. Credentials in `.env` or `smom-dbis-138/.env` (e.g. `NPM_PASSWORD`, `PRIVATE_KEY`) are used automatically when the operator script runs.
+When suggesting or running operator/LAN tasks (e.g. `run-all-operator-tasks-from-lan.sh`, contract verification, NPMplus backup, nginx/VMID 5000, token-aggregation DB, E2E checks), assume this host can reach Proxmox nodes (192.168.11.10–.14 or `*.sankofa.nexus`), Chain 138 RPC, NPMplus, and Blockscout. Credentials in `.env` or `smom-dbis-138/.env` (e.g. `NPM_PASSWORD`, `PRIVATE_KEY`) are used automatically when the operator script runs.
 
 **Optional:** Before running operator scripts, run the **Operator/LAN access check** (curl RPC, env files) per rule `operator-lan-access-check.mdc`; if unreachable, suggest `run-completable-tasks-from-anywhere.sh` and document that operator tasks need LAN.

.cursor/rules/operator-lan-access-check.mdc

@@ -38,7 +38,11 @@ test -f .env && test -f smom-dbis-138/.env && echo "env OK" || echo "env missing
 - Suggest: `./scripts/run-completable-tasks-from-anywhere.sh` (config validation, on-chain check, reconcile output).
 - Tell the user that NPMplus backup, Blockscout verify, RPC proxy updates, and deploy require a host on **LAN (192.168.11.x)** with root `.env` and `smom-dbis-138/.env`; see **docs/00-meta/OPERATOR_CREDENTIALS_CHECKLIST.md** and **OPERATOR_READY_CHECKLIST.md**.
 
-## 4. References
+## 4. Proxmox FQDN on LAN (optional)
+
+If you use **`*.sankofa.nexus`** for SSH: `bash scripts/verify/check-proxmox-mgmt-fqdn.sh` (exit `1` until UDM/local DNS or `/etc/hosts` has A-records). Snippet: `bash scripts/verify/check-proxmox-mgmt-fqdn.sh --print-hosts`.
+
+## 5. References
 
 - **Operator context (always):** `.cursor/rules/operator-context-lan-proxmox.mdc` — this machine is assumed LAN/operator when that rule applies.
 - **Credentials:** `docs/00-meta/OPERATOR_CREDENTIALS_CHECKLIST.md` — per-task LAN, PRIVATE_KEY, NPM_PASSWORD, RPC_URL_138.

.cursor/rules/project-doc-and-deployment-refs.mdc

@@ -8,8 +8,11 @@ alwaysApply: true
 When answering token/PMM/deployment questions, prefer these docs over inferring from other files. Cite §5 / §8 for canonical and verification.
 
 **Canonical / verification:** `docs/11-references/EXPLORER_TOKEN_LIST_CROSSCHECK.md` (§5 canonical, §8 on-chain verification)  
-**Contract addresses:** `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md`  
+**Token / bridge naming (UTRNF + DBIS `c*` mapping):** `docs/04-configuration/naming-conventions/README.md` (especially `02_DBIS_NAMESPACE_AND_UTRNF_MAPPING.md` for UTRNF `c` vs compliant money)  
+**GRU FX reference vs public PMM mesh:** `docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md` (reference-first policy; mesh = execution layer)  
+**Contract addresses:** `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md` (includes **Ethereum mainnet optional TRUU PMM** subsection)  
 **Address matrix:** `docs/11-references/ADDRESS_MATRIX_AND_STATUS.md`  
+**Mainnet TRUU PMM (optional volatile rail):** `docs/03-deployment/MAINNET_PMM_TRUU_CWUSD_PEG_AND_BOT_RUNBOOK.md` section 11; `cross-chain-pmm-lps/config/deployment-status.json` `chains."1".pmmPoolsVolatile[]`  
 **Fixes and deployments:** `docs/00-meta/REQUIRED_FIXES_GAPS_AND_DEPLOYMENTS_LIST.md`  
 **TODOs:** `docs/00-meta/TODOS_CONSOLIDATED.md`  
 **Operator commands:** `docs/00-meta/OPERATOR_READY_CHECKLIST.md`  

.cursor/rules/proxmox-production-safety.mdc

@@ -0,0 +1,28 @@
+---
+description: Mission-critical Proxmox — scoped mutations, no accidental cross-workload impact
+alwaysApply: true
+---
+
+# Production safety — Proxmox and operator automation
+
+This environment is **mission-critical**. Prefer **small, explicit scopes** over broad loops.
+
+## Do not
+
+- Run **host-wide** or **cluster-wide** `pct start` / `qm start` / `pct stop` / destructive maintenance **without** a named list of VMIDs and a **dry-run first**.
+- Edit **`config/ip-addresses.conf`** or shared dotenv for a **single-workload** fix unless the change is documented and reviewed; prefer **workload-specific scripts** with explicit `--host` / `--vmid` flags.
+- Rely on ad-hoc shell one-liners that iterate all Proxmox IPs for the user; use **`scripts/operator/start-stopped-lxc-scoped.sh`** (or an equally scoped script) instead.
+
+## Do
+
+- **Default dry-run**, then **`--apply`** or **`PROXMOX_OPS_APPLY=1`** for mutations. Optional **`PROXMOX_OPS_ALLOWED_VMIDS`** for an extra allowlist.
+- Set **`PROXMOX_SAFE_DEFAULTS=1`** in operator `.env` so guarded maintenance scripts (`fix-core-rpc-2101.sh`, `make-rpc-vmids-writable-via-ssh.sh`, `ensure-legacy-monitor-networkd-via-ssh.sh`) default to **dry-run** unless **`--apply`** or **`PROXMOX_OPS_APPLY=1`**. Orchestrators (e.g. `run-all-maintenance-via-proxmox-ssh.sh`) pass **`--apply`** to sub-steps when not in top-level `--dry-run`.
+- Use **`scripts/lib/proxmox-production-guard.sh`** in new operator scripts that SSH to PVE.
+- After changing VM placement, update **`get_host_for_vmid`** in `scripts/lib/load-project-env.sh` so automation targets the correct node.
+- For Chain 138 RPC checks only: **`scripts/verify/check-chain138-rpc-health.sh`** (read-only HTTP probes).
+
+## Reference
+
+- Scoped start: `scripts/operator/start-stopped-lxc-scoped.sh`
+- Guard helpers: `scripts/lib/proxmox-production-guard.sh`
+- VMID / host facts: `docs/04-configuration/ALL_VMIDS_ENDPOINTS.md`, `docs/04-configuration/RPC_ENDPOINTS_MASTER.md`

.cursor/rules/wormhole-ai-resources.mdc

@@ -0,0 +1,20 @@
+---
+description: When to use Wormhole AI doc bundles vs repo Chain 138 / CCIP canonicals
+alwaysApply: false
+---
+
+# Wormhole AI resources vs this repo
+
+## Use Wormhole’s bundles for
+
+- Wormhole protocol behavior: VAAs, Guardians, NTT, Connect, Executor, Wormhole CCTP integration, Wormhole Queries, MultiGov, Settlement, TypeScript/Solidity SDK **as documented by Wormhole**.
+- Prefer the **tier ladder**: `llms.txt` → `site-index.json` → category `.md` → `llms-full.jsonl` only for RAG or very large context.
+- Canonical URLs and mirror script: [docs/04-configuration/WORMHOLE_AI_RESOURCES_LLM_PLAYBOOK.md](docs/04-configuration/WORMHOLE_AI_RESOURCES_LLM_PLAYBOOK.md).
+- Optional MCP: `mcp-wormhole-docs` (read-only resources + `wormhole_doc_search`); see [docs/04-configuration/MCP_SETUP.md](docs/04-configuration/MCP_SETUP.md).
+
+## Use repo canonical docs for
+
+- **Chain 138** token addresses, PMM pools, DODOPMMIntegration, deployer wallet, Blockscout alignment.
+- **CCIP** routes, receivers, and this project’s bridge runbooks.
+
+Do not answer “what is the canonical cUSDT address on 138?” from Wormhole docs. Do not answer “how does Wormhole NTT deploy on Solana?” from `ADDRESS_MATRIX_AND_STATUS.md` unless it explicitly cites Wormhole.

.devin/README.md

@@ -1,18 +0,0 @@
-# Devin for Terminal in Cursor
-
-This project is configured to use Devin for Terminal as a local CLI companion inside Cursor.
-
-- Cursor config import is enabled through `.cursor/rules/` and `.cursor/mcp.json` if present.
-- Windsurf config import is disabled for this project.
-- `AGENTS.md` remains the canonical shared project guidance.
-- Personal Devin overrides and secrets belong in `.devin/config.local.json`, which is gitignored.
-- Run `devin auth login` interactively before first use.
-
-Useful commands:
-
-```bash
-devin
-devin -- "review this repo and suggest the next safe task"
-devin auth status
-devin mcp list
-```

.devin/agents/reviewer/AGENT.md

@@ -1,21 +0,0 @@
----
-name: reviewer
-description: Read-only reviewer for Cursor/Devin handoffs
-allowed-tools:
-  - read
-  - grep
-  - glob
-  - exec
-permissions:
-  allow:
-    - Exec(git status)
-    - Exec(git diff)
-    - Exec(git log)
-  deny:
-    - write
-    - edit
----
-
-You are a read-only review subagent for this Cursor workspace.
-
-Review changes for correctness, security, operational risk, and consistency with `AGENTS.md` and relevant `.cursor/rules/` guidance. Do not modify files. Report only actionable findings first, ordered by severity, with exact file paths.

.devin/config.json

@@ -1,38 +0,0 @@
-{
-  // Devin for Terminal project config optimized for Cursor as the primary IDE.
-  "read_config_from": {
-    "cursor": true,
-    "windsurf": false,
-    "claude": true
-  },
-  "permissions": {
-    "allow": [
-      "Read(**)",
-      "Exec(git status)",
-      "Exec(git diff)",
-      "Exec(git log)",
-      "Exec(pnpm run)",
-      "Exec(bash scripts/verify)",
-      "Exec(bash scripts/validation)"
-    ],
-    "ask": [
-      "Write(**)",
-      "Exec(git commit)",
-      "Exec(git push)",
-      "Exec(docker)",
-      "Exec(docker compose)",
-      "mcp__*"
-    ],
-    "deny": [
-      "Exec(rm)",
-      "Exec(sudo)",
-      "Exec(chmod -R)",
-      "Exec(chown -R)",
-      "Write(.env*)",
-      "Write(**/.env*)",
-      "Write(reports/secrets/**)",
-      "Write(config/production/*did-secrets.env)"
-    ]
-  },
-  "mcpServers": {}
-}

.devin/hooks.v1.json

@@ -1,14 +0,0 @@
-{
-  "PreToolUse": [
-    {
-      "matcher": "exec",
-      "hooks": [
-        {
-          "type": "command",
-          "command": "bash scripts/devin/block-dangerous-command.sh",
-          "timeout": 10
-        }
-      ]
-    }
-  ]
-}

.devin/skills/cursor-handoff/SKILL.md

@@ -1,22 +0,0 @@
----
-name: cursor-handoff
-description: Align Devin for Terminal work with this Cursor workspace and project rules
-allowed-tools:
-  - read
-  - grep
-  - glob
-  - exec
-triggers:
-  - user
-  - model
----
-
-Use this skill when starting or resuming work in this repository from Devin for Terminal.
-
-1. Treat Cursor as the primary IDE context and read `.cursor/rules/` when relevant.
-2. Read `AGENTS.md` first for canonical project guidance.
-3. Do not rely on Windsurf rules, skills, workflows, or MCP settings for this project.
-4. Check `git status --short` before editing and preserve unrelated user changes.
-5. Prefer dry-run flags for operator, deployment, DNS, Proxmox, and LAN-sensitive scripts.
-6. Never write secrets or runtime credentials into tracked files.
-7. When using MCP servers, assume Cursor and Devin maintain separate authentication sessions.

.devin/skills/review/SKILL.md

@@ -1,28 +0,0 @@
----
-name: review
-description: Review code changes before commit or handoff
-allowed-tools:
-  - read
-  - grep
-  - glob
-  - exec
-permissions:
-  allow:
-    - Exec(git status)
-    - Exec(git diff)
-    - Exec(git log)
-  deny:
-    - write
-    - edit
-triggers:
-  - user
-  - model
----
-
-Review the current changes with a correctness-first stance.
-
-1. Run `git status --short`.
-2. Run `git diff` and, if staged changes exist, `git diff --staged`.
-3. Focus on bugs, security regressions, deployment risk, missing validation, and secret exposure.
-4. Cite exact file paths and keep findings ordered by severity.
-5. If no issues are found, say so and call out any test or validation gaps.

.env.master.example

@@ -15,13 +15,14 @@ PROXMOX_USER=
 PROXMOX_TOKEN_NAME=
 PROXMOX_TOKEN_VALUE=
 PROXMOX_ALLOW_ELEVATED=
+# Production operator host: set PROXMOX_SAFE_DEFAULTS=1 so guarded maintenance scripts default to dry-run unless --apply or PROXMOX_OPS_APPLY=1 (see scripts/lib/proxmox-production-guard.sh).
+# PROXMOX_SAFE_DEFAULTS=
+# PROXMOX_OPS_ALLOWED_VMIDS=
 
 # --- Cloudflare ---
 # Prefer CLOUDFLARE_API_TOKEN scoped to Zone:DNS:Edit on the zones you use (avoid global Account API key when possible).
 # Bulk DNS script: scripts/update-all-dns-to-public-ip.sh — use --dry-run and --zone-only=sankofa.nexus (etc.) before wide updates.
 CLOUDFLARE_API_TOKEN=
-# Set to 1 if token has no DNS:Edit and you need Global API key for scripts/cloudflare/provision-d-bis-mail-dns-and-npmplus.sh etc.
-CLOUDFLARE_DNS_PREFER_GLOBAL_KEY=
 CLOUDFLARE_EMAIL=
 CLOUDFLARE_API_KEY=
 CLOUDFLARE_ZONE_ID=
@@ -29,6 +30,8 @@ CLOUDFLARE_ZONE_ID_D_BIS_ORG=
 CLOUDFLARE_ZONE_ID_MIM4U_ORG=
 CLOUDFLARE_ZONE_ID_SANKOFA_NEXUS=
 CLOUDFLARE_ZONE_ID_DEFI_ORACLE_IO=
+# omdnl.org (apex + www): scripts/cloudflare/configure-omdnl-org-dns.sh
+CLOUDFLARE_ZONE_ID_OMDNL_ORG=
 CLOUDFLARE_TUNNEL_TOKEN=
 CLOUDFLARE_TUNNEL_ID=
 CLOUDFLARE_TUNNEL_ID_ALLTRA_HYBX=
@@ -36,16 +39,19 @@ CLOUDFLARE_TUNNEL_ID_MIFOS_R630_02=
 CLOUDFLARE_TUNNEL_TOKEN_MIFOS_R630_02=
 CLOUDFLARE_ORIGIN_CA_KEY=
 CLOUDFLARE_ACCOUNT_ID=
+# Turnstile (Captcha) for IRU marketplace inquiry — Dashboard → Turnstile; NOT the DNS API key
+CLOUDFLARE_TURNSTILE_SECRET_KEY=
+# dbis_core Vite marketplace: VITE_CLOUDFLARE_TURNSTILE_SITE_KEY=
+# Sankofa portal Next.js (sibling repo): NEXT_PUBLIC_CLOUDFLARE_TURNSTILE_SITE_KEY=
 
 # --- ClouDNS ---
 CLOUDNS_AUTH_ID=
 CLOUDNS_AUTH_PASSWORD=
 
 # --- NPM / NPMplus ---
-# For scripts/verify/backup-npmplus.sh: NPM_EMAIL and NPM_PASSWORD are both required
-# (no in-script defaults); see AGENTS.md operator / backup row.
-# PMG (LXC 100) web UI — optional: run scripts/operator/sync-pmg-webui-password-to-dotenv.sh to pull from /root/PMG_WEBUI_password.txt
-PMG_WEBUI_PASSWORD=
+# Shared admin username for all NPMplus instances unless an instance-specific
+# UI is deliberately configured differently.
+# API scripts: use HTTPS on port 81 (e.g. https://192.168.11.167:81). Plain http:// typically 301-redirects to https:// and breaks POST /api/tokens unless curl uses --post301.
 NPM_URL=
 NPM_EMAIL=
 NPM_PASSWORD=
@@ -54,10 +60,67 @@ NPM_PROXMOX_HOST=
 NPMPLUS_HOST=
 NPM_VMID=
 NPMPLUS_VMID=
+NPM_PASSWORD_PRIMARY=
+NPM_PASSWORD_SECONDARY=
+NPM_PASSWORD_ALLTRA_HYBX=
+NPM_PASSWORD_FOURTH=
+NPM_PASSWORD_MIFOS=
 NPMPLUS_ALLTRA_HYBX_VMID=
 IP_NPMPLUS_ALLTRA_HYBX=
+NPM_URL_SECONDARY=
+NPM_URL_ALLTRA_HYBX=
+NPM_URL_FOURTH=
 NPM_URL_MIFOS=
 
+# --- NPMplus: public CCIP mainnet-cw relay health (upstream r630-01 :9863) ---
+# Set then run: bash scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh
+# Or from SSH (r630-01 → NPM LAN): bash scripts/nginx-proxy-manager/upsert-ccip-relay-mainnet-cw-via-ssh.sh
+# DNS (d-bis.org): bash scripts/cloudflare/configure-relay-mainnet-cw-dns.sh (or full zone: scripts/update-all-dns-to-public-ip.sh)
+# CCIP_RELAY_MAINNET_CW_PUBLIC_HOST=relay-mainnet-cw.d-bis.org
+# Optional: CCIP_RELAY_MAINNET_CW_UPSTREAM_IP=192.168.11.11 CCIP_RELAY_MAINNET_CW_UPSTREAM_PORT=9863
+# Explorer / mission-control (optional): name mainnet-cw normalizes to mainnet_cw (preferred primary in ccip_health.go).
+# Set on the explorer API host or pass through explorer-monorepo/deployment/docker-compose.yml (api service).
+# CCIP_RELAY_HEALTH_URLS=mainnet-cw=https://relay-mainnet-cw.d-bis.org/healthz,mainnet=http://192.168.11.11:9860/healthz
+# CCIP_RELAY_HEALTH_URL=
+
+# --- info.defi-oracle.io (dedicated nginx LXC, not VMID 2400 RPC) ---
+# Defaults in config/ip-addresses.conf: IP_INFO_DEFI_ORACLE_WEB=192.168.11.218, VMID 2410.
+# IP_INFO_DEFI_ORACLE_WEB=
+# INFO_DEFI_ORACLE_VMID=
+# INFO_DEFI_ORACLE_UPSTREAM_IP=   # NPM fleet: overrides forward_host for info.defi-oracle.io
+# INFO_DEFI_ORACLE_EDGE_MODE=auto   # auto | tunnel | public_ip — DNS script for info.defi-oracle.io
+# INFO_DEFI_ORACLE_PUBLIC_IP=      # WAN IP for public_ip mode (else PUBLIC_IP)
+# CLOUDFLARE_ZONE_ID_DEFI_ORACLE_IO=  # Required for set-info-defi-oracle-dns + purge-info-defi-oracle-cache
+# INFO_DEFI_ORACLE_TUNNEL_UPSTREAM=   # Tunnel ingress origin for info hostnames (default IP_INFO_DEFI_ORACLE_WEB)
+# SPA: default runtime base is {origin}/token-aggregation (nginx on 2410 proxies to Blockscout). Override only if needed:
+# In info-defi-oracle-138/.env.local (not this file): VITE_TOKEN_AGGREGATION_API_BASE=https://explorer.d-bis.org/token-aggregation
+
+# --- mev.defi-oracle.io (MEV Control GUI on nginx LXC 2410 by default) ---
+# MEV_ADMIN_API_HOST=192.168.11.223  # Dedicated backend CT 2421; LAN host reachable from CT
+# MEV_ADMIN_API_PORT=9090
+# MEV_DEFI_ORACLE_WEB_VMID=2410
+# MEV_DEFI_ORACLE_UPSTREAM_IP=      # NPM: forward_host override (default IP_INFO_DEFI_ORACLE_WEB)
+# MEV_DEFI_ORACLE_UPSTREAM_PORT=80
+# MEV_DEFI_ORACLE_EDGE_MODE=auto    # Cloudflare DNS script (same as info: auto|tunnel|public_ip)
+# MEV_DEFI_ORACLE_PUBLIC_IP=        # A-record mode WAN IP if not using tunnel
+# Backend CT runtime env lives in config/mev-platform/mev-platform-backend-ct.env.example
+# and must include:
+#   MEV_SUPERVISOR_URL=http://127.0.0.1:9091
+
+# --- Keycloak Admin API (optional) ---
+# For scripts/deployment/keycloak-sankofa-ensure-client-redirects.sh — merge portal/admin redirect URIs.
+# KEYCLOAK_URL=https://keycloak.sankofa.nexus
+# KEYCLOAK_REALM=master
+# KEYCLOAK_CLIENT_ID=sankofa-portal
+# KEYCLOAK_ADMIN=admin
+# KEYCLOAK_ADMIN_PASSWORD=
+
+# --- IT read API (Sankofa portal /it on CT 7801) ---
+# Base URL of sankofa-it-read-api (Phase 0). Merged into /opt/sankofa-portal/.env by:
+#   scripts/deployment/sankofa-portal-merge-it-read-api-env-from-repo.sh
+# IT_READ_API_URL=http://192.168.11.11:8787
+# IT_READ_API_KEY=
+
 # --- Fastly ---
 FASTLY_API_TOKEN=
 
@@ -76,16 +139,10 @@ OMADA_CLIENT_SECRET=
 GITEA_URL=
 GITEA_TOKEN=
 GITEA_ORG=
-
-# --- Phoenix deploy API (Gitea Actions secrets on EACH repo that triggers deploy) ---
-# PHOENIX_DEPLOY_URL=       # full POST URL e.g. http://192.168.11.59:4001/api/deploy — same variable name as repo Secrets in Gitea
-# PHOENIX_DEPLOY_TOKEN=    # bearer for Phoenix deploy API — set per-repo Secret on Gitea, not necessarily in this root .env
-
-# --- CyberSecur Global (Gov portal static site; optional Web3Forms intake) ---
-# CYBERSECUR_WEB3FORMS_ACCESS_KEY=   # web3forms.com — used by CyberSecur-Global/deploy/render-intake.sh (key is public in browser HTML per provider)
-# After rotating the key in the Web3Forms dashboard, update this line and redeploy:
-#   CYBERSECUR_REPO=/path/to/CyberSecur-Global ./scripts/deployment/sync-cybersecur-global-to-ct7810.sh
-# CYBERSECUR_INTAKE_REDIRECT_URL=    # optional; default https://cybersecur.d-bis.org/intake-thanks.html
+# NPMplus upstream for gitea.d-bis.org (primary + fourth scripts). Defaults in config/ip-addresses.conf: VMID 104 @ .31:80
+# GITEA_PUBLIC_UPSTREAM_HOST=192.168.11.31
+# GITEA_PUBLIC_UPSTREAM_PORT=80
+# Dev-local Gitea on VM 5700 instead: GITEA_PUBLIC_UPSTREAM_HOST=192.168.11.59 GITEA_PUBLIC_UPSTREAM_PORT=3000
 
 # --- Database & app auth ---
 DATABASE_URL=
@@ -108,68 +165,168 @@ AWS_S3_BUCKET=
 AZURE_STORAGE_CONNECTION_STRING=
 AZURE_STORAGE_CONTAINER=
 
+# --- Pinata (IPFS pinning; token logos) ---
+# Dashboard: https://app.pinata.cloud — API Keys → JWT or key/secret.
+# scripts/upload-token-logos-to-ipfs.sh uses PINATA_JWT only (Bearer for pinFileToIPFS).
+PINATA_JWT=
+PINATA_API_KEY=
+PINATA_API_SECRET=
+
 # --- Blockchain / SMOM-DBIS-138 (use smom-dbis-138/.env for PRIVATE_KEY) ---
 PRIVATE_KEY=
-DEPLOYER_ADDRESS=
+# Chain 138 Core (deploy/gas/scripts on LAN): http://192.168.11.211:8545 — IP:port; not FQDN. See docs/04-configuration/RPC_ENDPOINTS_MASTER.md
 RPC_URL_138=
+# Public JSON-RPC for frontends, bridges, MetaMask: HTTPS FQDN only, e.g. https://rpc-http-pub.d-bis.org (not 192.168.11.221). LAN-only services may use http://192.168.11.221:8545
 RPC_URL_138_PUBLIC=
+# Token-aggregation publication bundle (explorer): deploy script uses TOKEN_AGG_CHAIN138_RPC_URL if set, else defaults to public node — see scripts/deploy-token-aggregation-for-publication.sh
+# TOKEN_AGG_CHAIN138_RPC_URL=
+# Optional PMM-only RPC for GET /api/v1/quote on-chain path (core RPC while indexer uses public)
+# TOKEN_AGGREGATION_PMM_RPC_URL=
+# TOKEN_AGGREGATION_PMM_QUERY_TRADER=
+# Router-v2 execution stack (Chain 138 canonical live deployment)
+ENHANCED_SWAP_ROUTER_V2_ADDRESS=0xF1c93F54A5C2fc0d7766Ccb0Ad8f157DFB4C99Ce
+INTENT_BRIDGE_COORDINATOR_V2_ADDRESS=0x7D0022B7e8360172fd9C0bB6778113b7Ea3674E7
+CHAIN138_ENABLE_DODO_V3_EXECUTION=1
+# Chain 138 multi-provider venues (canonical live deployment)
+UNISWAP_V3_ROUTER=0xde9cD8ee2811E6E64a41D5F68Be315d33995975E
+UNISWAP_QUOTER_ADDRESS=0x6abbB1CEb2468e748a03A00CD6aA9BFE893AFa1f
+UNISWAP_V3_WETH_USDT_POOL=0xa893add35aEfe6A6d858EB01828bE4592f12C9F5
+UNISWAP_V3_WETH_USDC_POOL=0xEC745bfb6b3cd32f102d594E5F432d8d85B19391
+UNISWAP_V3_WETH_USDT_FEE=500
+UNISWAP_V3_WETH_USDC_FEE=500
+BALANCER_VAULT=0x96423d7C1727698D8a25EbFB88131e9422d1a3C3
+BALANCER_WETH_USDT_POOL_ID=0x877cd220759e8c94b82f55450c85d382ae06856c426b56d93092a420facbc324
+BALANCER_WETH_USDC_POOL_ID=0xd8dfb18a6baf9b29d8c2dbd74639db87ac558af120df5261dab8e2a5de69013b
+CURVE_3POOL=0xE440Ec15805BE4C7BabCD17A63B8C8A08a492e0f
+ONEINCH_ROUTER=0x500B84b1Bc6F59C1898a5Fe538eA20A758757A4F
+CHAIN138_DEPLOY_GAS_PRICE_WEI=1000
+# Chain 138 upstream-native Uniswap v3 replacement track
+CHAIN138_UNISWAP_V3_NATIVE_CORE_REPO=/home/intlc/projects/uniswap-v3-core
+CHAIN138_UNISWAP_V3_NATIVE_PERIPHERY_REPO=/home/intlc/projects/uniswap-v3-periphery
+CHAIN138_UNISWAP_V3_NATIVE_FACTORY=0x2f7219276e3ce367dB9ec74C1196a8ecEe67841C
+CHAIN138_UNISWAP_V3_NATIVE_NFT_DESCRIPTOR_LIBRARY=0x6F5fdE32DD2aC66B27e296EC9D6F4E79A3dE2947
+CHAIN138_UNISWAP_V3_NATIVE_TOKEN_DESCRIPTOR=0xca66DCAC4633555033F6fDDBE4234B6913c7ff51
+CHAIN138_UNISWAP_V3_NATIVE_POSITION_MANAGER=0x31b68BE5af4Df565Ce261dfe53D529005D947B48
+CHAIN138_UNISWAP_V3_NATIVE_SWAP_ROUTER=0xde9cD8ee2811E6E64a41D5F68Be315d33995975E
+CHAIN138_UNISWAP_V3_NATIVE_QUOTER_V2=0x6abbB1CEb2468e748a03A00CD6aA9BFE893AFa1f
+CHAIN138_UNISWAP_V3_NATIVE_WETH_USDT_POOL=0xa893add35aEfe6A6d858EB01828bE4592f12C9F5
+CHAIN138_UNISWAP_V3_NATIVE_WETH_USDC_POOL=0xEC745bfb6b3cd32f102d594E5F432d8d85B19391
+CHAIN138_UNISWAP_V3_NATIVE_FEE_TIER=500
+CHAIN138_NATIVE_GAS_PRICE=1000
+CHAIN138_NATIVE_DEPLOY_GAS_LIMIT=12000000
+CHAIN138_NATIVE_POOL_TX_GAS_LIMIT=12000000
+CHAIN138_NATIVE_WETH9=0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2
+CHAIN138_NATIVE_USDT=0x004b63A7B5b0E06f6bB6adb4a5F9f590BF3182D1
+CHAIN138_NATIVE_USDC=0x71D6687F38b93CCad569Fa6352c876eea967201b
+CHAIN138_NATIVE_CURRENCY_LABEL=ETH
+CHAIN138_UNISWAP_V3_INITIAL_USD_PER_WETH=2116.6
+CHAIN138_UNISWAP_V3_SEED_WETH_USDT_WETH=50
+CHAIN138_UNISWAP_V3_SEED_WETH_USDT_STABLE=105830
+CHAIN138_UNISWAP_V3_SEED_WETH_USDC_WETH=50
+CHAIN138_UNISWAP_V3_SEED_WETH_USDC_STABLE=105830
+# Cross-chain flash infra (Chain 138)
+FLASH_UNIVERSAL_CCIP_BRIDGE=0xCd42e8eD79Dc50599535d1de48d3dAFa0BE156F8
+FLASH_CCIP_ROUTER=0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817
+FLASH_REPAY_RECEIVER_ROUTER=0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817
+FLASH_VAULT_CREDIT_ROUTER=0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817
+CROSS_CHAIN_FLASH_BRIDGE_ADAPTER=0xBe9e0B2d4cF6A3b2994d6f2f0904D2B165eB8ffC
+CROSS_CHAIN_FLASH_REPAY_RECEIVER=0xD084b68cB4B1ef2cBA09CF99FB1B6552fd9b4859
+CROSS_CHAIN_FLASH_VAULT_CREDIT_RECEIVER=0x89F7a1fcbBe104BeE96Da4b4b6b7d3AF85f7E661
+# Optional same-chain ERC-3156 flash dry-run inputs (set when a canonical flash vault is deployed / approved)
+FLASH_VAULT=
+FLASH_VAULT_TOKEN=
+FLASH_PROVIDER_RPC_URL=
+FLASH_TEST_AMOUNT=
+# XDC Zero — second relayer pair (XDC Network mainnet <-> Chain 138). See docs/03-deployment/CHAIN138_XDC_ZERO_BRIDGE_RUNBOOK.md and config/xdc-zero/
+# Use XDC mainnet JSON-RPC only (chain id 50), not Ethereum L1. Prefer erpc (rpc.xinfin.network often returns 5xx).
+XDC_PARENTNET_URL=https://erpc.xinfin.network
+# Testnet (Apothem): https://rpc.apothem.network
+# Optional alias for 138 side (defaults to RPC_URL_138 in preflight if unset):
+XDC_ZERO_PEER_RPC_URL=
+
+# Ethereum L1 — used for dual-anchor attestation with scripts/omnl/omnl-chain138-attestation-tx.sh (consumes ETH gas). Alias: RPC_URL_MAINNET.
 ETHEREUM_MAINNET_RPC=
-# Clear scripts/verify/check-external-dependencies.sh — use real service URLs when split; example interim health target:
-# DBIS_CORE_URL=https://dbis-api.d-bis.org/health
-DBIS_CORE_URL=
-CC_PAYMENT_ADAPTERS_URL=
-CC_AUDIT_LEDGER_URL=
-CC_SHARED_EVENTS_URL=
-CC_SHARED_SCHEMAS_URL=
-FIN_GATEWAY_URL=
-ALLIANCE_ACCESS_URL=
-# cast must be in PATH; use a runner-reachable Chain 138 RPC, e.g.:
-# CHAIN138_CI_RPC_URL=https://rpc.public-0138.defi-oracle.io
-CHAIN138_CI_RPC_URL=
-ALL_MAINNET_RPC=
-# Alltra / Wemix / Etherlink: set for production; for local read-only checks, deployer-gas-auto-route.sh falls back to public RPCs documented in scripts/deployment/deployer-gas-auto-route.sh
+# Mainnet DODO PMM + optional TRUU volatile rail (see docs/03-deployment/MAINNET_PMM_TRUU_CWUSD_PEG_AND_BOT_RUNBOOK.md)
+# Canonical integration: 0xa9F284eD010f4F7d7F8F201742b49b9f58e29b84
+DODO_PMM_INTEGRATION_MAINNET=
+# --- Mainnet Aave flash quote-push (cWUSDC/USDC peg / rebalance without wallet USDC) ---
+# If the deployer wallet already has USDC + cWUSDC: bash scripts/deployment/apply-mainnet-cwusdc-usdc-peg-tranche-from-wallet.sh --dry-run | --apply
+# Receiver only: bash scripts/deployment/deploy-mainnet-aave-quote-push-receiver.sh --dry-run | --apply
+# Deploy: bash scripts/deployment/deploy-mainnet-aave-quote-push-stack.sh --dry-run | --apply
+# Treasury manager: bash scripts/deployment/deploy-mainnet-quote-push-treasury-manager.sh --dry-run | --apply
+# One shot: bash scripts/deployment/run-mainnet-aave-cwusdc-quote-push-once.sh --dry-run | --apply
+# Keeper: bash scripts/deployment/run-mainnet-aave-quote-push-keeper.sh --dry-run | --apply
+# Loop:    FLASH_LOOP_COUNT=3 bash scripts/deployment/run-mainnet-aave-cwusdc-quote-push-loop.sh --dry-run | --apply
+# Forge sources: smom-dbis-138/script/flash/RunMainnetAaveCwusdcUsdcQuotePushOnce.s.sol
+# Modeling (no chain writes): scripts/deployment/run-mainnet-cwusdc-flash-quote-push-model-sweep.sh
+# Optional sweep tuning: FLASH_MODEL_GAS_TX_COUNT FLASH_MODEL_GAS_PER_TX FLASH_MODEL_MAX_POST_TRADE_DEV_BPS
+AAVE_QUOTE_PUSH_RECEIVER_MAINNET=0x241cb416aaFC2654078b7E2376adED2bDeFbCBa2
+# QUOTE_PUSH_UNWINDER_TYPE=two_hop_dodo  # or dodo_univ3 / two_hop_dodo_univ3; lets the runner auto-pick the latest real broadcast unwinder after --apply
+QUOTE_PUSH_EXTERNAL_UNWINDER_MAINNET=0xaB74B4369e5603085A58FDa181E9B43617C6a58f
+FLASH_QUOTE_AMOUNT_RAW=200000
+# MIN_OUT_UNWIND_BUFFER_RAW=0  # route-specific override for two_hop_dodo_univ3; the recovered three-leg path can clear with zero buffer while the legacy 5000 raw default clips it
+# UNWIND_MODE: 0 = Uniswap V3 exactInputSingle (set UNWIND_V3_FEE_U24); 1 = DODO pool (UNWIND_DODO_POOL);
+#               2 = Uniswap V3 exactInput packed path hex (UNWIND_V3_PATH_HEX) when no direct pool — see UniswapV3ExternalUnwinder.
+#               6 = TwoHopDodoToUniswapV3MultiHopExternalUnwinder (UNWIND_TWO_HOP_* + UNWIND_INTERMEDIATE_TOKEN + UNWIND_V3_PATH_HEX)
+UNWIND_MODE=4
+# UNWIND_V3_FEE_U24=
+# UNWIND_V3_PATH_HEX=0x...   # UNWIND_MODE=2 — build: bash scripts/verify/build-uniswap-v3-exact-input-path-hex.sh <path-args>
+# UNWIND_DODO_POOL=
+UNWIND_TWO_HOP_POOL_A=0xe944b7Cb012A0820c07f54D51e92f0e1C74168DB
+UNWIND_TWO_HOP_POOL_B=0x27f3aE7EE71Be3d77bAf17d4435cF8B895DD25D2
+UNWIND_TWO_HOP_MID_TOKEN=0xaF5017d0163ecb99d9B5D94e3b4D7b09Af44D8AE
+UNWIND_MIN_MID_OUT_RAW=1
+# UNWIND_INTERMEDIATE_TOKEN=0xdAC17F958D2ee523a2206206994597C13D831ec7
+# UNWIND_MIN_INTERMEDIATE_OUT_RAW=1
+# Retained-surplus recycle / treasury manager policy:
+# QUOTE_PUSH_RECEIVER_OWNER=0x...
+# Live migration shortcut:
+#   bash scripts/deployment/deploy-mainnet-aave-quote-push-receiver.sh --apply
+#   AAVE_QUOTE_PUSH_RECEIVER_MAINNET=<new_receiver> QUOTE_PUSH_TREASURY_TAKE_RECEIVER_OWNERSHIP=1 bash scripts/deployment/deploy-mainnet-quote-push-treasury-manager.sh --apply
+# QUOTE_PUSH_TREASURY_MANAGER_MAINNET=0x...
+# QUOTE_PUSH_TREASURY_OWNER=0x...
+# QUOTE_PUSH_TREASURY_OPERATOR=0x...
+# QUOTE_PUSH_TREASURY_GAS_RECIPIENT=0x...
+# QUOTE_PUSH_TREASURY_RECYCLE_RECIPIENT=0x...
+# QUOTE_PUSH_RECEIVER_RESERVE_RAW=0
+# QUOTE_PUSH_TREASURY_RESERVE_RAW=0
+# QUOTE_PUSH_TREASURY_TAKE_RECEIVER_OWNERSHIP=1
+# QUOTE_PUSH_KEEPER_SKIP_FLASH=0
+# QUOTE_PUSH_KEEPER_SKIP_RECYCLE=0
+# QUOTE_PUSH_DEPLOYER_GAS_FLOOR_ETH=0.003
+# QUOTE_PUSH_OPERATION_BUFFER_ETH=0.0005
+# QUOTE_PUSH_NATIVE_TOKEN_PRICE=3200
+# Discover V3 pools: bash scripts/verify/probe-uniswap-v3-cwusdc-usdc-mainnet.sh
+# Optional min-out overrides (script derives from pool query + Aave premium when unset):
+# MIN_OUT_PMM=
+# MIN_OUT_UNWIND=
+# AAVE_FLASH_PREMIUM_BPS=5
+# UniswapV3ExternalUnwinder expects legacy SwapRouter exactInputSingle (not SwapRouter02 multicall).
+# UNISWAP_V3_SWAP_ROUTER_MAINNET=0xE592427A0AEce92De3Edee1F18E0157C05861564
+# cWUSDT/cWUSDC public PMM on mainnet (see cross-chain-pmm-lps/config/deployment-status.json); override if redeployed:
+# POOL_CWUSDT_CWUSDC_MAINNET=0xe944b7Cb012A0820c07f54D51e92f0e1C74168DB
+# Optional public flash-lender candidates for no-broadcast dry-runs on Ethereum mainnet.
+# Balancer mainnet vault is documented in smom-dbis-138/docs/bridge/trustless/ENV_VARIABLES_REFERENCE.md.
+MAINNET_BALANCER_VAULT=0xBA12222222228d8Ba445958a75a0704d566BF2C8
+# Aave V3 Ethereum mainnet pool/provider, verified on-chain 2026-04-05 via ADDRESSES_PROVIDER() and FLASHLOAN_PREMIUM_TOTAL().
+MAINNET_AAVE_V3_POOL=0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2
+MAINNET_AAVE_V3_POOL_ADDRESSES_PROVIDER=0x2f39d218133AFaB8F2B819B1066c7E434Ad94E9e
+# Optional overrides (defaults match deployment-status.json / scripts)
+TRUU_MAINNET=
+PMM_TRUU_FEE_BPS=
+PMM_TRUU_K=
+# Optional extra cast check in scripts/verify/check-mainnet-pmm-peg-bot-readiness.sh
+PMM_TRUU_BASE_TOKEN=
+PMM_TRUU_QUOTE_TOKEN=
+# Override initial DODO i for new pools only if governance changes baseline (top-up script default)
+PMM_TRUU_INITIAL_I=
+WORMHOLE_API_KEY=
+WORMHOLE_EXECUTOR_URL=https://executor.labsapis.com
+WORMHOLE_EXECUTOR_TESTNET_URL=https://executor-testnet.labsapis.com
 CHAIN_651940_RPC_URL=
-# ALLTRA_MAINNET_RPC=https://mainnet-rpc.alltra.global
-# WEMIX_RPC_URL=https://api.wemix.com
-# ETHERLINK_RPC_URL=https://node.mainnet.etherlink.com
-CHAIN_1_UNISWAP_V2_FACTORY=0x5C69bEe701ef814a2B6a3EDD4B1652CB9cc5aA6f
-CHAIN_1_UNISWAP_V2_ROUTER=0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D
-CHAIN_1_UNISWAP_V2_START_BLOCK=0
-CHAIN_10_UNISWAP_V2_FACTORY=0x0c3c1c532F1e39EdF36BE9Fe0bE1410313E074Bf
-CHAIN_10_UNISWAP_V2_ROUTER=0x4A7b5Da61326A6379179b40d00F57E5bbDC962c2
-CHAIN_10_UNISWAP_V2_START_BLOCK=0
-CHAIN_25_UNISWAP_V2_FACTORY=0x3B44B2a187a7b3824131F8db5a74194D0a42Fc15
-CHAIN_25_UNISWAP_V2_ROUTER=0x145863Eb42Cf62847A6Ca784e6416C1682b1b2Ae
-CHAIN_25_UNISWAP_V2_START_BLOCK=0
-CHAIN_56_UNISWAP_V2_FACTORY=0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73
-CHAIN_56_UNISWAP_V2_ROUTER=0x10ED43C718714eb63d5aA57B78B54704E256024E
-CHAIN_56_UNISWAP_V2_START_BLOCK=0
-CHAIN_100_UNISWAP_V2_FACTORY=0xc35DADB65012eC5796536bD9864eD8773aBc74C4
-CHAIN_100_UNISWAP_V2_ROUTER=0x1b02dA8Cb0d097eB8D57A175b88c7D8b47997506
-CHAIN_100_UNISWAP_V2_START_BLOCK=0
-CHAIN_137_UNISWAP_V2_FACTORY=0x5757371414417b8C6CAad45bAeF941aBc7d3Ab32
-CHAIN_137_UNISWAP_V2_ROUTER=0xa5E0829CaCEd8fFDD4De3c43696c57F7D7A678ff
-CHAIN_137_UNISWAP_V2_START_BLOCK=0
-CHAIN_42220_UNISWAP_V2_FACTORY=0x62d5b84bE28a183aBB507E125B384122D2C25fAE
-CHAIN_42220_UNISWAP_V2_ROUTER=0xE3D8bd6Aed4F159bc8000a9cD47CffDb95F96121
-CHAIN_42220_UNISWAP_V2_START_BLOCK=0
-CHAIN_43114_UNISWAP_V2_FACTORY=0x9Ad6C38BE94206cA50bb0d90783181662f0Cfa10
-CHAIN_43114_UNISWAP_V2_ROUTER=0x60aE616a2155Ee3d9A68541Ba4544862310933d4
-CHAIN_43114_UNISWAP_V2_START_BLOCK=0
-CHAIN_8453_UNISWAP_V2_FACTORY=0x02a84c1b3BBD7401a5f7fa98a384EBC70bB5749E
-CHAIN_8453_UNISWAP_V2_ROUTER=0x8cFe327CEc66d1C090Dd72bd0FF11d690C33a2Eb
-CHAIN_8453_UNISWAP_V2_START_BLOCK=0
-CHAIN_42161_UNISWAP_V2_FACTORY=0x02a84c1b3BBD7401a5f7fa98a384EBC70bB5749E
-CHAIN_42161_UNISWAP_V2_ROUTER=0x8cFe327CEc66d1C090Dd72bd0FF11d690C33a2Eb
-CHAIN_42161_UNISWAP_V2_START_BLOCK=0
-# Optional / scaffold-only until Wemix UniV2 routing is promoted
-CHAIN_1111_UNISWAP_V2_FACTORY=
-CHAIN_1111_UNISWAP_V2_ROUTER=
-CHAIN_1111_UNISWAP_V2_START_BLOCK=0
 ETHERLINK_RPC_URL=
 TEZOS_RPC_URL=
 ETHERSCAN_API_KEY=
-WEMIXSCAN_API_KEY=
 ETHERLINK_CCIP_SELECTOR=
 TEZOS_BRIDGE_ENABLED=
 ETHERLINK_BRIDGE_ENABLED=
@@ -178,11 +335,127 @@ ETHERLINK_RELAY_BRIDGE=
 ETHERLINK_RELAY_PRIVATE_KEY=
 JUMPER_API_KEY=
 ONEINCH_API_KEY=
+# Optional: 1inch dev API base (default https://api.1inch.dev/swap/v6.0) — see packages/economics-toolkit/src/swap-engine/oneinch-quote.ts
+ONEINCH_API_URL=
+DODO_API_KEY=
+DODO_SECRET_KEY=
+DODO_DEVELOPER_API_KEY=
+# Optional: hosted DODO SmartTrade swap URL (default https://api.dodoex.io/route-service/developer/swap)
+DODO_QUOTE_URL=
+# Optional override for hosted DODO quote probes; if unset, scripts derive USER_ADDR
+# from PRIVATE_KEY and fall back to the standard deployer wallet.
+USER_ADDR=
 MOONPAY_API_KEY=
 MOONPAY_SECRET_KEY=
 RAMP_NETWORK_API_KEY=
 ONRAMPER_API_KEY=
 
+# --- Changelly Exchange API v2 (Chain 138 → mainnet → BTC payout pathway; backend only) ---
+# Docs: https://docs.changelly.com/ — register keys via pro@changelly.com
+# Private key: PEM file on server or KMS reference; never expose to frontend builds.
+CHANGELLY_API_PUBLIC_KEY=
+CHANGELLY_API_PRIVATE_KEY_PEM_PATH=
+
+# --- Canonical GRU / D-WIN token surfaces used by PMM, reporting, and staged x402 cutover ---
+CUSDT_V2_ADDRESS_138=
+CUSDC_V2_ADDRESS_138=
+CAUSDT_ADDRESS_138=0x5fdDF65733e3d590463F68f93Cf16E8c04081271
+CUSDW_ADDRESS_138=
+AUSDT_ADDRESS_651940=0x015B1897Ed5279930bC2Be46F661894d219292A6
+CAXAUC_ADDRESS_651940=
+CAXAUT_ADDRESS_651940=
+CWAXAUC_ADDRESS_651940=
+CWAXAUT_ADDRESS_651940=
+USDW_ADDRESS_25=
+# Optional: CMC "USD DWIN" native USDW (post-migration); canonical pins are config/token-mapping-multichain.json -> dwinUsdWinPublic
+USDW_DWIN_BSC=
+USDW_DWIN_POLYGON=
+CWAUSDT_ADDRESS_56=0xe1a51Bc037a79AB36767561B147eb41780124934
+CWAUSDT_ADDRESS_137=0xf12e262F85107df26741726b074606CaFa24AAe7
+CWAUSDT_ADDRESS_43114=0xff3084410A732231472Ee9f93F5855dA89CC5254
+CWAUSDT_ADDRESS_42220=0xC158b6cD3A3088C52F797D41f5Aa02825361629e
+CWUSDW_ADDRESS_56=
+CWUSDW_ADDRESS_137=
+CWUSDW_ADDRESS_43114=
+USDW_WRAP_VAULT_56=
+USDW_WRAP_VAULT_137=
+USDW_NATIVE_ADDRESS_56=
+USDW_NATIVE_ADDRESS_137=
+# Legacy wrapped-token aliases still seen in smom-dbis-138/.env and accepted by token-aggregation:
+CWUSDW_BSC=
+CWUSDW_AVALANCHE=
+
+# --- cW* bridge role grants (scripts/deployment/grant-cw-bridge-roles-on-chain.sh) ---
+# Optional: legacy gas price wei, or percent bump over cast gas-price (default 150). Mainnet/L2s need this when base fee spikes.
+# CW_GRANT_GAS_PRICE_WEI=
+# CW_GRANT_GAS_BUMP_PCT=150
+
+# --- WEMIX3.0 mainnet (chain id 1111) ---
+# Official RPC (HTTPS): https://docs.wemix.com/en/quick-start/start-node/use-public-api-server-rpc
+# Swap on-chain to native WEMIX for gas after assets are on 1111: https://wemix.fi/swap
+# No in-repo route for ETH/BNB/POL → WEMIX; see docs/03-deployment/WEMIX_ACQUISITION_TABLED.md
+WEMIX_RPC=https://api.wemix.com
+# WEMIX_MAINNET_RPC=   # alias also read by grant-cw-bridge-roles-on-chain.sh
+
+# --- GRU deployer funding gates (check-gru-v2-deployer-funding-status.sh, check-full-deployment-status.sh) ---
+# Arbitrum native balance must exceed this wei threshold or a funding blocker is raised. Set to 0 to skip (planning/CI only).
+# GRU_FUNDING_ARBITRUM_THRESHOLD_WEI=440872740000000000
+
+# --- GRU Transport / cW hard-peg bridge controls (Chain 138 -> public chains) ---
+# Canonical L1 bridge env used by the GRU transport overlay and token-aggregation.
+CHAIN138_L1_BRIDGE=
+# Legacy alias still used by some deployment helpers.
+CW_L1_BRIDGE_CHAIN138=
+CW_BRIDGE_MAINNET=
+CW_BRIDGE_CRONOS=
+CW_BRIDGE_BSC=
+CW_BRIDGE_POLYGON=
+CW_BRIDGE_GNOSIS=
+CW_BRIDGE_CELO=
+CW_BRIDGE_AVALANCHE=
+CW_BRIDGE_BASE=
+CW_BRIDGE_ARBITRUM=
+CW_BRIDGE_OPTIMISM=
+CW_BRIDGE_WEMIX=
+CW_RESERVE_VERIFIER_CHAIN138=
+CW_STABLECOIN_RESERVE_VAULT=
+CW_RESERVE_SYSTEM=
+CW_ATTACH_VERIFIER_TO_L1=1
+CW_REQUIRE_VAULT_BACKING=
+CW_REQUIRE_RESERVE_SYSTEM_BALANCE=
+CW_REQUIRE_TOKEN_OWNER_MATCH_VAULT=
+CW_CANONICAL_USDT=
+CW_CANONICAL_USDC=
+CW_USDT_RESERVE_ASSET=
+CW_USDC_RESERVE_ASSET=
+CW_MAX_OUTSTANDING_BTC_MAINNET=2100000000000000
+CW_MAX_OUTSTANDING_USDT_MAINNET=10000000000000
+CW_MAX_OUTSTANDING_USDC_MAINNET=10000000000000
+CW_MAX_OUTSTANDING_USDT_CRONOS=
+CW_MAX_OUTSTANDING_USDC_CRONOS=
+CW_MAX_OUTSTANDING_USDT_BSC=
+CW_MAX_OUTSTANDING_USDC_BSC=
+CW_MAX_OUTSTANDING_AUSDT_BSC=
+CW_MAX_OUTSTANDING_USDT_POLYGON=
+CW_MAX_OUTSTANDING_USDC_POLYGON=
+CW_MAX_OUTSTANDING_AUSDT_POLYGON=
+CW_MAX_OUTSTANDING_USDT_GNOSIS=
+CW_MAX_OUTSTANDING_USDC_GNOSIS=
+CW_MAX_OUTSTANDING_USDT_CELO=
+CW_MAX_OUTSTANDING_USDC_CELO=
+CW_MAX_OUTSTANDING_AUSDT_CELO=
+CW_MAX_OUTSTANDING_USDT_AVALANCHE=
+CW_MAX_OUTSTANDING_USDC_AVALANCHE=
+CW_MAX_OUTSTANDING_AUSDT_AVALANCHE=
+CW_MAX_OUTSTANDING_USDT_BASE=
+CW_MAX_OUTSTANDING_USDC_BASE=
+CW_MAX_OUTSTANDING_USDT_ARBITRUM=
+CW_MAX_OUTSTANDING_USDC_ARBITRUM=
+CW_MAX_OUTSTANDING_USDT_OPTIMISM=
+CW_MAX_OUTSTANDING_USDC_OPTIMISM=
+CW_MAX_OUTSTANDING_WEMIX_WEMIX=
+CW_FREEZE_AVAX_L2_CONFIG=
+
 # --- Alerts & monitoring ---
 SLACK_WEBHOOK_URL=
 PAGERDUTY_INTEGRATION_KEY=
@@ -190,6 +463,17 @@ EMAIL_ALERT_API_URL=
 EMAIL_ALERT_RECIPIENTS=
 SENTRY_DSN=
 
+# --- dbis_core IRU / marketplace outbound mail (optional; Proxmox Mail Proxy VMID 100 = 192.168.11.32) ---
+# EMAIL_PROVIDER=smtp
+# SMTP_HOST=192.168.11.32
+# SMTP_PORT=587
+# SMTP_SECURE=false
+# SMTP_USER=
+# SMTP_PASSWORD=
+# EMAIL_FROM=
+# EMAIL_FROM_NAME=SolaceNet
+# DBIS_SALES_EMAIL=
+
 # --- Legal / e-signature ---
 E_SIGNATURE_BASE_URL=
 
@@ -228,6 +512,26 @@ SANKOFA_PHOENIX_API_URL=
 SANKOFA_PHOENIX_CLIENT_ID=
 SANKOFA_PHOENIX_CLIENT_SECRET=
 SANKOFA_PHOENIX_TENANT_ID=
+# Corporate apex (sankofa.nexus) → CT 7806 when provisioned (default in ip-addresses stays portal until set)
+# IP_SANKOFA_PUBLIC_WEB=192.168.11.63
+
+# Optional consolidated hub (non-chain web + API path router). Defaults in ip-addresses.conf match discrete CTs until overridden.
+# IP_SANKOFA_WEB_HUB=
+# SANKOFA_WEB_HUB_PORT=80
+# IP_SANKOFA_PHOENIX_API_HUB=
+# SANKOFA_PHOENIX_API_HUB_PORT=8080
+# When API hub nginx is live on Phoenix CT (7800), LAN smoke: curl -sS http://${IP_SANKOFA_PHOENIX_API:-192.168.11.50}:8080/health
+# NPM fleet (phoenix.sankofa.nexus): set 8080 when Tier-1 API hub nginx is live (production); leave unset only for break-glass direct :4000.
+SANKOFA_NPM_PHOENIX_PORT=8080
+# Hub listen port for LAN smoke scripts (distinct from SANKOFA_PHOENIX_API_HUB_PORT / Apollo):
+# SANKOFA_API_HUB_LISTEN_PORT=8080
+# WebSocket upgrade smoke (curl HTTP 101): pnpm run verify:phoenix-graphql-wss
+# Optional second probe to hub on LAN: PHOENIX_WSS_INCLUDE_LAN=1 (needs load-project-env / IP_SANKOFA_PHOENIX_API)
+# Phoenix CT 7800 — bind Apollo to loopback after hub uses 127.0.0.1:4000: scripts/deployment/ensure-sankofa-phoenix-apollo-bind-loopback-7800.sh
+# LAN verify prefers hub :8080 when reachable; optional direct :4000 check: SANKOFA_VERIFY_PHOENIX_DIRECT_PORT=1
+# Optional if hub CT IP differs from IP_SANKOFA_PHOENIX_API:
+# IP_SANKOFA_NPM_PHOENIX_API=192.168.11.xx
+# dbis_core behind NPM (+ optional hub): set TRUST_PROXY=1 and TRUST_PROXY_HOPS (1 or 2) in dbis_core .env — see dbis_core/.env.example
 
 # --- Frontend / MetaMask / Explorer ---
 VITE_WALLETCONNECT_PROJECT_ID=
@@ -259,6 +563,32 @@ RPC_URL_138_FIREBLOCKS=
 WS_URL_138_FIREBLOCKS=
 CHAIN_ID_138=
 
+# --- PMM soak grid (6534 wallets; operator funding scripts) ---
+# Runbook: docs/11-references/CHAIN138_GRID_6534_WALLET_FUNDING_PLAN.md
+# Optional stable RPC for long runs (avoids LAN Core flaps during thousands of cast sends):
+# PMM_SOAK_RPC_URL_OVERRIDE=https://rpc-http-pub.d-bis.org
+# Full-grid resume orchestrator: start at this leg only (native|mint|cusdt|cusdc|mirr_usdt|mirr_usdc)
+# PMM_SOAK_START_LEG=
+# Skip native when every wallet already funded (max linear index is 6533; use 6534 to skip native):
+# PMM_SOAK_RESUME_NATIVE_FROM_LINEAR=
+# Per-chunk progress/ETA in pmm-soak-operator-fund-grid.sh (0 = quiet except final line per chunk):
+# PMM_SOAK_FUND_PROGRESS_EVERY=50
+# PMM_SOAK_FUND_CHUNK=250
+
+# --- @proxmox/economics-toolkit (path-check / exec broadcast; operator LAN only) ---
+# Validate checked-in strategy JSON: pnpm run economics:validate (optional: pip install check-jsonschema for schema pass)
+# Optional: same as PRIVATE_KEY for guarded swap broadcast (see packages/economics-toolkit/config/executor-allowlist.example.json).
+# ECONOMICS_EXEC_PRIVATE_KEY=
+# Set to 1 to broadcast after successful simulation (default is dry-run).
+# ECONOMICS_EXEC_APPLY=
+# POST JSON when path-check clears economics gate (optional).
+# ECONOMICS_ALERT_WEBHOOK=
+# Per-chain RPC override for economics-toolkit gas-quote: ECONOMICS_GAS_RPC_1=, ECONOMICS_GAS_RPC_56=, etc.
+# (Listed chain IDs are CR/LF-stripped when using scripts/lib/load-project-env.sh — same as RPC_URL_138.)
+# ECONOMICS_GAS_SKIP_USD=1   Skip CoinGecko; print native gas cost only
+# Optional: economics-toolkit gas-budget derives EOA from this if --address omitted (else PRIVATE_KEY)
+# ECONOMICS_GAS_BUDGET_PRIVATE_KEY=
+
 # --- Phoenix deploy API ---
 PORT=
 GITEA_TOKEN=

.gitea/CONTRIBUTING.md

@@ -6,8 +6,6 @@
 2. Make changes, ensure tests pass
 3. Open a pull request
 
-Repo ↔ VM CI/CD mapping and templates for **other** Gitea repos: [docs/04-configuration/GITEA_REPO_VM_CD_CI_MATRIX.md](../docs/04-configuration/GITEA_REPO_VM_CD_CI_MATRIX.md), [config/gitea-workflow-templates/README.md](../config/gitea-workflow-templates/README.md).
-
 Deploy workflow policy:
 `main` and `master` are both deploy-triggering branches, so `.gitea/workflow-sources/deploy-to-phoenix.yml` and `.gitea/workflow-sources/validate-on-pr.yml` must stay identical across both branches.
 Use `bash scripts/verify/sync-gitea-workflows.sh` after editing workflow-source files, and `bash scripts/verify/run-all-validation.sh --skip-genesis` to catch workflow drift before push.

.gitea/workflows/bootstrap-phoenix-deploy-api.yml

@@ -1,210 +0,0 @@
-name: Bootstrap Phoenix Deploy API
-
-# Reinstalls phoenix-deploy-api on the dev VM (CT 5700) with the latest server.js
-# from master. This is the missing link between "code on master is the real
-# implementation" and "running service on CT 5700 still has the stub". Run this
-# workflow_dispatch job whenever phoenix-deploy-api/server.js, deploy-targets.json
-# or related scripts change and you need the running service to pick up the change
-# without a manual LAN visit.
-#
-# Required Gitea repo secrets (Settings -> Secrets):
-#   PHOENIX_PVE_HOST       PVE node IP that hosts CT 5700 (e.g. 192.168.11.12)
-#   PHOENIX_PVE_USER       SSH user on the PVE node (default: root)
-#   PHOENIX_PVE_SSH_KEY    Private SSH key (PEM, OpenSSH format) authorised on the PVE node
-#   PHOENIX_PVE_KNOWN_HOSTS  Pre-populated known_hosts entry for the PVE node (avoids strict-host prompt)
-#   PHOENIX_DEV_VM_VMID    Container VMID (default: 5700)
-#   PHOENIX_DEPLOY_DEV_VM_IP  IP of the dev VM for the post-install health check (default: 192.168.11.59)
-#   PHOENIX_DEPLOY_URL     Phoenix deploy webhook URL (already used by deploy job)
-#   PHOENIX_DEPLOY_TOKEN   Bearer token for the webhook (already used by deploy job)
-#
-# Trigger only via Gitea UI (Actions tab -> "Bootstrap Phoenix Deploy API" -> Run
-# workflow). NOT triggered on push: reinstalling the deploy service is sensitive
-# enough that we want it gated behind a manual click.
-
-on:
-  workflow_dispatch:
-    inputs:
-      verify_only:
-        description: "If true, only run the post-install /health + auth probe and skip the reinstall step."
-        type: boolean
-        required: false
-        default: false
-
-jobs:
-  bootstrap:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout proxmox repo
-        uses: actions/checkout@v4
-
-      - name: Validate repo layout
-        run: |
-          set -euo pipefail
-          test -d phoenix-deploy-api || { echo "phoenix-deploy-api/ missing" >&2; exit 1; }
-          test -f phoenix-deploy-api/server.js
-          test -f phoenix-deploy-api/scripts/install-systemd.sh
-          test -f phoenix-deploy-api/deploy-targets.json
-          # Manifest is optional; warn if missing but do not fail.
-          if [ ! -f config/public-sector-program-manifest.json ]; then
-            echo "::warning::config/public-sector-program-manifest.json missing — install will warn on CT"
-          fi
-          # Make sure the running master implementation is NOT the stub message
-          # that triggered this whole bootstrap thread.
-          if grep -q "Deploy request queued (stub)" phoenix-deploy-api/server.js; then
-            echo "phoenix-deploy-api/server.js still contains the stub string — refusing to bootstrap." >&2
-            exit 1
-          fi
-
-      - name: Install SSH key for PVE access
-        if: ${{ github.event.inputs.verify_only != 'true' }}
-        run: |
-          set -euo pipefail
-          mkdir -p "$HOME/.ssh"
-          chmod 700 "$HOME/.ssh"
-          umask 077
-          printf '%s\n' "${{ secrets.PHOENIX_PVE_SSH_KEY }}" > "$HOME/.ssh/id_pve"
-          chmod 600 "$HOME/.ssh/id_pve"
-          if [ -n "${{ secrets.PHOENIX_PVE_KNOWN_HOSTS }}" ]; then
-            printf '%s\n' "${{ secrets.PHOENIX_PVE_KNOWN_HOSTS }}" > "$HOME/.ssh/known_hosts"
-            chmod 644 "$HOME/.ssh/known_hosts"
-          else
-            # Fall back to accept-new on first connect; subsequent connects pin.
-            touch "$HOME/.ssh/known_hosts"
-            chmod 644 "$HOME/.ssh/known_hosts"
-          fi
-
-      - name: Build deploy bundle
-        if: ${{ github.event.inputs.verify_only != 'true' }}
-        run: |
-          set -euo pipefail
-          mkdir -p .out
-          if [ -f config/public-sector-program-manifest.json ]; then
-            tar czf .out/pda-deploy-bundle.tar.gz \
-              phoenix-deploy-api \
-              config/public-sector-program-manifest.json
-          else
-            tar czf .out/pda-deploy-bundle.tar.gz phoenix-deploy-api
-          fi
-          ls -lh .out/pda-deploy-bundle.tar.gz
-
-      - name: scp bundle to PVE host
-        if: ${{ github.event.inputs.verify_only != 'true' }}
-        env:
-          PVE_HOST: ${{ secrets.PHOENIX_PVE_HOST }}
-          PVE_USER: ${{ secrets.PHOENIX_PVE_USER }}
-        run: |
-          set -euo pipefail
-          : "${PVE_HOST:?PHOENIX_PVE_HOST not set in repo secrets}"
-          PVE_USER_VAL="${PVE_USER:-root}"
-          KNOWN_HOSTS_OPT="-o UserKnownHostsFile=$HOME/.ssh/known_hosts"
-          if [ ! -s "$HOME/.ssh/known_hosts" ]; then
-            KNOWN_HOSTS_OPT="$KNOWN_HOSTS_OPT -o StrictHostKeyChecking=accept-new"
-          else
-            KNOWN_HOSTS_OPT="$KNOWN_HOSTS_OPT -o StrictHostKeyChecking=yes"
-          fi
-          scp -i "$HOME/.ssh/id_pve" $KNOWN_HOSTS_OPT \
-            -o ConnectTimeout=20 \
-            .out/pda-deploy-bundle.tar.gz \
-            "${PVE_USER_VAL}@${PVE_HOST}:/tmp/pda-deploy-bundle.tar.gz"
-
-      - name: pct push + install-systemd on CT
-        if: ${{ github.event.inputs.verify_only != 'true' }}
-        env:
-          PVE_HOST: ${{ secrets.PHOENIX_PVE_HOST }}
-          PVE_USER: ${{ secrets.PHOENIX_PVE_USER }}
-          VMID: ${{ secrets.PHOENIX_DEV_VM_VMID }}
-        run: |
-          set -euo pipefail
-          : "${PVE_HOST:?PHOENIX_PVE_HOST not set in repo secrets}"
-          PVE_USER_VAL="${PVE_USER:-root}"
-          VMID_VAL="${VMID:-5700}"
-          KNOWN_HOSTS_OPT="-o UserKnownHostsFile=$HOME/.ssh/known_hosts"
-          if [ ! -s "$HOME/.ssh/known_hosts" ]; then
-            KNOWN_HOSTS_OPT="$KNOWN_HOSTS_OPT -o StrictHostKeyChecking=accept-new"
-          else
-            KNOWN_HOSTS_OPT="$KNOWN_HOSTS_OPT -o StrictHostKeyChecking=yes"
-          fi
-          ssh -i "$HOME/.ssh/id_pve" $KNOWN_HOSTS_OPT \
-            -o ConnectTimeout=20 \
-            "${PVE_USER_VAL}@${PVE_HOST}" "VMID=${VMID_VAL} bash -s" <<'REMOTE_EOF'
-          set -euo pipefail
-          : "${VMID:?}"
-          # Verify CT exists and is running.
-          if ! pct status "${VMID}" >/dev/null 2>&1; then
-            echo "CT ${VMID} not found on this PVE node." >&2
-            exit 1
-          fi
-          if ! pct exec "${VMID}" -- true 2>/dev/null; then
-            echo "CT ${VMID} not running. Start it first: pct start ${VMID}" >&2
-            exit 1
-          fi
-          STAGE="/tmp/proxmox-pda-stage"
-          pct push "${VMID}" /tmp/pda-deploy-bundle.tar.gz /root/pda-deploy.tar.gz
-          pct exec "${VMID}" -- bash -c "
-            set -euo pipefail
-            rm -rf '${STAGE}'
-            mkdir -p '${STAGE}'
-            tar xzf /root/pda-deploy.tar.gz -C '${STAGE}'
-            cd '${STAGE}'
-            bash phoenix-deploy-api/scripts/install-systemd.sh
-            rm -f /root/pda-deploy.tar.gz
-          "
-          rm -f /tmp/pda-deploy-bundle.tar.gz
-          REMOTE_EOF
-
-      - name: Health check (no auth)
-        env:
-          DEV_VM_IP: ${{ secrets.PHOENIX_DEPLOY_DEV_VM_IP }}
-        run: |
-          set -euo pipefail
-          IP="${DEV_VM_IP:-192.168.11.59}"
-          # Service may take a moment to come up after install; retry briefly.
-          for i in 1 2 3 4 5 6; do
-            if curl -sSf -m 5 "http://${IP}:4001/health" -o /tmp/health.json; then
-              echo "Health check OK on attempt ${i}"
-              cat /tmp/health.json || true
-              echo
-              break
-            fi
-            echo "Health check attempt ${i}/6 failed; sleeping 3s"
-            sleep 3
-            if [ "${i}" = "6" ]; then
-              echo "Phoenix Deploy API /health unreachable after install." >&2
-              exit 1
-            fi
-          done
-
-      - name: Auth + non-stub probe (POST with bogus target)
-        env:
-          PHOENIX_DEPLOY_URL: ${{ secrets.PHOENIX_DEPLOY_URL }}
-          PHOENIX_DEPLOY_TOKEN: ${{ secrets.PHOENIX_DEPLOY_TOKEN }}
-        run: |
-          set -euo pipefail
-          : "${PHOENIX_DEPLOY_URL:?}"
-          : "${PHOENIX_DEPLOY_TOKEN:?}"
-          # POST a bogus target. The post-bootstrap server should:
-          #   - accept the bearer token (NOT 401)
-          #   - reject the unknown target with a non-stub error
-          # The pre-bootstrap stub returned 202 with "Deploy request queued (stub)"
-          # for ANY target. So we explicitly check the response body does NOT
-          # contain that stub phrase.
-          BODY="$(curl -sS -m 10 -X POST "${PHOENIX_DEPLOY_URL}" \
-            -H "Authorization: Bearer ${PHOENIX_DEPLOY_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d '{"repo":"d-bis/proxmox","sha":"HEAD","branch":"master","target":"__bootstrap_probe__"}' || true)"
-          echo "Response body:"
-          echo "${BODY}"
-          if echo "${BODY}" | grep -q 'Deploy request queued (stub)'; then
-            echo "::error::Phoenix Deploy API still returning stub response — bootstrap did not take effect."
-            exit 1
-          fi
-          if echo "${BODY}" | grep -qi 'unauthorized\|invalid token\|401'; then
-            echo "::error::Phoenix Deploy API rejected the bearer token. PHOENIX_DEPLOY_TOKEN is out of sync with PHOENIX_DEPLOY_SECRET on the CT."
-            exit 1
-          fi
-          echo "Phoenix Deploy API is post-stub and authenticating correctly."
-
-      - name: Cleanup secrets
-        if: always()
-        run: |
-          rm -f "$HOME/.ssh/id_pve" "$HOME/.ssh/known_hosts" || true

.gitea/workflows/deploy-portal-live.yml

@@ -1,31 +0,0 @@
-name: Deploy Sankofa Portal Live
-
-on:
-  workflow_dispatch:
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Run repo validation gate
-        run: |
-          bash scripts/verify/run-all-validation.sh --skip-genesis
-
-  deploy:
-    needs: validate
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Trigger portal-live deployment
-        run: |
-          SHA="$(git rev-parse HEAD)"
-          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
-          curl -sSf -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
-            -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
-            -H "Content-Type: application/json" \
-            -d "{\"repo\":\"${{ gitea.repository }}\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"portal-live\"}"

.gitea/workflows/live-inventory-hardware-weekly.yml

@@ -0,0 +1,30 @@
+# Weekly: hardware poll + live inventory / drift export → artifacts.
+# GitHub: see .github/workflows/live-inventory-drift.yml
+# Gitea: use a LAN self-hosted runner with label [lan] for live Proxmox reachability;
+#        ubuntu-latest will usually produce seed_unreachable (still uploads JSON).
+name: Live inventory + hardware poll (weekly)
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '20 7 * * 1'
+
+jobs:
+  inventory-and-hardware:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Poll Proxmox cluster hardware (LAN optional)
+        run: bash scripts/verify/poll-proxmox-cluster-hardware.sh
+        continue-on-error: true
+
+      - name: Export live inventory and IPAM drift
+        run: bash scripts/it-ops/export-live-inventory-and-drift.sh
+        continue-on-error: true
+
+      - name: Summarize reports/status (commit artifacts on LAN runner if needed)
+        if: always()
+        run: |
+          ls -la reports/status/ 2>/dev/null || true
+          test -f reports/status/drift.json && head -c 400 reports/status/drift.json || true

.github/workflows/dbis-core-gateway-ci.yml

@@ -0,0 +1,55 @@
+# Gateway rails unit + HTTP integration tests (dbis_core submodule)
+name: dbis-core-gateway-ci
+
+on:
+  push:
+    paths:
+      - 'dbis_core/package.json'
+      - 'dbis_core/package-lock.json'
+      - 'dbis_core/jest.config.js'
+      - 'dbis_core/jest.gateway-http.config.js'
+      - 'dbis_core/src/core/gateway/**'
+      - 'dbis_core/src/workers/gateway-outbox.worker.ts'
+      - 'dbis_core/src/workers/run-gateway-outbox-worker.ts'
+      - 'dbis_core/src/__tests__/unit/core/gateway/**'
+      - 'dbis_core/src/__tests__/integration/api/gateway-rails-http.integration.test.ts'
+      - 'dbis_core/src/__tests__/gateway-http-env-setup.ts'
+      - 'dbis_core/src/__tests__/utils/gateway-http-test-app.ts'
+      - '.github/workflows/dbis-core-gateway-ci.yml'
+  pull_request:
+    paths:
+      - 'dbis_core/package.json'
+      - 'dbis_core/package-lock.json'
+      - 'dbis_core/jest.config.js'
+      - 'dbis_core/jest.gateway-http.config.js'
+      - 'dbis_core/src/core/gateway/**'
+      - 'dbis_core/src/workers/gateway-outbox.worker.ts'
+      - 'dbis_core/src/workers/run-gateway-outbox-worker.ts'
+      - 'dbis_core/src/__tests__/unit/core/gateway/**'
+      - 'dbis_core/src/__tests__/integration/api/gateway-rails-http.integration.test.ts'
+      - 'dbis_core/src/__tests__/gateway-http-env-setup.ts'
+      - 'dbis_core/src/__tests__/utils/gateway-http-test-app.ts'
+      - '.github/workflows/dbis-core-gateway-ci.yml'
+
+defaults:
+  run:
+    working-directory: dbis_core
+
+jobs:
+  test-gateway:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: dbis_core/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Gateway tests (unit + integration)
+        run: npm run test:gateway

.github/workflows/economics-toolkit.yml

@@ -0,0 +1,42 @@
+# Unit tests for packages/economics-toolkit (no live RPC required).
+name: economics-toolkit
+
+on:
+  push:
+    paths:
+      - "packages/economics-toolkit/**"
+      - "pnpm-workspace.yaml"
+      - "package.json"
+      - "scripts/economics/**"
+      - "scripts/validation/validate-economics-strategy-json.sh"
+      - "AGENTS.md"
+      - ".github/workflows/economics-toolkit.yml"
+  pull_request:
+    paths:
+      - "packages/economics-toolkit/**"
+      - "pnpm-workspace.yaml"
+      - "package.json"
+      - "scripts/economics/**"
+      - "scripts/validation/validate-economics-strategy-json.sh"
+      - "AGENTS.md"
+      - ".github/workflows/economics-toolkit.yml"
+  workflow_dispatch: {}
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "pnpm"
+      - name: Install
+        run: pnpm install
+      - name: Test economics-toolkit
+        run: pnpm run economics:test
+      - name: Validate strategy JSON (smoke + template)
+        run: pnpm run economics:validate

.github/workflows/info-defi-oracle-138.yml

@@ -0,0 +1,43 @@
+# Build Chain 138 info hub SPA when its package or workspace lockfile changes.
+name: info-defi-oracle-138
+
+on:
+  pull_request:
+    paths:
+      - 'info-defi-oracle-138/**'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - '.github/workflows/info-defi-oracle-138.yml'
+  push:
+    branches: [main, master]
+    paths:
+      - 'info-defi-oracle-138/**'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - '.github/workflows/info-defi-oracle-138.yml'
+
+jobs:
+  build:
+    name: Typecheck & Vite build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'pnpm'
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build info-defi-oracle-138
+        run: pnpm --filter info-defi-oracle-138 build

.github/workflows/live-inventory-drift.yml

@@ -0,0 +1,29 @@
+# Live Proxmox guest inventory + drift vs config/ip-addresses.conf.
+# GitHub-hosted runners usually cannot reach 192.168.11.x; workflow still produces
+# drift.json with seed_unreachable. Use a self-hosted LAN runner or run locally:
+#   bash scripts/it-ops/export-live-inventory-and-drift.sh
+name: Live inventory and IPAM drift
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '25 6 * * 1'
+
+jobs:
+  drift:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Export live inventory (LAN optional)
+        run: bash scripts/it-ops/export-live-inventory-and-drift.sh
+        continue-on-error: true
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: live-inventory-drift
+          path: |
+            reports/status/live_inventory.json
+            reports/status/drift.json

.github/workflows/pmm-soak-grid-smoke.yml

@@ -0,0 +1,46 @@
+# Dry-run PMM soak helpers: export, fund-grid plan, grid + single-wallet quote ticks (read-only RPC).
+name: PMM soak grid smoke
+
+on:
+  pull_request:
+    paths:
+      - 'scripts/deployment/pmm-soak*.sh'
+      - 'scripts/deployment/chain138-pmm*.sh'
+      - 'scripts/deployment/pmm-soak-grid-smoke-check.sh'
+      - 'scripts/lib/pmm-soak*.sh'
+      - 'scripts/lib/pmm-soak-dotenv-override.sh'
+      - 'scripts/deployment/pmm-soak-export-wallet-grid.py'
+      - 'config/pmm-soak-pools-stable.txt'
+      - 'config/pmm-soak-wallet-grid.example.json'
+      - '.github/workflows/pmm-soak-grid-smoke.yml'
+  push:
+    branches: [main, master]
+    paths:
+      - 'scripts/deployment/pmm-soak*.sh'
+      - 'scripts/deployment/chain138-pmm*.sh'
+      - 'scripts/deployment/pmm-soak-grid-smoke-check.sh'
+      - 'scripts/lib/pmm-soak*.sh'
+      - 'scripts/lib/pmm-soak-dotenv-override.sh'
+      - 'scripts/deployment/pmm-soak-export-wallet-grid.py'
+      - 'config/pmm-soak-pools-stable.txt'
+      - 'config/pmm-soak-wallet-grid.example.json'
+      - '.github/workflows/pmm-soak-grid-smoke.yml'
+
+jobs:
+  smoke:
+    name: Grid smoke (dry-run, public RPC)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Foundry (cast)
+        uses: foundry-rs/foundry-toolchain@v1
+
+      - name: Install bc
+        run: sudo apt-get update -qq && sudo apt-get install -y bc
+
+      - name: PMM soak grid smoke
+        env:
+          CI: "true"
+        run: bash scripts/deployment/pmm-soak-grid-smoke-check.sh

.github/workflows/validate-config.yml

@@ -6,19 +6,103 @@ on:
     paths:
       - 'config/**'
       - 'scripts/validation/**'
+      - 'scripts/jvmtm/**'
+      - 'scripts/omnl/build-omnl-e2e-settlement-audit-archive.sh'
+      - 'scripts/verify/sync-blockscout-address-labels-from-registry.sh'
+      - 'explorer-monorepo/scripts/generate-topology-graph.sh'
+      - 'explorer-monorepo/frontend/public/config/topology-graph.json'
       - 'scripts/verify/run-all-validation.sh'
+      - 'scripts/verify/verify-end-to-end-routing.sh'
       - 'scripts/run-completable-tasks-from-anywhere.sh'
+      - 'scripts/run-operator-tasks-from-lan.sh'
+      - 'scripts/run-all-operator-tasks-from-lan.sh'
+      - 'scripts/run-full-operator-completion-from-lan.sh'
+      - 'scripts/verify/check-info-defi-oracle-public.sh'
+      - 'scripts/verify/check-completion-status.sh'
+      - 'scripts/verify/check-chain138-rpc-health.sh'
+      - 'scripts/verify/check-chain138-rpc-nonce-gas-parity.sh'
+      - 'scripts/verify/self-test-chain138-rpc-verify.sh'
+      - 'scripts/lib/chain138-lan-rpc-inventory.sh'
+      - 'scripts/monitoring/monitor-blockchain-health.sh'
+      - 'scripts/clear-all-transaction-pools.sh'
       - '.github/workflows/validate-config.yml'
+      - '.github/workflows/verify-info-defi-oracle-public.yml'
       - 'token-lists/**'
       - 'explorer-monorepo/backend/api/rest/config/metamask/**'
+      - 'docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md'
+      - 'docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md'
+      - 'config/jvmtm-regulatory-closure/INAAUDJVMTM_2025_AUDIT_CLOSURE_MATRIX.md'
+      - 'docs/04-configuration/SMART_CONTRACTS_ISO20022_FIN_METHODOLOGY.md'
+      - 'docs/dbis-rail/ISO_GATEWAY_AND_RELAYER_SPEC.md'
+      - 'scripts/deployment/pmm-soak*.sh'
+      - 'scripts/deployment/chain138-pmm*.sh'
+      - 'scripts/lib/pmm-soak*.sh'
+      - 'scripts/deployment/pmm-soak-export-wallet-grid.py'
+      - '.github/workflows/pmm-soak-grid-smoke.yml'
+      - 'docs/11-references/CHAIN138_GRID_6534_WALLET_FUNDING_PLAN.md'
+      - 'docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md'
+      - 'docs/04-configuration/GRU_C_STAR_V2_STANDARDS_MATRIX_AND_IMPLEMENTATION_PLAN.md'
+      - 'scripts/verify/check-gru-reference-primacy-integration.sh'
+      - 'cross-chain-pmm-lps/config/peg-bands.json'
+      - 'cross-chain-pmm-lps/docs/04-bot-policy.md'
+      - 'cross-chain-pmm-lps/docs/05-oracles.md'
+      - 'docs/00-meta/SUBMODULE_HYGIENE.md'
+      - 'docs/00-meta/NEXT_STEPS_LIST.md'
+      - 'docs/00-meta/OPERATOR_READY_CHECKLIST.md'
+      - 'docs/11-references/GRU_V2_PUBLIC_PROTOCOL_DEPLOYMENT_STATUS.md'
+      - '.cursor/rules/chain138-tokens-and-pmm.mdc'
+      - 'scripts/run-completable-tasks-from-anywhere.sh'
   push:
-    branches: [master]
+    branches: [master, main]
     paths:
       - 'config/**'
       - 'scripts/validation/**'
+      - 'scripts/jvmtm/**'
+      - 'scripts/omnl/build-omnl-e2e-settlement-audit-archive.sh'
+      - 'scripts/verify/sync-blockscout-address-labels-from-registry.sh'
+      - 'explorer-monorepo/scripts/generate-topology-graph.sh'
+      - 'explorer-monorepo/frontend/public/config/topology-graph.json'
+      - 'scripts/verify/run-all-validation.sh'
+      - 'scripts/verify/verify-end-to-end-routing.sh'
+      - 'scripts/run-completable-tasks-from-anywhere.sh'
+      - 'scripts/run-operator-tasks-from-lan.sh'
+      - 'scripts/run-all-operator-tasks-from-lan.sh'
+      - 'scripts/run-full-operator-completion-from-lan.sh'
+      - 'scripts/verify/check-info-defi-oracle-public.sh'
+      - 'scripts/verify/check-completion-status.sh'
+      - 'scripts/verify/check-chain138-rpc-health.sh'
+      - 'scripts/verify/check-chain138-rpc-nonce-gas-parity.sh'
+      - 'scripts/verify/self-test-chain138-rpc-verify.sh'
+      - 'scripts/lib/chain138-lan-rpc-inventory.sh'
+      - 'scripts/monitoring/monitor-blockchain-health.sh'
+      - 'scripts/clear-all-transaction-pools.sh'
       - '.github/workflows/validate-config.yml'
+      - '.github/workflows/verify-info-defi-oracle-public.yml'
       - 'token-lists/**'
       - 'explorer-monorepo/backend/api/rest/config/metamask/**'
+      - 'docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md'
+      - 'docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md'
+      - 'config/jvmtm-regulatory-closure/INAAUDJVMTM_2025_AUDIT_CLOSURE_MATRIX.md'
+      - 'docs/04-configuration/SMART_CONTRACTS_ISO20022_FIN_METHODOLOGY.md'
+      - 'docs/dbis-rail/ISO_GATEWAY_AND_RELAYER_SPEC.md'
+      - 'scripts/deployment/pmm-soak*.sh'
+      - 'scripts/deployment/chain138-pmm*.sh'
+      - 'scripts/lib/pmm-soak*.sh'
+      - 'scripts/deployment/pmm-soak-export-wallet-grid.py'
+      - '.github/workflows/pmm-soak-grid-smoke.yml'
+      - 'docs/11-references/CHAIN138_GRID_6534_WALLET_FUNDING_PLAN.md'
+      - 'docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md'
+      - 'docs/04-configuration/GRU_C_STAR_V2_STANDARDS_MATRIX_AND_IMPLEMENTATION_PLAN.md'
+      - 'scripts/verify/check-gru-reference-primacy-integration.sh'
+      - 'cross-chain-pmm-lps/config/peg-bands.json'
+      - 'cross-chain-pmm-lps/docs/04-bot-policy.md'
+      - 'cross-chain-pmm-lps/docs/05-oracles.md'
+      - 'docs/00-meta/SUBMODULE_HYGIENE.md'
+      - 'docs/00-meta/NEXT_STEPS_LIST.md'
+      - 'docs/00-meta/OPERATOR_READY_CHECKLIST.md'
+      - 'docs/11-references/GRU_V2_PUBLIC_PROTOCOL_DEPLOYMENT_STATUS.md'
+      - '.cursor/rules/chain138-tokens-and-pmm.mdc'
+      - 'scripts/run-completable-tasks-from-anywhere.sh'
 
 jobs:
   validate:
@@ -28,11 +112,67 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'pnpm'
+
+      - name: Install workspace dependencies
+        run: pnpm install --frozen-lockfile
+
       - name: Config validation
         run: bash scripts/validation/validate-config-files.sh
 
+      - name: DBIS institutional JSON Schemas
+        run: |
+          python3 -m pip install check-jsonschema
+          SCHEMA_STRICT=1 bash scripts/validation/validate-dbis-institutional-schemas.sh
+
+      - name: JVMTM regulatory closure JSON Schemas
+        run: |
+          python3 -m pip install check-jsonschema
+          SCHEMA_STRICT=1 bash scripts/validation/validate-jvmtm-regulatory-closure-schemas.sh
+
+      - name: Reserve provenance package (3FR attestation JSON)
+        run: |
+          python3 -m pip install check-jsonschema
+          SCHEMA_STRICT=1 bash scripts/validation/validate-reserve-provenance-package.sh
+
       - name: Completable tasks (dry-run)
         run: bash scripts/run-completable-tasks-from-anywhere.sh --dry-run
 
+      - name: Chain 138 RPC verify scripts (syntax + offline parity)
+        run: bash scripts/verify/self-test-chain138-rpc-verify.sh
+
+      - name: Explorer topology graph (regenerate + diff check)
+        run: |
+          bash explorer-monorepo/scripts/generate-topology-graph.sh
+          git diff --exit-code explorer-monorepo/frontend/public/config/topology-graph.json
+
+      - name: ShellCheck (PMM soak grid scripts)
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y shellcheck
+          set -euo pipefail
+          shells=(
+            scripts/deployment/pmm-soak-operator-fund-grid.sh
+            scripts/deployment/pmm-soak-complete-grid-funding-operator.sh
+            scripts/deployment/pmm-soak-operator-fund-full-grid-tranches.sh
+            scripts/deployment/pmm-soak-mint-mirror-usdc-deployer-shortfall.sh
+            scripts/deployment/pmm-soak-complete-operator-bootstrap.sh
+            scripts/deployment/pmm-soak-grid-smoke-check.sh
+            scripts/lib/pmm-soak-dotenv-override.sh
+            scripts/lib/pmm-soak-pools.sh
+            scripts/lib/pmm-soak-chain138-tick.sh
+            scripts/deployment/chain138-pmm-random-soak-swaps.sh
+            scripts/deployment/chain138-pmm-soak-grid-bot.sh
+            scripts/verify/check-gru-reference-primacy-integration.sh
+          )
+          shellcheck -x "${shells[@]}"
+
       - name: Shellcheck (optional)
         run: bash scripts/verify/run-shellcheck.sh --optional

.github/workflows/validate-sankofa-nginx-examples.yml

@@ -0,0 +1,25 @@
+# nginx -t on Sankofa consolidated example configs (no LAN).
+name: Validate Sankofa nginx examples
+
+on:
+  pull_request:
+    paths:
+      - 'config/nginx/sankofa-*.example.conf'
+      - 'config/nginx/sankofa-*-main.example.conf'
+      - 'scripts/verify/check-sankofa-consolidated-nginx-examples.sh'
+      - '.github/workflows/validate-sankofa-nginx-examples.yml'
+  push:
+    branches: [main, master]
+    paths:
+      - 'config/nginx/sankofa-*.example.conf'
+      - 'config/nginx/sankofa-*-main.example.conf'
+      - 'scripts/verify/check-sankofa-consolidated-nginx-examples.sh'
+      - '.github/workflows/validate-sankofa-nginx-examples.yml'
+
+jobs:
+  nginx-syntax:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: nginx -t (host or Docker)
+        run: bash scripts/verify/check-sankofa-consolidated-nginx-examples.sh

.github/workflows/verify-info-defi-oracle-public.yml

@@ -0,0 +1,44 @@
+# Smoke-test the public Chain 138 info hub (HTTPS + agent files + same-origin token-aggregation JSON).
+# No secrets. May fail if the public edge or origin is down — inspect logs and runbook.
+name: Verify info.defi-oracle.io (public)
+
+on:
+  pull_request:
+    paths:
+      - 'scripts/verify/check-info-defi-oracle-public.sh'
+      - 'scripts/verify/playwright-audit-info-defi-oracle.mjs'
+      - 'info-defi-oracle-138/**'
+      - '.github/workflows/verify-info-defi-oracle-public.yml'
+  workflow_dispatch:
+    inputs:
+      info_site_base:
+        description: 'Optional INFO_SITE_BASE (staging). Leave empty to use repo variable or default https://info.defi-oracle.io'
+        required: false
+        type: string
+        default: ''
+  schedule:
+    - cron: '35 14 * * 1' # Mondays 14:35 UTC (~ weekly)
+
+jobs:
+  verify:
+    name: check-info-defi-oracle-public.sh
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install jq
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq jq
+
+      - name: Public info site + token-aggregation
+        shell: bash
+        env:
+          INPUT_BASE: ${{ github.event.inputs.info_site_base }}
+          VAR_BASE: ${{ vars.INFO_SITE_BASE }}
+        run: |
+          set -euo pipefail
+          if [ -n "${INPUT_BASE}" ]; then export INFO_SITE_BASE="${INPUT_BASE}"; fi
+          if [ -z "${INFO_SITE_BASE:-}" ] && [ -n "${VAR_BASE}" ]; then export INFO_SITE_BASE="${VAR_BASE}"; fi
+          bash scripts/verify/check-info-defi-oracle-public.sh

.gitignore

@@ -1,3 +1,6 @@
+# Nested clone (not a declared submodule; use submodule add if it should be tracked)
+transaction-composer/
+
 # Dependencies
 node_modules/
 .pnpm-store/
@@ -6,10 +9,20 @@ node_modules/
 package-lock.json
 yarn.lock
 
+# DBIS identity package — never commit real secrets (example only is tracked)
+config/production/dbis-identity-public-did-secrets.env
+
+# Local executor allowlist (copy from executor-allowlist.example.json)
+packages/economics-toolkit/config/executor-allowlist.json
+
+# PMM soak grid (addresses tied to a real mnemonic — generate locally)
+config/pmm-soak-wallet-grid.json
+
 # Environment files
 .env
 .env.local
 .env.*.local
+.env.keeper.local
 .env.master
 
 # Logs
@@ -26,8 +39,18 @@ Thumbs.db
 # Local-only Cursor session / context (exclude from Gitea)
 .cursor/local/
 
-# Devin for Terminal personal overrides / secrets
-.devin/config.local.json
+# Local Codex / IDE artifacts
+.codex
+.codex/
+
+# Scratch and regenerated audit trees (re-run OMNL/JVMTM scripts to reproduce)
+tmp/
+output/jvmtm-evidence/
+output/settlement-events/
+output/omnl-e2e-settlement-audit-*/
+output/*compliance-archive*.zip
+output/omnl-e2e-settlement-audit-*.zip
+output/transaction-package-HYBX-BATCH-001/
 
 # IDE files
 .vscode/
@@ -54,11 +77,13 @@ out/
 
 # Python
 venv/
+.venv-checkjson/
 __pycache__/
 *.pyc
 
 # CoinGecko/CMC token logos (generated by prepare-token-logos-512x512.sh)
 docs/04-configuration/coingecko/logos/*.png
+token-lists/logos/*.png
 
 # Ephemeral phase markers
 .phase1-event-status
@@ -66,6 +91,18 @@ docs/04-configuration/coingecko/logos/*.png
 # DBIS Phase 1 discovery — timestamped reports (run scripts/verify/run-phase1-discovery.sh)
 reports/phase1-discovery/phase1-discovery-*.md
 
+# Timestamped infra inventory/status exports (source-of-truth files stay tracked)
+reports/status/drift_*.json
+reports/status/live_inventory_*.json
+reports/status/hardware_poll_*.txt
+reports/status/lxc_cluster_health_*.json
+reports/status/lxc_cluster_health_*.txt
+
+# Wormhole AI docs mirror (sync with scripts/doc/sync-wormhole-ai-resources.sh; keep manifest.json committable)
+third-party/wormhole-ai-docs/**
+!third-party/wormhole-ai-docs/README.md
+!third-party/wormhole-ai-docs/manifest.json
+
 # OMNL operator rail (env-specific IDs, reconciliation, audit packets, posted refs)
 ids.env
 reconciliation/
@@ -78,83 +115,14 @@ reconciliation/
 *.payload.sha256
 audit_log.jsonl
 
-# cross-chain-pmm-lps-publish: git worktree under that repo — not a parent submodule
+# Local publish / clone trees (nested git repos; not submodules)
 cross-chain-pmm-lps-publish/
-
-# Local scratch (never commit)
-.tmp-*.cjs
-.codex
-.codex/
-.venv-checkjson/
-.env.bak.pmg.*
-
-# Teammate / third-party onboarding (API token handoffs; never commit)
-reports/secrets/
-
-# Operator / runtime env snapshots under reports/ (sensitive; regenerate from hosts)
-reports/status/operator-*.env
-reports/status/operator-runtime*.env
-reports/status/chain138_aave_runtime.env
-reports/status/*runtime-env*.env
-reports/status/ei-matrix-eth-send*
-reports/status/token-aggregation-*.tar.gz
-config/production/*did-secrets.env
-
-# Bulky one-off local outputs (re-run scripts to restore)
-output/omnl-e2e-*.zip
-output/omnl-e2e-*/
-output/office22-*.zip
-output/settlement-events/
-output/transaction-package-*/
-output/cw-assets-usd-quote-dump.json
-output/jvmtm-evidence/
-
-# Generated verification evidence snapshots (keep curated evidence, ignore rerunnable timestamped dumps)
-docs/04-configuration/verification-evidence/e2e-verification-*/
-
-# Generated deployment and inventory machine outputs
-reports/deployment/*_20[0-9][0-9]-[0-9][0-9]-[0-9][0-9].md
-reports/deployment/check-deployer-lp-balances-*.json
-reports/inventory/container_inventory_*.csv
-reports/inventory/contract-inventory-*.json
-reports/inventory/DEPLOYED_CONTRACTS_*.md
-reports/inventory/INCOMPLETE_DUPLICATE_ANALYSIS.md
-reports/inventory/INVENTORY_COVERAGE_GAPS.md
-reports/inventory/deployed-contracts-completion-matrix.json
-reports/inventory/incomplete-duplicate-bytecode-analysis.json
-
-# Generated status artifacts (rerunnable from wrappers/validation scripts)
-reports/status/MULTI_NETWORK_DEPLOYMENT_AUDIT_*.md
-reports/status/*-latest.json
-reports/status/*-latest.md
-reports/status/*-latest.csv
-reports/status/hardware_poll_*.txt
-reports/status/lxc_cluster_health_*.json
-reports/status/lxc_cluster_health_*.txt
-reports/status/mainnet-cwusdc-usdc-preflight-*.json
-reports/status/mainnet-cwusdc-usdc-repeg-plan-*.json
-reports/status/live_inventory_*.json
-reports/status/drift_*.json
-
-# Ephemeral e2e dry-run outputs (local re-runs; not canonical reports)
-reports/e2e-dry-runs/
-
-# Local relay / thirdweb scaffold trees (subtree or vendor experiments — git add -f if promoted)
-relay/
-relay-api/
-relay-docs/
-relay-web/
-thirdweb-contracts/
-
-# One-off liquidity staging helpers (operator-generated; use committed runbooks as source of truth)
-scripts/verify/stage-250m-eth-to-cwusdc-dry-run.sh
-scripts/verify/stage-427m-cusdc-weth-liquidity-funding.sh
-
-# Large optional vendor trees and local checkouts (keep out of main clone)
 smom-dbis-138-publish/
-third-party/
-thirdweb-core-2103-test/
-tmp/
-token-aggregation-build/
-transaction-composer/
-vendor/
+
+# Thirdweb scratch test: vendored contracts dep is a nested clone
+thirdweb-core-2103-test/lib/contracts/
+
+# Stray empty placeholders at repo root (do not track)
+/Arbitrum
+/cWUSDC
+/cWUSDT

.gitmodules

@@ -4,7 +4,7 @@
 	# Primary integration remote is Gitea; use GitHub only as an optional mirror when available.
 [submodule "mcp-proxmox"]
 	path = mcp-proxmox
-	url = https://gitea.d-bis.org/d-bis/mcp-proxmox.git
+	url = https://github.com/gilby125/mcp-proxmox.git
 [submodule "smom-dbis-138"]
 	path = smom-dbis-138
 	url = git@github.com:Order-of-Hospitallers/smom-dbis-138.git
@@ -64,7 +64,6 @@
 [submodule "MEV_Bot"]
 	path = MEV_Bot
 	url = https://gitea.d-bis.org/d-bis/MEV_Bot.git
-[submodule "atomic-swap-dapp"]
-	path = atomic-swap-dapp
-	url = https://gitea.d-bis.org/d-bis/atomic-swap-dapp.git
-	# Local bootstrap remote for initial scaffolding; replace with canonical hosted remote before team-wide clone use.
+[submodule "thirdweb-core-2103-test/lib/contracts"]
+	path = thirdweb-core-2103-test/lib/contracts
+	url = https://github.com/thirdweb-dev/contracts

.ops-backups/cloudflare/sfvalley02-config-20260405-1513-post-cleanup.json

@@ -0,0 +1 @@
+{"success":true,"errors":[],"messages":[],"result":{"tunnel_id":"892bd3fe-c6fa-4ddf-8b60-a8ed2b849c3d","version":14,"config":{"ingress":[{"service":"https://192.168.11.169:443","hostname":"rpc-core-2.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-alltra.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-alltra-2.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-alltra-3.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-hybx.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-hybx-2.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-hybx-3.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"cacti-alltra.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"cacti-hybx.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"http_status:404"}],"warp-routing":{"enabled":false}},"source":"cloudflare","created_at":"2026-04-05T22:11:28.363368Z"}}

AGENTS.md

@@ -11,41 +11,85 @@ Orchestration for Proxmox VE, Chain 138 (`smom-dbis-138/`), explorers, NPMplus,
 | Need | Location |
 |------|-----------|
 | Doc index | `docs/MASTER_INDEX.md` |
-| Canonical ecosystem master plan | `docs/02-architecture/DBIS_ECOSYSTEM_TECHNICAL_MASTER_PLAN.md` — umbrella root; subordinate roots: `dbis_chain_138_technical_master_plan.md`, `docs/03-deployment/DBIS_RTGS_MASTER_PLAN_IMPLEMENTATION_TRACKER.md`, `docs/04-configuration/universal-resource-activation/URA_MANIFEST_AUTOMATION_IMPLEMENTATION_TRACKER.md` |
-| Treasury / EMI / wallet / VA master plan | `docs/02-architecture/GOVERNMENT_TREASURY_EMI_WALLET_MASTER_PLAN.md` — government treasury, EMIs, digital wallets, virtual accounts (incl. Tatum-style), Rail vs RTGS gates |
-| Universal resource activation (manifest, CI, Phoenix) | `UNIVERSAL_RESOURCE_WIRING.md`, `URA_MANIFEST_AUTOMATION_IMPLEMENTATION_TRACKER.md`, `URA_OPERATIONAL_READINESS_CHECKLIST.md` (under `docs/04-configuration/universal-resource-activation/`); `config/universal-resource-activation/{manifest.json,policy-profiles.json,integration/}`; `pnpm ura:ops-readiness` / `ura:ops-readiness:full`, `ura:production-ready` / `ura:production-ready:connectivity`, `ura:validate`, `ura:validate-profiles`, `ura:merge-manifest`, `ura:validate-ledger-mapping`, `ura:writer:ledger`, `ura:writer:settlement`, `ura:profile-hash`, `ura:validate-closure`, `ura:keccak`, `ura:smoke`; `URA_STRICT_CLOSURE` / Gitea `vars.URA_STRICT_CLOSURE`; `smom-dbis-138/contracts/universal-resource/PolicyProfileRegistry.sol` (scoped forge test); Phoenix `PUBLIC_V1_NO_PARTNER_KEY_PATHS` |
-| Multi-jurisdiction compliance (matrices, onboarding) | `docs/04-configuration/compliance-matrices/README.md`, `INSTITUTION_ONBOARDING_CHARTER.md`, `INSTITUTION_ONBOARDING_PLAYBOOK.md`, `docs/04-configuration/jurisdictions/JURISDICTION_CATALOG.md`, `config/jurisdictions/catalog.v1.json`, `docs/dbis-rail/DBIS_RAIL_JURISDICTION_TRACEABILITY.md`, `docs/03-deployment/DBIS_RTGS_MASTER_PLAN_IMPLEMENTATION_TRACKER.md` |
+| Chain 138 PMM swap quote (CLI) | `bash scripts/verify/pmm-swap-quote-chain138.sh --token-in … --amount-in …` — on-chain `querySellBase`/`querySellQuote` + suggested `minOut` for `DODOPMMIntegration.swapExactIn` (REST `/quote` is xy=k only). |
+| **DeFi economics toolkit** (flash/gas buckets, path gate, dry-run exec, live gas quotes, multi-leg strategies) | `pnpm run economics:test`; `pnpm run economics:validate` (parse + optional `check-jsonschema` on smoke/template); `pnpm exec economics-toolkit calc|path-check|gas-quote|gas-budget|prepare-swap|exec`; `pnpm exec economics-toolkit strategy kinds|template|validate|eval|optimize|optimize-multi|optimize-random|optimize-descent|enrich|runbook|exec-plan`; live refresh: `bash scripts/economics/refresh-strategy-from-live.sh [--apply] <strategy.json>`; examples `config/strategy-bounds.example.json`, `config/strategy-optimize-dims.example.json`; template `packages/economics-toolkit/config/strategy-template.json`, smoke `strategy-smoke.json`, schema `strategy.schema.json`; allowlist `packages/economics-toolkit/config/executor-allowlist.example.json`; `gas-networks.json`; flow tables `packages/economics-toolkit/docs/FLOW_INPUTS_OUTPUTS_TABLE.md`; CI `.github/workflows/economics-toolkit.yml`. |
+| Chain 138 info site (`info.defi-oracle.io`) | Dedicated nginx LXC (default VMID **2410** / `IP_INFO_DEFI_ORACLE_WEB`): `provision-info-defi-oracle-web-lxc.sh` then `sync-info-defi-oracle-to-vmid2400.sh` (sync asserts `/token-aggregation` proxy); NPM fleet `scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh`; Cloudflare DNS `scripts/cloudflare/set-info-defi-oracle-dns-to-vmid2400-tunnel.sh`; cache `pnpm run cloudflare:purge-info-defi-oracle-cache`; runbook `docs/04-configuration/INFO_DEFI_ORACLE_IO_DEPLOYMENT.md`; `pnpm run verify:info-defi-oracle-public` (SPA routes including `/governance`, `/ecosystem`, `/documentation`, `/solacenet`, `llms.txt`, `agent-hints.json`, **same-origin** token-aggregation JSON; `INFO_SITE_BASE=…` optional); CI `info-defi-oracle-138.yml` (build) and `verify-info-defi-oracle-public.yml` (weekly + manual smoke); optional `pnpm run audit:info-defi-oracle-site` (`pnpm exec playwright install chromium`) |
+| **MEV Control GUI** (`mev.defi-oracle.io`) | Same nginx LXC as info by default: `scripts/deployment/sync-mev-control-gui-defi-oracle.sh` (builds `MEV_Bot/mev-platform/gui`, installs `/api` proxy to `MEV_ADMIN_API_HOST`:`MEV_ADMIN_API_PORT`); NPM + DNS via `update-npmplus-proxy-hosts-api.sh` and `scripts/cloudflare/set-mev-defi-oracle-dns.sh`; runbook `docs/04-configuration/MEV_CONTROL_DEFI_ORACLE_IO_DEPLOYMENT.md` |
+| **omdnl.org** (static landing) | Nginx LXC VMID **10203** / `IP_OMDNL_ORG_WEB` (default 192.168.11.222): `scripts/deployment/provision-omdnl-org-web-lxc.sh` → `sync-omdnl-org-static-to-ct.sh`; Cloudflare `configure-omdnl-org-dns.sh` (`CLOUDFLARE_ZONE_ID_OMDNL_ORG`, `PUBLIC_IP`); NPM `upsert-omdnl-org-proxy-host.sh`; content in `sites/omdnl-org/public/`. |
+| **SolaceNet + gateway rails** (dbis_core) | Hub map: `docs/04-configuration/SOLACENET_PUBLIC_HUB.md`. Backlog: `dbis_core/docs/solacenet/REMAINING_TASKS_FULL_LIST.md`. Gap IDs: `dbis_core/docs/solacenet/PROTOCOL_GAPS_CHECKLIST.md`. **Delta audit** (missing wiring, naming drift, CI): `dbis_core/docs/solacenet/AUDIT_GAPS_INCONSISTENCIES_MISSING.md`. Enforce rails runbook: `dbis_core/docs/solacenet/SOLACENET_GATEWAY_RAILS_ENFORCE_RUNBOOK.md`. Tests: `cd dbis_core && npm run test:gateway` (unit + HTTP integration). **Provider seed:** `cd dbis_core && npm run seed:gateway-provider` (needs `DATABASE_URL`). **Smoke (auth):** `bash scripts/verify/check-dbis-core-gateway-rails.sh`. **Outbox worker:** `cd dbis_core && npm run worker:gateway-outbox` (`DATABASE_URL`). CI: `.github/workflows/dbis-core-gateway-ci.yml`. API: `GET/POST /api/v1/gateway/rails*` (optional `SOLACENET_GATEWAY_RAILS_ENFORCE`) — `dbis_core/src/core/gateway/routes/gateway.routes.ts`. |
 | cXAUC/cXAUT unit | 1 full token = 1 troy oz Au — `docs/11-references/EXPLORER_TOKEN_LIST_CROSSCHECK.md` (section 5.1) |
+| GRU / UTRNF token naming (`c*` vs collateral prefix) | `docs/04-configuration/naming-conventions/README.md`, `docs/04-configuration/naming-conventions/02_DBIS_NAMESPACE_AND_UTRNF_MAPPING.md` |
+| **GRU reference primacy vs public cW\* PMM mesh** (FX policy; mesh = execution, not shadow oracle) | `docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md` |
 | PMM mesh 6s tick | `smom-dbis-138/scripts/reserve/pmm-mesh-6s-automation.sh` — `docs/integration/ORACLE_AND_KEEPER_CHAIN138.md` (PMM mesh automation) |
+| **PMM soak grid (33×33×6 wallets)** | `docs/11-references/CHAIN138_GRID_6534_WALLET_FUNDING_PLAN.md` — one-shot `scripts/deployment/pmm-soak-complete-operator-bootstrap.sh` (`PMM_SOAK_AUTO_INIT_GRID_MNEMONIC=1` … `--apply-funds --to-linear 19`); full-grid resume `scripts/deployment/pmm-soak-complete-grid-funding-operator.sh` (`PMM_SOAK_START_LEG`, `PMM_SOAK_RESUME_NATIVE_FROM_LINEAR`, `PMM_SOAK_RPC_URL_OVERRIDE`, `PMM_SOAK_FUND_PROGRESS_EVERY` via fund-grid); tranche driver `scripts/deployment/pmm-soak-operator-fund-full-grid-tranches.sh`; export `pmm-soak-export-wallet-grid.py`, fund `pmm-soak-operator-fund-grid.sh`, pools `scripts/lib/pmm-soak-pools.sh`, bots `chain138-pmm-soak-grid-bot.sh` / `chain138-pmm-random-soak-swaps.sh` (`--pool-preset`, `--swap-via`; `scripts/lib/pmm-soak-dotenv-override.sh` preserves caller `PMM_SOAK_POOL_*` / `CHAIN138_PMM_SOAK_SWAP_VIA` over `.env`), smoke `scripts/deployment/pmm-soak-grid-smoke-check.sh`, CI `.github/workflows/pmm-soak-grid-smoke.yml` |
+| Mainnet cWUSD\* peg, TRUU PMM, bot readiness | `docs/03-deployment/MAINNET_PMM_TRUU_CWUSD_PEG_AND_BOT_RUNBOOK.md` (§11 live inventory) — `scripts/verify/check-mainnet-pmm-peg-bot-readiness.sh`, `scripts/deployment/deploy-mainnet-pmm-cw-truu-pool.sh`, `scripts/deployment/add-mainnet-truu-pmm-topup.sh`, `scripts/deployment/compute-mainnet-truu-liquidity-amounts.sh`, `scripts/deployment/compute-mainnet-truu-pmm-seed-amounts.sh`; `cross-chain-pmm-lps/config/deployment-status.json` `pmmPoolsVolatile`; `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md` (Mainnet TRUU PMM); `check-full-deployment-status.sh` when `ETHEREUM_MAINNET_RPC` + `DODO_PMM_INTEGRATION_MAINNET` are set |
+| Mainnet cWUSD\* hybrid flash loop (modeled ladder + readiness) | `docs/03-deployment/MAINNET_CWUSD_HYBRID_FLASH_LOOP_CALCULATION_WHITEPAPER.md`; `scripts/analytics/pmm-flash-push-break-even.mjs` (`--sequential-matched-loops`, `--full-loop-dry-run --execution-grade`); `scripts/verify/check-public-pmm-dry-run-readiness.sh`; `scripts/verify/run-mainnet-cwusdc-usdc-ladder-steps-1-3.sh` (optional `PMM_FLASH_EXIT_PRICE_CMD`); `scripts/verify/print-mainnet-cwusdc-usdc-pmm-sellbase-implied-price.sh` (pool-implied diagnostic); `scripts/verify/print-mainnet-cwusdc-external-exit-quote.sh` (DODO / 1inch hosted quote for `--external-exit-price-cmd`); same APIs in `pnpm exec economics-toolkit swap-quote` |
+| Mainnet cWUSDT/cWUSDC PMM + USDT↔USDC pathing | `cross-chain-pmm-lps/config/deployment-status.json` (`cWUSDT`/`cWUSDC`); `scripts/deployment/compute-mainnet-cwusdt-cwusdc-seed-amounts.sh`, `deploy-mainnet-cwusdt-cwusdc-pool.sh`, `add-mainnet-public-dodo-cw-liquidity.sh --pair=cwusdt-cwusdc`, `run-mainnet-cwusdt-cwusdc-soak-roundtrips.sh`; `scripts/verify/plan-mainnet-usdt-usdc-via-cw-paths.sh`; `scripts/verify/report-mainnet-deployer-liquidity-and-routes.sh` (deployer + deep USDC/USDT venues); `run-mainnet-public-dodo-cw-swap.sh --pair=cwusdt-cwusdc`; `.env.master.example` `POOL_CWUSDT_CWUSDC_MAINNET` |
+| Mainnet cWUSDC/USDC **1:1 reserve peg** (6dp raw vault parity) | `scripts/verify/check-mainnet-cwusdc-usdc-reserve-peg.sh` (`PEG_IMBALANCE_MAX_BPS`, default 25); remediate with `scripts/deployment/plan-mainnet-cwusdc-usdc-rebalance-liquidity.sh` then `add-mainnet-public-dodo-cw-liquidity.sh --pair=cwusdc-usdc` (both `--base-amount` and `--quote-amount`; `--dry-run` first) |
+| Mainnet cWUSDC/USDC rebalance **without wallet USDC** (flash quote-push) | Plan: `scripts/deployment/plan-mainnet-cwusdc-flash-quote-push-rebalance.sh`; **models**: `run-mainnet-cwusdc-flash-quote-push-model-sweep.sh`; **V3 pool probe**: `scripts/verify/probe-uniswap-v3-cwusdc-usdc-mainnet.sh`; **V3 path hex (UNWIND_MODE=2)**: `scripts/verify/build-uniswap-v3-exact-input-path-hex.sh`; **deploy stack**: `deploy-mainnet-aave-quote-push-stack.sh` (`--dry-run` / `--apply`); **one tx**: `run-mainnet-aave-cwusdc-quote-push-once.sh`; **loop**: `run-mainnet-aave-cwusdc-quote-push-loop.sh` + `FLASH_LOOP_COUNT`. Forge: `smom-dbis-138/script/flash/RunMainnetAaveCwusdcUsdcQuotePushOnce.s.sol` (`UNWIND_MODE` 0=fee / 1=DODO pool / 2=V3 path hex). Whitepaper: `MAINNET_CWUSD_HYBRID_FLASH_LOOP_CALCULATION_WHITEPAPER.md`. |
 | VMID / IP / FQDN | `docs/04-configuration/ALL_VMIDS_ENDPOINTS.md` |
-| Ops template + JSON | `docs/03-deployment/PROXMOX_VE_OPERATIONAL_DEPLOYMENT_TEMPLATE.md`, `config/proxmox-operational-template.json` |
-| Live vs template (read-only SSH) | `bash scripts/verify/audit-proxmox-operational-template.sh` |
-| Config validation | `bash scripts/validation/validate-config-files.sh` |
-| pnpm lockfile vs workspace (prevents `pnpm outdated` / importer bugs) | `bash scripts/verify/check-pnpm-workspace-lockfile.sh` — also run as **step 1b** in `run-all-validation.sh` |
-| CI validation (no LAN) + cW* mesh matrix | `bash scripts/verify/run-all-validation.sh [--skip-genesis]` — same gate as **Gitea** push/PR: `run-all-validation` in `.gitea/workflows/deploy-to-phoenix.yml` (push) and `.gitea/workflows/validate-on-pr.yml` (PR only). After deploy, optional **Cloudflare** `cloudflare-sync` (Phoenix + `PHOENIX_REPO_ROOT`; set `PHOENIX_CLOUDFLARE_SYNC=1` on that host) via `scripts/deployment/gitea-cloudflare-sync.sh`. Steps: dependencies, **pnpm workspace/lockfile check**, config, cW* mesh (when pair-discovery exists), **`node cross-chain-pmm-lps/scripts/validate-deployment-status.cjs`**, optional genesis. Manual only: `bash scripts/verify/build-cw-mesh-deployment-matrix.sh [--json-out …]` |
+| Proxmox Mail Proxy (LAN SMTP) | VMID **100** `192.168.11.32` (`proxmox-mail-gateway`) — submission **587** / **465**; see Mail Proxy note in `ALL_VMIDS_ENDPOINTS.md` |
+| Spare R630 storage + optional tune-up | `scripts/proxmox/ensure-r630-spare-node-storage.sh`, `scripts/proxmox/provision-r630-03-six-ssd-thinpools.sh`, `scripts/proxmox/pve-spare-host-optional-tuneup.sh` · load balance / migrate: `docs/04-configuration/PROXMOX_LOAD_BALANCING_RUNBOOK.md` |
+| Ops template + JSON | `docs/03-deployment/PROXMOX_VE_OPERATIONAL_DEPLOYMENT_TEMPLATE.md`, `config/proxmox-operational-template.json` (`proxmox_nodes[].mgmt_fqdn` = `*.sankofa.nexus`; `config/ip-addresses.conf` `PROXMOX_FQDN_*`) |
+| Live vs template (read-only SSH) | `bash scripts/verify/audit-proxmox-operational-template.sh` — defaults to ML110 + **r630-01..04** (`PROXMOX_HOSTS` overrides) |
+| Proxmox mgmt FQDN DNS + `/etc/hosts` snippet | `bash scripts/verify/check-proxmox-mgmt-fqdn.sh` (`--print-hosts`, optional `--ssh`) |
+| Proxmox SSH check (all 5 nodes) | `bash scripts/security/ensure-proxmox-ssh-access.sh` (`--fqdn`, optional `--copy` for `ssh-copy-id`) |
+| Proxmox cluster hardware poll (LAN, key SSH) | `bash scripts/verify/poll-proxmox-cluster-hardware.sh` — writes `reports/status/hardware_poll_*.txt`; companion narrative + ARP/edge: `reports/status/hardware_and_connected_inventory_*.md` |
+| Proxmox LXC cluster health poll (LAN, key SSH) | `bash scripts/verify/poll-lxc-cluster-health.sh` — pulls `/cluster/resources` + per-node load/PSI/`pvesm`; writes `reports/status/lxc_cluster_health_*.json` and `.txt`; exits `0` ok / `1` warn / `2` crit / `3` collection failure |
+| Proxmox LXC rebalance planner (read-only) | `bash scripts/verify/plan-lxc-rebalance-from-health-report.sh [--report reports/status/lxc_cluster_health_*.json] --source r630-01 --target r630-04` — ranks move candidates, prints `pct migrate` commands, excludes chain-critical / infra-critical names by pattern |
+| IT live inventory + IPAM drift (LAN, Phase 0) | `bash scripts/it-ops/export-live-inventory-and-drift.sh` → `reports/status/live_inventory.json`, `drift.json` (exit **2** only if duplicate guest IPs; merges `ip-addresses.conf` + `ALL_VMIDS_ENDPOINTS.md`). Optional **`IT_BFF_SNAPSHOT_DB=/path/it.sqlite`** appends export metadata; optional **`IT_COLLECT_IP_NEIGH=1`** on PVE enables `ip neigh` sample in collector. [SANKOFA_IT_OPS_LIVE_INVENTORY_SCRIPTS.md](docs/03-deployment/SANKOFA_IT_OPS_LIVE_INVENTORY_SCRIPTS.md). Spec: [SANKOFA_IT_OPERATIONS_CONTROLLER_SPEC.md](docs/02-architecture/SANKOFA_IT_OPERATIONS_CONTROLLER_SPEC.md); ADR: [SANKOFA_IT_API_DEPLOYMENT_DECISION.md](docs/02-architecture/SANKOFA_IT_API_DEPLOYMENT_DECISION.md) |
+| IT inventory read API (Phase 0–1 BFF stub) | `python3 services/sankofa-it-read-api/server.py` — GET `/health`, `/v1/summary`, `/v1/collector-contract`, `/v1/portmap/joined` (stub), `/v1/inventory/live`, `/v1/inventory/drift`; POST `/v1/inventory/refresh` (returns `drift_exit_code`; **2** = duplicate IP alert). Optional `IT_READ_API_KEY`, `IT_BFF_OIDC_ISSUER` (health only). [services/sankofa-it-read-api/README.md](services/sankofa-it-read-api/README.md), systemd [config/systemd/sankofa-it-read-api.service.example](config/systemd/sankofa-it-read-api.service.example) |
+| **IT read API LAN bootstrap** | `bash scripts/deployment/bootstrap-sankofa-it-read-api-lan.sh` — rsync → `/opt/proxmox` on seed PVE (includes `config/it-operations/`), systemd + `/etc/sankofa-it-read-api.env`, repo `.env` + portal CT 7801 merge, weekly export timer on PVE. NPM: [upsert-it-read-api-proxy-host.sh](scripts/nginx-proxy-manager/upsert-it-read-api-proxy-host.sh); DNS: [add-it-api-sankofa-dns.sh](scripts/cloudflare/add-it-api-sankofa-dns.sh). [SANKOFA_IT_OPS_KEYCLOAK_PORTAL_NEXT_STEPS.md](docs/03-deployment/SANKOFA_IT_OPS_KEYCLOAK_PORTAL_NEXT_STEPS.md) |
+| Keycloak realm role + group for portal `/it` | `bash scripts/deployment/keycloak-sankofa-ensure-it-admin-role.sh` then `bash scripts/deployment/keycloak-sankofa-ensure-it-admin-group.sh` (CT 7802 via SSH); add IT users to group **sankofa-it-admin**. MFA: [SANKOFA_IT_OPS_KEYCLOAK_PORTAL_NEXT_STEPS.md](docs/03-deployment/SANKOFA_IT_OPS_KEYCLOAK_PORTAL_NEXT_STEPS.md). Portal: `IT_READ_API_URL` + optional `IT_READ_API_KEY` on CT 7801. Weekly export timer: [config/systemd/sankofa-it-inventory-export.timer.example](config/systemd/sankofa-it-inventory-export.timer.example) |
+| IT VLAN + port map + billing skeleton | VLAN runbook [VLAN_FLAT_11_TO_SEGMENTED_RUNBOOK.md](docs/03-deployment/VLAN_FLAT_11_TO_SEGMENTED_RUNBOOK.md); port layers [IT_PORT_MAP_LAYERS_SPEC.md](docs/02-architecture/IT_PORT_MAP_LAYERS_SPEC.md); edge IPs [IT_OPS_EDGE_DISCOVERY_IPS.md](docs/04-configuration/IT_OPS_EDGE_DISCOVERY_IPS.md); collectors contract [IT_LIVE_COLLECTORS_CONTRACT.md](docs/02-architecture/IT_LIVE_COLLECTORS_CONTRACT.md); Stripe outline [IT_OPERATIONS_BILLING_STRIPE_OUTLINE.md](docs/03-deployment/IT_OPERATIONS_BILLING_STRIPE_OUTLINE.md); guarded Proxmox preview [scripts/it-ops/proxmox-guarded-write-adapter.sh](scripts/it-ops/proxmox-guarded-write-adapter.sh); Gitea `.gitea/workflows/live-inventory-hardware-weekly.yml` |
+| IT admin UI next steps (Keycloak + portal `/it`) | [docs/03-deployment/SANKOFA_IT_OPS_KEYCLOAK_PORTAL_NEXT_STEPS.md](docs/03-deployment/SANKOFA_IT_OPS_KEYCLOAK_PORTAL_NEXT_STEPS.md) |
+| Config validation | `bash scripts/validation/validate-config-files.sh` (optional: `python3 -m pip install check-jsonschema` for `validate-dbis-institutional-schemas.sh`, `validate-naming-convention-registry-examples.sh`, `validate-jvmtm-regulatory-closure-schemas.sh`, `validate-reserve-provenance-package.sh`; includes explorer Chain 138 inventory vs `config/smart-contracts-master.json`) |
+| Chain 138 contract addresses (JSON + bytecode) | `config/smart-contracts-master.json` — `bash scripts/verify/check-contracts-on-chain-138.sh` (expect **75/75** when Core RPC reachable; jq uses JSON when file present) |
+| OMNL + Core + Chain 138 + RTGS + Smart Vaults | `docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md`; identifiers (UETR vs DLT-primary): `docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md`; JVMTM Tables B/C/D closure matrix: `config/jvmtm-regulatory-closure/INAAUDJVMTM_2025_AUDIT_CLOSURE_MATRIX.md`; **dual-anchor attestation:** `scripts/omnl/omnl-chain138-attestation-tx.sh` (138 + optional mainnet via `ETHEREUM_MAINNET_RPC`); E2E zip: `AUDIT_PROOF.json` `chainAttestationMainnet`; machine-readable: `config/dbis-institutional/` |
+| Blockscout address labels from registry | `bash scripts/verify/sync-blockscout-address-labels-from-registry.sh` (plan); `--apply` with `BLOCKSCOUT_*` env when explorer API confirmed |
+| ISO-20022 on-chain methodology + intake gateway | `docs/04-configuration/SMART_CONTRACTS_ISO20022_FIN_METHODOLOGY.md`, `ISO20022_INTAKE_GATEWAY_CONTRACT_MULTI_NETWORK.md`; Rail: `docs/dbis-rail/ISO_GATEWAY_AND_RELAYER_SPEC.md` |
 | FQDN / NPM E2E verifier | `bash scripts/verify/verify-end-to-end-routing.sh --profile=public` — inventory: `docs/04-configuration/E2E_ENDPOINTS_LIST.md`. Gitea Actions URLs (no API): `bash scripts/verify/print-gitea-actions-urls.sh` |
+| **Gitea** (org forge **VMID 104**, upgrades, NPM) | `docs/04-configuration/GITEA_PLATFORM_AND_UPGRADE_RUNBOOK.md` — `scripts/operator/upgrade-gitea-lxc.sh` (`--dry-run`, `GITEA_VERSION=`); `config/ip-addresses.conf` **`IP_GITEA_INFRA`**, **`GITEA_PUBLIC_UPSTREAM_*`**; `scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh`, `update-npmplus-fourth-proxy-hosts.sh` |
+| Chain 138 LAN RPC health + nonce/gas parity | `bash scripts/verify/check-chain138-rpc-health.sh` (fleet + public capability); `bash scripts/verify/check-chain138-rpc-nonce-gas-parity.sh` (LAN: aligned chainId / deployer nonces / gasPrice); offline/CI: `bash scripts/verify/self-test-chain138-rpc-verify.sh`; shared VMID list: `scripts/lib/chain138-lan-rpc-inventory.sh` |
+| RPC FQDN batch (`eth_chainId` + WSS) | `bash scripts/verify/check-rpc-fqdns-e2e.sh` — after DNS + `update-npmplus-proxy-hosts-api.sh`; includes `rpc-core.d-bis.org` |
 | Submodule trees clean (CI / post-merge) | `bash scripts/verify/submodules-clean.sh` |
-| Submodule + explorer remotes | `docs/00-meta/SUBMODULE_HYGIENE.md` — `mcp-proxmox` uses **Gitea** `https://gitea.d-bis.org/d-bis/mcp-proxmox.git` (not the old GitHub-only URL). `cross-chain-pmm-lps-publish` is a **worktree** of `cross-chain-pmm-lps`, not a submodule. |
+| Submodule + explorer remotes | `docs/00-meta/SUBMODULE_HYGIENE.md` |
 | smom-dbis-138 `.env` in bash scripts | Prefer `source smom-dbis-138/scripts/lib/deployment/dotenv.sh` + `load_deployment_env --repo-root "$PROJECT_ROOT"` (trims RPC URL line endings). From an interactive shell: `source smom-dbis-138/scripts/load-env.sh`. Proxmox root scripts: `source scripts/lib/load-project-env.sh` (also trims common RPC vars). |
-| Sankofa portal → CT 7801 (build + restart) | `./scripts/deployment/sync-sankofa-portal-7801.sh` (`--dry-run` first); sets `NEXTAUTH_URL` on CT via `sankofa-portal-ensure-nextauth-on-ct.sh` |
-| CCIP relay (r630-01 host) | Unit: `config/systemd/ccip-relay.service` → `/etc/systemd/system/ccip-relay.service`; `systemctl enable --now ccip-relay` |
+| Sankofa portal → CT 7801 (build + restart) | `./scripts/deployment/sync-sankofa-portal-7801.sh` (`--dry-run` first); default `NEXTAUTH_URL=https://portal.sankofa.nexus` via `sankofa-portal-ensure-nextauth-on-ct.sh`; IT `/it` env: `sankofa-portal-merge-it-read-api-env-from-repo.sh` (`IT_READ_API_URL` in repo `.env`) |
+| Portal Keycloak OIDC secret on CT 7801 | After client exists: `./scripts/deployment/sankofa-portal-merge-keycloak-env-from-repo.sh` (needs `KEYCLOAK_CLIENT_SECRET` in repo `.env`; base64-safe over SSH) |
+| Sankofa corporate web → CT 7806 | Provision: `./scripts/deployment/provision-sankofa-public-web-lxc-7806.sh`. Sync: `./scripts/deployment/sync-sankofa-public-web-to-ct.sh`. systemd: `config/systemd/sankofa-public-web.service`. Set `IP_SANKOFA_PUBLIC_WEB` in `.env`, then `scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh` |
+| **Non-chain ecosystem** (hyperscaler-style: edge / API hub / IdP / data cells; **not** chain CTs) | `docs/02-architecture/NON_CHAIN_ECOSYSTEM_HYPERSCALER_STYLE_MODEL.md` — gap review: `docs/02-architecture/NON_CHAIN_ECOSYSTEM_PLAN_REVIEW_AND_GAPS.md` |
+| Sankofa / Phoenix **consolidated hub** (optional — fewer non-chain LXCs) | `docs/02-architecture/SANKOFA_PHOENIX_CONSOLIDATED_FRONTEND_AND_API.md` — `docs/03-deployment/SANKOFA_R630_01_CONSOLIDATION_AND_HUB_PLACEMENT_GOAL.md` (offload r630-01: consolidate + **place** hubs on quieter nodes); `docs/03-deployment/SANKOFA_API_HUB_NPM_CUTOVER_AND_POST_CUTOVER_RUNBOOK.md` (NPM → `:8080`, `TRUST_PROXY`, rollback); `bash scripts/verify/check-sankofa-consolidated-nginx-examples.sh`; `bash scripts/verify/verify-sankofa-consolidated-hub-lan.sh`; `bash scripts/verify/smoke-phoenix-api-hub-lan.sh` (hub **:8080**); `pnpm run verify:phoenix-graphql-wss` or `PHOENIX_WSS_INCLUDE_LAN=1 bash scripts/verify/smoke-phoenix-graphql-wss-public.sh` (HTTP **101** WS upgrade); `pnpm run verify:phoenix-graphql-ws-subscription` (**connection_ack**); `bash scripts/deployment/ensure-sankofa-phoenix-graphql-ws-remove-fastify-websocket-7800.sh` (fix RSV1 / competing upgrade listener); `bash scripts/deployment/ensure-sankofa-phoenix-websocket-ts-import-logger-7800.sh` (**logger** import in `websocket.ts` — avoids **crash on WS disconnect**); `bash scripts/deployment/ensure-sankofa-phoenix-7800-nft-dport-4000-guard.sh` (optional **nft** reject :4000 from non-loopback); `bash scripts/deployment/ensure-sankofa-phoenix-api-hub-graphql-ws-proxy-headers-7800.sh` (hub `/graphql-ws` **Accept-Encoding** / **proxy_buffering**); `bash scripts/deployment/ensure-sankofa-phoenix-api-hub-systemd-exec-reload-7800.sh` (hub **ExecReload**); `bash scripts/deployment/ensure-sankofa-phoenix-api-env-lan-parity-7800.sh` (**.env** Keycloak + Postgres LAN + `NODE_ENV` policy); `bash scripts/deployment/ensure-sankofa-phoenix-api-db-migrate-up-7800.sh` (**pnpm db:migrate:up** on **7800**); `bash scripts/deployment/ensure-sankofa-phoenix-tls-config-terminate-at-edge-7800.sh` (production **HTTP** behind NPM); `bash scripts/deployment/plan-phoenix-apollo-port-4000-restrict-7800.sh` (`--ssh`); **Apollo loopback:** `PROXMOX_OPS_APPLY=1` `PROXMOX_OPS_ALLOWED_VMIDS=7800` `bash scripts/deployment/ensure-sankofa-phoenix-apollo-bind-loopback-7800.sh --apply --vmid 7800`; `bash scripts/deployment/plan-sankofa-consolidated-hub-cutover.sh`; **API hub on CT:** `bash scripts/deployment/install-sankofa-api-hub-nginx-on-pve.sh --dry-run --vmid 7800` (live: `PROXMOX_OPS_APPLY=1` `PROXMOX_OPS_ALLOWED_VMIDS=7800` `--apply --vmid 7800`); **dbis API `TRUST_PROXY`:** `PROXMOX_OPS_APPLY=1` `PROXMOX_OPS_ALLOWED_VMIDS=10150` `bash scripts/deployment/ensure-dbis-api-trust-proxy-on-ct.sh --apply --vmid 10150` (repeat **10151**); NPM fleet: `SANKOFA_NPM_PHOENIX_PORT=8080` + `scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh` (Phoenix rows use **WebSocket: true**); `.env` hub overrides optional |
+| CCIP relay (r630-01 host) | WETH lane: `config/systemd/ccip-relay.service`. Mainnet cW lane: `config/systemd/ccip-relay-mainnet-cw.service` (health `http://192.168.11.11:9863/healthz`). Public edge: set `CCIP_RELAY_MAINNET_CW_PUBLIC_HOST`, run `scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh`, relay-only `scripts/nginx-proxy-manager/upsert-ccip-relay-mainnet-cw-proxy-host.sh`, or SSH hop `scripts/nginx-proxy-manager/upsert-ccip-relay-mainnet-cw-via-ssh.sh`; DNS `scripts/cloudflare/configure-relay-mainnet-cw-dns.sh`. Use `NPM_URL=https://…:81` for API scripts (HTTP on :81 301s to HTTPS). |
+| XDC Zero + Chain 138 (parallel to CCIP) | `bash scripts/xdc-zero/run-xdc-zero-138-operator-sequence.sh` · `docs/03-deployment/CHAIN138_XDC_ZERO_BRIDGE_RUNBOOK.md` · `CHAIN138_XDC_ZERO_DEPLOYMENT_TROUBLESHOOTING.md` · `config/xdc-zero/` · `scripts/xdc-zero/` · systemd `node dist/server.js` template — **XDC mainnet RPC:** `https://rpc.xinfin.network` (chain id 50; more endpoints: [chainid.network/chain/50](https://chainid.network/chain/50/)); **Chain 138 side:** Core `http://192.168.11.211:8545` is operator-only, relayer/services use `https://rpc-http-pub.d-bis.org` |
+| OP Stack Standard Rollup (Ethereum mainnet, Superchain) | `docs/03-deployment/OP_STACK_STANDARD_ROLLUP_SUPERCHAIN_RUNBOOK.md` · optional L2↔Besu notes `docs/03-deployment/OP_STACK_L2_AND_BESU138_BRIDGE_NOTES.md` · `config/op-stack-superchain/` · `scripts/op-stack/` (e.g. `fetch-standard-mainnet-toml.sh`, checklist scripts) · `config/systemd/op-stack-*.example.service` — **distinct L2 chain ID from Besu 138**; follow [Optimism superchain-registry](https://github.com/ethereum-optimism/superchain-registry) for listing |
+| Wormhole protocol (LLM / MCP) vs Chain 138 facts | Wormhole NTT/Connect/VAAs/etc.: `docs/04-configuration/WORMHOLE_AI_RESOURCES_LLM_PLAYBOOK.md`, mirror `scripts/doc/sync-wormhole-ai-resources.sh`, MCP `mcp-wormhole-docs/` + `docs/04-configuration/MCP_SETUP.md`. **Chain 138 addresses, PMM, CCIP:** repo `docs/11-references/` + `docs/07-ccip/` — not Wormhole bundles. Cursor overlay: `.cursor/rules/wormhole-ai-resources.mdc`. |
 | TsunamiSwap VM 5010 check | `./scripts/deployment/tsunamiswap-vm-5010-provision.sh` (inventory only until VM exists) |
 | The Order portal (`https://the-order.sankofa.nexus`) | OSJ management UI (secure auth); source repo **the_order** at `~/projects/the_order`. NPM upstream defaults to **order-haproxy** CT **10210** (`IP_ORDER_HAPROXY:80`); use `THE_ORDER_UPSTREAM_*` to point at the Sankofa portal if 10210 is down. Provision HAProxy: `scripts/deployment/provision-order-haproxy-10210.sh`. **`www.the-order.sankofa.nexus`** → **301** apex (same as www.sankofa / www.phoenix). |
-| Portal login + Keycloak systemd + `.env` (prints password once) | `./scripts/deployment/enable-sankofa-portal-login-7801.sh` (`--dry-run` first) |
+| Portal login + Keycloak systemd + `.env` (prints password once) | `./scripts/deployment/enable-sankofa-portal-login-7801.sh` (`--dry-run` first); preserves `KEYCLOAK_*` from repo `.env` and runs merge script when `KEYCLOAK_CLIENT_SECRET` is set |
+| Keycloak redirect URIs (portal + admin) | `./scripts/deployment/keycloak-sankofa-ensure-client-redirects-via-proxmox-pct.sh` (or `keycloak-sankofa-ensure-client-redirects.sh` for LAN URL) — needs `KEYCLOAK_ADMIN_PASSWORD` in `.env` |
+| NPM TLS for hosts missing certs | `./scripts/request-npmplus-certificates.sh` — optional `CERT_DOMAINS_FILTER='portal\\.sankofa|admin\\.sankofa'`; IT API: `./scripts/deployment/request-it-api-tls-npm.sh` (same as filter `it-api\\.sankofa\\.nexus`) |
+| Token-aggregation API (Chain 138) | `pnpm run verify:token-aggregation-api` — tokens, pools, quote (prints `quoteEngine` when `jq` installed), `bridge/routes`, networks. Build + env: `scripts/deploy-token-aggregation-for-publication.sh` (sets `RPC_URL_138`, `TOKEN_AGGREGATION_CHAIN138_RPC_URL`, optional `TOKEN_AGGREGATION_PMM_*`). LAN push + restart: `scripts/deployment/push-token-aggregation-bundle-to-explorer.sh`. Nginx gaps: `scripts/fix-explorer-http-api-v1-proxy.sh` (apex `/api/v1/`), `scripts/fix-explorer-token-aggregation-api-v2-proxy.sh` (planner POST). Runbook: `docs/04-configuration/TOKEN_AGGREGATION_REPORT_API_RUNBOOK.md`. |
+| **Chain 138 Open Snap** (MetaMask, open Snap permissions only; stable MetaMask requires MetaMask install allowlist for npm Snaps) | Source repo: [Defi-Oracle-Tooling/chain138-snap-minimal](https://github.com/Defi-Oracle-Tooling/chain138-snap-minimal). Vendored in this workspace: `metamask-integration/chain138-snap-minimal/`. Snap ID `npm:chain138-open-snap`; **`npm run verify`** = `npm audit --omit=dev` + build. **Publish:** token in `chain138-snap/.env` or `npm login`, then `./scripts/deployment/publish-chain138-open-snap.sh`. **Full-feature Snap** (API quotes, allowlist): `metamask-integration/chain138-snap/`. Explorer `/wallet` install works on stable MetaMask only after allowlisting; use Flask or local serve for dev. |
 | Completable (no LAN) | `./scripts/run-completable-tasks-from-anywhere.sh` |
-| smom-dbis-138 root `forge test` | Uses `foundry.toml` `[profile.default] skip` for legacy Uniswap V2 vendor trees (0.5/0.6 solc); scoped work still uses `bash scripts/forge/scope.sh …` |
-| cWUSDT Mainnet USD pricing (on-chain + runbook) | `./scripts/deployment/price-cw-token-mainnet.sh` — `docs/03-deployment/CW_TOKEN_USD_PRICING_RUNBOOK.md` |
-| Deployer LP balances (mesh inventory) | `python3 scripts/deployment/check-deployer-lp-balances.py` — scans `deployment-status.json` + `reports/extraction/promod-uniswap-v2-live-pair-discovery-latest.json`; **UniV2** `lpToken` = pair; **DODO DVM** LP shares = `balanceOf(pool)`; on failure, probes `_BASE_TOKEN_` / `_BASE_CAPITAL_TOKEN_` / `_QUOTE_CAPITAL_TOKEN_` + extra public RPCs (`--no-resolve-dodo` skips; `--chain-id N` for one chain). JSON: `lpTokenAddress`, `lpResolution`, `lpBalances[]`. Use `--deployer` / `DEPLOYER_ADDRESS` if no `PRIVATE_KEY` |
-| Etherscan Value $0 for Mainnet `cW*` | Listing path (CoinGecko/CMC), not a contract toggle — `docs/04-configuration/coingecko/ETHERSCAN_USD_VALUE_MAINNET_TOKENS.md` |
-| Verify contracts on explorers (all networks) | `cd smom-dbis-138 && ./scripts/deployment/verify-all-networks-explorers.sh` — Blockscout 138, Etherscan + multichain `cW*`, Avax/Arb bridges, optional Cronos/Wemix/CCIPLogger |
-| Operator (LAN + secrets) | `./scripts/run-all-operator-tasks-from-lan.sh` (use `--skip-backup` if `NPM_PASSWORD` unset; backup also needs `NPM_EMAIL` in `.env`) |
-| Remote SSH to dev VM (5700 / `192.168.11.59`) for runner & deploy API | [docs/04-configuration/DEV_VM_SSH_REMOTE_ACCESS.md](docs/04-configuration/DEV_VM_SSH_REMOTE_ACCESS.md) (Cloudflare Access + tunnel, or UDM allowlist) |
+| Operator (LAN + secrets) | `./scripts/run-all-operator-tasks-from-lan.sh` (use `--skip-backup` if `NPM_PASSWORD` unset) |
 | Cloudflare bulk DNS → `PUBLIC_IP` | `./scripts/update-all-dns-to-public-ip.sh` — use **`--dry-run`** and **`--zone-only=sankofa.nexus`** (or `d-bis.org` / `mim4u.org` / `defi-oracle.io`) to limit scope; see script header. Prefer scoped **`CLOUDFLARE_API_TOKEN`** (see `.env.master.example`). |
+| Cloudflare SSL mode (sankofa.nexus zone) | `bash scripts/cloudflare/set-sankofa-zone-ssl-mode.sh full` — fixes **Flexible** + NPM **SSL forced** redirect loops (e.g. `it-api.sankofa.nexus`). |
+| IRU marketplace surfaces + Turnstile (Captcha) | [docs/03-deployment/SANKOFA_MARKETPLACE_SURFACES.md](docs/03-deployment/SANKOFA_MARKETPLACE_SURFACES.md) — **native** (VMs, IPs, app hosting, etc.) vs **partner** (e.g. SolaceNet IRU) methodology; Turnstile **secret** on API (`CLOUDFLARE_TURNSTILE_SECRET_KEY` or aliases), **site key** on frontend build (`VITE_*`); not the same as Cloudflare DNS keys. [docs/04-configuration/MASTER_SECRETS.md](docs/04-configuration/MASTER_SECRETS.md) (Cloudflare table). |
 
 ## Git submodules
 
 Most submodules are **pinned commits**; `git submodule update --init --recursive` often leaves **detached HEAD** — that is normal. To **change** a submodule: check out a branch inside it, commit, **push the submodule first**, then commit and push the **parent** submodule pointer. Do not embed credentials in `git remote` URLs; use SSH or a credential helper. Explorer Gitea vs GitHub and token cleanup: `docs/00-meta/SUBMODULE_HYGIENE.md`.
 
+## Production safety (Proxmox / shared config)
+
+- **Scoped LXC starts:** use `scripts/operator/start-stopped-lxc-scoped.sh --host <PVE> --vmid <N> [--vmid …]`; default is **dry-run**; add **`--apply`** or **`PROXMOX_OPS_APPLY=1`** to mutate. Optional **`PROXMOX_OPS_ALLOWED_VMIDS`** enforces an allowlist. Do **not** use cluster-wide “start every stopped CT” patterns for production.
+- **Maintenance scripts (SSH + pct):** set **`PROXMOX_SAFE_DEFAULTS=1`** so `fix-core-rpc-2101.sh`, `make-rpc-vmids-writable-via-ssh.sh`, and `ensure-legacy-monitor-networkd-via-ssh.sh` default to **plan-only** unless **`--apply`** or **`PROXMOX_OPS_APPLY=1`**. Without that env, behavior stays **legacy** (mutate unless `--dry-run`) so existing docs/commands keep working.
+- **Guard helpers** for new SSH+pct scripts: `scripts/lib/proxmox-production-guard.sh`.
+- **VMID → host** for automation: `get_host_for_vmid` in `scripts/lib/load-project-env.sh` must match live placement (`docs/04-configuration/ALL_VMIDS_ENDPOINTS.md`).
+- **Shared config:** avoid drive-by edits to `config/ip-addresses.conf` or root `.env` when the task only affects one workload; prefer flags, workload-specific env files, or small dedicated scripts.
+- Cursor overlay: `.cursor/rules/proxmox-production-safety.mdc`.
+
 ## Rules of engagement
 
 - Review scripts before running; prefer `--dry-run` where supported.

COMPREHENSIVE_STATUS_BRIDGE_READY.md

@@ -252,7 +252,7 @@ NEW_BRIDGE="0xNEW_ADDRESS_HERE"  # From deployment
 # 1. Add Mainnet destination
 cast send $NEW_BRIDGE "addDestination(uint64,address)" \
   5009297550715157269 \
-  0x2A0840e5117683b11682ac46f5CF5621E67269E3 \
+  0xc9901ce2Ddb6490FAA183645147a87496d8b20B6 \
   --private-key $PRIVATE_KEY \
   --rpc-url http://192.168.11.211:8545
 

README.md

@@ -90,17 +90,13 @@ From the root directory, you can run:
 - `pnpm frontend:build` - Build the ProxmoxVE frontend for production
 - `pnpm frontend:start` - Start the production frontend server
 
-### Mission Control (unified operator console)
-
-- `pnpm mission-control:dev` - Next.js console on **http://localhost:3010** (launchpad + guided runbooks + live run trace + audit ZIP)
-- `pnpm mission-control:build` / `pnpm mission-control:start` - Production build and server
-- `pnpm mission-control:test` - Executor smoke test (real allowlisted child process)
-
-See [mission-control/README.md](mission-control/README.md) and [mission-control/TIMELINE.md](mission-control/TIMELINE.md).
-
 ### Testing
 
-- `pnpm test` - Run tests (if available)
+- `pnpm test` - Run the local green-path Chain 138 / GRU / bridge / token test aggregate
+- `pnpm test:chain138` - Run the Chain 138 package CI targets directly
+- `pnpm test:chain138:contracts` - Run the focused Solidity contract CI targets
+- `pnpm test:chain138:services` - Run the focused JS/TS service CI targets
+- `pnpm test:mcp` - Run the legacy MCP server package test entrypoint
 - `pnpm test:basic` - Run basic MCP server tests (read-only operations)
 - `pnpm test:workflows` - Run comprehensive workflow tests (requires elevated permissions)
 
@@ -327,4 +323,3 @@ Individual checks:
 ## License
 
 This workspace contains multiple projects with different licenses. Please refer to individual project directories for license information.
-

config/README-BRIDGE-ROUTES-DEFAULT.md

@@ -0,0 +1,8 @@
+# bridge-routes-chain138-default.json
+
+Static snapshot of the default **`GET /api/v1/bridge/routes`** response shape (without per-env address overrides).
+
+- **Server source of truth:** `smom-dbis-138/services/token-aggregation/src/api/utils/default-bridge-routes.ts` (applies `CCIPWETH9_BRIDGE_CHAIN138`, `LOCKBOX_138`, `INBOX_ETH`, etc.).
+- **UI fallback:** `info-defi-oracle-138` imports this file when the live API returns 404 or errors.
+
+Update this JSON when canonical bridge addresses or relay destinations change; keep the TS module in sync.

config/README-CONTRACTS-MASTER.md

@@ -1,9 +1,10 @@
 # Master Smart Contracts (JSON)
 
-**Single source of truth for contract addresses:** `config/smart-contracts-master.json`
+**Machine-readable contract map:** `config/smart-contracts-master.json` (when the file exists in your clone).
 
 - **Safe to publish** — no secrets (no keys, no RPC URLs with credentials).
 - **Used by:** Bash scripts (via `scripts/lib/load-contract-addresses.sh`), Node/JS (via `config/contracts-loader.cjs`), and docs.
+- **If the file is absent:** loaders continue with `.env` only; Chain 138 **bytecode checks** use the embedded address list in `scripts/verify/check-contracts-on-chain-138.sh` (see also `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md`). When you introduce `smart-contracts-master.json`, populate `chains["138"].contracts` with the **complete** set for that chain — the check script uses JSON addresses instead of its fallback when the file is present.
 
 ## Layout
 
@@ -40,7 +41,7 @@ const {
 } = require('./config/contracts-loader.cjs');
 
 // By contract key
-getContractAddress(138, 'CCIP_Router');        // => '0x8078...'
+getContractAddress(138, 'CCIP_Router');        // => '0x42DA...' (canonical; legacy direct: CCIP_Router_Direct_Legacy)
 getContractAddress(138, 'CCIPWETH9_Bridge');
 getContractAddress(1, 'CCIP_Relay_Router');
 
@@ -57,7 +58,7 @@ loadContractsIntoProcessEnv();
 
 ## Overrides
 
-- **.env** (e.g. `smom-dbis-138/.env`, `services/relay/.env`): Values set there take precedence over the master JSON. Use .env for local or per-service overrides.
+- **.env** (e.g. `smom-dbis-138/.env`, `services/relay/.env`): Values set there take precedence over the master JSON. Use .env for local or per-service overrides. For **`ADDRESS_MAPPER`** on Chain 138, keep **`ADDRESS_MAPPER`** equal to **`chains["138"].contracts.AddressMapper`** unless you have a deliberate fork: a legacy duplicate on Core shares bytecode with the canonical mapper (see `docs/11-references/ADDRESS_MATRIX_AND_STATUS.md`, section 1.5).
 - **Publishing:** Commit `smart-contracts-master.json`; do not commit `.env` or any file containing `PRIVATE_KEY` or API secrets.
 
 ## Updating addresses

config/aggregator-route-matrix.csv

@@ -1,24 +1,35 @@
 kind,routeId,status,routeType,fromChainId,toChainId,tokenInSymbol,tokenInAddress,tokenOutSymbol,tokenOutAddress,hopCount,bridgeType,bridgeAddress,aggregatorFamilies,tags,intermediateSymbols,legRefs,notesOrReason
-liveSwapRoute,138-cUSDT-cUSDC-direct,live,swap,138,138,cUSDT,0x93E66202A11B1772E55407B32B44e5Cd8eda7f22,cUSDC,0xf22258f57794CC8E06237084b353Ab30fFfa640b,1,,,1inch|0x|LiFi,stable|direct|public,,0xff8d3b8fDF7B112759F076B69f4271D4209C0849,
-liveSwapRoute,138-cUSDT-USDT-direct,live,swap,138,138,cUSDT,0x93E66202A11B1772E55407B32B44e5Cd8eda7f22,USDT,0x004b63A7B5b0E06f6bB6adb4a5F9f590BF3182D1,1,,,1inch|0x|LiFi,stable|official-mirror|public,,0x6fc60DEDc92a2047062294488539992710b99D71,
-liveSwapRoute,138-cUSDC-USDC-direct,live,swap,138,138,cUSDC,0xf22258f57794CC8E06237084b353Ab30fFfa640b,USDC,0x71D6687F38b93CCad569Fa6352c876eea967201b,1,,,1inch|0x|LiFi,stable|official-mirror|public,,0x0309178ae30302D83c76d6Dd402a684eF3160eec,
-liveSwapRoute,138-cUSDT-cXAUC-direct,live,swap,138,138,cUSDT,0x93E66202A11B1772E55407B32B44e5Cd8eda7f22,cXAUC,0x290E52a8819A4fbD0714E517225429aA2B70EC6b,1,,,1inch|0x|LiFi,xau-hub|public,,0x1AA55E2001E5651349AfF5A63FD7A7Ae44f0F1b0,
-liveSwapRoute,138-cUSDC-cXAUC-direct,live,swap,138,138,cUSDC,0xf22258f57794CC8E06237084b353Ab30fFfa640b,cXAUC,0x290E52a8819A4fbD0714E517225429aA2B70EC6b,1,,,1inch|0x|LiFi,xau-hub|public,,0xEA9Ac6357CaCB42a83b9082B870610363B177cBa,
-liveSwapRoute,138-cEURT-cXAUC-direct,live,swap,138,138,cEURT,0xdf4b71c61E5912712C1Bdd451416B9aC26949d72,cXAUC,0x290E52a8819A4fbD0714E517225429aA2B70EC6b,1,,,1inch|0x|LiFi,xau-hub|public,,0xbA99bc1eAAC164569d5AcA96C806934DDaF970Cf,
-liveSwapRoute,138-cEURT-cUSDT-via-cXAUC,live,swap,138,138,cEURT,0xdf4b71c61E5912712C1Bdd451416B9aC26949d72,cUSDT,0x93E66202A11B1772E55407B32B44e5Cd8eda7f22,2,,,1inch|0x|LiFi,multihop|xau-hub|public,cXAUC,0xbA99bc1eAAC164569d5AcA96C806934DDaF970Cf|0x1AA55E2001E5651349AfF5A63FD7A7Ae44f0F1b0,Inferred from two live public pools.
-liveSwapRoute,138-cEURT-cUSDC-via-cXAUC,live,swap,138,138,cEURT,0xdf4b71c61E5912712C1Bdd451416B9aC26949d72,cUSDC,0xf22258f57794CC8E06237084b353Ab30fFfa640b,2,,,1inch|0x|LiFi,multihop|xau-hub|public,cXAUC,0xbA99bc1eAAC164569d5AcA96C806934DDaF970Cf|0xEA9Ac6357CaCB42a83b9082B870610363B177cBa,Inferred from two live public pools.
-liveSwapRoute,138-cUSDT-cUSDC-via-cXAUC,live,swap,138,138,cUSDT,0x93E66202A11B1772E55407B32B44e5Cd8eda7f22,cUSDC,0xf22258f57794CC8E06237084b353Ab30fFfa640b,2,,,1inch|0x|LiFi,multihop|xau-hub|public|alternate,cXAUC,0x1AA55E2001E5651349AfF5A63FD7A7Ae44f0F1b0|0xEA9Ac6357CaCB42a83b9082B870610363B177cBa,Alternate path to the deeper direct cUSDT/cUSDC pool.
-liveBridgeRoute,138-WETH-1-ccip,live,bridge,138,1,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-56-ccip,live,bridge,138,56,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-137-ccip,live,bridge,138,137,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-10-ccip,live,bridge,138,10,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-42161-ccip,live,bridge,138,42161,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-43114-ccip,live,bridge,138,43114,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-8453-ccip,live,bridge,138,8453,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-100-ccip,live,bridge,138,100,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-25-ccip,live,bridge,138,25,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-42220-ccip,live,bridge,138,42220,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-651940-alltra,live,bridge,138,651940,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,ALT,0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc,LiFi,,,,
-liveBridgeRoute,138-WETH10-1-ccip,live,bridge,138,1,WETH10,0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f,WETH10,0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f,,CCIP,0xe0E93247376aa097dB308B92e6Ba36bA015535D0,LiFi,,,,
-blockedOrPlannedRoute,651940-public-dex-routes,planned,swap,651940,651940,,,,,,,,,,,,Alltra same-chain settlement remains documentation-only: no deployed PMM or Uniswap venue inventory is published in canonical deployment status, and HYDX/AlltraDEX router-factory-pool addresses are still not committed in-repo.
-blockedOrPlannedRoute,138-weth-1111-ccip,planned,bridge,138,1111,,,,,,,,,,,,"Wemix bridge contracts are deployed and destinations are wired, but the current Chain 138 CCIP router still rejects the Wemix selector with `CCIPRouter: chain not supported`; the WEMIX-side LINK balances are also zero and no successful proof transfer has been recorded."
+liveSwapRoute,chain-138-swap-dodo-cusdt-cusdc-0x9e89bae0,live,swap,138,138,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0x9e89bae009adf128782e19e8341996c596ac40dc,Generated from live planner route graph.
+liveSwapRoute,chain-138-swap-dodo-cusdc-cusdt-0x9e89bae0,live,swap,138,138,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0x9e89bae009adf128782e19e8341996c596ac40dc,Generated from live planner route graph.
+liveSwapRoute,chain-138-swap-dodo-cusdt-usdt-0x866cb44b,live,swap,138,138,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0x866cb44b59303d8dc5f4f9e3e7a8e8b0bf238d66,Generated from live planner route graph.
+liveSwapRoute,chain-138-swap-dodo-usdt-cusdt-0x866cb44b,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0x866cb44b59303d8dc5f4f9e3e7a8e8b0bf238d66,Generated from live planner route graph.
+liveSwapRoute,chain-138-swap-dodo-cusdc-usdc-0xc39b7d0f,live,swap,138,138,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0xc39b7d0f40838cbfb54649d327f49a6dac964062,Generated from live planner route graph.
+liveSwapRoute,chain-138-swap-dodo-usdc-cusdc-0xc39b7d0f,live,swap,138,138,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0xc39b7d0f40838cbfb54649d327f49a6dac964062,Generated from live planner route graph.
+liveSwapRoute,chain-138-swap-dodo-v3-weth10-usdt-0x6550a3a5,live,swap,138,138,WETH10,0xf4bb2e28688e89fcce3c0580d37d36a7672e8a9f,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|dodo_v3,,0x6550a3a59070061a262a893a1d6f3f490affdbda,Generated from live planner route graph. | DODO v3 / D3MM Chain 138 pilot venue. | Canonical private pilot pool 0x6550a3a59070061a262a893a1d6f3f490affdbda executes through D3Proxy 0xc9a11abb7c63d88546be24d58a6d95e3762cb843. | Planner-v2 exposure and EnhancedSwapRouterV2 internal execution-plan calldata are live for the canonical pilot pair.
+liveSwapRoute,chain-138-swap-dodo-v3-usdt-weth10-0x6550a3a5,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,WETH10,0xf4bb2e28688e89fcce3c0580d37d36a7672e8a9f,1,,,1inch|0x|LiFi,planner-v2-generated|dodo_v3,,0x6550a3a59070061a262a893a1d6f3f490affdbda,Generated from live planner route graph. | DODO v3 / D3MM Chain 138 pilot venue. | Canonical private pilot pool 0x6550a3a59070061a262a893a1d6f3f490affdbda executes through D3Proxy 0xc9a11abb7c63d88546be24d58a6d95e3762cb843. | Planner-v2 exposure and EnhancedSwapRouterV2 internal execution-plan calldata are live for the canonical pilot pair.
+liveSwapRoute,chain-138-swap-uniswap-v3-weth-usdt,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|uniswap_v3,,0xde9cd8ee2811e6e64a41d5f68be315d33995975e,Generated from live planner route graph. | Chain 138 upstream-native Uniswap v3 WETH/USDT venue.
+liveSwapRoute,chain-138-swap-uniswap-v3-usdt-weth,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|uniswap_v3,,0xde9cd8ee2811e6e64a41d5f68be315d33995975e,Generated from live planner route graph. | Chain 138 upstream-native Uniswap v3 WETH/USDT venue.
+liveSwapRoute,chain-138-swap-uniswap-v3-weth-usdc,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,1,,,1inch|0x|LiFi,planner-v2-generated|uniswap_v3,,0xde9cd8ee2811e6e64a41d5f68be315d33995975e,Generated from live planner route graph. | Chain 138 upstream-native Uniswap v3 WETH/USDC venue.
+liveSwapRoute,chain-138-swap-uniswap-v3-usdc-weth,live,swap,138,138,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|uniswap_v3,,0xde9cd8ee2811e6e64a41d5f68be315d33995975e,Generated from live planner route graph. | Chain 138 upstream-native Uniswap v3 WETH/USDC venue.
+liveSwapRoute,chain-138-swap-balancer-weth-usdt,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|balancer,,0x96423d7c1727698d8a25ebfb88131e9422d1a3c3,Generated from live planner route graph. | Chain 138 pilot-compatible Balancer USDT/WETH venue.
+liveSwapRoute,chain-138-swap-balancer-usdt-weth,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|balancer,,0x96423d7c1727698d8a25ebfb88131e9422d1a3c3,Generated from live planner route graph. | Chain 138 pilot-compatible Balancer USDT/WETH venue.
+liveSwapRoute,chain-138-swap-balancer-weth-usdc,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,1,,,1inch|0x|LiFi,planner-v2-generated|balancer,,0x96423d7c1727698d8a25ebfb88131e9422d1a3c3,Generated from live planner route graph. | Chain 138 pilot-compatible Balancer USDC/WETH venue.
+liveSwapRoute,chain-138-swap-balancer-usdc-weth,live,swap,138,138,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|balancer,,0x96423d7c1727698d8a25ebfb88131e9422d1a3c3,Generated from live planner route graph. | Chain 138 pilot-compatible Balancer USDC/WETH venue.
+liveSwapRoute,chain-138-swap-curve-usdt-usdc,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,1,,,1inch|0x|LiFi,planner-v2-generated|curve,,0xe440ec15805be4c7babcd17a63b8c8a08a492e0f,Generated from live planner route graph. | Chain 138 pilot-compatible Curve 3Pool stable/stable venue.
+liveSwapRoute,chain-138-swap-curve-usdc-usdt,live,swap,138,138,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|curve,,0xe440ec15805be4c7babcd17a63b8c8a08a492e0f,Generated from live planner route graph. | Chain 138 pilot-compatible Curve 3Pool stable/stable venue.
+liveSwapRoute,chain-138-swap-one-inch-weth-usdt,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|one_inch,,0x500b84b1bc6f59c1898a5fe538ea20a758757a4f,Generated from live planner route graph. | Chain 138 pilot-compatible 1inch router lane.
+liveSwapRoute,chain-138-swap-one-inch-usdt-weth,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|one_inch,,0x500b84b1bc6f59c1898a5fe538ea20a758757a4f,Generated from live planner route graph. | Chain 138 pilot-compatible 1inch router lane.
+liveSwapRoute,chain-138-swap-one-inch-weth-usdc,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,1,,,1inch|0x|LiFi,planner-v2-generated|one_inch,,0x500b84b1bc6f59c1898a5fe538ea20a758757a4f,Generated from live planner route graph. | Chain 138 pilot-compatible 1inch router lane.
+liveSwapRoute,chain-138-swap-one-inch-usdc-weth,live,swap,138,138,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|one_inch,,0x500b84b1bc6f59c1898a5fe538ea20a758757a4f,Generated from live planner route graph. | Chain 138 pilot-compatible 1inch router lane.
+liveBridgeRoute,bridge-138-651940-cusdt-alltraadapter,live,bridge,138,651940,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,,ALT,0x66feba2fc9a0b47f26dd4284dad24f970436b8dc,1inch|0x|LiFi,planner-v2-generated|bridge,,,Generated from bridge registry and planner visibility. | Registry route AlltraAdapter
+liveBridgeRoute,bridge-138-651940-cusdc-alltraadapter,live,bridge,138,651940,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,,ALT,0x66feba2fc9a0b47f26dd4284dad24f970436b8dc,1inch|0x|LiFi,planner-v2-generated|bridge,,,Generated from bridge registry and planner visibility. | Registry route AlltraAdapter
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-cbtc-cusdt,planned,swap,138,138,cBTC|cUSDT,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CUSDT after the canonical cBTC/cUSDT PMM pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-cusdt-cbtc,planned,swap,138,138,cUSDT|cBTC,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CUSDT after the canonical cBTC/cUSDT PMM pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-cbtc-cusdc,planned,swap,138,138,cBTC|cUSDC,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CUSDC after the canonical cBTC/cUSDC PMM pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-cusdc-cbtc,planned,swap,138,138,cUSDC|cBTC,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CUSDC after the canonical cBTC/cUSDC PMM pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-cbtc-cxauc,planned,swap,138,138,cBTC|cXAUC,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CXAUC after the canonical cBTC/cXAUC PMM pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-cxauc-cbtc,planned,swap,138,138,cXAUC|cBTC,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CXAUC after the canonical cBTC/cXAUC PMM pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-weth-usdt,planned,swap,138,138,WETH|USDT,,,,,,,,,,,Set CHAIN138_POOL_WETH_USDT after the canonical WETH/USDT pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-usdt-weth,planned,swap,138,138,USDT|WETH,,,,,,,,,,,Set CHAIN138_POOL_WETH_USDT after the canonical WETH/USDT pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-weth-usdc,planned,swap,138,138,WETH|USDC,,,,,,,,,,,Set CHAIN138_POOL_WETH_USDC after the canonical WETH/USDC pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-usdc-weth,planned,swap,138,138,USDC|WETH,,,,,,,,,,,Set CHAIN138_POOL_WETH_USDC after the canonical WETH/USDC pool is created and funded.

config/aggregator-route-matrix.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "description": "Planner-v2-generated aggregator route visibility matrix for Chain 138 and approved bridge lanes.",
   "version": "2.0.0",
-  "updated": "2026-04-21T22:30:18.877Z",
+  "updated": "2026-04-05T19:31:45.871Z",
   "homeChainId": 138,
   "metadata": {
     "generatedFrom": [
@@ -11,7 +11,7 @@
       "services/token-aggregation/src/config/cross-chain-bridges.ts"
     ],
     "verification": {
-      "verifiedAt": "2026-04-21T22:30:18.878Z",
+      "verifiedAt": "2026-04-05T19:31:45.871Z",
       "verifiedBy": "services/token-aggregation planner-v2 generator",
       "rpc": "http://192.168.11.211:8545"
     },
@@ -64,7 +64,7 @@
       "kind": "compliant"
     },
     "cBTC": {
-      "address": "0xe94260c555ac1d9d3cc9e1632883452ebdf0082e",
+      "address": "0xcb7c000000000000000000000000000000000138",
       "decimals": 8,
       "kind": "monetary_unit"
     },
@@ -80,6 +80,252 @@
     }
   },
   "liveSwapRoutes": [
+    {
+      "routeId": "chain-138-swap-dodo-cusdt-cusdc-0x9e89bae0",
+      "status": "live",
+      "aggregatorFamilies": [
+        "1inch",
+        "0x",
+        "LiFi"
+      ],
+      "fromChainId": 138,
+      "toChainId": 138,
+      "tokenInSymbol": "cUSDT",
+      "tokenInAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
+      "tokenOutSymbol": "cUSDC",
+      "tokenOutAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
+      "routeType": "swap",
+      "hopCount": 1,
+      "label": "DODO PMM cUSDT -> cUSDC",
+      "intermediateSymbols": [],
+      "legs": [
+        {
+          "kind": "swap",
+          "protocol": "dodo_pmm",
+          "executor": "DODO PMM",
+          "executorAddress": "0x3f729632e9553ebaccde2e9b4c8f2b285b014f2e",
+          "poolAddress": "0x9e89bae009adf128782e19e8341996c596ac40dc",
+          "tokenInAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
+          "tokenOutAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
+          "reserves": {
+            "reserveIn": "999999997998",
+            "reserveOut": "999999997998"
+          }
+        }
+      ],
+      "tags": [
+        "planner-v2-generated",
+        "dodo"
+      ],
+      "notes": [
+        "Generated from live planner route graph."
+      ]
+    },
+    {
+      "routeId": "chain-138-swap-dodo-cusdc-cusdt-0x9e89bae0",
+      "status": "live",
+      "aggregatorFamilies": [
+        "1inch",
+        "0x",
+        "LiFi"
+      ],
+      "fromChainId": 138,
+      "toChainId": 138,
+      "tokenInSymbol": "cUSDC",
+      "tokenInAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
+      "tokenOutSymbol": "cUSDT",
+      "tokenOutAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
+      "routeType": "swap",
+      "hopCount": 1,
+      "label": "DODO PMM cUSDC -> cUSDT",
+      "intermediateSymbols": [],
+      "legs": [
+        {
+          "kind": "swap",
+          "protocol": "dodo_pmm",
+          "executor": "DODO PMM",
+          "executorAddress": "0x3f729632e9553ebaccde2e9b4c8f2b285b014f2e",
+          "poolAddress": "0x9e89bae009adf128782e19e8341996c596ac40dc",
+          "tokenInAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
+          "tokenOutAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
+          "reserves": {
+            "reserveIn": "999999997998",
+            "reserveOut": "999999997998"
+          }
+        }
+      ],
+      "tags": [
+        "planner-v2-generated",
+        "dodo"
+      ],
+      "notes": [
+        "Generated from live planner route graph."
+      ]
+    },
+    {
+      "routeId": "chain-138-swap-dodo-cusdt-usdt-0x866cb44b",
+      "status": "live",
+      "aggregatorFamilies": [
+        "1inch",
+        "0x",
+        "LiFi"
+      ],
+      "fromChainId": 138,
+      "toChainId": 138,
+      "tokenInSymbol": "cUSDT",
+      "tokenInAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
+      "tokenOutSymbol": "USDT",
+      "tokenOutAddress": "0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1",
+      "routeType": "swap",
+      "hopCount": 1,
+      "label": "DODO PMM cUSDT -> USDT",
+      "intermediateSymbols": [],
+      "legs": [
+        {
+          "kind": "swap",
+          "protocol": "dodo_pmm",
+          "executor": "DODO PMM",
+          "executorAddress": "0x3f729632e9553ebaccde2e9b4c8f2b285b014f2e",
+          "poolAddress": "0x866cb44b59303d8dc5f4f9e3e7a8e8b0bf238d66",
+          "tokenInAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
+          "tokenOutAddress": "0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1",
+          "reserves": {
+            "reserveIn": "999999997998",
+            "reserveOut": "999999997998"
+          }
+        }
+      ],
+      "tags": [
+        "planner-v2-generated",
+        "dodo"
+      ],
+      "notes": [
+        "Generated from live planner route graph."
+      ]
+    },
+    {
+      "routeId": "chain-138-swap-dodo-usdt-cusdt-0x866cb44b",
+      "status": "live",
+      "aggregatorFamilies": [
+        "1inch",
+        "0x",
+        "LiFi"
+      ],
+      "fromChainId": 138,
+      "toChainId": 138,
+      "tokenInSymbol": "USDT",
+      "tokenInAddress": "0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1",
+      "tokenOutSymbol": "cUSDT",
+      "tokenOutAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
+      "routeType": "swap",
+      "hopCount": 1,
+      "label": "DODO PMM USDT -> cUSDT",
+      "intermediateSymbols": [],
+      "legs": [
+        {
+          "kind": "swap",
+          "protocol": "dodo_pmm",
+          "executor": "DODO PMM",
+          "executorAddress": "0x3f729632e9553ebaccde2e9b4c8f2b285b014f2e",
+          "poolAddress": "0x866cb44b59303d8dc5f4f9e3e7a8e8b0bf238d66",
+          "tokenInAddress": "0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1",
+          "tokenOutAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
+          "reserves": {
+            "reserveIn": "999999997998",
+            "reserveOut": "999999997998"
+          }
+        }
+      ],
+      "tags": [
+        "planner-v2-generated",
+        "dodo"
+      ],
+      "notes": [
+        "Generated from live planner route graph."
+      ]
+    },
+    {
+      "routeId": "chain-138-swap-dodo-cusdc-usdc-0xc39b7d0f",
+      "status": "live",
+      "aggregatorFamilies": [
+        "1inch",
+        "0x",
+        "LiFi"
+      ],
+      "fromChainId": 138,
+      "toChainId": 138,
+      "tokenInSymbol": "cUSDC",
+      "tokenInAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
+      "tokenOutSymbol": "USDC",
+      "tokenOutAddress": "0x71d6687f38b93ccad569fa6352c876eea967201b",
+      "routeType": "swap",
+      "hopCount": 1,
+      "label": "DODO PMM cUSDC -> USDC",
+      "intermediateSymbols": [],
+      "legs": [
+        {
+          "kind": "swap",
+          "protocol": "dodo_pmm",
+          "executor": "DODO PMM",
+          "executorAddress": "0x3f729632e9553ebaccde2e9b4c8f2b285b014f2e",
+          "poolAddress": "0xc39b7d0f40838cbfb54649d327f49a6dac964062",
+          "tokenInAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
+          "tokenOutAddress": "0x71d6687f38b93ccad569fa6352c876eea967201b",
+          "reserves": {
+            "reserveIn": "999999997998",
+            "reserveOut": "999999997998"
+          }
+        }
+      ],
+      "tags": [
+        "planner-v2-generated",
+        "dodo"
+      ],
+      "notes": [
+        "Generated from live planner route graph."
+      ]
+    },
+    {
+      "routeId": "chain-138-swap-dodo-usdc-cusdc-0xc39b7d0f",
+      "status": "live",
+      "aggregatorFamilies": [
+        "1inch",
+        "0x",
+        "LiFi"
+      ],
+      "fromChainId": 138,
+      "toChainId": 138,
+      "tokenInSymbol": "USDC",
+      "tokenInAddress": "0x71d6687f38b93ccad569fa6352c876eea967201b",
+      "tokenOutSymbol": "cUSDC",
+      "tokenOutAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
+      "routeType": "swap",
+      "hopCount": 1,
+      "label": "DODO PMM USDC -> cUSDC",
+      "intermediateSymbols": [],
+      "legs": [
+        {
+          "kind": "swap",
+          "protocol": "dodo_pmm",
+          "executor": "DODO PMM",
+          "executorAddress": "0x3f729632e9553ebaccde2e9b4c8f2b285b014f2e",
+          "poolAddress": "0xc39b7d0f40838cbfb54649d327f49a6dac964062",
+          "tokenInAddress": "0x71d6687f38b93ccad569fa6352c876eea967201b",
+          "tokenOutAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
+          "reserves": {
+            "reserveIn": "999999997998",
+            "reserveOut": "999999997998"
+          }
+        }
+      ],
+      "tags": [
+        "planner-v2-generated",
+        "dodo"
+      ],
+      "notes": [
+        "Generated from live planner route graph."
+      ]
+    },
     {
       "routeId": "chain-138-swap-dodo-v3-weth10-usdt-0x6550a3a5",
       "status": "live",
@@ -744,56 +990,6 @@
     }
   ],
   "liveBridgeRoutes": [
-    {
-      "routeId": "bridge-138-1-cusdt-universalccipbridge",
-      "status": "live",
-      "aggregatorFamilies": [
-        "1inch",
-        "0x",
-        "LiFi"
-      ],
-      "fromChainId": 138,
-      "toChainId": 1,
-      "assetSymbol": "cUSDT",
-      "assetAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
-      "routeType": "bridge",
-      "bridgeType": "CCIP",
-      "bridgeAddress": "0xcd42e8ed79dc50599535d1de48d3dafa0be156f8",
-      "label": "UniversalCCIPBridge cUSDT 138 -> 1",
-      "tags": [
-        "planner-v2-generated",
-        "bridge"
-      ],
-      "notes": [
-        "Generated from bridge registry and planner visibility.",
-        "Registry route UniversalCCIPBridge"
-      ]
-    },
-    {
-      "routeId": "bridge-138-1-cusdc-universalccipbridge",
-      "status": "live",
-      "aggregatorFamilies": [
-        "1inch",
-        "0x",
-        "LiFi"
-      ],
-      "fromChainId": 138,
-      "toChainId": 1,
-      "assetSymbol": "cUSDC",
-      "assetAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
-      "routeType": "bridge",
-      "bridgeType": "CCIP",
-      "bridgeAddress": "0xcd42e8ed79dc50599535d1de48d3dafa0be156f8",
-      "label": "UniversalCCIPBridge cUSDC 138 -> 1",
-      "tags": [
-        "planner-v2-generated",
-        "bridge"
-      ],
-      "notes": [
-        "Generated from bridge registry and planner visibility.",
-        "Registry route UniversalCCIPBridge"
-      ]
-    },
     {
       "routeId": "bridge-138-651940-cusdt-alltraadapter",
       "status": "live",
@@ -845,5 +1041,126 @@
       ]
     }
   ],
-  "blockedOrPlannedRoutes": []
+  "blockedOrPlannedRoutes": [
+    {
+      "routeId": "chain-138-capability-dodo-planned-cbtc-cusdt",
+      "status": "planned",
+      "fromChainId": 138,
+      "toChainId": 138,
+      "routeType": "swap",
+      "reason": "Set CHAIN138_POOL_CBTC_CUSDT after the canonical cBTC/cUSDT PMM pool is created and funded.",
+      "tokenInSymbols": [
+        "cBTC",
+        "cUSDT"
+      ]
+    },
+    {
+      "routeId": "chain-138-capability-dodo-planned-cusdt-cbtc",
+      "status": "planned",
+      "fromChainId": 138,
+      "toChainId": 138,
+      "routeType": "swap",
+      "reason": "Set CHAIN138_POOL_CBTC_CUSDT after the canonical cBTC/cUSDT PMM pool is created and funded.",
+      "tokenInSymbols": [
+        "cUSDT",
+        "cBTC"
+      ]
+    },
+    {
+      "routeId": "chain-138-capability-dodo-planned-cbtc-cusdc",
+      "status": "planned",
+      "fromChainId": 138,
+      "toChainId": 138,
+      "routeType": "swap",
+      "reason": "Set CHAIN138_POOL_CBTC_CUSDC after the canonical cBTC/cUSDC PMM pool is created and funded.",
+      "tokenInSymbols": [
+        "cBTC",
+        "cUSDC"
+      ]
+    },
+    {
+      "routeId": "chain-138-capability-dodo-planned-cusdc-cbtc",
+      "status": "planned",
+      "fromChainId": 138,
+      "toChainId": 138,
+      "routeType": "swap",
+      "reason": "Set CHAIN138_POOL_CBTC_CUSDC after the canonical cBTC/cUSDC PMM pool is created and funded.",
+      "tokenInSymbols": [
+        "cUSDC",
+        "cBTC"
+      ]
+    },
+    {
+      "routeId": "chain-138-capability-dodo-planned-cbtc-cxauc",
+      "status": "planned",
+      "fromChainId": 138,
+      "toChainId": 138,
+      "routeType": "swap",
+      "reason": "Set CHAIN138_POOL_CBTC_CXAUC after the canonical cBTC/cXAUC PMM pool is created and funded.",
+      "tokenInSymbols": [
+        "cBTC",
+        "cXAUC"
+      ]
+    },
+    {
+      "routeId": "chain-138-capability-dodo-planned-cxauc-cbtc",
+      "status": "planned",
+      "fromChainId": 138,
+      "toChainId": 138,
+      "routeType": "swap",
+      "reason": "Set CHAIN138_POOL_CBTC_CXAUC after the canonical cBTC/cXAUC PMM pool is created and funded.",
+      "tokenInSymbols": [
+        "cXAUC",
+        "cBTC"
+      ]
+    },
+    {
+      "routeId": "chain-138-capability-dodo-planned-weth-usdt",
+      "status": "planned",
+      "fromChainId": 138,
+      "toChainId": 138,
+      "routeType": "swap",
+      "reason": "Set CHAIN138_POOL_WETH_USDT after the canonical WETH/USDT pool is created and funded.",
+      "tokenInSymbols": [
+        "WETH",
+        "USDT"
+      ]
+    },
+    {
+      "routeId": "chain-138-capability-dodo-planned-usdt-weth",
+      "status": "planned",
+      "fromChainId": 138,
+      "toChainId": 138,
+      "routeType": "swap",
+      "reason": "Set CHAIN138_POOL_WETH_USDT after the canonical WETH/USDT pool is created and funded.",
+      "tokenInSymbols": [
+        "USDT",
+        "WETH"
+      ]
+    },
+    {
+      "routeId": "chain-138-capability-dodo-planned-weth-usdc",
+      "status": "planned",
+      "fromChainId": 138,
+      "toChainId": 138,
+      "routeType": "swap",
+      "reason": "Set CHAIN138_POOL_WETH_USDC after the canonical WETH/USDC pool is created and funded.",
+      "tokenInSymbols": [
+        "WETH",
+        "USDC"
+      ]
+    },
+    {
+      "routeId": "chain-138-capability-dodo-planned-usdc-weth",
+      "status": "planned",
+      "fromChainId": 138,
+      "toChainId": 138,
+      "routeType": "swap",
+      "reason": "Set CHAIN138_POOL_WETH_USDC after the canonical WETH/USDC pool is created and funded.",
+      "tokenInSymbols": [
+        "USDC",
+        "WETH"
+      ]
+    }
+  ]
 }

config/all-mainnet-canary-evidence.example.json

@@ -1,23 +0,0 @@
-{
-  "description": "Copy to config/all-mainnet-canary-evidence.json after live canary swaps. Each row needs real transaction hashes and observed balance deltas.",
-  "evidence": [
-    {
-      "poolId": "651940-uniswap_v2-wall-ausdc",
-      "status": "canary_passed",
-      "generatedAt": "2026-04-29T00:00:00.000Z",
-      "canaryTransactions": [
-        {
-          "amountLabel": "seed",
-          "txHash": "0x0000000000000000000000000000000000000000000000000000000000000000",
-          "sourceToken": "WALL",
-          "destinationToken": "AUSDC",
-          "observedInputRaw": "0",
-          "observedOutputRaw": "0"
-        }
-      ],
-      "notes": [
-        "Replace with real canary transaction evidence before applying."
-      ]
-    }
-  ]
-}

config/all-mainnet-canary-evidence.json

@@ -1,77 +0,0 @@
-{
-  "description": "ALL Mainnet canary evidence recorded from live canary transactions executed with deployer wallet 0x4A666F96fC8764181194447A7dFdb7d471b301C8.",
-  "evidence": [
-    {
-      "poolId": "651940-dodo_pmm-wall-ausdc",
-      "generatedAt": "2026-04-29T04:41:13.993Z",
-      "canaryTransactions": [
-        {
-          "direction": "base_to_quote",
-          "txHash": "0x727cea66f601b514b0d82c4bc93c29fbc09047e8185c146a05564dce7916829c",
-          "fundingTransferTxHash": "0x65f8d2e15556c26b46dd7323a90cb174279fc6bd0e7002a868553dc990bfa656",
-          "amountInRaw": "1000000",
-          "tokenIn": "WALL",
-          "tokenOut": "AUSDC",
-          "executor": "DODO_DVM.transfer_then_sellBase"
-        }
-      ],
-      "notes": [
-        "Tiny live canary swap executed on ALL Mainnet DODO PMM WALL/AUSDC."
-      ]
-    },
-    {
-      "poolId": "651940-uniswap_v2-wall-ausdc",
-      "generatedAt": "2026-04-29T04:41:13.993Z",
-      "canaryTransactions": [
-        {
-          "direction": "base_to_quote",
-          "txHash": "0x0b76149f25e36919637fbeab10056e45d8ab7757454174966842c3f52f53dd5c",
-          "approvalTxHash": "0xc33d872d15628cfe521552ccc9a4b908f31df59189764468775b4557826514b6",
-          "amountInRaw": "1000000",
-          "tokenIn": "WALL",
-          "tokenOut": "AUSDC",
-          "executor": "UniswapV2Router.swapExactTokensForTokens"
-        }
-      ],
-      "notes": [
-        "Tiny live canary swap executed on ALL Mainnet Uniswap V2 WALL/AUSDC."
-      ]
-    },
-    {
-      "poolId": "137-dodo_pmm-cwusdc-usdc",
-      "generatedAt": "2026-04-29T04:41:13.993Z",
-      "canaryTransactions": [
-        {
-          "direction": "base_to_quote",
-          "txHash": "0x4f68cdb0502b0fd50602013e54cbf898556a5c1181d8009f9b0c166dfccf5ce7",
-          "fundingTransferTxHash": "0x2b2721dd505f82488b05f32810f7e94b3a712e9b459b638be9b8ea34c20925d9",
-          "amountInRaw": "1",
-          "tokenIn": "cWUSDC",
-          "tokenOut": "USDC",
-          "executor": "DODO_DVM.transfer_then_sellBase"
-        }
-      ],
-      "notes": [
-        "Tiny live canary swap executed on Polygon DODO PMM cWUSDC/USDC."
-      ]
-    },
-    {
-      "poolId": "137-dodo_pmm-cwusdt-usdt",
-      "generatedAt": "2026-04-29T04:41:13.993Z",
-      "canaryTransactions": [
-        {
-          "direction": "base_to_quote",
-          "txHash": "0x9c946c7c912e2eabe960c752041b533948e85e2a1603c80de80c5b0ee447908d",
-          "fundingTransferTxHash": "0xcac8b9187325869f164f6b7cd5464fcf46dce6be83ef04d760e7ecc21de7d40d",
-          "amountInRaw": "1",
-          "tokenIn": "cWUSDT",
-          "tokenOut": "USDT",
-          "executor": "DODO_DVM.transfer_then_sellBase"
-        }
-      ],
-      "notes": [
-        "Tiny live canary swap executed on Polygon DODO PMM cWUSDT/USDT."
-      ]
-    }
-  ]
-}

config/all-mainnet-enhanced-router-deployment.json

@@ -1,147 +0,0 @@
-{
-  "name": "ALL Mainnet Enhanced Router Deployment Evidence",
-  "version": "0.1.0",
-  "generatedAt": "2026-04-29T05:52:00Z",
-  "chainId": 651940,
-  "network": "ALL Mainnet (Alltra)",
-  "evmVersion": "paris",
-  "reason": "ALL Mainnet RPC/runtime rejected Cancun bytecode with BadInstruction; Paris bytecode was used for live deployment.",
-  "deployer": "0x4A666F96fC8764181194447A7dFdb7d471b301C8",
-  "contracts": {
-    "dodoPmmProvider": {
-      "address": "0x36F65027D21e151F0b7810bae1E94b225AC7Ba9e",
-      "transactionHash": "0xd2e69b556e84786338fd526ba149d1f88488a07190d081f935d7fffbe9d1b2e0",
-      "constructorArgs": {
-        "dodoPmmIntegration": "0x8528E268F3b8C94208d09D131ACa3Ea93Bad57c7",
-        "admin": "0x4A666F96fC8764181194447A7dFdb7d471b301C8"
-      }
-    },
-    "enhancedSwapRouterV2": {
-      "address": "0xb905fEfA56b028221E2Bc248Bbcd41141dc7aeD3",
-      "transactionHash": "0x2c5d409b6e06cbfb69d8e251240d830d624625a4d505cc963edb65b55623bc79",
-      "constructorArgs": {
-        "weth": "0x798F6762BB40d6801A593459d08F890603D3979C",
-        "usdt": "0x66D8Efa0AF63B0e84eb1Dd72bf00f00cd1e2234e",
-        "usdc": "0xa95EeD79f84E6A0151eaEb9d441F9Ffd50e8e881",
-        "daiSlot": "0x015B1897Ed5279930bC2Be46F661894d219292A6",
-        "daiSlotNote": "AUSDT is used as the third stablecoin slot for ALL Mainnet; no canonical ALL DAI token is committed."
-      }
-    },
-    "intentBridgeCoordinatorV2": {
-      "address": "0x9276ae27d9c624B43dbE43494f34A9c5F0233a0B",
-      "transactionHash": "0x5695b3f9ec59e09d5e4f8569ea8af31578ced0a56aba885a7c475a5187aadd3d"
-    },
-    "adapters": {
-      "dodo": {
-        "address": "0x391D192BED6188c4DaB4C93c078bD18432687474",
-        "transactionHash": "0xc4a036a6fff5eb9886e797559017cf8709505d13f39f5feddf055967cf9b4648",
-        "enabled": true
-      },
-      "dodoV3": {
-        "address": "0x97Ce874142625134aEEBDF42B5E7bB806e731D25",
-        "transactionHash": "0x5ad21f59b823adbc2cebc1e9c45ab3f8f0f1286e46a290c09c0667f499577136",
-        "enabled": false
-      },
-      "uniswapV3": {
-        "address": "0xBF75F3401de20bebBB1CBb678499941807E3E040",
-        "transactionHash": "0x081b86cc99306e694ef9daa3d3f9dc7f35ce91dce08c57ddaedcdd4b9a00008d",
-        "enabled": false
-      },
-      "balancer": {
-        "address": "0xDE7F15AF1D84e3694f7E966293d20e64Fc04d9fF",
-        "transactionHash": "0xa4f30c029fa062ae1b481786950ab0243541ce5b0b859fc534b55f7b444ba83c",
-        "enabled": false
-      },
-      "curve": {
-        "address": "0x753D2b0a723992D7B174D6e19F7b7Cb74be8D61a",
-        "transactionHash": "0xcdf0ff9723aedab96aeaa0b8f57f25ad6075f9467e0d19f3b842fb17c0bb6a79",
-        "enabled": false
-      },
-      "oneInch": {
-        "address": "0x487090bbb7d17875281692d582a11B445b3A7AC7",
-        "transactionHash": "0x4d0dd682b8e22812a258fee497c07e5cecfbc1228f413e67d9fe7b24f327a926",
-        "enabled": false
-      }
-    }
-  },
-  "routes": [
-    {
-      "poolId": "651940-dodo_pmm-wall-ausdc",
-      "provider": "dodo",
-      "tokenA": {
-        "symbol": "WALL",
-        "address": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4"
-      },
-      "tokenB": {
-        "symbol": "AUSDC",
-        "address": "0xa95EeD79f84E6A0151eaEb9d441F9Ffd50e8e881"
-      },
-      "poolAddress": "0x7b81Dad382BBB57e91a80389bA48e41Abd10794F",
-      "status": "quoteable",
-      "verification": {
-        "amountInRaw": "1000000",
-        "amountOutRaw": "1999999",
-        "slippageBps": 30,
-        "routerQuoteExecutable": true
-      }
-    },
-    {
-      "poolId": "651940-dodo_pmm-wall-ausdt",
-      "provider": "dodo",
-      "tokenA": {
-        "symbol": "WALL",
-        "address": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4"
-      },
-      "tokenB": {
-        "symbol": "AUSDT",
-        "address": "0x015B1897Ed5279930bC2Be46F661894d219292A6"
-      },
-      "poolAddress": "0x8D9bB238B6a76a438B116Ff22F5F7535191D49b4",
-      "status": "quoteable",
-      "verification": {
-        "amountInRaw": "1000000",
-        "amountOutRaw": "1999999",
-        "slippageBps": 30,
-        "routerQuoteExecutable": true
-      }
-    }
-  ],
-  "providerStatus": {
-    "enabled": [
-      "dodo"
-    ],
-    "disabled": [
-      "dodoV3",
-      "uniswapV3",
-      "balancer",
-      "curve",
-      "oneInch",
-      "partner"
-    ]
-  },
-  "remainingOptionalBlockers": [
-    "HYDX-native router/factory is not deployed or not committed in inventory.",
-    "Uniswap V3 factory/router/quoter/pool stack is not deployed or not committed in inventory."
-  ],
-  "disabledRoutes": [
-    {
-      "poolId": "651940-dodo_pmm-wall-usdt",
-      "provider": "dodo",
-      "tokenA": {
-        "symbol": "WALL",
-        "address": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4"
-      },
-      "tokenB": {
-        "symbol": "USDT",
-        "address": "0x66D8Efa0AF63B0e84eb1Dd72bf00f00cd1e2234e"
-      },
-      "poolAddress": "0x261D7e1447EE88398B2b5a274D49454F5B86800E",
-      "status": "disabled_wrong_quote_asset",
-      "reason": "AUSDT is the canonical ALL Mainnet cUSDT surface for this routing set.",
-      "disabledTransactions": [
-        "0x79f171ddc9977e99bb894bf7ff7a11a430441cc1285e7ecd747907ef3f23a0c4",
-        "0xec74f92e287cf1e193e791462f66b35cf9487ece8e343108fbdd3de760dc5c55"
-      ]
-    }
-  ]
-}

config/all-mainnet-uniswap-v3-deployment.json

@@ -1,68 +0,0 @@
-{
-  "generatedAt": "2026-04-29T06:18:00Z",
-  "chainId": 651940,
-  "deployer": "0x4A666F96fC8764181194447A7dFdb7d471b301C8",
-  "fee": 3000,
-  "tokens": {
-    "WETH": "0x798F6762BB40d6801A593459d08F890603D3979C",
-    "WALL": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4",
-    "AUSDT": "0x015B1897Ed5279930bC2Be46F661894d219292A6",
-    "token0": "0x015B1897Ed5279930bC2Be46F661894d219292A6",
-    "token1": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4"
-  },
-  "contracts": {
-    "nftDescriptorLibrary": "0xb53E8A0A19fB381537c6f28D37b7C2f7DC29EF02",
-    "nonfungibleTokenPositionDescriptor": "0x2a76C73458A0C11df4e0E43004598480d6D1E768",
-    "factory": "0xF1a334465C5DD628492780B39Be68D561A9AecA2",
-    "swapRouter": "0xe9Ea1B70803c18C4CEb8839D5D68681c7903511B",
-    "quoter": "0x0ecC56077325863c80cbe516D63e0afAFf7EA579",
-    "quoterV2": "0x024Ff178BaB7e6fa1794c3A216D2B299C3F295d2",
-    "nonfungiblePositionManager": "0xD29422211e1f2C1015FBb5dC2004657Dd8318aF6",
-    "pool": "0x9e0FC06BA367b51a0aBc5c0924306088DBB0e9c4"
-  },
-  "transactions": {
-    "nftDescriptorLibrary": "0x774202382ec2d29cced671b34c2b951682f60d3e60afd7fe64c13488cb341e32",
-    "nonfungibleTokenPositionDescriptor": "0xc6b98fc36e4c3b1d4d2e80efd4acacc31e2af2ff45de04f9fb066dcfffd380d3",
-    "factory": "0xb6e46b6d145cc707f12f4cf8980bf81d7b5b8d3bea9416737a7465c186b0fefd",
-    "swapRouter": "0x5fd7d021e8ac1bad918a1eb470a116f9dc6e750c102a5512e05391858296cc53",
-    "quoter": "0x0d5c14d3264c5abd70990349911a6eb3076f41feb2db93ccf74b2de022cd087f",
-    "quoterV2": "0x774327c7e7a7650fbfd9d28a8becbd88f86eb8f942a825980052bc50484aa54c",
-    "nonfungiblePositionManager": "0xe5be3fa83bd676051e2cc5ff990768d3de87e49a387d94be77352eaf1c38545f"
-  },
-  "poolState": {
-    "sqrtPriceX96": "79228162514264337593543950336",
-    "tick": 0,
-    "liquidity": "1000000000000000000"
-  },
-  "name": "ALL Mainnet Uniswap V3 Deployment Evidence",
-  "version": "0.1.0",
-  "network": "ALL Mainnet (Alltra)",
-  "evmVersion": "upstream-uniswap-artifacts-solc-0.7.x",
-  "packageSources": {
-    "v3Core": "@uniswap/v3-core@1.0.1",
-    "v3Periphery": "@uniswap/v3-periphery@1.4.4",
-    "swapRouterContracts": "@uniswap/swap-router-contracts@1.3.1"
-  },
-  "poolStateAfterRouterSwap": {
-    "testedAt": "2026-04-29T06:17:00Z",
-    "swapRouter": "0xe9Ea1B70803c18C4CEb8839D5D68681c7903511B",
-    "direction": "WALL_TO_AUSDT",
-    "amountInRaw": "1000000",
-    "amountOutRaw": "996999",
-    "approveTxHash": "0x572d1c6b2d0cdf6248913cd995e80196fbe0717017411c2251637afbfa825e1f",
-    "swapTxHash": "0xddf85aed18a6d872ac72d4f57b241e44946881e404f4f17cb7271180c8caa183",
-    "gasUsed": "119111"
-  },
-  "enhancedRouterIntegration": {
-    "enhancedSwapRouterV2": "0xb905fEfA56b028221E2Bc248Bbcd41141dc7aeD3",
-    "routeConfigured": true,
-    "providerEnabled": false,
-    "providerDisabledReason": "Existing UniswapV3RouteExecutorAdapter uses staticcall into the official Uniswap Quoter; the upstream Quoter is callable directly but does not return through that adapter staticcall path. Standalone SwapRouter/Quoter/Pool stack is live; enhanced-router V3 provider remains disabled until adapter quote compatibility is fixed.",
-    "routeSetTransactions": [
-      "0xa40b24889ab3ad985936562ee3690dafd14bfb1676ff49806a6fcb45c7704ef5",
-      "0x848fd6c7cedaebe7787c2f15a931b73afde709dac100cb745eab2d9eaa6da86c"
-    ],
-    "providerEnableTxHash": "0x4b430081582e1f2db5fedc904b8e90e137480dcae2f1e0a41dd25490f05394c7",
-    "providerDisableTxHash": "0x78b8ce4fdc296585ace36dd8c8318731cc5526115e712b14d1ad630c4f63aba6"
-  }
-}

config/all-mainnet-vault-assignments.example.json

@@ -1,27 +0,0 @@
-{
-  "description": "Copy to config/all-mainnet-vault-assignments.json and replace placeholder addresses with approved per-role vaults/multisigs. The apply script refuses placeholders.",
-  "defaultByRole": {
-    "treasury_reserve": "0x0000000000000000000000000000000000000000",
-    "bridge_liquidity": "0x0000000000000000000000000000000000000000",
-    "protocol_adapter": "0x0000000000000000000000000000000000000000",
-    "emergency_withdraw": "0x0000000000000000000000000000000000000000",
-    "single_sided_inventory": "0x0000000000000000000000000000000000000000"
-  },
-  "byChain": {
-    "651940": {
-      "treasury_reserve": "0x0000000000000000000000000000000000000000",
-      "bridge_liquidity": "0x0000000000000000000000000000000000000000",
-      "protocol_adapter": "0x0000000000000000000000000000000000000000",
-      "emergency_withdraw": "0x0000000000000000000000000000000000000000",
-      "single_sided_inventory": "0x0000000000000000000000000000000000000000"
-    }
-  },
-  "byPoolId": {
-    "651940-uniswap_v2-wall-ausdc": {
-      "treasury_reserve": "0x0000000000000000000000000000000000000000",
-      "bridge_liquidity": "0x0000000000000000000000000000000000000000",
-      "protocol_adapter": "0x0000000000000000000000000000000000000000",
-      "emergency_withdraw": "0x0000000000000000000000000000000000000000"
-    }
-  }
-}

config/all-mainnet-vault-assignments.json

@@ -1,20 +0,0 @@
-{
-  "description": "Operational vault assignments generated from smom-dbis-138/.env public addresses. No private material is stored here.",
-  "defaultByRole": {
-    "treasury_reserve": "0x74eccf9affb0e0938c2168ebdf7ef63a26964483",
-    "bridge_liquidity": "0x31884f84555210FFB36a19D2471b8eBc7372d0A8",
-    "protocol_adapter": "0xb9E29cFa1f89d369671E640d0BB3aD94Cab43965",
-    "emergency_withdraw": "0xb9E29cFa1f89d369671E640d0BB3aD94Cab43965",
-    "single_sided_inventory": "0x31884f84555210FFB36a19D2471b8eBc7372d0A8"
-  },
-  "byChain": {
-    "651940": {
-      "treasury_reserve": "0x74eccf9affb0e0938c2168ebdf7ef63a26964483",
-      "bridge_liquidity": "0x31884f84555210FFB36a19D2471b8eBc7372d0A8",
-      "protocol_adapter": "0xb9E29cFa1f89d369671E640d0BB3aD94Cab43965",
-      "emergency_withdraw": "0xb9E29cFa1f89d369671E640d0BB3aD94Cab43965",
-      "single_sided_inventory": "0x31884f84555210FFB36a19D2471b8eBc7372d0A8"
-    }
-  },
-  "byPoolId": {}
-}

config/allmainnet-non-dodo-protocol-surface.json

@@ -1,973 +0,0 @@
-{
-  "name": "ALL Mainnet Non-DODO Protocol Surface",
-  "version": "0.1.0",
-  "updated": "2026-04-29",
-  "chainId": 651940,
-  "network": "ALL Mainnet (Alltra)",
-  "status": "bridge_live_enhanced_router_partial_swap_inventory_published",
-  "summary": {
-    "bridgeOnlyLive": false,
-    "sameChainSwapInventoryPublished": true,
-    "notes": [
-      "The Chain 138 <-> 651940 AlltraAdapter bridge is live.",
-      "This file documents the known non-DODO Alltra protocol and token surface plus the committed same-chain inventory fragments that have real factory/router/pool addresses in config/all-mainnet-pool-creation-matrix.json.",
-      "Same-chain inventory publication is partial: production routing remains gated by required vault assignments, funding, live reserve reads, and canary evidence.",
-      "ALL Mainnet EnhancedSwapRouterV2 is deployed and DODO-backed routes are wired for the committed WALL/AUSDC and WALL/AUSDT DODO PMM pools; the earlier WALL/USDT route is disabled because AUSDT is the canonical ALL Mainnet cUSDT surface."
-    ]
-  },
-  "classificationFramework": {
-    "category": [
-      "tokenized-fiat",
-      "stablecoin",
-      "wrapped-native",
-      "dex-token",
-      "defi-token",
-      "governance-token",
-      "utility-token",
-      "rwa-token",
-      "commodity-token",
-      "other"
-    ],
-    "instrumentType": [
-      "emoney",
-      "deposit-token",
-      "fiat-backed-stablecoin",
-      "wrapped-native",
-      "protocol-token",
-      "governance-token",
-      "utility-token",
-      "other"
-    ],
-    "backingAssets": [
-      "cash",
-      "cash-equivalents",
-      "bank-deposits",
-      "treasuries",
-      "commodity-reserves",
-      "protocol-utility",
-      "native-gas-asset",
-      "unknown"
-    ],
-    "metadataDomains": [
-      "backingMetadata",
-      "bridgeMetadata",
-      "cashMetadata",
-      "commodityMetadata",
-      "reserveMetadata",
-      "securityMetadata",
-      "settlementMetadata"
-    ],
-    "notes": [
-      "Use category for the broad asset bucket.",
-      "Use instrumentType, issuerType, claimType, backingAssets, capabilities, and tags for legal, reserve, and integration semantics.",
-      "Use cash only as a backing, redemption, or settlement asset descriptor; do not use cash as the token category unless the instrument is literally cash-equivalent legal tender.",
-      "Use commodityMetadata only when the token directly references or is backed by a commodity reserve.",
-      "Use securityMetadata for pause/admin/monitoring controls; unknown means not yet committed in this inventory, not absent on-chain.",
-      "GRU tags use lowercase namespace:value strings and include the version, for example gru:v2."
-    ]
-  },
-  "documentedTokens": [
-    {
-      "symbol": "AUSDT",
-      "address": "0x015B1897Ed5279930bC2Be46F661894d219292A6",
-      "decimals": 18,
-      "category": "tokenized-fiat",
-      "instrumentType": "fiat-backed-stablecoin",
-      "issuerType": "token-issuer-unverified",
-      "currencyCode": "USD",
-      "claimType": "claim-on-issuer-unverified",
-      "settlementAssetClass": "fiat",
-      "backingAssets": [
-        "cash",
-        "cash-equivalents"
-      ],
-      "gruVersion": "v2",
-      "gruFamilySymbol": "cAUSDT",
-      "gruTransportRole": "all-mainnet-primary-surface",
-      "tags": [
-        "tokenized-fiat",
-        "fiat:usd",
-        "backing:cash",
-        "backing:cash-equivalents",
-        "gru:v2",
-        "gru:m1",
-        "gru:transport",
-        "gru:all-mainnet",
-        "gru:causdt-family"
-      ],
-      "backingMetadata": {
-        "backingModel": "fiat-reserve-backed",
-        "backingAssetClasses": [
-          "cash",
-          "cash-equivalents"
-        ],
-        "backingVerificationStatus": "reserve-disclosure-not-committed",
-        "overcollateralizationRequired": false
-      },
-      "bridgeMetadata": {
-        "bridgeStatus": "live-canonical-target",
-        "bridgeKind": "AlltraAdapter",
-        "sourceChainId": 138,
-        "destinationChainId": 651940,
-        "sourceSymbol": "cUSDT",
-        "sourceAddress": "0x93E66202A11B1772E55407B32B44e5Cd8eda7f22",
-        "destinationSymbol": "AUSDT",
-        "destinationAddress": "0x015B1897Ed5279930bC2Be46F661894d219292A6",
-        "adapterAddress": "0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc",
-        "bridgeCanonicalAssetVersion": "gru-v2",
-        "bridgeMirroredAssetVersion": "all-mainnet-surface"
-      },
-      "cashMetadata": {
-        "cashRole": "reserve-and-redemption-asset-class",
-        "currency": "USD",
-        "cashBackingAssertedByRepo": false,
-        "cashBackingEvidenceRef": null
-      },
-      "commodityMetadata": {
-        "commodityBacked": false,
-        "commodityType": null,
-        "commodityUnit": null,
-        "reserveLocationRef": null
-      },
-      "reserveMetadata": {
-        "reserveModel": "issuer-or-bridge-reserve-unverified",
-        "reserveDisclosureRef": null,
-        "reserveAccountRef": null,
-        "proofOfReserveRef": null,
-        "reserveVerificationStatus": "pending-disclosure",
-        "riskTier": "policy-review-required",
-        "registryStatus": "documented-surface-not-stablecoin-registry-entry"
-      },
-      "securityMetadata": {
-        "pauseAuthority": "unknown",
-        "adminAuthority": "unknown",
-        "upgradeability": "unknown",
-        "keyManagement": "unknown",
-        "emergencyHalt": "corridor-halt-required-for-issuer-bridge-or-peg-risk",
-        "monitoring": [
-          "peg-deviation",
-          "bridge-health",
-          "liquidity-depth",
-          "contract-admin-changes"
-        ]
-      },
-      "settlementMetadata": {
-        "settlementAssetClass": "fiat",
-        "settlementCurrency": "USD",
-        "settlementFinalityDomain": "off-chain-regulated-ledger-or-issuer-domain",
-        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
-        "accountingEvidenceRequired": true,
-        "redemptionPath": "issuer-or-bridge-redemption-unverified",
-        "parRedemption": "unverified"
-      },
-      "status": "verified"
-    },
-    {
-      "symbol": "USDT",
-      "address": "0x66D8Efa0AF63B0e84eb1Dd72bf00f00cd1e2234e",
-      "decimals": 18,
-      "category": "tokenized-fiat",
-      "instrumentType": "fiat-backed-stablecoin",
-      "issuerType": "token-issuer-unverified",
-      "currencyCode": "USD",
-      "claimType": "claim-on-issuer-unverified",
-      "settlementAssetClass": "fiat",
-      "backingAssets": [
-        "cash",
-        "cash-equivalents"
-      ],
-      "gruVersion": "v2",
-      "gruFamilySymbol": "cUSDT",
-      "gruTransportRole": "all-mainnet-usdt-surface",
-      "tags": [
-        "tokenized-fiat",
-        "fiat:usd",
-        "backing:cash",
-        "backing:cash-equivalents",
-        "gru:v2",
-        "gru:m1",
-        "gru:transport",
-        "gru:all-mainnet",
-        "gru:cusdt-family"
-      ],
-      "backingMetadata": {
-        "backingModel": "fiat-reserve-backed",
-        "backingAssetClasses": [
-          "cash",
-          "cash-equivalents"
-        ],
-        "backingVerificationStatus": "reserve-disclosure-not-committed",
-        "overcollateralizationRequired": false
-      },
-      "bridgeMetadata": {
-        "bridgeStatus": "documented-token-not-canonical-138-to-651940-target",
-        "bridgeKind": "unknown-or-noncanonical",
-        "sourceChainId": null,
-        "destinationChainId": 651940,
-        "sourceSymbol": null,
-        "sourceAddress": null,
-        "destinationSymbol": "USDT",
-        "destinationAddress": "0x66D8Efa0AF63B0e84eb1Dd72bf00f00cd1e2234e",
-        "adapterAddress": null,
-        "bridgeCanonicalAssetVersion": null,
-        "bridgeMirroredAssetVersion": "all-mainnet-surface"
-      },
-      "cashMetadata": {
-        "cashRole": "reserve-and-redemption-asset-class",
-        "currency": "USD",
-        "cashBackingAssertedByRepo": false,
-        "cashBackingEvidenceRef": null
-      },
-      "commodityMetadata": {
-        "commodityBacked": false,
-        "commodityType": null,
-        "commodityUnit": null,
-        "reserveLocationRef": null
-      },
-      "reserveMetadata": {
-        "reserveModel": "issuer-reserve-unverified",
-        "reserveDisclosureRef": null,
-        "reserveAccountRef": null,
-        "proofOfReserveRef": null,
-        "reserveVerificationStatus": "pending-disclosure",
-        "riskTier": "policy-review-required",
-        "registryStatus": "documented-surface-not-stablecoin-registry-entry"
-      },
-      "securityMetadata": {
-        "pauseAuthority": "unknown",
-        "adminAuthority": "unknown",
-        "upgradeability": "unknown",
-        "keyManagement": "unknown",
-        "emergencyHalt": "corridor-halt-required-for-issuer-or-peg-risk",
-        "monitoring": [
-          "peg-deviation",
-          "liquidity-depth",
-          "contract-admin-changes"
-        ]
-      },
-      "settlementMetadata": {
-        "settlementAssetClass": "fiat",
-        "settlementCurrency": "USD",
-        "settlementFinalityDomain": "off-chain-issuer-domain",
-        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
-        "accountingEvidenceRequired": true,
-        "redemptionPath": "issuer-redemption-unverified",
-        "parRedemption": "unverified"
-      },
-      "status": "verified"
-    },
-    {
-      "symbol": "USDC",
-      "address": "0xa95EeD79f84E6A0151eaEb9d441F9Ffd50e8e881",
-      "decimals": 18,
-      "category": "tokenized-fiat",
-      "instrumentType": "fiat-backed-stablecoin",
-      "issuerType": "token-issuer-unverified",
-      "currencyCode": "USD",
-      "claimType": "claim-on-issuer-unverified",
-      "settlementAssetClass": "fiat",
-      "backingAssets": [
-        "cash",
-        "cash-equivalents"
-      ],
-      "gruVersion": "v2",
-      "gruFamilySymbol": "cUSDC",
-      "gruTransportRole": "all-mainnet-usdc-surface",
-      "tags": [
-        "tokenized-fiat",
-        "fiat:usd",
-        "backing:cash",
-        "backing:cash-equivalents",
-        "gru:v2",
-        "gru:m1",
-        "gru:transport",
-        "gru:all-mainnet",
-        "gru:cusdc-family"
-      ],
-      "backingMetadata": {
-        "backingModel": "fiat-reserve-backed",
-        "backingAssetClasses": [
-          "cash",
-          "cash-equivalents"
-        ],
-        "backingVerificationStatus": "reserve-disclosure-not-committed",
-        "overcollateralizationRequired": false
-      },
-      "bridgeMetadata": {
-        "bridgeStatus": "live-canonical-target",
-        "bridgeKind": "AlltraAdapter",
-        "sourceChainId": 138,
-        "destinationChainId": 651940,
-        "sourceSymbol": "cUSDC",
-        "sourceAddress": "0xf22258f57794CC8E06237084b353Ab30fFfa640b",
-        "destinationSymbol": "USDC",
-        "destinationAddress": "0xa95EeD79f84E6A0151eaEb9d441F9Ffd50e8e881",
-        "adapterAddress": "0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc",
-        "bridgeCanonicalAssetVersion": "gru-v2",
-        "bridgeMirroredAssetVersion": "all-mainnet-surface"
-      },
-      "cashMetadata": {
-        "cashRole": "reserve-and-redemption-asset-class",
-        "currency": "USD",
-        "cashBackingAssertedByRepo": false,
-        "cashBackingEvidenceRef": null
-      },
-      "commodityMetadata": {
-        "commodityBacked": false,
-        "commodityType": null,
-        "commodityUnit": null,
-        "reserveLocationRef": null
-      },
-      "reserveMetadata": {
-        "reserveModel": "issuer-or-bridge-reserve-unverified",
-        "reserveDisclosureRef": null,
-        "reserveAccountRef": null,
-        "proofOfReserveRef": null,
-        "reserveVerificationStatus": "pending-disclosure",
-        "riskTier": "policy-review-required",
-        "registryStatus": "documented-surface-not-stablecoin-registry-entry"
-      },
-      "securityMetadata": {
-        "pauseAuthority": "unknown",
-        "adminAuthority": "unknown",
-        "upgradeability": "unknown",
-        "keyManagement": "unknown",
-        "emergencyHalt": "corridor-halt-required-for-issuer-bridge-or-peg-risk",
-        "monitoring": [
-          "peg-deviation",
-          "bridge-health",
-          "liquidity-depth",
-          "contract-admin-changes"
-        ]
-      },
-      "settlementMetadata": {
-        "settlementAssetClass": "fiat",
-        "settlementCurrency": "USD",
-        "settlementFinalityDomain": "off-chain-regulated-ledger-or-issuer-domain",
-        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
-        "accountingEvidenceRequired": true,
-        "redemptionPath": "issuer-or-bridge-redemption-unverified",
-        "parRedemption": "unverified"
-      },
-      "status": "verified"
-    },
-    {
-      "symbol": "WETH",
-      "address": "0x798F6762BB40d6801A593459d08F890603D3979C",
-      "decimals": 18,
-      "category": "wrapped-native",
-      "instrumentType": "wrapped-native",
-      "issuerType": "wrapper-contract",
-      "settlementAssetClass": "crypto-native",
-      "backingAssets": [
-        "native-gas-asset"
-      ],
-      "gruVersion": null,
-      "tags": [
-        "wrapped-native",
-        "gas:eth",
-        "all-mainnet"
-      ],
-      "backingMetadata": {
-        "backingModel": "wrapped-native-escrow",
-        "backingAssetClasses": [
-          "native-gas-asset"
-        ],
-        "backingVerificationStatus": "wrapper-contract-address-verified",
-        "overcollateralizationRequired": false
-      },
-      "bridgeMetadata": {
-        "bridgeStatus": "mapped-138-to-651940",
-        "bridgeKind": "AlltraAdapter",
-        "sourceChainId": 138,
-        "destinationChainId": 651940,
-        "sourceSymbol": "WETH9",
-        "sourceAddress": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2",
-        "destinationSymbol": "WETH",
-        "destinationAddress": "0x798F6762BB40d6801A593459d08F890603D3979C",
-        "adapterAddress": "0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc"
-      },
-      "cashMetadata": {
-        "cashRole": "none",
-        "currency": null,
-        "cashBackingAssertedByRepo": false,
-        "cashBackingEvidenceRef": null
-      },
-      "commodityMetadata": {
-        "commodityBacked": false,
-        "commodityType": null,
-        "commodityUnit": null,
-        "reserveLocationRef": null
-      },
-      "reserveMetadata": {
-        "reserveModel": "native-asset-wrapper-escrow",
-        "reserveDisclosureRef": null,
-        "reserveAccountRef": "wrapper-contract-balance",
-        "proofOfReserveRef": null,
-        "reserveVerificationStatus": "contract-balance-verifiable-on-chain",
-        "riskTier": "bridge-and-wrapper-risk",
-        "registryStatus": "documented-token-surface"
-      },
-      "securityMetadata": {
-        "pauseAuthority": "unknown",
-        "adminAuthority": "unknown",
-        "upgradeability": "unknown",
-        "keyManagement": "unknown",
-        "emergencyHalt": "corridor-halt-required-for-bridge-or-wrapper-risk",
-        "monitoring": [
-          "bridge-health",
-          "wrapper-contract-balance",
-          "liquidity-depth",
-          "contract-admin-changes"
-        ]
-      },
-      "settlementMetadata": {
-        "settlementAssetClass": "crypto-native",
-        "settlementCurrency": "ETH",
-        "settlementFinalityDomain": "chain-finality",
-        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
-        "accountingEvidenceRequired": false,
-        "redemptionPath": "unwrap-or-bridge-withdrawal",
-        "parRedemption": "one-to-one-native-asset-when-wrapper-solvent"
-      },
-      "status": "verified"
-    },
-    {
-      "symbol": "WALL",
-      "address": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4",
-      "decimals": 18,
-      "category": "wrapped-native",
-      "instrumentType": "wrapped-native",
-      "issuerType": "wrapper-contract",
-      "settlementAssetClass": "crypto-native",
-      "backingAssets": [
-        "native-gas-asset"
-      ],
-      "gruVersion": null,
-      "tags": [
-        "wrapped-native",
-        "gas:all",
-        "all-mainnet"
-      ],
-      "backingMetadata": {
-        "backingModel": "wrapped-native-escrow",
-        "backingAssetClasses": [
-          "native-gas-asset"
-        ],
-        "backingVerificationStatus": "wrapper-contract-address-verified",
-        "overcollateralizationRequired": false
-      },
-      "bridgeMetadata": {
-        "bridgeStatus": "documented-all-mainnet-native-wrapper",
-        "bridgeKind": "native-wrapper",
-        "sourceChainId": 651940,
-        "destinationChainId": 651940,
-        "sourceSymbol": "ALL",
-        "sourceAddress": null,
-        "destinationSymbol": "WALL",
-        "destinationAddress": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4",
-        "adapterAddress": null
-      },
-      "cashMetadata": {
-        "cashRole": "none",
-        "currency": null,
-        "cashBackingAssertedByRepo": false,
-        "cashBackingEvidenceRef": null
-      },
-      "commodityMetadata": {
-        "commodityBacked": false,
-        "commodityType": null,
-        "commodityUnit": null,
-        "reserveLocationRef": null
-      },
-      "reserveMetadata": {
-        "reserveModel": "native-asset-wrapper-escrow",
-        "reserveDisclosureRef": null,
-        "reserveAccountRef": "wrapper-contract-balance",
-        "proofOfReserveRef": null,
-        "reserveVerificationStatus": "contract-balance-verifiable-on-chain",
-        "riskTier": "wrapper-risk",
-        "registryStatus": "documented-token-surface"
-      },
-      "securityMetadata": {
-        "pauseAuthority": "unknown",
-        "adminAuthority": "unknown",
-        "upgradeability": "unknown",
-        "keyManagement": "unknown",
-        "emergencyHalt": "corridor-halt-required-for-wrapper-risk",
-        "monitoring": [
-          "wrapper-contract-balance",
-          "liquidity-depth",
-          "contract-admin-changes"
-        ]
-      },
-      "settlementMetadata": {
-        "settlementAssetClass": "crypto-native",
-        "settlementCurrency": "ALL",
-        "settlementFinalityDomain": "chain-finality",
-        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
-        "accountingEvidenceRequired": false,
-        "redemptionPath": "unwrap-to-native-all",
-        "parRedemption": "one-to-one-native-asset-when-wrapper-solvent"
-      },
-      "status": "verified"
-    },
-    {
-      "symbol": "HYDX",
-      "address": "0x0d9793861AEB9244AD1B34375a83A6730F6AdD38",
-      "decimals": 18,
-      "category": "dex-token",
-      "instrumentType": "protocol-token",
-      "issuerType": "protocol",
-      "settlementAssetClass": "crypto-native",
-      "backingAssets": [
-        "protocol-utility"
-      ],
-      "gruVersion": null,
-      "tags": [
-        "dex-token",
-        "protocol:hydx",
-        "all-mainnet"
-      ],
-      "backingMetadata": {
-        "backingModel": "protocol-utility",
-        "backingAssetClasses": [
-          "protocol-utility"
-        ],
-        "backingVerificationStatus": "not-reserve-backed",
-        "overcollateralizationRequired": false
-      },
-      "bridgeMetadata": {
-        "bridgeStatus": "not-bridge-canonical-in-this-inventory",
-        "bridgeKind": null,
-        "sourceChainId": null,
-        "destinationChainId": 651940,
-        "sourceSymbol": null,
-        "sourceAddress": null,
-        "destinationSymbol": "HYDX",
-        "destinationAddress": "0x0d9793861AEB9244AD1B34375a83A6730F6AdD38",
-        "adapterAddress": null
-      },
-      "cashMetadata": {
-        "cashRole": "none",
-        "currency": null,
-        "cashBackingAssertedByRepo": false,
-        "cashBackingEvidenceRef": null
-      },
-      "commodityMetadata": {
-        "commodityBacked": false,
-        "commodityType": null,
-        "commodityUnit": null,
-        "reserveLocationRef": null
-      },
-      "reserveMetadata": {
-        "reserveModel": "none-protocol-token",
-        "reserveDisclosureRef": null,
-        "reserveAccountRef": null,
-        "proofOfReserveRef": null,
-        "reserveVerificationStatus": "not-applicable",
-        "riskTier": "protocol-token-risk",
-        "registryStatus": "documented-token-surface"
-      },
-      "securityMetadata": {
-        "pauseAuthority": "unknown",
-        "adminAuthority": "unknown",
-        "upgradeability": "unknown",
-        "keyManagement": "unknown",
-        "emergencyHalt": "routing-halt-required-for-protocol-or-contract-risk",
-        "monitoring": [
-          "liquidity-depth",
-          "contract-admin-changes",
-          "protocol-surface-confirmation"
-        ]
-      },
-      "settlementMetadata": {
-        "settlementAssetClass": "crypto-native",
-        "settlementCurrency": "HYDX",
-        "settlementFinalityDomain": "chain-finality",
-        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
-        "accountingEvidenceRequired": false,
-        "redemptionPath": "not-applicable",
-        "parRedemption": "not-applicable"
-      },
-      "status": "verified"
-    },
-    {
-      "symbol": "HYBX",
-      "address": "0x1839f77eBed7F388c7035f7061B4B8Ef0E72317a",
-      "decimals": 8,
-      "category": "defi-token",
-      "instrumentType": "protocol-token",
-      "issuerType": "protocol",
-      "settlementAssetClass": "crypto-native",
-      "backingAssets": [
-        "protocol-utility"
-      ],
-      "gruVersion": null,
-      "tags": [
-        "defi-token",
-        "protocol:hybx",
-        "all-mainnet"
-      ],
-      "backingMetadata": {
-        "backingModel": "protocol-utility",
-        "backingAssetClasses": [
-          "protocol-utility"
-        ],
-        "backingVerificationStatus": "not-reserve-backed",
-        "overcollateralizationRequired": false
-      },
-      "bridgeMetadata": {
-        "bridgeStatus": "not-bridge-canonical-in-this-inventory",
-        "bridgeKind": null,
-        "sourceChainId": null,
-        "destinationChainId": 651940,
-        "sourceSymbol": null,
-        "sourceAddress": null,
-        "destinationSymbol": "HYBX",
-        "destinationAddress": "0x1839f77eBed7F388c7035f7061B4B8Ef0E72317a",
-        "adapterAddress": null
-      },
-      "cashMetadata": {
-        "cashRole": "none",
-        "currency": null,
-        "cashBackingAssertedByRepo": false,
-        "cashBackingEvidenceRef": null
-      },
-      "commodityMetadata": {
-        "commodityBacked": false,
-        "commodityType": null,
-        "commodityUnit": null,
-        "reserveLocationRef": null
-      },
-      "reserveMetadata": {
-        "reserveModel": "none-protocol-token",
-        "reserveDisclosureRef": null,
-        "reserveAccountRef": null,
-        "proofOfReserveRef": null,
-        "reserveVerificationStatus": "not-applicable",
-        "riskTier": "protocol-token-risk",
-        "registryStatus": "documented-token-surface"
-      },
-      "securityMetadata": {
-        "pauseAuthority": "unknown",
-        "adminAuthority": "unknown",
-        "upgradeability": "unknown",
-        "keyManagement": "unknown",
-        "emergencyHalt": "routing-halt-required-for-protocol-or-contract-risk",
-        "monitoring": [
-          "liquidity-depth",
-          "contract-admin-changes"
-        ]
-      },
-      "settlementMetadata": {
-        "settlementAssetClass": "crypto-native",
-        "settlementCurrency": "HYBX",
-        "settlementFinalityDomain": "chain-finality",
-        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
-        "accountingEvidenceRequired": false,
-        "redemptionPath": "not-applicable",
-        "parRedemption": "not-applicable"
-      },
-      "status": "verified"
-    },
-    {
-      "symbol": "CHT",
-      "address": "0xE59Bb804F4884FcEA183a4A67B1bb04f4a4567bc",
-      "decimals": 8,
-      "category": "defi-token",
-      "instrumentType": "utility-token",
-      "issuerType": "protocol",
-      "settlementAssetClass": "crypto-native",
-      "backingAssets": [
-        "protocol-utility"
-      ],
-      "gruVersion": null,
-      "tags": [
-        "defi-token",
-        "utility-token",
-        "protocol:cht",
-        "all-mainnet"
-      ],
-      "backingMetadata": {
-        "backingModel": "protocol-utility",
-        "backingAssetClasses": [
-          "protocol-utility"
-        ],
-        "backingVerificationStatus": "not-reserve-backed",
-        "overcollateralizationRequired": false
-      },
-      "bridgeMetadata": {
-        "bridgeStatus": "not-bridge-canonical-in-this-inventory",
-        "bridgeKind": null,
-        "sourceChainId": null,
-        "destinationChainId": 651940,
-        "sourceSymbol": null,
-        "sourceAddress": null,
-        "destinationSymbol": "CHT",
-        "destinationAddress": "0xE59Bb804F4884FcEA183a4A67B1bb04f4a4567bc",
-        "adapterAddress": null
-      },
-      "cashMetadata": {
-        "cashRole": "none",
-        "currency": null,
-        "cashBackingAssertedByRepo": false,
-        "cashBackingEvidenceRef": null
-      },
-      "commodityMetadata": {
-        "commodityBacked": false,
-        "commodityType": null,
-        "commodityUnit": null,
-        "reserveLocationRef": null
-      },
-      "reserveMetadata": {
-        "reserveModel": "none-utility-token",
-        "reserveDisclosureRef": null,
-        "reserveAccountRef": null,
-        "proofOfReserveRef": null,
-        "reserveVerificationStatus": "not-applicable",
-        "riskTier": "utility-token-risk",
-        "registryStatus": "documented-token-surface"
-      },
-      "securityMetadata": {
-        "pauseAuthority": "unknown",
-        "adminAuthority": "unknown",
-        "upgradeability": "unknown",
-        "keyManagement": "unknown",
-        "emergencyHalt": "routing-halt-required-for-protocol-or-contract-risk",
-        "monitoring": [
-          "liquidity-depth",
-          "contract-admin-changes"
-        ]
-      },
-      "settlementMetadata": {
-        "settlementAssetClass": "crypto-native",
-        "settlementCurrency": "CHT",
-        "settlementFinalityDomain": "chain-finality",
-        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
-        "accountingEvidenceRequired": false,
-        "redemptionPath": "not-applicable",
-        "parRedemption": "not-applicable"
-      },
-      "status": "verified"
-    },
-    {
-      "symbol": "AUDA",
-      "address": "0x690740f055A41FA7669f5a379Bf71B0cDF353073",
-      "decimals": 18,
-      "category": "defi-token",
-      "instrumentType": "protocol-token",
-      "issuerType": "protocol",
-      "settlementAssetClass": "crypto-native",
-      "backingAssets": [
-        "protocol-utility"
-      ],
-      "gruVersion": null,
-      "tags": [
-        "defi-token",
-        "protocol:auda",
-        "all-mainnet"
-      ],
-      "backingMetadata": {
-        "backingModel": "protocol-utility",
-        "backingAssetClasses": [
-          "protocol-utility"
-        ],
-        "backingVerificationStatus": "not-reserve-backed",
-        "overcollateralizationRequired": false
-      },
-      "bridgeMetadata": {
-        "bridgeStatus": "not-bridge-canonical-in-this-inventory",
-        "bridgeKind": null,
-        "sourceChainId": null,
-        "destinationChainId": 651940,
-        "sourceSymbol": null,
-        "sourceAddress": null,
-        "destinationSymbol": "AUDA",
-        "destinationAddress": "0x690740f055A41FA7669f5a379Bf71B0cDF353073",
-        "adapterAddress": null
-      },
-      "cashMetadata": {
-        "cashRole": "none",
-        "currency": null,
-        "cashBackingAssertedByRepo": false,
-        "cashBackingEvidenceRef": null
-      },
-      "commodityMetadata": {
-        "commodityBacked": false,
-        "commodityType": null,
-        "commodityUnit": null,
-        "reserveLocationRef": null
-      },
-      "reserveMetadata": {
-        "reserveModel": "none-protocol-token",
-        "reserveDisclosureRef": null,
-        "reserveAccountRef": null,
-        "proofOfReserveRef": null,
-        "reserveVerificationStatus": "not-applicable",
-        "riskTier": "protocol-token-risk",
-        "registryStatus": "documented-token-surface"
-      },
-      "securityMetadata": {
-        "pauseAuthority": "unknown",
-        "adminAuthority": "unknown",
-        "upgradeability": "unknown",
-        "keyManagement": "unknown",
-        "emergencyHalt": "routing-halt-required-for-protocol-or-contract-risk",
-        "monitoring": [
-          "liquidity-depth",
-          "contract-admin-changes"
-        ]
-      },
-      "settlementMetadata": {
-        "settlementAssetClass": "crypto-native",
-        "settlementCurrency": "AUDA",
-        "settlementFinalityDomain": "chain-finality",
-        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
-        "accountingEvidenceRequired": false,
-        "redemptionPath": "not-applicable",
-        "parRedemption": "not-applicable"
-      },
-      "status": "verified"
-    }
-  ],
-  "protocols": [
-    {
-      "name": "AlltraDEX / EnhancedSwapRouter",
-      "family": "custom_router",
-      "status": "partial_live_dodo_backed_router_deployed",
-      "factoryAddress": null,
-      "routerAddress": "0xb905fEfA56b028221E2Bc248Bbcd41141dc7aeD3",
-      "coordinatorAddress": "0x9276ae27d9c624B43dbE43494f34A9c5F0233a0B",
-      "providerAddress": "0x36F65027D21e151F0b7810bae1E94b225AC7Ba9e",
-      "adapters": {
-        "dodo": "0x391D192BED6188c4DaB4C93c078bD18432687474",
-        "dodoV3": "0x97Ce874142625134aEEBDF42B5E7bB806e731D25",
-        "uniswapV3": "0xBF75F3401de20bebBB1CBb678499941807E3E040",
-        "balancer": "0xDE7F15AF1D84e3694f7E966293d20e64Fc04d9fF",
-        "curve": "0x753D2b0a723992D7B174D6e19F7b7Cb74be8D61a",
-        "oneInch": "0x487090bbb7d17875281692d582a11B445b3A7AC7"
-      },
-      "enabledProviders": [
-        "dodo"
-      ],
-      "disabledProviders": [
-        "dodoV3",
-        "uniswapV3",
-        "balancer",
-        "curve",
-        "oneInch",
-        "partner"
-      ],
-      "publishedRoutePoolIds": [
-        "651940-dodo_pmm-wall-ausdc",
-        "651940-dodo_pmm-wall-ausdt"
-      ],
-      "deploymentEvidenceRef": "config/all-mainnet-enhanced-router-deployment.json",
-      "notes": [
-        "Documented in docs/11-references/ALL_MAINNET_ROUTING_ENGINE.md as the intended same-chain swap surface.",
-        "EnhancedSwapRouterV2 is deployed on ALL Mainnet with DODO as the only enabled provider.",
-        "Optional adapters were deployed for future wiring but are disabled until canonical provider targets and pools are committed.",
-        "WALL/AUSDC and WALL/AUSDT are funded and quoteable through the router provider path; the earlier WALL/USDT route is disabled because AUSDT is the canonical quote asset."
-      ],
-      "disabledRoutePoolIds": [
-        "651940-dodo_pmm-wall-usdt"
-      ]
-    },
-    {
-      "name": "HYDX",
-      "family": "custom_router",
-      "status": "token_present_protocol_surface_pending",
-      "factoryAddress": null,
-      "routerAddress": null,
-      "envKeys": [
-        "CHAIN_651940_HYDX_FACTORY",
-        "CHAIN_651940_HYDX_ROUTER",
-        "CHAIN_651940_HYDX_START_BLOCK",
-        "CHAIN_651940_HYDX_PAIR_CREATED_EVENT"
-      ],
-      "notes": [
-        "The HYDX token is documented and verified on ALL Mainnet.",
-        "The repo expects factory/router discovery via env, but no canonical HYDX-native router inventory is currently committed.",
-        "HYDX currently has committed same-chain exposure through the ALL Mainnet Uniswap V2 HYDX/WALL pool, not through a dedicated HYDX-native router surface."
-      ]
-    },
-    {
-      "name": "Uniswap V2",
-      "family": "uniswap_v2",
-      "status": "partial_live_inventory_published",
-      "factoryAddress": "0x3C3ED514691C06c89Bf6626B05D22991E8924c93",
-      "routerAddress": "0xED04Ee8307C0656207AF5aFE3926AE2380052940",
-      "inventoryRef": "config/all-mainnet-pool-creation-matrix.json",
-      "publishedPoolIds": [
-        "651940-uniswap_v2-wall-ausdc",
-        "651940-uniswap_v2-wall-usdt",
-        "651940-uniswap_v2-usdt-ausdc",
-        "651940-uniswap_v2-hydx-wall"
-      ],
-      "notes": [
-        "Factory/router and multiple pair addresses are committed in config/all-mainnet-pool-creation-matrix.json.",
-        "Required spend rows remain gated until vault assignments and canary evidence are recorded."
-      ]
-    },
-    {
-      "name": "Uniswap V3",
-      "family": "uniswap_v3",
-      "status": "standalone_live_router_quoter_pool_deployed",
-      "factoryAddress": "0xF1a334465C5DD628492780B39Be68D561A9AecA2",
-      "routerAddress": "0xe9Ea1B70803c18C4CEb8839D5D68681c7903511B",
-      "notes": [
-        "Official Uniswap V3 factory, legacy SwapRouter, Quoter, QuoterV2, NonfungiblePositionManager, and AUSDT/WALL 0.30% pool are deployed on ALL Mainnet.",
-        "The standalone SwapRouter path was tested with a tiny WALL -> AUSDT canary swap.",
-        "EnhancedSwapRouterV2 route config was written, but provider 1 remains disabled because the current UniswapV3RouteExecutorAdapter staticcall quote path is incompatible with the upstream Quoter behavior."
-      ],
-      "quoterAddress": "0x0ecC56077325863c80cbe516D63e0afAFf7EA579",
-      "quoterV2Address": "0x024Ff178BaB7e6fa1794c3A216D2B299C3F295d2",
-      "positionManagerAddress": "0xD29422211e1f2C1015FBb5dC2004657Dd8318aF6",
-      "descriptorAddress": "0x2a76C73458A0C11df4e0E43004598480d6D1E768",
-      "poolAddress": "0x9e0FC06BA367b51a0aBc5c0924306088DBB0e9c4",
-      "inventoryRef": "config/all-mainnet-pool-creation-matrix.json",
-      "deploymentEvidenceRef": "config/all-mainnet-uniswap-v3-deployment.json",
-      "publishedPoolIds": [
-        "651940-uniswap_v3-wall-ausdt"
-      ],
-      "enhancedRouterProviderStatus": "disabled_adapter_quote_compatibility_pending"
-    },
-    {
-      "name": "DODO PMM",
-      "family": "dodo_pmm",
-      "status": "partial_live_inventory_published",
-      "factoryAddress": "0x8a3403aef8d40c0F4AfaF6Dc2000A537EbC863c2",
-      "routerAddress": "0x8528E268F3b8C94208d09D131ACa3Ea93Bad57c7",
-      "inventoryRef": "config/all-mainnet-pool-creation-matrix.json",
-      "publishedPoolIds": [
-        "651940-dodo_pmm-wall-ausdc",
-        "651940-dodo_pmm-wall-ausdt"
-      ],
-      "notes": [
-        "DVM factory, DVM factory adapter, integration/router, and DODO PMM pool addresses are committed in config/all-mainnet-pool-creation-matrix.json; WALL/AUSDT supersedes the earlier WALL/USDT row for canonical spend routing.",
-        "Required spend rows remain gated until vault assignments, funding, live reserve reads, and canary evidence are recorded."
-      ],
-      "disabledPoolIds": [
-        "651940-dodo_pmm-wall-usdt"
-      ]
-    }
-  ],
-  "bridgeSurface": {
-    "adapter": {
-      "name": "AlltraAdapter",
-      "address": "0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc",
-      "status": "live"
-    },
-    "supportedBridgeAssets": [
-      "cUSDC",
-      "cUSDT"
-    ]
-  },
-  "nextTasks": [
-    "Keep the disabled WALL/USDT row historical-only unless explicitly re-approved for USDT routing.",
-    "Commit canonical factory/router metadata once a HYDX-native routing address is confirmed.",
-    "Deploy or import canonical Uniswap V3 factory/router/quoter/pool inventory before enabling the ALL Mainnet Uniswap V3 adapter.",
-    "Add pool-level addresses and verification artifacts before enabling public route generation from disabled optional protocol providers."
-  ]
-}

config/besu-node-lists/README.md

@@ -27,9 +27,9 @@ See [docs/06-besu/MASTER_DOCS_AND_NODE_LISTS_REVIEW.md](../../docs/06-besu/MASTE
 - **New node (e.g. 1504, 2102):** Get the node’s enode (e.g. from `admin_nodeInfo` or the node’s data dir), add it to both files here, then run the deploy script.
 - **Node removed:** Remove its enode from both files and redeploy.
 - **Regenerate all (no duplicates):** Run `bash scripts/besu/collect-enodes-from-all-besu-nodes.sh` to collect from every node (admin_nodeInfo or `besu public-key export`), merge with existing for unreachable nodes, and overwrite both files.
-- **Fix failures only:** Run `bash scripts/besu/collect-enodes-from-all-besu-nodes.sh --missing-only` to try only VMIDs whose IP is not yet in the list (no full 32-node sweep).
-- **Generate missing node keys:** Run `bash scripts/besu/generate-node-keys-for-missing-vmids.sh [--force] [--collect]` to create `/data/besu/key` (64-hex) only for VMIDs not yet in the list. Use `--force` to overwrite PEM/wrong-format keys; use `--collect` to run collect --missing-only after. Containers without Besu (1505–1508, 2501–2505) are supported via helper nodes (1504 on ml110, 2500 on r630-01).
-- **Install Besu permanently on nodes missing it:** Run `bash scripts/besu/install-besu-permanent-on-missing-nodes.sh` to install Besu (23.10.3) in 1505–1508 and 2501–2505, deploy config/genesis/node lists, and enable+start the service so RPC/sentry runs after reboot.
+- **Fix failures only:** Run `bash scripts/besu/collect-enodes-from-all-besu-nodes.sh --missing-only` to try only VMIDs whose IP is not yet in the list (no full 37-node sweep).
+- **Generate missing node keys:** Run `bash scripts/besu/generate-node-keys-for-missing-vmids.sh [--force] [--collect]` to create `/data/besu/key` (64-hex) only for VMIDs not yet in the list. Use `--force` to overwrite PEM/wrong-format keys; use `--collect` to run collect --missing-only after. Current auxiliary / edge nodes include sentries `1505–1510` and RPCs `2420/2430/2440/2460/2470/2480`.
+- **Install Besu permanently on nodes missing it:** Run `bash scripts/besu/install-besu-permanent-on-missing-nodes.sh` to install the current Besu line used by the fleet, deploy config/genesis/node lists, and enable+start the service so RPC/sentry runs after reboot.
 
 ## Sentry 1504 (.154)
 

config/besu-node-lists/permissions-nodes.toml

@@ -1,6 +1,6 @@
 # Node Permissioning — SINGLE SOURCE OF TRUTH for all Besu nodes
 # Must match config/besu-node-lists/static-nodes.json and be deployed to every node.
-# Generated by scripts/besu/collect-enodes-from-all-besu-nodes.sh — 37 enodes after live adds of 2103 (.217), 1509 (.219), and 1510 (.220).
+# Generated by scripts/besu/collect-enodes-from-all-besu-nodes.sh — 37 enodes (incl. 2103 refreshed, Putu RPC 2307/2308 .237/.238, and Thirdweb sentries 1509/1510).
 
 nodes-allowlist=[
   "enode://2221dd9fc65c9082d4a937832cba9f6759981888df6798407c390bd153f4332c152ea5d03dd9d9cda74d7990fb3479a5c4ba7166269322be9790eed9ebdcfe24@192.168.11.100:30303",
@@ -15,10 +15,10 @@ nodes-allowlist=[
   "enode://225d902bf840379ce122f8cc431a542ddee0bde3e949b48767285bbc9c774cc3fc22cd4913ee72f0a19dce266e3ecb66dba5c58092d0b0e5ceb4e13bf96a1a68@192.168.11.154:30303",
   "enode://afa44c03ac3dd97efcbbef8edea11d1edf23bd595f30d4cf0c4be364d0b194e4217926a37141b54dcff71107f9ee257f621553cd867a2c9fa5a5537b3ae59746@192.168.11.213:30303",
   "enode://5f048208071f2a3036128433e1e4a647a7683abd8bc0f27d063e2933ced983accdfc44998666f3be711e4eff27511142d9989775b86cdbe28c79b74409fc36bb@192.168.11.214:30303",
-  "enode://8da1b586e2e98f521f07148d3bb5d81fde151ce3d5738b51bc36e2c81de1aaa5404ce31e991b4393bbe471934f0a9a31f78d1d7c17c1899c3e2dde5e9f16eb24@192.168.11.244:30303",
-  "enode://acd46d31913b8379f075467cd88d2ea650d33474d2f9546426da4a414fe92233584c9d8c2e1ea9962fa4257c20b66c9434d0488e51c632f285205d6a379cfbd6@192.168.11.245:30303",
   "enode://8a3337adcc2d177caf3aee26b3b6077d9adf126c580e12f352743ca07828f056ceb1d5fb1a06287e2dbbe19043fcc4b9bdd2ca9ae2a2c9142cf0cc3a549bfc68@192.168.11.219:30303",
   "enode://09fe518689c54a34c3dac8aebf3c94bfc390f4bae143a80c57d92a502414df0689d12a2243ff9376c2f44a419894d934b4f47783ced31ea9668522078854e58f@192.168.11.220:30303",
+  "enode://8da1b586e2e98f521f07148d3bb5d81fde151ce3d5738b51bc36e2c81de1aaa5404ce31e991b4393bbe471934f0a9a31f78d1d7c17c1899c3e2dde5e9f16eb24@192.168.11.244:30303",
+  "enode://acd46d31913b8379f075467cd88d2ea650d33474d2f9546426da4a414fe92233584c9d8c2e1ea9962fa4257c20b66c9434d0488e51c632f285205d6a379cfbd6@192.168.11.245:30303",
   "enode://6cdc892fa09afa2b05c21cc9a1193a86cf0d195ce81b02a270d8bb987f78ca98ad90d907670796c90fc6e4eaf3b4cae6c0c15871e2564de063beceb4bbfc6532@192.168.11.211:30303",
   "enode://e53713bb77ad9f39e8a04b9c82aadddd3449220167f546bca8e9f36f6ebf60ae003e48ac293790e2bd7b0aca382777db9eca61d6f048c04f9dbe65eedb79d893@192.168.11.212:30303?discport=0",
   "enode://e871ff3b1f58b9a87122e552b2404e1893bf92ae74d4fa6bc2bd002d0350c506ea452f4aefa1a3497ef32694c4beb48bf8a006d2b82f57649c90b22f59044aad@192.168.11.217:30303?discport=0",

config/besu-node-lists/static-nodes.json

@@ -11,10 +11,10 @@
   "enode://225d902bf840379ce122f8cc431a542ddee0bde3e949b48767285bbc9c774cc3fc22cd4913ee72f0a19dce266e3ecb66dba5c58092d0b0e5ceb4e13bf96a1a68@192.168.11.154:30303",
   "enode://afa44c03ac3dd97efcbbef8edea11d1edf23bd595f30d4cf0c4be364d0b194e4217926a37141b54dcff71107f9ee257f621553cd867a2c9fa5a5537b3ae59746@192.168.11.213:30303",
   "enode://5f048208071f2a3036128433e1e4a647a7683abd8bc0f27d063e2933ced983accdfc44998666f3be711e4eff27511142d9989775b86cdbe28c79b74409fc36bb@192.168.11.214:30303",
-  "enode://8da1b586e2e98f521f07148d3bb5d81fde151ce3d5738b51bc36e2c81de1aaa5404ce31e991b4393bbe471934f0a9a31f78d1d7c17c1899c3e2dde5e9f16eb24@192.168.11.244:30303",
-  "enode://acd46d31913b8379f075467cd88d2ea650d33474d2f9546426da4a414fe92233584c9d8c2e1ea9962fa4257c20b66c9434d0488e51c632f285205d6a379cfbd6@192.168.11.245:30303",
   "enode://8a3337adcc2d177caf3aee26b3b6077d9adf126c580e12f352743ca07828f056ceb1d5fb1a06287e2dbbe19043fcc4b9bdd2ca9ae2a2c9142cf0cc3a549bfc68@192.168.11.219:30303",
   "enode://09fe518689c54a34c3dac8aebf3c94bfc390f4bae143a80c57d92a502414df0689d12a2243ff9376c2f44a419894d934b4f47783ced31ea9668522078854e58f@192.168.11.220:30303",
+  "enode://8da1b586e2e98f521f07148d3bb5d81fde151ce3d5738b51bc36e2c81de1aaa5404ce31e991b4393bbe471934f0a9a31f78d1d7c17c1899c3e2dde5e9f16eb24@192.168.11.244:30303",
+  "enode://acd46d31913b8379f075467cd88d2ea650d33474d2f9546426da4a414fe92233584c9d8c2e1ea9962fa4257c20b66c9434d0488e51c632f285205d6a379cfbd6@192.168.11.245:30303",
   "enode://6cdc892fa09afa2b05c21cc9a1193a86cf0d195ce81b02a270d8bb987f78ca98ad90d907670796c90fc6e4eaf3b4cae6c0c15871e2564de063beceb4bbfc6532@192.168.11.211:30303",
   "enode://e53713bb77ad9f39e8a04b9c82aadddd3449220167f546bca8e9f36f6ebf60ae003e48ac293790e2bd7b0aca382777db9eca61d6f048c04f9dbe65eedb79d893@192.168.11.212:30303?discport=0",
   "enode://e871ff3b1f58b9a87122e552b2404e1893bf92ae74d4fa6bc2bd002d0350c506ea452f4aefa1a3497ef32694c4beb48bf8a006d2b82f57649c90b22f59044aad@192.168.11.217:30303?discport=0",

config/bridge-routes-chain138-default.json

@@ -0,0 +1,25 @@
+{
+  "routes": {
+    "weth9": {
+      "Ethereum Mainnet (1)": "0xF9A32F37099c582D28b4dE7Fca6eaC1e5259f939",
+      "BNB Chain (56)": "0x886C6A4ABC064dbf74E7caEc460b7eeC31F1b78C",
+      "Avalanche C-Chain (43114)": "0x3f8C409C6072a2B6a4Ff17071927bA70F80c725F"
+    },
+    "weth10": {
+      "Ethereum Mainnet (1)": "0xF9A32F37099c582D28b4dE7Fca6eaC1e5259f939",
+      "BNB Chain (56)": "0x886C6A4ABC064dbf74E7caEc460b7eeC31F1b78C",
+      "Avalanche C-Chain (43114)": "0x3f8C409C6072a2B6a4Ff17071927bA70F80c725F"
+    }
+  },
+  "chain138Bridges": {
+    "weth9": "0xcacfd227A040002e49e2e01626363071324f820a",
+    "weth10": "0xe0E93247376aa097dB308B92e6Ba36bA015535D0",
+    "trustless": "0xFce6f50B312B3D936Ea9693C5C9531CF92a3324c"
+  },
+  "tokenMappingApi": {
+    "basePath": "/api/v1/token-mapping",
+    "pairs": "/api/v1/token-mapping/pairs",
+    "resolve": "/api/v1/token-mapping/resolve",
+    "note": "Resolve bridged token addresses between chains; requires monorepo config/token-mapping-multichain.json on server."
+  }
+}

config/btc-settlement-pathways.json

@@ -0,0 +1,133 @@
+{
+  "schemaVersion": 1,
+  "updated": "2026-04-03",
+  "description": "End-to-end pathways from Chain 138 to native BTC via Changelly (partner API) or Atomic Wallet (user-operated swap). Used by orchestration design; does not imply keys or contracts are configured.",
+  "homeChainId": 138,
+  "destinationAsset": {
+    "symbol": "BTC",
+    "network": "bitcoin-mainnet",
+    "addressFormat": "bech32-p2wpkh-or-legacy"
+  },
+  "references": {
+    "mainnetLiquidityPlan": "docs/00-meta/MAINNET_LIQUIDITY_AND_RAMPS_PRIORITY.md",
+    "rampUserFlows": "docs/04-configuration/MAINNET_RAMP_USER_FLOWS.md",
+    "deployedBridgesStatus": "docs/11-references/DEPLOYED_TOKENS_BRIDGES_LPS_AND_ROUTING_STATUS.md",
+    "changellyDocs": "https://docs.changelly.com/",
+    "changellySupportEmail": "pro@changelly.com",
+    "atomicWalletSwapKb": "https://support.atomicwallet.io/article/73-how-to-make-an-exchange"
+  },
+  "changelly": {
+    "product": "Changelly Exchange API v2",
+    "integrationSurface": "backend_jsonrpc",
+    "apiBaseUrl": "https://api.changelly.com/v2",
+    "authentication": {
+      "headers": ["X-Api-Key", "X-Api-Signature"],
+      "signatureAlgorithm": "RSA-SHA256 over raw JSON-RPC body",
+      "note": "Generate RSA keypair; register public key with Changelly; never expose private key to browsers."
+    },
+    "documentedRpcFlow": [
+      "getCurrencies",
+      "getPairsParams",
+      "getMinAmount",
+      "validateAddress",
+      "getExchangeAmount",
+      "createTransaction",
+      "getTransactions (poll status)"
+    ],
+    "envVars": [
+      "CHANGELLY_API_PUBLIC_KEY",
+      "CHANGELLY_API_PRIVATE_KEY_PEM_PATH"
+    ]
+  },
+  "atomicWallet": {
+    "product": "Atomic Wallet (desktop/mobile)",
+    "integrationSurface": "user_operated",
+    "note": "Swaps route through in-wallet partners to deposit addresses; there is no documented first-party B2B swap API equivalent to Changelly v2 for arbitrary server-side settlement. Use for operator or end-user manual path after funds sit on a chain Atomic supports.",
+    "supportedChainsForSwap": "See in-app asset list; typically includes BTC and major EVM assets when counterpart is available."
+  },
+  "pathways": [
+    {
+      "id": "138-evm-changelly-btc-treasury",
+      "label": "Automated-friendly: 138 → Ethereum mainnet stables/ETH → Changelly → BTC payout address",
+      "venue": "changelly",
+      "automationTier": "high",
+      "summary": "Bridge and swap on-chain until Ethereum holds USDT, USDC, ETH, or WETH that Changelly lists; backend calls createTransaction with payout btc address; treasury sends the exact deposit amount to Changelly’s deposit address.",
+      "preconditions": [
+        "Ethereum mainnet liquidity for chosen bridge (LiquidityPoolETH / CCIP WETH path per MAINNET_LIQUIDITY_AND_RAMPS_PRIORITY.md)",
+        "Changelly partner API key registered (pro@changelly.com)",
+        "Treasury hot wallet on Ethereum with gas ETH and sendable USDT/USDC/ETH per quote",
+        "Confirm Changelly ticker names for from-currency (e.g. eth, usdt20, usdc) match your token contract version"
+      ],
+      "steps": [
+        {
+          "order": 1,
+          "chainId": 138,
+          "action": "swap_to_bridge_asset",
+          "detail": "Use DODOPMMIntegration / EnhancedSwapRouter on 138 to convert source (e.g. cUSDT, cUSDC) into the token your bridge expects (often WETH for CCIP WETH bridges, or corridor-specific asset)."
+        },
+        {
+          "order": 2,
+          "chainId": 138,
+          "action": "bridge_to_ethereum",
+          "detail": "Execute CCIP or trustless bridge to Ethereum mainnet per deployed bridge matrix (DEPLOYED_TOKENS_BRIDGES_LPS_AND_ROUTING_STATUS.md)."
+        },
+        {
+          "order": 3,
+          "chainId": 1,
+          "action": "optional_swap_on_mainnet",
+          "detail": "If payout asset is wrong shape (e.g. WETH only, need USDT), swap on mainnet via DEX/aggregator to Changelly-accepted from-currency."
+        },
+        {
+          "order": 4,
+          "chainId": 0,
+          "action": "changelly_quote_and_create",
+          "detail": "JSON-RPC: getMinAmount, getExchangeAmount, validateAddress(BTC), createTransaction with amount, from, to btc, address = user btc address. Store payin address + id."
+        },
+        {
+          "order": 5,
+          "chainId": 1,
+          "action": "send_payin",
+          "detail": "Broadcast Ethereum tx from treasury to Changelly deposit address for exact amount; single output per Changelly rules for UTXO targets."
+        },
+        {
+          "order": 6,
+          "chainId": 0,
+          "action": "poll_until_btc_sent",
+          "detail": "Poll getTransactions / status until outbound BTC confirmed; record btc txid for reconciliation."
+        }
+      ]
+    },
+    {
+      "id": "138-evm-atomic-user-btc",
+      "label": "User-operated: 138 → Ethereum → Atomic Wallet swap → BTC",
+      "venue": "atomic_wallet",
+      "automationTier": "low",
+      "summary": "After funds arrive on an Ethereum address the user controls in Atomic Wallet, user runs in-app Exchange to BTC; no server-side Atomic swap API in repo.",
+      "preconditions": [
+        "Bridge completes to user-controlled Ethereum address (same EOA in MetaMask and Atomic, or user sends to Atomic-seeded wallet)",
+        "User installs Atomic Wallet and holds seed phrase",
+        "Asset appears in Atomic’s supported list for swap into BTC"
+      ],
+      "steps": [
+        {
+          "order": 1,
+          "chainId": 138,
+          "action": "swap_and_bridge_to_user_eoa_mainnet",
+          "detail": "Same as Changelly path steps 1–2 but recipient is user’s Ethereum mainnet address."
+        },
+        {
+          "order": 2,
+          "chainId": 1,
+          "action": "user_opens_atomic_exchange",
+          "detail": "In Atomic: Exchange → select from asset (ETH/USDT/USDC etc.) → to BTC → enter amount and destination BTC address (often same app wallet’s BTC account)."
+        },
+        {
+          "order": 3,
+          "chainId": 0,
+          "action": "user_completes_partner_flow",
+          "detail": "Follow Atomic prompts (rates non-fixed, ~20 min typical per vendor KB); user bears slippage and network fees."
+        }
+      ]
+    }
+  ]
+}

config/compliance-matrix/README.md

@@ -0,0 +1,14 @@
+# Global compliance matrix index
+
+**Canonical index:** [`global-compliance-matrix-index.json`](global-compliance-matrix-index.json)
+
+This folder holds a **top-level registry** of compliance packages by jurisdiction or region. Each entry points to a **drill-down manifest** under [`jurisdictions/`](jurisdictions/) that lists:
+
+- Transaction-grade JSON matrices (Indonesia / JVMTM)
+- Audit closure matrices (markdown)
+- Institutional submission binders (Indonesia 4.995 package)
+- Regional rulebook mappings (e.g. SEPA under `gru-docs/`)
+
+**Indonesia drill-down:** [`jurisdictions/ID.json`](jurisdictions/ID.json) → `config/jvmtm-regulatory-closure/transaction-compliance-matrix.json` plus submission docs in `docs/04-configuration/mifos-omnl-central-bank/`.
+
+**Validation:** `python3 scripts/validation/validate-global-compliance-matrix-index.py` (also invoked from `scripts/validation/validate-jvmtm-regulatory-closure-schemas.sh`).

config/compliance-matrix/global-compliance-matrix-index.json

@@ -0,0 +1,30 @@
+{
+  "schema_version": 1,
+  "matrix_version": "2026-04-03",
+  "title": "Global compliance matrix index",
+  "description": "Top-level registry of jurisdiction and regional compliance packages. Each row links to a manifest JSON for drill-down (controls, audit closure, submission binders, or regional rulebook mappings).",
+  "canonical_format": "json",
+  "cross_cutting": {
+    "dbis_institutional": "config/dbis-institutional/README.md",
+    "settlement_stack_runbook": "docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md",
+    "iso_gateway_spec": "docs/dbis-rail/ISO_GATEWAY_AND_RELAYER_SPEC.md"
+  },
+  "jurisdictions": [
+    {
+      "jurisdiction_id": "ID",
+      "display_name": "Indonesia",
+      "iso_3166_alpha2": "ID",
+      "status": "active",
+      "summary": "JVMTM audit closure (INAAUDJVMTM 2025), transaction-grade operator pack, OJK/BI identifier policy, BI/MoF institutional submission binder (4.995).",
+      "jurisdiction_manifest": "config/compliance-matrix/jurisdictions/ID.json"
+    },
+    {
+      "jurisdiction_id": "EU-SEPA",
+      "display_name": "European Union (SEPA — GRU docs)",
+      "iso_3166_alpha2": null,
+      "status": "active",
+      "summary": "SEPA Credit Transfer rulebook mapping in gru-docs; separate from Indonesia JVMTM JSON controls.",
+      "jurisdiction_manifest": "config/compliance-matrix/jurisdictions/EU-SEPA.json"
+    }
+  ]
+}

config/compliance-matrix/jurisdictions/EU-SEPA.json

@@ -0,0 +1,25 @@
+{
+  "schema_version": 1,
+  "jurisdiction_id": "EU-SEPA",
+  "iso_3166_alpha2": null,
+  "display_name": "European Union (SEPA — GRU documentation)",
+  "summary": "GRU site compliance set for SEPA Credit Transfer / SCT Inst rulebook mapping (markdown); use alongside global settlement runbooks when EUR rails apply.",
+  "audit_engagements": [],
+  "regulators": [
+    {"short": "EPC", "full_name": "European Payments Council"}
+  ],
+  "compliance_packages": [
+    {
+      "package_id": "gru-sepa-compliance-matrix",
+      "kind": "regional_markdown",
+      "title": "SEPA Compliance Matrix for GRU System",
+      "description": "Maps GRU implementation to EPC SEPA rulebook elements (ISO 20022); maintained under gru-docs.",
+      "human_readable_md": [
+        "gru-docs/_compliance/sepa/SEPA_Compliance_Matrix.md"
+      ],
+      "index_md": [
+        "gru-docs/compliance.md"
+      ]
+    }
+  ]
+}

config/compliance-matrix/jurisdictions/ID.json

@@ -0,0 +1,51 @@
+{
+  "schema_version": 1,
+  "jurisdiction_id": "ID",
+  "iso_3166_alpha2": "ID",
+  "display_name": "Indonesia",
+  "summary": "Transaction-grade controls derived from JVMTM Tables B/C/D closure; supervisory submission artifacts for HYBX-BATCH-001 (Bank Kanaya / BI–MoF package).",
+  "audit_engagements": [
+    {
+      "id": "018215821582",
+      "label": "INAAUDJVMTM/2025",
+      "closure_matrix": "config/jvmtm-regulatory-closure/INAAUDJVMTM_2025_AUDIT_CLOSURE_MATRIX.md"
+    }
+  ],
+  "regulators": [
+    {"short": "BI", "full_name": "Bank Indonesia"},
+    {"short": "OJK", "full_name": "Otoritas Jasa Keuangan"},
+    {"short": "MoF", "full_name": "Ministry of Finance of the Republic of Indonesia"},
+    {"short": "PPATK", "full_name": "Indonesian Financial Transaction Reports and Analysis Centre (PPATK)"}
+  ],
+  "compliance_packages": [
+    {
+      "package_id": "jvmtm-transaction-grade",
+      "kind": "transaction_controls_json",
+      "title": "JVMTM transaction-grade compliance matrix",
+      "description": "Canonical controls and runtime slots for pre-transaction through high-value mode; maps to audit rows and repo evidence.",
+      "canonical_matrix_json": "config/jvmtm-regulatory-closure/transaction-compliance-matrix.json",
+      "spreadsheet_csv": "config/jvmtm-regulatory-closure/transaction-compliance-matrix.csv",
+      "human_readable_md": [
+        "config/jvmtm-regulatory-closure/JVMTM_TRANSACTION_GRADE_COMPLIANCE_MATRIX.md",
+        "config/jvmtm-regulatory-closure/README.md"
+      ],
+      "policy_md": [
+        "docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md"
+      ]
+    },
+    {
+      "package_id": "submission-binder-hybx-batch-001",
+      "kind": "institutional_submission",
+      "title": "Indonesia central bank / MoF submission package (4.995 target)",
+      "description": "Master proof manifest, binder layout, scorecard, and regulatory annex for institutional transmission.",
+      "entry_point_md": [
+        "docs/04-configuration/mifos-omnl-central-bank/INDONESIA_MASTER_PROOF_MANIFEST.md",
+        "docs/04-configuration/mifos-omnl-central-bank/INDONESIA_CENTRAL_BANK_SUBMISSION_BINDER.md",
+        "docs/04-configuration/mifos-omnl-central-bank/INDONESIA_SUBMISSION_PACKAGE_GRADE_AND_SCORECARD.md",
+        "docs/04-configuration/mifos-omnl-central-bank/INDONESIA_PACKAGE_4_995_EVIDENCE_STANDARD.md",
+        "docs/04-configuration/mifos-omnl-central-bank/INDONESIA_REGULATORY_REFERENCES_ANNEX.md",
+        "docs/04-configuration/mifos-omnl-central-bank/HYBX_BATCH_001_OPERATOR_CHECKLIST.md"
+      ]
+    }
+  ]
+}

config/compose/sankofa-consolidated-runtime.example.yml

@@ -0,0 +1,15 @@
+# Example: API hub container only. Point upstream blocks in
+# config/nginx/sankofa-phoenix-api-hub.example.conf to real Phoenix (e.g. :4000) and
+# dbis_core (:3000) — on the same host use 127.0.0.1 after colocation, or LAN IPs
+# (e.g. 192.168.11.50, 192.168.11.155) during migration.
+#
+# docker compose -f sankofa-consolidated-runtime.example.yml up -d
+
+services:
+  api-hub:
+    image: nginx:1.27-alpine
+    ports:
+      - "8080:8080"
+    volumes:
+      - ../nginx/sankofa-phoenix-api-hub.example.conf:/etc/nginx/conf.d/default.conf:ro
+    restart: unless-stopped

config/contracts-loader.cjs

@@ -4,7 +4,7 @@
  *
  * Usage:
  *   const { getContractAddress, getChainContracts, loadContractsIntoProcessEnv } = require('../config/contracts-loader.cjs');
- *   getContractAddress(138, 'CCIP_Router')  // => '0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e'
+ *   getContractAddress(138, 'CCIP_Router')  // => '0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817'
  *   getContractAddress(138, 'CCIPWETH9_Bridge')  // by contract key
  *   loadContractsIntoProcessEnv()  // set process.env.CCIP_ROUTER etc. from envVarMap when unset
  *

config/dbis-data-api/README.md

@@ -0,0 +1,38 @@
+# DBIS Data API — implementation notes
+
+OpenAPI contract: [openapi.yaml](./openapi.yaml).
+
+## Lineage
+
+| Value | Meaning |
+|-------|---------|
+| `on_chain` | Derived from Chain 138 indexer, RPC, or token-aggregation inputs |
+| `policy` | Published by policy officers; not implied as ledger truth |
+| `modelled` | Simulation or internal model |
+
+## Suggested PostgreSQL / Timescale layout
+
+**Relational (PostgreSQL)**
+
+- `api_clients` — id, name, key_hash, rate_limit_tier, created_at  
+- `datasets` — id, slug, title, description, lineage_default  
+- `dataset_versions` — dataset_id, version, published_at, document_url  
+
+**Hypertables (TimescaleDB)**
+
+- `metric_gru_supply` — time TIMESTAMPTZ, value NUMERIC, metadata JSONB  
+- `metric_settlement_volume` — time, window, chain_id, value, tx_count  
+- `metric_reserve_snapshot` — time, asset, amount, source  
+
+Ingest jobs read from existing token-aggregation and explorer-compatible sources; separate ETL for policy-published series.
+
+## Frontend (DBIS portal)
+
+Set `NEXT_PUBLIC_DATA_API_BASE` in the Gov Web Portals DBIS app (see `DBIS/.env.example`) so the homepage and `/dashboard` monetary panels call this API. When the service is down, the UI shows placeholders and an “unreachable” status.
+
+## Deployment path
+
+1. Provision CT/VM or service user on LAN.  
+2. NPMplus proxy host `data.d-bis.org` → upstream.  
+3. Enable API keys (optional) for high-volume consumers; public tier remains read-only GET.  
+4. Add host to [E2E_ENDPOINTS_LIST.md](../../docs/04-configuration/E2E_ENDPOINTS_LIST.md) when live.

config/dbis-data-api/openapi.yaml

@@ -0,0 +1,133 @@
+openapi: 3.1.0
+info:
+  title: DBIS Data API
+  version: 0.1.0
+  description: |
+    Public read API for data.d-bis.org — monetary aggregates, GRU series, settlement summaries, rates.
+    Every response MUST declare lineage via `x-dbis-lineage` on operations: `on_chain`, `policy`, `modelled`.
+servers:
+  - url: https://data.d-bis.org
+    description: Production
+  - url: http://localhost:8080
+    description: Local
+tags:
+  - name: gru
+  - name: reserves
+  - name: settlement
+  - name: rates
+paths:
+  /v1/health:
+    get:
+      summary: Liveness
+      operationId: health
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  status: { type: string, example: ok }
+  /v1/gru/supply:
+    get:
+      tags: [gru]
+      summary: GRU supply time series (when defined)
+      operationId: gruSupply
+      x-dbis-lineage: policy
+      parameters:
+        - name: from
+          in: query
+          schema: { type: string, format: date }
+        - name: to
+          in: query
+          schema: { type: string, format: date }
+      responses:
+        "200":
+          description: Series points
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/TimeSeriesResponse"
+        "501":
+          description: Not yet published
+  /v1/reserves/summary:
+    get:
+      tags: [reserves]
+      summary: Reserve holdings summary
+      operationId: reservesSummary
+      x-dbis-lineage: on_chain
+      responses:
+        "200":
+          description: Summary
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ReservesSummary"
+  /v1/settlement/volumes:
+    get:
+      tags: [settlement]
+      summary: Settlement volume aggregates
+      operationId: settlementVolumes
+      x-dbis-lineage: on_chain
+      parameters:
+        - name: window
+          in: query
+          schema: { type: string, enum: [1h, 24h, 7d, 30d] }
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/SettlementVolumes"
+  /v1/rates/reference:
+    get:
+      tags: [rates]
+      summary: Reference rates (policy or observed)
+      operationId: referenceRates
+      x-dbis-lineage: policy
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: true
+components:
+  schemas:
+    LineageMeta:
+      type: object
+      required: [lineage, asOf]
+      properties:
+        lineage:
+          type: string
+          enum: [on_chain, policy, modelled]
+        asOf: { type: string, format: date-time }
+        source: { type: string }
+    TimeSeriesResponse:
+      allOf:
+        - $ref: "#/components/schemas/LineageMeta"
+        - type: object
+          properties:
+            unit: { type: string }
+            points:
+              type: array
+              items:
+                type: object
+                required: [t, v]
+                properties:
+                  t: { type: string, format: date-time }
+                  v: { type: number }
+    ReservesSummary:
+      allOf:
+        - $ref: "#/components/schemas/LineageMeta"
+        - type: object
+          additionalProperties: true
+    SettlementVolumes:
+      allOf:
+        - $ref: "#/components/schemas/LineageMeta"
+        - type: object
+          properties:
+            window: { type: string }
+            totalValue: { type: string, description: Decimal string }
+            txCount: { type: integer }

config/dbis-ecosystem-master-plan-tracker.json

@@ -1,166 +0,0 @@
-{
-  "schemaVersion": "1.0.0",
-  "updated": "2026-04-24",
-  "canonicalRootDoc": "docs/02-architecture/DBIS_ECOSYSTEM_TECHNICAL_MASTER_PLAN.md",
-  "workstreams": [
-    {
-      "id": "W1",
-      "title": "Besu / Chain 138 infrastructure and RPC topology",
-      "status": "live",
-      "horizon": "near_term",
-      "ownerClass": "mixed",
-      "dependsOn": [],
-      "sourceDocs": [
-        "docs/06-besu/BESU_NODE_CONFIGURATION_MAP_20260424.md",
-        "dbis_chain_138_technical_master_plan.md",
-        "docs/03-deployment/PROXMOX_VE_OPERATIONAL_DEPLOYMENT_TEMPLATE.md"
-      ],
-      "acceptanceGate": "Canonical Besu inventory reconciled across all active cluster hosts, block production healthy, and no unexplained canonical node gaps remain.",
-      "evidenceArtifact": "scripts/verify/check-cluster-besu-inventory.sh --json"
-    },
-    {
-      "id": "W2",
-      "title": "Liquidity, PMM, bridge, and public routing coverage",
-      "status": "partially live",
-      "horizon": "near_term",
-      "ownerClass": "mixed",
-      "dependsOn": [
-        "W1"
-      ],
-      "sourceDocs": [
-        "docs/11-references/DEPLOYER_TO_PUBLIC_STABLECOIN_ROUTES.md",
-        "docs/11-references/DEPLOYED_TOKENS_BRIDGES_LPS_AND_ROUTING_STATUS.md",
-        "reports/status/LIVE_ECOSYSTEM_FINANCIAL_INVENTORY_AND_ROUTING_GAPS_20260424.md"
-      ],
-      "acceptanceGate": "Machine-readable route coverage is current and can distinguish live, partial, and blocked routing paths for stablecoins and top assets.",
-      "evidenceArtifact": "config/public-routing-coverage-matrix.json"
-    },
-    {
-      "id": "W3",
-      "title": "Phoenix deploy/control-plane integration",
-      "status": "partially live",
-      "horizon": "near_term",
-      "ownerClass": "mixed",
-      "dependsOn": [
-        "W1",
-        "W2",
-        "W4"
-      ],
-      "sourceDocs": [
-        "docs/04-configuration/PHOENIX_SANKOFA_OPERATOR_HANDOFF.md",
-        "docs/02-architecture/DBIS_ECOSYSTEM_TECHNICAL_MASTER_PLAN.md"
-      ],
-      "acceptanceGate": "Phoenix deploy/control APIs expose current canonical manifests and validated deploy targets without drifting from repo truth.",
-      "evidenceArtifact": "scripts/validation/validate-config-files.sh"
-    },
-    {
-      "id": "W4",
-      "title": "URA manifest, policy profiles, registry, and route confidence",
-      "status": "repo-implemented",
-      "horizon": "near_term",
-      "ownerClass": "repo",
-      "dependsOn": [
-        "W2",
-        "W3"
-      ],
-      "sourceDocs": [
-        "docs/04-configuration/universal-resource-activation/URA_MANIFEST_AUTOMATION_IMPLEMENTATION_TRACKER.md",
-        "docs/04-configuration/universal-resource-activation/README.md",
-        "config/universal-resource-activation/manifest.json"
-      ],
-      "acceptanceGate": "URA manifest and policy profiles validate, registry references are coherent, and route-confidence can be produced as a first-class control-plane artifact.",
-      "evidenceArtifact": "scripts/validate/validate-universal-resource-activation.mjs"
-    },
-    {
-      "id": "W5",
-      "title": "DBIS RTGS / DBIS Rail / OMNL / settlement sidecars",
-      "status": "partially live",
-      "horizon": "near_term",
-      "ownerClass": "mixed",
-      "dependsOn": [
-        "W4",
-        "W6"
-      ],
-      "sourceDocs": [
-        "docs/03-deployment/DBIS_RTGS_MASTER_PLAN_IMPLEMENTATION_TRACKER.md",
-        "docs/dbis-rail/DBIS_RAIL_SETTLEMENT_EVENT_SOURCES.md",
-        "docs/03-deployment/DBIS_RTGS_FIRST_SLICE_ARCHITECTURE.md"
-      ],
-      "acceptanceGate": "First-slice settlement boundaries, event sources, custody roles, and sidecar responsibilities are explicit enough for production gating.",
-      "evidenceArtifact": "docs/03-deployment/DBIS_RTGS_MASTER_PLAN_IMPLEMENTATION_TRACKER.md"
-    },
-    {
-      "id": "W6",
-      "title": "Jurisdiction/compliance and onboarding matrices",
-      "status": "repo-implemented",
-      "horizon": "near_term",
-      "ownerClass": "repo",
-      "dependsOn": [
-        "W4"
-      ],
-      "sourceDocs": [
-        "docs/04-configuration/compliance-matrices/README.md",
-        "docs/04-configuration/jurisdictions/JURISDICTION_CATALOG.md",
-        "docs/dbis-rail/DBIS_RAIL_JURISDICTION_TRACEABILITY.md"
-      ],
-      "acceptanceGate": "Jurisdiction and onboarding matrices are machine-readable enough to gate policy profiles and institutional activation paths.",
-      "evidenceArtifact": "config/jurisdictions/catalog.v1.json"
-    },
-    {
-      "id": "W7",
-      "title": "Identity / Hyperledger / interoperability stack",
-      "status": "planned",
-      "horizon": "long_term",
-      "ownerClass": "external",
-      "dependsOn": [
-        "W5",
-        "W6"
-      ],
-      "sourceDocs": [
-        "docs/03-deployment/DBIS_HYPERLEDGER_RUNTIME_STATUS.md",
-        "docs/03-deployment/DBIS_HYPERLEDGER_IDENTITY_STACK_DECISION.md"
-      ],
-      "acceptanceGate": "Identity and interoperability slices have explicit runtime ownership, promotion gates, and environment-specific deployment decisions.",
-      "evidenceArtifact": "docs/03-deployment/DBIS_HYPERLEDGER_RUNTIME_STATUS.md"
-    },
-    {
-      "id": "W8",
-      "title": "Observability, verification, evidence, and operator readiness",
-      "status": "live",
-      "horizon": "near_term",
-      "ownerClass": "mixed",
-      "dependsOn": [
-        "W1",
-        "W2",
-        "W3",
-        "W4",
-        "W5",
-        "W6"
-      ],
-      "sourceDocs": [
-        "docs/00-meta/OPERATOR_HANDOFF_2026_04_24.md",
-        "docs/00-meta/OPERATOR_READY_CHECKLIST.md",
-        "docs/04-configuration/universal-resource-activation/URA_OPERATIONAL_READINESS_CHECKLIST.md"
-      ],
-      "acceptanceGate": "Validation, health, and operator readiness outputs are current enough to act as production gates rather than ad hoc references.",
-      "evidenceArtifact": "scripts/verify/run-all-validation.sh"
-    }
-  ],
-  "blockedBy": [
-    {
-      "id": "B1",
-      "class": "external",
-      "description": "Some institutional integrations, custody counterparties, and settlement-sidecar dependencies cannot be closed from repo-only work."
-    },
-    {
-      "id": "B2",
-      "class": "external",
-      "description": "Some public-network expansion lanes remain constrained by third-party bridge, exchange, or destination-liquidity realities."
-    },
-    {
-      "id": "B3",
-      "class": "operator",
-      "description": "Operator promotion of URA, sidecar, and policy-aware runtime slices still trails repo implementation in several areas."
-    }
-  ]
-}

config/dbis-institutional/README.md

@@ -0,0 +1,115 @@
+# DBIS institutional config (schemas + examples)
+
+Machine-readable artifacts for **OMNL + DBIS Core + Chain 138 + RTGS** integration and **identifier** alignment (LEI, IBAN, ISIN, ENS, WEB3-ETH-IBAN, explorer labels).
+
+## Canonical narrative doc
+
+[OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md](../../docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md)
+
+## WEB3-ETH-IBAN (`web3_eth_iban`) vs bank IBAN
+
+In this registry, **`aliases[].aliasType` = `web3_eth_iban`** is an **Ethereum presentation alias**: an **XE…** string in the same family as [ICAP / IBAN-style encoding](https://github.com/ethereum/wiki/wiki/ICAP:-Inter-exchange-Client-Address-Protocol) used by [Web3.js `Iban`](https://docs.web3js.org/libdocs/Iban). It is **not** a SWIFT bank IBAN. **`fiat_rails[].railType` = `iban`** is for **regulated fiat** account identifiers.
+
+- **Validate checksum and resolve to `address`:** from repo root, `node scripts/verify/validate-address-registry-xe-aliases.mjs [file.json …]` (defaults to institutional examples). Wired into `validate-dbis-institutional-schemas.sh` when `node` and npm package `web3-eth-iban` are installed at the workspace root.
+- **Library:** [`web3-eth-iban`](https://www.npmjs.com/package/web3-eth-iban) (also bundled as `web3.eth.Iban` in web3.js v1).
+
+## Event producers (`event-producers.manifest.json`)
+
+Registered logical emitters for `settlement-event.event_producer` (kept in sync with the `enum` in `schemas/settlement-event.schema.json`). Add a producer: extend both the manifest and the schema enum in one change.
+
+## Schemas (`schemas/`)
+
+| File | Purpose |
+|------|---------|
+| `settlement-event.schema.json` | Cross-system settlement / evidence event (section 6 of runbook). |
+| `address-registry-entry.schema.json` | Vault or wallet row: `0x` address, fiat rails, Web3 aliases, optional ISIN/CUSIP, Blockscout label hints (sections 3, 7, 13). |
+
+## Examples (`examples/`)
+
+| File | Pairs with |
+|------|------------|
+| `settlement-event.example.json` | `settlement-event.schema.json` (hybrid: includes `uetr` + internal refs) |
+| `settlement-event.chain138-primary.example.json` | Same schema; **Chain 138 as authoritative rail** — no `uetr`; `rtgs_message_ids.rail` + internal refs; see [OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md](../../docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md) |
+| `settlement-event.min.json` | **Minimal** valid `CHAIN_SETTLEMENT` fixture (required fields + `chain_tx_hash` / `chain_id`); CI baseline in `validate-dbis-institutional-schemas.sh`. |
+| `settlement-events-batch.example.json` | Each array element validated against `settlement-event.schema.json` (see `validate-dbis-institutional-schemas.sh`) |
+| `address-registry-entry.example.json` | `address-registry-entry.schema.json`; `web3_eth_iban` uses a valid **XE…** string that resolves to `address` (see XE section above) |
+| `address-registry-entries-batch.example.json` | Each array element validated against `address-registry-entry.schema.json` |
+
+Examples use placeholder addresses and ids; replace with live data in a secure store (not committed).
+
+### Settlement `amount` convention (operators + integrators)
+
+Use **major currency units** as a decimal string, with explicit scale for fiat:
+
+- **`amount`:** string matching `^-?[0-9]+(\.[0-9]+)?$` (e.g. USD 25,000,000.00 → `"25000000.00"`).
+- **`amount_scale`:** use **`2`** for USD and other ISO 4217 currencies with two decimal places.
+
+Fineract journal APIs may still use **minor units (cents)**; convert at the boundary and record settlement events in **major units** so logs and regulatory exports stay human-aligned. Do not mix major and minor in the same field without documenting which convention applies.
+
+### Chain 138 as SWIFT replacement vs UETR
+
+When settlement is **authoritative on Chain 138** (chain id **138**), treat **`correlation_id` + `chain_tx_hash` + `occurred_at`** as the primary rail-native E2E evidence for that leg. **`rtgs_message_ids.uetr`** is **optional** unless you also run a **parallel SWIFT gpi** leg (hybrid); then record both UETR and chain fields on the same **`correlation_id`**.
+
+### SWIFT UETR vs internal “message sent” reference
+
+**UETR** belongs in `rtgs_message_ids.uetr` when the payment is on **SWIFT gpi** (or your counterparty/scheme requires it). You **cannot** treat an arbitrary internal message id as a regulatory substitute for UETR on **those** legs.
+
+When no UETR exists yet (internal-only, pre-SWIFT, DLT-only, domestic rail), add extra keys under **`rtgs_message_ids`** (the schema allows any string keys), e.g. `internal_instruction_ref`, `operator_message_ref`, or a digest of the submitted instruction — and keep **`correlation_id`** as the cross-system spine. When UETR is later assigned, **record it** and retain internal refs for audit lineage.
+
+Policy and audit-scope notes: [OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md](../../docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md).
+
+## Related repo config
+
+- OMNL entity master: `docs/04-configuration/mifos-omnl-central-bank/OMNL_ENTITY_MASTER_DATA.json`
+- Institutional subdomains: `docs/04-configuration/DBIS_INSTITUTIONAL_SUBDOMAINS.md`
+- Blockscout address labeling (K8s): `smom-dbis-138/k8s/blockscout/address-labeling-config.yaml`
+
+## Validation
+
+```bash
+# JSON parse (all examples/*.json)
+bash scripts/validation/validate-dbis-institutional-json.sh
+
+# JSON Schema — requires check-jsonschema on PATH (PEP 668 / “externally managed” Python):
+#   python3 -m venv .venv-checkjson && .venv-checkjson/bin/pip install check-jsonschema
+#   PATH="$PWD/.venv-checkjson/bin:$PATH" bash scripts/validation/validate-dbis-institutional-schemas.sh
+# Or: pipx install check-jsonschema
+SCHEMA_STRICT=1 bash scripts/validation/validate-dbis-institutional-schemas.sh
+```
+
+`scripts/validation/validate-dbis-institutional-schemas.sh` validates **checked-in examples** only. For a **live or one-off** settlement event file, validate it directly:
+
+### Validation — ad-hoc settlement event
+
+```bash
+# From repository root; use the same venv as above or any check-jsonschema on PATH.
+PATH="$PWD/.venv-checkjson/bin:$PATH" check-jsonschema \
+  --schemafile config/dbis-institutional/schemas/settlement-event.schema.json \
+  your-event.json
+```
+
+- **Success:** exit code **0**; typical stdout is `ok -- validation done` (wording may vary by version).
+- **Failure:** non-zero exit; `ValidationError` / `SchemaError` in stderr — treat as **not schema-closed**.
+
+Do not use `validate-dbis-institutional-schemas.sh` as a substitute for validating arbitrary payload files.
+
+`validate-config-files.sh` runs schema validation automatically when `check-jsonschema` is on `PATH`. The gitignored venv `.venv-checkjson/` is listed in `.gitignore` for this purpose.
+
+Validated pairs (examples versus schemas): `settlement-event`, `address-registry-entry`, `trust`, `governance`, `policy` (against `policy-manifest.schema.json`).
+
+`settlement-event` optionally carries **ISO-20022** (`iso_msg_type`, `iso_instruction_id`, `iso_payload_hash`, `rail_iso_hash`) and **identity** (`holder_did`, `identity_verification_ref`) for full fiat / FX / chain correlation — see runbook section 14.
+
+`address-registry-entry` supports **`iso_intake`** and **`dbis_settlement_router`** roles plus optional **`primary_holder_did`** and **`identity_anchor_ref`** (section 14.6 checklist).
+
+## Blockscout address labels
+
+Plan or sync labels from registry JSON (`blockscout.label` + `status: active`):
+
+```bash
+bash scripts/verify/sync-blockscout-address-labels-from-registry.sh config/dbis-institutional/examples/address-registry-entry.example.json
+bash scripts/verify/sync-blockscout-address-labels-from-registry.sh --from-dir config/dbis-institutional/registry
+# Preferred for the self-hosted Chain 138 explorer (writes Blockscout Postgres address_names):
+bash scripts/verify/sync-blockscout-address-labels-from-registry.sh --apply --mode=db --from-dir config/dbis-institutional/registry
+```
+
+On `explorer.d-bis.org`, public `/api/v1/*` is served by token-aggregation, not by a Blockscout label-write API, so `--mode=db` is the correct operator path for live labels unless you have separately enabled a dedicated label endpoint. See `registry/README.md` for drop-in files (gitignored by default).

config/dbis-institutional/event-producers.manifest.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": 1,
+  "description": "Registered settlement event emitters. Keep in sync with settlement-event.schema.json event_producer enum.",
+  "producers": [
+    {
+      "id": "hybx-omnl-sidecar",
+      "summary": "HYBX Fineract/OMNL integration sidecar emitting settlement-correlated events."
+    },
+    {
+      "id": "dbis-core",
+      "summary": "DBIS Core banking / nostro-vostro / ISO adapter path."
+    },
+    {
+      "id": "iso-gateway",
+      "summary": "Off-chain ISO gateway building canonical bundles before chain or relayer submission."
+    },
+    {
+      "id": "mintauth-relayer",
+      "summary": "MintAuth EIP-712 quorum and relayer calling SettlementRouter or related contracts."
+    },
+    {
+      "id": "chain-settlement-worker",
+      "summary": "Worker observing chain receipts and emitting settlement events for reconciliation."
+    },
+    {
+      "id": "omnl-fineract-webhook",
+      "summary": "Fineract/OMNL webhook or callback integration."
+    },
+    {
+      "id": "integration-hub-example",
+      "summary": "Documentation / lab example only; not a production system id."
+    },
+    {
+      "id": "manual-operator",
+      "summary": "Human-initiated or ops tooling emission with explicit audit trail."
+    }
+  ]
+}

config/dbis-institutional/examples/address-registry-entries-batch.example.json

@@ -0,0 +1,29 @@
+[
+  {
+    "registryEntryId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
+    "entity_id": "98450070C57395F6B906",
+    "jurisdiction": "ID",
+    "chain_id": 138,
+    "address": "0x0000000000000000000000000000000000000001",
+    "addressRole": "treasury_vault",
+    "status": "active",
+    "blockscout": {
+      "label": "OMNL — Treasury vault (Office 22)",
+      "labelType": "contract"
+    }
+  },
+  {
+    "registryEntryId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
+    "entity_id": "98450070C57395F6B906",
+    "jurisdiction": "ID",
+    "chain_id": 138,
+    "address": "0x0000000000000000000000000000000000000002",
+    "addressRole": "iso_intake",
+    "status": "active",
+    "primary_holder_did": "did:sov:WRfXg6LQCZgRsXoHF",
+    "blockscout": {
+      "label": "ISO intake / gateway (verify live address)",
+      "labelType": "contract"
+    }
+  }
+]

config/dbis-institutional/examples/address-registry-entry.example.json

@@ -0,0 +1,53 @@
+{
+  "registryEntryId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
+  "entity_id": "98450070C57395F6B906",
+  "jurisdiction": "ID",
+  "class_id": "C01",
+  "anchor_id": "C01-A01",
+  "division_id": "C01-A01-D01",
+  "omnl_office_id": 22,
+  "dbis_participant_id": "PART-ID-OMNL-HO-001",
+  "chain_id": 138,
+  "address": "0x00c5496aEe77C1bA1f0854206A26DdA82a81D6D8",
+  "addressRole": "treasury_vault",
+  "fiat_rails": [
+    {
+      "railType": "iban",
+      "railValue": "ID00XXXX0000000000000000",
+      "bic": "EXAMPLEIDJ",
+      "validFrom": "2026-01-01"
+    }
+  ],
+  "aliases": [
+    {
+      "aliasType": "ens",
+      "aliasValue": "treasury-example.eth",
+      "resolver_chain_id": 1,
+      "validFrom": "2026-03-01T00:00:00Z"
+    },
+    {
+      "aliasType": "web3_eth_iban",
+      "aliasValue": "XE7338O073KYGTWWZN0F2WZ0R8PX5ZPPZS",
+      "validFrom": "2026-03-15T00:00:00Z"
+    },
+    {
+      "aliasType": "custom_ens_tld",
+      "aliasValue": "vault.anchor01.d-bis",
+      "validFrom": "2026-03-20T00:00:00Z"
+    }
+  ],
+  "instruments": [
+    {
+      "isin": "US0000000000",
+      "cusip": "000000000"
+    }
+  ],
+  "primary_holder_did": "did:sov:WRfXg6LQCZgRsXoHF",
+  "identity_anchor_ref": "indy-nym-or-acapy-conn-example",
+  "blockscout": {
+    "label": "OMNL — Treasury vault (Office 22)",
+    "labelType": "contract"
+  },
+  "status": "active",
+  "lastCorrelationId": "550e8400-e29b-41d4-a716-446655440001"
+}

config/dbis-institutional/examples/governance.json

@@ -0,0 +1,13 @@
+{
+  "version": "0.1.0",
+  "issuedAt": "2026-03-30T00:00:00Z",
+  "amendmentProcess": "Described in DBIS Charter and Governance Statute (placeholder).",
+  "bodies": [
+    {
+      "id": "council",
+      "name": "Sovereign Council",
+      "role": "Strategic oversight",
+      "documentUrl": "https://d-bis.org/documents/governance-statute"
+    }
+  ]
+}

config/dbis-institutional/examples/policy.json

@@ -0,0 +1,13 @@
+{
+  "version": "0.1.0",
+  "issuedAt": "2026-03-30T00:00:00Z",
+  "policies": [
+    {
+      "id": "gru-overview-v0",
+      "title": "Global Reserve Unit — Overview (draft)",
+      "effectiveDate": "2026-03-30",
+      "documentUrl": "https://d-bis.org/gru/overview",
+      "hashSha256": "0000000000000000000000000000000000000000000000000000000000000000"
+    }
+  ]
+}

config/dbis-institutional/examples/settlement-event.chain138-primary.example.json

@@ -0,0 +1,30 @@
+{
+  "schema_version": 1,
+  "correlation_id": "660e8400-e29b-41d4-a716-446655440002",
+  "event_producer": "chain-settlement-worker",
+  "entity_id": "98450070C57395F6B906",
+  "jurisdiction": "ID",
+  "class_id": "C01",
+  "anchor_id": "C01-A01",
+  "division_id": "C01-A01-D01",
+  "amount": "25000000.00",
+  "amount_scale": 2,
+  "currency": "USD",
+  "event_type": "CHAIN_SETTLEMENT",
+  "omnl_journal_entry_id": 88421,
+  "omnl_office_id": 22,
+  "dbis_reference": "CORE-TX-2026-0331-CHAIN138",
+  "rtgs_message_ids": {
+    "rail": "chain138",
+    "internal_instruction_ref": "OMNL-M1-KANAYA-CKRA-20260331",
+    "operator_message_ref": "sha256:replace-with-digest-of-instruction-or-archive-manifest"
+  },
+  "chain_id": 138,
+  "chain_tx_hash": "0xb90f2da51d9c506f552d276d9aa57f4ae485528f2ee6025f435f188d09d405f4",
+  "ipsas_narrative": "Chain 138 authoritative settlement leg; no SWIFT UETR on this flow",
+  "occurred_at": "2026-03-31T10:00:00Z",
+  "iso_msg_type": "pacs.008",
+  "iso_instruction_id": "pain001-hashed-key-placeholder",
+  "iso_payload_hash": "0xcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "rail_iso_hash": "0xdddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+}

config/dbis-institutional/examples/settlement-event.example.json

@@ -0,0 +1,33 @@
+{
+  "schema_version": 1,
+  "correlation_id": "550e8400-e29b-41d4-a716-446655440001",
+  "event_producer": "integration-hub-example",
+  "entity_id": "98450070C57395F6B906",
+  "jurisdiction": "ID",
+  "class_id": "C01",
+  "anchor_id": "C01-A01",
+  "division_id": "C01-A01-D01",
+  "amount": "1000000.00",
+  "amount_scale": 2,
+  "currency": "USD",
+  "event_type": "CHAIN_SETTLEMENT",
+  "omnl_journal_entry_id": 12045,
+  "omnl_office_id": 22,
+  "dbis_reference": "CORE-TX-2026-0330-88421",
+  "rtgs_message_ids": {
+    "uetr": "97ed4827-7b6f-4491-94b1-d651442ca301",
+    "msgId": "BNI2026033012000001",
+    "internal_instruction_ref": "018215821582-INAAUDJVMTM-2025-MSG-001",
+    "operator_message_ref": "sha256:replace-with-digest-of-submitted-instruction-payload"
+  },
+  "chain_id": 138,
+  "chain_tx_hash": "0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "ipsas_narrative": "IPSAS28/29 settlement leg; PvP net beneficiary credit",
+  "occurred_at": "2026-03-30T12:00:00Z",
+  "iso_msg_type": "pacs.008",
+  "iso_instruction_id": "0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "iso_payload_hash": "0xcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "rail_iso_hash": "0xdddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+  "holder_did": "did:sov:WRfXg6LQCZgRsXoHF",
+  "identity_verification_ref": "acapy-proof-req-2026-0330-001"
+}

config/dbis-institutional/examples/settlement-event.min.json

@@ -0,0 +1,12 @@
+{
+  "schema_version": 1,
+  "entity_id": "OMNL",
+  "jurisdiction": "MT",
+  "correlation_id": "00000000-0000-0000-0000-000000000001",
+  "event_type": "CHAIN_SETTLEMENT",
+  "amount": "1.00",
+  "amount_scale": 2,
+  "currency": "USD",
+  "chain_tx_hash": "0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "chain_id": 138
+}

config/dbis-institutional/examples/settlement-events-batch.example.json

@@ -0,0 +1,33 @@
+[
+  {
+    "schema_version": 1,
+    "correlation_id": "550e8400-e29b-41d4-a716-446655440001",
+    "event_producer": "chain-settlement-worker",
+    "entity_id": "98450070C57395F6B906",
+    "jurisdiction": "ID",
+    "class_id": "C01",
+    "anchor_id": "C01-A01",
+    "division_id": "C01-A01-D01",
+    "amount": "1000000.00",
+    "amount_scale": 2,
+    "currency": "USD",
+    "event_type": "CHAIN_SETTLEMENT",
+    "chain_id": 138,
+    "chain_tx_hash": "0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "occurred_at": "2026-03-30T12:00:00Z"
+  },
+  {
+    "schema_version": 1,
+    "correlation_id": "550e8400-e29b-41d4-a716-446655440002",
+    "event_producer": "omnl-fineract-webhook",
+    "entity_id": "98450070C57395F6B906",
+    "jurisdiction": "ID",
+    "amount": "0",
+    "currency": "USD",
+    "event_type": "OMNL_JOURNAL_POSTED",
+    "omnl_journal_entry_id": 12046,
+    "omnl_office_id": 22,
+    "occurred_at": "2026-03-30T12:05:00Z",
+    "no_chain_leg_reason": "IPSAS-only reclassification; no on-ledger leg"
+  }
+]

config/dbis-institutional/examples/trust.json

@@ -0,0 +1,16 @@
+{
+  "version": "0.1.0",
+  "issuedAt": "2026-03-30T00:00:00Z",
+  "organization": "Digital Bank of International Settlements",
+  "endpoints": {
+    "didRegistry": "https://identity.d-bis.org/registry",
+    "dataApi": "https://data.d-bis.org",
+    "explorer": "https://explorer.d-bis.org",
+    "status": "https://status.d-bis.org",
+    "developers": "https://developers.d-bis.org",
+    "gitea": "https://gitea.d-bis.org"
+  },
+  "jwksUri": "https://identity.d-bis.org/.well-known/jwks.json",
+  "caHints": ["production-trust-anchor.example"],
+  "notes": "Example only — replace URIs and keys before production."
+}

config/dbis-institutional/registry/.gitignore

@@ -0,0 +1,4 @@
+# Operator-specific registry rows; do not commit live LEI/IBAN/addresses.
+*.json
+!.gitignore
+!README.md

config/dbis-institutional/registry/README.md

@@ -0,0 +1,42 @@
+# Address registry drop-in (operator / CI)
+
+Place **non-example** `address-registry-entry` JSON files here (one object per file, or one array in a single file). These files may contain **LEI, IBAN, and live `0x` addresses** — treat as confidential; prefer `.gitignore` or a secrets store in production.
+
+## Sync labels to Blockscout
+
+From repo root (plan only):
+
+```bash
+bash scripts/verify/sync-blockscout-address-labels-from-registry.sh --from-dir config/dbis-institutional/registry
+```
+
+Or a **single JSON array** file (see [`../examples/address-registry-entries-batch.example.json`](../examples/address-registry-entries-batch.example.json)):
+
+```bash
+bash scripts/verify/sync-blockscout-address-labels-from-registry.sh path/to/registry-array.json
+```
+
+Apply (LAN or VPN to explorer; set API key if required):
+
+```bash
+export BLOCKSCOUT_API_KEY=...   # if your Blockscout instance requires it
+bash scripts/verify/sync-blockscout-address-labels-from-registry.sh --apply --from-dir config/dbis-institutional/registry
+```
+
+For the self-hosted Chain 138 explorer, prefer direct DB sync:
+
+```bash
+bash scripts/verify/sync-blockscout-address-labels-from-registry.sh --apply --mode=db --from-dir config/dbis-institutional/registry
+```
+
+That path writes Blockscout primary labels into `public.address_names` through the explorer CT (`5000`) because `explorer.d-bis.org/api/v1/*` is token-aggregation, not a native Blockscout label-write surface. Use HTTP mode only if you have separately enabled and confirmed a compatible label endpoint (default probe target: `/api/v1/labels`).
+
+## Token contract staging
+
+This directory is also the right place for **live token-contract label rows** that should not be committed, for example:
+
+- staged `cUSDT V2` / `cUSDC V2` token contract labels on Chain 138
+- bridge-side `cW*` contracts before public cutover
+- temporary explorer labels used during GRU V1/V2 coexistence
+
+Keep versioned token contracts clearly labeled in `blockscout.label`, for example `Chain 138 cUSDT V2 (staged)`, so explorer operators can distinguish them from the active V1 liquidity contracts.

config/dbis-institutional/registry/chain138-cusdc-v2.json

@@ -1,21 +0,0 @@
-{
-  "registryEntryId": "a5c115dd-e147-4eb5-8cf1-f7d9c38f959e",
-  "entity_id": "98450070C57395F6B906",
-  "jurisdiction": "International",
-  "chain_id": 138,
-  "address": "0x1ac3F4942a71E86A9682D91837E1E71b7BACdF99",
-  "addressRole": "token_contract",
-  "aliases": [
-    {
-      "aliasType": "internal_slug",
-      "aliasValue": "chain138-cusdc-v2",
-      "validFrom": "2026-03-31T08:22:11Z"
-    }
-  ],
-  "blockscout": {
-    "label": "Chain 138 cUSDC V2 (staged)",
-    "labelType": "token"
-  },
-  "status": "active",
-  "lastCorrelationId": "deploy-cusdc-v2-2026-03-31"
-}

config/dbis-institutional/registry/chain138-cusdt-v2.json

@@ -1,21 +0,0 @@
-{
-  "registryEntryId": "3cc7d52c-26fb-4afb-9508-0c102f8f6f81",
-  "entity_id": "98450070C57395F6B906",
-  "jurisdiction": "International",
-  "chain_id": 138,
-  "address": "0x8d342d321DdEe97D0c5011DAF8ca0B59DA617D29",
-  "addressRole": "token_contract",
-  "aliases": [
-    {
-      "aliasType": "internal_slug",
-      "aliasValue": "chain138-cusdt-v2",
-      "validFrom": "2026-03-31T08:22:11Z"
-    }
-  ],
-  "blockscout": {
-    "label": "Chain 138 cUSDT V2 (staged)",
-    "labelType": "token"
-  },
-  "status": "active",
-  "lastCorrelationId": "deploy-cusdt-v2-2026-03-31"
-}

config/dbis-institutional/schemas/address-registry-entry.schema.json

@@ -0,0 +1,140 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://d-bis.org/schemas/address-registry-entry.json",
+  "title": "Chain address + fiat + Web3 alias registry entry",
+  "description": "Source-of-truth row for explorer sync and settlement binding. See docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md sections 3, 7, 13, 14.",
+  "type": "object",
+  "required": [
+    "registryEntryId",
+    "entity_id",
+    "jurisdiction",
+    "chain_id",
+    "address",
+    "addressRole",
+    "status"
+  ],
+  "properties": {
+    "registryEntryId": {
+      "type": "string",
+      "description": "Stable UUID for this registry row."
+    },
+    "entity_id": {
+      "type": "string",
+      "description": "LEI (preferred) or internal party id."
+    },
+    "jurisdiction": { "type": "string" },
+    "class_id": { "type": "string" },
+    "anchor_id": { "type": "string" },
+    "division_id": { "type": "string" },
+    "omnl_office_id": { "type": "integer" },
+    "dbis_participant_id": { "type": "string" },
+    "chain_id": {
+      "type": "integer",
+      "description": "138 for production Chain 138."
+    },
+    "address": {
+      "type": "string",
+      "pattern": "^0x[a-fA-F0-9]{40}$",
+      "description": "Checksummed or lower-case EVM address (vault, EOA, or contract)."
+    },
+    "addressRole": {
+      "type": "string",
+      "enum": [
+        "treasury_vault",
+        "smart_account",
+        "eoa_operational",
+        "contract_registry",
+        "escrow",
+        "token_contract",
+        "iso_intake",
+        "dbis_settlement_router",
+        "other"
+      ]
+    },
+    "fiat_rails": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["railType", "railValue"],
+        "properties": {
+          "railType": {
+            "type": "string",
+            "enum": ["iban", "bban", "bic_account", "rtgs_account", "other"]
+          },
+          "railValue": { "type": "string" },
+          "bic": { "type": "string" },
+          "validFrom": { "type": "string", "format": "date" },
+          "validTo": { "type": "string", "format": "date" }
+        },
+        "additionalProperties": true
+      }
+    },
+    "aliases": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["aliasType", "aliasValue"],
+        "properties": {
+          "aliasType": {
+            "type": "string",
+            "enum": [
+              "ens",
+              "custom_ens_tld",
+              "web3_eth_iban",
+              "did",
+              "internal_slug",
+              "other"
+            ]
+          },
+          "aliasValue": { "type": "string" },
+          "resolver_chain_id": { "type": "integer" },
+          "validFrom": { "type": "string", "format": "date-time" },
+          "validTo": { "type": "string", "format": "date-time" }
+        },
+        "additionalProperties": true
+      }
+    },
+    "instruments": {
+      "type": "array",
+      "description": "ISIN/CUSIP held or represented at this address when applicable.",
+      "items": {
+        "type": "object",
+        "properties": {
+          "isin": { "type": "string" },
+          "cusip": { "type": "string" },
+          "figi": { "type": "string" }
+        },
+        "additionalProperties": true
+      }
+    },
+    "blockscout": {
+      "type": "object",
+      "description": "Hints for label sync (Blockscout /api/v1/labels or UI).",
+      "properties": {
+        "label": { "type": "string" },
+        "labelType": {
+          "type": "string",
+          "enum": ["account", "contract", "token"]
+        }
+      },
+      "additionalProperties": true
+    },
+    "status": {
+      "type": "string",
+      "enum": ["active", "pending", "revoked"]
+    },
+    "lastCorrelationId": {
+      "type": "string",
+      "description": "Last mutation tied to a settlement-event correlation_id."
+    },
+    "primary_holder_did": {
+      "type": "string",
+      "description": "Default operational DID for this address (Indy did:sov, did:web, etc.); link LEI in entity_id."
+    },
+    "identity_anchor_ref": {
+      "type": "string",
+      "description": "Indy NYM, ACA-Py connection, or OIDC subject binding reference for audits."
+    }
+  },
+  "additionalProperties": true
+}

config/dbis-institutional/schemas/governance.schema.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://d-bis.org/schemas/governance.json",
+  "title": "DBIS governance.json",
+  "type": "object",
+  "required": ["version", "issuedAt", "bodies"],
+  "properties": {
+    "version": { "type": "string" },
+    "issuedAt": { "type": "string", "format": "date-time" },
+    "amendmentProcess": { "type": "string" },
+    "bodies": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "name"],
+        "properties": {
+          "id": { "type": "string" },
+          "name": { "type": "string" },
+          "role": { "type": "string" },
+          "documentUrl": { "type": "string", "format": "uri" }
+        },
+        "additionalProperties": true
+      }
+    }
+  },
+  "additionalProperties": false
+}

config/dbis-institutional/schemas/member-directory-entry.schema.json

@@ -0,0 +1,64 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://d-bis.org/schemas/member-directory-entry.json",
+  "title": "DBIS member directory entry",
+  "type": "object",
+  "required": [
+    "memberId",
+    "name",
+    "jurisdiction",
+    "memberStatus",
+    "participationType",
+    "slug"
+  ],
+  "properties": {
+    "memberId": { "type": "string" },
+    "lei": { "type": "string" },
+    "name": { "type": "string" },
+    "shortName": { "type": "string" },
+    "jurisdiction": { "type": "string" },
+    "memberStatus": {
+      "type": "string",
+      "enum": ["active", "candidate", "suspended", "observer"]
+    },
+    "participationType": { "type": "string" },
+    "tier": {
+      "type": "string",
+      "enum": [
+        "full_central_bank",
+        "settlement_member",
+        "observer_member",
+        "infrastructure_member"
+      ]
+    },
+    "settlementRole": { "type": "string" },
+    "currencyParticipation": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "validatorRole": { "type": "string" },
+    "nodeParticipationStatus": { "type": "string" },
+    "roles": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "logoUrl": { "type": "string", "format": "uri" },
+    "slug": {
+      "type": "string",
+      "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"
+    },
+    "summary": { "type": "string" },
+    "hq": {
+      "type": "object",
+      "description": "Headquarters WGS84 coordinates for strategic map",
+      "required": ["lat", "lng"],
+      "properties": {
+        "lat": { "type": "number", "minimum": -90, "maximum": 90 },
+        "lng": { "type": "number", "minimum": -180, "maximum": 180 },
+        "label": { "type": "string" }
+      },
+      "additionalProperties": false
+    }
+  },
+  "additionalProperties": false
+}

config/dbis-institutional/schemas/policy-manifest.schema.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://d-bis.org/schemas/policy-manifest.json",
+  "title": "DBIS policy.json manifest",
+  "type": "object",
+  "required": ["version", "issuedAt", "policies"],
+  "properties": {
+    "version": { "type": "string" },
+    "issuedAt": { "type": "string", "format": "date-time" },
+    "policies": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "title", "hashSha256"],
+        "properties": {
+          "id": { "type": "string" },
+          "title": { "type": "string" },
+          "effectiveDate": { "type": "string", "format": "date" },
+          "documentUrl": { "type": "string", "format": "uri" },
+          "hashSha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
+        },
+        "additionalProperties": false
+      }
+    }
+  },
+  "additionalProperties": false
+}

config/dbis-institutional/schemas/settlement-event.schema.json

@@ -0,0 +1,143 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://d-bis.org/schemas/settlement-event.json",
+  "title": "Canonical settlement event (OMNL / Core / RTGS / Chain 138)",
+  "description": "Minimum payload for cross-system reconciliation. See docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md sections 6 and 14 (ISO-20022 + DID).",
+  "type": "object",
+  "required": [
+    "schema_version",
+    "correlation_id",
+    "entity_id",
+    "jurisdiction",
+    "amount",
+    "currency",
+    "event_type"
+  ],
+  "properties": {
+    "schema_version": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "Bump when breaking field semantics."
+    },
+    "correlation_id": {
+      "type": "string",
+      "minLength": 8,
+      "description": "UUID v4, ULID, or org ULID; immutable for the business event."
+    },
+    "entity_id": {
+      "type": "string",
+      "description": "LEI (preferred) or internal UUID for legal/cooperative entity."
+    },
+    "jurisdiction": {
+      "type": "string",
+      "description": "ISO 3166-1 alpha-2 or ISO 3166-2 style (e.g. US-NY)."
+    },
+    "event_producer": {
+      "type": "string",
+      "description": "Logical emitter for routing and audit. Registered ids and descriptions: `event-producers.manifest.json` in this directory.",
+      "enum": [
+        "hybx-omnl-sidecar",
+        "dbis-core",
+        "iso-gateway",
+        "mintauth-relayer",
+        "chain-settlement-worker",
+        "omnl-fineract-webhook",
+        "integration-hub-example",
+        "manual-operator"
+      ]
+    },
+    "class_id": {
+      "type": "string",
+      "description": "Elemental Imperium class, e.g. C01–C07."
+    },
+    "anchor_id": { "type": "string" },
+    "division_id": { "type": "string" },
+    "amount": {
+      "type": "string",
+      "pattern": "^-?[0-9]+(\\.[0-9]+)?$",
+      "description": "Decimal amount as string; scale implied by currency or separate field."
+    },
+    "amount_scale": {
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 18,
+      "description": "Optional explicit minor units (e.g. 2 for USD)."
+    },
+    "currency": {
+      "type": "string",
+      "description": "ISO 4217 for fiat, or token symbol / 0x contract on-chain."
+    },
+    "event_type": {
+      "type": "string",
+      "enum": [
+        "RTGS_OUT",
+        "RTGS_IN",
+        "OMNL_JOURNAL_POSTED",
+        "CHAIN_SETTLEMENT",
+        "PV_NET",
+        "TREASURY_RELEASE",
+        "INTERNAL_TRANSFER",
+        "NO_CHAIN_LEG"
+      ]
+    },
+    "no_chain_leg_reason": {
+      "type": "string",
+      "description": "When event_type is NO_CHAIN_LEG or internal-only; audit explanation."
+    },
+    "omnl_journal_entry_id": { "type": "integer" },
+    "omnl_office_id": { "type": "integer" },
+    "dbis_reference": {
+      "type": "string",
+      "description": "DBIS Core case or transaction id."
+    },
+    "rtgs_message_ids": {
+      "type": "object",
+      "additionalProperties": { "type": "string" },
+      "description": "Rail and messaging references. When Chain 138 is the authoritative settlement rail (SWIFT replacement for that flow), primary E2E evidence is correlation_id + chain_id + chain_tx_hash; uetr is optional unless a parallel SWIFT gpi leg exists. **uetr**: SWIFT gpi Unique End-to-End Transaction Reference (UUID) when the payment is on or reported to SWIFT gpi — required on those legs if the counterparty or scheme requires it. **msgId**, **endToEndId**: ISO-20022 / bank message ids. When no UETR exists yet (pre-SWIFT, internal-only, DLT-only, or domestic rail), record agreed internal keys, e.g. **internal_instruction_ref**, **operator_message_ref**, or **audit_file_ref**. Internal refs are not a substitute for a real UETR on SWIFT-settled payments; in hybrid flows map uetr + chain evidence + internal refs. See docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md."
+    },
+    "chain_id": {
+      "type": "integer",
+      "description": "EVM chain id; 138 for DeFi Oracle Meta Mainnet."
+    },
+    "chain_tx_hash": {
+      "type": "string",
+      "pattern": "^0x[a-fA-F0-9]{64}$"
+    },
+    "ipsas_narrative": {
+      "type": "string",
+      "maxLength": 500
+    },
+    "occurred_at": {
+      "type": "string",
+      "format": "date-time",
+      "description": "Business timestamp in UTC."
+    },
+    "iso_msg_type": {
+      "type": "string",
+      "description": "e.g. pacs.008, pain.001, MT103 — aligns with SMART_CONTRACTS_ISO20022_FIN_METHODOLOGY canonical struct."
+    },
+    "iso_instruction_id": {
+      "type": "string",
+      "description": "InstrId or hashed instruction key (hex or string per gateway contract)."
+    },
+    "iso_payload_hash": {
+      "type": "string",
+      "pattern": "^0x[a-fA-F0-9]{64}$",
+      "description": "keccak256 of canonical ISO bundle or raw MX/MT fingerprint; ties OMNL/Core to on-chain intake."
+    },
+    "rail_iso_hash": {
+      "type": "string",
+      "pattern": "^0x[a-fA-F0-9]{64}$",
+      "description": "Optional DBIS Rail isoHash from canonical bundle (ISO_GATEWAY_AND_RELAYER_SPEC)."
+    },
+    "holder_did": {
+      "type": "string",
+      "description": "W3C DID of payment initiator or account holder when VC/DID path used (Indy did:sov, did:web, etc.)."
+    },
+    "identity_verification_ref": {
+      "type": "string",
+      "description": "Reference to ACA-Py proof request, OIDC session, or eIDAS connector correlation id."
+    }
+  },
+  "additionalProperties": true
+}

config/dbis-institutional/schemas/trust.schema.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://d-bis.org/schemas/trust.json",
+  "title": "DBIS trust.json",
+  "type": "object",
+  "required": ["version", "issuedAt", "endpoints"],
+  "properties": {
+    "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
+    "issuedAt": { "type": "string", "format": "date-time" },
+    "organization": { "type": "string" },
+    "endpoints": {
+      "type": "object",
+      "additionalProperties": { "type": "string", "format": "uri" },
+      "properties": {
+        "didRegistry": { "type": "string", "format": "uri" },
+        "dataApi": { "type": "string", "format": "uri" },
+        "explorer": { "type": "string", "format": "uri" },
+        "status": { "type": "string", "format": "uri" },
+        "developers": { "type": "string", "format": "uri" },
+        "gitea": { "type": "string", "format": "uri" }
+      }
+    },
+    "jwksUri": { "type": "string", "format": "uri" },
+    "caHints": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "notes": { "type": "string" }
+  },
+  "additionalProperties": false
+}

config/deployer-gas-routes.json

@@ -1,6 +1,17 @@
 {
   "description": "Chain-to-method mapping for deployer gas auto-route: swap/bridge ERC-20 to native gas per chain. Used by scripts/deployment/deployer-gas-auto-route.sh.",
   "deployerAddress": "0x4A666F96fC8764181194447A7dFdb7d471b301C8",
+  "nonEvmNetworks": [
+    {
+      "identifier": "Solana",
+      "vmKind": "SVM",
+      "nativeSymbol": "SOL",
+      "method": "manual",
+      "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
+      "manualInstructions": "Acquire SOL for Solana mainnet-beta gas and fund the assigned Solana deployer / relay signer when the Solana rollout wave is opened. This entry is planning-only; deployer-gas-auto-route.sh currently processes only the EIP-155 .chains array.",
+      "note": "Desired non-EVM deployment network for future GRU / cW-style mirrored assets via a bridge-wrapped or SPL-native representation."
+    }
+  ],
   "chains": [
     {
       "chainId": 138,
@@ -8,10 +19,10 @@
       "nativeSymbol": "ETH",
       "thresholdEther": "0.006",
       "method": "internal",
-      "tokenAggregationBaseUrl": "https://dbis-api.d-bis.org/api/v1",
+      "tokenAggregationBaseUrl": "https://explorer.d-bis.org/token-aggregation/api/v1",
       "tokenAggregationFallbackUrl": "http://192.168.11.140:3001",
-      "dodoPmmIntegration": "0x79cdbaFBaA0FdF9F55D26F360F54cddE5c743F7D",
-      "poolCusdtCusdc": "0x9fcB06Aa1FD5215DC0E91Fd098aeff4B62fEa5C8",
+      "dodoPmmIntegration": "0x86ADA6Ef91A3B450F89f2b751e93B1b7A3218895",
+      "poolCusdtCusdc": "0x9e89bAe009adf128782E19e8341996c596ac40dC",
       "cusdt": "0x93E66202A11B1772E55407B32B44e5Cd8eda7f22",
       "cusdc": "0xf22258f57794CC8E06237084b353Ab30fFfa640b",
       "weth9": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2",

config/elemental-imperium-network-registry.json

@@ -1,37 +0,0 @@
-{
-  "registryVersion": 1,
-  "purpose": "Authoritative network codes for Elemental Imperium (33×33×6) wallet labels. ASNs are optional; add when assigned.",
-  "labelSpec": {
-    "id": "ei-wallet-label-v1",
-    "cellIdFormat": "EI-L{lpbca:02d}-B{branch:02d}-C{class}",
-    "labelFormatDefault": "{networkCode}.{cellId}",
-    "labelFormatWithAsn": "{networkCode}.{cellId}.AS{asn}",
-    "notes": [
-      "cellId is stable and never depends on ASN or network reassignment uses.",
-      "networkCode is lowercase kebab-case; use this registry as the allow-list.",
-      "When asn is assigned, append .AS{n} with integer n (no leading AS in the number token beyond the literal AS prefix)."
-    ]
-  },
-  "defaultNetworkCode": "unassigned",
-  "overlayExamplePath": "config/elemental-imperium-wallet-overlay.example.json",
-  "networks": [
-    {
-      "code": "unassigned",
-      "displayName": "Not yet mapped to an operational network",
-      "asn": null,
-      "status": "placeholder"
-    },
-    {
-      "code": "chain138-core",
-      "displayName": "Chain 138 execution / RPC plane (internal)",
-      "asn": null,
-      "status": "planned"
-    },
-    {
-      "code": "operator-lan",
-      "displayName": "Operator management LAN (e.g. 192.168.11.0/24)",
-      "asn": null,
-      "status": "planned"
-    }
-  ]
-}

config/elemental-imperium-wallet-overlay.example.json

@@ -1,23 +0,0 @@
-{
-  "overlayVersion": 1,
-  "description": "Optional mapping layered on registry defaults. rangeRules: first matching rule sets networkCode and asn for that wallet. cellOverrides: per cellId, partial overrides win over rangeRules.",
-  "rangeRules": [
-    {
-      "comment": "Example: LPBCA slice 0–10 on chain138-core; remove or edit when ASNs are assigned",
-      "match": {
-        "lpbca": [0, 10],
-        "branch": [0, 32],
-        "class": [0, 5]
-      },
-      "networkCode": "chain138-core",
-      "asn": null
-    }
-  ],
-  "cellOverrides": {
-    "EI-L00-B00-C0": {
-      "comment": "Example single-cell override",
-      "networkCode": "unassigned",
-      "asn": null
-    }
-  }
-}

config/extraction/additional-wallet-inventory.json

@@ -1,62 +0,0 @@
-{
-  "template_version": "1.1.0",
-  "purpose": "Additional on-chain and off-chain inventory for the source-to-CEX execution model.",
-  "questions_to_fill": [
-    "All additional EVM EOAs or smart-wallet addresses",
-    "Any multisigs, vaults, or treasury contracts you want included",
-    "Any custodial or exchange balances to include off-chain",
-    "Any LP or staking positions not visible from wallet token balances alone",
-    "The real production CEX or OTC sink to use for handoff"
-  ],
-  "wallets": [
-    {
-      "label": "primary-deployer-documented",
-      "address": "0x4A666F96fC8764181194447A7dFdb7d471b301C8",
-      "chains": [
-        "1",
-        "138"
-      ],
-      "role": "treasury",
-      "include_in_baseline": true,
-      "notes": "Canonical documented deployer wallet. Deduplicate against primary baseline if loaded twice."
-    }
-  ],
-  "offchain_accounts": [
-    {
-      "label": "example-exchange",
-      "platform": "unknown",
-      "account_type": "unknown",
-      "operational_status": "planned",
-      "enabled_for_production_handoff": false,
-      "accepted_deposit_assets": [
-        "USDC"
-      ],
-      "preferred_deposit_asset": "USDC",
-      "deposit_chain_id": "1",
-      "deposit_chain_name": "Ethereum Mainnet",
-      "deposit_address": "",
-      "min_packet_usd": 1000,
-      "max_packet_usd": 250000,
-      "slippage_ceiling_bps": 100,
-      "asset_balances": [
-        {
-          "symbol": "USDC",
-          "amount": 0,
-          "estimated_usd": 0,
-          "chain_id": "offchain",
-          "chain_name": "Off-chain / custodial",
-          "notes": "Replace with a real balance only when you want it counted."
-        }
-      ],
-      "include_in_baseline": false,
-      "notes": "Replace with a real sink before enabling production handoff."
-    }
-  ],
-  "risk_preferences": {
-    "max_drawdown_pct": null,
-    "liquidity_need_horizon": null,
-    "bridging_allowed": null,
-    "lp_allowed": null,
-    "leverage_allowed": null
-  }
-}

config/extraction/additional-wallet-inventory.template.json

@@ -1,62 +0,0 @@
-{
-  "template_version": "1.1.0",
-  "purpose": "Additional on-chain and off-chain inventory for the source-to-CEX execution model.",
-  "questions_to_fill": [
-    "All additional EVM EOAs or smart-wallet addresses",
-    "Any multisigs, vaults, or treasury contracts you want included",
-    "Any custodial or exchange balances to include off-chain",
-    "Any LP or staking positions not visible from wallet token balances alone",
-    "The real production CEX or OTC sink to use for handoff"
-  ],
-  "wallets": [
-    {
-      "label": "primary-deployer-documented",
-      "address": "0x4A666F96fC8764181194447A7dFdb7d471b301C8",
-      "chains": [
-        "1",
-        "138"
-      ],
-      "role": "treasury",
-      "include_in_baseline": true,
-      "notes": "Canonical documented deployer wallet. Deduplicate against primary baseline if loaded twice."
-    }
-  ],
-  "offchain_accounts": [
-    {
-      "label": "example-exchange",
-      "platform": "unknown",
-      "account_type": "unknown",
-      "operational_status": "planned",
-      "enabled_for_production_handoff": false,
-      "accepted_deposit_assets": [
-        "USDC"
-      ],
-      "preferred_deposit_asset": "USDC",
-      "deposit_chain_id": "1",
-      "deposit_chain_name": "Ethereum Mainnet",
-      "deposit_address": "",
-      "min_packet_usd": 1000,
-      "max_packet_usd": 250000,
-      "slippage_ceiling_bps": 100,
-      "asset_balances": [
-        {
-          "symbol": "USDC",
-          "amount": 0,
-          "estimated_usd": 0,
-          "chain_id": "offchain",
-          "chain_name": "Off-chain / custodial",
-          "notes": "Replace with a real balance only when you want it counted."
-        }
-      ],
-      "include_in_baseline": false,
-      "notes": "Replace with a real sink before enabling production handoff."
-    }
-  ],
-  "risk_preferences": {
-    "max_drawdown_pct": null,
-    "liquidity_need_horizon": null,
-    "bridging_allowed": null,
-    "lp_allowed": null,
-    "leverage_allowed": null
-  }
-}

config/extraction/mainnet-cwusdc-usdc-support-policy.json

@@ -1,55 +0,0 @@
-{
-  "version": "1.0.0",
-  "updated": "2026-04-18",
-  "rail": "mainnet_cwusdc_usdc",
-  "network": {
-    "chainId": 1,
-    "name": "Ethereum Mainnet",
-    "rpcEnvKeys": [
-      "ETHEREUM_MAINNET_RPC"
-    ]
-  },
-  "publicPair": {
-    "base": "cWUSDC",
-    "quote": "USDC",
-    "role": "discovery_lane",
-    "venue": "uniswap_v2_pair",
-    "poolAddress": "0xC28706F899266b36BC43cc072b3a921BDf2C48D9"
-  },
-  "defendedVenue": {
-    "base": "cWUSDC",
-    "quote": "USDC",
-    "role": "primary_defense",
-    "venue": "dodo_pmm",
-    "poolAddress": "0x69776fc607e9edA8042e320e7e43f54d06c68f0E",
-    "managedCycleScript": "smom-dbis-138/script/flash/RunManagedMainnetAaveCwusdcUsdcQuotePushCycle.s.sol:RunManagedMainnetAaveCwusdcUsdcQuotePushCycle"
-  },
-  "thresholds": {
-    "warnDeviationBps": 25,
-    "interveneDeviationBps": 75,
-    "criticalDeviationBps": 150,
-    "minBaseReserveUnits": 2500,
-    "minQuoteReserveUnits": 2500
-  },
-  "managedCycle": {
-    "defaultHarvestSurplus": true,
-    "defaultGasHoldbackTargetRaw": 0,
-    "maxAutomatedFlashQuoteAmountRaw": 2964298,
-    "quoteAmountByDeviationBps": [
-      {
-        "minDeviationBps": 150,
-        "flashQuoteAmountRaw": 2964298
-      },
-      {
-        "minDeviationBps": 75,
-        "flashQuoteAmountRaw": 1482149
-      }
-    ]
-  },
-  "notes": [
-    "The public Uniswap V2 pair is for visible routing and discovery, not for hard parity guarantees on its own.",
-    "When the public pair drifts beyond the intervention corridor, use the managed DODO quote-push stack as the first automated defense path.",
-    "Do not trust POOL_CWUSDC_USDC_MAINNET from dotenv blindly; this policy is the canonical defended venue binding.",
-    "Automation is capped to the currently tested safe tranche until the defended lane is explicitly re-sized from fresh liquidity measurements."
-  ]
-}

config/extraction/promod-uniswap-v2-liquidity-policy.json

@@ -1,83 +0,0 @@
-{
-  "program_name": "Mr. Promod Uniswap V2 cW Deep Liquidity Program",
-  "purpose": "Define the desired-state Uniswap V2 or Uniswap-V2-compatible liquidity rollout for cW* and cWAUSDT rails on bridged public networks.",
-  "operator_rule": "When canonical USDC or USDT depth is scarce, concentrate depth first in wrapped support rails and then expand into canonical settlement rails.",
-  "mainnet_funding_posture": {
-    "mode": "triple-rail-support",
-    "required_deployer_assets": [
-      "cWUSDC",
-      "cWUSDT",
-      "cWAUSDT"
-    ],
-    "notes": [
-      "cWUSDC and cWUSDT remain the core settlement-adjacent rails.",
-      "cWAUSDT is the wrapped-depth support asset when canonical USDC or USDT inventory is not yet deep enough."
-    ]
-  },
-  "priority_tiers": {
-    "tier_1": [
-      "1",
-      "8453",
-      "42161",
-      "10",
-      "137"
-    ],
-    "tier_2": [
-      "56",
-      "43114",
-      "100",
-      "42220",
-      "25"
-    ],
-    "tier_3": [
-      "1111"
-    ]
-  },
-  "wrapped_depth_phase": {
-    "preferred_pairs_in_order": [
-      "cWAUSDT/cWUSDC",
-      "cWAUSDT/cWUSDT",
-      "cWUSDT/cWUSDC"
-    ],
-    "allocation_share_pct": {
-      "flagship_pair": 50,
-      "second_pair": 30,
-      "third_pair": 20
-    },
-    "notes": [
-      "This phase is for creating visibly deep wrapped-to-wrapped liquidity before canonical settlement rails are deep enough.",
-      "Wrapped-depth pools strengthen routing and inventory transfer between the cW settlement rails and cWAUSDT support inventory.",
-      "These pools do not replace the eventual need for direct canonical settlement rails."
-    ]
-  },
-  "settlement_phase": {
-    "preferred_pairs_by_hub": {
-      "USDC": [
-        "cWUSDC/USDC",
-        "cWUSDT/USDC",
-        "cWAUSDT/USDC"
-      ],
-      "USDT": [
-        "cWUSDT/USDT",
-        "cWUSDC/USDT",
-        "cWAUSDT/USDT"
-      ]
-    },
-    "notes": [
-      "Settlement-phase pools remain the preferred terminal rails for exchange and OTC normalization.",
-      "Promote settlement rails only after wrapped-depth support is stable and enough canonical stable inventory is available."
-    ]
-  },
-  "uniswap_v2_requirements": {
-    "required_env_suffixes": [
-      "UNISWAP_V2_FACTORY",
-      "UNISWAP_V2_ROUTER",
-      "UNISWAP_V2_START_BLOCK"
-    ],
-    "required_registry_updates": [
-      "cross-chain-pmm-lps/config/deployment-status.json",
-      "token-aggregation env for the target chain",
-      "MCP allowlist or indexer visibility for new pairs"
-    ]
-  }
-}

config/extraction/source-to-cex-production-policy.json

@@ -1,35 +0,0 @@
-{
-  "version": "1.0.0",
-  "last_updated": "2026-04-17",
-  "purpose": "Operator policy for Chain 138 -> Mainnet normalization -> CEX handoff.",
-  "production_enabled": false,
-  "default_route_model": "Chain 138 inventory -> canonical bridge -> Mainnet normalization -> CEX handoff",
-  "operator_defaults": {
-    "primary_same_day_feeder": "cUSDC",
-    "secondary_same_day_feeder": "cUSDT",
-    "stable_lp_mode": "unwind_first",
-    "immediate_assets": [
-      "cWUSDC",
-      "cWUSDT"
-    ],
-    "reject_non_promoted_assets": true
-  },
-  "normalization_policy": {
-    "preferred_settlement_assets": [
-      "USDC",
-      "USDT"
-    ],
-    "default_settlement_asset": "USDC",
-    "allow_usdt_only_with_operator_approval": true,
-    "post_bridge_aggregation_only": true
-  },
-  "packetization_policy": {
-    "bridge_packet_usd_max": 250000,
-    "normalization_packet_usd_max": 100000,
-    "direct_cwusdc_usdc_usage_cap_usd": 213.102461,
-    "direct_cwusdt_usdt_usage_cap_usd": 2.182358,
-    "force_cwusdt_via_cwusdc_threshold_usd": 10,
-    "default_slippage_ceiling_bps": 100,
-    "chunking_mode": "bridge_in_chunks_then_normalize_then_continuous_cex_handoff"
-  }
-}

config/generated-node-configs/config-1500.toml

@@ -1,52 +0,0 @@
-# Besu Configuration for besu-sentry-1 (VMID: 1500)
-# Generated baseline sentry config promoted into first-class repo coverage.
-
-data-path="/data/besu"
-genesis-file=""
-
-# Network
-network-id=138
-p2p-host="192.168.11.150"
-p2p-port=30303
-max-peers=32
-discovery-enabled=true
-
-# RPC
-rpc-http-enabled=true
-rpc-http-host="0.0.0.0"
-rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
-rpc-http-cors-origins=["*"]
-rpc-http-api-enable-unsafe-txsigning=true
-
-rpc-ws-enabled=true
-rpc-ws-host="0.0.0.0"
-rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
-
-# GraphQL
-graphql-http-enabled=true
-graphql-http-host="0.0.0.0"
-graphql-http-port=8547
-
-# Metrics
-metrics-enabled=true
-metrics-host="0.0.0.0"
-metrics-port=9545
-
-# Logging
-logging="INFO"
-log-destination="CONSOLE"
-
-# Sync
-sync-mode="FULL"
-fast-sync-min-peers=2
-
-# Privacy
-privacy-enabled=false
-
-# Mining
-miner-enabled=false
-
-# QBFT
-qbft-enabled=true

config/generated-node-configs/config-1501.toml

@@ -1,52 +0,0 @@
-# Besu Configuration for besu-sentry-2 (VMID: 1501)
-# Generated baseline sentry config promoted into first-class repo coverage.
-
-data-path="/data/besu"
-genesis-file=""
-
-# Network
-network-id=138
-p2p-host="192.168.11.151"
-p2p-port=30303
-max-peers=32
-discovery-enabled=true
-
-# RPC
-rpc-http-enabled=true
-rpc-http-host="0.0.0.0"
-rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
-rpc-http-cors-origins=["*"]
-rpc-http-api-enable-unsafe-txsigning=true
-
-rpc-ws-enabled=true
-rpc-ws-host="0.0.0.0"
-rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
-
-# GraphQL
-graphql-http-enabled=true
-graphql-http-host="0.0.0.0"
-graphql-http-port=8547
-
-# Metrics
-metrics-enabled=true
-metrics-host="0.0.0.0"
-metrics-port=9545
-
-# Logging
-logging="INFO"
-log-destination="CONSOLE"
-
-# Sync
-sync-mode="FULL"
-fast-sync-min-peers=2
-
-# Privacy
-privacy-enabled=false
-
-# Mining
-miner-enabled=false
-
-# QBFT
-qbft-enabled=true

config/generated-node-configs/config-1502.toml

@@ -1,52 +0,0 @@
-# Besu Configuration for besu-sentry-3 (VMID: 1502)
-# Generated baseline sentry config promoted into first-class repo coverage.
-
-data-path="/data/besu"
-genesis-file=""
-
-# Network
-network-id=138
-p2p-host="192.168.11.152"
-p2p-port=30303
-max-peers=32
-discovery-enabled=true
-
-# RPC
-rpc-http-enabled=true
-rpc-http-host="0.0.0.0"
-rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
-rpc-http-cors-origins=["*"]
-rpc-http-api-enable-unsafe-txsigning=true
-
-rpc-ws-enabled=true
-rpc-ws-host="0.0.0.0"
-rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
-
-# GraphQL
-graphql-http-enabled=true
-graphql-http-host="0.0.0.0"
-graphql-http-port=8547
-
-# Metrics
-metrics-enabled=true
-metrics-host="0.0.0.0"
-metrics-port=9545
-
-# Logging
-logging="INFO"
-log-destination="CONSOLE"
-
-# Sync
-sync-mode="FULL"
-fast-sync-min-peers=2
-
-# Privacy
-privacy-enabled=false
-
-# Mining
-miner-enabled=false
-
-# QBFT
-qbft-enabled=true

config/generated-node-configs/config-1503.toml

@@ -1,52 +0,0 @@
-# Besu Configuration for besu-sentry-4 (VMID: 1503)
-# Generated baseline sentry config promoted into first-class repo coverage.
-
-data-path="/data/besu"
-genesis-file=""
-
-# Network
-network-id=138
-p2p-host="192.168.11.153"
-p2p-port=30303
-max-peers=32
-discovery-enabled=true
-
-# RPC
-rpc-http-enabled=true
-rpc-http-host="0.0.0.0"
-rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
-rpc-http-cors-origins=["*"]
-rpc-http-api-enable-unsafe-txsigning=true
-
-rpc-ws-enabled=true
-rpc-ws-host="0.0.0.0"
-rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
-
-# GraphQL
-graphql-http-enabled=true
-graphql-http-host="0.0.0.0"
-graphql-http-port=8547
-
-# Metrics
-metrics-enabled=true
-metrics-host="0.0.0.0"
-metrics-port=9545
-
-# Logging
-logging="INFO"
-log-destination="CONSOLE"
-
-# Sync
-sync-mode="FULL"
-fast-sync-min-peers=2
-
-# Privacy
-privacy-enabled=false
-
-# Mining
-miner-enabled=false
-
-# QBFT
-qbft-enabled=true

config/generated-node-configs/config-1504.toml

@@ -1,52 +0,0 @@
-# Besu Configuration for besu-sentry-ali (VMID: 1504)
-# Generated baseline sentry config promoted into first-class repo coverage.
-
-data-path="/data/besu"
-genesis-file=""
-
-# Network
-network-id=138
-p2p-host="192.168.11.154"
-p2p-port=30303
-max-peers=32
-discovery-enabled=true
-
-# RPC
-rpc-http-enabled=true
-rpc-http-host="0.0.0.0"
-rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
-rpc-http-cors-origins=["*"]
-rpc-http-api-enable-unsafe-txsigning=true
-
-rpc-ws-enabled=true
-rpc-ws-host="0.0.0.0"
-rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
-
-# GraphQL
-graphql-http-enabled=true
-graphql-http-host="0.0.0.0"
-graphql-http-port=8547
-
-# Metrics
-metrics-enabled=true
-metrics-host="0.0.0.0"
-metrics-port=9545
-
-# Logging
-logging="INFO"
-log-destination="CONSOLE"
-
-# Sync
-sync-mode="FULL"
-fast-sync-min-peers=2
-
-# Privacy
-privacy-enabled=false
-
-# Mining
-miner-enabled=false
-
-# QBFT
-qbft-enabled=true

config/generated-node-configs/config-1505.toml

@@ -8,21 +8,20 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.213"
 p2p-port=30303
-max-peers=32
+max-peers=40
 discovery-enabled=true
 
 # RPC
 rpc-http-enabled=true
 rpc-http-host="0.0.0.0"
 rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-api=["ETH","NET","WEB3"]
 rpc-http-cors-origins=["*"]
-rpc-http-api-enable-unsafe-txsigning=true
 
 rpc-ws-enabled=true
 rpc-ws-host="0.0.0.0"
 rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-ws-api=["ETH","NET","WEB3"]
 
 # GraphQL
 graphql-http-enabled=true

config/generated-node-configs/config-1506.toml

@@ -8,21 +8,20 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.214"
 p2p-port=30303
-max-peers=32
+max-peers=40
 discovery-enabled=true
 
 # RPC
 rpc-http-enabled=true
 rpc-http-host="0.0.0.0"
 rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-api=["ETH","NET","WEB3"]
 rpc-http-cors-origins=["*"]
-rpc-http-api-enable-unsafe-txsigning=true
 
 rpc-ws-enabled=true
 rpc-ws-host="0.0.0.0"
 rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-ws-api=["ETH","NET","WEB3"]
 
 # GraphQL
 graphql-http-enabled=true