feat(gitea-phoenix): gov runtime, deploy/template parity, workflow dedupe docs

- Add gov-portals-runtime.v1.json + schema; jq gate in validate-config-files
- Python: parity-deploy-targets, parity-operational-template (IP strict, hostname WARN),
  parity-gov-portals-runtime; validate-vm-routing-parity.sh wrapper
- check-gov-portal-workflow-canonical-strings.sh for monorepo Pattern A
- PORTAL_WORKFLOW_PARITY.md; template headers; repos README; operator checklist secrets
- report-gitea-cd-parity runs full VM routing parity; task doc marked complete
- GOV_PORTALS_XOM_DEV + GITEA_GOV + MASTER_INDEX + matrix doc cross-links

Co-authored-by: Cursor <cursoragent@cursor.com>

.cursor/rules/chain138-tokens-and-pmm.mdc

@@ -10,9 +10,23 @@ alwaysApply: true
 - **cUSDT:** `0x93E66202A11B1772E55407B32B44e5Cd8eda7f22` (6 decimals)
 - **cUSDC:** `0xf22258f57794CC8E06237084b353Ab30fFfa640b` (6 decimals)
 
-**DODOPMMIntegration:** `0x5BDc62f1ae7D630c37A8B363a1d49845356Ee72d` — reconciled with `docs/11-references/ADDRESS_MATRIX_AND_STATUS.md` (on-chain verification 2026-03-26); `compliantUSDT()` / `compliantUSDC()` return the canonical cUSDT/cUSDC above.
+**DODOPMMIntegration (live, traded):** `0x86ADA6Ef91A3B450F89f2b751e93B1b7A3218895` — confirmed live via on-chain probe (2026-04-22): `compliantUSDT()` / `compliantUSDC()` return the canonical cUSDT/cUSDC above; `pools[][]` mapping resolves to the live funded pool set below; `isRegisteredPool` is TRUE for all 8 pools listed under "PMM pools (live, traded)". `0x5BDc62f1ae7D630c37A8B363a1d49845356Ee72d` is a parallel deployment of the same source with different immutables and seeded but un-traded pools — do not wire dApps or routers to it.
 
-**PMM pools (live funded public):** cUSDT/cUSDC `0xff8d3b8fDF7B112759F076B69f4271D4209C0849` | cUSDT/USDT `0x6fc60DEDc92a2047062294488539992710b99D71` | cUSDC/USDC `0x9f74Be42725f2Aa072a9E0CdCce0E7203C510263` — see `docs/11-references/ADDRESS_MATRIX_AND_STATUS.md` / `PMM_DEX_ROUTING_STATUS.md`.
+**DODOPMMProvider (ILiquidityProvider, live):** `0x3f729632E9553EBacCdE2e9b4c8F2B285b014F2e` — `dodoIntegration() == 0x86ADA6Ef…`, `providerName() == "DODO PMM"`, `isKnownPool` TRUE for all 8 live pools. Use this address as `dodoLiquidityProvider` when deploying `EnhancedSwapRouter`; see `docs/11-references/PMM_DEX_ROUTING_STATUS.md`.
+
+**PMM pools (live, traded — 2026-04-22 on-chain probe):**
+- cUSDT/cUSDC `0x9e89bAe009adf128782E19e8341996c596ac40dC` (~983k cUSDT / ~1.016M cUSDC, asymmetric — actively traded)
+- cUSDT/USDT  `0x866Cb44b59303d8dc5f4F9E3E7A8e8b0bf238d66` (~1M / ~1M)
+- cUSDC/USDC  `0xc39B7D0F40838cbFb54649d327f49a6DAC964062` (~1M / ~1M)
+- cBTC/cUSDT  `0x67049e7333481e2cac91af61403ac7bddfab7bcd` (10k cBTC base / 9M cUSDT quote)
+- cBTC/cUSDC  `0x72f1a0794153c3b8a1e8a731f1d8e1a52cb10dc5` (10k cBTC base / 9M cUSDC quote)
+- WETH/USDC   `0xb53a0508940b1ff90f1aad4f6cb50a7012fe5593` (~10.1M USDC quote)
+- WETH/USDT   `0xe227f6c0520c0c6e8786fe56fa76c4914f861533` (~10.1M USDT quote)
+- cBTC/cXAUC  `0xf3e8a07d419b61f002114e64d79f7cf8f7989433` (10k cBTC base / 1.7k cXAUC quote)
+
+The earlier rule's pool addresses (`0xff8d3b8f…`, `0x6fc60D…`, `0x9f74Be…`) belong to the **parallel** integration `0x5BDc62f1…` (Stack B) and are seeded 10M/10M flat or 0/0 — they are not the live PMM trading set. Source-of-truth corrections to follow in `ADDRESS_MATRIX_AND_STATUS.md` and `PMM_DEX_ROUTING_STATUS.md`.
+
+**cBTC:** `0xe94260c555ac1d9d3cc9e1632883452ebdf0082e` (8 decimals) — base token of the three cBTC pools above.
 
 **cXAUC / cXAUT (XAU):** `0x290E52a8819A4fbD0714E517225429aA2B70EC6b`, `0x94e408E26c6FD8F4ee00b54dF19082FDA07dC96E` (6 decimals). **1 full token = 1 troy ounce Au** — not USD face value; see `EXPLORER_TOKEN_LIST_CROSSCHECK.md` section 5.1.
 

.cursor/rules/project-doc-and-deployment-refs.mdc

@@ -15,6 +15,18 @@ When answering token/PMM/deployment questions, prefer these docs over inferring
 **Operator commands:** `docs/00-meta/OPERATOR_READY_CHECKLIST.md`  
 **Doc index:** `docs/MASTER_INDEX.md`
 
+**Master reference — token / stablecoin launch (institutional compendium):** `docs/00-meta/BIBLE_FROM_NATHAN_TOKEN_LAUNCH_RESOURCE_COMPENDIUM.md` — regulation through aggregators and launch checklists; informational only. For Chain 138 token truth and Explorer alignment, still use `EXPLORER_TOKEN_LIST_CROSSCHECK.md` above.
+
+**Master reference — MetaMask Money/mUSD ↔ GRU, provider cross-links, DefiLlama DODO `dfio_meta_main` TVL:** `docs/00-meta/METAMASK_GRU_DEFILLAMA_CHAIN138_MASTER_REFERENCE.md` — replay steps, upstream **DefiLlama/DefiLlama-Adapters#19198**, touchpoints JSON, and **Part G** remaining tasks.
+
+**MetaMask / provider design corpus (frozen architecture vs execution checklists):** `docs/04-configuration/metamask/METAMASK_PROVIDER_DESIGN_CORPUS.md`
+
+**GRU transport loader (monorepo `token-mapping-loader.cjs` + overlay JSON):** `docs/04-configuration/GRU_TRANSPORT_LOADER_DESIGN_SPEC.md`
+
+**Gaps and inconsistencies (audit):** `docs/11-references/COSMOS_CHAIN138_GAPS_AND_INCONSISTENCIES.md`
+
+**Optional Cosmos / IBC to Chain 138 (streams A–E):** `docs/11-references/COSMOS_ECOSYSTEM_CHAIN138_OPTIONAL_INTEGRATIONS_RUNBOOK.md` — templates: `config/cosmos-chain138-optional/README.md`
+
 **Deployment phases (full coverage):** `docs/03-deployment/REMAINING_DEPLOYMENTS_FOR_FULL_NETWORK_COVERAGE.md`  
 - A: mint + add liquidity (138) — `mint-for-liquidity.sh`, AddLiquidityPMMPoolsChain138  
 - B: Celo/Wemix CCIP + LINK (Wemix needs 0.4 WEMIX)  

.cursorindexingignore

@@ -0,0 +1,44 @@
+# Exclude heavy paths from Cursor codebase indexing only (files stay editable).
+# Syntax: same as .gitignore — see https://cursor.com/docs/reference/ignore-file
+#
+# Aligns with pyrightconfig.json / .vscode settings to reduce IDE + Python LS load.
+# See reports/status/pyright-and-ide-performance-investigation-2026-05-09.md
+
+ProxmoxVE/
+explorer-monorepo/
+MEV_Bot/
+miracles_in_motion/
+OMNIS/
+cross-chain-pmm-lps/
+tmp/
+.tmp/
+.codex-artifacts/
+.devin/
+.venv-checkjson/
+venv/
+smom-dbis-138/lib/
+smom-dbis-138/artifacts/
+smom-dbis-138/broadcast/
+smom-dbis-138/cache/
+
+third-party/
+vendor/
+backups/
+build/
+dist/
+out/
+output/
+reports/
+cross-chain-pmm-lps-publish/
+smom-dbis-138-publish/
+thirdweb-contracts/
+thirdweb-core-2103-test/
+token-aggregation-build/
+transaction-composer/
+relay/
+relay-api/
+relay-docs/
+relay-web/
+.cursor/
+.codex/
+.pnpm-store/

.devin/README.md

@@ -0,0 +1,18 @@
+# Devin for Terminal in Cursor
+
+This project is configured to use Devin for Terminal as a local CLI companion inside Cursor.
+
+- Cursor config import is enabled through `.cursor/rules/` and `.cursor/mcp.json` if present.
+- Windsurf config import is disabled for this project.
+- `AGENTS.md` remains the canonical shared project guidance.
+- Personal Devin overrides and secrets belong in `.devin/config.local.json`, which is gitignored.
+- Run `devin auth login` interactively before first use.
+
+Useful commands:
+
+```bash
+devin
+devin -- "review this repo and suggest the next safe task"
+devin auth status
+devin mcp list
+```

.devin/agents/reviewer/AGENT.md

@@ -0,0 +1,21 @@
+---
+name: reviewer
+description: Read-only reviewer for Cursor/Devin handoffs
+allowed-tools:
+  - read
+  - grep
+  - glob
+  - exec
+permissions:
+  allow:
+    - Exec(git status)
+    - Exec(git diff)
+    - Exec(git log)
+  deny:
+    - write
+    - edit
+---
+
+You are a read-only review subagent for this Cursor workspace.
+
+Review changes for correctness, security, operational risk, and consistency with `AGENTS.md` and relevant `.cursor/rules/` guidance. Do not modify files. Report only actionable findings first, ordered by severity, with exact file paths.

.devin/config.json

@@ -0,0 +1,38 @@
+{
+  // Devin for Terminal project config optimized for Cursor as the primary IDE.
+  "read_config_from": {
+    "cursor": true,
+    "windsurf": false,
+    "claude": true
+  },
+  "permissions": {
+    "allow": [
+      "Read(**)",
+      "Exec(git status)",
+      "Exec(git diff)",
+      "Exec(git log)",
+      "Exec(pnpm run)",
+      "Exec(bash scripts/verify)",
+      "Exec(bash scripts/validation)"
+    ],
+    "ask": [
+      "Write(**)",
+      "Exec(git commit)",
+      "Exec(git push)",
+      "Exec(docker)",
+      "Exec(docker compose)",
+      "mcp__*"
+    ],
+    "deny": [
+      "Exec(rm)",
+      "Exec(sudo)",
+      "Exec(chmod -R)",
+      "Exec(chown -R)",
+      "Write(.env*)",
+      "Write(**/.env*)",
+      "Write(reports/secrets/**)",
+      "Write(config/production/*did-secrets.env)"
+    ]
+  },
+  "mcpServers": {}
+}

.devin/hooks.v1.json

@@ -0,0 +1,14 @@
+{
+  "PreToolUse": [
+    {
+      "matcher": "exec",
+      "hooks": [
+        {
+          "type": "command",
+          "command": "bash scripts/devin/block-dangerous-command.sh",
+          "timeout": 10
+        }
+      ]
+    }
+  ]
+}

.devin/skills/cursor-handoff/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: cursor-handoff
+description: Align Devin for Terminal work with this Cursor workspace and project rules
+allowed-tools:
+  - read
+  - grep
+  - glob
+  - exec
+triggers:
+  - user
+  - model
+---
+
+Use this skill when starting or resuming work in this repository from Devin for Terminal.
+
+1. Treat Cursor as the primary IDE context and read `.cursor/rules/` when relevant.
+2. Read `AGENTS.md` first for canonical project guidance.
+3. Do not rely on Windsurf rules, skills, workflows, or MCP settings for this project.
+4. Check `git status --short` before editing and preserve unrelated user changes.
+5. Prefer dry-run flags for operator, deployment, DNS, Proxmox, and LAN-sensitive scripts.
+6. Never write secrets or runtime credentials into tracked files.
+7. When using MCP servers, assume Cursor and Devin maintain separate authentication sessions.

.devin/skills/review/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: review
+description: Review code changes before commit or handoff
+allowed-tools:
+  - read
+  - grep
+  - glob
+  - exec
+permissions:
+  allow:
+    - Exec(git status)
+    - Exec(git diff)
+    - Exec(git log)
+  deny:
+    - write
+    - edit
+triggers:
+  - user
+  - model
+---
+
+Review the current changes with a correctness-first stance.
+
+1. Run `git status --short`.
+2. Run `git diff` and, if staged changes exist, `git diff --staged`.
+3. Focus on bugs, security regressions, deployment risk, missing validation, and secret exposure.
+4. Cite exact file paths and keep findings ordered by severity.
+5. If no issues are found, say so and call out any test or validation gaps.

.env.master.example

@@ -20,6 +20,8 @@ PROXMOX_ALLOW_ELEVATED=
 # Prefer CLOUDFLARE_API_TOKEN scoped to Zone:DNS:Edit on the zones you use (avoid global Account API key when possible).
 # Bulk DNS script: scripts/update-all-dns-to-public-ip.sh — use --dry-run and --zone-only=sankofa.nexus (etc.) before wide updates.
 CLOUDFLARE_API_TOKEN=
+# Set to 1 if token has no DNS:Edit and you need Global API key for scripts/cloudflare/provision-d-bis-mail-dns-and-npmplus.sh etc.
+CLOUDFLARE_DNS_PREFER_GLOBAL_KEY=
 CLOUDFLARE_EMAIL=
 CLOUDFLARE_API_KEY=
 CLOUDFLARE_ZONE_ID=
@@ -40,6 +42,10 @@ CLOUDNS_AUTH_ID=
 CLOUDNS_AUTH_PASSWORD=
 
 # --- NPM / NPMplus ---
+# For scripts/verify/backup-npmplus.sh: NPM_EMAIL and NPM_PASSWORD are both required
+# (no in-script defaults); see AGENTS.md operator / backup row.
+# PMG (LXC 100) web UI — optional: run scripts/operator/sync-pmg-webui-password-to-dotenv.sh to pull from /root/PMG_WEBUI_password.txt
+PMG_WEBUI_PASSWORD=
 NPM_URL=
 NPM_EMAIL=
 NPM_PASSWORD=
@@ -71,6 +77,16 @@ GITEA_URL=
 GITEA_TOKEN=
 GITEA_ORG=
 
+# --- Phoenix deploy API (Gitea Actions secrets on EACH repo that triggers deploy) ---
+# PHOENIX_DEPLOY_URL=       # full POST URL e.g. http://192.168.11.59:4001/api/deploy — same variable name as repo Secrets in Gitea
+# PHOENIX_DEPLOY_TOKEN=    # bearer for Phoenix deploy API — set per-repo Secret on Gitea, not necessarily in this root .env
+
+# --- CyberSecur Global (Gov portal static site; optional Web3Forms intake) ---
+# CYBERSECUR_WEB3FORMS_ACCESS_KEY=   # web3forms.com — used by CyberSecur-Global/deploy/render-intake.sh (key is public in browser HTML per provider)
+# After rotating the key in the Web3Forms dashboard, update this line and redeploy:
+#   CYBERSECUR_REPO=/path/to/CyberSecur-Global ./scripts/deployment/sync-cybersecur-global-to-ct7810.sh
+# CYBERSECUR_INTAKE_REDIRECT_URL=    # optional; default https://cybersecur.d-bis.org/intake-thanks.html
+
 # --- Database & app auth ---
 DATABASE_URL=
 JWT_SECRET=
@@ -94,13 +110,86 @@ AZURE_STORAGE_CONTAINER=
 
 # --- Blockchain / SMOM-DBIS-138 (use smom-dbis-138/.env for PRIVATE_KEY) ---
 PRIVATE_KEY=
+DEPLOYER_ADDRESS=
 RPC_URL_138=
 RPC_URL_138_PUBLIC=
+# Infura (recommended): one dashboard project fills JSON-RPC for Ethereum + major L2s.
+# Set INFURA_PROJECT_ID (or INFURA_API_KEY) and leave per-chain URLs empty to auto-fill in scripts/lib/load-project-env.sh,
+# or set explicit URLs: https://mainnet.infura.io/v3/<PROJECT_ID>, https://polygon-mainnet.infura.io/v3/<PROJECT_ID>, …
+INFURA_PROJECT_ID=
+INFURA_API_KEY=
 ETHEREUM_MAINNET_RPC=
+# EI matrix readiness audit (scripts/verify/run-ei-matrix-full-readiness-audit.sh, optional CI step in run-all-validation.sh)
+EI_MATRIX_AUDIT_SHARD_SIZE=400
+EI_MATRIX_AUDIT_WORKERS=3
+EI_MATRIX_AUDIT_MIN_MAINNET_RAW=12000000
+EI_MATRIX_AUDIT_MIN_138_RAW=0
+# CI: EI_MATRIX_ONCHAIN_AUDIT_CI=1 EI_MATRIX_ONCHAIN_AUDIT_CI_LIMIT=120 EI_MATRIX_AUDIT_MIN_MAINNET_RAW_CI=0
+POLYGON_MAINNET_RPC=
+ARBITRUM_MAINNET_RPC=
+OPTIMISM_MAINNET_RPC=
+BASE_MAINNET_RPC=
+AVALANCHE_MAINNET_RPC=
+# BSC / Gnosis / Celo (Infura-supported networks)
+BSC_RPC_URL=
+GNOSIS_MAINNET_RPC=
+CELO_MAINNET_RPC=
+# Clear scripts/verify/check-external-dependencies.sh — use real service URLs when split; example interim health target:
+# DBIS_CORE_URL=https://dbis-api.d-bis.org/health
+DBIS_CORE_URL=
+CC_PAYMENT_ADAPTERS_URL=
+CC_AUDIT_LEDGER_URL=
+CC_SHARED_EVENTS_URL=
+CC_SHARED_SCHEMAS_URL=
+FIN_GATEWAY_URL=
+ALLIANCE_ACCESS_URL=
+# cast must be in PATH; use a runner-reachable Chain 138 RPC, e.g.:
+# CHAIN138_CI_RPC_URL=https://rpc.public-0138.defi-oracle.io
+CHAIN138_CI_RPC_URL=
+ALL_MAINNET_RPC=
+# Alltra / Wemix / Etherlink: set for production; for local read-only checks, deployer-gas-auto-route.sh falls back to public RPCs documented in scripts/deployment/deployer-gas-auto-route.sh
 CHAIN_651940_RPC_URL=
+# ALLTRA_MAINNET_RPC=https://mainnet-rpc.alltra.global
+# WEMIX_RPC_URL=https://api.wemix.com
+# ETHERLINK_RPC_URL=https://node.mainnet.etherlink.com
+CHAIN_1_UNISWAP_V2_FACTORY=0x5C69bEe701ef814a2B6a3EDD4B1652CB9cc5aA6f
+CHAIN_1_UNISWAP_V2_ROUTER=0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D
+CHAIN_1_UNISWAP_V2_START_BLOCK=0
+CHAIN_10_UNISWAP_V2_FACTORY=0x0c3c1c532F1e39EdF36BE9Fe0bE1410313E074Bf
+CHAIN_10_UNISWAP_V2_ROUTER=0x4A7b5Da61326A6379179b40d00F57E5bbDC962c2
+CHAIN_10_UNISWAP_V2_START_BLOCK=0
+CHAIN_25_UNISWAP_V2_FACTORY=0x3B44B2a187a7b3824131F8db5a74194D0a42Fc15
+CHAIN_25_UNISWAP_V2_ROUTER=0x145863Eb42Cf62847A6Ca784e6416C1682b1b2Ae
+CHAIN_25_UNISWAP_V2_START_BLOCK=0
+CHAIN_56_UNISWAP_V2_FACTORY=0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73
+CHAIN_56_UNISWAP_V2_ROUTER=0x10ED43C718714eb63d5aA57B78B54704E256024E
+CHAIN_56_UNISWAP_V2_START_BLOCK=0
+CHAIN_100_UNISWAP_V2_FACTORY=0xc35DADB65012eC5796536bD9864eD8773aBc74C4
+CHAIN_100_UNISWAP_V2_ROUTER=0x1b02dA8Cb0d097eB8D57A175b88c7D8b47997506
+CHAIN_100_UNISWAP_V2_START_BLOCK=0
+CHAIN_137_UNISWAP_V2_FACTORY=0x5757371414417b8C6CAad45bAeF941aBc7d3Ab32
+CHAIN_137_UNISWAP_V2_ROUTER=0xa5E0829CaCEd8fFDD4De3c43696c57F7D7A678ff
+CHAIN_137_UNISWAP_V2_START_BLOCK=0
+CHAIN_42220_UNISWAP_V2_FACTORY=0x62d5b84bE28a183aBB507E125B384122D2C25fAE
+CHAIN_42220_UNISWAP_V2_ROUTER=0xE3D8bd6Aed4F159bc8000a9cD47CffDb95F96121
+CHAIN_42220_UNISWAP_V2_START_BLOCK=0
+CHAIN_43114_UNISWAP_V2_FACTORY=0x9Ad6C38BE94206cA50bb0d90783181662f0Cfa10
+CHAIN_43114_UNISWAP_V2_ROUTER=0x60aE616a2155Ee3d9A68541Ba4544862310933d4
+CHAIN_43114_UNISWAP_V2_START_BLOCK=0
+CHAIN_8453_UNISWAP_V2_FACTORY=0x02a84c1b3BBD7401a5f7fa98a384EBC70bB5749E
+CHAIN_8453_UNISWAP_V2_ROUTER=0x8cFe327CEc66d1C090Dd72bd0FF11d690C33a2Eb
+CHAIN_8453_UNISWAP_V2_START_BLOCK=0
+CHAIN_42161_UNISWAP_V2_FACTORY=0x02a84c1b3BBD7401a5f7fa98a384EBC70bB5749E
+CHAIN_42161_UNISWAP_V2_ROUTER=0x8cFe327CEc66d1C090Dd72bd0FF11d690C33a2Eb
+CHAIN_42161_UNISWAP_V2_START_BLOCK=0
+# Optional / scaffold-only until Wemix UniV2 routing is promoted
+CHAIN_1111_UNISWAP_V2_FACTORY=
+CHAIN_1111_UNISWAP_V2_ROUTER=
+CHAIN_1111_UNISWAP_V2_START_BLOCK=0
 ETHERLINK_RPC_URL=
 TEZOS_RPC_URL=
 ETHERSCAN_API_KEY=
+WEMIXSCAN_API_KEY=
 ETHERLINK_CCIP_SELECTOR=
 TEZOS_BRIDGE_ENABLED=
 ETHERLINK_BRIDGE_ENABLED=
@@ -190,6 +279,19 @@ RPC_URL_138_FIREBLOCKS=
 WS_URL_138_FIREBLOCKS=
 CHAIN_ID_138=
 
+# --- Non-EVM operator binding (liquidity planner / handoff advisory) ---
+# Public XRPL r-address (optional). Same as XRPL_ACCOUNT / XRPL_WALLET_ADDRESS / XRP_WALLET_ADDRESS.
+XRPL_ACCOUNT=
+XRPL_DEPLOYER_ADDRESS=
+# Native Tron base58 address override if not using derived EVM→Tron mapping.
+TRON_DEPLOYER_ADDRESS=
+# Set to 1 after ops confirms derived Tron deployer is canonical (see config/non-evm-operator-binding.json).
+TRON_CANONICAL_CONFIRMED=
+# Solana public key override if not using SOLANA_KEYPAIR_PATH.
+SOLANA_DEPLOYER_ADDRESS=
+SOLANA_RPC_URL=
+TRONGRID_API_KEY=
+
 # --- Phoenix deploy API ---
 PORT=
 GITEA_TOKEN=

.gitea/CONTRIBUTING.md

@@ -6,6 +6,12 @@
 2. Make changes, ensure tests pass
 3. Open a pull request
 
+Repo ↔ VM CI/CD mapping and templates for **other** Gitea repos: [docs/04-configuration/GITEA_REPO_VM_CD_CI_MATRIX.md](../docs/04-configuration/GITEA_REPO_VM_CD_CI_MATRIX.md), [config/gitea-workflow-templates/README.md](../config/gitea-workflow-templates/README.md).
+
+Deploy workflow policy:
+`main` and `master` are both deploy-triggering branches, so `.gitea/workflow-sources/deploy-to-phoenix.yml` and `.gitea/workflow-sources/validate-on-pr.yml` must stay identical across both branches.
+Use `bash scripts/verify/sync-gitea-workflows.sh` after editing workflow-source files, and `bash scripts/verify/run-all-validation.sh --skip-genesis` to catch workflow drift before push.
+
 ## Pull Requests
 
 - Use the PR template when opening a PR

.gitea/workflow-sources/deploy-to-phoenix.yml

@@ -0,0 +1,143 @@
+# Canonical deploy workflow. Keep source and checked-in workflow copies byte-identical.
+# Validation checks both file sync and main/master parity.
+#
+# Push runs validate + Phoenix only when at least one changed path is outside paths-ignore.
+# Doc/report/editor-only pushes skip CI deploy churn; use workflow_dispatch for a manual run.
+name: Deploy to Phoenix
+
+on:
+  push:
+    branches: [main, master]
+    paths-ignore:
+      # Narrative / audit text — does not change Phoenix-running code on the host
+      - 'docs/**'
+      - 'reports/**'
+      # Editor & local agent tooling
+      - '.cursor/**'
+      - '.cursorindexingignore'
+      - '.playwright-mcp/**'
+      # Repo guidance only (submodules + scripts drive deploy semantics)
+      - 'AGENTS.md'
+      # Typical local verification screenshots/bundles at repo root (regenerate at will)
+      - '/explorer-*.png'
+      - '/explorer-*.jpg'
+      - '/eip155-*.svg'
+      - '/*.tar.gz'
+  workflow_dispatch:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest-heavy
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Fetch deploy branches for workflow parity check
+        run: |
+          REMOTE="${GITEA_WORKFLOW_REMOTE:-origin}"
+          if git remote | grep -qx gitea; then
+            REMOTE="${GITEA_WORKFLOW_REMOTE:-gitea}"
+          fi
+          git fetch --depth=1 "$REMOTE" main master
+
+      - name: Install validation dependencies
+        run: |
+          corepack enable
+          pnpm install --frozen-lockfile
+
+      # The cW* mesh matrix and deployment-status validators read
+      # cross-chain-pmm-lps/config/*.json. The parent checkout does not
+      # materialize submodules by default, and .gitmodules mixes public HTTPS
+      # with SSH URLs, so clone only the required public validation dependency.
+      - name: Materialize cross-chain-pmm-lps
+        run: |
+          set -euo pipefail
+          if [ ! -f cross-chain-pmm-lps/config/deployment-status.json ]; then
+            rm -rf cross-chain-pmm-lps
+            git clone --depth=1 \
+              https://gitea.d-bis.org/d-bis/cross-chain-pmm-lps.git \
+              cross-chain-pmm-lps
+          fi
+
+      - name: Run repo validation gate
+        run: |
+          bash scripts/verify/run-all-validation.sh --skip-genesis
+
+  deploy:
+    needs: validate
+    runs-on: ubuntu-latest-heavy
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Trigger Phoenix deployment
+        run: |
+          set -euo pipefail
+          SHA="$(git rev-parse HEAD)"
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          set +e
+          curl -sSf --retry 3 --retry-connrefused --retry-delay 10 --retry-max-time 180 \
+            --connect-timeout 10 --max-time 3600 \
+            -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
+            -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\":\"${{ gitea.repository }}\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"default\"}"
+          rc="$?"
+          set -e
+          if [ "$rc" -eq 52 ]; then
+            HEALTH_URL="${{ secrets.PHOENIX_DEPLOY_URL }}"
+            HEALTH_URL="${HEALTH_URL%/api/deploy}/health"
+            echo "Phoenix deploy API restarted during self-deploy; verifying ${HEALTH_URL}"
+            for i in $(seq 1 12); do
+              if curl -fsS --max-time 5 "$HEALTH_URL"; then
+                exit 0
+              fi
+              sleep 5
+            done
+          fi
+          exit "$rc"
+
+  deploy-atomic-swap-dapp:
+    needs: deploy
+    runs-on: ubuntu-latest-heavy
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Trigger Atomic Swap dApp deployment (Phoenix)
+        run: |
+          set -euo pipefail
+          SHA="$(git rev-parse HEAD)"
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          curl -sSf \
+            --connect-timeout 10 --max-time 3600 \
+            -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
+            -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\":\"${{ gitea.repository }}\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"atomic-swap-dapp-live\"}"
+
+  # After app deploy, ask Phoenix to run path-gated Cloudflare DNS sync on the host that has
+  # PHOENIX_REPO_ROOT + .env (not on this runner). Skips unless PHOENIX_CLOUDFLARE_SYNC=1 on that host.
+  # continue-on-error: first-time or missing opt-in should not block the main deploy.
+  cloudflare:
+    needs:
+      - deploy
+      - deploy-atomic-swap-dapp
+    runs-on: ubuntu-latest-heavy
+    continue-on-error: true
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Request Cloudflare DNS sync (Phoenix)
+        run: |
+          set -euo pipefail
+          SHA="$(git rev-parse HEAD)"
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          curl -sSf --retry 5 --retry-all-errors --retry-connrefused --retry-delay 10 --retry-max-time 300 \
+            --connect-timeout 10 --max-time 900 \
+            -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
+            -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\":\"${{ gitea.repository }}\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"cloudflare-sync\"}" \
+            || { echo "Cloudflare DNS sync request failed; optional sync is non-blocking."; exit 0; }

.gitea/workflow-sources/validate-on-pr.yml

@@ -0,0 +1,35 @@
+# Canonical PR validation workflow. Keep source and checked-in workflow copies byte-identical.
+# Validation checks both file sync and main/master parity.
+# PR-only: merges to main/master run deploy-to-phoenix only when push touches deploy-relevant
+# paths (see paths-ignore there); this workflow always validates PRs without Phoenix deploy.
+name: Validate (PR)
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches: [main, master]
+  workflow_dispatch:
+jobs:
+  run-all-validation:
+    runs-on: ubuntu-latest-heavy
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Fetch deploy branches for workflow parity check
+        run: |
+          REMOTE="${GITEA_WORKFLOW_REMOTE:-origin}"
+          if git remote | grep -qx gitea; then
+            REMOTE="${GITEA_WORKFLOW_REMOTE:-gitea}"
+          fi
+          git fetch --depth=1 "$REMOTE" main master
+      - name: Install validation dependencies
+        run: |
+          corepack enable
+          pnpm install --frozen-lockfile
+      # Optional: set org/repo variable URA_STRICT_CLOSURE=1 to fail PRs while pilot placeholders
+      # remain in manifest (see scripts/ura/validate-manifest-closure.mjs). Not enabled by default.
+      # Optional: set org/repo vars ETHEREUM_MAINNET_RPC + RPC_URL_138 and EI_MATRIX_ONCHAIN_AUDIT_CI=1 to run
+      # scripts/lib/ei_matrix_onchain_readiness_audit.py via run-all-validation (see OPERATOR_READY_CHECKLIST §5e).
+      - name: run-all-validation (no LAN, no genesis)
+        env:
+          URA_STRICT_CLOSURE: ${{ vars.URA_STRICT_CLOSURE }}
+        run: bash scripts/verify/run-all-validation.sh --skip-genesis

.gitea/workflows/ai-review.yml

@@ -4,7 +4,7 @@ on:
     types: [opened, synchronize]
 jobs:
   claude-review:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-heavy
     steps:
       - uses: actions/checkout@v4
       - uses: markwylde/claude-code-gitea-action@v1.0.5

.gitea/workflows/bootstrap-phoenix-deploy-api.yml

@@ -0,0 +1,210 @@
+name: Bootstrap Phoenix Deploy API
+
+# Reinstalls phoenix-deploy-api on the dev VM (CT 5700) with the latest server.js
+# from master. This is the missing link between "code on master is the real
+# implementation" and "running service on CT 5700 still has the stub". Run this
+# workflow_dispatch job whenever phoenix-deploy-api/server.js, deploy-targets.json
+# or related scripts change and you need the running service to pick up the change
+# without a manual LAN visit.
+#
+# Required Gitea repo secrets (Settings -> Secrets):
+#   PHOENIX_PVE_HOST       PVE node IP that hosts CT 5700 (e.g. 192.168.11.12)
+#   PHOENIX_PVE_USER       SSH user on the PVE node (default: root)
+#   PHOENIX_PVE_SSH_KEY    Private SSH key (PEM, OpenSSH format) authorised on the PVE node
+#   PHOENIX_PVE_KNOWN_HOSTS  Pre-populated known_hosts entry for the PVE node (avoids strict-host prompt)
+#   PHOENIX_DEV_VM_VMID    Container VMID (default: 5700)
+#   PHOENIX_DEPLOY_DEV_VM_IP  IP of the dev VM for the post-install health check (default: 192.168.11.59)
+#   PHOENIX_DEPLOY_URL     Phoenix deploy webhook URL (already used by deploy job)
+#   PHOENIX_DEPLOY_TOKEN   Bearer token for the webhook (already used by deploy job)
+#
+# Trigger only via Gitea UI (Actions tab -> "Bootstrap Phoenix Deploy API" -> Run
+# workflow). NOT triggered on push: reinstalling the deploy service is sensitive
+# enough that we want it gated behind a manual click.
+
+on:
+  workflow_dispatch:
+    inputs:
+      verify_only:
+        description: "If true, only run the post-install /health + auth probe and skip the reinstall step."
+        type: boolean
+        required: false
+        default: false
+
+jobs:
+  bootstrap:
+    runs-on: ubuntu-latest-heavy
+    steps:
+      - name: Checkout proxmox repo
+        uses: actions/checkout@v4
+
+      - name: Validate repo layout
+        run: |
+          set -euo pipefail
+          test -d phoenix-deploy-api || { echo "phoenix-deploy-api/ missing" >&2; exit 1; }
+          test -f phoenix-deploy-api/server.js
+          test -f phoenix-deploy-api/scripts/install-systemd.sh
+          test -f phoenix-deploy-api/deploy-targets.json
+          # Manifest is optional; warn if missing but do not fail.
+          if [ ! -f config/public-sector-program-manifest.json ]; then
+            echo "::warning::config/public-sector-program-manifest.json missing — install will warn on CT"
+          fi
+          # Make sure the running master implementation is NOT the stub message
+          # that triggered this whole bootstrap thread.
+          if grep -q "Deploy request queued (stub)" phoenix-deploy-api/server.js; then
+            echo "phoenix-deploy-api/server.js still contains the stub string — refusing to bootstrap." >&2
+            exit 1
+          fi
+
+      - name: Install SSH key for PVE access
+        if: ${{ github.event.inputs.verify_only != 'true' }}
+        run: |
+          set -euo pipefail
+          mkdir -p "$HOME/.ssh"
+          chmod 700 "$HOME/.ssh"
+          umask 077
+          printf '%s\n' "${{ secrets.PHOENIX_PVE_SSH_KEY }}" > "$HOME/.ssh/id_pve"
+          chmod 600 "$HOME/.ssh/id_pve"
+          if [ -n "${{ secrets.PHOENIX_PVE_KNOWN_HOSTS }}" ]; then
+            printf '%s\n' "${{ secrets.PHOENIX_PVE_KNOWN_HOSTS }}" > "$HOME/.ssh/known_hosts"
+            chmod 644 "$HOME/.ssh/known_hosts"
+          else
+            # Fall back to accept-new on first connect; subsequent connects pin.
+            touch "$HOME/.ssh/known_hosts"
+            chmod 644 "$HOME/.ssh/known_hosts"
+          fi
+
+      - name: Build deploy bundle
+        if: ${{ github.event.inputs.verify_only != 'true' }}
+        run: |
+          set -euo pipefail
+          mkdir -p .out
+          if [ -f config/public-sector-program-manifest.json ]; then
+            tar czf .out/pda-deploy-bundle.tar.gz \
+              phoenix-deploy-api \
+              config/public-sector-program-manifest.json
+          else
+            tar czf .out/pda-deploy-bundle.tar.gz phoenix-deploy-api
+          fi
+          ls -lh .out/pda-deploy-bundle.tar.gz
+
+      - name: scp bundle to PVE host
+        if: ${{ github.event.inputs.verify_only != 'true' }}
+        env:
+          PVE_HOST: ${{ secrets.PHOENIX_PVE_HOST }}
+          PVE_USER: ${{ secrets.PHOENIX_PVE_USER }}
+        run: |
+          set -euo pipefail
+          : "${PVE_HOST:?PHOENIX_PVE_HOST not set in repo secrets}"
+          PVE_USER_VAL="${PVE_USER:-root}"
+          KNOWN_HOSTS_OPT="-o UserKnownHostsFile=$HOME/.ssh/known_hosts"
+          if [ ! -s "$HOME/.ssh/known_hosts" ]; then
+            KNOWN_HOSTS_OPT="$KNOWN_HOSTS_OPT -o StrictHostKeyChecking=accept-new"
+          else
+            KNOWN_HOSTS_OPT="$KNOWN_HOSTS_OPT -o StrictHostKeyChecking=yes"
+          fi
+          scp -i "$HOME/.ssh/id_pve" $KNOWN_HOSTS_OPT \
+            -o ConnectTimeout=20 \
+            .out/pda-deploy-bundle.tar.gz \
+            "${PVE_USER_VAL}@${PVE_HOST}:/tmp/pda-deploy-bundle.tar.gz"
+
+      - name: pct push + install-systemd on CT
+        if: ${{ github.event.inputs.verify_only != 'true' }}
+        env:
+          PVE_HOST: ${{ secrets.PHOENIX_PVE_HOST }}
+          PVE_USER: ${{ secrets.PHOENIX_PVE_USER }}
+          VMID: ${{ secrets.PHOENIX_DEV_VM_VMID }}
+        run: |
+          set -euo pipefail
+          : "${PVE_HOST:?PHOENIX_PVE_HOST not set in repo secrets}"
+          PVE_USER_VAL="${PVE_USER:-root}"
+          VMID_VAL="${VMID:-5700}"
+          KNOWN_HOSTS_OPT="-o UserKnownHostsFile=$HOME/.ssh/known_hosts"
+          if [ ! -s "$HOME/.ssh/known_hosts" ]; then
+            KNOWN_HOSTS_OPT="$KNOWN_HOSTS_OPT -o StrictHostKeyChecking=accept-new"
+          else
+            KNOWN_HOSTS_OPT="$KNOWN_HOSTS_OPT -o StrictHostKeyChecking=yes"
+          fi
+          ssh -i "$HOME/.ssh/id_pve" $KNOWN_HOSTS_OPT \
+            -o ConnectTimeout=20 \
+            "${PVE_USER_VAL}@${PVE_HOST}" "VMID=${VMID_VAL} bash -s" <<'REMOTE_EOF'
+          set -euo pipefail
+          : "${VMID:?}"
+          # Verify CT exists and is running.
+          if ! pct status "${VMID}" >/dev/null 2>&1; then
+            echo "CT ${VMID} not found on this PVE node." >&2
+            exit 1
+          fi
+          if ! pct exec "${VMID}" -- true 2>/dev/null; then
+            echo "CT ${VMID} not running. Start it first: pct start ${VMID}" >&2
+            exit 1
+          fi
+          STAGE="/tmp/proxmox-pda-stage"
+          pct push "${VMID}" /tmp/pda-deploy-bundle.tar.gz /root/pda-deploy.tar.gz
+          pct exec "${VMID}" -- bash -c "
+            set -euo pipefail
+            rm -rf '${STAGE}'
+            mkdir -p '${STAGE}'
+            tar xzf /root/pda-deploy.tar.gz -C '${STAGE}'
+            cd '${STAGE}'
+            bash phoenix-deploy-api/scripts/install-systemd.sh
+            rm -f /root/pda-deploy.tar.gz
+          "
+          rm -f /tmp/pda-deploy-bundle.tar.gz
+          REMOTE_EOF
+
+      - name: Health check (no auth)
+        env:
+          DEV_VM_IP: ${{ secrets.PHOENIX_DEPLOY_DEV_VM_IP }}
+        run: |
+          set -euo pipefail
+          IP="${DEV_VM_IP:-192.168.11.59}"
+          # Service may take a moment to come up after install; retry briefly.
+          for i in 1 2 3 4 5 6; do
+            if curl -sSf -m 5 "http://${IP}:4001/health" -o /tmp/health.json; then
+              echo "Health check OK on attempt ${i}"
+              cat /tmp/health.json || true
+              echo
+              break
+            fi
+            echo "Health check attempt ${i}/6 failed; sleeping 3s"
+            sleep 3
+            if [ "${i}" = "6" ]; then
+              echo "Phoenix Deploy API /health unreachable after install." >&2
+              exit 1
+            fi
+          done
+
+      - name: Auth + non-stub probe (POST with bogus target)
+        env:
+          PHOENIX_DEPLOY_URL: ${{ secrets.PHOENIX_DEPLOY_URL }}
+          PHOENIX_DEPLOY_TOKEN: ${{ secrets.PHOENIX_DEPLOY_TOKEN }}
+        run: |
+          set -euo pipefail
+          : "${PHOENIX_DEPLOY_URL:?}"
+          : "${PHOENIX_DEPLOY_TOKEN:?}"
+          # POST a bogus target. The post-bootstrap server should:
+          #   - accept the bearer token (NOT 401)
+          #   - reject the unknown target with a non-stub error
+          # The pre-bootstrap stub returned 202 with "Deploy request queued (stub)"
+          # for ANY target. So we explicitly check the response body does NOT
+          # contain that stub phrase.
+          BODY="$(curl -sS -m 10 -X POST "${PHOENIX_DEPLOY_URL}" \
+            -H "Authorization: Bearer ${PHOENIX_DEPLOY_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"repo":"d-bis/proxmox","sha":"HEAD","branch":"master","target":"__bootstrap_probe__"}' || true)"
+          echo "Response body:"
+          echo "${BODY}"
+          if echo "${BODY}" | grep -q 'Deploy request queued (stub)'; then
+            echo "::error::Phoenix Deploy API still returning stub response — bootstrap did not take effect."
+            exit 1
+          fi
+          if echo "${BODY}" | grep -qi 'unauthorized\|invalid token\|401'; then
+            echo "::error::Phoenix Deploy API rejected the bearer token. PHOENIX_DEPLOY_TOKEN is out of sync with PHOENIX_DEPLOY_SECRET on the CT."
+            exit 1
+          fi
+          echo "Phoenix Deploy API is post-stub and authenticating correctly."
+
+      - name: Cleanup secrets
+        if: always()
+        run: |
+          rm -f "$HOME/.ssh/id_pve" "$HOME/.ssh/known_hosts" || true

.gitea/workflows/deploy-portal-live.yml

@@ -0,0 +1,31 @@
+name: Deploy Sankofa Portal Live
+
+on:
+  workflow_dispatch:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest-heavy
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run repo validation gate
+        run: |
+          bash scripts/verify/run-all-validation.sh --skip-genesis
+
+  deploy:
+    needs: validate
+    runs-on: ubuntu-latest-heavy
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Trigger portal-live deployment
+        run: |
+          SHA="$(git rev-parse HEAD)"
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          curl -sSf -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
+            -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\":\"${{ gitea.repository }}\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"portal-live\"}"

.gitea/workflows/deploy-to-phoenix.yml

@@ -1,20 +1,143 @@
+# Canonical deploy workflow. Keep source and checked-in workflow copies byte-identical.
+# Validation checks both file sync and main/master parity.
+#
+# Push runs validate + Phoenix only when at least one changed path is outside paths-ignore.
+# Doc/report/editor-only pushes skip CI deploy churn; use workflow_dispatch for a manual run.
 name: Deploy to Phoenix
 
 on:
   push:
     branches: [main, master]
+    paths-ignore:
+      # Narrative / audit text — does not change Phoenix-running code on the host
+      - 'docs/**'
+      - 'reports/**'
+      # Editor & local agent tooling
+      - '.cursor/**'
+      - '.cursorindexingignore'
+      - '.playwright-mcp/**'
+      # Repo guidance only (submodules + scripts drive deploy semantics)
+      - 'AGENTS.md'
+      # Typical local verification screenshots/bundles at repo root (regenerate at will)
+      - '/explorer-*.png'
+      - '/explorer-*.jpg'
+      - '/eip155-*.svg'
+      - '/*.tar.gz'
+  workflow_dispatch:
 
 jobs:
+  validate:
+    runs-on: ubuntu-latest-heavy
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Fetch deploy branches for workflow parity check
+        run: |
+          REMOTE="${GITEA_WORKFLOW_REMOTE:-origin}"
+          if git remote | grep -qx gitea; then
+            REMOTE="${GITEA_WORKFLOW_REMOTE:-gitea}"
+          fi
+          git fetch --depth=1 "$REMOTE" main master
+
+      - name: Install validation dependencies
+        run: |
+          corepack enable
+          pnpm install --frozen-lockfile
+
+      # The cW* mesh matrix and deployment-status validators read
+      # cross-chain-pmm-lps/config/*.json. The parent checkout does not
+      # materialize submodules by default, and .gitmodules mixes public HTTPS
+      # with SSH URLs, so clone only the required public validation dependency.
+      - name: Materialize cross-chain-pmm-lps
+        run: |
+          set -euo pipefail
+          if [ ! -f cross-chain-pmm-lps/config/deployment-status.json ]; then
+            rm -rf cross-chain-pmm-lps
+            git clone --depth=1 \
+              https://gitea.d-bis.org/d-bis/cross-chain-pmm-lps.git \
+              cross-chain-pmm-lps
+          fi
+
+      - name: Run repo validation gate
+        run: |
+          bash scripts/verify/run-all-validation.sh --skip-genesis
+
   deploy:
-    runs-on: ubuntu-latest
+    needs: validate
+    runs-on: ubuntu-latest-heavy
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
       - name: Trigger Phoenix deployment
         run: |
-          curl -sSf -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
+          set -euo pipefail
+          SHA="$(git rev-parse HEAD)"
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          set +e
+          curl -sSf --retry 3 --retry-connrefused --retry-delay 10 --retry-max-time 180 \
+            --connect-timeout 10 --max-time 3600 \
+            -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
             -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
             -H "Content-Type: application/json" \
-            -d "{\"repo\":\"${{ gitea.repository }}\",\"sha\":\"${{ gitea.sha }}\",\"branch\":\"${{ gitea.ref_name }}\"}"
+            -d "{\"repo\":\"${{ gitea.repository }}\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"default\"}"
-        continue-on-error: true
+          rc="$?"
+          set -e
+          if [ "$rc" -eq 52 ]; then
+            HEALTH_URL="${{ secrets.PHOENIX_DEPLOY_URL }}"
+            HEALTH_URL="${HEALTH_URL%/api/deploy}/health"
+            echo "Phoenix deploy API restarted during self-deploy; verifying ${HEALTH_URL}"
+            for i in $(seq 1 12); do
+              if curl -fsS --max-time 5 "$HEALTH_URL"; then
+                exit 0
+              fi
+              sleep 5
+            done
+          fi
+          exit "$rc"
+
+  deploy-atomic-swap-dapp:
+    needs: deploy
+    runs-on: ubuntu-latest-heavy
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Trigger Atomic Swap dApp deployment (Phoenix)
+        run: |
+          set -euo pipefail
+          SHA="$(git rev-parse HEAD)"
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          curl -sSf \
+            --connect-timeout 10 --max-time 3600 \
+            -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
+            -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\":\"${{ gitea.repository }}\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"atomic-swap-dapp-live\"}"
+
+  # After app deploy, ask Phoenix to run path-gated Cloudflare DNS sync on the host that has
+  # PHOENIX_REPO_ROOT + .env (not on this runner). Skips unless PHOENIX_CLOUDFLARE_SYNC=1 on that host.
+  # continue-on-error: first-time or missing opt-in should not block the main deploy.
+  cloudflare:
+    needs:
+      - deploy
+      - deploy-atomic-swap-dapp
+    runs-on: ubuntu-latest-heavy
+    continue-on-error: true
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Request Cloudflare DNS sync (Phoenix)
+        run: |
+          set -euo pipefail
+          SHA="$(git rev-parse HEAD)"
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          curl -sSf --retry 5 --retry-all-errors --retry-connrefused --retry-delay 10 --retry-max-time 300 \
+            --connect-timeout 10 --max-time 900 \
+            -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
+            -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\":\"${{ gitea.repository }}\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"cloudflare-sync\"}" \
+            || { echo "Cloudflare DNS sync request failed; optional sync is non-blocking."; exit 0; }

.gitea/workflows/validate-on-pr.yml

@@ -0,0 +1,35 @@
+# Canonical PR validation workflow. Keep source and checked-in workflow copies byte-identical.
+# Validation checks both file sync and main/master parity.
+# PR-only: merges to main/master run deploy-to-phoenix only when push touches deploy-relevant
+# paths (see paths-ignore there); this workflow always validates PRs without Phoenix deploy.
+name: Validate (PR)
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches: [main, master]
+  workflow_dispatch:
+jobs:
+  run-all-validation:
+    runs-on: ubuntu-latest-heavy
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Fetch deploy branches for workflow parity check
+        run: |
+          REMOTE="${GITEA_WORKFLOW_REMOTE:-origin}"
+          if git remote | grep -qx gitea; then
+            REMOTE="${GITEA_WORKFLOW_REMOTE:-gitea}"
+          fi
+          git fetch --depth=1 "$REMOTE" main master
+      - name: Install validation dependencies
+        run: |
+          corepack enable
+          pnpm install --frozen-lockfile
+      # Optional: set org/repo variable URA_STRICT_CLOSURE=1 to fail PRs while pilot placeholders
+      # remain in manifest (see scripts/ura/validate-manifest-closure.mjs). Not enabled by default.
+      # Optional: set org/repo vars ETHEREUM_MAINNET_RPC + RPC_URL_138 and EI_MATRIX_ONCHAIN_AUDIT_CI=1 to run
+      # scripts/lib/ei_matrix_onchain_readiness_audit.py via run-all-validation (see OPERATOR_READY_CHECKLIST §5e).
+      - name: run-all-validation (no LAN, no genesis)
+        env:
+          URA_STRICT_CLOSURE: ${{ vars.URA_STRICT_CLOSURE }}
+        run: bash scripts/verify/run-all-validation.sh --skip-genesis

.gitignore

@@ -26,6 +26,9 @@ Thumbs.db
 # Local-only Cursor session / context (exclude from Gitea)
 .cursor/local/
 
+# Devin for Terminal personal overrides / secrets
+.devin/config.local.json
+
 # IDE files
 .vscode/
 .idea/
@@ -74,3 +77,112 @@ reconciliation/
 *.payload.json
 *.payload.sha256
 audit_log.jsonl
+
+# cross-chain-pmm-lps-publish: git worktree under that repo — not a parent submodule
+cross-chain-pmm-lps-publish/
+
+# Local scratch (never commit)
+.tmp-*.cjs
+.codex
+.codex/
+.venv-checkjson/
+.env.bak.pmg.*
+
+# Teammate / third-party onboarding (API token handoffs; never commit)
+reports/secrets/
+
+# Operator / runtime env snapshots under reports/ (sensitive; regenerate from hosts)
+reports/status/operator-*.env
+reports/status/operator-runtime*.env
+reports/status/chain138_aave_runtime.env
+reports/status/*runtime-env*.env
+reports/status/ei-matrix-eth-send*
+reports/status/token-aggregation-*.tar.gz
+config/production/*did-secrets.env
+
+# Bulky one-off local outputs (re-run scripts to restore)
+output/omnl-e2e-*.zip
+output/omnl-e2e-*/
+output/office22-*.zip
+output/settlement-events/
+output/transaction-package-*/
+output/cw-assets-usd-quote-dump.json
+output/jvmtm-evidence/
+
+# Generated verification evidence snapshots (keep curated evidence, ignore rerunnable timestamped dumps)
+docs/04-configuration/verification-evidence/e2e-verification-*/
+docs/04-configuration/verification-evidence/rpc-502-diagnostics-*.txt
+
+# Generated deployment and inventory machine outputs
+reports/deployment/*_20[0-9][0-9]-[0-9][0-9]-[0-9][0-9].md
+reports/deployment/check-deployer-lp-balances-*.json
+reports/inventory/container_inventory_*.csv
+reports/inventory/contract-inventory-*.json
+reports/inventory/DEPLOYED_CONTRACTS_*.md
+reports/inventory/INCOMPLETE_DUPLICATE_ANALYSIS.md
+reports/inventory/INVENTORY_COVERAGE_GAPS.md
+reports/inventory/deployed-contracts-completion-matrix.json
+reports/inventory/incomplete-duplicate-bytecode-analysis.json
+
+# Generated status artifacts (rerunnable from wrappers/validation scripts)
+reports/status/MULTI_NETWORK_DEPLOYMENT_AUDIT_*.md
+reports/status/*-latest.json
+reports/status/*-latest.md
+reports/status/*-latest.csv
+reports/status/*-latest.xml
+reports/status/hardware_poll_*.txt
+reports/status/lxc_cluster_health_*.json
+reports/status/lxc_cluster_health_*.txt
+reports/status/mainnet-cwusdc-usdc-preflight-*.json
+reports/status/mainnet-cwusdc-usdc-repeg-plan-*.json
+reports/status/live_inventory_*.json
+reports/status/drift_*.json
+
+# Ephemeral e2e dry-run outputs (local re-runs; not canonical reports)
+reports/e2e-dry-runs/
+
+# Local relay / thirdweb scaffold trees (subtree or vendor experiments — git add -f if promoted)
+relay/
+relay-api/
+relay-docs/
+relay-web/
+thirdweb-contracts/
+
+# One-off liquidity staging helpers (operator-generated; use committed runbooks as source of truth)
+scripts/verify/stage-250m-eth-to-cwusdc-dry-run.sh
+scripts/verify/stage-427m-cusdc-weth-liquidity-funding.sh
+
+# Large optional vendor trees and local checkouts (keep out of main clone)
+smom-dbis-138-publish/
+third-party/
+thirdweb-core-2103-test/
+tmp/
+token-aggregation-build/
+transaction-composer/
+vendor/
+
+# Operator-local secrets (SSH keys, tokens — never commit)
+.secrets/
+
+# --- Ephemeral local outputs (avoid accidental commits that re-trigger Phoenix via push) ---
+# Playwright MCP session data (Cursor)
+.playwright-mcp/
+
+# Root-level verification screenshots / bundles (use reports/status with git add -f if retaining)
+/explorer-*.png
+/explorer-*.jpg
+/eip155-*.svg
+/*.tar.gz
+
+# Operator pipeline chunks, locks, and screenshot dumps under reports/status (force-add to retain)
+reports/status/**/*.lock
+reports/status/**/*.idx
+reports/status/**/*.hex
+reports/status/**/*.jsonl
+reports/status/ei-matrix-*
+reports/status/cw-multitoken-l2-remediation-*.jsonl
+reports/status/screenshots/
+
+# Large evidence bundles / checksums under reports/status (retain outside git or use releases)
+reports/status/**/*.tar.gz
+reports/status/**/*.sha256

.gitmodules

@@ -4,7 +4,7 @@
 	# Primary integration remote is Gitea; use GitHub only as an optional mirror when available.
 [submodule "mcp-proxmox"]
 	path = mcp-proxmox
-	url = https://github.com/gilby125/mcp-proxmox.git
+	url = https://gitea.d-bis.org/d-bis/mcp-proxmox.git
 [submodule "smom-dbis-138"]
 	path = smom-dbis-138
 	url = git@github.com:Order-of-Hospitallers/smom-dbis-138.git
@@ -64,3 +64,7 @@
 [submodule "MEV_Bot"]
 	path = MEV_Bot
 	url = https://gitea.d-bis.org/d-bis/MEV_Bot.git
+[submodule "atomic-swap-dapp"]
+	path = atomic-swap-dapp
+	url = https://gitea.d-bis.org/d-bis/atomic-swap-dapp.git
+	# Local bootstrap remote for initial scaffolding; replace with canonical hosted remote before team-wide clone use.

AGENTS.md

@@ -11,23 +11,48 @@ Orchestration for Proxmox VE, Chain 138 (`smom-dbis-138/`), explorers, NPMplus,
 | Need | Location |
 |------|-----------|
 | Doc index | `docs/MASTER_INDEX.md` |
+| Master reference — token / stablecoin launch (“Bible from Nathan”) | `docs/00-meta/BIBLE_FROM_NATHAN_TOKEN_LAUNCH_RESOURCE_COMPENDIUM.md` — cross-cutting institutional compendium (regulation, custody, banking, tooling, audits, listings, checklists); use with Chain 138 canonicals below |
+| Master reference — MetaMask Money/mUSD ↔ GRU, provider cross-links, DefiLlama DODO `dfio_meta_main` TVL | `docs/00-meta/METAMASK_GRU_DEFILLAMA_CHAIN138_MASTER_REFERENCE.md` — replay steps, doc cross-links, DefiLlama-Adapters fork/PR **#19198**, touchpoints JSON maintenance |
+| DefiLlama ↔ Chain 138 (TVL + optional metrics) | `docs/04-configuration/defillama/CHAIN138_DEFILLAMA_ECOSYSTEM_MAP.md`, `config/defillama-chain138-touchpoints.json`; methodology hub [docs.llama.fi](https://docs.llama.fi/) |
+| Optional Cosmos / IBC / Noble / Osmosis / CosmWasm → Chain 138 | `docs/11-references/COSMOS_ECOSYSTEM_CHAIN138_OPTIONAL_INTEGRATIONS_RUNBOOK.md` (streams A–E); templates `config/cosmos-chain138-optional/`; **gaps audit** `docs/11-references/COSMOS_CHAIN138_GAPS_AND_INCONSISTENCIES.md` |
+| Canonical ecosystem master plan | `docs/02-architecture/DBIS_ECOSYSTEM_TECHNICAL_MASTER_PLAN.md` — umbrella root; subordinate roots: `dbis_chain_138_technical_master_plan.md`, `docs/03-deployment/DBIS_RTGS_MASTER_PLAN_IMPLEMENTATION_TRACKER.md`, `docs/04-configuration/universal-resource-activation/URA_MANIFEST_AUTOMATION_IMPLEMENTATION_TRACKER.md` |
+| Treasury / EMI / wallet / VA master plan | `docs/02-architecture/GOVERNMENT_TREASURY_EMI_WALLET_MASTER_PLAN.md` — government treasury, EMIs, digital wallets, virtual accounts (incl. Tatum-style), Rail vs RTGS gates |
+| Universal resource activation (manifest, CI, Phoenix) | `UNIVERSAL_RESOURCE_WIRING.md`, `URA_MANIFEST_AUTOMATION_IMPLEMENTATION_TRACKER.md`, `URA_OPERATIONAL_READINESS_CHECKLIST.md` (under `docs/04-configuration/universal-resource-activation/`); `config/universal-resource-activation/{manifest.json,policy-profiles.json,integration/}`; `pnpm ura:ops-readiness` / `ura:ops-readiness:full`, `ura:production-ready` / `ura:production-ready:connectivity`, `ura:validate`, `ura:validate-profiles`, `ura:merge-manifest`, `ura:validate-ledger-mapping`, `ura:writer:ledger`, `ura:writer:settlement`, `ura:profile-hash`, `ura:validate-closure`, `ura:keccak`, `ura:smoke`; `URA_STRICT_CLOSURE` / Gitea `vars.URA_STRICT_CLOSURE`; `smom-dbis-138/contracts/universal-resource/PolicyProfileRegistry.sol` (scoped forge test); Phoenix `PUBLIC_V1_NO_PARTNER_KEY_PATHS` |
+| Multi-jurisdiction compliance (matrices, onboarding) | `docs/04-configuration/compliance-matrices/README.md`, `INSTITUTION_ONBOARDING_CHARTER.md`, `INSTITUTION_ONBOARDING_PLAYBOOK.md`, `docs/04-configuration/jurisdictions/JURISDICTION_CATALOG.md`, `config/jurisdictions/catalog.v1.json`, `docs/dbis-rail/DBIS_RAIL_JURISDICTION_TRACEABILITY.md`, `docs/03-deployment/DBIS_RTGS_MASTER_PLAN_IMPLEMENTATION_TRACKER.md` |
 | cXAUC/cXAUT unit | 1 full token = 1 troy oz Au — `docs/11-references/EXPLORER_TOKEN_LIST_CROSSCHECK.md` (section 5.1) |
 | PMM mesh 6s tick | `smom-dbis-138/scripts/reserve/pmm-mesh-6s-automation.sh` — `docs/integration/ORACLE_AND_KEEPER_CHAIN138.md` (PMM mesh automation) |
 | VMID / IP / FQDN | `docs/04-configuration/ALL_VMIDS_ENDPOINTS.md` |
+| Live guest inventory + IPAM drift (LAN, seed **r630-01**) | `bash scripts/it-ops/export-live-inventory-and-drift.sh` → `reports/status/live_inventory.json`, `reports/status/drift.json` (exit **2** only on duplicate guest IPs). Collector parses QEMU **`ipconfig*`** and LXC **`net*`** via `scripts/lib/proxmox_guest_lan_ips.py`. |
 | Ops template + JSON | `docs/03-deployment/PROXMOX_VE_OPERATIONAL_DEPLOYMENT_TEMPLATE.md`, `config/proxmox-operational-template.json` |
 | Live vs template (read-only SSH) | `bash scripts/verify/audit-proxmox-operational-template.sh` |
 | Config validation | `bash scripts/validation/validate-config-files.sh` |
+| pnpm lockfile vs workspace (prevents `pnpm outdated` / importer bugs) | `bash scripts/verify/check-pnpm-workspace-lockfile.sh` — also run as **step 1b** in `run-all-validation.sh` |
+| CI validation (no LAN) + cW* mesh matrix | `bash scripts/verify/run-all-validation.sh [--skip-genesis]` — same gate as **Gitea** push/PR: `run-all-validation` in `.gitea/workflows/deploy-to-phoenix.yml` (push) and `.gitea/workflows/validate-on-pr.yml` (PR only), **`runs-on: ubuntu-latest-heavy`** (CT **5700**). After deploy, optional **Cloudflare** `cloudflare-sync` (Phoenix + `PHOENIX_REPO_ROOT`; set `PHOENIX_CLOUDFLARE_SYNC=1` on that host) via `scripts/deployment/gitea-cloudflare-sync.sh`. Steps: dependencies, **pnpm workspace/lockfile check**, config, cW* mesh (when pair-discovery exists), **`node cross-chain-pmm-lps/scripts/validate-deployment-status.cjs`**, optional genesis. Manual only: `bash scripts/verify/build-cw-mesh-deployment-matrix.sh [--json-out …]` |
+| Gitea Actions runners (heavy vs standard pool) | `docs/04-configuration/GITEA_ACT_RUNNER_SETUP.md` — **5700** `ubuntu-latest-heavy`, **5701** `ubuntu-latest`; apply configs `bash scripts/dev-vm/apply-act-runner-config.sh`; snapshot `bash scripts/dev-vm/act-runner-resource-snapshot.sh` |
 | FQDN / NPM E2E verifier | `bash scripts/verify/verify-end-to-end-routing.sh --profile=public` — inventory: `docs/04-configuration/E2E_ENDPOINTS_LIST.md`. Gitea Actions URLs (no API): `bash scripts/verify/print-gitea-actions-urls.sh` |
 | Submodule trees clean (CI / post-merge) | `bash scripts/verify/submodules-clean.sh` |
-| Submodule + explorer remotes | `docs/00-meta/SUBMODULE_HYGIENE.md` |
+| Submodule + explorer remotes | `docs/00-meta/SUBMODULE_HYGIENE.md` — `mcp-proxmox` uses **Gitea** `https://gitea.d-bis.org/d-bis/mcp-proxmox.git` (not the old GitHub-only URL). `cross-chain-pmm-lps-publish` is a **worktree** of `cross-chain-pmm-lps`, not a submodule. |
 | smom-dbis-138 `.env` in bash scripts | Prefer `source smom-dbis-138/scripts/lib/deployment/dotenv.sh` + `load_deployment_env --repo-root "$PROJECT_ROOT"` (trims RPC URL line endings). From an interactive shell: `source smom-dbis-138/scripts/load-env.sh`. Proxmox root scripts: `source scripts/lib/load-project-env.sh` (also trims common RPC vars). |
 | Sankofa portal → CT 7801 (build + restart) | `./scripts/deployment/sync-sankofa-portal-7801.sh` (`--dry-run` first); sets `NEXTAUTH_URL` on CT via `sankofa-portal-ensure-nextauth-on-ct.sh` |
+| Gov Portals (CT **7804** @ `IP_GOV_PORTALS_DEV`, r630-04): rebase from Gitea then build + sync | `./scripts/deployment/gov-portals-git-pull-rebase.sh` then `./scripts/deployment/sync-gov-portals-ct-7804-from-git.sh` — `GITEA_TOKEN` in `.env`; sync defaults to **pull --rebase** (use `--reset-hard` to mirror Gitea and discard local changes); optional `--skip-fetch`. Source-of-truth and Phoenix paths: `docs/04-configuration/GITEA_GOV_PORTALS_LIVE_SOURCE_OF_TRUTH.md`; ops template: `docs/04-configuration/GOV_PORTALS_XOM_DEV_DEPLOYMENT.md`. Optional Gitea tag: `scripts/deployment/gitea-tag-repo-release.sh`. |
 | CCIP relay (r630-01 host) | Unit: `config/systemd/ccip-relay.service` → `/etc/systemd/system/ccip-relay.service`; `systemctl enable --now ccip-relay` |
 | TsunamiSwap VM 5010 check | `./scripts/deployment/tsunamiswap-vm-5010-provision.sh` (inventory only until VM exists) |
+| Solana native SOL (robust JSON-RPC submit) | `scripts/lib/solana_jsonrpc.py` (stdlib `sendTransaction`), `./scripts/deployment/solana-transfer-native.py` (sign with `solders`). Install: `pip install -r scripts/lib/requirements-solana-ops.txt`. Avoids solana-py `SendTransactionResp` parse failures on RPCs that return only a signature string. Env: `SOLANA_RPC_URL`, `SOLANA_KEYPAIR_PATH` via `source scripts/lib/load-project-env.sh`. |
 | The Order portal (`https://the-order.sankofa.nexus`) | OSJ management UI (secure auth); source repo **the_order** at `~/projects/the_order`. NPM upstream defaults to **order-haproxy** CT **10210** (`IP_ORDER_HAPROXY:80`); use `THE_ORDER_UPSTREAM_*` to point at the Sankofa portal if 10210 is down. Provision HAProxy: `scripts/deployment/provision-order-haproxy-10210.sh`. **`www.the-order.sankofa.nexus`** → **301** apex (same as www.sankofa / www.phoenix). |
 | Portal login + Keycloak systemd + `.env` (prints password once) | `./scripts/deployment/enable-sankofa-portal-login-7801.sh` (`--dry-run` first) |
 | Completable (no LAN) | `./scripts/run-completable-tasks-from-anywhere.sh` |
-| Operator (LAN + secrets) | `./scripts/run-all-operator-tasks-from-lan.sh` (use `--skip-backup` if `NPM_PASSWORD` unset) |
+| **EI matrix → mainnet cWUSDC transfer** | `./scripts/deployment/send-cwusdc-ei-matrix-wallets.sh` — `transfer` from signer to grid slice (`--send-raw` / `--total-send-raw`); resume: `continue-cwusdc-ei-matrix-wallets.sh`. |
+| **EI matrix top-up TSV from audit** | `scripts/verify/build-ei-matrix-cwusdc-topup-tsv-from-audit-json.sh` — rebuilds `ei-matrix-cwusdc-topup-*.tsv` from `ei-matrix-readiness-audit-latest.json`. |
+| **EI matrix → Multicall3 cWUSDC (preferred)** | `./scripts/deployment/send-cwusdc-ei-matrix-multicall-batches.sh` — Multicall3 `aggregate3` + `transferFrom`; `EI_MATRIX_MC_CHUNK` (default 200). Core: `scripts/lib/ei_matrix_multicall3_cwusdc_batch.py`. Fallback: `send-cwusdc-ei-matrix-targeted.sh` (1 tx/wallet). Pipeline: `pipeline-ei-matrix-remediate-cwusdc-from-audit.sh --multicall`. |
+| **EI matrix → mainnet cWUSDC mint** | `./scripts/deployment/pipeline-ei-matrix-mint-cwusdc.sh` — mints `CWUSDC_MAINNET` to each wallet in `config/pmm-soak-wallet-grid.json` (see `docs/03-deployment/EI_MATRIX_CWUSDC_MINT_PIPELINE.md`). Core: `mint-cwusdc-ei-matrix-wallets.sh`; resume: `continue-mint-cwusdc-ei-matrix-wallets.sh`. Not a 138 bridge. |
+| **EI matrix on-chain readiness (cWUSDC / 138 cUSDC)** | `./scripts/verify/run-ei-matrix-full-readiness-audit.sh` — full grid, sharded (`--shard-size`, env `EI_MATRIX_AUDIT_*`), writes JSON + gap index files. Ad hoc: `./scripts/verify/audit-ei-matrix-onchain-readiness.sh`. Optional CI: `EI_MATRIX_ONCHAIN_AUDIT_CI=1` in `scripts/verify/run-all-validation.sh`. Core: `scripts/lib/ei_matrix_onchain_readiness_audit.py`. |
+| smom-dbis-138 root `forge test` | Uses `foundry.toml` `[profile.default] skip` for legacy Uniswap V2 vendor trees (0.5/0.6 solc); scoped work still uses `bash scripts/forge/scope.sh …` |
+| cWUSDT Mainnet USD pricing (on-chain + runbook) | `./scripts/deployment/price-cw-token-mainnet.sh` — `docs/03-deployment/CW_TOKEN_USD_PRICING_RUNBOOK.md` |
+| Deployer LP balances (mesh inventory) | `python3 scripts/deployment/check-deployer-lp-balances.py` — scans `deployment-status.json` + `reports/extraction/promod-uniswap-v2-live-pair-discovery-latest.json`; **UniV2** `lpToken` = pair; **DODO DVM** LP shares = `balanceOf(pool)`; on failure, probes `_BASE_TOKEN_` / `_BASE_CAPITAL_TOKEN_` / `_QUOTE_CAPITAL_TOKEN_` + extra public RPCs (`--no-resolve-dodo` skips; `--chain-id N` for one chain). JSON: `lpTokenAddress`, `lpResolution`, `lpBalances[]`. Use `--deployer` / `DEPLOYER_ADDRESS` if no `PRIVATE_KEY` |
+| Etherscan Value $0 for Mainnet `cW*` | Listing path (CoinGecko/CMC), not a contract toggle — `docs/04-configuration/coingecko/ETHERSCAN_USD_VALUE_MAINNET_TOKENS.md` |
+| Verify contracts on explorers (all networks) | `cd smom-dbis-138 && ./scripts/deployment/verify-all-networks-explorers.sh` — Blockscout 138, Etherscan + multichain `cW*`, Avax/Arb bridges, optional Cronos/Wemix/CCIPLogger |
+| Operator (LAN + secrets) | `./scripts/run-all-operator-tasks-from-lan.sh` (use `--skip-backup` if `NPM_PASSWORD` unset; backup also needs `NPM_EMAIL` in `.env`) |
+| Remote SSH to dev VM (5700 / `192.168.11.59`) for runner & deploy API | [DEV_VM_SSH_REMOTE_ACCESS.md](docs/04-configuration/DEV_VM_SSH_REMOTE_ACCESS.md); **move workstation `~/projects` → Dev VM:** [DEV_VM_WORKSTATION_MIGRATION_RUNBOOK.md](docs/04-configuration/DEV_VM_WORKSTATION_MIGRATION_RUNBOOK.md), `scripts/deployment/sync-local-projects-to-dev-vm.sh` (rsync code 23 on `--delete-remote`: `scripts/deployment/fix-dev-vm-srv-projects-ownership.sh`) |
 | Cloudflare bulk DNS → `PUBLIC_IP` | `./scripts/update-all-dns-to-public-ip.sh` — use **`--dry-run`** and **`--zone-only=sankofa.nexus`** (or `d-bis.org` / `mim4u.org` / `defi-oracle.io`) to limit scope; see script header. Prefer scoped **`CLOUDFLARE_API_TOKEN`** (see `.env.master.example`). |
 
 ## Git submodules

README.md

@@ -90,6 +90,14 @@ From the root directory, you can run:
 - `pnpm frontend:build` - Build the ProxmoxVE frontend for production
 - `pnpm frontend:start` - Start the production frontend server
 
+### Mission Control (unified operator console)
+
+- `pnpm mission-control:dev` - Next.js console on **http://localhost:3010** (launchpad + guided runbooks + live run trace + audit ZIP)
+- `pnpm mission-control:build` / `pnpm mission-control:start` - Production build and server
+- `pnpm mission-control:test` - Executor smoke test (real allowlisted child process)
+
+See [mission-control/README.md](mission-control/README.md) and [mission-control/TIMELINE.md](mission-control/TIMELINE.md).
+
 ### Testing
 
 - `pnpm test` - Run tests (if available)

config/aggregator-route-matrix.csv

@@ -20,7 +20,5 @@ liveBridgeRoute,138-WETH-25-ccip,live,bridge,138,25,WETH,0xC02aaA39b223FE8D0A0e5
 liveBridgeRoute,138-WETH-42220-ccip,live,bridge,138,42220,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
 liveBridgeRoute,138-WETH-651940-alltra,live,bridge,138,651940,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,ALT,0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc,LiFi,,,,
 liveBridgeRoute,138-WETH10-1-ccip,live,bridge,138,1,WETH10,0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f,WETH10,0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f,,CCIP,0xe0E93247376aa097dB308B92e6Ba36bA015535D0,LiFi,,,,
-blockedOrPlannedRoute,138-compliant-stable-to-weth-bridgeable,blocked,swap-bridge-swap,138,1,cUSDT|cUSDC|cEURT,,,,,,,,,,,"No live public cUSDT/WETH, cUSDC/WETH, or cEURT/WETH pool on Chain 138."
+blockedOrPlannedRoute,651940-public-dex-routes,planned,swap,651940,651940,,,,,,,,,,,,Alltra same-chain settlement remains documentation-only: no deployed PMM or Uniswap venue inventory is published in canonical deployment status, and HYDX/AlltraDEX router-factory-pool addresses are still not committed in-repo.
-blockedOrPlannedRoute,651940-public-dex-routes,planned,swap,651940,651940,,,,,,,,,,,,Uniswap V2/V3 and DODO are env placeholders only; no pool addresses are documented in-repo.
+blockedOrPlannedRoute,138-weth-1111-ccip,planned,bridge,138,1111,,,,,,,,,,,,"Wemix bridge contracts are deployed and destinations are wired, but the current Chain 138 CCIP router still rejects the Wemix selector with `CCIPRouter: chain not supported`; the WEMIX-side LINK balances are also zero and no successful proof transfer has been recorded."
-blockedOrPlannedRoute,cw-edge-pools-public-chains,planned,swap,1,43114,,,,,,,,,,,,"cW* token addresses exist on several public chains, but deployment-status.json contains no PMM pools."
-blockedOrPlannedRoute,138-weth-1111-ccip,planned,bridge,138,1111,,,,,,,,,,,,Wemix bridge is pending funding and deployment.

config/all-mainnet-canary-evidence.example.json

@@ -0,0 +1,23 @@
+{
+  "description": "Copy to config/all-mainnet-canary-evidence.json after live canary swaps. Each row needs real transaction hashes and observed balance deltas.",
+  "evidence": [
+    {
+      "poolId": "651940-uniswap_v2-wall-ausdc",
+      "status": "canary_passed",
+      "generatedAt": "2026-04-29T00:00:00.000Z",
+      "canaryTransactions": [
+        {
+          "amountLabel": "seed",
+          "txHash": "0x0000000000000000000000000000000000000000000000000000000000000000",
+          "sourceToken": "WALL",
+          "destinationToken": "AUSDC",
+          "observedInputRaw": "0",
+          "observedOutputRaw": "0"
+        }
+      ],
+      "notes": [
+        "Replace with real canary transaction evidence before applying."
+      ]
+    }
+  ]
+}

config/all-mainnet-canary-evidence.json

@@ -0,0 +1,498 @@
+{
+  "description": "ALL Mainnet canary evidence recorded from live canary transactions executed with deployer wallet 0x4A666F96fC8764181194447A7dFdb7d471b301C8.",
+  "evidence": [
+    {
+      "poolId": "651940-dodo_pmm-wall-ausdc",
+      "generatedAt": "2026-04-29T04:41:13.993Z",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x727cea66f601b514b0d82c4bc93c29fbc09047e8185c146a05564dce7916829c",
+          "fundingTransferTxHash": "0x65f8d2e15556c26b46dd7323a90cb174279fc6bd0e7002a868553dc990bfa656",
+          "amountInRaw": "1000000",
+          "tokenIn": "WALL",
+          "tokenOut": "AUSDC",
+          "executor": "DODO_DVM.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Tiny live canary swap executed on ALL Mainnet DODO PMM WALL/AUSDC."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "651940-uniswap_v2-wall-ausdc",
+      "generatedAt": "2026-04-29T04:41:13.993Z",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x0b76149f25e36919637fbeab10056e45d8ab7757454174966842c3f52f53dd5c",
+          "approvalTxHash": "0xc33d872d15628cfe521552ccc9a4b908f31df59189764468775b4557826514b6",
+          "amountInRaw": "1000000",
+          "tokenIn": "WALL",
+          "tokenOut": "AUSDC",
+          "executor": "UniswapV2Router.swapExactTokensForTokens"
+        }
+      ],
+      "notes": [
+        "Tiny live canary swap executed on ALL Mainnet Uniswap V2 WALL/AUSDC."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "651940-dodo_pmm-wall-ausdt",
+      "generatedAt": "2026-04-30T06:58:00Z",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x6b74c3b6816eb67409268a6e3b108fd631d278baf0fd57524a63c60c995bded3",
+          "fundingTransferTxHash": "0x2e1540c484abac9049e383a16fc35a5b6b81a33bd70183b80b20f94533dbe141",
+          "amountInRaw": "1000000",
+          "tokenIn": "WALL",
+          "tokenOut": "AUSDT",
+          "executor": "DODO_DVM.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Tiny live canary swap executed on ALL Mainnet DODO PMM WALL/AUSDT."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "137-dodo_pmm-cwusdc-usdc",
+      "generatedAt": "2026-04-29T04:41:13.993Z",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x4f68cdb0502b0fd50602013e54cbf898556a5c1181d8009f9b0c166dfccf5ce7",
+          "fundingTransferTxHash": "0x2b2721dd505f82488b05f32810f7e94b3a712e9b459b638be9b8ea34c20925d9",
+          "amountInRaw": "1",
+          "tokenIn": "cWUSDC",
+          "tokenOut": "USDC",
+          "executor": "DODO_DVM.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Tiny live canary swap executed on Polygon DODO PMM cWUSDC/USDC."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "137-dodo_pmm-cwusdt-usdt",
+      "generatedAt": "2026-04-29T04:41:13.993Z",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x9c946c7c912e2eabe960c752041b533948e85e2a1603c80de80c5b0ee447908d",
+          "fundingTransferTxHash": "0xcac8b9187325869f164f6b7cd5464fcf46dce6be83ef04d760e7ecc21de7d40d",
+          "amountInRaw": "1",
+          "tokenIn": "cWUSDT",
+          "tokenOut": "USDT",
+          "executor": "DODO_DVM.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Tiny live canary swap executed on Polygon DODO PMM cWUSDT/USDT."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "651940-uniswap_v2-usdt-ausdc",
+      "generatedAt": "2026-04-30T07:30:00Z",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0xa5479400c203922b0e29a4c438daeeeef6f99b847d617f029e7978c1beba6b2b",
+          "approvalTxHash": "0xe4e73ff7d9c4a998e4cca1fcbf847d351171c0c026b11e798a0c1dc2bb6b4f12",
+          "fundingSwapTxHash": "0x39bddcca6160e2df5c7595350f9d911c73e0e7bfe59595fae2c3248576962d5b",
+          "fundingApprovalTxHash": "0x238bae3818d16a95711c19657dbd08bc076ef3fde7fedb7291ed514d2e090684",
+          "amountInRaw": "1000000",
+          "tokenIn": "USDT",
+          "tokenOut": "AUSDC",
+          "executor": "UniswapV2Router.swapExactTokensForTokens"
+        }
+      ],
+      "notes": [
+        "Tiny live canary swap executed on ALL Mainnet Uniswap V2 USDT/AUSDC after acquiring USDT inventory via AUSDC/USDT."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "651940-uniswap_v2-wall-usdt",
+      "generatedAt": "2026-04-30T07:30:00Z",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x7b6a3d5dedc775e9b0f73de4e0a89bdd004f82c451d7cccf1e2178e5893d487c",
+          "approvalTxHash": "0xdd7985b4535915523831f989e054e6333af6b84e589c67791e73cce7acbff6a6",
+          "amountInRaw": "1000000",
+          "tokenIn": "WALL",
+          "tokenOut": "USDT",
+          "executor": "UniswapV2Router.swapExactTokensForTokens"
+        }
+      ],
+      "notes": [
+        "Tiny live canary swap executed on ALL Mainnet Uniswap V2 WALL/USDT."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "42220-dodo_pmm-cwusdc-usdc",
+      "generatedAt": "2026-04-30T00:00:00.000-07:00",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x32d3869f987d558e392fd01aab77968d9cad1d90da71be1db90061f58d5c14b1",
+          "fundingTransferTxHash": "0x8ecd2a68f5dc3f2ab471ccc7ea8fdce16064029b6792bce7a387d943326fa1d6",
+          "amountInRaw": "100",
+          "tokenIn": "cWUSDC",
+          "tokenOut": "USDC",
+          "executor": "DODO_DVM.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Tiny live canary swap executed on Celo DODO PMM cWUSDC/USDC after deployer-funded seed liquidity."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "42220-dodo_pmm-cwusdt-usdt",
+      "generatedAt": "2026-04-30T00:00:00.000-07:00",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x0498a0484f6707e0f8019b8803a8aed932f33f587a57186cc37bcdc594393094",
+          "fundingTransferTxHash": "0xd4182a6e116df30544097851892f379d67af2b33fc2374bb0204a6450dcecea4",
+          "amountInRaw": "100",
+          "tokenIn": "cWUSDT",
+          "tokenOut": "USDT",
+          "executor": "DODO_DVM.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Tiny live canary swap executed on Celo DODO PMM cWUSDT/USDT after deployer-funded seed liquidity."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "56-dodo_pmm-cwusdc-usdc",
+      "generatedAt": "2026-04-30T09:05:02.700Z",
+      "sourceFile": "config/all-mainnet-canary-evidence.json",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x85a62d3d5b23878ec17a6fa7b89e7f8218970cae7a99a9b4b7fd4bd9756e70ea",
+          "fundingTransferTxHash": "0x86081d0142d9d35062873599754cd7ea70f02449c002fa4f94f5673cccafdc6c",
+          "amountInRaw": "100",
+          "tokenIn": "cWUSDC",
+          "tokenOut": "USDC",
+          "executor": "MockDVMPool.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Replacement pool canary swap executed after replacing nonstandard DODO surface."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "56-dodo_pmm-cwusdt-usdt",
+      "generatedAt": "2026-04-30T09:05:02.700Z",
+      "sourceFile": "config/all-mainnet-canary-evidence.json",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x4a1373fb637f26bb2e9e1f05db333081ec9beeb70d03f7085c57700902ab41e3",
+          "fundingTransferTxHash": "0xb4b952d588be03f8a59bfb38cc71311d2191de86373f59248b11f9b9c59bf1bc",
+          "amountInRaw": "100",
+          "tokenIn": "cWUSDT",
+          "tokenOut": "USDT",
+          "executor": "MockDVMPool.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Replacement pool canary swap executed after replacing nonstandard DODO surface."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "8453-dodo_pmm-cwusdc-usdc",
+      "generatedAt": "2026-04-30T09:05:02.700Z",
+      "sourceFile": "config/all-mainnet-canary-evidence.json",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0xe1fd7a1268cbb205ef3f47cc730cc1a06b5b81f491fc86ad6a2c7cef355c0752",
+          "fundingTransferTxHash": "0xe2ffeff928685f8fc4c050e0c6736d10c0ea48a65d65fe7c2ea560b3729ce5b8",
+          "amountInRaw": "100",
+          "tokenIn": "cWUSDC",
+          "tokenOut": "USDC",
+          "executor": "MockDVMPool.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Replacement pool canary swap executed after replacing nonstandard DODO surface."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "8453-dodo_pmm-cwusdt-usdt",
+      "generatedAt": "2026-04-30T09:05:02.700Z",
+      "sourceFile": "config/all-mainnet-canary-evidence.json",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x6c9e3129cd8b9f81022b27160e3bbce828f033afb40b670742318df67b309126",
+          "fundingTransferTxHash": "0xa6b837616c42073f6afb85bc0a6a4cab77dfe1e3925fd5bfbe7d1a92c31c4f57",
+          "amountInRaw": "100",
+          "tokenIn": "cWUSDT",
+          "tokenOut": "USDT",
+          "executor": "MockDVMPool.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Replacement pool canary swap executed after replacing nonstandard DODO surface."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "42161-dodo_pmm-cwusdt-usdt",
+      "generatedAt": "2026-04-30T09:05:02.700Z",
+      "sourceFile": "config/all-mainnet-canary-evidence.json",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0xb27ffc20e1b993751342d7a76da70c1ec6190a4f67f52313b36beb0e9d49a12a",
+          "fundingTransferTxHash": "0x6cbeec16f67bb92df6bfbe0659c3d6098c96bd32b5917d001fb53587fa988d8a",
+          "amountInRaw": "100",
+          "tokenIn": "cWUSDT",
+          "tokenOut": "USDT",
+          "executor": "MockDVMPool.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Replacement pool canary swap executed after replacing nonstandard DODO surface."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "43114-dodo_pmm-cwusdc-usdc",
+      "generatedAt": "2026-04-30T09:05:02.700Z",
+      "sourceFile": "config/all-mainnet-canary-evidence.json",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0xfdbea3b4a196335b0b128befbd43a17916f2ec95787ab99651cbfd355e2bd2e5",
+          "fundingTransferTxHash": "0x4bafb7ecf6988bac594860bb9d2f33030557b467d09c371033ae4f4867469550",
+          "amountInRaw": "100",
+          "tokenIn": "cWUSDC",
+          "tokenOut": "USDC",
+          "executor": "MockDVMPool.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Replacement pool canary swap executed after replacing nonstandard DODO surface."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "43114-dodo_pmm-cwusdt-usdt",
+      "generatedAt": "2026-04-30T09:05:02.700Z",
+      "sourceFile": "config/all-mainnet-canary-evidence.json",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x6aa323b5d4abae31ef13f2d01972725fa8c939aee9fbd8326aad4910e3a33c91",
+          "fundingTransferTxHash": "0x8f1d905595aa540e32bcefd03a146dca39bce6aafe6d14d5b6731c583cb922f6",
+          "amountInRaw": "100",
+          "tokenIn": "cWUSDT",
+          "tokenOut": "USDT",
+          "executor": "MockDVMPool.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Replacement pool canary swap executed after replacing nonstandard DODO surface."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "25-dodo_pmm-cwusdc-usdc",
+      "generatedAt": "2026-04-30T09:05:02.700Z",
+      "sourceFile": "config/all-mainnet-canary-evidence.json",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x3d4fbd2ffdec9b2402cfa391b49dab9918ed30def3cd6edc43e4d6cae502df72",
+          "fundingTransferTxHash": "0x539702d9d5808c579023bc52f54bacb0327d886b6f969ae5d2830bd286749692",
+          "amountInRaw": "100",
+          "tokenIn": "cWUSDC",
+          "tokenOut": "USDC",
+          "executor": "MockDVMPool.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Replacement pool canary swap executed after replacing nonstandard DODO surface."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "25-dodo_pmm-cwusdt-usdt",
+      "generatedAt": "2026-04-30T09:05:02.700Z",
+      "sourceFile": "config/all-mainnet-canary-evidence.json",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0xd97ce616c7074301d66163a880798bf6a2165140320ccc440f80581972915fe0",
+          "fundingTransferTxHash": "0x3beff83366f24ba3fa0cec70aaae08b3edce1d1e8d56a9fbd094de97d5d653e7",
+          "amountInRaw": "100",
+          "tokenIn": "cWUSDT",
+          "tokenOut": "USDT",
+          "executor": "MockDVMPool.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Replacement pool canary swap executed after replacing nonstandard DODO surface."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "100-dodo_pmm-cwusdc-usdc",
+      "generatedAt": "2026-04-30T09:05:02.700Z",
+      "sourceFile": "config/all-mainnet-canary-evidence.json",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0xc63f257b2dc91621c4a260af3b88068ae92d2390cbbf44b4a971551b4b8b1c21",
+          "fundingTransferTxHash": "0x4c2bfe8c3cbe4d35121489448fd93d7d61e48812574485c0a4afe3aff4e7522e",
+          "amountInRaw": "100",
+          "tokenIn": "cWUSDC",
+          "tokenOut": "USDC",
+          "executor": "MockDVMPool.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Replacement pool canary swap executed after replacing nonstandard DODO surface."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "100-dodo_pmm-cwusdt-usdt",
+      "generatedAt": "2026-04-30T09:05:02.700Z",
+      "sourceFile": "config/all-mainnet-canary-evidence.json",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x29538d2cbd34b2f726fa8f696037dd176e0c463d7cc98ee6d4686182b0602b7d",
+          "fundingTransferTxHash": "0x864c92f1ef26b949d6ad4178e063846bf9c85bb9d5d516de4e63e2afb147fc48",
+          "amountInRaw": "100",
+          "tokenIn": "cWUSDT",
+          "tokenOut": "USDT",
+          "executor": "MockDVMPool.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Replacement pool canary swap executed after replacing nonstandard DODO surface."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "1-dodo_pmm-cwusdc-usdc",
+      "generatedAt": "2026-04-30T09:15:42.476Z",
+      "sourceFile": "config/all-mainnet-canary-evidence.json",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0xb485735ec59594e7a83d91feb98350cac490d28b0fc0418674d29e64dd93f0a5",
+          "fundingTransferTxHash": "0x80b2e141625a78c870ad80875ccc3fab0aa3d4ed6b64e324239fc9b30caed54c",
+          "amountInRaw": "100",
+          "tokenIn": "cWUSDC",
+          "tokenOut": "USDC",
+          "executor": "MockDVMPool.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Replacement pool canary swap executed after replacing nonstandard DODO surface."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "1-dodo_pmm-cwusdt-usdt",
+      "generatedAt": "2026-04-30T09:15:42.476Z",
+      "sourceFile": "config/all-mainnet-canary-evidence.json",
+      "canaryTransactions": [
+        {
+          "direction": "quote_to_base",
+          "txHash": "0x6407c89bed9b1631a793c63e0a1f17d8be994eda7b56dbc25b94377df4dada9a",
+          "fundingTransferTxHash": "0x829936195c802b93b385fb9bb1c75ed3e657319a7e89433a1e9e2581761b49ea",
+          "amountInRaw": "100",
+          "tokenIn": "USDT",
+          "tokenOut": "cWUSDT",
+          "executor": "MockDVMPool.transfer_then_sellQuote"
+        }
+      ],
+      "notes": [
+        "Replacement pool reverse canary swap executed after replacing nonstandard DODO surface; quote-to-base path avoids mainnet USDT non-standard transfer return behavior on sellBase."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "42161-dodo_pmm-cwusdc-usdc",
+      "generatedAt": "2026-04-30T11:18:00.000Z",
+      "sourceFile": "config/all-mainnet-canary-evidence.json",
+      "status": "production",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x1c8aee3f0a3d7c3dfd1c53471b65a56fe34d514b84721fef2eafd40581259997",
+          "fundingTransferTxHash": "0x020a5c922757816f82542cd0d0e623b8120db9b2816de528b110854d3164cd9f",
+          "amountInRaw": "100",
+          "tokenIn": "cWUSDC",
+          "tokenOut": "USDC",
+          "executor": "DODO_DVM.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Official DODO DVM canary swap executed after DODOAtomicSeeder funding."
+      ]
+    },
+    {
+      "poolId": "10-dodo_pmm-cwusdc-usdc",
+      "generatedAt": "2026-04-30T09:24:25.038Z",
+      "sourceFile": "config/all-mainnet-canary-evidence.json",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x8b27405ff031288cb8f298309b10742efc844ab22d515c731a61c0e7054295e9",
+          "fundingTransferTxHash": "0xf7f089b5e1aa6b52f414de874ebd94f6f7b23da1dfc9158e9da63b21ea9aa10c",
+          "amountInRaw": "100",
+          "tokenIn": "cWUSDC",
+          "tokenOut": "USDC",
+          "executor": "MockDVMPool.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Replacement pool canary swap executed on Optimism after replacing nonstandard DODO surface."
+      ],
+      "status": "production"
+    },
+    {
+      "poolId": "10-dodo_pmm-cwusdt-usdt",
+      "generatedAt": "2026-04-30T09:36:38.117Z",
+      "sourceFile": "config/all-mainnet-canary-evidence.json",
+      "canaryTransactions": [
+        {
+          "direction": "quote_to_base",
+          "txHash": "0xf3244685f8e0a0704d549a2bf9a980380c5fb06611e1765e77caf1a62238b506",
+          "fundingTransferTxHash": "0xdb912224b13137710b1723ff3b5fc9c7b752a642ffc1fc4a9e1a277a0bedf147",
+          "amountInRaw": "100",
+          "tokenIn": "USDT",
+          "tokenOut": "cWUSDT",
+          "executor": "MockDVMPool.transfer_then_sellQuote"
+        }
+      ],
+      "notes": [
+        "Replacement pool reverse canary swap executed on Optimism after retained seed remediation and successful buyShares."
+      ],
+      "status": "production"
+    }
+  ]
+}

config/all-mainnet-enhanced-router-deployment.json

@@ -0,0 +1,147 @@
+{
+  "name": "ALL Mainnet Enhanced Router Deployment Evidence",
+  "version": "0.1.0",
+  "generatedAt": "2026-04-29T05:52:00Z",
+  "chainId": 651940,
+  "network": "ALL Mainnet (Alltra)",
+  "evmVersion": "paris",
+  "reason": "ALL Mainnet RPC/runtime rejected Cancun bytecode with BadInstruction; Paris bytecode was used for live deployment.",
+  "deployer": "0x4A666F96fC8764181194447A7dFdb7d471b301C8",
+  "contracts": {
+    "dodoPmmProvider": {
+      "address": "0x36F65027D21e151F0b7810bae1E94b225AC7Ba9e",
+      "transactionHash": "0xd2e69b556e84786338fd526ba149d1f88488a07190d081f935d7fffbe9d1b2e0",
+      "constructorArgs": {
+        "dodoPmmIntegration": "0x8528E268F3b8C94208d09D131ACa3Ea93Bad57c7",
+        "admin": "0x4A666F96fC8764181194447A7dFdb7d471b301C8"
+      }
+    },
+    "enhancedSwapRouterV2": {
+      "address": "0xb905fEfA56b028221E2Bc248Bbcd41141dc7aeD3",
+      "transactionHash": "0x2c5d409b6e06cbfb69d8e251240d830d624625a4d505cc963edb65b55623bc79",
+      "constructorArgs": {
+        "weth": "0x798F6762BB40d6801A593459d08F890603D3979C",
+        "usdt": "0x66D8Efa0AF63B0e84eb1Dd72bf00f00cd1e2234e",
+        "usdc": "0xa95EeD79f84E6A0151eaEb9d441F9Ffd50e8e881",
+        "daiSlot": "0x015B1897Ed5279930bC2Be46F661894d219292A6",
+        "daiSlotNote": "AUSDT is used as the third stablecoin slot for ALL Mainnet; no canonical ALL DAI token is committed."
+      }
+    },
+    "intentBridgeCoordinatorV2": {
+      "address": "0x9276ae27d9c624B43dbE43494f34A9c5F0233a0B",
+      "transactionHash": "0x5695b3f9ec59e09d5e4f8569ea8af31578ced0a56aba885a7c475a5187aadd3d"
+    },
+    "adapters": {
+      "dodo": {
+        "address": "0x391D192BED6188c4DaB4C93c078bD18432687474",
+        "transactionHash": "0xc4a036a6fff5eb9886e797559017cf8709505d13f39f5feddf055967cf9b4648",
+        "enabled": true
+      },
+      "dodoV3": {
+        "address": "0x97Ce874142625134aEEBDF42B5E7bB806e731D25",
+        "transactionHash": "0x5ad21f59b823adbc2cebc1e9c45ab3f8f0f1286e46a290c09c0667f499577136",
+        "enabled": false
+      },
+      "uniswapV3": {
+        "address": "0xBF75F3401de20bebBB1CBb678499941807E3E040",
+        "transactionHash": "0x081b86cc99306e694ef9daa3d3f9dc7f35ce91dce08c57ddaedcdd4b9a00008d",
+        "enabled": false
+      },
+      "balancer": {
+        "address": "0xDE7F15AF1D84e3694f7E966293d20e64Fc04d9fF",
+        "transactionHash": "0xa4f30c029fa062ae1b481786950ab0243541ce5b0b859fc534b55f7b444ba83c",
+        "enabled": false
+      },
+      "curve": {
+        "address": "0x753D2b0a723992D7B174D6e19F7b7Cb74be8D61a",
+        "transactionHash": "0xcdf0ff9723aedab96aeaa0b8f57f25ad6075f9467e0d19f3b842fb17c0bb6a79",
+        "enabled": false
+      },
+      "oneInch": {
+        "address": "0x487090bbb7d17875281692d582a11B445b3A7AC7",
+        "transactionHash": "0x4d0dd682b8e22812a258fee497c07e5cecfbc1228f413e67d9fe7b24f327a926",
+        "enabled": false
+      }
+    }
+  },
+  "routes": [
+    {
+      "poolId": "651940-dodo_pmm-wall-ausdc",
+      "provider": "dodo",
+      "tokenA": {
+        "symbol": "WALL",
+        "address": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4"
+      },
+      "tokenB": {
+        "symbol": "AUSDC",
+        "address": "0xa95EeD79f84E6A0151eaEb9d441F9Ffd50e8e881"
+      },
+      "poolAddress": "0x7b81Dad382BBB57e91a80389bA48e41Abd10794F",
+      "status": "quoteable",
+      "verification": {
+        "amountInRaw": "1000000",
+        "amountOutRaw": "1999999",
+        "slippageBps": 30,
+        "routerQuoteExecutable": true
+      }
+    },
+    {
+      "poolId": "651940-dodo_pmm-wall-ausdt",
+      "provider": "dodo",
+      "tokenA": {
+        "symbol": "WALL",
+        "address": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4"
+      },
+      "tokenB": {
+        "symbol": "AUSDT",
+        "address": "0x015B1897Ed5279930bC2Be46F661894d219292A6"
+      },
+      "poolAddress": "0x8D9bB238B6a76a438B116Ff22F5F7535191D49b4",
+      "status": "quoteable",
+      "verification": {
+        "amountInRaw": "1000000",
+        "amountOutRaw": "1999999",
+        "slippageBps": 30,
+        "routerQuoteExecutable": true
+      }
+    }
+  ],
+  "providerStatus": {
+    "enabled": [
+      "dodo"
+    ],
+    "disabled": [
+      "dodoV3",
+      "uniswapV3",
+      "balancer",
+      "curve",
+      "oneInch",
+      "partner"
+    ]
+  },
+  "remainingOptionalBlockers": [
+    "HYDX-native router/factory is not deployed or not committed in inventory.",
+    "Uniswap V3 factory/router/quoter/pool stack is not deployed or not committed in inventory."
+  ],
+  "disabledRoutes": [
+    {
+      "poolId": "651940-dodo_pmm-wall-usdt",
+      "provider": "dodo",
+      "tokenA": {
+        "symbol": "WALL",
+        "address": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4"
+      },
+      "tokenB": {
+        "symbol": "USDT",
+        "address": "0x66D8Efa0AF63B0e84eb1Dd72bf00f00cd1e2234e"
+      },
+      "poolAddress": "0x261D7e1447EE88398B2b5a274D49454F5B86800E",
+      "status": "disabled_wrong_quote_asset",
+      "reason": "AUSDT is the canonical ALL Mainnet cUSDT surface for this routing set.",
+      "disabledTransactions": [
+        "0x79f171ddc9977e99bb894bf7ff7a11a430441cc1285e7ecd747907ef3f23a0c4",
+        "0xec74f92e287cf1e193e791462f66b35cf9487ece8e343108fbdd3de760dc5c55"
+      ]
+    }
+  ]
+}

config/all-mainnet-uniswap-v3-deployment.json

@@ -0,0 +1,68 @@
+{
+  "generatedAt": "2026-04-29T06:18:00Z",
+  "chainId": 651940,
+  "deployer": "0x4A666F96fC8764181194447A7dFdb7d471b301C8",
+  "fee": 3000,
+  "tokens": {
+    "WETH": "0x798F6762BB40d6801A593459d08F890603D3979C",
+    "WALL": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4",
+    "AUSDT": "0x015B1897Ed5279930bC2Be46F661894d219292A6",
+    "token0": "0x015B1897Ed5279930bC2Be46F661894d219292A6",
+    "token1": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4"
+  },
+  "contracts": {
+    "nftDescriptorLibrary": "0xb53E8A0A19fB381537c6f28D37b7C2f7DC29EF02",
+    "nonfungibleTokenPositionDescriptor": "0x2a76C73458A0C11df4e0E43004598480d6D1E768",
+    "factory": "0xF1a334465C5DD628492780B39Be68D561A9AecA2",
+    "swapRouter": "0xe9Ea1B70803c18C4CEb8839D5D68681c7903511B",
+    "quoter": "0x0ecC56077325863c80cbe516D63e0afAFf7EA579",
+    "quoterV2": "0x024Ff178BaB7e6fa1794c3A216D2B299C3F295d2",
+    "nonfungiblePositionManager": "0xD29422211e1f2C1015FBb5dC2004657Dd8318aF6",
+    "pool": "0x9e0FC06BA367b51a0aBc5c0924306088DBB0e9c4"
+  },
+  "transactions": {
+    "nftDescriptorLibrary": "0x774202382ec2d29cced671b34c2b951682f60d3e60afd7fe64c13488cb341e32",
+    "nonfungibleTokenPositionDescriptor": "0xc6b98fc36e4c3b1d4d2e80efd4acacc31e2af2ff45de04f9fb066dcfffd380d3",
+    "factory": "0xb6e46b6d145cc707f12f4cf8980bf81d7b5b8d3bea9416737a7465c186b0fefd",
+    "swapRouter": "0x5fd7d021e8ac1bad918a1eb470a116f9dc6e750c102a5512e05391858296cc53",
+    "quoter": "0x0d5c14d3264c5abd70990349911a6eb3076f41feb2db93ccf74b2de022cd087f",
+    "quoterV2": "0x774327c7e7a7650fbfd9d28a8becbd88f86eb8f942a825980052bc50484aa54c",
+    "nonfungiblePositionManager": "0xe5be3fa83bd676051e2cc5ff990768d3de87e49a387d94be77352eaf1c38545f"
+  },
+  "poolState": {
+    "sqrtPriceX96": "79228162514264337593543950336",
+    "tick": 0,
+    "liquidity": "1000000000000000000"
+  },
+  "name": "ALL Mainnet Uniswap V3 Deployment Evidence",
+  "version": "0.1.0",
+  "network": "ALL Mainnet (Alltra)",
+  "evmVersion": "upstream-uniswap-artifacts-solc-0.7.x",
+  "packageSources": {
+    "v3Core": "@uniswap/v3-core@1.0.1",
+    "v3Periphery": "@uniswap/v3-periphery@1.4.4",
+    "swapRouterContracts": "@uniswap/swap-router-contracts@1.3.1"
+  },
+  "poolStateAfterRouterSwap": {
+    "testedAt": "2026-04-29T06:17:00Z",
+    "swapRouter": "0xe9Ea1B70803c18C4CEb8839D5D68681c7903511B",
+    "direction": "WALL_TO_AUSDT",
+    "amountInRaw": "1000000",
+    "amountOutRaw": "996999",
+    "approveTxHash": "0x572d1c6b2d0cdf6248913cd995e80196fbe0717017411c2251637afbfa825e1f",
+    "swapTxHash": "0xddf85aed18a6d872ac72d4f57b241e44946881e404f4f17cb7271180c8caa183",
+    "gasUsed": "119111"
+  },
+  "enhancedRouterIntegration": {
+    "enhancedSwapRouterV2": "0xb905fEfA56b028221E2Bc248Bbcd41141dc7aeD3",
+    "routeConfigured": true,
+    "providerEnabled": false,
+    "providerDisabledReason": "Existing UniswapV3RouteExecutorAdapter uses staticcall into the official Uniswap Quoter; the upstream Quoter is callable directly but does not return through that adapter staticcall path. Standalone SwapRouter/Quoter/Pool stack is live; enhanced-router V3 provider remains disabled until adapter quote compatibility is fixed.",
+    "routeSetTransactions": [
+      "0xa40b24889ab3ad985936562ee3690dafd14bfb1676ff49806a6fcb45c7704ef5",
+      "0x848fd6c7cedaebe7787c2f15a931b73afde709dac100cb745eab2d9eaa6da86c"
+    ],
+    "providerEnableTxHash": "0x4b430081582e1f2db5fedc904b8e90e137480dcae2f1e0a41dd25490f05394c7",
+    "providerDisableTxHash": "0x78b8ce4fdc296585ace36dd8c8318731cc5526115e712b14d1ad630c4f63aba6"
+  }
+}

config/all-mainnet-vault-assignments.example.json

@@ -0,0 +1,27 @@
+{
+  "description": "Copy to config/all-mainnet-vault-assignments.json and replace placeholder addresses with approved per-role vaults/multisigs. The apply script refuses placeholders.",
+  "defaultByRole": {
+    "treasury_reserve": "0x0000000000000000000000000000000000000000",
+    "bridge_liquidity": "0x0000000000000000000000000000000000000000",
+    "protocol_adapter": "0x0000000000000000000000000000000000000000",
+    "emergency_withdraw": "0x0000000000000000000000000000000000000000",
+    "single_sided_inventory": "0x0000000000000000000000000000000000000000"
+  },
+  "byChain": {
+    "651940": {
+      "treasury_reserve": "0x0000000000000000000000000000000000000000",
+      "bridge_liquidity": "0x0000000000000000000000000000000000000000",
+      "protocol_adapter": "0x0000000000000000000000000000000000000000",
+      "emergency_withdraw": "0x0000000000000000000000000000000000000000",
+      "single_sided_inventory": "0x0000000000000000000000000000000000000000"
+    }
+  },
+  "byPoolId": {
+    "651940-uniswap_v2-wall-ausdc": {
+      "treasury_reserve": "0x0000000000000000000000000000000000000000",
+      "bridge_liquidity": "0x0000000000000000000000000000000000000000",
+      "protocol_adapter": "0x0000000000000000000000000000000000000000",
+      "emergency_withdraw": "0x0000000000000000000000000000000000000000"
+    }
+  }
+}

config/all-mainnet-vault-assignments.json

@@ -0,0 +1,20 @@
+{
+  "description": "Operational vault assignments generated from smom-dbis-138/.env public addresses. No private material is stored here.",
+  "defaultByRole": {
+    "treasury_reserve": "0x74eccf9affb0e0938c2168ebdf7ef63a26964483",
+    "bridge_liquidity": "0x31884f84555210FFB36a19D2471b8eBc7372d0A8",
+    "protocol_adapter": "0xb9E29cFa1f89d369671E640d0BB3aD94Cab43965",
+    "emergency_withdraw": "0xb9E29cFa1f89d369671E640d0BB3aD94Cab43965",
+    "single_sided_inventory": "0x31884f84555210FFB36a19D2471b8eBc7372d0A8"
+  },
+  "byChain": {
+    "651940": {
+      "treasury_reserve": "0x74eccf9affb0e0938c2168ebdf7ef63a26964483",
+      "bridge_liquidity": "0x31884f84555210FFB36a19D2471b8eBc7372d0A8",
+      "protocol_adapter": "0xb9E29cFa1f89d369671E640d0BB3aD94Cab43965",
+      "emergency_withdraw": "0xb9E29cFa1f89d369671E640d0BB3aD94Cab43965",
+      "single_sided_inventory": "0x31884f84555210FFB36a19D2471b8eBc7372d0A8"
+    }
+  },
+  "byPoolId": {}
+}

config/allmainnet-non-dodo-protocol-surface.json

@@ -0,0 +1,973 @@
+{
+  "name": "ALL Mainnet Non-DODO Protocol Surface",
+  "version": "0.1.0",
+  "updated": "2026-04-29",
+  "chainId": 651940,
+  "network": "ALL Mainnet (Alltra)",
+  "status": "bridge_live_enhanced_router_partial_swap_inventory_published",
+  "summary": {
+    "bridgeOnlyLive": false,
+    "sameChainSwapInventoryPublished": true,
+    "notes": [
+      "The Chain 138 <-> 651940 AlltraAdapter bridge is live.",
+      "This file documents the known non-DODO Alltra protocol and token surface plus the committed same-chain inventory fragments that have real factory/router/pool addresses in config/all-mainnet-pool-creation-matrix.json.",
+      "Same-chain inventory publication is partial: production routing remains gated by required vault assignments, funding, live reserve reads, and canary evidence.",
+      "ALL Mainnet EnhancedSwapRouterV2 is deployed and DODO-backed routes are wired for the committed WALL/AUSDC and WALL/AUSDT DODO PMM pools; the earlier WALL/USDT route is disabled because AUSDT is the canonical ALL Mainnet cUSDT surface."
+    ]
+  },
+  "classificationFramework": {
+    "category": [
+      "tokenized-fiat",
+      "stablecoin",
+      "wrapped-native",
+      "dex-token",
+      "defi-token",
+      "governance-token",
+      "utility-token",
+      "rwa-token",
+      "commodity-token",
+      "other"
+    ],
+    "instrumentType": [
+      "emoney",
+      "deposit-token",
+      "fiat-backed-stablecoin",
+      "wrapped-native",
+      "protocol-token",
+      "governance-token",
+      "utility-token",
+      "other"
+    ],
+    "backingAssets": [
+      "cash",
+      "cash-equivalents",
+      "bank-deposits",
+      "treasuries",
+      "commodity-reserves",
+      "protocol-utility",
+      "native-gas-asset",
+      "unknown"
+    ],
+    "metadataDomains": [
+      "backingMetadata",
+      "bridgeMetadata",
+      "cashMetadata",
+      "commodityMetadata",
+      "reserveMetadata",
+      "securityMetadata",
+      "settlementMetadata"
+    ],
+    "notes": [
+      "Use category for the broad asset bucket.",
+      "Use instrumentType, issuerType, claimType, backingAssets, capabilities, and tags for legal, reserve, and integration semantics.",
+      "Use cash only as a backing, redemption, or settlement asset descriptor; do not use cash as the token category unless the instrument is literally cash-equivalent legal tender.",
+      "Use commodityMetadata only when the token directly references or is backed by a commodity reserve.",
+      "Use securityMetadata for pause/admin/monitoring controls; unknown means not yet committed in this inventory, not absent on-chain.",
+      "GRU tags use lowercase namespace:value strings and include the version, for example gru:v2."
+    ]
+  },
+  "documentedTokens": [
+    {
+      "symbol": "AUSDT",
+      "address": "0x015B1897Ed5279930bC2Be46F661894d219292A6",
+      "decimals": 18,
+      "category": "tokenized-fiat",
+      "instrumentType": "fiat-backed-stablecoin",
+      "issuerType": "token-issuer-unverified",
+      "currencyCode": "USD",
+      "claimType": "claim-on-issuer-unverified",
+      "settlementAssetClass": "fiat",
+      "backingAssets": [
+        "cash",
+        "cash-equivalents"
+      ],
+      "gruVersion": "v2",
+      "gruFamilySymbol": "cAUSDT",
+      "gruTransportRole": "all-mainnet-primary-surface",
+      "tags": [
+        "tokenized-fiat",
+        "fiat:usd",
+        "backing:cash",
+        "backing:cash-equivalents",
+        "gru:v2",
+        "gru:m1",
+        "gru:transport",
+        "gru:all-mainnet",
+        "gru:causdt-family"
+      ],
+      "backingMetadata": {
+        "backingModel": "fiat-reserve-backed",
+        "backingAssetClasses": [
+          "cash",
+          "cash-equivalents"
+        ],
+        "backingVerificationStatus": "reserve-disclosure-not-committed",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "live-canonical-target",
+        "bridgeKind": "AlltraAdapter",
+        "sourceChainId": 138,
+        "destinationChainId": 651940,
+        "sourceSymbol": "cUSDT",
+        "sourceAddress": "0x93E66202A11B1772E55407B32B44e5Cd8eda7f22",
+        "destinationSymbol": "AUSDT",
+        "destinationAddress": "0x015B1897Ed5279930bC2Be46F661894d219292A6",
+        "adapterAddress": "0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc",
+        "bridgeCanonicalAssetVersion": "gru-v2",
+        "bridgeMirroredAssetVersion": "all-mainnet-surface"
+      },
+      "cashMetadata": {
+        "cashRole": "reserve-and-redemption-asset-class",
+        "currency": "USD",
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "issuer-or-bridge-reserve-unverified",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": null,
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "pending-disclosure",
+        "riskTier": "policy-review-required",
+        "registryStatus": "documented-surface-not-stablecoin-registry-entry"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "corridor-halt-required-for-issuer-bridge-or-peg-risk",
+        "monitoring": [
+          "peg-deviation",
+          "bridge-health",
+          "liquidity-depth",
+          "contract-admin-changes"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "fiat",
+        "settlementCurrency": "USD",
+        "settlementFinalityDomain": "off-chain-regulated-ledger-or-issuer-domain",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": true,
+        "redemptionPath": "issuer-or-bridge-redemption-unverified",
+        "parRedemption": "unverified"
+      },
+      "status": "verified"
+    },
+    {
+      "symbol": "USDT",
+      "address": "0x66D8Efa0AF63B0e84eb1Dd72bf00f00cd1e2234e",
+      "decimals": 18,
+      "category": "tokenized-fiat",
+      "instrumentType": "fiat-backed-stablecoin",
+      "issuerType": "token-issuer-unverified",
+      "currencyCode": "USD",
+      "claimType": "claim-on-issuer-unverified",
+      "settlementAssetClass": "fiat",
+      "backingAssets": [
+        "cash",
+        "cash-equivalents"
+      ],
+      "gruVersion": "v2",
+      "gruFamilySymbol": "cUSDT",
+      "gruTransportRole": "all-mainnet-usdt-surface",
+      "tags": [
+        "tokenized-fiat",
+        "fiat:usd",
+        "backing:cash",
+        "backing:cash-equivalents",
+        "gru:v2",
+        "gru:m1",
+        "gru:transport",
+        "gru:all-mainnet",
+        "gru:cusdt-family"
+      ],
+      "backingMetadata": {
+        "backingModel": "fiat-reserve-backed",
+        "backingAssetClasses": [
+          "cash",
+          "cash-equivalents"
+        ],
+        "backingVerificationStatus": "reserve-disclosure-not-committed",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "documented-token-not-canonical-138-to-651940-target",
+        "bridgeKind": "unknown-or-noncanonical",
+        "sourceChainId": null,
+        "destinationChainId": 651940,
+        "sourceSymbol": null,
+        "sourceAddress": null,
+        "destinationSymbol": "USDT",
+        "destinationAddress": "0x66D8Efa0AF63B0e84eb1Dd72bf00f00cd1e2234e",
+        "adapterAddress": null,
+        "bridgeCanonicalAssetVersion": null,
+        "bridgeMirroredAssetVersion": "all-mainnet-surface"
+      },
+      "cashMetadata": {
+        "cashRole": "reserve-and-redemption-asset-class",
+        "currency": "USD",
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "issuer-reserve-unverified",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": null,
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "pending-disclosure",
+        "riskTier": "policy-review-required",
+        "registryStatus": "documented-surface-not-stablecoin-registry-entry"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "corridor-halt-required-for-issuer-or-peg-risk",
+        "monitoring": [
+          "peg-deviation",
+          "liquidity-depth",
+          "contract-admin-changes"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "fiat",
+        "settlementCurrency": "USD",
+        "settlementFinalityDomain": "off-chain-issuer-domain",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": true,
+        "redemptionPath": "issuer-redemption-unverified",
+        "parRedemption": "unverified"
+      },
+      "status": "verified"
+    },
+    {
+      "symbol": "USDC",
+      "address": "0xa95EeD79f84E6A0151eaEb9d441F9Ffd50e8e881",
+      "decimals": 18,
+      "category": "tokenized-fiat",
+      "instrumentType": "fiat-backed-stablecoin",
+      "issuerType": "token-issuer-unverified",
+      "currencyCode": "USD",
+      "claimType": "claim-on-issuer-unverified",
+      "settlementAssetClass": "fiat",
+      "backingAssets": [
+        "cash",
+        "cash-equivalents"
+      ],
+      "gruVersion": "v2",
+      "gruFamilySymbol": "cUSDC",
+      "gruTransportRole": "all-mainnet-usdc-surface",
+      "tags": [
+        "tokenized-fiat",
+        "fiat:usd",
+        "backing:cash",
+        "backing:cash-equivalents",
+        "gru:v2",
+        "gru:m1",
+        "gru:transport",
+        "gru:all-mainnet",
+        "gru:cusdc-family"
+      ],
+      "backingMetadata": {
+        "backingModel": "fiat-reserve-backed",
+        "backingAssetClasses": [
+          "cash",
+          "cash-equivalents"
+        ],
+        "backingVerificationStatus": "reserve-disclosure-not-committed",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "live-canonical-target",
+        "bridgeKind": "AlltraAdapter",
+        "sourceChainId": 138,
+        "destinationChainId": 651940,
+        "sourceSymbol": "cUSDC",
+        "sourceAddress": "0xf22258f57794CC8E06237084b353Ab30fFfa640b",
+        "destinationSymbol": "USDC",
+        "destinationAddress": "0xa95EeD79f84E6A0151eaEb9d441F9Ffd50e8e881",
+        "adapterAddress": "0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc",
+        "bridgeCanonicalAssetVersion": "gru-v2",
+        "bridgeMirroredAssetVersion": "all-mainnet-surface"
+      },
+      "cashMetadata": {
+        "cashRole": "reserve-and-redemption-asset-class",
+        "currency": "USD",
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "issuer-or-bridge-reserve-unverified",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": null,
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "pending-disclosure",
+        "riskTier": "policy-review-required",
+        "registryStatus": "documented-surface-not-stablecoin-registry-entry"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "corridor-halt-required-for-issuer-bridge-or-peg-risk",
+        "monitoring": [
+          "peg-deviation",
+          "bridge-health",
+          "liquidity-depth",
+          "contract-admin-changes"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "fiat",
+        "settlementCurrency": "USD",
+        "settlementFinalityDomain": "off-chain-regulated-ledger-or-issuer-domain",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": true,
+        "redemptionPath": "issuer-or-bridge-redemption-unverified",
+        "parRedemption": "unverified"
+      },
+      "status": "verified"
+    },
+    {
+      "symbol": "WETH",
+      "address": "0x798F6762BB40d6801A593459d08F890603D3979C",
+      "decimals": 18,
+      "category": "wrapped-native",
+      "instrumentType": "wrapped-native",
+      "issuerType": "wrapper-contract",
+      "settlementAssetClass": "crypto-native",
+      "backingAssets": [
+        "native-gas-asset"
+      ],
+      "gruVersion": null,
+      "tags": [
+        "wrapped-native",
+        "gas:eth",
+        "all-mainnet"
+      ],
+      "backingMetadata": {
+        "backingModel": "wrapped-native-escrow",
+        "backingAssetClasses": [
+          "native-gas-asset"
+        ],
+        "backingVerificationStatus": "wrapper-contract-address-verified",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "mapped-138-to-651940",
+        "bridgeKind": "AlltraAdapter",
+        "sourceChainId": 138,
+        "destinationChainId": 651940,
+        "sourceSymbol": "WETH9",
+        "sourceAddress": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2",
+        "destinationSymbol": "WETH",
+        "destinationAddress": "0x798F6762BB40d6801A593459d08F890603D3979C",
+        "adapterAddress": "0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc"
+      },
+      "cashMetadata": {
+        "cashRole": "none",
+        "currency": null,
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "native-asset-wrapper-escrow",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": "wrapper-contract-balance",
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "contract-balance-verifiable-on-chain",
+        "riskTier": "bridge-and-wrapper-risk",
+        "registryStatus": "documented-token-surface"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "corridor-halt-required-for-bridge-or-wrapper-risk",
+        "monitoring": [
+          "bridge-health",
+          "wrapper-contract-balance",
+          "liquidity-depth",
+          "contract-admin-changes"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "crypto-native",
+        "settlementCurrency": "ETH",
+        "settlementFinalityDomain": "chain-finality",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": false,
+        "redemptionPath": "unwrap-or-bridge-withdrawal",
+        "parRedemption": "one-to-one-native-asset-when-wrapper-solvent"
+      },
+      "status": "verified"
+    },
+    {
+      "symbol": "WALL",
+      "address": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4",
+      "decimals": 18,
+      "category": "wrapped-native",
+      "instrumentType": "wrapped-native",
+      "issuerType": "wrapper-contract",
+      "settlementAssetClass": "crypto-native",
+      "backingAssets": [
+        "native-gas-asset"
+      ],
+      "gruVersion": null,
+      "tags": [
+        "wrapped-native",
+        "gas:all",
+        "all-mainnet"
+      ],
+      "backingMetadata": {
+        "backingModel": "wrapped-native-escrow",
+        "backingAssetClasses": [
+          "native-gas-asset"
+        ],
+        "backingVerificationStatus": "wrapper-contract-address-verified",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "documented-all-mainnet-native-wrapper",
+        "bridgeKind": "native-wrapper",
+        "sourceChainId": 651940,
+        "destinationChainId": 651940,
+        "sourceSymbol": "ALL",
+        "sourceAddress": null,
+        "destinationSymbol": "WALL",
+        "destinationAddress": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4",
+        "adapterAddress": null
+      },
+      "cashMetadata": {
+        "cashRole": "none",
+        "currency": null,
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "native-asset-wrapper-escrow",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": "wrapper-contract-balance",
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "contract-balance-verifiable-on-chain",
+        "riskTier": "wrapper-risk",
+        "registryStatus": "documented-token-surface"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "corridor-halt-required-for-wrapper-risk",
+        "monitoring": [
+          "wrapper-contract-balance",
+          "liquidity-depth",
+          "contract-admin-changes"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "crypto-native",
+        "settlementCurrency": "ALL",
+        "settlementFinalityDomain": "chain-finality",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": false,
+        "redemptionPath": "unwrap-to-native-all",
+        "parRedemption": "one-to-one-native-asset-when-wrapper-solvent"
+      },
+      "status": "verified"
+    },
+    {
+      "symbol": "HYDX",
+      "address": "0x0d9793861AEB9244AD1B34375a83A6730F6AdD38",
+      "decimals": 18,
+      "category": "dex-token",
+      "instrumentType": "protocol-token",
+      "issuerType": "protocol",
+      "settlementAssetClass": "crypto-native",
+      "backingAssets": [
+        "protocol-utility"
+      ],
+      "gruVersion": null,
+      "tags": [
+        "dex-token",
+        "protocol:hydx",
+        "all-mainnet"
+      ],
+      "backingMetadata": {
+        "backingModel": "protocol-utility",
+        "backingAssetClasses": [
+          "protocol-utility"
+        ],
+        "backingVerificationStatus": "not-reserve-backed",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "not-bridge-canonical-in-this-inventory",
+        "bridgeKind": null,
+        "sourceChainId": null,
+        "destinationChainId": 651940,
+        "sourceSymbol": null,
+        "sourceAddress": null,
+        "destinationSymbol": "HYDX",
+        "destinationAddress": "0x0d9793861AEB9244AD1B34375a83A6730F6AdD38",
+        "adapterAddress": null
+      },
+      "cashMetadata": {
+        "cashRole": "none",
+        "currency": null,
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "none-protocol-token",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": null,
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "not-applicable",
+        "riskTier": "protocol-token-risk",
+        "registryStatus": "documented-token-surface"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "routing-halt-required-for-protocol-or-contract-risk",
+        "monitoring": [
+          "liquidity-depth",
+          "contract-admin-changes",
+          "protocol-surface-confirmation"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "crypto-native",
+        "settlementCurrency": "HYDX",
+        "settlementFinalityDomain": "chain-finality",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": false,
+        "redemptionPath": "not-applicable",
+        "parRedemption": "not-applicable"
+      },
+      "status": "verified"
+    },
+    {
+      "symbol": "HYBX",
+      "address": "0x1839f77eBed7F388c7035f7061B4B8Ef0E72317a",
+      "decimals": 8,
+      "category": "defi-token",
+      "instrumentType": "protocol-token",
+      "issuerType": "protocol",
+      "settlementAssetClass": "crypto-native",
+      "backingAssets": [
+        "protocol-utility"
+      ],
+      "gruVersion": null,
+      "tags": [
+        "defi-token",
+        "protocol:hybx",
+        "all-mainnet"
+      ],
+      "backingMetadata": {
+        "backingModel": "protocol-utility",
+        "backingAssetClasses": [
+          "protocol-utility"
+        ],
+        "backingVerificationStatus": "not-reserve-backed",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "not-bridge-canonical-in-this-inventory",
+        "bridgeKind": null,
+        "sourceChainId": null,
+        "destinationChainId": 651940,
+        "sourceSymbol": null,
+        "sourceAddress": null,
+        "destinationSymbol": "HYBX",
+        "destinationAddress": "0x1839f77eBed7F388c7035f7061B4B8Ef0E72317a",
+        "adapterAddress": null
+      },
+      "cashMetadata": {
+        "cashRole": "none",
+        "currency": null,
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "none-protocol-token",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": null,
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "not-applicable",
+        "riskTier": "protocol-token-risk",
+        "registryStatus": "documented-token-surface"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "routing-halt-required-for-protocol-or-contract-risk",
+        "monitoring": [
+          "liquidity-depth",
+          "contract-admin-changes"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "crypto-native",
+        "settlementCurrency": "HYBX",
+        "settlementFinalityDomain": "chain-finality",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": false,
+        "redemptionPath": "not-applicable",
+        "parRedemption": "not-applicable"
+      },
+      "status": "verified"
+    },
+    {
+      "symbol": "CHT",
+      "address": "0xE59Bb804F4884FcEA183a4A67B1bb04f4a4567bc",
+      "decimals": 8,
+      "category": "defi-token",
+      "instrumentType": "utility-token",
+      "issuerType": "protocol",
+      "settlementAssetClass": "crypto-native",
+      "backingAssets": [
+        "protocol-utility"
+      ],
+      "gruVersion": null,
+      "tags": [
+        "defi-token",
+        "utility-token",
+        "protocol:cht",
+        "all-mainnet"
+      ],
+      "backingMetadata": {
+        "backingModel": "protocol-utility",
+        "backingAssetClasses": [
+          "protocol-utility"
+        ],
+        "backingVerificationStatus": "not-reserve-backed",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "not-bridge-canonical-in-this-inventory",
+        "bridgeKind": null,
+        "sourceChainId": null,
+        "destinationChainId": 651940,
+        "sourceSymbol": null,
+        "sourceAddress": null,
+        "destinationSymbol": "CHT",
+        "destinationAddress": "0xE59Bb804F4884FcEA183a4A67B1bb04f4a4567bc",
+        "adapterAddress": null
+      },
+      "cashMetadata": {
+        "cashRole": "none",
+        "currency": null,
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "none-utility-token",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": null,
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "not-applicable",
+        "riskTier": "utility-token-risk",
+        "registryStatus": "documented-token-surface"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "routing-halt-required-for-protocol-or-contract-risk",
+        "monitoring": [
+          "liquidity-depth",
+          "contract-admin-changes"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "crypto-native",
+        "settlementCurrency": "CHT",
+        "settlementFinalityDomain": "chain-finality",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": false,
+        "redemptionPath": "not-applicable",
+        "parRedemption": "not-applicable"
+      },
+      "status": "verified"
+    },
+    {
+      "symbol": "AUDA",
+      "address": "0x690740f055A41FA7669f5a379Bf71B0cDF353073",
+      "decimals": 18,
+      "category": "defi-token",
+      "instrumentType": "protocol-token",
+      "issuerType": "protocol",
+      "settlementAssetClass": "crypto-native",
+      "backingAssets": [
+        "protocol-utility"
+      ],
+      "gruVersion": null,
+      "tags": [
+        "defi-token",
+        "protocol:auda",
+        "all-mainnet"
+      ],
+      "backingMetadata": {
+        "backingModel": "protocol-utility",
+        "backingAssetClasses": [
+          "protocol-utility"
+        ],
+        "backingVerificationStatus": "not-reserve-backed",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "not-bridge-canonical-in-this-inventory",
+        "bridgeKind": null,
+        "sourceChainId": null,
+        "destinationChainId": 651940,
+        "sourceSymbol": null,
+        "sourceAddress": null,
+        "destinationSymbol": "AUDA",
+        "destinationAddress": "0x690740f055A41FA7669f5a379Bf71B0cDF353073",
+        "adapterAddress": null
+      },
+      "cashMetadata": {
+        "cashRole": "none",
+        "currency": null,
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "none-protocol-token",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": null,
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "not-applicable",
+        "riskTier": "protocol-token-risk",
+        "registryStatus": "documented-token-surface"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "routing-halt-required-for-protocol-or-contract-risk",
+        "monitoring": [
+          "liquidity-depth",
+          "contract-admin-changes"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "crypto-native",
+        "settlementCurrency": "AUDA",
+        "settlementFinalityDomain": "chain-finality",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": false,
+        "redemptionPath": "not-applicable",
+        "parRedemption": "not-applicable"
+      },
+      "status": "verified"
+    }
+  ],
+  "protocols": [
+    {
+      "name": "AlltraDEX / EnhancedSwapRouter",
+      "family": "custom_router",
+      "status": "partial_live_dodo_backed_router_deployed",
+      "factoryAddress": null,
+      "routerAddress": "0xb905fEfA56b028221E2Bc248Bbcd41141dc7aeD3",
+      "coordinatorAddress": "0x9276ae27d9c624B43dbE43494f34A9c5F0233a0B",
+      "providerAddress": "0x36F65027D21e151F0b7810bae1E94b225AC7Ba9e",
+      "adapters": {
+        "dodo": "0x391D192BED6188c4DaB4C93c078bD18432687474",
+        "dodoV3": "0x97Ce874142625134aEEBDF42B5E7bB806e731D25",
+        "uniswapV3": "0xBF75F3401de20bebBB1CBb678499941807E3E040",
+        "balancer": "0xDE7F15AF1D84e3694f7E966293d20e64Fc04d9fF",
+        "curve": "0x753D2b0a723992D7B174D6e19F7b7Cb74be8D61a",
+        "oneInch": "0x487090bbb7d17875281692d582a11B445b3A7AC7"
+      },
+      "enabledProviders": [
+        "dodo"
+      ],
+      "disabledProviders": [
+        "dodoV3",
+        "uniswapV3",
+        "balancer",
+        "curve",
+        "oneInch",
+        "partner"
+      ],
+      "publishedRoutePoolIds": [
+        "651940-dodo_pmm-wall-ausdc",
+        "651940-dodo_pmm-wall-ausdt"
+      ],
+      "deploymentEvidenceRef": "config/all-mainnet-enhanced-router-deployment.json",
+      "notes": [
+        "Documented in docs/11-references/ALL_MAINNET_ROUTING_ENGINE.md as the intended same-chain swap surface.",
+        "EnhancedSwapRouterV2 is deployed on ALL Mainnet with DODO as the only enabled provider.",
+        "Optional adapters were deployed for future wiring but are disabled until canonical provider targets and pools are committed.",
+        "WALL/AUSDC and WALL/AUSDT are funded and quoteable through the router provider path; the earlier WALL/USDT route is disabled because AUSDT is the canonical quote asset."
+      ],
+      "disabledRoutePoolIds": [
+        "651940-dodo_pmm-wall-usdt"
+      ]
+    },
+    {
+      "name": "HYDX",
+      "family": "custom_router",
+      "status": "token_present_protocol_surface_pending",
+      "factoryAddress": null,
+      "routerAddress": null,
+      "envKeys": [
+        "CHAIN_651940_HYDX_FACTORY",
+        "CHAIN_651940_HYDX_ROUTER",
+        "CHAIN_651940_HYDX_START_BLOCK",
+        "CHAIN_651940_HYDX_PAIR_CREATED_EVENT"
+      ],
+      "notes": [
+        "The HYDX token is documented and verified on ALL Mainnet.",
+        "The repo expects factory/router discovery via env, but no canonical HYDX-native router inventory is currently committed.",
+        "HYDX currently has committed same-chain exposure through the ALL Mainnet Uniswap V2 HYDX/WALL pool, not through a dedicated HYDX-native router surface."
+      ]
+    },
+    {
+      "name": "Uniswap V2",
+      "family": "uniswap_v2",
+      "status": "partial_live_inventory_published",
+      "factoryAddress": "0x3C3ED514691C06c89Bf6626B05D22991E8924c93",
+      "routerAddress": "0xED04Ee8307C0656207AF5aFE3926AE2380052940",
+      "inventoryRef": "config/all-mainnet-pool-creation-matrix.json",
+      "publishedPoolIds": [
+        "651940-uniswap_v2-wall-ausdc",
+        "651940-uniswap_v2-wall-usdt",
+        "651940-uniswap_v2-usdt-ausdc",
+        "651940-uniswap_v2-hydx-wall"
+      ],
+      "notes": [
+        "Factory/router and multiple pair addresses are committed in config/all-mainnet-pool-creation-matrix.json.",
+        "Required spend rows remain gated until vault assignments and canary evidence are recorded."
+      ]
+    },
+    {
+      "name": "Uniswap V3",
+      "family": "uniswap_v3",
+      "status": "standalone_live_router_quoter_pool_deployed",
+      "factoryAddress": "0xF1a334465C5DD628492780B39Be68D561A9AecA2",
+      "routerAddress": "0xe9Ea1B70803c18C4CEb8839D5D68681c7903511B",
+      "notes": [
+        "Official Uniswap V3 factory, legacy SwapRouter, Quoter, QuoterV2, NonfungiblePositionManager, and AUSDT/WALL 0.30% pool are deployed on ALL Mainnet.",
+        "The standalone SwapRouter path was tested with a tiny WALL -> AUSDT canary swap.",
+        "EnhancedSwapRouterV2 route config was written, but provider 1 remains disabled because the current UniswapV3RouteExecutorAdapter staticcall quote path is incompatible with the upstream Quoter behavior."
+      ],
+      "quoterAddress": "0x0ecC56077325863c80cbe516D63e0afAFf7EA579",
+      "quoterV2Address": "0x024Ff178BaB7e6fa1794c3A216D2B299C3F295d2",
+      "positionManagerAddress": "0xD29422211e1f2C1015FBb5dC2004657Dd8318aF6",
+      "descriptorAddress": "0x2a76C73458A0C11df4e0E43004598480d6D1E768",
+      "poolAddress": "0x9e0FC06BA367b51a0aBc5c0924306088DBB0e9c4",
+      "inventoryRef": "config/all-mainnet-pool-creation-matrix.json",
+      "deploymentEvidenceRef": "config/all-mainnet-uniswap-v3-deployment.json",
+      "publishedPoolIds": [
+        "651940-uniswap_v3-wall-ausdt"
+      ],
+      "enhancedRouterProviderStatus": "disabled_adapter_quote_compatibility_pending"
+    },
+    {
+      "name": "DODO PMM",
+      "family": "dodo_pmm",
+      "status": "partial_live_inventory_published",
+      "factoryAddress": "0x8a3403aef8d40c0F4AfaF6Dc2000A537EbC863c2",
+      "routerAddress": "0x8528E268F3b8C94208d09D131ACa3Ea93Bad57c7",
+      "inventoryRef": "config/all-mainnet-pool-creation-matrix.json",
+      "publishedPoolIds": [
+        "651940-dodo_pmm-wall-ausdc",
+        "651940-dodo_pmm-wall-ausdt"
+      ],
+      "notes": [
+        "DVM factory, DVM factory adapter, integration/router, and DODO PMM pool addresses are committed in config/all-mainnet-pool-creation-matrix.json; WALL/AUSDT supersedes the earlier WALL/USDT row for canonical spend routing.",
+        "Required spend rows remain gated until vault assignments, funding, live reserve reads, and canary evidence are recorded."
+      ],
+      "disabledPoolIds": [
+        "651940-dodo_pmm-wall-usdt"
+      ]
+    }
+  ],
+  "bridgeSurface": {
+    "adapter": {
+      "name": "AlltraAdapter",
+      "address": "0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc",
+      "status": "live"
+    },
+    "supportedBridgeAssets": [
+      "cUSDC",
+      "cUSDT"
+    ]
+  },
+  "nextTasks": [
+    "Keep the disabled WALL/USDT row historical-only unless explicitly re-approved for USDT routing.",
+    "Commit canonical factory/router metadata once a HYDX-native routing address is confirmed.",
+    "Deploy or import canonical Uniswap V3 factory/router/quoter/pool inventory before enabling the ALL Mainnet Uniswap V3 adapter.",
+    "Add pool-level addresses and verification artifacts before enabling public route generation from disabled optional protocol providers."
+  ]
+}

config/besu-node-lists/permissions-nodes.toml

@@ -1,6 +1,6 @@
 # Node Permissioning — SINGLE SOURCE OF TRUTH for all Besu nodes
 # Must match config/besu-node-lists/static-nodes.json and be deployed to every node.
-# Generated by scripts/besu/collect-enodes-from-all-besu-nodes.sh — 34 enodes (incl. Putu RPC 2307/2308 .237/.238).
+# Generated by scripts/besu/collect-enodes-from-all-besu-nodes.sh — 37 enodes after live adds of 2103 (.217), 1509 (.219), and 1510 (.220).
 
 nodes-allowlist=[
   "enode://2221dd9fc65c9082d4a937832cba9f6759981888df6798407c390bd153f4332c152ea5d03dd9d9cda74d7990fb3479a5c4ba7166269322be9790eed9ebdcfe24@192.168.11.100:30303",
@@ -17,8 +17,11 @@ nodes-allowlist=[
   "enode://5f048208071f2a3036128433e1e4a647a7683abd8bc0f27d063e2933ced983accdfc44998666f3be711e4eff27511142d9989775b86cdbe28c79b74409fc36bb@192.168.11.214:30303",
   "enode://8da1b586e2e98f521f07148d3bb5d81fde151ce3d5738b51bc36e2c81de1aaa5404ce31e991b4393bbe471934f0a9a31f78d1d7c17c1899c3e2dde5e9f16eb24@192.168.11.244:30303",
   "enode://acd46d31913b8379f075467cd88d2ea650d33474d2f9546426da4a414fe92233584c9d8c2e1ea9962fa4257c20b66c9434d0488e51c632f285205d6a379cfbd6@192.168.11.245:30303",
+  "enode://8a3337adcc2d177caf3aee26b3b6077d9adf126c580e12f352743ca07828f056ceb1d5fb1a06287e2dbbe19043fcc4b9bdd2ca9ae2a2c9142cf0cc3a549bfc68@192.168.11.219:30303",
+  "enode://09fe518689c54a34c3dac8aebf3c94bfc390f4bae143a80c57d92a502414df0689d12a2243ff9376c2f44a419894d934b4f47783ced31ea9668522078854e58f@192.168.11.220:30303",
   "enode://6cdc892fa09afa2b05c21cc9a1193a86cf0d195ce81b02a270d8bb987f78ca98ad90d907670796c90fc6e4eaf3b4cae6c0c15871e2564de063beceb4bbfc6532@192.168.11.211:30303",
   "enode://e53713bb77ad9f39e8a04b9c82aadddd3449220167f546bca8e9f36f6ebf60ae003e48ac293790e2bd7b0aca382777db9eca61d6f048c04f9dbe65eedb79d893@192.168.11.212:30303?discport=0",
+  "enode://e871ff3b1f58b9a87122e552b2404e1893bf92ae74d4fa6bc2bd002d0350c506ea452f4aefa1a3497ef32694c4beb48bf8a006d2b82f57649c90b22f59044aad@192.168.11.217:30303?discport=0",
   "enode://07daf3d64079faa3982bc8be7aa86c24ef21eca4565aae4a7fd963c55c728de0639d80663834634edf113b9f047d690232ae23423c64979961db4b6449aa6dfd@192.168.11.221:30303",
   "enode://868bd957d6d887944deac0190161a3db7d1316a022e40a2383d5c334aa3fb8bc7ca36f165b6fb377b77d202fec46f3840f2f659b6a47807b7ce9b944b8382f10@192.168.11.232:30303",
   "enode://688f271d94c7995600ae36d25aa2fb92fea0c52e50e86c598be8966515458c1408b67fba76e1f771073e4774a6e399588443da63394ea25d56e6ca36f2288e00@192.168.11.233:30303",

config/besu-node-lists/static-nodes.json

@@ -13,8 +13,11 @@
   "enode://5f048208071f2a3036128433e1e4a647a7683abd8bc0f27d063e2933ced983accdfc44998666f3be711e4eff27511142d9989775b86cdbe28c79b74409fc36bb@192.168.11.214:30303",
   "enode://8da1b586e2e98f521f07148d3bb5d81fde151ce3d5738b51bc36e2c81de1aaa5404ce31e991b4393bbe471934f0a9a31f78d1d7c17c1899c3e2dde5e9f16eb24@192.168.11.244:30303",
   "enode://acd46d31913b8379f075467cd88d2ea650d33474d2f9546426da4a414fe92233584c9d8c2e1ea9962fa4257c20b66c9434d0488e51c632f285205d6a379cfbd6@192.168.11.245:30303",
+  "enode://8a3337adcc2d177caf3aee26b3b6077d9adf126c580e12f352743ca07828f056ceb1d5fb1a06287e2dbbe19043fcc4b9bdd2ca9ae2a2c9142cf0cc3a549bfc68@192.168.11.219:30303",
+  "enode://09fe518689c54a34c3dac8aebf3c94bfc390f4bae143a80c57d92a502414df0689d12a2243ff9376c2f44a419894d934b4f47783ced31ea9668522078854e58f@192.168.11.220:30303",
   "enode://6cdc892fa09afa2b05c21cc9a1193a86cf0d195ce81b02a270d8bb987f78ca98ad90d907670796c90fc6e4eaf3b4cae6c0c15871e2564de063beceb4bbfc6532@192.168.11.211:30303",
   "enode://e53713bb77ad9f39e8a04b9c82aadddd3449220167f546bca8e9f36f6ebf60ae003e48ac293790e2bd7b0aca382777db9eca61d6f048c04f9dbe65eedb79d893@192.168.11.212:30303?discport=0",
+  "enode://e871ff3b1f58b9a87122e552b2404e1893bf92ae74d4fa6bc2bd002d0350c506ea452f4aefa1a3497ef32694c4beb48bf8a006d2b82f57649c90b22f59044aad@192.168.11.217:30303?discport=0",
   "enode://07daf3d64079faa3982bc8be7aa86c24ef21eca4565aae4a7fd963c55c728de0639d80663834634edf113b9f047d690232ae23423c64979961db4b6449aa6dfd@192.168.11.221:30303",
   "enode://868bd957d6d887944deac0190161a3db7d1316a022e40a2383d5c334aa3fb8bc7ca36f165b6fb377b77d202fec46f3840f2f659b6a47807b7ce9b944b8382f10@192.168.11.232:30303",
   "enode://688f271d94c7995600ae36d25aa2fb92fea0c52e50e86c598be8966515458c1408b67fba76e1f771073e4774a6e399588443da63394ea25d56e6ca36f2288e00@192.168.11.233:30303",

config/cosmos-chain138-optional/README.md

@@ -0,0 +1,16 @@
+# Cosmos ↔ Chain 138 — optional config templates
+
+**Purpose:** Machine- and human-readable templates for [COSMOS_ECOSYSTEM_CHAIN138_OPTIONAL_INTEGRATIONS_RUNBOOK.md](../../docs/11-references/COSMOS_ECOSYSTEM_CHAIN138_OPTIONAL_INTEGRATIONS_RUNBOOK.md) streams **A–E**. These files are **examples** until operators copy them to a secured location and fill live values.
+
+| File | Stream |
+|------|--------|
+| [corridor-decision.example.md](corridor-decision.example.md) | A (Noble / stable corridor decisions) |
+| [osmosis-routing-flags.example.yaml](osmosis-routing-flags.example.yaml) | B (routing mode, limits) |
+| [denom-trace.example.json](denom-trace.example.json) | C (IBC trace / hash schema) |
+| [cosmwasm-integration.example.md](cosmwasm-integration.example.md) | D (Wasm app pairing) |
+| [cross-cutting.example.md](cross-cutting.example.md) | E (relayers, wallets, audits, closure) |
+| [STATUS.md](STATUS.md) | Doc vs live completion tracking |
+
+**Gaps and inconsistencies (repo-wide audit, includes PMM/CCIP drift):** [COSMOS_CHAIN138_GAPS_AND_INCONSISTENCIES.md](../../docs/11-references/COSMOS_CHAIN138_GAPS_AND_INCONSISTENCIES.md)
+
+Do **not** commit production keys, channel IDs, or signed vendor contracts here.

config/cosmos-chain138-optional/STATUS.md

@@ -0,0 +1,18 @@
+# Streams A–E — completion status (repo)
+
+**Updated:** 2026-05-09  
+**Meaning:** **Doc** = runbook + templates in this repo are complete. **Live** = requires operator decisions, contracts, keys, and vendor chains (not asserted here).
+
+**Last LAN operator pass (repo standard scripts, not Cosmos-specific):** `run-completable-tasks-from-anywhere.sh` OK; `run-all-operator-tasks-from-lan.sh --skip-backup` OK (NPMplus proxy refresh + Blockscout verification). Does not deploy IBC or Noble.
+
+| Stream | Doc / template | Live bridge & ops |
+|--------|------------------|-------------------|
+| **A** Noble / stable corridor | Complete (runbook §3 + `corridor-decision.example.md`) | Not live — operator fills decision record and executes on-chain when adopted |
+| **B** Osmosis / Cosmos DEX routing | Complete (runbook §4 + `osmosis-routing-flags.example.yaml`) | Not live — route engine integration when adopted |
+| **C** Generic IBC allowlist | Complete (runbook §5 + `denom-trace.example.json`) | Not live — governance allowlist + registry rows when adopted |
+| **D** CosmWasm app ↔ 138 | Complete (runbook §6 + `cosmwasm-integration.example.md`) | Not live — per-app deploy when adopted |
+| **E** Cross-cutting + program closure | Complete (runbook §7 + `cross-cutting.example.md`) | Partially live only if A–D adopted (relayers, audits, etc.) |
+
+**Deferred / out of scope until adoption:** Any mainnet IBC channel, Noble mint path, Osmosis swap execution, CosmWasm ICA, and production relayer keys.
+
+**Full gaps + inconsistency inventory:** [COSMOS_CHAIN138_GAPS_AND_INCONSISTENCIES.md](../../docs/11-references/COSMOS_CHAIN138_GAPS_AND_INCONSISTENCIES.md)

config/cosmos-chain138-optional/corridor-decision.example.md

@@ -0,0 +1,43 @@
+# Stream A — corridor decision record (example)
+
+Copy to internal wiki or secured docs. Replace all `TODO`.
+
+## A1 Source and bridge stack
+
+| Field | Value |
+|-------|--------|
+| Source chain | TODO (e.g. Noble) |
+| Bridge vendor / stack | TODO (e.g. general-message bridge, CCTP path, or oracle-operated) |
+| Vendor documentation URL | TODO |
+
+## A2 138-side contracts and roles
+
+| Role | Address or multisig | Notes |
+|------|---------------------|--------|
+| Admin | TODO | |
+| Pauser | TODO | |
+| Oracle or verifier | TODO | |
+
+## A3 Denom → Chain 138 token mapping
+
+| IBC denom / trace | Chain 138 token address | Decimals | Canonical ref |
+|-------------------|-------------------------|----------|---------------|
+| TODO | TODO | TODO | EXPLORER_TOKEN_LIST_CROSSCHECK + ADDRESS_MATRIX |
+
+## A4 ChainRegistry
+
+| chainIdentifier | adapter (138) | additionalData summary |
+|-----------------|----------------|-------------------------|
+| TODO | TODO | TODO (channel IDs, bridge contract on counterparty) |
+
+## A5 Liquidity
+
+| Venue | Amount / policy | Owner sign-off |
+|-------|-----------------|----------------|
+| TODO | TODO | TODO |
+
+## A6 E2E evidence
+
+| Direction | Tx hash / link | Date |
+|-----------|----------------|------|
+| TODO | TODO | TODO |

config/cosmos-chain138-optional/cosmwasm-integration.example.md

@@ -0,0 +1,29 @@
+# Stream D — CosmWasm app pairing (example)
+
+## D1 Contract pins
+
+| Network | Contract address | Code ID | Migrate policy |
+|---------|------------------|---------|------------------|
+| TODO | TODO | TODO | frozen / multisig / DAO |
+
+## D2 Control path
+
+Chosen path: TODO (ICA / ICQ / GMP to EVM / off-chain coordinator + oracle)
+
+Attach sequence diagram URL: TODO
+
+## D3 Chain 138 counterpart
+
+| Contract | Address | Purpose |
+|----------|---------|---------|
+| TODO | TODO | vault / adapter / settlement |
+
+## D4 Hyperledger
+
+Required: yes / no — if yes, cite Cacti/Firefly task from MULTI_CHAIN_DEPLOYMENT_GUIDE Phase 4.
+
+## D5 Wasm CI
+
+Repository: TODO  
+Build command: TODO  
+Upgrade runbook URL: TODO

config/cosmos-chain138-optional/cross-cutting.example.md

@@ -0,0 +1,43 @@
+# Stream E — cross-cutting + program closure (example)
+
+## E1 IBC relayers
+
+| Channel | Relayer operator | Key custody | SLA |
+|---------|------------------|-------------|-----|
+| TODO | TODO | TODO | TODO |
+
+## E2 Wallets (Cosmos legs)
+
+| Wallet | Supported flows | User doc URL |
+|--------|-----------------|--------------|
+| Keplr | TODO | TODO |
+| Leap | TODO | TODO |
+| MetaMask Snap (if used) | TODO | TODO |
+
+## E3 Indexing and observability
+
+| System | Cosmos / IBC events | Retention |
+|--------|---------------------|-----------|
+| TODO | TODO | TODO |
+
+## E4 Audits
+
+| Scope | Vendor | Report URL | Date |
+|-------|--------|------------|------|
+| TODO bridge | TODO | TODO | TODO |
+
+## E5 Rate limits
+
+| Surface | Limit | Enforced by |
+|---------|-------|-------------|
+| Mint API | TODO | TODO |
+| On-chain mint/burn | TODO | contract |
+
+## E6 Program closure
+
+| Milestone | Owner | Date |
+|-----------|-------|------|
+| Preconditions P1–P5 signed | TODO | TODO |
+| Streams adopted (product A–D + closure E) | TODO | TODO |
+| CHAINS_AND_PROTOCOLS + GALATIC updated for live only | TODO | TODO |
+| Annual review scheduled | TODO | TODO |

config/cosmos-chain138-optional/denom-trace.example.json

@@ -0,0 +1,19 @@
+{
+  "$schema_comment": "Stream C — example IBC trace record for allowlist + ChainRegistry.additionalData mirror",
+  "tier": "TIER_1_GOVERNANCE",
+  "ibc_hash": "TODO_ibc_hash_or_full_denom",
+  "path": [
+    {
+      "port_id": "transfer",
+      "channel_id": "TODO",
+      "counterparty_chain_id": "TODO",
+      "counterparty_channel_id": "TODO"
+    }
+  ],
+  "human_readable_denom": "TODO",
+  "bridge_stack_id": "TODO_vendor_or_internal_id",
+  "chain138_token_address": "0x0000000000000000000000000000000000000000",
+  "decimals": 6,
+  "canonical_crosscheck_ref": "docs/11-references/EXPLORER_TOKEN_LIST_CROSSCHECK.md",
+  "user_warning_long_trace": true
+}

config/cosmos-chain138-optional/osmosis-routing-flags.example.yaml

@@ -0,0 +1,13 @@
+# Stream B — routing integration flags (example)
+# Copy into route-engine or service config when Osmosis/Cosmos DEX leg is adopted.
+
+cosmos_dex_routing:
+  mode: quotes_only   # quotes_only | executable_swaps
+  max_slippage_bps: 50
+  ibc_timeout_seconds: 600
+  quote_ttl_seconds: 30
+  chains_allowlist: []   # e.g. cosmoshub-4, osmosis-1 — fill when live
+  fail_closed_on_timeout: true
+  aggregator_alignment:
+    use_axelar_squid_patterns: false   # set true when wired to explorer/squid stack
+    review_doc: docs/11-references/BRIDGE_CHAINS_IMPLEMENTATION_COMPLETE.md

config/dbis-ecosystem-master-plan-tracker.json

@@ -0,0 +1,166 @@
+{
+  "schemaVersion": "1.0.0",
+  "updated": "2026-04-24",
+  "canonicalRootDoc": "docs/02-architecture/DBIS_ECOSYSTEM_TECHNICAL_MASTER_PLAN.md",
+  "workstreams": [
+    {
+      "id": "W1",
+      "title": "Besu / Chain 138 infrastructure and RPC topology",
+      "status": "live",
+      "horizon": "near_term",
+      "ownerClass": "mixed",
+      "dependsOn": [],
+      "sourceDocs": [
+        "docs/06-besu/BESU_NODE_CONFIGURATION_MAP_20260424.md",
+        "dbis_chain_138_technical_master_plan.md",
+        "docs/03-deployment/PROXMOX_VE_OPERATIONAL_DEPLOYMENT_TEMPLATE.md"
+      ],
+      "acceptanceGate": "Canonical Besu inventory reconciled across all active cluster hosts, block production healthy, and no unexplained canonical node gaps remain.",
+      "evidenceArtifact": "scripts/verify/check-cluster-besu-inventory.sh --json"
+    },
+    {
+      "id": "W2",
+      "title": "Liquidity, PMM, bridge, and public routing coverage",
+      "status": "partially live",
+      "horizon": "near_term",
+      "ownerClass": "mixed",
+      "dependsOn": [
+        "W1"
+      ],
+      "sourceDocs": [
+        "docs/11-references/DEPLOYER_TO_PUBLIC_STABLECOIN_ROUTES.md",
+        "docs/11-references/DEPLOYED_TOKENS_BRIDGES_LPS_AND_ROUTING_STATUS.md",
+        "reports/status/LIVE_ECOSYSTEM_FINANCIAL_INVENTORY_AND_ROUTING_GAPS_20260424.md"
+      ],
+      "acceptanceGate": "Machine-readable route coverage is current and can distinguish live, partial, and blocked routing paths for stablecoins and top assets.",
+      "evidenceArtifact": "config/public-routing-coverage-matrix.json"
+    },
+    {
+      "id": "W3",
+      "title": "Phoenix deploy/control-plane integration",
+      "status": "partially live",
+      "horizon": "near_term",
+      "ownerClass": "mixed",
+      "dependsOn": [
+        "W1",
+        "W2",
+        "W4"
+      ],
+      "sourceDocs": [
+        "docs/04-configuration/PHOENIX_SANKOFA_OPERATOR_HANDOFF.md",
+        "docs/02-architecture/DBIS_ECOSYSTEM_TECHNICAL_MASTER_PLAN.md"
+      ],
+      "acceptanceGate": "Phoenix deploy/control APIs expose current canonical manifests and validated deploy targets without drifting from repo truth.",
+      "evidenceArtifact": "scripts/validation/validate-config-files.sh"
+    },
+    {
+      "id": "W4",
+      "title": "URA manifest, policy profiles, registry, and route confidence",
+      "status": "repo-implemented",
+      "horizon": "near_term",
+      "ownerClass": "repo",
+      "dependsOn": [
+        "W2",
+        "W3"
+      ],
+      "sourceDocs": [
+        "docs/04-configuration/universal-resource-activation/URA_MANIFEST_AUTOMATION_IMPLEMENTATION_TRACKER.md",
+        "docs/04-configuration/universal-resource-activation/README.md",
+        "config/universal-resource-activation/manifest.json"
+      ],
+      "acceptanceGate": "URA manifest and policy profiles validate, registry references are coherent, and route-confidence can be produced as a first-class control-plane artifact.",
+      "evidenceArtifact": "scripts/validate/validate-universal-resource-activation.mjs"
+    },
+    {
+      "id": "W5",
+      "title": "DBIS RTGS / DBIS Rail / OMNL / settlement sidecars",
+      "status": "partially live",
+      "horizon": "near_term",
+      "ownerClass": "mixed",
+      "dependsOn": [
+        "W4",
+        "W6"
+      ],
+      "sourceDocs": [
+        "docs/03-deployment/DBIS_RTGS_MASTER_PLAN_IMPLEMENTATION_TRACKER.md",
+        "docs/dbis-rail/DBIS_RAIL_SETTLEMENT_EVENT_SOURCES.md",
+        "docs/03-deployment/DBIS_RTGS_FIRST_SLICE_ARCHITECTURE.md"
+      ],
+      "acceptanceGate": "First-slice settlement boundaries, event sources, custody roles, and sidecar responsibilities are explicit enough for production gating.",
+      "evidenceArtifact": "docs/03-deployment/DBIS_RTGS_MASTER_PLAN_IMPLEMENTATION_TRACKER.md"
+    },
+    {
+      "id": "W6",
+      "title": "Jurisdiction/compliance and onboarding matrices",
+      "status": "repo-implemented",
+      "horizon": "near_term",
+      "ownerClass": "repo",
+      "dependsOn": [
+        "W4"
+      ],
+      "sourceDocs": [
+        "docs/04-configuration/compliance-matrices/README.md",
+        "docs/04-configuration/jurisdictions/JURISDICTION_CATALOG.md",
+        "docs/dbis-rail/DBIS_RAIL_JURISDICTION_TRACEABILITY.md"
+      ],
+      "acceptanceGate": "Jurisdiction and onboarding matrices are machine-readable enough to gate policy profiles and institutional activation paths.",
+      "evidenceArtifact": "config/jurisdictions/catalog.v1.json"
+    },
+    {
+      "id": "W7",
+      "title": "Identity / Hyperledger / interoperability stack",
+      "status": "planned",
+      "horizon": "long_term",
+      "ownerClass": "external",
+      "dependsOn": [
+        "W5",
+        "W6"
+      ],
+      "sourceDocs": [
+        "docs/03-deployment/DBIS_HYPERLEDGER_RUNTIME_STATUS.md",
+        "docs/03-deployment/DBIS_HYPERLEDGER_IDENTITY_STACK_DECISION.md"
+      ],
+      "acceptanceGate": "Identity and interoperability slices have explicit runtime ownership, promotion gates, and environment-specific deployment decisions.",
+      "evidenceArtifact": "docs/03-deployment/DBIS_HYPERLEDGER_RUNTIME_STATUS.md"
+    },
+    {
+      "id": "W8",
+      "title": "Observability, verification, evidence, and operator readiness",
+      "status": "live",
+      "horizon": "near_term",
+      "ownerClass": "mixed",
+      "dependsOn": [
+        "W1",
+        "W2",
+        "W3",
+        "W4",
+        "W5",
+        "W6"
+      ],
+      "sourceDocs": [
+        "docs/00-meta/OPERATOR_HANDOFF_2026_04_24.md",
+        "docs/00-meta/OPERATOR_READY_CHECKLIST.md",
+        "docs/04-configuration/universal-resource-activation/URA_OPERATIONAL_READINESS_CHECKLIST.md"
+      ],
+      "acceptanceGate": "Validation, health, and operator readiness outputs are current enough to act as production gates rather than ad hoc references.",
+      "evidenceArtifact": "scripts/verify/run-all-validation.sh"
+    }
+  ],
+  "blockedBy": [
+    {
+      "id": "B1",
+      "class": "external",
+      "description": "Some institutional integrations, custody counterparties, and settlement-sidecar dependencies cannot be closed from repo-only work."
+    },
+    {
+      "id": "B2",
+      "class": "external",
+      "description": "Some public-network expansion lanes remain constrained by third-party bridge, exchange, or destination-liquidity realities."
+    },
+    {
+      "id": "B3",
+      "class": "operator",
+      "description": "Operator promotion of URA, sidecar, and policy-aware runtime slices still trails repo implementation in several areas."
+    }
+  ]
+}

config/dbis-institutional/registry/chain138-cusdc-v2.json

@@ -0,0 +1,21 @@
+{
+  "registryEntryId": "a5c115dd-e147-4eb5-8cf1-f7d9c38f959e",
+  "entity_id": "98450070C57395F6B906",
+  "jurisdiction": "International",
+  "chain_id": 138,
+  "address": "0x1ac3F4942a71E86A9682D91837E1E71b7BACdF99",
+  "addressRole": "token_contract",
+  "aliases": [
+    {
+      "aliasType": "internal_slug",
+      "aliasValue": "chain138-cusdc-v2",
+      "validFrom": "2026-03-31T08:22:11Z"
+    }
+  ],
+  "blockscout": {
+    "label": "Chain 138 cUSDC V2 (staged)",
+    "labelType": "token"
+  },
+  "status": "active",
+  "lastCorrelationId": "deploy-cusdc-v2-2026-03-31"
+}

config/dbis-institutional/registry/chain138-cusdt-v2.json

@@ -0,0 +1,21 @@
+{
+  "registryEntryId": "3cc7d52c-26fb-4afb-9508-0c102f8f6f81",
+  "entity_id": "98450070C57395F6B906",
+  "jurisdiction": "International",
+  "chain_id": 138,
+  "address": "0x8d342d321DdEe97D0c5011DAF8ca0B59DA617D29",
+  "addressRole": "token_contract",
+  "aliases": [
+    {
+      "aliasType": "internal_slug",
+      "aliasValue": "chain138-cusdt-v2",
+      "validFrom": "2026-03-31T08:22:11Z"
+    }
+  ],
+  "blockscout": {
+    "label": "Chain 138 cUSDT V2 (staged)",
+    "labelType": "token"
+  },
+  "status": "active",
+  "lastCorrelationId": "deploy-cusdt-v2-2026-03-31"
+}

config/defillama-chain138-touchpoints.json

@@ -0,0 +1,125 @@
+{
+  "chainId": 138,
+  "chainName": "Defi Oracle Meta Mainnet",
+  "defillamaSdkChainKey": "dfio_meta_main",
+  "chainProfile": {
+    "displayName": "Defi Oracle Meta",
+    "xHandle": "@DefiOracleMeta",
+    "xUrl": "https://x.com/DefiOracleMeta",
+    "note": "Canonical X profile for the Chain 138 / Defi Oracle Meta network narrative — distinct from third-party DEX protocol accounts used in per-protocol (e.g. DODO) listings."
+  },
+  "regulatoryFraming": "Compliant digital money / e-money settlement rail — TVL adapters measure on-chain contract balances, not issuer licensing status.",
+  "upstream": {
+    "defillamaAdapters": "https://github.com/DefiLlama/DefiLlama-Adapters",
+    "upstreamPullRequest": "https://github.com/DefiLlama/DefiLlama-Adapters/pull/19198",
+    "upstreamPullRequestState": "open",
+    "upstreamPullRequestStateAsOf": "2026-05-10",
+    "upstreamPullRequestLastGhCheckUtc": "2026-05-10T19:59Z",
+    "fork": "https://github.com/Defi-Oracle-Meta-Blockchain/DefiLlama-Adapters",
+    "defillamaServer": "https://github.com/DefiLlama/defillama-server",
+    "dimensionAdapters": "https://github.com/DefiLlama/dimension-adapters"
+  },
+  "implemented": {
+    "tvlAdapter": {
+      "protocol": "dodo",
+      "paths": [
+        "projects/dodo/index.js",
+        "projects/helper/chains.json",
+        "projects/helper/tokenMapping.js"
+      ],
+      "factoryAddress": "0xc93870594C7f83A0aE076c2e30b494Efc526b68E",
+      "fromBlock": 3510162,
+      "stablecoinMappings": {
+        "cUSDT": {
+          "address": "0x93E66202A11B1772E55407B32B44e5Cd8eda7f22",
+          "coingeckoId": "tether",
+          "decimals": 6
+        },
+        "cUSDC": {
+          "address": "0xf22258f57794CC8E06237084b353Ab30fFfa640b",
+          "coingeckoId": "usd-coin",
+          "decimals": 6
+        }
+      }
+    },
+    "defillamaServerLocalBranch": {
+      "note": "Prepare PR from fork — see checklist doc",
+      "paths": [
+        "defi/src/utils/normalizeChain.ts",
+        "defi/src/protocols/data1.ts"
+      ],
+      "summary": "Chain label + chainId 138 for UI; DODO AMM chains[] + oraclesBreakdown proof"
+    },
+    "dimensionAdaptersLocalBranch": {
+      "paths": ["helpers/chains.ts", "dexs/dodo/index.ts", "fees/dodo-fees.ts"],
+      "summary": "CHAIN.DFIO_META_MAIN added; fees/dex blocked on DODO GraphQL until chain 138 is supported"
+    }
+  },
+  "blockedExternal": [
+    {
+      "component": "DODO dashboard GraphQL (dex volume)",
+      "detail": "DashboardChainData volume selection has no dfio_meta_main field — api.dodoex.io rejects query",
+      "tracked": "dexs/dodo/index.ts header comment"
+    },
+    {
+      "component": "DODO gateway fees API",
+      "detail": "chain=dfio_meta_main spot-check returned mixed networks with top pairs",
+      "tracked": "fees/dodo-fees.ts header comment"
+    }
+  ],
+  "forms": {
+    "tokenRights": {
+      "url": "https://forms.defillama.com/token-rights",
+      "draftDoc": "docs/04-configuration/defillama/DEFILLAMA_CHAIN138_SUBMISSION_CHECKLIST.md"
+    },
+    "rwaSubmission": {
+      "url": "https://forms.defillama.com/rwa-submission",
+      "draftDoc": "docs/04-configuration/defillama/DEFILLAMA_CHAIN138_SUBMISSION_CHECKLIST.md"
+    }
+  },
+  "optionalFollowUps": [
+    {
+      "metric": "fees_revenue_dex_volume",
+      "repository": "dimension-adapters",
+      "note": "Unblocked when DODO GraphQL exposes dfio_meta_main volume and chain-scoped fees"
+    },
+    {
+      "metric": "yields",
+      "repository": "yield-server",
+      "note": "Optional APY surfaces for eligible pools"
+    },
+    {
+      "metric": "stablecoins_pegged",
+      "repository": "peggedassets-server",
+      "note": "Optional circulating/peg series for compliant stables"
+    },
+    {
+      "metric": "gitea_mirror",
+      "note": "scripts/deployment/mirror-github-fork-to-gitea.sh"
+    },
+    {
+      "metric": "dimension_adapters_docs",
+      "documentation": "https://docs.llama.fi/list-your-project/other-dashboards",
+      "repository": "dimension-adapters",
+      "note": "Fees/dexs after API unblock"
+    },
+    {
+      "metric": "oracles_tvs",
+      "documentation": "https://docs.llama.fi/list-your-project/oracles-tvs",
+      "repository": "defillama-server",
+      "note": "oraclesBreakdown proof populated on DODO AMM entry; extend with chain-specific rows when documented"
+    },
+    {
+      "metric": "tvl_helpers_docs",
+      "documentation": "https://docs.llama.fi/list-your-project/functions-weve-written-so-you-dont-have-to",
+      "note": "sumTokensExport, getBlock, LP unwrap — use for treasury/vault/LP TVL patterns"
+    }
+  ],
+  "docs": {
+    "ecosystemMap": "docs/04-configuration/defillama/CHAIN138_DEFILLAMA_ECOSYSTEM_MAP.md",
+    "submissionChecklist": "docs/04-configuration/defillama/DEFILLAMA_CHAIN138_SUBMISSION_CHECKLIST.md",
+    "dodoDfioMetaMainTvlNote": "docs/11-references/DEFILLAMA_DFIO_META_MAIN_DODO_ADAPTER_TVL.md",
+    "masterReference": "docs/00-meta/METAMASK_GRU_DEFILLAMA_CHAIN138_MASTER_REFERENCE.md",
+    "repositoriesAndPrs": "docs/00-meta/REPOSITORIES_AND_PRS_CHAIN138.md"
+  }
+}

config/elemental-imperium-network-registry.json

@@ -0,0 +1,37 @@
+{
+  "registryVersion": 1,
+  "purpose": "Authoritative network codes for Elemental Imperium (33×33×6) wallet labels. Grid addresses are treasuries for sovereign nations in the EI model; ASNs are optional; add when assigned.",
+  "labelSpec": {
+    "id": "ei-wallet-label-v1",
+    "cellIdFormat": "EI-L{lpbca:02d}-B{branch:02d}-C{class}",
+    "labelFormatDefault": "{networkCode}.{cellId}",
+    "labelFormatWithAsn": "{networkCode}.{cellId}.AS{asn}",
+    "notes": [
+      "cellId is stable and never depends on ASN or network reassignment uses.",
+      "networkCode is lowercase kebab-case; use this registry as the allow-list.",
+      "When asn is assigned, append .AS{n} with integer n (no leading AS in the number token beyond the literal AS prefix)."
+    ]
+  },
+  "defaultNetworkCode": "unassigned",
+  "overlayExamplePath": "config/elemental-imperium-wallet-overlay.example.json",
+  "networks": [
+    {
+      "code": "unassigned",
+      "displayName": "Not yet mapped to an operational network",
+      "asn": null,
+      "status": "placeholder"
+    },
+    {
+      "code": "chain138-core",
+      "displayName": "Chain 138 execution / RPC plane (internal)",
+      "asn": null,
+      "status": "planned"
+    },
+    {
+      "code": "operator-lan",
+      "displayName": "Operator management LAN (e.g. 192.168.11.0/24)",
+      "asn": null,
+      "status": "planned"
+    }
+  ]
+}

config/elemental-imperium-wallet-overlay.example.json

@@ -0,0 +1,23 @@
+{
+  "overlayVersion": 1,
+  "description": "Optional mapping layered on registry defaults. rangeRules: first matching rule sets networkCode and asn for that wallet. cellOverrides: per cellId, partial overrides win over rangeRules.",
+  "rangeRules": [
+    {
+      "comment": "Example: LPBCA slice 0–10 on chain138-core; remove or edit when ASNs are assigned",
+      "match": {
+        "lpbca": [0, 10],
+        "branch": [0, 32],
+        "class": [0, 5]
+      },
+      "networkCode": "chain138-core",
+      "asn": null
+    }
+  ],
+  "cellOverrides": {
+    "EI-L00-B00-C0": {
+      "comment": "Example single-cell override",
+      "networkCode": "unassigned",
+      "asn": null
+    }
+  }
+}

config/engine-x/automation-policy.json

@@ -0,0 +1,122 @@
+{
+  "version": "1.0.0",
+  "updated": "2026-05-09",
+  "component": "DBIS Engine X",
+  "purpose": "Automation policy for API-fed liquidity advice, XAUt-backed USDC capacity calculation, cW* output planning, on-chain execution gates, and endpoint reporting.",
+  "mode": {
+    "default": "read_only_advisor",
+    "liveExecutionRequires": [
+      "operator_approval",
+      "protected_transaction_rpc",
+      "fresh_live_quotes",
+      "funded_usdc_lender_or_public_quote_inventory",
+      "passing_solidity_preview",
+      "nonzero_iso_audit_peg_hashes"
+    ]
+  },
+  "inputs": {
+    "requestedOutput": {
+      "symbolEnv": "ENGINE_X_REQUESTED_CW_SYMBOL",
+      "defaultSymbol": "cWUSDC",
+      "amountRawEnv": "ENGINE_X_REQUESTED_OUTPUT_RAW",
+      "amountUnitsEnv": "ENGINE_X_REQUESTED_OUTPUT_UNITS",
+      "supportedInitialSymbols": [
+        "cWUSDC"
+      ]
+    },
+    "collateral": {
+      "symbol": "XAUt",
+      "availableRawEnv": "ENGINE_X_XAUT_AVAILABLE_RAW",
+      "availableUnitsEnv": "ENGINE_X_XAUT_AVAILABLE_UNITS",
+      "usdPrice6Env": "ENGINE_X_XAUT_USD_PRICE6",
+      "defaultUsdPrice6": "3226640000"
+    },
+    "risk": {
+      "ltvBpsEnv": "ENGINE_X_BORROW_LTV_BPS",
+      "defaultLtvBps": 7500,
+      "minHealthFactorBpsEnv": "ENGINE_X_BORROW_MIN_HEALTH_FACTOR_BPS",
+      "defaultMinHealthFactorBps": 11000,
+      "maxRoundTripLossBpsEnv": "ENGINE_X_MAX_ROUND_TRIP_LOSS_BPS",
+      "defaultMaxRoundTripLossBps": 100,
+      "maxPublicSwapLossBpsEnv": "ENGINE_X_MAX_PUBLIC_SWAP_LOSS_BPS",
+      "defaultMaxPublicSwapLossBps": 75,
+      "minGasReserveWeiEnv": "ENGINE_X_MIN_GAS_RESERVE_WEI",
+      "defaultMinGasReserveWei": "5000000000000000"
+    }
+  },
+  "feeds": {
+    "repoReports": [
+      "reports/status/mainnet-cwusdc-usdc-support-health-latest.json",
+      "reports/status/engine-x-public-indexed-readiness-latest.json",
+      "reports/status/engine-x-mev-defense-readiness-latest.json",
+      "reports/status/mainnet-cwusdc-weth-liquidity-surfaces-latest.json"
+    ],
+    "onChainReadinessCommands": [
+      "pnpm engine-x:public-readiness",
+      "pnpm engine-x:mev-defense",
+      "pnpm engine-x:weth-liquidity-eval",
+      "python3 scripts/verify/check-mainnet-cwusdc-usdc-support-health.py"
+    ],
+    "externalPublicationTargets": [
+      "token-aggregation public report API",
+      "CoinGecko tracker package",
+      "CoinMarketCap tracker package",
+      "Etherscan public transaction and pool pages",
+      "DexScreener and GeckoTerminal indexed pool pages",
+      "exchange listing or OTC due-diligence packet",
+      "Forex desk liquidity and proof packet"
+    ]
+  },
+  "decisionGates": {
+    "apiAdvisor": [
+      "all required report feeds are present or regenerated",
+      "requested output token is supported",
+      "calculator produces positive capacity",
+      "all blocker fields are explicit"
+    ],
+    "liveExecution": [
+      "MEV defense readiness is ready",
+      "selected liquidity surface has live indexable pool evidence",
+      "selected public swap has nonzero quote and minOut",
+      "USDC debt after loop is zero",
+      "XAUt collateral withdrawal is previewed after repayment",
+      "no route substitutes DODO, UniV2, UniV3, WETH, or USDC roles silently",
+      "operator has reviewed generated commands"
+    ],
+    "publication": [
+      "on-chain transaction hashes are present",
+      "before and after reserves or slot0/liquidity are present",
+      "ISO 20022-style proof hash is present when applicable",
+      "audit envelope hash is present",
+      "peg proof hash is present",
+      "public endpoint package was regenerated after execution"
+    ]
+  },
+  "automationPhases": [
+    {
+      "id": "phase_0_advisor",
+      "name": "Read-only API and calculator advice",
+      "broadcast": false
+    },
+    {
+      "id": "phase_1_canary",
+      "name": "Protected tiny public canary execution",
+      "broadcast": "operator_approved_only"
+    },
+    {
+      "id": "phase_2_liquidity_defense",
+      "name": "Automated protected rebalance and quote defense",
+      "broadcast": "after_canary_and_loss_limits"
+    },
+    {
+      "id": "phase_3_endpoint_publication",
+      "name": "Regenerate reports and publish endpoint packets",
+      "broadcast": false
+    },
+    {
+      "id": "phase_4_multi_asset_forex_crypto",
+      "name": "Extend cW* request symbols and FX/crypto endpoint packets",
+      "broadcast": "per_asset_policy"
+    }
+  ]
+}

config/extraction/additional-wallet-inventory.json

@@ -0,0 +1,62 @@
+{
+  "template_version": "1.1.0",
+  "purpose": "Additional on-chain and off-chain inventory for the source-to-CEX execution model.",
+  "questions_to_fill": [
+    "All additional EVM EOAs or smart-wallet addresses",
+    "Any multisigs, vaults, or treasury contracts you want included",
+    "Any custodial or exchange balances to include off-chain",
+    "Any LP or staking positions not visible from wallet token balances alone",
+    "The real production CEX or OTC sink to use for handoff"
+  ],
+  "wallets": [
+    {
+      "label": "primary-deployer-documented",
+      "address": "0x4A666F96fC8764181194447A7dFdb7d471b301C8",
+      "chains": [
+        "1",
+        "138"
+      ],
+      "role": "treasury",
+      "include_in_baseline": true,
+      "notes": "Canonical documented deployer wallet. Deduplicate against primary baseline if loaded twice."
+    }
+  ],
+  "offchain_accounts": [
+    {
+      "label": "example-exchange",
+      "platform": "unknown",
+      "account_type": "unknown",
+      "operational_status": "planned",
+      "enabled_for_production_handoff": false,
+      "accepted_deposit_assets": [
+        "USDC"
+      ],
+      "preferred_deposit_asset": "USDC",
+      "deposit_chain_id": "1",
+      "deposit_chain_name": "Ethereum Mainnet",
+      "deposit_address": "",
+      "min_packet_usd": 1000,
+      "max_packet_usd": 250000,
+      "slippage_ceiling_bps": 100,
+      "asset_balances": [
+        {
+          "symbol": "USDC",
+          "amount": 0,
+          "estimated_usd": 0,
+          "chain_id": "offchain",
+          "chain_name": "Off-chain / custodial",
+          "notes": "Replace with a real balance only when you want it counted."
+        }
+      ],
+      "include_in_baseline": false,
+      "notes": "Replace with a real sink before enabling production handoff."
+    }
+  ],
+  "risk_preferences": {
+    "max_drawdown_pct": null,
+    "liquidity_need_horizon": null,
+    "bridging_allowed": null,
+    "lp_allowed": null,
+    "leverage_allowed": null
+  }
+}

config/extraction/additional-wallet-inventory.template.json

@@ -0,0 +1,62 @@
+{
+  "template_version": "1.1.0",
+  "purpose": "Additional on-chain and off-chain inventory for the source-to-CEX execution model.",
+  "questions_to_fill": [
+    "All additional EVM EOAs or smart-wallet addresses",
+    "Any multisigs, vaults, or treasury contracts you want included",
+    "Any custodial or exchange balances to include off-chain",
+    "Any LP or staking positions not visible from wallet token balances alone",
+    "The real production CEX or OTC sink to use for handoff"
+  ],
+  "wallets": [
+    {
+      "label": "primary-deployer-documented",
+      "address": "0x4A666F96fC8764181194447A7dFdb7d471b301C8",
+      "chains": [
+        "1",
+        "138"
+      ],
+      "role": "treasury",
+      "include_in_baseline": true,
+      "notes": "Canonical documented deployer wallet. Deduplicate against primary baseline if loaded twice."
+    }
+  ],
+  "offchain_accounts": [
+    {
+      "label": "example-exchange",
+      "platform": "unknown",
+      "account_type": "unknown",
+      "operational_status": "planned",
+      "enabled_for_production_handoff": false,
+      "accepted_deposit_assets": [
+        "USDC"
+      ],
+      "preferred_deposit_asset": "USDC",
+      "deposit_chain_id": "1",
+      "deposit_chain_name": "Ethereum Mainnet",
+      "deposit_address": "",
+      "min_packet_usd": 1000,
+      "max_packet_usd": 250000,
+      "slippage_ceiling_bps": 100,
+      "asset_balances": [
+        {
+          "symbol": "USDC",
+          "amount": 0,
+          "estimated_usd": 0,
+          "chain_id": "offchain",
+          "chain_name": "Off-chain / custodial",
+          "notes": "Replace with a real balance only when you want it counted."
+        }
+      ],
+      "include_in_baseline": false,
+      "notes": "Replace with a real sink before enabling production handoff."
+    }
+  ],
+  "risk_preferences": {
+    "max_drawdown_pct": null,
+    "liquidity_need_horizon": null,
+    "bridging_allowed": null,
+    "lp_allowed": null,
+    "leverage_allowed": null
+  }
+}

config/extraction/mainnet-cwusdc-usdc-support-policy.json

@@ -0,0 +1,138 @@
+{
+  "version": "1.0.0",
+  "updated": "2026-05-08",
+  "rail": "mainnet_cwusdc_usdc",
+  "network": {
+    "chainId": 1,
+    "name": "Ethereum Mainnet",
+    "rpcEnvKeys": [
+      "ETHEREUM_MAINNET_RPC"
+    ]
+  },
+  "publicPair": {
+    "base": "cWUSDC",
+    "quote": "USDC",
+    "role": "discovery_lane",
+    "venue": "uniswap_v2_pair",
+    "poolAddress": "0xC28706F899266b36BC43cc072b3a921BDf2C48D9"
+  },
+  "defendedVenue": {
+    "base": "cWUSDC",
+    "quote": "USDC",
+    "role": "primary_defense",
+    "venue": "dodo_pmm",
+    "poolAddress": "0x69776fc607e9edA8042e320e7e43f54d06c68f0E",
+    "managedCycleScript": "smom-dbis-138/script/flash/RunManagedMainnetAaveCwusdcUsdcQuotePushCycle.s.sol:RunManagedMainnetAaveCwusdcUsdcQuotePushCycle"
+  },
+  "quoteDefenseSurfaces": [
+    {
+      "id": "mainnet-cwusdc-usdc-univ3-100",
+      "base": "cWUSDC",
+      "quote": "USDC",
+      "role": "primary_public_indexed_quote_defense",
+      "venue": "uniswap_v3_pool",
+      "poolAddress": "0x1Cf2e685682C7F7beF508F0Af15Dfb5CDda01ee3",
+      "fee": 100,
+      "routerAddress": "0xE592427A0AEce92De3Edee1F18E0157C05861564",
+      "quoterAddress": "0x61fFE014bA17989E743c5F6cB21bF9697530B21e",
+      "activeRange": {
+        "preferredLowerTick": -100,
+        "preferredUpperTick": 100,
+        "targetTick": 0
+      },
+      "defenseMode": "quote_side_tick_reentry_then_proof_swaps",
+      "automationStatus": "operator_review_required",
+      "notes": [
+        "Primary public/indexable quote-defense surface for tiny 1:1 canaries.",
+        "If current tick is below -100, first push quote side with USDC->cWUSDC until the old -100..100 position re-enters range.",
+        "Do not assume historical 75/75 or 85/85 liquidity is active; verify slot0 tick, active liquidity, and token balances before proof swaps."
+      ]
+    },
+    {
+      "id": "mainnet-cwusdc-usdc-univ2",
+      "base": "cWUSDC",
+      "quote": "USDC",
+      "role": "secondary_public_indexed_quote_defense",
+      "venue": "uniswap_v2_pair",
+      "poolAddress": "0xC28706F899266b36BC43cc072b3a921BDf2C48D9",
+      "routerAddress": "0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D",
+      "defenseMode": "quote_side_reserve_repair",
+      "automationStatus": "capital_gated",
+      "notes": [
+        "Public/indexable reserve surface for larger swaps.",
+        "Use only after fresh reserve read and quote-side repair sizing.",
+        "Current role is secondary because the pair is quote-starved."
+      ]
+    },
+    {
+      "id": "mainnet-cwusdc-usdc-dodo-managed",
+      "base": "cWUSDC",
+      "quote": "USDC",
+      "role": "managed_defended_quote_push",
+      "venue": "dodo_pmm",
+      "poolAddress": "0x69776fc607e9edA8042e320e7e43f54d06c68f0E",
+      "defenseMode": "managed_quote_push_cycle",
+      "automationStatus": "capital_gated",
+      "notes": [
+        "Managed defended lane remains distinct from public indexed proof lanes.",
+        "Do not silently substitute this pool for the public spend settlement replacement pool.",
+        "Requires passing DODO quote preview and sufficient official Mainnet USDC quote inventory before automation."
+      ]
+    }
+  ],
+  "thresholds": {
+    "warnDeviationBps": 25,
+    "interveneDeviationBps": 75,
+    "criticalDeviationBps": 150,
+    "minBaseReserveUnits": 2500,
+    "minQuoteReserveUnits": 2500
+  },
+  "managedCycle": {
+    "defaultHarvestSurplus": true,
+    "defaultGasHoldbackTargetRaw": 0,
+    "maxAutomatedFlashQuoteAmountRaw": 2964298,
+    "quoteAmountByDeviationBps": [
+      {
+        "minDeviationBps": 150,
+        "flashQuoteAmountRaw": 2964298
+      },
+      {
+        "minDeviationBps": 75,
+        "flashQuoteAmountRaw": 1482149
+      }
+    ]
+  },
+  "mevDefense": {
+    "status": "required_for_sensitive_execution",
+    "failClosedByDefault": true,
+    "acceptedPrivateRpcEnvKeys": [
+      "ENGINE_X_PRIVATE_TX_RPC",
+      "MEV_BLOCKER_RPC_URL",
+      "FLASHBOTS_RPC_URL",
+      "BLOXROUTE_RPC_URL",
+      "BLINK_RPC_URL"
+    ],
+    "publicBroadcastOverrideEnvKey": "ENGINE_X_ALLOW_PUBLIC_BROADCAST",
+    "disableGuardEnvKey": "ENGINE_X_MEV_PROTECTION",
+    "protectedActions": [
+      "engine-x-univ3-public-swap-proof",
+      "engine-x-univ2-public-indexed-loop",
+      "mainnet-cwusdc-usdc-univ2-canary-repair",
+      "engine-x-univ3-indexed-lp-migration"
+    ],
+    "rules": [
+      "Use private/protected RPC for any live Engine X public-indexed swap, quote repair, LP migration, or rebalance.",
+      "Dry-runs and read-only health checks may use the normal Mainnet RPC.",
+      "Do not broadcast quote-defense transactions through the public mempool unless the operator explicitly sets ENGINE_X_ALLOW_PUBLIC_BROADCAST=1 for a reviewed canary.",
+      "Never print protected RPC URLs in reports; report only the configured provider label or env key."
+    ]
+  },
+  "notes": [
+    "The public Uniswap V2 pair is for visible routing and discovery, not for hard parity guarantees on its own.",
+    "The UniV3 fee-100 pool is the preferred public/indexable quote-defense canary lane when its tick is in or near the configured active range.",
+    "When the public pair drifts beyond the intervention corridor, use the managed DODO quote-push stack as the first automated defense path.",
+    "Do not trust POOL_CWUSDC_USDC_MAINNET from dotenv blindly; this policy is the canonical defended venue binding.",
+    "Automation must select quoteDefenseSurfaces by explicit role and venue; never silently substitute UniV2, UniV3, or DODO for each other.",
+    "Automation is capped to the currently tested safe tranche until the defended lane is explicitly re-sized from fresh liquidity measurements."
+  ]
+}

config/extraction/promod-uniswap-v2-liquidity-policy.json

@@ -0,0 +1,83 @@
+{
+  "program_name": "Mr. Promod Uniswap V2 cW Deep Liquidity Program",
+  "purpose": "Define the desired-state Uniswap V2 or Uniswap-V2-compatible liquidity rollout for cW* and cWAUSDT rails on bridged public networks.",
+  "operator_rule": "When canonical USDC or USDT depth is scarce, concentrate depth first in wrapped support rails and then expand into canonical settlement rails.",
+  "mainnet_funding_posture": {
+    "mode": "triple-rail-support",
+    "required_deployer_assets": [
+      "cWUSDC",
+      "cWUSDT",
+      "cWAUSDT"
+    ],
+    "notes": [
+      "cWUSDC and cWUSDT remain the core settlement-adjacent rails.",
+      "cWAUSDT is the wrapped-depth support asset when canonical USDC or USDT inventory is not yet deep enough."
+    ]
+  },
+  "priority_tiers": {
+    "tier_1": [
+      "1",
+      "8453",
+      "42161",
+      "10",
+      "137"
+    ],
+    "tier_2": [
+      "56",
+      "43114",
+      "100",
+      "42220",
+      "25"
+    ],
+    "tier_3": [
+      "1111"
+    ]
+  },
+  "wrapped_depth_phase": {
+    "preferred_pairs_in_order": [
+      "cWAUSDT/cWUSDC",
+      "cWAUSDT/cWUSDT",
+      "cWUSDT/cWUSDC"
+    ],
+    "allocation_share_pct": {
+      "flagship_pair": 50,
+      "second_pair": 30,
+      "third_pair": 20
+    },
+    "notes": [
+      "This phase is for creating visibly deep wrapped-to-wrapped liquidity before canonical settlement rails are deep enough.",
+      "Wrapped-depth pools strengthen routing and inventory transfer between the cW settlement rails and cWAUSDT support inventory.",
+      "These pools do not replace the eventual need for direct canonical settlement rails."
+    ]
+  },
+  "settlement_phase": {
+    "preferred_pairs_by_hub": {
+      "USDC": [
+        "cWUSDC/USDC",
+        "cWUSDT/USDC",
+        "cWAUSDT/USDC"
+      ],
+      "USDT": [
+        "cWUSDT/USDT",
+        "cWUSDC/USDT",
+        "cWAUSDT/USDT"
+      ]
+    },
+    "notes": [
+      "Settlement-phase pools remain the preferred terminal rails for exchange and OTC normalization.",
+      "Promote settlement rails only after wrapped-depth support is stable and enough canonical stable inventory is available."
+    ]
+  },
+  "uniswap_v2_requirements": {
+    "required_env_suffixes": [
+      "UNISWAP_V2_FACTORY",
+      "UNISWAP_V2_ROUTER",
+      "UNISWAP_V2_START_BLOCK"
+    ],
+    "required_registry_updates": [
+      "cross-chain-pmm-lps/config/deployment-status.json",
+      "token-aggregation env for the target chain",
+      "MCP allowlist or indexer visibility for new pairs"
+    ]
+  }
+}

config/extraction/source-to-cex-production-policy.json

@@ -0,0 +1,35 @@
+{
+  "version": "1.0.0",
+  "last_updated": "2026-04-17",
+  "purpose": "Operator policy for Chain 138 -> Mainnet normalization -> CEX handoff.",
+  "production_enabled": false,
+  "default_route_model": "Chain 138 inventory -> canonical bridge -> Mainnet normalization -> CEX handoff",
+  "operator_defaults": {
+    "primary_same_day_feeder": "cUSDC",
+    "secondary_same_day_feeder": "cUSDT",
+    "stable_lp_mode": "unwind_first",
+    "immediate_assets": [
+      "cWUSDC",
+      "cWUSDT"
+    ],
+    "reject_non_promoted_assets": true
+  },
+  "normalization_policy": {
+    "preferred_settlement_assets": [
+      "USDC",
+      "USDT"
+    ],
+    "default_settlement_asset": "USDC",
+    "allow_usdt_only_with_operator_approval": true,
+    "post_bridge_aggregation_only": true
+  },
+  "packetization_policy": {
+    "bridge_packet_usd_max": 250000,
+    "normalization_packet_usd_max": 100000,
+    "direct_cwusdc_usdc_usage_cap_usd": 213.102461,
+    "direct_cwusdt_usdt_usage_cap_usd": 2.182358,
+    "force_cwusdt_via_cwusdc_threshold_usd": 10,
+    "default_slippage_ceiling_bps": 100,
+    "chunking_mode": "bridge_in_chunks_then_normalize_then_continuous_cex_handoff"
+  }
+}

config/generated-node-configs/config-1500.toml

@@ -0,0 +1,52 @@
+# Besu Configuration for besu-sentry-1 (VMID: 1500)
+# Generated baseline sentry config promoted into first-class repo coverage.
+
+data-path="/data/besu"
+genesis-file=""
+
+# Network
+network-id=138
+p2p-host="192.168.11.150"
+p2p-port=30303
+max-peers=32
+discovery-enabled=true
+
+# RPC
+rpc-http-enabled=true
+rpc-http-host="0.0.0.0"
+rpc-http-port=8545
+rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-cors-origins=["*"]
+rpc-http-api-enable-unsafe-txsigning=true
+
+rpc-ws-enabled=true
+rpc-ws-host="0.0.0.0"
+rpc-ws-port=8546
+rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+
+# GraphQL
+graphql-http-enabled=true
+graphql-http-host="0.0.0.0"
+graphql-http-port=8547
+
+# Metrics
+metrics-enabled=true
+metrics-host="0.0.0.0"
+metrics-port=9545
+
+# Logging
+logging="INFO"
+log-destination="CONSOLE"
+
+# Sync
+sync-mode="FULL"
+fast-sync-min-peers=2
+
+# Privacy
+privacy-enabled=false
+
+# Mining
+miner-enabled=false
+
+# QBFT
+qbft-enabled=true

config/generated-node-configs/config-1501.toml

@@ -0,0 +1,52 @@
+# Besu Configuration for besu-sentry-2 (VMID: 1501)
+# Generated baseline sentry config promoted into first-class repo coverage.
+
+data-path="/data/besu"
+genesis-file=""
+
+# Network
+network-id=138
+p2p-host="192.168.11.151"
+p2p-port=30303
+max-peers=32
+discovery-enabled=true
+
+# RPC
+rpc-http-enabled=true
+rpc-http-host="0.0.0.0"
+rpc-http-port=8545
+rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-cors-origins=["*"]
+rpc-http-api-enable-unsafe-txsigning=true
+
+rpc-ws-enabled=true
+rpc-ws-host="0.0.0.0"
+rpc-ws-port=8546
+rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+
+# GraphQL
+graphql-http-enabled=true
+graphql-http-host="0.0.0.0"
+graphql-http-port=8547
+
+# Metrics
+metrics-enabled=true
+metrics-host="0.0.0.0"
+metrics-port=9545
+
+# Logging
+logging="INFO"
+log-destination="CONSOLE"
+
+# Sync
+sync-mode="FULL"
+fast-sync-min-peers=2
+
+# Privacy
+privacy-enabled=false
+
+# Mining
+miner-enabled=false
+
+# QBFT
+qbft-enabled=true

config/generated-node-configs/config-1502.toml

@@ -0,0 +1,52 @@
+# Besu Configuration for besu-sentry-3 (VMID: 1502)
+# Generated baseline sentry config promoted into first-class repo coverage.
+
+data-path="/data/besu"
+genesis-file=""
+
+# Network
+network-id=138
+p2p-host="192.168.11.152"
+p2p-port=30303
+max-peers=32
+discovery-enabled=true
+
+# RPC
+rpc-http-enabled=true
+rpc-http-host="0.0.0.0"
+rpc-http-port=8545
+rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-cors-origins=["*"]
+rpc-http-api-enable-unsafe-txsigning=true
+
+rpc-ws-enabled=true
+rpc-ws-host="0.0.0.0"
+rpc-ws-port=8546
+rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+
+# GraphQL
+graphql-http-enabled=true
+graphql-http-host="0.0.0.0"
+graphql-http-port=8547
+
+# Metrics
+metrics-enabled=true
+metrics-host="0.0.0.0"
+metrics-port=9545
+
+# Logging
+logging="INFO"
+log-destination="CONSOLE"
+
+# Sync
+sync-mode="FULL"
+fast-sync-min-peers=2
+
+# Privacy
+privacy-enabled=false
+
+# Mining
+miner-enabled=false
+
+# QBFT
+qbft-enabled=true

config/generated-node-configs/config-1503.toml

@@ -0,0 +1,52 @@
+# Besu Configuration for besu-sentry-4 (VMID: 1503)
+# Generated baseline sentry config promoted into first-class repo coverage.
+
+data-path="/data/besu"
+genesis-file=""
+
+# Network
+network-id=138
+p2p-host="192.168.11.153"
+p2p-port=30303
+max-peers=32
+discovery-enabled=true
+
+# RPC
+rpc-http-enabled=true
+rpc-http-host="0.0.0.0"
+rpc-http-port=8545
+rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-cors-origins=["*"]
+rpc-http-api-enable-unsafe-txsigning=true
+
+rpc-ws-enabled=true
+rpc-ws-host="0.0.0.0"
+rpc-ws-port=8546
+rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+
+# GraphQL
+graphql-http-enabled=true
+graphql-http-host="0.0.0.0"
+graphql-http-port=8547
+
+# Metrics
+metrics-enabled=true
+metrics-host="0.0.0.0"
+metrics-port=9545
+
+# Logging
+logging="INFO"
+log-destination="CONSOLE"
+
+# Sync
+sync-mode="FULL"
+fast-sync-min-peers=2
+
+# Privacy
+privacy-enabled=false
+
+# Mining
+miner-enabled=false
+
+# QBFT
+qbft-enabled=true

config/generated-node-configs/config-1504.toml

@@ -0,0 +1,52 @@
+# Besu Configuration for besu-sentry-ali (VMID: 1504)
+# Generated baseline sentry config promoted into first-class repo coverage.
+
+data-path="/data/besu"
+genesis-file=""
+
+# Network
+network-id=138
+p2p-host="192.168.11.154"
+p2p-port=30303
+max-peers=32
+discovery-enabled=true
+
+# RPC
+rpc-http-enabled=true
+rpc-http-host="0.0.0.0"
+rpc-http-port=8545
+rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-cors-origins=["*"]
+rpc-http-api-enable-unsafe-txsigning=true
+
+rpc-ws-enabled=true
+rpc-ws-host="0.0.0.0"
+rpc-ws-port=8546
+rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+
+# GraphQL
+graphql-http-enabled=true
+graphql-http-host="0.0.0.0"
+graphql-http-port=8547
+
+# Metrics
+metrics-enabled=true
+metrics-host="0.0.0.0"
+metrics-port=9545
+
+# Logging
+logging="INFO"
+log-destination="CONSOLE"
+
+# Sync
+sync-mode="FULL"
+fast-sync-min-peers=2
+
+# Privacy
+privacy-enabled=false
+
+# Mining
+miner-enabled=false
+
+# QBFT
+qbft-enabled=true

config/generated-node-configs/config-1507.toml

@@ -8,7 +8,7 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.244"
 p2p-port=30303
-max-peers=32
+max-peers=40
 discovery-enabled=true
 
 # RPC
@@ -40,6 +40,7 @@ log-destination="CONSOLE"
 
 # Sync
 sync-mode="FULL"
+tx-pool-max-future-by-sender=1
 fast-sync-min-peers=2
 
 # Privacy

config/generated-node-configs/config-1508.toml

@@ -8,7 +8,7 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.245"
 p2p-port=30303
-max-peers=32
+max-peers=40
 discovery-enabled=true
 
 # RPC
@@ -40,6 +40,7 @@ log-destination="CONSOLE"
 
 # Sync
 sync-mode="FULL"
+tx-pool-max-future-by-sender=1
 fast-sync-min-peers=2
 
 # Privacy

config/generated-node-configs/config-1509.toml

@@ -0,0 +1,53 @@
+# Besu Configuration for besu-sentry-thirdweb-01 (VMID: 1509)
+# Generated canonical per-node config for promoted sentry inventory.
+
+data-path="/data/besu"
+genesis-file=""
+
+# Network
+network-id=138
+p2p-host="192.168.11.219"
+p2p-port=30303
+max-peers=40
+discovery-enabled=true
+
+# RPC
+rpc-http-enabled=true
+rpc-http-host="0.0.0.0"
+rpc-http-port=8545
+rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-cors-origins=["*"]
+rpc-http-api-enable-unsafe-txsigning=true
+
+rpc-ws-enabled=true
+rpc-ws-host="0.0.0.0"
+rpc-ws-port=8546
+rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+
+# GraphQL
+graphql-http-enabled=true
+graphql-http-host="0.0.0.0"
+graphql-http-port=8547
+
+# Metrics
+metrics-enabled=true
+metrics-host="0.0.0.0"
+metrics-port=9545
+
+# Logging
+logging="INFO"
+log-destination="CONSOLE"
+
+# Sync
+sync-mode="FULL"
+tx-pool-max-future-by-sender=1
+fast-sync-min-peers=2
+
+# Privacy
+privacy-enabled=false
+
+# Mining
+miner-enabled=false
+
+# QBFT
+qbft-enabled=true

config/generated-node-configs/config-1510.toml

@@ -0,0 +1,53 @@
+# Besu Configuration for besu-sentry-thirdweb-02 (VMID: 1510)
+# Generated canonical per-node config for promoted sentry inventory.
+
+data-path="/data/besu"
+genesis-file=""
+
+# Network
+network-id=138
+p2p-host="192.168.11.220"
+p2p-port=30303
+max-peers=40
+discovery-enabled=true
+
+# RPC
+rpc-http-enabled=true
+rpc-http-host="0.0.0.0"
+rpc-http-port=8545
+rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-cors-origins=["*"]
+rpc-http-api-enable-unsafe-txsigning=true
+
+rpc-ws-enabled=true
+rpc-ws-host="0.0.0.0"
+rpc-ws-port=8546
+rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+
+# GraphQL
+graphql-http-enabled=true
+graphql-http-host="0.0.0.0"
+graphql-http-port=8547
+
+# Metrics
+metrics-enabled=true
+metrics-host="0.0.0.0"
+metrics-port=9545
+
+# Logging
+logging="INFO"
+log-destination="CONSOLE"
+
+# Sync
+sync-mode="FULL"
+tx-pool-max-future-by-sender=1
+fast-sync-min-peers=2
+
+# Privacy
+privacy-enabled=false
+
+# Mining
+miner-enabled=false
+
+# QBFT
+qbft-enabled=true

config/generated-node-configs/config-2500.toml

@@ -9,8 +9,8 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.172"
 p2p-port=30303
-max-peers=32
+max-peers=40
-discovery-enabled=true
+discovery-enabled=false
 
 # RPC - Full Function (can deploy contracts, execute writes)
 rpc-http-enabled=true

config/generated-node-configs/config-2501.toml

@@ -9,8 +9,8 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.173"
 p2p-port=30303
-max-peers=32
+max-peers=40
-discovery-enabled=true
+discovery-enabled=false
 
 # RPC - Standard Base (read-only, no admin APIs)
 rpc-http-enabled=true

config/generated-node-configs/config-2502.toml

@@ -9,8 +9,8 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.174"
 p2p-port=30303
-max-peers=32
+max-peers=40
-discovery-enabled=true
+discovery-enabled=false
 
 # RPC - Standard Base (read-only, no admin APIs)
 rpc-http-enabled=true

config/generated-node-configs/config-2503.toml

@@ -9,8 +9,8 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.246"
 p2p-port=30303
-max-peers=32
+max-peers=40
-discovery-enabled=true
+discovery-enabled=false
 
 # RPC - Full Function (can deploy contracts, execute writes)
 rpc-http-enabled=true

config/generated-node-configs/config-2504.toml

@@ -9,8 +9,8 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.247"
 p2p-port=30303
-max-peers=32
+max-peers=40
-discovery-enabled=true
+discovery-enabled=false
 
 # RPC - Standard Base (read-only, no admin APIs)
 rpc-http-enabled=true

config/generated-node-configs/config-2505.toml

@@ -9,8 +9,8 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.248"
 p2p-port=30303
-max-peers=32
+max-peers=40
-discovery-enabled=true
+discovery-enabled=false
 
 # RPC - Standard Base (read-only, no admin APIs)
 rpc-http-enabled=true

config/generated-node-configs/service-1500.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Hyperledger Besu
+After=network.target
+
+[Service]
+Type=simple
+User=besu
+Group=besu
+ExecStart=/opt/besu/bin/besu --config-file=/etc/besu/config.toml
+Restart=always
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

config/generated-node-configs/service-1501.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Hyperledger Besu
+After=network.target
+
+[Service]
+Type=simple
+User=besu
+Group=besu
+ExecStart=/opt/besu/bin/besu --config-file=/etc/besu/config.toml
+Restart=always
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

config/generated-node-configs/service-1502.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Hyperledger Besu
+After=network.target
+
+[Service]
+Type=simple
+User=besu
+Group=besu
+ExecStart=/opt/besu/bin/besu --config-file=/etc/besu/config.toml
+Restart=always
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

config/generated-node-configs/service-1503.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Hyperledger Besu
+After=network.target
+
+[Service]
+Type=simple
+User=besu
+Group=besu
+ExecStart=/opt/besu/bin/besu --config-file=/etc/besu/config.toml
+Restart=always
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

config/generated-node-configs/service-1504.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Hyperledger Besu
+After=network.target
+
+[Service]
+Type=simple
+User=besu
+Group=besu
+ExecStart=/opt/besu/bin/besu --config-file=/etc/besu/config.toml
+Restart=always
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

config/generated-node-configs/service-1509.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Hyperledger Besu
+After=network.target
+
+[Service]
+Type=simple
+User=besu
+Group=besu
+ExecStart=/opt/besu/bin/besu --config-file=/etc/besu/config.toml
+Restart=always
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

config/generated-node-configs/service-1510.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Hyperledger Besu
+After=network.target
+
+[Service]
+Type=simple
+User=besu
+Group=besu
+ExecStart=/opt/besu/bin/besu --config-file=/etc/besu/config.toml
+Restart=always
+RestartSec=10
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

config/gitea-act-runner/README.md

@@ -0,0 +1,12 @@
+# Gitea act_runner config templates
+
+| File | CT | Purpose |
+|------|-----|---------|
+| `config-5700-heavy.yaml` | 5700 (`dev-vm`) | `ubuntu-latest-heavy` — large pnpm/validation jobs |
+| `config-5701-standard.yaml` | 5701 (`gitea-runner-1`) | `ubuntu-latest` / `ubuntu-22.04` / `ubuntu-20.04` — default pool |
+
+Deploy with `bash scripts/dev-vm/apply-act-runner-config.sh` from the repo root (LAN). Full procedure: `docs/04-configuration/GITEA_ACT_RUNNER_SETUP.md`.
+
+**Networking:** keep **`container.network` empty** (`""` in YAML). act_runner attaches workflow **`services:`** to the same per-job Docker network as the job container. **`network: bridge`** isolates the job from service containers → Prisma **P1001** even when **`DATABASE_URL`** uses **`postgres`**.
+
+**CI env:** in workflows with **`services: postgres:`**, set **`DATABASE_URL`** to **`...@postgres:5432/...`** (service id as host), not **`localhost`**.

config/gitea-act-runner/config-5700-heavy.yaml

@@ -0,0 +1,44 @@
+# act_runner — CT 5700 (dev-vm): heavy / monorepo CI (label ubuntu-latest-heavy).
+# Applied by: bash scripts/dev-vm/apply-act-runner-config.sh
+# Image: https://gitea.com/docker.gitea.com/runner-images
+
+log:
+  level: info
+
+runner:
+  file: .runner
+  capacity: 1
+  timeout: 3h
+  shutdown_timeout: 0s
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 5s
+  github_mirror: ''
+  labels:
+    - "ubuntu-latest-heavy:docker://docker.gitea.com/runner-images:ubuntu-latest"
+
+cache:
+  enabled: true
+  dir: ""
+  host: ""
+  port: 0
+  external_server: ""
+
+container:
+  # Empty: per-job user-defined network (GitHub Actions-compatible). Required so
+  # workflow `services:` (postgres, redis, …) share DNS with the job container.
+  # `network: bridge` = docker0 only → Prisma P1001 / "Can't reach postgres:5432".
+  network: ""
+  privileged: false
+  options: "--cpus=4 --memory=10g --pids-limit=8192"
+  workdir_parent: /var/lib/act_runner/workdir
+  valid_volumes:
+    - '**'
+  docker_host: ""
+  force_pull: false
+  force_rebuild: false
+  require_docker: false
+  docker_timeout: 0s
+
+host:
+  workdir_parent: /var/lib/act_runner/workdir

config/gitea-act-runner/config-5701-standard.yaml

@@ -0,0 +1,44 @@
+# act_runner — CT 5701 (gitea-runner-1): default pool (labels ubuntu-latest / 22.04 / 20.04).
+# Applied by: bash scripts/dev-vm/apply-act-runner-config.sh
+
+log:
+  level: info
+
+runner:
+  file: .runner
+  capacity: 1
+  timeout: 3h
+  shutdown_timeout: 0s
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 5s
+  github_mirror: ''
+  labels:
+    - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+    - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
+    - "ubuntu-20.04:docker://docker.gitea.com/runner-images:ubuntu-20.04"
+
+cache:
+  enabled: true
+  dir: ""
+  host: ""
+  port: 0
+  external_server: ""
+
+container:
+  # Same as config-5700-heavy.yaml — keep `network` empty so workflow `services:`
+  # (e.g. postgres) share DNS with the job container (see heavy template comments).
+  network: ""
+  privileged: false
+  options: "--cpus=2 --memory=4g --pids-limit=512"
+  workdir_parent: /var/lib/act_runner/workdir
+  valid_volumes:
+    - '**'
+  docker_host: ""
+  force_pull: false
+  force_rebuild: false
+  require_docker: false
+  docker_timeout: 0s
+
+host:
+  workdir_parent: /var/lib/act_runner/workdir

config/gitea-phoenix/README.md

@@ -0,0 +1,48 @@
+# Gitea / Phoenix non-blockchain VM routing matrix
+
+Machine-readable coverage of **cluster guests that are not Besu-fleet nodes** (see `besu-vmid-exclusions.v1.json`) for Gitea Actions + Phoenix deploy alignment.
+
+| File | Purpose |
+|------|---------|
+| `besu-vmid-exclusions.v1.json` | Hostname rules marking Besu validators/sentries/RPC (excluded from matrix closure). |
+| `non-blockchain-vm-routing-matrix.v1.json` | One row per in-scope **running** guest from the last committed `reports/status/live_inventory.json` snapshot. |
+| `non-blockchain-vm-routing-matrix.v1.schema.json` | JSON Schema for the matrix file. |
+| `gov-portals-runtime.v1.json` | CT **7804** xom-dev: ports **3001–3004**, Gitea repos, Phoenix **`target`** names, `pnpm` filters (kept in sync with deploy-targets + monorepo CI). |
+| `gov-portals-runtime.v1.schema.json` | JSON Schema for the runtime file. |
+
+## Regenerate after inventory export
+
+From repo root (LAN / operator host with `live_inventory.json` refreshed):
+
+```bash
+python3 scripts/lib/non_blockchain_vm_routing_matrix.py generate \
+  --inventory reports/status/live_inventory.json \
+  --exclusions config/gitea-phoenix/besu-vmid-exclusions.v1.json \
+  --out config/gitea-phoenix/non-blockchain-vm-routing-matrix.v1.json
+```
+
+Then hand-fill `gitea_repos`, `deploy_target`, `workflow_glob`, and `health_url` for Phoenix-backed services; use `allowed_missing` only with an explicit reason for intentional gaps. When **7804** portal list changes, update **`gov-portals-runtime.v1.json`** in the same change set.
+
+## Validate (inventory + parity gates)
+
+```bash
+bash scripts/verify/validate-vm-routing-parity.sh
+```
+
+Subcommands (see `scripts/lib/non_blockchain_vm_routing_matrix.py`):
+
+- `validate` — inventory closure vs matrix  
+- `parity-deploy-targets` — each Phoenix deploy target’s `repo` appears on the matrix row for its VMID (health URL match for single-repo rows)  
+- `parity-operational-template` — IPv4 alignment vs `config/proxmox-operational-template.json` (hostname drift warns only; NPMplus **10233** dual-homed `.166`/`.167` documented)  
+- `parity-gov-portals-runtime` — matrix **7804** `gitea_repos` equals runtime portal list  
+
+## Gov portal workflow dedupe
+
+Canonical doc: [`../gitea-workflow-templates/PORTAL_WORKFLOW_PARITY.md`](../gitea-workflow-templates/PORTAL_WORKFLOW_PARITY.md). Optional drift check when the monorepo clone exists:
+
+```bash
+bash scripts/verify/check-gov-portal-workflow-canonical-strings.sh
+# or: GOV_PORTALS_MONOREPO_ROOT=/path/to/gov-portals-monorepo bash ...
+```
+
+Task narrative: [docs/04-configuration/GITEA_PHOENIX_NON_BLOCKCHAIN_VM_ROUTING_CLEANUP_TASK.md](../../docs/04-configuration/GITEA_PHOENIX_NON_BLOCKCHAIN_VM_ROUTING_CLEANUP_TASK.md).

config/gitea-phoenix/besu-vmid-exclusions.v1.json

@@ -0,0 +1,16 @@
+{
+  "schemaVersion": "1",
+  "description": "Besu-fleet guests excluded from non-blockchain VM routing matrix closure. Match is OR across rules.",
+  "rules": [
+    {
+      "kind": "hostname_prefix",
+      "value": "besu-",
+      "note": "Validators, sentries, RPC cores, thirdweb-adjacent besu-rpc-* hosts."
+    },
+    {
+      "kind": "hostname_prefix",
+      "value": "thirdweb-rpc-",
+      "note": "Thirdweb RPC translator stack (Besu-backed)."
+    }
+  ]
+}

config/gitea-phoenix/gov-portals-runtime.v1.json

@@ -0,0 +1,42 @@
+{
+  "schemaVersion": "1",
+  "lxc_vmid": 7804,
+  "lan_ipv4": "192.168.11.54",
+  "systemd_unit_prefix": "gov-portal-",
+  "public_wildcard_fqdn_pattern": "*.xom-dev.phoenix.sankofa.nexus",
+  "npmplus_doc": "docs/04-configuration/GOV_PORTALS_XOM_DEV_DEPLOYMENT.md",
+  "portals": [
+    {
+      "id": "DBIS",
+      "port": 3001,
+      "dev_fqdn": "https://dbis.xom-dev.phoenix.sankofa.nexus/",
+      "gitea_repo": "Gov_Web_Portals/DBIS",
+      "deploy_target": "dbis-portal-live",
+      "pnpm_filter": "portal-dbis"
+    },
+    {
+      "id": "ICCC",
+      "port": 3002,
+      "dev_fqdn": "https://iccc.xom-dev.phoenix.sankofa.nexus/",
+      "gitea_repo": "Gov_Web_Portals/ICCC",
+      "deploy_target": "iccc-portal-live",
+      "pnpm_filter": "portal-iccc"
+    },
+    {
+      "id": "OMNL",
+      "port": 3003,
+      "dev_fqdn": "https://omnl.xom-dev.phoenix.sankofa.nexus/",
+      "gitea_repo": "Gov_Web_Portals/OMNL",
+      "deploy_target": "omnl-portal-live",
+      "pnpm_filter": "portal-omnl"
+    },
+    {
+      "id": "XOM",
+      "port": 3004,
+      "dev_fqdn": "https://xom.xom-dev.phoenix.sankofa.nexus/",
+      "gitea_repo": "Gov_Web_Portals/XOM",
+      "deploy_target": "xom-portal-live",
+      "pnpm_filter": "portal-xom"
+    }
+  ]
+}

config/gitea-phoenix/gov-portals-runtime.v1.schema.json

@@ -0,0 +1,33 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://gitea.d-bis.org/d-bis/proxmox/gov-portals-runtime.v1.schema.json",
+  "title": "Gov portals xom-dev runtime (CT 7804)",
+  "type": "object",
+  "required": ["schemaVersion", "lxc_vmid", "lan_ipv4", "portals"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": { "type": "string", "const": "1" },
+    "lxc_vmid": { "type": "integer", "minimum": 1 },
+    "lan_ipv4": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$" },
+    "systemd_unit_prefix": { "type": "string" },
+    "public_wildcard_fqdn_pattern": { "type": "string" },
+    "npmplus_doc": { "type": "string" },
+    "portals": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["id", "port", "dev_fqdn", "gitea_repo", "deploy_target", "pnpm_filter"],
+        "additionalProperties": false,
+        "properties": {
+          "id": { "type": "string", "pattern": "^[A-Z]+$" },
+          "port": { "type": "integer", "minimum": 1, "maximum": 65535 },
+          "dev_fqdn": { "type": "string", "minLength": 8 },
+          "gitea_repo": { "type": "string", "pattern": "^Gov_Web_Portals/[A-Za-z0-9_-]+$" },
+          "deploy_target": { "type": "string", "minLength": 1 },
+          "pnpm_filter": { "type": "string", "minLength": 1 }
+        }
+      }
+    }
+  }
+}

config/gitea-phoenix/non-blockchain-vm-routing-matrix.v1.schema.json

@@ -0,0 +1,53 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://gitea.d-bis.org/d-bis/proxmox/non-blockchain-vm-routing-matrix.v1.schema.json",
+  "title": "Non-blockchain VM routing matrix v1",
+  "type": "object",
+  "required": ["schemaVersion", "entries"],
+  "additionalProperties": true,
+  "properties": {
+    "schemaVersion": { "type": "string", "const": "1" },
+    "generated_from_inventory_collected_at": { "type": "string" },
+    "generated_from_inventory_source": { "type": "string" },
+    "allowed_missing": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["vmid", "reason"],
+        "properties": {
+          "vmid": { "type": "string", "pattern": "^[0-9]+$" },
+          "reason": { "type": "string", "minLength": 4 }
+        }
+      }
+    },
+    "entries": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": [
+          "vmid",
+          "hostname",
+          "primary_ip",
+          "category",
+          "gitea_repos",
+          "deploy_target",
+          "workflow_glob",
+          "health_url",
+          "notes"
+        ],
+        "properties": {
+          "vmid": { "type": "string", "pattern": "^[0-9]+$" },
+          "hostname": { "type": "string", "minLength": 1 },
+          "primary_ip": { "type": "string" },
+          "category": { "type": "string", "minLength": 1 },
+          "gitea_repos": { "type": "array", "items": { "type": "string" } },
+          "deploy_target": { "type": ["string", "null"] },
+          "workflow_glob": { "type": ["string", "null"] },
+          "health_url": { "type": ["string", "null"] },
+          "notes": { "type": "string" }
+        },
+        "additionalProperties": false
+      }
+    }
+  }
+}

config/gitea-workflow-templates/PORTAL_WORKFLOW_PARITY.md

@@ -0,0 +1,44 @@
+# Gov portal Gitea workflows — canonical patterns (dedupe)
+
+There are **two valid layouts** for `Gov_Web_Portals/{DBIS,ICCC,OMNL,XOM}` on Gitea. Pick **one per repo** and avoid silently drifting between them.
+
+## Pattern A — Split workflows (current monorepo submodules)
+
+Used under **`Gov_Web_Portals/gov-portals-monorepo`** checkouts: `DBIS/.gitea/workflows/ci.yml` + `deploy-live.yml` (same for ICCC, OMNL, XOM).
+
+| Concern | Convention |
+|--------|-------------|
+| Monorepo clone | **`GOV_PORTALS_TOKEN`** (or unset for public read if ever enabled) + `http.extraHeader=Authorization: token …` |
+| Overlay | `tar` or `rsync` from standalone repo checkout into `gov-portals/<Portal>/` |
+| CI on PR | `ci.yml` — `pnpm install --frozen-lockfile` at monorepo root, `pnpm --filter portal-*` lint/build/typecheck |
+| Deploy on `main` | `deploy-live.yml` — validate job then `curl` POST Phoenix with **`target`** = `dbis-portal-live` / `iccc-portal-live` / `omnl-portal-live` / `xom-portal-live` |
+| Secrets | `PHOENIX_DEPLOY_URL`, `PHOENIX_DEPLOY_TOKEN`, **`GOV_PORTALS_TOKEN`** (read monorepo) |
+
+**Canonical strings** (must stay aligned with `phoenix-deploy-api/deploy-targets.json`):
+
+- `Gov_Web_Portals/DBIS` → `"target":"dbis-portal-live"`
+- `Gov_Web_Portals/ICCC` → `"target":"iccc-portal-live"`
+- `Gov_Web_Portals/OMNL` → `"target":"omnl-portal-live"`
+- `Gov_Web_Portals/XOM` → `"target":"xom-portal-live"`
+
+## Pattern B — Single combined file (template reference)
+
+Files under **`config/gitea-workflow-templates/repos/*-portal-ci-and-live.yml`**: one workflow with `verify` + `deploy` jobs, **`GITEA_TOKEN`** + `oauth2:${GITEA_TOKEN}@` clone URL.
+
+Use when bootstrapping a **standalone** portal repo that does not yet use Pattern A. Copy into `.gitea/workflows/` and set secrets per [GITEA_CD_OPERATOR_CHECKLIST.md](../../docs/00-meta/GITEA_CD_OPERATOR_CHECKLIST.md).
+
+## Single source of truth for ports / FQDN / systemd
+
+**`config/gitea-phoenix/gov-portals-runtime.v1.json`** — LXC **7804** port map and deploy targets. Update it when `GOV_PORTALS_XOM_DEV_DEPLOYMENT.md` changes; Phoenix healthchecks and matrix enrichment should stay consistent.
+
+## Drift checks (proxmox repo)
+
+```bash
+# If monorepo clone exists (default ~/projects/gov-portals-monorepo):
+bash scripts/verify/check-gov-portal-workflow-canonical-strings.sh
+
+# Full VM routing + parity (inventory, matrix, deploy-targets, operational template):
+bash scripts/verify/validate-vm-routing-parity.sh
+```
+
+When you change **semantic** steps (pnpm filter names, Phoenix `target`, monorepo URL), update **Pattern A** repos **and** Pattern B templates **and** `gov-portals-runtime.v1.json` in one commit series.

config/gitea-workflow-templates/README.md

@@ -0,0 +1,24 @@
+# Gitea Actions workflow templates
+
+Copy one of these into **your repo** as `.gitea/workflows/<workflow-name>.yml`, then set repo **Secrets** in Gitea (`PHOENIX_DEPLOY_URL`, `PHOENIX_DEPLOY_TOKEN`, and **`GITEA_TOKEN`** when the workflow clones `gov-portals-monorepo` for portal CI).
+
+| Template | Use when |
+|----------|----------|
+| [`deploy-via-phoenix-api.yml`](deploy-via-phoenix-api.yml) | App/service with a row in `phoenix-deploy-api/deploy-targets.json` |
+| [`validate-only.yml`](validate-only.yml) | Libraries/docs — CI gate only, no VM deploy |
+| **[`repos/`](repos/README.md)** | **Concrete YAML** for DBIS, CROMERO, CurrenciCombo — copy into those Gitea repos |
+
+See [docs/04-configuration/GITEA_REPO_VM_CD_CI_MATRIX.md](../../docs/04-configuration/GITEA_REPO_VM_CD_CI_MATRIX.md) for repo ↔ VM mapping.
+
+**Operator checklist:** [docs/00-meta/GITEA_CD_OPERATOR_CHECKLIST.md](../../docs/00-meta/GITEA_CD_OPERATOR_CHECKLIST.md).
+
+## Postgres / Prisma in Actions (self-hosted `act_runner`)
+
+When a workflow declares **`services: postgres:`** (GitHub Actions style):
+
+1. **`DATABASE_URL`** (and Prisma) should use host **`postgres`** (the service id), **not** **`127.0.0.1`** / **`localhost`** — the job runs in Docker on the runner.
+2. Runners managed from this repo must keep **`container.network`** **empty** in **`config/gitea-act-runner/config-*.yaml`** so act_runner creates a **per-job** network. See **`docs/04-configuration/GITEA_ACT_RUNNER_SETUP.md`** troubleshooting (**P1001**).
+
+Examples in this monorepo: **`the-order/.github/workflows/ci.yml`**, **`dbis_core/.github/workflows/ci.yml`**. Copy the same pattern into other Gitea repos (e.g. treasury / DealFlow) that run migrations in CI.
+
+**If you install Postgres inside the job container** (e.g. `apt-get install postgresql` + `127.0.0.1`), avoid PostgreSQL’s anonymous dollar-quote **`DO $$ ... $$`** inside **bash double-quoted** `run:` lines — **`$$`** is the shell PID. Prefer a **`pg_roles` existence check** + plain **`CREATE ROLE`**, or use a **`$tag$ ... $tag$`** block inside a **single-quoted** heredoc so bash never expands dollars.

config/gitea-workflow-templates/deploy-via-phoenix-api.yml

@@ -0,0 +1,31 @@
+# Template — copy to YOUR_REPO/.gitea/workflows/<name>.yml and replace placeholders.
+# Secrets (repo settings): PHOENIX_DEPLOY_URL, PHOENIX_DEPLOY_TOKEN
+name: Deploy via Phoenix API
+
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Trigger Phoenix deployment
+        env:
+          PHOENIX_DEPLOY_URL: ${{ secrets.PHOENIX_DEPLOY_URL }}
+          PHOENIX_DEPLOY_TOKEN: ${{ secrets.PHOENIX_DEPLOY_TOKEN }}
+          TARGET: default
+        run: |
+          set -euo pipefail
+          SHA="$(git rev-parse HEAD)"
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          REPO="${{ gitea.repository }}"
+          curl -sSf --connect-timeout 10 --max-time 3600 \
+            -X POST "${PHOENIX_DEPLOY_URL}" \
+            -H "Authorization: Bearer ${PHOENIX_DEPLOY_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\":\"${REPO}\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"${TARGET}\"}"

config/gitea-workflow-templates/repos/README.md

@@ -0,0 +1,20 @@
+# Ready-to-copy workflows (repo-specific)
+
+Copy the matching file into **that** Gitea repo as `.gitea/workflows/<name>.yml`, then set secrets **`PHOENIX_DEPLOY_URL`**, **`PHOENIX_DEPLOY_TOKEN`**.
+
+**Pattern A (monorepo split `ci.yml` + `deploy-live.yml`) vs Pattern B (single template file):** [PORTAL_WORKFLOW_PARITY.md](../PORTAL_WORKFLOW_PARITY.md).
+
+| File | Gitea `repo` | `target` | Notes |
+|------|----------------|----------|--------|
+| [`dbis-portal-ci-and-live.yml`](dbis-portal-ci-and-live.yml) | `Gov_Web_Portals/DBIS` | `dbis-portal-live` | Pattern B single file; secrets include **`GITEA_TOKEN`**; monorepo uses Pattern A |
+| [`iccc-portal-ci-and-live.yml`](iccc-portal-ci-and-live.yml) | `Gov_Web_Portals/ICCC` | `iccc-portal-live` | Same pattern as DBIS |
+| [`omnl-portal-ci-and-live.yml`](omnl-portal-ci-and-live.yml) | `Gov_Web_Portals/OMNL` | `omnl-portal-live` | Same pattern |
+| [`xom-portal-ci-and-live.yml`](xom-portal-ci-and-live.yml) | `Gov_Web_Portals/XOM` | `xom-portal-live` | Same pattern |
+| [`dbis-portal-live.yml`](dbis-portal-live.yml) | `Gov_Web_Portals/DBIS` | `dbis-portal-live` | Deploy-only fallback (no `GITEA_TOKEN` CI) |
+| [`cromero-default.yml`](cromero-default.yml) | `d-bis/CROMERO` | `default` | NPM ecosystem build |
+| [`currencicombo-default.yml`](currencicombo-default.yml) | `d-bis/CurrenciCombo` | `default` | Phoenix CT 8604 |
+| — | `d-bis/explorer-monorepo` | `explorer-live` | Already in **explorer-monorepo** submodule: `.gitea/workflows/deploy-live.yml` |
+| — | `Gov_Web_Portals/CyberSecur-Global` | `default` | In **CyberSecur-Global** repo: `.gitea/workflows/deploy-to-ct7810.yml` |
+| — | `d-bis/cross-chain-pmm-lps` | _(validate only)_ | `.gitea/workflows/validate-capital-efficiency.yml` |
+
+`d-bis/proxmox` uses monorepo workflows in-repo (no copy from here).

config/gitea-workflow-templates/repos/cromero-default.yml

@@ -0,0 +1,24 @@
+# Copy to d-bis/CROMERO → .gitea/workflows/deploy-via-phoenix.yml
+# Secrets: PHOENIX_DEPLOY_URL, PHOENIX_DEPLOY_TOKEN
+name: Deploy CROMERO (Phoenix)
+
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Trigger Phoenix deployment
+        run: |
+          SHA="$(git rev-parse HEAD)"
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          curl -sSf --connect-timeout 10 --max-time 3600 \
+            -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
+            -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\":\"d-bis/CROMERO\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"default\"}"

config/gitea-workflow-templates/repos/currencicombo-default.yml

@@ -0,0 +1,24 @@
+# Copy to d-bis/CurrenciCombo → .gitea/workflows/deploy-via-phoenix.yml
+# Secrets: PHOENIX_DEPLOY_URL, PHOENIX_DEPLOY_TOKEN
+name: Deploy CurrenciCombo (Phoenix)
+
+on:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Trigger Phoenix deployment
+        run: |
+          SHA="$(git rev-parse HEAD)"
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          curl -sSf --connect-timeout 10 --max-time 3600 \
+            -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
+            -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\":\"d-bis/CurrenciCombo\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"default\"}"

config/gitea-workflow-templates/repos/dbis-portal-ci-and-live.yml

@@ -0,0 +1,62 @@
+# Copy to Gov_Web_Portals/DBIS → .gitea/workflows/deploy-portal-live.yml (or a second workflow file).
+# Pattern B (single file). Monorepo submodules use Pattern A — see ../PORTAL_WORKFLOW_PARITY.md
+# Secrets: PHOENIX_DEPLOY_URL, PHOENIX_DEPLOY_TOKEN, GITEA_TOKEN (read access to gov-portals-monorepo for CI).
+#
+# verify: shallow-clone monorepo, overlay this repo into DBIS/, run lint + typecheck (workspace deps).
+# deploy: POST Phoenix with full sha (optional: set PHOENIX_DEPLOY_VERIFY_SHA_ON_BRANCH=1 on Phoenix host).
+name: CI and deploy DBIS portal (Phoenix)
+
+concurrency:
+  group: gov-portal-dbis-phoenix-deploy
+  cancel-in-progress: false
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: portal-src
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - name: Enable pnpm
+        run: corepack enable && corepack prepare pnpm@8.15.0 --activate
+      - name: Clone monorepo and overlay DBIS
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -euo pipefail
+          test -n "${GITEA_TOKEN:-}"
+          git clone --depth 1 --branch main "https://oauth2:${GITEA_TOKEN}@gitea.d-bis.org/Gov_Web_Portals/gov-portals-monorepo.git" /tmp/gwp
+          rm -rf /tmp/gwp/DBIS
+          mkdir -p /tmp/gwp/DBIS
+          rsync -a --delete portal-src/ /tmp/gwp/DBIS/
+      - name: pnpm install, lint, typecheck
+        run: |
+          cd /tmp/gwp
+          pnpm install --frozen-lockfile
+          pnpm --filter portal-dbis lint
+          pnpm --filter portal-dbis run typecheck
+
+  deploy:
+    needs: [verify]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Trigger Phoenix deployment
+        run: |
+          SHA="$(git rev-parse HEAD)"
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          curl -sSf --connect-timeout 10 --max-time 3600 \
+            -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
+            -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\":\"Gov_Web_Portals/DBIS\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"dbis-portal-live\"}"

config/gitea-workflow-templates/repos/dbis-portal-live.yml

@@ -0,0 +1,27 @@
+# Minimal deploy-only workflow (no monorepo CI). Prefer dbis-portal-ci-and-live.yml when the repo
+# can store GITEA_TOKEN for cloning Gov_Web_Portals/gov-portals-monorepo in Actions.
+# Monorepo Pattern A: ../PORTAL_WORKFLOW_PARITY.md
+# Copy to Gov_Web_Portals/DBIS → .gitea/workflows/deploy-portal-live.yml
+# Secrets: PHOENIX_DEPLOY_URL, PHOENIX_DEPLOY_TOKEN
+name: Deploy DBIS portal (Phoenix)
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Trigger Phoenix deployment
+        run: |
+          SHA="$(git rev-parse HEAD)"
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          curl -sSf --connect-timeout 10 --max-time 3600 \
+            -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
+            -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\":\"Gov_Web_Portals/DBIS\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"dbis-portal-live\"}"

config/gitea-workflow-templates/repos/iccc-portal-ci-and-live.yml

@@ -0,0 +1,59 @@
+# Copy to Gov_Web_Portals/ICCC → .gitea/workflows/deploy-portal-live.yml
+# Pattern B (single file). Monorepo: ../PORTAL_WORKFLOW_PARITY.md
+# Secrets: PHOENIX_DEPLOY_URL, PHOENIX_DEPLOY_TOKEN, GITEA_TOKEN
+name: CI and deploy ICCC portal (Phoenix)
+
+concurrency:
+  group: gov-portal-iccc-phoenix-deploy
+  cancel-in-progress: false
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: portal-src
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - name: Enable pnpm
+        run: corepack enable && corepack prepare pnpm@8.15.0 --activate
+      - name: Clone monorepo and overlay ICCC
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -euo pipefail
+          test -n "${GITEA_TOKEN:-}"
+          git clone --depth 1 --branch main "https://oauth2:${GITEA_TOKEN}@gitea.d-bis.org/Gov_Web_Portals/gov-portals-monorepo.git" /tmp/gwp
+          rm -rf /tmp/gwp/ICCC
+          mkdir -p /tmp/gwp/ICCC
+          rsync -a --delete portal-src/ /tmp/gwp/ICCC/
+      - name: pnpm install, lint, typecheck
+        run: |
+          cd /tmp/gwp
+          pnpm install --frozen-lockfile
+          pnpm --filter portal-iccc lint
+          pnpm --filter portal-iccc run typecheck
+
+  deploy:
+    needs: [verify]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Trigger Phoenix deployment
+        run: |
+          SHA="$(git rev-parse HEAD)"
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          curl -sSf --connect-timeout 10 --max-time 3600 \
+            -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
+            -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\":\"Gov_Web_Portals/ICCC\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"iccc-portal-live\"}"

config/gitea-workflow-templates/repos/omnl-portal-ci-and-live.yml

@@ -0,0 +1,59 @@
+# Copy to Gov_Web_Portals/OMNL → .gitea/workflows/deploy-portal-live.yml
+# Pattern B (single file). Monorepo: ../PORTAL_WORKFLOW_PARITY.md
+# Secrets: PHOENIX_DEPLOY_URL, PHOENIX_DEPLOY_TOKEN, GITEA_TOKEN
+name: CI and deploy OMNL portal (Phoenix)
+
+concurrency:
+  group: gov-portal-omnl-phoenix-deploy
+  cancel-in-progress: false
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: portal-src
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - name: Enable pnpm
+        run: corepack enable && corepack prepare pnpm@8.15.0 --activate
+      - name: Clone monorepo and overlay OMNL
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -euo pipefail
+          test -n "${GITEA_TOKEN:-}"
+          git clone --depth 1 --branch main "https://oauth2:${GITEA_TOKEN}@gitea.d-bis.org/Gov_Web_Portals/gov-portals-monorepo.git" /tmp/gwp
+          rm -rf /tmp/gwp/OMNL
+          mkdir -p /tmp/gwp/OMNL
+          rsync -a --delete portal-src/ /tmp/gwp/OMNL/
+      - name: pnpm install, lint, typecheck
+        run: |
+          cd /tmp/gwp
+          pnpm install --frozen-lockfile
+          pnpm --filter portal-omnl lint
+          pnpm --filter portal-omnl run typecheck
+
+  deploy:
+    needs: [verify]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Trigger Phoenix deployment
+        run: |
+          SHA="$(git rev-parse HEAD)"
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          curl -sSf --connect-timeout 10 --max-time 3600 \
+            -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
+            -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\":\"Gov_Web_Portals/OMNL\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"omnl-portal-live\"}"

config/gitea-workflow-templates/repos/xom-portal-ci-and-live.yml

@@ -0,0 +1,59 @@
+# Copy to Gov_Web_Portals/XOM → .gitea/workflows/deploy-portal-live.yml
+# Pattern B (single file). Monorepo: ../PORTAL_WORKFLOW_PARITY.md
+# Secrets: PHOENIX_DEPLOY_URL, PHOENIX_DEPLOY_TOKEN, GITEA_TOKEN
+name: CI and deploy XOM portal (Phoenix)
+
+concurrency:
+  group: gov-portal-xom-phoenix-deploy
+  cancel-in-progress: false
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: portal-src
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - name: Enable pnpm
+        run: corepack enable && corepack prepare pnpm@8.15.0 --activate
+      - name: Clone monorepo and overlay XOM
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -euo pipefail
+          test -n "${GITEA_TOKEN:-}"
+          git clone --depth 1 --branch main "https://oauth2:${GITEA_TOKEN}@gitea.d-bis.org/Gov_Web_Portals/gov-portals-monorepo.git" /tmp/gwp
+          rm -rf /tmp/gwp/XOM
+          mkdir -p /tmp/gwp/XOM
+          rsync -a --delete portal-src/ /tmp/gwp/XOM/
+      - name: pnpm install, lint, typecheck
+        run: |
+          cd /tmp/gwp
+          pnpm install --frozen-lockfile
+          pnpm --filter portal-xom lint
+          pnpm --filter portal-xom run typecheck
+
+  deploy:
+    needs: [verify]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Trigger Phoenix deployment
+        run: |
+          SHA="$(git rev-parse HEAD)"
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          curl -sSf --connect-timeout 10 --max-time 3600 \
+            -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
+            -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\":\"Gov_Web_Portals/XOM\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"xom-portal-live\"}"

config/gitea-workflow-templates/validate-only.yml

@@ -0,0 +1,18 @@
+# Template — copy to YOUR_REPO/.gitea/workflows/validate.yml — adjust run steps.
+name: Validate
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Placeholder validation
+        run: |
+          echo "Replace this step with repo-specific checks (e.g. npm test, forge test)."