docs(chain138): Phase 4b runbook for EnhancedSwapRouterV2 + adapters

Add docs/bridge/trustless/PHASE4B_V2_DEPLOY_RUNBOOK.md mirroring the LAN deploy prompt for V2 (parallel infra to V1, doesn't change dApp routing until Phase 4c).

Flag both ADDRESS_MATRIX_AND_STATUS.md \u00a71.6 and PMM_DEX_ROUTING_STATUS.md \u00a72.1 with EnhancedSwapRouterV2 status "Pending Phase 4b" pointing at smom-dbis-138 PR #1 (deploy-script-only).

Co-Authored-By: Nakamoto, S <defi@defi-oracle.io>

.cursor/mcp.json

@@ -1,9 +0,0 @@
-{
-  "mcpServers": {
-    "wormhole-docs": {
-      "command": "node",
-      "args": ["./mcp-wormhole-docs/index.js"],
-      "cwd": "${workspaceFolder}"
-    }
-  }
-}

.cursor/rules/chain138-tokens-and-pmm.mdc

@@ -10,16 +10,24 @@ alwaysApply: true
 - **cUSDT:** `0x93E66202A11B1772E55407B32B44e5Cd8eda7f22` (6 decimals)
 - **cUSDC:** `0xf22258f57794CC8E06237084b353Ab30fFfa640b` (6 decimals)
 
-**DODOPMMIntegration (canonical, official DVM-backed stack):** `0x86ADA6Ef91A3B450F89f2b751e93B1b7A3218895` — use for stable-pool routing, token-aggregation, explorer fallbacks, and `info-defi-oracle-138` swaps. **`DODOPMMProvider`:** `0x3f729632E9553EBacCdE2e9b4c8F2B285b014F2e`. **`DODO_VENDING_MACHINE_ADDRESS`:** `0xb6D9EF3575bc48De3f011C310DC24d87bEC6087C`. Single source: `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md` and `ADDRESS_MATRIX_AND_STATUS.md` (on-chain verification 2026-04-02).
+**DODOPMMIntegration (live, traded):** `0x86ADA6Ef91A3B450F89f2b751e93B1b7A3218895` — confirmed live via on-chain probe (2026-04-22): `compliantUSDT()` / `compliantUSDC()` return the canonical cUSDT/cUSDC above; `pools[][]` mapping resolves to the live funded pool set below; `isRegisteredPool` is TRUE for all 8 pools listed under "PMM pools (live, traded)". `0x5BDc62f1ae7D630c37A8B363a1d49845356Ee72d` is a parallel deployment of the same source with different immutables and seeded but un-traded pools — do not wire dApps or routers to it.
 
-**Older PMM integration (historical / supplemental only):** `0x5BDc62f1ae7D630c37A8B363a1d49845356Ee72d` — do **not** treat as canonical for stable routing or explorer reads; retained for older XAU-phase references and probes.
+**DODOPMMProvider (ILiquidityProvider, live):** `0x3f729632E9553EBacCdE2e9b4c8F2B285b014F2e` — `dodoIntegration() == 0x86ADA6Ef…`, `providerName() == "DODO PMM"`, `isKnownPool` TRUE for all 8 live pools. Use this address as `dodoLiquidityProvider` when deploying `EnhancedSwapRouter`; see `docs/11-references/PMM_DEX_ROUTING_STATUS.md`.
 
-**PMM pools (live funded public):** cUSDT/cUSDC `0xff8d3b8fDF7B112759F076B69f4271D4209C0849` | cUSDT/USDT `0x6fc60DEDc92a2047062294488539992710b99D71` | cUSDC/USDC `0x9f74Be42725f2Aa072a9E0CdCce0E7203C510263` — see `docs/11-references/ADDRESS_MATRIX_AND_STATUS.md` / `PMM_DEX_ROUTING_STATUS.md`.
+**PMM pools (live, traded — 2026-04-22 on-chain probe):**
+- cUSDT/cUSDC `0x9e89bAe009adf128782E19e8341996c596ac40dC` (~983k cUSDT / ~1.016M cUSDC, asymmetric — actively traded)
+- cUSDT/USDT  `0x866Cb44b59303d8dc5f4F9E3E7A8e8b0bf238d66` (~1M / ~1M)
+- cUSDC/USDC  `0xc39B7D0F40838cbFb54649d327f49a6DAC964062` (~1M / ~1M)
+- cBTC/cUSDT  `0x67049e7333481e2cac91af61403ac7bddfab7bcd` (10k cBTC base / 9M cUSDT quote)
+- cBTC/cUSDC  `0x72f1a0794153c3b8a1e8a731f1d8e1a52cb10dc5` (10k cBTC base / 9M cUSDC quote)
+- WETH/USDC   `0xb53a0508940b1ff90f1aad4f6cb50a7012fe5593` (~10.1M USDC quote)
+- WETH/USDT   `0xe227f6c0520c0c6e8786fe56fa76c4914f861533` (~10.1M USDT quote)
+- cBTC/cXAUC  `0xf3e8a07d419b61f002114e64d79f7cf8f7989433` (10k cBTC base / 1.7k cXAUC quote)
 
-**Public cW\* mesh (cross-chain):** treat as **execution / corridor capacity** against reference-anchored GRU policy, not shadow FX — `docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md`, `cross-chain-pmm-lps/config/peg-bands.json` **`gruPolicyIntegration`**.
+The earlier rule's pool addresses (`0xff8d3b8f…`, `0x6fc60D…`, `0x9f74Be…`) belong to the **parallel** integration `0x5BDc62f1…` (Stack B) and are seeded 10M/10M flat or 0/0 — they are not the live PMM trading set. Source-of-truth corrections to follow in `ADDRESS_MATRIX_AND_STATUS.md` and `PMM_DEX_ROUTING_STATUS.md`.
+
+**cBTC:** `0xe94260c555ac1d9d3cc9e1632883452ebdf0082e` (8 decimals) — base token of the three cBTC pools above.
 
 **cXAUC / cXAUT (XAU):** `0x290E52a8819A4fbD0714E517225429aA2B70EC6b`, `0x94e408E26c6FD8F4ee00b54dF19082FDA07dC96E` (6 decimals). **1 full token = 1 troy ounce Au** — not USD face value; see `EXPLORER_TOKEN_LIST_CROSSCHECK.md` section 5.1.
 
 **RPC (deploy):** `RPC_URL_138=http://192.168.11.211:8545`. **Deployer:** `0x4A666F96fC8764181194447A7dFdb7d471b301C8`. Add-liquidity reads tokens from the integration contract, not env. Do not use non-canonical Blockscout addresses (§2 of EXPLORER_TOKEN_LIST_CROSSCHECK).
-
-**Token symbol grammar (UTRNF vs GRU `c*`):** DBIS **`c*`** (e.g. cUSDC) is **compliant GRU base money**, not Universal Token Role Naming Framework “`c` = collateral.” For prefix collision rules, registry fields, and bridges, use `docs/04-configuration/naming-conventions/02_DBIS_NAMESPACE_AND_UTRNF_MAPPING.md` and `docs/04-configuration/naming-conventions/README.md`.

.cursor/rules/operator-context-lan-proxmox.mdc

@@ -8,10 +8,10 @@ alwaysApply: true
 **Remember:** This machine **is** LAN/operator — it has LAN and Proxmox access to 192.168.11.x. Operator scripts **can and should** be run from here when the user asks to run operator tasks.
 
 - **Dotenv:** `run-all-operator-tasks-from-lan.sh` and `run-operator-tasks-from-lan.sh` **always load dotenv** via `scripts/lib/load-project-env.sh` (repo `.env` + `smom-dbis-138/.env`). No need to `source .env` before running.
-- **Proxmox hosts (IPs):** 192.168.11.10–.14 (ML110, R630-01..04). **Canonical FQDNs:** `ml110.sankofa.nexus`, `r630-01.sankofa.nexus`, … `r630-04.sankofa.nexus` (`config/ip-addresses.conf` `PROXMOX_FQDN_*`). Chain 138 RPC: 192.168.11.211:8545.
+- **Proxmox hosts:** 192.168.11.10 (ML110), .11 (R630-01), .12 (R630-02). Chain 138 RPC: 192.168.11.211:8545.
 - **NPMplus password:** In **project root** `.env` — variable `NPM_PASSWORD` (with `NPM_EMAIL`, `NPM_URL`). Operator scripts load it via `load-project-env.sh`; NPMplus API: 192.168.11.167:81 or .166:81.
 - **Continue and complete:** (1) `./scripts/run-completable-tasks-from-anywhere.sh` then (2) `./scripts/run-all-operator-tasks-from-lan.sh` (use `--skip-backup` if NPM_PASSWORD not set; add `--deploy` or `--create-vms` as needed).
 
-When suggesting or running operator/LAN tasks (e.g. `run-all-operator-tasks-from-lan.sh`, contract verification, NPMplus backup, nginx/VMID 5000, token-aggregation DB, E2E checks), assume this host can reach Proxmox nodes (192.168.11.10–.14 or `*.sankofa.nexus`), Chain 138 RPC, NPMplus, and Blockscout. Credentials in `.env` or `smom-dbis-138/.env` (e.g. `NPM_PASSWORD`, `PRIVATE_KEY`) are used automatically when the operator script runs.
+When suggesting or running operator/LAN tasks (e.g. `run-all-operator-tasks-from-lan.sh`, contract verification, NPMplus backup, nginx/VMID 5000, token-aggregation DB, E2E checks), assume this host can reach Proxmox hosts (192.168.11.10–12), Chain 138 RPC, NPMplus, and Blockscout. Credentials in `.env` or `smom-dbis-138/.env` (e.g. `NPM_PASSWORD`, `PRIVATE_KEY`) are used automatically when the operator script runs.
 
 **Optional:** Before running operator scripts, run the **Operator/LAN access check** (curl RPC, env files) per rule `operator-lan-access-check.mdc`; if unreachable, suggest `run-completable-tasks-from-anywhere.sh` and document that operator tasks need LAN.

.cursor/rules/operator-lan-access-check.mdc

@@ -38,11 +38,7 @@ test -f .env && test -f smom-dbis-138/.env && echo "env OK" || echo "env missing
 - Suggest: `./scripts/run-completable-tasks-from-anywhere.sh` (config validation, on-chain check, reconcile output).
 - Tell the user that NPMplus backup, Blockscout verify, RPC proxy updates, and deploy require a host on **LAN (192.168.11.x)** with root `.env` and `smom-dbis-138/.env`; see **docs/00-meta/OPERATOR_CREDENTIALS_CHECKLIST.md** and **OPERATOR_READY_CHECKLIST.md**.
 
-## 4. Proxmox FQDN on LAN (optional)
-
-If you use **`*.sankofa.nexus`** for SSH: `bash scripts/verify/check-proxmox-mgmt-fqdn.sh` (exit `1` until UDM/local DNS or `/etc/hosts` has A-records). Snippet: `bash scripts/verify/check-proxmox-mgmt-fqdn.sh --print-hosts`.
-
-## 5. References
+## 4. References
 
 - **Operator context (always):** `.cursor/rules/operator-context-lan-proxmox.mdc` — this machine is assumed LAN/operator when that rule applies.
 - **Credentials:** `docs/00-meta/OPERATOR_CREDENTIALS_CHECKLIST.md` — per-task LAN, PRIVATE_KEY, NPM_PASSWORD, RPC_URL_138.

.cursor/rules/project-doc-and-deployment-refs.mdc

@@ -8,11 +8,8 @@ alwaysApply: true
 When answering token/PMM/deployment questions, prefer these docs over inferring from other files. Cite §5 / §8 for canonical and verification.
 
 **Canonical / verification:** `docs/11-references/EXPLORER_TOKEN_LIST_CROSSCHECK.md` (§5 canonical, §8 on-chain verification)  
-**Token / bridge naming (UTRNF + DBIS `c*` mapping):** `docs/04-configuration/naming-conventions/README.md` (especially `02_DBIS_NAMESPACE_AND_UTRNF_MAPPING.md` for UTRNF `c` vs compliant money)  
-**GRU FX reference vs public PMM mesh:** `docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md` (reference-first policy; mesh = execution layer)  
-**Contract addresses:** `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md` (includes **Ethereum mainnet optional TRUU PMM** subsection)  
+**Contract addresses:** `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md`  
 **Address matrix:** `docs/11-references/ADDRESS_MATRIX_AND_STATUS.md`  
-**Mainnet TRUU PMM (optional volatile rail):** `docs/03-deployment/MAINNET_PMM_TRUU_CWUSD_PEG_AND_BOT_RUNBOOK.md` section 11; `cross-chain-pmm-lps/config/deployment-status.json` `chains."1".pmmPoolsVolatile[]`  
 **Fixes and deployments:** `docs/00-meta/REQUIRED_FIXES_GAPS_AND_DEPLOYMENTS_LIST.md`  
 **TODOs:** `docs/00-meta/TODOS_CONSOLIDATED.md`  
 **Operator commands:** `docs/00-meta/OPERATOR_READY_CHECKLIST.md`  

.cursor/rules/proxmox-production-safety.mdc

@@ -1,28 +0,0 @@
----
-description: Mission-critical Proxmox — scoped mutations, no accidental cross-workload impact
-alwaysApply: true
----
-
-# Production safety — Proxmox and operator automation
-
-This environment is **mission-critical**. Prefer **small, explicit scopes** over broad loops.
-
-## Do not
-
-- Run **host-wide** or **cluster-wide** `pct start` / `qm start` / `pct stop` / destructive maintenance **without** a named list of VMIDs and a **dry-run first**.
-- Edit **`config/ip-addresses.conf`** or shared dotenv for a **single-workload** fix unless the change is documented and reviewed; prefer **workload-specific scripts** with explicit `--host` / `--vmid` flags.
-- Rely on ad-hoc shell one-liners that iterate all Proxmox IPs for the user; use **`scripts/operator/start-stopped-lxc-scoped.sh`** (or an equally scoped script) instead.
-
-## Do
-
-- **Default dry-run**, then **`--apply`** or **`PROXMOX_OPS_APPLY=1`** for mutations. Optional **`PROXMOX_OPS_ALLOWED_VMIDS`** for an extra allowlist.
-- Set **`PROXMOX_SAFE_DEFAULTS=1`** in operator `.env` so guarded maintenance scripts (`fix-core-rpc-2101.sh`, `make-rpc-vmids-writable-via-ssh.sh`, `ensure-legacy-monitor-networkd-via-ssh.sh`) default to **dry-run** unless **`--apply`** or **`PROXMOX_OPS_APPLY=1`**. Orchestrators (e.g. `run-all-maintenance-via-proxmox-ssh.sh`) pass **`--apply`** to sub-steps when not in top-level `--dry-run`.
-- Use **`scripts/lib/proxmox-production-guard.sh`** in new operator scripts that SSH to PVE.
-- After changing VM placement, update **`get_host_for_vmid`** in `scripts/lib/load-project-env.sh` so automation targets the correct node.
-- For Chain 138 RPC checks only: **`scripts/verify/check-chain138-rpc-health.sh`** (read-only HTTP probes).
-
-## Reference
-
-- Scoped start: `scripts/operator/start-stopped-lxc-scoped.sh`
-- Guard helpers: `scripts/lib/proxmox-production-guard.sh`
-- VMID / host facts: `docs/04-configuration/ALL_VMIDS_ENDPOINTS.md`, `docs/04-configuration/RPC_ENDPOINTS_MASTER.md`

.cursor/rules/wormhole-ai-resources.mdc

@@ -1,20 +0,0 @@
----
-description: When to use Wormhole AI doc bundles vs repo Chain 138 / CCIP canonicals
-alwaysApply: false
----
-
-# Wormhole AI resources vs this repo
-
-## Use Wormhole’s bundles for
-
-- Wormhole protocol behavior: VAAs, Guardians, NTT, Connect, Executor, Wormhole CCTP integration, Wormhole Queries, MultiGov, Settlement, TypeScript/Solidity SDK **as documented by Wormhole**.
-- Prefer the **tier ladder**: `llms.txt` → `site-index.json` → category `.md` → `llms-full.jsonl` only for RAG or very large context.
-- Canonical URLs and mirror script: [docs/04-configuration/WORMHOLE_AI_RESOURCES_LLM_PLAYBOOK.md](docs/04-configuration/WORMHOLE_AI_RESOURCES_LLM_PLAYBOOK.md).
-- Optional MCP: `mcp-wormhole-docs` (read-only resources + `wormhole_doc_search`); see [docs/04-configuration/MCP_SETUP.md](docs/04-configuration/MCP_SETUP.md).
-
-## Use repo canonical docs for
-
-- **Chain 138** token addresses, PMM pools, DODOPMMIntegration, deployer wallet, Blockscout alignment.
-- **CCIP** routes, receivers, and this project’s bridge runbooks.
-
-Do not answer “what is the canonical cUSDT address on 138?” from Wormhole docs. Do not answer “how does Wormhole NTT deploy on Solana?” from `ADDRESS_MATRIX_AND_STATUS.md` unless it explicitly cites Wormhole.

.devin/README.md

@@ -0,0 +1,18 @@
+# Devin for Terminal in Cursor
+
+This project is configured to use Devin for Terminal as a local CLI companion inside Cursor.
+
+- Cursor config import is enabled through `.cursor/rules/` and `.cursor/mcp.json` if present.
+- Windsurf config import is disabled for this project.
+- `AGENTS.md` remains the canonical shared project guidance.
+- Personal Devin overrides and secrets belong in `.devin/config.local.json`, which is gitignored.
+- Run `devin auth login` interactively before first use.
+
+Useful commands:
+
+```bash
+devin
+devin -- "review this repo and suggest the next safe task"
+devin auth status
+devin mcp list
+```

.devin/agents/reviewer/AGENT.md

@@ -0,0 +1,21 @@
+---
+name: reviewer
+description: Read-only reviewer for Cursor/Devin handoffs
+allowed-tools:
+  - read
+  - grep
+  - glob
+  - exec
+permissions:
+  allow:
+    - Exec(git status)
+    - Exec(git diff)
+    - Exec(git log)
+  deny:
+    - write
+    - edit
+---
+
+You are a read-only review subagent for this Cursor workspace.
+
+Review changes for correctness, security, operational risk, and consistency with `AGENTS.md` and relevant `.cursor/rules/` guidance. Do not modify files. Report only actionable findings first, ordered by severity, with exact file paths.

.devin/config.json

@@ -0,0 +1,38 @@
+{
+  // Devin for Terminal project config optimized for Cursor as the primary IDE.
+  "read_config_from": {
+    "cursor": true,
+    "windsurf": false,
+    "claude": true
+  },
+  "permissions": {
+    "allow": [
+      "Read(**)",
+      "Exec(git status)",
+      "Exec(git diff)",
+      "Exec(git log)",
+      "Exec(pnpm run)",
+      "Exec(bash scripts/verify)",
+      "Exec(bash scripts/validation)"
+    ],
+    "ask": [
+      "Write(**)",
+      "Exec(git commit)",
+      "Exec(git push)",
+      "Exec(docker)",
+      "Exec(docker compose)",
+      "mcp__*"
+    ],
+    "deny": [
+      "Exec(rm)",
+      "Exec(sudo)",
+      "Exec(chmod -R)",
+      "Exec(chown -R)",
+      "Write(.env*)",
+      "Write(**/.env*)",
+      "Write(reports/secrets/**)",
+      "Write(config/production/*did-secrets.env)"
+    ]
+  },
+  "mcpServers": {}
+}

.devin/hooks.v1.json

@@ -0,0 +1,14 @@
+{
+  "PreToolUse": [
+    {
+      "matcher": "exec",
+      "hooks": [
+        {
+          "type": "command",
+          "command": "bash scripts/devin/block-dangerous-command.sh",
+          "timeout": 10
+        }
+      ]
+    }
+  ]
+}

.devin/skills/cursor-handoff/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: cursor-handoff
+description: Align Devin for Terminal work with this Cursor workspace and project rules
+allowed-tools:
+  - read
+  - grep
+  - glob
+  - exec
+triggers:
+  - user
+  - model
+---
+
+Use this skill when starting or resuming work in this repository from Devin for Terminal.
+
+1. Treat Cursor as the primary IDE context and read `.cursor/rules/` when relevant.
+2. Read `AGENTS.md` first for canonical project guidance.
+3. Do not rely on Windsurf rules, skills, workflows, or MCP settings for this project.
+4. Check `git status --short` before editing and preserve unrelated user changes.
+5. Prefer dry-run flags for operator, deployment, DNS, Proxmox, and LAN-sensitive scripts.
+6. Never write secrets or runtime credentials into tracked files.
+7. When using MCP servers, assume Cursor and Devin maintain separate authentication sessions.

.devin/skills/review/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: review
+description: Review code changes before commit or handoff
+allowed-tools:
+  - read
+  - grep
+  - glob
+  - exec
+permissions:
+  allow:
+    - Exec(git status)
+    - Exec(git diff)
+    - Exec(git log)
+  deny:
+    - write
+    - edit
+triggers:
+  - user
+  - model
+---
+
+Review the current changes with a correctness-first stance.
+
+1. Run `git status --short`.
+2. Run `git diff` and, if staged changes exist, `git diff --staged`.
+3. Focus on bugs, security regressions, deployment risk, missing validation, and secret exposure.
+4. Cite exact file paths and keep findings ordered by severity.
+5. If no issues are found, say so and call out any test or validation gaps.

.env.master.example

@@ -15,14 +15,13 @@ PROXMOX_USER=
 PROXMOX_TOKEN_NAME=
 PROXMOX_TOKEN_VALUE=
 PROXMOX_ALLOW_ELEVATED=
-# Production operator host: set PROXMOX_SAFE_DEFAULTS=1 so guarded maintenance scripts default to dry-run unless --apply or PROXMOX_OPS_APPLY=1 (see scripts/lib/proxmox-production-guard.sh).
-# PROXMOX_SAFE_DEFAULTS=
-# PROXMOX_OPS_ALLOWED_VMIDS=
 
 # --- Cloudflare ---
 # Prefer CLOUDFLARE_API_TOKEN scoped to Zone:DNS:Edit on the zones you use (avoid global Account API key when possible).
 # Bulk DNS script: scripts/update-all-dns-to-public-ip.sh — use --dry-run and --zone-only=sankofa.nexus (etc.) before wide updates.
 CLOUDFLARE_API_TOKEN=
+# Set to 1 if token has no DNS:Edit and you need Global API key for scripts/cloudflare/provision-d-bis-mail-dns-and-npmplus.sh etc.
+CLOUDFLARE_DNS_PREFER_GLOBAL_KEY=
 CLOUDFLARE_EMAIL=
 CLOUDFLARE_API_KEY=
 CLOUDFLARE_ZONE_ID=
@@ -30,8 +29,6 @@ CLOUDFLARE_ZONE_ID_D_BIS_ORG=
 CLOUDFLARE_ZONE_ID_MIM4U_ORG=
 CLOUDFLARE_ZONE_ID_SANKOFA_NEXUS=
 CLOUDFLARE_ZONE_ID_DEFI_ORACLE_IO=
-# omdnl.org (apex + www): scripts/cloudflare/configure-omdnl-org-dns.sh
-CLOUDFLARE_ZONE_ID_OMDNL_ORG=
 CLOUDFLARE_TUNNEL_TOKEN=
 CLOUDFLARE_TUNNEL_ID=
 CLOUDFLARE_TUNNEL_ID_ALLTRA_HYBX=
@@ -39,19 +36,16 @@ CLOUDFLARE_TUNNEL_ID_MIFOS_R630_02=
 CLOUDFLARE_TUNNEL_TOKEN_MIFOS_R630_02=
 CLOUDFLARE_ORIGIN_CA_KEY=
 CLOUDFLARE_ACCOUNT_ID=
-# Turnstile (Captcha) for IRU marketplace inquiry — Dashboard → Turnstile; NOT the DNS API key
-CLOUDFLARE_TURNSTILE_SECRET_KEY=
-# dbis_core Vite marketplace: VITE_CLOUDFLARE_TURNSTILE_SITE_KEY=
-# Sankofa portal Next.js (sibling repo): NEXT_PUBLIC_CLOUDFLARE_TURNSTILE_SITE_KEY=
 
 # --- ClouDNS ---
 CLOUDNS_AUTH_ID=
 CLOUDNS_AUTH_PASSWORD=
 
 # --- NPM / NPMplus ---
-# Shared admin username for all NPMplus instances unless an instance-specific
-# UI is deliberately configured differently.
-# API scripts: use HTTPS on port 81 (e.g. https://192.168.11.167:81). Plain http:// typically 301-redirects to https:// and breaks POST /api/tokens unless curl uses --post301.
+# For scripts/verify/backup-npmplus.sh: NPM_EMAIL and NPM_PASSWORD are both required
+# (no in-script defaults); see AGENTS.md operator / backup row.
+# PMG (LXC 100) web UI — optional: run scripts/operator/sync-pmg-webui-password-to-dotenv.sh to pull from /root/PMG_WEBUI_password.txt
+PMG_WEBUI_PASSWORD=
 NPM_URL=
 NPM_EMAIL=
 NPM_PASSWORD=
@@ -60,67 +54,10 @@ NPM_PROXMOX_HOST=
 NPMPLUS_HOST=
 NPM_VMID=
 NPMPLUS_VMID=
-NPM_PASSWORD_PRIMARY=
-NPM_PASSWORD_SECONDARY=
-NPM_PASSWORD_ALLTRA_HYBX=
-NPM_PASSWORD_FOURTH=
-NPM_PASSWORD_MIFOS=
 NPMPLUS_ALLTRA_HYBX_VMID=
 IP_NPMPLUS_ALLTRA_HYBX=
-NPM_URL_SECONDARY=
-NPM_URL_ALLTRA_HYBX=
-NPM_URL_FOURTH=
 NPM_URL_MIFOS=
 
-# --- NPMplus: public CCIP mainnet-cw relay health (upstream r630-01 :9863) ---
-# Set then run: bash scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh
-# Or from SSH (r630-01 → NPM LAN): bash scripts/nginx-proxy-manager/upsert-ccip-relay-mainnet-cw-via-ssh.sh
-# DNS (d-bis.org): bash scripts/cloudflare/configure-relay-mainnet-cw-dns.sh (or full zone: scripts/update-all-dns-to-public-ip.sh)
-# CCIP_RELAY_MAINNET_CW_PUBLIC_HOST=relay-mainnet-cw.d-bis.org
-# Optional: CCIP_RELAY_MAINNET_CW_UPSTREAM_IP=192.168.11.11 CCIP_RELAY_MAINNET_CW_UPSTREAM_PORT=9863
-# Explorer / mission-control (optional): name mainnet-cw normalizes to mainnet_cw (preferred primary in ccip_health.go).
-# Set on the explorer API host or pass through explorer-monorepo/deployment/docker-compose.yml (api service).
-# CCIP_RELAY_HEALTH_URLS=mainnet-cw=https://relay-mainnet-cw.d-bis.org/healthz,mainnet=http://192.168.11.11:9860/healthz
-# CCIP_RELAY_HEALTH_URL=
-
-# --- info.defi-oracle.io (dedicated nginx LXC, not VMID 2400 RPC) ---
-# Defaults in config/ip-addresses.conf: IP_INFO_DEFI_ORACLE_WEB=192.168.11.218, VMID 2410.
-# IP_INFO_DEFI_ORACLE_WEB=
-# INFO_DEFI_ORACLE_VMID=
-# INFO_DEFI_ORACLE_UPSTREAM_IP=   # NPM fleet: overrides forward_host for info.defi-oracle.io
-# INFO_DEFI_ORACLE_EDGE_MODE=auto   # auto | tunnel | public_ip — DNS script for info.defi-oracle.io
-# INFO_DEFI_ORACLE_PUBLIC_IP=      # WAN IP for public_ip mode (else PUBLIC_IP)
-# CLOUDFLARE_ZONE_ID_DEFI_ORACLE_IO=  # Required for set-info-defi-oracle-dns + purge-info-defi-oracle-cache
-# INFO_DEFI_ORACLE_TUNNEL_UPSTREAM=   # Tunnel ingress origin for info hostnames (default IP_INFO_DEFI_ORACLE_WEB)
-# SPA: default runtime base is {origin}/token-aggregation (nginx on 2410 proxies to Blockscout). Override only if needed:
-# In info-defi-oracle-138/.env.local (not this file): VITE_TOKEN_AGGREGATION_API_BASE=https://explorer.d-bis.org/token-aggregation
-
-# --- mev.defi-oracle.io (MEV Control GUI on nginx LXC 2410 by default) ---
-# MEV_ADMIN_API_HOST=192.168.11.223  # Dedicated backend CT 2421; LAN host reachable from CT
-# MEV_ADMIN_API_PORT=9090
-# MEV_DEFI_ORACLE_WEB_VMID=2410
-# MEV_DEFI_ORACLE_UPSTREAM_IP=      # NPM: forward_host override (default IP_INFO_DEFI_ORACLE_WEB)
-# MEV_DEFI_ORACLE_UPSTREAM_PORT=80
-# MEV_DEFI_ORACLE_EDGE_MODE=auto    # Cloudflare DNS script (same as info: auto|tunnel|public_ip)
-# MEV_DEFI_ORACLE_PUBLIC_IP=        # A-record mode WAN IP if not using tunnel
-# Backend CT runtime env lives in config/mev-platform/mev-platform-backend-ct.env.example
-# and must include:
-#   MEV_SUPERVISOR_URL=http://127.0.0.1:9091
-
-# --- Keycloak Admin API (optional) ---
-# For scripts/deployment/keycloak-sankofa-ensure-client-redirects.sh — merge portal/admin redirect URIs.
-# KEYCLOAK_URL=https://keycloak.sankofa.nexus
-# KEYCLOAK_REALM=master
-# KEYCLOAK_CLIENT_ID=sankofa-portal
-# KEYCLOAK_ADMIN=admin
-# KEYCLOAK_ADMIN_PASSWORD=
-
-# --- IT read API (Sankofa portal /it on CT 7801) ---
-# Base URL of sankofa-it-read-api (Phase 0). Merged into /opt/sankofa-portal/.env by:
-#   scripts/deployment/sankofa-portal-merge-it-read-api-env-from-repo.sh
-# IT_READ_API_URL=http://192.168.11.11:8787
-# IT_READ_API_KEY=
-
 # --- Fastly ---
 FASTLY_API_TOKEN=
 
@@ -139,10 +76,16 @@ OMADA_CLIENT_SECRET=
 GITEA_URL=
 GITEA_TOKEN=
 GITEA_ORG=
-# NPMplus upstream for gitea.d-bis.org (primary + fourth scripts). Defaults in config/ip-addresses.conf: VMID 104 @ .31:80
-# GITEA_PUBLIC_UPSTREAM_HOST=192.168.11.31
-# GITEA_PUBLIC_UPSTREAM_PORT=80
-# Dev-local Gitea on VM 5700 instead: GITEA_PUBLIC_UPSTREAM_HOST=192.168.11.59 GITEA_PUBLIC_UPSTREAM_PORT=3000
+
+# --- Phoenix deploy API (Gitea Actions secrets on EACH repo that triggers deploy) ---
+# PHOENIX_DEPLOY_URL=       # full POST URL e.g. http://192.168.11.59:4001/api/deploy — same variable name as repo Secrets in Gitea
+# PHOENIX_DEPLOY_TOKEN=    # bearer for Phoenix deploy API — set per-repo Secret on Gitea, not necessarily in this root .env
+
+# --- CyberSecur Global (Gov portal static site; optional Web3Forms intake) ---
+# CYBERSECUR_WEB3FORMS_ACCESS_KEY=   # web3forms.com — used by CyberSecur-Global/deploy/render-intake.sh (key is public in browser HTML per provider)
+# After rotating the key in the Web3Forms dashboard, update this line and redeploy:
+#   CYBERSECUR_REPO=/path/to/CyberSecur-Global ./scripts/deployment/sync-cybersecur-global-to-ct7810.sh
+# CYBERSECUR_INTAKE_REDIRECT_URL=    # optional; default https://cybersecur.d-bis.org/intake-thanks.html
 
 # --- Database & app auth ---
 DATABASE_URL=
@@ -165,168 +108,68 @@ AWS_S3_BUCKET=
 AZURE_STORAGE_CONNECTION_STRING=
 AZURE_STORAGE_CONTAINER=
 
-# --- Pinata (IPFS pinning; token logos) ---
-# Dashboard: https://app.pinata.cloud — API Keys → JWT or key/secret.
-# scripts/upload-token-logos-to-ipfs.sh uses PINATA_JWT only (Bearer for pinFileToIPFS).
-PINATA_JWT=
-PINATA_API_KEY=
-PINATA_API_SECRET=
-
 # --- Blockchain / SMOM-DBIS-138 (use smom-dbis-138/.env for PRIVATE_KEY) ---
 PRIVATE_KEY=
-# Chain 138 Core (deploy/gas/scripts on LAN): http://192.168.11.211:8545 — IP:port; not FQDN. See docs/04-configuration/RPC_ENDPOINTS_MASTER.md
+DEPLOYER_ADDRESS=
 RPC_URL_138=
-# Public JSON-RPC for frontends, bridges, MetaMask: HTTPS FQDN only, e.g. https://rpc-http-pub.d-bis.org (not 192.168.11.221). LAN-only services may use http://192.168.11.221:8545
 RPC_URL_138_PUBLIC=
-# Token-aggregation publication bundle (explorer): deploy script uses TOKEN_AGG_CHAIN138_RPC_URL if set, else defaults to public node — see scripts/deploy-token-aggregation-for-publication.sh
-# TOKEN_AGG_CHAIN138_RPC_URL=
-# Optional PMM-only RPC for GET /api/v1/quote on-chain path (core RPC while indexer uses public)
-# TOKEN_AGGREGATION_PMM_RPC_URL=
-# TOKEN_AGGREGATION_PMM_QUERY_TRADER=
-# Router-v2 execution stack (Chain 138 canonical live deployment)
-ENHANCED_SWAP_ROUTER_V2_ADDRESS=0xF1c93F54A5C2fc0d7766Ccb0Ad8f157DFB4C99Ce
-INTENT_BRIDGE_COORDINATOR_V2_ADDRESS=0x7D0022B7e8360172fd9C0bB6778113b7Ea3674E7
-CHAIN138_ENABLE_DODO_V3_EXECUTION=1
-# Chain 138 multi-provider venues (canonical live deployment)
-UNISWAP_V3_ROUTER=0xde9cD8ee2811E6E64a41D5F68Be315d33995975E
-UNISWAP_QUOTER_ADDRESS=0x6abbB1CEb2468e748a03A00CD6aA9BFE893AFa1f
-UNISWAP_V3_WETH_USDT_POOL=0xa893add35aEfe6A6d858EB01828bE4592f12C9F5
-UNISWAP_V3_WETH_USDC_POOL=0xEC745bfb6b3cd32f102d594E5F432d8d85B19391
-UNISWAP_V3_WETH_USDT_FEE=500
-UNISWAP_V3_WETH_USDC_FEE=500
-BALANCER_VAULT=0x96423d7C1727698D8a25EbFB88131e9422d1a3C3
-BALANCER_WETH_USDT_POOL_ID=0x877cd220759e8c94b82f55450c85d382ae06856c426b56d93092a420facbc324
-BALANCER_WETH_USDC_POOL_ID=0xd8dfb18a6baf9b29d8c2dbd74639db87ac558af120df5261dab8e2a5de69013b
-CURVE_3POOL=0xE440Ec15805BE4C7BabCD17A63B8C8A08a492e0f
-ONEINCH_ROUTER=0x500B84b1Bc6F59C1898a5Fe538eA20A758757A4F
-CHAIN138_DEPLOY_GAS_PRICE_WEI=1000
-# Chain 138 upstream-native Uniswap v3 replacement track
-CHAIN138_UNISWAP_V3_NATIVE_CORE_REPO=/home/intlc/projects/uniswap-v3-core
-CHAIN138_UNISWAP_V3_NATIVE_PERIPHERY_REPO=/home/intlc/projects/uniswap-v3-periphery
-CHAIN138_UNISWAP_V3_NATIVE_FACTORY=0x2f7219276e3ce367dB9ec74C1196a8ecEe67841C
-CHAIN138_UNISWAP_V3_NATIVE_NFT_DESCRIPTOR_LIBRARY=0x6F5fdE32DD2aC66B27e296EC9D6F4E79A3dE2947
-CHAIN138_UNISWAP_V3_NATIVE_TOKEN_DESCRIPTOR=0xca66DCAC4633555033F6fDDBE4234B6913c7ff51
-CHAIN138_UNISWAP_V3_NATIVE_POSITION_MANAGER=0x31b68BE5af4Df565Ce261dfe53D529005D947B48
-CHAIN138_UNISWAP_V3_NATIVE_SWAP_ROUTER=0xde9cD8ee2811E6E64a41D5F68Be315d33995975E
-CHAIN138_UNISWAP_V3_NATIVE_QUOTER_V2=0x6abbB1CEb2468e748a03A00CD6aA9BFE893AFa1f
-CHAIN138_UNISWAP_V3_NATIVE_WETH_USDT_POOL=0xa893add35aEfe6A6d858EB01828bE4592f12C9F5
-CHAIN138_UNISWAP_V3_NATIVE_WETH_USDC_POOL=0xEC745bfb6b3cd32f102d594E5F432d8d85B19391
-CHAIN138_UNISWAP_V3_NATIVE_FEE_TIER=500
-CHAIN138_NATIVE_GAS_PRICE=1000
-CHAIN138_NATIVE_DEPLOY_GAS_LIMIT=12000000
-CHAIN138_NATIVE_POOL_TX_GAS_LIMIT=12000000
-CHAIN138_NATIVE_WETH9=0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2
-CHAIN138_NATIVE_USDT=0x004b63A7B5b0E06f6bB6adb4a5F9f590BF3182D1
-CHAIN138_NATIVE_USDC=0x71D6687F38b93CCad569Fa6352c876eea967201b
-CHAIN138_NATIVE_CURRENCY_LABEL=ETH
-CHAIN138_UNISWAP_V3_INITIAL_USD_PER_WETH=2116.6
-CHAIN138_UNISWAP_V3_SEED_WETH_USDT_WETH=50
-CHAIN138_UNISWAP_V3_SEED_WETH_USDT_STABLE=105830
-CHAIN138_UNISWAP_V3_SEED_WETH_USDC_WETH=50
-CHAIN138_UNISWAP_V3_SEED_WETH_USDC_STABLE=105830
-# Cross-chain flash infra (Chain 138)
-FLASH_UNIVERSAL_CCIP_BRIDGE=0xCd42e8eD79Dc50599535d1de48d3dAFa0BE156F8
-FLASH_CCIP_ROUTER=0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817
-FLASH_REPAY_RECEIVER_ROUTER=0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817
-FLASH_VAULT_CREDIT_ROUTER=0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817
-CROSS_CHAIN_FLASH_BRIDGE_ADAPTER=0xBe9e0B2d4cF6A3b2994d6f2f0904D2B165eB8ffC
-CROSS_CHAIN_FLASH_REPAY_RECEIVER=0xD084b68cB4B1ef2cBA09CF99FB1B6552fd9b4859
-CROSS_CHAIN_FLASH_VAULT_CREDIT_RECEIVER=0x89F7a1fcbBe104BeE96Da4b4b6b7d3AF85f7E661
-# Optional same-chain ERC-3156 flash dry-run inputs (set when a canonical flash vault is deployed / approved)
-FLASH_VAULT=
-FLASH_VAULT_TOKEN=
-FLASH_PROVIDER_RPC_URL=
-FLASH_TEST_AMOUNT=
-# XDC Zero — second relayer pair (XDC Network mainnet <-> Chain 138). See docs/03-deployment/CHAIN138_XDC_ZERO_BRIDGE_RUNBOOK.md and config/xdc-zero/
-# Use XDC mainnet JSON-RPC only (chain id 50), not Ethereum L1. Prefer erpc (rpc.xinfin.network often returns 5xx).
-XDC_PARENTNET_URL=https://erpc.xinfin.network
-# Testnet (Apothem): https://rpc.apothem.network
-# Optional alias for 138 side (defaults to RPC_URL_138 in preflight if unset):
-XDC_ZERO_PEER_RPC_URL=
-
-# Ethereum L1 — used for dual-anchor attestation with scripts/omnl/omnl-chain138-attestation-tx.sh (consumes ETH gas). Alias: RPC_URL_MAINNET.
 ETHEREUM_MAINNET_RPC=
-# Mainnet DODO PMM + optional TRUU volatile rail (see docs/03-deployment/MAINNET_PMM_TRUU_CWUSD_PEG_AND_BOT_RUNBOOK.md)
-# Canonical integration: 0xa9F284eD010f4F7d7F8F201742b49b9f58e29b84
-DODO_PMM_INTEGRATION_MAINNET=
-# --- Mainnet Aave flash quote-push (cWUSDC/USDC peg / rebalance without wallet USDC) ---
-# If the deployer wallet already has USDC + cWUSDC: bash scripts/deployment/apply-mainnet-cwusdc-usdc-peg-tranche-from-wallet.sh --dry-run | --apply
-# Receiver only: bash scripts/deployment/deploy-mainnet-aave-quote-push-receiver.sh --dry-run | --apply
-# Deploy: bash scripts/deployment/deploy-mainnet-aave-quote-push-stack.sh --dry-run | --apply
-# Treasury manager: bash scripts/deployment/deploy-mainnet-quote-push-treasury-manager.sh --dry-run | --apply
-# One shot: bash scripts/deployment/run-mainnet-aave-cwusdc-quote-push-once.sh --dry-run | --apply
-# Keeper: bash scripts/deployment/run-mainnet-aave-quote-push-keeper.sh --dry-run | --apply
-# Loop:    FLASH_LOOP_COUNT=3 bash scripts/deployment/run-mainnet-aave-cwusdc-quote-push-loop.sh --dry-run | --apply
-# Forge sources: smom-dbis-138/script/flash/RunMainnetAaveCwusdcUsdcQuotePushOnce.s.sol
-# Modeling (no chain writes): scripts/deployment/run-mainnet-cwusdc-flash-quote-push-model-sweep.sh
-# Optional sweep tuning: FLASH_MODEL_GAS_TX_COUNT FLASH_MODEL_GAS_PER_TX FLASH_MODEL_MAX_POST_TRADE_DEV_BPS
-AAVE_QUOTE_PUSH_RECEIVER_MAINNET=0x241cb416aaFC2654078b7E2376adED2bDeFbCBa2
-# QUOTE_PUSH_UNWINDER_TYPE=two_hop_dodo  # or dodo_univ3 / two_hop_dodo_univ3; lets the runner auto-pick the latest real broadcast unwinder after --apply
-QUOTE_PUSH_EXTERNAL_UNWINDER_MAINNET=0xaB74B4369e5603085A58FDa181E9B43617C6a58f
-FLASH_QUOTE_AMOUNT_RAW=200000
-# MIN_OUT_UNWIND_BUFFER_RAW=0  # route-specific override for two_hop_dodo_univ3; the recovered three-leg path can clear with zero buffer while the legacy 5000 raw default clips it
-# UNWIND_MODE: 0 = Uniswap V3 exactInputSingle (set UNWIND_V3_FEE_U24); 1 = DODO pool (UNWIND_DODO_POOL);
-#               2 = Uniswap V3 exactInput packed path hex (UNWIND_V3_PATH_HEX) when no direct pool — see UniswapV3ExternalUnwinder.
-#               6 = TwoHopDodoToUniswapV3MultiHopExternalUnwinder (UNWIND_TWO_HOP_* + UNWIND_INTERMEDIATE_TOKEN + UNWIND_V3_PATH_HEX)
-UNWIND_MODE=4
-# UNWIND_V3_FEE_U24=
-# UNWIND_V3_PATH_HEX=0x...   # UNWIND_MODE=2 — build: bash scripts/verify/build-uniswap-v3-exact-input-path-hex.sh <path-args>
-# UNWIND_DODO_POOL=
-UNWIND_TWO_HOP_POOL_A=0xe944b7Cb012A0820c07f54D51e92f0e1C74168DB
-UNWIND_TWO_HOP_POOL_B=0x27f3aE7EE71Be3d77bAf17d4435cF8B895DD25D2
-UNWIND_TWO_HOP_MID_TOKEN=0xaF5017d0163ecb99d9B5D94e3b4D7b09Af44D8AE
-UNWIND_MIN_MID_OUT_RAW=1
-# UNWIND_INTERMEDIATE_TOKEN=0xdAC17F958D2ee523a2206206994597C13D831ec7
-# UNWIND_MIN_INTERMEDIATE_OUT_RAW=1
-# Retained-surplus recycle / treasury manager policy:
-# QUOTE_PUSH_RECEIVER_OWNER=0x...
-# Live migration shortcut:
-#   bash scripts/deployment/deploy-mainnet-aave-quote-push-receiver.sh --apply
-#   AAVE_QUOTE_PUSH_RECEIVER_MAINNET=<new_receiver> QUOTE_PUSH_TREASURY_TAKE_RECEIVER_OWNERSHIP=1 bash scripts/deployment/deploy-mainnet-quote-push-treasury-manager.sh --apply
-# QUOTE_PUSH_TREASURY_MANAGER_MAINNET=0x...
-# QUOTE_PUSH_TREASURY_OWNER=0x...
-# QUOTE_PUSH_TREASURY_OPERATOR=0x...
-# QUOTE_PUSH_TREASURY_GAS_RECIPIENT=0x...
-# QUOTE_PUSH_TREASURY_RECYCLE_RECIPIENT=0x...
-# QUOTE_PUSH_RECEIVER_RESERVE_RAW=0
-# QUOTE_PUSH_TREASURY_RESERVE_RAW=0
-# QUOTE_PUSH_TREASURY_TAKE_RECEIVER_OWNERSHIP=1
-# QUOTE_PUSH_KEEPER_SKIP_FLASH=0
-# QUOTE_PUSH_KEEPER_SKIP_RECYCLE=0
-# QUOTE_PUSH_DEPLOYER_GAS_FLOOR_ETH=0.003
-# QUOTE_PUSH_OPERATION_BUFFER_ETH=0.0005
-# QUOTE_PUSH_NATIVE_TOKEN_PRICE=3200
-# Discover V3 pools: bash scripts/verify/probe-uniswap-v3-cwusdc-usdc-mainnet.sh
-# Optional min-out overrides (script derives from pool query + Aave premium when unset):
-# MIN_OUT_PMM=
-# MIN_OUT_UNWIND=
-# AAVE_FLASH_PREMIUM_BPS=5
-# UniswapV3ExternalUnwinder expects legacy SwapRouter exactInputSingle (not SwapRouter02 multicall).
-# UNISWAP_V3_SWAP_ROUTER_MAINNET=0xE592427A0AEce92De3Edee1F18E0157C05861564
-# cWUSDT/cWUSDC public PMM on mainnet (see cross-chain-pmm-lps/config/deployment-status.json); override if redeployed:
-# POOL_CWUSDT_CWUSDC_MAINNET=0xe944b7Cb012A0820c07f54D51e92f0e1C74168DB
-# Optional public flash-lender candidates for no-broadcast dry-runs on Ethereum mainnet.
-# Balancer mainnet vault is documented in smom-dbis-138/docs/bridge/trustless/ENV_VARIABLES_REFERENCE.md.
-MAINNET_BALANCER_VAULT=0xBA12222222228d8Ba445958a75a0704d566BF2C8
-# Aave V3 Ethereum mainnet pool/provider, verified on-chain 2026-04-05 via ADDRESSES_PROVIDER() and FLASHLOAN_PREMIUM_TOTAL().
-MAINNET_AAVE_V3_POOL=0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2
-MAINNET_AAVE_V3_POOL_ADDRESSES_PROVIDER=0x2f39d218133AFaB8F2B819B1066c7E434Ad94E9e
-# Optional overrides (defaults match deployment-status.json / scripts)
-TRUU_MAINNET=
-PMM_TRUU_FEE_BPS=
-PMM_TRUU_K=
-# Optional extra cast check in scripts/verify/check-mainnet-pmm-peg-bot-readiness.sh
-PMM_TRUU_BASE_TOKEN=
-PMM_TRUU_QUOTE_TOKEN=
-# Override initial DODO i for new pools only if governance changes baseline (top-up script default)
-PMM_TRUU_INITIAL_I=
-WORMHOLE_API_KEY=
-WORMHOLE_EXECUTOR_URL=https://executor.labsapis.com
-WORMHOLE_EXECUTOR_TESTNET_URL=https://executor-testnet.labsapis.com
+# Clear scripts/verify/check-external-dependencies.sh — use real service URLs when split; example interim health target:
+# DBIS_CORE_URL=https://dbis-api.d-bis.org/health
+DBIS_CORE_URL=
+CC_PAYMENT_ADAPTERS_URL=
+CC_AUDIT_LEDGER_URL=
+CC_SHARED_EVENTS_URL=
+CC_SHARED_SCHEMAS_URL=
+FIN_GATEWAY_URL=
+ALLIANCE_ACCESS_URL=
+# cast must be in PATH; use a runner-reachable Chain 138 RPC, e.g.:
+# CHAIN138_CI_RPC_URL=https://rpc.public-0138.defi-oracle.io
+CHAIN138_CI_RPC_URL=
+ALL_MAINNET_RPC=
+# Alltra / Wemix / Etherlink: set for production; for local read-only checks, deployer-gas-auto-route.sh falls back to public RPCs documented in scripts/deployment/deployer-gas-auto-route.sh
 CHAIN_651940_RPC_URL=
+# ALLTRA_MAINNET_RPC=https://mainnet-rpc.alltra.global
+# WEMIX_RPC_URL=https://api.wemix.com
+# ETHERLINK_RPC_URL=https://node.mainnet.etherlink.com
+CHAIN_1_UNISWAP_V2_FACTORY=0x5C69bEe701ef814a2B6a3EDD4B1652CB9cc5aA6f
+CHAIN_1_UNISWAP_V2_ROUTER=0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D
+CHAIN_1_UNISWAP_V2_START_BLOCK=0
+CHAIN_10_UNISWAP_V2_FACTORY=0x0c3c1c532F1e39EdF36BE9Fe0bE1410313E074Bf
+CHAIN_10_UNISWAP_V2_ROUTER=0x4A7b5Da61326A6379179b40d00F57E5bbDC962c2
+CHAIN_10_UNISWAP_V2_START_BLOCK=0
+CHAIN_25_UNISWAP_V2_FACTORY=0x3B44B2a187a7b3824131F8db5a74194D0a42Fc15
+CHAIN_25_UNISWAP_V2_ROUTER=0x145863Eb42Cf62847A6Ca784e6416C1682b1b2Ae
+CHAIN_25_UNISWAP_V2_START_BLOCK=0
+CHAIN_56_UNISWAP_V2_FACTORY=0xcA143Ce32Fe78f1f7019d7d551a6402fC5350c73
+CHAIN_56_UNISWAP_V2_ROUTER=0x10ED43C718714eb63d5aA57B78B54704E256024E
+CHAIN_56_UNISWAP_V2_START_BLOCK=0
+CHAIN_100_UNISWAP_V2_FACTORY=0xc35DADB65012eC5796536bD9864eD8773aBc74C4
+CHAIN_100_UNISWAP_V2_ROUTER=0x1b02dA8Cb0d097eB8D57A175b88c7D8b47997506
+CHAIN_100_UNISWAP_V2_START_BLOCK=0
+CHAIN_137_UNISWAP_V2_FACTORY=0x5757371414417b8C6CAad45bAeF941aBc7d3Ab32
+CHAIN_137_UNISWAP_V2_ROUTER=0xa5E0829CaCEd8fFDD4De3c43696c57F7D7A678ff
+CHAIN_137_UNISWAP_V2_START_BLOCK=0
+CHAIN_42220_UNISWAP_V2_FACTORY=0x62d5b84bE28a183aBB507E125B384122D2C25fAE
+CHAIN_42220_UNISWAP_V2_ROUTER=0xE3D8bd6Aed4F159bc8000a9cD47CffDb95F96121
+CHAIN_42220_UNISWAP_V2_START_BLOCK=0
+CHAIN_43114_UNISWAP_V2_FACTORY=0x9Ad6C38BE94206cA50bb0d90783181662f0Cfa10
+CHAIN_43114_UNISWAP_V2_ROUTER=0x60aE616a2155Ee3d9A68541Ba4544862310933d4
+CHAIN_43114_UNISWAP_V2_START_BLOCK=0
+CHAIN_8453_UNISWAP_V2_FACTORY=0x02a84c1b3BBD7401a5f7fa98a384EBC70bB5749E
+CHAIN_8453_UNISWAP_V2_ROUTER=0x8cFe327CEc66d1C090Dd72bd0FF11d690C33a2Eb
+CHAIN_8453_UNISWAP_V2_START_BLOCK=0
+CHAIN_42161_UNISWAP_V2_FACTORY=0x02a84c1b3BBD7401a5f7fa98a384EBC70bB5749E
+CHAIN_42161_UNISWAP_V2_ROUTER=0x8cFe327CEc66d1C090Dd72bd0FF11d690C33a2Eb
+CHAIN_42161_UNISWAP_V2_START_BLOCK=0
+# Optional / scaffold-only until Wemix UniV2 routing is promoted
+CHAIN_1111_UNISWAP_V2_FACTORY=
+CHAIN_1111_UNISWAP_V2_ROUTER=
+CHAIN_1111_UNISWAP_V2_START_BLOCK=0
 ETHERLINK_RPC_URL=
 TEZOS_RPC_URL=
 ETHERSCAN_API_KEY=
+WEMIXSCAN_API_KEY=
 ETHERLINK_CCIP_SELECTOR=
 TEZOS_BRIDGE_ENABLED=
 ETHERLINK_BRIDGE_ENABLED=
@@ -335,127 +178,11 @@ ETHERLINK_RELAY_BRIDGE=
 ETHERLINK_RELAY_PRIVATE_KEY=
 JUMPER_API_KEY=
 ONEINCH_API_KEY=
-# Optional: 1inch dev API base (default https://api.1inch.dev/swap/v6.0) — see packages/economics-toolkit/src/swap-engine/oneinch-quote.ts
-ONEINCH_API_URL=
-DODO_API_KEY=
-DODO_SECRET_KEY=
-DODO_DEVELOPER_API_KEY=
-# Optional: hosted DODO SmartTrade swap URL (default https://api.dodoex.io/route-service/developer/swap)
-DODO_QUOTE_URL=
-# Optional override for hosted DODO quote probes; if unset, scripts derive USER_ADDR
-# from PRIVATE_KEY and fall back to the standard deployer wallet.
-USER_ADDR=
 MOONPAY_API_KEY=
 MOONPAY_SECRET_KEY=
 RAMP_NETWORK_API_KEY=
 ONRAMPER_API_KEY=
 
-# --- Changelly Exchange API v2 (Chain 138 → mainnet → BTC payout pathway; backend only) ---
-# Docs: https://docs.changelly.com/ — register keys via pro@changelly.com
-# Private key: PEM file on server or KMS reference; never expose to frontend builds.
-CHANGELLY_API_PUBLIC_KEY=
-CHANGELLY_API_PRIVATE_KEY_PEM_PATH=
-
-# --- Canonical GRU / D-WIN token surfaces used by PMM, reporting, and staged x402 cutover ---
-CUSDT_V2_ADDRESS_138=
-CUSDC_V2_ADDRESS_138=
-CAUSDT_ADDRESS_138=0x5fdDF65733e3d590463F68f93Cf16E8c04081271
-CUSDW_ADDRESS_138=
-AUSDT_ADDRESS_651940=0x015B1897Ed5279930bC2Be46F661894d219292A6
-CAXAUC_ADDRESS_651940=
-CAXAUT_ADDRESS_651940=
-CWAXAUC_ADDRESS_651940=
-CWAXAUT_ADDRESS_651940=
-USDW_ADDRESS_25=
-# Optional: CMC "USD DWIN" native USDW (post-migration); canonical pins are config/token-mapping-multichain.json -> dwinUsdWinPublic
-USDW_DWIN_BSC=
-USDW_DWIN_POLYGON=
-CWAUSDT_ADDRESS_56=0xe1a51Bc037a79AB36767561B147eb41780124934
-CWAUSDT_ADDRESS_137=0xf12e262F85107df26741726b074606CaFa24AAe7
-CWAUSDT_ADDRESS_43114=0xff3084410A732231472Ee9f93F5855dA89CC5254
-CWAUSDT_ADDRESS_42220=0xC158b6cD3A3088C52F797D41f5Aa02825361629e
-CWUSDW_ADDRESS_56=
-CWUSDW_ADDRESS_137=
-CWUSDW_ADDRESS_43114=
-USDW_WRAP_VAULT_56=
-USDW_WRAP_VAULT_137=
-USDW_NATIVE_ADDRESS_56=
-USDW_NATIVE_ADDRESS_137=
-# Legacy wrapped-token aliases still seen in smom-dbis-138/.env and accepted by token-aggregation:
-CWUSDW_BSC=
-CWUSDW_AVALANCHE=
-
-# --- cW* bridge role grants (scripts/deployment/grant-cw-bridge-roles-on-chain.sh) ---
-# Optional: legacy gas price wei, or percent bump over cast gas-price (default 150). Mainnet/L2s need this when base fee spikes.
-# CW_GRANT_GAS_PRICE_WEI=
-# CW_GRANT_GAS_BUMP_PCT=150
-
-# --- WEMIX3.0 mainnet (chain id 1111) ---
-# Official RPC (HTTPS): https://docs.wemix.com/en/quick-start/start-node/use-public-api-server-rpc
-# Swap on-chain to native WEMIX for gas after assets are on 1111: https://wemix.fi/swap
-# No in-repo route for ETH/BNB/POL → WEMIX; see docs/03-deployment/WEMIX_ACQUISITION_TABLED.md
-WEMIX_RPC=https://api.wemix.com
-# WEMIX_MAINNET_RPC=   # alias also read by grant-cw-bridge-roles-on-chain.sh
-
-# --- GRU deployer funding gates (check-gru-v2-deployer-funding-status.sh, check-full-deployment-status.sh) ---
-# Arbitrum native balance must exceed this wei threshold or a funding blocker is raised. Set to 0 to skip (planning/CI only).
-# GRU_FUNDING_ARBITRUM_THRESHOLD_WEI=440872740000000000
-
-# --- GRU Transport / cW hard-peg bridge controls (Chain 138 -> public chains) ---
-# Canonical L1 bridge env used by the GRU transport overlay and token-aggregation.
-CHAIN138_L1_BRIDGE=
-# Legacy alias still used by some deployment helpers.
-CW_L1_BRIDGE_CHAIN138=
-CW_BRIDGE_MAINNET=
-CW_BRIDGE_CRONOS=
-CW_BRIDGE_BSC=
-CW_BRIDGE_POLYGON=
-CW_BRIDGE_GNOSIS=
-CW_BRIDGE_CELO=
-CW_BRIDGE_AVALANCHE=
-CW_BRIDGE_BASE=
-CW_BRIDGE_ARBITRUM=
-CW_BRIDGE_OPTIMISM=
-CW_BRIDGE_WEMIX=
-CW_RESERVE_VERIFIER_CHAIN138=
-CW_STABLECOIN_RESERVE_VAULT=
-CW_RESERVE_SYSTEM=
-CW_ATTACH_VERIFIER_TO_L1=1
-CW_REQUIRE_VAULT_BACKING=
-CW_REQUIRE_RESERVE_SYSTEM_BALANCE=
-CW_REQUIRE_TOKEN_OWNER_MATCH_VAULT=
-CW_CANONICAL_USDT=
-CW_CANONICAL_USDC=
-CW_USDT_RESERVE_ASSET=
-CW_USDC_RESERVE_ASSET=
-CW_MAX_OUTSTANDING_BTC_MAINNET=2100000000000000
-CW_MAX_OUTSTANDING_USDT_MAINNET=10000000000000
-CW_MAX_OUTSTANDING_USDC_MAINNET=10000000000000
-CW_MAX_OUTSTANDING_USDT_CRONOS=
-CW_MAX_OUTSTANDING_USDC_CRONOS=
-CW_MAX_OUTSTANDING_USDT_BSC=
-CW_MAX_OUTSTANDING_USDC_BSC=
-CW_MAX_OUTSTANDING_AUSDT_BSC=
-CW_MAX_OUTSTANDING_USDT_POLYGON=
-CW_MAX_OUTSTANDING_USDC_POLYGON=
-CW_MAX_OUTSTANDING_AUSDT_POLYGON=
-CW_MAX_OUTSTANDING_USDT_GNOSIS=
-CW_MAX_OUTSTANDING_USDC_GNOSIS=
-CW_MAX_OUTSTANDING_USDT_CELO=
-CW_MAX_OUTSTANDING_USDC_CELO=
-CW_MAX_OUTSTANDING_AUSDT_CELO=
-CW_MAX_OUTSTANDING_USDT_AVALANCHE=
-CW_MAX_OUTSTANDING_USDC_AVALANCHE=
-CW_MAX_OUTSTANDING_AUSDT_AVALANCHE=
-CW_MAX_OUTSTANDING_USDT_BASE=
-CW_MAX_OUTSTANDING_USDC_BASE=
-CW_MAX_OUTSTANDING_USDT_ARBITRUM=
-CW_MAX_OUTSTANDING_USDC_ARBITRUM=
-CW_MAX_OUTSTANDING_USDT_OPTIMISM=
-CW_MAX_OUTSTANDING_USDC_OPTIMISM=
-CW_MAX_OUTSTANDING_WEMIX_WEMIX=
-CW_FREEZE_AVAX_L2_CONFIG=
-
 # --- Alerts & monitoring ---
 SLACK_WEBHOOK_URL=
 PAGERDUTY_INTEGRATION_KEY=
@@ -463,17 +190,6 @@ EMAIL_ALERT_API_URL=
 EMAIL_ALERT_RECIPIENTS=
 SENTRY_DSN=
 
-# --- dbis_core IRU / marketplace outbound mail (optional; Proxmox Mail Proxy VMID 100 = 192.168.11.32) ---
-# EMAIL_PROVIDER=smtp
-# SMTP_HOST=192.168.11.32
-# SMTP_PORT=587
-# SMTP_SECURE=false
-# SMTP_USER=
-# SMTP_PASSWORD=
-# EMAIL_FROM=
-# EMAIL_FROM_NAME=SolaceNet
-# DBIS_SALES_EMAIL=
-
 # --- Legal / e-signature ---
 E_SIGNATURE_BASE_URL=
 
@@ -512,26 +228,6 @@ SANKOFA_PHOENIX_API_URL=
 SANKOFA_PHOENIX_CLIENT_ID=
 SANKOFA_PHOENIX_CLIENT_SECRET=
 SANKOFA_PHOENIX_TENANT_ID=
-# Corporate apex (sankofa.nexus) → CT 7806 when provisioned (default in ip-addresses stays portal until set)
-# IP_SANKOFA_PUBLIC_WEB=192.168.11.63
-
-# Optional consolidated hub (non-chain web + API path router). Defaults in ip-addresses.conf match discrete CTs until overridden.
-# IP_SANKOFA_WEB_HUB=
-# SANKOFA_WEB_HUB_PORT=80
-# IP_SANKOFA_PHOENIX_API_HUB=
-# SANKOFA_PHOENIX_API_HUB_PORT=8080
-# When API hub nginx is live on Phoenix CT (7800), LAN smoke: curl -sS http://${IP_SANKOFA_PHOENIX_API:-192.168.11.50}:8080/health
-# NPM fleet (phoenix.sankofa.nexus): set 8080 when Tier-1 API hub nginx is live (production); leave unset only for break-glass direct :4000.
-SANKOFA_NPM_PHOENIX_PORT=8080
-# Hub listen port for LAN smoke scripts (distinct from SANKOFA_PHOENIX_API_HUB_PORT / Apollo):
-# SANKOFA_API_HUB_LISTEN_PORT=8080
-# WebSocket upgrade smoke (curl HTTP 101): pnpm run verify:phoenix-graphql-wss
-# Optional second probe to hub on LAN: PHOENIX_WSS_INCLUDE_LAN=1 (needs load-project-env / IP_SANKOFA_PHOENIX_API)
-# Phoenix CT 7800 — bind Apollo to loopback after hub uses 127.0.0.1:4000: scripts/deployment/ensure-sankofa-phoenix-apollo-bind-loopback-7800.sh
-# LAN verify prefers hub :8080 when reachable; optional direct :4000 check: SANKOFA_VERIFY_PHOENIX_DIRECT_PORT=1
-# Optional if hub CT IP differs from IP_SANKOFA_PHOENIX_API:
-# IP_SANKOFA_NPM_PHOENIX_API=192.168.11.xx
-# dbis_core behind NPM (+ optional hub): set TRUST_PROXY=1 and TRUST_PROXY_HOPS (1 or 2) in dbis_core .env — see dbis_core/.env.example
 
 # --- Frontend / MetaMask / Explorer ---
 VITE_WALLETCONNECT_PROJECT_ID=
@@ -563,32 +259,6 @@ RPC_URL_138_FIREBLOCKS=
 WS_URL_138_FIREBLOCKS=
 CHAIN_ID_138=
 
-# --- PMM soak grid (6534 wallets; operator funding scripts) ---
-# Runbook: docs/11-references/CHAIN138_GRID_6534_WALLET_FUNDING_PLAN.md
-# Optional stable RPC for long runs (avoids LAN Core flaps during thousands of cast sends):
-# PMM_SOAK_RPC_URL_OVERRIDE=https://rpc-http-pub.d-bis.org
-# Full-grid resume orchestrator: start at this leg only (native|mint|cusdt|cusdc|mirr_usdt|mirr_usdc)
-# PMM_SOAK_START_LEG=
-# Skip native when every wallet already funded (max linear index is 6533; use 6534 to skip native):
-# PMM_SOAK_RESUME_NATIVE_FROM_LINEAR=
-# Per-chunk progress/ETA in pmm-soak-operator-fund-grid.sh (0 = quiet except final line per chunk):
-# PMM_SOAK_FUND_PROGRESS_EVERY=50
-# PMM_SOAK_FUND_CHUNK=250
-
-# --- @proxmox/economics-toolkit (path-check / exec broadcast; operator LAN only) ---
-# Validate checked-in strategy JSON: pnpm run economics:validate (optional: pip install check-jsonschema for schema pass)
-# Optional: same as PRIVATE_KEY for guarded swap broadcast (see packages/economics-toolkit/config/executor-allowlist.example.json).
-# ECONOMICS_EXEC_PRIVATE_KEY=
-# Set to 1 to broadcast after successful simulation (default is dry-run).
-# ECONOMICS_EXEC_APPLY=
-# POST JSON when path-check clears economics gate (optional).
-# ECONOMICS_ALERT_WEBHOOK=
-# Per-chain RPC override for economics-toolkit gas-quote: ECONOMICS_GAS_RPC_1=, ECONOMICS_GAS_RPC_56=, etc.
-# (Listed chain IDs are CR/LF-stripped when using scripts/lib/load-project-env.sh — same as RPC_URL_138.)
-# ECONOMICS_GAS_SKIP_USD=1   Skip CoinGecko; print native gas cost only
-# Optional: economics-toolkit gas-budget derives EOA from this if --address omitted (else PRIVATE_KEY)
-# ECONOMICS_GAS_BUDGET_PRIVATE_KEY=
-
 # --- Phoenix deploy API ---
 PORT=
 GITEA_TOKEN=

.gitea/CONTRIBUTING.md

@@ -6,6 +6,8 @@
 2. Make changes, ensure tests pass
 3. Open a pull request
 
+Repo ↔ VM CI/CD mapping and templates for **other** Gitea repos: [docs/04-configuration/GITEA_REPO_VM_CD_CI_MATRIX.md](../docs/04-configuration/GITEA_REPO_VM_CD_CI_MATRIX.md), [config/gitea-workflow-templates/README.md](../config/gitea-workflow-templates/README.md).
+
 Deploy workflow policy:
 `main` and `master` are both deploy-triggering branches, so `.gitea/workflow-sources/deploy-to-phoenix.yml` and `.gitea/workflow-sources/validate-on-pr.yml` must stay identical across both branches.
 Use `bash scripts/verify/sync-gitea-workflows.sh` after editing workflow-source files, and `bash scripts/verify/run-all-validation.sh --skip-genesis` to catch workflow drift before push.

.gitea/workflows/bootstrap-phoenix-deploy-api.yml

@@ -0,0 +1,210 @@
+name: Bootstrap Phoenix Deploy API
+
+# Reinstalls phoenix-deploy-api on the dev VM (CT 5700) with the latest server.js
+# from master. This is the missing link between "code on master is the real
+# implementation" and "running service on CT 5700 still has the stub". Run this
+# workflow_dispatch job whenever phoenix-deploy-api/server.js, deploy-targets.json
+# or related scripts change and you need the running service to pick up the change
+# without a manual LAN visit.
+#
+# Required Gitea repo secrets (Settings -> Secrets):
+#   PHOENIX_PVE_HOST       PVE node IP that hosts CT 5700 (e.g. 192.168.11.12)
+#   PHOENIX_PVE_USER       SSH user on the PVE node (default: root)
+#   PHOENIX_PVE_SSH_KEY    Private SSH key (PEM, OpenSSH format) authorised on the PVE node
+#   PHOENIX_PVE_KNOWN_HOSTS  Pre-populated known_hosts entry for the PVE node (avoids strict-host prompt)
+#   PHOENIX_DEV_VM_VMID    Container VMID (default: 5700)
+#   PHOENIX_DEPLOY_DEV_VM_IP  IP of the dev VM for the post-install health check (default: 192.168.11.59)
+#   PHOENIX_DEPLOY_URL     Phoenix deploy webhook URL (already used by deploy job)
+#   PHOENIX_DEPLOY_TOKEN   Bearer token for the webhook (already used by deploy job)
+#
+# Trigger only via Gitea UI (Actions tab -> "Bootstrap Phoenix Deploy API" -> Run
+# workflow). NOT triggered on push: reinstalling the deploy service is sensitive
+# enough that we want it gated behind a manual click.
+
+on:
+  workflow_dispatch:
+    inputs:
+      verify_only:
+        description: "If true, only run the post-install /health + auth probe and skip the reinstall step."
+        type: boolean
+        required: false
+        default: false
+
+jobs:
+  bootstrap:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout proxmox repo
+        uses: actions/checkout@v4
+
+      - name: Validate repo layout
+        run: |
+          set -euo pipefail
+          test -d phoenix-deploy-api || { echo "phoenix-deploy-api/ missing" >&2; exit 1; }
+          test -f phoenix-deploy-api/server.js
+          test -f phoenix-deploy-api/scripts/install-systemd.sh
+          test -f phoenix-deploy-api/deploy-targets.json
+          # Manifest is optional; warn if missing but do not fail.
+          if [ ! -f config/public-sector-program-manifest.json ]; then
+            echo "::warning::config/public-sector-program-manifest.json missing — install will warn on CT"
+          fi
+          # Make sure the running master implementation is NOT the stub message
+          # that triggered this whole bootstrap thread.
+          if grep -q "Deploy request queued (stub)" phoenix-deploy-api/server.js; then
+            echo "phoenix-deploy-api/server.js still contains the stub string — refusing to bootstrap." >&2
+            exit 1
+          fi
+
+      - name: Install SSH key for PVE access
+        if: ${{ github.event.inputs.verify_only != 'true' }}
+        run: |
+          set -euo pipefail
+          mkdir -p "$HOME/.ssh"
+          chmod 700 "$HOME/.ssh"
+          umask 077
+          printf '%s\n' "${{ secrets.PHOENIX_PVE_SSH_KEY }}" > "$HOME/.ssh/id_pve"
+          chmod 600 "$HOME/.ssh/id_pve"
+          if [ -n "${{ secrets.PHOENIX_PVE_KNOWN_HOSTS }}" ]; then
+            printf '%s\n' "${{ secrets.PHOENIX_PVE_KNOWN_HOSTS }}" > "$HOME/.ssh/known_hosts"
+            chmod 644 "$HOME/.ssh/known_hosts"
+          else
+            # Fall back to accept-new on first connect; subsequent connects pin.
+            touch "$HOME/.ssh/known_hosts"
+            chmod 644 "$HOME/.ssh/known_hosts"
+          fi
+
+      - name: Build deploy bundle
+        if: ${{ github.event.inputs.verify_only != 'true' }}
+        run: |
+          set -euo pipefail
+          mkdir -p .out
+          if [ -f config/public-sector-program-manifest.json ]; then
+            tar czf .out/pda-deploy-bundle.tar.gz \
+              phoenix-deploy-api \
+              config/public-sector-program-manifest.json
+          else
+            tar czf .out/pda-deploy-bundle.tar.gz phoenix-deploy-api
+          fi
+          ls -lh .out/pda-deploy-bundle.tar.gz
+
+      - name: scp bundle to PVE host
+        if: ${{ github.event.inputs.verify_only != 'true' }}
+        env:
+          PVE_HOST: ${{ secrets.PHOENIX_PVE_HOST }}
+          PVE_USER: ${{ secrets.PHOENIX_PVE_USER }}
+        run: |
+          set -euo pipefail
+          : "${PVE_HOST:?PHOENIX_PVE_HOST not set in repo secrets}"
+          PVE_USER_VAL="${PVE_USER:-root}"
+          KNOWN_HOSTS_OPT="-o UserKnownHostsFile=$HOME/.ssh/known_hosts"
+          if [ ! -s "$HOME/.ssh/known_hosts" ]; then
+            KNOWN_HOSTS_OPT="$KNOWN_HOSTS_OPT -o StrictHostKeyChecking=accept-new"
+          else
+            KNOWN_HOSTS_OPT="$KNOWN_HOSTS_OPT -o StrictHostKeyChecking=yes"
+          fi
+          scp -i "$HOME/.ssh/id_pve" $KNOWN_HOSTS_OPT \
+            -o ConnectTimeout=20 \
+            .out/pda-deploy-bundle.tar.gz \
+            "${PVE_USER_VAL}@${PVE_HOST}:/tmp/pda-deploy-bundle.tar.gz"
+
+      - name: pct push + install-systemd on CT
+        if: ${{ github.event.inputs.verify_only != 'true' }}
+        env:
+          PVE_HOST: ${{ secrets.PHOENIX_PVE_HOST }}
+          PVE_USER: ${{ secrets.PHOENIX_PVE_USER }}
+          VMID: ${{ secrets.PHOENIX_DEV_VM_VMID }}
+        run: |
+          set -euo pipefail
+          : "${PVE_HOST:?PHOENIX_PVE_HOST not set in repo secrets}"
+          PVE_USER_VAL="${PVE_USER:-root}"
+          VMID_VAL="${VMID:-5700}"
+          KNOWN_HOSTS_OPT="-o UserKnownHostsFile=$HOME/.ssh/known_hosts"
+          if [ ! -s "$HOME/.ssh/known_hosts" ]; then
+            KNOWN_HOSTS_OPT="$KNOWN_HOSTS_OPT -o StrictHostKeyChecking=accept-new"
+          else
+            KNOWN_HOSTS_OPT="$KNOWN_HOSTS_OPT -o StrictHostKeyChecking=yes"
+          fi
+          ssh -i "$HOME/.ssh/id_pve" $KNOWN_HOSTS_OPT \
+            -o ConnectTimeout=20 \
+            "${PVE_USER_VAL}@${PVE_HOST}" "VMID=${VMID_VAL} bash -s" <<'REMOTE_EOF'
+          set -euo pipefail
+          : "${VMID:?}"
+          # Verify CT exists and is running.
+          if ! pct status "${VMID}" >/dev/null 2>&1; then
+            echo "CT ${VMID} not found on this PVE node." >&2
+            exit 1
+          fi
+          if ! pct exec "${VMID}" -- true 2>/dev/null; then
+            echo "CT ${VMID} not running. Start it first: pct start ${VMID}" >&2
+            exit 1
+          fi
+          STAGE="/tmp/proxmox-pda-stage"
+          pct push "${VMID}" /tmp/pda-deploy-bundle.tar.gz /root/pda-deploy.tar.gz
+          pct exec "${VMID}" -- bash -c "
+            set -euo pipefail
+            rm -rf '${STAGE}'
+            mkdir -p '${STAGE}'
+            tar xzf /root/pda-deploy.tar.gz -C '${STAGE}'
+            cd '${STAGE}'
+            bash phoenix-deploy-api/scripts/install-systemd.sh
+            rm -f /root/pda-deploy.tar.gz
+          "
+          rm -f /tmp/pda-deploy-bundle.tar.gz
+          REMOTE_EOF
+
+      - name: Health check (no auth)
+        env:
+          DEV_VM_IP: ${{ secrets.PHOENIX_DEPLOY_DEV_VM_IP }}
+        run: |
+          set -euo pipefail
+          IP="${DEV_VM_IP:-192.168.11.59}"
+          # Service may take a moment to come up after install; retry briefly.
+          for i in 1 2 3 4 5 6; do
+            if curl -sSf -m 5 "http://${IP}:4001/health" -o /tmp/health.json; then
+              echo "Health check OK on attempt ${i}"
+              cat /tmp/health.json || true
+              echo
+              break
+            fi
+            echo "Health check attempt ${i}/6 failed; sleeping 3s"
+            sleep 3
+            if [ "${i}" = "6" ]; then
+              echo "Phoenix Deploy API /health unreachable after install." >&2
+              exit 1
+            fi
+          done
+
+      - name: Auth + non-stub probe (POST with bogus target)
+        env:
+          PHOENIX_DEPLOY_URL: ${{ secrets.PHOENIX_DEPLOY_URL }}
+          PHOENIX_DEPLOY_TOKEN: ${{ secrets.PHOENIX_DEPLOY_TOKEN }}
+        run: |
+          set -euo pipefail
+          : "${PHOENIX_DEPLOY_URL:?}"
+          : "${PHOENIX_DEPLOY_TOKEN:?}"
+          # POST a bogus target. The post-bootstrap server should:
+          #   - accept the bearer token (NOT 401)
+          #   - reject the unknown target with a non-stub error
+          # The pre-bootstrap stub returned 202 with "Deploy request queued (stub)"
+          # for ANY target. So we explicitly check the response body does NOT
+          # contain that stub phrase.
+          BODY="$(curl -sS -m 10 -X POST "${PHOENIX_DEPLOY_URL}" \
+            -H "Authorization: Bearer ${PHOENIX_DEPLOY_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"repo":"d-bis/proxmox","sha":"HEAD","branch":"master","target":"__bootstrap_probe__"}' || true)"
+          echo "Response body:"
+          echo "${BODY}"
+          if echo "${BODY}" | grep -q 'Deploy request queued (stub)'; then
+            echo "::error::Phoenix Deploy API still returning stub response — bootstrap did not take effect."
+            exit 1
+          fi
+          if echo "${BODY}" | grep -qi 'unauthorized\|invalid token\|401'; then
+            echo "::error::Phoenix Deploy API rejected the bearer token. PHOENIX_DEPLOY_TOKEN is out of sync with PHOENIX_DEPLOY_SECRET on the CT."
+            exit 1
+          fi
+          echo "Phoenix Deploy API is post-stub and authenticating correctly."
+
+      - name: Cleanup secrets
+        if: always()
+        run: |
+          rm -f "$HOME/.ssh/id_pve" "$HOME/.ssh/known_hosts" || true

.gitea/workflows/deploy-portal-live.yml

@@ -0,0 +1,31 @@
+name: Deploy Sankofa Portal Live
+
+on:
+  workflow_dispatch:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run repo validation gate
+        run: |
+          bash scripts/verify/run-all-validation.sh --skip-genesis
+
+  deploy:
+    needs: validate
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Trigger portal-live deployment
+        run: |
+          SHA="$(git rev-parse HEAD)"
+          BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+          curl -sSf -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
+            -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "{\"repo\":\"${{ gitea.repository }}\",\"sha\":\"${SHA}\",\"branch\":\"${BRANCH}\",\"target\":\"portal-live\"}"

.gitea/workflows/live-inventory-hardware-weekly.yml

@@ -1,30 +0,0 @@
-# Weekly: hardware poll + live inventory / drift export → artifacts.
-# GitHub: see .github/workflows/live-inventory-drift.yml
-# Gitea: use a LAN self-hosted runner with label [lan] for live Proxmox reachability;
-#        ubuntu-latest will usually produce seed_unreachable (still uploads JSON).
-name: Live inventory + hardware poll (weekly)
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '20 7 * * 1'
-
-jobs:
-  inventory-and-hardware:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Poll Proxmox cluster hardware (LAN optional)
-        run: bash scripts/verify/poll-proxmox-cluster-hardware.sh
-        continue-on-error: true
-
-      - name: Export live inventory and IPAM drift
-        run: bash scripts/it-ops/export-live-inventory-and-drift.sh
-        continue-on-error: true
-
-      - name: Summarize reports/status (commit artifacts on LAN runner if needed)
-        if: always()
-        run: |
-          ls -la reports/status/ 2>/dev/null || true
-          test -f reports/status/drift.json && head -c 400 reports/status/drift.json || true

.github/workflows/dbis-core-gateway-ci.yml

@@ -1,55 +0,0 @@
-# Gateway rails unit + HTTP integration tests (dbis_core submodule)
-name: dbis-core-gateway-ci
-
-on:
-  push:
-    paths:
-      - 'dbis_core/package.json'
-      - 'dbis_core/package-lock.json'
-      - 'dbis_core/jest.config.js'
-      - 'dbis_core/jest.gateway-http.config.js'
-      - 'dbis_core/src/core/gateway/**'
-      - 'dbis_core/src/workers/gateway-outbox.worker.ts'
-      - 'dbis_core/src/workers/run-gateway-outbox-worker.ts'
-      - 'dbis_core/src/__tests__/unit/core/gateway/**'
-      - 'dbis_core/src/__tests__/integration/api/gateway-rails-http.integration.test.ts'
-      - 'dbis_core/src/__tests__/gateway-http-env-setup.ts'
-      - 'dbis_core/src/__tests__/utils/gateway-http-test-app.ts'
-      - '.github/workflows/dbis-core-gateway-ci.yml'
-  pull_request:
-    paths:
-      - 'dbis_core/package.json'
-      - 'dbis_core/package-lock.json'
-      - 'dbis_core/jest.config.js'
-      - 'dbis_core/jest.gateway-http.config.js'
-      - 'dbis_core/src/core/gateway/**'
-      - 'dbis_core/src/workers/gateway-outbox.worker.ts'
-      - 'dbis_core/src/workers/run-gateway-outbox-worker.ts'
-      - 'dbis_core/src/__tests__/unit/core/gateway/**'
-      - 'dbis_core/src/__tests__/integration/api/gateway-rails-http.integration.test.ts'
-      - 'dbis_core/src/__tests__/gateway-http-env-setup.ts'
-      - 'dbis_core/src/__tests__/utils/gateway-http-test-app.ts'
-      - '.github/workflows/dbis-core-gateway-ci.yml'
-
-defaults:
-  run:
-    working-directory: dbis_core
-
-jobs:
-  test-gateway:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'npm'
-          cache-dependency-path: dbis_core/package-lock.json
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Gateway tests (unit + integration)
-        run: npm run test:gateway

.github/workflows/economics-toolkit.yml

@@ -1,42 +0,0 @@
-# Unit tests for packages/economics-toolkit (no live RPC required).
-name: economics-toolkit
-
-on:
-  push:
-    paths:
-      - "packages/economics-toolkit/**"
-      - "pnpm-workspace.yaml"
-      - "package.json"
-      - "scripts/economics/**"
-      - "scripts/validation/validate-economics-strategy-json.sh"
-      - "AGENTS.md"
-      - ".github/workflows/economics-toolkit.yml"
-  pull_request:
-    paths:
-      - "packages/economics-toolkit/**"
-      - "pnpm-workspace.yaml"
-      - "package.json"
-      - "scripts/economics/**"
-      - "scripts/validation/validate-economics-strategy-json.sh"
-      - "AGENTS.md"
-      - ".github/workflows/economics-toolkit.yml"
-  workflow_dispatch: {}
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 10
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-          cache: "pnpm"
-      - name: Install
-        run: pnpm install
-      - name: Test economics-toolkit
-        run: pnpm run economics:test
-      - name: Validate strategy JSON (smoke + template)
-        run: pnpm run economics:validate

.github/workflows/info-defi-oracle-138.yml

@@ -1,43 +0,0 @@
-# Build Chain 138 info hub SPA when its package or workspace lockfile changes.
-name: info-defi-oracle-138
-
-on:
-  pull_request:
-    paths:
-      - 'info-defi-oracle-138/**'
-      - 'pnpm-lock.yaml'
-      - 'pnpm-workspace.yaml'
-      - '.github/workflows/info-defi-oracle-138.yml'
-  push:
-    branches: [main, master]
-    paths:
-      - 'info-defi-oracle-138/**'
-      - 'pnpm-lock.yaml'
-      - 'pnpm-workspace.yaml'
-      - '.github/workflows/info-defi-oracle-138.yml'
-
-jobs:
-  build:
-    name: Typecheck & Vite build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'pnpm'
-          cache-dependency-path: pnpm-lock.yaml
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Build info-defi-oracle-138
-        run: pnpm --filter info-defi-oracle-138 build

.github/workflows/live-inventory-drift.yml

@@ -1,29 +0,0 @@
-# Live Proxmox guest inventory + drift vs config/ip-addresses.conf.
-# GitHub-hosted runners usually cannot reach 192.168.11.x; workflow still produces
-# drift.json with seed_unreachable. Use a self-hosted LAN runner or run locally:
-#   bash scripts/it-ops/export-live-inventory-and-drift.sh
-name: Live inventory and IPAM drift
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '25 6 * * 1'
-
-jobs:
-  drift:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Export live inventory (LAN optional)
-        run: bash scripts/it-ops/export-live-inventory-and-drift.sh
-        continue-on-error: true
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: live-inventory-drift
-          path: |
-            reports/status/live_inventory.json
-            reports/status/drift.json

.github/workflows/pmm-soak-grid-smoke.yml

@@ -1,46 +0,0 @@
-# Dry-run PMM soak helpers: export, fund-grid plan, grid + single-wallet quote ticks (read-only RPC).
-name: PMM soak grid smoke
-
-on:
-  pull_request:
-    paths:
-      - 'scripts/deployment/pmm-soak*.sh'
-      - 'scripts/deployment/chain138-pmm*.sh'
-      - 'scripts/deployment/pmm-soak-grid-smoke-check.sh'
-      - 'scripts/lib/pmm-soak*.sh'
-      - 'scripts/lib/pmm-soak-dotenv-override.sh'
-      - 'scripts/deployment/pmm-soak-export-wallet-grid.py'
-      - 'config/pmm-soak-pools-stable.txt'
-      - 'config/pmm-soak-wallet-grid.example.json'
-      - '.github/workflows/pmm-soak-grid-smoke.yml'
-  push:
-    branches: [main, master]
-    paths:
-      - 'scripts/deployment/pmm-soak*.sh'
-      - 'scripts/deployment/chain138-pmm*.sh'
-      - 'scripts/deployment/pmm-soak-grid-smoke-check.sh'
-      - 'scripts/lib/pmm-soak*.sh'
-      - 'scripts/lib/pmm-soak-dotenv-override.sh'
-      - 'scripts/deployment/pmm-soak-export-wallet-grid.py'
-      - 'config/pmm-soak-pools-stable.txt'
-      - 'config/pmm-soak-wallet-grid.example.json'
-      - '.github/workflows/pmm-soak-grid-smoke.yml'
-
-jobs:
-  smoke:
-    name: Grid smoke (dry-run, public RPC)
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install Foundry (cast)
-        uses: foundry-rs/foundry-toolchain@v1
-
-      - name: Install bc
-        run: sudo apt-get update -qq && sudo apt-get install -y bc
-
-      - name: PMM soak grid smoke
-        env:
-          CI: "true"
-        run: bash scripts/deployment/pmm-soak-grid-smoke-check.sh

.github/workflows/validate-config.yml

@@ -6,103 +6,19 @@ on:
     paths:
       - 'config/**'
       - 'scripts/validation/**'
-      - 'scripts/jvmtm/**'
-      - 'scripts/omnl/build-omnl-e2e-settlement-audit-archive.sh'
-      - 'scripts/verify/sync-blockscout-address-labels-from-registry.sh'
-      - 'explorer-monorepo/scripts/generate-topology-graph.sh'
-      - 'explorer-monorepo/frontend/public/config/topology-graph.json'
       - 'scripts/verify/run-all-validation.sh'
-      - 'scripts/verify/verify-end-to-end-routing.sh'
       - 'scripts/run-completable-tasks-from-anywhere.sh'
-      - 'scripts/run-operator-tasks-from-lan.sh'
-      - 'scripts/run-all-operator-tasks-from-lan.sh'
-      - 'scripts/run-full-operator-completion-from-lan.sh'
-      - 'scripts/verify/check-info-defi-oracle-public.sh'
-      - 'scripts/verify/check-completion-status.sh'
-      - 'scripts/verify/check-chain138-rpc-health.sh'
-      - 'scripts/verify/check-chain138-rpc-nonce-gas-parity.sh'
-      - 'scripts/verify/self-test-chain138-rpc-verify.sh'
-      - 'scripts/lib/chain138-lan-rpc-inventory.sh'
-      - 'scripts/monitoring/monitor-blockchain-health.sh'
-      - 'scripts/clear-all-transaction-pools.sh'
       - '.github/workflows/validate-config.yml'
-      - '.github/workflows/verify-info-defi-oracle-public.yml'
       - 'token-lists/**'
       - 'explorer-monorepo/backend/api/rest/config/metamask/**'
-      - 'docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md'
-      - 'docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md'
-      - 'config/jvmtm-regulatory-closure/INAAUDJVMTM_2025_AUDIT_CLOSURE_MATRIX.md'
-      - 'docs/04-configuration/SMART_CONTRACTS_ISO20022_FIN_METHODOLOGY.md'
-      - 'docs/dbis-rail/ISO_GATEWAY_AND_RELAYER_SPEC.md'
-      - 'scripts/deployment/pmm-soak*.sh'
-      - 'scripts/deployment/chain138-pmm*.sh'
-      - 'scripts/lib/pmm-soak*.sh'
-      - 'scripts/deployment/pmm-soak-export-wallet-grid.py'
-      - '.github/workflows/pmm-soak-grid-smoke.yml'
-      - 'docs/11-references/CHAIN138_GRID_6534_WALLET_FUNDING_PLAN.md'
-      - 'docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md'
-      - 'docs/04-configuration/GRU_C_STAR_V2_STANDARDS_MATRIX_AND_IMPLEMENTATION_PLAN.md'
-      - 'scripts/verify/check-gru-reference-primacy-integration.sh'
-      - 'cross-chain-pmm-lps/config/peg-bands.json'
-      - 'cross-chain-pmm-lps/docs/04-bot-policy.md'
-      - 'cross-chain-pmm-lps/docs/05-oracles.md'
-      - 'docs/00-meta/SUBMODULE_HYGIENE.md'
-      - 'docs/00-meta/NEXT_STEPS_LIST.md'
-      - 'docs/00-meta/OPERATOR_READY_CHECKLIST.md'
-      - 'docs/11-references/GRU_V2_PUBLIC_PROTOCOL_DEPLOYMENT_STATUS.md'
-      - '.cursor/rules/chain138-tokens-and-pmm.mdc'
-      - 'scripts/run-completable-tasks-from-anywhere.sh'
   push:
-    branches: [master, main]
+    branches: [master]
     paths:
       - 'config/**'
       - 'scripts/validation/**'
-      - 'scripts/jvmtm/**'
-      - 'scripts/omnl/build-omnl-e2e-settlement-audit-archive.sh'
-      - 'scripts/verify/sync-blockscout-address-labels-from-registry.sh'
-      - 'explorer-monorepo/scripts/generate-topology-graph.sh'
-      - 'explorer-monorepo/frontend/public/config/topology-graph.json'
-      - 'scripts/verify/run-all-validation.sh'
-      - 'scripts/verify/verify-end-to-end-routing.sh'
-      - 'scripts/run-completable-tasks-from-anywhere.sh'
-      - 'scripts/run-operator-tasks-from-lan.sh'
-      - 'scripts/run-all-operator-tasks-from-lan.sh'
-      - 'scripts/run-full-operator-completion-from-lan.sh'
-      - 'scripts/verify/check-info-defi-oracle-public.sh'
-      - 'scripts/verify/check-completion-status.sh'
-      - 'scripts/verify/check-chain138-rpc-health.sh'
-      - 'scripts/verify/check-chain138-rpc-nonce-gas-parity.sh'
-      - 'scripts/verify/self-test-chain138-rpc-verify.sh'
-      - 'scripts/lib/chain138-lan-rpc-inventory.sh'
-      - 'scripts/monitoring/monitor-blockchain-health.sh'
-      - 'scripts/clear-all-transaction-pools.sh'
       - '.github/workflows/validate-config.yml'
-      - '.github/workflows/verify-info-defi-oracle-public.yml'
       - 'token-lists/**'
       - 'explorer-monorepo/backend/api/rest/config/metamask/**'
-      - 'docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md'
-      - 'docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md'
-      - 'config/jvmtm-regulatory-closure/INAAUDJVMTM_2025_AUDIT_CLOSURE_MATRIX.md'
-      - 'docs/04-configuration/SMART_CONTRACTS_ISO20022_FIN_METHODOLOGY.md'
-      - 'docs/dbis-rail/ISO_GATEWAY_AND_RELAYER_SPEC.md'
-      - 'scripts/deployment/pmm-soak*.sh'
-      - 'scripts/deployment/chain138-pmm*.sh'
-      - 'scripts/lib/pmm-soak*.sh'
-      - 'scripts/deployment/pmm-soak-export-wallet-grid.py'
-      - '.github/workflows/pmm-soak-grid-smoke.yml'
-      - 'docs/11-references/CHAIN138_GRID_6534_WALLET_FUNDING_PLAN.md'
-      - 'docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md'
-      - 'docs/04-configuration/GRU_C_STAR_V2_STANDARDS_MATRIX_AND_IMPLEMENTATION_PLAN.md'
-      - 'scripts/verify/check-gru-reference-primacy-integration.sh'
-      - 'cross-chain-pmm-lps/config/peg-bands.json'
-      - 'cross-chain-pmm-lps/docs/04-bot-policy.md'
-      - 'cross-chain-pmm-lps/docs/05-oracles.md'
-      - 'docs/00-meta/SUBMODULE_HYGIENE.md'
-      - 'docs/00-meta/NEXT_STEPS_LIST.md'
-      - 'docs/00-meta/OPERATOR_READY_CHECKLIST.md'
-      - 'docs/11-references/GRU_V2_PUBLIC_PROTOCOL_DEPLOYMENT_STATUS.md'
-      - '.cursor/rules/chain138-tokens-and-pmm.mdc'
-      - 'scripts/run-completable-tasks-from-anywhere.sh'
 
 jobs:
   validate:
@@ -112,67 +28,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 9
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          cache: 'pnpm'
-
-      - name: Install workspace dependencies
-        run: pnpm install --frozen-lockfile
-
       - name: Config validation
         run: bash scripts/validation/validate-config-files.sh
 
-      - name: DBIS institutional JSON Schemas
-        run: |
-          python3 -m pip install check-jsonschema
-          SCHEMA_STRICT=1 bash scripts/validation/validate-dbis-institutional-schemas.sh
-
-      - name: JVMTM regulatory closure JSON Schemas
-        run: |
-          python3 -m pip install check-jsonschema
-          SCHEMA_STRICT=1 bash scripts/validation/validate-jvmtm-regulatory-closure-schemas.sh
-
-      - name: Reserve provenance package (3FR attestation JSON)
-        run: |
-          python3 -m pip install check-jsonschema
-          SCHEMA_STRICT=1 bash scripts/validation/validate-reserve-provenance-package.sh
-
       - name: Completable tasks (dry-run)
         run: bash scripts/run-completable-tasks-from-anywhere.sh --dry-run
 
-      - name: Chain 138 RPC verify scripts (syntax + offline parity)
-        run: bash scripts/verify/self-test-chain138-rpc-verify.sh
-
-      - name: Explorer topology graph (regenerate + diff check)
-        run: |
-          bash explorer-monorepo/scripts/generate-topology-graph.sh
-          git diff --exit-code explorer-monorepo/frontend/public/config/topology-graph.json
-
-      - name: ShellCheck (PMM soak grid scripts)
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y shellcheck
-          set -euo pipefail
-          shells=(
-            scripts/deployment/pmm-soak-operator-fund-grid.sh
-            scripts/deployment/pmm-soak-complete-grid-funding-operator.sh
-            scripts/deployment/pmm-soak-operator-fund-full-grid-tranches.sh
-            scripts/deployment/pmm-soak-mint-mirror-usdc-deployer-shortfall.sh
-            scripts/deployment/pmm-soak-complete-operator-bootstrap.sh
-            scripts/deployment/pmm-soak-grid-smoke-check.sh
-            scripts/lib/pmm-soak-dotenv-override.sh
-            scripts/lib/pmm-soak-pools.sh
-            scripts/lib/pmm-soak-chain138-tick.sh
-            scripts/deployment/chain138-pmm-random-soak-swaps.sh
-            scripts/deployment/chain138-pmm-soak-grid-bot.sh
-            scripts/verify/check-gru-reference-primacy-integration.sh
-          )
-          shellcheck -x "${shells[@]}"
-
       - name: Shellcheck (optional)
         run: bash scripts/verify/run-shellcheck.sh --optional

.github/workflows/validate-sankofa-nginx-examples.yml

@@ -1,25 +0,0 @@
-# nginx -t on Sankofa consolidated example configs (no LAN).
-name: Validate Sankofa nginx examples
-
-on:
-  pull_request:
-    paths:
-      - 'config/nginx/sankofa-*.example.conf'
-      - 'config/nginx/sankofa-*-main.example.conf'
-      - 'scripts/verify/check-sankofa-consolidated-nginx-examples.sh'
-      - '.github/workflows/validate-sankofa-nginx-examples.yml'
-  push:
-    branches: [main, master]
-    paths:
-      - 'config/nginx/sankofa-*.example.conf'
-      - 'config/nginx/sankofa-*-main.example.conf'
-      - 'scripts/verify/check-sankofa-consolidated-nginx-examples.sh'
-      - '.github/workflows/validate-sankofa-nginx-examples.yml'
-
-jobs:
-  nginx-syntax:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: nginx -t (host or Docker)
-        run: bash scripts/verify/check-sankofa-consolidated-nginx-examples.sh

.github/workflows/verify-info-defi-oracle-public.yml

@@ -1,44 +0,0 @@
-# Smoke-test the public Chain 138 info hub (HTTPS + agent files + same-origin token-aggregation JSON).
-# No secrets. May fail if the public edge or origin is down — inspect logs and runbook.
-name: Verify info.defi-oracle.io (public)
-
-on:
-  pull_request:
-    paths:
-      - 'scripts/verify/check-info-defi-oracle-public.sh'
-      - 'scripts/verify/playwright-audit-info-defi-oracle.mjs'
-      - 'info-defi-oracle-138/**'
-      - '.github/workflows/verify-info-defi-oracle-public.yml'
-  workflow_dispatch:
-    inputs:
-      info_site_base:
-        description: 'Optional INFO_SITE_BASE (staging). Leave empty to use repo variable or default https://info.defi-oracle.io'
-        required: false
-        type: string
-        default: ''
-  schedule:
-    - cron: '35 14 * * 1' # Mondays 14:35 UTC (~ weekly)
-
-jobs:
-  verify:
-    name: check-info-defi-oracle-public.sh
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install jq
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y -qq jq
-
-      - name: Public info site + token-aggregation
-        shell: bash
-        env:
-          INPUT_BASE: ${{ github.event.inputs.info_site_base }}
-          VAR_BASE: ${{ vars.INFO_SITE_BASE }}
-        run: |
-          set -euo pipefail
-          if [ -n "${INPUT_BASE}" ]; then export INFO_SITE_BASE="${INPUT_BASE}"; fi
-          if [ -z "${INFO_SITE_BASE:-}" ] && [ -n "${VAR_BASE}" ]; then export INFO_SITE_BASE="${VAR_BASE}"; fi
-          bash scripts/verify/check-info-defi-oracle-public.sh

.gitignore

@@ -1,6 +1,3 @@
-# Nested clone (not a declared submodule; use submodule add if it should be tracked)
-transaction-composer/
-
 # Dependencies
 node_modules/
 .pnpm-store/
@@ -9,20 +6,10 @@ node_modules/
 package-lock.json
 yarn.lock
 
-# DBIS identity package — never commit real secrets (example only is tracked)
-config/production/dbis-identity-public-did-secrets.env
-
-# Local executor allowlist (copy from executor-allowlist.example.json)
-packages/economics-toolkit/config/executor-allowlist.json
-
-# PMM soak grid (addresses tied to a real mnemonic — generate locally)
-config/pmm-soak-wallet-grid.json
-
 # Environment files
 .env
 .env.local
 .env.*.local
-.env.keeper.local
 .env.master
 
 # Logs
@@ -39,18 +26,8 @@ Thumbs.db
 # Local-only Cursor session / context (exclude from Gitea)
 .cursor/local/
 
-# Local Codex / IDE artifacts
-.codex
-.codex/
-
-# Scratch and regenerated audit trees (re-run OMNL/JVMTM scripts to reproduce)
-tmp/
-output/jvmtm-evidence/
-output/settlement-events/
-output/omnl-e2e-settlement-audit-*/
-output/*compliance-archive*.zip
-output/omnl-e2e-settlement-audit-*.zip
-output/transaction-package-HYBX-BATCH-001/
+# Devin for Terminal personal overrides / secrets
+.devin/config.local.json
 
 # IDE files
 .vscode/
@@ -77,13 +54,11 @@ out/
 
 # Python
 venv/
-.venv-checkjson/
 __pycache__/
 *.pyc
 
 # CoinGecko/CMC token logos (generated by prepare-token-logos-512x512.sh)
 docs/04-configuration/coingecko/logos/*.png
-token-lists/logos/*.png
 
 # Ephemeral phase markers
 .phase1-event-status
@@ -91,18 +66,6 @@ token-lists/logos/*.png
 # DBIS Phase 1 discovery — timestamped reports (run scripts/verify/run-phase1-discovery.sh)
 reports/phase1-discovery/phase1-discovery-*.md
 
-# Timestamped infra inventory/status exports (source-of-truth files stay tracked)
-reports/status/drift_*.json
-reports/status/live_inventory_*.json
-reports/status/hardware_poll_*.txt
-reports/status/lxc_cluster_health_*.json
-reports/status/lxc_cluster_health_*.txt
-
-# Wormhole AI docs mirror (sync with scripts/doc/sync-wormhole-ai-resources.sh; keep manifest.json committable)
-third-party/wormhole-ai-docs/**
-!third-party/wormhole-ai-docs/README.md
-!third-party/wormhole-ai-docs/manifest.json
-
 # OMNL operator rail (env-specific IDs, reconciliation, audit packets, posted refs)
 ids.env
 reconciliation/
@@ -115,14 +78,83 @@ reconciliation/
 *.payload.sha256
 audit_log.jsonl
 
-# Local publish / clone trees (nested git repos; not submodules)
+# cross-chain-pmm-lps-publish: git worktree under that repo — not a parent submodule
 cross-chain-pmm-lps-publish/
+
+# Local scratch (never commit)
+.tmp-*.cjs
+.codex
+.codex/
+.venv-checkjson/
+.env.bak.pmg.*
+
+# Teammate / third-party onboarding (API token handoffs; never commit)
+reports/secrets/
+
+# Operator / runtime env snapshots under reports/ (sensitive; regenerate from hosts)
+reports/status/operator-*.env
+reports/status/operator-runtime*.env
+reports/status/chain138_aave_runtime.env
+reports/status/*runtime-env*.env
+reports/status/ei-matrix-eth-send*
+reports/status/token-aggregation-*.tar.gz
+config/production/*did-secrets.env
+
+# Bulky one-off local outputs (re-run scripts to restore)
+output/omnl-e2e-*.zip
+output/omnl-e2e-*/
+output/office22-*.zip
+output/settlement-events/
+output/transaction-package-*/
+output/cw-assets-usd-quote-dump.json
+output/jvmtm-evidence/
+
+# Generated verification evidence snapshots (keep curated evidence, ignore rerunnable timestamped dumps)
+docs/04-configuration/verification-evidence/e2e-verification-*/
+
+# Generated deployment and inventory machine outputs
+reports/deployment/*_20[0-9][0-9]-[0-9][0-9]-[0-9][0-9].md
+reports/deployment/check-deployer-lp-balances-*.json
+reports/inventory/container_inventory_*.csv
+reports/inventory/contract-inventory-*.json
+reports/inventory/DEPLOYED_CONTRACTS_*.md
+reports/inventory/INCOMPLETE_DUPLICATE_ANALYSIS.md
+reports/inventory/INVENTORY_COVERAGE_GAPS.md
+reports/inventory/deployed-contracts-completion-matrix.json
+reports/inventory/incomplete-duplicate-bytecode-analysis.json
+
+# Generated status artifacts (rerunnable from wrappers/validation scripts)
+reports/status/MULTI_NETWORK_DEPLOYMENT_AUDIT_*.md
+reports/status/*-latest.json
+reports/status/*-latest.md
+reports/status/*-latest.csv
+reports/status/hardware_poll_*.txt
+reports/status/lxc_cluster_health_*.json
+reports/status/lxc_cluster_health_*.txt
+reports/status/mainnet-cwusdc-usdc-preflight-*.json
+reports/status/mainnet-cwusdc-usdc-repeg-plan-*.json
+reports/status/live_inventory_*.json
+reports/status/drift_*.json
+
+# Ephemeral e2e dry-run outputs (local re-runs; not canonical reports)
+reports/e2e-dry-runs/
+
+# Local relay / thirdweb scaffold trees (subtree or vendor experiments — git add -f if promoted)
+relay/
+relay-api/
+relay-docs/
+relay-web/
+thirdweb-contracts/
+
+# One-off liquidity staging helpers (operator-generated; use committed runbooks as source of truth)
+scripts/verify/stage-250m-eth-to-cwusdc-dry-run.sh
+scripts/verify/stage-427m-cusdc-weth-liquidity-funding.sh
+
+# Large optional vendor trees and local checkouts (keep out of main clone)
 smom-dbis-138-publish/
-
-# Thirdweb scratch test: vendored contracts dep is a nested clone
-thirdweb-core-2103-test/lib/contracts/
-
-# Stray empty placeholders at repo root (do not track)
-/Arbitrum
-/cWUSDC
-/cWUSDT
+third-party/
+thirdweb-core-2103-test/
+tmp/
+token-aggregation-build/
+transaction-composer/
+vendor/

.gitmodules

@@ -4,7 +4,7 @@
 	# Primary integration remote is Gitea; use GitHub only as an optional mirror when available.
 [submodule "mcp-proxmox"]
 	path = mcp-proxmox
-	url = https://github.com/gilby125/mcp-proxmox.git
+	url = https://gitea.d-bis.org/d-bis/mcp-proxmox.git
 [submodule "smom-dbis-138"]
 	path = smom-dbis-138
 	url = git@github.com:Order-of-Hospitallers/smom-dbis-138.git
@@ -64,6 +64,7 @@
 [submodule "MEV_Bot"]
 	path = MEV_Bot
 	url = https://gitea.d-bis.org/d-bis/MEV_Bot.git
-[submodule "thirdweb-core-2103-test/lib/contracts"]
-	path = thirdweb-core-2103-test/lib/contracts
-	url = https://github.com/thirdweb-dev/contracts
+[submodule "atomic-swap-dapp"]
+	path = atomic-swap-dapp
+	url = https://gitea.d-bis.org/d-bis/atomic-swap-dapp.git
+	# Local bootstrap remote for initial scaffolding; replace with canonical hosted remote before team-wide clone use.

.ops-backups/cloudflare/sfvalley02-config-20260405-1513-post-cleanup.json

@@ -1 +0,0 @@
-{"success":true,"errors":[],"messages":[],"result":{"tunnel_id":"892bd3fe-c6fa-4ddf-8b60-a8ed2b849c3d","version":14,"config":{"ingress":[{"service":"https://192.168.11.169:443","hostname":"rpc-core-2.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-alltra.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-alltra-2.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-alltra-3.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-hybx.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-hybx-2.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-hybx-3.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"cacti-alltra.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"cacti-hybx.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"http_status:404"}],"warp-routing":{"enabled":false}},"source":"cloudflare","created_at":"2026-04-05T22:11:28.363368Z"}}

AGENTS.md

@@ -11,85 +11,41 @@ Orchestration for Proxmox VE, Chain 138 (`smom-dbis-138/`), explorers, NPMplus,
 | Need | Location |
 |------|-----------|
 | Doc index | `docs/MASTER_INDEX.md` |
-| Chain 138 PMM swap quote (CLI) | `bash scripts/verify/pmm-swap-quote-chain138.sh --token-in … --amount-in …` — on-chain `querySellBase`/`querySellQuote` + suggested `minOut` for `DODOPMMIntegration.swapExactIn` (REST `/quote` is xy=k only). |
-| **DeFi economics toolkit** (flash/gas buckets, path gate, dry-run exec, live gas quotes, multi-leg strategies) | `pnpm run economics:test`; `pnpm run economics:validate` (parse + optional `check-jsonschema` on smoke/template); `pnpm exec economics-toolkit calc|path-check|gas-quote|gas-budget|prepare-swap|exec`; `pnpm exec economics-toolkit strategy kinds|template|validate|eval|optimize|optimize-multi|optimize-random|optimize-descent|enrich|runbook|exec-plan`; live refresh: `bash scripts/economics/refresh-strategy-from-live.sh [--apply] <strategy.json>`; examples `config/strategy-bounds.example.json`, `config/strategy-optimize-dims.example.json`; template `packages/economics-toolkit/config/strategy-template.json`, smoke `strategy-smoke.json`, schema `strategy.schema.json`; allowlist `packages/economics-toolkit/config/executor-allowlist.example.json`; `gas-networks.json`; flow tables `packages/economics-toolkit/docs/FLOW_INPUTS_OUTPUTS_TABLE.md`; CI `.github/workflows/economics-toolkit.yml`. |
-| Chain 138 info site (`info.defi-oracle.io`) | Dedicated nginx LXC (default VMID **2410** / `IP_INFO_DEFI_ORACLE_WEB`): `provision-info-defi-oracle-web-lxc.sh` then `sync-info-defi-oracle-to-vmid2400.sh` (sync asserts `/token-aggregation` proxy); NPM fleet `scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh`; Cloudflare DNS `scripts/cloudflare/set-info-defi-oracle-dns-to-vmid2400-tunnel.sh`; cache `pnpm run cloudflare:purge-info-defi-oracle-cache`; runbook `docs/04-configuration/INFO_DEFI_ORACLE_IO_DEPLOYMENT.md`; `pnpm run verify:info-defi-oracle-public` (SPA routes including `/governance`, `/ecosystem`, `/documentation`, `/solacenet`, `llms.txt`, `agent-hints.json`, **same-origin** token-aggregation JSON; `INFO_SITE_BASE=…` optional); CI `info-defi-oracle-138.yml` (build) and `verify-info-defi-oracle-public.yml` (weekly + manual smoke); optional `pnpm run audit:info-defi-oracle-site` (`pnpm exec playwright install chromium`) |
-| **MEV Control GUI** (`mev.defi-oracle.io`) | Same nginx LXC as info by default: `scripts/deployment/sync-mev-control-gui-defi-oracle.sh` (builds `MEV_Bot/mev-platform/gui`, installs `/api` proxy to `MEV_ADMIN_API_HOST`:`MEV_ADMIN_API_PORT`); NPM + DNS via `update-npmplus-proxy-hosts-api.sh` and `scripts/cloudflare/set-mev-defi-oracle-dns.sh`; runbook `docs/04-configuration/MEV_CONTROL_DEFI_ORACLE_IO_DEPLOYMENT.md` |
-| **omdnl.org** (static landing) | Nginx LXC VMID **10203** / `IP_OMDNL_ORG_WEB` (default 192.168.11.222): `scripts/deployment/provision-omdnl-org-web-lxc.sh` → `sync-omdnl-org-static-to-ct.sh`; Cloudflare `configure-omdnl-org-dns.sh` (`CLOUDFLARE_ZONE_ID_OMDNL_ORG`, `PUBLIC_IP`); NPM `upsert-omdnl-org-proxy-host.sh`; content in `sites/omdnl-org/public/`. |
-| **SolaceNet + gateway rails** (dbis_core) | Hub map: `docs/04-configuration/SOLACENET_PUBLIC_HUB.md`. Backlog: `dbis_core/docs/solacenet/REMAINING_TASKS_FULL_LIST.md`. Gap IDs: `dbis_core/docs/solacenet/PROTOCOL_GAPS_CHECKLIST.md`. **Delta audit** (missing wiring, naming drift, CI): `dbis_core/docs/solacenet/AUDIT_GAPS_INCONSISTENCIES_MISSING.md`. Enforce rails runbook: `dbis_core/docs/solacenet/SOLACENET_GATEWAY_RAILS_ENFORCE_RUNBOOK.md`. Tests: `cd dbis_core && npm run test:gateway` (unit + HTTP integration). **Provider seed:** `cd dbis_core && npm run seed:gateway-provider` (needs `DATABASE_URL`). **Smoke (auth):** `bash scripts/verify/check-dbis-core-gateway-rails.sh`. **Outbox worker:** `cd dbis_core && npm run worker:gateway-outbox` (`DATABASE_URL`). CI: `.github/workflows/dbis-core-gateway-ci.yml`. API: `GET/POST /api/v1/gateway/rails*` (optional `SOLACENET_GATEWAY_RAILS_ENFORCE`) — `dbis_core/src/core/gateway/routes/gateway.routes.ts`. |
+| Canonical ecosystem master plan | `docs/02-architecture/DBIS_ECOSYSTEM_TECHNICAL_MASTER_PLAN.md` — umbrella root; subordinate roots: `dbis_chain_138_technical_master_plan.md`, `docs/03-deployment/DBIS_RTGS_MASTER_PLAN_IMPLEMENTATION_TRACKER.md`, `docs/04-configuration/universal-resource-activation/URA_MANIFEST_AUTOMATION_IMPLEMENTATION_TRACKER.md` |
+| Treasury / EMI / wallet / VA master plan | `docs/02-architecture/GOVERNMENT_TREASURY_EMI_WALLET_MASTER_PLAN.md` — government treasury, EMIs, digital wallets, virtual accounts (incl. Tatum-style), Rail vs RTGS gates |
+| Universal resource activation (manifest, CI, Phoenix) | `UNIVERSAL_RESOURCE_WIRING.md`, `URA_MANIFEST_AUTOMATION_IMPLEMENTATION_TRACKER.md`, `URA_OPERATIONAL_READINESS_CHECKLIST.md` (under `docs/04-configuration/universal-resource-activation/`); `config/universal-resource-activation/{manifest.json,policy-profiles.json,integration/}`; `pnpm ura:ops-readiness` / `ura:ops-readiness:full`, `ura:production-ready` / `ura:production-ready:connectivity`, `ura:validate`, `ura:validate-profiles`, `ura:merge-manifest`, `ura:validate-ledger-mapping`, `ura:writer:ledger`, `ura:writer:settlement`, `ura:profile-hash`, `ura:validate-closure`, `ura:keccak`, `ura:smoke`; `URA_STRICT_CLOSURE` / Gitea `vars.URA_STRICT_CLOSURE`; `smom-dbis-138/contracts/universal-resource/PolicyProfileRegistry.sol` (scoped forge test); Phoenix `PUBLIC_V1_NO_PARTNER_KEY_PATHS` |
+| Multi-jurisdiction compliance (matrices, onboarding) | `docs/04-configuration/compliance-matrices/README.md`, `INSTITUTION_ONBOARDING_CHARTER.md`, `INSTITUTION_ONBOARDING_PLAYBOOK.md`, `docs/04-configuration/jurisdictions/JURISDICTION_CATALOG.md`, `config/jurisdictions/catalog.v1.json`, `docs/dbis-rail/DBIS_RAIL_JURISDICTION_TRACEABILITY.md`, `docs/03-deployment/DBIS_RTGS_MASTER_PLAN_IMPLEMENTATION_TRACKER.md` |
 | cXAUC/cXAUT unit | 1 full token = 1 troy oz Au — `docs/11-references/EXPLORER_TOKEN_LIST_CROSSCHECK.md` (section 5.1) |
-| GRU / UTRNF token naming (`c*` vs collateral prefix) | `docs/04-configuration/naming-conventions/README.md`, `docs/04-configuration/naming-conventions/02_DBIS_NAMESPACE_AND_UTRNF_MAPPING.md` |
-| **GRU reference primacy vs public cW\* PMM mesh** (FX policy; mesh = execution, not shadow oracle) | `docs/04-configuration/GRU_REFERENCE_PRIMACY_AND_MESH_EXECUTION_MODEL.md` |
 | PMM mesh 6s tick | `smom-dbis-138/scripts/reserve/pmm-mesh-6s-automation.sh` — `docs/integration/ORACLE_AND_KEEPER_CHAIN138.md` (PMM mesh automation) |
-| **PMM soak grid (33×33×6 wallets)** | `docs/11-references/CHAIN138_GRID_6534_WALLET_FUNDING_PLAN.md` — one-shot `scripts/deployment/pmm-soak-complete-operator-bootstrap.sh` (`PMM_SOAK_AUTO_INIT_GRID_MNEMONIC=1` … `--apply-funds --to-linear 19`); full-grid resume `scripts/deployment/pmm-soak-complete-grid-funding-operator.sh` (`PMM_SOAK_START_LEG`, `PMM_SOAK_RESUME_NATIVE_FROM_LINEAR`, `PMM_SOAK_RPC_URL_OVERRIDE`, `PMM_SOAK_FUND_PROGRESS_EVERY` via fund-grid); tranche driver `scripts/deployment/pmm-soak-operator-fund-full-grid-tranches.sh`; export `pmm-soak-export-wallet-grid.py`, fund `pmm-soak-operator-fund-grid.sh`, pools `scripts/lib/pmm-soak-pools.sh`, bots `chain138-pmm-soak-grid-bot.sh` / `chain138-pmm-random-soak-swaps.sh` (`--pool-preset`, `--swap-via`; `scripts/lib/pmm-soak-dotenv-override.sh` preserves caller `PMM_SOAK_POOL_*` / `CHAIN138_PMM_SOAK_SWAP_VIA` over `.env`), smoke `scripts/deployment/pmm-soak-grid-smoke-check.sh`, CI `.github/workflows/pmm-soak-grid-smoke.yml` |
-| Mainnet cWUSD\* peg, TRUU PMM, bot readiness | `docs/03-deployment/MAINNET_PMM_TRUU_CWUSD_PEG_AND_BOT_RUNBOOK.md` (§11 live inventory) — `scripts/verify/check-mainnet-pmm-peg-bot-readiness.sh`, `scripts/deployment/deploy-mainnet-pmm-cw-truu-pool.sh`, `scripts/deployment/add-mainnet-truu-pmm-topup.sh`, `scripts/deployment/compute-mainnet-truu-liquidity-amounts.sh`, `scripts/deployment/compute-mainnet-truu-pmm-seed-amounts.sh`; `cross-chain-pmm-lps/config/deployment-status.json` `pmmPoolsVolatile`; `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md` (Mainnet TRUU PMM); `check-full-deployment-status.sh` when `ETHEREUM_MAINNET_RPC` + `DODO_PMM_INTEGRATION_MAINNET` are set |
-| Mainnet cWUSD\* hybrid flash loop (modeled ladder + readiness) | `docs/03-deployment/MAINNET_CWUSD_HYBRID_FLASH_LOOP_CALCULATION_WHITEPAPER.md`; `scripts/analytics/pmm-flash-push-break-even.mjs` (`--sequential-matched-loops`, `--full-loop-dry-run --execution-grade`); `scripts/verify/check-public-pmm-dry-run-readiness.sh`; `scripts/verify/run-mainnet-cwusdc-usdc-ladder-steps-1-3.sh` (optional `PMM_FLASH_EXIT_PRICE_CMD`); `scripts/verify/print-mainnet-cwusdc-usdc-pmm-sellbase-implied-price.sh` (pool-implied diagnostic); `scripts/verify/print-mainnet-cwusdc-external-exit-quote.sh` (DODO / 1inch hosted quote for `--external-exit-price-cmd`); same APIs in `pnpm exec economics-toolkit swap-quote` |
-| Mainnet cWUSDT/cWUSDC PMM + USDT↔USDC pathing | `cross-chain-pmm-lps/config/deployment-status.json` (`cWUSDT`/`cWUSDC`); `scripts/deployment/compute-mainnet-cwusdt-cwusdc-seed-amounts.sh`, `deploy-mainnet-cwusdt-cwusdc-pool.sh`, `add-mainnet-public-dodo-cw-liquidity.sh --pair=cwusdt-cwusdc`, `run-mainnet-cwusdt-cwusdc-soak-roundtrips.sh`; `scripts/verify/plan-mainnet-usdt-usdc-via-cw-paths.sh`; `scripts/verify/report-mainnet-deployer-liquidity-and-routes.sh` (deployer + deep USDC/USDT venues); `run-mainnet-public-dodo-cw-swap.sh --pair=cwusdt-cwusdc`; `.env.master.example` `POOL_CWUSDT_CWUSDC_MAINNET` |
-| Mainnet cWUSDC/USDC **1:1 reserve peg** (6dp raw vault parity) | `scripts/verify/check-mainnet-cwusdc-usdc-reserve-peg.sh` (`PEG_IMBALANCE_MAX_BPS`, default 25); remediate with `scripts/deployment/plan-mainnet-cwusdc-usdc-rebalance-liquidity.sh` then `add-mainnet-public-dodo-cw-liquidity.sh --pair=cwusdc-usdc` (both `--base-amount` and `--quote-amount`; `--dry-run` first) |
-| Mainnet cWUSDC/USDC rebalance **without wallet USDC** (flash quote-push) | Plan: `scripts/deployment/plan-mainnet-cwusdc-flash-quote-push-rebalance.sh`; **models**: `run-mainnet-cwusdc-flash-quote-push-model-sweep.sh`; **V3 pool probe**: `scripts/verify/probe-uniswap-v3-cwusdc-usdc-mainnet.sh`; **V3 path hex (UNWIND_MODE=2)**: `scripts/verify/build-uniswap-v3-exact-input-path-hex.sh`; **deploy stack**: `deploy-mainnet-aave-quote-push-stack.sh` (`--dry-run` / `--apply`); **one tx**: `run-mainnet-aave-cwusdc-quote-push-once.sh`; **loop**: `run-mainnet-aave-cwusdc-quote-push-loop.sh` + `FLASH_LOOP_COUNT`. Forge: `smom-dbis-138/script/flash/RunMainnetAaveCwusdcUsdcQuotePushOnce.s.sol` (`UNWIND_MODE` 0=fee / 1=DODO pool / 2=V3 path hex). Whitepaper: `MAINNET_CWUSD_HYBRID_FLASH_LOOP_CALCULATION_WHITEPAPER.md`. |
 | VMID / IP / FQDN | `docs/04-configuration/ALL_VMIDS_ENDPOINTS.md` |
-| Proxmox Mail Proxy (LAN SMTP) | VMID **100** `192.168.11.32` (`proxmox-mail-gateway`) — submission **587** / **465**; see Mail Proxy note in `ALL_VMIDS_ENDPOINTS.md` |
-| Spare R630 storage + optional tune-up | `scripts/proxmox/ensure-r630-spare-node-storage.sh`, `scripts/proxmox/provision-r630-03-six-ssd-thinpools.sh`, `scripts/proxmox/pve-spare-host-optional-tuneup.sh` · load balance / migrate: `docs/04-configuration/PROXMOX_LOAD_BALANCING_RUNBOOK.md` |
-| Ops template + JSON | `docs/03-deployment/PROXMOX_VE_OPERATIONAL_DEPLOYMENT_TEMPLATE.md`, `config/proxmox-operational-template.json` (`proxmox_nodes[].mgmt_fqdn` = `*.sankofa.nexus`; `config/ip-addresses.conf` `PROXMOX_FQDN_*`) |
-| Live vs template (read-only SSH) | `bash scripts/verify/audit-proxmox-operational-template.sh` — defaults to ML110 + **r630-01..04** (`PROXMOX_HOSTS` overrides) |
-| Proxmox mgmt FQDN DNS + `/etc/hosts` snippet | `bash scripts/verify/check-proxmox-mgmt-fqdn.sh` (`--print-hosts`, optional `--ssh`) |
-| Proxmox SSH check (all 5 nodes) | `bash scripts/security/ensure-proxmox-ssh-access.sh` (`--fqdn`, optional `--copy` for `ssh-copy-id`) |
-| Proxmox cluster hardware poll (LAN, key SSH) | `bash scripts/verify/poll-proxmox-cluster-hardware.sh` — writes `reports/status/hardware_poll_*.txt`; companion narrative + ARP/edge: `reports/status/hardware_and_connected_inventory_*.md` |
-| Proxmox LXC cluster health poll (LAN, key SSH) | `bash scripts/verify/poll-lxc-cluster-health.sh` — pulls `/cluster/resources` + per-node load/PSI/`pvesm`; writes `reports/status/lxc_cluster_health_*.json` and `.txt`; exits `0` ok / `1` warn / `2` crit / `3` collection failure |
-| Proxmox LXC rebalance planner (read-only) | `bash scripts/verify/plan-lxc-rebalance-from-health-report.sh [--report reports/status/lxc_cluster_health_*.json] --source r630-01 --target r630-04` — ranks move candidates, prints `pct migrate` commands, excludes chain-critical / infra-critical names by pattern |
-| IT live inventory + IPAM drift (LAN, Phase 0) | `bash scripts/it-ops/export-live-inventory-and-drift.sh` → `reports/status/live_inventory.json`, `drift.json` (exit **2** only if duplicate guest IPs; merges `ip-addresses.conf` + `ALL_VMIDS_ENDPOINTS.md`). Optional **`IT_BFF_SNAPSHOT_DB=/path/it.sqlite`** appends export metadata; optional **`IT_COLLECT_IP_NEIGH=1`** on PVE enables `ip neigh` sample in collector. [SANKOFA_IT_OPS_LIVE_INVENTORY_SCRIPTS.md](docs/03-deployment/SANKOFA_IT_OPS_LIVE_INVENTORY_SCRIPTS.md). Spec: [SANKOFA_IT_OPERATIONS_CONTROLLER_SPEC.md](docs/02-architecture/SANKOFA_IT_OPERATIONS_CONTROLLER_SPEC.md); ADR: [SANKOFA_IT_API_DEPLOYMENT_DECISION.md](docs/02-architecture/SANKOFA_IT_API_DEPLOYMENT_DECISION.md) |
-| IT inventory read API (Phase 0–1 BFF stub) | `python3 services/sankofa-it-read-api/server.py` — GET `/health`, `/v1/summary`, `/v1/collector-contract`, `/v1/portmap/joined` (stub), `/v1/inventory/live`, `/v1/inventory/drift`; POST `/v1/inventory/refresh` (returns `drift_exit_code`; **2** = duplicate IP alert). Optional `IT_READ_API_KEY`, `IT_BFF_OIDC_ISSUER` (health only). [services/sankofa-it-read-api/README.md](services/sankofa-it-read-api/README.md), systemd [config/systemd/sankofa-it-read-api.service.example](config/systemd/sankofa-it-read-api.service.example) |
-| **IT read API LAN bootstrap** | `bash scripts/deployment/bootstrap-sankofa-it-read-api-lan.sh` — rsync → `/opt/proxmox` on seed PVE (includes `config/it-operations/`), systemd + `/etc/sankofa-it-read-api.env`, repo `.env` + portal CT 7801 merge, weekly export timer on PVE. NPM: [upsert-it-read-api-proxy-host.sh](scripts/nginx-proxy-manager/upsert-it-read-api-proxy-host.sh); DNS: [add-it-api-sankofa-dns.sh](scripts/cloudflare/add-it-api-sankofa-dns.sh). [SANKOFA_IT_OPS_KEYCLOAK_PORTAL_NEXT_STEPS.md](docs/03-deployment/SANKOFA_IT_OPS_KEYCLOAK_PORTAL_NEXT_STEPS.md) |
-| Keycloak realm role + group for portal `/it` | `bash scripts/deployment/keycloak-sankofa-ensure-it-admin-role.sh` then `bash scripts/deployment/keycloak-sankofa-ensure-it-admin-group.sh` (CT 7802 via SSH); add IT users to group **sankofa-it-admin**. MFA: [SANKOFA_IT_OPS_KEYCLOAK_PORTAL_NEXT_STEPS.md](docs/03-deployment/SANKOFA_IT_OPS_KEYCLOAK_PORTAL_NEXT_STEPS.md). Portal: `IT_READ_API_URL` + optional `IT_READ_API_KEY` on CT 7801. Weekly export timer: [config/systemd/sankofa-it-inventory-export.timer.example](config/systemd/sankofa-it-inventory-export.timer.example) |
-| IT VLAN + port map + billing skeleton | VLAN runbook [VLAN_FLAT_11_TO_SEGMENTED_RUNBOOK.md](docs/03-deployment/VLAN_FLAT_11_TO_SEGMENTED_RUNBOOK.md); port layers [IT_PORT_MAP_LAYERS_SPEC.md](docs/02-architecture/IT_PORT_MAP_LAYERS_SPEC.md); edge IPs [IT_OPS_EDGE_DISCOVERY_IPS.md](docs/04-configuration/IT_OPS_EDGE_DISCOVERY_IPS.md); collectors contract [IT_LIVE_COLLECTORS_CONTRACT.md](docs/02-architecture/IT_LIVE_COLLECTORS_CONTRACT.md); Stripe outline [IT_OPERATIONS_BILLING_STRIPE_OUTLINE.md](docs/03-deployment/IT_OPERATIONS_BILLING_STRIPE_OUTLINE.md); guarded Proxmox preview [scripts/it-ops/proxmox-guarded-write-adapter.sh](scripts/it-ops/proxmox-guarded-write-adapter.sh); Gitea `.gitea/workflows/live-inventory-hardware-weekly.yml` |
-| IT admin UI next steps (Keycloak + portal `/it`) | [docs/03-deployment/SANKOFA_IT_OPS_KEYCLOAK_PORTAL_NEXT_STEPS.md](docs/03-deployment/SANKOFA_IT_OPS_KEYCLOAK_PORTAL_NEXT_STEPS.md) |
-| Config validation | `bash scripts/validation/validate-config-files.sh` (optional: `python3 -m pip install check-jsonschema` for `validate-dbis-institutional-schemas.sh`, `validate-naming-convention-registry-examples.sh`, `validate-jvmtm-regulatory-closure-schemas.sh`, `validate-reserve-provenance-package.sh`; includes explorer Chain 138 inventory vs `config/smart-contracts-master.json`) |
-| Chain 138 contract addresses (JSON + bytecode) | `config/smart-contracts-master.json` — `bash scripts/verify/check-contracts-on-chain-138.sh` (expect **75/75** when Core RPC reachable; jq uses JSON when file present) |
-| OMNL + Core + Chain 138 + RTGS + Smart Vaults | `docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md`; identifiers (UETR vs DLT-primary): `docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md`; JVMTM Tables B/C/D closure matrix: `config/jvmtm-regulatory-closure/INAAUDJVMTM_2025_AUDIT_CLOSURE_MATRIX.md`; **dual-anchor attestation:** `scripts/omnl/omnl-chain138-attestation-tx.sh` (138 + optional mainnet via `ETHEREUM_MAINNET_RPC`); E2E zip: `AUDIT_PROOF.json` `chainAttestationMainnet`; machine-readable: `config/dbis-institutional/` |
-| Blockscout address labels from registry | `bash scripts/verify/sync-blockscout-address-labels-from-registry.sh` (plan); `--apply` with `BLOCKSCOUT_*` env when explorer API confirmed |
-| ISO-20022 on-chain methodology + intake gateway | `docs/04-configuration/SMART_CONTRACTS_ISO20022_FIN_METHODOLOGY.md`, `ISO20022_INTAKE_GATEWAY_CONTRACT_MULTI_NETWORK.md`; Rail: `docs/dbis-rail/ISO_GATEWAY_AND_RELAYER_SPEC.md` |
+| Ops template + JSON | `docs/03-deployment/PROXMOX_VE_OPERATIONAL_DEPLOYMENT_TEMPLATE.md`, `config/proxmox-operational-template.json` |
+| Live vs template (read-only SSH) | `bash scripts/verify/audit-proxmox-operational-template.sh` |
+| Config validation | `bash scripts/validation/validate-config-files.sh` |
+| pnpm lockfile vs workspace (prevents `pnpm outdated` / importer bugs) | `bash scripts/verify/check-pnpm-workspace-lockfile.sh` — also run as **step 1b** in `run-all-validation.sh` |
+| CI validation (no LAN) + cW* mesh matrix | `bash scripts/verify/run-all-validation.sh [--skip-genesis]` — same gate as **Gitea** push/PR: `run-all-validation` in `.gitea/workflows/deploy-to-phoenix.yml` (push) and `.gitea/workflows/validate-on-pr.yml` (PR only). After deploy, optional **Cloudflare** `cloudflare-sync` (Phoenix + `PHOENIX_REPO_ROOT`; set `PHOENIX_CLOUDFLARE_SYNC=1` on that host) via `scripts/deployment/gitea-cloudflare-sync.sh`. Steps: dependencies, **pnpm workspace/lockfile check**, config, cW* mesh (when pair-discovery exists), **`node cross-chain-pmm-lps/scripts/validate-deployment-status.cjs`**, optional genesis. Manual only: `bash scripts/verify/build-cw-mesh-deployment-matrix.sh [--json-out …]` |
 | FQDN / NPM E2E verifier | `bash scripts/verify/verify-end-to-end-routing.sh --profile=public` — inventory: `docs/04-configuration/E2E_ENDPOINTS_LIST.md`. Gitea Actions URLs (no API): `bash scripts/verify/print-gitea-actions-urls.sh` |
-| **Gitea** (org forge **VMID 104**, upgrades, NPM) | `docs/04-configuration/GITEA_PLATFORM_AND_UPGRADE_RUNBOOK.md` — `scripts/operator/upgrade-gitea-lxc.sh` (`--dry-run`, `GITEA_VERSION=`); `config/ip-addresses.conf` **`IP_GITEA_INFRA`**, **`GITEA_PUBLIC_UPSTREAM_*`**; `scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh`, `update-npmplus-fourth-proxy-hosts.sh` |
-| Chain 138 LAN RPC health + nonce/gas parity | `bash scripts/verify/check-chain138-rpc-health.sh` (fleet + public capability); `bash scripts/verify/check-chain138-rpc-nonce-gas-parity.sh` (LAN: aligned chainId / deployer nonces / gasPrice); offline/CI: `bash scripts/verify/self-test-chain138-rpc-verify.sh`; shared VMID list: `scripts/lib/chain138-lan-rpc-inventory.sh` |
-| RPC FQDN batch (`eth_chainId` + WSS) | `bash scripts/verify/check-rpc-fqdns-e2e.sh` — after DNS + `update-npmplus-proxy-hosts-api.sh`; includes `rpc-core.d-bis.org` |
 | Submodule trees clean (CI / post-merge) | `bash scripts/verify/submodules-clean.sh` |
-| Submodule + explorer remotes | `docs/00-meta/SUBMODULE_HYGIENE.md` |
+| Submodule + explorer remotes | `docs/00-meta/SUBMODULE_HYGIENE.md` — `mcp-proxmox` uses **Gitea** `https://gitea.d-bis.org/d-bis/mcp-proxmox.git` (not the old GitHub-only URL). `cross-chain-pmm-lps-publish` is a **worktree** of `cross-chain-pmm-lps`, not a submodule. |
 | smom-dbis-138 `.env` in bash scripts | Prefer `source smom-dbis-138/scripts/lib/deployment/dotenv.sh` + `load_deployment_env --repo-root "$PROJECT_ROOT"` (trims RPC URL line endings). From an interactive shell: `source smom-dbis-138/scripts/load-env.sh`. Proxmox root scripts: `source scripts/lib/load-project-env.sh` (also trims common RPC vars). |
-| Sankofa portal → CT 7801 (build + restart) | `./scripts/deployment/sync-sankofa-portal-7801.sh` (`--dry-run` first); default `NEXTAUTH_URL=https://portal.sankofa.nexus` via `sankofa-portal-ensure-nextauth-on-ct.sh`; IT `/it` env: `sankofa-portal-merge-it-read-api-env-from-repo.sh` (`IT_READ_API_URL` in repo `.env`) |
-| Portal Keycloak OIDC secret on CT 7801 | After client exists: `./scripts/deployment/sankofa-portal-merge-keycloak-env-from-repo.sh` (needs `KEYCLOAK_CLIENT_SECRET` in repo `.env`; base64-safe over SSH) |
-| Sankofa corporate web → CT 7806 | Provision: `./scripts/deployment/provision-sankofa-public-web-lxc-7806.sh`. Sync: `./scripts/deployment/sync-sankofa-public-web-to-ct.sh`. systemd: `config/systemd/sankofa-public-web.service`. Set `IP_SANKOFA_PUBLIC_WEB` in `.env`, then `scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh` |
-| **Non-chain ecosystem** (hyperscaler-style: edge / API hub / IdP / data cells; **not** chain CTs) | `docs/02-architecture/NON_CHAIN_ECOSYSTEM_HYPERSCALER_STYLE_MODEL.md` — gap review: `docs/02-architecture/NON_CHAIN_ECOSYSTEM_PLAN_REVIEW_AND_GAPS.md` |
-| Sankofa / Phoenix **consolidated hub** (optional — fewer non-chain LXCs) | `docs/02-architecture/SANKOFA_PHOENIX_CONSOLIDATED_FRONTEND_AND_API.md` — `docs/03-deployment/SANKOFA_R630_01_CONSOLIDATION_AND_HUB_PLACEMENT_GOAL.md` (offload r630-01: consolidate + **place** hubs on quieter nodes); `docs/03-deployment/SANKOFA_API_HUB_NPM_CUTOVER_AND_POST_CUTOVER_RUNBOOK.md` (NPM → `:8080`, `TRUST_PROXY`, rollback); `bash scripts/verify/check-sankofa-consolidated-nginx-examples.sh`; `bash scripts/verify/verify-sankofa-consolidated-hub-lan.sh`; `bash scripts/verify/smoke-phoenix-api-hub-lan.sh` (hub **:8080**); `pnpm run verify:phoenix-graphql-wss` or `PHOENIX_WSS_INCLUDE_LAN=1 bash scripts/verify/smoke-phoenix-graphql-wss-public.sh` (HTTP **101** WS upgrade); `pnpm run verify:phoenix-graphql-ws-subscription` (**connection_ack**); `bash scripts/deployment/ensure-sankofa-phoenix-graphql-ws-remove-fastify-websocket-7800.sh` (fix RSV1 / competing upgrade listener); `bash scripts/deployment/ensure-sankofa-phoenix-websocket-ts-import-logger-7800.sh` (**logger** import in `websocket.ts` — avoids **crash on WS disconnect**); `bash scripts/deployment/ensure-sankofa-phoenix-7800-nft-dport-4000-guard.sh` (optional **nft** reject :4000 from non-loopback); `bash scripts/deployment/ensure-sankofa-phoenix-api-hub-graphql-ws-proxy-headers-7800.sh` (hub `/graphql-ws` **Accept-Encoding** / **proxy_buffering**); `bash scripts/deployment/ensure-sankofa-phoenix-api-hub-systemd-exec-reload-7800.sh` (hub **ExecReload**); `bash scripts/deployment/ensure-sankofa-phoenix-api-env-lan-parity-7800.sh` (**.env** Keycloak + Postgres LAN + `NODE_ENV` policy); `bash scripts/deployment/ensure-sankofa-phoenix-api-db-migrate-up-7800.sh` (**pnpm db:migrate:up** on **7800**); `bash scripts/deployment/ensure-sankofa-phoenix-tls-config-terminate-at-edge-7800.sh` (production **HTTP** behind NPM); `bash scripts/deployment/plan-phoenix-apollo-port-4000-restrict-7800.sh` (`--ssh`); **Apollo loopback:** `PROXMOX_OPS_APPLY=1` `PROXMOX_OPS_ALLOWED_VMIDS=7800` `bash scripts/deployment/ensure-sankofa-phoenix-apollo-bind-loopback-7800.sh --apply --vmid 7800`; `bash scripts/deployment/plan-sankofa-consolidated-hub-cutover.sh`; **API hub on CT:** `bash scripts/deployment/install-sankofa-api-hub-nginx-on-pve.sh --dry-run --vmid 7800` (live: `PROXMOX_OPS_APPLY=1` `PROXMOX_OPS_ALLOWED_VMIDS=7800` `--apply --vmid 7800`); **dbis API `TRUST_PROXY`:** `PROXMOX_OPS_APPLY=1` `PROXMOX_OPS_ALLOWED_VMIDS=10150` `bash scripts/deployment/ensure-dbis-api-trust-proxy-on-ct.sh --apply --vmid 10150` (repeat **10151**); NPM fleet: `SANKOFA_NPM_PHOENIX_PORT=8080` + `scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh` (Phoenix rows use **WebSocket: true**); `.env` hub overrides optional |
-| CCIP relay (r630-01 host) | WETH lane: `config/systemd/ccip-relay.service`. Mainnet cW lane: `config/systemd/ccip-relay-mainnet-cw.service` (health `http://192.168.11.11:9863/healthz`). Public edge: set `CCIP_RELAY_MAINNET_CW_PUBLIC_HOST`, run `scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh`, relay-only `scripts/nginx-proxy-manager/upsert-ccip-relay-mainnet-cw-proxy-host.sh`, or SSH hop `scripts/nginx-proxy-manager/upsert-ccip-relay-mainnet-cw-via-ssh.sh`; DNS `scripts/cloudflare/configure-relay-mainnet-cw-dns.sh`. Use `NPM_URL=https://…:81` for API scripts (HTTP on :81 301s to HTTPS). |
-| XDC Zero + Chain 138 (parallel to CCIP) | `bash scripts/xdc-zero/run-xdc-zero-138-operator-sequence.sh` · `docs/03-deployment/CHAIN138_XDC_ZERO_BRIDGE_RUNBOOK.md` · `CHAIN138_XDC_ZERO_DEPLOYMENT_TROUBLESHOOTING.md` · `config/xdc-zero/` · `scripts/xdc-zero/` · systemd `node dist/server.js` template — **XDC mainnet RPC:** `https://rpc.xinfin.network` (chain id 50; more endpoints: [chainid.network/chain/50](https://chainid.network/chain/50/)); **Chain 138 side:** Core `http://192.168.11.211:8545` is operator-only, relayer/services use `https://rpc-http-pub.d-bis.org` |
-| OP Stack Standard Rollup (Ethereum mainnet, Superchain) | `docs/03-deployment/OP_STACK_STANDARD_ROLLUP_SUPERCHAIN_RUNBOOK.md` · optional L2↔Besu notes `docs/03-deployment/OP_STACK_L2_AND_BESU138_BRIDGE_NOTES.md` · `config/op-stack-superchain/` · `scripts/op-stack/` (e.g. `fetch-standard-mainnet-toml.sh`, checklist scripts) · `config/systemd/op-stack-*.example.service` — **distinct L2 chain ID from Besu 138**; follow [Optimism superchain-registry](https://github.com/ethereum-optimism/superchain-registry) for listing |
-| Wormhole protocol (LLM / MCP) vs Chain 138 facts | Wormhole NTT/Connect/VAAs/etc.: `docs/04-configuration/WORMHOLE_AI_RESOURCES_LLM_PLAYBOOK.md`, mirror `scripts/doc/sync-wormhole-ai-resources.sh`, MCP `mcp-wormhole-docs/` + `docs/04-configuration/MCP_SETUP.md`. **Chain 138 addresses, PMM, CCIP:** repo `docs/11-references/` + `docs/07-ccip/` — not Wormhole bundles. Cursor overlay: `.cursor/rules/wormhole-ai-resources.mdc`. |
+| Sankofa portal → CT 7801 (build + restart) | `./scripts/deployment/sync-sankofa-portal-7801.sh` (`--dry-run` first); sets `NEXTAUTH_URL` on CT via `sankofa-portal-ensure-nextauth-on-ct.sh` |
+| CCIP relay (r630-01 host) | Unit: `config/systemd/ccip-relay.service` → `/etc/systemd/system/ccip-relay.service`; `systemctl enable --now ccip-relay` |
 | TsunamiSwap VM 5010 check | `./scripts/deployment/tsunamiswap-vm-5010-provision.sh` (inventory only until VM exists) |
 | The Order portal (`https://the-order.sankofa.nexus`) | OSJ management UI (secure auth); source repo **the_order** at `~/projects/the_order`. NPM upstream defaults to **order-haproxy** CT **10210** (`IP_ORDER_HAPROXY:80`); use `THE_ORDER_UPSTREAM_*` to point at the Sankofa portal if 10210 is down. Provision HAProxy: `scripts/deployment/provision-order-haproxy-10210.sh`. **`www.the-order.sankofa.nexus`** → **301** apex (same as www.sankofa / www.phoenix). |
-| Portal login + Keycloak systemd + `.env` (prints password once) | `./scripts/deployment/enable-sankofa-portal-login-7801.sh` (`--dry-run` first); preserves `KEYCLOAK_*` from repo `.env` and runs merge script when `KEYCLOAK_CLIENT_SECRET` is set |
-| Keycloak redirect URIs (portal + admin) | `./scripts/deployment/keycloak-sankofa-ensure-client-redirects-via-proxmox-pct.sh` (or `keycloak-sankofa-ensure-client-redirects.sh` for LAN URL) — needs `KEYCLOAK_ADMIN_PASSWORD` in `.env` |
-| NPM TLS for hosts missing certs | `./scripts/request-npmplus-certificates.sh` — optional `CERT_DOMAINS_FILTER='portal\\.sankofa|admin\\.sankofa'`; IT API: `./scripts/deployment/request-it-api-tls-npm.sh` (same as filter `it-api\\.sankofa\\.nexus`) |
-| Token-aggregation API (Chain 138) | `pnpm run verify:token-aggregation-api` — tokens, pools, quote (prints `quoteEngine` when `jq` installed), `bridge/routes`, networks. Build + env: `scripts/deploy-token-aggregation-for-publication.sh` (sets `RPC_URL_138`, `TOKEN_AGGREGATION_CHAIN138_RPC_URL`, optional `TOKEN_AGGREGATION_PMM_*`). LAN push + restart: `scripts/deployment/push-token-aggregation-bundle-to-explorer.sh`. Nginx gaps: `scripts/fix-explorer-http-api-v1-proxy.sh` (apex `/api/v1/`), `scripts/fix-explorer-token-aggregation-api-v2-proxy.sh` (planner POST). Runbook: `docs/04-configuration/TOKEN_AGGREGATION_REPORT_API_RUNBOOK.md`. |
-| **Chain 138 Open Snap** (MetaMask, open Snap permissions only; stable MetaMask requires MetaMask install allowlist for npm Snaps) | Source repo: [Defi-Oracle-Tooling/chain138-snap-minimal](https://github.com/Defi-Oracle-Tooling/chain138-snap-minimal). Vendored in this workspace: `metamask-integration/chain138-snap-minimal/`. Snap ID `npm:chain138-open-snap`; **`npm run verify`** = `npm audit --omit=dev` + build. **Publish:** token in `chain138-snap/.env` or `npm login`, then `./scripts/deployment/publish-chain138-open-snap.sh`. **Full-feature Snap** (API quotes, allowlist): `metamask-integration/chain138-snap/`. Explorer `/wallet` install works on stable MetaMask only after allowlisting; use Flask or local serve for dev. |
+| Portal login + Keycloak systemd + `.env` (prints password once) | `./scripts/deployment/enable-sankofa-portal-login-7801.sh` (`--dry-run` first) |
 | Completable (no LAN) | `./scripts/run-completable-tasks-from-anywhere.sh` |
-| Operator (LAN + secrets) | `./scripts/run-all-operator-tasks-from-lan.sh` (use `--skip-backup` if `NPM_PASSWORD` unset) |
+| smom-dbis-138 root `forge test` | Uses `foundry.toml` `[profile.default] skip` for legacy Uniswap V2 vendor trees (0.5/0.6 solc); scoped work still uses `bash scripts/forge/scope.sh …` |
+| cWUSDT Mainnet USD pricing (on-chain + runbook) | `./scripts/deployment/price-cw-token-mainnet.sh` — `docs/03-deployment/CW_TOKEN_USD_PRICING_RUNBOOK.md` |
+| Deployer LP balances (mesh inventory) | `python3 scripts/deployment/check-deployer-lp-balances.py` — scans `deployment-status.json` + `reports/extraction/promod-uniswap-v2-live-pair-discovery-latest.json`; **UniV2** `lpToken` = pair; **DODO DVM** LP shares = `balanceOf(pool)`; on failure, probes `_BASE_TOKEN_` / `_BASE_CAPITAL_TOKEN_` / `_QUOTE_CAPITAL_TOKEN_` + extra public RPCs (`--no-resolve-dodo` skips; `--chain-id N` for one chain). JSON: `lpTokenAddress`, `lpResolution`, `lpBalances[]`. Use `--deployer` / `DEPLOYER_ADDRESS` if no `PRIVATE_KEY` |
+| Etherscan Value $0 for Mainnet `cW*` | Listing path (CoinGecko/CMC), not a contract toggle — `docs/04-configuration/coingecko/ETHERSCAN_USD_VALUE_MAINNET_TOKENS.md` |
+| Verify contracts on explorers (all networks) | `cd smom-dbis-138 && ./scripts/deployment/verify-all-networks-explorers.sh` — Blockscout 138, Etherscan + multichain `cW*`, Avax/Arb bridges, optional Cronos/Wemix/CCIPLogger |
+| Operator (LAN + secrets) | `./scripts/run-all-operator-tasks-from-lan.sh` (use `--skip-backup` if `NPM_PASSWORD` unset; backup also needs `NPM_EMAIL` in `.env`) |
+| Remote SSH to dev VM (5700 / `192.168.11.59`) for runner & deploy API | [docs/04-configuration/DEV_VM_SSH_REMOTE_ACCESS.md](docs/04-configuration/DEV_VM_SSH_REMOTE_ACCESS.md) (Cloudflare Access + tunnel, or UDM allowlist) |
 | Cloudflare bulk DNS → `PUBLIC_IP` | `./scripts/update-all-dns-to-public-ip.sh` — use **`--dry-run`** and **`--zone-only=sankofa.nexus`** (or `d-bis.org` / `mim4u.org` / `defi-oracle.io`) to limit scope; see script header. Prefer scoped **`CLOUDFLARE_API_TOKEN`** (see `.env.master.example`). |
-| Cloudflare SSL mode (sankofa.nexus zone) | `bash scripts/cloudflare/set-sankofa-zone-ssl-mode.sh full` — fixes **Flexible** + NPM **SSL forced** redirect loops (e.g. `it-api.sankofa.nexus`). |
-| IRU marketplace surfaces + Turnstile (Captcha) | [docs/03-deployment/SANKOFA_MARKETPLACE_SURFACES.md](docs/03-deployment/SANKOFA_MARKETPLACE_SURFACES.md) — **native** (VMs, IPs, app hosting, etc.) vs **partner** (e.g. SolaceNet IRU) methodology; Turnstile **secret** on API (`CLOUDFLARE_TURNSTILE_SECRET_KEY` or aliases), **site key** on frontend build (`VITE_*`); not the same as Cloudflare DNS keys. [docs/04-configuration/MASTER_SECRETS.md](docs/04-configuration/MASTER_SECRETS.md) (Cloudflare table). |
 
 ## Git submodules
 
 Most submodules are **pinned commits**; `git submodule update --init --recursive` often leaves **detached HEAD** — that is normal. To **change** a submodule: check out a branch inside it, commit, **push the submodule first**, then commit and push the **parent** submodule pointer. Do not embed credentials in `git remote` URLs; use SSH or a credential helper. Explorer Gitea vs GitHub and token cleanup: `docs/00-meta/SUBMODULE_HYGIENE.md`.
 
-## Production safety (Proxmox / shared config)
-
-- **Scoped LXC starts:** use `scripts/operator/start-stopped-lxc-scoped.sh --host <PVE> --vmid <N> [--vmid …]`; default is **dry-run**; add **`--apply`** or **`PROXMOX_OPS_APPLY=1`** to mutate. Optional **`PROXMOX_OPS_ALLOWED_VMIDS`** enforces an allowlist. Do **not** use cluster-wide “start every stopped CT” patterns for production.
-- **Maintenance scripts (SSH + pct):** set **`PROXMOX_SAFE_DEFAULTS=1`** so `fix-core-rpc-2101.sh`, `make-rpc-vmids-writable-via-ssh.sh`, and `ensure-legacy-monitor-networkd-via-ssh.sh` default to **plan-only** unless **`--apply`** or **`PROXMOX_OPS_APPLY=1`**. Without that env, behavior stays **legacy** (mutate unless `--dry-run`) so existing docs/commands keep working.
-- **Guard helpers** for new SSH+pct scripts: `scripts/lib/proxmox-production-guard.sh`.
-- **VMID → host** for automation: `get_host_for_vmid` in `scripts/lib/load-project-env.sh` must match live placement (`docs/04-configuration/ALL_VMIDS_ENDPOINTS.md`).
-- **Shared config:** avoid drive-by edits to `config/ip-addresses.conf` or root `.env` when the task only affects one workload; prefer flags, workload-specific env files, or small dedicated scripts.
-- Cursor overlay: `.cursor/rules/proxmox-production-safety.mdc`.
-
 ## Rules of engagement
 
 - Review scripts before running; prefer `--dry-run` where supported.

COMPREHENSIVE_STATUS_BRIDGE_READY.md

@@ -252,7 +252,7 @@ NEW_BRIDGE="0xNEW_ADDRESS_HERE"  # From deployment
 # 1. Add Mainnet destination
 cast send $NEW_BRIDGE "addDestination(uint64,address)" \
   5009297550715157269 \
-  0xc9901ce2Ddb6490FAA183645147a87496d8b20B6 \
+  0x2A0840e5117683b11682ac46f5CF5621E67269E3 \
   --private-key $PRIVATE_KEY \
   --rpc-url http://192.168.11.211:8545
 

README.md

@@ -90,13 +90,17 @@ From the root directory, you can run:
 - `pnpm frontend:build` - Build the ProxmoxVE frontend for production
 - `pnpm frontend:start` - Start the production frontend server
 
+### Mission Control (unified operator console)
+
+- `pnpm mission-control:dev` - Next.js console on **http://localhost:3010** (launchpad + guided runbooks + live run trace + audit ZIP)
+- `pnpm mission-control:build` / `pnpm mission-control:start` - Production build and server
+- `pnpm mission-control:test` - Executor smoke test (real allowlisted child process)
+
+See [mission-control/README.md](mission-control/README.md) and [mission-control/TIMELINE.md](mission-control/TIMELINE.md).
+
 ### Testing
 
-- `pnpm test` - Run the local green-path Chain 138 / GRU / bridge / token test aggregate
-- `pnpm test:chain138` - Run the Chain 138 package CI targets directly
-- `pnpm test:chain138:contracts` - Run the focused Solidity contract CI targets
-- `pnpm test:chain138:services` - Run the focused JS/TS service CI targets
-- `pnpm test:mcp` - Run the legacy MCP server package test entrypoint
+- `pnpm test` - Run tests (if available)
 - `pnpm test:basic` - Run basic MCP server tests (read-only operations)
 - `pnpm test:workflows` - Run comprehensive workflow tests (requires elevated permissions)
 
@@ -323,3 +327,4 @@ Individual checks:
 ## License
 
 This workspace contains multiple projects with different licenses. Please refer to individual project directories for license information.
+

config/README-BRIDGE-ROUTES-DEFAULT.md

@@ -1,8 +0,0 @@
-# bridge-routes-chain138-default.json
-
-Static snapshot of the default **`GET /api/v1/bridge/routes`** response shape (without per-env address overrides).
-
-- **Server source of truth:** `smom-dbis-138/services/token-aggregation/src/api/utils/default-bridge-routes.ts` (applies `CCIPWETH9_BRIDGE_CHAIN138`, `LOCKBOX_138`, `INBOX_ETH`, etc.).
-- **UI fallback:** `info-defi-oracle-138` imports this file when the live API returns 404 or errors.
-
-Update this JSON when canonical bridge addresses or relay destinations change; keep the TS module in sync.

config/README-CONTRACTS-MASTER.md

@@ -1,10 +1,9 @@
 # Master Smart Contracts (JSON)
 
-**Machine-readable contract map:** `config/smart-contracts-master.json` (when the file exists in your clone).
+**Single source of truth for contract addresses:** `config/smart-contracts-master.json`
 
 - **Safe to publish** — no secrets (no keys, no RPC URLs with credentials).
 - **Used by:** Bash scripts (via `scripts/lib/load-contract-addresses.sh`), Node/JS (via `config/contracts-loader.cjs`), and docs.
-- **If the file is absent:** loaders continue with `.env` only; Chain 138 **bytecode checks** use the embedded address list in `scripts/verify/check-contracts-on-chain-138.sh` (see also `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md`). When you introduce `smart-contracts-master.json`, populate `chains["138"].contracts` with the **complete** set for that chain — the check script uses JSON addresses instead of its fallback when the file is present.
 
 ## Layout
 
@@ -41,7 +40,7 @@ const {
 } = require('./config/contracts-loader.cjs');
 
 // By contract key
-getContractAddress(138, 'CCIP_Router');        // => '0x42DA...' (canonical; legacy direct: CCIP_Router_Direct_Legacy)
+getContractAddress(138, 'CCIP_Router');        // => '0x8078...'
 getContractAddress(138, 'CCIPWETH9_Bridge');
 getContractAddress(1, 'CCIP_Relay_Router');
 
@@ -58,7 +57,7 @@ loadContractsIntoProcessEnv();
 
 ## Overrides
 
-- **.env** (e.g. `smom-dbis-138/.env`, `services/relay/.env`): Values set there take precedence over the master JSON. Use .env for local or per-service overrides. For **`ADDRESS_MAPPER`** on Chain 138, keep **`ADDRESS_MAPPER`** equal to **`chains["138"].contracts.AddressMapper`** unless you have a deliberate fork: a legacy duplicate on Core shares bytecode with the canonical mapper (see `docs/11-references/ADDRESS_MATRIX_AND_STATUS.md`, section 1.5).
+- **.env** (e.g. `smom-dbis-138/.env`, `services/relay/.env`): Values set there take precedence over the master JSON. Use .env for local or per-service overrides.
 - **Publishing:** Commit `smart-contracts-master.json`; do not commit `.env` or any file containing `PRIVATE_KEY` or API secrets.
 
 ## Updating addresses

config/aggregator-route-matrix.csv

@@ -1,35 +1,24 @@
 kind,routeId,status,routeType,fromChainId,toChainId,tokenInSymbol,tokenInAddress,tokenOutSymbol,tokenOutAddress,hopCount,bridgeType,bridgeAddress,aggregatorFamilies,tags,intermediateSymbols,legRefs,notesOrReason
-liveSwapRoute,chain-138-swap-dodo-cusdt-cusdc-0x9e89bae0,live,swap,138,138,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0x9e89bae009adf128782e19e8341996c596ac40dc,Generated from live planner route graph.
-liveSwapRoute,chain-138-swap-dodo-cusdc-cusdt-0x9e89bae0,live,swap,138,138,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0x9e89bae009adf128782e19e8341996c596ac40dc,Generated from live planner route graph.
-liveSwapRoute,chain-138-swap-dodo-cusdt-usdt-0x866cb44b,live,swap,138,138,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0x866cb44b59303d8dc5f4f9e3e7a8e8b0bf238d66,Generated from live planner route graph.
-liveSwapRoute,chain-138-swap-dodo-usdt-cusdt-0x866cb44b,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0x866cb44b59303d8dc5f4f9e3e7a8e8b0bf238d66,Generated from live planner route graph.
-liveSwapRoute,chain-138-swap-dodo-cusdc-usdc-0xc39b7d0f,live,swap,138,138,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0xc39b7d0f40838cbfb54649d327f49a6dac964062,Generated from live planner route graph.
-liveSwapRoute,chain-138-swap-dodo-usdc-cusdc-0xc39b7d0f,live,swap,138,138,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0xc39b7d0f40838cbfb54649d327f49a6dac964062,Generated from live planner route graph.
-liveSwapRoute,chain-138-swap-dodo-v3-weth10-usdt-0x6550a3a5,live,swap,138,138,WETH10,0xf4bb2e28688e89fcce3c0580d37d36a7672e8a9f,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|dodo_v3,,0x6550a3a59070061a262a893a1d6f3f490affdbda,Generated from live planner route graph. | DODO v3 / D3MM Chain 138 pilot venue. | Canonical private pilot pool 0x6550a3a59070061a262a893a1d6f3f490affdbda executes through D3Proxy 0xc9a11abb7c63d88546be24d58a6d95e3762cb843. | Planner-v2 exposure and EnhancedSwapRouterV2 internal execution-plan calldata are live for the canonical pilot pair.
-liveSwapRoute,chain-138-swap-dodo-v3-usdt-weth10-0x6550a3a5,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,WETH10,0xf4bb2e28688e89fcce3c0580d37d36a7672e8a9f,1,,,1inch|0x|LiFi,planner-v2-generated|dodo_v3,,0x6550a3a59070061a262a893a1d6f3f490affdbda,Generated from live planner route graph. | DODO v3 / D3MM Chain 138 pilot venue. | Canonical private pilot pool 0x6550a3a59070061a262a893a1d6f3f490affdbda executes through D3Proxy 0xc9a11abb7c63d88546be24d58a6d95e3762cb843. | Planner-v2 exposure and EnhancedSwapRouterV2 internal execution-plan calldata are live for the canonical pilot pair.
-liveSwapRoute,chain-138-swap-uniswap-v3-weth-usdt,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|uniswap_v3,,0xde9cd8ee2811e6e64a41d5f68be315d33995975e,Generated from live planner route graph. | Chain 138 upstream-native Uniswap v3 WETH/USDT venue.
-liveSwapRoute,chain-138-swap-uniswap-v3-usdt-weth,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|uniswap_v3,,0xde9cd8ee2811e6e64a41d5f68be315d33995975e,Generated from live planner route graph. | Chain 138 upstream-native Uniswap v3 WETH/USDT venue.
-liveSwapRoute,chain-138-swap-uniswap-v3-weth-usdc,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,1,,,1inch|0x|LiFi,planner-v2-generated|uniswap_v3,,0xde9cd8ee2811e6e64a41d5f68be315d33995975e,Generated from live planner route graph. | Chain 138 upstream-native Uniswap v3 WETH/USDC venue.
-liveSwapRoute,chain-138-swap-uniswap-v3-usdc-weth,live,swap,138,138,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|uniswap_v3,,0xde9cd8ee2811e6e64a41d5f68be315d33995975e,Generated from live planner route graph. | Chain 138 upstream-native Uniswap v3 WETH/USDC venue.
-liveSwapRoute,chain-138-swap-balancer-weth-usdt,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|balancer,,0x96423d7c1727698d8a25ebfb88131e9422d1a3c3,Generated from live planner route graph. | Chain 138 pilot-compatible Balancer USDT/WETH venue.
-liveSwapRoute,chain-138-swap-balancer-usdt-weth,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|balancer,,0x96423d7c1727698d8a25ebfb88131e9422d1a3c3,Generated from live planner route graph. | Chain 138 pilot-compatible Balancer USDT/WETH venue.
-liveSwapRoute,chain-138-swap-balancer-weth-usdc,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,1,,,1inch|0x|LiFi,planner-v2-generated|balancer,,0x96423d7c1727698d8a25ebfb88131e9422d1a3c3,Generated from live planner route graph. | Chain 138 pilot-compatible Balancer USDC/WETH venue.
-liveSwapRoute,chain-138-swap-balancer-usdc-weth,live,swap,138,138,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|balancer,,0x96423d7c1727698d8a25ebfb88131e9422d1a3c3,Generated from live planner route graph. | Chain 138 pilot-compatible Balancer USDC/WETH venue.
-liveSwapRoute,chain-138-swap-curve-usdt-usdc,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,1,,,1inch|0x|LiFi,planner-v2-generated|curve,,0xe440ec15805be4c7babcd17a63b8c8a08a492e0f,Generated from live planner route graph. | Chain 138 pilot-compatible Curve 3Pool stable/stable venue.
-liveSwapRoute,chain-138-swap-curve-usdc-usdt,live,swap,138,138,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|curve,,0xe440ec15805be4c7babcd17a63b8c8a08a492e0f,Generated from live planner route graph. | Chain 138 pilot-compatible Curve 3Pool stable/stable venue.
-liveSwapRoute,chain-138-swap-one-inch-weth-usdt,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|one_inch,,0x500b84b1bc6f59c1898a5fe538ea20a758757a4f,Generated from live planner route graph. | Chain 138 pilot-compatible 1inch router lane.
-liveSwapRoute,chain-138-swap-one-inch-usdt-weth,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|one_inch,,0x500b84b1bc6f59c1898a5fe538ea20a758757a4f,Generated from live planner route graph. | Chain 138 pilot-compatible 1inch router lane.
-liveSwapRoute,chain-138-swap-one-inch-weth-usdc,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,1,,,1inch|0x|LiFi,planner-v2-generated|one_inch,,0x500b84b1bc6f59c1898a5fe538ea20a758757a4f,Generated from live planner route graph. | Chain 138 pilot-compatible 1inch router lane.
-liveSwapRoute,chain-138-swap-one-inch-usdc-weth,live,swap,138,138,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|one_inch,,0x500b84b1bc6f59c1898a5fe538ea20a758757a4f,Generated from live planner route graph. | Chain 138 pilot-compatible 1inch router lane.
-liveBridgeRoute,bridge-138-651940-cusdt-alltraadapter,live,bridge,138,651940,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,,ALT,0x66feba2fc9a0b47f26dd4284dad24f970436b8dc,1inch|0x|LiFi,planner-v2-generated|bridge,,,Generated from bridge registry and planner visibility. | Registry route AlltraAdapter
-liveBridgeRoute,bridge-138-651940-cusdc-alltraadapter,live,bridge,138,651940,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,,ALT,0x66feba2fc9a0b47f26dd4284dad24f970436b8dc,1inch|0x|LiFi,planner-v2-generated|bridge,,,Generated from bridge registry and planner visibility. | Registry route AlltraAdapter
-blockedOrPlannedRoute,chain-138-capability-dodo-planned-cbtc-cusdt,planned,swap,138,138,cBTC|cUSDT,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CUSDT after the canonical cBTC/cUSDT PMM pool is created and funded.
-blockedOrPlannedRoute,chain-138-capability-dodo-planned-cusdt-cbtc,planned,swap,138,138,cUSDT|cBTC,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CUSDT after the canonical cBTC/cUSDT PMM pool is created and funded.
-blockedOrPlannedRoute,chain-138-capability-dodo-planned-cbtc-cusdc,planned,swap,138,138,cBTC|cUSDC,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CUSDC after the canonical cBTC/cUSDC PMM pool is created and funded.
-blockedOrPlannedRoute,chain-138-capability-dodo-planned-cusdc-cbtc,planned,swap,138,138,cUSDC|cBTC,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CUSDC after the canonical cBTC/cUSDC PMM pool is created and funded.
-blockedOrPlannedRoute,chain-138-capability-dodo-planned-cbtc-cxauc,planned,swap,138,138,cBTC|cXAUC,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CXAUC after the canonical cBTC/cXAUC PMM pool is created and funded.
-blockedOrPlannedRoute,chain-138-capability-dodo-planned-cxauc-cbtc,planned,swap,138,138,cXAUC|cBTC,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CXAUC after the canonical cBTC/cXAUC PMM pool is created and funded.
-blockedOrPlannedRoute,chain-138-capability-dodo-planned-weth-usdt,planned,swap,138,138,WETH|USDT,,,,,,,,,,,Set CHAIN138_POOL_WETH_USDT after the canonical WETH/USDT pool is created and funded.
-blockedOrPlannedRoute,chain-138-capability-dodo-planned-usdt-weth,planned,swap,138,138,USDT|WETH,,,,,,,,,,,Set CHAIN138_POOL_WETH_USDT after the canonical WETH/USDT pool is created and funded.
-blockedOrPlannedRoute,chain-138-capability-dodo-planned-weth-usdc,planned,swap,138,138,WETH|USDC,,,,,,,,,,,Set CHAIN138_POOL_WETH_USDC after the canonical WETH/USDC pool is created and funded.
-blockedOrPlannedRoute,chain-138-capability-dodo-planned-usdc-weth,planned,swap,138,138,USDC|WETH,,,,,,,,,,,Set CHAIN138_POOL_WETH_USDC after the canonical WETH/USDC pool is created and funded.
+liveSwapRoute,138-cUSDT-cUSDC-direct,live,swap,138,138,cUSDT,0x93E66202A11B1772E55407B32B44e5Cd8eda7f22,cUSDC,0xf22258f57794CC8E06237084b353Ab30fFfa640b,1,,,1inch|0x|LiFi,stable|direct|public,,0xff8d3b8fDF7B112759F076B69f4271D4209C0849,
+liveSwapRoute,138-cUSDT-USDT-direct,live,swap,138,138,cUSDT,0x93E66202A11B1772E55407B32B44e5Cd8eda7f22,USDT,0x004b63A7B5b0E06f6bB6adb4a5F9f590BF3182D1,1,,,1inch|0x|LiFi,stable|official-mirror|public,,0x6fc60DEDc92a2047062294488539992710b99D71,
+liveSwapRoute,138-cUSDC-USDC-direct,live,swap,138,138,cUSDC,0xf22258f57794CC8E06237084b353Ab30fFfa640b,USDC,0x71D6687F38b93CCad569Fa6352c876eea967201b,1,,,1inch|0x|LiFi,stable|official-mirror|public,,0x0309178ae30302D83c76d6Dd402a684eF3160eec,
+liveSwapRoute,138-cUSDT-cXAUC-direct,live,swap,138,138,cUSDT,0x93E66202A11B1772E55407B32B44e5Cd8eda7f22,cXAUC,0x290E52a8819A4fbD0714E517225429aA2B70EC6b,1,,,1inch|0x|LiFi,xau-hub|public,,0x1AA55E2001E5651349AfF5A63FD7A7Ae44f0F1b0,
+liveSwapRoute,138-cUSDC-cXAUC-direct,live,swap,138,138,cUSDC,0xf22258f57794CC8E06237084b353Ab30fFfa640b,cXAUC,0x290E52a8819A4fbD0714E517225429aA2B70EC6b,1,,,1inch|0x|LiFi,xau-hub|public,,0xEA9Ac6357CaCB42a83b9082B870610363B177cBa,
+liveSwapRoute,138-cEURT-cXAUC-direct,live,swap,138,138,cEURT,0xdf4b71c61E5912712C1Bdd451416B9aC26949d72,cXAUC,0x290E52a8819A4fbD0714E517225429aA2B70EC6b,1,,,1inch|0x|LiFi,xau-hub|public,,0xbA99bc1eAAC164569d5AcA96C806934DDaF970Cf,
+liveSwapRoute,138-cEURT-cUSDT-via-cXAUC,live,swap,138,138,cEURT,0xdf4b71c61E5912712C1Bdd451416B9aC26949d72,cUSDT,0x93E66202A11B1772E55407B32B44e5Cd8eda7f22,2,,,1inch|0x|LiFi,multihop|xau-hub|public,cXAUC,0xbA99bc1eAAC164569d5AcA96C806934DDaF970Cf|0x1AA55E2001E5651349AfF5A63FD7A7Ae44f0F1b0,Inferred from two live public pools.
+liveSwapRoute,138-cEURT-cUSDC-via-cXAUC,live,swap,138,138,cEURT,0xdf4b71c61E5912712C1Bdd451416B9aC26949d72,cUSDC,0xf22258f57794CC8E06237084b353Ab30fFfa640b,2,,,1inch|0x|LiFi,multihop|xau-hub|public,cXAUC,0xbA99bc1eAAC164569d5AcA96C806934DDaF970Cf|0xEA9Ac6357CaCB42a83b9082B870610363B177cBa,Inferred from two live public pools.
+liveSwapRoute,138-cUSDT-cUSDC-via-cXAUC,live,swap,138,138,cUSDT,0x93E66202A11B1772E55407B32B44e5Cd8eda7f22,cUSDC,0xf22258f57794CC8E06237084b353Ab30fFfa640b,2,,,1inch|0x|LiFi,multihop|xau-hub|public|alternate,cXAUC,0x1AA55E2001E5651349AfF5A63FD7A7Ae44f0F1b0|0xEA9Ac6357CaCB42a83b9082B870610363B177cBa,Alternate path to the deeper direct cUSDT/cUSDC pool.
+liveBridgeRoute,138-WETH-1-ccip,live,bridge,138,1,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
+liveBridgeRoute,138-WETH-56-ccip,live,bridge,138,56,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
+liveBridgeRoute,138-WETH-137-ccip,live,bridge,138,137,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
+liveBridgeRoute,138-WETH-10-ccip,live,bridge,138,10,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
+liveBridgeRoute,138-WETH-42161-ccip,live,bridge,138,42161,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
+liveBridgeRoute,138-WETH-43114-ccip,live,bridge,138,43114,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
+liveBridgeRoute,138-WETH-8453-ccip,live,bridge,138,8453,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
+liveBridgeRoute,138-WETH-100-ccip,live,bridge,138,100,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
+liveBridgeRoute,138-WETH-25-ccip,live,bridge,138,25,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
+liveBridgeRoute,138-WETH-42220-ccip,live,bridge,138,42220,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
+liveBridgeRoute,138-WETH-651940-alltra,live,bridge,138,651940,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,ALT,0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc,LiFi,,,,
+liveBridgeRoute,138-WETH10-1-ccip,live,bridge,138,1,WETH10,0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f,WETH10,0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f,,CCIP,0xe0E93247376aa097dB308B92e6Ba36bA015535D0,LiFi,,,,
+blockedOrPlannedRoute,651940-public-dex-routes,planned,swap,651940,651940,,,,,,,,,,,,Alltra same-chain settlement remains documentation-only: no deployed PMM or Uniswap venue inventory is published in canonical deployment status, and HYDX/AlltraDEX router-factory-pool addresses are still not committed in-repo.
+blockedOrPlannedRoute,138-weth-1111-ccip,planned,bridge,138,1111,,,,,,,,,,,,"Wemix bridge contracts are deployed and destinations are wired, but the current Chain 138 CCIP router still rejects the Wemix selector with `CCIPRouter: chain not supported`; the WEMIX-side LINK balances are also zero and no successful proof transfer has been recorded."

config/aggregator-route-matrix.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "description": "Planner-v2-generated aggregator route visibility matrix for Chain 138 and approved bridge lanes.",
   "version": "2.0.0",
-  "updated": "2026-04-05T19:31:45.871Z",
+  "updated": "2026-04-21T22:30:18.877Z",
   "homeChainId": 138,
   "metadata": {
     "generatedFrom": [
@@ -11,7 +11,7 @@
       "services/token-aggregation/src/config/cross-chain-bridges.ts"
     ],
     "verification": {
-      "verifiedAt": "2026-04-05T19:31:45.871Z",
+      "verifiedAt": "2026-04-21T22:30:18.878Z",
       "verifiedBy": "services/token-aggregation planner-v2 generator",
       "rpc": "http://192.168.11.211:8545"
     },
@@ -64,7 +64,7 @@
       "kind": "compliant"
     },
     "cBTC": {
-      "address": "0xcb7c000000000000000000000000000000000138",
+      "address": "0xe94260c555ac1d9d3cc9e1632883452ebdf0082e",
       "decimals": 8,
       "kind": "monetary_unit"
     },
@@ -80,252 +80,6 @@
     }
   },
   "liveSwapRoutes": [
-    {
-      "routeId": "chain-138-swap-dodo-cusdt-cusdc-0x9e89bae0",
-      "status": "live",
-      "aggregatorFamilies": [
-        "1inch",
-        "0x",
-        "LiFi"
-      ],
-      "fromChainId": 138,
-      "toChainId": 138,
-      "tokenInSymbol": "cUSDT",
-      "tokenInAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
-      "tokenOutSymbol": "cUSDC",
-      "tokenOutAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
-      "routeType": "swap",
-      "hopCount": 1,
-      "label": "DODO PMM cUSDT -> cUSDC",
-      "intermediateSymbols": [],
-      "legs": [
-        {
-          "kind": "swap",
-          "protocol": "dodo_pmm",
-          "executor": "DODO PMM",
-          "executorAddress": "0x3f729632e9553ebaccde2e9b4c8f2b285b014f2e",
-          "poolAddress": "0x9e89bae009adf128782e19e8341996c596ac40dc",
-          "tokenInAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
-          "tokenOutAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
-          "reserves": {
-            "reserveIn": "999999997998",
-            "reserveOut": "999999997998"
-          }
-        }
-      ],
-      "tags": [
-        "planner-v2-generated",
-        "dodo"
-      ],
-      "notes": [
-        "Generated from live planner route graph."
-      ]
-    },
-    {
-      "routeId": "chain-138-swap-dodo-cusdc-cusdt-0x9e89bae0",
-      "status": "live",
-      "aggregatorFamilies": [
-        "1inch",
-        "0x",
-        "LiFi"
-      ],
-      "fromChainId": 138,
-      "toChainId": 138,
-      "tokenInSymbol": "cUSDC",
-      "tokenInAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
-      "tokenOutSymbol": "cUSDT",
-      "tokenOutAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
-      "routeType": "swap",
-      "hopCount": 1,
-      "label": "DODO PMM cUSDC -> cUSDT",
-      "intermediateSymbols": [],
-      "legs": [
-        {
-          "kind": "swap",
-          "protocol": "dodo_pmm",
-          "executor": "DODO PMM",
-          "executorAddress": "0x3f729632e9553ebaccde2e9b4c8f2b285b014f2e",
-          "poolAddress": "0x9e89bae009adf128782e19e8341996c596ac40dc",
-          "tokenInAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
-          "tokenOutAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
-          "reserves": {
-            "reserveIn": "999999997998",
-            "reserveOut": "999999997998"
-          }
-        }
-      ],
-      "tags": [
-        "planner-v2-generated",
-        "dodo"
-      ],
-      "notes": [
-        "Generated from live planner route graph."
-      ]
-    },
-    {
-      "routeId": "chain-138-swap-dodo-cusdt-usdt-0x866cb44b",
-      "status": "live",
-      "aggregatorFamilies": [
-        "1inch",
-        "0x",
-        "LiFi"
-      ],
-      "fromChainId": 138,
-      "toChainId": 138,
-      "tokenInSymbol": "cUSDT",
-      "tokenInAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
-      "tokenOutSymbol": "USDT",
-      "tokenOutAddress": "0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1",
-      "routeType": "swap",
-      "hopCount": 1,
-      "label": "DODO PMM cUSDT -> USDT",
-      "intermediateSymbols": [],
-      "legs": [
-        {
-          "kind": "swap",
-          "protocol": "dodo_pmm",
-          "executor": "DODO PMM",
-          "executorAddress": "0x3f729632e9553ebaccde2e9b4c8f2b285b014f2e",
-          "poolAddress": "0x866cb44b59303d8dc5f4f9e3e7a8e8b0bf238d66",
-          "tokenInAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
-          "tokenOutAddress": "0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1",
-          "reserves": {
-            "reserveIn": "999999997998",
-            "reserveOut": "999999997998"
-          }
-        }
-      ],
-      "tags": [
-        "planner-v2-generated",
-        "dodo"
-      ],
-      "notes": [
-        "Generated from live planner route graph."
-      ]
-    },
-    {
-      "routeId": "chain-138-swap-dodo-usdt-cusdt-0x866cb44b",
-      "status": "live",
-      "aggregatorFamilies": [
-        "1inch",
-        "0x",
-        "LiFi"
-      ],
-      "fromChainId": 138,
-      "toChainId": 138,
-      "tokenInSymbol": "USDT",
-      "tokenInAddress": "0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1",
-      "tokenOutSymbol": "cUSDT",
-      "tokenOutAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
-      "routeType": "swap",
-      "hopCount": 1,
-      "label": "DODO PMM USDT -> cUSDT",
-      "intermediateSymbols": [],
-      "legs": [
-        {
-          "kind": "swap",
-          "protocol": "dodo_pmm",
-          "executor": "DODO PMM",
-          "executorAddress": "0x3f729632e9553ebaccde2e9b4c8f2b285b014f2e",
-          "poolAddress": "0x866cb44b59303d8dc5f4f9e3e7a8e8b0bf238d66",
-          "tokenInAddress": "0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1",
-          "tokenOutAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
-          "reserves": {
-            "reserveIn": "999999997998",
-            "reserveOut": "999999997998"
-          }
-        }
-      ],
-      "tags": [
-        "planner-v2-generated",
-        "dodo"
-      ],
-      "notes": [
-        "Generated from live planner route graph."
-      ]
-    },
-    {
-      "routeId": "chain-138-swap-dodo-cusdc-usdc-0xc39b7d0f",
-      "status": "live",
-      "aggregatorFamilies": [
-        "1inch",
-        "0x",
-        "LiFi"
-      ],
-      "fromChainId": 138,
-      "toChainId": 138,
-      "tokenInSymbol": "cUSDC",
-      "tokenInAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
-      "tokenOutSymbol": "USDC",
-      "tokenOutAddress": "0x71d6687f38b93ccad569fa6352c876eea967201b",
-      "routeType": "swap",
-      "hopCount": 1,
-      "label": "DODO PMM cUSDC -> USDC",
-      "intermediateSymbols": [],
-      "legs": [
-        {
-          "kind": "swap",
-          "protocol": "dodo_pmm",
-          "executor": "DODO PMM",
-          "executorAddress": "0x3f729632e9553ebaccde2e9b4c8f2b285b014f2e",
-          "poolAddress": "0xc39b7d0f40838cbfb54649d327f49a6dac964062",
-          "tokenInAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
-          "tokenOutAddress": "0x71d6687f38b93ccad569fa6352c876eea967201b",
-          "reserves": {
-            "reserveIn": "999999997998",
-            "reserveOut": "999999997998"
-          }
-        }
-      ],
-      "tags": [
-        "planner-v2-generated",
-        "dodo"
-      ],
-      "notes": [
-        "Generated from live planner route graph."
-      ]
-    },
-    {
-      "routeId": "chain-138-swap-dodo-usdc-cusdc-0xc39b7d0f",
-      "status": "live",
-      "aggregatorFamilies": [
-        "1inch",
-        "0x",
-        "LiFi"
-      ],
-      "fromChainId": 138,
-      "toChainId": 138,
-      "tokenInSymbol": "USDC",
-      "tokenInAddress": "0x71d6687f38b93ccad569fa6352c876eea967201b",
-      "tokenOutSymbol": "cUSDC",
-      "tokenOutAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
-      "routeType": "swap",
-      "hopCount": 1,
-      "label": "DODO PMM USDC -> cUSDC",
-      "intermediateSymbols": [],
-      "legs": [
-        {
-          "kind": "swap",
-          "protocol": "dodo_pmm",
-          "executor": "DODO PMM",
-          "executorAddress": "0x3f729632e9553ebaccde2e9b4c8f2b285b014f2e",
-          "poolAddress": "0xc39b7d0f40838cbfb54649d327f49a6dac964062",
-          "tokenInAddress": "0x71d6687f38b93ccad569fa6352c876eea967201b",
-          "tokenOutAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
-          "reserves": {
-            "reserveIn": "999999997998",
-            "reserveOut": "999999997998"
-          }
-        }
-      ],
-      "tags": [
-        "planner-v2-generated",
-        "dodo"
-      ],
-      "notes": [
-        "Generated from live planner route graph."
-      ]
-    },
     {
       "routeId": "chain-138-swap-dodo-v3-weth10-usdt-0x6550a3a5",
       "status": "live",
@@ -990,6 +744,56 @@
     }
   ],
   "liveBridgeRoutes": [
+    {
+      "routeId": "bridge-138-1-cusdt-universalccipbridge",
+      "status": "live",
+      "aggregatorFamilies": [
+        "1inch",
+        "0x",
+        "LiFi"
+      ],
+      "fromChainId": 138,
+      "toChainId": 1,
+      "assetSymbol": "cUSDT",
+      "assetAddress": "0x93e66202a11b1772e55407b32b44e5cd8eda7f22",
+      "routeType": "bridge",
+      "bridgeType": "CCIP",
+      "bridgeAddress": "0xcd42e8ed79dc50599535d1de48d3dafa0be156f8",
+      "label": "UniversalCCIPBridge cUSDT 138 -> 1",
+      "tags": [
+        "planner-v2-generated",
+        "bridge"
+      ],
+      "notes": [
+        "Generated from bridge registry and planner visibility.",
+        "Registry route UniversalCCIPBridge"
+      ]
+    },
+    {
+      "routeId": "bridge-138-1-cusdc-universalccipbridge",
+      "status": "live",
+      "aggregatorFamilies": [
+        "1inch",
+        "0x",
+        "LiFi"
+      ],
+      "fromChainId": 138,
+      "toChainId": 1,
+      "assetSymbol": "cUSDC",
+      "assetAddress": "0xf22258f57794cc8e06237084b353ab30fffa640b",
+      "routeType": "bridge",
+      "bridgeType": "CCIP",
+      "bridgeAddress": "0xcd42e8ed79dc50599535d1de48d3dafa0be156f8",
+      "label": "UniversalCCIPBridge cUSDC 138 -> 1",
+      "tags": [
+        "planner-v2-generated",
+        "bridge"
+      ],
+      "notes": [
+        "Generated from bridge registry and planner visibility.",
+        "Registry route UniversalCCIPBridge"
+      ]
+    },
     {
       "routeId": "bridge-138-651940-cusdt-alltraadapter",
       "status": "live",
@@ -1041,126 +845,5 @@
       ]
     }
   ],
-  "blockedOrPlannedRoutes": [
-    {
-      "routeId": "chain-138-capability-dodo-planned-cbtc-cusdt",
-      "status": "planned",
-      "fromChainId": 138,
-      "toChainId": 138,
-      "routeType": "swap",
-      "reason": "Set CHAIN138_POOL_CBTC_CUSDT after the canonical cBTC/cUSDT PMM pool is created and funded.",
-      "tokenInSymbols": [
-        "cBTC",
-        "cUSDT"
-      ]
-    },
-    {
-      "routeId": "chain-138-capability-dodo-planned-cusdt-cbtc",
-      "status": "planned",
-      "fromChainId": 138,
-      "toChainId": 138,
-      "routeType": "swap",
-      "reason": "Set CHAIN138_POOL_CBTC_CUSDT after the canonical cBTC/cUSDT PMM pool is created and funded.",
-      "tokenInSymbols": [
-        "cUSDT",
-        "cBTC"
-      ]
-    },
-    {
-      "routeId": "chain-138-capability-dodo-planned-cbtc-cusdc",
-      "status": "planned",
-      "fromChainId": 138,
-      "toChainId": 138,
-      "routeType": "swap",
-      "reason": "Set CHAIN138_POOL_CBTC_CUSDC after the canonical cBTC/cUSDC PMM pool is created and funded.",
-      "tokenInSymbols": [
-        "cBTC",
-        "cUSDC"
-      ]
-    },
-    {
-      "routeId": "chain-138-capability-dodo-planned-cusdc-cbtc",
-      "status": "planned",
-      "fromChainId": 138,
-      "toChainId": 138,
-      "routeType": "swap",
-      "reason": "Set CHAIN138_POOL_CBTC_CUSDC after the canonical cBTC/cUSDC PMM pool is created and funded.",
-      "tokenInSymbols": [
-        "cUSDC",
-        "cBTC"
-      ]
-    },
-    {
-      "routeId": "chain-138-capability-dodo-planned-cbtc-cxauc",
-      "status": "planned",
-      "fromChainId": 138,
-      "toChainId": 138,
-      "routeType": "swap",
-      "reason": "Set CHAIN138_POOL_CBTC_CXAUC after the canonical cBTC/cXAUC PMM pool is created and funded.",
-      "tokenInSymbols": [
-        "cBTC",
-        "cXAUC"
-      ]
-    },
-    {
-      "routeId": "chain-138-capability-dodo-planned-cxauc-cbtc",
-      "status": "planned",
-      "fromChainId": 138,
-      "toChainId": 138,
-      "routeType": "swap",
-      "reason": "Set CHAIN138_POOL_CBTC_CXAUC after the canonical cBTC/cXAUC PMM pool is created and funded.",
-      "tokenInSymbols": [
-        "cXAUC",
-        "cBTC"
-      ]
-    },
-    {
-      "routeId": "chain-138-capability-dodo-planned-weth-usdt",
-      "status": "planned",
-      "fromChainId": 138,
-      "toChainId": 138,
-      "routeType": "swap",
-      "reason": "Set CHAIN138_POOL_WETH_USDT after the canonical WETH/USDT pool is created and funded.",
-      "tokenInSymbols": [
-        "WETH",
-        "USDT"
-      ]
-    },
-    {
-      "routeId": "chain-138-capability-dodo-planned-usdt-weth",
-      "status": "planned",
-      "fromChainId": 138,
-      "toChainId": 138,
-      "routeType": "swap",
-      "reason": "Set CHAIN138_POOL_WETH_USDT after the canonical WETH/USDT pool is created and funded.",
-      "tokenInSymbols": [
-        "USDT",
-        "WETH"
-      ]
-    },
-    {
-      "routeId": "chain-138-capability-dodo-planned-weth-usdc",
-      "status": "planned",
-      "fromChainId": 138,
-      "toChainId": 138,
-      "routeType": "swap",
-      "reason": "Set CHAIN138_POOL_WETH_USDC after the canonical WETH/USDC pool is created and funded.",
-      "tokenInSymbols": [
-        "WETH",
-        "USDC"
-      ]
-    },
-    {
-      "routeId": "chain-138-capability-dodo-planned-usdc-weth",
-      "status": "planned",
-      "fromChainId": 138,
-      "toChainId": 138,
-      "routeType": "swap",
-      "reason": "Set CHAIN138_POOL_WETH_USDC after the canonical WETH/USDC pool is created and funded.",
-      "tokenInSymbols": [
-        "USDC",
-        "WETH"
-      ]
-    }
-  ]
+  "blockedOrPlannedRoutes": []
 }

config/all-mainnet-canary-evidence.example.json

@@ -0,0 +1,23 @@
+{
+  "description": "Copy to config/all-mainnet-canary-evidence.json after live canary swaps. Each row needs real transaction hashes and observed balance deltas.",
+  "evidence": [
+    {
+      "poolId": "651940-uniswap_v2-wall-ausdc",
+      "status": "canary_passed",
+      "generatedAt": "2026-04-29T00:00:00.000Z",
+      "canaryTransactions": [
+        {
+          "amountLabel": "seed",
+          "txHash": "0x0000000000000000000000000000000000000000000000000000000000000000",
+          "sourceToken": "WALL",
+          "destinationToken": "AUSDC",
+          "observedInputRaw": "0",
+          "observedOutputRaw": "0"
+        }
+      ],
+      "notes": [
+        "Replace with real canary transaction evidence before applying."
+      ]
+    }
+  ]
+}

config/all-mainnet-canary-evidence.json

@@ -0,0 +1,77 @@
+{
+  "description": "ALL Mainnet canary evidence recorded from live canary transactions executed with deployer wallet 0x4A666F96fC8764181194447A7dFdb7d471b301C8.",
+  "evidence": [
+    {
+      "poolId": "651940-dodo_pmm-wall-ausdc",
+      "generatedAt": "2026-04-29T04:41:13.993Z",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x727cea66f601b514b0d82c4bc93c29fbc09047e8185c146a05564dce7916829c",
+          "fundingTransferTxHash": "0x65f8d2e15556c26b46dd7323a90cb174279fc6bd0e7002a868553dc990bfa656",
+          "amountInRaw": "1000000",
+          "tokenIn": "WALL",
+          "tokenOut": "AUSDC",
+          "executor": "DODO_DVM.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Tiny live canary swap executed on ALL Mainnet DODO PMM WALL/AUSDC."
+      ]
+    },
+    {
+      "poolId": "651940-uniswap_v2-wall-ausdc",
+      "generatedAt": "2026-04-29T04:41:13.993Z",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x0b76149f25e36919637fbeab10056e45d8ab7757454174966842c3f52f53dd5c",
+          "approvalTxHash": "0xc33d872d15628cfe521552ccc9a4b908f31df59189764468775b4557826514b6",
+          "amountInRaw": "1000000",
+          "tokenIn": "WALL",
+          "tokenOut": "AUSDC",
+          "executor": "UniswapV2Router.swapExactTokensForTokens"
+        }
+      ],
+      "notes": [
+        "Tiny live canary swap executed on ALL Mainnet Uniswap V2 WALL/AUSDC."
+      ]
+    },
+    {
+      "poolId": "137-dodo_pmm-cwusdc-usdc",
+      "generatedAt": "2026-04-29T04:41:13.993Z",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x4f68cdb0502b0fd50602013e54cbf898556a5c1181d8009f9b0c166dfccf5ce7",
+          "fundingTransferTxHash": "0x2b2721dd505f82488b05f32810f7e94b3a712e9b459b638be9b8ea34c20925d9",
+          "amountInRaw": "1",
+          "tokenIn": "cWUSDC",
+          "tokenOut": "USDC",
+          "executor": "DODO_DVM.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Tiny live canary swap executed on Polygon DODO PMM cWUSDC/USDC."
+      ]
+    },
+    {
+      "poolId": "137-dodo_pmm-cwusdt-usdt",
+      "generatedAt": "2026-04-29T04:41:13.993Z",
+      "canaryTransactions": [
+        {
+          "direction": "base_to_quote",
+          "txHash": "0x9c946c7c912e2eabe960c752041b533948e85e2a1603c80de80c5b0ee447908d",
+          "fundingTransferTxHash": "0xcac8b9187325869f164f6b7cd5464fcf46dce6be83ef04d760e7ecc21de7d40d",
+          "amountInRaw": "1",
+          "tokenIn": "cWUSDT",
+          "tokenOut": "USDT",
+          "executor": "DODO_DVM.transfer_then_sellBase"
+        }
+      ],
+      "notes": [
+        "Tiny live canary swap executed on Polygon DODO PMM cWUSDT/USDT."
+      ]
+    }
+  ]
+}

config/all-mainnet-enhanced-router-deployment.json

@@ -0,0 +1,147 @@
+{
+  "name": "ALL Mainnet Enhanced Router Deployment Evidence",
+  "version": "0.1.0",
+  "generatedAt": "2026-04-29T05:52:00Z",
+  "chainId": 651940,
+  "network": "ALL Mainnet (Alltra)",
+  "evmVersion": "paris",
+  "reason": "ALL Mainnet RPC/runtime rejected Cancun bytecode with BadInstruction; Paris bytecode was used for live deployment.",
+  "deployer": "0x4A666F96fC8764181194447A7dFdb7d471b301C8",
+  "contracts": {
+    "dodoPmmProvider": {
+      "address": "0x36F65027D21e151F0b7810bae1E94b225AC7Ba9e",
+      "transactionHash": "0xd2e69b556e84786338fd526ba149d1f88488a07190d081f935d7fffbe9d1b2e0",
+      "constructorArgs": {
+        "dodoPmmIntegration": "0x8528E268F3b8C94208d09D131ACa3Ea93Bad57c7",
+        "admin": "0x4A666F96fC8764181194447A7dFdb7d471b301C8"
+      }
+    },
+    "enhancedSwapRouterV2": {
+      "address": "0xb905fEfA56b028221E2Bc248Bbcd41141dc7aeD3",
+      "transactionHash": "0x2c5d409b6e06cbfb69d8e251240d830d624625a4d505cc963edb65b55623bc79",
+      "constructorArgs": {
+        "weth": "0x798F6762BB40d6801A593459d08F890603D3979C",
+        "usdt": "0x66D8Efa0AF63B0e84eb1Dd72bf00f00cd1e2234e",
+        "usdc": "0xa95EeD79f84E6A0151eaEb9d441F9Ffd50e8e881",
+        "daiSlot": "0x015B1897Ed5279930bC2Be46F661894d219292A6",
+        "daiSlotNote": "AUSDT is used as the third stablecoin slot for ALL Mainnet; no canonical ALL DAI token is committed."
+      }
+    },
+    "intentBridgeCoordinatorV2": {
+      "address": "0x9276ae27d9c624B43dbE43494f34A9c5F0233a0B",
+      "transactionHash": "0x5695b3f9ec59e09d5e4f8569ea8af31578ced0a56aba885a7c475a5187aadd3d"
+    },
+    "adapters": {
+      "dodo": {
+        "address": "0x391D192BED6188c4DaB4C93c078bD18432687474",
+        "transactionHash": "0xc4a036a6fff5eb9886e797559017cf8709505d13f39f5feddf055967cf9b4648",
+        "enabled": true
+      },
+      "dodoV3": {
+        "address": "0x97Ce874142625134aEEBDF42B5E7bB806e731D25",
+        "transactionHash": "0x5ad21f59b823adbc2cebc1e9c45ab3f8f0f1286e46a290c09c0667f499577136",
+        "enabled": false
+      },
+      "uniswapV3": {
+        "address": "0xBF75F3401de20bebBB1CBb678499941807E3E040",
+        "transactionHash": "0x081b86cc99306e694ef9daa3d3f9dc7f35ce91dce08c57ddaedcdd4b9a00008d",
+        "enabled": false
+      },
+      "balancer": {
+        "address": "0xDE7F15AF1D84e3694f7E966293d20e64Fc04d9fF",
+        "transactionHash": "0xa4f30c029fa062ae1b481786950ab0243541ce5b0b859fc534b55f7b444ba83c",
+        "enabled": false
+      },
+      "curve": {
+        "address": "0x753D2b0a723992D7B174D6e19F7b7Cb74be8D61a",
+        "transactionHash": "0xcdf0ff9723aedab96aeaa0b8f57f25ad6075f9467e0d19f3b842fb17c0bb6a79",
+        "enabled": false
+      },
+      "oneInch": {
+        "address": "0x487090bbb7d17875281692d582a11B445b3A7AC7",
+        "transactionHash": "0x4d0dd682b8e22812a258fee497c07e5cecfbc1228f413e67d9fe7b24f327a926",
+        "enabled": false
+      }
+    }
+  },
+  "routes": [
+    {
+      "poolId": "651940-dodo_pmm-wall-ausdc",
+      "provider": "dodo",
+      "tokenA": {
+        "symbol": "WALL",
+        "address": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4"
+      },
+      "tokenB": {
+        "symbol": "AUSDC",
+        "address": "0xa95EeD79f84E6A0151eaEb9d441F9Ffd50e8e881"
+      },
+      "poolAddress": "0x7b81Dad382BBB57e91a80389bA48e41Abd10794F",
+      "status": "quoteable",
+      "verification": {
+        "amountInRaw": "1000000",
+        "amountOutRaw": "1999999",
+        "slippageBps": 30,
+        "routerQuoteExecutable": true
+      }
+    },
+    {
+      "poolId": "651940-dodo_pmm-wall-ausdt",
+      "provider": "dodo",
+      "tokenA": {
+        "symbol": "WALL",
+        "address": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4"
+      },
+      "tokenB": {
+        "symbol": "AUSDT",
+        "address": "0x015B1897Ed5279930bC2Be46F661894d219292A6"
+      },
+      "poolAddress": "0x8D9bB238B6a76a438B116Ff22F5F7535191D49b4",
+      "status": "quoteable",
+      "verification": {
+        "amountInRaw": "1000000",
+        "amountOutRaw": "1999999",
+        "slippageBps": 30,
+        "routerQuoteExecutable": true
+      }
+    }
+  ],
+  "providerStatus": {
+    "enabled": [
+      "dodo"
+    ],
+    "disabled": [
+      "dodoV3",
+      "uniswapV3",
+      "balancer",
+      "curve",
+      "oneInch",
+      "partner"
+    ]
+  },
+  "remainingOptionalBlockers": [
+    "HYDX-native router/factory is not deployed or not committed in inventory.",
+    "Uniswap V3 factory/router/quoter/pool stack is not deployed or not committed in inventory."
+  ],
+  "disabledRoutes": [
+    {
+      "poolId": "651940-dodo_pmm-wall-usdt",
+      "provider": "dodo",
+      "tokenA": {
+        "symbol": "WALL",
+        "address": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4"
+      },
+      "tokenB": {
+        "symbol": "USDT",
+        "address": "0x66D8Efa0AF63B0e84eb1Dd72bf00f00cd1e2234e"
+      },
+      "poolAddress": "0x261D7e1447EE88398B2b5a274D49454F5B86800E",
+      "status": "disabled_wrong_quote_asset",
+      "reason": "AUSDT is the canonical ALL Mainnet cUSDT surface for this routing set.",
+      "disabledTransactions": [
+        "0x79f171ddc9977e99bb894bf7ff7a11a430441cc1285e7ecd747907ef3f23a0c4",
+        "0xec74f92e287cf1e193e791462f66b35cf9487ece8e343108fbdd3de760dc5c55"
+      ]
+    }
+  ]
+}

config/all-mainnet-uniswap-v3-deployment.json

@@ -0,0 +1,68 @@
+{
+  "generatedAt": "2026-04-29T06:18:00Z",
+  "chainId": 651940,
+  "deployer": "0x4A666F96fC8764181194447A7dFdb7d471b301C8",
+  "fee": 3000,
+  "tokens": {
+    "WETH": "0x798F6762BB40d6801A593459d08F890603D3979C",
+    "WALL": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4",
+    "AUSDT": "0x015B1897Ed5279930bC2Be46F661894d219292A6",
+    "token0": "0x015B1897Ed5279930bC2Be46F661894d219292A6",
+    "token1": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4"
+  },
+  "contracts": {
+    "nftDescriptorLibrary": "0xb53E8A0A19fB381537c6f28D37b7C2f7DC29EF02",
+    "nonfungibleTokenPositionDescriptor": "0x2a76C73458A0C11df4e0E43004598480d6D1E768",
+    "factory": "0xF1a334465C5DD628492780B39Be68D561A9AecA2",
+    "swapRouter": "0xe9Ea1B70803c18C4CEb8839D5D68681c7903511B",
+    "quoter": "0x0ecC56077325863c80cbe516D63e0afAFf7EA579",
+    "quoterV2": "0x024Ff178BaB7e6fa1794c3A216D2B299C3F295d2",
+    "nonfungiblePositionManager": "0xD29422211e1f2C1015FBb5dC2004657Dd8318aF6",
+    "pool": "0x9e0FC06BA367b51a0aBc5c0924306088DBB0e9c4"
+  },
+  "transactions": {
+    "nftDescriptorLibrary": "0x774202382ec2d29cced671b34c2b951682f60d3e60afd7fe64c13488cb341e32",
+    "nonfungibleTokenPositionDescriptor": "0xc6b98fc36e4c3b1d4d2e80efd4acacc31e2af2ff45de04f9fb066dcfffd380d3",
+    "factory": "0xb6e46b6d145cc707f12f4cf8980bf81d7b5b8d3bea9416737a7465c186b0fefd",
+    "swapRouter": "0x5fd7d021e8ac1bad918a1eb470a116f9dc6e750c102a5512e05391858296cc53",
+    "quoter": "0x0d5c14d3264c5abd70990349911a6eb3076f41feb2db93ccf74b2de022cd087f",
+    "quoterV2": "0x774327c7e7a7650fbfd9d28a8becbd88f86eb8f942a825980052bc50484aa54c",
+    "nonfungiblePositionManager": "0xe5be3fa83bd676051e2cc5ff990768d3de87e49a387d94be77352eaf1c38545f"
+  },
+  "poolState": {
+    "sqrtPriceX96": "79228162514264337593543950336",
+    "tick": 0,
+    "liquidity": "1000000000000000000"
+  },
+  "name": "ALL Mainnet Uniswap V3 Deployment Evidence",
+  "version": "0.1.0",
+  "network": "ALL Mainnet (Alltra)",
+  "evmVersion": "upstream-uniswap-artifacts-solc-0.7.x",
+  "packageSources": {
+    "v3Core": "@uniswap/v3-core@1.0.1",
+    "v3Periphery": "@uniswap/v3-periphery@1.4.4",
+    "swapRouterContracts": "@uniswap/swap-router-contracts@1.3.1"
+  },
+  "poolStateAfterRouterSwap": {
+    "testedAt": "2026-04-29T06:17:00Z",
+    "swapRouter": "0xe9Ea1B70803c18C4CEb8839D5D68681c7903511B",
+    "direction": "WALL_TO_AUSDT",
+    "amountInRaw": "1000000",
+    "amountOutRaw": "996999",
+    "approveTxHash": "0x572d1c6b2d0cdf6248913cd995e80196fbe0717017411c2251637afbfa825e1f",
+    "swapTxHash": "0xddf85aed18a6d872ac72d4f57b241e44946881e404f4f17cb7271180c8caa183",
+    "gasUsed": "119111"
+  },
+  "enhancedRouterIntegration": {
+    "enhancedSwapRouterV2": "0xb905fEfA56b028221E2Bc248Bbcd41141dc7aeD3",
+    "routeConfigured": true,
+    "providerEnabled": false,
+    "providerDisabledReason": "Existing UniswapV3RouteExecutorAdapter uses staticcall into the official Uniswap Quoter; the upstream Quoter is callable directly but does not return through that adapter staticcall path. Standalone SwapRouter/Quoter/Pool stack is live; enhanced-router V3 provider remains disabled until adapter quote compatibility is fixed.",
+    "routeSetTransactions": [
+      "0xa40b24889ab3ad985936562ee3690dafd14bfb1676ff49806a6fcb45c7704ef5",
+      "0x848fd6c7cedaebe7787c2f15a931b73afde709dac100cb745eab2d9eaa6da86c"
+    ],
+    "providerEnableTxHash": "0x4b430081582e1f2db5fedc904b8e90e137480dcae2f1e0a41dd25490f05394c7",
+    "providerDisableTxHash": "0x78b8ce4fdc296585ace36dd8c8318731cc5526115e712b14d1ad630c4f63aba6"
+  }
+}

config/all-mainnet-vault-assignments.example.json

@@ -0,0 +1,27 @@
+{
+  "description": "Copy to config/all-mainnet-vault-assignments.json and replace placeholder addresses with approved per-role vaults/multisigs. The apply script refuses placeholders.",
+  "defaultByRole": {
+    "treasury_reserve": "0x0000000000000000000000000000000000000000",
+    "bridge_liquidity": "0x0000000000000000000000000000000000000000",
+    "protocol_adapter": "0x0000000000000000000000000000000000000000",
+    "emergency_withdraw": "0x0000000000000000000000000000000000000000",
+    "single_sided_inventory": "0x0000000000000000000000000000000000000000"
+  },
+  "byChain": {
+    "651940": {
+      "treasury_reserve": "0x0000000000000000000000000000000000000000",
+      "bridge_liquidity": "0x0000000000000000000000000000000000000000",
+      "protocol_adapter": "0x0000000000000000000000000000000000000000",
+      "emergency_withdraw": "0x0000000000000000000000000000000000000000",
+      "single_sided_inventory": "0x0000000000000000000000000000000000000000"
+    }
+  },
+  "byPoolId": {
+    "651940-uniswap_v2-wall-ausdc": {
+      "treasury_reserve": "0x0000000000000000000000000000000000000000",
+      "bridge_liquidity": "0x0000000000000000000000000000000000000000",
+      "protocol_adapter": "0x0000000000000000000000000000000000000000",
+      "emergency_withdraw": "0x0000000000000000000000000000000000000000"
+    }
+  }
+}

config/all-mainnet-vault-assignments.json

@@ -0,0 +1,20 @@
+{
+  "description": "Operational vault assignments generated from smom-dbis-138/.env public addresses. No private material is stored here.",
+  "defaultByRole": {
+    "treasury_reserve": "0x74eccf9affb0e0938c2168ebdf7ef63a26964483",
+    "bridge_liquidity": "0x31884f84555210FFB36a19D2471b8eBc7372d0A8",
+    "protocol_adapter": "0xb9E29cFa1f89d369671E640d0BB3aD94Cab43965",
+    "emergency_withdraw": "0xb9E29cFa1f89d369671E640d0BB3aD94Cab43965",
+    "single_sided_inventory": "0x31884f84555210FFB36a19D2471b8eBc7372d0A8"
+  },
+  "byChain": {
+    "651940": {
+      "treasury_reserve": "0x74eccf9affb0e0938c2168ebdf7ef63a26964483",
+      "bridge_liquidity": "0x31884f84555210FFB36a19D2471b8eBc7372d0A8",
+      "protocol_adapter": "0xb9E29cFa1f89d369671E640d0BB3aD94Cab43965",
+      "emergency_withdraw": "0xb9E29cFa1f89d369671E640d0BB3aD94Cab43965",
+      "single_sided_inventory": "0x31884f84555210FFB36a19D2471b8eBc7372d0A8"
+    }
+  },
+  "byPoolId": {}
+}

config/allmainnet-non-dodo-protocol-surface.json

@@ -0,0 +1,973 @@
+{
+  "name": "ALL Mainnet Non-DODO Protocol Surface",
+  "version": "0.1.0",
+  "updated": "2026-04-29",
+  "chainId": 651940,
+  "network": "ALL Mainnet (Alltra)",
+  "status": "bridge_live_enhanced_router_partial_swap_inventory_published",
+  "summary": {
+    "bridgeOnlyLive": false,
+    "sameChainSwapInventoryPublished": true,
+    "notes": [
+      "The Chain 138 <-> 651940 AlltraAdapter bridge is live.",
+      "This file documents the known non-DODO Alltra protocol and token surface plus the committed same-chain inventory fragments that have real factory/router/pool addresses in config/all-mainnet-pool-creation-matrix.json.",
+      "Same-chain inventory publication is partial: production routing remains gated by required vault assignments, funding, live reserve reads, and canary evidence.",
+      "ALL Mainnet EnhancedSwapRouterV2 is deployed and DODO-backed routes are wired for the committed WALL/AUSDC and WALL/AUSDT DODO PMM pools; the earlier WALL/USDT route is disabled because AUSDT is the canonical ALL Mainnet cUSDT surface."
+    ]
+  },
+  "classificationFramework": {
+    "category": [
+      "tokenized-fiat",
+      "stablecoin",
+      "wrapped-native",
+      "dex-token",
+      "defi-token",
+      "governance-token",
+      "utility-token",
+      "rwa-token",
+      "commodity-token",
+      "other"
+    ],
+    "instrumentType": [
+      "emoney",
+      "deposit-token",
+      "fiat-backed-stablecoin",
+      "wrapped-native",
+      "protocol-token",
+      "governance-token",
+      "utility-token",
+      "other"
+    ],
+    "backingAssets": [
+      "cash",
+      "cash-equivalents",
+      "bank-deposits",
+      "treasuries",
+      "commodity-reserves",
+      "protocol-utility",
+      "native-gas-asset",
+      "unknown"
+    ],
+    "metadataDomains": [
+      "backingMetadata",
+      "bridgeMetadata",
+      "cashMetadata",
+      "commodityMetadata",
+      "reserveMetadata",
+      "securityMetadata",
+      "settlementMetadata"
+    ],
+    "notes": [
+      "Use category for the broad asset bucket.",
+      "Use instrumentType, issuerType, claimType, backingAssets, capabilities, and tags for legal, reserve, and integration semantics.",
+      "Use cash only as a backing, redemption, or settlement asset descriptor; do not use cash as the token category unless the instrument is literally cash-equivalent legal tender.",
+      "Use commodityMetadata only when the token directly references or is backed by a commodity reserve.",
+      "Use securityMetadata for pause/admin/monitoring controls; unknown means not yet committed in this inventory, not absent on-chain.",
+      "GRU tags use lowercase namespace:value strings and include the version, for example gru:v2."
+    ]
+  },
+  "documentedTokens": [
+    {
+      "symbol": "AUSDT",
+      "address": "0x015B1897Ed5279930bC2Be46F661894d219292A6",
+      "decimals": 18,
+      "category": "tokenized-fiat",
+      "instrumentType": "fiat-backed-stablecoin",
+      "issuerType": "token-issuer-unverified",
+      "currencyCode": "USD",
+      "claimType": "claim-on-issuer-unverified",
+      "settlementAssetClass": "fiat",
+      "backingAssets": [
+        "cash",
+        "cash-equivalents"
+      ],
+      "gruVersion": "v2",
+      "gruFamilySymbol": "cAUSDT",
+      "gruTransportRole": "all-mainnet-primary-surface",
+      "tags": [
+        "tokenized-fiat",
+        "fiat:usd",
+        "backing:cash",
+        "backing:cash-equivalents",
+        "gru:v2",
+        "gru:m1",
+        "gru:transport",
+        "gru:all-mainnet",
+        "gru:causdt-family"
+      ],
+      "backingMetadata": {
+        "backingModel": "fiat-reserve-backed",
+        "backingAssetClasses": [
+          "cash",
+          "cash-equivalents"
+        ],
+        "backingVerificationStatus": "reserve-disclosure-not-committed",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "live-canonical-target",
+        "bridgeKind": "AlltraAdapter",
+        "sourceChainId": 138,
+        "destinationChainId": 651940,
+        "sourceSymbol": "cUSDT",
+        "sourceAddress": "0x93E66202A11B1772E55407B32B44e5Cd8eda7f22",
+        "destinationSymbol": "AUSDT",
+        "destinationAddress": "0x015B1897Ed5279930bC2Be46F661894d219292A6",
+        "adapterAddress": "0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc",
+        "bridgeCanonicalAssetVersion": "gru-v2",
+        "bridgeMirroredAssetVersion": "all-mainnet-surface"
+      },
+      "cashMetadata": {
+        "cashRole": "reserve-and-redemption-asset-class",
+        "currency": "USD",
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "issuer-or-bridge-reserve-unverified",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": null,
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "pending-disclosure",
+        "riskTier": "policy-review-required",
+        "registryStatus": "documented-surface-not-stablecoin-registry-entry"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "corridor-halt-required-for-issuer-bridge-or-peg-risk",
+        "monitoring": [
+          "peg-deviation",
+          "bridge-health",
+          "liquidity-depth",
+          "contract-admin-changes"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "fiat",
+        "settlementCurrency": "USD",
+        "settlementFinalityDomain": "off-chain-regulated-ledger-or-issuer-domain",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": true,
+        "redemptionPath": "issuer-or-bridge-redemption-unverified",
+        "parRedemption": "unverified"
+      },
+      "status": "verified"
+    },
+    {
+      "symbol": "USDT",
+      "address": "0x66D8Efa0AF63B0e84eb1Dd72bf00f00cd1e2234e",
+      "decimals": 18,
+      "category": "tokenized-fiat",
+      "instrumentType": "fiat-backed-stablecoin",
+      "issuerType": "token-issuer-unverified",
+      "currencyCode": "USD",
+      "claimType": "claim-on-issuer-unverified",
+      "settlementAssetClass": "fiat",
+      "backingAssets": [
+        "cash",
+        "cash-equivalents"
+      ],
+      "gruVersion": "v2",
+      "gruFamilySymbol": "cUSDT",
+      "gruTransportRole": "all-mainnet-usdt-surface",
+      "tags": [
+        "tokenized-fiat",
+        "fiat:usd",
+        "backing:cash",
+        "backing:cash-equivalents",
+        "gru:v2",
+        "gru:m1",
+        "gru:transport",
+        "gru:all-mainnet",
+        "gru:cusdt-family"
+      ],
+      "backingMetadata": {
+        "backingModel": "fiat-reserve-backed",
+        "backingAssetClasses": [
+          "cash",
+          "cash-equivalents"
+        ],
+        "backingVerificationStatus": "reserve-disclosure-not-committed",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "documented-token-not-canonical-138-to-651940-target",
+        "bridgeKind": "unknown-or-noncanonical",
+        "sourceChainId": null,
+        "destinationChainId": 651940,
+        "sourceSymbol": null,
+        "sourceAddress": null,
+        "destinationSymbol": "USDT",
+        "destinationAddress": "0x66D8Efa0AF63B0e84eb1Dd72bf00f00cd1e2234e",
+        "adapterAddress": null,
+        "bridgeCanonicalAssetVersion": null,
+        "bridgeMirroredAssetVersion": "all-mainnet-surface"
+      },
+      "cashMetadata": {
+        "cashRole": "reserve-and-redemption-asset-class",
+        "currency": "USD",
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "issuer-reserve-unverified",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": null,
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "pending-disclosure",
+        "riskTier": "policy-review-required",
+        "registryStatus": "documented-surface-not-stablecoin-registry-entry"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "corridor-halt-required-for-issuer-or-peg-risk",
+        "monitoring": [
+          "peg-deviation",
+          "liquidity-depth",
+          "contract-admin-changes"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "fiat",
+        "settlementCurrency": "USD",
+        "settlementFinalityDomain": "off-chain-issuer-domain",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": true,
+        "redemptionPath": "issuer-redemption-unverified",
+        "parRedemption": "unverified"
+      },
+      "status": "verified"
+    },
+    {
+      "symbol": "USDC",
+      "address": "0xa95EeD79f84E6A0151eaEb9d441F9Ffd50e8e881",
+      "decimals": 18,
+      "category": "tokenized-fiat",
+      "instrumentType": "fiat-backed-stablecoin",
+      "issuerType": "token-issuer-unverified",
+      "currencyCode": "USD",
+      "claimType": "claim-on-issuer-unverified",
+      "settlementAssetClass": "fiat",
+      "backingAssets": [
+        "cash",
+        "cash-equivalents"
+      ],
+      "gruVersion": "v2",
+      "gruFamilySymbol": "cUSDC",
+      "gruTransportRole": "all-mainnet-usdc-surface",
+      "tags": [
+        "tokenized-fiat",
+        "fiat:usd",
+        "backing:cash",
+        "backing:cash-equivalents",
+        "gru:v2",
+        "gru:m1",
+        "gru:transport",
+        "gru:all-mainnet",
+        "gru:cusdc-family"
+      ],
+      "backingMetadata": {
+        "backingModel": "fiat-reserve-backed",
+        "backingAssetClasses": [
+          "cash",
+          "cash-equivalents"
+        ],
+        "backingVerificationStatus": "reserve-disclosure-not-committed",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "live-canonical-target",
+        "bridgeKind": "AlltraAdapter",
+        "sourceChainId": 138,
+        "destinationChainId": 651940,
+        "sourceSymbol": "cUSDC",
+        "sourceAddress": "0xf22258f57794CC8E06237084b353Ab30fFfa640b",
+        "destinationSymbol": "USDC",
+        "destinationAddress": "0xa95EeD79f84E6A0151eaEb9d441F9Ffd50e8e881",
+        "adapterAddress": "0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc",
+        "bridgeCanonicalAssetVersion": "gru-v2",
+        "bridgeMirroredAssetVersion": "all-mainnet-surface"
+      },
+      "cashMetadata": {
+        "cashRole": "reserve-and-redemption-asset-class",
+        "currency": "USD",
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "issuer-or-bridge-reserve-unverified",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": null,
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "pending-disclosure",
+        "riskTier": "policy-review-required",
+        "registryStatus": "documented-surface-not-stablecoin-registry-entry"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "corridor-halt-required-for-issuer-bridge-or-peg-risk",
+        "monitoring": [
+          "peg-deviation",
+          "bridge-health",
+          "liquidity-depth",
+          "contract-admin-changes"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "fiat",
+        "settlementCurrency": "USD",
+        "settlementFinalityDomain": "off-chain-regulated-ledger-or-issuer-domain",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": true,
+        "redemptionPath": "issuer-or-bridge-redemption-unverified",
+        "parRedemption": "unverified"
+      },
+      "status": "verified"
+    },
+    {
+      "symbol": "WETH",
+      "address": "0x798F6762BB40d6801A593459d08F890603D3979C",
+      "decimals": 18,
+      "category": "wrapped-native",
+      "instrumentType": "wrapped-native",
+      "issuerType": "wrapper-contract",
+      "settlementAssetClass": "crypto-native",
+      "backingAssets": [
+        "native-gas-asset"
+      ],
+      "gruVersion": null,
+      "tags": [
+        "wrapped-native",
+        "gas:eth",
+        "all-mainnet"
+      ],
+      "backingMetadata": {
+        "backingModel": "wrapped-native-escrow",
+        "backingAssetClasses": [
+          "native-gas-asset"
+        ],
+        "backingVerificationStatus": "wrapper-contract-address-verified",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "mapped-138-to-651940",
+        "bridgeKind": "AlltraAdapter",
+        "sourceChainId": 138,
+        "destinationChainId": 651940,
+        "sourceSymbol": "WETH9",
+        "sourceAddress": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2",
+        "destinationSymbol": "WETH",
+        "destinationAddress": "0x798F6762BB40d6801A593459d08F890603D3979C",
+        "adapterAddress": "0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc"
+      },
+      "cashMetadata": {
+        "cashRole": "none",
+        "currency": null,
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "native-asset-wrapper-escrow",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": "wrapper-contract-balance",
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "contract-balance-verifiable-on-chain",
+        "riskTier": "bridge-and-wrapper-risk",
+        "registryStatus": "documented-token-surface"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "corridor-halt-required-for-bridge-or-wrapper-risk",
+        "monitoring": [
+          "bridge-health",
+          "wrapper-contract-balance",
+          "liquidity-depth",
+          "contract-admin-changes"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "crypto-native",
+        "settlementCurrency": "ETH",
+        "settlementFinalityDomain": "chain-finality",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": false,
+        "redemptionPath": "unwrap-or-bridge-withdrawal",
+        "parRedemption": "one-to-one-native-asset-when-wrapper-solvent"
+      },
+      "status": "verified"
+    },
+    {
+      "symbol": "WALL",
+      "address": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4",
+      "decimals": 18,
+      "category": "wrapped-native",
+      "instrumentType": "wrapped-native",
+      "issuerType": "wrapper-contract",
+      "settlementAssetClass": "crypto-native",
+      "backingAssets": [
+        "native-gas-asset"
+      ],
+      "gruVersion": null,
+      "tags": [
+        "wrapped-native",
+        "gas:all",
+        "all-mainnet"
+      ],
+      "backingMetadata": {
+        "backingModel": "wrapped-native-escrow",
+        "backingAssetClasses": [
+          "native-gas-asset"
+        ],
+        "backingVerificationStatus": "wrapper-contract-address-verified",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "documented-all-mainnet-native-wrapper",
+        "bridgeKind": "native-wrapper",
+        "sourceChainId": 651940,
+        "destinationChainId": 651940,
+        "sourceSymbol": "ALL",
+        "sourceAddress": null,
+        "destinationSymbol": "WALL",
+        "destinationAddress": "0x2da2b8f961F161ab6320acB3377e2e844a3C3ce4",
+        "adapterAddress": null
+      },
+      "cashMetadata": {
+        "cashRole": "none",
+        "currency": null,
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "native-asset-wrapper-escrow",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": "wrapper-contract-balance",
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "contract-balance-verifiable-on-chain",
+        "riskTier": "wrapper-risk",
+        "registryStatus": "documented-token-surface"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "corridor-halt-required-for-wrapper-risk",
+        "monitoring": [
+          "wrapper-contract-balance",
+          "liquidity-depth",
+          "contract-admin-changes"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "crypto-native",
+        "settlementCurrency": "ALL",
+        "settlementFinalityDomain": "chain-finality",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": false,
+        "redemptionPath": "unwrap-to-native-all",
+        "parRedemption": "one-to-one-native-asset-when-wrapper-solvent"
+      },
+      "status": "verified"
+    },
+    {
+      "symbol": "HYDX",
+      "address": "0x0d9793861AEB9244AD1B34375a83A6730F6AdD38",
+      "decimals": 18,
+      "category": "dex-token",
+      "instrumentType": "protocol-token",
+      "issuerType": "protocol",
+      "settlementAssetClass": "crypto-native",
+      "backingAssets": [
+        "protocol-utility"
+      ],
+      "gruVersion": null,
+      "tags": [
+        "dex-token",
+        "protocol:hydx",
+        "all-mainnet"
+      ],
+      "backingMetadata": {
+        "backingModel": "protocol-utility",
+        "backingAssetClasses": [
+          "protocol-utility"
+        ],
+        "backingVerificationStatus": "not-reserve-backed",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "not-bridge-canonical-in-this-inventory",
+        "bridgeKind": null,
+        "sourceChainId": null,
+        "destinationChainId": 651940,
+        "sourceSymbol": null,
+        "sourceAddress": null,
+        "destinationSymbol": "HYDX",
+        "destinationAddress": "0x0d9793861AEB9244AD1B34375a83A6730F6AdD38",
+        "adapterAddress": null
+      },
+      "cashMetadata": {
+        "cashRole": "none",
+        "currency": null,
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "none-protocol-token",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": null,
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "not-applicable",
+        "riskTier": "protocol-token-risk",
+        "registryStatus": "documented-token-surface"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "routing-halt-required-for-protocol-or-contract-risk",
+        "monitoring": [
+          "liquidity-depth",
+          "contract-admin-changes",
+          "protocol-surface-confirmation"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "crypto-native",
+        "settlementCurrency": "HYDX",
+        "settlementFinalityDomain": "chain-finality",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": false,
+        "redemptionPath": "not-applicable",
+        "parRedemption": "not-applicable"
+      },
+      "status": "verified"
+    },
+    {
+      "symbol": "HYBX",
+      "address": "0x1839f77eBed7F388c7035f7061B4B8Ef0E72317a",
+      "decimals": 8,
+      "category": "defi-token",
+      "instrumentType": "protocol-token",
+      "issuerType": "protocol",
+      "settlementAssetClass": "crypto-native",
+      "backingAssets": [
+        "protocol-utility"
+      ],
+      "gruVersion": null,
+      "tags": [
+        "defi-token",
+        "protocol:hybx",
+        "all-mainnet"
+      ],
+      "backingMetadata": {
+        "backingModel": "protocol-utility",
+        "backingAssetClasses": [
+          "protocol-utility"
+        ],
+        "backingVerificationStatus": "not-reserve-backed",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "not-bridge-canonical-in-this-inventory",
+        "bridgeKind": null,
+        "sourceChainId": null,
+        "destinationChainId": 651940,
+        "sourceSymbol": null,
+        "sourceAddress": null,
+        "destinationSymbol": "HYBX",
+        "destinationAddress": "0x1839f77eBed7F388c7035f7061B4B8Ef0E72317a",
+        "adapterAddress": null
+      },
+      "cashMetadata": {
+        "cashRole": "none",
+        "currency": null,
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "none-protocol-token",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": null,
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "not-applicable",
+        "riskTier": "protocol-token-risk",
+        "registryStatus": "documented-token-surface"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "routing-halt-required-for-protocol-or-contract-risk",
+        "monitoring": [
+          "liquidity-depth",
+          "contract-admin-changes"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "crypto-native",
+        "settlementCurrency": "HYBX",
+        "settlementFinalityDomain": "chain-finality",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": false,
+        "redemptionPath": "not-applicable",
+        "parRedemption": "not-applicable"
+      },
+      "status": "verified"
+    },
+    {
+      "symbol": "CHT",
+      "address": "0xE59Bb804F4884FcEA183a4A67B1bb04f4a4567bc",
+      "decimals": 8,
+      "category": "defi-token",
+      "instrumentType": "utility-token",
+      "issuerType": "protocol",
+      "settlementAssetClass": "crypto-native",
+      "backingAssets": [
+        "protocol-utility"
+      ],
+      "gruVersion": null,
+      "tags": [
+        "defi-token",
+        "utility-token",
+        "protocol:cht",
+        "all-mainnet"
+      ],
+      "backingMetadata": {
+        "backingModel": "protocol-utility",
+        "backingAssetClasses": [
+          "protocol-utility"
+        ],
+        "backingVerificationStatus": "not-reserve-backed",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "not-bridge-canonical-in-this-inventory",
+        "bridgeKind": null,
+        "sourceChainId": null,
+        "destinationChainId": 651940,
+        "sourceSymbol": null,
+        "sourceAddress": null,
+        "destinationSymbol": "CHT",
+        "destinationAddress": "0xE59Bb804F4884FcEA183a4A67B1bb04f4a4567bc",
+        "adapterAddress": null
+      },
+      "cashMetadata": {
+        "cashRole": "none",
+        "currency": null,
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "none-utility-token",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": null,
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "not-applicable",
+        "riskTier": "utility-token-risk",
+        "registryStatus": "documented-token-surface"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "routing-halt-required-for-protocol-or-contract-risk",
+        "monitoring": [
+          "liquidity-depth",
+          "contract-admin-changes"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "crypto-native",
+        "settlementCurrency": "CHT",
+        "settlementFinalityDomain": "chain-finality",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": false,
+        "redemptionPath": "not-applicable",
+        "parRedemption": "not-applicable"
+      },
+      "status": "verified"
+    },
+    {
+      "symbol": "AUDA",
+      "address": "0x690740f055A41FA7669f5a379Bf71B0cDF353073",
+      "decimals": 18,
+      "category": "defi-token",
+      "instrumentType": "protocol-token",
+      "issuerType": "protocol",
+      "settlementAssetClass": "crypto-native",
+      "backingAssets": [
+        "protocol-utility"
+      ],
+      "gruVersion": null,
+      "tags": [
+        "defi-token",
+        "protocol:auda",
+        "all-mainnet"
+      ],
+      "backingMetadata": {
+        "backingModel": "protocol-utility",
+        "backingAssetClasses": [
+          "protocol-utility"
+        ],
+        "backingVerificationStatus": "not-reserve-backed",
+        "overcollateralizationRequired": false
+      },
+      "bridgeMetadata": {
+        "bridgeStatus": "not-bridge-canonical-in-this-inventory",
+        "bridgeKind": null,
+        "sourceChainId": null,
+        "destinationChainId": 651940,
+        "sourceSymbol": null,
+        "sourceAddress": null,
+        "destinationSymbol": "AUDA",
+        "destinationAddress": "0x690740f055A41FA7669f5a379Bf71B0cDF353073",
+        "adapterAddress": null
+      },
+      "cashMetadata": {
+        "cashRole": "none",
+        "currency": null,
+        "cashBackingAssertedByRepo": false,
+        "cashBackingEvidenceRef": null
+      },
+      "commodityMetadata": {
+        "commodityBacked": false,
+        "commodityType": null,
+        "commodityUnit": null,
+        "reserveLocationRef": null
+      },
+      "reserveMetadata": {
+        "reserveModel": "none-protocol-token",
+        "reserveDisclosureRef": null,
+        "reserveAccountRef": null,
+        "proofOfReserveRef": null,
+        "reserveVerificationStatus": "not-applicable",
+        "riskTier": "protocol-token-risk",
+        "registryStatus": "documented-token-surface"
+      },
+      "securityMetadata": {
+        "pauseAuthority": "unknown",
+        "adminAuthority": "unknown",
+        "upgradeability": "unknown",
+        "keyManagement": "unknown",
+        "emergencyHalt": "routing-halt-required-for-protocol-or-contract-risk",
+        "monitoring": [
+          "liquidity-depth",
+          "contract-admin-changes"
+        ]
+      },
+      "settlementMetadata": {
+        "settlementAssetClass": "crypto-native",
+        "settlementCurrency": "AUDA",
+        "settlementFinalityDomain": "chain-finality",
+        "onChainFinality": "token-transfer-final-on-chain-651940-after-confirmation",
+        "accountingEvidenceRequired": false,
+        "redemptionPath": "not-applicable",
+        "parRedemption": "not-applicable"
+      },
+      "status": "verified"
+    }
+  ],
+  "protocols": [
+    {
+      "name": "AlltraDEX / EnhancedSwapRouter",
+      "family": "custom_router",
+      "status": "partial_live_dodo_backed_router_deployed",
+      "factoryAddress": null,
+      "routerAddress": "0xb905fEfA56b028221E2Bc248Bbcd41141dc7aeD3",
+      "coordinatorAddress": "0x9276ae27d9c624B43dbE43494f34A9c5F0233a0B",
+      "providerAddress": "0x36F65027D21e151F0b7810bae1E94b225AC7Ba9e",
+      "adapters": {
+        "dodo": "0x391D192BED6188c4DaB4C93c078bD18432687474",
+        "dodoV3": "0x97Ce874142625134aEEBDF42B5E7bB806e731D25",
+        "uniswapV3": "0xBF75F3401de20bebBB1CBb678499941807E3E040",
+        "balancer": "0xDE7F15AF1D84e3694f7E966293d20e64Fc04d9fF",
+        "curve": "0x753D2b0a723992D7B174D6e19F7b7Cb74be8D61a",
+        "oneInch": "0x487090bbb7d17875281692d582a11B445b3A7AC7"
+      },
+      "enabledProviders": [
+        "dodo"
+      ],
+      "disabledProviders": [
+        "dodoV3",
+        "uniswapV3",
+        "balancer",
+        "curve",
+        "oneInch",
+        "partner"
+      ],
+      "publishedRoutePoolIds": [
+        "651940-dodo_pmm-wall-ausdc",
+        "651940-dodo_pmm-wall-ausdt"
+      ],
+      "deploymentEvidenceRef": "config/all-mainnet-enhanced-router-deployment.json",
+      "notes": [
+        "Documented in docs/11-references/ALL_MAINNET_ROUTING_ENGINE.md as the intended same-chain swap surface.",
+        "EnhancedSwapRouterV2 is deployed on ALL Mainnet with DODO as the only enabled provider.",
+        "Optional adapters were deployed for future wiring but are disabled until canonical provider targets and pools are committed.",
+        "WALL/AUSDC and WALL/AUSDT are funded and quoteable through the router provider path; the earlier WALL/USDT route is disabled because AUSDT is the canonical quote asset."
+      ],
+      "disabledRoutePoolIds": [
+        "651940-dodo_pmm-wall-usdt"
+      ]
+    },
+    {
+      "name": "HYDX",
+      "family": "custom_router",
+      "status": "token_present_protocol_surface_pending",
+      "factoryAddress": null,
+      "routerAddress": null,
+      "envKeys": [
+        "CHAIN_651940_HYDX_FACTORY",
+        "CHAIN_651940_HYDX_ROUTER",
+        "CHAIN_651940_HYDX_START_BLOCK",
+        "CHAIN_651940_HYDX_PAIR_CREATED_EVENT"
+      ],
+      "notes": [
+        "The HYDX token is documented and verified on ALL Mainnet.",
+        "The repo expects factory/router discovery via env, but no canonical HYDX-native router inventory is currently committed.",
+        "HYDX currently has committed same-chain exposure through the ALL Mainnet Uniswap V2 HYDX/WALL pool, not through a dedicated HYDX-native router surface."
+      ]
+    },
+    {
+      "name": "Uniswap V2",
+      "family": "uniswap_v2",
+      "status": "partial_live_inventory_published",
+      "factoryAddress": "0x3C3ED514691C06c89Bf6626B05D22991E8924c93",
+      "routerAddress": "0xED04Ee8307C0656207AF5aFE3926AE2380052940",
+      "inventoryRef": "config/all-mainnet-pool-creation-matrix.json",
+      "publishedPoolIds": [
+        "651940-uniswap_v2-wall-ausdc",
+        "651940-uniswap_v2-wall-usdt",
+        "651940-uniswap_v2-usdt-ausdc",
+        "651940-uniswap_v2-hydx-wall"
+      ],
+      "notes": [
+        "Factory/router and multiple pair addresses are committed in config/all-mainnet-pool-creation-matrix.json.",
+        "Required spend rows remain gated until vault assignments and canary evidence are recorded."
+      ]
+    },
+    {
+      "name": "Uniswap V3",
+      "family": "uniswap_v3",
+      "status": "standalone_live_router_quoter_pool_deployed",
+      "factoryAddress": "0xF1a334465C5DD628492780B39Be68D561A9AecA2",
+      "routerAddress": "0xe9Ea1B70803c18C4CEb8839D5D68681c7903511B",
+      "notes": [
+        "Official Uniswap V3 factory, legacy SwapRouter, Quoter, QuoterV2, NonfungiblePositionManager, and AUSDT/WALL 0.30% pool are deployed on ALL Mainnet.",
+        "The standalone SwapRouter path was tested with a tiny WALL -> AUSDT canary swap.",
+        "EnhancedSwapRouterV2 route config was written, but provider 1 remains disabled because the current UniswapV3RouteExecutorAdapter staticcall quote path is incompatible with the upstream Quoter behavior."
+      ],
+      "quoterAddress": "0x0ecC56077325863c80cbe516D63e0afAFf7EA579",
+      "quoterV2Address": "0x024Ff178BaB7e6fa1794c3A216D2B299C3F295d2",
+      "positionManagerAddress": "0xD29422211e1f2C1015FBb5dC2004657Dd8318aF6",
+      "descriptorAddress": "0x2a76C73458A0C11df4e0E43004598480d6D1E768",
+      "poolAddress": "0x9e0FC06BA367b51a0aBc5c0924306088DBB0e9c4",
+      "inventoryRef": "config/all-mainnet-pool-creation-matrix.json",
+      "deploymentEvidenceRef": "config/all-mainnet-uniswap-v3-deployment.json",
+      "publishedPoolIds": [
+        "651940-uniswap_v3-wall-ausdt"
+      ],
+      "enhancedRouterProviderStatus": "disabled_adapter_quote_compatibility_pending"
+    },
+    {
+      "name": "DODO PMM",
+      "family": "dodo_pmm",
+      "status": "partial_live_inventory_published",
+      "factoryAddress": "0x8a3403aef8d40c0F4AfaF6Dc2000A537EbC863c2",
+      "routerAddress": "0x8528E268F3b8C94208d09D131ACa3Ea93Bad57c7",
+      "inventoryRef": "config/all-mainnet-pool-creation-matrix.json",
+      "publishedPoolIds": [
+        "651940-dodo_pmm-wall-ausdc",
+        "651940-dodo_pmm-wall-ausdt"
+      ],
+      "notes": [
+        "DVM factory, DVM factory adapter, integration/router, and DODO PMM pool addresses are committed in config/all-mainnet-pool-creation-matrix.json; WALL/AUSDT supersedes the earlier WALL/USDT row for canonical spend routing.",
+        "Required spend rows remain gated until vault assignments, funding, live reserve reads, and canary evidence are recorded."
+      ],
+      "disabledPoolIds": [
+        "651940-dodo_pmm-wall-usdt"
+      ]
+    }
+  ],
+  "bridgeSurface": {
+    "adapter": {
+      "name": "AlltraAdapter",
+      "address": "0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc",
+      "status": "live"
+    },
+    "supportedBridgeAssets": [
+      "cUSDC",
+      "cUSDT"
+    ]
+  },
+  "nextTasks": [
+    "Keep the disabled WALL/USDT row historical-only unless explicitly re-approved for USDT routing.",
+    "Commit canonical factory/router metadata once a HYDX-native routing address is confirmed.",
+    "Deploy or import canonical Uniswap V3 factory/router/quoter/pool inventory before enabling the ALL Mainnet Uniswap V3 adapter.",
+    "Add pool-level addresses and verification artifacts before enabling public route generation from disabled optional protocol providers."
+  ]
+}

config/besu-node-lists/README.md

@@ -27,9 +27,9 @@ See [docs/06-besu/MASTER_DOCS_AND_NODE_LISTS_REVIEW.md](../../docs/06-besu/MASTE
 - **New node (e.g. 1504, 2102):** Get the node’s enode (e.g. from `admin_nodeInfo` or the node’s data dir), add it to both files here, then run the deploy script.
 - **Node removed:** Remove its enode from both files and redeploy.
 - **Regenerate all (no duplicates):** Run `bash scripts/besu/collect-enodes-from-all-besu-nodes.sh` to collect from every node (admin_nodeInfo or `besu public-key export`), merge with existing for unreachable nodes, and overwrite both files.
-- **Fix failures only:** Run `bash scripts/besu/collect-enodes-from-all-besu-nodes.sh --missing-only` to try only VMIDs whose IP is not yet in the list (no full 37-node sweep).
-- **Generate missing node keys:** Run `bash scripts/besu/generate-node-keys-for-missing-vmids.sh [--force] [--collect]` to create `/data/besu/key` (64-hex) only for VMIDs not yet in the list. Use `--force` to overwrite PEM/wrong-format keys; use `--collect` to run collect --missing-only after. Current auxiliary / edge nodes include sentries `1505–1510` and RPCs `2420/2430/2440/2460/2470/2480`.
-- **Install Besu permanently on nodes missing it:** Run `bash scripts/besu/install-besu-permanent-on-missing-nodes.sh` to install the current Besu line used by the fleet, deploy config/genesis/node lists, and enable+start the service so RPC/sentry runs after reboot.
+- **Fix failures only:** Run `bash scripts/besu/collect-enodes-from-all-besu-nodes.sh --missing-only` to try only VMIDs whose IP is not yet in the list (no full 32-node sweep).
+- **Generate missing node keys:** Run `bash scripts/besu/generate-node-keys-for-missing-vmids.sh [--force] [--collect]` to create `/data/besu/key` (64-hex) only for VMIDs not yet in the list. Use `--force` to overwrite PEM/wrong-format keys; use `--collect` to run collect --missing-only after. Containers without Besu (1505–1508, 2501–2505) are supported via helper nodes (1504 on ml110, 2500 on r630-01).
+- **Install Besu permanently on nodes missing it:** Run `bash scripts/besu/install-besu-permanent-on-missing-nodes.sh` to install Besu (23.10.3) in 1505–1508 and 2501–2505, deploy config/genesis/node lists, and enable+start the service so RPC/sentry runs after reboot.
 
 ## Sentry 1504 (.154)
 

config/besu-node-lists/permissions-nodes.toml

@@ -1,6 +1,6 @@
 # Node Permissioning — SINGLE SOURCE OF TRUTH for all Besu nodes
 # Must match config/besu-node-lists/static-nodes.json and be deployed to every node.
-# Generated by scripts/besu/collect-enodes-from-all-besu-nodes.sh — 37 enodes (incl. 2103 refreshed, Putu RPC 2307/2308 .237/.238, and Thirdweb sentries 1509/1510).
+# Generated by scripts/besu/collect-enodes-from-all-besu-nodes.sh — 37 enodes after live adds of 2103 (.217), 1509 (.219), and 1510 (.220).
 
 nodes-allowlist=[
   "enode://2221dd9fc65c9082d4a937832cba9f6759981888df6798407c390bd153f4332c152ea5d03dd9d9cda74d7990fb3479a5c4ba7166269322be9790eed9ebdcfe24@192.168.11.100:30303",
@@ -15,10 +15,10 @@ nodes-allowlist=[
   "enode://225d902bf840379ce122f8cc431a542ddee0bde3e949b48767285bbc9c774cc3fc22cd4913ee72f0a19dce266e3ecb66dba5c58092d0b0e5ceb4e13bf96a1a68@192.168.11.154:30303",
   "enode://afa44c03ac3dd97efcbbef8edea11d1edf23bd595f30d4cf0c4be364d0b194e4217926a37141b54dcff71107f9ee257f621553cd867a2c9fa5a5537b3ae59746@192.168.11.213:30303",
   "enode://5f048208071f2a3036128433e1e4a647a7683abd8bc0f27d063e2933ced983accdfc44998666f3be711e4eff27511142d9989775b86cdbe28c79b74409fc36bb@192.168.11.214:30303",
-  "enode://8a3337adcc2d177caf3aee26b3b6077d9adf126c580e12f352743ca07828f056ceb1d5fb1a06287e2dbbe19043fcc4b9bdd2ca9ae2a2c9142cf0cc3a549bfc68@192.168.11.219:30303",
-  "enode://09fe518689c54a34c3dac8aebf3c94bfc390f4bae143a80c57d92a502414df0689d12a2243ff9376c2f44a419894d934b4f47783ced31ea9668522078854e58f@192.168.11.220:30303",
   "enode://8da1b586e2e98f521f07148d3bb5d81fde151ce3d5738b51bc36e2c81de1aaa5404ce31e991b4393bbe471934f0a9a31f78d1d7c17c1899c3e2dde5e9f16eb24@192.168.11.244:30303",
   "enode://acd46d31913b8379f075467cd88d2ea650d33474d2f9546426da4a414fe92233584c9d8c2e1ea9962fa4257c20b66c9434d0488e51c632f285205d6a379cfbd6@192.168.11.245:30303",
+  "enode://8a3337adcc2d177caf3aee26b3b6077d9adf126c580e12f352743ca07828f056ceb1d5fb1a06287e2dbbe19043fcc4b9bdd2ca9ae2a2c9142cf0cc3a549bfc68@192.168.11.219:30303",
+  "enode://09fe518689c54a34c3dac8aebf3c94bfc390f4bae143a80c57d92a502414df0689d12a2243ff9376c2f44a419894d934b4f47783ced31ea9668522078854e58f@192.168.11.220:30303",
   "enode://6cdc892fa09afa2b05c21cc9a1193a86cf0d195ce81b02a270d8bb987f78ca98ad90d907670796c90fc6e4eaf3b4cae6c0c15871e2564de063beceb4bbfc6532@192.168.11.211:30303",
   "enode://e53713bb77ad9f39e8a04b9c82aadddd3449220167f546bca8e9f36f6ebf60ae003e48ac293790e2bd7b0aca382777db9eca61d6f048c04f9dbe65eedb79d893@192.168.11.212:30303?discport=0",
   "enode://e871ff3b1f58b9a87122e552b2404e1893bf92ae74d4fa6bc2bd002d0350c506ea452f4aefa1a3497ef32694c4beb48bf8a006d2b82f57649c90b22f59044aad@192.168.11.217:30303?discport=0",

config/besu-node-lists/static-nodes.json

@@ -11,10 +11,10 @@
   "enode://225d902bf840379ce122f8cc431a542ddee0bde3e949b48767285bbc9c774cc3fc22cd4913ee72f0a19dce266e3ecb66dba5c58092d0b0e5ceb4e13bf96a1a68@192.168.11.154:30303",
   "enode://afa44c03ac3dd97efcbbef8edea11d1edf23bd595f30d4cf0c4be364d0b194e4217926a37141b54dcff71107f9ee257f621553cd867a2c9fa5a5537b3ae59746@192.168.11.213:30303",
   "enode://5f048208071f2a3036128433e1e4a647a7683abd8bc0f27d063e2933ced983accdfc44998666f3be711e4eff27511142d9989775b86cdbe28c79b74409fc36bb@192.168.11.214:30303",
-  "enode://8a3337adcc2d177caf3aee26b3b6077d9adf126c580e12f352743ca07828f056ceb1d5fb1a06287e2dbbe19043fcc4b9bdd2ca9ae2a2c9142cf0cc3a549bfc68@192.168.11.219:30303",
-  "enode://09fe518689c54a34c3dac8aebf3c94bfc390f4bae143a80c57d92a502414df0689d12a2243ff9376c2f44a419894d934b4f47783ced31ea9668522078854e58f@192.168.11.220:30303",
   "enode://8da1b586e2e98f521f07148d3bb5d81fde151ce3d5738b51bc36e2c81de1aaa5404ce31e991b4393bbe471934f0a9a31f78d1d7c17c1899c3e2dde5e9f16eb24@192.168.11.244:30303",
   "enode://acd46d31913b8379f075467cd88d2ea650d33474d2f9546426da4a414fe92233584c9d8c2e1ea9962fa4257c20b66c9434d0488e51c632f285205d6a379cfbd6@192.168.11.245:30303",
+  "enode://8a3337adcc2d177caf3aee26b3b6077d9adf126c580e12f352743ca07828f056ceb1d5fb1a06287e2dbbe19043fcc4b9bdd2ca9ae2a2c9142cf0cc3a549bfc68@192.168.11.219:30303",
+  "enode://09fe518689c54a34c3dac8aebf3c94bfc390f4bae143a80c57d92a502414df0689d12a2243ff9376c2f44a419894d934b4f47783ced31ea9668522078854e58f@192.168.11.220:30303",
   "enode://6cdc892fa09afa2b05c21cc9a1193a86cf0d195ce81b02a270d8bb987f78ca98ad90d907670796c90fc6e4eaf3b4cae6c0c15871e2564de063beceb4bbfc6532@192.168.11.211:30303",
   "enode://e53713bb77ad9f39e8a04b9c82aadddd3449220167f546bca8e9f36f6ebf60ae003e48ac293790e2bd7b0aca382777db9eca61d6f048c04f9dbe65eedb79d893@192.168.11.212:30303?discport=0",
   "enode://e871ff3b1f58b9a87122e552b2404e1893bf92ae74d4fa6bc2bd002d0350c506ea452f4aefa1a3497ef32694c4beb48bf8a006d2b82f57649c90b22f59044aad@192.168.11.217:30303?discport=0",

config/bridge-routes-chain138-default.json

@@ -1,25 +0,0 @@
-{
-  "routes": {
-    "weth9": {
-      "Ethereum Mainnet (1)": "0xF9A32F37099c582D28b4dE7Fca6eaC1e5259f939",
-      "BNB Chain (56)": "0x886C6A4ABC064dbf74E7caEc460b7eeC31F1b78C",
-      "Avalanche C-Chain (43114)": "0x3f8C409C6072a2B6a4Ff17071927bA70F80c725F"
-    },
-    "weth10": {
-      "Ethereum Mainnet (1)": "0xF9A32F37099c582D28b4dE7Fca6eaC1e5259f939",
-      "BNB Chain (56)": "0x886C6A4ABC064dbf74E7caEc460b7eeC31F1b78C",
-      "Avalanche C-Chain (43114)": "0x3f8C409C6072a2B6a4Ff17071927bA70F80c725F"
-    }
-  },
-  "chain138Bridges": {
-    "weth9": "0xcacfd227A040002e49e2e01626363071324f820a",
-    "weth10": "0xe0E93247376aa097dB308B92e6Ba36bA015535D0",
-    "trustless": "0xFce6f50B312B3D936Ea9693C5C9531CF92a3324c"
-  },
-  "tokenMappingApi": {
-    "basePath": "/api/v1/token-mapping",
-    "pairs": "/api/v1/token-mapping/pairs",
-    "resolve": "/api/v1/token-mapping/resolve",
-    "note": "Resolve bridged token addresses between chains; requires monorepo config/token-mapping-multichain.json on server."
-  }
-}

config/btc-settlement-pathways.json

@@ -1,133 +0,0 @@
-{
-  "schemaVersion": 1,
-  "updated": "2026-04-03",
-  "description": "End-to-end pathways from Chain 138 to native BTC via Changelly (partner API) or Atomic Wallet (user-operated swap). Used by orchestration design; does not imply keys or contracts are configured.",
-  "homeChainId": 138,
-  "destinationAsset": {
-    "symbol": "BTC",
-    "network": "bitcoin-mainnet",
-    "addressFormat": "bech32-p2wpkh-or-legacy"
-  },
-  "references": {
-    "mainnetLiquidityPlan": "docs/00-meta/MAINNET_LIQUIDITY_AND_RAMPS_PRIORITY.md",
-    "rampUserFlows": "docs/04-configuration/MAINNET_RAMP_USER_FLOWS.md",
-    "deployedBridgesStatus": "docs/11-references/DEPLOYED_TOKENS_BRIDGES_LPS_AND_ROUTING_STATUS.md",
-    "changellyDocs": "https://docs.changelly.com/",
-    "changellySupportEmail": "pro@changelly.com",
-    "atomicWalletSwapKb": "https://support.atomicwallet.io/article/73-how-to-make-an-exchange"
-  },
-  "changelly": {
-    "product": "Changelly Exchange API v2",
-    "integrationSurface": "backend_jsonrpc",
-    "apiBaseUrl": "https://api.changelly.com/v2",
-    "authentication": {
-      "headers": ["X-Api-Key", "X-Api-Signature"],
-      "signatureAlgorithm": "RSA-SHA256 over raw JSON-RPC body",
-      "note": "Generate RSA keypair; register public key with Changelly; never expose private key to browsers."
-    },
-    "documentedRpcFlow": [
-      "getCurrencies",
-      "getPairsParams",
-      "getMinAmount",
-      "validateAddress",
-      "getExchangeAmount",
-      "createTransaction",
-      "getTransactions (poll status)"
-    ],
-    "envVars": [
-      "CHANGELLY_API_PUBLIC_KEY",
-      "CHANGELLY_API_PRIVATE_KEY_PEM_PATH"
-    ]
-  },
-  "atomicWallet": {
-    "product": "Atomic Wallet (desktop/mobile)",
-    "integrationSurface": "user_operated",
-    "note": "Swaps route through in-wallet partners to deposit addresses; there is no documented first-party B2B swap API equivalent to Changelly v2 for arbitrary server-side settlement. Use for operator or end-user manual path after funds sit on a chain Atomic supports.",
-    "supportedChainsForSwap": "See in-app asset list; typically includes BTC and major EVM assets when counterpart is available."
-  },
-  "pathways": [
-    {
-      "id": "138-evm-changelly-btc-treasury",
-      "label": "Automated-friendly: 138 → Ethereum mainnet stables/ETH → Changelly → BTC payout address",
-      "venue": "changelly",
-      "automationTier": "high",
-      "summary": "Bridge and swap on-chain until Ethereum holds USDT, USDC, ETH, or WETH that Changelly lists; backend calls createTransaction with payout btc address; treasury sends the exact deposit amount to Changelly’s deposit address.",
-      "preconditions": [
-        "Ethereum mainnet liquidity for chosen bridge (LiquidityPoolETH / CCIP WETH path per MAINNET_LIQUIDITY_AND_RAMPS_PRIORITY.md)",
-        "Changelly partner API key registered (pro@changelly.com)",
-        "Treasury hot wallet on Ethereum with gas ETH and sendable USDT/USDC/ETH per quote",
-        "Confirm Changelly ticker names for from-currency (e.g. eth, usdt20, usdc) match your token contract version"
-      ],
-      "steps": [
-        {
-          "order": 1,
-          "chainId": 138,
-          "action": "swap_to_bridge_asset",
-          "detail": "Use DODOPMMIntegration / EnhancedSwapRouter on 138 to convert source (e.g. cUSDT, cUSDC) into the token your bridge expects (often WETH for CCIP WETH bridges, or corridor-specific asset)."
-        },
-        {
-          "order": 2,
-          "chainId": 138,
-          "action": "bridge_to_ethereum",
-          "detail": "Execute CCIP or trustless bridge to Ethereum mainnet per deployed bridge matrix (DEPLOYED_TOKENS_BRIDGES_LPS_AND_ROUTING_STATUS.md)."
-        },
-        {
-          "order": 3,
-          "chainId": 1,
-          "action": "optional_swap_on_mainnet",
-          "detail": "If payout asset is wrong shape (e.g. WETH only, need USDT), swap on mainnet via DEX/aggregator to Changelly-accepted from-currency."
-        },
-        {
-          "order": 4,
-          "chainId": 0,
-          "action": "changelly_quote_and_create",
-          "detail": "JSON-RPC: getMinAmount, getExchangeAmount, validateAddress(BTC), createTransaction with amount, from, to btc, address = user btc address. Store payin address + id."
-        },
-        {
-          "order": 5,
-          "chainId": 1,
-          "action": "send_payin",
-          "detail": "Broadcast Ethereum tx from treasury to Changelly deposit address for exact amount; single output per Changelly rules for UTXO targets."
-        },
-        {
-          "order": 6,
-          "chainId": 0,
-          "action": "poll_until_btc_sent",
-          "detail": "Poll getTransactions / status until outbound BTC confirmed; record btc txid for reconciliation."
-        }
-      ]
-    },
-    {
-      "id": "138-evm-atomic-user-btc",
-      "label": "User-operated: 138 → Ethereum → Atomic Wallet swap → BTC",
-      "venue": "atomic_wallet",
-      "automationTier": "low",
-      "summary": "After funds arrive on an Ethereum address the user controls in Atomic Wallet, user runs in-app Exchange to BTC; no server-side Atomic swap API in repo.",
-      "preconditions": [
-        "Bridge completes to user-controlled Ethereum address (same EOA in MetaMask and Atomic, or user sends to Atomic-seeded wallet)",
-        "User installs Atomic Wallet and holds seed phrase",
-        "Asset appears in Atomic’s supported list for swap into BTC"
-      ],
-      "steps": [
-        {
-          "order": 1,
-          "chainId": 138,
-          "action": "swap_and_bridge_to_user_eoa_mainnet",
-          "detail": "Same as Changelly path steps 1–2 but recipient is user’s Ethereum mainnet address."
-        },
-        {
-          "order": 2,
-          "chainId": 1,
-          "action": "user_opens_atomic_exchange",
-          "detail": "In Atomic: Exchange → select from asset (ETH/USDT/USDC etc.) → to BTC → enter amount and destination BTC address (often same app wallet’s BTC account)."
-        },
-        {
-          "order": 3,
-          "chainId": 0,
-          "action": "user_completes_partner_flow",
-          "detail": "Follow Atomic prompts (rates non-fixed, ~20 min typical per vendor KB); user bears slippage and network fees."
-        }
-      ]
-    }
-  ]
-}

config/compliance-matrix/README.md

@@ -1,14 +0,0 @@
-# Global compliance matrix index
-
-**Canonical index:** [`global-compliance-matrix-index.json`](global-compliance-matrix-index.json)
-
-This folder holds a **top-level registry** of compliance packages by jurisdiction or region. Each entry points to a **drill-down manifest** under [`jurisdictions/`](jurisdictions/) that lists:
-
-- Transaction-grade JSON matrices (Indonesia / JVMTM)
-- Audit closure matrices (markdown)
-- Institutional submission binders (Indonesia 4.995 package)
-- Regional rulebook mappings (e.g. SEPA under `gru-docs/`)
-
-**Indonesia drill-down:** [`jurisdictions/ID.json`](jurisdictions/ID.json) → `config/jvmtm-regulatory-closure/transaction-compliance-matrix.json` plus submission docs in `docs/04-configuration/mifos-omnl-central-bank/`.
-
-**Validation:** `python3 scripts/validation/validate-global-compliance-matrix-index.py` (also invoked from `scripts/validation/validate-jvmtm-regulatory-closure-schemas.sh`).

config/compliance-matrix/global-compliance-matrix-index.json

@@ -1,30 +0,0 @@
-{
-  "schema_version": 1,
-  "matrix_version": "2026-04-03",
-  "title": "Global compliance matrix index",
-  "description": "Top-level registry of jurisdiction and regional compliance packages. Each row links to a manifest JSON for drill-down (controls, audit closure, submission binders, or regional rulebook mappings).",
-  "canonical_format": "json",
-  "cross_cutting": {
-    "dbis_institutional": "config/dbis-institutional/README.md",
-    "settlement_stack_runbook": "docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md",
-    "iso_gateway_spec": "docs/dbis-rail/ISO_GATEWAY_AND_RELAYER_SPEC.md"
-  },
-  "jurisdictions": [
-    {
-      "jurisdiction_id": "ID",
-      "display_name": "Indonesia",
-      "iso_3166_alpha2": "ID",
-      "status": "active",
-      "summary": "JVMTM audit closure (INAAUDJVMTM 2025), transaction-grade operator pack, OJK/BI identifier policy, BI/MoF institutional submission binder (4.995).",
-      "jurisdiction_manifest": "config/compliance-matrix/jurisdictions/ID.json"
-    },
-    {
-      "jurisdiction_id": "EU-SEPA",
-      "display_name": "European Union (SEPA — GRU docs)",
-      "iso_3166_alpha2": null,
-      "status": "active",
-      "summary": "SEPA Credit Transfer rulebook mapping in gru-docs; separate from Indonesia JVMTM JSON controls.",
-      "jurisdiction_manifest": "config/compliance-matrix/jurisdictions/EU-SEPA.json"
-    }
-  ]
-}

config/compliance-matrix/jurisdictions/EU-SEPA.json

@@ -1,25 +0,0 @@
-{
-  "schema_version": 1,
-  "jurisdiction_id": "EU-SEPA",
-  "iso_3166_alpha2": null,
-  "display_name": "European Union (SEPA — GRU documentation)",
-  "summary": "GRU site compliance set for SEPA Credit Transfer / SCT Inst rulebook mapping (markdown); use alongside global settlement runbooks when EUR rails apply.",
-  "audit_engagements": [],
-  "regulators": [
-    {"short": "EPC", "full_name": "European Payments Council"}
-  ],
-  "compliance_packages": [
-    {
-      "package_id": "gru-sepa-compliance-matrix",
-      "kind": "regional_markdown",
-      "title": "SEPA Compliance Matrix for GRU System",
-      "description": "Maps GRU implementation to EPC SEPA rulebook elements (ISO 20022); maintained under gru-docs.",
-      "human_readable_md": [
-        "gru-docs/_compliance/sepa/SEPA_Compliance_Matrix.md"
-      ],
-      "index_md": [
-        "gru-docs/compliance.md"
-      ]
-    }
-  ]
-}

config/compliance-matrix/jurisdictions/ID.json

@@ -1,51 +0,0 @@
-{
-  "schema_version": 1,
-  "jurisdiction_id": "ID",
-  "iso_3166_alpha2": "ID",
-  "display_name": "Indonesia",
-  "summary": "Transaction-grade controls derived from JVMTM Tables B/C/D closure; supervisory submission artifacts for HYBX-BATCH-001 (Bank Kanaya / BI–MoF package).",
-  "audit_engagements": [
-    {
-      "id": "018215821582",
-      "label": "INAAUDJVMTM/2025",
-      "closure_matrix": "config/jvmtm-regulatory-closure/INAAUDJVMTM_2025_AUDIT_CLOSURE_MATRIX.md"
-    }
-  ],
-  "regulators": [
-    {"short": "BI", "full_name": "Bank Indonesia"},
-    {"short": "OJK", "full_name": "Otoritas Jasa Keuangan"},
-    {"short": "MoF", "full_name": "Ministry of Finance of the Republic of Indonesia"},
-    {"short": "PPATK", "full_name": "Indonesian Financial Transaction Reports and Analysis Centre (PPATK)"}
-  ],
-  "compliance_packages": [
-    {
-      "package_id": "jvmtm-transaction-grade",
-      "kind": "transaction_controls_json",
-      "title": "JVMTM transaction-grade compliance matrix",
-      "description": "Canonical controls and runtime slots for pre-transaction through high-value mode; maps to audit rows and repo evidence.",
-      "canonical_matrix_json": "config/jvmtm-regulatory-closure/transaction-compliance-matrix.json",
-      "spreadsheet_csv": "config/jvmtm-regulatory-closure/transaction-compliance-matrix.csv",
-      "human_readable_md": [
-        "config/jvmtm-regulatory-closure/JVMTM_TRANSACTION_GRADE_COMPLIANCE_MATRIX.md",
-        "config/jvmtm-regulatory-closure/README.md"
-      ],
-      "policy_md": [
-        "docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md"
-      ]
-    },
-    {
-      "package_id": "submission-binder-hybx-batch-001",
-      "kind": "institutional_submission",
-      "title": "Indonesia central bank / MoF submission package (4.995 target)",
-      "description": "Master proof manifest, binder layout, scorecard, and regulatory annex for institutional transmission.",
-      "entry_point_md": [
-        "docs/04-configuration/mifos-omnl-central-bank/INDONESIA_MASTER_PROOF_MANIFEST.md",
-        "docs/04-configuration/mifos-omnl-central-bank/INDONESIA_CENTRAL_BANK_SUBMISSION_BINDER.md",
-        "docs/04-configuration/mifos-omnl-central-bank/INDONESIA_SUBMISSION_PACKAGE_GRADE_AND_SCORECARD.md",
-        "docs/04-configuration/mifos-omnl-central-bank/INDONESIA_PACKAGE_4_995_EVIDENCE_STANDARD.md",
-        "docs/04-configuration/mifos-omnl-central-bank/INDONESIA_REGULATORY_REFERENCES_ANNEX.md",
-        "docs/04-configuration/mifos-omnl-central-bank/HYBX_BATCH_001_OPERATOR_CHECKLIST.md"
-      ]
-    }
-  ]
-}

config/compose/sankofa-consolidated-runtime.example.yml

@@ -1,15 +0,0 @@
-# Example: API hub container only. Point upstream blocks in
-# config/nginx/sankofa-phoenix-api-hub.example.conf to real Phoenix (e.g. :4000) and
-# dbis_core (:3000) — on the same host use 127.0.0.1 after colocation, or LAN IPs
-# (e.g. 192.168.11.50, 192.168.11.155) during migration.
-#
-# docker compose -f sankofa-consolidated-runtime.example.yml up -d
-
-services:
-  api-hub:
-    image: nginx:1.27-alpine
-    ports:
-      - "8080:8080"
-    volumes:
-      - ../nginx/sankofa-phoenix-api-hub.example.conf:/etc/nginx/conf.d/default.conf:ro
-    restart: unless-stopped

config/contracts-loader.cjs

@@ -4,7 +4,7 @@
  *
  * Usage:
  *   const { getContractAddress, getChainContracts, loadContractsIntoProcessEnv } = require('../config/contracts-loader.cjs');
- *   getContractAddress(138, 'CCIP_Router')  // => '0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817'
+ *   getContractAddress(138, 'CCIP_Router')  // => '0x8078A09637e47Fa5Ed34F626046Ea2094a5CDE5e'
  *   getContractAddress(138, 'CCIPWETH9_Bridge')  // by contract key
  *   loadContractsIntoProcessEnv()  // set process.env.CCIP_ROUTER etc. from envVarMap when unset
  *

config/dbis-data-api/README.md

@@ -1,38 +0,0 @@
-# DBIS Data API — implementation notes
-
-OpenAPI contract: [openapi.yaml](./openapi.yaml).
-
-## Lineage
-
-| Value | Meaning |
-|-------|---------|
-| `on_chain` | Derived from Chain 138 indexer, RPC, or token-aggregation inputs |
-| `policy` | Published by policy officers; not implied as ledger truth |
-| `modelled` | Simulation or internal model |
-
-## Suggested PostgreSQL / Timescale layout
-
-**Relational (PostgreSQL)**
-
-- `api_clients` — id, name, key_hash, rate_limit_tier, created_at  
-- `datasets` — id, slug, title, description, lineage_default  
-- `dataset_versions` — dataset_id, version, published_at, document_url  
-
-**Hypertables (TimescaleDB)**
-
-- `metric_gru_supply` — time TIMESTAMPTZ, value NUMERIC, metadata JSONB  
-- `metric_settlement_volume` — time, window, chain_id, value, tx_count  
-- `metric_reserve_snapshot` — time, asset, amount, source  
-
-Ingest jobs read from existing token-aggregation and explorer-compatible sources; separate ETL for policy-published series.
-
-## Frontend (DBIS portal)
-
-Set `NEXT_PUBLIC_DATA_API_BASE` in the Gov Web Portals DBIS app (see `DBIS/.env.example`) so the homepage and `/dashboard` monetary panels call this API. When the service is down, the UI shows placeholders and an “unreachable” status.
-
-## Deployment path
-
-1. Provision CT/VM or service user on LAN.  
-2. NPMplus proxy host `data.d-bis.org` → upstream.  
-3. Enable API keys (optional) for high-volume consumers; public tier remains read-only GET.  
-4. Add host to [E2E_ENDPOINTS_LIST.md](../../docs/04-configuration/E2E_ENDPOINTS_LIST.md) when live.

config/dbis-data-api/openapi.yaml

@@ -1,133 +0,0 @@
-openapi: 3.1.0
-info:
-  title: DBIS Data API
-  version: 0.1.0
-  description: |
-    Public read API for data.d-bis.org — monetary aggregates, GRU series, settlement summaries, rates.
-    Every response MUST declare lineage via `x-dbis-lineage` on operations: `on_chain`, `policy`, `modelled`.
-servers:
-  - url: https://data.d-bis.org
-    description: Production
-  - url: http://localhost:8080
-    description: Local
-tags:
-  - name: gru
-  - name: reserves
-  - name: settlement
-  - name: rates
-paths:
-  /v1/health:
-    get:
-      summary: Liveness
-      operationId: health
-      responses:
-        "200":
-          description: OK
-          content:
-            application/json:
-              schema:
-                type: object
-                properties:
-                  status: { type: string, example: ok }
-  /v1/gru/supply:
-    get:
-      tags: [gru]
-      summary: GRU supply time series (when defined)
-      operationId: gruSupply
-      x-dbis-lineage: policy
-      parameters:
-        - name: from
-          in: query
-          schema: { type: string, format: date }
-        - name: to
-          in: query
-          schema: { type: string, format: date }
-      responses:
-        "200":
-          description: Series points
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/TimeSeriesResponse"
-        "501":
-          description: Not yet published
-  /v1/reserves/summary:
-    get:
-      tags: [reserves]
-      summary: Reserve holdings summary
-      operationId: reservesSummary
-      x-dbis-lineage: on_chain
-      responses:
-        "200":
-          description: Summary
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/ReservesSummary"
-  /v1/settlement/volumes:
-    get:
-      tags: [settlement]
-      summary: Settlement volume aggregates
-      operationId: settlementVolumes
-      x-dbis-lineage: on_chain
-      parameters:
-        - name: window
-          in: query
-          schema: { type: string, enum: [1h, 24h, 7d, 30d] }
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/SettlementVolumes"
-  /v1/rates/reference:
-    get:
-      tags: [rates]
-      summary: Reference rates (policy or observed)
-      operationId: referenceRates
-      x-dbis-lineage: policy
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                type: object
-                additionalProperties: true
-components:
-  schemas:
-    LineageMeta:
-      type: object
-      required: [lineage, asOf]
-      properties:
-        lineage:
-          type: string
-          enum: [on_chain, policy, modelled]
-        asOf: { type: string, format: date-time }
-        source: { type: string }
-    TimeSeriesResponse:
-      allOf:
-        - $ref: "#/components/schemas/LineageMeta"
-        - type: object
-          properties:
-            unit: { type: string }
-            points:
-              type: array
-              items:
-                type: object
-                required: [t, v]
-                properties:
-                  t: { type: string, format: date-time }
-                  v: { type: number }
-    ReservesSummary:
-      allOf:
-        - $ref: "#/components/schemas/LineageMeta"
-        - type: object
-          additionalProperties: true
-    SettlementVolumes:
-      allOf:
-        - $ref: "#/components/schemas/LineageMeta"
-        - type: object
-          properties:
-            window: { type: string }
-            totalValue: { type: string, description: Decimal string }
-            txCount: { type: integer }

config/dbis-ecosystem-master-plan-tracker.json

@@ -0,0 +1,166 @@
+{
+  "schemaVersion": "1.0.0",
+  "updated": "2026-04-24",
+  "canonicalRootDoc": "docs/02-architecture/DBIS_ECOSYSTEM_TECHNICAL_MASTER_PLAN.md",
+  "workstreams": [
+    {
+      "id": "W1",
+      "title": "Besu / Chain 138 infrastructure and RPC topology",
+      "status": "live",
+      "horizon": "near_term",
+      "ownerClass": "mixed",
+      "dependsOn": [],
+      "sourceDocs": [
+        "docs/06-besu/BESU_NODE_CONFIGURATION_MAP_20260424.md",
+        "dbis_chain_138_technical_master_plan.md",
+        "docs/03-deployment/PROXMOX_VE_OPERATIONAL_DEPLOYMENT_TEMPLATE.md"
+      ],
+      "acceptanceGate": "Canonical Besu inventory reconciled across all active cluster hosts, block production healthy, and no unexplained canonical node gaps remain.",
+      "evidenceArtifact": "scripts/verify/check-cluster-besu-inventory.sh --json"
+    },
+    {
+      "id": "W2",
+      "title": "Liquidity, PMM, bridge, and public routing coverage",
+      "status": "partially live",
+      "horizon": "near_term",
+      "ownerClass": "mixed",
+      "dependsOn": [
+        "W1"
+      ],
+      "sourceDocs": [
+        "docs/11-references/DEPLOYER_TO_PUBLIC_STABLECOIN_ROUTES.md",
+        "docs/11-references/DEPLOYED_TOKENS_BRIDGES_LPS_AND_ROUTING_STATUS.md",
+        "reports/status/LIVE_ECOSYSTEM_FINANCIAL_INVENTORY_AND_ROUTING_GAPS_20260424.md"
+      ],
+      "acceptanceGate": "Machine-readable route coverage is current and can distinguish live, partial, and blocked routing paths for stablecoins and top assets.",
+      "evidenceArtifact": "config/public-routing-coverage-matrix.json"
+    },
+    {
+      "id": "W3",
+      "title": "Phoenix deploy/control-plane integration",
+      "status": "partially live",
+      "horizon": "near_term",
+      "ownerClass": "mixed",
+      "dependsOn": [
+        "W1",
+        "W2",
+        "W4"
+      ],
+      "sourceDocs": [
+        "docs/04-configuration/PHOENIX_SANKOFA_OPERATOR_HANDOFF.md",
+        "docs/02-architecture/DBIS_ECOSYSTEM_TECHNICAL_MASTER_PLAN.md"
+      ],
+      "acceptanceGate": "Phoenix deploy/control APIs expose current canonical manifests and validated deploy targets without drifting from repo truth.",
+      "evidenceArtifact": "scripts/validation/validate-config-files.sh"
+    },
+    {
+      "id": "W4",
+      "title": "URA manifest, policy profiles, registry, and route confidence",
+      "status": "repo-implemented",
+      "horizon": "near_term",
+      "ownerClass": "repo",
+      "dependsOn": [
+        "W2",
+        "W3"
+      ],
+      "sourceDocs": [
+        "docs/04-configuration/universal-resource-activation/URA_MANIFEST_AUTOMATION_IMPLEMENTATION_TRACKER.md",
+        "docs/04-configuration/universal-resource-activation/README.md",
+        "config/universal-resource-activation/manifest.json"
+      ],
+      "acceptanceGate": "URA manifest and policy profiles validate, registry references are coherent, and route-confidence can be produced as a first-class control-plane artifact.",
+      "evidenceArtifact": "scripts/validate/validate-universal-resource-activation.mjs"
+    },
+    {
+      "id": "W5",
+      "title": "DBIS RTGS / DBIS Rail / OMNL / settlement sidecars",
+      "status": "partially live",
+      "horizon": "near_term",
+      "ownerClass": "mixed",
+      "dependsOn": [
+        "W4",
+        "W6"
+      ],
+      "sourceDocs": [
+        "docs/03-deployment/DBIS_RTGS_MASTER_PLAN_IMPLEMENTATION_TRACKER.md",
+        "docs/dbis-rail/DBIS_RAIL_SETTLEMENT_EVENT_SOURCES.md",
+        "docs/03-deployment/DBIS_RTGS_FIRST_SLICE_ARCHITECTURE.md"
+      ],
+      "acceptanceGate": "First-slice settlement boundaries, event sources, custody roles, and sidecar responsibilities are explicit enough for production gating.",
+      "evidenceArtifact": "docs/03-deployment/DBIS_RTGS_MASTER_PLAN_IMPLEMENTATION_TRACKER.md"
+    },
+    {
+      "id": "W6",
+      "title": "Jurisdiction/compliance and onboarding matrices",
+      "status": "repo-implemented",
+      "horizon": "near_term",
+      "ownerClass": "repo",
+      "dependsOn": [
+        "W4"
+      ],
+      "sourceDocs": [
+        "docs/04-configuration/compliance-matrices/README.md",
+        "docs/04-configuration/jurisdictions/JURISDICTION_CATALOG.md",
+        "docs/dbis-rail/DBIS_RAIL_JURISDICTION_TRACEABILITY.md"
+      ],
+      "acceptanceGate": "Jurisdiction and onboarding matrices are machine-readable enough to gate policy profiles and institutional activation paths.",
+      "evidenceArtifact": "config/jurisdictions/catalog.v1.json"
+    },
+    {
+      "id": "W7",
+      "title": "Identity / Hyperledger / interoperability stack",
+      "status": "planned",
+      "horizon": "long_term",
+      "ownerClass": "external",
+      "dependsOn": [
+        "W5",
+        "W6"
+      ],
+      "sourceDocs": [
+        "docs/03-deployment/DBIS_HYPERLEDGER_RUNTIME_STATUS.md",
+        "docs/03-deployment/DBIS_HYPERLEDGER_IDENTITY_STACK_DECISION.md"
+      ],
+      "acceptanceGate": "Identity and interoperability slices have explicit runtime ownership, promotion gates, and environment-specific deployment decisions.",
+      "evidenceArtifact": "docs/03-deployment/DBIS_HYPERLEDGER_RUNTIME_STATUS.md"
+    },
+    {
+      "id": "W8",
+      "title": "Observability, verification, evidence, and operator readiness",
+      "status": "live",
+      "horizon": "near_term",
+      "ownerClass": "mixed",
+      "dependsOn": [
+        "W1",
+        "W2",
+        "W3",
+        "W4",
+        "W5",
+        "W6"
+      ],
+      "sourceDocs": [
+        "docs/00-meta/OPERATOR_HANDOFF_2026_04_24.md",
+        "docs/00-meta/OPERATOR_READY_CHECKLIST.md",
+        "docs/04-configuration/universal-resource-activation/URA_OPERATIONAL_READINESS_CHECKLIST.md"
+      ],
+      "acceptanceGate": "Validation, health, and operator readiness outputs are current enough to act as production gates rather than ad hoc references.",
+      "evidenceArtifact": "scripts/verify/run-all-validation.sh"
+    }
+  ],
+  "blockedBy": [
+    {
+      "id": "B1",
+      "class": "external",
+      "description": "Some institutional integrations, custody counterparties, and settlement-sidecar dependencies cannot be closed from repo-only work."
+    },
+    {
+      "id": "B2",
+      "class": "external",
+      "description": "Some public-network expansion lanes remain constrained by third-party bridge, exchange, or destination-liquidity realities."
+    },
+    {
+      "id": "B3",
+      "class": "operator",
+      "description": "Operator promotion of URA, sidecar, and policy-aware runtime slices still trails repo implementation in several areas."
+    }
+  ]
+}

config/dbis-institutional/README.md

@@ -1,115 +0,0 @@
-# DBIS institutional config (schemas + examples)
-
-Machine-readable artifacts for **OMNL + DBIS Core + Chain 138 + RTGS** integration and **identifier** alignment (LEI, IBAN, ISIN, ENS, WEB3-ETH-IBAN, explorer labels).
-
-## Canonical narrative doc
-
-[OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md](../../docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md)
-
-## WEB3-ETH-IBAN (`web3_eth_iban`) vs bank IBAN
-
-In this registry, **`aliases[].aliasType` = `web3_eth_iban`** is an **Ethereum presentation alias**: an **XE…** string in the same family as [ICAP / IBAN-style encoding](https://github.com/ethereum/wiki/wiki/ICAP:-Inter-exchange-Client-Address-Protocol) used by [Web3.js `Iban`](https://docs.web3js.org/libdocs/Iban). It is **not** a SWIFT bank IBAN. **`fiat_rails[].railType` = `iban`** is for **regulated fiat** account identifiers.
-
-- **Validate checksum and resolve to `address`:** from repo root, `node scripts/verify/validate-address-registry-xe-aliases.mjs [file.json …]` (defaults to institutional examples). Wired into `validate-dbis-institutional-schemas.sh` when `node` and npm package `web3-eth-iban` are installed at the workspace root.
-- **Library:** [`web3-eth-iban`](https://www.npmjs.com/package/web3-eth-iban) (also bundled as `web3.eth.Iban` in web3.js v1).
-
-## Event producers (`event-producers.manifest.json`)
-
-Registered logical emitters for `settlement-event.event_producer` (kept in sync with the `enum` in `schemas/settlement-event.schema.json`). Add a producer: extend both the manifest and the schema enum in one change.
-
-## Schemas (`schemas/`)
-
-| File | Purpose |
-|------|---------|
-| `settlement-event.schema.json` | Cross-system settlement / evidence event (section 6 of runbook). |
-| `address-registry-entry.schema.json` | Vault or wallet row: `0x` address, fiat rails, Web3 aliases, optional ISIN/CUSIP, Blockscout label hints (sections 3, 7, 13). |
-
-## Examples (`examples/`)
-
-| File | Pairs with |
-|------|------------|
-| `settlement-event.example.json` | `settlement-event.schema.json` (hybrid: includes `uetr` + internal refs) |
-| `settlement-event.chain138-primary.example.json` | Same schema; **Chain 138 as authoritative rail** — no `uetr`; `rtgs_message_ids.rail` + internal refs; see [OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md](../../docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md) |
-| `settlement-event.min.json` | **Minimal** valid `CHAIN_SETTLEMENT` fixture (required fields + `chain_tx_hash` / `chain_id`); CI baseline in `validate-dbis-institutional-schemas.sh`. |
-| `settlement-events-batch.example.json` | Each array element validated against `settlement-event.schema.json` (see `validate-dbis-institutional-schemas.sh`) |
-| `address-registry-entry.example.json` | `address-registry-entry.schema.json`; `web3_eth_iban` uses a valid **XE…** string that resolves to `address` (see XE section above) |
-| `address-registry-entries-batch.example.json` | Each array element validated against `address-registry-entry.schema.json` |
-
-Examples use placeholder addresses and ids; replace with live data in a secure store (not committed).
-
-### Settlement `amount` convention (operators + integrators)
-
-Use **major currency units** as a decimal string, with explicit scale for fiat:
-
-- **`amount`:** string matching `^-?[0-9]+(\.[0-9]+)?$` (e.g. USD 25,000,000.00 → `"25000000.00"`).
-- **`amount_scale`:** use **`2`** for USD and other ISO 4217 currencies with two decimal places.
-
-Fineract journal APIs may still use **minor units (cents)**; convert at the boundary and record settlement events in **major units** so logs and regulatory exports stay human-aligned. Do not mix major and minor in the same field without documenting which convention applies.
-
-### Chain 138 as SWIFT replacement vs UETR
-
-When settlement is **authoritative on Chain 138** (chain id **138**), treat **`correlation_id` + `chain_tx_hash` + `occurred_at`** as the primary rail-native E2E evidence for that leg. **`rtgs_message_ids.uetr`** is **optional** unless you also run a **parallel SWIFT gpi** leg (hybrid); then record both UETR and chain fields on the same **`correlation_id`**.
-
-### SWIFT UETR vs internal “message sent” reference
-
-**UETR** belongs in `rtgs_message_ids.uetr` when the payment is on **SWIFT gpi** (or your counterparty/scheme requires it). You **cannot** treat an arbitrary internal message id as a regulatory substitute for UETR on **those** legs.
-
-When no UETR exists yet (internal-only, pre-SWIFT, DLT-only, domestic rail), add extra keys under **`rtgs_message_ids`** (the schema allows any string keys), e.g. `internal_instruction_ref`, `operator_message_ref`, or a digest of the submitted instruction — and keep **`correlation_id`** as the cross-system spine. When UETR is later assigned, **record it** and retain internal refs for audit lineage.
-
-Policy and audit-scope notes: [OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md](../../docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md).
-
-## Related repo config
-
-- OMNL entity master: `docs/04-configuration/mifos-omnl-central-bank/OMNL_ENTITY_MASTER_DATA.json`
-- Institutional subdomains: `docs/04-configuration/DBIS_INSTITUTIONAL_SUBDOMAINS.md`
-- Blockscout address labeling (K8s): `smom-dbis-138/k8s/blockscout/address-labeling-config.yaml`
-
-## Validation
-
-```bash
-# JSON parse (all examples/*.json)
-bash scripts/validation/validate-dbis-institutional-json.sh
-
-# JSON Schema — requires check-jsonschema on PATH (PEP 668 / “externally managed” Python):
-#   python3 -m venv .venv-checkjson && .venv-checkjson/bin/pip install check-jsonschema
-#   PATH="$PWD/.venv-checkjson/bin:$PATH" bash scripts/validation/validate-dbis-institutional-schemas.sh
-# Or: pipx install check-jsonschema
-SCHEMA_STRICT=1 bash scripts/validation/validate-dbis-institutional-schemas.sh
-```
-
-`scripts/validation/validate-dbis-institutional-schemas.sh` validates **checked-in examples** only. For a **live or one-off** settlement event file, validate it directly:
-
-### Validation — ad-hoc settlement event
-
-```bash
-# From repository root; use the same venv as above or any check-jsonschema on PATH.
-PATH="$PWD/.venv-checkjson/bin:$PATH" check-jsonschema \
-  --schemafile config/dbis-institutional/schemas/settlement-event.schema.json \
-  your-event.json
-```
-
-- **Success:** exit code **0**; typical stdout is `ok -- validation done` (wording may vary by version).
-- **Failure:** non-zero exit; `ValidationError` / `SchemaError` in stderr — treat as **not schema-closed**.
-
-Do not use `validate-dbis-institutional-schemas.sh` as a substitute for validating arbitrary payload files.
-
-`validate-config-files.sh` runs schema validation automatically when `check-jsonschema` is on `PATH`. The gitignored venv `.venv-checkjson/` is listed in `.gitignore` for this purpose.
-
-Validated pairs (examples versus schemas): `settlement-event`, `address-registry-entry`, `trust`, `governance`, `policy` (against `policy-manifest.schema.json`).
-
-`settlement-event` optionally carries **ISO-20022** (`iso_msg_type`, `iso_instruction_id`, `iso_payload_hash`, `rail_iso_hash`) and **identity** (`holder_did`, `identity_verification_ref`) for full fiat / FX / chain correlation — see runbook section 14.
-
-`address-registry-entry` supports **`iso_intake`** and **`dbis_settlement_router`** roles plus optional **`primary_holder_did`** and **`identity_anchor_ref`** (section 14.6 checklist).
-
-## Blockscout address labels
-
-Plan or sync labels from registry JSON (`blockscout.label` + `status: active`):
-
-```bash
-bash scripts/verify/sync-blockscout-address-labels-from-registry.sh config/dbis-institutional/examples/address-registry-entry.example.json
-bash scripts/verify/sync-blockscout-address-labels-from-registry.sh --from-dir config/dbis-institutional/registry
-# Preferred for the self-hosted Chain 138 explorer (writes Blockscout Postgres address_names):
-bash scripts/verify/sync-blockscout-address-labels-from-registry.sh --apply --mode=db --from-dir config/dbis-institutional/registry
-```
-
-On `explorer.d-bis.org`, public `/api/v1/*` is served by token-aggregation, not by a Blockscout label-write API, so `--mode=db` is the correct operator path for live labels unless you have separately enabled a dedicated label endpoint. See `registry/README.md` for drop-in files (gitignored by default).

config/dbis-institutional/event-producers.manifest.json

@@ -1,38 +0,0 @@
-{
-  "schema_version": 1,
-  "description": "Registered settlement event emitters. Keep in sync with settlement-event.schema.json event_producer enum.",
-  "producers": [
-    {
-      "id": "hybx-omnl-sidecar",
-      "summary": "HYBX Fineract/OMNL integration sidecar emitting settlement-correlated events."
-    },
-    {
-      "id": "dbis-core",
-      "summary": "DBIS Core banking / nostro-vostro / ISO adapter path."
-    },
-    {
-      "id": "iso-gateway",
-      "summary": "Off-chain ISO gateway building canonical bundles before chain or relayer submission."
-    },
-    {
-      "id": "mintauth-relayer",
-      "summary": "MintAuth EIP-712 quorum and relayer calling SettlementRouter or related contracts."
-    },
-    {
-      "id": "chain-settlement-worker",
-      "summary": "Worker observing chain receipts and emitting settlement events for reconciliation."
-    },
-    {
-      "id": "omnl-fineract-webhook",
-      "summary": "Fineract/OMNL webhook or callback integration."
-    },
-    {
-      "id": "integration-hub-example",
-      "summary": "Documentation / lab example only; not a production system id."
-    },
-    {
-      "id": "manual-operator",
-      "summary": "Human-initiated or ops tooling emission with explicit audit trail."
-    }
-  ]
-}

config/dbis-institutional/examples/address-registry-entries-batch.example.json

@@ -1,29 +0,0 @@
-[
-  {
-    "registryEntryId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
-    "entity_id": "98450070C57395F6B906",
-    "jurisdiction": "ID",
-    "chain_id": 138,
-    "address": "0x0000000000000000000000000000000000000001",
-    "addressRole": "treasury_vault",
-    "status": "active",
-    "blockscout": {
-      "label": "OMNL — Treasury vault (Office 22)",
-      "labelType": "contract"
-    }
-  },
-  {
-    "registryEntryId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
-    "entity_id": "98450070C57395F6B906",
-    "jurisdiction": "ID",
-    "chain_id": 138,
-    "address": "0x0000000000000000000000000000000000000002",
-    "addressRole": "iso_intake",
-    "status": "active",
-    "primary_holder_did": "did:sov:WRfXg6LQCZgRsXoHF",
-    "blockscout": {
-      "label": "ISO intake / gateway (verify live address)",
-      "labelType": "contract"
-    }
-  }
-]

config/dbis-institutional/examples/address-registry-entry.example.json

@@ -1,53 +0,0 @@
-{
-  "registryEntryId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
-  "entity_id": "98450070C57395F6B906",
-  "jurisdiction": "ID",
-  "class_id": "C01",
-  "anchor_id": "C01-A01",
-  "division_id": "C01-A01-D01",
-  "omnl_office_id": 22,
-  "dbis_participant_id": "PART-ID-OMNL-HO-001",
-  "chain_id": 138,
-  "address": "0x00c5496aEe77C1bA1f0854206A26DdA82a81D6D8",
-  "addressRole": "treasury_vault",
-  "fiat_rails": [
-    {
-      "railType": "iban",
-      "railValue": "ID00XXXX0000000000000000",
-      "bic": "EXAMPLEIDJ",
-      "validFrom": "2026-01-01"
-    }
-  ],
-  "aliases": [
-    {
-      "aliasType": "ens",
-      "aliasValue": "treasury-example.eth",
-      "resolver_chain_id": 1,
-      "validFrom": "2026-03-01T00:00:00Z"
-    },
-    {
-      "aliasType": "web3_eth_iban",
-      "aliasValue": "XE7338O073KYGTWWZN0F2WZ0R8PX5ZPPZS",
-      "validFrom": "2026-03-15T00:00:00Z"
-    },
-    {
-      "aliasType": "custom_ens_tld",
-      "aliasValue": "vault.anchor01.d-bis",
-      "validFrom": "2026-03-20T00:00:00Z"
-    }
-  ],
-  "instruments": [
-    {
-      "isin": "US0000000000",
-      "cusip": "000000000"
-    }
-  ],
-  "primary_holder_did": "did:sov:WRfXg6LQCZgRsXoHF",
-  "identity_anchor_ref": "indy-nym-or-acapy-conn-example",
-  "blockscout": {
-    "label": "OMNL — Treasury vault (Office 22)",
-    "labelType": "contract"
-  },
-  "status": "active",
-  "lastCorrelationId": "550e8400-e29b-41d4-a716-446655440001"
-}

config/dbis-institutional/examples/governance.json

@@ -1,13 +0,0 @@
-{
-  "version": "0.1.0",
-  "issuedAt": "2026-03-30T00:00:00Z",
-  "amendmentProcess": "Described in DBIS Charter and Governance Statute (placeholder).",
-  "bodies": [
-    {
-      "id": "council",
-      "name": "Sovereign Council",
-      "role": "Strategic oversight",
-      "documentUrl": "https://d-bis.org/documents/governance-statute"
-    }
-  ]
-}

config/dbis-institutional/examples/policy.json

@@ -1,13 +0,0 @@
-{
-  "version": "0.1.0",
-  "issuedAt": "2026-03-30T00:00:00Z",
-  "policies": [
-    {
-      "id": "gru-overview-v0",
-      "title": "Global Reserve Unit — Overview (draft)",
-      "effectiveDate": "2026-03-30",
-      "documentUrl": "https://d-bis.org/gru/overview",
-      "hashSha256": "0000000000000000000000000000000000000000000000000000000000000000"
-    }
-  ]
-}

config/dbis-institutional/examples/settlement-event.chain138-primary.example.json

@@ -1,30 +0,0 @@
-{
-  "schema_version": 1,
-  "correlation_id": "660e8400-e29b-41d4-a716-446655440002",
-  "event_producer": "chain-settlement-worker",
-  "entity_id": "98450070C57395F6B906",
-  "jurisdiction": "ID",
-  "class_id": "C01",
-  "anchor_id": "C01-A01",
-  "division_id": "C01-A01-D01",
-  "amount": "25000000.00",
-  "amount_scale": 2,
-  "currency": "USD",
-  "event_type": "CHAIN_SETTLEMENT",
-  "omnl_journal_entry_id": 88421,
-  "omnl_office_id": 22,
-  "dbis_reference": "CORE-TX-2026-0331-CHAIN138",
-  "rtgs_message_ids": {
-    "rail": "chain138",
-    "internal_instruction_ref": "OMNL-M1-KANAYA-CKRA-20260331",
-    "operator_message_ref": "sha256:replace-with-digest-of-instruction-or-archive-manifest"
-  },
-  "chain_id": 138,
-  "chain_tx_hash": "0xb90f2da51d9c506f552d276d9aa57f4ae485528f2ee6025f435f188d09d405f4",
-  "ipsas_narrative": "Chain 138 authoritative settlement leg; no SWIFT UETR on this flow",
-  "occurred_at": "2026-03-31T10:00:00Z",
-  "iso_msg_type": "pacs.008",
-  "iso_instruction_id": "pain001-hashed-key-placeholder",
-  "iso_payload_hash": "0xcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-  "rail_iso_hash": "0xdddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
-}

config/dbis-institutional/examples/settlement-event.example.json

@@ -1,33 +0,0 @@
-{
-  "schema_version": 1,
-  "correlation_id": "550e8400-e29b-41d4-a716-446655440001",
-  "event_producer": "integration-hub-example",
-  "entity_id": "98450070C57395F6B906",
-  "jurisdiction": "ID",
-  "class_id": "C01",
-  "anchor_id": "C01-A01",
-  "division_id": "C01-A01-D01",
-  "amount": "1000000.00",
-  "amount_scale": 2,
-  "currency": "USD",
-  "event_type": "CHAIN_SETTLEMENT",
-  "omnl_journal_entry_id": 12045,
-  "omnl_office_id": 22,
-  "dbis_reference": "CORE-TX-2026-0330-88421",
-  "rtgs_message_ids": {
-    "uetr": "97ed4827-7b6f-4491-94b1-d651442ca301",
-    "msgId": "BNI2026033012000001",
-    "internal_instruction_ref": "018215821582-INAAUDJVMTM-2025-MSG-001",
-    "operator_message_ref": "sha256:replace-with-digest-of-submitted-instruction-payload"
-  },
-  "chain_id": 138,
-  "chain_tx_hash": "0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-  "ipsas_narrative": "IPSAS28/29 settlement leg; PvP net beneficiary credit",
-  "occurred_at": "2026-03-30T12:00:00Z",
-  "iso_msg_type": "pacs.008",
-  "iso_instruction_id": "0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
-  "iso_payload_hash": "0xcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
-  "rail_iso_hash": "0xdddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
-  "holder_did": "did:sov:WRfXg6LQCZgRsXoHF",
-  "identity_verification_ref": "acapy-proof-req-2026-0330-001"
-}

config/dbis-institutional/examples/settlement-event.min.json

@@ -1,12 +0,0 @@
-{
-  "schema_version": 1,
-  "entity_id": "OMNL",
-  "jurisdiction": "MT",
-  "correlation_id": "00000000-0000-0000-0000-000000000001",
-  "event_type": "CHAIN_SETTLEMENT",
-  "amount": "1.00",
-  "amount_scale": 2,
-  "currency": "USD",
-  "chain_tx_hash": "0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-  "chain_id": 138
-}

config/dbis-institutional/examples/settlement-events-batch.example.json

@@ -1,33 +0,0 @@
-[
-  {
-    "schema_version": 1,
-    "correlation_id": "550e8400-e29b-41d4-a716-446655440001",
-    "event_producer": "chain-settlement-worker",
-    "entity_id": "98450070C57395F6B906",
-    "jurisdiction": "ID",
-    "class_id": "C01",
-    "anchor_id": "C01-A01",
-    "division_id": "C01-A01-D01",
-    "amount": "1000000.00",
-    "amount_scale": 2,
-    "currency": "USD",
-    "event_type": "CHAIN_SETTLEMENT",
-    "chain_id": 138,
-    "chain_tx_hash": "0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-    "occurred_at": "2026-03-30T12:00:00Z"
-  },
-  {
-    "schema_version": 1,
-    "correlation_id": "550e8400-e29b-41d4-a716-446655440002",
-    "event_producer": "omnl-fineract-webhook",
-    "entity_id": "98450070C57395F6B906",
-    "jurisdiction": "ID",
-    "amount": "0",
-    "currency": "USD",
-    "event_type": "OMNL_JOURNAL_POSTED",
-    "omnl_journal_entry_id": 12046,
-    "omnl_office_id": 22,
-    "occurred_at": "2026-03-30T12:05:00Z",
-    "no_chain_leg_reason": "IPSAS-only reclassification; no on-ledger leg"
-  }
-]

config/dbis-institutional/examples/trust.json

@@ -1,16 +0,0 @@
-{
-  "version": "0.1.0",
-  "issuedAt": "2026-03-30T00:00:00Z",
-  "organization": "Digital Bank of International Settlements",
-  "endpoints": {
-    "didRegistry": "https://identity.d-bis.org/registry",
-    "dataApi": "https://data.d-bis.org",
-    "explorer": "https://explorer.d-bis.org",
-    "status": "https://status.d-bis.org",
-    "developers": "https://developers.d-bis.org",
-    "gitea": "https://gitea.d-bis.org"
-  },
-  "jwksUri": "https://identity.d-bis.org/.well-known/jwks.json",
-  "caHints": ["production-trust-anchor.example"],
-  "notes": "Example only — replace URIs and keys before production."
-}

config/dbis-institutional/registry/.gitignore

@@ -1,4 +0,0 @@
-# Operator-specific registry rows; do not commit live LEI/IBAN/addresses.
-*.json
-!.gitignore
-!README.md

config/dbis-institutional/registry/README.md

@@ -1,42 +0,0 @@
-# Address registry drop-in (operator / CI)
-
-Place **non-example** `address-registry-entry` JSON files here (one object per file, or one array in a single file). These files may contain **LEI, IBAN, and live `0x` addresses** — treat as confidential; prefer `.gitignore` or a secrets store in production.
-
-## Sync labels to Blockscout
-
-From repo root (plan only):
-
-```bash
-bash scripts/verify/sync-blockscout-address-labels-from-registry.sh --from-dir config/dbis-institutional/registry
-```
-
-Or a **single JSON array** file (see [`../examples/address-registry-entries-batch.example.json`](../examples/address-registry-entries-batch.example.json)):
-
-```bash
-bash scripts/verify/sync-blockscout-address-labels-from-registry.sh path/to/registry-array.json
-```
-
-Apply (LAN or VPN to explorer; set API key if required):
-
-```bash
-export BLOCKSCOUT_API_KEY=...   # if your Blockscout instance requires it
-bash scripts/verify/sync-blockscout-address-labels-from-registry.sh --apply --from-dir config/dbis-institutional/registry
-```
-
-For the self-hosted Chain 138 explorer, prefer direct DB sync:
-
-```bash
-bash scripts/verify/sync-blockscout-address-labels-from-registry.sh --apply --mode=db --from-dir config/dbis-institutional/registry
-```
-
-That path writes Blockscout primary labels into `public.address_names` through the explorer CT (`5000`) because `explorer.d-bis.org/api/v1/*` is token-aggregation, not a native Blockscout label-write surface. Use HTTP mode only if you have separately enabled and confirmed a compatible label endpoint (default probe target: `/api/v1/labels`).
-
-## Token contract staging
-
-This directory is also the right place for **live token-contract label rows** that should not be committed, for example:
-
-- staged `cUSDT V2` / `cUSDC V2` token contract labels on Chain 138
-- bridge-side `cW*` contracts before public cutover
-- temporary explorer labels used during GRU V1/V2 coexistence
-
-Keep versioned token contracts clearly labeled in `blockscout.label`, for example `Chain 138 cUSDT V2 (staged)`, so explorer operators can distinguish them from the active V1 liquidity contracts.

config/dbis-institutional/registry/chain138-cusdc-v2.json

@@ -0,0 +1,21 @@
+{
+  "registryEntryId": "a5c115dd-e147-4eb5-8cf1-f7d9c38f959e",
+  "entity_id": "98450070C57395F6B906",
+  "jurisdiction": "International",
+  "chain_id": 138,
+  "address": "0x1ac3F4942a71E86A9682D91837E1E71b7BACdF99",
+  "addressRole": "token_contract",
+  "aliases": [
+    {
+      "aliasType": "internal_slug",
+      "aliasValue": "chain138-cusdc-v2",
+      "validFrom": "2026-03-31T08:22:11Z"
+    }
+  ],
+  "blockscout": {
+    "label": "Chain 138 cUSDC V2 (staged)",
+    "labelType": "token"
+  },
+  "status": "active",
+  "lastCorrelationId": "deploy-cusdc-v2-2026-03-31"
+}

config/dbis-institutional/registry/chain138-cusdt-v2.json

@@ -0,0 +1,21 @@
+{
+  "registryEntryId": "3cc7d52c-26fb-4afb-9508-0c102f8f6f81",
+  "entity_id": "98450070C57395F6B906",
+  "jurisdiction": "International",
+  "chain_id": 138,
+  "address": "0x8d342d321DdEe97D0c5011DAF8ca0B59DA617D29",
+  "addressRole": "token_contract",
+  "aliases": [
+    {
+      "aliasType": "internal_slug",
+      "aliasValue": "chain138-cusdt-v2",
+      "validFrom": "2026-03-31T08:22:11Z"
+    }
+  ],
+  "blockscout": {
+    "label": "Chain 138 cUSDT V2 (staged)",
+    "labelType": "token"
+  },
+  "status": "active",
+  "lastCorrelationId": "deploy-cusdt-v2-2026-03-31"
+}

config/dbis-institutional/schemas/address-registry-entry.schema.json

@@ -1,140 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://d-bis.org/schemas/address-registry-entry.json",
-  "title": "Chain address + fiat + Web3 alias registry entry",
-  "description": "Source-of-truth row for explorer sync and settlement binding. See docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md sections 3, 7, 13, 14.",
-  "type": "object",
-  "required": [
-    "registryEntryId",
-    "entity_id",
-    "jurisdiction",
-    "chain_id",
-    "address",
-    "addressRole",
-    "status"
-  ],
-  "properties": {
-    "registryEntryId": {
-      "type": "string",
-      "description": "Stable UUID for this registry row."
-    },
-    "entity_id": {
-      "type": "string",
-      "description": "LEI (preferred) or internal party id."
-    },
-    "jurisdiction": { "type": "string" },
-    "class_id": { "type": "string" },
-    "anchor_id": { "type": "string" },
-    "division_id": { "type": "string" },
-    "omnl_office_id": { "type": "integer" },
-    "dbis_participant_id": { "type": "string" },
-    "chain_id": {
-      "type": "integer",
-      "description": "138 for production Chain 138."
-    },
-    "address": {
-      "type": "string",
-      "pattern": "^0x[a-fA-F0-9]{40}$",
-      "description": "Checksummed or lower-case EVM address (vault, EOA, or contract)."
-    },
-    "addressRole": {
-      "type": "string",
-      "enum": [
-        "treasury_vault",
-        "smart_account",
-        "eoa_operational",
-        "contract_registry",
-        "escrow",
-        "token_contract",
-        "iso_intake",
-        "dbis_settlement_router",
-        "other"
-      ]
-    },
-    "fiat_rails": {
-      "type": "array",
-      "items": {
-        "type": "object",
-        "required": ["railType", "railValue"],
-        "properties": {
-          "railType": {
-            "type": "string",
-            "enum": ["iban", "bban", "bic_account", "rtgs_account", "other"]
-          },
-          "railValue": { "type": "string" },
-          "bic": { "type": "string" },
-          "validFrom": { "type": "string", "format": "date" },
-          "validTo": { "type": "string", "format": "date" }
-        },
-        "additionalProperties": true
-      }
-    },
-    "aliases": {
-      "type": "array",
-      "items": {
-        "type": "object",
-        "required": ["aliasType", "aliasValue"],
-        "properties": {
-          "aliasType": {
-            "type": "string",
-            "enum": [
-              "ens",
-              "custom_ens_tld",
-              "web3_eth_iban",
-              "did",
-              "internal_slug",
-              "other"
-            ]
-          },
-          "aliasValue": { "type": "string" },
-          "resolver_chain_id": { "type": "integer" },
-          "validFrom": { "type": "string", "format": "date-time" },
-          "validTo": { "type": "string", "format": "date-time" }
-        },
-        "additionalProperties": true
-      }
-    },
-    "instruments": {
-      "type": "array",
-      "description": "ISIN/CUSIP held or represented at this address when applicable.",
-      "items": {
-        "type": "object",
-        "properties": {
-          "isin": { "type": "string" },
-          "cusip": { "type": "string" },
-          "figi": { "type": "string" }
-        },
-        "additionalProperties": true
-      }
-    },
-    "blockscout": {
-      "type": "object",
-      "description": "Hints for label sync (Blockscout /api/v1/labels or UI).",
-      "properties": {
-        "label": { "type": "string" },
-        "labelType": {
-          "type": "string",
-          "enum": ["account", "contract", "token"]
-        }
-      },
-      "additionalProperties": true
-    },
-    "status": {
-      "type": "string",
-      "enum": ["active", "pending", "revoked"]
-    },
-    "lastCorrelationId": {
-      "type": "string",
-      "description": "Last mutation tied to a settlement-event correlation_id."
-    },
-    "primary_holder_did": {
-      "type": "string",
-      "description": "Default operational DID for this address (Indy did:sov, did:web, etc.); link LEI in entity_id."
-    },
-    "identity_anchor_ref": {
-      "type": "string",
-      "description": "Indy NYM, ACA-Py connection, or OIDC subject binding reference for audits."
-    }
-  },
-  "additionalProperties": true
-}

config/dbis-institutional/schemas/governance.schema.json

@@ -1,27 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://d-bis.org/schemas/governance.json",
-  "title": "DBIS governance.json",
-  "type": "object",
-  "required": ["version", "issuedAt", "bodies"],
-  "properties": {
-    "version": { "type": "string" },
-    "issuedAt": { "type": "string", "format": "date-time" },
-    "amendmentProcess": { "type": "string" },
-    "bodies": {
-      "type": "array",
-      "items": {
-        "type": "object",
-        "required": ["id", "name"],
-        "properties": {
-          "id": { "type": "string" },
-          "name": { "type": "string" },
-          "role": { "type": "string" },
-          "documentUrl": { "type": "string", "format": "uri" }
-        },
-        "additionalProperties": true
-      }
-    }
-  },
-  "additionalProperties": false
-}

config/dbis-institutional/schemas/member-directory-entry.schema.json

@@ -1,64 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://d-bis.org/schemas/member-directory-entry.json",
-  "title": "DBIS member directory entry",
-  "type": "object",
-  "required": [
-    "memberId",
-    "name",
-    "jurisdiction",
-    "memberStatus",
-    "participationType",
-    "slug"
-  ],
-  "properties": {
-    "memberId": { "type": "string" },
-    "lei": { "type": "string" },
-    "name": { "type": "string" },
-    "shortName": { "type": "string" },
-    "jurisdiction": { "type": "string" },
-    "memberStatus": {
-      "type": "string",
-      "enum": ["active", "candidate", "suspended", "observer"]
-    },
-    "participationType": { "type": "string" },
-    "tier": {
-      "type": "string",
-      "enum": [
-        "full_central_bank",
-        "settlement_member",
-        "observer_member",
-        "infrastructure_member"
-      ]
-    },
-    "settlementRole": { "type": "string" },
-    "currencyParticipation": {
-      "type": "array",
-      "items": { "type": "string" }
-    },
-    "validatorRole": { "type": "string" },
-    "nodeParticipationStatus": { "type": "string" },
-    "roles": {
-      "type": "array",
-      "items": { "type": "string" }
-    },
-    "logoUrl": { "type": "string", "format": "uri" },
-    "slug": {
-      "type": "string",
-      "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$"
-    },
-    "summary": { "type": "string" },
-    "hq": {
-      "type": "object",
-      "description": "Headquarters WGS84 coordinates for strategic map",
-      "required": ["lat", "lng"],
-      "properties": {
-        "lat": { "type": "number", "minimum": -90, "maximum": 90 },
-        "lng": { "type": "number", "minimum": -180, "maximum": 180 },
-        "label": { "type": "string" }
-      },
-      "additionalProperties": false
-    }
-  },
-  "additionalProperties": false
-}

config/dbis-institutional/schemas/policy-manifest.schema.json

@@ -1,27 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://d-bis.org/schemas/policy-manifest.json",
-  "title": "DBIS policy.json manifest",
-  "type": "object",
-  "required": ["version", "issuedAt", "policies"],
-  "properties": {
-    "version": { "type": "string" },
-    "issuedAt": { "type": "string", "format": "date-time" },
-    "policies": {
-      "type": "array",
-      "items": {
-        "type": "object",
-        "required": ["id", "title", "hashSha256"],
-        "properties": {
-          "id": { "type": "string" },
-          "title": { "type": "string" },
-          "effectiveDate": { "type": "string", "format": "date" },
-          "documentUrl": { "type": "string", "format": "uri" },
-          "hashSha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" }
-        },
-        "additionalProperties": false
-      }
-    }
-  },
-  "additionalProperties": false
-}

config/dbis-institutional/schemas/settlement-event.schema.json

@@ -1,143 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://d-bis.org/schemas/settlement-event.json",
-  "title": "Canonical settlement event (OMNL / Core / RTGS / Chain 138)",
-  "description": "Minimum payload for cross-system reconciliation. See docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md sections 6 and 14 (ISO-20022 + DID).",
-  "type": "object",
-  "required": [
-    "schema_version",
-    "correlation_id",
-    "entity_id",
-    "jurisdiction",
-    "amount",
-    "currency",
-    "event_type"
-  ],
-  "properties": {
-    "schema_version": {
-      "type": "integer",
-      "minimum": 1,
-      "description": "Bump when breaking field semantics."
-    },
-    "correlation_id": {
-      "type": "string",
-      "minLength": 8,
-      "description": "UUID v4, ULID, or org ULID; immutable for the business event."
-    },
-    "entity_id": {
-      "type": "string",
-      "description": "LEI (preferred) or internal UUID for legal/cooperative entity."
-    },
-    "jurisdiction": {
-      "type": "string",
-      "description": "ISO 3166-1 alpha-2 or ISO 3166-2 style (e.g. US-NY)."
-    },
-    "event_producer": {
-      "type": "string",
-      "description": "Logical emitter for routing and audit. Registered ids and descriptions: `event-producers.manifest.json` in this directory.",
-      "enum": [
-        "hybx-omnl-sidecar",
-        "dbis-core",
-        "iso-gateway",
-        "mintauth-relayer",
-        "chain-settlement-worker",
-        "omnl-fineract-webhook",
-        "integration-hub-example",
-        "manual-operator"
-      ]
-    },
-    "class_id": {
-      "type": "string",
-      "description": "Elemental Imperium class, e.g. C01–C07."
-    },
-    "anchor_id": { "type": "string" },
-    "division_id": { "type": "string" },
-    "amount": {
-      "type": "string",
-      "pattern": "^-?[0-9]+(\\.[0-9]+)?$",
-      "description": "Decimal amount as string; scale implied by currency or separate field."
-    },
-    "amount_scale": {
-      "type": "integer",
-      "minimum": 0,
-      "maximum": 18,
-      "description": "Optional explicit minor units (e.g. 2 for USD)."
-    },
-    "currency": {
-      "type": "string",
-      "description": "ISO 4217 for fiat, or token symbol / 0x contract on-chain."
-    },
-    "event_type": {
-      "type": "string",
-      "enum": [
-        "RTGS_OUT",
-        "RTGS_IN",
-        "OMNL_JOURNAL_POSTED",
-        "CHAIN_SETTLEMENT",
-        "PV_NET",
-        "TREASURY_RELEASE",
-        "INTERNAL_TRANSFER",
-        "NO_CHAIN_LEG"
-      ]
-    },
-    "no_chain_leg_reason": {
-      "type": "string",
-      "description": "When event_type is NO_CHAIN_LEG or internal-only; audit explanation."
-    },
-    "omnl_journal_entry_id": { "type": "integer" },
-    "omnl_office_id": { "type": "integer" },
-    "dbis_reference": {
-      "type": "string",
-      "description": "DBIS Core case or transaction id."
-    },
-    "rtgs_message_ids": {
-      "type": "object",
-      "additionalProperties": { "type": "string" },
-      "description": "Rail and messaging references. When Chain 138 is the authoritative settlement rail (SWIFT replacement for that flow), primary E2E evidence is correlation_id + chain_id + chain_tx_hash; uetr is optional unless a parallel SWIFT gpi leg exists. **uetr**: SWIFT gpi Unique End-to-End Transaction Reference (UUID) when the payment is on or reported to SWIFT gpi — required on those legs if the counterparty or scheme requires it. **msgId**, **endToEndId**: ISO-20022 / bank message ids. When no UETR exists yet (pre-SWIFT, internal-only, DLT-only, or domestic rail), record agreed internal keys, e.g. **internal_instruction_ref**, **operator_message_ref**, or **audit_file_ref**. Internal refs are not a substitute for a real UETR on SWIFT-settled payments; in hybrid flows map uetr + chain evidence + internal refs. See docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md."
-    },
-    "chain_id": {
-      "type": "integer",
-      "description": "EVM chain id; 138 for DeFi Oracle Meta Mainnet."
-    },
-    "chain_tx_hash": {
-      "type": "string",
-      "pattern": "^0x[a-fA-F0-9]{64}$"
-    },
-    "ipsas_narrative": {
-      "type": "string",
-      "maxLength": 500
-    },
-    "occurred_at": {
-      "type": "string",
-      "format": "date-time",
-      "description": "Business timestamp in UTC."
-    },
-    "iso_msg_type": {
-      "type": "string",
-      "description": "e.g. pacs.008, pain.001, MT103 — aligns with SMART_CONTRACTS_ISO20022_FIN_METHODOLOGY canonical struct."
-    },
-    "iso_instruction_id": {
-      "type": "string",
-      "description": "InstrId or hashed instruction key (hex or string per gateway contract)."
-    },
-    "iso_payload_hash": {
-      "type": "string",
-      "pattern": "^0x[a-fA-F0-9]{64}$",
-      "description": "keccak256 of canonical ISO bundle or raw MX/MT fingerprint; ties OMNL/Core to on-chain intake."
-    },
-    "rail_iso_hash": {
-      "type": "string",
-      "pattern": "^0x[a-fA-F0-9]{64}$",
-      "description": "Optional DBIS Rail isoHash from canonical bundle (ISO_GATEWAY_AND_RELAYER_SPEC)."
-    },
-    "holder_did": {
-      "type": "string",
-      "description": "W3C DID of payment initiator or account holder when VC/DID path used (Indy did:sov, did:web, etc.)."
-    },
-    "identity_verification_ref": {
-      "type": "string",
-      "description": "Reference to ACA-Py proof request, OIDC session, or eIDAS connector correlation id."
-    }
-  },
-  "additionalProperties": true
-}

config/dbis-institutional/schemas/trust.schema.json

@@ -1,31 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://d-bis.org/schemas/trust.json",
-  "title": "DBIS trust.json",
-  "type": "object",
-  "required": ["version", "issuedAt", "endpoints"],
-  "properties": {
-    "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
-    "issuedAt": { "type": "string", "format": "date-time" },
-    "organization": { "type": "string" },
-    "endpoints": {
-      "type": "object",
-      "additionalProperties": { "type": "string", "format": "uri" },
-      "properties": {
-        "didRegistry": { "type": "string", "format": "uri" },
-        "dataApi": { "type": "string", "format": "uri" },
-        "explorer": { "type": "string", "format": "uri" },
-        "status": { "type": "string", "format": "uri" },
-        "developers": { "type": "string", "format": "uri" },
-        "gitea": { "type": "string", "format": "uri" }
-      }
-    },
-    "jwksUri": { "type": "string", "format": "uri" },
-    "caHints": {
-      "type": "array",
-      "items": { "type": "string" }
-    },
-    "notes": { "type": "string" }
-  },
-  "additionalProperties": false
-}

config/deployer-gas-routes.json

@@ -1,17 +1,6 @@
 {
   "description": "Chain-to-method mapping for deployer gas auto-route: swap/bridge ERC-20 to native gas per chain. Used by scripts/deployment/deployer-gas-auto-route.sh.",
   "deployerAddress": "0x4A666F96fC8764181194447A7dFdb7d471b301C8",
-  "nonEvmNetworks": [
-    {
-      "identifier": "Solana",
-      "vmKind": "SVM",
-      "nativeSymbol": "SOL",
-      "method": "manual",
-      "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
-      "manualInstructions": "Acquire SOL for Solana mainnet-beta gas and fund the assigned Solana deployer / relay signer when the Solana rollout wave is opened. This entry is planning-only; deployer-gas-auto-route.sh currently processes only the EIP-155 .chains array.",
-      "note": "Desired non-EVM deployment network for future GRU / cW-style mirrored assets via a bridge-wrapped or SPL-native representation."
-    }
-  ],
   "chains": [
     {
       "chainId": 138,
@@ -19,10 +8,10 @@
       "nativeSymbol": "ETH",
       "thresholdEther": "0.006",
       "method": "internal",
-      "tokenAggregationBaseUrl": "https://explorer.d-bis.org/token-aggregation/api/v1",
+      "tokenAggregationBaseUrl": "https://dbis-api.d-bis.org/api/v1",
       "tokenAggregationFallbackUrl": "http://192.168.11.140:3001",
-      "dodoPmmIntegration": "0x86ADA6Ef91A3B450F89f2b751e93B1b7A3218895",
-      "poolCusdtCusdc": "0x9e89bAe009adf128782E19e8341996c596ac40dC",
+      "dodoPmmIntegration": "0x79cdbaFBaA0FdF9F55D26F360F54cddE5c743F7D",
+      "poolCusdtCusdc": "0x9fcB06Aa1FD5215DC0E91Fd098aeff4B62fEa5C8",
       "cusdt": "0x93E66202A11B1772E55407B32B44e5Cd8eda7f22",
       "cusdc": "0xf22258f57794CC8E06237084b353Ab30fFfa640b",
       "weth9": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2",

config/elemental-imperium-network-registry.json

@@ -0,0 +1,37 @@
+{
+  "registryVersion": 1,
+  "purpose": "Authoritative network codes for Elemental Imperium (33×33×6) wallet labels. ASNs are optional; add when assigned.",
+  "labelSpec": {
+    "id": "ei-wallet-label-v1",
+    "cellIdFormat": "EI-L{lpbca:02d}-B{branch:02d}-C{class}",
+    "labelFormatDefault": "{networkCode}.{cellId}",
+    "labelFormatWithAsn": "{networkCode}.{cellId}.AS{asn}",
+    "notes": [
+      "cellId is stable and never depends on ASN or network reassignment uses.",
+      "networkCode is lowercase kebab-case; use this registry as the allow-list.",
+      "When asn is assigned, append .AS{n} with integer n (no leading AS in the number token beyond the literal AS prefix)."
+    ]
+  },
+  "defaultNetworkCode": "unassigned",
+  "overlayExamplePath": "config/elemental-imperium-wallet-overlay.example.json",
+  "networks": [
+    {
+      "code": "unassigned",
+      "displayName": "Not yet mapped to an operational network",
+      "asn": null,
+      "status": "placeholder"
+    },
+    {
+      "code": "chain138-core",
+      "displayName": "Chain 138 execution / RPC plane (internal)",
+      "asn": null,
+      "status": "planned"
+    },
+    {
+      "code": "operator-lan",
+      "displayName": "Operator management LAN (e.g. 192.168.11.0/24)",
+      "asn": null,
+      "status": "planned"
+    }
+  ]
+}

config/elemental-imperium-wallet-overlay.example.json

@@ -0,0 +1,23 @@
+{
+  "overlayVersion": 1,
+  "description": "Optional mapping layered on registry defaults. rangeRules: first matching rule sets networkCode and asn for that wallet. cellOverrides: per cellId, partial overrides win over rangeRules.",
+  "rangeRules": [
+    {
+      "comment": "Example: LPBCA slice 0–10 on chain138-core; remove or edit when ASNs are assigned",
+      "match": {
+        "lpbca": [0, 10],
+        "branch": [0, 32],
+        "class": [0, 5]
+      },
+      "networkCode": "chain138-core",
+      "asn": null
+    }
+  ],
+  "cellOverrides": {
+    "EI-L00-B00-C0": {
+      "comment": "Example single-cell override",
+      "networkCode": "unassigned",
+      "asn": null
+    }
+  }
+}

config/extraction/additional-wallet-inventory.json

@@ -0,0 +1,62 @@
+{
+  "template_version": "1.1.0",
+  "purpose": "Additional on-chain and off-chain inventory for the source-to-CEX execution model.",
+  "questions_to_fill": [
+    "All additional EVM EOAs or smart-wallet addresses",
+    "Any multisigs, vaults, or treasury contracts you want included",
+    "Any custodial or exchange balances to include off-chain",
+    "Any LP or staking positions not visible from wallet token balances alone",
+    "The real production CEX or OTC sink to use for handoff"
+  ],
+  "wallets": [
+    {
+      "label": "primary-deployer-documented",
+      "address": "0x4A666F96fC8764181194447A7dFdb7d471b301C8",
+      "chains": [
+        "1",
+        "138"
+      ],
+      "role": "treasury",
+      "include_in_baseline": true,
+      "notes": "Canonical documented deployer wallet. Deduplicate against primary baseline if loaded twice."
+    }
+  ],
+  "offchain_accounts": [
+    {
+      "label": "example-exchange",
+      "platform": "unknown",
+      "account_type": "unknown",
+      "operational_status": "planned",
+      "enabled_for_production_handoff": false,
+      "accepted_deposit_assets": [
+        "USDC"
+      ],
+      "preferred_deposit_asset": "USDC",
+      "deposit_chain_id": "1",
+      "deposit_chain_name": "Ethereum Mainnet",
+      "deposit_address": "",
+      "min_packet_usd": 1000,
+      "max_packet_usd": 250000,
+      "slippage_ceiling_bps": 100,
+      "asset_balances": [
+        {
+          "symbol": "USDC",
+          "amount": 0,
+          "estimated_usd": 0,
+          "chain_id": "offchain",
+          "chain_name": "Off-chain / custodial",
+          "notes": "Replace with a real balance only when you want it counted."
+        }
+      ],
+      "include_in_baseline": false,
+      "notes": "Replace with a real sink before enabling production handoff."
+    }
+  ],
+  "risk_preferences": {
+    "max_drawdown_pct": null,
+    "liquidity_need_horizon": null,
+    "bridging_allowed": null,
+    "lp_allowed": null,
+    "leverage_allowed": null
+  }
+}

config/extraction/additional-wallet-inventory.template.json

@@ -0,0 +1,62 @@
+{
+  "template_version": "1.1.0",
+  "purpose": "Additional on-chain and off-chain inventory for the source-to-CEX execution model.",
+  "questions_to_fill": [
+    "All additional EVM EOAs or smart-wallet addresses",
+    "Any multisigs, vaults, or treasury contracts you want included",
+    "Any custodial or exchange balances to include off-chain",
+    "Any LP or staking positions not visible from wallet token balances alone",
+    "The real production CEX or OTC sink to use for handoff"
+  ],
+  "wallets": [
+    {
+      "label": "primary-deployer-documented",
+      "address": "0x4A666F96fC8764181194447A7dFdb7d471b301C8",
+      "chains": [
+        "1",
+        "138"
+      ],
+      "role": "treasury",
+      "include_in_baseline": true,
+      "notes": "Canonical documented deployer wallet. Deduplicate against primary baseline if loaded twice."
+    }
+  ],
+  "offchain_accounts": [
+    {
+      "label": "example-exchange",
+      "platform": "unknown",
+      "account_type": "unknown",
+      "operational_status": "planned",
+      "enabled_for_production_handoff": false,
+      "accepted_deposit_assets": [
+        "USDC"
+      ],
+      "preferred_deposit_asset": "USDC",
+      "deposit_chain_id": "1",
+      "deposit_chain_name": "Ethereum Mainnet",
+      "deposit_address": "",
+      "min_packet_usd": 1000,
+      "max_packet_usd": 250000,
+      "slippage_ceiling_bps": 100,
+      "asset_balances": [
+        {
+          "symbol": "USDC",
+          "amount": 0,
+          "estimated_usd": 0,
+          "chain_id": "offchain",
+          "chain_name": "Off-chain / custodial",
+          "notes": "Replace with a real balance only when you want it counted."
+        }
+      ],
+      "include_in_baseline": false,
+      "notes": "Replace with a real sink before enabling production handoff."
+    }
+  ],
+  "risk_preferences": {
+    "max_drawdown_pct": null,
+    "liquidity_need_horizon": null,
+    "bridging_allowed": null,
+    "lp_allowed": null,
+    "leverage_allowed": null
+  }
+}

config/extraction/mainnet-cwusdc-usdc-support-policy.json

@@ -0,0 +1,55 @@
+{
+  "version": "1.0.0",
+  "updated": "2026-04-18",
+  "rail": "mainnet_cwusdc_usdc",
+  "network": {
+    "chainId": 1,
+    "name": "Ethereum Mainnet",
+    "rpcEnvKeys": [
+      "ETHEREUM_MAINNET_RPC"
+    ]
+  },
+  "publicPair": {
+    "base": "cWUSDC",
+    "quote": "USDC",
+    "role": "discovery_lane",
+    "venue": "uniswap_v2_pair",
+    "poolAddress": "0xC28706F899266b36BC43cc072b3a921BDf2C48D9"
+  },
+  "defendedVenue": {
+    "base": "cWUSDC",
+    "quote": "USDC",
+    "role": "primary_defense",
+    "venue": "dodo_pmm",
+    "poolAddress": "0x69776fc607e9edA8042e320e7e43f54d06c68f0E",
+    "managedCycleScript": "smom-dbis-138/script/flash/RunManagedMainnetAaveCwusdcUsdcQuotePushCycle.s.sol:RunManagedMainnetAaveCwusdcUsdcQuotePushCycle"
+  },
+  "thresholds": {
+    "warnDeviationBps": 25,
+    "interveneDeviationBps": 75,
+    "criticalDeviationBps": 150,
+    "minBaseReserveUnits": 2500,
+    "minQuoteReserveUnits": 2500
+  },
+  "managedCycle": {
+    "defaultHarvestSurplus": true,
+    "defaultGasHoldbackTargetRaw": 0,
+    "maxAutomatedFlashQuoteAmountRaw": 2964298,
+    "quoteAmountByDeviationBps": [
+      {
+        "minDeviationBps": 150,
+        "flashQuoteAmountRaw": 2964298
+      },
+      {
+        "minDeviationBps": 75,
+        "flashQuoteAmountRaw": 1482149
+      }
+    ]
+  },
+  "notes": [
+    "The public Uniswap V2 pair is for visible routing and discovery, not for hard parity guarantees on its own.",
+    "When the public pair drifts beyond the intervention corridor, use the managed DODO quote-push stack as the first automated defense path.",
+    "Do not trust POOL_CWUSDC_USDC_MAINNET from dotenv blindly; this policy is the canonical defended venue binding.",
+    "Automation is capped to the currently tested safe tranche until the defended lane is explicitly re-sized from fresh liquidity measurements."
+  ]
+}

config/extraction/promod-uniswap-v2-liquidity-policy.json

@@ -0,0 +1,83 @@
+{
+  "program_name": "Mr. Promod Uniswap V2 cW Deep Liquidity Program",
+  "purpose": "Define the desired-state Uniswap V2 or Uniswap-V2-compatible liquidity rollout for cW* and cWAUSDT rails on bridged public networks.",
+  "operator_rule": "When canonical USDC or USDT depth is scarce, concentrate depth first in wrapped support rails and then expand into canonical settlement rails.",
+  "mainnet_funding_posture": {
+    "mode": "triple-rail-support",
+    "required_deployer_assets": [
+      "cWUSDC",
+      "cWUSDT",
+      "cWAUSDT"
+    ],
+    "notes": [
+      "cWUSDC and cWUSDT remain the core settlement-adjacent rails.",
+      "cWAUSDT is the wrapped-depth support asset when canonical USDC or USDT inventory is not yet deep enough."
+    ]
+  },
+  "priority_tiers": {
+    "tier_1": [
+      "1",
+      "8453",
+      "42161",
+      "10",
+      "137"
+    ],
+    "tier_2": [
+      "56",
+      "43114",
+      "100",
+      "42220",
+      "25"
+    ],
+    "tier_3": [
+      "1111"
+    ]
+  },
+  "wrapped_depth_phase": {
+    "preferred_pairs_in_order": [
+      "cWAUSDT/cWUSDC",
+      "cWAUSDT/cWUSDT",
+      "cWUSDT/cWUSDC"
+    ],
+    "allocation_share_pct": {
+      "flagship_pair": 50,
+      "second_pair": 30,
+      "third_pair": 20
+    },
+    "notes": [
+      "This phase is for creating visibly deep wrapped-to-wrapped liquidity before canonical settlement rails are deep enough.",
+      "Wrapped-depth pools strengthen routing and inventory transfer between the cW settlement rails and cWAUSDT support inventory.",
+      "These pools do not replace the eventual need for direct canonical settlement rails."
+    ]
+  },
+  "settlement_phase": {
+    "preferred_pairs_by_hub": {
+      "USDC": [
+        "cWUSDC/USDC",
+        "cWUSDT/USDC",
+        "cWAUSDT/USDC"
+      ],
+      "USDT": [
+        "cWUSDT/USDT",
+        "cWUSDC/USDT",
+        "cWAUSDT/USDT"
+      ]
+    },
+    "notes": [
+      "Settlement-phase pools remain the preferred terminal rails for exchange and OTC normalization.",
+      "Promote settlement rails only after wrapped-depth support is stable and enough canonical stable inventory is available."
+    ]
+  },
+  "uniswap_v2_requirements": {
+    "required_env_suffixes": [
+      "UNISWAP_V2_FACTORY",
+      "UNISWAP_V2_ROUTER",
+      "UNISWAP_V2_START_BLOCK"
+    ],
+    "required_registry_updates": [
+      "cross-chain-pmm-lps/config/deployment-status.json",
+      "token-aggregation env for the target chain",
+      "MCP allowlist or indexer visibility for new pairs"
+    ]
+  }
+}

config/extraction/source-to-cex-production-policy.json

@@ -0,0 +1,35 @@
+{
+  "version": "1.0.0",
+  "last_updated": "2026-04-17",
+  "purpose": "Operator policy for Chain 138 -> Mainnet normalization -> CEX handoff.",
+  "production_enabled": false,
+  "default_route_model": "Chain 138 inventory -> canonical bridge -> Mainnet normalization -> CEX handoff",
+  "operator_defaults": {
+    "primary_same_day_feeder": "cUSDC",
+    "secondary_same_day_feeder": "cUSDT",
+    "stable_lp_mode": "unwind_first",
+    "immediate_assets": [
+      "cWUSDC",
+      "cWUSDT"
+    ],
+    "reject_non_promoted_assets": true
+  },
+  "normalization_policy": {
+    "preferred_settlement_assets": [
+      "USDC",
+      "USDT"
+    ],
+    "default_settlement_asset": "USDC",
+    "allow_usdt_only_with_operator_approval": true,
+    "post_bridge_aggregation_only": true
+  },
+  "packetization_policy": {
+    "bridge_packet_usd_max": 250000,
+    "normalization_packet_usd_max": 100000,
+    "direct_cwusdc_usdc_usage_cap_usd": 213.102461,
+    "direct_cwusdt_usdt_usage_cap_usd": 2.182358,
+    "force_cwusdt_via_cwusdc_threshold_usd": 10,
+    "default_slippage_ceiling_bps": 100,
+    "chunking_mode": "bridge_in_chunks_then_normalize_then_continuous_cex_handoff"
+  }
+}

config/generated-node-configs/config-1500.toml

@@ -0,0 +1,52 @@
+# Besu Configuration for besu-sentry-1 (VMID: 1500)
+# Generated baseline sentry config promoted into first-class repo coverage.
+
+data-path="/data/besu"
+genesis-file=""
+
+# Network
+network-id=138
+p2p-host="192.168.11.150"
+p2p-port=30303
+max-peers=32
+discovery-enabled=true
+
+# RPC
+rpc-http-enabled=true
+rpc-http-host="0.0.0.0"
+rpc-http-port=8545
+rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-cors-origins=["*"]
+rpc-http-api-enable-unsafe-txsigning=true
+
+rpc-ws-enabled=true
+rpc-ws-host="0.0.0.0"
+rpc-ws-port=8546
+rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+
+# GraphQL
+graphql-http-enabled=true
+graphql-http-host="0.0.0.0"
+graphql-http-port=8547
+
+# Metrics
+metrics-enabled=true
+metrics-host="0.0.0.0"
+metrics-port=9545
+
+# Logging
+logging="INFO"
+log-destination="CONSOLE"
+
+# Sync
+sync-mode="FULL"
+fast-sync-min-peers=2
+
+# Privacy
+privacy-enabled=false
+
+# Mining
+miner-enabled=false
+
+# QBFT
+qbft-enabled=true

config/generated-node-configs/config-1501.toml

@@ -0,0 +1,52 @@
+# Besu Configuration for besu-sentry-2 (VMID: 1501)
+# Generated baseline sentry config promoted into first-class repo coverage.
+
+data-path="/data/besu"
+genesis-file=""
+
+# Network
+network-id=138
+p2p-host="192.168.11.151"
+p2p-port=30303
+max-peers=32
+discovery-enabled=true
+
+# RPC
+rpc-http-enabled=true
+rpc-http-host="0.0.0.0"
+rpc-http-port=8545
+rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-cors-origins=["*"]
+rpc-http-api-enable-unsafe-txsigning=true
+
+rpc-ws-enabled=true
+rpc-ws-host="0.0.0.0"
+rpc-ws-port=8546
+rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+
+# GraphQL
+graphql-http-enabled=true
+graphql-http-host="0.0.0.0"
+graphql-http-port=8547
+
+# Metrics
+metrics-enabled=true
+metrics-host="0.0.0.0"
+metrics-port=9545
+
+# Logging
+logging="INFO"
+log-destination="CONSOLE"
+
+# Sync
+sync-mode="FULL"
+fast-sync-min-peers=2
+
+# Privacy
+privacy-enabled=false
+
+# Mining
+miner-enabled=false
+
+# QBFT
+qbft-enabled=true

config/generated-node-configs/config-1502.toml

@@ -0,0 +1,52 @@
+# Besu Configuration for besu-sentry-3 (VMID: 1502)
+# Generated baseline sentry config promoted into first-class repo coverage.
+
+data-path="/data/besu"
+genesis-file=""
+
+# Network
+network-id=138
+p2p-host="192.168.11.152"
+p2p-port=30303
+max-peers=32
+discovery-enabled=true
+
+# RPC
+rpc-http-enabled=true
+rpc-http-host="0.0.0.0"
+rpc-http-port=8545
+rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-cors-origins=["*"]
+rpc-http-api-enable-unsafe-txsigning=true
+
+rpc-ws-enabled=true
+rpc-ws-host="0.0.0.0"
+rpc-ws-port=8546
+rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+
+# GraphQL
+graphql-http-enabled=true
+graphql-http-host="0.0.0.0"
+graphql-http-port=8547
+
+# Metrics
+metrics-enabled=true
+metrics-host="0.0.0.0"
+metrics-port=9545
+
+# Logging
+logging="INFO"
+log-destination="CONSOLE"
+
+# Sync
+sync-mode="FULL"
+fast-sync-min-peers=2
+
+# Privacy
+privacy-enabled=false
+
+# Mining
+miner-enabled=false
+
+# QBFT
+qbft-enabled=true

config/generated-node-configs/config-1503.toml

@@ -0,0 +1,52 @@
+# Besu Configuration for besu-sentry-4 (VMID: 1503)
+# Generated baseline sentry config promoted into first-class repo coverage.
+
+data-path="/data/besu"
+genesis-file=""
+
+# Network
+network-id=138
+p2p-host="192.168.11.153"
+p2p-port=30303
+max-peers=32
+discovery-enabled=true
+
+# RPC
+rpc-http-enabled=true
+rpc-http-host="0.0.0.0"
+rpc-http-port=8545
+rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-cors-origins=["*"]
+rpc-http-api-enable-unsafe-txsigning=true
+
+rpc-ws-enabled=true
+rpc-ws-host="0.0.0.0"
+rpc-ws-port=8546
+rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+
+# GraphQL
+graphql-http-enabled=true
+graphql-http-host="0.0.0.0"
+graphql-http-port=8547
+
+# Metrics
+metrics-enabled=true
+metrics-host="0.0.0.0"
+metrics-port=9545
+
+# Logging
+logging="INFO"
+log-destination="CONSOLE"
+
+# Sync
+sync-mode="FULL"
+fast-sync-min-peers=2
+
+# Privacy
+privacy-enabled=false
+
+# Mining
+miner-enabled=false
+
+# QBFT
+qbft-enabled=true

config/generated-node-configs/config-1504.toml

@@ -0,0 +1,52 @@
+# Besu Configuration for besu-sentry-ali (VMID: 1504)
+# Generated baseline sentry config promoted into first-class repo coverage.
+
+data-path="/data/besu"
+genesis-file=""
+
+# Network
+network-id=138
+p2p-host="192.168.11.154"
+p2p-port=30303
+max-peers=32
+discovery-enabled=true
+
+# RPC
+rpc-http-enabled=true
+rpc-http-host="0.0.0.0"
+rpc-http-port=8545
+rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-cors-origins=["*"]
+rpc-http-api-enable-unsafe-txsigning=true
+
+rpc-ws-enabled=true
+rpc-ws-host="0.0.0.0"
+rpc-ws-port=8546
+rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+
+# GraphQL
+graphql-http-enabled=true
+graphql-http-host="0.0.0.0"
+graphql-http-port=8547
+
+# Metrics
+metrics-enabled=true
+metrics-host="0.0.0.0"
+metrics-port=9545
+
+# Logging
+logging="INFO"
+log-destination="CONSOLE"
+
+# Sync
+sync-mode="FULL"
+fast-sync-min-peers=2
+
+# Privacy
+privacy-enabled=false
+
+# Mining
+miner-enabled=false
+
+# QBFT
+qbft-enabled=true

config/generated-node-configs/config-1505.toml

@@ -8,20 +8,21 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.213"
 p2p-port=30303
-max-peers=40
+max-peers=32
 discovery-enabled=true
 
 # RPC
 rpc-http-enabled=true
 rpc-http-host="0.0.0.0"
 rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3"]
+rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
 rpc-http-cors-origins=["*"]
+rpc-http-api-enable-unsafe-txsigning=true
 
 rpc-ws-enabled=true
 rpc-ws-host="0.0.0.0"
 rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3"]
+rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
 
 # GraphQL
 graphql-http-enabled=true

config/generated-node-configs/config-1506.toml

@@ -8,20 +8,21 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.214"
 p2p-port=30303
-max-peers=40
+max-peers=32
 discovery-enabled=true
 
 # RPC
 rpc-http-enabled=true
 rpc-http-host="0.0.0.0"
 rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3"]
+rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
 rpc-http-cors-origins=["*"]
+rpc-http-api-enable-unsafe-txsigning=true
 
 rpc-ws-enabled=true
 rpc-ws-host="0.0.0.0"
 rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3"]
+rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
 
 # GraphQL
 graphql-http-enabled=true