smom-dbis-138/docs/hybx-omnl/DEPLOYMENT_CHECKLIST.md

HYBX OMNL — deployment checklist

Use with config/deployment-omnl.example.env (copy to .env on the host; never commit secrets).

Pre-flight

1. Contracts: forge script script/hybx-omnl/DeployOMNLStack.s.sol (or DeployMirrorCoordinator.s.sol for coordinator-only) on target chains; record addresses.
2. CCIP: Router and LINK (or native fee) match hybx-omnl-cross-chain-lines.json; coordinator approve path for ERC-20 fee token if used.
3. Policy: hybx-omnl-policy.json matches on-chain PolicyMath / registry limits (1.2× M0, 5× M1).
4. Fineract: GL accounts exist; pagination env OMNL_FINERACT_GL_PAGE_LIMIT set if >200 accounts.

Token aggregation service

1. Set OMNL_*, ENABLE_OMNL_EVENT_POLLER, OMNL_POLLER_STATE_PATH (optional), webhook URLs/secrets, optional OMNL_API_KEY / OMNL_DASHBOARD_TOKEN, OMNL_RATE_LIMIT_* as needed.
2. pnpm run build in services/token-aggregation.
3. Health: GET /health; OMNL: GET /api/v1/omnl/compliance; dashboard: GET /omnl/dashboard.
4. Run bash scripts/hybx-omnl/verify-deployment.sh (Forge hybx-omnl tests + tsc in services/token-aggregation).
5. Publish snapshot (smom-dbis-138-publish/): run the same script name there for TypeScript + omnl-reconcile-report.mjs only; Forge deps live in the main repo.

Post-deploy

1. Anchor reconciliation hash: pnpm run omnl:reconcile:artifact (repo root) or bash scripts/hybx-omnl/omnl-reconcile-artifact.sh (writes artifacts/omnl-reconcile/omnl-reconcile-sha256.txt) or pnpm run omnl:reconcile under services/token-aggregation / node services/token-aggregation/scripts/omnl-reconcile-report.mjs → store sha256 in ops log. Cron and GitHub Actions: see docs/hybx-omnl/OMNL_RECONCILE_CRON_AND_CI.md.
2. Mirror smoke: send test payload per CCIP_MIRROR_FLOW.md (staging first).
3. Operational compliance: see OPERATIONAL_COMPLIANCE.md (retention, webhook signing, break-glass).