scripts: deployment, NPM, verify, validation, env loader, operator helpers

Made-with: Cursor
2026-03-27 18:51:02 -07:00
parent 92d854a31c
commit 875454f449
20 changed files with 271 additions and 98 deletions
--- a/scripts/complete-all-remaining-tasks-final.sh
+++ b/scripts/complete-all-remaining-tasks-final.sh
@@ -162,7 +162,7 @@ echo "Configuring DBIS service dependencies..."

 # DBIS service IPs
 POSTGRES_IP="${DBIS_POSTGRES_PRIMARY:-192.168.11.105}"
-REDIS_IP="${DBIS_REDIS_IP:-192.168.11.120}"
+REDIS_IP="${DBIS_REDIS_IP:-192.168.11.125}"
 DB_PASSWORD="8cba649443f97436db43b34ab2c0e75b5cf15611bef9c099cee6fb22cc3d7771"

 for vmid in 10150 10151; do
--- a/scripts/convert-database-containers-to-privileged.sh
+++ b/scripts/convert-database-containers-to-privileged.sh
@@ -26,7 +26,7 @@ CONTAINER_CONFIGS[10001]="order-postgres-replica:${ORDER_POSTGRES_REPLICA:-${ORD
 CONTAINER_CONFIGS[10100]="dbis-postgres:${DBIS_POSTGRES_PRIMARY:-192.168.11.105}/24:${NETWORK_GATEWAY:-192.168.11.1}:2:2048:8"
 CONTAINER_CONFIGS[10101]="dbis-postgres-replica:${DBIS_POSTGRES_REPLICA:-192.168.11.106}/24:${NETWORK_GATEWAY:-192.168.11.1}:2:2048:8"
 # Redis containers
-CONTAINER_CONFIGS[10020]="order-redis:${ORDER_REDIS_REPLICA:-${ORDER_REDIS_REPLICA:-${ORDER_REDIS_REPLICA:-192.168.11.46}}}/24:${NETWORK_GATEWAY:-192.168.11.1}:1:1024:4"
+CONTAINER_CONFIGS[10020]="order-redis:${ORDER_REDIS_IP:-192.168.11.38}/24:${NETWORK_GATEWAY:-192.168.11.1}:1:1024:4"
 CONTAINER_CONFIGS[10120]="dbis-redis:${DBIS_REDIS_IP:-192.168.11.125}/24:${NETWORK_GATEWAY:-192.168.11.1}:1:1024:4"

 backup_container() {
--- a/scripts/deployment/check-deployer-balance-chain138-and-funding-plan.sh
+++ b/scripts/deployment/check-deployer-balance-chain138-and-funding-plan.sh
@@ -25,11 +25,11 @@ WETH10="0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f"
 LINK="0xb7721dD53A8c629d9f1Ba31a5819AFe250002b03"
 CUSDT="0x93E66202A11B1772E55407B32B44e5Cd8eda7f22"
 CUSDC="0xf22258f57794CC8E06237084b353Ab30fFfa640b"
-USDT_OFFICIAL="0x15DF1D5BFDD8Aa4b380445D4e3E9B38d34283619"
+USDT_OFFICIAL="0x004b63A7B5b0E06f6bB6adb4a5F9f590BF3182D1"

 # PMM pool addresses (from LIQUIDITY_POOLS_MASTER_MAP / ADDRESS_MATRIX)
 POOL_CUSDTCUSDC="0x9fcB06Aa1FD5215DC0E91Fd098aeff4B62fEa5C8"
-POOL_CUSDTUSDT="0xa3Ee6091696B28e5497b6F491fA1e99047250c59"
+POOL_CUSDTUSDT="0x6fc60DEDc92a2047062294488539992710b99D71"
 POOL_CUSDCUSDC="0x90bd9Bf18Daa26Af3e814ea224032d015db58Ea5"

 get_balance() {
--- a/scripts/deployment/create-all-pmm-pools-chain138.sh
+++ b/scripts/deployment/create-all-pmm-pools-chain138.sh
@@ -26,7 +26,7 @@ set +a

 RPC="${RPC_URL_138:-http://192.168.11.211:8545}"
 GAS_PRICE="${GAS_PRICE_138:-${GAS_PRICE:-1000000000}}"
-export DODO_PMM_INTEGRATION="${DODO_PMM_INTEGRATION_ADDRESS:-${DODO_PMM_INTEGRATION:-0x79cdbaFBaA0FdF9F55D26F360F54cddE5c743F7D}}"
+export DODO_PMM_INTEGRATION="${DODO_PMM_INTEGRATION_ADDRESS:-${DODO_PMM_INTEGRATION:-0x5BDc62f1ae7D630c37A8B363a1d49845356Ee72d}}"
 export RPC_URL_138="$RPC"

 cd "$SMOM"
--- a/scripts/deployment/deploy-transaction-mirror-and-pmm-pool-after-txpool-clear.sh
+++ b/scripts/deployment/deploy-transaction-mirror-and-pmm-pool-after-txpool-clear.sh
@@ -97,7 +97,7 @@ fi

 cd "$SMOM"
 export RPC_URL_138="$RPC"
-export DODO_PMM_INTEGRATION="${DODO_PMM_INTEGRATION_ADDRESS:-${DODO_PMM_INTEGRATION:-0x79cdbaFBaA0FdF9F55D26F360F54cddE5c743F7D}}"
+export DODO_PMM_INTEGRATION="${DODO_PMM_INTEGRATION_ADDRESS:-${DODO_PMM_INTEGRATION:-0x5BDc62f1ae7D630c37A8B363a1d49845356Ee72d}}"

 # Skip TransactionMirror deploy if already deployed at TRANSACTION_MIRROR_ADDRESS or if --skip-mirror
 MIRROR_ADDR="${TRANSACTION_MIRROR_ADDRESS:-}"
--- a/scripts/deployment/set-missing-dotenv-chain138.sh
+++ b/scripts/deployment/set-missing-dotenv-chain138.sh
@@ -27,11 +27,12 @@ echo "=== Set missing dotenv (Chain 138 / DODO PMM) ==="
 echo "  Target: $ENV_FILE"
 echo ""

-append_if_missing "DODO_PMM_PROVIDER_ADDRESS" "0x8EF6657D2a86c569F6ffc337EE6b4260Bd2e59d0"
-append_if_missing "DODO_PMM_INTEGRATION_ADDRESS" "0x79cdbaFBaA0FdF9F55D26F360F54cddE5c743F7D"
+append_if_missing "DODO_PMM_PROVIDER_ADDRESS" "0x5CAe6Ce155b7f08D3a956F5Dc82fC9945f29B381"
+append_if_missing "DODO_PMM_INTEGRATION_ADDRESS" "0x5BDc62f1ae7D630c37A8B363a1d49845356Ee72d"
 append_if_missing "POOL_CUSDTCUSDC" "0x9fcB06Aa1FD5215DC0E91Fd098aeff4B62fEa5C8"
-append_if_missing "POOL_CUSDTUSDT" "0xa3Ee6091696B28e5497b6F491fA1e99047250c59"
-append_if_missing "POOL_CUSDCUSDC" "0x90bd9Bf18Daa26Af3e814ea224032d015db58Ea5"
+append_if_missing "POOL_CUSDTUSDT" "0x6fc60DEDc92a2047062294488539992710b99D71"
+append_if_missing "POOL_CUSDCUSDC" "0x9f74Be42725f2Aa072a9E0CdCce0E7203C510263"
+append_if_missing "CHAIN_138_DODO_PMM_INTEGRATION" "0x5BDc62f1ae7D630c37A8B363a1d49845356Ee72d"

 echo ""
 echo "Done. Verify: grep -E 'DODO_PMM|POOL_' $ENV_FILE"
--- a/scripts/generate-mcp-allowlist-from-chain138.sh
+++ b/scripts/generate-mcp-allowlist-from-chain138.sh
@@ -40,10 +40,17 @@ done
 command -v cast &>/dev/null || { echo "cast (foundry) required"; exit 1; }
 command -v jq &>/dev/null || { echo "jq required"; exit 1; }

+hex_to_addr() {
+  local value="${1#0x}"
+  [[ ${#value} -ge 40 ]] || return 1
+  printf '0x%s\n' "${value: -40}"
+}
+
 # Fetch pool count: call allPools(length) by trying 0..MAX_POOLS (contract has allPools(uint256))
 pools=()
 for ((i=0; i<MAX_POOLS; i++)); do
-  addr=$(cast call "$INT" "allPools(uint256)(address)" "$i" --rpc-url "$RPC" 2>/dev/null | cast --to-addr 2>/dev/null || true)
+  raw=$(cast call "$INT" "allPools(uint256)(address)" "$i" --rpc-url "$RPC" 2>/dev/null || true)
+  addr=$(hex_to_addr "$raw" 2>/dev/null || true)
  [[ -n "$addr" && "$addr" != "0x0000000000000000000000000000000000000000" ]] || break
  pools+=("$addr")
 done
@@ -53,6 +60,11 @@ echo "Found ${#pools[@]} pools on Chain 138" >&2
 # Build JSON array of pool entries
 entries="[]"
 for pool in "${pools[@]}"; do
+  registered=$(cast call "$INT" "isRegisteredPool(address)(bool)" "$pool" --rpc-url "$RPC" 2>/dev/null || true)
+  if [[ "$registered" != "true" ]]; then
+    echo "  Skip $pool (not registered in integration)" >&2
+    continue
+  fi
  # poolConfigs(pool) -> (pool, baseToken, quoteToken, lpFeeRate, i, k, isOpenTWAP, createdAt)
  config=$(cast call "$INT" "poolConfigs(address)(address,address,address,uint256,uint256,uint256,bool,uint256)" "$pool" --rpc-url "$RPC" 2>/dev/null || true)
  if [[ -z "$config" ]]; then
--- a/scripts/get-npmplus-mappings.py
+++ b/scripts/get-npmplus-mappings.py
@@ -37,7 +37,7 @@ IP_TO_VMID = {
    "192.168.11.110": "106",
    "192.168.11.111": "107",
    "192.168.11.112": "108",
-    "192.168.11.120": "10120",
+    "192.168.11.125": "10120",
    "192.168.11.130": "10130",
    "192.168.11.140": "5000",
    "192.168.11.150": "1500",
@@ -92,7 +92,7 @@ IP_TO_HOSTNAME = {
    "192.168.11.110": "redis-rpc-translator",
    "192.168.11.111": "web3signer-rpc-translator",
    "192.168.11.112": "vault-rpc-translator",
-    "192.168.11.120": "dbis-redis",
+    "192.168.11.125": "dbis-redis",
    "192.168.11.130": "dbis-frontend",
    "192.168.11.140": "blockscout-1",
    "192.168.11.150": "besu-sentry-1",
--- a/scripts/lib/load-project-env.sh
+++ b/scripts/lib/load-project-env.sh
@@ -32,6 +32,20 @@ err_exit() { echo "ERROR: $1" >&2; exit 1; }
 # 4. dbis_core config if present
 [[ -f "${PROJECT_ROOT}/dbis_core/config/dbis-core-proxmox.conf" ]] && source "${PROJECT_ROOT}/dbis_core/config/dbis-core-proxmox.conf" 2>/dev/null || true

+# 4b. Strip trailing CR/LF from RPC URL vars (editor mistakes; breaks cast/curl)
+for _lpr_k in RPC_URL_138 RPC_URL CHAIN138_RPC CHAIN138_RPC_URL ETHEREUM_MAINNET_RPC \
+  RPC_URL_138_PUBLIC GNOSIS_MAINNET_RPC GNOSIS_RPC CRONOS_RPC_URL CRONOS_RPC \
+  CELO_MAINNET_RPC CELO_RPC WEMIX_RPC WEMIX_MAINNET_RPC BSC_RPC_URL \
+  POLYGON_MAINNET_RPC BASE_MAINNET_RPC OPTIMISM_MAINNET_RPC ARBITRUM_MAINNET_RPC \
+  AVALANCHE_RPC_URL AVALANCHE_RPC; do
+  _lpr_v="${!_lpr_k:-}"
+  [[ -z "$_lpr_v" ]] && continue
+  _lpr_v="${_lpr_v%$'\r'}"
+  _lpr_v="${_lpr_v%$'\n'}"
+  export "$_lpr_k=$_lpr_v"
+done
+unset _lpr_k _lpr_v 2>/dev/null || true
+
 # 5. Contract addresses from master JSON (config/smart-contracts-master.json) when not set by .env
 [[ -f "${PROJECT_ROOT}/scripts/lib/load-contract-addresses.sh" ]] && source "${PROJECT_ROOT}/scripts/lib/load-contract-addresses.sh" 2>/dev/null || true

--- a/scripts/nginx-proxy-manager/manual-ssl-config-guide.sh
+++ b/scripts/nginx-proxy-manager/manual-ssl-config-guide.sh
@@ -3,7 +3,7 @@ set -euo pipefail

 # Load IP configuration
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true


@@ -38,12 +38,12 @@ echo "📝 Domains to Configure (19 total):"
 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 echo ""

-cat > "$DOMAINS_FILE" << 'DOMAINS'
-sankofa.nexus → http://${IP_BLOCKSCOUT}:80
-www.sankofa.nexus → http://${IP_BLOCKSCOUT}:80
-phoenix.sankofa.nexus → http://${IP_BLOCKSCOUT}:80
-www.phoenix.sankofa.nexus → http://${IP_BLOCKSCOUT}:80
-the-order.sankofa.nexus → http://${IP_BLOCKSCOUT}:80
+cat > "$DOMAINS_FILE" <<DOMAINS
+sankofa.nexus → http://${IP_SANKOFA_PORTAL}:${SANKOFA_PORTAL_PORT} (portal CT 7801)
+www.sankofa.nexus → http://${IP_SANKOFA_PORTAL}:${SANKOFA_PORTAL_PORT}
+phoenix.sankofa.nexus → http://${IP_SANKOFA_PHOENIX_API}:${SANKOFA_PHOENIX_API_PORT} (Phoenix API CT 7800)
+www.phoenix.sankofa.nexus → http://${IP_SANKOFA_PHOENIX_API}:${SANKOFA_PHOENIX_API_PORT}
+the-order.sankofa.nexus → http://${IP_ORDER_HAPROXY}:80
 explorer.d-bis.org → http://${IP_BLOCKSCOUT}:80
 rpc-http-pub.d-bis.org → https://${RPC_ALI_2:-${RPC_ALI_2:-${RPC_ALI_2:-${RPC_ALI_2:-${RPC_ALI_2:-${RPC_ALI_2:-${RPC_ALI_2:-192.168.11.252}}}}}}}:443 (WebSocket)
 rpc-ws-pub.d-bis.org → https://${RPC_ALI_2:-${RPC_ALI_2:-${RPC_ALI_2:-${RPC_ALI_2:-${RPC_ALI_2:-${RPC_ALI_2:-${RPC_ALI_2:-192.168.11.252}}}}}}}:443 (WebSocket)
--- a/scripts/nginx-proxy-manager/migrate-configs-to-npmplus.sh
+++ b/scripts/nginx-proxy-manager/migrate-configs-to-npmplus.sh
@@ -3,7 +3,7 @@ set -euo pipefail

 # Load IP configuration
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true


@@ -164,12 +164,12 @@ echo ""
 SUCCESS=0
 FAILED=0

-# sankofa.nexus (5 domains)
-create_proxy_host "sankofa.nexus" "http" "${IP_BLOCKSCOUT:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-192.168.11.14}}}}}0}" "80" "false" && ((SUCCESS++)) || ((FAILED++))
-create_proxy_host "www.sankofa.nexus" "http" "${IP_BLOCKSCOUT:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-192.168.11.14}}}}}0}" "80" "false" && ((SUCCESS++)) || ((FAILED++))
-create_proxy_host "phoenix.sankofa.nexus" "http" "${IP_BLOCKSCOUT:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-192.168.11.14}}}}}0}" "80" "false" && ((SUCCESS++)) || ((FAILED++))
-create_proxy_host "www.phoenix.sankofa.nexus" "http" "${IP_BLOCKSCOUT:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-192.168.11.14}}}}}0}" "80" "false" && ((SUCCESS++)) || ((FAILED++))
-create_proxy_host "the-order.sankofa.nexus" "http" "${IP_BLOCKSCOUT:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-192.168.11.14}}}}}0}" "80" "false" && ((SUCCESS++)) || ((FAILED++))
+# sankofa.nexus (5 domains) — portal :3000 / Phoenix API :4000 (not Blockscout)
+create_proxy_host "sankofa.nexus" "http" "192.168.11.51" "3000" "false" && ((SUCCESS++)) || ((FAILED++))
+create_proxy_host "www.sankofa.nexus" "http" "192.168.11.51" "3000" "false" && ((SUCCESS++)) || ((FAILED++))
+create_proxy_host "phoenix.sankofa.nexus" "http" "192.168.11.50" "4000" "false" && ((SUCCESS++)) || ((FAILED++))
+create_proxy_host "www.phoenix.sankofa.nexus" "http" "192.168.11.50" "4000" "false" && ((SUCCESS++)) || ((FAILED++))
+create_proxy_host "the-order.sankofa.nexus" "http" "192.168.11.39" "80" "false" && ((SUCCESS++)) || ((FAILED++))

 # d-bis.org (9 domains)
 create_proxy_host "explorer.d-bis.org" "http" "${IP_BLOCKSCOUT:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-192.168.11.14}}}}}0}" "80" "false" && ((SUCCESS++)) || ((FAILED++))
--- a/scripts/nginx-proxy-manager/migrate-to-npmplus.sh
+++ b/scripts/nginx-proxy-manager/migrate-to-npmplus.sh
@@ -3,7 +3,7 @@ set -euo pipefail

 # Load IP configuration
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true


@@ -291,12 +291,17 @@ echo ""
 SUCCESS=0
 FAILED=0

-# sankofa.nexus (5 domains)
-create_proxy_host "sankofa.nexus" "http" "${IP_BLOCKSCOUT:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-192.168.11.14}}}}}0}" "80" "false" && ((SUCCESS++)) || ((FAILED++))
-create_proxy_host "www.sankofa.nexus" "http" "${IP_BLOCKSCOUT:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-192.168.11.14}}}}}0}" "80" "false" && ((SUCCESS++)) || ((FAILED++))
-create_proxy_host "phoenix.sankofa.nexus" "http" "${IP_BLOCKSCOUT:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-192.168.11.14}}}}}0}" "80" "false" && ((SUCCESS++)) || ((FAILED++))
-create_proxy_host "www.phoenix.sankofa.nexus" "http" "${IP_BLOCKSCOUT:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-192.168.11.14}}}}}0}" "80" "false" && ((SUCCESS++)) || ((FAILED++))
-create_proxy_host "the-order.sankofa.nexus" "http" "${IP_BLOCKSCOUT:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-192.168.11.14}}}}}0}" "80" "false" && ((SUCCESS++)) || ((FAILED++))
+# sankofa.nexus (5 domains) — portal :3000 / Phoenix API :4000 (not Blockscout; explorer is IP_BLOCKSCOUT:80)
+IP_SANKOFA_PORTAL="${IP_SANKOFA_PORTAL:-${IP_SERVICE_51:-192.168.11.51}}"
+IP_SANKOFA_PHOENIX_API="${IP_SANKOFA_PHOENIX_API:-${IP_SERVICE_50:-192.168.11.50}}"
+SANKOFA_PORTAL_PORT="${SANKOFA_PORTAL_PORT:-3000}"
+SANKOFA_PHOENIX_API_PORT="${SANKOFA_PHOENIX_API_PORT:-4000}"
+IP_ORDER_HAPROXY="${IP_ORDER_HAPROXY:-192.168.11.39}"
+create_proxy_host "sankofa.nexus" "http" "${IP_SANKOFA_PORTAL}" "${SANKOFA_PORTAL_PORT}" "false" && ((SUCCESS++)) || ((FAILED++))
+create_proxy_host "www.sankofa.nexus" "http" "${IP_SANKOFA_PORTAL}" "${SANKOFA_PORTAL_PORT}" "false" && ((SUCCESS++)) || ((FAILED++))
+create_proxy_host "phoenix.sankofa.nexus" "http" "${IP_SANKOFA_PHOENIX_API}" "${SANKOFA_PHOENIX_API_PORT}" "false" && ((SUCCESS++)) || ((FAILED++))
+create_proxy_host "www.phoenix.sankofa.nexus" "http" "${IP_SANKOFA_PHOENIX_API}" "${SANKOFA_PHOENIX_API_PORT}" "false" && ((SUCCESS++)) || ((FAILED++))
+create_proxy_host "the-order.sankofa.nexus" "http" "${IP_ORDER_HAPROXY}" "80" "false" && ((SUCCESS++)) || ((FAILED++))

 # d-bis.org (9 domains)
 create_proxy_host "explorer.d-bis.org" "http" "${IP_BLOCKSCOUT:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-${IP_DEVICE_14:-192.168.11.14}}}}}0}" "80" "false" && ((SUCCESS++)) || ((FAILED++))
--- a/scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh
+++ b/scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh
@@ -374,7 +374,7 @@ update_proxy_host "iccc.xom-dev.phoenix.sankofa.nexus" "http://${IP_GOV_PORTALS_
 update_proxy_host "omnl.xom-dev.phoenix.sankofa.nexus" "http://${IP_GOV_PORTALS_DEV}:3003" false && updated_count=$((updated_count + 1)) || { add_proxy_host "omnl.xom-dev.phoenix.sankofa.nexus" "${IP_GOV_PORTALS_DEV}" 3003 false false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1))
 update_proxy_host "xom.xom-dev.phoenix.sankofa.nexus" "http://${IP_GOV_PORTALS_DEV}:3004" false && updated_count=$((updated_count + 1)) || { add_proxy_host "xom.xom-dev.phoenix.sankofa.nexus" "${IP_GOV_PORTALS_DEV}" 3004 false false && updated_count=$((updated_count + 1)); } || failed_count=$((failed_count + 1))
 # Sankofa portal (Next.js CT 7801) and Phoenix API (Fastify CT 7800) — not Blockscout / SolaceScanScout (that is explorer.d-bis.org / IP_BLOCKSCOUT:80)
-# Public URL policy: https://sankofa.nexus = sovereign technology utility (portal); https://phoenix.sankofa.nexus = Phoenix division (API host; marketing site may share hostname later).
+# Public web intent: sankofa.nexus = Sankofa Sovereign Technologies; phoenix.sankofa.nexus = Phoenix Cloud Services (division). Client SSO: admin / portal + keycloak IdP. Operator: dash (IP+MFA). See docs/02-architecture/EXPECTED_WEB_CONTENT.md.
 # www.sankofa.nexus → 301 https://sankofa.nexus$request_uri; www.phoenix → phoenix; www.the-order → the-order (NPM advanced_config).
 IP_SANKOFA_PORTAL="${IP_SANKOFA_PORTAL:-${IP_SERVICE_51:-192.168.11.51}}"
 IP_SANKOFA_PHOENIX_API="${IP_SANKOFA_PHOENIX_API:-${IP_SERVICE_50:-192.168.11.50}}"
--- a/scripts/reassign-vlan200-to-vlan11.sh
+++ b/scripts/reassign-vlan200-to-vlan11.sh
@@ -4,7 +4,12 @@

 set -uo pipefail

-NODE_IP="${PROXMOX_HOST_R630_01}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+# shellcheck source=/dev/null
+source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true
+
+NODE_IP="${PROXMOX_HOST_R630_01:-192.168.11.11}"

 # VLAN 200 containers that need reassignment
 declare -A vlan200_containers=(
@@ -42,7 +47,7 @@ available_ips=(
  "${IP_SERVICE_43:-${IP_SERVICE_43:-${IP_SERVICE_43:-192.168.11.43}}}"
  "${ORDER_POSTGRES_PRIMARY:-${ORDER_POSTGRES_PRIMARY:-192.168.11.44}}"
  "${ORDER_POSTGRES_REPLICA:-${ORDER_POSTGRES_REPLICA:-192.168.11.45}}"
-  "${ORDER_REDIS_REPLICA:-${ORDER_REDIS_REPLICA:-${ORDER_REDIS_REPLICA:-192.168.11.46}}}"
+  "${IP_ORDER_PROMETHEUS:-${ORDER_REDIS_REPLICA:-192.168.11.46}}"
  "${IP_SERVICE_47:-${IP_SERVICE_47:-${IP_SERVICE_47:-192.168.11.47}}}"
  "${IP_ORDER_OPENSEARCH:-${IP_ORDER_OPENSEARCH:-${IP_ORDER_OPENSEARCH:-192.168.11.48}}}"
  "${IP_SERVICE_49:-${IP_SERVICE_49:-${IP_SERVICE_49:-192.168.11.49}}}"
@@ -50,7 +55,7 @@ available_ips=(
  "${IP_SERVICE_51:-${IP_SERVICE_51:-${IP_SERVICE_51:-${IP_SERVICE_51:-${IP_SERVICE_51:-${IP_SERVICE_51:-192.168.11.51}}}}}}"
  "${IP_SERVICE_52:-${IP_SERVICE_52:-192.168.11.52}}"
  "${DB_HOST:-192.168.11.53}"
-  "${IP_SERVICE_54:-${IP_SERVICE_54:-192.168.11.54}}"
+  "${IP_ORDER_LEGAL:-192.168.11.87}"
  "${IP_SERVICE_55:-${IP_SERVICE_55:-192.168.11.55}}"
  "${IP_SERVICE_56:-${IP_SERVICE_56:-192.168.11.56}}"
  "${IP_SERVICE_57:-${IP_SERVICE_57:-192.168.11.57}}"
--- a/scripts/recreate-containers-privileged-and-complete-all.sh
+++ b/scripts/recreate-containers-privileged-and-complete-all.sh
@@ -4,7 +4,12 @@

 set -uo pipefail

-NODE_IP="${PROXMOX_HOST_R630_01}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+# shellcheck source=/dev/null
+source "${PROJECT_ROOT}/config/ip-addresses.conf" 2>/dev/null || true
+
+NODE_IP="${PROXMOX_HOST_R630_01:-192.168.11.11}"
 BACKUP_DIR="/root/container-backups-$(date +%Y%m%d-%H%M%S)"

 log_info() { echo -e "\033[0;32m[INFO]\033[0m $1"; }
@@ -143,7 +148,7 @@ declare -A CONTAINERS=(
    ["10040"]="order-intake:${IP_SERVICE_41:-${IP_SERVICE_41:-${IP_SERVICE_41:-192.168.11.41}}}:2048:2:20"
    ["10050"]="order-finance:${IP_SERVICE_49:-${IP_SERVICE_49:-${IP_SERVICE_49:-192.168.11.49}}}:2048:2:20"
    ["10060"]="order-dataroom:${IP_SERVICE_42:-${IP_SERVICE_42:-${IP_SERVICE_42:-192.168.11.42}}}:2048:2:20"
-    ["10070"]="order-legal:${IP_SERVICE_50:-${IP_SERVICE_50:-${IP_SERVICE_50:-${IP_SERVICE_50:-${IP_SERVICE_50:-${IP_SERVICE_50:-192.168.11.50}}}}}}:2048:2:20"
+    ["10070"]="order-legal:${IP_ORDER_LEGAL:-192.168.11.87}:2048:2:20"
    ["10080"]="order-eresidency:${IP_SERVICE_43:-${IP_SERVICE_43:-${IP_SERVICE_43:-192.168.11.43}}}:2048:2:20"
    ["10090"]="order-portal-public:${IP_SERVICE_36:-${IP_SERVICE_36:-${IP_SERVICE_36:-${IP_SERVICE_36:-${IP_SERVICE_36:-${IP_SERVICE_36:-192.168.11.36}}}}}}:2048:2:20"
    ["10091"]="order-portal-internal:${IP_SERVICE_35:-${IP_SERVICE_35:-${IP_SERVICE_35:-${IP_SERVICE_35:-${IP_SERVICE_35:-${IP_SERVICE_35:-192.168.11.35}}}}}}:2048:2:20"
--- a/scripts/resolve-ip-conflicts.sh
+++ b/scripts/resolve-ip-conflicts.sh
@@ -1,8 +1,9 @@
 #!/usr/bin/env bash

 # IP Conflict Resolution Script
-# Resolves 3 verified IP conflicts on r630-01
-# Date: 2026-01-20
+# Resolves IP conflicts on r630-01 (Sankofa vs Order vs vault CTs).
+# 2026-03-25: VMID 7804 (gov-portals) owns 192.168.11.54. VMID 10070 (order-legal) must use IP_ORDER_LEGAL (default 192.168.11.87), not .54.
+# Original date: 2026-01-20

 set -euo pipefail

@@ -25,8 +26,17 @@ log_error() {

 verify_ip_available() {
    local ip=$1
+    local vmid_if_mine=$2
    log "Verifying IP $ip is available..."
    if ping -c 1 -W 1 "$ip" > /dev/null 2>&1; then
+        if [ -n "${vmid_if_mine:-}" ]; then
+            local cur
+            cur=$(ssh root@$PROXMOX_HOST "pct config $vmid_if_mine 2>/dev/null | grep -oE 'ip=[0-9.]+' | head -1 | cut -d= -f2" | tr -d '\r')
+            if [ "$cur" = "$ip" ]; then
+                log "IP $ip already assigned to VMID $vmid_if_mine (ok) ✓"
+                return 0
+            fi
+        fi
        log_error "IP $ip is already in use!"
        return 1
    fi
@@ -44,8 +54,8 @@ resolve_conflict() {
    log "Current IP: $old_ip"
    log "New IP: $new_ip"

-    # Verify new IP is available
-    if ! verify_ip_available "$new_ip"; then
+    # Verify new IP is available (or already ours on this VMID)
+    if ! verify_ip_available "$new_ip" "$vmid"; then
        log_error "Cannot proceed - IP $new_ip is in use"
        return 1
    fi
@@ -129,9 +139,9 @@ main() {
    log "SSH access verified ✓"
    log ""

-    # Verify IP availability
+    # Verify target IPs are free (ping) — not .54 (in use by gov-portals 7804)
    log "=== Step 1: Verifying IP Availability ==="
-    for ip in ${IP_SERVICE_54:-${IP_SERVICE_54:-192.168.11.54}} ${IP_SERVICE_55:-${IP_SERVICE_55:-192.168.11.55}} ${IP_SERVICE_56:-${IP_SERVICE_56:-192.168.11.56}}; do
+    for ip in ${IP_SERVICE_55:-192.168.11.55} ${IP_SERVICE_56:-192.168.11.56}; do
        if ! verify_ip_available "$ip"; then
            log_error "Required IP $ip is not available. Cannot proceed."
            exit 1
@@ -141,7 +151,7 @@ main() {

    if [ "${DRY_RUN:-false}" = "true" ]; then
        log "DRY RUN - Would resolve conflicts:"
-        log "  VMID 10070 (order-legal): ${IP_SERVICE_50:-${IP_SERVICE_50:-${IP_SERVICE_50:-${IP_SERVICE_50:-${IP_SERVICE_50:-${IP_SERVICE_50:-192.168.11.50}}}}}} → ${IP_SERVICE_54:-${IP_SERVICE_54:-192.168.11.54}}"
+        log "  VMID 10070 (order-legal): if still on ${IP_GOV_PORTALS_DEV:-192.168.11.54} → $IP_ORDER_LEGAL"
        log "  VMID 10230 (order-vault): ${IP_SERVICE_51:-${IP_SERVICE_51:-${IP_SERVICE_51:-${IP_SERVICE_51:-${IP_SERVICE_51:-${IP_SERVICE_51:-192.168.11.51}}}}}} → ${IP_SERVICE_55:-${IP_SERVICE_55:-192.168.11.55}}"
        log "  VMID 10232 (CT10232): ${IP_SERVICE_52:-${IP_SERVICE_52:-192.168.11.52}} → ${IP_SERVICE_56:-${IP_SERVICE_56:-192.168.11.56}}"
        exit 0
@@ -151,9 +161,22 @@ main() {
    log "=== Step 2: Resolving IP Conflicts ==="
    log ""

-    # Conflict 1: VMID 10070 (order-legal)
-    resolve_conflict 10070 "${IP_SERVICE_50:-${IP_SERVICE_50:-${IP_SERVICE_50:-${IP_SERVICE_50:-${IP_SERVICE_50:-${IP_SERVICE_50:-192.168.11.50}}}}}}" "${IP_SERVICE_54:-${IP_SERVICE_54:-192.168.11.54}}" "order-legal"
-    local result1=$?
+    # Conflict 1: VMID 10070 (order-legal) must not share IP with VMID 7804 (gov-portals on .54)
+    IP_GOV="${IP_GOV_PORTALS_DEV:-192.168.11.54}"
+    IP_ORDER_LEGAL="${IP_ORDER_LEGAL:-192.168.11.87}"
+    CURRENT_LEGAL=$(ssh root@$PROXMOX_HOST "pct config 10070 2>/dev/null | grep -oE 'ip=[0-9.]+' | head -1 | cut -d= -f2" | tr -d '\r' || echo "")
+    result1=0
+    if [ "$CURRENT_LEGAL" = "$IP_GOV" ]; then
+        log "VMID 10070 shares gov-portals IP $IP_GOV — moving to $IP_ORDER_LEGAL"
+        resolve_conflict 10070 "$IP_GOV" "$IP_ORDER_LEGAL" "order-legal"
+        result1=$?
+    elif [ "$CURRENT_LEGAL" = "$IP_ORDER_LEGAL" ]; then
+        log "VMID 10070 already on $IP_ORDER_LEGAL — skip"
+        result1=0
+    else
+        log "VMID 10070 is $CURRENT_LEGAL (expected $IP_ORDER_LEGAL or conflict with $IP_GOV); no automatic change"
+        result1=0
+    fi
    log ""

    # Conflict 2: VMID 10230 (order-vault)
@@ -175,7 +198,8 @@ main() {
        log "  ${IP_SERVICE_50:-${IP_SERVICE_50:-${IP_SERVICE_50:-${IP_SERVICE_50:-${IP_SERVICE_50:-${IP_SERVICE_50:-192.168.11.50}}}}}} → VMID 7800 (sankofa-api-1) only"
        log "  ${IP_SERVICE_51:-${IP_SERVICE_51:-${IP_SERVICE_51:-${IP_SERVICE_51:-${IP_SERVICE_51:-${IP_SERVICE_51:-192.168.11.51}}}}}} → VMID 7801 (sankofa-portal-1) only"
        log "  ${IP_SERVICE_52:-${IP_SERVICE_52:-192.168.11.52}} → VMID 7802 (sankofa-keycloak-1) only"
-        log "  ${IP_SERVICE_54:-${IP_SERVICE_54:-192.168.11.54}} → VMID 10070 (order-legal)"
+        log "  ${IP_GOV_PORTALS_DEV:-192.168.11.54} → VMID 7804 (gov-portals-dev) only"
+        log "  ${IP_ORDER_LEGAL:-192.168.11.87} → VMID 10070 (order-legal)"
        log "  ${IP_SERVICE_55:-${IP_SERVICE_55:-192.168.11.55}} → VMID 10230 (order-vault)"
        log "  ${IP_SERVICE_56:-${IP_SERVICE_56:-192.168.11.56}} → VMID 10232 (CT10232)"
        exit 0
--- a/scripts/validation/validate-config-files.sh
+++ b/scripts/validation/validate-config-files.sh
@@ -112,6 +112,48 @@ else
      ERRORS=$((ERRORS + 1))
    fi
  fi
+  # Public-sector program manifest (served by phoenix-deploy-api GET /api/v1/public-sector/programs)
+  if [[ -f "$PROJECT_ROOT/config/public-sector-program-manifest.json" ]]; then
+    log_ok "Found: config/public-sector-program-manifest.json"
+    if command -v jq &>/dev/null; then
+      if jq -e '
+        (.schemaVersion | type == "string")
+        and (.programs | type == "array")
+        and (.programs | length > 0)
+        and ((.programs | map(.id) | unique | length) == (.programs | length))
+      ' "$PROJECT_ROOT/config/public-sector-program-manifest.json" &>/dev/null; then
+        log_ok "public-sector-program-manifest.json: schemaVersion, programs[], unique .id"
+      else
+        log_err "public-sector-program-manifest.json: invalid structure or duplicate program ids"
+        ERRORS=$((ERRORS + 1))
+      fi
+    fi
+  else
+    log_err "Missing config/public-sector-program-manifest.json"
+    ERRORS=$((ERRORS + 1))
+  fi
+  # Proxmox operational template (VMID/IP/FQDN mirror; see docs/03-deployment/PROXMOX_VE_OPERATIONAL_DEPLOYMENT_TEMPLATE.md)
+  if [[ -f "$PROJECT_ROOT/config/proxmox-operational-template.json" ]]; then
+    log_ok "Found: config/proxmox-operational-template.json"
+    if command -v jq &>/dev/null; then
+      if jq -e '
+        (.schemaVersion | type == "string")
+        and (.network.management_lan.gateway | type == "string")
+        and (.proxmox_nodes | type == "array")
+        and (.proxmox_nodes | length >= 1)
+        and (.services | type == "array")
+        and (.services | length >= 1)
+      ' "$PROJECT_ROOT/config/proxmox-operational-template.json" &>/dev/null; then
+        log_ok "proxmox-operational-template.json: schema, network, nodes, services"
+      else
+        log_err "proxmox-operational-template.json: invalid top-level structure"
+        ERRORS=$((ERRORS + 1))
+      fi
+    fi
+  else
+    log_err "Missing config/proxmox-operational-template.json"
+    ERRORS=$((ERRORS + 1))
+  fi
 fi

 if [[ -n "$OPTIONAL_ENV" ]]; then
--- a/scripts/verify-contracts-blockscout.sh
+++ b/scripts/verify-contracts-blockscout.sh
@@ -1,7 +1,10 @@
 #!/usr/bin/env bash
 # Verify deployed contracts on Blockscout (Chain 138)
 # Usage: ./scripts/verify-contracts-blockscout.sh [--only contract1,contract2] [--skip contract3]
-# Version: 2026-01-31
+# Before each verify, uses `cast code` on RPC to skip EOAs / empty code (avoids Blockscout
+# "not a smart contract" noise for addresses like WETH10 when nothing is deployed there).
+# Set VERIFY_SKIP_BYTECODE_CHECK=1 to attempt forge verify even when code lookup fails or is empty.
+# Version: 2026-03-26

 set -euo pipefail

@@ -41,9 +44,23 @@ should_verify() {

 cd "$SMOM"

+# Returns 0 if address has non-empty runtime bytecode on RPC, 1 otherwise (or if check skipped).
+has_contract_bytecode() {
+  local addr="$1"
+  local code
+  [[ "${VERIFY_SKIP_BYTECODE_CHECK:-0}" == "1" ]] && return 0
+  command -v cast >/dev/null 2>&1 || return 0
+  code=$(cast code "$addr" --rpc-url "$RPC" 2>/dev/null | tr -d '\n\r \t' | tr '[:upper:]' '[:lower:]') || true
+  [[ -n "$code" && "$code" != "0x" && "$code" != "0x0" ]]
+}
+
 verify_one() {
  local addr="$1" contract="$2" path="$3"
  echo "Verifying $contract at $addr..."
+  if ! has_contract_bytecode "$addr"; then
+    echo "  skip: no contract bytecode at $addr on RPC (EOA or undeployed; verify would fail in Blockscout)"
+    return 0
+  fi
  if forge verify-contract "$addr" "$path" \
    --chain-id 138 \
    --verifier blockscout \
--- a/scripts/verify/check-contracts-on-chain-138.sh
+++ b/scripts/verify/check-contracts-on-chain-138.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Check that Chain 138 deployed contracts have bytecode on-chain.
-# Address list: 59 (core, CCIP, PMM, vault/reserve, CompliantFiatTokens). Source: CONTRACT_ADDRESSES_REFERENCE, ADDRESS_MATRIX.
+# Address list: 61 (core, CCIP, PMM, vault/reserve, oracle keeper path, CompliantFiatTokens). Source: CONTRACT_ADDRESSES_REFERENCE, ADDRESS_MATRIX.
 # Usage: ./scripts/verify/check-contracts-on-chain-138.sh [RPC_URL] [--dry-run]
 # Default RPC: from env RPC_URL_138 (Chain 138 Core standard) or config/ip-addresses.conf, else https://rpc-core.d-bis.org
 # Optional: SKIP_EXIT=1 to exit 0 even when some addresses MISS (e.g. when RPC unreachable from this host).
@@ -65,6 +65,8 @@ else
    "0x0C4FD27018130A00762a802f91a72D6a64a60F14"   # PolicyManager
    "0x0059e237973179146237aB49f1322E8197c22b21"   # TokenImplementation
    "0xD3AD6831aacB5386B8A25BB8D8176a6C8a026f04"   # Price Feed Keeper
+    "0x8918eE0819fD687f4eb3e8b9B7D0ef7557493cfa"   # OraclePriceFeed (keeper → ReserveSystem)
+    "0x3e8725b8De386feF3eFE5678c92eA6aDB41992B2"   # WETH MockPriceFeed (keeper WETH aggregator)
    "0x16D9A2cB94A0b92721D93db4A6Cd8023D3338800"   # MerchantSettlementRegistry
    "0xe77cb26eA300e2f5304b461b0EC94c8AD6A7E46D"   # WithdrawalEscrow
    "0xAEE4b7fBe82E1F8295951584CBc772b8BBD68575"   # UniversalAssetRegistry (proxy)
@@ -82,11 +84,11 @@ else
    "0x6427F9739e6B6c3dDb4E94fEfeBcdF35549549d8"   # MirrorRegistry
    "0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc"   # AlltraAdapter
    "0x7131F887DBEEb2e44c1Ed267D2A68b5b83285afc"   # TransactionMirror Chain 138 (deployed 2026-02-27; set TRANSACTION_MIRROR_ADDRESS in .env)
-    "0x9fcB06Aa1FD5215DC0E91Fd098aeff4B62fEa5C8"   # DODO cUSDT-cUSDC pool
-    "0x79cdbaFBaA0FdF9F55D26F360F54cddE5c743F7D"   # DODOPMMIntegration
-    "0x8EF6657D2a86c569F6ffc337EE6b4260Bd2e59d0"   # DODOPMMProvider
-    "0xa3Ee6091696B28e5497b6F491fA1e99047250c59"   # DODO pool cUSDT/USDT
-    "0x90bd9Bf18Daa26Af3e814ea224032d015db58Ea5"   # DODO pool cUSDC/USDC
+    "0xff8d3b8fDF7B112759F076B69f4271D4209C0849"   # DODO cUSDT-cUSDC pool
+    "0x5BDc62f1ae7D630c37A8B363a1d49845356Ee72d"   # DODOPMMIntegration (corrected canonical stack)
+    "0x5CAe6Ce155b7f08D3a956F5Dc82fC9945f29B381"   # DODOPMMProvider (corrected canonical stack)
+    "0x6fc60DEDc92a2047062294488539992710b99D71"   # DODO pool cUSDT/USDT
+    "0x9f74Be42725f2Aa072a9E0CdCce0E7203C510263"   # DODO pool cUSDC/USDC
    "0x607e97cD626f209facfE48c1464815DDE15B5093"   # ReserveSystem
    "0x34B73e6EDFd9f85a7c25EeD31dcB13aB6E969b96"   # ReserveTokenIntegration
    "0xEA4C892D6c1253797c5D95a05BF3863363080b4B"   # RegulatedEntityRegistry (vault)
@@ -160,7 +162,7 @@ if [[ $MISS -gt 0 && -z "$rpc_reachable" ]]; then
  echo "  → RPC was unreachable from this host; see WARN above. Run from LAN/VPN or pass a reachable RPC URL." >&2
 fi
 # Expected missing (pending deploy or confirm): TransactionMirror, DODO pool; exit 0 when only these are missing
-EXPECTED_MISSING=("0xb5876547c52CaBf49d7f40233B6f6a140F403d25" "0x9fcB06Aa1FD5215DC0E91Fd098aeff4B62fEa5C8")
+EXPECTED_MISSING=("0xb5876547c52CaBf49d7f40233B6f6a140F403d25")
 if [[ -n "${SKIP_EXIT:-}" && "${SKIP_EXIT}" != "0" ]]; then
  exit 0
 fi
--- a/scripts/verify/check-pmm-pool-balances-chain138.sh
+++ b/scripts/verify/check-pmm-pool-balances-chain138.sh
@@ -1,7 +1,11 @@
 #!/usr/bin/env bash
-# Check all Chain 138 DODO PMM pool token balances (base + quote).
+# Check the corrected Chain 138 funded DODO PMM pool token balances (base + quote).
 # Uses eth_call (curl) for compatibility with RPCs that reject some cast call formats.
 #
+# Canonical source for addresses:
+#   docs/11-references/ADDRESS_MATRIX_AND_STATUS.md (updated 2026-03-26)
+#   docs/11-references/DEPLOYED_TOKENS_BRIDGES_LPS_AND_ROUTING_STATUS.md
+#
 # Usage: ./scripts/verify/check-pmm-pool-balances-chain138.sh [RPC_URL]
 # Default RPC: http://192.168.11.211:8545

@@ -14,14 +18,10 @@ RPC="${1:-${RPC_URL_138:-http://192.168.11.211:8545}}"
 # Token addresses (Chain 138 canonical)
 cUSDT="0x93E66202A11B1772E55407B32B44e5Cd8eda7f22"
 cUSDC="0xf22258f57794CC8E06237084b353Ab30fFfa640b"
-OFFICIAL_USDT="0x15DF1D5BFDD8Aa4b380445D4e3E9B38d34283619"
-# Official USDC from integration or placeholder (no contract on 138)
-OFFICIAL_USDC="0x0000000000000000000000000000000000000000"
-
-# Pool addresses
-POOL_CUSDTCUSDC="0x9fcB06Aa1FD5215DC0E91Fd098aeff4B62fEa5C8"
-POOL_CUSDTUSDT="0xa3Ee6091696B28e5497b6F491fA1e99047250c59"
-POOL_CUSDCUSDC="0x90bd9Bf18Daa26Af3e814ea224032d015db58Ea5"
+OFFICIAL_USDT="0x004b63A7B5b0E06f6bB6adb4a5F9f590BF3182D1"
+OFFICIAL_USDC="0x71D6687F38b93CCad569Fa6352c876eea967201b"
+cXAUC="0x290E52a8819A4fbD0714E517225429aA2B70EC6b"
+cEURT="0xdf4b71c61E5912712C1Bdd451416B9aC26949d72"

 pads() { local a; a=$(echo "$1" | sed 's/0x//'); printf '%064s' "$a" | tr ' ' '0'; }
 balance() {
@@ -35,43 +35,89 @@ balance() {
 }
 hex2dec() { local h="$1"; [[ -z "$h" || "$h" == "0x" ]] && echo "0" && return; printf '%d' "$h"; }
 human6() { local r; r=$(hex2dec "$1"); echo "scale=6; $r / 1000000" | bc 2>/dev/null || echo "$r"; }
+add_hex() {
+  local a b
+  a=$(hex2dec "$1")
+  b=$(hex2dec "$2")
+  printf '0x%x' "$((a + b))"
+}
+
+PUBLIC_STABLE_TOTAL="0x0"
+PUBLIC_XAU_TOTAL="0x0"
+PRIVATE_STABLE_TOTAL="0x0"
+PRIVATE_XAU_TOTAL="0x0"
+
+print_pool() {
+  local label="$1" pool="$2" base_name="$3" base_token="$4" quote_name="$5" quote_token="$6" bucket="$7"
+  local base_raw quote_raw
+  base_raw=$(balance "$base_token" "$pool")
+  quote_raw=$(balance "$quote_token" "$pool")
+
+  echo "$label"
+  echo "  Address: $pool"
+  echo "  $base_name (base):  raw=$base_raw  ->  $(human6 "$base_raw")"
+  echo "  $quote_name (quote): raw=$quote_raw  ->  $(human6 "$quote_raw")"
+  echo ""
+
+  if [[ "$bucket" == "public" ]]; then
+    if [[ "$base_name" == "cXAUC" ]]; then
+      PUBLIC_XAU_TOTAL=$(add_hex "$PUBLIC_XAU_TOTAL" "$base_raw")
+    else
+      PUBLIC_STABLE_TOTAL=$(add_hex "$PUBLIC_STABLE_TOTAL" "$base_raw")
+    fi
+    if [[ "$quote_name" == "cXAUC" ]]; then
+      PUBLIC_XAU_TOTAL=$(add_hex "$PUBLIC_XAU_TOTAL" "$quote_raw")
+    else
+      PUBLIC_STABLE_TOTAL=$(add_hex "$PUBLIC_STABLE_TOTAL" "$quote_raw")
+    fi
+  else
+    if [[ "$base_name" == "cXAUC" ]]; then
+      PRIVATE_XAU_TOTAL=$(add_hex "$PRIVATE_XAU_TOTAL" "$base_raw")
+    else
+      PRIVATE_STABLE_TOTAL=$(add_hex "$PRIVATE_STABLE_TOTAL" "$base_raw")
+    fi
+    if [[ "$quote_name" == "cXAUC" ]]; then
+      PRIVATE_XAU_TOTAL=$(add_hex "$PRIVATE_XAU_TOTAL" "$quote_raw")
+    else
+      PRIVATE_STABLE_TOTAL=$(add_hex "$PRIVATE_STABLE_TOTAL" "$quote_raw")
+    fi
+  fi
+}

 echo "=============================================="
 echo "  Chain 138 — PMM pool balances"
 echo "  RPC: $RPC"
+echo "  Pool map: corrected 2026-03-26 public + private funded set"
 echo "=============================================="
 echo ""

-# Pool 1: cUSDT / cUSDC (base / quote)
-echo "Pool 1: cUSDT / cUSDC"
-echo "  Address: $POOL_CUSDTCUSDC"
-r1=$(balance "$cUSDT" "$POOL_CUSDTCUSDC")
-r2=$(balance "$cUSDC" "$POOL_CUSDTCUSDC")
-echo "  cUSDT (base):  raw=$r1  →  $(human6 "$r1")"
-echo "  cUSDC (quote): raw=$r2  →  $(human6 "$r2")"
+echo "Public pools"
+echo "------------"
+print_pool "Pool 1: cUSDT / cUSDC" "0xff8d3b8fDF7B112759F076B69f4271D4209C0849" "cUSDT" "$cUSDT" "cUSDC" "$cUSDC" "public"
+print_pool "Pool 2: cUSDT / USDT (official mirror)" "0x6fc60DEDc92a2047062294488539992710b99D71" "cUSDT" "$cUSDT" "USDT" "$OFFICIAL_USDT" "public"
+print_pool "Pool 3: cUSDC / USDC (official mirror)" "0x0309178ae30302D83c76d6Dd402a684eF3160eec" "cUSDC" "$cUSDC" "USDC" "$OFFICIAL_USDC" "public"
+print_pool "Pool 4: cUSDT / cXAUC" "0x1AA55E2001E5651349AfF5A63FD7A7Ae44f0F1b0" "cUSDT" "$cUSDT" "cXAUC" "$cXAUC" "public"
+print_pool "Pool 5: cUSDC / cXAUC" "0xEA9Ac6357CaCB42a83b9082B870610363B177cBa" "cUSDC" "$cUSDC" "cXAUC" "$cXAUC" "public"
+print_pool "Pool 6: cEURT / cXAUC" "0xbA99bc1eAAC164569d5AcA96C806934DDaF970Cf" "cEURT" "$cEURT" "cXAUC" "$cXAUC" "public"
+
+echo "Private pools"
+echo "-------------"
+print_pool "Pool 7: cUSDT / cXAUC (private)" "0x94316511621430423a2cff0C036902BAB4aA70c2" "cUSDT" "$cUSDT" "cXAUC" "$cXAUC" "private"
+print_pool "Pool 8: cUSDC / cXAUC (private)" "0x7867D58567948e5b9908F1057055Ee4440de0851" "cUSDC" "$cUSDC" "cXAUC" "$cXAUC" "private"
+print_pool "Pool 9: cEURT / cXAUC (private)" "0x505403093826D494983A93b43Aa0B8601078A44e" "cEURT" "$cEURT" "cXAUC" "$cXAUC" "private"
+
+TOTAL_STABLE=$(add_hex "$PUBLIC_STABLE_TOTAL" "$PRIVATE_STABLE_TOTAL")
+TOTAL_XAU=$(add_hex "$PUBLIC_XAU_TOTAL" "$PRIVATE_XAU_TOTAL")
+
+echo "Summary"
+echo "-------"
+echo "  Public stable liquidity:  raw=$PUBLIC_STABLE_TOTAL  ->  $(human6 "$PUBLIC_STABLE_TOTAL")"
+echo "  Public XAU liquidity:     raw=$PUBLIC_XAU_TOTAL  ->  $(human6 "$PUBLIC_XAU_TOTAL")"
+echo "  Private stable liquidity: raw=$PRIVATE_STABLE_TOTAL  ->  $(human6 "$PRIVATE_STABLE_TOTAL")"
+echo "  Private XAU liquidity:    raw=$PRIVATE_XAU_TOTAL  ->  $(human6 "$PRIVATE_XAU_TOTAL")"
+echo "  Total stable liquidity:   raw=$TOTAL_STABLE  ->  $(human6 "$TOTAL_STABLE")"
+echo "  Total XAU liquidity:      raw=$TOTAL_XAU  ->  $(human6 "$TOTAL_XAU")"
 echo ""

-# Pool 2: cUSDT / USDT (official USDT has no code on 138)
-echo "Pool 2: cUSDT / USDT (official)"
-echo "  Address: $POOL_CUSDTUSDT"
-r1=$(balance "$cUSDT" "$POOL_CUSDTUSDT")
-r2=$(balance "$OFFICIAL_USDT" "$POOL_CUSDTUSDT")
-echo "  cUSDT (base):     raw=${r1:-0x0}  →  $(human6 "$r1")"
-echo "  USDT (quote):     raw=${r2:-0x0}  →  $(human6 "$r2")"
-echo ""
-
-# Pool 3: cUSDC / USDC (official USDC not deployed on 138)
-echo "Pool 3: cUSDC / USDC (official)"
-echo "  Address: $POOL_CUSDCUSDC"
-r1=$(balance "$cUSDC" "$POOL_CUSDCUSDC")
-echo "  cUSDC (base):     raw=$r1  →  $(human6 "$r1")"
-if [[ "$OFFICIAL_USDC" != "0x0000000000000000000000000000000000000000" ]]; then
-  r2=$(balance "$OFFICIAL_USDC" "$POOL_CUSDCUSDC")
-  echo "  USDC (quote):     raw=$r2  →  $(human6 "$r2")"
-else
-  echo "  USDC (quote):     N/A (no official USDC contract on 138)"
-fi
-echo ""
-
-echo "Note: Pool 1 (cUSDT/cUSDC) is the only pool with liquidity on 138. Pools 2 and 3 use official USDT/USDC which have no contract on Chain 138."
+echo "Note: This script verifies the current funded public and private PMM set from the 2026-03-26 docs."
 echo "Done."