Sync workspace: config, docs, scripts, CI, operator rules, and submodule pointers.

- Update dbis_core, cross-chain-pmm-lps, explorer-monorepo, metamask-integration, pr-workspace/chains - Omit embedded publish git dirs and empty placeholders from index Made-with: Cursor
2026-04-12 06:12:20 -07:00
parent 6fb6bd3993
commit dbd517b279
2935 changed files with 327972 additions and 5533 deletions
--- a/.cursor/rules/chain138-tokens-and-pmm.mdc
+++ b/.cursor/rules/chain138-tokens-and-pmm.mdc
@@ -10,10 +10,14 @@ alwaysApply: true
 - **cUSDT:** `0x93E66202A11B1772E55407B32B44e5Cd8eda7f22` (6 decimals)
 - **cUSDC:** `0xf22258f57794CC8E06237084b353Ab30fFfa640b` (6 decimals)

-**DODOPMMIntegration:** `0x5BDc62f1ae7D630c37A8B363a1d49845356Ee72d` — reconciled with `docs/11-references/ADDRESS_MATRIX_AND_STATUS.md` (on-chain verification 2026-03-26); `compliantUSDT()` / `compliantUSDC()` return the canonical cUSDT/cUSDC above.
+**DODOPMMIntegration (canonical, official DVM-backed stack):** `0x86ADA6Ef91A3B450F89f2b751e93B1b7A3218895` — use for stable-pool routing, token-aggregation, explorer fallbacks, and `info-defi-oracle-138` swaps. **`DODOPMMProvider`:** `0x3f729632E9553EBacCdE2e9b4c8F2B285b014F2e`. **`DODO_VENDING_MACHINE_ADDRESS`:** `0xb6D9EF3575bc48De3f011C310DC24d87bEC6087C`. Single source: `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md` and `ADDRESS_MATRIX_AND_STATUS.md` (on-chain verification 2026-04-02).
+
+**Older PMM integration (historical / supplemental only):** `0x5BDc62f1ae7D630c37A8B363a1d49845356Ee72d` — do **not** treat as canonical for stable routing or explorer reads; retained for older XAU-phase references and probes.

 **PMM pools (live funded public):** cUSDT/cUSDC `0xff8d3b8fDF7B112759F076B69f4271D4209C0849` | cUSDT/USDT `0x6fc60DEDc92a2047062294488539992710b99D71` | cUSDC/USDC `0x9f74Be42725f2Aa072a9E0CdCce0E7203C510263` — see `docs/11-references/ADDRESS_MATRIX_AND_STATUS.md` / `PMM_DEX_ROUTING_STATUS.md`.

 **cXAUC / cXAUT (XAU):** `0x290E52a8819A4fbD0714E517225429aA2B70EC6b`, `0x94e408E26c6FD8F4ee00b54dF19082FDA07dC96E` (6 decimals). **1 full token = 1 troy ounce Au** — not USD face value; see `EXPLORER_TOKEN_LIST_CROSSCHECK.md` section 5.1.

 **RPC (deploy):** `RPC_URL_138=http://192.168.11.211:8545`. **Deployer:** `0x4A666F96fC8764181194447A7dFdb7d471b301C8`. Add-liquidity reads tokens from the integration contract, not env. Do not use non-canonical Blockscout addresses (§2 of EXPLORER_TOKEN_LIST_CROSSCHECK).
+
+**Token symbol grammar (UTRNF vs GRU `c*`):** DBIS **`c*`** (e.g. cUSDC) is **compliant GRU base money**, not Universal Token Role Naming Framework “`c` = collateral.” For prefix collision rules, registry fields, and bridges, use `docs/04-configuration/naming-conventions/02_DBIS_NAMESPACE_AND_UTRNF_MAPPING.md` and `docs/04-configuration/naming-conventions/README.md`.
--- a/.cursor/rules/operator-context-lan-proxmox.mdc
+++ b/.cursor/rules/operator-context-lan-proxmox.mdc
@@ -8,10 +8,10 @@ alwaysApply: true
 **Remember:** This machine **is** LAN/operator — it has LAN and Proxmox access to 192.168.11.x. Operator scripts **can and should** be run from here when the user asks to run operator tasks.

 - **Dotenv:** `run-all-operator-tasks-from-lan.sh` and `run-operator-tasks-from-lan.sh` **always load dotenv** via `scripts/lib/load-project-env.sh` (repo `.env` + `smom-dbis-138/.env`). No need to `source .env` before running.
- **Proxmox hosts:** 192.168.11.10 (ML110), .11 (R630-01), .12 (R630-02). Chain 138 RPC: 192.168.11.211:8545.
+- **Proxmox hosts (IPs):** 192.168.11.10–.14 (ML110, R630-01..04). **Canonical FQDNs:** `ml110.sankofa.nexus`, `r630-01.sankofa.nexus`, … `r630-04.sankofa.nexus` (`config/ip-addresses.conf` `PROXMOX_FQDN_*`). Chain 138 RPC: 192.168.11.211:8545.
 - **NPMplus password:** In **project root** `.env` — variable `NPM_PASSWORD` (with `NPM_EMAIL`, `NPM_URL`). Operator scripts load it via `load-project-env.sh`; NPMplus API: 192.168.11.167:81 or .166:81.
 - **Continue and complete:** (1) `./scripts/run-completable-tasks-from-anywhere.sh` then (2) `./scripts/run-all-operator-tasks-from-lan.sh` (use `--skip-backup` if NPM_PASSWORD not set; add `--deploy` or `--create-vms` as needed).

-When suggesting or running operator/LAN tasks (e.g. `run-all-operator-tasks-from-lan.sh`, contract verification, NPMplus backup, nginx/VMID 5000, token-aggregation DB, E2E checks), assume this host can reach Proxmox hosts (192.168.11.10–12), Chain 138 RPC, NPMplus, and Blockscout. Credentials in `.env` or `smom-dbis-138/.env` (e.g. `NPM_PASSWORD`, `PRIVATE_KEY`) are used automatically when the operator script runs.
+When suggesting or running operator/LAN tasks (e.g. `run-all-operator-tasks-from-lan.sh`, contract verification, NPMplus backup, nginx/VMID 5000, token-aggregation DB, E2E checks), assume this host can reach Proxmox nodes (192.168.11.10–.14 or `*.sankofa.nexus`), Chain 138 RPC, NPMplus, and Blockscout. Credentials in `.env` or `smom-dbis-138/.env` (e.g. `NPM_PASSWORD`, `PRIVATE_KEY`) are used automatically when the operator script runs.

 **Optional:** Before running operator scripts, run the **Operator/LAN access check** (curl RPC, env files) per rule `operator-lan-access-check.mdc`; if unreachable, suggest `run-completable-tasks-from-anywhere.sh` and document that operator tasks need LAN.
--- a/.cursor/rules/operator-lan-access-check.mdc
+++ b/.cursor/rules/operator-lan-access-check.mdc
@@ -38,7 +38,11 @@ test -f .env && test -f smom-dbis-138/.env && echo "env OK" || echo "env missing
 - Suggest: `./scripts/run-completable-tasks-from-anywhere.sh` (config validation, on-chain check, reconcile output).
 - Tell the user that NPMplus backup, Blockscout verify, RPC proxy updates, and deploy require a host on **LAN (192.168.11.x)** with root `.env` and `smom-dbis-138/.env`; see **docs/00-meta/OPERATOR_CREDENTIALS_CHECKLIST.md** and **OPERATOR_READY_CHECKLIST.md**.

-## 4. References
+## 4. Proxmox FQDN on LAN (optional)
+
+If you use **`*.sankofa.nexus`** for SSH: `bash scripts/verify/check-proxmox-mgmt-fqdn.sh` (exit `1` until UDM/local DNS or `/etc/hosts` has A-records). Snippet: `bash scripts/verify/check-proxmox-mgmt-fqdn.sh --print-hosts`.
+
+## 5. References

 - **Operator context (always):** `.cursor/rules/operator-context-lan-proxmox.mdc` — this machine is assumed LAN/operator when that rule applies.
 - **Credentials:** `docs/00-meta/OPERATOR_CREDENTIALS_CHECKLIST.md` — per-task LAN, PRIVATE_KEY, NPM_PASSWORD, RPC_URL_138.
--- a/.cursor/rules/project-doc-and-deployment-refs.mdc
+++ b/.cursor/rules/project-doc-and-deployment-refs.mdc
@@ -8,8 +8,10 @@ alwaysApply: true
 When answering token/PMM/deployment questions, prefer these docs over inferring from other files. Cite §5 / §8 for canonical and verification.

 **Canonical / verification:** `docs/11-references/EXPLORER_TOKEN_LIST_CROSSCHECK.md` (§5 canonical, §8 on-chain verification)  
-**Contract addresses:** `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md`  
+**Token / bridge naming (UTRNF + DBIS `c*` mapping):** `docs/04-configuration/naming-conventions/README.md` (especially `02_DBIS_NAMESPACE_AND_UTRNF_MAPPING.md` for UTRNF `c` vs compliant money)  
+**Contract addresses:** `docs/11-references/CONTRACT_ADDRESSES_REFERENCE.md` (includes **Ethereum mainnet optional TRUU PMM** subsection)  
 **Address matrix:** `docs/11-references/ADDRESS_MATRIX_AND_STATUS.md`  
+**Mainnet TRUU PMM (optional volatile rail):** `docs/03-deployment/MAINNET_PMM_TRUU_CWUSD_PEG_AND_BOT_RUNBOOK.md` section 11; `cross-chain-pmm-lps/config/deployment-status.json` `chains."1".pmmPoolsVolatile[]`  
 **Fixes and deployments:** `docs/00-meta/REQUIRED_FIXES_GAPS_AND_DEPLOYMENTS_LIST.md`  
 **TODOs:** `docs/00-meta/TODOS_CONSOLIDATED.md`  
 **Operator commands:** `docs/00-meta/OPERATOR_READY_CHECKLIST.md`  
--- a/.cursor/rules/proxmox-production-safety.mdc
+++ b/.cursor/rules/proxmox-production-safety.mdc
@@ -0,0 +1,28 @@
+---
+description: Mission-critical Proxmox — scoped mutations, no accidental cross-workload impact
+alwaysApply: true
+---
+
+# Production safety — Proxmox and operator automation
+
+This environment is **mission-critical**. Prefer **small, explicit scopes** over broad loops.
+
+## Do not
+
+- Run **host-wide** or **cluster-wide** `pct start` / `qm start` / `pct stop` / destructive maintenance **without** a named list of VMIDs and a **dry-run first**.
+- Edit **`config/ip-addresses.conf`** or shared dotenv for a **single-workload** fix unless the change is documented and reviewed; prefer **workload-specific scripts** with explicit `--host` / `--vmid` flags.
+- Rely on ad-hoc shell one-liners that iterate all Proxmox IPs for the user; use **`scripts/operator/start-stopped-lxc-scoped.sh`** (or an equally scoped script) instead.
+
+## Do
+
+- **Default dry-run**, then **`--apply`** or **`PROXMOX_OPS_APPLY=1`** for mutations. Optional **`PROXMOX_OPS_ALLOWED_VMIDS`** for an extra allowlist.
+- Set **`PROXMOX_SAFE_DEFAULTS=1`** in operator `.env` so guarded maintenance scripts (`fix-core-rpc-2101.sh`, `make-rpc-vmids-writable-via-ssh.sh`, `ensure-legacy-monitor-networkd-via-ssh.sh`) default to **dry-run** unless **`--apply`** or **`PROXMOX_OPS_APPLY=1`**. Orchestrators (e.g. `run-all-maintenance-via-proxmox-ssh.sh`) pass **`--apply`** to sub-steps when not in top-level `--dry-run`.
+- Use **`scripts/lib/proxmox-production-guard.sh`** in new operator scripts that SSH to PVE.
+- After changing VM placement, update **`get_host_for_vmid`** in `scripts/lib/load-project-env.sh` so automation targets the correct node.
+- For Chain 138 RPC checks only: **`scripts/verify/check-chain138-rpc-health.sh`** (read-only HTTP probes).
+
+## Reference
+
+- Scoped start: `scripts/operator/start-stopped-lxc-scoped.sh`
+- Guard helpers: `scripts/lib/proxmox-production-guard.sh`
+- VMID / host facts: `docs/04-configuration/ALL_VMIDS_ENDPOINTS.md`, `docs/04-configuration/RPC_ENDPOINTS_MASTER.md`
--- a/.env.master.example
+++ b/.env.master.example
@@ -245,15 +245,20 @@ DODO_PMM_INTEGRATION_MAINNET=
 # Forge sources: smom-dbis-138/script/flash/RunMainnetAaveCwusdcUsdcQuotePushOnce.s.sol
 # Modeling (no chain writes): scripts/deployment/run-mainnet-cwusdc-flash-quote-push-model-sweep.sh
 # Optional sweep tuning: FLASH_MODEL_GAS_TX_COUNT FLASH_MODEL_GAS_PER_TX FLASH_MODEL_MAX_POST_TRADE_DEV_BPS
-AAVE_QUOTE_PUSH_RECEIVER_MAINNET=
-QUOTE_PUSH_EXTERNAL_UNWINDER_MAINNET=
-FLASH_QUOTE_AMOUNT_RAW=
+AAVE_QUOTE_PUSH_RECEIVER_MAINNET=0x241cb416aaFC2654078b7E2376adED2bDeFbCBa2
+# QUOTE_PUSH_UNWINDER_TYPE=two_hop_dodo  # lets run-mainnet-aave-cwusdc-quote-push-once.sh auto-pick the latest real broadcast unwinder after --apply
+QUOTE_PUSH_EXTERNAL_UNWINDER_MAINNET=0xaB74B4369e5603085A58FDa181E9B43617C6a58f
+FLASH_QUOTE_AMOUNT_RAW=200000
 # UNWIND_MODE: 0 = Uniswap V3 exactInputSingle (set UNWIND_V3_FEE_U24); 1 = DODO pool (UNWIND_DODO_POOL);
 #               2 = Uniswap V3 exactInput packed path hex (UNWIND_V3_PATH_HEX) when no direct pool — see UniswapV3ExternalUnwinder.
-UNWIND_MODE=0
-UNWIND_V3_FEE_U24=
+UNWIND_MODE=4
+# UNWIND_V3_FEE_U24=
 # UNWIND_V3_PATH_HEX=0x...   # UNWIND_MODE=2 — build: bash scripts/verify/build-uniswap-v3-exact-input-path-hex.sh <path-args>
 # UNWIND_DODO_POOL=
+UNWIND_TWO_HOP_POOL_A=0xe944b7Cb012A0820c07f54D51e92f0e1C74168DB
+UNWIND_TWO_HOP_POOL_B=0x27f3aE7EE71Be3d77bAf17d4435cF8B895DD25D2
+UNWIND_TWO_HOP_MID_TOKEN=0xaF5017d0163ecb99d9B5D94e3b4D7b09Af44D8AE
+UNWIND_MIN_MID_OUT_RAW=1
 # Discover V3 pools: bash scripts/verify/probe-uniswap-v3-cwusdc-usdc-mainnet.sh
 # Optional min-out overrides (script derives from pool query + Aave premium when unset):
 # MIN_OUT_PMM=
--- a/.gitea/workflows/live-inventory-hardware-weekly.yml
+++ b/.gitea/workflows/live-inventory-hardware-weekly.yml
@@ -0,0 +1,30 @@
+# Weekly: hardware poll + live inventory / drift export → artifacts.
+# GitHub: see .github/workflows/live-inventory-drift.yml
+# Gitea: use a LAN self-hosted runner with label [lan] for live Proxmox reachability;
+#        ubuntu-latest will usually produce seed_unreachable (still uploads JSON).
+name: Live inventory + hardware poll (weekly)
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '20 7 * * 1'
+
+jobs:
+  inventory-and-hardware:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Poll Proxmox cluster hardware (LAN optional)
+        run: bash scripts/verify/poll-proxmox-cluster-hardware.sh
+        continue-on-error: true
+
+      - name: Export live inventory and IPAM drift
+        run: bash scripts/it-ops/export-live-inventory-and-drift.sh
+        continue-on-error: true
+
+      - name: Summarize reports/status (commit artifacts on LAN runner if needed)
+        if: always()
+        run: |
+          ls -la reports/status/ 2>/dev/null || true
+          test -f reports/status/drift.json && head -c 400 reports/status/drift.json || true
--- a/.github/workflows/dbis-core-gateway-ci.yml
+++ b/.github/workflows/dbis-core-gateway-ci.yml
@@ -0,0 +1,55 @@
+# Gateway rails unit + HTTP integration tests (dbis_core submodule)
+name: dbis-core-gateway-ci
+
+on:
+  push:
+    paths:
+      - 'dbis_core/package.json'
+      - 'dbis_core/package-lock.json'
+      - 'dbis_core/jest.config.js'
+      - 'dbis_core/jest.gateway-http.config.js'
+      - 'dbis_core/src/core/gateway/**'
+      - 'dbis_core/src/workers/gateway-outbox.worker.ts'
+      - 'dbis_core/src/workers/run-gateway-outbox-worker.ts'
+      - 'dbis_core/src/__tests__/unit/core/gateway/**'
+      - 'dbis_core/src/__tests__/integration/api/gateway-rails-http.integration.test.ts'
+      - 'dbis_core/src/__tests__/gateway-http-env-setup.ts'
+      - 'dbis_core/src/__tests__/utils/gateway-http-test-app.ts'
+      - '.github/workflows/dbis-core-gateway-ci.yml'
+  pull_request:
+    paths:
+      - 'dbis_core/package.json'
+      - 'dbis_core/package-lock.json'
+      - 'dbis_core/jest.config.js'
+      - 'dbis_core/jest.gateway-http.config.js'
+      - 'dbis_core/src/core/gateway/**'
+      - 'dbis_core/src/workers/gateway-outbox.worker.ts'
+      - 'dbis_core/src/workers/run-gateway-outbox-worker.ts'
+      - 'dbis_core/src/__tests__/unit/core/gateway/**'
+      - 'dbis_core/src/__tests__/integration/api/gateway-rails-http.integration.test.ts'
+      - 'dbis_core/src/__tests__/gateway-http-env-setup.ts'
+      - 'dbis_core/src/__tests__/utils/gateway-http-test-app.ts'
+      - '.github/workflows/dbis-core-gateway-ci.yml'
+
+defaults:
+  run:
+    working-directory: dbis_core
+
+jobs:
+  test-gateway:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: dbis_core/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Gateway tests (unit + integration)
+        run: npm run test:gateway
--- a/.github/workflows/economics-toolkit.yml
+++ b/.github/workflows/economics-toolkit.yml
@@ -0,0 +1,42 @@
+# Unit tests for packages/economics-toolkit (no live RPC required).
+name: economics-toolkit
+
+on:
+  push:
+    paths:
+      - "packages/economics-toolkit/**"
+      - "pnpm-workspace.yaml"
+      - "package.json"
+      - "scripts/economics/**"
+      - "scripts/validation/validate-economics-strategy-json.sh"
+      - "AGENTS.md"
+      - ".github/workflows/economics-toolkit.yml"
+  pull_request:
+    paths:
+      - "packages/economics-toolkit/**"
+      - "pnpm-workspace.yaml"
+      - "package.json"
+      - "scripts/economics/**"
+      - "scripts/validation/validate-economics-strategy-json.sh"
+      - "AGENTS.md"
+      - ".github/workflows/economics-toolkit.yml"
+  workflow_dispatch: {}
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "pnpm"
+      - name: Install
+        run: pnpm install
+      - name: Test economics-toolkit
+        run: pnpm run economics:test
+      - name: Validate strategy JSON (smoke + template)
+        run: pnpm run economics:validate
--- a/.github/workflows/info-defi-oracle-138.yml
+++ b/.github/workflows/info-defi-oracle-138.yml
@@ -0,0 +1,43 @@
+# Build Chain 138 info hub SPA when its package or workspace lockfile changes.
+name: info-defi-oracle-138
+
+on:
+  pull_request:
+    paths:
+      - 'info-defi-oracle-138/**'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - '.github/workflows/info-defi-oracle-138.yml'
+  push:
+    branches: [main, master]
+    paths:
+      - 'info-defi-oracle-138/**'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
+      - '.github/workflows/info-defi-oracle-138.yml'
+
+jobs:
+  build:
+    name: Typecheck & Vite build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'pnpm'
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build info-defi-oracle-138
+        run: pnpm --filter info-defi-oracle-138 build
--- a/.github/workflows/pmm-soak-grid-smoke.yml
+++ b/.github/workflows/pmm-soak-grid-smoke.yml
@@ -0,0 +1,46 @@
+# Dry-run PMM soak helpers: export, fund-grid plan, grid + single-wallet quote ticks (read-only RPC).
+name: PMM soak grid smoke
+
+on:
+  pull_request:
+    paths:
+      - 'scripts/deployment/pmm-soak*.sh'
+      - 'scripts/deployment/chain138-pmm*.sh'
+      - 'scripts/deployment/pmm-soak-grid-smoke-check.sh'
+      - 'scripts/lib/pmm-soak*.sh'
+      - 'scripts/lib/pmm-soak-dotenv-override.sh'
+      - 'scripts/deployment/pmm-soak-export-wallet-grid.py'
+      - 'config/pmm-soak-pools-stable.txt'
+      - 'config/pmm-soak-wallet-grid.example.json'
+      - '.github/workflows/pmm-soak-grid-smoke.yml'
+  push:
+    branches: [main, master]
+    paths:
+      - 'scripts/deployment/pmm-soak*.sh'
+      - 'scripts/deployment/chain138-pmm*.sh'
+      - 'scripts/deployment/pmm-soak-grid-smoke-check.sh'
+      - 'scripts/lib/pmm-soak*.sh'
+      - 'scripts/lib/pmm-soak-dotenv-override.sh'
+      - 'scripts/deployment/pmm-soak-export-wallet-grid.py'
+      - 'config/pmm-soak-pools-stable.txt'
+      - 'config/pmm-soak-wallet-grid.example.json'
+      - '.github/workflows/pmm-soak-grid-smoke.yml'
+
+jobs:
+  smoke:
+    name: Grid smoke (dry-run, public RPC)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Foundry (cast)
+        uses: foundry-rs/foundry-toolchain@v1
+
+      - name: Install bc
+        run: sudo apt-get update -qq && sudo apt-get install -y bc
+
+      - name: PMM soak grid smoke
+        env:
+          CI: "true"
+        run: bash scripts/deployment/pmm-soak-grid-smoke-check.sh
--- a/.github/workflows/verify-info-defi-oracle-public.yml
+++ b/.github/workflows/verify-info-defi-oracle-public.yml
@@ -0,0 +1,44 @@
+# Smoke-test the public Chain 138 info hub (HTTPS + agent files + same-origin token-aggregation JSON).
+# No secrets. May fail if the public edge or origin is down — inspect logs and runbook.
+name: Verify info.defi-oracle.io (public)
+
+on:
+  pull_request:
+    paths:
+      - 'scripts/verify/check-info-defi-oracle-public.sh'
+      - 'scripts/verify/playwright-audit-info-defi-oracle.mjs'
+      - 'info-defi-oracle-138/**'
+      - '.github/workflows/verify-info-defi-oracle-public.yml'
+  workflow_dispatch:
+    inputs:
+      info_site_base:
+        description: 'Optional INFO_SITE_BASE (staging). Leave empty to use repo variable or default https://info.defi-oracle.io'
+        required: false
+        type: string
+        default: ''
+  schedule:
+    - cron: '35 14 * * 1' # Mondays 14:35 UTC (~ weekly)
+
+jobs:
+  verify:
+    name: check-info-defi-oracle-public.sh
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install jq
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq jq
+
+      - name: Public info site + token-aggregation
+        shell: bash
+        env:
+          INPUT_BASE: ${{ github.event.inputs.info_site_base }}
+          VAR_BASE: ${{ vars.INFO_SITE_BASE }}
+        run: |
+          set -euo pipefail
+          if [ -n "${INPUT_BASE}" ]; then export INFO_SITE_BASE="${INPUT_BASE}"; fi
+          if [ -z "${INFO_SITE_BASE:-}" ] && [ -n "${VAR_BASE}" ]; then export INFO_SITE_BASE="${VAR_BASE}"; fi
+          bash scripts/verify/check-info-defi-oracle-public.sh
--- a/.gitignore
+++ b/.gitignore
@@ -12,10 +12,17 @@ yarn.lock
 # DBIS identity package — never commit real secrets (example only is tracked)
 config/production/dbis-identity-public-did-secrets.env

+# Local executor allowlist (copy from executor-allowlist.example.json)
+packages/economics-toolkit/config/executor-allowlist.json
+
+# PMM soak grid (addresses tied to a real mnemonic — generate locally)
+config/pmm-soak-wallet-grid.json
+
 # Environment files
 .env
 .env.local
 .env.*.local
+.env.keeper.local
 .env.master

 # Logs
--- a/.gitmodules
+++ b/.gitmodules
@@ -64,3 +64,6 @@
 [submodule "MEV_Bot"]
 	path = MEV_Bot
 	url = https://gitea.d-bis.org/d-bis/MEV_Bot.git
+[submodule "thirdweb-core-2103-test/lib/contracts"]
+	path = thirdweb-core-2103-test/lib/contracts
+	url = https://github.com/thirdweb-dev/contracts
--- a/.ops-backups/cloudflare/sfvalley02-config-20260405-1512.json
+++ b/.ops-backups/cloudflare/sfvalley02-config-20260405-1512.json
--- a/.ops-backups/cloudflare/sfvalley02-config-20260405-1513-post-cleanup.json
+++ b/.ops-backups/cloudflare/sfvalley02-config-20260405-1513-post-cleanup.json
@@ -0,0 +1 @@
+{"success":true,"errors":[],"messages":[],"result":{"tunnel_id":"892bd3fe-c6fa-4ddf-8b60-a8ed2b849c3d","version":14,"config":{"ingress":[{"service":"https://192.168.11.169:443","hostname":"rpc-core-2.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-alltra.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-alltra-2.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-alltra-3.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-hybx.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-hybx-2.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-hybx-3.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"cacti-alltra.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"cacti-hybx.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"http_status:404"}],"warp-routing":{"enabled":false}},"source":"cloudflare","created_at":"2026-04-05T22:11:28.363368Z"}}
--- a/.ops-backups/npmplus/proxy-hosts-20260405-115027.json
+++ b/.ops-backups/npmplus/proxy-hosts-20260405-115027.json
--- a/COMPREHENSIVE_STATUS_BRIDGE_READY.md
+++ b/COMPREHENSIVE_STATUS_BRIDGE_READY.md
@@ -252,7 +252,7 @@ NEW_BRIDGE="0xNEW_ADDRESS_HERE"  # From deployment
 # 1. Add Mainnet destination
 cast send $NEW_BRIDGE "addDestination(uint64,address)" \
  5009297550715157269 \
-  0x2A0840e5117683b11682ac46f5CF5621E67269E3 \
+  0xc9901ce2Ddb6490FAA183645147a87496d8b20B6 \
  --private-key $PRIVATE_KEY \
  --rpc-url http://192.168.11.211:8545

--- a/config/aggregator-route-matrix.csv
+++ b/config/aggregator-route-matrix.csv
@@ -1,26 +1,35 @@
 kind,routeId,status,routeType,fromChainId,toChainId,tokenInSymbol,tokenInAddress,tokenOutSymbol,tokenOutAddress,hopCount,bridgeType,bridgeAddress,aggregatorFamilies,tags,intermediateSymbols,legRefs,notesOrReason
-liveSwapRoute,138-cUSDT-cUSDC-direct,live,swap,138,138,cUSDT,0x93E66202A11B1772E55407B32B44e5Cd8eda7f22,cUSDC,0xf22258f57794CC8E06237084b353Ab30fFfa640b,1,,,1inch|0x|LiFi,stable|direct|public,,0xff8d3b8fDF7B112759F076B69f4271D4209C0849,
-liveSwapRoute,138-cUSDT-USDT-direct,live,swap,138,138,cUSDT,0x93E66202A11B1772E55407B32B44e5Cd8eda7f22,USDT,0x004b63A7B5b0E06f6bB6adb4a5F9f590BF3182D1,1,,,1inch|0x|LiFi,stable|official-mirror|public,,0x6fc60DEDc92a2047062294488539992710b99D71,
-liveSwapRoute,138-cUSDC-USDC-direct,live,swap,138,138,cUSDC,0xf22258f57794CC8E06237084b353Ab30fFfa640b,USDC,0x71D6687F38b93CCad569Fa6352c876eea967201b,1,,,1inch|0x|LiFi,stable|official-mirror|public,,0x0309178ae30302D83c76d6Dd402a684eF3160eec,
-liveSwapRoute,138-cUSDT-cXAUC-direct,live,swap,138,138,cUSDT,0x93E66202A11B1772E55407B32B44e5Cd8eda7f22,cXAUC,0x290E52a8819A4fbD0714E517225429aA2B70EC6b,1,,,1inch|0x|LiFi,xau-hub|public,,0x1AA55E2001E5651349AfF5A63FD7A7Ae44f0F1b0,
-liveSwapRoute,138-cUSDC-cXAUC-direct,live,swap,138,138,cUSDC,0xf22258f57794CC8E06237084b353Ab30fFfa640b,cXAUC,0x290E52a8819A4fbD0714E517225429aA2B70EC6b,1,,,1inch|0x|LiFi,xau-hub|public,,0xEA9Ac6357CaCB42a83b9082B870610363B177cBa,
-liveSwapRoute,138-cEURT-cXAUC-direct,live,swap,138,138,cEURT,0xdf4b71c61E5912712C1Bdd451416B9aC26949d72,cXAUC,0x290E52a8819A4fbD0714E517225429aA2B70EC6b,1,,,1inch|0x|LiFi,xau-hub|public,,0xbA99bc1eAAC164569d5AcA96C806934DDaF970Cf,
-liveSwapRoute,138-cEURT-cUSDT-via-cXAUC,live,swap,138,138,cEURT,0xdf4b71c61E5912712C1Bdd451416B9aC26949d72,cUSDT,0x93E66202A11B1772E55407B32B44e5Cd8eda7f22,2,,,1inch|0x|LiFi,multihop|xau-hub|public,cXAUC,0xbA99bc1eAAC164569d5AcA96C806934DDaF970Cf|0x1AA55E2001E5651349AfF5A63FD7A7Ae44f0F1b0,Inferred from two live public pools.
-liveSwapRoute,138-cEURT-cUSDC-via-cXAUC,live,swap,138,138,cEURT,0xdf4b71c61E5912712C1Bdd451416B9aC26949d72,cUSDC,0xf22258f57794CC8E06237084b353Ab30fFfa640b,2,,,1inch|0x|LiFi,multihop|xau-hub|public,cXAUC,0xbA99bc1eAAC164569d5AcA96C806934DDaF970Cf|0xEA9Ac6357CaCB42a83b9082B870610363B177cBa,Inferred from two live public pools.
-liveSwapRoute,138-cUSDT-cUSDC-via-cXAUC,live,swap,138,138,cUSDT,0x93E66202A11B1772E55407B32B44e5Cd8eda7f22,cUSDC,0xf22258f57794CC8E06237084b353Ab30fFfa640b,2,,,1inch|0x|LiFi,multihop|xau-hub|public|alternate,cXAUC,0x1AA55E2001E5651349AfF5A63FD7A7Ae44f0F1b0|0xEA9Ac6357CaCB42a83b9082B870610363B177cBa,Alternate path to the deeper direct cUSDT/cUSDC pool.
-liveBridgeRoute,138-WETH-1-ccip,live,bridge,138,1,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-56-ccip,live,bridge,138,56,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-137-ccip,live,bridge,138,137,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-10-ccip,live,bridge,138,10,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-42161-ccip,live,bridge,138,42161,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-43114-ccip,live,bridge,138,43114,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-8453-ccip,live,bridge,138,8453,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-100-ccip,live,bridge,138,100,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-25-ccip,live,bridge,138,25,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-42220-ccip,live,bridge,138,42220,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,CCIP,0xcacfd227A040002e49e2e01626363071324f820a,LiFi,,,,
-liveBridgeRoute,138-WETH-651940-alltra,live,bridge,138,651940,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,WETH,0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2,,ALT,0x66FEBA2fC9a0B47F26DD4284DAd24F970436B8Dc,LiFi,,,,
-liveBridgeRoute,138-WETH10-1-ccip,live,bridge,138,1,WETH10,0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f,WETH10,0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f,,CCIP,0xe0E93247376aa097dB308B92e6Ba36bA015535D0,LiFi,,,,
-blockedOrPlannedRoute,138-compliant-stable-to-weth-bridgeable,blocked,swap-bridge-swap,138,1,cUSDT|cUSDC|cEURT,,,,,,,,,,,"No live public cUSDT/WETH, cUSDC/WETH, or cEURT/WETH pool on Chain 138."
-blockedOrPlannedRoute,651940-public-dex-routes,planned,swap,651940,651940,,,,,,,,,,,,Uniswap V2/V3 and DODO are env placeholders only; no pool addresses are documented in-repo.
-blockedOrPlannedRoute,cw-edge-pools-public-chains,planned,swap,1,43114,,,,,,,,,,,,"cW* token addresses exist on several public chains, but deployment-status.json contains no PMM pools."
-blockedOrPlannedRoute,138-weth-1111-ccip,planned,bridge,138,1111,,,,,,,,,,,,Wemix bridge is pending funding and deployment.
+liveSwapRoute,chain-138-swap-dodo-cusdt-cusdc-0x9e89bae0,live,swap,138,138,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0x9e89bae009adf128782e19e8341996c596ac40dc,Generated from live planner route graph.
+liveSwapRoute,chain-138-swap-dodo-cusdc-cusdt-0x9e89bae0,live,swap,138,138,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0x9e89bae009adf128782e19e8341996c596ac40dc,Generated from live planner route graph.
+liveSwapRoute,chain-138-swap-dodo-cusdt-usdt-0x866cb44b,live,swap,138,138,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0x866cb44b59303d8dc5f4f9e3e7a8e8b0bf238d66,Generated from live planner route graph.
+liveSwapRoute,chain-138-swap-dodo-usdt-cusdt-0x866cb44b,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0x866cb44b59303d8dc5f4f9e3e7a8e8b0bf238d66,Generated from live planner route graph.
+liveSwapRoute,chain-138-swap-dodo-cusdc-usdc-0xc39b7d0f,live,swap,138,138,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0xc39b7d0f40838cbfb54649d327f49a6dac964062,Generated from live planner route graph.
+liveSwapRoute,chain-138-swap-dodo-usdc-cusdc-0xc39b7d0f,live,swap,138,138,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,1,,,1inch|0x|LiFi,planner-v2-generated|dodo,,0xc39b7d0f40838cbfb54649d327f49a6dac964062,Generated from live planner route graph.
+liveSwapRoute,chain-138-swap-dodo-v3-weth10-usdt-0x6550a3a5,live,swap,138,138,WETH10,0xf4bb2e28688e89fcce3c0580d37d36a7672e8a9f,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|dodo_v3,,0x6550a3a59070061a262a893a1d6f3f490affdbda,Generated from live planner route graph. | DODO v3 / D3MM Chain 138 pilot venue. | Canonical private pilot pool 0x6550a3a59070061a262a893a1d6f3f490affdbda executes through D3Proxy 0xc9a11abb7c63d88546be24d58a6d95e3762cb843. | Planner-v2 exposure and EnhancedSwapRouterV2 internal execution-plan calldata are live for the canonical pilot pair.
+liveSwapRoute,chain-138-swap-dodo-v3-usdt-weth10-0x6550a3a5,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,WETH10,0xf4bb2e28688e89fcce3c0580d37d36a7672e8a9f,1,,,1inch|0x|LiFi,planner-v2-generated|dodo_v3,,0x6550a3a59070061a262a893a1d6f3f490affdbda,Generated from live planner route graph. | DODO v3 / D3MM Chain 138 pilot venue. | Canonical private pilot pool 0x6550a3a59070061a262a893a1d6f3f490affdbda executes through D3Proxy 0xc9a11abb7c63d88546be24d58a6d95e3762cb843. | Planner-v2 exposure and EnhancedSwapRouterV2 internal execution-plan calldata are live for the canonical pilot pair.
+liveSwapRoute,chain-138-swap-uniswap-v3-weth-usdt,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|uniswap_v3,,0xde9cd8ee2811e6e64a41d5f68be315d33995975e,Generated from live planner route graph. | Chain 138 upstream-native Uniswap v3 WETH/USDT venue.
+liveSwapRoute,chain-138-swap-uniswap-v3-usdt-weth,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|uniswap_v3,,0xde9cd8ee2811e6e64a41d5f68be315d33995975e,Generated from live planner route graph. | Chain 138 upstream-native Uniswap v3 WETH/USDT venue.
+liveSwapRoute,chain-138-swap-uniswap-v3-weth-usdc,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,1,,,1inch|0x|LiFi,planner-v2-generated|uniswap_v3,,0xde9cd8ee2811e6e64a41d5f68be315d33995975e,Generated from live planner route graph. | Chain 138 upstream-native Uniswap v3 WETH/USDC venue.
+liveSwapRoute,chain-138-swap-uniswap-v3-usdc-weth,live,swap,138,138,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|uniswap_v3,,0xde9cd8ee2811e6e64a41d5f68be315d33995975e,Generated from live planner route graph. | Chain 138 upstream-native Uniswap v3 WETH/USDC venue.
+liveSwapRoute,chain-138-swap-balancer-weth-usdt,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|balancer,,0x96423d7c1727698d8a25ebfb88131e9422d1a3c3,Generated from live planner route graph. | Chain 138 pilot-compatible Balancer USDT/WETH venue.
+liveSwapRoute,chain-138-swap-balancer-usdt-weth,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|balancer,,0x96423d7c1727698d8a25ebfb88131e9422d1a3c3,Generated from live planner route graph. | Chain 138 pilot-compatible Balancer USDT/WETH venue.
+liveSwapRoute,chain-138-swap-balancer-weth-usdc,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,1,,,1inch|0x|LiFi,planner-v2-generated|balancer,,0x96423d7c1727698d8a25ebfb88131e9422d1a3c3,Generated from live planner route graph. | Chain 138 pilot-compatible Balancer USDC/WETH venue.
+liveSwapRoute,chain-138-swap-balancer-usdc-weth,live,swap,138,138,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|balancer,,0x96423d7c1727698d8a25ebfb88131e9422d1a3c3,Generated from live planner route graph. | Chain 138 pilot-compatible Balancer USDC/WETH venue.
+liveSwapRoute,chain-138-swap-curve-usdt-usdc,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,1,,,1inch|0x|LiFi,planner-v2-generated|curve,,0xe440ec15805be4c7babcd17a63b8c8a08a492e0f,Generated from live planner route graph. | Chain 138 pilot-compatible Curve 3Pool stable/stable venue.
+liveSwapRoute,chain-138-swap-curve-usdc-usdt,live,swap,138,138,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|curve,,0xe440ec15805be4c7babcd17a63b8c8a08a492e0f,Generated from live planner route graph. | Chain 138 pilot-compatible Curve 3Pool stable/stable venue.
+liveSwapRoute,chain-138-swap-one-inch-weth-usdt,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,1,,,1inch|0x|LiFi,planner-v2-generated|one_inch,,0x500b84b1bc6f59c1898a5fe538ea20a758757a4f,Generated from live planner route graph. | Chain 138 pilot-compatible 1inch router lane.
+liveSwapRoute,chain-138-swap-one-inch-usdt-weth,live,swap,138,138,USDT,0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|one_inch,,0x500b84b1bc6f59c1898a5fe538ea20a758757a4f,Generated from live planner route graph. | Chain 138 pilot-compatible 1inch router lane.
+liveSwapRoute,chain-138-swap-one-inch-weth-usdc,live,swap,138,138,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,1,,,1inch|0x|LiFi,planner-v2-generated|one_inch,,0x500b84b1bc6f59c1898a5fe538ea20a758757a4f,Generated from live planner route graph. | Chain 138 pilot-compatible 1inch router lane.
+liveSwapRoute,chain-138-swap-one-inch-usdc-weth,live,swap,138,138,USDC,0x71d6687f38b93ccad569fa6352c876eea967201b,WETH,0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2,1,,,1inch|0x|LiFi,planner-v2-generated|one_inch,,0x500b84b1bc6f59c1898a5fe538ea20a758757a4f,Generated from live planner route graph. | Chain 138 pilot-compatible 1inch router lane.
+liveBridgeRoute,bridge-138-651940-cusdt-alltraadapter,live,bridge,138,651940,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,cUSDT,0x93e66202a11b1772e55407b32b44e5cd8eda7f22,,ALT,0x66feba2fc9a0b47f26dd4284dad24f970436b8dc,1inch|0x|LiFi,planner-v2-generated|bridge,,,Generated from bridge registry and planner visibility. | Registry route AlltraAdapter
+liveBridgeRoute,bridge-138-651940-cusdc-alltraadapter,live,bridge,138,651940,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,cUSDC,0xf22258f57794cc8e06237084b353ab30fffa640b,,ALT,0x66feba2fc9a0b47f26dd4284dad24f970436b8dc,1inch|0x|LiFi,planner-v2-generated|bridge,,,Generated from bridge registry and planner visibility. | Registry route AlltraAdapter
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-cbtc-cusdt,planned,swap,138,138,cBTC|cUSDT,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CUSDT after the canonical cBTC/cUSDT PMM pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-cusdt-cbtc,planned,swap,138,138,cUSDT|cBTC,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CUSDT after the canonical cBTC/cUSDT PMM pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-cbtc-cusdc,planned,swap,138,138,cBTC|cUSDC,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CUSDC after the canonical cBTC/cUSDC PMM pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-cusdc-cbtc,planned,swap,138,138,cUSDC|cBTC,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CUSDC after the canonical cBTC/cUSDC PMM pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-cbtc-cxauc,planned,swap,138,138,cBTC|cXAUC,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CXAUC after the canonical cBTC/cXAUC PMM pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-cxauc-cbtc,planned,swap,138,138,cXAUC|cBTC,,,,,,,,,,,Set CHAIN138_POOL_CBTC_CXAUC after the canonical cBTC/cXAUC PMM pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-weth-usdt,planned,swap,138,138,WETH|USDT,,,,,,,,,,,Set CHAIN138_POOL_WETH_USDT after the canonical WETH/USDT pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-usdt-weth,planned,swap,138,138,USDT|WETH,,,,,,,,,,,Set CHAIN138_POOL_WETH_USDT after the canonical WETH/USDT pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-weth-usdc,planned,swap,138,138,WETH|USDC,,,,,,,,,,,Set CHAIN138_POOL_WETH_USDC after the canonical WETH/USDC pool is created and funded.
+blockedOrPlannedRoute,chain-138-capability-dodo-planned-usdc-weth,planned,swap,138,138,USDC|WETH,,,,,,,,,,,Set CHAIN138_POOL_WETH_USDC after the canonical WETH/USDC pool is created and funded.
--- a/config/aggregator-route-matrix.json
+++ b/config/aggregator-route-matrix.json
--- a/config/besu-node-lists/README.md
+++ b/config/besu-node-lists/README.md
@@ -27,9 +27,9 @@ See [docs/06-besu/MASTER_DOCS_AND_NODE_LISTS_REVIEW.md](../../docs/06-besu/MASTE
 - **New node (e.g. 1504, 2102):** Get the node’s enode (e.g. from `admin_nodeInfo` or the node’s data dir), add it to both files here, then run the deploy script.
 - **Node removed:** Remove its enode from both files and redeploy.
 - **Regenerate all (no duplicates):** Run `bash scripts/besu/collect-enodes-from-all-besu-nodes.sh` to collect from every node (admin_nodeInfo or `besu public-key export`), merge with existing for unreachable nodes, and overwrite both files.
- **Fix failures only:** Run `bash scripts/besu/collect-enodes-from-all-besu-nodes.sh --missing-only` to try only VMIDs whose IP is not yet in the list (no full 32-node sweep).
- **Generate missing node keys:** Run `bash scripts/besu/generate-node-keys-for-missing-vmids.sh [--force] [--collect]` to create `/data/besu/key` (64-hex) only for VMIDs not yet in the list. Use `--force` to overwrite PEM/wrong-format keys; use `--collect` to run collect --missing-only after. Containers without Besu (1505–1508, 2501–2505) are supported via helper nodes (1504 on ml110, 2500 on r630-01).
- **Install Besu permanently on nodes missing it:** Run `bash scripts/besu/install-besu-permanent-on-missing-nodes.sh` to install Besu (23.10.3) in 1505–1508 and 2501–2505, deploy config/genesis/node lists, and enable+start the service so RPC/sentry runs after reboot.
+- **Fix failures only:** Run `bash scripts/besu/collect-enodes-from-all-besu-nodes.sh --missing-only` to try only VMIDs whose IP is not yet in the list (no full 37-node sweep).
+- **Generate missing node keys:** Run `bash scripts/besu/generate-node-keys-for-missing-vmids.sh [--force] [--collect]` to create `/data/besu/key` (64-hex) only for VMIDs not yet in the list. Use `--force` to overwrite PEM/wrong-format keys; use `--collect` to run collect --missing-only after. Current auxiliary / edge nodes include sentries `1505–1510` and RPCs `2420/2430/2440/2460/2470/2480`.
+- **Install Besu permanently on nodes missing it:** Run `bash scripts/besu/install-besu-permanent-on-missing-nodes.sh` to install the current Besu line used by the fleet, deploy config/genesis/node lists, and enable+start the service so RPC/sentry runs after reboot.

 ## Sentry 1504 (.154)

--- a/config/besu-node-lists/permissions-nodes.toml
+++ b/config/besu-node-lists/permissions-nodes.toml
@@ -1,6 +1,6 @@
 # Node Permissioning — SINGLE SOURCE OF TRUTH for all Besu nodes
 # Must match config/besu-node-lists/static-nodes.json and be deployed to every node.
-# Generated by scripts/besu/collect-enodes-from-all-besu-nodes.sh — 34 enodes (incl. Putu RPC 2307/2308 .237/.238).
+# Generated by scripts/besu/collect-enodes-from-all-besu-nodes.sh — 37 enodes (incl. 2103 refreshed, Putu RPC 2307/2308 .237/.238, and Thirdweb sentries 1509/1510).

 nodes-allowlist=[
  "enode://2221dd9fc65c9082d4a937832cba9f6759981888df6798407c390bd153f4332c152ea5d03dd9d9cda74d7990fb3479a5c4ba7166269322be9790eed9ebdcfe24@192.168.11.100:30303",
@@ -15,10 +15,13 @@ nodes-allowlist=[
  "enode://225d902bf840379ce122f8cc431a542ddee0bde3e949b48767285bbc9c774cc3fc22cd4913ee72f0a19dce266e3ecb66dba5c58092d0b0e5ceb4e13bf96a1a68@192.168.11.154:30303",
  "enode://afa44c03ac3dd97efcbbef8edea11d1edf23bd595f30d4cf0c4be364d0b194e4217926a37141b54dcff71107f9ee257f621553cd867a2c9fa5a5537b3ae59746@192.168.11.213:30303",
  "enode://5f048208071f2a3036128433e1e4a647a7683abd8bc0f27d063e2933ced983accdfc44998666f3be711e4eff27511142d9989775b86cdbe28c79b74409fc36bb@192.168.11.214:30303",
+  "enode://8a3337adcc2d177caf3aee26b3b6077d9adf126c580e12f352743ca07828f056ceb1d5fb1a06287e2dbbe19043fcc4b9bdd2ca9ae2a2c9142cf0cc3a549bfc68@192.168.11.219:30303",
+  "enode://09fe518689c54a34c3dac8aebf3c94bfc390f4bae143a80c57d92a502414df0689d12a2243ff9376c2f44a419894d934b4f47783ced31ea9668522078854e58f@192.168.11.220:30303",
  "enode://8da1b586e2e98f521f07148d3bb5d81fde151ce3d5738b51bc36e2c81de1aaa5404ce31e991b4393bbe471934f0a9a31f78d1d7c17c1899c3e2dde5e9f16eb24@192.168.11.244:30303",
  "enode://acd46d31913b8379f075467cd88d2ea650d33474d2f9546426da4a414fe92233584c9d8c2e1ea9962fa4257c20b66c9434d0488e51c632f285205d6a379cfbd6@192.168.11.245:30303",
  "enode://6cdc892fa09afa2b05c21cc9a1193a86cf0d195ce81b02a270d8bb987f78ca98ad90d907670796c90fc6e4eaf3b4cae6c0c15871e2564de063beceb4bbfc6532@192.168.11.211:30303",
  "enode://e53713bb77ad9f39e8a04b9c82aadddd3449220167f546bca8e9f36f6ebf60ae003e48ac293790e2bd7b0aca382777db9eca61d6f048c04f9dbe65eedb79d893@192.168.11.212:30303?discport=0",
+  "enode://e871ff3b1f58b9a87122e552b2404e1893bf92ae74d4fa6bc2bd002d0350c506ea452f4aefa1a3497ef32694c4beb48bf8a006d2b82f57649c90b22f59044aad@192.168.11.217:30303?discport=0",
  "enode://07daf3d64079faa3982bc8be7aa86c24ef21eca4565aae4a7fd963c55c728de0639d80663834634edf113b9f047d690232ae23423c64979961db4b6449aa6dfd@192.168.11.221:30303",
  "enode://868bd957d6d887944deac0190161a3db7d1316a022e40a2383d5c334aa3fb8bc7ca36f165b6fb377b77d202fec46f3840f2f659b6a47807b7ce9b944b8382f10@192.168.11.232:30303",
  "enode://688f271d94c7995600ae36d25aa2fb92fea0c52e50e86c598be8966515458c1408b67fba76e1f771073e4774a6e399588443da63394ea25d56e6ca36f2288e00@192.168.11.233:30303",
--- a/config/besu-node-lists/static-nodes.json
+++ b/config/besu-node-lists/static-nodes.json
@@ -11,10 +11,13 @@
  "enode://225d902bf840379ce122f8cc431a542ddee0bde3e949b48767285bbc9c774cc3fc22cd4913ee72f0a19dce266e3ecb66dba5c58092d0b0e5ceb4e13bf96a1a68@192.168.11.154:30303",
  "enode://afa44c03ac3dd97efcbbef8edea11d1edf23bd595f30d4cf0c4be364d0b194e4217926a37141b54dcff71107f9ee257f621553cd867a2c9fa5a5537b3ae59746@192.168.11.213:30303",
  "enode://5f048208071f2a3036128433e1e4a647a7683abd8bc0f27d063e2933ced983accdfc44998666f3be711e4eff27511142d9989775b86cdbe28c79b74409fc36bb@192.168.11.214:30303",
+  "enode://8a3337adcc2d177caf3aee26b3b6077d9adf126c580e12f352743ca07828f056ceb1d5fb1a06287e2dbbe19043fcc4b9bdd2ca9ae2a2c9142cf0cc3a549bfc68@192.168.11.219:30303",
+  "enode://09fe518689c54a34c3dac8aebf3c94bfc390f4bae143a80c57d92a502414df0689d12a2243ff9376c2f44a419894d934b4f47783ced31ea9668522078854e58f@192.168.11.220:30303",
  "enode://8da1b586e2e98f521f07148d3bb5d81fde151ce3d5738b51bc36e2c81de1aaa5404ce31e991b4393bbe471934f0a9a31f78d1d7c17c1899c3e2dde5e9f16eb24@192.168.11.244:30303",
  "enode://acd46d31913b8379f075467cd88d2ea650d33474d2f9546426da4a414fe92233584c9d8c2e1ea9962fa4257c20b66c9434d0488e51c632f285205d6a379cfbd6@192.168.11.245:30303",
  "enode://6cdc892fa09afa2b05c21cc9a1193a86cf0d195ce81b02a270d8bb987f78ca98ad90d907670796c90fc6e4eaf3b4cae6c0c15871e2564de063beceb4bbfc6532@192.168.11.211:30303",
  "enode://e53713bb77ad9f39e8a04b9c82aadddd3449220167f546bca8e9f36f6ebf60ae003e48ac293790e2bd7b0aca382777db9eca61d6f048c04f9dbe65eedb79d893@192.168.11.212:30303?discport=0",
+  "enode://e871ff3b1f58b9a87122e552b2404e1893bf92ae74d4fa6bc2bd002d0350c506ea452f4aefa1a3497ef32694c4beb48bf8a006d2b82f57649c90b22f59044aad@192.168.11.217:30303?discport=0",
  "enode://07daf3d64079faa3982bc8be7aa86c24ef21eca4565aae4a7fd963c55c728de0639d80663834634edf113b9f047d690232ae23423c64979961db4b6449aa6dfd@192.168.11.221:30303",
  "enode://868bd957d6d887944deac0190161a3db7d1316a022e40a2383d5c334aa3fb8bc7ca36f165b6fb377b77d202fec46f3840f2f659b6a47807b7ce9b944b8382f10@192.168.11.232:30303",
  "enode://688f271d94c7995600ae36d25aa2fb92fea0c52e50e86c598be8966515458c1408b67fba76e1f771073e4774a6e399588443da63394ea25d56e6ca36f2288e00@192.168.11.233:30303",
--- a/config/btc-settlement-pathways.json
+++ b/config/btc-settlement-pathways.json
@@ -0,0 +1,133 @@
+{
+  "schemaVersion": 1,
+  "updated": "2026-04-03",
+  "description": "End-to-end pathways from Chain 138 to native BTC via Changelly (partner API) or Atomic Wallet (user-operated swap). Used by orchestration design; does not imply keys or contracts are configured.",
+  "homeChainId": 138,
+  "destinationAsset": {
+    "symbol": "BTC",
+    "network": "bitcoin-mainnet",
+    "addressFormat": "bech32-p2wpkh-or-legacy"
+  },
+  "references": {
+    "mainnetLiquidityPlan": "docs/00-meta/MAINNET_LIQUIDITY_AND_RAMPS_PRIORITY.md",
+    "rampUserFlows": "docs/04-configuration/MAINNET_RAMP_USER_FLOWS.md",
+    "deployedBridgesStatus": "docs/11-references/DEPLOYED_TOKENS_BRIDGES_LPS_AND_ROUTING_STATUS.md",
+    "changellyDocs": "https://docs.changelly.com/",
+    "changellySupportEmail": "pro@changelly.com",
+    "atomicWalletSwapKb": "https://support.atomicwallet.io/article/73-how-to-make-an-exchange"
+  },
+  "changelly": {
+    "product": "Changelly Exchange API v2",
+    "integrationSurface": "backend_jsonrpc",
+    "apiBaseUrl": "https://api.changelly.com/v2",
+    "authentication": {
+      "headers": ["X-Api-Key", "X-Api-Signature"],
+      "signatureAlgorithm": "RSA-SHA256 over raw JSON-RPC body",
+      "note": "Generate RSA keypair; register public key with Changelly; never expose private key to browsers."
+    },
+    "documentedRpcFlow": [
+      "getCurrencies",
+      "getPairsParams",
+      "getMinAmount",
+      "validateAddress",
+      "getExchangeAmount",
+      "createTransaction",
+      "getTransactions (poll status)"
+    ],
+    "envVars": [
+      "CHANGELLY_API_PUBLIC_KEY",
+      "CHANGELLY_API_PRIVATE_KEY_PEM_PATH"
+    ]
+  },
+  "atomicWallet": {
+    "product": "Atomic Wallet (desktop/mobile)",
+    "integrationSurface": "user_operated",
+    "note": "Swaps route through in-wallet partners to deposit addresses; there is no documented first-party B2B swap API equivalent to Changelly v2 for arbitrary server-side settlement. Use for operator or end-user manual path after funds sit on a chain Atomic supports.",
+    "supportedChainsForSwap": "See in-app asset list; typically includes BTC and major EVM assets when counterpart is available."
+  },
+  "pathways": [
+    {
+      "id": "138-evm-changelly-btc-treasury",
+      "label": "Automated-friendly: 138 → Ethereum mainnet stables/ETH → Changelly → BTC payout address",
+      "venue": "changelly",
+      "automationTier": "high",
+      "summary": "Bridge and swap on-chain until Ethereum holds USDT, USDC, ETH, or WETH that Changelly lists; backend calls createTransaction with payout btc address; treasury sends the exact deposit amount to Changelly’s deposit address.",
+      "preconditions": [
+        "Ethereum mainnet liquidity for chosen bridge (LiquidityPoolETH / CCIP WETH path per MAINNET_LIQUIDITY_AND_RAMPS_PRIORITY.md)",
+        "Changelly partner API key registered (pro@changelly.com)",
+        "Treasury hot wallet on Ethereum with gas ETH and sendable USDT/USDC/ETH per quote",
+        "Confirm Changelly ticker names for from-currency (e.g. eth, usdt20, usdc) match your token contract version"
+      ],
+      "steps": [
+        {
+          "order": 1,
+          "chainId": 138,
+          "action": "swap_to_bridge_asset",
+          "detail": "Use DODOPMMIntegration / EnhancedSwapRouter on 138 to convert source (e.g. cUSDT, cUSDC) into the token your bridge expects (often WETH for CCIP WETH bridges, or corridor-specific asset)."
+        },
+        {
+          "order": 2,
+          "chainId": 138,
+          "action": "bridge_to_ethereum",
+          "detail": "Execute CCIP or trustless bridge to Ethereum mainnet per deployed bridge matrix (DEPLOYED_TOKENS_BRIDGES_LPS_AND_ROUTING_STATUS.md)."
+        },
+        {
+          "order": 3,
+          "chainId": 1,
+          "action": "optional_swap_on_mainnet",
+          "detail": "If payout asset is wrong shape (e.g. WETH only, need USDT), swap on mainnet via DEX/aggregator to Changelly-accepted from-currency."
+        },
+        {
+          "order": 4,
+          "chainId": 0,
+          "action": "changelly_quote_and_create",
+          "detail": "JSON-RPC: getMinAmount, getExchangeAmount, validateAddress(BTC), createTransaction with amount, from, to btc, address = user btc address. Store payin address + id."
+        },
+        {
+          "order": 5,
+          "chainId": 1,
+          "action": "send_payin",
+          "detail": "Broadcast Ethereum tx from treasury to Changelly deposit address for exact amount; single output per Changelly rules for UTXO targets."
+        },
+        {
+          "order": 6,
+          "chainId": 0,
+          "action": "poll_until_btc_sent",
+          "detail": "Poll getTransactions / status until outbound BTC confirmed; record btc txid for reconciliation."
+        }
+      ]
+    },
+    {
+      "id": "138-evm-atomic-user-btc",
+      "label": "User-operated: 138 → Ethereum → Atomic Wallet swap → BTC",
+      "venue": "atomic_wallet",
+      "automationTier": "low",
+      "summary": "After funds arrive on an Ethereum address the user controls in Atomic Wallet, user runs in-app Exchange to BTC; no server-side Atomic swap API in repo.",
+      "preconditions": [
+        "Bridge completes to user-controlled Ethereum address (same EOA in MetaMask and Atomic, or user sends to Atomic-seeded wallet)",
+        "User installs Atomic Wallet and holds seed phrase",
+        "Asset appears in Atomic’s supported list for swap into BTC"
+      ],
+      "steps": [
+        {
+          "order": 1,
+          "chainId": 138,
+          "action": "swap_and_bridge_to_user_eoa_mainnet",
+          "detail": "Same as Changelly path steps 1–2 but recipient is user’s Ethereum mainnet address."
+        },
+        {
+          "order": 2,
+          "chainId": 1,
+          "action": "user_opens_atomic_exchange",
+          "detail": "In Atomic: Exchange → select from asset (ETH/USDT/USDC etc.) → to BTC → enter amount and destination BTC address (often same app wallet’s BTC account)."
+        },
+        {
+          "order": 3,
+          "chainId": 0,
+          "action": "user_completes_partner_flow",
+          "detail": "Follow Atomic prompts (rates non-fixed, ~20 min typical per vendor KB); user bears slippage and network fees."
+        }
+      ]
+    }
+  ]
+}
--- a/config/compliance-matrix/README.md
+++ b/config/compliance-matrix/README.md
@@ -0,0 +1,14 @@
+# Global compliance matrix index
+
+**Canonical index:** [`global-compliance-matrix-index.json`](global-compliance-matrix-index.json)
+
+This folder holds a **top-level registry** of compliance packages by jurisdiction or region. Each entry points to a **drill-down manifest** under [`jurisdictions/`](jurisdictions/) that lists:
+
+- Transaction-grade JSON matrices (Indonesia / JVMTM)
+- Audit closure matrices (markdown)
+- Institutional submission binders (Indonesia 4.995 package)
+- Regional rulebook mappings (e.g. SEPA under `gru-docs/`)
+
+**Indonesia drill-down:** [`jurisdictions/ID.json`](jurisdictions/ID.json) → `config/jvmtm-regulatory-closure/transaction-compliance-matrix.json` plus submission docs in `docs/04-configuration/mifos-omnl-central-bank/`.
+
+**Validation:** `python3 scripts/validation/validate-global-compliance-matrix-index.py` (also invoked from `scripts/validation/validate-jvmtm-regulatory-closure-schemas.sh`).
--- a/config/compliance-matrix/global-compliance-matrix-index.json
+++ b/config/compliance-matrix/global-compliance-matrix-index.json
@@ -0,0 +1,30 @@
+{
+  "schema_version": 1,
+  "matrix_version": "2026-04-03",
+  "title": "Global compliance matrix index",
+  "description": "Top-level registry of jurisdiction and regional compliance packages. Each row links to a manifest JSON for drill-down (controls, audit closure, submission binders, or regional rulebook mappings).",
+  "canonical_format": "json",
+  "cross_cutting": {
+    "dbis_institutional": "config/dbis-institutional/README.md",
+    "settlement_stack_runbook": "docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md",
+    "iso_gateway_spec": "docs/dbis-rail/ISO_GATEWAY_AND_RELAYER_SPEC.md"
+  },
+  "jurisdictions": [
+    {
+      "jurisdiction_id": "ID",
+      "display_name": "Indonesia",
+      "iso_3166_alpha2": "ID",
+      "status": "active",
+      "summary": "JVMTM audit closure (INAAUDJVMTM 2025), transaction-grade operator pack, OJK/BI identifier policy, BI/MoF institutional submission binder (4.995).",
+      "jurisdiction_manifest": "config/compliance-matrix/jurisdictions/ID.json"
+    },
+    {
+      "jurisdiction_id": "EU-SEPA",
+      "display_name": "European Union (SEPA — GRU docs)",
+      "iso_3166_alpha2": null,
+      "status": "active",
+      "summary": "SEPA Credit Transfer rulebook mapping in gru-docs; separate from Indonesia JVMTM JSON controls.",
+      "jurisdiction_manifest": "config/compliance-matrix/jurisdictions/EU-SEPA.json"
+    }
+  ]
+}
--- a/config/compliance-matrix/jurisdictions/EU-SEPA.json
+++ b/config/compliance-matrix/jurisdictions/EU-SEPA.json
@@ -0,0 +1,25 @@
+{
+  "schema_version": 1,
+  "jurisdiction_id": "EU-SEPA",
+  "iso_3166_alpha2": null,
+  "display_name": "European Union (SEPA — GRU documentation)",
+  "summary": "GRU site compliance set for SEPA Credit Transfer / SCT Inst rulebook mapping (markdown); use alongside global settlement runbooks when EUR rails apply.",
+  "audit_engagements": [],
+  "regulators": [
+    {"short": "EPC", "full_name": "European Payments Council"}
+  ],
+  "compliance_packages": [
+    {
+      "package_id": "gru-sepa-compliance-matrix",
+      "kind": "regional_markdown",
+      "title": "SEPA Compliance Matrix for GRU System",
+      "description": "Maps GRU implementation to EPC SEPA rulebook elements (ISO 20022); maintained under gru-docs.",
+      "human_readable_md": [
+        "gru-docs/_compliance/sepa/SEPA_Compliance_Matrix.md"
+      ],
+      "index_md": [
+        "gru-docs/compliance.md"
+      ]
+    }
+  ]
+}
--- a/config/compliance-matrix/jurisdictions/ID.json
+++ b/config/compliance-matrix/jurisdictions/ID.json
@@ -0,0 +1,51 @@
+{
+  "schema_version": 1,
+  "jurisdiction_id": "ID",
+  "iso_3166_alpha2": "ID",
+  "display_name": "Indonesia",
+  "summary": "Transaction-grade controls derived from JVMTM Tables B/C/D closure; supervisory submission artifacts for HYBX-BATCH-001 (Bank Kanaya / BI–MoF package).",
+  "audit_engagements": [
+    {
+      "id": "018215821582",
+      "label": "INAAUDJVMTM/2025",
+      "closure_matrix": "config/jvmtm-regulatory-closure/INAAUDJVMTM_2025_AUDIT_CLOSURE_MATRIX.md"
+    }
+  ],
+  "regulators": [
+    {"short": "BI", "full_name": "Bank Indonesia"},
+    {"short": "OJK", "full_name": "Otoritas Jasa Keuangan"},
+    {"short": "MoF", "full_name": "Ministry of Finance of the Republic of Indonesia"},
+    {"short": "PPATK", "full_name": "Indonesian Financial Transaction Reports and Analysis Centre (PPATK)"}
+  ],
+  "compliance_packages": [
+    {
+      "package_id": "jvmtm-transaction-grade",
+      "kind": "transaction_controls_json",
+      "title": "JVMTM transaction-grade compliance matrix",
+      "description": "Canonical controls and runtime slots for pre-transaction through high-value mode; maps to audit rows and repo evidence.",
+      "canonical_matrix_json": "config/jvmtm-regulatory-closure/transaction-compliance-matrix.json",
+      "spreadsheet_csv": "config/jvmtm-regulatory-closure/transaction-compliance-matrix.csv",
+      "human_readable_md": [
+        "config/jvmtm-regulatory-closure/JVMTM_TRANSACTION_GRADE_COMPLIANCE_MATRIX.md",
+        "config/jvmtm-regulatory-closure/README.md"
+      ],
+      "policy_md": [
+        "docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md"
+      ]
+    },
+    {
+      "package_id": "submission-binder-hybx-batch-001",
+      "kind": "institutional_submission",
+      "title": "Indonesia central bank / MoF submission package (4.995 target)",
+      "description": "Master proof manifest, binder layout, scorecard, and regulatory annex for institutional transmission.",
+      "entry_point_md": [
+        "docs/04-configuration/mifos-omnl-central-bank/INDONESIA_MASTER_PROOF_MANIFEST.md",
+        "docs/04-configuration/mifos-omnl-central-bank/INDONESIA_CENTRAL_BANK_SUBMISSION_BINDER.md",
+        "docs/04-configuration/mifos-omnl-central-bank/INDONESIA_SUBMISSION_PACKAGE_GRADE_AND_SCORECARD.md",
+        "docs/04-configuration/mifos-omnl-central-bank/INDONESIA_PACKAGE_4_995_EVIDENCE_STANDARD.md",
+        "docs/04-configuration/mifos-omnl-central-bank/INDONESIA_REGULATORY_REFERENCES_ANNEX.md",
+        "docs/04-configuration/mifos-omnl-central-bank/HYBX_BATCH_001_OPERATOR_CHECKLIST.md"
+      ]
+    }
+  ]
+}
--- a/config/dbis-institutional/README.md
+++ b/config/dbis-institutional/README.md
@@ -6,6 +6,13 @@ Machine-readable artifacts for **OMNL + DBIS Core + Chain 138 + RTGS** integrati

 [OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md](../../docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md)

+## WEB3-ETH-IBAN (`web3_eth_iban`) vs bank IBAN
+
+In this registry, **`aliases[].aliasType` = `web3_eth_iban`** is an **Ethereum presentation alias**: an **XE…** string in the same family as [ICAP / IBAN-style encoding](https://github.com/ethereum/wiki/wiki/ICAP:-Inter-exchange-Client-Address-Protocol) used by [Web3.js `Iban`](https://docs.web3js.org/libdocs/Iban). It is **not** a SWIFT bank IBAN. **`fiat_rails[].railType` = `iban`** is for **regulated fiat** account identifiers.
+
+- **Validate checksum and resolve to `address`:** from repo root, `node scripts/verify/validate-address-registry-xe-aliases.mjs [file.json …]` (defaults to institutional examples). Wired into `validate-dbis-institutional-schemas.sh` when `node` and npm package `web3-eth-iban` are installed at the workspace root.
+- **Library:** [`web3-eth-iban`](https://www.npmjs.com/package/web3-eth-iban) (also bundled as `web3.eth.Iban` in web3.js v1).
+
 ## Event producers (`event-producers.manifest.json`)

 Registered logical emitters for `settlement-event.event_producer` (kept in sync with the `enum` in `schemas/settlement-event.schema.json`). Add a producer: extend both the manifest and the schema enum in one change.
@@ -25,7 +32,7 @@ Registered logical emitters for `settlement-event.event_producer` (kept in sync
 | `settlement-event.chain138-primary.example.json` | Same schema; **Chain 138 as authoritative rail** — no `uetr`; `rtgs_message_ids.rail` + internal refs; see [OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md](../../docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md) |
 | `settlement-event.min.json` | **Minimal** valid `CHAIN_SETTLEMENT` fixture (required fields + `chain_tx_hash` / `chain_id`); CI baseline in `validate-dbis-institutional-schemas.sh`. |
 | `settlement-events-batch.example.json` | Each array element validated against `settlement-event.schema.json` (see `validate-dbis-institutional-schemas.sh`) |
-| `address-registry-entry.example.json` | `address-registry-entry.schema.json` |
+| `address-registry-entry.example.json` | `address-registry-entry.schema.json`; `web3_eth_iban` uses a valid **XE…** string that resolves to `address` (see XE section above) |
 | `address-registry-entries-batch.example.json` | Each array element validated against `address-registry-entry.schema.json` |

 Examples use placeholder addresses and ids; replace with live data in a secure store (not committed).
--- a/config/dbis-institutional/examples/address-registry-entry.example.json
+++ b/config/dbis-institutional/examples/address-registry-entry.example.json
@@ -8,7 +8,7 @@
  "omnl_office_id": 22,
  "dbis_participant_id": "PART-ID-OMNL-HO-001",
  "chain_id": 138,
-  "address": "0x0000000000000000000000000000000000000001",
+  "address": "0x00c5496aEe77C1bA1f0854206A26DdA82a81D6D8",
  "addressRole": "treasury_vault",
  "fiat_rails": [
    {
@@ -27,7 +27,7 @@
    },
    {
      "aliasType": "web3_eth_iban",
-      "aliasValue": "ETHXXXXXXXXXXXXXXXX",
+      "aliasValue": "XE7338O073KYGTWWZN0F2WZ0R8PX5ZPPZS",
      "validFrom": "2026-03-15T00:00:00Z"
    },
    {
--- a/config/deployer-gas-routes.json
+++ b/config/deployer-gas-routes.json
@@ -1,6 +1,17 @@
 {
  "description": "Chain-to-method mapping for deployer gas auto-route: swap/bridge ERC-20 to native gas per chain. Used by scripts/deployment/deployer-gas-auto-route.sh.",
  "deployerAddress": "0x4A666F96fC8764181194447A7dFdb7d471b301C8",
+  "nonEvmNetworks": [
+    {
+      "identifier": "Solana",
+      "vmKind": "SVM",
+      "nativeSymbol": "SOL",
+      "method": "manual",
+      "caip2": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
+      "manualInstructions": "Acquire SOL for Solana mainnet-beta gas and fund the assigned Solana deployer / relay signer when the Solana rollout wave is opened. This entry is planning-only; deployer-gas-auto-route.sh currently processes only the EIP-155 .chains array.",
+      "note": "Desired non-EVM deployment network for future GRU / cW-style mirrored assets via a bridge-wrapped or SPL-native representation."
+    }
+  ],
  "chains": [
    {
      "chainId": 138,
@@ -8,10 +19,10 @@
      "nativeSymbol": "ETH",
      "thresholdEther": "0.006",
      "method": "internal",
-      "tokenAggregationBaseUrl": "https://dbis-api.d-bis.org/api/v1",
+      "tokenAggregationBaseUrl": "https://explorer.d-bis.org/token-aggregation/api/v1",
      "tokenAggregationFallbackUrl": "http://192.168.11.140:3001",
-      "dodoPmmIntegration": "0x79cdbaFBaA0FdF9F55D26F360F54cddE5c743F7D",
-      "poolCusdtCusdc": "0x9fcB06Aa1FD5215DC0E91Fd098aeff4B62fEa5C8",
+      "dodoPmmIntegration": "0x86ADA6Ef91A3B450F89f2b751e93B1b7A3218895",
+      "poolCusdtCusdc": "0x9e89bAe009adf128782E19e8341996c596ac40dC",
      "cusdt": "0x93E66202A11B1772E55407B32B44e5Cd8eda7f22",
      "cusdc": "0xf22258f57794CC8E06237084b353Ab30fFfa640b",
      "weth9": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2",
--- a/config/flash_candidates-chain138.json
+++ b/config/flash_candidates-chain138.json
--- a/config/generated-node-configs/config-1505.toml
+++ b/config/generated-node-configs/config-1505.toml
@@ -8,21 +8,20 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.213"
 p2p-port=30303
-max-peers=32
+max-peers=40
 discovery-enabled=true

 # RPC
 rpc-http-enabled=true
 rpc-http-host="0.0.0.0"
 rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-api=["ETH","NET","WEB3"]
 rpc-http-cors-origins=["*"]
-rpc-http-api-enable-unsafe-txsigning=true

 rpc-ws-enabled=true
 rpc-ws-host="0.0.0.0"
 rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-ws-api=["ETH","NET","WEB3"]

 # GraphQL
 graphql-http-enabled=true
--- a/config/generated-node-configs/config-1506.toml
+++ b/config/generated-node-configs/config-1506.toml
@@ -8,21 +8,20 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.214"
 p2p-port=30303
-max-peers=32
+max-peers=40
 discovery-enabled=true

 # RPC
 rpc-http-enabled=true
 rpc-http-host="0.0.0.0"
 rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-api=["ETH","NET","WEB3"]
 rpc-http-cors-origins=["*"]
-rpc-http-api-enable-unsafe-txsigning=true

 rpc-ws-enabled=true
 rpc-ws-host="0.0.0.0"
 rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-ws-api=["ETH","NET","WEB3"]

 # GraphQL
 graphql-http-enabled=true
--- a/config/generated-node-configs/config-1507.toml
+++ b/config/generated-node-configs/config-1507.toml
@@ -8,21 +8,20 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.244"
 p2p-port=30303
-max-peers=32
+max-peers=40
 discovery-enabled=true

 # RPC
 rpc-http-enabled=true
 rpc-http-host="0.0.0.0"
 rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-api=["ETH","NET","WEB3"]
 rpc-http-cors-origins=["*"]
-rpc-http-api-enable-unsafe-txsigning=true

 rpc-ws-enabled=true
 rpc-ws-host="0.0.0.0"
 rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-ws-api=["ETH","NET","WEB3"]

 # GraphQL
 graphql-http-enabled=true
--- a/config/generated-node-configs/config-1508.toml
+++ b/config/generated-node-configs/config-1508.toml
@@ -8,21 +8,20 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.245"
 p2p-port=30303
-max-peers=32
+max-peers=40
 discovery-enabled=true

 # RPC
 rpc-http-enabled=true
 rpc-http-host="0.0.0.0"
 rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-api=["ETH","NET","WEB3"]
 rpc-http-cors-origins=["*"]
-rpc-http-api-enable-unsafe-txsigning=true

 rpc-ws-enabled=true
 rpc-ws-host="0.0.0.0"
 rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-ws-api=["ETH","NET","WEB3"]

 # GraphQL
 graphql-http-enabled=true
--- a/config/generated-node-configs/config-2500.toml
+++ b/config/generated-node-configs/config-2500.toml
@@ -1,5 +1,5 @@
-# Besu Configuration for besu-rpc-alltra-1 (VMID: 2500)
-# Type: Full Function RPC Node
+# Besu Configuration for besu-rpc-alltra-1 (legacy filename, live VMID: 2420)
+# Type: Permissioned / Private RPC Node
 # Generated: Fri Jan 23 22:33:18 PST 2026

 data-path="/data/besu"
@@ -9,21 +9,20 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.172"
 p2p-port=30303
-max-peers=32
+max-peers=40
 discovery-enabled=true

-# RPC - Full Function (can deploy contracts, execute writes)
+# RPC - Permissioned / private (no ADMIN)
 rpc-http-enabled=true
 rpc-http-host="0.0.0.0"
 rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-api=["ETH","NET","WEB3","TXPOOL","QBFT","DEBUG","TRACE"]
 rpc-http-cors-origins=["*"]
-rpc-http-api-enable-unsafe-txsigning=true

 rpc-ws-enabled=true
 rpc-ws-host="0.0.0.0"
 rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-ws-api=["ETH","NET","WEB3","TXPOOL","QBFT"]

 # GraphQL
 graphql-http-enabled=true
--- a/config/generated-node-configs/config-2501.toml
+++ b/config/generated-node-configs/config-2501.toml
@@ -1,5 +1,5 @@
-# Besu Configuration for besu-rpc-alltra-2 (VMID: 2501)
-# Type: Standard Base RPC Node (Read-only, Public Services)
+# Besu Configuration for besu-rpc-alltra-2 (legacy filename, live VMID: 2430)
+# Type: Permissioned / Private RPC Node
 # Generated: Fri Jan 23 22:33:18 PST 2026

 data-path="/data/besu"
@@ -9,14 +9,14 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.173"
 p2p-port=30303
-max-peers=32
+max-peers=40
 discovery-enabled=true

-# RPC - Standard Base (read-only, no admin APIs)
+# RPC - Permissioned / private (no ADMIN)
 rpc-http-enabled=true
 rpc-http-host="0.0.0.0"
 rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3"]
+rpc-http-api=["ETH","NET","WEB3","TXPOOL","QBFT","DEBUG","TRACE"]
 rpc-http-cors-origins=["*"]
 # NO unsafe tx signing
 # NO ADMIN/PERSONAL/MINER/DEBUG APIs
@@ -24,7 +24,7 @@ rpc-http-cors-origins=["*"]
 rpc-ws-enabled=true
 rpc-ws-host="0.0.0.0"
 rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3"]
+rpc-ws-api=["ETH","NET","WEB3","TXPOOL","QBFT"]

 # GraphQL
 graphql-http-enabled=true
--- a/config/generated-node-configs/config-2502.toml
+++ b/config/generated-node-configs/config-2502.toml
@@ -1,5 +1,5 @@
-# Besu Configuration for besu-rpc-alltra-3 (VMID: 2502)
-# Type: Standard Base RPC Node (Read-only, Public Services)
+# Besu Configuration for besu-rpc-alltra-3 (legacy filename, live VMID: 2440)
+# Type: Permissioned / Private RPC Node
 # Generated: Fri Jan 23 22:33:18 PST 2026

 data-path="/data/besu"
@@ -9,14 +9,14 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.174"
 p2p-port=30303
-max-peers=32
+max-peers=40
 discovery-enabled=true

-# RPC - Standard Base (read-only, no admin APIs)
+# RPC - Permissioned / private (no ADMIN)
 rpc-http-enabled=true
 rpc-http-host="0.0.0.0"
 rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3"]
+rpc-http-api=["ETH","NET","WEB3","TXPOOL","QBFT","DEBUG","TRACE"]
 rpc-http-cors-origins=["*"]
 # NO unsafe tx signing
 # NO ADMIN/PERSONAL/MINER/DEBUG APIs
@@ -24,7 +24,7 @@ rpc-http-cors-origins=["*"]
 rpc-ws-enabled=true
 rpc-ws-host="0.0.0.0"
 rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3"]
+rpc-ws-api=["ETH","NET","WEB3","TXPOOL","QBFT"]

 # GraphQL
 graphql-http-enabled=true
--- a/config/generated-node-configs/config-2503.toml
+++ b/config/generated-node-configs/config-2503.toml
@@ -1,5 +1,5 @@
-# Besu Configuration for besu-rpc-hybx-1 (VMID: 2503)
-# Type: Full Function RPC Node
+# Besu Configuration for besu-rpc-hybx-1 (legacy filename, live VMID: 2460)
+# Type: Permissioned / Private RPC Node
 # Generated: Fri Jan 23 22:33:18 PST 2026

 data-path="/data/besu"
@@ -9,21 +9,20 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.246"
 p2p-port=30303
-max-peers=32
+max-peers=40
 discovery-enabled=true

-# RPC - Full Function (can deploy contracts, execute writes)
+# RPC - Permissioned / private (no ADMIN)
 rpc-http-enabled=true
 rpc-http-host="0.0.0.0"
 rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-http-api=["ETH","NET","WEB3","TXPOOL","QBFT","DEBUG","TRACE"]
 rpc-http-cors-origins=["*"]
-rpc-http-api-enable-unsafe-txsigning=true

 rpc-ws-enabled=true
 rpc-ws-host="0.0.0.0"
 rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3","ADMIN","PERSONAL","MINER","DEBUG"]
+rpc-ws-api=["ETH","NET","WEB3","TXPOOL","QBFT"]

 # GraphQL
 graphql-http-enabled=true
--- a/config/generated-node-configs/config-2504.toml
+++ b/config/generated-node-configs/config-2504.toml
@@ -1,5 +1,5 @@
-# Besu Configuration for besu-rpc-hybx-2 (VMID: 2504)
-# Type: Standard Base RPC Node (Read-only, Public Services)
+# Besu Configuration for besu-rpc-hybx-2 (legacy filename, live VMID: 2470)
+# Type: Permissioned / Private RPC Node
 # Generated: Fri Jan 23 22:33:18 PST 2026

 data-path="/data/besu"
@@ -9,14 +9,14 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.247"
 p2p-port=30303
-max-peers=32
+max-peers=40
 discovery-enabled=true

-# RPC - Standard Base (read-only, no admin APIs)
+# RPC - Permissioned / private (no ADMIN)
 rpc-http-enabled=true
 rpc-http-host="0.0.0.0"
 rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3"]
+rpc-http-api=["ETH","NET","WEB3","TXPOOL","QBFT","DEBUG","TRACE"]
 rpc-http-cors-origins=["*"]
 # NO unsafe tx signing
 # NO ADMIN/PERSONAL/MINER/DEBUG APIs
@@ -24,7 +24,7 @@ rpc-http-cors-origins=["*"]
 rpc-ws-enabled=true
 rpc-ws-host="0.0.0.0"
 rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3"]
+rpc-ws-api=["ETH","NET","WEB3","TXPOOL","QBFT"]

 # GraphQL
 graphql-http-enabled=true
--- a/config/generated-node-configs/config-2505.toml
+++ b/config/generated-node-configs/config-2505.toml
@@ -1,5 +1,5 @@
-# Besu Configuration for besu-rpc-hybx-3 (VMID: 2505)
-# Type: Standard Base RPC Node (Read-only, Public Services)
+# Besu Configuration for besu-rpc-hybx-3 (legacy filename, live VMID: 2480)
+# Type: Permissioned / Private RPC Node
 # Generated: Fri Jan 23 22:33:18 PST 2026

 data-path="/data/besu"
@@ -9,14 +9,14 @@ genesis-file=""
 network-id=138
 p2p-host="192.168.11.248"
 p2p-port=30303
-max-peers=32
+max-peers=40
 discovery-enabled=true

-# RPC - Standard Base (read-only, no admin APIs)
+# RPC - Permissioned / private (no ADMIN)
 rpc-http-enabled=true
 rpc-http-host="0.0.0.0"
 rpc-http-port=8545
-rpc-http-api=["ETH","NET","WEB3"]
+rpc-http-api=["ETH","NET","WEB3","TXPOOL","QBFT","DEBUG","TRACE"]
 rpc-http-cors-origins=["*"]
 # NO unsafe tx signing
 # NO ADMIN/PERSONAL/MINER/DEBUG APIs
@@ -24,7 +24,7 @@ rpc-http-cors-origins=["*"]
 rpc-ws-enabled=true
 rpc-ws-host="0.0.0.0"
 rpc-ws-port=8546
-rpc-ws-api=["ETH","NET","WEB3"]
+rpc-ws-api=["ETH","NET","WEB3","TXPOOL","QBFT"]

 # GraphQL
 graphql-http-enabled=true
--- a/config/gru-global-priority-currency-rollout.json
+++ b/config/gru-global-priority-currency-rollout.json
@@ -0,0 +1,706 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "name": "GRU Global Priority Cross-Chain Rollout",
+  "version": "1.0.0",
+  "updated": "2026-04-03",
+  "canonicalChainId": 138,
+  "desiredDestinationNetworks": {
+    "evmPublicCwMeshChainIds": [
+      1,
+      10,
+      25,
+      56,
+      100,
+      137,
+      42161,
+      42220,
+      43114,
+      8453,
+      1111
+    ],
+    "altEvmPrograms": [
+      {
+        "chainId": 651940,
+        "name": "ALL Mainnet (Alltra)",
+        "classification": "custom_alt_bridge",
+        "status": "live"
+      },
+      {
+        "chainId": 42793,
+        "name": "Etherlink",
+        "classification": "feature_gated_evm_target",
+        "status": "planned"
+      }
+    ],
+    "nonEvmRelayPrograms": [
+      {
+        "identifier": "Solana",
+        "vmKind": "SVM",
+        "classification": "desired_non_evm_target",
+        "status": "planned_relay_dependent",
+        "notes": "Track under token-mapping-multichain.json -> nonEvmNetworks. Requires an SPL or bridge-wrapped cW representation before live GRU transport can be enabled."
+      }
+    ],
+    "notes": [
+      "The default mirrored-asset rollout surface remains the public EVM cW mesh.",
+      "ALL Mainnet and Etherlink are separate bridge programs, not rows in the default EVM cW pool mesh.",
+      "Truth and Tron remain separate adapter programs rather than default GRU cW rollout targets."
+    ]
+  },
+  "notes": "Planning queue for globally important fiat, commodity, and monetary-unit assets that may be onboarded into GRU as canonical c* on Chain 138 and mirrored cW* on destination chains. This file does not itself activate support; live support is still controlled by gru-iso4217-currency-manifest.json, gru-transport-active.json, and deployed cW addresses in token-mapping-multichain.json.",
+  "symbolConvention": {
+    "defaultFiatPrimaryForm": "coin",
+    "defaultFiatCanonicalPattern": "c<ISO>C",
+    "defaultFiatWrappedPattern": "cW<ISO>C",
+    "defaultCommodityPrimaryForm": "coin",
+    "defaultCommodityCanonicalPattern": "c<CODE>C",
+    "defaultCommodityWrappedPattern": "cW<CODE>C",
+    "dualFormExceptions": [
+      "USD",
+      "EUR",
+      "GBP",
+      "XAU"
+    ],
+    "assumptions": [
+      "Currencies without a live or canonical token form default to a coin-style c<ISO>C symbol until governance chooses a paired token form.",
+      "USD keeps the existing dual cUSDC/cUSDT pattern, and EUR/GBP/XAU keep their current dual-form conventions.",
+      "Meta-units such as XDR and XAG are modeled as governance-approved monetary units using the same c*/cW* naming discipline."
+    ]
+  },
+  "waves": [
+    {
+      "id": "wave0",
+      "name": "Live GRU Transport Baseline",
+      "goal": "Keep the current USD transport and x402 path healthy while GRU v2 promotion continues."
+    },
+    {
+      "id": "wave1",
+      "name": "Promote Existing Canonical Chain 138 Assets",
+      "goal": "Finish cW deployment, reserve wiring, and transport activation for the already-deployed non-USD GRU assets on Chain 138."
+    },
+    {
+      "id": "wave2",
+      "name": "Add Remaining Tier 1-3 Fiat Corridors",
+      "goal": "Deploy new canonical c* assets on Chain 138 for the next highest-priority globally important fiat currencies, then mirror them as cW*."
+    },
+    {
+      "id": "wave3",
+      "name": "Add Tier 4 and Meta-Unit Coverage",
+      "goal": "Extend the corridor set to secondary emerging currencies plus monetary-unit references such as XDR and XAG."
+    }
+  ],
+  "assets": [
+    {
+      "code": "USD",
+      "name": "US Dollar",
+      "category": "fiat",
+      "tier": "Tier 1",
+      "rank": 1,
+      "wave": "wave0",
+      "repoTargetState": "live_transport",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cUSDC",
+          "wrappedSymbol": "cWUSDC"
+        },
+        {
+          "form": "token",
+          "canonicalSymbol": "cUSDT",
+          "wrappedSymbol": "cWUSDT"
+        }
+      ]
+    },
+    {
+      "code": "EUR",
+      "name": "Euro",
+      "category": "fiat",
+      "tier": "Tier 1",
+      "rank": 2,
+      "wave": "wave1",
+      "repoTargetState": "canonical_then_transport",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cEURC",
+          "wrappedSymbol": "cWEURC"
+        },
+        {
+          "form": "token",
+          "canonicalSymbol": "cEURT",
+          "wrappedSymbol": "cWEURT"
+        }
+      ]
+    },
+    {
+      "code": "JPY",
+      "name": "Japanese Yen",
+      "category": "fiat",
+      "tier": "Tier 1",
+      "rank": 3,
+      "wave": "wave1",
+      "repoTargetState": "canonical_then_transport",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cJPYC",
+          "wrappedSymbol": "cWJPYC"
+        }
+      ]
+    },
+    {
+      "code": "GBP",
+      "name": "Pound Sterling",
+      "category": "fiat",
+      "tier": "Tier 1",
+      "rank": 4,
+      "wave": "wave1",
+      "repoTargetState": "canonical_then_transport",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cGBPC",
+          "wrappedSymbol": "cWGBPC"
+        },
+        {
+          "form": "token",
+          "canonicalSymbol": "cGBPT",
+          "wrappedSymbol": "cWGBPT"
+        }
+      ]
+    },
+    {
+      "code": "CNY",
+      "name": "Chinese Yuan (Renminbi)",
+      "category": "fiat",
+      "tier": "Tier 1",
+      "rank": 5,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cCNYC",
+          "wrappedSymbol": "cWCNYC"
+        }
+      ]
+    },
+    {
+      "code": "AUD",
+      "name": "Australian Dollar",
+      "category": "fiat",
+      "tier": "Tier 2",
+      "rank": 6,
+      "wave": "wave1",
+      "repoTargetState": "canonical_then_transport",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cAUDC",
+          "wrappedSymbol": "cWAUDC"
+        }
+      ]
+    },
+    {
+      "code": "CAD",
+      "name": "Canadian Dollar",
+      "category": "fiat",
+      "tier": "Tier 2",
+      "rank": 7,
+      "wave": "wave1",
+      "repoTargetState": "canonical_then_transport",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cCADC",
+          "wrappedSymbol": "cWCADC"
+        }
+      ]
+    },
+    {
+      "code": "CHF",
+      "name": "Swiss Franc",
+      "category": "fiat",
+      "tier": "Tier 2",
+      "rank": 8,
+      "wave": "wave1",
+      "repoTargetState": "canonical_then_transport",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cCHFC",
+          "wrappedSymbol": "cWCHFC"
+        }
+      ]
+    },
+    {
+      "code": "HKD",
+      "name": "Hong Kong Dollar",
+      "category": "fiat",
+      "tier": "Tier 2",
+      "rank": 9,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cHKDC",
+          "wrappedSymbol": "cWHKDC"
+        }
+      ]
+    },
+    {
+      "code": "SGD",
+      "name": "Singapore Dollar",
+      "category": "fiat",
+      "tier": "Tier 2",
+      "rank": 10,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cSGDC",
+          "wrappedSymbol": "cWSGDC"
+        }
+      ]
+    },
+    {
+      "code": "SEK",
+      "name": "Swedish Krona",
+      "category": "fiat",
+      "tier": "Tier 2",
+      "rank": 11,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cSEKC",
+          "wrappedSymbol": "cWSEKC"
+        }
+      ]
+    },
+    {
+      "code": "KRW",
+      "name": "South Korean Won",
+      "category": "fiat",
+      "tier": "Tier 2",
+      "rank": 12,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cKRWC",
+          "wrappedSymbol": "cWKRWC"
+        }
+      ]
+    },
+    {
+      "code": "NOK",
+      "name": "Norwegian Krone",
+      "category": "fiat",
+      "tier": "Tier 2",
+      "rank": 13,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cNOKC",
+          "wrappedSymbol": "cWNOKC"
+        }
+      ]
+    },
+    {
+      "code": "NZD",
+      "name": "New Zealand Dollar",
+      "category": "fiat",
+      "tier": "Tier 2",
+      "rank": 14,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cNZDC",
+          "wrappedSymbol": "cWNZDC"
+        }
+      ]
+    },
+    {
+      "code": "INR",
+      "name": "Indian Rupee",
+      "category": "fiat",
+      "tier": "Tier 3",
+      "rank": 15,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cINRC",
+          "wrappedSymbol": "cWINRC"
+        }
+      ]
+    },
+    {
+      "code": "MXN",
+      "name": "Mexican Peso",
+      "category": "fiat",
+      "tier": "Tier 3",
+      "rank": 16,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cMXNC",
+          "wrappedSymbol": "cWMXNC"
+        }
+      ]
+    },
+    {
+      "code": "BRL",
+      "name": "Brazilian Real",
+      "category": "fiat",
+      "tier": "Tier 3",
+      "rank": 17,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cBRLC",
+          "wrappedSymbol": "cWBRLC"
+        }
+      ]
+    },
+    {
+      "code": "ZAR",
+      "name": "South African Rand",
+      "category": "fiat",
+      "tier": "Tier 3",
+      "rank": 18,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cZARC",
+          "wrappedSymbol": "cWZARC"
+        }
+      ]
+    },
+    {
+      "code": "TRY",
+      "name": "Turkish Lira",
+      "category": "fiat",
+      "tier": "Tier 3",
+      "rank": 19,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cTRYC",
+          "wrappedSymbol": "cWTRYC"
+        }
+      ]
+    },
+    {
+      "code": "AED",
+      "name": "UAE Dirham",
+      "category": "fiat",
+      "tier": "Tier 3",
+      "rank": 20,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cAEDC",
+          "wrappedSymbol": "cWAEDC"
+        }
+      ]
+    },
+    {
+      "code": "SAR",
+      "name": "Saudi Riyal",
+      "category": "fiat",
+      "tier": "Tier 3",
+      "rank": 21,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cSARC",
+          "wrappedSymbol": "cWSARC"
+        }
+      ]
+    },
+    {
+      "code": "PLN",
+      "name": "Polish Zloty",
+      "category": "fiat",
+      "tier": "Tier 3",
+      "rank": 22,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cPLNC",
+          "wrappedSymbol": "cWPLNC"
+        }
+      ]
+    },
+    {
+      "code": "THB",
+      "name": "Thai Baht",
+      "category": "fiat",
+      "tier": "Tier 3",
+      "rank": 23,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cTHBC",
+          "wrappedSymbol": "cWTHBC"
+        }
+      ]
+    },
+    {
+      "code": "IDR",
+      "name": "Indonesian Rupiah",
+      "category": "fiat",
+      "tier": "Tier 3",
+      "rank": 24,
+      "wave": "wave2",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cIDRC",
+          "wrappedSymbol": "cWIDRC"
+        }
+      ]
+    },
+    {
+      "code": "MYR",
+      "name": "Malaysian Ringgit",
+      "category": "fiat",
+      "tier": "Tier 4",
+      "rank": 25,
+      "wave": "wave3",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cMYRC",
+          "wrappedSymbol": "cWMYRC"
+        }
+      ]
+    },
+    {
+      "code": "PHP",
+      "name": "Philippine Peso",
+      "category": "fiat",
+      "tier": "Tier 4",
+      "rank": 26,
+      "wave": "wave3",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cPHPC",
+          "wrappedSymbol": "cWPHPC"
+        }
+      ]
+    },
+    {
+      "code": "VND",
+      "name": "Vietnamese Dong",
+      "category": "fiat",
+      "tier": "Tier 4",
+      "rank": 27,
+      "wave": "wave3",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cVNDC",
+          "wrappedSymbol": "cWVNDC"
+        }
+      ]
+    },
+    {
+      "code": "EGP",
+      "name": "Egyptian Pound",
+      "category": "fiat",
+      "tier": "Tier 4",
+      "rank": 28,
+      "wave": "wave3",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cEGPC",
+          "wrappedSymbol": "cWEGPC"
+        }
+      ]
+    },
+    {
+      "code": "CLP",
+      "name": "Chilean Peso",
+      "category": "fiat",
+      "tier": "Tier 4",
+      "rank": 29,
+      "wave": "wave3",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cCLPC",
+          "wrappedSymbol": "cWCLPC"
+        }
+      ]
+    },
+    {
+      "code": "COP",
+      "name": "Colombian Peso",
+      "category": "fiat",
+      "tier": "Tier 4",
+      "rank": 30,
+      "wave": "wave3",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cCOPC",
+          "wrappedSymbol": "cWCOPC"
+        }
+      ]
+    },
+    {
+      "code": "PKR",
+      "name": "Pakistani Rupee",
+      "category": "fiat",
+      "tier": "Tier 4",
+      "rank": 31,
+      "wave": "wave3",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cPKRC",
+          "wrappedSymbol": "cWPKRC"
+        }
+      ]
+    },
+    {
+      "code": "BDT",
+      "name": "Bangladeshi Taka",
+      "category": "fiat",
+      "tier": "Tier 4",
+      "rank": 32,
+      "wave": "wave3",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cBDTC",
+          "wrappedSymbol": "cWBDTC"
+        }
+      ]
+    },
+    {
+      "code": "KES",
+      "name": "Kenyan Shilling",
+      "category": "fiat",
+      "tier": "Tier 4",
+      "rank": 33,
+      "wave": "wave3",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cKESC",
+          "wrappedSymbol": "cWKESC"
+        }
+      ]
+    },
+    {
+      "code": "NGN",
+      "name": "Nigerian Naira",
+      "category": "fiat",
+      "tier": "Tier 4",
+      "rank": 34,
+      "wave": "wave3",
+      "repoTargetState": "new_currency_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cNGNC",
+          "wrappedSymbol": "cWNGNC"
+        }
+      ]
+    },
+    {
+      "code": "XDR",
+      "name": "IMF Special Drawing Rights",
+      "category": "monetary_unit",
+      "tier": "Special",
+      "rank": 35,
+      "wave": "wave3",
+      "repoTargetState": "meta_unit_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cXDRC",
+          "wrappedSymbol": "cWXDRC"
+        }
+      ]
+    },
+    {
+      "code": "XAU",
+      "name": "Gold",
+      "category": "commodity",
+      "tier": "Special",
+      "rank": 36,
+      "wave": "wave1",
+      "repoTargetState": "canonical_then_transport",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cXAUC",
+          "wrappedSymbol": "cWXAUC"
+        },
+        {
+          "form": "token",
+          "canonicalSymbol": "cXAUT",
+          "wrappedSymbol": "cWXAUT"
+        }
+      ]
+    },
+    {
+      "code": "XAG",
+      "name": "Silver",
+      "category": "commodity",
+      "tier": "Special",
+      "rank": 37,
+      "wave": "wave3",
+      "repoTargetState": "meta_unit_rollout",
+      "tokenForms": [
+        {
+          "form": "coin",
+          "canonicalSymbol": "cXAGC",
+          "wrappedSymbol": "cWXAGC"
+        }
+      ]
+    }
+  ]
+}
--- a/config/gru-iso4217-currency-manifest.json
+++ b/config/gru-iso4217-currency-manifest.json
@@ -2,18 +2,19 @@
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "name": "GRU ISO-4217 Currency Manifest",
  "version": "1.0.0",
-  "updated": "2026-03-31",
+  "updated": "2026-04-07",
  "canonicalChainId": 138,
  "standardsProfileRef": "config/gru-standards-profile.json",
  "coverage": {
    "appliesToCurrentAndFutureCurrencies": true,
    "targetUniverse": [
      "all ISO-4217 fiat currencies adopted into GRU",
-      "governance-approved commodities and additional monetary units"
+      "governance-approved commodities and additional monetary units",
+      "designator-specific ecosystem extensions such as Alltra/AUSDT and D-WIN/USDW that settle into canonical Chain 138 c* assets"
    ],
    "transportMethodology": "Chain 138 canonical c* with mirrored cW* transport on compatible public chains"
  },
-  "notes": "Canonical GRU-supported ISO-4217 and commodity currency set for c* and cW* onboarding, routing, explorer metadata, and FX integration. This is the machine-readable source of truth for supported currencies, token families, lifecycle state, and canonical logo assignment.",
+  "notes": "Canonical GRU-supported ISO-4217 and commodity currency set for c* and cW* onboarding, routing, explorer metadata, and FX integration. This is the machine-readable source of truth for supported currencies, token families, lifecycle state, canonical logo assignment, and USD ecosystem extensions that land on Chain 138 as c* assets.",
  "currencies": [
    {
      "code": "USD",
@@ -30,23 +31,86 @@
        "coin": {
          "symbol": "cUSDC",
          "v1Address": "0xf22258f57794CC8E06237084b353Ab30fFfa640b",
-          "v2Address": "0x1ac3F4942a71E86A9682D91837E1E71b7BACdF99",
+          "v2Address": "0x219522c60e83dEe01FC5b0329d6fA8fD84b9D13d",
          "activeVersion": "v1",
+          "canonicalForwardVersion": "v2",
+          "canonicalForwardAddress": "0x219522c60e83dEe01FC5b0329d6fA8fD84b9D13d",
+          "liquidityActiveVersion": "v1",
+          "transportActiveVersion": "v1",
          "x402PreferredVersion": "v2",
-          "logoURI": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cUSDC.svg"
+          "logoURI": "https://explorer.d-bis.org/token-icons/cUSDC.png"
        },
        "token": {
          "symbol": "cUSDT",
          "v1Address": "0x93E66202A11B1772E55407B32B44e5Cd8eda7f22",
-          "v2Address": "0x8d342d321DdEe97D0c5011DAF8ca0B59DA617D29",
+          "v2Address": "0x9FBfab33882Efe0038DAa608185718b772EE5660",
          "activeVersion": "v1",
+          "canonicalForwardVersion": "v2",
+          "canonicalForwardAddress": "0x9FBfab33882Efe0038DAa608185718b772EE5660",
+          "liquidityActiveVersion": "v1",
+          "transportActiveVersion": "v1",
          "x402PreferredVersion": "v2",
-          "logoURI": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cUSDT.svg"
+          "logoURI": "https://explorer.d-bis.org/token-icons/cUSDT.png"
        }
      },
      "wrappedAssets": {
        "coin": "cWUSDC",
        "token": "cWUSDT"
+      },
+      "ecosystemExtensions": {
+        "alltra": {
+          "originNetwork": {
+            "chainId": 651940,
+            "name": "ALL Mainnet (Alltra)",
+            "originSymbol": "AUSDT"
+          },
+          "canonicalAsset": {
+            "symbol": "cAUSDT",
+            "address": "0x5fdDF65733e3d590463F68f93Cf16E8c04081271",
+            "activeVersion": "v1",
+            "transportMethodology": "AUSDT originates on ALL Mainnet, may mirror through public-chain cWAUSDT, and lands canonically on Chain 138 as cAUSDT."
+          },
+          "wrappedAsset": {
+            "symbol": "cWAUSDT",
+            "status": "live_selected_public_chains"
+          },
+          "status": {
+            "planned": true,
+            "deployed": true,
+            "transportActive": true,
+            "x402Ready": false
+          }
+        },
+        "dwin": {
+          "originNetworks": [
+            {
+              "chainId": 56,
+              "name": "BSC (BNB Chain)",
+              "originSymbol": "USDW"
+            },
+            {
+              "chainId": 137,
+              "name": "Polygon",
+              "originSymbol": "USDW"
+            }
+          ],
+          "canonicalAsset": {
+            "symbol": "cUSDW",
+            "address": "0xcA6BFa614935f1AB71c9aB106bAA6FBB6057095e",
+            "activeVersion": "v1",
+            "transportMethodology": "Native public USD DWIN locks into cWUSDW on supported public chains and bridges against the Chain 138 cUSDW hub asset."
+          },
+          "wrappedAsset": {
+            "symbol": "cWUSDW",
+            "status": "partial_transport"
+          },
+          "status": {
+            "planned": true,
+            "deployed": true,
+            "transportActive": false,
+            "x402Ready": false
+          }
+        }
      }
    },
    {
@@ -58,17 +122,29 @@
        "planned": true,
        "deployed": true,
        "transportActive": false,
-        "x402Ready": false
+        "x402Ready": true
      },
      "canonicalAssets": {
        "coin": {
          "symbol": "cEURC",
-          "address": "0x8085961F9cF02b4d800A3c6d386D31da4B34266a",
+          "address": "0x243e6581Dc8a98d98B92265858b322b193555C81",
+          "v1Address": "0x8085961F9cF02b4d800A3c6d386D31da4B34266a",
+          "v2Address": "0x243e6581Dc8a98d98B92265858b322b193555C81",
+          "activeVersion": "v2",
+          "canonicalForwardVersion": "v2",
+          "canonicalForwardAddress": "0x243e6581Dc8a98d98B92265858b322b193555C81",
+          "x402PreferredVersion": "v2",
          "logoURI": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cEURC.svg"
        },
        "token": {
          "symbol": "cEURT",
-          "address": "0xdf4b71c61E5912712C1Bdd451416B9aC26949d72",
+          "address": "0x2bAFA83d8fF8BaE9505511998987D0659791605B",
+          "v1Address": "0xdf4b71c61E5912712C1Bdd451416B9aC26949d72",
+          "v2Address": "0x2bAFA83d8fF8BaE9505511998987D0659791605B",
+          "activeVersion": "v2",
+          "canonicalForwardVersion": "v2",
+          "canonicalForwardAddress": "0x2bAFA83d8fF8BaE9505511998987D0659791605B",
+          "x402PreferredVersion": "v2",
          "logoURI": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cEURT.svg"
        }
      },
@@ -86,17 +162,29 @@
        "planned": true,
        "deployed": true,
        "transportActive": false,
-        "x402Ready": false
+        "x402Ready": true
      },
      "canonicalAssets": {
        "coin": {
          "symbol": "cGBPC",
-          "address": "0x003960f16D9d34F2e98d62723B6721Fb92074aD2",
+          "address": "0x707508D223103f5D2d9EFBc656302c9d48878b29",
+          "v1Address": "0x003960f16D9d34F2e98d62723B6721Fb92074aD2",
+          "v2Address": "0x707508D223103f5D2d9EFBc656302c9d48878b29",
+          "activeVersion": "v2",
+          "canonicalForwardVersion": "v2",
+          "canonicalForwardAddress": "0x707508D223103f5D2d9EFBc656302c9d48878b29",
+          "x402PreferredVersion": "v2",
          "logoURI": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cGBPC.svg"
        },
        "token": {
          "symbol": "cGBPT",
-          "address": "0x350f54e4D23795f86A9c03988c7135357CCaD97c",
+          "address": "0xee17c18E10E55ce23F7457D018aAa2Fb1E64B281",
+          "v1Address": "0x350f54e4D23795f86A9c03988c7135357CCaD97c",
+          "v2Address": "0xee17c18E10E55ce23F7457D018aAa2Fb1E64B281",
+          "activeVersion": "v2",
+          "canonicalForwardVersion": "v2",
+          "canonicalForwardAddress": "0xee17c18E10E55ce23F7457D018aAa2Fb1E64B281",
+          "x402PreferredVersion": "v2",
          "logoURI": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cGBPT.svg"
        }
      },
@@ -114,12 +202,18 @@
        "planned": true,
        "deployed": true,
        "transportActive": false,
-        "x402Ready": false
+        "x402Ready": true
      },
      "canonicalAssets": {
        "coin": {
          "symbol": "cAUDC",
-          "address": "0xD51482e567c03899eecE3CAe8a058161FD56069D",
+          "address": "0xfb37aFd415B70C5cEDc9bA58a72D517207b769Bb",
+          "v1Address": "0xD51482e567c03899eecE3CAe8a058161FD56069D",
+          "v2Address": "0xfb37aFd415B70C5cEDc9bA58a72D517207b769Bb",
+          "activeVersion": "v2",
+          "canonicalForwardVersion": "v2",
+          "canonicalForwardAddress": "0xfb37aFd415B70C5cEDc9bA58a72D517207b769Bb",
+          "x402PreferredVersion": "v2",
          "logoURI": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cAUDC.svg"
        }
      },
@@ -136,12 +230,18 @@
        "planned": true,
        "deployed": true,
        "transportActive": false,
-        "x402Ready": false
+        "x402Ready": true
      },
      "canonicalAssets": {
        "coin": {
          "symbol": "cJPYC",
-          "address": "0xEe269e1226a334182aace90056EE4ee5Cc8A6770",
+          "address": "0x2c751bBE4f299b989b3A8c333E0A966cdcA6Fd98",
+          "v1Address": "0xEe269e1226a334182aace90056EE4ee5Cc8A6770",
+          "v2Address": "0x2c751bBE4f299b989b3A8c333E0A966cdcA6Fd98",
+          "activeVersion": "v2",
+          "canonicalForwardVersion": "v2",
+          "canonicalForwardAddress": "0x2c751bBE4f299b989b3A8c333E0A966cdcA6Fd98",
+          "x402PreferredVersion": "v2",
          "logoURI": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cJPYC.svg"
        }
      },
@@ -158,12 +258,18 @@
        "planned": true,
        "deployed": true,
        "transportActive": false,
-        "x402Ready": false
+        "x402Ready": true
      },
      "canonicalAssets": {
        "coin": {
          "symbol": "cCHFC",
-          "address": "0x873990849DDa5117d7C644f0aF24370797C03885",
+          "address": "0x60B7FB8e0DD0Be8595AD12Fe80AE832861Be747c",
+          "v1Address": "0x873990849DDa5117d7C644f0aF24370797C03885",
+          "v2Address": "0x60B7FB8e0DD0Be8595AD12Fe80AE832861Be747c",
+          "activeVersion": "v2",
+          "canonicalForwardVersion": "v2",
+          "canonicalForwardAddress": "0x60B7FB8e0DD0Be8595AD12Fe80AE832861Be747c",
+          "x402PreferredVersion": "v2",
          "logoURI": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cCHFC.svg"
        }
      },
@@ -180,12 +286,18 @@
        "planned": true,
        "deployed": true,
        "transportActive": false,
-        "x402Ready": false
+        "x402Ready": true
      },
      "canonicalAssets": {
        "coin": {
          "symbol": "cCADC",
-          "address": "0x54dBd40cF05e15906A2C21f600937e96787f5679",
+          "address": "0xe799033c87fE0CE316DAECcefBE3134CC74b76a9",
+          "v1Address": "0x54dBd40cF05e15906A2C21f600937e96787f5679",
+          "v2Address": "0xe799033c87fE0CE316DAECcefBE3134CC74b76a9",
+          "activeVersion": "v2",
+          "canonicalForwardVersion": "v2",
+          "canonicalForwardAddress": "0xe799033c87fE0CE316DAECcefBE3134CC74b76a9",
+          "x402PreferredVersion": "v2",
          "logoURI": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cCADC.svg"
        }
      },
@@ -203,18 +315,30 @@
        "planned": true,
        "deployed": true,
        "transportActive": false,
-        "x402Ready": false
+        "x402Ready": true
      },
      "canonicalAssets": {
        "coin": {
          "symbol": "cXAUC",
-          "address": "0x290E52a8819A4fbD0714E517225429aA2B70EC6b",
-          "logoURI": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cXAUC.svg"
+          "address": "0xF0F0F81bE3D033D8586bAfd2293e37eE2f615647",
+          "v1Address": "0x290E52a8819A4fbD0714E517225429aA2B70EC6b",
+          "v2Address": "0xF0F0F81bE3D033D8586bAfd2293e37eE2f615647",
+          "activeVersion": "v2",
+          "canonicalForwardVersion": "v2",
+          "canonicalForwardAddress": "0xF0F0F81bE3D033D8586bAfd2293e37eE2f615647",
+          "x402PreferredVersion": "v2",
+          "logoURI": "https://explorer.d-bis.org/token-icons/cXAUC.png"
        },
        "token": {
          "symbol": "cXAUT",
-          "address": "0x94e408E26c6FD8F4ee00b54dF19082FDA07dC96E",
-          "logoURI": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cXAUT.svg"
+          "address": "0x89477E982847023aaB5C3492082cd1bB4b1b9Ef1",
+          "v1Address": "0x94e408E26c6FD8F4ee00b54dF19082FDA07dC96E",
+          "v2Address": "0x89477E982847023aaB5C3492082cd1bB4b1b9Ef1",
+          "activeVersion": "v2",
+          "canonicalForwardVersion": "v2",
+          "canonicalForwardAddress": "0x89477E982847023aaB5C3492082cd1bB4b1b9Ef1",
+          "x402PreferredVersion": "v2",
+          "logoURI": "https://explorer.d-bis.org/token-icons/cXAUT.png"
        }
      },
      "wrappedAssets": {
--- a/config/gru-monetary-unit-manifest.json
+++ b/config/gru-monetary-unit-manifest.json
@@ -0,0 +1,207 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "name": "GRU Monetary Unit Manifest",
+  "version": "1.0.0",
+  "updated": "2026-04-07",
+  "canonicalChainId": 138,
+  "notes": "Machine-readable manifest for governance-approved GRU monetary units and gas-native transport families that are outside the ISO-4217 fiat/commodity manifest. These assets retain the c*/cW* naming discipline but are tracked through parallel registry families.",
+  "gasNativeFamilies": [
+    {
+      "code": "ETH",
+      "familyKey": "eth_mainnet",
+      "type": "gas_native",
+      "canonicalSymbol": "cETH",
+      "wrappedSymbol": "cWETH",
+      "mappingKey": "Compliant_ETH_MAINNET_cW",
+      "registryFamily": "gas_native",
+      "assetClass": "gas_native",
+      "backingMode": "strict_escrow",
+      "canonicalAddress": "0xf8e9802a1766422e33a269556ad5fc032338eefc",
+      "ui": {
+        "displayName": "Ethereum Mainnet Gas (Compliant)",
+        "wrappedDisplayName": "Ethereum Mainnet Gas (Compliant Wrapped)"
+      }
+    },
+    {
+      "code": "ETH",
+      "familyKey": "eth_l2",
+      "type": "gas_native",
+      "canonicalSymbol": "cETHL2",
+      "wrappedSymbol": "cWETHL2",
+      "mappingKey": "Compliant_ETH_L2_cW",
+      "registryFamily": "gas_native",
+      "assetClass": "gas_native",
+      "backingMode": "hybrid_cap",
+      "canonicalAddress": "0x18a6b163d255cc0cb32b99697843b487d059907d",
+      "ui": {
+        "displayName": "Ethereum L2 Gas (Compliant)",
+        "wrappedDisplayName": "Ethereum L2 Gas (Compliant Wrapped)"
+      }
+    },
+    {
+      "code": "BNB",
+      "familyKey": "bnb",
+      "type": "gas_native",
+      "canonicalSymbol": "cBNB",
+      "wrappedSymbol": "cWBNB",
+      "mappingKey": "Compliant_BNB_cW",
+      "registryFamily": "gas_native",
+      "assetClass": "gas_native",
+      "backingMode": "hybrid_cap",
+      "canonicalAddress": "0x94517875f32680984a5921da7abf78e22f65d70f",
+      "ui": {
+        "displayName": "BNB Gas (Compliant)",
+        "wrappedDisplayName": "BNB Gas (Compliant Wrapped)"
+      }
+    },
+    {
+      "code": "POL",
+      "familyKey": "pol",
+      "type": "gas_native",
+      "canonicalSymbol": "cPOL",
+      "wrappedSymbol": "cWPOL",
+      "mappingKey": "Compliant_POL_cW",
+      "registryFamily": "gas_native",
+      "assetClass": "gas_native",
+      "backingMode": "hybrid_cap",
+      "canonicalAddress": "0x19fec21edede9edb91d1fbec7c4095c5ac1fc10c",
+      "ui": {
+        "displayName": "Polygon Gas (Compliant)",
+        "wrappedDisplayName": "Polygon Gas (Compliant Wrapped)"
+      }
+    },
+    {
+      "code": "AVAX",
+      "familyKey": "avax",
+      "type": "gas_native",
+      "canonicalSymbol": "cAVAX",
+      "wrappedSymbol": "cWAVAX",
+      "mappingKey": "Compliant_AVAX_cW",
+      "registryFamily": "gas_native",
+      "assetClass": "gas_native",
+      "backingMode": "hybrid_cap",
+      "canonicalAddress": "0x9c8f6f4fe1e535e6f85a78ee95249ded5540a2d0",
+      "ui": {
+        "displayName": "Avalanche Gas (Compliant)",
+        "wrappedDisplayName": "Avalanche Gas (Compliant Wrapped)"
+      }
+    },
+    {
+      "code": "CRO",
+      "familyKey": "cro",
+      "type": "gas_native",
+      "canonicalSymbol": "cCRO",
+      "wrappedSymbol": "cWCRO",
+      "mappingKey": "Compliant_CRO_cW",
+      "registryFamily": "gas_native",
+      "assetClass": "gas_native",
+      "backingMode": "hybrid_cap",
+      "canonicalAddress": "0xfb48bb6c623571f9795b535b73f0d660e8643fd4",
+      "ui": {
+        "displayName": "Cronos Gas (Compliant)",
+        "wrappedDisplayName": "Cronos Gas (Compliant Wrapped)"
+      }
+    },
+    {
+      "code": "XDAI",
+      "familyKey": "xdai",
+      "type": "gas_native",
+      "canonicalSymbol": "cXDAI",
+      "wrappedSymbol": "cWXDAI",
+      "mappingKey": "Compliant_XDAI_cW",
+      "registryFamily": "gas_native",
+      "assetClass": "gas_native",
+      "backingMode": "hybrid_cap",
+      "canonicalAddress": "0xa39a59138f8a45b4a31455875b8a29ff31e76ec8",
+      "ui": {
+        "displayName": "xDAI Gas (Compliant)",
+        "wrappedDisplayName": "xDAI Gas (Compliant Wrapped)"
+      }
+    },
+    {
+      "code": "CELO",
+      "familyKey": "celo",
+      "type": "gas_native",
+      "canonicalSymbol": "cCELO",
+      "wrappedSymbol": "cWCELO",
+      "mappingKey": "Compliant_CELO_cW",
+      "registryFamily": "gas_native",
+      "assetClass": "gas_native",
+      "backingMode": "hybrid_cap",
+      "canonicalAddress": "0x1814661dae0933bf397b1274f5a62411b94195c7",
+      "ui": {
+        "displayName": "Celo Gas (Compliant)",
+        "wrappedDisplayName": "Celo Gas (Compliant Wrapped)"
+      }
+    },
+    {
+      "code": "WEMIX",
+      "familyKey": "wemix",
+      "type": "gas_native",
+      "canonicalSymbol": "cWEMIX",
+      "wrappedSymbol": "cWWEMIX",
+      "mappingKey": "Compliant_WEMIX_cW",
+      "registryFamily": "gas_native",
+      "assetClass": "gas_native",
+      "backingMode": "hybrid_cap",
+      "canonicalAddress": "0x4d82206bec5b4dfa17759ffede07e35f4f63a050",
+      "ui": {
+        "displayName": "WEMIX Hub Gas (Compliant)",
+        "wrappedDisplayName": "WEMIX Gas (Compliant Wrapped)"
+      }
+    }
+  ],
+  "monetaryUnits": [
+    {
+      "code": "BTC",
+      "type": "monetary_unit",
+      "canonicalSymbol": "cBTC",
+      "wrappedSymbol": "cWBTC",
+      "mappingKey": "Compliant_BTC_cW",
+      "registryFamily": "monetary_unit",
+      "assetType": "GRU",
+      "decimals": 8,
+      "custodyModel": "native_btc_attested_reserve",
+      "mintPolicy": {
+        "confirmationThreshold": 6,
+        "freezeOnReserveDeficit": true,
+        "freezeOnReconciliationFailure": true,
+        "freezeOnOutstandingLimitBreach": true
+      },
+      "launchChains": [
+        1,
+        10,
+        25,
+        56,
+        100,
+        137,
+        42161,
+        42220,
+        43114,
+        8453
+      ],
+      "stagedChains": [
+        1111
+      ],
+      "canonicalAddress": "0xcb7c000000000000000000000000000000000138",
+      "wrappedAddresses": {
+        "1": "0xcb7c000000000000000000000000000000000001",
+        "10": "0xcb7c00000000000000000000000000000000000a",
+        "25": "0xcb7c000000000000000000000000000000000019",
+        "56": "0xcb7c000000000000000000000000000000000038",
+        "100": "0xcb7c000000000000000000000000000000000064",
+        "137": "0xcb7c000000000000000000000000000000000089",
+        "1111": "0xcb7c000000000000000000000000000000000457",
+        "8453": "0xcb7c000000000000000000000000000000002105",
+        "42161": "0xcb7c00000000000000000000000000000000a4b1",
+        "42220": "0xcb7c00000000000000000000000000000000a4ec",
+        "43114": "0xcb7c00000000000000000000000000000000a86a"
+      },
+      "ui": {
+        "displayName": "Bitcoin (Compliant)",
+        "wrappedDisplayName": "Bitcoin (Compliant Wrapped)",
+        "publicWarning": "cWBTC is the GRU transport representation of Chain 138 cBTC and is distinct from Ethereum WBTC."
+      }
+    }
+  ]
+}
--- a/config/gru-standards-profile.json
+++ b/config/gru-standards-profile.json
@@ -3,17 +3,19 @@
  "name": "GRU Standards Profile",
  "profileId": "gru-c-star-v2-transport-and-payment",
  "version": "1.0.0",
-  "updated": "2026-03-31",
+  "updated": "2026-04-07",
  "canonicalChainId": 138,
-  "notes": "Machine-readable standards profile for canonical c* V2 money on Chain 138, mirrored cW* public-chain transport, x402 payment capability, ISO-4217 coverage, and GRU governance/policy enforcement.",
+  "notes": "Machine-readable standards profile for canonical c* V2 money on Chain 138, mirrored cW* public-chain transport, x402 payment capability, ISO-4217 coverage, USD ecosystem extensions such as AUSDT/USDW, gas-native GRU transport families, and GRU governance/policy enforcement.",
  "references": {
    "transportOverlay": "config/gru-transport-active.json",
    "currencyManifest": "config/gru-iso4217-currency-manifest.json",
+    "monetaryUnitManifest": "config/gru-monetary-unit-manifest.json",
    "governanceSupervisionProfile": "config/gru-governance-supervision-profile.json",
    "standardsMatrixDoc": "docs/04-configuration/GRU_C_STAR_V2_STANDARDS_MATRIX_AND_IMPLEMENTATION_PLAN.md",
    "storageGovernanceDoc": "docs/04-configuration/GRU_STORAGE_GOVERNANCE_AND_SUPERVISION_STANDARD.md",
    "x402SupportDoc": "docs/04-configuration/CHAIN138_X402_TOKEN_SUPPORT.md",
-    "fxOnboardingDoc": "docs/04-configuration/GRU_FX_CURRENCY_ONBOARDING_CHECKLIST.md"
+    "fxOnboardingDoc": "docs/04-configuration/GRU_FX_CURRENCY_ONBOARDING_CHECKLIST.md",
+    "tokenCategoriesDoc": "docs/11-references/TOKEN_CATEGORIES_CANONICAL.md"
  },
  "scope": {
    "canonicalAssetPrefix": "c",
@@ -21,7 +23,9 @@
    "canonicalMethodology": "Chain 138 is the canonical monetary layer for c*. Compatible public chains use mirrored cW* transport assets via lock on 138 and mint on destination.",
    "targetCurrencyCoverage": [
      "all ISO-4217 fiat currencies adopted into the GRU currency manifest",
-      "governance-approved commodities and additional monetary units beyond ISO-4217"
+      "governance-approved commodities and additional monetary units beyond ISO-4217",
+      "USD ecosystem extensions that settle as canonical Chain 138 c* assets",
+      "gas-native GRU transport families tracked outside the ISO-4217 currency manifest"
    ],
    "compatibilityBoundary": [
      "token mapping exists in config/token-mapping-multichain.json",
@@ -194,6 +198,20 @@
    "activeCanonicalCurrencyCodes": [
      "USD"
    ],
+    "activeUsdExtensions": [
+      "cAUSDT"
+    ],
+    "gasNativeFamiliesTracked": [
+      "eth_mainnet",
+      "eth_l2",
+      "bnb",
+      "pol",
+      "avax",
+      "cro",
+      "xdai",
+      "celo",
+      "wemix"
+    ],
    "transportOverlayRef": "config/gru-transport-active.json"
  }
 }
--- a/config/gru-transport-active.json
+++ b/config/gru-transport-active.json
--- a/config/gru-v2-chain138-wave1-v2-plan.json
+++ b/config/gru-v2-chain138-wave1-v2-plan.json
@@ -0,0 +1,148 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "name": "GRU V2 Chain 138 Wave 1 Deployment Plan",
+  "version": "1.0.0",
+  "updated": "2026-04-07",
+  "canonicalChainId": 138,
+  "notes": [
+    "Wave 1 assets were already canonically deployed on Chain 138 as legacy GRU assets and now also have generic GRU V2 deployments for the full V2/x402-capable token base.",
+    "Broadcast execution completed on April 7, 2026. This file now captures both the legacy canonical addresses and the newly deployed V2 addresses."
+  ],
+  "assets": [
+    {
+      "code": "EUR",
+      "deployments": [
+        {
+          "tokenName": "Euro Coin (Compliant V2)",
+          "tokenSymbol": "cEURC",
+          "currencyCode": "EUR",
+          "metadataKey": "ceurc-v2",
+          "registryName": "Euro Coin (Compliant V2)",
+          "registrySymbol": "cEURC.v2",
+          "currentCanonicalAddress": "0x8085961F9cF02b4d800A3c6d386D31da4B34266a",
+          "deployedV2Address": "0x243e6581Dc8a98d98B92265858b322b193555C81"
+        },
+        {
+          "tokenName": "Euro Token (Compliant V2)",
+          "tokenSymbol": "cEURT",
+          "currencyCode": "EUR",
+          "metadataKey": "ceurt-v2",
+          "registryName": "Euro Token (Compliant V2)",
+          "registrySymbol": "cEURT.v2",
+          "currentCanonicalAddress": "0xdf4b71c61E5912712C1Bdd451416B9aC26949d72",
+          "deployedV2Address": "0x2bAFA83d8fF8BaE9505511998987D0659791605B"
+        }
+      ]
+    },
+    {
+      "code": "GBP",
+      "deployments": [
+        {
+          "tokenName": "Pound Sterling Coin (Compliant V2)",
+          "tokenSymbol": "cGBPC",
+          "currencyCode": "GBP",
+          "metadataKey": "cgbpc-v2",
+          "registryName": "Pound Sterling Coin (Compliant V2)",
+          "registrySymbol": "cGBPC.v2",
+          "currentCanonicalAddress": "0x003960f16D9d34F2e98d62723B6721Fb92074aD2",
+          "deployedV2Address": "0x707508D223103f5D2d9EFBc656302c9d48878b29"
+        },
+        {
+          "tokenName": "Pound Sterling Token (Compliant V2)",
+          "tokenSymbol": "cGBPT",
+          "currencyCode": "GBP",
+          "metadataKey": "cgbpt-v2",
+          "registryName": "Pound Sterling Token (Compliant V2)",
+          "registrySymbol": "cGBPT.v2",
+          "currentCanonicalAddress": "0x350f54e4D23795f86A9c03988c7135357CCaD97c",
+          "deployedV2Address": "0xee17c18E10E55ce23F7457D018aAa2Fb1E64B281"
+        }
+      ]
+    },
+    {
+      "code": "AUD",
+      "deployments": [
+        {
+          "tokenName": "Australian Dollar Coin (Compliant V2)",
+          "tokenSymbol": "cAUDC",
+          "currencyCode": "AUD",
+          "metadataKey": "caudc-v2",
+          "registryName": "Australian Dollar Coin (Compliant V2)",
+          "registrySymbol": "cAUDC.v2",
+          "currentCanonicalAddress": "0xD51482e567c03899eecE3CAe8a058161FD56069D",
+          "deployedV2Address": "0xfb37aFd415B70C5cEDc9bA58a72D517207b769Bb"
+        }
+      ]
+    },
+    {
+      "code": "JPY",
+      "deployments": [
+        {
+          "tokenName": "Japanese Yen Coin (Compliant V2)",
+          "tokenSymbol": "cJPYC",
+          "currencyCode": "JPY",
+          "metadataKey": "cjpyc-v2",
+          "registryName": "Japanese Yen Coin (Compliant V2)",
+          "registrySymbol": "cJPYC.v2",
+          "currentCanonicalAddress": "0xEe269e1226a334182aace90056EE4ee5Cc8A6770",
+          "deployedV2Address": "0x2c751bBE4f299b989b3A8c333E0A966cdcA6Fd98"
+        }
+      ]
+    },
+    {
+      "code": "CHF",
+      "deployments": [
+        {
+          "tokenName": "Swiss Franc Coin (Compliant V2)",
+          "tokenSymbol": "cCHFC",
+          "currencyCode": "CHF",
+          "metadataKey": "cchfc-v2",
+          "registryName": "Swiss Franc Coin (Compliant V2)",
+          "registrySymbol": "cCHFC.v2",
+          "currentCanonicalAddress": "0x873990849DDa5117d7C644f0aF24370797C03885",
+          "deployedV2Address": "0x60B7FB8e0DD0Be8595AD12Fe80AE832861Be747c"
+        }
+      ]
+    },
+    {
+      "code": "CAD",
+      "deployments": [
+        {
+          "tokenName": "Canadian Dollar Coin (Compliant V2)",
+          "tokenSymbol": "cCADC",
+          "currencyCode": "CAD",
+          "metadataKey": "ccadc-v2",
+          "registryName": "Canadian Dollar Coin (Compliant V2)",
+          "registrySymbol": "cCADC.v2",
+          "currentCanonicalAddress": "0x54dBd40cF05e15906A2C21f600937e96787f5679",
+          "deployedV2Address": "0xe799033c87fE0CE316DAECcefBE3134CC74b76a9"
+        }
+      ]
+    },
+    {
+      "code": "XAU",
+      "deployments": [
+        {
+          "tokenName": "Gold Coin (Compliant V2)",
+          "tokenSymbol": "cXAUC",
+          "currencyCode": "XAU",
+          "metadataKey": "cxauc-v2",
+          "registryName": "Gold Coin (Compliant V2)",
+          "registrySymbol": "cXAUC.v2",
+          "currentCanonicalAddress": "0x290E52a8819A4fbD0714E517225429aA2B70EC6b",
+          "deployedV2Address": "0xF0F0F81bE3D033D8586bAfd2293e37eE2f615647"
+        },
+        {
+          "tokenName": "Gold Token (Compliant V2)",
+          "tokenSymbol": "cXAUT",
+          "currencyCode": "XAU",
+          "metadataKey": "cxaut-v2",
+          "registryName": "Gold Token (Compliant V2)",
+          "registrySymbol": "cXAUT.v2",
+          "currentCanonicalAddress": "0x94e408E26c6FD8F4ee00b54dF19082FDA07dC96E",
+          "deployedV2Address": "0x89477E982847023aaB5C3492082cd1bB4b1b9Ef1"
+        }
+      ]
+    }
+  ]
+}
--- a/config/gru-v2-d3mm-network-expansion-plan.json
+++ b/config/gru-v2-d3mm-network-expansion-plan.json
@@ -0,0 +1,141 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "name": "GRU V2 / D3MM Public EVM Expansion Plan",
+  "version": "1.0.0",
+  "updated": "2026-04-07",
+  "notes": [
+    "This plan defines rollout order and expected next actions. It is not proof that D3MM or GRU v2 public liquidity is already live on every listed chain.",
+    "Chain 138 remains the canonical D3MM pilot/private venue until the upstream-native public expansion is completed chain-by-chain.",
+    "Mainnet expansion should coexist with the current DODO PMM public rows first, then migrate traffic only after execution, monitoring, and policy gates pass."
+  ],
+  "waves": [
+    {
+      "key": "wave0_mainnet_hardening",
+      "priority": 0,
+      "description": "Keep Mainnet as the first public-chain control point while D3MM and GRU v2 public edges become execution-grade.",
+      "chains": [
+        {
+          "chainId": 1,
+          "name": "Ethereum Mainnet",
+          "targetProtocols": ["dodo_pmm", "dodo_v3_d3mm", "uniswap_v3", "one_inch"],
+          "rolloutMode": "coexist_then_promote",
+          "requiredPairs": ["cWUSDT/USDC", "cWUSDC/USDC", "cWUSDT/USDT", "cWUSDC/USDT"],
+          "successCriteria": [
+            "current public DODO PMM rows remain healthy",
+            "D3MM venue inventory is frozen and published",
+            "execution-grade routing is proven for approved lanes",
+            "bot and peg-monitor surfaces remain green"
+          ]
+        }
+      ]
+    },
+    {
+      "key": "wave1_existing_public_depth",
+      "priority": 1,
+      "description": "Chains that already have first-tier public PMM depth should receive D3MM/edge promotion and route visibility next.",
+      "chains": [
+        {
+          "chainId": 137,
+          "name": "Polygon",
+          "targetProtocols": ["dodo_pmm", "dodo_v3_d3mm", "uniswap_v3", "one_inch"],
+          "rolloutMode": "promote_existing_pairs",
+          "requiredPairs": ["cWUSDT/USDT", "cWUSDC/USDC"],
+          "successCriteria": [
+            "existing first-tier public PMM rows stay funded",
+            "route-matrix visibility is attached",
+            "token-aggregation exposes the chain publicly",
+            "D3MM edge decision is recorded"
+          ]
+        },
+        {
+          "chainId": 10,
+          "name": "Optimism",
+          "targetProtocols": ["dodo_pmm", "dodo_v3_d3mm", "uniswap_v3", "one_inch"],
+          "rolloutMode": "promote_existing_pairs",
+          "requiredPairs": ["cWUSDT/USDT", "cWUSDC/USDC"],
+          "successCriteria": [
+            "existing first-tier public PMM rows stay funded",
+            "route-matrix visibility is attached",
+            "token-aggregation exposes the chain publicly",
+            "D3MM edge decision is recorded"
+          ]
+        }
+      ]
+    },
+    {
+      "key": "wave2_l2_bootstrap",
+      "priority": 2,
+      "description": "Bootstrap first-tier public PMM depth on the highest-leverage L2s before broader EVM rollout.",
+      "chains": [
+        {
+          "chainId": 42161,
+          "name": "Arbitrum One",
+          "targetProtocols": ["dodo_pmm", "dodo_v3_d3mm", "uniswap_v3", "one_inch"],
+          "rolloutMode": "deploy_first_tier_then_promote",
+          "requiredPairs": ["cWUSDT/USDC", "cWUSDC/USDC"],
+          "successCriteria": [
+            "hub stable anchor is recorded in deployment-status",
+            "first-tier public PMM rows are deployed and seeded",
+            "route visibility is enabled",
+            "Mainnet-hub bootstrap blockers are cleared"
+          ]
+        },
+        {
+          "chainId": 8453,
+          "name": "Base",
+          "targetProtocols": ["dodo_pmm", "dodo_v3_d3mm", "uniswap_v3", "one_inch"],
+          "rolloutMode": "deploy_first_tier_then_promote",
+          "requiredPairs": ["cWUSDT/USDC", "cWUSDC/USDC"],
+          "successCriteria": [
+            "hub stable anchor is recorded in deployment-status",
+            "first-tier public PMM rows are deployed and seeded",
+            "route visibility is enabled",
+            "public D3MM policy is recorded"
+          ]
+        }
+      ]
+    },
+    {
+      "key": "wave3_secondary_public_evm",
+      "priority": 3,
+      "description": "Secondary public EVM expansion after Mainnet, Polygon, Optimism, Arbitrum, and Base are stable.",
+      "chains": [
+        {
+          "chainId": 43114,
+          "name": "Avalanche C-Chain",
+          "targetProtocols": ["dodo_pmm", "dodo_v3_d3mm", "uniswap_v3", "one_inch"],
+          "rolloutMode": "deploy_first_tier_then_promote",
+          "requiredPairs": ["cWUSDT/USDC", "cWUSDC/USDC"]
+        },
+        {
+          "chainId": 100,
+          "name": "Gnosis",
+          "targetProtocols": ["dodo_pmm", "dodo_v3_d3mm", "uniswap_v3", "one_inch"],
+          "rolloutMode": "deploy_first_tier_then_promote",
+          "requiredPairs": ["cWUSDT/USDC", "cWUSDC/USDC"]
+        },
+        {
+          "chainId": 56,
+          "name": "BSC",
+          "targetProtocols": ["dodo_pmm", "dodo_v3_d3mm", "uniswap_v3", "one_inch"],
+          "rolloutMode": "deploy_first_tier_then_promote",
+          "requiredPairs": ["cWUSDT/USDT", "cWUSDC/USDT"]
+        },
+        {
+          "chainId": 25,
+          "name": "Cronos",
+          "targetProtocols": ["dodo_pmm", "dodo_v3_d3mm", "uniswap_v3", "one_inch"],
+          "rolloutMode": "deploy_first_tier_then_promote",
+          "requiredPairs": ["cWUSDT/USDT", "cWUSDC/USDC"]
+        },
+        {
+          "chainId": 42220,
+          "name": "Celo",
+          "targetProtocols": ["dodo_pmm", "dodo_v3_d3mm", "uniswap_v3", "one_inch"],
+          "rolloutMode": "deploy_first_tier_then_promote",
+          "requiredPairs": ["cWUSDT/USDC", "cWUSDC/USDC"]
+        }
+      ]
+    }
+  ]
+}
--- a/config/gru-v2-first-tier-pool-scaffolds.json
+++ b/config/gru-v2-first-tier-pool-scaffolds.json
@@ -0,0 +1,214 @@
+{
+  "version": 1,
+  "asOfDate": "2026-04-07",
+  "purpose": "Canonical scaffold inventory for missing first-tier GRU v2 / D3MM public PMM pools.",
+  "generatedFrom": [
+    "config/gru-v2-d3mm-network-expansion-plan.json",
+    "cross-chain-pmm-lps/config/deployment-status.json",
+    "cross-chain-pmm-lps/config/pool-matrix.json"
+  ],
+  "summary": {
+    "chainsWithScaffolds": 6,
+    "scaffoldPoolCount": 12
+  },
+  "chains": [
+    {
+      "chainId": 8453,
+      "name": "Base",
+      "waveKey": "wave2_l2_bootstrap",
+      "priority": 2,
+      "rolloutMode": "deploy_first_tier_then_promote",
+      "hubStable": "USDC",
+      "bridgeAvailable": true,
+      "scaffoldPools": [
+        {
+          "pair": "cWUSDT/USDC",
+          "base": "cWUSDT",
+          "quote": "USDC",
+          "poolAddress": "0x0000000000000000000000000000000000000000",
+          "feeBps": 3,
+          "k": "500000000000000000",
+          "role": "public_routing",
+          "publicRoutingEnabled": false,
+          "notes": "scaffold only; replace poolAddress and enable routing after live deploy + seed"
+        },
+        {
+          "pair": "cWUSDC/USDC",
+          "base": "cWUSDC",
+          "quote": "USDC",
+          "poolAddress": "0x0000000000000000000000000000000000000000",
+          "feeBps": 3,
+          "k": "500000000000000000",
+          "role": "public_routing",
+          "publicRoutingEnabled": false,
+          "notes": "scaffold only; replace poolAddress and enable routing after live deploy + seed"
+        }
+      ]
+    },
+    {
+      "chainId": 42161,
+      "name": "Arbitrum One",
+      "waveKey": "wave2_l2_bootstrap",
+      "priority": 2,
+      "rolloutMode": "deploy_first_tier_then_promote",
+      "hubStable": "USDC",
+      "bridgeAvailable": true,
+      "scaffoldPools": [
+        {
+          "pair": "cWUSDT/USDC",
+          "base": "cWUSDT",
+          "quote": "USDC",
+          "poolAddress": "0x0000000000000000000000000000000000000000",
+          "feeBps": 3,
+          "k": "500000000000000000",
+          "role": "public_routing",
+          "publicRoutingEnabled": false,
+          "notes": "scaffold only; replace poolAddress and enable routing after live deploy + seed"
+        },
+        {
+          "pair": "cWUSDC/USDC",
+          "base": "cWUSDC",
+          "quote": "USDC",
+          "poolAddress": "0x0000000000000000000000000000000000000000",
+          "feeBps": 3,
+          "k": "500000000000000000",
+          "role": "public_routing",
+          "publicRoutingEnabled": false,
+          "notes": "scaffold only; replace poolAddress and enable routing after live deploy + seed"
+        }
+      ]
+    },
+    {
+      "chainId": 56,
+      "name": "BSC",
+      "waveKey": "wave3_secondary_public_evm",
+      "priority": 3,
+      "rolloutMode": "deploy_first_tier_then_promote",
+      "hubStable": "USDT",
+      "bridgeAvailable": true,
+      "scaffoldPools": [
+        {
+          "pair": "cWUSDT/USDT",
+          "base": "cWUSDT",
+          "quote": "USDT",
+          "poolAddress": "0x0000000000000000000000000000000000000000",
+          "feeBps": 3,
+          "k": "500000000000000000",
+          "role": "public_routing",
+          "publicRoutingEnabled": false,
+          "notes": "scaffold only; replace poolAddress and enable routing after live deploy + seed"
+        },
+        {
+          "pair": "cWUSDC/USDT",
+          "base": "cWUSDC",
+          "quote": "USDT",
+          "poolAddress": "0x0000000000000000000000000000000000000000",
+          "feeBps": 3,
+          "k": "500000000000000000",
+          "role": "public_routing",
+          "publicRoutingEnabled": false,
+          "notes": "scaffold only; replace poolAddress and enable routing after live deploy + seed"
+        }
+      ]
+    },
+    {
+      "chainId": 100,
+      "name": "Gnosis",
+      "waveKey": "wave3_secondary_public_evm",
+      "priority": 3,
+      "rolloutMode": "deploy_first_tier_then_promote",
+      "hubStable": "USDC",
+      "bridgeAvailable": true,
+      "scaffoldPools": [
+        {
+          "pair": "cWUSDT/USDC",
+          "base": "cWUSDT",
+          "quote": "USDC",
+          "poolAddress": "0x0000000000000000000000000000000000000000",
+          "feeBps": 3,
+          "k": "500000000000000000",
+          "role": "public_routing",
+          "publicRoutingEnabled": false,
+          "notes": "scaffold only; replace poolAddress and enable routing after live deploy + seed"
+        },
+        {
+          "pair": "cWUSDC/USDC",
+          "base": "cWUSDC",
+          "quote": "USDC",
+          "poolAddress": "0x0000000000000000000000000000000000000000",
+          "feeBps": 3,
+          "k": "500000000000000000",
+          "role": "public_routing",
+          "publicRoutingEnabled": false,
+          "notes": "scaffold only; replace poolAddress and enable routing after live deploy + seed"
+        }
+      ]
+    },
+    {
+      "chainId": 42220,
+      "name": "Celo",
+      "waveKey": "wave3_secondary_public_evm",
+      "priority": 3,
+      "rolloutMode": "deploy_first_tier_then_promote",
+      "hubStable": "USDC",
+      "bridgeAvailable": true,
+      "scaffoldPools": [
+        {
+          "pair": "cWUSDT/USDC",
+          "base": "cWUSDT",
+          "quote": "USDC",
+          "poolAddress": "0x0000000000000000000000000000000000000000",
+          "feeBps": 3,
+          "k": "500000000000000000",
+          "role": "public_routing",
+          "publicRoutingEnabled": false,
+          "notes": "scaffold only; replace poolAddress and enable routing after live deploy + seed"
+        },
+        {
+          "pair": "cWUSDC/USDC",
+          "base": "cWUSDC",
+          "quote": "USDC",
+          "poolAddress": "0x0000000000000000000000000000000000000000",
+          "feeBps": 3,
+          "k": "500000000000000000",
+          "role": "public_routing",
+          "publicRoutingEnabled": false,
+          "notes": "scaffold only; replace poolAddress and enable routing after live deploy + seed"
+        }
+      ]
+    },
+    {
+      "chainId": 43114,
+      "name": "Avalanche C-Chain",
+      "waveKey": "wave3_secondary_public_evm",
+      "priority": 3,
+      "rolloutMode": "deploy_first_tier_then_promote",
+      "hubStable": "USDC",
+      "bridgeAvailable": true,
+      "scaffoldPools": [
+        {
+          "pair": "cWUSDT/USDC",
+          "base": "cWUSDT",
+          "quote": "USDC",
+          "poolAddress": "0x0000000000000000000000000000000000000000",
+          "feeBps": 3,
+          "k": "500000000000000000",
+          "role": "public_routing",
+          "publicRoutingEnabled": false,
+          "notes": "scaffold only; replace poolAddress and enable routing after live deploy + seed"
+        },
+        {
+          "pair": "cWUSDC/USDC",
+          "base": "cWUSDC",
+          "quote": "USDC",
+          "poolAddress": "0x0000000000000000000000000000000000000000",
+          "feeBps": 3,
+          "k": "500000000000000000",
+          "role": "public_routing",
+          "publicRoutingEnabled": false,
+          "notes": "scaffold only; replace poolAddress and enable routing after live deploy + seed"
+        }
+      ]
+    }
+  ]
+}
--- a/config/gru-v2-metadata/chain138/caudc-v2/metadata.json
+++ b/config/gru-v2-metadata/chain138/caudc-v2/metadata.json
@@ -0,0 +1,21 @@
+{
+  "name": "Australian Dollar Coin (Compliant V2)",
+  "symbol": "cAUDC",
+  "description": "GRU v2 regulated AUD settlement asset for Chain 138 with ISO-20022-aligned accounting metadata and x402-capable signature support.",
+  "decimals": 6,
+  "logo": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cAUDC.svg",
+  "image": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cAUDC.svg",
+  "external_url": "https://explorer.d-bis.org",
+  "properties": {
+    "chainId": 138,
+    "currencyCode": "AUD",
+    "gruVersion": "2",
+    "assetFamily": "GRU",
+    "tokenRole": "gru_compliant_base",
+    "forwardCanonical": true,
+    "iso20022Ready": true,
+    "x402Ready": true,
+    "assetId": "keccak256:GRU:cAUDC",
+    "assetVersionId": "keccak256:GRU:cAUDC:2"
+  }
+}
--- a/config/gru-v2-metadata/chain138/caudc-v2/regulatory-disclosure.json
+++ b/config/gru-v2-metadata/chain138/caudc-v2/regulatory-disclosure.json
@@ -0,0 +1,12 @@
+{
+  "title": "cAUDC V2 Regulatory Disclosure",
+  "symbol": "cAUDC",
+  "gruVersion": "2",
+  "chainId": 138,
+  "jurisdiction": "International",
+  "notice": "This disclosure record is the contract-linked GRU v2 placeholder for regulated AUD settlement operations on Chain 138.",
+  "references": [
+    "https://explorer.d-bis.org",
+    "https://info.defi-oracle.io"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/caudc-v2/reporting.json
+++ b/config/gru-v2-metadata/chain138/caudc-v2/reporting.json
@@ -0,0 +1,11 @@
+{
+  "title": "cAUDC V2 Reporting Manifest",
+  "symbol": "cAUDC",
+  "gruVersion": "2",
+  "chainId": 138,
+  "reportingSchema": "dbis-gru-v2-reporting/1.0",
+  "notes": "Reporting URI placeholder for GRU v2 AUD rollout on Chain 138 with ISO-20022 / IPSAS evidence linkage.",
+  "sources": [
+    "https://explorer.d-bis.org/api/v1/report/token-list?chainId=138"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/ccadc-v2/metadata.json
+++ b/config/gru-v2-metadata/chain138/ccadc-v2/metadata.json
@@ -0,0 +1,21 @@
+{
+  "name": "Canadian Dollar Coin (Compliant V2)",
+  "symbol": "cCADC",
+  "description": "GRU v2 regulated CAD settlement asset for Chain 138 with ISO-20022-aligned accounting metadata and x402-capable signature support.",
+  "decimals": 6,
+  "logo": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cCADC.svg",
+  "image": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cCADC.svg",
+  "external_url": "https://explorer.d-bis.org",
+  "properties": {
+    "chainId": 138,
+    "currencyCode": "CAD",
+    "gruVersion": "2",
+    "assetFamily": "GRU",
+    "tokenRole": "gru_compliant_base",
+    "forwardCanonical": true,
+    "iso20022Ready": true,
+    "x402Ready": true,
+    "assetId": "keccak256:GRU:cCADC",
+    "assetVersionId": "keccak256:GRU:cCADC:2"
+  }
+}
--- a/config/gru-v2-metadata/chain138/ccadc-v2/regulatory-disclosure.json
+++ b/config/gru-v2-metadata/chain138/ccadc-v2/regulatory-disclosure.json
@@ -0,0 +1,12 @@
+{
+  "title": "cCADC V2 Regulatory Disclosure",
+  "symbol": "cCADC",
+  "gruVersion": "2",
+  "chainId": 138,
+  "jurisdiction": "International",
+  "notice": "This disclosure record is the contract-linked GRU v2 placeholder for regulated CAD settlement operations on Chain 138.",
+  "references": [
+    "https://explorer.d-bis.org",
+    "https://info.defi-oracle.io"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/ccadc-v2/reporting.json
+++ b/config/gru-v2-metadata/chain138/ccadc-v2/reporting.json
@@ -0,0 +1,11 @@
+{
+  "title": "cCADC V2 Reporting Manifest",
+  "symbol": "cCADC",
+  "gruVersion": "2",
+  "chainId": 138,
+  "reportingSchema": "dbis-gru-v2-reporting/1.0",
+  "notes": "Reporting URI placeholder for GRU v2 CAD rollout on Chain 138 with ISO-20022 / IPSAS evidence linkage.",
+  "sources": [
+    "https://explorer.d-bis.org/api/v1/report/token-list?chainId=138"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/cchfc-v2/metadata.json
+++ b/config/gru-v2-metadata/chain138/cchfc-v2/metadata.json
@@ -0,0 +1,21 @@
+{
+  "name": "Swiss Franc Coin (Compliant V2)",
+  "symbol": "cCHFC",
+  "description": "GRU v2 regulated CHF settlement asset for Chain 138 with ISO-20022-aligned accounting metadata and x402-capable signature support.",
+  "decimals": 6,
+  "logo": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cCHFC.svg",
+  "image": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cCHFC.svg",
+  "external_url": "https://explorer.d-bis.org",
+  "properties": {
+    "chainId": 138,
+    "currencyCode": "CHF",
+    "gruVersion": "2",
+    "assetFamily": "GRU",
+    "tokenRole": "gru_compliant_base",
+    "forwardCanonical": true,
+    "iso20022Ready": true,
+    "x402Ready": true,
+    "assetId": "keccak256:GRU:cCHFC",
+    "assetVersionId": "keccak256:GRU:cCHFC:2"
+  }
+}
--- a/config/gru-v2-metadata/chain138/cchfc-v2/regulatory-disclosure.json
+++ b/config/gru-v2-metadata/chain138/cchfc-v2/regulatory-disclosure.json
@@ -0,0 +1,12 @@
+{
+  "title": "cCHFC V2 Regulatory Disclosure",
+  "symbol": "cCHFC",
+  "gruVersion": "2",
+  "chainId": 138,
+  "jurisdiction": "International",
+  "notice": "This disclosure record is the contract-linked GRU v2 placeholder for regulated CHF settlement operations on Chain 138.",
+  "references": [
+    "https://explorer.d-bis.org",
+    "https://info.defi-oracle.io"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/cchfc-v2/reporting.json
+++ b/config/gru-v2-metadata/chain138/cchfc-v2/reporting.json
@@ -0,0 +1,11 @@
+{
+  "title": "cCHFC V2 Reporting Manifest",
+  "symbol": "cCHFC",
+  "gruVersion": "2",
+  "chainId": 138,
+  "reportingSchema": "dbis-gru-v2-reporting/1.0",
+  "notes": "Reporting URI placeholder for GRU v2 CHF rollout on Chain 138 with ISO-20022 / IPSAS evidence linkage.",
+  "sources": [
+    "https://explorer.d-bis.org/api/v1/report/token-list?chainId=138"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/ceurc-v2/metadata.json
+++ b/config/gru-v2-metadata/chain138/ceurc-v2/metadata.json
@@ -0,0 +1,21 @@
+{
+  "name": "Euro Coin (Compliant V2)",
+  "symbol": "cEURC",
+  "description": "GRU v2 regulated EUR settlement asset for Chain 138 with ISO-20022-aligned accounting metadata and x402-capable signature support.",
+  "decimals": 6,
+  "logo": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cEURC.svg",
+  "image": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cEURC.svg",
+  "external_url": "https://explorer.d-bis.org",
+  "properties": {
+    "chainId": 138,
+    "currencyCode": "EUR",
+    "gruVersion": "2",
+    "assetFamily": "GRU",
+    "tokenRole": "gru_compliant_base",
+    "forwardCanonical": true,
+    "iso20022Ready": true,
+    "x402Ready": true,
+    "assetId": "keccak256:GRU:cEURC",
+    "assetVersionId": "keccak256:GRU:cEURC:2"
+  }
+}
--- a/config/gru-v2-metadata/chain138/ceurc-v2/regulatory-disclosure.json
+++ b/config/gru-v2-metadata/chain138/ceurc-v2/regulatory-disclosure.json
@@ -0,0 +1,12 @@
+{
+  "title": "cEURC V2 Regulatory Disclosure",
+  "symbol": "cEURC",
+  "gruVersion": "2",
+  "chainId": 138,
+  "jurisdiction": "International",
+  "notice": "This disclosure record is the contract-linked GRU v2 placeholder for regulated EUR settlement operations on Chain 138.",
+  "references": [
+    "https://explorer.d-bis.org",
+    "https://info.defi-oracle.io"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/ceurc-v2/reporting.json
+++ b/config/gru-v2-metadata/chain138/ceurc-v2/reporting.json
@@ -0,0 +1,11 @@
+{
+  "title": "cEURC V2 Reporting Manifest",
+  "symbol": "cEURC",
+  "gruVersion": "2",
+  "chainId": 138,
+  "reportingSchema": "dbis-gru-v2-reporting/1.0",
+  "notes": "Reporting URI placeholder for GRU v2 EUR rollout on Chain 138 with ISO-20022 / IPSAS evidence linkage.",
+  "sources": [
+    "https://explorer.d-bis.org/api/v1/report/token-list?chainId=138"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/ceurt-v2/metadata.json
+++ b/config/gru-v2-metadata/chain138/ceurt-v2/metadata.json
@@ -0,0 +1,21 @@
+{
+  "name": "Euro Token (Compliant V2)",
+  "symbol": "cEURT",
+  "description": "GRU v2 regulated EUR token-form settlement asset for Chain 138 with ISO-20022-aligned accounting metadata and x402-capable signature support.",
+  "decimals": 6,
+  "logo": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cEURT.svg",
+  "image": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cEURT.svg",
+  "external_url": "https://explorer.d-bis.org",
+  "properties": {
+    "chainId": 138,
+    "currencyCode": "EUR",
+    "gruVersion": "2",
+    "assetFamily": "GRU",
+    "tokenRole": "gru_compliant_base",
+    "forwardCanonical": true,
+    "iso20022Ready": true,
+    "x402Ready": true,
+    "assetId": "keccak256:GRU:cEURT",
+    "assetVersionId": "keccak256:GRU:cEURT:2"
+  }
+}
--- a/config/gru-v2-metadata/chain138/ceurt-v2/regulatory-disclosure.json
+++ b/config/gru-v2-metadata/chain138/ceurt-v2/regulatory-disclosure.json
@@ -0,0 +1,12 @@
+{
+  "title": "cEURT V2 Regulatory Disclosure",
+  "symbol": "cEURT",
+  "gruVersion": "2",
+  "chainId": 138,
+  "jurisdiction": "International",
+  "notice": "This disclosure record is the contract-linked GRU v2 placeholder for regulated EUR token-form settlement operations on Chain 138.",
+  "references": [
+    "https://explorer.d-bis.org",
+    "https://info.defi-oracle.io"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/ceurt-v2/reporting.json
+++ b/config/gru-v2-metadata/chain138/ceurt-v2/reporting.json
@@ -0,0 +1,11 @@
+{
+  "title": "cEURT V2 Reporting Manifest",
+  "symbol": "cEURT",
+  "gruVersion": "2",
+  "chainId": 138,
+  "reportingSchema": "dbis-gru-v2-reporting/1.0",
+  "notes": "Reporting URI placeholder for GRU v2 EUR token-form rollout on Chain 138 with ISO-20022 / IPSAS evidence linkage.",
+  "sources": [
+    "https://explorer.d-bis.org/api/v1/report/token-list?chainId=138"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/cgbpc-v2/metadata.json
+++ b/config/gru-v2-metadata/chain138/cgbpc-v2/metadata.json
@@ -0,0 +1,21 @@
+{
+  "name": "Pound Sterling Coin (Compliant V2)",
+  "symbol": "cGBPC",
+  "description": "GRU v2 regulated GBP settlement asset for Chain 138 with ISO-20022-aligned accounting metadata and x402-capable signature support.",
+  "decimals": 6,
+  "logo": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cGBPC.svg",
+  "image": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cGBPC.svg",
+  "external_url": "https://explorer.d-bis.org",
+  "properties": {
+    "chainId": 138,
+    "currencyCode": "GBP",
+    "gruVersion": "2",
+    "assetFamily": "GRU",
+    "tokenRole": "gru_compliant_base",
+    "forwardCanonical": true,
+    "iso20022Ready": true,
+    "x402Ready": true,
+    "assetId": "keccak256:GRU:cGBPC",
+    "assetVersionId": "keccak256:GRU:cGBPC:2"
+  }
+}
--- a/config/gru-v2-metadata/chain138/cgbpc-v2/regulatory-disclosure.json
+++ b/config/gru-v2-metadata/chain138/cgbpc-v2/regulatory-disclosure.json
@@ -0,0 +1,12 @@
+{
+  "title": "cGBPC V2 Regulatory Disclosure",
+  "symbol": "cGBPC",
+  "gruVersion": "2",
+  "chainId": 138,
+  "jurisdiction": "International",
+  "notice": "This disclosure record is the contract-linked GRU v2 placeholder for regulated GBP settlement operations on Chain 138.",
+  "references": [
+    "https://explorer.d-bis.org",
+    "https://info.defi-oracle.io"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/cgbpc-v2/reporting.json
+++ b/config/gru-v2-metadata/chain138/cgbpc-v2/reporting.json
@@ -0,0 +1,11 @@
+{
+  "title": "cGBPC V2 Reporting Manifest",
+  "symbol": "cGBPC",
+  "gruVersion": "2",
+  "chainId": 138,
+  "reportingSchema": "dbis-gru-v2-reporting/1.0",
+  "notes": "Reporting URI placeholder for GRU v2 GBP rollout on Chain 138 with ISO-20022 / IPSAS evidence linkage.",
+  "sources": [
+    "https://explorer.d-bis.org/api/v1/report/token-list?chainId=138"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/cgbpt-v2/metadata.json
+++ b/config/gru-v2-metadata/chain138/cgbpt-v2/metadata.json
@@ -0,0 +1,21 @@
+{
+  "name": "Pound Sterling Token (Compliant V2)",
+  "symbol": "cGBPT",
+  "description": "GRU v2 regulated GBP token-form settlement asset for Chain 138 with ISO-20022-aligned accounting metadata and x402-capable signature support.",
+  "decimals": 6,
+  "logo": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cGBPT.svg",
+  "image": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cGBPT.svg",
+  "external_url": "https://explorer.d-bis.org",
+  "properties": {
+    "chainId": 138,
+    "currencyCode": "GBP",
+    "gruVersion": "2",
+    "assetFamily": "GRU",
+    "tokenRole": "gru_compliant_base",
+    "forwardCanonical": true,
+    "iso20022Ready": true,
+    "x402Ready": true,
+    "assetId": "keccak256:GRU:cGBPT",
+    "assetVersionId": "keccak256:GRU:cGBPT:2"
+  }
+}
--- a/config/gru-v2-metadata/chain138/cgbpt-v2/regulatory-disclosure.json
+++ b/config/gru-v2-metadata/chain138/cgbpt-v2/regulatory-disclosure.json
@@ -0,0 +1,12 @@
+{
+  "title": "cGBPT V2 Regulatory Disclosure",
+  "symbol": "cGBPT",
+  "gruVersion": "2",
+  "chainId": 138,
+  "jurisdiction": "International",
+  "notice": "This disclosure record is the contract-linked GRU v2 placeholder for regulated GBP token-form settlement operations on Chain 138.",
+  "references": [
+    "https://explorer.d-bis.org",
+    "https://info.defi-oracle.io"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/cgbpt-v2/reporting.json
+++ b/config/gru-v2-metadata/chain138/cgbpt-v2/reporting.json
@@ -0,0 +1,11 @@
+{
+  "title": "cGBPT V2 Reporting Manifest",
+  "symbol": "cGBPT",
+  "gruVersion": "2",
+  "chainId": 138,
+  "reportingSchema": "dbis-gru-v2-reporting/1.0",
+  "notes": "Reporting URI placeholder for GRU v2 GBP token-form rollout on Chain 138 with ISO-20022 / IPSAS evidence linkage.",
+  "sources": [
+    "https://explorer.d-bis.org/api/v1/report/token-list?chainId=138"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/cjpyc-v2/metadata.json
+++ b/config/gru-v2-metadata/chain138/cjpyc-v2/metadata.json
@@ -0,0 +1,21 @@
+{
+  "name": "Japanese Yen Coin (Compliant V2)",
+  "symbol": "cJPYC",
+  "description": "GRU v2 regulated JPY settlement asset for Chain 138 with ISO-20022-aligned accounting metadata and x402-capable signature support.",
+  "decimals": 6,
+  "logo": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cJPYC.svg",
+  "image": "https://raw.githubusercontent.com/Order-of-Hospitallers/proxmox-cp/main/token-lists/logos/gru/cJPYC.svg",
+  "external_url": "https://explorer.d-bis.org",
+  "properties": {
+    "chainId": 138,
+    "currencyCode": "JPY",
+    "gruVersion": "2",
+    "assetFamily": "GRU",
+    "tokenRole": "gru_compliant_base",
+    "forwardCanonical": true,
+    "iso20022Ready": true,
+    "x402Ready": true,
+    "assetId": "keccak256:GRU:cJPYC",
+    "assetVersionId": "keccak256:GRU:cJPYC:2"
+  }
+}
--- a/config/gru-v2-metadata/chain138/cjpyc-v2/regulatory-disclosure.json
+++ b/config/gru-v2-metadata/chain138/cjpyc-v2/regulatory-disclosure.json
@@ -0,0 +1,12 @@
+{
+  "title": "cJPYC V2 Regulatory Disclosure",
+  "symbol": "cJPYC",
+  "gruVersion": "2",
+  "chainId": 138,
+  "jurisdiction": "International",
+  "notice": "This disclosure record is the contract-linked GRU v2 placeholder for regulated JPY settlement operations on Chain 138.",
+  "references": [
+    "https://explorer.d-bis.org",
+    "https://info.defi-oracle.io"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/cjpyc-v2/reporting.json
+++ b/config/gru-v2-metadata/chain138/cjpyc-v2/reporting.json
@@ -0,0 +1,11 @@
+{
+  "title": "cJPYC V2 Reporting Manifest",
+  "symbol": "cJPYC",
+  "gruVersion": "2",
+  "chainId": 138,
+  "reportingSchema": "dbis-gru-v2-reporting/1.0",
+  "notes": "Reporting URI placeholder for GRU v2 JPY rollout on Chain 138 with ISO-20022 / IPSAS evidence linkage.",
+  "sources": [
+    "https://explorer.d-bis.org/api/v1/report/token-list?chainId=138"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/cusdc-v2/metadata.json
+++ b/config/gru-v2-metadata/chain138/cusdc-v2/metadata.json
@@ -0,0 +1,19 @@
+{
+  "name": "Compliant USD Coin V2",
+  "symbol": "cUSDC",
+  "description": "GRU v2 regulated USD settlement asset for Chain 138. The contract stores this metadata URI while the logo and metadata payload live on IPFS.",
+  "decimals": 6,
+  "logo": "ipfs://QmNPq4D5JXzurmi9jAhogVMzhAQRk1PZ1r9H3qQUV9gjDm",
+  "image": "ipfs://QmNPq4D5JXzurmi9jAhogVMzhAQRk1PZ1r9H3qQUV9gjDm",
+  "external_url": "https://explorer.d-bis.org",
+  "properties": {
+    "chainId": 138,
+    "currencyCode": "USD",
+    "gruVersion": "2",
+    "assetFamily": "GRU",
+    "tokenRole": "gru_compliant_base",
+    "forwardCanonical": true,
+    "assetId": "keccak256:GRU:cUSDC",
+    "assetVersionId": "keccak256:GRU:cUSDC:2"
+  }
+}
--- a/config/gru-v2-metadata/chain138/cusdc-v2/regulatory-disclosure.json
+++ b/config/gru-v2-metadata/chain138/cusdc-v2/regulatory-disclosure.json
@@ -0,0 +1,12 @@
+{
+  "title": "cUSDC V2 Regulatory Disclosure",
+  "symbol": "cUSDC",
+  "gruVersion": "2",
+  "chainId": 138,
+  "jurisdiction": "International",
+  "notice": "This disclosure record is the contract-linked GRU v2 placeholder for regulated USD settlement operations on Chain 138.",
+  "references": [
+    "https://explorer.d-bis.org",
+    "https://info.defi-oracle.io"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/cusdc-v2/reporting.json
+++ b/config/gru-v2-metadata/chain138/cusdc-v2/reporting.json
@@ -0,0 +1,11 @@
+{
+  "title": "cUSDC V2 Reporting Manifest",
+  "symbol": "cUSDC",
+  "gruVersion": "2",
+  "chainId": 138,
+  "reportingSchema": "dbis-gru-v2-reporting/1.0",
+  "notes": "Reporting URI placeholder for GRU v2 Chain 138 rollout. Replace with the production reporting feed when the operating profile is finalized.",
+  "sources": [
+    "https://explorer.d-bis.org/api/v1/report/token-list?chainId=138"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/cusdt-v2/metadata.json
+++ b/config/gru-v2-metadata/chain138/cusdt-v2/metadata.json
@@ -0,0 +1,19 @@
+{
+  "name": "Compliant Tether USD V2",
+  "symbol": "cUSDT",
+  "description": "GRU v2 regulated USD settlement asset for Chain 138. The contract stores this metadata URI while the logo and metadata payload live on IPFS.",
+  "decimals": 6,
+  "logo": "ipfs://QmRfhPs9DcyFPpGjKwF6CCoVDWUHSxkQR34n9NK7JSbPCP",
+  "image": "ipfs://QmRfhPs9DcyFPpGjKwF6CCoVDWUHSxkQR34n9NK7JSbPCP",
+  "external_url": "https://explorer.d-bis.org",
+  "properties": {
+    "chainId": 138,
+    "currencyCode": "USD",
+    "gruVersion": "2",
+    "assetFamily": "GRU",
+    "tokenRole": "gru_compliant_base",
+    "forwardCanonical": true,
+    "assetId": "keccak256:GRU:cUSDT",
+    "assetVersionId": "keccak256:GRU:cUSDT:2"
+  }
+}
--- a/config/gru-v2-metadata/chain138/cusdt-v2/regulatory-disclosure.json
+++ b/config/gru-v2-metadata/chain138/cusdt-v2/regulatory-disclosure.json
@@ -0,0 +1,12 @@
+{
+  "title": "cUSDT V2 Regulatory Disclosure",
+  "symbol": "cUSDT",
+  "gruVersion": "2",
+  "chainId": 138,
+  "jurisdiction": "International",
+  "notice": "This disclosure record is the contract-linked GRU v2 placeholder for regulated USD settlement operations on Chain 138.",
+  "references": [
+    "https://explorer.d-bis.org",
+    "https://info.defi-oracle.io"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/cusdt-v2/reporting.json
+++ b/config/gru-v2-metadata/chain138/cusdt-v2/reporting.json
@@ -0,0 +1,11 @@
+{
+  "title": "cUSDT V2 Reporting Manifest",
+  "symbol": "cUSDT",
+  "gruVersion": "2",
+  "chainId": 138,
+  "reportingSchema": "dbis-gru-v2-reporting/1.0",
+  "notes": "Reporting URI placeholder for GRU v2 Chain 138 rollout. Replace with the production reporting feed when the operating profile is finalized.",
+  "sources": [
+    "https://explorer.d-bis.org/api/v1/report/token-list?chainId=138"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/cxauc-v2/metadata.json
+++ b/config/gru-v2-metadata/chain138/cxauc-v2/metadata.json
@@ -0,0 +1,22 @@
+{
+  "name": "Gold Coin (Compliant V2)",
+  "symbol": "cXAUC",
+  "description": "GRU v2 regulated XAU settlement asset for Chain 138 with ISO-20022-aligned accounting metadata and x402-capable signature support.",
+  "decimals": 6,
+  "logo": "https://explorer.d-bis.org/token-icons/cXAUC.png",
+  "image": "https://explorer.d-bis.org/token-icons/cXAUC.png",
+  "external_url": "https://explorer.d-bis.org",
+  "properties": {
+    "chainId": 138,
+    "currencyCode": "XAU",
+    "gruVersion": "2",
+    "assetFamily": "GRU",
+    "tokenRole": "gru_compliant_base",
+    "forwardCanonical": true,
+    "iso20022Ready": true,
+    "x402Ready": true,
+    "unitOfAccount": "troy_ounce",
+    "assetId": "keccak256:GRU:cXAUC",
+    "assetVersionId": "keccak256:GRU:cXAUC:2"
+  }
+}
--- a/config/gru-v2-metadata/chain138/cxauc-v2/regulatory-disclosure.json
+++ b/config/gru-v2-metadata/chain138/cxauc-v2/regulatory-disclosure.json
@@ -0,0 +1,12 @@
+{
+  "title": "cXAUC V2 Regulatory Disclosure",
+  "symbol": "cXAUC",
+  "gruVersion": "2",
+  "chainId": 138,
+  "jurisdiction": "International",
+  "notice": "This disclosure record is the contract-linked GRU v2 placeholder for regulated XAU settlement operations on Chain 138.",
+  "references": [
+    "https://explorer.d-bis.org",
+    "https://info.defi-oracle.io"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/cxauc-v2/reporting.json
+++ b/config/gru-v2-metadata/chain138/cxauc-v2/reporting.json
@@ -0,0 +1,11 @@
+{
+  "title": "cXAUC V2 Reporting Manifest",
+  "symbol": "cXAUC",
+  "gruVersion": "2",
+  "chainId": 138,
+  "reportingSchema": "dbis-gru-v2-reporting/1.0",
+  "notes": "Reporting URI placeholder for GRU v2 XAU rollout on Chain 138 with ISO-20022 / IPSAS evidence linkage.",
+  "sources": [
+    "https://explorer.d-bis.org/api/v1/report/token-list?chainId=138"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/cxaut-v2/metadata.json
+++ b/config/gru-v2-metadata/chain138/cxaut-v2/metadata.json
@@ -0,0 +1,22 @@
+{
+  "name": "Gold Token (Compliant V2)",
+  "symbol": "cXAUT",
+  "description": "GRU v2 regulated XAU token-form settlement asset for Chain 138 with ISO-20022-aligned accounting metadata and x402-capable signature support.",
+  "decimals": 6,
+  "logo": "https://explorer.d-bis.org/token-icons/cXAUT.png",
+  "image": "https://explorer.d-bis.org/token-icons/cXAUT.png",
+  "external_url": "https://explorer.d-bis.org",
+  "properties": {
+    "chainId": 138,
+    "currencyCode": "XAU",
+    "gruVersion": "2",
+    "assetFamily": "GRU",
+    "tokenRole": "gru_compliant_base",
+    "forwardCanonical": true,
+    "iso20022Ready": true,
+    "x402Ready": true,
+    "unitOfAccount": "troy_ounce",
+    "assetId": "keccak256:GRU:cXAUT",
+    "assetVersionId": "keccak256:GRU:cXAUT:2"
+  }
+}
--- a/config/gru-v2-metadata/chain138/cxaut-v2/regulatory-disclosure.json
+++ b/config/gru-v2-metadata/chain138/cxaut-v2/regulatory-disclosure.json
@@ -0,0 +1,12 @@
+{
+  "title": "cXAUT V2 Regulatory Disclosure",
+  "symbol": "cXAUT",
+  "gruVersion": "2",
+  "chainId": 138,
+  "jurisdiction": "International",
+  "notice": "This disclosure record is the contract-linked GRU v2 placeholder for regulated XAU token-form settlement operations on Chain 138.",
+  "references": [
+    "https://explorer.d-bis.org",
+    "https://info.defi-oracle.io"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/cxaut-v2/reporting.json
+++ b/config/gru-v2-metadata/chain138/cxaut-v2/reporting.json
@@ -0,0 +1,11 @@
+{
+  "title": "cXAUT V2 Reporting Manifest",
+  "symbol": "cXAUT",
+  "gruVersion": "2",
+  "chainId": 138,
+  "reportingSchema": "dbis-gru-v2-reporting/1.0",
+  "notes": "Reporting URI placeholder for GRU v2 XAU token-form rollout on Chain 138 with ISO-20022 / IPSAS evidence linkage.",
+  "sources": [
+    "https://explorer.d-bis.org/api/v1/report/token-list?chainId=138"
+  ]
+}
--- a/config/gru-v2-metadata/chain138/ipfs-manifest.latest.json
+++ b/config/gru-v2-metadata/chain138/ipfs-manifest.latest.json
@@ -0,0 +1,80 @@
+{
+  "chainId": 138,
+  "publishedAt": "2026-04-07T17:34:31Z",
+  "rootCID": "QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR",
+  "ipfsApi": "http://192.168.11.35:5001",
+  "assets": {
+    "cAUDC": {
+      "metadataKey": "caudc-v2",
+      "tokenURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/caudc-v2/metadata.json",
+      "regulatoryDisclosureURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/caudc-v2/regulatory-disclosure.json",
+      "reportingURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/caudc-v2/reporting.json"
+    },
+    "cCADC": {
+      "metadataKey": "ccadc-v2",
+      "tokenURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/ccadc-v2/metadata.json",
+      "regulatoryDisclosureURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/ccadc-v2/regulatory-disclosure.json",
+      "reportingURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/ccadc-v2/reporting.json"
+    },
+    "cCHFC": {
+      "metadataKey": "cchfc-v2",
+      "tokenURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cchfc-v2/metadata.json",
+      "regulatoryDisclosureURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cchfc-v2/regulatory-disclosure.json",
+      "reportingURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cchfc-v2/reporting.json"
+    },
+    "cEURC": {
+      "metadataKey": "ceurc-v2",
+      "tokenURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/ceurc-v2/metadata.json",
+      "regulatoryDisclosureURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/ceurc-v2/regulatory-disclosure.json",
+      "reportingURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/ceurc-v2/reporting.json"
+    },
+    "cEURT": {
+      "metadataKey": "ceurt-v2",
+      "tokenURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/ceurt-v2/metadata.json",
+      "regulatoryDisclosureURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/ceurt-v2/regulatory-disclosure.json",
+      "reportingURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/ceurt-v2/reporting.json"
+    },
+    "cGBPC": {
+      "metadataKey": "cgbpc-v2",
+      "tokenURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cgbpc-v2/metadata.json",
+      "regulatoryDisclosureURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cgbpc-v2/regulatory-disclosure.json",
+      "reportingURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cgbpc-v2/reporting.json"
+    },
+    "cGBPT": {
+      "metadataKey": "cgbpt-v2",
+      "tokenURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cgbpt-v2/metadata.json",
+      "regulatoryDisclosureURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cgbpt-v2/regulatory-disclosure.json",
+      "reportingURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cgbpt-v2/reporting.json"
+    },
+    "cJPYC": {
+      "metadataKey": "cjpyc-v2",
+      "tokenURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cjpyc-v2/metadata.json",
+      "regulatoryDisclosureURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cjpyc-v2/regulatory-disclosure.json",
+      "reportingURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cjpyc-v2/reporting.json"
+    },
+    "cUSDC": {
+      "metadataKey": "cusdc-v2",
+      "tokenURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cusdc-v2/metadata.json",
+      "regulatoryDisclosureURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cusdc-v2/regulatory-disclosure.json",
+      "reportingURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cusdc-v2/reporting.json"
+    },
+    "cUSDT": {
+      "metadataKey": "cusdt-v2",
+      "tokenURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cusdt-v2/metadata.json",
+      "regulatoryDisclosureURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cusdt-v2/regulatory-disclosure.json",
+      "reportingURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cusdt-v2/reporting.json"
+    },
+    "cXAUC": {
+      "metadataKey": "cxauc-v2",
+      "tokenURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cxauc-v2/metadata.json",
+      "regulatoryDisclosureURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cxauc-v2/regulatory-disclosure.json",
+      "reportingURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cxauc-v2/reporting.json"
+    },
+    "cXAUT": {
+      "metadataKey": "cxaut-v2",
+      "tokenURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cxaut-v2/metadata.json",
+      "regulatoryDisclosureURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cxaut-v2/regulatory-disclosure.json",
+      "reportingURI": "ipfs://QmYtB2FoftYoLuJVoQP8uWcuECxwtZUtmcGkerXdTeL3QR/cxaut-v2/reporting.json"
+    }
+  }
+}
--- a/config/gru-v2-public-protocol-rollout-plan.json
+++ b/config/gru-v2-public-protocol-rollout-plan.json
@@ -0,0 +1,82 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "name": "GRU V2 Public Protocol Rollout Plan",
+  "version": "1.0.0",
+  "updated": "2026-04-03",
+  "notes": [
+    "This is a deployment queue and protocol-role plan, not a statement that public cW liquidity is live.",
+    "Chain 138 canonical venues are tracked separately from the public cW mesh."
+  ],
+  "protocols": [
+    {
+      "key": "dodo_v3_d3mm",
+      "name": "DODO v3 / D3MM",
+      "role": "atomic_liquidity_and_private_edge_venue",
+      "deploymentStage": "stage0_chain138_canonical_then_public_evm_expansion",
+      "activationDependsOn": [
+        "canonical D3MM inventory frozen for the target chain",
+        "route-matrix visibility attached",
+        "token-aggregation capability surfaced",
+        "upstream-native contract family verified",
+        "if public-chain rollout is intended, resulting pool addresses written to deployment-status.json or the dedicated D3MM inventory surface"
+      ]
+    },
+    {
+      "key": "uniswap_v3",
+      "name": "Uniswap v3",
+      "role": "primary_public_pool_venue",
+      "deploymentStage": "stage1_first_tier_pools",
+      "activationDependsOn": [
+        "cW token suite deployed on destination chain",
+        "first-tier cW/hub pools created",
+        "pool addresses written to deployment-status.json",
+        "token-aggregation/indexer visibility enabled"
+      ]
+    },
+    {
+      "key": "dodo_pmm",
+      "name": "DODO PMM",
+      "role": "primary_public_pmm_edge_venue",
+      "deploymentStage": "stage1_first_tier_pools",
+      "activationDependsOn": [
+        "cW token suite deployed on destination chain",
+        "first-tier cW/hub pools created",
+        "pool addresses written to deployment-status.json",
+        "policy controls and MCP visibility attached"
+      ]
+    },
+    {
+      "key": "balancer",
+      "name": "Balancer",
+      "role": "secondary_basket_liquidity",
+      "deploymentStage": "stage2_post_first_tier_liquidity",
+      "activationDependsOn": [
+        "first-tier Uniswap v3 or DODO PMM liquidity live",
+        "basket design approved for the destination chain",
+        "pool addresses written to deployment-status.json"
+      ]
+    },
+    {
+      "key": "curve_3",
+      "name": "Curve 3",
+      "role": "secondary_stable_curve",
+      "deploymentStage": "stage2_post_first_tier_liquidity",
+      "activationDependsOn": [
+        "first-tier stable liquidity live",
+        "stable basket design approved for the destination chain",
+        "pool addresses written to deployment-status.json"
+      ]
+    },
+    {
+      "key": "one_inch",
+      "name": "1inch",
+      "role": "routing_aggregation_layer",
+      "deploymentStage": "stage3_after_underlying_pools_live",
+      "activationDependsOn": [
+        "underlying public pools already live",
+        "router/indexer visibility enabled",
+        "token-aggregation/provider capability surfaced publicly"
+      ]
+    }
+  ]
+}
--- a/config/ip-addresses.conf
+++ b/config/ip-addresses.conf
@@ -15,20 +15,37 @@ PROXMOX_HOST_R630_02="${PROXMOX_R630_02:-${PROXMOX_HOST_R630_02:-192.168.11.12}}
 PROXMOX_ML110="${PROXMOX_HOST_ML110}"
 PROXMOX_R630_01="${PROXMOX_HOST_R630_01}"
 PROXMOX_R630_02="${PROXMOX_HOST_R630_02}"
+# Spare / expansion R630s (cluster); storage alignment: scripts/proxmox/ensure-r630-spare-node-storage.sh
+PROXMOX_HOST_R630_03="${PROXMOX_R630_03:-${PROXMOX_HOST_R630_03:-192.168.11.13}}"
+PROXMOX_HOST_R630_04="${PROXMOX_R630_04:-${PROXMOX_HOST_R630_04:-192.168.11.14}}"
+PROXMOX_R630_03="${PROXMOX_HOST_R630_03}"
+PROXMOX_R630_04="${PROXMOX_HOST_R630_04}"
+# Canonical Proxmox node FQDNs on LAN (DNS or /etc/hosts): <short-hostname>.sankofa.nexus
+PROXMOX_FQDN_ML110="${PROXMOX_FQDN_ML110:-ml110.sankofa.nexus}"
+PROXMOX_FQDN_R630_01="${PROXMOX_FQDN_R630_01:-r630-01.sankofa.nexus}"
+PROXMOX_FQDN_R630_02="${PROXMOX_FQDN_R630_02:-r630-02.sankofa.nexus}"
+PROXMOX_FQDN_R630_03="${PROXMOX_FQDN_R630_03:-r630-03.sankofa.nexus}"
+PROXMOX_FQDN_R630_04="${PROXMOX_FQDN_R630_04:-r630-04.sankofa.nexus}"
+# If LAN DNS does not resolve *.sankofa.nexus: `bash scripts/verify/check-proxmox-mgmt-fqdn.sh --print-hosts` (paste into operator /etc/hosts).
 # WAN aggregator (OPNsense/pfSense on ML110); same IP .10 after repurpose
 WAN_AGGREGATOR_ML110="${WAN_AGGREGATOR_ML110:-192.168.11.10}"

-# R630-03..13: 192.168.11.13–.23 (r630-03 … r630-13). Add when nodes are brought online.
+# R630-05..13: 192.168.11.15–.23. Add PROXMOX_HOST_R630_XX when nodes are brought online.
 # Extended inventory: R750 (3), Dell 7920 (2), UDM Pro #2 (1). See docs/11-references/HARDWARE_INVENTORY_MASTER.md
+# .24/.25: R750 placeholders (often unassigned). .26 is NOT a physical R750 — legacy NPM OpenResty (VMID 105); use IP_NGINX_LEGACY.
+# PROXMOX_HOST_R750_03 remains a historical variable name pointing at .26; automation must not assume a bare-metal host at this IP.
 PROXMOX_HOST_R750_01="${PROXMOX_HOST_R750_01:-192.168.11.24}"
 PROXMOX_HOST_R750_02="${PROXMOX_HOST_R750_02:-192.168.11.25}"
 PROXMOX_HOST_R750_03="${PROXMOX_HOST_R750_03:-192.168.11.26}"
 UDM_PRO_2_IP="${UDM_PRO_2_IP:-192.168.11.2}"
-WORKSTATION_01_IP="${WORKSTATION_01_IP:-192.168.11.30}"
-WORKSTATION_02_IP="${WORKSTATION_02_IP:-192.168.11.31}"
+# Optional workstation placeholders.
+# Do not preassign .30/.31 here: .30 was freed when Omada VMID 103 was retired on 2026-04-04, and .31 is the live Gitea address.
+# Set explicit workstation IPs in .env only when the 7920s are actually provisioned.
+WORKSTATION_01_IP="${WORKSTATION_01_IP:-}"
+WORKSTATION_02_IP="${WORKSTATION_02_IP:-}"

 # RPC Endpoints — Chain ID 138 two standards
-# Core (admin/deploy): RPC_URL_138 — VMID 2101
+# Core (admin/deploy): RPC_URL_138 — VMID 2101 (r630-01). VMID 2102 = RPC_CORE_2 on r630-03; VMID 2103 = RPC_THIRDWEB_ADMIN_CORE on r630-01.
 RPC_CORE_1="192.168.11.211"
 RPC_URL_138="http://${RPC_CORE_1}:8545"
 # Public (bridge/frontend/monitoring): RPC_URL_138_PUBLIC — VMID 2201, FIXED PERMANENT
@@ -45,6 +62,34 @@ RPC_FIREBLOCKS_1="${RPC_PRIVATE_1}"
 RPC_URL_138_FIREBLOCKS="http://${RPC_FIREBLOCKS_1}:8545"
 WS_URL_138_FIREBLOCKS="ws://${RPC_FIREBLOCKS_1}:8546"
 RPC_THIRDWEB_PRIMARY="192.168.11.240"
+RPC_THIRDWEB_1="${RPC_THIRDWEB_1:-192.168.11.241}"
+RPC_THIRDWEB_2="${RPC_THIRDWEB_2:-192.168.11.242}"
+RPC_THIRDWEB_3="${RPC_THIRDWEB_3:-192.168.11.243}"
+# Thirdweb admin/core Besu RPC — VMID 2103 (NPM: RPC_THIRDWEB_ADMIN_CORE in update-npmplus-proxy-hosts-api.sh)
+RPC_THIRDWEB_ADMIN_CORE="${RPC_THIRDWEB_ADMIN_CORE:-192.168.11.217}"
+RPC_ALI_0X8A="${RPC_ALI_0X8A:-192.168.11.233}"
+RPC_ALI_0X1="${RPC_ALI_0X1:-192.168.11.234}"
+RPC_LUIS_0X8A="${RPC_LUIS_0X8A:-192.168.11.235}"
+RPC_LUIS_0X1="${RPC_LUIS_0X1:-192.168.11.236}"
+RPC_PUTU_0X8A="${RPC_PUTU_0X8A:-192.168.11.237}"
+RPC_PUTU_0X1="${RPC_PUTU_0X1:-192.168.11.238}"
+
+# Aliases for Besu VMID RPC scripts (same IPs as RPC_CORE_* / RPC_PUBLIC_1 / RPC_PRIVATE_1)
+IP_BESU_RPC_CORE_1="${IP_BESU_RPC_CORE_1:-${RPC_CORE_1}}"
+IP_BESU_RPC_CORE_2="${IP_BESU_RPC_CORE_2:-${RPC_CORE_2}}"
+IP_BESU_RPC_PUBLIC_1="${IP_BESU_RPC_PUBLIC_1:-${RPC_PUBLIC_1}}"
+IP_BESU_RPC_PRIVATE_1="${IP_BESU_RPC_PRIVATE_1:-${RPC_PRIVATE_1}}"
+
+# Dedicated nginx LXC for https://info.defi-oracle.io (Chain 138 info SPA). Not VMID 2400 (ThirdWeb RPC).
+IP_INFO_DEFI_ORACLE_WEB="${IP_INFO_DEFI_ORACLE_WEB:-192.168.11.218}"
+INFO_DEFI_ORACLE_WEB_VMID="${INFO_DEFI_ORACLE_WEB_VMID:-2410}"
+
+# Static landing https://omdnl.org (nginx LXC). Provision: scripts/deployment/provision-omdnl-org-web-lxc.sh
+IP_OMDNL_ORG_WEB="${IP_OMDNL_ORG_WEB:-192.168.11.222}"
+OMDNL_ORG_WEB_VMID="${OMDNL_ORG_WEB_VMID:-10203}"
+
+IP_BESU_SENTRY_THIRDWEB_1="${IP_BESU_SENTRY_THIRDWEB_1:-192.168.11.219}"
+IP_BESU_SENTRY_THIRDWEB_2="${IP_BESU_SENTRY_THIRDWEB_2:-192.168.11.220}"

 # Gateway (192.168.11.0/24 — do not change unless network changes)
 NETWORK_GATEWAY="${NETWORK_GATEWAY:-192.168.11.1}"
@@ -77,6 +122,7 @@ BLOCKSCOUT_API_URL="http://${IP_BLOCKSCOUT}:${BLOCKSCOUT_API_PORT}"
 FORGE_VERIFIER_PROXY_PORT="${FORGE_VERIFIER_PROXY_PORT:-3080}"
 IP_NPMPLUS="192.168.11.167"
 IP_NPMPLUS_SECONDARY="192.168.11.168"
+# Legacy NPM (OpenResty) LXC VMID 105 — same wire IP as PROXMOX_HOST_R750_03 default; not an R750.
 IP_NGINX_LEGACY="192.168.11.26"
 IP_ORDER_OPENSEARCH="192.168.11.48"
 IP_ORDER_HAPROXY="192.168.11.39"
@@ -85,7 +131,7 @@ IP_VAULT_PHOENIX_2="192.168.11.201"
 # Order Service IPs
 ORDER_POSTGRES_PRIMARY="192.168.11.44"
 ORDER_POSTGRES_REPLICA="192.168.11.45"
-# Dedicated order-redis LXC (e.g. VMID 10020) not present on cluster as of 2026-03; reserve for scripts / future CT
+# Order Redis LXC VMID 10020 (`order-redis` on r630-01); keep in sync with ALL_VMIDS_ENDPOINTS + proxmox-operational-template.json
 ORDER_REDIS_IP="192.168.11.38"
 IP_ORDER_MCP_LEGAL="192.168.11.94"

@@ -107,7 +153,12 @@ IP_NPMPLUS_ETH0="192.168.11.166"
 # NPMplus Alltra/HYBX (VMID 10235) - see docs/04-configuration/NPMPLUS_ALLTRA_HYBX_MASTER_PLAN.md
 IP_NPMPLUS_ALLTRA_HYBX="192.168.11.169"
 PUBLIC_IP_NPMPLUS_ALLTRA_HYBX="76.53.10.42"
-RPC_ALLTRA_1="192.168.11.250"
+RPC_ALLTRA_1="${RPC_ALLTRA_1:-192.168.11.172}"
+RPC_ALLTRA_2="${RPC_ALLTRA_2:-192.168.11.173}"
+RPC_ALLTRA_3="${RPC_ALLTRA_3:-192.168.11.174}"
+RPC_HYBX_1="${RPC_HYBX_1:-192.168.11.246}"
+RPC_HYBX_2="${RPC_HYBX_2:-192.168.11.247}"
+RPC_HYBX_3="${RPC_HYBX_3:-192.168.11.248}"
 IP_DBIS_FRONTEND="192.168.11.130"
 IP_FIREFLY="192.168.11.66"
 IP_FIREFLY_2="192.168.11.67"
@@ -131,15 +182,14 @@ IP_BESU_RPC_0="192.168.11.150"
 IP_BESU_RPC_1="192.168.11.151"
 IP_BESU_RPC_2="192.168.11.152"
 IP_BESU_RPC_3="192.168.11.153"
+# Legacy migration aliases retained for older scripts that still reference the destroyed 250x era.
 RPC_ALI_1="192.168.11.251"
 RPC_ALI_2="192.168.11.252"
-RPC_THIRDWEB_1="192.168.11.241"
-RPC_THIRDWEB_2="192.168.11.242"

 # Network and additional container IPs (for remaining migration)
 NETWORK_192_168_11_0="192.168.11.0"
-IP_INDY="192.168.11.68"
-IP_FABRIC="192.168.11.65"
+IP_INDY="192.168.11.64"
+IP_FABRIC="192.168.11.113"
 IP_CACTI="192.168.11.64"
 # VMID 10200 order-prometheus (NOT Redis). Legacy scripts use ORDER_REDIS_REPLICA for this IP — prefer IP_ORDER_PROMETHEUS.
 IP_ORDER_PROMETHEUS="192.168.11.46"
@@ -153,21 +203,40 @@ RPC_LUIS_2="192.168.11.202"
 # Additional ALLTRA container IPs
 IP_FIREFLY_ALLTRA_1="192.168.11.175"
 IP_FIREFLY_ALLTRA_2="192.168.11.176"
+# Firefly HYBX (r630-02 LXC 6204/6205); was misconfigured at .172 for 6205 — fixed 2026-04-09
+IP_FIREFLY_HYBX_1="192.168.11.249"
+IP_FIREFLY_HYBX_2="192.168.11.250"
 IP_CACTI_ALLTRA="192.168.11.177"
 IP_FABRIC_ALLTRA="192.168.11.178"
 IP_INDY_ALLTRA="192.168.11.179"
+# Legacy Omada alternate; controller retired — keep only if scripts still reference IP_OMADA_ALT.
 IP_OMADA_ALT="192.168.11.8"
 IP_MIM4U="192.168.11.19"
+# Non-guest discovery IP (not in /etc/pve as a CT/VM); HTTP :8080 observed — owner TBD. See docs/04-configuration/IT_OPS_EDGE_DISCOVERY_IPS.md
 IP_SERVICE_23="192.168.11.23"
 IP_CCIP_MONITOR="192.168.11.28"
+# Was Omada (VMID 103); CT removed 2026-04-04 — spare / reuse for another service.
 IP_SERVICE_30="192.168.11.30"
 IP_KEYCLOAK="192.168.11.52"
 IP_RPC_90="192.168.11.90"

-# Development VM (VMID 5700) — shared Cursor dev + private GitOps (Gitea). See docs/04-configuration/DEV_VM_GITOPS_PLAN.md
+# Development VM (VMID 5700) — shared Cursor dev; may run a *local* Gitea on :3000. See docs/04-configuration/DEV_VM_GITOPS_PLAN.md
 # Changed from .60 to .59 to resolve conflict with VMID 3000 (ML) at .60. Reconfigure CT 5700 on Proxmox to use this IP.
 IP_DEV_VM="192.168.11.59"

+# Gitea infrastructure CT (VMID 104) — org forge; LAN web 80/443. See docs/04-configuration/ALL_VMIDS_ENDPOINTS.md
+IP_GITEA_INFRA="${IP_GITEA_INFRA:-192.168.11.31}"
+# NPMplus upstream for https://gitea.d-bis.org (scripts/nginx-proxy-manager/update-npmplus-fourth-proxy-hosts.sh).
+# Default: infra CT. To point the public hostname at dev VM Gitea instead: GITEA_PUBLIC_UPSTREAM_HOST=$IP_DEV_VM GITEA_PUBLIC_UPSTREAM_PORT=3000
+GITEA_PUBLIC_UPSTREAM_HOST="${GITEA_PUBLIC_UPSTREAM_HOST:-$IP_GITEA_INFRA}"
+GITEA_PUBLIC_UPSTREAM_PORT="${GITEA_PUBLIC_UPSTREAM_PORT:-80}"
+
+# OP Stack operator landing zone (VMIDs 5751-5752) on r630-02 / thin5 — deployment + runtime ops only.
+OP_STACK_DEPLOYER_VMID="${OP_STACK_DEPLOYER_VMID:-5751}"
+OP_STACK_OPS_VMID="${OP_STACK_OPS_VMID:-5752}"
+IP_OP_STACK_DEPLOYER_CT="${IP_OP_STACK_DEPLOYER_CT:-192.168.11.69}"
+IP_OP_STACK_OPS_CT="${IP_OP_STACK_OPS_CT:-192.168.11.70}"
+
 # Mifos X + Fineract (VMID 5800) on r630-02 — Cloudflare Tunnel + UK egress. See docs/04-configuration/MIFOS_R630_02_DEPLOYMENT.md
 MIFOS_IP="192.168.11.85"
 # Public IP for Mifos when using direct access (A record + UDM Pro port forward). See docs/04-configuration/UDM_PRO_MIFOS_76_53_10_41_PORT_FORWARD.md
--- a/config/it-operations/entitlements-schema.sql
+++ b/config/it-operations/entitlements-schema.sql
@@ -0,0 +1,51 @@
+-- IT operations controller — entitlements + metering (Phase 4 skeleton)
+-- Postgres 14+. Run on dedicated IT DB CT; do not share with app OLTP.
+-- Link to dbis_core marketplace via external_sku_id / iru_offering_ref.
+
+CREATE TABLE IF NOT EXISTS entitlement (
+    id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    org_id          TEXT NOT NULL,
+    sku_code        TEXT NOT NULL,
+    external_sku_id TEXT,
+    seat_count      INT NOT NULL DEFAULT 1 CHECK (seat_count >= 0),
+    valid_from      TIMESTAMPTZ NOT NULL DEFAULT now(),
+    valid_to        TIMESTAMPTZ,
+    stripe_subscription_id TEXT,
+    stripe_customer_id     TEXT,
+    metadata        JSONB NOT NULL DEFAULT '{}',
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at      TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_entitlement_org ON entitlement (org_id);
+CREATE INDEX IF NOT EXISTS idx_entitlement_stripe_sub ON entitlement (stripe_subscription_id);
+
+CREATE TABLE IF NOT EXISTS usage_snapshot (
+    id           UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    collected_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    vmid         TEXT NOT NULL,
+    node         TEXT,
+    vcpus        REAL,
+    memory_mb    REAL,
+    disk_gb      REAL,
+    source       TEXT NOT NULL DEFAULT 'proxmox_api',
+    raw          JSONB
+);
+
+CREATE INDEX IF NOT EXISTS idx_usage_snapshot_time ON usage_snapshot (collected_at);
+
+CREATE TABLE IF NOT EXISTS stripe_webhook_event (
+    id            TEXT PRIMARY KEY,
+    received_at   TIMESTAMPTZ NOT NULL DEFAULT now(),
+    event_type    TEXT NOT NULL,
+    payload       JSONB NOT NULL,
+    processed     BOOLEAN NOT NULL DEFAULT false,
+    error         TEXT
+);
+
+-- Optional: map Keycloak group / subject to org for RBAC in BFF
+CREATE TABLE IF NOT EXISTS it_operator_org (
+    keycloak_sub TEXT PRIMARY KEY,
+    org_id       TEXT NOT NULL,
+    created_at   TIMESTAMPTZ NOT NULL DEFAULT now()
+);
--- a/config/it-operations/live-collectors-contract.json
+++ b/config/it-operations/live-collectors-contract.json
@@ -0,0 +1,49 @@
+{
+  "version": 1,
+  "updated": "2026-04-09",
+  "collectors": [
+    {
+      "id": "proxmox_cluster_guests",
+      "description": "pvesh /cluster/resources + per-guest net0/ipconfig0",
+      "default_interval_seconds": 3600,
+      "failure_mode": "stale_banner",
+      "live_only_fields": ["guests[].status", "guests[].ip", "guests[].mac", "guests[].node"],
+      "declared_sources": ["config/ip-addresses.conf", "docs/04-configuration/ALL_VMIDS_ENDPOINTS.md"],
+      "script": "scripts/it-ops/export-live-inventory-and-drift.sh"
+    },
+    {
+      "id": "proxmox_ip_neigh_optional",
+      "description": "ARP/neighbor sample on seed node (optional)",
+      "default_interval_seconds": 900,
+      "failure_mode": "omit_layer",
+      "env_enable": "IT_COLLECT_IP_NEIGH=1",
+      "script": "scripts/it-ops/lib/collect_inventory_remote.py"
+    },
+    {
+      "id": "hardware_poll",
+      "description": "Cluster hardware / connected inventory markdown",
+      "default_interval_seconds": 604800,
+      "failure_mode": "stale_banner",
+      "script": "scripts/verify/poll-proxmox-cluster-hardware.sh"
+    },
+    {
+      "id": "npm_proxy_hosts",
+      "description": "NPMplus proxy host rows (logical edge map)",
+      "default_interval_seconds": 3600,
+      "failure_mode": "stale_banner",
+      "status": "planned_phase_2",
+      "script": "scripts/nginx-proxy-manager/update-npmplus-proxy-hosts-api.sh"
+    },
+    {
+      "id": "unifi_devices",
+      "description": "UniFi Network API (UDM) devices and ports",
+      "default_interval_seconds": 3600,
+      "failure_mode": "stale_banner",
+      "status": "planned_phase_2"
+    }
+  ],
+  "ui_rules": [
+    "Do not present live panels without a visible collected_at (or equivalent mtime) per domain.",
+    "If seed_unreachable or collector error appears in drift notes, show a warning banner, not silent fallback to markdown-only truth."
+  ]
+}
--- a/config/nginx/info-defi-oracle-io.site.conf
+++ b/config/nginx/info-defi-oracle-io.site.conf
@@ -0,0 +1,35 @@
+# Chain 138 info SPA (Vite dist/) — SPA fallback for client routes.
+# Deploy: scripts/deployment/sync-info-defi-oracle-to-vmid2400.sh
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name info.defi-oracle.io www.info.defi-oracle.io;
+
+    root /var/www/info.defi-oracle.io/html;
+    index index.html;
+
+    access_log /var/log/nginx/info-defi-oracle-access.log;
+    error_log /var/log/nginx/info-defi-oracle-error.log;
+
+    location = /health {
+        access_log off;
+        add_header Content-Type text/plain;
+        return 200 "healthy\n";
+    }
+
+    # Token-aggregation API (Blockscout CT) — same-origin for LAN + HTTPS (avoids mixed content / public 429).
+    # Upstream: IP_BLOCKSCOUT in config/ip-addresses.conf
+    location /token-aggregation/ {
+        proxy_pass http://192.168.11.140/token-aggregation/;
+        proxy_http_version 1.1;
+        proxy_set_header Host 192.168.11.140;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 120s;
+    }
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}
--- a/config/nginx/omdnl-org.site.conf
+++ b/config/nginx/omdnl-org.site.conf
@@ -0,0 +1,24 @@
+# Static landing: https://omdnl.org
+# Deploy: scripts/deployment/sync-omdnl-org-static-to-ct.sh
+# Provision CT + nginx: scripts/deployment/provision-omdnl-org-web-lxc.sh
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name omdnl.org www.omdnl.org;
+
+    root /var/www/omdnl.org/html;
+    index index.html;
+
+    access_log /var/log/nginx/omdnl-org-access.log;
+    error_log /var/log/nginx/omdnl-org-error.log;
+
+    location = /health {
+        access_log off;
+        add_header Content-Type text/plain;
+        return 200 "healthy\n";
+    }
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}
--- a/config/op-stack-superchain/README.md
+++ b/config/op-stack-superchain/README.md
@@ -0,0 +1,34 @@
+# OP Stack Standard Rollup (Superchain) — repo scaffolding
+
+**Purpose:** Track **Ethereum mainnet** Standard Rollup work **alongside** Besu **Chain 138** (EIP-155:138). The OP Stack L2 is a **separate network** with its **own chain ID** (do **not** reuse `138` for the rollup unless you accept wallet/RPC collisions with Besu).
+
+**Runbook:** [docs/03-deployment/OP_STACK_STANDARD_ROLLUP_SUPERCHAIN_RUNBOOK.md](../../docs/03-deployment/OP_STACK_STANDARD_ROLLUP_SUPERCHAIN_RUNBOOK.md)  
+**Bridge notes (L2 ↔ Besu 138):** [docs/03-deployment/OP_STACK_L2_AND_BESU138_BRIDGE_NOTES.md](../../docs/03-deployment/OP_STACK_L2_AND_BESU138_BRIDGE_NOTES.md)  
+**Scripts:** [scripts/op-stack/README.md](../../scripts/op-stack/README.md)
+
+## Canonical governance inputs (freeze before mainnet)
+
+Copy these into your CMDB and pin **release tags / commit hashes** that match [standard-versions-mainnet.toml](https://github.com/ethereum-optimism/superchain-registry/blob/main/validation/standard/standard-versions-mainnet.toml):
+
+| Artifact | URL |
+|----------|-----|
+| Standard Rollup Charter | [Standard Rollup Charter (OPerating-manual)](https://github.com/ethereum-optimism/OPerating-manual/blob/main/policies/Standard%20Rollup%20Charter.md) |
+| Blockspace / charter overview | [Optimism docs](https://docs.optimism.io/op-stack/protocol/blockspace-charter) |
+| `standard-versions-mainnet.toml` | [superchain-registry](https://github.com/ethereum-optimism/superchain-registry/blob/main/validation/standard/standard-versions-mainnet.toml) |
+| `standard-config-params-mainnet.toml` | [superchain-registry](https://github.com/ethereum-optimism/superchain-registry/blob/main/validation/standard/standard-config-params-mainnet.toml) |
+| `standard-config-roles-mainnet.toml` | [superchain-registry](https://github.com/ethereum-optimism/superchain-registry/blob/main/validation/standard/standard-config-roles-mainnet.toml) |
+
+**Offline copy:** `bash scripts/op-stack/fetch-standard-mainnet-toml.sh` writes to `cache/` (gitignored).
+
+## Files in this directory
+
+| File | Use |
+|------|-----|
+| `op-stack-l2.example.env` | Copy to a **non-repo** path or `deployed/*.env` (gitignored); set RPC URLs and **L2 chain id**. |
+| `pinned-versions.manifest.example.yaml` | Copy to `deployed/pinned-versions.manifest.yaml` after locking versions; keep out of git if it embeds internal notes. |
+| `key-custody-checklist.example.md` | Copy to internal wiki/CMDB; document multisig + service keys. |
+| `deployed/` | Operator-generated genesis/rollup snippets, address lists, manifests (see `deployed/README.md`). |
+
+## Law of Chains
+
+Standard Rollup alignment includes [Law of Chains](https://github.com/ethereum-optimism/OPerating-manual/blob/main/Law%20of%20Chains.md) expectations; review with legal/ops before mainnet.
--- a/config/op-stack-superchain/cache/.gitignore
+++ b/config/op-stack-superchain/cache/.gitignore
@@ -0,0 +1,3 @@
+*
+!.gitignore
+!README.md
--- a/config/op-stack-superchain/cache/README.md
+++ b/config/op-stack-superchain/cache/README.md
@@ -0,0 +1,9 @@
+# Cached Standard Rollup TOML (gitignored)
+
+Run from repo root:
+
+```bash
+bash scripts/op-stack/fetch-standard-mainnet-toml.sh
+```
+
+Refreshes governance validation inputs from [superchain-registry](https://github.com/ethereum-optimism/superchain-registry) `validation/standard/` for offline review.
--- a/config/op-stack-superchain/deployed/.gitignore
+++ b/config/op-stack-superchain/deployed/.gitignore
@@ -0,0 +1,5 @@
+*
+!.gitignore
+!README.md
+!*.example
+!*.example.*
--- a/config/op-stack-superchain/deployed/README.md
+++ b/config/op-stack-superchain/deployed/README.md
@@ -0,0 +1,12 @@
+# OP Stack deployed artifacts (gitignored by default)
+
+Store **non-secret** deployment outputs here for operator reference (optional staging in git: use `*.example` suffix only).
+
+Suggested files after mainnet deploy:
+
+- `l1-addresses.json` — OP system contract addresses from `op-deployer` output
+- `rollup.json` / genesis excerpts — as produced by your pinned `op-deployer` version (redact if large; often kept in artifact store instead)
+- `pinned-versions.manifest.yaml` — filled copy of `../pinned-versions.manifest.example.yaml`
+- `registry-pr-url.txt` — link to superchain-registry PR
+
+**Secrets:** Never commit private keys or `*.env` with keys. Use host paths or secret managers.
--- a/config/op-stack-superchain/key-custody-checklist.example.md
+++ b/config/op-stack-superchain/key-custody-checklist.example.md
@@ -0,0 +1,29 @@
+# Key custody checklist (Standard Rollup) — example
+
+Copy this checklist to your internal CMDB. **Do not** commit filled copies with addresses of multisig signers if classified.
+
+## Roles (separate keys per role in production)
+
+- [ ] Sequencer signing (L2 block production)
+- [ ] Batcher (L1 transaction submission)
+- [ ] Proposer (L2 output roots on L1)
+- [ ] Challenger (fault-proof participation)
+- [ ] L1 deployer (one-time or gated contract deploy)
+- [ ] Upgrade / admin (multisig; align with [standard-config-roles-mainnet.toml](https://github.com/ethereum-optimism/superchain-registry/blob/main/validation/standard/standard-config-roles-mainnet.toml) and charter)
+
+## Custody
+
+- [ ] Multisig vendor + threshold recorded
+- [ ] Hardware / institutional custody for hot keys where required
+- [ ] Break-glass procedure documented
+- [ ] Key rotation and incident response contacts
+
+## Funding
+
+- [ ] L1 ETH budget for deploy, batching, proposals, challenger bonds
+- [ ] L2 gas funding for operational tests
+
+## Evidence
+
+- [ ] `pinned-versions.manifest.yaml` filled and stored with deploy artifacts
+- [ ] Addresses recorded under `config/op-stack-superchain/deployed/` (non-secret files only)
--- a/config/op-stack-superchain/op-stack-l2.example.env
+++ b/config/op-stack-superchain/op-stack-l2.example.env
@@ -0,0 +1,16 @@
+# OP Stack L2 operator env (example — copy to deployed/op-stack-l2.env or host path; do not commit secrets)
+#
+# L2 chain ID: MUST be distinct from Besu DBIS Chain 138 (138). Choose a registered-unique ID per superchain-registry / chainlist policy.
+# OP_STACK_L2_CHAIN_ID=
+
+# Ethereum L1 (mainnet or Sepolia rehearsal)
+# ETH_MAINNET_RPC_URL=https://eth.llamarpc.com
+# ETH_SEPOLIA_RPC_URL=https://rpc.sepolia.org
+
+# L2 sequencer / replica RPC (your infra)
+# OP_STACK_L2_RPC_URL=http://127.0.0.1:8545
+
+# Deployer / batcher / proposer (use separate keys in production; never commit private keys)
+# DEPLOYER_PRIVATE_KEY=
+# BATCHER_PRIVATE_KEY=
+# PROPOSER_PRIVATE_KEY=
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				{"success":true,"errors":[],"messages":[],"result":{"tunnel_id":"892bd3fe-c6fa-4ddf-8b60-a8ed2b849c3d","version":14,"config":{"ingress":[{"service":"https://192.168.11.169:443","hostname":"rpc-core-2.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-alltra.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-alltra-2.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-alltra-3.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-hybx.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-hybx-2.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"rpc-hybx-3.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"cacti-alltra.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"https://192.168.11.169:443","hostname":"cacti-hybx.d-bis.org","originRequest":{"noTLSVerify":true}},{"service":"http_status:404"}],"warp-routing":{"enabled":false}},"source":"cloudflare","created_at":"2026-04-05T22:11:28.363368Z"}}