docs: Ledger Live integration, contract deploy learnings, NEXT_STEPS updates

- ADD_CHAIN138_TO_LEDGER_LIVE: Ledger form done; public code review repo bis-innovations/LedgerLive; init/push commands - CONTRACT_DEPLOYMENT_RUNBOOK: Chain 138 gas price 1 gwei, 36-addr check, TransactionMirror workaround - CONTRACT_*: AddressMapper, MirrorManager deployed 2026-02-12; 36-address on-chain check - NEXT_STEPS_FOR_YOU: Ledger done; steps completable now (no LAN); run-completable-tasks-from-anywhere - MASTER_INDEX, OPERATOR_OPTIONAL, SMART_CONTRACTS_INVENTORY_SIMPLE: updates - LEDGER_BLOCKCHAIN_INTEGRATION_COMPLETE: bis-innovations/LedgerLive reference Co-authored-by: Cursor <cursoragent@cursor.com>
2026-02-12 15:46:57 -08:00
parent cc8dcaf356
commit fbda1b4beb
5114 changed files with 498901 additions and 4567 deletions
--- a/scripts/dev-vm/add-as4-411-submodule-to-sankofa.sh
+++ b/scripts/dev-vm/add-as4-411-submodule-to-sankofa.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Add as4-411 as a git submodule to Sankofa (Phoenix) for deployable LogicApps-like solution in Sankofa Marketplace.
+# Run after as4-411 has been pushed to Gitea: GITEA_TOKEN=xxx bash scripts/dev-vm/push-all-projects-to-gitea.sh
+# Usage: bash scripts/dev-vm/add-as4-411-submodule-to-sankofa.sh
+# Optional: SANKOFA_DIR=/path/to/Sankofa
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+[ -f "$PROJECT_ROOT/.env" ] && set +u && source "$PROJECT_ROOT/.env" 2>/dev/null || true && set -u
+
+GITEA_ORG="${GITEA_ORG:-d-bis}"
+GITEA_URL="${GITEA_URL:-https://gitea.d-bis.org}"
+SANKOFA_DIR="${SANKOFA_DIR:-/home/intlc/projects/Sankofa}"
+SUBMODULE_PATH="marketplace/as4-411"
+REPO_URL="$GITEA_URL/$GITEA_ORG/as4-411.git"
+
+if [ ! -d "$SANKOFA_DIR/.git" ]; then
+  echo "Sankofa not found or not a git repo: $SANKOFA_DIR"
+  exit 1
+fi
+
+if [ -f "$SANKOFA_DIR/.gitmodules" ] && grep -q "path = $SUBMODULE_PATH" "$SANKOFA_DIR/.gitmodules" 2>/dev/null; then
+  echo "Submodule $SUBMODULE_PATH already present in Sankofa."
+  exit 0
+fi
+
+echo "Adding as4-411 as submodule at $SUBMODULE_PATH in Sankofa (Phoenix / Sankofa Marketplace)"
+cd "$SANKOFA_DIR"
+git submodule add "$REPO_URL" "$SUBMODULE_PATH"
+echo "Done. Commit with: git add .gitmodules $SUBMODULE_PATH && git commit -m 'Add as4-411 as marketplace submodule (LogicApps-like deployable)'"
--- a/scripts/dev-vm/add-dev-user-ssh-keys.sh
+++ b/scripts/dev-vm/add-dev-user-ssh-keys.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Add SSH public key(s) to dev1, dev2, dev3, dev4 on Dev VM (CT 5700).
+# Usage:
+#   PUBLIC_KEY="$(cat ~/.ssh/id_ed25519.pub)" bash scripts/dev-vm/add-dev-user-ssh-keys.sh
+#   bash scripts/dev-vm/add-dev-user-ssh-keys.sh /path/to/key.pub
+#   bash scripts/dev-vm/add-dev-user-ssh-keys.sh   # uses ~/.ssh/id_ed25519.pub or id_rsa.pub
+# Requires: SSH as root to the Proxmox host that runs CT 5700 (default: PROXMOX_R630_01).
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+source "$PROJECT_ROOT/config/ip-addresses.conf" 2>/dev/null || true
+[ -f "$PROJECT_ROOT/.env" ] && set +u && source "$PROJECT_ROOT/.env" 2>/dev/null || true && set -u
+
+VMID=5700
+PROXMOX_HOST="${PROXMOX_HOST:-${PROXMOX_R630_01:-192.168.11.11}}"
+USERS="dev1 dev2 dev3 dev4"
+
+if [ -n "${PUBLIC_KEY:-}" ]; then
+  KEY="$PUBLIC_KEY"
+elif [ -n "${1:-}" ] && [ -f "$1" ]; then
+  KEY=$(cat "$1")
+elif [ -f "$HOME/.ssh/id_ed25519.pub" ]; then
+  KEY=$(cat "$HOME/.ssh/id_ed25519.pub")
+elif [ -f "$HOME/.ssh/id_rsa.pub" ]; then
+  KEY=$(cat "$HOME/.ssh/id_rsa.pub")
+else
+  echo "No public key found. Set PUBLIC_KEY= or pass a key file, or add ~/.ssh/id_ed25519.pub / id_rsa.pub"
+  exit 1
+fi
+
+KEY_B64=$(printf '%s\n' "$KEY" | base64 -w0)
+
+echo "Adding SSH key to $USERS on CT $VMID (host $PROXMOX_HOST)..."
+for u in $USERS; do
+  ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new root@"$PROXMOX_HOST" \
+    "pct exec $VMID -- bash -c 'mkdir -p /home/$u/.ssh && chmod 700 /home/$u/.ssh && echo \"$KEY_B64\" | base64 -d >> /home/$u/.ssh/authorized_keys && chmod 600 /home/$u/.ssh/authorized_keys && chown -R $u:$u /home/$u/.ssh'"
+  echo "  OK: $u"
+done
+echo "Done. Test: ssh dev1@${IP_DEV_VM:-192.168.11.60}"
--- a/scripts/dev-vm/add-gitea-webhook-phoenix.sh
+++ b/scripts/dev-vm/add-gitea-webhook-phoenix.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Add Gitea webhook for Phoenix deploy to a repository.
+# Usage: GITEA_TOKEN=xxx PHOENIX_WEBHOOK_URL=https://host:4001/webhook/gitea bash add-gitea-webhook-phoenix.sh [owner/repo]
+# Example: GITEA_TOKEN=xxx PHOENIX_WEBHOOK_URL=http://192.168.11.60:4001/webhook/gitea bash add-gitea-webhook-phoenix.sh d-bis/proxmox
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+[ -f "$PROJECT_ROOT/.env" ] && set +u && source "$PROJECT_ROOT/.env" 2>/dev/null || true && set -u
+
+GITEA_URL="${GITEA_URL:-https://gitea.d-bis.org}"
+GITEA_TOKEN="${GITEA_TOKEN:-}"
+PHOENIX_WEBHOOK_URL="${PHOENIX_WEBHOOK_URL:-}"
+REPO="${1:-d-bis/proxmox}"
+
+if [ -z "$GITEA_TOKEN" ]; then
+  echo "Set GITEA_TOKEN (from Gitea Settings → Applications)"
+  exit 1
+fi
+if [ -z "$PHOENIX_WEBHOOK_URL" ]; then
+  echo "Set PHOENIX_WEBHOOK_URL (e.g. http://192.168.11.60:4001/webhook/gitea)"
+  exit 1
+fi
+
+API="${GITEA_URL%/}/api/v1"
+OWNER="${REPO%%/*}"
+REPO_NAME="${REPO#*/}"
+
+# Check if webhook already exists
+EXISTING=$(curl -s -H "Authorization: token $GITEA_TOKEN" "$API/repos/$OWNER/$REPO_NAME/hooks" | jq -r ".[] | select(.config.url == \"$PHOENIX_WEBHOOK_URL\") | .id" 2>/dev/null || true)
+if [ -n "$EXISTING" ]; then
+  echo "Webhook already exists for $REPO -> $PHOENIX_WEBHOOK_URL (id=$EXISTING)"
+  exit 0
+fi
+
+# Create webhook
+BODY=$(jq -n \
+  --arg url "$PHOENIX_WEBHOOK_URL" \
+  '{
+    type: "gitea",
+    config: {
+      url: $url,
+      content_type: "json"
+    },
+    events: ["push", "create"],
+    active: true
+  }')
+
+RESP=$(curl -s -w "\n%{http_code}" -X POST "$API/repos/$OWNER/$REPO_NAME/hooks" \
+  -H "Authorization: token $GITEA_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d "$BODY")
+HTTP=$(echo "$RESP" | tail -1)
+BODY=$(echo "$RESP" | sed '$d')
+
+if [ "$HTTP" = "201" ]; then
+  echo "Webhook added for $REPO -> $PHOENIX_WEBHOOK_URL"
+else
+  echo "Failed ($HTTP): $BODY"
+  exit 1
+fi
--- a/scripts/dev-vm/gitea-create-orgs-and-repos.sh
+++ b/scripts/dev-vm/gitea-create-orgs-and-repos.sh
@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+# Create Gitea organization(s) and repositories via API.
+# Usage: GITEA_TOKEN=xxx bash scripts/dev-vm/gitea-create-orgs-and-repos.sh [--dry-run]
+# Create token at: https://gitea.d-bis.org/user/settings/applications (scopes: write:organization, write:repository)
+# Optional: GITEA_ORG=myorg REPO_NAMES="proxmox dbis_core ..." (default org: d-bis; repos from list or discover)
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+source "$PROJECT_ROOT/config/ip-addresses.conf" 2>/dev/null || true
+[ -f "$PROJECT_ROOT/.env" ] && set +u && source "$PROJECT_ROOT/.env" 2>/dev/null || true && set -u
+
+GITEA_URL="${GITEA_URL:-https://gitea.d-bis.org}"
+# GITEA_TOKEN from .env or environment
+# Token from Gitea: Settings → Applications → Generate New Token (write:organization, write:repository)
+# Or set GITEA_USER + GITEA_PASSWORD to create a token automatically (scopes: write:organization, write:repository)
+GITEA_TOKEN="${GITEA_TOKEN:-}"
+GITEA_USER="${GITEA_USER:-}"
+GITEA_PASSWORD="${GITEA_PASSWORD:-}"
+DRY_RUN=false
+[[ "${1:-}" == "--dry-run" ]] && DRY_RUN=true
+
+# Default org and repos (override with env)
+GITEA_ORG="${GITEA_ORG:-d-bis}"
+REPO_NAMES="${REPO_NAMES:-proxmox dbis_core explorer-monorepo virtual-banker alltra-lifi-settlement smom-dbis-138 unifi-api metamask-integration mcp-omada mcp-proxmox mcp-unifi the-order miracles_in_motion rpc-translator-138 token-lists forge-verification-proxy site-manager-api multi-chain-execution}"
+
+# Create token from username/password if needed
+if [ -z "$GITEA_TOKEN" ] && [ -n "$GITEA_USER" ] && [ -n "$GITEA_PASSWORD" ]; then
+  echo "Creating token for $GITEA_USER..."
+  TOKEN_RESP=$(curl -s -X POST "${GITEA_URL%/}/api/v1/users/${GITEA_USER}/tokens" \
+    -H "Content-Type: application/json" -u "$GITEA_USER:$GITEA_PASSWORD" \
+    -d '{"name":"org-repo-setup","scopes":["write:organization","write:repository"]}')
+  GITEA_TOKEN=$(echo "$TOKEN_RESP" | jq -r '.sha1 // .token // empty')
+  if [ -z "$GITEA_TOKEN" ] || [ "$GITEA_TOKEN" = "null" ]; then
+    echo "Failed to create token: $TOKEN_RESP"
+    exit 1
+  fi
+  echo "Token created."
+fi
+if [ -z "$GITEA_TOKEN" ]; then
+  echo "Set GITEA_TOKEN, or GITEA_USER + GITEA_PASSWORD. Create token at: $GITEA_URL/user/settings/applications (scopes: write:organization, write:repository)"
+  exit 1
+fi
+
+API="${GITEA_URL%/}/api/v1"
+AUTH="Authorization: token $GITEA_TOKEN"
+
+# Create organization
+create_org() {
+  local org="$1"
+  local full_name="${2:-$org}"
+  if $DRY_RUN; then
+    echo "[DRY-RUN] Would create org: $org ($full_name)"
+    return 0
+  fi
+  local resp
+  resp=$(curl -s -w "\n%{http_code}" -X POST "$API/orgs" \
+    -H "Content-Type: application/json" -H "$AUTH" \
+    -d "{\"username\":\"$org\",\"full_name\":\"$full_name\",\"visibility\":\"public\"}")
+  local code
+  code=$(echo "$resp" | tail -1)
+  local body
+  body=$(echo "$resp" | sed '$d')
+  if [ "$code" = "201" ]; then
+    echo "  Created org: $org"
+    return 0
+  fi
+  if echo "$body" | grep -q "already exists\|Username .* is already"; then
+    echo "  Org $org already exists"
+    return 0
+  fi
+  echo "  Failed to create org $org: HTTP $code — $body"
+  return 1
+}
+
+# Create repository in org
+create_repo() {
+  local org="$1"
+  local name="$2"
+  local desc="${3:-}"
+  if $DRY_RUN; then
+    echo "[DRY-RUN] Would create repo: $org/$name"
+    return 0
+  fi
+  local payload="{\"name\":\"$name\",\"private\":false}"
+  [ -n "$desc" ] && payload=$(echo "$payload" | jq -c --arg d "$desc" '. + {description:$d}')
+  local resp
+  resp=$(curl -s -w "\n%{http_code}" -X POST "$API/orgs/$org/repos" \
+    -H "Content-Type: application/json" -H "$AUTH" -d "$payload")
+  local code
+  code=$(echo "$resp" | tail -1)
+  local body
+  body=$(echo "$resp" | sed '$d')
+  if [ "$code" = "201" ]; then
+    echo "  Created repo: $org/$name"
+    return 0
+  fi
+  if echo "$body" | grep -q "already exists\|Repository .* already"; then
+    echo "  Repo $org/$name already exists"
+    return 0
+  fi
+  echo "  Failed to create repo $org/$name: HTTP $code — $body"
+  return 1
+}
+
+echo "Gitea: $GITEA_URL | Org: $GITEA_ORG | DRY_RUN=$DRY_RUN"
+echo "Creating org: $GITEA_ORG"
+create_org "$GITEA_ORG" "D-BIS" || true
+echo "Creating repos in $GITEA_ORG:"
+for r in $REPO_NAMES; do
+  create_repo "$GITEA_ORG" "$r" "" || true
+done
+echo "Done. Add remote and push: git remote add gitea $GITEA_URL/$GITEA_ORG/<repo>.git && git push -u gitea main"
--- a/scripts/dev-vm/gitignore-default.txt
+++ b/scripts/dev-vm/gitignore-default.txt
@@ -0,0 +1,49 @@
+# Dependencies
+node_modules/
+.pnpm-store/
+vendor/
+
+# Package manager lock files (optional: uncomment to ignore)
+# package-lock.json
+# yarn.lock
+
+# Environment and secrets
+.env
+.env.local
+.env.*.local
+*.env.backup
+.env.backup.*
+
+# Logs and temp
+*.log
+logs/
+*.tmp
+*.temp
+*.tmp.*
+
+# OS
+.DS_Store
+Thumbs.db
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# Build / output
+dist/
+build/
+.next/
+out/
+*.pyc
+__pycache__/
+.eggs/
+*.egg-info/
+.coverage
+htmlcov/
+
+# Optional
+.reports/
+reports/
--- a/scripts/dev-vm/init-projects-git-and-push.sh
+++ b/scripts/dev-vm/init-projects-git-and-push.sh
@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# Add .git, .gitignore, and README.md to all project directories under PROJECTS_DIR that don't have .git;
+# then run push-all-projects-to-gitea.sh to create Gitea repos and push.
+# Usage: bash scripts/dev-vm/init-projects-git-and-push.sh [--dry-run] [--no-push]
+# Optional: PROJECTS_DIR=/path
+# Requires: run from proxmox repo root; GITEA_TOKEN in env or root .env for push
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+[ -f "$PROJECT_ROOT/.env" ] && set +u && source "$PROJECT_ROOT/.env" 2>/dev/null || true && set -u
+
+PROJECTS_DIR="${PROJECTS_DIR:-/home/intlc/projects}"
+DRY_RUN=false
+NO_PUSH=false
+[[ "${1:-}" == "--dry-run" ]] && DRY_RUN=true
+[[ "${1:-}" == "--no-push" ]] && NO_PUSH=true
+
+# Directories to skip (not treated as projects)
+SKIP_NAMES=(
+  __pycache__
+  archives
+  logs
+  .git
+)
+
+# Default .gitignore content (multi-language)
+GITIGNORE_TEMPLATE="$SCRIPT_DIR/gitignore-default.txt"
+
+discover_no_git_dirs() {
+  for d in "$PROJECTS_DIR"/*/; do
+    [ -d "${d}.git" ] && continue
+    name=$(basename "$d")
+    for skip in "${SKIP_NAMES[@]}"; do
+      [[ "$name" == "$skip" ]] && continue 2
+    done
+    echo "$d"
+  done 2>/dev/null | sort -u
+}
+
+ensure_gitignore() {
+  local dir="$1"
+  if [ -f "$dir/.gitignore" ]; then
+    return 0
+  fi
+  if [ -f "$GITIGNORE_TEMPLATE" ]; then
+    cp "$GITIGNORE_TEMPLATE" "$dir/.gitignore"
+    echo "  Added .gitignore"
+  else
+    printf '# Dependencies\nnode_modules/\n# Env\n.env\n.env.*\n# OS\n.DS_Store\n# Build\ndist/\nbuild/\n' > "$dir/.gitignore"
+    echo "  Added minimal .gitignore"
+  fi
+}
+
+ensure_readme() {
+  local dir="$1"
+  local name="$2"
+  if [ -f "$dir/README.md" ]; then
+    return 0
+  fi
+  cat > "$dir/README.md" << EOF
+# $name
+
+Project under \`$PROJECTS_DIR/$name\`.
+
+## Overview
+
+(Add project description and setup instructions here.)
+EOF
+  echo "  Added README.md"
+}
+
+init_and_commit() {
+  local dir="$1"
+  local name="$2"
+  if $DRY_RUN; then
+    echo "  [DRY-RUN] Would: git init, add .gitignore, README.md, initial commit"
+    return 0
+  fi
+  (cd "$dir" && git init -b main 2>/dev/null) || (cd "$dir" && git init && git branch -M main)
+  ensure_gitignore "$dir"
+  ensure_readme "$dir" "$name"
+  (cd "$dir" && git add -A && git status --short)
+  if (cd "$dir" && git diff --cached --quiet); then
+    echo "  No changes to commit (already tracked or empty)"
+  else
+    (cd "$dir" && git commit -m "Initial commit: add .gitignore and README")
+    echo "  Initial commit done"
+  fi
+}
+
+echo "Projects dir: $PROJECTS_DIR | DRY_RUN=$DRY_RUN | NO_PUSH=$NO_PUSH"
+DIRS=()
+while read -r d; do
+  [ -n "$d" ] && DIRS+=("$d")
+done < <(discover_no_git_dirs)
+
+echo "Found ${#DIRS[@]} directories without .git. Initializing..."
+for d in "${DIRS[@]}"; do
+  name=$(basename "$d")
+  echo "--- $name ---"
+  init_and_commit "$d" "$name" || true
+done
+echo "Done initializing."
+
+if [ "$NO_PUSH" = true ]; then
+  echo "Skipping push (--no-push). Run: bash scripts/dev-vm/push-all-projects-to-gitea.sh"
+  exit 0
+fi
+if $DRY_RUN; then
+  echo "Dry-run: skipping push. Run without --dry-run to push."
+  exit 0
+fi
+
+echo "Running push-all-projects-to-gitea.sh..."
+exec bash "$SCRIPT_DIR/push-all-projects-to-gitea.sh"
--- a/scripts/dev-vm/push-all-projects-to-gitea.sh
+++ b/scripts/dev-vm/push-all-projects-to-gitea.sh
@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+# Create Gitea repos for all projects under PROJECTS_DIR (if missing) and push each.
+# Usage: GITEA_TOKEN=xxx bash scripts/dev-vm/push-all-projects-to-gitea.sh [--dry-run] [--create-only]
+# Optional: PROJECTS_DIR=/path REPO_NAMES="a b c" to limit repos.
+# Requires: run from proxmox repo root; GITEA_TOKEN in env or root .env
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+[ -f "$PROJECT_ROOT/.env" ] && set +u && source "$PROJECT_ROOT/.env" 2>/dev/null || true && set -u
+
+GITEA_ORG="${GITEA_ORG:-d-bis}"
+GITEA_URL="${GITEA_URL:-https://gitea.d-bis.org}"
+PROJECTS_DIR="${PROJECTS_DIR:-/home/intlc/projects}"
+DRY_RUN=false
+CREATE_ONLY=false
+[[ "${1:-}" == "--dry-run" ]] && DRY_RUN=true
+[[ "${1:-}" == "--create-only" ]] && CREATE_ONLY=true
+
+if [ -z "${GITEA_TOKEN:-}" ] && [ "$DRY_RUN" = false ]; then
+  echo "Set GITEA_TOKEN to create repos and push (e.g. from Gitea Settings → Applications)."
+  exit 1
+fi
+
+API="${GITEA_URL%/}/api/v1"
+AUTH=""
+[ -n "${GITEA_TOKEN:-}" ] && AUTH="Authorization: token $GITEA_TOKEN"
+
+# Repos to skip (e.g. upstream SDKs that are too large or not our projects)
+SKIP_REPOS=( js )
+
+# Discover git repos: direct children of PROJECTS_DIR that have .git
+discover_repos() {
+  for d in "$PROJECTS_DIR"/*/; do
+    [ -d "${d}.git" ] || continue
+    name=$(basename "$d")
+    for skip in "${SKIP_REPOS[@]}"; do
+      [[ "$name" == "$skip" ]] && continue 2
+    done
+    echo "${d%/}"
+  done 2>/dev/null | sort -u
+}
+
+# Ensure Gitea repo exists; create if missing
+ensure_repo() {
+  local repo_name="$1"
+  if $DRY_RUN && [ -z "${GITEA_TOKEN:-}" ]; then
+    echo "  [DRY-RUN] $repo_name: would ensure exists"
+    return 0
+  fi
+  if $DRY_RUN; then
+    echo "  [DRY-RUN] Would create repo if missing: $GITEA_ORG/$repo_name"
+    return 0
+  fi
+  local resp code body
+  resp=$(curl -s -w "\n%{http_code}" -X GET "$API/repos/$GITEA_ORG/$repo_name" ${AUTH:+-H "$AUTH"})
+  code=$(echo "$resp" | tail -1)
+  if [ "$code" = "200" ]; then
+    echo "  $repo_name: exists"
+    return 0
+  fi
+  body=$(curl -s -w "\n%{http_code}" -X POST "$API/orgs/$GITEA_ORG/repos" \
+    -H "Content-Type: application/json" ${AUTH:+-H "$AUTH"} \
+    -d "{\"name\":\"$repo_name\",\"private\":false}")
+  code=$(echo "$body" | tail -1)
+  if [ "$code" = "201" ]; then
+    echo "  $repo_name: created"
+    return 0
+  fi
+  if echo "$body" | grep -q "already exists\|already exists"; then
+    echo "  $repo_name: exists"
+    return 0
+  fi
+  echo "  $repo_name: failed (HTTP $code)" >&2
+  return 1
+}
+
+# Push one repo (branch = current branch)
+push_repo() {
+  local dir="$1"
+  local repo_name
+  repo_name=$(basename "$dir")
+  local branch
+  branch=$(git -C "$dir" branch --show-current 2>/dev/null || echo "main")
+  if $DRY_RUN; then
+    echo "  [DRY-RUN] Would push $repo_name (branch $branch)"
+    return 0
+  fi
+  [ -z "${GITEA_TOKEN:-}" ] && { echo "  $repo_name: skip (no GITEA_TOKEN)" >&2; return 1; }
+  if ! git -C "$dir" remote get-url gitea &>/dev/null; then
+    git -C "$dir" remote add gitea "$GITEA_URL/$GITEA_ORG/$repo_name.git"
+  fi
+  git -C "$dir" push "https://${GITEA_TOKEN}@${GITEA_URL#https://}/$GITEA_ORG/$repo_name.git" "$branch" --set-upstream 2>&1 && echo "  $repo_name: pushed ($branch)" || { echo "  $repo_name: push failed" >&2; return 1; }
+}
+
+echo "Gitea: $GITEA_URL | Org: $GITEA_ORG | Projects dir: $PROJECTS_DIR | DRY_RUN=$DRY_RUN | CREATE_ONLY=$CREATE_ONLY"
+REPOS=()
+while read -r d; do
+  [ -n "$d" ] && REPOS+=("$d")
+done < <(discover_repos)
+
+echo "Discovered ${#REPOS[@]} repos. Ensuring Gitea repos exist..."
+for d in "${REPOS[@]}"; do
+  ensure_repo "$(basename "$d")" || true
+done
+
+if [ "$CREATE_ONLY" = true ]; then
+  echo "Create-only: skipping push."
+  exit 0
+fi
+
+echo "Pushing..."
+for d in "${REPOS[@]}"; do
+  push_repo "$d" || true
+done
+echo "Done."
--- a/scripts/dev-vm/push-to-gitea.sh
+++ b/scripts/dev-vm/push-to-gitea.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Push current repo to Gitea (d-bis org). Uses GITEA_TOKEN for HTTPS auth.
+# Usage: GITEA_TOKEN=xxx bash scripts/dev-vm/push-to-gitea.sh
+# Or from repo root: GITEA_TOKEN=xxx bash scripts/dev-vm/push-to-gitea.sh
+# Run from each project dir, or set REPO_NAME and run from project root.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+[ -f "$PROJECT_ROOT/.env" ] && set +u && source "$PROJECT_ROOT/.env" 2>/dev/null || true && set -u
+GITEA_ORG="${GITEA_ORG:-d-bis}"
+GITEA_URL="${GITEA_URL:-https://gitea.d-bis.org}"
+
+# Use current directory if it's a git repo, else use PROJECT_ROOT (proxmox)
+if [ -d ".git" ]; then
+  REPO_NAME="${REPO_NAME:-$(basename "$PWD")}"
+elif [ -d "$PROJECT_ROOT/.git" ]; then
+  cd "$PROJECT_ROOT"
+  REPO_NAME="${REPO_NAME:-$(basename "$PWD")}"
+else
+  echo "Run from a git repo root (e.g. ~/projects/dbis_core), or set REPO_NAME and run from repo root."
+  exit 1
+fi
+
+if [ -z "${GITEA_TOKEN:-}" ]; then
+  echo "Set GITEA_TOKEN to push via HTTPS (e.g. from Gitea Settings → Applications)."
+  exit 1
+fi
+
+if ! git remote get-url gitea &>/dev/null; then
+  git remote add gitea "https://gitea.d-bis.org/${GITEA_ORG}/${REPO_NAME}.git"
+fi
+# Push using token for auth (URL embeds token for this push only)
+BRANCH=$(git branch --show-current)
+git push "https://${GITEA_TOKEN}@gitea.d-bis.org/${GITEA_ORG}/${REPO_NAME}.git" "$BRANCH" --set-upstream
+echo "Pushed $REPO_NAME (branch $BRANCH) to gitea."
--- a/scripts/dev-vm/rsync-projects-to-dev-vm.sh
+++ b/scripts/dev-vm/rsync-projects-to-dev-vm.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Rsync projects from local to Dev VM (5700). Run after SSH keys are added for dev1.
+# Usage: bash scripts/dev-vm/rsync-projects-to-dev-vm.sh [--dry-run]
+# Default target: dev1@192.168.11.60:/srv/projects/
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+source "$PROJECT_ROOT/config/ip-addresses.conf" 2>/dev/null || true
+
+DEV_USER="${DEV_USER:-dev1}"
+DEV_HOST="${IP_DEV_VM:-192.168.11.60}"
+# Source: parent of project root (e.g. /home/intlc/projects)
+SOURCE_DIR="${SOURCE_DIR:-$(dirname "$PROJECT_ROOT")}"
+DRY_RUN=""
+[[ "${1:-}" == "--dry-run" ]] && DRY_RUN="--dry-run -v"
+
+echo "Rsync: $SOURCE_DIR/ -> $DEV_USER@$DEV_HOST:/srv/projects/"
+echo "Excludes: .git, node_modules, .venv, venv, dist, .next, coverage, build, __pycache__, etc."
+rsync -avz $DRY_RUN \
+  --exclude='.git' \
+  --exclude='node_modules' \
+  --exclude='.cursor' \
+  --exclude='.venv' \
+  --exclude='venv' \
+  --exclude='__pycache__' \
+  --exclude='dist' \
+  --exclude='.next' \
+  --exclude='coverage' \
+  --exclude='build' \
+  --exclude='.turbo' \
+  --exclude='.pnpm-store' \
+  --exclude='.nx' \
+  --exclude='*.pyc' \
+  "$SOURCE_DIR/" "$DEV_USER@$DEV_HOST:/srv/projects/"
--- a/scripts/dev-vm/setup-act-runner.sh
+++ b/scripts/dev-vm/setup-act-runner.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Install and register act_runner for Gitea Actions on dev-vm (5700).
+# Usage: GITEA_RUNNER_REGISTRATION_TOKEN=xxx bash setup-act-runner.sh
+# Get token: https://gitea.d-bis.org/-/admin/actions/runners
+
+set -euo pipefail
+
+ACT_RUNNER_VERSION="${ACT_RUNNER_VERSION:-0.2.13}"
+INSTANCE="${INSTANCE:-http://192.168.11.60:3000}"
+WORK_DIR="${WORK_DIR:-/opt/act_runner}"
+TOKEN="${GITEA_RUNNER_REGISTRATION_TOKEN:-}"
+
+if [ -z "$TOKEN" ]; then
+  echo "Set GITEA_RUNNER_REGISTRATION_TOKEN"
+  exit 1
+fi
+
+mkdir -p "$WORK_DIR"
+cd "$WORK_DIR"
+
+ARCH=$(uname -m)
+case "$ARCH" in x86_64) ARCH="amd64" ;; aarch64|arm64) ARCH="arm64" ;; *) echo "Unsupported: $ARCH"; exit 1 ;; esac
+BINARY="act_runner-${ACT_RUNNER_VERSION}-linux-${ARCH}"
+URL="https://dl.gitea.com/act_runner/${ACT_RUNNER_VERSION}/${BINARY}"
+
+if [ ! -f "./act_runner" ]; then
+  curl -sL -o act_runner "$URL"
+fi
+chmod +x ./act_runner
+
+if [ ! -f .runner ]; then
+  ./act_runner register --no-interactive --instance "$INSTANCE" --token "$TOKEN"
+fi
+echo "Ready. Run: ./act_runner daemon"