Placeholders and What Needs to Be Completed — Master List
Last Updated: 2026-02-13
Purpose: Single list of every placeholder and what must be completed (code, config, docs, ops).
Completion pass (2026-02-13): OMNIS backend routes (POST/PUT budgets, POST documents/upload, PATCH profile) done; authController token blacklisting (in-memory + TOKEN_BLACKLIST_ENABLED); TezosRelayService Taquito skeleton + mock gated; Smart accounts .env.example + runbook; dbis_core Redis stub, Prometheus/risk comments, deal-execution tests skipped with ticket; CCIPLogger decision (omit unless monitoring); .bak listed and deprecated in BAK_FILES_DEPRECATION; deployment gaps (env table, TransactionMirror script, DEPLOYMENT_GAPS_COMPLETED); NPMplus HA and storage monitor already have ALERT_EMAIL/ALERT_WEBHOOK; deploy.sh TODO comments for migration/health; the-order legal-documents vendor integration README; root .gitignore (venv, pycache, .phase1).
Code generation pass (2026-02-12): PagerDuty API implemented (dbis_core alert.service); liquidity amountDecimal fix + future-work comments (dbis_core liquidity-limits); Sankofa Phoenix helpers getAuthUrl/validateToken/getUserInfo (OMNIS); BudgetForm/DocumentUpload/ProfileEditForm API wiring (OMNIS); authController token blacklist + deploy.sh health/migration note (OMNIS); court-efiling/e-signature/document-security integration comments (the-order); script alert env docs (monitor-ha-status, storage-monitor); token-aggregation README required env; TEZOS_CROSS_CHAIN_FINALITY placeholder note.
Related: GAPS_AND_RECOMMENDATIONS_CONSOLIDATED | PLACEHOLDERS_AND_TBD | REQUIRED_FIXES_UPDATES_GAPS | REMAINING_COMPONENTS_TASKS_AND_RECOMMENDATIONS | NOT_IMPLEMENTED_FULL_SCOPE (not implemented — design and full scope)
1. Security and secrets
| Placeholder |
Location |
What to complete |
| API keys in .env.example |
smom-dbis-138/services/token-aggregation/.env.example, root .env.example |
✅ Done — use your-coingecko-api-key, your-coinmarketcap-api-key. Rotate any keys if they were ever committed. |
| PRIVATE_KEY, JWT_SECRET, NPM_PASSWORD, etc. |
Root and project .env.example |
Keep as your-* placeholders; never commit real values. Document in MASTER_SECRETS_INVENTORY, API_KEYS_REQUIRED (if present). |
| OMNIS / dbis_core / the-order secrets |
Their .env / config |
Use your-* or empty in examples; document in MASTER_SECRETS_INVENTORY. |
2. Configuration and DNS
| Placeholder |
Location |
What to complete |
| the-order.sankofa.nexus |
ALL_VMIDS_ENDPOINTS, RPC_ENDPOINTS_MASTER |
When The Order portal is deployed: add NPMplus proxy host and document IP:port in RPC_ENDPOINTS_MASTER and ALL_VMIDS_ENDPOINTS. |
| Sankofa cutover plan |
SANKOFA_CUTOVER_PLAN |
Replace <TARGET_IP>, <TARGET_PORT>, and table TBDs with actual Sankofa service IPs/ports when deployed. |
| sankofa.nexus / phoenix.sankofa.nexus |
ALL_VMIDS_ENDPOINTS, RPC_ENDPOINTS_MASTER, DNS_NPMPLUS_VM |
Doc fix done: Correct targets: sankofa → 192.168.11.51:3000 (VMID 7801), phoenix → 192.168.11.50:4000 (VMID 7800). Operator: Ensure NPMplus proxy hosts use these, not 192.168.11.140. Only explorer.d-bis.org → .140. |
| Public blocks #2–#6 |
NETWORK_ARCHITECTURE, NETWORK_CONFIGURATION_MASTER |
Document when blocks are assigned or mark as “reserved”. |
| PROXMOX_HOST / PROXMOX_TOKEN_SECRET |
smom-dbis-138-proxmox/README.md |
Keep as proxmox.example.com, your-token-secret; document in deployment guide. |
3. smom-dbis-138 — Code placeholders
| Placeholder |
Location |
What to complete |
| AlltraAdapter fee |
contracts/bridge/adapters/evm/AlltraAdapter.sol |
getBridgeFee(): use configurable value (e.g. setBridgeFee). Update with actual ALL Mainnet fee when known; document in PLACEHOLDERS_AND_TBD. |
| Smart accounts kit |
script/smart-accounts/DeploySmartAccountsKit.s.sol |
✅ Done: .env.example has ENTRY_POINT, SMART_ACCOUNT_FACTORY, PAYMASTER; runbook has Smart accounts subsection. Script reads env; deploy EntryPoint/Factory externally and set env. |
| EnhancedSwapRouter |
contracts/bridge/trustless/EnhancedSwapRouter.sol |
Uniswap quoter / Balancer: document when pools exist; keep “return 0” placeholder until integrated. |
| DODOPMMProvider |
contracts/liquidity/providers/DODOPMMProvider.sol |
“For now, placeholder” — document oracle-driven flow; complete when DODO is integrated. |
| Quote service Fabric |
orchestration/bridge/quote-service.ts |
FABRIC_CHAIN_ID env (default 999). Set real chain ID when Fabric is integrated. |
| register-all-mainnet avgBlockTime |
TEZOS_CCIP_REMAINING_ITEMS |
Verify actual block time and set in script. |
| TezosRelayService |
services/tezos-relay/src/TezosRelayService.js |
✅ Skeleton done: Taquito/RPC path added; mock gated by MOCK_TEZOS_RELAY; runbook updated. Set TEZOS_MINTER_ADDRESS, TEZOS_ORACLE_SECRET_KEY for real mint. |
| Canonical token addresses |
services/token-aggregation/src/config/canonical-tokens.ts |
All from env; unset tokens omitted. Document required env vars (e.g. which *_ADDRESS_138 / *_ADDRESS_651940) in token-aggregation README and .env.example. |
| WETH bridges mainnet receiver |
script/deploy/bridge/DeployWETHBridges.s.sol |
Set MAINNET_WETH9_BRIDGE_ADDRESS and MAINNET_WETH10_BRIDGE_ADDRESS in env when configuring cross-chain destinations. |
| .bak files |
Various *.sol.bak, *.t.sol.bak |
✅ Done: Listed and deprecated in BAK_FILES_DEPRECATION; REQUIRED_FIXES §9 links there. |
4. dbis_core — Code placeholders
| Placeholder |
Location |
What to complete |
| as4-settlement liquidity |
src/core/settlement/as4-settlement/liquidity-limits.service.ts |
Implement “Check intraday/daily usage”, “Implement liquidity reservation”, “Implement liquidity release” or document as future work. |
| arbitrage monitoring |
src/core/defi/arbitrage/services/monitoring/metrics.service.ts |
✅ Done: Comment added — add Prometheus when monitoring stack deployed. |
| risk-monitor |
src/core/defi/arbitrage/services/risk-monitor.service.ts |
✅ Done: Stub note + RECOMMENDATIONS.md reference. |
| cache.service |
src/core/defi/arbitrage/services/cache/cache.service.ts |
✅ Done: Redis init when REDIS_URL set (ioredis); pattern-based invalidateDealCache; skips when unset. |
| alert.service |
src/core/defi/arbitrage/services/alert.service.ts |
✅ Done: PagerDuty API (events.pagerduty.com/v2/enqueue) implemented. |
| deal-execution integration tests |
__tests__/integration/deal-execution.integration.test.ts |
✅ Done: DB/metrics/risk/cache TODOs marked it.skip with ticket DBIS-ARB-TEST. |
| Emergency hotline / API URLs |
dbis_core nostro-vostro docs |
✅ Done — set to “To be configured”. Replace with real emergency contact and API base URLs when available. |
5. OMNIS — Code placeholders
| Placeholder |
Location |
What to complete |
| Sankofa Phoenix SDK |
src/identity/sankofa-phoenix.ts, authProvider.tsx, authController.ts |
“TODO: Replace with actual Sankofa Phoenix SDK”. Integrate real SDK or document dependency and timeline. |
| authController token blacklisting |
backend/src/controllers/authController.ts |
“Implement token blacklisting if needed” — ✅ Done: In-memory blacklist when TOKEN_BLACKLIST_ENABLED=true; comments for production Redis/DB. |
| BudgetForm / MilestoneForm / AccountForm |
src/components/*.tsx |
✅ Done: Backend exposes POST/PUT /api/budgets; frontend wired to VITE_API_URL. |
| DocumentUpload |
src/components/DocumentUpload.tsx |
✅ Done: Backend POST /api/documents/upload (multipart); returns { id, name, url }; frontend wired. |
| ProfileEditForm |
src/components/ProfileEditForm.tsx |
✅ Done: Backend PATCH /api/profile (displayName, email); auth required; frontend wired. |
| CI/CD and deploy |
.github/workflows/*.yml, scripts/deploy.sh |
“TODO: Replace with actual Sankofa Phoenix deployment” / “Add database migration” / “Add health check” — add real deployment and health steps. |
6. the-order — Code placeholders
| Placeholder |
Location |
What to complete |
| court-efiling |
services/legal-documents/src/services/court-efiling.ts |
“TODO: Integrate with actual court e-filing system” and status/config queries — implement or document vendor. |
| e-signature |
services/legal-documents/src/services/e-signature.ts |
“TODO: Integrate with e-signature provider” and status/webhook — implement or document provider (e.g. DocuSign/Adobe Sign). |
| document-security |
services/legal-documents/src/services/document-security.ts |
“TODO: Fetch PDF, apply watermark/redactions, re-upload” — implement or document. |
7. Scripts and ops
| Placeholder |
Location |
What to complete |
| NPMplus HA alert |
scripts/npmplus/monitor-ha-status.sh |
✅ Done: ALERT_EMAIL (mail) and ALERT_WEBHOOK (curl JSON) implemented when set. |
| Storage monitor |
scripts/storage-monitor.sh |
✅ Done: ALERT_EMAIL and ALERT_WEBHOOK implemented. |
| CCIPLogger |
CONTRACTS_TO_DEPLOY |
✅ Done: Decision documented — omit from deploy list unless monitoring needed; deploy via Hardhat per TASK12 if needed. |
8. Token aggregation and external data
| Placeholder |
Location |
What to complete |
| CoinGecko/CMC chain support |
token-aggregation adapters |
ChainId 138 and 651940 not supported by CoinGecko/CMC; external price/volume empty for our chains. Submit chain/tokens to CoinGecko/CMC (see COINGECKO_SUBMISSION_GUIDE) or use alternative price source; document in report API. |
| Canonical addresses env |
token-aggregation canonical-tokens.ts |
✅ Done: README lists required CUSDC_ADDRESS_138, CUSDT_ADDRESS_138; .env.example has full list. |
9. Tezos / CCIP
| Placeholder |
Location |
What to complete |
| Etherlink finality |
TEZOS_CCIP_REMAINING_ITEMS |
✅ Doc: TEZOS_CROSS_CHAIN_FINALITY placeholder note added. Set confirmation blocks in relay/DON when decided. |
| Route planner TBD |
TEZOS_USDTZ_IMPLEMENTATION_ROADMAP |
Replace “TBD” bridge provider in route-routes and route-planner with real provider or eth2tz[0]?.provider ?? 'TBD'. |
| Placeholder wallet / tx hashes |
Same doc |
Do not use placeholder wallet or tx hashes in production; use real signer and adapter.sendTransaction results. |
| Token mapping (138↔Mainnet) |
config/token-mapping.json, TOKEN_MAPPING_AND_MAINNET_ADDRESSES |
✅ Done: Single source of truth in config/token-mapping.json; relay uses it; CI validates; runbook for LINK support. When adding tokens: update token-mapping.json and optionally CHAIN138_TOKEN_ADDRESSES. |
10. Operational and runbook
| Placeholder |
Location |
What to complete |
| NPMplus HA (Keepalived / secondary) |
NPMPLUS_HA_SETUP_GUIDE, PHASES_AND_TASKS_MASTER |
Optional: implement Keepalived or HAProxy; document failover; update OPERATIONAL_RUNBOOKS with NPMplus HA failover steps. |
| UDM Pro VLAN / VLAN-aware bridge |
NEXT_STEPS_MASTER, PHASES_AND_TASKS_MASTER |
Optional: document when VLAN migration is planned; update NETWORK_ARCHITECTURE when done. |
| Automated backups |
TODO_TASK_LIST_MASTER |
NPMplus backup (NPM_PASSWORD); ensure backup-npmplus.sh is scheduled and verified. |
11. Summary by priority
| Priority |
Count (approx) |
Focus |
| High |
2 |
API keys (done); TezosRelayService real mint/transfer; Sankofa cutover when deployed. |
| Medium |
12+ |
AlltraAdapter fee; Smart accounts deploy + env; canonical token env docs; dbis_core Redis/PagerDuty/as4; OMNIS Sankofa Phoenix; the-order legal-documents; NPMplus HA alert; storage monitor. |
| Low |
15+ |
EnhancedSwapRouter/DODO/Fabric; network blocks #2–#6; .bak files; route planner TBD; Etherlink finality; optional NPMplus HA/VLAN. |
| Done |
— |
API keys placeholders; emergency hotline “To be configured”; AlltraAdapter configurable fee (PLACEHOLDERS_AND_TBD); Smart accounts .env.example + runbook; Quote service FABRIC_CHAIN_ID; EnhancedSwapRouter/DODO documented; TezosRelayService skeleton; OMNIS budgets/documents/profile routes; authController token blacklisting; dbis_core Redis/Prometheus/risk/alert/tests; CCIPLogger decision; .bak deprecated; NPMplus HA and storage monitor alerts; deployment gaps (env table, TransactionMirror script, DEPLOYMENT_GAPS_COMPLETED); token mapping (config/token-mapping.json, TOKEN_MAPPING_AND_MAINNET_ADDRESSES, relay, CI, runbook LINK). |
12. Not changed by design — actionable steps
See NOT_CHANGED_BY_DESIGN_ACTIONABLE_STEPS.md for a step-by-step breakdown: AlltraAdapter fee, Smart accounts deploy + env, EnhancedSwapRouter/DODO/Quote, TezosRelayService, OMNIS backend routes, CCIPLogger, .bak files, dbis_core Prometheus/Redis/tests.
13. Where to update when completed
bea1903ac9