**Related:** [GAPS_AND_RECOMMENDATIONS_CONSOLIDATED](../GAPS_AND_RECOMMENDATIONS_CONSOLIDATED.md) | [PLACEHOLDERS_AND_TBD](../PLACEHOLDERS_AND_TBD.md) | [REQUIRED_FIXES_UPDATES_GAPS](../REQUIRED_FIXES_UPDATES_GAPS.md) | [REMAINING_COMPONENTS_TASKS_AND_RECOMMENDATIONS](REMAINING_COMPONENTS_TASKS_AND_RECOMMENDATIONS.md) | [NOT_IMPLEMENTED_FULL_SCOPE](NOT_IMPLEMENTED_FULL_SCOPE.md) (not implemented — design and full scope)
---
## 1. Security and secrets
| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| API keys in .env.example | `smom-dbis-138/services/token-aggregation/.env.example`, root `.env.example` | ✅ **Done** — use `your-coingecko-api-key`, `your-coinmarketcap-api-key`. Rotate any keys if they were ever committed. |
| PRIVATE_KEY, JWT_SECRET, NPM_PASSWORD, etc. | Root and project `.env.example` | Keep as `your-*` placeholders; never commit real values. Document in [MASTER_SECRETS_INVENTORY](../04-configuration/MASTER_SECRETS_INVENTORY.md), [API_KEYS_REQUIRED](../../reports/API_KEYS_REQUIRED.md) (if present). |
| OMNIS / dbis_core / the-order secrets | Their .env / config | Use `your-*` or empty in examples; document in MASTER_SECRETS_INVENTORY. |
| **Sankofa cutover plan** | [SANKOFA_CUTOVER_PLAN](../04-configuration/SANKOFA_CUTOVER_PLAN.md) | **Done 2026-03-27:** v1.1 lists live backends (incl. The Order via 10210). Legacy API examples may still contain `<TARGET_*>` placeholders—substitute real values if you reuse them. |
| **Public blocks #2–#6** | [NETWORK_ARCHITECTURE](../02-architecture/NETWORK_ARCHITECTURE.md), [NETWORK_CONFIGURATION_MASTER](../11-references/NETWORK_CONFIGURATION_MASTER.md) | Document when blocks are assigned or mark as “reserved”. |
| **PROXMOX_HOST / PROXMOX_TOKEN_SECRET** | smom-dbis-138-proxmox/README.md | Keep as `proxmox.example.com`, `your-token-secret`; document in deployment guide. |
---
## 3. smom-dbis-138 — Code placeholders
| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| **AlltraAdapter fee** | `contracts/bridge/adapters/evm/AlltraAdapter.sol` | `getBridgeFee()`: use configurable value (e.g. `setBridgeFee`). Update with actual ALL Mainnet fee when known; document in [PLACEHOLDERS_AND_TBD](../PLACEHOLDERS_AND_TBD.md). |
| **Smart accounts kit** | `script/smart-accounts/DeploySmartAccountsKit.s.sol` | ✅ **Done:** .env.example has ENTRY_POINT, SMART_ACCOUNT_FACTORY, PAYMASTER; runbook has Smart accounts subsection. Script reads env; deploy EntryPoint/Factory externally and set env. |
| **EnhancedSwapRouter** | `contracts/bridge/trustless/EnhancedSwapRouter.sol` | Uniswap quoter / Balancer: document when pools exist; keep “return 0” placeholder until integrated. |
| **DODOPMMProvider** | `contracts/liquidity/providers/DODOPMMProvider.sol` | “For now, placeholder” — document oracle-driven flow; complete when DODO is integrated. |
| **Quote service Fabric** | `orchestration/bridge/quote-service.ts` | `FABRIC_CHAIN_ID` env (default 999). Set real chain ID when Fabric is integrated. |
| **register-all-mainnet avgBlockTime** | [TEZOS_CCIP_REMAINING_ITEMS](../07-ccip/TEZOS_CCIP_REMAINING_ITEMS.md) | Verify actual block time and set in script. |
| **TezosRelayService** | `services/tezos-relay/src/TezosRelayService.js` | ✅ **Skeleton done:** Taquito/RPC path added; mock gated by MOCK_TEZOS_RELAY; runbook updated. Set TEZOS_MINTER_ADDRESS, TEZOS_ORACLE_SECRET_KEY for real mint. |
| **Canonical token addresses** | `services/token-aggregation/src/config/canonical-tokens.ts` | All from env; unset tokens omitted. Document required env vars (e.g. which `*_ADDRESS_138` / `*_ADDRESS_651940`) in token-aggregation README and .env.example. |
| **WETH bridges mainnet receiver** | `script/deploy/bridge/DeployWETHBridges.s.sol` | Set `MAINNET_WETH9_BRIDGE_ADDRESS` and `MAINNET_WETH10_BRIDGE_ADDRESS` in env when configuring cross-chain destinations. |
| **.bak files** | Various `*.sol.bak`, `*.t.sol.bak` | ✅ **Done:** Listed and deprecated in [BAK_FILES_DEPRECATION](../../smom-dbis-138/docs/BAK_FILES_DEPRECATION.md); REQUIRED_FIXES §9 links there. |
| **deal-execution integration tests** | `__tests__/integration/deal-execution.integration.test.ts` | ✅ **Done:** DB/metrics/risk/cache TODOs marked it.skip with ticket DBIS-ARB-TEST. |
| **Emergency hotline / API URLs** | dbis_core nostro-vostro docs | ✅ **Done** — set to “To be configured”. Replace with real emergency contact and API base URLs when available. |
---
## 5. OMNIS — Code placeholders
| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| **Sankofa Phoenix SDK** | `src/identity/sankofa-phoenix.ts`, `authProvider.tsx`, `authController.ts` | “TODO: Replace with actual Sankofa Phoenix SDK”. Integrate real SDK or document dependency and timeline. |
| **authController token blacklisting** | `backend/src/controllers/authController.ts` | “Implement token blacklisting if needed” — ✅ **Done:** In-memory blacklist when `TOKEN_BLACKLIST_ENABLED=true`; comments for production Redis/DB. |
| **CI/CD and deploy** | `.github/workflows/*.yml`, `scripts/deploy.sh` | “TODO: Replace with actual Sankofa Phoenix deployment” / “Add database migration” / “Add health check” — add real deployment and health steps. |
---
## 6. the-order — Code placeholders
| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| **court-efiling** | `services/legal-documents/src/services/court-efiling.ts` | “TODO: Integrate with actual court e-filing system” and status/config queries — implement or document vendor. |
| **e-signature** | `services/legal-documents/src/services/e-signature.ts` | “TODO: Integrate with e-signature provider” and status/webhook — implement or document provider (e.g. DocuSign/Adobe Sign). |
| **CCIPLogger** | [CONTRACTS_TO_DEPLOY](../11-references/CONTRACTS_TO_DEPLOY.md) | ✅ **Done:** Decision documented — omit from deploy list unless monitoring needed; deploy via Hardhat per TASK12 if needed. |
---
## 8. Token aggregation and external data
| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| **CoinGecko/CMC chain support** | token-aggregation adapters | ChainId 138 and 651940 not supported by CoinGecko/CMC; external price/volume empty for our chains. Submit chain/tokens to CoinGecko/CMC (see COINGECKO_SUBMISSION_GUIDE) or use alternative price source; document in report API. |
| **Canonical addresses env** | token-aggregation canonical-tokens.ts | ✅ **Done:** README lists required CUSDC_ADDRESS_138, CUSDT_ADDRESS_138; .env.example has full list. |
---
## 9. Tezos / CCIP
| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| **Etherlink finality** | [TEZOS_CCIP_REMAINING_ITEMS](../07-ccip/TEZOS_CCIP_REMAINING_ITEMS.md) | ✅ **Doc:** TEZOS_CROSS_CHAIN_FINALITY placeholder note added. Set confirmation blocks in relay/DON when decided. |
| **Route planner TBD** | [TEZOS_USDTZ_IMPLEMENTATION_ROADMAP](../11-references/TEZOS_USDTZ_IMPLEMENTATION_ROADMAP.md) | Replace “TBD” bridge provider in route-routes and route-planner with real provider or `eth2tz[0]?.provider ?? 'TBD'`. |
| **Placeholder wallet / tx hashes** | Same doc | Do not use placeholder wallet or tx hashes in production; use real signer and `adapter.sendTransaction` results. |
| **Token mapping (138↔Mainnet)** | config/token-mapping.json, [TOKEN_MAPPING_AND_MAINNET_ADDRESSES](../07-ccip/TOKEN_MAPPING_AND_MAINNET_ADDRESSES.md) | ✅ **Done:** Single source of truth in config/token-mapping.json; relay uses it; CI validates; runbook for LINK support. When adding tokens: update token-mapping.json and optionally CHAIN138_TOKEN_ADDRESSES. |
---
## 10. Operational and runbook
| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| **NPMplus HA (Keepalived / secondary)** | [NPMPLUS_HA_SETUP_GUIDE](../04-configuration/NPMPLUS_HA_SETUP_GUIDE.md), [PHASES_AND_TASKS_MASTER](PHASES_AND_TASKS_MASTER.md) | Optional: implement Keepalived or HAProxy; document failover; update OPERATIONAL_RUNBOOKS with NPMplus HA failover steps. |
| **UDM Pro VLAN / VLAN-aware bridge** | [NEXT_STEPS_MASTER](NEXT_STEPS_MASTER.md), PHASES_AND_TASKS_MASTER | Optional: document when VLAN migration is planned; update NETWORK_ARCHITECTURE when done. |
| **Automated backups** | [TODO_TASK_LIST_MASTER](TODO_TASK_LIST_MASTER.md) | NPMplus backup (NPM_PASSWORD); ensure backup-npmplus.sh is scheduled and verified. |
---
## 11. Summary by priority
| Priority | Count (approx) | Focus |
|----------|----------------|--------|
| **High** | 2 | API keys (done); TezosRelayService real mint/transfer; Sankofa cutover when deployed. |
See **[NOT_CHANGED_BY_DESIGN_ACTIONABLE_STEPS.md](NOT_CHANGED_BY_DESIGN_ACTIONABLE_STEPS.md)** for a step-by-step breakdown: AlltraAdapter fee, Smart accounts deploy + env, EnhancedSwapRouter/DODO/Quote, TezosRelayService, OMNIS backend routes, CCIPLogger, .bak files, dbis_core Prometheus/Redis/tests.
---
## 13. Where to update when completed
- **This list:** Mark item as ✅ and add “Done” note.
- **Single index (Blitzkrieg):** [BLITZKRIEG_SOURCE_DOCUMENT_INDEX](BLITZKRIEG_SOURCE_DOCUMENT_INDEX.md) — full table of source docs and when to update each.
