**Purpose:** Identify every execution-critical MEV value, where it is supposed to come from, what this repo currently knows, and what is still missing before live bundle submission can be enabled.
This document is intentionally strict. It separates:
- values that are already authoritative in repo docs or config
- values that must come from a secret store or runtime env
- values that must come from an actual on-chain deployment and therefore cannot be guessed
Use the verifier before promoting or committing execution-related config:
| `MEV_EXECUTOR_PRIVATE_KEY` | Runtime secret env only; never commit | Signing real bundle txs | Missing from repo examples except commented placeholder |
| `MEV_SUBMIT_DISABLED` | Runtime env | Guardrail for shadow vs live submission | Present and intentionally set to `1` in examples |
| `chains.<id>.execution.executor_contract` | Real deployed contract address | `executeArbitrage(...)` destination | Still zero address in checked-in config |
| `chains.<id>.execution.flash_loan_provider` | Real deployed venue/provider address | Arbitrage executor input | Still zero address in checked-in config |
As of the current public deployment, the live signer readiness endpoint reports:
-`MEV_EXECUTOR_PRIVATE_KEY is not configured`
-`submit_disabled is enabled`
-`chain 1: router missing for dex uniswap_v2`
-`chain 1: router missing for dex sushiswap`
-`chain 1: executor_contract is zero address`
-`chain 1: flash_loan_provider is zero address`
That means the code path is present, but the deployment inputs for real execution are not.
## Values that must not be guessed
These must come from a controlled operator source, secret manager, or an actual deployment result:
-`MEV_EXECUTOR_PRIVATE_KEY`
-`chains.<id>.execution.executor_contract`
-`chains.<id>.execution.flash_loan_provider`
The repo currently does **not** contain authoritative values for them. If they are to be committed into non-secret config, they must first exist as real deployment outputs.
## Values that still need operator selection
These may be public addresses, but they still need to be selected intentionally for the exact chain and venue plan:
-`chains.<id>.factories[].router` for each V2-style DEX used by execution
- any non-default relay endpoint if Flashbots is not the intended submission path
They should not be filled by assumption if the deployment target is expected to be canonical and auditable.
## Recommended source order
1. Runtime secret store or backend CT env for `MEV_EXECUTOR_PRIVATE_KEY`.
2. Actual deployment output from the MEV contracts deployment process for `executor_contract`.
3. Actual deployment output or operator-selected venue address for `flash_loan_provider`.
4. Canonical chain venue inventory for router addresses, then validate through the readiness script and live `/api/safety/signer`.
The repo now includes a deployment helper that uses the existing Foundry script and captures the resulting addresses into a JSON artifact instead of relying on manual copy/paste:
