Deploy DBIS RTGS first-slice sidecars

docs/03-deployment/DBIS_RTGS_E2E_REQUIREMENTS_MATRIX.md

@@ -31,12 +31,12 @@
 | HYBX participant / office / treasury model | Planned | Banking architecture lead | OMNL scripts and central-bank config | Participant model and treasury structure not yet frozen end-to-end | Office IDs, treasury accounts, GL mapping, nostro/vostro model, and settlement roles are documented and accepted |
 | Mojaloop integration | Planned | Payments interoperability lead | [DBIS_MOJALOOP_INTEGRATION_STATUS.md](DBIS_MOJALOOP_INTEGRATION_STATUS.md) | No proven live Mojaloop switch endpoint set or callback contract in repo-backed state | Endpoint/auth contract documented, quote/transfer/callback flow integrated, settlement-window behavior mapped to accounting and chain settlement |
 | HYBX sidecar layer | Partial | HYBX app / integration lead | [DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md](DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md) | Sidecars available, but full orchestration and system-of-record ownership not yet frozen | Sidecar-by-sidecar purpose, auth, ingress/egress, retries, and system-of-record ownership documented and validated |
-| `mifos-fineract-sidecar` | Partial | HYBX integration lead | [DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md](DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md) | Integration contract not yet wired into canonical RTGS runbook | Sidecar API and event flow documented and validated against live Fineract rail |
+| `mifos-fineract-sidecar` | Partial | HYBX integration lead | [DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md](DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md), [DBIS_RTGS_FIRST_SLICE_DEPLOYMENT_CHECKLIST.md](DBIS_RTGS_FIRST_SLICE_DEPLOYMENT_CHECKLIST.md) | Runtime is deployed on Proxmox and healthy, but authenticated Fineract tenant flow is not yet frozen | Sidecar API and event flow documented and validated against live Fineract rail |
 | `mt103-hardcopy-sidecar` | Partial | HYBX integration lead | [DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md](DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md) | Ingestion path not yet tied into canonical RTGS workflow | MT103 ingest to settlement and evidence path is documented and tested |
-| `off-ledger-2-on-ledger-sidecar` | Partial | HYBX integration lead | [DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md](DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md) | Off-ledger to on-ledger conversion path not yet frozen | Canonical mapping from off-ledger event to Chain 138 settlement defined and tested |
+| `off-ledger-2-on-ledger-sidecar` | Partial | HYBX integration lead | [DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md](DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md), [DBIS_RTGS_FIRST_SLICE_DEPLOYMENT_CHECKLIST.md](DBIS_RTGS_FIRST_SLICE_DEPLOYMENT_CHECKLIST.md) | Runtime is deployed on Proxmox and healthy, but canonical off-ledger source event and authenticated Fineract flow are not yet frozen | Canonical mapping from off-ledger event to Chain 138 settlement defined and tested |
 | `securitization-engine-sidecar` | Partial | HYBX integration lead | [DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md](DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md) | Regulatory/accounting role not yet tied into RTGS runbook | Accounting and reporting responsibilities explicitly mapped and validated |
 | `card-networks-sidecar` | Partial | HYBX integration lead | [DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md](DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md) | Not yet placed in RTGS path | Include only if card-network settlement is in scope and integrated |
-| `server-funds-sidecar` | Partial | HYBX integration lead | [DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md](DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md) | Not yet placed in RTGS path | Define and validate if it is needed for treasury/funding orchestration |
+| `server-funds-sidecar` | Partial | HYBX integration lead | [DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md](DBIS_HYBX_SIDECAR_BOUNDARY_MATRIX.md), [DBIS_RTGS_FIRST_SLICE_DEPLOYMENT_CHECKLIST.md](DBIS_RTGS_FIRST_SLICE_DEPLOYMENT_CHECKLIST.md) | Runtime is deployed on Proxmox and healthy, but its final treasury/system-of-record boundary is not yet frozen | Define and validate if it is needed for treasury/funding orchestration |
 | Chain 138 settlement contracts | Partial | Chain 138 / settlement lead | `smom-dbis-138`, `alltra-lifi-settlement`, [CONTRACTS_TO_DEPLOY.md](../11-references/CONTRACTS_TO_DEPLOY.md) | Canonical RTGS path not yet frozen across off-ledger ↔ on-ledger events | Final contract set chosen, deployed addresses frozen, flow tested end-to-end |
 | MerchantSettlementRegistry | Partial | Chain 138 / settlement lead | `alltra-lifi-settlement` docs and deploy scripts | Need explicit placement in RTGS canonical flow | Registry integrated into business flow with verified inputs/outputs |
 | WithdrawalEscrow | Partial | Chain 138 / settlement lead | `alltra-lifi-settlement` docs and deploy scripts | Need explicit placement in RTGS canonical flow | Escrow flow validated in settlement and withdrawal scenarios |

docs/03-deployment/DBIS_RTGS_FIRST_SLICE_DEPLOYMENT_CHECKLIST.md

@@ -50,6 +50,29 @@ The following sidecars were built successfully on 2026-03-28 with Maven and `-Ds
 - Verified runnable artifact:
   - `/home/intlc/projects/HYBX_Sidecars/off-ledger-2-on-ledger-sidecar/target/off-ledger-2-on-ledger-sidecar-0.1.0-SNAPSHOT.jar`
 
+## Current deployment status
+
+As of 2026-03-28/29:
+
+- `5802` `rtgs-scsm-1` is deployed on `r630-02`
+  - systemd: `dbis-rtgs-scsm`
+  - Redis: active
+  - health: `UP`
+- `5803` `rtgs-funds-1` is deployed on `r630-02`
+  - systemd: `dbis-rtgs-funds`
+  - Redis: active
+  - health: `UP`
+- `5804` `rtgs-xau-1` is deployed on `r630-02`
+  - systemd: `dbis-rtgs-xau`
+  - Redis: active
+  - health: `UP`
+
+What is still not complete:
+
+- the canonical authenticated Fineract tenant flow is not yet frozen in the sidecar runtime
+- the sidecars can reach the live Fineract endpoint at the HTTP layer, but current checks stop at `400 Bad Request` without the final request/auth contract
+- no canonical RTGS transaction has yet been executed across OMNL / Fineract, sidecar logic, Chain 138 settlement, and final evidence output
+
 ## Runtime deployment baseline
 
 ### Besu / explorer / FireFly
@@ -184,12 +207,13 @@ The following sidecars were built successfully on 2026-03-28 with Maven and `-Ds
 
 ### Runtime verification
 
-- [ ] Process starts under systemd / container supervisor
-- [ ] Health endpoints return healthy
-- [ ] API base paths respond
-- [ ] Logs show no dependency boot failures
-- [ ] Sidecar can reach Fineract
-- [ ] Sidecar can reach any required Redis / DB / Kafka dependency
+- [x] Process starts under systemd / container supervisor
+- [x] Health endpoints return healthy
+- [ ] API base paths respond for a canonical business flow
+- [x] Logs show no dependency boot failures for current runtime boot
+- [x] Sidecar can reach Fineract at the HTTP layer
+- [x] Sidecar can reach required local Redis dependency
+- [ ] Sidecar can reach final production DB / Kafka dependencies if those are required by the chosen slice
 
 ### Functional verification
 
@@ -199,6 +223,22 @@ The following sidecars were built successfully on 2026-03-28 with Maven and `-Ds
 - [ ] Chain 138 receives and records the intended settlement leg where applicable
 - [ ] Reconciliation and audit outputs are captured
 
+## Verification command
+
+Use:
+
+```bash
+bash scripts/verify/check-dbis-rtgs-first-slice.sh
+```
+
+This verifies:
+
+- CT status
+- systemd service status
+- local Redis status
+- local actuator health
+- live Fineract HTTP reachability from each sidecar CT
+
 ## First-slice production gate
 
 The first RTGS production slice should be treated as deployable only when all of the following are true:

docs/04-configuration/ALL_VMIDS_ENDPOINTS.md

@@ -180,6 +180,21 @@ The following VMIDs have been permanently removed:
 
 ---
 
+### DBIS RTGS first-slice sidecars
+
+| VMID | IP Address | Hostname | Status | Endpoints | Purpose |
+|------|------------|----------|--------|-----------|---------|
+| 5802 | 192.168.11.89 | rtgs-scsm-1 | ✅ Running | App: 8080, Redis: 6379 | DBIS RTGS `mifos-fineract-sidecar` / SCSM |
+| 5803 | 192.168.11.90 | rtgs-funds-1 | ✅ Running | App: 8080, Redis: 6379 | DBIS RTGS `server-funds-sidecar` |
+| 5804 | 192.168.11.92 | rtgs-xau-1 | ✅ Running | App: 8080, Redis: 6379 | DBIS RTGS `off-ledger-2-on-ledger-sidecar` |
+
+**Operational note (2026-03-28/29):**
+- These three sidecars are deployed internally on `r630-02` and return local actuator health.
+- They can reach the live Mifos / Fineract surface on VMID `5800` at the HTTP layer.
+- Canonical authenticated RTGS flow is still pending final Fineract tenant/auth freeze, so these should currently be treated as `runtime deployed, functionally partial`.
+
+---
+
 ### Hyperledger Fabric
 
 | VMID | IP Address | Hostname | Status | Endpoints | Purpose |