Add RTGS later-phase sidecar deployment scaffolding

docs/03-deployment/DBIS_RTGS_E2E_REQUIREMENTS_MATRIX.md

@@ -43,6 +43,8 @@
 | `mt103-hardcopy-sidecar` | Partial. Known sidecar, but not yet tied into the canonical RTGS path. | MT103 ingest, bank-message archive, and settlement/evidence mapping. | Decide whether it is in scope and, if yes, integrate MT103 ingest into the canonical RTGS flow. | HYBX integration lead | MT103 ingestion path is documented, integrated, and tested if in scope. |
 | `securitization-engine-sidecar` | Partial. Known sidecar, but regulatory/accounting role in RTGS is not yet frozen. | Accounting, collateral, and reporting responsibilities in the RTGS operating model. | Define whether it participates in RTGS slice 1 and validate the required role if so. | HYBX integration lead | Its RTGS responsibility is either validated or explicitly out of scope. |
 | `card-networks-sidecar` | Partial. Known sidecar, but not yet placed in the RTGS path. | Card-network settlement role only if card rails are included in scope. | Include only if card settlement is part of production scope; otherwise keep it out of the canonical path. | HYBX integration lead | Scope decision is frozen, and if included the settlement path is validated. |
+| `securities-sidecar` | Partial. Known sidecar with runnable application shape, but its depository/custody placement in the RTGS architecture is not yet frozen. | Instrument resolution, securities instructions, settlement events, and position reconciliation linked to the depository/custody operating model. | Freeze whether it is the runtime boundary for depository/custody flows and validate one canonical securities/custody path if so. | HYBX integration lead | Scope decision is frozen, and if included one canonical securities or custody flow is validated. |
+| `flash-loan-xau-sidecar` | Planned. Runnable sidecar exists locally, but its role in the RTGS production path is still specialized and optional. | XAU-specific liquidity, conversion, and settlement logic only if retained as part of the target architecture. | Decide whether it remains a specialized liquidity extension or enters the canonical RTGS path; validate if retained. | HYBX integration lead | Scope decision is frozen, and if included the XAU liquidity path is validated end to end. |
 | Chain 138 settlement contracts | Partial. Contract families exist, but the exact RTGS contract path is not yet frozen as one canonical settlement lane. | Final contract path between OMNL-side events and on-chain settlement evidence. | Freeze the exact contract set and document how each business flow reaches Chain 138. | Chain 138 / settlement lead | Final contract set is frozen, deployed addresses are accepted, and the path is tested end to end. |
 | MerchantSettlementRegistry | Partial. Available contract family, but exact placement in the canonical RTGS flow is not yet frozen. | RTGS settlement workflow and evidence mapping. | Decide exactly when and how the registry is invoked in RTGS settlement. | Chain 138 / settlement lead | Registry path is integrated into the business flow with verified inputs and outputs. |
 | WithdrawalEscrow | Partial. Available contract family, but exact placement in RTGS withdrawal scenarios is not yet frozen. | Withdrawal / release / payout semantics in the RTGS model. | Freeze the escrow role for settlement and withdrawal scenarios. | Chain 138 / settlement lead | Escrow flow is validated in the chosen settlement and withdrawal scenarios. |

docs/03-deployment/DBIS_RTGS_LATER_PHASE_SIDECARS_DEPLOYMENT_CHECKLIST.md

@@ -0,0 +1,54 @@
+# DBIS RTGS Later-Phase Sidecars Deployment Checklist
+
+**Last updated:** 2026-03-29  
+**Purpose:** Deployment checklist for the next sidecar tranche beyond the currently deployed first-slice services.
+
+## 1. Target sidecars
+
+| Sidecar | Runtime type | Expected artifact | Health path |
+|---------|--------------|-------------------|-------------|
+| `securities-sidecar` | Java / Spring Boot | `securities-app/target/securities-app-1.0.0-SNAPSHOT.jar` | `GET /actuator/health` |
+| `card-networks-sidecar` | Java / Spring Boot | `cardnet-app/target/cardnet-app-1.0.0-SNAPSHOT.jar` | `GET /actuator/health` |
+| `mt103-hardcopy-sidecar` | Go binary | `./server` built from `cmd/server` | `GET /health` |
+
+## 2. Intended role in DBIS RTGS
+
+- `securities-sidecar`
+  - later-phase depository / custody / securities instruction lane
+- `card-networks-sidecar`
+  - later-phase card-rail settlement lane
+- `mt103-hardcopy-sidecar`
+  - evidence and hardcopy-bank-message archive lane
+
+## 3. Target runtime
+
+Suggested default Proxmox targets on `r630-02`:
+
+- `5808` `rtgs-securities-1`
+- `5809` `rtgs-cardnet-1`
+- `5810` `rtgs-mt103-1`
+
+## 4. Required inputs before deployment
+
+- built JAR for `securities-sidecar`
+- built JAR for `card-networks-sidecar`
+- built Go binary for `mt103-hardcopy-sidecar`
+- OMNL / Fineract tenant/auth contract for the Java sidecars
+- PostgreSQL decision for `mt103-hardcopy-sidecar`
+- Redis host/port for Java sidecars
+
+## 5. Deployment gates
+
+- [ ] each artifact exists and is versioned
+- [ ] each target CT exists and is reachable
+- [ ] each service can start under systemd
+- [ ] health endpoint returns success
+- [ ] Fineract reachability is proven for Java sidecars
+- [ ] storage/database reachability is proven for the MT103 sidecar
+- [ ] one canonical later-phase business flow is identified per sidecar before production claims are made
+
+## 6. Scripts
+
+- [create-dbis-rtgs-later-phase-sidecar-lxcs.sh](/home/intlc/projects/proxmox/scripts/deployment/create-dbis-rtgs-later-phase-sidecar-lxcs.sh)
+- [deploy-dbis-rtgs-later-phase-sidecars.sh](/home/intlc/projects/proxmox/scripts/deployment/deploy-dbis-rtgs-later-phase-sidecars.sh)
+- [check-dbis-rtgs-later-phase-sidecars.sh](/home/intlc/projects/proxmox/scripts/verify/check-dbis-rtgs-later-phase-sidecars.sh)