# Placeholders and What Needs to Be Completed — Master List

**Last Updated:** 2026-03-27  
**Purpose:** Single list of every placeholder and what must be completed (code, config, docs, ops).

**Completion pass (2026-02-13):** OMNIS backend routes (POST/PUT budgets, POST documents/upload, PATCH profile) done; authController token blacklisting (in-memory + TOKEN_BLACKLIST_ENABLED); TezosRelayService Taquito skeleton + mock gated; Smart accounts .env.example + runbook; dbis_core Redis stub, Prometheus/risk comments, deal-execution tests skipped with ticket; CCIPLogger decision (omit unless monitoring); .bak listed and deprecated in BAK_FILES_DEPRECATION; deployment gaps (env table, TransactionMirror script, DEPLOYMENT_GAPS_COMPLETED); NPMplus HA and storage monitor already have ALERT_EMAIL/ALERT_WEBHOOK; deploy.sh TODO comments for migration/health; the-order legal-documents vendor integration README; root .gitignore (venv, __pycache__, .phase1).

**Code generation pass (2026-02-12):** PagerDuty API implemented (dbis_core alert.service); liquidity amountDecimal fix + future-work comments (dbis_core liquidity-limits); Sankofa Phoenix helpers getAuthUrl/validateToken/getUserInfo (OMNIS); BudgetForm/DocumentUpload/ProfileEditForm API wiring (OMNIS); authController token blacklist + deploy.sh health/migration note (OMNIS); court-efiling/e-signature/document-security integration comments (the-order); script alert env docs (monitor-ha-status, storage-monitor); token-aggregation README required env; TEZOS_CROSS_CHAIN_FINALITY placeholder note.

**Related:** [GAPS_AND_RECOMMENDATIONS_CONSOLIDATED](../GAPS_AND_RECOMMENDATIONS_CONSOLIDATED.md) | [PLACEHOLDERS_AND_TBD](../PLACEHOLDERS_AND_TBD.md) | [REQUIRED_FIXES_UPDATES_GAPS](../REQUIRED_FIXES_UPDATES_GAPS.md) | [REMAINING_COMPONENTS_TASKS_AND_RECOMMENDATIONS](REMAINING_COMPONENTS_TASKS_AND_RECOMMENDATIONS.md) | [NOT_IMPLEMENTED_FULL_SCOPE](NOT_IMPLEMENTED_FULL_SCOPE.md) (not implemented — design and full scope)

---

## 1. Security and secrets

| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| API keys in .env.example | `smom-dbis-138/services/token-aggregation/.env.example`, root `.env.example` | ✅ **Done** — use `your-coingecko-api-key`, `your-coinmarketcap-api-key`. Rotate any keys if they were ever committed. |
| PRIVATE_KEY, JWT_SECRET, NPM_PASSWORD, etc. | Root and project `.env.example` | Keep as `your-*` placeholders; never commit real values. Document in [MASTER_SECRETS_INVENTORY](../04-configuration/MASTER_SECRETS_INVENTORY.md), [API_KEYS_REQUIRED](../../reports/API_KEYS_REQUIRED.md) (if present). |
| OMNIS / dbis_core / the-order secrets | Their .env / config | Use `your-*` or empty in examples; document in MASTER_SECRETS_INVENTORY. |

---

## 2. Configuration and DNS

| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| **the-order.sankofa.nexus** | [ALL_VMIDS_ENDPOINTS](../04-configuration/ALL_VMIDS_ENDPOINTS.md), [RPC_ENDPOINTS_MASTER](../04-configuration/RPC_ENDPOINTS_MASTER.md) | **Done 2026-03-27:** NPM → 10210 `192.168.11.39:80` (HAProxy → portal :3000). Keep docs in sync if routing changes. |
| **Sankofa cutover plan** | [SANKOFA_CUTOVER_PLAN](../04-configuration/SANKOFA_CUTOVER_PLAN.md) | **Done 2026-03-27:** v1.1 lists live backends (incl. The Order via 10210). Legacy API examples may still contain `<TARGET_*>` placeholders—substitute real values if you reuse them. |
| **sankofa.nexus / phoenix.sankofa.nexus** | [ALL_VMIDS_ENDPOINTS](../04-configuration/ALL_VMIDS_ENDPOINTS.md), [RPC_ENDPOINTS_MASTER](../04-configuration/RPC_ENDPOINTS_MASTER.md), [DNS_NPMPLUS_VM](../04-configuration/DNS_NPMPLUS_VM_COMPREHENSIVE_ARCHITECTURE.md) | **Doc fix done:** Correct targets: sankofa → 192.168.11.51:3000 (VMID 7801), phoenix → 192.168.11.50:4000 (VMID 7800). **Operator:** Ensure NPMplus proxy hosts use these, not 192.168.11.140. Only explorer.d-bis.org → .140. |
| **Public blocks #2–#6** | [NETWORK_ARCHITECTURE](../02-architecture/NETWORK_ARCHITECTURE.md), [NETWORK_CONFIGURATION_MASTER](../11-references/NETWORK_CONFIGURATION_MASTER.md) | Document when blocks are assigned or mark as “reserved”. |
| **PROXMOX_HOST / PROXMOX_TOKEN_SECRET** | smom-dbis-138-proxmox/README.md | Keep as `proxmox.example.com`, `your-token-secret`; document in deployment guide. |

---

## 3. smom-dbis-138 — Code placeholders

| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| **AlltraAdapter fee** | `contracts/bridge/adapters/evm/AlltraAdapter.sol` | `getBridgeFee()`: use configurable value (e.g. `setBridgeFee`). Update with actual ALL Mainnet fee when known; document in [PLACEHOLDERS_AND_TBD](../PLACEHOLDERS_AND_TBD.md). |
| **Smart accounts kit** | `script/smart-accounts/DeploySmartAccountsKit.s.sol` | ✅ **Done:** .env.example has ENTRY_POINT, SMART_ACCOUNT_FACTORY, PAYMASTER; runbook has Smart accounts subsection. Script reads env; deploy EntryPoint/Factory externally and set env. |
| **EnhancedSwapRouter** | `contracts/bridge/trustless/EnhancedSwapRouter.sol` | Uniswap quoter / Balancer: document when pools exist; keep “return 0” placeholder until integrated. |
| **DODOPMMProvider** | `contracts/liquidity/providers/DODOPMMProvider.sol` | “For now, placeholder” — document oracle-driven flow; complete when DODO is integrated. |
| **Quote service Fabric** | `orchestration/bridge/quote-service.ts` | `FABRIC_CHAIN_ID` env (default 999). Set real chain ID when Fabric is integrated. |
| **register-all-mainnet avgBlockTime** | [TEZOS_CCIP_REMAINING_ITEMS](../07-ccip/TEZOS_CCIP_REMAINING_ITEMS.md) | Verify actual block time and set in script. |
| **TezosRelayService** | `services/tezos-relay/src/TezosRelayService.js` | ✅ **Skeleton done:** Taquito/RPC path added; mock gated by MOCK_TEZOS_RELAY; runbook updated. Set TEZOS_MINTER_ADDRESS, TEZOS_ORACLE_SECRET_KEY for real mint. |
| **Canonical token addresses** | `services/token-aggregation/src/config/canonical-tokens.ts` | All from env; unset tokens omitted. Document required env vars (e.g. which `*_ADDRESS_138` / `*_ADDRESS_651940`) in token-aggregation README and .env.example. |
| **WETH bridges mainnet receiver** | `script/deploy/bridge/DeployWETHBridges.s.sol` | Set `MAINNET_WETH9_BRIDGE_ADDRESS` and `MAINNET_WETH10_BRIDGE_ADDRESS` in env when configuring cross-chain destinations. |
| **.bak files** | Various `*.sol.bak`, `*.t.sol.bak` | ✅ **Done:** Listed and deprecated in [BAK_FILES_DEPRECATION](../../smom-dbis-138/docs/BAK_FILES_DEPRECATION.md); REQUIRED_FIXES §9 links there. |

---

## 4. dbis_core — Code placeholders

| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| **as4-settlement liquidity** | `src/core/settlement/as4-settlement/liquidity-limits.service.ts` | Implement “Check intraday/daily usage”, “Implement liquidity reservation”, “Implement liquidity release” or document as future work. |
| **arbitrage monitoring** | `src/core/defi/arbitrage/services/monitoring/metrics.service.ts` | ✅ **Done:** Comment added — add Prometheus when monitoring stack deployed. |
| **risk-monitor** | `src/core/defi/arbitrage/services/risk-monitor.service.ts` | ✅ **Done:** Stub note + RECOMMENDATIONS.md reference. |
| **cache.service** | `src/core/defi/arbitrage/services/cache/cache.service.ts` | ✅ **Done:** Redis init when REDIS_URL set (ioredis); pattern-based invalidateDealCache; skips when unset. |
| **alert.service** | `src/core/defi/arbitrage/services/alert.service.ts` | ✅ **Done:** PagerDuty API (events.pagerduty.com/v2/enqueue) implemented. |
| **deal-execution integration tests** | `__tests__/integration/deal-execution.integration.test.ts` | ✅ **Done:** DB/metrics/risk/cache TODOs marked it.skip with ticket DBIS-ARB-TEST. |
| **Emergency hotline / API URLs** | dbis_core nostro-vostro docs | ✅ **Done** — set to “To be configured”. Replace with real emergency contact and API base URLs when available. |

---

## 5. OMNIS — Code placeholders

| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| **Sankofa Phoenix SDK** | `src/identity/sankofa-phoenix.ts`, `authProvider.tsx`, `authController.ts` | “TODO: Replace with actual Sankofa Phoenix SDK”. Integrate real SDK or document dependency and timeline. |
| **authController token blacklisting** | `backend/src/controllers/authController.ts` | “Implement token blacklisting if needed” — ✅ **Done:** In-memory blacklist when `TOKEN_BLACKLIST_ENABLED=true`; comments for production Redis/DB. |
| **BudgetForm / MilestoneForm / AccountForm** | `src/components/*.tsx` | ✅ **Done:** Backend exposes POST/PUT /api/budgets; frontend wired to VITE_API_URL. |
| **DocumentUpload** | `src/components/DocumentUpload.tsx` | ✅ **Done:** Backend POST /api/documents/upload (multipart); returns { id, name, url }; frontend wired. |
| **ProfileEditForm** | `src/components/ProfileEditForm.tsx` | ✅ **Done:** Backend PATCH /api/profile (displayName, email); auth required; frontend wired. |
| **CI/CD and deploy** | `.github/workflows/*.yml`, `scripts/deploy.sh` | “TODO: Replace with actual Sankofa Phoenix deployment” / “Add database migration” / “Add health check” — add real deployment and health steps. |

---

## 6. the-order — Code placeholders

| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| **court-efiling** | `services/legal-documents/src/services/court-efiling.ts` | “TODO: Integrate with actual court e-filing system” and status/config queries — implement or document vendor. |
| **e-signature** | `services/legal-documents/src/services/e-signature.ts` | “TODO: Integrate with e-signature provider” and status/webhook — implement or document provider (e.g. DocuSign/Adobe Sign). |
| **document-security** | `services/legal-documents/src/services/document-security.ts` | “TODO: Fetch PDF, apply watermark/redactions, re-upload” — implement or document. |

---

## 7. Scripts and ops

| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| **NPMplus HA alert** | `scripts/npmplus/monitor-ha-status.sh` | ✅ **Done:** ALERT_EMAIL (mail) and ALERT_WEBHOOK (curl JSON) implemented when set. |
| **Storage monitor** | `scripts/storage-monitor.sh` | ✅ **Done:** ALERT_EMAIL and ALERT_WEBHOOK implemented. |
| **CCIPLogger** | [CONTRACTS_TO_DEPLOY](../11-references/CONTRACTS_TO_DEPLOY.md) | ✅ **Done:** Decision documented — omit from deploy list unless monitoring needed; deploy via Hardhat per TASK12 if needed. |

---

## 8. Token aggregation and external data

| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| **CoinGecko/CMC chain support** | token-aggregation adapters | ChainId 138 and 651940 not supported by CoinGecko/CMC; external price/volume empty for our chains. Submit chain/tokens to CoinGecko/CMC (see COINGECKO_SUBMISSION_GUIDE) or use alternative price source; document in report API. |
| **Canonical addresses env** | token-aggregation canonical-tokens.ts | ✅ **Done:** README lists required CUSDC_ADDRESS_138, CUSDT_ADDRESS_138; .env.example has full list. |

---

## 9. Tezos / CCIP

| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| **Etherlink finality** | [TEZOS_CCIP_REMAINING_ITEMS](../07-ccip/TEZOS_CCIP_REMAINING_ITEMS.md) | ✅ **Doc:** TEZOS_CROSS_CHAIN_FINALITY placeholder note added. Set confirmation blocks in relay/DON when decided. |
| **Route planner TBD** | [TEZOS_USDTZ_IMPLEMENTATION_ROADMAP](../11-references/TEZOS_USDTZ_IMPLEMENTATION_ROADMAP.md) | Replace “TBD” bridge provider in route-routes and route-planner with real provider or `eth2tz[0]?.provider ?? 'TBD'`. |
| **Placeholder wallet / tx hashes** | Same doc | Do not use placeholder wallet or tx hashes in production; use real signer and `adapter.sendTransaction` results. |
| **Token mapping (138↔Mainnet)** | config/token-mapping.json, [TOKEN_MAPPING_AND_MAINNET_ADDRESSES](../07-ccip/TOKEN_MAPPING_AND_MAINNET_ADDRESSES.md) | ✅ **Done:** Single source of truth in config/token-mapping.json; relay uses it; CI validates; runbook for LINK support. When adding tokens: update token-mapping.json and optionally CHAIN138_TOKEN_ADDRESSES. |

---

## 10. Operational and runbook

| Placeholder | Location | What to complete |
|-------------|----------|------------------|
| **NPMplus HA (Keepalived / secondary)** | [NPMPLUS_HA_SETUP_GUIDE](../04-configuration/NPMPLUS_HA_SETUP_GUIDE.md), [PHASES_AND_TASKS_MASTER](PHASES_AND_TASKS_MASTER.md) | Optional: implement Keepalived or HAProxy; document failover; update OPERATIONAL_RUNBOOKS with NPMplus HA failover steps. |
| **UDM Pro VLAN / VLAN-aware bridge** | [NEXT_STEPS_MASTER](NEXT_STEPS_MASTER.md), PHASES_AND_TASKS_MASTER | Optional: document when VLAN migration is planned; update NETWORK_ARCHITECTURE when done. |
| **Automated backups** | [TODO_TASK_LIST_MASTER](TODO_TASK_LIST_MASTER.md) | NPMplus backup (NPM_PASSWORD); ensure backup-npmplus.sh is scheduled and verified. |

---

## 11. Summary by priority

| Priority | Count (approx) | Focus |
|----------|----------------|--------|
| **High** | 2 | API keys (done); TezosRelayService real mint/transfer; Sankofa cutover when deployed. |
| **Medium** | 12+ | AlltraAdapter fee; Smart accounts deploy + env; canonical token env docs; dbis_core Redis/PagerDuty/as4; OMNIS Sankofa Phoenix; the-order legal-documents; NPMplus HA alert; storage monitor. |
| **Low** | 15+ | EnhancedSwapRouter/DODO/Fabric; network blocks #2–#6; .bak files; route planner TBD; Etherlink finality; optional NPMplus HA/VLAN. |
| **Done** | — | API keys placeholders; emergency hotline “To be configured”; AlltraAdapter configurable fee (PLACEHOLDERS_AND_TBD); Smart accounts .env.example + runbook; Quote service FABRIC_CHAIN_ID; EnhancedSwapRouter/DODO documented; TezosRelayService skeleton; OMNIS budgets/documents/profile routes; authController token blacklisting; dbis_core Redis/Prometheus/risk/alert/tests; CCIPLogger decision; .bak deprecated; NPMplus HA and storage monitor alerts; deployment gaps (env table, TransactionMirror script, DEPLOYMENT_GAPS_COMPLETED); token mapping (config/token-mapping.json, TOKEN_MAPPING_AND_MAINNET_ADDRESSES, relay, CI, runbook LINK). |

---

## 12. Not changed by design — actionable steps

See **[NOT_CHANGED_BY_DESIGN_ACTIONABLE_STEPS.md](NOT_CHANGED_BY_DESIGN_ACTIONABLE_STEPS.md)** for a step-by-step breakdown: AlltraAdapter fee, Smart accounts deploy + env, EnhancedSwapRouter/DODO/Quote, TezosRelayService, OMNIS backend routes, CCIPLogger, .bak files, dbis_core Prometheus/Redis/tests.

---

## 13. Where to update when completed

- **This list:** Mark item as ✅ and add “Done” note.
- **Single index (Blitzkrieg):** [BLITZKRIEG_SOURCE_DOCUMENT_INDEX](BLITZKRIEG_SOURCE_DOCUMENT_INDEX.md) — full table of source docs and when to update each.
- **Source docs:** [GAPS_AND_RECOMMENDATIONS_CONSOLIDATED](../GAPS_AND_RECOMMENDATIONS_CONSOLIDATED.md), [PLACEHOLDERS_AND_TBD](../PLACEHOLDERS_AND_TBD.md), [REQUIRED_FIXES_UPDATES_GAPS](../REQUIRED_FIXES_UPDATES_GAPS.md).
- **Remaining tasks:** [REMAINING_COMPONENTS_TASKS_AND_RECOMMENDATIONS](REMAINING_COMPONENTS_TASKS_AND_RECOMMENDATIONS.md) § 1.6 and Part 2.
- **Deployment gaps:** [DEPLOYMENT_GAPS_COMPLETED](../03-deployment/DEPLOYMENT_GAPS_COMPLETED.md) — env per script, TransactionMirror fallback, smart accounts.