diff --git a/config/omnl-banking-portal-host.v1.json b/config/omnl-banking-portal-host.v1.json
index 372f9c1..7171d8b 100644
--- a/config/omnl-banking-portal-host.v1.json
+++ b/config/omnl-banking-portal-host.v1.json
@@ -34,6 +34,14 @@
   "handoff": {
     "refreshCommand": "pnpm ali:hospitallers:handoff",
     "verifyCommand": "pnpm ali:hospitallers:verify-external",
-    "onboardingDoc": "docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md"
+    "onboardingDoc": "docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md",
+    "workflowDoc": "docs/04-configuration/ALI_GITEA_TWO_REPO_WORKFLOW.md",
+    "forgeRegistry": "docs/04-configuration/FORGE_CANONICAL_REGISTRY.md"
+  },
+  "gitea": {
+    "appRepo": "https://gitea.d-bis.org/d-bis/smom-dbis-138.git",
+    "opsRepo": "https://gitea.d-bis.org/d-bis/proxmox.git",
+    "branch": "main",
+    "user": "ali"
   }
 }
diff --git a/docs/04-configuration/ALI_GITEA_TWO_REPO_WORKFLOW.md b/docs/04-configuration/ALI_GITEA_TWO_REPO_WORKFLOW.md
new file mode 100644
index 0000000..ea78528
--- /dev/null
+++ b/docs/04-configuration/ALI_GITEA_TWO_REPO_WORKFLOW.md
@@ -0,0 +1,96 @@
+# Ali — two-repo Gitea workflow
+
+Canonical layout per [FORGE_CANONICAL_REGISTRY.md](./FORGE_CANONICAL_REGISTRY.md).
+
+## 1. Cursor Remote-SSH
+
+Connect to **`dev-bis-ali`** → open **`/srv/projects/proxmox`** for ops docs and orchestration scripts.
+
+## 2. Edit banking app code
+
+Primary workspace: **`~/smom-dbis-138`**
+
+```bash
+cd ~/smom-dbis-138
+git pull origin main
+# edit frontend-dapp/, services/, config/, etc.
+```
+
+## 3. Build and run on dev VM (`.59`)
+
+```bash
+cd ~/smom-dbis-138
+git pull origin main
+bash scripts/deployment/deploy-omnl-bank-production.sh
+bash scripts/deployment/deploy-omnl-domains.sh   # dev nginx only
+```
+
+Health checks:
+
+```bash
+curl -sf http://127.0.0.1:3011/api/v1/settlement/health | head -c 120
+curl -sf http://127.0.0.1:3012/api/v1/exchange/health | head -c 120
+curl -s -o /dev/null -w 'frontend=%{http_code}\n' http://127.0.0.1:3002/central-bank
+```
+
+## 4. Push to Gitea
+
+```bash
+cd ~/smom-dbis-138
+git add -A
+git commit -m "feat: your change"
+git push origin main
+```
+
+Remote: `https://gitea.d-bis.org/d-bis/smom-dbis-138.git`  
+Branch: **`main`**
+
+## 5. Production banking LXCs (5820–5828)
+
+Operator sync from LAN (dev-bis-ali or Proxmox host with `pct`):
+
+```bash
+cd ~/smom-dbis-138
+git pull origin main
+
+# dry-run (default)
+bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh
+
+# deploy all nine LXCs
+bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh --apply
+```
+
+Single LXC:
+
+```bash
+export OMNL_PCT_CTID=5825
+bash scripts/deployment/deploy-omnl-banking-portal-pct.sh
+```
+
+## Env / secrets
+
+| File | Contents |
+|------|----------|
+| `/srv/projects/proxmox/.env` | Proxmox, NPM, Cloudflare, Gitea tokens |
+| `~/smom-dbis-138/.env` | `PRIVATE_KEY`, `RPC_URL_138`, `OMNL_API_KEY`, deploy keys |
+
+Both: `chmod 600`
+
+## Verify public endpoints
+
+From operator machine:
+
+```bash
+pnpm ali:hospitallers:verify-external
+```
+
+Expected: **14/14** public endpoints passing (9 portal FQDNs + API health routes).
+
+## Summary
+
+| Layer | Repo | Deploy target |
+|-------|------|---------------|
+| Banking app | `smom-dbis-138` | `~/smom-dbis-138` (dev) → `/srv/ali-portal` (each LXC) |
+| Ops / edge | `proxmox` | NPMplus, DNS, LXC map |
+
+One monorepo, nine public URLs, same stack on every banking LXC.
diff --git a/docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md b/docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md
index 971ff3c..b286fad 100644
--- a/docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md
+++ b/docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md
@@ -2,8 +2,7 @@
 
 Verified path: `pnpm ali:hospitallers:verify-external` → **PASS**
 
-Full canonical copy lives in the **proxmox** repo:
-`docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md`
+Mirrored in **proxmox** repo: `docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md`
 
 ## Path diagram
 
@@ -23,7 +22,7 @@ Ali laptop (Cursor)
 | LAN IP | `192.168.11.59` |
 | User | `dev1` (NOPASSWD sudo) |
 | Cursor workspace | `/srv/projects/proxmox` |
-| OMNL repo (on `.59`) | `~/smom-dbis-138` |
+| Banking app repo | `~/smom-dbis-138` → Gitea `d-bis/smom-dbis-138` |
 | Proxmox host | `root@192.168.11.13` |
 | Banking LXC CTIDs | `5820`–`5828` |
 | Banking deploy root (each LXC) | `/srv/ali-portal` → app `:3000` |
@@ -39,6 +38,10 @@ Ali laptop (Cursor)
 
 Refresh: `pnpm ali:hospitallers:handoff`
 
+## Two-repo layout (Gitea)
+
+See [FORGE_CANONICAL_REGISTRY.md](./FORGE_CANONICAL_REGISTRY.md) and [ALI_GITEA_TWO_REPO_WORKFLOW.md](./ALI_GITEA_TWO_REPO_WORKFLOW.md).
+
 ## Quick verify (from `.59`)
 
 ```bash
@@ -46,12 +49,19 @@ curl -s -o /dev/null -w '%{http_code}\n' http://192.168.11.211:8545   # expect 4
 ssh root@192.168.11.13 'pct exec 5825 -- ls /srv/ali-portal'
 ```
 
-## Deploy OMNL to banking LXC
+## Deploy OMNL to banking LXCs
 
-From `dev-bis-ali`:
+All nine LXCs:
 
 ```bash
-export OMNL_PCT_CTID=5825   # or 5820–5828 per product
+cd ~/smom-dbis-138 && git pull origin main
+bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh --apply
+```
+
+Single LXC:
+
+```bash
+export OMNL_PCT_CTID=5825
 bash ~/smom-dbis-138/scripts/deployment/deploy-omnl-banking-portal-pct.sh
 ```
 
diff --git a/docs/04-configuration/FORGE_CANONICAL_REGISTRY.md b/docs/04-configuration/FORGE_CANONICAL_REGISTRY.md
new file mode 100644
index 0000000..fdf7c7d
--- /dev/null
+++ b/docs/04-configuration/FORGE_CANONICAL_REGISTRY.md
@@ -0,0 +1,66 @@
+# Forge canonical registry — Gitea `d-bis`
+
+Single source of truth for which repositories Ali and operators use. **Do not** treat GitHub mirrors or ad-hoc “banking portal” repos as canonical.
+
+## Canonical repositories
+
+| Repo | Gitea remote | Path on `dev-bis-ali` | Role |
+|------|--------------|------------------------|------|
+| **`proxmox`** | `https://gitea.d-bis.org/d-bis/proxmox.git` | `/srv/projects/proxmox` | Operator / orchestration — manifests, LXC map, NPM, deploy orchestration |
+| **`smom-dbis-138`** | `https://gitea.d-bis.org/d-bis/smom-dbis-138.git` | `~/smom-dbis-138` | **Banking app source of truth** — all OMNL portal code |
+
+Optional: `proxmox` may vendor `smom-dbis-138` as a git submodule at `proxmox/smom-dbis-138`. Pick **one** primary workspace for app edits (`~/smom-dbis-138` recommended) and stay consistent.
+
+## Branch policy
+
+| Repo | Branch | Notes |
+|------|--------|-------|
+| `smom-dbis-138` | `main` | Production banking stack (commit `33e9316`+ verified on dev) |
+| `proxmox` | `main` | Operator scripts, LXC sync, infra docs |
+
+## What lives where
+
+### `smom-dbis-138` (banking app monorepo)
+
+```
+smom-dbis-138/
+├── frontend-dapp/              # Vite SPA → :3002 (dev) / :3000 (LXC edge)
+├── services/
+│   ├── settlement-middleware/  # /settlement/* → :3011
+│   ├── dbis-exchange/          # /exchange/* → :3012
+│   └── token-aggregation/      # /api/v1/* → :3000
+├── packages/
+│   ├── integration-foundation/
+│   └── settlement-core/
+├── config/                     # omnl-*.json, production configs
+├── deploy/nginx/               # omnl-domains.conf (dev nginx)
+└── scripts/deployment/
+    ├── deploy-omnl-bank-production.sh
+    ├── deploy-omnl-domains.sh
+    ├── deploy-omnl-banking-portal-pct.sh
+    ├── sync-ali-omnl-banking-portal-lxcs.sh
+    └── start-omnl-banking-portal.sh
+```
+
+### `proxmox` (ops)
+
+- LXC CTID map (5820–5828)
+- NPMplus proxy hosts (9 public FQDNs → LAN)
+- Cloudflare / DNS runbooks
+- `pnpm ali:hospitallers:handoff`, `pnpm ali:hospitallers:verify-external`
+
+## Public surface
+
+Nine FQDNs (see `config/omnl-production-domains.v1.json`) — **one stack**, deployed to each banking LXC at `/srv/ali-portal`. No per-FQDN git repos.
+
+## Credentials
+
+- Gitea user: **`ali`** — `ali-gitea-credentials.env` (handoff bundle)
+- Env split:
+  - `proxmox/.env` — Proxmox, NPM, Cloudflare, Gitea tokens
+  - `smom-dbis-138/.env` — `PRIVATE_KEY`, `RPC_URL_138`, OMNL API keys
+
+## Related docs
+
+- [ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md](./ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md)
+- [ALI_GITEA_TWO_REPO_WORKFLOW.md](./ALI_GITEA_TWO_REPO_WORKFLOW.md)
diff --git a/scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh b/scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh
new file mode 100644
index 0000000..b230598
--- /dev/null
+++ b/scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Sync OMNL banking portal to all Ali banking LXCs (5820–5828) via Proxmox pct.
+#
+# Usage:
+#   bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh           # dry-run
+#   bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh --apply   # deploy all
+#
+# Requires: root SSH to OMNL_PVE_HOST (default 192.168.11.13), built repo at ~/smom-dbis-138
+
+set -euo pipefail
+
+REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}"
+DEPLOY_SCRIPT="${REPO_DIR}/scripts/deployment/deploy-omnl-banking-portal-pct.sh"
+APPLY=false
+
+if [[ "${1:-}" == "--apply" ]]; then
+  APPLY=true
+fi
+
+# Banking portal LXCs — one per public FQDN product surface
+CTIDS=(5820 5821 5822 5823 5824 5825 5826 5827 5828)
+
+log() { echo "[$(date -Iseconds)] $*"; }
+
+if [[ ! -x "$DEPLOY_SCRIPT" ]]; then
+  echo "Missing deploy script: $DEPLOY_SCRIPT" >&2
+  exit 1
+fi
+
+log "OMNL banking LXC sync — CTIDs: ${CTIDS[*]}"
+log "Mode: $(if $APPLY; then echo APPLY; else echo DRY-RUN; fi)"
+log "Repo: $REPO_DIR"
+
+for CTID in "${CTIDS[@]}"; do
+  if $APPLY; then
+    log "Deploying CT $CTID..."
+    OMNL_PCT_CTID="$CTID" OMNL_BANK_ROOT="$REPO_DIR" bash "$DEPLOY_SCRIPT"
+  else
+    log "Would deploy CT $CTID → /srv/ali-portal (pct exec on ${OMNL_PVE_HOST:-192.168.11.13})"
+  fi
+done
+
+if $APPLY; then
+  log "All ${#CTIDS[@]} banking LXCs synced."
+else
+  log "Dry-run complete. Re-run with --apply to deploy."
+fi