diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..bbcbb68
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,4 @@
+creation_rules:
+  - path_regex: k8s/configmap.yaml
+    age: ***REMOVED***
+    encrypted_regex: '^data'
diff --git a/k8s/configmap.yaml b/k8s/configmap.yaml
index b1c62b8..297e94a 100644
--- a/k8s/configmap.yaml
+++ b/k8s/configmap.yaml
@@ -1,157 +1,24 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: api-gateway-config
-  namespace: api
-  labels:
-    app: api-gateway
+    name: api-gateway-config
+    namespace: api
+    labels:
+        app: api-gateway
 data:
-  config.yaml: |
-    # Gateway configuration - loaded at startup, never compiled in
-    # See REQUIREMENTS.md for full specification
-    
-    # JWT Authentication for /v1/* endpoints (LLM API)
-    auth:
-      enabled: true
-      issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
-      audience: "api-gw"
-      jwksUrl: "http://authentik-server.iam.svc.cluster.local:9000/application/o/api-gw/jwks/"
-      requiredCapability: "llm:inference"
-      tokenUrl: "http://authentik-server.iam.svc.cluster.local:9000/application/o/token/"
-      clientId: "api-gw"
-    
-    # Routes: standard HTTP proxy routes (not LLM-specific)
-    # These are for non-LLM services (agent-pod/console, etc.)
-    routes: []
-    
-    # Models: LLM model registry for body-based dispatch
-    # POST /v1/chat/completions routes based on the "model" field in request JSON
-    models:
-    - name: "reasoning"
-      address: "reasoning-predictor.llm-serving:80"
-      path: "/v1/chat/completions"
-    
-    - name: "ornith:35b"
-      address: "ornith-predictor.llm-serving:80"
-      path: "/v1/chat/completions"
-    
-    - name: "qwen2.5:3b-instruct"
-      address: "qwen-cpu.llm-serving:80"
-      path: "/v1/chat/completions"
-    
-    - name: "nomic-ai/nomic-embed-text-v2-moe"
-      address: "embeddings-predictor.llm-serving:80"
-      path: "/v1/embeddings"
-    
-    - name: "BAAI/bge-reranker-base"
-      address: "reranker-predictor.llm-serving:80"
-      path: "/v1/rerank"
-    
-    # Service adapters for X-Service header routing
-    adapters:
-    - serviceName: sqs
-      upstream:
-        url: http://management-service.sqs.svc.cluster.local:9090
-        timeoutSeconds: 30
-      auth:
-        required: true
-        # Gateway validates (kmsvc JWT validation code unverified)
-        # TODO: Phase 3 - validate JWT signature against Authentik JWKS
-      resources:
-      - name: send-message
-        methods:
-        - verb: POST
-          upstreamPath: /sqs/send
-      - name: receive-message
-        methods:
-        - verb: POST
-          upstreamPath: /sqs/receive
-      - name: list-queues
-        methods:
-        - verb: GET
-          upstreamPath: /sqs/queues
-
-    - serviceName: workflow
-      upstream:
-        url: grpc://temporal-frontend.temporal.svc.cluster.local:7233
-        timeoutSeconds: 60
-      auth:
-        required: false
-        # Temporal has native JWT support via jwtKeyProvider
-        # Phase 3: configure and test Temporal JWT validation
-      resources:
-      - name: execute
-        methods:
-        - verb: POST
-          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow
-      - name: describe
-        methods:
-        - verb: GET
-          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution
-      - name: list
-        methods:
-        - verb: GET
-          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions
-
-    - serviceName: memory
-      upstream:
-        url: http://poimen-memory.poimen.svc.cluster.local:8080
-        timeoutSeconds: 30
-      auth:
-        required: false
-      resources:
-      - name: query
-        methods:
-        - verb: POST
-          upstreamPath: /memory/query
-      - name: ingest
-        methods:
-        - verb: POST
-          upstreamPath: /memory/ingest
-      - name: skills
-        methods:
-        - verb: GET
-          upstreamPath: /memory/skills
-
-    - serviceName: s3
-      upstream:
-        url: http://minio.storage.svc.cluster.local:80
-        timeoutSeconds: 30
-      auth:
-        required: false
-        # MinIO has native JWT/OIDC support - validates JWTs itself
-        # Phase 3: load-test MinIO JWT validation
-      resources:
-      - name: list-objects
-        methods:
-        - verb: GET
-          upstreamPath: /
-      - name: get-object
-        methods:
-        - verb: GET
-          upstreamPath: /
-      - name: put-object
-        methods:
-        - verb: PUT
-          upstreamPath: /
-
-    - serviceName: iam
-      upstream:
-        url: http://authentik-server.iam.svc.cluster.local:9000
-        timeoutSeconds: 30
-      auth:
-        required: false
-        # Authentik validates bearer tokens independently
-      resources:
-      - name: list-roles
-        methods:
-        - verb: GET
-          upstreamPath: /api/v3/roles
-      - name: list-users
-        methods:
-        - verb: GET
-          upstreamPath: /api/v3/users
-      - name: create-role
-        methods:
-        - verb: POST
-          upstreamPath: /api/v3/roles
+    config.yaml: ENC[AES256_GCM,data:AQHxAzklWEksAw1faR8Wel1DzrGaR6hZVTh67JZ2muftm7Rc8CEpG7NAQyEn/2hm38LytuEKHDmZbhguEx2KUoBoSG+IYxqfl4uaLw3CllDQeR1VFkYqrtXZmb0K1rHbKYAzaSS74l5ZIEboHse7E39lINAvQc4ST4Fi/4tg4RoBsqlJoUIkI6/EkX0ls5NsXrq/6G5fCzIQv3WLx2pW7z3wwZpoJ5vgSvE9w7nI92aq8BNShFHj7NaELH25F8VvRCvsqSJfSHhJXLVlMaUDEA9Hkyl494sLg/G4jubfCwhvBHXobnPtc1I8Qm/UTzxg8UYWTr6XwmN7Gdxj+BtzOTLSY+wVyOzmdkGOS2dLOYXqOaRH2XDUkJNsemI5Diow8h8hlmpvmhWJ9AsG/jXjnqfuhPBavjmTWRFMT8B62ph+T3+Sx0g+g/JP+Za4Bncy6wZ1iNa0QvVTh+X0s6uJO/u5GOcpzipT3ctuthluwdnMHsWd7MuY5qH0yppUtRfIIa7Tcqmwc/fcPhWy6W+9b1RRvecAc+WTF58ziAq4EysacM/fAaecD44OrH5pM79qpvF6nn8N/oeyHdpHlojiZatrzfmDA2hCx2JGgdrJGzQ7oKlV6acZHGRPEzh+ziVhpZzbKF35QSOIilvSsGAiQGCOobTPPXBAUmMXozWEsK/is2mBSf+Av/McSPH5Xlkg9fC8HijVZmB0M2DCpTiOwr8mATYT81emqH9kCGePwbjNQxAc08n2fugVaW1kITm84tAjCQLv67HvtZMITtabg6KVbK6weW3bULyoqGddN31IaVsBxNuAGJNeQFAtaGOHTlIQu7hH79USPW7DIdBWQMWKogyghKTgv9hZDxQz8SYMCk4rknWpPZ+CJRQaXVKH9i5IubrecoIS4ZD5iHTrjDddL5diYoMaLmaRhxUUMqxTxbXQZHA8lYbhVqnqfoy9fPb9yV9FfNjpTRAtTav03iD2JH9hYOBFpKfv1CNwpRYUjduYsp8ifQffVVHo/Ru2SHRuBxpgGVHf6BqB3xlUsptMrTVJMGYMaKNFfGLm1wuJGsNqx3ZX2/WX93N++j7A25dfV+Jx7k/g6cR7miicPAVuC4y9dYYStlS6pXWg2aQcwFPSCmOaoPP4Ol1yc+5DhO8+j7KDjfzzak04DjDpWoeYECTwXORL3TNNcCi7yWp6h+dUwjrcDMnBBpPnEeSWqyk6usdijUNZiZgupi12szHDKvebvXFKdsoxjywH0nhRnA8+nBQPYxqivSxnaqkSVTgPMLCG2rhxAt9rD2KOBU4/zBMnivaKYOhhqRKivIwj/V8Ybfyok5W/mGfkXvXU3HPYNvCLLuH8pmaG8Y3iQiCoUB2vLOOZVFMk3n3G97GF036lpsTFv8rICHrBoNhFsRvfz+1u4OVEF00nZuaNwV1przu7ePEQEt/wLnr7RzuTU4csMHlRTjn0bPH3tnRoqhpxBXj3cZDdu7ukNerjAb5ytt8OLOtgTPxPe45rxJKAIet5lFBed1Te43kR4zXxf4fdiUXsbsYVfcl/6g/Mi79sD7xGfCGcppXEYwG0umbSTwUhi2nbGQIR2KDMOnGkCveMBOuY8dUI8JpOxPSibHxKzikcHn58+K5BrV3SZE5YY2nBLu9i1RiKRPHl6gnJMUUgb6zVFQhlP5dzQCRNsjvZ7gWKzJKehZUbmuIQWFuA6QM2OWpS6v93XcC8nFENIkkSvIMZiP/shzzv3L1fMR7dTsRqBLhPsxcPRItSBaVfYfrfDVOeS4eGroqkLoIHC39bKxY1pC4l5fxa536H1DKkNiS2bHpDCAcH04uVeOUKmPGLDEqcSiYBpvYXCIDOE/4BFE0wM0BXDNzkYcxvovu02z5Nr3hKbCot0gmeQGOzXWdlOTPAGdW20PU676Fs/G8rqNJhKnkrJEsZ1VsOJuDS+4GAVybAG++NPHrtqmNeN5IthC7Et1qR9dPQJ6idPLxLy0LbhbLJKAAAcpi4ZHrqbsSvu4GfeXp/5YdBKqY0RF9RjL0ptJMRRm+/kg2BMrxBGjNhZMDLgW/9VapITCH1rFBYOz1Cu53+90Asc3Uo66XdqSGQw1yBumIwu66SJArfwqv5Pz9RyabbpDDbXYmDP0AtL+rtVfGnCNCSU3h9og8H18pEBFdmJY7xkkoUu+ncAoL4qp0irdnb1YUGjMUI8f5TuBgLVg0gCZeDIY8Qf3Nty+jdpBmvhYshTdlhQe42n9NmGUtBai8m1tTOMzEo+RDUiIY3B4tczyNm5G2pVXT7dcBtgPrWoMV46+ieUQFueyuVqOL4Xyae3OhothatmGv012zZu0xPWreEP8OPhINy++uTtm4fkVM/ieuglTWfu5DmRV6Xeal/LgVCPgVpQ1WxB613J/7h1zFZg8OLP4X4sQ1dvigUtcWkMzuRQZa1MRkyKp5MOajUDTcNv6BshkIS6yyIiuzu3XJS7MZGh5pFzvcMhFaJqDMsKQ0Celd5MX3/2vutK2EoNIL+6yFOsLFSQ1VthfeLwkWXYS5d3u1uSjsKngLIoZYLuW7WZGaaJVKAcoPzLW7HU8IW3duM4iflkG3KvLLq/aVSE+DN72ga4TnDNtjOlyDJtP/9lvG1IOFLWbhWslrZOYMOqiay3rvd3QT1e6qMPXAlbGWomxMyY7UQqEqbZDCJvL3yZqtI6dhzkyL/CSzSXiU/gaO3qFGoQHNtLwwXqBBsgtUcIZwAW/uzPGgvacLyin6p1ezW4H40UzkhzHBwiMKhRumMPyGCw8uo65nun0KScWqsu0hjDMGHYRBCoHLavOJ+lgXquvcg9ct6w16OXVBH8HiW1cg5UBIywP7oSTzePslxcVHY2dlOBUK5/Exdvg8ss8C6jUdkuSZOlbHBH/RWlYR89VnfoezAKuVgcn2hsGyPmLP+e6IiEgGGzc5z+KPamGAoyqPj77Q8vzBzAXd8PEf80NRz9j9K4EDE4MxadcoLFFW9HkrCYUBWC3JBsMUmuEUIoZIQTAJngvNS3kbx5+GIte+wykugztqAQm37UEsVKxlC1Jns6Xr638oKvmd4uGYmMbFq9ARzhx+NyNMpZWxJubln+LskFGRocQ/HNWr6Fjkb96AGV3gCMMJ3R6XteRJvssqI5q2k9dmfRaoiw/T+bBWlWNfqR7FgVrFCW+KGleBBmZQi8YAfn6pqRIe7tikS+VUaKHOrG1AEnoQMuOQaTy5sWEpm1NG2Ugqe0I3dTZo4HJHdtVwJzYNNMWToGjbGtThpsdvn/kQLMixj0F219ILDBt6YtP7VogMZ9dSUVHIm6MJnnyE2w9OtR5xbwVhYAIUwSEyvPUlNoN9+sQ6Hsevyi5hGqULfh9iXsGOIktHY4ALXpVdsI1O5fIvxWrPkYlHJTBwgfb4RGL65slvHUKCQZAX8ec5qAcJoxBdyZn8V6gVjb6OPNxVhRETDQTYscwfyzUCWNuLtxCnskcvOLm/iFm/2AqKclocf1/YEIpDm+kRElG1CsUa/CgI2xCj6UKDZVVaTwoRCN/PZ1goHkb35n1QhmmZ4kbi9MQHVdFOQnM3AN7c2tdVJ/2vYWfISSD1b+ASG5HP2cZG4HUS5ae4SJd/TED2BMC22lxkHUVeLlztCShyTHak40Au8brJSykJNiTloGY7XHRFIXBdzfBluLpzzcyIGL7pxjJp/tc0DdztxdNhkX+7pKAvOb0DM5HhuyeH3IFxYx8+mJq9bSrD3bjlZXSrPLMgzk/ht102QhrpmSUIoYdJLFCywBmGI9nJd+5CyLps0UlF6OV8t3ndm/NMRF7kcLyhxmYNotddn9tuc2hBM/3zQHs4vwJobGuvr/9gKfgTOm6a3Gvlb0O25wOxJdcMDWxwvIAOBl2LLT+aIqP3fDaKhTeti8p57gWpAOm1OxG8/S5ONsNCjMucy3TT+Jft0JMlZIHLTYcz/GmZzA3GrRc3kbngIyBUjrUkQtwdGGxOgvvv2QCSD7/kcK9lz84UOl4kQVTwVgjoJZk++FUyfVrsCH7BBLct4EGLFMvmvXxVcM+Glxe5eUgepNy5lmF8f7Mjwf9sB/d46oC5qP+N7lUjs2JO0JNcISbchwyYssqS7LuTDaLAsEO0Z8RszhQXu+EW7o6FP/MGytzavRE0hYbDKHMFsqZgV0Z/tiKnhKbPkdIHALFYyh5fUmUntT/K2xYbq2dUXjKBKDUeNN8o9ZhMLjBHollVIjo7LR3/sZNIS0rgHqLGW/5mCr3jLUzfDrciyVgRWHic52F+DalsA0rIS1+b95jhuH1bI+DBihZY6EJtKdX52kjtTL+yvwbkHzxIYBZKhV7VuTTmal1HWgY/blx6nHrCPoz11kCJELxC8IVznE4ZyPTX1sLWgOr1xEG9wZQ4Wbxq3CiBz4uFG4E4guaSJIpKWc0/Xsj11viMmh415AEdW4mWHn7GKhYVj+c9MrKvuJ+ZhGuIt7kSLRJGwCmSbT02CzOpTUFB4H0nUYSDE0tTVLAzJ123sz2Aa3xH8MrCevIGd5uTGsd0c7Gig2ixgzB5VYtFINc1d1Ob4JDWnW5x0Sc2JgXcat0RHPhP18b2INv9q2SV0DEmI6+h+OfZ1WEthim/evofQwD//px9Nkf2lj8TbAGVyCWNck6BlvrFWtP73sPmU4lnoNr6LesrLWMQXY5JiFa8C4M2qqUeHHI2j0MB08zG92TU29O+ovElhrt0d9SpSXTIPT/jWaJNYy6qTUlUcwp8/Pipo1eIRQgjhaIWpzXM1oCd19q8OVlC/QHUbDLTcWn43xNEkiBCL/m+7yLwF7w4rnDpOzWBnZkHklYHAWhs4qRoqgukMWITbXowj7ATXu9SgEqke2KncUVXqWQbTHHIcPwOp/EEC0g8wcxHJZHCx2r8oEi7u6FfJs+mt8yq4gY2IGIr6wMMJn4UU1rloQVt4fhZRYVBEddn37DkWjrZ4oYi54xWLVS3ms6uyZuk3ve2SiHEqQSWMzheNkDMEHRw32GMFe82YUO55+pZ3UEVL/nNLujCCtS19LyM/JarlnZQ2b4yqx7P9P094M3/SixPd22ad4b/xdlcVhih6PBYibw4+heiY5bHn6bncXY5emeaQhm1h314oeq3gTea5zNso/WON80gQnGB4yU4wZsmmP09So1XPsD2YMNNVfi/gK4J8uvocNpwRqP3UbXUOUH+m7vsY+PUbedd6gS4kqb5OjUVpF7PMrguO9A==,iv:ApldFxLlG/wUrrLXZVyEQrZsv25VqZfrtxMOR0b3A4g=,tag:oO98FOrBN7Wu3JUfkNsL+g==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxNFk4M3VVRHZvM2N5Qm1P
+            SDZKeTNPYjh1QytMWjVaUFk1WGFkdmo3T21VCnp3MGt2dTNXNHhSdTVEMjhjeUs4
+            cFcxWFJRWE9EMDlrMGR6M1BkWXRwNXcKLS0tIHFvaEQ4YWtDU05UTHplUDlRVmFq
+            SXB2b2wrZlVCeUhXaG5QQkxWQXJ6aDgKqV2V1jyeKQHr1iDaWR36WZWZdkZeSUcw
+            BcA8vT73qdIb3Rnt6zYIBfgFYuVgQp4m+2pU3J4xgyGKPwQEtLz2XA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: ***REMOVED***
+    encrypted_regex: ^data
+    lastmodified: "2026-09-12T23:58:01Z"
+    mac: ENC[AES256_GCM,data:4zterh5GOq6fibw+npmmIB//+7nYoKoQDXoinNCbTEAiQPuxqcpYJn1Mxmt37ZobG8Y7rqQYEpoRLCangFZA2b7mbkEWeEf9qXhP+cufqWB+Aagr7b8XmbL6tNSRxamxr+4WyjJzSrY+5w6d/4usDGRJhs+AB2F/Vmq7peDhZiU=,iv:G+ZbPJ7YiQlrhwt+7EUxWq8pNelw/bUz6thYufh3+rA=,tag:uaCoQ7wg7Rg9xKkq5ZT6NA==,type:str]
+    version: 3.13.2