diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..11685d4
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,4 @@
+creation_rules:
+  # Encrypt secrets, configs, and deployment files with infrastructure details
+  - path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml)
+    age: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
diff --git a/k8s/configmap.yaml b/k8s/configmap.yaml
index f5a0807..09038c6 100644
--- a/k8s/configmap.yaml
+++ b/k8s/configmap.yaml
@@ -1,157 +1,24 @@
-apiVersion: v1
-kind: ConfigMap
+apiVersion: ENC[AES256_GCM,data:8TQ=,iv:U7JYi6fxipUMyscpSpeJD7muF+hCgylff1dnJkKzywo=,tag:lupDub5YL+J9ckzrKc/4lA==,type:str]
+kind: ENC[AES256_GCM,data:XSYDX0OyRWMU,iv:q85HtZddwP6hfQu+EwwOE+3a+tN04uuKKOOdtaJc2g4=,tag:vRLf021ZCugfduJCc/WTOw==,type:str]
 metadata:
-  name: api-gateway-config
-  namespace: api
-  labels:
-    app: api-gateway
+    name: ENC[AES256_GCM,data:D2n/HWMdgS9xsHeD6nDNaDt9,iv:cr9coFTu7uhlo6HYZV9Ux//KUzoDY/ydw+RSKFb2z3E=,tag:QjMi5VRdCXhyO3A44hrL7Q==,type:str]
+    namespace: ENC[AES256_GCM,data:sWer,iv:aT7nKAm0KM1hxyAuj1oTeeIHwyfMlmx9yAIv+cW+kio=,tag:XuZJjwnj9eClQ8HUKe1EgA==,type:str]
+    labels:
+        app: ENC[AES256_GCM,data:6QeLYRWYA5oMSDY=,iv:Jiv8aLjJN6H7l4/NxqaNG5sSgsWosDc5j6eLEayG3IE=,tag:xkU0ti4hikIPi6xbthH0gg==,type:str]
 data:
-  config.yaml: |
-    # Gateway configuration - loaded at startup, never compiled in
-    # See REQUIREMENTS.md for full specification
-    
-    # JWT Authentication for /v1/* endpoints (LLM API)
-    auth:
-      enabled: true
-      issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
-      audience: "api-gw"
-      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/"
-      requiredCapability: "llm:inference"
-      tokenUrl: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
-      clientId: "api-gw"
-    
-    # Routes: standard HTTP proxy routes (not LLM-specific)
-    # These are for non-LLM services (agent-pod/console, etc.)
-    routes: []
-    
-    # Models: LLM model registry for body-based dispatch
-    # POST /v1/chat/completions routes based on the "model" field in request JSON
-    models:
-    - name: "reasoning"
-      address: "reasoning-predictor.llm-serving:80"
-      path: "/v1/chat/completions"
-    
-    - name: "ornith:35b"
-      address: "ornith-predictor.llm-serving:80"
-      path: "/v1/chat/completions"
-    
-    - name: "qwen2.5:3b-instruct"
-      address: "qwen-cpu.llm-serving:80"
-      path: "/v1/chat/completions"
-    
-    - name: "nomic-ai/nomic-embed-text-v2-moe"
-      address: "embeddings-predictor.llm-serving:80"
-      path: "/v1/embeddings"
-    
-    - name: "BAAI/bge-reranker-base"
-      address: "reranker-predictor.llm-serving:80"
-      path: "/v1/rerank"
-    
-    # Service adapters for X-Service header routing
-    adapters:
-    - serviceName: sqs
-      upstream:
-        url: http://management-service.sqs.svc.cluster.local:9090
-        timeoutSeconds: 30
-      auth:
-        required: true
-        # Gateway validates (kmsvc JWT validation code unverified)
-        # TODO: Phase 3 - validate JWT signature against Authentik JWKS
-      resources:
-      - name: send-message
-        methods:
-        - verb: POST
-          upstreamPath: /sqs/send
-      - name: receive-message
-        methods:
-        - verb: POST
-          upstreamPath: /sqs/receive
-      - name: list-queues
-        methods:
-        - verb: GET
-          upstreamPath: /sqs/queues
-
-    - serviceName: workflow
-      upstream:
-        url: grpc://temporal-frontend.temporal.svc.cluster.local:7233
-        timeoutSeconds: 60
-      auth:
-        required: false
-        # Temporal has native JWT support via jwtKeyProvider
-        # Phase 3: configure and test Temporal JWT validation
-      resources:
-      - name: execute
-        methods:
-        - verb: POST
-          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow
-      - name: describe
-        methods:
-        - verb: GET
-          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution
-      - name: list
-        methods:
-        - verb: GET
-          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions
-
-    - serviceName: memory
-      upstream:
-        url: http://poimen-memory.poimen.svc.cluster.local:8080
-        timeoutSeconds: 30
-      auth:
-        required: false
-      resources:
-      - name: query
-        methods:
-        - verb: POST
-          upstreamPath: /memory/query
-      - name: ingest
-        methods:
-        - verb: POST
-          upstreamPath: /memory/ingest
-      - name: skills
-        methods:
-        - verb: GET
-          upstreamPath: /memory/skills
-
-    - serviceName: s3
-      upstream:
-        url: http://minio.storage.svc.cluster.local:80
-        timeoutSeconds: 30
-      auth:
-        required: false
-        # MinIO has native JWT/OIDC support - validates JWTs itself
-        # Phase 3: load-test MinIO JWT validation
-      resources:
-      - name: list-objects
-        methods:
-        - verb: GET
-          upstreamPath: /
-      - name: get-object
-        methods:
-        - verb: GET
-          upstreamPath: /
-      - name: put-object
-        methods:
-        - verb: PUT
-          upstreamPath: /
-
-    - serviceName: iam
-      upstream:
-        url: http://authentik-server.iam.svc.cluster.local:80
-        timeoutSeconds: 30
-      auth:
-        required: false
-        # Authentik validates bearer tokens independently
-      resources:
-      - name: list-roles
-        methods:
-        - verb: GET
-          upstreamPath: /api/v3/roles
-      - name: list-users
-        methods:
-        - verb: GET
-          upstreamPath: /api/v3/users
-      - name: create-role
-        methods:
-        - verb: POST
-          upstreamPath: /api/v3/roles
+    config.yaml: ENC[AES256_GCM,data:sftE71zaAWON8K/+UF83XPFwdSfiztcC8ToJEXzAdGvBxxIcFrgdH+38TgrmKXMmox+SSjU8r/Du/6SoUy8GytDRBg+lIQ9z1AbnvHVbqmeSACFtFm3fCZS7PhgFRAnwuMJ8MA8Rw3tGfCxawGsxuNCd+ucLcTui+sbH50OgZOyF2tW3RioVwtGkN5IT2VSXu8il7BO7SWCFAiVbN+Z8juGrEeu2XZhGHXCWl9sfvHSBtCq0B9y4FzYC/ysv9UyCr5yGuygLl8vsHcyCfJdrCjOY9GYbRDzkR5f3BJb5ibLDnZNEzPQgqxWiKv907+BwlNi33LquMgvzhcADubcBfRcadVM3yKTYpIqS9BYnHdY1eRyzluiOdBYbFwwTvJw2KP+mipOQAK24DNjU3dUticnWmgMpQ0KJvnKchplvGxBd0RevZId7UIUAs4Ce5yKDHa3vEWqDwSN3xTWViwXBl75/O/SchPcJXVkEzjtFZFBUcpTfA/AGkpXex3ZW7OII5TKwg3F/a4JcYFbwPaoUT/pIUt/usYte2H8AiWPACNfslu0t4WnDe1wXwwL8l6AdXa4zM0whPREuCmAOEh+qSUpwyqNniWk+bPu4pLwk1SdCZcgyqcfsy2t+S0yPRGpprgyWsc62d4oHuZ5Sui1AXB4iOIN/DpAfMu1BABdePt5m60iOIVZOvwV6BI1bVCc9wlMKvc+dGf/5mb1wMgTjklP6BGGvSlaYEAkZt0oGylTvOEniluWtDw/Q5i18kgGN6xtJS9F9I9KR9xrpnvJEuTh0cv00MQFNIenegIKakheqr2t/pTkTTcHZO0eSFiamQz1ldSDRWtuQBrmbDKC++BACDmTau7N/pyvdX09+/J6i2bktRRD9AfbaWFDeIaz3bNGh0c+kP7X8Bf8qyb+YMQ1E+5cyTGm00TrCY+fCQOCa0PuwHPHN2jtHkVCdzMElHq4M0K/ZjtilXIQRLw2o8L6EwNkLhDlTM6nrgV/B6jVlSpWsVNfNAo9fo4Gfi5SGJp2okA94TxAufe3kiUHC9q4N137VnFKYobUaP8lhaHVrso5PbYxOD2W4cKVsS3vBbcwIksrRFAkSrX+kLPXYIZR7i1Lb7NnRvt12la8skYg8DPJUVss8vPq1HZMhRBLmCRaKovdxroMENMh+ZaFq2ugRK8SN9uKf1xma6ljKJKmY2rpci1tfPVooOfjIDKfO5T5NkDRYH48ifUPKqG2zubiFB0D76n64VZPw6dNbpH81rJTbX0S1VMKHkKvEQL8irxseRPOx29Jw0IjpnV5q8vDmWaFzM5+vo/eAI57ZnCjMrSJvdDr/OR8fCLxS/2SmFuoNNv1gYsH4M4N9+oCQ+ZS/OpcZzhzNd+OXpqw3HSEDMAk/RaNwOYH9KCURDiP5XZ9gWklw9gMBSKQC+cuterhpsaTvRJizRPQxqpJicUNiS4RMnpxzGqvqK3bY2ZgnbKxlFfoccDbcIN1LK4DPe2c/nEinJRlVAlcOZxcp0fqgliFpQ5mZg7/qqDYC3vLxUfGd2J3OyyCsa2TVhM+jt/w9NMtWkau3rGKJd9xBhYZLGNKZdYnvFBK8hWSFoBXOvvUrrhoGVGp7F6/2+MnCD77RZd8o9KC4bKJ6MEB8jTpSfAYKnVVkPzoU31tdhnwf2BLOzdmX/rCy3bdyu1vSOWFzrMBiB/uUnmTEVplfx1cX+WpbevsE+M765gtzleyC3Lc+2TXTWcQRBGvqmi0xr+Deby0r9cciV5m/5DDe7PVAnevtDUt0M5Cd7iujzwd6LQtNdvV59FLsK3phjewYNrFvvcxOzAoFNIAlhDacHghpDehUyAJUxO5xKsuhP/FaMgcfMH0cIYr7Xjs/QHu13QcQKvyWLh8fEpmQOky0G+Tkbqb3CcJT+CTAHYFVtHfv4cE9JQIt8GQcsE+6Kn7RiSHv4l9dKdhGA2+2OECT/NWFjNIUDgIsdd+h5upqEnYu1lyf+2059tThOuDHIU4gEdGJnzAdrK5udP149xgfl7SeaFcxSqC1gK/d9afAAdvnAaEBrIgzzfhSekvQPFvTu320JDZ2eN4Me5zrFxZpVAO8sAreZF1bAeC9TP3P9zzaUWfrMRhu4lE2sqorxBLh70b1by932jW6sIfduXO8AIKPTfF5lEYFkqwcXVSA0a4Dqk/G9u74WGIofT+cG9EseBJZgTqSjq1t8AHGXq5qLBEIknt9q4hGxyBo2c+F8P5SCxxDnR+x1d9fhUkOK4zWqvW0uR9pL2vLYgAOlCCWomCqPQX12XmRSUfxlHl86GwBxbSEz8RoHAgOeRee2ppvtyfWYFLFBCkt7yOv+sqDb5G5gk1crAmHtdVpvqSk4HtMOHwl4tAl3xMRktoEghcniTteAYGo3jKX9YNyl5DjE487At6swFwyD8P6CeiGP0pnDvrcnAsnEjgIuYkTSbAeJHakOPukUSvPEi1Hw3JAkoNwNjtRLT2SgqHOSXBB3n4QW/NpBl1Ojw5Ps89I6AirO8YJoFMEkbm+cG8a2fkK40mvrVmIG0k9mdAiFXgaZqx+pArWo0RlkKvPuAjL+ywJh8soU4lOAccDCWWlvp7snxC72hG1TvKE3LqdWoo4TVs6KPoBarZZ3n1cJ+A24SgSRI7SHh95XrS+Tx3aRgbDdHJhHfrZARwfeNFbEDrv78wZFzS5/rla7BLfV4kcavLLJt0mRORmxRTiNMxiVni5uAKfanhzYis4MVYhbLp86Swbnx5JwNXNXeJgU3x9ZHwGEdlGTU+qQjPKwmQh1QUEzxYRnty0qJPD3N4eH1jNzomhrXVjGAVTfpvtQ2uUOTJa7jaViHHxudRfNHblNrZed05mLwi6fl+CYBJrNRw7C/Iqn26yuiCQvIY4EQ4Kssm2sJJ+YIlQJcIyf+OnM9J8J8rBHtuEDfknJZfVzeF9AXNmGt2GkD4dK4c+bMer4mFWe+QEosvLcnBBW0PgASVMhfOdUQn7MDF0z67f7+F5q2PKWbYYrqz4y0LZC7Gju+WmpbV16z+o9I/ps9MUMoVz/Hnj29Sg9cIh1Xlxq5dhs1NSNpixzYVObdQEjvF1GaNYZpk67WYyGRiXTh0Gjapbik7xwQV/8Wn00f1YdjeY+7F1eQ/NPLmtsdVxfTPomtNjxoICT7FyIHJUSJm4v+srM4GX9n0DR5qaYmpxTxXiXP+Z7wroEWgaZcGwH0UXIjwL5N57X6m6kTLcJ3X3ped3P6mLEBAgxwu0K1IOZyBj2a7o++ajhOOA7uaP5umgGXItqs0613iK7BeshNmdv7lDmObTR++2fIhs51LPqg/f100yGVonWI7Dg1VUel+OXGEzmA4V6WDaAIehlg7kFTYO1e9HTkOv41bI4N3n8f2XVZXJZIeKlrTtNhPp/F9DQsBUtqFYvlycVXkIw9PakIdkQC8QQK3FKCKGp/hkzGHfsTB+WBCEf3D1bBbXHpGAUB040W1Z1B8PQIkcr3INPZTW0+0WE0TPw/0Q6cmtF6fwv0A2mHuqW0iyp/PtTd7f2WVesgR1lMr2ljxhdmv9VOcBPY4fkXairg8qzo5+b2PaEZ1qES6bzJJ5pouxVU3YDzf5Usv0KRVktIvVwywOmJ2bHZJxNbrR9WFFumZ/12DvDU9uLcZAUQlIDU+E5+rem4h1JMiz6UC7NzfVMzCeyEQXzPtVM0ui8Yls0ADqGZv1qkF0v9Ys3OXwe7XUKOGanhMda0UbfpqlHy/NyCizRG7TcUW2mk4eCZWisls3uCbAU3UTMFSX203DH7SxuDmbcGEF1+mInK137rhqFLZU7ICIwrxFem+SWlDzkozxcP+aG6qFv4tEMUGK9+q6gXk1kwIiVdrBgPSl055VBigf5+sA1h/X0s9c7FX8ruT2Ba7B+s2X1ZsYXiu8nUdr2uvCGDwKYsC7a5edtvJwe1u3UjXUqJlCTIQGTPz0rLEiLbj49PfIQEG88ErU1C9YUXbiIx109NdK6PRWyJ2XlnVP7lelY0JF/KY7xzfHDkWOVXlPst6XRbhILOjgJHJDmsAc234jgaiIpvGxHKCsKxdHRX9157ohSf3YraDV/z3AkCcwa2IzWavgzvaU8d0VH+4x8F5iKYGnMQgsHB2ZTZ5q8G11UZ0Vy7EgdZi1edDL4Wg58F79U0hZQP4rQgsYIh8qKWMiKG0b+v0QCRC3SkJsd5R97YgsirfxuVv7p9i9da9YwaUPUp5rv5tO34AsXLAhSWUZd1+88FpeNwVFfzoBioMs8bXw0P72FQkiKLtv5w72X2kSwvhxesynJGVjONNfrcwVuL8REanBHtjE5P2hXXLgXBbvnMxm8hk1l5i5slebBPxx/sEjLs1Ra/NGrU3QQp6D0Ryzdng1//E6qWtBrP6ElqiK+wlheth953yWuHkCdKIsVnFkmta8u13jd3+UQ/W1126gsKzuKurZ8OkoJjoHZi5NBvWbaBEsCYQT3VKHPrUCsFVNhsUe0VOVVpKNWL3MW5JRL/eyMdHOM7x/Id55a/NxjLFX0b1xjdIOOerefw+0fDMxXm6+dQYDSlyGFrwKFGgSi5iUY2UIP69VsASOi3nK9oorggUVfjUCHC6aEPtHHdRzeiXBkOnPtSBkVffV1XJst851/Jd1JyfVvECJwWs6SWywPAefI6WUEv0PlIoE5Mln4kERyTPsnRQPIRjSVrXxE+dswDmR2mEAb7HVihdmWvtEETBkKToW4FRYCY6ORdSq1TIYNEIhJMHZ+Jd2xUAiuXxc5zJrdSosGp6rWl88eC221pd6bjZ23KhAxhhd6lk7kfx2/L0pStvOJxPKy0Zc3SHL27bE5qvn4SV1gHYI1EqV5jJHZHJd98Lok41MV8CkBUK2QjqhOsojMiZUFO41OywB+eu8fQfEZ5nDsah7J3pnfPfxB3ecyHPjBzC5otmpU5WHmS549ejUGH04V/Q9xzhCASWR4zjj+KePYOh6t4inYj5Kk4EedR1ULa8GOoSYn2RCfyasDgcjezAXIstBgNFe8tGP/51inDpxVe4Pi8Nc53wz9TWJDk9gpIyiihiYcmYzpHDM++yY9ddi9QJ9qVCuObXeaiqzQa+vgFuw38a9Sjb4gxCGqHZnIi8TQdb3+m4j6AikHEwp2o3nu4z5NGFTFFB3N3hfXnUm471SKvtu3VHDB12CEjjcieTt973TaTenRoMPpChQ9V9AXuINrIYaiRyEd1YRy+WhTgnIpg==,iv:pieacH/aOj4/4KaaydhItbYZihFIO49eEN92vLXZTGg=,tag:FU01xRqqPgA4MzjsTVUS6Q==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGZ2JCYVN3SEZJOElTbVlL
+            RE5RR1NpdzA3YXM3YnBBU1ZBZmIwRUlKVmxJCkp6eHFCdlpvZnJrb3pQb1lXZWZw
+            cGJrUlpqYldxRGMzWk5jMVh2Z1E5bG8KLS0tIFArUXMvTDA0VkwwZUNWUlVXTmJW
+            SWIxcjNNVjJlSG0xYW9qM0IzUGUvdWMKoM1qv53QI3j4v1dh3T8n2lTZMh5b/9+k
+            eM752ZDeks5XyV0ufloGdEaRk+qZeyM6gEqbk/wawruhemNEvo6Wfg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-09-12T23:54:32Z"
+    mac: ENC[AES256_GCM,data:6SqzXEZrOMycjKTQlsfKiUv6HSeRGoLs1NW37qqeR0tJFGZU5pXYnIQ/S2SguIFFclfIaXXVzn44aHcceTxFe6OziIGeLlQi9hRUJyk56r73OjybnQHGl7L1sUlcmDG3NGNOAGmbw9rDQ7y45ql+0pLK2UxGeaHUuADtVeLPBzU=,iv:dGeyzAErd0gDyPsFOGUcpTGu/CGmUIriXyTHIVFLDVs=,tag:KG3UnYjNBQXM8SycGMppCQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
diff --git a/k8s/gateway-config-secret.enc.yaml b/k8s/gateway-config-secret.enc.yaml
index beaee53..19a532d 100644
--- a/k8s/gateway-config-secret.enc.yaml
+++ b/k8s/gateway-config-secret.enc.yaml
@@ -1,131 +1,27 @@
-apiVersion: v1
-kind: Secret
+apiVersion: ENC[AES256_GCM,data:zPM=,iv:31E0HyT/gIYuP7wJuv2PyZTUI8ZSxzsHoNwJBXtN3eQ=,tag:UiOz3gWeZpseTvijzoMO/g==,type:str]
+kind: ENC[AES256_GCM,data:fC9L4bgQ,iv:cTB5L5uOy/klV5ACJgHwY2voWGo1NcoINrrQyyZMBl8=,tag:v0/8OPMW/Yun7/JPJidUtA==,type:str]
 metadata:
-  name: api-gateway-config
-  namespace: api
-  labels:
-    app: api-gateway
-type: Opaque
+    name: ENC[AES256_GCM,data:35058TEeQUpJ7TT16XX4HsxN,iv:W/n1SdzwAGeOhwD7XE3dIoMnzttaxHV4fBqfW+1cut8=,tag:AOlK9sfDT5wzNq+91hxQtw==,type:str]
+    namespace: ENC[AES256_GCM,data:GTD3,iv:58j03KpGyiiEJCvSip9hdZA/scPtn31VkYxE9U3SCN8=,tag:q+RNx4PmENfNHgK5RRE3kw==,type:str]
+    labels:
+        app: ENC[AES256_GCM,data:2ZMbFp4alrD/qnM=,iv:p66pFUVHBYPnYE9icQhrphsLbF41if26EcxQ7x0uIV0=,tag:GjQJbzjrf5Bx6rKMMALXmw==,type:str]
+type: ENC[AES256_GCM,data:bKTOubPr,iv:jUOAj9p6BhrQGIXYNcp7aam5IkfGHzvmnja6Po8dHwc=,tag:mUKMVkGOGma4CF3OIAWHyg==,type:str]
 stringData:
-  config.yaml: |
-    auth:
-      enabled: true
-      issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
-      audience: "api-gw"
-      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/"
-      requiredCapability: "llm:inference"
-      tokenUrl: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
-      clientId: "api-gw"
-    routes: []
-    models:
-    - name: "reasoning"
-      address: "reasoning-predictor.llm-serving:80"
-      path: "/v1/chat/completions"
-    - name: "ornith:35b"
-      address: "ornith-predictor.llm-serving:80"
-      path: "/v1/chat/completions"
-    - name: "qwen2.5:3b-instruct"
-      address: "qwen-cpu.llm-serving:80"
-      path: "/v1/chat/completions"
-    - name: "nomic-ai/nomic-embed-text-v2-moe"
-      address: "embeddings-predictor.llm-serving:80"
-      path: "/v1/embeddings"
-    - name: "BAAI/bge-reranker-base"
-      address: "reranker-predictor.llm-serving:80"
-      path: "/v1/rerank"
-    adapters:
-    - serviceName: sqs
-      upstream:
-        url: http://management-service.sqs.svc.cluster.local:9090
-        timeoutSeconds: 30
-      auth:
-        required: true
-      resources:
-      - name: send-message
-        methods:
-        - verb: POST
-          upstreamPath: /sqs/send
-      - name: receive-message
-        methods:
-        - verb: POST
-          upstreamPath: /sqs/receive
-      - name: list-queues
-        methods:
-        - verb: GET
-          upstreamPath: /sqs/queues
-    - serviceName: workflow
-      upstream:
-        url: grpc://temporal-frontend.temporal.svc.cluster.local:7233
-        timeoutSeconds: 60
-      auth:
-        required: false
-      resources:
-      - name: execute
-        methods:
-        - verb: POST
-          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow
-      - name: describe
-        methods:
-        - verb: GET
-          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution
-      - name: list
-        methods:
-        - verb: GET
-          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions
-    - serviceName: memory
-      upstream:
-        url: http://poimen-memory.poimen.svc.cluster.local:8080
-        timeoutSeconds: 30
-      auth:
-        required: false
-      resources:
-      - name: query
-        methods:
-        - verb: POST
-          upstreamPath: /memory/query
-      - name: ingest
-        methods:
-        - verb: POST
-          upstreamPath: /memory/ingest
-      - name: skills
-        methods:
-        - verb: GET
-          upstreamPath: /memory/skills
-    - serviceName: s3
-      upstream:
-        url: http://minio.storage.svc.cluster.local:80
-        timeoutSeconds: 30
-      auth:
-        required: false
-      resources:
-      - name: list-objects
-        methods:
-        - verb: GET
-          upstreamPath: /
-      - name: get-object
-        methods:
-        - verb: GET
-          upstreamPath: /
-      - name: put-object
-        methods:
-        - verb: PUT
-          upstreamPath: /
-    - serviceName: iam
-      upstream:
-        url: http://authentik-server.iam.svc.cluster.local:80
-        timeoutSeconds: 30
-      auth:
-        required: false
-      resources:
-      - name: list-roles
-        methods:
-        - verb: GET
-          upstreamPath: /api/v3/roles
-      - name: list-users
-        methods:
-        - verb: GET
-          upstreamPath: /api/v3/users
-      - name: create-role
-        methods:
-        - verb: POST
-          upstreamPath: /api/v3/roles
+    config.yaml: ENC[AES256_GCM,data:sRkonCAvqqiOdyZLNUVvptbwB9Cf5QxBw5mo9vG7uEy3ySrI4MdpxoZ05zxGZbTbGmzOg7Nmh26AXqnizuICRiHknXQz9eOFPvbHuPCMOlezhMfbIRmcJ6HBUPVdKo4uAYbTfJVsqH0KXVsaSptEPydx4nPR1u8GB26NC1qqzIT7ax1bKzUEWvI9LZNZWfHfirp7O/CGTA0QvzfKp7dP7tkf84+SiJLlrl90q4mUTFF4D0LZLS4sxMi5LfwVls4epB13Jo83ezOojdO8lc2wj8PWRan2PE8pLwC6r36kiZ2upXQR2rU9h8rblgHL0lRM5vcgEy0Ey54s32sLLl3m8jW2f/npXYSUh/lSyjdT9JlTcknMa1FwMvm0AMyzZ2p0DeoGa+gnbXhxhq7cGa2tKTOby07eJxNs9k2wyr7ThvTMnpatpnV6qMvGj2P4SZKj5a3WKQpSacJ7jTyBa16FBmN+IMzlnP89/55zpx/WCG0xHxcr16h1bZFE+isTyrHPJ7TYtcailA/+sM7HJL7rnXBPzs2LjmJPY90wX6marle9Vg7+L69DwC4fswpjcMFZ1o8gd9na3jWHr4so4Y9nUok9qPnJIW3C9NUMN/mPNKVC7tt6p04jq9Q2GzGPK3sLx/vD36kkD4DgjOBe/DDnskTC6G0CSZfAjFOc+ec5ExVCpgPH8ysw7Xj8SvCYGhklcuR/D4xKldNUT5KfEExQLBbsjlW1PJGheIdjftmgultmDDsb86Yp0DOicxzWuh4ekA8hkqb1RSkyl2OiDgVvvANvBDQLuZBuFBlJoF0bLNLcyJXdl9EjnG0ClqYz5mzkId50afbh1p13tOkpIv66ONYznu5hKfLdtUrqnjTjtDt68msnsvUbQVvI6OOHUcqOzHZ4W/X8hOEzqRf9aAriEyIPj6Ac+SRvvuYOjzFPjCW/+RlyqZ8ec8MKZ43NeFI9Hg8Xnm9QoursiLRhbch20/FH3rEN7RGx2NGc2FU4HuCbV0spVPmItv7SsDKM88nXRa5C+g+cDl8YkPc1blDz3xX24jOD5oa7fVWhjmVLdKrTGGzykrmMDdj7phBviWiuFvOXt5b2A1l35ABDNjKC104bieuGM06p9T6xuB3eRPJLcJufKq4N8kk/LamvMYf9T1GAHhCxiy3iXwRhVCmMhea5e5N7OdnSWa8OipxRNcJBO7uWSrTlLYnFdkTXoYXM4syc8+j4P+1k45zOkwaUAR/WdaAQlHZgu6o9on7nFFd4QTSElJgh00y76Mb/wHdPdlAOi2lg9dA0DAWfGKi42ez4dOWjn9UDJdRLJUIh2vSJyu39wgsXHTNBQXcRc86jTBhhjh6iaAXoTmXmWvx9ZuBhOsW0clUePGbg+c8oRmWvIAYR21IPA46WSxPDQQve0JjrO73rEPQ2vmy5nqpDpywRPgbgYReDZ1FiBtZASnaEPCwunro1oKUJbjtaJBt3yx1+xilg/wTmeH9kP9sDWE47LJ3hBGEtmTNTTrDP11IP8rqU5tSHGNlRW6V9nxlAW73LJrahNWrl8tm2UP8SQG+hyrQmKvALzDQlnbjVEo9m+kPTbiewxN8gRCt8qfgk9jDcJASynQWButjyutQt84qdFQWYMRV1GNvZ7oU0OdEXfHgM7vwm+Qke1EohGkXqtqLUmXqF+NWMzWTeg1SCuH60MsOMHoKM8LId7IYl3NsmALhYOSn/FojR80ejt6AzJtezXKupeRjHHszLYP5xZDpu7swqQy4PoIybQXB9alWNhS7wTsqr8zIjKN8LFNKV4r4Nx2BdtbrWzvAGVDpGTZclTDTqm5IhcQRMOPsd3Hh3zOchpczeqdZsW0CE2EByJOqlQFRTUS7ebqU+nfNxra51hlehEGjwW2qjF/1JY+2kaaSqLerZpQkAhuyfOnFhVmN3QWXO7EvHpL4D658R2MwYAqcq1Lhlqo9kz0ebOib/YlazDEa6Wd/oenUcT9pTapRozZcOAo6bkZ4BBTxTd+dUYbJpqJfZFJt3rHJiutX9Go46mP+PQJ9MM8HeW2KicB33hPFBDiTKCySRprJCfc6Q/iP4UVk7n0AXkAzLLm8gIUByxF1yKwRyYNTS9Dko4mkiueKK96X9LrPy2s2o7hK+s1qcF7Hh+4HMJw9U/Ys2mZKecvRfcbAGXrPFORGSm59PRyMQycPPz/uOiFnEVL1xKrn/foq81iADpCSf/pTS+Rkb0EbH6MGN8b6CPKq2m5rxWgNKcRyOD85UPjyhMKF12CjAjRxEg8hlce7e5StEOgH01W9uT8MkXmBWag2FcwRU282jvcPJYHUKR6LlZRTMbJN+5onxlOkGco8//Cw48X+rASCS899+1AQkPNzdkUn49tqhHMlLBCOfFkXi3QJ/L3lloe/rPA2b4PQu0v80kgHVn+LaDUX8LcMbTA5fay85tiFlETSS1M9qZPQ+HY7QjJScDQsKU36NmgyMpdwKccuqSv+qd2E4mPRlE6mG+BrqvR6+Vrk9MGvrsnt/Dgjuc8z9rM1mgnrP9/uucseeTqYc5ibrp0X4Umn03a9QJa1wIvbLQkvOFq0BILwsCbOu4ls/EuGO2mUMjfoqD03UXFXbnH1GspX8nm8Dk9w3rugVeFD3ZVBKV5aRkx3cxVGgkpQv33Jd8e6O+s7+B7AcVpL+D+lIGWFkf6CjxTe+zZ1fjdNQrKEuXJ0koOn2r5SqbQC4PI+mWlIhgQ2ELYMHHRLYDi2DiC44UMNVwxbVNdtBnTf0EDdUIsprneS6kcjg4MuXJVdbtMYmMbeOSeP7Lk7mAM2gkEy8jZcoKhdG6kmojCi+T9D37hn7038rz+JOCJxBuH099yvI87IRp01PLOczASWBFgBe7Jxa6zEdOXR3PLb/oiTn9EB0oDxO5oSMM5jM8SxqspRP/5gAjQdkIFH9gE+y56PUbyAcbFqEqO1oODVUKv1u7tx43yosH0R5LK0JM+R5bcwJ3D0qBWPSjnU4aczRZ1XSenkLJXOE1+V3bWMNlpEqR4mtSUqe3msv8tryNWkQpdqPeTN4F89Wmhvx/d74RfZ+IDc674tJs40hK4kwm761RtXlItvcUtRokva9PDLRe50zcG9s6gkMkflrVcVKTepGGa7cNm9HxQeOeHSonBXWSRrisz5EISWwuWA6RteF5PMznApizZbCrmoIW0GDa1ibBnVZrVq87jRl0jkJelqp5kAVFajWPXW/XOwLfpOKBcQX9hKxUeFEaXSXaf6vY7SWle6EFb+3wk/Gy6piULDCkAM6LyOskxFLaqQP6PJ7Jg89MmHj2cK8wIvMNt8SdoxM/Ckrj3chSq/9yCy9UoVGDTYg6PNmzcRj9RFBKIXpldgC37rNWwshc6HXRLPmrNiJe0PjNOYPyUU0UtY87peS5C1HxABWGEjv+nIqlAgTmLieKlMLzCW+PDjvp7pYu324t4gLywgxem4mrHVTSCHmXY9UOODzZ3vzspx+RrsAmF01mLG6nxgMycf7t4U6d1yaOGn/78i947IUx/CkdKUbHlgl7qeGOOk/GPM01yz86xczviMjYLL5J9GlpQwOpAvr39ODjCKv9jmoq6XP9RVLdVLo+/JsjQnuDCqnC6razVUYiDQbFbR6Rj/2bY97UEJPeJu1RBkwUooQ8XTn3tf2g02bM9VjBFEnjBRw7zBTAwNA+vMp25a3NgFCDV/tBI93bddJd9P5BjXPW9a/44yHi36/CiFf0W8w/62DlmFLCBKP9aduZ3dYv7T6pn5fZILtF4TPGkZxXxPRakhtNnz49/DaGkxY8X2V5Gt4TVZg9aohQHJfAhmaCwb4DRnDZyd2lD8xI82V2XIUIUK0gMRT5aBrZdvLNSOnHjLZuyRjd/3iYxPjP2PaT9cDcpFxvsBSfXbGafDITqwWoDasPSWviBgJlKRbtkXUu0AlVKTL7uukM4DUcR60olyrjyJmbrKeRcueiHJ4aLjjKbI+2j8i9QC0rH+hgdFFer09b/ORAzbPDq+MknsYVux33wNTQ+7haXadjqMSIzdx0FgWBfMQOquj6gT80OQ3yiu2M+k=,iv:F+45ts5NR7auZMszEdZc6m1yqs5m90v+LSZinS0uo5M=,tag:3g351RmwiBMCtYyRGJAm+A==,type:str]
+#ENC[AES256_GCM,data:j2gPjs0hZwK/5c3fIRqnfMaRbxe0uoUTiUO7oSexIgOpbQGwZBME2BBZTf/BjlbnWGFgU43E9Y3LZm/Da3xR7w==,iv:BmUAWIEuzu+mz2Q2c3HNrS/gbdbXhaHaD/edcaVbSKs=,tag:ckp/2N8vGCoE/5i284LzSw==,type:comment]
+#ENC[AES256_GCM,data:sQaf5dfdmyJ0czeNstXaN38TGZMa3/nfD1jaV46MT4deBJFgWAikcnnJJGC8hGK8KKVXZ+W7mmxwskE=,iv:1JKnZFYzm5PrcsvGduSLk31saixMBrMqk/VwG1P3JQg=,tag:UWW/ngvsz6/GNYLrUUxLzQ==,type:comment]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZQTVNVXczc29yQ1JnTmJR
+            QnFJTVJvczROZU44cmNqZW5POHJEbnc4Rnl3ClhldTg2dkY2aGpVN2FBb1dGQ2tS
+            Y1M3TTQ2NjNvRm45YzlBODIweHcxZVUKLS0tIEZpZnJ1cncxUm04a2hWMkZVSHEv
+            cVFraWhTNzBNUHlPMGxPNVhkTmxubWsKYUkhnMX/1aXP7yh5z1JNUlSW9GKSU1QM
+            3DDporJvkUBx/PEUkRuCY0ntFqQKxsOPzfY1R3Xls2KdXHgQjPFkMA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-09-12T23:54:28Z"
+    mac: ENC[AES256_GCM,data:BXGmTl7z+oh4+sAnWqzIpzGkoJ1ebzQJYZAYZHb2xrsrMK6LRtzZYW9OHTXuP1UCZtLnFvy5dsLFUMFXwOo8hxeBx4GpRJUFrTuA+phkkv3+RHXL+sDBvzDr/Z0vqgVE7evAxumnfAnLfpRvbAs5BaaFi3s2GWYO/pj1k9hRL4o=,iv:IeKfgXERKH7Vwd3mJLsufTvQ52EwoK4jCH538VW7Fxs=,tag:/HsSYetbscQ3CTm081I3QA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2