diff --git a/k8s/gateway-config-secret.enc.yaml b/k8s/gateway-config-secret.enc.yaml
deleted file mode 100644
index 29e515e..0000000
--- a/k8s/gateway-config-secret.enc.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: api-gateway-config
-    namespace: api
-    labels:
-        app: api-gateway
-type: Opaque
-stringData:
-    config.yaml: ENC[AES256_GCM,data:/DEIZuTHeYtHgwXnohLiedkbh5g9xR++AmnLVfMe+ds3M5eUVM/1wWfXP7QmiIB5nZ64cEdXHQtsXRIWUTHECOkEP8GMYkzOfX1bBnwOcdyYMGLMEW+FAxw3oGE71eZIuNXoEAxXnGna8UzcbYRYqSehLIIgYOEb7HRXcBIkFMfsm0CEr921K2UUATVzhF/XFRuUFY1ruSBteLNEpkgSb7YJjg7y5OeGlQ/d18qouogRqAr5k9JcBOY+hxyKtE7QjIIMwRq0vuwBR7KWkcnaV9efYsJ10CoPXYTBELy05k8INed8pyU7/dZEa9+IPtGjam/GG5xsCFLcf3fez7xTD1+wW8nc5FEGEC/keY5ip96JyCnFjABNmCo2NkIFjkmnz1MzufSCRbtssk7X3jb1FwEG3Hgu3q5xeiX6atUsQmWu2VauI5v9/xOTa57xh75x/B35joy+lawgB8WuLLVdABWMOCpXEK/3HPka5Y6Gfg+M9f736uBNM/vQGtUlX/r42VPo2SXFKOx0KNgcvOCbmCGBSXX/0MYbdD6e4NPmQz2J5dbLn3NcXCzx9Bb7EQXj4/Az4aPb1+w+ZiT0McISqPdulZrHuIdNw+BVW4vYeQqmbBase/ey2Xx0GmF7u+IAsapbGG8z3JZvtfFVmUswfwefMXD5IkxfzHWazM6y+tsYKHDF3KiUubyHwwo6WktBmLYXVF5EfV34ZQ5NsfiVeIZFlfXdhauAIZTwTVI4nJuYH4NSF4O/dk59n70JSHUmXUJcS8S0SfeGHw33tVvZMo1FHnSbQR22N8y6XrPRHU9K2ToHcwRpYNQINFlFgmTlP4gzEklFViy6EF2MsYWQWa1CcdCJyE7IYPaBvF9ZEYXbk2QyHoJXwPudpbRobsQiKv49+NPogFWeAw8obe9eNzLU1eqZv2WD1rqX3vMMoB4SjTuFPxS0HCgAWpbzWt/ycGnTMeXebdbNQUCJ2k4Nk9MMpUcZcgKAJ2ANE6j6I4tF5zl5KEkqMA/GougcdThNxdhOBDVyFd71lYtJApEvzSARscKq3Iq/bGAtHJvhqhXtG9504QcooCZypr4sPANZMFbhF5AOX/Gg0x0ZTL8B3y3VM4JnNU/MmNakklJidIIx4qSMmwRsu+oKx5jXiAj9TOgvEj4QgKGyD1neIVMinC0UsUQD9FkWWXDCBd934ymw4LLArPiQbc0rvRG+WEu3W3obKixgMOIwgREJ8PtMyjOBWHDyKBU2s7VbRJt/sS62CGVc8DgprRJcy7qZSTtNqnuxhOhaRBDScj+CCfllQJ6hanLQmhdkWPA7I+PZhY07/9F4zfP6+CiWZkGhrpfeQ0H62PuplgSowbYIK+BM2GsBAPBSBlTWvuMdD2SrW99s8C1+TRbHLON0byZG+QM3Qe+BMGhmwPO3tJPbbD4TPlFfJYSR5/H+8dofj87urvlZGYltThmfiMutS7OltoKwLZW8YV2R3IBV/zQKctj4OB0SH09YmjiLbDRxGEN0sa7te/TTk5Oirphi1+yShi8m6CZSaJkhZRILWk14d9inCX7l07oFb8xTW9aTbRC5yg1z73nQe7A3z2evW+I1jL0oefw7A8oeITTBQ1f2fmNJP/k6tf/a1JiIA8yOxzax0ZGx+ZRyzKpjCodcCufmWt8ixoCfDSKaBKqTtRkRz0kvKHKAFpssTPtaiOxdJSkRgB25/bLFzASTm0AOX/Sm6rTLsQ3rl+SIuTtCdMHo2Q4NKSLRWtkXDdd+q9HUNjk5B7o2fb2GU5M1+8ll3OHbwpCGxJHkN6qjbplfgvyIi3JMcU5M7emj7wZQZi2qFg5Hv3Rrb+D/pnLNnfVY4fY+Kjxraa5WS2t6saphIq9020vDQPLRJQyG8IfoZr0J+QulLS2gX1O2tjE4ys2ws3Ka1Xy0VwUAPogBLqP25E+bcOKYO2jwYDMpJUEM3OFeGjxqi2b+D4S0O+gfE7AulmuC3bMMsdCfeIhT8YLYP4a1wXs5F2CQ5chVzED5ThiWBo9MIE774YMmcCuW7dwTtgrfm2M6KK7PpM6VpGGbJhS96JDi0Bd5pNyP4Kibp1XrnezGtoGLOq0theBnt/9nkPxbnclnqsnBVnRR8P+6UvTV/ccEbFKzjdNgYiApjkN3IvDkg7oKNfvg48say9nXIQhbPJlP5F8g0SZV/+VHywnTAxSIrinPFkWLrhjhXtz0ddDSdhCgq8aMDzZ1D3dp+QHSdZD9EUP+iXAAUZ6ltSS4E1OGmptlA3L4C312yThsY/R4DntnGEvxb9y30eF0wCIrNeXZMxgHkb+5J/AmfbRAnlaEKYYDnb6Tau4s+nj76PcsrphrVEFLvcm2bZ/sepLISHGgNljiMdaSa68zdl3YhO1MltSV0NIfuGm/j7WHjCRilHCGfLSHsQhfmDdOJ1CtYrQ8ArNW/1+g4OMD7kMw+9/9TIDUD0cpEK5newheDmvA5duf7y07ff5BK7FVONGGZM9wdn6q2KY3dUrP+0fc6zQU+Nai177dNKwmRiX4E7n76p68G36MKapIkz9GrJvQmMIbklvAe/kD08Rpj8gFjH9QWbpvEplfQl5Z8anrdGLFPKtkGVD4AD72NCfdFDUkvdHm8nO2lHfJNjJqLiR2jQiike5oPWLTIjy5wg/FNYzSVBs1ywyH6VJ0X4wf1x3v5OZ99UuLP01Mf7ozIEjJFx1b+1vlngj8YBTAMoU2uVLVfeuQpH/3t9KOVWvuX9XW2XiIIgybPx+TSn45J/XPmuAXskMCA3z9QcvjJRYEO/whqHq/OWV5Dmel8M29BA9HwKJy5MMDrv3C2mppMCRWsLqUAHnxto92h1kggfTmG8o7P6u7Y8e5vkGTXTM6PzpfODpX6wOZUJ133V3DpL3jFS15vvi6kdF35h/Pz1gWTV2iQ2nQP+kSt0w7hWX+t5fAEMUm0Mxaq0iOiQ2GIxr4MXGIvCrrvs5zlLyLRZPpP+ZKh83jDmKvnKqT7tmScsUt0dbzpeA4i3Ng+FIzyJr98+hJjzf8hWxGL8HFYWxOnMmRQ+xvkEjXoJMWONEXQ0Fhhdn7Vo/cocByCqvTVUFZrl8ELhYeCBqyIhWrMlvGKGkM15Erj+CFY54AcetzdMNaJhC2n12w0AJ/k2PqCoZN56aQ+vCht68CYijxAahf8CfXR3Eqcfg92tHS56IPUNGbgq1RW850zIOj72TyOoYKKuk0mzusbrpusCDDFfXT6MGGGaAzPM4FzrwmB0rD6EdyRsKvn4hWB3XtRGWysD9BTWPku4RM8qrwuPWRx2awJ3MlOFCxNurd+URprgFz9/1jico8iYL205SPl/M8mwOiFuZQKe8vmsGLlHkhKbzXvPCxdR1K/3xcM6G2pwQvU9qgAYJZSuINW+qcU8CXpnRnrB/v9NMQvr5bXptTDNY6sXKEBu9In/wFAKx6PaIIhikKJVdAYZVeBVRo3tu4xa+gF5u5EMMiINgVKYzlpN6vvE538Uz6tuaCur47n7t76ub14IXDyHoWuOO6PL+wJlFVkzi4wFGQeaPSbNyjixpaLsxPDvYRAGGDqnTwh37AleoxnuVpuEkS48HU8GyRqyoioEhxfCcimCKCahIIpTyuO1vS7/ZAUk+JFBJG5Ad6agqQ1GCVwFWC17rnhfzeTplk2OC/9PjHdj4wcYIY1RaShZX93gUs3HCMbPEGLfMgPT8BAtsAS9uRGxLBHcqkq+QCssiHhHm2Lb6mDdQvgbizsFGBIeYFucSP4ZF5DuCVSo19QdGDKzFVoUGMtfxKVKvEj77PTZxzHicvFsSnGYoyVK3gjYVardse4zsMk3zO9AlbGkyQMKbpUxxnE6yZKgkQcTJ4D/L7RSxu4iLwbuCUH3egDPnUHQb6ZGuQuT9Hzp9uAtgg/nl6YDoT6ING3iiCAu/O+PZqgT09KHA2xChe4v1iJlSO3JEn6rSMBXNcaj8AdhhekxFTwdmK66rEr4XSKDCP01Bp65z0nqX2epgQoBixdHGvMniCgEoJSEwhphXvk/gVWo2qZr/mEwK+Ra4NEGGC24UufAUmtwEpCTe8GludWnoyKz0reB3xnUyMyJOVAj0/1ZZ2wPzFWy3lXWMgjrOPOYKgIFOPxlO4gn2tYdfFwgyLFN2b23eWqoP03Hh4K8ISKZMFSUQ+VbuWu5NNn66AkW3eAg9xo2CsfggFn8c0c9/C0inY7ZaTUgRdQ+aY+XX36YRs0CmYBn05wah+33TrTB625/qonzzvUWTPAzosANq1bJeu0kMaln1IBeeQ3yINWWE96+q64EXijatrWY66mtdi2Qyjd6DrM9PnVahEhDsm32I3nc0aeEi/OMQxJP1dL/G6pq54TmBREEumnsIiypYSd99ts9oZ+fIPAFv5g1VWq1f0GUSd+ytEGkoRWnaskeYpgtxYDdr1ZA9ltTPW+rZBslzWCY7if3+9ih/CcJ7iEVrKbSqipKmKYvhVn96QSyxIrwJe9LHgRPEFqN24qRBfoQQ6kAwEIKGOLWDzX54Z2PNOq17BE69KffxbA7gcJ7RZ7IjecPkJJwTuCBwtYexYdR5XPHknqMCTe44WEl6JyxUQTCms6hJ17lSgc9I9TVSPljoYf0zmQunqgim/a/tKZe8L0c+VH/d74y9M0xzR+FqZTYy8eaimav4s8iT9Q5jR3FX7x4cK8dkvFCI7lIRFIk7j8Ub90NevoS1rp9XIWhUgyghtNanklDnBYZcU+Ew3qC7oJu+Ad8IJXWtXAgEz6KIC7cEfV+SK5R8et776BrfXDsq1XiurEtsi+lBv353kCJUKC8N3Cc1MCNglOPnuxExitinOTmBu/hKZ+k8VDDzbdahLwlsc2eBQyAPCkzaVo/EiTP7RiKSZ1pyEToL/x8JSD72X17vNqcHcMNFlx5atYquwmP0U1bT2uPkGo6Nn3/IVhZFvEYLUbAyRmxVxTyqPCiGZOmxx5/tJwWk2DpPL1kOB9tiBpCt5f1bXk5VRG6bpbqLt5mRbcMRYBRlcNal8YFjyxDBtqK8mDwA7CPuXyYSnP8UmfDyYch2DnUWcZEEV,iv:5muZD/hQMgLaP2wb/AKKaOFCi2dEBi4EXnR95xWVUsM=,tag:1AUnMd4J1+P51GcwvwBBow==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaNmIzMmw5YTNMazcrTHJJ
-            QTI5ckwwREpaNzV3bXhCRVRhaXozSzk5aEMwCnVZZDVHWlFIRnhlNzErTWJjamJh
-            SWdrVlRscVdIUjI3SDlTbWRuZTBxczgKLS0tIDZFeW53MTgweU1JMk9sT3c4ajFq
-            TVYvcTFHVEMwdk8wb2lZbzBMcWdMOEUKrbjTZ7AeuNqfyWolsYGh0Dc5bE2bDU+y
-            vXI+gz8GwN+VNR06G39uE8wAIvlCL9rJocWx9uNcCChZGCaaJu3GPQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    encrypted_regex: ^data|^stringData
-    lastmodified: "2026-09-13T01:04:23Z"
-    mac: ENC[AES256_GCM,data:LN3J+B0QonolFEeisj+NwYjp6F196uIcDyxf4ZoLdAs67Pmpi2YBtB0J4BEbUirR9N13M5k9gWjtDJwgHONYBCjEGC4sCQS3JvNkvwiTf7uSCKaY5+Qq71VtUljf9c9P+Ni/D+zGEVTWHFYtirnsnGpxb/YNYDvbxLFRRI+sLKg=,iv:HQP/SeN+6spVpLRIrYsyBVpbji7YC1oK3lCPmmB0OK0=,tag:e+yfBwzPXSqvBMU4Wn/Tfg==,type:str]
-    version: 3.13.2
diff --git a/k8s/gateway-config-secret.yaml b/k8s/gateway-config-secret.yaml
new file mode 100644
index 0000000..03cd15a
--- /dev/null
+++ b/k8s/gateway-config-secret.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: api-gateway-config
+    namespace: api
+    labels:
+        app: api-gateway
+type: Opaque
+stringData:
+    config.yaml: "# PRODUCTION GATEWAY CONFIGURATION\n# ==========================================\n# All upstream services MUST use Kubernetes internal service DNS names\n# Format: <service>.<namespace>.svc.cluster.local\n# \n# This ensures:\n#  - Communication within cluster network only (no external IP exposure)\n#  - Pod-to-pod service discovery via internal DNS\n#  - Security policy enforcement at network level\n#  - Service-level load balancing via kube-proxy\n#\n# Routing Pattern:\n#  PREFERRED: X-Service header routing (e.g., X-Service: workflow)\n#  Legacy: Path-based routing (e.g., /workflow) - being deprecated\n#\nauth:\n  enabled: true\n  issuer: \"https://authentik.riotpiao.com/application/o/api-gw/\"\n  audience: \"api-gw\"\n  jwksUrl: \"http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/\"\n  requiredCapability: \"llm:inference\"\n  tokenUrl: \"http://authentik-server.iam.svc.cluster.local/application/o/token/\"\n  clientId: \"api-gw\"\nroutes: []\nmodels:\n# All model services use internal Kubernetes DNS (llm-serving namespace)\n- name: \"reasoning\"\n  address: \"reasoning-predictor.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/chat/completions\"\n- name: \"ornith:35b\"\n  address: \"ornith-predictor.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/chat/completions\"\n- name: \"qwen2.5:3b-instruct\"\n  address: \"qwen-cpu.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/chat/completions\"\n- name: \"nomic-ai/nomic-embed-text-v2-moe\"\n  address: \"embeddings-predictor.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/embeddings\"\n- name: \"BAAI/bge-reranker-base\"\n  address: \"reranker-predictor.llm-serving.svc.cluster.local:80\"\n  path: \"/v1/rerank\"\nadapters:\n- serviceName: sqs\n  upstream:\n    url: http://management-service.sqs.svc.cluster.local:9090\n    timeoutSeconds: 30\n  auth:\n    required: true\n  resources:\n  - name: send-message\n    methods:\n    - verb: POST\n      upstreamPath: /sqs/send\n  - name: receive-message\n    methods:\n    - verb: POST\n      upstreamPath: /sqs/receive\n  - name: list-queues\n    methods:\n    - verb: GET\n      upstreamPath: /sqs/queues\n- serviceName: workflow\n  upstream:\n    url: grpc://temporal-frontend.temporal.svc.cluster.local:7233\n    timeoutSeconds: 60\n  auth:\n    required: false\n  resources:\n  - name: execute\n    methods:\n    - verb: POST\n      upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow\n  - name: describe\n    methods:\n    - verb: GET\n      upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution\n  - name: list\n    methods:\n    - verb: GET\n      upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions\n- serviceName: memory\n  upstream:\n    url: http://poimen-memory.poimen.svc.cluster.local:8080\n    timeoutSeconds: 30\n  auth:\n    required: false\n  resources:\n  - name: query\n    methods:\n    - verb: POST\n      upstreamPath: /memory/query\n  - name: ingest\n    methods:\n    - verb: POST\n      upstreamPath: /memory/ingest\n  - name: skills\n    methods:\n    - verb: GET\n      upstreamPath: /memory/skills\n- serviceName: s3\n  upstream:\n    url: http://minio.storage.svc.cluster.local:80\n    timeoutSeconds: 30\n  auth:\n    required: false\n  resources:\n  - name: list-objects\n    methods:\n    - verb: GET\n      upstreamPath: /\n  - name: get-object\n    methods:\n    - verb: GET\n      upstreamPath: /\n  - name: put-object\n    methods:\n    - verb: PUT\n      upstreamPath: /\n- serviceName: iam\n  upstream:\n    url: http://authentik-server.iam.svc.cluster.local:80\n    timeoutSeconds: 30\n  auth:\n    required: false\n  resources:\n  - name: list-roles\n    methods:\n    - verb: GET\n      upstreamPath: /api/v3/roles\n  - name: list-users\n    methods:\n    - verb: GET\n      upstreamPath: /api/v3/users\n  - name: create-role\n    methods:\n    - verb: POST\n      upstreamPath: /api/v3/roles\n"
diff --git a/k8s/kustomization.yaml b/k8s/kustomization.yaml
index 4bd1abd..844575b 100644
--- a/k8s/kustomization.yaml
+++ b/k8s/kustomization.yaml
@@ -8,7 +8,7 @@ resources:
 - service.yaml
 - deployment.yaml
 - network-policy.yaml
-- gateway-config-secret.enc.yaml
+- gateway-config-secret.yaml
 
 # The deployed image tag lives here and nowhere else. CI publishes
 # forgejo.riotpiao.com/rock/api-gateway:<commit-sha> and tags it as :latest on main.