fc-apple-mdm: add NanoHUB GitOps workload

Ships the Blazor circuit-resilience + mood + telemetry fixes to live chat:
- FcAiChat reconnect-resync (stuck _generating after a circuit drop)
- fc-blazor-start.js client serverTimeout 60s (fewer spurious 1006 reconnects)
- ChatToolVisibility (tool plumbing hidden in personality chat)
- mood empathy fix (avatar no longer "excited" on bad news)
- fc-circuit-telemetry.js + /api/clientlog sink (kubectl-readable circuit data)

Image built on noc1 + imported to rke2-server + rke2-agent1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/agent-zero/agent-zero.yaml

@@ -153,6 +153,17 @@ metadata:
 spec:
   itemPath: "vaults/IAmWorkin/items/FlowerCore DMS MCP Keys"
 
+---
+# FlowerCore MCP Gateway key. Agent Zero advertises only fc_gateway so product
+# tool schemas are discovered on demand instead of dumped into the prompt.
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: gateway-mcp-keys
+  namespace: agent-zero
+spec:
+  itemPath: "vaults/IAmWorkin/items/FlowerCore Gateway MCP Keys"
+
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -266,31 +277,11 @@ spec:
               MODELCFG
               # Strip heredoc indentation
               sed -i 's/^              //' /a0/usr/plugins/_model_config/config.json
-              # Phase 0 Chat MCP pilot: Agent Zero does not interpolate env vars
-              # inside A0_SET_mcp_servers JSON, so build the final JSON here from
-              # the secret-backed env vars before initialize.sh. Keep the local
-              # corpus_search.py tool mounted either way so outage fallback
-              # remains available even when fc_knowledge is not advertised.
-              export KNOWLEDGE_MCP_ENABLED=false
-              if [ -n "${KNOWLEDGE_MCP_BEARER_TOKEN:-}" ]; then
-                if curl -sf --connect-timeout 3 "${KNOWLEDGE_MCP_HEALTH_URL}" > /dev/null && \
-                   curl -sf --connect-timeout 5 \
-                     -H "Authorization: Bearer ${KNOWLEDGE_MCP_BEARER_TOKEN}" \
-                     -H "Accept: application/json, text/event-stream" \
-                     -H "Content-Type: application/json" \
-                     -d '{"jsonrpc":"2.0","id":"fc-knowledge-bootstrap","method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"agent-zero-bootstrap","version":"1.0"}}}' \
-                     "${KNOWLEDGE_MCP_URL}" > /dev/null; then
-                  export KNOWLEDGE_MCP_ENABLED=true
-                  echo "fc_knowledge enabled from ${KNOWLEDGE_MCP_URL}."
-                else
-                  echo "fc_knowledge unavailable or unauthorized; keeping local corpus_search.py as the fallback path."
-                fi
-              else
-                echo "fc_knowledge token missing; keeping local corpus_search.py as the fallback path."
-              fi
-
+              # Agent Zero does not interpolate env vars inside
+              # A0_SET_mcp_servers JSON, so build the final JSON here from the
+              # secret-backed gateway key before initialize.sh.
               export A0_SET_mcp_servers="$(
-                python3 -c 'import json, os; servers = {}; chat_key = os.getenv("CHAT_MCP_API_KEY"); knowledge_enabled = os.getenv("KNOWLEDGE_MCP_ENABLED", "false").lower() == "true"; token = os.getenv("KNOWLEDGE_MCP_BEARER_TOKEN", "") if knowledge_enabled else ""; chat_key and servers.setdefault("fc_chat", {"type": "streamable-http", "url": "http://chat-web.fc-chat.svc/mcp", "headers": {"X-Api-Key": chat_key}}); token and servers.setdefault("fc_knowledge", {"type": "streamable-http", "url": os.getenv("KNOWLEDGE_MCP_URL", "http://knowledge-web.knowledge.svc/mcp"), "headers": {"Authorization": f"Bearer {token}"}}); dms_key = os.getenv("DMS_MCP_API_KEY"); dms_key and servers.setdefault("fc_dms", {"type": "streamable-http", "url": os.getenv("DMS_MCP_URL", "http://dms-web.fc-dms.svc/mcp"), "headers": {"X-Api-Key": dms_key}}); print(json.dumps({"mcpServers": servers}, separators=(",", ":")))'
+                python3 -c 'import json, os; key=os.getenv("GATEWAY_MCP_API_KEY"); url=os.getenv("GATEWAY_MCP_URL", "http://fc-gateway.fc-gateway.svc/mcp"); servers={"fc_gateway":{"type":"streamable-http","url":url,"headers":{"X-Api-Key":key}}} if key else {}; print(json.dumps({"mcpServers": servers}, separators=(",", ":")))'
               )"
               # Run the original entrypoint
               exec /exe/initialize.sh $BRANCH
@@ -372,6 +363,14 @@ spec:
               value: "http://fc-llm-bridge.fc-llm-bridge.svc:8080"
             - name: FLOWERCORE_AGENTZERO_OLLAMA_URL
               value: "http://fc-llm-bridge.fc-llm-bridge.svc:8080"
+            # FlowerCore.Mcp.Gateway — single MCP fan-in for product tools.
+            - name: GATEWAY_MCP_URL
+              value: "http://fc-gateway.fc-gateway.svc/mcp"
+            - name: GATEWAY_MCP_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: gateway-mcp-keys
+                  key: credential
             # Agent profile — Blue Jay personality, tools, and system prompt
             - name: A0_SET_agent_profile
               value: "bluejay"
@@ -678,6 +677,17 @@ spec:
           protocol: TCP
         - port: 8080
           protocol: TCP
+    # FlowerCore.Mcp.Gateway — Agent Zero advertises this single MCP server;
+    # the gateway performs backend search and invokes product MCP tools.
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: fc-gateway
+      ports:
+        - port: 80
+          protocol: TCP
+        - port: 8080
+          protocol: TCP
     # Allow internet (for kubectl image pull, etc)
     - to:
         - ipBlock:

apps/fc-apple-mdm/1password-item.yaml

@@ -0,0 +1,32 @@
+# Runtime secret placeholder for the self-hosted Apple MDM substrate.
+#
+# OnePasswordItem operator syncs this item into a Kubernetes Secret with the
+# same name. Expected fields for MDM-N1:
+#   NANOHUB_API_KEY
+#
+# Optional fields for later lanes:
+#   NANOHUB_WEBHOOK_URL
+#   APNS_MDM_CERT_PEM
+#   APNS_MDM_KEY_PEM
+#   APNS_MDM_TOPIC
+#   SCEP_CA_CERT_PEM
+#   SCEP_CA_KEY_PEM
+#   PROFILE_SIGNING_CERT_PEM
+#   PROFILE_SIGNING_KEY_PEM
+#
+# Do not commit APNs, SCEP, profile-signing, webhook, or API key material to
+# Git. MDM-N1 only consumes NANOHUB_API_KEY and optional NANOHUB_WEBHOOK_URL.
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: fc-apple-mdm-runtime
+  namespace: fc-apple-mdm
+  labels:
+    app.kubernetes.io/name: fc-apple-mdm
+    app.kubernetes.io/component: secrets
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/tenant-id: system
+    flowercore.io/created-by: bluejay-infra
+spec:
+  itemPath: "vaults/IAmWorkin/items/FlowerCore Apple MDM Runtime"

apps/fc-apple-mdm/README.md

@@ -0,0 +1,65 @@
+# FlowerCore Apple MDM Infra
+
+This app hosts the private NanoHUB bootstrap service for FlowerCore iPad
+management at `https://mdm.iamworkin.lan`.
+
+## Runtime Shape
+
+- Namespace: `fc-apple-mdm`
+- Host: `mdm.iamworkin.lan`
+- Image: `localhost/fc-apple-mdm-nanohub:v0.2.0-20260617`
+- Upstream baseline: NanoHUB `v0.2.0`, published 2025-12-25
+- Persistent data: `fc-apple-mdm-data` mounted at `/var/lib/nanohub`
+- NanoHUB file backend root: `/var/lib/nanohub/db`
+- Runtime secret: `OnePasswordItem/fc-apple-mdm-runtime`
+- Required secret field: `NANOHUB_API_KEY`
+- Optional secret field: `NANOHUB_WEBHOOK_URL`
+
+NanoHUB listens on HTTP `:9004` inside the pod; Traefik owns TLS using
+`Certificate/fc-apple-mdm-tls`. The public route intentionally exposes only
+`/mdm`, `/checkin`, and `/version`. The NanoHUB APIs under `/api/v1/*` stay
+cluster-internal for MDM-N1 and are intended for the FlowerCore
+DeviceManagement bridge.
+
+## NanoHUB Endpoints
+
+- Device command/report and default check-in endpoint: `/mdm`
+- Separate check-in endpoint enabled by `NANOHUB_CHECKIN=true`: `/checkin`
+- Health/version endpoint: `/version`
+- Internal NanoMDM API: `/api/v1/nanomdm/`
+- Internal NanoCMD API: `/api/v1/nanocmd/`
+- Internal KMFDDM API: `/api/v1/ddm/`
+
+NanoHUB API authentication is HTTP Basic with username `nanohub` and password
+from `NANOHUB_API_KEY`.
+
+## Operator Gates
+
+1. Create `FlowerCore Apple MDM Runtime` in the `IAmWorkin` 1Password vault with
+   field `NANOHUB_API_KEY`. Add `NANOHUB_WEBHOOK_URL` only after the
+   DeviceManagement Nano bridge endpoint is live.
+2. Add or confirm `mdm.iamworkin.lan -> 10.0.56.200` in FlowerCore.DNS/pfSense
+   before cert-manager syncs the certificate.
+3. Mirror or build the pinned NanoHUB image, then import it on every schedulable
+   RKE2 node:
+
+   ```bash
+   podman pull --arch arm64 ghcr.io/micromdm/nanohub:latest@sha256:e36a50db2dc3d2bf736645e58712f622c04b05b28487390981905ef4d0be5fbd
+   podman tag ghcr.io/micromdm/nanohub@sha256:e36a50db2dc3d2bf736645e58712f622c04b05b28487390981905ef4d0be5fbd localhost/fc-apple-mdm-nanohub:v0.2.0-20260617
+   podman save localhost/fc-apple-mdm-nanohub:v0.2.0-20260617 -o fc-apple-mdm-nanohub-v0.2.0-20260617.tar
+   # copy to each RKE2 node, then:
+   sudo ctr -n k8s.io images import fc-apple-mdm-nanohub-v0.2.0-20260617.tar
+   ```
+
+   If GHCR changes or becomes unavailable, rebuild/import from
+   `nanohub-linux-arm64-v0.2.0.zip` with SHA-256
+   `b05968322a9bc34e79169ebee28d16554046f981eaee48a12cf80899f51a9dbd`.
+
+4. Sync the ArgoCD app and prove `https://mdm.iamworkin.lan/version`.
+
+## Support Boundary
+
+This MDM-N1 lane deploys the protocol substrate only. It does not create an APNs
+MDM push certificate, enrollment profile, SCEP/device identity service, managed
+Wi-Fi payload, managed app install, or supervised iPad enrollment. Those stay in
+MDM-N2 through MDM-N8.

apps/fc-apple-mdm/certificate.yaml

@@ -0,0 +1,29 @@
+# Certificate for mdm.iamworkin.lan.
+#
+# Preflight gate: FlowerCore.DNS / pfSense must contain an explicit A record:
+#   mdm.iamworkin.lan -> 10.0.56.200
+# before this Certificate is synced. step-ca ACME cannot see the CoreDNS
+# wildcard, so missing pfSense DNS produces cert-manager HTTP-01 backoff.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: fc-apple-mdm-tls
+  namespace: fc-apple-mdm
+  labels:
+    app.kubernetes.io/name: fc-apple-mdm
+    app.kubernetes.io/component: mdm
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/tenant-id: system
+    flowercore.io/created-by: bluejay-infra
+  annotations:
+    flowercore.io/dns-preflight: "mdm.iamworkin.lan must resolve to 10.0.56.200 before ACME sync"
+spec:
+  secretName: fc-apple-mdm-tls
+  issuerRef:
+    name: step-ca-acme
+    kind: ClusterIssuer
+  dnsNames:
+    - mdm.iamworkin.lan
+  duration: 720h
+  renewBefore: 240h

apps/fc-apple-mdm/deployment.yaml

@@ -0,0 +1,127 @@
+# Self-hosted NanoHUB lane for FlowerCore Apple device management.
+#
+# Image contract:
+#   Mirror/import localhost/fc-apple-mdm-nanohub:v0.2.0-20260617 from
+#   ghcr.io/micromdm/nanohub:latest@sha256:e36a50db2dc3d2bf736645e58712f622c04b05b28487390981905ef4d0be5fbd
+#   or rebuild from nanohub-linux-arm64-v0.2.0.zip with SHA-256
+#   b05968322a9bc34e79169ebee28d16554046f981eaee48a12cf80899f51a9dbd.
+#   Keep imagePullPolicy: Never so the RKE2 nodes do not depend on GHCR at
+#   runtime.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: fc-apple-mdm
+  namespace: fc-apple-mdm
+  labels:
+    app: fc-apple-mdm
+    app.kubernetes.io/name: fc-apple-mdm
+    app.kubernetes.io/component: mdm
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/tenant-id: system
+    flowercore.io/created-by: bluejay-infra
+  annotations:
+    flowercore.io/traceability-standard: k8s-pod-ownership-and-traceability-standard
+spec:
+  replicas: 1
+  revisionHistoryLimit: 3
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: fc-apple-mdm
+  template:
+    metadata:
+      labels:
+        app: fc-apple-mdm
+        app.kubernetes.io/name: fc-apple-mdm
+        app.kubernetes.io/component: mdm
+        app.kubernetes.io/part-of: flowercore
+        app.kubernetes.io/managed-by: argocd
+        flowercore.io/tenant-id: system
+        flowercore.io/created-by: bluejay-infra
+      annotations:
+        fc.flowercore.io/healthz-anon: "true"
+        fc.flowercore.io/probe-path: "/version"
+        prometheus.io/scrape: "false"
+        flowercore.io/audit-trace-id: "apple-mdm-nanohub-runtime-trace"
+    spec:
+      securityContext:
+        fsGroup: 1654
+        fsGroupChangePolicy: OnRootMismatch
+      containers:
+        - name: nanohub
+          image: localhost/fc-apple-mdm-nanohub:v0.2.0-20260617
+          imagePullPolicy: Never
+          ports:
+            - name: http
+              containerPort: 9004
+          env:
+            - name: HOME
+              value: "/var/lib/nanohub"
+            - name: NANOHUB_LISTEN
+              value: ":9004"
+            - name: NANOHUB_STORAGE
+              value: "file"
+            - name: NANOHUB_STORAGE_DSN
+              value: "/var/lib/nanohub/db"
+            - name: NANOHUB_CHECKIN
+              value: "true"
+            - name: NANOHUB_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: fc-apple-mdm-runtime
+                  key: NANOHUB_API_KEY
+            - name: NANOHUB_WEBHOOK_URL
+              valueFrom:
+                secretKeyRef:
+                  name: fc-apple-mdm-runtime
+                  key: NANOHUB_WEBHOOK_URL
+                  optional: true
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          startupProbe:
+            httpGet:
+              path: /version
+              port: 9004
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            failureThreshold: 30
+          readinessProbe:
+            httpGet:
+              path: /version
+              port: 9004
+            periodSeconds: 10
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /version
+              port: 9004
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            failureThreshold: 3
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1654
+            runAsGroup: 1654
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/nanohub
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: fc-apple-mdm-data
+        - name: tmp
+          emptyDir: {}

apps/fc-apple-mdm/ingressroute.yaml

@@ -0,0 +1,29 @@
+# LAN ingress for NanoHUB.
+#
+# Traefik terminates step-ca TLS; NanoHUB listens on HTTP :9004 and serves the
+# Apple MDM protocol endpoints. The NanoHUB API stays cluster-internal for
+# MDM-N1; do not route /api/v1 through Traefik until the operator approves an
+# API exposure model.
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: fc-apple-mdm
+  namespace: fc-apple-mdm
+  labels:
+    app.kubernetes.io/name: fc-apple-mdm
+    app.kubernetes.io/component: mdm
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/tenant-id: system
+    flowercore.io/created-by: bluejay-infra
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`mdm.iamworkin.lan`) && (PathPrefix(`/mdm`) || PathPrefix(`/checkin`) || PathPrefix(`/version`))
+      kind: Rule
+      services:
+        - name: fc-apple-mdm
+          port: 80
+  tls:
+    secretName: fc-apple-mdm-tls

apps/fc-apple-mdm/kustomization.yaml

@@ -0,0 +1,13 @@
+# ArgoCD's bluejay-infra ApplicationSet discovers apps/* directories on main.
+# The kustomization is included for local previews and single-app validation.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - 1password-item.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - certificate.yaml
+  - ingressroute.yaml
+  - network-policy.yaml

apps/fc-apple-mdm/namespace.yaml

@@ -0,0 +1,13 @@
+# FlowerCore Apple MDM namespace.
+#
+# ArgoCD discovers this directory as Application `infra-fc-apple-mdm`.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: fc-apple-mdm
+  labels:
+    app.kubernetes.io/name: fc-apple-mdm
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/tenant-id: system
+    flowercore.io/created-by: bluejay-infra

apps/fc-apple-mdm/network-policy.yaml

@@ -0,0 +1,94 @@
+# FlowerCore Apple MDM network isolation.
+#
+# Public/LAN device traffic enters through Traefik. NanoHUB API access is kept
+# cluster-internal for MDM-N1 and is reachable by the DeviceManagement bridge.
+# Egress 443 is required for Apple APNs/ADE/VPP endpoints once APNs and Apple
+# enrollment material are configured in later lanes.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: fc-apple-mdm-isolation
+  namespace: fc-apple-mdm
+  labels:
+    app.kubernetes.io/name: fc-apple-mdm
+    app.kubernetes.io/component: mdm
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/tenant-id: system
+    flowercore.io/created-by: bluejay-infra
+spec:
+  podSelector:
+    matchLabels:
+      app: fc-apple-mdm
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - port: 9004
+          protocol: TCP
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: fc-devicemgmt
+      ports:
+        - port: 9004
+          protocol: TCP
+  egress:
+    # CoreDNS.
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    # Apple APNs/ADE/VPP endpoints and upstream certificate checks.
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+      ports:
+        - port: 443
+          protocol: TCP
+    # Traefik VIP / in-cluster Traefik for public URL self-checks. Include
+    # post-DNAT backend ports 8443 + 8080.
+    - to:
+        - ipBlock:
+            cidr: 10.0.56.200/32
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - port: 80
+          protocol: TCP
+        - port: 443
+          protocol: TCP
+        - port: 8080
+          protocol: TCP
+        - port: 8443
+          protocol: TCP
+    # DeviceManagement bridge webhook/API target.
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: fc-devicemgmt
+      ports:
+        - port: 80
+          protocol: TCP
+        - port: 8080
+          protocol: TCP

apps/fc-apple-mdm/pvc.yaml

@@ -0,0 +1,25 @@
+# Persistent NanoHUB file backend state.
+#
+# NanoHUB stores NanoMDM, NanoCMD, and KMFDDM data under the file backend root.
+# RWO: keep a single replica and use Recreate for disruptive image/runtime
+# changes.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: fc-apple-mdm-data
+  namespace: fc-apple-mdm
+  labels:
+    app: fc-apple-mdm
+    app.kubernetes.io/name: fc-apple-mdm
+    app.kubernetes.io/component: mdm
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/tenant-id: system
+    flowercore.io/created-by: bluejay-infra
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 2Gi

apps/fc-apple-mdm/service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: fc-apple-mdm
+  namespace: fc-apple-mdm
+  labels:
+    app: fc-apple-mdm
+    app.kubernetes.io/name: fc-apple-mdm
+    app.kubernetes.io/component: mdm
+    app.kubernetes.io/part-of: flowercore
+    app.kubernetes.io/managed-by: argocd
+    flowercore.io/tenant-id: system
+    flowercore.io/created-by: bluejay-infra
+spec:
+  type: ClusterIP
+  selector:
+    app: fc-apple-mdm
+  ports:
+    - name: http
+      port: 80
+      targetPort: 9004
+      protocol: TCP

apps/fc-chat/fc-chat.yaml

@@ -47,6 +47,8 @@ data:
   FlowerCore__AI__Skills__Library__LibraryApiUrl: "http://library-web.fc-library.svc.cluster.local"
   FlowerCore__AI__Skills__Retail__RetailApiUrl: "http://retail-web.fc-retail.svc.cluster.local"
   FlowerCore__AI__Skills__Intranet__IntranetBaseUrl: "http://intranet-web.intranet.svc.cluster.local"
+  FlowerCore__AI__Skills__Intranet__SearchBaseUrl: "https://intranet.iamworkin.lan"
+  FlowerCore__AI__Skills__Intranet__PublicBaseUrl: "https://intranet.iamworkin.lan"
   FlowerCore__AI__Skills__Print__PrintMcpBaseUrl: "http://10.0.57.16:5200"
   FlowerCore__AI__Helpdesk__SentimentEscalation__Enabled: "true"
   FlowerCore__AI__IrcBridge__Enabled: "true"
@@ -123,7 +125,7 @@ spec:
         fsGroupChangePolicy: OnRootMismatch
       containers:
         - name: chat-web
-          image: localhost/fc-chat-web:v20260614-regroup-ch6-37285d8
+          image: localhost/fc-chat-web:v20260616-circuit-mood-5711f2d
           imagePullPolicy: Never
           ports:
             - name: http

apps/fc-dns/fc-dns.yaml

@@ -26,6 +26,17 @@ metadata:
 spec:
   itemPath: "vaults/IAmWorkin/items/dns-oidc-client"
 ---
+# Service X-Api-Key for the cert-manager ACME webhook -> dns-web call path.
+# The 1Password operator resolves this item into Secret/dns-api-keys; field
+# `api_key` becomes Secret key `api_key`.
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: dns-api-keys
+  namespace: fc-dns
+spec:
+  itemPath: "vaults/IAmWorkin/items/FlowerCore DNS API Keys"
+---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
@@ -48,7 +59,7 @@ data:
     {
         "FlowerCore": {
         "Auth": {
-          "Enabled": false,
+          "Enabled": true,
           "Oidc": {
             "Enabled": true,
             "Audience": "dns",
@@ -63,7 +74,7 @@ data:
         },
         "Tenant": {
           "DefaultTenantId": "default",
-          "JwtClaimsEnabled": false,
+          "JwtClaimsEnabled": true,
           "DefaultTenantHosts": [
             "dns.iamworkin.lan"
           ]
@@ -74,6 +85,13 @@ data:
               "Distribution": "Warn"
             }
           }
+        },
+        "Dns": {
+          "RateLimits": {
+            "PermitLimit": 60,
+            "WindowSeconds": 60,
+            "QueueLimit": 0
+          }
         }
       }
     }
@@ -111,7 +129,7 @@ spec:
         fsGroup: 1654
       containers:
         - name: dns-web
-          image: localhost/fc-dns-web:v20260614-wave5-isolation-6124856
+          image: localhost/fc-dns-web:v20260616-dn-current-3626f04
           imagePullPolicy: Never
           securityContext:
             readOnlyRootFilesystem: true
@@ -148,8 +166,22 @@ spec:
                   name: dns-oidc-client
                   key: client_secret
                   optional: true
+            - name: FlowerCore__Auth__ApiKey
+              valueFrom:
+                secretKeyRef:
+                  name: dns-api-keys
+                  key: api_key
+                  optional: true
+            - name: FlowerCore__Mcp__ApiKey__Key
+              valueFrom:
+                secretKeyRef:
+                  name: dns-api-keys
+                  key: api_key
+                  optional: true
+            - name: FlowerCore__Mcp__ServiceName
+              value: flowercore.dns
             - name: FlowerCore__Auth__Enabled
-              value: "false"
+              value: "true"
             - name: FlowerCore__Auth__Oidc__Enabled
               value: "true"
             - name: FlowerCore__Auth__Oidc__Audience
@@ -209,6 +241,42 @@ spec:
       targetPort: 5320
   type: ClusterIP
 ---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: dns-web-ingress-isolation
+  namespace: fc-dns
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: dns-web
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: fc-dns
+        - ipBlock:
+            cidr: 10.42.0.0/16
+        - ipBlock:
+            cidr: 10.0.56.0/24
+        - ipBlock:
+            cidr: 10.0.57.0/24
+        - ipBlock:
+            cidr: 10.0.58.0/24
+        - ipBlock:
+            cidr: 10.0.68.0/27
+      ports:
+        - port: 5320
+          protocol: TCP
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -303,7 +371,7 @@ spec:
         fsGroup: 1654
       containers:
         - name: dns-acme-webhook
-          image: localhost/fc-dns-acme-webhook:v20260614-wave5-isolation-6124856
+          image: localhost/fc-dns-acme-webhook:v20260616-dn-current-3626f04
           imagePullPolicy: Never
           securityContext:
             readOnlyRootFilesystem: true
@@ -322,6 +390,12 @@ spec:
               value: /tls/tls.key
             - name: FlowerCore__Dns__AcmeWebhook__ServiceBaseUrl
               value: http://dns-web:5320
+            - name: FlowerCore__Dns__AcmeWebhook__ApiKey
+              valueFrom:
+                secretKeyRef:
+                  name: dns-api-keys
+                  key: api_key
+                  optional: true
             - name: FlowerCore__Dns__AcmeWebhook__GroupName
               value: acme.flowercore.io
             - name: FlowerCore__Dns__AcmeWebhook__SolverName

apps/fc-gateway/fc-gateway.yaml

@@ -0,0 +1,345 @@
+# FlowerCore.Mcp.Gateway — Agent Zero MCP tool-router.
+# Exposes one AZ-facing MCP endpoint with three meta-tools:
+# list_capabilities, search_tools, invoke_tool.
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: fc-gateway
+  labels:
+    app.kubernetes.io/part-of: flowercore
+---
+# Inbound key Agent Zero sends to the gateway as X-Api-Key.
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: gateway-mcp-keys
+  namespace: fc-gateway
+spec:
+  itemPath: "vaults/IAmWorkin/items/FlowerCore Gateway MCP Keys"
+---
+# Embedding API key for fc:embedding via fc-llm-bridge. Optional at runtime:
+# the gateway falls back to deterministic keyword ranking if embeddings are down.
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: fc-llm-bridge-api-keys
+  namespace: fc-gateway
+spec:
+  itemPath: "vaults/IAmWorkin/items/FC LLM Bridge API Keys"
+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: mysql-mcp-keys
+  namespace: fc-gateway
+spec:
+  itemPath: "vaults/IAmWorkin/items/FlowerCore MySQL MCP Keys"
+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: telephony-mcp-keys
+  namespace: fc-gateway
+spec:
+  itemPath: "vaults/IAmWorkin/items/Twilio IVR MCP Token (Agent Zero)"
+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: chat-mcp-keys
+  namespace: fc-gateway
+spec:
+  itemPath: "vaults/IAmWorkin/items/FlowerCore Chat MCP Keys"
+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: dms-mcp-keys
+  namespace: fc-gateway
+spec:
+  itemPath: "vaults/IAmWorkin/items/FlowerCore DMS MCP Keys"
+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: knowledge-mcp-tokens
+  namespace: fc-gateway
+spec:
+  itemPath: "vaults/IAmWorkin/items/FlowerCore Knowledge MCP Tokens"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: fc-gateway
+  namespace: fc-gateway
+  labels:
+    app.kubernetes.io/name: fc-gateway
+    app.kubernetes.io/part-of: flowercore
+spec:
+  replicas: 1
+  revisionHistoryLimit: 3
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: fc-gateway
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: fc-gateway
+        app.kubernetes.io/part-of: flowercore
+      annotations:
+        fc.flowercore.io/healthz-anon: "true"
+        fc.flowercore.io/probe-path: "/healthz"
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8080"
+        prometheus.io/path: "/metrics/prometheus"
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        fsGroup: 1654
+        fsGroupChangePolicy: OnRootMismatch
+      containers:
+        - name: web
+          image: localhost/fc-gateway:v20260617-az-gateway
+          imagePullPolicy: Never
+          ports:
+            - containerPort: 8080
+              name: http
+          env:
+            - name: ASPNETCORE_URLS
+              value: "http://+:8080"
+            - name: ASPNETCORE_ENVIRONMENT
+              value: "Production"
+            - name: DOTNET_SYSTEM_GLOBALIZATION_INVARIANT
+              value: "false"
+            - name: FlowerCore__Mcp__ApiKey__Key
+              valueFrom:
+                secretKeyRef:
+                  name: gateway-mcp-keys
+                  key: credential
+            - name: FlowerCore__Mcp__Gateway__Embedding__BaseUrl
+              value: "http://fc-llm-bridge.fc-llm-bridge.svc:8080/v1"
+            - name: FlowerCore__Mcp__Gateway__Embedding__Model
+              value: "fc:embedding"
+            - name: FlowerCore__Mcp__Gateway__Embedding__Mode
+              value: "openai"
+            - name: FlowerCore__Mcp__Gateway__Embedding__ApiKey
+              valueFrom:
+                secretKeyRef:
+                  name: fc-llm-bridge-api-keys
+                  key: agent-zero-k8s
+                  optional: true
+            - name: GW_BACKEND_fc_mysql_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: mysql-mcp-keys
+                  key: credential
+                  optional: true
+            - name: GW_BACKEND_fc_telephony_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: telephony-mcp-keys
+                  key: credential
+                  optional: true
+            - name: GW_BACKEND_fc_chat_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: chat-mcp-keys
+                  key: credential
+                  optional: true
+            - name: GW_BACKEND_fc_dms_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: dms-mcp-keys
+                  key: credential
+                  optional: true
+            - name: GW_BACKEND_fc_knowledge_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: knowledge-mcp-tokens
+                  key: password
+                  optional: true
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 384Mi
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            - name: logs
+              mountPath: /home/app/logs
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1654
+            runAsGroup: 1654
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: [ALL]
+          startupProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            failureThreshold: 30
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              port: 8080
+            initialDelaySeconds: 30
+            periodSeconds: 30
+      volumes:
+        - name: tmp
+          emptyDir: {}
+        - name: logs
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: fc-gateway
+  namespace: fc-gateway
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: fc-gateway
+  ports:
+    - name: http
+      port: 80
+      targetPort: 8080
+      protocol: TCP
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: fc-gateway-tls
+  namespace: fc-gateway
+spec:
+  secretName: fc-gateway-tls
+  issuerRef:
+    name: step-ca-acme
+    kind: ClusterIssuer
+  dnsNames:
+    - gateway.iamworkin.lan
+  duration: 720h
+  renewBefore: 240h
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: fc-gateway
+  namespace: fc-gateway
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`gateway.iamworkin.lan`)
+      kind: Rule
+      services:
+        - name: fc-gateway
+          port: 80
+  tls:
+    secretName: fc-gateway-tls
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: fc-gateway-netpol
+  namespace: fc-gateway
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: fc-gateway
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: agent-zero
+      ports:
+        - port: 8080
+          protocol: TCP
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik-system
+      ports:
+        - port: 8080
+          protocol: TCP
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: monitoring
+      ports:
+        - port: 8080
+          protocol: TCP
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+      ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: fc-llm-bridge
+      ports:
+        - port: 8080
+          protocol: TCP
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: fc-mysql
+      ports:
+        - port: 5300
+          protocol: TCP
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: telephony
+      ports:
+        - port: 5100
+          protocol: TCP
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: fc-chat
+      ports:
+        - port: 80
+          protocol: TCP
+        - port: 8080
+          protocol: TCP
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: fc-dms
+      ports:
+        - port: 80
+          protocol: TCP
+        - port: 8080
+          protocol: TCP
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: knowledge
+      ports:
+        - port: 80
+          protocol: TCP
+        - port: 8080
+          protocol: TCP

apps/fc-library/fc-library.yaml

@@ -60,7 +60,7 @@ spec:
         - envFrom:
             - configMapRef:
                 name: library-web-config
-          image: localhost/fc-library-web:v20260614-regroup-f20adc1
+          image: localhost/fc-library-web:v20260615-rl5-fineaction-80981c3
           imagePullPolicy: Never
           livenessProbe:
             failureThreshold: 3

apps/fc-ttsreader/fc-ttsreader.yaml

@@ -535,7 +535,7 @@ spec:
         fsGroupChangePolicy: OnRootMismatch
       containers:
         - name: web
-          image: localhost/fc-ttsreader-web:v20260614-wave5-help-2f096e3
+          image: localhost/fc-ttsreader-web:v20260616-tt3-plane-3fe50f0
           imagePullPolicy: Never
           ports:
             - containerPort: 5217

apps/github-runner/github-runner.yaml

@@ -1698,7 +1698,12 @@ metadata:
     flowercore.io/runner-repo: tts-reader
     flowercore.io/github-repo: FlowerCore.TtsReader
 spec:
-  replicas: 1
+  # Scaled to 0 2026-06-16: this runner was crash-looping (329 restarts) and
+  # consuming memory on the over-pressured old cluster (agent1 ~81%), which was
+  # contributing to Blazor circuit drops on ttsreader/chat. It provides no
+  # working CI in this state. Restore to 1 once the runner is fixed (or the repo
+  # CI moves to the GX10 / a working runner).
+  replicas: 0
   selector:
     matchLabels:
       app.kubernetes.io/name: github-runner-tts-reader

apps/telephony/telephony.yaml

@@ -25,17 +25,25 @@ data:
 ---
 # 1Password → K8s Secret sync for Twilio credentials
 # Creates secret "twilio-credentials" with fields: AccountSid, AuthToken, DefaultFromNumber
-apiVersion: onepassword.com/v1
-kind: OnePasswordItem
-metadata:
-  name: twilio-credentials
-  namespace: telephony
-spec:
-  itemPath: "vaults/IAmWorkin/items/Twilio Account"
----
-# Application configuration overlay
-apiVersion: v1
-kind: ConfigMap
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: twilio-credentials
+  namespace: telephony
+spec:
+  itemPath: "vaults/IAmWorkin/items/Twilio Account"
+---
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: telephony-mcp-keys
+  namespace: telephony
+spec:
+  itemPath: "vaults/IAmWorkin/items/Twilio IVR MCP Token (Agent Zero)"
+---
+# Application configuration overlay
+apiVersion: v1
+kind: ConfigMap
 metadata:
   name: telephony-config
   namespace: telephony
@@ -180,14 +188,20 @@ spec:
                   name: twilio-credentials
                   key: AuthToken
                   optional: true
-            - name: Telephony__Twilio__DefaultFromNumber
-              valueFrom:
-                secretKeyRef:
-                  name: twilio-credentials
-                  key: DefaultFromNumber
-                  optional: true
-            # Env vars OVERRIDE appsettings.Production.json in ASP.NET Core config.
-            # These were previously applied live-only (kubectl) and drifted from git;
+            - name: Telephony__Twilio__DefaultFromNumber
+              valueFrom:
+                secretKeyRef:
+                  name: twilio-credentials
+                  key: DefaultFromNumber
+                  optional: true
+            - name: FlowerCore__Mcp__ApiKey__Key
+              valueFrom:
+                secretKeyRef:
+                  name: telephony-mcp-keys
+                  key: credential
+                  optional: true
+            # Env vars OVERRIDE appsettings.Production.json in ASP.NET Core config.
+            # These were previously applied live-only (kubectl) and drifted from git;
             # codified here so git is the source of truth. Tts__PiperUrl is the real
             # TTS cutover lever (the configmap "Tts" block is shadowed by this env).
             - name: Tts__PiperUrl
@@ -301,17 +315,25 @@ spec:
         - namespaceSelector:
             matchLabels:
               kubernetes.io/metadata.name: traefik-system
-    # Allow Selenium Grid for automated UI testing
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: selenium
-      ports:
-        - port: 5100
-          protocol: TCP
-    # Allow SIP/RTP from external sources (Yealink phones, Twilio SIP trunk)
-    - from:
-        - ipBlock:
+    # Allow Selenium Grid for automated UI testing
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: selenium
+      ports:
+        - port: 5100
+          protocol: TCP
+    # Allow FlowerCore.Mcp.Gateway to reach Telephony /mcp on the destination pod port.
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: fc-gateway
+      ports:
+        - port: 5100
+          protocol: TCP
+    # Allow SIP/RTP from external sources (Yealink phones, Twilio SIP trunk)
+    - from:
+        - ipBlock:
             cidr: 0.0.0.0/0
       ports:
         - port: 5060

tests/bluejay-infra-lint/FleetManifestLintTests.cs

@@ -814,6 +814,78 @@ public sealed class FleetManifestLintTests
         ns.FileText.Should().Contain("ArgoCD discovers this directory as Application `infra-fc-devicemgmt`.");
     }
 
+    [Fact]
+    public void FcAppleMdm_NanoHubWorkloadMustStayPinnedAndInternalApiOnly()
+    {
+        var documents = AppDocuments("fc-apple-mdm");
+
+        documents.Should().Contain(document => document.Kind == "Namespace" && document.Name == "fc-apple-mdm");
+        documents.Should().Contain(document => document.Kind == "OnePasswordItem" && document.Name == "fc-apple-mdm-runtime");
+        documents.Should().NotContain(document => document.Kind == "Secret");
+
+        var item = documents.Single(document => document.Kind == "OnePasswordItem" && document.Name == "fc-apple-mdm-runtime");
+        item.Scalar("spec", "itemPath").Should().Be("vaults/IAmWorkin/items/FlowerCore Apple MDM Runtime");
+
+        var deployment = documents.Single(document => document.Kind == "Deployment" && document.Name == "fc-apple-mdm");
+        deployment.Scalar("spec", "strategy", "type").Should().Be("Recreate");
+        PodAnnotation(deployment, "fc.flowercore.io/healthz-anon").Should().Be("true");
+        PodAnnotation(deployment, "fc.flowercore.io/probe-path").Should().Be("/version");
+        PodAnnotation(deployment, "flowercore.io/audit-trace-id").Should().Be("apple-mdm-nanohub-runtime-trace");
+
+        var container = deployment.MainContainerMappings().Should().ContainSingle().Subject;
+        ManifestNodeExtensions.Scalar(container, "name").Should().Be("nanohub");
+        ManifestNodeExtensions.Scalar(container, "image").Should().Be("localhost/fc-apple-mdm-nanohub:v0.2.0-20260617");
+        ManifestNodeExtensions.Scalar(container, "imagePullPolicy").Should().Be("Never");
+        EnvValue(container, "NANOHUB_LISTEN").Should().Be(":9004");
+        EnvValue(container, "NANOHUB_STORAGE").Should().Be("file");
+        EnvValue(container, "NANOHUB_STORAGE_DSN").Should().Be("/var/lib/nanohub/db");
+        EnvValue(container, "NANOHUB_CHECKIN").Should().Be("true");
+        EnvSecretName(container, "NANOHUB_API_KEY").Should().Be("fc-apple-mdm-runtime");
+        EnvSecretKey(container, "NANOHUB_API_KEY").Should().Be("NANOHUB_API_KEY");
+        EnvSecretName(container, "NANOHUB_WEBHOOK_URL").Should().Be("fc-apple-mdm-runtime");
+        EnvSecretKey(container, "NANOHUB_WEBHOOK_URL").Should().Be("NANOHUB_WEBHOOK_URL");
+        EnvSecretOptional(container, "NANOHUB_WEBHOOK_URL").Should().Be("true");
+        ProbePath(container, "readinessProbe").Should().Be("/version");
+        ProbePath(container, "startupProbe").Should().Be("/version");
+        ProbePath(container, "livenessProbe").Should().Be("/version");
+
+        var certificate = documents.Single(document => document.Kind == "Certificate" && document.Name == "fc-apple-mdm-tls");
+        certificate.Scalar("spec", "issuerRef", "name").Should().Be("step-ca-acme");
+        certificate.Scalar("spec", "issuerRef", "kind").Should().Be("ClusterIssuer");
+        ManifestNodeExtensions.ScalarSequence(certificate.Root, "spec", "dnsNames")
+            .Should()
+            .ContainSingle("mdm.iamworkin.lan");
+
+        var ingress = documents.Single(document => document.Kind == "IngressRoute" && document.Name == "fc-apple-mdm");
+        var match = ingress.MappingSequence("spec", "routes")
+            .Select(route => ManifestNodeExtensions.Scalar(route, "match") ?? string.Empty)
+            .Should()
+            .ContainSingle()
+            .Subject;
+
+        match.Should().Contain("Host(`mdm.iamworkin.lan`)");
+        match.Should().Contain("PathPrefix(`/mdm`)");
+        match.Should().Contain("PathPrefix(`/checkin`)");
+        match.Should().Contain("PathPrefix(`/version`)");
+        match.Should().NotContain("/api/v1", "NanoHUB API access is cluster-internal for MDM-N1");
+
+        var service = documents.Single(document => document.Kind == "Service" && document.Name == "fc-apple-mdm");
+        service.AllScalars().Should().Contain("9004");
+
+        var policy = documents.Single(document => document.Kind == "NetworkPolicy" && document.Name == "fc-apple-mdm-isolation");
+        policy.AllScalars().Should().Contain(new[]
+        {
+            "traefik-system",
+            "fc-devicemgmt",
+            "10.0.56.200/32",
+        });
+        policy.EgressPorts().Should().Contain(new[] { "53", "80", "443", "8080", "8443" });
+
+        documents.Should().NotContain(document => document.AllScalars().Any(value =>
+            value.Contains("micromdm", StringComparison.OrdinalIgnoreCase)
+            || value.Contains("MICROMDM", StringComparison.Ordinal)));
+    }
+
     [Fact]
     public void BroaderHardeningDeployments_MustAnnotateAnonymousHealthProbeIntent()
     {
@@ -867,7 +939,7 @@ public sealed class FleetManifestLintTests
     {
         var deployments = new[]
         {
-            (App: "fc-dns", Name: "dns-web", Slug: "dns", Secret: "dns-oidc-client", AuthEnabled: "false"),
+            (App: "fc-dns", Name: "dns-web", Slug: "dns", Secret: "dns-oidc-client", AuthEnabled: "true"),
             (App: "fc-media", Name: "fc-media-web", Slug: "media", Secret: "media-oidc-client", AuthEnabled: "true"),
             (App: "fc-distribution", Name: "fc-distribution", Slug: "distribution", Secret: "distribution-oidc-client", AuthEnabled: "true"),
         };
@@ -918,6 +990,37 @@ public sealed class FleetManifestLintTests
         }
     }
 
+    [Fact]
+    public void DnsPhase0_UsesOnePasswordBackedAcmeApiKey()
+    {
+        var item = AppDocuments("fc-dns")
+            .Single(document => document.Kind == "OnePasswordItem" && document.Name == "dns-api-keys");
+        item.Scalar("spec", "itemPath").Should().Be("vaults/IAmWorkin/items/FlowerCore DNS API Keys");
+
+        var dnsWeb = AppDocuments("fc-dns")
+            .Single(document => document.Kind == "Deployment" && document.Name == "dns-web")
+            .MainContainerMappings()
+            .Should()
+            .ContainSingle()
+            .Subject;
+        EnvSecretName(dnsWeb, "FlowerCore__Auth__ApiKey").Should().Be("dns-api-keys");
+        EnvSecretKey(dnsWeb, "FlowerCore__Auth__ApiKey").Should().Be("api_key");
+        EnvSecretOptional(dnsWeb, "FlowerCore__Auth__ApiKey").Should().Be("true");
+        EnvSecretName(dnsWeb, "FlowerCore__Mcp__ApiKey__Key").Should().Be("dns-api-keys");
+        EnvSecretKey(dnsWeb, "FlowerCore__Mcp__ApiKey__Key").Should().Be("api_key");
+        EnvSecretOptional(dnsWeb, "FlowerCore__Mcp__ApiKey__Key").Should().Be("true");
+
+        var webhook = AppDocuments("fc-dns")
+            .Single(document => document.Kind == "Deployment" && document.Name == "dns-acme-webhook")
+            .MainContainerMappings()
+            .Should()
+            .ContainSingle()
+            .Subject;
+        EnvSecretName(webhook, "FlowerCore__Dns__AcmeWebhook__ApiKey").Should().Be("dns-api-keys");
+        EnvSecretKey(webhook, "FlowerCore__Dns__AcmeWebhook__ApiKey").Should().Be("api_key");
+        EnvSecretOptional(webhook, "FlowerCore__Dns__AcmeWebhook__ApiKey").Should().Be("true");
+    }
+
     [Fact]
     public void DnsAndMediaGitOpsAdoption_PreservesLiveStorageAndImageShape()
     {
@@ -927,7 +1030,7 @@ public sealed class FleetManifestLintTests
         var dnsPvc = AppDocuments("fc-dns")
             .Single(document => document.Kind == "PersistentVolumeClaim" && document.Name == "dns-web-data");
 
-        ManifestNodeExtensions.Scalar(dnsContainer, "image").Should().Be("localhost/fc-dns-web:v20260613-g5-quota-aa99bd1");
+        ManifestNodeExtensions.Scalar(dnsContainer, "image").Should().Be("localhost/fc-dns-web:v20260616-dn-current-3626f04");
         dnsPvc.Scalar("spec", "storageClassName").Should().Be("longhorn");
         dnsPvc.Scalar("spec", "resources", "requests", "storage").Should().Be("1Gi");