diff --git a/deploy/artifact-catalog.v02.json b/deploy/artifact-catalog.v02.json
index 2d17b004..89cb3116 100644
--- a/deploy/artifact-catalog.v02.json
+++ b/deploy/artifact-catalog.v02.json
@@ -5,7 +5,7 @@
   "profile": "v02",
   "namespace": "hwlab-v02",
   "endpoint": "https://hwlab.74-48-78-17.nip.io",
-  "commitId": "554269ef997aaa7df64053072f8bfc732febecd6",
+  "commitId": "40f798eb0b4a1379b8746b84373da03c56aa307c",
   "artifactState": "published",
   "publish": {
     "registryPrefix": "127.0.0.1:5000/hwlab",
@@ -14,7 +14,7 @@
     "publishedAt": null,
     "ciPublished": true,
     "registryVerified": true,
-    "provenance": "g14-ci-artifact:hwlab-v02-ci-poll-554269ef997a-collect",
+    "provenance": "g14-ci-artifact:hwlab-v02-ci-poll-40f798eb0b4a-collect",
     "note": "Digest fields were copied from a successful DEV artifact publish report for this source commit."
   },
   "allowedProfiles": [
@@ -29,16 +29,16 @@
       "serviceId": "hwlab-cloud-api",
       "profile": "v02",
       "namespace": "hwlab-v02",
-      "commitId": "869746374be36a7aeac7443de8c72a377240ca2d",
-      "sourceCommitId": "869746374be36a7aeac7443de8c72a377240ca2d",
-      "image": "127.0.0.1:5000/hwlab/hwlab-cloud-api:869746374be36a7aeac7443de8c72a377240ca2d",
-      "imageTag": "869746374be36a7aeac7443de8c72a377240ca2d",
-      "digest": "sha256:687276c4a7fbc7665cd473b4e937e99cee6eb133207c4ac43da76b373ba1c264",
-      "buildBackend": "reused-catalog",
-      "buildCreatedAt": "2026-06-04T18:30:21.096Z",
-      "buildSource": "git-mirror-http.devops-infra.svc.cluster.local/pikasTech/HWLAB@869746374be36a7aeac7443de8c72a377240ca2d",
-      "componentCommitId": "1162c0e5bd47b4a5d59e5ff98b66a2e456d12eef",
-      "componentInputHash": "114fc37e66d94feb9eb3fe19d41b9a7526914dbbacb96753c43535a6a04f317d",
+      "commitId": "40f798eb0b4a1379b8746b84373da03c56aa307c",
+      "sourceCommitId": "40f798eb0b4a1379b8746b84373da03c56aa307c",
+      "image": "127.0.0.1:5000/hwlab/hwlab-cloud-api:40f798eb0b4a1379b8746b84373da03c56aa307c",
+      "imageTag": "40f798eb0b4a1379b8746b84373da03c56aa307c",
+      "digest": "sha256:84ff5a13997a9dabc8204fa30a0b514190a31b4b1a793033851247ec57b51b97",
+      "buildBackend": "buildkit",
+      "buildCreatedAt": "2026-06-05T01:44:13.462Z",
+      "buildSource": "git-mirror-http.devops-infra.svc.cluster.local/pikasTech/HWLAB@40f798eb0b4a1379b8746b84373da03c56aa307c",
+      "componentCommitId": "cf722efd06c599fbd4507ca74039b054eb26631a",
+      "componentInputHash": "3f8a6c37d3a5325dc492ed8665821781762e2e9e5fd3462b1056e11438f83104",
       "runtimeMode": "service-image",
       "envReuse": false,
       "envChanged": null,
@@ -48,25 +48,23 @@
       "environmentInputHash": null,
       "codeInputHash": null,
       "bootRepo": null,
-      "bootCommit": "554269ef997aaa7df64053072f8bfc732febecd6",
+      "bootCommit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
       "bootSh": null,
       "bootEnvEvidence": null,
       "dockerfileHash": "01404b65f1bc82b4ef400e06d122ffaf072407f1dc67fb822903288ef679344d",
       "baseImageReference": "127.0.0.1:5000/hwlab/hwlab-node20-base:20-bookworm-slim",
       "baseImageDigest": null,
       "buildArgsHash": "445d32282d642d5089290ffe5f621ccea3206cf1d9f11b24091f82a4434cbcd5",
-      "ciAffected": false,
+      "ciAffected": true,
       "ciReason": [
-        "component-inputs-unchanged"
+        "component-path-changed"
       ],
       "reuse": {
-        "status": "ready",
-        "image": "127.0.0.1:5000/hwlab/hwlab-cloud-api:869746374be36a7aeac7443de8c72a377240ca2d",
-        "digest": "sha256:687276c4a7fbc7665cd473b4e937e99cee6eb133207c4ac43da76b373ba1c264",
-        "reusedFrom": "114fc37e66d94feb9eb3fe19d41b9a7526914dbbacb96753c43535a6a04f317d"
+        "status": "not-reused",
+        "reason": "component-affected"
       },
       "reusedFrom": "114fc37e66d94feb9eb3fe19d41b9a7526914dbbacb96753c43535a6a04f317d",
-      "publishState": "reused",
+      "publishState": "published",
       "publishEnabled": true,
       "artifactRequired": true,
       "artifactScope": "required",
@@ -76,37 +74,37 @@
       "serviceId": "hwlab-cloud-web",
       "profile": "v02",
       "namespace": "hwlab-v02",
-      "commitId": "4baea168af28f090c8cf73f8a46620a5773ffd42",
-      "sourceCommitId": "4baea168af28f090c8cf73f8a46620a5773ffd42",
+      "commitId": "40f798eb0b4a1379b8746b84373da03c56aa307c",
+      "sourceCommitId": "40f798eb0b4a1379b8746b84373da03c56aa307c",
       "image": "127.0.0.1:5000/hwlab/hwlab-cloud-web-env:env-18c6c806d749",
       "imageTag": "env-18c6c806d749",
       "digest": "sha256:97e28c1203dbcca130b3d9369e7e4a4eb740b0af5a5f8b06bd7e904e23ee8808",
       "buildBackend": "reused-env-catalog",
       "buildCreatedAt": "2026-06-04T17:50:16.969Z",
       "buildSource": "git-mirror-http.devops-infra.svc.cluster.local/pikasTech/HWLAB@env:18c6c806d7494d1895e2adffd3930032fa57a8313a8ca5f6fba358acc613022e",
-      "componentCommitId": "fd1b8c0e5ad76e41802407f002f76962f78f8179",
-      "componentInputHash": "7437f244ce29636f2880ba9b506207b1c438378cbc1e234a58967565f4d13107",
+      "componentCommitId": "cf722efd06c599fbd4507ca74039b054eb26631a",
+      "componentInputHash": "22c84dc9096c3c88b7efa5341410c3676148aa6a6ec5f70ad37ec60c8ff3a3cf",
       "runtimeMode": "env-reuse-git-mirror-checkout",
       "envReuse": true,
       "envChanged": false,
-      "codeChanged": false,
+      "codeChanged": true,
       "environmentImage": "127.0.0.1:5000/hwlab/hwlab-cloud-web-env:env-18c6c806d749",
       "environmentDigest": "sha256:97e28c1203dbcca130b3d9369e7e4a4eb740b0af5a5f8b06bd7e904e23ee8808",
       "environmentInputHash": "18c6c806d7494d1895e2adffd3930032fa57a8313a8ca5f6fba358acc613022e",
-      "codeInputHash": "653f25bd417520db88237d6a49d45dce4d6ae6364475704705b7586395bfc82e",
+      "codeInputHash": "a6ca4236657f0c4d3b250a5ebb6ae6208c4e93affaa53a4765fec92cd10e7938",
       "bootRepo": "git@github.com:pikasTech/HWLAB.git",
-      "bootCommit": "4baea168af28f090c8cf73f8a46620a5773ffd42",
+      "bootCommit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
       "bootSh": "deploy/runtime/boot/hwlab-cloud-web.sh",
       "bootEnvEvidence": {
         "runtimeMode": "env-reuse-git-mirror-checkout",
         "environmentDigest": "sha256:97e28c1203dbcca130b3d9369e7e4a4eb740b0af5a5f8b06bd7e904e23ee8808",
         "environmentImage": "127.0.0.1:5000/hwlab/hwlab-cloud-web-env:env-18c6c806d749",
         "bootRepo": "git@github.com:pikasTech/HWLAB.git",
-        "bootCommit": "4baea168af28f090c8cf73f8a46620a5773ffd42",
+        "bootCommit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
         "bootSh": "deploy/runtime/boot/hwlab-cloud-web.sh",
         "env": {
           "HWLAB_BOOT_REPO": "git@github.com:pikasTech/HWLAB.git",
-          "HWLAB_BOOT_COMMIT": "4baea168af28f090c8cf73f8a46620a5773ffd42",
+          "HWLAB_BOOT_COMMIT": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "HWLAB_BOOT_SH": "deploy/runtime/boot/hwlab-cloud-web.sh",
           "HWLAB_ENVIRONMENT_IMAGE": "127.0.0.1:5000/hwlab/hwlab-cloud-web-env:env-18c6c806d749",
           "HWLAB_ENVIRONMENT_DIGEST": "sha256:97e28c1203dbcca130b3d9369e7e4a4eb740b0af5a5f8b06bd7e904e23ee8808"
@@ -116,9 +114,10 @@
       "baseImageReference": "127.0.0.1:5000/hwlab/hwlab-node20-base:20-bookworm-slim",
       "baseImageDigest": null,
       "buildArgsHash": "39effb18af665e5e286cca9f84ef2a30f577ad11c9acca098589b7ee37f6950c",
-      "ciAffected": false,
+      "ciAffected": true,
       "ciReason": [
-        "component-inputs-unchanged"
+        "code-input-changed",
+        "component-path-changed"
       ],
       "reuse": {
         "status": "ready",
@@ -217,7 +216,7 @@
       "environmentInputHash": null,
       "codeInputHash": null,
       "bootRepo": null,
-      "bootCommit": "554269ef997aaa7df64053072f8bfc732febecd6",
+      "bootCommit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
       "bootSh": null,
       "bootEnvEvidence": null,
       "dockerfileHash": "01404b65f1bc82b4ef400e06d122ffaf072407f1dc67fb822903288ef679344d",
@@ -264,7 +263,7 @@
       "environmentInputHash": null,
       "codeInputHash": null,
       "bootRepo": null,
-      "bootCommit": "554269ef997aaa7df64053072f8bfc732febecd6",
+      "bootCommit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
       "bootSh": null,
       "bootEnvEvidence": null,
       "dockerfileHash": "01404b65f1bc82b4ef400e06d122ffaf072407f1dc67fb822903288ef679344d",
@@ -311,7 +310,7 @@
       "environmentInputHash": null,
       "codeInputHash": null,
       "bootRepo": null,
-      "bootCommit": "554269ef997aaa7df64053072f8bfc732febecd6",
+      "bootCommit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
       "bootSh": null,
       "bootEnvEvidence": null,
       "dockerfileHash": "01404b65f1bc82b4ef400e06d122ffaf072407f1dc67fb822903288ef679344d",
diff --git a/deploy/gitops/g14/runtime-v02/deepseek-proxy.yaml b/deploy/gitops/g14/runtime-v02/deepseek-proxy.yaml
index e8fd44ca..f21147ca 100644
--- a/deploy/gitops/g14/runtime-v02/deepseek-proxy.yaml
+++ b/deploy/gitops/g14/runtime-v02/deepseek-proxy.yaml
@@ -14,7 +14,7 @@
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/gitops-target": "v02",
           "hwlab.pikastech.local/service-id": "hwlab-deepseek-proxy",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/monitoring": "enabled"
         }
       },
@@ -34,16 +34,16 @@
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/gitops-target": "v02",
           "hwlab.pikastech.local/service-id": "hwlab-deepseek-proxy",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/monitoring": "enabled"
         },
         "annotations": {
           "hwlab.pikastech.local/moonbridge-source-ref": "1b99888d3dae889b79ee602cb875c7907f7e76f2",
           "hwlab.pikastech.local/bridge-service-id": "hwlab-cloud-api",
-          "hwlab.pikastech.local/source-commit": "869746374be36a7aeac7443de8c72a377240ca2d",
-          "hwlab.pikastech.local/bridge-source-commit": "869746374be36a7aeac7443de8c72a377240ca2d",
-          "hwlab.pikastech.local/bridge-image-tag": "869746374be36a7aeac7443de8c72a377240ca2d",
-          "hwlab.pikastech.local/bridge-image": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:687276c4a7fbc7665cd473b4e937e99cee6eb133207c4ac43da76b373ba1c264",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
+          "hwlab.pikastech.local/bridge-source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
+          "hwlab.pikastech.local/bridge-image-tag": "40f798eb0b4a1379b8746b84373da03c56aa307c",
+          "hwlab.pikastech.local/bridge-image": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:84ff5a13997a9dabc8204fa30a0b514190a31b4b1a793033851247ec57b51b97",
           "hwlab.pikastech.local/metrics-sidecar-sha256": "95f5c8cb1419a94e8038509211100dbd1cc15c245655026df8c3027bf9f97a04"
         }
       },
@@ -62,16 +62,16 @@
               "hwlab.pikastech.local/environment": "v02",
               "hwlab.pikastech.local/gitops-target": "v02",
               "hwlab.pikastech.local/service-id": "hwlab-deepseek-proxy",
-              "hwlab.pikastech.local/source-commit": "869746374be36a7aeac7443de8c72a377240ca2d",
+              "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
               "hwlab.pikastech.local/monitoring": "enabled",
-              "hwlab.pikastech.local/bridge-source-commit": "869746374be36a7aeac7443de8c72a377240ca2d"
+              "hwlab.pikastech.local/bridge-source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
             },
             "annotations": {
               "hwlab.pikastech.local/bridge-service-id": "hwlab-cloud-api",
-              "hwlab.pikastech.local/source-commit": "869746374be36a7aeac7443de8c72a377240ca2d",
-              "hwlab.pikastech.local/bridge-source-commit": "869746374be36a7aeac7443de8c72a377240ca2d",
-              "hwlab.pikastech.local/bridge-image-tag": "869746374be36a7aeac7443de8c72a377240ca2d",
-              "hwlab.pikastech.local/bridge-image": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:687276c4a7fbc7665cd473b4e937e99cee6eb133207c4ac43da76b373ba1c264",
+              "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
+              "hwlab.pikastech.local/bridge-source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
+              "hwlab.pikastech.local/bridge-image-tag": "40f798eb0b4a1379b8746b84373da03c56aa307c",
+              "hwlab.pikastech.local/bridge-image": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:84ff5a13997a9dabc8204fa30a0b514190a31b4b1a793033851247ec57b51b97",
               "hwlab.pikastech.local/metrics-sidecar-sha256": "95f5c8cb1419a94e8038509211100dbd1cc15c245655026df8c3027bf9f97a04"
             }
           },
@@ -79,7 +79,7 @@
             "initContainers": [
               {
                 "name": "moonbridge-config",
-                "image": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:687276c4a7fbc7665cd473b4e937e99cee6eb133207c4ac43da76b373ba1c264",
+                "image": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:84ff5a13997a9dabc8204fa30a0b514190a31b4b1a793033851247ec57b51b97",
                 "imagePullPolicy": "IfNotPresent",
                 "command": [
                   "/bin/sh",
@@ -114,7 +114,7 @@
             "containers": [
               {
                 "name": "responses-bridge",
-                "image": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:687276c4a7fbc7665cd473b4e937e99cee6eb133207c4ac43da76b373ba1c264",
+                "image": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:84ff5a13997a9dabc8204fa30a0b514190a31b4b1a793033851247ec57b51b97",
                 "imagePullPolicy": "IfNotPresent",
                 "command": [
                   "/usr/local/bin/bun",
@@ -128,15 +128,15 @@
                   },
                   {
                     "name": "HWLAB_COMMIT_ID",
-                    "value": "869746374be36a7aeac7443de8c72a377240ca2d"
+                    "value": "40f798eb0b4a1379b8746b84373da03c56aa307c"
                   },
                   {
                     "name": "HWLAB_IMAGE",
-                    "value": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:687276c4a7fbc7665cd473b4e937e99cee6eb133207c4ac43da76b373ba1c264"
+                    "value": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:84ff5a13997a9dabc8204fa30a0b514190a31b4b1a793033851247ec57b51b97"
                   },
                   {
                     "name": "HWLAB_IMAGE_TAG",
-                    "value": "869746374be36a7aeac7443de8c72a377240ca2d"
+                    "value": "40f798eb0b4a1379b8746b84373da03c56aa307c"
                   },
                   {
                     "name": "HWLAB_DEEPSEEK_BRIDGE_UPSTREAM",
@@ -315,7 +315,7 @@
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/gitops-target": "v02",
           "hwlab.pikastech.local/service-id": "hwlab-deepseek-proxy",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/monitoring": "enabled"
         }
       },
diff --git a/deploy/gitops/g14/runtime-v02/g14-frpc.yaml b/deploy/gitops/g14/runtime-v02/g14-frpc.yaml
index f58898b3..34dbbf2b 100644
--- a/deploy/gitops/g14/runtime-v02/g14-frpc.yaml
+++ b/deploy/gitops/g14/runtime-v02/g14-frpc.yaml
@@ -14,7 +14,7 @@
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/gitops-target": "v02",
           "hwlab.pikastech.local/profile": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6"
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
         }
       },
       "data": {
@@ -33,7 +33,7 @@
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/gitops-target": "v02",
           "hwlab.pikastech.local/profile": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6"
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
         }
       },
       "spec": {
diff --git a/deploy/gitops/g14/runtime-v02/health-contract.yaml b/deploy/gitops/g14/runtime-v02/health-contract.yaml
index 8c88e63b..8fe5c1d4 100644
--- a/deploy/gitops/g14/runtime-v02/health-contract.yaml
+++ b/deploy/gitops/g14/runtime-v02/health-contract.yaml
@@ -8,7 +8,7 @@
       "app.kubernetes.io/name": "hwlab-v02-health-contract",
       "hwlab.pikastech.local/profile": "v02",
       "hwlab.pikastech.local/gitops-target": "v02",
-      "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+      "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
       "hwlab.pikastech.local/environment": "v02"
     },
     "annotations": {
diff --git a/deploy/gitops/g14/runtime-v02/kustomization.yaml b/deploy/gitops/g14/runtime-v02/kustomization.yaml
index ba817b1e..2dd9edbe 100644
--- a/deploy/gitops/g14/runtime-v02/kustomization.yaml
+++ b/deploy/gitops/g14/runtime-v02/kustomization.yaml
@@ -9,6 +9,7 @@
     "workloads.yaml",
     "deepseek-proxy.yaml",
     "postgres.yaml",
+    "openfga.yaml",
     "observability.yaml",
     "g14-frpc.yaml"
   ]
diff --git a/deploy/gitops/g14/runtime-v02/namespace.yaml b/deploy/gitops/g14/runtime-v02/namespace.yaml
index 113e4542..bb15d7b8 100644
--- a/deploy/gitops/g14/runtime-v02/namespace.yaml
+++ b/deploy/gitops/g14/runtime-v02/namespace.yaml
@@ -7,7 +7,7 @@
       "app.kubernetes.io/part-of": "hwlab",
       "hwlab.pikastech.local/profile": "v02",
       "hwlab.pikastech.local/gitops-target": "v02",
-      "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+      "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
       "hwlab.pikastech.local/environment": "v02"
     },
     "annotations": {
diff --git a/deploy/gitops/g14/runtime-v02/observability.yaml b/deploy/gitops/g14/runtime-v02/observability.yaml
index 979b71b9..34bfd412 100644
--- a/deploy/gitops/g14/runtime-v02/observability.yaml
+++ b/deploy/gitops/g14/runtime-v02/observability.yaml
@@ -10,7 +10,7 @@
         "namespace": "hwlab-v02",
         "labels": {
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "app.kubernetes.io/part-of": "hwlab",
@@ -32,7 +32,7 @@
         "namespace": "hwlab-v02",
         "labels": {
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "app.kubernetes.io/part-of": "hwlab",
@@ -78,7 +78,7 @@
         "namespace": "hwlab-v02",
         "labels": {
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "app.kubernetes.io/part-of": "hwlab",
@@ -124,7 +124,7 @@
         "namespace": "hwlab-v02",
         "labels": {
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "app.kubernetes.io/part-of": "hwlab",
@@ -170,7 +170,7 @@
         "namespace": "hwlab-v02",
         "labels": {
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "app.kubernetes.io/part-of": "hwlab",
@@ -216,7 +216,7 @@
         "namespace": "hwlab-v02",
         "labels": {
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "app.kubernetes.io/part-of": "hwlab",
@@ -262,7 +262,7 @@
         "namespace": "hwlab-v02",
         "labels": {
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "app.kubernetes.io/part-of": "hwlab",
@@ -308,7 +308,7 @@
         "namespace": "hwlab-v02",
         "labels": {
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "app.kubernetes.io/part-of": "hwlab",
diff --git a/deploy/gitops/g14/runtime-v02/openfga.yaml b/deploy/gitops/g14/runtime-v02/openfga.yaml
new file mode 100644
index 00000000..9d12bc2d
--- /dev/null
+++ b/deploy/gitops/g14/runtime-v02/openfga.yaml
@@ -0,0 +1,275 @@
+{
+  "apiVersion": "v1",
+  "kind": "List",
+  "items": [
+    {
+      "apiVersion": "batch/v1",
+      "kind": "Job",
+      "metadata": {
+        "name": "hwlab-openfga-migrate",
+        "namespace": "hwlab-v02",
+        "labels": {
+          "app.kubernetes.io/name": "hwlab-openfga",
+          "app.kubernetes.io/part-of": "hwlab",
+          "hwlab.pikastech.local/component": "authorization",
+          "hwlab.pikastech.local/environment": "v02",
+          "hwlab.pikastech.local/gitops-target": "v02",
+          "hwlab.pikastech.local/profile": "v02",
+          "hwlab.pikastech.local/service-id": "hwlab-openfga",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
+        },
+        "annotations": {
+          "hwlab.pikastech.local/rendered-by": "scripts/g14-gitops-render.mjs",
+          "argocd.argoproj.io/hook": "PreSync",
+          "argocd.argoproj.io/hook-delete-policy": "BeforeHookCreation,HookSucceeded"
+        }
+      },
+      "spec": {
+        "backoffLimit": 3,
+        "template": {
+          "metadata": {
+            "labels": {
+              "app.kubernetes.io/name": "hwlab-openfga",
+              "app.kubernetes.io/part-of": "hwlab",
+              "hwlab.pikastech.local/component": "authorization",
+              "hwlab.pikastech.local/environment": "v02",
+              "hwlab.pikastech.local/gitops-target": "v02",
+              "hwlab.pikastech.local/profile": "v02",
+              "hwlab.pikastech.local/service-id": "hwlab-openfga",
+              "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
+            },
+            "annotations": {
+              "hwlab.pikastech.local/rendered-by": "scripts/g14-gitops-render.mjs"
+            }
+          },
+          "spec": {
+            "restartPolicy": "OnFailure",
+            "containers": [
+              {
+                "name": "openfga-migrate",
+                "image": "127.0.0.1:5000/hwlab/openfga:v1.17.0",
+                "imagePullPolicy": "IfNotPresent",
+                "args": [
+                  "migrate"
+                ],
+                "env": [
+                  {
+                    "name": "OPENFGA_DATASTORE_ENGINE",
+                    "value": "postgres"
+                  },
+                  {
+                    "name": "OPENFGA_DATASTORE_URI",
+                    "valueFrom": {
+                      "secretKeyRef": {
+                        "name": "hwlab-v02-openfga",
+                        "key": "datastore-uri"
+                      }
+                    }
+                  },
+                  {
+                    "name": "OPENFGA_AUTHN_METHOD",
+                    "value": "preshared"
+                  },
+                  {
+                    "name": "OPENFGA_AUTHN_PRESHARED_KEYS",
+                    "valueFrom": {
+                      "secretKeyRef": {
+                        "name": "hwlab-v02-openfga",
+                        "key": "authn-preshared-key"
+                      }
+                    }
+                  },
+                  {
+                    "name": "OPENFGA_PLAYGROUND_ENABLED",
+                    "value": "false"
+                  },
+                  {
+                    "name": "OPENFGA_HTTP_ADDR",
+                    "value": "0.0.0.0:8080"
+                  },
+                  {
+                    "name": "OPENFGA_GRPC_ADDR",
+                    "value": "0.0.0.0:8081"
+                  }
+                ]
+              }
+            ]
+          }
+        }
+      }
+    },
+    {
+      "apiVersion": "apps/v1",
+      "kind": "Deployment",
+      "metadata": {
+        "name": "hwlab-openfga",
+        "namespace": "hwlab-v02",
+        "labels": {
+          "app.kubernetes.io/name": "hwlab-openfga",
+          "app.kubernetes.io/part-of": "hwlab",
+          "hwlab.pikastech.local/component": "authorization",
+          "hwlab.pikastech.local/environment": "v02",
+          "hwlab.pikastech.local/gitops-target": "v02",
+          "hwlab.pikastech.local/profile": "v02",
+          "hwlab.pikastech.local/service-id": "hwlab-openfga",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
+        },
+        "annotations": {
+          "hwlab.pikastech.local/rendered-by": "scripts/g14-gitops-render.mjs"
+        }
+      },
+      "spec": {
+        "replicas": 1,
+        "selector": {
+          "matchLabels": {
+            "app.kubernetes.io/name": "hwlab-openfga"
+          }
+        },
+        "template": {
+          "metadata": {
+            "labels": {
+              "app.kubernetes.io/name": "hwlab-openfga",
+              "app.kubernetes.io/part-of": "hwlab",
+              "hwlab.pikastech.local/component": "authorization",
+              "hwlab.pikastech.local/environment": "v02",
+              "hwlab.pikastech.local/gitops-target": "v02",
+              "hwlab.pikastech.local/profile": "v02",
+              "hwlab.pikastech.local/service-id": "hwlab-openfga",
+              "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
+            },
+            "annotations": {
+              "hwlab.pikastech.local/rendered-by": "scripts/g14-gitops-render.mjs"
+            }
+          },
+          "spec": {
+            "containers": [
+              {
+                "name": "openfga",
+                "image": "127.0.0.1:5000/hwlab/openfga:v1.17.0",
+                "imagePullPolicy": "IfNotPresent",
+                "args": [
+                  "run"
+                ],
+                "env": [
+                  {
+                    "name": "OPENFGA_DATASTORE_ENGINE",
+                    "value": "postgres"
+                  },
+                  {
+                    "name": "OPENFGA_DATASTORE_URI",
+                    "valueFrom": {
+                      "secretKeyRef": {
+                        "name": "hwlab-v02-openfga",
+                        "key": "datastore-uri"
+                      }
+                    }
+                  },
+                  {
+                    "name": "OPENFGA_AUTHN_METHOD",
+                    "value": "preshared"
+                  },
+                  {
+                    "name": "OPENFGA_AUTHN_PRESHARED_KEYS",
+                    "valueFrom": {
+                      "secretKeyRef": {
+                        "name": "hwlab-v02-openfga",
+                        "key": "authn-preshared-key"
+                      }
+                    }
+                  },
+                  {
+                    "name": "OPENFGA_PLAYGROUND_ENABLED",
+                    "value": "false"
+                  },
+                  {
+                    "name": "OPENFGA_HTTP_ADDR",
+                    "value": "0.0.0.0:8080"
+                  },
+                  {
+                    "name": "OPENFGA_GRPC_ADDR",
+                    "value": "0.0.0.0:8081"
+                  }
+                ],
+                "ports": [
+                  {
+                    "name": "http",
+                    "containerPort": 8080
+                  },
+                  {
+                    "name": "grpc",
+                    "containerPort": 8081
+                  }
+                ],
+                "readinessProbe": {
+                  "httpGet": {
+                    "path": "/healthz",
+                    "port": "http"
+                  },
+                  "initialDelaySeconds": 3,
+                  "periodSeconds": 10
+                },
+                "livenessProbe": {
+                  "httpGet": {
+                    "path": "/healthz",
+                    "port": "http"
+                  },
+                  "initialDelaySeconds": 15,
+                  "periodSeconds": 20
+                },
+                "resources": {
+                  "requests": {
+                    "cpu": "50m",
+                    "memory": "128Mi"
+                  },
+                  "limits": {
+                    "cpu": "500m",
+                    "memory": "512Mi"
+                  }
+                }
+              }
+            ]
+          }
+        }
+      }
+    },
+    {
+      "apiVersion": "v1",
+      "kind": "Service",
+      "metadata": {
+        "name": "hwlab-openfga",
+        "namespace": "hwlab-v02",
+        "labels": {
+          "app.kubernetes.io/name": "hwlab-openfga",
+          "app.kubernetes.io/part-of": "hwlab",
+          "hwlab.pikastech.local/component": "authorization",
+          "hwlab.pikastech.local/environment": "v02",
+          "hwlab.pikastech.local/gitops-target": "v02",
+          "hwlab.pikastech.local/profile": "v02",
+          "hwlab.pikastech.local/service-id": "hwlab-openfga",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
+        },
+        "annotations": {
+          "hwlab.pikastech.local/rendered-by": "scripts/g14-gitops-render.mjs"
+        }
+      },
+      "spec": {
+        "type": "ClusterIP",
+        "selector": {
+          "app.kubernetes.io/name": "hwlab-openfga"
+        },
+        "ports": [
+          {
+            "name": "http",
+            "port": 8080,
+            "targetPort": "http"
+          },
+          {
+            "name": "grpc",
+            "port": 8081,
+            "targetPort": "grpc"
+          }
+        ]
+      }
+    }
+  ]
+}
diff --git a/deploy/gitops/g14/runtime-v02/postgres.yaml b/deploy/gitops/g14/runtime-v02/postgres.yaml
index b9d0757a..3dc6ae85 100644
--- a/deploy/gitops/g14/runtime-v02/postgres.yaml
+++ b/deploy/gitops/g14/runtime-v02/postgres.yaml
@@ -14,7 +14,7 @@
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/gitops-target": "v02",
           "hwlab.pikastech.local/profile": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6"
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
         }
       },
       "data": {
@@ -33,7 +33,7 @@
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/gitops-target": "v02",
           "hwlab.pikastech.local/profile": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6"
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
         }
       },
       "spec": {
@@ -62,7 +62,7 @@
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/gitops-target": "v02",
           "hwlab.pikastech.local/profile": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6"
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
         }
       },
       "spec": {
diff --git a/deploy/gitops/g14/runtime-v02/services.yaml b/deploy/gitops/g14/runtime-v02/services.yaml
index 775f0d3b..e47aad6c 100644
--- a/deploy/gitops/g14/runtime-v02/services.yaml
+++ b/deploy/gitops/g14/runtime-v02/services.yaml
@@ -12,7 +12,7 @@
           "app.kubernetes.io/name": "hwlab-cloud-api",
           "hwlab.pikastech.local/service-id": "hwlab-cloud-api",
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "hwlab.pikastech.local/monitoring": "enabled"
@@ -50,7 +50,7 @@
           "app.kubernetes.io/name": "hwlab-cloud-web",
           "hwlab.pikastech.local/service-id": "hwlab-cloud-web",
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "hwlab.pikastech.local/monitoring": "enabled"
@@ -89,7 +89,7 @@
           "hwlab.pikastech.local/service-id": "hwlab-gateway",
           "hwlab.pikastech.local/activation": "manual",
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02"
         },
@@ -121,7 +121,7 @@
           "app.kubernetes.io/name": "hwlab-agent-skills",
           "hwlab.pikastech.local/service-id": "hwlab-agent-skills",
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "hwlab.pikastech.local/monitoring": "enabled"
@@ -159,7 +159,7 @@
           "app.kubernetes.io/name": "hwlab-device-pod",
           "hwlab.pikastech.local/service-id": "hwlab-device-pod",
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "hwlab.pikastech.local/monitoring": "enabled"
@@ -197,7 +197,7 @@
           "app.kubernetes.io/name": "hwlab-edge-proxy",
           "hwlab.pikastech.local/service-id": "hwlab-edge-proxy",
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "hwlab.pikastech.local/monitoring": "enabled"
diff --git a/deploy/gitops/g14/runtime-v02/workloads.yaml b/deploy/gitops/g14/runtime-v02/workloads.yaml
index d8f0dd95..3a3bbcba 100644
--- a/deploy/gitops/g14/runtime-v02/workloads.yaml
+++ b/deploy/gitops/g14/runtime-v02/workloads.yaml
@@ -13,14 +13,14 @@
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "unidesk.ai/g14-staging": "false"
         },
         "name": "hwlab-user-skills",
         "namespace": "hwlab-v02",
         "annotations": {
           "hwlab.pikastech.local/gitops-note": "HWLAB v0.2 GitOps target.",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6"
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
         }
       },
       "spec": {
@@ -47,13 +47,13 @@
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "unidesk.ai/g14-staging": "false",
           "hwlab.pikastech.local/monitoring": "enabled"
         },
         "annotations": {
           "hwlab.pikastech.local/gitops-note": "HWLAB v0.2 GitOps target.",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6"
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
         }
       },
       "spec": {
@@ -78,14 +78,14 @@
               "hwlab.pikastech.local/environment": "v02",
               "hwlab.pikastech.local/profile": "v02",
               "hwlab.pikastech.local/gitops-target": "v02",
-              "hwlab.pikastech.local/source-commit": "869746374be36a7aeac7443de8c72a377240ca2d",
-              "hwlab.pikastech.local/artifact-source-commit": "869746374be36a7aeac7443de8c72a377240ca2d",
+              "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
+              "hwlab.pikastech.local/artifact-source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
               "hwlab.pikastech.local/monitoring": "enabled"
             },
             "annotations": {
               "hwlab.pikastech.local/metrics-sidecar-sha256": "95f5c8cb1419a94e8038509211100dbd1cc15c245655026df8c3027bf9f97a04",
-              "hwlab.pikastech.local/source-commit": "869746374be36a7aeac7443de8c72a377240ca2d",
-              "hwlab.pikastech.local/artifact-source-commit": "869746374be36a7aeac7443de8c72a377240ca2d",
+              "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
+              "hwlab.pikastech.local/artifact-source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
               "hwlab.pikastech.local/rendered-by": "scripts/g14-gitops-render.mjs"
             }
           },
@@ -94,7 +94,7 @@
             "containers": [
               {
                 "name": "hwlab-cloud-api",
-                "image": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:687276c4a7fbc7665cd473b4e937e99cee6eb133207c4ac43da76b373ba1c264",
+                "image": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:84ff5a13997a9dabc8204fa30a0b514190a31b4b1a793033851247ec57b51b97",
                 "ports": [
                   {
                     "name": "http",
@@ -116,15 +116,15 @@
                   },
                   {
                     "name": "HWLAB_COMMIT_ID",
-                    "value": "869746374be36a7aeac7443de8c72a377240ca2d"
+                    "value": "40f798eb0b4a1379b8746b84373da03c56aa307c"
                   },
                   {
                     "name": "HWLAB_IMAGE",
-                    "value": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:687276c4a7fbc7665cd473b4e937e99cee6eb133207c4ac43da76b373ba1c264"
+                    "value": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:84ff5a13997a9dabc8204fa30a0b514190a31b4b1a793033851247ec57b51b97"
                   },
                   {
                     "name": "HWLAB_IMAGE_TAG",
-                    "value": "869746374be36a7aeac7443de8c72a377240ca2d"
+                    "value": "40f798eb0b4a1379b8746b84373da03c56aa307c"
                   },
                   {
                     "name": "HWLAB_RUNTIME_SUBSTITUTE_FORBIDDEN",
@@ -314,11 +314,29 @@
                   },
                   {
                     "name": "HWLAB_GITOPS_SOURCE_COMMIT",
-                    "value": "869746374be36a7aeac7443de8c72a377240ca2d"
+                    "value": "40f798eb0b4a1379b8746b84373da03c56aa307c"
                   },
                   {
                     "name": "HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT",
-                    "value": "554269ef997aaa7df64053072f8bfc732febecd6"
+                    "value": "40f798eb0b4a1379b8746b84373da03c56aa307c"
+                  },
+                  {
+                    "name": "HWLAB_OPENFGA_MODE",
+                    "value": "shadow"
+                  },
+                  {
+                    "name": "HWLAB_OPENFGA_API_URL",
+                    "value": "http://hwlab-openfga.hwlab-v02.svc.cluster.local:8080"
+                  },
+                  {
+                    "name": "HWLAB_OPENFGA_AUTHN_TOKEN",
+                    "valueFrom": {
+                      "secretKeyRef": {
+                        "name": "hwlab-v02-openfga",
+                        "key": "authn-preshared-key",
+                        "optional": true
+                      }
+                    }
                   },
                   {
                     "name": "UNIDESK_MAIN_SERVER_IP",
@@ -347,7 +365,7 @@
               },
               {
                 "name": "hwlab-codex-api-forwarder",
-                "image": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:687276c4a7fbc7665cd473b4e937e99cee6eb133207c4ac43da76b373ba1c264",
+                "image": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:84ff5a13997a9dabc8204fa30a0b514190a31b4b1a793033851247ec57b51b97",
                 "command": [
                   "/usr/local/bin/bun",
                   "run",
@@ -556,15 +574,15 @@
                   },
                   {
                     "name": "HWLAB_COMMIT_ID",
-                    "value": "869746374be36a7aeac7443de8c72a377240ca2d"
+                    "value": "40f798eb0b4a1379b8746b84373da03c56aa307c"
                   },
                   {
                     "name": "HWLAB_IMAGE",
-                    "value": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:687276c4a7fbc7665cd473b4e937e99cee6eb133207c4ac43da76b373ba1c264"
+                    "value": "127.0.0.1:5000/hwlab/hwlab-cloud-api@sha256:84ff5a13997a9dabc8204fa30a0b514190a31b4b1a793033851247ec57b51b97"
                   },
                   {
                     "name": "HWLAB_IMAGE_TAG",
-                    "value": "869746374be36a7aeac7443de8c72a377240ca2d"
+                    "value": "40f798eb0b4a1379b8746b84373da03c56aa307c"
                   },
                   {
                     "name": "HWLAB_GITOPS_TARGET",
@@ -576,11 +594,29 @@
                   },
                   {
                     "name": "HWLAB_GITOPS_SOURCE_COMMIT",
-                    "value": "869746374be36a7aeac7443de8c72a377240ca2d"
+                    "value": "40f798eb0b4a1379b8746b84373da03c56aa307c"
                   },
                   {
                     "name": "HWLAB_CODE_AGENT_AGENTRUN_SOURCE_COMMIT",
-                    "value": "554269ef997aaa7df64053072f8bfc732febecd6"
+                    "value": "40f798eb0b4a1379b8746b84373da03c56aa307c"
+                  },
+                  {
+                    "name": "HWLAB_OPENFGA_MODE",
+                    "value": "shadow"
+                  },
+                  {
+                    "name": "HWLAB_OPENFGA_API_URL",
+                    "value": "http://hwlab-openfga.hwlab-v02.svc.cluster.local:8080"
+                  },
+                  {
+                    "name": "HWLAB_OPENFGA_AUTHN_TOKEN",
+                    "valueFrom": {
+                      "secretKeyRef": {
+                        "name": "hwlab-v02-openfga",
+                        "key": "authn-preshared-key",
+                        "optional": true
+                      }
+                    }
                   },
                   {
                     "name": "UNIDESK_MAIN_SERVER_IP",
@@ -706,13 +742,13 @@
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "unidesk.ai/g14-staging": "false",
           "hwlab.pikastech.local/monitoring": "enabled"
         },
         "annotations": {
           "hwlab.pikastech.local/gitops-note": "HWLAB v0.2 GitOps target.",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6"
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
         }
       },
       "spec": {
@@ -734,24 +770,24 @@
               "hwlab.pikastech.local/environment": "v02",
               "hwlab.pikastech.local/profile": "v02",
               "hwlab.pikastech.local/gitops-target": "v02",
-              "hwlab.pikastech.local/source-commit": "4baea168af28f090c8cf73f8a46620a5773ffd42",
-              "hwlab.pikastech.local/artifact-source-commit": "4baea168af28f090c8cf73f8a46620a5773ffd42",
+              "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
+              "hwlab.pikastech.local/artifact-source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
               "hwlab.pikastech.local/monitoring": "enabled",
               "hwlab.pikastech.local/runtime-mode": "env-reuse-git-mirror-checkout",
-              "hwlab.pikastech.local/boot-commit": "4baea168af28f090c8cf73f8a46620a5773ffd42"
+              "hwlab.pikastech.local/boot-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
             },
             "annotations": {
               "hwlab.pikastech.local/metrics-sidecar-sha256": "95f5c8cb1419a94e8038509211100dbd1cc15c245655026df8c3027bf9f97a04",
-              "hwlab.pikastech.local/source-commit": "4baea168af28f090c8cf73f8a46620a5773ffd42",
-              "hwlab.pikastech.local/artifact-source-commit": "4baea168af28f090c8cf73f8a46620a5773ffd42",
+              "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
+              "hwlab.pikastech.local/artifact-source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
               "hwlab.pikastech.local/rendered-by": "scripts/g14-gitops-render.mjs",
               "hwlab.pikastech.local/runtime-mode": "env-reuse-git-mirror-checkout",
               "hwlab.pikastech.local/boot-repo": "git@github.com:pikasTech/HWLAB.git",
-              "hwlab.pikastech.local/boot-commit": "4baea168af28f090c8cf73f8a46620a5773ffd42",
+              "hwlab.pikastech.local/boot-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
               "hwlab.pikastech.local/boot-sh": "deploy/runtime/boot/hwlab-cloud-web.sh",
               "hwlab.pikastech.local/environment-digest": "sha256:97e28c1203dbcca130b3d9369e7e4a4eb740b0af5a5f8b06bd7e904e23ee8808",
               "hwlab.pikastech.local/environment-input-hash": "18c6c806d7494d1895e2adffd3930032fa57a8313a8ca5f6fba358acc613022e",
-              "hwlab.pikastech.local/code-input-hash": "653f25bd417520db88237d6a49d45dce4d6ae6364475704705b7586395bfc82e"
+              "hwlab.pikastech.local/code-input-hash": "a6ca4236657f0c4d3b250a5ebb6ae6208c4e93affaa53a4765fec92cd10e7938"
             }
           },
           "spec": {
@@ -776,7 +812,7 @@
                   },
                   {
                     "name": "HWLAB_COMMIT_ID",
-                    "value": "4baea168af28f090c8cf73f8a46620a5773ffd42"
+                    "value": "40f798eb0b4a1379b8746b84373da03c56aa307c"
                   },
                   {
                     "name": "HWLAB_IMAGE",
@@ -800,7 +836,7 @@
                   },
                   {
                     "name": "HWLAB_GITOPS_SOURCE_COMMIT",
-                    "value": "4baea168af28f090c8cf73f8a46620a5773ffd42"
+                    "value": "40f798eb0b4a1379b8746b84373da03c56aa307c"
                   },
                   {
                     "name": "HWLAB_RUNTIME_MODE",
@@ -812,7 +848,7 @@
                   },
                   {
                     "name": "HWLAB_BOOT_COMMIT",
-                    "value": "4baea168af28f090c8cf73f8a46620a5773ffd42"
+                    "value": "40f798eb0b4a1379b8746b84373da03c56aa307c"
                   },
                   {
                     "name": "HWLAB_BOOT_REF",
@@ -840,7 +876,7 @@
                   },
                   {
                     "name": "HWLAB_CODE_INPUT_HASH",
-                    "value": "653f25bd417520db88237d6a49d45dce4d6ae6364475704705b7586395bfc82e"
+                    "value": "a6ca4236657f0c4d3b250a5ebb6ae6208c4e93affaa53a4765fec92cd10e7938"
                   },
                   {
                     "name": "HWLAB_IMAGE_DIGEST",
@@ -955,13 +991,13 @@
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "unidesk.ai/g14-staging": "false",
           "hwlab.pikastech.local/monitoring": "enabled"
         },
         "annotations": {
           "hwlab.pikastech.local/gitops-note": "HWLAB v0.2 GitOps target.",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6"
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
         }
       },
       "spec": {
@@ -1215,12 +1251,12 @@
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "unidesk.ai/g14-staging": "false"
         },
         "annotations": {
           "hwlab.pikastech.local/gitops-note": "HWLAB v0.2 GitOps target.",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6"
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
         }
       },
       "spec": {
@@ -1328,13 +1364,13 @@
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "unidesk.ai/g14-staging": "false",
           "hwlab.pikastech.local/monitoring": "enabled"
         },
         "annotations": {
           "hwlab.pikastech.local/gitops-note": "HWLAB v0.2 GitOps target.",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6"
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
         }
       },
       "spec": {
@@ -1528,13 +1564,13 @@
           "hwlab.pikastech.local/environment": "v02",
           "hwlab.pikastech.local/profile": "v02",
           "hwlab.pikastech.local/gitops-target": "v02",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6",
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c",
           "unidesk.ai/g14-staging": "false",
           "hwlab.pikastech.local/monitoring": "enabled"
         },
         "annotations": {
           "hwlab.pikastech.local/gitops-note": "HWLAB v0.2 GitOps target.",
-          "hwlab.pikastech.local/source-commit": "554269ef997aaa7df64053072f8bfc732febecd6"
+          "hwlab.pikastech.local/source-commit": "40f798eb0b4a1379b8746b84373da03c56aa307c"
         }
       },
       "spec": {