diff --git a/cmd/api/enterprise.go b/cmd/api/enterprise.go
index e688b3b..06e3aad 100644
--- a/cmd/api/enterprise.go
+++ b/cmd/api/enterprise.go
@@ -369,6 +369,16 @@ var defaultRoles = map[string]Role{
 			{Resource: "agents", Verbs: []string{"read"}},
 			{Resource: "health", Verbs: []string{"read"}},
 			{Resource: "routes", Verbs: []string{"read"}},
+			{Resource: "skills", Verbs: []string{"read"}},
+			{Resource: "tools", Verbs: []string{"read"}},
+			{Resource: "catalog", Verbs: []string{"read"}},
+			{Resource: "models", Verbs: []string{"read"}},
+			{Resource: "connectors", Verbs: []string{"read"}},
+			{Resource: "rules", Verbs: []string{"read"}},
+			{Resource: "memory", Verbs: []string{"read"}},
+			{Resource: "stats", Verbs: []string{"read"}},
+			{Resource: "eval", Verbs: []string{"read"}},
+			{Resource: "costs", Verbs: []string{"read"}},
 		},
 	},
 }
diff --git a/cmd/api/main.go b/cmd/api/main.go
index e324261..6f7450b 100644
--- a/cmd/api/main.go
+++ b/cmd/api/main.go
@@ -3,6 +3,8 @@ package main
 import (
 	"encoding/json"
 	"fmt"
+	"io"
+	"log"
 	"net"
 	"net/http"
 	"net/http/httputil"
@@ -1538,6 +1540,18 @@ func main() {
 
 	enterprise.RegisterRoutes(httpSrv)
 
+	httpSrv.HandleFunc("/api/v1/webhooks/alerts/", func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			w.WriteHeader(http.StatusMethodNotAllowed)
+			return
+		}
+		severity := strings.TrimPrefix(r.URL.Path, "/api/v1/webhooks/alerts/")
+		body, _ := io.ReadAll(r.Body)
+		log.Printf("alert webhook received: severity=%s payload=%s", severity, string(body))
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprintf(w, `{"status":"accepted","severity":%q}`, severity)
+	})
+
 	httpSrv.HandleFunc("/api/v1/health", enterprise.AuthMiddleware(cors(healthHandler)))
 	httpSrv.HandleFunc("/api/v1/routes", enterprise.AuthMiddleware(cors(routesHandler)))
 	httpSrv.HandleFunc("/api/v1/chat", enterprise.AuthMiddleware(chatHandler))
diff --git a/cmd/mesh/handlers.go b/cmd/mesh/handlers.go
index ba80d7d..e1c72bc 100644
--- a/cmd/mesh/handlers.go
+++ b/cmd/mesh/handlers.go
@@ -171,6 +171,17 @@ func (s *Server) provisionAgentNamespace(agent *MeshAgent) {
 		s.provisionDeepAgentPod(ns, agent)
 	}
 
+	baseDomain := os.Getenv("ARCANA_BASE_DOMAIN")
+	if baseDomain == "" {
+		baseDomain = "arcana.localhost.me"
+	}
+	agentHost := agent.Name + "." + baseDomain
+	if err := s.k8s.CreateIngress(ns, "agent-ingress", agentHost, "deep-agent", 5002); err != nil {
+		log.Printf("failed to create ingress in %s: %v", ns, err)
+	} else {
+		log.Printf("ingress created: %s → deep-agent:5002 in %s", agentHost, ns)
+	}
+
 	log.Printf("agent %s fully provisioned in namespace %s", agent.Name, ns)
 }
 
diff --git a/cmd/mesh/k8s.go b/cmd/mesh/k8s.go
index fb71393..b2d7d28 100644
--- a/cmd/mesh/k8s.go
+++ b/cmd/mesh/k8s.go
@@ -164,6 +164,18 @@ func (k *K8sClient) CreateNetworkPolicy(namespace, name string) error {
 						}},
 					},
 				},
+				{
+					"from": []map[string]interface{}{
+						{"namespaceSelector": map[string]interface{}{
+							"matchLabels": map[string]string{
+								"app.kubernetes.io/name": "ingress-nginx",
+							},
+						}},
+					},
+					"ports": []map[string]interface{}{
+						{"protocol": "TCP", "port": 5002},
+					},
+				},
 			},
 			"egress": []map[string]interface{}{
 				{
@@ -184,6 +196,11 @@ func (k *K8sClient) CreateNetworkPolicy(namespace, name string) error {
 						{"protocol": "UDP", "port": 53},
 					},
 				},
+				{
+					"ports": []map[string]interface{}{
+						{"protocol": "TCP", "port": 443},
+					},
+				},
 			},
 		},
 	}
@@ -314,6 +331,59 @@ func (k *K8sClient) CreateService(namespace, name string, port int, targetPort i
 	return nil
 }
 
+func (k *K8sClient) CreateIngress(namespace, name, host, serviceName string, servicePort int) error {
+	ing := map[string]interface{}{
+		"apiVersion": "networking.k8s.io/v1",
+		"kind":       "Ingress",
+		"metadata": map[string]interface{}{
+			"name":      name,
+			"namespace": namespace,
+			"annotations": map[string]string{
+				"nginx.ingress.kubernetes.io/proxy-read-timeout": "3600",
+				"nginx.ingress.kubernetes.io/proxy-send-timeout": "3600",
+				"nginx.ingress.kubernetes.io/proxy-buffering":    "off",
+				"nginx.ingress.kubernetes.io/ssl-redirect":       "false",
+			},
+		},
+		"spec": map[string]interface{}{
+			"ingressClassName": "nginx",
+			"rules": []map[string]interface{}{
+				{
+					"host": host,
+					"http": map[string]interface{}{
+						"paths": []map[string]interface{}{
+							{
+								"path":     "/",
+								"pathType": "Prefix",
+								"backend": map[string]interface{}{
+									"service": map[string]interface{}{
+										"name": serviceName,
+										"port": map[string]interface{}{
+											"number": servicePort,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	_, code, err := k.do("POST",
+		fmt.Sprintf("/apis/networking.k8s.io/v1/namespaces/%s/ingresses", namespace), ing)
+	if err != nil {
+		return err
+	}
+	if code == 409 {
+		return nil
+	}
+	if code >= 300 {
+		return fmt.Errorf("create ingress: HTTP %d", code)
+	}
+	return nil
+}
+
 func (k *K8sClient) GetDeploymentStatus(namespace, name string) (map[string]interface{}, error) {
 	body, code, err := k.do("GET",
 		fmt.Sprintf("/apis/apps/v1/namespaces/%s/deployments/%s", namespace, name), nil)
diff --git a/cmd/operator/main.go b/cmd/operator/main.go
index 41ca6b7..4b79b58 100644
--- a/cmd/operator/main.go
+++ b/cmd/operator/main.go
@@ -17,7 +17,7 @@ import (
 )
 
 var agentGVR = schema.GroupVersionResource{
-	Group:    "arcana.ai",
+	Group:    "arcana.io",
 	Version:  "v1alpha1",
 	Resource: "arcanaagents",
 }
@@ -81,7 +81,7 @@ func reconcile(client dynamic.Interface) {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
-	agents, err := client.Resource(agentGVR).Namespace("arcana").List(ctx, metav1.ListOptions{})
+	agents, err := client.Resource(agentGVR).List(ctx, metav1.ListOptions{})
 	if err != nil {
 		log.Printf("operator: list agents failed: %v", err)
 		status.Errors = append(status.Errors, fmt.Sprintf("%s: %v", time.Now().Format(time.RFC3339), err))
diff --git a/deploy/backing/ingress.yaml b/deploy/backing/ingress.yaml
index 6c0b495..8b3b4d1 100644
--- a/deploy/backing/ingress.yaml
+++ b/deploy/backing/ingress.yaml
@@ -29,13 +29,6 @@ spec:
                 name: arcana-api
                 port:
                   number: 8080
-          - path: /agents/
-            pathType: Prefix
-            backend:
-              service:
-                name: arcana-api
-                port:
-                  number: 8080
           - path: /events
             pathType: Prefix
             backend:
diff --git a/deploy/helm/arcana-agui/values.yaml b/deploy/helm/arcana-agui/values.yaml
index a73fdd0..58f9cfc 100644
--- a/deploy/helm/arcana-agui/values.yaml
+++ b/deploy/helm/arcana-agui/values.yaml
@@ -19,7 +19,7 @@ service:
 
 env:
   PORT: "8084"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 probes:
   liveness: "/healthz"
diff --git a/deploy/helm/arcana-annotate/values.yaml b/deploy/helm/arcana-annotate/values.yaml
index 62bce6e..bc3b637 100644
--- a/deploy/helm/arcana-annotate/values.yaml
+++ b/deploy/helm/arcana-annotate/values.yaml
@@ -19,7 +19,7 @@ service:
 
 env:
   PORT: "8102"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 probes:
   liveness: "/healthz"
diff --git a/deploy/helm/arcana-api/values.yaml b/deploy/helm/arcana-api/values.yaml
index e0adcff..6af9977 100644
--- a/deploy/helm/arcana-api/values.yaml
+++ b/deploy/helm/arcana-api/values.yaml
@@ -46,7 +46,7 @@ env:
   REGISTRY_HOST: "arcana-registry.arcana.svc.cluster.local"
   FINOPS_HOST: "arcana-finops.arcana.svc.cluster.local"
   GITOPS_HOST: "arcana-gitops.arcana.svc.cluster.local"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 envFromSecrets:
   - arcana-platform-secret
diff --git a/deploy/helm/arcana-audit/values.yaml b/deploy/helm/arcana-audit/values.yaml
index e91995f..4b39341 100644
--- a/deploy/helm/arcana-audit/values.yaml
+++ b/deploy/helm/arcana-audit/values.yaml
@@ -21,7 +21,7 @@ env:
   PORT: "8100"
   POSTGRES_HOST: "postgres.arcana.svc.cluster.local"
   POSTGRES_PORT: "5432"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 envFromSecrets:
   - arcana-platform-secret
diff --git a/deploy/helm/arcana-blueprint/values.yaml b/deploy/helm/arcana-blueprint/values.yaml
index 8fdbde2..45f1700 100644
--- a/deploy/helm/arcana-blueprint/values.yaml
+++ b/deploy/helm/arcana-blueprint/values.yaml
@@ -21,7 +21,7 @@ env:
   PORT: "8088"
   POSTGRES_HOST: "postgres.arcana.svc.cluster.local"
   POSTGRES_PORT: "5432"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 envFromSecrets:
   - arcana-platform-secret
diff --git a/deploy/helm/arcana-codex-ingestor/values.yaml b/deploy/helm/arcana-codex-ingestor/values.yaml
index dd10d14..20a1566 100644
--- a/deploy/helm/arcana-codex-ingestor/values.yaml
+++ b/deploy/helm/arcana-codex-ingestor/values.yaml
@@ -19,7 +19,7 @@ service:
 
 env:
   PORT: "8092"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 probes:
   liveness: "/healthz"
diff --git a/deploy/helm/arcana-codex-router/values.yaml b/deploy/helm/arcana-codex-router/values.yaml
index 3d0cc76..d2f7e5b 100644
--- a/deploy/helm/arcana-codex-router/values.yaml
+++ b/deploy/helm/arcana-codex-router/values.yaml
@@ -19,7 +19,7 @@ service:
 
 env:
   PORT: "8090"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 probes:
   liveness: "/healthz"
diff --git a/deploy/helm/arcana-codex-scorer/values.yaml b/deploy/helm/arcana-codex-scorer/values.yaml
index 80c4eaf..06d1dca 100644
--- a/deploy/helm/arcana-codex-scorer/values.yaml
+++ b/deploy/helm/arcana-codex-scorer/values.yaml
@@ -19,7 +19,7 @@ service:
 
 env:
   PORT: "8093"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 probes:
   liveness: "/healthz"
diff --git a/deploy/helm/arcana-codex-searcher/values.yaml b/deploy/helm/arcana-codex-searcher/values.yaml
index 65d44aa..34d5389 100644
--- a/deploy/helm/arcana-codex-searcher/values.yaml
+++ b/deploy/helm/arcana-codex-searcher/values.yaml
@@ -19,7 +19,7 @@ service:
 
 env:
   PORT: "8091"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 probes:
   liveness: "/healthz"
diff --git a/deploy/helm/arcana-connectors/values.yaml b/deploy/helm/arcana-connectors/values.yaml
index 313b0ea..496d645 100644
--- a/deploy/helm/arcana-connectors/values.yaml
+++ b/deploy/helm/arcana-connectors/values.yaml
@@ -19,7 +19,7 @@ service:
 
 env:
   PORT: "8094"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 probes:
   liveness: "/healthz"
diff --git a/deploy/helm/arcana-engine/values.yaml b/deploy/helm/arcana-engine/values.yaml
index 2d7388d..36b9b35 100644
--- a/deploy/helm/arcana-engine/values.yaml
+++ b/deploy/helm/arcana-engine/values.yaml
@@ -24,7 +24,7 @@ env:
   REDIS_HOST: "redis.arcana.svc.cluster.local"
   NATS_HOST: "nats.arcana.svc.cluster.local"
   TEMPORAL_HOST: "temporal.arcana.svc.cluster.local"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 envFromSecrets:
   - arcana-platform-secret
diff --git a/deploy/helm/arcana-finops/values.yaml b/deploy/helm/arcana-finops/values.yaml
index 7b619ec..82b39d7 100644
--- a/deploy/helm/arcana-finops/values.yaml
+++ b/deploy/helm/arcana-finops/values.yaml
@@ -21,7 +21,7 @@ env:
   PORT: "8105"
   POSTGRES_HOST: "postgres.arcana.svc.cluster.local"
   POSTGRES_PORT: "5432"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 envFromSecrets:
   - arcana-platform-secret
diff --git a/deploy/helm/arcana-forge/values.yaml b/deploy/helm/arcana-forge/values.yaml
index 7c06300..4b7d203 100644
--- a/deploy/helm/arcana-forge/values.yaml
+++ b/deploy/helm/arcana-forge/values.yaml
@@ -19,7 +19,7 @@ service:
 
 env:
   PORT: "8098"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 probes:
   liveness: "/healthz"
diff --git a/deploy/helm/arcana-gitops/values.yaml b/deploy/helm/arcana-gitops/values.yaml
index 1c7479b..5fb43a5 100644
--- a/deploy/helm/arcana-gitops/values.yaml
+++ b/deploy/helm/arcana-gitops/values.yaml
@@ -19,7 +19,7 @@ service:
 
 env:
   PORT: "8106"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 probes:
   liveness: "/healthz"
diff --git a/deploy/helm/arcana-graph/values.yaml b/deploy/helm/arcana-graph/values.yaml
index 8191920..f8ae721 100644
--- a/deploy/helm/arcana-graph/values.yaml
+++ b/deploy/helm/arcana-graph/values.yaml
@@ -19,7 +19,7 @@ service:
 
 env:
   PORT: "8095"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 probes:
   liveness: "/healthz"
diff --git a/deploy/helm/arcana-memory/values.yaml b/deploy/helm/arcana-memory/values.yaml
index aa1f99e..267eb9a 100644
--- a/deploy/helm/arcana-memory/values.yaml
+++ b/deploy/helm/arcana-memory/values.yaml
@@ -21,7 +21,7 @@ env:
   PORT: "8087"
   POSTGRES_HOST: "postgres.arcana.svc.cluster.local"
   POSTGRES_PORT: "5432"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 envFromSecrets:
   - arcana-platform-secret
diff --git a/deploy/helm/arcana-mesh/values.yaml b/deploy/helm/arcana-mesh/values.yaml
index 80d2cbe..022c06a 100644
--- a/deploy/helm/arcana-mesh/values.yaml
+++ b/deploy/helm/arcana-mesh/values.yaml
@@ -22,7 +22,7 @@ env:
   NATS_URL: "nats://nats.arcana.svc.cluster.local:4222"
   POSTGRES_HOST: "postgres.arcana.svc.cluster.local"
   POSTGRES_PORT: "5432"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
   TEMPLATE_AGENT_IMAGE: "ghcr.io/redhat-data-and-ai/template-agent:deep-agent"
   TEMPLATE_AGENT_PULL_POLICY: "Always"
 
diff --git a/deploy/helm/arcana-models/values.yaml b/deploy/helm/arcana-models/values.yaml
index 804d64a..1c95ef1 100644
--- a/deploy/helm/arcana-models/values.yaml
+++ b/deploy/helm/arcana-models/values.yaml
@@ -19,7 +19,7 @@ service:
 
 env:
   PORT: "8099"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 probes:
   liveness: "/healthz"
diff --git a/deploy/helm/arcana-operator/values.yaml b/deploy/helm/arcana-operator/values.yaml
index 57e6c85..1de81b9 100644
--- a/deploy/helm/arcana-operator/values.yaml
+++ b/deploy/helm/arcana-operator/values.yaml
@@ -19,7 +19,7 @@ service:
 
 env:
   PORT: "8082"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 probes:
   liveness: "/healthz"
diff --git a/deploy/helm/arcana-oracle/values.yaml b/deploy/helm/arcana-oracle/values.yaml
index 08b61fc..fd4922a 100644
--- a/deploy/helm/arcana-oracle/values.yaml
+++ b/deploy/helm/arcana-oracle/values.yaml
@@ -19,7 +19,7 @@ service:
 
 env:
   PORT: "8089"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 probes:
   liveness: "/healthz"
diff --git a/deploy/helm/arcana-probe/values.yaml b/deploy/helm/arcana-probe/values.yaml
index a48fa8e..58b02b5 100644
--- a/deploy/helm/arcana-probe/values.yaml
+++ b/deploy/helm/arcana-probe/values.yaml
@@ -19,7 +19,7 @@ service:
 
 env:
   PORT: "8101"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 probes:
   liveness: "/healthz"
diff --git a/deploy/helm/arcana-registry/values.yaml b/deploy/helm/arcana-registry/values.yaml
index 76fce95..77c946d 100644
--- a/deploy/helm/arcana-registry/values.yaml
+++ b/deploy/helm/arcana-registry/values.yaml
@@ -21,7 +21,7 @@ env:
   PORT: "8104"
   POSTGRES_HOST: "postgres.arcana.svc.cluster.local"
   POSTGRES_PORT: "5432"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 envFromSecrets:
   - arcana-platform-secret
diff --git a/deploy/helm/arcana-sandbox/values.yaml b/deploy/helm/arcana-sandbox/values.yaml
index bb5d143..2b1a8bc 100644
--- a/deploy/helm/arcana-sandbox/values.yaml
+++ b/deploy/helm/arcana-sandbox/values.yaml
@@ -19,7 +19,7 @@ service:
 
 env:
   PORT: "8097"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
   SANDBOX_RUNTIME_CLASS: "arcana-sandbox-dev"
   SANDBOX_NAMESPACE: "arcana"
 
diff --git a/deploy/helm/arcana-scheduler/values.yaml b/deploy/helm/arcana-scheduler/values.yaml
index 14b1642..e5845a9 100644
--- a/deploy/helm/arcana-scheduler/values.yaml
+++ b/deploy/helm/arcana-scheduler/values.yaml
@@ -21,7 +21,7 @@ env:
   PORT: "8103"
   POSTGRES_HOST: "postgres.arcana.svc.cluster.local"
   POSTGRES_PORT: "5432"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 envFromSecrets:
   - arcana-platform-secret
diff --git a/deploy/helm/arcana-skills/values.yaml b/deploy/helm/arcana-skills/values.yaml
index 0b90765..b699547 100644
--- a/deploy/helm/arcana-skills/values.yaml
+++ b/deploy/helm/arcana-skills/values.yaml
@@ -22,7 +22,7 @@ env:
   POSTGRES_HOST: "postgres.arcana.svc.cluster.local"
   POSTGRES_PORT: "5432"
   REDIS_HOST: "redis.arcana.svc.cluster.local"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 envFromSecrets:
   - arcana-platform-secret
diff --git a/deploy/helm/arcana-studio/values.yaml b/deploy/helm/arcana-studio/values.yaml
index f79973f..42e9730 100644
--- a/deploy/helm/arcana-studio/values.yaml
+++ b/deploy/helm/arcana-studio/values.yaml
@@ -18,7 +18,7 @@ service:
   port: 3000
 
 env:
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 probes:
   liveness: "/"
diff --git a/deploy/helm/arcana-tools/values.yaml b/deploy/helm/arcana-tools/values.yaml
index 3e5d1a3..729583f 100644
--- a/deploy/helm/arcana-tools/values.yaml
+++ b/deploy/helm/arcana-tools/values.yaml
@@ -19,7 +19,7 @@ service:
 
 env:
   PORT: "8096"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 probes:
   liveness: "/healthz"
diff --git a/deploy/helm/arcana-ward/values.yaml b/deploy/helm/arcana-ward/values.yaml
index 4d6f950..dffd722 100644
--- a/deploy/helm/arcana-ward/values.yaml
+++ b/deploy/helm/arcana-ward/values.yaml
@@ -21,7 +21,7 @@ env:
   PORT: "8086"
   POSTGRES_HOST: "postgres.arcana.svc.cluster.local"
   POSTGRES_PORT: "5432"
-  OTEL_EXPORTER_OTLP_ENDPOINT: "jaeger.arcana.svc.cluster.local:4318"
+  OTEL_EXPORTER_OTLP_ENDPOINT: "http://jaeger.arcana.svc.cluster.local:4318"
 
 envFromSecrets:
   - arcana-platform-secret
diff --git a/mesh b/mesh
new file mode 100755
index 0000000..5001931
Binary files /dev/null and b/mesh differ
diff --git a/services/studio/src/main.tsx b/services/studio/src/main.tsx
index ba86729..bd1bb20 100644
--- a/services/studio/src/main.tsx
+++ b/services/studio/src/main.tsx
@@ -4,6 +4,24 @@ import "@patternfly/react-core/dist/styles/base.css";
 import "./styles.css";
 import { App } from "./App";
 
+const originalFetch = window.fetch;
+window.fetch = function (input: RequestInfo | URL, init?: RequestInit) {
+  const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+  if (url.startsWith("/api/")) {
+    const token = localStorage.getItem("arcana_auth_token");
+    const role = localStorage.getItem("arcana_auth_role");
+    const headers = new Headers(init?.headers);
+    if (token && token !== "open" && !headers.has("Authorization")) {
+      headers.set("Authorization", `Bearer ${token}`);
+    }
+    if (role && !headers.has("X-Arcana-Role")) {
+      headers.set("X-Arcana-Role", role);
+    }
+    return originalFetch(input, { ...init, headers });
+  }
+  return originalFetch(input, init);
+};
+
 ReactDOM.createRoot(document.getElementById("root")!).render(
   <React.StrictMode>
     <App />
diff --git a/services/studio/src/pages/DashboardPage.tsx b/services/studio/src/pages/DashboardPage.tsx
index 578703f..4a74575 100644
--- a/services/studio/src/pages/DashboardPage.tsx
+++ b/services/studio/src/pages/DashboardPage.tsx
@@ -11,25 +11,26 @@ import { useAuth } from "../auth/AuthContext";
 export const DashboardPage = () => {
   const navigate = useNavigate();
   const { health, error, loading } = useHealth(5000);
-  const { user, isAtLeast } = useAuth();
+  const { user, isAtLeast, authHeaders } = useAuth();
   const [agentCount, setAgentCount] = useState<{ total: number } | null>(null);
   const [skillCount, setSkillCount] = useState(0);
   const [mcpCount, setMcpCount] = useState(0);
 
   useEffect(() => {
-    fetch("/api/v1/agents")
+    const headers = authHeaders();
+    fetch("/api/v1/agents", { headers })
       .then((r) => r.json())
       .then((d) => setAgentCount({ total: d.total ?? 0 }))
       .catch(() => {});
-    fetch("/api/v1/skills")
+    fetch("/api/v1/skills", { headers })
       .then((r) => r.json())
       .then((d) => setSkillCount(d.skills?.length ?? 0))
       .catch(() => {});
-    fetch("/api/v1/mcp")
+    fetch("/api/v1/tools", { headers })
       .then((r) => r.json())
       .then((d) => setMcpCount(d.servers?.length ?? 0))
       .catch(() => {});
-  }, []);
+  }, [authHeaders]);
 
   const totalServices = health?.services.length ?? 0;
   const healthyServices = health?.services.filter((s) => s.status === "healthy").length ?? 0;