first commit

2026-09-09 16:50:00 -03:00
commit b2a368d71a
104 changed files with 7462 additions and 0 deletions
--- a/deploy/.DS_Store
+++ b/deploy/.DS_Store
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -0,0 +1,125 @@
+# Deployment Kubernetes — Evaluator TIM
+
+O **evaluator continua sendo batch/CronJob-only**. O componente `evaluator-batch` não expõe HTTP nem gRPC.
+
+Para acompanhamento operacional existe um componente **separado e somente leitura**, `evaluator-monitor`, que consulta as tabelas do Autonomous Database e disponibiliza `/ui` e APIs de monitoramento. Essa separação mantém o processamento em batch e evita acoplar uma API HTTP ao evaluator.
+
+Recursos aplicados pelo Kustomize:
+
+```text
+Namespace
+ServiceAccount
+ConfigMap
+CronJob evaluator-batch
+Deployment evaluator-monitor
+Service evaluator-monitor (ClusterIP)
+```
+
+O CronJob executa diariamente às 02:00 em `America/Sao_Paulo`, com `suspend: false` e `concurrencyPolicy: Forbid`.
+
+## Preparação
+
+```bash
+cp deploy/env/evaluator.env.example deploy/env/evaluator.env
+```
+
+Configure ADB, OCI GenAI e GCS no env file. Copie `deploy/langfuse/langfuse_credentials.example.yaml` para `deploy/langfuse/langfuse_credentials.yaml` e declare ali quantos agentes/projetos Langfuse forem necessários. O script cria o Secret `evaluator-langfuse` dinamicamente a partir desse arquivo.
+
+Wallet Oracle:
+
+```text
+deploy/wallet/
+```
+
+Credencial GCP opcionalmente materializada pelo script:
+
+```text
+deploy/gcp/GCP_ACCESS_KEY.json
+```
+
+## Secrets
+
+```bash
+./deploy/scripts/create-secrets.sh dev
+./deploy/scripts/create-secrets.sh hml
+./deploy/scripts/create-secrets.sh prod
+```
+
+## Build
+
+```bash
+export REGISTRY=tim.azurecr.io
+export IMAGE_TAG=0.3.0
+./deploy/scripts/build-push.sh prod
+```
+
+## Deploy
+
+```bash
+export REGISTRY=tim.azurecr.io
+export IMAGE_TAG=0.3.0
+./deploy/scripts/deploy.sh prod
+```
+
+## Status
+
+```bash
+./deploy/scripts/status.sh prod
+```
+
+Ou:
+
+```bash
+kubectl -n agent-evaluator-prod get cronjob,jobs,pods,deploy,svc
+```
+
+## Execução imediata
+
+```bash
+./deploy/scripts/run-now.sh prod
+```
+
+Acompanhar logs do batch:
+
+```bash
+kubectl -n agent-evaluator-prod get jobs,pods
+kubectl -n agent-evaluator-prod logs -f job/<nome-do-job>
+```
+
+O comando `run-agents` também imprime o `RUN_ID` assim que cada execução é criada, permitindo:
+
+```bash
+python -m evaluator.cli progress <RUN_ID> --events 100
+```
+
+## Interface web
+
+O Service do monitor é `ClusterIP`, portanto não fica exposto externamente por default.
+
+Para acessar via sua máquina:
+
+```bash
+kubectl -n agent-evaluator-prod port-forward svc/evaluator-monitor 8080:8080
+```
+
+Abra:
+
+```text
+http://localhost:8080/ui
+```
+
+Endpoints read-only:
+
+```text
+GET /health
+GET /api/runs
+GET /api/runs/{run_id}
+GET /api/runs/{run_id}/results
+GET /ui
+```
+
+Não há endpoints para iniciar, cancelar, apagar ou alterar runs.
+
+## Configuração de storage
+
+Os buckets por ambiente ficam em `configs/judge/storage.yaml`. Para usar outro arquivo, configure `STORAGE_CONFIG_PATH`. `JUDGE_GCS_BUCKET` sobrescreve o mapping quando necessário.
--- a/deploy/env/evaluator.env.example
+++ b/deploy/env/evaluator.env.example
@@ -0,0 +1,22 @@
+# Copie para evaluator.env e não faça commit do arquivo real.
+APP_ENV=dev
+ADB_USER=admin
+ADB_PASSWORD=change-me
+ADB_DSN=oradb23ai_high
+ADB_WALLET_PASSWORD=change-me
+
+LLM_PROVIDER=oci_sdk
+OCI_AUTH_MODE=oke_workload_identity
+OCI_GENAI_BASE_URL=https://<private-endpoint>.inference.generativeai.sa-saopaulo-1.oci.oraclecloud.com
+OCI_GENAI_MODEL=ocid1.generativeaiendpoint...
+OCI_GENAI_ENDPOINT_ID=ocid1.generativeaiendpoint...
+OCI_COMPARTMENT_ID=ocid1.compartment...
+OCI_REGION=sa-saopaulo-1
+
+ENABLE_GCS_UPLOAD=true
+JUDGE_GCS_BUCKET=
+STORAGE_CONFIG_PATH=configs/judge/storage.yaml
+GOOGLE_APPLICATION_CREDENTIALS=/var/secrets/google/GCP_ACCESS_KEY.json
+
+# Langfuse per-agent credentials are supplied by the mounted YAML file, not env names.
+LANGFUSE_CREDENTIALS_CONFIG_PATH=/var/secrets/langfuse/langfuse_credentials.yaml
--- a/deploy/k8s/.DS_Store
+++ b/deploy/k8s/.DS_Store
--- a/deploy/k8s/base/configmap.yaml
+++ b/deploy/k8s/base/configmap.yaml
@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: evaluator-config
+  namespace: agent-evaluator
+data:
+  ENABLE_LANGFUSE: "true"
+  LANGFUSE_CREDENTIALS_CONFIG_PATH: "/var/secrets/langfuse/langfuse_credentials.yaml"
+  PUBLISH_LANGFUSE_SCORES: "false"
+  LLM_PROVIDER: "oci_sdk"
+  LLM_PROFILE: "judge"
+  LLM_PROFILES_PATH: "configs/llm_profiles/llm_profiles.yaml"
+  LLM_TEMPERATURE: "0"
+  LLM_MAX_TOKENS: "900"
+  LLM_TIMEOUT_SECONDS: "120"
+  AGENTS_CONFIG_PATH: "configs/judge/agents.yaml"
+  TRACE_PROMPT_PATH: "configs/judge/trace_metrics.yaml"
+  SESSION_PROMPT_PATH: "configs/judge/session_metrics.yaml"
+  OUTPUT_DIR: "/app/output"
+  BATCH_SIZE: "50"
+  MAX_ATTEMPTS: "3"
+  ENABLE_GCS_UPLOAD: "true"
+  STORAGE_CONFIG_PATH: "configs/judge/storage.yaml"
+  ADB_TABLE_PREFIX: "AGENTFW"
+  ADB_WALLET_LOCATION: "/opt/oracle/wallet"
--- a/deploy/k8s/base/cronjob.yaml
+++ b/deploy/k8s/base/cronjob.yaml
@@ -0,0 +1,94 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: evaluator-batch
+  namespace: agent-evaluator
+  labels:
+    app.kubernetes.io/name: evaluator-batch
+    app.kubernetes.io/component: batch
+    app.kubernetes.io/part-of: agent-framework
+spec:
+  schedule: "0 2 * * *"
+  timeZone: "America/Sao_Paulo"
+  suspend: false
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 5
+  startingDeadlineSeconds: 1800
+  jobTemplate:
+    spec:
+      backoffLimit: 2
+      activeDeadlineSeconds: 21600
+      ttlSecondsAfterFinished: 86400
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: evaluator-batch
+            app.kubernetes.io/component: batch
+        spec:
+          restartPolicy: Never
+          serviceAccountName: evaluator
+          automountServiceAccountToken: false
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 10001
+            runAsGroup: 10001
+            fsGroup: 10001
+            seccompProfile:
+              type: RuntimeDefault
+          containers:
+            - name: evaluator
+              image: agent-framework-evaluator:latest
+              imagePullPolicy: IfNotPresent
+              command: ["python", "-m", "evaluator.cli", "run-agents"]
+              args: ["--source", "langfuse"]
+              envFrom:
+                - configMapRef:
+                    name: evaluator-config
+                - secretRef:
+                    name: evaluator-secrets
+              env:
+                - name: TNS_ADMIN
+                  value: /opt/oracle/wallet
+              resources:
+                requests:
+                  cpu: 500m
+                  memory: 1Gi
+                limits:
+                  cpu: "2"
+                  memory: 2Gi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                capabilities:
+                  drop: ["ALL"]
+              volumeMounts:
+                - name: wallet
+                  mountPath: /opt/oracle/wallet
+                  readOnly: true
+                - name: output
+                  mountPath: /app/output
+                - name: tmp
+                  mountPath: /tmp
+                - name: gcp-credentials
+                  mountPath: /var/secrets/google
+                  readOnly: true
+                - name: langfuse-credentials
+                  mountPath: /var/secrets/langfuse
+                  readOnly: true
+          volumes:
+            - name: wallet
+              secret:
+                secretName: evaluator-wallet
+            - name: output
+              emptyDir: {}
+            - name: tmp
+              emptyDir: {}
+            - name: gcp-credentials
+              secret:
+                secretName: evaluator-gcp
+                optional: true
+            - name: langfuse-credentials
+              secret:
+                secretName: evaluator-langfuse
+                optional: false
--- a/deploy/k8s/base/init-db-job.yaml
+++ b/deploy/k8s/base/init-db-job.yaml
@@ -0,0 +1,63 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: evaluator-init-db
+  namespace: agent-evaluator
+  labels:
+    app.kubernetes.io/name: evaluator-init-db
+    app.kubernetes.io/component: database-migration
+spec:
+  backoffLimit: 3
+  ttlSecondsAfterFinished: 3600
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: evaluator-init-db
+    spec:
+      restartPolicy: OnFailure
+      serviceAccountName: evaluator
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: init-db
+          image: agent-framework-evaluator:latest
+          imagePullPolicy: IfNotPresent
+          command: ["python", "-m", "evaluator.cli", "init-db"]
+          envFrom:
+            - configMapRef:
+                name: evaluator-config
+            - secretRef:
+                name: evaluator-secrets
+          env:
+            - name: TNS_ADMIN
+              value: /opt/oracle/wallet
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: wallet
+              mountPath: /opt/oracle/wallet
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: wallet
+          secret:
+            secretName: evaluator-wallet
+        - name: tmp
+          emptyDir: {}
--- a/deploy/k8s/base/kustomization.yaml
+++ b/deploy/k8s/base/kustomization.yaml
@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: agent-evaluator
+resources:
+  - namespace.yaml
+  - serviceaccount.yaml
+  - configmap.yaml
+  - cronjob.yaml
+  - monitor-deployment.yaml
+  - monitor-service.yaml
+commonLabels:
+  app.kubernetes.io/managed-by: kustomize
--- a/deploy/k8s/base/monitor-deployment.yaml
+++ b/deploy/k8s/base/monitor-deployment.yaml
@@ -0,0 +1,82 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: evaluator-monitor
+  namespace: agent-evaluator
+  labels:
+    app.kubernetes.io/name: evaluator-monitor
+    app.kubernetes.io/component: monitoring
+    app.kubernetes.io/part-of: agent-framework
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: evaluator-monitor
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: evaluator-monitor
+        app.kubernetes.io/component: monitoring
+    spec:
+      serviceAccountName: evaluator
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        runAsGroup: 10001
+        fsGroup: 10001
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: monitor
+          image: agent-framework-evaluator:latest
+          imagePullPolicy: IfNotPresent
+          command: ["python", "-m", "uvicorn"]
+          args: ["evaluator_monitor.app:app", "--host", "0.0.0.0", "--port", "8080"]
+          ports:
+            - name: http
+              containerPort: 8080
+          envFrom:
+            - configMapRef:
+                name: evaluator-config
+            - secretRef:
+                name: evaluator-secrets
+          env:
+            - name: TNS_ADMIN
+              value: /opt/oracle/wallet
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: wallet
+              mountPath: /opt/oracle/wallet
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: wallet
+          secret:
+            secretName: evaluator-wallet
+        - name: tmp
+          emptyDir: {}
--- a/deploy/k8s/base/monitor-service.yaml
+++ b/deploy/k8s/base/monitor-service.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: evaluator-monitor
+  namespace: agent-evaluator
+  labels:
+    app.kubernetes.io/name: evaluator-monitor
+    app.kubernetes.io/component: monitoring
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: evaluator-monitor
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
--- a/deploy/k8s/base/namespace.yaml
+++ b/deploy/k8s/base/namespace.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: agent-evaluator
+  labels:
+    app.kubernetes.io/part-of: agent-framework
--- a/deploy/k8s/base/secret-template.yaml
+++ b/deploy/k8s/base/secret-template.yaml
@@ -0,0 +1,35 @@
+# TEMPLATE ONLY. Do not apply or commit real values.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: evaluator-secrets
+  namespace: agent-evaluator
+type: Opaque
+stringData:
+  ADB_USER: "REPLACE_ME"
+  ADB_PASSWORD: "REPLACE_ME"
+  ADB_DSN: "REPLACE_ME"
+  ADB_WALLET_PASSWORD: "REPLACE_ME"
+  OCI_GENAI_BASE_URL: "https://private-endpoint.inference.generativeai.region.oci.oraclecloud.com"
+  OCI_GENAI_MODEL: "ocid1.generativeaiendpoint.REPLACE_ME"
+  OCI_GENAI_ENDPOINT_ID: "ocid1.generativeaiendpoint.REPLACE_ME"
+  OCI_COMPARTMENT_ID: "ocid1.compartment.REPLACE_ME"
+  OCI_AUTH_MODE: "oke_workload_identity"
+  GOOGLE_APPLICATION_CREDENTIALS: "/var/secrets/google/GCP_ACCESS_KEY.json"
+---
+# Langfuse credentials are one data-driven YAML, not one env namespace per agent.
+# Add as many entries as required; no Python or manifest change is needed.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: evaluator-langfuse
+  namespace: agent-evaluator
+type: Opaque
+stringData:
+  langfuse_credentials.yaml: |
+    langfuse:
+      agents:
+        - agentId: REPLACE_WITH_AGENT_ID
+          host: https://langfuse.example
+          publicKey: pk-REPLACE_ME
+          secretKey: sk-REPLACE_ME
--- a/deploy/k8s/base/serviceaccount.yaml
+++ b/deploy/k8s/base/serviceaccount.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: evaluator
+  namespace: agent-evaluator
+automountServiceAccountToken: false
--- a/deploy/k8s/overlays/dev/kustomization.yaml
+++ b/deploy/k8s/overlays/dev/kustomization.yaml
@@ -0,0 +1,24 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: agent-evaluator-dev
+resources:
+  - ../../base
+images:
+  - name: agent-framework-evaluator
+    newName: REPLACE_REGISTRY/agent-framework-evaluator
+    newTag: dev
+patches:
+  - target:
+      kind: Namespace
+      name: agent-evaluator
+    patch: |-
+      - op: replace
+        path: /metadata/name
+        value: agent-evaluator-dev
+  - target:
+      kind: CronJob
+      name: evaluator-batch
+    patch: |-
+      - op: replace
+        path: /spec/suspend
+        value: false
--- a/deploy/k8s/overlays/hml/kustomization.yaml
+++ b/deploy/k8s/overlays/hml/kustomization.yaml
@@ -0,0 +1,24 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: agent-evaluator-hml
+resources:
+  - ../../base
+images:
+  - name: agent-framework-evaluator
+    newName: REPLACE_REGISTRY/agent-framework-evaluator
+    newTag: hml
+patches:
+  - target:
+      kind: Namespace
+      name: agent-evaluator
+    patch: |-
+      - op: replace
+        path: /metadata/name
+        value: agent-evaluator-hml
+  - target:
+      kind: CronJob
+      name: evaluator-batch
+    patch: |-
+      - op: replace
+        path: /spec/suspend
+        value: false
--- a/deploy/k8s/overlays/prod/kustomization.yaml
+++ b/deploy/k8s/overlays/prod/kustomization.yaml
@@ -0,0 +1,24 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: agent-evaluator-prod
+resources:
+  - ../../base
+images:
+  - name: agent-framework-evaluator
+    newName: REPLACE_REGISTRY/agent-framework-evaluator
+    newTag: stable
+patches:
+  - target:
+      kind: Namespace
+      name: agent-evaluator
+    patch: |-
+      - op: replace
+        path: /metadata/name
+        value: agent-evaluator-prod
+  - target:
+      kind: CronJob
+      name: evaluator-batch
+    patch: |-
+      - op: replace
+        path: /spec/suspend
+        value: false
--- a/deploy/langfuse/langfuse_credentials.example.yaml
+++ b/deploy/langfuse/langfuse_credentials.example.yaml
@@ -0,0 +1,22 @@
+# Copy/mount this file as configs/langfuse/langfuse_credentials.yaml, or point
+# LANGFUSE_CREDENTIALS_CONFIG_PATH to another location.
+#
+# Production recommendation: mount the complete file from a Kubernetes Secret.
+# The evaluator loops over all entries; adding an agent requires no Python change.
+langfuse:
+  agents:
+    - agentId: billing
+      host: https://langfuse.example.internal
+      publicKey: pk-example-billing
+      secretKey: sk-example-billing
+
+    - agentId: sales
+      host: https://langfuse.example.internal
+      publicKey: pk-example-sales
+      secretKey: sk-example-sales
+
+# Alternative: keep only references in Git and source values from env or files:
+#    - agentId: collection
+#      hostEnv: COLLECTION_LANGFUSE_HOST
+#      publicKeyEnv: COLLECTION_LANGFUSE_PUBLIC_KEY
+#      secretKeyFile: /var/secrets/langfuse/collection-secret-key
--- a/deploy/scripts/build-push.sh
+++ b/deploy/scripts/build-push.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+source "$(dirname "$0")/common.sh"
+require_command docker
+validate_environment
+
+REGISTRY="${REGISTRY:?Defina REGISTRY, por exemplo: tim.azurecr.io}"
+IMAGE_NAME="${IMAGE_NAME:-agent-framework-evaluator}"
+IMAGE_TAG="${IMAGE_TAG:-$(git -C "${ROOT_DIR}" rev-parse --short HEAD 2>/dev/null || date +%Y%m%d%H%M%S)}"
+IMAGE="${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
+PLATFORM="${PLATFORM:-linux/amd64}"
+
+echo "Construindo ${IMAGE} para ${PLATFORM}..."
+docker build --platform "${PLATFORM}" -t "${IMAGE}" "${ROOT_DIR}"
+
+echo "Enviando ${IMAGE}..."
+docker push "${IMAGE}"
+echo "IMAGE=${IMAGE}"
--- a/deploy/scripts/common.sh
+++ b/deploy/scripts/common.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+ENVIRONMENT="${ENVIRONMENT:-${1:-dev}}"
+NAMESPACE="${NAMESPACE:-agent-evaluator-${ENVIRONMENT}}"
+OVERLAY_DIR="${ROOT_DIR}/deploy/k8s/overlays/${ENVIRONMENT}"
+
+require_command() {
+  command -v "$1" >/dev/null 2>&1 || { echo "Erro: comando '$1' não encontrado." >&2; exit 1; }
+}
+
+validate_environment() {
+  case "${ENVIRONMENT}" in dev|hml|prod) ;; *) echo "Ambiente inválido: ${ENVIRONMENT}. Use dev, hml ou prod." >&2; exit 1;; esac
+  [[ -d "${OVERLAY_DIR}" ]] || { echo "Overlay não encontrado: ${OVERLAY_DIR}" >&2; exit 1; }
+}
--- a/deploy/scripts/create-secrets.sh
+++ b/deploy/scripts/create-secrets.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+source "$(dirname "$0")/common.sh"
+require_command kubectl
+validate_environment
+
+ENV_FILE="${ENV_FILE:-${ROOT_DIR}/deploy/env/evaluator.env}"
+WALLET_DIR="${WALLET_DIR:-${ROOT_DIR}/deploy/wallet}"
+
+[[ -f "${ENV_FILE}" ]] || { echo "Arquivo de variáveis não encontrado: ${ENV_FILE}" >&2; exit 1; }
+[[ -d "${WALLET_DIR}" ]] || { echo "Diretório do wallet não encontrado: ${WALLET_DIR}" >&2; exit 1; }
+
+kubectl create namespace "${NAMESPACE}" --dry-run=client -o yaml | kubectl apply -f -
+kubectl -n "${NAMESPACE}" create secret generic evaluator-secrets \
+  --from-env-file="${ENV_FILE}" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+wallet_args=()
+while IFS= read -r -d '' file; do
+  wallet_args+=("--from-file=$(basename "${file}")=${file}")
+done < <(find "${WALLET_DIR}" -maxdepth 1 -type f -print0)
+
+((${#wallet_args[@]} > 0)) || { echo "Nenhum arquivo encontrado em ${WALLET_DIR}" >&2; exit 1; }
+kubectl -n "${NAMESPACE}" create secret generic evaluator-wallet \
+  "${wallet_args[@]}" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+
+
+LANGFUSE_CREDENTIALS_FILE="${LANGFUSE_CREDENTIALS_FILE:-${ROOT_DIR}/deploy/langfuse/langfuse_credentials.yaml}"
+if [[ -f "${LANGFUSE_CREDENTIALS_FILE}" ]]; then
+  kubectl -n "${NAMESPACE}" create secret generic evaluator-langfuse \
+    --from-file=langfuse_credentials.yaml="${LANGFUSE_CREDENTIALS_FILE}" \
+    --dry-run=client -o yaml | kubectl apply -f -
+  echo "Credenciais Langfuse atualizadas no secret evaluator-langfuse."
+else
+  echo "Arquivo de credenciais Langfuse não encontrado: ${LANGFUSE_CREDENTIALS_FILE}" >&2
+  exit 1
+fi
+
+GCP_CREDENTIALS_FILE="${GCP_CREDENTIALS_FILE:-${ROOT_DIR}/deploy/gcp/GCP_ACCESS_KEY.json}"
+if [[ -f "${GCP_CREDENTIALS_FILE}" ]]; then
+  kubectl -n "${NAMESPACE}" create secret generic evaluator-gcp \
+    --from-file=GCP_ACCESS_KEY.json="${GCP_CREDENTIALS_FILE}" \
+    --dry-run=client -o yaml | kubectl apply -f -
+  echo "Credencial GCP atualizada no secret evaluator-gcp."
+else
+  echo "Aviso: credencial GCP não encontrada em ${GCP_CREDENTIALS_FILE}; secret evaluator-gcp não foi alterado." >&2
+fi
+
+echo "Secrets atualizados no namespace ${NAMESPACE}."
--- a/deploy/scripts/deploy.sh
+++ b/deploy/scripts/deploy.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+source "$(dirname "$0")/common.sh"
+require_command kubectl
+validate_environment
+
+REGISTRY="${REGISTRY:?Defina REGISTRY, por exemplo: tim.azurecr.io}"
+IMAGE_NAME="${IMAGE_NAME:-agent-framework-evaluator}"
+IMAGE_TAG="${IMAGE_TAG:?Defina IMAGE_TAG com a versão já publicada}"
+IMAGE="${REGISTRY}/${IMAGE_NAME}:${IMAGE_TAG}"
+RUN_INIT_DB="${RUN_INIT_DB:-true}"
+TIMEOUT="${TIMEOUT:-300s}"
+
+kubectl kustomize "${OVERLAY_DIR}" \
+  | sed "s#REPLACE_REGISTRY/agent-framework-evaluator:[^[:space:]]*#${IMAGE}#g" \
+  | kubectl apply -f -
+
+if [[ "${RUN_INIT_DB}" == "true" ]]; then
+  job_name="evaluator-init-db-${ENVIRONMENT}-$(date +%s)"
+  sed -e "s#agent-evaluator#${NAMESPACE}#g" \
+      -e "s#name: evaluator-init-db#name: ${job_name}#" \
+      -e "s#agent-framework-evaluator:latest#${IMAGE}#" \
+      "${ROOT_DIR}/deploy/k8s/base/init-db-job.yaml" | kubectl apply -f -
+  kubectl -n "${NAMESPACE}" wait --for=condition=complete "job/${job_name}" --timeout="${TIMEOUT}" || {
+    kubectl -n "${NAMESPACE}" logs "job/${job_name}" --all-containers=true || true
+    exit 1
+  }
+fi
+
+kubectl -n "${NAMESPACE}" get cronjob,pod,jobs
--- a/deploy/scripts/run-now.sh
+++ b/deploy/scripts/run-now.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+source "$(dirname "$0")/common.sh"
+require_command kubectl
+validate_environment
+
+CRONJOB="${CRONJOB:-evaluator-batch}"
+JOB_NAME="${JOB_NAME:-evaluator-manual-${ENVIRONMENT}-$(date +%Y%m%d%H%M%S)}"
+kubectl -n "${NAMESPACE}" create job --from="cronjob/${CRONJOB}" "${JOB_NAME}"
+echo "Job criado: ${JOB_NAME}"
+echo "Logs: kubectl -n ${NAMESPACE} logs -f job/${JOB_NAME}"
--- a/deploy/scripts/status.sh
+++ b/deploy/scripts/status.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+source "$(dirname "$0")/common.sh"
+require_command kubectl
+validate_environment
+kubectl -n "${NAMESPACE}" get cronjob,jobs,pods,deploy,svc
+printf '\nEventos recentes:\n'
+kubectl -n "${NAMESPACE}" get events --sort-by=.lastTimestamp | tail -30
--- a/deploy/scripts/undeploy.sh
+++ b/deploy/scripts/undeploy.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+source "$(dirname "$0")/common.sh"
+require_command kubectl
+validate_environment
+
+kubectl delete -k "${OVERLAY_DIR}" --ignore-not-found
+if [[ "${DELETE_NAMESPACE:-false}" == "true" ]]; then
+  kubectl delete namespace "${NAMESPACE}" --ignore-not-found
+fi