M0 e M1 revisados e fixes implementados

RI/deploy/docker/Dockerfile

@@ -1,10 +1,11 @@
 # Shared image for every RI service (Gateway, example MCP servers, ...).
 # docker-compose.yml selects the process to run per service via `command:`.
 #
-# NOTE: not verified with a real `docker build` in this session -- no Docker
-# daemon was available in the sandbox this was authored in (see RI/README.md,
-# "Validado nesta sessão" for exactly what *was* run). Please verify on first
-# use in an environment with Docker and report back if anything needs fixing.
+# Verified with a real `docker build`/`docker compose up` (RI/README.md, "O
+# que foi validado com Docker") -- this image originally omitted `config ./config`
+# below, which built fine but made the Gateway fail closed at startup
+# (`ConfigError`: config/clients not found -- `load_yaml_models`, EP-01/EP-04),
+# since the container never had client registrations/profiles to load.
 FROM python:3.12-slim AS base
 
 WORKDIR /app
@@ -14,16 +15,19 @@ WORKDIR /app
 COPY pyproject.toml ./
 COPY src ./src
 COPY services ./services
+# The Gateway loads client registrations/profiles/backend-credential config
+# from `config/` at startup (EP-01/EP-04/EP-07, GatewayConfig.config_dir).
+COPY config ./config
 
 RUN pip install --no-cache-dir --upgrade pip \
-    && pip install --no-cache-dir -e .
+    && pip install --no-cache-dir -e ".[otlp]"
 
 # Runs as a non-root user; every RI service binds 0.0.0.0 inside its own
 # container network namespace, never the host network directly.
 RUN useradd --create-home --uid 10001 emcp
 USER emcp
 
-EXPOSE 8000 8100
+EXPOSE 8000 8100 8101
 
 # Overridden per-service by docker-compose.yml `command:`.
 CMD ["python3", "-m", "emcp_bus.gateway.server"]

RI/deploy/keycloak/realm-export.json

@@ -0,0 +1,75 @@
+{
+  "realm": "emcp",
+  "enabled": true,
+  "clients": [
+    {
+      "clientId": "sales-read-agent",
+      "name": "Sales.Read agent (README.md §7.1)",
+      "enabled": true,
+      "protocol": "openid-connect",
+      "publicClient": false,
+      "standardFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": true,
+      "secret": "dev-sales-read-agent-secret",
+      "protocolMappers": [
+        {
+          "name": "emcp-gateway-audience",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-audience-mapper",
+          "config": {
+            "included.custom.audience": "emcp-gateway",
+            "id.token.claim": "false",
+            "access.token.claim": "true"
+          }
+        }
+      ]
+    },
+    {
+      "clientId": "sales-write-agent",
+      "name": "Sales.Write agent (README.md §7.1)",
+      "enabled": true,
+      "protocol": "openid-connect",
+      "publicClient": false,
+      "standardFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": true,
+      "secret": "dev-sales-write-agent-secret",
+      "protocolMappers": [
+        {
+          "name": "emcp-gateway-audience",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-audience-mapper",
+          "config": {
+            "included.custom.audience": "emcp-gateway",
+            "id.token.claim": "false",
+            "access.token.claim": "true"
+          }
+        }
+      ]
+    },
+    {
+      "clientId": "finance-payments-agent",
+      "name": "Finance.Payments agent (README.md §7.2)",
+      "enabled": true,
+      "protocol": "openid-connect",
+      "publicClient": false,
+      "standardFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": true,
+      "secret": "dev-finance-payments-agent-secret",
+      "protocolMappers": [
+        {
+          "name": "emcp-gateway-audience",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-audience-mapper",
+          "config": {
+            "included.custom.audience": "emcp-gateway",
+            "id.token.claim": "false",
+            "access.token.claim": "true"
+          }
+        }
+      ]
+    }
+  ]
+}

RI/deploy/otel/collector-config.yaml

@@ -0,0 +1,29 @@
+# EP-08-T04: minimal OTel Collector config for local development.
+#
+# RI services export OTLP/HTTP to this collector (OTEL_EXPORTER_OTLP_ENDPOINT,
+# common/otel.py); the collector forwards to Jaeger's own OTLP/gRPC receiver
+# for the local `jaeger` UI (docker-compose.yml, `observability` profile), and
+# also logs a basic summary of every batch to its own stdout for a quick
+# sanity check without opening the Jaeger UI.
+
+receivers:
+  otlp:
+    protocols:
+      http:
+        endpoint: 0.0.0.0:4318
+      grpc:
+        endpoint: 0.0.0.0:4317
+
+exporters:
+  otlp:
+    endpoint: jaeger:4317
+    tls:
+      insecure: true
+  debug:
+    verbosity: basic
+
+service:
+  pipelines:
+    traces:
+      receivers: [otlp]
+      exporters: [otlp, debug]