diff --git a/docs/deploy/secrets-store.yaml.sample b/docs/deploy/secrets-store.yaml.sample
index 7729be1d4..ae37d3f10 100644
--- a/docs/deploy/secrets-store.yaml.sample
+++ b/docs/deploy/secrets-store.yaml.sample
@@ -72,8 +72,8 @@ insight-local-insight-db-creds: |
 ## shipped local overlay sets authDisabled: true).
 ##
 ## Seven keys; see the umbrella chart's api-gateway secret.yaml for the
-## exact env-var-named schema (APP__modules__oidc-authn-plugin__config__*
-## and APP__modules__auth-info__config__*).
+## exact env-var-named schema (APP__gears__oidc-authn-plugin__config__*
+## and APP__gears__auth-info__config__*).
 # insight-local-insight-oidc: |
 #   apiVersion: v1
 #   kind: Secret
@@ -82,10 +82,10 @@ insight-local-insight-db-creds: |
 #     namespace: insight
 #   type: Opaque
 #   stringData:
-#     APP__modules__oidc-authn-plugin__config__issuer_url: "https://<idp>/..."
-#     APP__modules__oidc-authn-plugin__config__audience:   "<api-audience>"
-#     APP__modules__oidc-authn-plugin__config__jwks_url:   "https://<idp>/.../jwks.json"
-#     APP__modules__auth-info__config__issuer_url:         "https://<idp>/..."
-#     APP__modules__auth-info__config__client_id:          "<client-id>"
-#     APP__modules__auth-info__config__redirect_uri:       "https://<host>/callback"
-#     APP__modules__auth-info__config__scopes:             "openid profile email"
+#     APP__gears__oidc-authn-plugin__config__issuer_url: "https://<idp>/..."
+#     APP__gears__oidc-authn-plugin__config__audience:   "<api-audience>"
+#     APP__gears__oidc-authn-plugin__config__jwks_url:   "https://<idp>/.../jwks.json"
+#     APP__gears__auth-info__config__issuer_url:         "https://<idp>/..."
+#     APP__gears__auth-info__config__client_id:          "<client-id>"
+#     APP__gears__auth-info__config__redirect_uri:       "https://<host>/callback"
+#     APP__gears__auth-info__config__scopes:             "openid profile email"
diff --git a/src/backend/Cargo.lock b/src/backend/Cargo.lock
index 1d6908a57..99925d4e1 100644
--- a/src/backend/Cargo.lock
+++ b/src/backend/Cargo.lock
@@ -48,79 +48,6 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "250f629c0161ad8107cf89319e990051fae62832fd343083bea452d93e2205fd"
 
-[[package]]
-name = "aliri"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96607b3bbf9454cd1043e5c110e4f578dba8a4829a6e82f1cbce951cb98ff8dd"
-dependencies = [
- "aliri_base64",
- "aliri_braid",
- "aliri_clock",
- "once_cell",
- "regex",
- "ring",
- "serde",
- "serde_json",
- "thiserror 1.0.69",
-]
-
-[[package]]
-name = "aliri_base64"
-version = "0.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9d87771969112cbfb21574d11935c2cc37b961b7b1e8e0f146bc1f327d175f4"
-dependencies = [
- "base64",
- "serde",
-]
-
-[[package]]
-name = "aliri_braid"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df233d014e7a9ad9693f08f17eb198251fb75d94c345dcfa4bdedfecc67f24fb"
-dependencies = [
- "aliri_braid_impl",
-]
-
-[[package]]
-name = "aliri_braid_impl"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1eb7c4fcde1858a6796c18a729b661346d38e05a207e2d9028bce822fc20283"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
-[[package]]
-name = "aliri_clock"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c5710b7d6bf6988872bcd82a3e44d89859fe8338f7cd8120913093147cce034"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "aliri_tokens"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d352b7b80e4881473a66a50e4ee1e9563fa1ff9ea242ef0afcabbb8c3db5e66c"
-dependencies = [
- "aliri",
- "aliri_braid",
- "aliri_clock",
- "async-trait",
- "rand 0.8.6",
- "serde",
- "thiserror 1.0.69",
- "tokio",
- "tracing",
-]
-
 [[package]]
 name = "alloc-no-stdlib"
 version = "2.0.4"
@@ -149,7 +76,7 @@ dependencies = [
  "anyhow",
  "async-trait",
  "axum",
- "cf-modkit-canonical-errors",
+ "cf-gears-toolkit-canonical-errors",
  "chrono",
  "clap",
  "clickhouse",
@@ -163,10 +90,9 @@ dependencies = [
  "sea-orm-migration",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror",
  "tokio",
  "tower",
- "tower-http",
  "tracing",
  "tracing-subscriber",
  "uuid",
@@ -248,15 +174,6 @@ version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
-[[package]]
-name = "arbitrary"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
-dependencies = [
- "derive_arbitrary",
-]
-
 [[package]]
 name = "arc-swap"
 version = "1.9.1"
@@ -654,23 +571,25 @@ dependencies = [
 ]
 
 [[package]]
-name = "cf-api-gateway"
-version = "0.1.22"
+name = "cf-gears-api-gateway"
+version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15ed06b5ebda058b4554ae2f239acf5f307e3aa6d76b80f7ca6329f831cb7cb1"
+checksum = "3d394f3069b4d63631cfbeed37f1dd124c78d57f91b311f3b969f6a1ed4f0870"
 dependencies = [
  "anyhow",
  "arc-swap",
  "async-trait",
  "axum",
  "bytes",
- "cf-authn-resolver-sdk",
- "cf-modkit",
- "cf-modkit-http",
- "cf-modkit-macros",
- "cf-modkit-security 0.6.2",
+ "cf-gears-authn-resolver-sdk",
+ "cf-gears-toolkit",
+ "cf-gears-toolkit-canonical-errors",
+ "cf-gears-toolkit-http",
+ "cf-gears-toolkit-macros",
+ "cf-gears-toolkit-security",
  "chrono",
  "dashmap",
+ "glob",
  "governor",
  "http",
  "http-body",
@@ -682,7 +601,7 @@ dependencies = [
  "rust-embed",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror",
  "tokio",
  "tokio-util",
  "tower",
@@ -694,99 +613,125 @@ dependencies = [
 ]
 
 [[package]]
-name = "cf-authn-resolver"
-version = "0.2.8"
+name = "cf-gears-authn-resolver"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0468531f492019f9595d3ffa6caf44994530ad21bd99253b1323d469ab6ff555"
+checksum = "beafcc9824512761cddde127af1a2178ccb791fce8dd0be9813ff3c0070a7750"
 dependencies = [
  "anyhow",
  "async-trait",
- "cf-authn-resolver-sdk",
- "cf-modkit",
- "cf-modkit-macros",
- "cf-modkit-security 0.6.2",
- "cf-types-registry-sdk",
+ "cf-gears-authn-resolver-sdk",
+ "cf-gears-toolkit",
+ "cf-gears-toolkit-macros",
+ "cf-gears-toolkit-security",
+ "cf-gears-types-registry-sdk",
  "inventory",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror",
  "tokio",
  "tracing",
  "uuid",
 ]
 
 [[package]]
-name = "cf-authn-resolver-sdk"
-version = "0.3.8"
+name = "cf-gears-authn-resolver-sdk"
+version = "0.3.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b5eb6ed76eec6c1a895fd7458982861fa6cd7a36ca02d84299aaf09def667cd"
+checksum = "ddf17984762e5aff8afd7ce3ec9f218cd8508a0961f606aee299926ca80d6372"
 dependencies = [
  "async-trait",
- "cf-modkit",
- "cf-modkit-security 0.6.2",
+ "cf-gears-toolkit",
+ "cf-gears-toolkit-gts",
+ "cf-gears-toolkit-security",
  "gts",
  "gts-macros",
  "schemars",
  "secrecy",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror",
  "uuid",
 ]
 
 [[package]]
-name = "cf-authz-resolver"
-version = "0.1.15"
+name = "cf-gears-authz-resolver"
+version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521e75a3361498445bd31e458bf9bc19afedf7d626e411f7a379010727701828"
+checksum = "32c8178f703b42bee63199cbaf697cee1079b96af11e1219917e3edaf392d5ba"
 dependencies = [
  "anyhow",
  "async-trait",
- "cf-authz-resolver-sdk",
- "cf-modkit",
- "cf-modkit-macros",
- "cf-modkit-security 0.6.2",
- "cf-types-registry-sdk",
+ "cf-gears-authz-resolver-sdk",
+ "cf-gears-toolkit",
+ "cf-gears-toolkit-macros",
+ "cf-gears-toolkit-security",
+ "cf-gears-types-registry-sdk",
  "inventory",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror",
  "tokio",
  "tracing",
  "uuid",
 ]
 
 [[package]]
-name = "cf-authz-resolver-sdk"
-version = "0.2.17"
+name = "cf-gears-authz-resolver-sdk"
+version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "172fec6d092b8472dc6af5c942d8690b4b9b6d4abdb856cb2bb626ae3e29f726"
+checksum = "97ff3d7920ee0091c21bc369708357d9877f8af1d05d7e0f60e50cf5cff39ef0"
 dependencies = [
  "async-trait",
- "cf-modkit",
- "cf-modkit-security 0.6.2",
+ "cf-gears-tenant-resolver-sdk",
+ "cf-gears-toolkit",
+ "cf-gears-toolkit-gts",
+ "cf-gears-toolkit-security",
  "gts",
  "gts-macros",
  "schemars",
  "secrecy",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror",
  "tracing",
  "uuid",
 ]
 
 [[package]]
-name = "cf-grpc-hub"
-version = "0.1.18"
+name = "cf-gears-gear-orchestrator"
+version = "0.1.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a9eb8127dd81f5aa281f8688436a628cd46d9365a13f75fd4794fb34265c8ab"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "axum",
+ "cf-gears-system-sdks",
+ "cf-gears-toolkit",
+ "cf-gears-toolkit-macros",
+ "inventory",
+ "parking_lot",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tonic",
+ "tracing",
+ "utoipa",
+ "uuid",
+]
+
+[[package]]
+name = "cf-gears-grpc-hub"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9299804198999d44aa5951a3cea45ce67c349a77d54c3b39564173fb19b1a34"
+checksum = "b0e86975d75aecfc5017adb6e6c87e236ed1d429de541ffc7b982be5476e199a"
 dependencies = [
  "anyhow",
  "async-trait",
- "cf-modkit",
- "cf-modkit-transport-grpc",
- "cf-system-sdks",
+ "cf-gears-system-sdks",
+ "cf-gears-toolkit",
+ "cf-gears-toolkit-transport-grpc",
  "http",
  "inventory",
  "parking_lot",
@@ -801,22 +746,132 @@ dependencies = [
 ]
 
 [[package]]
-name = "cf-modkit"
-version = "0.6.2"
+name = "cf-gears-single-tenant-tr-plugin"
+version = "0.1.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8446d375e3126d01282eec62c0dde30883707718924bc4997554688c7f05e99"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "cf-gears-tenant-resolver-sdk",
+ "cf-gears-toolkit",
+ "cf-gears-toolkit-macros",
+ "cf-gears-toolkit-odata",
+ "cf-gears-toolkit-security",
+ "cf-gears-types-registry-sdk",
+ "inventory",
+ "serde",
+ "serde_json",
+ "tracing",
+ "uuid",
+]
+
+[[package]]
+name = "cf-gears-static-authz-plugin"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f146a77da5d8f065e54cf6863a2f6b7ccc68aa989bb9e5736ddd5ecd1566a1eb"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "cf-gears-authz-resolver-sdk",
+ "cf-gears-toolkit",
+ "cf-gears-toolkit-macros",
+ "cf-gears-toolkit-security",
+ "cf-gears-types-registry-sdk",
+ "inventory",
+ "serde",
+ "serde_json",
+ "tracing",
+ "uuid",
+]
+
+[[package]]
+name = "cf-gears-system-sdk-directory"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3aa9e55ad7434d2bb73549cdb1bbcfc431b6557194fb8299800157085491da85"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "cf-gears-toolkit-transport-grpc",
+ "prost",
+ "tonic",
+ "tonic-prost",
+ "tonic-prost-build",
+ "tracing",
+]
+
+[[package]]
+name = "cf-gears-system-sdks"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8f0273e9570118ee18118abb4957f9505b34c05a01b9ed896abd19a86978f92"
+dependencies = [
+ "cf-gears-system-sdk-directory",
+]
+
+[[package]]
+name = "cf-gears-tenant-resolver"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b40800242c08a93205ece1ff238f78c1890f96bfdb2fc112c9c83d993ddb9159"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "cf-gears-tenant-resolver-sdk",
+ "cf-gears-toolkit",
+ "cf-gears-toolkit-macros",
+ "cf-gears-toolkit-odata",
+ "cf-gears-toolkit-security",
+ "cf-gears-types-registry-sdk",
+ "inventory",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "uuid",
+]
+
+[[package]]
+name = "cf-gears-tenant-resolver-sdk"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "992e2f52fdf80e34ddb75e3423dd0a5fa840a6e04afaeff7df99cd69d6c70ac8"
+dependencies = [
+ "async-trait",
+ "cf-gears-toolkit",
+ "cf-gears-toolkit-gts",
+ "cf-gears-toolkit-odata",
+ "cf-gears-toolkit-security",
+ "gts",
+ "gts-macros",
+ "schemars",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "uuid",
+]
+
+[[package]]
+name = "cf-gears-toolkit"
+version = "0.6.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6ecd43f8f1b12998d606590d0079ff1058b1bbb8643fd44ff789b53daac0357"
+checksum = "1f7556bf5692652891b6f5ca5bc79b7ba1d0edf53469e97a2ec3c4203a297516"
 dependencies = [
  "anyhow",
  "arc-swap",
  "async-trait",
  "axum",
- "cf-modkit-db",
- "cf-modkit-errors 0.6.2",
- "cf-modkit-macros",
- "cf-modkit-odata 0.6.2",
- "cf-modkit-sdk",
- "cf-modkit-utils",
- "cf-system-sdks",
+ "cf-gears-system-sdks",
+ "cf-gears-toolkit-canonical-errors",
+ "cf-gears-toolkit-db",
+ "cf-gears-toolkit-gts",
+ "cf-gears-toolkit-macros",
+ "cf-gears-toolkit-odata",
+ "cf-gears-toolkit-sdk",
+ "cf-gears-toolkit-utils",
  "chrono",
  "dashmap",
  "dsn",
@@ -829,18 +884,19 @@ dependencies = [
  "gts-macros",
  "http",
  "inventory",
- "nix",
+ "nix 0.31.3",
  "opentelemetry",
  "opentelemetry-otlp",
  "opentelemetry_sdk",
  "parking_lot",
+ "rustls",
  "schemars",
  "sea-orm-migration",
  "serde",
- "serde-saphyr 0.0.16",
+ "serde-saphyr 0.0.22",
  "serde_json",
  "supports-color",
- "thiserror 2.0.18",
+ "thiserror",
  "tokio",
  "tokio-stream",
  "tokio-util",
@@ -854,28 +910,26 @@ dependencies = [
  "urlencoding",
  "utoipa",
  "uuid",
- "zip",
 ]
 
 [[package]]
-name = "cf-modkit-auth"
-version = "0.6.1"
+name = "cf-gears-toolkit-auth"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "737fea6cd64551bf5ad37947a44b3df1209aecb7c8340e9c254c9dd19abe9f56"
+checksum = "a8a9c919e9713ec458e3fa3a08f95f127e58f64fcda7837a25c419dcc92beab8"
 dependencies = [
- "aliri_clock",
- "aliri_tokens",
  "arc-swap",
  "async-trait",
  "base64",
- "cf-modkit-http",
- "cf-modkit-security 0.6.2",
- "cf-modkit-utils",
+ "cf-gears-toolkit-http",
+ "cf-gears-toolkit-security",
+ "cf-gears-toolkit-utils",
  "http",
  "jsonwebtoken",
+ "rand 0.10.1",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror",
  "time",
  "tokio",
  "tokio-util",
@@ -887,25 +941,27 @@ dependencies = [
 ]
 
 [[package]]
-name = "cf-modkit-canonical-errors"
-version = "0.7.3"
+name = "cf-gears-toolkit-canonical-errors"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4744fbabb7651e264b83b21085072748c7408824705128086748b0a0080bfaad"
+checksum = "7103d782f9d14dde845c74361e6176d5ff9b2bd80c65dd6ba0ce6777b00ad0e8"
 dependencies = [
  "axum",
- "cf-modkit-canonical-errors-macro",
+ "cf-gears-toolkit-canonical-errors-macro",
  "http",
  "sea-orm",
  "serde",
  "serde_json",
+ "thiserror",
  "tracing",
+ "utoipa",
 ]
 
 [[package]]
-name = "cf-modkit-canonical-errors-macro"
+name = "cf-gears-toolkit-canonical-errors-macro"
 version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5cd2c4573fb82c4dd2e30f7f3fa8859036826e037631c46356a3cea74709413"
+checksum = "e57391e4dbd4eb5512202c63710154c18e7be12ef9a3e492aab32ead073d0c99"
 dependencies = [
  "proc-macro-crate",
  "proc-macro2",
@@ -914,18 +970,18 @@ dependencies = [
 ]
 
 [[package]]
-name = "cf-modkit-db"
-version = "0.7.2"
+name = "cf-gears-toolkit-db"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cd58dba69301bff18a4faf01998009cfbadc9aa93e9636d2a94b2a5aabd1b0a"
+checksum = "c201988105bda08307cbed0bd20467114afe35322fcf3f2249bbae210fee10e4"
 dependencies = [
  "anyhow",
  "async-trait",
  "bigdecimal",
- "cf-modkit-db-macros",
- "cf-modkit-odata 0.7.1",
- "cf-modkit-security 0.7.0",
- "cf-modkit-utils",
+ "cf-gears-toolkit-db-macros",
+ "cf-gears-toolkit-odata",
+ "cf-gears-toolkit-security",
+ "cf-gears-toolkit-utils",
  "chrono",
  "dashmap",
  "dirs",
@@ -936,7 +992,7 @@ dependencies = [
  "sea-orm-migration",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror",
  "time",
  "tokio",
  "tracing",
@@ -946,10 +1002,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "cf-modkit-db-macros"
+name = "cf-gears-toolkit-db-macros"
 version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d60f5a2fb4f50cb38fd0dc0d7ef9933a9f0823a19687b044af6d6c2dd70b3d9b"
+checksum = "25d7fe946ed2d9ad129e2e738439656b0959299d7e3b7831182ddb874321f05f"
 dependencies = [
  "heck 0.5.0",
  "proc-macro-error2",
@@ -959,47 +1015,39 @@ dependencies = [
 ]
 
 [[package]]
-name = "cf-modkit-errors"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b02d4c8a5551afe3a667da6d120c25a17f4eb6be96777f81baf01b96cf81e86f"
-dependencies = [
- "axum",
- "http",
- "serde",
- "tracing",
- "utoipa",
-]
-
-[[package]]
-name = "cf-modkit-errors"
-version = "0.7.0"
+name = "cf-gears-toolkit-gts"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8dc5526c8dc60fb57a63a119140ed0996eb5d7c8748e74a5b53ace92fa037268"
+checksum = "fdb42809a45903114573ec24e56fb0a5b23273313e75411e5e395d7d66eb626d"
 dependencies = [
- "http",
+ "anyhow",
+ "cf-gears-toolkit-gts-macros",
+ "gts",
+ "gts-macros",
+ "inventory",
+ "schemars",
  "serde",
  "serde_json",
 ]
 
 [[package]]
-name = "cf-modkit-errors-macro"
-version = "0.6.3"
+name = "cf-gears-toolkit-gts-macros"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "972d99140d0937911b2b0e368ec06a6bc416b77a37cf94688f45fc2a4e2a9b7e"
+checksum = "6e07cd94a901b36d3d2f2a2d406fd92b0f29e09ecc009e788214d2794454c6e1"
 dependencies = [
+ "gts-macros",
+ "proc-macro-crate",
  "proc-macro2",
  "quote",
- "serde",
- "serde_json",
  "syn 2.0.117",
 ]
 
 [[package]]
-name = "cf-modkit-http"
-version = "0.6.2"
+name = "cf-gears-toolkit-http"
+version = "0.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d200cc3825929770476fb33940cab971c73429a8a8571491235965f63971fcaf"
+checksum = "7a7adc13b6b65bfee1b7c1203c72b2e9759eb998c920109bd6820d724b01593a"
 dependencies = [
  "bytes",
  "http",
@@ -1010,317 +1058,133 @@ dependencies = [
  "hyper-rustls",
  "hyper-util",
  "pin-project-lite",
- "rand 0.9.4",
+ "rand 0.10.1",
  "rustls",
  "rustls-native-certs",
  "rustls-pki-types",
  "serde",
  "serde_json",
  "serde_urlencoded",
- "thiserror 2.0.18",
+ "thiserror",
  "tokio",
  "tower",
  "tower-http",
  "tracing",
+ "webpki-roots",
 ]
 
-[[package]]
-name = "cf-modkit-macros"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e793c53aaab524fef22443b6e2568d6ba7aee892acabf85451decf517899025"
-dependencies = [
- "heck 0.5.0",
- "proc-macro2",
- "quote",
- "strsim",
- "syn 2.0.117",
-]
-
-[[package]]
-name = "cf-modkit-odata"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67e82c56a885ac7f037a4adb43eb86b01068cb2ea525eeb3e360d16c28ac8be3"
-dependencies = [
- "base64",
- "bigdecimal",
- "cf-modkit-errors 0.6.2",
- "cf-modkit-errors-macro",
- "chrono",
- "chrono-tz 0.9.0",
- "hex",
- "http",
- "peg",
- "serde",
- "serde_json",
- "sha2",
- "thiserror 2.0.18",
- "uuid",
-]
-
-[[package]]
-name = "cf-modkit-odata"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1edda2d6bbe1f9b8504a00785cf774e7a3787369a41b3511e23136155007846f"
-dependencies = [
- "base64",
- "bigdecimal",
- "cf-modkit-errors 0.7.0",
- "cf-modkit-errors-macro",
- "chrono",
- "chrono-tz 0.10.4",
- "hex",
- "http",
- "peg",
- "serde",
- "serde_json",
- "sha2",
- "thiserror 2.0.18",
- "uuid",
-]
-
-[[package]]
-name = "cf-modkit-odata"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d88116ec506d129a3b8ca109443f464ea3528002a187d797576064d8632407fc"
-dependencies = [
- "base64",
- "bigdecimal",
- "cf-modkit-errors 0.7.0",
- "cf-modkit-errors-macro",
- "chrono",
- "chrono-tz 0.10.4",
- "hex",
- "http",
- "peg",
- "serde",
- "serde_json",
- "sha2",
- "thiserror 2.0.18",
- "uuid",
-]
-
-[[package]]
-name = "cf-modkit-sdk"
-version = "0.6.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32418515431f41b64d5deed2e21f7b329918341c3dcdf356e1005bce070a2353"
-dependencies = [
- "cf-modkit-odata 0.8.0",
- "cf-modkit-security 0.7.0",
- "futures-core",
- "pin-project-lite",
-]
-
-[[package]]
-name = "cf-modkit-security"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b69bda45f063297919e7f24206e3e94f4632d358b4012dbc95e015c61206b4f"
-dependencies = [
- "anyhow",
- "postcard",
- "secrecy",
- "serde",
- "thiserror 2.0.18",
- "uuid",
-]
-
-[[package]]
-name = "cf-modkit-security"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "980a7564897e2e90d8555c1a294ee4fe67de10b11c41f4f6da05a5486c7a155d"
-dependencies = [
- "anyhow",
- "postcard",
- "secrecy",
- "serde",
- "thiserror 2.0.18",
- "uuid",
-]
-
-[[package]]
-name = "cf-modkit-transport-grpc"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c38037782ada8021a571205b255df4c3cfcafbe717606b8333ff506513c67051"
-dependencies = [
- "anyhow",
- "cf-modkit-security 0.7.0",
- "rand 0.10.1",
- "tokio",
- "tokio-stream",
- "tokio-util",
- "tonic",
- "tracing",
-]
-
-[[package]]
-name = "cf-modkit-utils"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e8daf588a9f311cbd7dc28ed3ae3c1e642d5c8117788e7f24414ad8e781c530"
-dependencies = [
- "humantime",
- "regex",
- "secrecy",
- "serde",
- "zeroize",
-]
-
-[[package]]
-name = "cf-module-orchestrator"
-version = "0.1.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3645464fe6cec8820e777fe2551c8c0659f9d6feb3ec4b975b75afdcd34dcb02"
-dependencies = [
- "anyhow",
- "async-trait",
- "axum",
- "cf-modkit",
- "cf-modkit-macros",
- "cf-system-sdks",
- "inventory",
- "parking_lot",
- "serde",
- "serde_json",
- "tokio",
- "tonic",
- "tracing",
- "utoipa",
- "uuid",
-]
-
-[[package]]
-name = "cf-single-tenant-tr-plugin"
-version = "0.1.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59e9642abc79d4f49bfaff822d8e0160b772e21815316bfad3042f145d3494e6"
-dependencies = [
- "anyhow",
- "async-trait",
- "cf-modkit",
- "cf-modkit-macros",
- "cf-modkit-odata 0.6.2",
- "cf-modkit-security 0.6.2",
- "cf-tenant-resolver-sdk",
- "cf-types-registry-sdk",
- "inventory",
- "serde",
- "serde_json",
- "tracing",
- "uuid",
+[[package]]
+name = "cf-gears-toolkit-macros"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a48041ece24d732e959aedc5e42fd0218c839d4dbd90e5a62123475ec52f9ee9"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 2.0.117",
 ]
 
 [[package]]
-name = "cf-static-authz-plugin"
-version = "0.1.15"
+name = "cf-gears-toolkit-odata"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3838f096cd4126106015f0073080228a51b157a64712d661f13ee0287849c463"
+checksum = "78f7314503a9da67ced132a436f9668bf51004648a7e266a02563a851338aa22"
 dependencies = [
- "anyhow",
- "async-trait",
- "cf-authz-resolver-sdk",
- "cf-modkit",
- "cf-modkit-macros",
- "cf-modkit-security 0.6.2",
- "cf-types-registry-sdk",
- "inventory",
+ "base64",
+ "bigdecimal",
+ "cf-gears-toolkit-canonical-errors",
+ "chrono",
+ "chrono-tz",
+ "hex",
+ "http",
+ "peg",
  "serde",
  "serde_json",
+ "sha2",
+ "thiserror",
  "tracing",
  "uuid",
 ]
 
 [[package]]
-name = "cf-system-sdk-directory"
-version = "0.1.35"
+name = "cf-gears-toolkit-sdk"
+version = "0.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12cad531f9ff82b8eeebad81b2bcb980733e85af1aade8e5c9a20a3957ee0468"
+checksum = "1d26a2ebc3a80059ed1ff41e89eabce6e338af736dd8fc802a963b298649f6a1"
 dependencies = [
- "anyhow",
- "async-trait",
- "cf-modkit-transport-grpc",
- "prost",
- "tonic",
- "tonic-prost",
- "tonic-prost-build",
- "tracing",
+ "cf-gears-toolkit-odata",
+ "cf-gears-toolkit-security",
+ "futures-core",
+ "pin-project-lite",
 ]
 
 [[package]]
-name = "cf-system-sdks"
-version = "0.1.35"
+name = "cf-gears-toolkit-security"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "422482ef901f8ba158779e8a87d7abb38e250995429ef5b36abe406640c25e8a"
+checksum = "79a68d90c8f24469816601577232d2ebb00a7f04fbd137acc117803267505c4b"
 dependencies = [
- "cf-system-sdk-directory",
+ "anyhow",
+ "postcard",
+ "secrecy",
+ "serde",
+ "thiserror",
+ "uuid",
 ]
 
 [[package]]
-name = "cf-tenant-resolver"
-version = "0.1.16"
+name = "cf-gears-toolkit-transport-grpc"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49c3be5470d5e662d3bb22f73a88ab711a15dddbaf120a95886cc0b8c81662cd"
+checksum = "4c30d3fb4ffccec4d5db3bb2999873c5a32907a98599bc8d24a1765f9bd7e3d3"
 dependencies = [
  "anyhow",
- "async-trait",
- "cf-modkit",
- "cf-modkit-macros",
- "cf-modkit-odata 0.6.2",
- "cf-modkit-security 0.6.2",
- "cf-tenant-resolver-sdk",
- "cf-types-registry-sdk",
- "inventory",
- "serde",
- "serde_json",
- "thiserror 2.0.18",
+ "cf-gears-toolkit-security",
+ "rand 0.10.1",
  "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "tonic",
  "tracing",
- "uuid",
 ]
 
 [[package]]
-name = "cf-tenant-resolver-sdk"
-version = "0.2.16"
+name = "cf-gears-toolkit-utils"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf5db767d729ce7ae0012328df0f1c008003b9669d67fcbaa96b18a04d5176dd"
+checksum = "6b361ba77d6cdf16f87ae2cc6e7c092d1424101ecab435c7ef805baf68f0e9b8"
 dependencies = [
- "async-trait",
- "cf-modkit",
- "cf-modkit-odata 0.6.2",
- "cf-modkit-security 0.6.2",
- "gts",
- "gts-macros",
- "schemars",
+ "humantime",
+ "regex",
+ "secrecy",
  "serde",
- "serde_json",
- "thiserror 2.0.18",
- "uuid",
+ "zeroize",
 ]
 
 [[package]]
-name = "cf-types-registry"
-version = "0.1.17"
+name = "cf-gears-types-registry"
+version = "0.1.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed9d1c059c73bc844c779573f4f2c38183436218619c0fb716880b576611a73d"
+checksum = "72e4404b5ceaaed6af129ca66974ee35a9cac24761ea176852d262ee1bcc36ed"
 dependencies = [
  "anyhow",
  "async-trait",
  "axum",
- "cf-modkit",
- "cf-modkit-macros",
- "cf-types-registry-sdk",
+ "cf-gears-toolkit",
+ "cf-gears-toolkit-canonical-errors",
+ "cf-gears-toolkit-gts",
+ "cf-gears-toolkit-macros",
+ "cf-gears-toolkit-utils",
+ "cf-gears-types-registry-sdk",
  "gts",
  "inventory",
+ "lru",
  "parking_lot",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror",
  "tokio",
  "tracing",
  "utoipa",
@@ -1328,15 +1192,15 @@ dependencies = [
 ]
 
 [[package]]
-name = "cf-types-registry-sdk"
-version = "0.1.5"
+name = "cf-gears-types-registry-sdk"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f66f08e07de8531821ab86b1d796861fe9befa6a63878aef2f0399e05f25e23"
+checksum = "d3613e641abefa66d322f18666dcb299cfa89070c7fd6f846b4aef67cba0dfaf"
 dependencies = [
  "async-trait",
  "gts",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror",
  "uuid",
 ]
 
@@ -1377,17 +1241,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "chrono-tz"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93698b29de5e97ad0ae26447b344c482a7284c737d9ddc5f9e52b74a336671bb"
-dependencies = [
- "chrono",
- "chrono-tz-build",
- "phf 0.11.3",
-]
-
 [[package]]
 name = "chrono-tz"
 version = "0.10.4"
@@ -1395,18 +1248,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6139a8597ed92cf816dfb33f5dd6cf0bb93a6adc938f11039f371bc5bcd26c3"
 dependencies = [
  "chrono",
- "phf 0.12.1",
-]
-
-[[package]]
-name = "chrono-tz-build"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c088aee841df9c3041febbb73934cfc39708749bf96dc827e3359cd39ef11b1"
-dependencies = [
- "parse-zoneinfo",
- "phf 0.11.3",
- "phf_codegen",
+ "phf",
 ]
 
 [[package]]
@@ -1475,7 +1317,7 @@ dependencies = [
  "lz4_flex",
  "polonius-the-crab",
  "serde",
- "thiserror 2.0.18",
+ "thiserror",
  "tokio",
  "url",
  "uuid",
@@ -1500,7 +1342,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "30a5efddc880ce9e2573bd867413d9056fa2bea0206af88dec21e72178b9dc74"
 dependencies = [
  "bytes",
- "thiserror 2.0.18",
+ "thiserror",
 ]
 
 [[package]]
@@ -1518,7 +1360,7 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
 dependencies = [
- "thiserror 2.0.18",
+ "thiserror",
 ]
 
 [[package]]
@@ -1751,17 +1593,6 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "derive_arbitrary"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "derive_more"
 version = "2.1.1"
@@ -1887,11 +1718,11 @@ checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"
 
 [[package]]
 name = "enable-ansi-support"
-version = "0.2.1"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa4ff3ae2a9aa54bf7ee0983e59303224de742818c1822d89f07da9856d9bc60"
+checksum = "ea7457668b3da8a4b702f3d79e131aa3e81cd7e81cc95fb2d54fce9f182ecc77"
 dependencies = [
- "windows-sys 0.42.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2277,25 +2108,25 @@ dependencies = [
  "portable-atomic",
  "quanta",
  "rand 0.9.4",
- "smallvec 1.15.1",
+ "smallvec",
  "spinning_top",
  "web-time",
 ]
 
 [[package]]
 name = "gts"
-version = "0.8.4"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cf70de49935aad158ecc91b335a5e1361757a7048417a26e19bd72b2d5bb44d"
+checksum = "2b4da3d02018e3da21fed237cea4ef17bdb7fd4bea4c7d9550573cbcbb66d61b"
 dependencies = [
  "gts-id",
  "jsonschema",
  "schemars",
  "serde",
- "serde-saphyr 0.0.10",
+ "serde-saphyr 0.0.24",
  "serde_json",
  "shellexpand",
- "thiserror 2.0.18",
+ "thiserror",
  "tracing",
  "uuid",
  "walkdir",
@@ -2303,18 +2134,18 @@ dependencies = [
 
 [[package]]
 name = "gts-id"
-version = "0.8.4"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2d137decd946d1034f918cb972069ca22928fe8416348dbbb142b9d4a5eb922"
+checksum = "7375046849cd80b1db1ed549272eb2fab826b13b13e9efb4333a6ec606070c8c"
 dependencies = [
- "thiserror 2.0.18",
+ "thiserror",
 ]
 
 [[package]]
 name = "gts-macros"
-version = "0.8.4"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9140ff93e4f92f38ce91c47a3b7b27df6d581d05d94e435cb31ce91ee4fb391"
+checksum = "8e437588827fff359c11f572a5d05f74a776546230108c3dc6263d131d7cac2b"
 dependencies = [
  "gts-id",
  "proc-macro2",
@@ -2503,9 +2334,9 @@ checksum = "135b12329e5e3ce057a9f972339ea52bc954fe1e9358ef27f95e89716fbc5424"
 
 [[package]]
 name = "hyper"
-version = "1.9.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
+checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -2518,7 +2349,7 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
- "smallvec 1.15.1",
+ "smallvec",
  "tokio",
  "want",
 ]
@@ -2537,7 +2368,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots 1.0.7",
+ "webpki-roots",
 ]
 
 [[package]]
@@ -2655,7 +2486,7 @@ dependencies = [
  "icu_normalizer_data",
  "icu_properties",
  "icu_provider",
- "smallvec 1.15.1",
+ "smallvec",
  "zerovec",
 ]
 
@@ -2719,7 +2550,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
 dependencies = [
  "idna_adapter",
- "smallvec 1.15.1",
+ "smallvec",
  "utf8_iter",
 ]
 
@@ -2769,28 +2600,24 @@ dependencies = [
  "anyhow",
  "async-trait",
  "axum",
- "cf-api-gateway",
- "cf-authn-resolver",
- "cf-authz-resolver",
- "cf-grpc-hub",
- "cf-modkit",
- "cf-modkit-macros",
- "cf-modkit-security 0.6.2",
- "cf-module-orchestrator",
- "cf-single-tenant-tr-plugin",
- "cf-static-authz-plugin",
- "cf-tenant-resolver",
- "cf-types-registry",
- "cf-types-registry-sdk",
+ "cf-gears-api-gateway",
+ "cf-gears-authn-resolver",
+ "cf-gears-authz-resolver",
+ "cf-gears-gear-orchestrator",
+ "cf-gears-grpc-hub",
+ "cf-gears-single-tenant-tr-plugin",
+ "cf-gears-static-authz-plugin",
+ "cf-gears-tenant-resolver",
+ "cf-gears-toolkit",
+ "cf-gears-toolkit-canonical-errors",
+ "cf-gears-types-registry",
  "clap",
  "oidc-authn-plugin",
  "reqwest",
  "serde",
- "serde_json",
  "tokio",
  "tower",
  "tracing",
- "tracing-subscriber",
 ]
 
 [[package]]
@@ -2800,9 +2627,8 @@ dependencies = [
  "clickhouse",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror",
  "time",
- "tokio",
  "tracing",
  "uuid",
 ]
@@ -3001,6 +2827,15 @@ version = "0.4.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "616ec5685824bcc94416c6d4a7a446eea774a31efd7062c8480ba6fd06d7a6e5"
 
+[[package]]
+name = "lru"
+version = "0.16.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f66e8d5d03f609abc3a39e6f08e4164ebf1447a732906d39eb9b99b7919ef39"
+dependencies = [
+ "hashbrown 0.16.1",
+]
+
 [[package]]
 name = "lz4_flex"
 version = "0.11.6"
@@ -3013,7 +2848,7 @@ version = "1.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0aeb26bf5e836cc1c341c8106051b573f1766dfa05aa87f0b98be5e51b02303"
 dependencies = [
- "nix",
+ "nix 0.29.0",
  "serde",
  "winapi",
 ]
@@ -3158,6 +2993,18 @@ dependencies = [
  "memoffset",
 ]
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nohash-hasher"
 version = "0.2.0"
@@ -3215,7 +3062,7 @@ dependencies = [
  "num-iter",
  "num-traits",
  "rand 0.8.6",
- "smallvec 1.15.1",
+ "smallvec",
  "zeroize",
 ]
 
@@ -3296,18 +3143,15 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "cf-authn-resolver-sdk",
- "cf-modkit",
- "cf-modkit-auth",
- "cf-modkit-http",
- "cf-modkit-macros",
- "cf-modkit-security 0.6.2",
- "cf-types-registry-sdk",
+ "cf-gears-authn-resolver-sdk",
+ "cf-gears-toolkit",
+ "cf-gears-toolkit-auth",
+ "cf-gears-toolkit-security",
+ "cf-gears-types-registry-sdk",
  "secrecy",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
- "tokio",
+ "thiserror",
  "tracing",
  "uuid",
 ]
@@ -3377,7 +3221,7 @@ dependencies = [
  "futures-sink",
  "js-sys",
  "pin-project-lite",
- "thiserror 2.0.18",
+ "thiserror",
  "tracing",
 ]
 
@@ -3407,7 +3251,7 @@ dependencies = [
  "opentelemetry_sdk",
  "prost",
  "reqwest",
- "thiserror 2.0.18",
+ "thiserror",
  "tokio",
  "tonic",
  "tracing",
@@ -3438,7 +3282,7 @@ dependencies = [
  "opentelemetry",
  "percent-encoding",
  "rand 0.9.4",
- "thiserror 2.0.18",
+ "thiserror",
  "tokio",
  "tokio-stream",
 ]
@@ -3513,19 +3357,10 @@ dependencies = [
  "cfg-if",
  "libc",
  "redox_syscall 0.5.18",
- "smallvec 1.15.1",
+ "smallvec",
  "windows-link",
 ]
 
-[[package]]
-name = "parse-zoneinfo"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f2a05b18d44e2957b88f96ba460715e295bc1d7510468a2f3d3b44535d26c24"
-dependencies = [
- "regex",
-]
-
 [[package]]
 name = "paste"
 version = "1.0.15"
@@ -3627,51 +3462,13 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "phf"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
-dependencies = [
- "phf_shared 0.11.3",
-]
-
 [[package]]
 name = "phf"
 version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "913273894cec178f401a31ec4b656318d95473527be05c0752cc41cdc32be8b7"
 dependencies = [
- "phf_shared 0.12.1",
-]
-
-[[package]]
-name = "phf_codegen"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a"
-dependencies = [
- "phf_generator",
- "phf_shared 0.11.3",
-]
-
-[[package]]
-name = "phf_generator"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
-dependencies = [
- "phf_shared 0.11.3",
- "rand 0.8.6",
-]
-
-[[package]]
-name = "phf_shared"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
-dependencies = [
- "siphasher",
+ "phf_shared",
 ]
 
 [[package]]
@@ -4129,7 +3926,7 @@ checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
 dependencies = [
  "getrandom 0.2.17",
  "libredox",
- "thiserror 2.0.18",
+ "thiserror",
 ]
 
 [[package]]
@@ -4454,24 +4251,25 @@ dependencies = [
 ]
 
 [[package]]
-name = "saphyr-parser"
-version = "0.0.6"
+name = "saphyr-parser-bw"
+version = "0.0.610"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fb771b59f6b1985d1406325ec28f97cfb14256abcec4fdfb37b36a1766d6af7"
+checksum = "6d643f5e972f17219245b82f038c22cd3c74320bb17c6e8f7e8537de268b1bc6"
 dependencies = [
  "arraydeque",
- "hashlink",
+ "smallvec",
+ "thiserror",
 ]
 
 [[package]]
 name = "saphyr-parser-bw"
-version = "0.0.605"
+version = "0.0.611"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e1aee7486406df3541b5a657204a11be97175a467d77bc98e6d94a66289fb80"
+checksum = "67dec0c833db75dc98957956b303fe447ffc5eb13f2325ef4c2350f7f3aa69e3"
 dependencies = [
  "arraydeque",
- "smallvec 2.0.0-alpha.12",
- "thiserror 2.0.18",
+ "smallvec",
+ "thiserror",
 ]
 
 [[package]]
@@ -4552,7 +4350,7 @@ dependencies = [
  "serde_json",
  "sqlx",
  "strum",
- "thiserror 2.0.18",
+ "thiserror",
  "time",
  "tracing",
  "url",
@@ -4652,7 +4450,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.117",
- "thiserror 2.0.18",
+ "thiserror",
 ]
 
 [[package]]
@@ -4737,39 +4535,40 @@ dependencies = [
 
 [[package]]
 name = "serde-saphyr"
-version = "0.0.10"
+version = "0.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b9e06cddad47cc6214c0c456cf209b99a58b54223e7af2f6d4b88a5a9968499"
+checksum = "546b4da4f679832602a8f8ab8ddc10b6b1d2e1a13b4f9dddcaee499436fa06ad"
 dependencies = [
  "ahash 0.8.12",
+ "annotate-snippets",
  "base64",
  "encoding_rs_io",
+ "getrandom 0.3.4",
  "nohash-hasher",
  "num-traits",
- "ryu",
- "saphyr-parser",
+ "regex",
+ "saphyr-parser-bw 0.0.610",
  "serde",
- "serde_json",
- "smallvec 2.0.0-alpha.12",
+ "smallvec",
+ "zmij",
 ]
 
 [[package]]
 name = "serde-saphyr"
-version = "0.0.16"
+version = "0.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4db5a4a562bcc0017c34cd0efbabf447be783f00576a2a516947f884e6a7ed57"
+checksum = "f83ad47c2f14654528a89495f8d0dbc64173176f8512c7c72386cbe81009f661"
 dependencies = [
  "ahash 0.8.12",
  "annotate-snippets",
  "base64",
  "encoding_rs_io",
+ "getrandom 0.3.4",
  "nohash-hasher",
  "num-traits",
- "regex",
- "saphyr-parser-bw",
+ "saphyr-parser-bw 0.0.611",
  "serde",
- "serde_json",
- "smallvec 2.0.0-alpha.12",
+ "smallvec",
  "zmij",
 ]
 
@@ -4810,7 +4609,6 @@ version = "1.0.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
 dependencies = [
- "indexmap",
  "itoa",
  "memchr",
  "serde",
@@ -4946,7 +4744,7 @@ checksum = "0d585997b0ac10be3c5ee635f1bab02d512760d14b7c468801ac8a01d9ae5f1d"
 dependencies = [
  "num-bigint",
  "num-traits",
- "thiserror 2.0.18",
+ "thiserror",
  "time",
 ]
 
@@ -4971,12 +4769,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "smallvec"
-version = "2.0.0-alpha.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef784004ca8777809dcdad6ac37629f0a97caee4c685fcea805278d81dd8b857"
-
 [[package]]
 name = "socket2"
 version = "0.5.10"
@@ -5067,8 +4859,8 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2",
- "smallvec 1.15.1",
- "thiserror 2.0.18",
+ "smallvec",
+ "thiserror",
  "time",
  "tokio",
  "tokio-stream",
@@ -5152,10 +4944,10 @@ dependencies = [
  "serde",
  "sha1",
  "sha2",
- "smallvec 1.15.1",
+ "smallvec",
  "sqlx-core",
  "stringprep",
- "thiserror 2.0.18",
+ "thiserror",
  "time",
  "tracing",
  "uuid",
@@ -5195,10 +4987,10 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2",
- "smallvec 1.15.1",
+ "smallvec",
  "sqlx-core",
  "stringprep",
- "thiserror 2.0.18",
+ "thiserror",
  "time",
  "tracing",
  "uuid",
@@ -5225,7 +5017,7 @@ dependencies = [
  "serde",
  "serde_urlencoded",
  "sqlx-core",
- "thiserror 2.0.18",
+ "thiserror",
  "time",
  "tracing",
  "url",
@@ -5370,33 +5162,13 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "thiserror"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
-dependencies = [
- "thiserror-impl 1.0.69",
-]
-
 [[package]]
 name = "thiserror"
 version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
 dependencies = [
- "thiserror-impl 2.0.18",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
+ "thiserror-impl",
 ]
 
 [[package]]
@@ -5725,7 +5497,7 @@ checksum = "050686193eb999b4bb3bc2acfa891a13da00f79734704c4b8b4ef1a10b368a3c"
 dependencies = [
  "crossbeam-channel",
  "symlink",
- "thiserror 2.0.18",
+ "thiserror",
  "time",
  "tracing-subscriber",
 ]
@@ -5770,7 +5542,7 @@ checksum = "1ac28f2d093c6c477eaa76b23525478f38de514fa9aeb1285738d4b97a9552fc"
 dependencies = [
  "js-sys",
  "opentelemetry",
- "smallvec 1.15.1",
+ "smallvec",
  "tracing",
  "tracing-core",
  "tracing-log",
@@ -5801,7 +5573,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sharded-slab",
- "smallvec 1.15.1",
+ "smallvec",
  "thread_local",
  "time",
  "tracing",
@@ -5902,18 +5674,31 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "ureq"
-version = "2.12.1"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02d1a66277ed75f640d608235660df48c8e3c19f3b4edb6a263315626cc3c01d"
+checksum = "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0"
 dependencies = [
  "base64",
  "flate2",
  "log",
- "once_cell",
+ "percent-encoding",
  "rustls",
  "rustls-pki-types",
- "url",
- "webpki-roots 0.26.11",
+ "ureq-proto",
+ "utf8-zero",
+ "webpki-roots",
+]
+
+[[package]]
+name = "ureq-proto"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e994ba84b0bd1b1b0cf92878b7ef898a5c1760108fe7b6010327e274917a808c"
+dependencies = [
+ "base64",
+ "http",
+ "httparse",
+ "log",
 ]
 
 [[package]]
@@ -5934,6 +5719,12 @@ version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
 
+[[package]]
+name = "utf8-zero"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8c0a043c9540bae7c578c88f91dda8bd82e59ae27c21baca69c8b191aaf5a6e"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -5972,9 +5763,9 @@ dependencies = [
 
 [[package]]
 name = "uuid"
-version = "1.23.1"
+version = "1.23.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd74a9687298c6858e9b88ec8935ec45d22e8fd5e6394fa1bd4e99a87789c76"
+checksum = "144d6b123cef80b301b8f72a9e2ca4370ddec21950d0a103dd22c437006d2db7"
 dependencies = [
  "getrandom 0.4.2",
  "js-sys",
@@ -6176,15 +5967,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "webpki-roots"
-version = "0.26.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
-dependencies = [
- "webpki-roots 1.0.7",
-]
-
 [[package]]
 name = "webpki-roots"
 version = "1.0.7"
@@ -6305,21 +6087,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.42.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a3e1820f08b8513f676f7ab6c1f99ff312fb97b553d30ff4dd86f9f15728aa7"
-dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.48.0"
@@ -6378,12 +6145,6 @@ dependencies = [
  "windows_x86_64_msvc 0.52.6",
 ]
 
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
-
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.48.5"
@@ -6396,12 +6157,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
-
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
@@ -6414,12 +6169,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
-[[package]]
-name = "windows_i686_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
-
 [[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
@@ -6438,12 +6187,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
-[[package]]
-name = "windows_i686_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
-
 [[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
@@ -6456,12 +6199,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
-
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
@@ -6474,12 +6211,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
-
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.48.5"
@@ -6492,12 +6223,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.42.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
-
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
@@ -6757,37 +6482,8 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "zip"
-version = "2.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fabe6324e908f85a1c52063ce7aa26b68dcb7eb6dbc83a2d148403c9bc3eba50"
-dependencies = [
- "arbitrary",
- "crc32fast",
- "crossbeam-utils",
- "displaydoc",
- "flate2",
- "indexmap",
- "memchr",
- "thiserror 2.0.18",
- "zopfli",
-]
-
 [[package]]
 name = "zmij"
 version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
-
-[[package]]
-name = "zopfli"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
-dependencies = [
- "bumpalo",
- "crc32fast",
- "log",
- "simd-adler32",
-]
diff --git a/src/backend/Cargo.toml b/src/backend/Cargo.toml
index 8ef5106ce..fc80cdf93 100644
--- a/src/backend/Cargo.toml
+++ b/src/backend/Cargo.toml
@@ -48,7 +48,6 @@ futures-util = { version = "0.3", default-features = false, features = ["std"] }
 
 # Web framework
 axum = "0.8"
-tower-http = { version = "0.6", features = ["cors", "trace"] }
 
 # Database (MariaDB via SeaORM)
 sea-orm = { version = "1.1", features = ["runtime-tokio", "sqlx-mysql", "with-uuid", "with-chrono", "with-json", "macros"] }
@@ -75,34 +74,26 @@ redis = { version = "0.27", features = ["tokio-comp", "connection-manager"] }
 # CLI
 clap = { version = "4.5", features = ["derive"] }
 
-# gears-rust toolkit (crates.io)
-#
-# Still published under the legacy `cf-modkit-*` / `cf-*` names. The
-# gears-rust workspace renamed the local packages to `cf-gears-toolkit-*`
-# but the renamed crates have not been pushed to crates.io yet; flip the
-# `package = "..."` strings here when they appear.
-modkit = { package = "cf-modkit", version = "=0.6.2" }
-modkit-auth = { package = "cf-modkit-auth", version = "=0.6.1" }
-modkit-http = { package = "cf-modkit-http", version = "=0.6.2" }
-modkit-security = { package = "cf-modkit-security", version = "=0.6.2" }
-modkit-macros = { package = "cf-modkit-macros", version = "=0.6.2" }
-modkit-canonical-errors = { package = "cf-modkit-canonical-errors", version = "=0.7.3", features = ["axum", "sea-orm"] }
+# gears-rust toolkit (crates.io, `cf-gears-toolkit-*` family)
+toolkit = { package = "cf-gears-toolkit", version = "=0.6.12" }
+toolkit-auth = { package = "cf-gears-toolkit-auth", version = "=0.7.1" }
+toolkit-security = { package = "cf-gears-toolkit-security", version = "=0.7.1" }
+toolkit-canonical-errors = { package = "cf-gears-toolkit-canonical-errors", version = "=0.7.4", features = ["axum", "sea-orm"] }
 
 # gears-rust SDKs (crates.io)
-authn-resolver-sdk = { package = "cf-authn-resolver-sdk", version = "0.3.8" }
-authz-resolver-sdk = { package = "cf-authz-resolver-sdk", version = "0.2.17" }
-types-registry-sdk = { package = "cf-types-registry-sdk", version = "0.1.5" }
-
-# gears-rust system modules (crates.io)
-api-gateway-module = { package = "cf-api-gateway", version = "0.1.22" }
-authn-resolver = { package = "cf-authn-resolver", version = "0.2.8" }
-authz-resolver = { package = "cf-authz-resolver", version = "0.1.15" }
-tenant-resolver = { package = "cf-tenant-resolver", version = "0.1.16" }
-static-authz-plugin = { package = "cf-static-authz-plugin", version = "0.1.15" }
-single-tenant-tr-plugin = { package = "cf-single-tenant-tr-plugin", version = "0.1.17" }
-grpc-hub = { package = "cf-grpc-hub", version = "0.1.18" }
-module-orchestrator = { package = "cf-module-orchestrator", version = "0.1.18" }
-types-registry = { package = "cf-types-registry", version = "0.1.17" }
+authn-resolver-sdk = { package = "cf-gears-authn-resolver-sdk", version = "0.3.17" }
+types-registry-sdk = { package = "cf-gears-types-registry-sdk", version = "0.2.3" }
+
+# gears-rust system gears (crates.io)
+api_gateway = { package = "cf-gears-api-gateway", version = "0.2.8" }
+authn-resolver = { package = "cf-gears-authn-resolver", version = "0.2.17" }
+authz-resolver = { package = "cf-gears-authz-resolver", version = "0.1.24" }
+tenant-resolver = { package = "cf-gears-tenant-resolver", version = "0.1.21" }
+static-authz-plugin = { package = "cf-gears-static-authz-plugin", version = "0.1.20" }
+single-tenant-tr-plugin = { package = "cf-gears-single-tenant-tr-plugin", version = "0.1.22" }
+grpc_hub = { package = "cf-gears-grpc-hub", version = "0.2.7" }
+gear_orchestrator = { package = "cf-gears-gear-orchestrator", version = "0.1.26" }
+types_registry = { package = "cf-gears-types-registry", version = "0.1.22" }
 
 # Config
 figment = { version = "0.10", features = ["yaml", "env"] }
@@ -111,5 +102,5 @@ figment = { version = "0.10", features = ["yaml", "env"] }
 insight-clickhouse = { path = "libs/insight-clickhouse" }
 
 # CI rebuild marker — bumped to retrigger the api-gateway + analytics-api
-# image builds on the constructorfabric/* namespace flip (2026-06-09 11:32).
+# image builds on the cf → gears crate migration (2026-06-12).
 
diff --git a/src/backend/libs/insight-clickhouse/Cargo.toml b/src/backend/libs/insight-clickhouse/Cargo.toml
index 66d4dec37..510d127ad 100644
--- a/src/backend/libs/insight-clickhouse/Cargo.toml
+++ b/src/backend/libs/insight-clickhouse/Cargo.toml
@@ -16,7 +16,6 @@ clickhouse = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
-tokio = { workspace = true }
 uuid = { workspace = true }
 time = { workspace = true }
 tracing = { workspace = true }
diff --git a/src/backend/plugins/oidc-authn-plugin/Cargo.toml b/src/backend/plugins/oidc-authn-plugin/Cargo.toml
index aa2c88345..d7a7862ff 100644
--- a/src/backend/plugins/oidc-authn-plugin/Cargo.toml
+++ b/src/backend/plugins/oidc-authn-plugin/Cargo.toml
@@ -13,17 +13,14 @@ workspace = true
 
 [dependencies]
 # gears-rust
-modkit = { workspace = true }
-modkit-auth = { workspace = true }
-modkit-http = { workspace = true }
-modkit-security = { workspace = true }
-modkit-macros = { workspace = true }
+toolkit = { workspace = true }
+toolkit-auth = { workspace = true }
+toolkit-security = { workspace = true }
 authn-resolver-sdk = { workspace = true }
 types-registry-sdk = { workspace = true }
 
 # Async
 async-trait = { workspace = true }
-tokio = { workspace = true }
 
 # Serialization
 serde = { workspace = true }
diff --git a/src/backend/plugins/oidc-authn-plugin/README.md b/src/backend/plugins/oidc-authn-plugin/README.md
index 5a3329b1c..ab787f857 100644
--- a/src/backend/plugins/oidc-authn-plugin/README.md
+++ b/src/backend/plugins/oidc-authn-plugin/README.md
@@ -14,7 +14,7 @@ A cyberfabric `authn-resolver` plugin that validates JWT bearer tokens against a
 ## Configuration
 
 ```yaml
-modules:
+gears:
   oidc-authn-plugin:
     config:
       vendor: "hyperspot"
@@ -45,8 +45,8 @@ modules:
 ### Environment variable overrides
 
 ```bash
-export APP__modules__oidc-authn-plugin__config__issuer_url=https://dev-12345.okta.com/oauth2/default
-export APP__modules__oidc-authn-plugin__config__audience=api://insight
+export APP__gears__oidc-authn-plugin__config__issuer_url=https://dev-12345.okta.com/oauth2/default
+export APP__gears__oidc-authn-plugin__config__audience=api://insight
 ```
 
 ## Claim mapping
diff --git a/src/backend/plugins/oidc-authn-plugin/src/domain/service.rs b/src/backend/plugins/oidc-authn-plugin/src/domain/service.rs
index 6b0ff28e3..74a90a094 100644
--- a/src/backend/plugins/oidc-authn-plugin/src/domain/service.rs
+++ b/src/backend/plugins/oidc-authn-plugin/src/domain/service.rs
@@ -1,13 +1,13 @@
 //! OIDC token validation service.
 //!
-//! Uses `modkit-auth` `JwksKeyProvider` for JWT signature validation
+//! Uses `toolkit-auth` `JwksKeyProvider` for JWT signature validation
 //! and `validate_claims` for standard claim checks.
 
-use modkit_auth::traits::KeyProvider;
-use modkit_auth::{JwksKeyProvider, ValidationConfig, validate_claims};
-use modkit_security::SecurityContext;
 use secrecy::SecretString;
 use std::sync::Arc;
+use toolkit_auth::traits::KeyProvider;
+use toolkit_auth::{JwksKeyProvider, ValidationConfig, validate_claims};
+use toolkit_security::SecurityContext;
 use uuid::Uuid;
 
 use crate::config::OidcAuthnPluginConfig;
diff --git a/src/backend/plugins/oidc-authn-plugin/src/module.rs b/src/backend/plugins/oidc-authn-plugin/src/module.rs
index 373a66927..17ec6c5fd 100644
--- a/src/backend/plugins/oidc-authn-plugin/src/module.rs
+++ b/src/backend/plugins/oidc-authn-plugin/src/module.rs
@@ -1,6 +1,6 @@
 //! OIDC `AuthN` plugin module registration.
 //!
-//! Registers with the cyberfabric runtime via the `#[modkit::module]` macro.
+//! Registers with the cyberfabric runtime via the `#[toolkit::gear]` macro.
 //! Discovered by `authn-resolver` gateway via the GTS types-registry.
 
 use std::sync::{Arc, OnceLock};
@@ -8,10 +8,10 @@ use std::time::Duration;
 
 use async_trait::async_trait;
 use authn_resolver_sdk::{AuthNResolverPluginClient, AuthNResolverPluginSpecV1};
-use modkit::Module;
-use modkit::client_hub::ClientScope;
-use modkit::context::ModuleCtx;
-use modkit::gts::BaseModkitPluginV1;
+use toolkit::Gear;
+use toolkit::client_hub::ClientScope;
+use toolkit::context::GearCtx;
+use toolkit::gts::PluginV1;
 use tracing::info;
 use types_registry_sdk::{RegisterResult, TypesRegistryClient};
 
@@ -23,7 +23,7 @@ use crate::domain::service::OidcService;
 ///
 /// Validates JWT bearer tokens against an OIDC provider (Okta, Keycloak, Auth0, etc.)
 /// using JWKS key discovery.
-#[modkit::module(
+#[toolkit::gear(
     name = "oidc-authn-plugin",
     deps = ["types-registry"]
 )]
@@ -40,14 +40,14 @@ impl Default for OidcAuthnPlugin {
 }
 
 #[async_trait]
-impl Module for OidcAuthnPlugin {
-    async fn init(&self, ctx: &ModuleCtx) -> anyhow::Result<()> {
+impl Gear for OidcAuthnPlugin {
+    async fn init(&self, ctx: &GearCtx) -> anyhow::Result<()> {
         let config: OidcAuthnPluginConfig = ctx.config()?;
 
         if config.issuer_url.is_empty() {
             anyhow::bail!(
                 "oidc-authn-plugin: issuer_url is required. \
-                 Set modules.oidc-authn-plugin.config.issuer_url in your config."
+                 Set gears.oidc-authn-plugin.config.issuer_url in your config."
             );
         }
 
@@ -69,14 +69,14 @@ impl Module for OidcAuthnPlugin {
             "initializing OIDC authn plugin"
         );
 
-        // Create JWKS key provider using modkit-auth
+        // Create JWKS key provider using toolkit-auth
         let key_provider = Arc::new(
-            modkit_auth::JwksKeyProvider::new(config.effective_jwks_url())?
+            toolkit_auth::JwksKeyProvider::new(config.effective_jwks_url())?
                 .with_refresh_interval(Duration::from_secs(config.jwks_refresh_interval_seconds)),
         );
 
         // Initial key fetch — log warning if IdP is unreachable, don't crash
-        match modkit_auth::traits::KeyProvider::refresh_keys(key_provider.as_ref()).await {
+        match toolkit_auth::traits::KeyProvider::refresh_keys(key_provider.as_ref()).await {
             Ok(()) => info!("JWKS keys loaded successfully"),
             Err(e) => tracing::warn!(
                 error = %e,
@@ -95,7 +95,7 @@ impl Module for OidcAuthnPlugin {
 
         // Register plugin instance in types-registry (fallible — do before OnceLock)
         let registry = ctx.client_hub().get::<dyn TypesRegistryClient>()?;
-        let instance = BaseModkitPluginV1::<AuthNResolverPluginSpecV1> {
+        let instance = PluginV1::<AuthNResolverPluginSpecV1> {
             id: instance_id.clone(),
             vendor: config.vendor.clone(),
             priority: config.priority,
diff --git a/src/backend/services/analytics-api/Cargo.toml b/src/backend/services/analytics-api/Cargo.toml
index 2112a4fa3..0a72e37ba 100644
--- a/src/backend/services/analytics-api/Cargo.toml
+++ b/src/backend/services/analytics-api/Cargo.toml
@@ -19,10 +19,9 @@ insight-clickhouse = { workspace = true }
 clickhouse = { workspace = true }
 
 axum = { workspace = true }
-tower-http = { workspace = true }
 sea-orm = { workspace = true }
 sea-orm-migration = { workspace = true }
-modkit-canonical-errors = { workspace = true }
+toolkit-canonical-errors = { workspace = true }
 reqwest = { workspace = true }
 redis = { workspace = true }
 
diff --git a/src/backend/services/analytics-api/src/api/admin/error_map.rs b/src/backend/services/analytics-api/src/api/admin/error_map.rs
index a66f57e4d..bb7ffbbf8 100644
--- a/src/backend/services/analytics-api/src/api/admin/error_map.rs
+++ b/src/backend/services/analytics-api/src/api/admin/error_map.rs
@@ -26,7 +26,7 @@
 //!
 //! ## Why we sometimes set `Problem.detail` directly
 //!
-//! `modkit-canonical-errors` v0.7.3's `ResourceErrorBuilder::with_detail`
+//! `toolkit-canonical-errors` v0.7.3's `ResourceErrorBuilder::with_detail`
 //! is `pub(crate)` — only callable inside the crate. The public builder
 //! pre-sets the canonical default detail string for each category
 //! ("You do not have permission to perform this operation", etc.). For
@@ -39,9 +39,9 @@
 
 use axum::http::{HeaderValue, header};
 use axum::response::{IntoResponse, Response};
-use modkit_canonical_errors::{CanonicalError, Problem};
 use sea_orm::DbErr;
 use serde_json::json;
+use toolkit_canonical_errors::{CanonicalError, Problem};
 use uuid::Uuid;
 
 use crate::api::error::ThresholdAdminError;
@@ -475,7 +475,7 @@ mod tests {
             "gts://gts.cf.core.errors.err.v1~cf.core.err.failed_precondition.v1~"
         );
         assert_eq!(body["context"]["resource_name"], row_id.to_string());
-        // The cyberfabric `modkit-canonical-errors` crate serializes the
+        // The cyberfabric `toolkit-canonical-errors` crate serializes the
         // `FailedPrecondition` ctx as `context.violations` (not
         // `context.precondition_violations`); DESIGN §3.3 example shows
         // the latter — cross-team alignment is a follow-up. We pin to
@@ -506,7 +506,7 @@ mod tests {
         let resp = lock_reason_required_response(None);
         assert_eq!(resp.status(), 400);
         let body = body_json(resp).await;
-        // The cyberfabric `modkit-canonical-errors` crate serializes the
+        // The cyberfabric `toolkit-canonical-errors` crate serializes the
         // `FailedPrecondition` ctx as `context.violations` (not
         // `context.precondition_violations`); DESIGN §3.3 example shows
         // the latter — cross-team alignment is a follow-up. We pin to
@@ -523,7 +523,7 @@ mod tests {
         let resp = lock_scope_invalid_response(None);
         assert_eq!(resp.status(), 400);
         let body = body_json(resp).await;
-        // The cyberfabric `modkit-canonical-errors` crate serializes the
+        // The cyberfabric `toolkit-canonical-errors` crate serializes the
         // `FailedPrecondition` ctx as `context.violations` (not
         // `context.precondition_violations`); DESIGN §3.3 example shows
         // the latter — cross-team alignment is a follow-up. We pin to
diff --git a/src/backend/services/analytics-api/src/api/canonical_json.rs b/src/backend/services/analytics-api/src/api/canonical_json.rs
index 6bc6fc5ed..8f7596ed0 100644
--- a/src/backend/services/analytics-api/src/api/canonical_json.rs
+++ b/src/backend/services/analytics-api/src/api/canonical_json.rs
@@ -50,16 +50,16 @@
 //! TODO: when admin-crud (#525) and any future POST/PUT handler ships,
 //! the duplication this module prevents will be visible. If a third
 //! cyberfabric service grows the same need, upstream `CanonicalJson` to
-//! `cf-modkit-canonical-errors` (where `Problem` already lives) and
+//! `cf-gears-toolkit-canonical-errors` (where `Problem` already lives) and
 //! drop this module.
 
 use axum::Json;
 use axum::extract::{FromRequest, Request, rejection::JsonRejection};
 use axum::http::StatusCode;
 use axum::response::{IntoResponse, Response};
-use modkit_canonical_errors::Problem;
 use serde::de::DeserializeOwned;
 use serde_json::json;
+use toolkit_canonical_errors::Problem;
 
 /// GTS type URI for the canonical `invalid_argument` category. Mirrors what
 /// `CanonicalError::gts_type` would emit for the same variant; we build the
@@ -69,7 +69,7 @@ const INVALID_ARGUMENT_TYPE: &str =
     "gts://gts.cf.core.errors.err.v1~cf.core.err.invalid_argument.v1~";
 
 /// GTS type URI for the catalog-local `unsupported_media_type` category.
-/// `modkit-canonical-errors` v0.7.3 doesn't expose a builder for this
+/// `toolkit-canonical-errors` v0.7.3 doesn't expose a builder for this
 /// category (it maps every variant to a fixed HTTP status from a closed
 /// set, and 415 isn't in the set). When the upstream crate grows the
 /// variant, swap this constant for the standard `CanonicalError::gts_type`
diff --git a/src/backend/services/analytics-api/src/api/catalog.rs b/src/backend/services/analytics-api/src/api/catalog.rs
index e15916d4b..d4d65d120 100644
--- a/src/backend/services/analytics-api/src/api/catalog.rs
+++ b/src/backend/services/analytics-api/src/api/catalog.rs
@@ -19,7 +19,7 @@ use std::sync::Arc;
 
 use axum::extract::{Extension, State};
 use axum::response::{IntoResponse, Response};
-use modkit_canonical_errors::CanonicalError;
+use toolkit_canonical_errors::CanonicalError;
 
 use super::AppState;
 use super::canonical_json::CanonicalJson;
diff --git a/src/backend/services/analytics-api/src/api/error.rs b/src/backend/services/analytics-api/src/api/error.rs
index 9085a5604..025fefc03 100644
--- a/src/backend/services/analytics-api/src/api/error.rs
+++ b/src/backend/services/analytics-api/src/api/error.rs
@@ -2,14 +2,14 @@
 //!
 //! Each unit struct binds a GTS resource namespace and exposes builder-style
 //! constructors (`not_found`, `invalid_argument`, …) from the
-//! `modkit-canonical-errors` crate. The resulting `CanonicalError` serializes
+//! `toolkit-canonical-errors` crate. The resulting `CanonicalError` serializes
 //! to an RFC 9457 `application/problem+json` envelope via the crate's
 //! `IntoResponse` impl.
 //!
 //! See `docs/domain/metric-catalog/specs/DESIGN.md` §3.3 (Error Envelope)
 //! and DNA `REST/API.md §7` for the platform-wide contract.
 
-use modkit_canonical_errors::resource_error;
+use toolkit_canonical_errors::resource_error;
 
 #[resource_error("gts.cf.insight.analytics_api.metric.v1~")]
 pub struct MetricError;
@@ -78,7 +78,7 @@ mod tests {
     use axum::body::to_bytes;
     use axum::http::header::CONTENT_TYPE;
     use axum::response::IntoResponse;
-    use modkit_canonical_errors::{CanonicalError, Problem};
+    use toolkit_canonical_errors::{CanonicalError, Problem};
 
     use super::*;
 
diff --git a/src/backend/services/analytics-api/src/api/handlers.rs b/src/backend/services/analytics-api/src/api/handlers.rs
index ab115204e..a6c7945cc 100644
--- a/src/backend/services/analytics-api/src/api/handlers.rs
+++ b/src/backend/services/analytics-api/src/api/handlers.rs
@@ -7,8 +7,8 @@ use axum::Json;
 use axum::extract::{Extension, Path, State};
 use axum::http::StatusCode;
 use axum::response::IntoResponse;
-use modkit_canonical_errors::{CanonicalError, Problem};
 use sea_orm::{ActiveModelTrait, ColumnTrait, Condition, EntityTrait, NotSet, QueryFilter, Set};
+use toolkit_canonical_errors::{CanonicalError, Problem};
 use uuid::Uuid;
 
 use super::AppState;
diff --git a/src/backend/services/analytics-api/src/auth.rs b/src/backend/services/analytics-api/src/auth.rs
index 39bc32783..7bcb8ed37 100644
--- a/src/backend/services/analytics-api/src/auth.rs
+++ b/src/backend/services/analytics-api/src/auth.rs
@@ -22,7 +22,7 @@ use std::sync::Arc;
 use axum::extract::{Request, State};
 use axum::middleware::Next;
 use axum::response::{IntoResponse, Response};
-use modkit_canonical_errors::CanonicalError;
+use toolkit_canonical_errors::CanonicalError;
 use uuid::Uuid;
 
 use crate::api::error::TenantError;
diff --git a/src/backend/services/analytics-api/src/domain/query.rs b/src/backend/services/analytics-api/src/domain/query.rs
index ccab3ea94..c47eecadd 100644
--- a/src/backend/services/analytics-api/src/domain/query.rs
+++ b/src/backend/services/analytics-api/src/domain/query.rs
@@ -1,7 +1,7 @@
 //! Query request/response models — `OData`-style per DNA REST conventions.
 
-use modkit_canonical_errors::Problem;
 use serde::{Deserialize, Serialize};
+use toolkit_canonical_errors::Problem;
 use uuid::Uuid;
 
 /// Query request body for `POST /v1/metrics/{id}/query`.
diff --git a/src/backend/services/api-gateway/Cargo.toml b/src/backend/services/api-gateway/Cargo.toml
index 6ea069560..8f5f3a25f 100644
--- a/src/backend/services/api-gateway/Cargo.toml
+++ b/src/backend/services/api-gateway/Cargo.toml
@@ -17,36 +17,32 @@ workspace = true
 
 [dependencies]
 # gears-rust
-modkit = { workspace = true, features = ["bootstrap"] }
+toolkit = { workspace = true, features = ["bootstrap"] }
 
-# System modules (linked via inventory for runtime discovery)
-api-gateway-module = { workspace = true }
+# System gears (linked via inventory for runtime discovery)
+api_gateway = { workspace = true }
 authn-resolver = { workspace = true }
 authz-resolver = { workspace = true }
 tenant-resolver = { workspace = true }
-grpc-hub = { workspace = true }
-module-orchestrator = { workspace = true }
-types-registry = { workspace = true }
-types-registry-sdk = { workspace = true }
+grpc_hub = { workspace = true }
+gear_orchestrator = { workspace = true }
+types_registry = { workspace = true }
 
 # Plugins
 static-authz-plugin = { workspace = true }
 single-tenant-tr-plugin = { workspace = true }
 oidc-authn-plugin = { path = "../../plugins/oidc-authn-plugin" }
 
-# Auth info + proxy modules
-modkit-macros = { workspace = true }
-modkit-security = { workspace = true }
+# Auth info + proxy gears
+toolkit-canonical-errors = { workspace = true }
 async-trait = { workspace = true }
 axum = "0.8"
 reqwest = { workspace = true }
 serde = { workspace = true }
-serde_json = { workspace = true }
 
 # Runtime
 tokio = { workspace = true }
 tracing = { workspace = true }
-tracing-subscriber = { workspace = true }
 anyhow = { workspace = true }
 clap = { workspace = true }
 
diff --git a/src/backend/services/api-gateway/README.md b/src/backend/services/api-gateway/README.md
index 27c02f4f7..6af371cfc 100644
--- a/src/backend/services/api-gateway/README.md
+++ b/src/backend/services/api-gateway/README.md
@@ -4,7 +4,7 @@ HTTP entry point for all Insight backend services. Built on cyberfabric-core Mod
 
 ## What it does
 
-- Routes HTTP requests to backend service modules
+- Routes HTTP requests to backend service gears
 - Validates JWT bearer tokens against an OIDC provider (Okta, Keycloak, Auth0, etc.)
 - Enforces RBAC and tenant isolation via authz-resolver
 - Provides OpenAPI documentation, CORS, rate limiting, request tracing
@@ -41,7 +41,7 @@ Configuration is loaded in layers (highest priority last):
 
 1. **Defaults** — hardcoded in code
 2. **YAML file** — `-c config/insight.yaml`
-3. **Environment variables** — `APP__modules__<module>__config__<key>`
+3. **Environment variables** — `APP__gears__<gear>__config__<key>`
 4. **CLI flags** — `--verbose`, `--print-config`
 
 ### Key environment variables
@@ -50,8 +50,8 @@ Configuration is loaded in layers (highest priority last):
 |----------|-------------|---------|
 | `OIDC_ISSUER_URL` | OIDC issuer URL | `https://dev-12345.okta.com/oauth2/default` |
 | `OIDC_AUDIENCE` | Expected JWT audience | `api://insight` |
-| `APP__modules__api-gateway__config__bind_addr` | Listen address | `0.0.0.0:8080` |
-| `APP__modules__api-gateway__config__auth_disabled` | Disable auth | `true` |
+| `APP__gears__api-gateway__config__bind_addr` | Listen address | `0.0.0.0:8080` |
+| `APP__gears__api-gateway__config__auth_disabled` | Disable auth | `true` |
 
 ### Okta setup
 
@@ -112,24 +112,24 @@ helm install insight-gw ./helm --set authDisabled=true
 ## Architecture
 
 ```text
-Client → Ingress → API Gateway → [Auth Middleware] → Service Modules
+Client → Ingress → API Gateway → [Auth Middleware] → Service Gears
                                        │
                                        ├── OIDC Plugin (JWT validation via JWKS)
                                        ├── AuthZ Resolver (RBAC + org scoping)
                                        └── Tenant Resolver (workspace isolation)
 ```
 
-The gateway is a cyberfabric-core ModKit server binary that links:
+The gateway is a gears-rust Toolkit server binary that links:
 
-| Module | Purpose |
-|--------|---------|
+| Gear | Purpose |
+|------|---------|
 | `api-gateway` | Axum HTTP server, routing, OpenAPI, CORS, rate limiting |
 | `oidc-authn-plugin` | JWT validation against OIDC provider |
 | `authn-resolver` | Authentication gateway (delegates to OIDC plugin) |
 | `authz-resolver` | Authorization (static plugin now, org-tree plugin later) |
 | `tenant-resolver` | Multi-tenant workspace isolation |
 | `grpc-hub` | Internal gRPC communication |
-| `module-orchestrator` | Module lifecycle management |
+| `gear-orchestrator` | Gear lifecycle management |
 | `types-registry` | GTS type/plugin discovery |
 
 ## Public endpoints (no auth required)
diff --git a/src/backend/services/api-gateway/config/insight.yaml b/src/backend/services/api-gateway/config/insight.yaml
index 486dca216..0f14a6372 100644
--- a/src/backend/services/api-gateway/config/insight.yaml
+++ b/src/backend/services/api-gateway/config/insight.yaml
@@ -1,7 +1,7 @@
 # Insight API Gateway Configuration
 #
-# Environment variable overrides: APP__modules__<module>__config__<key>
-# Example: APP__modules__oidc-authn-plugin__config__issuer_url=https://dev-123.okta.com/oauth2/default
+# Environment variable overrides: APP__gears__<gear>__config__<key>
+# Example: APP__gears__oidc-authn-plugin__config__issuer_url=https://dev-123.okta.com/oauth2/default
 
 server:
   home_dir: "/app/data"
@@ -14,7 +14,7 @@ logging:
   api-gateway:
     console_level: debug
 
-modules:
+gears:
   api-gateway:
     config:
       bind_addr: "0.0.0.0:8080"
@@ -36,7 +36,7 @@ modules:
       # When false, OIDC plugin validates JWT tokens.
       auth_disabled: false
 
-  module-orchestrator:
+  gear-orchestrator:
     config: {}
 
   grpc-hub:
@@ -50,8 +50,8 @@ modules:
 
   # OIDC/JWT plugin — validates bearer tokens against IdP (Okta, Keycloak, etc.)
   # Required env vars for production:
-  #   APP__modules__oidc-authn-plugin__config__issuer_url
-  #   APP__modules__oidc-authn-plugin__config__audience
+  #   APP__gears__oidc-authn-plugin__config__issuer_url
+  #   APP__gears__oidc-authn-plugin__config__audience
   oidc-authn-plugin:
     config:
       vendor: "hyperspot"
@@ -94,17 +94,13 @@ modules:
     config:
       vendor: "hyperspot"
 
+  # Zero-config in the gears-rust split: the plugin derives the tenant from
+  # the SecurityContext at request time (JWT claims when auth is enabled, or
+  # toolkit-security's DEFAULT_TENANT_ID when auth_disabled=true).
   single-tenant-tr-plugin:
     config:
       vendor: "hyperspot"
       priority: 20
-      tenants:
-        # Default tenant — used when a single workspace is deployed.
-        # Replace with dynamic tenant resolution for multi-tenant deployments.
-        - id: "00000000-df51-5b42-9538-d2b56b7ee953"
-          name: "default"
-          parent_id: null
-          status: active
 
   # ─── Reverse Proxy ─────────────────────────────────────────
   # Routes requests to downstream services after authentication.
@@ -117,6 +113,6 @@ modules:
 
 # ─── Local development ──────────────────────────────────────
 # To run without OIDC (auth disabled), override:
-#   modules.api-gateway.config.auth_disabled: true
+#   gears.api-gateway.config.auth_disabled: true
 # Or use the no-auth config:
 #   insight-api-gateway run -c config/no-auth.yaml
diff --git a/src/backend/services/api-gateway/config/no-auth.yaml b/src/backend/services/api-gateway/config/no-auth.yaml
index f1ff5b485..ea0734598 100644
--- a/src/backend/services/api-gateway/config/no-auth.yaml
+++ b/src/backend/services/api-gateway/config/no-auth.yaml
@@ -12,7 +12,7 @@ logging:
   default:
     console_level: debug
 
-modules:
+gears:
   api-gateway:
     config:
       bind_addr: "0.0.0.0:8080"
@@ -31,7 +31,7 @@ modules:
       client_id: ""
       redirect_uri: "http://localhost:3000/callback"
 
-  # The oidc-authn-plugin module is registered in the binary regardless of
+  # The oidc-authn-plugin gear is registered in the binary regardless of
   # whether auth is in use. It rejects an empty issuer_url at startup, so
   # we hand it a placeholder URL that is never actually contacted because
   # api-gateway.auth_disabled=true short-circuits the validator. Replace
@@ -40,7 +40,7 @@ modules:
     config:
       issuer_url: "https://no-auth.local/oauth2/default"
 
-  module-orchestrator:
+  gear-orchestrator:
     config: {}
 
   grpc-hub:
@@ -64,15 +64,13 @@ modules:
     config:
       vendor: "hyperspot"
 
+  # Zero-config in the gears-rust split: the plugin now derives the tenant
+  # from the SecurityContext at request time. With api-gateway.auth_disabled,
+  # toolkit-security injects DEFAULT_TENANT_ID (00000000-df51-5b42-9538-…).
   single-tenant-tr-plugin:
     config:
       vendor: "hyperspot"
       priority: 20
-      tenants:
-        - id: "00000000-df51-5b42-9538-d2b56b7ee953"
-          name: "default"
-          parent_id: null
-          status: active
 
   proxy:
     config:
diff --git a/src/backend/services/api-gateway/helm/templates/configmap.yaml b/src/backend/services/api-gateway/helm/templates/configmap.yaml
index 2c4ef2acf..7d42c94b4 100644
--- a/src/backend/services/api-gateway/helm/templates/configmap.yaml
+++ b/src/backend/services/api-gateway/helm/templates/configmap.yaml
@@ -13,7 +13,7 @@ data:
       default:
         console_level: info
 
-    modules:
+    gears:
       api-gateway:
         config:
           bind_addr: "0.0.0.0:{{ .Values.service.port }}"
@@ -32,7 +32,7 @@ data:
               burst: {{ .Values.gateway.rateLimit.burst }}
               in_flight: {{ .Values.gateway.rateLimit.inFlight }}
 
-      module-orchestrator:
+      gear-orchestrator:
         config: {}
 
       grpc-hub:
@@ -87,7 +87,7 @@ data:
           # expected a string` on api-gateway init when running with
           # authDisabled=true (no Secret mounted) or with a BYO
           # `oidc.existingSecret` that does NOT include the
-          # `APP__modules__auth-info__config__scopes` env-var override.
+          # `APP__gears__auth-info__config__scopes` env-var override.
           # In Secret-injected paths the env-var still wins (envFrom
           # overrides envFrom-loaded YAML); this fallback covers the
           # configmap-only paths.
@@ -106,20 +106,15 @@ data:
         config:
           vendor: "hyperspot"
 
+      # Zero-config in the gears-rust split: the plugin derives the tenant
+      # from the SecurityContext at request time (JWT claims when auth is
+      # enabled, or toolkit-security's DEFAULT_TENANT_ID when
+      # authDisabled=true). The umbrella's `global.tenantDefaultId` is
+      # therefore no longer consumed here.
       single-tenant-tr-plugin:
         config:
           vendor: "hyperspot"
           priority: 20
-          tenants:
-            # ID sourced from the umbrella's `global.tenantDefaultId` so
-            # this gateway, the identity service, and the analytics-api
-            # all agree on one tenant UUID. Falls back to a fixed UUID
-            # for standalone-subchart users who don't go through the
-            # umbrella (and therefore don't see `global.*`).
-            - id: {{ (default dict .Values.global).tenantDefaultId | default "00000000-df51-5b42-9538-d2b56b7ee953" | quote }}
-              name: "default"
-              parent_id: null
-              status: active
 
       proxy:
         config:
diff --git a/src/backend/services/api-gateway/helm/templates/secret.yaml b/src/backend/services/api-gateway/helm/templates/secret.yaml
index d61c91c31..0cc76b25d 100644
--- a/src/backend/services/api-gateway/helm/templates/secret.yaml
+++ b/src/backend/services/api-gateway/helm/templates/secret.yaml
@@ -7,13 +7,13 @@ metadata:
     {{- include "insight-api-gateway.labels" . | nindent 4 }}
 type: Opaque
 stringData:
-  APP__modules__oidc-authn-plugin__config__issuer_url: {{ required "oidc.issuer is required when auth is enabled and oidc.existingSecret is not set" .Values.oidc.issuer | quote }}
-  APP__modules__oidc-authn-plugin__config__audience: {{ .Values.oidc.audience | quote }}
-  APP__modules__auth-info__config__issuer_url: {{ required "oidc.issuer is required when auth is enabled and oidc.existingSecret is not set" .Values.oidc.issuer | quote }}
-  APP__modules__auth-info__config__client_id: {{ required "oidc.clientId is required when auth is enabled and oidc.existingSecret is not set" .Values.oidc.clientId | quote }}
-  APP__modules__auth-info__config__redirect_uri: {{ required "oidc.redirectUri is required when auth is enabled and oidc.existingSecret is not set" .Values.oidc.redirectUri | quote }}
-  APP__modules__auth-info__config__scopes: {{ required "oidc.scopes is required when auth is enabled and oidc.existingSecret is not set (space-separated, IdP-specific)" .Values.oidc.scopes | quote }}
+  APP__gears__oidc-authn-plugin__config__issuer_url: {{ required "oidc.issuer is required when auth is enabled and oidc.existingSecret is not set" .Values.oidc.issuer | quote }}
+  APP__gears__oidc-authn-plugin__config__audience: {{ .Values.oidc.audience | quote }}
+  APP__gears__auth-info__config__issuer_url: {{ required "oidc.issuer is required when auth is enabled and oidc.existingSecret is not set" .Values.oidc.issuer | quote }}
+  APP__gears__auth-info__config__client_id: {{ required "oidc.clientId is required when auth is enabled and oidc.existingSecret is not set" .Values.oidc.clientId | quote }}
+  APP__gears__auth-info__config__redirect_uri: {{ required "oidc.redirectUri is required when auth is enabled and oidc.existingSecret is not set" .Values.oidc.redirectUri | quote }}
+  APP__gears__auth-info__config__scopes: {{ required "oidc.scopes is required when auth is enabled and oidc.existingSecret is not set (space-separated, IdP-specific)" .Values.oidc.scopes | quote }}
   {{- if .Values.oidc.jwksUrl }}
-  APP__modules__oidc-authn-plugin__config__jwks_url: {{ .Values.oidc.jwksUrl | quote }}
+  APP__gears__oidc-authn-plugin__config__jwks_url: {{ .Values.oidc.jwksUrl | quote }}
   {{- end }}
 {{- end }}
diff --git a/src/backend/services/api-gateway/secrets/oidc.yaml.example b/src/backend/services/api-gateway/secrets/oidc.yaml.example
index a0ef06034..447af8d9d 100644
--- a/src/backend/services/api-gateway/secrets/oidc.yaml.example
+++ b/src/backend/services/api-gateway/secrets/oidc.yaml.example
@@ -25,11 +25,11 @@ metadata:
 type: Opaque
 stringData:
   # ─── oidc-authn-plugin (validates bearer tokens) ───────────────
-  APP__modules__oidc-authn-plugin__config__issuer_url: "https://integrator-4985807.okta.com/oauth2/default"
-  APP__modules__oidc-authn-plugin__config__audience: "api://default"
+  APP__gears__oidc-authn-plugin__config__issuer_url: "https://integrator-4985807.okta.com/oauth2/default"
+  APP__gears__oidc-authn-plugin__config__audience: "api://default"
 
   # ─── auth-info (public GET /api/v1/auth/config for the SPA) ────
   # issuer_url MUST match the one above.
-  APP__modules__auth-info__config__issuer_url: "https://integrator-4985807.okta.com/oauth2/default"
-  APP__modules__auth-info__config__client_id: "CHANGE_ME"                         # Okta SPA app client ID (PKCE, no secret)
-  APP__modules__auth-info__config__redirect_uri: "http://CHANGE_ME/callback"      # e.g., http://192.168.44.36/callback
+  APP__gears__auth-info__config__issuer_url: "https://integrator-4985807.okta.com/oauth2/default"
+  APP__gears__auth-info__config__client_id: "CHANGE_ME"                         # Okta SPA app client ID (PKCE, no secret)
+  APP__gears__auth-info__config__redirect_uri: "http://CHANGE_ME/callback"      # e.g., http://192.168.44.36/callback
diff --git a/src/backend/services/api-gateway/specs/DESIGN.md b/src/backend/services/api-gateway/specs/DESIGN.md
index 7edd0dab2..e4a97e231 100644
--- a/src/backend/services/api-gateway/specs/DESIGN.md
+++ b/src/backend/services/api-gateway/specs/DESIGN.md
@@ -367,7 +367,7 @@ Deployed as a Kubernetes Deployment with per-service Helm chart (`services/api-g
 
 Configuration via:
 1. YAML config file (baked into image at `/etc/insight/`)
-2. Environment variable overrides (`APP__modules__<module>__config__<key>`)
+2. Environment variable overrides (`APP__gears__<gear>__config__<key>`)
 3. Helm values → rendered as env vars in deployment template
 
 ## 4. Additional Context
@@ -397,7 +397,7 @@ The OIDC plugin uses `modkit-auth::JwksKeyProvider` which:
 Defaults (code) → YAML file (-c flag) → Env vars (APP__*) → CLI flags (-v)
 ```
 
-Each layer overrides the previous. Environment variables use double-underscore nesting: `APP__modules__oidc-authn-plugin__config__issuer_url`.
+Each layer overrides the previous. Environment variables use double-underscore nesting: `APP__gears__oidc-authn-plugin__config__issuer_url`.
 
 ## 5. Traceability
 
diff --git a/src/backend/services/api-gateway/src/auth_info.rs b/src/backend/services/api-gateway/src/auth_info.rs
index ea83108ad..e6cbfa822 100644
--- a/src/backend/services/api-gateway/src/auth_info.rs
+++ b/src/backend/services/api-gateway/src/auth_info.rs
@@ -10,10 +10,10 @@ use std::sync::{Arc, OnceLock};
 use async_trait::async_trait;
 use axum::http::{Method, StatusCode};
 use axum::{Json, Router};
-use modkit::api::{OpenApiRegistry, OperationBuilder};
-use modkit::context::ModuleCtx;
-use modkit::contracts::{Module, RestApiCapability};
 use serde::{Deserialize, Serialize};
+use toolkit::api::{OpenApiRegistry, OperationBuilder};
+use toolkit::context::GearCtx;
+use toolkit::contracts::{Gear, RestApiCapability};
 
 /// OIDC configuration served to the frontend.
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -30,7 +30,7 @@ pub struct AuthInfoResponse {
     pub response_type: String,
 }
 
-/// Module configuration (from YAML).
+/// Gear configuration (from YAML).
 #[derive(Debug, Clone, Default, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 pub struct AuthInfoConfig {
@@ -42,7 +42,7 @@ pub struct AuthInfoConfig {
     pub redirect_uri: String,
     /// Scopes to request, as a space-separated string (matches OAuth2's wire
     /// format). Stored as `String` so the standard
-    /// `APP__modules__auth-info__config__scopes` env-var override works
+    /// `APP__gears__auth-info__config__scopes` env-var override works
     /// without a custom Vec deserializer; split on whitespace when building
     /// the response. IdP-specific:
     ///   Entra v2 single-app: "openid profile email api://<clientId>/Access.Default"
@@ -51,7 +51,7 @@ pub struct AuthInfoConfig {
 }
 
 /// Auth info module — serves OIDC config to the frontend.
-#[modkit::module(
+#[toolkit::gear(
     name = "auth-info",
     capabilities = [rest]
 )]
@@ -68,15 +68,15 @@ impl Default for AuthInfoModule {
 }
 
 #[async_trait]
-impl Module for AuthInfoModule {
-    async fn init(&self, ctx: &ModuleCtx) -> anyhow::Result<()> {
+impl Gear for AuthInfoModule {
+    async fn init(&self, ctx: &GearCtx) -> anyhow::Result<()> {
         let config: AuthInfoConfig = ctx.config()?;
 
         if config.issuer_url.is_empty() {
             tracing::warn!(
                 "auth-info: issuer_url is empty. \
                  /auth/config endpoint will return empty OIDC config. \
-                 Set modules.auth-info.config.issuer_url."
+                 Set gears.auth-info.config.issuer_url."
             );
         }
         if config.scopes.split_whitespace().next().is_none() {
@@ -84,7 +84,7 @@ impl Module for AuthInfoModule {
                 "auth-info: scopes is empty. SPA will request no OIDC scopes \
                  and IdPs will fall back to default audiences (Entra → Microsoft Graph), \
                  producing access tokens the gateway can't validate. \
-                 Set modules.auth-info.config.scopes (space-separated)."
+                 Set gears.auth-info.config.scopes (space-separated)."
             );
         }
 
@@ -99,7 +99,7 @@ impl Module for AuthInfoModule {
 impl RestApiCapability for AuthInfoModule {
     fn register_rest(
         &self,
-        _ctx: &ModuleCtx,
+        _ctx: &GearCtx,
         router: Router,
         openapi: &dyn OpenApiRegistry,
     ) -> anyhow::Result<Router> {
diff --git a/src/backend/services/api-gateway/src/core_types.rs b/src/backend/services/api-gateway/src/core_types.rs
deleted file mode 100644
index 35043004d..000000000
--- a/src/backend/services/api-gateway/src/core_types.rs
+++ /dev/null
@@ -1,50 +0,0 @@
-//! Core GTS types registration module.
-//!
-//! Replaces the unpublished `types` module from cyberfabric-core.
-//! Registers the base GTS schemas (embedded in `modkit`) with the types-registry
-//! so that plugin modules can register their instances.
-//!
-//! Dependency chain: `types-registry` → `core-types` → plugin modules
-
-use async_trait::async_trait;
-use modkit::contracts::SystemCapability;
-use modkit::gts::get_core_gts_schemas;
-use modkit::{Module, ModuleCtx};
-use tracing::info;
-use types_registry_sdk::TypesRegistryClient;
-
-/// Core types registration module.
-///
-/// Registers `BaseModkitPluginV1` and other core GTS schemas that
-/// all plugin modules depend on.
-#[modkit::module(
-    name = "core-types",
-    deps = ["types-registry"],
-    capabilities = [system]
-)]
-pub struct CoreTypes;
-
-impl Default for CoreTypes {
-    fn default() -> Self {
-        Self
-    }
-}
-
-#[async_trait]
-impl Module for CoreTypes {
-    async fn init(&self, ctx: &ModuleCtx) -> anyhow::Result<()> {
-        let registry = ctx.client_hub().get::<dyn TypesRegistryClient>()?;
-
-        let core_schemas = get_core_gts_schemas()?;
-        registry
-            .register(core_schemas)
-            .await
-            .map_err(|e| anyhow::anyhow!("failed to register core GTS schemas: {e}"))?;
-
-        info!("core GTS schemas registered");
-        Ok(())
-    }
-}
-
-#[async_trait]
-impl SystemCapability for CoreTypes {}
diff --git a/src/backend/services/api-gateway/src/main.rs b/src/backend/services/api-gateway/src/main.rs
index b831553ad..b642ca04d 100644
--- a/src/backend/services/api-gateway/src/main.rs
+++ b/src/backend/services/api-gateway/src/main.rs
@@ -14,17 +14,16 @@
 //!   insight-api-gateway run -c config/insight.yaml
 //!   insight-api-gateway check -c config/insight.yaml
 
-// Insight modules (compiled into the binary, registered via inventory).
+// Insight gears (compiled into the binary, registered via inventory).
 mod auth_info;
-mod core_types;
 mod proxy;
 
 // Link external modules via inventory — runtime discovers them automatically.
-use api_gateway_module as _;
+use api_gateway as _;
 use authn_resolver as _;
 use authz_resolver as _;
+use gear_orchestrator as _;
 use grpc_hub as _;
-use module_orchestrator as _;
 use oidc_authn_plugin as _;
 use single_tenant_tr_plugin as _;
 use static_authz_plugin as _;
@@ -35,7 +34,7 @@ use std::path::PathBuf;
 
 use anyhow::Result;
 use clap::{Parser, Subcommand};
-use modkit::bootstrap::{AppConfig, run_migrate, run_server};
+use toolkit::bootstrap::{AppConfig, run_migrate, run_server};
 
 /// Insight API Gateway — entry point for all backend services.
 #[derive(Parser)]
diff --git a/src/backend/services/api-gateway/src/proxy.rs b/src/backend/services/api-gateway/src/proxy.rs
index bd2813bcc..e3aff80de 100644
--- a/src/backend/services/api-gateway/src/proxy.rs
+++ b/src/backend/services/api-gateway/src/proxy.rs
@@ -29,10 +29,11 @@ use axum::body::Body;
 use axum::extract::Request;
 use axum::http::{HeaderValue, Method, StatusCode};
 use axum::response::{IntoResponse, Response};
-use modkit::api::{OpenApiRegistry, OperationBuilder, Problem};
-use modkit::context::ModuleCtx;
-use modkit::contracts::{Module, RestApiCapability};
 use serde::Deserialize;
+use toolkit::api::{OpenApiRegistry, OperationBuilder};
+use toolkit::context::GearCtx;
+use toolkit::contracts::{Gear, RestApiCapability};
+use toolkit_canonical_errors::CanonicalError;
 
 /// Route definition: prefix → upstream.
 #[derive(Debug, Clone, Deserialize)]
@@ -47,7 +48,7 @@ pub struct RouteConfig {
     pub public: bool,
 }
 
-/// Module configuration.
+/// Gear configuration.
 #[derive(Debug, Clone, Default, Deserialize)]
 #[serde(default)]
 pub struct ProxyConfig {
@@ -63,7 +64,7 @@ struct ProxyState {
 }
 
 /// Reverse proxy module.
-#[modkit::module(
+#[toolkit::gear(
     name = "proxy",
     capabilities = [rest]
 )]
@@ -80,8 +81,8 @@ impl Default for ProxyModule {
 }
 
 #[async_trait]
-impl Module for ProxyModule {
-    async fn init(&self, ctx: &ModuleCtx) -> anyhow::Result<()> {
+impl Gear for ProxyModule {
+    async fn init(&self, ctx: &GearCtx) -> anyhow::Result<()> {
         let config: ProxyConfig = ctx.config()?;
 
         for route in &config.routes {
@@ -108,7 +109,7 @@ impl Module for ProxyModule {
 impl RestApiCapability for ProxyModule {
     fn register_rest(
         &self,
-        _ctx: &ModuleCtx,
+        _ctx: &GearCtx,
         mut router: Router,
         openapi: &dyn OpenApiRegistry,
     ) -> anyhow::Result<Router> {
@@ -165,66 +166,15 @@ impl RestApiCapability for ProxyModule {
             );
         }
 
-        // TEMPORARILY DISABLED — see https://github.com/cyberfabric/cyberfabric-core/pull/1843
-        //
-        // The wildcard `/{*rest}` registered as `authenticated()` here used to
-        // shield 404s behind a 401 for anonymous callers (so they couldn't
-        // probe path existence). But cyberfabric-core's GatewayRoutePolicy
-        // resolves auth requirements with `is_authenticated` short-circuiting
-        // before the public-route check, so this wildcard masks every
-        // explicitly `.public()` route at a more specific path — including
-        // /v1/auth/config, breaking the SPA's unauthenticated bootstrap.
-        //
-        // PR #1843 flips that precedence (public wins over wildcard
-        // authenticated). Once it lands and we bump the cf-api-gateway
-        // dependency past the fix, RE-ENABLE this block to restore the
-        // 404→401 topology shield.
-        //
-        // let fallback_methods = [
-        //     Method::GET,
-        //     Method::POST,
-        //     Method::PUT,
-        //     Method::DELETE,
-        //     Method::PATCH,
-        // ];
-        // for method in fallback_methods {
-        //     let handler =
-        //         move |_req: Request<Body>| async move { not_found_problem().into_response() };
-        //     router = OperationBuilder::new(method.clone(), "/{*rest}")
-        //         .summary("Authenticated 404 fallback")
-        //         .authenticated()
-        //         .no_license_required()
-        //         .json_response(StatusCode::NOT_FOUND, "Not found")
-        //         .handler(handler)
-        //         .register(router, openapi);
-        // }
         tracing::warn!(
-            "authenticated 404 fallback DISABLED pending cyberfabric-core PR #1843 — \
-             unmatched paths will return Axum's default 404 without auth checking"
+            "authenticated 404 fallback not yet wired up against cf-gears-api-gateway — \
+             unmatched paths return Axum's default 404 without auth checking"
         );
 
         Ok(router)
     }
 }
 
-/// RFC 9457 Problem for unmatched paths. Returned only after auth has
-/// already validated the token; unauthenticated callers get 401 from the
-/// auth middleware before reaching this handler.
-///
-/// Currently only the test references it — the handler that calls it is
-/// commented out pending cyberfabric-core PR #1843. Drop the
-/// `#[allow(dead_code)]` once the fallback is re-enabled.
-#[allow(dead_code)]
-fn not_found_problem() -> Problem {
-    Problem::new(
-        StatusCode::NOT_FOUND,
-        "Not Found",
-        "no route matches this path",
-    )
-    .with_type("urn:insight:error:not_found")
-    .with_code("not_found")
-}
-
 /// Register an authenticated proxy route via `OperationBuilder`.
 fn register_authenticated<H, T>(
     router: Router,
@@ -278,14 +228,10 @@ async fn proxy_handler(state: Arc<ProxyState>, req: Request<Body>) -> Response {
                 error = %e,
                 "proxy request failed"
             );
-            Problem::new(
-                StatusCode::BAD_GATEWAY,
-                "Bad Gateway",
-                "upstream service unavailable",
-            )
-            .with_type("urn:insight:error:bad_gateway")
-            .with_code("bad_gateway")
-            .into_response()
+            CanonicalError::service_unavailable()
+                .with_detail("upstream service unavailable")
+                .create()
+                .into_response()
         }
     }
 }
@@ -365,81 +311,3 @@ fn is_hop_by_hop(name: &str) -> bool {
             | "host"
     )
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use axum::body::to_bytes;
-    use axum::routing::get;
-    use tower::ServiceExt;
-
-    type TestResult = Result<(), Box<dyn std::error::Error>>;
-
-    #[tokio::test]
-    async fn not_found_problem_conforms_to_rfc9457() -> TestResult {
-        let response = not_found_problem().into_response();
-        assert_eq!(response.status(), StatusCode::NOT_FOUND);
-        // RFC 9457 §3 mandates application/problem+json — modkit::api::Problem
-        // sets this automatically; assert it so we catch any regression.
-        let ct = response
-            .headers()
-            .get(axum::http::header::CONTENT_TYPE)
-            .ok_or("content-type missing")?;
-        assert_eq!(ct, "application/problem+json");
-
-        let body = to_bytes(response.into_body(), 4096).await?;
-        let json: serde_json::Value =
-            serde_json::from_slice(&body).unwrap_or(serde_json::Value::Null);
-
-        assert_eq!(json["status"], 404);
-        assert_eq!(json["title"], "Not Found");
-        assert_eq!(json["type"], "urn:insight:error:not_found");
-        assert_eq!(json["code"], "not_found");
-        assert!(json["detail"].is_string());
-        Ok(())
-    }
-
-    /// Verifies the routing precedence assumption the fallback relies on:
-    /// a wildcard `/{*rest}` at the root must NOT shadow a more specific
-    /// `/configured/{*rest}` route. If Axum ever changes this rule, the
-    /// fallback would start hijacking proxy traffic and this test fires.
-    #[tokio::test]
-    async fn fallback_does_not_intercept_configured_routes() -> TestResult {
-        let app = Router::new()
-            .route(
-                "/configured/{*rest}",
-                get(|| async { (StatusCode::OK, "configured") }),
-            )
-            .route(
-                "/{*rest}",
-                get(|| async { not_found_problem().into_response() }),
-            );
-
-        // Configured route → handler
-        let req = axum::http::Request::builder()
-            .uri("/configured/v1/anything")
-            .body(Body::empty())?;
-        let resp = app.clone().oneshot(req).await?;
-        assert_eq!(resp.status(), StatusCode::OK);
-        let body = to_bytes(resp.into_body(), 4096).await?;
-        assert_eq!(&body[..], b"configured");
-
-        // Unmatched path → fallback 404 (RFC 9457 problem+json)
-        let req = axum::http::Request::builder()
-            .uri("/unknown/foo/bar")
-            .body(Body::empty())?;
-        let resp = app.oneshot(req).await?;
-        assert_eq!(resp.status(), StatusCode::NOT_FOUND);
-        let ct = resp
-            .headers()
-            .get(axum::http::header::CONTENT_TYPE)
-            .ok_or("content-type missing")?;
-        assert_eq!(ct, "application/problem+json");
-        let body = to_bytes(resp.into_body(), 4096).await?;
-        let json: serde_json::Value =
-            serde_json::from_slice(&body).unwrap_or(serde_json::Value::Null);
-        assert_eq!(json["status"], 404);
-        assert_eq!(json["type"], "urn:insight:error:not_found");
-        Ok(())
-    }
-}