apiVersion: apps/v1
kind: Deployment
metadata:
  name: evolver
  labels:
    app: evolver
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: evolver
  template:
    metadata:
      labels:
        app: evolver
    spec:
      serviceAccountName: investibook-backend
      containers:
        - name: evolver
          image: investibook/evolver:latest
          ports:
            - containerPort: 8080
          env:
            # Backend API (in-cluster DNS)
            - name: INVESTIBOOK_BASE_URL
              value: "http://backend:8000"

            # Claude CLI via Bedrock (bearer token gateway)
            - name: CLAUDE_CODE_USE_BEDROCK
              value: "1"
            - name: ANTHROPIC_MODEL
              value: "arn:aws:bedrock:us-east-1:841162690310:application-inference-profile/hwcg0f9zawfd"
            - name: AWS_REGION
              value: "us-east-1"
            - name: AWS_BEARER_TOKEN_BEDROCK
              valueFrom:
                secretKeyRef:
                  name: agent-provider-secret
                  key: AWS_BEARER_TOKEN_BEDROCK

            # Postmortem cron schedule (UTC).
            - name: EVOLVER_POSTMORTEM_CRON_HOUR_UTC
              value: "2"
            - name: EVOLVER_POSTMORTEM_CRON_WEEKDAYS_UTC
              value: "mon,wed,fri"

            # Autofix cron schedule (UTC).
            - name: EVOLVER_AUTOFIX_ENABLED
              value: "true"
            - name: EVOLVER_AUTOFIX_CRON_HOUR_UTC
              value: "6"
            - name: EVOLVER_AUTOFIX_CRON_WEEKDAYS_UTC
              value: "mon,wed,fri"
            - name: EVOLVER_AUTOFIX_TIMEOUT_SECONDS
              value: "14400"

            # Temporary Dedicated daily inspection cron.
            - name: DEDICATED_INSPECTION_ENABLED
              value: "false"
            - name: DEDICATED_INSPECTION_CRON_HOUR_UTC
              value: "4"
            - name: DEDICATED_INSPECTION_CRON_MINUTE_UTC
              value: "20"
            - name: DEDICATED_INSPECTION_TIMEOUT_SECONDS
              value: "1800"
            - name: DEDICATED_INSPECTION_BASE_URL
              value: "https://investibook.tidbcloud.com"
            - name: DEDICATED_INSPECTION_WORKSPACE_ID
              value: "ws-1781598701127-da28e5bfa"
            - name: DEDICATED_INSPECTION_CLUSTER_IDS
              value: "10518506906906971664,10754652599988043412,10324983984131567830,10989049060142230334,10698648422638660035,1379661944646416096,10083921845422295624,1379661944646416075,1379661944646416073,1379661944646416074,1379661944646416020,1379661944646416019,1379661944646416018,1379661944646416017,1379661944646416046,1379661944646413872,1379661944646413225,1379661944646413137"
            - name: DEDICATED_INSPECTION_API_TOKEN
              valueFrom:
                secretKeyRef:
                  name: evolver-dedicated-inspection
                  key: DEDICATED_INSPECTION_API_TOKEN
                  optional: true
            - name: DEDICATED_INSPECTION_TRIGGER_TOKEN
              valueFrom:
                secretKeyRef:
                  name: evolver-dedicated-inspection
                  key: DEDICATED_INSPECTION_TRIGGER_TOKEN
                  optional: true

            # Investibook API token (for workspace/messages API)
            - name: INVESTIBOOK_API_TOKEN
              valueFrom:
                secretKeyRef:
                  name: evolver-secret
                  key: INVESTIBOOK_API_TOKEN

            # GitHub token (for issue read/create + git push)
            - name: GITHUB_TOKEN
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: SKILL_GITHUB_TOKEN

            # Webhook signature verification (optional)
            - name: EVOLVER_WEBHOOK_SECRET
              valueFrom:
                secretKeyRef:
                  name: evolver-secret
                  key: EVOLVER_WEBHOOK_SECRET
                  optional: true

            # Skill credentials (passed through to Claude session env)
            - name: SKILL_CLINIC_API_KEY
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: SKILL_CLINIC_API_KEY
            - name: INVESTIBOOK_JIRA_API_TOKEN
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: JIRA_API_TOKEN
            - name: INVESTIBOOK_JIRA_USERNAME
              valueFrom:
                secretKeyRef:
                  name: investibook-config-secret
                  key: JIRA_USERNAME
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
            periodSeconds: 30
            timeoutSeconds: 5
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /healthz
              port: 8080
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          startupProbe:
            httpGet:
              path: /healthz
              port: 8080
            periodSeconds: 5
            failureThreshold: 12
          resources:
            requests:
              cpu: "500m"
              memory: "1Gi"
            limits:
              cpu: "2000m"
              memory: "4Gi"
      restartPolicy: Always