diff --git a/apps/codezero/Chart.lock b/apps/codezero/Chart.lock
new file mode 100644
index 0000000..479c3d1
--- /dev/null
+++ b/apps/codezero/Chart.lock
@@ -0,0 +1,6 @@
+dependencies:
+- name: postgresql
+  repository: https://charts.bitnami.com/bitnami
+  version: 18.5.17
+digest: sha256:e5b697e6b97321ba0386615a7cf67cb8b2f37ab4e159fad9fb5f6603a6807f6f
+generated: "2026-04-13T21:21:16.724184+02:00"
diff --git a/apps/codezero/Chart.yaml b/apps/codezero/Chart.yaml
new file mode 100644
index 0000000..9152e73
--- /dev/null
+++ b/apps/codezero/Chart.yaml
@@ -0,0 +1,23 @@
+apiVersion: v2
+name: codezero
+description: CodeZero — no-code workflow automation & AI orchestration platform
+type: application
+version: 0.1.0
+appVersion: 'canary'
+home: https://codezero.build
+sources:
+  - https://github.com/code0-tech/codezero
+maintainers:
+  - name: CNAP Technologies
+    url: https://cnap.tech
+keywords:
+  - automation
+  - workflow
+  - no-code
+  - ai
+  - orchestration
+dependencies:
+  - name: postgresql
+    version: "18.5.17"
+    repository: https://charts.bitnami.com/bitnami
+    condition: postgres.enabled
diff --git a/apps/codezero/templates/_helpers.tpl b/apps/codezero/templates/_helpers.tpl
new file mode 100644
index 0000000..eeb5264
--- /dev/null
+++ b/apps/codezero/templates/_helpers.tpl
@@ -0,0 +1,78 @@
+{{/*
+Common labels
+*/}}
+{{- define "codezero.labels" -}}
+app.kubernetes.io/name: {{ .Chart.Name }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/version: {{ .Values.image.tag | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "codezero.selectorLabels" -}}
+app.kubernetes.io/name: {{ .Chart.Name }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Full image reference for Code Zero components
+*/}}
+{{- define "codezero.image" -}}
+{{ .Values.image.registry }}/{{ .component }}:{{ .Values.image.tag }}{{ if .edition }}-{{ .edition }}{{ end }}
+{{- end }}
+
+{{/*
+Sagittarius image (includes edition suffix)
+*/}}
+{{- define "codezero.sagittariusImage" -}}
+{{ .Values.image.registry }}/sagittarius:{{ .Values.image.tag }}-{{ .Values.image.edition }}
+{{- end }}
+
+{{/*
+Sculptor image (includes edition suffix)
+*/}}
+{{- define "codezero.sculptorImage" -}}
+{{ .Values.image.registry }}/sculptor:{{ .Values.image.tag }}-{{ .Values.image.edition }}
+{{- end }}
+
+{{/*
+Component image (no edition suffix)
+*/}}
+{{- define "codezero.componentImage" -}}
+{{ .Values.image.registry }}/{{ .component }}:{{ .Values.image.tag }}
+{{- end }}
+
+{{/*
+Draco image with variant suffix
+*/}}
+{{- define "codezero.dracoImage" -}}
+{{ .Values.image.registry }}/draco:{{ .Values.image.tag }}-{{ .variant }}
+{{- end }}
+
+{{/*
+Service account name
+*/}}
+{{- define "codezero.serviceAccountName" -}}
+{{- if .Values.serviceAccount.name }}
+{{- .Values.serviceAccount.name }}
+{{- else }}
+{{- .Release.Name }}-codezero
+{{- end }}
+{{- end }}
+
+{{/*
+Config volume name
+*/}}
+{{- define "codezero.configVolume" -}}
+{{ .Release.Name }}-generated-configs
+{{- end }}
+
+{{/*
+Postgres connection details — points to Bitnami subchart service
+*/}}
+{{- define "codezero.postgresHost" -}}
+{{ .Release.Name }}-postgresql
+{{- end }}
diff --git a/apps/codezero/templates/configmap-nginx.yaml b/apps/codezero/templates/configmap-nginx.yaml
new file mode 100644
index 0000000..f0eaaec
--- /dev/null
+++ b/apps/codezero/templates/configmap-nginx.yaml
@@ -0,0 +1,83 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-nginx-config
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+data:
+  default.conf: |
+    upstream sagittarius_rails_web {
+      server {{ .Release.Name }}-sagittarius-web:3000;
+    }
+
+    upstream sagittarius_grpc {
+      server {{ .Release.Name }}-sagittarius-grpc:50051;
+    }
+
+    upstream sculptor {
+      server {{ .Release.Name }}-sculptor:3000;
+    }
+
+    server {
+      listen 80 http2;
+      server_name _;
+
+      location = /graphql {
+        proxy_pass http://sagittarius_rails_web;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+      }
+
+      location = /files/upload {
+        proxy_pass http://sagittarius_rails_web;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        client_max_body_size 100M;
+      }
+
+      location = /health/liveness {
+        proxy_pass http://sagittarius_rails_web;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+      }
+
+      location /good_job {
+        proxy_pass http://sagittarius_rails_web;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+      }
+
+      location = /error502grpc {
+        internal;
+        default_type application/grpc;
+        add_header grpc-status 14;
+        add_header grpc-message "unavailable";
+        return 204;
+      }
+
+      location / {
+        if ($content_type = "application/grpc") {
+          grpc_pass grpc://sagittarius_grpc;
+          error_page 502 = /error502grpc;
+        }
+        grpc_set_header X-Real-IP $remote_addr;
+        grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        grpc_read_timeout 1h;
+        grpc_send_timeout 1h;
+        grpc_socket_keepalive on;
+
+        proxy_pass http://sculptor;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+      }
+    }
diff --git a/apps/codezero/templates/configmap-sagittarius.yaml b/apps/codezero/templates/configmap-sagittarius.yaml
new file mode 100644
index 0000000..a5f1dbc
--- /dev/null
+++ b/apps/codezero/templates/configmap-sagittarius.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-sagittarius-config
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+data:
+  sagittarius.yml: |
+    rails:
+      web:
+        force_ssl: false
+      log_level: info
+      threads: 3
+      db:
+        host: {{ include "codezero.postgresHost" . | quote }}
+        port: "5432"
diff --git a/apps/codezero/templates/deployment-nginx.yaml b/apps/codezero/templates/deployment-nginx.yaml
new file mode 100644
index 0000000..6bd0944
--- /dev/null
+++ b/apps/codezero/templates/deployment-nginx.yaml
@@ -0,0 +1,44 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-nginx
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: nginx
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "codezero.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: nginx
+  template:
+    metadata:
+      labels:
+        {{- include "codezero.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: nginx
+    spec:
+      containers:
+        - name: nginx
+          image: {{ .Values.nginx.image }}
+          ports:
+            - name: http
+              containerPort: 80
+          volumeMounts:
+            - name: nginx-config
+              mountPath: /etc/nginx/conf.d
+          livenessProbe:
+            httpGet:
+              path: /health/liveness
+              port: 80
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /health/liveness
+              port: 80
+            initialDelaySeconds: 5
+            periodSeconds: 5
+      volumes:
+        - name: nginx-config
+          configMap:
+            name: {{ .Release.Name }}-nginx-config
diff --git a/apps/codezero/templates/deployment-runtime.yaml b/apps/codezero/templates/deployment-runtime.yaml
new file mode 100644
index 0000000..c426a04
--- /dev/null
+++ b/apps/codezero/templates/deployment-runtime.yaml
@@ -0,0 +1,177 @@
+{{- if .Values.runtime.enabled }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-nats
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: nats
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "codezero.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: nats
+  template:
+    metadata:
+      labels:
+        {{- include "codezero.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: nats
+    spec:
+      containers:
+        - name: nats
+          image: {{ .Values.nats.image }}
+          args: ["-js"]
+          ports:
+            - containerPort: 4222
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-aquila
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: aquila
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "codezero.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: aquila
+  template:
+    metadata:
+      labels:
+        {{- include "codezero.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: aquila
+    spec:
+      containers:
+        - name: aquila
+          image: {{ .Values.image.registry }}/aquila:{{ .Values.image.tag }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          env:
+            - name: MODE
+              value: dynamic
+            - name: NATS_URL
+              value: nats://{{ .Release.Name }}-nats:4222
+            - name: NATS_BUCKET
+              value: flow_store
+            - name: GRPC_HOST
+              value: "0.0.0.0"
+            - name: SAGITTARIUS_URL
+              value: {{ .Values.runtime.aquila.sagittariusUrl | default (printf "http://%s-nginx:80" .Release.Name) }}
+            - name: RUNTIME_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-codezero
+                  key: AQUILA_SAGITTARIUS_TOKEN
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-taurus
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: taurus
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "codezero.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: taurus
+  template:
+    metadata:
+      labels:
+        {{- include "codezero.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: taurus
+    spec:
+      containers:
+        - name: taurus
+          image: {{ .Values.image.registry }}/taurus:{{ .Values.image.tag }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          env:
+            - name: MODE
+              value: dynamic
+            - name: AQUILA_URL
+              value: http://{{ .Release.Name }}-aquila:8081
+            - name: NATS_URL
+              value: nats://{{ .Release.Name }}-nats:4222
+            - name: DEFINITION_PATH
+              value: /definitions
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-draco-rest
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: draco-rest
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "codezero.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: draco-rest
+  template:
+    metadata:
+      labels:
+        {{- include "codezero.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: draco-rest
+    spec:
+      containers:
+        - name: draco-rest
+          image: {{ .Values.image.registry }}/draco:{{ .Values.image.tag }}-rest
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - containerPort: {{ .Values.runtime.draco.rest.port }}
+          env:
+            - name: MODE
+              value: dynamic
+            - name: AQUILA_URL
+              value: http://{{ .Release.Name }}-aquila:8081
+            - name: NATS_URL
+              value: nats://{{ .Release.Name }}-nats:4222
+            - name: NATS_BUCKET
+              value: flow_store
+            - name: DEFINITION_PATH
+              value: /definitions
+            - name: HTTP_SERVER_PORT
+              value: {{ .Values.runtime.draco.rest.port | quote }}
+            - name: HTTP_SERVER_HOST
+              value: "0.0.0.0"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-draco-cron
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: draco-cron
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "codezero.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: draco-cron
+  template:
+    metadata:
+      labels:
+        {{- include "codezero.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: draco-cron
+    spec:
+      containers:
+        - name: draco-cron
+          image: {{ .Values.image.registry }}/draco:{{ .Values.image.tag }}-cron
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          env:
+            - name: MODE
+              value: dynamic
+            - name: AQUILA_URL
+              value: http://{{ .Release.Name }}-aquila:8081
+            - name: NATS_URL
+              value: nats://{{ .Release.Name }}-nats:4222
+            - name: NATS_BUCKET
+              value: flow_store
+            - name: DEFINITION_PATH
+              value: /definitions
+{{- end }}
diff --git a/apps/codezero/templates/deployment-sagittarius.yaml b/apps/codezero/templates/deployment-sagittarius.yaml
new file mode 100644
index 0000000..6e3ef18
--- /dev/null
+++ b/apps/codezero/templates/deployment-sagittarius.yaml
@@ -0,0 +1,158 @@
+{{- $sagittariusImage := include "codezero.sagittariusImage" . -}}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-sagittarius-web
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: sagittarius-web
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "codezero.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: sagittarius-web
+  template:
+    metadata:
+      labels:
+        {{- include "codezero.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: sagittarius-web
+    spec:
+      containers:
+        - name: sagittarius-web
+          image: {{ $sagittariusImage }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: ["sh", "-c"]
+          args:
+            - |
+              cp /tmp/config/sagittarius.yml config/sagittarius.yml
+              exec bin/docker-entrypoint ./bin/rails server
+          ports:
+            - containerPort: 3000
+          envFrom:
+            - secretRef:
+                name: {{ .Release.Name }}-codezero
+          env:
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-postgresql
+                  key: password
+          volumeMounts:
+            - name: sagittarius-config
+              mountPath: /tmp/config
+          livenessProbe:
+            httpGet:
+              path: /health/liveness
+              port: 3000
+            initialDelaySeconds: 30
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /health/liveness
+              port: 3000
+            initialDelaySeconds: 10
+            periodSeconds: 5
+          resources:
+            {{- toYaml .Values.resources.sagittarius | nindent 12 }}
+      volumes:
+        - name: sagittarius-config
+          configMap:
+            name: {{ .Release.Name }}-sagittarius-config
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-sagittarius-background
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: sagittarius-background
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "codezero.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: sagittarius-background
+  template:
+    metadata:
+      labels:
+        {{- include "codezero.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: sagittarius-background
+    spec:
+      containers:
+        - name: sagittarius-background
+          image: {{ $sagittariusImage }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: ["sh", "-c"]
+          args:
+            - |
+              cp /tmp/config/sagittarius.yml config/sagittarius.yml
+              exec bin/docker-entrypoint bundle exec good_job
+          envFrom:
+            - secretRef:
+                name: {{ .Release.Name }}-codezero
+          env:
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-postgresql
+                  key: password
+          volumeMounts:
+            - name: sagittarius-config
+              mountPath: /tmp/config
+          resources:
+            {{- toYaml .Values.resources.sagittarius | nindent 12 }}
+      volumes:
+        - name: sagittarius-config
+          configMap:
+            name: {{ .Release.Name }}-sagittarius-config
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-sagittarius-grpc
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: sagittarius-grpc
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "codezero.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: sagittarius-grpc
+  template:
+    metadata:
+      labels:
+        {{- include "codezero.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: sagittarius-grpc
+    spec:
+      containers:
+        - name: sagittarius-grpc
+          image: {{ $sagittariusImage }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          envFrom:
+            - secretRef:
+                name: {{ .Release.Name }}-codezero
+          env:
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-postgresql
+                  key: password
+          command: ["sh", "-c"]
+          args:
+            - |
+              cp /tmp/config/sagittarius.yml config/sagittarius.yml
+              exec bin/docker-entrypoint ./bin/grpc_server
+          ports:
+            - containerPort: 50051
+          volumeMounts:
+            - name: sagittarius-config
+              mountPath: /tmp/config
+          resources:
+            {{- toYaml .Values.resources.sagittarius | nindent 12 }}
+      volumes:
+        - name: sagittarius-config
+          configMap:
+            name: {{ .Release.Name }}-sagittarius-config
diff --git a/apps/codezero/templates/deployment-sculptor.yaml b/apps/codezero/templates/deployment-sculptor.yaml
new file mode 100644
index 0000000..fac2108
--- /dev/null
+++ b/apps/codezero/templates/deployment-sculptor.yaml
@@ -0,0 +1,27 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-sculptor
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: sculptor
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "codezero.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: sculptor
+  template:
+    metadata:
+      labels:
+        {{- include "codezero.selectorLabels" . | nindent 8 }}
+        app.kubernetes.io/component: sculptor
+    spec:
+      containers:
+        - name: sculptor
+          image: {{ include "codezero.sculptorImage" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - containerPort: 3000
+          resources:
+            {{- toYaml .Values.resources.sculptor | nindent 12 }}
diff --git a/apps/codezero/templates/secret.yaml b/apps/codezero/templates/secret.yaml
new file mode 100644
index 0000000..5cf2564
--- /dev/null
+++ b/apps/codezero/templates/secret.yaml
@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-codezero
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  POSTGRES_DB: {{ .Values.postgresql.auth.database | quote }}
+  POSTGRES_USER: {{ .Values.postgresql.auth.username | quote }}
+  POSTGRES_HOST: {{ include "codezero.postgresHost" . | quote }}
+  POSTGRES_PORT: "5432"
+  INITIAL_ROOT_PASSWORD: {{ .Values.admin.password | quote }}
+  INITIAL_ROOT_MAIL: {{ .Values.admin.email | quote }}
+  {{- if .Values.runtime.aquila.sagittariusToken }}
+  AQUILA_SAGITTARIUS_TOKEN: {{ .Values.runtime.aquila.sagittariusToken | quote }}
+  {{- end }}
+---
+{{/*
+The Postgres password is managed by Bitnami's postgresql subchart.
+Sagittarius containers read it from Bitnami's auto-generated secret.
+This avoids duplicating the password in two secrets.
+*/}}
diff --git a/apps/codezero/templates/services.yaml b/apps/codezero/templates/services.yaml
new file mode 100644
index 0000000..724281e
--- /dev/null
+++ b/apps/codezero/templates/services.yaml
@@ -0,0 +1,107 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-sagittarius-web
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: sagittarius-web
+spec:
+  selector:
+    {{- include "codezero.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: sagittarius-web
+  ports:
+    - port: 3000
+      targetPort: 3000
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-sagittarius-grpc
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: sagittarius-grpc
+spec:
+  selector:
+    {{- include "codezero.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: sagittarius-grpc
+  ports:
+    - port: 50051
+      targetPort: 50051
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-sculptor
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: sculptor
+spec:
+  selector:
+    {{- include "codezero.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: sculptor
+  ports:
+    - port: 3000
+      targetPort: 3000
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-nginx
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: nginx
+spec:
+  selector:
+    {{- include "codezero.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: nginx
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+{{- if .Values.runtime.enabled }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-nats
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: nats
+spec:
+  selector:
+    {{- include "codezero.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: nats
+  ports:
+    - port: 4222
+      targetPort: 4222
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-aquila
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: aquila
+spec:
+  selector:
+    {{- include "codezero.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: aquila
+  ports:
+    - port: 8081
+      targetPort: 8081
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-draco-rest
+  labels:
+    {{- include "codezero.labels" . | nindent 4 }}
+    app.kubernetes.io/component: draco-rest
+spec:
+  selector:
+    {{- include "codezero.selectorLabels" . | nindent 4 }}
+    app.kubernetes.io/component: draco-rest
+  ports:
+    - port: {{ .Values.runtime.draco.rest.port }}
+      targetPort: {{ .Values.runtime.draco.rest.port }}
+{{- end }}
diff --git a/apps/codezero/values.yaml b/apps/codezero/values.yaml
new file mode 100644
index 0000000..52aba8d
--- /dev/null
+++ b/apps/codezero/values.yaml
@@ -0,0 +1,92 @@
+# CodeZero Helm Chart Values
+# https://codezero.build
+
+# -- Global image settings
+image:
+  registry: registry.gitlab.com/code0-tech/packages
+  tag: "0.0.0-canary-2356067148-c06e576791513b10dbcb10aa3b0420b87178a205"
+  edition: "ee"  # ce (community) or ee (enterprise)
+  pullPolicy: IfNotPresent
+
+# -- Initial admin credentials
+admin:
+  password: "root"
+  email: "root@code0.tech"
+
+# -- PostgreSQL (Bitnami subchart)
+postgres:
+  enabled: true  # set to false to use an external database
+
+postgresql:
+  auth:
+    database: sagittarius_production
+    username: sagittarius
+    # password is auto-generated by Bitnami if not set — stored in a K8s Secret
+    # To set explicitly: password: "your-password"
+    # To use an existing secret: existingSecret: "my-pg-secret"
+  primary:
+    persistence:
+      size: 10Gi
+      # storageClass: ""  # uses default if not set
+    resources:
+      requests:
+        cpu: 100m
+        memory: 256Mi
+      limits:
+        cpu: 500m
+        memory: 512Mi
+
+# -- NATS (message broker for runtime)
+nats:
+  image: nats:2.11.9
+
+# -- Nginx (reverse proxy)
+nginx:
+  image: nginx:1.29.5-alpine-slim
+
+# -- HTTP settings
+http:
+  port: 80
+
+# -- Runtime settings
+runtime:
+  # -- Enable the runtime profile (workflow execution engine)
+  enabled: true
+  # -- Aquila connection to sagittarius
+  aquila:
+    sagittariusUrl: ""  # auto-configured if empty
+    sagittariusToken: ""
+  # -- Draco REST trigger
+  draco:
+    rest:
+      port: 8084
+
+# -- Resource defaults
+resources:
+  sagittarius:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: 1000m
+      memory: 1Gi
+  sculptor:
+    requests:
+      cpu: 50m
+      memory: 128Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+
+# -- Service account
+serviceAccount:
+  create: true
+  name: ""
+
+# -- Pod security
+podSecurityContext:
+  fsGroup: 1000
+
+securityContext:
+  runAsNonRoot: true
+  runAsUser: 1000