diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 7647198..5126799 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -26,3 +26,9 @@ jobs:
           linux-amd64/helm lint charts/storelink -f charts/storelink/values-local.yaml
           linux-amd64/helm lint charts/storelink -f charts/storelink/values-prod.yaml
           linux-amd64/helm template storelink charts/storelink -f charts/storelink/values-prod.yaml > /dev/null
+
+          linux-amd64/helm template storelink charts/storelink --set stores.enabled=false > /dev/null
+          if linux-amd64/helm template storelink charts/storelink --set stores.scheme=https --set stores.tlsSecretName= --set stores.tlsClusterIssuer= > /dev/null 2>&1; then
+            echo 'HTTPS store configuration without certificate settings must fail' >&2
+            exit 1
+          fi
diff --git a/README.md b/README.md
index c92a7d8..528f07d 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,7 @@ StoreLink runs a WooCommerce store on Kubernetes and puts a team MCP gateway in
 
 ## Features
 
+- **Multi-store provisioning:** create, retry and delete independent stores from **Stores**, with per-user/team limits, automatic MCP registration and namespace isolation. [Guide and verification](docs/multi-store.md).
 - **WooCommerce store:** WordPress, WooCommerce and MariaDB in the cluster, with persistent storage and cash-on-delivery checkout.
 - **WooCommerce MCP server:** list products, create product, list orders, get order and update order status, served over Streamable HTTP. Reachable only from the gateway.
 - **MCP gateway:** aggregates the tools of every enabled upstream behind one endpoint, namespaces tool names per server, and routes each call to its server. Every upstream call has a timeout. Runs as two replicas that share MCP sessions, rate limits and configuration changes through PostgreSQL.
@@ -32,7 +33,7 @@ flowchart LR
 
 | Component                  | Responsibility                                                                       |
 | -------------------------- | ------------------------------------------------------------------------------------ |
-| `apps/dashboard`           | React dashboard: connections, access, activity and chat                              |
+| `apps/dashboard`           | React dashboard: stores, connections, access, activity and chat                      |
 | `services/gateway`         | Express backend, aggregated MCP endpoint, upstream registry, audit log and chat loop |
 | `services/woocommerce-mcp` | MCP server for store products and orders, using the WooCommerce REST API             |
 | `services/time-mcp`        | Store timezone and day-window tools                                                  |
@@ -147,6 +148,10 @@ The key is stored in a Kubernetes Secret and used only by the gateway. Example p
 
 Each answer lists the tools it called, and **Activity** shows the matching audit records. Conversations and token usage are saved per user.
 
+### Provision additional stores
+
+Open **Stores → Create store**, choose a name and short address, and wait for Ready. Members manage their own stores; admins manage their team’s stores. Each store gets independent persistent data and a tool prefix such as `woo-north__*`. Retry failed setup or confirm deletion from its card. Defaults allow two stores per user and three per team; Failed/Deleting stores count until removal finishes. See [multi-store setup, production TLS, backups and acceptance](docs/multi-store.md).
+
 ### Administration
 
 - **Connections:** add, edit, disable or remove MCP servers, each with an optional static header or bearer credential. The gateway pings each server every second, so a stopped or restarting server shows as Unreachable within about a second, and every status change is kept in the connection history. Public HTTPS servers can be added directly. Cluster-internal origins must be listed in `gateway.extraUpstreamOrigins`. Credentials are encrypted with AES-256-GCM, stored in a Kubernetes Secret, and never returned by the API.
@@ -351,6 +356,7 @@ node scripts/smoke-cluster.ts       # store tools and storefront checkout
 node scripts/smoke-dashboard.ts     # dashboard, invitations, keys and server management
 node scripts/smoke-failures.ts      # upstream outage, recovery and persistence
 node scripts/smoke-pod-delete.ts    # deleted upstream pod shows as Unreachable, then recovers
+node scripts/smoke-multistore.ts    # two-store lifecycle, isolation, retry/restart and one paid comparison
 node scripts/smoke-scaling.ts       # sessions, configuration changes and limits across two gateway pods (one live model call)
 node --env-file=.env scripts/smoke-chat.ts  # live chat flow (uses the OpenAI API)
 ```
@@ -373,12 +379,14 @@ kubectl -n storelink exec deploy/storelink-postgres -- \
 | #7 Scaling               | Implemented                              |
 | #8 Observability         | Implemented                              |
 | #9 Upgrades and rollback | Documented and rehearsed                 |
-| #2–#5, multi-store bonus | Not attempted                            |
+| Multi-store bonus        | Implemented and verified locally         |
+| #2–#5                    | Not attempted                            |
 
 [Verification](docs/verification.md#stand-out-items-and-additional-features) lists what each item covers and where it is implemented, along with additional features such as catalog change notifications, per-user conversations with token accounting, and single-use invitations.
 
 ## Documentation
 
+- [Multi-store provisioning](docs/multi-store.md)
 - [System design and tradeoffs](docs/system-design.md)
 - [Threat model](docs/threat-model.md)
 - [Verification](docs/verification.md)
diff --git a/apps/dashboard/src/main.tsx b/apps/dashboard/src/main.tsx
index 02dd8e1..6af04de 100644
--- a/apps/dashboard/src/main.tsx
+++ b/apps/dashboard/src/main.tsx
@@ -1,6 +1,7 @@
 import React, { useEffect, useState } from 'react';
 import { createRoot } from 'react-dom/client';
 import './style.css';
+import { Stores } from './stores.tsx';
 
 type User = {
   userId: string;
@@ -14,6 +15,8 @@ type Me = {
   chatConfigured: boolean;
   model: string;
   gatewayUrl: string;
+  storesConfigured?: boolean;
+  storeLimits?: { perUser: number; perTeam: number };
 };
 type Server = {
   id: string;
@@ -259,7 +262,13 @@ function App() {
           </div>
         </div>
         <nav aria-label="Main navigation">
-          {['Chat', 'Connections', 'Access', 'Activity'].map((name) => (
+          {[
+            'Chat',
+            ...(me.storesConfigured ? ['Stores'] : []),
+            'Connections',
+            'Access',
+            'Activity',
+          ].map((name) => (
             <button
               key={name}
               onClick={() => {
@@ -270,9 +279,13 @@ function App() {
             >
               <span aria-hidden="true" className="nav-icon">
                 {
-                  { Chat: '✧', Connections: '⊞', Access: '♙', Activity: '≋' }[
-                    name
-                  ]
+                  {
+                    Chat: '✧',
+                    Stores: '▤',
+                    Connections: '⊞',
+                    Access: '♙',
+                    Activity: '≋',
+                  }[name]
                 }
               </span>
               {name}
@@ -325,6 +338,8 @@ function App() {
           )}
           {tab === 'Chat' ? (
             <Chat me={me} run={run} />
+          ) : tab === 'Stores' ? (
+            <Stores me={me} request={api} run={run} />
           ) : tab === 'Connections' ? (
             <Connections me={me} run={run} />
           ) : tab === 'Access' ? (
diff --git a/apps/dashboard/src/stores.tsx b/apps/dashboard/src/stores.tsx
new file mode 100644
index 0000000..3ddc7aa
--- /dev/null
+++ b/apps/dashboard/src/stores.tsx
@@ -0,0 +1,304 @@
+import React, { useEffect, useState } from 'react';
+
+type Store = {
+  id: string;
+  slug: string;
+  displayName: string;
+  publicUrl: string;
+  upstreamSlug: string;
+  status: 'Provisioning' | 'Ready' | 'Failed' | 'Deleting';
+  failureReason: string | null;
+  createdAt: string;
+  createdBy: string;
+  attempt: number;
+};
+type Request = <T>(path: string, body?: unknown, method?: string) => Promise<T>;
+export function Stores({
+  me,
+  request,
+  run,
+}: {
+  me: {
+    user: { userId: string; role: 'admin' | 'member' };
+    storeLimits?: { perUser: number; perTeam: number };
+  };
+  request: Request;
+  run: (work: () => Promise<void>) => Promise<void>;
+}) {
+  const [stores, setStores] = useState<Store[]>([]),
+    [loading, setLoading] = useState(true),
+    [refreshError, setRefreshError] = useState(''),
+    [creating, setCreating] = useState(false),
+    [deleting, setDeleting] = useState<Store | null>(null),
+    [busy, setBusy] = useState(false);
+  async function load() {
+    const rows = await request<Store[]>('/stores');
+    setStores(rows);
+    setRefreshError('');
+    setLoading(false);
+  }
+  useEffect(() => {
+    let stopped = false;
+    let timer: ReturnType<typeof setTimeout>;
+    async function poll() {
+      try {
+        const rows = await request<Store[]>('/stores');
+        if (!stopped) {
+          setStores(rows);
+          setRefreshError('');
+        }
+      } catch {
+        if (!stopped)
+          setRefreshError(
+            'Store status could not be refreshed. The last available status is shown.',
+          );
+      } finally {
+        if (!stopped) {
+          setLoading(false);
+          timer = setTimeout(() => void poll(), 3000);
+        }
+      }
+    }
+    void poll();
+    return () => {
+      stopped = true;
+      clearTimeout(timer);
+    };
+  }, [request]);
+  async function action(work: () => Promise<void>) {
+    if (busy) return;
+    await run(async () => {
+      setBusy(true);
+      try {
+        await work();
+        await load();
+      } finally {
+        setBusy(false);
+      }
+    });
+  }
+  const owned = stores.filter(
+    (store) => store.createdBy === me.user.userId,
+  ).length;
+  return (
+    <>
+      <div className="page-title">
+        <div>
+          <p className="eyebrow">YOUR STOREFRONTS</p>
+          <h1>Your stores</h1>
+          <p className="muted">
+            Create a store and its tools become available to your team
+            automatically.
+          </p>
+        </div>
+        <button
+          className="primary"
+          disabled={
+            busy || (me.storeLimits ? owned >= me.storeLimits.perUser : false)
+          }
+          onClick={() => setCreating(true)}
+        >
+          + Create store
+        </button>
+      </div>
+      {me.storeLimits && (
+        <p className="muted">
+          {owned} of {me.storeLimits.perUser} personal stores used ·{' '}
+          {me.storeLimits.perTeam} stores per team. Deleting stores count until
+          removal finishes.
+        </p>
+      )}
+      {refreshError && (
+        <div role="alert" className="error">
+          {refreshError}
+          <button onClick={() => void run(load)}>Refresh</button>
+        </div>
+      )}
+      {loading ? (
+        <p role="status">Loading stores…</p>
+      ) : !stores.length ? (
+        <section className="card">
+          <h2>Your first store starts here.</h2>
+          <p className="muted">
+            Choose a name and address. Once ready, open its storefront or use
+            its products and orders in Chat.
+          </p>
+        </section>
+      ) : (
+        <section className="cards" aria-label="Stores">
+          {stores.map((store) => (
+            <article
+              className="card connection"
+              key={store.id}
+              aria-label={store.displayName}
+            >
+              <div className="card-heading">
+                <div className="server-icon">
+                  {store.displayName.slice(0, 1).toUpperCase()}
+                </div>
+                <span
+                  className={`badge ${store.status.toLowerCase()}`}
+                  role="status"
+                >
+                  {store.status}
+                </span>
+              </div>
+              <h2>{store.displayName}</h2>
+              <p className="endpoint">{store.publicUrl}</p>
+              <p className="muted">
+                Created {new Date(store.createdAt).toLocaleString()}
+              </p>
+              {store.status === 'Ready' && (
+                <>
+                  <p>
+                    Tools: <code>{store.upstreamSlug}__*</code>
+                  </p>
+                  <a href={store.publicUrl} target="_blank" rel="noreferrer">
+                    Open storefront ↗
+                  </a>
+                </>
+              )}
+              {store.status === 'Provisioning' && (
+                <p className="muted">
+                  Setting up your store. This page updates automatically.
+                </p>
+              )}
+              {store.status === 'Deleting' && (
+                <p className="muted">
+                  Removing the store, its data and its tools.
+                </p>
+              )}
+              {store.failureReason && (
+                <p className="store-failure" role="alert">
+                  {store.failureReason}
+                </p>
+              )}
+              <div className="card-actions">
+                {store.status === 'Failed' && (
+                  <button
+                    disabled={busy}
+                    onClick={() =>
+                      void action(async () => {
+                        await request(`/stores/${store.id}/retry`, {});
+                      })
+                    }
+                  >
+                    Retry setup
+                  </button>
+                )}
+                {store.status !== 'Deleting' && (
+                  <button
+                    className="danger-text"
+                    disabled={busy}
+                    aria-label={`Delete ${store.displayName}`}
+                    onClick={() => setDeleting(store)}
+                  >
+                    Delete store
+                  </button>
+                )}
+              </div>
+            </article>
+          ))}
+        </section>
+      )}
+      {creating && (
+        <div className="modal-backdrop">
+          <form
+            className="modal"
+            role="dialog"
+            aria-modal="true"
+            aria-label="Create store"
+            onSubmit={(event) => {
+              event.preventDefault();
+              const data = new FormData(event.currentTarget);
+              void action(async () => {
+                await request('/stores', {
+                  displayName: String(data.get('displayName')),
+                  slug: String(data.get('slug')),
+                });
+                setCreating(false);
+              });
+            }}
+          >
+            <p className="eyebrow">NEW STOREFRONT</p>
+            <h2>Create a store</h2>
+            <label>
+              Store name
+              <input
+                name="displayName"
+                required
+                maxLength={60}
+                placeholder="North shop"
+                autoFocus
+              />
+            </label>
+            <label>
+              Store address
+              <input
+                name="slug"
+                required
+                maxLength={12}
+                pattern="[a-z]([a-z0-9-]{0,10}[a-z0-9])?"
+                title="1–12 lowercase letters, digits or hyphens; start with a letter and end with a letter or digit"
+                placeholder="north"
+              />
+            </label>
+            <p className="muted">
+              Use a unique short address, such as north-shop. Your store’s tools
+              will be shared with your team.
+            </p>
+            <div className="modal-actions">
+              <button
+                type="button"
+                disabled={busy}
+                onClick={() => setCreating(false)}
+              >
+                Cancel
+              </button>
+              <button className="primary" disabled={busy}>
+                {busy ? 'Creating…' : 'Create store'}
+              </button>
+            </div>
+          </form>
+        </div>
+      )}
+      {deleting && (
+        <div className="modal-backdrop">
+          <section
+            className="modal"
+            role="dialog"
+            aria-modal="true"
+            aria-label="Delete store"
+          >
+            <h2>Delete {deleting.displayName}?</h2>
+            <p>
+              This permanently removes this store, its products, orders and
+              files. Its tools will be removed from your team’s gateway.
+            </p>
+            <div className="modal-actions">
+              <button disabled={busy} onClick={() => setDeleting(null)}>
+                Cancel
+              </button>
+              <button
+                className="primary danger-button"
+                disabled={busy}
+                onClick={() =>
+                  void action(async () => {
+                    await request(
+                      `/stores/${deleting.id}`,
+                      undefined,
+                      'DELETE',
+                    );
+                    setDeleting(null);
+                  })
+                }
+              >
+                {busy ? 'Deleting…' : 'Delete permanently'}
+              </button>
+            </div>
+          </section>
+        </div>
+      )}
+    </>
+  );
+}
diff --git a/apps/dashboard/src/style.css b/apps/dashboard/src/style.css
index cedc815..1a62911 100644
--- a/apps/dashboard/src/style.css
+++ b/apps/dashboard/src/style.css
@@ -919,3 +919,30 @@ td small {
 .connection-history {
   margin-top: 24px;
 }
+
+.badge.ready {
+  background: #eaf2e3;
+  color: #48713e;
+}
+.badge.provisioning,
+.badge.deleting {
+  background: #fff0df;
+  color: #9a621e;
+}
+.badge.failed {
+  background: #fce9e5;
+  color: #a13f31;
+}
+.store-failure {
+  color: #a13f31;
+  overflow-wrap: anywhere;
+}
+.modal-actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 12px;
+  margin-top: 20px;
+}
+.danger-button {
+  background: #9d3e31;
+}
diff --git a/charts/storelink/templates/apps.yaml b/charts/storelink/templates/apps.yaml
index 3550573..6fffad6 100644
--- a/charts/storelink/templates/apps.yaml
+++ b/charts/storelink/templates/apps.yaml
@@ -54,6 +54,12 @@ spec:
             - { name: HEALTH_INTERVAL_MS, value: {{ .Values.gateway.healthIntervalMs | quote }} }
             - { name: SHUTDOWN_DELAY_MS, value: {{ .Values.gateway.shutdownDelayMs | quote }} }
             - { name: MCP_REQUESTS_PER_MINUTE, value: {{ .Values.gateway.mcpRequestsPerMinute | quote }} }
+            - { name: STORES_ENABLED, value: {{ .Values.stores.enabled | quote }} }
+            - { name: STORES_HOST_SUFFIX, value: {{ .Values.stores.hostSuffix | quote }} }
+            - { name: STORES_SCHEME, value: {{ .Values.stores.scheme | quote }} }
+            - { name: STORES_MAX_PER_TEAM, value: {{ .Values.stores.maxPerTeam | quote }} }
+            - { name: STORES_MAX_PER_USER, value: {{ .Values.stores.maxPerUser | quote }} }
+            - { name: STORES_TIMEOUT_MS, value: {{ mul .Values.stores.provisionTimeoutSeconds 1000 | quote }} }
             {{- if .Values.gateway.metrics.enabled }}
             - { name: METRICS_PORT, value: {{ .Values.gateway.metrics.port | quote }} }
             {{- end }}
diff --git a/charts/storelink/templates/network-policies.yaml b/charts/storelink/templates/network-policies.yaml
index 49deae4..69ef919 100644
--- a/charts/storelink/templates/network-policies.yaml
+++ b/charts/storelink/templates/network-policies.yaml
@@ -3,7 +3,7 @@
 {{- $instance := .Release.Name }}
 {{- $ports := dict "gateway" 3000 "time-mcp" 3002 "operations-mcp" 3003 "woo-mcp" 3001 "postgres" 5432 "mariadb" 3306 "wordpress" 8080 }}
 # Only the listed components can connect to the MCP servers, databases and WordPress.
-{{- range $destination, $sources := dict "time-mcp" (list "gateway") "operations-mcp" (list "gateway") "woo-mcp" (list "gateway") "postgres" (list "gateway") "mariadb" (list "wordpress" "store-bootstrap") "wordpress" (list "woo-mcp") }}
+{{- range $destination, $sources := dict "time-mcp" (list "gateway") "operations-mcp" (list "gateway") "woo-mcp" (list "gateway") "postgres" (list "gateway" "provisioner") "mariadb" (list "wordpress" "store-bootstrap") "wordpress" (list "woo-mcp") }}
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
@@ -124,8 +124,41 @@ spec:
             except: [10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 100.64.0.0/10, 169.254.0.0/16, 127.0.0.0/8]
       ports: [{ protocol: TCP, port: 443 }]
     {{- end }}
+    {{- if .Values.stores.enabled }}
+    # MCP servers of provisioned stores.
+    - to:
+        - namespaceSelector:
+            matchLabels: { storelink/managed-store: "true" }
+          podSelector:
+            matchLabels: { storelink/component: woo-mcp }
+      ports: [{ protocol: TCP, port: 3001 }]
+    {{- end }}
     {{- with .Values.networkPolicies.gatewayEgress }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
+{{- if .Values.stores.enabled }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ $name }}-provisioner
+spec:
+  podSelector:
+    matchLabels: { storelink/component: provisioner, app.kubernetes.io/instance: {{ $instance }} }
+  policyTypes: [Ingress, Egress]
+  egress:
+    - to:
+        - podSelector:
+            matchLabels: { storelink/component: postgres, app.kubernetes.io/instance: {{ $instance }} }
+      ports: [{ protocol: TCP, port: 5432 }]
+    - to:
+        {{- range .Values.networkPolicies.kubernetesApi.cidrs }}
+        - ipBlock: { cidr: {{ . }} }
+        {{- end }}
+      ports:
+        {{- range .Values.networkPolicies.kubernetesApi.ports }}
+        - { protocol: TCP, port: {{ . }} }
+        {{- end }}
+{{- end }}
 {{- end }}
 {{- end }}
diff --git a/charts/storelink/templates/provisioner.yaml b/charts/storelink/templates/provisioner.yaml
new file mode 100644
index 0000000..f936cb0
--- /dev/null
+++ b/charts/storelink/templates/provisioner.yaml
@@ -0,0 +1,163 @@
+{{- if .Values.stores.enabled }}
+{{- if and (eq .Values.stores.scheme "https") (or (empty .Values.stores.tlsSecretName) (empty .Values.stores.tlsClusterIssuer)) }}
+{{- fail "HTTPS stores require stores.tlsSecretName and stores.tlsClusterIssuer (cert-manager)" }}
+{{- end }}
+{{- $name := include "storelink.name" . }}
+{{- $account := printf "system:serviceaccount:%s:%s-provisioner" .Release.Namespace $name }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ $name }}-provisioner
+---
+# Creating stores needs rights in namespaces that do not exist yet, which RBAC can
+# only grant cluster-wide. The admission policy below limits them to store namespaces.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ $name }}-store-provisioner-{{ .Release.Namespace }}
+rules:
+  - apiGroups: [""]
+    resources: [namespaces]
+    verbs: [get, create, patch, delete]
+  - apiGroups: [""]
+    resources: [resourcequotas, limitranges, configmaps, persistentvolumeclaims, services]
+    verbs: [get, create, patch]
+  # Store Secrets are created once and never read back.
+  - apiGroups: [""]
+    resources: [secrets]
+    verbs: [create]
+  - apiGroups: [networking.k8s.io]
+    resources: [networkpolicies, ingresses]
+    verbs: [get, create, patch]
+  - apiGroups: [apps]
+    resources: [deployments]
+    verbs: [get, create, patch]
+  - apiGroups: [batch]
+    resources: [jobs]
+    verbs: [get, create, patch]
+  - apiGroups: [cert-manager.io]
+    resources: [certificates]
+    verbs: [get]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ $name }}-store-provisioner-{{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ $name }}-provisioner
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ $name }}-store-provisioner-{{ .Release.Namespace }}
+  apiGroup: rbac.authorization.k8s.io
+---
+# Registers each store's MCP credential in the gateway's credentials Secret.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ $name }}-provisioner-credentials
+subjects:
+  - kind: ServiceAccount
+    name: {{ $name }}-provisioner
+roleRef:
+  kind: Role
+  name: {{ $name }}-credentials
+  apiGroup: rbac.authorization.k8s.io
+---
+# Enforced by the API server: the provisioner may change only namespaces labelled
+# as managed stores and the objects inside them, plus the credentials Secret.
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: {{ $name }}-store-provisioner-{{ .Release.Namespace }}
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+      - apiGroups: ["", apps, batch, networking.k8s.io, rbac.authorization.k8s.io]
+        apiVersions: ["*"]
+        operations: [CREATE, UPDATE, DELETE]
+        resources: ["*"]
+  matchConditions:
+    - name: provisioner
+      expression: request.userInfo.username == {{ $account | quote }}
+  validations:
+    - message: The store provisioner may only change managed store namespaces
+      expression: >-
+        (request.kind.kind == 'Secret' && request.operation == 'UPDATE'
+          && request.namespace == {{ .Release.Namespace | quote }}
+          && request.name == {{ .Values.upstreamSecretName | quote }})
+        || (request.kind.kind == 'Namespace' && request.name.startsWith('storelink-store-')
+          && (request.operation == 'DELETE' ? oldObject : object).metadata.?labels[?'storelink/managed-store'].orValue('') == 'true')
+        || (request.kind.kind != 'Namespace' && request.namespace.startsWith('storelink-store-')
+          && namespaceObject != null
+          && namespaceObject.metadata.?labels[?'storelink/managed-store'].orValue('') == 'true')
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: {{ $name }}-store-provisioner-{{ .Release.Namespace }}
+spec:
+  policyName: {{ $name }}-store-provisioner-{{ .Release.Namespace }}
+  validationActions: [Deny]
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ $name }}-provisioner
+spec:
+  replicas: 1
+  strategy: { type: Recreate }
+  selector:
+    matchLabels: { storelink/component: provisioner, app.kubernetes.io/instance: {{ .Release.Name }} }
+  template:
+    metadata:
+      labels: { storelink/component: provisioner, app.kubernetes.io/instance: {{ .Release.Name }} }
+    spec:
+      serviceAccountName: {{ $name }}-provisioner
+      automountServiceAccountToken: true
+      securityContext: { runAsNonRoot: true, runAsUser: 1000, runAsGroup: 1000 }
+      containers:
+        - name: provisioner
+          image: {{ .Values.images.app | quote }}
+          imagePullPolicy: {{ .Values.images.pullPolicy }}
+          command: [node, services/gateway/src/provisioner-main.ts]
+          env:
+            - { name: DATABASE_URL_FILE, value: /secrets/database-url }
+            - { name: API_KEY_PEPPER_FILE, value: /secrets/api-key-pepper }
+            - name: POD_NAMESPACE
+              valueFrom: { fieldRef: { fieldPath: metadata.namespace } }
+            - { name: UPSTREAM_SECRET_NAME, value: {{ .Values.upstreamSecretName | quote }} }
+            - { name: GATEWAY_INSTANCE, value: {{ .Release.Name | quote }} }
+            - { name: STORE_IMAGE_APP, value: {{ .Values.images.app | quote }} }
+            - { name: STORE_IMAGE_STORE, value: {{ .Values.images.store | quote }} }
+            - { name: STORE_IMAGE_MARIADB, value: {{ .Values.images.mariadb | quote }} }
+            - { name: STORE_IMAGE_PULL_POLICY, value: {{ .Values.images.pullPolicy | quote }} }
+            - { name: STORES_HOST_SUFFIX, value: {{ .Values.stores.hostSuffix | quote }} }
+            - { name: STORES_SCHEME, value: {{ .Values.stores.scheme | quote }} }
+            - { name: STORES_TLS_SECRET, value: {{ .Values.stores.tlsSecretName | quote }} }
+            - { name: STORES_TLS_CLUSTER_ISSUER, value: {{ .Values.stores.tlsClusterIssuer | quote }} }
+            - { name: STORES_QUOTA, value: {{ toJson .Values.stores.quota | quote }} }
+            - { name: STORES_INGRESS_CLASS, value: {{ .Values.ingress.className | quote }} }
+            - { name: STORES_STORAGE_CLASS, value: {{ .Values.storage.className | quote }} }
+            - { name: STORES_WORDPRESS_STORAGE, value: {{ .Values.stores.storage.wordpress | quote }} }
+            - { name: STORES_MARIADB_STORAGE, value: {{ .Values.stores.storage.mariadb | quote }} }
+            - { name: STORES_RESOURCES, value: {{ toJson .Values.stores.resources | quote }} }
+            - { name: STORE_TIMEZONE, value: {{ .Values.store.timezone | quote }} }
+            - { name: WOOCOMMERCE_VERSION, value: {{ .Values.store.woocommerceVersion | quote }} }
+          ports: [{ name: http, containerPort: 3000 }]
+          startupProbe: { httpGet: { path: /health/live, port: http }, periodSeconds: 2, failureThreshold: 60 }
+          readinessProbe: { httpGet: { path: /health/ready, port: http }, periodSeconds: 10 }
+          livenessProbe: { httpGet: { path: /health/live, port: http }, periodSeconds: 10 }
+          securityContext: { allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities: { drop: [ALL] } }
+          resources: {{ toYaml .Values.stores.provisioner.resources | nindent 12 }}
+          volumeMounts: [{ name: secrets, mountPath: /secrets, readOnly: true }]
+      volumes:
+        - name: secrets
+          secret:
+            secretName: {{ .Values.secretName }}
+            items:
+              - { key: database-url, path: database-url }
+              - { key: api-key-pepper, path: api-key-pepper }
+{{- end }}
diff --git a/charts/storelink/values-prod.yaml b/charts/storelink/values-prod.yaml
index 21d54b7..d3cd7a9 100644
--- a/charts/storelink/values-prod.yaml
+++ b/charts/storelink/values-prod.yaml
@@ -6,6 +6,13 @@ images:
 store:
   host: store.example.com
   publicUrl: https://store.example.com
+stores:
+  hostSuffix: store.example.com
+  scheme: https
+  tlsSecretName: storefront-tls
+  # Install cert-manager and configure this ClusterIssuer before enabling stores.
+  tlsClusterIssuer: letsencrypt-prod
+  provisionTimeoutSeconds: 600
 gateway:
   host: dashboard.example.com
   publicUrl: https://dashboard.example.com
diff --git a/charts/storelink/values.yaml b/charts/storelink/values.yaml
index 013f227..53bdee9 100644
--- a/charts/storelink/values.yaml
+++ b/charts/storelink/values.yaml
@@ -57,6 +57,35 @@ mariadb:
   resources:
     requests: { cpu: 50m, memory: 96Mi }
     limits: { cpu: '1', memory: 384Mi }
+# Additional stores created from the dashboard, each in its own namespace.
+stores:
+  enabled: true
+  # Storefronts are served at <slug>.<hostSuffix>; production needs wildcard DNS.
+  hostSuffix: store.storelink.localhost
+  scheme: http
+  # cert-manager creates a separate TLS Secret in each store namespace for HTTPS.
+  tlsSecretName: ''
+  tlsClusterIssuer: ''
+  maxPerTeam: 3
+  maxPerUser: 2
+  quota:
+    requests.storage: 8Gi
+  provisionTimeoutSeconds: 240
+  storage: { wordpress: 2Gi, mariadb: 1Gi }
+  resources:
+    wordpress:
+      requests: { cpu: 100m, memory: 256Mi }
+      limits: { cpu: '1', memory: 768Mi }
+    mariadb:
+      requests: { cpu: 50m, memory: 96Mi }
+      limits: { cpu: '1', memory: 384Mi }
+    wooMcp:
+      requests: { cpu: 25m, memory: 64Mi }
+      limits: { cpu: '1', memory: 192Mi }
+  provisioner:
+    resources:
+      requests: { cpu: 25m, memory: 64Mi }
+      limits: { cpu: 500m, memory: 192Mi }
 storage:
   className: local-path
   wordpress: 2Gi
diff --git a/docs/multi-store.md b/docs/multi-store.md
new file mode 100644
index 0000000..e59508e
--- /dev/null
+++ b/docs/multi-store.md
@@ -0,0 +1,77 @@
+# Multi-store Provisioning
+
+The Stores dashboard provisions independent WooCommerce stores and connects each to the team's existing MCP gateway. It is enabled by `stores.enabled` in the same Helm chart used for the original store.
+
+## Using Stores
+
+1. Sign in and open **Stores → Create store**. Supply a display name and a globally unique address of 1–12 lowercase letters, digits or interior hyphens, beginning with a letter.
+2. The card shows **Provisioning**, then **Ready** or **Failed**, with a failure reason. Status refreshes automatically. A Ready card links to its storefront and identifies its tool prefix, such as `woo-north__*`.
+3. Members list, retry and delete their own stores. Administrators manage every store in their team. Store tools are shared with that team's members, consistent with the gateway's existing shared-upstream model.
+4. Use **Retry setup** after a failure. Use **Delete store**, then confirm permanent deletion, to remove a store's products, orders, files and gateway registration.
+
+No store, database or upstream credentials are returned by these APIs. WordPress administration credentials are operator-managed in that store namespace's `store-credentials` Secret; the dashboard does not expose them.
+
+For example, create `north` and `south`, place a COD order in each, then ask Chat: “Compare today's orders in woo-north and woo-south. Use the time server for the day window and report each store's total and currency.”
+
+## Desired state and recovery
+
+The gateway records requests in PostgreSQL and announces work with `NOTIFY`. A separate provisioner reconciles pending stores every five seconds and on notifications. It holds a PostgreSQL advisory lock so overlapping controller pods cannot reconcile simultaneously. The gateway has no provisioning ClusterRole.
+
+Each `storelink-store-<slug>` namespace gets its own MariaDB, WordPress, WooCommerce MCP, Services, Ingress, Secrets, two PVCs, readiness/liveness probes, resource limits, ResourceQuota and LimitRange. Kubernetes runs different stores' workloads concurrently. Bootstrap uses the bundled WooCommerce plugin and is idempotent.
+
+A persisted attempt number gives retries a new bootstrap Job even if a previous Job is terminally Failed. Existing PVCs and random database/WordPress credentials remain unchanged. Newly created stores use a domain-separated HMAC of the Secret-held API-key pepper and immutable store ID for the MCP token. The controller can reconstruct that token after an interruption between creating the store Secret and saving the gateway's encrypted credential. It never reads back the store's database passwords. Existing development-era stores with random tokens retain their old behavior; if both credential copies are lost, their failure message requires recreation.
+
+Ready requires available workloads and a successful setup Job. With certificate automation enabled, it also requires the store's Certificate to be Ready. Failed provisioning retains resources for inspection/retry and still consumes quota. Status updates use compare-and-set predicates, so a concurrent deletion cannot be overwritten by Ready.
+
+Deletion unregisters tools and removes the encrypted MCP credential before deleting the managed namespace. The database row remains Deleting until Kubernetes confirms the namespace is gone. Use a StorageClass with **Delete** reclaim policy for automatic volume/data removal; Retain classes deliberately require operator cleanup and do not satisfy automatic teardown. Do not remove a namespace's finalizers blindly if deletion stalls.
+
+## Limits and isolation
+
+Defaults are two stores per user, three per team and a 240-second provisioning deadline. Check-and-insert runs in a short PostgreSQL transaction under a shared lock, so concurrent requests across gateway replicas cannot bypass either limit. Deleting and Failed stores count until removed. Configure `stores.maxPerUser`, `stores.maxPerTeam`, `stores.provisionTimeoutSeconds`, `stores.resources`, `stores.storage` and `stores.quota` in values; storage requests must fit the namespace storage quota.
+
+Every generated namespace starts with ingress and egress denied. Explicit rules allow its MCP to its WordPress, WordPress to its MariaDB, bootstrap to MariaDB, DNS, Traefik to the storefront, and the platform gateway to MCP. Cross-store WordPress/database connections are blocked. HTTP-01 certificate solvers have a separate rule for Traefik to their challenge port.
+
+The provisioner has cluster-level permissions because it creates namespaces. Application-side namespace checks and an API-server ValidatingAdmissionPolicy restrict its mutations to managed store namespaces, with an exception for the gateway's named credential Secret. The controller remains a privileged, trusted component; these guards do not sandbox arbitrary code executing inside it. The cluster must support `admissionregistration.k8s.io/v1` ValidatingAdmissionPolicy.
+
+## Production DNS and TLS
+
+`values-prod.yaml` sets HTTPS storefront URLs, a per-store TLS Secret name and a cert-manager ClusterIssuer. Supply real values for:
+
+```yaml
+stores:
+  hostSuffix: stores.example.com
+  scheme: https
+  tlsSecretName: storefront-tls
+  tlsClusterIssuer: letsencrypt-prod
+  provisionTimeoutSeconds: 600
+```
+
+Point wildcard DNS `*.stores.example.com` at the VPS Ingress. Install cert-manager using its [official Helm instructions](https://cert-manager.io/docs/installation/helm/) and configure the named ClusterIssuer first. For HTTP-01, its solver must use your Ingress class (Traefik by default) and the public hostnames must resolve to that Ingress. The generated Ingress annotation asks ingress-shim to create a Certificate and TLS Secret **inside each store namespace**, rather than referring to the base namespace's Secret. See the [official cert-manager Ingress guide](https://cert-manager.io/docs/usage/ingress/). HTTPS store configuration without the issuer/Secret settings fails Helm rendering. Certificate delays appear as pending TLS and eventually a bounded failure, rather than a false Ready state.
+
+Public DNS, issuer credentials and VPS provisioning are operator setup. No domain or VPS was purchased, and real public certificate issuance has not been exercised by the local acceptance test. Local stores use HTTP on `*.store.storelink.localhost`.
+
+## Backups and upgrades
+
+Back up the application PostgreSQL database, both platform Secrets (pepper and encrypted gateway credentials), and **each store's** database, WordPress files and `store-credentials` Secret. For a store called north:
+
+```sh
+umask 077
+backup="$HOME/storelink-backups/north-$(date +%Y%m%d-%H%M%S)"
+mkdir -p "$backup"
+namespace=storelink-store-north
+kubectl -n "$namespace" exec deploy/mariadb -- \
+  sh -c 'mariadb-dump -uroot -p"$MARIADB_ROOT_PASSWORD" --single-transaction --routines wordpress' > "$backup/database.sql"
+kubectl -n "$namespace" exec deploy/wordpress -- \
+  tar -C /var/www/html -czf - . > "$backup/wordpress.tgz"
+kubectl -n "$namespace" get secret store-credentials -o yaml > "$backup/credentials.yaml"
+```
+
+Take a coordinated backup with writers quiesced if database/files consistency is required. Before restoring, pause the provisioner and store writers, restore matching database/files/Secrets, then restart store pods and reconciliation. Preserve the original store row/ID and platform pepper so the MCP token and encrypted credential agree. cert-manager can reissue certificates; also back up the issuer/account configuration according to its recovery procedure. Test restores in an isolated environment before relying on backups. The local bonus check tests controller restart recovery, not disaster recovery from these backups.
+
+Changing the platform app/store images affects future stores and retries; Ready stores are not silently upgraded by this controller. Plan explicit per-store migrations and backups for existing stores. Helm rollback restores platform manifests; it does not roll back provisioned namespace data or database schemas.
+
+## Verification
+
+Run `node scripts/smoke-multistore.ts` on the configured local cluster. It acquires the shared cluster lock, requires no existing additional stores, creates temporary stores and real COD orders, and makes **one paid, read-only OpenAI chat turn**. Its cleanup removes its stores while retaining the attributed audit history and chat evidence.
+
+The check verifies real concurrent admission, browser create/list/retry/delete, member ownership, a forced terminal bootstrap failure followed by retry, provisioner restart, unchanged credentials, two-store MCP discovery, blocked cross-store traffic, today's-order comparison, stale-tool refusal, surviving-store availability and namespace/PV cleanup. Evidence is saved privately to `.data/multi-store-evidence.json`; screenshots are in `.cache/multi-store-*.png`.
diff --git a/docs/system-design.md b/docs/system-design.md
index ff2b266..1574986 100644
--- a/docs/system-design.md
+++ b/docs/system-design.md
@@ -57,6 +57,14 @@ The gateway (`services/gateway/src/gateway.ts`) uses `@modelcontextprotocol/sdk`
 - **Upstream credentials and SSRF checks:** Upstream credentials are stored in a dedicated Kubernetes Secret (`storelink-upstream-credentials`) as AES-256-GCM envelopes keyed from the API key pepper, with the credential ID as authenticated data; PostgreSQL stores only the key reference. On startup the gateway encrypts any plaintext entries left by older releases. A namespaced `Role` (`charts/storelink/templates/registry-rbac.yaml`) restricts the gateway `ServiceAccount` to `get` and `patch` on that single Secret. Admins can register public HTTPS upstreams directly in the dashboard; `UpstreamPolicy` resolves DNS and verifies that all returned IP addresses are public unicast addresses both at registration time and in the socket `lookup` callback. Cluster-internal HTTP upstreams require an explicit entry in `gateway.extraUpstreamOrigins`. With default-deny network policies on, they also need a `networkPolicies.gatewayEgress` rule, since the gateway's egress policy then allows only its own MCP servers, PostgreSQL, the Kubernetes API and public HTTPS on port 443.
 - **Chat loop:** `services/gateway/src/chat.ts` runs an OpenAI Responses API tool loop (`gpt-6-luna` default; bounded to 8 rounds, 20 tool calls and 120 seconds per turn). On each round it fetches `gateway.listTools(actor)` and executes model tool calls through `gateway.call(actor, ...)`, sharing the exact authorization and audit path used by external MCP clients. Conversations and token counts are persisted per user.
 
+## Multi-store provisioning
+
+The Stores UI records owner/team-scoped desired state in PostgreSQL. A separate provisioner, guarded by a database advisory lock, reconciles each store into its own namespace with database, WordPress, MCP, credentials, PVCs, Ingress, default-deny policies, quotas and limits. The Internet-facing gateway retains only its named-Secret RBAC; provisioning rights and a mutation admission policy that checks namespace ownership belong to the separate controller.
+
+Store admission is atomic across gateway replicas and enforces both user and team limits. Persisted attempt numbers create fresh bootstrap Jobs on retry. Domain-separated, per-store MCP token derivation closes the Secret-create/credential-save interruption window without exposing database passwords to the gateway. Ready follows successful bootstrap/workloads and, for HTTPS stores, certificate readiness. Deletion unregisters tools before removing the namespace and retains its row until teardown finishes.
+
+Store tools use `woo-<slug>__<tool>`. Members manage their own store lifecycle; store tool capabilities are shared across their team. The base time server and generated stores use the same configured timezone. See [the multi-store guide](multi-store.md) for lifecycle, production TLS, storage reclaim policy, backup and image-upgrade tradeoffs.
+
 ## Production changes
 
 Local (`values-local.yaml`) and production (`values-prod.yaml`) deployments use the same Helm chart (`charts/storelink`):
diff --git a/docs/threat-model.md b/docs/threat-model.md
index 944c656..d08e770 100644
--- a/docs/threat-model.md
+++ b/docs/threat-model.md
@@ -55,3 +55,11 @@ Within a team, members share the store and upstream tool catalog:
 - **Container security:** Every workload runs as a non-root user without privilege escalation and with all Linux capabilities dropped. Application and MCP containers (`gateway`, `woo-mcp`, `time-mcp`, `operations-mcp`) run as UID `1000` with a read-only root filesystem. PostgreSQL runs as `70` and MariaDB as `999`. WordPress and its bootstrap Job run as `www-data` (`33`), with Apache on port 8080 inside the pod.
 - **Upstream credentials at rest:** Each entry in `storelink-upstream-credentials` is an AES-256-GCM envelope (`packages/shared/src/credential-cipher.ts`). The key is derived with HKDF-SHA256 from the API key pepper, and the credential ID is authenticated data, so an entry copied into another server's slot fails to decrypt instead of sending one server's token to another. Altered entries fail closed. This protects against anyone who can read the upstream Secret, its backups or etcd snapshots but not `storelink-credentials`. It does not protect against anyone who can read every Secret in the namespace, because the pepper is in `storelink-credentials`. Rotating the pepper makes the stored credentials unreadable, so they must be re-entered.
 - **Secrets and transport:** Internal WooCommerce REST calls use OAuth 1.0a HMAC-SHA256 over cluster HTTP; production deployments that require encrypted pod-to-pod traffic should enable a CNI wire-encryption layer or service mesh. Enable Kubernetes Secret encryption at rest on the k3s host and restrict access to `.data/cluster-secrets.json` and `.data/kubeconfig` (`0600`).
+
+## Provisioned stores
+
+Store lifecycle APIs allow members to manage their own stores and admins to manage stores only in their team. A PostgreSQL transaction enforces per-user and per-team caps under concurrent creation. Every store namespace has its own database, WordPress, random database/REST credentials, PVCs and default-deny network rules; it cannot connect to another store's WordPress or database. All tool calls still pass through the team's gateway, so a teammate can use another teammate's shared store tools. Lifecycle ownership is not a per-tool ACL.
+
+A separate trusted provisioner holds the cluster-level permissions needed to create/delete namespaces. An API-server admission policy constrains its writes to managed store namespaces and the named gateway credential Secret, while the application also validates namespace names and checks the managed label before deletion. This reduces accidental cross-namespace mutation; compromise of this privileged controller remains a serious cluster trust-boundary failure. The gateway has no store-provisioning ClusterRole.
+
+New-store MCP tokens are derived from the Secret-held pepper and immutable store ID using a distinct HMAC domain. This permits crash recovery without reading store database passwords. The pepper already grants access to the gateway's encrypted upstream tokens; losing it requires a coordinated credential recovery plan. Delete confirmation describes permanent data loss, and the controller removes gateway registration before namespace teardown. A Delete-reclaim StorageClass is required for automatic volume removal; backup/restore and root-key rotation remain operator responsibilities. See [multi-store operations](multi-store.md).
diff --git a/docs/verification.md b/docs/verification.md
index a07e464..5f7ee34 100644
--- a/docs/verification.md
+++ b/docs/verification.md
@@ -2,7 +2,7 @@
 
 ## Automated test suite
 
-`npm test` runs 52 deterministic unit and protocol tests across thirteen test files without making paid OpenAI calls:
+`npm test` runs 66 deterministic unit and protocol tests across fifteen test files without making paid OpenAI calls:
 
 - **`tests/gateway.test.ts`:** API key HMAC digest lookup, revoked-key attribution after restart, `<slug>__<alias>` tool collision routing (`time__get_status` vs `ops__get_status`), immediate route removal on disable, hung upstream timeout isolation, uncertain mutation auditing without retries, argument schema validation, cross-team route isolation, audit-failure fail-closed behavior, and full MCP SDK Streamable HTTP exchanges.
 - **`tests/mcp-notifications.test.ts`:** Stateful Streamable HTTP + GET SSE sessions, team-scoped `notifications/tools/list_changed` delivery, suppression of unchanged catalog refreshes, cross-user/cross-key session rejection (`403`), revoked-key notification cutoff, per-user/global session limits (`429`), `DELETE` cleanup, and idle session expiry (`404`).
@@ -27,6 +27,14 @@ All cluster scripts run against the local k3d deployment (`storelink` namespace)
 - **`node scripts/smoke-failures.ts`:** Exercises held scale-to-zero outages, verifies `storelink-gateway` rollout restart retains sessions, disabled server state and audit rows, and verifies `storelink-wordpress` rollout restart retains product and order data on its PVC.
 - **`node --env-file=.env scripts/smoke-chat.ts` & `node scripts/smoke-chat-regressions.ts`:** Runs the end-to-end two-user flow with live OpenAI (`gpt-6-luna`): User A creates a product in dashboard chat, places a browser COD order, queries today's orders across `time` and `woo`, and reloads saved conversation history and token counts; User B connects with a separate API key, runs a multi-upstream prompt (`time`, `woo`, `ops`), and verifies server disable, key revocation, conversation isolation (`404`), and attributed audit rows.
 
+## Multi-store bonus acceptance
+
+`node scripts/smoke-multistore.ts` passed locally on 2026-10-26. Two users created independent stores from the dashboard. The check reproduced a terminal bootstrap failure, retried through the UI with a new attempt, restarted the provisioner and confirmed that credentials survived unchanged. A real concurrent admission test accepted one request and rejected the other with 409 when one personal slot remained. Members could not delete/retry another user's store.
+
+The gateway discovered ten additional tools. Cross-store connections to WordPress and MariaDB were blocked while authorized calls worked. COD checkout created one order per store, totaling ₹149.00 and ₹249.00. One dashboard chat turn called the time server and both stores' order tools and compared the totals. Deleting one store removed its tools while the other stayed usable; final deletion removed both namespaces and all four PVs, returning the gateway to nine tools.
+
+Private evidence: `.data/multi-store-evidence.json` and `.cache/multi-store-*.png`. The test cleans up its stores/products/orders and preserves the chat and audit evidence. Deterministic tests in `tests/stores.test.ts` and `tests/store-requests.test.ts` cover manifests, namespace safety, attempt-based retries, token crash recovery, TLS readiness, quota admission and state transitions. The check also passed with the platform namespace’s optional default-deny mode enabled, after which its original setting was restored. The final run used 7,458 input / 278 output model tokens. Both runs used local HTTP; public DNS/certificate issuance and disaster restore are not claimed. See [operations](multi-store.md).
+
 ## External MCP client verification
 
 In addition to MCP Inspector (`npx @modelcontextprotocol/inspector`) and the SDK smoke scripts, the gateway was verified with **Claude Code** (`claude -p`) configured solely with `http://dashboard.storelink.localhost/mcp` and a member Bearer key:
@@ -42,14 +50,15 @@ Claude Code discovered the tools of all three servers (`mcp__storelink__woo__*`,
 
 Mapping against the assignment brief's numbered stand-out items:
 
-| Item                                         | Status                                              | Implementation                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| -------------------------------------------- | --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **#1 Production-like VPS deployment**        | Documented & templated (not deployed to a live VPS) | `charts/storelink/values-prod.yaml`, [README production guide](../README.md#production-deployment-k3s), [system design](system-design.md#production-changes)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| **#6 Security hardening**                    | Implemented (default-deny off by default)           | Ingress `NetworkPolicy` isolation for the MCP servers, databases and WordPress, plus an optional default-deny ingress and egress mode with per-component allow rules (`networkPolicies.defaultDeny`, `charts/storelink/templates/network-policies.yaml`), checked live with the mode on by probing blocked paths (MCP servers to PostgreSQL and the internet, Woo MCP to MariaDB, gateway to MariaDB and WordPress); every workload non-root with capabilities dropped (PostgreSQL `70`, MariaDB `999`, WordPress `33` on port 8080, app containers `1000`), checked on an upgraded and a fresh install; AES-256-GCM upstream credentials bound to their ID (`packages/shared/src/credential-cipher.ts`, `services/gateway/src/credentials.ts`, `tests/credentials.test.ts`); single-Secret least-privilege RBAC (`charts/storelink/templates/registry-rbac.yaml`); SSRF and socket-level DNS rebinding checks (`services/gateway/src/upstream-policy.ts`, `tests/upstream-policy.test.ts`). Cluster-level Secret encryption at rest is a k3s host setting. |
-| **#7 Scaling**                               | Implemented                                         | Two gateway replicas (`gateway.replicas`) sharing MCP sessions with handshake replay on any replica (`services/gateway/src/mcp-sessions.ts`, `services/gateway/src/mcp.ts`), per-request registry revision checks plus `LISTEN/NOTIFY` for configuration changes (`services/gateway/src/registry.ts`), PostgreSQL-backed rate limits including a per-key `/mcp` limit and chat concurrency leases (`services/gateway/src/rate-limits.ts`), and graceful rolling shutdown. Tests: `tests/scaling.test.ts`; live: `scripts/smoke-scaling.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| **#8 Observability**                         | Implemented                                         | Prometheus `/metrics` on in-cluster port `9464` with per-server call counters by outcome, a latency histogram, and upstream up/status/last-failure gauges (`services/gateway/src/metrics.ts`, `services/gateway/src/main.ts`); 24-hour per-server calls, error rate and avg/p95 latency on dashboard cards and `GET /api/metrics`; 1-second health probes with persisted `lastError` and `upstream_events` history; per-call outcome, reason and duration in `audit_calls`. Tests: `tests/metrics.test.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| **#9 Upgrades and rollback**                 | Implemented & rehearsed                             | Revision-scoped store bootstrap Job (`charts/storelink/templates/store.yaml`), backward-compatible additive SQL migrations (`services/gateway/migrations/`), and an upgrade/rollback procedure rehearsed on the local cluster, with backups verified by restoring them into scratch databases, in [README](../README.md#upgrades-and-rollback) and [system design](system-design.md#upgrades-and-rollback).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| **Bonus (Multi-store provisioning) & #2–#5** | Not attempted                                       | Deferred in favor of completing the core platform and the items above.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| Item                                  | Status                                              | Implementation                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| ------------------------------------- | --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **#1 Production-like VPS deployment** | Documented & templated (not deployed to a live VPS) | `charts/storelink/values-prod.yaml`, [README production guide](../README.md#production-deployment-k3s), [system design](system-design.md#production-changes)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| **#6 Security hardening**             | Implemented (default-deny off by default)           | Ingress `NetworkPolicy` isolation for the MCP servers, databases and WordPress, plus an optional default-deny ingress and egress mode with per-component allow rules (`networkPolicies.defaultDeny`, `charts/storelink/templates/network-policies.yaml`), checked live with the mode on by probing blocked paths (MCP servers to PostgreSQL and the internet, Woo MCP to MariaDB, gateway to MariaDB and WordPress); every workload non-root with capabilities dropped (PostgreSQL `70`, MariaDB `999`, WordPress `33` on port 8080, app containers `1000`), checked on an upgraded and a fresh install; AES-256-GCM upstream credentials bound to their ID (`packages/shared/src/credential-cipher.ts`, `services/gateway/src/credentials.ts`, `tests/credentials.test.ts`); single-Secret least-privilege RBAC (`charts/storelink/templates/registry-rbac.yaml`); SSRF and socket-level DNS rebinding checks (`services/gateway/src/upstream-policy.ts`, `tests/upstream-policy.test.ts`). Cluster-level Secret encryption at rest is a k3s host setting. |
+| **#7 Scaling**                        | Implemented                                         | Two gateway replicas (`gateway.replicas`) sharing MCP sessions with handshake replay on any replica (`services/gateway/src/mcp-sessions.ts`, `services/gateway/src/mcp.ts`), per-request registry revision checks plus `LISTEN/NOTIFY` for configuration changes (`services/gateway/src/registry.ts`), PostgreSQL-backed rate limits including a per-key `/mcp` limit and chat concurrency leases (`services/gateway/src/rate-limits.ts`), and graceful rolling shutdown. Tests: `tests/scaling.test.ts`; live: `scripts/smoke-scaling.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| **#8 Observability**                  | Implemented                                         | Prometheus `/metrics` on in-cluster port `9464` with per-server call counters by outcome, a latency histogram, and upstream up/status/last-failure gauges (`services/gateway/src/metrics.ts`, `services/gateway/src/main.ts`); 24-hour per-server calls, error rate and avg/p95 latency on dashboard cards and `GET /api/metrics`; 1-second health probes with persisted `lastError` and `upstream_events` history; per-call outcome, reason and duration in `audit_calls`. Tests: `tests/metrics.test.ts`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| **#9 Upgrades and rollback**          | Implemented & rehearsed                             | Revision-scoped store bootstrap Job (`charts/storelink/templates/store.yaml`), backward-compatible additive SQL migrations (`services/gateway/migrations/`), and an upgrade/rollback procedure rehearsed on the local cluster, with backups verified by restoring them into scratch databases, in [README](../README.md#upgrades-and-rollback) and [system design](system-design.md#upgrades-and-rollback).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| **Bonus: Multi-store provisioning**   | Implemented and verified locally                    | `apps/dashboard/src/stores.tsx`, store request/provisioner/manifests source, `charts/storelink/templates/provisioner.yaml`, migrations 0008–0009, `tests/stores.test.ts`, `tests/store-requests.test.ts`, `scripts/smoke-multistore.ts`; [guide](multi-store.md).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| **#2–#5**                             | Not attempted                                       | Per-tool ACLs, gateway OAuth, large-catalog search and hosted arbitrary MCP images remain outside this implementation.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 
 Additional platform features:
 
diff --git a/images/app/Dockerfile b/images/app/Dockerfile
index 6d87ea9..0ebb2a5 100644
--- a/images/app/Dockerfile
+++ b/images/app/Dockerfile
@@ -20,6 +20,8 @@ RUN npm ci --omit=dev --ignore-scripts --cache=/tmp/npm-cache && rm -rf /tmp/npm
 COPY --chown=node:node packages packages
 COPY --chown=node:node services services
 COPY --chown=node:node scripts/bootstrap-cluster.ts scripts/bootstrap-cluster.ts
+# The store provisioner mounts the same readiness probe into each store.
+COPY --chown=node:node charts/storelink/files/health.php charts/storelink/files/health.php
 COPY --from=dashboard-build --chown=node:node /app/apps/dashboard/dist apps/dashboard/dist
 USER node
 ENV NODE_ENV=production BIND_ADDRESS=0.0.0.0
diff --git a/images/store/bootstrap.sh b/images/store/bootstrap.sh
index 4792870..0544b83 100644
--- a/images/store/bootstrap.sh
+++ b/images/store/bootstrap.sh
@@ -8,7 +8,7 @@ for attempt in $(seq 1 120); do
   sleep 2
 done
 if ! wp core is-installed --quiet; then
-  wp core install --url="$STORE_PUBLIC_URL" --title='StoreLink Demo Store' \
+  wp core install --url="$STORE_PUBLIC_URL" --title="${STORE_TITLE:-StoreLink Demo Store}" \
     --admin_user="$WORDPRESS_ADMIN_USER" --admin_password="$WORDPRESS_ADMIN_PASSWORD" \
     --admin_email='admin@storelink.test' --skip-email --quiet
 fi
diff --git a/scripts/smoke-multistore.ts b/scripts/smoke-multistore.ts
new file mode 100644
index 0000000..8805cfe
--- /dev/null
+++ b/scripts/smoke-multistore.ts
@@ -0,0 +1,546 @@
+// Live bonus acceptance: creates/removes isolated stores and makes one paid chat turn.
+import assert from 'node:assert/strict';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { chromium } from '@playwright/test';
+import type { BrowserContext, Page } from '@playwright/test';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { CallToolResultSchema } from '@modelcontextprotocol/sdk/types.js';
+import { acquireClusterLock } from './lib/cluster-lock.ts';
+import { kubectlCommand } from './lib/kubectl.ts';
+import { closeClient } from './lib/mcp-client.ts';
+
+type Store = {
+  id: string;
+  slug: string;
+  displayName: string;
+  publicUrl: string;
+  status: string;
+  failureReason: string | null;
+  upstreamSlug: string;
+  attempt: number;
+};
+acquireClusterLock();
+const started = new Date().toISOString();
+console.log(`Multi-store acceptance started at ${started}`);
+const execute = promisify(execFile);
+const kube = async (...args: string[]) =>
+  (
+    await execute(kubectlCommand(), args, {
+      env: { ...process.env, KUBECONFIG: `${process.cwd()}/.data/kubeconfig` },
+      timeout: 150000,
+      maxBuffer: 1024 * 1024,
+    })
+  ).stdout;
+const material = JSON.parse(readFileSync('.data/cluster-secrets.json', 'utf8'));
+const secret = (name: string) =>
+  Buffer.from(material[name], 'base64').toString('utf8');
+const origin = 'http://dashboard.storelink.localhost';
+const nonce = Date.now().toString(36).slice(-8);
+const north = `n${nonce}`,
+  south = `s${nonce}`;
+const browser = await chromium.launch({
+  channel: 'chrome',
+  headless: true,
+  args: ['--no-sandbox'],
+});
+const admin = await browser.newContext({
+    viewport: { width: 1440, height: 1000 },
+  }),
+  member = await browser.newContext();
+const client = new Client({
+  name: 'storelink-multi-store-check',
+  version: '1',
+});
+const owned = new Set<string>();
+let paused = false;
+const evidence: Record<string, unknown> = { started };
+async function until(check: () => Promise<boolean>, ms = 120000) {
+  const end = Date.now() + ms;
+  while (Date.now() < end) {
+    if (await check()) return;
+    await new Promise((resolve) => setTimeout(resolve, 500));
+  }
+  throw new Error('Timed out waiting for multi-store acceptance state');
+}
+async function login(context: BrowserContext, role: 'admin' | 'member') {
+  const page = await context.newPage();
+  page.setDefaultTimeout(20000);
+  await page.goto(origin);
+  await page.getByLabel('Email address').fill(`${role}@storelink.local`);
+  await page
+    .getByLabel('Password', { exact: true })
+    .fill(secret(`dashboard-${role}-password`));
+  await page.getByRole('button', { name: /^Sign in/ }).click();
+  await page.getByRole('navigation', { name: 'Main navigation' }).waitFor();
+  await page.getByRole('button', { name: 'Stores', exact: true }).click();
+  await page
+    .getByRole('heading', { name: 'Your stores', exact: true })
+    .waitFor();
+  return page;
+}
+async function api(
+  context: BrowserContext,
+  path: string,
+  body?: unknown,
+  method = body ? 'POST' : 'GET',
+  expected = 200,
+): Promise<any> {
+  const me = await (await context.request.get(origin + '/api/me')).json();
+  const response = await context.request.fetch(origin + '/api' + path, {
+    method,
+    data: body,
+    headers: { origin, 'x-csrf-token': me.csrf },
+    timeout: 150000,
+  });
+  assert.equal(
+    response.status(),
+    expected,
+    `${method} ${path}: ${response.status()}`,
+  );
+  return response.json();
+}
+async function create(
+  page: Page,
+  context: BrowserContext,
+  slug: string,
+  label: string,
+) {
+  await page
+    .getByRole('button', { name: '+ Create store', exact: true })
+    .click();
+  const dialog = page.getByRole('dialog', {
+    name: 'Create store',
+    exact: true,
+  });
+  await dialog.getByLabel('Store name', { exact: true }).fill(label);
+  await dialog.getByLabel('Store address', { exact: true }).fill(slug);
+  const response = page.waitForResponse(
+    (r) =>
+      r.url() === origin + '/api/stores' && r.request().method() === 'POST',
+  );
+  await dialog
+    .getByRole('button', { name: 'Create store', exact: true })
+    .click();
+  const result = await response;
+  assert.equal(result.status(), 201);
+  const { id } = await result.json();
+  owned.add(id);
+  await dialog.waitFor({ state: 'hidden' });
+  return ((await api(context, '/stores')) as Store[]).find((s) => s.id === id)!;
+}
+async function remove(page: Page, store: Store) {
+  await page.getByRole('button', { name: 'Stores', exact: true }).click();
+  await page
+    .getByRole('button', { name: `Delete ${store.displayName}`, exact: true })
+    .click();
+  const dialog = page.getByRole('dialog', {
+    name: 'Delete store',
+    exact: true,
+  });
+  await dialog
+    .getByRole('button', { name: 'Delete permanently', exact: true })
+    .click();
+  await dialog.waitFor({ state: 'hidden' });
+}
+function data(result: unknown) {
+  const parsed = CallToolResultSchema.parse(result);
+  assert.ok(!parsed.isError);
+  const item = parsed.content.find((c) => c.type === 'text');
+  assert.ok(item?.type === 'text');
+  return JSON.parse(item.text);
+}
+async function order(store: Store, name: string, price: string) {
+  const product = data(
+    await client.callTool({
+      name: `${store.upstreamSlug}__create_product`,
+      arguments: { name, price },
+    }),
+  );
+  const shopper = await browser.newContext();
+  try {
+    const page = await shopper.newPage();
+    await page.goto(product.permalink);
+    await page.goto(store.publicUrl + `/?add-to-cart=${product.id}`);
+    await page.goto(store.publicUrl + '/checkout/');
+    for (const [field, value] of Object.entries({
+      first_name: 'Store',
+      last_name: 'Demo',
+      address_1: '1 Demo Road',
+      city: 'Bengaluru',
+      postcode: '560001',
+      phone: '9999999999',
+      email: 'multi-store@storelink.invalid',
+    }))
+      await page.locator('#billing_' + field).fill(value);
+    await page.locator('#billing_country').selectOption('IN');
+    await page.locator('#billing_state').selectOption('KA');
+    if (await page.locator('#payment_method_cod').isVisible())
+      await page.locator('#payment_method_cod').check();
+    if (await page.locator('#terms').isVisible())
+      await page.locator('#terms').check();
+    await page.locator('#place_order').click();
+    await page.waitForURL(/order-received\/\d+/, { timeout: 60000 });
+    return Number(/order-received\/(\d+)/.exec(page.url())![1]);
+  } finally {
+    await shopper.close();
+  }
+}
+try {
+  const adminPage = await login(admin, 'admin'),
+    memberPage = await login(member, 'member');
+  assert.equal(
+    (await api(admin, '/stores')).length,
+    0,
+    'Start with no additional stores; existing user stores are never removed by this check',
+  );
+  // Test the real database cap before allocating any store workloads.
+  await kube(
+    '-n',
+    'storelink',
+    'scale',
+    'deployment/storelink-provisioner',
+    '--replicas=0',
+  );
+  paused = true;
+  await kube(
+    '-n',
+    'storelink',
+    'rollout',
+    'status',
+    'deployment/storelink-provisioner',
+    '--timeout=60s',
+  );
+  const scratch = await api(
+    member,
+    '/stores',
+    { slug: `q${nonce}`, displayName: 'Quota baseline' },
+    'POST',
+    201,
+  );
+  owned.add(scratch.id);
+  const me = await (await member.request.get(origin + '/api/me')).json();
+  const requests = await Promise.all(
+    ['r', 't'].map((prefix) =>
+      member.request.post(origin + '/api/stores', {
+        headers: { origin, 'x-csrf-token': me.csrf },
+        data: { slug: prefix + nonce, displayName: 'Quota contender' },
+      }),
+    ),
+  );
+  assert.deepEqual(requests.map((r) => r.status()).sort(), [201, 409]);
+  for (const response of requests)
+    if (response.status() === 201) owned.add((await response.json()).id);
+  for (const id of owned)
+    await api(member, '/stores/' + id, undefined, 'DELETE');
+  await kube(
+    '-n',
+    'storelink',
+    'scale',
+    'deployment/storelink-provisioner',
+    '--replicas=1',
+  );
+  paused = false;
+  await kube(
+    '-n',
+    'storelink',
+    'rollout',
+    'status',
+    'deployment/storelink-provisioner',
+    '--timeout=90s',
+  );
+  await until(async () => (await api(admin, '/stores')).length === 0);
+  owned.clear();
+  console.log(
+    'Real concurrent admission: one slot, one accepted create, one 409.',
+  );
+  const [a, b] = await Promise.all([
+    create(adminPage, admin, north, 'North acceptance'),
+    create(memberPage, member, south, 'South acceptance'),
+  ]);
+  assert.equal((await api(member, '/stores')).length, 1);
+  await api(member, '/stores/' + a.id, undefined, 'DELETE', 404);
+  await api(member, '/stores/' + a.id + '/retry', {}, 'POST', 409);
+  const namespaceA = `storelink-store-${a.slug}`,
+    namespaceB = `storelink-store-${b.slug}`;
+  // Force a terminal setup failure, then exercise the dashboard's retry action.
+  let failedJob = '';
+  await until(async () => {
+    const jobs = JSON.parse(
+      await kube('-n', namespaceA, 'get', 'jobs', '-o', 'json'),
+    ).items;
+    failedJob = jobs[0]?.metadata.name ?? '';
+    return Boolean(failedJob);
+  });
+  await kube(
+    '-n',
+    namespaceA,
+    'patch',
+    'job',
+    failedJob,
+    '--type=merge',
+    '-p',
+    '{"spec":{"activeDeadlineSeconds":1}}',
+  );
+  await until(
+    async () =>
+      ((await api(admin, '/stores')) as Store[]).find((s) => s.id === a.id)
+        ?.status === 'Failed',
+  );
+  const before = JSON.parse(
+    await kube(
+      '-n',
+      namespaceA,
+      'get',
+      'secret',
+      'store-credentials',
+      '-o',
+      'json',
+    ),
+  ).data;
+  const retryResponse = adminPage.waitForResponse((r) =>
+    r.url().endsWith(`/stores/${a.id}/retry`),
+  );
+  await adminPage
+    .getByRole('article', { name: a.displayName, exact: true })
+    .getByRole('button', { name: 'Retry setup' })
+    .click();
+  assert.equal((await retryResponse).status(), 200);
+  await kube(
+    '-n',
+    'storelink',
+    'rollout',
+    'restart',
+    'deployment/storelink-provisioner',
+  );
+  await kube(
+    '-n',
+    'storelink',
+    'rollout',
+    'status',
+    'deployment/storelink-provisioner',
+    '--timeout=90s',
+  );
+  await until(async () => {
+    const stores = (await api(admin, '/stores')) as Store[];
+    if (stores.some((s) => s.status === 'Failed'))
+      throw new Error(
+        'Provisioning failed: ' +
+          stores.find((s) => s.status === 'Failed')!.failureReason,
+      );
+    return stores.length === 2 && stores.every((s) => s.status === 'Ready');
+  }, 300000);
+  const after = JSON.parse(
+    await kube(
+      '-n',
+      namespaceA,
+      'get',
+      'secret',
+      'store-credentials',
+      '-o',
+      'json',
+    ),
+  ).data;
+  assert.deepEqual(before, after);
+  const ready = ((await api(admin, '/stores')) as Store[]).find(
+    (s) => s.id === a.id,
+  )!;
+  assert.equal(ready.attempt, 2);
+  const jobs = JSON.parse(
+    await kube('-n', namespaceA, 'get', 'jobs', '-o', 'json'),
+  ).items;
+  assert.ok(
+    jobs.some((j: any) => j.metadata.name !== failedJob && j.status.succeeded),
+  );
+  for (const store of [a, b])
+    await adminPage
+      .getByRole('article', { name: store.displayName, exact: true })
+      .getByRole('status')
+      .filter({ hasText: 'Ready' })
+      .waitFor();
+  await adminPage.screenshot({
+    path: '.cache/multi-store-ready.png',
+    fullPage: true,
+  });
+  console.log(
+    'Two stores Ready after a failed Job, UI retry and provisioner restart; store credentials unchanged.',
+  );
+  const key = JSON.parse(secret('gateway-keys'))['member-b'];
+  await client.connect(
+    new StreamableHTTPClientTransport(new URL(origin + '/mcp'), {
+      requestInit: { headers: { authorization: `Bearer ${key}` } },
+    }),
+  );
+  await until(
+    async () =>
+      (await client.listTools()).tools.filter(
+        (t) =>
+          t.name.startsWith(a.upstreamSlug + '__') ||
+          t.name.startsWith(b.upstreamSlug + '__'),
+      ).length === 10,
+  );
+  // Each destination is healthy through the authorized gateway, then blocked cross-store.
+  for (const store of [a, b])
+    assert.ok(
+      data(
+        await client.callTool({
+          name: store.upstreamSlug + '__list_products',
+          arguments: {},
+        }),
+      ).length > 0,
+    );
+  for (const [destination, port] of [
+    ['wordpress', 80],
+    ['mariadb', 3306],
+  ] as const) {
+    await kube(
+      '-n',
+      namespaceA,
+      'exec',
+      'deployment/woo-mcp',
+      '--',
+      'node',
+      '--input-type=module',
+      '-e',
+      `import net from 'node:net';const socket=net.createConnection({host:${JSON.stringify(destination + '.' + namespaceB + '.svc.cluster.local')},port:${port}});socket.setTimeout(1500);socket.on('connect',()=>process.exit(1));socket.on('timeout',()=>{socket.destroy();console.log('cross-store blocked');});socket.on('error',()=>{console.log('cross-store blocked');});`,
+    );
+  }
+  const volumes: string[] = [];
+  for (const namespace of [namespaceA, namespaceB]) {
+    const claims = JSON.parse(
+      await kube('-n', namespace, 'get', 'pvc', '-o', 'json'),
+    ).items;
+    assert.equal(claims.length, 2);
+    volumes.push(...claims.map((p: any) => p.spec.volumeName));
+  }
+  const orderA = await order(a, 'North acceptance mug', '149.00'),
+    orderB = await order(b, 'South acceptance mug', '249.00');
+  await adminPage.getByRole('button', { name: 'Chat', exact: true }).click();
+  const chatResponse = adminPage.waitForResponse(
+    (r) => r.url() === origin + '/api/chat' && r.request().method() === 'POST',
+    { timeout: 150000 },
+  );
+  await adminPage
+    .getByLabel('Message', { exact: true })
+    .fill(
+      `Compare today's orders in exactly these two stores: ${a.upstreamSlug} and ${b.upstreamSlug}. First use time__get_day_window, then call ${a.upstreamSlug}__list_orders and ${b.upstreamSlug}__list_orders with its UTC date filters. Report each store's order count, total and currency. Do not change anything.`,
+    );
+  await adminPage
+    .getByRole('button', { name: 'Send message', exact: true })
+    .click();
+  const response = await chatResponse;
+  assert.equal(response.status(), 200);
+  const answer = await response.json();
+  for (const name of [
+    'time__get_day_window',
+    a.upstreamSlug + '__list_orders',
+    b.upstreamSlug + '__list_orders',
+  ])
+    assert.ok(
+      answer.activity.some((call: any) => call.name === name && !call.isError),
+      `Model did not call ${name}`,
+    );
+  assert.match(answer.text, /149/);
+  assert.match(answer.text, /249/);
+  await adminPage.screenshot({
+    path: '.cache/multi-store-chat.png',
+    fullPage: true,
+  });
+  evidence.stores = [
+    { slug: a.slug, orderId: orderA, total: '149.00' },
+    { slug: b.slug, orderId: orderB, total: '249.00' },
+  ];
+  evidence.conversationId = answer.id;
+  evidence.tokens = { input: answer.inputTokens, output: answer.outputTokens };
+  evidence.retryAndRestart = true;
+  evidence.isolation = true;
+  evidence.atomicAdmission = true;
+  await remove(adminPage, a);
+  await until(
+    async () =>
+      !((await api(admin, '/stores')) as Store[]).some((s) => s.id === a.id),
+  );
+  owned.delete(a.id);
+  await until(
+    async () =>
+      !(await client.listTools()).tools.some((t) =>
+        t.name.startsWith(a.upstreamSlug + '__'),
+      ),
+  );
+  assert.equal(
+    (
+      await client.callTool({
+        name: a.upstreamSlug + '__list_products',
+        arguments: {},
+      })
+    ).isError,
+    true,
+  );
+  assert.ok(
+    data(
+      await client.callTool({
+        name: b.upstreamSlug + '__list_products',
+        arguments: {},
+      }),
+    ).length > 0,
+  );
+  await remove(memberPage, b);
+  await until(async () => (await api(admin, '/stores')).length === 0);
+  owned.delete(b.id);
+  for (const namespace of [namespaceA, namespaceB])
+    assert.equal(
+      (
+        await kube(
+          'get',
+          'namespace',
+          namespace,
+          '--ignore-not-found',
+          '-o',
+          'name',
+        )
+      ).trim(),
+      '',
+    );
+  for (const volume of volumes)
+    await until(
+      async () =>
+        (
+          await kube('get', 'pv', volume, '--ignore-not-found', '-o', 'name')
+        ).trim() === '',
+      90000,
+    );
+  await until(async () => (await client.listTools()).tools.length === 9);
+  evidence.teardown = true;
+  evidence.finished = new Date().toISOString();
+  writeFileSync(
+    '.data/multi-store-evidence.json',
+    JSON.stringify(evidence, null, 2) + '\n',
+    { mode: 0o600 },
+  );
+  console.log(JSON.stringify(evidence));
+} finally {
+  if (paused)
+    await kube(
+      '-n',
+      'storelink',
+      'scale',
+      'deployment/storelink-provisioner',
+      '--replicas=1',
+    ).catch(() => {});
+  for (const id of owned)
+    await api(admin, '/stores/' + id, undefined, 'DELETE').catch(() => {});
+  if (owned.size)
+    await until(
+      async () =>
+        !((await api(admin, '/stores')) as Store[]).some((s) =>
+          owned.has(s.id),
+        ),
+      120000,
+    ).catch(() => {});
+  await closeClient(client).catch(() => {});
+  for (const context of [admin, member])
+    await api(context, '/logout', {}, 'POST').catch(() => {});
+  await browser.close();
+}
diff --git a/services/gateway/migrations/0008_stores.sql b/services/gateway/migrations/0008_stores.sql
new file mode 100644
index 0000000..0956b26
--- /dev/null
+++ b/services/gateway/migrations/0008_stores.sql
@@ -0,0 +1,17 @@
+CREATE TABLE IF NOT EXISTS stores (
+  id TEXT PRIMARY KEY,
+  team_id TEXT NOT NULL,
+  created_by TEXT NOT NULL,
+  -- Slugs name a cluster-wide namespace, so they are unique across teams. The
+  -- row stays until the namespace is gone, which blocks reuse while it terminates.
+  slug TEXT NOT NULL UNIQUE,
+  display_name TEXT NOT NULL,
+  public_url TEXT NOT NULL,
+  upstream_slug TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('Provisioning','Ready','Failed','Deleting')),
+  failure_reason TEXT,
+  deadline_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS stores_team ON stores(team_id,created_at);
diff --git a/services/gateway/migrations/0009_store_attempts.sql b/services/gateway/migrations/0009_store_attempts.sql
new file mode 100644
index 0000000..2eeca51
--- /dev/null
+++ b/services/gateway/migrations/0009_store_attempts.sql
@@ -0,0 +1,4 @@
+-- Preserve existing stores; new requests use recoverable, derived MCP tokens.
+ALTER TABLE stores ADD COLUMN IF NOT EXISTS attempt INTEGER NOT NULL DEFAULT 1;
+ALTER TABLE stores ADD COLUMN IF NOT EXISTS token_version INTEGER NOT NULL DEFAULT 0;
+CREATE INDEX IF NOT EXISTS stores_owner ON stores(team_id,created_by);
diff --git a/services/gateway/src/credentials.ts b/services/gateway/src/credentials.ts
index 3a908ae..599c7b0 100644
--- a/services/gateway/src/credentials.ts
+++ b/services/gateway/src/credentials.ts
@@ -1,6 +1,5 @@
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
-import https from 'node:https';
-import type { OutgoingHttpHeaders } from 'node:http';
+import { KubernetesClient } from './k8s-client.ts';
 import {
   credentialKey,
   isSealed,
@@ -58,54 +57,22 @@ export class KubernetesCredentials implements CredentialStore {
     method: string,
     body?: unknown,
   ): Promise<Record<string, unknown>> {
-    const directory = '/var/run/secrets/kubernetes.io/serviceaccount';
-    const headers: OutgoingHttpHeaders = {
-      authorization: `Bearer ${readFileSync(`${directory}/token`, 'utf8').trim()}`,
-    };
-    if (body) headers['content-type'] = 'application/merge-patch+json';
-    return new Promise((resolve, reject) => {
-      const request = https.request(
-        {
-          hostname: process.env.KUBERNETES_SERVICE_HOST,
-          port: Number(process.env.KUBERNETES_SERVICE_PORT_HTTPS ?? 443),
-          path: this.path,
-          method,
-          headers,
-          ca: readFileSync(`${directory}/ca.crt`),
-          timeout: 3000,
-        },
-        (response) => {
-          let data = '';
-          response.on('data', (chunk) => {
-            data += chunk;
-            if (data.length > 1048576)
-              request.destroy(new Error('Secret exceeds limit'));
-          });
-          response.on('end', () => {
-            if (response.statusCode === 409) {
-              reject(new SecretConflictError('Credential Secret changed'));
-              return;
-            }
-            if (response.statusCode !== 200) {
-              reject(new Error('Credential Secret is unavailable'));
-              return;
-            }
-            try {
-              resolve(JSON.parse(data));
-            } catch {
-              reject(new Error('Invalid Secret response'));
-            }
-          });
-        },
+    let response;
+    try {
+      response = await new KubernetesClient().request(
+        method,
+        this.path,
+        body,
+        'application/merge-patch+json',
       );
-      request.on('timeout', () =>
-        request.destroy(new Error('Secret request timed out')),
-      );
-      request.on('error', () =>
-        reject(new Error('Credential Secret is unavailable')),
-      );
-      request.end(body ? JSON.stringify(body) : undefined);
-    });
+    } catch {
+      throw new Error('Credential Secret is unavailable');
+    }
+    if (response.status === 409)
+      throw new SecretConflictError('Credential Secret changed');
+    if (response.status !== 200 || typeof response.body !== 'object')
+      throw new Error('Credential Secret is unavailable');
+    return response.body as Record<string, unknown>;
   }
   async get(id: string): Promise<Credential | undefined> {
     const result = await this.request('GET');
diff --git a/services/gateway/src/dashboard-api.ts b/services/gateway/src/dashboard-api.ts
index 4dddb40..0c1e7b4 100644
--- a/services/gateway/src/dashboard-api.ts
+++ b/services/gateway/src/dashboard-api.ts
@@ -19,6 +19,9 @@ import type { Gateway } from './gateway.ts';
 import { runChat, ChatInputError, validateChatInput } from './chat.ts';
 import type { Model } from './chat.ts';
 import { summarizeCalls } from './metrics.ts';
+import { requestStore, StoreRequestError } from './store-requests.ts';
+import type { StoreRequestSettings } from './store-requests.ts';
+import { storeSlugPattern } from './store-manifests.ts';
 
 class HttpError extends Error {
   status: number;
@@ -53,9 +56,20 @@ type Options = {
   // Shared across replicas in the cluster; in memory for a single process.
   rateLimiter?: RateLimiter;
   chatAdmission?: Admission;
+  // Present when the store provisioner is deployed.
+  stores?: StoreRequestSettings;
 };
 export function dashboardApi(options: Options) {
   const { store, registry, gateway, pepper, origin } = options;
+  if (
+    options.stores &&
+    [
+      options.stores.maxPerTeam,
+      options.stores.maxPerUser,
+      options.stores.provisionTimeoutMs,
+    ].some((n) => !Number.isSafeInteger(n) || n < 1)
+  )
+    throw new Error('Store limits must be positive integers');
   const router = express.Router();
   const rateLimiter = options.rateLimiter ?? new MemoryRateLimiter();
   const chatAdmission =
@@ -188,6 +202,13 @@ export function dashboardApi(options: Options) {
       user: actor(res),
       csrf: res.locals.csrf,
       chatConfigured: Boolean(options.model),
+      storesConfigured: Boolean(options.stores),
+      storeLimits: options.stores
+        ? {
+            perUser: options.stores.maxPerUser,
+            perTeam: options.stores.maxPerTeam,
+          }
+        : undefined,
       model: options.modelName,
       gatewayUrl: `${origin}/mcp`,
     }),
@@ -388,6 +409,77 @@ export function dashboardApi(options: Options) {
     if (!result.rows[0]) throw new HttpError(404, 'Unknown conversation');
     res.json(result.rows[0]);
   });
+  // Stores are created and removed by the provisioner; the gateway only records
+  // requests and announces them.
+  function storesEnabled(_res: express.Response) {
+    if (!options.stores)
+      throw new HttpError(404, 'Store provisioning is not enabled');
+    return options.stores;
+  }
+  const announceStores = () =>
+    store.pool.query("SELECT pg_notify('storelink_stores', '')");
+  router.get('/stores', async (_req, res) => {
+    storesEnabled(res);
+    const { rows } = await store.pool.query(
+      `SELECT id,slug,display_name AS "displayName",public_url AS "publicUrl",
+        upstream_slug AS "upstreamSlug",status,failure_reason AS "failureReason",
+        created_at AS "createdAt",created_by AS "createdBy",attempt
+      FROM stores WHERE team_id=$1 AND ($2='admin' OR created_by=$3) ORDER BY created_at`,
+      [actor(res).teamId, actor(res).role, actor(res).userId],
+    );
+    res.json(rows);
+  });
+  router.post('/stores', async (req, res) => {
+    const settings = storesEnabled(res);
+    const input = z
+      .object({
+        slug: z
+          .string()
+          .regex(
+            storeSlugPattern,
+            'Use 1–12 lowercase letters, digits or hyphens, starting with a letter',
+          ),
+        displayName: z.string().trim().min(1).max(60),
+      })
+      .parse(req.body);
+    const id = await requestStore(store.pool, actor(res), input, settings);
+    res.status(201).json({ id });
+  });
+  router.post('/stores/:id/retry', async (req, res) => {
+    const settings = storesEnabled(res);
+    const updated = await store.pool.query(
+      `UPDATE stores SET status='Provisioning',attempt=attempt+1,failure_reason=NULL,updated_at=now(),
+        deadline_at=now()+$3*interval '1 millisecond'
+      WHERE id=$1 AND team_id=$2 AND status='Failed' AND ($4='admin' OR created_by=$5)`,
+      [
+        String(req.params.id),
+        actor(res).teamId,
+        settings.provisionTimeoutMs,
+        actor(res).role,
+        actor(res).userId,
+      ],
+    );
+    if (!updated.rowCount)
+      throw new HttpError(409, 'Only a failed store can be retried');
+    await announceStores();
+    res.json({ ok: true });
+  });
+  router.delete('/stores/:id', async (req, res) => {
+    storesEnabled(res);
+    const updated = await store.pool.query(
+      `UPDATE stores SET status='Deleting',failure_reason=NULL,updated_at=now()
+      WHERE id=$1 AND team_id=$2 AND ($3='admin' OR created_by=$4)`,
+      [
+        String(req.params.id),
+        actor(res).teamId,
+        actor(res).role,
+        actor(res).userId,
+      ],
+    );
+    if (!updated.rowCount) throw new HttpError(404, 'Unknown store');
+    await announceStores();
+    res.json({ ok: true });
+  });
   router.post('/chat', async (req, res) => {
     if (!options.model)
       throw new HttpError(
@@ -489,7 +581,7 @@ export function dashboardApi(options: Options) {
         res.status(400).json({ error: error.message });
       else if (error instanceof ChatBusyError)
         res.status(429).json({ error: error.message });
-      else if (error instanceof HttpError)
+      else if (error instanceof HttpError || error instanceof StoreRequestError)
         res.status(error.status).json({ error: error.message });
       else if (error instanceof z.ZodError)
         res.status(400).json({
diff --git a/services/gateway/src/k8s-client.ts b/services/gateway/src/k8s-client.ts
new file mode 100644
index 0000000..d4d73b4
--- /dev/null
+++ b/services/gateway/src/k8s-client.ts
@@ -0,0 +1,185 @@
+import { readFileSync } from 'node:fs';
+import https from 'node:https';
+import type { OutgoingHttpHeaders } from 'node:http';
+
+export type KubeResponse = { status: number; body: unknown };
+
+// Talks to the Kubernetes API with the pod's ServiceAccount.
+export class KubernetesClient {
+  directory: string;
+  constructor(directory = '/var/run/secrets/kubernetes.io/serviceaccount') {
+    this.directory = directory;
+  }
+  request(
+    method: string,
+    path: string,
+    body?: unknown,
+    contentType = 'application/json',
+  ): Promise<KubeResponse> {
+    const headers: OutgoingHttpHeaders = {
+      authorization: `Bearer ${readFileSync(`${this.directory}/token`, 'utf8').trim()}`,
+      accept: 'application/json',
+    };
+    if (body !== undefined) headers['content-type'] = contentType;
+    return new Promise((resolve, reject) => {
+      const request = https.request(
+        {
+          hostname: process.env.KUBERNETES_SERVICE_HOST,
+          port: Number(process.env.KUBERNETES_SERVICE_PORT_HTTPS ?? 443),
+          path,
+          method,
+          headers,
+          ca: readFileSync(`${this.directory}/ca.crt`),
+          timeout: 10000,
+        },
+        (response) => {
+          let data = '';
+          response.on('data', (chunk) => {
+            data += chunk;
+            if (data.length > 4194304)
+              request.destroy(new Error('Kubernetes response exceeds limit'));
+          });
+          response.on('end', () => {
+            let parsed: unknown;
+            try {
+              parsed = data ? JSON.parse(data) : undefined;
+            } catch {
+              reject(new Error('Invalid Kubernetes API response'));
+              return;
+            }
+            resolve({ status: response.statusCode ?? 0, body: parsed });
+          });
+        },
+      );
+      request.on('timeout', () =>
+        request.destroy(new Error('Kubernetes API request timed out')),
+      );
+      request.on('error', () =>
+        reject(new Error('Kubernetes API is unavailable')),
+      );
+      request.end(body === undefined ? undefined : JSON.stringify(body));
+    });
+  }
+}
+
+export const storeNamespacePattern =
+  /^storelink-store-[a-z](?:[a-z0-9-]{0,10}[a-z0-9])?$/;
+export const managedLabel = 'storelink/managed-store';
+
+type KubeObject = {
+  apiVersion: string;
+  kind: string;
+  metadata: {
+    name: string;
+    namespace?: string;
+    labels?: Record<string, string>;
+  };
+};
+
+const resources: Record<string, { base: string; plural: string }> = {
+  Namespace: { base: '/api/v1', plural: 'namespaces' },
+  ResourceQuota: { base: '/api/v1', plural: 'resourcequotas' },
+  LimitRange: { base: '/api/v1', plural: 'limitranges' },
+  Secret: { base: '/api/v1', plural: 'secrets' },
+  ConfigMap: { base: '/api/v1', plural: 'configmaps' },
+  PersistentVolumeClaim: { base: '/api/v1', plural: 'persistentvolumeclaims' },
+  Service: { base: '/api/v1', plural: 'services' },
+  NetworkPolicy: {
+    base: '/apis/networking.k8s.io/v1',
+    plural: 'networkpolicies',
+  },
+  Ingress: { base: '/apis/networking.k8s.io/v1', plural: 'ingresses' },
+  Certificate: { base: '/apis/cert-manager.io/v1', plural: 'certificates' },
+  Deployment: { base: '/apis/apps/v1', plural: 'deployments' },
+  Job: { base: '/apis/batch/v1', plural: 'jobs' },
+};
+
+export class KubernetesApiError extends Error {
+  status: number;
+  constructor(message: string, status: number) {
+    super(message);
+    this.status = status;
+  }
+}
+
+// The provisioner's only way into the cluster. RBAC cannot limit a ClusterRole
+// to a name pattern, so every operation is checked against the store namespace
+// pattern here, and namespaces are deleted only if they carry the managed label.
+export class StoreCluster {
+  client: Pick<KubernetesClient, 'request'>;
+  fieldManager = 'storelink-provisioner';
+  constructor(client: Pick<KubernetesClient, 'request'>) {
+    this.client = client;
+  }
+  private namespaceOf(object: KubeObject): string {
+    const namespace =
+      object.kind === 'Namespace'
+        ? object.metadata.name
+        : object.metadata.namespace;
+    if (!namespace || !storeNamespacePattern.test(namespace))
+      throw new Error('Refusing to touch a namespace outside store namespaces');
+    return namespace;
+  }
+  private path(object: KubeObject): string {
+    const resource = resources[object.kind];
+    if (!resource) throw new Error(`Unsupported kind ${object.kind}`);
+    const namespace = this.namespaceOf(object);
+    const name = encodeURIComponent(object.metadata.name);
+    return object.kind === 'Namespace'
+      ? `${resource.base}/namespaces/${name}`
+      : `${resource.base}/namespaces/${namespace}/${resource.plural}/${name}`;
+  }
+  private check(response: KubeResponse, action: string) {
+    if (response.status >= 200 && response.status < 300) return response.body;
+    const message =
+      (response.body as { message?: string } | undefined)?.message ??
+      `HTTP ${response.status}`;
+    throw new KubernetesApiError(`${action}: ${message}`, response.status);
+  }
+  // Server-side apply: creates or updates the object to match.
+  async apply(object: KubeObject): Promise<unknown> {
+    const response = await this.client.request(
+      'PATCH',
+      `${this.path(object)}?fieldManager=${this.fieldManager}&force=true`,
+      object,
+      'application/apply-patch+yaml',
+    );
+    return this.check(response, `Apply ${object.kind} ${object.metadata.name}`);
+  }
+  // Creates the object only if it does not exist; never overwrites it.
+  // Returns false when it already existed.
+  async create(object: KubeObject): Promise<boolean> {
+    const resource = resources[object.kind];
+    const namespace = this.namespaceOf(object);
+    const response = await this.client.request(
+      'POST',
+      `${resource.base}/namespaces/${namespace}/${resource.plural}`,
+      object,
+    );
+    if (response.status === 409) return false;
+    this.check(response, `Create ${object.kind} ${object.metadata.name}`);
+    return true;
+  }
+  async get(object: KubeObject): Promise<unknown | undefined> {
+    const response = await this.client.request('GET', this.path(object));
+    if (response.status === 404) return undefined;
+    return this.check(response, `Read ${object.kind} ${object.metadata.name}`);
+  }
+  async deleteNamespace(name: string): Promise<'deleting' | 'gone'> {
+    const object = {
+      apiVersion: 'v1',
+      kind: 'Namespace',
+      metadata: { name },
+    };
+    const found = (await this.get(object)) as KubeObject | undefined;
+    if (!found) return 'gone';
+    if (found.metadata.labels?.[managedLabel] !== 'true')
+      throw new Error(
+        'Refusing to delete a namespace StoreLink does not manage',
+      );
+    const response = await this.client.request('DELETE', this.path(object));
+    if (response.status === 404) return 'gone';
+    this.check(response, `Delete namespace ${name}`);
+    return 'deleting';
+  }
+}
diff --git a/services/gateway/src/main.ts b/services/gateway/src/main.ts
index ddc7540..2a45367 100644
--- a/services/gateway/src/main.ts
+++ b/services/gateway/src/main.ts
@@ -70,6 +70,7 @@ if (store instanceof PostgresStore) {
       url: process.env.OPERATIONS_MCP_URL ?? 'http://127.0.0.1:3003/mcp',
     },
   ];
+  const storesEnabled = process.env.STORES_ENABLED === 'true';
   const credentials = process.env.UPSTREAM_SECRET_NAME
     ? new KubernetesCredentials(
         process.env.POD_NAMESPACE ?? 'storelink',
@@ -95,6 +96,7 @@ if (store instanceof PostgresStore) {
       .split(',')
       .map((value) => value.trim())
       .filter(Boolean),
+    storesEnabled,
   );
   await registry.seed(teamId, defaults);
   await registry.sync();
@@ -124,6 +126,16 @@ if (store instanceof PostgresStore) {
       chatLimits,
       rateLimiter,
       chatAdmission: new PostgresChatAdmission(store.pool, chatLimits),
+      stores: storesEnabled
+        ? {
+            hostSuffix:
+              process.env.STORES_HOST_SUFFIX ?? 'store.storelink.localhost',
+            scheme: process.env.STORES_SCHEME === 'https' ? 'https' : 'http',
+            maxPerTeam: Number(process.env.STORES_MAX_PER_TEAM ?? 3),
+            maxPerUser: Number(process.env.STORES_MAX_PER_USER ?? 2),
+            provisionTimeoutMs: Number(process.env.STORES_TIMEOUT_MS ?? 240000),
+          }
+        : undefined,
     }),
   );
   const dashboard = resolve('apps/dashboard/dist');
diff --git a/services/gateway/src/provisioner-main.ts b/services/gateway/src/provisioner-main.ts
new file mode 100644
index 0000000..c0c696e
--- /dev/null
+++ b/services/gateway/src/provisioner-main.ts
@@ -0,0 +1,154 @@
+import { createServer } from 'node:http';
+import { readFileSync } from 'node:fs';
+import { Client, Pool } from 'pg';
+import { apiKeyPepper, secret } from '../../../packages/shared/src/secrets.ts';
+import { KubernetesClient, StoreCluster } from './k8s-client.ts';
+import { KubernetesCredentials } from './credentials.ts';
+import {
+  PostgresStoreRegistrar,
+  PostgresStoreRepository,
+  StoreProvisioner,
+} from './store-provisioner.ts';
+import type { StoreSettings } from './store-manifests.ts';
+
+// Creates and removes stores requested through the dashboard. It runs as its own
+// Deployment so the internet-facing gateway never holds cluster-wide rights.
+const env = (name: string, fallback?: string) => {
+  const value = process.env[name] ?? fallback;
+  if (value === undefined) throw new Error(`Supply ${name}`);
+  return value;
+};
+const namespace = env('POD_NAMESPACE', 'storelink');
+const settings: StoreSettings = {
+  images: {
+    app: env('STORE_IMAGE_APP'),
+    store: env('STORE_IMAGE_STORE'),
+    mariadb: env('STORE_IMAGE_MARIADB'),
+    pullPolicy: env('STORE_IMAGE_PULL_POLICY', 'IfNotPresent'),
+  },
+  hostSuffix: env('STORES_HOST_SUFFIX'),
+  scheme: env('STORES_SCHEME', 'http') === 'https' ? 'https' : 'http',
+  tlsSecretName: process.env.STORES_TLS_SECRET || undefined,
+  tlsClusterIssuer: process.env.STORES_TLS_CLUSTER_ISSUER || undefined,
+  quota: JSON.parse(env('STORES_QUOTA', '{}')),
+  ingressClass: env('STORES_INGRESS_CLASS', 'traefik'),
+  storageClass: env('STORES_STORAGE_CLASS', 'local-path'),
+  storage: {
+    wordpress: env('STORES_WORDPRESS_STORAGE', '2Gi'),
+    mariadb: env('STORES_MARIADB_STORAGE', '1Gi'),
+  },
+  timezone: env('STORE_TIMEZONE', 'Asia/Kolkata'),
+  woocommerceVersion: env('WOOCOMMERCE_VERSION'),
+  gateway: { namespace, instance: env('GATEWAY_INSTANCE') },
+  // The same file the chart mounts for the main store's readiness probe.
+  healthPhp: readFileSync(
+    new URL('../../../charts/storelink/files/health.php', import.meta.url),
+    'utf8',
+  ),
+  resources: JSON.parse(env('STORES_RESOURCES')),
+};
+
+const pool = new Pool({
+  connectionString: secret('DATABASE_URL'),
+  max: 3,
+  connectionTimeoutMillis: 3000,
+  statement_timeout: 10000,
+});
+pool.on('error', () =>
+  console.error('Application database connection interrupted'),
+);
+const provisioner = new StoreProvisioner({
+  tokenKey: apiKeyPepper(),
+  repository: new PostgresStoreRepository(pool),
+  cluster: new StoreCluster(new KubernetesClient()),
+  registrar: new PostgresStoreRegistrar(
+    pool,
+    new KubernetesCredentials(
+      namespace,
+      env('UPSTREAM_SECRET_NAME'),
+      apiKeyPepper(),
+    ),
+  ),
+  settings,
+});
+
+let running = false;
+async function tick() {
+  if (running) return;
+  running = true;
+  try {
+    const client = await pool.connect();
+    try {
+      // One pass at a time across overlapping provisioner pods.
+      const { rows } = await client.query<{ locked: boolean }>(
+        'SELECT pg_try_advisory_lock(87264004) AS locked',
+      );
+      if (!rows[0].locked) return;
+      try {
+        await provisioner.reconcile();
+      } finally {
+        await client.query('SELECT pg_advisory_unlock(87264004)');
+      }
+    } finally {
+      client.release();
+    }
+  } catch (error) {
+    console.error(
+      `Store reconciliation failed: ${error instanceof Error ? error.message : 'unexpected error'}`,
+    );
+  } finally {
+    running = false;
+  }
+}
+const timer = setInterval(() => void tick(), 5000);
+void tick();
+
+// Dashboard requests are announced so they start without waiting for the timer.
+let listener: Client | undefined;
+let closing = false;
+async function listen() {
+  if (closing) return;
+  const client = new Client({ connectionString: secret('DATABASE_URL') });
+  client.on('notification', () => void tick());
+  client.on('error', () => {
+    void client.end().catch(() => {});
+    if (!closing) setTimeout(() => void listen(), 2000);
+  });
+  try {
+    await client.connect();
+    await client.query('LISTEN storelink_stores');
+    listener = client;
+  } catch {
+    void client.end().catch(() => {});
+    setTimeout(() => void listen(), 2000);
+  }
+}
+void listen();
+
+const health = createServer((req, res) => {
+  if (req.url === '/health/live') {
+    res.writeHead(200).end('ok');
+    return;
+  }
+  if (req.url === '/health/ready') {
+    void pool.query('SELECT 1').then(
+      () => res.writeHead(200).end('ok'),
+      () => res.writeHead(503).end(),
+    );
+    return;
+  }
+  res.writeHead(404).end();
+}).listen(
+  Number(process.env.PORT ?? 3000),
+  process.env.BIND_ADDRESS ?? '127.0.0.1',
+);
+
+for (const signal of ['SIGINT', 'SIGTERM'])
+  process.once(signal, async () => {
+    closing = true;
+    clearInterval(timer);
+    health.close();
+    await listener?.end().catch(() => {});
+    while (running) await new Promise((resolve) => setTimeout(resolve, 100));
+    await pool.end();
+  });
diff --git a/services/gateway/src/registry.ts b/services/gateway/src/registry.ts
index 20a40cc..01491ab 100644
--- a/services/gateway/src/registry.ts
+++ b/services/gateway/src/registry.ts
@@ -29,6 +29,11 @@ type Row = {
 // pg returns TIMESTAMPTZ columns as Date objects.
 const iso = (value: string | Date | null) =>
   value ? new Date(value).toISOString() : undefined;
+// Servers created by the store provisioner are changed only through Stores.
+const storeOwned = () =>
+  new RegistryInputError(
+    'This server belongs to a store; manage it from Stores',
+  );
 export class Registry {
   store: PostgresStore;
   gateway: Gateway;
@@ -51,11 +56,12 @@ export class Registry {
     gateway: Gateway,
     secrets: CredentialStore,
     origins: string[],
+    managedStores = false,
   ) {
     this.store = store;
     this.gateway = gateway;
     this.secrets = secrets;
-    this.policy = new UpstreamPolicy(origins);
+    this.policy = new UpstreamPolicy(origins, undefined, managedStores);
   }
   validateUrl(value: string): string {
     return this.policy.validate(value).toString();
@@ -283,6 +289,7 @@ export class Registry {
     },
   ) {
     if (actor.role !== 'admin') throw new Error('Administrator required');
+    if (input.id?.startsWith('store-')) throw storeOwned();
     if (!/^[a-z][a-z0-9_-]{0,15}$/.test(input.slug))
       throw new RegistryInputError('Use a short lowercase server slug');
     const url = (await this.policy.check(input.url)).toString();
@@ -350,6 +357,7 @@ export class Registry {
   }
   private async deleteUnlocked(actor: Identity, id: string): Promise<void> {
     if (actor.role !== 'admin') throw new Error('Administrator required');
+    if (id.startsWith('store-')) throw storeOwned();
     const deleted = await this.store.pool.query(
       `WITH deleted AS (
         DELETE FROM upstream_servers WHERE id=$1 AND team_id=$2 RETURNING id,team_id,slug,credential_ref
diff --git a/services/gateway/src/store-manifests.ts b/services/gateway/src/store-manifests.ts
new file mode 100644
index 0000000..08c9b30
--- /dev/null
+++ b/services/gateway/src/store-manifests.ts
@@ -0,0 +1,596 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { managedLabel, storeNamespacePattern } from './k8s-client.ts';
+
+export const storeSlugPattern = /^[a-z](?:[a-z0-9-]{0,10}[a-z0-9])?$/;
+
+type Resources = {
+  requests: { cpu: string; memory: string };
+  limits: { cpu: string; memory: string };
+};
+export type StoreSettings = {
+  images: { app: string; store: string; mariadb: string; pullPolicy: string };
+  // Storefront hosts are <slug>.<hostSuffix>.
+  hostSuffix: string;
+  scheme: 'http' | 'https';
+  tlsSecretName?: string;
+  tlsClusterIssuer?: string;
+  quota?: Record<string, string>;
+  ingressClass: string;
+  storageClass: string;
+  storage: { wordpress: string; mariadb: string };
+  timezone: string;
+  woocommerceVersion: string;
+  // Where the gateway runs, so only it can reach each store's MCP server.
+  gateway: { namespace: string; instance: string };
+  healthPhp: string;
+  resources: { wordpress: Resources; mariadb: Resources; wooMcp: Resources };
+};
+
+// Every name and address a store uses comes from here, so the Ingress host,
+// WordPress URLs, OAuth signing and the MCP origin always agree.
+export function storeNames(
+  slug: string,
+  settings: Pick<StoreSettings, 'hostSuffix' | 'scheme'>,
+) {
+  if (!storeSlugPattern.test(slug)) throw new Error('Invalid store slug');
+  const namespace = `storelink-store-${slug}`;
+  if (!storeNamespacePattern.test(namespace))
+    throw new Error('Invalid store namespace');
+  const host = `${slug}.${settings.hostSuffix}`;
+  const mcpOrigin = `http://woo-mcp.${namespace}.svc.cluster.local:3001`;
+  return {
+    namespace,
+    host,
+    publicUrl: `${settings.scheme}://${host}`,
+    mcpOrigin,
+    mcpUrl: `${mcpOrigin}/mcp`,
+    upstreamSlug: `woo-${slug}`,
+  };
+}
+
+// Generated once per store; the provisioner creates it only if it is missing,
+// since MariaDB and WooCommerce keep the first values they see.
+export function storeSecret(
+  slug: string,
+  settings: StoreSettings,
+  mcpToken?: string,
+) {
+  const { namespace } = storeNames(slug, settings);
+  const random = () => randomBytes(32).toString('base64url');
+  return {
+    apiVersion: 'v1',
+    kind: 'Secret',
+    metadata: { name: 'store-credentials', namespace, labels: labels(slug) },
+    type: 'Opaque',
+    stringData: {
+      'mariadb-root-password': random(),
+      'wordpress-db-password': random(),
+      'wordpress-admin-password': random(),
+      'woo-consumer-key': `ck_${randomBytes(20).toString('hex')}`,
+      'woo-consumer-secret': `cs_${randomBytes(20).toString('hex')}`,
+      'woo-mcp-token': mcpToken ?? random(),
+    },
+  };
+}
+
+function labels(slug: string, component?: string) {
+  return {
+    'app.kubernetes.io/managed-by': 'storelink-provisioner',
+    'storelink/store': slug,
+    ...(component && { 'storelink/component': component }),
+  };
+}
+const selector = (slug: string, component: string) => ({
+  matchLabels: { 'storelink/store': slug, 'storelink/component': component },
+});
+const secretEnv = (name: string, key: string) => ({
+  name,
+  valueFrom: { secretKeyRef: { name: 'store-credentials', key } },
+});
+const dropAll = {
+  allowPrivilegeEscalation: false,
+  capabilities: { drop: ['ALL'] },
+};
+const nonRoot = (id: number) => ({
+  runAsNonRoot: true,
+  runAsUser: id,
+  runAsGroup: id,
+  fsGroup: id,
+  fsGroupChangePolicy: 'OnRootMismatch',
+});
+
+export function storeManifests(
+  slug: string,
+  settings: StoreSettings,
+  title = 'StoreLink Store',
+  attempt = 1,
+) {
+  if (!Number.isSafeInteger(attempt) || attempt < 1)
+    throw new Error('Invalid provisioning attempt');
+  if (settings.scheme === 'https' && !settings.tlsSecretName)
+    throw new Error('HTTPS stores need a TLS Secret name');
+  const names = storeNames(slug, settings);
+  const { namespace } = names;
+  const meta = (name: string, component?: string) => ({
+    name,
+    namespace,
+    labels: labels(slug, component),
+  });
+  const deployment = (
+    name: string,
+    podSpec: Record<string, unknown>,
+    component = name,
+  ) => ({
+    apiVersion: 'apps/v1',
+    kind: 'Deployment',
+    metadata: meta(name, component),
+    spec: {
+      replicas: 1,
+      strategy: { type: 'Recreate' },
+      selector: selector(slug, component),
+      template: {
+        metadata: { labels: labels(slug, component) },
+        spec: {
+          automountServiceAccountToken: false,
+          enableServiceLinks: false,
+          ...podSpec,
+        },
+      },
+    },
+  });
+  const service = (
+    name: string,
+    port: number,
+    targetPort: string | number,
+  ) => ({
+    apiVersion: 'v1',
+    kind: 'Service',
+    metadata: meta(name, name),
+    spec: {
+      selector: selector(slug, name).matchLabels,
+      ports: [{ port, targetPort }],
+    },
+  });
+  const claim = (name: string, size: string) => ({
+    apiVersion: 'v1',
+    kind: 'PersistentVolumeClaim',
+    metadata: meta(name, name),
+    spec: {
+      accessModes: ['ReadWriteOnce'],
+      storageClassName: settings.storageClass,
+      resources: { requests: { storage: size } },
+    },
+  });
+  const policy = (
+    name: string,
+    component: string | undefined,
+    spec: Record<string, unknown>,
+  ) => ({
+    apiVersion: 'networking.k8s.io/v1',
+    kind: 'NetworkPolicy',
+    metadata: meta(name),
+    spec: {
+      podSelector: component ? selector(slug, component) : {},
+      ...spec,
+    },
+  });
+  const from = (component: string) => ({
+    podSelector: selector(slug, component),
+  });
+  const traefik = {
+    namespaceSelector: {
+      matchLabels: { 'kubernetes.io/metadata.name': 'kube-system' },
+    },
+    podSelector: { matchLabels: { 'app.kubernetes.io/name': 'traefik' } },
+  };
+  const gateway = {
+    namespaceSelector: {
+      matchLabels: {
+        'kubernetes.io/metadata.name': settings.gateway.namespace,
+      },
+    },
+    podSelector: {
+      matchLabels: {
+        'storelink/component': 'gateway',
+        'app.kubernetes.io/instance': settings.gateway.instance,
+      },
+    },
+  };
+  const tcp = (port: number) => [{ protocol: 'TCP', port }];
+  const wordpressEnv = [
+    { name: 'WORDPRESS_DB_HOST', value: 'mariadb' },
+    { name: 'WORDPRESS_DB_NAME', value: 'wordpress' },
+    { name: 'WORDPRESS_DB_USER', value: 'wordpress' },
+    secretEnv('WORDPRESS_DB_PASSWORD', 'wordpress-db-password'),
+    { name: 'STORE_PUBLIC_URL', value: names.publicUrl },
+  ];
+  const bootstrap = {
+    restartPolicy: 'OnFailure',
+    automountServiceAccountToken: false,
+    // Service variables such as WOO_MCP_PORT would override the app's own settings.
+    enableServiceLinks: false,
+    securityContext: nonRoot(33),
+    affinity: {
+      podAffinity: {
+        requiredDuringSchedulingIgnoredDuringExecution: [
+          {
+            labelSelector: selector(slug, 'wordpress'),
+            topologyKey: 'kubernetes.io/hostname',
+          },
+        ],
+      },
+    },
+    containers: [
+      {
+        name: 'bootstrap',
+        image: settings.images.store,
+        imagePullPolicy: settings.images.pullPolicy,
+        command: ['bash', '/opt/storelink/bootstrap.sh'],
+        env: [
+          ...wordpressEnv,
+          { name: 'STORE_TITLE', value: title },
+          { name: 'STORE_TIMEZONE', value: settings.timezone },
+          { name: 'WOOCOMMERCE_VERSION', value: settings.woocommerceVersion },
+          { name: 'WORDPRESS_ADMIN_USER', value: 'admin' },
+          secretEnv('WORDPRESS_ADMIN_PASSWORD', 'wordpress-admin-password'),
+          secretEnv('WOO_CONSUMER_KEY', 'woo-consumer-key'),
+          secretEnv('WOO_CONSUMER_SECRET', 'woo-consumer-secret'),
+        ],
+        resources: {
+          requests: { cpu: '100m', memory: '192Mi' },
+          limits: { cpu: '1', memory: '512Mi' },
+        },
+        securityContext: dropAll,
+        volumeMounts: [
+          { name: 'wordpress', mountPath: '/var/www/html' },
+          { name: 'tmp', mountPath: '/tmp' },
+        ],
+      },
+    ],
+    volumes: [
+      { name: 'wordpress', persistentVolumeClaim: { claimName: 'wordpress' } },
+      { name: 'tmp', emptyDir: {} },
+    ],
+  };
+  // Jobs cannot be changed after creation, so the name follows the spec.
+  const jobName = `store-bootstrap-${createHash('sha256')
+    .update(JSON.stringify(bootstrap))
+    .digest('hex')
+    .slice(0, 10)}-${attempt}`;
+  const ingress = {
+    apiVersion: 'networking.k8s.io/v1',
+    kind: 'Ingress',
+    metadata: {
+      ...meta('wordpress', 'wordpress'),
+      ...(settings.tlsClusterIssuer && {
+        annotations: {
+          'cert-manager.io/cluster-issuer': settings.tlsClusterIssuer,
+        },
+      }),
+    },
+    spec: {
+      ingressClassName: settings.ingressClass,
+      ...(settings.tlsSecretName && {
+        tls: [{ hosts: [names.host], secretName: settings.tlsSecretName }],
+      }),
+      rules: [
+        {
+          host: names.host,
+          http: {
+            paths: [
+              {
+                path: '/',
+                pathType: 'Prefix',
+                backend: {
+                  service: { name: 'wordpress', port: { number: 80 } },
+                },
+              },
+            ],
+          },
+        },
+      ],
+    },
+  };
+  return {
+    names,
+    jobName,
+    objects: [
+      {
+        apiVersion: 'v1',
+        kind: 'Namespace',
+        metadata: {
+          name: namespace,
+          labels: { ...labels(slug), [managedLabel]: 'true' },
+        },
+      },
+      {
+        apiVersion: 'v1',
+        kind: 'ResourceQuota',
+        metadata: meta('store'),
+        spec: {
+          hard: {
+            'requests.cpu': '1',
+            'requests.memory': '1Gi',
+            'limits.cpu': '6',
+            'limits.memory': '2Gi',
+            pods: '6',
+            persistentvolumeclaims: '2',
+            'requests.storage': '8Gi',
+            services: '4',
+            ...settings.quota,
+          },
+        },
+      },
+      {
+        apiVersion: 'v1',
+        kind: 'LimitRange',
+        metadata: meta('store'),
+        spec: {
+          limits: [
+            {
+              type: 'Container',
+              defaultRequest: { cpu: '50m', memory: '64Mi' },
+              default: { cpu: '500m', memory: '256Mi' },
+              max: { cpu: '2', memory: '1Gi' },
+            },
+          ],
+        },
+      },
+      policy('default-deny', undefined, { policyTypes: ['Ingress', 'Egress'] }),
+      // HTTP-01 solver pods are created by cert-manager, outside the store's
+      // application labels. Let Traefik reach only their challenge port.
+      ...(settings.tlsClusterIssuer
+        ? [
+            {
+              apiVersion: 'networking.k8s.io/v1',
+              kind: 'NetworkPolicy',
+              metadata: meta('acme-http01-solver'),
+              spec: {
+                podSelector: {
+                  matchLabels: { 'acme.cert-manager.io/http01-solver': 'true' },
+                },
+                policyTypes: ['Ingress'],
+                ingress: [{ from: [traefik], ports: tcp(8089) }],
+              },
+            },
+          ]
+        : []),
+      policy('dns', undefined, {
+        policyTypes: ['Egress'],
+        egress: [
+          {
+            to: [
+              {
+                namespaceSelector: {
+                  matchLabels: { 'kubernetes.io/metadata.name': 'kube-system' },
+                },
+                podSelector: { matchLabels: { 'k8s-app': 'kube-dns' } },
+              },
+            ],
+            ports: [
+              { protocol: 'UDP', port: 53 },
+              { protocol: 'TCP', port: 53 },
+            ],
+          },
+        ],
+      }),
+      policy('woo-mcp', 'woo-mcp', {
+        policyTypes: ['Ingress', 'Egress'],
+        ingress: [{ from: [gateway], ports: tcp(3001) }],
+        egress: [{ to: [from('wordpress')], ports: tcp(8080) }],
+      }),
+      policy('wordpress', 'wordpress', {
+        policyTypes: ['Ingress', 'Egress'],
+        ingress: [{ from: [from('woo-mcp'), traefik], ports: tcp(8080) }],
+        egress: [{ to: [from('mariadb')], ports: tcp(3306) }],
+      }),
+      policy('mariadb', 'mariadb', {
+        policyTypes: ['Ingress'],
+        ingress: [
+          {
+            from: [from('wordpress'), from('store-bootstrap')],
+            ports: tcp(3306),
+          },
+        ],
+      }),
+      policy('store-bootstrap', 'store-bootstrap', {
+        policyTypes: ['Egress'],
+        egress: [{ to: [from('mariadb')], ports: tcp(3306) }],
+      }),
+      {
+        apiVersion: 'v1',
+        kind: 'ConfigMap',
+        metadata: meta('store-health'),
+        data: { 'health.php': settings.healthPhp },
+      },
+      claim('mariadb', settings.storage.mariadb),
+      claim('wordpress', settings.storage.wordpress),
+      deployment('mariadb', {
+        securityContext: nonRoot(999),
+        containers: [
+          {
+            name: 'mariadb',
+            image: settings.images.mariadb,
+            imagePullPolicy: settings.images.pullPolicy,
+            args: ['--innodb-buffer-pool-size=64M', '--max-connections=30'],
+            env: [
+              { name: 'MARIADB_DATABASE', value: 'wordpress' },
+              { name: 'MARIADB_USER', value: 'wordpress' },
+              secretEnv('MARIADB_PASSWORD', 'wordpress-db-password'),
+              secretEnv('MARIADB_ROOT_PASSWORD', 'mariadb-root-password'),
+            ],
+            ports: [{ containerPort: 3306, name: 'mysql' }],
+            startupProbe: {
+              exec: {
+                command: [
+                  'healthcheck.sh',
+                  '--connect',
+                  '--innodb_initialized',
+                ],
+              },
+              periodSeconds: 2,
+              failureThreshold: 60,
+            },
+            readinessProbe: {
+              exec: {
+                command: [
+                  'healthcheck.sh',
+                  '--connect',
+                  '--innodb_initialized',
+                ],
+              },
+              periodSeconds: 5,
+            },
+            livenessProbe: {
+              exec: { command: ['healthcheck.sh', '--connect'] },
+              periodSeconds: 10,
+              failureThreshold: 6,
+            },
+            securityContext: dropAll,
+            resources: settings.resources.mariadb,
+            volumeMounts: [{ name: 'data', mountPath: '/var/lib/mysql' }],
+          },
+        ],
+        volumes: [
+          { name: 'data', persistentVolumeClaim: { claimName: 'mariadb' } },
+        ],
+      }),
+      service('mariadb', 3306, 'mysql'),
+      deployment('wordpress', {
+        securityContext: nonRoot(33),
+        containers: [
+          {
+            name: 'wordpress',
+            image: settings.images.store,
+            imagePullPolicy: settings.images.pullPolicy,
+            env: [
+              ...wordpressEnv,
+              {
+                name: 'WORDPRESS_CONFIG_EXTRA',
+                value: [
+                  "define('WP_HOME', getenv('STORE_PUBLIC_URL'));",
+                  "define('WP_SITEURL', getenv('STORE_PUBLIC_URL'));",
+                  "define('DISALLOW_FILE_EDIT', true);",
+                  "define('WP_MEMORY_LIMIT', '256M');",
+                ].join('\n'),
+              },
+            ],
+            ports: [{ containerPort: 8080, name: 'http' }],
+            startupProbe: {
+              tcpSocket: { port: 'http' },
+              periodSeconds: 2,
+              failureThreshold: 90,
+            },
+            readinessProbe: {
+              httpGet: { path: '/storelink-health.php', port: 'http' },
+              periodSeconds: 5,
+              timeoutSeconds: 5,
+              failureThreshold: 3,
+            },
+            livenessProbe: {
+              tcpSocket: { port: 'http' },
+              periodSeconds: 10,
+              failureThreshold: 6,
+            },
+            securityContext: dropAll,
+            resources: settings.resources.wordpress,
+            volumeMounts: [
+              { name: 'wordpress', mountPath: '/var/www/html' },
+              {
+                name: 'health',
+                mountPath: '/var/www/html/storelink-health.php',
+                subPath: 'health.php',
+                readOnly: true,
+              },
+            ],
+          },
+        ],
+        volumes: [
+          {
+            name: 'wordpress',
+            persistentVolumeClaim: { claimName: 'wordpress' },
+          },
+          { name: 'health', configMap: { name: 'store-health' } },
+        ],
+      }),
+      service('wordpress', 80, 'http'),
+      ingress,
+      {
+        apiVersion: 'batch/v1',
+        kind: 'Job',
+        metadata: meta(jobName, 'store-bootstrap'),
+        spec: {
+          backoffLimit: 6,
+          activeDeadlineSeconds: 600,
+          template: {
+            metadata: { labels: labels(slug, 'store-bootstrap') },
+            spec: bootstrap,
+          },
+        },
+      },
+      deployment('woo-mcp', {
+        securityContext: {
+          runAsNonRoot: true,
+          runAsUser: 1000,
+          runAsGroup: 1000,
+        },
+        containers: [
+          {
+            name: 'woo-mcp',
+            image: settings.images.app,
+            imagePullPolicy: settings.images.pullPolicy,
+            command: ['node', 'services/woocommerce-mcp/src/main.ts'],
+            env: [
+              { name: 'WOO_MCP_ORIGIN', value: names.mcpOrigin },
+              { name: 'WOO_MCP_PORT', value: '3001' },
+              { name: 'STORE_PUBLIC_URL', value: names.publicUrl },
+              { name: 'STORE_CONNECT_SERVICE', value: 'wordpress' },
+              { name: 'WOO_MCP_TOKEN_FILE', value: '/secrets/woo-mcp-token' },
+              {
+                name: 'WOO_CONSUMER_KEY_FILE',
+                value: '/secrets/woo-consumer-key',
+              },
+              {
+                name: 'WOO_CONSUMER_SECRET_FILE',
+                value: '/secrets/woo-consumer-secret',
+              },
+            ],
+            ports: [{ name: 'http', containerPort: 3001 }],
+            startupProbe: {
+              httpGet: { path: '/health/live', port: 'http' },
+              periodSeconds: 2,
+              failureThreshold: 60,
+            },
+            readinessProbe: {
+              httpGet: { path: '/health/ready', port: 'http' },
+              periodSeconds: 5,
+            },
+            livenessProbe: {
+              httpGet: { path: '/health/live', port: 'http' },
+              periodSeconds: 10,
+            },
+            securityContext: { ...dropAll, readOnlyRootFilesystem: true },
+            resources: settings.resources.wooMcp,
+            volumeMounts: [
+              { name: 'secrets', mountPath: '/secrets', readOnly: true },
+            ],
+          },
+        ],
+        volumes: [
+          {
+            name: 'secrets',
+            secret: {
+              secretName: 'store-credentials',
+              items: [
+                'woo-mcp-token',
+                'woo-consumer-key',
+                'woo-consumer-secret',
+              ].map((key) => ({ key, path: key })),
+            },
+          },
+        ],
+      }),
+      service('woo-mcp', 3001, 'http'),
+    ],
+  };
+}
diff --git a/services/gateway/src/store-provisioner.ts b/services/gateway/src/store-provisioner.ts
new file mode 100644
index 0000000..903c30b
--- /dev/null
+++ b/services/gateway/src/store-provisioner.ts
@@ -0,0 +1,323 @@
+import { createHmac } from 'node:crypto';
+import type { Pool } from 'pg';
+import { storeManifests, storeSecret } from './store-manifests.ts';
+import type { StoreSettings } from './store-manifests.ts';
+import type { StoreCluster } from './k8s-client.ts';
+import type { CredentialStore } from './credentials.ts';
+
+export type StoreStatus = 'Provisioning' | 'Ready' | 'Failed' | 'Deleting';
+export type StoreRecord = {
+  id: string;
+  teamId: string;
+  slug: string;
+  displayName: string;
+  status: StoreStatus;
+  deadlineAt: number | null;
+  attempt?: number;
+  tokenVersion?: number;
+};
+export interface StoreRepository {
+  // Stores the provisioner has work to do for.
+  active(): Promise<StoreRecord[]>;
+  // Changes status only if the store is still in `from`, so a concurrent
+  // delete is never overwritten.
+  update(
+    id: string,
+    from: StoreStatus,
+    to: StoreStatus,
+    reason: string | null,
+  ): Promise<void>;
+  remove(id: string): Promise<void>;
+}
+// Connects a store's MCP server to the gateway.
+export interface StoreRegistrar {
+  hasCredential(store: StoreRecord): Promise<boolean>;
+  saveCredential(store: StoreRecord, token: string): Promise<void>;
+  register(store: StoreRecord, url: string, slug: string): Promise<void>;
+  unregister(store: StoreRecord): Promise<void>;
+}
+type Cluster = Pick<
+  StoreCluster,
+  'apply' | 'create' | 'get' | 'deleteNamespace'
+>;
+
+type Workload = {
+  status?: {
+    availableReplicas?: number;
+    succeeded?: number;
+    conditions?: { type: string; status: string; message?: string }[];
+  };
+};
+
+export class StoreProvisioner {
+  repository: StoreRepository;
+  cluster: Cluster;
+  registrar: StoreRegistrar;
+  settings: StoreSettings;
+  now: () => number;
+  tokenKey?: Uint8Array;
+  // Stores whose manifests this process has applied, keyed by store and Job name.
+  private applied = new Set<string>();
+  private pending = new Map<string, string>();
+  constructor(options: {
+    repository: StoreRepository;
+    cluster: Cluster;
+    registrar: StoreRegistrar;
+    settings: StoreSettings;
+    now?: () => number;
+    tokenKey?: Uint8Array;
+  }) {
+    this.repository = options.repository;
+    this.cluster = options.cluster;
+    this.registrar = options.registrar;
+    this.settings = options.settings;
+    this.now = options.now ?? Date.now;
+    this.tokenKey = options.tokenKey;
+  }
+
+  async reconcile(): Promise<void> {
+    for (const store of await this.repository.active()) {
+      try {
+        if (store.status === 'Provisioning') await this.provision(store);
+        else if (store.status === 'Deleting') await this.teardown(store);
+      } catch (error) {
+        // Recorded for the dashboard; the next pass tries again.
+        await this.repository
+          .update(store.id, store.status, store.status, message(error))
+          .catch(() => {});
+      }
+    }
+  }
+
+  private async fail(store: StoreRecord, reason: string) {
+    for (const key of this.applied)
+      if (key.startsWith(`${store.id}:`)) this.applied.delete(key);
+    this.pending.delete(store.id);
+    await this.repository.update(store.id, 'Provisioning', 'Failed', reason);
+  }
+
+  private async provision(store: StoreRecord) {
+    if (store.deadlineAt !== null && this.now() > store.deadlineAt) {
+      await this.fail(
+        store,
+        `Not ready before the provisioning deadline; ${this.pending.get(store.id) ?? 'nothing was created'}`,
+      );
+      return;
+    }
+    const { objects, jobName, names } = storeManifests(
+      store.slug,
+      this.settings,
+      store.displayName,
+      store.attempt ?? 1,
+    );
+    const key = `${store.id}:${jobName}`;
+    if (!this.applied.has(key)) {
+      await this.cluster.apply(objects[0] as never);
+      const token =
+        store.tokenVersion === 1
+          ? storeMcpToken(this.tokenKey, store.id)
+          : undefined;
+      const secret = storeSecret(store.slug, this.settings, token);
+      const created = await this.cluster.create(secret as never);
+      // For new stores the token can be reconstructed after a crash between
+      // Secret creation and saving the gateway's credential. DB passwords stay random.
+      if (created || (token && !(await this.registrar.hasCredential(store))))
+        await this.registrar.saveCredential(
+          store,
+          secret.stringData['woo-mcp-token'],
+        );
+      else if (!(await this.registrar.hasCredential(store))) {
+        await this.fail(
+          store,
+          'Legacy store credentials exist but the gateway has no copy; delete the store and create it again',
+        );
+        return;
+      }
+      for (const object of objects.slice(1))
+        await this.cluster.apply(object as never);
+      this.applied.add(key);
+    }
+    const waiting: string[] = [];
+    for (const name of ['mariadb', 'wordpress', 'woo-mcp']) {
+      const deployment = (await this.cluster.get({
+        apiVersion: 'apps/v1',
+        kind: 'Deployment',
+        metadata: { name, namespace: names.namespace },
+      })) as Workload | undefined;
+      if (!deployment?.status?.availableReplicas) waiting.push(name);
+    }
+    const job = (await this.cluster.get({
+      apiVersion: 'batch/v1',
+      kind: 'Job',
+      metadata: { name: jobName, namespace: names.namespace },
+    })) as Workload | undefined;
+    const failed = job?.status?.conditions?.find(
+      (c) => c.type === 'Failed' && c.status === 'True',
+    );
+    if (failed) {
+      await this.fail(
+        store,
+        `Store setup failed${failed.message ? `: ${failed.message}` : ''}`,
+      );
+      return;
+    }
+    if (!job?.status?.succeeded) waiting.push('store setup');
+    if (this.settings.tlsClusterIssuer) {
+      const certificate = (await this.cluster.get({
+        apiVersion: 'cert-manager.io/v1',
+        kind: 'Certificate',
+        metadata: {
+          name: this.settings.tlsSecretName!,
+          namespace: names.namespace,
+        },
+      })) as Workload | undefined;
+      if (
+        !certificate?.status?.conditions?.some(
+          (c) => c.type === 'Ready' && c.status === 'True',
+        )
+      )
+        waiting.push('TLS certificate');
+    }
+
+    if (waiting.length) {
+      this.pending.set(store.id, `waiting for ${waiting.join(', ')}`);
+      return;
+    }
+    await this.registrar.register(store, names.mcpUrl, names.upstreamSlug);
+    this.pending.delete(store.id);
+    await this.repository.update(store.id, 'Provisioning', 'Ready', null);
+  }
+
+  private async teardown(store: StoreRecord) {
+    await this.registrar.unregister(store);
+    const { namespace } = storeManifests(store.slug, this.settings).names;
+    if ((await this.cluster.deleteNamespace(namespace)) === 'gone') {
+      for (const key of this.applied)
+        if (key.startsWith(`${store.id}:`)) this.applied.delete(key);
+      await this.repository.remove(store.id);
+    }
+  }
+}
+
+export function storeMcpToken(key: Uint8Array | undefined, id: string): string {
+  if (!key || key.byteLength < 32)
+    throw new Error(
+      'Store MCP token key must contain at least 32 random bytes',
+    );
+  return createHmac('sha256', key)
+    .update('storelink/store-mcp/v1:' + id)
+    .digest('base64url');
+}
+
+const message = (error: unknown) =>
+  error instanceof Error ? error.message.slice(0, 500) : 'Unexpected error';
+
+export class PostgresStoreRepository implements StoreRepository {
+  pool: Pool;
+  constructor(pool: Pool) {
+    this.pool = pool;
+  }
+  async active(): Promise<StoreRecord[]> {
+    const { rows } = await this.pool.query<{
+      id: string;
+      team_id: string;
+      slug: string;
+      display_name: string;
+      status: StoreStatus;
+      deadline_at: Date | null;
+      attempt: number;
+      token_version: number;
+    }>(
+      `SELECT id,team_id,slug,display_name,status,deadline_at,attempt,token_version FROM stores
+      WHERE status IN ('Provisioning','Deleting') ORDER BY created_at`,
+    );
+    return rows.map((row) => ({
+      id: row.id,
+      teamId: row.team_id,
+      slug: row.slug,
+      displayName: row.display_name,
+      status: row.status,
+      deadlineAt: row.deadline_at ? row.deadline_at.getTime() : null,
+      attempt: row.attempt,
+      tokenVersion: row.token_version,
+    }));
+  }
+  async update(
+    id: string,
+    from: StoreStatus,
+    to: StoreStatus,
+    reason: string | null,
+  ): Promise<void> {
+    await this.pool.query(
+      `UPDATE stores SET status=$3,failure_reason=$4,updated_at=now()
+      WHERE id=$1 AND status=$2`,
+      [id, from, to, reason],
+    );
+  }
+  async remove(id: string): Promise<void> {
+    await this.pool.query(
+      "DELETE FROM stores WHERE id=$1 AND status='Deleting'",
+      [id],
+    );
+  }
+}
+
+// Registers a store's MCP server the way the dashboard registers any server:
+// a credential entry in the gateway's Secret and a row in upstream_servers.
+export class PostgresStoreRegistrar implements StoreRegistrar {
+  pool: Pool;
+  credentials: CredentialStore;
+  constructor(pool: Pool, credentials: CredentialStore) {
+    this.pool = pool;
+    this.credentials = credentials;
+  }
+  static upstreamId(store: { id: string }) {
+    return `store-${store.id}`;
+  }
+  async hasCredential(store: StoreRecord) {
+    return (
+      (await this.credentials.get(PostgresStoreRegistrar.upstreamId(store))) !==
+      undefined
+    );
+  }
+  async saveCredential(store: StoreRecord, token: string) {
+    await this.credentials.set(PostgresStoreRegistrar.upstreamId(store), {
+      header: 'authorization',
+      value: `Bearer ${token}`,
+    });
+  }
+  async register(store: StoreRecord, url: string, slug: string) {
+    const id = PostgresStoreRegistrar.upstreamId(store);
+    try {
+      await this.pool.query(
+        `INSERT INTO upstream_servers (id,team_id,slug,url,enabled,has_credential,credential_ref)
+        VALUES ($1,$2,$3,$4,true,true,$1)
+        ON CONFLICT (id) DO UPDATE SET url=excluded.url,slug=excluded.slug,
+          revision=upstream_servers.revision+1`,
+        [id, store.teamId, slug, url],
+      );
+    } catch (error) {
+      if ((error as { code?: string }).code === '23505')
+        throw new Error(`The MCP server name ${slug} is already in use`);
+      throw error;
+    }
+    await this.pool.query("SELECT pg_notify('storelink_registry', $1)", [
+      store.teamId,
+    ]);
+  }
+  async unregister(store: StoreRecord) {
+    const id = PostgresStoreRegistrar.upstreamId(store);
+    const removed = await this.pool.query(
+      `WITH deleted AS (
+        DELETE FROM upstream_servers WHERE id=$1 RETURNING id,team_id,slug
+      ) INSERT INTO upstream_events(team_id,server_id,slug,status)
+        SELECT team_id,id,slug,'Removed' FROM deleted`,
+      [id],
+    );
+    await this.credentials.set(id, null);
+    if (removed.rowCount)
+      await this.pool.query("SELECT pg_notify('storelink_registry', $1)", [
+        store.teamId,
+      ]);
+  }
+}
diff --git a/services/gateway/src/store-requests.ts b/services/gateway/src/store-requests.ts
new file mode 100644
index 0000000..ff5be08
--- /dev/null
+++ b/services/gateway/src/store-requests.ts
@@ -0,0 +1,83 @@
+import { randomUUID } from 'node:crypto';
+import type { Pool } from 'pg';
+import type { Identity } from '../../../packages/shared/src/api-keys.ts';
+import { storeNames } from './store-manifests.ts';
+
+export class StoreRequestError extends Error {
+  status: number;
+  constructor(status: number, message: string) {
+    super(message);
+    this.status = status;
+  }
+}
+export type StoreRequestSettings = {
+  hostSuffix: string;
+  scheme: 'http' | 'https';
+  maxPerTeam: number;
+  maxPerUser: number;
+  provisionTimeoutMs: number;
+};
+
+export async function requestStore(
+  pool: Pick<Pool, 'connect'>,
+  user: Identity,
+  input: { slug: string; displayName: string },
+  settings: StoreRequestSettings,
+): Promise<string> {
+  const names = storeNames(input.slug, settings);
+  const id = randomUUID();
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    // A short database admission transaction, independent of the long-running worker.
+    // The shared lock makes limits authoritative across gateway replicas.
+    await client.query('SELECT pg_advisory_xact_lock(87264005)');
+    const { rows } = await client.query<{ total: string; mine: string }>(
+      'SELECT count(*) AS total,count(*) FILTER (WHERE created_by=$2) AS mine FROM stores WHERE team_id=$1',
+      [user.teamId, user.userId],
+    );
+    if (Number(rows[0].total) >= settings.maxPerTeam)
+      throw new StoreRequestError(
+        409,
+        `A team can have ${settings.maxPerTeam} stores; delete one first`,
+      );
+    if (Number(rows[0].mine) >= settings.maxPerUser)
+      throw new StoreRequestError(
+        409,
+        `You can have ${settings.maxPerUser} stores; delete one first`,
+      );
+    const conflict = await client.query(
+      'SELECT 1 FROM upstream_servers WHERE team_id=$1 AND slug=$2',
+      [user.teamId, names.upstreamSlug],
+    );
+    if (conflict.rowCount)
+      throw new StoreRequestError(
+        409,
+        `The MCP server name ${names.upstreamSlug} is already in use`,
+      );
+    await client.query(
+      `INSERT INTO stores (id,team_id,created_by,slug,display_name,public_url,upstream_slug,status,deadline_at,token_version)
+   VALUES ($1,$2,$3,$4,$5,$6,$7,'Provisioning',now()+$8*interval '1 millisecond',1)`,
+      [
+        id,
+        user.teamId,
+        user.userId,
+        input.slug,
+        input.displayName,
+        names.publicUrl,
+        names.upstreamSlug,
+        settings.provisionTimeoutMs,
+      ],
+    );
+    await client.query("SELECT pg_notify('storelink_stores', '')");
+    await client.query('COMMIT');
+    return id;
+  } catch (error) {
+    await client.query('ROLLBACK');
+    if ((error as { code?: string }).code === '23505')
+      throw new StoreRequestError(409, 'That store name is in use');
+    throw error;
+  } finally {
+    client.release();
+  }
+}
diff --git a/services/gateway/src/upstream-policy.ts b/services/gateway/src/upstream-policy.ts
index f660ce6..ba49ea6 100644
--- a/services/gateway/src/upstream-policy.ts
+++ b/services/gateway/src/upstream-policy.ts
@@ -15,12 +15,29 @@ export function publicAddress(address: string): boolean {
     return false;
   }
 }
+// The MCP server of a store created by the provisioner (see store-manifests.ts).
+export const managedStoreOrigin =
+  /^http:\/\/woo-mcp\.storelink-store-[a-z](?:[a-z0-9-]{0,10}[a-z0-9])?\.svc\.cluster\.local:3001$/;
 export class UpstreamPolicy {
   origins: Set<string>;
   resolver: Resolver;
-  constructor(origins: string[], resolver: Resolver = resolve) {
+  managedStores: boolean;
+  constructor(
+    origins: string[],
+    resolver: Resolver = resolve,
+    managedStores = false,
+  ) {
     this.origins = new Set(origins);
     this.resolver = resolver;
+    this.managedStores = managedStores;
+  }
+  // Operator-approved private origins: the configured list and, when enabled,
+  // provisioned stores.
+  approved(origin: string): boolean {
+    return (
+      this.origins.has(origin) ||
+      (this.managedStores && managedStoreOrigin.test(origin))
+    );
   }
   validate(value: string): URL {
     let url: URL;
@@ -39,7 +56,7 @@ export class UpstreamPolicy {
       throw new RegistryInputError(
         'Upstream URL must not contain a query or fragment',
       );
-    if (this.origins.has(url.origin)) return url;
+    if (this.approved(url.origin)) return url;
     if (url.protocol !== 'https:')
       throw new RegistryInputError(
         'Public upstreams require HTTPS; private HTTP origins need operator approval',
@@ -77,13 +94,13 @@ export class UpstreamPolicy {
   }
   async check(value: string): Promise<URL> {
     const url = this.validate(value);
-    if (!this.origins.has(url.origin))
+    if (!this.approved(url.origin))
       await this.addresses(url.hostname.replace(/^\[|\]$/g, ''));
     return url;
   }
   connectionOptions(value: string): { lookup?: LookupFunction } {
     const url = this.validate(value);
-    if (this.origins.has(url.origin)) return {};
+    if (this.approved(url.origin)) return {};
     // This resolver supplies the checked addresses directly to the socket. No second DNS lookup.
     const lookup: LookupFunction = (hostname, options, callback) => {
       void this.addresses(hostname).then(
diff --git a/tests/store-requests.test.ts b/tests/store-requests.test.ts
new file mode 100644
index 0000000..71541ec
--- /dev/null
+++ b/tests/store-requests.test.ts
@@ -0,0 +1,123 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import type { Pool } from 'pg';
+import {
+  requestStore,
+  StoreRequestError,
+} from '../services/gateway/src/store-requests.ts';
+import type { Identity } from '../packages/shared/src/api-keys.ts';
+
+const user: Identity = {
+  userId: 'alice',
+  teamId: 'team',
+  role: 'member',
+  keyId: 'key',
+};
+const settings = {
+  hostSuffix: 'test.localhost',
+  scheme: 'http' as const,
+  maxPerUser: 3,
+  maxPerTeam: 3,
+  provisionTimeoutMs: 240000,
+};
+function fixture(existing: { team: string; owner: string }[]) {
+  const records = [...existing];
+  let tail = Promise.resolve();
+  let rollbacks = 0;
+  const pool = {
+    async connect() {
+      let release: (() => void) | undefined;
+      let pending: { team: string; owner: string } | undefined;
+      return {
+        async query(sql: string, args: unknown[] = []) {
+          if (sql === 'BEGIN') return { rows: [] };
+          if (sql.includes('pg_advisory_xact_lock')) {
+            const previous = tail;
+            tail = new Promise<void>((resolve) => {
+              release = resolve;
+            });
+            await previous;
+            return { rows: [] };
+          }
+          if (sql.includes('count(*) AS total')) {
+            const team = records.filter((r) => r.team === args[0]);
+            return {
+              rows: [
+                {
+                  total: String(team.length),
+                  mine: String(team.filter((r) => r.owner === args[1]).length),
+                },
+              ],
+            };
+          }
+          if (sql.includes('SELECT 1 FROM upstream_servers'))
+            return { rows: [], rowCount: 0 };
+          if (sql.includes('INSERT INTO stores')) {
+            pending = { team: String(args[1]), owner: String(args[2]) };
+            return { rows: [], rowCount: 1 };
+          }
+          if (sql.includes('pg_notify')) return { rows: [] };
+          if (sql === 'COMMIT') {
+            if (pending) records.push(pending);
+            release?.();
+            return { rows: [] };
+          }
+          if (sql === 'ROLLBACK') {
+            rollbacks++;
+            release?.();
+            return { rows: [] };
+          }
+          throw new Error('Unexpected query');
+        },
+        release() {
+          release?.();
+        },
+      };
+    },
+  } as unknown as Pick<Pool, 'connect'>;
+  return { pool, records, rollbacks: () => rollbacks };
+}
+
+test('concurrent gateway requests admit exactly one store when a team has one slot', async () => {
+  const f = fixture([
+    { team: 'team', owner: 'other' },
+    { team: 'team', owner: 'other' },
+  ]);
+  const results = await Promise.allSettled(
+    ['north', 'south'].map((slug) =>
+      requestStore(f.pool, user, { slug, displayName: slug }, settings),
+    ),
+  );
+  assert.equal(results.filter((r) => r.status === 'fulfilled').length, 1);
+  assert.equal(f.records.length, 3);
+  const rejected = results.find(
+    (r) => r.status === 'rejected',
+  ) as PromiseRejectedResult;
+  assert.ok(rejected.reason instanceof StoreRequestError);
+  assert.equal(rejected.reason.status, 409);
+  assert.equal(f.rollbacks(), 1);
+});
+test('store admission enforces per-user limits independently of another team and releases the transaction', async () => {
+  const f = fixture([
+    { team: 'team', owner: 'alice' },
+    { team: 'other', owner: 'alice' },
+  ]);
+  await assert.rejects(
+    () =>
+      requestStore(
+        f.pool,
+        user,
+        { slug: 'north', displayName: 'North' },
+        { ...settings, maxPerUser: 1 },
+      ),
+    /You can have 1 stores/,
+  );
+  await requestStore(
+    f.pool,
+    { ...user, userId: 'bob' },
+    { slug: 'south', displayName: 'South' },
+    { ...settings, maxPerUser: 1 },
+  );
+  assert.equal(f.records.length, 3);
+  assert.equal(f.rollbacks(), 1);
+});
diff --git a/tests/stores.test.ts b/tests/stores.test.ts
new file mode 100644
index 0000000..5718f4d
--- /dev/null
+++ b/tests/stores.test.ts
@@ -0,0 +1,524 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import {
+  storeManifests,
+  storeNames,
+  storeSecret,
+} from '../services/gateway/src/store-manifests.ts';
+import type { StoreSettings } from '../services/gateway/src/store-manifests.ts';
+import { StoreCluster } from '../services/gateway/src/k8s-client.ts';
+import type { KubeResponse } from '../services/gateway/src/k8s-client.ts';
+import { UpstreamPolicy } from '../services/gateway/src/upstream-policy.ts';
+import {
+  StoreProvisioner,
+  storeMcpToken,
+} from '../services/gateway/src/store-provisioner.ts';
+import type { StoreRecord } from '../services/gateway/src/store-provisioner.ts';
+
+const resources = {
+  requests: { cpu: '50m', memory: '64Mi' },
+  limits: { cpu: '1', memory: '256Mi' },
+};
+export const settings: StoreSettings = {
+  images: {
+    app: 'storelink-app:1',
+    store: 'storelink-wordpress:1',
+    mariadb: 'mariadb:11.8',
+    pullPolicy: 'IfNotPresent',
+  },
+  hostSuffix: 'store.storelink.localhost',
+  scheme: 'http',
+  ingressClass: 'traefik',
+  storageClass: 'local-path',
+  storage: { wordpress: '2Gi', mariadb: '1Gi' },
+  timezone: 'Asia/Kolkata',
+  woocommerceVersion: '11.2.1',
+  gateway: { namespace: 'storelink', instance: 'storelink' },
+  healthPhp: '<?php echo 1;',
+  resources: { wordpress: resources, mariadb: resources, wooMcp: resources },
+};
+
+type Obj = {
+  apiVersion: string;
+  kind: string;
+  metadata: {
+    name: string;
+    namespace?: string;
+    labels?: Record<string, string>;
+  };
+  spec?: any;
+};
+const env = (container: any, name: string) =>
+  container.env.find((e: { name: string }) => e.name === name)?.value;
+
+test('every address a store uses comes from its slug', () => {
+  const names = storeNames('north', settings);
+  assert.deepEqual(names, {
+    namespace: 'storelink-store-north',
+    host: 'north.store.storelink.localhost',
+    publicUrl: 'http://north.store.storelink.localhost',
+    mcpOrigin: 'http://woo-mcp.storelink-store-north.svc.cluster.local:3001',
+    mcpUrl: 'http://woo-mcp.storelink-store-north.svc.cluster.local:3001/mcp',
+    upstreamSlug: 'woo-north',
+  });
+  for (const slug of [
+    'North',
+    '1st',
+    'a'.repeat(13),
+    '../x',
+    'a_b',
+    '',
+    'north-',
+  ])
+    assert.throws(() => storeNames(slug, settings), /Invalid store slug/);
+  // The gateway approves exactly this origin form, and only when enabled.
+  assert.ok(new UpstreamPolicy([], undefined, true).approved(names.mcpOrigin));
+  assert.ok(!new UpstreamPolicy([]).approved(names.mcpOrigin));
+  for (const origin of [
+    'http://woo-mcp.storelink-store-north.svc.cluster.local:3002',
+    'http://wordpress.storelink-store-north.svc.cluster.local:3001',
+    'http://woo-mcp.storelink.svc.cluster.local:3001',
+    'https://woo-mcp.storelink-store-north.svc.cluster.local:3001',
+  ])
+    assert.ok(
+      !new UpstreamPolicy([], undefined, true).approved(origin),
+      origin,
+    );
+});
+
+test('store manifests stay inside the store namespace and agree on addresses', () => {
+  const { names, objects, jobName } = storeManifests('north', settings);
+  const all = objects as Obj[];
+  for (const object of all)
+    assert.equal(
+      object.kind === 'Namespace'
+        ? object.metadata.name
+        : object.metadata.namespace,
+      names.namespace,
+    );
+  assert.ok(
+    !all.some((o) => o.kind === 'Secret'),
+    'Secrets are created separately',
+  );
+  assert.equal(
+    all.find((o) => o.kind === 'Namespace')!.metadata.labels![
+      'storelink/managed-store'
+    ],
+    'true',
+  );
+  const workloads = all.filter((o) => ['Deployment', 'Job'].includes(o.kind));
+  const containers = workloads.flatMap((o) =>
+    o.spec.template.spec.containers.map((c: any) => ({
+      kind: o.kind,
+      c,
+      pod: o.spec.template.spec,
+    })),
+  );
+  assert.equal(containers.length, 4);
+  for (const { kind, c, pod } of containers) {
+    assert.ok(c.resources.requests && c.resources.limits, c.name);
+    assert.equal(pod.securityContext.runAsNonRoot, true, c.name);
+    assert.equal(pod.automountServiceAccountToken, false, c.name);
+    // A Service named woo-mcp would otherwise inject WOO_MCP_PORT=tcp://...
+    assert.equal(pod.enableServiceLinks, false, c.name);
+    assert.deepEqual(c.securityContext.capabilities.drop, ['ALL'], c.name);
+    if (kind === 'Deployment')
+      assert.ok(c.readinessProbe && c.livenessProbe, c.name);
+  }
+  const byName = (name: string) =>
+    containers.find(({ c }) => c.name === name)!.c;
+  assert.equal(env(byName('woo-mcp'), 'WOO_MCP_ORIGIN'), names.mcpOrigin);
+  for (const name of ['woo-mcp', 'wordpress', 'bootstrap'])
+    assert.equal(env(byName(name), 'STORE_PUBLIC_URL'), names.publicUrl, name);
+  const ingress = all.find((o) => o.kind === 'Ingress')!;
+  assert.equal(ingress.spec.rules[0].host, names.host);
+  assert.ok(all.some((o) => o.kind === 'Job' && o.metadata.name === jobName));
+  // A new image gives the immutable bootstrap Job a new name.
+  const updated = storeManifests('north', {
+    ...settings,
+    images: { ...settings.images, store: 'storelink-wordpress:2' },
+  });
+  assert.notEqual(updated.jobName, jobName);
+});
+
+test('store network policies admit only the gateway and the store itself', () => {
+  const policies = (storeManifests('north', settings).objects as Obj[]).filter(
+    (o) => o.kind === 'NetworkPolicy',
+  );
+  const deny = policies.find((p) => p.metadata.name === 'default-deny')!;
+  assert.deepEqual(deny.spec.podSelector, {});
+  assert.deepEqual(deny.spec.policyTypes, ['Ingress', 'Egress']);
+  const mcp = policies.find((p) => p.metadata.name === 'woo-mcp')!;
+  assert.deepEqual(mcp.spec.ingress[0].from, [
+    {
+      namespaceSelector: {
+        matchLabels: { 'kubernetes.io/metadata.name': 'storelink' },
+      },
+      podSelector: {
+        matchLabels: {
+          'storelink/component': 'gateway',
+          'app.kubernetes.io/instance': 'storelink',
+        },
+      },
+    },
+  ]);
+  // Peers within the store are selected by store and component, never by namespace.
+  for (const policy of policies)
+    for (const rule of [
+      ...(policy.spec.ingress ?? []),
+      ...(policy.spec.egress ?? []),
+    ])
+      for (const peer of rule.from ?? rule.to ?? [])
+        if (!peer.namespaceSelector)
+          assert.equal(
+            peer.podSelector.matchLabels['storelink/store'],
+            'north',
+          );
+});
+
+test('store secrets are random per store', () => {
+  const a = storeSecret('north', settings).stringData;
+  const b = storeSecret('north', settings).stringData;
+  assert.notEqual(a['woo-mcp-token'], b['woo-mcp-token']);
+  assert.match(a['woo-consumer-key'], /^ck_[0-9a-f]{40}$/);
+});
+
+test('the cluster client refuses namespaces outside the store pattern', async () => {
+  const calls: { method: string; path: string; type?: string }[] = [];
+  let namespaceLabels: Record<string, string> | undefined;
+  const cluster = new StoreCluster({
+    async request(method, path, _body, type): Promise<KubeResponse> {
+      calls.push({ method, path, type });
+      if (method === 'GET')
+        return namespaceLabels
+          ? {
+              status: 200,
+              body: { metadata: { name: 'x', labels: namespaceLabels } },
+            }
+          : { status: 404, body: {} };
+      return { status: 200, body: {} };
+    },
+  });
+  for (const namespace of ['storelink', 'kube-system', 'default'])
+    await assert.rejects(
+      cluster.apply({
+        apiVersion: 'v1',
+        kind: 'ConfigMap',
+        metadata: { name: 'x', namespace },
+      }),
+      /outside store namespaces/,
+    );
+  await assert.rejects(cluster.deleteNamespace('kube-system'), /outside store/);
+  assert.equal(calls.length, 0);
+
+  await cluster.apply(storeManifests('north', settings).objects[0] as Obj);
+  assert.equal(
+    calls[0].path,
+    '/api/v1/namespaces/storelink-store-north?fieldManager=storelink-provisioner&force=true',
+  );
+  assert.equal(calls[0].type, 'application/apply-patch+yaml');
+
+  // A namespace with a store-like name but without the managed label is kept.
+  namespaceLabels = {};
+  await assert.rejects(
+    cluster.deleteNamespace('storelink-store-north'),
+    /does not manage/,
+  );
+  namespaceLabels = { 'storelink/managed-store': 'true' };
+  assert.equal(
+    await cluster.deleteNamespace('storelink-store-north'),
+    'deleting',
+  );
+  assert.equal(calls.at(-1)!.method, 'DELETE');
+  namespaceLabels = undefined;
+  assert.equal(await cluster.deleteNamespace('storelink-store-north'), 'gone');
+});
+
+// A provisioner wired to in-memory fakes of the cluster, database and gateway.
+function provisionerFixture() {
+  let now = 0;
+  const store: StoreRecord = {
+    id: 's1',
+    teamId: 'team',
+    slug: 'north',
+    displayName: 'North',
+    status: 'Provisioning',
+    deadlineAt: 240000,
+  };
+  const updates: [string, string, string | null][] = [];
+  const events: string[] = [];
+  const state = {
+    secretExists: false,
+    credential: false,
+    available: new Set<string>(),
+    job: undefined as undefined | 'succeeded' | 'failed',
+    namespace: 'present' as 'present' | 'deleting' | 'gone',
+    removed: false,
+  };
+  const provisioner = new StoreProvisioner({
+    settings,
+    now: () => now,
+    repository: {
+      async active() {
+        return store.status === 'Provisioning' || store.status === 'Deleting'
+          ? [{ ...store }]
+          : [];
+      },
+      async update(_id, from, to, reason) {
+        if (store.status !== from) return;
+        store.status = to;
+        updates.push([from, to, reason]);
+      },
+      async remove() {
+        state.removed = true;
+      },
+    },
+    registrar: {
+      async hasCredential() {
+        return state.credential;
+      },
+      async saveCredential() {
+        state.credential = true;
+        events.push('credential');
+      },
+      async register(_store, url, slug) {
+        events.push(`register ${slug} ${url}`);
+      },
+      async unregister() {
+        events.push('unregister');
+      },
+    },
+    cluster: {
+      async apply(object: { kind: string }) {
+        events.push(`apply ${object.kind}`);
+        return {};
+      },
+      async create() {
+        if (state.secretExists) return false;
+        state.secretExists = true;
+        return true;
+      },
+      async get(object: { kind: string; metadata: { name: string } }) {
+        if (object.kind === 'Deployment')
+          return {
+            status: {
+              availableReplicas: state.available.has(object.metadata.name)
+                ? 1
+                : 0,
+            },
+          };
+        if (!state.job) return { status: {} };
+        return state.job === 'succeeded'
+          ? { status: { succeeded: 1 } }
+          : {
+              status: {
+                conditions: [
+                  {
+                    type: 'Failed',
+                    status: 'True',
+                    message: 'BackoffLimitExceeded',
+                  },
+                ],
+              },
+            };
+      },
+      async deleteNamespace() {
+        if (state.namespace === 'present') state.namespace = 'deleting';
+        return state.namespace === 'gone' ? 'gone' : 'deleting';
+      },
+    } as never,
+  });
+  return {
+    store,
+    updates,
+    events,
+    state,
+    provisioner,
+    advance: (ms: number) => {
+      now += ms;
+    },
+  };
+}
+
+test('a store becomes Ready once its workloads and setup finish, then registers', async () => {
+  const f = provisionerFixture();
+  await f.provisioner.reconcile();
+  assert.equal(f.store.status, 'Provisioning');
+  assert.ok(f.events.includes('credential'));
+  assert.equal(f.events.filter((e) => e === 'apply Namespace').length, 1);
+  // Later passes only check readiness; nothing is applied twice.
+  f.state.available = new Set(['mariadb', 'wordpress', 'woo-mcp']);
+  await f.provisioner.reconcile();
+  assert.equal(f.events.filter((e) => e === 'apply Namespace').length, 1);
+  assert.equal(f.store.status, 'Provisioning');
+  f.state.job = 'succeeded';
+  await f.provisioner.reconcile();
+  assert.equal(f.store.status, 'Ready');
+  assert.ok(
+    f.events.includes(
+      'register woo-north http://woo-mcp.storelink-store-north.svc.cluster.local:3001/mcp',
+    ),
+  );
+});
+
+test('provisioning fails with a reason on a deadline, a failed setup or lost credentials', async () => {
+  const late = provisionerFixture();
+  await late.provisioner.reconcile();
+  late.advance(240001);
+  await late.provisioner.reconcile();
+  assert.equal(late.store.status, 'Failed');
+  assert.match(
+    late.updates.at(-1)![2]!,
+    /deadline; waiting for mariadb, wordpress, woo-mcp, store setup/,
+  );
+
+  const broken = provisionerFixture();
+  broken.state.job = 'failed';
+  await broken.provisioner.reconcile();
+  assert.equal(broken.store.status, 'Failed');
+  assert.match(
+    broken.updates.at(-1)![2]!,
+    /Store setup failed: BackoffLimitExceeded/,
+  );
+
+  // The Secret survived a restart but the gateway never received its copy.
+  const lost = provisionerFixture();
+  lost.state.secretExists = true;
+  await lost.provisioner.reconcile();
+  assert.equal(lost.store.status, 'Failed');
+  assert.match(lost.updates.at(-1)![2]!, /no copy/);
+});
+
+test('deleting a store unregisters it and removes the row once the namespace is gone', async () => {
+  const f = provisionerFixture();
+  f.store.status = 'Deleting';
+  await f.provisioner.reconcile();
+  assert.deepEqual(f.events, ['unregister']);
+  assert.equal(f.state.removed, false);
+  f.state.namespace = 'gone';
+  await f.provisioner.reconcile();
+  assert.equal(f.state.removed, true);
+});
+
+test('a status change never overwrites a concurrent delete', async () => {
+  const f = provisionerFixture();
+  f.state.available = new Set(['mariadb', 'wordpress', 'woo-mcp']);
+  f.state.job = 'succeeded';
+  // The pass read the store as Provisioning, then it was deleted before it finished.
+  const snapshot = { ...f.store };
+  f.store.status = 'Deleting';
+  f.provisioner.repository.active = async () => [snapshot];
+  await f.provisioner.reconcile();
+  assert.equal(f.store.status, 'Deleting');
+});
+
+test('retry gives a failed bootstrap a new attempt without replacing database credentials', async () => {
+  const f = provisionerFixture();
+  f.state.available = new Set(['mariadb', 'wordpress', 'woo-mcp']);
+  f.state.job = 'failed';
+  const original = storeManifests(
+    f.store.slug,
+    settings,
+    f.store.displayName,
+    1,
+  ).jobName;
+  const get = f.provisioner.cluster.get.bind(f.provisioner.cluster);
+  f.provisioner.cluster.get = async (object) =>
+    object.kind === 'Job' && object.metadata.name === original
+      ? { status: { conditions: [{ type: 'Failed', status: 'True' }] } }
+      : get(object);
+  await f.provisioner.reconcile();
+  assert.equal(f.store.status, 'Failed');
+  f.store.status = 'Provisioning';
+  f.store.attempt = 2;
+  f.state.job = 'succeeded';
+  await f.provisioner.reconcile();
+  assert.equal(f.store.status, 'Ready');
+  assert.notEqual(
+    storeManifests(f.store.slug, settings, f.store.displayName, 2).jobName,
+    original,
+  );
+  assert.equal(f.events.filter((e) => e === 'credential').length, 1);
+});
+
+test('new-store MCP tokens recover a crash after Secret creation without reading store passwords', async () => {
+  const f = provisionerFixture();
+  const key = Buffer.alloc(32, 7);
+  f.store.tokenVersion = 1;
+  f.provisioner.tokenKey = key;
+  const tokens: string[] = [];
+  let interrupted = true;
+  f.provisioner.registrar.saveCredential = async (_store, token) => {
+    tokens.push(token);
+    if (interrupted) {
+      interrupted = false;
+      throw new Error('interrupted');
+    }
+    f.state.credential = true;
+  };
+  await f.provisioner.reconcile();
+  assert.equal(f.state.secretExists, true);
+  assert.equal(f.state.credential, false);
+  const restarted = new StoreProvisioner({
+    settings,
+    repository: f.provisioner.repository,
+    cluster: f.provisioner.cluster,
+    registrar: f.provisioner.registrar,
+    tokenKey: key,
+    now: () => 0,
+  });
+  f.state.available = new Set(['mariadb', 'wordpress', 'woo-mcp']);
+  f.state.job = 'succeeded';
+  await restarted.reconcile();
+  assert.equal(f.store.status, 'Ready');
+  assert.equal(tokens.length, 2);
+  assert.equal(tokens[0], tokens[1]);
+  assert.equal(tokens[0], storeMcpToken(key, f.store.id));
+  assert.notEqual(tokens[0], storeMcpToken(key, 'other-store'));
+  assert.throws(() => storeMcpToken(undefined, 'id'), /32 random bytes/);
+});
+
+test('HTTPS stores request their own certificate and remain Provisioning until it is Ready', async () => {
+  const f = provisionerFixture();
+  f.provisioner.settings = {
+    ...settings,
+    scheme: 'https',
+    tlsSecretName: 'storefront-tls',
+    tlsClusterIssuer: 'test-issuer',
+  };
+  const objects = storeManifests('north', f.provisioner.settings)
+    .objects as Obj[];
+  const ingress = objects.find((o) => o.kind === 'Ingress') as any;
+  assert.equal(
+    ingress.metadata.annotations['cert-manager.io/cluster-issuer'],
+    'test-issuer',
+  );
+  assert.equal(ingress.spec.tls[0].secretName, 'storefront-tls');
+  const solver = objects.find((o) => o.metadata.name === 'acme-http01-solver')!;
+  assert.equal(solver.spec.ingress[0].ports[0].port, 8089);
+  assert.deepEqual(solver.spec.podSelector.matchLabels, {
+    'acme.cert-manager.io/http01-solver': 'true',
+  });
+  let ready = false;
+  const get = f.provisioner.cluster.get.bind(f.provisioner.cluster);
+  f.provisioner.cluster.get = async (o) =>
+    o.kind === 'Certificate'
+      ? {
+          status: {
+            conditions: [{ type: 'Ready', status: ready ? 'True' : 'False' }],
+          },
+        }
+      : get(o);
+  f.state.available = new Set(['mariadb', 'wordpress', 'woo-mcp']);
+  f.state.job = 'succeeded';
+  await f.provisioner.reconcile();
+  assert.equal(f.store.status, 'Provisioning');
+  assert.ok(!f.events.some((e) => e.startsWith('register ')));
+  ready = true;
+  await f.provisioner.reconcile();
+  assert.equal(f.store.status, 'Ready');
+  assert.throws(
+    () => storeManifests('north', { ...settings, scheme: 'https' }),
+    /TLS Secret/,
+  );
+});