diff --git a/tenants/demo/00-namespace-quota-netpol.yaml b/tenants/demo/00-namespace-quota-netpol.yaml
index d9c4738..67e4536 100644
--- a/tenants/demo/00-namespace-quota-netpol.yaml
+++ b/tenants/demo/00-namespace-quota-netpol.yaml
@@ -16,7 +16,7 @@ metadata:
 spec:
   hard:
     requests.cpu: "4"
-    requests.memory: 6Gi
+    requests.memory: 7Gi
     limits.cpu: "20"
     limits.memory: 16Gi
     pods: "30"
diff --git a/tenants/demo/07-sealed-consentimento-selo.yaml b/tenants/demo/07-sealed-consentimento-selo.yaml
new file mode 100644
index 0000000..927af22
--- /dev/null
+++ b/tenants/demo/07-sealed-consentimento-selo.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: consentimento-selo
+  namespace: demo-prod
+spec:
+  encryptedData:
+    segredo: AgCFcAJHiHlG/bT+aj0m/UWNWKvNBBOdxXXO9FCgM5tqfNeJzl+zB3P+Xyz3CryEfnRVEPR2ZqGaKYk/CbiaLn67vUxPyzQHVNS/0PN3+04asMsS+5/YxaSxWufhlafefWFjyVJcrOEBWN3hNoXSS6esibOsna5n0O6OTL7q+5qSzJDDdYlXDcEd2Lb5y2SEcyFh+bc+jHeM8Q7AxqyJZ5zH3Ny7YGV4CzBxvt4Rx+NSn5YEizO54VpFKz+r8dnoYJAQfy5McD0jGkKtOuztYeDjg3HUzdHXZls2oD3bTm+A7wjrjqJlqnHxWSLy/mURsffeRkHoWk0yLFrO9NQ39TIkqqh/HrgyMUV6tOGJnfOsXHLzImqEd7d9JOsYry0KxBGMZ1xLh6v8RQrlFCTQbkJ4AlLezFKFyiwynG2dKxYSqPremnktBCdgf/PPsWvV4WNyxLsyuPLNLv3OZ5Ky9CUj0N/lXFVa1iQ60VYWC1sHbgr4+5OxNwr6keR9SNPX05yQr4PureltVE63bVXZ5X/FIL4y9B+hOuo0e3GS5lhEuQlm8ph40QmS3obe91xf9nHtBpMB68PZzpdCO3sWhKoURMAwgQPQ18HGa6VeGy7XAv0d+Px4PQx8tewJJjbET67LcDc20J4dfgZTcBO7fOA/bM3ED6RmQxAClKgtBP/c/yAqS6SHl37FdXOY0xdWlfqnCYCr3azCdGVqJA8W4ldHTHYZphdU5hetAxegvdyjLIZfsNkKtgFE
+  template:
+    metadata:
+      creationTimestamp: null
+      name: consentimento-selo
+      namespace: demo-prod
diff --git a/tenants/demo/65-runtime-core.yaml b/tenants/demo/65-runtime-core.yaml
new file mode 100644
index 0000000..473536e
--- /dev/null
+++ b/tenants/demo/65-runtime-core.yaml
@@ -0,0 +1,86 @@
+# P4.3-P4.9 — runtime-core do demo. GERADO por scripts/consolidar_demo.py a partir
+# da uniao do ambiente dos servicos que ele absorve. Nao edite a mao sem rodar o
+# --check de novo.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: runtime-core
+  namespace: demo-prod
+  labels:
+    app: runtime-core
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: runtime-core
+  template:
+    metadata:
+      labels:
+        app: runtime-core
+        athleticmap.io/contexto: runtime-core
+    spec:
+      containers:
+      - name: runtime-core
+        image: docker.io/library/runtime-core:1.1-demo
+        imagePullPolicy: Never
+        ports:
+        - containerPort: 8083
+        env:
+        - name: SPRING_DATASOURCE_URL
+          value: jdbc:postgresql://pgbouncer.plataforma-prod.svc.cluster.local:6432/athleticmap_demo
+        - name: SPRING_DATASOURCE_USERNAME
+          value: r_demo
+        - name: SPRING_DATASOURCE_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: db-compartilhado
+              key: password
+        - name: ATM_JWK_SET_URI
+          value: http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs
+        - name: ATM_ISSUER
+          value: https://auth-demo.athleticmap.influxdigital.com.br/realms/athleticmap
+        - name: ATM_TENANT
+          value: demo
+        - name: ATM_KC_ADMIN_ENABLED
+          value: 'true'
+        - name: ATM_KC_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: kc-admin-secret
+              key: client-secret
+        - name: SPRING_DATASOURCE_HIKARI_MAXIMUM_POOL_SIZE
+          value: '10'
+        resources:
+          requests:
+            cpu: 100m
+            memory: 384Mi
+          limits:
+            cpu: '1'
+            memory: 768Mi
+        readinessProbe:
+          httpGet:
+            path: /actuator/health/readiness
+            port: 8083
+          initialDelaySeconds: 25
+          periodSeconds: 10
+          failureThreshold: 30
+        livenessProbe:
+          httpGet:
+            path: /actuator/health/liveness
+            port: 8083
+          initialDelaySeconds: 90
+          periodSeconds: 20
+          failureThreshold: 6
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: runtime-core
+  namespace: demo-prod
+spec:
+  selector:
+    app: runtime-core
+  ports:
+  - name: http
+    port: 80
+    targetPort: 8083
diff --git a/tenants/demo/66-runtime-operacao.yaml b/tenants/demo/66-runtime-operacao.yaml
new file mode 100644
index 0000000..33daa83
--- /dev/null
+++ b/tenants/demo/66-runtime-operacao.yaml
@@ -0,0 +1,84 @@
+# P4.3-P4.9 — runtime-operacao do demo. GERADO por scripts/consolidar_demo.py a partir
+# da uniao do ambiente dos servicos que ele absorve. Nao edite a mao sem rodar o
+# --check de novo.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: runtime-operacao
+  namespace: demo-prod
+  labels:
+    app: runtime-operacao
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: runtime-operacao
+  template:
+    metadata:
+      labels:
+        app: runtime-operacao
+        athleticmap.io/contexto: runtime-operacao
+    spec:
+      containers:
+      - name: runtime-operacao
+        image: docker.io/library/runtime-operacao:1.1-demo
+        imagePullPolicy: Never
+        ports:
+        - containerPort: 8083
+        env:
+        - name: SPRING_DATASOURCE_URL
+          value: jdbc:postgresql://pgbouncer.plataforma-prod.svc.cluster.local:6432/athleticmap_demo
+        - name: SPRING_DATASOURCE_USERNAME
+          value: r_demo
+        - name: SPRING_DATASOURCE_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: db-compartilhado
+              key: password
+        - name: ATM_JWK_SET_URI
+          value: http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs
+        - name: ATM_ISSUER
+          value: https://auth-demo.athleticmap.influxdigital.com.br/realms/athleticmap
+        - name: ATM_TENANT
+          value: demo
+        - name: ATM_CONSENTIMENTO_SEGREDO
+          valueFrom:
+            secretKeyRef:
+              name: consentimento-selo
+              key: segredo
+        - name: SPRING_DATASOURCE_HIKARI_MAXIMUM_POOL_SIZE
+          value: '10'
+        resources:
+          requests:
+            cpu: 100m
+            memory: 384Mi
+          limits:
+            cpu: '1'
+            memory: 768Mi
+        readinessProbe:
+          httpGet:
+            path: /actuator/health/readiness
+            port: 8083
+          initialDelaySeconds: 25
+          periodSeconds: 10
+          failureThreshold: 30
+        livenessProbe:
+          httpGet:
+            path: /actuator/health/liveness
+            port: 8083
+          initialDelaySeconds: 90
+          periodSeconds: 20
+          failureThreshold: 6
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: runtime-operacao
+  namespace: demo-prod
+spec:
+  selector:
+    app: runtime-operacao
+  ports:
+  - name: http
+    port: 80
+    targetPort: 8083
diff --git a/tenants/demo/67-runtime-saude.yaml b/tenants/demo/67-runtime-saude.yaml
new file mode 100644
index 0000000..930accc
--- /dev/null
+++ b/tenants/demo/67-runtime-saude.yaml
@@ -0,0 +1,95 @@
+# P4.3-P4.9 — runtime-saude do demo. GERADO por scripts/consolidar_demo.py a partir
+# da uniao do ambiente dos servicos que ele absorve. Nao edite a mao sem rodar o
+# --check de novo.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: runtime-saude
+  namespace: demo-prod
+  labels:
+    app: runtime-saude
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: runtime-saude
+  template:
+    metadata:
+      labels:
+        app: runtime-saude
+        athleticmap.io/contexto: runtime-saude
+    spec:
+      containers:
+      - name: runtime-saude
+        image: docker.io/library/runtime-saude:1.1-demo
+        imagePullPolicy: Never
+        ports:
+        - containerPort: 8083
+        env:
+        - name: SPRING_DATASOURCE_URL
+          value: jdbc:postgresql://pgbouncer.plataforma-prod.svc.cluster.local:6432/athleticmap_demo
+        - name: SPRING_DATASOURCE_USERNAME
+          value: r_demo
+        - name: SPRING_DATASOURCE_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: db-compartilhado
+              key: password
+        - name: ATM_JWK_SET_URI
+          value: http://keycloak:8080/realms/athleticmap/protocol/openid-connect/certs
+        - name: ATM_ISSUER
+          value: https://auth-demo.athleticmap.influxdigital.com.br/realms/athleticmap
+        - name: ATM_TENANT
+          value: demo
+        - name: GARMIN_REDIRECT_URI
+          value: https://demo.athleticmap.influxdigital.com.br/api/public/integrations/garmin/callback
+        - name: GARMIN_FRONTEND_REDIRECT
+          value: https://demo.athleticmap.influxdigital.com.br/integracoes/garmin
+        - name: GARMIN_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              name: garmin-oauth
+              key: GARMIN_CLIENT_ID
+        - name: GARMIN_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: garmin-oauth
+              key: GARMIN_CLIENT_SECRET
+        - name: ATM_AUDITORIA_RETENCAO_DIAS
+          value: '730'
+        - name: SPRING_DATASOURCE_HIKARI_MAXIMUM_POOL_SIZE
+          value: '10'
+        resources:
+          requests:
+            cpu: 100m
+            memory: 384Mi
+          limits:
+            cpu: '1'
+            memory: 768Mi
+        readinessProbe:
+          httpGet:
+            path: /actuator/health/readiness
+            port: 8083
+          initialDelaySeconds: 25
+          periodSeconds: 10
+          failureThreshold: 30
+        livenessProbe:
+          httpGet:
+            path: /actuator/health/liveness
+            port: 8083
+          initialDelaySeconds: 90
+          periodSeconds: 20
+          failureThreshold: 6
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: runtime-saude
+  namespace: demo-prod
+spec:
+  selector:
+    app: runtime-saude
+  ports:
+  - name: http
+    port: 80
+    targetPort: 8083