sequenceDiagram
    participant Client as Client<br/>(Dashboard / SDK)
    participant API as eval-hub API<br/>8080/TCP HTTPS
    participant K8sAPI as Kubernetes API<br/>443/TCP HTTPS
    participant PG as PostgreSQL<br/>5432/TCP
    participant MLflow as MLflow Tracking<br/>5000/TCP HTTPS
    participant S3 as AWS S3<br/>443/TCP HTTPS
    participant Adapter as Framework Adapter<br/>(eval job pod)
    participant Sidecar as eval-runtime-sidecar<br/>8080/TCP HTTP (localhost)
    participant OCI as OCI Registry<br/>443/TCP HTTPS

    Note over Client,OCI: Flow 1: Create and Run Evaluation Job

    Client->>API: POST /api/v1/evaluations/jobs<br/>Auth: Bearer Token (K8s SA)<br/>TLS 1.2+
    API->>K8sAPI: TokenReview + SubjectAccessReview<br/>Auth: SA Token, TLS 1.2+
    K8sAPI-->>API: Authenticated & Authorized

    API->>PG: INSERT evaluation record<br/>SQL, Password auth
    PG-->>API: Stored

    API->>MLflow: Create experiment<br/>Auth: Bearer Token, TLS 1.2+
    MLflow-->>API: Experiment ID

    API->>K8sAPI: Create ConfigMap (job spec + sidecar config)<br/>Auth: SA Token, TLS 1.2+
    API->>K8sAPI: Create batch/v1 Job<br/>(init + sidecar + adapter containers)<br/>Auth: SA Token, TLS 1.2+
    K8sAPI-->>API: Job created

    API-->>Client: 201 Created (job ID)

    Note over S3,Adapter: Init Container Phase (if test data configured)

    S3->>Adapter: eval-runtime-init downloads test data<br/>Auth: AWS IAM, TLS 1.2+

    Note over Adapter,OCI: Evaluation Execution Phase

    Adapter->>Sidecar: POST /api/v1/evaluations/jobs/{id}/events<br/>HTTP plaintext (pod-local), No auth

    Note over Sidecar,API: Flow 2: Sidecar Auth Token Resolution
    Sidecar->>Sidecar: Read SA token from<br/>/var/run/secrets/.../token
    Sidecar->>API: Forward request<br/>Auth: Bearer Token (from SA token file)<br/>HTTPS 8443/TCP, TLS 1.2+
    API->>PG: Update job status
    API-->>Sidecar: 200 OK
    Sidecar-->>Adapter: 200 OK

    Adapter->>Sidecar: POST /api/2.0/mlflow/runs/log-metric<br/>HTTP plaintext (pod-local)
    Sidecar->>Sidecar: Read projected SA token from<br/>/var/run/secrets/mlflow/token
    Sidecar->>MLflow: Forward to MLflow Tracking<br/>Auth: Projected SA Token<br/>HTTPS, TLS 1.2+
    MLflow-->>Sidecar: 200 OK
    Sidecar-->>Adapter: 200 OK

    Adapter->>Sidecar: PUT /v2/{repo}/blobs/uploads<br/>HTTP plaintext (pod-local)
    Sidecar->>OCI: OCI auth challenge flow<br/>Auth: Bearer Token (Docker config.json)<br/>HTTPS 443/TCP, TLS 1.2+
    OCI-->>Sidecar: 201 Created
    Sidecar-->>Adapter: 201 Created

    Note over Client,API: Job Completion

    Client->>API: GET /api/v1/evaluations/jobs/{id}<br/>Auth: Bearer Token
    API->>PG: SELECT evaluation record
    PG-->>API: Job status + results
    API-->>Client: 200 OK (job details)
