diff --git a/create-commerce-secrets.sh b/create-commerce-secrets.sh
new file mode 100644
index 0000000..eb6d46b
--- /dev/null
+++ b/create-commerce-secrets.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+NAMESPACE="${NAMESPACE:-ecommerce}"
+
+random_secret() {
+  openssl rand -hex 32
+}
+
+read -rp "Usuario PostgreSQL [medusa]: " POSTGRES_USER
+POSTGRES_USER="${POSTGRES_USER:-medusa}"
+
+read -rp "Base de datos PostgreSQL [medusa]: " POSTGRES_DB
+POSTGRES_DB="${POSTGRES_DB:-medusa}"
+
+read -rsp "Contraseña PostgreSQL (vacío = generar): " POSTGRES_PASSWORD
+echo
+POSTGRES_PASSWORD="${POSTGRES_PASSWORD:-$(random_secret)}"
+
+read -rsp "Contraseña Redis (vacío = generar): " REDIS_PASSWORD
+echo
+REDIS_PASSWORD="${REDIS_PASSWORD:-$(random_secret)}"
+
+read -rp "Usuario MinIO [ari-minio]: " MINIO_ROOT_USER
+MINIO_ROOT_USER="${MINIO_ROOT_USER:-ari-minio}"
+
+read -rsp "Contraseña MinIO (vacío = generar): " MINIO_ROOT_PASSWORD
+echo
+MINIO_ROOT_PASSWORD="${MINIO_ROOT_PASSWORD:-$(random_secret)}"
+
+JWT_SECRET="$(random_secret)"
+COOKIE_SECRET="$(random_secret)"
+
+DATABASE_URL="postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres-svc:5432/${POSTGRES_DB}"
+REDIS_URL="redis://:${REDIS_PASSWORD}@redis-svc:6379"
+
+kubectl -n "${NAMESPACE}" create secret generic commerce-secrets \
+  --from-literal=POSTGRES_USER="${POSTGRES_USER}" \
+  --from-literal=POSTGRES_PASSWORD="${POSTGRES_PASSWORD}" \
+  --from-literal=POSTGRES_DB="${POSTGRES_DB}" \
+  --from-literal=DATABASE_URL="${DATABASE_URL}" \
+  --from-literal=REDIS_PASSWORD="${REDIS_PASSWORD}" \
+  --from-literal=REDIS_URL="${REDIS_URL}" \
+  --from-literal=MINIO_ROOT_USER="${MINIO_ROOT_USER}" \
+  --from-literal=MINIO_ROOT_PASSWORD="${MINIO_ROOT_PASSWORD}" \
+  --from-literal=S3_ACCESS_KEY_ID="${MINIO_ROOT_USER}" \
+  --from-literal=S3_SECRET_ACCESS_KEY="${MINIO_ROOT_PASSWORD}" \
+  --from-literal=JWT_SECRET="${JWT_SECRET}" \
+  --from-literal=COOKIE_SECRET="${COOKIE_SECRET}" \
+  --dry-run=client \
+  -o yaml |
+kubectl apply -f -
+
+echo
+echo "Secret commerce-secrets configurado en namespace ${NAMESPACE}."
+echo "No se imprimieron las credenciales."
diff --git a/create-storefront-secret.sh b/create-storefront-secret.sh
new file mode 100644
index 0000000..6b46e2c
--- /dev/null
+++ b/create-storefront-secret.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+NAMESPACE="${NAMESPACE:-ecommerce}"
+
+read -rsp "Pega la Publishable API Key de Medusa: " MEDUSA_PUBLISHABLE_KEY
+echo
+
+if [[ -z "${MEDUSA_PUBLISHABLE_KEY}" ]]; then
+  echo "ERROR: la clave no puede estar vacía."
+  exit 1
+fi
+
+kubectl -n "${NAMESPACE}" create secret generic commerce-storefront \
+  --from-literal=MEDUSA_PUBLISHABLE_KEY="${MEDUSA_PUBLISHABLE_KEY}" \
+  --dry-run=client \
+  -o yaml |
+kubectl apply -f -
+
+unset MEDUSA_PUBLISHABLE_KEY
+
+echo "Secret commerce-storefront configurado."
diff --git a/install-apps-registry.sh b/install-apps-registry.sh
new file mode 100644
index 0000000..390ba2d
--- /dev/null
+++ b/install-apps-registry.sh
@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+PACKAGE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+REPO_ROOT="${1:-$PWD}"
+
+if [[ ! -d "${REPO_ROOT}/.git" ]]; then
+  echo "ERROR: ${REPO_ROOT} no parece ser la raíz de apps-registry."
+  exit 1
+fi
+
+test -f "${REPO_ROOT}/workloads/ecommerce/kustomization.yaml"
+
+BACKUP="${REPO_ROOT}/.phase1-backup-$(date +%Y%m%d-%H%M%S)"
+mkdir -p "${BACKUP}"
+
+cp -a \
+  "${REPO_ROOT}/workloads/ecommerce/kustomization.yaml" \
+  "${BACKUP}/kustomization.yaml"
+
+for file in \
+  "workloads/ecommerce/lib/headless/providers/medusa.ts" \
+  "workloads/ecommerce/next.config.ts"; do
+  if [[ -f "${REPO_ROOT}/${file}" ]]; then
+    mkdir -p "${BACKUP}/$(dirname "${file}")"
+    cp -a "${REPO_ROOT}/${file}" "${BACKUP}/${file}"
+  fi
+done
+
+cp -a \
+  "${PACKAGE_ROOT}/apps-registry/." \
+  "${REPO_ROOT}/"
+
+KUSTOMIZATION="${REPO_ROOT}/workloads/ecommerce/kustomization.yaml"
+
+python3 - "${KUSTOMIZATION}" <<'PY'
+from pathlib import Path
+import sys
+
+path = Path(sys.argv[1])
+text = path.read_text(encoding="utf-8")
+
+if "  - commerce/" not in text:
+    marker = "resources:\n"
+    if marker not in text:
+        raise SystemExit("No se encontró el bloque resources en kustomization.yaml")
+
+    lines = text.splitlines()
+    out = []
+    inserted = False
+
+    for line in lines:
+        if not inserted and line.startswith("patches:"):
+            out.append("  - commerce/")
+            out.append("")
+            inserted = True
+        out.append(line)
+
+    if not inserted:
+        out.append("  - commerce/")
+
+    path.write_text("\n".join(out).rstrip() + "\n", encoding="utf-8")
+PY
+
+echo
+echo "Fase 1 copiada en: ${REPO_ROOT}"
+echo "Respaldo: ${BACKUP}"
+echo
+echo "El frontend NO fue cambiado a Medusa todavía."
+echo "Revisa los cambios con: git status && git diff"
diff --git a/validate-phase1.sh b/validate-phase1.sh
new file mode 100644
index 0000000..b69f69d
--- /dev/null
+++ b/validate-phase1.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+NAMESPACE="${NAMESPACE:-ecommerce}"
+
+echo "== Aplicaciones =="
+kubectl -n argocd get application ecommerce-app ecommerce-governance \
+  -o custom-columns='NAME:.metadata.name,SYNC:.status.sync.status,HEALTH:.status.health.status'
+
+echo
+echo "== Pods =="
+kubectl -n "${NAMESPACE}" get pods -o wide
+
+echo
+echo "== PVC =="
+kubectl -n "${NAMESPACE}" get pvc
+
+echo
+echo "== Servicios =="
+kubectl -n "${NAMESPACE}" get svc \
+  postgres-svc redis-svc minio-svc medusa-svc
+
+echo
+echo "== Health interno =="
+kubectl -n "${NAMESPACE}" run commerce-healthcheck \
+  --image=curlimages/curl:8.12.1 \
+  --restart=Never \
+  --rm -i \
+  --command -- \
+  curl -fsS --max-time 10 http://medusa-svc:9000/health
+
+echo
+echo
+echo "== Health público =="
+curl -fsS --max-time 15 https://commerce.cruzcloud.net/health
+echo