@@ -203,20 +203,30 @@ kubectl context set to `capstone`.
 
 ### Observing the results
 
-The observability tools run inside the cluster. Port-forward to reach
-them from the host. Fedora ships Cockpit on port 9090, so Prometheus
-uses an alternate local port.
-
-| Tool | Port-forward command | Local URL |
-|------|---------------------|-----------|
-| Grafana | `kubectl port-forward -n capstone svc/grafana 3000:80` | `http://localhost:3000` |
-| Prometheus | `kubectl port-forward -n capstone svc/prometheus-server 9091:80` | `http://localhost:9091` |
-| Kiali | `kubectl port-forward -n istio-system svc/kiali 20001:20001` | `http://localhost:20001/kiali` |
-| Tempo | (via Grafana → Explore → Tempo datasource) | — |
-| OpenMetadata | `kubectl port-forward -n capstone svc/openmetadata 8585:8585` | `http://localhost:8585` |
-
-Grafana default credentials: `admin` / the value from
-`kubectl get secret grafana -n capstone -o jsonpath='{.data.admin-password}' | base64 -d`.
+Bootstrap and the walkthrough automatically start port-forwards for the
+four UI services via `scripts/port-forward-ui.sh`. They survive script
+exit and stay up until you stop them.
+
+| Tool | Local URL | Notes |
+|------|-----------|-------|
+| Grafana | `http://localhost:3000` | |
+| Prometheus | `http://localhost:9091` | Port 9091 avoids Fedora Cockpit on 9090 |
+| Kiali | `http://localhost:20001/kiali` | |
+| Tempo | (via Grafana → Explore → Tempo datasource) | No direct forward needed |
+| OpenMetadata | `http://localhost:8585` | |
+
+```bash
+./scripts/port-forward-ui.sh --status   # check which forwards are alive
+./scripts/port-forward-ui.sh --stop     # tear them all down
+./scripts/port-forward-ui.sh            # restart them
+```
+
+Default credentials:
+
+| Tool | User | Password |
+|------|------|----------|
+| Grafana | `admin` | `capstone` |
+| OpenMetadata | `admin@open-metadata.org` | `admin` |
 
 ## Restoring baseline
 
 
@@ -141,21 +141,15 @@ run_act() {
 }
 
 # ─── Cleanup ─────────────────────────────────────────────────────────────────
-# Two acts start background port-forwards: trace (to graphql-gateway, while the
-# query is in flight) and topology (to Kiali, kept open through the discussion).
-# Tear them down on exit no matter how we got there (Ctrl-C, normal exit,
-# failure).
-KIALI_PF=""
+# The trace act starts a temporary port-forward to graphql-gateway; tear it
+# down on exit. Persistent UI forwards (Grafana, Kiali, etc.) are managed
+# by port-forward-ui.sh and survive this script.
 TRACE_PF=""
 cleanup() {
     if [[ -n "$TRACE_PF" ]] && kill -0 "$TRACE_PF" 2>/dev/null; then
         printf '\n%s  cleaning up trace port-forward (pid %s)%s\n' "$DIM" "$TRACE_PF" "$RST"
         kill "$TRACE_PF" 2>/dev/null || true
     fi
-    if [[ -n "$KIALI_PF" ]] && kill -0 "$KIALI_PF" 2>/dev/null; then
-        printf '\n%s  cleaning up Kiali port-forward (pid %s)%s\n' "$DIM" "$KIALI_PF" "$RST"
-        kill "$KIALI_PF" 2>/dev/null || true
-    fi
 }
 trap cleanup EXIT
 trap 'printf "\n%sinterrupted%s\n" "$RED" "$RST"; exit 130' INT
@@ -275,6 +269,11 @@ ${BOLD}${BLU}╔═════════════════════
 INTRO
 
 (( PREFLIGHT == 1 )) && preflight
+
+# Start persistent UI port-forwards (Grafana, Prometheus, Kiali, OpenMetadata)
+# so the dashboards are available throughout the walkthrough.
+./scripts/port-forward-ui.sh
+
 prompt_enter "press Enter to start"
 
 # ─── ACT 1 · TRACE ───────────────────────────────────────────────────────────
@@ -402,6 +401,16 @@ if want_act scale; then
 fi
 
 # ─── ACT 3 · CANARY ──────────────────────────────────────────────────────────
+# Guard: ensure order-service v1 is deployed — earlier demos (demo-order.sh,
+# demo-discovery.sh) uninstall it on success (CAP-008), and the canary act
+# needs it as the v1 baseline.
+if want_act canary; then
+    if ! kubectl get deployment order-service -n "$NS" >/dev/null 2>&1; then
+        info "order-service not deployed — restoring for canary act"
+        helm upgrade --install order-service charts/capstone/charts/order-service -n "$NS" >/dev/null
+        kubectl rollout status deploy/order-service -n "$NS" --timeout=120s >/dev/null
+    fi
+fi
 
 if want_act canary; then
     act_header "canary" "Canary a contract — v1 → v2, by weight" \
@@ -449,20 +458,8 @@ if want_act topology; then
     prompt_enter "press Enter to verify Kiali"
     run_act "topology (smoke)" ./demos/demo-kiali.sh || exit 1
 
-    narrate "now opening a port-forward to Kiali for you to show in the browser"
+    narrate "Kiali is already port-forwarded (port-forward-ui.sh)"
     info "  http://localhost:20001/kiali   (Graph → namespace: capstone)"
-    info "  the port-forward stays open until this script exits (Ctrl-C or end of walkthrough)"
-    # background port-forward; cleanup trap kills it on any exit
-    kubectl port-forward -n "$ISTIO_SYSTEM" svc/kiali 20001:20001 >/dev/null 2>&1 &
-    KIALI_PF=$!
-    # give it a couple seconds to bind, then probe
-    for _ in 1 2 3 4 5 6 7 8 9 10; do
-        if curl -fsS http://127.0.0.1:20001/kiali/healthz >/dev/null 2>&1; then
-            printf '%s    ✓ Kiali port-forward live at http://localhost:20001/kiali%s\n' "$GRN" "$RST"
-            break
-        fi
-        sleep 1
-    done
 
     narrate "to make EDGES appear in the graph, generate some traffic:"
     info "  in another shell:  for i in {1..40}; do ./demos/demo-trace-flow.sh >/dev/null; done"
@@ -476,8 +473,5 @@ printf '\n%s%s══════════════════════
 printf '%s%s  walkthrough complete  ·  %d / %d acts run%s\n' "$BOLD" "$GRN" "$ACT_NUM" "$ACT_TOTAL" "$RST"
 printf '%s%s═══════════════════════════════════════════════════════════════════════%s\n\n' "$BOLD" "$GRN" "$RST"
 
-if want_act topology && [[ -n "$KIALI_PF" ]] && kill -0 "$KIALI_PF" 2>/dev/null; then
-    printf '%s  Kiali port-forward is still up (pid %s) — http://localhost:20001/kiali%s\n' "$DIM" "$KIALI_PF" "$RST"
-    printf '%s  press Enter to tear it down and exit, or Ctrl-C to keep the script alive until you do%s\n\n' "$DIM" "$RST"
-    prompt_enter "press Enter to exit"
-fi
+printf '%s  UI port-forwards remain active (Grafana :3000, Prometheus :9091, Kiali :20001, OpenMetadata :8585)%s\n' "$DIM" "$RST"
+printf '%s  stop them with: ./scripts/port-forward-ui.sh --stop%s\n' "$DIM" "$RST"
@@ -159,11 +159,21 @@ ok "catalog populated and lineage declared"
 step "Cluster status"
 bash ./scripts/cluster-status.sh || true
 
+step "UI port-forwards (Grafana, Prometheus, Kiali, OpenMetadata)"
+./scripts/port-forward-ui.sh
+
 step "Bring-up complete — the cluster is walkthrough-ready."
 cat <<EOF
     # The five-act presenter walkthrough (the deck's "What you can see it do"):
     ./demos/walkthrough.sh
 
+    # UI dashboards (port-forwards started automatically):
+    #   Grafana        http://localhost:3000
+    #   Prometheus     http://localhost:9091
+    #   Kiali          http://localhost:20001/kiali
+    #   OpenMetadata   http://localhost:8585
+    #   Stop them:     ./scripts/port-forward-ui.sh --stop
+
     # Other things you can do from here:
     ./demos/demo-discovery.sh             # publish OpenAPI/proto/SDL to Apicurio
     ./demos/demo-canary.sh up 90 10        # the v1->v2 contract canary (Phase B)
 
@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+#
+# port-forward-ui.sh — start (or stop) persistent background port-forwards
+# for the four capstone UI services so they're reachable from the host
+# immediately after bootstrap, without manual kubectl commands.
+#
+# The forwards are designed to outlive this script (no cleanup trap). PIDs
+# are written to a pidfile so --stop can clean them up later.
+#
+# Usage:
+#   ./scripts/port-forward-ui.sh            # start all four forwards
+#   ./scripts/port-forward-ui.sh --stop     # kill all forwards
+#   ./scripts/port-forward-ui.sh --status   # show which are alive
+
+set -uo pipefail
+
+PIDFILE="/tmp/capstone-ui-pf.pids"
+
+BOLD=""; GRN=""; DIM=""; RST=""
+if [[ -t 1 ]]; then
+    BOLD=$'\033[1m'; GRN=$'\033[32m'; DIM=$'\033[2m'; RST=$'\033[0m'
+fi
+
+ok()   { printf '    %s✓%s %s\n' "$GRN" "$RST" "$1"; }
+info() { printf '    %s%s%s\n' "$DIM" "$1" "$RST"; }
+
+# ── --stop ───────────────────────────────────────────────────────────────────
+
+do_stop() {
+    if [[ ! -f "$PIDFILE" ]]; then
+        info "no pidfile — nothing to stop"
+        return 0
+    fi
+    local killed=0
+    while IFS='|' read -r pid label _ ; do
+        if kill -0 "$pid" 2>/dev/null; then
+            kill "$pid" 2>/dev/null && killed=$((killed + 1))
+            info "stopped $label (pid $pid)"
+        fi
+    done < "$PIDFILE"
+    rm -f "$PIDFILE"
+    info "stopped $killed forward(s)"
+}
+
+# ── --status ─────────────────────────────────────────────────────────────────
+
+do_status() {
+    if [[ ! -f "$PIDFILE" ]]; then
+        info "no pidfile — no forwards tracked"
+        return 0
+    fi
+    while IFS='|' read -r pid label url ; do
+        if kill -0 "$pid" 2>/dev/null; then
+            printf '    %s✓%s %-16s  %s  (pid %s)\n' "$GRN" "$RST" "$label" "$url" "$pid"
+        else
+            printf '    ✗ %-16s  dead (pid %s)\n' "$label" "$pid"
+        fi
+    done < "$PIDFILE"
+}
+
+# ── args ─────────────────────────────────────────────────────────────────────
+
+case "${1:-start}" in
+    --stop)   do_stop;   exit 0 ;;
+    --status) do_status; exit 0 ;;
+    start|--start) ;;
+    --help|-h)
+        printf 'Usage: %s [--stop | --status | --help]\n' "$(basename "$0")"
+        exit 0 ;;
+    *) printf 'unknown flag: %s\n' "$1"; exit 2 ;;
+esac
+
+# ── start ────────────────────────────────────────────────────────────────────
+# Each entry: label | namespace | service | local_port | remote_port | url
+
+FORWARDS=(
+    "Grafana|observability|grafana|3000|80|http://localhost:3000"
+    "Prometheus|observability|prometheus-server|9091|80|http://localhost:9091"
+    "Kiali|istio-system|kiali|20001|20001|http://localhost:20001/kiali"
+    "OpenMetadata|capstone|openmetadata|8585|8585|http://localhost:8585"
+)
+
+port_in_use() {
+    local port="$1"
+    ss -tlnp 2>/dev/null | grep -q ":${port} " && return 0
+    return 1
+}
+
+# kill any stale forwards from a previous run before starting fresh
+[[ -f "$PIDFILE" ]] && do_stop >/dev/null 2>&1
+: > "$PIDFILE"
+
+started=0
+for entry in "${FORWARDS[@]}"; do
+    IFS='|' read -r label ns svc local_port remote_port url <<< "$entry"
+
+    if port_in_use "$local_port"; then
+        info "$label: port $local_port already bound (skipped)"
+        continue
+    fi
+
+    if ! kubectl get svc "$svc" -n "$ns" >/dev/null 2>&1; then
+        info "$label: svc/$svc not found in $ns (skipped)"
+        continue
+    fi
+
+    kubectl port-forward -n "$ns" "svc/$svc" "${local_port}:${remote_port}" >/dev/null 2>&1 &
+    pf_pid=$!
+    printf '%s|%s|%s\n' "$pf_pid" "$label" "$url" >> "$PIDFILE"
+    started=$((started + 1))
+done
+
+# brief pause to let the forwards bind
+sleep 1
+
+printf '\n'
+printf '    %s%-16s  %-40s  %s%s\n' "$BOLD" "Service" "URL" "Status" "$RST"
+printf '    %-16s  %-40s  %s\n' "───────────────" "────────────────────────────────────────" "──────"
+while IFS='|' read -r pid label url ; do
+    if kill -0 "$pid" 2>/dev/null; then
+        printf '    %s✓%s %-14s  %-40s  %slive%s\n' "$GRN" "$RST" "$label" "$url" "$GRN" "$RST"
+    else
+        printf '    ✗ %-14s  %-40s  failed\n' "$label" "$url"
+    fi
+done < "$PIDFILE"
+printf '\n'
+
+ok "$started UI port-forward(s) started (pidfile: $PIDFILE)"
+info "Grafana login:      admin / capstone"
+info "OpenMetadata login:  admin@open-metadata.org / admin"
+info "stop with: ./scripts/port-forward-ui.sh --stop"
@@ -15,6 +15,9 @@ if [[ "${1:-}" == "--remove-profile" ]]; then
     REMOVE=1
 fi
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+"$SCRIPT_DIR/port-forward-ui.sh" --stop 2>/dev/null || true
+
 if ! minikube status -p "$PROFILE_NAME" >/dev/null 2>&1; then
     printf '==> Profile %s is not present. Nothing to do.\n' "$PROFILE_NAME"
     exit 0