From e11f9bd7e75b8a53b784eb0546e4e8337fa3837b Mon Sep 17 00:00:00 2001 From: Codex Date: Wed, 24 Jun 2026 22:03:44 +0300 Subject: [PATCH] docs: document AI Workspace Engine entitlement adapter --- services/ai-workspace-assistant/README.md | 3 +++ services/ai-workspace-assistant/TEST_MATRIX.md | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/services/ai-workspace-assistant/README.md b/services/ai-workspace-assistant/README.md index dc3762b..2a3b48d 100644 --- a/services/ai-workspace-assistant/README.md +++ b/services/ai-workspace-assistant/README.md @@ -134,6 +134,9 @@ or app-specific variables: AI_WORKSPACE_OPS_ENTITLEMENT_URL=https://ops.example/api/ai-workspace/entitlements AI_WORKSPACE_OPS_ENTITLEMENT_TOKEN=... AI_WORKSPACE_OPS_ENTITLEMENT_REQUIRED=false +AI_WORKSPACE_ENGINE_ENTITLEMENT_URL=https://engine.example/api/ai-workspace/internal/v1/entitlements +AI_WORKSPACE_ENGINE_ENTITLEMENT_TOKEN=... +AI_WORKSPACE_ENGINE_ENTITLEMENT_REQUIRED=false ``` Adapter request body: diff --git a/services/ai-workspace-assistant/TEST_MATRIX.md b/services/ai-workspace-assistant/TEST_MATRIX.md index 9d7358a..5017abb 100644 --- a/services/ai-workspace-assistant/TEST_MATRIX.md +++ b/services/ai-workspace-assistant/TEST_MATRIX.md @@ -155,7 +155,7 @@ Scenarios: - Engine user with Ops read grant opens an Ops-targeted run and can read the target card. - Engine user with Ops write grant creates or updates in the target Ops project. - Engine user without target Ops grant gets preflight denied and no token. -- Ops-origin run can call Engine-side context once the Engine entitlement adapter exists. +- Ops-origin run can call Engine-side context once `AI_WORKSPACE_ENGINE_ENTITLEMENT_URL` points at Engine `/api/ai-workspace/internal/v1/entitlements`. - Admin grants a user a new project permission; new AI Workspace run receives it without reinstalling the agent. - Admin revokes a project permission; new run token loses it and existing source-linked token grants stop resolving through deleted grants.