API - CODEX AGENTS: secure owner lifecycle endpoints

README.md

@@ -24,6 +24,7 @@ All writes go through NODE.DC Agent Gateway, are scoped by agent grants, and are
 - Fastify service with `/healthz`, `/readyz`, and capability metadata.
 - Postgres migrations for agents, grants, token hashes, pairing codes, audit events, and idempotency keys.
 - Internal REST endpoints for agent profile, grant, and token lifecycle.
+- Lifecycle endpoints are protected by `NODEDC_AGENT_GATEWAY_INTERNAL_TOKEN`; public agent traffic uses only issued agent tokens.
 - Opaque agent tokens are generated once and stored only as SHA-256 hashes.
 - Authenticated agent-session endpoint returns effective grants/scopes for future MCP calls.
 - Agent setup endpoint returns an MCP config template and AGENTS.md instruction pack without echoing the raw token.
@@ -59,6 +60,7 @@ Create a local test agent:
 
 ```bash
 curl -X POST http://127.0.0.1:4100/api/v1/agents \
+  -H "Authorization: Bearer $NODEDC_AGENT_GATEWAY_INTERNAL_TOKEN" \
   -H 'Content-Type: application/json' \
   -d '{"owner_user_id":"local-user","owner_email":"local@example.test","display_name":"Local Codex"}'
 ```
@@ -67,6 +69,7 @@ Create a token and inspect effective agent session:
 
 ```bash
 TOKEN=$(curl -sS -X POST http://127.0.0.1:4100/api/v1/agents/<agent-id>/tokens \
+  -H "Authorization: Bearer $NODEDC_AGENT_GATEWAY_INTERNAL_TOKEN" \
   -H 'Content-Type: application/json' \
   -d '{"name":"Local Codex token"}' | jq -r .token)
 
@@ -74,7 +77,14 @@ curl http://127.0.0.1:4100/api/v1/agent-session \
   -H "Authorization: Bearer $TOKEN"
 ```
 
-Do not expose these lifecycle endpoints publicly before the Launcher/internal auth layer is added.
+Tasker UI should use the owner-scoped internal lifecycle API through its backend proxy:
+
+```bash
+curl http://127.0.0.1:4100/api/internal/v1/owners/<owner-user-id>/agents \
+  -H "Authorization: Bearer $NODEDC_AGENT_GATEWAY_INTERNAL_TOKEN"
+```
+
+The internal API verifies the owner path against the stored agent owner before returning agent detail, grants, tokens, setup packets, or revoke responses.
 
 Generate a local Codex setup packet:
 
@@ -131,6 +141,7 @@ DATABASE_URL='postgres://nodedc_agent_gateway:replace-with-local-postgres-passwo
 NODE_ENV=development \
 LOG_LEVEL=silent \
 NODEDC_TASKER_INTERNAL_URL='http://localhost:8090' \
+NODEDC_AGENT_GATEWAY_INTERNAL_TOKEN='replace-with-gateway-internal-token' \
 NODEDC_INTERNAL_ACCESS_TOKEN="$TOKEN" \
 SMOKE_WORKSPACE_SLUG='nodedc' \
 SMOKE_PROJECT_ID='<project-id>' \