API - CODEX AGENTS: secure owner lifecycle endpoints

docs/THREAT_MODEL.md

@@ -75,6 +75,17 @@ Mitigation:
 - rate limits;
 - optional IP/device binding later.
 
+### Lifecycle API exposure
+
+Risk: an external caller creates agents, grants projects, or mints tokens without going through Launcher/Tasker entitlement.
+
+Mitigation:
+
+- lifecycle routes require `NODEDC_AGENT_GATEWAY_INTERNAL_TOKEN`;
+- owner-scoped routes verify `owner_user_id` against the stored agent owner;
+- external Codex tokens can call only agent-session, setup, tool, and MCP routes;
+- raw agent token is returned only once on token creation.
+
 ### Owner lifecycle bypass
 
 Risk: blocked/annulled user keeps active agent token.