Stabilize AI Workspace Ops entitlements

README.md

@@ -28,6 +28,7 @@ All writes go through NODE.DC Agent Gateway, are scoped by agent grants, and are
 - Opaque agent tokens are generated once and stored only as SHA-256 hashes.
 - Authenticated agent-session endpoint returns effective grants/scopes for future MCP calls.
 - Agent setup endpoint returns an MCP config template and AGENTS.md instruction pack without echoing the raw token.
+- Internal AI Workspace entitlement endpoint issues short-lived run tokens and returns a dynamic Ops MCP server profile for the Platform run profile.
 - Product tool endpoints validate agent token, scopes, and project grants before calling Tasker internal adapter.
 - MCP JSON-RPC endpoint `/mcp` exposes the same tool runtime as REST product endpoints.
 - Write tools require idempotency keys and replay successful duplicate requests without creating duplicate Tasker writes.
@@ -100,6 +101,38 @@ curl http://127.0.0.1:4100/api/internal/v1/owners/<owner-user-id>/agents \
 
 The internal API verifies the owner path against the stored agent owner before returning agent detail, grants, tokens, setup packets, or revoke responses.
 
+Issue an AI Workspace entitlement for a Codex run:
+
+```bash
+curl -X POST http://127.0.0.1:4100/api/internal/v1/ai-workspace/entitlements \
+  -H "Authorization: Bearer $NODEDC_AGENT_GATEWAY_INTERNAL_TOKEN" \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "schemaVersion":"ai-workspace.entitlement-request.v1",
+    "appId":"ops",
+    "owner":{"userId":"local-user","email":"local@example.test"},
+    "runContext":{"ops":{"workspaceSlug":"nodedc","projectId":"<project-id>"}}
+  }'
+```
+
+The response uses the AI Workspace adapter contract and returns `appGrants.ops.mcpServers[]` with a bearer token narrowed to the matching active agent grant(s) for the requested Ops workspace/project. The token expires after `NODEDC_AI_WORKSPACE_RUN_TOKEN_TTL_SECONDS` seconds, is marked as `grant_scope=token`, and the response reports `grantMode=token-scoped-run-grants`. Existing long-lived agent tokens keep the legacy `grant_scope=agent` behavior for manually installed local Codex clients.
+
+Run the same check without issuing a token:
+
+```bash
+curl -X POST http://127.0.0.1:4100/api/internal/v1/ai-workspace/preflight \
+  -H "Authorization: Bearer $NODEDC_AGENT_GATEWAY_INTERNAL_TOKEN" \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "schemaVersion":"ai-workspace.entitlement-request.v1",
+    "appId":"ops",
+    "owner":{"userId":"local-user","email":"local@example.test"},
+    "runContext":{"ops":{"workspaceSlug":"nodedc","projectId":"<project-id>"}}
+  }'
+```
+
+Preflight returns redacted diagnostics: selected agent, matching grants, scopes, `grantMode`, token TTL, and MCP endpoint metadata. It does not create or return a bearer token.
+
 Generate a local Codex setup packet:
 
 ```bash