fix(compose): give the XTM One worker its public URL and accept the platforms' internal audience (#47)

[Samuel Hassine (SamuelHassine)]

Proposed changes

• xtm-one-worker gets the same BASE_URL / FRONTEND_URL as xtm-one. Without it the worker signed the tokens of background work (assignments, delegated tasks, autonomous runs) with XTM One's built-in default issuer, https://copilot.filigran.ai, which OpenCTI and OpenAEV can never trust.
• xtm-one sets XTM_AUTH_ACCEPTED_AUDIENCES=http://xtm-one:4000: OpenCTI and OpenAEV versions that predate their fix address their tokens to http://xtm-one:4000, and XTM One accepts that as its own audience once told so. XTM One images that predate the variable ignore it.
• README: which URL is public (and the identity each product signs with) and which one the containers use.
• No default, port or service name changes. Same fix as fix(compose): give the XTM One worker its public URL and accept OpenCTI's internal audience (#614) OpenCTI-Platform/docker#615 and fix(compose): give the XTM One worker its public URL and accept OpenAEV's internal audience (#166) OpenAEV-Platform/docker#167.

Related issues

• Closes fix(compose): give the XTM One worker its public URL and accept the platforms' internal audience #47
• Product fixes: XTM-One-Platform/xtm-one#4883, fix(xtm-one): trust and address XTM One by its published identity when it is reached on an internal URL (#18564) OpenCTI-Platform/opencti#18585, fix(xtm-one): trust and address XTM One by its published identity when it is reached on an internal URL (#8142) OpenAEV-Platform/openaev#8143

How to test this PR

1. docker compose -f docker-compose.yml --env-file .env.sample config -q (passes).
2. With the product fixes released: docker compose up -d, then an Ask Ariane question on OpenCTI data and on OpenAEV data, and an XTM One assignment that calls OpenCTI (worker path).

Checklist

• The PR title follows the Conventional Commits convention type(scope?): description (#issue)
• I signed my commits
• This PR is linked to an issue
• I consider the submitted work as finished

[Copilot]

Copilot review overview

🟡 Changes recommended

The README links issue reports instead of the required product-fix PRs, making compatible versions unclear.

Review effort: Balanced
Findings: 1

Open (1)

• Link implementation PRs for release compatibility guidance · New

What changed in this PR

Updates Compose authentication URLs so XTM One integrations can trust signed cross-platform requests.

Changes:

• Configures the worker with XTM One’s public URL.
• Accepts the platforms’ internal XTM One audience.
• Documents public versus internal URLs.

File	Description
README.md	Documents URL identities and compatibility requirements.
docker-compose.yml	Adds worker URLs and accepted token audience.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The changes satisfy the linked issue and match the corresponding product-stack fixes.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Link implementation PRs for release compatibility guidance