Repository navigation
fix(compose): give the XTM One worker its public URL and accept OpenAEV's internal audience (#166) - #167
Merged
Samuel Hassine (SamuelHassine) merged 2 commits intoSep 29, 2026
Conversation
…EV's internal audience (#166) The worker signed the tokens of background work with XTM One's built-in default issuer, which OpenAEV never trusts. XTM One now also accepts http://xtm-one:4000 as the audience of OpenAEV's tokens, for OpenAEV versions that address them to the internal URL. The README and .env.sample explain the public and internal URLs.
Samuel Hassine (SamuelHassine)
added
the
vibe-coded
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The URL documentation omits required scheme variables and references issue reports instead of the implementation PRs.
Review effort: Balanced
Findings: 2
Open (2)
What changed in this PR
Configures reliable signed communication between XTM One and OpenAEV while documenting public and internal URLs.
Changes:
- Configures the worker’s public URL.
- Accepts OpenAEV’s internal audience.
- Documents URL configuration and troubleshooting.
| File | Description |
|---|---|
docker-compose.yml |
Adds worker URLs and accepted audience. |
.env.sample |
Documents public host identities. |
README.md |
Explains URL roles and troubleshooting. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
OpenAEV registered with XTM One in this stack, but the signed calls between them were refused with 401. The root cause is in the products and is fixed there (XTM-One-Platform/xtm-one#4883, OpenAEV-Platform/openaev#8143); this PR fixes what the stack itself got wrong and documents the URLs, without changing any default.
xtm-one-workergets the sameBASE_URL/FRONTEND_URLasxtm-one. Without it the worker signed the tokens of background work (assignments, autonomous runs) with XTM One's built-in default issuer,https://copilot.filigran.ai, which OpenAEV can never trust.xtm-onesetsXTM_AUTH_ACCEPTED_AUDIENCES=http://xtm-one:4000: OpenAEV versions that predate fix(xtm-one): trust and address XTM One by its published identity when it is reached on an internal URL (#8142) openaev#8143 address their tokens toOPENAEV_XTM_ONE_URL, and XTM One accepts that as its own audience once told so. XTM One images that predate the variable ignore it..env.sampleexplain which URL users open, which one each product signs with, and which one the containers use.localhostdefaults, ports and service names are unchanged.Test plan
docker compose -f docker-compose.yml --env-file .env.sample config -q.docker compose up, then an Ask Ariane question that reads OpenAEV data, and an autonomous run (worker path and callbacks).Closes #166