Release the chart as 0.4.0, and let it express the engine token

charts/agent-controller/Chart.lock

@@ -5,6 +5,9 @@ dependencies:
 - name: core-controller
   repository: file://charts/core-controller
   version: 0.1.0
+- name: temporal-engine
+  repository: file://charts/temporal-engine
+  version: 0.1.1
 - name: integration-gateway
   repository: file://charts/integration-gateway
   version: 0.1.0
@@ -14,5 +17,5 @@ dependencies:
 - name: nats
   repository: https://nats-io.github.io/k8s/helm/charts/
   version: 2.14.2
-digest: sha256:328c0678a640e98589cf6f96b28bc82931dffab1dbe78185e078d686dd2dbfc5
-generated: "2026-07-20T06:08:05.149497-07:00"
+digest: sha256:571058ff9cac13b57a9e36b07e9a866cca84904a0411bffde4b556f3ea1cea7b
+generated: "2026-08-06T18:08:32.066566-07:00"

charts/agent-controller/Chart.yaml

@@ -9,7 +9,7 @@ description: >-
   one release. Install the community-components chart afterward to populate
   the catalog with Tool/Skill/Agent CRs.
 type: application
-version: 0.3.0
+version: 0.4.0
 appVersion: "0.1.0"
 home: https://github.com/imaustink/agent-controller
 sources:
@@ -38,13 +38,13 @@ dependencies:
     version: "0.1.0"
     repository: "file://charts/core-controller"
     condition: core-controller.enabled
-  # The Temporal-workflow agent engine (engines/temporal), docs/adr/0036. OFF
-  # by default: agent-orchestrator runs its in-process LangGraph loop unless
-  # AGENT_ENGINE=temporal selects this instead, so enabling the subchart alone
-  # changes no behaviour. Takes a Temporal address rather than bundling a
-  # server, so it adds no stateful component.
+  # The Temporal-workflow agent engine (engines/temporal), docs/adr/0036. ON,
+  # and paired with agent-orchestrator.config.agentEngine=temporal in values --
+  # deploying the subchart is only half the switch, since the orchestrator
+  # picks its loop independently. Takes a Temporal address rather than bundling
+  # a server, so it adds no stateful component.
   - name: temporal-engine
-    version: "0.1.0"
+    version: "0.1.1"
     repository: "file://charts/temporal-engine"
     condition: temporal-engine.enabled
   # GitHub Issues adapter (apps/integration-gateway) -- phase 1 of

charts/agent-controller/charts/agent-orchestrator/templates/deployment.yaml

@@ -78,6 +78,23 @@ spec:
             - name: AGENT_TEMPORAL_ENGINE_URL
               value: {{ .Values.config.temporalEngineUrl | quote }}
             {{- end }}
+            {{- if and .Values.config.agentEngine .Values.secrets.temporalEngineTokenKey }}
+            # Bearer token presented to the engine gateway, which resolves it
+            # to a subject and ROLES against its own static identity map. The
+            # engine re-resolves every skill/agent target under those roles, so
+            # without a token that the gateway recognises it falls closed to
+            # zero capabilities and every turn is denied.
+            #
+            # Optional, because the alternative to a token is the gateway's
+            # defaultSubject/defaultRoles rather than a broken pod — but one of
+            # the two has to be configured for a turn to resolve anything.
+            - name: AGENT_TEMPORAL_ENGINE_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.secrets.existingSecret | default (include "agent-orchestrator.fullname" .) }}
+                  key: {{ .Values.secrets.temporalEngineTokenKey }}
+                  optional: true
+            {{- end }}
             {{- if .Values.config.callerToolTtlSeconds }}
             - name: AGENT_CALLER_TOOL_TTL_SECONDS
               value: {{ .Values.config.callerToolTtlSeconds | quote }}

charts/agent-controller/charts/agent-orchestrator/values.yaml

@@ -205,6 +205,14 @@ secrets:
   # absent from the Secret the orchestrator falls back to trusting the
   # unsigned request-body login and warns at startup.
   senderAssertionSecretKey: AGENT_SENDER_ASSERTION_SECRET
+  # Only used when config.agentEngine is set above. The engine gateway maps
+  # this token to a subject and ROLES, and re-resolves every skill/agent target
+  # under them, so an unrecognised or absent token leaves a turn with no
+  # capabilities. Must match an entry in that gateway's
+  # identity.staticIdentities — or be left out in favour of its
+  # defaultSubject/defaultRoles, which is the other way to give the hop an
+  # identity.
+  temporalEngineTokenKey: AGENT_TEMPORAL_ENGINE_TOKEN
   # Only read when secrets.create=true.
   openaiApiKey: ""
   callbackSecret: ""

charts/agent-controller/charts/temporal-engine/Chart.yaml

@@ -2,12 +2,12 @@ apiVersion: v2
 name: temporal-engine
 description: >-
   The Temporal-workflow agent engine (engines/temporal) — worker, gateway and
-  catalog-sync. Off by default: agent-orchestrator runs its in-process
-  LangGraph loop unless AGENT_ENGINE=temporal selects this instead
-  (docs/adr/0036). Assumes a Temporal cluster is already reachable and takes
-  its address, so enabling this adds no stateful component.
+  catalog-sync. Runs a turn only when agent-orchestrator is also told to use it
+  with AGENT_ENGINE=temporal (docs/adr/0036); deploying this alone leaves the
+  in-process LangGraph loop serving every turn. Assumes a Temporal cluster is
+  already reachable and takes its address, so this adds no stateful component.
 type: application
-version: 0.1.0
+version: 0.1.1
 appVersion: "0.1.0"
 home: https://github.com/imaustink/agent-controller
 sources: