v1.6.3 - CUE_CORE_URL env + Docker-secrets Pawly token

v1.6.3 (2026-07-05)

Fixed

• CUE_CORE_URL env wiring (__main__.py + Dockerfile)
  • --a2a-url default now reads $CUE_CORE_URL (same pattern as $CUE_DOCTOR_A2A_URL)
  • Dockerfile CMD no longer hardcodes agentwire-core:18800
  • docker-compose.yml pins CUE_CORE_URL=http://127.0.0.1:18800 for the host-network layout
• Pawly per-peer token via Docker secrets (commit ce890ae)
  • Previously released commit f8fbfeb hardcoded a real Pawly A2A token as a literal env var in docker-compose.yml. That mishap is superseded by ce890aec, which switches to the established secrets-file pattern:
    • secrets/pawly-a2a-token.txt (chmod 600, gitignored) mounted at /run/secrets/pawly-a2a-token.txt
    • docker-compose.yml exports PAWLY_A2A_TOKEN_FILE=<path> only
    • examples/owner-alert/cue.yaml alias uses token_file so HistoryClient._resolve_peer_token reads the file

Required operator actions

• Rotate the Pawly A2A token server-side. The literal value still appears in commit f8fbfeb (which is a parent of ce890aec); treat that token as compromised even though this repo is private.
• Update secrets/pawly-a2a-token.txt (chmod 600) with the new token, then docker compose up -d to mount it.

Verification

• 338 passed / 6 skipped — no regression vs v1.6.2 baseline
• After docker compose up -d agentwire-cue: zero history_change ... poll failed log lines across multiple 15-second cycles

Image

agentwire-cue:v1.6.3 (rebuild required)