It gets to documenter but QA fails false positive then it gets blocked because it needs to be awaiting_pm_review to be able to merge. It's almost there.

docker-compose.yml

@@ -218,6 +218,13 @@ services:
       ROBOCO_HOST: 0.0.0.0
       ROBOCO_PORT: 8000
       ROBOCO_ENCRYPTION_KEY: ${ROBOCO_ENCRYPTION_KEY:?ROBOCO_ENCRYPTION_KEY is required}
+      # HMAC secret for agent auth tokens. Orchestrator signs tokens
+      # per-agent at spawn; API middleware verifies them. Generate with:
+      #   python -c 'import secrets; print(secrets.token_hex(32))'
+      ROBOCO_AGENT_AUTH_SECRET: ${ROBOCO_AGENT_AUTH_SECRET:?ROBOCO_AGENT_AUTH_SECRET is required}
+      # Set to "true" to require tokens on every API call (fail-closed).
+      # Leave unset/false during rollout so the panel + curl still work.
+      ROBOCO_AGENT_AUTH_REQUIRED: ${ROBOCO_AGENT_AUTH_REQUIRED:-false}
       # Ollama (use container name)
       ROBOCO_LOCAL_LLM_BASE_URL: http://roboco-ollama:11434/v1
       ROBOCO_LOCAL_LLM_MODEL: glm-5:cloud
@@ -245,6 +252,8 @@ services:
       # each spawned agent write structured logs here so we can audit past
       # runs instead of relying on ephemeral `docker logs`.
       - ${ROBOCO_DATA_DIR:-./data}/logs:/data/logs
+      # Per-agent SessionStart briefings (pre-rendered task context)
+      - ${ROBOCO_DATA_DIR:-./data}/briefings:/app/briefings
     depends_on:
       postgres:
         condition: service_healthy