feat: update token exchange app after fixes

[cowan-macady]

implement ENG-8488

update token exchange app after fixes in agent-gateway service

[deepsource-io]

DeepSource Code Review

We reviewed changes in 84ea2db...1d83ada on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Secrets		Aug 28, 2026 5:30p.m.	Review ↗
Python		Aug 28, 2026 5:30p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[Copilot]

Pull request overview

Updates the token-exchange demo and the instant-stack provisioning app to support token-service mode (multi-hop X-IK-Token delegation chains), and adds a new canbank-ts dataset that includes multiple Token Introspect configs with env-substituted values.

Changes:

• Add multi-config Token Introspect support in instant-stack (UI tabs, provisioning steps, per-config .env ID keys, and ${ENV_VAR} placeholder resolution).
• Introduce the new instant-stack/data/canbank-ts dataset (manifest + nodes + relationships) for token-service mode demos.
• Update the a2a/iag-token-exchange stack for token-service mode (gateway pin/healthchecks, docker-compose env blocks, audit UI vocabulary, and agent audit reporting).

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
instant-stack/templates/token_introspect/create_form.html	Adds multi-config selector UI and posts env_key through the form.
instant-stack/api/token_introspect.py	Supports selecting nth token-introspect config via ?index=, and saves IDs under per-config env keys.
instant-stack/api/provision.py	Generates one provisioning step per token-introspect config and passes env_key.
instant-stack/api/_dataset.py	Treats token_introspect as list-or-singleton and resolves ${ENV_VAR} placeholders.
instant-stack/api/project.py	Preserves TOKEN_SERVICE_PUBLIC_JWK across .env cleanup.
instant-stack/.env.example	Documents TOKEN_SERVICE_PUBLIC_JWK used by canbank-ts placeholder substitution.
instant-stack/data/canbank-ts/manifest.json	New dataset manifest including token-service-mode Token Introspect entries and MCP server config.
instant-stack/data/canbank-ts/nodes.json	New dataset node graph for CanBank token-service demo.
instant-stack/data/canbank-ts/relationships.json	New dataset relationship graph for CanBank token-service demo.
a2a/iag-token-exchange/iag-base-docker.yaml	Pins gateway version and disables baked-in healthcheck that would mark services unhealthy.
a2a/iag-token-exchange/docker-compose.yaml	Enables token-service mode across gateways and adds token-service healthcheck.
a2a/iag-token-exchange/.example.env	Updates token-service environment documentation to match new deployment behavior.
a2a/iag-token-exchange/token-service/token-service.example.yaml	Updates token-service config format to map-based configurations.
a2a/iag-token-exchange/token-service/README.md	Documents platform/server version requirements for token-service mode and MCP acceptance.
a2a/iag-token-exchange/README.md	Updates gateway pin and clarifies token-service-mode requirements and rollout notes.
a2a/iag-token-exchange/chatbot/static/styles.css	Adds styling for token-service decision types (introspection/exchange refusals).
a2a/iag-token-exchange/chatbot/static/index.html	Expands audit badge labeling to handle token-service decision vocabulary.
a2a/iag-token-exchange/orchestrator_agent/orchestrator_agent.py	Reports delegated token (when present) to audit terminal for token-service mode.
a2a/iag-token-exchange/retriever_agent/retriever_agent.py	Same delegated-token audit reporting adjustment.
a2a/iag-token-exchange/weather_agent/weather_agent.py	Same delegated-token audit reporting adjustment.
a2a/iag-token-exchange/analyst_agent/analyst_agent.py	Same delegated-token audit reporting adjustment.

Suppressed comments (2)

instant-stack/data/canbank-ts/nodes.json:695

• The SharePoint URL domain is misspelled as miscrosoft.com, which will break the link in the demo UI/data.

        },
        {
          "type": "url",
          "value": "https://sharepoint.miscrosoft.com/canbank/site/csr/kyc_policy.pdf",
          "metadata": {
            "source": "Sharepoint"

instant-stack/data/canbank-ts/nodes.json:669

• The SharePoint URL domain is misspelled as miscrosoft.com, which will break the link in the demo UI/data.

        },
        {
          "type": "url",
          "value": "https://sharepoint.miscrosoft.com/canbank/site/csr/discount_policy.pdf",
          "metadata": {
            "source": "Sharepoint"

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chahalarora]

_resolve_env_placeholders only does regex .sub() on strings, so TOKEN_SERVICE_PUBLIC_JWK gets substituted into offline_validation.public_jwks as a JSON string instead of a parsed object. The README explicitly requires "raw public JWK JSON" as an object.

[cowan-macady]

The string is intentional: a JSON string is the format the platform actually requires: offline_validation.public_jwks is an array of raw JWK JSON strings, per the platform findings report.