feat: establish v0.70 platform milestone

internal/orchestration/provider_processing.go

@@ -12,6 +12,7 @@ import (
 
 	"data-terminal-cloud/internal/billing"
 	"data-terminal-cloud/internal/conversation"
+	"data-terminal-cloud/internal/memorytool"
 	"data-terminal-cloud/internal/outbox"
 	"data-terminal-cloud/internal/ratelimit"
 	"data-terminal-cloud/internal/voiceprovider"
@@ -40,6 +41,19 @@ type StartProcessor struct {
 	startLimiter    providerStartRateLimiter
 	maxActiveTasks  int
 	now             func() time.Time
+	memoryTool      *memorytool.TokenSigner
+	memoryToolURL   string
+	memoryToolTTL   time.Duration
+}
+
+func (p *StartProcessor) ConfigureMemoryTool(signer *memorytool.TokenSigner, endpoint string, ttl time.Duration) error {
+	if signer == nil || endpoint == "" || ttl <= 0 {
+		return errors.New("memory tool signer, endpoint and positive token TTL are required")
+	}
+	p.memoryTool = signer
+	p.memoryToolURL = endpoint
+	p.memoryToolTTL = ttl
+	return nil
 }
 
 // ConfigureStartProtection enables the provider-wide RPS bucket and durable
@@ -105,6 +119,13 @@ func (p *StartProcessor) Handle(ctx context.Context, event outbox.Event) error {
 	if taskStatus != "STARTING" && taskStatus != "UNKNOWN" {
 		return fmt.Errorf("provider task status %s cannot be started", taskStatus)
 	}
+	if request.EngineMode == "s2s_hybrid" && p.memoryTool != nil {
+		request.MemoryToolURL = p.memoryToolURL
+		request.MemoryToolToken, err = p.memoryTool.Issue(request.ConversationID, request.TaskRef, p.now().UTC().Add(p.memoryToolTTL))
+		if err != nil {
+			return fmt.Errorf("issue memory tool token: %w", err)
+		}
+	}
 	allowed, err := p.health.AllowStart(ctx, tenantID, providerName)
 	if err != nil {
 		return fmt.Errorf("read provider health: %w", err)