openspec/changes/secure-modal-klein-endpoint/tasks.md

Tasks: Secure Modal Klein Endpoint

1. Backend Client

• Add KLEIN_MODAL_TOKEN configuration in app.py.
• Send bearer auth to the Modal generation endpoint when configured.
• Send bearer auth to Modal health/status checks when configured.
• Ensure runtime status/setup can show token configured state without exposing the value.

2. Modal Worker

• Read KLEIN_MODAL_TOKEN in modal_workers/klein_image.py.
• Add token validation helper.
• Reject unauthorized POST /generate requests with HTTP 401 when the token is configured.
• Keep requests allowed when the token is not configured.

3. Documentation

• Add KLEIN_MODAL_TOKEN to .env.example.
• Update README Modal setup notes.
• Update runtime setup guidance for the shared token.

4. Verification

• Update scripts/verify.py for auth wiring and redaction.
• Run python scripts\verify.py.
• Run python -m py_compile app.py scripts\verify.py modal_workers\klein_image.py.
• Run git diff --check.