Mobile-friendly REST API for mission control

[jeremyplichta]

Summary

Extend the townhall REST API with endpoints optimized for a thin mobile app.

Revised direction (per Andrew's RAR feedback): The mobile app should be a thin A2A + MCP client, not a custom REST client.

• A2A (Add A2A (Agent-to-Agent) protocol endpoint to townhall #62) handles conversation: "what's happening?", "approve the merge", status updates
• MCP (Expose mission operations as MCP tools #63) handles structured actions: mission.start, mission.approve, mission.pause

What Remains in This Issue

The A2A and MCP protocols cover most of what a mobile app needs, but there are a few convenience endpoints that don't fit neatly into either protocol:

Dashboard Endpoint

GET /api/dashboard

Single call that returns everything the home screen needs:

{
  "town": "mytown",
  "active_missions": 1,
  "total_agents": 3,
  "working_agents": 1,
  "cold_agents": 2,
  "pending_tasks": 2,
  "attention_needed": [
    {
      "type": "approval_needed",
      "mission_id": "xyz",
      "summary": "PR #42 ready for review - merge to main?"
    }
  ],
  "recent_events": [ ... ]
}

This is a read-only aggregation endpoint. It could be an MCP resource (tinytown://dashboard) but a simple GET is more natural for mobile polling.

Authentication

• Bearer token auth (simple, works for personal use)
• Future: OAuth2/OIDC for team use
• Shared auth layer across REST, A2A, and MCP endpoints

Depends On

• Add A2A (Agent-to-Agent) protocol endpoint to townhall #62 (A2A endpoint — primary mobile interface)
• Expose mission operations as MCP tools #63 (Mission MCP tools — structured actions)

Acceptance Criteria

• /api/dashboard returns compact home screen payload
• Shared auth layer for REST + A2A + MCP
• Bearer token auth on all endpoints
• Mobile-friendly JSON (compact, pre-formatted summaries)