Projects as configuration entries (M1.4, D8)

- Config: `projects: {name: entry}` with repo, base_branch, workspace,
  build_host, push credential, labels (defaults added to every issue),
  secrets by ${VAR} reference with visibility (commands | harness), and
  egress (recorded, not enforced). Every problem in every entry is
  reported at once; an inline secret, a bad visibility, a repeated repo or
  a non-slug name is an error.
- The old loop runs exactly one project (only_project) and refuses more.
- The new loop is per project: each its own clone, workspace (with its
  commands-visible secrets, redacted on return), push credential and
  milestones; intake polls every project's repository; items are scoped
  to their project for every run, publish and PR watch. Issues are named
  project#14 when there is more than one project, and a bare #14 that
  matches two is asked about. Switching projects parks the one worked on
  last (all others after a boot).
- A restatement that ends in a question is sent back to the driver, not
  posted: the e2e driver kept asking "Is this the right interpretation?",
  which a plain yes can't answer.

Tests: config entries and errors, two-project assembly, two-project loop
tests (intake, own workspaces and repos, #14 in both, do-next, label
defaults, parking across projects), the property walk over two projects
with a new own_repository_only property (an item using the first
project's repo fails 15 of 16 seeds), and the restatement check.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/tests/test_agent_build.py

@@ -9,7 +9,7 @@ from typing import Any
 
 import httpx
 import pytest
-from test_config import SECRETS, tree
+from test_config import SECRETS, P, tree
 
 from nisse_dev.agent import build_agent, discover_models, prepare_workspace
 from nisse_dev.catalog import ModelCatalog, UnknownModel
@@ -51,11 +51,13 @@ def config_for(tmp_path: Path, **changes: str) -> AgentConfig:
     return AgentConfig.from_tree(
         tree(
             state_db=str(tmp_path / "state.db"),
-            workspace=str(tmp_path / "work"),
-            build_host__address=HOST.address,
-            build_host__user=HOST.user,
-            build_host__port=str(HOST.port),
-            build_host__key=str(HOST._key),
+            **{
+                f"{P}workspace": str(tmp_path / "work"),
+                f"{P}build_host__address": HOST.address,
+                f"{P}build_host__user": HOST.user,
+                f"{P}build_host__port": str(HOST.port),
+                f"{P}build_host__key": str(HOST._key),
+            },
             **changes,
         ),
         SECRETS,
@@ -397,8 +399,63 @@ def test_the_new_loop_assembles(tmp_path: Path, origin: Path, monkeypatch) -> No
     running = build_loop_agent(config)
     try:
         assert running.account == "nisse-dev-testing"
-        assert running.loop._repo == config.gitea_repo
+        [project] = running.loop._projects.values()
+        assert project.repo == config.gitea_repo
         assert (config.workspace / "README.md").exists()  # cloned on the build host
     finally:
         running.worker.call(running.store.close)
         running.worker.stop(timeout=5)
+
+
+def test_each_project_gets_its_own_clone_and_secrets(
+    tmp_path: Path, origin: Path, monkeypatch
+) -> None:
+    """D8: a second project is only a second entry."""
+    from nisse_dev.loop.build import build_loop_agent
+
+    second = tmp_path / "second"
+    config = config_for(
+        tmp_path,
+        loop="new",
+        projects__other={
+            "repo": "don/other",
+            "workspace": str(tmp_path / "other-work"),
+            "build_host": {
+                "address": HOST.address,
+                "user": HOST.user,
+                "port": str(HOST.port),
+                "key": str(HOST._key),
+            },
+            "labels": ["discuss"],
+            "secrets": {
+                "API_KEY": {"value": "${TEST_LLM_TOKEN}", "visible": "commands"}
+            },
+        },
+    )
+    git("clone", "-q", "--bare", str(origin), str(second))
+    origins = {"don/demo": str(origin), "don/other": str(second)}
+    monkeypatch.setattr(
+        "nisse_dev.loop.build.GiteaClient.whoami", lambda self: "nisse-dev-testing"
+    )
+    monkeypatch.setattr(
+        "nisse_dev.loop.build.GiteaClient.clone_url", lambda self, repo: origins[repo]
+    )
+    monkeypatch.setattr(
+        "nisse_dev.agent.ModelCatalog.discover",
+        classmethod(lambda cls, *a, **kw: TEST_CATALOG),
+    )
+    monkeypatch.setattr(
+        "nisse_dev.loop.build.MatrixTransport", lambda cfg: FakeTransport()
+    )
+    running = build_loop_agent(config)
+    try:
+        projects = running.loop._projects
+        assert set(projects) == {"greet", "other"}
+        assert (tmp_path / "work" / "README.md").exists()
+        assert (tmp_path / "other-work" / "README.md").exists()
+        assert projects["other"].labels == ("discuss",)
+        assert projects["other"].workspace._secrets == {"API_KEY": "sk-x"}
+        assert projects["greet"].workspace._secrets == {}
+    finally:
+        running.worker.call(running.store.close)
+        running.worker.stop(timeout=5)