Projects as configuration entries (M1.4, D8)

- Config: `projects: {name: entry}` with repo, base_branch, workspace,
  build_host, push credential, labels (defaults added to every issue),
  secrets by ${VAR} reference with visibility (commands | harness), and
  egress (recorded, not enforced). Every problem in every entry is
  reported at once; an inline secret, a bad visibility, a repeated repo or
  a non-slug name is an error.
- The old loop runs exactly one project (only_project) and refuses more.
- The new loop is per project: each its own clone, workspace (with its
  commands-visible secrets, redacted on return), push credential and
  milestones; intake polls every project's repository; items are scoped
  to their project for every run, publish and PR watch. Issues are named
  project#14 when there is more than one project, and a bare #14 that
  matches two is asked about. Switching projects parks the one worked on
  last (all others after a boot).
- A restatement that ends in a question is sent back to the driver, not
  posted: the e2e driver kept asking "Is this the right interpretation?",
  which a plain yes can't answer.

Tests: config entries and errors, two-project assembly, two-project loop
tests (intake, own workspaces and repos, #14 in both, do-next, label
defaults, parking across projects), the property walk over two projects
with a new own_repository_only property (an item using the first
project's repo fails 15 of 16 seeds), and the restatement check.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/tests/test_config.py

@@ -10,8 +10,13 @@ from nisse_dev.llm import DEFAULT_REQUEST_TIMEOUT_S
 # A complete config as the YAML file would give it, with secrets by reference.
 COMPLETE: dict[str, Any] = {
     "state_db": "~/demo/state.db",
-    "workspace": "~/demo/work",
-    "project": "greet",
+    "projects": {
+        "greet": {
+            "repo": "don/demo",
+            "workspace": "~/demo/work",
+            "build_host": {"address": "build.test", "key": "~/.ssh/nisse-dev"},
+        }
+    },
     "llm": {"base_url": "https://litellm.test", "token": "${TEST_LLM_TOKEN}"},
     "roles": {
         "executor": "claude-haiku-4-5",
@@ -29,11 +34,10 @@ COMPLETE: dict[str, Any] = {
     "gitea": {
         "url": "https://gitea.test",
         "token": "${TEST_GITEA_TOKEN}",
-        "repo": "don/demo",
         "operators": ["don"],
     },
-    "build_host": {"address": "build.test", "key": "~/.ssh/nisse-dev"},
 }
+P = "projects__greet__"  # the one project's keys, for tree()
 SECRETS = {
     "TEST_LLM_TOKEN": "sk-x",
     "TEST_MATRIX_TOKEN": "syt_x",
@@ -83,15 +87,15 @@ def test_every_missing_setting_is_reported_at_once() -> None:
     # Failing at first use would surface a missing token twenty minutes into
     # a milestone, on the call that mattered.
     with pytest.raises(ConfigError) as excinfo:
-        build(matrix__token=None, gitea__repo=None)
+        build(matrix__token=None, **{f"{P}repo": None})
     message = str(excinfo.value)
     assert "matrix.token" in message
-    assert "gitea.repo" in message
+    assert "projects.greet: unset or empty — repo" in message
 
 
 def test_empty_is_treated_as_missing() -> None:
-    with pytest.raises(ConfigError, match="gitea.repo"):
-        build(gitea__repo="   ")
+    with pytest.raises(ConfigError, match="projects.greet: unset or empty — repo"):
+        build(**{f"{P}repo": "   "})
 
 
 def test_a_reference_to_an_unset_variable_is_an_error() -> None:
@@ -115,7 +119,7 @@ def test_an_operator_list_of_only_blanks_is_missing() -> None:
 
 
 def test_base_branch_is_configurable() -> None:
-    assert build(gitea__base_branch="trunk").base_branch == "trunk"
+    assert build(**{f"{P}base_branch": "trunk"}).base_branch == "trunk"
 
 
 def test_max_output_tokens_is_configurable_and_checked() -> None:
@@ -148,7 +152,7 @@ def test_redacted_summary_carries_no_secrets() -> None:
     flat = " ".join(summary.values())
     for secret in SECRETS.values():
         assert secret not in flat
-    assert summary["project"] == "greet"
+    assert "greet (don/demo, build.test:" in summary["projects"]
 
 
 def test_tuning_is_read() -> None:
@@ -178,7 +182,7 @@ def test_a_partly_given_tuning_section_keeps_the_other_defaults() -> None:
 def test_every_problem_is_reported_at_once() -> None:
     # A misspelt knob that was silently ignored would look exactly like a knob
     # with no effect, so unknown keys are errors.
-    bad = tree(project=None, llm_extra=1)
+    bad = tree(llm_extra=1, **{f"{P}workspace": None})
     bad["tuning"] = {
         "executor": {"max_turn": 40, "failure_limit": 0},
         "expert": {"consult_budget": True},
@@ -188,7 +192,7 @@ def test_every_problem_is_reported_at_once() -> None:
         AgentConfig.from_tree(bad, SECRETS)
     message = str(excinfo.value)
     for expected in (
-        "project",
+        "projects.greet: unset or empty — workspace",
         "llm_extra: unknown setting",
         "tuning.executor.max_turn: unknown setting",
         "tuning.executor.failure_limit: must be a positive number",
@@ -207,8 +211,13 @@ def test_a_whole_number_is_required_where_one_is_meant() -> None:
 
 FILE = """
 state_db: ~/demo/state.db
-workspace: ~/demo/work
-project: greet
+projects:
+  greet:
+    repo: don/demo
+    workspace: ~/demo/work
+    build_host:
+      address: build.test
+      key: ~/.ssh/nisse-dev
 llm: {base_url: "https://litellm.test", token: "${TEST_LLM_TOKEN}"}
 roles:
   executor: local-fast
@@ -224,11 +233,7 @@ matrix:
 gitea:
   url: https://gitea.test
   token: ${TEST_GITEA_TOKEN}
-  repo: don/demo
   operators: [don]
-build_host:
-  address: build.test
-  key: ~/.ssh/nisse-dev
 """
 
 
@@ -297,7 +302,7 @@ def test_state_db_inside_the_clone_is_refused(tmp_path: Path) -> None:
     # own state alongside the project.
     work = tmp_path / "project"
     with pytest.raises(ConfigError, match="inside the workspace"):
-        build(workspace=str(work), state_db=str(work / "state.db"))
+        build(state_db=str(work / "state.db"), **{f"{P}workspace": str(work)})
 
 
 def test_env_file_inside_the_clone_is_refused(tmp_path: Path) -> None:
@@ -306,7 +311,7 @@ def test_env_file_inside_the_clone_is_refused(tmp_path: Path) -> None:
     work = tmp_path / "project"
     with pytest.raises(ConfigError, match="NISSE_ENV"):
         AgentConfig.from_tree(
-            tree(workspace=str(work), state_db=str(tmp_path / "state.db")),
+            tree(state_db=str(tmp_path / "state.db"), **{f"{P}workspace": str(work)}),
             {**SECRETS, "NISSE_ENV": str(work / ".env")},
         )
 
@@ -315,13 +320,17 @@ def test_a_config_file_inside_the_clone_is_refused(tmp_path: Path) -> None:
     work = tmp_path / "project"
     work.mkdir()
     text = FILE.replace("workspace: ~/demo/work", f"workspace: {work}")
+    assert text != FILE
     with pytest.raises(ConfigError, match="NISSE_CONFIG"):
         AgentConfig.from_file(write(work, text), SECRETS)
 
 
 def test_sibling_paths_are_fine(tmp_path: Path) -> None:
     config = AgentConfig.from_tree(
-        tree(workspace=str(tmp_path / "project"), state_db=str(tmp_path / "state.db")),
+        tree(
+            state_db=str(tmp_path / "state.db"),
+            **{f"{P}workspace": str(tmp_path / "project")},
+        ),
         {**SECRETS, "NISSE_ENV": str(tmp_path / ".env")},
     )
     assert config.workspace.name == "project"
@@ -342,30 +351,36 @@ def test_the_build_host_is_required_and_defaults_to_root_on_22() -> None:
     assert config.build_host.port == 22
     assert config.build_host.key.is_absolute()
     with pytest.raises(ConfigError, match="build_host.address"):
-        build(build_host__address=None)
+        build(**{f"{P}build_host__address": None})
 
 
 def test_a_bad_build_host_port_is_reported() -> None:
     with pytest.raises(ConfigError, match="build_host.port"):
-        build(build_host__port="ssh")
+        build(**{f"{P}build_host__port": "ssh"})
 
 
 def test_the_push_key_is_optional_and_a_path() -> None:
     assert build().push_key is None
-    assert build(gitea__push_key="~/k").push_key == Path("~/k").expanduser()
+    assert build(**{f"{P}push_key": "~/k"}).push_key == Path("~/k").expanduser()
 
 
 def test_a_push_token_needs_its_user_and_excludes_a_key() -> None:
-    config = build(gitea__push_user="pusher", gitea__push_token="${TEST_GITEA_TOKEN}")
+    token = {f"{P}push_user": "pusher", f"{P}push_token": "${TEST_GITEA_TOKEN}"}
+    config = build(**token)
     assert (config.push_user, config.push_token) == ("pusher", "gt")
     with pytest.raises(ConfigError, match="set both or neither"):
-        build(gitea__push_user="pusher")
+        build(**{f"{P}push_user": "pusher"})
     with pytest.raises(ConfigError, match="not both"):
-        build(gitea__push_user="p", gitea__push_token="t", gitea__push_key="~/k")
+        build(**token, **{f"{P}push_key": "~/k"})
 
 
 def test_no_credential_appears_in_the_config_repr() -> None:
-    config = build(gitea__push_user="pusher", gitea__push_token="${TEST_GITEA_TOKEN}")
+    config = build(
+        **{f"{P}push_user": "pusher", f"{P}push_token": "${TEST_GITEA_TOKEN}"},
+        **{
+            f"{P}secrets": {"DB": {"value": "${TEST_LLM_TOKEN}", "visible": "commands"}}
+        },
+    )
     text = repr(config)
     for secret in SECRETS.values():
         assert secret not in text
@@ -376,3 +391,90 @@ def test_the_loop_defaults_to_old_and_takes_new() -> None:
     assert build(loop="new").loop == "new"
     with pytest.raises(ConfigError, match="loop: must be old or new"):
         build(loop="newer")
+
+
+# --- projects (D8) -----------------------------------------------------------
+
+SECOND = {
+    "repo": "don/other",
+    "workspace": "~/demo/other",
+    "build_host": {"address": "build2.test", "key": "~/.ssh/nisse-dev"},
+}
+
+
+def test_a_second_project_is_a_second_entry() -> None:
+    config = build(projects__other=SECOND)
+    assert [p.name for p in config.projects] == ["greet", "other"]
+    other = config.projects[1]
+    assert (other.repo, other.build_host.address) == ("don/other", "build2.test")
+    assert other.base_branch == "main" and other.labels == () and other.secrets == {}
+
+
+def test_the_old_loop_refuses_more_than_one_project() -> None:
+    config = build(projects__other=SECOND)
+    with pytest.raises(ConfigError, match="exactly one project"):
+        config.only_project()
+    with pytest.raises(ConfigError, match="exactly one project"):
+        _ = config.gitea_repo
+
+
+def test_at_least_one_project_is_needed() -> None:
+    with pytest.raises(ConfigError, match="projects: must name at least one"):
+        build(projects={})
+
+
+def test_project_problems_are_named_by_project() -> None:
+    bad = tree(projects__other={**SECOND, "repo": "don/demo", "colour": "red"})
+    with pytest.raises(ConfigError) as excinfo:
+        AgentConfig.from_tree(bad, SECRETS)
+    message = str(excinfo.value)
+    assert "projects.other.colour: unknown setting" in message
+    assert "projects.other.repo: don/demo is also project greet's" in message
+
+
+def test_a_project_name_is_a_slug() -> None:
+    with pytest.raises(ConfigError, match="lowercase letters, digits"):
+        build(projects__Other_Project=SECOND)
+
+
+def test_labels_and_egress_are_lists_of_names() -> None:
+    config = build(**{f"{P}labels": ["discuss"], f"{P}egress": ["pypi.org"]})
+    assert config.only_project().labels == ("discuss",)
+    assert config.only_project().egress == ("pypi.org",)
+    with pytest.raises(ConfigError, match="projects.greet.labels: must be a list"):
+        build(**{f"{P}labels": "discuss"})
+
+
+def test_secrets_are_by_reference_with_a_visibility() -> None:
+    config = build(
+        **{
+            f"{P}secrets": {
+                "DB_URL": {"value": "${TEST_LLM_TOKEN}", "visible": "commands"},
+                "DEPLOY": {"value": "${TEST_GITEA_TOKEN}", "visible": "harness"},
+            }
+        }
+    )
+    project = config.only_project()
+    assert project.command_secrets() == {"DB_URL": "sk-x"}
+    assert project.secrets["DEPLOY"].visible == "harness"
+
+
+def test_a_secret_written_inline_is_refused() -> None:
+    with pytest.raises(ConfigError, match="must be a \\$\\{VAR\\} reference"):
+        build(**{f"{P}secrets": {"DB": {"value": "hunter2", "visible": "commands"}}})
+
+
+def test_a_secret_needs_a_known_visibility() -> None:
+    with pytest.raises(ConfigError, match="visible: must be one of commands, harness"):
+        build(
+            **{f"{P}secrets": {"DB": {"value": "${TEST_LLM_TOKEN}", "visible": "all"}}}
+        )
+
+
+def test_a_workspace_of_any_project_inside_is_refused(tmp_path: Path) -> None:
+    work = tmp_path / "other"
+    with pytest.raises(ConfigError, match="project other"):
+        build(
+            state_db=str(work / "state.db"),
+            projects__other={**SECOND, "workspace": str(work)},
+        )