Projects as configuration entries (M1.4, D8)

- Config: `projects: {name: entry}` with repo, base_branch, workspace,
  build_host, push credential, labels (defaults added to every issue),
  secrets by ${VAR} reference with visibility (commands | harness), and
  egress (recorded, not enforced). Every problem in every entry is
  reported at once; an inline secret, a bad visibility, a repeated repo or
  a non-slug name is an error.
- The old loop runs exactly one project (only_project) and refuses more.
- The new loop is per project: each its own clone, workspace (with its
  commands-visible secrets, redacted on return), push credential and
  milestones; intake polls every project's repository; items are scoped
  to their project for every run, publish and PR watch. Issues are named
  project#14 when there is more than one project, and a bare #14 that
  matches two is asked about. Switching projects parks the one worked on
  last (all others after a boot).
- A restatement that ends in a question is sent back to the driver, not
  posted: the e2e driver kept asking "Is this the right interpretation?",
  which a plain yes can't answer.

Tests: config entries and errors, two-project assembly, two-project loop
tests (intake, own workspaces and repos, #14 in both, do-next, label
defaults, parking across projects), the property walk over two projects
with a new own_repository_only property (an item using the first
project's repo fails 15 of 16 seeds), and the restatement check.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

tests/integration/nisse-test.yaml

@@ -7,15 +7,23 @@
 # the live tests that need it, rather than skipping them, so a broken
 # credential cannot hide as a skip.
 
-# Unused by the live tests, which work in pytest's temporary directories on a
-# throwaway local sshd (the `ssh_host` fixture); present because every agent
-# config has them.
+# Unused by the live tests, which work in pytest's temporary directories;
+# present because every agent config has it.
 state_db: /tmp/nisse-test/state.db
-workspace: /tmp/nisse-test/work
-project: nisse-dev-testing
-build_host:
-  address: 127.0.0.1
-  key: /tmp/nisse-test/unused-key
+
+projects:
+  nisse-dev-testing:
+    repo: dongar/nisse-dev-testing-sandbox    # the sandbox, never a real project
+    # The live tests replace these with a throwaway local sshd (the `ssh_host`
+    # fixture) or the bring-up build VM, in temporary directories.
+    workspace: /tmp/nisse-test/work
+    build_host:
+      address: 127.0.0.1
+      key: /tmp/nisse-test/unused-key
+    # What pushes go by (D4): the sandbox's deploy key, whose private half CI
+    # writes to this path from the NISSE_PUSH_KEY secret (locally: copy it
+    # there). An HTTPS push token works too: push_user plus push_token.
+    push_key: /tmp/nisse-test/push_key
 
 llm:
   base_url: https://litellm.dongar.net
@@ -40,11 +48,6 @@ matrix:
 gitea:
   url: https://gitea.dongar.net
   token: ${NISSE_GITEA_TOKEN}
-  repo: dongar/nisse-dev-testing-sandbox      # the sandbox, never a real project
   # nisse-testing-operator plays the operator in the end-to-end tests
   # (NISSE_OPERATOR_TOKEN); an operator here and nowhere else.
   operators: [dongar, nisse-testing-operator]
-  # What pushes go by (D4): the sandbox's deploy key, whose private half CI
-  # writes to this path from the NISSE_PUSH_KEY secret (locally: copy it
-  # there). An HTTPS push token works too: push_user plus push_token.
-  push_key: /tmp/nisse-test/push_key

tests/integration/test_end_to_end.py

@@ -74,11 +74,12 @@ def agent(
     operator = operator_gitea(live_config.gitea_url)
     base = stack.enter_context(base_branch(operator, live_config.gitea_repo, run))
     config = replace(
-        live_config,
-        base_branch=base,
+        live_config.with_project(
+            base_branch=base,
+            workspace=Path(f"/tmp/nisse-e2e-{run}/sandbox"),
+            build_host=build_host(ssh_host),
+        ),
         state_db=tmp_path / "state.db",
-        workspace=Path(f"/tmp/nisse-e2e-{run}/sandbox"),
-        build_host=build_host(ssh_host),
     )
     transport = InMemoryTransport()
     monkeypatch.setattr("nisse_dev.agent.MatrixTransport", lambda cfg: transport)

tests/integration/test_end_to_end_loop.py

@@ -65,12 +65,13 @@ def running(
     operator = operator_gitea(live_config.gitea_url)
     base = stack.enter_context(base_branch(operator, live_config.gitea_repo, run))
     config = replace(
-        live_config,
+        live_config.with_project(
+            base_branch=base,
+            workspace=Path(f"/tmp/nisse-e2e-{run}/sandbox"),
+            build_host=build_host(ssh_host),
+        ),
         loop="new",
-        base_branch=base,
         state_db=keep / "state.db",
-        workspace=Path(f"/tmp/nisse-e2e-{run}/sandbox"),
-        build_host=build_host(ssh_host),
         # Short, so a bug's grace period runs out within the test.
         tuning=replace(live_config.tuning, loop=LoopTuning(bug_grace_s=BUG_GRACE_S)),
     )