M7.1: extract nisse-core

What isn't the dev agent's moves to nisse-core, unchanged in behaviour,
with its tests: canonical, render, render_anthropic, llm, catalog, probe,
context, views, state, reconcile, worker, cancel, dump, transport, matrix,
execution, testing, vault, memory, oplog, envfile and gitea (whole).

- nisse_core.state.StateStore holds the tables every agent has; an
  agent's subclass adds its tables (version, migrations), roles and
  views. nisse_dev.state.StateStore adds the build VM blocks (v5).
- views.project takes what each role is shown, rather than a fixed table.
- Vault takes the agent's name (agent=), for provenance.
- A test that nisse_core never imports an agent.
- The loop, config, git, delegation, expert, tools and evals stay in
  nisse-dev until nisse-ops has a loop to share.

Docs: the Development Plan marks M7.1 done and notes that Phase 6 waits on
the agent host and Terraform; Architecture Part L names the package.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

scripts/benchmark.py

@@ -14,12 +14,12 @@ import os
 import sys
 from pathlib import Path
 
+from nisse_core.catalog import ModelCatalog
+from nisse_core.envfile import load_env_file
 from nisse_dev.bench.results import append, load, render, results_file, summarise
 from nisse_dev.bench.runner import agent_commit, run_task
 from nisse_dev.bench.tasks import load_tasks
-from nisse_dev.catalog import ModelCatalog
 from nisse_dev.config import AgentConfig, ConfigError
-from nisse_dev.envfile import load_env_file
 from nisse_dev.loop.build import build_host, make_llm_clients
 
 REPO = Path(__file__).resolve().parents[1]

scripts/bringup-repo.sh

@@ -23,8 +23,8 @@ from pathlib import Path
 sys.path.insert(0, "tests/integration")
 from e2e_support import OWNER, delete_repo, make_repo, operator_gitea  # noqa: E402
 
-from nisse_dev.envfile import load_env_file  # noqa: E402
-from nisse_dev.gitea import GiteaClient  # noqa: E402
+from nisse_core.envfile import load_env_file  # noqa: E402
+from nisse_core.gitea import GiteaClient  # noqa: E402
 
 action, e2e = sys.argv[1], Path(sys.argv[2])
 url = "https://gitea.dongar.net"

scripts/bringup.sh

@@ -133,7 +133,7 @@ cmd_logs() { journalctl -u "$UNIT" -f -o cat; }
 # The state store, read with the image's own code.
 dump() {
     docker run --rm --user 0 -v "$E2E:$E2E" --entrypoint python "$IMAGE" \
-        -m nisse_dev.dump "$@"
+        -m nisse_core.dump "$@"
 }
 
 cmd_collect() {

scripts/ci-sshd.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# The throwaway sshd the tests need (nisse_dev/testing.py), in a CI job.
+# The throwaway sshd the tests need (nisse_core/testing.py), in a CI job.
 # Skipped when the job's image already has it. Otherwise apt fetches from a
 # kernel.org mirror rather than archive.ubuntu.com, which has been slow
 # enough (a few KB/s) to add minutes to every job.

scripts/classifier-evals.py

@@ -19,7 +19,7 @@ import sys
 from dataclasses import asdict
 from pathlib import Path
 
-from nisse_dev.canonical import StoredEvent, from_payload
+from nisse_core.canonical import StoredEvent, from_payload
 from nisse_dev.evals import classifier_cases
 
 

scripts/e2e-cleanup.sh

@@ -11,7 +11,7 @@ if [ -f .env ]; then set -a; . ./.env; set +a; fi
 exec uv run python - "$@" <<'PY'
 import os, sys
 from datetime import datetime, timedelta, timezone
-from nisse_dev.gitea import GiteaClient
+from nisse_core.gitea import GiteaClient
 
 gitea = GiteaClient("https://gitea.dongar.net", os.environ["NISSE_OPERATOR_TOKEN"])
 cutoff = datetime.now(timezone.utc) - (timedelta(0) if "--all" in sys.argv else timedelta(days=1))

scripts/e2e.sh

@@ -36,7 +36,7 @@ else
     export NISSE_E2E_BUILD_HOST=${NISSE_E2E_BUILD_HOST:-nisse-dev.garrett-hall.com}
     export NISSE_E2E_BUILD_KEY=${NISSE_E2E_BUILD_KEY:-/root/nisse-e2e/ssh/id_ed25519}
 fi
-# Each run's state store is kept here, for nisse_dev.dump after a failure.
+# Each run's state store is kept here, for nisse_core.dump after a failure.
 export NISSE_E2E_RUNS=${NISSE_E2E_RUNS:-/root/nisse-e2e/test-runs}
 
 # What the run spent on the test key, read from LiteLLM (spend only). The

scripts/probe_context.py

@@ -5,7 +5,7 @@
 ALIAS is a LiteLLM model alias. The LiteLLM URL and token come from the agent
 config (NISSE_CONFIG, ./nisse-dev.yaml, or --config), with its secrets from
 the environment or .env. See docs/Tuning-Guide.md, "Declaring a local model's
-limits", and nisse_dev/probe.py for what the verdicts mean.
+limits", and nisse_core/probe.py for what the verdicts mean.
 """
 
 import argparse
@@ -15,10 +15,10 @@ from pathlib import Path
 
 import httpx
 
-from nisse_dev.catalog import ModelCatalog
+from nisse_core.catalog import ModelCatalog
+from nisse_core.envfile import load_env_file
+from nisse_core.probe import probe
 from nisse_dev.config import AgentConfig, ConfigError
-from nisse_dev.envfile import load_env_file
-from nisse_dev.probe import probe
 
 
 def main() -> int: