@usine/config 0.2.1 → 0.3.0

package/README.md

@@ -1,15 +1,16 @@
 # @usine/config
 
-Reads and edits the authored files in a [usine](https://github.com/basaltbytes/usine) instance folder:
+Reads and edits the files of a [usine](https://github.com/basaltbytes/usine) instance folder. The [`usine.yaml`](https://docs.usine.dev/reference/configuration/usine-yaml/), [loop file](https://docs.usine.dev/reference/configuration/loop-files/), and [agent file](https://docs.usine.dev/reference/configuration/agent-files/) references describe every key.
 
-- `usine.yaml` defines the schema version, factory-wide GitHub labels, managed-repo registry, settings, workers, webhook mode, and operator login.
-- `loops/*.md` combines strict YAML frontmatter with a Markdown prompt. The parser type-checks the trigger and every `{{ CEL expression }}` against that trigger's payload.
-- `agents/*.md` records a named agent's harness, model, effort, optional parent model, optional parent effort, and persona.
-- `updateYaml` and `updateFrontmatter` change one path through the YAML document tree while retaining comments, key order, and the Markdown body.
+- `usine.yaml`: schema version, factory-wide GitHub labels, the managed-repo registry, settings, workers, webhook mode, and operator login.
+- `loops/*.md`: strict YAML frontmatter and a Markdown prompt. The parser type-checks the trigger and every `{{ CEL expression }}` against the trigger's payload.
+- `agents/*.md`: harness, model, effort, optional parent model and parent effort, and persona.
 
-Authored keys are snake_case (`poll_interval`, `max_concurrent_attempts`); the decoded domain types expose camelCase fields (`pollInterval`, `maxConcurrentAttempts`). The rename is part of the schema, so edits encode back to the authored casing.
+`updateYaml` and `updateFrontmatter` change one path in the YAML tree and keep comments, key order, and the Markdown body. Files use snake_case keys (`poll_interval`, `max_concurrent_attempts`); decoded types use camelCase (`pollInterval`, `maxConcurrentAttempts`). The schema does the rename, so edits keep snake_case.
 
-Declare the GitHub labels used by Loops and Board lanes once. Usine provisions missing declarations in every managed repository; existing definitions are never edited or deleted. `color` is an optional six-digit hexadecimal value without `#`:
+## Labels and lanes
+
+Declare the labels that loops and lanes use once. usine creates missing labels in every managed repo and never edits or deletes labels:
 
 ```yaml
 labels:
@@ -19,11 +20,9 @@ labels:
   - name: ready-for-review
 ```
 
-Label names follow GitHub's contract: at most 50 characters, no surrounding whitespace, and unique without regard to case; descriptions are at most 100 characters. A lane source or trigger-expression string literal that refers to an undeclared label becomes a non-blocking entry in `LoadedInstance.warnings`; prose in prompt bodies is not inspected.
-
-Set `settings.max_children` to the number of child sessions one Attempt may spawn. The default is 4, and the count includes sequential and concurrent child sessions.
+An undeclared label in a lane source or a trigger expression string literal adds a non-blocking entry to `LoadedInstance.warnings`. Prompt prose isn't checked.
 
-Each managed repository can define an exclusive Board lane map. A lane accepts one or more GitHub label or Item-state sources:
+Each managed repo can define an exclusive board lane map of label and item state sources:
 
 ```yaml
 repos:
@@ -38,16 +37,29 @@ repos:
           - state: pr-open
 ```
 
-Valid state sources are `issue-open`, `issue-closed`, `pr-open`, `pr-closed`, and `pr-merged`. Lane names and sources must be unique within the repository. Repositories without an authored map receive proposed lanes from the labels observed during GitHub polling.
+`isSettledItemState` reports the settled states, `issue-closed`, `pr-closed`, and `pr-merged`; the board places such an item by state alone, whatever its labels. A repo without a lane map gets proposed lanes from the labels that polling finds.
+
+## Settings and workers
+
+`settings.max_children` (default 4) limits the child sessions, sequential and concurrent, that one attempt can start. Without a `workers` key, the parser adds a local worker named `local` that runs one attempt at a time. A worker's `kind` (`local`, `exe.dev`, or `ssh`) selects its executor.
+
+Issue and pull request loops accept `max_cycles`, a positive integer (default 3): the number of runs each loop can open on an item between operator resets. The first admission past it blocks runs from every loop on the item. Schedule loops are exempt. See [Write review and fix loops](https://docs.usine.dev/guides/review-fix-loops/).
+
+## Load an instance
+
+`InstanceFolder.load` takes an `InstanceDirectory` (`@usine/core/instance`) and returns one atomic `LoadedInstance` snapshot:
 
-`workers` must contain at least one uniquely named worker. If the key is absent, the parser supplies one local worker named `local` with a concurrency limit of one. Set `kind` to `local` or `exe.dev` to select its executor, and set `max_concurrent_attempts` to control how many Attempts it can run at once.
+- An invalid `usine.yaml` fails the load with `FactoryConfigError`.
+- An invalid loop goes to `quarantinedLoops` with a `ConfigFileError` naming the file and stage. Valid loops still load.
+- Invalid agents go to `invalidAgents`, and loops that use them are quarantined.
+- Non-blocking reference diagnostics go to `warnings`.
 
-`InstanceFolder.load` takes an `InstanceDirectory` (from `@usine/core/instance`) and returns one atomic `LoadedInstance` snapshot. An invalid `usine.yaml` fails the load with a `FactoryConfigError`; an invalid loop enters `quarantinedLoops` with a `ConfigFileError` naming the file and stage, without blocking valid siblings. Invalid agents appear in `invalidAgents`, and loops that name them are quarantined. A `LoadedInstance` always satisfies its own reference rule: every loaded loop names a rostered agent and registered selector entries, enforced at construction. Non-blocking authored-reference diagnostics appear in `warnings`. The `ConfigError` union covers both failure types.
+`ConfigError` is the union of both errors. The `LoadedInstance` constructor enforces that every loop references a rostered agent and registered selector entries.
 
-Import factory settings and registry types from `@usine/config/factory`, Board lanes from `@usine/config/board`, and label declarations from `@usine/config/label`. Authored loop, trigger, and agent schemas are available at `/loop`, `/trigger`, and `/agent`; `/selector` provides both the selector schema and matching operation. `/instance` provides `LoadedInstance` and its warnings, while `/file` provides file paths and typed loading failures. Shared identities and agent personas come from their owning `@usine/core` modules.
+## Imports
 
-The package exports Effect services and layers. Import `InstanceFolder` from `@usine/config/instance-folder` and `ConfigParser` from `@usine/config/parser`. Supply `FileSystem.FileSystem` and `Path.Path` implementations when composing `InstanceFolder.layer`; `ConfigParser.layer` requires `ExpressionEngine` from `@usine/expression/expression-engine`.
+Subpaths: `/factory` (settings and registry), `/board` (lanes), `/label`, `/loop`, `/trigger`, `/agent`, `/selector` (schema and matching), `/instance` (`LoadedInstance` and warnings), and `/file` (file paths and loading failures). Shared identities and agent personas come from `@usine/core`.
 
-All APIs remain 0.x and can change between minor releases.
+`InstanceFolder` (`/instance-folder`) and `ConfigParser` (`/parser`) are Effect services. `InstanceFolder.layer` needs `FileSystem.FileSystem` and `Path.Path`; `ConfigParser.layer` needs `ExpressionEngine` from `@usine/expression/expression-engine`.
 
-Issue and pull-request Loops accept `max_cycles`, a positive integer defaulting to three. Each Loop may open that many Runs on an Item between operator resets. The first excess admission blocks further Runs from every Loop on the Item. Schedule Loops are exempt. See the [review/fix guide](../../docs/guides/review-fix-loops.md) for authored examples.
+The 0.x APIs can change between minor releases.

package/dist/agent.d.ts

@@ -10,16 +10,15 @@ declare const AgentFile_base: Schema.Class<AgentFile, Schema.Struct<{
     readonly parentEffort: Schema.Option<Schema.Literals<readonly ["off", "minimal", "low", "medium", "high", "xhigh", "max"]>>;
     readonly persona: Schema.brand<Schema.String, "AgentPersona">;
 }>, {}>;
-/** An Agent's authored brain, parent overrides, and standing instructions, named by its Markdown filename. */
+/** A parsed Agent Markdown file; `name` comes from the filename. */
 export declare class AgentFile extends AgentFile_base {
-    /** The roster member represented by this file, including persona and parent overrides. */
     get agent(): Agent;
 }
 declare const InvalidAgent_base: Schema.Class<InvalidAgent, Schema.Struct<{
     readonly file: Schema.brand<Schema.NonEmptyString, "InstancePath">;
     readonly error: typeof ConfigFileError;
 }>, {}>;
-/** An Agent file excluded from the roster because it could not be loaded. */
+/** An Agent file that failed to load and is left out of the roster. */
 export declare class InvalidAgent extends InvalidAgent_base {
 }
 export {};

package/dist/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAA2B,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAgB,eAAe,EAAE,MAAM,WAAW,CAAC;;;;;;;;;;AAE1D,8GAA8G;AAC9G,qBAAa,SAAU,SAAQ,cAQ7B;IACA,0FAA0F;IAC1F,IAAI,KAAK,IAAI,KAAK,CAQjB;CACF;;;;;AAED,6EAA6E;AAC7E,qBAAa,YAAa,SAAQ,iBAGhC;CAAG"}
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAA2B,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAgB,eAAe,EAAE,MAAM,WAAW,CAAC;;;;;;;;;;AAE1D,oEAAoE;AACpE,qBAAa,SAAU,SAAQ,cAQ7B;IACA,IAAI,KAAK,IAAI,KAAK,CAQjB;CACF;;;;;AAED,uEAAuE;AACvE,qBAAa,YAAa,SAAQ,iBAGhC;CAAG"}

package/dist/agent.js

@@ -2,7 +2,7 @@ import { Agent, AgentPersona, AgentName } from "@usine/core/agent";
 import { BrainSpec, Effort, Harness, ModelId } from "@usine/core/agent/brain";
 import { Schema } from "effect";
 import { InstancePath, ConfigFileError } from "./file.js";
-/** An Agent's authored brain, parent overrides, and standing instructions, named by its Markdown filename. */
+/** A parsed Agent Markdown file; `name` comes from the filename. */
 export class AgentFile extends Schema.Class("@usine/config/AgentFile")({
     name: AgentName,
     harness: Harness,
@@ -12,7 +12,6 @@ export class AgentFile extends Schema.Class("@usine/config/AgentFile")({
     parentEffort: Schema.Option(Effort),
     persona: AgentPersona,
 }) {
-    /** The roster member represented by this file, including persona and parent overrides. */
     get agent() {
         return new Agent({
             name: this.name,
@@ -23,7 +22,7 @@ export class AgentFile extends Schema.Class("@usine/config/AgentFile")({
         });
     }
 }
-/** An Agent file excluded from the roster because it could not be loaded. */
+/** An Agent file that failed to load and is left out of the roster. */
 export class InvalidAgent extends Schema.Class("@usine/config/InvalidAgent")({
     file: InstancePath,
     error: ConfigFileError,

package/dist/agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE1D,8GAA8G;AAC9G,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,KAAK,CAAY,yBAAyB,CAAC,CAAC;IAChF,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,MAAM;IACd,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,YAAY;CACtB,CAAC;IACA,0FAA0F;IAC1F,IAAI,KAAK;QACP,OAAO,IAAI,KAAK,CAAC;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACvF,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAC;IACL,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,KAAK,CAAe,4BAA4B,CAAC,CAAC;IACzF,IAAI,EAAE,YAAY;IAClB,KAAK,EAAE,eAAe;CACvB,CAAC;CAAG"}
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAE1D,oEAAoE;AACpE,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,KAAK,CAAY,yBAAyB,CAAC,CAAC;IAChF,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,MAAM;IACd,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,YAAY;CACtB,CAAC;IACA,IAAI,KAAK;QACP,OAAO,IAAI,KAAK,CAAC;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACvF,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAC;IACL,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,OAAO,YAAa,SAAQ,MAAM,CAAC,KAAK,CAAe,4BAA4B,CAAC,CAAC;IACzF,IAAI,EAAE,YAAY;IAClB,KAAK,EAAE,eAAe;CACvB,CAAC;CAAG"}

package/dist/board.d.ts

@@ -1,30 +1,32 @@
 import { Schema } from "effect";
-/** The operator-visible name of one lane on a Project's Board. */
 export declare const LaneName: Schema.brand<Schema.String, "LaneName">;
 export type LaneName = typeof LaneName.Type;
-/** An issue or pull-request state that can place an Item in a Board lane. */
 export declare const LaneItemState: Schema.Literals<readonly ["issue-open", "issue-closed", "pr-open", "pr-closed", "pr-merged"]>;
 export type LaneItemState = typeof LaneItemState.Type;
+/**
+ * Returns whether `state` is a closed issue or a closed or merged pull request, which the Board
+ * places by state regardless of labels.
+ */
+export declare const isSettledItemState: (state: LaneItemState) => boolean;
 declare const LabelLaneSource_base: Schema.Class<LabelLaneSource, Schema.Struct<{
     readonly label: Schema.brand<Schema.String, "GitHubLabelName">;
 }>, {}>;
-/** Places Items with this GitHub label in the lane; Board moves can write the label. */
+/** A lane source that matches Items with this GitHub label, which Board moves can set. */
 export declare class LabelLaneSource extends LabelLaneSource_base {
 }
 declare const StateLaneSource_base: Schema.Class<StateLaneSource, Schema.Struct<{
     readonly state: Schema.Literals<readonly ["issue-open", "issue-closed", "pr-open", "pr-closed", "pr-merged"]>;
 }>, {}>;
-/** Places Items with this GitHub state in the lane; Board moves cannot change the state. */
+/** A lane source that matches Items in this state, which Board moves can't change. */
 export declare class StateLaneSource extends StateLaneSource_base {
 }
-/** A GitHub label or Item state that routes matching Items to a Board lane. */
 export declare const LaneSource: Schema.Union<readonly [typeof LabelLaneSource, typeof StateLaneSource]>;
 export type LaneSource = typeof LaneSource.Type;
 declare const Lane_base: Schema.Class<Lane, Schema.Struct<{
     readonly name: Schema.brand<Schema.String, "LaneName">;
     readonly sources: Schema.$Array<Schema.Union<readonly [typeof LabelLaneSource, typeof StateLaneSource]>>;
 }>, {}>;
-/** A named Board column containing Items that match any of its configured sources. */
+/** A Board column that contains the Items matching any of `sources`. */
 export declare class Lane extends Lane_base {
 }
 export {};

package/dist/board.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"board.d.ts","sourceRoot":"","sources":["../src/board.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIhC,kEAAkE;AAClE,eAAO,MAAM,QAAQ,yCAEpB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC;AAE5C,6EAA6E;AAC7E,eAAO,MAAM,aAAa,+FAMxB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;;;;AAEtD,wFAAwF;AACxF,qBAAa,eAAgB,SAAQ,oBAIpC;CAAG;;;;AAEJ,4FAA4F;AAC5F,qBAAa,eAAgB,SAAQ,oBAIpC;CAAG;AAEJ,+EAA+E;AAC/E,eAAO,MAAM,UAAU,yEAAmD,CAAC;AAE3E,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAC;;;;;AAEhD,sFAAsF;AACtF,qBAAa,IAAK,SAAQ,SAGxB;CAAG"}
+{"version":3,"file":"board.d.ts","sourceRoot":"","sources":["../src/board.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIhC,eAAO,MAAM,QAAQ,yCAEpB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC;AAE5C,eAAO,MAAM,aAAa,+FAMxB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;AAQtD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,UAAW,aAAa,KAAG,OAAyC,CAAC;;;;AAEpG,0FAA0F;AAC1F,qBAAa,eAAgB,SAAQ,oBAIpC;CAAG;;;;AAEJ,sFAAsF;AACtF,qBAAa,eAAgB,SAAQ,oBAIpC;CAAG;AAEJ,eAAO,MAAM,UAAU,yEAAmD,CAAC;AAE3E,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,IAAI,CAAC;;;;;AAEhD,wEAAwE;AACxE,qBAAa,IAAK,SAAQ,SAGxB;CAAG"}

package/dist/board.js

@@ -1,9 +1,7 @@
 import { Schema } from "effect";
 import { nonBlankString } from "./checks.js";
 import { GitHubLabelName } from "./label.js";
-/** The operator-visible name of one lane on a Project's Board. */
 export const LaneName = nonBlankString("Expected a non-blank lane name").pipe(Schema.brand("LaneName"));
-/** An issue or pull-request state that can place an Item in a Board lane. */
 export const LaneItemState = Schema.Literals([
     "issue-open",
     "issue-closed",
@@ -11,19 +9,28 @@ export const LaneItemState = Schema.Literals([
     "pr-closed",
     "pr-merged",
 ]);
-/** Places Items with this GitHub label in the lane; Board moves can write the label. */
+const SETTLED_ITEM_STATES = new Set([
+    "issue-closed",
+    "pr-closed",
+    "pr-merged",
+]);
+/**
+ * Returns whether `state` is a closed issue or a closed or merged pull request, which the Board
+ * places by state regardless of labels.
+ */
+export const isSettledItemState = (state) => SETTLED_ITEM_STATES.has(state);
+/** A lane source that matches Items with this GitHub label, which Board moves can set. */
 export class LabelLaneSource extends Schema.Class("@usine/config/LabelLaneSource")({
     label: GitHubLabelName,
 }) {
 }
-/** Places Items with this GitHub state in the lane; Board moves cannot change the state. */
+/** A lane source that matches Items in this state, which Board moves can't change. */
 export class StateLaneSource extends Schema.Class("@usine/config/StateLaneSource")({
     state: LaneItemState,
 }) {
 }
-/** A GitHub label or Item state that routes matching Items to a Board lane. */
 export const LaneSource = Schema.Union([LabelLaneSource, StateLaneSource]);
-/** A named Board column containing Items that match any of its configured sources. */
+/** A Board column that contains the Items matching any of `sources`. */
 export class Lane extends Schema.Class("@usine/config/Lane")({
     name: LaneName,
     sources: Schema.Array(LaneSource).check(Schema.isNonEmpty()),

package/dist/board.js.map

@@ -1 +1 @@
-{"version":3,"file":"board.js","sourceRoot":"","sources":["../src/board.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,kEAAkE;AAClE,MAAM,CAAC,MAAM,QAAQ,GAAG,cAAc,CAAC,gCAAgC,CAAC,CAAC,IAAI,CAC3E,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CACzB,CAAC;AAIF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC3C,YAAY;IACZ,cAAc;IACd,SAAS;IACT,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAIH,wFAAwF;AACxF,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAAkB,+BAA+B,CAAC,CACjG;IACE,KAAK,EAAE,eAAe;CACvB,CACF;CAAG;AAEJ,4FAA4F;AAC5F,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAAkB,+BAA+B,CAAC,CACjG;IACE,KAAK,EAAE,aAAa;CACrB,CACF;CAAG;AAEJ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;AAI3E,sFAAsF;AACtF,MAAM,OAAO,IAAK,SAAQ,MAAM,CAAC,KAAK,CAAO,oBAAoB,CAAC,CAAC;IACjE,IAAI,EAAE,QAAQ;IACd,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;CAC7D,CAAC;CAAG"}
+{"version":3,"file":"board.js","sourceRoot":"","sources":["../src/board.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,CAAC,MAAM,QAAQ,GAAG,cAAc,CAAC,gCAAgC,CAAC,CAAC,IAAI,CAC3E,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CACzB,CAAC;AAIF,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC3C,YAAY;IACZ,cAAc;IACd,SAAS;IACT,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAIH,MAAM,mBAAmB,GAA+B,IAAI,GAAG,CAAC;IAC9D,cAAc;IACd,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAoB,EAAW,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAEpG,0FAA0F;AAC1F,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAAkB,+BAA+B,CAAC,CACjG;IACE,KAAK,EAAE,eAAe;CACvB,CACF;CAAG;AAEJ,sFAAsF;AACtF,MAAM,OAAO,eAAgB,SAAQ,MAAM,CAAC,KAAK,CAAkB,+BAA+B,CAAC,CACjG;IACE,KAAK,EAAE,aAAa;CACrB,CACF;CAAG;AAEJ,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;AAI3E,wEAAwE;AACxE,MAAM,OAAO,IAAK,SAAQ,MAAM,CAAC,KAAK,CAAO,oBAAoB,CAAC,CAAC;IACjE,IAAI,EAAE,QAAQ;IACd,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;CAC7D,CAAC;CAAG"}

package/dist/checks.d.ts

@@ -1,3 +1,6 @@
+import { type RepositoryName } from "@usine/core/repository";
 import { Schema } from "effect";
 export declare const nonBlankString: (message: string) => Schema.String;
+/** Returns a filter that rejects two names GitHub treats as the same repository. */
+export declare const uniqueRepositoryNames: <A>(nameOf: (value: A) => RepositoryName) => import("effect/SchemaAST").Filter<readonly A[]>;
 //# sourceMappingURL=checks.d.ts.map

package/dist/checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../src/checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,eAAO,MAAM,cAAc,YAAa,MAAM,kBACa,CAAC"}
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../src/checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,eAAO,MAAM,cAAc,YAAa,MAAM,kBACa,CAAC;AAE5D,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,GAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,cAAc,oDAK1E,CAAC"}

package/dist/checks.js

@@ -1,3 +1,6 @@
+import { canonicalRepositoryName } from "@usine/core/repository";
 import { Schema } from "effect";
 export const nonBlankString = (message) => Schema.String.check(Schema.isPattern(/\S/u, { message }));
+/** Returns a filter that rejects two names GitHub treats as the same repository. */
+export const uniqueRepositoryNames = (nameOf) => Schema.makeFilter((values) => new Set(values.map((value) => canonicalRepositoryName(nameOf(value)))).size === values.length, { message: "Expected unique repository names, ignoring case" });
 //# sourceMappingURL=checks.js.map

package/dist/checks.js.map

@@ -1 +1 @@
-{"version":3,"file":"checks.js","sourceRoot":"","sources":["../src/checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,EAAE,CAChD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC"}
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../src/checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAuB,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,EAAE,CAChD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAE5D,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAI,MAAoC,EAAE,EAAE,CAC/E,MAAM,CAAC,UAAU,CACf,CAAC,MAAM,EAAE,EAAE,CACT,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAC/F,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAC/D,CAAC"}

package/dist/factory.d.ts

@@ -1,46 +1,94 @@
 import { Schema } from "effect";
 import { Lane } from "./board.ts";
 import { DeclaredLabel } from "./label.ts";
-/** A factory-defined repository grouping that Loops can select by tag. */
+/** A repository tag that Loop selectors match. */
 export declare const RegistryTag: Schema.brand<Schema.String, "RegistryTag">;
 export type RegistryTag = typeof RegistryTag.Type;
-/** GitHub login identifying the human operator for this factory. */
-export declare const OperatorLogin: Schema.brand<Schema.String, "OperatorLogin">;
-export type OperatorLogin = typeof OperatorLogin.Type;
 declare const ManagedRepo_base: Schema.Class<ManagedRepo, Schema.Struct<{
     readonly name: Schema.brand<Schema.String, "RepositoryName">;
     readonly tags: Schema.withDecodingDefaultKey<Schema.$Array<Schema.brand<Schema.String, "RegistryTag">>, never>;
     readonly lanes: Schema.withDecodingDefaultKey<Schema.$Array<typeof Lane>, never>;
 }>, {}>;
-/** A repository the factory manages, with its selector tags and configured Board lanes. */
 export declare class ManagedRepo extends ManagedRepo_base {
 }
-declare const Worker_base: Schema.Class<Worker, Schema.Struct<{
+declare const LocalWorker_base: Schema.Class<LocalWorker, Schema.Struct<{
     readonly name: Schema.brand<Schema.String, "WorkerName">;
-    readonly kind: Schema.Literals<readonly ["local", "exe.dev"]>;
+    readonly kind: Schema.Literal<"local">;
     readonly maxConcurrentAttempts: Schema.withDecodingDefaultKey<Schema.Int, never>;
 }>, {}>;
-/** A named place to execute Attempts, with the number it may run at the same time. */
-export declare class Worker extends Worker_base {
+/** A Worker that runs Attempts on the orchestrator's machine. */
+export declare class LocalWorker extends LocalWorker_base {
 }
+declare const ExeDevWorker_base: Schema.Class<ExeDevWorker, Schema.Struct<{
+    readonly name: Schema.brand<Schema.String, "WorkerName">;
+    readonly kind: Schema.Literal<"exe.dev">;
+    readonly maxConcurrentAttempts: Schema.withDecodingDefaultKey<Schema.Int, never>;
+}>, {}>;
+/** A Worker on the exe.dev VM with the same name. */
+export declare class ExeDevWorker extends ExeDevWorker_base {
+}
+declare const WorkerGateway_base: Schema.Class<WorkerGateway, Schema.Struct<{
+    readonly domain: Schema.brand<Schema.String, "GatewayDomain">;
+    readonly destination: Schema.brand<Schema.String, "SshDestination">;
+    readonly adminPort: Schema.withDecodingDefaultKey<Schema.brand<Schema.Int, "GatewayAdminPort">, never>;
+    readonly adminTokenEnv: Schema.brand<Schema.String, "EnvironmentVariableName">;
+    readonly llmProviders: Schema.withDecodingDefaultKey<Schema.$Array<Schema.Literals<readonly ["anthropic"]>>, never>;
+}>, {}>;
+/**
+ * The Gateway in front of an SSH Worker's machine on a private network (ADR 0027).
+ *
+ * - `domain`: the Gateway's private DNS domain.
+ * - `destination`: the Gateway's `ssh` destination, usually the Host alias in the Worker's
+ *   `ProxyJump`. The executor forwards through it to the admin API at `adminPort` on the
+ *   Gateway's loopback interface.
+ * - `adminTokenEnv`: the orchestrator environment variable with the admin token, read when
+ *   `usine up` starts or a reload adds the Worker.
+ * - `llmProviders`: the providers whose credential the Gateway injects. Harnesses for other
+ *   providers, and Codex, use the operator's login on the Worker through the forward proxy.
+ */
+export declare class WorkerGateway extends WorkerGateway_base {
+}
+declare const SshWorker_base: Schema.Class<SshWorker, Schema.Struct<{
+    readonly name: Schema.brand<Schema.String, "WorkerName">;
+    readonly kind: Schema.Literal<"ssh">;
+    readonly maxConcurrentAttempts: Schema.withDecodingDefaultKey<Schema.Int, never>;
+    readonly destination: Schema.brand<Schema.String, "SshDestination">;
+    readonly identityFile: Schema.OptionFromOptionalKey<Schema.brand<Schema.String, "SshIdentityFile">>;
+    readonly port: Schema.OptionFromOptionalKey<Schema.brand<Schema.Int, "SshPort">>;
+    readonly root: Schema.brand<Schema.String, "WorkerRoot">;
+    readonly gateway: Schema.OptionFromOptionalKey<Schema.encodeKeys<typeof WorkerGateway, {
+        readonly adminPort: "admin_port";
+        readonly adminTokenEnv: "admin_token_env";
+        readonly llmProviders: "llm_providers";
+    }>>;
+}>, {}>;
+/**
+ * A Linux machine reached with `ssh`, with Worker state under `<root>/workers/<name>`. If
+ * `gateway` is set, the machine stores no GitHub token; the executor sends each Attempt's token
+ * to the Gateway.
+ */
+export declare class SshWorker extends SshWorker_base {
+}
+/** A configured Worker; `kind` selects the adapter. */
+export declare const Worker: Schema.Union<readonly [typeof LocalWorker, typeof ExeDevWorker, typeof SshWorker]>;
+export type Worker = typeof Worker.Type;
 declare const Settings_base: Schema.Class<Settings, Schema.Struct<{
-    /** Seconds between routine GitHub polling cycles; defaults to 60. */
+    /** The interval between GitHub polling cycles, in seconds. */
     readonly pollInterval: Schema.withDecodingDefaultKey<Schema.Int, never>;
-    /** Total child sessions allowed over one Attempt's lifetime, including sequential spawns; defaults to four. */
+    /** The maximum number of child sessions per Attempt, counting sequential spawns. */
     readonly maxChildren: Schema.withDecodingDefaultKey<Schema.brand<Schema.Int, "ChildSessionBudget">, never>;
-    /** Configured Attempt duration ceiling in minutes; defaults to 60. */
-    readonly maxAttemptMinutes: Schema.withDecodingDefaultKey<Schema.Int, never>;
-    /** Configured total-token ceiling per Attempt; defaults to 10,000,000. */
-    readonly maxAttemptTokens: Schema.withDecodingDefaultKey<Schema.Int, never>;
-    /** Parent model used when the Agent has no override; an absent default leaves selection to Pi. */
+    /** The wall-clock limit per Attempt, in minutes, or `None` for no limit. */
+    readonly maxAttemptMinutes: Schema.OptionFromOptionalKey<Schema.Int>;
+    /** The token limit per Attempt, counting the parent and every child, or `None` for no limit. */
+    readonly maxAttemptTokens: Schema.OptionFromOptionalKey<Schema.Int>;
+    /** The parent model for Agents that set none, or `None` to let Pi select it. */
     readonly parentModel: Schema.OptionFromOptionalKey<Schema.brand<Schema.String, "ModelId">>;
-    /** Default parent reasoning effort; if neither Agent nor factory supplies one, the child's effort applies. */
+    /** The parent reasoning effort for Agents that set none, or `None` to use the child's effort. */
     readonly parentEffort: Schema.OptionFromOptionalKey<Schema.Literals<readonly ["off", "minimal", "low", "medium", "high", "xhigh", "max"]>>;
 }>, {}>;
-/** Factory-wide polling, Attempt limits, and defaults for the coordinating parent. */
 export declare class Settings extends Settings_base {
 }
-/** How GitHub hints reach the factory to request earlier polling; routine polling remains the backstop. */
+/** The source of GitHub webhook events that trigger an early poll; polling continues in every mode. */
 export declare const Webhooks: Schema.Union<readonly [Schema.Struct<{
     readonly mode: Schema.Literal<"off">;
 }>, Schema.Struct<{
@@ -64,9 +112,14 @@ declare const UsineConfig_base: Schema.Class<UsineConfig, Schema.Struct<{
         readonly parentModel: "parent_model";
         readonly parentEffort: "parent_effort";
     }>, never>;
-    readonly workers: Schema.withDecodingDefaultKey<Schema.$Array<Schema.encodeKeys<typeof Worker, {
+    readonly workers: Schema.withDecodingDefaultKey<Schema.$Array<Schema.Union<readonly [Schema.encodeKeys<typeof LocalWorker, {
+        readonly maxConcurrentAttempts: "max_concurrent_attempts";
+    }>, Schema.encodeKeys<typeof ExeDevWorker, {
+        readonly maxConcurrentAttempts: "max_concurrent_attempts";
+    }>, Schema.encodeKeys<typeof SshWorker, {
         readonly maxConcurrentAttempts: "max_concurrent_attempts";
-    }>>, never>;
+        readonly identityFile: "identity_file";
+    }>]>>, never>;
     readonly webhooks: Schema.withDecodingDefaultKey<Schema.Union<readonly [Schema.Struct<{
         readonly mode: Schema.Literal<"off">;
     }>, Schema.Struct<{
@@ -79,7 +132,7 @@ declare const UsineConfig_base: Schema.Class<UsineConfig, Schema.Struct<{
     }>]>, never>;
     readonly operator: Schema.OptionFromOptionalKey<Schema.brand<Schema.String, "OperatorLogin">>;
 }>, {}>;
-/** The factory's repository registry, Worker capacity, labels, and operating defaults from `usine.yaml`. */
+/** The decoded `usine.yaml`. */
 export declare class UsineConfig extends UsineConfig_base {
 }
 export {};

package/dist/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAIA,OAAO,EAAU,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAc,IAAI,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAsB,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D,0EAA0E;AAC1E,eAAO,MAAM,WAAW,4CAEvB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,IAAI,CAAC;AAElD,oEAAoE;AACpE,eAAO,MAAM,aAAa,8CAIW,CAAC;AAEtC,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAC;;;;;;AA6BtD,2FAA2F;AAC3F,qBAAa,WAAY,SAAQ,gBAM/B;CAAG;;;;;;AAEL,sFAAsF;AACtF,qBAAa,MAAO,SAAQ,WAI1B;CAAG;;IAIH,qEAAqE;;IAErE,+GAA+G;;IAE/G,sEAAsE;;IAEtE,0EAA0E;;IAE1E,kGAAkG;;IAElG,8GAA8G;;;AAZhH,sFAAsF;AACtF,qBAAa,QAAS,SAAQ,aAa5B;CAAG;AAEL,2GAA2G;AAC3G,eAAO,MAAM,QAAQ;;;;;;;;;IAMnB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuB5C,4GAA4G;AAC5G,qBAAa,WAAY,SAAQ,gBAU/B;CAAG"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAcA,OAAO,EAAU,MAAM,EAAE,MAAM,QAAQ,CAAC;AAExC,OAAO,EAAc,IAAI,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAsB,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D,kDAAkD;AAClD,eAAO,MAAM,WAAW,4CAEvB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,IAAI,CAAC;;;;;;AA6BlD,qBAAa,WAAY,SAAQ,gBAM/B;CAAG;;;;;;AAIL,iEAAiE;AACjE,qBAAa,WAAY,SAAQ,gBAI/B;CAAG;;;;;;AAEL,qDAAqD;AACrD,qBAAa,YAAa,SAAQ,iBAIhC;CAAG;;;;;;;;AAQL;;;;;;;;;;;GAWG;AACH,qBAAa,aAAc,SAAQ,kBAQjC;CAAG;;;;;;;;;;;;;;;AAEL;;;;GAIG;AACH,qBAAa,SAAU,SAAQ,cAiB7B;CAAG;AAEL,uDAAuD;AACvD,eAAO,MAAM,MAAM,oFAAuD,CAAC;AAC3E,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAC;;IAGtC,8DAA8D;;IAE9D,oFAAoF;;IAEpF,4EAA4E;;IAE5E,gGAAgG;;IAEhG,gFAAgF;;IAEhF,iGAAiG;;;AAXnG,qBAAa,QAAS,SAAQ,aAa5B;CAAG;AAEL,uGAAuG;AACvG,eAAO,MAAM,QAAQ;;;;;;;;;IAMnB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8B5C,gCAAgC;AAChC,qBAAa,WAAY,SAAQ,gBAU/B;CAAG"}

package/dist/factory.js

@@ -1,28 +1,24 @@
 import { Effort, ModelId } from "@usine/core/agent/brain";
 import { ChildSessionBudget } from "@usine/core/agent/session";
+import { OperatorLogin } from "@usine/core/operator";
 import { RepositoryName } from "@usine/core/repository";
-import { WorkerName, WorkerKind } from "@usine/core/worker";
+import { GatewayAdminPort, GatewayDomain, GatewayLlmProvider, SshDestination, SshIdentityFile, SshPort, WorkerName, WorkerRoot, } from "@usine/core/worker";
 import { Effect, Schema } from "effect";
-import { nonBlankString } from "./checks.js";
+import { nonBlankString, uniqueRepositoryNames } from "./checks.js";
 import { LaneSource, Lane } from "./board.js";
 import { canonicalLabelName, DeclaredLabel } from "./label.js";
-/** A factory-defined repository grouping that Loops can select by tag. */
+/** A repository tag that Loop selectors match. */
 export const RegistryTag = nonBlankString("Expected a non-blank registry tag").pipe(Schema.brand("RegistryTag"));
-/** GitHub login identifying the human operator for this factory. */
-export const OperatorLogin = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/u, {
-    message: "Expected a GitHub login",
-})).pipe(Schema.brand("OperatorLogin"));
 const PositiveInt = Schema.Int.check(Schema.isGreaterThanOrEqualTo(1));
 const uniqueNames = Schema.makeFilter((values) => new Set(values.map(({ name }) => name)).size === values.length, { message: "Expected unique names" });
-const laneSourceKey = (source) => "label" in source ? `label:${source.label}` : `state:${source.state}`;
+const laneSourceKey = (source) => "label" in source ? `label:${canonicalLabelName(source.label)}` : `state:${source.state}`;
 const uniqueLaneSources = Schema.makeFilter((lanes) => {
     const keys = lanes.flatMap(({ sources }) => sources.map(laneSourceKey));
     return new Set(keys).size === keys.length;
-}, { message: "Expected every lane source to be mapped once" });
+}, { message: "Expected each lane source in only one lane" });
 const Lanes = Schema.Array(Lane).check(uniqueNames, uniqueLaneSources);
 const uniqueLabelNames = Schema.makeFilter((values) => new Set(values.map(({ name }) => canonicalLabelName(name))).size === values.length, { message: "Expected unique GitHub label names" });
 const DeclaredLabels = Schema.Array(DeclaredLabel).check(uniqueLabelNames);
-/** A repository the factory manages, with its selector tags and configured Board lanes. */
 export class ManagedRepo extends Schema.Class("@usine/config/ManagedRepo")({
     name: RepositoryName,
     tags: Schema.Array(RegistryTag)
@@ -31,37 +27,89 @@ export class ManagedRepo extends Schema.Class("@usine/config/ManagedRepo")({
     lanes: Lanes.pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))),
 }) {
 }
-/** A named place to execute Attempts, with the number it may run at the same time. */
-export class Worker extends Schema.Class("@usine/config/Worker")({
+const MaxConcurrentAttempts = PositiveInt.pipe(Schema.withDecodingDefaultKey(Effect.succeed(1)));
+/** A Worker that runs Attempts on the orchestrator's machine. */
+export class LocalWorker extends Schema.Class("@usine/config/LocalWorker")({
     name: WorkerName,
-    kind: WorkerKind,
-    maxConcurrentAttempts: PositiveInt.pipe(Schema.withDecodingDefaultKey(Effect.succeed(1))),
+    kind: Schema.Literal("local"),
+    maxConcurrentAttempts: MaxConcurrentAttempts,
 }) {
 }
-/** Factory-wide polling, Attempt limits, and defaults for the coordinating parent. */
+/** A Worker on the exe.dev VM with the same name. */
+export class ExeDevWorker extends Schema.Class("@usine/config/ExeDevWorker")({
+    name: WorkerName,
+    kind: Schema.Literal("exe.dev"),
+    maxConcurrentAttempts: MaxConcurrentAttempts,
+}) {
+}
+const EnvironmentVariableName = Schema.String.check(Schema.isPattern(/^[A-Za-z_][A-Za-z0-9_]*$/u, {
+    message: "Expected an environment variable name",
+})).pipe(Schema.brand("EnvironmentVariableName"));
+/**
+ * The Gateway in front of an SSH Worker's machine on a private network (ADR 0027).
+ *
+ * - `domain`: the Gateway's private DNS domain.
+ * - `destination`: the Gateway's `ssh` destination, usually the Host alias in the Worker's
+ *   `ProxyJump`. The executor forwards through it to the admin API at `adminPort` on the
+ *   Gateway's loopback interface.
+ * - `adminTokenEnv`: the orchestrator environment variable with the admin token, read when
+ *   `usine up` starts or a reload adds the Worker.
+ * - `llmProviders`: the providers whose credential the Gateway injects. Harnesses for other
+ *   providers, and Codex, use the operator's login on the Worker through the forward proxy.
+ */
+export class WorkerGateway extends Schema.Class("@usine/config/WorkerGateway")({
+    domain: GatewayDomain,
+    destination: SshDestination,
+    adminPort: GatewayAdminPort.pipe(Schema.withDecodingDefaultKey(Effect.succeed(7070))),
+    adminTokenEnv: EnvironmentVariableName,
+    llmProviders: Schema.Array(GatewayLlmProvider)
+        .check(Schema.isUnique())
+        .pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))),
+}) {
+}
+/**
+ * A Linux machine reached with `ssh`, with Worker state under `<root>/workers/<name>`. If
+ * `gateway` is set, the machine stores no GitHub token; the executor sends each Attempt's token
+ * to the Gateway.
+ */
+export class SshWorker extends Schema.Class("@usine/config/SshWorker")({
+    name: WorkerName,
+    kind: Schema.Literal("ssh"),
+    maxConcurrentAttempts: MaxConcurrentAttempts,
+    destination: SshDestination,
+    identityFile: Schema.OptionFromOptionalKey(SshIdentityFile),
+    port: Schema.OptionFromOptionalKey(SshPort),
+    root: WorkerRoot,
+    gateway: Schema.OptionFromOptionalKey(WorkerGateway.pipe(Schema.encodeKeys({
+        adminPort: "admin_port",
+        adminTokenEnv: "admin_token_env",
+        llmProviders: "llm_providers",
+    }))),
+}) {
+}
+/** A configured Worker; `kind` selects the adapter. */
+export const Worker = Schema.Union([LocalWorker, ExeDevWorker, SshWorker]);
 export class Settings extends Schema.Class("@usine/config/Settings")({
-    /** Seconds between routine GitHub polling cycles; defaults to 60. */
+    /** The interval between GitHub polling cycles, in seconds. */
     pollInterval: PositiveInt.pipe(Schema.withDecodingDefaultKey(Effect.succeed(60))),
-    /** Total child sessions allowed over one Attempt's lifetime, including sequential spawns; defaults to four. */
+    /** The maximum number of child sessions per Attempt, counting sequential spawns. */
     maxChildren: ChildSessionBudget.pipe(Schema.withDecodingDefaultKey(Effect.succeed(4))),
-    /** Configured Attempt duration ceiling in minutes; defaults to 60. */
-    maxAttemptMinutes: PositiveInt.pipe(Schema.withDecodingDefaultKey(Effect.succeed(60))),
-    /** Configured total-token ceiling per Attempt; defaults to 10,000,000. */
-    maxAttemptTokens: PositiveInt.pipe(Schema.withDecodingDefaultKey(Effect.succeed(10_000_000))),
-    /** Parent model used when the Agent has no override; an absent default leaves selection to Pi. */
+    /** The wall-clock limit per Attempt, in minutes, or `None` for no limit. */
+    maxAttemptMinutes: Schema.OptionFromOptionalKey(PositiveInt),
+    /** The token limit per Attempt, counting the parent and every child, or `None` for no limit. */
+    maxAttemptTokens: Schema.OptionFromOptionalKey(PositiveInt),
+    /** The parent model for Agents that set none, or `None` to let Pi select it. */
     parentModel: Schema.OptionFromOptionalKey(ModelId),
-    /** Default parent reasoning effort; if neither Agent nor factory supplies one, the child's effort applies. */
+    /** The parent reasoning effort for Agents that set none, or `None` to use the child's effort. */
     parentEffort: Schema.OptionFromOptionalKey(Effort),
 }) {
 }
-/** How GitHub hints reach the factory to request earlier polling; routine polling remains the backstop. */
+/** The source of GitHub webhook events that trigger an early poll; polling continues in every mode. */
 export const Webhooks = Schema.Union([
     Schema.Struct({ mode: Schema.Literal("off") }),
     Schema.Struct({ mode: Schema.Literal("deliveries") }),
     Schema.Struct({ mode: Schema.Literal("endpoint"), publicUrl: Schema.URLFromString }).pipe(Schema.encodeKeys({ publicUrl: "public_url" })),
 ]);
-// Authored YAML keys are snake_case and domain fields camelCase. The rename
-// happens once here and encodes back for edits.
 const SettingsFromYaml = Settings.pipe(Schema.encodeKeys({
     pollInterval: "poll_interval",
     maxChildren: "max_children",
@@ -70,10 +118,17 @@ const SettingsFromYaml = Settings.pipe(Schema.encodeKeys({
     parentModel: "parent_model",
     parentEffort: "parent_effort",
 }));
-const WorkerFromYaml = Worker.pipe(Schema.encodeKeys({ maxConcurrentAttempts: "max_concurrent_attempts" }));
-const ManagedRepos = Schema.Array(ManagedRepo).check(uniqueNames);
+const WorkerFromYaml = Schema.Union([
+    LocalWorker.pipe(Schema.encodeKeys({ maxConcurrentAttempts: "max_concurrent_attempts" })),
+    ExeDevWorker.pipe(Schema.encodeKeys({ maxConcurrentAttempts: "max_concurrent_attempts" })),
+    SshWorker.pipe(Schema.encodeKeys({
+        maxConcurrentAttempts: "max_concurrent_attempts",
+        identityFile: "identity_file",
+    })),
+]);
+const ManagedRepos = Schema.Array(ManagedRepo).check(uniqueRepositoryNames((repo) => repo.name));
 const Workers = Schema.Array(WorkerFromYaml).check(Schema.isNonEmpty(), uniqueNames);
-/** The factory's repository registry, Worker capacity, labels, and operating defaults from `usine.yaml`. */
+/** The decoded `usine.yaml`. */
 export class UsineConfig extends Schema.Class("@usine/config/UsineConfig")({
     version: Schema.Literal(1),
     labels: DeclaredLabels.pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))),