project

type AgentSpec struct {
	ID   string `toml:"id"`   // stable per-island handle: "a1", "a2", …
	Type string `toml:"type"` // handler id: "claude-code", "codex", "headless"
	// Label is a user-facing, renamable name (e.g. "frontend"). Cosmetic.
	Label string `toml:"label,omitempty"`
	// Cmd is the entrypoint for headless agents; empty for the CLI agents.
	Cmd string `toml:"cmd,omitempty"`
	// Tmux is the in-container tmux session name for interactive agents. Empty
	// for headless. The migrated primary keeps "dejima" so a live attached
	// session survives a daemon upgrade; new agents use "agent-<id>".
	Tmux string `toml:"tmux,omitempty"`
	// Branch is the git branch backing this agent's worktree.
	Branch string `toml:"branch,omitempty"`
	// Worktree is the container path the agent works in: "/workspace" for the
	// primary, "/workspace/.agents/<id>" for the rest.
	Worktree string `toml:"worktree,omitempty"`
	// Restart enables supervise-and-restart-on-crash for co-located headless agents.
	Restart bool `toml:"restart,omitempty"`
	// Provider names which daemon LLM-provider credential this agent uses (see
	// internal/providercreds), e.g. "anthropic". Empty → the store default. Only
	// meaningful when the handler RequiresProviderKey.
	Provider string `toml:"provider,omitempty"`
	// Model is the "provider/model" string handed to the framework (via the
	// DEJIMA_MODEL env the per-agent shim translates). Empty → unset (the user
	// picks explicitly; there is no baked-in default).
	Model     string    `toml:"model,omitempty"`
	CreatedAt time.Time `toml:"created_at,omitempty"`
}

type CapabilityGrant struct {
	Target    string    `toml:"target"`
	GrantedAt time.Time `toml:"granted_at"`
}

type MCPGrant struct {
	Server    string    `toml:"server"`
	GrantedAt time.Time `toml:"granted_at"`
}

type PortScope struct {
	// Name is the short, slug handle used to address the scope in Trades and the
	// Ledger (e.g. "vault"). Derived from the host path's basename; unique within
	// the island.
	Name string `toml:"name"`
	// HostPath is the absolute host directory granted. The broker never serves
	// anything outside it.
	HostPath string `toml:"host_path"`
	// Mode is "ro" or "rw".
	Mode      string    `toml:"mode"`
	GrantedAt time.Time `toml:"granted_at"`
}

type Project struct {
	Name string `toml:"name"`
	// Title is a cosmetic, freely-editable display name. Name stays the durable
	// infra handle (container/volume/network/config-dir identity, and the slug
	// addressed by the CLI); Title is what the user reads. Empty → show Name.
	Title   string `toml:"title,omitempty"`
	RepoURL string `toml:"repo"`
	// Agent and Cmd are the pre-multi-agent scalar fields. They are retained for
	// backward compatibility (older daemons read them) and mirror Agents[0]. New
	// code should read Agents; PrimaryAgent() is the accessor.
	Agent string `toml:"agent"`
	Image string `toml:"image"`
	// Cmd is the command to run inside the island when Agent is "headless".
	// It is ignored for the built-in CLI agents (claude-code, codex), which
	// have a baked-in command. Persisted so reset/reprovision can reuse it.
	Cmd          string      `toml:"cmd,omitempty"`
	Resources    Resources   `toml:"resources,omitempty"`
	CreatedAt    time.Time   `toml:"created_at"`
	LastUsedAt   time.Time   `toml:"last_used_at"`
	DesiredState State       `toml:"state"`
	Agents       []AgentSpec `toml:"agents,omitempty"`
	// Role is the island's purpose: "" (a work island) or "home" (a Home Island
	// hosting an assistant brain). Empty for islands created before roles existed.
	Role string `toml:"role,omitempty"`
	// GitHubIdentity names which of the daemon's GitHub identities this island
	// clones and pushes as (see internal/githubid). Empty means the daemon's
	// default identity, or — when the store is empty — the host's ~/.config/gh.
	GitHubIdentity string `toml:"github_identity,omitempty"`
	// Ports are brokered host-filesystem grants for this island (see ports.go).
	// Empty means deny-all: the island reaches no host content outside its repo.
	Ports []PortScope `toml:"ports,omitempty"`
	// Capabilities are brokered host-action grants for this island (see
	// capabilities.go and docs/capability-broker-spec.md). Empty means deny-all:
	// the island may invoke no host capabilities.
	Capabilities []CapabilityGrant `toml:"capabilities,omitempty"`
	// LinkActions are the named, typed action types THIS island exposes for
	// cross-island delegation (Lane 5, Phase 3). Another island may invoke one of
	// these only if it ALSO holds a link grant authorizing it (or an operator
	// approves ad hoc). Empty means deny-all: this island exposes no actions.
	LinkActions []string `toml:"link_actions,omitempty"`
	// Owner is a free-form creator label (e.g. "alice@laptop"), captured at
	// create time. Purely informational — there is no auth model yet — but it
	// lets wrapper dashboards attribute islands per person/team. Empty for
	// islands created before ownership existed.
	Owner string `toml:"owner,omitempty"`
	// Tags are free-form key=value labels (e.g. team=web, env=staging) for
	// grouping and per-team rollups in wrapper tooling. Empty when untagged.
	Tags map[string]string `toml:"tags,omitempty"`
}

type Resources struct {
	Memory string `toml:"memory,omitempty"` // e.g. "4G"
	CPUs   string `toml:"cpus,omitempty"`   // e.g. "2.0"
	Disk   string `toml:"disk,omitempty"`   // e.g. "20G" — maps to --storage-opt size=
	// OOMPriority stack-ranks islands for the kernel OOM killer: higher = more
	// protected (killed later). nil = unset → resolved to a smart default at
	// create (headless brains start expendable). Mapped to docker --oom-score-adj
	// (inverted) in the api layer. Set-at-create only; a change needs a recreate.
	OOMPriority *int `toml:"oom_priority,omitempty"`
}

type State string