config: keyproxy mpk refs, loop daemon knobs, redmine status map, gitea section

mpk: key refs resolve through the ukrrs/mopac-keyproxy hop ([keyproxy]
url + token_ref, POST /v1/resolve, short in-memory cache); env:/file:/
literal: refs keep working untouched, so the harness runs with or
without keyproxy up. [loop] gains poll_interval_secs + state_dir for the
self-host daemon; [redmine.status_map] (quoted TOML keys) drives status
transitions; [gitea] carries the optional REPORT-commit step, off by
default. All hosts live in harness.toml, none in code.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

harness.toml.example

@@ -1,8 +1,9 @@
 # MOPAC harness configuration, v0 (2026-08-28).
 #
 # Copy to harness.toml and adjust. harness.toml is gitignored: secrets never
-# live in this file, only refs (env:NAME | file:PATH | literal:VALUE; the
-# bw: bitwarden ref lands with the key wrapper in build phase 3).
+# live in this file, only refs (env:NAME | file:PATH | literal:VALUE |
+# mpk:PLACEHOLDER via [keyproxy]; the bw: bitwarden ref lands with the key
+# wrapper in build phase 3).
 
 # Vertical / stack identity for this harness instance.
 vertical = "demo"
@@ -15,6 +16,10 @@ report_dir = "reports"
 [loop]
 # Bounded turn: max LLM round trips per task (tool calls included).
 max_rounds = 8
+# `harness loop` daemon: Redmine scan interval and state location
+# (append-only loop.jsonl, dedup by issue id + updated_on).
+poll_interval_secs = 120
+state_dir = "state/loop"
 
 [redmine]
 url = "https://rm.example.org"
@@ -27,12 +32,37 @@ scope_query = "project=mopac&status_id=released&limit=25"
 class_field = "Class"
 default_class = "primary"
 
+# `harness loop` status transitions: after a REPORT is noted back on the
+# issue, an issue whose CURRENT status matches a key here is moved to the
+# value. Statuses are names (resolved via /issue_statuses.json); an empty
+# map leaves status alone.
+[redmine.status_map]
+"In Progress" = "Done"
+
 [litellm]
 base_url = "http://192.168.3.78:4001"
 key_ref = "env:HARNESS_LITELLM_KEY"
 timeout_secs = 120
 max_retries = 2
 
+# KEYPROXY (optional): resolve `mpk:` key refs through the ukrrs/mopac-keyproxy
+# hop (POST /v1/resolve, bearer auth). Without this section, env:/file:/
+# literal: refs keep working as-is — the loop runs with or without keyproxy up.
+# [keyproxy]
+# url = "http://127.0.0.1:8082"
+# token_ref = "env:HARNESS_KEYPROXY_TOKEN"   # local ref only (no mpk: recursion)
+# cache_ttl_secs = 60
+
+# GITEA (optional, off by default): `harness loop` commits each REPORT file
+# to this repo right after writing it (contents API, create-or-update).
+# [gitea]
+# url = "https://git.example.org"
+# key_ref = "env:HARNESS_GITEA_KEY"
+# owner = "ukrrs"
+# repo = "MOPAC-reports"
+# branch = "main"          # empty = repo default branch
+# commit_reports = false
+
 # MODEL ROUTING v0 (static, config-only, no heuristics): [models] is the
 # tier map (tier alias -> concrete proxy model); [models.classes] maps task
 # classes to tiers. Requests go out with the CONCRETE model name resolved