Configuration reference

Every record of the organisation specification, with defaults, validation rules and the provider's computed attributes.

The same schema is used everywhere: in Terraform's typed spec attribute, in the AgentOrganization CRD, and in the controller. One compiler validates it at terraform plan time and again in the controller, so the two can never disagree. Field names are snake_case. Map keys are stable keys matching ^[a-z][a-z0-9_]{0,62}$.

Provider

provider "steadmesh" {
  kubeconfig_path = "~/.kube/config"   # optional; standard loading rules otherwise
  kube_context    = "kind-steadmesh"    # required; the ambient context is never used
  namespace       = "steadmesh-example" # required; the organisation namespace
}

The provider fails early if the cluster does not serve steadmesh.io/v1alpha1, which means the platform stage has not been applied.

Resource steadmesh_organization

Import. terraform import steadmesh_organization.this <namespace>/<key>. Objects managed by Helm are rejected. An object with no owner annotation needs explicit adoption: <namespace>/<key>/adopt.

Spec records

culture_refs

A list of instruction references applied to every seat, first.

Reference formats

team_templates

Templates are resolved by the provider. The object written to Kubernetes contains only concrete teams.

teams

Teams have no member list. Seats declare their teams.

seats

memory_stores

shared_workspaces

Fields: access_mode (required; ReadWriteMany or ReadOnlyMany, which the storage class must support), storage_class, size_gb (default 5) and retention. Declaring and granting shared workspaces is validated, but mounting them into seats is not implemented yet in this release.

harness_profiles

Changing a profile's adapter, model, API or settings changes the seat's configuration revision: the seat reaches a turn boundary and its Pod is replaced. The seat keeps its identity, volume, memory, inbox and handoff. The same harness resumes its native session; a different harness starts a new session from the portable handoff, which the next turn and the console report.

execution_profiles

access_profiles

Practical access from a seat's sandbox, one plugin per field: tools (binaries), egress (hosts), network (rules of cidr, ports, protocol), github (connection, repos, permissions, delivery) and browser (session.connection). Seats and teams name profiles in access_profiles; a seat gets the union of its own and its teams' profiles. See Sandbox access.

sandbox_profiles

connections

Operations a grant can name: Slack channel.reply (normally implicit through bindings); Linear project.read, project.create, task.read, task.write, comment.write; model connections model.infer (normally implicit through the harness).

grants

Only three permissions are implicit: a seat's own personal_memory (all memory operations), model.infer on its harness's model connection, and channel.reply to the human it is bound to. Each appears in the seat's capability manifest with an implicit: source.

message_routes

channel_bindings

work_publication (optional)

Publishes the work items of shared memory stores to a tracker, so people can follow progress there. Agents coordinate in memory and messages either way. They can also use the tracker directly through connections.invoke whenever they are granted it, independently of publication.

Each work item becomes one issue, titled <store>/W-<n>: <objective>, with its status, owner, plan, acceptance criteria and evidence in the description. Later changes update the same issue. Publication runs in the background and is retried while the tracker is unavailable. Its state is shown per item in the console's Work view, separately from the work itself. A crash between creating an issue and recording it is resolved by reading the issue back, never by creating a duplicate. This is outward only: edits made in the tracker do not change work items, although agents can read them with task.read and comment.read.

Limits

• The serialised specification is limited to 256 KiB. Reference large documents by digest instead of inlining them.
• Seat object names are derived deterministically and kept short enough for Kubernetes: seat-<key>-<8 hex>.
• The defaults above belong to defaults_version = 1, which is recorded in every effective manifest.

Modules

Steadmesh documentation. Source: docs/ in the repository.