Config

Config is where an operator changes how an agent behaves. It has five tabs, matching the TUI and GUI surfaces and the JSON API:

Tab	What it edits	API
Settings	Writable config keys	GET/PATCH /api/config
Credentials	Encrypted secrets	GET /api/credentials, GET /api/credentials/catalog, PUT, DELETE /api/credentials/{id}
Health checks	Safety checks per environment	GET/POST /api/health-checks, PATCH/DELETE /api/health-checks/{id}
Skills	Agent skills and their steps	GET/POST /api/skills, PATCH/DELETE /api/skills/{id}
Tooling	Read-only readiness report	GET /api/tooling

Settings

Settings renders every key in WRITABLE_CONFIG_KEYS that the API accepts. Select a row to edit it inline; the editor shape depends on the key:

• Select — enumerated keys such as delivery_profile (live/source), pr_merge_method (squash/rebase/merge), coding_runtime (claude/grok/codex/opencode/pi), monitor_environment (staging/production), and staging_deploy_strategy (workflow/merge_pr).
• Number — intervals and limits such as max_workers, worker_timeout_minutes, github_sync_minutes, harness_converge_minutes, watchdog_interval_secs, production_monitor_minutes, optimize_performance_hours, and pentest_hours.
• Bool — self_heal_codehealth.
• Text — everything else, including paths, URLs, and free-form values.

Representative keys by area:

• GitHub: github_repo, github_app_id, pickup_labels.
• Delivery: delivery_profile, pr_merge_method, staging_deploy_strategy, staging_deploy_workflow, prod_deploy_workflow, staging_soak_minutes, deploy_workflow_inputs.
• Capacity: max_workers, worker_timeout_minutes, worker_checkpoint_minutes, dispatch_min_available_mb, max_compile_slots, worker_memory_max.
• Cadence: github_sync_minutes, harness_converge_minutes, watchdog_interval_secs, production_monitor_minutes, self_heal_minutes, optimize_performance_hours, pentest_hours.
• Session memory: memory_s3_endpoint, memory_s3_bucket, memory_s3_prefix, memory_embed_model, memory_embed_cache_dir, memory_retrieve_limit, memory_retrieve_candidates.
• Self-heal: self_heal_minutes, self_heal_max_issues, self_heal_codehealth.
• Security audit: pentest_target_url, pentest_timeout_minutes, pentest_instruction.
• Misc: external_url.

Patching is validated before any write: if one key is not writable, the whole patch is rejected and nothing changes. An empty value deletes the key. A successful patch broadcasts config_changed and is recorded as config.patch in the audit log.

Credentials

The Credentials tab shows the well-known service catalog with a [set] / [ ] badge and the master-key status. Pick a service to edit its target URL and secret, or delete it. Secrets are written encrypted; listing never returns secret material. See Credentials for the service list and shapes.

Health checks

The Health checks tab creates and edits safety checks: name, kind, environment, required flag, and a JSON config. Kinds are http_health, ci_workflow, metric_threshold, and smoke_test. See Health checks for config shapes and how they gate deploys.

Skills

The Skills tab lists builtins (read-only, viewable) and DB-backed skills (editable). Create a skill from its full SKILL.md text (including the name: frontmatter) and tag it to worker-spawning steps. See Skills.

Caution

Builtin skills cannot be edited, deleted, or overridden by name. The API rejects mutations on any builtin: id.

Gotchas

• A PATCH /api/config with an empty value deletes that config row rather than storing an empty string.
• A failed config write reports the key that failed and returns 500; the config is not reported as persisted unless it was.
• The tooling report is derived from credentials and installed binaries; adding a credential can change readiness immediately.