feat(repo): dokimi_config.v1 schema and repo_config loader

dokimi/changelog.d/20261030_180000_napetrov_feat-repo-config.md

@@ -0,0 +1,22 @@
+<!--
+Copyright (C) 2026 Intel Corporation
+SPDX-License-Identifier: Apache-2.0
+-->
+
+### Added
+
+- **`dokimi_config.v1`, the repository config schema and loader (library only, no CLI yet)** — a
+  repository's `.github/dokimi/config.yaml` (or `.dokimi/config.yaml`) declares its subjects (skills, and
+  the repository itself with `kind: repo`), where each subject's evals are (beside the skill by default,
+  or a central glob such as `evaluation/harbor/tasks/onetbb-*`), the plan defaults, `shared` paths for
+  the smoke set, and the budget and baseline store. The loader `dokimi.repo_config` finds the file in
+  the order explicit path, `.github/dokimi/config.yaml`, `.dokimi/config.yaml` under the repository root,
+  validates it against the schema, and reports each subject's `skill_sha` (the tree digest of the skill
+  directory without its evals and without any nested skill directory, which is its own subject) and
+  `suite_hash`. A skill's suite claims whole directories of its skill (its evals, or a directory such as
+  `tests/**`), and those directories leave `skill_sha`. A suite that picks an individual file of its skill
+  (`SKILL.md`, a script, a reference, one eval file) is refused at load, naming the subject and the file. A link in a suite that resolves into its skill is refused too. An explicit subject whose id is taken by a default skill at another directory is refused instead of silently replacing it. `baseline.store: false`
+  reads as `off`, and a budget number that YAML reads as text (`1e3`) is refused with the plain
+  decimal or the `1.0e+3` spelling, and a `.nan` or `.inf` budget is refused. A suite directory is
+  hashed file by file, following symlinks; a link also counts by its target text, so an edit to a shared eval, or a retarget of its link, moves `suite_hash`. Nothing reads the file yet: the commands that use it come later,
+  and existing `.agent-eval/` lookups are unchanged.

dokimi/docs/reference/cli-interface.json

@@ -13143,6 +13143,7 @@
                 "'answers'",
                 "'arms'",
                 "'cli_routes'",
+                "'dokimi_config'",
                 "'effective_instructions'",
                 "'eval'",
                 "'eval_coverage'",

dokimi/dokimi/artifacts.py

@@ -14,8 +14,9 @@
 ``result`` (one status per planned cell), ``repo_budget`` (what a repository puts
 into an agent's context), ``effective_instructions`` (the effective-instructions/v0
 receipt of a reach probe), ``need_graph`` and ``eval_coverage`` (a frozen need graph and an
-eval set's coverage of it) and ``task_inspect`` (which eval-task format each
-path under a tree is). This module stamps each with a
+eval set's coverage of it), ``task_inspect`` (which eval-task format each
+path under a tree is) and ``dokimi_config`` (a repository's subjects and where
+their evals are). This module stamps each with a
 ``schema_version`` and validates it against the JSON Schema in
 ``dokimi/schemas/`` on save and load, so fixtures and baselines stay
 forward-compatible and self-describing.
@@ -63,6 +64,7 @@
     "task_inspect": "task_inspect.v1",
     "redteam": "redteam.v1",
     "cli_routes": "cli_routes.v1",
+    "dokimi_config": "dokimi_config.v1",
     "need_graph": "need_graph.v1",
     "eval_coverage": "eval_coverage.v1",
 }

dokimi/dokimi/commands/repo_run.py

@@ -20,6 +20,7 @@
 
 from dokimi.repos.harness_profile import DELEGATION_MODES
 from dokimi.exit_codes import EXIT_USAGE
+from dokimi.utils import tree_digest
 
 
 def _context(args: argparse.Namespace, out: Path, pin: bool = False):
@@ -59,14 +60,14 @@ def _context(args: argparse.Namespace, out: Path, pin: bool = False):
         sha = getattr(tree, "sha", None)
         if sha is None:  # a working tree: tag by what is built, or an edited Dockerfile reuses a stale image
             ctx_dir = export_build_context(tree, manifest, out / "_eval" / "build-context")
-            tag = "worktree-" + context_digest(ctx_dir)[:12]
+            tag = "worktree-" + tree_digest(ctx_dir)[:12]
         else:
             tag = sha[:12]
         image = f"dokimi/{slug(manifest.id).lower()}:{tag}"
     elif not runner.image_exists(image):
         raise ValueError(f"--image {image} does not exist")
     if pin:
-        stamp = {"tree": tree.label, "eval_dir": context_digest(staged), "image": image}
+        stamp = {"tree": tree.label, "eval_dir": tree_digest(staged), "image": image}
         if _uses_builtin_graders(staged, manifest):  # else no score depends on them: an upgrade keeps the batch
             stamp["graders"] = graders_digest()
         _pin_batch(out, stamp)
@@ -95,24 +96,6 @@ def _context(args: argparse.Namespace, out: Path, pin: bool = False):
     return ctx, tree
 
 
-def context_digest(root: Path) -> str:
-    """sha256 over every path, mode bit and byte of a build context (a link by its target)."""
-    import hashlib
-    import os
-
-    h = hashlib.sha256()
-    for path in sorted(root.rglob("*")):
-        rel = path.relative_to(root).as_posix()
-        if path.is_symlink():
-            h.update(f"L {rel}\0{os.readlink(path)}\0".encode())
-        elif path.is_file():
-            h.update(f"F {rel}\0{int(os.access(path, os.X_OK))}\0".encode())
-            h.update(hashlib.sha256(path.read_bytes()).digest())
-        elif path.is_dir():
-            h.update(f"D {rel}\0".encode())
-    return h.hexdigest()
-
-
 def _require_grade(content: Path, manifest: RepoManifest, ids: list[str] | None) -> None:
     """Refuse the selected tasks when one needs ``entry_points.grade`` and the manifest has none."""
     from dokimi.repos.manifest import ManifestError, TaskSummary, grade_problems