Capacity changes live, never by restart: concurrency, shards and egress mode set by an admin, audited #903

Closes #874

Touches hot files: src/core/schema.ts (migration 62, appended last), src/http/api.ts, src/http/server.ts, src/http/mcp.ts and scripts/gate.ts. Changes one shared class: Gate (src/git/env.ts) gains resize(limit), and its limit is now a getter, so every existing caller is unchanged. No shared function's contract changes; in particular, childEnv is untouched.

What changes

• Live settings. src/core/capacity.ts holds four settings, each read where it is used, on every pick:

- crew.concurrency - checks.concurrency - checks.shards - cells.egress

The environment (FORGE_CREW_CONCURRENCY, FORGE_CHECKS_CONCURRENCY, FORGE_CHECK_SHARDS, FORGE_CELLS_EGRESS) stays the boot default. A stored value overrides it until it is cleared. Every change is kept as who, when, from and to.

• Where each setting is read.

- The check service reads its concurrency on every schedule() and resizes its gate. Lowering it lets running checks finish, and the next one waits. - The crew's pump reads its concurrency on every pump. - The shard count reaches a check's commands, and an agent's Claude Code process and so its shell, as an explicit FORGE_CHECK_SHARDS set by the launcher from the setting. It never comes from the pod's environment. - The egress mode is read at every cell start: app, preview, terminal, and install, test and check steps. Flipping report to enforce is the emergency lever, and it reaches the next cell without a roll. The app page's egress card states the mode in force.

• Who can change it. src/actions/capacity.ts allows a forge admin only, and never an agent. Everyone else gets not_found. Each change emits a capacity.changed event carrying key, from, to and actor.
• Where it can be changed.

- Settings → Capacity, /settings/capacity: an admin-only page listing each setting with its value, its source and a reset to the default, followed by the change history. - GET /api/v1/admin/capacity and PUT /api/v1/admin/capacity/:key with { value } (null restores the default). - The capacity MCP tool. It plans by default; making a change needs an admin-scope token.

• docs/APPS.md (Configuration) documents all of the above.

Tests (test/capacity.test.ts, added to the gate). The refusing tests come first:

• A member, an agent and an anonymous user are refused at every door: the action, the page, the form post, the API and MCP. Nothing changes and nothing is recorded.
• An admin's read-only token may read but not change.
• An admin changes settings from the page, the API and MCP. Wrong values and unknown keys are refused, a reset returns the default, and the change history reads back exactly.
• Gate.resize: when the limit is lowered, holders keep their permits and the next caller waits; when it is raised, waiters go at once.
• Checks: the service is booted at 3 at once and an admin lowers it to 1. Three repositories' checks then run one at a time (at most 1 ever running), and each check's log shows shards=2, the value the admin set.
• Crew: booted at 1 and raised to 2 by the admin; two agents' runs go at once. Each fake Claude process receives FORGE_CHECK_SHARDS=4, the value the admin set.
• Egress: flipping report to enforce changes the mode handed to the next cell start, with the same runtime and no restart.
• test/mcp.test.ts now lists the new tool.

Checks run. I merged main 6b03138 (one migration crossed, so mine is now 62). bun x tsc --noEmit is clean. One bun test call covering this pull's files, the files it touches and the five cross files passed 381 of 381: capacity, checks, contain, mcp, here-manifest, secret-store, crew-sandbox, migrate, schema-migrations, reserved-names, studio, shards, check-list and hollow.

🤖 Generated with Claude Code