Credentials, projects and personas
Everything below is configured in the web UI by a board member and stored in the database. Every create and edit is audited with the old and new values.
Credential references
Dark Factory never stores secret values. A credential reference names a Kubernetes Secret in the instance namespace and a key in it; the control plane reads the value when it uses it.
- Create the Secret, for example
kubectl -n dark-factory create secret generic claude-token --from-file=token=<file>. - Credentials → New credential reference: a name, the Secret name and the key.
Two kinds of credentials are referenced:
| Credential | Used by | Reaches the sandbox |
|---|---|---|
| Forge credential (a token of a bot account) | the forge plugins (API) and the Git proxy | never |
Harness credential (for example a Claude subscription token, CLAUDE_CODE_OAUTH_TOKEN) | the agent harness | yes, in memory over the agent channel, at every connect |
Projects
Projects → New project:
| Field | Meaning |
|---|---|
| Name, Key | Display name and the task key prefix (DF → tasks DF-1, DF-2, …). The key is 2–10 capital letters or digits, starting with a letter, and cannot change later. |
| Repository URL | HTTPS clone URL. Its host selects the forge plugin; the hint below the field names it. |
| Base branch | Where task branches start and pull requests point to. |
| Issue tracker URL | Optional. |
| Sandbox image | The image the agent works in. It needs git and a shell; the runtime and the harness are mounted into it. |
| Adapter command | Optional. Replaces the instance’s harness image for this project (a harness installed in the sandbox image). |
| Forge credential | The credential reference for the forge. |
The Push checks tab sets what the Git proxy checks for this project: protected paths, secret scan and blob size, each in mode approval or reject, and whether merge commits are allowed.
The project list shows the number of queued, running, waiting and done tasks per project.
Personas
A persona is an agent with a role. Personas → New persona:
| Field | Meaning |
|---|---|
| Name | Shown in the task list and transcript, for example “Linus”. |
| System prompt | The role and the working rules of this agent. |
| Harness | The coding agent that runs in the sandbox (claude-code). |
| Model | Optional; empty uses the harness default. |
| Harness credential | The credential reference the harness logs in with. |
Every task is assigned to one persona; the persona’s harness, model and prompt apply to all runs of the task.