[Unit]
Description=cleveragents controller — worker instance %i
Documentation=file:///etc/cleveragents/RUNBOOK.md
# Master initializes the DB schema via create_all on startup; workers
# should not race that.
After=network-online.target postgresql.service opencode.service cleveragents-controller-master.service
Wants=network-online.target cleveragents-controller-master.service
# Template unit. Enable per-instance via:
#   systemctl enable --now cleveragents-controller-worker@implementer-1
#   systemctl enable --now cleveragents-controller-worker@reviewer-1
# %i becomes the worker's role-pool identifier. The same env file
# (with CLEVERAGENTS_WORKER_ROLES_%i override) configures which roles
# this instance dequeues.

[Service]
Type=simple
User=cleveragents
Group=cleveragents
WorkingDirectory=/opt/cleveragents-core
EnvironmentFile=/etc/cleveragents/worker.env
# Per-instance override file (optional): /etc/cleveragents/worker.%i.env
# overrides anything in worker.env for this specific instance.
EnvironmentFile=-/etc/cleveragents/worker.%i.env

# CLEVERAGENTS_WORKER_ROLES is read from env (default = all 5 roles).
# Per-instance env files override it to specialize pools — e.g. for
# instance "implementer-1" set CLEVERAGENTS_WORKER_ROLES=implementer
# in /etc/cleveragents/worker.implementer-1.env.
ExecStart=/opt/cleveragents-core/.venv/bin/python -m tools.controller.worker \
    --opencode-url=${CONTROLLER_OPENCODE_URL} \
    --log-level=${CONTROLLER_LOG_LEVEL}

KillSignal=SIGTERM
TimeoutStopSec=60s
# Longer than master because in-flight attempts get a graceful
# heartbeat-driven stop (worker waits for current attempt to finish
# OR for its TTL to pass).
Restart=always
RestartSec=10s
RestartPreventExitStatus=2

LimitNOFILE=8192

# Hardening
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/cleveragents /var/log/cleveragents /tmp
# Workers spawn per-attempt MCP subprocesses; need /tmp writable.
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true

StandardOutput=journal
StandardError=journal
SyslogIdentifier=cleveragents-worker-%i

[Install]
WantedBy=multi-user.target