diff --git a/experimental/runme.yaml b/experimental/runme.yaml
index 6265bdff7..b616a697f 100644
--- a/experimental/runme.yaml
+++ b/experimental/runme.yaml
@@ -6,10 +6,27 @@
 # You can test it with the "runme beta" commands.
 version: v1alpha1
 
-# Indicate the root of the runme project. "." means that
-# the project root directory will be used.
+# config settings that often use default or a set at points of integration
+kernel:
+  server:
+    # Also unix:///path/to/file.sock is supported.
+    address: localhost:7890
+    tls:
+      enabled: true
+      # If not specified, default paths will be used.
+      # cert_file: "/path/to/cert.pem"
+      # key_file: "/path/to/key.pem"
+
+  log:
+    enabled: true
+    path: "/var/tmp/runme.log"
+    verbose: true
+
+# config settings that apply at the repo-level
 project:
-  dir: "."
+  # Indicate the root of the runme project. "." means that
+  # the project root directory will be used.
+  root: "."
   # If true, the project root will be searched upwards starting from "dir".
   # If found, the repo root will be used as the project root.
   find_repo_upward: true
@@ -18,41 +35,27 @@ project:
     - ".venv"
   disable_gitignore: false
 
-# It's possible to point at a single file as well.
-# filename: "README.md"
+  # It's possible to point at a single file as well.
+  # filename: "README.md"
 
-# List of dotenv files to load.
-env:
-  use_system_env: true
-  sources:
-    - ".env"
-    - ".env.local"
-
-# The list of filters to apply to blocks.
-# "condition" must return a boolean value.
-# You can learn about the syntax at https://expr-lang.org/docs/language-definition.
-# Available fields are defined in [config.FilterDocumentEnv] and [config.FilterBlockEnv].
-filters:
-  # Do not allow unnamed code blocks.
-  - type: "FILTER_TYPE_BLOCK"
-    condition: "is_named"
-  # Do not allow code blocks without a language.
-  - type: "FILTER_TYPE_BLOCK"
-    condition: "language != ''"
-  # Do not allow code blocks starting with "test".
-  - type: "FILTER_TYPE_BLOCK"
-    condition: "!hasPrefix(name, 'test')"
-
-server:
-  # Also unix:///path/to/file.sock is supported.
-  address: localhost:7890
-  tls:
-    enabled: true
-    # If not specified, default paths will be used.
-    # cert_file: "/path/to/cert.pem"
-    # key_file: "/path/to/key.pem"
+  # List of dotenv files to load.
+  env:
+    use_system_env: true
+    sources:
+      - ".env"
+      - ".env.local"
 
-log:
-  enabled: true
-  path: "/var/tmp/runme.log"
-  verbose: true
+  # The list of filters to apply to blocks.
+  # "condition" must return a boolean value.
+  # You can learn about the syntax at https://expr-lang.org/docs/language-definition.
+  # Available fields are defined in [config.FilterDocumentEnv] and [config.FilterBlockEnv].
+  filters:
+    # Do not allow unnamed code blocks.
+    - type: "FILTER_TYPE_BLOCK"
+      condition: "is_named"
+    # Do not allow code blocks without a language.
+    - type: "FILTER_TYPE_BLOCK"
+      condition: "language != ''"
+    # Do not allow code blocks starting with "test".
+    - type: "FILTER_TYPE_BLOCK"
+      condition: "!hasPrefix(name, 'test')"
diff --git a/internal/api/runme/config/v1alpha1/config.proto b/internal/api/runme/config/v1alpha1/config.proto
index d5a428fb1..be8ddca7e 100644
--- a/internal/api/runme/config/v1alpha1/config.proto
+++ b/internal/api/runme/config/v1alpha1/config.proto
@@ -6,14 +6,45 @@ import "buf/validate/validate.proto";
 
 option go_package = "github.com/stateful/runme/internal/gen/proto/go/runme/config/v1alpha1;configv1alpha1";
 
-// Config describes the configuration of the runme tools, including CLI, server, and clients like VS Code extension.
-message Config {
+// Kernel describes system-level configuration of the runme toolchain.
+message Kernel {
+  // log contains the log configuration.
+  Log log = 1;
+
+  Server server = 2;
+
+  message Log {
+    // enabled indicates whether to enable logging.
+    bool enabled = 1;
+
+    // path is the path to the log output file.
+    string path = 2;
+
+    // verbose is the verbosity level of the log.
+    bool verbose = 3;
+  }
+
+  message Server {
+    string address = 1;
+
+    TLS tls = 2;
+
+    message TLS {
+      bool enabled = 1;
+      string cert_file = 2;
+      string key_file = 3;
+    }
+  }
+}
+
+// Project describes repo-level configuration of the runme toolchain.
+message Project {
   // source is a source of Markdown files to look into.
   oneof source {
     option (buf.validate.oneof).required = true;
 
-    // project indicates a dir-based source typically including multiple Markdown files.
-    Project project = 1;
+    // root indicates a dir-based source typically including multiple Markdown files.
+    string root = 1;
 
     // filename indicates a single Markdown file.
     string filename = 2;
@@ -22,29 +53,27 @@ message Config {
   // env is the environment variables configuration.
   Env env = 3;
 
-  // filters is a list of filters to apply.
-  // Filters can be applied to documents or
-  // individual code blocks.
-  repeated Filter filters = 5;
+  // find_repo_upward indicates whether to find the nearest Git repository upward.
+  // This is useful to, for example, recognize .gitignore files.
+  bool find_repo_upward = 4;
 
-  // log contains the log configuration.
-  Log log = 7;
+  // ignore_paths is a list of paths to ignore relative to dir.
+  repeated string ignore_paths = 5 [json_name = "ignore"];
 
-  Server server = 8;
+  // disable_gitignore indicates whether to disable the .gitignore file.
+  bool disable_gitignore = 6;
 
-  message Project {
-    // dir is the directory to look for Markdown files.
-    string dir = 1;
-
-    // find_repo_upward indicates whether to find the nearest Git repository upward.
-    // This is useful to, for example, recognize .gitignore files.
-    bool find_repo_upward = 2;
+  // filters is a list of filters to apply.
+  // Filters can be applied to documents or
+  // individual code blocks.
+  repeated Filter filters = 7;
 
-    // ignore_paths is a list of paths to ignore relative to dir.
-    repeated string ignore_paths = 3 [json_name = "ignore"];
+  message Env {
+    // use_system_env indicates whether to use the system environment variables.
+    bool use_system_env = 1;
 
-    // disable_gitignore indicates whether to disable the .gitignore file.
-    bool disable_gitignore = 4;
+    // sources is a list of files with env.
+    repeated string sources = 2;
   }
 
   message Filter {
@@ -67,35 +96,16 @@ message Config {
     FILTER_TYPE_BLOCK = 1;
     FILTER_TYPE_DOCUMENT = 2;
   }
+}
 
-  message Env {
-    // use_system_env indicates whether to use the system environment variables.
-    bool use_system_env = 1;
-
-    // sources is a list of files with env.
-    repeated string sources = 2;
-  }
-
-  message Log {
-    // enabled indicates whether to enable logging.
-    bool enabled = 1;
-
-    // path is the path to the log output file.
-    string path = 2;
-
-    // verbose is the verbosity level of the log.
-    bool verbose = 3;
-  }
-
-  message Server {
-    string address = 1;
+// Config describes the configuration of the runme toolchain, including CLI, server, and clients like VS Code extension.
+message Config {
+  // kernel is the system-level configuration and config that's not specific to one single client
+  Kernel kernel = 1;
 
-    TLS tls = 2;
+  // project contains configuration applicable to the project inside a repo.
+  Project project = 2;
 
-    message TLS {
-      bool enabled = 1;
-      string cert_file = 2;
-      string key_file = 3;
-    }
-  }
+  // will likely add document to overwrite frontmatter in documents per dir when nested
+  // Document document = 3;
 }
diff --git a/internal/cmd/beta/beta_cmd.go b/internal/cmd/beta/beta_cmd.go
index 09c8e175f..db159082a 100644
--- a/internal/cmd/beta/beta_cmd.go
+++ b/internal/cmd/beta/beta_cmd.go
@@ -30,12 +30,12 @@ All commands use the runme.yaml configuration file.`,
 			return autoconfig.Invoke(func(cfg *config.Config) error {
 				// Override the filename if provided.
 				if cFlags.filename != "" {
-					cfg.Filename = cFlags.filename
+					cfg.Kernel.Filename = cFlags.filename
 				}
 
 				// Add a filter to run only tasks from the specified categories.
 				if len(cFlags.categories) > 0 {
-					cfg.Filters = append(cfg.Filters, &config.Filter{
+					cfg.Repo.Filters = append(cfg.Repo.Filters, &config.Filter{
 						Type:      config.FilterTypeBlock,
 						Condition: `len(intersection(categories, extra.categories)) > 0`,
 						Extra:     map[string]interface{}{"categories": cFlags.categories},
diff --git a/internal/cmd/beta/server/grpcurl_utils.go b/internal/cmd/beta/server/grpcurl_utils.go
index 65300d206..191a03457 100644
--- a/internal/cmd/beta/server/grpcurl_utils.go
+++ b/internal/cmd/beta/server/grpcurl_utils.go
@@ -27,14 +27,14 @@ func getDescriptorSource(ctx context.Context, cfg *config.Config) (grpcurl.Descr
 }
 
 func dialServer(ctx context.Context, cfg *config.Config) (*grpc.ClientConn, error) {
-	tlsConf, err := runmetls.LoadClientConfig(cfg.ServerTLSCertFile, cfg.ServerTLSKeyFile)
+	tlsConf, err := runmetls.LoadClientConfig(cfg.Kernel.ServerTLSCertFile, cfg.Kernel.ServerTLSKeyFile)
 	if err != nil {
 		return nil, err
 	}
 
 	creds := credentials.NewTLS(tlsConf)
 
-	network, addr := "tcp", cfg.ServerAddress
+	network, addr := "tcp", cfg.Kernel.ServerAddress
 	if strings.HasPrefix(addr, "unix://") {
 		network, addr = "unix", strings.TrimPrefix(addr, "unix://")
 	}
diff --git a/internal/cmd/beta/server/server_cmd.go b/internal/cmd/beta/server/server_cmd.go
index ad010414e..d0ffd4471 100644
--- a/internal/cmd/beta/server/server_cmd.go
+++ b/internal/cmd/beta/server/server_cmd.go
@@ -19,7 +19,7 @@ func Cmd() *cobra.Command {
 				) error {
 					// For the server commands, we want to always log to stdout.
 					// TODO(adamb): there might be a need to separate client and server logs.
-					cfg.LogPath = ""
+					cfg.Kernel.LogPath = ""
 					return nil
 				},
 			)
diff --git a/internal/cmd/beta/server/server_start_cmd.go b/internal/cmd/beta/server/server_start_cmd.go
index 37b0076a4..026cd814a 100644
--- a/internal/cmd/beta/server/server_start_cmd.go
+++ b/internal/cmd/beta/server/server_start_cmd.go
@@ -25,10 +25,10 @@ func serverStartCmd() *cobra.Command {
 					defer logger.Sync()
 
 					serverCfg := &server.Config{
-						Address:    cfg.ServerAddress,
-						CertFile:   cfg.ServerTLSCertFile,
-						KeyFile:    cfg.ServerTLSKeyFile,
-						TLSEnabled: cfg.ServerTLSEnabled,
+						Address:    cfg.Kernel.ServerAddress,
+						CertFile:   cfg.Kernel.ServerTLSCertFile,
+						KeyFile:    cfg.Kernel.ServerTLSKeyFile,
+						TLSEnabled: cfg.Kernel.ServerTLSEnabled,
 					}
 
 					logger.Debug("server config", zap.Any("config", serverCfg))
@@ -39,12 +39,12 @@ func serverStartCmd() *cobra.Command {
 					}
 
 					// When using a unix socket, we want to create a file with server's PID.
-					if path := pidFileNameFromAddr(cfg.ServerAddress); path != "" {
+					if path := pidFileNameFromAddr(cfg.Kernel.ServerAddress); path != "" {
 						logger.Debug("creating PID file", zap.String("path", path))
 						if err := createFileWithPID(path); err != nil {
 							return errors.WithStack(err)
 						}
-						defer os.Remove(cfg.ServerAddress)
+						defer os.Remove(cfg.Kernel.ServerAddress)
 					}
 
 					return errors.WithStack(s.Serve())
diff --git a/internal/cmd/beta/server/server_stop_cmd.go b/internal/cmd/beta/server/server_stop_cmd.go
index f7bceabeb..660ab1abe 100644
--- a/internal/cmd/beta/server/server_stop_cmd.go
+++ b/internal/cmd/beta/server/server_stop_cmd.go
@@ -26,7 +26,7 @@ func serverStopCmd() *cobra.Command {
 
 					logger.Debug("stopping the server by looking for runme.pid")
 
-					path := pidFileNameFromAddr(cfg.ServerAddress)
+					path := pidFileNameFromAddr(cfg.Kernel.ServerAddress)
 					if path == "" {
 						return errors.New("server address is not a unix socket")
 					}
diff --git a/internal/config/autoconfig/autoconfig.go b/internal/config/autoconfig/autoconfig.go
index 050962f47..b759f23a0 100644
--- a/internal/config/autoconfig/autoconfig.go
+++ b/internal/config/autoconfig/autoconfig.go
@@ -102,12 +102,12 @@ func getConfig(userCfgDir UserConfigDir, viper *viper.Viper) (*config.Config, er
 		return nil, err
 	}
 
-	if cfg.ServerTLSEnabled {
-		if cfg.ServerTLSCertFile == "" {
-			cfg.ServerTLSCertFile = filepath.Join(string(userCfgDir), "cert.pem")
+	if cfg.Kernel.ServerTLSEnabled {
+		if cfg.Kernel.ServerTLSCertFile == "" {
+			cfg.Kernel.ServerTLSCertFile = filepath.Join(string(userCfgDir), "cert.pem")
 		}
-		if cfg.ServerTLSKeyFile == "" {
-			cfg.ServerTLSKeyFile = filepath.Join(string(userCfgDir), "key.pem")
+		if cfg.Kernel.ServerTLSKeyFile == "" {
+			cfg.Kernel.ServerTLSKeyFile = filepath.Join(string(userCfgDir), "key.pem")
 		}
 	}
 
@@ -115,7 +115,7 @@ func getConfig(userCfgDir UserConfigDir, viper *viper.Viper) (*config.Config, er
 }
 
 func getLogger(c *config.Config) (*zap.Logger, error) {
-	if c == nil || !c.LogEnabled {
+	if c == nil || !c.Kernel.LogEnabled {
 		return zap.NewNop(), nil
 	}
 
@@ -132,16 +132,16 @@ func getLogger(c *config.Config) (*zap.Logger, error) {
 		ErrorOutputPaths: []string{"stderr"},
 	}
 
-	if c.LogVerbose {
+	if c.Kernel.LogVerbose {
 		zapConfig.Level = zap.NewAtomicLevelAt(zap.DebugLevel)
 		zapConfig.Development = true
 		zapConfig.Encoding = "console"
 		zapConfig.EncoderConfig = zap.NewDevelopmentEncoderConfig()
 	}
 
-	if c.LogPath != "" {
-		zapConfig.OutputPaths = []string{c.LogPath}
-		zapConfig.ErrorOutputPaths = []string{c.LogPath}
+	if c.Kernel.LogPath != "" {
+		zapConfig.OutputPaths = []string{c.Kernel.LogPath}
+		zapConfig.ErrorOutputPaths = []string{c.Kernel.LogPath}
 	}
 
 	l, err := zapConfig.Build()
@@ -153,11 +153,11 @@ func getProject(c *config.Config, logger *zap.Logger) (*project.Project, error)
 		project.WithLogger(logger),
 	}
 
-	if c.Filename != "" {
-		return project.NewFileProject(c.Filename, opts...)
+	if c.Kernel.Filename != "" {
+		return project.NewFileProject(c.Kernel.Filename, opts...)
 	}
 
-	projDir := c.ProjectDir
+	projDir := c.Kernel.ProjectDir
 	// If no project directory is specified, use the current directory.
 	if projDir == "" {
 		projDir = "."
@@ -165,12 +165,12 @@ func getProject(c *config.Config, logger *zap.Logger) (*project.Project, error)
 
 	opts = append(
 		opts,
-		project.WithIgnoreFilePatterns(c.IgnorePaths...),
-		project.WithRespectGitignore(!c.DisableGitignore),
-		project.WithEnvFilesReadOrder(c.EnvSourceFiles),
+		project.WithIgnoreFilePatterns(c.Kernel.IgnorePaths...),
+		project.WithRespectGitignore(!c.Kernel.DisableGitignore),
+		project.WithEnvFilesReadOrder(c.Kernel.EnvSourceFiles),
 	)
 
-	if c.FindRepoUpward {
+	if c.Kernel.FindRepoUpward {
 		opts = append(opts, project.WithFindRepoUpward())
 	}
 
@@ -180,7 +180,7 @@ func getProject(c *config.Config, logger *zap.Logger) (*project.Project, error)
 func getProjectFilters(c *config.Config) ([]project.Filter, error) {
 	var filters []project.Filter
 
-	for _, filter := range c.Filters {
+	for _, filter := range c.Repo.Filters {
 		filter := filter
 
 		switch filter.Type {
@@ -228,7 +228,7 @@ func getProjectFilters(c *config.Config) ([]project.Filter, error) {
 func getSession(cfg *config.Config, proj *project.Project) (*command.Session, error) {
 	sess := command.NewSession()
 
-	if cfg.UseSystemEnv {
+	if cfg.Kernel.UseSystemEnv {
 		if err := sess.SetEnv(os.Environ()...); err != nil {
 			return nil, err
 		}
diff --git a/internal/config/autoconfig/autoconfig_test.go b/internal/config/autoconfig/autoconfig_test.go
index f34dbba69..ba2c66c0a 100644
--- a/internal/config/autoconfig/autoconfig_test.go
+++ b/internal/config/autoconfig/autoconfig_test.go
@@ -26,7 +26,7 @@ func TestInvokeAll(t *testing.T) {
 	// Create a runme.yaml using the README.md file from above.
 	// This won't work with the project as it requires the project
 	// to be a subdirectory of the current working directory.
-	configYAML := fmt.Sprintf("version: v1alpha1\nfilename: %s\n", readmeFilePath)
+	configYAML := fmt.Sprintf("version: v1alpha1\nproject:\n  filename: %s\n", readmeFilePath)
 
 	// Create a runme.yaml file in the temp directory.
 	err = os.WriteFile(filepath.Join(tempDir, "/runme.yaml"), []byte(configYAML), 0o600)
diff --git a/internal/config/config.go b/internal/config/config.go
index 96a663fd6..bde20f112 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -15,9 +15,7 @@ import (
 	configv1alpha1 "github.com/stateful/runme/v3/internal/gen/proto/go/runme/config/v1alpha1"
 )
 
-// Config is a flatten configuration of runme.yaml. The purpose of it is to
-// unify all the different configuration versions into a single struct.
-type Config struct {
+type ConfigKernel struct {
 	// Dir- or git-based project fields.
 	DisableGitignore bool
 	IgnorePaths      []string
@@ -31,8 +29,6 @@ type Config struct {
 	EnvSourceFiles []string
 	UseSystemEnv   bool
 
-	Filters []*Filter
-
 	// Log related fields.
 	LogEnabled bool
 	LogPath    string
@@ -45,6 +41,17 @@ type Config struct {
 	ServerTLSKeyFile  string
 }
 
+type ConfigRepo struct {
+	Filters []*Filter
+}
+
+// Config is a flatten configuration of runme.yaml. The purpose of it is to
+// unify all the different configuration versions into a single struct.
+type Config struct {
+	Kernel ConfigKernel
+	Repo   ConfigRepo
+}
+
 func ParseYAML(data []byte) (*Config, error) {
 	version, err := parseVersionFromYAML(data)
 	if err != nil {
@@ -113,10 +120,10 @@ func parseYAMLv1alpha1(data []byte) (*configv1alpha1.Config, error) {
 
 func configV1alpha1ToConfig(c *configv1alpha1.Config) *Config {
 	project := c.GetProject()
-	log := c.GetLog()
+	log := c.Kernel.GetLog()
 
 	var filters []*Filter
-	for _, f := range c.GetFilters() {
+	for _, f := range c.Project.GetFilters() {
 		filters = append(filters, &Filter{
 			Type:      f.GetType().String(),
 			Condition: f.GetCondition(),
@@ -124,26 +131,29 @@ func configV1alpha1ToConfig(c *configv1alpha1.Config) *Config {
 	}
 
 	return &Config{
-		ProjectDir:       project.GetDir(),
-		FindRepoUpward:   project.GetFindRepoUpward(),
-		IgnorePaths:      project.GetIgnorePaths(),
-		DisableGitignore: project.GetDisableGitignore(),
-
-		Filename: c.GetFilename(),
-
-		UseSystemEnv:   c.GetEnv().GetUseSystemEnv(),
-		EnvSourceFiles: c.GetEnv().GetSources(),
-
-		Filters: filters,
-
-		LogEnabled: log.GetEnabled(),
-		LogPath:    log.GetPath(),
-		LogVerbose: log.GetVerbose(),
-
-		ServerAddress:     c.GetServer().GetAddress(),
-		ServerTLSEnabled:  c.GetServer().GetTls().GetEnabled(),
-		ServerTLSCertFile: c.GetServer().GetTls().GetCertFile(),
-		ServerTLSKeyFile:  c.GetServer().GetTls().GetKeyFile(),
+		Kernel: ConfigKernel{
+			ProjectDir:       project.GetRoot(),
+			FindRepoUpward:   project.GetFindRepoUpward(),
+			IgnorePaths:      project.GetIgnorePaths(),
+			DisableGitignore: project.GetDisableGitignore(),
+
+			Filename: project.GetFilename(),
+
+			UseSystemEnv:   project.GetEnv().GetUseSystemEnv(),
+			EnvSourceFiles: project.GetEnv().GetSources(),
+
+			LogEnabled: log.GetEnabled(),
+			LogPath:    log.GetPath(),
+			LogVerbose: log.GetVerbose(),
+
+			ServerAddress:     c.Kernel.GetServer().GetAddress(),
+			ServerTLSEnabled:  c.Kernel.GetServer().GetTls().GetEnabled(),
+			ServerTLSCertFile: c.Kernel.GetServer().GetTls().GetCertFile(),
+			ServerTLSKeyFile:  c.Kernel.GetServer().GetTls().GetKeyFile(),
+		},
+		Repo: ConfigRepo{
+			Filters: filters,
+		},
 	}
 }
 
@@ -165,7 +175,7 @@ func validateConfig(cfg *Config) error {
 }
 
 func validateProjectDir(cfg *Config, cwd string) error {
-	rel, err := filepath.Rel(cwd, filepath.Join(cwd, cfg.ProjectDir))
+	rel, err := filepath.Rel(cwd, filepath.Join(cwd, cfg.Kernel.ProjectDir))
 	if err != nil {
 		return errors.WithStack(err)
 	}
@@ -177,7 +187,7 @@ func validateProjectDir(cfg *Config, cwd string) error {
 }
 
 func validateFilename(cfg *Config, cwd string) error {
-	rel, err := filepath.Rel(cwd, filepath.Join(cwd, cfg.Filename))
+	rel, err := filepath.Rel(cwd, filepath.Join(cwd, cfg.Kernel.Filename))
 	if err != nil {
 		return errors.WithStack(err)
 	}
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index bc9366d5e..815206e20 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -22,32 +22,32 @@ func TestParseYAML(t *testing.T) {
 		},
 		{
 			name:           "minimal config v1alpha1",
-			rawConfig:      "version: v1alpha1\nfilename: REAEDME.md\n",
-			expectedConfig: &Config{Filename: "REAEDME.md"},
+			rawConfig:      "version: v1alpha1\nproject:\n  filename: REAEDME.md\n",
+			expectedConfig: &Config{Kernel: ConfigKernel{Filename: "REAEDME.md"}},
 		},
 		{
 			name:           "validate source",
 			rawConfig:      "version: v1alpha1",
-			errorSubstring: "failed to validate v1alpha1 config: validation error:\n - source: exactly one field is required",
+			expectedConfig: &Config{},
 		},
 		{
 			name:           "project and filename",
-			rawConfig:      "version: v1alpha1\nproject:\n  dir: \".\"\nfilename: \"README.md\"\n",
-			errorSubstring: "error parsing \"project\", oneof runme.config.v1alpha1.Config.source is already set",
+			rawConfig:      "version: v1alpha1\nproject:\n  root: \".\"\n  filename: \"README.md\"\n",
+			errorSubstring: "error parsing \"root\", oneof runme.config.v1alpha1.Project.source is already set",
 		},
 		{
 			name:           "validate filter type",
-			rawConfig:      "version: v1alpha1\nfilename: README.md\nfilters:\n  - type: 3\n    condition: \"name != ''\"\n",
-			errorSubstring: "failed to validate v1alpha1 config: validation error:\n - filters[0].type: value must be one of the defined enum values",
+			rawConfig:      "version: v1alpha1\nproject:\n  filename: README.md\n  filters:\n  - type: 3\n    condition: \"name != ''\"\n",
+			errorSubstring: "failed to validate v1alpha1 config: validation error:\n - project.filters[0].type: value must be one of the defined enum values",
 		},
 		{
 			name:           "validate project within cwd",
-			rawConfig:      "version: v1alpha1\nproject:\n  dir: '..'\n",
+			rawConfig:      "version: v1alpha1\nproject:\n  root: '..'\n",
 			errorSubstring: "failed to validate config: failed to validate project dir: outside of current working directory",
 		},
 		{
 			name:           "validate filename within cwd",
-			rawConfig:      "version: v1alpha1\nfilename: '../README.md'\n",
+			rawConfig:      "version: v1alpha1\nproject:\n  filename: '../README.md'\n",
 			errorSubstring: "failed to validate config: failed to validate filename: outside of current working directory",
 		},
 	}
@@ -79,45 +79,49 @@ func TestParseYAML(t *testing.T) {
 var (
 	testConfigV1alpha1Raw = `version: v1alpha1
 
+kernel:
+  log:
+    enabled: true
+    path: "/var/tmp/runme.log"
+    verbose: true
+
 project:
-  dir: "."
+  root: "."
   find_repo_upward: true
   ignore:
     - "node_modules"
     - ".venv"
   disable_gitignore: false
 
-env:
-  sources:
-    - ".env"
-
-filters:
-  - type: "FILTER_TYPE_BLOCK"
-    condition: "name != ''"
+  env:
+    sources:
+      - ".env"
 
-log:
-  enabled: true
-  path: "/var/tmp/runme.log"
-  verbose: true
+  filters:
+    - type: "FILTER_TYPE_BLOCK"
+      condition: "name != ''"
 `
 
 	testConfigV1alpha1 = &Config{
-		ProjectDir:       ".",
-		FindRepoUpward:   true,
-		IgnorePaths:      []string{"node_modules", ".venv"},
-		DisableGitignore: false,
+		Kernel: ConfigKernel{
+			ProjectDir:       ".",
+			FindRepoUpward:   true,
+			IgnorePaths:      []string{"node_modules", ".venv"},
+			DisableGitignore: false,
 
-		EnvSourceFiles: []string{".env"},
+			EnvSourceFiles: []string{".env"},
 
-		Filters: []*Filter{
-			{
-				Type:      "FILTER_TYPE_BLOCK",
-				Condition: "name != ''",
+			LogEnabled: true,
+			LogPath:    "/var/tmp/runme.log",
+			LogVerbose: true,
+		},
+		Repo: ConfigRepo{
+			Filters: []*Filter{
+				{
+					Type:      "FILTER_TYPE_BLOCK",
+					Condition: "name != ''",
+				},
 			},
 		},
-
-		LogEnabled: true,
-		LogPath:    "/var/tmp/runme.log",
-		LogVerbose: true,
 	}
 )
diff --git a/internal/gen/proto/go/runme/config/v1alpha1/config.pb.go b/internal/gen/proto/go/runme/config/v1alpha1/config.pb.go
index c243cdeaa..66bac19e8 100644
--- a/internal/gen/proto/go/runme/config/v1alpha1/config.pb.go
+++ b/internal/gen/proto/go/runme/config/v1alpha1/config.pb.go
@@ -21,57 +21,114 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-type Config_FilterType int32
+type Project_FilterType int32
 
 const (
-	Config_FILTER_TYPE_UNSPECIFIED Config_FilterType = 0
-	Config_FILTER_TYPE_BLOCK       Config_FilterType = 1
-	Config_FILTER_TYPE_DOCUMENT    Config_FilterType = 2
+	Project_FILTER_TYPE_UNSPECIFIED Project_FilterType = 0
+	Project_FILTER_TYPE_BLOCK       Project_FilterType = 1
+	Project_FILTER_TYPE_DOCUMENT    Project_FilterType = 2
 )
 
-// Enum value maps for Config_FilterType.
+// Enum value maps for Project_FilterType.
 var (
-	Config_FilterType_name = map[int32]string{
+	Project_FilterType_name = map[int32]string{
 		0: "FILTER_TYPE_UNSPECIFIED",
 		1: "FILTER_TYPE_BLOCK",
 		2: "FILTER_TYPE_DOCUMENT",
 	}
-	Config_FilterType_value = map[string]int32{
+	Project_FilterType_value = map[string]int32{
 		"FILTER_TYPE_UNSPECIFIED": 0,
 		"FILTER_TYPE_BLOCK":       1,
 		"FILTER_TYPE_DOCUMENT":    2,
 	}
 )
 
-func (x Config_FilterType) Enum() *Config_FilterType {
-	p := new(Config_FilterType)
+func (x Project_FilterType) Enum() *Project_FilterType {
+	p := new(Project_FilterType)
 	*p = x
 	return p
 }
 
-func (x Config_FilterType) String() string {
+func (x Project_FilterType) String() string {
 	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
 }
 
-func (Config_FilterType) Descriptor() protoreflect.EnumDescriptor {
+func (Project_FilterType) Descriptor() protoreflect.EnumDescriptor {
 	return file_runme_config_v1alpha1_config_proto_enumTypes[0].Descriptor()
 }
 
-func (Config_FilterType) Type() protoreflect.EnumType {
+func (Project_FilterType) Type() protoreflect.EnumType {
 	return &file_runme_config_v1alpha1_config_proto_enumTypes[0]
 }
 
-func (x Config_FilterType) Number() protoreflect.EnumNumber {
+func (x Project_FilterType) Number() protoreflect.EnumNumber {
 	return protoreflect.EnumNumber(x)
 }
 
-// Deprecated: Use Config_FilterType.Descriptor instead.
-func (Config_FilterType) EnumDescriptor() ([]byte, []int) {
-	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{0, 0}
+// Deprecated: Use Project_FilterType.Descriptor instead.
+func (Project_FilterType) EnumDescriptor() ([]byte, []int) {
+	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{1, 0}
 }
 
-// Config describes the configuration of the runme tools, including CLI, server, and clients like VS Code extension.
-type Config struct {
+// Kernel describes system-level configuration of the runme toolchain.
+type Kernel struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// log contains the log configuration.
+	Log    *Kernel_Log    `protobuf:"bytes,1,opt,name=log,proto3" json:"log,omitempty"`
+	Server *Kernel_Server `protobuf:"bytes,2,opt,name=server,proto3" json:"server,omitempty"`
+}
+
+func (x *Kernel) Reset() {
+	*x = Kernel{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runme_config_v1alpha1_config_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Kernel) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Kernel) ProtoMessage() {}
+
+func (x *Kernel) ProtoReflect() protoreflect.Message {
+	mi := &file_runme_config_v1alpha1_config_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Kernel.ProtoReflect.Descriptor instead.
+func (*Kernel) Descriptor() ([]byte, []int) {
+	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Kernel) GetLog() *Kernel_Log {
+	if x != nil {
+		return x.Log
+	}
+	return nil
+}
+
+func (x *Kernel) GetServer() *Kernel_Server {
+	if x != nil {
+		return x.Server
+	}
+	return nil
+}
+
+// Project describes repo-level configuration of the runme toolchain.
+type Project struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
@@ -80,37 +137,41 @@ type Config struct {
 	//
 	// Types that are assignable to Source:
 	//
-	//	*Config_Project_
-	//	*Config_Filename
-	Source isConfig_Source `protobuf_oneof:"source"`
+	//	*Project_Root
+	//	*Project_Filename
+	Source isProject_Source `protobuf_oneof:"source"`
 	// env is the environment variables configuration.
-	Env *Config_Env `protobuf:"bytes,3,opt,name=env,proto3" json:"env,omitempty"`
+	Env *Project_Env `protobuf:"bytes,3,opt,name=env,proto3" json:"env,omitempty"`
+	// find_repo_upward indicates whether to find the nearest Git repository upward.
+	// This is useful to, for example, recognize .gitignore files.
+	FindRepoUpward bool `protobuf:"varint,4,opt,name=find_repo_upward,json=findRepoUpward,proto3" json:"find_repo_upward,omitempty"`
+	// ignore_paths is a list of paths to ignore relative to dir.
+	IgnorePaths []string `protobuf:"bytes,5,rep,name=ignore_paths,json=ignore,proto3" json:"ignore_paths,omitempty"`
+	// disable_gitignore indicates whether to disable the .gitignore file.
+	DisableGitignore bool `protobuf:"varint,6,opt,name=disable_gitignore,json=disableGitignore,proto3" json:"disable_gitignore,omitempty"`
 	// filters is a list of filters to apply.
 	// Filters can be applied to documents or
 	// individual code blocks.
-	Filters []*Config_Filter `protobuf:"bytes,5,rep,name=filters,proto3" json:"filters,omitempty"`
-	// log contains the log configuration.
-	Log    *Config_Log    `protobuf:"bytes,7,opt,name=log,proto3" json:"log,omitempty"`
-	Server *Config_Server `protobuf:"bytes,8,opt,name=server,proto3" json:"server,omitempty"`
+	Filters []*Project_Filter `protobuf:"bytes,7,rep,name=filters,proto3" json:"filters,omitempty"`
 }
 
-func (x *Config) Reset() {
-	*x = Config{}
+func (x *Project) Reset() {
+	*x = Project{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_runme_config_v1alpha1_config_proto_msgTypes[0]
+		mi := &file_runme_config_v1alpha1_config_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *Config) String() string {
+func (x *Project) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Config) ProtoMessage() {}
+func (*Project) ProtoMessage() {}
 
-func (x *Config) ProtoReflect() protoreflect.Message {
-	mi := &file_runme_config_v1alpha1_config_proto_msgTypes[0]
+func (x *Project) ProtoReflect() protoreflect.Message {
+	mi := &file_runme_config_v1alpha1_config_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -121,111 +182,114 @@ func (x *Config) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Config.ProtoReflect.Descriptor instead.
-func (*Config) Descriptor() ([]byte, []int) {
-	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{0}
+// Deprecated: Use Project.ProtoReflect.Descriptor instead.
+func (*Project) Descriptor() ([]byte, []int) {
+	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{1}
 }
 
-func (m *Config) GetSource() isConfig_Source {
+func (m *Project) GetSource() isProject_Source {
 	if m != nil {
 		return m.Source
 	}
 	return nil
 }
 
-func (x *Config) GetProject() *Config_Project {
-	if x, ok := x.GetSource().(*Config_Project_); ok {
-		return x.Project
+func (x *Project) GetRoot() string {
+	if x, ok := x.GetSource().(*Project_Root); ok {
+		return x.Root
 	}
-	return nil
+	return ""
 }
 
-func (x *Config) GetFilename() string {
-	if x, ok := x.GetSource().(*Config_Filename); ok {
+func (x *Project) GetFilename() string {
+	if x, ok := x.GetSource().(*Project_Filename); ok {
 		return x.Filename
 	}
 	return ""
 }
 
-func (x *Config) GetEnv() *Config_Env {
+func (x *Project) GetEnv() *Project_Env {
 	if x != nil {
 		return x.Env
 	}
 	return nil
 }
 
-func (x *Config) GetFilters() []*Config_Filter {
+func (x *Project) GetFindRepoUpward() bool {
 	if x != nil {
-		return x.Filters
+		return x.FindRepoUpward
 	}
-	return nil
+	return false
 }
 
-func (x *Config) GetLog() *Config_Log {
+func (x *Project) GetIgnorePaths() []string {
 	if x != nil {
-		return x.Log
+		return x.IgnorePaths
 	}
 	return nil
 }
 
-func (x *Config) GetServer() *Config_Server {
+func (x *Project) GetDisableGitignore() bool {
 	if x != nil {
-		return x.Server
+		return x.DisableGitignore
+	}
+	return false
+}
+
+func (x *Project) GetFilters() []*Project_Filter {
+	if x != nil {
+		return x.Filters
 	}
 	return nil
 }
 
-type isConfig_Source interface {
-	isConfig_Source()
+type isProject_Source interface {
+	isProject_Source()
 }
 
-type Config_Project_ struct {
-	// project indicates a dir-based source typically including multiple Markdown files.
-	Project *Config_Project `protobuf:"bytes,1,opt,name=project,proto3,oneof"`
+type Project_Root struct {
+	// root indicates a dir-based source typically including multiple Markdown files.
+	Root string `protobuf:"bytes,1,opt,name=root,proto3,oneof"`
 }
 
-type Config_Filename struct {
+type Project_Filename struct {
 	// filename indicates a single Markdown file.
 	Filename string `protobuf:"bytes,2,opt,name=filename,proto3,oneof"`
 }
 
-func (*Config_Project_) isConfig_Source() {}
+func (*Project_Root) isProject_Source() {}
 
-func (*Config_Filename) isConfig_Source() {}
+func (*Project_Filename) isProject_Source() {}
 
-type Config_Project struct {
+// Config describes the configuration of the runme toolchain, including CLI, server, and clients like VS Code extension.
+type Config struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// dir is the directory to look for Markdown files.
-	Dir string `protobuf:"bytes,1,opt,name=dir,proto3" json:"dir,omitempty"`
-	// find_repo_upward indicates whether to find the nearest Git repository upward.
-	// This is useful to, for example, recognize .gitignore files.
-	FindRepoUpward bool `protobuf:"varint,2,opt,name=find_repo_upward,json=findRepoUpward,proto3" json:"find_repo_upward,omitempty"`
-	// ignore_paths is a list of paths to ignore relative to dir.
-	IgnorePaths []string `protobuf:"bytes,3,rep,name=ignore_paths,json=ignore,proto3" json:"ignore_paths,omitempty"`
-	// disable_gitignore indicates whether to disable the .gitignore file.
-	DisableGitignore bool `protobuf:"varint,4,opt,name=disable_gitignore,json=disableGitignore,proto3" json:"disable_gitignore,omitempty"`
+	// kernel is the system-level configuration.
+	Kernel *Kernel `protobuf:"bytes,1,opt,name=kernel,proto3" json:"kernel,omitempty"`
+	// project contains configuration applicable to the project inside a repo.
+	Project *Project `protobuf:"bytes,2,opt,name=project,proto3" json:"project,omitempty"`
 }
 
-func (x *Config_Project) Reset() {
-	*x = Config_Project{}
+func (x *Config) Reset() {
+	*x = Config{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_runme_config_v1alpha1_config_proto_msgTypes[1]
+		mi := &file_runme_config_v1alpha1_config_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *Config_Project) String() string {
+func (x *Config) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Config_Project) ProtoMessage() {}
+func (*Config) ProtoMessage() {}
 
-func (x *Config_Project) ProtoReflect() protoreflect.Message {
-	mi := &file_runme_config_v1alpha1_config_proto_msgTypes[1]
+func (x *Config) ProtoReflect() protoreflect.Message {
+	mi := &file_runme_config_v1alpha1_config_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -236,71 +300,55 @@ func (x *Config_Project) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Config_Project.ProtoReflect.Descriptor instead.
-func (*Config_Project) Descriptor() ([]byte, []int) {
-	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{0, 0}
-}
-
-func (x *Config_Project) GetDir() string {
-	if x != nil {
-		return x.Dir
-	}
-	return ""
-}
-
-func (x *Config_Project) GetFindRepoUpward() bool {
-	if x != nil {
-		return x.FindRepoUpward
-	}
-	return false
+// Deprecated: Use Config.ProtoReflect.Descriptor instead.
+func (*Config) Descriptor() ([]byte, []int) {
+	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{2}
 }
 
-func (x *Config_Project) GetIgnorePaths() []string {
+func (x *Config) GetKernel() *Kernel {
 	if x != nil {
-		return x.IgnorePaths
+		return x.Kernel
 	}
 	return nil
 }
 
-func (x *Config_Project) GetDisableGitignore() bool {
+func (x *Config) GetProject() *Project {
 	if x != nil {
-		return x.DisableGitignore
+		return x.Project
 	}
-	return false
+	return nil
 }
 
-type Config_Filter struct {
+type Kernel_Log struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// type is the type of the filter.
-	Type Config_FilterType `protobuf:"varint,1,opt,name=type,proto3,enum=runme.config.v1alpha1.Config_FilterType" json:"type,omitempty"`
-	// condition is the filter program to execute for each document or block,
-	// depending on the filter type.
-	//
-	// The condition should be a valid Expr expression and it should return a boolean value.
-	// You can read more about the Expr syntax on https://expr-lang.org/.
-	Condition string `protobuf:"bytes,2,opt,name=condition,proto3" json:"condition,omitempty"`
+	// enabled indicates whether to enable logging.
+	Enabled bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	// path is the path to the log output file.
+	Path string `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"`
+	// verbose is the verbosity level of the log.
+	Verbose bool `protobuf:"varint,3,opt,name=verbose,proto3" json:"verbose,omitempty"`
 }
 
-func (x *Config_Filter) Reset() {
-	*x = Config_Filter{}
+func (x *Kernel_Log) Reset() {
+	*x = Kernel_Log{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_runme_config_v1alpha1_config_proto_msgTypes[2]
+		mi := &file_runme_config_v1alpha1_config_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *Config_Filter) String() string {
+func (x *Kernel_Log) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Config_Filter) ProtoMessage() {}
+func (*Kernel_Log) ProtoMessage() {}
 
-func (x *Config_Filter) ProtoReflect() protoreflect.Message {
-	mi := &file_runme_config_v1alpha1_config_proto_msgTypes[2]
+func (x *Kernel_Log) ProtoReflect() protoreflect.Message {
+	mi := &file_runme_config_v1alpha1_config_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -311,53 +359,58 @@ func (x *Config_Filter) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Config_Filter.ProtoReflect.Descriptor instead.
-func (*Config_Filter) Descriptor() ([]byte, []int) {
-	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{0, 1}
+// Deprecated: Use Kernel_Log.ProtoReflect.Descriptor instead.
+func (*Kernel_Log) Descriptor() ([]byte, []int) {
+	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{0, 0}
 }
 
-func (x *Config_Filter) GetType() Config_FilterType {
+func (x *Kernel_Log) GetEnabled() bool {
 	if x != nil {
-		return x.Type
+		return x.Enabled
 	}
-	return Config_FILTER_TYPE_UNSPECIFIED
+	return false
 }
 
-func (x *Config_Filter) GetCondition() string {
+func (x *Kernel_Log) GetPath() string {
 	if x != nil {
-		return x.Condition
+		return x.Path
 	}
 	return ""
 }
 
-type Config_Env struct {
+func (x *Kernel_Log) GetVerbose() bool {
+	if x != nil {
+		return x.Verbose
+	}
+	return false
+}
+
+type Kernel_Server struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// use_system_env indicates whether to use the system environment variables.
-	UseSystemEnv bool `protobuf:"varint,1,opt,name=use_system_env,json=useSystemEnv,proto3" json:"use_system_env,omitempty"`
-	// sources is a list of files with env.
-	Sources []string `protobuf:"bytes,2,rep,name=sources,proto3" json:"sources,omitempty"`
+	Address string             `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
+	Tls     *Kernel_Server_TLS `protobuf:"bytes,2,opt,name=tls,proto3" json:"tls,omitempty"`
 }
 
-func (x *Config_Env) Reset() {
-	*x = Config_Env{}
+func (x *Kernel_Server) Reset() {
+	*x = Kernel_Server{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_runme_config_v1alpha1_config_proto_msgTypes[3]
+		mi := &file_runme_config_v1alpha1_config_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *Config_Env) String() string {
+func (x *Kernel_Server) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Config_Env) ProtoMessage() {}
+func (*Kernel_Server) ProtoMessage() {}
 
-func (x *Config_Env) ProtoReflect() protoreflect.Message {
-	mi := &file_runme_config_v1alpha1_config_proto_msgTypes[3]
+func (x *Kernel_Server) ProtoReflect() protoreflect.Message {
+	mi := &file_runme_config_v1alpha1_config_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -368,55 +421,52 @@ func (x *Config_Env) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Config_Env.ProtoReflect.Descriptor instead.
-func (*Config_Env) Descriptor() ([]byte, []int) {
-	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{0, 2}
+// Deprecated: Use Kernel_Server.ProtoReflect.Descriptor instead.
+func (*Kernel_Server) Descriptor() ([]byte, []int) {
+	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{0, 1}
 }
 
-func (x *Config_Env) GetUseSystemEnv() bool {
+func (x *Kernel_Server) GetAddress() string {
 	if x != nil {
-		return x.UseSystemEnv
+		return x.Address
 	}
-	return false
+	return ""
 }
 
-func (x *Config_Env) GetSources() []string {
+func (x *Kernel_Server) GetTls() *Kernel_Server_TLS {
 	if x != nil {
-		return x.Sources
+		return x.Tls
 	}
 	return nil
 }
 
-type Config_Log struct {
+type Kernel_Server_TLS struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// enabled indicates whether to enable logging.
-	Enabled bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
-	// path is the path to the log output file.
-	Path string `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"`
-	// verbose is the verbosity level of the log.
-	Verbose bool `protobuf:"varint,3,opt,name=verbose,proto3" json:"verbose,omitempty"`
+	Enabled  bool   `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	CertFile string `protobuf:"bytes,2,opt,name=cert_file,json=certFile,proto3" json:"cert_file,omitempty"`
+	KeyFile  string `protobuf:"bytes,3,opt,name=key_file,json=keyFile,proto3" json:"key_file,omitempty"`
 }
 
-func (x *Config_Log) Reset() {
-	*x = Config_Log{}
+func (x *Kernel_Server_TLS) Reset() {
+	*x = Kernel_Server_TLS{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_runme_config_v1alpha1_config_proto_msgTypes[4]
+		mi := &file_runme_config_v1alpha1_config_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *Config_Log) String() string {
+func (x *Kernel_Server_TLS) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Config_Log) ProtoMessage() {}
+func (*Kernel_Server_TLS) ProtoMessage() {}
 
-func (x *Config_Log) ProtoReflect() protoreflect.Message {
-	mi := &file_runme_config_v1alpha1_config_proto_msgTypes[4]
+func (x *Kernel_Server_TLS) ProtoReflect() protoreflect.Message {
+	mi := &file_runme_config_v1alpha1_config_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -427,58 +477,60 @@ func (x *Config_Log) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Config_Log.ProtoReflect.Descriptor instead.
-func (*Config_Log) Descriptor() ([]byte, []int) {
-	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{0, 3}
+// Deprecated: Use Kernel_Server_TLS.ProtoReflect.Descriptor instead.
+func (*Kernel_Server_TLS) Descriptor() ([]byte, []int) {
+	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{0, 1, 0}
 }
 
-func (x *Config_Log) GetEnabled() bool {
+func (x *Kernel_Server_TLS) GetEnabled() bool {
 	if x != nil {
 		return x.Enabled
 	}
 	return false
 }
 
-func (x *Config_Log) GetPath() string {
+func (x *Kernel_Server_TLS) GetCertFile() string {
 	if x != nil {
-		return x.Path
+		return x.CertFile
 	}
 	return ""
 }
 
-func (x *Config_Log) GetVerbose() bool {
+func (x *Kernel_Server_TLS) GetKeyFile() string {
 	if x != nil {
-		return x.Verbose
+		return x.KeyFile
 	}
-	return false
+	return ""
 }
 
-type Config_Server struct {
+type Project_Env struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Address string             `protobuf:"bytes,1,opt,name=address,proto3" json:"address,omitempty"`
-	Tls     *Config_Server_TLS `protobuf:"bytes,2,opt,name=tls,proto3" json:"tls,omitempty"`
+	// use_system_env indicates whether to use the system environment variables.
+	UseSystemEnv bool `protobuf:"varint,1,opt,name=use_system_env,json=useSystemEnv,proto3" json:"use_system_env,omitempty"`
+	// sources is a list of files with env.
+	Sources []string `protobuf:"bytes,2,rep,name=sources,proto3" json:"sources,omitempty"`
 }
 
-func (x *Config_Server) Reset() {
-	*x = Config_Server{}
+func (x *Project_Env) Reset() {
+	*x = Project_Env{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_runme_config_v1alpha1_config_proto_msgTypes[5]
+		mi := &file_runme_config_v1alpha1_config_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *Config_Server) String() string {
+func (x *Project_Env) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Config_Server) ProtoMessage() {}
+func (*Project_Env) ProtoMessage() {}
 
-func (x *Config_Server) ProtoReflect() protoreflect.Message {
-	mi := &file_runme_config_v1alpha1_config_proto_msgTypes[5]
+func (x *Project_Env) ProtoReflect() protoreflect.Message {
+	mi := &file_runme_config_v1alpha1_config_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -489,52 +541,57 @@ func (x *Config_Server) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Config_Server.ProtoReflect.Descriptor instead.
-func (*Config_Server) Descriptor() ([]byte, []int) {
-	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{0, 4}
+// Deprecated: Use Project_Env.ProtoReflect.Descriptor instead.
+func (*Project_Env) Descriptor() ([]byte, []int) {
+	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{1, 0}
 }
 
-func (x *Config_Server) GetAddress() string {
+func (x *Project_Env) GetUseSystemEnv() bool {
 	if x != nil {
-		return x.Address
+		return x.UseSystemEnv
 	}
-	return ""
+	return false
 }
 
-func (x *Config_Server) GetTls() *Config_Server_TLS {
+func (x *Project_Env) GetSources() []string {
 	if x != nil {
-		return x.Tls
+		return x.Sources
 	}
 	return nil
 }
 
-type Config_Server_TLS struct {
+type Project_Filter struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Enabled  bool   `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
-	CertFile string `protobuf:"bytes,2,opt,name=cert_file,json=certFile,proto3" json:"cert_file,omitempty"`
-	KeyFile  string `protobuf:"bytes,3,opt,name=key_file,json=keyFile,proto3" json:"key_file,omitempty"`
+	// type is the type of the filter.
+	Type Project_FilterType `protobuf:"varint,1,opt,name=type,proto3,enum=runme.config.v1alpha1.Project_FilterType" json:"type,omitempty"`
+	// condition is the filter program to execute for each document or block,
+	// depending on the filter type.
+	//
+	// The condition should be a valid Expr expression and it should return a boolean value.
+	// You can read more about the Expr syntax on https://expr-lang.org/.
+	Condition string `protobuf:"bytes,2,opt,name=condition,proto3" json:"condition,omitempty"`
 }
 
-func (x *Config_Server_TLS) Reset() {
-	*x = Config_Server_TLS{}
+func (x *Project_Filter) Reset() {
+	*x = Project_Filter{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_runme_config_v1alpha1_config_proto_msgTypes[6]
+		mi := &file_runme_config_v1alpha1_config_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *Config_Server_TLS) String() string {
+func (x *Project_Filter) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Config_Server_TLS) ProtoMessage() {}
+func (*Project_Filter) ProtoMessage() {}
 
-func (x *Config_Server_TLS) ProtoReflect() protoreflect.Message {
-	mi := &file_runme_config_v1alpha1_config_proto_msgTypes[6]
+func (x *Project_Filter) ProtoReflect() protoreflect.Message {
+	mi := &file_runme_config_v1alpha1_config_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -545,28 +602,21 @@ func (x *Config_Server_TLS) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Config_Server_TLS.ProtoReflect.Descriptor instead.
-func (*Config_Server_TLS) Descriptor() ([]byte, []int) {
-	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{0, 4, 0}
-}
-
-func (x *Config_Server_TLS) GetEnabled() bool {
-	if x != nil {
-		return x.Enabled
-	}
-	return false
+// Deprecated: Use Project_Filter.ProtoReflect.Descriptor instead.
+func (*Project_Filter) Descriptor() ([]byte, []int) {
+	return file_runme_config_v1alpha1_config_proto_rawDescGZIP(), []int{1, 1}
 }
 
-func (x *Config_Server_TLS) GetCertFile() string {
+func (x *Project_Filter) GetType() Project_FilterType {
 	if x != nil {
-		return x.CertFile
+		return x.Type
 	}
-	return ""
+	return Project_FILTER_TYPE_UNSPECIFIED
 }
 
-func (x *Config_Server_TLS) GetKeyFile() string {
+func (x *Project_Filter) GetCondition() string {
 	if x != nil {
-		return x.KeyFile
+		return x.Condition
 	}
 	return ""
 }
@@ -579,79 +629,83 @@ var file_runme_config_v1alpha1_config_proto_rawDesc = []byte{
 	0x72, 0x6f, 0x74, 0x6f, 0x12, 0x15, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x63, 0x6f, 0x6e, 0x66,
 	0x69, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x1a, 0x1b, 0x62, 0x75, 0x66,
 	0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x2f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61,
-	0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x9d, 0x08, 0x0a, 0x06, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x12, 0x41, 0x0a, 0x07, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x63, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x2e, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x48, 0x00, 0x52, 0x07, 0x70,
-	0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x12, 0x1c, 0x0a, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x6e, 0x61,
-	0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x08, 0x66, 0x69, 0x6c, 0x65,
-	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x03, 0x65, 0x6e, 0x76, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x21, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x2e, 0x45, 0x6e, 0x76, 0x52, 0x03, 0x65, 0x6e, 0x76, 0x12, 0x3e, 0x0a, 0x07, 0x66, 0x69, 0x6c,
-	0x74, 0x65, 0x72, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x72, 0x75, 0x6e,
-	0x6d, 0x65, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
-	0x61, 0x31, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72,
-	0x52, 0x07, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x12, 0x33, 0x0a, 0x03, 0x6c, 0x6f, 0x67,
-	0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x63,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x4c, 0x6f, 0x67, 0x52, 0x03, 0x6c, 0x6f, 0x67, 0x12, 0x3c,
-	0x0a, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24,
-	0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x76, 0x31,
-	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x53, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x52, 0x06, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x1a, 0x90, 0x01, 0x0a,
-	0x07, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x69, 0x72, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x69, 0x72, 0x12, 0x28, 0x0a, 0x10, 0x66, 0x69,
-	0x6e, 0x64, 0x5f, 0x72, 0x65, 0x70, 0x6f, 0x5f, 0x75, 0x70, 0x77, 0x61, 0x72, 0x64, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x66, 0x69, 0x6e, 0x64, 0x52, 0x65, 0x70, 0x6f, 0x55, 0x70,
-	0x77, 0x61, 0x72, 0x64, 0x12, 0x1c, 0x0a, 0x0c, 0x69, 0x67, 0x6e, 0x6f, 0x72, 0x65, 0x5f, 0x70,
-	0x61, 0x74, 0x68, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x69, 0x67, 0x6e, 0x6f,
-	0x72, 0x65, 0x12, 0x2b, 0x0a, 0x11, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x67, 0x69,
-	0x74, 0x69, 0x67, 0x6e, 0x6f, 0x72, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x64,
-	0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x47, 0x69, 0x74, 0x69, 0x67, 0x6e, 0x6f, 0x72, 0x65, 0x1a,
-	0x7a, 0x0a, 0x06, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x46, 0x0a, 0x04, 0x74, 0x79, 0x70,
-	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x28, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e,
+	0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x84, 0x03, 0x0a, 0x06, 0x4b, 0x65, 0x72,
+	0x6e, 0x65, 0x6c, 0x12, 0x33, 0x0a, 0x03, 0x6c, 0x6f, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x21, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e,
+	0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x2e,
+	0x4c, 0x6f, 0x67, 0x52, 0x03, 0x6c, 0x6f, 0x67, 0x12, 0x3c, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65,
+	0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x2e, 0x4b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x06,
+	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x1a, 0x4d, 0x0a, 0x03, 0x4c, 0x6f, 0x67, 0x12, 0x18, 0x0a,
+	0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07,
+	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x18, 0x0a, 0x07, 0x76,
+	0x65, 0x72, 0x62, 0x6f, 0x73, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x76, 0x65,
+	0x72, 0x62, 0x6f, 0x73, 0x65, 0x1a, 0xb7, 0x01, 0x0a, 0x06, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x12, 0x18, 0x0a, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x3a, 0x0a, 0x03, 0x74, 0x6c,
+	0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e,
 	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x54, 0x79, 0x70,
-	0x65, 0x42, 0x08, 0xba, 0x48, 0x05, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52, 0x04, 0x74, 0x79, 0x70,
-	0x65, 0x12, 0x28, 0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x72, 0x05, 0x10, 0x01, 0x18, 0x80, 0x08,
-	0x52, 0x09, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x1a, 0x45, 0x0a, 0x03, 0x45,
+	0x4b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x54, 0x4c,
+	0x53, 0x52, 0x03, 0x74, 0x6c, 0x73, 0x1a, 0x57, 0x0a, 0x03, 0x54, 0x4c, 0x53, 0x12, 0x18, 0x0a,
+	0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07,
+	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x65, 0x72, 0x74, 0x5f,
+	0x66, 0x69, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x65, 0x72, 0x74,
+	0x46, 0x69, 0x6c, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6b, 0x65, 0x79, 0x5f, 0x66, 0x69, 0x6c, 0x65,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6b, 0x65, 0x79, 0x46, 0x69, 0x6c, 0x65, 0x22,
+	0xda, 0x04, 0x0a, 0x07, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x12, 0x14, 0x0a, 0x04, 0x72,
+	0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x04, 0x72, 0x6f, 0x6f,
+	0x74, 0x12, 0x1c, 0x0a, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x34, 0x0a, 0x03, 0x65, 0x6e, 0x76, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x72,
+	0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x45, 0x6e, 0x76,
+	0x52, 0x03, 0x65, 0x6e, 0x76, 0x12, 0x28, 0x0a, 0x10, 0x66, 0x69, 0x6e, 0x64, 0x5f, 0x72, 0x65,
+	0x70, 0x6f, 0x5f, 0x75, 0x70, 0x77, 0x61, 0x72, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x0e, 0x66, 0x69, 0x6e, 0x64, 0x52, 0x65, 0x70, 0x6f, 0x55, 0x70, 0x77, 0x61, 0x72, 0x64, 0x12,
+	0x1c, 0x0a, 0x0c, 0x69, 0x67, 0x6e, 0x6f, 0x72, 0x65, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x73, 0x18,
+	0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x69, 0x67, 0x6e, 0x6f, 0x72, 0x65, 0x12, 0x2b, 0x0a,
+	0x11, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x67, 0x69, 0x74, 0x69, 0x67, 0x6e, 0x6f,
+	0x72, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x47, 0x69, 0x74, 0x69, 0x67, 0x6e, 0x6f, 0x72, 0x65, 0x12, 0x3f, 0x0a, 0x07, 0x66, 0x69,
+	0x6c, 0x74, 0x65, 0x72, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x72, 0x75,
+	0x6e, 0x6d, 0x65, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x46, 0x69, 0x6c, 0x74,
+	0x65, 0x72, 0x52, 0x07, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x1a, 0x45, 0x0a, 0x03, 0x45,
 	0x6e, 0x76, 0x12, 0x24, 0x0a, 0x0e, 0x75, 0x73, 0x65, 0x5f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d,
 	0x5f, 0x65, 0x6e, 0x76, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x75, 0x73, 0x65, 0x53,
 	0x79, 0x73, 0x74, 0x65, 0x6d, 0x45, 0x6e, 0x76, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x6f, 0x75, 0x72,
 	0x63, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x73, 0x1a, 0x4d, 0x0a, 0x03, 0x4c, 0x6f, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x62, 0x6f,
-	0x73, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x76, 0x65, 0x72, 0x62, 0x6f, 0x73,
-	0x65, 0x1a, 0xb7, 0x01, 0x0a, 0x06, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12, 0x18, 0x0a, 0x07,
-	0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61,
-	0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x3a, 0x0a, 0x03, 0x74, 0x6c, 0x73, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x63, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x54, 0x4c, 0x53, 0x52, 0x03, 0x74,
-	0x6c, 0x73, 0x1a, 0x57, 0x0a, 0x03, 0x54, 0x4c, 0x53, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x66, 0x69, 0x6c, 0x65,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x65, 0x72, 0x74, 0x46, 0x69, 0x6c, 0x65,
-	0x12, 0x19, 0x0a, 0x08, 0x6b, 0x65, 0x79, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x07, 0x6b, 0x65, 0x79, 0x46, 0x69, 0x6c, 0x65, 0x22, 0x5a, 0x0a, 0x0a, 0x46,
-	0x69, 0x6c, 0x74, 0x65, 0x72, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1b, 0x0a, 0x17, 0x46, 0x49, 0x4c,
-	0x54, 0x45, 0x52, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49,
-	0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x15, 0x0a, 0x11, 0x46, 0x49, 0x4c, 0x54, 0x45, 0x52,
-	0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x42, 0x4c, 0x4f, 0x43, 0x4b, 0x10, 0x01, 0x12, 0x18, 0x0a,
-	0x14, 0x46, 0x49, 0x4c, 0x54, 0x45, 0x52, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x44, 0x4f, 0x43,
-	0x55, 0x4d, 0x45, 0x4e, 0x54, 0x10, 0x02, 0x42, 0x0f, 0x0a, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x12, 0x05, 0xba, 0x48, 0x02, 0x08, 0x01, 0x42, 0x56, 0x5a, 0x54, 0x67, 0x69, 0x74, 0x68,
-	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x66, 0x75, 0x6c, 0x2f,
-	0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x67,
-	0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x72, 0x75, 0x6e, 0x6d,
-	0x65, 0x2f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61,
-	0x31, 0x3b, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x65, 0x73, 0x1a, 0x7b, 0x0a, 0x06, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x12, 0x47, 0x0a, 0x04,
+	0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x29, 0x2e, 0x72, 0x75, 0x6e,
+	0x6d, 0x65, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x2e, 0x46, 0x69, 0x6c, 0x74, 0x65,
+	0x72, 0x54, 0x79, 0x70, 0x65, 0x42, 0x08, 0xba, 0x48, 0x05, 0x82, 0x01, 0x02, 0x10, 0x01, 0x52,
+	0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x28, 0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69,
+	0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x42, 0x0a, 0xba, 0x48, 0x07, 0x72, 0x05, 0x10,
+	0x01, 0x18, 0x80, 0x08, 0x52, 0x09, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x22,
+	0x5a, 0x0a, 0x0a, 0x46, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1b, 0x0a,
+	0x17, 0x46, 0x49, 0x4c, 0x54, 0x45, 0x52, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53,
+	0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x15, 0x0a, 0x11, 0x46, 0x49,
+	0x4c, 0x54, 0x45, 0x52, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x42, 0x4c, 0x4f, 0x43, 0x4b, 0x10,
+	0x01, 0x12, 0x18, 0x0a, 0x14, 0x46, 0x49, 0x4c, 0x54, 0x45, 0x52, 0x5f, 0x54, 0x59, 0x50, 0x45,
+	0x5f, 0x44, 0x4f, 0x43, 0x55, 0x4d, 0x45, 0x4e, 0x54, 0x10, 0x02, 0x42, 0x0f, 0x0a, 0x06, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x05, 0xba, 0x48, 0x02, 0x08, 0x01, 0x22, 0x79, 0x0a, 0x06,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x35, 0x0a, 0x06, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4b,
+	0x65, 0x72, 0x6e, 0x65, 0x6c, 0x52, 0x06, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x12, 0x38, 0x0a,
+	0x07, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e,
+	0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x76, 0x31,
+	0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x52, 0x07,
+	0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x42, 0x56, 0x5a, 0x54, 0x67, 0x69, 0x74, 0x68, 0x75,
+	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x66, 0x75, 0x6c, 0x2f, 0x72,
+	0x75, 0x6e, 0x6d, 0x65, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x67, 0x65,
+	0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x72, 0x75, 0x6e, 0x6d, 0x65,
+	0x2f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2f, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
+	0x3b, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -667,30 +721,32 @@ func file_runme_config_v1alpha1_config_proto_rawDescGZIP() []byte {
 }
 
 var file_runme_config_v1alpha1_config_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_runme_config_v1alpha1_config_proto_msgTypes = make([]protoimpl.MessageInfo, 7)
+var file_runme_config_v1alpha1_config_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
 var file_runme_config_v1alpha1_config_proto_goTypes = []interface{}{
-	(Config_FilterType)(0),    // 0: runme.config.v1alpha1.Config.FilterType
-	(*Config)(nil),            // 1: runme.config.v1alpha1.Config
-	(*Config_Project)(nil),    // 2: runme.config.v1alpha1.Config.Project
-	(*Config_Filter)(nil),     // 3: runme.config.v1alpha1.Config.Filter
-	(*Config_Env)(nil),        // 4: runme.config.v1alpha1.Config.Env
-	(*Config_Log)(nil),        // 5: runme.config.v1alpha1.Config.Log
-	(*Config_Server)(nil),     // 6: runme.config.v1alpha1.Config.Server
-	(*Config_Server_TLS)(nil), // 7: runme.config.v1alpha1.Config.Server.TLS
+	(Project_FilterType)(0),   // 0: runme.config.v1alpha1.Project.FilterType
+	(*Kernel)(nil),            // 1: runme.config.v1alpha1.Kernel
+	(*Project)(nil),           // 2: runme.config.v1alpha1.Project
+	(*Config)(nil),            // 3: runme.config.v1alpha1.Config
+	(*Kernel_Log)(nil),        // 4: runme.config.v1alpha1.Kernel.Log
+	(*Kernel_Server)(nil),     // 5: runme.config.v1alpha1.Kernel.Server
+	(*Kernel_Server_TLS)(nil), // 6: runme.config.v1alpha1.Kernel.Server.TLS
+	(*Project_Env)(nil),       // 7: runme.config.v1alpha1.Project.Env
+	(*Project_Filter)(nil),    // 8: runme.config.v1alpha1.Project.Filter
 }
 var file_runme_config_v1alpha1_config_proto_depIdxs = []int32{
-	2, // 0: runme.config.v1alpha1.Config.project:type_name -> runme.config.v1alpha1.Config.Project
-	4, // 1: runme.config.v1alpha1.Config.env:type_name -> runme.config.v1alpha1.Config.Env
-	3, // 2: runme.config.v1alpha1.Config.filters:type_name -> runme.config.v1alpha1.Config.Filter
-	5, // 3: runme.config.v1alpha1.Config.log:type_name -> runme.config.v1alpha1.Config.Log
-	6, // 4: runme.config.v1alpha1.Config.server:type_name -> runme.config.v1alpha1.Config.Server
-	0, // 5: runme.config.v1alpha1.Config.Filter.type:type_name -> runme.config.v1alpha1.Config.FilterType
-	7, // 6: runme.config.v1alpha1.Config.Server.tls:type_name -> runme.config.v1alpha1.Config.Server.TLS
-	7, // [7:7] is the sub-list for method output_type
-	7, // [7:7] is the sub-list for method input_type
-	7, // [7:7] is the sub-list for extension type_name
-	7, // [7:7] is the sub-list for extension extendee
-	0, // [0:7] is the sub-list for field type_name
+	4, // 0: runme.config.v1alpha1.Kernel.log:type_name -> runme.config.v1alpha1.Kernel.Log
+	5, // 1: runme.config.v1alpha1.Kernel.server:type_name -> runme.config.v1alpha1.Kernel.Server
+	7, // 2: runme.config.v1alpha1.Project.env:type_name -> runme.config.v1alpha1.Project.Env
+	8, // 3: runme.config.v1alpha1.Project.filters:type_name -> runme.config.v1alpha1.Project.Filter
+	1, // 4: runme.config.v1alpha1.Config.kernel:type_name -> runme.config.v1alpha1.Kernel
+	2, // 5: runme.config.v1alpha1.Config.project:type_name -> runme.config.v1alpha1.Project
+	6, // 6: runme.config.v1alpha1.Kernel.Server.tls:type_name -> runme.config.v1alpha1.Kernel.Server.TLS
+	0, // 7: runme.config.v1alpha1.Project.Filter.type:type_name -> runme.config.v1alpha1.Project.FilterType
+	8, // [8:8] is the sub-list for method output_type
+	8, // [8:8] is the sub-list for method input_type
+	8, // [8:8] is the sub-list for extension type_name
+	8, // [8:8] is the sub-list for extension extendee
+	0, // [0:8] is the sub-list for field type_name
 }
 
 func init() { file_runme_config_v1alpha1_config_proto_init() }
@@ -700,7 +756,7 @@ func file_runme_config_v1alpha1_config_proto_init() {
 	}
 	if !protoimpl.UnsafeEnabled {
 		file_runme_config_v1alpha1_config_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Config); i {
+			switch v := v.(*Kernel); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -712,7 +768,7 @@ func file_runme_config_v1alpha1_config_proto_init() {
 			}
 		}
 		file_runme_config_v1alpha1_config_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Config_Project); i {
+			switch v := v.(*Project); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -724,7 +780,7 @@ func file_runme_config_v1alpha1_config_proto_init() {
 			}
 		}
 		file_runme_config_v1alpha1_config_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Config_Filter); i {
+			switch v := v.(*Config); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -736,7 +792,7 @@ func file_runme_config_v1alpha1_config_proto_init() {
 			}
 		}
 		file_runme_config_v1alpha1_config_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Config_Env); i {
+			switch v := v.(*Kernel_Log); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -748,7 +804,7 @@ func file_runme_config_v1alpha1_config_proto_init() {
 			}
 		}
 		file_runme_config_v1alpha1_config_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Config_Log); i {
+			switch v := v.(*Kernel_Server); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -760,7 +816,7 @@ func file_runme_config_v1alpha1_config_proto_init() {
 			}
 		}
 		file_runme_config_v1alpha1_config_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Config_Server); i {
+			switch v := v.(*Kernel_Server_TLS); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -772,7 +828,19 @@ func file_runme_config_v1alpha1_config_proto_init() {
 			}
 		}
 		file_runme_config_v1alpha1_config_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Config_Server_TLS); i {
+			switch v := v.(*Project_Env); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runme_config_v1alpha1_config_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Project_Filter); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -784,9 +852,9 @@ func file_runme_config_v1alpha1_config_proto_init() {
 			}
 		}
 	}
-	file_runme_config_v1alpha1_config_proto_msgTypes[0].OneofWrappers = []interface{}{
-		(*Config_Project_)(nil),
-		(*Config_Filename)(nil),
+	file_runme_config_v1alpha1_config_proto_msgTypes[1].OneofWrappers = []interface{}{
+		(*Project_Root)(nil),
+		(*Project_Filename)(nil),
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -794,7 +862,7 @@ func file_runme_config_v1alpha1_config_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_runme_config_v1alpha1_config_proto_rawDesc,
 			NumEnums:      1,
-			NumMessages:   7,
+			NumMessages:   8,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/internal/gen/proto/go/runme/runner/v2alpha1/runner_grpc.pb.go b/internal/gen/proto/go/runme/runner/v2alpha1/runner_grpc.pb.go
index 5d6716d49..79d35bd9e 100644
--- a/internal/gen/proto/go/runme/runner/v2alpha1/runner_grpc.pb.go
+++ b/internal/gen/proto/go/runme/runner/v2alpha1/runner_grpc.pb.go
@@ -45,7 +45,7 @@ type RunnerServiceClient interface {
 	// Subsequent "ExecuteRequest" should only contain "input_data" as
 	// other fields will be ignored.
 	Execute(ctx context.Context, opts ...grpc.CallOption) (RunnerService_ExecuteClient, error)
-	// ResolveVars resolves variables from a script or a list of commands
+	// ResolveProgram resolves variables from a script or a list of commands
 	// using the provided sources, which can be a list of environment variables,
 	// a session, or a project.
 	// For now, the resolved variables are only the exported ones using `export`.
@@ -162,7 +162,7 @@ type RunnerServiceServer interface {
 	// Subsequent "ExecuteRequest" should only contain "input_data" as
 	// other fields will be ignored.
 	Execute(RunnerService_ExecuteServer) error
-	// ResolveVars resolves variables from a script or a list of commands
+	// ResolveProgram resolves variables from a script or a list of commands
 	// using the provided sources, which can be a list of environment variables,
 	// a session, or a project.
 	// For now, the resolved variables are only the exported ones using `export`.
diff --git a/internal/gen/proto/ts/google/protobuf/descriptor_pb.d.ts b/internal/gen/proto/ts/google/protobuf/descriptor_pb.d.ts
index 24d33a76f..a270339c1 100644
--- a/internal/gen/proto/ts/google/protobuf/descriptor_pb.d.ts
+++ b/internal/gen/proto/ts/google/protobuf/descriptor_pb.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "google/protobuf/descriptor.proto" (package "google.protobuf", syntax proto2)
 // tslint:disable
 // @ts-nocheck
diff --git a/internal/gen/proto/ts/google/protobuf/descriptor_pb.js b/internal/gen/proto/ts/google/protobuf/descriptor_pb.js
index 776302a11..e7ad35453 100644
--- a/internal/gen/proto/ts/google/protobuf/descriptor_pb.js
+++ b/internal/gen/proto/ts/google/protobuf/descriptor_pb.js
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "google/protobuf/descriptor.proto" (package "google.protobuf", syntax proto2)
 // tslint:disable
 // @ts-nocheck
diff --git a/internal/gen/proto/ts/google/protobuf/wrappers_pb.d.ts b/internal/gen/proto/ts/google/protobuf/wrappers_pb.d.ts
index 056eabb58..22f5b715d 100644
--- a/internal/gen/proto/ts/google/protobuf/wrappers_pb.d.ts
+++ b/internal/gen/proto/ts/google/protobuf/wrappers_pb.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "google/protobuf/wrappers.proto" (package "google.protobuf", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/internal/gen/proto/ts/google/protobuf/wrappers_pb.js b/internal/gen/proto/ts/google/protobuf/wrappers_pb.js
index 1602fa2c2..267e1f399 100644
--- a/internal/gen/proto/ts/google/protobuf/wrappers_pb.js
+++ b/internal/gen/proto/ts/google/protobuf/wrappers_pb.js
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "google/protobuf/wrappers.proto" (package "google.protobuf", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -45,7 +45,7 @@
 // individual entries of a map or fields of a oneof can already detect presence.
 //
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "google/protobuf/wrappers.proto" (package "google.protobuf", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/internal/gen/proto/ts/runme/config/v1alpha1/config_pb.d.ts b/internal/gen/proto/ts/runme/config/v1alpha1/config_pb.d.ts
index 7de7dad99..fd648097a 100644
--- a/internal/gen/proto/ts/runme/config/v1alpha1/config_pb.d.ts
+++ b/internal/gen/proto/ts/runme/config/v1alpha1/config_pb.d.ts
@@ -1,26 +1,96 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/config/v1alpha1/config.proto" (package "runme.config.v1alpha1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
 import { MessageType } from "@protobuf-ts/runtime";
 /**
- * Config describes the configuration of the runme tools, including CLI, server, and clients like VS Code extension.
+ * Kernel describes system-level configuration of the runme toolchain.
  *
- * @generated from protobuf message runme.config.v1alpha1.Config
+ * @generated from protobuf message runme.config.v1alpha1.Kernel
  */
-export interface Config {
+export interface Kernel {
+    /**
+     * log contains the log configuration.
+     *
+     * @generated from protobuf field: runme.config.v1alpha1.Kernel.Log log = 1;
+     */
+    log?: Kernel_Log;
+    /**
+     * @generated from protobuf field: runme.config.v1alpha1.Kernel.Server server = 2;
+     */
+    server?: Kernel_Server;
+}
+/**
+ * @generated from protobuf message runme.config.v1alpha1.Kernel.Log
+ */
+export interface Kernel_Log {
+    /**
+     * enabled indicates whether to enable logging.
+     *
+     * @generated from protobuf field: bool enabled = 1;
+     */
+    enabled: boolean;
+    /**
+     * path is the path to the log output file.
+     *
+     * @generated from protobuf field: string path = 2;
+     */
+    path: string;
+    /**
+     * verbose is the verbosity level of the log.
+     *
+     * @generated from protobuf field: bool verbose = 3;
+     */
+    verbose: boolean;
+}
+/**
+ * @generated from protobuf message runme.config.v1alpha1.Kernel.Server
+ */
+export interface Kernel_Server {
+    /**
+     * @generated from protobuf field: string address = 1;
+     */
+    address: string;
+    /**
+     * @generated from protobuf field: runme.config.v1alpha1.Kernel.Server.TLS tls = 2;
+     */
+    tls?: Kernel_Server_TLS;
+}
+/**
+ * @generated from protobuf message runme.config.v1alpha1.Kernel.Server.TLS
+ */
+export interface Kernel_Server_TLS {
+    /**
+     * @generated from protobuf field: bool enabled = 1;
+     */
+    enabled: boolean;
+    /**
+     * @generated from protobuf field: string cert_file = 2;
+     */
+    certFile: string;
+    /**
+     * @generated from protobuf field: string key_file = 3;
+     */
+    keyFile: string;
+}
+/**
+ * Project describes repo-level configuration of the runme toolchain.
+ *
+ * @generated from protobuf message runme.config.v1alpha1.Project
+ */
+export interface Project {
     /**
      * @generated from protobuf oneof: source
      */
     source: {
-        oneofKind: "project";
+        oneofKind: "root";
         /**
-         * project indicates a dir-based source typically including multiple Markdown files.
+         * root indicates a dir-based source typically including multiple Markdown files.
          *
-         * @generated from protobuf field: runme.config.v1alpha1.Config.Project project = 1;
+         * @generated from protobuf field: string root = 1;
          */
-        project: Config_Project;
+        root: string;
     } | {
         oneofKind: "filename";
         /**
@@ -35,83 +105,41 @@ export interface Config {
     /**
      * env is the environment variables configuration.
      *
-     * @generated from protobuf field: runme.config.v1alpha1.Config.Env env = 3;
-     */
-    env?: Config_Env;
-    /**
-     * filters is a list of filters to apply.
-     * Filters can be applied to documents or
-     * individual code blocks.
-     *
-     * @generated from protobuf field: repeated runme.config.v1alpha1.Config.Filter filters = 5;
+     * @generated from protobuf field: runme.config.v1alpha1.Project.Env env = 3;
      */
-    filters: Config_Filter[];
-    /**
-     * log contains the log configuration.
-     *
-     * @generated from protobuf field: runme.config.v1alpha1.Config.Log log = 7;
-     */
-    log?: Config_Log;
-    /**
-     * @generated from protobuf field: runme.config.v1alpha1.Config.Server server = 8;
-     */
-    server?: Config_Server;
-}
-/**
- * @generated from protobuf message runme.config.v1alpha1.Config.Project
- */
-export interface Config_Project {
-    /**
-     * dir is the directory to look for Markdown files.
-     *
-     * @generated from protobuf field: string dir = 1;
-     */
-    dir: string;
+    env?: Project_Env;
     /**
      * find_repo_upward indicates whether to find the nearest Git repository upward.
      * This is useful to, for example, recognize .gitignore files.
      *
-     * @generated from protobuf field: bool find_repo_upward = 2;
+     * @generated from protobuf field: bool find_repo_upward = 4;
      */
     findRepoUpward: boolean;
     /**
      * ignore_paths is a list of paths to ignore relative to dir.
      *
-     * @generated from protobuf field: repeated string ignore_paths = 3 [json_name = "ignore"];
+     * @generated from protobuf field: repeated string ignore_paths = 5 [json_name = "ignore"];
      */
     ignorePaths: string[];
     /**
      * disable_gitignore indicates whether to disable the .gitignore file.
      *
-     * @generated from protobuf field: bool disable_gitignore = 4;
+     * @generated from protobuf field: bool disable_gitignore = 6;
      */
     disableGitignore: boolean;
-}
-/**
- * @generated from protobuf message runme.config.v1alpha1.Config.Filter
- */
-export interface Config_Filter {
-    /**
-     * type is the type of the filter.
-     *
-     * @generated from protobuf field: runme.config.v1alpha1.Config.FilterType type = 1;
-     */
-    type: Config_FilterType;
     /**
-     * condition is the filter program to execute for each document or block,
-     * depending on the filter type.
-     *
-     * The condition should be a valid Expr expression and it should return a boolean value.
-     * You can read more about the Expr syntax on https://expr-lang.org/.
+     * filters is a list of filters to apply.
+     * Filters can be applied to documents or
+     * individual code blocks.
      *
-     * @generated from protobuf field: string condition = 2;
+     * @generated from protobuf field: repeated runme.config.v1alpha1.Project.Filter filters = 7;
      */
-    condition: string;
+    filters: Project_Filter[];
 }
 /**
- * @generated from protobuf message runme.config.v1alpha1.Config.Env
+ * @generated from protobuf message runme.config.v1alpha1.Project.Env
  */
-export interface Config_Env {
+export interface Project_Env {
     /**
      * use_system_env indicates whether to use the system environment variables.
      *
@@ -126,122 +154,116 @@ export interface Config_Env {
     sources: string[];
 }
 /**
- * @generated from protobuf message runme.config.v1alpha1.Config.Log
+ * @generated from protobuf message runme.config.v1alpha1.Project.Filter
  */
-export interface Config_Log {
+export interface Project_Filter {
     /**
-     * enabled indicates whether to enable logging.
+     * type is the type of the filter.
      *
-     * @generated from protobuf field: bool enabled = 1;
+     * @generated from protobuf field: runme.config.v1alpha1.Project.FilterType type = 1;
      */
-    enabled: boolean;
+    type: Project_FilterType;
     /**
-     * path is the path to the log output file.
+     * condition is the filter program to execute for each document or block,
+     * depending on the filter type.
      *
-     * @generated from protobuf field: string path = 2;
-     */
-    path: string;
-    /**
-     * verbose is the verbosity level of the log.
+     * The condition should be a valid Expr expression and it should return a boolean value.
+     * You can read more about the Expr syntax on https://expr-lang.org/.
      *
-     * @generated from protobuf field: bool verbose = 3;
-     */
-    verbose: boolean;
-}
-/**
- * @generated from protobuf message runme.config.v1alpha1.Config.Server
- */
-export interface Config_Server {
-    /**
-     * @generated from protobuf field: string address = 1;
-     */
-    address: string;
-    /**
-     * @generated from protobuf field: runme.config.v1alpha1.Config.Server.TLS tls = 2;
+     * @generated from protobuf field: string condition = 2;
      */
-    tls?: Config_Server_TLS;
+    condition: string;
 }
 /**
- * @generated from protobuf message runme.config.v1alpha1.Config.Server.TLS
+ * @generated from protobuf enum runme.config.v1alpha1.Project.FilterType
  */
-export interface Config_Server_TLS {
+export declare enum Project_FilterType {
     /**
-     * @generated from protobuf field: bool enabled = 1;
+     * @generated from protobuf enum value: FILTER_TYPE_UNSPECIFIED = 0;
      */
-    enabled: boolean;
+    UNSPECIFIED = 0,
     /**
-     * @generated from protobuf field: string cert_file = 2;
+     * @generated from protobuf enum value: FILTER_TYPE_BLOCK = 1;
      */
-    certFile: string;
+    BLOCK = 1,
     /**
-     * @generated from protobuf field: string key_file = 3;
+     * @generated from protobuf enum value: FILTER_TYPE_DOCUMENT = 2;
      */
-    keyFile: string;
+    DOCUMENT = 2
 }
 /**
- * @generated from protobuf enum runme.config.v1alpha1.Config.FilterType
+ * Config describes the configuration of the runme toolchain, including CLI, server, and clients like VS Code extension.
+ *
+ * @generated from protobuf message runme.config.v1alpha1.Config
  */
-export declare enum Config_FilterType {
-    /**
-     * @generated from protobuf enum value: FILTER_TYPE_UNSPECIFIED = 0;
-     */
-    UNSPECIFIED = 0,
+export interface Config {
     /**
-     * @generated from protobuf enum value: FILTER_TYPE_BLOCK = 1;
+     * kernel is the system-level configuration.
+     *
+     * @generated from protobuf field: runme.config.v1alpha1.Kernel kernel = 1;
      */
-    BLOCK = 1,
+    kernel?: Kernel;
     /**
-     * @generated from protobuf enum value: FILTER_TYPE_DOCUMENT = 2;
+     * project contains configuration applicable to the project inside a repo.
+     *
+     * @generated from protobuf field: runme.config.v1alpha1.Project project = 2;
      */
-    DOCUMENT = 2
+    project?: Project;
 }
-declare class Config$Type extends MessageType<Config> {
+declare class Kernel$Type extends MessageType<Kernel> {
     constructor();
 }
 /**
- * @generated MessageType for protobuf message runme.config.v1alpha1.Config
+ * @generated MessageType for protobuf message runme.config.v1alpha1.Kernel
  */
-export declare const Config: Config$Type;
-declare class Config_Project$Type extends MessageType<Config_Project> {
+export declare const Kernel: Kernel$Type;
+declare class Kernel_Log$Type extends MessageType<Kernel_Log> {
     constructor();
 }
 /**
- * @generated MessageType for protobuf message runme.config.v1alpha1.Config.Project
+ * @generated MessageType for protobuf message runme.config.v1alpha1.Kernel.Log
  */
-export declare const Config_Project: Config_Project$Type;
-declare class Config_Filter$Type extends MessageType<Config_Filter> {
+export declare const Kernel_Log: Kernel_Log$Type;
+declare class Kernel_Server$Type extends MessageType<Kernel_Server> {
     constructor();
 }
 /**
- * @generated MessageType for protobuf message runme.config.v1alpha1.Config.Filter
+ * @generated MessageType for protobuf message runme.config.v1alpha1.Kernel.Server
  */
-export declare const Config_Filter: Config_Filter$Type;
-declare class Config_Env$Type extends MessageType<Config_Env> {
+export declare const Kernel_Server: Kernel_Server$Type;
+declare class Kernel_Server_TLS$Type extends MessageType<Kernel_Server_TLS> {
     constructor();
 }
 /**
- * @generated MessageType for protobuf message runme.config.v1alpha1.Config.Env
+ * @generated MessageType for protobuf message runme.config.v1alpha1.Kernel.Server.TLS
  */
-export declare const Config_Env: Config_Env$Type;
-declare class Config_Log$Type extends MessageType<Config_Log> {
+export declare const Kernel_Server_TLS: Kernel_Server_TLS$Type;
+declare class Project$Type extends MessageType<Project> {
     constructor();
 }
 /**
- * @generated MessageType for protobuf message runme.config.v1alpha1.Config.Log
+ * @generated MessageType for protobuf message runme.config.v1alpha1.Project
  */
-export declare const Config_Log: Config_Log$Type;
-declare class Config_Server$Type extends MessageType<Config_Server> {
+export declare const Project: Project$Type;
+declare class Project_Env$Type extends MessageType<Project_Env> {
     constructor();
 }
 /**
- * @generated MessageType for protobuf message runme.config.v1alpha1.Config.Server
+ * @generated MessageType for protobuf message runme.config.v1alpha1.Project.Env
  */
-export declare const Config_Server: Config_Server$Type;
-declare class Config_Server_TLS$Type extends MessageType<Config_Server_TLS> {
+export declare const Project_Env: Project_Env$Type;
+declare class Project_Filter$Type extends MessageType<Project_Filter> {
     constructor();
 }
 /**
- * @generated MessageType for protobuf message runme.config.v1alpha1.Config.Server.TLS
+ * @generated MessageType for protobuf message runme.config.v1alpha1.Project.Filter
  */
-export declare const Config_Server_TLS: Config_Server_TLS$Type;
+export declare const Project_Filter: Project_Filter$Type;
+declare class Config$Type extends MessageType<Config> {
+    constructor();
+}
+/**
+ * @generated MessageType for protobuf message runme.config.v1alpha1.Config
+ */
+export declare const Config: Config$Type;
 export {};
diff --git a/internal/gen/proto/ts/runme/config/v1alpha1/config_pb.js b/internal/gen/proto/ts/runme/config/v1alpha1/config_pb.js
index a76fc0d00..b10a0ee5d 100644
--- a/internal/gen/proto/ts/runme/config/v1alpha1/config_pb.js
+++ b/internal/gen/proto/ts/runme/config/v1alpha1/config_pb.js
@@ -1,128 +1,140 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/config/v1alpha1/config.proto" (package "runme.config.v1alpha1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/config/v1alpha1/config.proto" (package "runme.config.v1alpha1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
 import { MessageType } from "@protobuf-ts/runtime";
 /**
- * @generated from protobuf enum runme.config.v1alpha1.Config.FilterType
+ * @generated from protobuf enum runme.config.v1alpha1.Project.FilterType
  */
-export var Config_FilterType;
-(function (Config_FilterType) {
+export var Project_FilterType;
+(function (Project_FilterType) {
     /**
      * @generated from protobuf enum value: FILTER_TYPE_UNSPECIFIED = 0;
      */
-    Config_FilterType[Config_FilterType["UNSPECIFIED"] = 0] = "UNSPECIFIED";
+    Project_FilterType[Project_FilterType["UNSPECIFIED"] = 0] = "UNSPECIFIED";
     /**
      * @generated from protobuf enum value: FILTER_TYPE_BLOCK = 1;
      */
-    Config_FilterType[Config_FilterType["BLOCK"] = 1] = "BLOCK";
+    Project_FilterType[Project_FilterType["BLOCK"] = 1] = "BLOCK";
     /**
      * @generated from protobuf enum value: FILTER_TYPE_DOCUMENT = 2;
      */
-    Config_FilterType[Config_FilterType["DOCUMENT"] = 2] = "DOCUMENT";
-})(Config_FilterType || (Config_FilterType = {}));
+    Project_FilterType[Project_FilterType["DOCUMENT"] = 2] = "DOCUMENT";
+})(Project_FilterType || (Project_FilterType = {}));
 // @generated message type with reflection information, may provide speed optimized methods
-class Config$Type extends MessageType {
+class Kernel$Type extends MessageType {
     constructor() {
-        super("runme.config.v1alpha1.Config", [
-            { no: 1, name: "project", kind: "message", oneof: "source", T: () => Config_Project },
-            { no: 2, name: "filename", kind: "scalar", oneof: "source", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "env", kind: "message", T: () => Config_Env },
-            { no: 5, name: "filters", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Config_Filter },
-            { no: 7, name: "log", kind: "message", T: () => Config_Log },
-            { no: 8, name: "server", kind: "message", T: () => Config_Server }
+        super("runme.config.v1alpha1.Kernel", [
+            { no: 1, name: "log", kind: "message", T: () => Kernel_Log },
+            { no: 2, name: "server", kind: "message", T: () => Kernel_Server }
         ]);
     }
 }
 /**
- * @generated MessageType for protobuf message runme.config.v1alpha1.Config
+ * @generated MessageType for protobuf message runme.config.v1alpha1.Kernel
  */
-export const Config = new Config$Type();
+export const Kernel = new Kernel$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class Config_Project$Type extends MessageType {
+class Kernel_Log$Type extends MessageType {
     constructor() {
-        super("runme.config.v1alpha1.Config.Project", [
-            { no: 1, name: "dir", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "find_repo_upward", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 3, name: "ignore_paths", kind: "scalar", jsonName: "ignore", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "disable_gitignore", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
+        super("runme.config.v1alpha1.Kernel.Log", [
+            { no: 1, name: "enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 2, name: "path", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "verbose", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
         ]);
     }
 }
 /**
- * @generated MessageType for protobuf message runme.config.v1alpha1.Config.Project
+ * @generated MessageType for protobuf message runme.config.v1alpha1.Kernel.Log
  */
-export const Config_Project = new Config_Project$Type();
+export const Kernel_Log = new Kernel_Log$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class Config_Filter$Type extends MessageType {
+class Kernel_Server$Type extends MessageType {
     constructor() {
-        super("runme.config.v1alpha1.Config.Filter", [
-            { no: 1, name: "type", kind: "enum", T: () => ["runme.config.v1alpha1.Config.FilterType", Config_FilterType, "FILTER_TYPE_"], options: { "buf.validate.field": { enum: { definedOnly: true } } } },
-            { no: 2, name: "condition", kind: "scalar", T: 9 /*ScalarType.STRING*/, options: { "buf.validate.field": { string: { minLen: "1", maxLen: "1024" } } } }
+        super("runme.config.v1alpha1.Kernel.Server", [
+            { no: 1, name: "address", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "tls", kind: "message", T: () => Kernel_Server_TLS }
         ]);
     }
 }
 /**
- * @generated MessageType for protobuf message runme.config.v1alpha1.Config.Filter
+ * @generated MessageType for protobuf message runme.config.v1alpha1.Kernel.Server
  */
-export const Config_Filter = new Config_Filter$Type();
+export const Kernel_Server = new Kernel_Server$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class Config_Env$Type extends MessageType {
+class Kernel_Server_TLS$Type extends MessageType {
     constructor() {
-        super("runme.config.v1alpha1.Config.Env", [
-            { no: 1, name: "use_system_env", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 2, name: "sources", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+        super("runme.config.v1alpha1.Kernel.Server.TLS", [
+            { no: 1, name: "enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 2, name: "cert_file", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "key_file", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
 }
 /**
- * @generated MessageType for protobuf message runme.config.v1alpha1.Config.Env
+ * @generated MessageType for protobuf message runme.config.v1alpha1.Kernel.Server.TLS
  */
-export const Config_Env = new Config_Env$Type();
+export const Kernel_Server_TLS = new Kernel_Server_TLS$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class Config_Log$Type extends MessageType {
+class Project$Type extends MessageType {
     constructor() {
-        super("runme.config.v1alpha1.Config.Log", [
-            { no: 1, name: "enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 2, name: "path", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "verbose", kind: "scalar", T: 8 /*ScalarType.BOOL*/ }
+        super("runme.config.v1alpha1.Project", [
+            { no: 1, name: "root", kind: "scalar", oneof: "source", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "filename", kind: "scalar", oneof: "source", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "env", kind: "message", T: () => Project_Env },
+            { no: 4, name: "find_repo_upward", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 5, name: "ignore_paths", kind: "scalar", jsonName: "ignore", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "disable_gitignore", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 7, name: "filters", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => Project_Filter }
         ]);
     }
 }
 /**
- * @generated MessageType for protobuf message runme.config.v1alpha1.Config.Log
+ * @generated MessageType for protobuf message runme.config.v1alpha1.Project
  */
-export const Config_Log = new Config_Log$Type();
+export const Project = new Project$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class Config_Server$Type extends MessageType {
+class Project_Env$Type extends MessageType {
     constructor() {
-        super("runme.config.v1alpha1.Config.Server", [
-            { no: 1, name: "address", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "tls", kind: "message", T: () => Config_Server_TLS }
+        super("runme.config.v1alpha1.Project.Env", [
+            { no: 1, name: "use_system_env", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 2, name: "sources", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
         ]);
     }
 }
 /**
- * @generated MessageType for protobuf message runme.config.v1alpha1.Config.Server
+ * @generated MessageType for protobuf message runme.config.v1alpha1.Project.Env
  */
-export const Config_Server = new Config_Server$Type();
+export const Project_Env = new Project_Env$Type();
 // @generated message type with reflection information, may provide speed optimized methods
-class Config_Server_TLS$Type extends MessageType {
+class Project_Filter$Type extends MessageType {
     constructor() {
-        super("runme.config.v1alpha1.Config.Server.TLS", [
-            { no: 1, name: "enabled", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
-            { no: 2, name: "cert_file", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "key_file", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        super("runme.config.v1alpha1.Project.Filter", [
+            { no: 1, name: "type", kind: "enum", T: () => ["runme.config.v1alpha1.Project.FilterType", Project_FilterType, "FILTER_TYPE_"], options: { "buf.validate.field": { enum: { definedOnly: true } } } },
+            { no: 2, name: "condition", kind: "scalar", T: 9 /*ScalarType.STRING*/, options: { "buf.validate.field": { string: { minLen: "1", maxLen: "1024" } } } }
+        ]);
+    }
+}
+/**
+ * @generated MessageType for protobuf message runme.config.v1alpha1.Project.Filter
+ */
+export const Project_Filter = new Project_Filter$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class Config$Type extends MessageType {
+    constructor() {
+        super("runme.config.v1alpha1.Config", [
+            { no: 1, name: "kernel", kind: "message", T: () => Kernel },
+            { no: 2, name: "project", kind: "message", T: () => Project }
         ]);
     }
 }
 /**
- * @generated MessageType for protobuf message runme.config.v1alpha1.Config.Server.TLS
+ * @generated MessageType for protobuf message runme.config.v1alpha1.Config
  */
-export const Config_Server_TLS = new Config_Server_TLS$Type();
+export const Config = new Config$Type();
diff --git a/internal/gen/proto/ts/runme/parser/v1/parser_pb.client.d.ts b/internal/gen/proto/ts/runme/parser/v1/parser_pb.client.d.ts
index 9271efafd..ec57f80ba 100644
--- a/internal/gen/proto/ts/runme/parser/v1/parser_pb.client.d.ts
+++ b/internal/gen/proto/ts/runme/parser/v1/parser_pb.client.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/parser/v1/parser.proto" (package "runme.parser.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/internal/gen/proto/ts/runme/parser/v1/parser_pb.client.js b/internal/gen/proto/ts/runme/parser/v1/parser_pb.client.js
index 6e1823213..b26827eca 100644
--- a/internal/gen/proto/ts/runme/parser/v1/parser_pb.client.js
+++ b/internal/gen/proto/ts/runme/parser/v1/parser_pb.client.js
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/parser/v1/parser.proto" (package "runme.parser.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/internal/gen/proto/ts/runme/parser/v1/parser_pb.d.ts b/internal/gen/proto/ts/runme/parser/v1/parser_pb.d.ts
index fab79bdc0..5af4b2df0 100644
--- a/internal/gen/proto/ts/runme/parser/v1/parser_pb.d.ts
+++ b/internal/gen/proto/ts/runme/parser/v1/parser_pb.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/parser/v1/parser.proto" (package "runme.parser.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/internal/gen/proto/ts/runme/parser/v1/parser_pb.js b/internal/gen/proto/ts/runme/parser/v1/parser_pb.js
index 239ace9d7..a22f06084 100644
--- a/internal/gen/proto/ts/runme/parser/v1/parser_pb.js
+++ b/internal/gen/proto/ts/runme/parser/v1/parser_pb.js
@@ -1,10 +1,10 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/parser/v1/parser.proto" (package "runme.parser.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/parser/v1/parser.proto" (package "runme.parser.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/internal/gen/proto/ts/runme/project/v1/project_pb.client.d.ts b/internal/gen/proto/ts/runme/project/v1/project_pb.client.d.ts
index 20230a4cb..44052292e 100644
--- a/internal/gen/proto/ts/runme/project/v1/project_pb.client.d.ts
+++ b/internal/gen/proto/ts/runme/project/v1/project_pb.client.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/project/v1/project.proto" (package "runme.project.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/internal/gen/proto/ts/runme/project/v1/project_pb.client.js b/internal/gen/proto/ts/runme/project/v1/project_pb.client.js
index 2c9bc06e0..57e0669f2 100644
--- a/internal/gen/proto/ts/runme/project/v1/project_pb.client.js
+++ b/internal/gen/proto/ts/runme/project/v1/project_pb.client.js
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/project/v1/project.proto" (package "runme.project.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/internal/gen/proto/ts/runme/project/v1/project_pb.d.ts b/internal/gen/proto/ts/runme/project/v1/project_pb.d.ts
index 2fe50f994..f2f5e18d0 100644
--- a/internal/gen/proto/ts/runme/project/v1/project_pb.d.ts
+++ b/internal/gen/proto/ts/runme/project/v1/project_pb.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/project/v1/project.proto" (package "runme.project.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/internal/gen/proto/ts/runme/project/v1/project_pb.js b/internal/gen/proto/ts/runme/project/v1/project_pb.js
index ad2c2b3a2..75307e14d 100644
--- a/internal/gen/proto/ts/runme/project/v1/project_pb.js
+++ b/internal/gen/proto/ts/runme/project/v1/project_pb.js
@@ -1,10 +1,10 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/project/v1/project.proto" (package "runme.project.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/project/v1/project.proto" (package "runme.project.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/internal/gen/proto/ts/runme/runner/v1/runner_pb.client.d.ts b/internal/gen/proto/ts/runme/runner/v1/runner_pb.client.d.ts
index e45f94def..c927af9f1 100644
--- a/internal/gen/proto/ts/runme/runner/v1/runner_pb.client.d.ts
+++ b/internal/gen/proto/ts/runme/runner/v1/runner_pb.client.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/runner/v1/runner.proto" (package "runme.runner.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/internal/gen/proto/ts/runme/runner/v1/runner_pb.client.js b/internal/gen/proto/ts/runme/runner/v1/runner_pb.client.js
index 483843cd3..da10571de 100644
--- a/internal/gen/proto/ts/runme/runner/v1/runner_pb.client.js
+++ b/internal/gen/proto/ts/runme/runner/v1/runner_pb.client.js
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/runner/v1/runner.proto" (package "runme.runner.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/internal/gen/proto/ts/runme/runner/v1/runner_pb.d.ts b/internal/gen/proto/ts/runme/runner/v1/runner_pb.d.ts
index 7d4748e8b..cfe956186 100644
--- a/internal/gen/proto/ts/runme/runner/v1/runner_pb.d.ts
+++ b/internal/gen/proto/ts/runme/runner/v1/runner_pb.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/runner/v1/runner.proto" (package "runme.runner.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -825,18 +825,9 @@ declare class ProcessPID$Type extends MessageType<ProcessPID> {
 /**
  * @generated MessageType for protobuf message runme.runner.v1.ProcessPID
  */
-export const ProcessPID = new ProcessPID$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ExecuteResponse$Type extends MessageType<ExecuteResponse> {
-    constructor() {
-        super("runme.runner.v1.ExecuteResponse", [
-            { no: 1, name: "exit_code", kind: "message", T: () => UInt32Value },
-            { no: 2, name: "stdout_data", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 3, name: "stderr_data", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 4, name: "pid", kind: "message", T: () => ProcessPID },
-            { no: 5, name: "mime_type", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
+export declare const ProcessPID: ProcessPID$Type;
+declare class ExecuteResponse$Type extends MessageType<ExecuteResponse> {
+    constructor();
 }
 /**
  * @generated MessageType for protobuf message runme.runner.v1.ExecuteResponse
diff --git a/internal/gen/proto/ts/runme/runner/v1/runner_pb.js b/internal/gen/proto/ts/runme/runner/v1/runner_pb.js
index cca295a5f..7d285682e 100644
--- a/internal/gen/proto/ts/runme/runner/v1/runner_pb.js
+++ b/internal/gen/proto/ts/runme/runner/v1/runner_pb.js
@@ -1,10 +1,10 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/runner/v1/runner.proto" (package "runme.runner.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/runner/v1/runner.proto" (package "runme.runner.v1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -379,7 +379,8 @@ class ExecuteResponse$Type extends MessageType {
             { no: 1, name: "exit_code", kind: "message", T: () => UInt32Value },
             { no: 2, name: "stdout_data", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
             { no: 3, name: "stderr_data", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 4, name: "pid", kind: "message", T: () => ProcessPID }
+            { no: 4, name: "pid", kind: "message", T: () => ProcessPID },
+            { no: 5, name: "mime_type", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
 }
diff --git a/internal/gen/proto/ts/runme/runner/v2alpha1/config_pb.d.ts b/internal/gen/proto/ts/runme/runner/v2alpha1/config_pb.d.ts
index 8c46e2f18..07cc7144f 100644
--- a/internal/gen/proto/ts/runme/runner/v2alpha1/config_pb.d.ts
+++ b/internal/gen/proto/ts/runme/runner/v2alpha1/config_pb.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/runner/v2alpha1/config.proto" (package "runme.runner.v2alpha1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/internal/gen/proto/ts/runme/runner/v2alpha1/config_pb.js b/internal/gen/proto/ts/runme/runner/v2alpha1/config_pb.js
index af6185104..1ab02e5c3 100644
--- a/internal/gen/proto/ts/runme/runner/v2alpha1/config_pb.js
+++ b/internal/gen/proto/ts/runme/runner/v2alpha1/config_pb.js
@@ -1,10 +1,10 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/runner/v2alpha1/config.proto" (package "runme.runner.v2alpha1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/runner/v2alpha1/config.proto" (package "runme.runner.v2alpha1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
diff --git a/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.client.d.ts b/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.client.d.ts
index baee36eb4..7cd5a85ca 100644
--- a/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.client.d.ts
+++ b/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.client.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/runner/v2alpha1/runner.proto" (package "runme.runner.v2alpha1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -59,7 +59,7 @@ export interface IRunnerServiceClient {
      */
     execute(options?: RpcOptions): DuplexStreamingCall<ExecuteRequest, ExecuteResponse>;
     /**
-     * ResolveVars resolves variables from a script or a list of commands
+     * ResolveProgram resolves variables from a script or a list of commands
      * using the provided sources, which can be a list of environment variables,
      * a session, or a project.
      * For now, the resolved variables are only the exported ones using `export`.
@@ -110,7 +110,7 @@ export declare class RunnerServiceClient implements IRunnerServiceClient, Servic
      */
     execute(options?: RpcOptions): DuplexStreamingCall<ExecuteRequest, ExecuteResponse>;
     /**
-     * ResolveVars resolves variables from a script or a list of commands
+     * ResolveProgram resolves variables from a script or a list of commands
      * using the provided sources, which can be a list of environment variables,
      * a session, or a project.
      * For now, the resolved variables are only the exported ones using `export`.
diff --git a/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.client.js b/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.client.js
index eca578a44..baa7bb068 100644
--- a/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.client.js
+++ b/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.client.js
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/runner/v2alpha1/runner.proto" (package "runme.runner.v2alpha1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -66,7 +66,7 @@ export class RunnerServiceClient {
         return stackIntercept("duplex", this._transport, method, opt);
     }
     /**
-     * ResolveVars resolves variables from a script or a list of commands
+     * ResolveProgram resolves variables from a script or a list of commands
      * using the provided sources, which can be a list of environment variables,
      * a session, or a project.
      * For now, the resolved variables are only the exported ones using `export`.
diff --git a/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.d.ts b/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.d.ts
index 29342a4ef..a2140bf9d 100644
--- a/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.d.ts
+++ b/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.d.ts
@@ -1,5 +1,5 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/runner/v2alpha1/runner.proto" (package "runme.runner.v2alpha1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -613,18 +613,9 @@ declare class ExecuteRequest$Type extends MessageType<ExecuteRequest> {
 /**
  * @generated MessageType for protobuf message runme.runner.v2alpha1.ExecuteRequest
  */
-export const ExecuteRequest = new ExecuteRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class ExecuteResponse$Type extends MessageType<ExecuteResponse> {
-    constructor() {
-        super("runme.runner.v2alpha1.ExecuteResponse", [
-            { no: 1, name: "exit_code", kind: "message", T: () => UInt32Value },
-            { no: 2, name: "stdout_data", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 3, name: "stderr_data", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 4, name: "pid", kind: "message", T: () => UInt32Value },
-            { no: 5, name: "mime_type", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
+export declare const ExecuteRequest: ExecuteRequest$Type;
+declare class ExecuteResponse$Type extends MessageType<ExecuteResponse> {
+    constructor();
 }
 /**
  * @generated MessageType for protobuf message runme.runner.v2alpha1.ExecuteResponse
diff --git a/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.js b/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.js
index 487142647..930a9843a 100644
--- a/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.js
+++ b/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.js
@@ -1,10 +1,10 @@
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/runner/v2alpha1/runner.proto" (package "runme.runner.v2alpha1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
 /* eslint-disable */
-// @generated by protobuf-ts 2.9.3 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
+// @generated by protobuf-ts 2.9.4 with parameter output_javascript,optimize_code_size,long_type_string,add_pb_suffix,ts_nocheck,eslint_disable
 // @generated from protobuf file "runme/runner/v2alpha1/runner.proto" (package "runme.runner.v2alpha1", syntax proto3)
 // tslint:disable
 // @ts-nocheck
@@ -301,7 +301,8 @@ class ExecuteResponse$Type extends MessageType {
             { no: 1, name: "exit_code", kind: "message", T: () => UInt32Value },
             { no: 2, name: "stdout_data", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
             { no: 3, name: "stderr_data", kind: "scalar", T: 12 /*ScalarType.BYTES*/ },
-            { no: 4, name: "pid", kind: "message", T: () => UInt32Value }
+            { no: 4, name: "pid", kind: "message", T: () => UInt32Value },
+            { no: 5, name: "mime_type", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
         ]);
     }
 }
diff --git a/testdata/beta/base.txtar b/testdata/beta/base.txtar
index 2240aaa52..cee5521e2 100644
--- a/testdata/beta/base.txtar
+++ b/testdata/beta/base.txtar
@@ -17,12 +17,13 @@ stderr 'no tasks to run'
 -- experimental/runme.yaml --
 version: v1alpha1
 project:
-  dir: "."
-env:
-  sources:
-    - .env
-# log:
-#   enable: true
+  root: "."
+  env:
+    sources:
+      - .env
+#kernel:
+#  log:
+#    enable: true
 
 -- .env --
 ENV_IN_ENV="env_in_env"
diff --git a/testdata/beta/categories.txtar b/testdata/beta/categories.txtar
index 8e28d2598..7057a4159 100644
--- a/testdata/beta/categories.txtar
+++ b/testdata/beta/categories.txtar
@@ -8,9 +8,11 @@ stdout '^bar[\s]+bar-baz[\s]+$'
 
 -- experimental/runme.yaml --
 version: v1alpha1
-filename: README.md
-# log:
-#   enable: true
+project:
+  filename: README.md
+#kernel:
+#  log:
+#    enable: true
 
 -- README.md --
 ```sh {"category": "foo", "name": "foo"}
diff --git a/testdata/beta/failure.txtar b/testdata/beta/failure.txtar
index 1a962d6d7..9e36f5cba 100644
--- a/testdata/beta/failure.txtar
+++ b/testdata/beta/failure.txtar
@@ -12,7 +12,8 @@ stderr '^could not execute command: failed to open file-based project ".*/unknow
 
 -- experimental/runme.yaml --
 version: v1alpha1
-filename: README.md
+project:
+  filename: README.md
 
 -- README.md --
 ```sh { "name": "not-found-singleline" }
diff --git a/testdata/beta/find_repo_upward.txtar b/testdata/beta/find_repo_upward.txtar
index e45f1b93c..c01be856d 100644
--- a/testdata/beta/find_repo_upward.txtar
+++ b/testdata/beta/find_repo_upward.txtar
@@ -13,11 +13,11 @@ cmp stdout result-print.txt
 -- nested/experimental/runme.yaml --
 version: v1alpha1
 project:
-  dir: "."
+  root: "."
   find_repo_upward: true
-env:
-  sources:
-    - .env
+  env:
+    sources:
+      - .env
 
 # Ensure that there is a git repository upwards.
 # It contains .gitignore which should be respected.
diff --git a/testdata/beta/project_dir_nested.txtar b/testdata/beta/project_dir_nested.txtar
index 2168e28b6..26116ddc4 100644
--- a/testdata/beta/project_dir_nested.txtar
+++ b/testdata/beta/project_dir_nested.txtar
@@ -9,10 +9,10 @@ cmp stdout result-print.txt
 -- experimental/runme.yaml --
 version: v1alpha1
 project:
-  dir: "./nested"
-env:
-  sources:
-    - .env
+  root: "./nested"
+  env:
+    sources:
+      - .env
 
 -- README.md --
 ```sh {"name": "root-hello"}
diff --git a/testdata/beta/server.txtar b/testdata/beta/server.txtar
index 64605675d..7f4344c90 100644
--- a/testdata/beta/server.txtar
+++ b/testdata/beta/server.txtar
@@ -8,16 +8,18 @@ stderr '(?sm)server listening'
 
 -- experimental/runme.yaml --
 version: v1alpha1
-filename: README.md
-server:
-  address: unix://runme.sock
-  tls:
+project:
+  filename: README.md
+kernel:
+  server:
+    address: unix://runme.sock
+    tls:
+      enabled: true
+      cert_file: "cert.pem"
+      key_file: "key.pem"
+  log:
     enabled: true
-    cert_file: "cert.pem"
-    key_file: "key.pem"
-log:
-  enabled: true
-  verbose: true
+    verbose: true
 
 -- README.md --
 ```sh {"name": "hello"}