docs: SPA pattern noted, todo cleared; harness-base git config mkDefault

programs.git.config.user.{name,email} in harness-base.nix now mkDefault
so the per-agent applied flake's override merges without mkForce.

CLAUDE.md

@@ -21,8 +21,8 @@ hive-c0re/         host daemon + CLI (one binary, subcommand-dispatched)
   src/actions.rs        approve/deny/destroy
   src/auto_update.rs    startup rebuild scan + ensure_manager
   src/lifecycle.rs      `nixos-container` shellouts, per-agent flake generator
-  src/dashboard.rs      axum HTTP UI: containers, approvals, async-form actions
-  assets/               CSS + JS shipped via include_str!
+  src/dashboard.rs      axum HTTP: static shell + /api/state JSON + actions
+  assets/               index.html, dashboard.css, app.js (include_str!)
 
 hive-ag3nt/        in-container harness crate; produces TWO binaries
   src/lib.rs            re-exports + DEFAULT_SOCKET, DEFAULT_WEB_PORT
@@ -120,6 +120,32 @@ nix/
   marks them `failed` with note `"agent state dir missing"` so they fall out
   of `pending`. They stay in sqlite for audit.
 
+## Web UI shape
+
+Both the dashboard (port 7000) and the per-agent web UIs (8000 /
+8100-8999) are SPAs with the same skeleton:
+
+- `GET /` → static `assets/index.html` (placeholders for state-driven
+  sections).
+- `GET /static/*.css` + `GET /static/*.js` → static assets shipped via
+  `include_str!` so there's no runtime file dependency.
+- `GET /api/state` → JSON snapshot the JS app renders into the DOM.
+- `POST /<action>` (approve, deny, kill, restart, rebuild, destroy,
+  request-spawn, update-all, send, login/*) → idempotent action endpoints.
+- `GET /events/stream` (per-agent) and `GET /messages/stream` (dashboard)
+  are `text/event-stream` SSE for live updates.
+
+The JS app handles all `form[data-async]` submissions via a delegated
+listener: read `data-confirm`, swap the button to a spinner, POST
+`application/x-www-form-urlencoded` (axum's `Form` extractor rejects
+multipart), then on success call `refreshState()` (re-fetch `/api/state`
+and re-render). No full-page reloads.
+
+Per-agent + dashboard state shapes live in `dashboard.rs::StateSnapshot`
+and `web_ui.rs::StateSnapshot`. When adding new state fields, plumb
+through the snapshot struct and the relevant `assets/app.js` render
+function — never reach for server-side HTML rendering again.
+
 ## Agent MCP surface + turn loop
 
 The harness ships an embedded MCP server (rmcp 1.7) that claude launches as