diff --git a/nix/agent-modules/agent-service.nix b/nix/agent-modules/agent-service.nix
index 2dca4049..21671fb5 100644
--- a/nix/agent-modules/agent-service.nix
+++ b/nix/agent-modules/agent-service.nix
@@ -201,6 +201,13 @@ in
           # `hive_c0re::agent_sockets::socket_path_for(name)` so lifecycle
           # bind-mounts and gateway upstream config stay in sync.
           HIVE_WEB_SOCKET = "/run/hive-agent/${userName}/web.sock";
+          # In-agent socket (loose-ends v2): the harness binds this and
+          # serves the `hive-agent-sock` todo protocol to the in-container
+          # producers (matrix daemon) + the MCP bridge (`get_loose_ends`).
+          # Same per-agent runtime dir as the web socket so all agent-user
+          # services in this container can reach it; purely in-container
+          # (never bind-mounted to the host — unlike hive-c0re's mcp.sock).
+          HIVE_AGENT_SOCKET = "/run/hive-agent/${userName}/agent.sock";
           # Loopback URL of the persistent `hive-mcp-http` daemon that
           # `render_claude_config` points claude at for the built-in
           # surface (HTTP is the sole transport — no per-turn stdio child).
diff --git a/nix/agent-modules/matrix.nix b/nix/agent-modules/matrix.nix
index 06c50331..1d13ce15 100644
--- a/nix/agent-modules/matrix.nix
+++ b/nix/agent-modules/matrix.nix
@@ -219,6 +219,10 @@ in
       wants = [ "network-online.target" ];
       environment = {
         HIVE_MATRIX_SOCKET = "/run/hive-matrix/socket";
+        # In-agent todo socket the harness serves (loose-ends v2): the
+        # matrix sweep pushes unread-room + pending-invite todos here
+        # instead of firing wakes at hive-c0re's mcp.sock.
+        HIVE_AGENT_SOCKET = "/run/hive-agent/${userName}/agent.sock";
         RUST_LOG = "info";
       }
       # Homeserver URL: by default the daemon inherits the host-forwarded
diff --git a/nix/agent-modules/mcp.nix b/nix/agent-modules/mcp.nix
index 8d039260..6a6aaeca 100644
--- a/nix/agent-modules/mcp.nix
+++ b/nix/agent-modules/mcp.nix
@@ -221,6 +221,10 @@ in
       wantedBy = [ "multi-user.target" ];
       before = [ "hive-agent.service" ];
       environment.RUST_LOG = "info";
+      # In-agent todo socket the harness serves (loose-ends v2): the
+      # `get_loose_ends` handler dials it to merge this agent's local todos
+      # with the static loose-ends from hive-c0re.
+      environment.HIVE_AGENT_SOCKET = "/run/hive-agent/${userName}/agent.sock";
       serviceConfig = {
         ExecStart = "${config.hyperhive.packages.hive-agent-mcp}/bin/hive-agent-mcp --http 127.0.0.1:${toString config.hyperhive.mcp.httpPort}";
         SyslogIdentifier = "hive-mcp-http";