feat(#1969): ship claude settings via /etc/claude-code/managed-settings.json

docs/turn-loop.md

@@ -135,13 +135,22 @@ if a new inbox message arrives before this turn ends"). The
 
 ```
 claude --print --verbose --output-format stream-json --model <name> \
-  --continue --settings /run/hive/claude-settings.json \
+  --effort <level> --continue \
   --system-prompt-file /run/hive/claude-system-prompt.md \
   --mcp-config /run/hive/claude-mcp-config.json --strict-mcp-config \
   --tools <builtins> --allowedTools <builtins+mcp>
 # wake prompt piped over stdin
 ```
 
+Static settings are no longer passed with `--settings`: hive-enforced
+settings ship at `/etc/claude-code/managed-settings.json` (claude-code's
+canonical managed-settings path — precedence #1, read-only,
+un-overridable), wired in `nix/templates/harness-base.nix` from the
+`prompts/claude-settings.json` asset. `effortLevel` is deliberately not
+in that file — effort is controlled live via the `--effort` flag
+(`HIVE_DEFAULT_EFFORT` / the per-agent UI slider), which managed scope
+would otherwise lock.
+
 `<name>` is read from `Bus::model()` on each turn. The initial
 default is set by `hyperhive.model` in the agent's `agent.nix`
 (NixOS option; propagates via `HIVE_DEFAULT_MODEL` env var; falls
@@ -172,9 +181,9 @@ percentage-of-window ctx badge.
 
 `--continue` keeps a persistent session per agent (claude stores
 sessions in `~/.claude/projects/`, which is bind-mounted
-persistently). Auto-compact and auto-memory are disabled via
-`--settings` because hyperhive owns compaction — see
-[Compaction](#compaction) below.
+persistently). Auto-compact and auto-memory are disabled via the
+managed settings at `/etc/claude-code/managed-settings.json` because
+hyperhive owns compaction — see [Compaction](#compaction) below.
 A one-shot `--continue` suppression is available via
 `POST /api/new-session` (or `/new-session` slash command in the
 per-agent terminal) — `Bus::take_skip_continue()` flips an
@@ -183,8 +192,9 @@ per-agent terminal) — `Bus::take_skip_continue()` flips an
 
 ### Compaction
 
-claude's own in-session auto-compact is off (`--settings`); hyperhive
-owns it explicitly in `turn::drive_turn`. There are two triggers:
+claude's own in-session auto-compact is off (via the managed settings
+at `/etc/claude-code/managed-settings.json`); hyperhive owns it
+explicitly in `turn::drive_turn`. There are two triggers:
 
 - **Reactive** — claude-code prints `Prompt is too long` (the
   `PROMPT_TOO_LONG_MARKER`). The session is *already* past the context
@@ -255,14 +265,12 @@ next turn picks it up like any other inbox message.
 
 ### On-boot files
 
-`hive_ag3nt::turn::write_*` writes three files next to the per-agent
+`hive_ag3nt::turn::write_*` writes two files next to the per-agent
 socket at `/run/hive/` once at startup:
 
 - `claude-mcp-config.json` — re-invokes the running binary as `mcp`
   child (so the same binary serves as harness + as claude's MCP
   child process).
-- `claude-settings.json` — the `--settings` blob (auto-compact and
-  auto-memory off, effortLevel medium).
 - `claude-system-prompt.md` — rendered from
   `hive-ag3nt/prompts/system.md` by `hive_ag3nt::prompt::render`:
   HTML-comment markers (`<!-- role:agent -->...<!-- /role:agent -->`,
@@ -620,8 +628,9 @@ status hint moved to the wake prompt + UI header.
 - Allowed built-ins: `Edit`, `Glob`, `Grep`, `Read`, `Write`.
 - Tool-group-gated built-ins: `WebFetch`, `WebSearch` (added when the
   `web_tools` tool group is enabled — see P3RM1SS10NS tab).
-- Denied by omission or `claude-settings.json` deny list: `Bash`,
-  `Task`, `NotebookEdit`, `TodoWrite`.
+- Denied by omission or the managed-settings deny list
+  (`/etc/claude-code/managed-settings.json`): `Bash`, `Task`,
+  `NotebookEdit`, `TodoWrite`.
 - Allowed MCP tools: as listed above (by tool group).
 
 `Bash` is disallowed — shell execution goes through