agent permissions: one set, tool groups included, set at agent creation

mara on #5170: "dont split caps and perms. its all perms. / dont include
the now empty tool groups / nothing set -> default / also add perms to
agent creation screen".

- hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution,
  web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`;
  `lifecycle`/`forge` are gone. `Permission::default_for` is the default
  for an agent the swarm sets nothing for.
- The record is `{ "permissions": [...] }`. Missing key, unset field or
  no successful read yet = default; `[]` = none; a failed read after a
  good one keeps the last value.
- hive-agent reads its own key every 10s and builds each turn's --tools,
  --allowedTools and MCP config (rewritten before every turn) from it;
  the subagent daemon reads it on each start/continue. Agents get a
  read-only grant on their own key.
- hive-c0re restarts an agent only when its manage_root_agent changes.
  The import now merges meta/capabilities.json and meta/tool-groups.json
  into one list per agent and deletes both; the "import pending, don't
  read" decision is `ImportOutcome::read_allowed`, table-tested.
- swarm-controller: `GET /api/permissions` (names + default) and an
  optional `permissions` on `POST /api/agents`, stored before the job is
  queued. swarm-ui's create-agent form gets a permissions field.
- Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon,
  tool_groups.rs, ruth's tool-group seed, the permissions rebuild job
  (PermPayload/WritePermFile/perm_change), the dashboard permissions tab
  and its stale-entries panel.

Part of #5170.

docs/agent-lifecycle/agent-roster.md

@@ -2,8 +2,8 @@
 
 <!-- vale write-good.Passive = NO -->
 
-Agents are a **flat set**: the capability store scopes which agents can
-manage which others.
+Agents are a **flat set**: the `manage_root_agent` permission scopes
+which agents can manage which others.
 
 <!-- vale write-good.Passive = YES -->
 
@@ -79,7 +79,7 @@ module docs for the exact call chain.
 ## Hard-coded manager behaviour
 
 The **manager (`ruth`)** differs from other agents in naming/bootstrap,
-its socket flavour and its default capability grant; its prompt, tool
+its socket flavour and its default permissions; its prompt, tool
 allow-list and state dirs work as for every other agent. A hive with
 `services.hyperhive.ruthless = true` runs no manager: `hive-c0re` skips
 its root-agent create/start sweep
@@ -107,7 +107,7 @@ apply.
   manage any agent's state dir — config isn't authored there, since a
   real config change is a PR from a clone), plus RO mounts for
   `/applied` (diff against what's deployed) and `/meta` (system-wide
-  deploy log). That grant is the `ManageRootAgent` capability: ruth
+  deploy log). That grant is the `manage_root_agent` permission: ruth
   holds it by default, and any agent holding it gets the same mounts.
   The operator dashboard's `POST /api/meta-update` is the only path
   that writes `flake.lock`.
@@ -118,11 +118,10 @@ apply.
   `hive-agent/src/prompt.rs`'s own module doc). The `role:manager`
   blocks are dead in production, exercised only by a unit test
   (`filter_role_blocks(SAMPLE, "manager")`).
-- **Tool allow-list** — the MCP tools claude sees come from
-  `HIVE_TOOL_GROUPS` alone, the same mechanism for every agent
-  ([`docs/turn-loop/mcp.md`](../turn-loop/mcp.md)). Ruth's wider default
-  surface is a wider default grant (`ToolGroup::MANAGER_DEFAULT`, seeded
-  by `auto_update.rs` whenever its groups aren't already set).
+- **Tool allow-list** — the MCP tools claude sees come from the agent's
+  permissions alone, the same mechanism for every agent
+  ([`docs/turn-loop/mcp.md`](../turn-loop/mcp.md)). Ruth's default
+  permissions add only `manage_root_agent` (`Permission::default_for`).
 - **State dirs** — _not_ special-cased: `HYPERHIVE_STATE_DIR` is
 injected uniformly via `systemd.globalEnvironment` for every
 container including the manager, so all token/state paths resolve

docs/agent-lifecycle/config-changes.md

@@ -244,7 +244,7 @@ bind-mounted **read-only** (`hive-c0re/src/lifecycle/host_config.rs`
 calls `bind_child_agent_dirs` for each entry in
 `topology::all_agents()`). it's a copy to *read* another agent's
 current config — not an editing surface. An agent without the
-capability sees no other agent's config at all.
+permission sees no other agent's config at all.
 
 An agent submits a change to another agent's config the same way it
 makes any other change: **clone the target agent's config repo from the
@@ -252,29 +252,29 @@ forge into its own state dir, commit on a branch, open a PR**, and let
 the operator review and merge it. By design, no second, mount-shaped
 path reaches the same file without the review.
 
-Agents holding the `manage_root_agent` capability (granted per agent in
+Agents holding the `manage_root_agent` permission (granted per agent in
 the swarm's `agent-permissions` record; see
-`docs/process/conventions.md#capabilities`) get additional host-side bind
+`docs/process/conventions.md#permissions`) get additional host-side bind
 mounts via `set_nspawn_flags`:
 
 - `/var/lib/hyperhive/agents/` → `/agents/` (RW) — **every** agent's
-  proposed repo, not just direct children. The capability means "may
+  proposed repo, not just direct children. The permission means "may
   manage any agent", so the mounted set is every agent.
 - `/var/lib/hyperhive/applied/` → `/applied/` (RO) — every agent's
   authoritative applied repo, including `.git`.
 - `/var/lib/hyperhive/meta/` → `/meta/` (RO) — the swarm-wide
   deploy flake.
 
-An agent without the capability only has its direct children's config
+An agent without the permission only has its direct children's config
 dirs.
 
 ⚠️ nspawn bakes bind flags at container start, so hive-c0re restarts
-an agent, after its current turn, when its capabilities change.
+an agent, after its current turn, when its `manage_root_agent` changes.
 
-The root agent holds the capability by default: an agent whose record
-leaves `capabilities` unset gets the hive's default, which is
-`manage_root_agent` for `ruth` and nothing for every other agent.
-Setting `"capabilities": []` for her revokes it.
+The root agent holds the permission by default: an agent whose record
+leaves `permissions` unset gets the default, which includes
+`manage_root_agent` for `ruth` and for no other agent. Setting her
+permissions without it revokes it.
 
 Each proposed repo (`/agents/<n>/config/`) is pre-configured
 with `applied` as a git remote pointing at
@@ -349,8 +349,8 @@ updates the root agent itself.
 
 The system prompt (`hive-agent/prompts/system.md`, rendered by
 `hive-agent/src/prompt.rs`) is the **same for every agent**; what
-varies is which MCP tools it surfaces (gated by tool groups and
-capabilities in `agent.nix`). No `role:manager` block renders only
+varies is which MCP tools it surfaces (gated by the agent's permissions,
+which the swarm sets). No `role:manager` block renders only
 for the root agent. The root agent's role-specific
 behaviour comes from its CLAUDE.md / agent-specific instructions, not
 the system prompt template.

docs/agent-lifecycle/persistence.md

@@ -329,14 +329,14 @@ Under `/var/lib/hyperhive/agents/<name>/`:
 
 ### Cross-agent access to state
 
-An agent holding the `ManageRootAgent` capability gets every other
+An agent holding the `manage_root_agent` permission gets every other
 agent's `state` dir bind-mounted **read-write** and its `config` dir
 **read-only** (`bind_child_agent_dirs` in `lifecycle/host_config.rs`).
 The RW on `state` is deliberate, not an oversight: the holder recovers
 other agents, which includes writing into their state (for example
 seeding notes, clearing a stuck sentinel) as well as reading it.
 
-This is the **only** cross-agent mount. An agent holding no capability
+This is the **only** cross-agent mount. An agent without that permission
 sees its own dirs and nothing else.
 
 **`harness` isn't mounted at all.** It holds that agent's own runtime
@@ -364,7 +364,7 @@ mount should be writable when it shouldn't.
 <!-- vale write-good.Passive = YES -->
 
 Isolation still holds by default: a container has its *own* dirs and,
-unless it holds the capability, nothing else.
+unless it holds the permission, nothing else.
 
 Under `/var/lib/hyperhive/applied/<name>/` — the hive-c0re-only
 applied repo. Tracks `flake.nix` (module-only boilerplate; never
@@ -384,13 +384,9 @@ Contents:
   audit trail (one commit per successful deploy or hyperhive bump).
 - `topology.json` — the agent roster (`["alice", "bob", "ruth"]`).
   Written by `topology::reconcile` on every meta sync; read by
-  `topology::all_agents`, which is the set the `ManageRootAgent`
-  capability grants mounts over. The reader also accepts a map-shaped
+  `topology::all_agents`, which is the set the `manage_root_agent`
+  permission grants mounts over. The reader also accepts a map-shaped
   file carrying a `parent` per agent, and keeps its keys.
-- `tool-groups.json` — per-agent MCP tool group grants
-  (`{ "alice": ["messaging", "inbox", "execution"] }`). Written by
-  `tool_groups::set_groups`; injected as `HIVE_TOOL_GROUPS` env
-  var into each agent's container.
 - `swarm-resource-limits.json` — the caps the swarm sets for this
   hive's agents
   (`{ "sock": { "cpu_quota": "400%", "memory_max": "8G" } }`).
@@ -415,11 +411,11 @@ Contents:
 The root agent has the meta dir RO-mounted at `/meta/`.
 
 Outside the meta repo, `/var/lib/hyperhive/swarm-agent-permissions.json`
-holds the capabilities the swarm grants this hive's agents, as
+holds the permissions the swarm grants this hive's agents, as
 `workers::swarm_permissions` last read them from the swarm's
 `agent-permissions` bucket (every 30 seconds): a copy, not the
 record, which `swarmctl agent permissions` sets. `set_nspawn_flags`
-reads it at every container start.
+reads it at every container start for `manage_root_agent`.
 
 hive-c0re renders containers onto `meta#<n>` at creation.