diff --git a/CLAUDE.md b/CLAUDE.md
index 2da3cccf..4405782d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -217,7 +217,7 @@ frontend/             npm workspaces (esbuild → static dist). Built
                          + agent.css → dist/{*.html, static/*}.
 
 hive-ag3nt/        in-container harness crate; produces ONE `hive`
-                   binary for all agents
+                   binary picking role from `HIVE_ROLE` env
   src/lib.rs            re-exports + DEFAULT_SOCKET, DEFAULT_WEB_PORT
   src/client.rs         generic JSON-line request/response over unix socket
   src/web_ui.rs         per-container axum HTTP page (incl /api/cancel,
@@ -255,13 +255,12 @@ hive-ag3nt/        in-container harness crate; produces ONE `hive`
   src/login_session.rs  drives `claude auth login` over stdio pipes
   src/prompt.rs         system prompt renderer: filters the unified
                          template through `<!-- role:agent -->` /
-                         `<!-- role:manager -->` markers (always
-                         renders the agent section); owns
-                         `write_system_prompt` (re-exported from
-                         turn.rs for callers).
+                         `<!-- role:manager -->` markers per
+                         `mcp::Flavor`; owns `write_system_prompt`
+                         (re-exported from turn.rs for callers).
   src/bin/hive.rs       unified harness main (Serve + Mcp + Wake
-                         subcommands); privilege boundary enforced
-                         server-side at the broker socket. Static UI assets
+                         subcommands); role from `HIVE_ROLE` env, picks
+                         agent or manager wire surface server-side. Static UI assets
                          served by ServeDir from $HIVE_STATIC_DIR
                          (= hyperhive.frontend.mergedDist — default agent
                          dist + per-agent extraFiles, set per the
@@ -329,12 +328,11 @@ nix/
                                  `services.hyperhive.domain`; gateway serves
                                  `.well-known/matrix/{client,server}` for
                                  auto-discovery; federation on, e2ee deferred
-  templates/harness-base.nix    shared harness for all containers; single
-                                 `hive-ag3nt` service unit; `hyperhive.model`
-                                 option (HIVE_DEFAULT_MODEL)
-  templates/agent-base.nix      entry-point for sub-agent containers
-  templates/manager.nix         entry-point for ruth; adds forge noise-reduction
-                                 defaults (keepSubscriptions=false etc.)
+  templates/harness-base.nix    shared harness for all containers; `hyperhive.role`
+                                 (`"agent"` | `"manager"`) drives service unit + forge
+                                 defaults; `hyperhive.model` option (HIVE_DEFAULT_MODEL)
+  templates/agent-base.nix      thin role-setter (`hyperhive.role = "agent"`)
+  templates/manager.nix         thin role-setter (`hyperhive.role = "manager"`)
   templates/weston-vnc.nix      optional `hyperhive.gui.enable`
                                  — weston + VNC backend systemd unit; writes
                                  /etc/hyperhive/gui.json (vnc_port + auth) for
diff --git a/docs/agent-hierarchy.md b/docs/agent-hierarchy.md
index 2e3ce4b7..087326f6 100644
--- a/docs/agent-hierarchy.md
+++ b/docs/agent-hierarchy.md
@@ -202,19 +202,46 @@ nspawn agent. Open questions, not yet wired:
 - Filesystem: share parent's `/state` RW, or a sub-dir?
 - Identity: distinct broker recipient name, or address the parent?
 
-## Harness systemd unit shape
+## Harness systemd unit shape (per-role)
 
-One harness binary (`hive`), one `harness-base.nix` template, one
-service unit (`systemd.services.hive-ag3nt`) for all agents. There
-is no longer a separate manager service name or role distinction in
-the harness — privilege differences live server-side in the broker
-socket (which tool groups and manager-surface calls each agent
-receives).
+One harness binary (`hive`), one `harness-base.nix` template, two
+systemd units depending on `hyperhive.role`:
 
-`agent-base.nix` and `manager.nix` both import `harness-base.nix`.
-`manager.nix` additionally sets forge defaults to suppress the
-subscription/participation firehose so ruth's inbox stays focused
-on direct mentions, reviews, and assignments.
+- `agent-base.nix` (`role = "agent"`) → `systemd.services.hive-ag3nt`
+- `manager.nix` (`role = "manager"`) → `systemd.services.hive-m1nd`
+
+The unit names diverge but the binary is the same. `HIVE_ROLE` env
+var picks the surface at startup (agent vs manager); naming the
+units after the historical per-role binaries keeps dashboard log
+queries, ExecStartPre paths, and ancestor PR diffs working without a
+rename cascade.
+
+### Manager-only defaults
+
+`harness-base.nix` flips these when `hyperhive.role == "manager"`,
+via `lib.mkDefault` so any agent can invert if needed:
+
+- `hyperhive.forge.keepSubscriptions = false`
+- `hyperhive.forge.skipNotifyReasons = [ "subscribed" "participating" ]`
+
+Skips the subscription / participation firehose so the manager's
+inbox only carries direct mentions, reviews, and assignments. Sub-
+agents keep the noisier defaults so they see anything aimed at the
+repos they're working on.
+
+### Standalone-eval fallbacks
+
+`nixosConfigurations.manager` must build standalone (without the
+meta-flake's per-agent flake.nix wrapper). For the manager unit
+that means a hardcoded `HIVE_LABEL` env value:
+
+- `HIVE_LABEL = "ruth"` — logical agent name; matches what `meta.rs`
+  injects at deploy time.
+
+Real deploys never read these — `meta::render_flake` overrides them
+via the generated wrapper. They exist so the manager
+`nixosConfigurations` evaluates cleanly even outside the meta-flake
+boundary.
 
 ### Environment variables set on the unit
 
@@ -229,6 +256,8 @@ on direct mentions, reviews, and assignments.
   directly on the unit, **not** via `environment.variables`, because
   the latter only populates `/etc/profile` which systemd services
   don't inherit.
+- `HIVE_ROLE = config.hyperhive.role` — picks the binary surface
+  (agent / manager) at startup.
 
 ### `PATH` setup (the wrapper-dir trick)
 
@@ -249,7 +278,8 @@ bit set` regardless of `hyperhive.user.passwordlessSudo`.
 
 ### `serviceConfig` highlights
 
-- `ExecStart = pkgs.hyperhive/bin/hive serve` — single binary.
+- `ExecStart = pkgs.hyperhive/bin/hive serve` — single binary,
+  surface picked from `HIVE_ROLE`.
 - `Restart = on-failure`, `RestartSec = 2` — keeps the harness
   resilient across transient crashes without thundering retries.
 - `RuntimeDirectory = "hive-config"` → `/run/hive-config/` owned by
diff --git a/docs/turn-loop.md b/docs/turn-loop.md
index 9e5955ad..88ac9b82 100644
--- a/docs/turn-loop.md
+++ b/docs/turn-loop.md
@@ -5,7 +5,8 @@ claude has access to in return.
 
 ## The loop
 
-Each agent harness (`hive serve` — one binary for all agents) runs:
+Each agent harness (`hive serve`, role set via `$HIVE_ROLE` — always
+`"agent"`, one binary) runs:
 
 1. Long-poll `Recv` on its socket. The host-side broker
    (`broker.rs::recv_blocking_batch`) returns immediately if there's
@@ -56,11 +57,15 @@ Each agent harness (`hive serve` — one binary for all agents) runs:
 
 ## Harness binary shape
 
-One `hive` binary for all agents. The earlier split into
+One `hive` binary serves both roles. The split into
 `hive-ag3nt` + `hive-m1nd` was collapsed because the privilege
 boundary lives server-side at the broker socket
-(`/run/hive/mcp.sock`): `ManagerRequest` calls are refused by the
-standard agent socket regardless of who sends them.
+(`/run/hive/mcp.sock`): an agent-flavor socket refuses
+`ManagerRequest` calls regardless of who sends them, so there's no
+escalation risk in shipping the same code to both. `main()` reads
+`$HIVE_ROLE` (set by `harness-base.nix` from `hyperhive.role`;
+defaults to `"agent"` for standalone `nix run` invocations) and
+dispatches.
 
 Three subcommands:
 
diff --git a/hive-ag3nt/Cargo.toml b/hive-ag3nt/Cargo.toml
index 655b5ab3..ed5de53b 100644
--- a/hive-ag3nt/Cargo.toml
+++ b/hive-ag3nt/Cargo.toml
@@ -28,8 +28,10 @@ tracing-subscriber.workspace = true
 tempfile = "3"
 
 [[bin]]
-# Unified harness binary for all agents. Privilege boundary is
-# enforced server-side at the socket (tool groups / manager surface).
-# See `docs/turn-loop.md::Harness binary shape`.
+# Unified harness binary: both `agent` and `manager` code paths live
+# here; the binary picks its role at startup from `HIVE_ROLE` (set by
+# `harness-base.nix` from `hyperhive.role`). The privilege boundary is
+# enforced server-side at the socket, so shipping both surfaces in one
+# binary is safe. See `docs/turn-loop.md::Harness binary shape`.
 name = "hive"
 path = "src/bin/hive.rs"
diff --git a/hive-ag3nt/src/bin/hive.rs b/hive-ag3nt/src/bin/hive.rs
index a565b6ce..b90494ca 100644
--- a/hive-ag3nt/src/bin/hive.rs
+++ b/hive-ag3nt/src/bin/hive.rs
@@ -198,6 +198,7 @@ trait Surface {
 struct AgentSurface;
 
 impl Surface for AgentSurface {
+
     async fn ack_turn(socket: &Path) {
         match client::request::<_, AgentResponse>(socket, &AgentRequest::AckTurn).await {
             Ok(AgentResponse::Ok) => {}
diff --git a/hive-ag3nt/src/prompt.rs b/hive-ag3nt/src/prompt.rs
index a86d9054..8173fc7e 100644
--- a/hive-ag3nt/src/prompt.rs
+++ b/hive-ag3nt/src/prompt.rs
@@ -269,7 +269,13 @@ shared closer
         // Real template's first agent line — keeps the renderer
         // honest about the {label} / {operator_pronouns} pair the
         // harness already relied on.
-        let rendered = render(&PRODUCTION_TEMPLATE, "alice", "they/them", None, None);
+        let rendered = render(
+            &PRODUCTION_TEMPLATE,
+            "alice",
+            "they/them",
+            None,
+            None,
+        );
         assert!(rendered.contains("hyperhive agent `alice`"));
         assert!(rendered.contains("**they/them** pronouns"));
         assert!(!rendered.contains("{label}"));
@@ -279,7 +285,13 @@ shared closer
     #[test]
     fn render_no_role_markers_in_output() {
         // No raw role markers should survive into the rendered prompt.
-        let rendered = render(&PRODUCTION_TEMPLATE, "alice", "she/her", None, None);
+        let rendered = render(
+            &PRODUCTION_TEMPLATE,
+            "alice",
+            "she/her",
+            None,
+            None,
+        );
         assert!(!rendered.contains("<!-- role:"));
         assert!(!rendered.contains("<!-- /role:"));
         // Shared tools appear.
@@ -289,7 +301,13 @@ shared closer
 
     #[test]
     fn render_uses_agent_opener() {
-        let rendered = render(&PRODUCTION_TEMPLATE, "alice", "she/her", None, None);
+        let rendered = render(
+            &PRODUCTION_TEMPLATE,
+            "alice",
+            "she/her",
+            None,
+            None,
+        );
         assert!(rendered.starts_with("You are hyperhive agent"));
     }
 
@@ -308,7 +326,13 @@ You are hyperhive agent `{label}` (qualified: `{qualified_label}`){hive_identity
 
     #[test]
     fn render_substitutes_hive_identity_when_set() {
-        let rendered = render(IDENTITY_FIXTURE, "alice", "she/her", Some("pr1ma"), None);
+        let rendered = render(
+            IDENTITY_FIXTURE,
+            "alice",
+            "she/her",
+            Some("pr1ma"),
+            None,
+        );
         assert!(rendered.contains("on hive `pr1ma`"), "{rendered}");
         // swarm clause stays absent when only hive is set.
         assert!(!rendered.contains("in swarm"));
diff --git a/hive-ag3nt/src/web_ui.rs b/hive-ag3nt/src/web_ui.rs
index fdaecc20..61364701 100644
--- a/hive-ag3nt/src/web_ui.rs
+++ b/hive-ag3nt/src/web_ui.rs
@@ -62,6 +62,7 @@ struct AppState {
     gui_vnc_port: Option<u16>,
 }
 
+
 /// Bind the per-container web listener and serve the SPA.
 ///
 /// `HIVE_WEB_SOCKET` opt-in selects unix-socket vs TCP binding; the
@@ -736,11 +737,7 @@ async fn events_history(
     // window is "drop buffered events you've already seen in history",
     // never "lose an event that fired between the read and the seq."
     // On paginated loads (`before` is set) seq is not needed.
-    let seq = if is_initial {
-        Some(state.bus.current_seq())
-    } else {
-        None
-    };
+    let seq = if is_initial { Some(state.bus.current_seq()) } else { None };
 
     let (events, min_id, has_more) = state.bus.history_page(before, limit);
     let mut resp = serde_json::json!({
diff --git a/hive-bash-mcp/src/runner.rs b/hive-bash-mcp/src/runner.rs
index 44358640..97bd00cb 100644
--- a/hive-bash-mcp/src/runner.rs
+++ b/hive-bash-mcp/src/runner.rs
@@ -306,18 +306,17 @@ async fn run_task(mut task: TaskFile, socket: &Path) {
     let out_path = paths::task_out(&id);
     let err_path = paths::task_err(&id);
 
-    let (timed_out, exit_code) =
-        match exec_cmd(&task.cmd, &out_path, &err_path, task.timeout_secs).await {
-            Ok((code, false)) => (false, Some(code)),
-            Ok((_, true)) => {
-                tracing::warn!(id = %id, "bash_runner: task timed out");
-                (true, None)
-            }
-            Err(e) => {
-                tracing::warn!(id = %id, error = ?e, "bash_runner: exec error");
-                (false, None)
-            }
-        };
+    let (timed_out, exit_code) = match exec_cmd(&task.cmd, &out_path, &err_path, task.timeout_secs).await {
+        Ok((code, false)) => (false, Some(code)),
+        Ok((_, true)) => {
+            tracing::warn!(id = %id, "bash_runner: task timed out");
+            (true, None)
+        }
+        Err(e) => {
+            tracing::warn!(id = %id, error = ?e, "bash_runner: exec error");
+            (false, None)
+        }
+    };
 
     let stdout_tail = tail_file(&out_path, SUMMARY_BYTES);
     let stderr_tail = tail_file(&err_path, SUMMARY_BYTES);
diff --git a/hive-c0re/src/actions.rs b/hive-c0re/src/actions.rs
index 2f70c4c8..4ed288f5 100644
--- a/hive-c0re/src/actions.rs
+++ b/hive-c0re/src/actions.rs
@@ -547,9 +547,12 @@ async fn run_apply_commit(
     // "nixos-container update" label for the whole multi-minute window.
     let hive = coord.hive_env();
     let paths = Coordinator::agent_paths(&approval.agent, agent_dir.to_path_buf());
-    let build_result = lifecycle::rebuild_no_meta(&approval.agent, &hive, &paths, &|step| {
-        coord.set_queue_step(queue_entry_id, step)
-    })
+    let build_result = lifecycle::rebuild_no_meta(
+        &approval.agent,
+        &hive,
+        &paths,
+        &|step| coord.set_queue_step(queue_entry_id, step),
+    )
     .await;
 
     match build_result {
diff --git a/hive-c0re/src/agent_server.rs b/hive-c0re/src/agent_server.rs
index b7f50963..7d44ea27 100644
--- a/hive-c0re/src/agent_server.rs
+++ b/hive-c0re/src/agent_server.rs
@@ -463,7 +463,7 @@ async fn dispatch(req: &AgentRequest, agent: &str, coord: &Arc<Coordinator>) ->
                     Err(e) => {
                         return AgentResponse::Err {
                             message: format!("list containers failed: {e:#}"),
-                        };
+                        }
                     }
                 };
             // Walk the full topology and collect every descendant.
@@ -497,8 +497,7 @@ async fn dispatch(req: &AgentRequest, agent: &str, coord: &Arc<Coordinator>) ->
                 };
             }
             tracing::info!(%agent, %name, "agent: request_init_config for child");
-            match crate::manager_server::submit_init_config(coord, name, description.clone()).await
-            {
+            match crate::manager_server::submit_init_config(coord, name, description.clone()).await {
                 Ok(_id) => AgentResponse::Ok,
                 Err(e) => AgentResponse::Err {
                     message: format!("{e:#}"),
diff --git a/hive-c0re/src/auto_update.rs b/hive-c0re/src/auto_update.rs
index 44886d86..f4589284 100644
--- a/hive-c0re/src/auto_update.rs
+++ b/hive-c0re/src/auto_update.rs
@@ -84,9 +84,12 @@ pub async fn rebuild_agent(
     // lifecycle_action; this catches the auto-update scan + any
     // other direct caller.
     let guard = coord.transient_guard(name, crate::coordinator::TransientKind::Rebuilding);
-    let result = lifecycle::rebuild(name, &hive, &paths, &|step| {
-        coord.set_queue_step(queue_entry_id, step)
-    })
+    let result = lifecycle::rebuild(
+        name,
+        &hive,
+        &paths,
+        &|step| coord.set_queue_step(queue_entry_id, step),
+    )
     .await;
     drop(guard);
     match &result {
diff --git a/hive-c0re/src/bin/hivectl.rs b/hive-c0re/src/bin/hivectl.rs
index a3b8f3e5..9f190cfd 100644
--- a/hive-c0re/src/bin/hivectl.rs
+++ b/hive-c0re/src/bin/hivectl.rs
@@ -478,7 +478,8 @@ async fn matrix_reset_password(name: &str) -> Result<()> {
         );
     }
     let admin_token = hive_c0re::matrix::read_admin_token()?;
-    let new_password = hive_c0re::matrix::random_password().context("generate random password")?;
+    let new_password =
+        hive_c0re::matrix::random_password().context("generate random password")?;
     let client = reqwest::Client::builder()
         .timeout(std::time::Duration::from_secs(30))
         .build()
@@ -495,7 +496,8 @@ async fn matrix_reset_password(name: &str) -> Result<()> {
     )
     .await
     .with_context(|| format!("matrix reset-password {name}"))?;
-    let pw_path = PathBuf::from("/var/lib/hyperhive/matrix-creds").join(format!("{name}-password"));
+    let pw_path = PathBuf::from("/var/lib/hyperhive/matrix-creds")
+        .join(format!("{name}-password"));
     println!("matrix: password for @{name}:{server_name} reset");
     println!("password persisted at: {}", pw_path.display());
     println!("next: hivectl matrix create-user {name}   # mints a fresh access token");
diff --git a/hive-c0re/src/dashboard.rs b/hive-c0re/src/dashboard.rs
index 97373c7a..1b67bc95 100644
--- a/hive-c0re/src/dashboard.rs
+++ b/hive-c0re/src/dashboard.rs
@@ -3037,17 +3037,18 @@ struct PushWebhookRepo {
 async fn post_webhook_knowledge(
     axum::extract::Json(payload): axum::extract::Json<PushWebhookPayload>,
 ) -> Response {
-    let expected_repo = format!("{}/{}", crate::knowledge::ORG, crate::knowledge::REPO);
+    let expected_repo = format!(
+        "{}/{}",
+        crate::knowledge::ORG,
+        crate::knowledge::REPO
+    );
     let full_name = payload
         .repository
         .as_ref()
         .and_then(|r| r.full_name.as_deref())
         .unwrap_or("");
     if full_name != expected_repo {
-        tracing::debug!(
-            full_name,
-            "webhook/knowledge: ignoring push from unexpected repo"
-        );
+        tracing::debug!(full_name, "webhook/knowledge: ignoring push from unexpected repo");
         return (StatusCode::OK, "ignored").into_response();
     }
     let git_ref = payload.git_ref.as_deref().unwrap_or("");
diff --git a/hive-c0re/src/manager_server.rs b/hive-c0re/src/manager_server.rs
index ff26c197..e5a0a54f 100644
--- a/hive-c0re/src/manager_server.rs
+++ b/hive-c0re/src/manager_server.rs
@@ -355,12 +355,7 @@ pub(crate) async fn submit_init_config(
     }
     let id = coord
         .approvals
-        .submit_kind(
-            name,
-            hive_sh4re::ApprovalKind::InitConfig,
-            "",
-            description.as_deref(),
-        )
+        .submit_kind(name, hive_sh4re::ApprovalKind::InitConfig, "", description.as_deref())
         .map_err(|e| anyhow::anyhow!("queue approval row: {e:#}"))?;
     tracing::info!(%id, %name, "init_config approval queued");
     coord.emit_approval_added(id, name, "init_config", None, None, description);
diff --git a/hive-c0re/src/migrate.rs b/hive-c0re/src/migrate.rs
index d149143d..e718f9eb 100644
--- a/hive-c0re/src/migrate.rs
+++ b/hive-c0re/src/migrate.rs
@@ -340,7 +340,9 @@ fn backfill_manager_tool_groups(names: &[String]) {
     }
     let existing = tool_groups::groups_for(MANAGER_NAME);
     if !existing.is_empty() {
-        tracing::debug!("migration: ruth already has explicit tool groups — skipping backfill");
+        tracing::debug!(
+            "migration: ruth already has explicit tool groups — skipping backfill"
+        );
         return;
     }
     let all_groups: Vec<String> = hive_sh4re::ToolGroup::MANAGER_DEFAULT
diff --git a/hive-c0re/src/scheduled_prompts_worker.rs b/hive-c0re/src/scheduled_prompts_worker.rs
index ad9b35f8..ec0d431b 100644
--- a/hive-c0re/src/scheduled_prompts_worker.rs
+++ b/hive-c0re/src/scheduled_prompts_worker.rs
@@ -202,6 +202,7 @@ fn known_agents(_coord: &Coordinator) -> std::collections::HashSet<String> {
                 if let Some(name) = raw.strip_prefix(crate::lifecycle::AGENT_PREFIX) {
                     out.insert(name.to_owned());
                 }
+
             }
         }
         Err(e) => {
@@ -377,6 +378,7 @@ async fn known_agents_async() -> std::collections::HashSet<String> {
                 if let Some(name) = raw.strip_prefix(crate::lifecycle::AGENT_PREFIX) {
                     out.insert(name.to_owned());
                 }
+
             }
         }
         Err(e) => {
diff --git a/hive-c0re/src/server.rs b/hive-c0re/src/server.rs
index 12cacc92..d305baea 100644
--- a/hive-c0re/src/server.rs
+++ b/hive-c0re/src/server.rs
@@ -82,7 +82,8 @@ async fn dispatch(req: &HostRequest, coord: Arc<Coordinator>) -> HostResponse {
                 let agent_dir = coord.ensure_runtime(name)?;
                 let hive = coord.hive_env();
                 let paths = Coordinator::agent_paths(name, agent_dir);
-                match lifecycle::spawn(name, &hive, &paths).await {
+                match lifecycle::spawn(name, &hive, &paths).await
+                {
                     Ok(()) => {
                         coord.notify_manager(&hive_sh4re::HelperEvent::Spawned {
                             agent: name.clone(),
diff --git a/hive-forge/src/verbs/pr_reviews.rs b/hive-forge/src/verbs/pr_reviews.rs
index 6ee76b02..4533f468 100644
--- a/hive-forge/src/verbs/pr_reviews.rs
+++ b/hive-forge/src/verbs/pr_reviews.rs
@@ -54,13 +54,21 @@ pub fn run(client: &Client, args: Args) -> Result<()> {
 
 /// Submit a review event (APPROVED / REQUEST_CHANGES / COMMENT) and print
 /// a compact summary of the created review.
-fn submit_review(client: &Client, number: u64, event: &str, body: Option<String>) -> Result<()> {
+fn submit_review(
+    client: &Client,
+    number: u64,
+    event: &str,
+    body: Option<String>,
+) -> Result<()> {
     let repo = client.repo();
     let payload = json!({
         "event": event,
         "body": body.unwrap_or_default(),
     });
-    let v = client.post_json(&format!("/repos/{repo}/pulls/{number}/reviews"), &payload)?;
+    let v = client.post_json(
+        &format!("/repos/{repo}/pulls/{number}/reviews"),
+        &payload,
+    )?;
     print_json(&json!({
         "id": v.get("id"),
         "state": v.get("state"),
@@ -73,9 +81,7 @@ fn submit_review(client: &Client, number: u64, event: &str, body: Option<String>
 /// gracefully.
 fn fetch_inline_comments(client: &Client, repo: &str, pr: u64, review_id: u64) -> Vec<Value> {
     client
-        .get_json(&format!(
-            "/repos/{repo}/pulls/{pr}/reviews/{review_id}/comments"
-        ))
+        .get_json(&format!("/repos/{repo}/pulls/{pr}/reviews/{review_id}/comments"))
         .ok()
         .and_then(|v| v.as_array().cloned())
         .unwrap_or_default()
@@ -94,7 +100,12 @@ fn list_reviews(client: &Client, number: u64) -> Result<()> {
 }
 
 /// JSON output: one object per review, with an inline `comments` array.
-fn list_reviews_json(client: &Client, repo: &str, number: u64, reviews: &[Value]) -> Result<()> {
+fn list_reviews_json(
+    client: &Client,
+    repo: &str,
+    number: u64,
+    reviews: &[Value],
+) -> Result<()> {
     let trimmed: Vec<Value> = reviews
         .iter()
         .map(|r| {
@@ -129,7 +140,12 @@ fn list_reviews_json(client: &Client, repo: &str, number: u64, reviews: &[Value]
 
 /// Human-readable output: Markdown-style heading per review, inline
 /// comments as `[path:line] body` (line omitted for PR-level comments).
-fn list_reviews_text(client: &Client, repo: &str, number: u64, reviews: &[Value]) -> Result<()> {
+fn list_reviews_text(
+    client: &Client,
+    repo: &str,
+    number: u64,
+    reviews: &[Value],
+) -> Result<()> {
     if reviews.is_empty() {
         println!("(no reviews)");
         return Ok(());
diff --git a/hive-sh4re/src/lib.rs b/hive-sh4re/src/lib.rs
index 58ef97df..2e676c02 100644
--- a/hive-sh4re/src/lib.rs
+++ b/hive-sh4re/src/lib.rs
@@ -936,9 +936,7 @@ impl ToolGroup {
             Self::Inbox => {
                 "get_loose_ends, cancel_loose_end, remind, request_next_turn — self-scheduling"
             }
-            Self::Lifecycle => {
-                "kill, start, restart, update, list_containers — container lifecycle (privileged)"
-            }
+            Self::Lifecycle => "kill, start, restart, update, list_containers — container lifecycle (privileged)",
             Self::Approvals => {
                 "request_init_config, request_apply_commit, request_update_meta_inputs — config change flow (privileged)"
             }
@@ -948,9 +946,7 @@ impl ToolGroup {
             Self::Diagnostics => {
                 "get_logs — read a sub-agent container's systemd journal (privileged)"
             }
-            Self::Execution => {
-                "run, status — run shell commands via mcp__bash__run / mcp__bash__status"
-            }
+            Self::Execution => "run, status — run shell commands via mcp__bash__run / mcp__bash__status",
             Self::WebTools => "WebFetch, WebSearch — Claude built-in web egress; not MCP tools",
         }
     }
diff --git a/nix/modules/hive-network.nix b/nix/modules/hive-network.nix
index 9d86f770..1cce485a 100644
--- a/nix/modules/hive-network.nix
+++ b/nix/modules/hive-network.nix
@@ -197,7 +197,8 @@ in
           '';
         }
         {
-          assertion = !config.services.hyperhive.forge.enable || config.services.hyperhive.gateway.enable;
+          assertion =
+            !config.services.hyperhive.forge.enable || config.services.hyperhive.gateway.enable;
           message = ''
             services.hyperhive.network.isolateContainers = true with
             services.hyperhive.forge.enable = true requires
diff --git a/nix/templates/agent-base.nix b/nix/templates/agent-base.nix
index e905e813..82ea3c84 100644
--- a/nix/templates/agent-base.nix
+++ b/nix/templates/agent-base.nix
@@ -1,7 +1,11 @@
 { ... }:
 {
   imports = [ ./harness-base.nix ];
-  # Entry-point for sub-agent containers. Referenced from `flake.nix`
+
+  # Sub-agent role: the role-driven `systemd.services.hive-ag3nt` plus
+  # the default forge notification surface live in `harness-base.nix`.
+  # This file is the bare entry-point referenced from `flake.nix`
   # (`nixosConfigurations.agent-base`) and the meta-flake's
-  # `applied/<name>/flake.nix`.
+  # `applied/<name>/flake.nix` for sub-agent containers.
+  hyperhive.role = "agent";
 }
diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index 9771baa2..37596756 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -19,9 +19,10 @@ let
   homeDir = "/home/${userName}";
 in
 {
-  # Shared scaffolding for every hyperhive harness container.
-  # `agent-base.nix` and `manager.nix` both import this; all agents
-  # use the same service unit regardless of which entry-point they came from.
+  # Shared scaffolding for any hyperhive harness container — both
+  # sub-agents (`agent-base.nix`) and the manager (`manager.nix`) extend
+  # this. The systemd service that actually runs the harness binary
+  # differs per role and lives in the child module.
 
   # Optional feature modules. Each declares its own `hyperhive.*`
   # option(s), default-off, so every agent has them available but
@@ -85,6 +86,28 @@ in
     '';
   };
 
+  options.hyperhive.role = lib.mkOption {
+    type = lib.types.enum [
+      "agent"
+      "manager"
+    ];
+    default = "agent";
+    example = "manager";
+    description = ''
+      Whether this container runs as a sub-agent (`"agent"`, the
+      default) or as the swarm's manager (`"manager"` — both invoke
+      `hive serve`;
+      defaults the forge notification surface to mentions-only).
+
+      meta.rs flips this to `"manager"` for the manager container
+      and leaves it at the default for every sub-agent. Agents
+      and `agent.nix` files don't normally touch this option;
+      it's exposed so a standalone `nixos-rebuild` against
+      `nixosConfigurations.manager` keeps working without the
+      meta-flake wrapper around it.
+    '';
+  };
+
   options.hyperhive.model = lib.mkOption {
     type = lib.types.str;
     default = "haiku";
@@ -269,7 +292,9 @@ in
       Computed: the merged static tree consumed by the harness via
       `HIVE_STATIC_DIR`. Composed at evaluation time by copying
       `hyperhive.frontend.dist`'s `agent/` subdir as the base, then
-      layering each `extraFiles` entry on top. Read-only — do not set directly.
+      layering each `extraFiles` entry on top. Read-only —
+      consumers (`agent-base.nix`, `manager.nix`) reference this in
+      their systemd service environment; do not set directly.
     '';
   };
 
@@ -1332,6 +1357,18 @@ in
       };
     };
 
+    # Manager-only forge defaults: subscription/participation
+    # firehose stays off so the manager's inbox isn't drowned in
+    # noise. Full rationale + sub-agent contrast:
+    # docs/agent-hierarchy.md::Manager-only defaults.
+    hyperhive.forge = lib.mkIf (config.hyperhive.role == "manager") {
+      keepSubscriptions = lib.mkDefault false;
+      skipNotifyReasons = lib.mkDefault [
+        "subscribed"
+        "participating"
+      ];
+    };
+
     # Harness systemd unit. Unit shape (PATH wrapper-dir trick, env vars,
     # RuntimeDirectory, User=, standalone-eval fallbacks):
     # docs/agent-hierarchy.md::Harness systemd unit shape. PATH /bin
@@ -1339,10 +1376,11 @@ in
     # appends /bin to every entry.
     systemd.services.hive-ag3nt =
       let
+        isManager = config.hyperhive.role == "manager";
         binary = "hive";
       in
       {
-        description = "${binary} harness";
+        description = "${binary}${lib.optionalString isManager " manager"} harness";
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
         # `/run/wrappers` before `/run/current-system/sw` so setuid
@@ -1357,11 +1395,16 @@ in
           HOME = homeDir;
           HIVE_STATIC_DIR = "${config.hyperhive.frontend.mergedDist}";
           HIVE_ASSETS_DIR = "${pkgs.hyperhive-assets}/share/hyperhive";
-          # Unix-socket path for the harness web UI. All agents always bind
-          # here; TCP fallback is removed. Path matches
-          # `hive_c0re::agent_sockets::socket_path_for(name)` so lifecycle
-          # bind-mounts and gateway upstream config stay in sync.
+          HIVE_ROLE = config.hyperhive.role;
+          # Unix-socket path for the harness web UI. All agents (sub-agents
+          # and manager) always bind here; TCP fallback is removed. Path
+          # matches `hive_c0re::agent_sockets::socket_path_for(name)` so
+          # lifecycle bind-mounts and gateway upstream config stay in sync.
           HIVE_WEB_SOCKET = "/run/hive-agent/${userName}/web.sock";
+        }
+        // lib.optionalAttrs isManager {
+          # Standalone-eval fallback; meta.rs overrides at deploy time.
+          HIVE_LABEL = "ruth";
         };
         serviceConfig = {
           ExecStart = "${pkgs.hyperhive}/bin/${binary} serve";
diff --git a/nix/templates/manager.nix b/nix/templates/manager.nix
index b84b4bd1..64fc4bb9 100644
--- a/nix/templates/manager.nix
+++ b/nix/templates/manager.nix
@@ -2,15 +2,14 @@
 {
   imports = [ ./harness-base.nix ];
 
-  # Entry-point for the privileged root agent (ruth). Referenced from
+  # Manager role: the `systemd.services.hive-ag3nt` unit plus
+  # the manager-only forge defaults (`keepSubscriptions = false`,
+  # `skipNotifyReasons = [ "subscribed" "participating" ]`) live in
+  # `harness-base.nix` under `lib.mkIf (config.hyperhive.role ==
+  # "manager")`. This file is the bare entry-point referenced from
   # `flake.nix` (`nixosConfigurations.ruth`) and the meta-flake's
-  # `applied/ruth/flake.nix`. Forge subscription/participation firehose
-  # stays off so ruth's inbox isn't drowned in noise.
-  hyperhive.forge = {
-    keepSubscriptions = false;
-    skipNotifyReasons = [
-      "subscribed"
-      "participating"
-    ];
-  };
+  # `applied/ruth/flake.nix`. HIVE_PORT / HIVE_LABEL are injected by
+  # the meta-flake at deploy time and have manager-only standalone-eval
+  # fallbacks in `harness-base.nix`.
+  hyperhive.role = "manager";
 }