{ pkgs, ... }:
{
  imports = [ ./harness-base.nix ];

  # HIVE_PORT/HIVE_LABEL/gitconfig are also injected by the generated
  # `applied/hm1nd/flake.nix` (see `lifecycle::setup_applied`); the values
  # here are the base config so the container stays sensible if anyone
  # ever evaluates `nixosConfigurations.manager` standalone.
  systemd.services.hive-m1nd = {
    description = "hive-m1nd manager harness";
    wantedBy = [ "multi-user.target" ];
    after = [ "network.target" ];
    environment = {
      HIVE_PORT = "8000";
      HIVE_LABEL = "hm1nd";
      SHELL = "${pkgs.bashInteractive}/bin/bash";
    };
    # See note in agent-base.nix — `/run/current-system/sw` makes the
    # harness service PATH track `environment.systemPackages` so anything
    # an agent adds to its own `agent.nix` is visible without editing the
    # service definition.
    path = [ "/run/current-system/sw" ];
    serviceConfig = {
      ExecStart = "${pkgs.hyperhive}/bin/hive-m1nd serve";
      Restart = "on-failure";
      RestartSec = 2;
    };
  };
}