{ pkgs, config, ... }:
let
  userName = config.hyperhive.user.name;
in
{
  imports = [ ./harness-base.nix ];

  # Manager auto-unsubscribes from repo watches and skips the subscription/
  # participation firehose — only direct mentions, reviews, and assignments
  # land in the inbox. Sub-agents default to keepSubscriptions=true and
  # skipNotifyReasons=[].
  hyperhive.forge.keepSubscriptions = false;
  hyperhive.forge.skipNotifyReasons = [
    "subscribed"
    "participating"
  ];

  # HIVE_PORT/HIVE_LABEL/gitconfig are also injected by the generated
  # `applied/hm1nd/flake.nix` (see `lifecycle::setup_applied`); the values
  # here are the base config so the container stays sensible if anyone
  # ever evaluates `nixosConfigurations.manager` standalone.
  systemd.services.hive-m1nd = {
    description = "hive-m1nd manager harness";
    wantedBy = [ "multi-user.target" ];
    after = [ "network.target" ];
    environment = {
      HIVE_PORT = "8000";
      HIVE_LABEL = "hm1nd";
      SHELL = "${pkgs.bashInteractive}/bin/bash";
      # `HOME` set explicitly so claude finds `~/.claude/` at the
      # bind-mounted location after #658 (User= drop from root).
      HOME = "/home/${userName}";
      # Manager runs the same hive-m1nd harness binary that serves
      # the per-agent web UI; point it at the merged agent static dist
      # (same shape as for sub-agents).
      HIVE_STATIC_DIR = "${config.hyperhive.frontend.mergedDist}";
      # Static runtime assets (branding + claude prompts). Set on the
      # unit directly — `environment.variables` in harness-base.nix only
      # populates /etc/profile, which systemd services don't inherit.
      HIVE_ASSETS_DIR = "${pkgs.hyperhive-assets}/share/hyperhive";
    };
    # See note in agent-base.nix — `/run/current-system/sw` makes the
    # harness service PATH track `environment.systemPackages` so anything
    # an agent adds to its own `agent.nix` is visible without editing the
    # service definition.
    path = [ "/run/current-system/sw" ];
    serviceConfig = {
      ExecStart = "${pkgs.hyperhive}/bin/hive-m1nd serve";
      Restart = "on-failure";
      RestartSec = 2;
      # Same drop-from-root as agent-base.nix (#658). Manager
      # interactions with the host (rebuild approvals, config
      # writes) still happen via the dedicated unix sockets
      # bind-mounted from hive-c0re — those don't need root
      # inside the container.
      User = userName;
      Group = userName;
    };
  };
}