{ pkgs, config, ... }:
{
  imports = [ ./harness-base.nix ];

  # Manager auto-unsubscribes from repo watches and skips the subscription/
  # participation firehose — only direct mentions, reviews, and assignments
  # land in the inbox. Sub-agents default to keepSubscriptions=true and
  # skipNotifyReasons=[].
  hyperhive.forge.keepSubscriptions = false;
  hyperhive.forge.skipNotifyReasons = [
    "subscribed"
    "participating"
  ];

  # HIVE_PORT/HIVE_LABEL/gitconfig are also injected by the generated
  # `applied/hm1nd/flake.nix` (see `lifecycle::setup_applied`); the values
  # here are the base config so the container stays sensible if anyone
  # ever evaluates `nixosConfigurations.manager` standalone.
  systemd.services.hive-m1nd = {
    description = "hive-m1nd manager harness";
    wantedBy = [ "multi-user.target" ];
    after = [ "network.target" ];
    environment = {
      HIVE_PORT = "8000";
      HIVE_LABEL = "hm1nd";
      SHELL = "${pkgs.bashInteractive}/bin/bash";
      # Manager runs the same hive-m1nd harness binary that serves
      # the per-agent web UI; point it at the merged agent static dist
      # (same shape as for sub-agents).
      HIVE_STATIC_DIR = "${config.hyperhive.frontend.mergedDist}";
    };
    # See note in agent-base.nix — `/run/current-system/sw` makes the
    # harness service PATH track `environment.systemPackages` so anything
    # an agent adds to its own `agent.nix` is visible without editing the
    # service definition.
    path = [ "/run/current-system/sw" ];
    serviceConfig = {
      ExecStart = "${pkgs.hyperhive}/bin/hive-m1nd serve";
      Restart = "on-failure";
      RestartSec = 2;
    };
  };
}