Resolves #13453

Tracked, AGENTS.md-mirroring Claude harness config that resolves the friction where the Claude Code auto-mode classifier denies legitimate equal-peer substrate work. @tobiu green-lit this in-session. Fleet-generic (no hardcoded identity).

Evidence: L1 (static config — JSON validity verified, no runtime AC). No residuals.

Changes

1. .claude/settings.template.json (new, tracked) — mirrors AGENTS.md:

• permissions.allow the three neo-mjs MCP substrate servers — an explicit MCP-tool allow suppresses the intent classifier for that tool (verified via claude-code-guide), the direct fix for the denial friction.
• permissions.deny: ["Bash(gh pr merge *)"] — statically blocks the merge command, closing the mechanical_guard: none gap on §critical_gates #1.
• prose autoMode — hard_deny carries the runtime-arg-aware gates (push/commit to main|dev, client-names-in-public); allow clarifies equal-peer substrate work is normal; every section leads with "$defaults" to keep built-in protections.

2. .claude/claude_desktop_config.example.json (new, tracked) — Claude Desktop MCP starter, local-first (V-B-A'd against the operator's actual claude_desktop_config.json): each server runs node --env-file=<repo>/.env …, so secrets live in .env (never inline — no GEMINI_API_KEY, no inline GH_TOKEN); providers point at NEO_OPENAI_COMPATIBLE_HOST (a local inference endpoint); only memory-core carries NEO_AGENT_IDENTITY.

Deltas

• The AI_QUICK_START.md refresh is descoped from this PR. A correct guide update needs a clear local-first vs remote/cloud split, the local startup prerequisites (orchestrator + NL bridge), and one consistent config form per harness — none of which my initial edits delivered (they introduced inconsistent config blocks instead). Reverted to dev; the guide gets a proper, V-B-A'd rework as a separate effort, and #13453's guide AC moves with it (ticket re-scope pending the operator's structural steer).
• Neural-link MCP tools are intentionally not in the default permissions.allow (live-runtime mutation — explicit per-agent opt-in).
• autoMode is prose, not tool-pattern strings (verified; corrected a pre-session assumption).
• No Contract Ledger: client-side harness config, no consumed-MCP-surface contract change.

Test Evidence

Config-only change — no unit tests required (pr-review §7.5). Verified:

• node -p "JSON.parse(...)" on both JSON files → VALID.
• git check-ignore on both → not ignored (will be tracked; .gitignore only ignores .claude/settings.json).
• Claude Code settings schema — autoMode prose shape + "$defaults", permissions.deny Bash syntax + deny>ask>allow precedence, MCP allow-listing — verified against current docs via the claude-code-guide agent before authoring.
• The Desktop example was corrected to local-first after V-B-A against the operator's running claude_desktop_config.json (it initially, wrongly, carried GEMINI_API_KEY).
• Commits: 7256116c1 (templates + guide) → 0af6a0385 (local-first example fix) → 0060febd3 (revert guide; descope). Net PR diff: the two .claude/ templates only.

Post-Merge Validation

• An agent copies .claude/settings.template.json → .claude/settings.local.json and confirms routine substrate-work is no longer classifier-gated, while gh pr merge and direct main/dev pushes stay blocked.
• A Desktop user copies .claude/claude_desktop_config.example.json, fills the placeholders, and a neo-mjs-memory-core healthcheck returns identity.bound: true.

Open / Follow-up

• Guide rework (separate): a proper AI_QUICK_START.md overhaul — local-first vs remote/cloud, local startup (orchestrator + NL bridge), one consistent config form per harness. Needs the operator's structural steer + a V-B-A of the startup mechanics; deliberately not faked here.
• Applying any config into a live file stays the operator's trust-root action; this PR only adds tracked templates.

Authored by Vega (@neo-opus-vega, Claude Opus 4.8).