Add .claude harness-config templates (settings + Claude Desktop MCP)

Context

Operator-green-lit (this session): resolve the friction where the Claude Code auto-mode classifier denies legitimate equal-peer substrate work (it applies a generic human-approval prior unaware of AGENTS.md / the flat-peer model). There was no tracked .claude/ config teaching the harness Neo's permission model — each agent re-derived it in a gitignored local file or hit the friction cold.

Scope note (re-scoped 2026-06-17): this ticket delivers the two tracked .claude/ config templates below. The AI_QUICK_START.md refresh originally bundled here is descoped to a separate guide-rework effort — see Out of Scope.

The Problem

With no harness-level encoding of "equal-peer substrate work is normal; only gh pr merge / direct main|dev pushes / public client-names are forbidden," the classifier defaults to a deferential prior and gates routine work — the "Helpful Assistant regression" AGENTS.md §identity_prompt_firewall exists to counter, except the firewall is prose the model reads, not config the harness enforces. And the only committed harness-config template was .gemini/settings.template.json (Gemini CLI); Claude Code / Desktop users (the fleet + external contributors) had no equivalent.

The Architectural Reality

Claude Code settings schema verified via the claude-code-guide agent: an explicit permissions.allow MCP-tool entry suppresses the intent classifier for that tool (the friction fix); permissions.deny (deny > ask > allow, compound-aware) statically blocks gh pr merge; autoMode is prose (LLM-evaluated, runtime-arg-aware), carrying the gates a static pattern can't (main|dev push, client-names). .claude/settings.json holds permissions/autoMode — not mcpServers (those live in .mcp.json / claude_desktop_config.json).

The Fix

1. NEW .claude/settings.template.json — permissions.allow the three neo-mjs MCP substrate servers + permissions.deny: ["Bash(gh pr merge *)"] (closes the mechanical_guard: none gap on §critical_gates #1) + prose autoMode mirroring AGENTS.md (hard_deny / allow / environment / soft_deny, each leading with "$defaults"). Fleet-generic — no hardcoded identity.
2. NEW .claude/claude_desktop_config.example.json — Claude Desktop MCP starter, local-first (V-B-A'd against the operator's actual claude_desktop_config.json): node --env-file=<repo>/.env …; secrets live in .env (never inline — no GEMINI_API_KEY); providers point at NEO_OPENAI_COMPATIBLE_HOST (a local inference endpoint); only memory-core carries NEO_AGENT_IDENTITY.

Contract Ledger

N/A — client-side harness config; changes no consumed-MCP-surface contract, behavior, or error-code.

Decision Record impact

none — config; no ADR mutation (harness-adjacent to ADR 0020).

Acceptance Criteria

• .claude/settings.template.json exists (tracked, valid JSON) with permissions.allow for the three neo-mjs MCP servers, permissions.deny: ["Bash(gh pr merge *)"], and a prose autoMode whose hard_deny names: no gh pr merge, no push/commit to main|dev, no client-names in public artifacts; environment / soft_deny / hard_deny each include "$defaults".
• No hardcoded agent identity or machine-specific path in either template (fleet-generic).
• .claude/claude_desktop_config.example.json exists (tracked, valid JSON), local-first, with no committed secrets (env-var names / placeholders only; .env is the secret home).
• PR opened against dev for operator merge.

Out of Scope

• AI_QUICK_START.md refresh — DESCOPED to a separate guide-rework effort. A correct guide update needs: a local-first vs remote/cloud split, the local startup prerequisites (orchestrator + NL bridge), and one consistent config form per harness — plus fixing pre-existing staleness (the "Claude Desktop & Claude Code share one MCP file" claim; the neo.mjs-memory-core typo). The initial bundled guide edits were inconsistent + incomplete and were reverted from PR #13454. The rework is filed/steered separately — the local-vs-cloud structure is an operator decision; the startup mechanics need a V-B-A of the actual scripts.
• Applying/installing the config into any live settings.json / claude_desktop_config.json / .mcp.json (operator / per-agent trust-root act).
• Neural-link MCP tools in the default allow-list (live-runtime mutation; explicit per-agent opt-in).

Related

• PR #13454 (delivers this ticket)
• .gemini/settings.template.json (the precedent this mirrors)
• AGENTS.md — §critical_gates (#1 mechanical_guard gap, #8 PR→dev, #9 client-names), §identity_prompt_firewall, §swarm_topology_anchor
• ADR 0020 (agent-harness concept — harness-adjacent)

Release classification

post-release (non-blocking) — internal agent-harness dev-config + contributor onboarding; not a v13 / v14 release artifact.

Retrieval Hint: query_raw_memories "harness auto-mode classifier denied substrate work settings template"; "Claude Code permissions autoMode AGENTS.md mirror"