docs(code-review): state precisely what disallowedTools enforces

The changelog said the denylist "keeps the read-only-reviewer boundary"
and the agent comment said reviewers "never shell out or mutate source".
Both overstate it: disallowedTools matches only whole servers or every
MCP tool, so a write-shaped inherited MCP tool is covered by prompt
instruction, not by the denylist.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011QjUMmrqfGU4QNXDDRLPrN

Author: wongk

CHANGELOG.md

@@ -7,7 +7,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ### code-review v3.8.0
 
 #### Changed
-- The cross-file and design reviewers are no longer bound to a specific code-intelligence MCP server. `code-review-worker-graph` previously declared an allowlist of six `mcp__codebase-memory-mcp__*` tools, which meant only that server could ever reach a reviewer and unresolved entries were silently dropped on any machine without it. The agent now declares no `tools:` allowlist and inherits the tools of the session that spawned it, so whichever indexing server the operator has connected is available; `disallowedTools: Bash, Edit, NotebookEdit` keeps the read-only-reviewer boundary. `code-review-worker` keeps its explicit four-tool allowlist, so the verifier fleet, Bug Hunter A, the domain critics and the singleton prompts continue to inherit nothing.
+- The cross-file and design reviewers are no longer bound to a specific code-intelligence MCP server. `code-review-worker-graph` previously declared an allowlist of six `mcp__codebase-memory-mcp__*` tools, which meant only that server could ever reach a reviewer and unresolved entries were silently dropped on any machine without it. The agent now declares no `tools:` allowlist and inherits the tools of the session that spawned it, so whichever indexing server the operator has connected is available. `disallowedTools: Bash, Edit, NotebookEdit` removes those three native tools at the harness level; note that this is narrower than the old allowlist, which made every non-listed tool unreachable by construction — an inherited MCP tool that runs shell commands or edits files is covered by prompt instruction, not by the denylist, because `disallowedTools` matches only whole servers (`mcp__<server>`) or every MCP tool (`mcp__*`), with no pattern for write-shaped tools across servers. `code-review-worker` keeps its explicit four-tool allowlist, so the verifier fleet, Bug Hunter A, the domain critics and the singleton prompts continue to inherit nothing.
 - The knowledge-graph protocol in `shared_prompt.txt` is now a substrate-agnostic capability contract (`OPTIONAL — CODE INTELLIGENCE`). Instead of naming tools and their argument shapes, it describes four capabilities — symbol lookup, usage/caller enumeration, snippet read, and structure/dependency analysis — and directs the reviewer to inspect its own tool roster and bind whichever tools answer them, loading deferred MCP schemas with `ToolSearch` first. The same rewrite is applied to `impact_analyzer_prompt.txt`, `design_critic_suffix.txt`, `verifier_prompt.txt`, and the Bug Hunter B / Impact Analyzer / Design Critic / fast-path suffixes in the `spawn-reviewers` skill. The repo-scoping, path-validation, silent-degradation, and untrusted-tool-output rules are retained and generalized to any MCP tool.
 - `GRAPH_PROJECT` is replaced by a single orchestrator-computed boolean, `CODE_INTEL_ALLOWED`. The orchestrator no longer calls `list_projects`, resolves a project identifier, or makes any code-intelligence tool call at all; it only decides whether an external index may be trusted for the run, setting `CODE_INTEL_ALLOWED=false` whenever `review_root` is set (an index covers the operator checkout, not the PR head). This removes the prior step that substituted a server-returned project name into the agents' trusted instruction zone.
 

plugins/code-review/agents/code-review-worker-graph.md

@@ -1,7 +1,7 @@
 ---
 name: code-review-worker-graph
 description: Code-intelligence-aware review worker for the cross-file and design reviewers (Impact Analyzer, Bug Hunter B, fast-path, Design Critic). Identical to code-review-worker but inherits the parent session's tools, so whatever code-intelligence MCP server the operator has connected is available for cross-file usage discovery and project-structure / dependency-graph analysis. Use only for reviewers whose role prompt loads the code-intelligence protocol.
-disallowedTools: Bash, Edit, NotebookEdit  # harness-level: reviewers never shell out or mutate source. MCP inheritance is deliberately untouched — see shared_prompt.txt "OPTIONAL — CODE INTELLIGENCE".
+disallowedTools: Bash, Edit, NotebookEdit  # harness-level removal of the three native tools a reviewer must never hold. Does NOT reach write-shaped MCP tools (no cross-server pattern exists); those are covered by the prompt below. MCP inheritance is deliberately untouched — see shared_prompt.txt "OPTIONAL — CODE INTELLIGENCE".
 effort: high  # pinned so a lowered session effort can't cut reviewer reasoning depth (no per-Task override; frontmatter is the only lever). Not redundant with the default — do not remove. Rationale: start.md "Orchestrator model (cost)".
 ---