refactor(code-review): decouple review agents from codebase-memory-mcp

[wongk]

Why

The reviewer fleet was hard-bound to one MCP server. agents/code-review-worker-graph.md declared an allowlist of six mcp__codebase-memory-mcp__* tools, and an allowlist is exhaustive — no other server could ever reach a reviewer, no matter what the operator had connected. Unresolvable entries were silently dropped rather than erroring, which is why the coupling went unnoticed on machines without that server: reviews just quietly ran grep-only forever.

This makes the plugin substrate-agnostic. Reviewers now use whatever code-intelligence MCP server the operator's session provides — codebase-memory-mcp, LemonCrow, closedloop-graph, or something that does not exist yet — with no plugin edit required.

Approach

Access. The graph worker drops tools: entirely and inherits the spawning session, with disallowedTools: Bash, Edit, NotebookEdit as harness-level hardening. code-review-worker keeps its explicit four-tool allowlist, so the verifier fleet, Bug Hunter A, the domain critics, and the singleton prompts still inherit nothing — the adversarial trust boundary is unchanged.

Protocol. The codebase-memory-mcp block in shared_prompt.txt becomes OPTIONAL — CODE INTELLIGENCE: four capabilities (C1 symbol lookup, C2 usage/caller enumeration, C3 snippet read, C4 structure) that the reviewer binds to whatever it holds, discovering its own roster and loading deferred MCP schemas with ToolSearch. Same rewrite across the impact-analyzer, design-critic, verifier prompts and the four suffixes in spawn-reviewers.

Orchestrator. GRAPH_PROJECT collapses to one computed boolean, CODE_INTEL_ALLOWED, false whenever review_root is set. That preserves the stale-index kill switch — substrate-independent, since any index covers the operator checkout rather than the PR head — and drops the list_projects handshake that substituted a server-returned project name into the agents' trusted instruction zone.

Schema: comments only. discovery: "graph" was already substrate-neutral, so no schema change and no fixture churn.

Verified at runtime, not from docs

Each claim below was checked by running the real plugin through headless claude -p --plugin-dir and inspecting the spawned worker's actual tool roster.

Check	Result
Baseline (before)	Graph worker got exactly Read, Write, Grep, Glob — zero MCP. The allowlist was genuinely gating.
Unresolvable entries	Agent still spawns; missing MCP tools silently dropped. Confirms the failure was invisible.
After	Worker inherits 139 MCP tools; Impact Analyzer bound C2 to mcp__lc__relations — a server this plugin never names — and cross-checked with mcp__lc__code_query.
Kill switch	CODE_INTEL_ALLOWED=false → zero MCP calls, silent degradation, finding still emitted.
disallowedTools	Bash/Edit/NotebookEdit removed; MCP inheritance survives intact.
tools: mcp__*	Silently dropped — wildcards are denylist-only, so allowlist and inheritance are mutually exclusive. Worth knowing before anyone tries to have both.

A fail-open this surfaced

Inheriting tools means inheriting the parent's absence of them. In a session without Grep/Glob, the reviewer still emitted grep_query_used: "_parse_agent_name\\(" — a query it never ran — which the verifier replays as its fabrication check. That is a fail-open in the exact mechanism designed to catch hallucination.

Fixed in both prompts: text search is a capability, not a tool name, and any recorded search must describe a query actually executed. With no text-search tool the analyzer now emits grep_query_used: null, external_usages_found: [], and tags entries discovery: "graph", routing them to the per-entry file-read and content-match audit — which verifier_prompt.txt already handles as the all-graph case, so no verifier change was needed.

Re-spiked after the fix and asserted the replay-gate invariant against the real vocabulary:

discovery value in vocab: True -> graph
grep_query_used: None
external_usages_found: []
grep-discovery entries: 0
REPLAY-GATE INVARIANT HOLDS: True

Verification

• pytest plugins/ — 2107 passed, 3 skipped
• uv run ruff check . — clean
• uv run pyright — 0 errors
• Zero references to codebase-memory-mcp or GRAPH_PROJECT remain outside historical CHANGELOG entries
• README re-verified against disk: accurate, no changes needed beyond the agent line

Notes for review

• Expected one-time cache miss. shared_prompt.txt and verifier_prompt.txt bytes feed prompt_hash, so the first run after merge re-pays the BHA and verification namespaces. Correct behavior — cached findings were produced under the old protocol.
• Known gap: disallowedTools cannot reach shell-equivalent MCP tools (e.g. mcp__lc__bash). Addressed with one clause in the agent prompt rather than new machinery, on the principle that the harness owns permissions.
• Version 3.7.1 → 3.8.0 (MINOR: new capability, no breaking interface change).

🤖 Generated with Claude Code

https://claude.ai/code/session_011QjUMmrqfGU4QNXDDRLPrN

[shafty023]

Beginning a code-review. Please allow time for me to finish before merging the PR