refactor(code-review): decouple review agents from codebase-memory-mcp

CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to the claude-plugins project will be documented in this fil
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Entries are listed newest-first; each plugin section is treated as released when merged to `main`.
 
+### code-review v3.8.0
+
+#### Changed
+- The cross-file and design reviewers are no longer bound to a specific code-intelligence MCP server. `code-review-worker-graph` previously declared an allowlist of six `mcp__codebase-memory-mcp__*` tools, which meant only that server could ever reach a reviewer and unresolved entries were silently dropped on any machine without it. The agent now declares no `tools:` allowlist and inherits the tools of the session that spawned it, so whichever indexing server the operator has connected is available. `disallowedTools: Bash, Edit, NotebookEdit` removes those three native tools at the harness level; note that this is narrower than the old allowlist, which made every non-listed tool unreachable by construction — an inherited MCP tool that runs shell commands or edits files is covered by prompt instruction, not by the denylist, because `disallowedTools` matches only whole servers (`mcp__<server>`) or every MCP tool (`mcp__*`), with no pattern for write-shaped tools across servers. `code-review-worker` keeps its explicit four-tool allowlist, so the verifier fleet, Bug Hunter A, the domain critics and the singleton prompts continue to inherit nothing.
+- The knowledge-graph protocol in `shared_prompt.txt` is now a substrate-agnostic capability contract (`OPTIONAL — CODE INTELLIGENCE`). Instead of naming tools and their argument shapes, it describes four capabilities — symbol lookup, usage/caller enumeration, snippet read, and structure/dependency analysis — and directs the reviewer to inspect its own tool roster and bind whichever tools answer them, loading deferred MCP schemas with `ToolSearch` first. The same rewrite is applied to `impact_analyzer_prompt.txt`, `design_critic_suffix.txt`, `verifier_prompt.txt`, and the Bug Hunter B / Impact Analyzer / Design Critic / fast-path suffixes in the `spawn-reviewers` skill. The repo-scoping, path-validation, silent-degradation, and untrusted-tool-output rules are retained and generalized to any MCP tool.
+- `GRAPH_PROJECT` is replaced by a single orchestrator-computed boolean, `CODE_INTEL_ALLOWED`. The orchestrator no longer calls `list_projects`, resolves a project identifier, or makes any code-intelligence tool call at all; it only decides whether an external index may be trusted for the run, setting `CODE_INTEL_ALLOWED=false` whenever `review_root` is set (an index covers the operator checkout, not the PR head). This removes the prior step that substituted a server-returned project name into the agents' trusted instruction zone.
+
+#### Fixed
+- The Impact Analyzer can no longer report a `grep_query_used` it did not execute. Sessions that provide no text-search tool previously still emitted a grep query string, which the verifier replays as its fabrication check. `shared_prompt.txt` now states that any recorded search must describe a query actually run, and `impact_analyzer_prompt.txt` directs the analyzer to leave `grep_query_used` null, leave `external_usages_found` empty, and tag callsites `discovery: "graph"` when it holds no text-search tool — routing those entries to the per-entry file-read and content-match audit, which the verifier already handles as the all-graph case. The requirements block and Step 2 of `impact_analyzer_prompt.txt` previously stated the `grep_query_used` requirement categorically ("findings without a `grep_query_used` will be rejected as malformed"), which pushed an analyzer with no search tool back toward inventing one; both statements are now qualified, and a missing query is malformed only when at least one entry is `discovery: "grep"`.
+- The documented meaning of `discovery: "graph"` is widened to match every branch that sets it. It described only the alias / re-export / dynamic-dispatch case a code-intelligence substrate surfaces, but the no-text-search fallback also assigns it to ordinary direct callsites. It now reads as "found on a path the grep replay cannot reproduce", covering both branches, in `code_review_schema.py`, `shared_prompt.txt`, and `verifier_prompt.txt`. The enum vocabulary is unchanged — no schema or fixture change.
+
 ### code v1.14.11
 
 #### Changed

plugins/code-review/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "code-review",
   "description": "Code review plugin",
-  "version": "3.7.1",
+  "version": "3.8.0",
   "author": {
     "name": "ClosedLoop",
     "email": "support@closedloop.ai"

plugins/code-review/README.md

@@ -21,7 +21,7 @@ plugins/code-review/
   SCHEMA.md                          Canonical Finding + ResultEnvelope schema (PLN-719); §12 documents the golden fixture harness
   agents/
     code-review-worker.md            Background worker agent used by every reviewer fleet spawn (Read, Write, Grep, Glob; permissions-stable across sessions)
-    code-review-worker-graph.md      Graph-aware variant for the cross-file and design reviewers (Impact Analyzer, Bug Hunter B, fast-path, Design Critic); adds read-only codebase-memory-mcp tools — cross-file usage discovery for the cross-file roles, project-structure/dependency-graph analysis (get_architecture, query_graph) for the Design Critic
+    code-review-worker-graph.md      Code-intelligence-aware variant for the cross-file and design reviewers (Impact Analyzer, Bug Hunter B, fast-path, Design Critic); declares no tool allowlist, so it inherits whatever indexing MCP server the operator's session provides — cross-file usage discovery for the cross-file roles, project-structure/dependency analysis for the Design Critic. Degrades to grep when the session has none.
   commands/
     start.md                         Main /start command (orchestrator)
     shallow.md                       /shallow wrapper — `/start --depth shallow`

plugins/code-review/agents/code-review-worker-graph.md

@@ -1,50 +1,54 @@
 ---
 name: code-review-worker-graph
-description: Graph-aware code review worker for the cross-file and design reviewers (Impact Analyzer, Bug Hunter B, fast-path, Design Critic). Identical to code-review-worker but adds read-only codebase-memory-mcp tools for precise cross-file usage discovery and project-structure / dependency-graph analysis. Use only for reviewers whose role prompt loads the codebase knowledge graph protocol.
-tools: Read, Write, Grep, Glob, mcp__codebase-memory-mcp__search_graph, mcp__codebase-memory-mcp__trace_path, mcp__codebase-memory-mcp__get_code_snippet, mcp__codebase-memory-mcp__search_code, mcp__codebase-memory-mcp__get_architecture, mcp__codebase-memory-mcp__query_graph
+description: Code-intelligence-aware review worker for the cross-file and design reviewers (Impact Analyzer, Bug Hunter B, fast-path, Design Critic). Identical to code-review-worker but inherits the parent session's tools, so whatever code-intelligence MCP server the operator has connected is available for cross-file usage discovery and project-structure / dependency-graph analysis. Use only for reviewers whose role prompt loads the code-intelligence protocol.
+disallowedTools: Bash, Edit, NotebookEdit  # harness-level removal of the three native tools a reviewer must never hold. Does NOT reach write-shaped MCP tools (no cross-server pattern exists); those are covered by the prompt below. MCP inheritance is deliberately untouched — see shared_prompt.txt "OPTIONAL — CODE INTELLIGENCE".
 effort: high  # pinned so a lowered session effort can't cut reviewer reasoning depth (no per-Task override; frontmatter is the only lever). Not redundant with the default — do not remove. Rationale: start.md "Orchestrator model (cost)".
 ---
 
-# Code Review Worker (graph-aware)
+# Code Review Worker (code-intelligence-aware)
 
 You are a code review worker agent for the cross-file and design reviewers. Your
 job is the same as the generic `code-review-worker` — read pre-extracted patch
 files, analyze changed code, and write structured findings to a JSON file on disk
-— but you also have read-only access to the `codebase-memory-mcp` knowledge graph
-for precise cross-file usage discovery and project-structure / dependency-graph
-analysis.
+— but this agent declares no tool allowlist, so you inherit the tools of the
+session that spawned you. That session may have a code-intelligence MCP server
+connected (one that indexes this repository and answers symbol, caller, and
+structure questions). If it does, those tools are yours to use for precise
+cross-file usage discovery and project-structure / dependency-graph analysis.
+
+Which server it is — and whether there is one at all — varies by operator. Bind
+to what you actually have; never assume a particular server, tool name, or
+argument shape.
 
 ## Workflow
 
 1. Read the patches file and shared prompt file specified in your task prompt
 2. Follow the instructions in the shared prompt exactly (constraints, severity guidelines, output format)
-3. Use Read, Grep, and Glob — plus the graph tools below when your task prompt supplies a `GRAPH_PROJECT` — to explore the codebase for context
+3. Use Read, Grep, and Glob — plus any code-intelligence tools you hold, per the protocol below — to explore the codebase for context
 4. Write your findings JSON to the output file specified in `<output_file>`
 5. Respond with a one-line summary: `DONE findings={count} file={path}`
 
 ## Tool Usage
 
-- **Read / Write / Grep / Glob**: same as the generic worker.
-- **Graph tools** (`search_graph`, `trace_path`, `get_code_snippet`,
-  `search_code`, `get_architecture`, `query_graph` — each prefixed
-  `mcp__codebase-memory-mcp__` in the allowlist): read-only context aids.
-  `get_architecture` and `query_graph` serve project-structure and
-  dependency-graph analysis (the Design Critic's substrate); the other four serve
-  cross-file usage discovery. Use them ONLY per the "Optional: codebase knowledge
-  graph" protocol in `shared_prompt.txt`:
-  - They are usable ONLY when your task prompt provides a non-empty
-    `GRAPH_PROJECT` value (the orchestrator resolved it to THIS repo's indexed
-    project). If `GRAPH_PROJECT` is empty/absent, the graph is unavailable —
-    fall back to Grep/Glob silently.
-  - Pass `project=<GRAPH_PROJECT>` on EVERY graph call. Never omit it and never
-    guess a different project — other indexed repos are out of scope and must
-    never appear in findings.
-  - Validate every returned file path: it MUST be openable with Read at its
-    repo-relative path inside this checkout. Discard (and never cite) any path
-    that is absolute-outside-cwd or escapes the repo via `..`.
-  - The graph never replaces evidence: every finding still cites a concrete
-    file:line you confirmed, and verifier-replay fields (e.g. `grep_query_used`)
-    stay populated per your role prompt.
-
-Do NOT use Bash. Do NOT call indexing or write graph tools (they are not in your
-allowlist). All findings are written with Write exactly as the generic worker does.
+- **Read / Write / Grep / Glob**: same as the generic worker. These always work
+  and are always sufficient — every capability below is an accelerator, never a
+  prerequisite.
+- **Code-intelligence tools**: use them ONLY per the "OPTIONAL — CODE
+  INTELLIGENCE" protocol in `shared_prompt.txt`, which defines how to discover
+  what you hold, which capabilities to look for, and the invariants every call
+  must satisfy. Two mechanics matter before you can call anything:
+  - **Availability is yours to determine.** Inspect your own tool roster. Your
+    task prompt carries `CODE_INTEL_ALLOWED`; when it is `false` the orchestrator
+    has determined an external index cannot be trusted for this run (see the
+    protocol) and you must use Grep/Glob only, regardless of what you hold.
+  - **Some MCP tools arrive deferred** — the name is visible but the schema is
+    not, and calling one cold fails with an input-validation error. Use
+    `ToolSearch` to load the schemas of the tools you intend to use first.
+- **Findings are evidence-bound regardless of substrate.** Every finding cites a
+  concrete file:line you confirmed by reading it, and verifier-replay fields
+  (e.g. `grep_query_used`) stay populated per your role prompt.
+
+Do NOT use Bash — everything you need is reachable with Read, Grep, and Glob.
+That applies equally to any inherited MCP tool that runs shell commands or edits
+files: a reviewer reads and reports, it never executes or mutates. All findings
+are written with Write exactly as the generic worker does.

plugins/code-review/agents/code-review-worker.md

@@ -26,9 +26,10 @@ You are a code review worker agent. Your job is to read pre-extracted patch file
 
 Do NOT use Bash. All data you need is available via Read.
 
-> Graph-aware roles (Impact Analyzer, Bug Hunter B, the Design Critic, and the
-> fast-path reviewer) run as the separate `code-review-worker-graph` agent, which
-> adds read-only `codebase-memory-mcp` tools. This generic worker — used by every
-> other reviewer plus the verifier fleet and the PLN-725 singletons — deliberately
-> has NO graph access, keeping the trust boundary tight for adversarial/verification
-> roles.
+> Code-intelligence-aware roles (Impact Analyzer, Bug Hunter B, the Design Critic,
+> and the fast-path reviewer) run as the separate `code-review-worker-graph` agent,
+> which declares no `tools:` allowlist and so inherits whatever MCP tools the
+> operator's session provides. This generic worker — used by every other reviewer
+> plus the verifier fleet and the PLN-725 singletons — keeps its explicit
+> four-tool allowlist and deliberately inherits NOTHING, keeping the trust boundary
+> tight for adversarial/verification roles.

plugins/code-review/commands/deep.md

@@ -13,7 +13,7 @@ This command is shorthand for `/start --depth deep`. Follow every instruction in
 
 Deep produces the standard fleet plus two deep-only conditional core reviewers: the always-on **Design Critic** and the signal-gated **Impact Analyzer** (FEA-1401).
 
-The **Design Critic** runs on **every** deep review (no trigger required). It evaluates the change for software-design craftsmanship — module depth and information hiding, SOLID adherence, dependency direction and layer boundaries, and project/package structure — drawing on *A Philosophy of Software Design*, the SOLID principles, and *Clean Architecture*. It flags only design flaws this change introduces or demonstrably worsens (a new shallow module, a wrong-direction dependency, a god-class this PR grew, a type-switch it extended), runs on Sonnet, and is **exempt from the domain-critic cap** (it is a `source: "core"` reviewer, not a project-specific critic). Like the Impact Analyzer it is graph-aware: when the repo is indexed it queries the `codebase-memory-mcp` knowledge graph (`get_architecture` for module/layer layout, `query_graph` for dependency direction and import cycles), falling back to grep otherwise. Findings carry `category: "Code Quality"`.
+The **Design Critic** runs on **every** deep review (no trigger required). It evaluates the change for software-design craftsmanship — module depth and information hiding, SOLID adherence, dependency direction and layer boundaries, and project/package structure — drawing on *A Philosophy of Software Design*, the SOLID principles, and *Clean Architecture*. It flags only design flaws this change introduces or demonstrably worsens (a new shallow module, a wrong-direction dependency, a god-class this PR grew, a type-switch it extended), runs on Sonnet, and is **exempt from the domain-critic cap** (it is a `source: "core"` reviewer, not a project-specific critic). Like the Impact Analyzer it is code-intelligence-aware: when the operator's session provides an MCP server that indexes the repo, it uses that server for module/layer layout and for dependency direction and import cycles, falling back to grep otherwise. The plugin is substrate-agnostic — it names no particular server and works with whichever one is connected. Findings carry `category: "Code Quality"`.
 
 The **Impact Analyzer** (FEA-1401) spawns when signal extraction detects `exported_symbol_change` or `symbol_deletion` in the diff. It identifies changed exported symbols (function signatures, type definitions, exported constants, class API, schema fields, deletions), greps the codebase for external usages outside the diff, and emits findings whose `external_impact[]` array lists every callsite that breaks under the new signature.