fix(#170): remove inert disallowedTools from agent definitions

agents/code.md

@@ -4,19 +4,6 @@ description: >-
   Implementation specialist for GitHub issues. Reads triaged issues, implements
   fixes following repo conventions, runs tests and linters, and commits to a
   feature branch. Use when implementing a fix or feature from a triaged issue.
-disallowedTools: >-
-  Bash(sed *), Bash(sed),
-  Bash(awk *), Bash(awk),
-  Bash(git push *), Bash(git push),
-  Bash(git add -A *), Bash(git add -A),
-  Bash(git add --all *), Bash(git add --all),
-  Bash(git add . *), Bash(git add .),
-  Bash(git commit --amend *), Bash(git commit --amend),
-  Bash(git reset --hard *), Bash(git reset --hard),
-  Bash(git rebase *), Bash(git rebase),
-  Bash(gh pr create *), Bash(gh pr edit *), Bash(gh pr merge *),
-  Bash(gh issue edit *), Bash(gh issue comment *),
-  Bash(gh api *)
 model: opus
 skills:
   - code-implementation

agents/fix.md

@@ -5,19 +5,6 @@ description: >-
   reviewers, implements targeted fixes on the existing PR branch, runs tests
   and linters, and commits the result. Use when the review agent requests
   changes or a human issues a /fs-fix command on a PR.
-disallowedTools: >-
-  Bash(sed *), Bash(sed),
-  Bash(awk *), Bash(awk),
-  Bash(git push *), Bash(git push),
-  Bash(git add -A *), Bash(git add -A),
-  Bash(git add --all *), Bash(git add --all),
-  Bash(git add . *), Bash(git add .),
-  Bash(git commit --amend *), Bash(git commit --amend),
-  Bash(git reset --hard *), Bash(git reset --hard),
-  Bash(git rebase *), Bash(git rebase),
-  Bash(gh pr create *), Bash(gh pr edit *), Bash(gh pr merge *),
-  Bash(gh issue edit *), Bash(gh issue comment *),
-  Bash(gh api *)
 model: opus
 skills:
   - fix-review

agents/retro.md

@@ -9,10 +9,6 @@ skills:
   - finding-agent-runs
   - agent-scaffolding
   - autonomy-readiness
-tools: >-
-  Read, Grep, Glob, Bash(gh,jq)
-disallowedTools: >-
-  Write, Edit, NotebookEdit
 model: opus
 ---
 

agents/review.md

@@ -4,10 +4,6 @@ description: >-
   Code review orchestrator. Triages the change, dispatches specialized
   sub-agents in parallel across six review dimensions, synthesizes
   findings, and produces a structured result.
-tools: >-
-  Read, Grep, Glob, Bash, Agent
-disallowedTools: >-
-  Write, Edit, NotebookEdit
 model: opus
 skills:
   - code-review

env/code.env

@@ -4,7 +4,7 @@ export GITHUB_ISSUE_URL=${GITHUB_ISSUE_URL}
 # GH_TOKEN in the sandbox is a READ-ONLY scoped app installation token
 # (contents:read, issues:read, pull_requests:read). Set by
 # setup-agent-env.sh from CODE_GH_TOKEN. This token CANNOT push code
-# or create PRs even if the agent bypasses disallowedTools.
+# or create PRs — token scoping is the primary enforcement mechanism.
 # The separate write-enabled PUSH_TOKEN (runner_env) never enters the sandbox.
 export GH_TOKEN=${GH_TOKEN}
 

harness/code.yaml

@@ -6,7 +6,9 @@
 #   agent       : reads the issue, implements, tests, scans, commits locally
 #   post_script : protected-path check, secret scan, push branch, create PR
 #
-# The agent NEVER pushes or creates PRs (disallowedTools enforces this).
+# The agent NEVER pushes or creates PRs. Enforcement: the sandbox
+# GH_TOKEN is read-only scoped, PUSH_TOKEN never enters the sandbox,
+# and network policy restricts git/gh binary access.
 # Only the post-script, running on the runner with PUSH_TOKEN, can write.
 agent: agents/code.md
 doc: docs/code.md

harness/fix.yaml

@@ -6,7 +6,9 @@
 #   agent       : reads pre-fetched review body, fixes code, tests, scans, commits
 #   post_script : push commit, post summary comment on PR
 #
-# The agent NEVER pushes or creates PRs (disallowedTools enforces this).
+# The agent NEVER pushes or creates PRs. Enforcement: the sandbox
+# GH_TOKEN is read-only scoped, PUSH_TOKEN never enters the sandbox,
+# and network policy restricts git/gh binary access.
 # Only the post-script, running on the runner with PUSH_TOKEN, can write.
 agent: agents/fix.md
 doc: docs/fix.md

policies/code.yaml

@@ -5,8 +5,8 @@ version: 1
 #
 # Grants network access the code agent needs beyond the base sandbox:
 #   - Vertex AI (global inference + GCP auth token exchange)
-#   - GitHub API (gh/git only — curl intentionally excluded to prevent
-#     disallowedTools bypass via raw HTTP with the injected GH_TOKEN)
+#   - GitHub API (gh/git only — curl excluded from the binary allowlist
+#     to prevent raw HTTP access with the injected GH_TOKEN)
 #   - gitleaks releases (fallback download if not pre-installed in image)
 #   - npm/yarn/pnpm/PyPI/Go registries (running tests may pull dev dependencies)
 #   - pre-commit binary needs github (clone hook repos), package registries

policies/fix.yaml

@@ -6,7 +6,7 @@ version: 1
 # Identical to the code agent policy — the fix agent needs the same network
 # access (Vertex AI, GitHub API for gh pr view/diff, package registries)
 # because it runs tests and linters. The review body is pre-fetched by the
-# workflow; gh api is banned via disallowedTools in agents/fix.md.
+# workflow; the sandbox GH_TOKEN is read-only scoped.
 
 filesystem_policy:
   include_workdir: true

policies/prioritize.yaml

@@ -4,8 +4,8 @@ version: 1
 # Sandbox policy for the prioritize agent.
 #
 # Needs GitHub API for project board operations (read-write) and Vertex AI
-# for inference. curl intentionally excluded to prevent disallowedTools
-# bypass via raw HTTP with the injected GH_TOKEN.
+# for inference. curl excluded from the binary allowlist to prevent raw
+# HTTP access with the injected GH_TOKEN.
 
 filesystem_policy:
   include_workdir: true

policies/retro.yaml

@@ -7,8 +7,8 @@ version: 1
 # and Vertex AI for inference. The sandbox token has issues:write (needed by
 # the post-script on the runner) and pull_requests:write (required by GitHub to
 # comment on PRs via the issues endpoint) but not contents:write.
-# curl intentionally excluded to prevent disallowedTools bypass via raw HTTP
-# with the injected GH_TOKEN.
+# curl excluded from the binary allowlist to prevent raw HTTP access with
+# the injected GH_TOKEN.
 
 filesystem_policy:
   include_workdir: true

policies/scribe.yaml

@@ -2,9 +2,9 @@ version: 1
 
 # Sandbox policy for the scribe agent.
 #
-# Needs Vertex AI for inference only. curl intentionally excluded from
-# vertex_ai binaries to prevent disallowedTools bypass via raw HTTP with
-# the injected GCP service account key at /tmp/.gcp-credentials.json.
+# Needs Vertex AI for inference only. curl excluded from the binary
+# allowlist to prevent raw HTTP access with the injected GCP service
+# account key at /tmp/.gcp-credentials.json.
 
 filesystem_policy:
   include_workdir: true

policies/triage.yaml

@@ -3,8 +3,8 @@ version: 1
 # Sandbox policy for the triage agent.
 #
 # Needs GitHub API for issue/PR triage and Vertex AI for inference.
-# curl intentionally excluded from vertex_ai binaries to prevent
-# disallowedTools bypass via raw HTTP with the injected GH_TOKEN.
+# curl excluded from the binary allowlist to prevent raw HTTP access
+# with the injected GH_TOKEN.
 
 filesystem_policy:
   include_workdir: true

skills/code-implementation/SKILL.md

@@ -734,8 +734,8 @@ Closes #<number>"
 which gitlint &>/dev/null && gitlint --commit HEAD
 ```
 
-If gitlint fails, **undo and recommit** with a corrected message (`--amend`
-is blocked by `disallowedTools`):
+If gitlint fails, **undo and recommit** with a corrected message (do not
+use `--amend` — always create new commits to preserve attribution):
 
 ```bash
 git reset --soft HEAD~1