feat: three more agents, tool allowlists, and a README that records the tiers

Committed as-authored to establish a recoverable baseline before the
client-neutral architecture port rewrites these paths. No content is changed
here; this is the working tree as it stood.

- `plan-reviewer`, `pr-creator` and `release-notes` join the set.
- `refactor-scan` and `security-scanner` gain explicit `tools:` allowlists, so a
  review agent can no longer edit or write.
- The README's agent table records each agent's model tier and read-only status,
  and documents how to invoke the three new ones.

One gap is left as-is rather than fixed mid-baseline: `pr-creator` declares no
`tools:`, so it inherits the full tool pool while every sibling review agent is
constrained. It is also the only agent here that legitimately needs to write.

This commit is contained in:

james.bland

2026-09-19 17:25:39 -04:00

parent 16dc81e66d

commit e111e61832

6 changed files with 385 additions and 5 deletions

									
										.claude/agents/security-scanner.md
									
		+1
		
												View File
												
				@@ -2,6 +2,7 @@

				name: security-scanner

				description: Scans code for security vulnerabilities, secrets, and common security anti-patterns. Use before commits or during code review.

				model: sonnet

				tools: Read, Grep, Glob, Bash

				---

				# Security Scanner Agent