orchestrator-workflow 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to `orchestrator-workflow` are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.1] - 2026-06-24
+
+### Security
+
+- The installed `reviewer` subagent now carries the same read-only tool posture
+  as the explorer: `disallowedTools: Edit, Write, NotebookEdit` (Claude Code) and
+  `permission: edit: deny` (opencode). Previously only the explorer was
+  tool-restricted and the reviewer was restrained by prose alone ("Do not rewrite
+  the change yourself"), so a misled or prompt-injected reviewer could edit files
+  through the edit tools. The reviewer's job is to judge work without changing it,
+  so it is now installed read-only on both harnesses, matching the explorer.
+  (Bash is intentionally not restricted by this posture on either read-only role,
+  unchanged from before.)
+
 ## [0.7.0] - 2026-06-22
 
 ### Added

package/INSTALL-AGENT.md

@@ -107,8 +107,8 @@ steps in the repository you were asked to install into.
      `assets/skill/SKILL.md`. For each role, `.claude/agents/<role>.md` from
      `assets/agents/<role>.md` with `model: <operator's choice>` added as a
      new line directly after the `description:` line (that placement matches
-     the installer's output byte for byte). For the explorer role
-     additionally, `disallowedTools: Edit, Write, NotebookEdit` goes on a new
+     the installer's output byte for byte). For the explorer and reviewer
+     roles additionally, `disallowedTools: Edit, Write, NotebookEdit` goes on a new
      line directly after the `model:` line. Ensure `CLAUDE.md` exists and
      contains a line `@AGENTS.md`.
    - Codex: `.agents/skills/orchestrator-workflow/SKILL.md`, same skill file.
@@ -125,10 +125,11 @@ steps in the repository you were asked to install into.
      which is the safe portable fallback. The installed CLI resolves aliases
      to fully-qualified ids by running `opencode models` at install time; in a
      manual install you may not have a live catalog, so omitting `model:` is
-     correct. For the explorer role additionally, `permission:` goes on a new
+     correct. For the explorer and reviewer roles additionally, `permission:` goes on a new
      line directly after `mode: subagent` (or after `model:` when that line is
      present), followed by `  edit: deny` (two-space indent) on the next line.
-     Example explorer frontmatter when no model is resolved:
+     Example read-only role frontmatter (explorer or reviewer) when no model
+     is resolved:
      ```yaml
      ---
      description: "..."

package/README.md

@@ -97,9 +97,9 @@ Per selected harness:
 
 | Harness | Files | Notes |
 |---|---|---|
-| Claude Code | `.claude/skills/orchestrator-workflow/SKILL.md`, `.claude/agents/{explorer,task-slicer,implementer,reviewer}.md`, `CLAUDE.md` | Claude Code reads `CLAUDE.md`, not `AGENTS.md`; the installer adds an additive `@AGENTS.md` import. Subagent models go into the `model:` frontmatter; the read-only explorer also gets `disallowedTools: Edit, Write, NotebookEdit`. |
+| Claude Code | `.claude/skills/orchestrator-workflow/SKILL.md`, `.claude/agents/{explorer,task-slicer,implementer,reviewer}.md`, `CLAUDE.md` | Claude Code reads `CLAUDE.md`, not `AGENTS.md`; the installer adds an additive `@AGENTS.md` import. Subagent models go into the `model:` frontmatter; the read-only explorer and reviewer also get `disallowedTools: Edit, Write, NotebookEdit`. |
 | OpenAI Codex | `.agents/skills/orchestrator-workflow/SKILL.md` | Codex reads `AGENTS.md` natively. There is no standardized project-level subagent definition; the skill instructs running the roles inline with the same contracts. |
-| opencode | `.opencode/skills/orchestrator-workflow/SKILL.md`, `.opencode/agents/{explorer,task-slicer,implementer,reviewer}.md` | opencode reads `AGENTS.md` natively. Subagents get `mode: subagent`; the explorer also gets `permission: edit: deny`. Model resolution is described below. |
+| opencode | `.opencode/skills/orchestrator-workflow/SKILL.md`, `.opencode/agents/{explorer,task-slicer,implementer,reviewer}.md` | opencode reads `AGENTS.md` natively. Subagents get `mode: subagent`; the read-only explorer and reviewer also get `permission: edit: deny`. Model resolution is described below. |
 
 ## Model preselection
 

package/dist/models.js

@@ -8,7 +8,10 @@ export const ROLES = [
  * Roles that map the terrain or judge work without changing it. They are
  * installed with a read-only posture (no file-mutation tools).
  */
-export const READ_ONLY_ROLES = new Set(["explorer"]);
+export const READ_ONLY_ROLES = new Set([
+    "explorer",
+    "reviewer",
+]);
 export const MODEL_ALIASES = ["sonnet", "opus", "haiku"];
 /**
  * Per-role defaults. The orchestrator itself runs on the session model and is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orchestrator-workflow",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Installer for an orchestrator-led agent workflow: .ai/ run state, an AGENTS.md policy section, and per-harness subagent definitions for Claude Code, OpenAI Codex, and opencode",
   "main": "dist/index.js",
   "type": "module",