fix!: drop the coordinator's tools allowlist — it reduced it to Bash + Read

[ruturaj-browserstack]

Production fix. Coordinators cannot run. A live RCA dispatched three of them and
each reported having only Bash and Read — no ToolSearch, no tfaRcaTurn, no
getTfaTurnResult — then terminated honestly rather than fabricating a result:

the tfaRcaTurn / getTfaTurnResult MCP tools that this coordinator role requires are
not present in my available toolset for this session (only Bash and Read … are
exposed) … I did not fabricate any tool call or invent a result.

Cause

agents/ai-tfa-coordinator.md carried:

tools: [Bash, Read, Grep, Glob, Task, mcp__*__tfaRcaTurn, mcp__*__getTfaTurnResult, mcp__github__*]

That line had been inert for months, because the YAML frontmatter did not parse — the
runtime dropped every field and derived the agent's name from the filename. An earlier PR
fixed the parse so claude plugin validate would pass, and in doing so activated an
allowlist that had never once been exercised. It is wrong three ways:

1. mcp__*__tfaRcaTurn does not match the real mcp__plugin_tfa-rca_bstack__tfaRcaTurn.
2. Task, Grep and Glob were not granted either.
3. ToolSearch is missing — fatal on its own, because MCP tools are deferred and
   their schemas cannot be loaded without it. Even a correctly-named tfaRcaTurn would
   be unreachable.

Removed, not corrected

An allowlist cannot express what this agent needs. The coordinator routes evidence to
whatever the customer has — a log store, a cluster, a metrics surface, a forge —
and none of that is knowable when this file is written. Inheriting the session's tools
is not laxness here; it is the only thing consistent with "generic over product and
infra", and it is the behaviour that worked before the allowlist came into force.

Guard

tests/wiring.test.mjs now fails if any tools: key returns to the frontmatter, and
separately if a continuation line drifts back to column 0 — the parse failure that hid
all of this. Mutation-proven against the exact old line, against a plausible "better"
list ([Bash, Read, ToolSearch, Agent, mcp__*]), and against re-breaking the indent.

The guard carries the reasoning, so the next person adding a list argues with the reason
rather than rediscovering this.

Still newly in force — worth a decision

model: sonnet was dropped by the same parse failure, so it is now actually applying:
coordinators run on Sonnet where they previously inherited the session model. That is
what the file asks for and it is a deliberate cost choice, but it shipped unexamined
alongside the tools change. Not touched here; flagging it.

Verification

• 340 tests pass (up from 339).
• claude plugin validate . passes plain and --strict; frontmatter parses, so
  description and model load rather than being silently dropped.
• Same fix applied to the development checkout, which is what the failing run loaded via
  --plugin-dir.

🤖 Generated with Claude Code