# .grok/roles/reviewer.toml — a reviewer that cannot edit what it judges.
#
# Two things make this worth copying. `default_capability_mode = "read-only"`
# is a capability, not an instruction: the role has no write or execute tool,
# so it cannot "fix" what it finds or widen its own access. And the model is
# pinned, so judgement is spent here and nowhere else.
#
# Spawn it from a session ("when you are done, have the reviewer check the
# diff in a fresh context") or name it as a subagent_type.

[subagents.roles.reviewer]
description = "Read-only reviewer: correctness, security and stated requirements only"
default_capability_mode = "read-only"
model = "grok-4.6"
prompt_file = ".grok/prompts/reviewer.md"

# Keep write-capable MCP tools (ticket systems, deploy hooks) away from a
# reviewer that has no business calling them.
mcpInheritance = "none"