OMP Role Tool Configuration

When using spawn_subagent (single or batch mode) to dispatch sub-agents, set the corresponding allowed_tools and skills parameters based on the sub-agent's role.

Canonical source of truth in code: plugins/bundle/omp_workflows/shared/constants.py (ROLE_ALLOWED_TOOLS, ROLE_SKILLS, TOOL_* names) and shared/role_prompts.py (ROLE_PROMPTS, build_worker_prompt, format_spawn_call). Tool strings must match registered ToolRegistry names — do not invent aliases.

Role Definitions

executor (Code Executor)

• allowed_tools: null (inherits all tools)
• skills: null (inherits all skills)
• Boundary: Implement features, run quality checks. Follow existing patterns.

architect (System Architect)

• allowed_tools: ["read_file", "grep_search", "glob_search", "write_file", "ast_search", "execute_shell_command"]
• skills: []
• Boundary: Design interfaces and module boundaries, diagnose complex issues. No implementation code.

analyst (Requirements Analyst)

• allowed_tools: ["read_file", "grep_search", "glob_search", "write_file", "execute_shell_command"]
• skills: []
• Boundary: Extract requirements, identify constraints, define acceptance criteria. No code.

critic (Plan/Design Critic)

• allowed_tools: ["read_file", "grep_search", "glob_search", "ast_search"]
• skills: []
• Boundary: Review plans and designs, challenge assumptions. No plans, no code.

security-reviewer (Security Reviewer)

• allowed_tools: ["read_file", "grep_search", "glob_search", "execute_shell_command", "ast_search"]
• skills: []
• Boundary: Identify vulnerabilities, injection vectors, auth weaknesses. No file modifications.

code-reviewer (Code Reviewer)

• allowed_tools: ["read_file", "grep_search", "glob_search", "execute_shell_command", "ast_search"]
• skills: []
• Boundary: Review code quality, maintainability, convention adherence. No file modifications.

qa-tester (QA Tester)

• allowed_tools: ["read_file", "grep_search", "glob_search", "execute_shell_command"]
• skills: []
• Boundary: Interactive CLI/service testing — start services and verify behavior.

planner (Strategic Planner)

• allowed_tools: ["read_file", "grep_search", "glob_search", "write_file", "ast_search"]
• skills: []
• Boundary: Create implementation plans, define task breakdown and dependencies. No implementation code.

explore (Code Explorer)

• allowed_tools: ["read_file", "grep_search", "glob_search", "ast_search"]
• skills: []
• Boundary: Read-only exploration. Map codebase structure and dependencies.

debugger (Debugging Expert)

• allowed_tools: null (inherits all tools)
• skills: []
• Boundary: Root cause analysis, fix build/test failures. No new features.

verifier (Adversarial Verifier)

• allowed_tools: ["read_file", "grep_search", "glob_search", "execute_shell_command", "ast_search"]
• skills: []
• Boundary: Verification only — no file modifications. Physical isolation via read-only tool set.

Usage

spawn_subagent(
    task="<role identity from ROLE_PROMPTS>\n\n## Task\n<task description>",
    allowed_tools=<ROLE_ALLOWED_TOOLS[role] or omit if null>,
    skills=<ROLE_SKILLS[role] or omit if null>,
    fork=True,         # if worktree isolation needed
    background=True,   # if background execution needed
)

When allowed_tools or skills is null, omit the parameter (uses default None). For batch mode, pass task="" and put per-item role config in each batch dict.