[knihit]

Description

Stack: 4 of 12 in the orchestration stack. Base: feat/specialists-return-routing (#123). Depends on #114, the memory PR and #123. #123 tells specialists not to spawn; this PR removes the tools that let them. The Kiro CLI v2 half lands at the top of the stack (feat/strip-spawn-v2-specialists).

On GPT models under Kiro CLI v3, specialists re-delegate to orchestrators and cascade to the depth limit. A prompt rule alone does not hold for every model, so specialist configs now carry no agent-spawning tool. Orchestrator output is unchanged.

Agents:

• k-architect, k-developer, k-media-analyzer, k-product-manager, k-quality-assurance, k-researcher, k-tpm: dropped the subagent tool, toolsSettings.subagent and the Claude Code Agent(...) grants. k-architect also drops dependencies.subagents.

CLI:

• synth/model.rs: is_specialist(name), true for k-* names.
• synth/kiro_cli_v3.rs: for specialists, drop subagent tags and subagent permission rules, and emit excludedTools: ["invoke_sub_agent", "run_workflow"]. A subagent deny rule alone does not block: @builtin also carries run_workflow, which accepts agent://<name> and starts any agent, and no permission rule gates it. excludedTools held under --trust-all-tools. The field is skipped when empty, so orchestrator files serialize as before.
• synth/claude.rs: for specialists, filter Agent, Task and Workflow (bare or scoped) out of tools. A specialist with no tools list gets them as disallowedTools.
• synth/parse_canonical.rs: synth warns for each k-* spec that grants a spawn tool (Kiro subagent tag or alias, toolsSettings.subagent, Claude Agent/Task/Workflow), so a spec and its output cannot disagree silently.

SOPs:

• agent-sops/k-code-review-workflow.sop.md step 6: returns the adversarial pass as a handoff for k-architect instead of skipping it. The handoff carries the review's parameters, the PR URL, the resolved base branch, the Step 1 diff, the Step 2 file counts and the Step 5 list; a run resumed at step 6 merges k-architect's findings and continues to Step 7.

Docs / Other:

• docs/user-guide/agents.md: delegation section and table rewritten. Only orchestrators spawn, and the section says how each runtime enforces it. Matching spawn and step 6 facts in concepts.md, faq.md, glossary.md, sop-workflows/code-review.md, use-cases/plan-and-verify-work.md and use-cases/review-code-and-tests.md; a standalone adversarial pass is routed through konductor.
• CHANGELOG.md: one [Unreleased] bullet. No VERSION change.

Type of Change

• New or updated agent spec
• New or updated agent SOP
• CLI (cli/) change: Rust
• Documentation

Testing

• npm test: not run on the final head (no JS changed). On an earlier head, 119 of 136 passed; the same 17 fail on unmodified main (missing generated scripts/brand-config/lib/constants.js).
• cd cli && make test passes
• Gate on this branch's head, and on the top of the stack (feat/strip-spawn-v2-specialists, which contains it): make build && make synth, cd cli && make test (1,873 Rust tests on the top, 0 failed), make test-skills-sh, uvx --with pyyaml pytest -q tests/ (281 passed, 1 skipped on the top), make claude-plugin-check. All pass.
• Smoke tested: installed into a scratch project with konductor install --from <tree> and ran headless spawn attempts (see Runtime check)
• npm run benchmark: not run. A 72-run A/B was run instead; see Benchmark.
• Changed code files carry the required SPDX header (no new code files)

New tests: render_agent_file_strips_spawn_grants_from_specialist and render_agent_file_keeps_spawn_grants_for_orchestrator (kiro_cli_v3.rs); render_agent_md_strips_spawn_tools_from_specialist, render_agent_md_denies_spawn_tools_for_specialist_without_tools_list and render_agent_md_keeps_spawn_tools_for_orchestrator (claude.rs); is_specialist_matches_k_prefix_only (model.rs); installed_specialists_cannot_spawn_but_orchestrator_can (tests/synth_install_e2e.rs, hermetic, --from a local tree, --no-telemetry); test_specialists_hold_no_spawn_grant, which rejects every spawn alias (subagent, use_subagent, agent_crew, *, bare Agent, Task, Workflow and Agent(...)) in kiroCli.tools, kiroCli.allowedTools, toolsSettings and claudeCli.tools.

Orchestrator check: dist/ output for the three orchestrators on Kiro CLI v3, Kiro CLI v2 and Claude Code is byte-identical to a synth of the parent commit built with its own binary.

Runtime check

Each variant was installed into a scratch project and asked to spawn an agent that writes a file. Blocked means no file and no successful spawn call.

Runtime	Config	Blocked
Kiro CLI v3	as on main (scoped subagent allow)	no, under --trust-all-tools a specialist spawned konductor, which spawned k-developer
Kiro CLI v3	subagent tag dropped, or a subagent deny rule	no, the model used run_workflow with agent://k-developer
Kiro CLI v3	adds a workflow deny rule	no, run_workflow is not gated by it
Kiro CLI v3	excludedTools: [invoke_sub_agent, run_workflow] (this PR)	yes, also under --trust-all-tools
Claude Code	as on main (Agent(k-developer, k-quality-assurance))	no for listed names, yes for others
Claude Code	Agent(...) removed from tools (this PR)	yes, also under --dangerously-skip-permissions and when nested under konductor

Benchmark

Setup: main vs this branch (with #123), three cells (a GPT model on Kiro CLI v3, a Claude Sonnet model on Kiro CLI v3, a Claude Sonnet model on Claude Code), 4 cases, 3 reps each, fresh isolated project and HOME per run. 72 runs.

cell		n	spawns/run	spec to spec	depth-limit rejections	cost/run	wall s/run	success
GPT, Kiro CLI v3	main	12	7.9	30	6	59.2 credits	478	9/12
GPT, Kiro CLI v3	branch	12	3.2	0	0	30.5 credits	253	9/12
Claude Sonnet, Kiro CLI v3	main	12	1.9	0	0	5.2 credits	122	10/12
Claude Sonnet, Kiro CLI v3	branch	12	2.0	0	0	5.0 credits	120	8/12
Claude Sonnet, Claude Code	main	12	1.8	0	0	$0.87	105	11/12
Claude Sonnet, Claude Code	branch	12	1.9	0	0	$0.93	114	11/12

On the GPT cell, spawns, credits and wall time roughly halved with task success unchanged; most of the gap is the design plus threat model case (18.7 vs 3.3 spawns per run, 128.6 vs 37.6 credits). The Claude cells did not change. The Claude on Kiro CLI v3 drop on the implement, document and review case was re-run 5 more reps per side (main 2/5, branch 5/5) and reads as variance. n=3 per case. The step 6 handoff and the synth warning came after the bench.

Checklist

• My code follows the style guidelines of this project (see AGENTS.md's Code Style & Conventions)
• I have performed a self-review of my own changes
• I have commented my code where necessary
• I have made corresponding changes to the documentation
• My changes generate no new warnings: build is clean, and cd cli && make lint passes
• I have added or updated tests that prove my change works (see Testing above)

Agents Affected

Orchestrator output is unchanged; only specialist configs change.

• k-developer
• k-architect
• k-researcher
• k-product-manager
• k-quality-assurance
• k-tpm
• k-browser (synth only; its spec had no spawn grant, but Kiro CLI v3 output now excludes run_workflow)
• k-media-analyzer

Notes for Reviewers

• Review: adversarial review in rounds until 0 CRITICAL and 0 IMPORTANT findings remained (5 rounds). The IMPORTANT findings were both about code review step 6: the docs said it runs under konductor while the SOP told k-developer to skip it, and then the handoff did not say how the resumed run finishes. Both are fixed in the SOP. Every finding has a fix commit or a written reason.
• Kiro CLI v2 gets the spec change here; its synth strip is feat/strip-spawn-v2-specialists at the top of this stack.
• Merging main (fix(claude): write Claude Code model IDs and ship NOTICE.txt in the plugin #105) into this stack conflicted in claude.rs; both sides were kept (SPAWN_TOOLS and is_spawn_tool next to the model ID helpers, and model next to tools in the render call).
• Not covered: a specialist shelling out to kiro-cli chat or claude -p through its shell tool.