[ivanpaghubasan]

Summary

Adds CSDK-115 (subagent scope, severity high, confidence 0.75) and the predicate subagent_inherits_all_tools. A subagent in a .claude/agents/ directory with no tools: key and no disallowedTools: entries inherits all tools available to subagents, per the Claude Code subagents documentation.

SubagentDef gains two in-memory fields (json:"-", so report JSON is unchanged): ToolsOmitted (the tools key is absent; tools: [] and an empty tools: count as declared) and Canonical (found under .claude/agents/). The predicate skips files found by the frontmatter-shape fallback.

Includes unit, policy and scanner tests, the subagent-tools-inherit corpus fixture, and updates to COVERAGE, ARCHITECTURE and schema.yaml.

Schema number is provisional

The schema number is set to 27. Whichever of the open PRs merges later (#261 OBS-009..012, #264 CI-001..005, or this one) merges main in and renumbers in schema_version.go, the fixture manifest.yaml and the rules manifest.yaml, then reruns go test ./... and scripts/check-rules-sync.sh.

Verification

• go test ./...: all packages pass.
• Scan of testdata/corpus/subagent-tools-inherit with the rules branch as the pack: one CSDK-115 finding, on .claude/agents/inheritor.md.
• scripts/check-rules-sync.sh: in sync (133 files compared).

Maintainer notes

• The Agentic Security Baseline rated this Critical. The pack uses high because the predicate is certain about the frontmatter shape but cannot see how wide the inherited pool is, which depends on the main conversation. Explicit Bash grants (CSDK-110) and bypassPermissions with omitted tools (CSDK-103/120) are also high; Critical is used for pre-trust execution and secret egress.
• CSDK-206 and OAI-025 on main reuse IDs from the reverted test(rules): mirror and cover AG2-015 #138. They are different rules now. Reported, not acted on.
• The report cites "Delegation Without Trust" and APC as evidence. Neither is verified, so neither is used in the rule text or the docs.
• Merge order: engine, then rules, then rulebook. The rationale doc follows in a separate PR.