fix(coding-agents): identify safe MCP knowledge reads

[altaywtf]

Codex Auto-review can now distinguish safe Hindsight knowledge reads from writes. Previously, the coding-agent MCP registered bare tools, so clients treated every call as unverified external access.

• Fix: attach explicit read-only, destructive, idempotent, and open-world hints to every ToolSpec and pass them through tools/list.
• Writes: hindsight_capture_initiative and hindsight_ingest_document remain additive, non-idempotent writes. Clients must still approve them.
• Guard: assert the exact tools/list metadata for all 8 tools, so no tool can inherit unsafe protocol defaults.
• Precedent: match the native MCP behavior from feat(mcp): add ToolAnnotations (read-only/destructive hints) to MCP tools #2243. hindsight_reflect is read-only because it does not persist.

Class	Tools	MCP annotations
Read-only	sync status, diagnostics, knowledge search/list/read, reflect	readOnlyHint=true, destructiveHint=false, idempotentHint=true, openWorldHint=false
Additive write	capture initiative, ingest document	readOnlyHint=false, destructiveHint=false, idempotentHint=false, openWorldHint=false

[strix-security]

Strix Security Review

No security issues found.

_{Updated for 9612e71.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.