fix: restore allowedTools with posting tools, fix review workflow

.claude/settings.json

@@ -2,20 +2,10 @@
   "permissions": {
     "allow": [
       "Read",
-      "Write",
-      "Edit",
-      "MultiEdit",
       "Grep",
       "Glob",
-      "MultiGrep",
       "Bash(git diff:*)",
-      "Bash(git log:*)",
-      "Bash(cat:*)",
-      "Bash(find:*)",
-      "Bash(ls:*)",
-      "Bash(head:*)",
-      "Bash(tail:*)",
-      "Bash(wc:*)"
+      "Bash(git log:*)"
     ],
     "deny": []
   }

.github/workflows/claude-review.yml

@@ -2,9 +2,8 @@ name: Claude PR Review
 
 on:
   pull_request:
-    types: [opened, ready_for_review, synchronize]
+    types: [opened, ready_for_review]
 
-# Cancel a superseded review when new commits are pushed — cost control.
 concurrency:
   group: claude-review-${{ github.event.pull_request.number }}
   cancel-in-progress: true
@@ -16,8 +15,7 @@ permissions:
   id-token: write
 
 jobs:
-  # ---------- Gate: run CI checks first so Claude doesn't waste tokens ----------
-  # Skips gracefully if package.json doesn't exist yet (spec-only PRs).
+  # ---------- CI gate: unchanged behavior, runs in parallel with review ----------
   ci:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
@@ -60,54 +58,67 @@ jobs:
       - run: npm run build
         if: steps.check.outputs.has_project == 'true'
 
-  # ---------- Claude review: only runs if CI passes ----------
+  # ---------- Claude review: parallel with CI, posts via gh + inline comments ----------
   review:
-    needs: ci
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          fetch-depth: 1
 
       - uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          track_progress: true
           prompt: |
-            Review pull request #${{ github.event.pull_request.number }} in
-            ${{ github.repository }} as a rigorous senior reviewer. Post your
-            review as a PR comment, with file-anchored comments for specific
-            issues. End with a clear verdict: approve, approve-with-nits, or
-            request-changes, and list blocking items separately from nits.
-
-            Project context: this repo is a visual page builder for Nuxt,
-            built task-by-task from specs. Read .kiro/steering/AI-MAP.md and
-            the relevant files in ".kiro/specs/" and "MD Instructions/" before
-            judging the diff — PRs here are usually either spec documents or
-            implementations of a spec.
-
-            CI (tests, lint, typecheck, build) has ALREADY PASSED in a prior
-            job. Do NOT re-run npm ci, npm test, npm run lint, npm run
-            typecheck, or npm run build. Focus exclusively on code review.
-
-            Review standards for this repo, in priority order:
-
-            1. Spec traceability. If the PR implements a numbered task, check
-               the implementation against that spec's acceptance criteria and
-               flag criteria that are unmet or silently reinterpreted.
-
-            2. Consistency across sources of truth. Flag contradictions
-               between the diff, .kiro/steering/AI-MAP.md, .kiro/specs/, and
-               "MD Instructions/" — including stale version pins and paths.
-
-            3. Registry purity rule: nothing imported by /compiler, its CLI,
-               or /server may transitively import .vue files. Check imports.
-
-            4. Standard review: correctness, types (no `any`), security,
-               and whether tests actually assert what they claim.
-
-            Do not restate the diff or praise padding. Credit genuinely good
-            decisions in one or two lines. Be specific enough that a follow-up
-            commit can address every point without asking questions.
-          claude_args: "--max-turns 20"
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number }}
+
+            Review this pull request as a rigorous senior reviewer. Be
+            efficient: you have a limited turn budget, so read only what
+            you need and post as you go.
+
+            HOW TO POST — required, not optional:
+            - Post file-anchored issues with the
+              mcp__github_inline_comment__create_inline_comment tool,
+              passing confirmed: true, AS YOU FIND THEM — do not save
+              them all for the end.
+            - Post ONE top-level summary with `gh pr comment` as your
+              final action: verdict (approve / approve-with-nits /
+              request-changes), blocking items, then nits.
+            - Review text not posted to GitHub does not exist.
+
+            WHAT TO READ — in this order, nothing more unless the diff
+            demands it:
+            1. `gh pr diff` — the change itself.
+            2. .kiro/steering/AI-MAP.md — conventions and Decisions Log
+               (settled; do not relitigate).
+            3. ONLY the spec files in .kiro/specs/ and "MD Instructions/"
+               that this PR implements or modifies, identified from the
+               PR title/branch/diff. Do not read the full spec library.
+
+            Review standards, in priority order:
+            1. Spec traceability — implementation vs. that spec's
+               acceptance criteria; flag unmet or silently reinterpreted
+               criteria.
+            2. Consistency — contradictions between the diff, AI-MAP.md,
+               the relevant spec, and its MD Instruction file, including
+               stale version pins and paths.
+            3. Registry purity — nothing imported by /compiler, its CLI,
+               or /server may transitively import .vue files.
+            4. Correctness, types (no `any`), security, and whether
+               tests assert what they claim.
+
+            CI (lint, typecheck, tests, build) runs in a parallel job —
+            do NOT run npm commands. Check CI status with
+            `gh pr checks` if relevant; if CI is still running, note
+            that your review is code-level only.
+
+            Do not restate the diff or praise padding. Credit genuinely
+            good decisions in one or two lines, inside the summary
+            comment.
+          claude_args: |
+            --max-turns 12
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr checks:*)"

.kiro/steering/AI-MAP.md

@@ -146,3 +146,4 @@ After completing a task:
 | — | @formkit/drag-and-drop spike required | Task 07 requires proving nested named-slot drops work before full wiring. If it can't, fall back to custom pointer-events for canvas, keep library for flat lists. |
 | — | Columns only accepts Column children | `allowedChildren: ['Column']` on Columns entry + `allowedParents: ['Columns']` on Column entry. Both validated by `validateAgainstRegistry` (Task 03). Drop-target guard (Task 07) checks both directions. Column.span is a number prop (min:1, max:4). |
 | — | CLAUDE.md mirrors steering conventions for non-Kiro agents | `CLAUDE.md` at the repo root provides the same project conventions to Claude Code and the GitHub Actions reviewer. When conventions in `.kiro/steering/` change, `CLAUDE.md` must be updated in sync. |
+| — | Claude PR review posts via gh + inline-comment MCP tool | Claude PR review posts via `gh pr comment` + `mcp__github_inline_comment__create_inline_comment`, allowlisted in `claude_args`; automation mode posts nothing without them. `synchronize` trigger removed — reviews run on open/ready only; re-review by pushing after marking ready or via a future manual trigger. Review job runs parallel to CI, does not run npm commands. |