P2-1: Update opencode.json — deny question for pure subagents

[Cho-Geer]

Parent Epic

#138 — Sub-Agent Question Propagation Fix

Phase 2 — Option C: Permission Tightening

Task

Update opencode.json to set question: "deny" for agents with mode: "subagent".

Design (from §6 Option C)

• Set question: "deny" for agents with mode: "subagent" after Phase 0 is in place.
• Keep question: "allow" for Orchestrator.
• Keep Super-Admin as allow (Phase 0 instruction update + Phase 1 runtime guard handle the dispatched-super-admin case).

Rationale

• Official permissions support question as allow/ask/deny only.
• Because question is non-granular, permission-only control is too blunt for Super-Admin mode all.
• Permission tightening should not be the only mitigation — combines with Phase 0 + Phase 1.

Affected Agents (mode: subagent)

• Meta-Planner
• Architect
• Coder-BE
• Coder-FE
• Guardian
• Arbiter
• CI-CD-Agent
• Knowledge-Curator

Not Affected

• Orchestrator (primary) — stays allow
• Super-Admin (mode: all) — stays allow (guarded by Phase 1 plugin)

Reference

docs/review/framework-refactor/sub-agent-question-propagation-issue.md §6 Option C

[Cho-Geer]

✅ Completed — opencode.json updated.

8 subagents changed from question: "allow" to question: "deny":

• Meta-Planner, Architect, Coder-BE, Coder-FE, Guardian, Arbiter, CI-CD-Agent, Knowledge-Curator

Preserved question: "allow": Orchestrator, Super-Admin