[role]
name = "explorer"
display-name = "explorer + cargo-check (read-only analyst with build probe)"
description = "Read-only analyst that may run cargo-family commands for build/test introspection. No edits, no git, no non-cargo shell."
spawnable = true
claude-subagent-type = "Explore"

[capabilities]
# Layer E — inherits read-only capability set, adds bash-allowlist for cargo probing.
extends = "read-only"
required = ["tools::bash-allowlist"]

[tools]
allowed = ["Read", "Glob", "Grep", "WebFetch", "Bash"]
bash-patterns-allowed = ['^cargo( |$)']

[escalation]
policy = "ask-via-return"