Spec: nisse-review (Part R) before nisse-ops

A review agent comes second: it reads every ready PR in the repositories
it can see and discusses its points on the PR, never changing code.

- Architecture Part R: duty and items (R1), rounds capped and reset by
  anyone else commenting (R2), read-only reach bound to the item's
  repository, no approvals, no build VM for now (R3), peers (R4), local
  model with ask_expert, no Matrix room for now, own identity (R5).
- D5 and L11: a peer's review is constructive criticism, answered point by
  point; never an instruction, approval or go-ahead; nisse-dev doesn't
  wait for it before asking to merge.
- Part Q: letting nisse-review approve a limited subset of PRs.
- Development Plan: Phase 7 is nisse-core and nisse-review (M7.2-M7.6);
  nisse-ops moves to Phase 8 (M8.1-M8.5), with the MCP decisions so far.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

docs/Development-Plan.md

@@ -435,7 +435,7 @@ past the usual fixes (D3).
 - `loop.qnt` gained the block (`blocked_vm_runs_nothing`); it found that work in
   progress was lost on a reimage, hence parking first. The walk requests
   reimages and recovers them, reimaged or not.
-- Later, nisse-ops reimages a VM itself (M6.2, M7.6); a changed address means
+- Later, nisse-ops reimages a VM itself (M6.2, M8.5); a changed address means
   editing `build_host` and restarting.
 
 **M4.4** *(#137, with the operator).* **Done** (this PR). A VM that can't be
@@ -525,7 +525,7 @@ notes are written and read (L6.4).
   corrected; don't remember what it already holds.
 - Decided with the operator: `ARCHITECTURE.md` isn't put into every item's
   context (its size); the driver still reads it as told. The infrastructure
-  world model waits for `nisse-ops` (Phase 7).
+  world model waits for `nisse-ops` (Phase 8).
 - The walk writes project notes and checks they come only from that project's
   items.
 
@@ -553,7 +553,11 @@ LLDAP principal (L12).
 
 **M6.5 The browser tool.** *Pre-approved.* On the internal test network (D7).
 
-### Phase 7 — `nisse-core` and `nisse-ops`
+### Phase 7 — `nisse-core` and `nisse-review`
+
+`nisse-review` (Part R) comes before `nisse-ops`: it writes only comments, so it
+needs none of ops' machinery or infrastructure, while being a real second user of
+the loop. Decided with the operator, 2026-10-13.
 
 **M7.1 Extract `nisse-core`.** *Done.* What isn't the dev agent's moved to
 `nisse-core`, unchanged in behaviour, with its tests: the transcript and its
@@ -569,16 +573,39 @@ says so).
   `nisse_dev.state.StateStore` adds the build VM blocks (D3); stores already at
   version 5 open unchanged.
 - The vault names whose writes it records (`agent`), rather than assuming one.
-- Deferred until `nisse-ops` has a loop to share: splitting the loop (`loop/*`)
-  and configuration into a common part and the dev agent's. The dev agent's
-  `git`, delegation, `ask_expert`, executor tools and evaluation capture stay
-  in `nisse-dev`.
+- Deferred until a second agent has a loop to share: splitting the loop
+  (`loop/*`) and configuration into a common part and the dev agent's. The dev
+  agent's `git`, delegation, `ask_expert`, executor tools and evaluation capture
+  stay in `nisse-dev`.
 
-**M7.2 MCP servers** (#37). **M7.3 Approved step
-sequences** (O2). **M7.4 Ops intake and duties** from the infrastructure
-repository (O5). **M7.5 The ops tool VM and deployment** (O6). **M7.6 Requests
-between agents:** `nisse-dev` asking for build VMs (L1, O5). All *needs discussion*
-except M7.1.
+**M7.2 Share the loop.** *Needs discussion.* What of `nisse_dev.loop` and
+`config` is any agent's moves to `nisse-core`, shaped by what `nisse-review`
+needs; `nisse-dev` runs on it unchanged.
+
+**M7.3 `nisse-review`'s first slice.** *Needs discussion.* The duty and a work item
+per ready PR (R1), read-only tools bound to the item's repository (R3), a first
+review posted on the PR; bring-up on this box, and an end-to-end test against a
+PR in a test repository.
+
+**M7.4 `nisse-dev` answers a peer.** *Pre-approved.* Peer comments labelled as a
+peer's, answered point by point with a change or a reason (D5, R4).
+
+**M7.5 Discussion and rounds.** *Pre-approved.* Later reviews of what changed and
+of earlier points, replies on threads, the round cap and its reset, `stop` and
+`review` on a PR (R1, R2, R5).
+
+**M7.6 Deployment.** *Waits for the agent host (Phase 6).* Its image, container,
+Gitea account and secrets (R5).
+
+### Phase 8 — `nisse-ops`
+
+**M8.1 MCP servers** (#37). Settled so far: redaction scrubs each instance's own
+credentials (L12), with masking what an API returns as #144; search-then-dispatch
+meta-tools are avoided, not ruled out (X3). **M8.2 Approved step sequences** (O2).
+**M8.3 Ops intake and duties** from the infrastructure repository (O5), taking over
+the Terraform the operator is writing now. **M8.4 The ops tool VM and deployment**
+(O6). **M8.5 Requests between agents:** `nisse-dev` asking for build VMs (L1, O5).
+All *needs discussion*.
 
 ### Not yet scheduled
 
@@ -598,7 +625,7 @@ vision; one local model for every agent; several forges (#26); a room per projec
 | #27 per-project state, clone on use | M1.3 (clone on the build VM), M1.4 (projects) |
 | #28 room per project | Not yet scheduled (threads, M2.3, may make it unnecessary) |
 | #29 create a project from scratch | M2.5 (ownership settled by D4, D8) |
-| #37 MCP servers | M7.2 |
+| #37 MCP servers | M8.1 |
 | #42 per-turn commentary | M2.7 |
 | #62 branch at execution start | M2.1 |
 | #65 agent merges approved PRs | M3.3 |
@@ -606,6 +633,7 @@ vision; one local model for every agent; several forges (#26); a room per projec
 | #70 watch stall | M2.1 |
 | #77 conversational agent | M2.3 (questions), M2.7 |
 | #137 block on an unreachable build VM | M4.4 |
+| #144 redact secrets an MCP server returns | After M8.1 |
 
 ## 6. Implementation notes