Readonly_Optional ReadonlybodyThe lead/intro prose of the system prompt (the "You are…" opener), before any
sections. Carries verified file()/cmd()/symbol()/ref() marks. No
markdown headers — use sections for those.
Optional ReadonlycolorSubagent UI colour (Claude Code frontmatter, e.g. "pink", "blue"). Optional.
ReadonlydescriptionWhen to dispatch this subagent — the trigger (frontmatter).
Optional ReadonlydisallowedThe DENY-side contract — tools the worker may NOT use. Use this INSTEAD OF
tools, not with it: tools is an allowlist (only these), so a tool not
listed is already unavailable and a disallowedTools entry would be
redundant. disallowedTools earns its place only when there's NO allowlist
(the agent inherits ALL tools) and you want to subtract a few — e.g.
disallowedTools: ["Bash"] on an otherwise-unrestricted worker. Rendered to
the disallowedTools: frontmatter; close-typos are flagged (a typo'd entry
blocks nothing). For a read-only floor prefer a tight tools list + purity.
Optional ReadonlymodelModel alias (e.g. "sonnet", "opus", "haiku", "inherit"). Optional.
ReadonlynameSubagent name (frontmatter + dispatch handle).
Optional ReadonlyoutputThe typed result contract — what this worker returns on success/error. When
set, compiles to an ## Output contract section instructing the worker to
end with a vigiles:ok / vigiles:err block, so its outcome is parseable
and testable (see result(), parseAgentResult, assertAgentOk).
Optional ReadonlypurityDeclare this agent's purity floor — compile rejects a tool contract looser
than it. "pure" allows only read-only tools; "bounded" also allows
decidable side-effecting tools (Write, Edit, …) but bars Bash /
unknown-effect / inherits-all; "dangerously-unrestricted" (or omitting it)
enforces nothing. "pure"/"bounded" require an explicit tools list — a
wildcard or absent-tools (inherits-all) is always a violation.
Optional ReadonlyrulesRules the worker must follow — rendered as a ## Rules section.
Optional ReadonlysectionsNamed ## sections of the system prompt (e.g. Purpose, Core Principles,
Capabilities) — the shape real subagents actually take. Same verified-ref +
no-nested-## rules as a CLAUDE.md spec's sections. Use body for the intro
and sections for the structured rest.
Optional ReadonlytoolsThe allowed-tools contract — the rails the worker runs on. Each entry must be
a known built-in tool (Read/Write/Edit/Bash/Grep/Glob/WebSearch/WebFetch/
NotebookEdit/TodoWrite/Task/Skill) or an MCP tool (mcp__server__tool).
Omit to inherit all tools. Verified at compile time.
A subagent definition (compiles to
agents/<name>.md). Unlike a skill — reference material the model reads on activation — a subagent is a delegated worker with a contract: a dispatchdescription, an allowed-toolsrail, an optionalmodel, a system-promptbody, and therulesit must follow. That tool contract + those rules are the "railway" a subagent runs on, and they're exactly the compile-time-verifiable surface vigiles owns: the body'sfile()/cmd()/symbol()marks are checked like any instruction file, and the tools list is verified against the real tool set.