feat(mcp): add custom comment minimize tool (#45)

* feat(mcp): add custom comment minimize tool

* fix(mcp): harden custom review tool boundaries

* fix(mcp): enforce local write tool gate

* fix(mcp): normalize bot identity in minimize ownership check, make GraphQL testable

The ownership gate compared GraphQL viewer.login to the comment
author.login with strict equality. Empirically (verified against
api.github.com with a real installation token): viewer for an App
installation token is '<app-slug>[bot]' while Bot-authored comments
carry the bare '<app-slug>' author login — the check could never
pass for the App's own comments, i.e. the only comments the tool is
allowed to minimize. The feature was unusable and untested because
the GraphQL endpoint was a hard-coded const.

- normalize_actor() strips the '[bot]' suffix on both sides of the
  comparison
- execute_graphql/handle_minimize_comment take the GraphQL URL as a
  parameter (production callsite passes the api.github.com const)
- handler-level tests against a mock GraphQL server:
  - App-bot-authored comment succeeds (viewer 'oab-ghpool[bot]' vs
    author 'oab-ghpool' — the exact live API shape), mutation payload
    asserted
  - human-authored comment refused, zero mutations
  - node in a different repository than the policy-checked owner/repo
    refused (403), zero mutations
  - GraphQL soft errors (HTTP 200 + errors[]) fail closed; unknown
    classifier rejected before any network call
- drop the contradictory required+default classifier in the tool
  schema (classifier is required)

Tests: ghpool 112 passed, clippy -D warnings clean.

---------

Co-authored-by: chaodu-agent <chaodu-agent@users.noreply.github.com>

Author: chaodu-agent

README.md

@@ -361,7 +361,7 @@ path = "/var/lib/ghpool/mcp-audit.jsonl"
 [[mcp.agents]]                # writes are only for authenticated agents
 id = "openab-bot"
 key = "aws:secretsmanager:ghpool/mcp-keys:openab"
-tools = ["issue_read", "create_issue", "add_issue_comment"]
+tools = ["issue_read", "create_issue", "add_issue_comment", "ghpool_review_minimize_comment"]
 repos = ["openabdev/ghpool", "openabdev/openab"]
 ```
 
@@ -378,10 +378,28 @@ Required GitHub App permissions (grant only what your agents' tools need):
 | Tools | App permission |
 |-------|----------------|
 | `issue_read`, `list_issues`, `create_issue`, `add_issue_comment` | Issues: read / write |
+| `ghpool_review_minimize_comment` | Issues: write and Pull requests: write |
 | `pull_request_read`, `create_pull_request`, `merge_pull_request` | Pull requests: read / write |
 | `get_file_contents`, `create_or_update_file`, `push_files` | Contents: read / write |
 | `list_workflows`, `run_workflow` | Actions: read / write |
 
+
+#### ghpool-owned review tools (issue #44 MVP)
+
+When writes are enabled and an authenticated agent explicitly includes the tool in its allowlist, `tools/list` also advertises it. For example:
+
+```toml
+[[mcp.agents]]
+id = "review-bot"
+key = "env:GHPOOL_REVIEW_KEY"
+tools = ["issue_read", "list_issues", "ghpool_review_minimize_comment"]
+repos = ["openabdev/ghpool"]
+```
+
+The tool accepts `owner`, `repo`, `node_id`, and a `classifier` (`ABUSE`, `DUPLICATE`, `OFF_TOPIC`, `OUTDATED`, `RESOLVED`, or `SPAM`). It supports issue and pull-request comments authored by the current GitHub App bot identity; it does not minimize human-authored comments or unsupported node types. Before mutating, it verifies both the App-bot author and the exact repository owner/name against the policy arguments, then executes GitHub's `minimizeComment` GraphQL mutation locally through ghpool's scoped GitHub App credential. The operation is not forwarded to the upstream MCP server. The call uses the same repository policy, write gate, in-flight limit, and fail-closed audit as upstream write tools. Agents that do not explicitly allowlist the name, or that have writes disabled, neither see it in `tools/list` nor can call it.
+
+This is intentionally a narrow MVP: ghpool does not expose arbitrary GraphQL, and upstream GitHub MCP tools remain unchanged. Any future ghpool-owned tool must preserve the same explicit allowlist, repository binding, write gate, and audit requirements.
+
 The tool surface returned by `tools/list` shrinks to match the App's actual permissions (verified in the [#22 spike](https://github.com/openabdev/ghpool/issues/22)) — grant conservatively and expand as agents need more.
 
 #### Multi-installation routing (one key, many orgs)

docs/DESIGN.md

@@ -24,10 +24,11 @@ against GitHub directly.
 ghpool is a **credential-swapping reverse proxy with a default-deny policy
 engine**, sitting between agents and two GitHub surfaces:
 
-- **MCP** (`/mcp`) → GitHub's hosted MCP server (`api.githubcopilot.com/mcp/`).
-  ghpool proxies the official tool schemas verbatim — it defines no tools of
-  its own (the Revision 1→2 pivot). Zero schema maintenance; new upstream
-  tools appear automatically but are **denied by default** until granted.
+- **MCP** (`/mcp`) -> GitHub's hosted MCP server (`api.githubcopilot.com/mcp/`), with a
+  narrowly scoped ghpool-owned review-tool exception. Upstream schemas remain
+  proxied verbatim; `ghpool_*` tools are explicit, default-deny, App-backed,
+  repository-bound, and fail-closed audited. ghpool does not expose arbitrary
+  GraphQL or a general custom-tool registry.
 - **REST/GraphQL** (`/{path}`, `/graphql`) → `api.github.com`, with PAT
   pooling (budget-aware selection) and in-memory read caching. GraphQL
   mutations pass through with the client's own token (full attribution).
@@ -149,3 +150,4 @@ caller.
 | Buffer + parse write responses | #17 review | `isError` inside HTTP 200; audit must record tool outcome |
 | Scoped installation tokens per policy envelope | #17 review | GitHub enforces the repo boundary, not just our parser |
 | Writes: App + audit + agents required in code | #17 review | Hard rules, not documented hopes |
+| `ghpool_*` review tools as a narrow MCP exception | #44 / PR #45 | Fill upstream capability gaps without arbitrary GraphQL; preserve default-deny, repo binding, App credentials, and audit |