Command-scoped reviewer isolation is not transitive

Command-scoped configuration overrides do not automatically isolate recursively launched CLI processes. When a code-review wrapper can re-enter repository instructions and start another native reviewer, either prevent that recursion or explicitly propagate every isolation override to the nested launch. This matters for disabling optional integrations, sandbox settings, and other per-invocation controls; it does not imply that every wrapper will recurse or that child processes never inherit ordinary environment variables.

Evidence/example — 2026-09-10

During a read-only Codex PR review in e3-solutions/theft, the outer codex review was launched with every configured MCP server disabled through -c mcp_servers.<id>.enabled=false. The outer reviewer re-entered the repository review workflow and launched a nested codex review; the nested command did not inherit those CLI configuration overrides. It still completed successfully and returned a clean verdict. Provenance: delegated reviewer execution evidence and the local gitignored review artifact. This corrects the narrower working hypothesis that disabling MCPs on the outer command would necessarily isolate the entire recursive review chain.