Ship neutral MULTI-BOT roles, starters and read-only selection

[lukisch]

MULTI-BOT now ships as neutral Core package resources: Windows/POSIX starters, a German policy and the existing care/probe helpers. The visible menu is 1 operator (default), 2 bot-triage and 3 github-maintain. Operator checks fresh PR work before each new unit, then fixes, then evidenced policy/care alternation; urgent policy work precedes routine care. The named legacy modes triage, review-merge and aftercare keep their restricted scopes.

The new multi-bot-select --input SNAPSHOT.json reads caller-supplied exact-revision candidates and completion evidence without persisting, enqueueing or executing work. Blocked/done revisions do not repeatedly preempt other work; idle checks do not advance maintenance history. The caller remains responsible for fresh snapshots and verifying the referenced evidence.

All six modes export the existing strict seven-field system-agent descriptor, bound to the actual packaged policy bytes and canonical blueprint hash. The original system-agent template remains unchanged. TASKPLAN remains optional; missing launcher support fails closed. Instance roots, accounts, permissions and authentication stay explicit, with merge disabled by default. Windows starters run in the foreground and pause on completion/error unless dry-run or no-pause is explicit.

Validation at b42a5ee: 179 tests passed, including separate fresh wheel and sdist consumers, six installed descriptors and policy-byte hashes, the read-only selector, native cmd.exe pause/exit behavior and the actual installed BAT. Ruff lint/format and diff checks passed; both archives contain all 33 frozen package files and no lock/instance files. No provider/model, productive loop, installation activation, merge or release was performed.

[ellmos-multi-bot]

MULTI-BOT review (ellmos-multi-bot): changes requested at head b42a5ee8c648aa544c766080054a8015081c6bbc

• Model: Claude Opus 5.5, separate session from the author (commit trailers: Codex GPT-6 Sol; independence level: instance).
• Read in full: the diffs of cli.py and pyproject.toml; .gitattributes; multibot.py, multibot_select.py, multibot_care.py, multibot_probe.py; multibot.example.json; the four starters; tests/test_multibot_windows.py. Partly read: multibot_roles.json (meta and the mode/id list only), tests/test_multibot_resources.py (the failing tests). Not read: prompts/MULTI-BOT.de.md at this head (line by line), README/README_de/CHANGELOG, tests/test_multibot_selector.py, tests/test_consumer_install.py.
• Tests (isolated checkout at this head, Windows, Python 3.12): ruff check . → all checks passed. pytest -q → 170 passed, 7 failed, 2 skipped. CI (test (3.10), test (3.12)) is green, but runs only on ubuntu-latest, so the os.name == "nt" tests are skipped there.

Findings

1. (P2) src/githubbot_core/multibot_care.py:38-53, targets(), does not apply exclude_writes, global_exclude_writes or exclude from orgs.json. claim() (line 171) accepts any target from that list. Against a real instance configuration, overview lists four repos that the configuration excludes via exclude_writes. next currently returns an owner/.github repo, although .github is in global_exclude_writes. The role prompt says excluded targets are skipped, but the selector offers them anyway, and only the prompt and project locks stand in the way. Suggestion: filter them in targets() and add a regression test.
2. (P3) tests/test_multibot_windows.py:16-20: the stub githubbot_core has only __main__.py and no __init__.py. That makes it a namespace package, and the installed real githubbot_core takes precedence over it even though PYTHONPATH puts the stub first. With the package installed (as pip install -e does in CI), all 5 tests fail on Windows. After adding an empty __init__.py, the 3 test_explicit_dry_or_no_pause_skips_wait cases pass. The 2 wait_for_key cases still fail on this host; I did not determine why. These tests do not run in CI at all; a Windows job would make them effective.
3. (P3) .gitattributes: prompts/*.md is not pinned to LF. With core.autocrlf=true, the packaged policy contains CRLF, so the policy SHA256 differs from Linux builds, and test_launched_persona_is_exactly_the_hashed_descriptor fails (read_text normalises line endings). With src/githubbot_core/prompts/*.md text eol=lf and a fresh checkout, the test passes. multibot_roles.json is worth the same treatment.
4. (Nit) tests/test_multibot_resources.py:55-78: the test fails when MULTIBOT_INSTANCE_PROMPT is set, because multibot.py (--instance-prompt default from the environment) prefers it over multi_bot.instance_prompt. Use monkeypatch.delenv.

No issues found in multibot_select.py (exact 40-hex binding, duplicate/unknown-field rejection, alternation only from evidenced done maintenance) or multibot_probe.py (stderr suppression, 1000-limit flag).

Merge: HOLD, because of finding 1. The bot's permission contract does not include a merge action in any case.