[lukisch]

Summary

• Applies canonical config/orgs.json organization/global exclude_writes to typed formal PR reviews at preview, apply, direct executor, replay, and immediately before the review POST. Exclusions include research-line/fst-nash and .github; missing or invalid required scope policy fails closed.
• Keeps permissions.enabled and publish_reviews as separate gates. The legacy features.pr-review marker is not required.
• Binds a review to an open, non-draft PR at the requested exact head and rejects self-authored PRs. Any existing review by the configured account for that head blocks reposting, including DISMISSED.
• After reading existing reviews, the PR is fetched again and checked for open state, exact head, and non-draft status before the POST; scope is reloaded immediately before the POST. Final readback checks review identity/head/event and PR state/head/draft.
• This narrows the pre-POST race window but is not atomic compare-and-swap: the PR can change after the last pre-POST read and before GitHub receives the write. Final readback can report state drift but cannot undo an already submitted review.

Verification

• Focused fake-transport tests for the implementation head d870af1d4790c463281f87af67f3682814abf949: 57 passed (tests/test_review_write_scope.py, tests/test_typed_actions.py); the probes made no live review or comment call.
• The version-only follow-up 2de60870f887c2b20fe2ccfdc257038786dad26c changes four files: src/githubbot_core/__init__.py, README.md, README_de.md, and CHANGELOG.md. The package version remains dynamically sourced by pyproject.toml from githubbot_core.__version__; no behavior, permissions, policy, or starter logic changed.
• Local checks on this follow-up passed: ruff check ., ruff format --check . (50 files), source import/syntax and dynamic-version consistency, git diff --check, private wheel build, and import/CLI/metadata checks directly from the wheel without installing it. Wheel metadata is 0.2.2; pr.review remains in the default ceiling and disabled by default.
• Private, unpublished wheel githubbot_core-0.2.2-py3-none-any.whl, built from source commit 2de60870f887c2b20fe2ccfdc257038786dad26c: SHA-256 93D9F37B8F7B3A6AB9B8DFBFF70857E8A7B4F5FC449BBA9F8CF63F6E98337C5D. Source archive SHA-256: 7A239421D34BA22EBD253D3E7D75CA8B06683E508F85CB1AB37617824643935A. The wheel was not installed or published.
• Exact-head GitHub Actions run 40135537101: SUCCESS on Python 3.10 and 3.12; unit/contract tests and the isolated fresh-venv consumer check passed.
• Independent code review of implementation head d870af1d4790c463281f87af67f3682814abf949: GO; local receipt SHA-256 FF77B117B7540D01BD09B8A2BE694B6E228E3255FA566067E70423283B9881FC (not a posted GitHub review). The metadata/package follow-up has not yet received its separate review.

Scope and limits

• Base main: 0afab1c48d975d7dc2928a7282b7c9f7ed89f3f6; reviewed implementation parent: d870af1d4790c463281f87af67f3682814abf949; current head: 2de60870f887c2b20fe2ccfdc257038786dad26c.
• PR remains OPEN and Draft. No live GitHub review, merge, v0.2.2 tag, GitHub/PyPI release, runtime installation, hook activation, or rollout is included. Existing v0.2.1 is unchanged. The CI consumer install is only an isolated CI check.

[ellmos-multi-bot]

MULTI-BOT-Prüfung durch GPT-6 (Codex), Head 2de6087.

Vollständigen 13-Dateien-Diff im isolierten Checkout und angrenzende Vorschau-/Apply-/Transportpfade geprüft. Die unveränderte PR-Suite besteht lokal: 238 Tests bestanden, 2 übersprungen; fokussierte Review-/Aktionsprüfungen: 57 bestanden. Ruff und git diff --check bestehen. Beide sichtbaren GitHub-Checks sind am gleichen Head erfolgreich.

Keine Merge- oder Rollout-Empfehlung: Ein zusätzlicher blockierender Befund ist privat dokumentiert. Reproduktionsdetails und ein noch nicht integrierter Korrekturkandidat bleiben gemäß SECURITY.md außerhalb dieses öffentlichen PRs. Die Offline-Prüfungen haben keine echten GitHub-Reviews oder Kommentare ausgeführt. Kein Paket installiert, veröffentlicht oder aktiviert.

Dieser Unterhaltungskommentar ist keine formale GitHub-Review-Aktion. Die unabhängige Abnahme des vollständigen aktuellen Stands bleibt ausstehend.