feat: enable the github plugin at the manager tier

[mabry1985]

What

Adds github-plugin (read+write GitHub tools over gh) to the pm-stack bundle, enabled by default alongside delegates + portfolio.

A portfolio manager's job includes filing/triaging issues — an external dependency, a cross-repo ask, a bug that needs a human's call — not just orchestrating teams. project_board/agent_browser stay installed-but-off (team-tier only, discovered via the host's plugins dir); github is manager-tier work, so it's enabled at the bundle level.

Config

config:
  github:
    write: true   # opt-in: filing + triage needs comment/label/create, not just read

github-plugin ships write: false by default as its own operator-trust gate (per-agent, ADR 0019); this bundle makes the trust decision explicit since it's exactly the PM-tier's job. Merge itself stays confirm-guarded by the plugin regardless of this setting. No default_repo/repos baked in — those are per-instance operator config (which repos this PM watches).

Also added a soul bullet so a PM spun up from this bundle actually knows to reach for the capability, not just have it silently available.

Verification

Ran the bundle's own scripts/verify_bundle.py locally against a fresh protoAgent checkout (what CI's verify-bundle.yml does):

installed portfolio@6ec783aee9 (ref v0.14.7)
installed github@702a202fb3 (ref v0.1.3)
installed project_board@1e40213284 (ref v0.25.0)
installed agent_browser@1bfd7f923e (ref v0.5.1)
loaded portfolio: 15 tool(s)
loaded github: 8 tool(s)
loaded project_board: 5 tool(s)
loaded agent_browser: 17 tool(s)
view github '/plugins/github/view' -> 200
view github '/plugins/github/new-issue' -> 200
data github '/api/plugins/github/config' -> 200
data github '/api/plugins/github/issues' -> 422   (missing query params — expected, still <500)
data github '/api/plugins/github/prs' -> 422       (same)

OK — 4 member(s) installed+loaded, declared views serve 200, enabled data routes < 500.

Note for future readers: a stale local plugins/github/__pycache__ (leftover from before GitHub was retired from protoAgent core in #1336) briefly made the installer think github collided with a built-in — that's untracked/gitignored local debris, not a real conflict; a fresh CI checkout doesn't have it, confirmed by removing the debris and re-running clean.

🤖 Generated with Claude Code

[protoquinn]

👀 Quinn is reviewing — verdict (PASS / WARN / FAIL) + findings to follow.

[protoquinn]

QA Audit — PR #25 | feat: enable the github plugin at the manager tier

VERDICT: WARN (CI non-terminal — verify queued)

---

CI Status

• bump: skipped
• verify: queued

Diff Review

• Single-file change: protoagent.bundle.yaml — adds github-plugin v0.1.3 (pinned), enables it alongside delegates + portfolio, sets write: true with clear rationale, and adds a soul bullet to the archetype.
• Plugin ref is pinned, config section is well-commented, no stale/untracked debris concerns (PR description addresses the __pycache__ false positive from protoAgent#1336).

Observations

• GAP: CI verify is still queued — re-review will confirm once terminal. Local verification (documented) covers the same path.
• LOW: The write: true opt-in is correctly scoped — merge remains confirm-guarded by the plugin regardless, so this is an explicit trust decision at the bundle level, not a risk escalation.

— Quinn, QA Engineer

[protoquinn]

Submitted COMMENT review on #25.