[christso]

Changes

• Add github-attention to the engineering plugin with a dependency-free Bun helper and explicit one-or-more repository selection.
• Query current open review requests/history and assignments directly; report actionable authored PR state and bounded mention/reply candidates from read and unread notifications.
• Distinguish direct/team requests, re-requests, dismissed approvals, unchanged reviewed heads, waiting-on-others, and informational updates. Deduplicate each issue/PR and exclude closed/merged work.
• Inspect exact-head checks, commit statuses and workflow runs, including workflow_dispatch, without interpreting empty rollups as missing CI.
• Keep all GitHub operations read-only. Add deterministic boundary tests and document usage, coverage limits and local-only personal data.

Verification

• bun run validate: passed for all five plugins and both native catalogues.
• bun test: 58 passed, including 37 attention-skill tests; run in the host's bounded verification slice.
• Actual authenticated read-only Bun invocation: exited 0; reported items remained within the explicit repository selection. Private selection and report are not included in this PR.
• Transport fixtures cover paginated GET arguments, malformed JSON, HTTP error redaction and subprocess timeout/termination.
• Public-file privacy scan passed; personal selection/report remain outside project repositories in ~/.agents/github-attention.md. Repository-local temporary notes are ignored by *.local.md.
• Independent standards review found no issues. A requirements-review finding about skipped review-request notification replies was fixed with a failing-before/passing-after regression; subscribed-thread chatter remains informational only when personal activity is evidenced.

Limits

Mention/reply discovery is notification-bounded, not an exhaustive historical inbox or resolution detector. Team matching depends on visible memberships. API caps, partial access and snapshot races are reported; successful CI records do not prove required checks or merge readiness. No dependencies, service, automatic task actions or global skill changes.