@fitlab-ai/agent-infra 0.9.11 → 0.9.13

package/dist/lib/platform/pull-requests.js

@@ -1,18 +1,25 @@
 import fs from 'node:fs';
+import path from 'node:path';
 import { execFileSync } from 'node:child_process';
-import { parseTaskFrontmatter } from '../task/frontmatter.js';
+import { parseTypedTaskFrontmatter } from '../task/frontmatter.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { extractSection } from '../task/sections.js';
 import { captureTaskWriteMetadata, writeTask } from '../task/write.js';
-import { inspectPlatformChangeRequest, inspectPlatformIssueClosingChangeRequests, registerPlatformCapabilities } from './adapters.js';
-import { parseGitHubRemote, resolvePlatformContext } from './context.js';
+import { parseGitHubRemote, resolvePlatformContext, resolvePlatformProviderContext } from './context.js';
 import { createGitHubClient } from './github-client.js';
 import { inspectPlatformIssue } from './issues.js';
+import { inspectGitHubIssue } from './issues.js';
 import { planPullRequestMetadata } from './pull-request-metadata.js';
+import { extractPullRequestFileNames, planInLabelUpdate, syncLabelDelta, validateInLabelMapping, validateRepositoryLabelPayload } from './in-label-sync.js';
 import { platformResult } from './types.js';
 import { inspectCompletionArtifacts } from '../task/finalization-artifacts.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
+import { resolveDeliveryTarget } from '../task/delivery-target.js';
 import { mergeOperationWarnings } from '../task/operation-outcome.js';
+import { buildBoundFact, buildSkippedFact, factFrontmatterMutation, readPrDeliveryFact } from '../task/pr-delivery-fact.js';
+import { providerError, providerOperationContext, providerStatus, providerResourceToken, providerResourceIdentity, resourceIdentity, unsupportedProviderOperation } from './provider-bridge.js';
+import { isResourceIdentity, resourceIdentityEquals, resourceIdentityNumber } from './resource-identity.js';
+import { taskIssueIdentity, taskIssueIdentityError } from './task-identities.js';
 function warningResultForPrimary(primaryResult) {
     if (primaryResult === 'pr_created')
         return 'pr_created_with_warnings';
@@ -26,6 +33,7 @@ function result(status, taskId, issueNumber, prNumber, overrides = {}) {
         task: { id: taskId, issueNumber, prNumber },
         pullRequest: null,
         result: null,
+        creation: null,
         warnings: [],
         ...overrides
     };
@@ -42,6 +50,12 @@ function externalResult(base, overrides = {}) {
         ...overrides
     };
 }
+function withCreation(output, creation) {
+    return { ...output, creation };
+}
+const PRECONDITION_NOT_CREATED = {
+    kind: 'not-created', reason: 'precondition-failed', createdByCurrentOperation: false
+};
 function normalizePullRequest(remote, repository) {
     const number = Number(remote.number);
     const headRepository = remote.head?.repo?.full_name;
@@ -95,9 +109,15 @@ function normalizeClosingPullRequest(node, repository) {
 function repositoryKey(repository) {
     return repository.trim().toLowerCase();
 }
+function isUsableResourceIdentity(identity) {
+    return isResourceIdentity(identity);
+}
+function identityLabel(identity) {
+    return identity.kind === 'number' ? `PR #${identity.value}` : `PR ${identity.kind}:${identity.value}`;
+}
 function identitySignature(pullRequest) {
     return [
-        pullRequest.repository, pullRequest.number, pullRequest.nodeId, pullRequest.url,
+        pullRequest.repository, JSON.stringify(pullRequestIdentity(pullRequest)), pullRequest.nodeId, pullRequest.url,
         pullRequest.head.repository, pullRequest.head.ref, pullRequest.head.sha,
         pullRequest.base.repository, pullRequest.base.ref, pullRequest.base.sha,
         pullRequest.mergedAt || '', pullRequest.mergeCommitSha || ''
@@ -109,47 +129,52 @@ function hasCompleteExternalIdentity(pullRequest) {
         pullRequest.head.repository, pullRequest.head.ref, pullRequest.head.sha,
         pullRequest.base.repository, pullRequest.base.ref, pullRequest.base.sha
     ];
-    return Number.isInteger(pullRequest.number) && pullRequest.number > 0 &&
-        required.every((value) => Boolean(value?.trim())) &&
-        Boolean(pullRequest.mergedAt) === Boolean(pullRequest.mergeCommitSha);
+    return isUsableResourceIdentity(pullRequestIdentity(pullRequest)) && required.every((value) => Boolean(value?.trim())) &&
+        (pullRequest.state === 'open' || Boolean(pullRequest.mergedAt) === Boolean(pullRequest.mergeCommitSha));
 }
-function selectExternalPullRequest(candidates, repository, existingPrNumber, explicitPrNumber) {
+function selectExternalPullRequest(candidates, repository, existingPrIdentity, explicitPrIdentity) {
+    const existingIdentity = typeof existingPrIdentity === 'number'
+        ? resourceIdentity(existingPrIdentity) : existingPrIdentity;
+    const explicitIdentity = typeof explicitPrIdentity === 'number'
+        ? resourceIdentity(explicitPrIdentity) : explicitPrIdentity;
     const invalid = candidates.find((candidate) => !hasCompleteExternalIdentity(candidate));
     if (invalid)
         return {
             status: 'failed', code: 'PR_IDENTITY_INVALID',
             message: `Closing PR #${invalid.number} lacks required identity`, candidates, eligible: []
         };
-    const byNumber = new Map();
+    const byIdentity = new Map();
     for (const candidate of candidates) {
         const signature = identitySignature(candidate);
-        const prior = byNumber.get(candidate.number);
+        const identityKey = JSON.stringify(pullRequestIdentity(candidate));
+        const prior = byIdentity.get(identityKey);
         if (prior && prior !== signature)
             return {
                 status: 'failed', code: 'PR_IDENTITY_INVALID',
                 message: `Closing PR #${candidate.number} has conflicting identities`, candidates, eligible: []
             };
-        byNumber.set(candidate.number, signature);
+        byIdentity.set(identityKey, signature);
     }
-    const unique = candidates.filter((candidate, index) => candidates.findIndex((other) => other.number === candidate.number) === index);
+    const unique = candidates.filter((candidate, index) => candidates.findIndex((other) => resourceIdentityEquals(pullRequestIdentity(other), pullRequestIdentity(candidate))) === index);
     const wantedRepository = repositoryKey(repository);
     const eligible = unique.filter((candidate) => repositoryKey(candidate.repository) === wantedRepository &&
         repositoryKey(candidate.base.repository) === wantedRepository &&
+        candidate.state === 'closed' &&
         Boolean(candidate.mergedAt && candidate.mergeCommitSha));
-    if (explicitPrNumber !== null) {
-        const selected = unique.find((candidate) => candidate.number === explicitPrNumber);
+    if (explicitIdentity !== null) {
+        const selected = unique.find((candidate) => resourceIdentityEquals(pullRequestIdentity(candidate), explicitIdentity));
         if (!selected)
-            return { status: 'failed', code: 'PR_NOT_FOUND', message: `PR #${explicitPrNumber} is not a closing PR`, candidates, eligible };
-        if (!eligible.some((candidate) => candidate.number === explicitPrNumber)) {
-            return { status: 'failed', code: 'PR_IDENTITY_INVALID', message: `PR #${explicitPrNumber} is not an eligible merged PR`, candidates, eligible };
+            return { status: 'failed', code: 'PR_NOT_FOUND', message: `PR ${identityLabel(explicitIdentity)} is not a closing PR`, candidates, eligible };
+        if (!eligible.some((candidate) => resourceIdentityEquals(pullRequestIdentity(candidate), explicitIdentity))) {
+            return { status: 'failed', code: 'PR_IDENTITY_INVALID', message: `PR ${identityLabel(explicitIdentity)} is not an eligible merged PR`, candidates, eligible };
         }
-        if (existingPrNumber !== null && existingPrNumber !== explicitPrNumber) {
-            return { status: 'failed', code: 'PR_BIND_CONFLICT', message: `Task is already bound to PR #${existingPrNumber}`, candidates, eligible };
+        if (existingIdentity !== null && !resourceIdentityEquals(existingIdentity, explicitIdentity)) {
+            return { status: 'failed', code: 'PR_BIND_CONFLICT', message: `Task is already bound to ${identityLabel(existingIdentity)}`, candidates, eligible };
         }
         return { status: 'selected', source: 'explicit', selected, candidates, eligible };
     }
-    if (existingPrNumber !== null && eligible.length === 1 && existingPrNumber !== eligible[0].number) {
-        return { status: 'failed', code: 'PR_BIND_CONFLICT', message: `Task is already bound to PR #${existingPrNumber}`, candidates, eligible };
+    if (existingIdentity !== null && eligible.length === 1 && !resourceIdentityEquals(existingIdentity, pullRequestIdentity(eligible[0]))) {
+        return { status: 'failed', code: 'PR_BIND_CONFLICT', message: `Task is already bound to ${identityLabel(existingIdentity)}`, candidates, eligible };
     }
     if (eligible.length === 0)
         return { status: 'normal', candidates, eligible: [] };
@@ -227,64 +252,6 @@ function selectPullRequest(remotes, repository, head, base, expectedSha) {
         return { status: 'resolved', pullRequest: matches[0] };
     return { status: matches.length === 0 ? 'missing' : 'ambiguous', pullRequest: null };
 }
-function repositoryHead(cwd) {
-    return execFileSync('git', ['rev-parse', 'HEAD'], {
-        cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe']
-    }).trim();
-}
-function remoteBranchHead(cwd, repository, head) {
-    const wanted = expectedHead(repository, head);
-    if (!wanted.ref || !/^[A-Za-z0-9._/-]+$/.test(wanted.ref))
-        return {
-            ok: false,
-            error: { code: 'PR_HEAD_INVALID', message: 'Pull request head ref is invalid', retryable: false }
-        };
-    const remotes = configuredGitRemotes(cwd);
-    const remote = remotes.find((item) => repositoryKey(item.repository) === repositoryKey(wanted.repository))
-        ?? remotes.find((item) => item.name === 'origin');
-    if (!remote)
-        return {
-            ok: false,
-            error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `No configured remote can verify ${wanted.repository}:${wanted.ref}`, retryable: false }
-        };
-    try {
-        const output = execFileSync('git', ['ls-remote', '--refs', remote.name, `refs/heads/${wanted.ref}`], {
-            cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe']
-        }).trim();
-        const match = output.split(/\r?\n/).map((line) => line.trim()).find((line) => line.endsWith(`refs/heads/${wanted.ref}`));
-        const sha = match?.split(/\s+/)[0] || null;
-        if (!sha || !/^[a-f0-9]{40}$/i.test(sha))
-            return {
-                ok: false,
-                error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `Remote branch ${wanted.repository}:${wanted.ref} does not exist`, retryable: false }
-            };
-        return { ok: true, value: sha };
-    }
-    catch (error) {
-        return {
-            ok: false,
-            error: { code: 'PR_REMOTE_BRANCH_UNAVAILABLE', message: error instanceof Error ? error.message : String(error), retryable: true }
-        };
-    }
-}
-function verifyCreateHead(base, head) {
-    let localHead;
-    try {
-        localHead = repositoryHead(base.resolved.repoRoot);
-    }
-    catch (error) {
-        return { ok: false, error: { code: 'PR_LOCAL_HEAD_UNAVAILABLE', message: error instanceof Error ? error.message : String(error), retryable: false } };
-    }
-    const remote = remoteBranchHead(base.resolved.repoRoot, base.context.platform.repository, head);
-    if (!remote.ok)
-        return remote;
-    if (remote.value !== localHead)
-        return {
-            ok: false,
-            error: { code: 'PR_REMOTE_HEAD_MISMATCH', message: `Remote head ${remote.value} does not match local HEAD ${localHead}`, retryable: false }
-        };
-    return { ok: true, value: localHead };
-}
 function validateBoundPullRequest(base, pullRequest, head, baseRef, expectedSha) {
     if (!pullRequest)
         return {
@@ -303,26 +270,157 @@ function validateBoundPullRequest(base, pullRequest, head, baseRef, expectedSha)
         };
     return { ok: true };
 }
-function resolvedContext(taskRef, options) {
+function resolveTaskDeliveryTarget(repoRoot, frontmatter) {
+    const existing = {
+        ...(typeof frontmatter.delivery_remote === 'string' && frontmatter.delivery_remote
+            ? { remote: frontmatter.delivery_remote } : {}),
+        ...(typeof frontmatter.delivery_base_ref === 'string' && frontmatter.delivery_base_ref
+            ? { baseRef: frontmatter.delivery_base_ref } : {})
+    };
+    const target = resolveDeliveryTarget(repoRoot, existing);
+    return target.ok
+        ? { ok: true, value: target.value }
+        : { ok: false, error: { code: target.code, message: target.message, retryable: false } };
+}
+function taskDeliveryTarget(base) {
+    return resolveTaskDeliveryTarget(base.resolved.repoRoot, base.frontmatter);
+}
+function validateIdentityAgainstTarget(repository, target, pullRequest, options = {}) {
+    if (!pullRequest || !hasCompleteExternalIdentity(pullRequest))
+        return {
+            ok: false,
+            error: { code: options.errorCode || 'PR_BIND_IDENTITY_MISMATCH', message: 'Pull request identity is incomplete', retryable: false }
+        };
+    const wantedHead = options.expectedHead ? expectedHead(repository, options.expectedHead) : null;
+    const matches = repositoryKey(pullRequest.repository) === repositoryKey(repository)
+        && repositoryKey(pullRequest.base.repository) === repositoryKey(repository)
+        && pullRequest.base.ref === target.baseRef
+        && (!wantedHead || (repositoryKey(pullRequest.head.repository) === repositoryKey(wantedHead.repository) && pullRequest.head.ref === wantedHead.ref))
+        && (!options.expectedHeadSha || pullRequest.head.sha === options.expectedHeadSha);
+    if (!matches)
+        return {
+            ok: false,
+            error: {
+                code: options.errorCode || 'PR_BIND_IDENTITY_MISMATCH',
+                message: 'Pull request identity does not match the task branch and delivery target',
+                retryable: false
+            }
+        };
+    return { ok: true };
+}
+function validateWriterIdentity(base, pullRequest, options = {}) {
+    const target = taskDeliveryTarget(base);
+    if (!target.ok)
+        return target;
+    return validateIdentityAgainstTarget(base.context.platform.repository, target.value, pullRequest, options);
+}
+function sameDeliveryIdentity(left, right) {
+    return JSON.stringify(deliveryIdentity(left)) === JSON.stringify(deliveryIdentity(right));
+}
+function validateExternalMergedEvidence(initial, rechecked) {
+    if (initial.state !== 'closed'
+        || !initial.mergedAt
+        || !initial.mergeCommitSha
+        || rechecked.state !== 'closed'
+        || !rechecked.mergedAt
+        || !rechecked.mergeCommitSha
+        || initial.mergedAt !== rechecked.mergedAt
+        || initial.mergeCommitSha !== rechecked.mergeCommitSha)
+        return {
+            ok: false,
+            error: { code: 'PR_EXTERNAL_IDENTITY_MISMATCH', message: 'Selected pull request merged evidence changed before task binding', retryable: false }
+        };
+    return { ok: true };
+}
+async function resolvedContext(taskRef, options) {
     const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
     if (!resolved.ok)
         return { ok: false, output: result('failed', resolved.taskId, null, null, {
                 error: { code: resolved.code, message: resolved.message, retryable: false }
             }) };
     const content = fs.readFileSync(resolved.taskMdPath, 'utf8');
-    const frontmatter = parseTaskFrontmatter(content);
-    const issue = Number(frontmatter.issue_number);
-    const pr = Number(frontmatter.pr_number);
-    const issueNumber = Number.isInteger(issue) && issue > 0 ? issue : null;
-    const prNumber = Number.isInteger(pr) && pr > 0 ? pr : null;
-    const client = options.client || createGitHubClient();
-    const context = resolvePlatformContext({ cwd: resolved.repoRoot, client });
+    const frontmatter = parseTypedTaskFrontmatter(content);
+    const factRead = readPrDeliveryFact(frontmatter, options.runtimeVersion);
+    if (factRead.status === 'invalid')
+        return { ok: false, output: result('failed', resolved.taskId, null, null, {
+                error: { code: factRead.error.code, message: factRead.error.message, retryable: false }
+            }) };
+    const fact = factRead.status === 'valid' ? factRead.fact : null;
+    let issueIdentity;
+    try {
+        issueIdentity = taskIssueIdentity(frontmatter, undefined, options.runtimeVersion);
+    }
+    catch (error) {
+        return { ok: false, output: result('failed', resolved.taskId, null, null, { error: { ...taskIssueIdentityError(error), retryable: false } }) };
+    }
+    const issueNumber = resourceIdentityNumber(issueIdentity);
+    const prIdentity = fact?.state === 'bound' ? fact.identity.resource : null;
+    const prNumber = resourceIdentityNumber(prIdentity);
+    const client = options.client;
+    const loaded = await resolvePlatformProviderContext({ cwd: resolved.repoRoot, client });
+    const context = loaded.ok ? loaded.value.context : loaded.context;
     const usable = (context.status === 'no-op' || context.status === 'degraded') && context.platform.repository;
-    if (!usable)
+    if (!usable || !loaded.ok)
         return { ok: false, output: result(context.status, resolved.taskId, issueNumber, prNumber, {
                 platform: context.platform, capabilities: context.capabilities, operations: context.operations, error: context.error
             }) };
-    return { ok: true, resolved, content, frontmatter, issueNumber, prNumber, client, context };
+    return { ok: true, resolved, content, frontmatter, fact, issueIdentity, issueNumber, prIdentity, prNumber, client, context, provider: loaded.value.provider, providerType: loaded.value.providerType, loadedContext: loaded.value };
+}
+function normalizeProviderPullRequest(remote, repository, fallbackNumber, fallback) {
+    const head = remote.head || fallback?.head || { repository, ref: '', sha: remote.headSha || '' };
+    const base = remote.base || fallback?.base || { repository, ref: '', sha: remote.baseSha || '' };
+    const identity = remote.identity || fallback?.identity || (remote.number ? { kind: 'number', value: remote.number } : { kind: 'id', value: remote.id });
+    const snapshot = {
+        repository,
+        number: remote.number ?? resourceIdentityNumber(identity) ?? fallbackNumber,
+        nodeId: remote.id,
+        url: remote.displayUrl || fallback?.url || '',
+        state: remote.state === 'closed' ? 'closed' : 'open',
+        title: remote.title,
+        body: remote.body,
+        draft: remote.draft ?? fallback?.draft ?? false,
+        head: { ...head, sha: remote.headSha || head.sha },
+        base: { ...base, sha: remote.baseSha || base.sha },
+        mergedAt: remote.mergedAt ?? fallback?.mergedAt ?? null,
+        mergeCommitSha: remote.mergeCommitSha ?? fallback?.mergeCommitSha ?? null,
+        labels: [...(remote.labels || fallback?.labels || [])].sort(),
+        assignees: [...(remote.assignees || fallback?.assignees || [])].sort(),
+        milestone: remote.milestone ?? fallback?.milestone ?? null,
+        mergeability: remote.mergeability || fallback?.mergeability || { state: 'unknown', detail: null }
+    };
+    Object.defineProperty(snapshot, 'identity', { value: identity, enumerable: false, configurable: true });
+    return snapshot;
+}
+function pullRequestIdentity(pullRequest) {
+    return pullRequest.identity || { kind: 'number', value: pullRequest.number };
+}
+function providerPullRequestError(base, error, prNumber) {
+    return result(error.code.startsWith('IN_LABEL_SYNC') ? 'blocked' : providerStatus(error), base.resolved.taskId, base.issueNumber, prNumber, {
+        changed: error.code.startsWith('IN_LABEL_SYNC'),
+        platform: base.context.platform,
+        capabilities: base.context.capabilities,
+        resource: { kind: 'pull-request', number: prNumber },
+        error: providerError(error, 'PLATFORM_PROVIDER_OPERATION_FAILED')
+    });
+}
+async function inspectExternalPullRequest(base, prIdentity) {
+    const prNumber = resourceIdentityNumber(prIdentity);
+    const fallback = base.fact?.state === 'bound' && resourceIdentityEquals(base.fact.identity.resource, prIdentity)
+        ? base.fact.identity
+        : null;
+    const inspected = base.provider.changeRequests?.inspect
+        ? await base.provider.changeRequests.inspect({ context: providerOperationContext(base.loadedContext), target: prIdentity })
+        : unsupportedProviderOperation(base.provider, 'changeRequests.inspect');
+    if (!inspected.ok)
+        return providerPullRequestError(base, inspected.error, prNumber);
+    const pullRequest = normalizeProviderPullRequest(inspected.value, base.context.platform.repository, prNumber || 0, fallback);
+    return result('no-op', base.resolved.taskId, base.issueNumber, prNumber, {
+        platform: base.context.platform,
+        capabilities: base.context.capabilities,
+        resource: { kind: 'pull-request', number: prNumber, identity: prIdentity },
+        pullRequest,
+        error: null
+    });
 }
 function inspectGitHubPullRequest(client, repository, number, cwd) {
     const fetched = client.json(['api', `repos/${repository}/pulls/${number}`], { cwd });
@@ -333,191 +431,369 @@ function inspectGitHubPullRequest(client, repository, number, cwd) {
         ? { ok: true, value: pullRequest }
         : { ok: false, error: { code: 'PR_IDENTITY_INVALID', message: 'Remote resource is not a valid pull request', retryable: false } };
 }
-function configuredGitRemotes(cwd) {
+async function inspectPlatformPullRequest(taskRef, options = {}) {
+    const base = await resolvedContext(taskRef, options);
+    if (!base.ok)
+        return base.output;
+    if (!base.fact)
+        return result('no-op', base.resolved.taskId, base.issueNumber, null, {
+            error: { code: 'PR_DELIVERY_FACT_MISSING', message: 'Task has no pr_delivery_fact; repair the task metadata or create a new task', retryable: false }
+        });
+    if (!base.prIdentity)
+        return result('no-op', base.resolved.taskId, base.issueNumber, null, {
+            platform: base.context.platform, capabilities: base.context.capabilities,
+            error: { code: 'PR_NOT_LINKED', message: 'Task has no verified bound pull request', retryable: false }
+        });
+    return inspectExternalPullRequest(base, base.prIdentity);
+}
+async function inspectPlatformPullRequestByNumber(prNumber, options = {}) {
+    const loaded = await resolvePlatformProviderContext({ cwd: options.cwd || process.cwd(), client: options.client });
+    const context = loaded.ok ? loaded.value.context : loaded.context;
+    const usable = (context.status === 'no-op' || context.status === 'degraded') && context.platform.repository;
+    if (!usable) {
+        return result(context.status, null, null, null, {
+            platform: context.platform, capabilities: context.capabilities, operations: context.operations, error: context.error
+        });
+    }
+    let identity;
     try {
-        return execFileSync('git', ['remote'], {
-            cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe']
-        }).split(/\r?\n/).filter(Boolean).flatMap((name) => {
-            try {
-                const url = execFileSync('git', ['config', '--get', `remote.${name}.url`], {
-                    cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe']
-                }).trim();
-                const repository = parseGitHubRemote(url);
-                return repository ? [{ name, url, repository }] : [];
-            }
-            catch {
-                return [];
-            }
+        identity = loaded.ok ? providerResourceToken(loaded.value.provider, 'pull-request', String(prNumber)) : resourceIdentity(prNumber);
+    }
+    catch (error) {
+        return result('failed', null, null, null, {
+            platform: context.platform, capabilities: context.capabilities,
+            error: { code: 'PLATFORM_IDENTITY_TOKEN_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
         });
     }
-    catch {
-        return [];
+    if (loaded.ok) {
+        const inspected = loaded.value.provider.changeRequests?.inspect
+            ? await loaded.value.provider.changeRequests.inspect({ context: providerOperationContext(loaded.value), target: identity })
+            : unsupportedProviderOperation(loaded.value.provider, 'changeRequests.inspect');
+        const number = resourceIdentityNumber(identity);
+        if (!inspected.ok)
+            return result(providerStatus(inspected.error), null, null, number, {
+                platform: context.platform, capabilities: context.capabilities,
+                resource: { kind: 'pull-request', number, identity }, error: providerError(inspected.error, 'PLATFORM_PROVIDER_OPERATION_FAILED')
+            });
+        return result('no-op', null, null, number, {
+            platform: context.platform, capabilities: context.capabilities,
+            resource: { kind: 'pull-request', number, identity },
+            pullRequest: normalizeProviderPullRequest(inspected.value, context.platform.repository, number || 0), error: null
+        });
     }
+    return result('failed', null, null, null, {
+        platform: context.platform, capabilities: context.capabilities,
+        resource: { kind: 'pull-request', number: null },
+        error: { code: 'PLATFORM_PROVIDER_LOAD_FAILED', message: 'Selected provider failed to load', retryable: false }
+    });
 }
-function rewriteGitHubRemote(remote, repository) {
-    const match = remote.trim().match(/^(https?:\/\/github\.com\/|ssh:\/\/(?:git@)?github\.com\/|git@github\.com:)[^/\s]+\/[^/\s]+(?:\.git)?$/i);
-    return match ? `${match[1]}${repository}.git` : null;
+const CLOSING_ISSUES_QUERY = 'query($owner:String!,$name:String!,$number:Int!,$cursor:String){repository(owner:$owner,name:$name){pullRequest(number:$number){closingIssuesReferences(first:100,after:$cursor){nodes{number} pageInfo{hasNextPage endCursor}}}}}';
+function readInLabelMapping(repoRoot) {
+    try {
+        const config = JSON.parse(fs.readFileSync(path.join(repoRoot, '.agents', '.airc.json'), 'utf8'));
+        const mapping = validateInLabelMapping(config.labels?.in);
+        return mapping.ok ? { ok: true, value: mapping.value } : mapping;
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: { code: 'IN_LABEL_SYNC_CONFIG_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
+        };
+    }
 }
-function resolveGitHubChangeRequestGitEvidence({ cwd, repository, pullRequest }) {
-    if (pullRequest.repository !== repository ||
-        pullRequest.base.repository !== repository ||
-        pullRequest.number <= 0) {
+function taskInLabelTarget(repoRoot, frontmatter, currentLabels, repositoryLabels) {
+    const baseRef = typeof frontmatter.delivery_base_ref === 'string' ? frontmatter.delivery_base_ref.trim() : '';
+    if (!baseRef)
         return {
             ok: false,
-            error: {
-                code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
-                message: 'Pull request repository identity is inconsistent',
-                retryable: false
-            }
+            error: { code: 'IN_LABEL_SYNC_BASE_MISSING', message: 'Task has no delivery_base_ref for in-label evidence', retryable: false }
         };
+    let changedFiles;
+    try {
+        changedFiles = execFileSync('git', ['diff', `${baseRef}...HEAD`, '--name-only'], {
+            cwd: repoRoot, encoding: 'utf8'
+        }).trim().split(/\r?\n/).filter(Boolean);
     }
-    const reviewedHeadRef = `refs/pull/${pullRequest.number}/head`;
-    const targetHeadRef = `refs/heads/${pullRequest.base.ref}`;
-    const refValid = (ref) => {
-        try {
-            execFileSync('git', ['check-ref-format', ref], {
-                cwd, encoding: 'utf8', stdio: ['ignore', 'ignore', 'ignore']
-            });
-            return true;
-        }
-        catch {
-            return false;
-        }
-    };
-    if (!refValid(reviewedHeadRef) || !refValid(targetHeadRef)) {
+    catch (error) {
         return {
             ok: false,
-            error: {
-                code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
-                message: 'Pull request Git refs are invalid',
-                retryable: false
-            }
+            error: { code: 'IN_LABEL_SYNC_EVIDENCE_UNAVAILABLE', message: error instanceof Error ? error.message : String(error), retryable: false }
         };
     }
-    const remotes = configuredGitRemotes(cwd);
-    const exact = remotes
-        .filter((remote) => remote.repository === repository)
-        .sort((left, right) => Number(right.name === 'origin') - Number(left.name === 'origin') ||
-        left.name.localeCompare(right.name))[0];
-    const origin = remotes.find((remote) => remote.name === 'origin');
-    const remoteUrl = exact?.url || (origin ? rewriteGitHubRemote(origin.url, repository) : null);
-    if (!remoteUrl) {
+    const mapping = readInLabelMapping(repoRoot);
+    if (!mapping.ok)
+        return mapping;
+    const planned = planInLabelUpdate({ changedFiles, currentLabels, mapping: mapping.value, repositoryLabels });
+    if (planned.error)
+        return { ok: false, error: planned.error };
+    return { ok: true, value: planned.target };
+}
+function inspectClosingIssueNumbers(client, repository, pullRequest, cwd) {
+    const [owner, name] = repository.split('/');
+    if (!owner || !name)
         return {
             ok: false,
-            error: {
-                code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
-                message: `No GitHub remote can provide evidence for ${repository}`,
-                retryable: false
-            }
+            error: { code: 'IN_LABEL_SYNC_REPOSITORY_INVALID', message: 'Repository identity is invalid', retryable: false }
         };
+    let cursor = null;
+    const numbers = [];
+    for (;;) {
+        const args = ['api', 'graphql', '-f', `query=${CLOSING_ISSUES_QUERY}`, '-F', `owner=${owner}`, '-F', `name=${name}`, '-F', `number=${pullRequest}`];
+        if (cursor)
+            args.push('-F', `cursor=${cursor}`);
+        const response = client.json(args, { cwd });
+        if (!response.ok)
+            return response;
+        const connection = response.value?.data?.repository?.pullRequest?.closingIssuesReferences;
+        if (!connection || !Array.isArray(connection.nodes) || !connection.pageInfo)
+            return {
+                ok: false,
+                error: { code: 'IN_LABEL_SYNC_ASSOCIATION_INVALID', message: 'Closing Issue response is incomplete', retryable: false }
+            };
+        for (const node of connection.nodes) {
+            const issue = Number(node?.number);
+            if (!Number.isSafeInteger(issue) || issue <= 0)
+                return {
+                    ok: false,
+                    error: { code: 'IN_LABEL_SYNC_ASSOCIATION_INVALID', message: 'Closing Issue identity is invalid', retryable: false }
+                };
+            numbers.push(issue);
+        }
+        if (!connection.pageInfo.hasNextPage)
+            return { ok: true, value: [...new Set(numbers)] };
+        if (!connection.pageInfo.endCursor || connection.pageInfo.endCursor === cursor)
+            return {
+                ok: false,
+                error: { code: 'IN_LABEL_SYNC_ASSOCIATION_INVALID', message: 'Closing Issue pagination cursor is invalid', retryable: false }
+            };
+        cursor = connection.pageInfo.endCursor;
     }
-    return {
-        ok: true,
-        value: { remoteUrl, reviewedHeadRef, targetHeadRef }
-    };
 }
-registerPlatformCapabilities('github', {
-    inspectChangeRequest({ client, repository, number, cwd }) {
-        return inspectGitHubPullRequest(client || createGitHubClient(), repository, number, cwd);
-    },
-    inspectIssueClosingChangeRequests({ client, repository, issueNumber, cwd }) {
-        return inspectGitHubIssueClosingChangeRequests(client || createGitHubClient(), repository, issueNumber, cwd);
-    },
-    resolveChangeRequestGitEvidence(context) {
-        return resolveGitHubChangeRequestGitEvidence(context);
-    }
-});
-function locatePullRequest(base, head, target, expectedSha) {
-    const repository = base.context.platform.repository;
-    const listed = base.client.json([
-        'api', `repos/${repository}/pulls?state=open&base=${encodeURIComponent(target)}&per_page=100`
-    ], { cwd: base.resolved.repoRoot });
-    if (!listed.ok)
-        return listed;
-    const selected = selectPullRequest(listed.value, repository, head, target, expectedSha);
-    return selected.status === 'resolved'
-        ? { ok: true, value: selected.pullRequest }
-        : { ok: false, error: {
-                code: selected.status === 'ambiguous' ? 'PR_IDENTITY_AMBIGUOUS'
-                    : selected.status === 'head-mismatch' ? 'PR_HEAD_SHA_MISMATCH' : 'PR_NOT_FOUND',
-                message: selected.status === 'ambiguous' ? 'Multiple pull requests match the exact head/base identity'
-                    : selected.status === 'head-mismatch' ? 'A pull request matches head/base but not the expected head SHA'
-                        : 'No pull request matches the exact head/base identity',
-                retryable: false
-            } };
+function inspectRepositoryLabels(client, repository, cwd) {
+    const response = client.json(['api', '--paginate', '--slurp', `repos/${repository}/labels?per_page=100`], { cwd });
+    if (!response.ok)
+        return response;
+    const labels = validateRepositoryLabelPayload(response.value);
+    return labels.ok ? { ok: true, value: new Set(labels.value) } : labels;
 }
-function inspectPlatformPullRequest(taskRef, options = {}) {
-    const base = resolvedContext(taskRef, options);
-    if (!base.ok)
-        return base.output;
-    if (!base.prNumber)
-        return result('no-op', base.resolved.taskId, base.issueNumber, null, {
-            platform: base.context.platform, capabilities: base.context.capabilities,
-            error: { code: 'PR_NOT_LINKED', message: 'Task has no valid pr_number', retryable: false }
-        });
-    const fetched = inspectPlatformChangeRequest(base.context.platform.type, {
-        cwd: base.resolved.repoRoot,
-        repository: base.context.platform.repository,
-        number: base.prNumber,
-        client: options.client || base.client
-    });
-    if (!fetched.ok || !fetched.value) {
-        const error = fetched.error || {
-            code: 'PR_INSPECTION_INVALID',
-            message: 'Platform adapter returned no change-request snapshot',
-            retryable: false
+function inspectPullRequestFiles(client, repository, pullRequest, cwd) {
+    const response = client.json(['api', '--paginate', '--slurp', `repos/${repository}/pulls/${pullRequest}/files?per_page=100`], { cwd });
+    if (!response.ok)
+        return response;
+    const files = extractPullRequestFileNames(response.value);
+    return files ? { ok: true, value: files } : {
+        ok: false,
+        error: { code: 'IN_LABEL_SYNC_FILES_INVALID', message: 'Pull request files response is incomplete', retryable: false }
+    };
+}
+function inspectTaskInLabelTarget(repoRoot, frontmatter, pullRequest, repository, client) {
+    const baseRef = typeof frontmatter.delivery_base_ref === 'string' ? frontmatter.delivery_base_ref.trim() : '';
+    if (!baseRef)
+        return {
+            ok: false,
+            error: { code: 'IN_LABEL_SYNC_BASE_MISSING', message: 'Task has no delivery_base_ref for in-label evidence', retryable: false }
+        };
+    let changedFiles;
+    try {
+        changedFiles = execFileSync('git', ['diff', `${baseRef}...HEAD`, '--name-only'], {
+            cwd: repoRoot, encoding: 'utf8'
+        }).trim().split(/\r?\n/).filter(Boolean);
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: { code: 'IN_LABEL_SYNC_EVIDENCE_UNAVAILABLE', message: error instanceof Error ? error.message : String(error), retryable: false }
         };
-        return result(error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
-            platform: base.context.platform, capabilities: base.context.capabilities,
-            resource: { kind: 'pull-request', number: base.prNumber }, error
-        });
     }
-    return result('no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
-        platform: base.context.platform, capabilities: base.context.capabilities,
-        resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: fetched.value, error: null
+    const mapping = readInLabelMapping(repoRoot);
+    if (!mapping.ok)
+        return mapping;
+    const labels = inspectRepositoryLabels(client, repository, repoRoot);
+    if (!labels.ok)
+        return labels;
+    const planned = planInLabelUpdate({
+        changedFiles, currentLabels: pullRequest.labels, mapping: mapping.value, repositoryLabels: labels.value
     });
+    if (planned.error)
+        return { ok: false, error: planned.error };
+    return { ok: true, value: { changedFiles, target: planned.target } };
 }
-function inspectPlatformPullRequestByNumber(prNumber, options = {}) {
+function inLabelResource(kind, number, before, expected, after, effect) {
+    return { kind, number, before: [...before].sort(), expected: [...expected].sort(), after: after ? [...after].sort() : null, effect };
+}
+async function syncPlatformPullRequestInLabels(prNumber, options = {}) {
+    const cwd = path.resolve(options.cwd || process.cwd());
     const client = options.client || createGitHubClient();
-    const context = resolvePlatformContext({ cwd: options.cwd || process.cwd(), client });
+    const context = await resolvePlatformContext({ cwd, client });
     const usable = (context.status === 'no-op' || context.status === 'degraded') && context.platform.repository;
-    if (!usable) {
-        return result(context.status, null, null, null, {
+    if (!usable)
+        return result(context.status, null, null, prNumber, {
             platform: context.platform, capabilities: context.capabilities, operations: context.operations, error: context.error
         });
-    }
-    if (!Number.isInteger(prNumber) || prNumber <= 0) {
-        return result('failed', null, null, null, {
+    if (!Number.isSafeInteger(prNumber) || prNumber <= 0)
+        return result('failed', null, null, prNumber, {
             platform: context.platform, capabilities: context.capabilities,
             error: { code: 'PR_NUMBER_INVALID', message: 'PR number must be positive', retryable: false }
         });
-    }
-    const fetched = inspectPlatformChangeRequest(context.platform.type, {
-        cwd: options.cwd || process.cwd(),
-        repository: context.platform.repository,
-        number: prNumber,
-        client
+    const repository = context.platform.repository;
+    const fetched = inspectGitHubPullRequest(client, repository, prNumber, cwd);
+    if (!fetched.ok)
+        return result(fetched.error.retryable ? 'blocked' : 'failed', null, null, prNumber, {
+            platform: context.platform, capabilities: context.capabilities, resource: { kind: 'pull-request', number: prNumber }, error: fetched.error
+        });
+    const files = inspectPullRequestFiles(client, repository, prNumber, cwd);
+    if (!files.ok)
+        return result(files.error.retryable ? 'blocked' : 'failed', null, null, prNumber, {
+            platform: context.platform, capabilities: context.capabilities, pullRequest: fetched.value,
+            resource: { kind: 'pull-request', number: prNumber }, error: files.error
+        });
+    const mapping = readInLabelMapping(cwd);
+    if (!mapping.ok)
+        return result('failed', null, null, prNumber, {
+            platform: context.platform, capabilities: context.capabilities, pullRequest: fetched.value,
+            resource: { kind: 'pull-request', number: prNumber }, error: mapping.error
+        });
+    const repositoryLabels = inspectRepositoryLabels(client, repository, cwd);
+    if (!repositoryLabels.ok)
+        return result(repositoryLabels.error.retryable ? 'blocked' : 'failed', null, null, prNumber, {
+            platform: context.platform, capabilities: context.capabilities, pullRequest: fetched.value,
+            resource: { kind: 'pull-request', number: prNumber }, error: repositoryLabels.error
+        });
+    const plannedTarget = planInLabelUpdate({
+        changedFiles: files.value, currentLabels: fetched.value.labels,
+        mapping: mapping.value, repositoryLabels: repositoryLabels.value
     });
-    if (!fetched.ok || !fetched.value) {
-        const error = fetched.error || {
-            code: 'PR_INSPECTION_INVALID',
-            message: 'Platform adapter returned no change-request snapshot',
-            retryable: false
-        };
-        return result(error.retryable ? 'blocked' : 'failed', null, null, prNumber, {
-            platform: context.platform, capabilities: context.capabilities,
-            resource: { kind: 'pull-request', number: prNumber }, error
+    if (plannedTarget.error)
+        return result('failed', null, null, prNumber, {
+            platform: context.platform, capabilities: context.capabilities, pullRequest: fetched.value,
+            resource: { kind: 'pull-request', number: prNumber }, error: plannedTarget.error
+        });
+    const target = plannedTarget.target;
+    const association = inspectClosingIssueNumbers(client, repository, prNumber, cwd);
+    if (!association.ok)
+        return result(association.error.retryable ? 'blocked' : 'failed', null, null, prNumber, {
+            platform: context.platform, capabilities: context.capabilities, pullRequest: fetched.value,
+            resource: { kind: 'pull-request', number: prNumber }, evidence: { kind: 'pull-request-files', pullRequestFiles: files.value }, error: association.error
         });
+    const issueNumber = association.value.length === 1 ? association.value[0] : null;
+    let issue = null;
+    if (issueNumber) {
+        const fetchedIssue = inspectGitHubIssue(client, repository, issueNumber, cwd);
+        if (!fetchedIssue.ok)
+            return result(fetchedIssue.error.retryable ? 'blocked' : 'failed', null, issueNumber, prNumber, {
+                platform: context.platform, capabilities: context.capabilities, pullRequest: fetched.value,
+                resource: { kind: 'issue', number: issueNumber }, evidence: { kind: 'pull-request-files', pullRequestFiles: files.value, closingIssues: association.value }, error: fetchedIssue.error
+            });
+        issue = fetchedIssue.value;
     }
-    return result('no-op', null, null, prNumber, {
-        platform: context.platform, capabilities: context.capabilities,
-        resource: { kind: 'pull-request', number: prNumber }, pullRequest: fetched.value, error: null
+    const resources = issue
+        ? [
+            { kind: 'issue', number: issue.number, snapshot: issue },
+            { kind: 'pull-request', number: prNumber, snapshot: fetched.value }
+        ]
+        : [{ kind: 'pull-request', number: prNumber, snapshot: fetched.value }];
+    const plans = resources.map((resource) => ({
+        ...resource,
+        plan: planInLabelUpdate({
+            changedFiles: files.value, currentLabels: resource.snapshot.labels,
+            mapping: mapping.value, repositoryLabels: repositoryLabels.value
+        })
+    }));
+    const operations = [
+        { name: 'closing-issues', status: 'no-op', reasonCode: association.value.length === 1 ? null : association.value.length === 0 ? 'ISSUE_ASSOCIATION_NONE' : 'ISSUE_ASSOCIATION_AMBIGUOUS' },
+        ...plans.map((item) => ({
+            name: `labels:in:${item.kind}`,
+            status: !context.capabilities.triage ? 'skipped' : item.plan.changed ? 'planned' : 'no-op',
+            reasonCode: !context.capabilities.triage ? 'TRIAGE_REQUIRED' : null
+        }))
+    ];
+    const willWrite = context.capabilities.triage && !options.dryRun;
+    const resourcesState = plans.map((item) => inLabelResource(item.kind, item.number, item.snapshot.labels, target, item.plan.changed && willWrite ? null : item.snapshot.labels, item.plan.changed && willWrite ? 'unknown' : 'no-op'));
+    if (options.dryRun || !context.capabilities.triage)
+        return result(!context.capabilities.triage || association.value.length !== 1 ? 'degraded' : plans.some((item) => item.plan.changed) ? 'planned' : 'no-op', null, issueNumber, prNumber, {
+            platform: context.platform, capabilities: context.capabilities, pullRequest: fetched.value,
+            resource: { kind: 'pull-request', number: prNumber }, operations, resources: resourcesState,
+            evidence: { kind: 'pull-request-files', pullRequestFiles: files.value, closingIssues: association.value }, error: null
+        });
+    let currentPullRequest = fetched.value;
+    let successfulWrites = 0;
+    for (const item of plans) {
+        if (!item.plan.changed)
+            continue;
+        const synced = syncLabelDelta(client, repository, item.number, cwd, item.snapshot.labels, item.plan.target);
+        if (synced.status === 'failed' || synced.status === 'blocked') {
+            const state = resourcesState.find((resource) => resource.kind === item.kind && resource.number === item.number);
+            state.effect = synced.status === 'blocked' ? 'unknown' : 'no-op';
+            state.after = synced.status === 'blocked' ? null : item.snapshot.labels;
+            const partial = successfulWrites > 0 || synced.status === 'blocked';
+            const error = partial && synced.error
+                ? { ...synced.error, code: 'IN_LABEL_SYNC_PARTIAL', message: `In-label synchronization is partial or unknown: ${synced.error.message}` }
+                : synced.error;
+            return result(partial ? 'blocked' : synced.status, null, issueNumber, prNumber, {
+                changed: successfulWrites > 0 || synced.changed, platform: context.platform, capabilities: context.capabilities,
+                pullRequest: currentPullRequest, resource: { kind: 'pull-request', number: prNumber }, operations, resources: resourcesState,
+                evidence: { kind: 'pull-request-files', pullRequestFiles: files.value, closingIssues: association.value }, error
+            });
+        }
+        successfulWrites += synced.changed ? 1 : 0;
+        const reread = item.kind === 'issue'
+            ? inspectGitHubIssue(client, repository, item.number, cwd)
+            : inspectGitHubPullRequest(client, repository, item.number, cwd);
+        if (!reread.ok)
+            return result('blocked', null, issueNumber, prNumber, {
+                changed: true, platform: context.platform, capabilities: context.capabilities,
+                pullRequest: currentPullRequest, resource: { kind: 'pull-request', number: prNumber }, operations, resources: resourcesState,
+                evidence: { kind: 'pull-request-files', pullRequestFiles: files.value, closingIssues: association.value },
+                error: { ...reread.error, code: 'IN_LABEL_SYNC_PARTIAL', message: `In-label synchronization is partial or unknown: ${reread.error.message}` }
+            });
+        const after = reread.value.labels;
+        const state = resourcesState.find((resource) => resource.kind === item.kind && resource.number === item.number);
+        state.after = after;
+        state.effect = after.filter((label) => label.startsWith('in:')).sort().join('\0') === target.join('\0') ? 'applied' : 'unknown';
+        if (state.effect === 'unknown')
+            return result('blocked', null, issueNumber, prNumber, {
+                changed: true, platform: context.platform, capabilities: context.capabilities,
+                pullRequest: currentPullRequest, resource: { kind: 'pull-request', number: prNumber }, operations, resources: resourcesState,
+                evidence: { kind: 'pull-request-files', pullRequestFiles: files.value, closingIssues: association.value },
+                error: { code: 'IN_LABEL_SYNC_PARTIAL', message: `${item.kind} #${item.number} did not converge to the expected in: labels`, retryable: true }
+            });
+        if (item.kind === 'pull-request')
+            currentPullRequest = reread.value;
+    }
+    return result(association.value.length !== 1 ? 'degraded' : successfulWrites > 0 ? 'applied' : 'no-op', null, issueNumber, prNumber, {
+        changed: successfulWrites > 0, platform: context.platform, capabilities: context.capabilities,
+        pullRequest: currentPullRequest, resource: { kind: 'pull-request', number: prNumber },
+        operations: operations.map((operation) => operation.status === 'planned' ? { ...operation, status: 'applied' } : operation),
+        resources: resourcesState, evidence: { kind: 'pull-request-files', pullRequestFiles: files.value, closingIssues: association.value }, error: null
     });
 }
 function appendActivity(content, line) {
     const body = extractSection(content, ['活动日志', 'Activity Log']);
     return `${body.replace(/\s+$/, '')}${body.trim() ? '\n' : ''}${line}`;
 }
+function deliveryIdentity(pullRequest) {
+    return {
+        resource: pullRequestIdentity(pullRequest),
+        repository: pullRequest.repository,
+        url: pullRequest.url,
+        head: { ...pullRequest.head },
+        base: { ...pullRequest.base }
+    };
+}
+function factTimestamp(timestamp) {
+    return new Date(timestamp.replace(' ', 'T')).toISOString();
+}
+function boundFactFor(pullRequest, source, issue, verifiedAt) {
+    return buildBoundFact({
+        identity: deliveryIdentity(pullRequest),
+        source,
+        ...(typeof issue === 'object' ? { issueIdentity: issue } : { issueNumber: issue }),
+        verifiedAt: factTimestamp(verifiedAt),
+        remoteState: pullRequest.state,
+        mergedAt: pullRequest.state === 'closed' ? pullRequest.mergedAt : null,
+        mergeCommitSha: pullRequest.state === 'closed' ? pullRequest.mergeCommitSha : null
+    });
+}
 function writeCreateStarted(base, agent) {
     const starts = (base.content.match(/\*\*Create PR \[started\]\*\*/g) || []).length;
     const dones = (base.content.match(/\*\*Create PR\*\*/g) || []).length;
@@ -530,60 +806,93 @@ function writeCreateStarted(base, agent) {
         mutations: [{ kind: 'section', aliases: ['活动日志', 'Activity Log'], heading: '活动日志', body: appendActivity(base.content, `- ${metadata.timestamp} — **Create PR [started]** by ${agent} — started`) }]
     }, { repoRoot: base.resolved.repoRoot, metadataProvider: () => metadata });
 }
-function bindIdentity(base, pullRequest, agent, dryRun = false) {
-    if (base.prNumber && base.prNumber !== pullRequest.number)
+function bindIdentity(base, pullRequest, agent, source, dryRun = false, expectedHead, expectedHeadSha) {
+    const identity = validateWriterIdentity(base, pullRequest, {
+        expectedHead: source === 'explicit-bind' ? String(base.frontmatter.branch || '') : expectedHead,
+        expectedHeadSha,
+        errorCode: 'PR_BIND_IDENTITY_MISMATCH'
+    });
+    if (!identity.ok)
+        return { status: 'failed', error: identity.error };
+    if (base.prIdentity && !resourceIdentityEquals(base.prIdentity, pullRequestIdentity(pullRequest)))
         return { status: 'failed', error: {
-                code: 'PR_BIND_CONFLICT', message: `Task is already bound to PR #${base.prNumber}`
+                code: 'PR_BIND_CONFLICT', message: 'Task is already bound to a different pull request identity'
             } };
-    if (base.prNumber === pullRequest.number)
+    if (base.prIdentity && resourceIdentityEquals(base.prIdentity, pullRequestIdentity(pullRequest)) && base.fact?.state === 'bound') {
+        if (JSON.stringify(base.fact.identity) !== JSON.stringify(deliveryIdentity(pullRequest)))
+            return { status: 'failed', error: {
+                    code: 'PR_BIND_IDENTITY_MISMATCH', message: `Task binding for PR #${pullRequest.number} does not match the fetched pull request identity`
+                } };
         return { status: 'no-op', error: null };
+    }
     const current = fs.readFileSync(base.resolved.taskMdPath, 'utf8');
     const metadata = captureTaskWriteMetadata();
+    const fact = boundFactFor(pullRequest, source, taskIssueIdentity(base.frontmatter), metadata.timestamp);
+    const factMutation = factFrontmatterMutation(fact);
     return writeTask({
         taskRef: base.resolved.taskId,
         expectedState: 'active',
         dryRun,
         mutations: [
-            { kind: 'frontmatter', set: { pr_number: pullRequest.number, pr_status: 'created', assigned_to: agent } },
+            { kind: 'frontmatter', set: { ...factMutation.set, assigned_to: agent } },
             { kind: 'section', aliases: ['活动日志', 'Activity Log'], heading: '活动日志', body: appendActivity(current, `- ${metadata.timestamp} — **Create PR** by ${agent} — PR #${pullRequest.number} created → ${pullRequest.url}`) }
         ]
     }, { repoRoot: base.resolved.repoRoot, metadataProvider: () => metadata });
 }
-function bindPlatformPullRequest(taskRef, options) {
-    const base = resolvedContext(taskRef, options);
+async function bindPlatformPullRequest(taskRef, options) {
+    const base = await resolvedContext(taskRef, options);
     if (!base.ok)
         return base.output;
-    if (!Number.isInteger(options.pr) || options.pr <= 0)
-        return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
-            error: { code: 'PR_NUMBER_INVALID', message: 'PR number must be positive', retryable: false }
+    if (!base.fact)
+        return result('failed', base.resolved.taskId, base.issueNumber, null, {
+            error: { code: 'PR_DELIVERY_FACT_MISSING', message: 'Task has no pr_delivery_fact; repair the task metadata or create a new task', retryable: false }
         });
-    if (base.prNumber && base.prNumber !== options.pr)
+    let prIdentity;
+    try {
+        prIdentity = providerResourceToken(base.provider, 'pull-request', String(options.pr));
+    }
+    catch (error) {
+        return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, { error: { code: 'PLATFORM_IDENTITY_TOKEN_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false } });
+    }
+    const requestedNumber = resourceIdentityNumber(prIdentity);
+    if (base.prIdentity && !resourceIdentityEquals(base.prIdentity, prIdentity))
         return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
-            error: { code: 'PR_BIND_CONFLICT', message: `Task is already bound to PR #${base.prNumber}`, retryable: false }
+            error: { code: 'PR_BIND_CONFLICT', message: 'Task is already bound to a different pull request identity', retryable: false }
         });
-    const fetched = inspectGitHubPullRequest(base.client, base.context.platform.repository, options.pr, base.resolved.repoRoot);
-    if (!fetched.ok)
-        return result(fetched.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, { error: fetched.error });
-    const written = bindIdentity(base, fetched.value, options.agent, options.dryRun);
+    const inspected = await inspectExternalPullRequest(base, prIdentity);
+    if (inspected.status === 'failed' || inspected.status === 'blocked' || !inspected.pullRequest)
+        return inspected;
+    const initialIdentity = validateWriterIdentity(base, inspected.pullRequest, {
+        expectedHead: String(base.frontmatter.branch || ''),
+        errorCode: 'PR_BIND_IDENTITY_MISMATCH'
+    });
+    if (!initialIdentity.ok)
+        return result('failed', base.resolved.taskId, base.issueNumber, requestedNumber, {
+            pullRequest: inspected.pullRequest, error: initialIdentity.error
+        });
+    const written = bindIdentity(base, inspected.pullRequest, options.agent, 'explicit-bind', options.dryRun);
     if (written.status === 'failed')
-        return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
-            pullRequest: fetched.value, error: { code: written.error.code, message: written.error.message, retryable: false }
+        return result('failed', base.resolved.taskId, base.issueNumber, requestedNumber, {
+            pullRequest: inspected.pullRequest, error: { code: written.error.code, message: written.error.message, retryable: false }
         });
-    return result(options.dryRun ? 'planned' : written.status === 'no-op' ? 'no-op' : 'applied', base.resolved.taskId, base.issueNumber, options.dryRun ? base.prNumber : fetched.value.number, {
+    return result(options.dryRun ? 'planned' : written.status === 'no-op' ? 'no-op' : 'applied', base.resolved.taskId, base.issueNumber, options.dryRun ? base.prNumber : inspected.pullRequest.number, {
         changed: !options.dryRun && written.status === 'applied', platform: base.context.platform, capabilities: base.context.capabilities,
-        resource: { kind: 'pull-request', number: fetched.value.number }, pullRequest: fetched.value,
+        resource: { kind: 'pull-request', number: inspected.pullRequest.number, identity: pullRequestIdentity(inspected.pullRequest) }, pullRequest: inspected.pullRequest,
         operations: [{ name: 'task:bind-pr', status: options.dryRun ? 'planned' : written.status === 'no-op' ? 'no-op' : 'applied', reasonCode: null }], error: null
     });
 }
-function externalEvidenceNote(issueNumber, source, pullRequest) {
+function externalEvidenceNote(issueIdentity, source, pullRequest) {
     return [
         `authorization=${source}`,
-        externalIdentityEvidenceNote(issueNumber, pullRequest)
+        externalIdentityEvidenceNote(issueIdentity, pullRequest)
     ].join('; ');
 }
-function externalIdentityEvidenceNote(issueNumber, pullRequest) {
+function externalIdentityEvidenceNote(issueIdentity, pullRequest) {
+    const issueLabel = issueIdentity
+        ? issueIdentity.kind === 'number' ? `#${issueIdentity.value}` : `${issueIdentity.kind}:${issueIdentity.value}`
+        : 'unknown';
     return [
-        `issue=#${issueNumber}`,
+        `issue=${issueLabel}`,
         `pr=#${pullRequest.number}`,
         `url=${pullRequest.url}`,
         `base=${pullRequest.base.repository}:${pullRequest.base.ref}@${pullRequest.base.sha}`,
@@ -592,10 +901,14 @@ function externalIdentityEvidenceNote(issueNumber, pullRequest) {
         `mergeCommitSha=${pullRequest.mergeCommitSha}`
     ].join('; ');
 }
-function resolveExternalPullRequest(taskRef, options) {
-    const base = resolvedContext(taskRef, options);
+async function resolveExternalPullRequest(taskRef, options) {
+    const base = await resolvedContext(taskRef, options);
     if (!base.ok)
         return externalResult(base.output);
+    if (!base.fact)
+        return externalResult(result('failed', base.resolved.taskId, base.issueNumber, null, {
+            error: { code: 'PR_DELIVERY_FACT_MISSING', message: 'Task has no pr_delivery_fact; repair the task metadata or create a new task', retryable: false }
+        }));
     const inventory = inspectCompletionArtifacts(base.resolved.taskId, { repoRoot: base.resolved.repoRoot });
     if (inventory.status === 'failed')
         return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
@@ -617,25 +930,40 @@ function resolveExternalPullRequest(taskRef, options) {
             error: null
         }), { mode: 'normal' });
     }
-    if (!base.issueNumber)
+    if (!base.issueIdentity)
         return externalResult(result('failed', base.resolved.taskId, null, base.prNumber, {
             platform: base.context.platform,
             capabilities: base.context.capabilities,
             error: { code: 'EXTERNAL_DELIVERY_ISSUE_REQUIRED', message: 'External delivery requires a valid issue_number', retryable: false }
         }));
-    const inspected = inspectPlatformIssueClosingChangeRequests(base.context.platform.type, {
-        cwd: base.resolved.repoRoot,
-        repository: base.context.platform.repository,
-        issueNumber: base.issueNumber,
-        client: base.client
-    });
+    const inspected = base.provider.changeRequests?.listClosing
+        ? await base.provider.changeRequests.listClosing({
+            context: providerOperationContext(base.loadedContext),
+            issue: base.issueIdentity
+        })
+        : unsupportedProviderOperation(base.provider, 'changeRequests.listClosing');
     if (!inspected.ok || !inspected.value) {
-        const error = inspected.error || { code: 'PR_IDENTITY_INVALID', message: 'Closing PR inspection returned no candidates', retryable: false };
+        const error = 'error' in inspected && inspected.error
+            ? inspected.error
+            : { code: 'PR_IDENTITY_INVALID', message: 'Closing PR inspection returned no candidates', retryable: false };
         return externalResult(result(error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
             platform: base.context.platform, capabilities: base.context.capabilities, error
         }));
     }
-    const selected = selectExternalPullRequest(inspected.value, base.context.platform.repository, base.prNumber, options.pr ?? null);
+    const candidates = inspected.value.map((item) => normalizeProviderPullRequest(item, base.context.platform.repository, item.number || 0));
+    let explicitPrIdentity = null;
+    if (options.pr !== undefined) {
+        try {
+            explicitPrIdentity = providerResourceToken(base.provider, 'pull-request', String(options.pr));
+        }
+        catch (error) {
+            return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+                platform: base.context.platform, capabilities: base.context.capabilities,
+                error: { code: 'PLATFORM_IDENTITY_TOKEN_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
+            }));
+        }
+    }
+    const selected = selectExternalPullRequest(candidates, base.context.platform.repository, base.prIdentity, explicitPrIdentity);
     if (selected.status === 'normal')
         return externalResult(result('no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
             platform: base.context.platform,
@@ -649,8 +977,47 @@ function resolveExternalPullRequest(taskRef, options) {
             capabilities: base.context.capabilities,
             error: { code: selected.code, message: selected.message, retryable: false }
         }), { candidates: selected.candidates, eligible: selected.eligible });
-    const note = externalEvidenceNote(base.issueNumber, selected.source, selected.selected);
-    const identityNote = externalIdentityEvidenceNote(base.issueNumber, selected.selected);
+    const initialIdentity = validateWriterIdentity(base, selected.selected, { errorCode: 'PR_EXTERNAL_IDENTITY_MISMATCH' });
+    if (!initialIdentity.ok)
+        return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+            platform: base.context.platform, capabilities: base.context.capabilities,
+            pullRequest: selected.selected, error: initialIdentity.error
+        }), { candidates: selected.candidates, eligible: selected.eligible, selected: selected.selected });
+    const rechecked = base.provider.changeRequests?.inspect
+        ? await base.provider.changeRequests.inspect({
+            context: providerOperationContext(base.loadedContext),
+            target: pullRequestIdentity(selected.selected)
+        }).then((response) => response.ok
+            ? { ok: true, value: normalizeProviderPullRequest(response.value, base.context.platform.repository, selected.selected.number, selected.selected) }
+            : response)
+        : unsupportedProviderOperation(base.provider, 'changeRequests.inspect');
+    if (!rechecked.ok || !rechecked.value)
+        return externalResult(result(rechecked.ok ? 'failed' : rechecked.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+            platform: base.context.platform, capabilities: base.context.capabilities,
+            pullRequest: selected.selected,
+            error: rechecked.ok ? { code: 'PR_EXTERNAL_RECHECK_FAILED', message: 'Selected pull request recheck returned no identity', retryable: false } : rechecked.error
+        }), { candidates: selected.candidates, eligible: selected.eligible, selected: selected.selected });
+    if (!sameDeliveryIdentity(selected.selected, rechecked.value))
+        return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+            platform: base.context.platform, capabilities: base.context.capabilities,
+            pullRequest: rechecked.value,
+            error: { code: 'PR_EXTERNAL_IDENTITY_MISMATCH', message: 'Selected pull request identity changed before task binding', retryable: false }
+        }), { candidates: selected.candidates, eligible: selected.eligible, selected: rechecked.value });
+    const finalIdentity = validateWriterIdentity(base, rechecked.value, { errorCode: 'PR_EXTERNAL_IDENTITY_MISMATCH' });
+    if (!finalIdentity.ok)
+        return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+            platform: base.context.platform, capabilities: base.context.capabilities,
+            pullRequest: rechecked.value, error: finalIdentity.error
+        }), { candidates: selected.candidates, eligible: selected.eligible, selected: rechecked.value });
+    const finalEvidence = validateExternalMergedEvidence(selected.selected, rechecked.value);
+    if (!finalEvidence.ok)
+        return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+            platform: base.context.platform, capabilities: base.context.capabilities,
+            pullRequest: rechecked.value, error: finalEvidence.error
+        }), { candidates: selected.candidates, eligible: selected.eligible, selected: rechecked.value });
+    const selectedPullRequest = rechecked.value;
+    const note = externalEvidenceNote(base.issueIdentity, selected.source, selectedPullRequest);
+    const identityNote = externalIdentityEvidenceNote(base.issueIdentity, selectedPullRequest);
     const activityEntry = `**Bind External PR** by ${options.agent} — ${note}`;
     const auditLines = base.content.split(/\r?\n/).filter((line) => line.includes('**Bind External PR**'));
     const alreadyAudited = auditLines.some((line) => line.endsWith(identityNote));
@@ -658,25 +1025,25 @@ function resolveExternalPullRequest(taskRef, options) {
         return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
             platform: base.context.platform,
             capabilities: base.context.capabilities,
-            pullRequest: selected.selected,
+            pullRequest: selectedPullRequest,
             error: { code: 'PR_BIND_CONFLICT', message: 'Existing external PR audit evidence conflicts with the selected identity', retryable: false }
-        }), { candidates: selected.candidates, eligible: selected.eligible, selected: selected.selected });
-    if (alreadyAudited && base.prNumber !== selected.selected.number)
+        }), { candidates: selected.candidates, eligible: selected.eligible, selected: selectedPullRequest });
+    if (alreadyAudited && base.prIdentity && !resourceIdentityEquals(base.prIdentity, pullRequestIdentity(selectedPullRequest)))
         return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
             platform: base.context.platform,
             capabilities: base.context.capabilities,
-            pullRequest: selected.selected,
+            pullRequest: selectedPullRequest,
             error: { code: 'PR_BIND_CONFLICT', message: 'External PR audit evidence does not match the task binding', retryable: false }
-        }), { candidates: selected.candidates, eligible: selected.eligible, selected: selected.selected });
-    if (base.prNumber === selected.selected.number && alreadyAudited) {
+        }), { candidates: selected.candidates, eligible: selected.eligible, selected: selectedPullRequest });
+    if (base.prIdentity && resourceIdentityEquals(base.prIdentity, pullRequestIdentity(selectedPullRequest)) && alreadyAudited) {
         return externalResult(result('no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
             platform: base.context.platform,
             capabilities: base.context.capabilities,
-            resource: { kind: 'pull-request', number: selected.selected.number },
-            pullRequest: selected.selected,
+            resource: { kind: 'pull-request', number: selectedPullRequest.number },
+            pullRequest: selectedPullRequest,
             operations: [{ name: 'task:bind-external-pr', status: 'no-op', reasonCode: 'EVIDENCE_ALREADY_RECORDED' }],
             error: null
-        }), { mode: 'external', authorization: selected.source, candidates: selected.candidates, eligible: selected.eligible, selected: selected.selected });
+        }), { mode: 'external', authorization: selected.source, candidates: selected.candidates, eligible: selected.eligible, selected: selectedPullRequest });
     }
     const metadata = captureTaskWriteMetadata();
     const write = writeTask({
@@ -684,7 +1051,7 @@ function resolveExternalPullRequest(taskRef, options) {
         expectedState: 'active',
         dryRun: options.dryRun,
         mutations: [
-            { kind: 'frontmatter', set: { pr_number: selected.selected.number, pr_status: 'created', assigned_to: options.agent } },
+            { kind: 'frontmatter', set: { ...factFrontmatterMutation(boundFactFor(selectedPullRequest, selected.source === 'unique' ? 'external-unique' : 'external-explicit', base.issueNumber, metadata.timestamp)).set, assigned_to: options.agent } },
             { kind: 'section', aliases: ['活动日志', 'Activity Log'], heading: '活动日志', body: appendActivity(base.content, `- ${metadata.timestamp} — ${activityEntry}`) }
         ]
     }, { repoRoot: base.resolved.repoRoot, metadataProvider: () => metadata });
@@ -692,185 +1059,41 @@ function resolveExternalPullRequest(taskRef, options) {
         return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
             platform: base.context.platform,
             capabilities: base.context.capabilities,
-            pullRequest: selected.selected,
+            pullRequest: selectedPullRequest,
             error: { code: write.error.code, message: write.error.message, retryable: false }
-        }), { candidates: selected.candidates, eligible: selected.eligible, selected: selected.selected });
+        }), { candidates: selected.candidates, eligible: selected.eligible, selected: selectedPullRequest });
     const operationStatus = options.dryRun ? 'planned' : write.status === 'applied' ? 'applied' : 'no-op';
-    return externalResult(result(operationStatus, base.resolved.taskId, base.issueNumber, options.dryRun ? base.prNumber : selected.selected.number, {
+    return externalResult(result(operationStatus, base.resolved.taskId, base.issueNumber, options.dryRun ? base.prNumber : selectedPullRequest.number, {
         changed: !options.dryRun && write.changed,
         platform: base.context.platform,
         capabilities: base.context.capabilities,
-        resource: { kind: 'pull-request', number: selected.selected.number },
-        pullRequest: selected.selected,
+        resource: { kind: 'pull-request', number: selectedPullRequest.number },
+        pullRequest: selectedPullRequest,
         operations: [{ name: 'task:bind-external-pr', status: operationStatus, reasonCode: null }],
         error: null
-    }), { mode: 'external', authorization: selected.source, candidates: selected.candidates, eligible: selected.eligible, selected: selected.selected });
-}
-function createPlatformPullRequestUnlocked(taskRef, options) {
-    const base = resolvedContext(taskRef, options);
-    if (!base.ok)
-        return base.output;
-    if (!options.base || !options.head || !options.title.trim() || !options.body.trim())
-        return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
-            error: { code: 'PR_PAYLOAD_INVALID', message: 'base, head, title and body are required', retryable: false }
-        });
-    if (base.prNumber) {
-        const headCheck = verifyCreateHead(base, options.head);
-        if (!headCheck.ok)
-            return result(headCheck.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
-                platform: base.context.platform,
-                capabilities: base.context.capabilities,
-                error: headCheck.error
-            });
-        const inspected = inspectPlatformPullRequest(taskRef, options);
-        const identity = validateBoundPullRequest(base, inspected.pullRequest, options.head, options.base, headCheck.value);
-        if (!identity.ok)
-            return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
-                platform: base.context.platform,
-                capabilities: base.context.capabilities,
-                pullRequest: inspected.pullRequest,
-                error: identity.error
-            });
-        return { ...inspected, result: 'no_op' };
-    }
-    const headCheck = verifyCreateHead(base, options.head);
-    if (!headCheck.ok)
-        return result(headCheck.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, null, {
-            platform: base.context.platform,
-            capabilities: base.context.capabilities,
-            error: headCheck.error
-        });
-    const expectedHeadSha = headCheck.value;
-    const located = locatePullRequest(base, options.head, options.base, expectedHeadSha);
-    if (!located.ok && located.error.code === 'PR_IDENTITY_AMBIGUOUS')
-        return result('failed', base.resolved.taskId, base.issueNumber, null, {
-            platform: base.context.platform, capabilities: base.context.capabilities, error: located.error
-        });
-    if (!located.ok && located.error.code === 'PR_HEAD_SHA_MISMATCH')
-        return result('failed', base.resolved.taskId, base.issueNumber, null, {
-            platform: base.context.platform, capabilities: base.context.capabilities, error: located.error
-        });
-    if (options.dryRun)
-        return result('planned', base.resolved.taskId, base.issueNumber, null, {
-            platform: base.context.platform, capabilities: base.context.capabilities,
-            operations: [{ name: located.ok ? 'pr:reuse' : 'pr:create', status: 'planned', reasonCode: null }],
-            result: located.ok ? 'pr_reused' : 'pr_created', error: null
-        });
-    const started = writeCreateStarted(base, options.agent);
-    if (started.status === 'failed')
-        return result('failed', base.resolved.taskId, base.issueNumber, null, {
-            error: { code: started.error.code, message: started.error.message, retryable: false }
-        });
-    let pullRequest = located.ok ? located.value : null;
-    let created = false;
-    if (!pullRequest) {
-        const repository = base.context.platform.repository;
-        const response = base.client.json(['api', `repos/${repository}/pulls`, '-X', 'POST', '--input', '-'], {
-            cwd: base.resolved.repoRoot,
-            method: 'POST',
-            input: JSON.stringify({ title: options.title, body: options.body, head: options.head, base: options.base, draft: Boolean(options.draft) })
-        });
-        if (response.ok)
-            pullRequest = normalizePullRequest(response.value, repository);
-        else if (response.error.retryable) {
-            const recovered = locatePullRequest(base, options.head, options.base, expectedHeadSha);
-            if (recovered.ok)
-                pullRequest = recovered.value;
-            else
-                return result('blocked', base.resolved.taskId, base.issueNumber, null, {
-                    platform: base.context.platform, capabilities: base.context.capabilities,
-                    operations: [{ name: 'pr:create', status: 'failed', reasonCode: 'PR_CREATE_OUTCOME_UNKNOWN' }],
-                    error: { code: 'PR_CREATE_OUTCOME_UNKNOWN', message: response.error.message, retryable: true }
-                });
-        }
-        else
-            return result('failed', base.resolved.taskId, base.issueNumber, null, {
-                platform: base.context.platform, capabilities: base.context.capabilities,
-                operations: [{ name: 'pr:create', status: 'failed', reasonCode: response.error.code }], error: response.error
-            });
-        if (!pullRequest)
-            return result('failed', base.resolved.taskId, base.issueNumber, null, {
-                error: { code: 'PR_CREATE_RESPONSE_INVALID', message: 'PR create response lacks validated identity', retryable: false }
-            });
-        if (pullRequest.head.sha !== expectedHeadSha)
-            return result('failed', base.resolved.taskId, base.issueNumber, pullRequest.number, {
-                platform: base.context.platform, capabilities: base.context.capabilities,
-                resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest,
-                error: { code: 'PR_HEAD_SHA_MISMATCH', message: 'Created pull request head does not match the expected local HEAD', retryable: false }
-            });
-        created = true;
-    }
-    const bindHeadCheck = verifyCreateHead(base, options.head);
-    if (!bindHeadCheck.ok || bindHeadCheck.value !== expectedHeadSha) {
-        const error = bindHeadCheck.ok
-            ? { code: 'PR_REMOTE_HEAD_MISMATCH', message: 'Remote head changed before task binding', retryable: false }
-            : bindHeadCheck.error;
-        return result(error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, pullRequest.number, {
-            platform: base.context.platform, capabilities: base.context.capabilities,
-            resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest, error
-        });
-    }
-    const beforeBind = inspectGitHubPullRequest(base.client, base.context.platform.repository, pullRequest.number, base.resolved.repoRoot);
-    if (!beforeBind.ok || !beforeBind.value) {
-        const error = beforeBind.ok
-            ? { code: 'PR_BIND_RECHECK_FAILED', message: 'Pull request recheck returned no identity', retryable: false }
-            : beforeBind.error;
-        return result(error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, pullRequest.number, {
-            platform: base.context.platform, capabilities: base.context.capabilities,
-            resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest, error
-        });
-    }
-    if (beforeBind.value.head.sha !== expectedHeadSha
-        || beforeBind.value.head.ref !== expectedHead(base.context.platform.repository, options.head).ref
-        || beforeBind.value.base.ref !== options.base
-        || beforeBind.value.base.repository !== base.context.platform.repository)
-        return result('failed', base.resolved.taskId, base.issueNumber, pullRequest.number, {
-            platform: base.context.platform, capabilities: base.context.capabilities,
-            resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest: beforeBind.value,
-            error: { code: 'PR_BIND_IDENTITY_MISMATCH', message: 'Pull request identity changed before task binding', retryable: false }
-        });
-    pullRequest = beforeBind.value;
-    const refreshed = resolvedContext(taskRef, options);
-    if (!refreshed.ok)
-        return result('failed', base.resolved.taskId, base.issueNumber, null, {
-            pullRequest, error: { code: 'PR_CREATED_BIND_FAILED', message: pullRequest.url, retryable: false }
-        });
-    const bound = bindIdentity(refreshed, pullRequest, options.agent);
-    if (bound.status === 'failed')
-        return result('failed', base.resolved.taskId, base.issueNumber, null, {
-            platform: base.context.platform, capabilities: base.context.capabilities,
-            resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest,
-            operations: [{ name: created ? 'pr:create' : 'pr:reuse', status: 'applied', reasonCode: null }, { name: 'task:bind-pr', status: 'failed', reasonCode: bound.error.code }],
-            error: { code: 'PR_CREATED_BIND_FAILED', message: `${pullRequest.url}: ${bound.error.message}`, retryable: false }
-        });
-    return result('applied', base.resolved.taskId, base.issueNumber, pullRequest.number, {
-        changed: true, platform: base.context.platform, capabilities: base.context.capabilities,
-        resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest,
-        operations: [{ name: created ? 'pr:create' : 'pr:reuse', status: created ? 'applied' : 'no-op', reasonCode: null }, { name: 'task:bind-pr', status: 'applied', reasonCode: null }],
-        result: created ? 'pr_created' : 'pr_reused', error: null
-    });
+    }), { mode: 'external', authorization: selected.source, candidates: selected.candidates, eligible: selected.eligible, selected: selectedPullRequest });
 }
-function createPlatformPullRequest(taskRef, options) {
-    const base = resolvedContext(taskRef, options);
+async function createPlatformPullRequest(taskRef, options) {
+    const base = await resolvedContext(taskRef, options);
     if (!base.ok)
-        return base.output;
+        return withCreation(base.output, PRECONDITION_NOT_CREATED);
     if (!options.base || !options.head || !options.title.trim() || !options.body.trim()) {
-        return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+        return withCreation(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
             error: { code: 'PR_PAYLOAD_INVALID', message: 'base, head, title and body are required', retryable: false }
-        });
+        }), PRECONDITION_NOT_CREATED);
     }
     try {
-        return withTaskExecutionLock(base.resolved.repoRoot, base.resolved.taskId, 'platform-pr.create', () => createPlatformPullRequestUnlocked(taskRef, options));
+        return withTaskExecutionLock(base.resolved.repoRoot, base.resolved.taskId, 'platform-pr.create', () => createExternalPullRequest(taskRef, options, base));
     }
     catch (error) {
         if (error instanceof TaskExecutionLockError) {
-            return result('blocked', base.resolved.taskId, base.issueNumber, null, {
+            return withCreation(result('blocked', base.resolved.taskId, base.issueNumber, null, {
                 platform: base.context.platform,
                 capabilities: base.context.capabilities,
                 error: { code: error.code, message: error.message, retryable: true }
-            });
+            }), PRECONDITION_NOT_CREATED);
         }
-        return result('failed', base.resolved.taskId, base.issueNumber, null, {
+        return withCreation(result('failed', base.resolved.taskId, base.issueNumber, null, {
             platform: base.context.platform,
             capabilities: base.context.capabilities,
             error: {
@@ -878,13 +1101,147 @@ function createPlatformPullRequest(taskRef, options) {
                 message: error instanceof Error ? error.message : String(error),
                 retryable: false
             }
+        }), PRECONDITION_NOT_CREATED);
+    }
+}
+async function createExternalPullRequest(taskRef, options, base) {
+    if (!base.fact)
+        return withCreation(result('failed', base.resolved.taskId, base.issueNumber, null, {
+            error: { code: 'PR_DELIVERY_FACT_MISSING', message: 'Task has no pr_delivery_fact; repair the task metadata or create a new task', retryable: false }
+        }), PRECONDITION_NOT_CREATED);
+    const target = taskDeliveryTarget(base);
+    if (!target.ok)
+        return withCreation(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+            error: target.error
+        }), PRECONDITION_NOT_CREATED);
+    if (options.base !== target.value.baseRef)
+        return withCreation(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+            platform: base.context.platform,
+            capabilities: base.context.capabilities,
+            error: { code: 'PR_DELIVERY_TARGET_MISMATCH', message: `Pull request base '${options.base}' does not match delivery target '${target.value.baseRef}'`, retryable: false }
+        }), PRECONDITION_NOT_CREATED);
+    let verifiedHeadSha;
+    if (base.provider.changeRequests?.verifyHead) {
+        const verified = await base.provider.changeRequests.verifyHead({
+            context: providerOperationContext(base.loadedContext),
+            head: options.head
         });
+        if (!verified.ok)
+            return withCreation(providerPullRequestError(base, verified.error, base.prNumber), PRECONDITION_NOT_CREATED);
+        verifiedHeadSha = verified.value.sha;
+    }
+    if (base.prIdentity) {
+        const inspected = await inspectExternalPullRequest(base, base.prIdentity);
+        return inspected.status === 'failed' || inspected.status === 'blocked'
+            ? withCreation(inspected, PRECONDITION_NOT_CREATED)
+            : withCreation({ ...inspected, result: 'no_op' }, { kind: 'no-op', createdByCurrentOperation: false });
     }
+    if (options.dryRun)
+        return withCreation(result('planned', base.resolved.taskId, base.issueNumber, null, {
+            platform: base.context.platform,
+            capabilities: base.context.capabilities,
+            operations: [{ name: 'pr:create', status: 'planned', reasonCode: null }],
+            result: 'pr_created',
+            error: null
+        }), { kind: 'planned', action: 'create', createdByCurrentOperation: false });
+    const started = writeCreateStarted(base, options.agent);
+    if (started.status === 'failed')
+        return withCreation(result('failed', base.resolved.taskId, base.issueNumber, null, {
+            error: { code: started.error.code, message: started.error.message, retryable: false }
+        }), PRECONDITION_NOT_CREATED);
+    const created = base.provider.changeRequests?.create
+        ? await base.provider.changeRequests.create({
+            context: providerOperationContext(base.loadedContext),
+            base: options.base,
+            head: options.head,
+            title: options.title,
+            body: options.body,
+            draft: Boolean(options.draft),
+            mutation: { idempotencyKey: `pull-request:create:${base.resolved.taskId}` }
+        })
+        : unsupportedProviderOperation(base.provider, 'changeRequests.create');
+    if (!created.ok)
+        return withCreation(providerPullRequestError(base, created.error, null), { kind: 'unknown', errorCode: 'PR_CREATE_OUTCOME_UNKNOWN' });
+    const remoteId = String(created.value.remoteId || '');
+    let createdIdentity;
+    try {
+        createdIdentity = providerResourceIdentity(base.provider, 'pull-request', remoteId);
+    }
+    catch (error) {
+        return withCreation(result('failed', base.resolved.taskId, base.issueNumber, null, {
+            platform: base.context.platform, capabilities: base.context.capabilities,
+            error: { code: 'PR_CREATE_RESPONSE_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
+        }), { kind: 'created', createdByCurrentOperation: true });
+    }
+    const number = resourceIdentityNumber(createdIdentity);
+    const fallbackNumber = number ?? 0;
+    const fallback = normalizeProviderPullRequest({
+        id: remoteId,
+        identity: createdIdentity,
+        number: number || undefined,
+        state: 'open',
+        title: options.title,
+        body: options.body,
+        headSha: '',
+        baseSha: '',
+        head: { repository: base.context.platform.repository, ref: options.head, sha: '' },
+        base: { repository: base.context.platform.repository, ref: options.base, sha: '' },
+        displayUrl: `${base.provider.type}:${remoteId}`
+    }, base.context.platform.repository, fallbackNumber);
+    const inspected = base.provider.changeRequests?.inspect
+        ? await base.provider.changeRequests.inspect({
+            context: providerOperationContext(base.loadedContext),
+            target: createdIdentity
+        })
+        : unsupportedProviderOperation(base.provider, 'changeRequests.inspect');
+    if (!inspected.ok)
+        return withCreation(providerPullRequestError(base, inspected.error, number), { kind: 'created', createdByCurrentOperation: true });
+    const pullRequest = normalizeProviderPullRequest(inspected.value, base.context.platform.repository, inspected.value.number ?? fallback.number, fallback);
+    if (!pullRequest.nodeId || !isUsableResourceIdentity(pullRequestIdentity(pullRequest)))
+        return withCreation(result('failed', base.resolved.taskId, base.issueNumber, null, {
+            platform: base.context.platform,
+            capabilities: base.context.capabilities,
+            error: { code: 'PR_CREATE_RESPONSE_INVALID', message: 'Provider create response lacks validated identity', retryable: false }
+        }), { kind: 'created', createdByCurrentOperation: true });
+    const identity = validateWriterIdentity(base, pullRequest, {
+        expectedHead: options.head,
+        expectedHeadSha: verifiedHeadSha,
+        errorCode: 'PR_BIND_IDENTITY_MISMATCH'
+    });
+    if (!identity.ok)
+        return withCreation(result('failed', base.resolved.taskId, base.issueNumber, pullRequest.number, {
+            platform: base.context.platform,
+            capabilities: base.context.capabilities,
+            resource: { kind: 'pull-request', number: pullRequest.number },
+            pullRequest,
+            error: identity.error
+        }), { kind: 'created', createdByCurrentOperation: true });
+    const bound = bindIdentity(base, pullRequest, options.agent, 'created', false, options.head);
+    if (bound.status === 'failed')
+        return withCreation(result('failed', base.resolved.taskId, base.issueNumber, pullRequest.number, {
+            platform: base.context.platform,
+            capabilities: base.context.capabilities,
+            resource: { kind: 'pull-request', number: pullRequest.number },
+            pullRequest,
+            error: { code: 'PR_CREATED_BIND_FAILED', message: `${pullRequest.url}: ${bound.error.message}`, retryable: false }
+        }), { kind: 'created', createdByCurrentOperation: true });
+    return withCreation(result('applied', base.resolved.taskId, base.issueNumber, pullRequest.number, {
+        changed: true,
+        platform: base.context.platform,
+        capabilities: base.context.capabilities,
+        resource: { kind: 'pull-request', number: pullRequest.number },
+        pullRequest,
+        operations: [{ name: 'pr:create', status: 'applied', reasonCode: null }, { name: 'task:bind-pr', status: 'applied', reasonCode: null }],
+        result: 'pr_created',
+        error: null
+    }), { kind: 'created', createdByCurrentOperation: true });
 }
-function syncPlatformPullRequest(taskRef, options) {
+async function syncPlatformPullRequest(taskRef, options) {
     const warningResult = warningResultForPrimary(options.primaryResult);
     const softenFailure = (output) => {
+        const authorityError = output.error?.code.startsWith('IN_LABEL_SYNC') || output.error?.code.startsWith('PR_IDENTITY');
         const warning = output.error && output.task.prNumber !== null
+            && !authorityError
             && !['PR_NOT_LINKED', 'PR_BIND_CONFLICT'].includes(output.error.code)
             ? {
                 code: output.error.code,
@@ -899,77 +1256,268 @@ function syncPlatformPullRequest(taskRef, options) {
             ? { ...output, status: 'applied', changed: false, error: null, result: warningResult, warnings: mergeOperationWarnings([warning]) }
             : output;
     };
-    const base = resolvedContext(taskRef, options);
+    const base = await resolvedContext(taskRef, options);
     if (!base.ok)
         return softenFailure(base.output);
-    if (!base.prNumber)
+    if (!base.fact)
         return softenFailure(result('failed', base.resolved.taskId, base.issueNumber, null, {
-            error: { code: 'PR_NOT_LINKED', message: 'Task has no valid pr_number', retryable: false }
-        }));
-    const fetched = inspectGitHubPullRequest(base.client, base.context.platform.repository, base.prNumber, base.resolved.repoRoot);
-    if (!fetched.ok)
-        return softenFailure(result(fetched.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, { error: fetched.error }));
-    if (!options.metadata && !options.closingIssue)
-        return softenFailure(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
-            error: { code: 'PR_PAYLOAD_INVALID', message: 'sync requires a desired-state option', retryable: false }
-        }));
-    if (!base.issueNumber)
-        return softenFailure(result('degraded', base.resolved.taskId, null, base.prNumber, {
-            pullRequest: fetched.value, error: { code: 'ISSUE_NOT_LINKED', message: 'Task has no linked Issue to copy metadata from', retryable: false }
-        }));
-    const issue = inspectPlatformIssue(taskRef, { cwd: base.resolved.repoRoot, client: base.client });
-    if (!issue.issue)
-        return softenFailure(result(issue.status, base.resolved.taskId, base.issueNumber, base.prNumber, {
-            platform: base.context.platform, capabilities: base.context.capabilities, pullRequest: fetched.value, error: issue.error
+            error: { code: 'PR_DELIVERY_FACT_MISSING', message: 'Task has no pr_delivery_fact; repair the task metadata or create a new task', retryable: false }
         }));
-    const planned = planPullRequestMetadata({
-        pullRequest: fetched.value,
-        issue: issue.issue,
-        taskType: base.frontmatter.type || 'task',
-        issueNumber: base.issueNumber,
-        capabilities: base.context.capabilities
-    }).operations.filter((operation) => options.metadata || operation.name === 'closing-issue')
-        .filter((operation) => options.closingIssue || operation.name !== 'closing-issue');
-    const operations = planned.map(({ name, status, reasonCode }) => ({ name, status, reasonCode }));
-    if (options.dryRun)
-        return softenFailure(result(planned.some((operation) => operation.status === 'planned') ? 'planned' : 'no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
-            platform: base.context.platform, capabilities: base.context.capabilities, pullRequest: fetched.value, operations, error: null
+    if (!base.prIdentity)
+        return softenFailure(result('failed', base.resolved.taskId, base.issueNumber, null, {
+            error: { code: 'PR_NOT_LINKED', message: 'Task has no verified bound pull request', retryable: false }
         }));
-    const payload = {};
-    for (const operation of planned) {
-        if (operation.status !== 'planned')
-            continue;
-        if (operation.name === 'labels')
-            payload.labels = operation.value;
-        if (operation.name === 'assignees')
-            payload.assignees = operation.value;
-        if (operation.name === 'closing-issue')
-            payload.body = operation.value;
-        if (operation.name === 'milestone') {
-            const milestones = base.client.json(['api', '--paginate', '--slurp', `repos/${base.context.platform.repository}/milestones?state=open&per_page=100`], { cwd: base.resolved.repoRoot });
+    {
+        const inspected = await inspectExternalPullRequest(base, base.prIdentity);
+        if (inspected.status === 'failed' || inspected.status === 'blocked' || !inspected.pullRequest)
+            return softenFailure(inspected);
+        if (!options.metadata && !options.closingIssue)
+            return softenFailure(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+                error: { code: 'PR_PAYLOAD_INVALID', message: 'sync requires a desired-state option', retryable: false }
+            }));
+        const issue = await inspectPlatformIssue(taskRef, { cwd: base.resolved.repoRoot, client: base.client });
+        if (!issue.issue)
+            return softenFailure(result(issue.status, base.resolved.taskId, base.issueNumber, base.prNumber, {
+                platform: base.context.platform, capabilities: base.context.capabilities, pullRequest: inspected.pullRequest, error: issue.error
+            }));
+        let inLabels = inspected.pullRequest.labels.filter((label) => label.startsWith('in:')).sort();
+        let issueInLabelOperation = null;
+        if (options.metadata && base.provider.issues?.listLabels) {
+            const labels = await base.provider.issues.listLabels({ context: providerOperationContext(base.loadedContext) });
+            if (!labels.ok)
+                return softenFailure(providerPullRequestError(base, labels.error, base.prNumber));
+            const target = taskInLabelTarget(base.resolved.repoRoot, base.frontmatter, inspected.pullRequest.labels, new Set(labels.value));
+            if (!target.ok)
+                return softenFailure(providerPullRequestError(base, target.error, base.prNumber));
+            inLabels = target.value;
+            const currentIssueLabels = issue.issue.labels.filter((label) => label.startsWith('in:')).sort();
+            issueInLabelOperation = base.context.capabilities.triage
+                ? currentIssueLabels.join('\0') === inLabels.join('\0')
+                    ? { name: 'labels:in:issue', status: 'no-op', reasonCode: null }
+                    : { name: 'labels:in:issue', status: 'planned', reasonCode: null }
+                : { name: 'labels:in:issue', status: 'skipped', reasonCode: 'TRIAGE_REQUIRED' };
+        }
+        const planned = planPullRequestMetadata({
+            pullRequest: inspected.pullRequest,
+            issue: issue.issue,
+            taskType: String(base.frontmatter.type || 'task'),
+            issueNumber: base.issueNumber,
+            capabilities: base.context.capabilities,
+            inLabels
+        }).operations.filter((operation) => options.metadata || operation.name === 'closing-issue')
+            .filter((operation) => options.closingIssue || operation.name !== 'closing-issue');
+        const operations = [
+            ...(issueInLabelOperation ? [issueInLabelOperation] : []),
+            ...planned.map(({ name, status, reasonCode }) => ({ name, status, reasonCode }))
+        ];
+        const milestoneOperation = planned.find((operation) => operation.name === 'milestone' && operation.status === 'planned');
+        if (milestoneOperation && base.provider.issues?.listMilestones) {
+            const milestones = await base.provider.issues.listMilestones({ context: providerOperationContext(base.loadedContext) });
             if (!milestones.ok)
-                return softenFailure(result(milestones.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, { pullRequest: fetched.value, operations, error: milestones.error }));
-            const flat = milestones.value.flatMap((entry) => Array.isArray(entry) ? entry : [entry]);
-            payload.milestone = flat.find((entry) => entry.title === operation.value)?.number ?? null;
+                return providerPullRequestError(base, milestones.error, base.prNumber);
         }
-    }
-    if (Object.keys(payload).length === 0) {
-        const degraded = planned.some((operation) => operation.status === 'skipped');
-        return softenFailure(result(degraded ? 'degraded' : 'no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
-            platform: base.context.platform, capabilities: base.context.capabilities, resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: fetched.value, operations, error: null
+        if (options.dryRun)
+            return softenFailure(result(planned.some((operation) => operation.status === 'planned') ? 'planned' : 'no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
+                platform: base.context.platform, capabilities: base.context.capabilities, pullRequest: inspected.pullRequest, operations, error: null
+            }));
+        let issueChanged = false;
+        if (issueInLabelOperation?.status === 'planned') {
+            const desiredIssueLabels = [...new Set([
+                    ...issue.issue.labels.filter((label) => !label.startsWith('in:')),
+                    ...inLabels
+                ])].sort();
+            const updatedIssue = base.provider.issues?.update
+                ? await base.provider.issues.update({
+                    context: providerOperationContext(base.loadedContext),
+                    target: base.issueIdentity,
+                    currentLabels: issue.issue.labels,
+                    patch: { labels: desiredIssueLabels },
+                    mutation: { idempotencyKey: `issue:update:${base.resolved.taskId}:in-labels` }
+                })
+                : unsupportedProviderOperation(base.provider, 'issues.update');
+            if (!updatedIssue.ok)
+                return softenFailure(providerPullRequestError(base, updatedIssue.error, base.prNumber));
+            issueChanged = updatedIssue.value.changed;
+            const rereadIssue = base.provider.issues?.inspect
+                ? await base.provider.issues.inspect({ context: providerOperationContext(base.loadedContext), target: base.issueIdentity })
+                : unsupportedProviderOperation(base.provider, 'issues.inspect');
+            if (!rereadIssue.ok)
+                return softenFailure(providerPullRequestError(base, {
+                    ...rereadIssue.error,
+                    code: 'IN_LABEL_SYNC_PARTIAL',
+                    message: `In-label synchronization is partial or unknown: ${rereadIssue.error.message}`
+                }, base.prNumber));
+            const actualIssueLabels = rereadIssue.value.labels.filter((label) => label.startsWith('in:')).sort();
+            if (actualIssueLabels.join('\0') !== inLabels.join('\0'))
+                return softenFailure(providerPullRequestError(base, {
+                    code: 'IN_LABEL_SYNC_PARTIAL',
+                    message: 'Issue in: labels did not converge after update',
+                    retryable: true
+                }, base.prNumber));
+        }
+        const patch = {};
+        for (const operation of planned) {
+            if (operation.status !== 'planned')
+                continue;
+            if (operation.name === 'labels')
+                patch.labels = operation.value;
+            if (operation.name === 'assignees')
+                patch.assignees = operation.value;
+            if (operation.name === 'closing-issue')
+                patch.body = operation.value;
+            if (operation.name === 'milestone')
+                patch.milestone = operation.value;
+        }
+        if (Object.keys(patch).length === 0)
+            return softenFailure(result(planned.some((operation) => operation.status === 'skipped') ? 'degraded' : 'no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
+                platform: base.context.platform, capabilities: base.context.capabilities, resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: inspected.pullRequest, operations, error: null
+            }));
+        const updated = base.provider.changeRequests?.update
+            ? await base.provider.changeRequests.update({
+                context: providerOperationContext(base.loadedContext),
+                target: base.prIdentity,
+                currentLabels: inspected.pullRequest.labels,
+                patch: patch,
+                mutation: { idempotencyKey: `pull-request:update:${base.resolved.taskId}` }
+            })
+            : unsupportedProviderOperation(base.provider, 'changeRequests.update');
+        if (!updated.ok) {
+            const error = issueChanged && !updated.error.code.startsWith('IN_LABEL_SYNC')
+                ? { ...updated.error, code: 'IN_LABEL_SYNC_PARTIAL', message: `In-label synchronization is partial or unknown: ${updated.error.message}` }
+                : updated.error;
+            return softenFailure(providerPullRequestError(base, error, base.prNumber));
+        }
+        let finalPullRequest = inspected.pullRequest;
+        if (planned.some((operation) => operation.name === 'labels' && operation.status === 'planned')) {
+            const reread = base.provider.changeRequests?.inspect
+                ? await base.provider.changeRequests.inspect({ context: providerOperationContext(base.loadedContext), target: base.prIdentity })
+                : unsupportedProviderOperation(base.provider, 'changeRequests.inspect');
+            if (!reread.ok)
+                return softenFailure(providerPullRequestError(base, {
+                    ...reread.error,
+                    code: 'IN_LABEL_SYNC_PARTIAL',
+                    message: `In-label synchronization is partial or unknown: ${reread.error.message}`
+                }, base.prNumber));
+            finalPullRequest = normalizeProviderPullRequest(reread.value, base.context.platform.repository, base.prNumber || 0, inspected.pullRequest);
+            const expected = ((planned.find((operation) => operation.name === 'labels')?.value || [])
+                .filter((label) => label.startsWith('in:') || label.startsWith('type:'))).sort();
+            const actual = finalPullRequest.labels.filter((label) => label.startsWith('in:') || label.startsWith('type:')).sort();
+            if (actual.join('\0') !== expected.join('\0'))
+                return softenFailure(providerPullRequestError(base, {
+                    code: 'IN_LABEL_SYNC_PARTIAL',
+                    message: 'Pull request labels did not converge after update',
+                    retryable: true
+                }, base.prNumber));
+        }
+        return softenFailure(result(planned.some((operation) => operation.status === 'skipped') ? 'degraded' : 'applied', base.resolved.taskId, base.issueNumber, base.prNumber, {
+            changed: issueChanged || updated.value.changed,
+            platform: base.context.platform,
+            capabilities: base.context.capabilities,
+            resource: { kind: 'pull-request', number: base.prNumber },
+            pullRequest: finalPullRequest,
+            operations: operations.map((operation) => operation.status === 'planned' ? { ...operation, status: 'applied' } : operation),
+            error: null
         }));
     }
-    const patched = base.client.json(['api', `repos/${base.context.platform.repository}/issues/${base.prNumber}`, '-X', 'PATCH', '--input', '-'], {
-        cwd: base.resolved.repoRoot, method: 'PATCH', input: JSON.stringify(payload)
+}
+function readProjectPrFlow(repoRoot) {
+    try {
+        const config = JSON.parse(fs.readFileSync(path.join(repoRoot, '.agents', '.airc.json'), 'utf8'));
+        return config.prFlow === 'required' || config.prFlow === 'disabled' ? config.prFlow : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function skipPlatformPullRequestFactUnlocked(resolved, options) {
+    let content;
+    let frontmatter;
+    try {
+        content = fs.readFileSync(resolved.taskMdPath, 'utf8');
+        frontmatter = parseTypedTaskFrontmatter(content);
+    }
+    catch (error) {
+        return result('failed', resolved.taskId, null, null, {
+            error: { code: 'TASK_DOCUMENT_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
+        });
+    }
+    let issueIdentity;
+    try {
+        issueIdentity = taskIssueIdentity(frontmatter, undefined, options.runtimeVersion);
+    }
+    catch (error) {
+        return result('failed', resolved.taskId, null, null, { error: { ...taskIssueIdentityError(error), retryable: false } });
+    }
+    const issueNumber = resourceIdentityNumber(issueIdentity);
+    const existing = readPrDeliveryFact(frontmatter, options.runtimeVersion);
+    if (existing.status === 'invalid')
+        return result('failed', resolved.taskId, issueNumber, null, {
+            error: { code: existing.error.code, message: existing.error.message, retryable: false }
+        });
+    if (existing.status === 'missing')
+        return result('failed', resolved.taskId, issueNumber, null, {
+            error: { code: 'PR_DELIVERY_FACT_MISSING', message: 'Task has no pr_delivery_fact; repair the task metadata or create a new task', retryable: false }
+        });
+    if (existing.fact.state === 'skipped')
+        return result('no-op', resolved.taskId, issueNumber, null, {
+            operations: [{ name: 'task:skip-pr', status: 'no-op', reasonCode: null }],
+            error: null
+        });
+    if (existing.fact.state === 'bound') {
+        const boundNumber = resourceIdentityNumber(existing.fact.identity.resource);
+        return result('failed', resolved.taskId, issueNumber, boundNumber, {
+            error: { code: 'PR_DELIVERY_FACT_CONFLICT', message: `Task is already bound to PR ${boundNumber === null ? 'identity' : `#${boundNumber}`}`, retryable: false }
+        });
+    }
+    if (readProjectPrFlow(resolved.repoRoot) === 'required')
+        return result('failed', resolved.taskId, issueNumber, null, {
+            error: { code: 'PR_SKIP_FORBIDDEN', message: 'Cannot skip PR delivery when prFlow is required', retryable: false }
+        });
+    const metadata = captureTaskWriteMetadata();
+    const fact = buildSkippedFact(factTimestamp(metadata.timestamp));
+    const write = writeTask({
+        taskRef: resolved.taskId,
+        expectedState: 'active',
+        dryRun: options.dryRun,
+        mutations: [
+            { kind: 'frontmatter', set: { ...factFrontmatterMutation(fact).set, assigned_to: options.agent } },
+            { kind: 'section', aliases: ['活动日志', 'Activity Log'], heading: '活动日志', body: appendActivity(content, `- ${metadata.timestamp} — **Skip PR** by ${options.agent} — PR delivery explicitly skipped`) }
+        ]
+    }, { repoRoot: resolved.repoRoot, metadataProvider: () => metadata });
+    if (write.status === 'failed')
+        return result('failed', resolved.taskId, issueNumber, null, {
+            error: { code: write.error.code, message: write.error.message, retryable: false }
+        });
+    const status = options.dryRun ? 'planned' : write.status === 'no-op' ? 'no-op' : 'applied';
+    return result(status, resolved.taskId, issueNumber, null, {
+        changed: !options.dryRun && write.changed,
+        operations: [{ name: 'task:skip-pr', status, reasonCode: null }],
+        error: null
     });
-    if (!patched.ok)
-        return softenFailure(result(patched.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, { pullRequest: fetched.value, operations, error: patched.error }));
-    return softenFailure(result(planned.some((operation) => operation.status === 'skipped') ? 'degraded' : 'applied', base.resolved.taskId, base.issueNumber, base.prNumber, {
-        changed: true, platform: base.context.platform, capabilities: base.context.capabilities,
-        resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: fetched.value,
-        operations: operations.map((operation) => operation.status === 'planned' ? { ...operation, status: 'applied' } : operation), error: null
-    }));
 }
-export { bindPlatformPullRequest, createPlatformPullRequest, inspectGitHubPullRequest, inspectGitHubIssueClosingChangeRequests, inspectPlatformPullRequest, inspectPlatformPullRequestByNumber, normalizePullRequest, resolveGitHubChangeRequestGitEvidence, resolveExternalPullRequest, selectExternalPullRequest, selectPullRequest, syncPlatformPullRequest };
+async function skipPlatformPullRequestFact(taskRef, options) {
+    const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
+    if (!resolved.ok)
+        return result('failed', resolved.taskId, null, null, {
+            error: { code: resolved.code, message: resolved.message, retryable: false }
+        });
+    if (resolved.state !== 'active')
+        return result('failed', resolved.taskId, null, null, {
+            error: { code: 'TASK_STATE_INVALID', message: 'platform-pr skip requires an active task', retryable: false }
+        });
+    try {
+        return withTaskExecutionLock(resolved.repoRoot, resolved.taskId, 'platform-pr.skip', () => skipPlatformPullRequestFactUnlocked(resolved, options));
+    }
+    catch (error) {
+        if (error instanceof TaskExecutionLockError)
+            return result('blocked', resolved.taskId, null, null, {
+                error: { code: error.code, message: error.message, retryable: true }
+            });
+        return result('failed', resolved.taskId, null, null, {
+            error: { code: 'PR_SKIP_FAILED', message: error instanceof Error ? error.message : String(error), retryable: false }
+        });
+    }
+}
+export { bindPlatformPullRequest, createPlatformPullRequest, inspectGitHubPullRequest, inspectGitHubIssueClosingChangeRequests, inspectPlatformPullRequest, inspectPlatformPullRequestByNumber, normalizePullRequest, resolveExternalPullRequest, skipPlatformPullRequestFact, selectExternalPullRequest, selectPullRequest, syncPlatformPullRequest, syncPlatformPullRequestInLabels };
 export { warningResultForPrimary };
 //# sourceMappingURL=pull-requests.js.map