@fitlab-ai/agent-infra 0.9.11 → 0.9.13

package/lib/platform/pull-requests.ts

@@ -1,26 +1,52 @@
 import fs from 'node:fs';
+import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 
-import { parseTaskFrontmatter } from '../task/frontmatter.ts';
+import { parseTypedTaskFrontmatter } from '../task/frontmatter.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
 import { extractSection } from '../task/sections.ts';
 import { captureTaskWriteMetadata, writeTask } from '../task/write.ts';
-import {
-  inspectPlatformChangeRequest,
-  inspectPlatformIssueClosingChangeRequests,
-  registerPlatformCapabilities
-} from './adapters.ts';
 import type { PlatformChangeRequestSnapshot } from './adapters.ts';
-import { parseGitHubRemote, resolvePlatformContext } from './context.ts';
+import { parseGitHubRemote, resolvePlatformContext, resolvePlatformProviderContext } from './context.ts';
+import type { PlatformClient } from './context.ts';
 import { createGitHubClient } from './github-client.ts';
-import type { GitHubClient } from './github-client.ts';
 import { inspectPlatformIssue } from './issues.ts';
+import { inspectGitHubIssue } from './issues.ts';
+import type { IssueSnapshot } from './issues.ts';
 import { planPullRequestMetadata } from './pull-request-metadata.ts';
+import {
+  extractPullRequestFileNames,
+  planInLabelUpdate,
+  syncLabelDelta,
+  validateInLabelMapping,
+  validateRepositoryLabelPayload
+} from './in-label-sync.ts';
 import { platformResult } from './types.ts';
 import type { PlatformOperation, PlatformResult } from './types.ts';
 import { inspectCompletionArtifacts } from '../task/finalization-artifacts.ts';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.ts';
+import { resolveDeliveryTarget } from '../task/delivery-target.ts';
 import { mergeOperationWarnings, type OperationWarning } from '../task/operation-outcome.ts';
+import {
+  buildBoundFact,
+  buildSkippedFact,
+  factFrontmatterMutation,
+  readPrDeliveryFact
+} from '../task/pr-delivery-fact.ts';
+import type { CreationOutcome, PrDeliveryBindingSource, PrDeliveryFact } from '../task/pr-delivery-fact.ts';
+import {
+  providerError,
+  providerOperationContext,
+  providerStatus,
+  providerResourceToken,
+  providerResourceIdentity,
+  resourceIdentity,
+  unsupportedProviderOperation
+} from './provider-bridge.ts';
+import { isResourceIdentity, resourceIdentityEquals, resourceIdentityNumber } from './resource-identity.ts';
+import type { ResourceIdentity } from './resource-identity.ts';
+import { taskIssueIdentity, taskIssueIdentityError } from './task-identities.ts';
+import type { ChangeRequestSnapshot as ProviderChangeRequestSnapshot } from './provider-contract.ts';
 
 type PullRequestSnapshot = PlatformChangeRequestSnapshot;
 
@@ -28,10 +54,21 @@ type PullRequestResult = PlatformResult & {
   task: { id: string | null; issueNumber: number | null; prNumber: number | null };
   pullRequest: PullRequestSnapshot | null;
   result: 'pr_created' | 'pr_reused' | 'no_op' | 'pr_created_with_warnings' | 'pr_reused_with_warnings' | 'no_op_with_warnings' | 'failed' | 'blocked' | null;
+  creation: CreationOutcome | null;
   warnings: readonly OperationWarning[];
+  evidence?: { kind: string; pullRequestFiles?: string[]; closingIssues?: number[] };
+  resources?: Array<{
+    kind: 'issue' | 'pull-request';
+    number: number;
+    before: string[];
+    expected: string[];
+    after: string[] | null;
+    effect: 'no-op' | 'applied' | 'unknown';
+  }>;
 };
-type InspectionOptions = { cwd?: string; client?: unknown };
-type SharedOptions = { cwd?: string; client?: GitHubClient };
+type GitHubClient = PlatformClient;
+type InspectionOptions = { cwd?: string; client?: PlatformClient; runtimeVersion?: string };
+type SharedOptions = { cwd?: string; client?: PlatformClient; runtimeVersion?: string };
 type CreateOptions = SharedOptions & {
   agent: string;
   base: string;
@@ -40,11 +77,13 @@ type CreateOptions = SharedOptions & {
   body: string;
   draft?: boolean;
   dryRun?: boolean;
+  phase?: { value: CreatePhase };
 };
-type BindOptions = SharedOptions & { agent: string; pr: number; dryRun?: boolean };
+type BindOptions = SharedOptions & { agent: string; pr: string | number; dryRun?: boolean };
 type PullRequestPrimaryResult = 'pr_created' | 'pr_reused' | 'no_op';
 type SyncOptions = SharedOptions & { agent: string; metadata?: boolean; closingIssue?: boolean; dryRun?: boolean; primaryResult: PullRequestPrimaryResult };
-type ResolveExternalOptions = SharedOptions & { agent: string; pr?: number; dryRun?: boolean };
+type ResolveExternalOptions = SharedOptions & { agent: string; pr?: string | number; dryRun?: boolean };
+type SkipFactOptions = { cwd?: string; agent: string; dryRun?: boolean; runtimeVersion?: string };
 type ExternalPullRequestSelection =
   | { status: 'normal'; candidates: PullRequestSnapshot[]; eligible: [] }
   | { status: 'selected'; source: 'unique' | 'explicit'; selected: PullRequestSnapshot; candidates: PullRequestSnapshot[]; eligible: PullRequestSnapshot[] }
@@ -57,6 +96,8 @@ type ExternalPullRequestResult = PullRequestResult & {
   selected: PullRequestSnapshot | null;
 };
 
+type CreatePhase = 'before-post' | 'post-dispatched' | 'post-accepted';
+
 type RemotePullRequest = {
   number?: number;
   node_id?: string;
@@ -123,6 +164,7 @@ function result(
     task: { id: taskId, issueNumber, prNumber },
     pullRequest: null,
     result: null,
+    creation: null,
     warnings: [],
     ...overrides
   };
@@ -144,6 +186,14 @@ function externalResult(
   };
 }
 
+function withCreation(output: PullRequestResult, creation: CreationOutcome): PullRequestResult {
+  return { ...output, creation };
+}
+
+const PRECONDITION_NOT_CREATED: CreationOutcome = {
+  kind: 'not-created', reason: 'precondition-failed', createdByCurrentOperation: false
+};
+
 function normalizePullRequest(remote: RemotePullRequest, repository: string): PullRequestSnapshot | null {
   const number = Number(remote.number);
   const headRepository = remote.head?.repo?.full_name;
@@ -199,9 +249,17 @@ function repositoryKey(repository: string): string {
   return repository.trim().toLowerCase();
 }
 
+function isUsableResourceIdentity(identity: ResourceIdentity): boolean {
+  return isResourceIdentity(identity);
+}
+
+function identityLabel(identity: ResourceIdentity): string {
+  return identity.kind === 'number' ? `PR #${identity.value}` : `PR ${identity.kind}:${identity.value}`;
+}
+
 function identitySignature(pullRequest: PullRequestSnapshot): string {
   return [
-    pullRequest.repository, pullRequest.number, pullRequest.nodeId, pullRequest.url,
+    pullRequest.repository, JSON.stringify(pullRequestIdentity(pullRequest)), pullRequest.nodeId, pullRequest.url,
     pullRequest.head.repository, pullRequest.head.ref, pullRequest.head.sha,
     pullRequest.base.repository, pullRequest.base.ref, pullRequest.base.sha,
     pullRequest.mergedAt || '', pullRequest.mergeCommitSha || ''
@@ -214,54 +272,59 @@ function hasCompleteExternalIdentity(pullRequest: PullRequestSnapshot): boolean
     pullRequest.head.repository, pullRequest.head.ref, pullRequest.head.sha,
     pullRequest.base.repository, pullRequest.base.ref, pullRequest.base.sha
   ];
-  return Number.isInteger(pullRequest.number) && pullRequest.number > 0 &&
-    required.every((value) => Boolean(value?.trim())) &&
-    Boolean(pullRequest.mergedAt) === Boolean(pullRequest.mergeCommitSha);
+  return isUsableResourceIdentity(pullRequestIdentity(pullRequest)) && required.every((value) => Boolean(value?.trim())) &&
+    (pullRequest.state === 'open' || Boolean(pullRequest.mergedAt) === Boolean(pullRequest.mergeCommitSha));
 }
 
 function selectExternalPullRequest(
   candidates: PullRequestSnapshot[],
   repository: string,
-  existingPrNumber: number | null,
-  explicitPrNumber: number | null
+  existingPrIdentity: ResourceIdentity | number | null,
+  explicitPrIdentity: ResourceIdentity | number | null
 ): ExternalPullRequestSelection {
+  const existingIdentity = typeof existingPrIdentity === 'number'
+    ? resourceIdentity(existingPrIdentity) : existingPrIdentity;
+  const explicitIdentity = typeof explicitPrIdentity === 'number'
+    ? resourceIdentity(explicitPrIdentity) : explicitPrIdentity;
   const invalid = candidates.find((candidate) => !hasCompleteExternalIdentity(candidate));
   if (invalid) return {
     status: 'failed', code: 'PR_IDENTITY_INVALID',
     message: `Closing PR #${invalid.number} lacks required identity`, candidates, eligible: []
   };
-  const byNumber = new Map<number, string>();
+  const byIdentity = new Map<string, string>();
   for (const candidate of candidates) {
     const signature = identitySignature(candidate);
-    const prior = byNumber.get(candidate.number);
+    const identityKey = JSON.stringify(pullRequestIdentity(candidate));
+    const prior = byIdentity.get(identityKey);
     if (prior && prior !== signature) return {
       status: 'failed', code: 'PR_IDENTITY_INVALID',
       message: `Closing PR #${candidate.number} has conflicting identities`, candidates, eligible: []
     };
-    byNumber.set(candidate.number, signature);
+    byIdentity.set(identityKey, signature);
   }
   const unique = candidates.filter((candidate, index) =>
-    candidates.findIndex((other) => other.number === candidate.number) === index
+    candidates.findIndex((other) => resourceIdentityEquals(pullRequestIdentity(other), pullRequestIdentity(candidate))) === index
   );
   const wantedRepository = repositoryKey(repository);
   const eligible = unique.filter((candidate) =>
     repositoryKey(candidate.repository) === wantedRepository &&
     repositoryKey(candidate.base.repository) === wantedRepository &&
+    candidate.state === 'closed' &&
     Boolean(candidate.mergedAt && candidate.mergeCommitSha)
   );
-  if (explicitPrNumber !== null) {
-    const selected = unique.find((candidate) => candidate.number === explicitPrNumber);
-    if (!selected) return { status: 'failed', code: 'PR_NOT_FOUND', message: `PR #${explicitPrNumber} is not a closing PR`, candidates, eligible };
-    if (!eligible.some((candidate) => candidate.number === explicitPrNumber)) {
-      return { status: 'failed', code: 'PR_IDENTITY_INVALID', message: `PR #${explicitPrNumber} is not an eligible merged PR`, candidates, eligible };
+  if (explicitIdentity !== null) {
+    const selected = unique.find((candidate) => resourceIdentityEquals(pullRequestIdentity(candidate), explicitIdentity));
+    if (!selected) return { status: 'failed', code: 'PR_NOT_FOUND', message: `PR ${identityLabel(explicitIdentity)} is not a closing PR`, candidates, eligible };
+    if (!eligible.some((candidate) => resourceIdentityEquals(pullRequestIdentity(candidate), explicitIdentity))) {
+      return { status: 'failed', code: 'PR_IDENTITY_INVALID', message: `PR ${identityLabel(explicitIdentity)} is not an eligible merged PR`, candidates, eligible };
     }
-    if (existingPrNumber !== null && existingPrNumber !== explicitPrNumber) {
-      return { status: 'failed', code: 'PR_BIND_CONFLICT', message: `Task is already bound to PR #${existingPrNumber}`, candidates, eligible };
+    if (existingIdentity !== null && !resourceIdentityEquals(existingIdentity, explicitIdentity)) {
+      return { status: 'failed', code: 'PR_BIND_CONFLICT', message: `Task is already bound to ${identityLabel(existingIdentity)}`, candidates, eligible };
     }
     return { status: 'selected', source: 'explicit', selected, candidates, eligible };
   }
-  if (existingPrNumber !== null && eligible.length === 1 && existingPrNumber !== eligible[0]!.number) {
-    return { status: 'failed', code: 'PR_BIND_CONFLICT', message: `Task is already bound to PR #${existingPrNumber}`, candidates, eligible };
+  if (existingIdentity !== null && eligible.length === 1 && !resourceIdentityEquals(existingIdentity, pullRequestIdentity(eligible[0]!))) {
+    return { status: 'failed', code: 'PR_BIND_CONFLICT', message: `Task is already bound to ${identityLabel(existingIdentity)}`, candidates, eligible };
   }
   if (eligible.length === 0) return { status: 'normal', candidates, eligible: [] };
   if (eligible.length > 1) return {
@@ -340,64 +403,8 @@ function selectPullRequest(remotes: RemotePullRequest[], repository: string, hea
   return { status: matches.length === 0 ? 'missing' : 'ambiguous', pullRequest: null };
 }
 
-function repositoryHead(cwd: string): string {
-  return execFileSync('git', ['rev-parse', 'HEAD'], {
-    cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe']
-  }).trim();
-}
-
-function remoteBranchHead(cwd: string, repository: string, head: string):
-  | { ok: true; value: string }
-  | { ok: false; error: { code: string; message: string; retryable: boolean } } {
-  const wanted = expectedHead(repository, head);
-  if (!wanted.ref || !/^[A-Za-z0-9._/-]+$/.test(wanted.ref)) return {
-    ok: false,
-    error: { code: 'PR_HEAD_INVALID', message: 'Pull request head ref is invalid', retryable: false }
-  };
-  const remotes = configuredGitRemotes(cwd);
-  const remote = remotes.find((item) => repositoryKey(item.repository) === repositoryKey(wanted.repository))
-    ?? remotes.find((item) => item.name === 'origin');
-  if (!remote) return {
-    ok: false,
-    error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `No configured remote can verify ${wanted.repository}:${wanted.ref}`, retryable: false }
-  };
-  try {
-    const output = execFileSync('git', ['ls-remote', '--refs', remote.name, `refs/heads/${wanted.ref}`], {
-      cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe']
-    }).trim();
-    const match = output.split(/\r?\n/).map((line) => line.trim()).find((line) => line.endsWith(`refs/heads/${wanted.ref}`));
-    const sha = match?.split(/\s+/)[0] || null;
-    if (!sha || !/^[a-f0-9]{40}$/i.test(sha)) return {
-      ok: false,
-      error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `Remote branch ${wanted.repository}:${wanted.ref} does not exist`, retryable: false }
-    };
-    return { ok: true, value: sha };
-  } catch (error) {
-    return {
-      ok: false,
-      error: { code: 'PR_REMOTE_BRANCH_UNAVAILABLE', message: error instanceof Error ? error.message : String(error), retryable: true }
-    };
-  }
-}
-
-function verifyCreateHead(base: ReturnType<typeof resolvedContext> & { ok: true }, head: string) {
-  let localHead: string;
-  try {
-    localHead = repositoryHead(base.resolved.repoRoot);
-  } catch (error) {
-    return { ok: false as const, error: { code: 'PR_LOCAL_HEAD_UNAVAILABLE', message: error instanceof Error ? error.message : String(error), retryable: false } };
-  }
-  const remote = remoteBranchHead(base.resolved.repoRoot, base.context.platform.repository!, head);
-  if (!remote.ok) return remote;
-  if (remote.value !== localHead) return {
-    ok: false as const,
-    error: { code: 'PR_REMOTE_HEAD_MISMATCH', message: `Remote head ${remote.value} does not match local HEAD ${localHead}`, retryable: false }
-  };
-  return { ok: true as const, value: localHead };
-}
-
 function validateBoundPullRequest(
-  base: ReturnType<typeof resolvedContext> & { ok: true },
+  base: Awaited<ReturnType<typeof resolvedContext>> & { ok: true },
   pullRequest: PullRequestSnapshot | null,
   head: string,
   baseRef: string,
@@ -421,24 +428,187 @@ function validateBoundPullRequest(
   return { ok: true };
 }
 
-function resolvedContext(taskRef: string, options: InspectionOptions) {
+type BindingIdentityOptions = {
+  expectedHead?: string;
+  expectedHeadSha?: string;
+  errorCode?: string;
+};
+
+function resolveTaskDeliveryTarget(repoRoot: string, frontmatter: Record<string, unknown>) {
+  const existing = {
+    ...(typeof frontmatter.delivery_remote === 'string' && frontmatter.delivery_remote
+      ? { remote: frontmatter.delivery_remote } : {}),
+    ...(typeof frontmatter.delivery_base_ref === 'string' && frontmatter.delivery_base_ref
+      ? { baseRef: frontmatter.delivery_base_ref } : {})
+  };
+  const target = resolveDeliveryTarget(repoRoot, existing);
+  return target.ok
+    ? { ok: true as const, value: target.value }
+    : { ok: false as const, error: { code: target.code, message: target.message, retryable: false } };
+}
+
+function taskDeliveryTarget(base: Awaited<ReturnType<typeof resolvedContext>> & { ok: true }) {
+  return resolveTaskDeliveryTarget(base.resolved.repoRoot, base.frontmatter);
+}
+
+function validateIdentityAgainstTarget(
+  repository: string,
+  target: { remote: string; baseRef: string },
+  pullRequest: PullRequestSnapshot | null,
+  options: BindingIdentityOptions = {}
+): { ok: true } | { ok: false; error: { code: string; message: string; retryable: boolean } } {
+  if (!pullRequest || !hasCompleteExternalIdentity(pullRequest)) return {
+    ok: false,
+    error: { code: options.errorCode || 'PR_BIND_IDENTITY_MISMATCH', message: 'Pull request identity is incomplete', retryable: false }
+  };
+  const wantedHead = options.expectedHead ? expectedHead(repository, options.expectedHead) : null;
+  const matches = repositoryKey(pullRequest.repository) === repositoryKey(repository)
+    && repositoryKey(pullRequest.base.repository) === repositoryKey(repository)
+    && pullRequest.base.ref === target.baseRef
+    && (!wantedHead || (repositoryKey(pullRequest.head.repository) === repositoryKey(wantedHead.repository) && pullRequest.head.ref === wantedHead.ref))
+    && (!options.expectedHeadSha || pullRequest.head.sha === options.expectedHeadSha);
+  if (!matches) return {
+    ok: false,
+    error: {
+      code: options.errorCode || 'PR_BIND_IDENTITY_MISMATCH',
+      message: 'Pull request identity does not match the task branch and delivery target',
+      retryable: false
+    }
+  };
+  return { ok: true };
+}
+
+function validateWriterIdentity(
+  base: Awaited<ReturnType<typeof resolvedContext>> & { ok: true },
+  pullRequest: PullRequestSnapshot | null,
+  options: BindingIdentityOptions = {}
+): { ok: true } | { ok: false; error: { code: string; message: string; retryable: boolean } } {
+  const target = taskDeliveryTarget(base);
+  if (!target.ok) return target;
+  return validateIdentityAgainstTarget(base.context.platform.repository!, target.value, pullRequest, options);
+}
+
+function sameDeliveryIdentity(left: PullRequestSnapshot, right: PullRequestSnapshot): boolean {
+  return JSON.stringify(deliveryIdentity(left)) === JSON.stringify(deliveryIdentity(right));
+}
+
+function validateExternalMergedEvidence(
+  initial: PullRequestSnapshot,
+  rechecked: PullRequestSnapshot
+): { ok: true } | { ok: false; error: { code: string; message: string; retryable: boolean } } {
+  if (
+    initial.state !== 'closed'
+    || !initial.mergedAt
+    || !initial.mergeCommitSha
+    || rechecked.state !== 'closed'
+    || !rechecked.mergedAt
+    || !rechecked.mergeCommitSha
+    || initial.mergedAt !== rechecked.mergedAt
+    || initial.mergeCommitSha !== rechecked.mergeCommitSha
+  ) return {
+    ok: false,
+    error: { code: 'PR_EXTERNAL_IDENTITY_MISMATCH', message: 'Selected pull request merged evidence changed before task binding', retryable: false }
+  };
+  return { ok: true };
+}
+
+async function resolvedContext(taskRef: string, options: InspectionOptions) {
   const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
   if (!resolved.ok) return { ok: false as const, output: result('failed', resolved.taskId, null, null, {
     error: { code: resolved.code, message: resolved.message, retryable: false }
   }) };
   const content = fs.readFileSync(resolved.taskMdPath, 'utf8');
-  const frontmatter = parseTaskFrontmatter(content);
-  const issue = Number(frontmatter.issue_number);
-  const pr = Number(frontmatter.pr_number);
-  const issueNumber = Number.isInteger(issue) && issue > 0 ? issue : null;
-  const prNumber = Number.isInteger(pr) && pr > 0 ? pr : null;
-  const client = (options.client as GitHubClient | undefined) || createGitHubClient();
-  const context = resolvePlatformContext({ cwd: resolved.repoRoot, client });
+  const frontmatter = parseTypedTaskFrontmatter(content);
+  const factRead = readPrDeliveryFact(frontmatter, options.runtimeVersion);
+  if (factRead.status === 'invalid') return { ok: false as const, output: result('failed', resolved.taskId, null, null, {
+    error: { code: factRead.error.code, message: factRead.error.message, retryable: false }
+  }) };
+  const fact = factRead.status === 'valid' ? factRead.fact : null;
+  let issueIdentity: ResourceIdentity | null;
+  try { issueIdentity = taskIssueIdentity(frontmatter, undefined, options.runtimeVersion); }
+  catch (error) { return { ok: false as const, output: result('failed', resolved.taskId, null, null, { error: { ...taskIssueIdentityError(error), retryable: false } }) }; }
+  const issueNumber = resourceIdentityNumber(issueIdentity);
+  const prIdentity = fact?.state === 'bound' ? fact.identity.resource : null;
+  const prNumber = resourceIdentityNumber(prIdentity);
+  const client = options.client;
+  const loaded = await resolvePlatformProviderContext({ cwd: resolved.repoRoot, client });
+  const context = loaded.ok ? loaded.value.context : loaded.context;
   const usable = (context.status === 'no-op' || context.status === 'degraded') && context.platform.repository;
-  if (!usable) return { ok: false as const, output: result(context.status, resolved.taskId, issueNumber, prNumber, {
+  if (!usable || !loaded.ok) return { ok: false as const, output: result(context.status, resolved.taskId, issueNumber, prNumber, {
     platform: context.platform, capabilities: context.capabilities, operations: context.operations, error: context.error
   }) };
-  return { ok: true as const, resolved, content, frontmatter, issueNumber, prNumber, client, context };
+  return { ok: true as const, resolved, content, frontmatter, fact, issueIdentity, issueNumber, prIdentity, prNumber, client, context, provider: loaded.value.provider, providerType: loaded.value.providerType, loadedContext: loaded.value };
+}
+
+function normalizeProviderPullRequest(
+  remote: ProviderChangeRequestSnapshot,
+  repository: string,
+  fallbackNumber: number,
+  fallback?: PullRequestSnapshot | null
+): PullRequestSnapshot {
+  const head = remote.head || fallback?.head || { repository, ref: '', sha: remote.headSha || '' };
+  const base = remote.base || fallback?.base || { repository, ref: '', sha: remote.baseSha || '' };
+  const identity = remote.identity || fallback?.identity || (remote.number ? { kind: 'number' as const, value: remote.number } : { kind: 'id' as const, value: remote.id });
+  const snapshot: PullRequestSnapshot = {
+    repository,
+    number: remote.number ?? resourceIdentityNumber(identity) ?? fallbackNumber,
+    nodeId: remote.id,
+    url: remote.displayUrl || fallback?.url || '',
+    state: remote.state === 'closed' ? 'closed' : 'open',
+    title: remote.title,
+    body: remote.body,
+    draft: remote.draft ?? fallback?.draft ?? false,
+    head: { ...head, sha: remote.headSha || head.sha },
+    base: { ...base, sha: remote.baseSha || base.sha },
+    mergedAt: remote.mergedAt ?? fallback?.mergedAt ?? null,
+    mergeCommitSha: remote.mergeCommitSha ?? fallback?.mergeCommitSha ?? null,
+    labels: [...(remote.labels || fallback?.labels || [])].sort(),
+    assignees: [...(remote.assignees || fallback?.assignees || [])].sort(),
+    milestone: remote.milestone ?? fallback?.milestone ?? null,
+    mergeability: remote.mergeability || fallback?.mergeability || { state: 'unknown', detail: null }
+  };
+  Object.defineProperty(snapshot, 'identity', { value: identity, enumerable: false, configurable: true });
+  return snapshot;
+}
+
+function pullRequestIdentity(pullRequest: PullRequestSnapshot): ResourceIdentity {
+  return pullRequest.identity || { kind: 'number', value: pullRequest.number };
+}
+
+function providerPullRequestError(
+  base: Awaited<ReturnType<typeof resolvedContext>> & { ok: true },
+  error: { code: string; message: string; retryable: boolean },
+  prNumber: number | null
+): PullRequestResult {
+  return result(error.code.startsWith('IN_LABEL_SYNC') ? 'blocked' : providerStatus(error), base.resolved.taskId, base.issueNumber, prNumber, {
+    changed: error.code.startsWith('IN_LABEL_SYNC'),
+    platform: base.context.platform,
+    capabilities: base.context.capabilities,
+    resource: { kind: 'pull-request', number: prNumber },
+    error: providerError(error, 'PLATFORM_PROVIDER_OPERATION_FAILED')
+  });
+}
+
+async function inspectExternalPullRequest(
+  base: Awaited<ReturnType<typeof resolvedContext>> & { ok: true },
+  prIdentity: ResourceIdentity
+): Promise<PullRequestResult> {
+  const prNumber = resourceIdentityNumber(prIdentity);
+  const fallback = base.fact?.state === 'bound' && resourceIdentityEquals(base.fact.identity.resource, prIdentity)
+    ? base.fact.identity as unknown as PullRequestSnapshot
+    : null;
+  const inspected = base.provider.changeRequests?.inspect
+    ? await base.provider.changeRequests.inspect({ context: providerOperationContext(base.loadedContext), target: prIdentity })
+    : unsupportedProviderOperation(base.provider, 'changeRequests.inspect');
+  if (!inspected.ok) return providerPullRequestError(base, inspected.error, prNumber);
+  const pullRequest = normalizeProviderPullRequest(inspected.value, base.context.platform.repository!, prNumber || 0, fallback);
+  return result('no-op', base.resolved.taskId, base.issueNumber, prNumber, {
+    platform: base.context.platform,
+    capabilities: base.context.capabilities,
+    resource: { kind: 'pull-request', number: prNumber, identity: prIdentity },
+    pullRequest,
+    error: null
+  });
 }
 
 function inspectGitHubPullRequest(client: GitHubClient, repository: string, number: number, cwd: string) {
@@ -450,200 +620,348 @@ function inspectGitHubPullRequest(client: GitHubClient, repository: string, numb
     : { ok: false as const, error: { code: 'PR_IDENTITY_INVALID', message: 'Remote resource is not a valid pull request', retryable: false } };
 }
 
-function configuredGitRemotes(cwd: string): Array<{ name: string; url: string; repository: string }> {
-  try {
-    return execFileSync('git', ['remote'], {
-      cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe']
-    }).split(/\r?\n/).filter(Boolean).flatMap((name) => {
-      try {
-        const url = execFileSync('git', ['config', '--get', `remote.${name}.url`], {
-          cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe']
-        }).trim();
-        const repository = parseGitHubRemote(url);
-        return repository ? [{ name, url, repository }] : [];
-      } catch {
-        return [];
-      }
+async function inspectPlatformPullRequest(taskRef: string, options: InspectionOptions = {}): Promise<PullRequestResult> {
+  const base = await resolvedContext(taskRef, options);
+  if (!base.ok) return base.output;
+  if (!base.fact) return result('no-op', base.resolved.taskId, base.issueNumber, null, {
+    error: { code: 'PR_DELIVERY_FACT_MISSING', message: 'Task has no pr_delivery_fact; repair the task metadata or create a new task', retryable: false }
+  });
+  if (!base.prIdentity) return result('no-op', base.resolved.taskId, base.issueNumber, null, {
+    platform: base.context.platform, capabilities: base.context.capabilities,
+    error: { code: 'PR_NOT_LINKED', message: 'Task has no verified bound pull request', retryable: false }
+  });
+  return inspectExternalPullRequest(base, base.prIdentity);
+}
+
+async function inspectPlatformPullRequestByNumber(prNumber: string | number, options: InspectionOptions = {}): Promise<PullRequestResult> {
+  const loaded = await resolvePlatformProviderContext({ cwd: options.cwd || process.cwd(), client: options.client });
+  const context = loaded.ok ? loaded.value.context : loaded.context;
+  const usable = (context.status === 'no-op' || context.status === 'degraded') && context.platform.repository;
+  if (!usable) {
+    return result(context.status, null, null, null, {
+      platform: context.platform, capabilities: context.capabilities, operations: context.operations, error: context.error
+    });
+  }
+  let identity: ResourceIdentity;
+  try { identity = loaded.ok ? providerResourceToken(loaded.value.provider, 'pull-request', String(prNumber)) : resourceIdentity(prNumber); }
+  catch (error) {
+    return result('failed', null, null, null, {
+      platform: context.platform, capabilities: context.capabilities,
+      error: { code: 'PLATFORM_IDENTITY_TOKEN_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
+    });
+  }
+  if (loaded.ok) {
+    const inspected = loaded.value.provider.changeRequests?.inspect
+      ? await loaded.value.provider.changeRequests.inspect({ context: providerOperationContext(loaded.value), target: identity })
+      : unsupportedProviderOperation(loaded.value.provider, 'changeRequests.inspect');
+    const number = resourceIdentityNumber(identity);
+    if (!inspected.ok) return result(providerStatus(inspected.error), null, null, number, {
+      platform: context.platform, capabilities: context.capabilities,
+      resource: { kind: 'pull-request', number, identity }, error: providerError(inspected.error, 'PLATFORM_PROVIDER_OPERATION_FAILED')
+    });
+    return result('no-op', null, null, number, {
+      platform: context.platform, capabilities: context.capabilities,
+      resource: { kind: 'pull-request', number, identity },
+      pullRequest: normalizeProviderPullRequest(inspected.value, context.platform.repository!, number || 0), error: null
     });
-  } catch {
-    return [];
   }
+  return result('failed', null, null, null, {
+    platform: context.platform, capabilities: context.capabilities,
+    resource: { kind: 'pull-request', number: null },
+    error: { code: 'PLATFORM_PROVIDER_LOAD_FAILED', message: 'Selected provider failed to load', retryable: false }
+  });
 }
 
-function rewriteGitHubRemote(remote: string, repository: string): string | null {
-  const match = remote.trim().match(
-    /^(https?:\/\/github\.com\/|ssh:\/\/(?:git@)?github\.com\/|git@github\.com:)[^/\s]+\/[^/\s]+(?:\.git)?$/i
-  );
-  return match ? `${match[1]}${repository}.git` : null;
-}
+const CLOSING_ISSUES_QUERY = 'query($owner:String!,$name:String!,$number:Int!,$cursor:String){repository(owner:$owner,name:$name){pullRequest(number:$number){closingIssuesReferences(first:100,after:$cursor){nodes{number} pageInfo{hasNextPage endCursor}}}}}';
 
-function resolveGitHubChangeRequestGitEvidence({
-  cwd,
-  repository,
-  pullRequest
-}: {
-  cwd: string;
-  repository: string;
-  pullRequest: PullRequestSnapshot;
-}) {
-  if (
-    pullRequest.repository !== repository ||
-    pullRequest.base.repository !== repository ||
-    pullRequest.number <= 0
-  ) {
+function readInLabelMapping(repoRoot: string): { ok: true; value: Record<string, unknown> } | { ok: false; error: { code: string; message: string; retryable: boolean } } {
+  try {
+    const config = JSON.parse(fs.readFileSync(path.join(repoRoot, '.agents', '.airc.json'), 'utf8')) as {
+      labels?: { in?: unknown };
+    };
+    const mapping = validateInLabelMapping(config.labels?.in);
+    return mapping.ok ? { ok: true, value: mapping.value } : mapping;
+  } catch (error) {
     return {
-      ok: false as const,
-      error: {
-        code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
-        message: 'Pull request repository identity is inconsistent',
-        retryable: false
-      }
+      ok: false,
+      error: { code: 'IN_LABEL_SYNC_CONFIG_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
     };
   }
-  const reviewedHeadRef = `refs/pull/${pullRequest.number}/head`;
-  const targetHeadRef = `refs/heads/${pullRequest.base.ref}`;
-  const refValid = (ref: string) => {
-    try {
-      execFileSync('git', ['check-ref-format', ref], {
-        cwd, encoding: 'utf8', stdio: ['ignore', 'ignore', 'ignore']
-      });
-      return true;
-    } catch {
-      return false;
-    }
+}
+
+function taskInLabelTarget(
+  repoRoot: string,
+  frontmatter: Record<string, unknown>,
+  currentLabels: readonly string[],
+  repositoryLabels: Set<string>
+) {
+  const baseRef = typeof frontmatter.delivery_base_ref === 'string' ? frontmatter.delivery_base_ref.trim() : '';
+  if (!baseRef) return {
+    ok: false as const,
+    error: { code: 'IN_LABEL_SYNC_BASE_MISSING', message: 'Task has no delivery_base_ref for in-label evidence', retryable: false }
   };
-  if (!refValid(reviewedHeadRef) || !refValid(targetHeadRef)) {
+  let changedFiles: string[];
+  try {
+    changedFiles = execFileSync('git', ['diff', `${baseRef}...HEAD`, '--name-only'], {
+      cwd: repoRoot, encoding: 'utf8'
+    }).trim().split(/\r?\n/).filter(Boolean);
+  } catch (error) {
     return {
       ok: false as const,
-      error: {
-        code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
-        message: 'Pull request Git refs are invalid',
-        retryable: false
-      }
+      error: { code: 'IN_LABEL_SYNC_EVIDENCE_UNAVAILABLE', message: error instanceof Error ? error.message : String(error), retryable: false }
     };
   }
+  const mapping = readInLabelMapping(repoRoot);
+  if (!mapping.ok) return mapping;
+  const planned = planInLabelUpdate({ changedFiles, currentLabels, mapping: mapping.value, repositoryLabels });
+  if (planned.error) return { ok: false as const, error: planned.error };
+  return { ok: true as const, value: planned.target };
+}
 
-  const remotes = configuredGitRemotes(cwd);
-  const exact = remotes
-    .filter((remote) => remote.repository === repository)
-    .sort((left, right) => Number(right.name === 'origin') - Number(left.name === 'origin') ||
-      left.name.localeCompare(right.name))[0];
-  const origin = remotes.find((remote) => remote.name === 'origin');
-  const remoteUrl = exact?.url || (origin ? rewriteGitHubRemote(origin.url, repository) : null);
-  if (!remoteUrl) {
-    return {
+function inspectClosingIssueNumbers(client: GitHubClient, repository: string, pullRequest: number, cwd: string) {
+  const [owner, name] = repository.split('/');
+  if (!owner || !name) return {
+    ok: false as const,
+    error: { code: 'IN_LABEL_SYNC_REPOSITORY_INVALID', message: 'Repository identity is invalid', retryable: false }
+  };
+  let cursor: string | null = null;
+  const numbers: number[] = [];
+  for (;;) {
+    const args = ['api', 'graphql', '-f', `query=${CLOSING_ISSUES_QUERY}`, '-F', `owner=${owner}`, '-F', `name=${name}`, '-F', `number=${pullRequest}`];
+    if (cursor) args.push('-F', `cursor=${cursor}`);
+    const response = client.json<unknown>(args, { cwd });
+    if (!response.ok) return response;
+    const connection = (response.value as {
+      data?: { repository?: { pullRequest?: { closingIssuesReferences?: {
+        nodes?: unknown[]; pageInfo?: { hasNextPage?: boolean; endCursor?: string | null };
+      } } } };
+    })?.data?.repository?.pullRequest?.closingIssuesReferences;
+    if (!connection || !Array.isArray(connection.nodes) || !connection.pageInfo) return {
       ok: false as const,
-      error: {
-        code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
-        message: `No GitHub remote can provide evidence for ${repository}`,
-        retryable: false
-      }
+      error: { code: 'IN_LABEL_SYNC_ASSOCIATION_INVALID', message: 'Closing Issue response is incomplete', retryable: false }
     };
+    for (const node of connection.nodes) {
+      const issue = Number((node as { number?: unknown })?.number);
+      if (!Number.isSafeInteger(issue) || issue <= 0) return {
+        ok: false as const,
+        error: { code: 'IN_LABEL_SYNC_ASSOCIATION_INVALID', message: 'Closing Issue identity is invalid', retryable: false }
+      };
+      numbers.push(issue);
+    }
+    if (!connection.pageInfo.hasNextPage) return { ok: true as const, value: [...new Set(numbers)] };
+    if (!connection.pageInfo.endCursor || connection.pageInfo.endCursor === cursor) return {
+      ok: false as const,
+      error: { code: 'IN_LABEL_SYNC_ASSOCIATION_INVALID', message: 'Closing Issue pagination cursor is invalid', retryable: false }
+    };
+    cursor = connection.pageInfo.endCursor;
   }
-  return {
-    ok: true as const,
-    value: { remoteUrl, reviewedHeadRef, targetHeadRef }
-  };
 }
 
-registerPlatformCapabilities('github', {
-  inspectChangeRequest({ client, repository, number, cwd }) {
-    return inspectGitHubPullRequest((client as GitHubClient | undefined) || createGitHubClient(), repository, number, cwd);
-  },
-  inspectIssueClosingChangeRequests({ client, repository, issueNumber, cwd }) {
-    return inspectGitHubIssueClosingChangeRequests(
-      (client as GitHubClient | undefined) || createGitHubClient(), repository, issueNumber, cwd
-    );
-  },
-  resolveChangeRequestGitEvidence(context) {
-    return resolveGitHubChangeRequestGitEvidence(context);
-  }
-});
-
-function locatePullRequest(base: ReturnType<typeof resolvedContext> & { ok: true }, head: string, target: string, expectedSha?: string) {
-  const repository = base.context.platform.repository!;
-  const listed = base.client.json<RemotePullRequest[]>([
-    'api', `repos/${repository}/pulls?state=open&base=${encodeURIComponent(target)}&per_page=100`
-  ], { cwd: base.resolved.repoRoot });
-  if (!listed.ok) return listed;
-  const selected = selectPullRequest(listed.value, repository, head, target, expectedSha);
-  return selected.status === 'resolved'
-    ? { ok: true as const, value: selected.pullRequest }
-    : { ok: false as const, error: {
-      code: selected.status === 'ambiguous' ? 'PR_IDENTITY_AMBIGUOUS'
-        : selected.status === 'head-mismatch' ? 'PR_HEAD_SHA_MISMATCH' : 'PR_NOT_FOUND',
-      message: selected.status === 'ambiguous' ? 'Multiple pull requests match the exact head/base identity'
-        : selected.status === 'head-mismatch' ? 'A pull request matches head/base but not the expected head SHA'
-          : 'No pull request matches the exact head/base identity',
-      retryable: false
-    } };
+function inspectRepositoryLabels(client: GitHubClient, repository: string, cwd: string) {
+  const response = client.json<unknown>(['api', '--paginate', '--slurp', `repos/${repository}/labels?per_page=100`], { cwd });
+  if (!response.ok) return response;
+  const labels = validateRepositoryLabelPayload(response.value);
+  return labels.ok ? { ok: true as const, value: new Set(labels.value) } : labels;
 }
 
-function inspectPlatformPullRequest(taskRef: string, options: InspectionOptions = {}): PullRequestResult {
-  const base = resolvedContext(taskRef, options);
-  if (!base.ok) return base.output;
-  if (!base.prNumber) return result('no-op', base.resolved.taskId, base.issueNumber, null, {
-    platform: base.context.platform, capabilities: base.context.capabilities,
-    error: { code: 'PR_NOT_LINKED', message: 'Task has no valid pr_number', retryable: false }
-  });
-  const fetched = inspectPlatformChangeRequest(base.context.platform.type, {
-    cwd: base.resolved.repoRoot,
-    repository: base.context.platform.repository!,
-    number: base.prNumber,
-    client: options.client || base.client
-  });
-  if (!fetched.ok || !fetched.value) {
-    const error = fetched.error || {
-      code: 'PR_INSPECTION_INVALID',
-      message: 'Platform adapter returned no change-request snapshot',
-      retryable: false
+function inspectPullRequestFiles(client: GitHubClient, repository: string, pullRequest: number, cwd: string) {
+  const response = client.json<unknown>(['api', '--paginate', '--slurp', `repos/${repository}/pulls/${pullRequest}/files?per_page=100`], { cwd });
+  if (!response.ok) return response;
+  const files = extractPullRequestFileNames(response.value);
+  return files ? { ok: true as const, value: files } : {
+    ok: false as const,
+    error: { code: 'IN_LABEL_SYNC_FILES_INVALID', message: 'Pull request files response is incomplete', retryable: false }
+  };
+}
+
+function inspectTaskInLabelTarget(
+  repoRoot: string,
+  frontmatter: Record<string, unknown>,
+  pullRequest: PullRequestSnapshot,
+  repository: string,
+  client: GitHubClient
+) {
+  const baseRef = typeof frontmatter.delivery_base_ref === 'string' ? frontmatter.delivery_base_ref.trim() : '';
+  if (!baseRef) return {
+    ok: false as const,
+    error: { code: 'IN_LABEL_SYNC_BASE_MISSING', message: 'Task has no delivery_base_ref for in-label evidence', retryable: false }
+  };
+  let changedFiles: string[];
+  try {
+    changedFiles = execFileSync('git', ['diff', `${baseRef}...HEAD`, '--name-only'], {
+      cwd: repoRoot, encoding: 'utf8'
+    }).trim().split(/\r?\n/).filter(Boolean);
+  } catch (error) {
+    return {
+      ok: false as const,
+      error: { code: 'IN_LABEL_SYNC_EVIDENCE_UNAVAILABLE', message: error instanceof Error ? error.message : String(error), retryable: false }
     };
-    return result(error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
-      platform: base.context.platform, capabilities: base.context.capabilities,
-      resource: { kind: 'pull-request', number: base.prNumber }, error
-    });
   }
-  return result('no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
-    platform: base.context.platform, capabilities: base.context.capabilities,
-    resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: fetched.value, error: null
+  const mapping = readInLabelMapping(repoRoot);
+  if (!mapping.ok) return mapping;
+  const labels = inspectRepositoryLabels(client, repository, repoRoot);
+  if (!labels.ok) return labels;
+  const planned = planInLabelUpdate({
+    changedFiles, currentLabels: pullRequest.labels, mapping: mapping.value, repositoryLabels: labels.value
   });
+  if (planned.error) return { ok: false as const, error: planned.error };
+  return { ok: true as const, value: { changedFiles, target: planned.target } };
+}
+
+function inLabelResource(
+  kind: 'issue' | 'pull-request',
+  number: number,
+  before: string[],
+  expected: string[],
+  after: string[] | null,
+  effect: 'no-op' | 'applied' | 'unknown'
+) {
+  return { kind, number, before: [...before].sort(), expected: [...expected].sort(), after: after ? [...after].sort() : null, effect };
 }
 
-function inspectPlatformPullRequestByNumber(prNumber: number, options: InspectionOptions = {}): PullRequestResult {
-  const client = (options.client as GitHubClient | undefined) || createGitHubClient();
-  const context = resolvePlatformContext({ cwd: options.cwd || process.cwd(), client });
+async function syncPlatformPullRequestInLabels(prNumber: number, options: SharedOptions & { dryRun?: boolean } = {}): Promise<PullRequestResult> {
+  const cwd = path.resolve(options.cwd || process.cwd());
+  const client = options.client || createGitHubClient();
+  const context = await resolvePlatformContext({ cwd, client });
   const usable = (context.status === 'no-op' || context.status === 'degraded') && context.platform.repository;
-  if (!usable) {
-    return result(context.status, null, null, null, {
-      platform: context.platform, capabilities: context.capabilities, operations: context.operations, error: context.error
+  if (!usable) return result(context.status, null, null, prNumber, {
+    platform: context.platform, capabilities: context.capabilities, operations: context.operations, error: context.error
+  });
+  if (!Number.isSafeInteger(prNumber) || prNumber <= 0) return result('failed', null, null, prNumber, {
+    platform: context.platform, capabilities: context.capabilities,
+    error: { code: 'PR_NUMBER_INVALID', message: 'PR number must be positive', retryable: false }
+  });
+  const repository = context.platform.repository!;
+  const fetched = inspectGitHubPullRequest(client, repository, prNumber, cwd);
+  if (!fetched.ok) return result(fetched.error.retryable ? 'blocked' : 'failed', null, null, prNumber, {
+    platform: context.platform, capabilities: context.capabilities, resource: { kind: 'pull-request', number: prNumber }, error: fetched.error
+  });
+  const files = inspectPullRequestFiles(client, repository, prNumber, cwd);
+  if (!files.ok) return result(files.error.retryable ? 'blocked' : 'failed', null, null, prNumber, {
+    platform: context.platform, capabilities: context.capabilities, pullRequest: fetched.value,
+    resource: { kind: 'pull-request', number: prNumber }, error: files.error
+  });
+  const mapping = readInLabelMapping(cwd);
+  if (!mapping.ok) return result('failed', null, null, prNumber, {
+    platform: context.platform, capabilities: context.capabilities, pullRequest: fetched.value,
+    resource: { kind: 'pull-request', number: prNumber }, error: mapping.error
+  });
+  const repositoryLabels = inspectRepositoryLabels(client, repository, cwd);
+  if (!repositoryLabels.ok) return result(repositoryLabels.error.retryable ? 'blocked' : 'failed', null, null, prNumber, {
+    platform: context.platform, capabilities: context.capabilities, pullRequest: fetched.value,
+    resource: { kind: 'pull-request', number: prNumber }, error: repositoryLabels.error
+  });
+  const plannedTarget = planInLabelUpdate({
+    changedFiles: files.value, currentLabels: fetched.value.labels,
+    mapping: mapping.value, repositoryLabels: repositoryLabels.value
+  });
+  if (plannedTarget.error) return result('failed', null, null, prNumber, {
+    platform: context.platform, capabilities: context.capabilities, pullRequest: fetched.value,
+    resource: { kind: 'pull-request', number: prNumber }, error: plannedTarget.error
+  });
+  const target = plannedTarget.target;
+  const association = inspectClosingIssueNumbers(client, repository, prNumber, cwd);
+  if (!association.ok) return result(association.error.retryable ? 'blocked' : 'failed', null, null, prNumber, {
+    platform: context.platform, capabilities: context.capabilities, pullRequest: fetched.value,
+    resource: { kind: 'pull-request', number: prNumber }, evidence: { kind: 'pull-request-files', pullRequestFiles: files.value }, error: association.error
+  });
+
+  const issueNumber = association.value.length === 1 ? association.value[0]! : null;
+  let issue: IssueSnapshot | null = null;
+  if (issueNumber) {
+    const fetchedIssue = inspectGitHubIssue(client, repository, issueNumber, cwd);
+    if (!fetchedIssue.ok) return result(fetchedIssue.error.retryable ? 'blocked' : 'failed', null, issueNumber, prNumber, {
+      platform: context.platform, capabilities: context.capabilities, pullRequest: fetched.value,
+      resource: { kind: 'issue', number: issueNumber }, evidence: { kind: 'pull-request-files', pullRequestFiles: files.value, closingIssues: association.value }, error: fetchedIssue.error
     });
+    issue = fetchedIssue.value;
   }
-  if (!Number.isInteger(prNumber) || prNumber <= 0) {
-    return result('failed', null, null, null, {
-      platform: context.platform, capabilities: context.capabilities,
-      error: { code: 'PR_NUMBER_INVALID', message: 'PR number must be positive', retryable: false }
+
+  const resources = issue
+    ? [
+      { kind: 'issue' as const, number: issue.number, snapshot: issue },
+      { kind: 'pull-request' as const, number: prNumber, snapshot: fetched.value }
+    ]
+    : [{ kind: 'pull-request' as const, number: prNumber, snapshot: fetched.value }];
+  const plans = resources.map((resource) => ({
+    ...resource,
+    plan: planInLabelUpdate({
+      changedFiles: files.value, currentLabels: resource.snapshot.labels,
+      mapping: mapping.value, repositoryLabels: repositoryLabels.value
+    })
+  }));
+  const operations: PlatformOperation[] = [
+    { name: 'closing-issues', status: 'no-op', reasonCode: association.value.length === 1 ? null : association.value.length === 0 ? 'ISSUE_ASSOCIATION_NONE' : 'ISSUE_ASSOCIATION_AMBIGUOUS' },
+    ...plans.map((item) => ({
+      name: `labels:in:${item.kind}`,
+      status: !context.capabilities.triage ? 'skipped' as const : item.plan.changed ? 'planned' as const : 'no-op' as const,
+      reasonCode: !context.capabilities.triage ? 'TRIAGE_REQUIRED' : null
+    }))
+  ];
+  const willWrite = context.capabilities.triage && !options.dryRun;
+  const resourcesState = plans.map((item) => inLabelResource(
+    item.kind,
+    item.number,
+    item.snapshot.labels,
+    target,
+    item.plan.changed && willWrite ? null : item.snapshot.labels,
+    item.plan.changed && willWrite ? 'unknown' : 'no-op'
+  ));
+  if (options.dryRun || !context.capabilities.triage) return result(
+    !context.capabilities.triage || association.value.length !== 1 ? 'degraded' : plans.some((item) => item.plan.changed) ? 'planned' : 'no-op',
+    null, issueNumber, prNumber, {
+      platform: context.platform, capabilities: context.capabilities, pullRequest: fetched.value,
+      resource: { kind: 'pull-request', number: prNumber }, operations, resources: resourcesState,
+      evidence: { kind: 'pull-request-files', pullRequestFiles: files.value, closingIssues: association.value }, error: null
+    }
+  );
+
+  let currentPullRequest = fetched.value;
+  let successfulWrites = 0;
+  for (const item of plans) {
+    if (!item.plan.changed) continue;
+    const synced = syncLabelDelta(client, repository, item.number, cwd, item.snapshot.labels, item.plan.target);
+    if (synced.status === 'failed' || synced.status === 'blocked') {
+      const state = resourcesState.find((resource) => resource.kind === item.kind && resource.number === item.number)!;
+      state.effect = synced.status === 'blocked' ? 'unknown' : 'no-op';
+      state.after = synced.status === 'blocked' ? null : item.snapshot.labels;
+      const partial = successfulWrites > 0 || synced.status === 'blocked';
+      const error = partial && synced.error
+        ? { ...synced.error, code: 'IN_LABEL_SYNC_PARTIAL', message: `In-label synchronization is partial or unknown: ${synced.error.message}` }
+        : synced.error;
+      return result(partial ? 'blocked' : synced.status, null, issueNumber, prNumber, {
+        changed: successfulWrites > 0 || synced.changed, platform: context.platform, capabilities: context.capabilities,
+        pullRequest: currentPullRequest, resource: { kind: 'pull-request', number: prNumber }, operations, resources: resourcesState,
+        evidence: { kind: 'pull-request-files', pullRequestFiles: files.value, closingIssues: association.value }, error
+      });
+    }
+    successfulWrites += synced.changed ? 1 : 0;
+    const reread = item.kind === 'issue'
+      ? inspectGitHubIssue(client, repository, item.number, cwd)
+      : inspectGitHubPullRequest(client, repository, item.number, cwd);
+    if (!reread.ok) return result('blocked', null, issueNumber, prNumber, {
+      changed: true, platform: context.platform, capabilities: context.capabilities,
+      pullRequest: currentPullRequest, resource: { kind: 'pull-request', number: prNumber }, operations, resources: resourcesState,
+      evidence: { kind: 'pull-request-files', pullRequestFiles: files.value, closingIssues: association.value },
+      error: { ...reread.error, code: 'IN_LABEL_SYNC_PARTIAL', message: `In-label synchronization is partial or unknown: ${reread.error.message}` }
     });
-  }
-  const fetched = inspectPlatformChangeRequest(context.platform.type, {
-    cwd: options.cwd || process.cwd(),
-    repository: context.platform.repository!,
-    number: prNumber,
-    client
-  });
-  if (!fetched.ok || !fetched.value) {
-    const error = fetched.error || {
-      code: 'PR_INSPECTION_INVALID',
-      message: 'Platform adapter returned no change-request snapshot',
-      retryable: false
-    };
-    return result(error.retryable ? 'blocked' : 'failed', null, null, prNumber, {
-      platform: context.platform, capabilities: context.capabilities,
-      resource: { kind: 'pull-request', number: prNumber }, error
+    const after = reread.value.labels;
+    const state = resourcesState.find((resource) => resource.kind === item.kind && resource.number === item.number)!;
+    state.after = after;
+    state.effect = after.filter((label: string) => label.startsWith('in:')).sort().join('\0') === target.join('\0') ? 'applied' : 'unknown';
+    if (state.effect === 'unknown') return result('blocked', null, issueNumber, prNumber, {
+      changed: true, platform: context.platform, capabilities: context.capabilities,
+      pullRequest: currentPullRequest, resource: { kind: 'pull-request', number: prNumber }, operations, resources: resourcesState,
+      evidence: { kind: 'pull-request-files', pullRequestFiles: files.value, closingIssues: association.value },
+      error: { code: 'IN_LABEL_SYNC_PARTIAL', message: `${item.kind} #${item.number} did not converge to the expected in: labels`, retryable: true }
     });
+    if (item.kind === 'pull-request') currentPullRequest = reread.value as PullRequestSnapshot;
   }
-  return result('no-op', null, null, prNumber, {
-    platform: context.platform, capabilities: context.capabilities,
-    resource: { kind: 'pull-request', number: prNumber }, pullRequest: fetched.value, error: null
+  return result(association.value.length !== 1 ? 'degraded' : successfulWrites > 0 ? 'applied' : 'no-op', null, issueNumber, prNumber, {
+    changed: successfulWrites > 0, platform: context.platform, capabilities: context.capabilities,
+    pullRequest: currentPullRequest, resource: { kind: 'pull-request', number: prNumber },
+    operations: operations.map((operation) => operation.status === 'planned' ? { ...operation, status: 'applied' as const } : operation),
+    resources: resourcesState, evidence: { kind: 'pull-request-files', pullRequestFiles: files.value, closingIssues: association.value }, error: null
   });
 }
 
@@ -652,7 +970,38 @@ function appendActivity(content: string, line: string): string {
   return `${body.replace(/\s+$/, '')}${body.trim() ? '\n' : ''}${line}`;
 }
 
-function writeCreateStarted(base: ReturnType<typeof resolvedContext> & { ok: true }, agent: string) {
+function deliveryIdentity(pullRequest: PullRequestSnapshot) {
+  return {
+    resource: pullRequestIdentity(pullRequest),
+    repository: pullRequest.repository,
+    url: pullRequest.url,
+    head: { ...pullRequest.head },
+    base: { ...pullRequest.base }
+  };
+}
+
+function factTimestamp(timestamp: string): string {
+  return new Date(timestamp.replace(' ', 'T')).toISOString();
+}
+
+function boundFactFor(
+  pullRequest: PullRequestSnapshot,
+  source: PrDeliveryBindingSource,
+  issue: number | ResourceIdentity | null,
+  verifiedAt: string
+): PrDeliveryFact {
+  return buildBoundFact({
+    identity: deliveryIdentity(pullRequest),
+    source,
+    ...(typeof issue === 'object' ? { issueIdentity: issue } : { issueNumber: issue }),
+    verifiedAt: factTimestamp(verifiedAt),
+    remoteState: pullRequest.state,
+    mergedAt: pullRequest.state === 'closed' ? pullRequest.mergedAt : null,
+    mergeCommitSha: pullRequest.state === 'closed' ? pullRequest.mergeCommitSha : null
+  });
+}
+
+function writeCreateStarted(base: Awaited<ReturnType<typeof resolvedContext>> & { ok: true }, agent: string) {
   const starts = (base.content.match(/\*\*Create PR \[started\]\*\*/g) || []).length;
   const dones = (base.content.match(/\*\*Create PR\*\*/g) || []).length;
   if (starts > dones) return { status: 'no-op' as const };
@@ -666,19 +1015,40 @@ function writeCreateStarted(base: ReturnType<typeof resolvedContext> & { ok: tru
   }, { repoRoot: base.resolved.repoRoot, metadataProvider: () => metadata });
 }
 
-function bindIdentity(base: ReturnType<typeof resolvedContext> & { ok: true }, pullRequest: PullRequestSnapshot, agent: string, dryRun = false) {
-  if (base.prNumber && base.prNumber !== pullRequest.number) return { status: 'failed' as const, error: {
-    code: 'PR_BIND_CONFLICT', message: `Task is already bound to PR #${base.prNumber}`
+function bindIdentity(
+  base: Awaited<ReturnType<typeof resolvedContext>> & { ok: true },
+  pullRequest: PullRequestSnapshot,
+  agent: string,
+  source: PrDeliveryBindingSource,
+  dryRun = false,
+  expectedHead?: string,
+  expectedHeadSha?: string
+) {
+  const identity = validateWriterIdentity(base, pullRequest, {
+    expectedHead: source === 'explicit-bind' ? String(base.frontmatter.branch || '') : expectedHead,
+    expectedHeadSha,
+    errorCode: 'PR_BIND_IDENTITY_MISMATCH'
+  });
+  if (!identity.ok) return { status: 'failed' as const, error: identity.error };
+  if (base.prIdentity && !resourceIdentityEquals(base.prIdentity, pullRequestIdentity(pullRequest))) return { status: 'failed' as const, error: {
+    code: 'PR_BIND_CONFLICT', message: 'Task is already bound to a different pull request identity'
   } };
-  if (base.prNumber === pullRequest.number) return { status: 'no-op' as const, error: null };
+  if (base.prIdentity && resourceIdentityEquals(base.prIdentity, pullRequestIdentity(pullRequest)) && base.fact?.state === 'bound') {
+    if (JSON.stringify(base.fact.identity) !== JSON.stringify(deliveryIdentity(pullRequest))) return { status: 'failed' as const, error: {
+      code: 'PR_BIND_IDENTITY_MISMATCH', message: `Task binding for PR #${pullRequest.number} does not match the fetched pull request identity`
+    } };
+    return { status: 'no-op' as const, error: null };
+  }
   const current = fs.readFileSync(base.resolved.taskMdPath, 'utf8');
   const metadata = captureTaskWriteMetadata();
+  const fact = boundFactFor(pullRequest, source, taskIssueIdentity(base.frontmatter), metadata.timestamp);
+  const factMutation = factFrontmatterMutation(fact);
   return writeTask({
     taskRef: base.resolved.taskId,
     expectedState: 'active',
     dryRun,
     mutations: [
-      { kind: 'frontmatter', set: { pr_number: pullRequest.number, pr_status: 'created', assigned_to: agent } },
+      { kind: 'frontmatter', set: { ...factMutation.set, assigned_to: agent } },
       { kind: 'section', aliases: ['活动日志', 'Activity Log'], heading: '活动日志', body: appendActivity(
         current, `- ${metadata.timestamp} — **Create PR** by ${agent} — PR #${pullRequest.number} created → ${pullRequest.url}`
       ) }
@@ -686,45 +1056,59 @@ function bindIdentity(base: ReturnType<typeof resolvedContext> & { ok: true }, p
   }, { repoRoot: base.resolved.repoRoot, metadataProvider: () => metadata });
 }
 
-function bindPlatformPullRequest(taskRef: string, options: BindOptions): PullRequestResult {
-  const base = resolvedContext(taskRef, options);
+async function bindPlatformPullRequest(taskRef: string, options: BindOptions): Promise<PullRequestResult> {
+  const base = await resolvedContext(taskRef, options);
   if (!base.ok) return base.output;
-  if (!Number.isInteger(options.pr) || options.pr <= 0) return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
-    error: { code: 'PR_NUMBER_INVALID', message: 'PR number must be positive', retryable: false }
+  if (!base.fact) return result('failed', base.resolved.taskId, base.issueNumber, null, {
+    error: { code: 'PR_DELIVERY_FACT_MISSING', message: 'Task has no pr_delivery_fact; repair the task metadata or create a new task', retryable: false }
+  });
+  let prIdentity: ResourceIdentity;
+  try { prIdentity = providerResourceToken(base.provider, 'pull-request', String(options.pr)); }
+  catch (error) { return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, { error: { code: 'PLATFORM_IDENTITY_TOKEN_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false } }); }
+  const requestedNumber = resourceIdentityNumber(prIdentity);
+  if (base.prIdentity && !resourceIdentityEquals(base.prIdentity, prIdentity)) return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+    error: { code: 'PR_BIND_CONFLICT', message: 'Task is already bound to a different pull request identity', retryable: false }
   });
-  if (base.prNumber && base.prNumber !== options.pr) return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
-    error: { code: 'PR_BIND_CONFLICT', message: `Task is already bound to PR #${base.prNumber}`, retryable: false }
+  const inspected = await inspectExternalPullRequest(base, prIdentity);
+  if (inspected.status === 'failed' || inspected.status === 'blocked' || !inspected.pullRequest) return inspected;
+  const initialIdentity = validateWriterIdentity(base, inspected.pullRequest, {
+    expectedHead: String(base.frontmatter.branch || ''),
+    errorCode: 'PR_BIND_IDENTITY_MISMATCH'
   });
-  const fetched = inspectGitHubPullRequest(base.client, base.context.platform.repository!, options.pr, base.resolved.repoRoot);
-  if (!fetched.ok) return result(fetched.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, { error: fetched.error });
-  const written = bindIdentity(base, fetched.value, options.agent, options.dryRun);
-  if (written.status === 'failed') return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
-    pullRequest: fetched.value, error: { code: written.error.code, message: written.error.message, retryable: false }
+  if (!initialIdentity.ok) return result('failed', base.resolved.taskId, base.issueNumber, requestedNumber, {
+    pullRequest: inspected.pullRequest, error: initialIdentity.error
   });
-  return result(options.dryRun ? 'planned' : written.status === 'no-op' ? 'no-op' : 'applied', base.resolved.taskId, base.issueNumber, options.dryRun ? base.prNumber : fetched.value.number, {
+  const written = bindIdentity(base, inspected.pullRequest, options.agent, 'explicit-bind', options.dryRun);
+  if (written.status === 'failed') return result('failed', base.resolved.taskId, base.issueNumber, requestedNumber, {
+    pullRequest: inspected.pullRequest, error: { code: written.error.code, message: written.error.message, retryable: false }
+  });
+  return result(options.dryRun ? 'planned' : written.status === 'no-op' ? 'no-op' : 'applied', base.resolved.taskId, base.issueNumber, options.dryRun ? base.prNumber : inspected.pullRequest.number, {
     changed: !options.dryRun && written.status === 'applied', platform: base.context.platform, capabilities: base.context.capabilities,
-    resource: { kind: 'pull-request', number: fetched.value.number }, pullRequest: fetched.value,
+    resource: { kind: 'pull-request', number: inspected.pullRequest.number, identity: pullRequestIdentity(inspected.pullRequest) }, pullRequest: inspected.pullRequest,
     operations: [{ name: 'task:bind-pr', status: options.dryRun ? 'planned' : written.status === 'no-op' ? 'no-op' : 'applied', reasonCode: null }], error: null
   });
 }
 
 function externalEvidenceNote(
-  issueNumber: number,
+  issueIdentity: ResourceIdentity | null,
   source: 'unique' | 'explicit',
   pullRequest: PullRequestSnapshot
 ): string {
   return [
     `authorization=${source}`,
-    externalIdentityEvidenceNote(issueNumber, pullRequest)
+    externalIdentityEvidenceNote(issueIdentity, pullRequest)
   ].join('; ');
 }
 
 function externalIdentityEvidenceNote(
-  issueNumber: number,
+  issueIdentity: ResourceIdentity | null,
   pullRequest: PullRequestSnapshot
 ): string {
+  const issueLabel = issueIdentity
+    ? issueIdentity.kind === 'number' ? `#${issueIdentity.value}` : `${issueIdentity.kind}:${issueIdentity.value}`
+    : 'unknown';
   return [
-    `issue=#${issueNumber}`,
+    `issue=${issueLabel}`,
     `pr=#${pullRequest.number}`,
     `url=${pullRequest.url}`,
     `base=${pullRequest.base.repository}:${pullRequest.base.ref}@${pullRequest.base.sha}`,
@@ -734,9 +1118,12 @@ function externalIdentityEvidenceNote(
   ].join('; ');
 }
 
-function resolveExternalPullRequest(taskRef: string, options: ResolveExternalOptions): ExternalPullRequestResult {
-  const base = resolvedContext(taskRef, options);
+async function resolveExternalPullRequest(taskRef: string, options: ResolveExternalOptions): Promise<ExternalPullRequestResult> {
+  const base = await resolvedContext(taskRef, options);
   if (!base.ok) return externalResult(base.output);
+  if (!base.fact) return externalResult(result('failed', base.resolved.taskId, base.issueNumber, null, {
+    error: { code: 'PR_DELIVERY_FACT_MISSING', message: 'Task has no pr_delivery_fact; repair the task metadata or create a new task', retryable: false }
+  }));
   const inventory = inspectCompletionArtifacts(base.resolved.taskId, { repoRoot: base.resolved.repoRoot });
   if (inventory.status === 'failed') return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
     platform: base.context.platform,
@@ -756,28 +1143,41 @@ function resolveExternalPullRequest(taskRef: string, options: ResolveExternalOpt
       error: null
     }), { mode: 'normal' });
   }
-  if (!base.issueNumber) return externalResult(result('failed', base.resolved.taskId, null, base.prNumber, {
+  if (!base.issueIdentity) return externalResult(result('failed', base.resolved.taskId, null, base.prNumber, {
     platform: base.context.platform,
     capabilities: base.context.capabilities,
     error: { code: 'EXTERNAL_DELIVERY_ISSUE_REQUIRED', message: 'External delivery requires a valid issue_number', retryable: false }
   }));
-  const inspected = inspectPlatformIssueClosingChangeRequests(base.context.platform.type, {
-    cwd: base.resolved.repoRoot,
-    repository: base.context.platform.repository!,
-    issueNumber: base.issueNumber,
-    client: base.client
-  });
+  const inspected = base.provider.changeRequests?.listClosing
+    ? await base.provider.changeRequests.listClosing({
+      context: providerOperationContext(base.loadedContext),
+      issue: base.issueIdentity
+    })
+    : unsupportedProviderOperation(base.provider, 'changeRequests.listClosing');
   if (!inspected.ok || !inspected.value) {
-    const error = inspected.error || { code: 'PR_IDENTITY_INVALID', message: 'Closing PR inspection returned no candidates', retryable: false };
+    const error = 'error' in inspected && inspected.error
+      ? inspected.error
+      : { code: 'PR_IDENTITY_INVALID', message: 'Closing PR inspection returned no candidates', retryable: false };
     return externalResult(result(error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
       platform: base.context.platform, capabilities: base.context.capabilities, error
     }));
   }
+  const candidates = (inspected.value as ProviderChangeRequestSnapshot[]).map((item) => normalizeProviderPullRequest(item, base.context.platform.repository!, item.number || 0));
+  let explicitPrIdentity: ResourceIdentity | null = null;
+  if (options.pr !== undefined) {
+    try { explicitPrIdentity = providerResourceToken(base.provider, 'pull-request', String(options.pr)); }
+    catch (error) {
+      return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+        platform: base.context.platform, capabilities: base.context.capabilities,
+        error: { code: 'PLATFORM_IDENTITY_TOKEN_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
+      }));
+    }
+  }
   const selected = selectExternalPullRequest(
-    inspected.value,
+    candidates,
     base.context.platform.repository!,
-    base.prNumber,
-    options.pr ?? null
+    base.prIdentity,
+    explicitPrIdentity
   );
   if (selected.status === 'normal') return externalResult(result('no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
     platform: base.context.platform,
@@ -791,32 +1191,66 @@ function resolveExternalPullRequest(taskRef: string, options: ResolveExternalOpt
     error: { code: selected.code, message: selected.message, retryable: false }
   }), { candidates: selected.candidates, eligible: selected.eligible });
 
-  const note = externalEvidenceNote(base.issueNumber, selected.source, selected.selected);
-  const identityNote = externalIdentityEvidenceNote(base.issueNumber, selected.selected);
+  const initialIdentity = validateWriterIdentity(base, selected.selected, { errorCode: 'PR_EXTERNAL_IDENTITY_MISMATCH' });
+  if (!initialIdentity.ok) return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+    platform: base.context.platform, capabilities: base.context.capabilities,
+    pullRequest: selected.selected, error: initialIdentity.error
+  }), { candidates: selected.candidates, eligible: selected.eligible, selected: selected.selected });
+  const rechecked = base.provider.changeRequests?.inspect
+    ? await base.provider.changeRequests.inspect({
+      context: providerOperationContext(base.loadedContext),
+      target: pullRequestIdentity(selected.selected)
+    }).then((response) => response.ok
+      ? { ok: true as const, value: normalizeProviderPullRequest(response.value, base.context.platform.repository!, selected.selected.number, selected.selected) }
+      : response)
+    : unsupportedProviderOperation(base.provider, 'changeRequests.inspect');
+  if (!rechecked.ok || !rechecked.value) return externalResult(result(rechecked.ok ? 'failed' : rechecked.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+    platform: base.context.platform, capabilities: base.context.capabilities,
+    pullRequest: selected.selected,
+    error: rechecked.ok ? { code: 'PR_EXTERNAL_RECHECK_FAILED', message: 'Selected pull request recheck returned no identity', retryable: false } : rechecked.error
+  }), { candidates: selected.candidates, eligible: selected.eligible, selected: selected.selected });
+  if (!sameDeliveryIdentity(selected.selected, rechecked.value)) return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+    platform: base.context.platform, capabilities: base.context.capabilities,
+    pullRequest: rechecked.value,
+    error: { code: 'PR_EXTERNAL_IDENTITY_MISMATCH', message: 'Selected pull request identity changed before task binding', retryable: false }
+  }), { candidates: selected.candidates, eligible: selected.eligible, selected: rechecked.value });
+  const finalIdentity = validateWriterIdentity(base, rechecked.value, { errorCode: 'PR_EXTERNAL_IDENTITY_MISMATCH' });
+  if (!finalIdentity.ok) return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+    platform: base.context.platform, capabilities: base.context.capabilities,
+    pullRequest: rechecked.value, error: finalIdentity.error
+  }), { candidates: selected.candidates, eligible: selected.eligible, selected: rechecked.value });
+  const finalEvidence = validateExternalMergedEvidence(selected.selected, rechecked.value);
+  if (!finalEvidence.ok) return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+    platform: base.context.platform, capabilities: base.context.capabilities,
+    pullRequest: rechecked.value, error: finalEvidence.error
+  }), { candidates: selected.candidates, eligible: selected.eligible, selected: rechecked.value });
+  const selectedPullRequest = rechecked.value;
+  const note = externalEvidenceNote(base.issueIdentity, selected.source, selectedPullRequest);
+  const identityNote = externalIdentityEvidenceNote(base.issueIdentity, selectedPullRequest);
   const activityEntry = `**Bind External PR** by ${options.agent} — ${note}`;
   const auditLines = base.content.split(/\r?\n/).filter((line) => line.includes('**Bind External PR**'));
   const alreadyAudited = auditLines.some((line) => line.endsWith(identityNote));
   if (auditLines.length > 0 && !alreadyAudited) return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
     platform: base.context.platform,
     capabilities: base.context.capabilities,
-    pullRequest: selected.selected,
+    pullRequest: selectedPullRequest,
     error: { code: 'PR_BIND_CONFLICT', message: 'Existing external PR audit evidence conflicts with the selected identity', retryable: false }
-  }), { candidates: selected.candidates, eligible: selected.eligible, selected: selected.selected });
-  if (alreadyAudited && base.prNumber !== selected.selected.number) return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+  }), { candidates: selected.candidates, eligible: selected.eligible, selected: selectedPullRequest });
+  if (alreadyAudited && base.prIdentity && !resourceIdentityEquals(base.prIdentity, pullRequestIdentity(selectedPullRequest))) return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
     platform: base.context.platform,
     capabilities: base.context.capabilities,
-    pullRequest: selected.selected,
+    pullRequest: selectedPullRequest,
     error: { code: 'PR_BIND_CONFLICT', message: 'External PR audit evidence does not match the task binding', retryable: false }
-  }), { candidates: selected.candidates, eligible: selected.eligible, selected: selected.selected });
-  if (base.prNumber === selected.selected.number && alreadyAudited) {
+  }), { candidates: selected.candidates, eligible: selected.eligible, selected: selectedPullRequest });
+  if (base.prIdentity && resourceIdentityEquals(base.prIdentity, pullRequestIdentity(selectedPullRequest)) && alreadyAudited) {
     return externalResult(result('no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
       platform: base.context.platform,
       capabilities: base.context.capabilities,
-      resource: { kind: 'pull-request', number: selected.selected.number },
-      pullRequest: selected.selected,
+      resource: { kind: 'pull-request', number: selectedPullRequest.number },
+      pullRequest: selectedPullRequest,
       operations: [{ name: 'task:bind-external-pr', status: 'no-op', reasonCode: 'EVIDENCE_ALREADY_RECORDED' }],
       error: null
-    }), { mode: 'external', authorization: selected.source, candidates: selected.candidates, eligible: selected.eligible, selected: selected.selected });
+    }), { mode: 'external', authorization: selected.source, candidates: selected.candidates, eligible: selected.eligible, selected: selectedPullRequest });
   }
   const metadata = captureTaskWriteMetadata();
   const write = writeTask({
@@ -824,7 +1258,7 @@ function resolveExternalPullRequest(taskRef: string, options: ResolveExternalOpt
     expectedState: 'active',
     dryRun: options.dryRun,
     mutations: [
-      { kind: 'frontmatter', set: { pr_number: selected.selected.number, pr_status: 'created', assigned_to: options.agent } },
+      { kind: 'frontmatter', set: { ...factFrontmatterMutation(boundFactFor(selectedPullRequest, selected.source === 'unique' ? 'external-unique' : 'external-explicit', base.issueNumber, metadata.timestamp)).set, assigned_to: options.agent } },
       { kind: 'section', aliases: ['活动日志', 'Activity Log'], heading: '活动日志', body: appendActivity(
         base.content, `- ${metadata.timestamp} — ${activityEntry}`
       ) }
@@ -833,173 +1267,45 @@ function resolveExternalPullRequest(taskRef: string, options: ResolveExternalOpt
   if (write.status === 'failed') return externalResult(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
     platform: base.context.platform,
     capabilities: base.context.capabilities,
-    pullRequest: selected.selected,
+    pullRequest: selectedPullRequest,
     error: { code: write.error.code, message: write.error.message, retryable: false }
-  }), { candidates: selected.candidates, eligible: selected.eligible, selected: selected.selected });
+  }), { candidates: selected.candidates, eligible: selected.eligible, selected: selectedPullRequest });
   const operationStatus = options.dryRun ? 'planned' : write.status === 'applied' ? 'applied' : 'no-op';
-  return externalResult(result(operationStatus, base.resolved.taskId, base.issueNumber, options.dryRun ? base.prNumber : selected.selected.number, {
+  return externalResult(result(operationStatus, base.resolved.taskId, base.issueNumber, options.dryRun ? base.prNumber : selectedPullRequest.number, {
     changed: !options.dryRun && write.changed,
     platform: base.context.platform,
     capabilities: base.context.capabilities,
-    resource: { kind: 'pull-request', number: selected.selected.number },
-    pullRequest: selected.selected,
+    resource: { kind: 'pull-request', number: selectedPullRequest.number },
+    pullRequest: selectedPullRequest,
     operations: [{ name: 'task:bind-external-pr', status: operationStatus, reasonCode: null }],
     error: null
-  }), { mode: 'external', authorization: selected.source, candidates: selected.candidates, eligible: selected.eligible, selected: selected.selected });
-}
-
-function createPlatformPullRequestUnlocked(taskRef: string, options: CreateOptions): PullRequestResult {
-  const base = resolvedContext(taskRef, options);
-  if (!base.ok) return base.output;
-  if (!options.base || !options.head || !options.title.trim() || !options.body.trim()) return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
-    error: { code: 'PR_PAYLOAD_INVALID', message: 'base, head, title and body are required', retryable: false }
-  });
-  if (base.prNumber) {
-    const headCheck = verifyCreateHead(base, options.head);
-    if (!headCheck.ok) return result(headCheck.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
-      platform: base.context.platform,
-      capabilities: base.context.capabilities,
-      error: headCheck.error
-    });
-    const inspected = inspectPlatformPullRequest(taskRef, options);
-    const identity = validateBoundPullRequest(base, inspected.pullRequest, options.head, options.base, headCheck.value);
-    if (!identity.ok) return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
-      platform: base.context.platform,
-      capabilities: base.context.capabilities,
-      pullRequest: inspected.pullRequest,
-      error: identity.error
-    });
-    return { ...inspected, result: 'no_op' };
-  }
-  const headCheck = verifyCreateHead(base, options.head);
-  if (!headCheck.ok) return result(headCheck.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, null, {
-    platform: base.context.platform,
-    capabilities: base.context.capabilities,
-    error: headCheck.error
-  });
-  const expectedHeadSha = headCheck.value;
-  const located = locatePullRequest(base, options.head, options.base, expectedHeadSha);
-  if (!located.ok && located.error.code === 'PR_IDENTITY_AMBIGUOUS') return result('failed', base.resolved.taskId, base.issueNumber, null, {
-    platform: base.context.platform, capabilities: base.context.capabilities, error: located.error
-  });
-  if (!located.ok && located.error.code === 'PR_HEAD_SHA_MISMATCH') return result('failed', base.resolved.taskId, base.issueNumber, null, {
-    platform: base.context.platform, capabilities: base.context.capabilities, error: located.error
-  });
-  if (options.dryRun) return result('planned', base.resolved.taskId, base.issueNumber, null, {
-    platform: base.context.platform, capabilities: base.context.capabilities,
-    operations: [{ name: located.ok ? 'pr:reuse' : 'pr:create', status: 'planned', reasonCode: null }],
-    result: located.ok ? 'pr_reused' : 'pr_created', error: null
-  });
-  const started = writeCreateStarted(base, options.agent);
-  if (started.status === 'failed') return result('failed', base.resolved.taskId, base.issueNumber, null, {
-    error: { code: started.error.code, message: started.error.message, retryable: false }
-  });
-  let pullRequest = located.ok ? located.value : null;
-  let created = false;
-  if (!pullRequest) {
-    const repository = base.context.platform.repository!;
-    const response = base.client.json<RemotePullRequest>(['api', `repos/${repository}/pulls`, '-X', 'POST', '--input', '-'], {
-      cwd: base.resolved.repoRoot,
-      method: 'POST',
-      input: JSON.stringify({ title: options.title, body: options.body, head: options.head, base: options.base, draft: Boolean(options.draft) })
-    });
-    if (response.ok) pullRequest = normalizePullRequest(response.value, repository);
-    else if (response.error.retryable) {
-      const recovered = locatePullRequest(base, options.head, options.base, expectedHeadSha);
-      if (recovered.ok) pullRequest = recovered.value;
-      else return result('blocked', base.resolved.taskId, base.issueNumber, null, {
-        platform: base.context.platform, capabilities: base.context.capabilities,
-        operations: [{ name: 'pr:create', status: 'failed', reasonCode: 'PR_CREATE_OUTCOME_UNKNOWN' }],
-        error: { code: 'PR_CREATE_OUTCOME_UNKNOWN', message: response.error.message, retryable: true }
-      });
-    } else return result('failed', base.resolved.taskId, base.issueNumber, null, {
-      platform: base.context.platform, capabilities: base.context.capabilities,
-      operations: [{ name: 'pr:create', status: 'failed', reasonCode: response.error.code }], error: response.error
-    });
-    if (!pullRequest) return result('failed', base.resolved.taskId, base.issueNumber, null, {
-      error: { code: 'PR_CREATE_RESPONSE_INVALID', message: 'PR create response lacks validated identity', retryable: false }
-    });
-    if (pullRequest.head.sha !== expectedHeadSha) return result('failed', base.resolved.taskId, base.issueNumber, pullRequest.number, {
-      platform: base.context.platform, capabilities: base.context.capabilities,
-      resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest,
-      error: { code: 'PR_HEAD_SHA_MISMATCH', message: 'Created pull request head does not match the expected local HEAD', retryable: false }
-    });
-    created = true;
-  }
-  const bindHeadCheck = verifyCreateHead(base, options.head);
-  if (!bindHeadCheck.ok || bindHeadCheck.value !== expectedHeadSha) {
-    const error = bindHeadCheck.ok
-      ? { code: 'PR_REMOTE_HEAD_MISMATCH', message: 'Remote head changed before task binding', retryable: false }
-      : bindHeadCheck.error;
-    return result(error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, pullRequest.number, {
-      platform: base.context.platform, capabilities: base.context.capabilities,
-      resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest, error
-    });
-  }
-  const beforeBind = inspectGitHubPullRequest(base.client, base.context.platform.repository!, pullRequest.number, base.resolved.repoRoot);
-  if (!beforeBind.ok || !beforeBind.value) {
-    const error = beforeBind.ok
-      ? { code: 'PR_BIND_RECHECK_FAILED', message: 'Pull request recheck returned no identity', retryable: false }
-      : beforeBind.error;
-    return result(error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, pullRequest.number, {
-      platform: base.context.platform, capabilities: base.context.capabilities,
-      resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest, error
-    });
-  }
-  if (
-    beforeBind.value.head.sha !== expectedHeadSha
-    || beforeBind.value.head.ref !== expectedHead(base.context.platform.repository!, options.head).ref
-    || beforeBind.value.base.ref !== options.base
-    || beforeBind.value.base.repository !== base.context.platform.repository
-  ) return result('failed', base.resolved.taskId, base.issueNumber, pullRequest.number, {
-    platform: base.context.platform, capabilities: base.context.capabilities,
-    resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest: beforeBind.value,
-    error: { code: 'PR_BIND_IDENTITY_MISMATCH', message: 'Pull request identity changed before task binding', retryable: false }
-  });
-  pullRequest = beforeBind.value;
-  const refreshed = resolvedContext(taskRef, options);
-  if (!refreshed.ok) return result('failed', base.resolved.taskId, base.issueNumber, null, {
-    pullRequest, error: { code: 'PR_CREATED_BIND_FAILED', message: pullRequest.url, retryable: false }
-  });
-  const bound = bindIdentity(refreshed, pullRequest, options.agent);
-  if (bound.status === 'failed') return result('failed', base.resolved.taskId, base.issueNumber, null, {
-    platform: base.context.platform, capabilities: base.context.capabilities,
-    resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest,
-    operations: [{ name: created ? 'pr:create' : 'pr:reuse', status: 'applied', reasonCode: null }, { name: 'task:bind-pr', status: 'failed', reasonCode: bound.error.code }],
-    error: { code: 'PR_CREATED_BIND_FAILED', message: `${pullRequest.url}: ${bound.error.message}`, retryable: false }
-  });
-  return result('applied', base.resolved.taskId, base.issueNumber, pullRequest.number, {
-    changed: true, platform: base.context.platform, capabilities: base.context.capabilities,
-    resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest,
-    operations: [{ name: created ? 'pr:create' : 'pr:reuse', status: created ? 'applied' : 'no-op', reasonCode: null }, { name: 'task:bind-pr', status: 'applied', reasonCode: null }],
-    result: created ? 'pr_created' : 'pr_reused', error: null
-  });
+  }), { mode: 'external', authorization: selected.source, candidates: selected.candidates, eligible: selected.eligible, selected: selectedPullRequest });
 }
 
-function createPlatformPullRequest(taskRef: string, options: CreateOptions): PullRequestResult {
-  const base = resolvedContext(taskRef, options);
-  if (!base.ok) return base.output;
+async function createPlatformPullRequest(taskRef: string, options: CreateOptions): Promise<PullRequestResult> {
+  const base = await resolvedContext(taskRef, options);
+  if (!base.ok) return withCreation(base.output, PRECONDITION_NOT_CREATED);
   if (!options.base || !options.head || !options.title.trim() || !options.body.trim()) {
-    return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+    return withCreation(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
       error: { code: 'PR_PAYLOAD_INVALID', message: 'base, head, title and body are required', retryable: false }
-    });
+    }), PRECONDITION_NOT_CREATED);
   }
   try {
     return withTaskExecutionLock(
       base.resolved.repoRoot,
       base.resolved.taskId,
       'platform-pr.create',
-      () => createPlatformPullRequestUnlocked(taskRef, options)
+      () => createExternalPullRequest(taskRef, options, base)
     );
   } catch (error) {
     if (error instanceof TaskExecutionLockError) {
-      return result('blocked', base.resolved.taskId, base.issueNumber, null, {
+      return withCreation(result('blocked', base.resolved.taskId, base.issueNumber, null, {
         platform: base.context.platform,
         capabilities: base.context.capabilities,
         error: { code: error.code, message: error.message, retryable: true }
-      });
+      }), PRECONDITION_NOT_CREATED);
     }
-    return result('failed', base.resolved.taskId, base.issueNumber, null, {
+    return withCreation(result('failed', base.resolved.taskId, base.issueNumber, null, {
       platform: base.context.platform,
       capabilities: base.context.capabilities,
       error: {
@@ -1007,14 +1313,146 @@ function createPlatformPullRequest(taskRef: string, options: CreateOptions): Pul
         message: error instanceof Error ? error.message : String(error),
         retryable: false
       }
+    }), PRECONDITION_NOT_CREATED);
+  }
+}
+
+async function createExternalPullRequest(
+  taskRef: string,
+  options: CreateOptions,
+  base: Extract<Awaited<ReturnType<typeof resolvedContext>>, { ok: true }>
+): Promise<PullRequestResult> {
+  if (!base.fact) return withCreation(result('failed', base.resolved.taskId, base.issueNumber, null, {
+    error: { code: 'PR_DELIVERY_FACT_MISSING', message: 'Task has no pr_delivery_fact; repair the task metadata or create a new task', retryable: false }
+  }), PRECONDITION_NOT_CREATED);
+  const target = taskDeliveryTarget(base);
+  if (!target.ok) return withCreation(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+    error: target.error
+  }), PRECONDITION_NOT_CREATED);
+  if (options.base !== target.value.baseRef) return withCreation(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+    platform: base.context.platform,
+    capabilities: base.context.capabilities,
+    error: { code: 'PR_DELIVERY_TARGET_MISMATCH', message: `Pull request base '${options.base}' does not match delivery target '${target.value.baseRef}'`, retryable: false }
+  }), PRECONDITION_NOT_CREATED);
+  let verifiedHeadSha: string | undefined;
+  if (base.provider.changeRequests?.verifyHead) {
+    const verified = await base.provider.changeRequests.verifyHead({
+      context: providerOperationContext(base.loadedContext),
+      head: options.head
     });
+    if (!verified.ok) return withCreation(providerPullRequestError(base, verified.error, base.prNumber), PRECONDITION_NOT_CREATED);
+    verifiedHeadSha = verified.value.sha;
+  }
+  if (base.prIdentity) {
+    const inspected = await inspectExternalPullRequest(base, base.prIdentity!);
+    return inspected.status === 'failed' || inspected.status === 'blocked'
+      ? withCreation(inspected, PRECONDITION_NOT_CREATED)
+      : withCreation({ ...inspected, result: 'no_op' }, { kind: 'no-op', createdByCurrentOperation: false });
   }
+  if (options.dryRun) return withCreation(result('planned', base.resolved.taskId, base.issueNumber, null, {
+    platform: base.context.platform,
+    capabilities: base.context.capabilities,
+    operations: [{ name: 'pr:create', status: 'planned', reasonCode: null }],
+    result: 'pr_created',
+    error: null
+  }), { kind: 'planned', action: 'create', createdByCurrentOperation: false });
+
+  const started = writeCreateStarted(base, options.agent);
+  if (started.status === 'failed') return withCreation(result('failed', base.resolved.taskId, base.issueNumber, null, {
+    error: { code: started.error.code, message: started.error.message, retryable: false }
+  }), PRECONDITION_NOT_CREATED);
+  const created = base.provider.changeRequests?.create
+    ? await base.provider.changeRequests.create({
+      context: providerOperationContext(base.loadedContext),
+      base: options.base,
+      head: options.head,
+      title: options.title,
+      body: options.body,
+      draft: Boolean(options.draft),
+      mutation: { idempotencyKey: `pull-request:create:${base.resolved.taskId}` }
+    })
+    : unsupportedProviderOperation(base.provider, 'changeRequests.create');
+  if (!created.ok) return withCreation(providerPullRequestError(base, created.error, null), { kind: 'unknown', errorCode: 'PR_CREATE_OUTCOME_UNKNOWN' });
+  const remoteId = String(created.value.remoteId || '');
+  let createdIdentity: ResourceIdentity;
+  try { createdIdentity = providerResourceIdentity(base.provider, 'pull-request', remoteId); }
+  catch (error) {
+    return withCreation(result('failed', base.resolved.taskId, base.issueNumber, null, {
+      platform: base.context.platform, capabilities: base.context.capabilities,
+      error: { code: 'PR_CREATE_RESPONSE_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
+    }), { kind: 'created', createdByCurrentOperation: true });
+  }
+  const number = resourceIdentityNumber(createdIdentity);
+  const fallbackNumber = number ?? 0;
+  const fallback = normalizeProviderPullRequest({
+    id: remoteId,
+    identity: createdIdentity,
+    number: number || undefined,
+    state: 'open',
+    title: options.title,
+    body: options.body,
+    headSha: '',
+    baseSha: '',
+    head: { repository: base.context.platform.repository!, ref: options.head, sha: '' },
+    base: { repository: base.context.platform.repository!, ref: options.base, sha: '' },
+    displayUrl: `${base.provider.type}:${remoteId}`
+  }, base.context.platform.repository!, fallbackNumber);
+  const inspected = base.provider.changeRequests?.inspect
+    ? await base.provider.changeRequests.inspect({
+      context: providerOperationContext(base.loadedContext),
+      target: createdIdentity
+    })
+    : unsupportedProviderOperation(base.provider, 'changeRequests.inspect');
+  if (!inspected.ok) return withCreation(providerPullRequestError(base, inspected.error, number), { kind: 'created', createdByCurrentOperation: true });
+  const pullRequest = normalizeProviderPullRequest(
+    inspected.value,
+    base.context.platform.repository!,
+    inspected.value.number ?? fallback.number,
+    fallback
+  );
+  if (!pullRequest.nodeId || !isUsableResourceIdentity(pullRequestIdentity(pullRequest))) return withCreation(result('failed', base.resolved.taskId, base.issueNumber, null, {
+    platform: base.context.platform,
+    capabilities: base.context.capabilities,
+    error: { code: 'PR_CREATE_RESPONSE_INVALID', message: 'Provider create response lacks validated identity', retryable: false }
+  }), { kind: 'created', createdByCurrentOperation: true });
+  const identity = validateWriterIdentity(base, pullRequest, {
+    expectedHead: options.head,
+    expectedHeadSha: verifiedHeadSha,
+    errorCode: 'PR_BIND_IDENTITY_MISMATCH'
+  });
+  if (!identity.ok) return withCreation(result('failed', base.resolved.taskId, base.issueNumber, pullRequest.number, {
+    platform: base.context.platform,
+    capabilities: base.context.capabilities,
+    resource: { kind: 'pull-request', number: pullRequest.number },
+    pullRequest,
+    error: identity.error
+  }), { kind: 'created', createdByCurrentOperation: true });
+  const bound = bindIdentity(base, pullRequest, options.agent, 'created', false, options.head);
+  if (bound.status === 'failed') return withCreation(result('failed', base.resolved.taskId, base.issueNumber, pullRequest.number, {
+    platform: base.context.platform,
+    capabilities: base.context.capabilities,
+    resource: { kind: 'pull-request', number: pullRequest.number },
+    pullRequest,
+    error: { code: 'PR_CREATED_BIND_FAILED', message: `${pullRequest.url}: ${bound.error.message}`, retryable: false }
+  }), { kind: 'created', createdByCurrentOperation: true });
+  return withCreation(result('applied', base.resolved.taskId, base.issueNumber, pullRequest.number, {
+    changed: true,
+    platform: base.context.platform,
+    capabilities: base.context.capabilities,
+    resource: { kind: 'pull-request', number: pullRequest.number },
+    pullRequest,
+    operations: [{ name: 'pr:create', status: 'applied', reasonCode: null }, { name: 'task:bind-pr', status: 'applied', reasonCode: null }],
+    result: 'pr_created',
+    error: null
+  }), { kind: 'created', createdByCurrentOperation: true });
 }
 
-function syncPlatformPullRequest(taskRef: string, options: SyncOptions): PullRequestResult {
+async function syncPlatformPullRequest(taskRef: string, options: SyncOptions): Promise<PullRequestResult> {
   const warningResult = warningResultForPrimary(options.primaryResult);
   const softenFailure = (output: PullRequestResult): PullRequestResult => {
+    const authorityError = output.error?.code.startsWith('IN_LABEL_SYNC') || output.error?.code.startsWith('PR_IDENTITY');
     const warning = output.error && output.task.prNumber !== null
+      && !authorityError
       && !['PR_NOT_LINKED', 'PR_BIND_CONFLICT'].includes(output.error.code)
       ? {
         code: output.error.code,
@@ -1029,63 +1467,245 @@ function syncPlatformPullRequest(taskRef: string, options: SyncOptions): PullReq
       ? { ...output, status: 'applied', changed: false, error: null, result: warningResult, warnings: mergeOperationWarnings([warning]) }
       : output;
   };
-  const base = resolvedContext(taskRef, options);
+  const base = await resolvedContext(taskRef, options);
   if (!base.ok) return softenFailure(base.output);
-  if (!base.prNumber) return softenFailure(result('failed', base.resolved.taskId, base.issueNumber, null, {
-    error: { code: 'PR_NOT_LINKED', message: 'Task has no valid pr_number', retryable: false }
-  }));
-  const fetched = inspectGitHubPullRequest(base.client, base.context.platform.repository!, base.prNumber, base.resolved.repoRoot);
-  if (!fetched.ok) return softenFailure(result(fetched.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, { error: fetched.error }));
-  if (!options.metadata && !options.closingIssue) return softenFailure(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
-    error: { code: 'PR_PAYLOAD_INVALID', message: 'sync requires a desired-state option', retryable: false }
-  }));
-  if (!base.issueNumber) return softenFailure(result('degraded', base.resolved.taskId, null, base.prNumber, {
-    pullRequest: fetched.value, error: { code: 'ISSUE_NOT_LINKED', message: 'Task has no linked Issue to copy metadata from', retryable: false }
-  }));
-  const issue = inspectPlatformIssue(taskRef, { cwd: base.resolved.repoRoot, client: base.client });
-  if (!issue.issue) return softenFailure(result(issue.status, base.resolved.taskId, base.issueNumber, base.prNumber, {
-    platform: base.context.platform, capabilities: base.context.capabilities, pullRequest: fetched.value, error: issue.error
+  if (!base.fact) return softenFailure(result('failed', base.resolved.taskId, base.issueNumber, null, {
+    error: { code: 'PR_DELIVERY_FACT_MISSING', message: 'Task has no pr_delivery_fact; repair the task metadata or create a new task', retryable: false }
   }));
-  const planned = planPullRequestMetadata({
-    pullRequest: fetched.value,
-    issue: issue.issue,
-    taskType: base.frontmatter.type || 'task',
-    issueNumber: base.issueNumber,
-    capabilities: base.context.capabilities
-  }).operations.filter((operation) => options.metadata || operation.name === 'closing-issue')
-    .filter((operation) => options.closingIssue || operation.name !== 'closing-issue');
-  const operations: PlatformOperation[] = planned.map(({ name, status, reasonCode }) => ({ name, status, reasonCode }));
-  if (options.dryRun) return softenFailure(result(planned.some((operation) => operation.status === 'planned') ? 'planned' : 'no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
-    platform: base.context.platform, capabilities: base.context.capabilities, pullRequest: fetched.value, operations, error: null
+  if (!base.prIdentity) return softenFailure(result('failed', base.resolved.taskId, base.issueNumber, null, {
+    error: { code: 'PR_NOT_LINKED', message: 'Task has no verified bound pull request', retryable: false }
   }));
-  const payload: Record<string, unknown> = {};
-  for (const operation of planned) {
-    if (operation.status !== 'planned') continue;
-    if (operation.name === 'labels') payload.labels = operation.value;
-    if (operation.name === 'assignees') payload.assignees = operation.value;
-    if (operation.name === 'closing-issue') payload.body = operation.value;
-    if (operation.name === 'milestone') {
-      const milestones = base.client.json<unknown[]>(['api', '--paginate', '--slurp', `repos/${base.context.platform.repository}/milestones?state=open&per_page=100`], { cwd: base.resolved.repoRoot });
-      if (!milestones.ok) return softenFailure(result(milestones.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, { pullRequest: fetched.value, operations, error: milestones.error }));
-      const flat = milestones.value.flatMap((entry) => Array.isArray(entry) ? entry : [entry]) as Array<{ title?: string; number?: number }>;
-      payload.milestone = flat.find((entry) => entry.title === operation.value)?.number ?? null;
+  {
+    const inspected = await inspectExternalPullRequest(base, base.prIdentity!);
+    if (inspected.status === 'failed' || inspected.status === 'blocked' || !inspected.pullRequest) return softenFailure(inspected);
+    if (!options.metadata && !options.closingIssue) return softenFailure(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+      error: { code: 'PR_PAYLOAD_INVALID', message: 'sync requires a desired-state option', retryable: false }
+    }));
+    const issue = await inspectPlatformIssue(taskRef, { cwd: base.resolved.repoRoot, client: base.client });
+    if (!issue.issue) return softenFailure(result(issue.status, base.resolved.taskId, base.issueNumber, base.prNumber, {
+      platform: base.context.platform, capabilities: base.context.capabilities, pullRequest: inspected.pullRequest, error: issue.error
+    }));
+    let inLabels = inspected.pullRequest.labels.filter((label) => label.startsWith('in:')).sort();
+    let issueInLabelOperation: PlatformOperation | null = null;
+    if (options.metadata && base.provider.issues?.listLabels) {
+      const labels = await base.provider.issues.listLabels({ context: providerOperationContext(base.loadedContext) });
+      if (!labels.ok) return softenFailure(providerPullRequestError(base, labels.error, base.prNumber));
+      const target = taskInLabelTarget(base.resolved.repoRoot, base.frontmatter, inspected.pullRequest.labels, new Set(labels.value));
+      if (!target.ok) return softenFailure(providerPullRequestError(base, target.error, base.prNumber));
+      inLabels = target.value;
+      const currentIssueLabels = issue.issue.labels.filter((label) => label.startsWith('in:')).sort();
+      issueInLabelOperation = base.context.capabilities.triage
+        ? currentIssueLabels.join('\0') === inLabels.join('\0')
+          ? { name: 'labels:in:issue', status: 'no-op', reasonCode: null }
+          : { name: 'labels:in:issue', status: 'planned', reasonCode: null }
+        : { name: 'labels:in:issue', status: 'skipped', reasonCode: 'TRIAGE_REQUIRED' };
     }
-  }
-  if (Object.keys(payload).length === 0) {
-    const degraded = planned.some((operation) => operation.status === 'skipped');
-    return softenFailure(result(degraded ? 'degraded' : 'no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
-      platform: base.context.platform, capabilities: base.context.capabilities, resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: fetched.value, operations, error: null
+    const planned = planPullRequestMetadata({
+      pullRequest: inspected.pullRequest,
+      issue: issue.issue,
+      taskType: String(base.frontmatter.type || 'task'),
+      issueNumber: base.issueNumber,
+      capabilities: base.context.capabilities,
+      inLabels
+    }).operations.filter((operation) => options.metadata || operation.name === 'closing-issue')
+      .filter((operation) => options.closingIssue || operation.name !== 'closing-issue');
+    const operations: PlatformOperation[] = [
+      ...(issueInLabelOperation ? [issueInLabelOperation] : []),
+      ...planned.map(({ name, status, reasonCode }) => ({ name, status, reasonCode }))
+    ];
+    const milestoneOperation = planned.find((operation) => operation.name === 'milestone' && operation.status === 'planned');
+    if (milestoneOperation && base.provider.issues?.listMilestones) {
+      const milestones = await base.provider.issues.listMilestones({ context: providerOperationContext(base.loadedContext) });
+      if (!milestones.ok) return providerPullRequestError(base, milestones.error, base.prNumber);
+    }
+    if (options.dryRun) return softenFailure(result(planned.some((operation) => operation.status === 'planned') ? 'planned' : 'no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
+      platform: base.context.platform, capabilities: base.context.capabilities, pullRequest: inspected.pullRequest, operations, error: null
+    }));
+    let issueChanged = false;
+    if (issueInLabelOperation?.status === 'planned') {
+      const desiredIssueLabels = [...new Set([
+        ...issue.issue.labels.filter((label) => !label.startsWith('in:')),
+        ...inLabels
+      ])].sort();
+      const updatedIssue = base.provider.issues?.update
+        ? await base.provider.issues.update({
+          context: providerOperationContext(base.loadedContext),
+          target: base.issueIdentity!,
+          currentLabels: issue.issue.labels,
+          patch: { labels: desiredIssueLabels },
+          mutation: { idempotencyKey: `issue:update:${base.resolved.taskId}:in-labels` }
+        })
+        : unsupportedProviderOperation(base.provider, 'issues.update');
+      if (!updatedIssue.ok) return softenFailure(providerPullRequestError(base, updatedIssue.error, base.prNumber));
+      issueChanged = updatedIssue.value.changed;
+      const rereadIssue = base.provider.issues?.inspect
+        ? await base.provider.issues.inspect({ context: providerOperationContext(base.loadedContext), target: base.issueIdentity! })
+        : unsupportedProviderOperation(base.provider, 'issues.inspect');
+      if (!rereadIssue.ok) return softenFailure(providerPullRequestError(base, {
+        ...rereadIssue.error,
+        code: 'IN_LABEL_SYNC_PARTIAL',
+        message: `In-label synchronization is partial or unknown: ${rereadIssue.error.message}`
+      }, base.prNumber));
+      const actualIssueLabels = rereadIssue.value.labels.filter((label) => label.startsWith('in:')).sort();
+      if (actualIssueLabels.join('\0') !== inLabels.join('\0')) return softenFailure(providerPullRequestError(base, {
+        code: 'IN_LABEL_SYNC_PARTIAL',
+        message: 'Issue in: labels did not converge after update',
+        retryable: true
+      }, base.prNumber));
+    }
+    const patch: Record<string, unknown> = {};
+    for (const operation of planned) {
+      if (operation.status !== 'planned') continue;
+      if (operation.name === 'labels') patch.labels = operation.value;
+      if (operation.name === 'assignees') patch.assignees = operation.value;
+      if (operation.name === 'closing-issue') patch.body = operation.value;
+      if (operation.name === 'milestone') patch.milestone = operation.value;
+    }
+    if (Object.keys(patch).length === 0) return softenFailure(result(planned.some((operation) => operation.status === 'skipped') ? 'degraded' : 'no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
+      platform: base.context.platform, capabilities: base.context.capabilities, resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: inspected.pullRequest, operations, error: null
+    }));
+    const updated = base.provider.changeRequests?.update
+      ? await base.provider.changeRequests.update({
+        context: providerOperationContext(base.loadedContext),
+        target: base.prIdentity,
+        currentLabels: inspected.pullRequest.labels,
+        patch: patch as never,
+        mutation: { idempotencyKey: `pull-request:update:${base.resolved.taskId}` }
+      })
+      : unsupportedProviderOperation(base.provider, 'changeRequests.update');
+    if (!updated.ok) {
+      const error = issueChanged && !updated.error.code.startsWith('IN_LABEL_SYNC')
+        ? { ...updated.error, code: 'IN_LABEL_SYNC_PARTIAL', message: `In-label synchronization is partial or unknown: ${updated.error.message}` }
+        : updated.error;
+      return softenFailure(providerPullRequestError(base, error, base.prNumber));
+    }
+    let finalPullRequest = inspected.pullRequest;
+    if (planned.some((operation) => operation.name === 'labels' && operation.status === 'planned')) {
+      const reread = base.provider.changeRequests?.inspect
+        ? await base.provider.changeRequests.inspect({ context: providerOperationContext(base.loadedContext), target: base.prIdentity })
+        : unsupportedProviderOperation(base.provider, 'changeRequests.inspect');
+      if (!reread.ok) return softenFailure(providerPullRequestError(base, {
+        ...reread.error,
+        code: 'IN_LABEL_SYNC_PARTIAL',
+        message: `In-label synchronization is partial or unknown: ${reread.error.message}`
+      }, base.prNumber));
+      finalPullRequest = normalizeProviderPullRequest(reread.value, base.context.platform.repository!, base.prNumber || 0, inspected.pullRequest);
+      const expected = ((planned.find((operation) => operation.name === 'labels')?.value as string[] || [])
+        .filter((label) => label.startsWith('in:') || label.startsWith('type:'))).sort();
+      const actual = finalPullRequest.labels.filter((label) => label.startsWith('in:') || label.startsWith('type:')).sort();
+      if (actual.join('\0') !== expected.join('\0')) return softenFailure(providerPullRequestError(base, {
+        code: 'IN_LABEL_SYNC_PARTIAL',
+        message: 'Pull request labels did not converge after update',
+        retryable: true
+      }, base.prNumber));
+    }
+    return softenFailure(result(planned.some((operation) => operation.status === 'skipped') ? 'degraded' : 'applied', base.resolved.taskId, base.issueNumber, base.prNumber, {
+      changed: issueChanged || updated.value.changed,
+      platform: base.context.platform,
+      capabilities: base.context.capabilities,
+      resource: { kind: 'pull-request', number: base.prNumber },
+      pullRequest: finalPullRequest,
+      operations: operations.map((operation) => operation.status === 'planned' ? { ...operation, status: 'applied' } : operation),
+      error: null
     }));
   }
-  const patched = base.client.json<RemotePullRequest>(['api', `repos/${base.context.platform.repository}/issues/${base.prNumber}`, '-X', 'PATCH', '--input', '-'], {
-    cwd: base.resolved.repoRoot, method: 'PATCH', input: JSON.stringify(payload)
+}
+
+function readProjectPrFlow(repoRoot: string): 'required' | 'disabled' | undefined {
+  try {
+    const config = JSON.parse(fs.readFileSync(path.join(repoRoot, '.agents', '.airc.json'), 'utf8')) as { prFlow?: unknown };
+    return config.prFlow === 'required' || config.prFlow === 'disabled' ? config.prFlow : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function skipPlatformPullRequestFactUnlocked(
+  resolved: Extract<ReturnType<typeof resolveTaskRef>, { ok: true }>,
+  options: SkipFactOptions
+): PullRequestResult {
+  let content: string;
+  let frontmatter: ReturnType<typeof parseTypedTaskFrontmatter>;
+  try {
+    content = fs.readFileSync(resolved.taskMdPath, 'utf8');
+    frontmatter = parseTypedTaskFrontmatter(content);
+  } catch (error) {
+    return result('failed', resolved.taskId, null, null, {
+      error: { code: 'TASK_DOCUMENT_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
+    });
+  }
+  let issueIdentity: ResourceIdentity | null;
+  try { issueIdentity = taskIssueIdentity(frontmatter, undefined, options.runtimeVersion); }
+  catch (error) { return result('failed', resolved.taskId, null, null, { error: { ...taskIssueIdentityError(error), retryable: false } }); }
+  const issueNumber = resourceIdentityNumber(issueIdentity);
+  const existing = readPrDeliveryFact(frontmatter, options.runtimeVersion);
+  if (existing.status === 'invalid') return result('failed', resolved.taskId, issueNumber, null, {
+    error: { code: existing.error.code, message: existing.error.message, retryable: false }
   });
-  if (!patched.ok) return softenFailure(result(patched.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, { pullRequest: fetched.value, operations, error: patched.error }));
-  return softenFailure(result(planned.some((operation) => operation.status === 'skipped') ? 'degraded' : 'applied', base.resolved.taskId, base.issueNumber, base.prNumber, {
-    changed: true, platform: base.context.platform, capabilities: base.context.capabilities,
-    resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: fetched.value,
-    operations: operations.map((operation) => operation.status === 'planned' ? { ...operation, status: 'applied' } : operation), error: null
-  }));
+  if (existing.status === 'missing') return result('failed', resolved.taskId, issueNumber, null, {
+    error: { code: 'PR_DELIVERY_FACT_MISSING', message: 'Task has no pr_delivery_fact; repair the task metadata or create a new task', retryable: false }
+  });
+  if (existing.fact.state === 'skipped') return result('no-op', resolved.taskId, issueNumber, null, {
+    operations: [{ name: 'task:skip-pr', status: 'no-op', reasonCode: null }],
+    error: null
+  });
+  if (existing.fact.state === 'bound') {
+    const boundNumber = resourceIdentityNumber(existing.fact.identity.resource);
+    return result('failed', resolved.taskId, issueNumber, boundNumber, {
+      error: { code: 'PR_DELIVERY_FACT_CONFLICT', message: `Task is already bound to PR ${boundNumber === null ? 'identity' : `#${boundNumber}`}`, retryable: false }
+    });
+  }
+  if (readProjectPrFlow(resolved.repoRoot) === 'required') return result('failed', resolved.taskId, issueNumber, null, {
+    error: { code: 'PR_SKIP_FORBIDDEN', message: 'Cannot skip PR delivery when prFlow is required', retryable: false }
+  });
+
+  const metadata = captureTaskWriteMetadata();
+  const fact = buildSkippedFact(factTimestamp(metadata.timestamp));
+  const write = writeTask({
+    taskRef: resolved.taskId,
+    expectedState: 'active',
+    dryRun: options.dryRun,
+    mutations: [
+      { kind: 'frontmatter', set: { ...factFrontmatterMutation(fact).set, assigned_to: options.agent } },
+      { kind: 'section', aliases: ['活动日志', 'Activity Log'], heading: '活动日志', body: appendActivity(
+        content, `- ${metadata.timestamp} — **Skip PR** by ${options.agent} — PR delivery explicitly skipped`
+      ) }
+    ]
+  }, { repoRoot: resolved.repoRoot, metadataProvider: () => metadata });
+  if (write.status === 'failed') return result('failed', resolved.taskId, issueNumber, null, {
+    error: { code: write.error.code, message: write.error.message, retryable: false }
+  });
+  const status = options.dryRun ? 'planned' : write.status === 'no-op' ? 'no-op' : 'applied';
+  return result(status, resolved.taskId, issueNumber, null, {
+    changed: !options.dryRun && write.changed,
+    operations: [{ name: 'task:skip-pr', status, reasonCode: null }],
+    error: null
+  });
+}
+
+async function skipPlatformPullRequestFact(taskRef: string, options: SkipFactOptions): Promise<PullRequestResult> {
+  const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
+  if (!resolved.ok) return result('failed', resolved.taskId, null, null, {
+    error: { code: resolved.code, message: resolved.message, retryable: false }
+  });
+  if (resolved.state !== 'active') return result('failed', resolved.taskId, null, null, {
+    error: { code: 'TASK_STATE_INVALID', message: 'platform-pr skip requires an active task', retryable: false }
+  });
+  try {
+    return withTaskExecutionLock(
+      resolved.repoRoot,
+      resolved.taskId,
+      'platform-pr.skip',
+      () => skipPlatformPullRequestFactUnlocked(resolved, options)
+    );
+  } catch (error) {
+    if (error instanceof TaskExecutionLockError) return result('blocked', resolved.taskId, null, null, {
+      error: { code: error.code, message: error.message, retryable: true }
+    });
+    return result('failed', resolved.taskId, null, null, {
+      error: { code: 'PR_SKIP_FAILED', message: error instanceof Error ? error.message : String(error), retryable: false }
+    });
+  }
 }
 
 export {
@@ -1096,11 +1716,12 @@ export {
   inspectPlatformPullRequest,
   inspectPlatformPullRequestByNumber,
   normalizePullRequest,
-  resolveGitHubChangeRequestGitEvidence,
   resolveExternalPullRequest,
+  skipPlatformPullRequestFact,
   selectExternalPullRequest,
   selectPullRequest,
-  syncPlatformPullRequest
+  syncPlatformPullRequest,
+  syncPlatformPullRequestInLabels
 };
-export type { BindOptions, CreateOptions, ExternalPullRequestResult, ExternalPullRequestSelection, PullRequestPrimaryResult, PullRequestResult, PullRequestSnapshot, ResolveExternalOptions, SyncOptions };
+export type { BindOptions, CreateOptions, ExternalPullRequestResult, ExternalPullRequestSelection, PullRequestPrimaryResult, PullRequestResult, PullRequestSnapshot, ResolveExternalOptions, SkipFactOptions, SyncOptions };
 export { warningResultForPrimary };