@h-rig/bundle-default-lifecycle 0.0.6-alpha.154 → 0.0.6-alpha.156

package/dist/src/pipelineCloseout.js

@@ -1,16 +1,2643 @@
 // @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
+// packages/bundle-default-lifecycle/src/control-plane/pr-automation.ts
+var exports_pr_automation = {};
+__export(exports_pr_automation, {
+  runRepoDefaultMerge: () => runRepoDefaultMerge,
+  runPrAutomation: () => runPrAutomation,
+  resolvePrAutomationLimits: () => resolvePrAutomationLimits,
+  requestGreptileRereview: () => requestGreptileRereview,
+  pushBranchSyncedWithOrigin: () => pushBranchSyncedWithOrigin,
+  hasCommittableRunChanges: () => hasCommittableRunChanges,
+  gateNeedsGreptileRereview: () => gateNeedsGreptileRereview,
+  commitRunChanges: () => commitRunChanges,
+  collectPendingPrChecks: () => collectPendingPrChecks,
+  collectActionablePrFeedback: () => collectActionablePrFeedback,
+  closeIssueAfterMergedPr: () => closeIssueAfterMergedPr,
+  buildPrAutomationBody: () => buildPrAutomationBody,
+  UPLOADED_SNAPSHOT_PR_MARKER: () => UPLOADED_SNAPSHOT_PR_MARKER
+});
+import { assertSafeGitBranchName } from "@rig/shared/safe-identifiers";
+import { runStrictPrMergeGate } from "@rig/pr-review-plugin";
+import {
+  strictMergeHeadShaFromGate
+} from "@rig/contracts";
+function positiveInt(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
+}
+function resolvePrAutomationLimits(config) {
+  return {
+    maxPrFixIterations: positiveInt(config?.automation?.maxPrFixIterations, 100500)
+  };
+}
+function buildPrAutomationBody(input) {
+  const lines = [
+    input.summary?.trim() || "Rig completed this task autonomously.",
+    "",
+    `Run: ${input.runId}`
+  ];
+  if (/^\d+$/.test(input.taskId)) {
+    lines.push("", `Closes #${input.taskId}`);
+  }
+  if (input.uploadedSnapshot) {
+    lines.push("", UPLOADED_SNAPSHOT_PR_MARKER, "This PR was seeded from an uploaded local working-tree snapshot. Review local snapshot provenance before merging if repository policy requires it.");
+  }
+  return lines.join(`
+`);
+}
+function wildcardToRegExp(pattern) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`, "i");
+}
+function isAllowedFailure(name, allowedFailures) {
+  return allowedFailures.some((pattern) => wildcardToRegExp(pattern).test(name));
+}
+function isPendingCheck(check) {
+  const conclusion = String(check.conclusion ?? "").toLowerCase();
+  const state = String(check.state ?? check.status ?? "").toLowerCase();
+  return ["pending", "queued", "in_progress", "waiting", "requested", "expected", "action_required"].includes(conclusion) || ["pending", "queued", "in_progress", "waiting", "requested", "expected"].includes(state);
+}
+function isPassingCheck(check) {
+  const conclusion = String(check.conclusion ?? "").toLowerCase();
+  const state = String(check.state ?? check.status ?? "").toLowerCase();
+  return ["success", "successful", "passed", "neutral", "skipped"].includes(conclusion) || ["success", "successful", "passed", "completed"].includes(state);
+}
+function isFailingCheck(check) {
+  const conclusion = String(check.conclusion ?? "").toLowerCase();
+  const state = String(check.state ?? check.status ?? "").toLowerCase();
+  return ["failure", "failed", "timed_out", "action_required", "cancelled", "error"].includes(conclusion) || ["failure", "failed", "timed_out", "action_required", "cancelled", "error"].includes(state);
+}
+function collectPendingPrChecks(input) {
+  const allowedFailures = input.allowedFailures ?? [];
+  const pending = [];
+  for (const check of input.checks ?? []) {
+    const name = check.name.trim();
+    if (!name || isAllowedFailure(name, allowedFailures))
+      continue;
+    if (isPendingCheck(check) && !isPassingCheck(check))
+      pending.push(name);
+  }
+  return pending;
+}
+function collectActionablePrFeedback(input) {
+  const allowedFailures = input.allowedFailures ?? [];
+  const feedback = [];
+  for (const check of input.checks ?? []) {
+    const name = check.name.trim();
+    if (!name || !isFailingCheck(check) || isAllowedFailure(name, allowedFailures))
+      continue;
+    feedback.push(`Check failed: ${name}${check.detailsUrl ? ` (${check.detailsUrl})` : ""}`);
+  }
+  for (const thread of input.reviewThreads ?? []) {
+    if (thread.resolved === true)
+      continue;
+    const body = thread.body.trim();
+    if (!body)
+      continue;
+    feedback.push(`Review feedback from ${thread.author?.trim() || "reviewer"}: ${body}`);
+  }
+  return feedback;
+}
+function parseJsonArray(value) {
+  if (!value?.trim())
+    return [];
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+function parsePrChecks(value) {
+  return parseJsonArray(value).flatMap((entry) => {
+    if (!entry || typeof entry !== "object")
+      return [];
+    const record = entry;
+    const name = typeof record.name === "string" ? record.name : "";
+    if (!name.trim())
+      return [];
+    return [{
+      name,
+      status: typeof record.status === "string" ? record.status : null,
+      state: typeof record.state === "string" ? record.state : null,
+      conclusion: typeof record.conclusion === "string" ? record.conclusion : null,
+      detailsUrl: typeof record.detailsUrl === "string" ? record.detailsUrl : typeof record.link === "string" ? record.link : null
+    }];
+  });
+}
+function parsePrViewStatusCheckRollup(value) {
+  if (!value?.trim())
+    return [];
+  try {
+    const parsed = JSON.parse(value);
+    const rollup = Array.isArray(parsed.statusCheckRollup) ? parsed.statusCheckRollup : [];
+    return rollup.flatMap((entry) => {
+      if (!entry || typeof entry !== "object")
+        return [];
+      const record = entry;
+      const name = typeof record.name === "string" ? record.name : "";
+      if (!name.trim())
+        return [];
+      return [{
+        name,
+        status: typeof record.status === "string" ? record.status : null,
+        state: typeof record.state === "string" ? record.state : null,
+        conclusion: typeof record.conclusion === "string" ? record.conclusion : null,
+        detailsUrl: typeof record.detailsUrl === "string" ? record.detailsUrl : typeof record.link === "string" ? record.link : null
+      }];
+    });
+  } catch {
+    return [];
+  }
+}
+async function readPrChecks(input) {
+  const checks = await input.command(["pr", "checks", input.prUrl, "--json", "name,state,link"], input.cwd ? { cwd: input.cwd } : undefined);
+  if (checks.exitCode === 0) {
+    return parsePrChecks(checks.stdout);
+  }
+  const combined = `${checks.stderr ?? ""}
+${checks.stdout ?? ""}`;
+  if (!/unknown flag.*--json|unknown flag: --json|unknown shorthand flag/i.test(combined)) {
+    throw new Error(`gh pr checks ${input.prUrl} --json name,state,link failed (${checks.exitCode}): ${checks.stderr ?? checks.stdout ?? ""}`.trim());
+  }
+  const view = await runChecked(input.command, ["pr", "view", input.prUrl, "--json", "statusCheckRollup"], input.cwd, "gh");
+  return parsePrViewStatusCheckRollup(view.stdout);
+}
+function parsePrViewReviewThreads(value) {
+  if (!value?.trim())
+    return [];
+  try {
+    const parsed = JSON.parse(value);
+    const feedback = [];
+    const reviewThreads = parsed.reviewThreads;
+    if (Array.isArray(reviewThreads)) {
+      feedback.push(...reviewThreads.flatMap((entry) => {
+        if (!entry || typeof entry !== "object")
+          return [];
+        const record = entry;
+        const body = typeof record.body === "string" ? record.body : null;
+        if (!body)
+          return [];
+        return [{
+          id: typeof record.id === "string" ? record.id : null,
+          body,
+          resolved: typeof record.resolved === "boolean" ? record.resolved : false,
+          author: typeof record.author === "string" ? record.author : null
+        }];
+      }));
+    }
+    const reviews = parsed.reviews;
+    if (Array.isArray(reviews)) {
+      feedback.push(...reviews.flatMap((entry) => {
+        if (!entry || typeof entry !== "object")
+          return [];
+        const record = entry;
+        const state = typeof record.state === "string" ? record.state.toUpperCase() : "";
+        if (state !== "CHANGES_REQUESTED")
+          return [];
+        const body = typeof record.body === "string" && record.body.trim() ? record.body : "Changes requested by reviewer.";
+        const author = record.author && typeof record.author === "object" ? record.author.login : null;
+        return [{
+          id: typeof record.id === "string" ? record.id : null,
+          body,
+          resolved: false,
+          author: typeof author === "string" ? author : null
+        }];
+      }));
+    }
+    const reviewDecision = typeof parsed.reviewDecision === "string" ? parsed.reviewDecision.toUpperCase() : "";
+    if (reviewDecision === "CHANGES_REQUESTED" && feedback.length === 0) {
+      feedback.push({ body: "Changes requested by reviewer.", resolved: false });
+    }
+    return feedback;
+  } catch {
+    return [];
+  }
+}
+function findPrUrl(output) {
+  return output?.split(/\s+/).map((part) => part.trim()).find((part) => /^https?:\/\/\S+\/pull\/\d+$/i.test(part)) ?? null;
+}
+function normalizePrUrl(stdout) {
+  const url = findPrUrl(stdout);
+  if (!url)
+    throw new Error("gh pr create did not return a PR URL");
+  return url;
+}
+function parseGitHubPullRequestUrl(prUrl) {
+  try {
+    const parsed = new URL(prUrl);
+    const [owner, repo, kind, number] = parsed.pathname.split("/").filter(Boolean);
+    if (!owner || !repo || kind !== "pull" || !number || !/^\d+$/.test(number))
+      return null;
+    return { owner, repo, number };
+  } catch {
+    return null;
+  }
+}
+async function ensureExistingPrBodyHasRigMarkers(input) {
+  const view = await input.command(["pr", "view", input.prUrl, "--json", "body"], input.cwd ? { cwd: input.cwd } : undefined);
+  if (view.exitCode !== 0) {
+    throw new Error(`gh pr view ${input.prUrl} --json body failed (${view.exitCode}): ${view.stderr ?? view.stdout ?? ""}`.trim());
+  }
+  let currentBody = "";
+  try {
+    const parsed = JSON.parse(view.stdout ?? "{}");
+    currentBody = typeof parsed.body === "string" ? parsed.body : "";
+  } catch {
+    currentBody = "";
+  }
+  const requiredBlocks = input.body.split(/\n{2,}/).map((block) => block.trim()).filter((block) => /^Run: /i.test(block) || /^Closes #\d+/i.test(block));
+  const missing = requiredBlocks.filter((block) => {
+    if (/^Run: /i.test(block))
+      return !/^Run: \S+/im.test(currentBody);
+    return !currentBody.includes(block);
+  });
+  if (missing.length === 0)
+    return;
+  const nextBody = [currentBody.trim(), ...missing].filter(Boolean).join(`
+
+`);
+  const pr = parseGitHubPullRequestUrl(input.prUrl);
+  if (!pr)
+    throw new Error(`Cannot update existing PR body for unrecognized PR URL: ${input.prUrl}`);
+  const edit = await input.command(["api", `repos/${pr.owner}/${pr.repo}/issues/${pr.number}`, "-X", "PATCH", "-f", `body=${nextBody}`], input.cwd ? { cwd: input.cwd } : undefined);
+  if (edit.exitCode !== 0) {
+    throw new Error(`gh api repos/${pr.owner}/${pr.repo}/issues/${pr.number} -X PATCH -f body=<redacted> failed (${edit.exitCode}): ${edit.stderr ?? edit.stdout ?? ""}`.trim());
+  }
+}
+async function runChecked(command, args, cwd, label = "gh") {
+  const result = await command(args, cwd ? { cwd } : undefined);
+  if (result.exitCode !== 0) {
+    throw new Error(`${label} ${args.join(" ")} failed (${result.exitCode}): ${result.stderr ?? result.stdout ?? ""}`.trim());
+  }
+  return result;
+}
+function statusPathFromShortLine(line) {
+  const rawPath = line.length > 3 ? line.slice(3).trim() : "";
+  const renamedPath = rawPath.includes(" -> ") ? rawPath.split(" -> ").at(-1).trim() : rawPath;
+  if (renamedPath.startsWith('"') && renamedPath.endsWith('"')) {
+    try {
+      return JSON.parse(renamedPath);
+    } catch {
+      return renamedPath.slice(1, -1);
+    }
+  }
+  return renamedPath;
+}
+function isRuntimeCommitExcludedPath(path) {
+  const normalized = path.replace(/^\.\/+/, "").replace(/\/+$/, "");
+  return RIG_RUNTIME_COMMIT_EXCLUDES.some((excluded) => normalized === excluded || normalized.startsWith(`${excluded}/`));
+}
+function committableRunChangePaths(statusText) {
+  const seen = new Set;
+  const paths = [];
+  for (const line of statusText.split(/\r?\n/)) {
+    const path = statusPathFromShortLine(line);
+    if (!path || isRuntimeCommitExcludedPath(path) || seen.has(path))
+      continue;
+    seen.add(path);
+    paths.push(path);
+  }
+  return paths;
+}
+function hasCommittableRunChanges(statusText) {
+  return committableRunChangePaths(statusText).length > 0;
+}
+async function commitRunChanges(input) {
+  const status = await runChecked(input.command, ["status", "--short", "--untracked-files=all"], input.cwd, "git");
+  const statusText = status.stdout ?? "";
+  const committablePaths = committableRunChangePaths(statusText);
+  if (!statusText.trim() || committablePaths.length === 0) {
+    return { committed: false, status: statusText };
+  }
+  await runChecked(input.command, ["add", "-A", "--", ...committablePaths], input.cwd, "git");
+  const staged = await input.command(["diff", "--cached", "--quiet"], { cwd: input.cwd });
+  if (staged.exitCode === 0) {
+    return { committed: false, status: statusText };
+  }
+  if (staged.exitCode !== 1) {
+    throw new Error(`git diff --cached --quiet failed (${staged.exitCode}): ${staged.stderr ?? staged.stdout ?? ""}`.trim());
+  }
+  await runChecked(input.command, ["commit", "-m", input.message], input.cwd, "git");
+  return { committed: true, status: statusText };
+}
+async function closeIssueAfterMergedPr(input) {
+  await input.updateTaskSource(input.projectRoot, {
+    taskId: input.taskId,
+    sourceTask: input.sourceTask,
+    update: {
+      status: "closed",
+      comment: [
+        "<!-- rig:status-comment -->",
+        "### Rig status: closed",
+        "",
+        "Rig PR merged and closed this task.",
+        "",
+        `- Run: ${input.runId}`,
+        `- PR merged: ${input.prUrl}`
+      ].join(`
+`)
+    }
+  });
+}
+function parseGitHubRepoFromPrUrl(prUrl) {
+  const match = /^https?:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/\d+\/?$/i.exec(prUrl.trim());
+  return match ? { owner: match[1], repo: match[2] } : null;
+}
+async function resolveRepoDefaultMergeFlag(input) {
+  const repo = parseGitHubRepoFromPrUrl(input.prUrl);
+  if (!repo)
+    throw new Error(`Cannot resolve GitHub repository from PR URL: ${input.prUrl}`);
+  const result = await input.command(["api", `repos/${repo.owner}/${repo.repo}`], input.cwd ? { cwd: input.cwd } : undefined);
+  if (result.exitCode !== 0) {
+    throw new Error(`Could not read repository merge policy for ${repo.owner}/${repo.repo}: ${result.stderr ?? result.stdout ?? "gh api failed"}`.trim());
+  }
+  try {
+    const parsed = JSON.parse(result.stdout ?? "{}");
+    if (parsed.allow_merge_commit !== false)
+      return "--merge";
+    if (parsed.allow_squash_merge !== false)
+      return "--squash";
+    if (parsed.allow_rebase_merge !== false)
+      return "--rebase";
+  } catch (error) {
+    throw new Error(`Could not parse repository merge policy for ${repo.owner}/${repo.repo}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  throw new Error(`Repository ${repo.owner}/${repo.repo} has no enabled merge method for repo-default merge.`);
+}
+async function runRepoDefaultMerge(input) {
+  const merge = input.config?.merge ?? {};
+  if (merge.mode === "off")
+    return;
+  const requireGreptile = (input.config?.review?.provider ?? "greptile") === "greptile";
+  const matchHeadSha = strictMergeHeadShaFromGate(input.strictGate, input.prUrl, requireGreptile);
+  const method = merge.method ?? "repo-default";
+  const args = ["pr", "merge", input.prUrl];
+  if (method === "repo-default") {
+    args.push(await resolveRepoDefaultMergeFlag({ prUrl: input.prUrl, command: input.command, cwd: input.cwd }));
+  } else {
+    args.push(`--${method}`);
+  }
+  args.push("--match-head-commit", matchHeadSha);
+  if (merge.deleteBranch === true) {
+    args.push("--delete-branch");
+  }
+  if (merge.bypass === true) {
+    args.push("--admin");
+  }
+  await runChecked(input.command, args, input.cwd);
+}
+function shouldAttemptRigMerge(config) {
+  const mode = config?.merge?.mode;
+  return mode !== "off" && mode !== "pr-ready";
+}
+function isPendingOnlyGate(result) {
+  return result.pending && result.reasonDetails.length > 0 && result.reasonDetails.every((reason) => reason.reasonClass === "pending" && reason.suggestedAction === "wait");
+}
+function gateNeedsGreptileRereview(result) {
+  if (result.approved)
+    return false;
+  const staleShaEvidence = result.reasonDetails.some((reason) => reason.surface === "greptile" && (reason.code === "greptile_stale" || reason.code === "greptile_not_current_head" && !!reason.reviewedSha && reason.reviewedSha !== reason.headSha));
+  const hasParseableGreptileScore = !!result.evidence.greptile.score;
+  const greptileNeedsPrompt = !hasParseableGreptileScore && result.reasonDetails.some((reason) => reason.surface === "greptile" && reason.suggestedAction === "ask_greptile" && (reason.code === "greptile_not_current_head" || reason.code === "greptile_score_missing" || reason.code === "greptile_mapping_unproven"));
+  const greptileStillRunning = result.reasonDetails.some((reason) => reason.code === "greptile_pending" || reason.code === "greptile_missing");
+  return (staleShaEvidence || greptileNeedsPrompt) && !greptileStillRunning;
+}
+async function requestGreptileRereview(input) {
+  const sha = input.headSha?.trim() || "unknown";
+  const marker = `<!-- ${GREPTILE_REREVIEW_MARKER_PREFIX}:${sha} -->`;
+  const existing = await input.command(["pr", "view", input.prUrl, "--json", "comments"], input.cwd ? { cwd: input.cwd } : undefined);
+  if (existing.exitCode === 0 && (existing.stdout ?? "").includes(marker)) {
+    return false;
+  }
+  await runChecked(input.command, [
+    "pr",
+    "comment",
+    input.prUrl,
+    "--body",
+    `${marker}
+@greptileai review
+
+Rig strict merge gate: Greptile evidence is bound to an older commit. Requesting a fresh review of the current head (${sha}). Merge waits until Greptile re-reviews this exact commit.`
+  ], input.cwd);
+  return true;
+}
+async function pushBranchSyncedWithOrigin(input) {
+  const branch = assertSafeGitBranchName(input.branch, "PR branch");
+  const fetched = await input.gitCommand(["fetch", "origin", branch], { cwd: input.projectRoot });
+  if (fetched.exitCode === 0) {
+    const originRef = `origin/${branch}`;
+    const behind = await input.gitCommand(["rev-list", "--count", `HEAD..${originRef}`], { cwd: input.projectRoot });
+    const behindCount = Number.parseInt((behind.stdout ?? "").trim(), 10);
+    if (behind.exitCode === 0 && Number.isFinite(behindCount) && behindCount > 0) {
+      await runChecked(input.gitCommand, ["rebase", "--autostash", originRef], input.projectRoot, "git");
+    }
+  }
+  const pushed = await input.gitCommand(["push", "--set-upstream", "origin", branch], { cwd: input.projectRoot });
+  if (pushed.exitCode !== 0) {
+    await runChecked(input.gitCommand, ["push", "--set-upstream", "--force-with-lease", "origin", branch], input.projectRoot, "git");
+  }
+}
+async function syncBranchAfterPrFeedback(input) {
+  if (!input.gitCommand)
+    return;
+  const branch = assertSafeGitBranchName(input.branch, "PR branch");
+  await commitRunChanges({
+    cwd: input.projectRoot,
+    message: `rig: address PR feedback for task ${input.taskId}`,
+    command: input.gitCommand
+  });
+  await pushBranchSyncedWithOrigin({ projectRoot: input.projectRoot, branch, gitCommand: input.gitCommand });
+}
+async function runPrAutomation(input) {
+  const branch = assertSafeGitBranchName(input.branch, "PR branch");
+  const prConfig = input.config?.pr ?? {};
+  const requireGreptile = (input.config?.review?.provider ?? "greptile") === "greptile";
+  if (prConfig.mode === "off" || prConfig.mode === "ask") {
+    return { status: "skipped", iterations: 0, actionableFeedback: [] };
+  }
+  const body = buildPrAutomationBody({
+    taskId: input.taskId,
+    runId: input.runId,
+    summary: input.sourceTask?.title ? `Rig completed: ${input.sourceTask.title}` : null,
+    uploadedSnapshot: input.uploadedSnapshot
+  });
+  if (input.gitCommand) {
+    await pushBranchSyncedWithOrigin({ projectRoot: input.projectRoot, branch, gitCommand: input.gitCommand });
+  }
+  const createArgs = [
+    "pr",
+    "create",
+    "--head",
+    branch,
+    "--title",
+    input.sourceTask?.title?.trim() || `Rig task ${input.taskId}`,
+    "--body",
+    body
+  ];
+  const createResult = await input.command(createArgs, { cwd: input.projectRoot });
+  const existingPrUrl = createResult.exitCode === 0 ? null : /pull request .*already exists/i.test(`${createResult.stderr ?? ""}
+${createResult.stdout ?? ""}`) ? findPrUrl(`${createResult.stderr ?? ""}
+${createResult.stdout ?? ""}`) : null;
+  if (createResult.exitCode !== 0 && !existingPrUrl) {
+    throw new Error(`gh ${createArgs.join(" ")} failed (${createResult.exitCode}): ${createResult.stderr ?? createResult.stdout ?? ""}`.trim());
+  }
+  const prUrl = existingPrUrl ?? normalizePrUrl(createResult.stdout);
+  if (existingPrUrl) {
+    await ensureExistingPrBodyHasRigMarkers({ prUrl, body, command: input.command, cwd: input.projectRoot });
+  }
+  await input.lifecycle?.onPrOpened?.({ prUrl });
+  const { maxPrFixIterations } = resolvePrAutomationLimits(input.config);
+  let latestFeedback = [];
+  let pendingElapsedMs = 0;
+  const shouldMerge = shouldAttemptRigMerge(input.config);
+  for (let iteration = 1;iteration <= maxPrFixIterations; iteration += 1) {
+    await input.lifecycle?.onReviewCiStarted?.({ prUrl, iteration });
+    if (!shouldMerge) {
+      const checks = prConfig.watchChecks === false ? [] : await readPrChecks({ prUrl, command: input.command, cwd: input.projectRoot });
+      const reviewThreads = prConfig.autoFixReview === false ? [] : parsePrViewReviewThreads((await runChecked(input.command, ["pr", "view", prUrl, "--json", "reviewDecision,reviews"], input.projectRoot)).stdout);
+      latestFeedback = collectActionablePrFeedback({
+        checks,
+        reviewThreads,
+        allowedFailures: input.config?.merge?.allowedFailures ?? []
+      });
+      const pendingChecks = collectPendingPrChecks({ checks, allowedFailures: input.config?.merge?.allowedFailures ?? [] });
+      if (latestFeedback.length === 0 && pendingChecks.length > 0) {
+        const timeoutMs = positiveInt(prConfig.pendingTimeoutMs, 600000);
+        const pollMs = positiveInt(prConfig.pendingPollMs, 15000);
+        if (iteration >= maxPrFixIterations || timeoutMs <= 0 || pendingElapsedMs >= timeoutMs) {
+          return { status: "needs_attention", prUrl, iterations: iteration, actionableFeedback: pendingChecks.map((name) => `Check still pending: ${name}`), merged: false };
+        }
+        const sleepMs = Math.min(pollMs, timeoutMs - pendingElapsedMs);
+        await (input.sleep ?? Bun.sleep)(sleepMs);
+        pendingElapsedMs += sleepMs;
+        continue;
+      }
+      if (latestFeedback.length === 0) {
+        pendingElapsedMs = 0;
+        return { status: "opened", prUrl, iterations: iteration, actionableFeedback: [], merged: false };
+      }
+      pendingElapsedMs = 0;
+      if (iteration >= maxPrFixIterations || prConfig.autoFixChecks === false && prConfig.autoFixReview === false) {
+        return { status: "needs_attention", prUrl, iterations: iteration, actionableFeedback: latestFeedback, merged: false };
+      }
+      await input.lifecycle?.onFeedback?.({ prUrl, iteration, feedback: latestFeedback });
+      await input.steerPi([
+        `PR automation found actionable feedback on ${prUrl}.`,
+        `Fix iteration ${iteration + 1}/${maxPrFixIterations}.`,
+        "",
+        ...latestFeedback.map((entry) => `- ${entry}`)
+      ].join(`
+`));
+      await syncBranchAfterPrFeedback({ projectRoot: input.projectRoot, taskId: input.taskId, branch, gitCommand: input.gitCommand });
+      continue;
+    }
+    const gate = await runStrictPrMergeGate({
+      projectRoot: input.projectRoot,
+      prUrl,
+      taskId: input.taskId,
+      runId: input.runId,
+      cycle: iteration,
+      command: input.command,
+      artifactRoot: input.artifactRoot,
+      allowedFailures: input.config?.merge?.allowedFailures ?? [],
+      greptileApi: requireGreptile ? input.greptileApi : undefined,
+      requireGreptile
+    });
+    latestFeedback = [...gate.actionableFeedback];
+    if (requireGreptile && gateNeedsGreptileRereview(gate)) {
+      const requested = await requestGreptileRereview({
+        prUrl,
+        headSha: gate.evidence.headSha ?? null,
+        command: input.command,
+        cwd: input.projectRoot
+      });
+      if (requested) {
+        await input.lifecycle?.onFeedback?.({
+          prUrl,
+          iteration,
+          feedback: [`Requested a fresh Greptile review for current head ${gate.evidence.headSha ?? "unknown"}; merge stays blocked until Greptile re-reviews it.`]
+        });
+      }
+      const timeoutMs = positiveInt(prConfig.pendingTimeoutMs, 600000);
+      const pollMs = positiveInt(prConfig.pendingPollMs, 15000);
+      if (iteration >= maxPrFixIterations || timeoutMs <= 0 || pendingElapsedMs >= timeoutMs) {
+        return { status: "needs_attention", prUrl, iterations: iteration, actionableFeedback: latestFeedback, merged: false };
+      }
+      const sleepMs = Math.min(pollMs, timeoutMs - pendingElapsedMs);
+      await (input.sleep ?? Bun.sleep)(sleepMs);
+      pendingElapsedMs += sleepMs;
+      continue;
+    }
+    if (gate.approved) {
+      pendingElapsedMs = 0;
+      const finalGate = await runStrictPrMergeGate({
+        projectRoot: input.projectRoot,
+        prUrl,
+        taskId: input.taskId,
+        runId: input.runId,
+        cycle: iteration,
+        command: input.command,
+        artifactRoot: input.artifactRoot,
+        allowedFailures: input.config?.merge?.allowedFailures ?? [],
+        greptileApi: requireGreptile ? input.greptileApi : undefined,
+        requireGreptile,
+        final: true
+      });
+      if (finalGate.approved) {
+        await input.lifecycle?.onMergeStarted?.({ prUrl });
+        await runRepoDefaultMerge({ prUrl, config: input.config, command: input.command, cwd: input.projectRoot, strictGate: finalGate });
+        await input.lifecycle?.onMerged?.({ prUrl });
+        return { status: "merged", prUrl, iterations: iteration, actionableFeedback: [], merged: true };
+      }
+      latestFeedback = [...finalGate.actionableFeedback];
+      if (isPendingOnlyGate(finalGate)) {
+        const timeoutMs = positiveInt(prConfig.pendingTimeoutMs, 600000);
+        const pollMs = positiveInt(prConfig.pendingPollMs, 15000);
+        if (iteration >= maxPrFixIterations || timeoutMs <= 0 || pendingElapsedMs >= timeoutMs) {
+          return { status: "needs_attention", prUrl, iterations: iteration, actionableFeedback: latestFeedback, merged: false };
+        }
+        const sleepMs = Math.min(pollMs, timeoutMs - pendingElapsedMs);
+        await (input.sleep ?? Bun.sleep)(sleepMs);
+        pendingElapsedMs += sleepMs;
+        continue;
+      }
+      if (iteration >= maxPrFixIterations || prConfig.autoFixChecks === false && prConfig.autoFixReview === false) {
+        return { status: "needs_attention", prUrl, iterations: iteration, actionableFeedback: latestFeedback, merged: false };
+      }
+      await input.lifecycle?.onFeedback?.({ prUrl, iteration, feedback: latestFeedback });
+      await input.steerPi(finalGate.steeringPrompt);
+      await syncBranchAfterPrFeedback({ projectRoot: input.projectRoot, taskId: input.taskId, branch, gitCommand: input.gitCommand });
+      continue;
+    }
+    if (isPendingOnlyGate(gate)) {
+      const timeoutMs = positiveInt(prConfig.pendingTimeoutMs, 600000);
+      const pollMs = positiveInt(prConfig.pendingPollMs, 15000);
+      if (iteration >= maxPrFixIterations || timeoutMs <= 0 || pendingElapsedMs >= timeoutMs) {
+        return { status: "needs_attention", prUrl, iterations: iteration, actionableFeedback: latestFeedback, merged: false };
+      }
+      const sleepMs = Math.min(pollMs, timeoutMs - pendingElapsedMs);
+      await (input.sleep ?? Bun.sleep)(sleepMs);
+      pendingElapsedMs += sleepMs;
+      continue;
+    }
+    pendingElapsedMs = 0;
+    if (iteration >= maxPrFixIterations || prConfig.autoFixChecks === false && prConfig.autoFixReview === false) {
+      return { status: "needs_attention", prUrl, iterations: iteration, actionableFeedback: latestFeedback, merged: false };
+    }
+    await input.lifecycle?.onFeedback?.({ prUrl, iteration, feedback: latestFeedback });
+    await input.steerPi(gate.steeringPrompt);
+    await syncBranchAfterPrFeedback({ projectRoot: input.projectRoot, taskId: input.taskId, branch, gitCommand: input.gitCommand });
+  }
+  return { status: "needs_attention", prUrl, iterations: maxPrFixIterations, actionableFeedback: latestFeedback, merged: false };
+}
+var UPLOADED_SNAPSHOT_PR_MARKER = "<!-- rig:uploaded-snapshot -->", RIG_RUNTIME_COMMIT_EXCLUDES, GREPTILE_REREVIEW_MARKER_PREFIX = "rig:greptile-rereview";
+var init_pr_automation = __esm(() => {
+  RIG_RUNTIME_COMMIT_EXCLUDES = [
+    ".rig",
+    "artifacts",
+    "node_modules"
+  ];
+});
+
+// packages/bundle-default-lifecycle/src/control-plane/verifier.ts
+import { existsSync, mkdirSync, writeFileSync } from "fs";
+import { resolve } from "path";
+import { resolveRuntimeSecrets } from "@rig/runtime/control-plane/runtime/baked-secrets";
+import { readPrMetadata } from "@rig/runtime/control-plane/native/git-ops";
+import { loadRuntimeContextFromEnv } from "@rig/runtime/control-plane/runtime/context";
+import { readConfiguredTaskSourceTask } from "@rig/runtime/control-plane/tasks/source-lifecycle";
+import { artifactDirForId, lookupTask, readTaskConfig } from "@rig/runtime/control-plane/native/task-state";
+import { nowIso, resolveHarnessPaths, runCapture } from "@rig/runtime/control-plane/native/utils";
+import {
+  collectPrReviewEvidence,
+  evaluateStrictPrMergeGate,
+  parseGreptileScore,
+  stripHtml
+} from "@rig/pr-review-plugin";
+async function verifyTask(options) {
+  const paths = resolveHarnessPaths(options.projectRoot);
+  const taskId = options.taskId;
+  const normalizedTaskId = lookupTask(options.projectRoot, taskId);
+  const artifactDir = artifactDirForId(options.projectRoot, taskId);
+  mkdirSync(artifactDir, { recursive: true });
+  const validationSummaryPath = resolve(artifactDir, "validation-summary.json");
+  const reviewFeedbackPath = resolve(artifactDir, "review-feedback.md");
+  const reviewStatePath = resolve(artifactDir, "review-state.json");
+  const greptileRawPath = resolve(artifactDir, "review-greptile-raw.json");
+  const prStates = readPrMetadata(options.projectRoot, taskId);
+  const prState = prStates[0] || null;
+  const localReasons = [];
+  const aiReasons = [];
+  const aiWarnings = [];
+  let aiVerdict = "SKIP";
+  let aiRawFeedback = "";
+  const persistArtifacts = options.persistArtifacts !== false;
+  if (!normalizedTaskId && !await hasConfiguredSourceTask(options.projectRoot, taskId)) {
+    localReasons.push(`[Task Config] Unknown task id '${taskId}' in task-config or configured task source.`);
+  }
+  if (!existsSync(validationSummaryPath)) {
+    localReasons.push(`[Artifact Quality] validation-summary.json not found at ${validationSummaryPath}.`);
+  } else {
+    const summary = await parseValidationSummary(validationSummaryPath);
+    if (!isAcceptedValidationSummary(summary)) {
+      localReasons.push(`[Validation] validation-summary status is '${summary?.status ?? "unknown"}', expected 'pass' or zero-check 'skipped'.`);
+    }
+  }
+  for (const file of ["task-result.json", "decision-log.md", "next-actions.md", "changed-files.txt"]) {
+    const requiredPath = resolve(artifactDir, file);
+    if (!existsSync(requiredPath)) {
+      localReasons.push(`[Artifact Quality] Missing required artifact file: ${requiredPath}`);
+    }
+  }
+  const taskResultPath = resolve(artifactDir, "task-result.json");
+  if (existsSync(taskResultPath)) {
+    const taskResult = await readJsonFile(taskResultPath);
+    const artifactStatus = typeof taskResult?.status === "string" ? taskResult.status.trim().toLowerCase() : "";
+    if (artifactStatus === "partial") {
+      localReasons.push("[Artifact Quality] task-result.json status is 'partial'; completion requires a terminal result.");
+    }
+    if (hasNonEmptyBlockers(taskResult?.blockers)) {
+      localReasons.push("[Artifact Quality] task-result.json blockers must be empty for completion.");
+    }
+    if (nextActionsIndicateRemainingScope(stringifyNextActions(taskResult?.nextActions ?? taskResult?.next_actions))) {
+      localReasons.push("[Artifact Quality] task-result.json next actions indicate remaining implementation scope.");
+    }
+  }
+  const nextActionsPath = resolve(artifactDir, "next-actions.md");
+  if (existsSync(nextActionsPath)) {
+    const nextActionsContent = await Bun.file(nextActionsPath).text();
+    if (nextActionsContent.includes("TODO: Replace this scaffold") || nextActionsContent.includes("bd-<downstream-task-id>")) {
+      localReasons.push("[Artifact Quality] next-actions.md still contains scaffold placeholder text. Replace with real recommendations.");
+    }
+    if (nextActionsIndicateRemainingScope(nextActionsContent)) {
+      localReasons.push("[Artifact Quality] next-actions.md indicates remaining implementation scope.");
+    }
+  }
+  const sourceCloseoutIssueId = resolveGithubSourceIssueId(options.projectRoot, taskId);
+  if (sourceCloseoutIssueId) {
+    localReasons.push(...evaluateGithubSourceIssuePrCloseout(options.projectRoot, prStates, sourceCloseoutIssueId));
+  }
+  const reviewMode = await loadReviewMode(paths.reviewProfilePath, process.env.AI_REVIEW_MODE || "advisory");
+  const reviewProvider = await loadReviewProvider(paths.reviewProfilePath, process.env.AI_REVIEW_PROVIDER || "github");
+  if (!options.skipAiReview && localReasons.length === 0 && reviewProvider === "greptile" && reviewMode !== "off") {
+    const ai = await runGreptileReview({
+      projectRoot: options.projectRoot,
+      taskId,
+      artifactDir,
+      prStates,
+      reviewMode
+    });
+    aiVerdict = ai.verdict;
+    aiRawFeedback = ai.feedback;
+    aiReasons.push(...ai.reasons);
+    aiWarnings.push(...ai.warnings);
+    if (reviewMode === "required" && ai.verdict !== "APPROVE" && ai.reasons.length === 0) {
+      aiReasons.push(`[AI Review] Required mode needs a completed Greptile approval; current verdict is ${ai.verdict}.`);
+    }
+    if (persistArtifacts && ai.rawResponse) {
+      writeFileSync(greptileRawPath, `${ai.rawResponse}
+`, "utf-8");
+    }
+  } else if (!options.skipAiReview && reviewMode === "off") {
+    aiWarnings.push("[AI Review] AI review mode is off.");
+  }
+  const aiReviewApproved = options.skipAiReview || reviewProvider !== "greptile" || isAiReviewApproved({
+    reviewMode,
+    aiVerdict,
+    aiReasons
+  });
+  if (persistArtifacts) {
+    writeFeedbackFile({
+      taskId,
+      provider: reviewProvider,
+      mode: reviewMode,
+      verdict: aiVerdict,
+      localReasons,
+      aiReasons,
+      aiWarnings,
+      aiRawFeedback,
+      output: reviewFeedbackPath
+    });
+    writeReviewStateFile({
+      taskId,
+      approved: localReasons.length === 0 && aiReviewApproved,
+      provider: reviewProvider,
+      mode: reviewMode,
+      verdict: aiVerdict,
+      prState,
+      localReasons,
+      aiReasons,
+      aiWarnings,
+      output: reviewStatePath
+    });
+  }
+  if (localReasons.length > 0) {
+    return {
+      approved: false,
+      localReasons,
+      aiReasons,
+      aiWarnings,
+      aiVerdict,
+      reviewFeedbackPath,
+      reviewStatePath
+    };
+  }
+  if (!aiReviewApproved) {
+    return {
+      approved: false,
+      localReasons,
+      aiReasons,
+      aiWarnings,
+      aiVerdict,
+      reviewFeedbackPath,
+      reviewStatePath
+    };
+  }
+  return {
+    approved: true,
+    localReasons,
+    aiReasons,
+    aiWarnings,
+    aiVerdict,
+    reviewFeedbackPath,
+    reviewStatePath
+  };
+}
+async function readJsonFile(path) {
+  try {
+    return await Bun.file(path).json();
+  } catch {
+    return null;
+  }
+}
+function hasNonEmptyBlockers(blockers) {
+  if (blockers == null) {
+    return false;
+  }
+  if (typeof blockers === "string") {
+    const normalized = blockers.trim().toLowerCase();
+    return normalized.length > 0 && normalized !== "none" && normalized !== "n/a";
+  }
+  if (Array.isArray(blockers)) {
+    return blockers.some((entry) => {
+      if (typeof entry === "string") {
+        const normalized = entry.trim().toLowerCase();
+        return normalized.length > 0 && normalized !== "none" && normalized !== "n/a";
+      }
+      return entry != null;
+    });
+  }
+  if (typeof blockers === "object") {
+    return Object.keys(blockers).length > 0;
+  }
+  return Boolean(blockers);
+}
+function stringifyNextActions(value) {
+  if (value == null) {
+    return "";
+  }
+  if (typeof value === "string") {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => stringifyNextActions(entry)).join(`
+`);
+  }
+  return JSON.stringify(value);
+}
+function nextActionsIndicateRemainingScope(content) {
+  const normalized = content.trim();
+  if (!normalized) {
+    return false;
+  }
+  const lower = normalized.toLowerCase();
+  if (/^(#\s*)?next actions\s*\n+\s*(none|n\/a|no remaining scope)\.?\s*$/i.test(normalized)) {
+    return false;
+  }
+  return /^\s*- \[ \]/m.test(normalized) || /\b(remaining scope|still need|needs? to be implemented|not yet implemented|not implemented|follow[- ]?up required|blocked by|blocker:)\b/i.test(lower);
+}
+async function hasConfiguredSourceTask(projectRoot, taskId) {
+  return readConfiguredTaskSourceTask(projectRoot, taskId).then((result) => result.task !== null).catch(() => false);
+}
+function resolveGithubSourceIssueId(projectRoot, taskId) {
+  const fromRuntime = loadRuntimeContextFromEnv()?.sourceTask?.sourceIssueId;
+  if (typeof fromRuntime === "string" && isGithubSourceIssueId(fromRuntime)) {
+    return fromRuntime;
+  }
+  try {
+    const taskConfig = readTaskConfig(projectRoot);
+    const entry = taskConfig[taskId];
+    const sourceIssueId = typeof entry?.sourceIssueId === "string" ? entry.sourceIssueId : typeof entry?.source_issue_id === "string" ? entry.source_issue_id : null;
+    if (sourceIssueId && isGithubSourceIssueId(sourceIssueId)) {
+      return sourceIssueId;
+    }
+    const rig = entry?._rig;
+    if (rig && typeof rig === "object" && !Array.isArray(rig)) {
+      const rigRecord = rig;
+      const rigSourceIssueId = typeof rigRecord.sourceIssueId === "string" ? rigRecord.sourceIssueId : null;
+      if (rigSourceIssueId && isGithubSourceIssueId(rigSourceIssueId)) {
+        return rigSourceIssueId;
+      }
+    }
+  } catch {}
+  return null;
+}
+function isGithubSourceIssueId(value) {
+  return /^[^/\s]+\/[^#\s]+#\d+$/.test(value.trim());
+}
+function evaluateGithubSourceIssuePrCloseout(projectRoot, prStates, sourceIssueId) {
+  const issueNumber = sourceIssueId.match(/#(\d+)$/)?.[1];
+  if (!issueNumber) {
+    return [`[Source Issue] GitHub issue task ${sourceIssueId} has an invalid source issue id.`];
+  }
+  if (prStates.length === 0) {
+    return [
+      `[Source Issue] GitHub issue task ${sourceIssueId} must have an open, green, mergeable PR with resolved review feedback and closeout intent (for example "Closes #${issueNumber}"). Source issue closure or merge is not required before completion.`
+    ];
+  }
+  const rejectionReasons = [];
+  for (const prState of prStates) {
+    const hydratedPr = hydratePrCloseoutState(projectRoot, prState);
+    const prReasons = evaluateSinglePrSourceIssueCloseout(hydratedPr, sourceIssueId, issueNumber);
+    if (prReasons.length === 0) {
+      return [];
+    }
+    rejectionReasons.push(...prReasons);
+  }
+  return uniqueStrings(rejectionReasons);
+}
+function hydratePrCloseoutState(projectRoot, prState) {
+  if (hasLocalPrCloseoutEvidence(prState)) {
+    return prState;
+  }
+  const snapshot = loadGithubPullRequestCloseoutSnapshot(projectRoot, prState);
+  return snapshot ? { ...prState, ...snapshot } : prState;
+}
+function hasLocalPrCloseoutEvidence(prState) {
+  const hasCloseoutText = typeof prState.title === "string" || typeof prState.body === "string" || Array.isArray(prState.closingIssues) && prState.closingIssues.length > 0;
+  return hasCloseoutText && typeof prState.state === "string" && typeof prState.isDraft === "boolean" && typeof prState.mergeable === "string" && typeof prState.mergeStateStatus === "string" && typeof prState.reviewDecision === "string" && Array.isArray(prState.statusCheckRollup) && Array.isArray(prState.reviewThreads);
+}
+function loadGithubPullRequestCloseoutSnapshot(projectRoot, prState) {
+  const prNumber = parsePullRequestNumber(prState.url || "");
+  if (!prNumber) {
+    return null;
+  }
+  try {
+    const repoName = deriveRepoName(projectRoot, prState);
+    if (!repoName) {
+      return null;
+    }
+    const view = runGhJson(projectRoot, [
+      "pr",
+      "view",
+      `${prNumber}`,
+      "--repo",
+      repoName,
+      "--json",
+      "state,isDraft,mergeable,mergeStateStatus,reviewDecision,title,body,statusCheckRollup"
+    ]);
+    return {
+      state: stringField(view, "state"),
+      isDraft: booleanField(view, "isDraft"),
+      mergeable: stringField(view, "mergeable"),
+      mergeStateStatus: stringField(view, "mergeStateStatus"),
+      reviewDecision: stringField(view, "reviewDecision"),
+      title: stringField(view, "title"),
+      body: stringField(view, "body"),
+      statusCheckRollup: statusCheckRollupField(view, "statusCheckRollup"),
+      reviewThreads: loadGithubReviewThreads(projectRoot, repoName, prNumber)
+    };
+  } catch {
+    return null;
+  }
+}
+function evaluateSinglePrSourceIssueCloseout(prState, sourceIssueId, issueNumber) {
+  const prLabel = prState.url || prState.branch || "recorded PR";
+  const reasons = [];
+  if (!prStateClosesIssue(prState, sourceIssueId, issueNumber)) {
+    reasons.push(`[Source Issue] GitHub issue task ${sourceIssueId} must have PR closeout intent (for example "Closes #${issueNumber}"). "Closes part of #N" is not sufficient.`);
+  }
+  const state = (prState.state || "").toUpperCase();
+  if (state !== "OPEN") {
+    reasons.push(`[Source Issue] PR ${prLabel} must be open before operator-controlled merge; current state is ${prState.state || "unknown"}.`);
+  }
+  if (prState.isDraft !== false) {
+    reasons.push(`[Source Issue] PR ${prLabel} must not be a draft.`);
+  }
+  const mergeable = (prState.mergeable || "").toUpperCase();
+  const mergeStateStatus = (prState.mergeStateStatus || "").toUpperCase();
+  if (mergeable !== "MERGEABLE" || mergeStateStatus === "DIRTY" || mergeStateStatus === "BLOCKED") {
+    reasons.push(`[Source Issue] PR ${prLabel} must be mergeable before completion (mergeable=${prState.mergeable || "unknown"}, mergeStateStatus=${prState.mergeStateStatus || "unknown"}).`);
+  }
+  reasons.push(...evaluateSourceCloseoutChecks(prState, prLabel));
+  reasons.push(...evaluateSourceCloseoutReviewState(prState, prLabel));
+  return reasons;
+}
+function evaluateSourceCloseoutChecks(prState, prLabel) {
+  const checks = prState.statusCheckRollup;
+  if (!Array.isArray(checks) || checks.length === 0) {
+    return [`[Source Issue] PR ${prLabel} must have green check evidence before completion.`];
+  }
+  const ciGate = evaluatePullRequestCiChecks(checks, "PR", 0, { mergeStateStatus: prState.mergeStateStatus });
+  if (ciGate.verdict === "APPROVE") {
+    return [];
+  }
+  return ciGate.reasons.map((reason) => reason.replace("PR#0", prLabel));
+}
+function evaluateSourceCloseoutReviewState(prState, prLabel) {
+  const reasons = [];
+  const reviewDecision = (prState.reviewDecision || "").toUpperCase();
+  if (reviewDecision === "REVIEW_REQUIRED" || reviewDecision === "CHANGES_REQUESTED") {
+    reasons.push(`[Source Issue] PR ${prLabel} required review is unresolved (${prState.reviewDecision}).`);
+  }
+  if (!Array.isArray(prState.reviewThreads)) {
+    reasons.push(`[Source Issue] PR ${prLabel} review thread resolution could not be verified.`);
+    return reasons;
+  }
+  for (const comment of filterUnresolvedReviewThreadComments(prState.reviewThreads)) {
+    reasons.push(`[Source Issue] PR ${prLabel} has unresolved review thread on ${comment.path || "unknown path"}: ${summarizeComment(comment.body || "")}`);
+  }
+  return reasons;
+}
+function filterUnresolvedReviewThreadComments(threads) {
+  const comments = [];
+  for (const thread of threads) {
+    if (thread.isResolved === true || thread.isOutdated === true) {
+      continue;
+    }
+    const threadComments = thread.comments?.nodes ?? [];
+    if (threadComments.length === 0) {
+      comments.push({ body: "Unresolved review thread" });
+      continue;
+    }
+    comments.push(threadComments[threadComments.length - 1]);
+  }
+  return comments;
+}
+function stringField(record, key) {
+  const value = record[key];
+  return typeof value === "string" ? value : undefined;
+}
+function booleanField(record, key) {
+  const value = record[key];
+  return typeof value === "boolean" ? value : undefined;
+}
+function statusCheckRollupField(record, key) {
+  const value = record[key];
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.filter(isGithubStatusCheckRollupItem);
+}
+function isGithubStatusCheckRollupItem(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function uniqueStrings(values) {
+  return Array.from(new Set(values));
+}
+function prStateClosesIssue(pr, sourceIssueId, issueNumber) {
+  const closingIssues = pr.closingIssues ?? [];
+  if (closingIssues.some((issue) => closingIssueMatches(issue, sourceIssueId, issueNumber))) {
+    return true;
+  }
+  const text = [pr.title, pr.body].filter((value) => typeof value === "string").join(`
+`);
+  return prTextClosesIssue(text, issueNumber);
+}
+function closingIssueMatches(issue, sourceIssueId, issueNumber) {
+  if (typeof issue === "number") {
+    return String(issue) === issueNumber;
+  }
+  if (typeof issue === "string") {
+    return issue === sourceIssueId || issue.replace(/^#/, "") === issueNumber;
+  }
+  return String(issue.number ?? "") === issueNumber || issue.id === issueNumber || issue.sourceIssueId === sourceIssueId;
+}
+function prTextClosesIssue(text, issueNumber) {
+  if (!text.trim()) {
+    return false;
+  }
+  const escaped = issueNumber.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const closePattern = new RegExp(`\\b(close[sd]?|fix(e[sd])?|resolve[sd]?)\\s+#${escaped}\\b`, "i");
+  return closePattern.test(text);
+}
+async function parseValidationSummary(path) {
+  return readJsonFile(path);
+}
+function isAcceptedValidationSummary(summary) {
+  if (!summary) {
+    return false;
+  }
+  if (summary.status === "pass") {
+    return true;
+  }
+  return summary.status === "skipped" && summary.total === 0 && summary.failed === 0;
+}
+async function loadReviewMode(reviewProfilePath, fallback) {
+  const parsed = existsSync(reviewProfilePath) ? await readJsonFile(reviewProfilePath) : null;
+  const mode = parsed?.mode;
+  if (mode === "off" || mode === "advisory" || mode === "required") {
+    return mode;
+  }
+  if (fallback === "off" || fallback === "advisory" || fallback === "required") {
+    return fallback;
+  }
+  return "advisory";
+}
+async function loadReviewProvider(reviewProfilePath, fallback) {
+  const parsed = existsSync(reviewProfilePath) ? await readJsonFile(reviewProfilePath) : null;
+  const provider = parsed?.provider;
+  if (typeof provider === "string" && provider.trim().length > 0) {
+    return provider;
+  }
+  return fallback || "greptile";
+}
+function resolveRepoSlug(projectRoot) {
+  const paths = resolveHarnessPaths(projectRoot);
+  const remote = runCapture(["git", "-C", paths.monorepoRoot, "remote", "get-url", "origin"], projectRoot).stdout.trim() || runCapture(["git", "-C", projectRoot, "remote", "get-url", "origin"], projectRoot).stdout.trim();
+  if (!remote) {
+    return "";
+  }
+  if (remote.startsWith("git@")) {
+    return remote.split(":")[1]?.replace(/\.git$/, "") || "";
+  }
+  const cleaned = remote.replace(/^https?:\/\//, "").replace(/\.git$/, "");
+  const slash = cleaned.indexOf("/");
+  return slash >= 0 ? cleaned.slice(slash + 1) : cleaned;
+}
+async function runGreptileReview(options) {
+  const reasons = [];
+  const warnings = [];
+  const secrets = resolveRuntimeSecrets(process.env);
+  const apiKey = secrets.GREPTILE_API_KEY || "";
+  const apiBase = secrets.GREPTILE_API_BASE || "https://api.greptile.com/mcp";
+  const remote = secrets.GREPTILE_REMOTE || "github";
+  const greptileDefaultBranch = secrets.GREPTILE_DEFAULT_BRANCH || "main";
+  const { pollAttempts, pollIntervalMs } = resolveGreptilePollSettings({
+    reviewMode: options.reviewMode,
+    secrets
+  });
+  if (!apiKey) {
+    reasons.push("[AI Review] Missing GREPTILE_API_KEY.");
+    return { verdict: "SKIP", feedback: "", reasons, warnings, rawResponse: "" };
+  }
+  if (options.prStates.length === 0) {
+    reasons.push("[AI Review] Missing pr-state.json or no PRs were recorded for review.");
+    return { verdict: "SKIP", feedback: "", reasons, warnings, rawResponse: "" };
+  }
+  const perPrResults = [];
+  for (const prState of options.prStates) {
+    try {
+      const prResult = await runGreptileReviewForPr({
+        apiBase,
+        apiKey,
+        remote,
+        defaultBranch: greptileDefaultBranch,
+        projectRoot: options.projectRoot,
+        taskId: options.taskId,
+        prState,
+        reviewMode: options.reviewMode,
+        pollAttempts,
+        pollIntervalMs
+      });
+      if (prResult.verdict === "SKIP") {
+        warnings.push(...prResult.reasons.map(asGreptileInfrastructureWarning));
+      } else {
+        reasons.push(...prResult.reasons);
+      }
+      warnings.push(...prResult.warnings);
+      perPrResults.push(prResult);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const fallback = await runGithubGreptileFallbackReviewForPr({
+        projectRoot: options.projectRoot,
+        taskId: options.taskId,
+        prState,
+        reviewMode: options.reviewMode,
+        infrastructureError: message,
+        pollAttempts,
+        pollIntervalMs
+      }).catch(() => null);
+      if (fallback) {
+        if (fallback.verdict === "SKIP") {
+          warnings.push(...fallback.reasons.map(asGreptileInfrastructureWarning));
+        } else {
+          reasons.push(...fallback.reasons);
+        }
+        warnings.push(...fallback.warnings);
+        perPrResults.push(fallback);
+        continue;
+      }
+      warnings.push(asGreptileInfrastructureWarning(`Greptile infrastructure failure for ${prState.url || prState.branch || options.taskId}: ${message}`));
+      perPrResults.push({
+        verdict: "SKIP",
+        feedback: "",
+        reasons: [],
+        warnings: [],
+        rawPayload: { pr: prState, error: message }
+      });
+    }
+  }
+  if (perPrResults.some((result) => result.verdict === "REJECT")) {
+    return {
+      verdict: "REJECT",
+      feedback: perPrResults.map((result) => result.feedback).filter(Boolean).join(`
+
+`),
+      reasons,
+      warnings,
+      rawResponse: JSON.stringify(perPrResults.map((result) => result.rawPayload), null, 2)
+    };
+  }
+  if (perPrResults.every((result) => result.verdict === "APPROVE")) {
+    return {
+      verdict: "APPROVE",
+      feedback: perPrResults.map((result) => result.feedback).filter(Boolean).join(`
+
+`),
+      reasons,
+      warnings,
+      rawResponse: JSON.stringify(perPrResults.map((result) => result.rawPayload), null, 2)
+    };
+  }
+  return {
+    verdict: "SKIP",
+    feedback: perPrResults.map((result) => result.feedback).filter(Boolean).join(`
+
+`),
+    reasons,
+    warnings,
+    rawResponse: JSON.stringify(perPrResults.map((result) => result.rawPayload), null, 2)
+  };
+}
+function writeFeedbackFile(options) {
+  const lines = [
+    "# AI Review Feedback",
+    "",
+    `- Task: ${options.taskId}`,
+    `- Provider: ${options.provider}`,
+    `- Mode: ${options.mode}`,
+    `- Verdict: ${options.verdict}`,
+    ""
+  ];
+  if (options.localReasons.length > 0) {
+    lines.push("## Local Rejection Reasons", "");
+    for (const reason of options.localReasons) {
+      lines.push(`- ${reason}`);
+    }
+    lines.push("");
+  }
+  if (options.aiReasons.length > 0) {
+    lines.push("## AI Rejection Reasons", "");
+    for (const reason of options.aiReasons) {
+      lines.push(`- ${reason}`);
+    }
+    lines.push("");
+  }
+  if (options.aiWarnings.length > 0) {
+    lines.push("## AI Warnings", "");
+    for (const warning of options.aiWarnings) {
+      lines.push(`- ${warning}`);
+    }
+    lines.push("");
+  }
+  if (options.aiRawFeedback) {
+    lines.push("## Raw Reviewer Feedback", "", "```text", options.aiRawFeedback, "```", "");
+  }
+  writeFileSync(options.output, `${lines.join(`
+`)}
+`, "utf-8");
+}
+function writeReviewStateFile(options) {
+  const payload = {
+    task_id: options.taskId,
+    approved: options.approved,
+    provider: options.provider,
+    mode: options.mode,
+    verdict: options.verdict,
+    pr: options.prState,
+    local_reasons: options.localReasons,
+    ai_reasons: options.aiReasons,
+    ai_warnings: options.aiWarnings,
+    updated_at: nowIso()
+  };
+  writeFileSync(options.output, `${JSON.stringify(payload, null, 2)}
+`, "utf-8");
+}
+async function runGreptileReviewForPr(options) {
+  const reasons = [];
+  const warnings = [];
+  const repoName = deriveRepoName(options.projectRoot, options.prState);
+  const prNumber = parsePullRequestNumber(options.prState.url || "");
+  const defaultBranch = options.defaultBranch;
+  const expectedHeadSha = resolvePrHeadSha(options.projectRoot, options.prState);
+  if (!repoName) {
+    reasons.push(`[AI Review] Could not resolve repository slug for ${options.prState.repoLabel || options.prState.target || "PR"}.`);
+    return { verdict: "SKIP", feedback: "", reasons, warnings, rawPayload: { pr: options.prState } };
+  }
+  if (!prNumber) {
+    reasons.push(`[AI Review] Could not parse PR number from ${options.prState.url || "missing PR URL"}.`);
+    return { verdict: "SKIP", feedback: "", reasons, warnings, rawPayload: { pr: options.prState } };
+  }
+  const githubPrState = loadGithubPullRequestState(options.projectRoot, repoName, prNumber);
+  if (shouldPreferGithubGreptileFallback(githubPrState)) {
+    return runGithubGreptileFallbackReviewForPr({
+      projectRoot: options.projectRoot,
+      taskId: options.taskId,
+      prState: options.prState,
+      reviewMode: options.reviewMode,
+      infrastructureError: undefined,
+      pollAttempts: options.pollAttempts,
+      pollIntervalMs: options.pollIntervalMs
+    });
+  }
+  const initialReviewsPayload = await callGreptileMcpToolJson(options.apiBase, options.apiKey, "list_code_reviews", {
+    name: repoName,
+    remote: options.remote,
+    defaultBranch,
+    prNumber,
+    limit: 20
+  });
+  const existingReview = findGreptileReviewForHeadSha(initialReviewsPayload.codeReviews || [], expectedHeadSha);
+  const shouldTrigger = shouldTriggerGreptileReview(existingReview, expectedHeadSha);
+  let triggerStartedAt = Date.now();
+  if (shouldTrigger) {
+    triggerStartedAt = Date.now();
+    await callGreptileMcpTool(options.apiBase, options.apiKey, "trigger_code_review", {
+      name: repoName,
+      remote: options.remote,
+      defaultBranch,
+      branch: options.prState.branch,
+      prNumber
+    }).catch((error) => {
+      throw new Error(`Greptile trigger failed for ${repoName}#${prNumber}: ${error instanceof Error ? error.message : String(error)}`);
+    });
+  } else {
+    const existingCreatedAt = Date.parse(existingReview?.createdAt || "");
+    triggerStartedAt = Number.isFinite(existingCreatedAt) ? existingCreatedAt : Date.now();
+  }
+  let selectedReview = null;
+  let reviewsPayload = initialReviewsPayload;
+  let githubCheckRollup = [];
+  let githubCheckState = { pending: false, completed: false };
+  for (let attempt = 0;; attempt += 1) {
+    const listPayload = attempt === 0 ? initialReviewsPayload : await callGreptileMcpToolJson(options.apiBase, options.apiKey, "list_code_reviews", {
+      name: repoName,
+      remote: options.remote,
+      defaultBranch,
+      prNumber,
+      limit: 20
+    });
+    reviewsPayload = listPayload;
+    selectedReview = pickRelevantCodeReview(listPayload.codeReviews || [], triggerStartedAt, expectedHeadSha);
+    githubCheckRollup = loadGithubPullRequestCheckRollup(options.projectRoot, repoName, prNumber);
+    githubCheckState = classifyGithubGreptileCheckState(githubCheckRollup);
+    if (!shouldContinueGreptileMcpPolling({
+      attempt,
+      pollAttempts: options.pollAttempts,
+      githubCheckState,
+      selectedReview
+    })) {
+      break;
+    }
+    await Bun.sleep(options.pollIntervalMs);
+  }
+  const ciGate = evaluatePullRequestCiChecks(githubCheckRollup, repoName, prNumber, { mergeStateStatus: options.prState.mergeStateStatus });
+  if (ciGate.verdict !== "APPROVE") {
+    return {
+      verdict: ciGate.verdict,
+      feedback: "",
+      reasons: ciGate.reasons,
+      warnings,
+      rawPayload: { pr: options.prState, codeReviews: reviewsPayload, checkRollup: githubCheckRollup }
+    };
+  }
+  if (!selectedReview) {
+    reasons.push(`[AI Review] Greptile did not produce a review for ${repoName}#${prNumber}.`);
+    return {
+      verdict: "SKIP",
+      feedback: "",
+      reasons,
+      warnings,
+      rawPayload: { pr: options.prState, codeReviews: reviewsPayload }
+    };
+  }
+  if (selectedReview.status === "FAILED") {
+    reasons.push(`[AI Review] Greptile review failed for ${repoName}#${prNumber}.`);
+    return {
+      verdict: "SKIP",
+      feedback: "",
+      reasons,
+      warnings,
+      rawPayload: { pr: options.prState, codeReviews: reviewsPayload, selectedReview }
+    };
+  }
+  if (selectedReview.status === "SKIPPED") {
+    reasons.push(`[AI Review] Greptile skipped review for ${repoName}#${prNumber}.`);
+    return {
+      verdict: "SKIP",
+      feedback: "",
+      reasons,
+      warnings,
+      rawPayload: { pr: options.prState, codeReviews: reviewsPayload, selectedReview }
+    };
+  }
+  if (selectedReview.status !== "COMPLETED") {
+    if (githubCheckState.completed) {
+      return runGithubGreptileFallbackReviewForPr({
+        projectRoot: options.projectRoot,
+        taskId: options.taskId,
+        prState: options.prState,
+        reviewMode: options.reviewMode,
+        infrastructureError: `Greptile MCP review stayed ${selectedReview.status} after the GitHub Greptile check completed.`,
+        pollAttempts: options.pollAttempts,
+        pollIntervalMs: options.pollIntervalMs
+      });
+    }
+    reasons.push(`[AI Review] Greptile review for ${repoName}#${prNumber} did not finish before timeout (last status: ${selectedReview.status}).`);
+    return {
+      verdict: "SKIP",
+      feedback: "",
+      reasons,
+      warnings,
+      rawPayload: { pr: options.prState, codeReviews: reviewsPayload, selectedReview }
+    };
+  }
+  const reviewDetails = await callGreptileMcpToolJson(options.apiBase, options.apiKey, "get_code_review", { codeReviewId: selectedReview.id });
+  const commentsPayload = await callGreptileMcpToolJson(options.apiBase, options.apiKey, "list_merge_request_comments", {
+    name: repoName,
+    remote: options.remote,
+    defaultBranch,
+    prNumber,
+    greptileGenerated: true,
+    createdAfter: selectedReview.createdAt
+  });
+  const actionableComments = filterActionableGreptileComments(commentsPayload.comments || []);
+  const reviewBody = reviewDetails.codeReview?.body || "";
+  const score = parseGreptileScore(reviewBody);
+  const feedback = [
+    `## ${options.prState.repoLabel || repoName} PR Review`,
+    "",
+    `- PR: ${options.prState.url || `${repoName}#${prNumber}`}`,
+    `- Review ID: ${selectedReview.id}`,
+    `- Status: ${selectedReview.status}`,
+    "",
+    reviewBody ? stripHtml(reviewBody).trim() : "Greptile completed without summary body."
+  ].filter(Boolean).join(`
+`);
+  if (actionableComments.length > 0) {
+    for (const comment of actionableComments) {
+      reasons.push(`[AI Review] ${repoName}#${prNumber} has unresolved Greptile comment on ${comment.filePath}: ${summarizeComment(comment.body || "")}`);
+    }
+    return {
+      verdict: "REJECT",
+      feedback,
+      reasons,
+      warnings,
+      rawPayload: {
+        pr: options.prState,
+        codeReviews: reviewsPayload,
+        selectedReview,
+        reviewDetails,
+        comments: commentsPayload
+      }
+    };
+  }
+  const blockerScanBody = stripHtml(reviewBody).replace(/\b(?:no|without|zero)\s+blockers?\b/gi, " ").replace(/\bno\s+changes\s+requested\b/gi, " ");
+  if (/not safe(?: to merge)?|unsafe(?: to merge)?|do not merge|cannot merge|blockers?|must fix|changes requested|please fix|needs? fix|fix this|address this|\breject(?:ed|ion)?\b|\bskip(?:ped)?\b|status\s*:\s*(?:reject(?:ed)?|skip(?:ped)?|failed)/i.test(blockerScanBody)) {
+    reasons.push(`[AI Review] ${repoName}#${prNumber} summary indicates the PR is not safe to merge.`);
+    return {
+      verdict: "REJECT",
+      feedback,
+      reasons,
+      warnings,
+      rawPayload: {
+        pr: options.prState,
+        codeReviews: reviewsPayload,
+        selectedReview,
+        reviewDetails,
+        comments: commentsPayload
+      }
+    };
+  }
+  if (score?.scale === 5 && score.value < 5) {
+    reasons.push(`[AI Review] ${repoName}#${prNumber} completed with Greptile confidence ${score.value}/${score.scale}; strict review requires 5/5 before merge.`);
+    return {
+      verdict: "REJECT",
+      feedback,
+      reasons,
+      warnings,
+      rawPayload: {
+        pr: options.prState,
+        codeReviews: reviewsPayload,
+        selectedReview,
+        reviewDetails,
+        comments: commentsPayload,
+        score
+      }
+    };
+  }
+  const prUrl = options.prState.url || `https://github.com/${repoName}/pull/${prNumber}`;
+  let strictGate = null;
+  try {
+    const strictEvidence = await collectStrictPrEvidenceForVerifier({
+      projectRoot: options.projectRoot,
+      taskId: options.taskId,
+      prUrl,
+      apiSignals: [{
+        id: selectedReview.id,
+        body: reviewBody,
+        reviewedSha: selectedReview.metadata?.checkHeadSha ?? null,
+        status: selectedReview.status
+      }]
+    });
+    strictGate = evaluateStrictPrMergeGate(strictEvidence);
+  } catch (error) {
+    reasons.push(`[AI Review] Strict Greptile evidence collection failed for ${repoName}#${prNumber}: ${error instanceof Error ? error.message : String(error)}`);
+    return {
+      verdict: "REJECT",
+      feedback,
+      reasons,
+      warnings,
+      rawPayload: {
+        pr: options.prState,
+        codeReviews: reviewsPayload,
+        selectedReview,
+        reviewDetails,
+        comments: commentsPayload,
+        score
+      }
+    };
+  }
+  if (!strictGate.approved) {
+    return {
+      verdict: strictGate.pending ? "SKIP" : "REJECT",
+      feedback,
+      reasons: strictGate.reasons.map((reason) => reason.startsWith("[AI Review]") ? reason : `[AI Review] ${reason}`),
+      warnings: [...warnings, ...strictGate.warnings],
+      rawPayload: {
+        pr: options.prState,
+        codeReviews: reviewsPayload,
+        selectedReview,
+        reviewDetails,
+        comments: commentsPayload,
+        score,
+        strictGate: {
+          approved: strictGate.approved,
+          pending: strictGate.pending,
+          reasons: strictGate.reasons,
+          reasonDetails: strictGate.reasonDetails,
+          warnings: strictGate.warnings,
+          greptile: strictGate.evidence.greptile,
+          readErrors: strictGate.evidence.readErrors
+        }
+      }
+    };
+  }
+  return {
+    verdict: "APPROVE",
+    feedback,
+    reasons,
+    warnings,
+    rawPayload: {
+      pr: options.prState,
+      codeReviews: reviewsPayload,
+      selectedReview,
+      reviewDetails,
+      comments: commentsPayload,
+      strictGate: {
+        approved: strictGate.approved,
+        pending: strictGate.pending,
+        reasons: strictGate.reasons,
+        reasonDetails: strictGate.reasonDetails,
+        warnings: strictGate.warnings,
+        greptile: strictGate.evidence.greptile,
+        readErrors: strictGate.evidence.readErrors
+      }
+    }
+  };
+}
+async function runGithubGreptileFallbackReviewForPr(options) {
+  const repoName = deriveRepoName(options.projectRoot, options.prState);
+  const prNumber = parsePullRequestNumber(options.prState.url || "");
+  const expectedHeadSha = resolvePrHeadSha(options.projectRoot, options.prState);
+  if (!repoName || !prNumber) {
+    return {
+      verdict: "SKIP",
+      feedback: "",
+      reasons: [],
+      warnings: buildGithubGreptileFallbackWarnings(options),
+      rawPayload: buildGithubGreptileFallbackRawPayload(options)
+    };
+  }
+  let reviews = [];
+  let selectedReview = null;
+  let latestReview = null;
+  let fallbackReview = null;
+  let threads = [];
+  let actionableThreads = [];
+  let checkRollup = [];
+  let checkState = { pending: false, completed: false };
+  for (let attempt = 0;; attempt += 1) {
+    reviews = runGhJson(options.projectRoot, ["api", `repos/${repoName}/pulls/${prNumber}/reviews`]);
+    selectedReview = pickRelevantGithubGreptileReview(reviews, expectedHeadSha);
+    latestReview = pickLatestGithubGreptileReview(reviews);
+    fallbackReview = selectedReview ?? latestReview;
+    threads = loadGithubReviewThreads(options.projectRoot, repoName, prNumber);
+    actionableThreads = filterActionableGithubGreptileThreads(threads);
+    checkRollup = loadGithubPullRequestCheckRollup(options.projectRoot, repoName, prNumber);
+    checkState = classifyGithubGreptileCheckState(checkRollup);
+    const approvedViaReviewedAncestor = !selectedReview && !!fallbackReview?.commit_id && !!expectedHeadSha && isCommitAncestorOfPrHead(options.projectRoot, options.prState, fallbackReview.commit_id, expectedHeadSha);
+    if (!shouldContinueGithubGreptileFallbackPolling({
+      attempt,
+      pollAttempts: options.pollAttempts,
+      checkState,
+      fallbackReview,
+      selectedReview,
+      approvedViaReviewedAncestor
+    })) {
+      break;
+    }
+    await Bun.sleep(options.pollIntervalMs);
+  }
+  const ciGate = evaluatePullRequestCiChecks(checkRollup, repoName, prNumber, { mergeStateStatus: options.prState.mergeStateStatus });
+  if (ciGate.verdict !== "APPROVE") {
+    return {
+      verdict: ciGate.verdict,
+      feedback: "",
+      reasons: ciGate.reasons,
+      warnings: buildGithubGreptileFallbackWarnings(options),
+      rawPayload: { ...buildGithubGreptileFallbackRawPayload(options), reviews, threads, checkRollup }
+    };
+  }
+  const feedback = [
+    `## ${options.prState.repoLabel || repoName} PR Review`,
+    "",
+    `- PR: ${options.prState.url || `${repoName}#${prNumber}`}`,
+    "- Source: GitHub Greptile fallback",
+    fallbackReview?.html_url ? `- Review: ${fallbackReview.html_url}` : "",
+    fallbackReview?.state ? `- Status: ${fallbackReview.state}` : "",
+    "",
+    fallbackReview?.body?.trim() ? stripHtml(fallbackReview.body).trim() : "Greptile MCP was unavailable, so verification used GitHub review threads instead."
+  ].filter(Boolean).join(`
+`);
+  const warnings = buildGithubGreptileFallbackWarnings(options);
+  if (checkState.pending) {
+    return {
+      verdict: "SKIP",
+      feedback,
+      reasons: [
+        `[AI Review] Greptile GitHub review for ${repoName}#${prNumber} is still in progress.`
+      ],
+      warnings,
+      rawPayload: { ...buildGithubGreptileFallbackRawPayload(options), reviews, threads, checkRollup }
+    };
+  }
+  const prUrl = options.prState.url || `https://github.com/${repoName}/pull/${prNumber}`;
+  let strictGate;
+  try {
+    const strictEvidence = await collectStrictPrEvidenceForVerifier({
+      projectRoot: options.projectRoot,
+      taskId: options.taskId,
+      prUrl
+    });
+    strictGate = evaluateStrictPrMergeGate(strictEvidence);
+  } catch (error) {
+    return {
+      verdict: "REJECT",
+      feedback,
+      reasons: [`[AI Review] Strict Greptile evidence collection failed for ${repoName}#${prNumber}: ${error instanceof Error ? error.message : String(error)}`],
+      warnings,
+      rawPayload: {
+        pr: options.prState,
+        selectedReview: fallbackReview,
+        reviews,
+        threads,
+        checkRollup,
+        actionableThreads,
+        ...buildGithubGreptileFallbackRawPayload(options)
+      }
+    };
+  }
+  if (!strictGate.approved) {
+    return {
+      verdict: strictGate.pending ? "SKIP" : "REJECT",
+      feedback,
+      reasons: strictGate.reasons.map((reason) => reason.startsWith("[AI Review]") ? reason : `[AI Review] ${reason}`),
+      warnings: [...warnings, ...strictGate.warnings],
+      rawPayload: {
+        pr: options.prState,
+        selectedReview: fallbackReview,
+        reviews,
+        threads,
+        checkRollup,
+        actionableThreads,
+        strictGate: {
+          approved: strictGate.approved,
+          pending: strictGate.pending,
+          reasons: strictGate.reasons,
+          reasonDetails: strictGate.reasonDetails,
+          warnings: strictGate.warnings,
+          greptile: strictGate.evidence.greptile
+        },
+        ...buildGithubGreptileFallbackRawPayload(options)
+      }
+    };
+  }
+  return {
+    verdict: "APPROVE",
+    feedback,
+    reasons: [],
+    warnings,
+    rawPayload: {
+      pr: options.prState,
+      selectedReview: fallbackReview,
+      reviews,
+      threads,
+      checkRollup,
+      strictGate: {
+        approved: strictGate.approved,
+        pending: strictGate.pending,
+        reasons: strictGate.reasons,
+        reasonDetails: strictGate.reasonDetails,
+        warnings: strictGate.warnings,
+        greptile: strictGate.evidence.greptile
+      },
+      ...buildGithubGreptileFallbackRawPayload(options)
+    }
+  };
+}
+function buildGithubGreptileFallbackWarnings(options) {
+  if (!options.infrastructureError?.trim()) {
+    return [];
+  }
+  return [
+    asGreptileInfrastructureWarning(`Greptile infrastructure failure for ${options.prState.url || options.prState.branch || options.taskId}: ${options.infrastructureError}`)
+  ];
+}
+function buildGithubGreptileFallbackRawPayload(options) {
+  return options.infrastructureError?.trim() ? { pr: options.prState, error: options.infrastructureError } : { pr: options.prState };
+}
+async function callGreptileMcpTool(apiBase, apiKey, name, args) {
+  return callGreptileMcpToolWithTimeout(apiBase, apiKey, name, args, resolveGreptileRequestTimeoutMs(process.env.GREPTILE_REQUEST_TIMEOUT_MS));
+}
+async function callGreptileMcpToolWithTimeout(apiBase, apiKey, name, args, timeoutMs) {
+  const controller = new AbortController;
+  const timeoutId = setTimeout(() => {
+    controller.abort(new Error(`Greptile MCP tool ${name} timed out after ${timeoutMs}ms.`));
+  }, timeoutMs);
+  let response;
+  try {
+    response = await fetch(apiBase, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: `rig-${name}-${Date.now()}`,
+        method: "tools/call",
+        params: { name, arguments: args }
+      }),
+      signal: controller.signal
+    });
+  } catch (error) {
+    if (controller.signal.aborted) {
+      throw controller.signal.reason instanceof Error ? controller.signal.reason : new Error(`Greptile MCP tool ${name} timed out after ${timeoutMs}ms.`);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeoutId);
+  }
+  const raw = await response.text();
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status}: ${raw}`);
+  }
+  let envelope;
+  try {
+    envelope = JSON.parse(raw);
+  } catch {
+    throw new Error(`Malformed MCP response: ${raw}`);
+  }
+  if (envelope.error?.message) {
+    throw new Error(envelope.error.message);
+  }
+  const text = (envelope.result?.content || []).filter((item) => item.type === "text" && typeof item.text === "string").map((item) => item.text || "").join(`
+`).trim();
+  if (!text) {
+    throw new Error(`MCP tool ${name} returned no text payload.`);
+  }
+  return text;
+}
+function resolveGreptileRequestTimeoutMs(rawValue) {
+  const DEFAULT_GREPTILE_REQUEST_TIMEOUT_MS = 30000;
+  const parsed = Number.parseInt(rawValue || `${DEFAULT_GREPTILE_REQUEST_TIMEOUT_MS}`, 10);
+  return Number.isFinite(parsed) && parsed >= 1000 ? parsed : DEFAULT_GREPTILE_REQUEST_TIMEOUT_MS;
+}
+async function callGreptileMcpToolJson(apiBase, apiKey, name, args) {
+  const text = await callGreptileMcpTool(apiBase, apiKey, name, args);
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`MCP tool ${name} returned malformed JSON: ${text}`);
+  }
+}
+function pickRelevantCodeReview(reviews, triggerStartedAt, expectedHeadSha) {
+  const normalized = [...reviews].sort((a, b) => Date.parse(b.createdAt || "") - Date.parse(a.createdAt || ""));
+  const exactSha = normalized.find((review) => expectedHeadSha && review.metadata?.checkHeadSha === expectedHeadSha);
+  if (exactSha) {
+    return exactSha;
+  }
+  const triggered = normalized.find((review) => Date.parse(review.createdAt || "") >= triggerStartedAt - 1000);
+  return triggered || normalized[0] || null;
+}
+function filterActionableGreptileComments(comments) {
+  return comments.filter((comment) => comment.sourceType === "greptile" && typeof comment.filePath === "string" && comment.filePath.trim().length > 0 && comment.addressed === false);
+}
+function findGreptileReviewForHeadSha(reviews, expectedHeadSha) {
+  if (!expectedHeadSha) {
+    return null;
+  }
+  const normalized = [...reviews].sort((a, b) => Date.parse(b.createdAt || "") - Date.parse(a.createdAt || ""));
+  return normalized.find((review) => review.metadata?.checkHeadSha === expectedHeadSha) || null;
+}
+function isGreptileReviewTerminal(status) {
+  return status === "COMPLETED" || status === "FAILED" || status === "SKIPPED";
+}
+function shouldTriggerGreptileReview(existingReview, expectedHeadSha) {
+  if (!existingReview) {
+    return true;
+  }
+  if (!expectedHeadSha) {
+    return true;
+  }
+  if ((existingReview.metadata?.checkHeadSha || "") !== expectedHeadSha) {
+    return true;
+  }
+  return false;
+}
+function shouldContinueGreptileMcpPolling(options) {
+  if (options.githubCheckState.completed) {
+    return false;
+  }
+  if (options.attempt + 1 >= options.pollAttempts) {
+    return false;
+  }
+  if (options.selectedReview && !isGreptileReviewTerminal(options.selectedReview.status)) {
+    return true;
+  }
+  return true;
+}
+function shouldContinueGithubGreptileFallbackPolling(options) {
+  const waitingForVisiblePendingReview = options.checkState.pending && (!options.fallbackReview || !options.selectedReview && !options.approvedViaReviewedAncestor);
+  if (options.attempt + 1 >= options.pollAttempts) {
+    return false;
+  }
+  if (waitingForVisiblePendingReview) {
+    return true;
+  }
+  const reviewNotVisibleYet = !options.fallbackReview && !options.checkState.pending && !options.checkState.completed;
+  if (reviewNotVisibleYet) {
+    return options.attempt + 1 < options.pollAttempts;
+  }
+  return false;
+}
+function resolveGreptilePollSettings(options) {
+  const DEFAULT_POLL_ATTEMPTS = 60;
+  const DEFAULT_POLL_INTERVAL_MS = 5000;
+  const REQUIRED_MODE_MIN_ATTEMPTS = 180;
+  const configuredAttempts = Number.parseInt(options.secrets.GREPTILE_POLL_ATTEMPTS || `${DEFAULT_POLL_ATTEMPTS}`, 10);
+  const configuredIntervalMs = Number.parseInt(options.secrets.GREPTILE_POLL_INTERVAL_MS || `${DEFAULT_POLL_INTERVAL_MS}`, 10);
+  const pollAttempts = Number.isFinite(configuredAttempts) && configuredAttempts > 0 ? configuredAttempts : DEFAULT_POLL_ATTEMPTS;
+  const pollIntervalMs = Number.isFinite(configuredIntervalMs) && configuredIntervalMs > 0 ? configuredIntervalMs : DEFAULT_POLL_INTERVAL_MS;
+  if (options.reviewMode !== "required") {
+    return { pollAttempts, pollIntervalMs };
+  }
+  return {
+    pollAttempts: Math.max(REQUIRED_MODE_MIN_ATTEMPTS, pollAttempts),
+    pollIntervalMs: Math.max(DEFAULT_POLL_INTERVAL_MS, pollIntervalMs)
+  };
+}
+function loadGithubPullRequestState(projectRoot, repoName, prNumber) {
+  const response = runGhJson(projectRoot, [
+    "api",
+    `repos/${repoName}/pulls/${prNumber}`
+  ]);
+  return {
+    state: response.state || "",
+    merged: response.merged,
+    merged_at: response.merged_at ?? null
+  };
+}
+function shouldPreferGithubGreptileFallback(prState) {
+  if ((prState?.state || "").toUpperCase() === "MERGED") {
+    return true;
+  }
+  if (prState?.merged === true) {
+    return true;
+  }
+  return typeof prState?.merged_at === "string" && prState.merged_at.trim().length > 0;
+}
+function parsePullRequestNumber(url) {
+  const match = /\/pull\/(\d+)(?:\/|$)/.exec(url);
+  return match ? Number.parseInt(match[1] || "0", 10) : 0;
+}
+function runGhJson(projectRoot, args) {
+  const result = runCapture(["gh", ...args], projectRoot);
+  if (result.exitCode !== 0) {
+    throw new Error(result.stderr || result.stdout || `gh ${args.join(" ")} failed`);
+  }
+  try {
+    return JSON.parse(result.stdout);
+  } catch {
+    throw new Error(`gh ${args.join(" ")} returned malformed JSON: ${result.stdout}`);
+  }
+}
+async function collectStrictPrEvidenceForVerifier(input) {
+  return collectPrReviewEvidence({
+    projectRoot: input.projectRoot,
+    prUrl: input.prUrl,
+    taskId: input.taskId,
+    runId: "verifier",
+    cycle: 0,
+    apiSignals: input.apiSignals ?? [],
+    command: async (args, options) => {
+      const result = runCapture(["gh", ...args], options?.cwd ?? input.projectRoot);
+      return { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr };
+    }
+  });
+}
+function deriveRepoName(projectRoot, prState) {
+  const fromUrl = /github\.com\/([^/]+\/[^/]+)\/pull\/\d+/.exec(prState.url || "");
+  if (fromUrl?.[1]) {
+    return fromUrl[1];
+  }
+  if (prState.target === "monorepo") {
+    return resolveRepoSlug(projectRoot);
+  }
+  return runCapture(["gh", "repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"], projectRoot).stdout.trim();
+}
+function resolvePrHeadSha(projectRoot, prState) {
+  const repoRoot = resolvePrRepoRoot(projectRoot, prState);
+  return runCapture(["git", "-C", repoRoot, "rev-parse", "HEAD"], projectRoot).stdout.trim();
+}
+function isGreptileGithubLogin(login) {
+  const normalized = (login || "").toLowerCase().replace(/\[bot\]$/, "");
+  return normalized === "greptile" || normalized === "greptile-ai" || normalized === "greptileai" || normalized === "greptile-apps";
+}
+function pickRelevantGithubGreptileReview(reviews, expectedHeadSha) {
+  const matching = sortGithubGreptileReviews(reviews);
+  if (expectedHeadSha) {
+    const exact = matching.find((review) => review.commit_id === expectedHeadSha);
+    if (exact) {
+      return exact;
+    }
+    return null;
+  }
+  return matching[0] || null;
+}
+function pickLatestGithubGreptileReview(reviews) {
+  return sortGithubGreptileReviews(reviews)[0] || null;
+}
+function sortGithubGreptileReviews(reviews) {
+  return reviews.filter((review) => isGreptileGithubLogin(review.user?.login)).sort((left, right) => Date.parse(right.submitted_at || "") - Date.parse(left.submitted_at || ""));
+}
+function loadGithubPullRequestCheckRollup(projectRoot, repoName, prNumber) {
+  const response = runGhJson(projectRoot, [
+    "pr",
+    "view",
+    `${prNumber}`,
+    "--repo",
+    repoName,
+    "--json",
+    "statusCheckRollup"
+  ]);
+  return response.statusCheckRollup || [];
+}
+function evaluatePullRequestCiChecks(checks, repoName, prNumber, options = {}) {
+  const isPendingCheck2 = (check) => {
+    if ((check.__typename || "") === "CheckRun") {
+      return (check.status || "").toUpperCase() !== "COMPLETED";
+    }
+    const state = (check.state || check.status || "").toUpperCase();
+    return state === "PENDING" || state === "EXPECTED" || state === "QUEUED" || state === "IN_PROGRESS";
+  };
+  const pendingGreptile = checks.filter((check) => {
+    const label = (check.name || check.context || "").toLowerCase();
+    return label.includes("greptile") && isPendingCheck2(check);
+  });
+  if (pendingGreptile.length > 0) {
+    return {
+      verdict: "SKIP",
+      reasons: pendingGreptile.map((check) => `[CI] ${repoName}#${prNumber} mandatory Greptile check is still pending: ${check.name || check.context || "unknown"}.`)
+    };
+  }
+  const nonGreptileChecks = checks.filter((check) => {
+    const label = (check.name || check.context || "").toLowerCase();
+    return label.length > 0 && !label.includes("greptile");
+  });
+  const pending = nonGreptileChecks.filter(isPendingCheck2);
+  const mergeClean = (options.mergeStateStatus || "").toUpperCase() === "CLEAN";
+  if (pending.length > 0 && !mergeClean) {
+    return {
+      verdict: "SKIP",
+      reasons: pending.map((check) => `[CI] ${repoName}#${prNumber} check is still pending: ${check.name || check.context || "unknown"}.`)
+    };
+  }
+  const failing = nonGreptileChecks.filter((check) => {
+    if ((check.__typename || "") === "CheckRun") {
+      const conclusion = (check.conclusion || "").toUpperCase();
+      return conclusion.length > 0 && !["SUCCESS", "NEUTRAL", "SKIPPED"].includes(conclusion);
+    }
+    const state = (check.state || check.conclusion || "").toUpperCase();
+    return state.length > 0 && !["SUCCESS", "NEUTRAL", "SKIPPED"].includes(state);
+  });
+  if (failing.length > 0) {
+    return {
+      verdict: "REJECT",
+      reasons: failing.map((check) => `[CI] ${repoName}#${prNumber} check failed: ${check.name || check.context || "unknown"} (${check.conclusion || check.state || check.status || "unknown"}).`)
+    };
+  }
+  return { verdict: "APPROVE", reasons: [] };
+}
+function classifyGithubGreptileCheckState(checks) {
+  const greptileChecks = checks.filter((check) => {
+    const label = (check.name || check.context || "").toLowerCase();
+    return label.includes("greptile");
+  });
+  if (greptileChecks.length === 0) {
+    return { pending: false, completed: false };
+  }
+  for (const check of greptileChecks) {
+    if ((check.__typename || "") === "CheckRun") {
+      if ((check.status || "").toUpperCase() !== "COMPLETED") {
+        return { pending: true, completed: false };
+      }
+      return { pending: false, completed: true };
+    }
+    const state = (check.state || "").toUpperCase();
+    if (state === "PENDING" || state === "EXPECTED") {
+      return { pending: true, completed: false };
+    }
+    if (state) {
+      return { pending: false, completed: true };
+    }
+  }
+  return { pending: false, completed: false };
+}
+function loadGithubReviewThreads(projectRoot, repoName, prNumber) {
+  const [owner, name] = repoName.split("/");
+  if (!owner || !name) {
+    return [];
+  }
+  const response = runGhJson(projectRoot, [
+    "api",
+    "graphql",
+    "-F",
+    `owner=${owner}`,
+    "-F",
+    `name=${name}`,
+    "-F",
+    `prNumber=${prNumber}`,
+    "-f",
+    "query=query($owner: String!, $name: String!, $prNumber: Int!) { repository(owner:$owner, name:$name) { pullRequest(number:$prNumber) { reviewThreads(first: 100) { nodes { isResolved isOutdated comments(first: 20) { nodes { author { login } body path url createdAt } } } } } } }"
+  ]);
+  return response.data?.repository?.pullRequest?.reviewThreads?.nodes || [];
+}
+function filterActionableGithubGreptileThreads(threads) {
+  return threads.flatMap((thread) => {
+    if (thread.isResolved || thread.isOutdated) {
+      return [];
+    }
+    const comments = thread.comments?.nodes || [];
+    const latestGreptileComment = [...comments].reverse().find((comment) => isGreptileGithubLogin(comment.author?.login));
+    if (!latestGreptileComment?.path?.trim()) {
+      return [];
+    }
+    return [latestGreptileComment];
+  });
+}
+function resolvePrRepoRoot(projectRoot, prState) {
+  const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (prState.target === "monorepo" && runtimeWorkspace && existsSync(resolve(runtimeWorkspace, ".git"))) {
+    return runtimeWorkspace;
+  }
+  const paths = resolveHarnessPaths(projectRoot);
+  return prState.target === "monorepo" ? paths.monorepoRoot : projectRoot;
+}
+function isCommitAncestorOfPrHead(projectRoot, prState, reviewedCommit, headCommit) {
+  if (!reviewedCommit || !headCommit) {
+    return false;
+  }
+  const repoRoot = resolvePrRepoRoot(projectRoot, prState);
+  return runCapture(["git", "-C", repoRoot, "merge-base", "--is-ancestor", reviewedCommit, headCommit], projectRoot).exitCode === 0;
+}
+function summarizeComment(input) {
+  const text = stripHtml(input).replace(/\s+/g, " ").trim();
+  return text.length > 160 ? `${text.slice(0, 157)}...` : text;
+}
+function asGreptileInfrastructureWarning(reason) {
+  return reason.startsWith("[AI Review]") ? reason.replace("[AI Review]", "[AI Review Warning]") : reason;
+}
+function isAiReviewApproved(input) {
+  if (input.aiVerdict === "REJECT" && input.aiReasons.length > 0) {
+    return false;
+  }
+  if (input.reviewMode !== "required") {
+    return true;
+  }
+  return input.aiVerdict === "APPROVE" && input.aiReasons.length === 0;
+}
+var init_verifier = () => {};
+
+// packages/bundle-default-lifecycle/src/control-plane/completion-verification.ts
+var exports_completion_verification = {};
+__export(exports_completion_verification, {
+  runCompletionVerificationGate: () => runCompletionVerificationGate,
+  formatCompletionBlockedMessage: () => formatCompletionBlockedMessage,
+  closeCompletedTaskSource: () => closeCompletedTaskSource
+});
+import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync, writeFileSync as writeFileSync2 } from "fs";
+import { resolve as resolve2 } from "path";
+import { safePathSegment } from "@rig/shared/safe-identifiers";
+import {
+  escapeRegExp,
+  resolveBunCli,
+  resolveBunCliInvocation,
+  resolveTaskScopes,
+  resolvePolicyContent
+} from "@rig/hook-kit";
+import { loadPolicy, seedPolicyFromContent } from "@rig/runtime/control-plane/runtime/guard";
+import { gitCommit, gitMergePr, gitOpenPr, readPrMetadata as readPrMetadata2, resolveTaskBranchRef } from "@rig/runtime/control-plane/native/git-ops";
+import { runStrictPrMergeGate as runStrictPrMergeGate2 } from "@rig/pr-review-plugin";
+import { strictMergeHeadShaFromGate as strictMergeHeadShaFromGate2 } from "@rig/contracts";
+import { changedFilesForTask, pendingFilesForTask, taskArtifacts, taskValidate as taskValidate2 } from "@rig/runtime/control-plane/native/task-ops";
+import { currentTaskId } from "@rig/runtime/control-plane/native/task-state";
+import { resolveHarnessPaths as resolveHarnessPaths2, runCapture as runCapture2 } from "@rig/runtime/control-plane/native/utils";
+import { readSourceAwareTaskStatus } from "@rig/runtime/control-plane/tasks/source-aware-task-config-source";
+import {
+  buildTaskRunLifecycleComment,
+  updateConfiguredTaskSourceTask
+} from "@rig/runtime/control-plane/tasks/source-lifecycle";
+import { buildPluginHostContext as buildPluginHostContext2 } from "@rig/runtime/control-plane/plugin-host-context";
+async function closeCompletedTaskSource(projectRoot, taskId) {
+  const comment = buildTaskRunLifecycleComment({
+    runId: process.env.RIG_SERVER_RUN_ID || taskId,
+    status: "closed",
+    summary: "Rig completion verification approved and closed this task.",
+    runtimeWorkspace: process.env.RIG_TASK_WORKSPACE,
+    logsDir: process.env.RIG_LOGS_DIR,
+    sessionDir: process.env.RIG_SESSION_FILE
+  });
+  const result = await updateConfiguredTaskSourceTask(projectRoot, {
+    taskId,
+    update: { status: "closed", comment }
+  });
+  const status = result.status ?? await readSourceAwareTaskStatus(projectRoot, result.taskId);
+  if (!result.updated && status == null) {
+    return {
+      ok: true,
+      status,
+      message: `No source-aware task source configured for ${taskId}; closeout skipped.`
+    };
+  }
+  const ok = isClosedStatus(status);
+  return {
+    ok,
+    status,
+    message: ok ? `Task source closed for ${taskId}.` : `Task source closeout failed for ${taskId}; updated=${result.updated}, status=${String(status)}`
+  };
+}
+function isClosedStatus(status) {
+  return status === "closed" || status === "CLOSED" || status === "completed" || status === "cancelled" || status === "blocked";
+}
+async function runCompletionVerificationGate(projectRoot) {
+  seedPolicyFromContent(resolvePolicyContent(projectRoot));
+  const taskId = currentTaskId(projectRoot);
+  if (!taskId) {
+    return { ok: true };
+  }
+  const paths = resolveHarnessPaths2(projectRoot);
+  let failed = false;
+  let sourceCloseoutAllowed = false;
+  console.log(`=== Completion Verification: ${taskId} ===`);
+  const scopes = await resolveTaskScopes(projectRoot, taskId);
+  const taskChangedFiles = changedFilesForTask(projectRoot, taskId, true);
+  const sourceInArtifacts = taskChangedFiles.filter((file) => /^artifacts\//.test(file) && /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(file));
+  if (sourceInArtifacts.length > 0) {
+    console.log(`
+[0/3] Source code in artifacts check...`);
+    console.log("FAIL: Source code files found in artifacts/ directory.");
+    console.log("Code belongs in the project source tree, not artifacts/.");
+    console.log("Affected files:");
+    for (const f of sourceInArtifacts) {
+      console.log(`  - ${f}`);
+    }
+    failed = true;
+  }
+  const pluginHostCtx = await buildPluginHostContext2(projectRoot).catch((error) => {
+    console.warn(`[completion-verification] plugin host unavailable for validators: ${error instanceof Error ? error.message : String(error)}`);
+    return null;
+  });
+  console.log(`
+[1/3] Task validation...`);
+  if (!await taskValidate2(projectRoot, taskId, pluginHostCtx?.validatorRegistry ?? undefined)) {
+    console.log(`FAIL: Validation failed for ${taskId}`);
+    failed = true;
+  } else {
+    console.log("OK: Validation passes");
+  }
+  if (taskChangedFiles.some((file) => /^packages\/protos\//.test(file))) {
+    console.log(`
+[1.5/3] Proto/codegen drift gate...`);
+    if (!await runProtoQualityGate(paths.monorepoRoot)) {
+      failed = true;
+    }
+  }
+  taskArtifacts(projectRoot, taskId);
+  const policy = loadPolicy(projectRoot);
+  const openPrEnabled = policy.completion.checks.includes("open-pr");
+  const autoMergeEnabled = policy.completion.checks.includes("auto-merge");
+  console.log(`
+[2/3] Verifier preflight...`);
+  if (!failed) {
+    const localVerifyOutcome = await verifyTask({
+      projectRoot,
+      taskId,
+      skipAiReview: true,
+      persistArtifacts: false
+    });
+    if (!localVerifyOutcome.approved) {
+      console.log("REJECT:");
+      for (const reason of localVerifyOutcome.localReasons) {
+        console.log(`- ${reason}`);
+      }
+      console.log("FAIL: Local verifier preflight rejected completion");
+      failed = true;
+      await recordVerifierFailure(projectRoot, taskId, paths);
+    } else {
+      console.log("OK: Local verifier preflight passes");
+    }
+  } else {
+    console.log("Verifier preflight: skipped (earlier checks failed)");
+  }
+  const pendingTaskChangedFiles = pendingFilesForTask(projectRoot, taskId, true);
+  const hasLocalChanges = pendingTaskChangedFiles.length > 0;
+  console.log(`
+[post] Auto-committing task changes...`);
+  if (failed) {
+    console.log("Auto-commit: skipped (earlier checks failed)");
+  } else if (hasLocalChanges) {
+    gitCommit({
+      projectRoot,
+      taskId,
+      target: "monorepo",
+      message: `rig: ${taskId} task completion`,
+      allowEmpty: false,
+      scoped: false
+    });
+    console.log("OK: Task changes committed");
+  } else {
+    console.log("Auto-commit: skipped (no changes detected)");
+  }
+  const prReady = !failed && (hasLocalChanges || repoHasRemoteRelevantCommits(projectRoot, paths.monorepoRoot) || repoHasPublishedTaskBranch(projectRoot, paths.monorepoRoot, taskId));
+  if (!failed && openPrEnabled && prReady) {
+    console.log(`
+[post] Auto push + PR handoff...`);
+    try {
+      const pr = gitOpenPr({
+        projectRoot,
+        taskId,
+        target: "monorepo"
+      });
+      console.log(`PR ready (${pr.repoLabel}): ${pr.url}`);
+      if (pr.reviewer && pr.reviewerSource) {
+        console.log(`Reviewer assigned: ${pr.reviewer} (${pr.reviewerSource})`);
+      } else if (pr.reviewer) {
+        console.log(`Reviewer assigned: ${pr.reviewer}`);
+      }
+      console.log("OK: Auto PR handoff complete");
+    } catch (error) {
+      console.log("FAIL: Auto PR handoff failed");
+      console.log(error instanceof Error ? error.message : String(error));
+      failed = true;
+    }
+  } else if (failed) {
+    console.log(`
+[post] Auto PR handoff: skipped (earlier checks failed)`);
+  } else if (!failed) {
+    console.log(openPrEnabled ? `
+[post] Auto PR handoff: skipped (no changes detected)` : `
+[post] Auto PR handoff: skipped (not in policy completion.checks)`);
+  }
+  console.log(`
+[3/3] Verifier review...`);
+  const verifyOutcome = await verifyTask({
+    projectRoot,
+    taskId
+  });
+  if (!verifyOutcome.approved) {
+    console.log("REJECT:");
+    for (const reason of verifyOutcome.localReasons) {
+      console.log(`- ${reason}`);
+    }
+    for (const reason of verifyOutcome.aiReasons) {
+      console.log(`- ${reason}`);
+    }
+    console.log("FAIL: Verifier rejected completion");
+    failed = true;
+    await recordVerifierFailure(projectRoot, taskId, paths);
+  } else {
+    console.log("OK: Verifier approved");
+  }
+  if (!failed && autoMergeEnabled) {
+    console.log(`
+[post] Auto-merge...`);
+    try {
+      const prs = readPrMetadata2(projectRoot, taskId);
+      if (prs.length === 0) {
+        console.log("Auto-merge: skipped (no PR metadata found)");
+      } else {
+        let cycle = 0;
+        for (const pr of prs) {
+          cycle += 1;
+          const gate = await runStrictPrMergeGate2({
+            projectRoot,
+            prUrl: pr.url,
+            taskId,
+            runId: "completion-verification",
+            cycle,
+            final: true,
+            command: async (args, options) => {
+              const result = runCapture2(["gh", ...args], options?.cwd ?? projectRoot);
+              return { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr };
+            }
+          });
+          if (!gate.approved) {
+            console.log(`FAIL: Strict merge gate blocked PR (${pr.repoLabel}): ${pr.url}`);
+            for (const reason of gate.reasons) {
+              console.log(`- ${reason}`);
+            }
+            failed = true;
+            continue;
+          }
+          const mergeResult = gitMergePr({
+            projectRoot,
+            pr,
+            method: "squash",
+            deleteBranch: true,
+            matchHeadCommit: strictMergeHeadShaFromGate2(gate, pr.url)
+          });
+          if (mergeResult.status === "merged" || mergeResult.status === "already-merged") {
+            console.log(`OK: PR merge confirmed (${pr.repoLabel}): ${pr.url}`);
+          }
+        }
+        if (!failed) {
+          sourceCloseoutAllowed = true;
+          console.log("OK: Auto-merge complete");
+        }
+      }
+    } catch (error) {
+      console.log("FAIL: Auto-merge failed");
+      console.log(error instanceof Error ? error.message : String(error));
+      failed = true;
+    }
+  } else if (!failed) {
+    console.log(`
+[post] Auto-merge: skipped (not in policy completion.checks)`);
+  }
+  const artifactDir = resolve2(paths.artifactsDir, safePathSegment(taskId, { fallback: "task", maxLength: 96 }));
+  mkdirSync2(artifactDir, { recursive: true });
+  writeFileSync2(resolve2(artifactDir, "review-status.txt"), failed ? `REJECTED
+` : `APPROVED
+`, "utf-8");
+  if (!failed) {
+    await recordTaskRepoCommits(projectRoot, taskId, paths);
+    if (sourceCloseoutAllowed) {
+      const closeout = await closeCompletedTaskSource(projectRoot, taskId);
+      if (!closeout.ok) {
+        console.log(`FAIL: ${closeout.message}`);
+        failed = true;
+      } else {
+        console.log(`OK: ${closeout.message}`);
+      }
+    } else {
+      console.log("Task source closeout skipped until an approved PR merge completes.");
+    }
+  }
+  if (!failed) {
+    console.log(`
+=== All checks passed for ${taskId} ===`);
+    console.log(autoMergeEnabled ? "Task approved and merged." : "Task ready for review.");
+    return { ok: true };
+  }
+  console.log(`
+=== COMPLETION BLOCKED ===`);
+  console.log(formatCompletionBlockedMessage(taskId));
+  return { ok: false };
+}
+function formatCompletionBlockedMessage(taskId) {
+  return `BLOCKED: Fix the failures above before completing ${taskId}.`;
+}
+async function runBunTool(args, cwd) {
+  const bunCli = resolveBunCliInvocation();
+  const proc = Bun.spawn([resolveBunCli(), ...args], {
+    cwd,
+    env: {
+      ...process.env,
+      ...bunCli.env
+    },
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const exitCode = await proc.exited;
+  return {
+    exitCode,
+    stdout: await new Response(proc.stdout).text(),
+    stderr: await new Response(proc.stderr).text()
+  };
+}
+async function runProtoQualityGate(monorepoRoot) {
+  const protosDir = resolve2(monorepoRoot, "packages", "protos");
+  if (!existsSync2(protosDir)) {
+    console.log(`FAIL: Proto workspace not found at ${protosDir}`);
+    return false;
+  }
+  let ok = true;
+  const bufBuild = await runBunTool(["x", "buf", "build"], protosDir);
+  if (bufBuild.exitCode !== 0) {
+    console.log("FAIL: buf build failed");
+    console.log(bufBuild.stderr || bufBuild.stdout);
+    ok = false;
+  } else {
+    console.log("OK: buf build passes");
+  }
+  const bufLint = await runBunTool(["x", "buf", "lint"], protosDir);
+  if (bufLint.exitCode !== 0) {
+    console.log("FAIL: buf lint failed");
+    console.log(bufLint.stderr || bufLint.stdout);
+    ok = false;
+  } else {
+    console.log("OK: buf lint passes");
+  }
+  const generate = await runBunTool(["run", "generate"], protosDir);
+  if (generate.exitCode !== 0) {
+    console.log("FAIL: proto generation failed");
+    console.log(generate.stderr || generate.stdout);
+    ok = false;
+  } else {
+    const drift = runCapture2(["git", "-C", protosDir, "status", "--porcelain", "--", "gen/ts"], monorepoRoot);
+    if (drift.exitCode !== 0) {
+      console.log("FAIL: Could not inspect generated proto drift");
+      console.log(drift.stderr || drift.stdout);
+      ok = false;
+    } else if (drift.stdout.trim()) {
+      console.log("FAIL: Generated TypeScript stubs are out of sync with proto sources");
+      console.log(drift.stdout.trim());
+      ok = false;
+    } else {
+      console.log("OK: Generated TypeScript stubs are in sync");
+    }
+  }
+  const typecheck = await runBunTool(["x", "tsc", "--noEmit"], protosDir);
+  if (typecheck.exitCode !== 0) {
+    console.log("FAIL: Generated TypeScript does not typecheck");
+    console.log(typecheck.stderr || typecheck.stdout);
+    ok = false;
+  } else {
+    console.log("OK: Generated TypeScript compiles");
+  }
+  const workflowPath = resolve2(monorepoRoot, ".github", "workflows", "pull-request-gate.yml");
+  if (!existsSync2(workflowPath)) {
+    console.log(`FAIL: Missing workflow gate file at ${workflowPath}`);
+    ok = false;
+  } else {
+    const workflow = readFileSync(workflowPath, "utf-8");
+    if (workflow.includes("if: false && needs.detect.outputs.protos_changed == 'true'")) {
+      console.log("FAIL: Proto quality CI gate is disabled in pull-request-gate.yml");
+      ok = false;
+    } else {
+      console.log("OK: Proto quality CI gate is enabled");
+    }
+  }
+  return ok;
+}
+function repoHasRemoteRelevantCommits(projectRoot, repoRoot) {
+  const unpushed = runCapture2(["git", "-C", repoRoot, "log", "@{u}..HEAD", "--oneline"], projectRoot);
+  if (unpushed.exitCode === 0 && unpushed.stdout.trim().length > 0)
+    return true;
+  if (unpushed.exitCode !== 0) {
+    const branch = runCapture2(["git", "-C", repoRoot, "rev-parse", "--abbrev-ref", "HEAD"], projectRoot);
+    if (branch.exitCode === 0 && branch.stdout.trim()) {
+      const remote = runCapture2(["git", "-C", repoRoot, "ls-remote", "--exit-code", "origin", `refs/heads/${branch.stdout.trim()}`], projectRoot);
+      if (remote.exitCode !== 0)
+        return true;
+    }
+  }
+  return false;
+}
+function repoHasPublishedTaskBranch(projectRoot, repoRoot, taskId) {
+  const branchRef = resolveTaskBranchRef(projectRoot, taskId);
+  return runCapture2(["git", "-C", repoRoot, "ls-remote", "--exit-code", "origin", `refs/heads/${branchRef}`], projectRoot).exitCode === 0;
+}
+async function readJsonFileIfPresent(path) {
+  if (!existsSync2(path)) {
+    return null;
+  }
+  try {
+    return await Bun.file(path).json();
+  } catch {
+    return null;
+  }
+}
+async function recordVerifierFailure(projectRoot, taskId, paths) {
+  const failedApproachesPath = paths.failedApproachesPath;
+  const artifactDir = resolve2(paths.artifactsDir, safePathSegment(taskId, { fallback: "task", maxLength: 96 }));
+  const reviewStatePath = resolve2(artifactDir, "review-state.json");
+  const reviewFeedbackPath = resolve2(artifactDir, "review-feedback.md");
+  let summary = "Verifier rejected completion. Read review-feedback.md for required fixes.";
+  const parsedReviewState = await readJsonFileIfPresent(reviewStatePath);
+  if (parsedReviewState) {
+    const reasons = [...parsedReviewState.local_reasons || [], ...parsedReviewState.ai_reasons || []].filter(Boolean);
+    if (reasons.length > 0) {
+      summary = `Verifier rejected completion: ${reasons[0]}`;
+    }
+  }
+  let attempts = 1;
+  if (existsSync2(failedApproachesPath)) {
+    const content = readFileSync(failedApproachesPath, "utf-8");
+    attempts = (content.match(new RegExp(`^## ${escapeRegExp(taskId)}\\b`, "gm")) || []).length + 1;
+  } else {
+    mkdirSync2(resolve2(failedApproachesPath, ".."), { recursive: true });
+    writeFileSync2(failedApproachesPath, `# Failed Approaches
+
+`, "utf-8");
+  }
+  appendFileSync(failedApproachesPath, [
+    "",
+    `## ${taskId} - Attempt ${attempts} (${new Date().toISOString()})`,
+    "",
+    `**Reason:** ${summary}`,
+    "",
+    `**Review artifacts:** ${reviewFeedbackPath}`,
+    "",
+    "---",
+    ""
+  ].join(`
+`), "utf-8");
+}
+async function recordTaskRepoCommits(projectRoot, taskId, paths) {
+  const statePaths = new Set([paths.taskRepoCommitsPath]);
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim();
+  if (hostProjectRoot && hostProjectRoot !== projectRoot) {
+    statePaths.add(resolveHarnessPaths2(hostProjectRoot).taskRepoCommitsPath);
+  }
+  const repos = {};
+  const monoHead = runCapture2(["git", "-C", paths.monorepoRoot, "rev-parse", "HEAD"], projectRoot).stdout.trim();
+  if (monoHead) {
+    repos["monorepo"] = monoHead;
+  }
+  for (const statePath of statePaths) {
+    let state = {};
+    const parsedState = await readJsonFileIfPresent(statePath);
+    if (parsedState && typeof parsedState === "object" && !Array.isArray(parsedState)) {
+      state = parsedState;
+    }
+    state[taskId] = {
+      recorded_at: new Date().toISOString(),
+      repos
+    };
+    mkdirSync2(resolve2(statePath, ".."), { recursive: true });
+    writeFileSync2(statePath, `${JSON.stringify(state, null, 2)}
+`, "utf-8");
+  }
+}
+var init_completion_verification = __esm(() => {
+  init_verifier();
+});
+
+// packages/bundle-default-lifecycle/src/control-plane/task-verify.ts
+var exports_task_verify = {};
+__export(exports_task_verify, {
+  taskVerify: () => taskVerify
+});
+import { currentTaskId as currentTaskId2 } from "@rig/runtime/control-plane/native/task-state";
+async function taskVerify(projectRoot, taskId) {
+  const activeTask = taskId || currentTaskId2(projectRoot);
+  if (!activeTask) {
+    throw new Error("No active task.");
+  }
+  const outcome = await verifyTask({ projectRoot, taskId: activeTask });
+  if (!outcome.approved) {
+    console.log("REJECT:");
+    for (const reason of outcome.localReasons) {
+      console.log(`- ${reason}`);
+    }
+    for (const reason of outcome.aiReasons) {
+      console.log(`- ${reason}`);
+    }
+    return false;
+  }
+  console.log("APPROVE");
+  if (outcome.aiVerdict === "APPROVE") {
+    console.log("- [AI Review] Greptile approved.");
+  }
+  for (const warning of outcome.aiWarnings) {
+    console.log(`- ${warning}`);
+  }
+  return true;
+}
+var init_task_verify = __esm(() => {
+  init_verifier();
+});
+
 // packages/bundle-default-lifecycle/src/pipelineCloseout.ts
-import { resolve } from "path";
-import { loadConfig } from "@rig/core/load-config";
-import { createPluginHost } from "@rig/core";
+import { resolve as resolve3 } from "path";
+import { loadConfig as loadConfig2 } from "@rig/core/load-config";
+import { resolvePluginHost } from "@rig/core/project-plugins";
 import { createDefaultKernel } from "@rig/kernel/default-kernel";
+import { buildPluginHostContext as buildPluginHostContext3 } from "@rig/runtime/control-plane/plugin-host-context";
+
+// packages/bundle-default-lifecycle/src/native/in-process-closeout.ts
+init_pr_automation();
+import { loadConfig } from "@rig/core/load-config";
 import { buildPluginHostContext } from "@rig/runtime/control-plane/plugin-host-context";
-import {
-  CloseoutValidationError
-} from "@rig/runtime/control-plane/native/in-process-closeout";
 import { taskValidate } from "@rig/runtime/control-plane/native/task-ops";
+var CLOSEOUT_PHASES = new Set([
+  "queued",
+  "commit",
+  "push",
+  "pr-review-merge",
+  "pr-opened",
+  "merge",
+  "close-source",
+  "completed"
+]);
+
+class CloseoutValidationError extends Error {
+  name = "CloseoutValidationError";
+}
+
+// packages/bundle-default-lifecycle/src/pipelineCloseout.ts
+import { taskValidate as taskValidate3 } from "@rig/runtime/control-plane/native/task-ops";
 
 // packages/bundle-default-lifecycle/src/defaultPipeline.ts
 import { resolveKernelStages } from "@rig/kernel/resolver";
@@ -33,8 +2660,8 @@ var autoMergeStage = defineDefaultLifecycleStage({
   calls: ["runRepoDefaultMerge"]
 });
 async function runAutoMergeStage(input) {
-  const { runRepoDefaultMerge } = await import("@rig/runtime/control-plane/native/pr-automation");
-  await runRepoDefaultMerge(input);
+  const { runRepoDefaultMerge: runRepoDefaultMerge2 } = await Promise.resolve().then(() => (init_pr_automation(), exports_pr_automation));
+  await runRepoDefaultMerge2(input);
 }
 
 // packages/bundle-default-lifecycle/src/stages/commit.ts
@@ -45,8 +2672,8 @@ var commitStage = defineDefaultLifecycleStage({
   calls: ["commitRunChanges"]
 });
 async function runCommitStage(input) {
-  const { commitRunChanges } = await import("@rig/runtime/control-plane/native/pr-automation");
-  return await commitRunChanges(input);
+  const { commitRunChanges: commitRunChanges2 } = await Promise.resolve().then(() => (init_pr_automation(), exports_pr_automation));
+  return await commitRunChanges2(input);
 }
 
 // packages/bundle-default-lifecycle/src/stages/isolation.ts
@@ -73,8 +2700,8 @@ var mergeGateStage = defineDefaultLifecycleStage({
   calls: ["runStrictPrMergeGate"]
 });
 async function runMergeGateStage(input) {
-  const { runStrictPrMergeGate } = await import("@rig/runtime/control-plane/native/pr-review-gate");
-  return await runStrictPrMergeGate({
+  const { runStrictPrMergeGate: runStrictPrMergeGate2 } = await import("@rig/pr-review-plugin");
+  return await runStrictPrMergeGate2({
     projectRoot: input.projectRoot,
     prUrl: input.prUrl,
     taskId: input.taskId,
@@ -97,8 +2724,8 @@ var openPrStage = defineDefaultLifecycleStage({
   calls: ["runPrAutomation"]
 });
 async function runOpenPrStage(input) {
-  const { runPrAutomation } = await import("@rig/runtime/control-plane/native/pr-automation");
-  return await runPrAutomation({
+  const { runPrAutomation: runPrAutomation2 } = await Promise.resolve().then(() => (init_pr_automation(), exports_pr_automation));
+  return await runPrAutomation2({
     projectRoot: input.workspace,
     taskId: input.taskId,
     runId: input.runId,
@@ -123,8 +2750,8 @@ var pushStage = defineDefaultLifecycleStage({
   calls: ["pushBranchSyncedWithOrigin"]
 });
 async function runPushStage(input) {
-  const { pushBranchSyncedWithOrigin } = await import("@rig/runtime/control-plane/native/pr-automation");
-  await pushBranchSyncedWithOrigin(input);
+  const { pushBranchSyncedWithOrigin: pushBranchSyncedWithOrigin2 } = await Promise.resolve().then(() => (init_pr_automation(), exports_pr_automation));
+  await pushBranchSyncedWithOrigin2(input);
 }
 
 // packages/bundle-default-lifecycle/src/stages/source-closeout.ts
@@ -137,8 +2764,8 @@ var sourceCloseoutStage = defineDefaultLifecycleStage({
 async function runSourceCloseoutStage(input) {
   if (input.pr.status !== "merged" || !input.pr.prUrl)
     return;
-  const { closeIssueAfterMergedPr } = await import("@rig/runtime/control-plane/native/pr-automation");
-  await closeIssueAfterMergedPr({
+  const { closeIssueAfterMergedPr: closeIssueAfterMergedPr2 } = await Promise.resolve().then(() => (init_pr_automation(), exports_pr_automation));
+  await closeIssueAfterMergedPr2({
     projectRoot: input.projectRoot,
     taskId: input.taskId,
     runId: input.runId,
@@ -223,11 +2850,11 @@ function defaultKernelStatusData() {
   const plugin = createDefaultKernelPlugin();
   const resolved = resolveDefaultLifecycle();
   const capabilities = {};
-  for (const capability of plugin.provides)
-    capabilities[capability] = plugin.meta.id;
+  for (const capability of plugin.provides ?? [])
+    capabilities[capability] = plugin.name;
   return {
-    kernelProviderId: plugin.meta.id,
-    kernelVersion: plugin.meta.version,
+    kernelProviderId: plugin.name,
+    kernelVersion: plugin.version ?? "0.0.0-alpha.1",
     capabilities,
     pipelineStageCount: resolved.order.length,
     stageOrder: [...resolved.order]
@@ -266,6 +2893,10 @@ function formatDefaultPipelineShow(input = {}) {
 
 // packages/bundle-default-lifecycle/src/plugin.ts
 import { definePlugin } from "@rig/core/config";
+import {
+  COMPLETION_VERIFICATION_CAPABILITY_ID,
+  TASK_VERIFY_CAPABILITY_ID
+} from "@rig/contracts";
 
 // packages/bundle-default-lifecycle/src/cli.ts
 var DEFAULT_PIPELINE_CLI_ID = "default-lifecycle.pipeline";
@@ -341,33 +2972,63 @@ var defaultLifecycleCliCommands = [
 
 // packages/bundle-default-lifecycle/src/plugin.ts
 var DEFAULT_LIFECYCLE_PLUGIN_ID = "@rig/bundle-default-lifecycle";
+var COMPLETION_VERIFICATION_HOOK_ID = "@rig/bundle-default-lifecycle:completion-verification";
+async function runCompletionGate(projectRoot) {
+  const mod = await Promise.resolve().then(() => (init_completion_verification(), exports_completion_verification));
+  return mod.runCompletionVerificationGate(projectRoot);
+}
+async function completionVerificationStopHandler(ctx) {
+  const { ok } = await runCompletionGate(ctx.projectRoot);
+  if (ok) {
+    return { decision: "allow" };
+  }
+  const { formatCompletionBlockedMessage: formatCompletionBlockedMessage2 } = await Promise.resolve().then(() => (init_completion_verification(), exports_completion_verification));
+  return { decision: "block", reason: formatCompletionBlockedMessage2(ctx.taskId || "task") };
+}
+var LIFECYCLE_HOOKS = [
+  {
+    id: COMPLETION_VERIFICATION_HOOK_ID,
+    event: "Stop",
+    matcher: { kind: "all" },
+    description: "Runs the completion-verification gate (validate, verify, commit, PR, merge) before the agent stops.",
+    handler: completionVerificationStopHandler
+  }
+];
+var LIFECYCLE_CAPABILITIES = [
+  { id: "default-lifecycle.pipeline", title: "Default lifecycle pipeline", commandId: DEFAULT_PIPELINE_CLI_ID },
+  { id: "default-lifecycle.kernel-status", title: "Default kernel status", commandId: DEFAULT_KERNEL_CLI_ID },
+  {
+    id: TASK_VERIFY_CAPABILITY_ID,
+    title: "Task verification",
+    description: "Verify a task's changes (local checks + AI review) and report approval.",
+    run: async (input) => {
+      const { projectRoot, taskId } = input;
+      const { taskVerify: taskVerify2 } = await Promise.resolve().then(() => (init_task_verify(), exports_task_verify));
+      return taskVerify2(projectRoot, taskId);
+    }
+  },
+  {
+    id: COMPLETION_VERIFICATION_CAPABILITY_ID,
+    title: "Completion verification gate",
+    description: "Run the full completion gate for the active task and report whether it passed.",
+    run: async (input) => {
+      const { projectRoot } = input;
+      return runCompletionGate(projectRoot);
+    }
+  }
+];
 function createDefaultLifecyclePlugin(stages = {}) {
-  const plugin = definePlugin({
+  return definePlugin({
     name: DEFAULT_LIFECYCLE_PLUGIN_ID,
     version: "0.0.0-alpha.1",
     provides: [],
     contributes: {
-      stages: defaultLifecycleStages,
-      capabilities: [
-        { id: "default-lifecycle.pipeline", title: "Default lifecycle pipeline", commandId: DEFAULT_PIPELINE_CLI_ID },
-        { id: "default-lifecycle.kernel-status", title: "Default kernel status", commandId: DEFAULT_KERNEL_CLI_ID }
-      ],
-      cliCommands: defaultLifecycleCliCommands.map(({ run: _run, ...metadata }) => metadata)
+      stages: defaultLifecycleStages.map((stage) => stages[stage.id] ? { ...stage, run: stages[stage.id] } : stage),
+      hooks: LIFECYCLE_HOOKS,
+      capabilities: LIFECYCLE_CAPABILITIES,
+      cliCommands: defaultLifecycleCliCommands
     }
-  }, {
-    stages,
-    featureCapabilities: [
-      { id: "default-lifecycle.pipeline", title: "Default lifecycle pipeline", commandId: DEFAULT_PIPELINE_CLI_ID },
-      { id: "default-lifecycle.kernel-status", title: "Default kernel status", commandId: DEFAULT_KERNEL_CLI_ID }
-    ],
-    cliCommands: defaultLifecycleCliCommands
   });
-  return {
-    ...plugin,
-    meta: { id: DEFAULT_LIFECYCLE_PLUGIN_ID, name: "Default Rig Lifecycle", version: "0.0.0-alpha.1" },
-    contributes: { ...plugin.contributes ?? {}, stages: defaultLifecycleStages },
-    runtime: { stages }
-  };
 }
 var defaultLifecyclePlugin = createDefaultLifecyclePlugin();
 
@@ -388,19 +3049,18 @@ function closeoutOutcome(status) {
   }
 }
 async function loadRigAutomationConfig(projectRoot) {
-  return await loadConfig(projectRoot);
+  return await loadConfig2(projectRoot);
 }
 async function runRigProjectValidation({ projectRoot, taskId }) {
-  const pluginHostCtx = await buildPluginHostContext(projectRoot);
-  return taskValidate(projectRoot, taskId, pluginHostCtx?.validatorRegistry ?? undefined);
+  const pluginHostCtx = await buildPluginHostContext3(projectRoot);
+  return taskValidate3(projectRoot, taskId, pluginHostCtx?.validatorRegistry ?? undefined);
 }
-function shouldAttemptRigMerge(config) {
+function shouldAttemptRigMerge2(config) {
   const mode = config.merge?.mode;
   return mode !== "off" && mode !== "pr-ready";
 }
 async function loadPluginStageContributions(projectRoot) {
-  const config = await loadConfig(projectRoot);
-  const host = createPluginHost(config.plugins ?? []);
+  const { host } = await resolvePluginHost(projectRoot);
   return { executors: host.listStageExecutors(), mutations: host.listStageMutations() };
 }
 async function runPipelineCloseout(input) {
@@ -420,9 +3080,9 @@ async function runPipelineCloseout(input) {
     ...effectiveConfig,
     merge: { ...effectiveConfig.merge ?? {}, mode: "pr-ready" }
   };
-  const shouldMerge = shouldAttemptRigMerge(effectiveConfig);
+  const shouldMerge = shouldAttemptRigMerge2(effectiveConfig);
   const workspace = input.workspace;
-  const artifactRoot = input.artifactRoot ?? resolve(input.projectRoot, "artifacts", taskId);
+  const artifactRoot = input.artifactRoot ?? resolve3(input.projectRoot, "artifacts", taskId);
   const journal = async (phase, status, detail) => {
     await input.journalPhase(phase, closeoutOutcome(status), detail ?? null);
   };
@@ -586,8 +3246,8 @@ async function runPipelineCloseout(input) {
   };
   const defaultLifecyclePlugin2 = createDefaultLifecyclePlugin(executors);
   const pluginStages = await loadPluginStageContributions(input.projectRoot);
-  const kernel = createDefaultKernel({ ...input.kernelJournal ? { journal: input.kernelJournal } : {}, stageExecutors: { ...defaultLifecyclePlugin2.runtime.stages, ...pluginStages.executors } });
-  const resolved = kernel.stageRunner.resolve(defaultLifecyclePlugin2.contributes.stages, pluginStages.mutations);
+  const kernel = createDefaultKernel({ ...input.kernelJournal ? { journal: input.kernelJournal } : {}, stageExecutors: { ...executors, ...pluginStages.executors } });
+  const resolved = kernel.stageRunner.resolve(defaultLifecyclePlugin2.contributes?.stages ?? [], pluginStages.mutations);
   const ctx = {
     runId: input.runId,
     taskId,