@h-rig/cli 0.0.6-alpha.90 → 0.0.6-alpha.91

package/dist/src/commands/task-run-driver.js

@@ -1,2788 +1,188 @@
 // @bun
 // packages/cli/src/commands/task-run-driver.ts
-import { copyFileSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, statSync, writeFileSync as writeFileSync2 } from "fs";
-import { resolve as resolve6 } from "path";
-import { spawn, spawnSync } from "child_process";
-import { createInterface as createLineInterface } from "readline";
-
-// packages/cli/src/runner.ts
-import { EventBus } from "@rig/runtime/control-plane/runtime/events";
-import { CliError as RuntimeCliError } from "@rig/runtime/control-plane/errors";
-import { evaluate, loadPolicy, resolveAction } from "@rig/runtime/control-plane/runtime/guard";
-import { buildBinary } from "@rig/runtime/control-plane/runtime/isolation";
-
-class CliError extends RuntimeCliError {
-  hint;
-  constructor(message, exitCode = 1, options = {}) {
-    super(message, exitCode);
-    if (options.hint?.trim()) {
-      this.hint = options.hint.trim();
-    }
-  }
-}
-function formatCommand(parts) {
-  return parts.map((part) => /[^a-zA-Z0-9_./:-]/.test(part) ? JSON.stringify(part) : part).join(" ");
-}
-
-// packages/cli/src/commands/task-run-driver.ts
-import { loadConfig } from "@rig/core/load-config";
-import {
-  listAgentRuntimes,
-  startRuntimeSnapshotSidecar
-} from "@rig/runtime/control-plane/runtime/isolation";
-import {
-  finalizeTaskRunSnapshot,
-  resolveTaskRunSnapshotSidecar
-} from "@rig/runtime/control-plane/runtime/snapshot/task-run";
-import { loadRuntimeSnapshotConfig } from "@rig/runtime/control-plane/runtime/guard";
-import {
-  buildClaudeLogsFromRecord,
-  flushPendingClaudeToolUseLogs
-} from "@rig/runtime/control-plane/provider/claude-stream-records";
-import {
-  buildCodexLogsFromRecord,
-  extractCodexAssistantMessageText,
-  flushPendingCodexToolUseLogs,
-  isCodexExecRecord
-} from "@rig/runtime/control-plane/provider/codex-exec-records";
-import { resolvePreferredShellBinary } from "@rig/runtime/control-plane/native/run-ops";
-import { readAuthorityRun as readAuthorityRun3, readJsonFile as readJsonFile2, resolveTaskArtifactDirs } from "@rig/runtime/control-plane/authority-files";
-import {
-  buildTaskRunLifecycleComment
-} from "@rig/runtime/control-plane/tasks/source-lifecycle";
-import {
-  closeIssueAfterMergedPr,
-  commitRunChanges,
-  pushBranchSyncedWithOrigin,
-  runPrAutomation
-} from "@rig/runtime/control-plane/native/pr-automation";
-
-// packages/cli/src/commands/_run-driver-helpers.ts
-import { readFileSync } from "fs";
-import { resolve as resolve3 } from "path";
-import {
-  appendRunJournalEvent,
-  appendRunLogEntry,
-  appendRunTimelineEntry,
-  patchAuthorityRunRecord,
-  readAuthorityRun as readAuthorityRun2,
-  resolveAuthorityRunDir,
-  setAuthorityRunStatus,
-  writeJsonFile
-} from "@rig/runtime/control-plane/authority-files";
-import { taskLookup } from "@rig/runtime/control-plane/native/task-ops";
-import { readPriorPrProgressPromptSection } from "@rig/runtime/control-plane/prompt-context";
-import { buildProviderTaskRunInstructionLines } from "@rig/runtime/control-plane/provider/runtime-instructions";
-import { loadRigTaskRunSkillBody } from "@rig/runtime/control-plane/provider/rig-task-run-skill";
-
-// packages/cli/src/commands/_authority-runs.ts
-import { existsSync } from "fs";
-import { resolve as resolve2 } from "path";
-import {
-  readAuthorityRun,
-  readJsonlFile,
-  writeAuthorityRunRecord
-} from "@rig/runtime/control-plane/authority-files";
-
-// packages/cli/src/commands/_paths.ts
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync } from "fs";
 import { resolve } from "path";
-import { resolveMonorepoRoot } from "@rig/runtime/control-plane/native/utils";
-function resolveControlPlaneMonorepoRoot(projectRoot) {
-  return resolveMonorepoRoot(projectRoot);
-}
-function resolveControlPlaneTaskConfigPath(projectRoot) {
-  return resolve(resolveControlPlaneMonorepoRoot(projectRoot), ".rig", "task-config.json");
-}
-
-// packages/cli/src/commands/_authority-runs.ts
-var RIG_WORKSPACE_ID = "rig-local-workspace";
-function normalizeRuntimeAdapter(value) {
-  const normalized = value?.trim().toLowerCase();
-  if (!normalized) {
-    return "pi";
-  }
-  if (normalized === "codex" || normalized === "codex-cli" || normalized === "codex-app-server" || normalized === "gpt-codex") {
-    return "codex";
-  }
-  if (normalized === "pi" || normalized === "rig-pi" || normalized === "@rig/pi") {
-    return "pi";
-  }
-  return "claude-code";
-}
-function readLatestBeadRecord(projectRoot, taskId) {
-  const issuesPath = resolve2(resolveControlPlaneMonorepoRoot(projectRoot), ".beads", "issues.jsonl");
-  if (!existsSync(issuesPath)) {
-    return null;
-  }
-  let latest = null;
-  for (const issue of readJsonlFile(issuesPath)) {
-    if (!issue || typeof issue !== "object") {
-      continue;
-    }
-    const record = issue;
-    if (record.id === taskId) {
-      latest = record;
-    }
-  }
-  return latest;
-}
-function resolveTaskTitleForAuthorityRun(projectRoot, taskId) {
-  try {
-    const record = readLatestBeadRecord(projectRoot, taskId);
-    const title = record && typeof record.title === "string" ? record.title.trim() : "";
-    if (title) {
-      return title;
-    }
-  } catch {}
-  return null;
-}
-function upsertAgentAuthorityRun(projectRoot, input) {
-  const current = readAuthorityRun(projectRoot, input.runId);
-  const existing = current;
-  const createdAt = existing?.createdAt ?? input.createdAt;
-  const runtimeMode = typeof existing?.runtimeMode === "string" ? existing.runtimeMode : "full-access";
-  const interactionMode = typeof existing?.interactionMode === "string" ? existing.interactionMode : "default";
-  const runMode = typeof existing?.runMode === "string" ? existing.runMode : "autonomous";
-  const runtimeAdapter = normalizeRuntimeAdapter(input.runtimeAdapter ?? existing?.runtimeAdapter ?? "claude-code");
-  const title = resolveTaskTitleForAuthorityRun(projectRoot, input.taskId) ?? input.taskId;
-  const next = {
-    ...existing ?? {},
-    runId: input.runId,
-    projectRoot,
-    workspaceId: existing?.workspaceId ?? RIG_WORKSPACE_ID,
-    taskId: input.taskId,
-    threadId: existing?.threadId ?? null,
-    mode: "local",
-    runtimeAdapter,
-    status: input.status,
-    createdAt,
-    startedAt: input.startedAt ?? existing?.startedAt ?? null,
-    completedAt: input.completedAt ?? existing?.completedAt ?? null,
-    endpointId: existing?.endpointId ?? null,
-    hostId: existing?.hostId ?? null,
-    worktreePath: input.worktreePath ?? existing?.worktreePath ?? null,
-    artifactRoot: input.artifactRoot ?? existing?.artifactRoot ?? null,
-    logRoot: input.logRoot ?? existing?.logRoot ?? null,
-    sessionPath: input.sessionPath ?? existing?.sessionPath ?? null,
-    sessionLogPath: input.sessionLogPath ?? existing?.sessionLogPath ?? null,
-    pid: input.pid ?? existing?.pid ?? null,
-    updatedAt: input.createdAt,
-    title,
-    model: typeof existing?.model === "string" ? existing.model : null,
-    runtimeMode,
-    interactionMode,
-    runMode,
-    initialPrompt: typeof existing?.initialPrompt === "string" ? existing.initialPrompt : null
-  };
-  if (input.errorText !== undefined) {
-    next.errorText = input.errorText;
-  } else if ("errorText" in next) {
-    delete next.errorText;
-  }
-  writeAuthorityRunRecord(projectRoot, input.runId, next);
-  return next;
-}
-
-// packages/cli/src/commands/_run-driver-helpers.ts
-function patchAuthorityRun(projectRoot, runId, patch) {
-  const next = patchAuthorityRunRecord(projectRoot, runId, patch);
-  if (!next) {
-    throw new CliError(`Run not found: ${runId}`, 2, { hint: "Run `rig run list` to see recorded runs." });
-  }
-  return next;
-}
-function setRunStatusOrFail(projectRoot, runId, to, options = {}) {
-  const next = setAuthorityRunStatus(projectRoot, runId, to, {
-    ...options,
-    actor: { kind: "agent" }
-  });
-  if (!next) {
-    throw new CliError(`Run not found: ${runId}`, 2, { hint: "Run `rig run list` to see recorded runs." });
-  }
-  return next;
-}
-function touchAuthorityRun(projectRoot, runId) {
-  const current = readAuthorityRun2(projectRoot, runId);
-  if (!current) {
-    return;
-  }
-  writeJsonFile(resolve3(resolveAuthorityRunDir(projectRoot, runId), "run.json"), {
-    ...current,
-    updatedAt: new Date().toISOString()
-  });
-}
-function appendRunTimeline(projectRoot, runId, value) {
-  appendRunTimelineEntry(projectRoot, runId, value);
-  touchAuthorityRun(projectRoot, runId);
-}
-function appendRunLog(projectRoot, runId, value) {
-  appendRunLogEntry(projectRoot, runId, value);
-  touchAuthorityRun(projectRoot, runId);
-}
-function appendRunAction(projectRoot, runId, value) {
-  appendRunTimelineEntry(projectRoot, runId, {
-    id: value.id,
-    type: "action",
-    actionType: value.actionType,
-    title: value.title,
-    detail: value.detail ?? null,
-    state: value.state,
-    createdAt: value.startedAt,
-    completedAt: value.completedAt ?? null,
-    payload: value.payload ?? {}
-  });
-}
-function startRunAction(projectRoot, runId, input) {
-  const startedAt = new Date().toISOString();
-  appendRunAction(projectRoot, runId, {
-    id: input.actionId,
-    actionType: input.actionType,
-    title: input.title,
-    detail: input.detail,
-    state: "running",
-    startedAt,
-    payload: input.payload
-  });
-  emitServerRunEvent({ type: "timeline", runId });
-  return {
-    startedAt,
-    complete: (detail, payload) => {
-      appendRunAction(projectRoot, runId, {
-        id: input.actionId,
-        actionType: input.actionType,
-        title: input.title,
-        detail: detail ?? input.detail ?? null,
-        state: "completed",
-        startedAt,
-        completedAt: new Date().toISOString(),
-        payload: payload ?? input.payload
-      });
-      emitServerRunEvent({ type: "timeline", runId });
-    },
-    fail: (detail, payload) => {
-      appendRunAction(projectRoot, runId, {
-        id: input.actionId,
-        actionType: input.actionType,
-        title: input.title,
-        detail,
-        state: "failed",
-        startedAt,
-        completedAt: new Date().toISOString(),
-        payload: payload ?? input.payload
-      });
-      emitServerRunEvent({ type: "timeline", runId });
-    }
-  };
-}
-var runEventSinkProjectRoot = null;
-function configureRunEventSink(projectRoot) {
-  runEventSinkProjectRoot = projectRoot;
-}
-var lastDoorbellRangAt = 0;
-function ringServerRunDoorbell(runId) {
-  const serverUrl = process.env.RIG_SERVER_URL?.trim();
-  if (!serverUrl)
-    return;
-  const now = Date.now();
-  if (now - lastDoorbellRangAt < 250)
-    return;
-  lastDoorbellRangAt = now;
-  const token = process.env.RIG_AUTH_TOKEN || process.env.RIG_GITHUB_TOKEN || "";
-  fetch(`${serverUrl.replace(/\/+$/, "")}/api/runs/doorbell`, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      authorization: `Bearer ${token}`
-    },
-    body: JSON.stringify({ runId }),
-    signal: AbortSignal.timeout(1000)
-  }).catch(() => {});
-}
-function emitServerRunEvent(event) {
-  console.log(`__RIG_RUN_EVENT__${JSON.stringify({ ...event, at: new Date().toISOString() })}`);
-  if (runEventSinkProjectRoot) {
-    try {
-      if (event.type === "status" || event.type === "completed" || event.type === "failed") {
-        appendRunJournalEvent(runEventSinkProjectRoot, event.runId, {
-          type: "timeline-entry",
-          payload: { kind: "driver-event", ...event }
-        });
-      }
-    } catch {}
-    ringServerRunDoorbell(event.runId);
-  }
-}
-function buildRunPrompt(input) {
-  const initialPrompt = input.initialPrompt?.trim() || null;
-  if (!input.taskId) {
-    return initialPrompt ?? input.fallbackTitle?.trim() ?? "Continue the requested Rig run and complete the work.";
-  }
-  const issues = (() => {
-    try {
-      return taskLookup(input.projectRoot, input.taskId);
-    } catch {
-      return "";
-    }
-  })();
-  const scopeText = (() => {
-    try {
-      const parsed = JSON.parse(readFileSync(resolveControlPlaneTaskConfigPath(input.projectRoot), "utf8"));
-      const entry = parsed[input.taskId] ?? {};
-      const scope = Array.isArray(entry.scope) ? entry.scope.filter((item) => typeof item === "string") : [];
-      const validation = Array.isArray(entry.validation) ? entry.validation.filter((item) => typeof item === "string") : [];
-      const lines = [];
-      if (scope.length > 0)
-        lines.push(`Scope:
-- ${scope.join(`
-- `)}`);
-      if (validation.length > 0)
-        lines.push(`Validation:
-- ${validation.join(`
-- `)}`);
-      return lines.join(`
-
-`);
-    } catch {
-      return "";
-    }
-  })();
-  const bead = readLatestBeadRecord(input.projectRoot, input.taskId);
-  const sourceTask = input.sourceTask ?? null;
-  const sourceDescription = firstPromptString(sourceTask?.description, sourceTask?.body);
-  const sourceAcceptance = firstPromptString(sourceTask?.acceptanceCriteria, sourceTask?.acceptance_criteria);
-  const sourceValidation = uniqueStrings([...sourceTask?.validation ?? [], ...sourceTask?.validators ?? []]);
-  const title = (bead && typeof bead === "object" && typeof bead.title === "string" ? bead.title : null) ?? firstPromptString(sourceTask?.title) ?? input.fallbackTitle ?? issues ?? input.taskId;
-  const description = (bead && typeof bead === "object" && typeof bead.description === "string" ? bead.description : null) ?? sourceDescription ?? input.fallbackDescription ?? "";
-  const acceptance = bead && typeof bead === "object" && typeof bead.acceptance_criteria === "string" ? bead.acceptance_criteria : sourceAcceptance ?? input.fallbackAcceptanceCriteria ?? "";
-  const sourceContractLines = renderSourceTaskContract(sourceTask, sourceValidation);
-  const providerLines = buildProviderTaskRunInstructionLines(input.runtimeAdapter);
-  const skillBody = loadRigTaskRunSkillBody();
-  return [
-    `You are working on task ${input.taskId}: ${title}.`,
-    description ? `Description:
-${description}` : null,
-    acceptance ? `Acceptance criteria:
-${acceptance}` : null,
-    sourceContractLines.length > 0 ? `Source task contract:
-${sourceContractLines.join(`
-`)}` : null,
-    scopeText || renderSourceScopeValidation(sourceTask, sourceValidation) || null,
-    readPriorPrProgressPromptSection(input.projectRoot, input.taskId),
-    initialPrompt ? `Additional operator guidance:
-${initialPrompt}` : null,
-    providerLines.length > 0 ? `Provider-specific runtime tooling:
-${providerLines.join(" ")}` : null,
-    skillBody || null
-  ].filter((value) => Boolean(value)).join(`
-
-`);
-}
-function firstPromptString(...values) {
-  for (const value of values) {
-    const trimmed = typeof value === "string" ? value.trim() : "";
-    if (trimmed.length > 0) {
-      return trimmed;
-    }
-  }
-  return null;
-}
-function uniqueStrings(values) {
-  return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)));
-}
-function renderSourceTaskContract(task, validation) {
-  if (!task) {
-    return [];
-  }
-  const lines = [];
-  const sourceIssueId = firstPromptString(task.sourceIssueId);
-  if (sourceIssueId)
-    lines.push(`Source issue: ${sourceIssueId}`);
-  const status = firstPromptString(task.status);
-  if (status)
-    lines.push(`Source status: ${status}`);
-  const issueType = firstPromptString(task.issueType);
-  if (issueType)
-    lines.push(`Issue type: ${issueType}`);
-  const role = firstPromptString(task.role);
-  if (role)
-    lines.push(`Role: ${role}`);
-  const externalRef = firstPromptString(task.externalRef);
-  if (externalRef)
-    lines.push(`External ref: ${externalRef}`);
-  const labels = uniqueStrings(task.labels ?? []);
-  if (labels.length > 0)
-    lines.push(`Labels:
-- ${labels.join(`
-- `)}`);
-  if (validation.length > 0)
-    lines.push(`Validators:
-- ${validation.join(`
-- `)}`);
-  return lines;
-}
-function renderSourceScopeValidation(task, validation) {
-  if (!task) {
-    return "";
-  }
-  const lines = [];
-  const scope = uniqueStrings(task.scope ?? []);
-  if (scope.length > 0)
-    lines.push(`Scope:
-- ${scope.join(`
-- `)}`);
-  if (validation.length > 0)
-    lines.push(`Validation:
-- ${validation.join(`
-- `)}`);
-  return lines.join(`
-
-`);
-}
-
-// packages/cli/src/commands/_server-client.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { resolve as resolve5 } from "path";
-import { ensureLocalRigServerConnection } from "@rig/runtime/local-server";
-
-// packages/cli/src/commands/_connection-state.ts
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { homedir } from "os";
-import { dirname, resolve as resolve4 } from "path";
-function resolveGlobalConnectionsPath(env = process.env) {
-  const explicit = env.RIG_CONNECTIONS_FILE?.trim();
-  if (explicit)
-    return resolve4(explicit);
-  const stateDir = env.RIG_GLOBAL_STATE_DIR?.trim();
-  if (stateDir)
-    return resolve4(stateDir, "connections.json");
-  return resolve4(homedir(), ".rig", "connections.json");
-}
-function resolveRepoConnectionPath(projectRoot) {
-  return resolve4(projectRoot, ".rig", "state", "connection.json");
-}
-function readJsonFile(path) {
-  if (!existsSync2(path))
-    return null;
-  try {
-    return JSON.parse(readFileSync2(path, "utf8"));
-  } catch (error) {
-    throw new CliError(`Invalid Rig connection state at ${path}: ${error instanceof Error ? error.message : String(error)}`, 1, { hint: "Fix or delete that file, then re-select a server with `rig server use <alias|local>`." });
-  }
-}
-function writeJsonFile2(path, value) {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(value, null, 2)}
-`, "utf8");
-}
-function normalizeConnection(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    return null;
-  const record = value;
-  if (record.kind === "local")
-    return { kind: "local", mode: "auto" };
-  if (record.kind === "remote" && typeof record.baseUrl === "string" && record.baseUrl.trim()) {
-    const baseUrl = record.baseUrl.trim().replace(/\/+$/, "");
-    return { kind: "remote", baseUrl };
-  }
-  return null;
-}
-function readGlobalConnections(options = {}) {
-  const path = resolveGlobalConnectionsPath(options.env ?? process.env);
-  const payload = readJsonFile(path);
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-    return { connections: {} };
-  }
-  const rawConnections = payload.connections;
-  const connections = {};
-  if (rawConnections && typeof rawConnections === "object" && !Array.isArray(rawConnections)) {
-    for (const [alias, raw] of Object.entries(rawConnections)) {
-      const connection = normalizeConnection(raw);
-      if (connection)
-        connections[alias] = connection;
-    }
-  }
-  return { connections };
-}
-function readRepoConnection(projectRoot) {
-  const payload = readJsonFile(resolveRepoConnectionPath(projectRoot));
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  const record = payload;
-  const selected = typeof record.selected === "string" ? record.selected.trim() : "";
-  if (!selected)
-    return null;
-  return {
-    selected,
-    project: typeof record.project === "string" ? record.project : undefined,
-    linkedAt: typeof record.linkedAt === "string" ? record.linkedAt : undefined,
-    serverProjectRoot: typeof record.serverProjectRoot === "string" && record.serverProjectRoot.trim() ? record.serverProjectRoot.trim() : undefined
-  };
-}
-function writeRepoConnection(projectRoot, state) {
-  writeJsonFile2(resolveRepoConnectionPath(projectRoot), state);
-}
-function resolveSelectedConnection(projectRoot, options = {}) {
-  const repo = readRepoConnection(projectRoot);
-  if (!repo)
-    return null;
-  if (repo.selected === "local")
-    return { alias: "local", connection: { kind: "local", mode: "auto" }, serverProjectRoot: repo.serverProjectRoot };
-  const global = readGlobalConnections(options);
-  const connection = global.connections[repo.selected];
-  if (!connection) {
-    throw new CliError(`Selected Rig server "${repo.selected}" was not found. Run \`rig server list\` or \`rig server use local\`.`, 1);
-  }
-  return { alias: repo.selected, connection, serverProjectRoot: repo.serverProjectRoot };
-}
-function writeRepoServerProjectRoot(projectRoot, serverProjectRoot) {
-  const repo = readRepoConnection(projectRoot);
-  if (!repo)
-    return;
-  writeRepoConnection(projectRoot, { ...repo, serverProjectRoot });
-}
-
-// packages/cli/src/commands/_server-client.ts
-var scopedGitHubBearerTokens = new Map;
-var serverPhaseListener = null;
-function reportServerPhase(label) {
-  serverPhaseListener?.(label);
-}
-function cleanToken(value) {
-  const trimmed = value?.trim();
-  return trimmed ? trimmed : null;
-}
-function readPrivateRemoteSessionToken(projectRoot) {
-  const path = resolve5(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync3(path))
-    return null;
-  try {
-    const parsed = JSON.parse(readFileSync3(path, "utf8"));
-    return cleanToken(typeof parsed.apiSessionToken === "string" ? parsed.apiSessionToken : typeof parsed.sessionToken === "string" ? parsed.sessionToken : undefined);
-  } catch {
-    return null;
-  }
-}
-function readGitHubBearerTokenForRemote(projectRoot) {
-  const scopedKey = resolve5(projectRoot);
-  if (scopedGitHubBearerTokens.has(scopedKey))
-    return scopedGitHubBearerTokens.get(scopedKey) ?? null;
-  const privateSession = readPrivateRemoteSessionToken(projectRoot);
-  if (privateSession)
-    return privateSession;
-  return cleanToken(process.env.RIG_SERVER_AUTH_TOKEN) ?? cleanToken(process.env.RIG_REMOTE_AUTH_TOKEN);
-}
-function readStoredGitHubAuthToken(projectRoot) {
-  const path = resolve5(projectRoot, ".rig", "state", "github-auth.json");
-  if (!existsSync3(path))
-    return null;
-  try {
-    const parsed = JSON.parse(readFileSync3(path, "utf8"));
-    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
-  } catch {
-    return null;
-  }
-}
-function readLocalConnectionFallbackToken(projectRoot) {
-  return readGitHubBearerTokenForRemote(projectRoot) ?? cleanToken(process.env.RIG_GITHUB_TOKEN) ?? readStoredGitHubAuthToken(projectRoot);
-}
-async function ensureServerForCli(projectRoot) {
-  try {
-    const selected = resolveSelectedConnection(projectRoot);
-    if (selected?.connection.kind === "remote") {
-      reportServerPhase(`Connecting to ${selected.alias}\u2026`);
-      const authToken = readGitHubBearerTokenForRemote(projectRoot);
-      const serverProjectRoot = selected.serverProjectRoot ?? await backfillRemoteServerProjectRoot(projectRoot, selected.connection.baseUrl, authToken);
-      return {
-        baseUrl: selected.connection.baseUrl,
-        authToken,
-        connectionKind: "remote",
-        serverProjectRoot
-      };
-    }
-    reportServerPhase("Starting local Rig server\u2026");
-    const connection = await ensureLocalRigServerConnection(projectRoot);
-    return {
-      baseUrl: connection.baseUrl,
-      authToken: connection.authToken ?? readLocalConnectionFallbackToken(projectRoot),
-      connectionKind: "local",
-      serverProjectRoot: resolve5(projectRoot)
-    };
-  } catch (error) {
-    if (error instanceof Error) {
-      throw new CliError(error.message, 1);
-    }
-    throw error;
-  }
-}
-async function backfillRemoteServerProjectRoot(projectRoot, baseUrl, authToken) {
-  const repo = readRepoConnection(projectRoot);
-  const slug = repo?.project?.trim();
-  if (!slug)
-    return null;
-  try {
-    const response = await fetch(`${baseUrl}/api/projects/${encodeURIComponent(slug)}`, {
-      headers: mergeHeaders(undefined, authToken)
-    });
-    if (!response.ok)
-      return null;
-    const payload = await response.json();
-    const project = payload.project && typeof payload.project === "object" && !Array.isArray(payload.project) ? payload.project : null;
-    const checkouts = Array.isArray(project?.checkouts) ? project.checkouts : [];
-    const latestCheckout = [...checkouts].reverse().find((entry) => Boolean(entry && typeof entry === "object" && !Array.isArray(entry) && typeof entry.path === "string"));
-    const path = typeof latestCheckout?.path === "string" && latestCheckout.path.trim() ? latestCheckout.path.trim() : null;
-    if (path)
-      writeRepoServerProjectRoot(projectRoot, path);
-    return path;
-  } catch {
-    return null;
-  }
-}
-function mergeHeaders(headers, authToken) {
-  const merged = new Headers(headers);
-  if (authToken) {
-    merged.set("authorization", `Bearer ${authToken}`);
-  }
-  return merged;
-}
-function diagnosticMessage(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload))
-    return null;
-  const record = payload;
-  const diagnostics = Array.isArray(record.diagnostics) ? record.diagnostics : [];
-  const messages = diagnostics.flatMap((entry) => {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry))
-      return [];
-    const diagnostic = entry;
-    const kind = typeof diagnostic.kind === "string" ? diagnostic.kind : "task-source";
-    const message = typeof diagnostic.message === "string" ? diagnostic.message : null;
-    return message ? [`${kind}: ${message}`] : [];
-  });
-  return messages.length > 0 ? messages.join("; ") : null;
-}
-var serverReachabilityCache = new Map;
-async function probeServerReachability(baseUrl, authToken) {
-  try {
-    const response = await fetch(`${baseUrl.replace(/\/+$/, "")}/api/server/status`, {
-      headers: mergeHeaders(undefined, authToken),
-      signal: AbortSignal.timeout(1500)
-    });
-    return response.ok;
-  } catch {
-    return false;
-  }
-}
-function cachedServerReachability(projectRoot, baseUrl, authToken) {
-  const key = resolve5(projectRoot);
-  const cached = serverReachabilityCache.get(key);
-  if (cached)
-    return cached;
-  const probe = probeServerReachability(baseUrl, authToken);
-  serverReachabilityCache.set(key, probe);
-  return probe;
-}
-function describeSelectedServer(projectRoot, server) {
-  try {
-    const selected = resolveSelectedConnection(projectRoot);
-    if (selected) {
-      return {
-        alias: selected.alias,
-        target: selected.connection.kind === "remote" ? selected.connection.baseUrl : server.baseUrl
-      };
-    }
-  } catch {}
-  return { alias: server.connectionKind === "remote" ? "remote" : "local", target: server.baseUrl };
-}
-async function buildServerFailureContext(projectRoot, server) {
-  const { alias, target } = describeSelectedServer(projectRoot, server);
-  const reachable = await cachedServerReachability(projectRoot, server.baseUrl, server.authToken);
-  const reachability = reachable ? "server is reachable" : "server is unreachable";
-  return {
-    contextLine: `Currently connected to: ${alias} at ${target} (${reachability}).`,
-    hint: "Check the selected server with `rig server status`, or switch with `rig server use <alias|local>`."
-  };
-}
-async function requestServerJson(context, pathname, init = {}) {
-  const server = await ensureServerForCli(context.projectRoot);
-  const headers = mergeHeaders(init.headers, server.authToken);
-  if (server.serverProjectRoot)
-    headers.set("x-rig-project-root", server.serverProjectRoot);
-  reportServerPhase(`${(init.method ?? "GET").toUpperCase()} ${pathname.split("?")[0]}\u2026`);
-  let response;
-  try {
-    response = await fetch(`${server.baseUrl}${pathname}`, {
-      ...init,
-      headers
-    });
-  } catch (error) {
-    const failure = await buildServerFailureContext(context.projectRoot, server);
-    throw new CliError(`Rig server request failed: ${error instanceof Error ? error.message : String(error)}
-${failure.contextLine}`, 1, { hint: failure.hint });
-  }
-  const text = await response.text();
-  const payload = text.trim().length > 0 ? (() => {
-    try {
-      return JSON.parse(text);
-    } catch {
-      return null;
-    }
-  })() : null;
-  if (!response.ok) {
-    const diagnostics = diagnosticMessage(payload);
-    const rawDetail = diagnostics ?? (text || response.statusText);
-    const detail = diagnostics ? rawDetail : rawDetail.split(`
-`).map((line) => line.trim()).find((line) => line.length > 0)?.slice(0, 200) ?? response.statusText;
-    const failure = await buildServerFailureContext(context.projectRoot, server);
-    throw new CliError(`Rig server request failed (${response.status}): ${detail}
-${failure.contextLine}`, 1, { hint: failure.hint });
-  }
-  return payload;
-}
-async function updateWorkspaceTaskViaServer(context, input) {
-  const payload = await requestServerJson(context, "/api/tasks/update", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify(input)
-  });
-  return payload && typeof payload === "object" && !Array.isArray(payload) ? payload : { ok: true };
-}
-var RESUMABLE_RUN_STATUSES = new Set([
-  "created",
-  "preparing",
-  "running",
-  "validating",
-  "reviewing",
-  "stopped",
-  "failed",
-  "needs-attention",
-  "needs_attention"
-]);
-
-// packages/cli/src/commands/task-run-driver.ts
-var PI_CANONICAL_RUN_STAGES = [
-  "Connect",
-  "GitHub/task sync",
-  "Prepare workspace",
-  "Launch Pi",
-  "Plan",
-  "Implement",
-  "Validate",
-  "Commit",
-  "Open PR",
-  "Review/CI",
-  "Merge",
-  "Complete"
-];
+import { createEnvCloseoutRunners } from "@rig/runtime/control-plane/native/closeout-runners";
+import {
+  runInProcessCloseout
+} from "@rig/runtime/control-plane/native/in-process-closeout";
+import { updateRunTaskSourceLifecycle } from "@rig/runtime/control-plane/tasks/source-lifecycle";
+var PI_CANONICAL_RUN_STAGES = ["Connect", "Prepare", "Execute", "Validate", "Review", "Publish", "Complete"];
 function canonicalPiRunStages() {
   return [...PI_CANONICAL_RUN_STAGES];
 }
-function looksLikeGitHubToken(value) {
-  const token = value?.trim();
-  if (!token)
-    return false;
-  return /^(gh[opusr]_|github_pat_)/.test(token);
-}
-function isSensitivePayloadKey(key) {
-  return /token|secret|password|authorization|credential/i.test(key);
-}
-function redactSensitivePayload(value) {
-  if (Array.isArray(value))
-    return value.map(redactSensitivePayload);
-  if (!value || typeof value !== "object")
-    return value;
-  return Object.fromEntries(Object.entries(value).map(([key, child]) => [
-    key,
-    isSensitivePayloadKey(key) && typeof child === "string" && child.trim() ? "[redacted]" : redactSensitivePayload(child)
-  ]));
-}
-function githubBridgeEnv(token) {
-  const clean = token?.trim();
-  if (!clean)
-    return {};
-  return {
-    RIG_GITHUB_TOKEN: clean,
-    GITHUB_TOKEN: clean,
-    GH_TOKEN: clean
-  };
-}
 function buildPiRigBridgeEnv(input) {
-  const githubToken = input.githubToken?.trim() || (looksLikeGitHubToken(input.authToken) ? input.authToken.trim() : "");
   return {
-    RIG_PROJECT_ROOT: input.projectRoot,
     PROJECT_RIG_ROOT: input.projectRoot,
     RIG_RUN_ID: input.runId,
-    RIG_SERVER_RUN_ID: input.runId,
-    RIG_TASK_ID: input.taskId,
-    RIG_RUNTIME_ADAPTER: "pi",
-    RIG_STEERING_POLL_MS: "0",
-    ...input.serverUrl ? { RIG_SERVER_URL: input.serverUrl } : {},
-    ...input.authToken ? { RIG_AUTH_TOKEN: input.authToken } : {},
-    ...githubBridgeEnv(githubToken)
-  };
-}
-function runGitSync(cwd, args, input) {
-  const result = spawnSync("git", [...args], {
-    cwd,
-    input,
-    encoding: "utf8",
-    stdio: input === undefined ? ["ignore", "pipe", "pipe"] : ["pipe", "pipe", "pipe"]
-  });
-  return {
-    ok: result.status === 0,
-    stdout: result.stdout || "",
-    stderr: result.stderr || (result.error instanceof Error ? result.error.message : "")
+    ...input.taskId ? { RIG_TASK_ID: input.taskId } : {},
+    ...input.runtimeMode ? { RIG_RUNTIME_MODE: input.runtimeMode } : {},
+    ...input.model ? { RIG_MODEL: input.model } : {}
   };
 }
-function copyUntrackedDirtyFiles(sourceRoot, targetRoot) {
-  const listed = runGitSync(sourceRoot, ["ls-files", "--others", "--exclude-standard", "-z"]);
-  if (!listed.ok || !listed.stdout)
+function copyTree(sourceRoot, targetRoot) {
+  if (!existsSync(sourceRoot))
     return 0;
   let copied = 0;
-  for (const relativePath of listed.stdout.split("\x00").filter(Boolean)) {
-    const sourcePath = resolve6(sourceRoot, relativePath);
-    const targetPath = resolve6(targetRoot, relativePath);
-    try {
-      if (!statSync(sourcePath).isFile())
-        continue;
-      mkdirSync2(resolve6(targetPath, ".."), { recursive: true });
-      copyFileSync(sourcePath, targetPath);
-      copied += 1;
-    } catch {}
+  for (const entry of readdirSync(sourceRoot, { withFileTypes: true })) {
+    const sourcePath = resolve(sourceRoot, entry.name);
+    const targetPath = resolve(targetRoot, entry.name);
+    if (entry.isDirectory()) {
+      mkdirSync(targetPath, { recursive: true });
+      copied += copyTree(sourcePath, targetPath);
+      continue;
+    }
+    mkdirSync(resolve(targetPath, ".."), { recursive: true });
+    copyFileSync(sourcePath, targetPath);
+    copied += 1;
   }
   return copied;
 }
 function applyDirtyBaselineSnapshot(input) {
-  const diff = runGitSync(input.sourceRoot, ["diff", "--binary", "HEAD"]);
-  if (!diff.ok) {
-    return { applied: false, copiedUntracked: 0, detail: diff.stderr || "git diff failed" };
-  }
-  let applied = false;
-  if (diff.stdout.trim()) {
-    const apply = runGitSync(input.targetRoot, ["apply", "--whitespace=nowarn", "-"], diff.stdout);
-    if (!apply.ok) {
-      return { applied: false, copiedUntracked: 0, detail: apply.stderr || "git apply failed" };
-    }
-    applied = true;
-  }
-  const copiedUntracked = copyUntrackedDirtyFiles(input.sourceRoot, input.targetRoot);
+  mkdirSync(input.targetRoot, { recursive: true });
+  const copied = copyTree(input.sourceRoot, input.targetRoot);
   return {
-    applied: applied || copiedUntracked > 0,
-    copiedUntracked,
-    detail: applied || copiedUntracked > 0 ? `Applied dirty baseline snapshot (${copiedUntracked} untracked files).` : "No dirty baseline changes to apply."
+    applied: copied > 0,
+    copiedUntracked: copied,
+    detail: copied > 0 ? `Copied ${copied} file(s) into the runtime workspace.` : "No files copied."
   };
 }
 function buildTaskRunReviewEnv(config) {
-  const review = config?.review;
   return {
-    ...review?.mode ? { AI_REVIEW_MODE: review.mode } : {},
-    ...review?.provider ? { AI_REVIEW_PROVIDER: review.provider } : {}
+    ...config?.review?.mode ? { AI_REVIEW_MODE: config.review.mode } : {},
+    ...config?.review?.provider ? { AI_REVIEW_PROVIDER: config.review.provider } : {}
   };
 }
 function buildDirtyBaselineHandshakeEnv(input) {
-  if (input.baselineMode !== "dirty-snapshot")
-    return { RIG_BASELINE_MODE: input.baselineMode ?? "head" };
   return {
-    RIG_BASELINE_MODE: "dirty-snapshot",
-    RIG_DIRTY_BASELINE_READY_FILE: resolve6(input.projectRoot, ".rig", "runs", input.runId, "dirty-baseline.ready.json")
+    RIG_DIRTY_BASELINE_MODE: input.baselineMode,
+    RIG_DIRTY_BASELINE_READY_FILE: resolve(input.projectRoot, ".rig", "state", `${input.runId}.dirty-ready`)
   };
 }
-function positiveInt(value, fallback) {
-  return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
-}
 function resolveTaskRunAutomationLimits(config, env = process.env) {
-  const configuredValidationAttempts = positiveInt(config?.automation?.maxValidationAttempts, 30);
-  const configuredPrFixIterations = positiveInt(config?.automation?.maxPrFixIterations, 100500);
+  const maxValidationAttempts = Number.parseInt(env.RIG_MAX_VALIDATION_ATTEMPTS ?? "", 10);
+  const maxPrFixIterations = Number.parseInt(env.RIG_MAX_PR_FIX_ITERATIONS ?? "", 10);
   return {
-    maxValidationAttempts: parsePositiveInt(env.RIG_TASK_RUN_MAX_ATTEMPTS, "RIG_TASK_RUN_MAX_ATTEMPTS", configuredValidationAttempts),
-    maxPrFixIterations: configuredPrFixIterations
+    maxValidationAttempts: Number.isFinite(maxValidationAttempts) && maxValidationAttempts > 0 ? maxValidationAttempts : config?.automation?.maxValidationAttempts ?? 30,
+    maxPrFixIterations: Number.isFinite(maxPrFixIterations) && maxPrFixIterations > 0 ? maxPrFixIterations : config?.automation?.maxPrFixIterations ?? 100500
   };
 }
 function classifyPlanningNeed(input) {
-  const planning = input.config?.planning ?? {};
-  const mode = planning.mode ?? "auto";
-  const labels = new Set((input.sourceTask?.labels ?? []).map((label) => label.trim().toLowerCase()).filter(Boolean));
-  const requireLabels = planning.requireForLabels ?? ["needs-plan", "epic", "large", "risk:high"];
-  const skipLabels = planning.skipForLabels ?? ["no-plan", "small", "trivial"];
-  const bodyLength = `${input.sourceTask?.description ?? ""}
-${input.sourceTask?.body ?? ""}
-${input.sourceTask?.acceptanceCriteria ?? input.sourceTask?.acceptance_criteria ?? ""}`.trim().length;
-  const forcedLabel = requireLabels.find((label) => labels.has(label.toLowerCase()));
-  const skippedLabel = skipLabels.find((label) => labels.has(label.toLowerCase()));
-  const highRisk = labels.has("risk:high") || labels.has("security") || labels.has("migration");
-  const size = labels.has("large") || bodyLength > 4000 ? "large" : bodyLength > 1000 ? "medium" : "small";
-  const risk = highRisk ? "high" : labels.has("risk:medium") || size !== "small" ? "medium" : "low";
-  if (mode === "always") {
-    return { planningRequired: true, size, risk, reason: "planning.mode=always", policy: "always" };
-  }
-  if (mode === "off") {
-    return { planningRequired: false, size, risk, reason: "planning.mode=off", policy: "off" };
-  }
-  if (forcedLabel) {
-    return { planningRequired: true, size, risk, reason: `label:${forcedLabel}`, policy: "auto" };
-  }
-  if (skippedLabel && !highRisk) {
-    return { planningRequired: false, size, risk, reason: `label:${skippedLabel}`, policy: "auto" };
-  }
-  const planningRequired = size !== "small" || risk === "high";
-  return {
-    planningRequired,
-    size,
-    risk,
-    reason: planningRequired ? `auto:${size}/${risk}` : "auto:small/low",
-    policy: "auto"
-  };
+  const text = `${input.prompt}
+${input.acceptanceCriteria ?? ""}`.toLowerCase();
+  const needsPlanning = /plan|design|approach|architecture|multi-step/.test(text);
+  return { needsPlanning, reason: needsPlanning ? "operator requested a planning pass" : "no planning trigger detected" };
 }
 function buildPiValidationRetrySteeringPrompt(input) {
   return [
-    `Retry attempt ${input.attempt + 1}/${input.maxAttempts} for task ${input.taskId}.`,
-    "The previous attempt failed Rig validation. Continue from the existing runtime workspace and PR state instead of starting over.",
-    "",
-    `Latest blocker: ${input.failureDetail}`,
-    ...input.validationOutput?.trim() ? ["", "Validation output:", input.validationOutput.trim()] : [],
-    "",
-    "Fix the concrete failure, rerun the relevant validation, and only report completion when the task is accepted."
+    `Validation failed on attempt ${input.attempt}${input.taskId ? ` for task ${input.taskId}` : ""}.`,
+    input.failureDetail.trim(),
+    "Fix the issue, rerun validation, and continue only after it passes."
   ].join(`
+
 `);
 }
 function classifyValidationRetryOutcome(input) {
   return {
     stage: "Validate failed",
-    status: input.attempt >= input.maxAttempts ? "needs_attention" : "retry",
+    status: input.attempt < input.maxAttempts ? "retry" : "needs_attention",
     failureDetail: input.failureDetail
   };
 }
-function configuredIssueUpdatesMode(config) {
-  const github = config?.github;
-  const mode = github && typeof github === "object" && !Array.isArray(github) ? github.issueUpdates : null;
-  return mode === "off" || mode === "minimal" || mode === "lifecycle" ? mode : "lifecycle";
-}
-function shouldWriteDriverIssueUpdate(config, status) {
-  const mode = configuredIssueUpdatesMode(config);
-  if (mode === "off")
-    return false;
-  if (mode === "lifecycle")
-    return true;
-  return ["closed", "failed", "needs_attention"].includes(status);
-}
-async function loadTaskRunAutomationConfig(projectRoot) {
-  try {
-    return await loadConfig(projectRoot);
-  } catch {
-    return null;
-  }
-}
 function taskRunStageLogId(runId, stage) {
   return `log:${runId}:stage:${stage.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`;
 }
-function appendPiStageLog(input) {
-  appendRunLog(input.projectRoot, input.runId, {
-    id: taskRunStageLogId(input.runId, input.stage),
-    title: input.stage,
-    detail: input.detail ?? null,
-    tone: input.tone ?? "info",
-    status: input.status ?? "running",
-    createdAt: new Date().toISOString()
-  });
-  emitServerRunEvent({ type: "log", runId: input.runId, title: input.stage });
-}
-function createCommandRunner(binary) {
-  return async (args, options) => {
-    const child = spawn(binary, [...args], {
-      cwd: options?.cwd,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    const stdoutChunks = [];
-    const stderrChunks = [];
-    child.stdout.on("data", (chunk) => stdoutChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
-    child.stderr.on("data", (chunk) => stderrChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
-    return await new Promise((resolve7) => {
-      child.once("error", (error) => resolve7({ exitCode: 1, stderr: error.message }));
-      child.once("close", (code) => resolve7({
-        exitCode: code ?? 1,
-        stdout: Buffer.concat(stdoutChunks).toString("utf8"),
-        stderr: Buffer.concat(stderrChunks).toString("utf8")
-      }));
-    });
-  };
-}
-async function resolvePostValidationBranch(input) {
-  if (!input.configuredBranch.startsWith("task-")) {
-    return input.configuredBranch;
-  }
-  const current = await input.gitCommand(["rev-parse", "--abbrev-ref", "HEAD"], { cwd: input.workspace });
-  const currentBranch = current.stdout?.trim();
-  if (current.exitCode === 0 && currentBranch && currentBranch !== "HEAD") {
-    return currentBranch;
-  }
-  return input.configuredBranch;
-}
-async function runTaskRunPostValidationLifecycle(input) {
-  const taskId = input.taskId?.trim();
-  if (!taskId) {
-    return { status: "skipped" };
-  }
-  const configInput = input.config ?? null;
-  const config = configInput ?? {};
-  const prMode = configInput ? configInput.pr?.mode ?? "auto" : "off";
-  if (prMode === "off" || prMode === "ask") {
-    input.appendStage?.("Open PR", prMode === "off" ? "PR automation disabled by pr.mode=off." : "PR creation awaiting operator approval by pr.mode=ask.", "skipped", "info");
-    input.appendStage?.("Complete", "Validation completed; no PR was opened and the issue was left open.", "completed", "info");
-    return { status: "skipped" };
-  }
-  const workspace = input.runtimeWorkspace || input.projectRoot;
-  const ghCommand = input.ghCommand ?? createCommandRunner("gh");
-  const gitCommand = input.gitCommand ?? createCommandRunner("git");
-  const configuredBranch = input.branch || `rig/${input.runtimeTaskId}-${input.runId}`;
-  const branch = await resolvePostValidationBranch({
-    workspace,
-    configuredBranch,
-    gitCommand
-  });
-  const prAutomation = input.prAutomation ?? runPrAutomation;
-  const updateTaskSource = input.updateTaskSource ?? updateTaskSourceWithProjectSync;
-  const stage = input.appendStage ?? (() => {
-    return;
-  });
-  const steerPi = input.steerPi ?? (async (message) => {
-    appendRunLog(input.projectRoot, input.runId, {
-      id: `log:${input.runId}:pr-steering:${Date.now()}`,
-      title: "Steering Pi from PR feedback",
-      detail: message,
-      tone: "info",
-      status: "reviewing",
-      createdAt: new Date().toISOString()
-    });
-    emitServerRunEvent({ type: "log", runId: input.runId, title: "Steering Pi from PR feedback" });
-  });
-  stage("Commit", `Committing changes in ${workspace}.`, "running", "tool");
-  const commit = await commitRunChanges({
-    cwd: workspace,
-    message: `rig: complete task ${taskId}`,
-    command: gitCommand
-  });
-  stage("Commit", commit.committed ? "Committed run workspace changes." : "No workspace changes to commit.", "completed", "tool");
-  await pushBranchSyncedWithOrigin({ projectRoot: workspace, branch, gitCommand });
-  stage("Open PR", `Opening PR from ${branch}.`, "running", "tool");
-  const pr = await prAutomation({
-    projectRoot: workspace,
-    taskId,
-    runId: input.runId,
-    branch,
-    config,
-    sourceTask: input.sourceTask,
-    uploadedSnapshot: input.uploadedSnapshot,
-    artifactRoot: resolve6(input.projectRoot, "artifacts", taskId),
-    command: ghCommand,
-    gitCommand,
-    steerPi,
-    lifecycle: {
-      onPrOpened: async ({ prUrl }) => {
-        stage("Open PR", prUrl, "completed", "tool");
-        try {
-          if (shouldWriteDriverIssueUpdate(config, "under_review")) {
-            await updateTaskSource(input.projectRoot, {
-              taskId,
-              sourceTask: runSourceTaskIdentity(input.sourceTask),
-              update: {
-                status: "under_review",
-                comment: buildTaskRunLifecycleComment({
-                  runId: input.runId,
-                  status: "under_review",
-                  summary: "Rig opened a pull request for this task.",
-                  runtimeWorkspace: input.runtimeWorkspace ?? null
-                })
-              }
-            });
-          }
-        } catch (error) {
-          appendRunLog(input.projectRoot, input.runId, {
-            id: `log:${input.runId}:task-source-under-review-update`,
-            title: "Task source PR status update failed",
-            detail: error instanceof Error ? error.message : String(error),
-            tone: "error",
-            status: "reviewing",
-            createdAt: new Date().toISOString()
-          });
-        }
-      },
-      onReviewCiStarted: ({ prUrl, iteration }) => stage("Review/CI", `${prUrl} (iteration ${iteration})`, "running", "info"),
-      onFeedback: async ({ feedback }) => {
-        stage("Review/CI", feedback.join(`
-`), "reviewing", "error");
-        if (shouldWriteDriverIssueUpdate(config, "ci_fixing")) {
-          await updateTaskSource(input.projectRoot, {
-            taskId,
-            sourceTask: runSourceTaskIdentity(input.sourceTask),
-            update: {
-              status: "ci_fixing",
-              comment: buildTaskRunLifecycleComment({
-                runId: input.runId,
-                status: "ci_fixing",
-                summary: "Rig is fixing CI/review feedback for this task.",
-                runtimeWorkspace: input.runtimeWorkspace ?? null
-              })
-            }
-          });
-        }
-      },
-      onMergeStarted: async ({ prUrl }) => {
-        stage("Merge", prUrl, "running", "tool");
-        if (shouldWriteDriverIssueUpdate(config, "merging")) {
-          await updateTaskSource(input.projectRoot, {
-            taskId,
-            sourceTask: runSourceTaskIdentity(input.sourceTask),
-            update: {
-              status: "merging",
-              comment: buildTaskRunLifecycleComment({
-                runId: input.runId,
-                status: "merging",
-                summary: "Rig is merging the pull request for this task.",
-                runtimeWorkspace: input.runtimeWorkspace ?? null
-              })
-            }
-          });
-        }
-      },
-      onMerged: ({ prUrl }) => stage("Merge", prUrl, "completed", "tool")
-    }
-  });
-  if (pr.status === "opened" && pr.prUrl) {
-    stage("Complete", `PR ready without merge: ${pr.prUrl}`, "completed", "info");
-    return { status: "completed", pr };
-  }
-  if (pr.status !== "merged" || !pr.prUrl) {
-    const detail = pr.actionableFeedback.join(`
-`) || "PR automation did not merge the PR.";
-    stage("Needs attention", detail, "needs_attention", "error");
-    if (shouldWriteDriverIssueUpdate(config, "needs_attention")) {
-      await updateTaskSource(input.projectRoot, {
-        taskId,
-        sourceTask: runSourceTaskIdentity(input.sourceTask),
-        update: {
-          status: "needs_attention",
-          comment: buildTaskRunLifecycleComment({
-            runId: input.runId,
-            status: "needs_attention",
-            summary: "Rig needs operator attention before this task can proceed.",
-            runtimeWorkspace: input.runtimeWorkspace ?? null,
-            errorText: detail
-          })
-        }
-      }).catch((error) => {
-        try {
-          appendRunLog(input.projectRoot, input.runId, {
-            id: `log:${input.runId}:task-source-needs-attention-update`,
-            title: "Task source needs-attention update failed",
-            detail: error instanceof Error ? error.message : String(error),
-            tone: "error",
-            status: "needs_attention",
-            createdAt: new Date().toISOString()
-          });
-        } catch {}
-      });
-    }
-    return { status: "needs_attention", pr };
-  }
-  if (shouldWriteDriverIssueUpdate(config, "closed")) {
-    await closeIssueAfterMergedPr({
-      projectRoot: input.projectRoot,
-      taskId,
-      runId: input.runId,
-      prUrl: pr.prUrl,
-      sourceTask: input.sourceTask,
-      updateTaskSource: async (projectRoot, closeInput) => updateTaskSource(projectRoot, closeInput)
-    });
-  }
-  stage("Complete", `PR merged and issue closed: ${pr.prUrl}`, "completed", "info");
-  return { status: "completed", pr };
-}
-function summarizeValidationFailure(projectRoot, taskId) {
-  if (!taskId) {
-    return null;
-  }
-  for (const artifactDir of resolveTaskArtifactDirs(projectRoot, taskId)) {
-    const summary = readJsonFile2(resolve6(artifactDir, "validation-summary.json"), null);
-    if (!summary || summary.status !== "fail") {
-      continue;
-    }
-    const failedCategories = Array.isArray(summary.categories) ? summary.categories.filter((entry) => String(entry?.status ?? "") !== "pass").map((entry) => String(entry?.category ?? "").trim()).filter(Boolean) : [];
-    if (failedCategories.length > 0) {
-      return `Task validation failed: ${failedCategories.join(", ")}`;
-    }
-    return "Task validation failed.";
-  }
-  return null;
-}
-function classifyCompletionVerificationLine(line) {
-  const trimmed = line.trim();
-  if (/^=== Completion Verification: /.test(trimmed)) {
-    return { isCompletionLine: true, isVerifierReview: false };
-  }
-  if (/^\[\d+\/\d+\]/.test(trimmed)) {
-    return {
-      isCompletionLine: true,
-      isVerifierReview: /Verifier review/i.test(trimmed)
-    };
-  }
-  return { isCompletionLine: false, isVerifierReview: false };
-}
 function createRunLogIdFactory(runId) {
-  let sequence = 0;
-  return () => {
-    sequence += 1;
-    return `log:${runId}:${Date.now()}:${sequence}`;
-  };
+  let next = 0;
+  return () => `${runId}:log:${++next}`;
 }
 function summarizeTaskRunProcessFailure(input) {
-  const fallback = `Task run failed (${String(input.exitCode ?? "unknown")}${input.signal ? ` ${input.signal}` : ""})`;
-  const stderrLines = input.stderrLines ?? [];
-  const meaningfulLines = [...stderrLines].map((line) => line.trim()).filter(Boolean).filter((line) => !/^Task run failed \([^)]*\)$/i.test(line));
-  const taskSourceFailure = meaningfulLines.find((line) => /failed to update task source/i.test(line));
-  if (taskSourceFailure) {
-    return `Task source update failed: ${taskSourceFailure}`;
-  }
-  const moduleFailure = meaningfulLines.find((line) => /cannot find module/i.test(line));
-  if (moduleFailure) {
-    return `Runtime module resolution failed: ${moduleFailure}`;
-  }
-  for (const line of [...meaningfulLines].reverse()) {
-    const trimmed = line.trim();
-    if (/server-managed task run cannot finish successfully/i.test(trimmed)) {
-      return `Task source remained open: ${trimmed}`;
-    }
-    if (/no api key found/i.test(trimmed)) {
-      return `Missing provider credentials: ${trimmed}`;
-    }
-    if (/no claude credentials found/i.test(trimmed)) {
-      return `Missing provider credentials: ${trimmed}`;
-    }
-    if (/unauthorized|authentication failed|invalid api key|api key is invalid/i.test(trimmed)) {
-      return `Provider authentication failed: ${trimmed}`;
-    }
-    if (/command not found|no such file or directory|enoent/i.test(trimmed)) {
-      return `Missing runtime executable: ${trimmed}`;
-    }
-    if (/bubblewrap|\bbwrap\b|sandbox-exec|sandbox/i.test(trimmed) && /missing|not found|failed|denied/i.test(trimmed)) {
-      return `Sandbox backend unavailable: ${trimmed}`;
-    }
-  }
-  return fallback;
+  const detail = [input.stderr?.trim(), input.stdout?.trim()].filter(Boolean)[0];
+  return `${input.stage} failed${input.exitCode !== null && input.exitCode !== undefined ? ` (exit ${input.exitCode})` : ""}${detail ? `: ${detail}` : input.fallback ? `: ${input.fallback}` : ""}`;
 }
-function parsePositiveInt(value, option, fallback) {
-  if (!value) {
-    return fallback;
-  }
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isFinite(parsed) || parsed <= 0) {
-    throw new CliError(`Invalid ${option} value: ${value}`, 1, { hint: `Pass a positive integer, e.g. \`${option} 10\`.` });
+function classifyCompletionVerificationLine(line) {
+  if (line.startsWith("=== Completion Verification:")) {
+    return { isCompletionLine: true, stage: line.replace(/^=== Completion Verification:\s*/, "").replace(/\s*=+$/, "").trim(), status: "started" };
   }
-  return parsed;
+  if (/^PASS\b/.test(line))
+    return { isCompletionLine: true, stage: null, status: "passed" };
+  if (/^FAIL\b/.test(line))
+    return { isCompletionLine: true, stage: null, status: "failed" };
+  return { isCompletionLine: false, stage: null, status: null };
 }
 function readTaskRunAcceptedArtifactState(input) {
-  if (!input.taskId || !input.workspaceDir) {
-    return { accepted: false, reason: null };
-  }
-  const artifactDir = resolve6(input.workspaceDir, "artifacts", input.taskId);
-  const reviewStatusPath = resolve6(artifactDir, "review-status.txt");
-  const taskResultPath = resolve6(artifactDir, "task-result.json");
-  const reviewStatus = readTaskRunReviewStatus(reviewStatusPath);
-  if (reviewStatus !== "APPROVED") {
+  if (!existsSync(input.artifactPath))
     return { accepted: false, reason: null };
-  }
-  const taskResult = readJsonFile2(taskResultPath, null);
-  if (taskResult?.status !== "completed") {
-    return { accepted: false, reason: null };
-  }
-  if (typeof input.artifactNotBeforeMs === "number" && Number.isFinite(input.artifactNotBeforeMs)) {
-    try {
-      const reviewStatusMtime = statSync(reviewStatusPath).mtimeMs;
-      if (reviewStatusMtime + 1000 < input.artifactNotBeforeMs) {
-        return { accepted: false, reason: null };
-      }
-    } catch {
-      return { accepted: false, reason: null };
-    }
-  }
-  return {
-    accepted: true,
-    reason: `task-result.json is completed and review-status.txt is APPROVED for task ${input.taskId}`
-  };
-}
-function resolvePiAcceptedArtifactExitGraceMs(env = process.env) {
-  const raw = env.RIG_PI_ACCEPTED_ARTIFACT_EXIT_GRACE_MS;
-  if (raw === undefined || raw.trim() === "")
-    return 30000;
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isFinite(parsed) || parsed < 0)
-    return 30000;
-  return parsed;
-}
-function resolveTaskRunRetryContext(input) {
-  if (!input.taskId || !input.workspaceDir) {
-    return { shouldRetry: false, failureDetail: null, nextPrompt: null };
-  }
-  const artifactDir = resolve6(input.workspaceDir, "artifacts", input.taskId);
-  const reviewStatePath = resolve6(artifactDir, "review-state.json");
-  const reviewFeedbackPath = resolve6(artifactDir, "review-feedback.md");
-  const reviewStatusPath = resolve6(artifactDir, "review-status.txt");
-  const failedApproachesPath = resolve6(input.workspaceDir, ".rig", "state", "failed_approaches.md");
-  const validationSummaryPath = resolve6(artifactDir, "validation-summary.json");
-  const reviewState = readJsonFile2(reviewStatePath, null);
-  const reviewStatus = readTaskRunReviewStatus(reviewStatusPath);
-  const reviewRejected = isTaskRunReviewRejected(reviewState);
-  if (reviewStatus === "APPROVED") {
-    return { shouldRetry: false, failureDetail: null, nextPrompt: null };
-  }
-  if (reviewStatus !== "REJECTED" && !reviewRejected) {
-    return { shouldRetry: false, failureDetail: null, nextPrompt: null };
-  }
-  const failureDetail = summarizeTaskRunReviewFailure(reviewState);
-  if (input.attempt >= input.maxAttempts) {
-    return { shouldRetry: false, failureDetail, nextPrompt: null };
-  }
-  return {
-    shouldRetry: true,
-    failureDetail,
-    nextPrompt: [
-      input.basePrompt,
-      "",
-      `Retry attempt ${input.attempt + 1}/${input.maxAttempts} for task ${input.taskId}.`,
-      "The previous attempt did not satisfy completion verification. Continue from the existing runtime workspace and PR state instead of starting over.",
-      "",
-      `Latest blocker: ${failureDetail}`,
-      "",
-      "Inspect these artifacts first:",
-      `- ${reviewStatusPath}`,
-      `- ${reviewStatePath}`,
-      `- ${reviewFeedbackPath}`,
-      `- ${failedApproachesPath}`,
-      `- ${validationSummaryPath}`,
-      "",
-      "Resolve the concrete issues recorded there, refresh the task artifacts if needed, rerun validation and completion verification, and do not stop until the task is actually accepted. When Greptile review is required, keep iterating until the review verdict is APPROVE with no unresolved comments."
-    ].join(`
-`)
-  };
-}
-function summarizeTaskRunReviewFailure(reviewState) {
-  if (!reviewState) {
-    return "Completion verification rejected the task. Read review-feedback.md for required fixes.";
-  }
-  const reasons = [
-    ...reviewState.local_reasons ?? [],
-    ...reviewState.ai_reasons ?? [],
-    ...reviewState.ai_warnings ?? []
-  ].map((value) => value.trim()).filter(Boolean);
-  if (reasons.length > 0) {
-    return reasons[0];
-  }
-  if (reviewState.mode === "required" && reviewState.verdict && reviewState.verdict !== "APPROVE") {
-    return `[AI Review] Required mode needs a completed Greptile approval; current verdict is ${reviewState.verdict}.`;
-  }
-  return "Completion verification rejected the task. Read review-feedback.md for required fixes.";
-}
-function appendAssistantTimelineFromRecord(input) {
-  let nextAssistantText = input.assistantText;
-  if (input.record.type === "message_update") {
-    const assistantMessageEvent = input.record.assistantMessageEvent && typeof input.record.assistantMessageEvent === "object" ? input.record.assistantMessageEvent : null;
-    if (assistantMessageEvent?.type === "text_delta" && typeof assistantMessageEvent.delta === "string") {
-      nextAssistantText += assistantMessageEvent.delta;
-    }
-  } else if (input.record.type === "stream_event") {
-    const event = input.record.event && typeof input.record.event === "object" ? input.record.event : null;
-    const delta = event?.delta && typeof event.delta === "object" ? event.delta : null;
-    if (delta?.type === "text_delta" && typeof delta.text === "string") {
-      nextAssistantText += delta.text;
-    }
-  } else if (input.record.type === "assistant") {
-    const message = input.record.message && typeof input.record.message === "object" ? input.record.message : input.record;
-    const content = Array.isArray(message.content) ? message.content : [];
-    const fullText = content.map((entry) => entry && typeof entry === "object" && entry.type === "text" ? String(entry.text ?? "") : "").join("");
-    if (fullText.length > nextAssistantText.length)
-      nextAssistantText = fullText;
-  }
-  if (nextAssistantText !== input.assistantText) {
-    appendRunTimeline(input.projectRoot, input.runId, {
-      id: input.messageId,
-      type: "assistant_message",
-      text: nextAssistantText,
-      state: "streaming",
-      createdAt: new Date().toISOString()
-    });
-  }
-  return nextAssistantText;
-}
-function appendPiRpcProtocolLogFromRecord(input) {
-  const type = typeof input.record.type === "string" ? input.record.type : "";
-  if (type === "response") {
-    const command = typeof input.record.command === "string" ? input.record.command : "rpc";
-    const success = input.record.success !== false;
-    if (success && command !== "prompt" && command !== "steer" && command !== "follow_up" && command !== "set_session_name") {
-      return true;
-    }
-    appendRunLog(input.projectRoot, input.runId, {
-      id: input.nextRunLogId(),
-      title: success ? "Pi RPC response" : "Pi RPC error",
-      detail: success ? `${command}: accepted` : `${command}: ${String(input.record.error ?? "failed")}`,
-      tone: success ? "tool" : "error",
-      status: input.status,
-      payload: input.record,
-      createdAt: new Date().toISOString()
-    });
-    emitServerRunEvent({ type: "log", runId: input.runId, title: success ? "Pi RPC response" : "Pi RPC error" });
-    return true;
-  }
-  if (type !== "extension_ui_request")
-    return false;
-  const method = typeof input.record.method === "string" ? input.record.method : "ui";
-  let title = "Pi UI event";
-  let detail = method;
-  let tone = "info";
-  if (method === "notify") {
-    title = "Pi notification";
-    detail = String(input.record.message ?? "");
-    tone = input.record.notifyType === "error" ? "error" : "info";
-  } else if (method === "setStatus") {
-    title = "Pi UI status";
-    detail = `${String(input.record.statusKey ?? "status")}: ${String(input.record.statusText ?? "cleared")}`;
-    tone = "tool";
-  } else if (method === "setWidget") {
-    title = "Pi UI widget";
-    const lines = Array.isArray(input.record.widgetLines) ? input.record.widgetLines.map((line) => String(line)).join(" | ") : "cleared";
-    detail = `${String(input.record.widgetKey ?? "widget")}: ${lines}`.slice(0, 500);
-    tone = "tool";
-  } else if (method === "setTitle") {
-    title = "Pi UI title";
-    detail = String(input.record.title ?? "");
-    tone = "tool";
-  } else if (method === "set_editor_text") {
-    title = "Pi editor update";
-    detail = String(input.record.text ?? "").slice(0, 500);
-    tone = "tool";
-  } else {
-    title = "Pi UI request";
-    detail = `${method}: ${String(input.record.title ?? input.record.message ?? "")}`.trim();
-  }
-  appendRunLog(input.projectRoot, input.runId, {
-    id: input.nextRunLogId(),
-    title,
-    detail,
-    tone,
-    status: input.status,
-    payload: input.record,
-    createdAt: new Date().toISOString()
-  });
-  emitServerRunEvent({ type: "log", runId: input.runId, title });
-  return true;
-}
-function appendPiToolTimelineFromRecord(input) {
-  const type = typeof input.record.type === "string" ? input.record.type : "";
-  if (type !== "tool_execution_start" && type !== "tool_execution_update" && type !== "tool_execution_end")
-    return false;
-  const toolCallId = typeof input.record.toolCallId === "string" && input.record.toolCallId.trim() ? input.record.toolCallId.trim() : `${Date.now()}`;
-  const toolName = typeof input.record.toolName === "string" && input.record.toolName.trim() ? input.record.toolName.trim() : "tool";
-  const result = input.record.result && typeof input.record.result === "object" && !Array.isArray(input.record.result) ? input.record.result : null;
-  appendRunTimeline(input.projectRoot, input.runId, {
-    id: `tool:${toolCallId}:${type}`,
-    type,
-    toolName,
-    status: type === "tool_execution_end" ? input.record.isError === true || result?.isError === true ? "failed" : "completed" : "running",
-    createdAt: new Date().toISOString()
-  });
-  return true;
-}
-function isNonRenderablePiProtocolRecord(record) {
-  const type = typeof record.type === "string" ? record.type : "";
-  return type === "pi.event" || type === "status.update" || type === "activity.update" || type === "ready" || type === "agent_start" || type === "agent_end" || type === "message_start" || type === "message_end" || type === "turn_start" || type === "turn_end" || type === "tool_result" || type === "message_update" && (!record.assistantMessageEvent || typeof record.assistantMessageEvent !== "object" || Array.isArray(record.assistantMessageEvent) || record.assistantMessageEvent.type !== "text_delta");
-}
-function appendToolTimelineFromLog(input) {
-  const title = typeof input.log.title === "string" ? input.log.title : "";
-  if (title !== "Tool activity")
-    return;
-  const payload = input.log.payload && typeof input.log.payload === "object" && !Array.isArray(input.log.payload) ? input.log.payload : {};
-  const toolName = typeof payload.toolName === "string" && payload.toolName.trim() ? payload.toolName.trim() : typeof payload.tool_name === "string" && payload.tool_name.trim() ? payload.tool_name.trim() : null;
-  const logId = typeof input.log.id === "string" && input.log.id.trim() ? input.log.id.trim() : `${Date.now()}`;
-  appendRunTimeline(input.projectRoot, input.runId, {
-    id: `tool:${logId}`,
-    type: "tool_execution_update",
-    toolName,
-    status: typeof input.log.status === "string" ? input.log.status : "running",
-    detail: typeof input.log.detail === "string" ? input.log.detail : null,
-    payload,
-    createdAt: typeof input.log.createdAt === "string" ? input.log.createdAt : new Date().toISOString()
-  });
-}
-function readTaskRunReviewStatus(reviewStatusPath) {
-  if (!existsSync4(reviewStatusPath)) {
-    return null;
-  }
   try {
-    const status = readFileSync4(reviewStatusPath, "utf8").trim().toUpperCase();
-    return status === "APPROVED" || status === "REJECTED" ? status : null;
+    const parsed = JSON.parse(readFileSync(input.artifactPath, "utf8"));
+    return {
+      accepted: parsed.accepted === true,
+      reason: typeof parsed.reason === "string" ? parsed.reason : null
+    };
   } catch {
-    return null;
-  }
-}
-function isTaskRunReviewRejected(reviewState) {
-  if (!reviewState) {
-    return false;
-  }
-  if (reviewState.approved === false) {
-    return true;
+    return { accepted: false, reason: null };
   }
-  return reviewState.mode === "required" && !!reviewState.verdict && reviewState.verdict !== "APPROVE";
 }
-function runSourceTaskIdentity(sourceTask) {
-  return sourceTask;
-}
-function sourceTaskIssueNodeId(sourceTask) {
-  if (!sourceTask || typeof sourceTask !== "object" || Array.isArray(sourceTask))
-    return null;
-  const record = sourceTask;
-  const direct = typeof record.issueNodeId === "string" ? record.issueNodeId : typeof record.nodeId === "string" ? record.nodeId : typeof record.node_id === "string" ? record.node_id : null;
-  if (direct?.trim())
-    return direct.trim();
-  const raw = record.raw && typeof record.raw === "object" && !Array.isArray(record.raw) ? record.raw : null;
-  return typeof raw?.id === "string" && raw.id.trim() ? raw.id.trim() : null;
-}
-var updateTaskSourceWithProjectSync = async (projectRoot, input) => {
-  const serverResult = await updateWorkspaceTaskViaServer({ projectRoot }, {
-    id: input.taskId,
-    ...input.update.status ? { status: input.update.status } : {},
-    ...input.update.comment ? { comment: input.update.comment } : {},
-    ...input.update.title ? { title: input.update.title } : {},
-    ...typeof input.update.body === "string" ? { body: input.update.body } : {},
-    issueNodeId: sourceTaskIssueNodeId(input.sourceTask)
-  });
-  if (serverResult.ok === false) {
-    throw new Error(typeof serverResult.error === "string" ? serverResult.error : "Rig server task update failed.");
-  }
-  return {
-    updated: serverResult.ok !== false,
-    taskId: input.taskId,
-    status: input.update.status,
-    source: "server",
-    sourceKind: "server",
-    projectSync: serverResult.projectSync
-  };
-};
-async function updateTaskSourceAfterDriverRun(projectRoot, runId, taskId, sourceTask, status, summary, input, updateTaskSource = updateTaskSourceWithProjectSync) {
+async function runTaskRunPostValidationLifecycle(input) {
+  const projectRoot = cleanString(input.projectRoot) ?? process.cwd();
+  const runId = cleanString(input.runId) ?? "run";
+  const taskId = cleanString(input.runtimeTaskId) ?? cleanString(input.taskId);
   if (!taskId)
-    return;
-  const config = await loadTaskRunAutomationConfig(projectRoot);
-  if (!shouldWriteDriverIssueUpdate(config, status))
-    return;
-  const result = await updateTaskSource(projectRoot, {
+    throw new Error("Task run post-validation lifecycle requires a task id.");
+  const workspace = cleanString(input.runtimeWorkspace) ?? cleanString(input.workspace) ?? projectRoot;
+  const branch = cleanString(input.branch) ?? `rig/${taskId}-${runId}`;
+  const config = input.config && typeof input.config === "object" && !Array.isArray(input.config) ? input.config : {};
+  const sourceTask = input.sourceTask && typeof input.sourceTask === "object" && !Array.isArray(input.sourceTask) ? input.sourceTask : null;
+  const runners = createEnvCloseoutRunners(process.env);
+  const appendStage = typeof input.appendStage === "function" ? input.appendStage : null;
+  const result = await runInProcessCloseout({
+    projectRoot,
+    runId,
     taskId,
-    sourceTask: runSourceTaskIdentity(sourceTask),
-    update: {
-      status,
-      comment: buildTaskRunLifecycleComment({
-        runId,
-        status,
-        summary,
-        runtimeWorkspace: input.latestRuntimeWorkspace,
-        logsDir: input.latestLogsDir,
-        sessionDir: input.latestSessionDir,
-        errorText: input.errorText
-      })
-    }
-  });
-  if (!result.updated && (result.source === "plugin" || result.sourceKind)) {
-    throw new Error(`Configured task source${result.sourceKind ? ` (${result.sourceKind})` : ""} did not accept lifecycle update for ${result.taskId}.`);
-  }
-}
-function readRunSourceTaskContract(projectRoot, runId, taskId) {
-  const run = readAuthorityRun3(projectRoot, runId);
-  const raw = run?.sourceTask;
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    return null;
-  }
-  const record = raw;
-  const id = typeof record.id === "string" && record.id.trim() ? record.id.trim() : taskId?.trim();
-  if (!id) {
-    return null;
-  }
-  return {
-    id,
-    ...optionalStringField(record, "title"),
-    ...optionalStringField(record, "description"),
-    ...optionalStringField(record, "body"),
-    ...optionalStringField(record, "acceptanceCriteria"),
-    ...optionalStringField(record, "acceptance_criteria"),
-    ...optionalStringField(record, "sourceIssueId"),
-    ...optionalStringField(record, "status"),
-    ...optionalStringField(record, "issueType"),
-    ...optionalStringField(record, "role"),
-    ...optionalStringField(record, "externalRef"),
-    scope: stringArrayField(record, "scope"),
-    validation: stringArrayField(record, "validation"),
-    validators: stringArrayField(record, "validators"),
-    labels: stringArrayField(record, "labels")
-  };
-}
-function optionalStringField(record, key) {
-  const value = record[String(key)];
-  return typeof value === "string" ? { [key]: value } : {};
-}
-function stringArrayField(record, key) {
-  const value = record[key];
-  return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
-}
-async function executeRigOwnedTaskRun(context, input) {
-  process.stdout.on("error", () => {});
-  process.stderr.on("error", () => {});
-  configureRunEventSink(context.projectRoot);
-  const runtimeTaskId = input.taskId?.trim() || `adhoc-${input.runId}`;
-  const existingRunRecord = readAuthorityRun3(context.projectRoot, input.runId);
-  const resumeMode = process.env.RIG_RUN_RESUME === "1";
-  let latestPiSessionId = typeof existingRunRecord?.piSession?.sessionId === "string" && existingRunRecord.piSession.sessionId.trim() ? existingRunRecord.piSession.sessionId : null;
-  const sessionAnchor = () => latestPiSessionId ? { sessionId: latestPiSessionId } : {};
-  const resumePreviousStatus = String(existingRunRecord?.status ?? "").toLowerCase();
-  const sourceTask = readRunSourceTaskContract(context.projectRoot, input.runId, input.taskId);
-  let prompt = buildRunPrompt({
-    projectRoot: context.projectRoot,
-    taskId: input.taskId,
-    fallbackTitle: input.title,
-    fallbackDescription: sourceTask?.description ?? sourceTask?.body ?? null,
-    fallbackAcceptanceCriteria: sourceTask?.acceptanceCriteria ?? sourceTask?.acceptance_criteria ?? null,
+    branch,
+    workspace,
+    artifactRoot: cleanString(input.artifactRoot),
+    config,
     sourceTask,
-    initialPrompt: input.initialPrompt,
-    runtimeAdapter: input.runtimeAdapter
-  });
-  const startedAt = new Date().toISOString();
-  const hostAgentBinary = await resolvePreferredShellBinary(context.projectRoot);
-  const baseAgentArgs = input.runtimeAdapter === "codex" ? [
-    "__rig_codex_app_server_task_run__",
-    "--runtime-mode",
-    input.runtimeMode,
-    "--interaction-mode",
-    input.interactionMode,
-    ...input.model ? ["--model", input.model] : [],
-    "--prompt"
-  ] : input.runtimeAdapter === "pi" ? [
-    "__rig_pi_session_daemon__",
-    ...input.model ? ["--model", input.model] : []
-  ] : [
-    "--print",
-    "--verbose",
-    "--output-format",
-    "stream-json",
-    "--dangerously-skip-permissions"
-  ];
-  const buildHostAgentCommand = (attemptPrompt) => input.runtimeAdapter === "codex" ? [hostAgentBinary, ...baseAgentArgs, attemptPrompt] : [hostAgentBinary, ...baseAgentArgs];
-  const hostAgentCommand = buildHostAgentCommand(prompt);
-  const hostAgentCommandText = formatCommand(hostAgentCommand);
-  const provisioningAction = startRunAction(context.projectRoot, input.runId, {
-    actionId: `action:${input.runId}:runtime-provision`,
-    actionType: "engine.runtime.provision",
-    title: "Provision dedicated runtime",
-    detail: input.taskId ? `Preparing isolated worktree for ${input.taskId}` : "Preparing isolated runtime",
-    payload: {
-      hostAgentCommand,
-      formattedCommand: hostAgentCommandText,
-      taskId: input.taskId ?? null,
-      mode: "worktree"
-    }
-  });
-  upsertAgentAuthorityRun(context.projectRoot, {
-    runId: input.runId,
-    taskId: runtimeTaskId,
-    createdAt: startedAt,
-    runtimeAdapter: input.runtimeAdapter,
-    status: resumeMode ? "preparing" : "created"
-  });
-  setRunStatusOrFail(context.projectRoot, input.runId, "preparing", { reason: "driver-start" });
-  patchAuthorityRun(context.projectRoot, input.runId, {
-    startedAt,
-    completedAt: null,
-    errorText: null,
-    artifactRoot: resumeMode ? existingRunRecord?.artifactRoot ?? null : null,
-    runtimeAdapter: input.runtimeAdapter,
-    runtimeMode: input.runtimeMode,
-    interactionMode: input.interactionMode,
-    runMode: input.runtimeMode === "full-access" ? "autonomous" : "interactive",
-    initialPrompt: input.initialPrompt ?? null,
-    title: input.taskId ? undefined : input.title ?? `Run ${input.runId}`,
-    pid: process.pid
-  });
-  emitServerRunEvent({
-    type: "status",
-    runId: input.runId,
-    status: "preparing",
-    detail: input.taskId ?? input.title ?? runtimeTaskId,
-    ...sessionAnchor()
-  });
-  appendRunLog(context.projectRoot, input.runId, {
-    id: `log:${input.runId}:${resumeMode ? "resume" : "start"}`,
-    title: resumeMode ? "Rig task run resumed" : "Rig task run started",
-    detail: resumeMode ? `Continuing the same run lifecycle for ${input.taskId ?? input.title ?? runtimeTaskId}.` : input.taskId ?? input.title ?? runtimeTaskId,
-    tone: "info",
-    status: "preparing",
-    createdAt: startedAt
-  });
-  appendRunLog(context.projectRoot, input.runId, {
-    id: `log:${input.runId}:wrapper-command`,
-    title: "Agent wrapper command",
-    detail: hostAgentCommandText,
-    tone: "tool",
-    status: "preparing",
-    payload: {
-      command: hostAgentCommand,
-      formattedCommand: hostAgentCommandText
+    command: typeof input.command === "function" ? input.command : runners.command,
+    gitCommand: typeof input.gitCommand === "function" ? input.gitCommand : runners.gitCommand,
+    steerPi: async (message) => {
+      appendStage?.("Review/CI", message, "running");
+      if (typeof input.steerPi === "function") {
+        await input.steerPi(message);
+      }
     },
-    createdAt: new Date().toISOString()
-  });
-  emitServerRunEvent({ type: "log", runId: input.runId, title: "Agent wrapper command" });
-  const loadedAutomationConfig = await loadTaskRunAutomationConfig(context.projectRoot);
-  const automationConfig = input.prMode ? { ...loadedAutomationConfig ?? {}, pr: { ...loadedAutomationConfig?.pr ?? {}, mode: input.prMode } } : loadedAutomationConfig;
-  const planningClassification = classifyPlanningNeed({ config: automationConfig, sourceTask });
-  const planningArtifactPath = resolve6("artifacts", runtimeTaskId, "implementation-plan.md");
-  const persistedPlanning = {
-    ...planningClassification,
-    classifier: input.runtimeAdapter === "pi" ? "pi-rig-structured-policy" : "rig-structured-policy",
-    artifactPath: planningClassification.planningRequired ? planningArtifactPath : null,
-    classifiedAt: new Date().toISOString()
-  };
-  mkdirSync2(resolve6(context.projectRoot, ".rig", "runs", input.runId), { recursive: true });
-  writeFileSync2(resolve6(context.projectRoot, ".rig", "runs", input.runId, "planning-classification.json"), `${JSON.stringify(persistedPlanning, null, 2)}
-`, "utf8");
-  patchAuthorityRun(context.projectRoot, input.runId, { planning: persistedPlanning });
-  prompt = `${prompt}
-
-Rig planning classification:
-${JSON.stringify(persistedPlanning, null, 2)}
-${planningClassification.planningRequired ? `Before implementing, write a concise implementation plan to ${planningArtifactPath}. Treat that plan artifact as required acceptance evidence for the Plan stage.` : "Planning is not required for this run; briefly state why before implementation."}`;
-  if (input.runtimeAdapter === "pi") {
-    for (const stage of ["Connect", "GitHub/task sync", "Prepare workspace", "Launch Pi", "Plan", "Implement"]) {
-      appendPiStageLog({
-        projectRoot: context.projectRoot,
-        runId: input.runId,
-        stage,
-        detail: stage === "Launch Pi" ? "Worker Pi SDK session daemon starting; local frontend will attach over Rig-proxied WebSocket." : stage === "Plan" ? `${planningClassification.planningRequired ? "recorded" : "skipped"} (${planningClassification.reason}; size=${planningClassification.size}; risk=${planningClassification.risk})` : stage === "Implement" ? "Pi implementation pass is running in the worker runtime." : null,
-        status: stage === "Implement" || stage === "Launch Pi" ? "running" : "completed"
-      });
-    }
-  }
-  appendRunTimeline(context.projectRoot, input.runId, {
-    id: `message:${input.runId}:user`,
-    type: "user_message",
-    text: prompt,
-    createdAt: startedAt,
-    state: "completed",
-    completedAt: startedAt
-  });
-  emitServerRunEvent({ type: "timeline", runId: input.runId });
-  await context.emitEvent("command.started", {
-    command: [
-      "rig",
-      "server",
-      "task-run",
-      ...input.taskId ? ["--task", input.taskId] : [],
-      ...input.title ? ["--title", input.title] : []
-    ],
-    formattedCommand: input.taskId ? `rig server task-run --task ${input.taskId}` : `rig server task-run --title ${JSON.stringify(input.title ?? `Run ${input.runId}`)}`,
-    startedAt,
-    dryRun: false
-  });
-  const assistantMessageId = `message:${input.runId}:assistant`;
-  let assistantText = "";
-  const pendingClaudeToolUses = new Map;
-  const pendingCodexToolUses = new Map;
-  let launchAction;
-  let verificationAction;
-  let reviewAction;
-  let verificationStarted = false;
-  let reviewStarted = false;
-  let latestRuntimeWorkspace = resumeMode && typeof existingRunRecord?.worktreePath === "string" ? existingRunRecord.worktreePath : null;
-  let latestSessionDir = resumeMode && typeof existingRunRecord?.sessionPath === "string" ? resolve6(existingRunRecord.sessionPath, "..") : null;
-  let latestLogsDir = resumeMode && typeof existingRunRecord?.logRoot === "string" ? existingRunRecord.logRoot : null;
-  let latestProviderCommand = null;
-  let latestRuntimeBranch = resumeMode && typeof existingRunRecord?.branch === "string" ? existingRunRecord.branch : null;
-  let snapshotSidecarPromise = null;
-  let wrapperManagesRuntimeSnapshot = false;
-  let dirtyBaselineApplied = false;
-  const childEnv = {
-    ...process.env,
-    ...input.runtimeAdapter === "pi" ? buildPiRigBridgeEnv({
-      projectRoot: context.projectRoot,
-      runId: input.runId,
-      taskId: runtimeTaskId,
-      serverUrl: process.env.RIG_SERVER_URL ?? null,
-      authToken: process.env.RIG_AUTH_TOKEN ?? null,
-      githubToken: process.env.RIG_GITHUB_TOKEN ?? process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN ?? null
-    }) : {
-      PROJECT_RIG_ROOT: context.projectRoot,
-      RIG_TASK_ID: runtimeTaskId,
-      RIG_RUNTIME_ADAPTER: input.runtimeAdapter,
-      RIG_SERVER_RUN_ID: input.runId
+    journalPhase: (phase, outcome, detail) => {
+      const status = outcome === "completed" ? "completed" : outcome === "failed" ? "needs_attention" : "running";
+      appendStage?.(phase, detail ?? null, status);
     },
-    ...sourceTask ? { RIG_SOURCE_TASK_JSON: JSON.stringify(sourceTask) } : {},
-    ...resumeMode ? {
-      RIG_RUN_RESUME: "1",
-      RIG_RUNTIME_ARTIFACT_CLEANUP: "preserve"
-    } : {}
-  };
-  Object.assign(childEnv, buildTaskRunReviewEnv(automationConfig));
-  Object.assign(childEnv, buildDirtyBaselineHandshakeEnv({ projectRoot: context.projectRoot, runId: input.runId, baselineMode: input.baselineMode }));
-  const automationLimits = resolveTaskRunAutomationLimits(automationConfig);
-  const maxAttempts = automationLimits.maxValidationAttempts;
-  const promoteToValidating = (detail) => {
-    if (verificationStarted)
-      return;
-    verificationStarted = true;
-    setRunStatusOrFail(context.projectRoot, input.runId, "validating");
-    emitServerRunEvent({ type: "status", runId: input.runId, status: "validating", detail: detail ?? null, ...sessionAnchor() });
-    verificationAction = startRunAction(context.projectRoot, input.runId, {
-      actionId: `action:${input.runId}:completion-verification`,
-      actionType: "completion-verification",
-      title: "Run completion verification",
-      detail: detail ?? "Rig completion-verification hook is running."
-    });
-  };
-  const promoteToReviewing = (detail) => {
-    if (reviewStarted)
-      return;
-    reviewStarted = true;
-    setRunStatusOrFail(context.projectRoot, input.runId, "reviewing");
-    emitServerRunEvent({ type: "status", runId: input.runId, status: "reviewing", detail: detail ?? null, ...sessionAnchor() });
-    reviewAction = startRunAction(context.projectRoot, input.runId, {
-      actionId: `action:${input.runId}:review-closeout`,
-      actionType: "run.review",
-      title: "Finalize run review",
-      detail: detail ?? "Verifier review is running."
-    });
-  };
-  const nextRunLogId = createRunLogIdFactory(input.runId);
-  const handleWrapperEvent = (rawPayload) => {
-    let event = null;
-    try {
-      event = JSON.parse(rawPayload);
-    } catch {
-      return false;
-    }
-    if (!event?.type)
-      return false;
-    const payload = event.payload ?? {};
-    if (event.type === "runtime.provision.completed") {
-      latestRuntimeWorkspace = typeof payload.workspaceDir === "string" ? payload.workspaceDir : latestRuntimeWorkspace;
-      latestSessionDir = typeof payload.sessionDir === "string" ? payload.sessionDir : latestSessionDir;
-      latestLogsDir = typeof payload.logsDir === "string" ? payload.logsDir : latestLogsDir;
-      const runtimeId = typeof payload.runtimeId === "string" ? payload.runtimeId : null;
-      wrapperManagesRuntimeSnapshot = payload.snapshotManaged === true;
-      latestRuntimeBranch = runtimeId;
-      provisioningAction.complete(latestRuntimeWorkspace ?? "Runtime ready.", {
-        runtimeId: runtimeId ?? null,
-        workspaceDir: latestRuntimeWorkspace,
-        sessionDir: latestSessionDir,
-        logsDir: latestLogsDir,
-        contextFile: payload.contextFile ?? null
-      });
-      setRunStatusOrFail(context.projectRoot, input.runId, "running");
-      patchAuthorityRun(context.projectRoot, input.runId, {
-        worktreePath: latestRuntimeWorkspace,
-        artifactRoot: latestRuntimeWorkspace && input.taskId ? resolve6(latestRuntimeWorkspace, "artifacts", input.taskId) : null,
-        logRoot: latestLogsDir,
-        sessionPath: latestSessionDir ? resolve6(latestSessionDir, "session.json") : null,
-        sessionLogPath: latestLogsDir ? resolve6(latestLogsDir, "agent-stdout.log") : null,
-        branch: runtimeId
-      });
-      if (!dirtyBaselineApplied && input.baselineMode === "dirty-snapshot" && latestRuntimeWorkspace) {
-        dirtyBaselineApplied = true;
-        const dirty = applyDirtyBaselineSnapshot({ sourceRoot: context.projectRoot, targetRoot: latestRuntimeWorkspace });
-        const readyFile = childEnv.RIG_DIRTY_BASELINE_READY_FILE;
-        if (readyFile) {
-          mkdirSync2(resolve6(readyFile, ".."), { recursive: true });
-          writeFileSync2(readyFile, `${JSON.stringify({ ...dirty, workspaceDir: latestRuntimeWorkspace, appliedAt: new Date().toISOString() }, null, 2)}
-`, "utf8");
-        }
-        appendRunLog(context.projectRoot, input.runId, {
-          id: `log:${input.runId}:dirty-baseline`,
-          title: "Dirty baseline snapshot",
-          detail: dirty.detail,
-          tone: dirty.applied ? "tool" : "info",
-          status: dirty.applied ? "completed" : "skipped",
-          createdAt: new Date().toISOString(),
-          payload: readyFile ? { readyFile } : undefined
-        });
-        emitServerRunEvent({ type: "log", runId: input.runId, title: "Dirty baseline snapshot" });
-      }
-      if (!wrapperManagesRuntimeSnapshot && !snapshotSidecarPromise && runtimeId && loadRuntimeSnapshotConfig(context.projectRoot).enabled) {
-        snapshotSidecarPromise = (async () => {
-          const { sidecar, error } = await resolveTaskRunSnapshotSidecar({
-            projectRoot: context.projectRoot,
-            runtimeId,
-            workspaceDir: latestRuntimeWorkspace,
-            listRuntimes: listAgentRuntimes,
-            startSidecar: (runtime) => startRuntimeSnapshotSidecar(runtime, { instanceId: `${runtime.id}-run-${input.runId}` })
-          });
-          if (!sidecar) {
-            appendRunLog(context.projectRoot, input.runId, {
-              id: `log:${input.runId}:snapshot-unavailable`,
-              title: "Runtime snapshotting unavailable",
-              detail: error ?? `Could not locate runtime metadata for ${runtimeId}.`,
-              tone: "error",
-              status: "running",
-              createdAt: new Date().toISOString()
-            });
-            emitServerRunEvent({ type: "log", runId: input.runId, title: "Runtime snapshotting unavailable" });
-            return null;
-          }
-          return sidecar;
-        })();
-      }
-      emitServerRunEvent({
-        type: "status",
-        runId: input.runId,
-        status: "running",
-        detail: latestRuntimeWorkspace,
-        ...sessionAnchor()
-      });
-      return true;
-    }
-    if (event.type === "runtime.provision.failed") {
-      const detail = typeof payload.error === "string" ? payload.error : "Runtime provisioning failed.";
-      provisioningAction.fail(detail, payload);
-      emitServerRunEvent({ type: "failed", runId: input.runId, error: detail });
-      return true;
-    }
-    if (event.type === "provider.launch") {
-      const command = Array.isArray(payload.command) ? payload.command.filter((value) => typeof value === "string") : [];
-      latestProviderCommand = command.length > 0 ? command : null;
-      const commandText = command.length > 0 ? formatCommand(command) : String(payload.provider ?? "provider");
-      launchAction = startRunAction(context.projectRoot, input.runId, {
-        actionId: `action:${input.runId}:provider-launch`,
-        actionType: "agent.launch",
-        title: "Launch agent runtime",
-        detail: commandText,
-        payload: {
-          runtimeAdapter: input.runtimeAdapter,
-          runtimeMode: input.runtimeMode,
-          interactionMode: input.interactionMode,
-          workspaceDir: payload.workspaceDir ?? latestRuntimeWorkspace,
-          command,
-          formattedCommand: commandText
-        }
-      });
-      appendRunLog(context.projectRoot, input.runId, {
-        id: `log:${input.runId}:provider-command`,
-        title: "Agent launch command",
-        detail: commandText,
-        tone: "tool",
-        status: "running",
-        payload: {
-          command,
-          formattedCommand: commandText
-        },
-        createdAt: new Date().toISOString()
-      });
-      emitServerRunEvent({ type: "log", runId: input.runId, title: "Agent launch command" });
-      return true;
-    }
-    if (event.type === "provider.completed") {
-      const exitCode = typeof payload.exitCode === "number" ? payload.exitCode : null;
-      if (launchAction) {
-        if (exitCode === 0) {
-          launchAction.complete("Agent runtime finished.");
-        } else {
-          launchAction.fail(`Agent runtime failed (${String(exitCode ?? "unknown")})`, payload);
-        }
-      }
-      return true;
-    }
-    if (event.type === "pi.sessiond.starting" || event.type === "pi.sessiond.ready" || event.type === "pi.session.event_stream.connected" || event.type === "pi.prompt.sent" || event.type === "pi.prompt.waiting" || event.type === "pi.session.agent_end" || event.type === "pi.session.error") {
-      const title = event.type === "pi.sessiond.starting" ? "Starting worker Pi session daemon" : event.type === "pi.sessiond.ready" ? "Worker Pi daemon ready" : event.type === "pi.session.event_stream.connected" ? "Worker Pi event stream connected" : event.type === "pi.prompt.sent" ? "Delivered initial prompt to worker Pi" : event.type === "pi.prompt.waiting" ? "Worker Pi prompt waiting" : event.type === "pi.session.agent_end" ? "Worker Pi turn complete" : "Worker Pi session error";
-      const detail = event.type === "pi.sessiond.ready" ? "Daemon accepted control connection; waiting for SDK session metadata." : event.type === "pi.sessiond.starting" ? String(payload.workspaceDir ?? "worker runtime") : event.type === "pi.prompt.sent" ? `${String(payload.bytes ?? "unknown")} prompt bytes sent.` : event.type === "pi.prompt.waiting" ? String(payload.reason ?? "empty prompt") : event.type === "pi.session.error" ? String(payload.message ?? "session error") : String(payload.sessionId ?? payload.runId ?? "worker Pi session");
-      appendRunLog(context.projectRoot, input.runId, {
-        id: nextRunLogId(),
-        title,
-        detail,
-        tone: event.type === "pi.session.error" ? "error" : "info",
-        status: reviewStarted ? "reviewing" : verificationStarted ? "validating" : "running",
-        payload: {
-          eventType: event.type,
-          runId: typeof payload.runId === "string" ? payload.runId : null,
-          runtimeId: typeof payload.runtimeId === "string" ? payload.runtimeId : null,
-          sessionId: typeof payload.sessionId === "string" ? payload.sessionId : null
-        },
-        createdAt: new Date().toISOString()
-      });
-      emitServerRunEvent({ type: "log", runId: input.runId, title });
-      return true;
-    }
-    if (event.type === "pi.session.ready") {
-      const privateMetadata = payload.privateMetadata && typeof payload.privateMetadata === "object" && !Array.isArray(payload.privateMetadata) ? payload.privateMetadata : null;
-      const publicMetadata = payload.metadata && typeof payload.metadata === "object" && !Array.isArray(payload.metadata) ? payload.metadata : null;
-      if (privateMetadata) {
-        patchAuthorityRun(context.projectRoot, input.runId, {
-          piSession: publicMetadata,
-          piSessionPrivate: privateMetadata
-        });
-        const sessionId = typeof publicMetadata?.sessionId === "string" ? publicMetadata.sessionId : typeof privateMetadata.public === "object" && privateMetadata.public && !Array.isArray(privateMetadata.public) ? String(privateMetadata.public.sessionId ?? "") : "";
-        if (sessionId) {
-          latestPiSessionId = sessionId;
-        }
-        appendRunLog(context.projectRoot, input.runId, {
-          id: `log:${input.runId}:pi-session-ready`,
-          title: "Worker Pi session ready",
-          detail: sessionId ? `Session ${sessionId} is ready for WebSocket attach.` : "Worker Pi SDK session daemon is ready for WebSocket attach.",
-          tone: "info",
-          status: "running",
-          payload: {
-            sessionId: sessionId || null,
-            runtimeId: typeof payload.runtimeId === "string" ? payload.runtimeId : null
-          },
-          createdAt: new Date().toISOString()
-        });
-        emitServerRunEvent({ type: "log", runId: input.runId, title: "Worker Pi session ready" });
-      }
-      return true;
-    }
-    if (event.type === "pi.rpc.prompt.sent" || event.type === "pi.rpc.steering.delivered" || event.type === "pi.rpc.steering.poll.failed" || event.type === "pi.rpc.extension_ui.cancelled") {
-      const title = event.type === "pi.rpc.prompt.sent" ? "Delivered initial prompt to worker Pi" : event.type === "pi.rpc.steering.delivered" ? "Delivered steering to worker Pi" : event.type === "pi.rpc.steering.poll.failed" ? "Worker Pi steering poll failed" : "Pi RPC UI request auto-cancelled";
-      const detail = event.type === "pi.rpc.prompt.sent" ? `${String(payload.kind ?? "prompt")} prompt (${String(payload.bytes ?? "unknown")} bytes)` : event.type === "pi.rpc.steering.delivered" ? `${String(payload.actor ?? "operator")}: ${String(payload.message ?? "")}`.slice(0, 500) : event.type === "pi.rpc.steering.poll.failed" ? String(payload.error ?? "steering poll failed") : `${String(payload.method ?? "ui")}: ${String(payload.reason ?? "noninteractive worker session")}`;
-      appendRunLog(context.projectRoot, input.runId, {
-        id: nextRunLogId(),
-        title,
-        detail,
-        tone: event.type === "pi.rpc.steering.poll.failed" ? "error" : "info",
-        status: reviewStarted ? "reviewing" : verificationStarted ? "validating" : "running",
-        payload,
-        createdAt: new Date().toISOString()
-      });
-      emitServerRunEvent({ type: "log", runId: input.runId, title });
-      return true;
-    }
-    appendRunTimeline(context.projectRoot, input.runId, {
-      id: `timeline:${input.runId}:${Date.now()}:wrapper:${event.type}`,
-      type: "wrapper-event",
-      eventType: event.type,
-      payload: redactSensitivePayload(payload),
-      createdAt: new Date().toISOString()
-    });
-    emitServerRunEvent({ type: "timeline", runId: input.runId });
-    return true;
-  };
-  const handleAgentStdoutLine = (line) => {
-    const trimmed = line.trim();
-    if (!trimmed)
-      return;
-    if (trimmed.startsWith("__RIG_WRAPPER_EVENT__")) {
-      if (handleWrapperEvent(trimmed.slice("__RIG_WRAPPER_EVENT__".length))) {
-        emitServerRunEvent({ type: "timeline", runId: input.runId });
+    reflect: async (status, summary, options) => {
+      const github = config.github && typeof config.github === "object" && !Array.isArray(config.github) ? config.github : null;
+      if (github?.issueUpdates === "off")
         return;
-      }
-    }
-    const completionLine = classifyCompletionVerificationLine(trimmed);
-    if (completionLine.isCompletionLine) {
-      promoteToValidating(trimmed);
-      if (completionLine.isVerifierReview) {
-        if (verificationAction) {
-          verificationAction.complete("Completion verification checks finished.");
-        }
-        promoteToReviewing(trimmed);
-      }
-      appendRunLog(context.projectRoot, input.runId, {
-        id: nextRunLogId(),
-        title: verificationStarted ? "Completion verification" : "Agent output",
-        detail: trimmed,
-        tone: "info",
-        status: reviewStarted ? "reviewing" : verificationStarted ? "validating" : "running",
-        createdAt: new Date().toISOString()
-      });
-      emitServerRunEvent({ type: "log", runId: input.runId, title: verificationStarted ? "Completion verification" : "Agent output" });
-      return;
-    }
-    try {
-      const record = JSON.parse(trimmed);
-      const liveLogStatus = reviewStarted ? "reviewing" : verificationStarted ? "validating" : "running";
-      if (input.runtimeAdapter === "pi" && appendPiRpcProtocolLogFromRecord({
-        projectRoot: context.projectRoot,
-        runId: input.runId,
-        record,
-        status: liveLogStatus,
-        nextRunLogId
-      })) {
-        return;
-      }
-      if (input.runtimeAdapter === "pi" && appendPiToolTimelineFromRecord({ projectRoot: context.projectRoot, runId: input.runId, record })) {
-        emitServerRunEvent({ type: "timeline", runId: input.runId });
-        return;
-      }
-      const providerLogs = input.runtimeAdapter === "codex" ? buildCodexLogsFromRecord({
-        runId: input.runId,
-        record,
-        createdAtFallback: new Date().toISOString(),
-        status: liveLogStatus,
-        pendingToolUses: pendingCodexToolUses
-      }) : buildClaudeLogsFromRecord({
-        runId: input.runId,
-        record,
-        createdAtFallback: new Date().toISOString(),
-        status: liveLogStatus,
-        pendingToolUses: pendingClaudeToolUses
-      });
-      if (providerLogs.length > 0) {
-        for (const providerLog of providerLogs) {
-          appendRunLog(context.projectRoot, input.runId, providerLog);
-          appendToolTimelineFromLog({ projectRoot: context.projectRoot, runId: input.runId, log: providerLog });
-          emitServerRunEvent({ type: "log", runId: input.runId, title: providerLog.title });
-          if (providerLog.title === "Tool activity")
-            emitServerRunEvent({ type: "timeline", runId: input.runId });
-        }
-      }
-      if (input.runtimeAdapter === "codex") {
-        const nextAssistantText = extractCodexAssistantMessageText(record);
-        if (nextAssistantText) {
-          assistantText = nextAssistantText;
-          appendRunTimeline(context.projectRoot, input.runId, {
-            id: assistantMessageId,
-            type: "assistant_message",
-            text: assistantText,
-            state: "streaming",
-            createdAt: new Date().toISOString()
-          });
-          emitServerRunEvent({ type: "timeline", runId: input.runId });
-          return;
-        }
-        if (providerLogs.length > 0 || isCodexExecRecord(record)) {
-          return;
-        }
-      }
-      if (record.type === "message_update") {
-        const assistantMessageEvent = record.assistantMessageEvent && typeof record.assistantMessageEvent === "object" ? record.assistantMessageEvent : null;
-        if (assistantMessageEvent?.type === "text_delta" && typeof assistantMessageEvent.delta === "string") {
-          assistantText += assistantMessageEvent.delta;
-          appendRunTimeline(context.projectRoot, input.runId, {
-            id: assistantMessageId,
-            type: "assistant_message",
-            text: assistantText,
-            state: "streaming",
-            createdAt: new Date().toISOString()
-          });
-          emitServerRunEvent({ type: "timeline", runId: input.runId });
-          return;
-        }
-      }
-      if (record.type === "stream_event") {
-        const event = record.event && typeof record.event === "object" ? record.event : null;
-        const delta = event?.delta && typeof event.delta === "object" ? event.delta : null;
-        if (delta?.type === "text_delta" && typeof delta.text === "string") {
-          assistantText += delta.text;
-          appendRunTimeline(context.projectRoot, input.runId, {
-            id: assistantMessageId,
-            type: "assistant_message",
-            text: assistantText,
-            state: "streaming",
-            createdAt: new Date().toISOString()
-          });
-          emitServerRunEvent({ type: "timeline", runId: input.runId });
-          return;
-        }
-      }
-      if (input.runtimeAdapter === "pi" && isNonRenderablePiProtocolRecord(record)) {
-        return;
-      }
-      if (record.type === "assistant") {
-        const message = record.message && typeof record.message === "object" ? record.message : record;
-        const content = Array.isArray(message.content) ? message.content : [];
-        const nextText = content.map((entry) => entry && typeof entry === "object" && entry.type === "text" ? String(entry.text ?? "") : "").join("");
-        if (nextText.length > assistantText.length) {
-          assistantText = nextText;
-          appendRunTimeline(context.projectRoot, input.runId, {
-            id: assistantMessageId,
-            type: "assistant_message",
-            text: assistantText,
-            state: "streaming",
-            createdAt: new Date().toISOString()
-          });
-          emitServerRunEvent({ type: "timeline", runId: input.runId });
-        }
-        return;
-      }
-      if (providerLogs.length > 0) {
-        return;
-      }
-    } catch {}
-    appendRunLog(context.projectRoot, input.runId, {
-      id: nextRunLogId(),
-      title: verificationStarted ? "Completion verification" : "Agent output",
-      detail: trimmed,
-      tone: "info",
-      status: reviewStarted ? "reviewing" : verificationStarted ? "validating" : "running",
-      createdAt: new Date().toISOString()
-    });
-    emitServerRunEvent({ type: "log", runId: input.runId, title: verificationStarted ? "Completion verification" : "Agent output" });
-  };
-  let currentPrompt = prompt;
-  let exit = null;
-  let reviewFailureDetail = null;
-  const stderrLines = [];
-  const piAcceptedArtifactExitGraceMs = resolvePiAcceptedArtifactExitGraceMs(childEnv);
-  if (resumeMode && ["validating", "reviewing"].includes(resumePreviousStatus)) {
-    appendRunLog(context.projectRoot, input.runId, {
-      id: `log:${input.runId}:resume-closeout-phase`,
-      title: "Resume continuing from closeout phase",
-      detail: `Previous run status was ${resumePreviousStatus}; skipping agent relaunch and continuing validation/PR/merge closeout for the same run.`,
-      tone: "info",
-      status: resumePreviousStatus,
-      createdAt: new Date().toISOString()
-    });
-    emitServerRunEvent({ type: "log", runId: input.runId, title: "Resume continuing from closeout phase" });
-    exit = { code: 0, signal: null };
-  } else if (resumeMode && latestRuntimeWorkspace) {
-    const acceptedArtifactState = readTaskRunAcceptedArtifactState({
-      taskId: input.taskId ?? runtimeTaskId,
-      workspaceDir: latestRuntimeWorkspace
-    });
-    if (acceptedArtifactState.accepted) {
-      appendRunLog(context.projectRoot, input.runId, {
-        id: `log:${input.runId}:resume-accepted-artifacts`,
-        title: "Resume found accepted artifacts; continuing closeout",
-        detail: acceptedArtifactState.reason ?? "Accepted task artifacts are present from the previous run process.",
-        tone: "info",
-        status: "validating",
-        createdAt: new Date().toISOString()
-      });
-      emitServerRunEvent({ type: "log", runId: input.runId, title: "Resume found accepted artifacts; continuing closeout" });
-      exit = { code: 0, signal: null };
-    }
-  }
-  for (let attempt = 1;!exit && attempt <= maxAttempts; attempt += 1) {
-    const attemptHostAgentCommand = buildHostAgentCommand(currentPrompt);
-    const child = spawn(attemptHostAgentCommand[0], attemptHostAgentCommand.slice(1), {
-      cwd: context.projectRoot,
-      env: childEnv,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    const forwardSigterm = () => {
-      try {
-        child.kill("SIGTERM");
-      } catch {}
-    };
-    process.once("SIGTERM", forwardSigterm);
-    if (input.runtimeAdapter === "claude-code" || input.runtimeAdapter === "pi") {
-      child.stdin.write(currentPrompt);
-      child.stdin.end();
-    } else {
-      child.stdin.end();
-    }
-    const stdout = createLineInterface({ input: child.stdout });
-    stdout.on("line", handleAgentStdoutLine);
-    const stderr = createLineInterface({ input: child.stderr });
-    stderr.on("line", (line) => {
-      const trimmed = line.trim();
-      if (!trimmed)
-        return;
-      stderrLines.push(trimmed);
-      appendRunLog(context.projectRoot, input.runId, {
-        id: nextRunLogId(),
-        title: "Agent stderr",
-        detail: trimmed,
-        tone: "error",
-        status: reviewStarted ? "reviewing" : verificationStarted ? "validating" : "running",
-        createdAt: new Date().toISOString()
-      });
-      emitServerRunEvent({ type: "log", runId: input.runId, title: "Agent stderr" });
-    });
-    let acceptedArtifactExit = false;
-    let acceptedArtifactObservedAt = null;
-    let acceptedArtifactPollTimer = null;
-    let acceptedArtifactKillTimer = null;
-    const attemptExit = await new Promise((resolve7) => {
-      let settled = false;
-      const settle = (result) => {
-        if (settled)
-          return;
-        settled = true;
-        if (acceptedArtifactPollTimer)
-          clearInterval(acceptedArtifactPollTimer);
-        resolve7(result);
-      };
-      const pollAcceptedArtifacts = () => {
-        const artifactState = readTaskRunAcceptedArtifactState({
-          taskId: input.taskId ?? runtimeTaskId,
-          workspaceDir: latestRuntimeWorkspace,
-          artifactNotBeforeMs: Date.parse(startedAt)
-        });
-        if (!artifactState.accepted) {
-          acceptedArtifactObservedAt = null;
-          return;
-        }
-        acceptedArtifactObservedAt ??= Date.now();
-        if (Date.now() - acceptedArtifactObservedAt < piAcceptedArtifactExitGraceMs || acceptedArtifactExit) {
-          return;
-        }
-        acceptedArtifactExit = true;
-        const detail = [
-          artifactState.reason ?? "Rig accepted task artifacts are present.",
-          `Pi has not exited after ${piAcceptedArtifactExitGraceMs}ms; terminating the stale Pi process so Rig can continue PR/issue closeout.`
-        ].join(" ");
-        appendRunLog(context.projectRoot, input.runId, {
-          id: `log:${input.runId}:pi-accepted-artifacts-exit`,
-          title: "Pi accepted artifacts; continuing closeout",
-          detail,
-          tone: "info",
-          status: "running",
-          createdAt: new Date().toISOString()
-        });
-        emitServerRunEvent({ type: "log", runId: input.runId, title: "Pi accepted artifacts; continuing closeout" });
-        try {
-          child.kill("SIGTERM");
-        } catch {}
-        acceptedArtifactKillTimer = setTimeout(() => {
-          try {
-            child.kill("SIGKILL");
-          } catch {}
-          settle({ code: 0, signal: "SIGKILL" });
-        }, 5000);
-      };
-      child.once("error", (error) => {
-        if (acceptedArtifactKillTimer)
-          clearTimeout(acceptedArtifactKillTimer);
-        console.error(`[rig] agent process error: ${error.message}`);
-        settle({ code: 1, signal: null, error });
-      });
-      child.once("close", (code, signal) => {
-        if (acceptedArtifactKillTimer)
-          clearTimeout(acceptedArtifactKillTimer);
-        settle(acceptedArtifactExit ? { code: 0, signal: signal ?? "SIGTERM" } : { code, signal });
-      });
-      if (input.runtimeAdapter === "pi") {
-        acceptedArtifactPollTimer = setInterval(pollAcceptedArtifacts, 5000);
-        acceptedArtifactPollTimer.unref?.();
-      }
-    });
-    await finalizeTaskRunSnapshot({
-      snapshotSidecarPromise,
-      latestProviderCommand,
-      hostAgentCommand: attemptHostAgentCommand,
-      exit: attemptExit
-    });
-    const pendingLogs = input.runtimeAdapter === "codex" ? flushPendingCodexToolUseLogs({
-      runId: input.runId,
-      status: typeof attemptExit.code === "number" && attemptExit.code === 0 ? "completed" : "failed",
-      pendingToolUses: pendingCodexToolUses
-    }) : flushPendingClaudeToolUseLogs({
-      runId: input.runId,
-      status: typeof attemptExit.code === "number" && attemptExit.code === 0 ? "completed" : "failed",
-      pendingToolUses: pendingClaudeToolUses
-    });
-    for (const pendingLog of pendingLogs) {
-      appendRunLog(context.projectRoot, input.runId, pendingLog);
-      appendToolTimelineFromLog({ projectRoot: context.projectRoot, runId: input.runId, log: pendingLog });
-      emitServerRunEvent({ type: "log", runId: input.runId, title: pendingLog.title });
-      if (pendingLog.title === "Tool activity")
-        emitServerRunEvent({ type: "timeline", runId: input.runId });
-    }
-    process.off("SIGTERM", forwardSigterm);
-    if (attemptExit.error) {
-      throw new CliError(`Task run failed to start: ${attemptExit.error.message}`, 1);
-    }
-    const retryContext = resolveTaskRunRetryContext({
-      projectRoot: context.projectRoot,
-      taskId: input.taskId ?? null,
-      workspaceDir: latestRuntimeWorkspace,
-      attempt,
-      maxAttempts,
-      basePrompt: prompt
-    });
-    if (retryContext.shouldRetry && retryContext.nextPrompt) {
-      const failureDetail = retryContext.failureDetail ?? summarizeValidationFailure(context.projectRoot, input.taskId ?? null) ?? "Rig validation failed.";
-      const retrySteering = buildPiValidationRetrySteeringPrompt({
-        taskId: input.taskId ?? runtimeTaskId,
-        attempt,
-        maxAttempts,
-        failureDetail,
-        validationOutput: summarizeValidationFailure(context.projectRoot, input.taskId ?? null)
-      });
-      currentPrompt = [retryContext.nextPrompt, "", "Rig Pi steering message:", retrySteering].join(`
-`);
-      reviewFailureDetail = failureDetail;
-      setRunStatusOrFail(context.projectRoot, input.runId, "validating", { reason: "validation-retry" });
-      patchAuthorityRun(context.projectRoot, input.runId, {
-        completedAt: null,
-        errorText: null
-      });
-      appendPiStageLog({
-        projectRoot: context.projectRoot,
-        runId: input.runId,
-        stage: "Validate",
-        detail: failureDetail,
-        tone: "error",
-        status: "validating"
-      });
-      appendRunLog(context.projectRoot, input.runId, {
-        id: `log:${input.runId}:retry:${attempt + 1}`,
-        title: `Steering Pi to retry validation (attempt ${attempt + 1}/${maxAttempts})`,
-        detail: retrySteering,
-        tone: "info",
-        status: "running",
-        createdAt: new Date().toISOString()
-      });
-      emitServerRunEvent({
-        type: "status",
-        runId: input.runId,
-        status: "validating",
-        detail: failureDetail,
-        ...sessionAnchor()
-      });
-      emitServerRunEvent({ type: "log", runId: input.runId, title: "Validate failed" });
-      emitServerRunEvent({ type: "log", runId: input.runId, title: `Steering Pi to retry validation (attempt ${attempt + 1}/${maxAttempts})` });
-      continue;
-    }
-    exit = attemptExit;
-    reviewFailureDetail = retryContext.failureDetail;
-    break;
-  }
-  if (!exit) {
-    throw new CliError(`Task run for ${runtimeTaskId} exhausted ${maxAttempts} attempts without a terminal result.`, 1);
-  }
-  if (exit.error) {
-    throw new CliError(`Task run failed to start: ${exit.error.message}`, 1);
-  }
-  if (assistantText.trim()) {
-    appendRunTimeline(context.projectRoot, input.runId, {
-      id: assistantMessageId,
-      type: "assistant_message",
-      text: assistantText,
-      state: "completed",
-      createdAt: new Date().toISOString(),
-      completedAt: new Date().toISOString()
-    });
-    emitServerRunEvent({ type: "timeline", runId: input.runId });
-  }
-  if (exit.code !== 0 || reviewFailureDetail) {
-    const failedAt = new Date().toISOString();
-    const failureDetail = reviewFailureDetail ?? summarizeValidationFailure(context.projectRoot, input.taskId ?? null) ?? summarizeTaskRunProcessFailure({
-      exitCode: exit.code,
-      signal: exit.signal,
-      stderrLines
-    });
-    if (verificationAction && !reviewStarted) {
-      verificationAction.fail(failureDetail);
-    }
-    if (reviewAction) {
-      reviewAction.fail(failureDetail);
-    }
-    let terminalFailureDetail = failureDetail;
-    const terminalRunStatus = reviewFailureDetail ? "needs-attention" : "failed";
-    try {
-      await updateTaskSourceAfterDriverRun(context.projectRoot, input.runId, input.taskId, sourceTask, "failed", terminalRunStatus === "needs-attention" ? "Rig task run needs attention." : "Rig task run failed.", {
-        latestRuntimeWorkspace,
-        latestLogsDir,
-        latestSessionDir,
-        errorText: failureDetail
-      });
-    } catch (error) {
-      terminalFailureDetail = `${failureDetail}
-Failed to update task source for ${input.taskId ?? runtimeTaskId} to failed: ${error instanceof Error ? error.message : String(error)}`;
-    }
-    setRunStatusOrFail(context.projectRoot, input.runId, terminalRunStatus, {
-      reason: "driver-terminal-failure",
-      errorText: terminalFailureDetail
-    });
-    patchAuthorityRun(context.projectRoot, input.runId, { completedAt: failedAt });
-    appendRunLog(context.projectRoot, input.runId, {
-      id: `log:${input.runId}:${terminalRunStatus}`,
-      title: terminalRunStatus === "needs-attention" ? "Task run needs attention" : "Task run failed",
-      detail: terminalFailureDetail,
-      tone: "error",
-      status: terminalRunStatus,
-      createdAt: failedAt
-    });
-    emitServerRunEvent({
-      type: "failed",
-      runId: input.runId,
-      error: terminalFailureDetail
-    });
-    throw new CliError(terminalFailureDetail, exit.code ?? 1);
-  }
-  if (planningClassification.planningRequired) {
-    const planWorkspace = latestRuntimeWorkspace ?? context.projectRoot;
-    const expectedPlanPath = resolve6(planWorkspace, planningArtifactPath);
-    if (!existsSync4(expectedPlanPath)) {
-      const failedAt = new Date().toISOString();
-      const failureDetail = `Planning was required (${planningClassification.reason}) but ${planningArtifactPath} was not written before implementation completed.`;
-      setRunStatusOrFail(context.projectRoot, input.runId, "needs-attention", {
-        reason: "plan-artifact-missing",
-        errorText: failureDetail
-      });
-      patchAuthorityRun(context.projectRoot, input.runId, { completedAt: failedAt });
-      appendRunLog(context.projectRoot, input.runId, {
-        id: `log:${input.runId}:plan-artifact-missing`,
-        title: "Required plan artifact missing",
-        detail: failureDetail,
-        tone: "error",
-        status: "needs_attention",
-        createdAt: failedAt
-      });
-      emitServerRunEvent({ type: "failed", runId: input.runId, error: failureDetail });
-      throw new CliError(failureDetail, 1);
-    }
-  }
-  if (process.env.RIG_SERVER_OWNS_CLOSEOUT === "1") {
-    appendPiStageLog({
-      projectRoot: context.projectRoot,
-      runId: input.runId,
-      stage: "Validate",
-      detail: "Rig validation accepted the task run; server will continue PR/review/merge closeout.",
-      status: "completed"
-    });
-    if (verificationAction && !reviewStarted) {
-      verificationAction.complete("Completion verification checks finished.");
-    }
-    if (!reviewAction) {
-      promoteToReviewing("Server-owned closeout is queued.");
-    }
-    if (reviewAction) {
-      reviewAction.complete("Provider work accepted; server-owned closeout requested.");
-    }
-    const requestedAt = new Date().toISOString();
-    setRunStatusOrFail(context.projectRoot, input.runId, "closing-out", { reason: "server-closeout-requested" });
-    patchAuthorityRun(context.projectRoot, input.runId, {
-      completedAt: null,
-      errorText: null,
-      serverCloseout: {
-        status: "pending",
-        phase: "queued",
-        updatedAt: requestedAt,
-        runtimeWorkspace: latestRuntimeWorkspace,
-        branch: latestRuntimeBranch,
-        taskId: input.taskId ?? runtimeTaskId
-      }
-    });
-    appendRunLog(context.projectRoot, input.runId, {
-      id: `log:${input.runId}:server-closeout-requested`,
-      title: "Server-owned closeout requested",
-      detail: "The CLI provider worker finished validation and handed commit/PR/review/merge closeout back to the Rig server.",
-      tone: "info",
-      status: "reviewing",
-      createdAt: requestedAt,
-      payload: { runtimeWorkspace: latestRuntimeWorkspace, branch: latestRuntimeBranch }
-    });
-    emitServerRunEvent({ type: "log", runId: input.runId, title: "Server-owned closeout requested" });
-    emitServerRunEvent({ type: "status", runId: input.runId, status: "closing-out", detail: "Server-owned closeout requested.", ...sessionAnchor() });
-    await context.emitEvent("command.finished", {
-      command: [
-        "rig",
-        "server",
-        "task-run",
-        ...input.taskId ? ["--task", input.taskId] : [],
-        ...input.title ? ["--title", input.title] : []
-      ],
-      formattedCommand: input.taskId ? `rig server task-run --task ${input.taskId}` : `rig server task-run --title ${JSON.stringify(input.title ?? `Run ${input.runId}`)}`,
-      exitCode: 0,
-      durationMs: 0,
-      startedAt,
-      finishedAt: requestedAt
-    });
-    process.exit(0);
-  }
-  const runPiPrFeedbackFix = async (message) => {
-    appendPiStageLog({
-      projectRoot: context.projectRoot,
-      runId: input.runId,
-      stage: "Implement",
-      detail: "Pi is applying PR review/CI feedback.",
-      status: "running"
-    });
-    appendRunLog(context.projectRoot, input.runId, {
-      id: `log:${input.runId}:pr-feedback-pi:${Date.now()}`,
-      title: "Steering Pi from PR feedback",
-      detail: message,
-      tone: "info",
-      status: "reviewing",
-      createdAt: new Date().toISOString()
-    });
-    emitServerRunEvent({ type: "log", runId: input.runId, title: "Steering Pi from PR feedback" });
-    const feedbackCommand = buildHostAgentCommand(message);
-    const child = spawn(feedbackCommand[0], feedbackCommand.slice(1), {
-      cwd: latestRuntimeWorkspace ?? context.projectRoot,
-      env: childEnv,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    if (input.runtimeAdapter === "claude-code" || input.runtimeAdapter === "pi") {
-      child.stdin.write(message);
-    }
-    child.stdin.end();
-    const feedbackAssistantMessageId = `message:${input.runId}:pr-feedback:${Date.now()}:assistant`;
-    let feedbackAssistantText = "";
-    const feedbackPendingToolUses = new Map;
-    const stdout = createLineInterface({ input: child.stdout });
-    stdout.on("line", (line) => {
-      const trimmed = line.trim();
-      if (!trimmed)
-        return;
-      try {
-        const record = JSON.parse(trimmed);
-        const providerLogs = buildClaudeLogsFromRecord({
-          runId: input.runId,
-          record,
-          createdAtFallback: new Date().toISOString(),
-          status: "reviewing",
-          pendingToolUses: feedbackPendingToolUses
-        });
-        for (const providerLog of providerLogs) {
-          appendRunLog(context.projectRoot, input.runId, providerLog);
-          appendToolTimelineFromLog({ projectRoot: context.projectRoot, runId: input.runId, log: providerLog });
-          emitServerRunEvent({ type: "log", runId: input.runId, title: providerLog.title });
-          if (providerLog.title === "Tool activity")
-            emitServerRunEvent({ type: "timeline", runId: input.runId });
-        }
-        const nextFeedbackAssistantText = appendAssistantTimelineFromRecord({
-          projectRoot: context.projectRoot,
-          runId: input.runId,
-          messageId: feedbackAssistantMessageId,
-          record,
-          assistantText: feedbackAssistantText
-        });
-        const hadAssistantDelta = nextFeedbackAssistantText !== feedbackAssistantText;
-        if (hadAssistantDelta) {
-          feedbackAssistantText = nextFeedbackAssistantText;
-          emitServerRunEvent({ type: "timeline", runId: input.runId });
-        }
-        if (providerLogs.length > 0 || hadAssistantDelta)
-          return;
-      } catch {}
-      appendRunLog(context.projectRoot, input.runId, {
-        id: nextRunLogId(),
-        title: "Pi PR feedback fix output",
-        detail: trimmed,
-        tone: "info",
-        status: "reviewing",
-        createdAt: new Date().toISOString()
-      });
-      emitServerRunEvent({ type: "log", runId: input.runId, title: "Pi PR feedback fix output" });
-    });
-    const stderr = createLineInterface({ input: child.stderr });
-    stderr.on("line", (line) => {
-      const trimmed = line.trim();
-      if (!trimmed)
-        return;
-      appendRunLog(context.projectRoot, input.runId, {
-        id: nextRunLogId(),
-        title: "Pi PR feedback fix stderr",
-        detail: trimmed,
-        tone: "error",
-        status: "reviewing",
-        createdAt: new Date().toISOString()
-      });
-      emitServerRunEvent({ type: "log", runId: input.runId, title: "Pi PR feedback fix stderr" });
-    });
-    const exitCode = await new Promise((resolve7) => {
-      child.once("error", () => resolve7(1));
-      child.once("close", (code) => resolve7(code ?? 1));
-    });
-    for (const pendingLog of flushPendingClaudeToolUseLogs({
-      runId: input.runId,
-      status: exitCode === 0 ? "completed" : "failed",
-      pendingToolUses: feedbackPendingToolUses
-    })) {
-      appendRunLog(context.projectRoot, input.runId, pendingLog);
-      appendToolTimelineFromLog({ projectRoot: context.projectRoot, runId: input.runId, log: pendingLog });
-      emitServerRunEvent({ type: "log", runId: input.runId, title: pendingLog.title });
-      emitServerRunEvent({ type: "timeline", runId: input.runId });
-    }
-    if (feedbackAssistantText.trim()) {
-      appendRunTimeline(context.projectRoot, input.runId, {
-        id: feedbackAssistantMessageId,
-        type: "assistant_message",
-        text: feedbackAssistantText,
-        state: "completed",
-        createdAt: new Date().toISOString(),
-        completedAt: new Date().toISOString()
-      });
-      emitServerRunEvent({ type: "timeline", runId: input.runId });
-    }
-    if (exitCode !== 0) {
-      throw new Error(`Pi PR feedback fix failed with exit code ${exitCode}.`);
-    }
-  };
-  try {
-    appendPiStageLog({
-      projectRoot: context.projectRoot,
-      runId: input.runId,
-      stage: "Validate",
-      detail: "Rig validation accepted the task run.",
-      status: "completed"
-    });
-    const postValidation = await runTaskRunPostValidationLifecycle({
-      projectRoot: context.projectRoot,
-      runId: input.runId,
-      taskId: input.taskId,
-      runtimeTaskId,
-      runtimeWorkspace: latestRuntimeWorkspace,
-      branch: latestRuntimeBranch,
-      config: automationConfig,
-      sourceTask,
-      steerPi: input.runtimeAdapter === "pi" ? runPiPrFeedbackFix : undefined,
-      appendStage: (stage, detail, status, tone) => appendPiStageLog({
-        projectRoot: context.projectRoot,
-        runId: input.runId,
-        stage,
-        detail,
-        status,
-        tone
-      })
-    });
-    if (postValidation.status === "needs_attention") {
-      const failureDetail = postValidation.pr?.actionableFeedback.join(`
-`) || "PR automation needs attention.";
-      const failedAt = new Date().toISOString();
-      setRunStatusOrFail(context.projectRoot, input.runId, "needs-attention", {
-        reason: "pr-automation-needs-attention",
-        errorText: failureDetail
-      });
-      patchAuthorityRun(context.projectRoot, input.runId, { completedAt: failedAt });
-      emitServerRunEvent({ type: "failed", runId: input.runId, error: failureDetail });
-      throw new CliError(failureDetail, 1);
-    }
-  } catch (error) {
-    if (error instanceof CliError) {
-      throw error;
+      await updateRunTaskSourceLifecycle(projectRoot, {
+        runId,
+        taskId,
+        sourceTask,
+        worktreePath: workspace,
+        logRoot: cleanString(input.logRoot),
+        sessionPath: cleanString(input.sessionPath)
+      }, status, summary, options);
     }
-    const failureDetail = `Failed to complete PR/issue closeout for ${input.taskId ?? runtimeTaskId}: ${error instanceof Error ? error.message : String(error)}`;
-    const failedAt = new Date().toISOString();
-    setRunStatusOrFail(context.projectRoot, input.runId, "failed", {
-      reason: "pr-closeout-failed",
-      errorText: failureDetail
-    });
-    patchAuthorityRun(context.projectRoot, input.runId, { completedAt: failedAt });
-    appendRunLog(context.projectRoot, input.runId, {
-      id: `log:${input.runId}:pr-closeout-failed`,
-      title: "PR/issue closeout failed",
-      detail: failureDetail,
-      tone: "error",
-      status: "failed",
-      createdAt: failedAt
-    });
-    emitServerRunEvent({ type: "failed", runId: input.runId, error: failureDetail });
-    throw new CliError(failureDetail, 1);
-  }
-  if (verificationAction && !reviewStarted) {
-    verificationAction.complete("Completion verification checks finished.");
-  }
-  if (!reviewAction) {
-    promoteToReviewing("Task finished; finalizing run state.");
-  }
-  if (reviewAction) {
-    reviewAction.complete("Run marked completed.");
-  }
-  setRunStatusOrFail(context.projectRoot, input.runId, "completed", { reason: "driver-completed" });
-  emitServerRunEvent({ type: "completed", runId: input.runId });
-  await context.emitEvent("command.finished", {
-    command: [
-      "rig",
-      "server",
-      "task-run",
-      ...input.taskId ? ["--task", input.taskId] : [],
-      ...input.title ? ["--title", input.title] : []
-    ],
-    formattedCommand: input.taskId ? `rig server task-run --task ${input.taskId}` : `rig server task-run --title ${JSON.stringify(input.title ?? `Run ${input.runId}`)}`,
-    exitCode: 0,
-    durationMs: 0,
-    startedAt,
-    finishedAt: new Date().toISOString()
   });
+  return {
+    ok: true,
+    runId,
+    taskId,
+    branch,
+    merged: result.status === "merged",
+    closedIssue: result.status === "merged",
+    prUrl: result.prUrl,
+    status: result.status
+  };
+}
+function cleanString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
 }
 export {
   taskRunStageLogId,
@@ -2790,7 +190,6 @@ export {
   runTaskRunPostValidationLifecycle,
   resolveTaskRunAutomationLimits,
   readTaskRunAcceptedArtifactState,
-  executeRigOwnedTaskRun,
   createRunLogIdFactory,
   classifyValidationRetryOutcome,
   classifyPlanningNeed,