@h-rig/runtime 0.0.6-alpha.0

package/dist/src/control-plane/hooks/inject-context.js

@@ -0,0 +1,4189 @@
+#!/usr/bin/env bun
+// @bun
+
+// packages/runtime/src/control-plane/hooks/inject-context.ts
+import { existsSync as existsSync20, readFileSync as readFileSync12 } from "fs";
+import { resolve as resolve21 } from "path";
+import { resolveProjectRoot } from "@rig/hook-kit";
+
+// packages/runtime/src/control-plane/memory-sync/db.ts
+import { Database } from "bun:sqlite";
+import { mkdirSync } from "fs";
+import { dirname } from "path";
+var SCHEMA_STATEMENTS = [
+  `CREATE TABLE IF NOT EXISTS memory_events (
+    event_id TEXT PRIMARY KEY,
+    event_type TEXT NOT NULL,
+    canonical_key TEXT NOT NULL,
+    summary TEXT,
+    kind TEXT,
+    category TEXT,
+    confidence REAL,
+    source_run_id TEXT,
+    source_task_id TEXT,
+    branch TEXT,
+    source_canonical_key TEXT,
+    replacement_canonical_key TEXT,
+    retrieval_query TEXT,
+    retrieval_rank INTEGER,
+    feedback_outcome TEXT,
+    details_json TEXT,
+    created_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS memory_items (
+    canonical_key TEXT PRIMARY KEY,
+    summary TEXT NOT NULL,
+    kind TEXT,
+    category TEXT,
+    status TEXT NOT NULL,
+    confidence REAL NOT NULL,
+    source_run_id TEXT,
+    source_task_id TEXT,
+    branch TEXT,
+    details_json TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    last_event_id TEXT NOT NULL,
+    superseded_by TEXT,
+    embedding TEXT
+  )`,
+  `CREATE TABLE IF NOT EXISTS memory_links (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    from_key TEXT NOT NULL,
+    to_key TEXT NOT NULL,
+    relation TEXT NOT NULL,
+    source_event_id TEXT NOT NULL,
+    created_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS task_runs (
+    run_id TEXT PRIMARY KEY,
+    task_id TEXT,
+    branch TEXT,
+    first_event_id TEXT,
+    last_event_id TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS retrieval_feedback (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    canonical_key TEXT NOT NULL,
+    outcome TEXT NOT NULL,
+    retrieval_rank INTEGER,
+    source_run_id TEXT,
+    source_task_id TEXT,
+    query_text TEXT,
+    source_event_id TEXT NOT NULL,
+    created_at TEXT NOT NULL
+  )`
+];
+var MEMORY_EVENT_COLUMNS = [
+  ["summary", "TEXT"],
+  ["kind", "TEXT"],
+  ["category", "TEXT"],
+  ["confidence", "REAL"],
+  ["source_run_id", "TEXT"],
+  ["source_task_id", "TEXT"],
+  ["branch", "TEXT"],
+  ["source_canonical_key", "TEXT"],
+  ["replacement_canonical_key", "TEXT"],
+  ["retrieval_query", "TEXT"],
+  ["retrieval_rank", "INTEGER"],
+  ["feedback_outcome", "TEXT"],
+  ["details_json", "TEXT"]
+];
+var MEMORY_ITEM_COLUMNS = [
+  ["kind", "TEXT"],
+  ["category", "TEXT"],
+  ["branch", "TEXT"],
+  ["details_json", "TEXT"],
+  ["superseded_by", "TEXT"],
+  ["embedding", "TEXT"]
+];
+function parseJsonRecord(value) {
+  if (typeof value !== "string" || value.length === 0) {
+    return null;
+  }
+  return JSON.parse(value);
+}
+function parseEmbedding(value) {
+  if (typeof value !== "string" || value.length === 0) {
+    return null;
+  }
+  return JSON.parse(value);
+}
+function rowString(row, key) {
+  const value = row[key];
+  return value == null ? null : String(value);
+}
+function normalizeStatement(statement, args) {
+  if (typeof statement === "string") {
+    return { sql: statement, args };
+  }
+  return {
+    sql: statement.sql,
+    args: statement.args ?? args
+  };
+}
+function normalizeBindings(bindings) {
+  return (bindings ?? []).map((binding) => binding === undefined ? null : binding);
+}
+function statementVerb(sql) {
+  const match = sql.trim().match(/^[A-Za-z]+/);
+  return match ? match[0].toUpperCase() : "";
+}
+function isMutationStatement(sql) {
+  return new Set([
+    "ALTER",
+    "ATTACH",
+    "BEGIN",
+    "COMMIT",
+    "CREATE",
+    "DELETE",
+    "DETACH",
+    "DROP",
+    "END",
+    "INSERT",
+    "REINDEX",
+    "RELEASE",
+    "REPLACE",
+    "ROLLBACK",
+    "SAVEPOINT",
+    "UPDATE",
+    "VACUUM"
+  ]).has(statementVerb(sql));
+}
+function executeSqlite(sqlite, statement, args) {
+  const normalized = normalizeStatement(statement, args);
+  const bindings = normalizeBindings(normalized.args);
+  if (isMutationStatement(normalized.sql)) {
+    const result = bindings.length > 0 ? sqlite.run(normalized.sql, ...bindings) : sqlite.run(normalized.sql);
+    return {
+      rows: [],
+      rowsAffected: Number(result.changes)
+    };
+  }
+  const query = sqlite.query(normalized.sql);
+  const rows = bindings.length > 0 ? query.all(...bindings) : query.all();
+  return {
+    rows,
+    rowsAffected: 0
+  };
+}
+function createTransaction(sqlite, mode) {
+  sqlite.run(mode === "write" ? "BEGIN IMMEDIATE" : "BEGIN");
+  let active = true;
+  return {
+    async execute(statement, args) {
+      if (!active) {
+        throw new Error("memory transaction is closed");
+      }
+      return executeSqlite(sqlite, statement, args);
+    },
+    async commit() {
+      if (!active) {
+        return;
+      }
+      sqlite.run("COMMIT");
+      active = false;
+    },
+    async rollback() {
+      if (!active) {
+        return;
+      }
+      sqlite.run("ROLLBACK");
+      active = false;
+    },
+    close() {
+      if (!active) {
+        return;
+      }
+      try {
+        sqlite.run("ROLLBACK");
+      } catch {} finally {
+        active = false;
+      }
+    }
+  };
+}
+function createMemoryDbClient(sqlite) {
+  return {
+    async execute(statement, args) {
+      return executeSqlite(sqlite, statement, args);
+    },
+    async transaction(mode) {
+      return createTransaction(sqlite, mode);
+    },
+    close() {
+      sqlite.close();
+    }
+  };
+}
+async function listColumns(executor, tableName) {
+  const result = await executor.execute(`PRAGMA table_info(${tableName})`);
+  return new Set(result.rows.map((row) => String(row.name)));
+}
+async function ensureColumns(executor, tableName, columns) {
+  const existing = await listColumns(executor, tableName);
+  for (const [columnName, definition] of columns) {
+    if (!existing.has(columnName)) {
+      await executor.execute(`ALTER TABLE ${tableName} ADD COLUMN ${columnName} ${definition}`);
+    }
+  }
+}
+async function ensureSchema(db) {
+  for (const statement of SCHEMA_STATEMENTS) {
+    await db.client.execute(statement);
+  }
+  await ensureColumns(db.client, "memory_events", MEMORY_EVENT_COLUMNS);
+  await ensureColumns(db.client, "memory_items", MEMORY_ITEM_COLUMNS);
+}
+function toMemoryItemRow(row) {
+  return {
+    canonicalKey: String(row.canonical_key),
+    summary: String(row.summary),
+    kind: rowString(row, "kind"),
+    category: rowString(row, "category"),
+    status: String(row.status),
+    confidence: Number(row.confidence),
+    sourceRunId: rowString(row, "source_run_id"),
+    sourceTaskId: rowString(row, "source_task_id"),
+    branch: rowString(row, "branch"),
+    details: parseJsonRecord(row.details_json),
+    createdAt: String(row.created_at),
+    updatedAt: String(row.updated_at),
+    lastEventId: String(row.last_event_id),
+    supersededBy: rowString(row, "superseded_by"),
+    embedding: parseEmbedding(row.embedding)
+  };
+}
+async function openMemoryDb(dbPath) {
+  mkdirSync(dirname(dbPath), { recursive: true });
+  const sqlite = new Database(dbPath, { create: true, strict: true });
+  const client = createMemoryDbClient(sqlite);
+  const db = {
+    path: dbPath,
+    client,
+    async close() {
+      client.close();
+    }
+  };
+  await ensureSchema(db);
+  return db;
+}
+async function listActiveMemoryItems(db) {
+  const result = await db.client.execute(`
+    SELECT
+      canonical_key,
+      summary,
+      kind,
+      category,
+      status,
+      confidence,
+      source_run_id,
+      source_task_id,
+      branch,
+      details_json,
+      created_at,
+      updated_at,
+      last_event_id,
+      superseded_by,
+      embedding
+    FROM memory_items
+    WHERE status = 'active'
+    ORDER BY canonical_key
+  `);
+  return result.rows.map((row) => toMemoryItemRow(row));
+}
+
+// packages/runtime/src/control-plane/memory-sync/embed.ts
+import { createHash } from "crypto";
+var DEFAULT_EMBEDDING_API_BASE_URL = "https://api.openai.com/v1";
+var DEFAULT_EMBEDDING_MODEL = "text-embedding-3-small";
+var DETERMINISTIC_EMBEDDER_MODE = "deterministic";
+var DETERMINISTIC_VECTOR_DIMS = 32;
+function tokenizeForDeterministicEmbedding(text) {
+  const tokens = text.toLowerCase().match(/[a-z0-9_./:-]+/g) ?? [];
+  return tokens.length > 0 ? tokens : [text.toLowerCase()];
+}
+function deterministicTokenVector(token) {
+  const hash = createHash("sha256").update(token).digest();
+  const vector = new Array(DETERMINISTIC_VECTOR_DIMS).fill(0);
+  for (let index = 0;index < 8; index += 1) {
+    const slot = (hash[index] ?? 0) % DETERMINISTIC_VECTOR_DIMS;
+    const sign = ((hash[index + 8] ?? 0) & 1) === 0 ? 1 : -1;
+    const magnitude = ((hash[index + 16] ?? 0) + 1) / 256;
+    vector[slot] = (vector[slot] ?? 0) + sign * magnitude;
+  }
+  return vector;
+}
+function normalizeVector(vector) {
+  const norm = Math.sqrt(vector.reduce((sum, value) => sum + value * value, 0));
+  if (norm === 0) {
+    return vector.map(() => 0);
+  }
+  return vector.map((value) => Number((value / norm).toFixed(6)));
+}
+function createDeterministicMemoryEmbedder() {
+  return {
+    async embed(texts) {
+      return texts.map((text) => {
+        const vector = new Array(DETERMINISTIC_VECTOR_DIMS).fill(0);
+        for (const token of tokenizeForDeterministicEmbedding(text)) {
+          const tokenVector = deterministicTokenVector(token);
+          for (let index = 0;index < tokenVector.length; index += 1) {
+            vector[index] = (vector[index] ?? 0) + (tokenVector[index] ?? 0);
+          }
+        }
+        return normalizeVector(vector);
+      });
+    }
+  };
+}
+function embeddingResponseMessage(payload, status) {
+  if (typeof payload === "object" && payload !== null) {
+    const maybeMessage = payload.error?.message;
+    if (maybeMessage) {
+      return maybeMessage;
+    }
+  }
+  return `memory embedding request failed with status ${status}`;
+}
+function createOpenAiMemoryEmbedder(options) {
+  const apiKey = options.apiKey.trim();
+  const model = options.model?.trim() || DEFAULT_EMBEDDING_MODEL;
+  const apiBaseUrl = (options.apiBaseUrl?.trim() || DEFAULT_EMBEDDING_API_BASE_URL).replace(/\/+$/, "");
+  const fetchImpl = options.fetchImpl ?? fetch;
+  if (!apiKey) {
+    throw new Error("memory embedding api key must be non-empty");
+  }
+  return {
+    async embed(texts) {
+      if (texts.length === 0) {
+        return [];
+      }
+      const response = await fetchImpl(`${apiBaseUrl}/embeddings`, {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${apiKey}`,
+          "content-type": "application/json"
+        },
+        body: JSON.stringify({
+          input: texts,
+          model
+        })
+      });
+      const payload = await response.json();
+      if (!response.ok) {
+        throw new Error(embeddingResponseMessage(payload, response.status));
+      }
+      if (!Array.isArray(payload.data) || payload.data.length !== texts.length) {
+        throw new Error(`memory embedding provider returned ${payload.data?.length ?? 0} embeddings for ${texts.length} inputs`);
+      }
+      const byIndex = new Map;
+      for (const row of payload.data) {
+        if (typeof row.index !== "number" || !Array.isArray(row.embedding)) {
+          throw new Error("memory embedding provider returned an invalid response payload");
+        }
+        byIndex.set(row.index, row.embedding);
+      }
+      return texts.map((_text, index) => {
+        const embedding = byIndex.get(index);
+        if (!embedding) {
+          throw new Error(`memory embedding provider omitted embedding ${index}`);
+        }
+        return embedding;
+      });
+    }
+  };
+}
+function createConfiguredMemoryEmbedder(options = {}) {
+  const env = options.env ?? process.env;
+  const mode = env.RIG_MEMORY_EMBEDDER?.trim();
+  if (mode === DETERMINISTIC_EMBEDDER_MODE) {
+    return createDeterministicMemoryEmbedder();
+  }
+  const apiKey = env.OPENAI_API_KEY?.trim();
+  if (!apiKey) {
+    throw new Error("memory embeddings require OPENAI_API_KEY or RIG_MEMORY_EMBEDDER=deterministic");
+  }
+  return createOpenAiMemoryEmbedder({
+    apiKey,
+    model: env.RIG_MEMORY_EMBEDDING_MODEL?.trim() || DEFAULT_EMBEDDING_MODEL,
+    apiBaseUrl: options.apiBaseUrl ?? env.RIG_MEMORY_EMBEDDING_API_BASE_URL?.trim() ?? DEFAULT_EMBEDDING_API_BASE_URL,
+    fetchImpl: options.fetchImpl
+  });
+}
+
+// packages/runtime/src/control-plane/runtime/context.ts
+import { existsSync, mkdirSync as mkdirSync2, readFileSync, writeFileSync } from "fs";
+import { dirname as dirname2, resolve } from "path";
+var RUNTIME_CONTEXT_ENV = "RIG_RUNTIME_CONTEXT_FILE";
+var DEFAULT_RUNTIME_MEMORY_RETRIEVAL = {
+  topK: 5,
+  lexicalWeight: 0.35,
+  vectorWeight: 0.45,
+  recencyWeight: 0.1,
+  confidenceWeight: 0.1
+};
+var runtimeContextStringFields = [
+  "runtimeId",
+  "taskId",
+  "role",
+  "workspaceDir",
+  "stateDir",
+  "logsDir",
+  "sessionDir",
+  "sessionFile",
+  "policyFile",
+  "binDir",
+  "createdAt"
+];
+var runtimeContextArrayFields = ["scopes", "validation"];
+var runtimeContextOptionalStringFields = [
+  "artifactRoot",
+  "hostProjectRoot",
+  "monorepoMainRoot",
+  "monorepoBaseRef",
+  "monorepoBaseCommit"
+];
+function loadRuntimeContext(path) {
+  const absPath = resolve(path);
+  if (!existsSync(absPath)) {
+    throw new Error(`RuntimeTaskContext file not found: ${absPath}`);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(absPath, "utf8"));
+  } catch (err) {
+    throw new Error(`Failed to parse RuntimeTaskContext at ${absPath}: ${String(err)}`);
+  }
+  if (typeof raw !== "object" || raw === null) {
+    throw new Error(`RuntimeTaskContext at ${absPath} is not an object`);
+  }
+  const obj = raw;
+  for (const field of runtimeContextStringFields) {
+    if (typeof obj[field] !== "string" || obj[field].length === 0) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a non-empty string (at ${absPath})`);
+    }
+  }
+  for (const field of runtimeContextArrayFields) {
+    if (!Array.isArray(obj[field])) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be an array (at ${absPath})`);
+    }
+    if (!obj[field].every((entry) => typeof entry === "string")) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a string[] (at ${absPath})`);
+    }
+  }
+  for (const field of runtimeContextOptionalStringFields) {
+    if (field in obj && obj[field] !== undefined && typeof obj[field] !== "string") {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a string when present (at ${absPath})`);
+    }
+  }
+  if (obj.browser !== undefined) {
+    if (typeof obj.browser !== "object" || obj.browser === null || Array.isArray(obj.browser)) {
+      throw new Error(`RuntimeTaskContext field "browser" must be an object when present (at ${absPath})`);
+    }
+    const browser = obj.browser;
+    for (const field of [
+      "preset",
+      "mode",
+      "stateDir",
+      "defaultProfile",
+      "effectiveProfile",
+      "defaultAttachUrl",
+      "effectiveAttachUrl",
+      "launchHelper",
+      "checkHelper",
+      "attachInfoHelper",
+      "e2eHelper",
+      "resetProfileHelper"
+    ]) {
+      if (typeof browser[field] !== "string" || browser[field].length === 0) {
+        throw new Error(`RuntimeTaskContext field "browser.${field}" must be a non-empty string (at ${absPath})`);
+      }
+    }
+    for (const field of ["devCommand", "launchCommand", "checkCommand", "e2eCommand"]) {
+      if (browser[field] !== undefined && typeof browser[field] !== "string") {
+        throw new Error(`RuntimeTaskContext field "browser.${field}" must be a string when present (at ${absPath})`);
+      }
+    }
+    if (typeof browser.required !== "boolean") {
+      throw new Error(`RuntimeTaskContext field "browser.required" must be a boolean (at ${absPath})`);
+    }
+  }
+  if (obj.memory !== undefined) {
+    if (typeof obj.memory !== "object" || obj.memory === null || Array.isArray(obj.memory)) {
+      throw new Error(`RuntimeTaskContext field "memory" must be an object when present (at ${absPath})`);
+    }
+    const memory = obj.memory;
+    for (const field of ["canonicalPath", "canonicalRef", "canonicalBaseOid", "hydratedPath"]) {
+      if (typeof memory[field] !== "string" || memory[field].length === 0) {
+        throw new Error(`RuntimeTaskContext field "memory.${field}" must be a non-empty string (at ${absPath})`);
+      }
+    }
+    if (typeof memory.createdFresh !== "boolean") {
+      throw new Error(`RuntimeTaskContext field "memory.createdFresh" must be a boolean (at ${absPath})`);
+    }
+    if (typeof memory.retrieval !== "object" || memory.retrieval === null || Array.isArray(memory.retrieval)) {
+      throw new Error(`RuntimeTaskContext field "memory.retrieval" must be an object (at ${absPath})`);
+    }
+    const retrieval = memory.retrieval;
+    for (const field of ["topK", "lexicalWeight", "vectorWeight", "recencyWeight", "confidenceWeight"]) {
+      if (typeof retrieval[field] !== "number" || Number.isNaN(retrieval[field])) {
+        throw new Error(`RuntimeTaskContext field "memory.retrieval.${field}" must be a number (at ${absPath})`);
+      }
+    }
+  }
+  if (obj.initialDirtyFiles !== undefined) {
+    if (typeof obj.initialDirtyFiles !== "object" || obj.initialDirtyFiles === null || Array.isArray(obj.initialDirtyFiles)) {
+      throw new Error(`RuntimeTaskContext field "initialDirtyFiles" must be an object when present (at ${absPath})`);
+    }
+    const dirtyFiles = obj.initialDirtyFiles;
+    for (const key of ["project", "monorepo"]) {
+      if (dirtyFiles[key] === undefined) {
+        continue;
+      }
+      if (!Array.isArray(dirtyFiles[key]) || !dirtyFiles[key].every((entry) => typeof entry === "string")) {
+        throw new Error(`RuntimeTaskContext field "initialDirtyFiles.${key}" must be a string[] when present (at ${absPath})`);
+      }
+    }
+  }
+  if (obj.initialHeadCommits !== undefined) {
+    if (typeof obj.initialHeadCommits !== "object" || obj.initialHeadCommits === null || Array.isArray(obj.initialHeadCommits)) {
+      throw new Error(`RuntimeTaskContext field "initialHeadCommits" must be an object when present (at ${absPath})`);
+    }
+    const headCommits = obj.initialHeadCommits;
+    for (const key of ["project", "monorepo"]) {
+      if (headCommits[key] === undefined) {
+        continue;
+      }
+      if (typeof headCommits[key] !== "string") {
+        throw new Error(`RuntimeTaskContext field "initialHeadCommits.${key}" must be a string when present (at ${absPath})`);
+      }
+    }
+  }
+  return obj;
+}
+function loadRuntimeContextFromEnv(env = process.env) {
+  const contextFile = env[RUNTIME_CONTEXT_ENV];
+  if (contextFile) {
+    return loadRuntimeContext(contextFile);
+  }
+  const inferred = findRuntimeContextFile(process.cwd());
+  if (!inferred) {
+    return null;
+  }
+  return loadRuntimeContext(inferred);
+}
+function findRuntimeContextFile(startPath) {
+  let current = resolve(startPath);
+  while (true) {
+    const candidate = resolve(current, "runtime-context.json");
+    if (existsSync(candidate) && isAgentRuntimeContextPath(candidate)) {
+      return candidate;
+    }
+    const parent = dirname2(current);
+    if (parent === current) {
+      return "";
+    }
+    current = parent;
+  }
+}
+function isAgentRuntimeContextPath(path) {
+  const normalized = path.replace(/\\/g, "/");
+  return /\/\.rig\/runtime-context\.json$/.test(normalized);
+}
+
+// packages/runtime/src/control-plane/memory-sync/query.ts
+var DEFAULT_RESULT_LIMIT = DEFAULT_RUNTIME_MEMORY_RETRIEVAL.topK;
+var DAY_MS = 24 * 60 * 60 * 1000;
+var MIN_VECTOR_MATCH_SCORE = 0.2;
+function tokenize(text) {
+  return (text.toLowerCase().match(/[a-z0-9_./:-]+/g) ?? []).flatMap((token) => {
+    const split = token.split(/[./:_-]+/).filter(Boolean);
+    return split.length > 0 ? [token, ...split] : [token];
+  });
+}
+function lexicalScore(query, item) {
+  const queryTokens = [...new Set(tokenize(query))];
+  if (queryTokens.length === 0) {
+    return 0;
+  }
+  const haystackTokens = new Set(tokenize(item.summary));
+  let matched = 0;
+  for (const token of queryTokens) {
+    if (haystackTokens.has(token)) {
+      matched += 1;
+    }
+  }
+  return matched / queryTokens.length;
+}
+function cosineSimilarity(left, right) {
+  if (left.length === 0 || left.length !== right.length) {
+    return 0;
+  }
+  let dot = 0;
+  let leftNorm = 0;
+  let rightNorm = 0;
+  for (let index = 0;index < left.length; index += 1) {
+    const l = left[index] ?? 0;
+    const r = right[index] ?? 0;
+    dot += l * r;
+    leftNorm += l * l;
+    rightNorm += r * r;
+  }
+  if (leftNorm === 0 || rightNorm === 0) {
+    return 0;
+  }
+  return dot / Math.sqrt(leftNorm * rightNorm);
+}
+function recencyScore(item, now) {
+  const updatedAt = Date.parse(item.updatedAt);
+  if (Number.isNaN(updatedAt)) {
+    return 0;
+  }
+  const ageMs = Math.max(0, now.getTime() - updatedAt);
+  return 1 / (1 + ageMs / DAY_MS);
+}
+async function maybeEmbedQuery(items, query, embedder) {
+  if (!items.some((item) => Array.isArray(item.embedding) && item.embedding.length > 0)) {
+    return null;
+  }
+  try {
+    const resolvedEmbedder = embedder ?? createConfiguredMemoryEmbedder();
+    const [queryEmbedding] = await resolvedEmbedder.embed([query]);
+    return queryEmbedding ?? null;
+  } catch {
+    return null;
+  }
+}
+async function queryRelevantMemory(db, input) {
+  const retrieval = input.retrieval ?? DEFAULT_RUNTIME_MEMORY_RETRIEVAL;
+  const now = input.now instanceof Date ? input.now : new Date(input.now ?? Date.now());
+  const items = await listActiveMemoryItems(db);
+  if (items.length === 0) {
+    return [];
+  }
+  const queryEmbedding = await maybeEmbedQuery(items, input.query, input.embedder);
+  const scored = items.map((item) => {
+    const lexical = lexicalScore(input.query, item);
+    const vector = queryEmbedding && item.embedding ? cosineSimilarity(queryEmbedding, item.embedding) : 0;
+    const recency = recencyScore(item, now);
+    const score = retrieval.lexicalWeight * lexical + retrieval.vectorWeight * vector + retrieval.recencyWeight * recency + retrieval.confidenceWeight * item.confidence;
+    return {
+      canonicalKey: item.canonicalKey,
+      summary: item.summary,
+      kind: item.kind,
+      category: item.category,
+      confidence: item.confidence,
+      updatedAt: item.updatedAt,
+      score,
+      lexicalScore: lexical,
+      vectorScore: vector,
+      recencyScore: recency
+    };
+  }).filter((item) => item.lexicalScore > 0 || item.vectorScore >= MIN_VECTOR_MATCH_SCORE).sort((left, right) => right.score - left.score || Date.parse(right.updatedAt) - Date.parse(left.updatedAt) || right.confidence - left.confidence || left.canonicalKey.localeCompare(right.canonicalKey));
+  return scored.slice(0, input.limit ?? retrieval.topK ?? DEFAULT_RESULT_LIMIT);
+}
+function formatMemoryQueryResults(results) {
+  if (results.length === 0) {
+    return "No shared memories matched.";
+  }
+  return results.map((result, index) => `${index + 1}. [${result.canonicalKey}] ${result.summary} (confidence ${result.confidence.toFixed(2)})`).join(`
+`);
+}
+
+// packages/runtime/src/control-plane/native/profile-ops.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync4, writeFileSync as writeFileSync2 } from "fs";
+
+// packages/runtime/src/control-plane/native/utils.ts
+import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve4 } from "path";
+
+// packages/runtime/src/layout.ts
+import { existsSync as existsSync2 } from "fs";
+import { basename, dirname as dirname3, resolve as resolve2 } from "path";
+var RIG_DEFINITION_DIRNAME = "rig";
+var RIG_ARTIFACTS_DIRNAME = "artifacts";
+function resolveMonorepoRoot(projectRoot) {
+  const normalizedProjectRoot = resolve2(projectRoot);
+  const explicit = process.env.MONOREPO_ROOT?.trim();
+  if (explicit) {
+    const explicitRoot = resolve2(explicit);
+    const explicitParent = dirname3(explicitRoot);
+    if (basename(explicitParent) === ".worktrees") {
+      const owner = dirname3(explicitParent);
+      const ownerHasGit = existsSync2(resolve2(owner, ".git"));
+      const ownerHasTaskConfig = existsSync2(resolve2(owner, ".rig", "task-config.json"));
+      const ownerHasRigConfig = existsSync2(resolve2(owner, "rig.config.ts"));
+      if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
+        return owner;
+      }
+      throw new Error(`MONOREPO_ROOT points to worktree ${explicitRoot}, but the owner checkout is incomplete at ${owner}.`);
+    }
+    if (!existsSync2(resolve2(explicitRoot, ".git"))) {
+      throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but no git checkout was found there.`);
+    }
+    const hasTaskConfig = existsSync2(resolve2(explicitRoot, ".rig", "task-config.json"));
+    const hasRigConfig = existsSync2(resolve2(explicitRoot, "rig.config.ts"));
+    if (!hasTaskConfig && !hasRigConfig) {
+      throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but neither .rig/task-config.json nor rig.config.ts exists there.`);
+    }
+    return explicitRoot;
+  }
+  const projectParent = dirname3(normalizedProjectRoot);
+  if (basename(projectParent) === ".worktrees") {
+    const worktreeOwner = dirname3(projectParent);
+    const ownerHasGit = existsSync2(resolve2(worktreeOwner, ".git"));
+    const ownerHasTaskConfig = existsSync2(resolve2(worktreeOwner, ".rig", "task-config.json"));
+    const ownerHasRigConfig = existsSync2(resolve2(worktreeOwner, "rig.config.ts"));
+    if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
+      return worktreeOwner;
+    }
+  }
+  return normalizedProjectRoot;
+}
+function resolveRuntimeWorkspaceLayout(workspaceDir) {
+  const root = resolve2(workspaceDir);
+  const rigRoot = resolve2(root, ".rig");
+  const logsDir = resolve2(rigRoot, "logs");
+  const stateDir = resolve2(rigRoot, "state");
+  const runtimeDir = resolve2(rigRoot, "runtime");
+  const binDir = resolve2(rigRoot, "bin");
+  return {
+    workspaceDir: root,
+    rigRoot,
+    stateDir,
+    logsDir,
+    artifactsRoot: resolve2(root, RIG_ARTIFACTS_DIRNAME),
+    runtimeDir,
+    homeDir: resolve2(rigRoot, "home"),
+    tmpDir: resolve2(rigRoot, "tmp"),
+    cacheDir: resolve2(rigRoot, "cache"),
+    sessionDir: resolve2(rigRoot, "session"),
+    binDir,
+    distDir: resolve2(rigRoot, "dist"),
+    pluginBinDir: resolve2(binDir, "plugins"),
+    contextPath: resolve2(rigRoot, "runtime-context.json"),
+    controlPlaneEventsFile: resolve2(logsDir, "control-plane.events.jsonl")
+  };
+}
+function resolveActiveRuntimeWorkspaceRoot(monorepoRoot) {
+  const explicit = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (!explicit) {
+    throw new Error("No active runtime workspace. Set RIG_TASK_WORKSPACE or provision a task runtime first.");
+  }
+  return resolve2(explicit);
+}
+function resolveRigLayout(projectRoot) {
+  const monorepoRoot = resolveMonorepoRoot(projectRoot);
+  const definitionRoot = resolve2(projectRoot, RIG_DEFINITION_DIRNAME);
+  const runtimeWorkspaceRoot = resolveActiveRuntimeWorkspaceRoot(monorepoRoot);
+  const runtimeLayout = resolveRuntimeWorkspaceLayout(runtimeWorkspaceRoot);
+  const policyDir = resolve2(definitionRoot, "policy");
+  return {
+    projectRoot,
+    monorepoRoot,
+    definitionRoot,
+    runtimeWorkspaceRoot,
+    stateRoot: runtimeLayout.rigRoot,
+    artifactsRoot: runtimeLayout.artifactsRoot,
+    configPath: resolve2(definitionRoot, "config.sh"),
+    taskConfigPath: resolve2(runtimeWorkspaceRoot, ".rig", "task-config.json"),
+    policyDir,
+    policyFile: resolve2(policyDir, "policy.json"),
+    pluginsDir: resolve2(definitionRoot, "plugins"),
+    hooksDir: resolve2(definitionRoot, "hooks"),
+    toolsDir: resolve2(definitionRoot, "tools"),
+    templatesDir: resolve2(definitionRoot, "templates"),
+    validationDir: resolve2(definitionRoot, "validation"),
+    stateDir: runtimeLayout.stateDir,
+    logsDir: runtimeLayout.logsDir,
+    notificationsDir: resolve2(definitionRoot, "notifications"),
+    runtimeDir: runtimeLayout.runtimeDir,
+    distDir: runtimeLayout.distDir,
+    binDir: runtimeLayout.binDir,
+    pluginBinDir: runtimeLayout.pluginBinDir,
+    keybindingsPath: resolve2(definitionRoot, "keybindings.json"),
+    controlPlaneEventsFile: runtimeLayout.controlPlaneEventsFile
+  };
+}
+
+// packages/runtime/src/control-plane/native/runtime-native.ts
+import { dlopen, ptr, suffix, toBuffer } from "bun:ffi";
+import { copyFileSync, existsSync as existsSync3, mkdirSync as mkdirSync3, renameSync, rmSync, statSync } from "fs";
+import { tmpdir } from "os";
+import { dirname as dirname4, resolve as resolve3 } from "path";
+var sharedNativeRuntimeOutputDir = resolve3(tmpdir(), "rig-native");
+var sharedNativeRuntimeOutputPath = resolve3(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
+var colocatedNativeRuntimeFileName = `runtime-native.${suffix}`;
+var nativeRuntimeLibrary = await loadNativeRuntimeLibrary();
+async function ensureNativeRuntimeLibraryPath(outputPath = sharedNativeRuntimeOutputPath, options = {}) {
+  if (await buildNativeRuntimeLibrary(outputPath, options)) {
+    return outputPath;
+  }
+  return !options.force && existsSync3(outputPath) ? outputPath : null;
+}
+async function loadNativeRuntimeLibrary() {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return null;
+  }
+  for (const candidate of nativeRuntimeLibraryCandidates()) {
+    if (!candidate || !existsSync3(candidate)) {
+      continue;
+    }
+    const loaded = tryDlopenNativeRuntimeLibrary(candidate);
+    if (loaded) {
+      return loaded;
+    }
+  }
+  const builtLibraryPath = await ensureNativeRuntimeLibraryPath(sharedNativeRuntimeOutputPath, { force: true });
+  if (!builtLibraryPath) {
+    return null;
+  }
+  return tryDlopenNativeRuntimeLibrary(builtLibraryPath);
+}
+function nativePackageLibraryCandidates(fromDir, names) {
+  const candidates = [];
+  let cursor = resolve3(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    for (const name of names) {
+      candidates.push(resolve3(cursor, "native", `${process.platform}-${process.arch}`, name), resolve3(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve3(cursor, "native", name), resolve3(cursor, "native", "lib", name));
+    }
+    const parent = dirname4(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function nativeRuntimeLibraryCandidates() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_LIB?.trim() || "";
+  const execDir = process.execPath?.trim() ? dirname4(process.execPath.trim()) : "";
+  const platformSpecific = `runtime-native-${process.platform}-${process.arch}.${suffix}`;
+  return [...new Set([
+    explicit,
+    ...nativePackageLibraryCandidates(import.meta.dir, [colocatedNativeRuntimeFileName, platformSpecific]),
+    execDir ? resolve3(execDir, colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve3(execDir, platformSpecific) : "",
+    execDir ? resolve3(execDir, "..", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve3(execDir, "..", platformSpecific) : "",
+    execDir ? resolve3(execDir, "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve3(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
+    sharedNativeRuntimeOutputPath
+  ].filter(Boolean))];
+}
+function resolveNativeRuntimeSourcePath() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_SOURCE?.trim();
+  if (explicit && existsSync3(explicit)) {
+    return explicit;
+  }
+  const bundled = resolve3(import.meta.dir, "../../../native/snapshot.zig");
+  return existsSync3(bundled) ? bundled : null;
+}
+async function buildNativeRuntimeLibrary(outputPath, options = {}) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return false;
+  }
+  const zigBinary = Bun.which("zig");
+  const sourcePath = resolveNativeRuntimeSourcePath();
+  if (!zigBinary || !sourcePath) {
+    return false;
+  }
+  const tempOutputPath = `${outputPath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+  try {
+    mkdirSync3(dirname4(outputPath), { recursive: true });
+    const needsBuild = options.force === true || !existsSync3(outputPath) || statSync(sourcePath).mtimeMs > statSync(outputPath).mtimeMs;
+    if (!needsBuild) {
+      return true;
+    }
+    const build = Bun.spawn([
+      zigBinary,
+      "build-lib",
+      sourcePath,
+      "-dynamic",
+      "-O",
+      "ReleaseFast",
+      `-femit-bin=${tempOutputPath}`
+    ], {
+      cwd: import.meta.dir,
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const exitCode = await build.exited;
+    if (exitCode !== 0 || !existsSync3(tempOutputPath)) {
+      rmSync(tempOutputPath, { force: true });
+      return false;
+    }
+    renameSync(tempOutputPath, outputPath);
+    return true;
+  } catch {
+    rmSync(tempOutputPath, { force: true });
+    return false;
+  }
+}
+function tryDlopenNativeRuntimeLibrary(outputPath) {
+  try {
+    return dlopen(outputPath, {
+      rig_scope_match: {
+        args: ["ptr", "ptr"],
+        returns: "u8"
+      },
+      snapshot_capture: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_delta: {
+        args: ["ptr", "ptr"],
+        returns: "ptr"
+      },
+      snapshot_store_delta: {
+        args: ["ptr", "ptr", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_inspect_delta: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_apply_delta: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_release: {
+        args: ["ptr"],
+        returns: "void"
+      },
+      runtime_hash_file: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_hash_tree: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_prepare_paths: {
+        args: ["ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_link_dependency_layer: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_scan_worktrees: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      }
+    });
+  } catch {
+    return null;
+  }
+}
+
+// packages/runtime/src/control-plane/native/scope-rules.ts
+var activeRules = null;
+function setScopeRules(rules) {
+  activeRules = rules ?? null;
+}
+
+// packages/runtime/src/control-plane/native/utils.ts
+function resolveMonorepoRoot2(projectRoot) {
+  return resolveMonorepoRoot(projectRoot);
+}
+var scopeRegexCache = new Map;
+function runCapture(command, cwd, env) {
+  const result = Bun.spawnSync(command, {
+    cwd,
+    env: env ? { ...process.env, ...env } : process.env,
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  return {
+    exitCode: result.exitCode,
+    stdout: result.stdout.toString(),
+    stderr: result.stderr.toString()
+  };
+}
+function readJsonFile(path, fallback) {
+  if (!existsSync4(path)) {
+    return fallback;
+  }
+  try {
+    return JSON.parse(readFileSync2(path, "utf-8"));
+  } catch {
+    return fallback;
+  }
+}
+function nowIso() {
+  return new Date().toISOString();
+}
+function unique(values) {
+  return [...new Set(values)];
+}
+function resolveHarnessPaths(projectRoot) {
+  const hasRuntimeWorkspace = Boolean(process.env.RIG_TASK_WORKSPACE?.trim());
+  const monorepoRoot = resolveMonorepoRoot2(projectRoot);
+  const harnessRoot = resolve4(projectRoot, "rig");
+  const stateRoot = resolve4(projectRoot, ".rig");
+  const layout = hasRuntimeWorkspace ? resolveRigLayout(projectRoot) : null;
+  const stateDir = layout?.stateDir ?? resolve4(stateRoot, "state");
+  const logsDir = layout?.logsDir ?? resolve4(stateRoot, "logs");
+  const artifactsDir = layout?.artifactsRoot ?? resolve4(monorepoRoot, "artifacts");
+  const taskConfigPath = layout?.taskConfigPath ?? resolve4(monorepoRoot, ".rig", "task-config.json");
+  const binDir = layout?.binDir ?? resolve4(stateRoot, "bin");
+  return {
+    harnessRoot,
+    stateDir: process.env.RIG_STATE_DIR || stateDir,
+    artifactsDir,
+    logsDir: process.env.RIG_LOGS_DIR || logsDir,
+    binDir,
+    hooksDir: resolve4(harnessRoot, "hooks"),
+    validationDir: resolve4(harnessRoot, "validation"),
+    taskConfigPath,
+    sessionPath: process.env.RIG_SESSION_FILE || resolve4(stateRoot, "session", "session.json"),
+    monorepoRoot,
+    tsApiTestsDir: process.env.TS_API_TESTS_DIR || resolve4(monorepoRoot, "TSAPITests"),
+    taskRepoCommitsPath: resolve4(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve4(stateDir, "base-repo-pins.json"),
+    failedApproachesPath: resolve4(stateDir, "failed_approaches.md"),
+    agentProfilePath: resolve4(stateDir, "agent-profile.json"),
+    reviewProfilePath: resolve4(stateDir, "review-profile.json")
+  };
+}
+
+// packages/runtime/src/control-plane/native/profile-ops.ts
+var DEFAULTS = {
+  model: parseEnvOrDefault(process.env.DEFAULT_AGENT_MODEL, ["claude", "gpt-codex", "pi"], "pi"),
+  runtime: parseEnvOrDefault(process.env.DEFAULT_AGENT_RUNTIME, ["claude-code", "codex-app-server", "pi"], "pi"),
+  plugin: parseEnvOrDefault(process.env.DEFAULT_AGENT_PLUGIN, ["claude", "codex", "pi"], "pi"),
+  reviewMode: parseEnvOrDefault(process.env.AI_REVIEW_MODE, ["off", "advisory", "required"], "advisory"),
+  reviewProvider: parseEnvOrDefault(process.env.AI_REVIEW_PROVIDER, ["greptile"], "greptile")
+};
+function parseEnvOrDefault(value, allowed, fallback) {
+  if (!value) {
+    return fallback;
+  }
+  return allowed.includes(value) ? value : fallback;
+}
+async function readProfileFile(path) {
+  if (!existsSync5(path)) {
+    return null;
+  }
+  try {
+    return await Bun.file(path).json();
+  } catch {
+    return null;
+  }
+}
+async function showProfile(projectRoot, compact = false) {
+  const paths = resolveHarnessPaths(projectRoot);
+  const profile = await loadProfile(paths.agentProfilePath);
+  if (compact) {
+    console.log(`model=${profile.model} runtime=${profile.runtime} plugin=${profile.agent_plugin}`);
+    return;
+  }
+  console.log("Execution Profile:");
+  console.log(`  model:        ${profile.model}`);
+  console.log(`  runtime:      ${profile.runtime}`);
+  console.log(`  plugin:       ${profile.agent_plugin}`);
+}
+async function showReviewProfile(projectRoot) {
+  const paths = resolveHarnessPaths(projectRoot);
+  const profile = await loadReviewProfile(paths.reviewProfilePath);
+  console.log("AI Review Profile:");
+  console.log(`  mode:      ${profile.mode}`);
+  console.log(`  provider:  ${profile.provider}`);
+  console.log(`  file:      ${paths.reviewProfilePath}`);
+}
+async function loadProfile(path) {
+  const parsed = await readProfileFile(path);
+  if (parsed) {
+    return {
+      model: parsed.model || DEFAULTS.model,
+      runtime: parsed.runtime || DEFAULTS.runtime,
+      agent_plugin: parsed.agent_plugin || DEFAULTS.plugin,
+      updated_at: parsed.updated_at || new Date().toISOString()
+    };
+  }
+  return {
+    model: DEFAULTS.model,
+    runtime: DEFAULTS.runtime,
+    agent_plugin: DEFAULTS.plugin,
+    updated_at: new Date().toISOString()
+  };
+}
+async function loadReviewProfile(path) {
+  const parsed = await readProfileFile(path);
+  if (parsed) {
+    return {
+      mode: parsed.mode || DEFAULTS.reviewMode,
+      provider: parsed.provider || DEFAULTS.reviewProvider,
+      updated_at: parsed.updated_at || new Date().toISOString()
+    };
+  }
+  return {
+    mode: DEFAULTS.reviewMode,
+    provider: DEFAULTS.reviewProvider,
+    updated_at: new Date().toISOString()
+  };
+}
+
+// packages/runtime/src/control-plane/native/repo-ops.ts
+import { existsSync as existsSync19, mkdirSync as mkdirSync11, readFileSync as readFileSync11, readdirSync as readdirSync4, rmSync as rmSync4, writeFileSync as writeFileSync9 } from "fs";
+import { basename as basename7, dirname as dirname11, resolve as resolve20 } from "path";
+
+// packages/runtime/src/control-plane/state-sync/types.ts
+var SUPPORTED_TASK_STATE_SCHEMA_VERSION = 1;
+var CANONICAL_TASK_LIFECYCLE_STATUSES = new Set([
+  "draft",
+  "open",
+  "ready",
+  "queued",
+  "in_progress",
+  "under_review",
+  "blocked",
+  "completed",
+  "cancelled"
+]);
+function normalizeTaskLifecycleStatus(status) {
+  switch (status) {
+    case "draft":
+    case "open":
+    case "ready":
+    case "queued":
+    case "in_progress":
+    case "under_review":
+    case "blocked":
+    case "completed":
+    case "cancelled":
+      return status;
+    case "closed":
+      return "completed";
+    case "running":
+      return "in_progress";
+    case "failed":
+      return "ready";
+    default:
+      return null;
+  }
+}
+function normalizeTaskStateMetadataStatus(status) {
+  if (CANONICAL_TASK_LIFECYCLE_STATUSES.has(status)) {
+    return status;
+  }
+  switch (status) {
+    case "closed":
+      return "completed";
+    case "running":
+      return "in_progress";
+    case "failed":
+      return "ready";
+    default:
+      return;
+  }
+}
+function canonicalizeTaskStateMetadata(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return null;
+  }
+  const metadata = raw;
+  const claimId = typeof metadata.claimId === "string" && metadata.claimId.length > 0 ? metadata.claimId : undefined;
+  const status = normalizeTaskStateMetadataStatus(metadata.status);
+  if (!status) {
+    return null;
+  }
+  return {
+    ...claimId ? { claimId } : {},
+    status,
+    ...typeof metadata.ownerId === "string" && metadata.ownerId.length > 0 ? { ownerId: metadata.ownerId } : {},
+    ...typeof metadata.claimedAt === "string" && metadata.claimedAt.length > 0 ? { claimedAt: metadata.claimedAt } : {},
+    ...typeof metadata.lastEvidenceAt === "string" && metadata.lastEvidenceAt.length > 0 ? { lastEvidenceAt: metadata.lastEvidenceAt } : {},
+    ...typeof metadata.runId === "string" && metadata.runId.length > 0 ? { runId: metadata.runId } : {},
+    ...typeof metadata.branchName === "string" && metadata.branchName.length > 0 ? { branchName: metadata.branchName } : {},
+    ...typeof metadata.prNumber === "number" ? { prNumber: metadata.prNumber } : {},
+    ...typeof metadata.prUrl === "string" && metadata.prUrl.length > 0 ? { prUrl: metadata.prUrl } : {},
+    ...typeof metadata.reviewState === "string" && metadata.reviewState.length > 0 ? { reviewState: metadata.reviewState } : {},
+    ...typeof metadata.blockerReason === "string" && metadata.blockerReason.length > 0 ? { blockerReason: metadata.blockerReason } : {},
+    ...typeof metadata.sourceCommit === "string" && metadata.sourceCommit.length > 0 ? { sourceCommit: metadata.sourceCommit } : {}
+  };
+}
+function discardMismatchedTaskStateMetadata(input) {
+  input.taskId;
+  const canonicalMetadata = canonicalizeTaskStateMetadata(input.metadata);
+  if (!canonicalMetadata || !input.lifecycleStatus) {
+    return null;
+  }
+  const metadataStatus = canonicalMetadata.status ?? null;
+  if (metadataStatus && metadataStatus !== input.lifecycleStatus) {
+    return null;
+  }
+  return canonicalMetadata;
+}
+function readTaskStateMetadataEnvelope(raw) {
+  if (!raw || typeof raw !== "object") {
+    return { schemaVersion: SUPPORTED_TASK_STATE_SCHEMA_VERSION, supported: true, baseTrackerCommit: null, tasks: {} };
+  }
+  const envelope = raw;
+  const schemaVersion = typeof envelope.schemaVersion === "number" ? envelope.schemaVersion : SUPPORTED_TASK_STATE_SCHEMA_VERSION;
+  if (schemaVersion !== SUPPORTED_TASK_STATE_SCHEMA_VERSION) {
+    return { schemaVersion, supported: false, baseTrackerCommit: null, tasks: {} };
+  }
+  const rawTasks = envelope.tasks && typeof envelope.tasks === "object" && !Array.isArray(envelope.tasks) ? envelope.tasks : {};
+  const tasks = Object.fromEntries(Object.entries(rawTasks).map(([taskId, metadata]) => [taskId, canonicalizeTaskStateMetadata(metadata)]).filter((entry) => entry[1] != null));
+  return {
+    schemaVersion,
+    supported: true,
+    baseTrackerCommit: typeof envelope.baseTrackerCommit === "string" && envelope.baseTrackerCommit.length > 0 ? envelope.baseTrackerCommit : null,
+    tasks
+  };
+}
+
+// packages/runtime/src/control-plane/repos/registry.ts
+function createRepoRegistry(entries) {
+  const map = new Map;
+  for (const e of entries) {
+    if (map.has(e.id))
+      throw new Error(`repo already registered: ${e.id}`);
+    map.set(e.id, { ...e });
+  }
+  const ordered = Array.from(map.values());
+  return {
+    getById: (id) => map.get(id),
+    list: () => ordered
+  };
+}
+var MANAGED_REPOS = new Map;
+function setManagedRepos(entries) {
+  const next = new Map;
+  for (const e of entries) {
+    if (next.has(e.id)) {
+      throw new Error(`managed repo already registered: ${e.id}`);
+    }
+    next.set(e.id, e);
+  }
+  MANAGED_REPOS = next;
+}
+function getManagedRepoEntry(repoId) {
+  const entry = MANAGED_REPOS.get(repoId);
+  if (!entry) {
+    throw new Error(`managed repo not registered: ${repoId}. Plugins contribute repos via RigPlugin.contributes.repoSources; ` + `make sure a plugin declares this id and the plugin host has been initialized.`);
+  }
+  return entry;
+}
+function listManagedRepoEntries() {
+  return Array.from(MANAGED_REPOS.values());
+}
+function repoRegistrationToManagedEntry(reg) {
+  if (!reg.defaultBranch) {
+    return null;
+  }
+  return {
+    id: reg.id,
+    alias: reg.defaultPath ?? reg.id,
+    defaultBranch: reg.defaultBranch,
+    defaultRemoteUrl: reg.url,
+    remoteEnvVar: reg.remoteEnvVar,
+    checkoutEnvVar: reg.checkoutEnvVar
+  };
+}
+// packages/runtime/src/control-plane/repos/layout.ts
+import { existsSync as existsSync6 } from "fs";
+import { basename as basename2, dirname as dirname5, join, resolve as resolve5 } from "path";
+function resolveRepoStateDir(projectRoot) {
+  const normalizedProjectRoot = resolve5(projectRoot);
+  const projectParent = dirname5(normalizedProjectRoot);
+  if (basename2(projectParent) === ".worktrees") {
+    const ownerRoot = dirname5(projectParent);
+    const ownerHasRepoMarkers = existsSync6(resolve5(ownerRoot, ".git")) || existsSync6(resolve5(ownerRoot, ".rig", "state"));
+    if (ownerHasRepoMarkers) {
+      return resolve5(ownerRoot, ".rig", "state");
+    }
+  }
+  return resolve5(projectRoot, ".rig", "state");
+}
+function resolveManagedRepoLayout(projectRoot, repoId) {
+  const normalizedProjectRoot = resolve5(projectRoot);
+  const entry = getManagedRepoEntry(repoId);
+  const stateDir = resolveRepoStateDir(normalizedProjectRoot);
+  const metadataRelativePath = join("repos", entry.id);
+  const metadataRoot = resolve5(stateDir, metadataRelativePath);
+  const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  const runsInsideTaskWorktree = runtimeWorkspace && resolve5(runtimeWorkspace) === normalizedProjectRoot || basename2(dirname5(normalizedProjectRoot)) === ".worktrees";
+  const isPrimaryManagedRepo = listManagedRepoEntries()[0]?.id === repoId;
+  const checkoutRoot = isPrimaryManagedRepo && runsInsideTaskWorktree ? resolveMonorepoRoot(normalizedProjectRoot) : entry.checkoutEnvVar && process.env[entry.checkoutEnvVar]?.trim() ? resolve5(process.env[entry.checkoutEnvVar].trim()) : resolve5(normalizedProjectRoot, entry.alias);
+  return {
+    projectRoot: normalizedProjectRoot,
+    repoId: entry.id,
+    alias: entry.alias,
+    defaultBranch: entry.defaultBranch,
+    remoteUrl: entry.remoteEnvVar && process.env[entry.remoteEnvVar]?.trim() ? process.env[entry.remoteEnvVar].trim() : entry.defaultRemoteUrl,
+    checkoutRoot,
+    worktreesRoot: resolve5(checkoutRoot, ".worktrees"),
+    stateDir,
+    metadataRoot,
+    metadataRelativePath,
+    mirrorRoot: resolve5(metadataRoot, "mirror.git"),
+    mirrorStatePath: resolve5(metadataRoot, "mirror-state.json"),
+    mirrorStateRelativePath: join(metadataRelativePath, "mirror-state.json")
+  };
+}
+function resolveMonorepoRepoLayout(projectRoot) {
+  const entries = listManagedRepoEntries();
+  if (entries.length === 0) {
+    throw new Error("resolveMonorepoRepoLayout: no managed repos registered. Either contribute one via " + "RigPlugin.contributes.repoSources (with defaultBranch set), or avoid calling this " + "function for projects where the project root IS the monorepo.");
+  }
+  const primary = entries[0];
+  return resolveManagedRepoLayout(projectRoot, primary.id);
+}
+// packages/runtime/src/control-plane/repos/mirror/bootstrap.ts
+import { existsSync as existsSync8, mkdirSync as mkdirSync6, realpathSync } from "fs";
+import { resolve as resolve7 } from "path";
+
+// packages/runtime/src/control-plane/authority-files.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync3, appendFileSync, copyFileSync as copyFileSync2, statSync as statSync2, readdirSync, chmodSync } from "fs";
+import { dirname as dirname6, join as join2, relative, resolve as resolve6 } from "path";
+import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+function resolveAuthorityProjectStateDir(projectRoot) {
+  const explicit = process.env.RIG_STATE_DIR?.trim();
+  if (explicit) {
+    return resolve6(explicit);
+  }
+  return resolve6(resolve6(projectRoot), ".rig", "state");
+}
+function readJsonAtPath(path, fallback) {
+  if (!existsSync7(path)) {
+    return fallback;
+  }
+  try {
+    return JSON.parse(readFileSync3(path, "utf-8"));
+  } catch {
+    return fallback;
+  }
+}
+function writeJsonAtPath(path, value) {
+  mkdirSync5(dirname6(path), { recursive: true });
+  writeFileSync3(path, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+  return path;
+}
+function readAuthorityProjectStateJson(projectRoot, relativePath, fallback) {
+  return readJsonAtPath(resolve6(resolveAuthorityProjectStateDir(projectRoot), relativePath), fallback);
+}
+function writeAuthorityProjectStateJson(projectRoot, relativePath, value) {
+  return writeJsonAtPath(resolve6(resolveAuthorityProjectStateDir(projectRoot), relativePath), value);
+}
+
+// packages/runtime/src/control-plane/repos/mirror/state.ts
+var STATE_VERSION = 1;
+function defaultMirrorState(projectRoot, repoId) {
+  const layout = resolveManagedRepoLayout(projectRoot, repoId);
+  return {
+    version: STATE_VERSION,
+    repoId,
+    remoteUrl: layout.remoteUrl,
+    defaultBranch: layout.defaultBranch
+  };
+}
+function readManagedRepoMirrorState(projectRoot, repoId) {
+  const layout = resolveManagedRepoLayout(projectRoot, repoId);
+  return readAuthorityProjectStateJson(projectRoot, layout.mirrorStateRelativePath, null);
+}
+function writeManagedRepoMirrorState(projectRoot, repoId, patch) {
+  const current = readManagedRepoMirrorState(projectRoot, repoId) || defaultMirrorState(projectRoot, repoId);
+  const next = {
+    ...current,
+    ...patch,
+    version: STATE_VERSION,
+    repoId
+  };
+  const layout = resolveManagedRepoLayout(projectRoot, repoId);
+  writeAuthorityProjectStateJson(projectRoot, layout.mirrorStateRelativePath, next);
+  return next;
+}
+
+// packages/runtime/src/control-plane/repos/mirror/bootstrap.ts
+function nowIso2() {
+  return new Date().toISOString();
+}
+function runGit(command, cwd) {
+  const result = Bun.spawnSync(command, {
+    cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: process.env
+  });
+  return {
+    exitCode: result.exitCode,
+    stdout: result.stdout.toString(),
+    stderr: result.stderr.toString()
+  };
+}
+function ensureGitSuccess(result, command) {
+  if (result.exitCode !== 0) {
+    throw new Error(result.stderr || result.stdout || `git command failed: ${command.join(" ")}`);
+  }
+}
+function isUsableRemoteUrl(candidate, layout) {
+  return candidate.length > 0 && candidate !== layout.mirrorRoot && candidate !== layout.checkoutRoot;
+}
+function sameExistingPath(left, right) {
+  try {
+    return realpathSync(left) === realpathSync(right);
+  } catch {
+    return resolve7(left) === resolve7(right);
+  }
+}
+function repoLooksUsable(repoRoot, projectRoot) {
+  const probe = runGit(["git", "-C", repoRoot, "rev-parse", "--show-toplevel"], projectRoot);
+  return probe.exitCode === 0 && sameExistingPath(probe.stdout.trim(), repoRoot);
+}
+function checkoutLooksUsable(layout) {
+  return repoLooksUsable(layout.checkoutRoot, layout.projectRoot);
+}
+function resolveMirrorRemoteUrl(layout) {
+  const entry = getManagedRepoEntry(layout.repoId);
+  const explicit = entry.remoteEnvVar ? process.env[entry.remoteEnvVar]?.trim() : "";
+  if (explicit) {
+    return explicit;
+  }
+  const persisted = readManagedRepoMirrorState(layout.projectRoot, layout.repoId)?.remoteUrl?.trim();
+  if (persisted && isUsableRemoteUrl(persisted, layout)) {
+    return persisted;
+  }
+  const mirrorOrigin = runGit(["git", "--git-dir", layout.mirrorRoot, "remote", "get-url", "origin"], layout.projectRoot);
+  if (mirrorOrigin.exitCode === 0) {
+    const currentOrigin = mirrorOrigin.stdout.trim();
+    if (isUsableRemoteUrl(currentOrigin, layout)) {
+      return currentOrigin;
+    }
+  }
+  if (repoLooksUsable(layout.projectRoot, layout.projectRoot)) {
+    const projectOrigin = runGit(["git", "-C", layout.projectRoot, "remote", "get-url", "origin"], layout.projectRoot);
+    if (projectOrigin.exitCode === 0) {
+      const currentOrigin = projectOrigin.stdout.trim();
+      if (isUsableRemoteUrl(currentOrigin, layout)) {
+        return currentOrigin;
+      }
+    }
+  }
+  if (existsSync8(resolve7(layout.checkoutRoot, ".git")) && checkoutLooksUsable(layout)) {
+    const checkoutOrigin = runGit(["git", "-C", layout.checkoutRoot, "remote", "get-url", "origin"], layout.projectRoot);
+    if (checkoutOrigin.exitCode === 0) {
+      const currentOrigin = checkoutOrigin.stdout.trim();
+      if (isUsableRemoteUrl(currentOrigin, layout)) {
+        return currentOrigin;
+      }
+    }
+  }
+  return layout.remoteUrl;
+}
+function ensureManagedRepoMirror(projectRoot, repoId) {
+  const layout = resolveManagedRepoLayout(projectRoot, repoId);
+  mkdirSync6(layout.metadataRoot, { recursive: true });
+  const remoteUrl = resolveMirrorRemoteUrl(layout);
+  if (!existsSync8(resolve7(layout.mirrorRoot, "HEAD"))) {
+    ensureGitSuccess(runGit(["git", "init", "--bare", layout.mirrorRoot], layout.projectRoot), ["git", "init", "--bare", layout.mirrorRoot]);
+  }
+  const getOrigin = runGit(["git", "--git-dir", layout.mirrorRoot, "remote", "get-url", "origin"], layout.projectRoot);
+  if (getOrigin.exitCode === 0) {
+    const currentOrigin = getOrigin.stdout.trim();
+    if (currentOrigin !== remoteUrl) {
+      ensureGitSuccess(runGit(["git", "--git-dir", layout.mirrorRoot, "remote", "set-url", "origin", remoteUrl], layout.projectRoot), ["git", "--git-dir", layout.mirrorRoot, "remote", "set-url", "origin", remoteUrl]);
+    }
+  } else {
+    ensureGitSuccess(runGit(["git", "--git-dir", layout.mirrorRoot, "remote", "add", "origin", remoteUrl], layout.projectRoot), ["git", "--git-dir", layout.mirrorRoot, "remote", "add", "origin", remoteUrl]);
+  }
+  writeManagedRepoMirrorState(projectRoot, repoId, {
+    remoteUrl,
+    defaultBranch: layout.defaultBranch,
+    initializedAt: nowIso2()
+  });
+  return layout;
+}
+// packages/runtime/src/control-plane/repos/mirror/refresh.ts
+import { existsSync as existsSync9, mkdirSync as mkdirSync7, realpathSync as realpathSync2, rmSync as rmSync2 } from "fs";
+import { resolve as resolve8 } from "path";
+function nowIso3() {
+  return new Date().toISOString();
+}
+function runGit2(command, cwd) {
+  const result = Bun.spawnSync(command, {
+    cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: process.env
+  });
+  return {
+    exitCode: result.exitCode,
+    stdout: result.stdout.toString(),
+    stderr: result.stderr.toString()
+  };
+}
+function ensureGitSuccess2(result, command) {
+  if (result.exitCode !== 0) {
+    throw new Error(result.stderr || result.stdout || `git command failed: ${command.join(" ")}`);
+  }
+  return result.stdout.trim();
+}
+function sameExistingPath2(left, right) {
+  try {
+    return realpathSync2(left) === realpathSync2(right);
+  } catch {
+    return resolve8(left) === resolve8(right);
+  }
+}
+function ensureMirrorHead(layout) {
+  ensureGitSuccess2(runGit2([
+    "git",
+    "--git-dir",
+    layout.mirrorRoot,
+    "fetch",
+    "--prune",
+    "origin",
+    "+refs/heads/*:refs/heads/*",
+    "+refs/tags/*:refs/tags/*"
+  ], layout.projectRoot), [
+    "git",
+    "--git-dir",
+    layout.mirrorRoot,
+    "fetch",
+    "--prune",
+    "origin",
+    "+refs/heads/*:refs/heads/*",
+    "+refs/tags/*:refs/tags/*"
+  ]);
+  const headRef = `refs/heads/${layout.defaultBranch}`;
+  const headCommit = ensureGitSuccess2(runGit2(["git", "--git-dir", layout.mirrorRoot, "rev-parse", headRef], layout.projectRoot), ["git", "--git-dir", layout.mirrorRoot, "rev-parse", headRef]);
+  const remoteUrl = ensureGitSuccess2(runGit2(["git", "--git-dir", layout.mirrorRoot, "remote", "get-url", "origin"], layout.projectRoot), ["git", "--git-dir", layout.mirrorRoot, "remote", "get-url", "origin"]);
+  ensureGitSuccess2(runGit2(["git", "--git-dir", layout.mirrorRoot, "symbolic-ref", "HEAD", headRef], layout.projectRoot), ["git", "--git-dir", layout.mirrorRoot, "symbolic-ref", "HEAD", headRef]);
+  writeManagedRepoMirrorState(layout.projectRoot, layout.repoId, {
+    remoteUrl,
+    defaultBranch: layout.defaultBranch,
+    lastSyncedAt: nowIso3(),
+    headRef,
+    headCommit
+  });
+  return headCommit;
+}
+function refreshManagedRepoMirror(projectRoot, repoId) {
+  const layout = ensureManagedRepoMirror(projectRoot, repoId);
+  const headCommit = ensureMirrorHead(layout);
+  return { layout, headCommit };
+}
+function checkoutLooksUsable2(layout) {
+  const probe = runGit2(["git", "-C", layout.checkoutRoot, "rev-parse", "--show-toplevel"], layout.projectRoot);
+  return probe.exitCode === 0 && sameExistingPath2(probe.stdout.trim(), layout.checkoutRoot);
+}
+function ensureCheckoutFromMirror(layout) {
+  mkdirSync7(resolve8(layout.checkoutRoot, ".."), { recursive: true });
+  const gitPath = resolve8(layout.checkoutRoot, ".git");
+  if (existsSync9(layout.checkoutRoot) && (!existsSync9(gitPath) || !checkoutLooksUsable2(layout))) {
+    rmSync2(layout.checkoutRoot, { recursive: true, force: true });
+  }
+  if (!existsSync9(gitPath)) {
+    ensureGitSuccess2(runGit2(["git", "clone", layout.mirrorRoot, layout.checkoutRoot], layout.projectRoot), ["git", "clone", layout.mirrorRoot, layout.checkoutRoot]);
+  }
+  const getOrigin = runGit2(["git", "-C", layout.checkoutRoot, "remote", "get-url", "origin"], layout.projectRoot);
+  if (getOrigin.exitCode === 0) {
+    const currentOrigin = getOrigin.stdout.trim();
+    if (currentOrigin !== layout.mirrorRoot) {
+      ensureGitSuccess2(runGit2(["git", "-C", layout.checkoutRoot, "remote", "set-url", "origin", layout.mirrorRoot], layout.projectRoot), ["git", "-C", layout.checkoutRoot, "remote", "set-url", "origin", layout.mirrorRoot]);
+    }
+  } else {
+    ensureGitSuccess2(runGit2(["git", "-C", layout.checkoutRoot, "remote", "add", "origin", layout.mirrorRoot], layout.projectRoot), ["git", "-C", layout.checkoutRoot, "remote", "add", "origin", layout.mirrorRoot]);
+  }
+  ensureGitSuccess2(runGit2(["git", "-C", layout.checkoutRoot, "fetch", "origin", layout.defaultBranch], layout.projectRoot), ["git", "-C", layout.checkoutRoot, "fetch", "origin", layout.defaultBranch]);
+  ensureGitSuccess2(runGit2(["git", "-C", layout.checkoutRoot, "reset", "--hard"], layout.projectRoot), ["git", "-C", layout.checkoutRoot, "reset", "--hard"]);
+  ensureGitSuccess2(runGit2(["git", "-C", layout.checkoutRoot, "clean", "-fd"], layout.projectRoot), ["git", "-C", layout.checkoutRoot, "clean", "-fd"]);
+  ensureGitSuccess2(runGit2([
+    "git",
+    "-C",
+    layout.checkoutRoot,
+    "checkout",
+    "--force",
+    "-B",
+    layout.defaultBranch,
+    `origin/${layout.defaultBranch}`
+  ], layout.projectRoot), [
+    "git",
+    "-C",
+    layout.checkoutRoot,
+    "checkout",
+    "--force",
+    "-B",
+    layout.defaultBranch,
+    `origin/${layout.defaultBranch}`
+  ]);
+  ensureGitSuccess2(runGit2(["git", "-C", layout.checkoutRoot, "reset", "--hard", `origin/${layout.defaultBranch}`], layout.projectRoot), ["git", "-C", layout.checkoutRoot, "reset", "--hard", `origin/${layout.defaultBranch}`]);
+  ensureGitSuccess2(runGit2(["git", "-C", layout.checkoutRoot, "clean", "-fd"], layout.projectRoot), ["git", "-C", layout.checkoutRoot, "clean", "-fd"]);
+  return ensureGitSuccess2(runGit2(["git", "-C", layout.checkoutRoot, "rev-parse", "HEAD"], layout.projectRoot), ["git", "-C", layout.checkoutRoot, "rev-parse", "HEAD"]);
+}
+function syncManagedRepo(projectRoot, repoId) {
+  const { layout, headCommit } = refreshManagedRepoMirror(projectRoot, repoId);
+  const checkoutCommit = ensureCheckoutFromMirror(layout);
+  if (checkoutCommit !== headCommit) {
+    throw new Error(`Managed repo checkout ${layout.alias} is out of sync with mirror: expected ${headCommit}, got ${checkoutCommit}.`);
+  }
+  return { layout, headCommit };
+}
+// packages/runtime/src/control-plane/native/task-ops.ts
+import { appendFileSync as appendFileSync2, existsSync as existsSync18, mkdirSync as mkdirSync10, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
+import { resolve as resolve19 } from "path";
+
+// packages/runtime/src/build-time-config.ts
+function normalizeBuildConfig(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return {};
+  }
+  return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+}
+function readBuildConfig() {
+  if (typeof __RIG_BUILD_CONFIG__ !== "undefined") {
+    return normalizeBuildConfig(__RIG_BUILD_CONFIG__);
+  }
+  const raw = process.env.RIG_BUILD_CONFIG_JSON?.trim();
+  if (!raw) {
+    return {};
+  }
+  try {
+    return normalizeBuildConfig(JSON.parse(raw));
+  } catch {
+    return {};
+  }
+}
+
+// packages/runtime/src/control-plane/runtime/tooling/shell.ts
+import { tmpdir as tmpdir2 } from "os";
+import { basename as basename3, dirname as dirname7, resolve as resolve9 } from "path";
+var sharedNativeShellOutputDir = resolve9(tmpdir2(), "rig-native");
+var sharedNativeShellOutputPath = resolve9(sharedNativeShellOutputDir, `rig-shell-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+function runtimeToolGatewayNames() {
+  return [
+    "bash",
+    "sh",
+    "zsh",
+    "git",
+    "bun",
+    "node",
+    "python3",
+    "rg",
+    "grep",
+    "sed",
+    "cat",
+    "ls",
+    "find",
+    "tsc",
+    "gh",
+    "mkdir",
+    "rm",
+    "mv",
+    "cp",
+    "touch",
+    "pwd",
+    "head",
+    "tail",
+    "wc",
+    "sort",
+    "uniq",
+    "awk",
+    "xargs",
+    "dirname",
+    "basename",
+    "realpath",
+    "env",
+    "jq",
+    "tee",
+    "which"
+  ];
+}
+// packages/runtime/src/control-plane/runtime/tooling/file-tools.ts
+import { tmpdir as tmpdir3 } from "os";
+import { basename as basename4, dirname as dirname8, resolve as resolve10 } from "path";
+var sharedNativeToolsOutputDir = resolve10(tmpdir3(), "rig-native");
+var sharedNativeToolsOutputPath = resolve10(sharedNativeToolsOutputDir, `rig-tools-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+function runtimeFileToolNames() {
+  return [
+    "rig-read",
+    "rig-write",
+    "rig-edit",
+    "rig-glob",
+    "rig-grep"
+  ];
+}
+
+// packages/runtime/src/control-plane/runtime/tooling/gateway.ts
+function runtimeGatewayToolNames() {
+  return runtimeToolGatewayNames();
+}
+// packages/runtime/src/control-plane/browser-contract.ts
+import { resolve as resolve11 } from "path";
+var DEFAULT_BROWSER_ATTACH_URL = "http://127.0.0.1:9333";
+var DEFAULT_BROWSER_MODE = "persistent";
+var RUNTIME_BROWSER_HELPERS = {
+  launch: "rig-browser-launch",
+  check: "rig-browser-check",
+  attachInfo: "rig-browser-attach-info",
+  e2e: "rig-browser-e2e",
+  resetProfile: "rig-browser-reset-profile"
+};
+var BASE_REMOTE_DEBUGGING_PORT = 9222;
+var REMOTE_DEBUGGING_PORT_SPREAD = 4000;
+function hashString(input) {
+  let hash = 0;
+  for (let index = 0;index < input.length; index += 1) {
+    hash = (hash << 5) - hash + input.charCodeAt(index) | 0;
+  }
+  return Math.abs(hash);
+}
+function derivePortFromProfile(profileName) {
+  return BASE_REMOTE_DEBUGGING_PORT + hashString(profileName) % REMOTE_DEBUGGING_PORT_SPREAD;
+}
+function parseAttachUrl(attachUrl) {
+  try {
+    return new URL((attachUrl || DEFAULT_BROWSER_ATTACH_URL).trim() || DEFAULT_BROWSER_ATTACH_URL);
+  } catch {
+    return new URL(DEFAULT_BROWSER_ATTACH_URL);
+  }
+}
+function sanitizeRuntimeSuffix(runtimeId) {
+  return runtimeId.replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 16) || "runtime";
+}
+function resolveBrowserStateDir(projectRoot, configuredStateDir) {
+  const trimmed = configuredStateDir?.trim() || ".tmp/rig-browser";
+  if (trimmed.startsWith("/")) {
+    return resolve11(trimmed);
+  }
+  return resolve11(projectRoot || process.cwd(), trimmed);
+}
+function resolveTaskBrowserContext(browser, options = {}) {
+  if (!browser?.required) {
+    return;
+  }
+  const defaultProfile = browser.profile?.trim() || "default";
+  const mode = browser.mode?.trim() || DEFAULT_BROWSER_MODE;
+  const defaultAttach = parseAttachUrl(browser.attach_url);
+  const shouldDeriveRuntimeProfile = Boolean(options.runtimeId?.trim()) && mode !== "shared";
+  const effectiveProfile = shouldDeriveRuntimeProfile ? `${defaultProfile}-${sanitizeRuntimeSuffix(options.runtimeId.trim())}` : defaultProfile;
+  const effectivePort = shouldDeriveRuntimeProfile ? derivePortFromProfile(effectiveProfile) : Number(defaultAttach.port || "80");
+  const effectiveAttach = new URL(defaultAttach.toString());
+  effectiveAttach.port = String(effectivePort);
+  return {
+    required: true,
+    preset: browser.preset?.trim() || "default",
+    mode,
+    stateDir: resolveBrowserStateDir(options.hostProjectRoot, browser.state_dir),
+    defaultProfile,
+    effectiveProfile,
+    defaultAttachUrl: defaultAttach.toString(),
+    effectiveAttachUrl: effectiveAttach.toString(),
+    devCommand: browser.dev_command?.trim() || undefined,
+    launchCommand: browser.launch_command?.trim() || undefined,
+    checkCommand: browser.check_command?.trim() || undefined,
+    e2eCommand: browser.e2e_command?.trim() || undefined,
+    launchHelper: RUNTIME_BROWSER_HELPERS.launch,
+    checkHelper: RUNTIME_BROWSER_HELPERS.check,
+    attachInfoHelper: RUNTIME_BROWSER_HELPERS.attachInfo,
+    e2eHelper: RUNTIME_BROWSER_HELPERS.e2e,
+    resetProfileHelper: RUNTIME_BROWSER_HELPERS.resetProfile
+  };
+}
+function buildBrowserGuidanceLines(browser) {
+  const lines = [
+    "This task requires Rig Browser.",
+    `Launch the browser: \`${browser.launchHelper}\`${browser.devCommand ? " or `rig-browser-launch --dev`" : ""}.`,
+    `Check the browser contract: \`${browser.checkHelper}\`.`,
+    `Show attach details: \`${browser.attachInfoHelper}\`.`,
+    `Attach Chrome DevTools MCP to ${browser.effectiveAttachUrl}.`,
+    `Preset: ${browser.preset}.`,
+    `Profile: ${browser.effectiveProfile}.`,
+    `State dir: ${browser.stateDir}.`,
+    `Reset the active profile with \`${browser.resetProfileHelper}\`.`
+  ];
+  if (browser.e2eCommand) {
+    lines.push(`Run app-owned browser e2e with \`${browser.e2eHelper}\`.`);
+  }
+  if (browser.defaultProfile !== browser.effectiveProfile) {
+    lines.push(`Base profile: ${browser.defaultProfile}. Runtime launches derive an isolated effective profile.`);
+  }
+  return lines;
+}
+
+// packages/runtime/src/control-plane/plugin-host-context.ts
+import { createPluginHost } from "@rig/core";
+import { loadConfig } from "@rig/core/load-config";
+
+// packages/runtime/src/control-plane/task-source.ts
+function createTaskSourceRegistry() {
+  const byId = new Map;
+  const order = [];
+  return {
+    register(s) {
+      if (byId.has(s.id))
+        throw new Error(`task source already registered: ${s.id}`);
+      byId.set(s.id, s);
+      order.push(s);
+    },
+    resolveById(id) {
+      const s = byId.get(id);
+      if (!s)
+        throw new Error(`task source not registered: ${id}`);
+      return s;
+    },
+    resolveByKind(kind) {
+      for (const s of order)
+        if (s.kind === kind)
+          return s;
+      throw new Error(`no task source registered for kind: ${kind}`);
+    },
+    list: () => order
+  };
+}
+
+// packages/runtime/src/control-plane/task-source-bootstrap.ts
+function formatRegisteredKinds(pluginHost) {
+  const kinds = pluginHost ? pluginHost.listExecutableTaskSources().map((source) => source.kind) : [];
+  return kinds.length > 0 ? kinds.join(", ") : "none";
+}
+function buildTaskSourceRegistry(config, pluginHost) {
+  const registry = createTaskSourceRegistry();
+  const taskSourceConfig = config.taskSource;
+  const factory = pluginHost?.resolveTaskSourceFactoryByKind(taskSourceConfig.kind);
+  if (!factory) {
+    throw new Error(`No task source factory registered for kind "${taskSourceConfig.kind}". ` + `Registered kinds: ${formatRegisteredKinds(pluginHost)}. ` + "Load a plugin that contributes an executable task source factory for this kind.");
+  }
+  registry.register(factory.factory(taskSourceConfig));
+  return registry;
+}
+
+// packages/runtime/src/control-plane/agent-roles.ts
+function createAgentRoleRegistry(pluginRoles, configOverrides) {
+  const map = new Map;
+  for (const r of pluginRoles) {
+    if (map.has(r.id))
+      throw new Error(`agent role already registered: ${r.id}`);
+    const override = configOverrides?.[r.id];
+    const model = override?.model ?? r.defaultModel;
+    if (!model) {
+      throw new Error(`agent role "${r.id}" has no model \u2014 provide defaultModel in plugin or model in config.runtime.agentRoles.${r.id}`);
+    }
+    map.set(r.id, { ...r, model });
+  }
+  return {
+    resolve(id) {
+      const r = map.get(id);
+      if (!r)
+        throw new Error(`agent role not registered: ${id}`);
+      return r;
+    },
+    list: () => Array.from(map.values())
+  };
+}
+
+// packages/runtime/src/control-plane/task-fields.ts
+function createTaskFieldRegistry(extensions) {
+  const byId = new Map;
+  for (const e of extensions) {
+    if (byId.has(e.id))
+      throw new Error(`task field extension already registered: ${e.id}`);
+    byId.set(e.id, e);
+  }
+  return {
+    get: (id) => byId.get(id),
+    list: () => Array.from(byId.values()),
+    fieldNames: () => Array.from(byId.values()).map((e) => e.fieldName),
+    validateTaskFields(task) {
+      const errors = [];
+      for (const ext of byId.values()) {
+        let schema;
+        try {
+          schema = JSON.parse(ext.schemaJson);
+        } catch {
+          errors.push(`task field "${ext.id}": schemaJson is not valid JSON`);
+          continue;
+        }
+        const isRequired = typeof schema === "object" && schema !== null && schema.required === true;
+        if (!isRequired)
+          continue;
+        const value = task[ext.fieldName];
+        if (value === undefined || value === null || value === "") {
+          errors.push(`task field "${ext.fieldName}" (from extension "${ext.id}") is required but missing`);
+        }
+      }
+      return errors.length === 0 ? { ok: true } : { ok: false, errors };
+    }
+  };
+}
+
+// packages/runtime/src/control-plane/validators/runtime-registration.ts
+import { existsSync as existsSync10 } from "fs";
+import { join as join3 } from "path";
+function createValidatorRegistry() {
+  const map = new Map;
+  const order = [];
+  const registry = {
+    register(v) {
+      if (map.has(v.id))
+        throw new Error(`validator already registered: ${v.id}`);
+      map.set(v.id, v);
+      order.push(v);
+    },
+    resolve(id) {
+      const v = map.get(id);
+      if (!v)
+        throw new Error(`validator not registered: ${id}`);
+      return v;
+    },
+    list: () => order
+  };
+  registerBuiltInValidators(registry);
+  return registry;
+}
+function registerBuiltInValidators(registry) {
+  registry.register({
+    id: "std:typecheck",
+    category: "custom",
+    description: "Runs the package typecheck script when present.",
+    run: async (ctx) => runStdTypecheck(ctx)
+  });
+}
+async function runStdTypecheck(ctx) {
+  const packageJsonPath = join3(ctx.workspaceRoot, "package.json");
+  if (!existsSync10(packageJsonPath)) {
+    return {
+      id: "std:typecheck",
+      passed: false,
+      summary: `package.json not found at ${packageJsonPath}`
+    };
+  }
+  const proc = Bun.spawn(["bun", "run", "typecheck"], {
+    cwd: ctx.workspaceRoot,
+    env: process.env,
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    proc.exited,
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text()
+  ]);
+  const output = `${stdout}${stderr}`.trim();
+  return {
+    id: "std:typecheck",
+    passed: exitCode === 0,
+    summary: exitCode === 0 ? "typecheck passed" : "typecheck failed",
+    ...output ? { details: output.slice(0, 4000) } : {}
+  };
+}
+
+// packages/runtime/src/control-plane/hook-materializer.ts
+import { existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname9, resolve as resolve12 } from "path";
+var MARKER_PLUGIN = "_rigPlugin";
+var MARKER_HOOK_ID = "_rigHookId";
+function matcherToString(matcher) {
+  if (matcher.kind === "all")
+    return;
+  if (matcher.kind === "tool")
+    return matcher.name;
+  return matcher.pattern;
+}
+function isPluginOwned(cmd) {
+  return typeof cmd[MARKER_PLUGIN] === "string";
+}
+function materializeHooks(projectRoot, entries) {
+  const settingsPath = resolve12(projectRoot, ".claude", "settings.json");
+  const existing = existsSync11(settingsPath) ? safeReadJson(settingsPath) : {};
+  const hooks = existing.hooks ?? {};
+  for (const event of Object.keys(hooks)) {
+    const groups = hooks[event] ?? [];
+    const cleaned = [];
+    for (const group of groups) {
+      const operatorHooks = group.hooks.filter((h) => !isPluginOwned(h));
+      if (operatorHooks.length > 0) {
+        cleaned.push({ ...group, hooks: operatorHooks });
+      }
+    }
+    if (cleaned.length > 0) {
+      hooks[event] = cleaned;
+    } else {
+      delete hooks[event];
+    }
+  }
+  for (const { pluginName, hook } of entries) {
+    if (!hook.command) {
+      continue;
+    }
+    const event = hook.event;
+    const matcherString = matcherToString(hook.matcher);
+    const groups = hooks[event] ??= [];
+    let group = groups.find((g) => g.matcher === matcherString);
+    if (!group) {
+      group = matcherString === undefined ? { hooks: [] } : { matcher: matcherString, hooks: [] };
+      groups.push(group);
+    }
+    group.hooks.push({
+      type: "command",
+      command: hook.command,
+      [MARKER_PLUGIN]: pluginName,
+      [MARKER_HOOK_ID]: hook.id
+    });
+  }
+  const next = { ...existing };
+  if (Object.keys(hooks).length > 0) {
+    next.hooks = hooks;
+  } else {
+    delete next.hooks;
+  }
+  mkdirSync8(dirname9(settingsPath), { recursive: true });
+  writeFileSync4(settingsPath, `${JSON.stringify(next, null, 2)}
+`, "utf-8");
+  return settingsPath;
+}
+function safeReadJson(path) {
+  try {
+    return JSON.parse(readFileSync4(path, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+
+// packages/runtime/src/control-plane/plugin-host-context.ts
+async function buildPluginHostContext(projectRoot) {
+  let config;
+  try {
+    config = await loadConfig(projectRoot);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("no rig.config")) {
+      return null;
+    }
+    throw err;
+  }
+  const pluginHost = createPluginHost(config.plugins);
+  setScopeRules(config.workspace.scopeNormalization);
+  const validatorRegistry = createValidatorRegistry();
+  for (const impl of pluginHost.listExecutableValidators()) {
+    validatorRegistry.register(impl);
+  }
+  const taskSourceRegistry = buildTaskSourceRegistry(config, pluginHost);
+  const repoRegistry = createRepoRegistry(pluginHost.listRepoSources());
+  const managedEntries = pluginHost.listRepoSources().map(repoRegistrationToManagedEntry).filter((e) => e !== null);
+  setManagedRepos(managedEntries);
+  const configRoleOverrides = config.runtime?.agentRoles;
+  const agentRoleRegistry = createAgentRoleRegistry(pluginHost.listAgentRoles(), configRoleOverrides);
+  const taskFieldRegistry = createTaskFieldRegistry(pluginHost.listTaskFieldExtensions());
+  try {
+    const hookEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.hooks ?? []).map((hook) => ({
+      pluginName: plugin.name,
+      hook
+    })));
+    if (hookEntries.length > 0) {
+      materializeHooks(projectRoot, hookEntries);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] hook materialization failed: ${err instanceof Error ? err.message : err}`);
+  }
+  return {
+    config,
+    pluginHost,
+    validatorRegistry,
+    taskSourceRegistry,
+    repoRegistry,
+    agentRoleRegistry,
+    taskFieldRegistry
+  };
+}
+
+// packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync13, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
+import { basename as basename5, join as join4, resolve as resolve14 } from "path";
+
+// packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
+import { existsSync as existsSync12, readFileSync as readFileSync5 } from "fs";
+import { resolve as resolve13 } from "path";
+
+// packages/runtime/src/control-plane/tasks/task-record-reader.ts
+async function findTaskById(reader, id) {
+  const tasks = await reader.listTasks();
+  return tasks.find((task) => task.id === id) ?? null;
+}
+
+// packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
+class LegacyTaskConfigReadError extends Error {
+  code = "LEGACY_TASK_CONFIG_READ_FAILED";
+  projectRoot;
+  configPath;
+  cause;
+  constructor(input) {
+    super(input.message, { cause: input.cause });
+    this.name = "LegacyTaskConfigReadError";
+    this.projectRoot = input.projectRoot;
+    this.configPath = input.configPath;
+    this.cause = input.cause;
+  }
+}
+function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
+  const configPath = options.configPath ?? resolve13(projectRoot, ".rig", "task-config.json");
+  const reader = {
+    async listTasks() {
+      return readLegacyTaskRecords(projectRoot, configPath);
+    },
+    async getTask(id) {
+      return findTaskById(reader, id);
+    }
+  };
+  return reader;
+}
+function readLegacyTaskRecords(projectRoot, configPath = resolve13(projectRoot, ".rig", "task-config.json")) {
+  if (!existsSync12(configPath)) {
+    return [];
+  }
+  const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
+  return Object.entries(stripLegacyTaskConfigMetadata(rawConfig)).map(([id, entry]) => legacyTaskConfigEntryToRecord(id, entry)).filter((record) => record !== null);
+}
+function readLegacyTaskConfigJson(projectRoot, configPath) {
+  try {
+    const parsed = JSON.parse(readFileSync5(configPath, "utf8"));
+    if (isPlainRecord(parsed)) {
+      return parsed;
+    }
+    throw new Error("task config root must be a JSON object");
+  } catch (cause) {
+    throw new LegacyTaskConfigReadError({
+      projectRoot,
+      configPath,
+      message: `Could not read legacy task config at ${configPath} for project ${projectRoot}: ${cause instanceof Error ? cause.message : String(cause)}`,
+      cause
+    });
+  }
+}
+function stripLegacyTaskConfigMetadata(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function legacyTaskConfigEntryToRecord(id, entry) {
+  if (!isPlainRecord(entry)) {
+    return null;
+  }
+  const deps = firstStringList(entry.deps, entry.dependencies, entry.validation_deps, entry.validationDeps);
+  const validation = readStringList(entry.validation);
+  const validators = readStringList(entry.validators);
+  const scope = readStringList(entry.scope);
+  const status = typeof entry.status === "string" ? entry.status : "open";
+  const title = typeof entry.title === "string" ? entry.title : undefined;
+  const description = typeof entry.description === "string" ? entry.description : undefined;
+  const acceptanceCriteria = typeof entry.acceptance_criteria === "string" ? entry.acceptance_criteria : typeof entry.acceptanceCriteria === "string" ? entry.acceptanceCriteria : undefined;
+  return {
+    id,
+    deps,
+    status,
+    source: "legacy-task-config",
+    ...title ? { title } : {},
+    ...description ? { description } : {},
+    ...acceptanceCriteria ? { acceptanceCriteria } : {},
+    ...scope.length > 0 ? { scope } : {},
+    ...validation.length > 0 ? { validation } : {},
+    ...validators.length > 0 ? { validators } : {},
+    ...preservedLegacyFields(entry)
+  };
+}
+function preservedLegacyFields(entry) {
+  const preserved = {};
+  for (const key of [
+    "role",
+    "browser",
+    "repo_pins",
+    "criticality",
+    "queue_weight",
+    "creates_repo",
+    "auto_synced"
+  ]) {
+    if (entry[key] !== undefined) {
+      preserved[key] = entry[key];
+    }
+  }
+  return preserved;
+}
+function firstStringList(...candidates) {
+  for (const candidate of candidates) {
+    const list = readStringList(candidate);
+    if (list.length > 0) {
+      return list;
+    }
+  }
+  return [];
+}
+function readStringList(candidate) {
+  if (!Array.isArray(candidate)) {
+    return [];
+  }
+  return candidate.filter((value) => typeof value === "string");
+}
+function isPlainRecord(candidate) {
+  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
+}
+
+// packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
+var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
+var FILE_TASK_PATTERN = /\.(task\.)?json$/;
+function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
+  const configPath = options.configPath ?? resolve14(projectRoot, ".rig", "task-config.json");
+  const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
+  const spawnFn = options.spawn ?? spawnSync;
+  const ghBinary = options.ghBinary ?? "gh";
+  const allowLocalFallback = options.allowLocalTaskConfigStatusFallback ?? true;
+  return {
+    async listTasks() {
+      const rawConfig = readRawTaskConfig(configPath);
+      if (!rawConfig) {
+        const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
+        return configuredFilesPath ? listFileBackedTasks(projectRoot, configuredFilesPath) : [];
+      }
+      const tasks = [];
+      const legacyTasks = await legacy.listTasks();
+      const legacyById = new Map(legacyTasks.map((task) => [task.id, task]));
+      for (const [id, rawEntry] of Object.entries(stripLegacyTaskConfigMetadata2(rawConfig))) {
+        if (!isPlainRecord2(rawEntry)) {
+          continue;
+        }
+        const metadata = readMaterializedTaskMetadata(rawEntry);
+        if (metadata.taskSource?.kind === "github-issues") {
+          tasks.push(readGithubIssueTask(ghBinary, spawnFn, id, metadata, rawEntry));
+          continue;
+        }
+        if (metadata.taskSource?.kind === "files" && metadata.taskSource.path) {
+          const fileTask = readFileBackedTask(projectRoot, metadata.taskSource.path, id, rawEntry);
+          if (fileTask)
+            tasks.push(fileTask);
+          continue;
+        }
+        if (!allowLocalFallback) {
+          continue;
+        }
+        const legacyTask = legacyById.get(id);
+        if (legacyTask) {
+          tasks.push(legacyTask);
+        }
+      }
+      return tasks;
+    },
+    async getTask(id) {
+      const rawEntry = readRawTaskEntry(configPath, id);
+      if (!rawEntry) {
+        const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
+        return configuredFilesPath ? readFileBackedTask(projectRoot, configuredFilesPath, id, {}) : null;
+      }
+      const metadata = readMaterializedTaskMetadata(rawEntry);
+      if (metadata.taskSource?.kind === "github-issues") {
+        return readGithubIssueTask(ghBinary, spawnFn, id, metadata, rawEntry);
+      }
+      if (metadata.taskSource?.kind === "files" && metadata.taskSource.path) {
+        return readFileBackedTask(projectRoot, metadata.taskSource.path, id, rawEntry);
+      }
+      return allowLocalFallback ? legacy.getTask(id) : null;
+    }
+  };
+}
+function readMaterializedTaskMetadata(entry) {
+  const rawRig = entry._rig;
+  if (!isPlainRecord2(rawRig)) {
+    return {};
+  }
+  const rawSource = rawRig.taskSource;
+  const metadata = {};
+  if (isPlainRecord2(rawSource)) {
+    const kind = typeof rawSource.kind === "string" ? rawSource.kind : "";
+    if (kind.length > 0) {
+      metadata.taskSource = {
+        kind,
+        ...typeof rawSource.path === "string" ? { path: rawSource.path } : {},
+        ...typeof rawSource.owner === "string" ? { owner: rawSource.owner } : {},
+        ...typeof rawSource.repo === "string" ? { repo: rawSource.repo } : {},
+        ...Array.isArray(rawSource.labels) ? { labels: rawSource.labels.filter((label) => typeof label === "string") } : {},
+        ...rawSource.state === "open" || rawSource.state === "closed" || rawSource.state === "all" ? { state: rawSource.state } : {}
+      };
+    }
+  }
+  if (typeof rawRig.sourceIssueId === "string") {
+    metadata.sourceIssueId = rawRig.sourceIssueId;
+  }
+  return metadata;
+}
+function readConfiguredFilesTaskSourcePath(projectRoot) {
+  const jsonPath = resolve14(projectRoot, "rig.config.json");
+  if (existsSync13(jsonPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync6(jsonPath, "utf8"));
+      if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
+        const source = parsed.taskSource;
+        return source.kind === "files" && typeof source.path === "string" ? source.path : null;
+      }
+    } catch {
+      return null;
+    }
+  }
+  const tsPath = resolve14(projectRoot, "rig.config.ts");
+  if (!existsSync13(tsPath)) {
+    return null;
+  }
+  try {
+    const source = readFileSync6(tsPath, "utf8");
+    const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
+    const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
+    if (kind !== "files") {
+      return null;
+    }
+    return taskSourceBlock.match(/path\s*:\s*["']([^"']+)["']/)?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+function readRawTaskEntry(configPath, taskId) {
+  const rawConfig = readRawTaskConfig(configPath);
+  if (!rawConfig) {
+    return null;
+  }
+  const entry = stripLegacyTaskConfigMetadata2(rawConfig)[taskId];
+  return isPlainRecord2(entry) ? entry : null;
+}
+function readRawTaskConfig(configPath) {
+  if (!existsSync13(configPath)) {
+    return null;
+  }
+  const parsed = JSON.parse(readFileSync6(configPath, "utf8"));
+  return isPlainRecord2(parsed) ? parsed : null;
+}
+function stripLegacyTaskConfigMetadata2(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function listFileBackedTasks(projectRoot, sourcePath) {
+  const directory = resolve14(projectRoot, sourcePath);
+  if (!existsSync13(directory)) {
+    return [];
+  }
+  const tasks = [];
+  for (const name of readdirSync2(directory)) {
+    if (!FILE_TASK_PATTERN.test(name))
+      continue;
+    const inferredId = basename5(name).replace(FILE_TASK_PATTERN, "");
+    const task = readFileBackedTask(projectRoot, sourcePath, inferredId, {});
+    if (task)
+      tasks.push(task);
+  }
+  return tasks;
+}
+function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
+  const file = findFileBackedTaskFile(resolve14(projectRoot, sourcePath), taskId);
+  if (!file) {
+    return null;
+  }
+  const raw = JSON.parse(readFileSync6(file, "utf8"));
+  if (!isPlainRecord2(raw)) {
+    return null;
+  }
+  return {
+    id: typeof raw.id === "string" ? raw.id : taskId,
+    deps: Array.isArray(raw.deps) ? raw.deps : Array.isArray(raw.depends_on) ? raw.depends_on : [],
+    status: typeof raw.status === "string" ? raw.status : "ready",
+    title: typeof raw.title === "string" ? raw.title : typeof rawEntry.title === "string" ? rawEntry.title : taskId,
+    ...raw
+  };
+}
+function findFileBackedTaskFile(directory, taskId) {
+  if (!existsSync13(directory)) {
+    return null;
+  }
+  for (const name of readdirSync2(directory)) {
+    if (!FILE_TASK_PATTERN.test(name))
+      continue;
+    const file = join4(directory, name);
+    try {
+      if (!statSync3(file).isFile())
+        continue;
+      const raw = JSON.parse(readFileSync6(file, "utf8"));
+      const inferredId = basename5(file).replace(FILE_TASK_PATTERN, "");
+      const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
+      if (id === taskId) {
+        return file;
+      }
+    } catch {}
+  }
+  return null;
+}
+function readGithubIssueTask(bin, spawnFn, id, metadata, rawEntry) {
+  const source = requireGithubIssueSource(metadata, id);
+  const issue = runGh(bin, [
+    "issue",
+    "view",
+    String(id),
+    "--repo",
+    `${source.owner}/${source.repo}`,
+    "--json",
+    "number,title,body,labels,state,url,assignees"
+  ], spawnFn);
+  return githubIssueToTask(issue, source, rawEntry);
+}
+function requireGithubIssueSource(metadata, id) {
+  const source = metadata.taskSource;
+  if (source?.kind === "github-issues" && source.owner && source.repo) {
+    return { owner: source.owner, repo: source.repo };
+  }
+  const parsed = metadata.sourceIssueId?.match(/^([^/]+)\/([^#]+)#(\d+)$/);
+  if (parsed && parsed[3] === id) {
+    return { owner: parsed[1], repo: parsed[2] };
+  }
+  throw new Error(`Task ${id} is marked as github-issues but has no owner/repo source metadata`);
+}
+function githubIssueToTask(issue, source, rawEntry) {
+  const labelNames = (issue.labels ?? []).map((label) => label.name);
+  const scope = labelNames.filter((label) => label.startsWith("scope:")).map((label) => label.slice("scope:".length));
+  const roleLabel = labelNames.find((label) => label.startsWith("role:"));
+  const validators = labelNames.filter((label) => label.startsWith("validator:")).map((label) => label.slice("validator:".length));
+  const body = issue.body ?? "";
+  const repo = `${source.owner}/${source.repo}`;
+  return {
+    id: String(issue.number),
+    deps: parseDeps(body),
+    status: githubStatusFor(issue),
+    title: issue.title,
+    body,
+    ...scope.length > 0 ? { scope } : {},
+    ...roleLabel ? { role: roleLabel.slice("role:".length) } : typeof rawEntry.role === "string" ? { role: rawEntry.role } : {},
+    ...validators.length > 0 ? { validators } : {},
+    ...issue.url ? { url: issue.url } : {},
+    issueType: issueTypeFor(labelNames),
+    sourceIssueId: `${repo}#${issue.number}`,
+    parentChildDeps: parseParents(body),
+    labels: labelNames,
+    raw: issue,
+    source: "github-issues",
+    _rig: {
+      taskSource: { kind: "github-issues", owner: source.owner, repo: source.repo },
+      sourceIssueId: `${repo}#${issue.number}`
+    }
+  };
+}
+function githubStatusFor(issue) {
+  const state = (issue.state ?? "").toUpperCase();
+  if (state === "CLOSED")
+    return "closed";
+  const labelNames = (issue.labels ?? []).map((label) => label.name);
+  if (labelNames.includes("in-progress"))
+    return "in_progress";
+  if (labelNames.includes("blocked"))
+    return "blocked";
+  if (labelNames.includes("ready"))
+    return "ready";
+  if (labelNames.includes("under-review"))
+    return "under_review";
+  if (labelNames.includes("failed"))
+    return "failed";
+  if (labelNames.includes("cancelled"))
+    return "cancelled";
+  return "open";
+}
+function selectedGitHubEnv() {
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+}
+function ghSpawnOptions() {
+  return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
+}
+function runGh(bin, args, spawnFn) {
+  const res = spawnFn(bin, [...args], ghSpawnOptions());
+  assertGhSuccess(args, res);
+  if (!res.stdout || res.stdout.trim() === "") {
+    throw new Error(`gh ${args.join(" ")} returned empty stdout`);
+  }
+  return JSON.parse(res.stdout);
+}
+function assertGhSuccess(args, res) {
+  if (res.error) {
+    const msg = res.error.message ?? String(res.error);
+    throw new Error(`gh CLI not available \u2014 install gh (brew install gh / apt install gh): ${msg}`);
+  }
+  if (res.status !== 0) {
+    throw new Error(`gh ${args.join(" ")} failed (exit ${res.status}): ${res.stderr}`);
+  }
+}
+function parseDeps(body) {
+  return parseIssueRefs(body, /^depends-on:\s*([^\n]+)/im);
+}
+function parseParents(body) {
+  return parseIssueRefs(body, /^parents?:\s*([^\n]+)/im);
+}
+function parseIssueRefs(body, pattern) {
+  const match = body.match(pattern);
+  if (!match)
+    return [];
+  return match[1].split(",").map((value) => value.trim()).map((value) => value.replace(/^#/, "").match(/^(\d+)/)?.[1] ?? "").filter((value) => value.length > 0);
+}
+function issueTypeFor(labels) {
+  const typed = labels.find((label) => label.startsWith("type:"));
+  if (typed)
+    return typed.slice("type:".length);
+  if (labels.includes("epic"))
+    return "epic";
+  return "task";
+}
+function isPlainRecord2(candidate) {
+  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
+}
+
+// packages/runtime/src/control-plane/tasks/source-lifecycle.ts
+function hasRunnableTaskSource(source) {
+  return Boolean(source && typeof source === "object" && !Array.isArray(source));
+}
+async function getPluginTask(projectRoot, taskId) {
+  const ctx = await buildPluginHostContext(projectRoot);
+  const [source] = ctx?.taskSourceRegistry.list() ?? [];
+  if (!hasRunnableTaskSource(source)) {
+    return ctx ? { configured: false, sourceKind: null, task: null } : null;
+  }
+  const task = source.get ? await source.get(taskId) ?? null : (await source.list()).find((entry) => entry.id === taskId) ?? null;
+  return {
+    configured: true,
+    sourceKind: source.kind,
+    task
+  };
+}
+async function readConfiguredTaskSourceTask(projectRoot, taskId) {
+  const pluginResult = await getPluginTask(projectRoot, taskId);
+  if (pluginResult)
+    return pluginResult;
+  const task = await createSourceAwareTaskConfigRecordReader(projectRoot).getTask(taskId);
+  return {
+    configured: false,
+    sourceKind: null,
+    task
+  };
+}
+
+// packages/runtime/src/control-plane/native/task-state.ts
+import { existsSync as existsSync17, readFileSync as readFileSync9, readdirSync as readdirSync3, statSync as statSync4, writeFileSync as writeFileSync7 } from "fs";
+import { basename as basename6, resolve as resolve18 } from "path";
+// packages/runtime/src/control-plane/state-sync/read.ts
+import { existsSync as existsSync16, readFileSync as readFileSync8 } from "fs";
+import { resolve as resolve17 } from "path";
+
+// packages/runtime/src/control-plane/native/git-native.ts
+import { chmodSync as chmodSync2, copyFileSync as copyFileSync3, existsSync as existsSync14, mkdirSync as mkdirSync9, readFileSync as readFileSync7, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
+import { tmpdir as tmpdir4 } from "os";
+import { dirname as dirname10, isAbsolute, resolve as resolve15 } from "path";
+import { createHash as createHash2 } from "crypto";
+var sharedGitNativeOutputDir = resolve15(tmpdir4(), "rig-native");
+var sharedGitNativeOutputPath = resolve15(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+var trackerCommandUsageProbe = "usage: rig-git fetch-ref <repo-path> <remote> <branch>";
+function temporaryGitBinaryOutputPath(outputPath) {
+  const suffix2 = process.platform === "win32" ? ".exe" : "";
+  return resolve15(dirname10(outputPath), `.rig-git-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}${suffix2}`);
+}
+function publishGitBinary(tempOutputPath, outputPath) {
+  try {
+    renameSync2(tempOutputPath, outputPath);
+  } catch (error) {
+    if (process.platform === "win32" && existsSync14(outputPath)) {
+      rmSync3(outputPath, { force: true });
+      renameSync2(tempOutputPath, outputPath);
+      return;
+    }
+    throw error;
+  }
+}
+function runtimeRigGitFileName() {
+  return `rig-git${process.platform === "win32" ? ".exe" : ""}`;
+}
+function rigGitSourceCandidates() {
+  const execDir = process.execPath?.trim() ? dirname10(process.execPath.trim()) : "";
+  const cwd = process.cwd()?.trim() || "";
+  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
+  const moduleRelativeSource = resolve15(import.meta.dir, "../../../native/rig-git.zig");
+  return [...new Set([
+    process.env.RIG_NATIVE_GIT_SOURCE?.trim() || "",
+    moduleRelativeSource,
+    projectRoot ? resolve15(projectRoot, "packages/runtime/native/rig-git.zig") : "",
+    hostProjectRoot ? resolve15(hostProjectRoot, "packages/runtime/native/rig-git.zig") : "",
+    cwd ? resolve15(cwd, "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve15(execDir, "..", "..", "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve15(execDir, "..", "native", "rig-git.zig") : ""
+  ].filter(Boolean))];
+}
+function nativePackageBinaryCandidates(fromDir, fileName) {
+  const candidates = [];
+  let cursor = resolve15(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    candidates.push(resolve15(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve15(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve15(cursor, "native", fileName), resolve15(cursor, "native", "bin", fileName));
+    const parent = dirname10(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function rigGitBinaryCandidates() {
+  const execDir = process.execPath?.trim() ? dirname10(process.execPath.trim()) : "";
+  const fileName = runtimeRigGitFileName();
+  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+  return [...new Set([
+    explicit,
+    ...nativePackageBinaryCandidates(import.meta.dir, fileName),
+    execDir ? resolve15(execDir, fileName) : "",
+    execDir ? resolve15(execDir, "..", fileName) : "",
+    execDir ? resolve15(execDir, "..", "bin", fileName) : "",
+    sharedGitNativeOutputPath
+  ].filter(Boolean))];
+}
+function resolveGitSourcePath() {
+  for (const candidate of rigGitSourceCandidates()) {
+    if (candidate && existsSync14(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function resolveGitBinaryPath() {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return null;
+  }
+  for (const candidate of rigGitBinaryCandidates()) {
+    if (candidate && existsSync14(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function preferredGitBinaryOutputPath() {
+  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+  return explicit || sharedGitNativeOutputPath;
+}
+function binarySupportsTrackerCommandsSync(binaryPath) {
+  try {
+    const probe = Bun.spawnSync([binaryPath, "fetch-ref", "."], {
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const stdout = probe.stdout.toString().trim();
+    const stderr = probe.stderr.toString().trim();
+    if (stdout.includes('"error":"unknown command"')) {
+      return false;
+    }
+    return probe.exitCode === 2 && stderr.includes(trackerCommandUsageProbe);
+  } catch {
+    return false;
+  }
+}
+function nativeBuildManifestPath(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+function hasMatchingNativeBuildManifestSync(manifestPath, buildKey) {
+  if (!existsSync14(manifestPath)) {
+    return false;
+  }
+  try {
+    const manifest = JSON.parse(readFileSync7(manifestPath, "utf8"));
+    return manifest.version === 1 && manifest.buildKey === buildKey;
+  } catch {
+    return false;
+  }
+}
+function sha256FileSync(path) {
+  return createHash2("sha256").update(readFileSync7(path)).digest("hex");
+}
+function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath()) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    throw new Error("Zig native git is disabled via RIG_DISABLE_ZIG_NATIVE=1");
+  }
+  const sourcePath = resolveGitSourcePath();
+  if (!sourcePath) {
+    const binaryPath = resolveGitBinaryPath();
+    if (binaryPath) {
+      return binaryPath;
+    }
+    throw new Error("rig-git.zig source file not found.");
+  }
+  const zigBinary = Bun.which("zig");
+  if (!zigBinary) {
+    throw new Error("zig is required to build native Rig git tools.");
+  }
+  mkdirSync9(dirname10(outputPath), { recursive: true });
+  const sourceDigest = sha256FileSync(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    zigBinary,
+    platform: process.platform,
+    arch: process.arch,
+    sourcePath,
+    sourceDigest
+  });
+  const manifestPath = nativeBuildManifestPath(outputPath);
+  const needsBuild = !existsSync14(outputPath) || !hasMatchingNativeBuildManifestSync(manifestPath, buildKey) || !binarySupportsTrackerCommandsSync(outputPath);
+  if (!needsBuild) {
+    chmodSync2(outputPath, 493);
+    return outputPath;
+  }
+  const tempOutputPath = temporaryGitBinaryOutputPath(outputPath);
+  const build = Bun.spawnSync([
+    zigBinary,
+    "build-exe",
+    sourcePath,
+    "-O",
+    "ReleaseFast",
+    `-femit-bin=${tempOutputPath}`
+  ], {
+    cwd: dirname10(sourcePath),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  if (build.exitCode !== 0 || !existsSync14(tempOutputPath)) {
+    const stderr = build.stderr.toString().trim();
+    const stdout = build.stdout.toString().trim();
+    const details = [stderr, stdout].filter(Boolean).join(`
+`);
+    throw new Error(`Failed to build native Rig git tools: ${details || `zig exited with code ${build.exitCode}`}`);
+  }
+  chmodSync2(tempOutputPath, 493);
+  if (existsSync14(outputPath) && hasMatchingNativeBuildManifestSync(manifestPath, buildKey)) {
+    rmSync3(tempOutputPath, { force: true });
+    chmodSync2(outputPath, 493);
+    return outputPath;
+  }
+  publishGitBinary(tempOutputPath, outputPath);
+  if (!binarySupportsTrackerCommandsSync(outputPath)) {
+    rmSync3(outputPath, { force: true });
+    throw new Error("Failed to build native Rig git tools: tracker command probe failed");
+  }
+  writeFileSync6(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`, "utf8");
+  return outputPath;
+}
+function runGitNative(command, args) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return { ok: false, error: "rig-git native disabled" };
+  }
+  const trackerCommand = command === "fetch-ref" || command === "read-blob-at-ref" || command === "write-tree-commit" || command === "push-ref-with-lease";
+  let binaryPath = null;
+  if (trackerCommand) {
+    try {
+      binaryPath = ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message.includes("rig-git.zig source file not found")) {
+        return { ok: false, error: "rig-git binary not found" };
+      }
+      return { ok: false, error: message };
+    }
+  } else {
+    const explicitBinaryPath = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+    binaryPath = explicitBinaryPath && existsSync14(explicitBinaryPath) ? explicitBinaryPath : !explicitBinaryPath ? resolveGitBinaryPath() : null;
+    if (!binaryPath) {
+      try {
+        binaryPath = ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (message.includes("rig-git.zig source file not found")) {
+          return { ok: false, error: "rig-git binary not found" };
+        }
+        return { ok: false, error: message };
+      }
+    }
+  }
+  try {
+    const proc = Bun.spawnSync([binaryPath, command, ...args], {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: process.env
+    });
+    if (proc.exitCode !== 0) {
+      const stdoutText = proc.stdout.toString().trim();
+      if (stdoutText) {
+        try {
+          const parsed = JSON.parse(stdoutText);
+          if (!parsed.ok) {
+            return parsed;
+          }
+        } catch {}
+      }
+      const errText = proc.stderr.toString().trim() || `exit code ${proc.exitCode}`;
+      return { ok: false, error: errText };
+    }
+    const output = proc.stdout.toString().trim();
+    return JSON.parse(output);
+  } catch (err) {
+    return { ok: false, error: String(err) };
+  }
+}
+function requireGitNative(command, args) {
+  const result = runGitNative(command, args);
+  if (!result.ok) {
+    throw new Error(`rig-git ${command} failed: ${result.error}`);
+  }
+  return result;
+}
+function requireGitNativeString(command, args) {
+  const result = requireGitNative(command, args);
+  if ("value" in result && typeof result.value === "string") {
+    return result.value;
+  }
+  throw new Error(`rig-git ${command} returned an unexpected result payload`);
+}
+function nativeFetchRef(repoPath, remote, branch) {
+  return requireGitNativeString("fetch-ref", [repoPath, remote, branch]);
+}
+function nativeReadBlobAtRef(repoPath, ref, path) {
+  const requestDir = resolve15(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
+  mkdirSync9(requestDir, { recursive: true });
+  const outputPath = resolve15(requestDir, "blob.txt");
+  try {
+    requireGitNative("read-blob-at-ref", [repoPath, ref, path, outputPath]);
+    return readFileSync7(outputPath, "utf8");
+  } finally {
+    rmSync3(requestDir, { recursive: true, force: true });
+  }
+}
+
+// packages/runtime/src/control-plane/state-sync/repo.ts
+import { existsSync as existsSync15 } from "fs";
+import { resolve as resolve16 } from "path";
+function resolveTrackerRepoPath(projectRoot) {
+  const monorepoRoot = resolveMonorepoRoot2(projectRoot);
+  try {
+    const layout = resolveMonorepoRepoLayout(projectRoot);
+    if (existsSync15(resolve16(layout.mirrorRoot, "HEAD"))) {
+      return layout.mirrorRoot;
+    }
+  } catch {}
+  return monorepoRoot;
+}
+
+// packages/runtime/src/control-plane/state-sync/read.ts
+var DEFAULT_READ_DEPS = {
+  fetchRef: nativeFetchRef,
+  readBlobAtRef: nativeReadBlobAtRef,
+  exists: existsSync16,
+  readFile: (path) => readFileSync8(path, "utf8")
+};
+function parseIssueStatus(rawStatus) {
+  const normalized = normalizeTaskLifecycleStatus(rawStatus);
+  return normalized ?? "unknown";
+}
+function parseIssueDependencies(raw) {
+  if (!Array.isArray(raw)) {
+    return [];
+  }
+  return raw.filter((entry) => !!entry && typeof entry === "object" && !Array.isArray(entry)).map((entry) => ({
+    issueId: typeof entry.issue_id === "string" && entry.issue_id.trim() ? entry.issue_id.trim() : null,
+    dependsOnId: typeof entry.depends_on_id === "string" && entry.depends_on_id.trim() ? entry.depends_on_id.trim() : null,
+    id: typeof entry.id === "string" && entry.id.trim() ? entry.id.trim() : null,
+    type: typeof entry.type === "string" && entry.type.trim() ? entry.type.trim() : null
+  }));
+}
+function parseIssuesJsonl(raw) {
+  const issues = [];
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      const record = JSON.parse(trimmed);
+      const id = typeof record.id === "string" && record.id.trim() ? record.id.trim() : "";
+      if (!id) {
+        continue;
+      }
+      const rawStatus = typeof record.status === "string" && record.status.trim() ? record.status.trim() : null;
+      issues.push({
+        id,
+        title: typeof record.title === "string" && record.title.trim() ? record.title.trim() : null,
+        description: typeof record.description === "string" && record.description.trim() ? record.description.trim() : null,
+        acceptanceCriteria: typeof record.acceptance_criteria === "string" && record.acceptance_criteria.trim() ? record.acceptance_criteria.trim() : typeof record.acceptanceCriteria === "string" && record.acceptanceCriteria.trim() ? record.acceptanceCriteria.trim() : null,
+        issueType: typeof record.issue_type === "string" && record.issue_type.trim() ? record.issue_type.trim() : null,
+        status: parseIssueStatus(rawStatus),
+        rawStatus,
+        priority: typeof record.priority === "number" ? record.priority : null,
+        dependencies: parseIssueDependencies(record.dependencies)
+      });
+    } catch {}
+  }
+  return issues;
+}
+function parseTaskStateEnvelope(raw) {
+  if (!raw || !raw.trim()) {
+    return readTaskStateMetadataEnvelope(null);
+  }
+  try {
+    return readTaskStateMetadataEnvelope(JSON.parse(raw));
+  } catch {
+    return readTaskStateMetadataEnvelope(null);
+  }
+}
+function readRemoteBlobAtRef(deps, repoPath, ref, path, options) {
+  try {
+    return deps.readBlobAtRef(repoPath, ref, path);
+  } catch (error) {
+    if (options.required) {
+      throw error;
+    }
+    return null;
+  }
+}
+function shouldPreferLocalTrackerState(options) {
+  if (!options.allowLocalFallback) {
+    return false;
+  }
+  const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (!runtimeWorkspace) {
+    return false;
+  }
+  if (process.env.RIG_TASK_RUNTIME_ID?.trim()) {
+    return true;
+  }
+  const runtimeContextPath = process.env[RUNTIME_CONTEXT_ENV]?.trim();
+  if (runtimeContextPath) {
+    return true;
+  }
+  return existsSync16(resolve17(runtimeWorkspace, ".rig", "runtime-context.json"));
+}
+function readLocalTrackerState(projectRoot, deps) {
+  const monorepoRoot = resolveMonorepoRoot2(projectRoot);
+  const issuesPath = resolve17(monorepoRoot, ".beads", "issues.jsonl");
+  const taskStatePath = resolve17(monorepoRoot, ".beads", "task-state.json");
+  return projectSyncedTrackerSnapshot({
+    source: "local",
+    issuesBaseOid: null,
+    issuesText: deps.exists(issuesPath) ? deps.readFile(issuesPath) : "",
+    taskStateBaseOid: null,
+    taskStateText: deps.exists(taskStatePath) ? deps.readFile(taskStatePath) : null
+  });
+}
+function projectSyncedTrackerSnapshot(input) {
+  if (input.source === "remote" && input.issuesBaseOid && input.taskStateBaseOid && input.issuesBaseOid !== input.taskStateBaseOid) {
+    throw new Error("Remote tracker files must be read from the same fetched base.");
+  }
+  return {
+    source: input.source,
+    baseOid: input.issuesBaseOid ?? input.taskStateBaseOid ?? null,
+    issues: parseIssuesJsonl(input.issuesText),
+    taskState: parseTaskStateEnvelope(input.taskStateText)
+  };
+}
+function readSyncedTrackerState(projectRoot, deps = {}, options = {}) {
+  const readDeps = { ...DEFAULT_READ_DEPS, ...deps };
+  const trackerRepoPath = resolveTrackerRepoPath(projectRoot);
+  if (shouldPreferLocalTrackerState(options)) {
+    return readLocalTrackerState(projectRoot, readDeps);
+  }
+  try {
+    const baseOid = readDeps.fetchRef(trackerRepoPath, "origin", "main");
+    return projectSyncedTrackerSnapshot({
+      source: "remote",
+      issuesBaseOid: baseOid,
+      issuesText: readRemoteBlobAtRef(readDeps, trackerRepoPath, baseOid, ".beads/issues.jsonl", {
+        required: true
+      }) ?? "",
+      taskStateBaseOid: baseOid,
+      taskStateText: readRemoteBlobAtRef(readDeps, trackerRepoPath, baseOid, ".beads/task-state.json", {
+        required: false
+      })
+    });
+  } catch (error) {
+    if (!options.allowLocalFallback) {
+      throw error;
+    }
+    return readLocalTrackerState(projectRoot, readDeps);
+  }
+}
+// packages/runtime/src/control-plane/state-sync/reconcile.ts
+var STALE_CLAIM_MS = 24 * 60 * 60 * 1000;
+// packages/runtime/src/control-plane/native/task-state.ts
+function readTaskConfig(projectRoot) {
+  const raw = readJsonFile(resolveTaskConfigPath(projectRoot), {});
+  return stripTaskConfigMetadata(raw);
+}
+function readSourceTaskConfig(projectRoot) {
+  const raw = readAndSyncSourceTaskConfig(projectRoot);
+  return stripTaskConfigMetadata(raw);
+}
+function readValidationDescriptions(projectRoot) {
+  const raw = readJsonFile(resolveTaskConfigPath(projectRoot), {});
+  return readValidationDescriptionMap(raw);
+}
+function readSourceValidationDescriptions(projectRoot) {
+  const rootRaw = readJsonFile(resolve18(projectRoot, "rig", "task-config.json"), {});
+  const sourcePath = findSourceTaskConfigPath(projectRoot);
+  const sourceRaw = sourcePath ? readJsonFile(sourcePath, {}) : {};
+  const rootDescriptions = readValidationDescriptionMap(rootRaw);
+  const sourceDescriptions = readValidationDescriptionMap(sourceRaw);
+  return {
+    ...rootDescriptions,
+    ...sourceDescriptions
+  };
+}
+function currentTaskId(projectRoot) {
+  const fromEnv = (process.env.RIG_TASK_ID || "").trim();
+  if (fromEnv) {
+    return fromEnv;
+  }
+  const runtimeId = (process.env.RIG_TASK_RUNTIME_ID || "").trim();
+  if (runtimeId.startsWith("task-") && runtimeId.length > "task-".length) {
+    return runtimeId.slice("task-".length);
+  }
+  const workspace = (process.env.RIG_TASK_WORKSPACE || "").trim();
+  const inferredFromWorkspace = inferTaskIdFromRuntimePath(workspace);
+  if (inferredFromWorkspace) {
+    return inferredFromWorkspace;
+  }
+  const inferredFromCwd = inferTaskIdFromRuntimePath(process.cwd());
+  if (inferredFromCwd) {
+    return inferredFromCwd;
+  }
+  try {
+    const paths = resolveHarnessPaths(projectRoot);
+    const session = readJsonFile(paths.sessionPath, {});
+    return session.activeTaskIds?.[0] || "";
+  } catch {
+    return "";
+  }
+}
+function readSourceTaskStateMetadata(projectRoot, taskId, lifecycleStatus, snapshot) {
+  const syncedSnapshot = snapshot ?? readSyncedTrackerState(projectRoot);
+  const syncedIssue = syncedSnapshot.issues.find((issue) => issue.id === taskId) ?? null;
+  const syncedLifecycleStatus = syncedIssue && syncedIssue.status !== "unknown" ? syncedIssue.status : readLocalSourceTaskLifecycleStatus(projectRoot, taskId);
+  const metadata = syncedSnapshot.taskState.tasks[taskId] ?? readLocalSourceTaskStateEnvelope(projectRoot).tasks[taskId] ?? null;
+  return discardMismatchedTaskStateMetadata({
+    taskId,
+    lifecycleStatus: syncedLifecycleStatus ?? normalizeTaskLifecycleStatus(lifecycleStatus),
+    metadata
+  });
+}
+function readValidationDescriptionMap(raw) {
+  return {
+    ...coerceValidationDescriptions(raw.validation_descriptions),
+    ...coerceValidationDescriptions(readValidationDescriptionsFromMeta(raw._meta))
+  };
+}
+function stripTaskConfigMetadata(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function coerceValidationDescriptions(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+    return {};
+  }
+  const descriptions = {};
+  for (const [key, value] of Object.entries(candidate)) {
+    if (typeof value === "string" && value.length > 0) {
+      descriptions[key] = value;
+    }
+  }
+  return descriptions;
+}
+function readValidationDescriptionsFromMeta(meta) {
+  if (!meta || typeof meta !== "object" || Array.isArray(meta)) {
+    return;
+  }
+  return meta.validation_descriptions;
+}
+function readLocalSourceTaskStateEnvelope(projectRoot) {
+  const taskStatePath = resolve18(resolveMonorepoRoot2(projectRoot), ".beads", "task-state.json");
+  return readTaskStateMetadataEnvelope(readJsonFile(taskStatePath, {}));
+}
+function readLocalSourceTaskLifecycleStatus(projectRoot, taskId) {
+  const issuesPath = resolve18(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync17(issuesPath)) {
+    return null;
+  }
+  for (const line of readFileSync9(issuesPath, "utf8").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (parsed.id === taskId && parsed.issue_type === "task") {
+        return normalizeTaskLifecycleStatus(parsed.status);
+      }
+    } catch {}
+  }
+  return null;
+}
+function inferTaskIdFromRuntimePath(path) {
+  if (!path) {
+    return "";
+  }
+  const match = path.match(/\/\.rig\/runtime\/agents\/task-([^/]+)\/worktree(?:\/|$)/) || path.match(/\/\.worktrees\/([^/]+)(?:\/|$)/);
+  const candidate = match?.[1] || "";
+  return candidate.startsWith("bd-") ? candidate : "";
+}
+function artifactDirForId(projectRoot, id) {
+  const workspaceDir = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (workspaceDir) {
+    const worktreeArtifacts = resolve18(workspaceDir, "artifacts", id);
+    if (existsSync17(worktreeArtifacts) || existsSync17(resolve18(workspaceDir, "artifacts"))) {
+      return worktreeArtifacts;
+    }
+  }
+  try {
+    const paths = resolveHarnessPaths(projectRoot);
+    return resolve18(paths.artifactsDir, id);
+  } catch {
+    return resolve18(resolveMonorepoRoot2(projectRoot), "artifacts", id);
+  }
+}
+function resolveTaskConfigPath(projectRoot) {
+  const paths = resolveHarnessPaths(projectRoot);
+  if (existsSync17(paths.taskConfigPath)) {
+    return paths.taskConfigPath;
+  }
+  for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
+    if (existsSync17(candidate)) {
+      return candidate;
+    }
+  }
+  throw new Error(`Task config missing at ${paths.taskConfigPath}.`);
+}
+function findSourceTaskConfigPath(projectRoot) {
+  for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
+    if (existsSync17(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+var FILE_TASK_PATTERN2 = /\.(task\.)?json$/;
+function readAndSyncSourceTaskConfig(projectRoot) {
+  const sourcePath = findSourceTaskConfigPath(projectRoot);
+  const raw = sourcePath ? readJsonFile(sourcePath, {}) : readConfiguredFileTaskConfig(projectRoot);
+  const synced = synchronizeTaskConfigWithTracker(projectRoot, raw);
+  if (sourcePath && synced.updated) {
+    try {
+      writeFileSync7(sourcePath, `${JSON.stringify(synced.config, null, 2)}
+`, "utf-8");
+    } catch {}
+  }
+  return synced.config;
+}
+function synchronizeTaskConfigWithTracker(projectRoot, rawConfig) {
+  const issues = readSourceIssueRecords(projectRoot);
+  if (issues.length === 0) {
+    return { config: rawConfig, updated: false };
+  }
+  const taskConfig = stripTaskConfigMetadata(rawConfig);
+  const mergedConfig = { ...taskConfig };
+  const validationDescriptions = coerceValidationDescriptions(rawConfig.validation_descriptions);
+  const metaValidationDescriptions = coerceValidationDescriptions(readValidationDescriptionsFromMeta(rawConfig._meta));
+  let updated = false;
+  for (const issue of issues) {
+    if (issue.issueType !== "task") {
+      continue;
+    }
+    if (mergedConfig[issue.id] && !shouldRefreshAutoSyncedTaskConfigEntry(mergedConfig[issue.id])) {
+      continue;
+    }
+    mergedConfig[issue.id] = buildAutoSyncedTaskConfigEntry(issue);
+    updated = true;
+  }
+  return {
+    config: {
+      ...mergedConfig,
+      ...Object.keys(validationDescriptions).length > 0 ? { validation_descriptions: validationDescriptions } : {},
+      ...Object.keys(metaValidationDescriptions).length > 0 ? { _meta: { validation_descriptions: metaValidationDescriptions } } : {}
+    },
+    updated
+  };
+}
+function shouldRefreshAutoSyncedTaskConfigEntry(entry) {
+  if (!entry || typeof entry !== "object") {
+    return false;
+  }
+  const candidate = entry;
+  if (!candidate.auto_synced) {
+    return false;
+  }
+  if (!Array.isArray(candidate.scope) || candidate.scope.length === 0) {
+    return true;
+  }
+  if (candidate.scope.some((glob) => typeof glob !== "string" || glob.trim().length === 0)) {
+    return true;
+  }
+  return !candidate.role;
+}
+function readSourceIssueRecords(projectRoot) {
+  const issuesPath = resolve18(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync17(issuesPath)) {
+    return [];
+  }
+  const records = [];
+  for (const line of readFileSync9(issuesPath, "utf-8").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(trimmed);
+      const id = typeof parsed.id === "string" ? parsed.id.trim() : "";
+      if (!id) {
+        continue;
+      }
+      records.push({
+        id,
+        title: typeof parsed.title === "string" ? parsed.title.trim() : "",
+        issueType: typeof parsed.issue_type === "string" ? parsed.issue_type.trim() : null,
+        labels: Array.isArray(parsed.labels) ? parsed.labels.filter((label) => typeof label === "string") : []
+      });
+    } catch {}
+  }
+  return records;
+}
+function buildAutoSyncedTaskConfigEntry(issue) {
+  return {
+    auto_synced: true,
+    role: inferAutoSyncedTaskRole(issue),
+    scope: inferAutoSyncedTaskScope(issue),
+    validation: []
+  };
+}
+function inferAutoSyncedTaskRole(issue) {
+  for (const label of issue.labels) {
+    if (label === "role:architect")
+      return "architect";
+    if (label === "role:extractor")
+      return "extractor";
+    if (label === "role:mechanic")
+      return "mechanic";
+    if (label === "role:verifier")
+      return "verifier";
+  }
+  if (/\bDESIGN\b/i.test(issue.title)) {
+    return "architect";
+  }
+  if (/\bInitialize\b/i.test(issue.title)) {
+    return "mechanic";
+  }
+  return "extractor";
+}
+function inferAutoSyncedTaskScope(issue) {
+  return [`artifacts/${issue.id}/**`];
+}
+function readConfiguredFileTaskConfig(projectRoot) {
+  const sourcePath = readConfiguredFilesTaskSourcePath2(projectRoot);
+  if (!sourcePath) {
+    return {};
+  }
+  const directory = resolve18(projectRoot, sourcePath);
+  if (!existsSync17(directory)) {
+    return {};
+  }
+  const config = {};
+  for (const name of readdirSync3(directory)) {
+    if (!FILE_TASK_PATTERN2.test(name))
+      continue;
+    const file = resolve18(directory, name);
+    try {
+      if (!statSync4(file).isFile())
+        continue;
+      const raw = JSON.parse(readFileSync9(file, "utf8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        continue;
+      const record = raw;
+      const inferredId = basename6(name).replace(FILE_TASK_PATTERN2, "");
+      const id = typeof record.id === "string" && record.id.trim().length > 0 ? record.id.trim() : inferredId;
+      config[id] = fileTaskToConfigEntry(record, { kind: "files", path: sourcePath });
+    } catch {}
+  }
+  return config;
+}
+function fileTaskToConfigEntry(task, source) {
+  const labels = Array.isArray(task.labels) ? task.labels.filter((label) => typeof label === "string") : [];
+  const scope = firstStringList2(task.scope, labels.filter((label) => label.startsWith("scope:")).map((label) => label.slice("scope:".length)));
+  const validation = firstStringList2(task.validation, task.validators, labels.filter((label) => label.startsWith("validator:")).map((label) => label.slice("validator:".length)));
+  const roleLabel = labels.find((label) => label.startsWith("role:"));
+  const role = typeof task.role === "string" && task.role.trim().length > 0 ? task.role.trim() : roleLabel ? roleLabel.slice("role:".length) : undefined;
+  return {
+    auto_synced: true,
+    ...typeof task.title === "string" ? { title: task.title } : {},
+    ...typeof task.status === "string" ? { status: task.status } : {},
+    ...typeof task.description === "string" ? { description: task.description } : {},
+    ...typeof task.acceptance_criteria === "string" ? { acceptance_criteria: task.acceptance_criteria } : typeof task.acceptanceCriteria === "string" ? { acceptance_criteria: task.acceptanceCriteria } : {},
+    ...role ? { role } : {},
+    ...scope.length > 0 ? { scope } : {},
+    ...validation.length > 0 ? { validation } : {},
+    _rig: { taskSource: source }
+  };
+}
+function firstStringList2(...candidates) {
+  for (const candidate of candidates) {
+    if (!Array.isArray(candidate)) {
+      continue;
+    }
+    const list = candidate.filter((entry) => typeof entry === "string" && entry.trim().length > 0);
+    if (list.length > 0) {
+      return list;
+    }
+  }
+  return [];
+}
+function readConfiguredFilesTaskSourcePath2(projectRoot) {
+  const jsonPath = resolve18(projectRoot, "rig.config.json");
+  if (existsSync17(jsonPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync9(jsonPath, "utf8"));
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        const taskSource = parsed.taskSource;
+        if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
+          const record = taskSource;
+          return record.kind === "files" && typeof record.path === "string" ? record.path : null;
+        }
+      }
+    } catch {
+      return null;
+    }
+  }
+  const tsPath = resolve18(projectRoot, "rig.config.ts");
+  if (!existsSync17(tsPath)) {
+    return null;
+  }
+  try {
+    const source = readFileSync9(tsPath, "utf8");
+    const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
+    const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
+    if (kind !== "files") {
+      return null;
+    }
+    return taskSourceBlock.match(/path\s*:\s*["']([^"']+)["']/)?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+function sourceTaskConfigCandidates(projectRoot) {
+  const runtimeContext = loadRuntimeContextFromEnv();
+  return [
+    runtimeContext?.monorepoMainRoot ? resolve18(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve18(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve18(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
+  ].filter(Boolean);
+}
+
+// packages/runtime/src/binary-run.ts
+var runtimeBinaryBuildQueue = Promise.resolve();
+// packages/runtime/src/control-plane/native/git-ops.ts
+var TASK_ARTIFACT_STAGE_FALLBACK = new Set([
+  "changed-files.txt",
+  "contract-changes.md",
+  "decision-log.md",
+  "git-state.txt",
+  "next-actions.md",
+  "pr-state.json",
+  "task-result.json",
+  "validation-summary.json"
+]);
+
+// packages/runtime/src/control-plane/provider/runtime-instructions.ts
+var CLAUDE_ROUTER_TOOL_NAMES = [
+  "`mcp__rig_runtime_tools__read`",
+  "`mcp__rig_runtime_tools__write`",
+  "`mcp__rig_runtime_tools__edit`",
+  "`mcp__rig_runtime_tools__glob`",
+  "`mcp__rig_runtime_tools__grep`"
+].join(", ");
+var CODEX_DYNAMIC_TOOL_NAMES = [
+  "`shell`",
+  "`read`",
+  "`write`",
+  "`edit`",
+  "`glob`",
+  "`grep`"
+].join(", ");
+function normalizeRuntimeInstructionProvider(value) {
+  const normalized = value?.trim().toLowerCase();
+  if (normalized === "codex" || normalized === "codex-cli" || normalized === "codex-app-server" || normalized === "gpt-codex") {
+    return "codex";
+  }
+  if (normalized === "pi" || normalized === "rig-pi" || normalized === "@rig/pi") {
+    return "pi";
+  }
+  return "claude-code";
+}
+function buildProviderRuntimeContextLines(provider) {
+  if (provider === "codex") {
+    return [
+      "Codex file and shell work must go through Rig-owned dynamic tools.",
+      `Use the dynamic tools instead: ${CODEX_DYNAMIC_TOOL_NAMES}.`,
+      "`read`/`glob`/`grep` may inspect the task worktree, `$PROJECT_RIG_ROOT`, and `$MONOREPO_MAIN_ROOT`.",
+      "`write` and `edit` remain restricted to the scoped task workspace.",
+      "Codex shell work must stay inside Rig's gatewayed binaries via the `shell` tool.",
+      "Do not invoke absolute host shell paths like `/bin/bash`, `/bin/zsh`, `/usr/bin/env`, or `/usr/bin/git`.",
+      "Parallel Rig tool calls are supported when each call stays scoped and bounded.",
+      "Never run repo-wide `rg` or `grep` against `.` or without an explicit narrow path; start with a scoped router `glob`/`grep`, `rg --files <dir>`, or pipe through `head` before widening."
+    ];
+  }
+  if (provider === "pi") {
+    return [
+      "Pi runs from the isolated Rig task worktree with its built-in `read`, `write`, `edit`, and `bash` tools enabled.",
+      "Keep writes scoped to the task workspace unless Rig-provided instructions name an explicit metadata path.",
+      "Prefer Pi file tools over shell one-liners for file reads and edits.",
+      "Keep shell commands narrow and bounded; cap broad searches before widening."
+    ];
+  }
+  return [
+    "Claude's built-in Read/Edit/Write/Glob/Grep/NotebookEdit tools are disabled in this runtime.",
+    "Use the Rig-owned router tools instead:",
+    "`read`/`glob`/`grep` may inspect the task worktree, `$PROJECT_RIG_ROOT`, and `$MONOREPO_MAIN_ROOT`.",
+    "`write` and `edit` remain restricted to the scoped task workspace.",
+    "mcp__rig_runtime_tools__read",
+    "mcp__rig_runtime_tools__write",
+    "mcp__rig_runtime_tools__edit",
+    "mcp__rig_runtime_tools__glob",
+    "mcp__rig_runtime_tools__grep",
+    "Use `.rig/bin/bash` or `.rig/bin/sh` only for shell-oriented work.",
+    "Run shell commands serially; parallel Bash calls can lose cwd state inside the isolated worktree."
+  ];
+}
+
+// packages/runtime/src/control-plane/native/task-ops.ts
+var BUILD_CONFIG = readBuildConfig();
+var BAKED_INFO_OUTPUT = BUILD_CONFIG.AGENT_INFO_OUTPUT ?? "";
+var BAKED_DEPS_OUTPUT = BUILD_CONFIG.AGENT_DEPS_OUTPUT ?? "";
+var BAKED_STATUS_OUTPUT = BUILD_CONFIG.AGENT_STATUS_OUTPUT ?? "";
+var REOPENABLE_TASK_STATUSES = new Set(["completed", "cancelled", "blocked"]);
+function hasRuntimeWorkspace() {
+  return Boolean(process.env.RIG_TASK_WORKSPACE?.trim());
+}
+function readTaskConfigForInvocation(projectRoot) {
+  return hasRuntimeWorkspace() ? readTaskConfig(projectRoot) : readSourceTaskConfig(projectRoot);
+}
+function readValidationDescriptionsForInvocation(projectRoot) {
+  return hasRuntimeWorkspace() ? readValidationDescriptions(projectRoot) : readSourceValidationDescriptions(projectRoot);
+}
+function readStringList2(candidate) {
+  return Array.isArray(candidate) ? candidate.filter((value) => typeof value === "string") : [];
+}
+function taskConfigEntryFromSourceTask(task) {
+  if (!task)
+    return {};
+  const record = task;
+  const description = firstNonEmpty(typeof record.description === "string" ? record.description : undefined, typeof record.body === "string" ? record.body : undefined);
+  const acceptance = firstNonEmpty(typeof record.acceptanceCriteria === "string" ? record.acceptanceCriteria : undefined, typeof record.acceptance_criteria === "string" ? record.acceptance_criteria : undefined);
+  const validation = readStringList2(record.validation).length > 0 ? readStringList2(record.validation) : readStringList2(record.validators);
+  const scope = readStringList2(record.scope);
+  const browser = record.browser && typeof record.browser === "object" && !Array.isArray(record.browser) ? record.browser : undefined;
+  return {
+    ...typeof record.role === "string" ? { role: record.role } : {},
+    ...description ? { description } : {},
+    ...acceptance ? { acceptance_criteria: acceptance } : {},
+    ...scope.length > 0 ? { scope } : {},
+    ...validation.length > 0 ? { validation } : {},
+    ...browser ? { browser } : {}
+  };
+}
+function taskMetadataFromSourceTask(task) {
+  if (!task)
+    return null;
+  const record = task;
+  const description = firstNonEmpty(typeof record.description === "string" ? record.description : undefined, typeof record.body === "string" ? record.body : undefined);
+  const acceptanceCriteria = firstNonEmpty(typeof record.acceptanceCriteria === "string" ? record.acceptanceCriteria : undefined, typeof record.acceptance_criteria === "string" ? record.acceptance_criteria : undefined);
+  return {
+    title: typeof record.title === "string" && record.title.trim() ? record.title : task.id,
+    ...typeof record.status === "string" ? { status: record.status } : {},
+    ...typeof record.priority === "number" ? { priority: record.priority } : {},
+    ...description ? { description } : {},
+    ...acceptanceCriteria ? { acceptanceCriteria } : {}
+  };
+}
+function sourceTaskDependencyIds(task) {
+  if (!task)
+    return null;
+  const record = task;
+  return unique([
+    ...readStringList2(record.deps),
+    ...readStringList2(record.dependencies)
+  ]).filter((id) => id !== task.id);
+}
+async function readTaskSourceRecordForInvocation(projectRoot, taskId) {
+  if (hasRuntimeWorkspace()) {
+    return null;
+  }
+  try {
+    const result = await readConfiguredTaskSourceTask(projectRoot, taskId);
+    return result.task;
+  } catch {
+    return null;
+  }
+}
+function runtimeToolSummary() {
+  const available = new Set(runtimeGatewayToolNames());
+  const shell = ["bash", "sh", "python3", "tee", "cp", "mv", "rm", "mkdir", "touch"].filter((tool) => available.has(tool));
+  return { shell, file: runtimeFileToolNames() };
+}
+function providerToolReferenceLine(provider) {
+  if (provider === "codex") {
+    return "Dynamic tool names: `shell`, `read`, `write`, `edit`, `glob`, `grep`.";
+  }
+  if (provider === "pi") {
+    return "Pi tool names: `read`, `write`, `edit`, `bash`.";
+  }
+  return "Router tool names: `mcp__rig_runtime_tools__read`, `mcp__rig_runtime_tools__write`, `mcp__rig_runtime_tools__edit`, `mcp__rig_runtime_tools__glob`, `mcp__rig_runtime_tools__grep`.";
+}
+async function taskInfo(projectRoot, taskId, runtimeProviderOverride) {
+  if (BAKED_INFO_OUTPUT) {
+    process.stdout.write(BAKED_INFO_OUTPUT);
+    return;
+  }
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask) {
+    throw new Error("No active task. Start one with: rig run start-serial");
+  }
+  const runtimeContext = loadRuntimeContextFromEnv();
+  const sourceTask = runtimeContext?.sourceTask ?? await readTaskSourceRecordForInvocation(projectRoot, activeTask);
+  const tracker = loadReadonlyTaskTrackerContext(projectRoot);
+  const taskConfig = (() => {
+    try {
+      return readTaskConfigForInvocation(projectRoot);
+    } catch {
+      return {};
+    }
+  })();
+  const entry = { ...taskConfig[activeTask] || {}, ...taskConfigEntryFromSourceTask(sourceTask) };
+  const taskMeta = taskMetadataFromSourceTask(sourceTask) ?? await readTaskMetadata(projectRoot, activeTask, tracker);
+  const runtimeProvider = runtimeProviderOverride ?? normalizeRuntimeInstructionProvider(process.env.RIG_RUNTIME_ADAPTER);
+  const description = firstNonEmpty(taskMeta?.description, entry.description);
+  const acceptanceCriteria = firstNonEmpty(taskMeta?.acceptanceCriteria, entry.acceptance_criteria);
+  const browserContext = runtimeContext?.browser ?? resolveTaskBrowserContext(entry.browser, {
+    hostProjectRoot: projectRoot
+  });
+  console.log(`=== Task: ${activeTask} ===`);
+  console.log("");
+  console.log(`Role:    ${entry.role || "unassigned"}`);
+  if (taskMeta) {
+    console.log(`Title:   ${taskMeta.title}`);
+    if (taskMeta.status) {
+      console.log(`Status:  ${taskMeta.status.toUpperCase()}`);
+    }
+    if (taskMeta.claimId) {
+      console.log(`Claim:   ${taskMeta.claimId}`);
+    }
+    if (typeof taskMeta.priority === "number") {
+      console.log(`Priority: P${taskMeta.priority}`);
+    }
+  } else {
+    console.log("Title:   (task metadata unavailable)");
+  }
+  if (description) {
+    console.log(`
+Description:`);
+    printIndented(description);
+  } else {
+    console.log('\nDescription: (not set; add one with `br update <task-id> --description "..."`)');
+  }
+  if (acceptanceCriteria) {
+    console.log(`
+Acceptance Criteria:`);
+    printIndented(acceptanceCriteria);
+  }
+  console.log(`
+Scope globs:`);
+  for (const scope of entry.scope || []) {
+    console.log(`  - ${scope}`);
+  }
+  if (entry.creates_repo) {
+    console.log(`
+  NOTE: This task creates a new repository. The scope directory does not exist yet \u2014 you are scaffolding it from scratch.`);
+  }
+  const valDescriptions = (() => {
+    try {
+      return readValidationDescriptionsForInvocation(projectRoot);
+    } catch {
+      return {};
+    }
+  })();
+  console.log(`
+Validation:`);
+  for (const cmd of entry.validation || []) {
+    const desc = valDescriptions[cmd];
+    console.log(desc ? `  $ ${cmd} \u2014 ${desc}` : `  $ ${cmd}`);
+  }
+  if (browserContext?.required) {
+    console.log(`
+Browser:`);
+    for (const line of buildBrowserGuidanceLines(browserContext)) {
+      console.log(`  - ${line}`);
+    }
+  }
+  const runtimeTools = runtimeToolSummary();
+  console.log(`
+Runtime Tools:`);
+  console.log("  - This task runtime provides audited shell tooling and Rig-owned file tools.");
+  console.log("  - Use the Rig-owned router tools for all read, search, edit, and write work inside the task workspace.");
+  for (const line of buildProviderRuntimeContextLines(runtimeProvider)) {
+    console.log(`  - ${line}`);
+  }
+  console.log("  - `write` and `edit` remain restricted to the scoped task workspace, plus the task artifact subtree at `artifacts/<taskId>/` for closeout files.");
+  console.log(`  - ${providerToolReferenceLine(runtimeProvider)}`);
+  console.log("  - Runtime tool location: `$RIG_TASK_WORKSPACE/.rig/bin`.");
+  if (runtimeTools.file.length > 0) {
+    console.log(`  - Runtime file binaries: ${runtimeTools.file.join(", ")}`);
+  }
+  if (runtimeTools.shell.length > 0) {
+    console.log(`  - Shell helpers: ${runtimeTools.shell.join(", ")}`);
+  }
+  console.log("  - Shell commands route through `rig-shell`; file-tool binaries enforce runtime workspace and scope boundaries directly.");
+  console.log(`
+Dependencies:`);
+  const deps = sourceTaskDependencyIds(sourceTask) ?? taskDependencies(projectRoot, activeTask, tracker);
+  if (deps.length === 0) {
+    console.log("  (none - root task)");
+  } else {
+    for (const dep of deps) {
+      const depMeta = readTaskMetadataFromTracker(projectRoot, dep, tracker);
+      const depStatus = depMeta?.status ? `status=${depMeta.status}` : "";
+      console.log(`  - ${dep} ${depStatus}`.trim());
+    }
+  }
+}
+async function taskDeps(projectRoot, taskId) {
+  if (BAKED_DEPS_OUTPUT) {
+    process.stdout.write(BAKED_DEPS_OUTPUT);
+    return;
+  }
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask) {
+    throw new Error("No active task.");
+  }
+  const sourceTask = loadRuntimeContextFromEnv()?.sourceTask ?? await readTaskSourceRecordForInvocation(projectRoot, activeTask);
+  const tracker = loadReadonlyTaskTrackerContext(projectRoot);
+  const deps = sourceTaskDependencyIds(sourceTask) ?? taskDependencies(projectRoot, activeTask, tracker);
+  if (deps.length === 0) {
+    console.log(`No dependencies for ${activeTask}.`);
+    return;
+  }
+  for (const dep of deps) {
+    const artifactDir = artifactDirForId(projectRoot, dep);
+    console.log(`=== ${dep} ===`);
+    if (!existsSync18(artifactDir)) {
+      console.log(`  (no artifacts yet)
+`);
+      continue;
+    }
+    printArtifactSection(resolve19(artifactDir, "decision-log.md"), "--- Decisions ---");
+    printArtifactSection(resolve19(artifactDir, "next-actions.md"), "--- Next Actions (for you) ---");
+    const changedFiles = resolve19(artifactDir, "changed-files.txt");
+    if (existsSync18(changedFiles)) {
+      const lines = readFileSync10(changedFiles, "utf-8").split(/\r?\n/).filter(Boolean);
+      console.log(`--- Changed Files (${lines.length}) ---`);
+      for (const line of lines) {
+        console.log(line);
+      }
+      console.log("");
+    }
+  }
+}
+var GENERATED_TASK_ARTIFACT_FILES = new Set([
+  "changed-files.txt",
+  "decision-log.md",
+  "next-actions.md",
+  "task-result.json",
+  "validation-summary.json",
+  "review-feedback.md",
+  "review-state.json",
+  "review-status.txt",
+  "review-greptile-raw.json",
+  "pr-state.json",
+  "git-state.txt"
+]);
+async function readTaskMetadata(projectRoot, taskId, tracker) {
+  const trackerMetadata = readTaskMetadataFromTracker(projectRoot, taskId, tracker);
+  if (trackerMetadata) {
+    return trackerMetadata;
+  }
+  try {
+    const task = await createSourceAwareTaskConfigRecordReader(projectRoot).getTask(taskId);
+    if (!task) {
+      return null;
+    }
+    const record = task;
+    const title = asNonEmptyString(record.title) || taskId;
+    const metadata = { title };
+    const status = asNonEmptyString(record.status);
+    if (status) {
+      metadata.status = normalizeTaskLifecycleStatus(status) ?? status;
+    }
+    const description = firstNonEmpty(asNonEmptyString(record.description), asNonEmptyString(record.body));
+    if (description)
+      metadata.description = description;
+    const acceptance = firstNonEmpty(asNonEmptyString(record.acceptance_criteria), asNonEmptyString(record.acceptanceCriteria));
+    if (acceptance)
+      metadata.acceptanceCriteria = acceptance;
+    const priority = record.priority;
+    if (typeof priority === "number")
+      metadata.priority = priority;
+    return metadata;
+  } catch {
+    return null;
+  }
+}
+function readTaskMetadataFromTracker(projectRoot, taskId, tracker) {
+  const context = tracker ?? loadTaskTrackerContext(projectRoot);
+  const record = context.tasksById.get(taskId);
+  if (!record?.title) {
+    return null;
+  }
+  const metadata = { title: record.title };
+  const status = asNonEmptyString(record.status);
+  if (status) {
+    const normalizedStatus = normalizeTaskLifecycleStatus(status);
+    metadata.status = normalizedStatus ?? status;
+    if (normalizedStatus) {
+      const taskState = readSourceTaskStateMetadata(projectRoot, taskId, normalizedStatus, context.snapshot);
+      if (taskState?.claimId) {
+        metadata.claimId = taskState.claimId;
+      }
+    }
+  }
+  if (typeof record.priority === "number")
+    metadata.priority = record.priority;
+  const description = asNonEmptyString(record.description);
+  if (description)
+    metadata.description = description;
+  const acceptance = firstNonEmpty(asNonEmptyString(record.acceptance_criteria), asNonEmptyString(record.acceptanceCriteria));
+  if (acceptance)
+    metadata.acceptanceCriteria = acceptance;
+  return metadata;
+}
+function asNonEmptyString(value) {
+  if (typeof value !== "string") {
+    return "";
+  }
+  return value.trim();
+}
+function firstNonEmpty(...values) {
+  for (const value of values) {
+    if (typeof value === "string" && value.trim()) {
+      return value.trim();
+    }
+  }
+  return "";
+}
+function printIndented(text) {
+  for (const line of text.split(/\r?\n/)) {
+    console.log(`  ${line}`);
+  }
+}
+function readLocalBeadsTasks(projectRoot) {
+  const issuesPath = resolve19(resolveMonorepoRoot2(projectRoot), ".beads/issues.jsonl");
+  if (!existsSync18(issuesPath)) {
+    return [];
+  }
+  const tasks = [];
+  for (const line of readFileSync10(issuesPath, "utf-8").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (parsed.issue_type === "task" && parsed.id) {
+        tasks.push({
+          id: parsed.id,
+          status: parsed.status || "open",
+          issue_type: parsed.issue_type,
+          title: parsed.title,
+          priority: parsed.priority,
+          description: parsed.description,
+          acceptance_criteria: parsed.acceptance_criteria,
+          acceptanceCriteria: parsed.acceptanceCriteria,
+          dependencies: Array.isArray(parsed.dependencies) ? parsed.dependencies : []
+        });
+      }
+    } catch {}
+  }
+  return tasks;
+}
+function readBeadsTasks(projectRoot, tracker, allowLocalFallback = false) {
+  return (tracker ?? loadTaskTrackerContext(projectRoot, undefined, allowLocalFallback)).tasks;
+}
+function loadTaskTrackerContext(projectRoot, snapshot, allowLocalFallback = false) {
+  const resolvedSnapshot = snapshot ?? readSyncedTrackerState(projectRoot, {}, allowLocalFallback ? { allowLocalFallback: true } : {});
+  const tasks = resolvedSnapshot.issues.filter((issue) => issue.issueType === "task").map(projectTaskRecordFromSyncedIssue);
+  const seenTaskIds = new Set(tasks.map((task) => task.id));
+  if (allowLocalFallback) {
+    for (const localTask of readLocalBeadsTasks(projectRoot)) {
+      if (seenTaskIds.has(localTask.id)) {
+        continue;
+      }
+      tasks.push(localTask);
+      seenTaskIds.add(localTask.id);
+    }
+  }
+  return {
+    snapshot: resolvedSnapshot,
+    tasks,
+    tasksById: new Map(tasks.map((task) => [task.id, task]))
+  };
+}
+function loadReadonlyTaskTrackerContext(projectRoot) {
+  return loadTaskTrackerContext(projectRoot, undefined, true);
+}
+function projectTaskRecordFromSyncedIssue(issue) {
+  const dependencies = issue.dependencies ?? [];
+  return {
+    id: issue.id,
+    status: issue.status === "unknown" ? issue.rawStatus || "open" : issue.status,
+    issue_type: "task",
+    title: issue.title ?? undefined,
+    priority: issue.priority ?? undefined,
+    description: issue.description ?? undefined,
+    acceptance_criteria: issue.acceptanceCriteria ?? undefined,
+    acceptanceCriteria: issue.acceptanceCriteria ?? undefined,
+    dependencies: dependencies.map((dependency) => ({
+      type: dependency.type ?? undefined,
+      issue_id: dependency.issueId ?? undefined,
+      depends_on_id: dependency.dependsOnId ?? undefined,
+      id: dependency.id ?? dependency.issueId ?? dependency.dependsOnId ?? undefined
+    }))
+  };
+}
+function taskDependencyIds(projectRoot, taskId) {
+  const tracker = loadReadonlyTaskTrackerContext(projectRoot);
+  const canonicalTaskIds = new Set(tracker.tasks.map((task) => task.id));
+  const record = readBeadsTasks(projectRoot, tracker).find((entry) => entry.id === taskId);
+  if (!record?.dependencies?.length) {
+    return [];
+  }
+  const ids = new Set;
+  for (const edge of record.dependencies) {
+    if (!edge || edge.type === "parent-child") {
+      continue;
+    }
+    for (const candidate of [edge.depends_on_id, edge.id, edge.issue_id]) {
+      if (typeof candidate !== "string" || candidate === taskId || !canonicalTaskIds.has(candidate)) {
+        continue;
+      }
+      ids.add(candidate);
+    }
+  }
+  return [...ids].sort();
+}
+function taskDependencies(projectRoot, taskId, tracker) {
+  if (!tracker) {
+    return taskDependencyIds(projectRoot, taskId);
+  }
+  const canonicalTaskIds = new Set(tracker.tasks.map((task) => task.id));
+  const record = readBeadsTasks(projectRoot, tracker).find((entry) => entry.id === taskId);
+  if (!record?.dependencies?.length) {
+    return [];
+  }
+  const ids = new Set;
+  for (const edge of record.dependencies) {
+    if (!edge || edge.type === "parent-child") {
+      continue;
+    }
+    for (const candidate of [edge.depends_on_id, edge.id, edge.issue_id]) {
+      if (typeof candidate !== "string" || candidate === taskId || !canonicalTaskIds.has(candidate)) {
+        continue;
+      }
+      ids.add(candidate);
+    }
+  }
+  return [...ids].sort();
+}
+function printArtifactSection(path, header) {
+  if (!existsSync18(path)) {
+    return;
+  }
+  console.log(header);
+  process.stdout.write(readFileSync10(path, "utf-8"));
+  console.log("");
+}
+
+// packages/runtime/src/control-plane/native/repo-ops.ts
+function primaryManagedRepoId() {
+  const entries = listManagedRepoEntries();
+  return entries.length > 0 ? entries[0].id : null;
+}
+function primaryManagedRepoAlias() {
+  const entries = listManagedRepoEntries();
+  return entries.length > 0 ? entries[0].alias : null;
+}
+function repoDiscover(projectRoot, taskId) {
+  const resolvedTask = taskId || currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    return {};
+  }
+  const explicit = explicitPins(projectRoot, resolvedTask);
+  if (Object.keys(explicit).length > 0) {
+    return explicit;
+  }
+  return discoverPins(projectRoot, resolvedTask);
+}
+function repoBaseline(projectRoot, refresh = false) {
+  const paths = resolveRepoDiscoveryPaths(projectRoot);
+  if (!refresh && existsSync19(paths.baseRepoPinsPath)) {
+    const baseline = readJsonFile(paths.baseRepoPinsPath, { recorded_at: nowIso(), repos: {} });
+    return baseline.repos || {};
+  }
+  const id = primaryManagedRepoId();
+  if (!id) {
+    return persistBaselinePins(projectRoot, {});
+  }
+  const synced = syncManagedRepo(projectRoot, id);
+  const alias = primaryManagedRepoAlias() ?? id;
+  return persistBaselinePins(projectRoot, { [alias]: synced.headCommit });
+}
+function persistBaselinePins(projectRoot, repos) {
+  const paths = resolveRepoDiscoveryPaths(projectRoot);
+  mkdirSync11(resolve20(paths.baseRepoPinsPath, ".."), { recursive: true });
+  writeFileSync9(paths.baseRepoPinsPath, `${JSON.stringify({ recorded_at: nowIso(), repos }, null, 2)}
+`, "utf-8");
+  return repos;
+}
+function explicitPins(projectRoot, taskId) {
+  const repoPins = readRepoDiscoveryTaskConfig(projectRoot)[taskId]?.repo_pins || {};
+  const normalized = {};
+  const validAliases = new Set(listManagedRepoEntries().map((e) => e.alias));
+  for (const [key, value] of Object.entries(repoPins)) {
+    if (!value) {
+      continue;
+    }
+    if (validAliases.size > 0 && !validAliases.has(key)) {
+      throw new Error(`Unsupported repo pin key for ${taskId}: ${key}. Known aliases: ${[...validAliases].join(", ") || "(none registered)"}`);
+    }
+    const existing = normalized[key];
+    if (existing && existing !== value) {
+      throw new Error(`Conflicting explicit repo pins for ${key}: ${existing} vs ${value}`);
+    }
+    normalized[key] = value;
+  }
+  return normalized;
+}
+function taskDependencies2(projectRoot, taskId) {
+  return taskDependencyIds(projectRoot, taskId);
+}
+function discoverPins(projectRoot, taskId) {
+  const deps = taskDependencies2(projectRoot, taskId);
+  if (deps.length === 0) {
+    return repoBaseline(projectRoot, true);
+  }
+  const paths = resolveRepoDiscoveryPaths(projectRoot);
+  const state = readJsonFile(paths.taskRepoCommitsPath, {});
+  const pinKeys = listManagedRepoEntries().map((e) => e.alias);
+  if (pinKeys.length === 0) {
+    return {};
+  }
+  const discovered = {};
+  for (const key of pinKeys) {
+    const commits = new Set;
+    for (const dep of deps) {
+      const fromState = state[dep]?.repos?.[key];
+      if (fromState) {
+        commits.add(fromState);
+      }
+      const fromArtifact = readPinFromArtifact(projectRoot, dep, key);
+      if (fromArtifact) {
+        commits.add(fromArtifact);
+      }
+    }
+    if (commits.size > 1) {
+      const values = [...commits].join(`
+  - `);
+      throw new Error(`Conflicting discovered pins for ${key} from dependency graph of ${taskId}:
+  - ${values}`);
+    }
+    if (commits.size === 1) {
+      discovered[key] = [...commits][0];
+    }
+  }
+  return discovered;
+}
+function readRepoDiscoveryTaskConfig(projectRoot) {
+  try {
+    return readSourceTaskConfig(projectRoot);
+  } catch {
+    return readTaskConfig(projectRoot);
+  }
+}
+function resolveRepoDiscoveryPaths(projectRoot) {
+  const monorepoRoot = resolveMonorepoRepoLayout(projectRoot).checkoutRoot;
+  const explicitHostProjectRoot = (process.env.RIG_HOST_PROJECT_ROOT || "").trim();
+  const normalizedProjectRoot = resolve20(projectRoot);
+  const hostProjectRoot = explicitHostProjectRoot && shouldUseHostProjectStateRoot(normalizedProjectRoot) ? explicitHostProjectRoot : normalizedProjectRoot;
+  const stateDir = resolve20(hostProjectRoot, ".rig", "state");
+  return {
+    monorepoRoot,
+    taskRepoCommitsPath: resolve20(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve20(stateDir, "base-repo-pins.json")
+  };
+}
+function shouldUseHostProjectStateRoot(projectRoot) {
+  const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (runtimeWorkspace && resolve20(runtimeWorkspace) === projectRoot) {
+    return true;
+  }
+  return basename7(dirname11(projectRoot)) === ".worktrees";
+}
+function readPinFromArtifact(projectRoot, depTask, repoKey) {
+  const snapshot = resolve20(artifactDirForId(projectRoot, depTask), "git-state.txt");
+  if (!existsSync19(snapshot)) {
+    return "";
+  }
+  const content = readFileSync11(snapshot, "utf-8");
+  const chunk = content.split(/\r?\n/);
+  let inSection = false;
+  for (const line of chunk) {
+    if (line.startsWith("## ")) {
+      inSection = line.startsWith(`## ${repoKey}`);
+      continue;
+    }
+    if (!inSection) {
+      continue;
+    }
+    if (line.startsWith("head:")) {
+      return line.replace(/^head:\s*/, "").trim();
+    }
+  }
+  return "";
+}
+
+// packages/runtime/src/control-plane/hooks/inject-context.ts
+function defaultMemoryQuery(taskId, runtimeContext) {
+  const role = runtimeContext?.role?.trim();
+  const scopeTerms = (runtimeContext?.scopes ?? []).flatMap((scope) => scope.split("/").slice(-3)).map((term) => term.trim()).filter(Boolean);
+  const validationTerms = (runtimeContext?.validation ?? []).map((command) => command.split(/\s+/)[0]?.trim() ?? "").filter(Boolean);
+  const parts = [...new Set([role, ...scopeTerms, ...validationTerms].filter(Boolean))];
+  return parts.join(" ").trim() || taskId;
+}
+async function printSharedMemorySection(taskId) {
+  const runtimeContext = loadRuntimeContextFromEnv();
+  const memory = runtimeContext?.memory;
+  if (!memory?.hydratedPath || !existsSync20(memory.hydratedPath)) {
+    return;
+  }
+  const db = await openMemoryDb(memory.hydratedPath);
+  try {
+    const results = await queryRelevantMemory(db, {
+      query: defaultMemoryQuery(taskId, runtimeContext),
+      limit: memory.retrieval.topK,
+      retrieval: memory.retrieval
+    });
+    if (results.length === 0) {
+      return;
+    }
+    console.log(`
+=== Shared Memory ===
+`);
+    console.log(formatMemoryQueryResults(results));
+  } finally {
+    await db.close();
+  }
+}
+async function main() {
+  const projectRoot = resolveProjectRoot();
+  const taskId = currentTaskId(projectRoot);
+  if (!taskId) {
+    console.log("No active task in Rig session. Start a run with: rig run start-serial");
+    return;
+  }
+  console.log(`=== Task Assignment: ${taskId} ===
+`);
+  await taskInfo(projectRoot, taskId);
+  await printSharedMemorySection(taskId);
+  const depIds = taskDependencyIds(projectRoot, taskId);
+  if (depIds.length > 0) {
+    console.log(`
+=== Completed Dependency Artifacts ===
+`);
+    await taskDeps(projectRoot, taskId);
+  }
+  console.log(`
+=== Repo Pin Verification ===
+`);
+  const pins = repoDiscover(projectRoot, taskId);
+  if (Object.keys(pins).length === 0) {
+    console.log("(no explicit/discovered task pins)");
+  } else {
+    for (const [key, expected] of Object.entries(pins)) {
+      const repoPath = key.startsWith("/") ? key : resolve21(projectRoot, key);
+      let current = "missing";
+      if (existsSync20(resolve21(repoPath, ".git"))) {
+        current = runCapture(["git", "-C", repoPath, "rev-parse", "HEAD"], projectRoot).stdout.trim() || "unknown";
+      }
+      console.log(`${current === expected ? "OK  " : "WARN"} ${key} expected ${expected} got ${current}`);
+    }
+  }
+  const failedPath = resolve21(resolveHarnessPaths(projectRoot).stateDir, "failed_approaches.md");
+  if (existsSync20(failedPath)) {
+    const lines = readFileSync12(failedPath, "utf-8").split(/\r?\n/);
+    let printing = false;
+    const failureLines = [];
+    for (const line of lines) {
+      if (line.startsWith("## ")) {
+        if (printing) {
+          break;
+        }
+        printing = line.includes(taskId);
+      }
+      if (printing) {
+        failureLines.push(line);
+      }
+    }
+    if (failureLines.length > 0) {
+      console.log(`
+=== Failed Approaches ===
+`);
+      for (const line of failureLines) {
+        console.log(line);
+      }
+    }
+  }
+  console.log(`
+=== Agent Runtime ===
+`);
+  await showProfile(projectRoot, false);
+  console.log(`
+=== AI Review Profile ===
+`);
+  await showReviewProfile(projectRoot);
+  console.log(`
+=== Agent CLI ===
+`);
+  console.log("Run: rig-agent help");
+  console.log("");
+  console.log("Quick reference:");
+  console.log("  rig-agent info        \u2014 Your task, role, scope, deps");
+  console.log("  rig-agent scope       \u2014 Scope globs (--files to expand)");
+  console.log("  rig-agent deps        \u2014 Dependency decisions & next-actions");
+  console.log("  rig-agent project-root \u2014 Absolute task worktree root");
+  console.log("  rig-agent monorepo-root \u2014 Absolute monorepo root");
+  console.log("  rig-agent validate    \u2014 Run validation before completing");
+  console.log("  rig-agent verify      \u2014 Run verifier (local + optional AI review)");
+  console.log("");
+  console.log("File tool contract:");
+  for (const line of buildProviderRuntimeContextLines(normalizeRuntimeInstructionProvider(process.env.RIG_RUNTIME_ADAPTER))) {
+    console.log(`  ${line}`);
+  }
+  console.log(`
+=== Working Directory ===
+`);
+  const taskWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (!taskWorkspace) {
+    throw new Error("inject-context requires RIG_TASK_WORKSPACE to point at the active runtime workspace.");
+  }
+  console.log("IMPORTANT: Your working directory is the task worktree:");
+  console.log(`  ${taskWorkspace}`);
+  console.log("");
+  console.log(`Do not use absolute root paths under ${projectRoot}/repos.`);
+  console.log("");
+  console.log("Use the agent CLI from any directory:");
+  console.log("  rig-agent <command>");
+  console.log("Scope globs are monorepo-relative inside the monorepo worktree.");
+  console.log("");
+  console.log("Path discipline:");
+  console.log("  Use absolute paths for Read/Grep/Bash after any `cd` command.");
+  console.log("  The shell session preserves cwd across commands, so relative repos/... paths can drift.");
+  console.log(`  Project root: ${taskWorkspace}`);
+  console.log(`  Monorepo root: ${taskWorkspace}`);
+}
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});