@h-rig/runtime 0.0.6-alpha.0

package/dist/src/control-plane/native/repo-ops.js

@@ -0,0 +1,2342 @@
+// @bun
+// packages/runtime/src/control-plane/native/repo-ops.ts
+import { existsSync as existsSync14, mkdirSync as mkdirSync8, readFileSync as readFileSync8, readdirSync as readdirSync3, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename6, dirname as dirname9, resolve as resolve16 } from "path";
+
+// packages/runtime/src/control-plane/state-sync/types.ts
+var SUPPORTED_TASK_STATE_SCHEMA_VERSION = 1;
+var CANONICAL_TASK_LIFECYCLE_STATUSES = new Set([
+  "draft",
+  "open",
+  "ready",
+  "queued",
+  "in_progress",
+  "under_review",
+  "blocked",
+  "completed",
+  "cancelled"
+]);
+function normalizeTaskLifecycleStatus(status) {
+  switch (status) {
+    case "draft":
+    case "open":
+    case "ready":
+    case "queued":
+    case "in_progress":
+    case "under_review":
+    case "blocked":
+    case "completed":
+    case "cancelled":
+      return status;
+    case "closed":
+      return "completed";
+    case "running":
+      return "in_progress";
+    case "failed":
+      return "ready";
+    default:
+      return null;
+  }
+}
+function normalizeTaskStateMetadataStatus(status) {
+  if (CANONICAL_TASK_LIFECYCLE_STATUSES.has(status)) {
+    return status;
+  }
+  switch (status) {
+    case "closed":
+      return "completed";
+    case "running":
+      return "in_progress";
+    case "failed":
+      return "ready";
+    default:
+      return;
+  }
+}
+function canonicalizeTaskStateMetadata(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return null;
+  }
+  const metadata = raw;
+  const claimId = typeof metadata.claimId === "string" && metadata.claimId.length > 0 ? metadata.claimId : undefined;
+  const status = normalizeTaskStateMetadataStatus(metadata.status);
+  if (!status) {
+    return null;
+  }
+  return {
+    ...claimId ? { claimId } : {},
+    status,
+    ...typeof metadata.ownerId === "string" && metadata.ownerId.length > 0 ? { ownerId: metadata.ownerId } : {},
+    ...typeof metadata.claimedAt === "string" && metadata.claimedAt.length > 0 ? { claimedAt: metadata.claimedAt } : {},
+    ...typeof metadata.lastEvidenceAt === "string" && metadata.lastEvidenceAt.length > 0 ? { lastEvidenceAt: metadata.lastEvidenceAt } : {},
+    ...typeof metadata.runId === "string" && metadata.runId.length > 0 ? { runId: metadata.runId } : {},
+    ...typeof metadata.branchName === "string" && metadata.branchName.length > 0 ? { branchName: metadata.branchName } : {},
+    ...typeof metadata.prNumber === "number" ? { prNumber: metadata.prNumber } : {},
+    ...typeof metadata.prUrl === "string" && metadata.prUrl.length > 0 ? { prUrl: metadata.prUrl } : {},
+    ...typeof metadata.reviewState === "string" && metadata.reviewState.length > 0 ? { reviewState: metadata.reviewState } : {},
+    ...typeof metadata.blockerReason === "string" && metadata.blockerReason.length > 0 ? { blockerReason: metadata.blockerReason } : {},
+    ...typeof metadata.sourceCommit === "string" && metadata.sourceCommit.length > 0 ? { sourceCommit: metadata.sourceCommit } : {}
+  };
+}
+function readTaskStateMetadataEnvelope(raw) {
+  if (!raw || typeof raw !== "object") {
+    return { schemaVersion: SUPPORTED_TASK_STATE_SCHEMA_VERSION, supported: true, baseTrackerCommit: null, tasks: {} };
+  }
+  const envelope = raw;
+  const schemaVersion = typeof envelope.schemaVersion === "number" ? envelope.schemaVersion : SUPPORTED_TASK_STATE_SCHEMA_VERSION;
+  if (schemaVersion !== SUPPORTED_TASK_STATE_SCHEMA_VERSION) {
+    return { schemaVersion, supported: false, baseTrackerCommit: null, tasks: {} };
+  }
+  const rawTasks = envelope.tasks && typeof envelope.tasks === "object" && !Array.isArray(envelope.tasks) ? envelope.tasks : {};
+  const tasks = Object.fromEntries(Object.entries(rawTasks).map(([taskId, metadata]) => [taskId, canonicalizeTaskStateMetadata(metadata)]).filter((entry) => entry[1] != null));
+  return {
+    schemaVersion,
+    supported: true,
+    baseTrackerCommit: typeof envelope.baseTrackerCommit === "string" && envelope.baseTrackerCommit.length > 0 ? envelope.baseTrackerCommit : null,
+    tasks
+  };
+}
+
+// packages/runtime/src/control-plane/runtime/context.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname, resolve } from "path";
+var RUNTIME_CONTEXT_ENV = "RIG_RUNTIME_CONTEXT_FILE";
+var runtimeContextStringFields = [
+  "runtimeId",
+  "taskId",
+  "role",
+  "workspaceDir",
+  "stateDir",
+  "logsDir",
+  "sessionDir",
+  "sessionFile",
+  "policyFile",
+  "binDir",
+  "createdAt"
+];
+var runtimeContextArrayFields = ["scopes", "validation"];
+var runtimeContextOptionalStringFields = [
+  "artifactRoot",
+  "hostProjectRoot",
+  "monorepoMainRoot",
+  "monorepoBaseRef",
+  "monorepoBaseCommit"
+];
+function loadRuntimeContext(path) {
+  const absPath = resolve(path);
+  if (!existsSync(absPath)) {
+    throw new Error(`RuntimeTaskContext file not found: ${absPath}`);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(absPath, "utf8"));
+  } catch (err) {
+    throw new Error(`Failed to parse RuntimeTaskContext at ${absPath}: ${String(err)}`);
+  }
+  if (typeof raw !== "object" || raw === null) {
+    throw new Error(`RuntimeTaskContext at ${absPath} is not an object`);
+  }
+  const obj = raw;
+  for (const field of runtimeContextStringFields) {
+    if (typeof obj[field] !== "string" || obj[field].length === 0) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a non-empty string (at ${absPath})`);
+    }
+  }
+  for (const field of runtimeContextArrayFields) {
+    if (!Array.isArray(obj[field])) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be an array (at ${absPath})`);
+    }
+    if (!obj[field].every((entry) => typeof entry === "string")) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a string[] (at ${absPath})`);
+    }
+  }
+  for (const field of runtimeContextOptionalStringFields) {
+    if (field in obj && obj[field] !== undefined && typeof obj[field] !== "string") {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a string when present (at ${absPath})`);
+    }
+  }
+  if (obj.browser !== undefined) {
+    if (typeof obj.browser !== "object" || obj.browser === null || Array.isArray(obj.browser)) {
+      throw new Error(`RuntimeTaskContext field "browser" must be an object when present (at ${absPath})`);
+    }
+    const browser = obj.browser;
+    for (const field of [
+      "preset",
+      "mode",
+      "stateDir",
+      "defaultProfile",
+      "effectiveProfile",
+      "defaultAttachUrl",
+      "effectiveAttachUrl",
+      "launchHelper",
+      "checkHelper",
+      "attachInfoHelper",
+      "e2eHelper",
+      "resetProfileHelper"
+    ]) {
+      if (typeof browser[field] !== "string" || browser[field].length === 0) {
+        throw new Error(`RuntimeTaskContext field "browser.${field}" must be a non-empty string (at ${absPath})`);
+      }
+    }
+    for (const field of ["devCommand", "launchCommand", "checkCommand", "e2eCommand"]) {
+      if (browser[field] !== undefined && typeof browser[field] !== "string") {
+        throw new Error(`RuntimeTaskContext field "browser.${field}" must be a string when present (at ${absPath})`);
+      }
+    }
+    if (typeof browser.required !== "boolean") {
+      throw new Error(`RuntimeTaskContext field "browser.required" must be a boolean (at ${absPath})`);
+    }
+  }
+  if (obj.memory !== undefined) {
+    if (typeof obj.memory !== "object" || obj.memory === null || Array.isArray(obj.memory)) {
+      throw new Error(`RuntimeTaskContext field "memory" must be an object when present (at ${absPath})`);
+    }
+    const memory = obj.memory;
+    for (const field of ["canonicalPath", "canonicalRef", "canonicalBaseOid", "hydratedPath"]) {
+      if (typeof memory[field] !== "string" || memory[field].length === 0) {
+        throw new Error(`RuntimeTaskContext field "memory.${field}" must be a non-empty string (at ${absPath})`);
+      }
+    }
+    if (typeof memory.createdFresh !== "boolean") {
+      throw new Error(`RuntimeTaskContext field "memory.createdFresh" must be a boolean (at ${absPath})`);
+    }
+    if (typeof memory.retrieval !== "object" || memory.retrieval === null || Array.isArray(memory.retrieval)) {
+      throw new Error(`RuntimeTaskContext field "memory.retrieval" must be an object (at ${absPath})`);
+    }
+    const retrieval = memory.retrieval;
+    for (const field of ["topK", "lexicalWeight", "vectorWeight", "recencyWeight", "confidenceWeight"]) {
+      if (typeof retrieval[field] !== "number" || Number.isNaN(retrieval[field])) {
+        throw new Error(`RuntimeTaskContext field "memory.retrieval.${field}" must be a number (at ${absPath})`);
+      }
+    }
+  }
+  if (obj.initialDirtyFiles !== undefined) {
+    if (typeof obj.initialDirtyFiles !== "object" || obj.initialDirtyFiles === null || Array.isArray(obj.initialDirtyFiles)) {
+      throw new Error(`RuntimeTaskContext field "initialDirtyFiles" must be an object when present (at ${absPath})`);
+    }
+    const dirtyFiles = obj.initialDirtyFiles;
+    for (const key of ["project", "monorepo"]) {
+      if (dirtyFiles[key] === undefined) {
+        continue;
+      }
+      if (!Array.isArray(dirtyFiles[key]) || !dirtyFiles[key].every((entry) => typeof entry === "string")) {
+        throw new Error(`RuntimeTaskContext field "initialDirtyFiles.${key}" must be a string[] when present (at ${absPath})`);
+      }
+    }
+  }
+  if (obj.initialHeadCommits !== undefined) {
+    if (typeof obj.initialHeadCommits !== "object" || obj.initialHeadCommits === null || Array.isArray(obj.initialHeadCommits)) {
+      throw new Error(`RuntimeTaskContext field "initialHeadCommits" must be an object when present (at ${absPath})`);
+    }
+    const headCommits = obj.initialHeadCommits;
+    for (const key of ["project", "monorepo"]) {
+      if (headCommits[key] === undefined) {
+        continue;
+      }
+      if (typeof headCommits[key] !== "string") {
+        throw new Error(`RuntimeTaskContext field "initialHeadCommits.${key}" must be a string when present (at ${absPath})`);
+      }
+    }
+  }
+  return obj;
+}
+function loadRuntimeContextFromEnv(env = process.env) {
+  const contextFile = env[RUNTIME_CONTEXT_ENV];
+  if (contextFile) {
+    return loadRuntimeContext(contextFile);
+  }
+  const inferred = findRuntimeContextFile(process.cwd());
+  if (!inferred) {
+    return null;
+  }
+  return loadRuntimeContext(inferred);
+}
+function findRuntimeContextFile(startPath) {
+  let current = resolve(startPath);
+  while (true) {
+    const candidate = resolve(current, "runtime-context.json");
+    if (existsSync(candidate) && isAgentRuntimeContextPath(candidate)) {
+      return candidate;
+    }
+    const parent = dirname(current);
+    if (parent === current) {
+      return "";
+    }
+    current = parent;
+  }
+}
+function isAgentRuntimeContextPath(path) {
+  const normalized = path.replace(/\\/g, "/");
+  return /\/\.rig\/runtime-context\.json$/.test(normalized);
+}
+
+// packages/runtime/src/control-plane/repos/registry.ts
+var MANAGED_REPOS = new Map;
+function getManagedRepoEntry(repoId) {
+  const entry = MANAGED_REPOS.get(repoId);
+  if (!entry) {
+    throw new Error(`managed repo not registered: ${repoId}. Plugins contribute repos via RigPlugin.contributes.repoSources; ` + `make sure a plugin declares this id and the plugin host has been initialized.`);
+  }
+  return entry;
+}
+function listManagedRepoEntries() {
+  return Array.from(MANAGED_REPOS.values());
+}
+function resolveManagedRepoIdByAlias(alias) {
+  for (const entry of MANAGED_REPOS.values()) {
+    if (entry.alias === alias) {
+      return entry.id;
+    }
+  }
+  return null;
+}
+// packages/runtime/src/control-plane/repos/layout.ts
+import { existsSync as existsSync3 } from "fs";
+import { basename as basename2, dirname as dirname3, join, resolve as resolve3 } from "path";
+
+// packages/runtime/src/layout.ts
+import { existsSync as existsSync2 } from "fs";
+import { basename, dirname as dirname2, resolve as resolve2 } from "path";
+var RIG_DEFINITION_DIRNAME = "rig";
+var RIG_ARTIFACTS_DIRNAME = "artifacts";
+function resolveMonorepoRoot(projectRoot) {
+  const normalizedProjectRoot = resolve2(projectRoot);
+  const explicit = process.env.MONOREPO_ROOT?.trim();
+  if (explicit) {
+    const explicitRoot = resolve2(explicit);
+    const explicitParent = dirname2(explicitRoot);
+    if (basename(explicitParent) === ".worktrees") {
+      const owner = dirname2(explicitParent);
+      const ownerHasGit = existsSync2(resolve2(owner, ".git"));
+      const ownerHasTaskConfig = existsSync2(resolve2(owner, ".rig", "task-config.json"));
+      const ownerHasRigConfig = existsSync2(resolve2(owner, "rig.config.ts"));
+      if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
+        return owner;
+      }
+      throw new Error(`MONOREPO_ROOT points to worktree ${explicitRoot}, but the owner checkout is incomplete at ${owner}.`);
+    }
+    if (!existsSync2(resolve2(explicitRoot, ".git"))) {
+      throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but no git checkout was found there.`);
+    }
+    const hasTaskConfig = existsSync2(resolve2(explicitRoot, ".rig", "task-config.json"));
+    const hasRigConfig = existsSync2(resolve2(explicitRoot, "rig.config.ts"));
+    if (!hasTaskConfig && !hasRigConfig) {
+      throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but neither .rig/task-config.json nor rig.config.ts exists there.`);
+    }
+    return explicitRoot;
+  }
+  const projectParent = dirname2(normalizedProjectRoot);
+  if (basename(projectParent) === ".worktrees") {
+    const worktreeOwner = dirname2(projectParent);
+    const ownerHasGit = existsSync2(resolve2(worktreeOwner, ".git"));
+    const ownerHasTaskConfig = existsSync2(resolve2(worktreeOwner, ".rig", "task-config.json"));
+    const ownerHasRigConfig = existsSync2(resolve2(worktreeOwner, "rig.config.ts"));
+    if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
+      return worktreeOwner;
+    }
+  }
+  return normalizedProjectRoot;
+}
+function resolveRuntimeWorkspaceLayout(workspaceDir) {
+  const root = resolve2(workspaceDir);
+  const rigRoot = resolve2(root, ".rig");
+  const logsDir = resolve2(rigRoot, "logs");
+  const stateDir = resolve2(rigRoot, "state");
+  const runtimeDir = resolve2(rigRoot, "runtime");
+  const binDir = resolve2(rigRoot, "bin");
+  return {
+    workspaceDir: root,
+    rigRoot,
+    stateDir,
+    logsDir,
+    artifactsRoot: resolve2(root, RIG_ARTIFACTS_DIRNAME),
+    runtimeDir,
+    homeDir: resolve2(rigRoot, "home"),
+    tmpDir: resolve2(rigRoot, "tmp"),
+    cacheDir: resolve2(rigRoot, "cache"),
+    sessionDir: resolve2(rigRoot, "session"),
+    binDir,
+    distDir: resolve2(rigRoot, "dist"),
+    pluginBinDir: resolve2(binDir, "plugins"),
+    contextPath: resolve2(rigRoot, "runtime-context.json"),
+    controlPlaneEventsFile: resolve2(logsDir, "control-plane.events.jsonl")
+  };
+}
+function resolveActiveRuntimeWorkspaceRoot(monorepoRoot) {
+  const explicit = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (!explicit) {
+    throw new Error("No active runtime workspace. Set RIG_TASK_WORKSPACE or provision a task runtime first.");
+  }
+  return resolve2(explicit);
+}
+function resolveRigLayout(projectRoot) {
+  const monorepoRoot = resolveMonorepoRoot(projectRoot);
+  const definitionRoot = resolve2(projectRoot, RIG_DEFINITION_DIRNAME);
+  const runtimeWorkspaceRoot = resolveActiveRuntimeWorkspaceRoot(monorepoRoot);
+  const runtimeLayout = resolveRuntimeWorkspaceLayout(runtimeWorkspaceRoot);
+  const policyDir = resolve2(definitionRoot, "policy");
+  return {
+    projectRoot,
+    monorepoRoot,
+    definitionRoot,
+    runtimeWorkspaceRoot,
+    stateRoot: runtimeLayout.rigRoot,
+    artifactsRoot: runtimeLayout.artifactsRoot,
+    configPath: resolve2(definitionRoot, "config.sh"),
+    taskConfigPath: resolve2(runtimeWorkspaceRoot, ".rig", "task-config.json"),
+    policyDir,
+    policyFile: resolve2(policyDir, "policy.json"),
+    pluginsDir: resolve2(definitionRoot, "plugins"),
+    hooksDir: resolve2(definitionRoot, "hooks"),
+    toolsDir: resolve2(definitionRoot, "tools"),
+    templatesDir: resolve2(definitionRoot, "templates"),
+    validationDir: resolve2(definitionRoot, "validation"),
+    stateDir: runtimeLayout.stateDir,
+    logsDir: runtimeLayout.logsDir,
+    notificationsDir: resolve2(definitionRoot, "notifications"),
+    runtimeDir: runtimeLayout.runtimeDir,
+    distDir: runtimeLayout.distDir,
+    binDir: runtimeLayout.binDir,
+    pluginBinDir: runtimeLayout.pluginBinDir,
+    keybindingsPath: resolve2(definitionRoot, "keybindings.json"),
+    controlPlaneEventsFile: runtimeLayout.controlPlaneEventsFile
+  };
+}
+
+// packages/runtime/src/control-plane/repos/layout.ts
+function resolveRepoStateDir(projectRoot) {
+  const normalizedProjectRoot = resolve3(projectRoot);
+  const projectParent = dirname3(normalizedProjectRoot);
+  if (basename2(projectParent) === ".worktrees") {
+    const ownerRoot = dirname3(projectParent);
+    const ownerHasRepoMarkers = existsSync3(resolve3(ownerRoot, ".git")) || existsSync3(resolve3(ownerRoot, ".rig", "state"));
+    if (ownerHasRepoMarkers) {
+      return resolve3(ownerRoot, ".rig", "state");
+    }
+  }
+  return resolve3(projectRoot, ".rig", "state");
+}
+function resolveManagedRepoLayout(projectRoot, repoId) {
+  const normalizedProjectRoot = resolve3(projectRoot);
+  const entry = getManagedRepoEntry(repoId);
+  const stateDir = resolveRepoStateDir(normalizedProjectRoot);
+  const metadataRelativePath = join("repos", entry.id);
+  const metadataRoot = resolve3(stateDir, metadataRelativePath);
+  const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  const runsInsideTaskWorktree = runtimeWorkspace && resolve3(runtimeWorkspace) === normalizedProjectRoot || basename2(dirname3(normalizedProjectRoot)) === ".worktrees";
+  const isPrimaryManagedRepo = listManagedRepoEntries()[0]?.id === repoId;
+  const checkoutRoot = isPrimaryManagedRepo && runsInsideTaskWorktree ? resolveMonorepoRoot(normalizedProjectRoot) : entry.checkoutEnvVar && process.env[entry.checkoutEnvVar]?.trim() ? resolve3(process.env[entry.checkoutEnvVar].trim()) : resolve3(normalizedProjectRoot, entry.alias);
+  return {
+    projectRoot: normalizedProjectRoot,
+    repoId: entry.id,
+    alias: entry.alias,
+    defaultBranch: entry.defaultBranch,
+    remoteUrl: entry.remoteEnvVar && process.env[entry.remoteEnvVar]?.trim() ? process.env[entry.remoteEnvVar].trim() : entry.defaultRemoteUrl,
+    checkoutRoot,
+    worktreesRoot: resolve3(checkoutRoot, ".worktrees"),
+    stateDir,
+    metadataRoot,
+    metadataRelativePath,
+    mirrorRoot: resolve3(metadataRoot, "mirror.git"),
+    mirrorStatePath: resolve3(metadataRoot, "mirror-state.json"),
+    mirrorStateRelativePath: join(metadataRelativePath, "mirror-state.json")
+  };
+}
+function resolveManagedRepoLayoutByAlias(projectRoot, alias) {
+  const repoId = resolveManagedRepoIdByAlias(alias);
+  return repoId ? resolveManagedRepoLayout(projectRoot, repoId) : null;
+}
+function resolveMonorepoRepoLayout(projectRoot) {
+  const entries = listManagedRepoEntries();
+  if (entries.length === 0) {
+    throw new Error("resolveMonorepoRepoLayout: no managed repos registered. Either contribute one via " + "RigPlugin.contributes.repoSources (with defaultBranch set), or avoid calling this " + "function for projects where the project root IS the monorepo.");
+  }
+  const primary = entries[0];
+  return resolveManagedRepoLayout(projectRoot, primary.id);
+}
+// packages/runtime/src/control-plane/repos/mirror/bootstrap.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, realpathSync } from "fs";
+import { resolve as resolve5 } from "path";
+
+// packages/runtime/src/control-plane/authority-files.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, appendFileSync, copyFileSync, statSync, readdirSync, chmodSync } from "fs";
+import { dirname as dirname4, join as join2, relative, resolve as resolve4 } from "path";
+import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+function resolveAuthorityProjectStateDir(projectRoot) {
+  const explicit = process.env.RIG_STATE_DIR?.trim();
+  if (explicit) {
+    return resolve4(explicit);
+  }
+  return resolve4(resolve4(projectRoot), ".rig", "state");
+}
+function readJsonAtPath(path, fallback) {
+  if (!existsSync4(path)) {
+    return fallback;
+  }
+  try {
+    return JSON.parse(readFileSync2(path, "utf-8"));
+  } catch {
+    return fallback;
+  }
+}
+function writeJsonAtPath(path, value) {
+  mkdirSync2(dirname4(path), { recursive: true });
+  writeFileSync2(path, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+  return path;
+}
+function readAuthorityProjectStateJson(projectRoot, relativePath, fallback) {
+  return readJsonAtPath(resolve4(resolveAuthorityProjectStateDir(projectRoot), relativePath), fallback);
+}
+function writeAuthorityProjectStateJson(projectRoot, relativePath, value) {
+  return writeJsonAtPath(resolve4(resolveAuthorityProjectStateDir(projectRoot), relativePath), value);
+}
+
+// packages/runtime/src/control-plane/repos/mirror/state.ts
+var STATE_VERSION = 1;
+function defaultMirrorState(projectRoot, repoId) {
+  const layout = resolveManagedRepoLayout(projectRoot, repoId);
+  return {
+    version: STATE_VERSION,
+    repoId,
+    remoteUrl: layout.remoteUrl,
+    defaultBranch: layout.defaultBranch
+  };
+}
+function readManagedRepoMirrorState(projectRoot, repoId) {
+  const layout = resolveManagedRepoLayout(projectRoot, repoId);
+  return readAuthorityProjectStateJson(projectRoot, layout.mirrorStateRelativePath, null);
+}
+function writeManagedRepoMirrorState(projectRoot, repoId, patch) {
+  const current = readManagedRepoMirrorState(projectRoot, repoId) || defaultMirrorState(projectRoot, repoId);
+  const next = {
+    ...current,
+    ...patch,
+    version: STATE_VERSION,
+    repoId
+  };
+  const layout = resolveManagedRepoLayout(projectRoot, repoId);
+  writeAuthorityProjectStateJson(projectRoot, layout.mirrorStateRelativePath, next);
+  return next;
+}
+
+// packages/runtime/src/control-plane/repos/mirror/bootstrap.ts
+function nowIso() {
+  return new Date().toISOString();
+}
+function runGit(command, cwd) {
+  const result = Bun.spawnSync(command, {
+    cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: process.env
+  });
+  return {
+    exitCode: result.exitCode,
+    stdout: result.stdout.toString(),
+    stderr: result.stderr.toString()
+  };
+}
+function ensureGitSuccess(result, command) {
+  if (result.exitCode !== 0) {
+    throw new Error(result.stderr || result.stdout || `git command failed: ${command.join(" ")}`);
+  }
+}
+function isUsableRemoteUrl(candidate, layout) {
+  return candidate.length > 0 && candidate !== layout.mirrorRoot && candidate !== layout.checkoutRoot;
+}
+function sameExistingPath(left, right) {
+  try {
+    return realpathSync(left) === realpathSync(right);
+  } catch {
+    return resolve5(left) === resolve5(right);
+  }
+}
+function repoLooksUsable(repoRoot, projectRoot) {
+  const probe = runGit(["git", "-C", repoRoot, "rev-parse", "--show-toplevel"], projectRoot);
+  return probe.exitCode === 0 && sameExistingPath(probe.stdout.trim(), repoRoot);
+}
+function checkoutLooksUsable(layout) {
+  return repoLooksUsable(layout.checkoutRoot, layout.projectRoot);
+}
+function resolveMirrorRemoteUrl(layout) {
+  const entry = getManagedRepoEntry(layout.repoId);
+  const explicit = entry.remoteEnvVar ? process.env[entry.remoteEnvVar]?.trim() : "";
+  if (explicit) {
+    return explicit;
+  }
+  const persisted = readManagedRepoMirrorState(layout.projectRoot, layout.repoId)?.remoteUrl?.trim();
+  if (persisted && isUsableRemoteUrl(persisted, layout)) {
+    return persisted;
+  }
+  const mirrorOrigin = runGit(["git", "--git-dir", layout.mirrorRoot, "remote", "get-url", "origin"], layout.projectRoot);
+  if (mirrorOrigin.exitCode === 0) {
+    const currentOrigin = mirrorOrigin.stdout.trim();
+    if (isUsableRemoteUrl(currentOrigin, layout)) {
+      return currentOrigin;
+    }
+  }
+  if (repoLooksUsable(layout.projectRoot, layout.projectRoot)) {
+    const projectOrigin = runGit(["git", "-C", layout.projectRoot, "remote", "get-url", "origin"], layout.projectRoot);
+    if (projectOrigin.exitCode === 0) {
+      const currentOrigin = projectOrigin.stdout.trim();
+      if (isUsableRemoteUrl(currentOrigin, layout)) {
+        return currentOrigin;
+      }
+    }
+  }
+  if (existsSync5(resolve5(layout.checkoutRoot, ".git")) && checkoutLooksUsable(layout)) {
+    const checkoutOrigin = runGit(["git", "-C", layout.checkoutRoot, "remote", "get-url", "origin"], layout.projectRoot);
+    if (checkoutOrigin.exitCode === 0) {
+      const currentOrigin = checkoutOrigin.stdout.trim();
+      if (isUsableRemoteUrl(currentOrigin, layout)) {
+        return currentOrigin;
+      }
+    }
+  }
+  return layout.remoteUrl;
+}
+function ensureManagedRepoMirror(projectRoot, repoId) {
+  const layout = resolveManagedRepoLayout(projectRoot, repoId);
+  mkdirSync3(layout.metadataRoot, { recursive: true });
+  const remoteUrl = resolveMirrorRemoteUrl(layout);
+  if (!existsSync5(resolve5(layout.mirrorRoot, "HEAD"))) {
+    ensureGitSuccess(runGit(["git", "init", "--bare", layout.mirrorRoot], layout.projectRoot), ["git", "init", "--bare", layout.mirrorRoot]);
+  }
+  const getOrigin = runGit(["git", "--git-dir", layout.mirrorRoot, "remote", "get-url", "origin"], layout.projectRoot);
+  if (getOrigin.exitCode === 0) {
+    const currentOrigin = getOrigin.stdout.trim();
+    if (currentOrigin !== remoteUrl) {
+      ensureGitSuccess(runGit(["git", "--git-dir", layout.mirrorRoot, "remote", "set-url", "origin", remoteUrl], layout.projectRoot), ["git", "--git-dir", layout.mirrorRoot, "remote", "set-url", "origin", remoteUrl]);
+    }
+  } else {
+    ensureGitSuccess(runGit(["git", "--git-dir", layout.mirrorRoot, "remote", "add", "origin", remoteUrl], layout.projectRoot), ["git", "--git-dir", layout.mirrorRoot, "remote", "add", "origin", remoteUrl]);
+  }
+  writeManagedRepoMirrorState(projectRoot, repoId, {
+    remoteUrl,
+    defaultBranch: layout.defaultBranch,
+    initializedAt: nowIso()
+  });
+  return layout;
+}
+// packages/runtime/src/control-plane/repos/mirror/refresh.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, realpathSync as realpathSync2, rmSync } from "fs";
+import { resolve as resolve6 } from "path";
+function nowIso2() {
+  return new Date().toISOString();
+}
+function runGit2(command, cwd) {
+  const result = Bun.spawnSync(command, {
+    cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+    env: process.env
+  });
+  return {
+    exitCode: result.exitCode,
+    stdout: result.stdout.toString(),
+    stderr: result.stderr.toString()
+  };
+}
+function ensureGitSuccess2(result, command) {
+  if (result.exitCode !== 0) {
+    throw new Error(result.stderr || result.stdout || `git command failed: ${command.join(" ")}`);
+  }
+  return result.stdout.trim();
+}
+function sameExistingPath2(left, right) {
+  try {
+    return realpathSync2(left) === realpathSync2(right);
+  } catch {
+    return resolve6(left) === resolve6(right);
+  }
+}
+function ensureMirrorHead(layout) {
+  ensureGitSuccess2(runGit2([
+    "git",
+    "--git-dir",
+    layout.mirrorRoot,
+    "fetch",
+    "--prune",
+    "origin",
+    "+refs/heads/*:refs/heads/*",
+    "+refs/tags/*:refs/tags/*"
+  ], layout.projectRoot), [
+    "git",
+    "--git-dir",
+    layout.mirrorRoot,
+    "fetch",
+    "--prune",
+    "origin",
+    "+refs/heads/*:refs/heads/*",
+    "+refs/tags/*:refs/tags/*"
+  ]);
+  const headRef = `refs/heads/${layout.defaultBranch}`;
+  const headCommit = ensureGitSuccess2(runGit2(["git", "--git-dir", layout.mirrorRoot, "rev-parse", headRef], layout.projectRoot), ["git", "--git-dir", layout.mirrorRoot, "rev-parse", headRef]);
+  const remoteUrl = ensureGitSuccess2(runGit2(["git", "--git-dir", layout.mirrorRoot, "remote", "get-url", "origin"], layout.projectRoot), ["git", "--git-dir", layout.mirrorRoot, "remote", "get-url", "origin"]);
+  ensureGitSuccess2(runGit2(["git", "--git-dir", layout.mirrorRoot, "symbolic-ref", "HEAD", headRef], layout.projectRoot), ["git", "--git-dir", layout.mirrorRoot, "symbolic-ref", "HEAD", headRef]);
+  writeManagedRepoMirrorState(layout.projectRoot, layout.repoId, {
+    remoteUrl,
+    defaultBranch: layout.defaultBranch,
+    lastSyncedAt: nowIso2(),
+    headRef,
+    headCommit
+  });
+  return headCommit;
+}
+function refreshManagedRepoMirror(projectRoot, repoId) {
+  const layout = ensureManagedRepoMirror(projectRoot, repoId);
+  const headCommit = ensureMirrorHead(layout);
+  return { layout, headCommit };
+}
+function checkoutLooksUsable2(layout) {
+  const probe = runGit2(["git", "-C", layout.checkoutRoot, "rev-parse", "--show-toplevel"], layout.projectRoot);
+  return probe.exitCode === 0 && sameExistingPath2(probe.stdout.trim(), layout.checkoutRoot);
+}
+function ensureCheckoutFromMirror(layout) {
+  mkdirSync4(resolve6(layout.checkoutRoot, ".."), { recursive: true });
+  const gitPath = resolve6(layout.checkoutRoot, ".git");
+  if (existsSync6(layout.checkoutRoot) && (!existsSync6(gitPath) || !checkoutLooksUsable2(layout))) {
+    rmSync(layout.checkoutRoot, { recursive: true, force: true });
+  }
+  if (!existsSync6(gitPath)) {
+    ensureGitSuccess2(runGit2(["git", "clone", layout.mirrorRoot, layout.checkoutRoot], layout.projectRoot), ["git", "clone", layout.mirrorRoot, layout.checkoutRoot]);
+  }
+  const getOrigin = runGit2(["git", "-C", layout.checkoutRoot, "remote", "get-url", "origin"], layout.projectRoot);
+  if (getOrigin.exitCode === 0) {
+    const currentOrigin = getOrigin.stdout.trim();
+    if (currentOrigin !== layout.mirrorRoot) {
+      ensureGitSuccess2(runGit2(["git", "-C", layout.checkoutRoot, "remote", "set-url", "origin", layout.mirrorRoot], layout.projectRoot), ["git", "-C", layout.checkoutRoot, "remote", "set-url", "origin", layout.mirrorRoot]);
+    }
+  } else {
+    ensureGitSuccess2(runGit2(["git", "-C", layout.checkoutRoot, "remote", "add", "origin", layout.mirrorRoot], layout.projectRoot), ["git", "-C", layout.checkoutRoot, "remote", "add", "origin", layout.mirrorRoot]);
+  }
+  ensureGitSuccess2(runGit2(["git", "-C", layout.checkoutRoot, "fetch", "origin", layout.defaultBranch], layout.projectRoot), ["git", "-C", layout.checkoutRoot, "fetch", "origin", layout.defaultBranch]);
+  ensureGitSuccess2(runGit2(["git", "-C", layout.checkoutRoot, "reset", "--hard"], layout.projectRoot), ["git", "-C", layout.checkoutRoot, "reset", "--hard"]);
+  ensureGitSuccess2(runGit2(["git", "-C", layout.checkoutRoot, "clean", "-fd"], layout.projectRoot), ["git", "-C", layout.checkoutRoot, "clean", "-fd"]);
+  ensureGitSuccess2(runGit2([
+    "git",
+    "-C",
+    layout.checkoutRoot,
+    "checkout",
+    "--force",
+    "-B",
+    layout.defaultBranch,
+    `origin/${layout.defaultBranch}`
+  ], layout.projectRoot), [
+    "git",
+    "-C",
+    layout.checkoutRoot,
+    "checkout",
+    "--force",
+    "-B",
+    layout.defaultBranch,
+    `origin/${layout.defaultBranch}`
+  ]);
+  ensureGitSuccess2(runGit2(["git", "-C", layout.checkoutRoot, "reset", "--hard", `origin/${layout.defaultBranch}`], layout.projectRoot), ["git", "-C", layout.checkoutRoot, "reset", "--hard", `origin/${layout.defaultBranch}`]);
+  ensureGitSuccess2(runGit2(["git", "-C", layout.checkoutRoot, "clean", "-fd"], layout.projectRoot), ["git", "-C", layout.checkoutRoot, "clean", "-fd"]);
+  return ensureGitSuccess2(runGit2(["git", "-C", layout.checkoutRoot, "rev-parse", "HEAD"], layout.projectRoot), ["git", "-C", layout.checkoutRoot, "rev-parse", "HEAD"]);
+}
+function syncManagedRepo(projectRoot, repoId) {
+  const { layout, headCommit } = refreshManagedRepoMirror(projectRoot, repoId);
+  const checkoutCommit = ensureCheckoutFromMirror(layout);
+  if (checkoutCommit !== headCommit) {
+    throw new Error(`Managed repo checkout ${layout.alias} is out of sync with mirror: expected ${headCommit}, got ${checkoutCommit}.`);
+  }
+  return { layout, headCommit };
+}
+// packages/runtime/src/control-plane/native/task-ops.ts
+import { appendFileSync as appendFileSync2, existsSync as existsSync13, mkdirSync as mkdirSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { resolve as resolve15 } from "path";
+
+// packages/runtime/src/build-time-config.ts
+function normalizeBuildConfig(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return {};
+  }
+  return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+}
+function readBuildConfig() {
+  if (typeof __RIG_BUILD_CONFIG__ !== "undefined") {
+    return normalizeBuildConfig(__RIG_BUILD_CONFIG__);
+  }
+  const raw = process.env.RIG_BUILD_CONFIG_JSON?.trim();
+  if (!raw) {
+    return {};
+  }
+  try {
+    return normalizeBuildConfig(JSON.parse(raw));
+  } catch {
+    return {};
+  }
+}
+
+// packages/runtime/src/control-plane/runtime/tooling/shell.ts
+import { tmpdir } from "os";
+import { basename as basename3, dirname as dirname5, resolve as resolve7 } from "path";
+var sharedNativeShellOutputDir = resolve7(tmpdir(), "rig-native");
+var sharedNativeShellOutputPath = resolve7(sharedNativeShellOutputDir, `rig-shell-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+// packages/runtime/src/control-plane/runtime/tooling/file-tools.ts
+import { tmpdir as tmpdir2 } from "os";
+import { basename as basename4, dirname as dirname6, resolve as resolve8 } from "path";
+var sharedNativeToolsOutputDir = resolve8(tmpdir2(), "rig-native");
+var sharedNativeToolsOutputPath = resolve8(sharedNativeToolsOutputDir, `rig-tools-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+// packages/runtime/src/control-plane/plugin-host-context.ts
+import { createPluginHost } from "@rig/core";
+import { loadConfig } from "@rig/core/load-config";
+
+// packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
+var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
+
+// packages/runtime/src/control-plane/native/task-state.ts
+import { existsSync as existsSync12, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
+import { basename as basename5, resolve as resolve14 } from "path";
+// packages/runtime/src/control-plane/state-sync/read.ts
+import { existsSync as existsSync11, readFileSync as readFileSync5 } from "fs";
+import { resolve as resolve13 } from "path";
+
+// packages/runtime/src/control-plane/native/git-native.ts
+import { chmodSync as chmodSync2, copyFileSync as copyFileSync2, existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync3, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { dirname as dirname7, isAbsolute, resolve as resolve9 } from "path";
+import { createHash } from "crypto";
+var sharedGitNativeOutputDir = resolve9(tmpdir3(), "rig-native");
+var sharedGitNativeOutputPath = resolve9(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+var trackerCommandUsageProbe = "usage: rig-git fetch-ref <repo-path> <remote> <branch>";
+function temporaryGitBinaryOutputPath(outputPath) {
+  const suffix = process.platform === "win32" ? ".exe" : "";
+  return resolve9(dirname7(outputPath), `.rig-git-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}${suffix}`);
+}
+function publishGitBinary(tempOutputPath, outputPath) {
+  try {
+    renameSync(tempOutputPath, outputPath);
+  } catch (error) {
+    if (process.platform === "win32" && existsSync7(outputPath)) {
+      rmSync2(outputPath, { force: true });
+      renameSync(tempOutputPath, outputPath);
+      return;
+    }
+    throw error;
+  }
+}
+function runtimeRigGitFileName() {
+  return `rig-git${process.platform === "win32" ? ".exe" : ""}`;
+}
+function rigGitSourceCandidates() {
+  const execDir = process.execPath?.trim() ? dirname7(process.execPath.trim()) : "";
+  const cwd = process.cwd()?.trim() || "";
+  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
+  const moduleRelativeSource = resolve9(import.meta.dir, "../../../native/rig-git.zig");
+  return [...new Set([
+    process.env.RIG_NATIVE_GIT_SOURCE?.trim() || "",
+    moduleRelativeSource,
+    projectRoot ? resolve9(projectRoot, "packages/runtime/native/rig-git.zig") : "",
+    hostProjectRoot ? resolve9(hostProjectRoot, "packages/runtime/native/rig-git.zig") : "",
+    cwd ? resolve9(cwd, "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve9(execDir, "..", "..", "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve9(execDir, "..", "native", "rig-git.zig") : ""
+  ].filter(Boolean))];
+}
+function nativePackageBinaryCandidates(fromDir, fileName) {
+  const candidates = [];
+  let cursor = resolve9(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    candidates.push(resolve9(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve9(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve9(cursor, "native", fileName), resolve9(cursor, "native", "bin", fileName));
+    const parent = dirname7(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function rigGitBinaryCandidates() {
+  const execDir = process.execPath?.trim() ? dirname7(process.execPath.trim()) : "";
+  const fileName = runtimeRigGitFileName();
+  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+  return [...new Set([
+    explicit,
+    ...nativePackageBinaryCandidates(import.meta.dir, fileName),
+    execDir ? resolve9(execDir, fileName) : "",
+    execDir ? resolve9(execDir, "..", fileName) : "",
+    execDir ? resolve9(execDir, "..", "bin", fileName) : "",
+    sharedGitNativeOutputPath
+  ].filter(Boolean))];
+}
+function resolveGitSourcePath() {
+  for (const candidate of rigGitSourceCandidates()) {
+    if (candidate && existsSync7(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function resolveGitBinaryPath() {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return null;
+  }
+  for (const candidate of rigGitBinaryCandidates()) {
+    if (candidate && existsSync7(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function preferredGitBinaryOutputPath() {
+  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+  return explicit || sharedGitNativeOutputPath;
+}
+function binarySupportsTrackerCommandsSync(binaryPath) {
+  try {
+    const probe = Bun.spawnSync([binaryPath, "fetch-ref", "."], {
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const stdout = probe.stdout.toString().trim();
+    const stderr = probe.stderr.toString().trim();
+    if (stdout.includes('"error":"unknown command"')) {
+      return false;
+    }
+    return probe.exitCode === 2 && stderr.includes(trackerCommandUsageProbe);
+  } catch {
+    return false;
+  }
+}
+function nativeBuildManifestPath(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+function hasMatchingNativeBuildManifestSync(manifestPath, buildKey) {
+  if (!existsSync7(manifestPath)) {
+    return false;
+  }
+  try {
+    const manifest = JSON.parse(readFileSync3(manifestPath, "utf8"));
+    return manifest.version === 1 && manifest.buildKey === buildKey;
+  } catch {
+    return false;
+  }
+}
+function sha256FileSync(path) {
+  return createHash("sha256").update(readFileSync3(path)).digest("hex");
+}
+function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath()) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    throw new Error("Zig native git is disabled via RIG_DISABLE_ZIG_NATIVE=1");
+  }
+  const sourcePath = resolveGitSourcePath();
+  if (!sourcePath) {
+    const binaryPath = resolveGitBinaryPath();
+    if (binaryPath) {
+      return binaryPath;
+    }
+    throw new Error("rig-git.zig source file not found.");
+  }
+  const zigBinary = Bun.which("zig");
+  if (!zigBinary) {
+    throw new Error("zig is required to build native Rig git tools.");
+  }
+  mkdirSync5(dirname7(outputPath), { recursive: true });
+  const sourceDigest = sha256FileSync(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    zigBinary,
+    platform: process.platform,
+    arch: process.arch,
+    sourcePath,
+    sourceDigest
+  });
+  const manifestPath = nativeBuildManifestPath(outputPath);
+  const needsBuild = !existsSync7(outputPath) || !hasMatchingNativeBuildManifestSync(manifestPath, buildKey) || !binarySupportsTrackerCommandsSync(outputPath);
+  if (!needsBuild) {
+    chmodSync2(outputPath, 493);
+    return outputPath;
+  }
+  const tempOutputPath = temporaryGitBinaryOutputPath(outputPath);
+  const build = Bun.spawnSync([
+    zigBinary,
+    "build-exe",
+    sourcePath,
+    "-O",
+    "ReleaseFast",
+    `-femit-bin=${tempOutputPath}`
+  ], {
+    cwd: dirname7(sourcePath),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  if (build.exitCode !== 0 || !existsSync7(tempOutputPath)) {
+    const stderr = build.stderr.toString().trim();
+    const stdout = build.stdout.toString().trim();
+    const details = [stderr, stdout].filter(Boolean).join(`
+`);
+    throw new Error(`Failed to build native Rig git tools: ${details || `zig exited with code ${build.exitCode}`}`);
+  }
+  chmodSync2(tempOutputPath, 493);
+  if (existsSync7(outputPath) && hasMatchingNativeBuildManifestSync(manifestPath, buildKey)) {
+    rmSync2(tempOutputPath, { force: true });
+    chmodSync2(outputPath, 493);
+    return outputPath;
+  }
+  publishGitBinary(tempOutputPath, outputPath);
+  if (!binarySupportsTrackerCommandsSync(outputPath)) {
+    rmSync2(outputPath, { force: true });
+    throw new Error("Failed to build native Rig git tools: tracker command probe failed");
+  }
+  writeFileSync3(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`, "utf8");
+  return outputPath;
+}
+function runGitNative(command, args) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return { ok: false, error: "rig-git native disabled" };
+  }
+  const trackerCommand = command === "fetch-ref" || command === "read-blob-at-ref" || command === "write-tree-commit" || command === "push-ref-with-lease";
+  let binaryPath = null;
+  if (trackerCommand) {
+    try {
+      binaryPath = ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message.includes("rig-git.zig source file not found")) {
+        return { ok: false, error: "rig-git binary not found" };
+      }
+      return { ok: false, error: message };
+    }
+  } else {
+    const explicitBinaryPath = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+    binaryPath = explicitBinaryPath && existsSync7(explicitBinaryPath) ? explicitBinaryPath : !explicitBinaryPath ? resolveGitBinaryPath() : null;
+    if (!binaryPath) {
+      try {
+        binaryPath = ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (message.includes("rig-git.zig source file not found")) {
+          return { ok: false, error: "rig-git binary not found" };
+        }
+        return { ok: false, error: message };
+      }
+    }
+  }
+  try {
+    const proc = Bun.spawnSync([binaryPath, command, ...args], {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: process.env
+    });
+    if (proc.exitCode !== 0) {
+      const stdoutText = proc.stdout.toString().trim();
+      if (stdoutText) {
+        try {
+          const parsed = JSON.parse(stdoutText);
+          if (!parsed.ok) {
+            return parsed;
+          }
+        } catch {}
+      }
+      const errText = proc.stderr.toString().trim() || `exit code ${proc.exitCode}`;
+      return { ok: false, error: errText };
+    }
+    const output = proc.stdout.toString().trim();
+    return JSON.parse(output);
+  } catch (err) {
+    return { ok: false, error: String(err) };
+  }
+}
+function requireGitNative(command, args) {
+  const result = runGitNative(command, args);
+  if (!result.ok) {
+    throw new Error(`rig-git ${command} failed: ${result.error}`);
+  }
+  return result;
+}
+function requireGitNativeString(command, args) {
+  const result = requireGitNative(command, args);
+  if ("value" in result && typeof result.value === "string") {
+    return result.value;
+  }
+  throw new Error(`rig-git ${command} returned an unexpected result payload`);
+}
+function nativeFetchRef(repoPath, remote, branch) {
+  return requireGitNativeString("fetch-ref", [repoPath, remote, branch]);
+}
+function nativeReadBlobAtRef(repoPath, ref, path) {
+  const requestDir = resolve9(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
+  mkdirSync5(requestDir, { recursive: true });
+  const outputPath = resolve9(requestDir, "blob.txt");
+  try {
+    requireGitNative("read-blob-at-ref", [repoPath, ref, path, outputPath]);
+    return readFileSync3(outputPath, "utf8");
+  } finally {
+    rmSync2(requestDir, { recursive: true, force: true });
+  }
+}
+
+// packages/runtime/src/control-plane/native/utils.ts
+import { existsSync as existsSync9, readFileSync as readFileSync4 } from "fs";
+import { resolve as resolve11 } from "path";
+
+// packages/runtime/src/control-plane/native/runtime-native.ts
+import { dlopen, ptr, suffix, toBuffer } from "bun:ffi";
+import { copyFileSync as copyFileSync3, existsSync as existsSync8, mkdirSync as mkdirSync6, renameSync as renameSync2, rmSync as rmSync3, statSync as statSync2 } from "fs";
+import { tmpdir as tmpdir4 } from "os";
+import { dirname as dirname8, resolve as resolve10 } from "path";
+var sharedNativeRuntimeOutputDir = resolve10(tmpdir4(), "rig-native");
+var sharedNativeRuntimeOutputPath = resolve10(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
+var colocatedNativeRuntimeFileName = `runtime-native.${suffix}`;
+var nativeRuntimeLibrary = await loadNativeRuntimeLibrary();
+async function ensureNativeRuntimeLibraryPath(outputPath = sharedNativeRuntimeOutputPath, options = {}) {
+  if (await buildNativeRuntimeLibrary(outputPath, options)) {
+    return outputPath;
+  }
+  return !options.force && existsSync8(outputPath) ? outputPath : null;
+}
+async function loadNativeRuntimeLibrary() {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return null;
+  }
+  for (const candidate of nativeRuntimeLibraryCandidates()) {
+    if (!candidate || !existsSync8(candidate)) {
+      continue;
+    }
+    const loaded = tryDlopenNativeRuntimeLibrary(candidate);
+    if (loaded) {
+      return loaded;
+    }
+  }
+  const builtLibraryPath = await ensureNativeRuntimeLibraryPath(sharedNativeRuntimeOutputPath, { force: true });
+  if (!builtLibraryPath) {
+    return null;
+  }
+  return tryDlopenNativeRuntimeLibrary(builtLibraryPath);
+}
+function nativePackageLibraryCandidates(fromDir, names) {
+  const candidates = [];
+  let cursor = resolve10(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    for (const name of names) {
+      candidates.push(resolve10(cursor, "native", `${process.platform}-${process.arch}`, name), resolve10(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve10(cursor, "native", name), resolve10(cursor, "native", "lib", name));
+    }
+    const parent = dirname8(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function nativeRuntimeLibraryCandidates() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_LIB?.trim() || "";
+  const execDir = process.execPath?.trim() ? dirname8(process.execPath.trim()) : "";
+  const platformSpecific = `runtime-native-${process.platform}-${process.arch}.${suffix}`;
+  return [...new Set([
+    explicit,
+    ...nativePackageLibraryCandidates(import.meta.dir, [colocatedNativeRuntimeFileName, platformSpecific]),
+    execDir ? resolve10(execDir, colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve10(execDir, platformSpecific) : "",
+    execDir ? resolve10(execDir, "..", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve10(execDir, "..", platformSpecific) : "",
+    execDir ? resolve10(execDir, "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve10(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
+    sharedNativeRuntimeOutputPath
+  ].filter(Boolean))];
+}
+function resolveNativeRuntimeSourcePath() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_SOURCE?.trim();
+  if (explicit && existsSync8(explicit)) {
+    return explicit;
+  }
+  const bundled = resolve10(import.meta.dir, "../../../native/snapshot.zig");
+  return existsSync8(bundled) ? bundled : null;
+}
+async function buildNativeRuntimeLibrary(outputPath, options = {}) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return false;
+  }
+  const zigBinary = Bun.which("zig");
+  const sourcePath = resolveNativeRuntimeSourcePath();
+  if (!zigBinary || !sourcePath) {
+    return false;
+  }
+  const tempOutputPath = `${outputPath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+  try {
+    mkdirSync6(dirname8(outputPath), { recursive: true });
+    const needsBuild = options.force === true || !existsSync8(outputPath) || statSync2(sourcePath).mtimeMs > statSync2(outputPath).mtimeMs;
+    if (!needsBuild) {
+      return true;
+    }
+    const build = Bun.spawn([
+      zigBinary,
+      "build-lib",
+      sourcePath,
+      "-dynamic",
+      "-O",
+      "ReleaseFast",
+      `-femit-bin=${tempOutputPath}`
+    ], {
+      cwd: import.meta.dir,
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const exitCode = await build.exited;
+    if (exitCode !== 0 || !existsSync8(tempOutputPath)) {
+      rmSync3(tempOutputPath, { force: true });
+      return false;
+    }
+    renameSync2(tempOutputPath, outputPath);
+    return true;
+  } catch {
+    rmSync3(tempOutputPath, { force: true });
+    return false;
+  }
+}
+function tryDlopenNativeRuntimeLibrary(outputPath) {
+  try {
+    return dlopen(outputPath, {
+      rig_scope_match: {
+        args: ["ptr", "ptr"],
+        returns: "u8"
+      },
+      snapshot_capture: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_delta: {
+        args: ["ptr", "ptr"],
+        returns: "ptr"
+      },
+      snapshot_store_delta: {
+        args: ["ptr", "ptr", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_inspect_delta: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_apply_delta: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_release: {
+        args: ["ptr"],
+        returns: "void"
+      },
+      runtime_hash_file: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_hash_tree: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_prepare_paths: {
+        args: ["ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_link_dependency_layer: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_scan_worktrees: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      }
+    });
+  } catch {
+    return null;
+  }
+}
+
+// packages/runtime/src/control-plane/native/utils.ts
+function resolveMonorepoRoot2(projectRoot) {
+  return resolveMonorepoRoot(projectRoot);
+}
+var scopeRegexCache = new Map;
+function runCapture(command, cwd, env) {
+  const result = Bun.spawnSync(command, {
+    cwd,
+    env: env ? { ...process.env, ...env } : process.env,
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  return {
+    exitCode: result.exitCode,
+    stdout: result.stdout.toString(),
+    stderr: result.stderr.toString()
+  };
+}
+function readJsonFile(path, fallback) {
+  if (!existsSync9(path)) {
+    return fallback;
+  }
+  try {
+    return JSON.parse(readFileSync4(path, "utf-8"));
+  } catch {
+    return fallback;
+  }
+}
+function nowIso3() {
+  return new Date().toISOString();
+}
+function resolveHarnessPaths(projectRoot) {
+  const hasRuntimeWorkspace = Boolean(process.env.RIG_TASK_WORKSPACE?.trim());
+  const monorepoRoot = resolveMonorepoRoot2(projectRoot);
+  const harnessRoot = resolve11(projectRoot, "rig");
+  const stateRoot = resolve11(projectRoot, ".rig");
+  const layout = hasRuntimeWorkspace ? resolveRigLayout(projectRoot) : null;
+  const stateDir = layout?.stateDir ?? resolve11(stateRoot, "state");
+  const logsDir = layout?.logsDir ?? resolve11(stateRoot, "logs");
+  const artifactsDir = layout?.artifactsRoot ?? resolve11(monorepoRoot, "artifacts");
+  const taskConfigPath = layout?.taskConfigPath ?? resolve11(monorepoRoot, ".rig", "task-config.json");
+  const binDir = layout?.binDir ?? resolve11(stateRoot, "bin");
+  return {
+    harnessRoot,
+    stateDir: process.env.RIG_STATE_DIR || stateDir,
+    artifactsDir,
+    logsDir: process.env.RIG_LOGS_DIR || logsDir,
+    binDir,
+    hooksDir: resolve11(harnessRoot, "hooks"),
+    validationDir: resolve11(harnessRoot, "validation"),
+    taskConfigPath,
+    sessionPath: process.env.RIG_SESSION_FILE || resolve11(stateRoot, "session", "session.json"),
+    monorepoRoot,
+    tsApiTestsDir: process.env.TS_API_TESTS_DIR || resolve11(monorepoRoot, "TSAPITests"),
+    taskRepoCommitsPath: resolve11(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve11(stateDir, "base-repo-pins.json"),
+    failedApproachesPath: resolve11(stateDir, "failed_approaches.md"),
+    agentProfilePath: resolve11(stateDir, "agent-profile.json"),
+    reviewProfilePath: resolve11(stateDir, "review-profile.json")
+  };
+}
+
+// packages/runtime/src/control-plane/state-sync/repo.ts
+import { existsSync as existsSync10 } from "fs";
+import { resolve as resolve12 } from "path";
+function resolveTrackerRepoPath(projectRoot) {
+  const monorepoRoot = resolveMonorepoRoot2(projectRoot);
+  try {
+    const layout = resolveMonorepoRepoLayout(projectRoot);
+    if (existsSync10(resolve12(layout.mirrorRoot, "HEAD"))) {
+      return layout.mirrorRoot;
+    }
+  } catch {}
+  return monorepoRoot;
+}
+
+// packages/runtime/src/control-plane/state-sync/read.ts
+var DEFAULT_READ_DEPS = {
+  fetchRef: nativeFetchRef,
+  readBlobAtRef: nativeReadBlobAtRef,
+  exists: existsSync11,
+  readFile: (path) => readFileSync5(path, "utf8")
+};
+function parseIssueStatus(rawStatus) {
+  const normalized = normalizeTaskLifecycleStatus(rawStatus);
+  return normalized ?? "unknown";
+}
+function parseIssueDependencies(raw) {
+  if (!Array.isArray(raw)) {
+    return [];
+  }
+  return raw.filter((entry) => !!entry && typeof entry === "object" && !Array.isArray(entry)).map((entry) => ({
+    issueId: typeof entry.issue_id === "string" && entry.issue_id.trim() ? entry.issue_id.trim() : null,
+    dependsOnId: typeof entry.depends_on_id === "string" && entry.depends_on_id.trim() ? entry.depends_on_id.trim() : null,
+    id: typeof entry.id === "string" && entry.id.trim() ? entry.id.trim() : null,
+    type: typeof entry.type === "string" && entry.type.trim() ? entry.type.trim() : null
+  }));
+}
+function parseIssuesJsonl(raw) {
+  const issues = [];
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      const record = JSON.parse(trimmed);
+      const id = typeof record.id === "string" && record.id.trim() ? record.id.trim() : "";
+      if (!id) {
+        continue;
+      }
+      const rawStatus = typeof record.status === "string" && record.status.trim() ? record.status.trim() : null;
+      issues.push({
+        id,
+        title: typeof record.title === "string" && record.title.trim() ? record.title.trim() : null,
+        description: typeof record.description === "string" && record.description.trim() ? record.description.trim() : null,
+        acceptanceCriteria: typeof record.acceptance_criteria === "string" && record.acceptance_criteria.trim() ? record.acceptance_criteria.trim() : typeof record.acceptanceCriteria === "string" && record.acceptanceCriteria.trim() ? record.acceptanceCriteria.trim() : null,
+        issueType: typeof record.issue_type === "string" && record.issue_type.trim() ? record.issue_type.trim() : null,
+        status: parseIssueStatus(rawStatus),
+        rawStatus,
+        priority: typeof record.priority === "number" ? record.priority : null,
+        dependencies: parseIssueDependencies(record.dependencies)
+      });
+    } catch {}
+  }
+  return issues;
+}
+function parseTaskStateEnvelope(raw) {
+  if (!raw || !raw.trim()) {
+    return readTaskStateMetadataEnvelope(null);
+  }
+  try {
+    return readTaskStateMetadataEnvelope(JSON.parse(raw));
+  } catch {
+    return readTaskStateMetadataEnvelope(null);
+  }
+}
+function readRemoteBlobAtRef(deps, repoPath, ref, path, options) {
+  try {
+    return deps.readBlobAtRef(repoPath, ref, path);
+  } catch (error) {
+    if (options.required) {
+      throw error;
+    }
+    return null;
+  }
+}
+function shouldPreferLocalTrackerState(options) {
+  if (!options.allowLocalFallback) {
+    return false;
+  }
+  const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (!runtimeWorkspace) {
+    return false;
+  }
+  if (process.env.RIG_TASK_RUNTIME_ID?.trim()) {
+    return true;
+  }
+  const runtimeContextPath = process.env[RUNTIME_CONTEXT_ENV]?.trim();
+  if (runtimeContextPath) {
+    return true;
+  }
+  return existsSync11(resolve13(runtimeWorkspace, ".rig", "runtime-context.json"));
+}
+function readLocalTrackerState(projectRoot, deps) {
+  const monorepoRoot = resolveMonorepoRoot2(projectRoot);
+  const issuesPath = resolve13(monorepoRoot, ".beads", "issues.jsonl");
+  const taskStatePath = resolve13(monorepoRoot, ".beads", "task-state.json");
+  return projectSyncedTrackerSnapshot({
+    source: "local",
+    issuesBaseOid: null,
+    issuesText: deps.exists(issuesPath) ? deps.readFile(issuesPath) : "",
+    taskStateBaseOid: null,
+    taskStateText: deps.exists(taskStatePath) ? deps.readFile(taskStatePath) : null
+  });
+}
+function projectSyncedTrackerSnapshot(input) {
+  if (input.source === "remote" && input.issuesBaseOid && input.taskStateBaseOid && input.issuesBaseOid !== input.taskStateBaseOid) {
+    throw new Error("Remote tracker files must be read from the same fetched base.");
+  }
+  return {
+    source: input.source,
+    baseOid: input.issuesBaseOid ?? input.taskStateBaseOid ?? null,
+    issues: parseIssuesJsonl(input.issuesText),
+    taskState: parseTaskStateEnvelope(input.taskStateText)
+  };
+}
+function readSyncedTrackerState(projectRoot, deps = {}, options = {}) {
+  const readDeps = { ...DEFAULT_READ_DEPS, ...deps };
+  const trackerRepoPath = resolveTrackerRepoPath(projectRoot);
+  if (shouldPreferLocalTrackerState(options)) {
+    return readLocalTrackerState(projectRoot, readDeps);
+  }
+  try {
+    const baseOid = readDeps.fetchRef(trackerRepoPath, "origin", "main");
+    return projectSyncedTrackerSnapshot({
+      source: "remote",
+      issuesBaseOid: baseOid,
+      issuesText: readRemoteBlobAtRef(readDeps, trackerRepoPath, baseOid, ".beads/issues.jsonl", {
+        required: true
+      }) ?? "",
+      taskStateBaseOid: baseOid,
+      taskStateText: readRemoteBlobAtRef(readDeps, trackerRepoPath, baseOid, ".beads/task-state.json", {
+        required: false
+      })
+    });
+  } catch (error) {
+    if (!options.allowLocalFallback) {
+      throw error;
+    }
+    return readLocalTrackerState(projectRoot, readDeps);
+  }
+}
+// packages/runtime/src/control-plane/state-sync/reconcile.ts
+var STALE_CLAIM_MS = 24 * 60 * 60 * 1000;
+// packages/runtime/src/control-plane/native/task-state.ts
+function readTaskConfig(projectRoot) {
+  const raw = readJsonFile(resolveTaskConfigPath(projectRoot), {});
+  return stripTaskConfigMetadata(raw);
+}
+function readSourceTaskConfig(projectRoot) {
+  const raw = readAndSyncSourceTaskConfig(projectRoot);
+  return stripTaskConfigMetadata(raw);
+}
+function currentTaskId(projectRoot) {
+  const fromEnv = (process.env.RIG_TASK_ID || "").trim();
+  if (fromEnv) {
+    return fromEnv;
+  }
+  const runtimeId = (process.env.RIG_TASK_RUNTIME_ID || "").trim();
+  if (runtimeId.startsWith("task-") && runtimeId.length > "task-".length) {
+    return runtimeId.slice("task-".length);
+  }
+  const workspace = (process.env.RIG_TASK_WORKSPACE || "").trim();
+  const inferredFromWorkspace = inferTaskIdFromRuntimePath(workspace);
+  if (inferredFromWorkspace) {
+    return inferredFromWorkspace;
+  }
+  const inferredFromCwd = inferTaskIdFromRuntimePath(process.cwd());
+  if (inferredFromCwd) {
+    return inferredFromCwd;
+  }
+  try {
+    const paths = resolveHarnessPaths(projectRoot);
+    const session = readJsonFile(paths.sessionPath, {});
+    return session.activeTaskIds?.[0] || "";
+  } catch {
+    return "";
+  }
+}
+function stripTaskConfigMetadata(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function coerceValidationDescriptions(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+    return {};
+  }
+  const descriptions = {};
+  for (const [key, value] of Object.entries(candidate)) {
+    if (typeof value === "string" && value.length > 0) {
+      descriptions[key] = value;
+    }
+  }
+  return descriptions;
+}
+function readValidationDescriptionsFromMeta(meta) {
+  if (!meta || typeof meta !== "object" || Array.isArray(meta)) {
+    return;
+  }
+  return meta.validation_descriptions;
+}
+function inferTaskIdFromRuntimePath(path) {
+  if (!path) {
+    return "";
+  }
+  const match = path.match(/\/\.rig\/runtime\/agents\/task-([^/]+)\/worktree(?:\/|$)/) || path.match(/\/\.worktrees\/([^/]+)(?:\/|$)/);
+  const candidate = match?.[1] || "";
+  return candidate.startsWith("bd-") ? candidate : "";
+}
+function artifactDirForId(projectRoot, id) {
+  const workspaceDir = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (workspaceDir) {
+    const worktreeArtifacts = resolve14(workspaceDir, "artifacts", id);
+    if (existsSync12(worktreeArtifacts) || existsSync12(resolve14(workspaceDir, "artifacts"))) {
+      return worktreeArtifacts;
+    }
+  }
+  try {
+    const paths = resolveHarnessPaths(projectRoot);
+    return resolve14(paths.artifactsDir, id);
+  } catch {
+    return resolve14(resolveMonorepoRoot2(projectRoot), "artifacts", id);
+  }
+}
+function resolveTaskConfigPath(projectRoot) {
+  const paths = resolveHarnessPaths(projectRoot);
+  if (existsSync12(paths.taskConfigPath)) {
+    return paths.taskConfigPath;
+  }
+  for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
+    if (existsSync12(candidate)) {
+      return candidate;
+    }
+  }
+  throw new Error(`Task config missing at ${paths.taskConfigPath}.`);
+}
+function findSourceTaskConfigPath(projectRoot) {
+  for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
+    if (existsSync12(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+var FILE_TASK_PATTERN = /\.(task\.)?json$/;
+function readAndSyncSourceTaskConfig(projectRoot) {
+  const sourcePath = findSourceTaskConfigPath(projectRoot);
+  const raw = sourcePath ? readJsonFile(sourcePath, {}) : readConfiguredFileTaskConfig(projectRoot);
+  const synced = synchronizeTaskConfigWithTracker(projectRoot, raw);
+  if (sourcePath && synced.updated) {
+    try {
+      writeFileSync4(sourcePath, `${JSON.stringify(synced.config, null, 2)}
+`, "utf-8");
+    } catch {}
+  }
+  return synced.config;
+}
+function synchronizeTaskConfigWithTracker(projectRoot, rawConfig) {
+  const issues = readSourceIssueRecords(projectRoot);
+  if (issues.length === 0) {
+    return { config: rawConfig, updated: false };
+  }
+  const taskConfig = stripTaskConfigMetadata(rawConfig);
+  const mergedConfig = { ...taskConfig };
+  const validationDescriptions = coerceValidationDescriptions(rawConfig.validation_descriptions);
+  const metaValidationDescriptions = coerceValidationDescriptions(readValidationDescriptionsFromMeta(rawConfig._meta));
+  let updated = false;
+  for (const issue of issues) {
+    if (issue.issueType !== "task") {
+      continue;
+    }
+    if (mergedConfig[issue.id] && !shouldRefreshAutoSyncedTaskConfigEntry(mergedConfig[issue.id])) {
+      continue;
+    }
+    mergedConfig[issue.id] = buildAutoSyncedTaskConfigEntry(issue);
+    updated = true;
+  }
+  return {
+    config: {
+      ...mergedConfig,
+      ...Object.keys(validationDescriptions).length > 0 ? { validation_descriptions: validationDescriptions } : {},
+      ...Object.keys(metaValidationDescriptions).length > 0 ? { _meta: { validation_descriptions: metaValidationDescriptions } } : {}
+    },
+    updated
+  };
+}
+function shouldRefreshAutoSyncedTaskConfigEntry(entry) {
+  if (!entry || typeof entry !== "object") {
+    return false;
+  }
+  const candidate = entry;
+  if (!candidate.auto_synced) {
+    return false;
+  }
+  if (!Array.isArray(candidate.scope) || candidate.scope.length === 0) {
+    return true;
+  }
+  if (candidate.scope.some((glob) => typeof glob !== "string" || glob.trim().length === 0)) {
+    return true;
+  }
+  return !candidate.role;
+}
+function readSourceIssueRecords(projectRoot) {
+  const issuesPath = resolve14(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync12(issuesPath)) {
+    return [];
+  }
+  const records = [];
+  for (const line of readFileSync6(issuesPath, "utf-8").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(trimmed);
+      const id = typeof parsed.id === "string" ? parsed.id.trim() : "";
+      if (!id) {
+        continue;
+      }
+      records.push({
+        id,
+        title: typeof parsed.title === "string" ? parsed.title.trim() : "",
+        issueType: typeof parsed.issue_type === "string" ? parsed.issue_type.trim() : null,
+        labels: Array.isArray(parsed.labels) ? parsed.labels.filter((label) => typeof label === "string") : []
+      });
+    } catch {}
+  }
+  return records;
+}
+function buildAutoSyncedTaskConfigEntry(issue) {
+  return {
+    auto_synced: true,
+    role: inferAutoSyncedTaskRole(issue),
+    scope: inferAutoSyncedTaskScope(issue),
+    validation: []
+  };
+}
+function inferAutoSyncedTaskRole(issue) {
+  for (const label of issue.labels) {
+    if (label === "role:architect")
+      return "architect";
+    if (label === "role:extractor")
+      return "extractor";
+    if (label === "role:mechanic")
+      return "mechanic";
+    if (label === "role:verifier")
+      return "verifier";
+  }
+  if (/\bDESIGN\b/i.test(issue.title)) {
+    return "architect";
+  }
+  if (/\bInitialize\b/i.test(issue.title)) {
+    return "mechanic";
+  }
+  return "extractor";
+}
+function inferAutoSyncedTaskScope(issue) {
+  return [`artifacts/${issue.id}/**`];
+}
+function readConfiguredFileTaskConfig(projectRoot) {
+  const sourcePath = readConfiguredFilesTaskSourcePath(projectRoot);
+  if (!sourcePath) {
+    return {};
+  }
+  const directory = resolve14(projectRoot, sourcePath);
+  if (!existsSync12(directory)) {
+    return {};
+  }
+  const config = {};
+  for (const name of readdirSync2(directory)) {
+    if (!FILE_TASK_PATTERN.test(name))
+      continue;
+    const file = resolve14(directory, name);
+    try {
+      if (!statSync3(file).isFile())
+        continue;
+      const raw = JSON.parse(readFileSync6(file, "utf8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        continue;
+      const record = raw;
+      const inferredId = basename5(name).replace(FILE_TASK_PATTERN, "");
+      const id = typeof record.id === "string" && record.id.trim().length > 0 ? record.id.trim() : inferredId;
+      config[id] = fileTaskToConfigEntry(record, { kind: "files", path: sourcePath });
+    } catch {}
+  }
+  return config;
+}
+function fileTaskToConfigEntry(task, source) {
+  const labels = Array.isArray(task.labels) ? task.labels.filter((label) => typeof label === "string") : [];
+  const scope = firstStringList(task.scope, labels.filter((label) => label.startsWith("scope:")).map((label) => label.slice("scope:".length)));
+  const validation = firstStringList(task.validation, task.validators, labels.filter((label) => label.startsWith("validator:")).map((label) => label.slice("validator:".length)));
+  const roleLabel = labels.find((label) => label.startsWith("role:"));
+  const role = typeof task.role === "string" && task.role.trim().length > 0 ? task.role.trim() : roleLabel ? roleLabel.slice("role:".length) : undefined;
+  return {
+    auto_synced: true,
+    ...typeof task.title === "string" ? { title: task.title } : {},
+    ...typeof task.status === "string" ? { status: task.status } : {},
+    ...typeof task.description === "string" ? { description: task.description } : {},
+    ...typeof task.acceptance_criteria === "string" ? { acceptance_criteria: task.acceptance_criteria } : typeof task.acceptanceCriteria === "string" ? { acceptance_criteria: task.acceptanceCriteria } : {},
+    ...role ? { role } : {},
+    ...scope.length > 0 ? { scope } : {},
+    ...validation.length > 0 ? { validation } : {},
+    _rig: { taskSource: source }
+  };
+}
+function firstStringList(...candidates) {
+  for (const candidate of candidates) {
+    if (!Array.isArray(candidate)) {
+      continue;
+    }
+    const list = candidate.filter((entry) => typeof entry === "string" && entry.trim().length > 0);
+    if (list.length > 0) {
+      return list;
+    }
+  }
+  return [];
+}
+function readConfiguredFilesTaskSourcePath(projectRoot) {
+  const jsonPath = resolve14(projectRoot, "rig.config.json");
+  if (existsSync12(jsonPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync6(jsonPath, "utf8"));
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        const taskSource = parsed.taskSource;
+        if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
+          const record = taskSource;
+          return record.kind === "files" && typeof record.path === "string" ? record.path : null;
+        }
+      }
+    } catch {
+      return null;
+    }
+  }
+  const tsPath = resolve14(projectRoot, "rig.config.ts");
+  if (!existsSync12(tsPath)) {
+    return null;
+  }
+  try {
+    const source = readFileSync6(tsPath, "utf8");
+    const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
+    const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
+    if (kind !== "files") {
+      return null;
+    }
+    return taskSourceBlock.match(/path\s*:\s*["']([^"']+)["']/)?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+function sourceTaskConfigCandidates(projectRoot) {
+  const runtimeContext = loadRuntimeContextFromEnv();
+  return [
+    runtimeContext?.monorepoMainRoot ? resolve14(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve14(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve14(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
+  ].filter(Boolean);
+}
+
+// packages/runtime/src/binary-run.ts
+var runtimeBinaryBuildQueue = Promise.resolve();
+// packages/runtime/src/control-plane/native/git-ops.ts
+var TASK_ARTIFACT_STAGE_FALLBACK = new Set([
+  "changed-files.txt",
+  "contract-changes.md",
+  "decision-log.md",
+  "git-state.txt",
+  "next-actions.md",
+  "pr-state.json",
+  "task-result.json",
+  "validation-summary.json"
+]);
+
+// packages/runtime/src/control-plane/provider/runtime-instructions.ts
+var CLAUDE_ROUTER_TOOL_NAMES = [
+  "`mcp__rig_runtime_tools__read`",
+  "`mcp__rig_runtime_tools__write`",
+  "`mcp__rig_runtime_tools__edit`",
+  "`mcp__rig_runtime_tools__glob`",
+  "`mcp__rig_runtime_tools__grep`"
+].join(", ");
+var CODEX_DYNAMIC_TOOL_NAMES = [
+  "`shell`",
+  "`read`",
+  "`write`",
+  "`edit`",
+  "`glob`",
+  "`grep`"
+].join(", ");
+
+// packages/runtime/src/control-plane/native/task-ops.ts
+var BUILD_CONFIG = readBuildConfig();
+var BAKED_INFO_OUTPUT = BUILD_CONFIG.AGENT_INFO_OUTPUT ?? "";
+var BAKED_DEPS_OUTPUT = BUILD_CONFIG.AGENT_DEPS_OUTPUT ?? "";
+var BAKED_STATUS_OUTPUT = BUILD_CONFIG.AGENT_STATUS_OUTPUT ?? "";
+var REOPENABLE_TASK_STATUSES = new Set(["completed", "cancelled", "blocked"]);
+var GENERATED_TASK_ARTIFACT_FILES = new Set([
+  "changed-files.txt",
+  "decision-log.md",
+  "next-actions.md",
+  "task-result.json",
+  "validation-summary.json",
+  "review-feedback.md",
+  "review-state.json",
+  "review-status.txt",
+  "review-greptile-raw.json",
+  "pr-state.json",
+  "git-state.txt"
+]);
+function readLocalBeadsTasks(projectRoot) {
+  const issuesPath = resolve15(resolveMonorepoRoot2(projectRoot), ".beads/issues.jsonl");
+  if (!existsSync13(issuesPath)) {
+    return [];
+  }
+  const tasks = [];
+  for (const line of readFileSync7(issuesPath, "utf-8").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (parsed.issue_type === "task" && parsed.id) {
+        tasks.push({
+          id: parsed.id,
+          status: parsed.status || "open",
+          issue_type: parsed.issue_type,
+          title: parsed.title,
+          priority: parsed.priority,
+          description: parsed.description,
+          acceptance_criteria: parsed.acceptance_criteria,
+          acceptanceCriteria: parsed.acceptanceCriteria,
+          dependencies: Array.isArray(parsed.dependencies) ? parsed.dependencies : []
+        });
+      }
+    } catch {}
+  }
+  return tasks;
+}
+function readBeadsTasks(projectRoot, tracker, allowLocalFallback = false) {
+  return (tracker ?? loadTaskTrackerContext(projectRoot, undefined, allowLocalFallback)).tasks;
+}
+function loadTaskTrackerContext(projectRoot, snapshot, allowLocalFallback = false) {
+  const resolvedSnapshot = snapshot ?? readSyncedTrackerState(projectRoot, {}, allowLocalFallback ? { allowLocalFallback: true } : {});
+  const tasks = resolvedSnapshot.issues.filter((issue) => issue.issueType === "task").map(projectTaskRecordFromSyncedIssue);
+  const seenTaskIds = new Set(tasks.map((task) => task.id));
+  if (allowLocalFallback) {
+    for (const localTask of readLocalBeadsTasks(projectRoot)) {
+      if (seenTaskIds.has(localTask.id)) {
+        continue;
+      }
+      tasks.push(localTask);
+      seenTaskIds.add(localTask.id);
+    }
+  }
+  return {
+    snapshot: resolvedSnapshot,
+    tasks,
+    tasksById: new Map(tasks.map((task) => [task.id, task]))
+  };
+}
+function loadReadonlyTaskTrackerContext(projectRoot) {
+  return loadTaskTrackerContext(projectRoot, undefined, true);
+}
+function projectTaskRecordFromSyncedIssue(issue) {
+  const dependencies = issue.dependencies ?? [];
+  return {
+    id: issue.id,
+    status: issue.status === "unknown" ? issue.rawStatus || "open" : issue.status,
+    issue_type: "task",
+    title: issue.title ?? undefined,
+    priority: issue.priority ?? undefined,
+    description: issue.description ?? undefined,
+    acceptance_criteria: issue.acceptanceCriteria ?? undefined,
+    acceptanceCriteria: issue.acceptanceCriteria ?? undefined,
+    dependencies: dependencies.map((dependency) => ({
+      type: dependency.type ?? undefined,
+      issue_id: dependency.issueId ?? undefined,
+      depends_on_id: dependency.dependsOnId ?? undefined,
+      id: dependency.id ?? dependency.issueId ?? dependency.dependsOnId ?? undefined
+    }))
+  };
+}
+function taskDependencyIds(projectRoot, taskId) {
+  const tracker = loadReadonlyTaskTrackerContext(projectRoot);
+  const canonicalTaskIds = new Set(tracker.tasks.map((task) => task.id));
+  const record = readBeadsTasks(projectRoot, tracker).find((entry) => entry.id === taskId);
+  if (!record?.dependencies?.length) {
+    return [];
+  }
+  const ids = new Set;
+  for (const edge of record.dependencies) {
+    if (!edge || edge.type === "parent-child") {
+      continue;
+    }
+    for (const candidate of [edge.depends_on_id, edge.id, edge.issue_id]) {
+      if (typeof candidate !== "string" || candidate === taskId || !canonicalTaskIds.has(candidate)) {
+        continue;
+      }
+      ids.add(candidate);
+    }
+  }
+  return [...ids].sort();
+}
+
+// packages/runtime/src/control-plane/native/repo-ops.ts
+function primaryManagedRepoId() {
+  const entries = listManagedRepoEntries();
+  return entries.length > 0 ? entries[0].id : null;
+}
+function primaryManagedRepoAlias() {
+  const entries = listManagedRepoEntries();
+  return entries.length > 0 ? entries[0].alias : null;
+}
+function repoEnsure(projectRoot, taskId) {
+  const monorepo = ensureMonorepoReady(projectRoot);
+  const resolvedTask = taskId || currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    if (monorepo) {
+      const alias = primaryManagedRepoAlias();
+      if (alias) {
+        persistBaselinePins(projectRoot, { [alias]: monorepo.headCommit });
+      }
+    }
+    console.log("No active task. Refreshed baseline repo pins.");
+    return;
+  }
+  const pins = resolvedPins(projectRoot, resolvedTask);
+  applyPins(projectRoot, pins);
+  verifyPins(projectRoot, pins);
+}
+function repoPins(projectRoot, taskId) {
+  const resolvedTask = taskId || currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    return {};
+  }
+  return resolvedPins(projectRoot, resolvedTask);
+}
+function repoVerify(projectRoot, taskId) {
+  const resolvedTask = taskId || currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    console.log("No active task. Nothing to verify.");
+    return true;
+  }
+  const pins = resolvedPins(projectRoot, resolvedTask);
+  return verifyPins(projectRoot, pins);
+}
+function repoDiscover(projectRoot, taskId) {
+  const resolvedTask = taskId || currentTaskId(projectRoot);
+  if (!resolvedTask) {
+    return {};
+  }
+  const explicit = explicitPins(projectRoot, resolvedTask);
+  if (Object.keys(explicit).length > 0) {
+    return explicit;
+  }
+  return discoverPins(projectRoot, resolvedTask);
+}
+function repoBaseline(projectRoot, refresh = false) {
+  const paths = resolveRepoDiscoveryPaths(projectRoot);
+  if (!refresh && existsSync14(paths.baseRepoPinsPath)) {
+    const baseline = readJsonFile(paths.baseRepoPinsPath, { recorded_at: nowIso3(), repos: {} });
+    return baseline.repos || {};
+  }
+  const id = primaryManagedRepoId();
+  if (!id) {
+    return persistBaselinePins(projectRoot, {});
+  }
+  const synced = syncManagedRepo(projectRoot, id);
+  const alias = primaryManagedRepoAlias() ?? id;
+  return persistBaselinePins(projectRoot, { [alias]: synced.headCommit });
+}
+function resetBaseline(projectRoot, keepTaskStatus) {
+  const paths = resolveHarnessPaths(projectRoot);
+  const label = primaryManagedRepoAlias() ?? "monorepo";
+  resetRepoToOriginMain(projectRoot, paths.monorepoRoot, label);
+  deleteBranches(projectRoot, paths.monorepoRoot, label, "rig/*");
+  deleteBranches(projectRoot, projectRoot, "project-rig", "codex/*");
+  repoBaseline(projectRoot, true);
+  console.log("OK: refreshed baseline repo pins");
+  if (!keepTaskStatus) {
+    reopenClosedTasks(projectRoot);
+  } else {
+    console.log("INFO: task status unchanged (--keep-task-status)");
+  }
+  clearDirectory(paths.artifactsDir, ".gitkeep");
+  clearDirectory(paths.logsDir, ".gitkeep");
+  for (const stateFile of ["hook_trips.log", "task-repo-commits.json", "current-task-id.txt"]) {
+    rmSync4(resolve16(paths.stateDir, stateFile), { force: true });
+  }
+  console.log("OK: cleared harness artifacts/logs/runtime state");
+  console.log("");
+  console.log("Baseline reset complete.");
+}
+function ensureMonorepoReady(projectRoot) {
+  const id = primaryManagedRepoId();
+  if (!id) {
+    return null;
+  }
+  const synced = syncManagedRepo(projectRoot, id);
+  const sha = synced.headCommit.slice(0, 7);
+  console.log(`Monorepo ready: ${synced.layout.alias}@${sha}`);
+  return synced;
+}
+function persistBaselinePins(projectRoot, repos) {
+  const paths = resolveRepoDiscoveryPaths(projectRoot);
+  mkdirSync8(resolve16(paths.baseRepoPinsPath, ".."), { recursive: true });
+  writeFileSync6(paths.baseRepoPinsPath, `${JSON.stringify({ recorded_at: nowIso3(), repos }, null, 2)}
+`, "utf-8");
+  return repos;
+}
+function resetRepoToOriginMain(projectRoot, repoPath, label) {
+  if (!existsSync14(resolve16(repoPath, ".git"))) {
+    console.log(`WARN: ${label} repo missing at ${repoPath}, skipping reset.`);
+    return;
+  }
+  runGitCapture(["git", "-C", repoPath, "fetch", "origin", "main"], projectRoot);
+  const hasMain = runGitCapture(["git", "-C", repoPath, "show-ref", "--verify", "--quiet", "refs/heads/main"], projectRoot).exitCode === 0;
+  if (hasMain) {
+    runGitCapture(["git", "-C", repoPath, "checkout", "main"], projectRoot);
+  } else {
+    runGitCapture(["git", "-C", repoPath, "checkout", "-B", "main", "origin/main"], projectRoot);
+  }
+  const resetResult = runGitCapture(["git", "-C", repoPath, "reset", "--hard", "origin/main"], projectRoot);
+  if (resetResult.exitCode !== 0) {
+    throw new Error(`Failed to reset ${label} to origin/main:
+${resetResult.stderr || resetResult.stdout}`);
+  }
+  runGitCapture(["git", "-C", repoPath, "clean", "-fd"], projectRoot);
+  const head = runGitCapture(["git", "-C", repoPath, "rev-parse", "--short", "HEAD"], projectRoot).stdout.trim();
+  console.log(`OK: ${label} reset to origin/main (${head})`);
+}
+function deleteBranches(projectRoot, repoPath, label, pattern) {
+  if (!existsSync14(resolve16(repoPath, ".git"))) {
+    return;
+  }
+  const listed = runGitCapture(["git", "-C", repoPath, "for-each-ref", `refs/heads/${pattern}`, "--format=%(refname:short)"], projectRoot).stdout.split(/\r?\n/).filter(Boolean);
+  let deleted = 0;
+  for (const branch of listed) {
+    runGitCapture(["git", "-C", repoPath, "branch", "-D", branch], projectRoot);
+    deleted += 1;
+  }
+  console.log(`OK: ${label} deleted ${deleted} branch(es) matching ${pattern}`);
+}
+function reopenClosedTasks(projectRoot) {
+  const paths = resolveHarnessPaths(projectRoot);
+  const issuesPath = resolve16(paths.monorepoRoot, ".beads/issues.jsonl");
+  if (!existsSync14(issuesPath)) {
+    console.log("WARN: .beads/issues.jsonl not found, skipping task reopen.");
+    return;
+  }
+  const content = readFileSync8(issuesPath, "utf-8");
+  const closed = [];
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      const issue = JSON.parse(trimmed);
+      const normalizedStatus = normalizeTaskLifecycleStatus(issue.status);
+      if (issue.issue_type === "task" && issue.id && (normalizedStatus === "completed" || normalizedStatus === "cancelled" || normalizedStatus === "blocked")) {
+        closed.push(issue.id);
+      }
+    } catch {}
+  }
+  if (closed.length === 0) {
+    console.log("OK: no terminal tasks to reopen");
+    return;
+  }
+  for (const id of closed) {
+    const update = runCapture(["br", "--no-db", "update", id, "--status", "open"], paths.monorepoRoot);
+    if (update.exitCode === 0) {
+      console.log(`OK: reopened task ${id}`);
+    } else {
+      console.log(`WARN: failed to reopen task ${id}`);
+    }
+  }
+}
+function clearDirectory(dir, keepName) {
+  if (!existsSync14(dir)) {
+    return;
+  }
+  for (const entry of readdirSync3(dir)) {
+    if (entry === keepName) {
+      continue;
+    }
+    rmSync4(resolve16(dir, entry), { recursive: true, force: true });
+  }
+}
+function resolvedPins(projectRoot, taskId) {
+  const explicit = explicitPins(projectRoot, taskId);
+  if (Object.keys(explicit).length > 0) {
+    return explicit;
+  }
+  return discoverPins(projectRoot, taskId);
+}
+function explicitPins(projectRoot, taskId) {
+  const repoPins2 = readRepoDiscoveryTaskConfig(projectRoot)[taskId]?.repo_pins || {};
+  const normalized = {};
+  const validAliases = new Set(listManagedRepoEntries().map((e) => e.alias));
+  for (const [key, value] of Object.entries(repoPins2)) {
+    if (!value) {
+      continue;
+    }
+    if (validAliases.size > 0 && !validAliases.has(key)) {
+      throw new Error(`Unsupported repo pin key for ${taskId}: ${key}. Known aliases: ${[...validAliases].join(", ") || "(none registered)"}`);
+    }
+    const existing = normalized[key];
+    if (existing && existing !== value) {
+      throw new Error(`Conflicting explicit repo pins for ${key}: ${existing} vs ${value}`);
+    }
+    normalized[key] = value;
+  }
+  return normalized;
+}
+function taskDependencies(projectRoot, taskId) {
+  return taskDependencyIds(projectRoot, taskId);
+}
+function discoverPins(projectRoot, taskId) {
+  const deps = taskDependencies(projectRoot, taskId);
+  if (deps.length === 0) {
+    return repoBaseline(projectRoot, true);
+  }
+  const paths = resolveRepoDiscoveryPaths(projectRoot);
+  const state = readJsonFile(paths.taskRepoCommitsPath, {});
+  const pinKeys = listManagedRepoEntries().map((e) => e.alias);
+  if (pinKeys.length === 0) {
+    return {};
+  }
+  const discovered = {};
+  for (const key of pinKeys) {
+    const commits = new Set;
+    for (const dep of deps) {
+      const fromState = state[dep]?.repos?.[key];
+      if (fromState) {
+        commits.add(fromState);
+      }
+      const fromArtifact = readPinFromArtifact(projectRoot, dep, key);
+      if (fromArtifact) {
+        commits.add(fromArtifact);
+      }
+    }
+    if (commits.size > 1) {
+      const values = [...commits].join(`
+  - `);
+      throw new Error(`Conflicting discovered pins for ${key} from dependency graph of ${taskId}:
+  - ${values}`);
+    }
+    if (commits.size === 1) {
+      discovered[key] = [...commits][0];
+    }
+  }
+  return discovered;
+}
+function readRepoDiscoveryTaskConfig(projectRoot) {
+  try {
+    return readSourceTaskConfig(projectRoot);
+  } catch {
+    return readTaskConfig(projectRoot);
+  }
+}
+function resolveRepoDiscoveryPaths(projectRoot) {
+  const monorepoRoot = resolveMonorepoRepoLayout(projectRoot).checkoutRoot;
+  const explicitHostProjectRoot = (process.env.RIG_HOST_PROJECT_ROOT || "").trim();
+  const normalizedProjectRoot = resolve16(projectRoot);
+  const hostProjectRoot = explicitHostProjectRoot && shouldUseHostProjectStateRoot(normalizedProjectRoot) ? explicitHostProjectRoot : normalizedProjectRoot;
+  const stateDir = resolve16(hostProjectRoot, ".rig", "state");
+  return {
+    monorepoRoot,
+    taskRepoCommitsPath: resolve16(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve16(stateDir, "base-repo-pins.json")
+  };
+}
+function shouldUseHostProjectStateRoot(projectRoot) {
+  const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (runtimeWorkspace && resolve16(runtimeWorkspace) === projectRoot) {
+    return true;
+  }
+  return basename6(dirname9(projectRoot)) === ".worktrees";
+}
+function readPinFromArtifact(projectRoot, depTask, repoKey) {
+  const snapshot = resolve16(artifactDirForId(projectRoot, depTask), "git-state.txt");
+  if (!existsSync14(snapshot)) {
+    return "";
+  }
+  const content = readFileSync8(snapshot, "utf-8");
+  const chunk = content.split(/\r?\n/);
+  let inSection = false;
+  for (const line of chunk) {
+    if (line.startsWith("## ")) {
+      inSection = line.startsWith(`## ${repoKey}`);
+      continue;
+    }
+    if (!inSection) {
+      continue;
+    }
+    if (line.startsWith("head:")) {
+      return line.replace(/^head:\s*/, "").trim();
+    }
+  }
+  return "";
+}
+function repoPath(projectRoot, key) {
+  const managed = resolveManagedRepoLayoutByAlias(projectRoot, key);
+  if (managed) {
+    return managed.checkoutRoot;
+  }
+  return key.startsWith("/") ? key : resolve16(projectRoot, key);
+}
+function applyPins(projectRoot, pins) {
+  for (const [key, commit] of Object.entries(pins)) {
+    const path = repoPath(projectRoot, key);
+    if (!existsSync14(resolve16(path, ".git"))) {
+      throw new Error(`Repo for pin not available: ${key} (${path})`);
+    }
+    let hasCommit = runGitCapture(["git", "-C", path, "cat-file", "-e", `${commit}^{commit}`], projectRoot).exitCode === 0;
+    if (!hasCommit) {
+      runGitCapture(["git", "-C", path, "fetch", "--all", "--tags", "--prune"], projectRoot);
+      hasCommit = runGitCapture(["git", "-C", path, "cat-file", "-e", `${commit}^{commit}`], projectRoot).exitCode === 0;
+    }
+    if (!hasCommit) {
+      throw new Error(`Commit not found for ${key}: ${commit}`);
+    }
+    const current = runGitCapture(["git", "-C", path, "rev-parse", "HEAD"], projectRoot).stdout.trim();
+    if (current === commit) {
+      console.log(`Repo pin: ${key} already at ${commit}`);
+      continue;
+    }
+    const branch = runGitCapture(["git", "-C", path, "rev-parse", "--abbrev-ref", "HEAD"], projectRoot).stdout.trim();
+    const checkout = branch.startsWith("rig/") ? runGitCapture(["git", "-C", path, "reset", "--hard", commit], projectRoot) : runGitCapture(["git", "-C", path, "checkout", "--detach", commit], projectRoot);
+    if (checkout.exitCode !== 0) {
+      throw new Error(`Failed to apply repo pin ${key} -> ${commit}:
+${checkout.stderr || checkout.stdout}`);
+    }
+    console.log(`Repo pin: ${key} -> ${commit}`);
+  }
+}
+function verifyPins(projectRoot, pins) {
+  let ok = true;
+  for (const [key, expected] of Object.entries(pins)) {
+    const path = repoPath(projectRoot, key);
+    if (!existsSync14(resolve16(path, ".git"))) {
+      console.error(`ERROR: repo missing during pin verification: ${key}`);
+      ok = false;
+      continue;
+    }
+    const current = runGitCapture(["git", "-C", path, "rev-parse", "HEAD"], projectRoot).stdout.trim();
+    if (current === expected) {
+      console.log(`Repo verify: ${key} at ${current}`);
+    } else {
+      console.error(`ERROR: repo pin mismatch for ${key}: expected ${expected}, got ${current}`);
+      ok = false;
+    }
+  }
+  return ok;
+}
+function runGitCapture(command, projectRoot) {
+  return runCapture(command, projectRoot, resolveRuntimeGitEnv());
+}
+function resolveRuntimeGitEnv() {
+  if (process.env.GIT_SSH_COMMAND?.trim()) {
+    return {
+      HOME: process.env.HOME ?? "",
+      GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND
+    };
+  }
+  const runtimeRoot = process.env.RIG_RUNTIME_HOME?.trim() || (process.env.RIG_RUNTIME_CONTEXT_FILE?.trim() ? resolve16(process.env.RIG_RUNTIME_CONTEXT_FILE, "..") : inferRuntimeRootFromWorkspace(process.cwd()));
+  const runtimeHome = runtimeRoot ? resolve16(runtimeRoot, "home") : process.env.HOME?.trim() || "";
+  if (!runtimeHome) {
+    return;
+  }
+  const knownHostsPath = resolve16(runtimeHome, ".ssh", "known_hosts");
+  if (!existsSync14(knownHostsPath)) {
+    return { HOME: runtimeHome };
+  }
+  const agentSshKey = resolve16(runtimeHome, ".ssh", "rig-agent-key");
+  const sshParts = [
+    "ssh",
+    `-o UserKnownHostsFile="${knownHostsPath}"`,
+    "-o StrictHostKeyChecking=yes",
+    "-F /dev/null"
+  ];
+  if (existsSync14(agentSshKey)) {
+    sshParts.splice(1, 0, `-i "${agentSshKey}"`, "-o IdentitiesOnly=yes");
+  }
+  return {
+    HOME: runtimeHome,
+    GIT_SSH_COMMAND: sshParts.join(" ")
+  };
+}
+function inferRuntimeRootFromWorkspace(cwd) {
+  const contextPath = findRuntimeContextFile2(cwd);
+  if (!contextPath || !existsSync14(contextPath)) {
+    return "";
+  }
+  try {
+    loadRuntimeContext(contextPath);
+    return resolve16(contextPath, "..");
+  } catch {
+    return "";
+  }
+}
+function findRuntimeContextFile2(startPath) {
+  let current = resolve16(startPath);
+  while (true) {
+    const candidate = resolve16(current, "runtime-context.json");
+    if (existsSync14(candidate)) {
+      return candidate;
+    }
+    const parent = resolve16(current, "..");
+    if (parent === current) {
+      return "";
+    }
+    current = parent;
+  }
+}
+export {
+  resetBaseline,
+  repoVerify,
+  repoPins,
+  repoEnsure,
+  repoDiscover,
+  repoBaseline
+};