@h-rig/runtime 0.0.6-alpha.0

package/dist/src/control-plane/native/verifier.js

@@ -0,0 +1,3249 @@
+// @bun
+// packages/runtime/src/control-plane/native/verifier.ts
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, writeFileSync as writeFileSync6 } from "fs";
+import { resolve as resolve13 } from "path";
+
+// packages/runtime/src/control-plane/runtime/baked-secrets.ts
+var BAKED_RUNTIME_SECRETS = {
+  ANTHROPIC_API_KEY: typeof RIG_BAKED_ANTHROPIC_API_KEY !== "undefined" ? RIG_BAKED_ANTHROPIC_API_KEY : "",
+  OPENAI_API_KEY: typeof RIG_BAKED_OPENAI_API_KEY !== "undefined" ? RIG_BAKED_OPENAI_API_KEY : "",
+  OPENROUTER_API_KEY: typeof RIG_BAKED_OPENROUTER_API_KEY !== "undefined" ? RIG_BAKED_OPENROUTER_API_KEY : "",
+  AI_REVIEW_MODE: typeof RIG_BAKED_AI_REVIEW_MODE !== "undefined" ? RIG_BAKED_AI_REVIEW_MODE : "",
+  AI_REVIEW_PROVIDER: typeof RIG_BAKED_AI_REVIEW_PROVIDER !== "undefined" ? RIG_BAKED_AI_REVIEW_PROVIDER : "",
+  GREPTILE_API_BASE: typeof RIG_BAKED_GREPTILE_API_BASE !== "undefined" ? RIG_BAKED_GREPTILE_API_BASE : "",
+  GREPTILE_REMOTE: typeof RIG_BAKED_GREPTILE_REMOTE !== "undefined" ? RIG_BAKED_GREPTILE_REMOTE : "",
+  GREPTILE_REPOSITORY: typeof RIG_BAKED_GREPTILE_REPOSITORY !== "undefined" ? RIG_BAKED_GREPTILE_REPOSITORY : "",
+  GREPTILE_CONTEXT_BRANCH: typeof RIG_BAKED_GREPTILE_CONTEXT_BRANCH !== "undefined" ? RIG_BAKED_GREPTILE_CONTEXT_BRANCH : "",
+  GREPTILE_DEFAULT_BRANCH: typeof RIG_BAKED_GREPTILE_DEFAULT_BRANCH !== "undefined" ? RIG_BAKED_GREPTILE_DEFAULT_BRANCH : "",
+  GREPTILE_API_KEY: typeof RIG_BAKED_GREPTILE_API_KEY !== "undefined" ? RIG_BAKED_GREPTILE_API_KEY : "",
+  GREPTILE_GITHUB_TOKEN: typeof RIG_BAKED_GREPTILE_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GREPTILE_GITHUB_TOKEN : "",
+  GREPTILE_POLL_ATTEMPTS: typeof RIG_BAKED_GREPTILE_POLL_ATTEMPTS !== "undefined" ? RIG_BAKED_GREPTILE_POLL_ATTEMPTS : "",
+  GREPTILE_POLL_INTERVAL_MS: typeof RIG_BAKED_GREPTILE_POLL_INTERVAL_MS !== "undefined" ? RIG_BAKED_GREPTILE_POLL_INTERVAL_MS : "",
+  GH_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+  GITHUB_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+  GITHUB_SSH_KEY: typeof RIG_BAKED_GITHUB_SSH_KEY !== "undefined" ? RIG_BAKED_GITHUB_SSH_KEY : "",
+  AWS_ACCESS_KEY_ID: typeof RIG_BAKED_AWS_ACCESS_KEY_ID !== "undefined" ? RIG_BAKED_AWS_ACCESS_KEY_ID : "",
+  AWS_SECRET_ACCESS_KEY: typeof RIG_BAKED_AWS_SECRET_ACCESS_KEY !== "undefined" ? RIG_BAKED_AWS_SECRET_ACCESS_KEY : "",
+  AWS_REGION: typeof RIG_BAKED_AWS_REGION !== "undefined" ? RIG_BAKED_AWS_REGION : "",
+  LINEAR_API_KEY: typeof RIG_BAKED_LINEAR_API_KEY !== "undefined" ? RIG_BAKED_LINEAR_API_KEY : "",
+  LINEAR_WEBHOOK_SECRET: typeof RIG_BAKED_LINEAR_WEBHOOK_SECRET !== "undefined" ? RIG_BAKED_LINEAR_WEBHOOK_SECRET : ""
+};
+function resolveRuntimeSecrets(env, baked = BAKED_RUNTIME_SECRETS) {
+  const resolved = {};
+  const keys = new Set([
+    ...Object.keys(BAKED_RUNTIME_SECRETS),
+    ...Object.keys(baked)
+  ]);
+  for (const key of keys) {
+    const envValue = env[key]?.trim();
+    const bakedValue = baked[key]?.trim();
+    if (envValue) {
+      resolved[key] = envValue;
+    } else if (bakedValue) {
+      resolved[key] = bakedValue;
+    }
+  }
+  return resolved;
+}
+
+// packages/runtime/src/control-plane/native/git-ops.ts
+import { existsSync as existsSync10, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname8, isAbsolute as isAbsolute2, resolve as resolve12 } from "path";
+
+// packages/runtime/src/control-plane/runtime/context.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { dirname, resolve } from "path";
+var RUNTIME_CONTEXT_ENV = "RIG_RUNTIME_CONTEXT_FILE";
+var runtimeContextStringFields = [
+  "runtimeId",
+  "taskId",
+  "role",
+  "workspaceDir",
+  "stateDir",
+  "logsDir",
+  "sessionDir",
+  "sessionFile",
+  "policyFile",
+  "binDir",
+  "createdAt"
+];
+var runtimeContextArrayFields = ["scopes", "validation"];
+var runtimeContextOptionalStringFields = [
+  "artifactRoot",
+  "hostProjectRoot",
+  "monorepoMainRoot",
+  "monorepoBaseRef",
+  "monorepoBaseCommit"
+];
+function loadRuntimeContext(path) {
+  const absPath = resolve(path);
+  if (!existsSync(absPath)) {
+    throw new Error(`RuntimeTaskContext file not found: ${absPath}`);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(absPath, "utf8"));
+  } catch (err) {
+    throw new Error(`Failed to parse RuntimeTaskContext at ${absPath}: ${String(err)}`);
+  }
+  if (typeof raw !== "object" || raw === null) {
+    throw new Error(`RuntimeTaskContext at ${absPath} is not an object`);
+  }
+  const obj = raw;
+  for (const field of runtimeContextStringFields) {
+    if (typeof obj[field] !== "string" || obj[field].length === 0) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a non-empty string (at ${absPath})`);
+    }
+  }
+  for (const field of runtimeContextArrayFields) {
+    if (!Array.isArray(obj[field])) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be an array (at ${absPath})`);
+    }
+    if (!obj[field].every((entry) => typeof entry === "string")) {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a string[] (at ${absPath})`);
+    }
+  }
+  for (const field of runtimeContextOptionalStringFields) {
+    if (field in obj && obj[field] !== undefined && typeof obj[field] !== "string") {
+      throw new Error(`RuntimeTaskContext field "${field}" must be a string when present (at ${absPath})`);
+    }
+  }
+  if (obj.browser !== undefined) {
+    if (typeof obj.browser !== "object" || obj.browser === null || Array.isArray(obj.browser)) {
+      throw new Error(`RuntimeTaskContext field "browser" must be an object when present (at ${absPath})`);
+    }
+    const browser = obj.browser;
+    for (const field of [
+      "preset",
+      "mode",
+      "stateDir",
+      "defaultProfile",
+      "effectiveProfile",
+      "defaultAttachUrl",
+      "effectiveAttachUrl",
+      "launchHelper",
+      "checkHelper",
+      "attachInfoHelper",
+      "e2eHelper",
+      "resetProfileHelper"
+    ]) {
+      if (typeof browser[field] !== "string" || browser[field].length === 0) {
+        throw new Error(`RuntimeTaskContext field "browser.${field}" must be a non-empty string (at ${absPath})`);
+      }
+    }
+    for (const field of ["devCommand", "launchCommand", "checkCommand", "e2eCommand"]) {
+      if (browser[field] !== undefined && typeof browser[field] !== "string") {
+        throw new Error(`RuntimeTaskContext field "browser.${field}" must be a string when present (at ${absPath})`);
+      }
+    }
+    if (typeof browser.required !== "boolean") {
+      throw new Error(`RuntimeTaskContext field "browser.required" must be a boolean (at ${absPath})`);
+    }
+  }
+  if (obj.memory !== undefined) {
+    if (typeof obj.memory !== "object" || obj.memory === null || Array.isArray(obj.memory)) {
+      throw new Error(`RuntimeTaskContext field "memory" must be an object when present (at ${absPath})`);
+    }
+    const memory = obj.memory;
+    for (const field of ["canonicalPath", "canonicalRef", "canonicalBaseOid", "hydratedPath"]) {
+      if (typeof memory[field] !== "string" || memory[field].length === 0) {
+        throw new Error(`RuntimeTaskContext field "memory.${field}" must be a non-empty string (at ${absPath})`);
+      }
+    }
+    if (typeof memory.createdFresh !== "boolean") {
+      throw new Error(`RuntimeTaskContext field "memory.createdFresh" must be a boolean (at ${absPath})`);
+    }
+    if (typeof memory.retrieval !== "object" || memory.retrieval === null || Array.isArray(memory.retrieval)) {
+      throw new Error(`RuntimeTaskContext field "memory.retrieval" must be an object (at ${absPath})`);
+    }
+    const retrieval = memory.retrieval;
+    for (const field of ["topK", "lexicalWeight", "vectorWeight", "recencyWeight", "confidenceWeight"]) {
+      if (typeof retrieval[field] !== "number" || Number.isNaN(retrieval[field])) {
+        throw new Error(`RuntimeTaskContext field "memory.retrieval.${field}" must be a number (at ${absPath})`);
+      }
+    }
+  }
+  if (obj.initialDirtyFiles !== undefined) {
+    if (typeof obj.initialDirtyFiles !== "object" || obj.initialDirtyFiles === null || Array.isArray(obj.initialDirtyFiles)) {
+      throw new Error(`RuntimeTaskContext field "initialDirtyFiles" must be an object when present (at ${absPath})`);
+    }
+    const dirtyFiles = obj.initialDirtyFiles;
+    for (const key of ["project", "monorepo"]) {
+      if (dirtyFiles[key] === undefined) {
+        continue;
+      }
+      if (!Array.isArray(dirtyFiles[key]) || !dirtyFiles[key].every((entry) => typeof entry === "string")) {
+        throw new Error(`RuntimeTaskContext field "initialDirtyFiles.${key}" must be a string[] when present (at ${absPath})`);
+      }
+    }
+  }
+  if (obj.initialHeadCommits !== undefined) {
+    if (typeof obj.initialHeadCommits !== "object" || obj.initialHeadCommits === null || Array.isArray(obj.initialHeadCommits)) {
+      throw new Error(`RuntimeTaskContext field "initialHeadCommits" must be an object when present (at ${absPath})`);
+    }
+    const headCommits = obj.initialHeadCommits;
+    for (const key of ["project", "monorepo"]) {
+      if (headCommits[key] === undefined) {
+        continue;
+      }
+      if (typeof headCommits[key] !== "string") {
+        throw new Error(`RuntimeTaskContext field "initialHeadCommits.${key}" must be a string when present (at ${absPath})`);
+      }
+    }
+  }
+  return obj;
+}
+function loadRuntimeContextFromEnv(env = process.env) {
+  const contextFile = env[RUNTIME_CONTEXT_ENV];
+  if (contextFile) {
+    return loadRuntimeContext(contextFile);
+  }
+  const inferred = findRuntimeContextFile(process.cwd());
+  if (!inferred) {
+    return null;
+  }
+  return loadRuntimeContext(inferred);
+}
+function findRuntimeContextFile(startPath) {
+  let current = resolve(startPath);
+  while (true) {
+    const candidate = resolve(current, "runtime-context.json");
+    if (existsSync(candidate) && isAgentRuntimeContextPath(candidate)) {
+      return candidate;
+    }
+    const parent = dirname(current);
+    if (parent === current) {
+      return "";
+    }
+    current = parent;
+  }
+}
+function isAgentRuntimeContextPath(path) {
+  const normalized = path.replace(/\\/g, "/");
+  return /\/\.rig\/runtime-context\.json$/.test(normalized);
+}
+
+// packages/runtime/src/build-time-config.ts
+function normalizeBuildConfig(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return {};
+  }
+  return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+}
+function readBuildConfig() {
+  if (typeof __RIG_BUILD_CONFIG__ !== "undefined") {
+    return normalizeBuildConfig(__RIG_BUILD_CONFIG__);
+  }
+  const raw = process.env.RIG_BUILD_CONFIG_JSON?.trim();
+  if (!raw) {
+    return {};
+  }
+  try {
+    return normalizeBuildConfig(JSON.parse(raw));
+  } catch {
+    return {};
+  }
+}
+
+// packages/runtime/src/control-plane/runtime/tooling/shell.ts
+import { tmpdir } from "os";
+import { basename, dirname as dirname2, resolve as resolve2 } from "path";
+var sharedNativeShellOutputDir = resolve2(tmpdir(), "rig-native");
+var sharedNativeShellOutputPath = resolve2(sharedNativeShellOutputDir, `rig-shell-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+// packages/runtime/src/control-plane/runtime/tooling/file-tools.ts
+import { tmpdir as tmpdir2 } from "os";
+import { basename as basename2, dirname as dirname3, resolve as resolve3 } from "path";
+var sharedNativeToolsOutputDir = resolve3(tmpdir2(), "rig-native");
+var sharedNativeToolsOutputPath = resolve3(sharedNativeToolsOutputDir, `rig-tools-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+// packages/runtime/src/control-plane/plugin-host-context.ts
+import { createPluginHost } from "@rig/core";
+import { loadConfig } from "@rig/core/load-config";
+
+// packages/runtime/src/control-plane/task-source.ts
+function createTaskSourceRegistry() {
+  const byId = new Map;
+  const order = [];
+  return {
+    register(s) {
+      if (byId.has(s.id))
+        throw new Error(`task source already registered: ${s.id}`);
+      byId.set(s.id, s);
+      order.push(s);
+    },
+    resolveById(id) {
+      const s = byId.get(id);
+      if (!s)
+        throw new Error(`task source not registered: ${id}`);
+      return s;
+    },
+    resolveByKind(kind) {
+      for (const s of order)
+        if (s.kind === kind)
+          return s;
+      throw new Error(`no task source registered for kind: ${kind}`);
+    },
+    list: () => order
+  };
+}
+
+// packages/runtime/src/control-plane/task-source-bootstrap.ts
+function formatRegisteredKinds(pluginHost) {
+  const kinds = pluginHost ? pluginHost.listExecutableTaskSources().map((source) => source.kind) : [];
+  return kinds.length > 0 ? kinds.join(", ") : "none";
+}
+function buildTaskSourceRegistry(config, pluginHost) {
+  const registry = createTaskSourceRegistry();
+  const taskSourceConfig = config.taskSource;
+  const factory = pluginHost?.resolveTaskSourceFactoryByKind(taskSourceConfig.kind);
+  if (!factory) {
+    throw new Error(`No task source factory registered for kind "${taskSourceConfig.kind}". ` + `Registered kinds: ${formatRegisteredKinds(pluginHost)}. ` + "Load a plugin that contributes an executable task source factory for this kind.");
+  }
+  registry.register(factory.factory(taskSourceConfig));
+  return registry;
+}
+
+// packages/runtime/src/control-plane/repos/registry.ts
+function createRepoRegistry(entries) {
+  const map = new Map;
+  for (const e of entries) {
+    if (map.has(e.id))
+      throw new Error(`repo already registered: ${e.id}`);
+    map.set(e.id, { ...e });
+  }
+  const ordered = Array.from(map.values());
+  return {
+    getById: (id) => map.get(id),
+    list: () => ordered
+  };
+}
+var MANAGED_REPOS = new Map;
+function setManagedRepos(entries) {
+  const next = new Map;
+  for (const e of entries) {
+    if (next.has(e.id)) {
+      throw new Error(`managed repo already registered: ${e.id}`);
+    }
+    next.set(e.id, e);
+  }
+  MANAGED_REPOS = next;
+}
+function repoRegistrationToManagedEntry(reg) {
+  if (!reg.defaultBranch) {
+    return null;
+  }
+  return {
+    id: reg.id,
+    alias: reg.defaultPath ?? reg.id,
+    defaultBranch: reg.defaultBranch,
+    defaultRemoteUrl: reg.url,
+    remoteEnvVar: reg.remoteEnvVar,
+    checkoutEnvVar: reg.checkoutEnvVar
+  };
+}
+
+// packages/runtime/src/control-plane/agent-roles.ts
+function createAgentRoleRegistry(pluginRoles, configOverrides) {
+  const map = new Map;
+  for (const r of pluginRoles) {
+    if (map.has(r.id))
+      throw new Error(`agent role already registered: ${r.id}`);
+    const override = configOverrides?.[r.id];
+    const model = override?.model ?? r.defaultModel;
+    if (!model) {
+      throw new Error(`agent role "${r.id}" has no model \u2014 provide defaultModel in plugin or model in config.runtime.agentRoles.${r.id}`);
+    }
+    map.set(r.id, { ...r, model });
+  }
+  return {
+    resolve(id) {
+      const r = map.get(id);
+      if (!r)
+        throw new Error(`agent role not registered: ${id}`);
+      return r;
+    },
+    list: () => Array.from(map.values())
+  };
+}
+
+// packages/runtime/src/control-plane/task-fields.ts
+function createTaskFieldRegistry(extensions) {
+  const byId = new Map;
+  for (const e of extensions) {
+    if (byId.has(e.id))
+      throw new Error(`task field extension already registered: ${e.id}`);
+    byId.set(e.id, e);
+  }
+  return {
+    get: (id) => byId.get(id),
+    list: () => Array.from(byId.values()),
+    fieldNames: () => Array.from(byId.values()).map((e) => e.fieldName),
+    validateTaskFields(task) {
+      const errors = [];
+      for (const ext of byId.values()) {
+        let schema;
+        try {
+          schema = JSON.parse(ext.schemaJson);
+        } catch {
+          errors.push(`task field "${ext.id}": schemaJson is not valid JSON`);
+          continue;
+        }
+        const isRequired = typeof schema === "object" && schema !== null && schema.required === true;
+        if (!isRequired)
+          continue;
+        const value = task[ext.fieldName];
+        if (value === undefined || value === null || value === "") {
+          errors.push(`task field "${ext.fieldName}" (from extension "${ext.id}") is required but missing`);
+        }
+      }
+      return errors.length === 0 ? { ok: true } : { ok: false, errors };
+    }
+  };
+}
+
+// packages/runtime/src/control-plane/validators/runtime-registration.ts
+import { existsSync as existsSync2 } from "fs";
+import { join } from "path";
+function createValidatorRegistry() {
+  const map = new Map;
+  const order = [];
+  const registry = {
+    register(v) {
+      if (map.has(v.id))
+        throw new Error(`validator already registered: ${v.id}`);
+      map.set(v.id, v);
+      order.push(v);
+    },
+    resolve(id) {
+      const v = map.get(id);
+      if (!v)
+        throw new Error(`validator not registered: ${id}`);
+      return v;
+    },
+    list: () => order
+  };
+  registerBuiltInValidators(registry);
+  return registry;
+}
+function registerBuiltInValidators(registry) {
+  registry.register({
+    id: "std:typecheck",
+    category: "custom",
+    description: "Runs the package typecheck script when present.",
+    run: async (ctx) => runStdTypecheck(ctx)
+  });
+}
+async function runStdTypecheck(ctx) {
+  const packageJsonPath = join(ctx.workspaceRoot, "package.json");
+  if (!existsSync2(packageJsonPath)) {
+    return {
+      id: "std:typecheck",
+      passed: false,
+      summary: `package.json not found at ${packageJsonPath}`
+    };
+  }
+  const proc = Bun.spawn(["bun", "run", "typecheck"], {
+    cwd: ctx.workspaceRoot,
+    env: process.env,
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    proc.exited,
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text()
+  ]);
+  const output = `${stdout}${stderr}`.trim();
+  return {
+    id: "std:typecheck",
+    passed: exitCode === 0,
+    summary: exitCode === 0 ? "typecheck passed" : "typecheck failed",
+    ...output ? { details: output.slice(0, 4000) } : {}
+  };
+}
+
+// packages/runtime/src/control-plane/native/scope-rules.ts
+var activeRules = null;
+function setScopeRules(rules) {
+  activeRules = rules ?? null;
+}
+
+// packages/runtime/src/control-plane/hook-materializer.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname4, resolve as resolve4 } from "path";
+var MARKER_PLUGIN = "_rigPlugin";
+var MARKER_HOOK_ID = "_rigHookId";
+function matcherToString(matcher) {
+  if (matcher.kind === "all")
+    return;
+  if (matcher.kind === "tool")
+    return matcher.name;
+  return matcher.pattern;
+}
+function isPluginOwned(cmd) {
+  return typeof cmd[MARKER_PLUGIN] === "string";
+}
+function materializeHooks(projectRoot, entries) {
+  const settingsPath = resolve4(projectRoot, ".claude", "settings.json");
+  const existing = existsSync3(settingsPath) ? safeReadJson(settingsPath) : {};
+  const hooks = existing.hooks ?? {};
+  for (const event of Object.keys(hooks)) {
+    const groups = hooks[event] ?? [];
+    const cleaned = [];
+    for (const group of groups) {
+      const operatorHooks = group.hooks.filter((h) => !isPluginOwned(h));
+      if (operatorHooks.length > 0) {
+        cleaned.push({ ...group, hooks: operatorHooks });
+      }
+    }
+    if (cleaned.length > 0) {
+      hooks[event] = cleaned;
+    } else {
+      delete hooks[event];
+    }
+  }
+  for (const { pluginName, hook } of entries) {
+    if (!hook.command) {
+      continue;
+    }
+    const event = hook.event;
+    const matcherString = matcherToString(hook.matcher);
+    const groups = hooks[event] ??= [];
+    let group = groups.find((g) => g.matcher === matcherString);
+    if (!group) {
+      group = matcherString === undefined ? { hooks: [] } : { matcher: matcherString, hooks: [] };
+      groups.push(group);
+    }
+    group.hooks.push({
+      type: "command",
+      command: hook.command,
+      [MARKER_PLUGIN]: pluginName,
+      [MARKER_HOOK_ID]: hook.id
+    });
+  }
+  const next = { ...existing };
+  if (Object.keys(hooks).length > 0) {
+    next.hooks = hooks;
+  } else {
+    delete next.hooks;
+  }
+  mkdirSync2(dirname4(settingsPath), { recursive: true });
+  writeFileSync2(settingsPath, `${JSON.stringify(next, null, 2)}
+`, "utf-8");
+  return settingsPath;
+}
+function safeReadJson(path) {
+  try {
+    return JSON.parse(readFileSync2(path, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+
+// packages/runtime/src/control-plane/plugin-host-context.ts
+async function buildPluginHostContext(projectRoot) {
+  let config;
+  try {
+    config = await loadConfig(projectRoot);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("no rig.config")) {
+      return null;
+    }
+    throw err;
+  }
+  const pluginHost = createPluginHost(config.plugins);
+  setScopeRules(config.workspace.scopeNormalization);
+  const validatorRegistry = createValidatorRegistry();
+  for (const impl of pluginHost.listExecutableValidators()) {
+    validatorRegistry.register(impl);
+  }
+  const taskSourceRegistry = buildTaskSourceRegistry(config, pluginHost);
+  const repoRegistry = createRepoRegistry(pluginHost.listRepoSources());
+  const managedEntries = pluginHost.listRepoSources().map(repoRegistrationToManagedEntry).filter((e) => e !== null);
+  setManagedRepos(managedEntries);
+  const configRoleOverrides = config.runtime?.agentRoles;
+  const agentRoleRegistry = createAgentRoleRegistry(pluginHost.listAgentRoles(), configRoleOverrides);
+  const taskFieldRegistry = createTaskFieldRegistry(pluginHost.listTaskFieldExtensions());
+  try {
+    const hookEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.hooks ?? []).map((hook) => ({
+      pluginName: plugin.name,
+      hook
+    })));
+    if (hookEntries.length > 0) {
+      materializeHooks(projectRoot, hookEntries);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] hook materialization failed: ${err instanceof Error ? err.message : err}`);
+  }
+  return {
+    config,
+    pluginHost,
+    validatorRegistry,
+    taskSourceRegistry,
+    repoRegistry,
+    agentRoleRegistry,
+    taskFieldRegistry
+  };
+}
+
+// packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync5, readFileSync as readFileSync4, readdirSync, statSync, writeFileSync as writeFileSync3 } from "fs";
+import { basename as basename3, join as join2, resolve as resolve6 } from "path";
+
+// packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve5 } from "path";
+
+// packages/runtime/src/control-plane/tasks/task-record-reader.ts
+async function findTaskById(reader, id) {
+  const tasks = await reader.listTasks();
+  return tasks.find((task) => task.id === id) ?? null;
+}
+
+// packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
+class LegacyTaskConfigReadError extends Error {
+  code = "LEGACY_TASK_CONFIG_READ_FAILED";
+  projectRoot;
+  configPath;
+  cause;
+  constructor(input) {
+    super(input.message, { cause: input.cause });
+    this.name = "LegacyTaskConfigReadError";
+    this.projectRoot = input.projectRoot;
+    this.configPath = input.configPath;
+    this.cause = input.cause;
+  }
+}
+function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
+  const configPath = options.configPath ?? resolve5(projectRoot, ".rig", "task-config.json");
+  const reader = {
+    async listTasks() {
+      return readLegacyTaskRecords(projectRoot, configPath);
+    },
+    async getTask(id) {
+      return findTaskById(reader, id);
+    }
+  };
+  return reader;
+}
+function readLegacyTaskRecords(projectRoot, configPath = resolve5(projectRoot, ".rig", "task-config.json")) {
+  if (!existsSync4(configPath)) {
+    return [];
+  }
+  const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
+  return Object.entries(stripLegacyTaskConfigMetadata(rawConfig)).map(([id, entry]) => legacyTaskConfigEntryToRecord(id, entry)).filter((record) => record !== null);
+}
+function readLegacyTaskConfigJson(projectRoot, configPath) {
+  try {
+    const parsed = JSON.parse(readFileSync3(configPath, "utf8"));
+    if (isPlainRecord(parsed)) {
+      return parsed;
+    }
+    throw new Error("task config root must be a JSON object");
+  } catch (cause) {
+    throw new LegacyTaskConfigReadError({
+      projectRoot,
+      configPath,
+      message: `Could not read legacy task config at ${configPath} for project ${projectRoot}: ${cause instanceof Error ? cause.message : String(cause)}`,
+      cause
+    });
+  }
+}
+function stripLegacyTaskConfigMetadata(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function legacyTaskConfigEntryToRecord(id, entry) {
+  if (!isPlainRecord(entry)) {
+    return null;
+  }
+  const deps = firstStringList(entry.deps, entry.dependencies, entry.validation_deps, entry.validationDeps);
+  const validation = readStringList(entry.validation);
+  const validators = readStringList(entry.validators);
+  const scope = readStringList(entry.scope);
+  const status = typeof entry.status === "string" ? entry.status : "open";
+  const title = typeof entry.title === "string" ? entry.title : undefined;
+  const description = typeof entry.description === "string" ? entry.description : undefined;
+  const acceptanceCriteria = typeof entry.acceptance_criteria === "string" ? entry.acceptance_criteria : typeof entry.acceptanceCriteria === "string" ? entry.acceptanceCriteria : undefined;
+  return {
+    id,
+    deps,
+    status,
+    source: "legacy-task-config",
+    ...title ? { title } : {},
+    ...description ? { description } : {},
+    ...acceptanceCriteria ? { acceptanceCriteria } : {},
+    ...scope.length > 0 ? { scope } : {},
+    ...validation.length > 0 ? { validation } : {},
+    ...validators.length > 0 ? { validators } : {},
+    ...preservedLegacyFields(entry)
+  };
+}
+function preservedLegacyFields(entry) {
+  const preserved = {};
+  for (const key of [
+    "role",
+    "browser",
+    "repo_pins",
+    "criticality",
+    "queue_weight",
+    "creates_repo",
+    "auto_synced"
+  ]) {
+    if (entry[key] !== undefined) {
+      preserved[key] = entry[key];
+    }
+  }
+  return preserved;
+}
+function firstStringList(...candidates) {
+  for (const candidate of candidates) {
+    const list = readStringList(candidate);
+    if (list.length > 0) {
+      return list;
+    }
+  }
+  return [];
+}
+function readStringList(candidate) {
+  if (!Array.isArray(candidate)) {
+    return [];
+  }
+  return candidate.filter((value) => typeof value === "string");
+}
+function isPlainRecord(candidate) {
+  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
+}
+
+// packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
+var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
+var FILE_TASK_PATTERN = /\.(task\.)?json$/;
+function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
+  const configPath = options.configPath ?? resolve6(projectRoot, ".rig", "task-config.json");
+  const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
+  const spawnFn = options.spawn ?? spawnSync;
+  const ghBinary = options.ghBinary ?? "gh";
+  const allowLocalFallback = options.allowLocalTaskConfigStatusFallback ?? true;
+  return {
+    async listTasks() {
+      const rawConfig = readRawTaskConfig(configPath);
+      if (!rawConfig) {
+        const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
+        return configuredFilesPath ? listFileBackedTasks(projectRoot, configuredFilesPath) : [];
+      }
+      const tasks = [];
+      const legacyTasks = await legacy.listTasks();
+      const legacyById = new Map(legacyTasks.map((task) => [task.id, task]));
+      for (const [id, rawEntry] of Object.entries(stripLegacyTaskConfigMetadata2(rawConfig))) {
+        if (!isPlainRecord2(rawEntry)) {
+          continue;
+        }
+        const metadata = readMaterializedTaskMetadata(rawEntry);
+        if (metadata.taskSource?.kind === "github-issues") {
+          tasks.push(readGithubIssueTask(ghBinary, spawnFn, id, metadata, rawEntry));
+          continue;
+        }
+        if (metadata.taskSource?.kind === "files" && metadata.taskSource.path) {
+          const fileTask = readFileBackedTask(projectRoot, metadata.taskSource.path, id, rawEntry);
+          if (fileTask)
+            tasks.push(fileTask);
+          continue;
+        }
+        if (!allowLocalFallback) {
+          continue;
+        }
+        const legacyTask = legacyById.get(id);
+        if (legacyTask) {
+          tasks.push(legacyTask);
+        }
+      }
+      return tasks;
+    },
+    async getTask(id) {
+      const rawEntry = readRawTaskEntry(configPath, id);
+      if (!rawEntry) {
+        const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
+        return configuredFilesPath ? readFileBackedTask(projectRoot, configuredFilesPath, id, {}) : null;
+      }
+      const metadata = readMaterializedTaskMetadata(rawEntry);
+      if (metadata.taskSource?.kind === "github-issues") {
+        return readGithubIssueTask(ghBinary, spawnFn, id, metadata, rawEntry);
+      }
+      if (metadata.taskSource?.kind === "files" && metadata.taskSource.path) {
+        return readFileBackedTask(projectRoot, metadata.taskSource.path, id, rawEntry);
+      }
+      return allowLocalFallback ? legacy.getTask(id) : null;
+    }
+  };
+}
+function readMaterializedTaskMetadata(entry) {
+  const rawRig = entry._rig;
+  if (!isPlainRecord2(rawRig)) {
+    return {};
+  }
+  const rawSource = rawRig.taskSource;
+  const metadata = {};
+  if (isPlainRecord2(rawSource)) {
+    const kind = typeof rawSource.kind === "string" ? rawSource.kind : "";
+    if (kind.length > 0) {
+      metadata.taskSource = {
+        kind,
+        ...typeof rawSource.path === "string" ? { path: rawSource.path } : {},
+        ...typeof rawSource.owner === "string" ? { owner: rawSource.owner } : {},
+        ...typeof rawSource.repo === "string" ? { repo: rawSource.repo } : {},
+        ...Array.isArray(rawSource.labels) ? { labels: rawSource.labels.filter((label) => typeof label === "string") } : {},
+        ...rawSource.state === "open" || rawSource.state === "closed" || rawSource.state === "all" ? { state: rawSource.state } : {}
+      };
+    }
+  }
+  if (typeof rawRig.sourceIssueId === "string") {
+    metadata.sourceIssueId = rawRig.sourceIssueId;
+  }
+  return metadata;
+}
+function readConfiguredFilesTaskSourcePath(projectRoot) {
+  const jsonPath = resolve6(projectRoot, "rig.config.json");
+  if (existsSync5(jsonPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync4(jsonPath, "utf8"));
+      if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
+        const source = parsed.taskSource;
+        return source.kind === "files" && typeof source.path === "string" ? source.path : null;
+      }
+    } catch {
+      return null;
+    }
+  }
+  const tsPath = resolve6(projectRoot, "rig.config.ts");
+  if (!existsSync5(tsPath)) {
+    return null;
+  }
+  try {
+    const source = readFileSync4(tsPath, "utf8");
+    const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
+    const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
+    if (kind !== "files") {
+      return null;
+    }
+    return taskSourceBlock.match(/path\s*:\s*["']([^"']+)["']/)?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+function readRawTaskEntry(configPath, taskId) {
+  const rawConfig = readRawTaskConfig(configPath);
+  if (!rawConfig) {
+    return null;
+  }
+  const entry = stripLegacyTaskConfigMetadata2(rawConfig)[taskId];
+  return isPlainRecord2(entry) ? entry : null;
+}
+function readRawTaskConfig(configPath) {
+  if (!existsSync5(configPath)) {
+    return null;
+  }
+  const parsed = JSON.parse(readFileSync4(configPath, "utf8"));
+  return isPlainRecord2(parsed) ? parsed : null;
+}
+function stripLegacyTaskConfigMetadata2(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function listFileBackedTasks(projectRoot, sourcePath) {
+  const directory = resolve6(projectRoot, sourcePath);
+  if (!existsSync5(directory)) {
+    return [];
+  }
+  const tasks = [];
+  for (const name of readdirSync(directory)) {
+    if (!FILE_TASK_PATTERN.test(name))
+      continue;
+    const inferredId = basename3(name).replace(FILE_TASK_PATTERN, "");
+    const task = readFileBackedTask(projectRoot, sourcePath, inferredId, {});
+    if (task)
+      tasks.push(task);
+  }
+  return tasks;
+}
+function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
+  const file = findFileBackedTaskFile(resolve6(projectRoot, sourcePath), taskId);
+  if (!file) {
+    return null;
+  }
+  const raw = JSON.parse(readFileSync4(file, "utf8"));
+  if (!isPlainRecord2(raw)) {
+    return null;
+  }
+  return {
+    id: typeof raw.id === "string" ? raw.id : taskId,
+    deps: Array.isArray(raw.deps) ? raw.deps : Array.isArray(raw.depends_on) ? raw.depends_on : [],
+    status: typeof raw.status === "string" ? raw.status : "ready",
+    title: typeof raw.title === "string" ? raw.title : typeof rawEntry.title === "string" ? rawEntry.title : taskId,
+    ...raw
+  };
+}
+function findFileBackedTaskFile(directory, taskId) {
+  if (!existsSync5(directory)) {
+    return null;
+  }
+  for (const name of readdirSync(directory)) {
+    if (!FILE_TASK_PATTERN.test(name))
+      continue;
+    const file = join2(directory, name);
+    try {
+      if (!statSync(file).isFile())
+        continue;
+      const raw = JSON.parse(readFileSync4(file, "utf8"));
+      const inferredId = basename3(file).replace(FILE_TASK_PATTERN, "");
+      const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
+      if (id === taskId) {
+        return file;
+      }
+    } catch {}
+  }
+  return null;
+}
+function readGithubIssueTask(bin, spawnFn, id, metadata, rawEntry) {
+  const source = requireGithubIssueSource(metadata, id);
+  const issue = runGh(bin, [
+    "issue",
+    "view",
+    String(id),
+    "--repo",
+    `${source.owner}/${source.repo}`,
+    "--json",
+    "number,title,body,labels,state,url,assignees"
+  ], spawnFn);
+  return githubIssueToTask(issue, source, rawEntry);
+}
+function requireGithubIssueSource(metadata, id) {
+  const source = metadata.taskSource;
+  if (source?.kind === "github-issues" && source.owner && source.repo) {
+    return { owner: source.owner, repo: source.repo };
+  }
+  const parsed = metadata.sourceIssueId?.match(/^([^/]+)\/([^#]+)#(\d+)$/);
+  if (parsed && parsed[3] === id) {
+    return { owner: parsed[1], repo: parsed[2] };
+  }
+  throw new Error(`Task ${id} is marked as github-issues but has no owner/repo source metadata`);
+}
+function githubIssueToTask(issue, source, rawEntry) {
+  const labelNames = (issue.labels ?? []).map((label) => label.name);
+  const scope = labelNames.filter((label) => label.startsWith("scope:")).map((label) => label.slice("scope:".length));
+  const roleLabel = labelNames.find((label) => label.startsWith("role:"));
+  const validators = labelNames.filter((label) => label.startsWith("validator:")).map((label) => label.slice("validator:".length));
+  const body = issue.body ?? "";
+  const repo = `${source.owner}/${source.repo}`;
+  return {
+    id: String(issue.number),
+    deps: parseDeps(body),
+    status: githubStatusFor(issue),
+    title: issue.title,
+    body,
+    ...scope.length > 0 ? { scope } : {},
+    ...roleLabel ? { role: roleLabel.slice("role:".length) } : typeof rawEntry.role === "string" ? { role: rawEntry.role } : {},
+    ...validators.length > 0 ? { validators } : {},
+    ...issue.url ? { url: issue.url } : {},
+    issueType: issueTypeFor(labelNames),
+    sourceIssueId: `${repo}#${issue.number}`,
+    parentChildDeps: parseParents(body),
+    labels: labelNames,
+    raw: issue,
+    source: "github-issues",
+    _rig: {
+      taskSource: { kind: "github-issues", owner: source.owner, repo: source.repo },
+      sourceIssueId: `${repo}#${issue.number}`
+    }
+  };
+}
+function githubStatusFor(issue) {
+  const state = (issue.state ?? "").toUpperCase();
+  if (state === "CLOSED")
+    return "closed";
+  const labelNames = (issue.labels ?? []).map((label) => label.name);
+  if (labelNames.includes("in-progress"))
+    return "in_progress";
+  if (labelNames.includes("blocked"))
+    return "blocked";
+  if (labelNames.includes("ready"))
+    return "ready";
+  if (labelNames.includes("under-review"))
+    return "under_review";
+  if (labelNames.includes("failed"))
+    return "failed";
+  if (labelNames.includes("cancelled"))
+    return "cancelled";
+  return "open";
+}
+function selectedGitHubEnv() {
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+}
+function ghSpawnOptions() {
+  return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
+}
+function runGh(bin, args, spawnFn) {
+  const res = spawnFn(bin, [...args], ghSpawnOptions());
+  assertGhSuccess(args, res);
+  if (!res.stdout || res.stdout.trim() === "") {
+    throw new Error(`gh ${args.join(" ")} returned empty stdout`);
+  }
+  return JSON.parse(res.stdout);
+}
+function assertGhSuccess(args, res) {
+  if (res.error) {
+    const msg = res.error.message ?? String(res.error);
+    throw new Error(`gh CLI not available \u2014 install gh (brew install gh / apt install gh): ${msg}`);
+  }
+  if (res.status !== 0) {
+    throw new Error(`gh ${args.join(" ")} failed (exit ${res.status}): ${res.stderr}`);
+  }
+}
+function parseDeps(body) {
+  return parseIssueRefs(body, /^depends-on:\s*([^\n]+)/im);
+}
+function parseParents(body) {
+  return parseIssueRefs(body, /^parents?:\s*([^\n]+)/im);
+}
+function parseIssueRefs(body, pattern) {
+  const match = body.match(pattern);
+  if (!match)
+    return [];
+  return match[1].split(",").map((value) => value.trim()).map((value) => value.replace(/^#/, "").match(/^(\d+)/)?.[1] ?? "").filter((value) => value.length > 0);
+}
+function issueTypeFor(labels) {
+  const typed = labels.find((label) => label.startsWith("type:"));
+  if (typed)
+    return typed.slice("type:".length);
+  if (labels.includes("epic"))
+    return "epic";
+  return "task";
+}
+function isPlainRecord2(candidate) {
+  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
+}
+
+// packages/runtime/src/control-plane/tasks/source-lifecycle.ts
+function hasRunnableTaskSource(source) {
+  return Boolean(source && typeof source === "object" && !Array.isArray(source));
+}
+async function getPluginTask(projectRoot, taskId) {
+  const ctx = await buildPluginHostContext(projectRoot);
+  const [source] = ctx?.taskSourceRegistry.list() ?? [];
+  if (!hasRunnableTaskSource(source)) {
+    return ctx ? { configured: false, sourceKind: null, task: null } : null;
+  }
+  const task = source.get ? await source.get(taskId) ?? null : (await source.list()).find((entry) => entry.id === taskId) ?? null;
+  return {
+    configured: true,
+    sourceKind: source.kind,
+    task
+  };
+}
+async function readConfiguredTaskSourceTask(projectRoot, taskId) {
+  const pluginResult = await getPluginTask(projectRoot, taskId);
+  if (pluginResult)
+    return pluginResult;
+  const task = await createSourceAwareTaskConfigRecordReader(projectRoot).getTask(taskId);
+  return {
+    configured: false,
+    sourceKind: null,
+    task
+  };
+}
+
+// packages/runtime/src/control-plane/native/task-state.ts
+import { existsSync as existsSync9, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
+import { basename as basename5, resolve as resolve11 } from "path";
+
+// packages/runtime/src/control-plane/state-sync/types.ts
+var CANONICAL_TASK_LIFECYCLE_STATUSES = new Set([
+  "draft",
+  "open",
+  "ready",
+  "queued",
+  "in_progress",
+  "under_review",
+  "blocked",
+  "completed",
+  "cancelled"
+]);
+// packages/runtime/src/control-plane/native/git-native.ts
+import { tmpdir as tmpdir3 } from "os";
+import { dirname as dirname5, isAbsolute, resolve as resolve7 } from "path";
+var sharedGitNativeOutputDir = resolve7(tmpdir3(), "rig-native");
+var sharedGitNativeOutputPath = resolve7(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+
+// packages/runtime/src/control-plane/native/utils.ts
+import { existsSync as existsSync8, readFileSync as readFileSync5 } from "fs";
+import { resolve as resolve10 } from "path";
+
+// packages/runtime/src/layout.ts
+import { existsSync as existsSync6 } from "fs";
+import { basename as basename4, dirname as dirname6, resolve as resolve8 } from "path";
+var RIG_DEFINITION_DIRNAME = "rig";
+var RIG_ARTIFACTS_DIRNAME = "artifacts";
+function resolveMonorepoRoot(projectRoot) {
+  const normalizedProjectRoot = resolve8(projectRoot);
+  const explicit = process.env.MONOREPO_ROOT?.trim();
+  if (explicit) {
+    const explicitRoot = resolve8(explicit);
+    const explicitParent = dirname6(explicitRoot);
+    if (basename4(explicitParent) === ".worktrees") {
+      const owner = dirname6(explicitParent);
+      const ownerHasGit = existsSync6(resolve8(owner, ".git"));
+      const ownerHasTaskConfig = existsSync6(resolve8(owner, ".rig", "task-config.json"));
+      const ownerHasRigConfig = existsSync6(resolve8(owner, "rig.config.ts"));
+      if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
+        return owner;
+      }
+      throw new Error(`MONOREPO_ROOT points to worktree ${explicitRoot}, but the owner checkout is incomplete at ${owner}.`);
+    }
+    if (!existsSync6(resolve8(explicitRoot, ".git"))) {
+      throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but no git checkout was found there.`);
+    }
+    const hasTaskConfig = existsSync6(resolve8(explicitRoot, ".rig", "task-config.json"));
+    const hasRigConfig = existsSync6(resolve8(explicitRoot, "rig.config.ts"));
+    if (!hasTaskConfig && !hasRigConfig) {
+      throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but neither .rig/task-config.json nor rig.config.ts exists there.`);
+    }
+    return explicitRoot;
+  }
+  const projectParent = dirname6(normalizedProjectRoot);
+  if (basename4(projectParent) === ".worktrees") {
+    const worktreeOwner = dirname6(projectParent);
+    const ownerHasGit = existsSync6(resolve8(worktreeOwner, ".git"));
+    const ownerHasTaskConfig = existsSync6(resolve8(worktreeOwner, ".rig", "task-config.json"));
+    const ownerHasRigConfig = existsSync6(resolve8(worktreeOwner, "rig.config.ts"));
+    if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
+      return worktreeOwner;
+    }
+  }
+  return normalizedProjectRoot;
+}
+function resolveRuntimeWorkspaceLayout(workspaceDir) {
+  const root = resolve8(workspaceDir);
+  const rigRoot = resolve8(root, ".rig");
+  const logsDir = resolve8(rigRoot, "logs");
+  const stateDir = resolve8(rigRoot, "state");
+  const runtimeDir = resolve8(rigRoot, "runtime");
+  const binDir = resolve8(rigRoot, "bin");
+  return {
+    workspaceDir: root,
+    rigRoot,
+    stateDir,
+    logsDir,
+    artifactsRoot: resolve8(root, RIG_ARTIFACTS_DIRNAME),
+    runtimeDir,
+    homeDir: resolve8(rigRoot, "home"),
+    tmpDir: resolve8(rigRoot, "tmp"),
+    cacheDir: resolve8(rigRoot, "cache"),
+    sessionDir: resolve8(rigRoot, "session"),
+    binDir,
+    distDir: resolve8(rigRoot, "dist"),
+    pluginBinDir: resolve8(binDir, "plugins"),
+    contextPath: resolve8(rigRoot, "runtime-context.json"),
+    controlPlaneEventsFile: resolve8(logsDir, "control-plane.events.jsonl")
+  };
+}
+function resolveActiveRuntimeWorkspaceRoot(monorepoRoot) {
+  const explicit = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (!explicit) {
+    throw new Error("No active runtime workspace. Set RIG_TASK_WORKSPACE or provision a task runtime first.");
+  }
+  return resolve8(explicit);
+}
+function resolveRigLayout(projectRoot) {
+  const monorepoRoot = resolveMonorepoRoot(projectRoot);
+  const definitionRoot = resolve8(projectRoot, RIG_DEFINITION_DIRNAME);
+  const runtimeWorkspaceRoot = resolveActiveRuntimeWorkspaceRoot(monorepoRoot);
+  const runtimeLayout = resolveRuntimeWorkspaceLayout(runtimeWorkspaceRoot);
+  const policyDir = resolve8(definitionRoot, "policy");
+  return {
+    projectRoot,
+    monorepoRoot,
+    definitionRoot,
+    runtimeWorkspaceRoot,
+    stateRoot: runtimeLayout.rigRoot,
+    artifactsRoot: runtimeLayout.artifactsRoot,
+    configPath: resolve8(definitionRoot, "config.sh"),
+    taskConfigPath: resolve8(runtimeWorkspaceRoot, ".rig", "task-config.json"),
+    policyDir,
+    policyFile: resolve8(policyDir, "policy.json"),
+    pluginsDir: resolve8(definitionRoot, "plugins"),
+    hooksDir: resolve8(definitionRoot, "hooks"),
+    toolsDir: resolve8(definitionRoot, "tools"),
+    templatesDir: resolve8(definitionRoot, "templates"),
+    validationDir: resolve8(definitionRoot, "validation"),
+    stateDir: runtimeLayout.stateDir,
+    logsDir: runtimeLayout.logsDir,
+    notificationsDir: resolve8(definitionRoot, "notifications"),
+    runtimeDir: runtimeLayout.runtimeDir,
+    distDir: runtimeLayout.distDir,
+    binDir: runtimeLayout.binDir,
+    pluginBinDir: runtimeLayout.pluginBinDir,
+    keybindingsPath: resolve8(definitionRoot, "keybindings.json"),
+    controlPlaneEventsFile: runtimeLayout.controlPlaneEventsFile
+  };
+}
+
+// packages/runtime/src/control-plane/native/runtime-native.ts
+import { dlopen, ptr, suffix, toBuffer } from "bun:ffi";
+import { copyFileSync, existsSync as existsSync7, mkdirSync as mkdirSync3, renameSync, rmSync, statSync as statSync2 } from "fs";
+import { tmpdir as tmpdir4 } from "os";
+import { dirname as dirname7, resolve as resolve9 } from "path";
+var sharedNativeRuntimeOutputDir = resolve9(tmpdir4(), "rig-native");
+var sharedNativeRuntimeOutputPath = resolve9(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
+var colocatedNativeRuntimeFileName = `runtime-native.${suffix}`;
+var nativeRuntimeLibrary = await loadNativeRuntimeLibrary();
+async function ensureNativeRuntimeLibraryPath(outputPath = sharedNativeRuntimeOutputPath, options = {}) {
+  if (await buildNativeRuntimeLibrary(outputPath, options)) {
+    return outputPath;
+  }
+  return !options.force && existsSync7(outputPath) ? outputPath : null;
+}
+async function loadNativeRuntimeLibrary() {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return null;
+  }
+  for (const candidate of nativeRuntimeLibraryCandidates()) {
+    if (!candidate || !existsSync7(candidate)) {
+      continue;
+    }
+    const loaded = tryDlopenNativeRuntimeLibrary(candidate);
+    if (loaded) {
+      return loaded;
+    }
+  }
+  const builtLibraryPath = await ensureNativeRuntimeLibraryPath(sharedNativeRuntimeOutputPath, { force: true });
+  if (!builtLibraryPath) {
+    return null;
+  }
+  return tryDlopenNativeRuntimeLibrary(builtLibraryPath);
+}
+function nativePackageLibraryCandidates(fromDir, names) {
+  const candidates = [];
+  let cursor = resolve9(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    for (const name of names) {
+      candidates.push(resolve9(cursor, "native", `${process.platform}-${process.arch}`, name), resolve9(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve9(cursor, "native", name), resolve9(cursor, "native", "lib", name));
+    }
+    const parent = dirname7(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+function nativeRuntimeLibraryCandidates() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_LIB?.trim() || "";
+  const execDir = process.execPath?.trim() ? dirname7(process.execPath.trim()) : "";
+  const platformSpecific = `runtime-native-${process.platform}-${process.arch}.${suffix}`;
+  return [...new Set([
+    explicit,
+    ...nativePackageLibraryCandidates(import.meta.dir, [colocatedNativeRuntimeFileName, platformSpecific]),
+    execDir ? resolve9(execDir, colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve9(execDir, platformSpecific) : "",
+    execDir ? resolve9(execDir, "..", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve9(execDir, "..", platformSpecific) : "",
+    execDir ? resolve9(execDir, "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve9(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
+    sharedNativeRuntimeOutputPath
+  ].filter(Boolean))];
+}
+function resolveNativeRuntimeSourcePath() {
+  const explicit = process.env.RIG_NATIVE_RUNTIME_SOURCE?.trim();
+  if (explicit && existsSync7(explicit)) {
+    return explicit;
+  }
+  const bundled = resolve9(import.meta.dir, "../../../native/snapshot.zig");
+  return existsSync7(bundled) ? bundled : null;
+}
+async function buildNativeRuntimeLibrary(outputPath, options = {}) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return false;
+  }
+  const zigBinary = Bun.which("zig");
+  const sourcePath = resolveNativeRuntimeSourcePath();
+  if (!zigBinary || !sourcePath) {
+    return false;
+  }
+  const tempOutputPath = `${outputPath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+  try {
+    mkdirSync3(dirname7(outputPath), { recursive: true });
+    const needsBuild = options.force === true || !existsSync7(outputPath) || statSync2(sourcePath).mtimeMs > statSync2(outputPath).mtimeMs;
+    if (!needsBuild) {
+      return true;
+    }
+    const build = Bun.spawn([
+      zigBinary,
+      "build-lib",
+      sourcePath,
+      "-dynamic",
+      "-O",
+      "ReleaseFast",
+      `-femit-bin=${tempOutputPath}`
+    ], {
+      cwd: import.meta.dir,
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const exitCode = await build.exited;
+    if (exitCode !== 0 || !existsSync7(tempOutputPath)) {
+      rmSync(tempOutputPath, { force: true });
+      return false;
+    }
+    renameSync(tempOutputPath, outputPath);
+    return true;
+  } catch {
+    rmSync(tempOutputPath, { force: true });
+    return false;
+  }
+}
+function tryDlopenNativeRuntimeLibrary(outputPath) {
+  try {
+    return dlopen(outputPath, {
+      rig_scope_match: {
+        args: ["ptr", "ptr"],
+        returns: "u8"
+      },
+      snapshot_capture: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_delta: {
+        args: ["ptr", "ptr"],
+        returns: "ptr"
+      },
+      snapshot_store_delta: {
+        args: ["ptr", "ptr", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_inspect_delta: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_apply_delta: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      snapshot_release: {
+        args: ["ptr"],
+        returns: "void"
+      },
+      runtime_hash_file: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_hash_tree: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_prepare_paths: {
+        args: ["ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_link_dependency_layer: {
+        args: ["ptr", "u64", "ptr", "u64"],
+        returns: "ptr"
+      },
+      runtime_scan_worktrees: {
+        args: ["ptr", "u64"],
+        returns: "ptr"
+      }
+    });
+  } catch {
+    return null;
+  }
+}
+
+// packages/runtime/src/control-plane/native/utils.ts
+function resolveMonorepoRoot2(projectRoot) {
+  return resolveMonorepoRoot(projectRoot);
+}
+var scopeRegexCache = new Map;
+function runCapture(command, cwd, env) {
+  const result = Bun.spawnSync(command, {
+    cwd,
+    env: env ? { ...process.env, ...env } : process.env,
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  return {
+    exitCode: result.exitCode,
+    stdout: result.stdout.toString(),
+    stderr: result.stderr.toString()
+  };
+}
+function readJsonFile(path, fallback) {
+  if (!existsSync8(path)) {
+    return fallback;
+  }
+  try {
+    return JSON.parse(readFileSync5(path, "utf-8"));
+  } catch {
+    return fallback;
+  }
+}
+function nowIso() {
+  return new Date().toISOString();
+}
+function resolveHarnessPaths(projectRoot) {
+  const hasRuntimeWorkspace = Boolean(process.env.RIG_TASK_WORKSPACE?.trim());
+  const monorepoRoot = resolveMonorepoRoot2(projectRoot);
+  const harnessRoot = resolve10(projectRoot, "rig");
+  const stateRoot = resolve10(projectRoot, ".rig");
+  const layout = hasRuntimeWorkspace ? resolveRigLayout(projectRoot) : null;
+  const stateDir = layout?.stateDir ?? resolve10(stateRoot, "state");
+  const logsDir = layout?.logsDir ?? resolve10(stateRoot, "logs");
+  const artifactsDir = layout?.artifactsRoot ?? resolve10(monorepoRoot, "artifacts");
+  const taskConfigPath = layout?.taskConfigPath ?? resolve10(monorepoRoot, ".rig", "task-config.json");
+  const binDir = layout?.binDir ?? resolve10(stateRoot, "bin");
+  return {
+    harnessRoot,
+    stateDir: process.env.RIG_STATE_DIR || stateDir,
+    artifactsDir,
+    logsDir: process.env.RIG_LOGS_DIR || logsDir,
+    binDir,
+    hooksDir: resolve10(harnessRoot, "hooks"),
+    validationDir: resolve10(harnessRoot, "validation"),
+    taskConfigPath,
+    sessionPath: process.env.RIG_SESSION_FILE || resolve10(stateRoot, "session", "session.json"),
+    monorepoRoot,
+    tsApiTestsDir: process.env.TS_API_TESTS_DIR || resolve10(monorepoRoot, "TSAPITests"),
+    taskRepoCommitsPath: resolve10(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve10(stateDir, "base-repo-pins.json"),
+    failedApproachesPath: resolve10(stateDir, "failed_approaches.md"),
+    agentProfilePath: resolve10(stateDir, "agent-profile.json"),
+    reviewProfilePath: resolve10(stateDir, "review-profile.json")
+  };
+}
+// packages/runtime/src/control-plane/state-sync/reconcile.ts
+var STALE_CLAIM_MS = 24 * 60 * 60 * 1000;
+// packages/runtime/src/control-plane/native/task-state.ts
+function readTaskConfig(projectRoot) {
+  const raw = readJsonFile(resolveTaskConfigPath(projectRoot), {});
+  return stripTaskConfigMetadata(raw);
+}
+function readSourceTaskConfig(projectRoot) {
+  const raw = readAndSyncSourceTaskConfig(projectRoot);
+  return stripTaskConfigMetadata(raw);
+}
+function stripTaskConfigMetadata(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function coerceValidationDescriptions(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+    return {};
+  }
+  const descriptions = {};
+  for (const [key, value] of Object.entries(candidate)) {
+    if (typeof value === "string" && value.length > 0) {
+      descriptions[key] = value;
+    }
+  }
+  return descriptions;
+}
+function readValidationDescriptionsFromMeta(meta) {
+  if (!meta || typeof meta !== "object" || Array.isArray(meta)) {
+    return;
+  }
+  return meta.validation_descriptions;
+}
+function lookupTask(projectRoot, input) {
+  if (!input) {
+    return "";
+  }
+  if (!input.startsWith("bd-")) {
+    return input;
+  }
+  try {
+    const taskConfig2 = readTaskConfig(projectRoot);
+    if (taskConfig2[input]) {
+      return input;
+    }
+  } catch {}
+  const taskConfig = readSourceTaskConfig(projectRoot);
+  return taskConfig[input] ? input : "";
+}
+function artifactDirForId(projectRoot, id) {
+  const workspaceDir = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (workspaceDir) {
+    const worktreeArtifacts = resolve11(workspaceDir, "artifacts", id);
+    if (existsSync9(worktreeArtifacts) || existsSync9(resolve11(workspaceDir, "artifacts"))) {
+      return worktreeArtifacts;
+    }
+  }
+  try {
+    const paths = resolveHarnessPaths(projectRoot);
+    return resolve11(paths.artifactsDir, id);
+  } catch {
+    return resolve11(resolveMonorepoRoot2(projectRoot), "artifacts", id);
+  }
+}
+function resolveTaskConfigPath(projectRoot) {
+  const paths = resolveHarnessPaths(projectRoot);
+  if (existsSync9(paths.taskConfigPath)) {
+    return paths.taskConfigPath;
+  }
+  for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
+    if (existsSync9(candidate)) {
+      return candidate;
+    }
+  }
+  throw new Error(`Task config missing at ${paths.taskConfigPath}.`);
+}
+function findSourceTaskConfigPath(projectRoot) {
+  for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
+    if (existsSync9(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+var FILE_TASK_PATTERN2 = /\.(task\.)?json$/;
+function readAndSyncSourceTaskConfig(projectRoot) {
+  const sourcePath = findSourceTaskConfigPath(projectRoot);
+  const raw = sourcePath ? readJsonFile(sourcePath, {}) : readConfiguredFileTaskConfig(projectRoot);
+  const synced = synchronizeTaskConfigWithTracker(projectRoot, raw);
+  if (sourcePath && synced.updated) {
+    try {
+      writeFileSync4(sourcePath, `${JSON.stringify(synced.config, null, 2)}
+`, "utf-8");
+    } catch {}
+  }
+  return synced.config;
+}
+function synchronizeTaskConfigWithTracker(projectRoot, rawConfig) {
+  const issues = readSourceIssueRecords(projectRoot);
+  if (issues.length === 0) {
+    return { config: rawConfig, updated: false };
+  }
+  const taskConfig = stripTaskConfigMetadata(rawConfig);
+  const mergedConfig = { ...taskConfig };
+  const validationDescriptions = coerceValidationDescriptions(rawConfig.validation_descriptions);
+  const metaValidationDescriptions = coerceValidationDescriptions(readValidationDescriptionsFromMeta(rawConfig._meta));
+  let updated = false;
+  for (const issue of issues) {
+    if (issue.issueType !== "task") {
+      continue;
+    }
+    if (mergedConfig[issue.id] && !shouldRefreshAutoSyncedTaskConfigEntry(mergedConfig[issue.id])) {
+      continue;
+    }
+    mergedConfig[issue.id] = buildAutoSyncedTaskConfigEntry(issue);
+    updated = true;
+  }
+  return {
+    config: {
+      ...mergedConfig,
+      ...Object.keys(validationDescriptions).length > 0 ? { validation_descriptions: validationDescriptions } : {},
+      ...Object.keys(metaValidationDescriptions).length > 0 ? { _meta: { validation_descriptions: metaValidationDescriptions } } : {}
+    },
+    updated
+  };
+}
+function shouldRefreshAutoSyncedTaskConfigEntry(entry) {
+  if (!entry || typeof entry !== "object") {
+    return false;
+  }
+  const candidate = entry;
+  if (!candidate.auto_synced) {
+    return false;
+  }
+  if (!Array.isArray(candidate.scope) || candidate.scope.length === 0) {
+    return true;
+  }
+  if (candidate.scope.some((glob) => typeof glob !== "string" || glob.trim().length === 0)) {
+    return true;
+  }
+  return !candidate.role;
+}
+function readSourceIssueRecords(projectRoot) {
+  const issuesPath = resolve11(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync9(issuesPath)) {
+    return [];
+  }
+  const records = [];
+  for (const line of readFileSync6(issuesPath, "utf-8").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(trimmed);
+      const id = typeof parsed.id === "string" ? parsed.id.trim() : "";
+      if (!id) {
+        continue;
+      }
+      records.push({
+        id,
+        title: typeof parsed.title === "string" ? parsed.title.trim() : "",
+        issueType: typeof parsed.issue_type === "string" ? parsed.issue_type.trim() : null,
+        labels: Array.isArray(parsed.labels) ? parsed.labels.filter((label) => typeof label === "string") : []
+      });
+    } catch {}
+  }
+  return records;
+}
+function buildAutoSyncedTaskConfigEntry(issue) {
+  return {
+    auto_synced: true,
+    role: inferAutoSyncedTaskRole(issue),
+    scope: inferAutoSyncedTaskScope(issue),
+    validation: []
+  };
+}
+function inferAutoSyncedTaskRole(issue) {
+  for (const label of issue.labels) {
+    if (label === "role:architect")
+      return "architect";
+    if (label === "role:extractor")
+      return "extractor";
+    if (label === "role:mechanic")
+      return "mechanic";
+    if (label === "role:verifier")
+      return "verifier";
+  }
+  if (/\bDESIGN\b/i.test(issue.title)) {
+    return "architect";
+  }
+  if (/\bInitialize\b/i.test(issue.title)) {
+    return "mechanic";
+  }
+  return "extractor";
+}
+function inferAutoSyncedTaskScope(issue) {
+  return [`artifacts/${issue.id}/**`];
+}
+function readConfiguredFileTaskConfig(projectRoot) {
+  const sourcePath = readConfiguredFilesTaskSourcePath2(projectRoot);
+  if (!sourcePath) {
+    return {};
+  }
+  const directory = resolve11(projectRoot, sourcePath);
+  if (!existsSync9(directory)) {
+    return {};
+  }
+  const config = {};
+  for (const name of readdirSync2(directory)) {
+    if (!FILE_TASK_PATTERN2.test(name))
+      continue;
+    const file = resolve11(directory, name);
+    try {
+      if (!statSync3(file).isFile())
+        continue;
+      const raw = JSON.parse(readFileSync6(file, "utf8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        continue;
+      const record = raw;
+      const inferredId = basename5(name).replace(FILE_TASK_PATTERN2, "");
+      const id = typeof record.id === "string" && record.id.trim().length > 0 ? record.id.trim() : inferredId;
+      config[id] = fileTaskToConfigEntry(record, { kind: "files", path: sourcePath });
+    } catch {}
+  }
+  return config;
+}
+function fileTaskToConfigEntry(task, source) {
+  const labels = Array.isArray(task.labels) ? task.labels.filter((label) => typeof label === "string") : [];
+  const scope = firstStringList2(task.scope, labels.filter((label) => label.startsWith("scope:")).map((label) => label.slice("scope:".length)));
+  const validation = firstStringList2(task.validation, task.validators, labels.filter((label) => label.startsWith("validator:")).map((label) => label.slice("validator:".length)));
+  const roleLabel = labels.find((label) => label.startsWith("role:"));
+  const role = typeof task.role === "string" && task.role.trim().length > 0 ? task.role.trim() : roleLabel ? roleLabel.slice("role:".length) : undefined;
+  return {
+    auto_synced: true,
+    ...typeof task.title === "string" ? { title: task.title } : {},
+    ...typeof task.status === "string" ? { status: task.status } : {},
+    ...typeof task.description === "string" ? { description: task.description } : {},
+    ...typeof task.acceptance_criteria === "string" ? { acceptance_criteria: task.acceptance_criteria } : typeof task.acceptanceCriteria === "string" ? { acceptance_criteria: task.acceptanceCriteria } : {},
+    ...role ? { role } : {},
+    ...scope.length > 0 ? { scope } : {},
+    ...validation.length > 0 ? { validation } : {},
+    _rig: { taskSource: source }
+  };
+}
+function firstStringList2(...candidates) {
+  for (const candidate of candidates) {
+    if (!Array.isArray(candidate)) {
+      continue;
+    }
+    const list = candidate.filter((entry) => typeof entry === "string" && entry.trim().length > 0);
+    if (list.length > 0) {
+      return list;
+    }
+  }
+  return [];
+}
+function readConfiguredFilesTaskSourcePath2(projectRoot) {
+  const jsonPath = resolve11(projectRoot, "rig.config.json");
+  if (existsSync9(jsonPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync6(jsonPath, "utf8"));
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        const taskSource = parsed.taskSource;
+        if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
+          const record = taskSource;
+          return record.kind === "files" && typeof record.path === "string" ? record.path : null;
+        }
+      }
+    } catch {
+      return null;
+    }
+  }
+  const tsPath = resolve11(projectRoot, "rig.config.ts");
+  if (!existsSync9(tsPath)) {
+    return null;
+  }
+  try {
+    const source = readFileSync6(tsPath, "utf8");
+    const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
+    const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
+    if (kind !== "files") {
+      return null;
+    }
+    return taskSourceBlock.match(/path\s*:\s*["']([^"']+)["']/)?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+function sourceTaskConfigCandidates(projectRoot) {
+  const runtimeContext = loadRuntimeContextFromEnv();
+  return [
+    runtimeContext?.monorepoMainRoot ? resolve11(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve11(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve11(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
+  ].filter(Boolean);
+}
+
+// packages/runtime/src/binary-run.ts
+var runtimeBinaryBuildQueue = Promise.resolve();
+// packages/runtime/src/control-plane/provider/runtime-instructions.ts
+var CLAUDE_ROUTER_TOOL_NAMES = [
+  "`mcp__rig_runtime_tools__read`",
+  "`mcp__rig_runtime_tools__write`",
+  "`mcp__rig_runtime_tools__edit`",
+  "`mcp__rig_runtime_tools__glob`",
+  "`mcp__rig_runtime_tools__grep`"
+].join(", ");
+var CODEX_DYNAMIC_TOOL_NAMES = [
+  "`shell`",
+  "`read`",
+  "`write`",
+  "`edit`",
+  "`glob`",
+  "`grep`"
+].join(", ");
+
+// packages/runtime/src/control-plane/native/task-ops.ts
+var BUILD_CONFIG = readBuildConfig();
+var BAKED_INFO_OUTPUT = BUILD_CONFIG.AGENT_INFO_OUTPUT ?? "";
+var BAKED_DEPS_OUTPUT = BUILD_CONFIG.AGENT_DEPS_OUTPUT ?? "";
+var BAKED_STATUS_OUTPUT = BUILD_CONFIG.AGENT_STATUS_OUTPUT ?? "";
+var REOPENABLE_TASK_STATUSES = new Set(["completed", "cancelled", "blocked"]);
+var GENERATED_TASK_ARTIFACT_FILES = new Set([
+  "changed-files.txt",
+  "decision-log.md",
+  "next-actions.md",
+  "task-result.json",
+  "validation-summary.json",
+  "review-feedback.md",
+  "review-state.json",
+  "review-status.txt",
+  "review-greptile-raw.json",
+  "pr-state.json",
+  "git-state.txt"
+]);
+
+// packages/runtime/src/control-plane/native/git-ops.ts
+var TASK_ARTIFACT_STAGE_FALLBACK = new Set([
+  "changed-files.txt",
+  "contract-changes.md",
+  "decision-log.md",
+  "git-state.txt",
+  "next-actions.md",
+  "pr-state.json",
+  "task-result.json",
+  "validation-summary.json"
+]);
+function readPrMetadata(projectRoot, taskId) {
+  const path = resolve12(artifactDirForId(projectRoot, taskId), "pr-state.json");
+  if (!existsSync10(path)) {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(readFileSync7(path, "utf-8"));
+    if (!parsed || typeof parsed !== "object") {
+      return [];
+    }
+    if (parsed.prs && typeof parsed.prs === "object") {
+      return Object.values(parsed.prs).filter(isGitOpenPrResult);
+    }
+    return isGitOpenPrResult(parsed) ? [parsed] : [];
+  } catch {
+    return [];
+  }
+}
+function isGitOpenPrResult(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  const record = value;
+  return typeof record.url === "string" && typeof record.branch === "string" && typeof record.base === "string" && (record.target === "project" || record.target === "monorepo") && typeof record.repoLabel === "string";
+}
+
+// packages/runtime/src/control-plane/native/verifier.ts
+async function verifyTask(options) {
+  const paths = resolveHarnessPaths(options.projectRoot);
+  const taskId = options.taskId;
+  const normalizedTaskId = lookupTask(options.projectRoot, taskId);
+  const artifactDir = artifactDirForId(options.projectRoot, taskId);
+  mkdirSync5(artifactDir, { recursive: true });
+  const validationSummaryPath = resolve13(artifactDir, "validation-summary.json");
+  const reviewFeedbackPath = resolve13(artifactDir, "review-feedback.md");
+  const reviewStatePath = resolve13(artifactDir, "review-state.json");
+  const greptileRawPath = resolve13(artifactDir, "review-greptile-raw.json");
+  const prStates = readPrMetadata(options.projectRoot, taskId);
+  const prState = prStates[0] || null;
+  const localReasons = [];
+  const aiReasons = [];
+  const aiWarnings = [];
+  let aiVerdict = "SKIP";
+  let aiRawFeedback = "";
+  const persistArtifacts = options.persistArtifacts !== false;
+  if (!normalizedTaskId && !await hasConfiguredSourceTask(options.projectRoot, taskId)) {
+    localReasons.push(`[Task Config] Unknown task id '${taskId}' in task-config or configured task source.`);
+  }
+  if (!existsSync11(validationSummaryPath)) {
+    localReasons.push(`[Artifact Quality] validation-summary.json not found at ${validationSummaryPath}.`);
+  } else {
+    const summary = await parseValidationSummary(validationSummaryPath);
+    if (!isAcceptedValidationSummary(summary)) {
+      localReasons.push(`[Validation] validation-summary status is '${summary?.status ?? "unknown"}', expected 'pass' or zero-check 'skipped'.`);
+    }
+  }
+  for (const file of ["task-result.json", "decision-log.md", "next-actions.md", "changed-files.txt"]) {
+    const requiredPath = resolve13(artifactDir, file);
+    if (!existsSync11(requiredPath)) {
+      localReasons.push(`[Artifact Quality] Missing required artifact file: ${requiredPath}`);
+    }
+  }
+  const taskResultPath = resolve13(artifactDir, "task-result.json");
+  if (existsSync11(taskResultPath)) {
+    const taskResult = await readJsonFile2(taskResultPath);
+    const artifactStatus = typeof taskResult?.status === "string" ? taskResult.status.trim().toLowerCase() : "";
+    if (artifactStatus === "partial") {
+      localReasons.push("[Artifact Quality] task-result.json status is 'partial'; completion requires a terminal result.");
+    }
+    if (hasNonEmptyBlockers(taskResult?.blockers)) {
+      localReasons.push("[Artifact Quality] task-result.json blockers must be empty for completion.");
+    }
+    if (nextActionsIndicateRemainingScope(stringifyNextActions(taskResult?.nextActions ?? taskResult?.next_actions))) {
+      localReasons.push("[Artifact Quality] task-result.json next actions indicate remaining implementation scope.");
+    }
+  }
+  const nextActionsPath = resolve13(artifactDir, "next-actions.md");
+  if (existsSync11(nextActionsPath)) {
+    const nextActionsContent = await Bun.file(nextActionsPath).text();
+    if (nextActionsContent.includes("TODO: Replace this scaffold") || nextActionsContent.includes("bd-<downstream-task-id>")) {
+      localReasons.push("[Artifact Quality] next-actions.md still contains scaffold placeholder text. Replace with real recommendations.");
+    }
+    if (nextActionsIndicateRemainingScope(nextActionsContent)) {
+      localReasons.push("[Artifact Quality] next-actions.md indicates remaining implementation scope.");
+    }
+  }
+  const sourceCloseoutIssueId = resolveGithubSourceIssueId(options.projectRoot, taskId);
+  if (sourceCloseoutIssueId) {
+    localReasons.push(...evaluateGithubSourceIssuePrCloseout(options.projectRoot, prStates, sourceCloseoutIssueId));
+  }
+  const pluginResults = await options.plugins.runValidators(taskId);
+  for (const result of pluginResults) {
+    if (!result.passed) {
+      localReasons.push(`[Plugin Validator] ${result.id}: ${result.summary}`);
+    }
+  }
+  const reviewMode = await loadReviewMode(paths.reviewProfilePath, process.env.AI_REVIEW_MODE || "advisory");
+  const reviewProvider = await loadReviewProvider(paths.reviewProfilePath, process.env.AI_REVIEW_PROVIDER || "greptile");
+  if (!options.skipAiReview && localReasons.length === 0 && reviewProvider === "greptile" && reviewMode !== "off") {
+    const ai = await runGreptileReview({
+      projectRoot: options.projectRoot,
+      taskId,
+      artifactDir,
+      prStates,
+      reviewMode
+    });
+    aiVerdict = ai.verdict;
+    aiRawFeedback = ai.feedback;
+    aiReasons.push(...ai.reasons);
+    aiWarnings.push(...ai.warnings);
+    if (reviewMode === "required" && ai.verdict !== "APPROVE" && ai.reasons.length === 0) {
+      aiReasons.push(`[AI Review] Required mode needs a completed Greptile approval; current verdict is ${ai.verdict}.`);
+    }
+    if (persistArtifacts && ai.rawResponse) {
+      writeFileSync6(greptileRawPath, `${ai.rawResponse}
+`, "utf-8");
+    }
+  } else if (!options.skipAiReview && reviewMode === "off") {
+    aiWarnings.push("[AI Review] AI review mode is off.");
+  }
+  const aiReviewApproved = options.skipAiReview || isAiReviewApproved({
+    reviewMode,
+    aiVerdict,
+    aiReasons
+  });
+  if (persistArtifacts) {
+    writeFeedbackFile({
+      taskId,
+      provider: reviewProvider,
+      mode: reviewMode,
+      verdict: aiVerdict,
+      localReasons,
+      aiReasons,
+      aiWarnings,
+      aiRawFeedback,
+      output: reviewFeedbackPath
+    });
+    writeReviewStateFile({
+      taskId,
+      approved: localReasons.length === 0 && aiReviewApproved,
+      provider: reviewProvider,
+      mode: reviewMode,
+      verdict: aiVerdict,
+      prState,
+      localReasons,
+      aiReasons,
+      aiWarnings,
+      output: reviewStatePath
+    });
+  }
+  if (localReasons.length > 0) {
+    return {
+      approved: false,
+      localReasons,
+      aiReasons,
+      aiWarnings,
+      aiVerdict,
+      reviewFeedbackPath,
+      reviewStatePath
+    };
+  }
+  if (!aiReviewApproved) {
+    return {
+      approved: false,
+      localReasons,
+      aiReasons,
+      aiWarnings,
+      aiVerdict,
+      reviewFeedbackPath,
+      reviewStatePath
+    };
+  }
+  return {
+    approved: true,
+    localReasons,
+    aiReasons,
+    aiWarnings,
+    aiVerdict,
+    reviewFeedbackPath,
+    reviewStatePath
+  };
+}
+async function readJsonFile2(path) {
+  try {
+    return await Bun.file(path).json();
+  } catch {
+    return null;
+  }
+}
+function hasNonEmptyBlockers(blockers) {
+  if (blockers == null) {
+    return false;
+  }
+  if (typeof blockers === "string") {
+    const normalized = blockers.trim().toLowerCase();
+    return normalized.length > 0 && normalized !== "none" && normalized !== "n/a";
+  }
+  if (Array.isArray(blockers)) {
+    return blockers.some((entry) => {
+      if (typeof entry === "string") {
+        const normalized = entry.trim().toLowerCase();
+        return normalized.length > 0 && normalized !== "none" && normalized !== "n/a";
+      }
+      return entry != null;
+    });
+  }
+  if (typeof blockers === "object") {
+    return Object.keys(blockers).length > 0;
+  }
+  return Boolean(blockers);
+}
+function stringifyNextActions(value) {
+  if (value == null) {
+    return "";
+  }
+  if (typeof value === "string") {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => stringifyNextActions(entry)).join(`
+`);
+  }
+  return JSON.stringify(value);
+}
+function nextActionsIndicateRemainingScope(content) {
+  const normalized = content.trim();
+  if (!normalized) {
+    return false;
+  }
+  const lower = normalized.toLowerCase();
+  if (/^(#\s*)?next actions\s*\n+\s*(none|n\/a|no remaining scope)\.?\s*$/i.test(normalized)) {
+    return false;
+  }
+  return /^\s*- \[ \]/m.test(normalized) || /\b(remaining scope|still need|needs? to be implemented|not yet implemented|not implemented|follow[- ]?up required|blocked by|blocker:)\b/i.test(lower);
+}
+async function hasConfiguredSourceTask(projectRoot, taskId) {
+  return readConfiguredTaskSourceTask(projectRoot, taskId).then((result) => result.task !== null).catch(() => false);
+}
+function resolveGithubSourceIssueId(projectRoot, taskId) {
+  const fromRuntime = loadRuntimeContextFromEnv()?.sourceTask?.sourceIssueId;
+  if (typeof fromRuntime === "string" && isGithubSourceIssueId(fromRuntime)) {
+    return fromRuntime;
+  }
+  try {
+    const taskConfig = readTaskConfig(projectRoot);
+    const entry = taskConfig[taskId];
+    const sourceIssueId = typeof entry?.sourceIssueId === "string" ? entry.sourceIssueId : typeof entry?.source_issue_id === "string" ? entry.source_issue_id : null;
+    if (sourceIssueId && isGithubSourceIssueId(sourceIssueId)) {
+      return sourceIssueId;
+    }
+    const rig = entry?._rig;
+    if (rig && typeof rig === "object" && !Array.isArray(rig)) {
+      const rigRecord = rig;
+      const rigSourceIssueId = typeof rigRecord.sourceIssueId === "string" ? rigRecord.sourceIssueId : null;
+      if (rigSourceIssueId && isGithubSourceIssueId(rigSourceIssueId)) {
+        return rigSourceIssueId;
+      }
+    }
+  } catch {}
+  return null;
+}
+function isGithubSourceIssueId(value) {
+  return /^[^/\s]+\/[^#\s]+#\d+$/.test(value.trim());
+}
+function evaluateGithubSourceIssuePrCloseout(projectRoot, prStates, sourceIssueId) {
+  const issueNumber = sourceIssueId.match(/#(\d+)$/)?.[1];
+  if (!issueNumber) {
+    return [`[Source Issue] GitHub issue task ${sourceIssueId} has an invalid source issue id.`];
+  }
+  if (prStates.length === 0) {
+    return [
+      `[Source Issue] GitHub issue task ${sourceIssueId} must have an open, green, mergeable PR with resolved review feedback and closeout intent (for example "Closes #${issueNumber}"). Source issue closure or merge is not required before completion.`
+    ];
+  }
+  const rejectionReasons = [];
+  for (const prState of prStates) {
+    const hydratedPr = hydratePrCloseoutState(projectRoot, prState);
+    const prReasons = evaluateSinglePrSourceIssueCloseout(hydratedPr, sourceIssueId, issueNumber);
+    if (prReasons.length === 0) {
+      return [];
+    }
+    rejectionReasons.push(...prReasons);
+  }
+  return uniqueStrings(rejectionReasons);
+}
+function hydratePrCloseoutState(projectRoot, prState) {
+  if (hasLocalPrCloseoutEvidence(prState)) {
+    return prState;
+  }
+  const snapshot = loadGithubPullRequestCloseoutSnapshot(projectRoot, prState);
+  return snapshot ? { ...prState, ...snapshot } : prState;
+}
+function hasLocalPrCloseoutEvidence(prState) {
+  const hasCloseoutText = typeof prState.title === "string" || typeof prState.body === "string" || Array.isArray(prState.closingIssues) && prState.closingIssues.length > 0;
+  return hasCloseoutText && typeof prState.state === "string" && typeof prState.isDraft === "boolean" && typeof prState.mergeable === "string" && typeof prState.mergeStateStatus === "string" && typeof prState.reviewDecision === "string" && Array.isArray(prState.statusCheckRollup) && Array.isArray(prState.reviewThreads);
+}
+function loadGithubPullRequestCloseoutSnapshot(projectRoot, prState) {
+  const prNumber = parsePullRequestNumber(prState.url || "");
+  if (!prNumber) {
+    return null;
+  }
+  try {
+    const repoName = deriveRepoName(projectRoot, prState);
+    if (!repoName) {
+      return null;
+    }
+    const view = runGhJson(projectRoot, [
+      "pr",
+      "view",
+      `${prNumber}`,
+      "--repo",
+      repoName,
+      "--json",
+      "state,isDraft,mergeable,mergeStateStatus,reviewDecision,title,body,statusCheckRollup"
+    ]);
+    return {
+      state: stringField(view, "state"),
+      isDraft: booleanField(view, "isDraft"),
+      mergeable: stringField(view, "mergeable"),
+      mergeStateStatus: stringField(view, "mergeStateStatus"),
+      reviewDecision: stringField(view, "reviewDecision"),
+      title: stringField(view, "title"),
+      body: stringField(view, "body"),
+      statusCheckRollup: statusCheckRollupField(view, "statusCheckRollup"),
+      reviewThreads: loadGithubReviewThreads(projectRoot, repoName, prNumber)
+    };
+  } catch {
+    return null;
+  }
+}
+function evaluateSinglePrSourceIssueCloseout(prState, sourceIssueId, issueNumber) {
+  const prLabel = prState.url || prState.branch || "recorded PR";
+  const reasons = [];
+  if (!prStateClosesIssue(prState, sourceIssueId, issueNumber)) {
+    reasons.push(`[Source Issue] GitHub issue task ${sourceIssueId} must have PR closeout intent (for example "Closes #${issueNumber}"). "Closes part of #N" is not sufficient.`);
+  }
+  const state = (prState.state || "").toUpperCase();
+  if (state !== "OPEN") {
+    reasons.push(`[Source Issue] PR ${prLabel} must be open before operator-controlled merge; current state is ${prState.state || "unknown"}.`);
+  }
+  if (prState.isDraft !== false) {
+    reasons.push(`[Source Issue] PR ${prLabel} must not be a draft.`);
+  }
+  const mergeable = (prState.mergeable || "").toUpperCase();
+  const mergeStateStatus = (prState.mergeStateStatus || "").toUpperCase();
+  if (mergeable !== "MERGEABLE" || mergeStateStatus === "DIRTY" || mergeStateStatus === "BLOCKED") {
+    reasons.push(`[Source Issue] PR ${prLabel} must be mergeable before completion (mergeable=${prState.mergeable || "unknown"}, mergeStateStatus=${prState.mergeStateStatus || "unknown"}).`);
+  }
+  reasons.push(...evaluateSourceCloseoutChecks(prState, prLabel));
+  reasons.push(...evaluateSourceCloseoutReviewState(prState, prLabel));
+  return reasons;
+}
+function evaluateSourceCloseoutChecks(prState, prLabel) {
+  const checks = prState.statusCheckRollup;
+  if (!Array.isArray(checks) || checks.length === 0) {
+    return [`[Source Issue] PR ${prLabel} must have green check evidence before completion.`];
+  }
+  const ciGate = evaluatePullRequestCiChecks(checks, "PR", 0);
+  if (ciGate.verdict === "APPROVE") {
+    return [];
+  }
+  return ciGate.reasons.map((reason) => reason.replace("PR#0", prLabel));
+}
+function evaluateSourceCloseoutReviewState(prState, prLabel) {
+  const reasons = [];
+  const reviewDecision = (prState.reviewDecision || "").toUpperCase();
+  if (reviewDecision === "REVIEW_REQUIRED" || reviewDecision === "CHANGES_REQUESTED") {
+    reasons.push(`[Source Issue] PR ${prLabel} required review is unresolved (${prState.reviewDecision}).`);
+  }
+  if (!Array.isArray(prState.reviewThreads)) {
+    reasons.push(`[Source Issue] PR ${prLabel} review thread resolution could not be verified.`);
+    return reasons;
+  }
+  for (const comment of filterUnresolvedReviewThreadComments(prState.reviewThreads)) {
+    reasons.push(`[Source Issue] PR ${prLabel} has unresolved review thread on ${comment.path || "unknown path"}: ${summarizeComment(comment.body || "")}`);
+  }
+  return reasons;
+}
+function filterUnresolvedReviewThreadComments(threads) {
+  const comments = [];
+  for (const thread of threads) {
+    if (thread.isResolved === true || thread.isOutdated === true) {
+      continue;
+    }
+    const threadComments = thread.comments?.nodes ?? [];
+    if (threadComments.length === 0) {
+      comments.push({ body: "Unresolved review thread" });
+      continue;
+    }
+    comments.push(threadComments[threadComments.length - 1]);
+  }
+  return comments;
+}
+function stringField(record, key) {
+  const value = record[key];
+  return typeof value === "string" ? value : undefined;
+}
+function booleanField(record, key) {
+  const value = record[key];
+  return typeof value === "boolean" ? value : undefined;
+}
+function statusCheckRollupField(record, key) {
+  const value = record[key];
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.filter(isGithubStatusCheckRollupItem);
+}
+function isGithubStatusCheckRollupItem(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function uniqueStrings(values) {
+  return Array.from(new Set(values));
+}
+function prStateClosesIssue(pr, sourceIssueId, issueNumber) {
+  const closingIssues = pr.closingIssues ?? [];
+  if (closingIssues.some((issue) => closingIssueMatches(issue, sourceIssueId, issueNumber))) {
+    return true;
+  }
+  const text = [pr.title, pr.body].filter((value) => typeof value === "string").join(`
+`);
+  return prTextClosesIssue(text, issueNumber);
+}
+function closingIssueMatches(issue, sourceIssueId, issueNumber) {
+  if (typeof issue === "number") {
+    return String(issue) === issueNumber;
+  }
+  if (typeof issue === "string") {
+    return issue === sourceIssueId || issue.replace(/^#/, "") === issueNumber;
+  }
+  return String(issue.number ?? "") === issueNumber || issue.id === issueNumber || issue.sourceIssueId === sourceIssueId;
+}
+function prTextClosesIssue(text, issueNumber) {
+  if (!text.trim()) {
+    return false;
+  }
+  const escaped = issueNumber.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const closePattern = new RegExp(`\\b(close[sd]?|fix(e[sd])?|resolve[sd]?)\\s+#${escaped}\\b`, "i");
+  return closePattern.test(text);
+}
+async function parseValidationSummary(path) {
+  return readJsonFile2(path);
+}
+function isAcceptedValidationSummary(summary) {
+  if (!summary) {
+    return false;
+  }
+  if (summary.status === "pass") {
+    return true;
+  }
+  return summary.status === "skipped" && summary.total === 0 && summary.failed === 0;
+}
+async function loadReviewMode(reviewProfilePath, fallback) {
+  const parsed = existsSync11(reviewProfilePath) ? await readJsonFile2(reviewProfilePath) : null;
+  const mode = parsed?.mode;
+  if (mode === "off" || mode === "advisory" || mode === "required") {
+    return mode;
+  }
+  if (fallback === "off" || fallback === "advisory" || fallback === "required") {
+    return fallback;
+  }
+  return "advisory";
+}
+async function loadReviewProvider(reviewProfilePath, fallback) {
+  const parsed = existsSync11(reviewProfilePath) ? await readJsonFile2(reviewProfilePath) : null;
+  const provider = parsed?.provider;
+  if (typeof provider === "string" && provider.trim().length > 0) {
+    return provider;
+  }
+  return fallback || "greptile";
+}
+function resolveRepoSlug(projectRoot) {
+  const paths = resolveHarnessPaths(projectRoot);
+  const remote = runCapture(["git", "-C", paths.monorepoRoot, "remote", "get-url", "origin"], projectRoot).stdout.trim() || runCapture(["git", "-C", projectRoot, "remote", "get-url", "origin"], projectRoot).stdout.trim();
+  if (!remote) {
+    return "";
+  }
+  if (remote.startsWith("git@")) {
+    return remote.split(":")[1]?.replace(/\.git$/, "") || "";
+  }
+  const cleaned = remote.replace(/^https?:\/\//, "").replace(/\.git$/, "");
+  const slash = cleaned.indexOf("/");
+  return slash >= 0 ? cleaned.slice(slash + 1) : cleaned;
+}
+async function runGreptileReview(options) {
+  const reasons = [];
+  const warnings = [];
+  const secrets = resolveRuntimeSecrets(process.env);
+  const apiKey = secrets.GREPTILE_API_KEY || "";
+  const apiBase = secrets.GREPTILE_API_BASE || "https://api.greptile.com/mcp";
+  const remote = secrets.GREPTILE_REMOTE || "github";
+  const greptileDefaultBranch = secrets.GREPTILE_DEFAULT_BRANCH || "main";
+  const { pollAttempts, pollIntervalMs } = resolveGreptilePollSettings({
+    reviewMode: options.reviewMode,
+    secrets
+  });
+  if (!apiKey) {
+    reasons.push("[AI Review] Missing GREPTILE_API_KEY.");
+    return { verdict: "SKIP", feedback: "", reasons, warnings, rawResponse: "" };
+  }
+  if (options.prStates.length === 0) {
+    reasons.push("[AI Review] Missing pr-state.json or no PRs were recorded for review.");
+    return { verdict: "SKIP", feedback: "", reasons, warnings, rawResponse: "" };
+  }
+  const perPrResults = [];
+  for (const prState of options.prStates) {
+    try {
+      const prResult = await runGreptileReviewForPr({
+        apiBase,
+        apiKey,
+        remote,
+        defaultBranch: greptileDefaultBranch,
+        projectRoot: options.projectRoot,
+        taskId: options.taskId,
+        prState,
+        reviewMode: options.reviewMode,
+        pollAttempts,
+        pollIntervalMs
+      });
+      if (prResult.verdict === "SKIP") {
+        warnings.push(...prResult.reasons.map(asGreptileInfrastructureWarning));
+      } else {
+        reasons.push(...prResult.reasons);
+      }
+      warnings.push(...prResult.warnings);
+      perPrResults.push(prResult);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const fallback = await runGithubGreptileFallbackReviewForPr({
+        projectRoot: options.projectRoot,
+        taskId: options.taskId,
+        prState,
+        reviewMode: options.reviewMode,
+        infrastructureError: message,
+        pollAttempts,
+        pollIntervalMs
+      }).catch(() => null);
+      if (fallback) {
+        if (fallback.verdict === "SKIP") {
+          warnings.push(...fallback.reasons.map(asGreptileInfrastructureWarning));
+        } else {
+          reasons.push(...fallback.reasons);
+        }
+        warnings.push(...fallback.warnings);
+        perPrResults.push(fallback);
+        continue;
+      }
+      warnings.push(asGreptileInfrastructureWarning(`Greptile infrastructure failure for ${prState.url || prState.branch || options.taskId}: ${message}`));
+      perPrResults.push({
+        verdict: "SKIP",
+        feedback: "",
+        reasons: [],
+        warnings: [],
+        rawPayload: { pr: prState, error: message }
+      });
+    }
+  }
+  if (perPrResults.some((result) => result.verdict === "REJECT")) {
+    return {
+      verdict: "REJECT",
+      feedback: perPrResults.map((result) => result.feedback).filter(Boolean).join(`
+
+`),
+      reasons,
+      warnings,
+      rawResponse: JSON.stringify(perPrResults.map((result) => result.rawPayload), null, 2)
+    };
+  }
+  if (perPrResults.every((result) => result.verdict === "APPROVE")) {
+    return {
+      verdict: "APPROVE",
+      feedback: perPrResults.map((result) => result.feedback).filter(Boolean).join(`
+
+`),
+      reasons,
+      warnings,
+      rawResponse: JSON.stringify(perPrResults.map((result) => result.rawPayload), null, 2)
+    };
+  }
+  return {
+    verdict: "SKIP",
+    feedback: perPrResults.map((result) => result.feedback).filter(Boolean).join(`
+
+`),
+    reasons,
+    warnings,
+    rawResponse: JSON.stringify(perPrResults.map((result) => result.rawPayload), null, 2)
+  };
+}
+function writeFeedbackFile(options) {
+  const lines = [
+    "# AI Review Feedback",
+    "",
+    `- Task: ${options.taskId}`,
+    `- Provider: ${options.provider}`,
+    `- Mode: ${options.mode}`,
+    `- Verdict: ${options.verdict}`,
+    ""
+  ];
+  if (options.localReasons.length > 0) {
+    lines.push("## Local Rejection Reasons", "");
+    for (const reason of options.localReasons) {
+      lines.push(`- ${reason}`);
+    }
+    lines.push("");
+  }
+  if (options.aiReasons.length > 0) {
+    lines.push("## AI Rejection Reasons", "");
+    for (const reason of options.aiReasons) {
+      lines.push(`- ${reason}`);
+    }
+    lines.push("");
+  }
+  if (options.aiWarnings.length > 0) {
+    lines.push("## AI Warnings", "");
+    for (const warning of options.aiWarnings) {
+      lines.push(`- ${warning}`);
+    }
+    lines.push("");
+  }
+  if (options.aiRawFeedback) {
+    lines.push("## Raw Reviewer Feedback", "", "```text", options.aiRawFeedback, "```", "");
+  }
+  writeFileSync6(options.output, `${lines.join(`
+`)}
+`, "utf-8");
+}
+function writeReviewStateFile(options) {
+  const payload = {
+    task_id: options.taskId,
+    approved: options.approved,
+    provider: options.provider,
+    mode: options.mode,
+    verdict: options.verdict,
+    pr: options.prState,
+    local_reasons: options.localReasons,
+    ai_reasons: options.aiReasons,
+    ai_warnings: options.aiWarnings,
+    updated_at: nowIso()
+  };
+  writeFileSync6(options.output, `${JSON.stringify(payload, null, 2)}
+`, "utf-8");
+}
+async function runGreptileReviewForPr(options) {
+  const reasons = [];
+  const warnings = [];
+  const repoName = deriveRepoName(options.projectRoot, options.prState);
+  const prNumber = parsePullRequestNumber(options.prState.url || "");
+  const defaultBranch = options.defaultBranch;
+  const expectedHeadSha = resolvePrHeadSha(options.projectRoot, options.prState);
+  if (!repoName) {
+    reasons.push(`[AI Review] Could not resolve repository slug for ${options.prState.repoLabel || options.prState.target || "PR"}.`);
+    return { verdict: "SKIP", feedback: "", reasons, warnings, rawPayload: { pr: options.prState } };
+  }
+  if (!prNumber) {
+    reasons.push(`[AI Review] Could not parse PR number from ${options.prState.url || "missing PR URL"}.`);
+    return { verdict: "SKIP", feedback: "", reasons, warnings, rawPayload: { pr: options.prState } };
+  }
+  const githubPrState = loadGithubPullRequestState(options.projectRoot, repoName, prNumber);
+  if (shouldPreferGithubGreptileFallback(githubPrState)) {
+    return runGithubGreptileFallbackReviewForPr({
+      projectRoot: options.projectRoot,
+      taskId: options.taskId,
+      prState: options.prState,
+      reviewMode: options.reviewMode,
+      infrastructureError: undefined,
+      pollAttempts: options.pollAttempts,
+      pollIntervalMs: options.pollIntervalMs
+    });
+  }
+  const initialReviewsPayload = await callGreptileMcpToolJson(options.apiBase, options.apiKey, "list_code_reviews", {
+    name: repoName,
+    remote: options.remote,
+    defaultBranch,
+    prNumber,
+    limit: 20
+  });
+  const existingReview = findGreptileReviewForHeadSha(initialReviewsPayload.codeReviews || [], expectedHeadSha);
+  const shouldTrigger = shouldTriggerGreptileReview(existingReview, expectedHeadSha);
+  let triggerStartedAt = Date.now();
+  if (shouldTrigger) {
+    triggerStartedAt = Date.now();
+    await callGreptileMcpTool(options.apiBase, options.apiKey, "trigger_code_review", {
+      name: repoName,
+      remote: options.remote,
+      defaultBranch,
+      branch: options.prState.branch,
+      prNumber
+    }).catch((error) => {
+      throw new Error(`Greptile trigger failed for ${repoName}#${prNumber}: ${error instanceof Error ? error.message : String(error)}`);
+    });
+  } else {
+    const existingCreatedAt = Date.parse(existingReview?.createdAt || "");
+    triggerStartedAt = Number.isFinite(existingCreatedAt) ? existingCreatedAt : Date.now();
+  }
+  let selectedReview = null;
+  let reviewsPayload = initialReviewsPayload;
+  let githubCheckRollup = [];
+  let githubCheckState = { pending: false, completed: false };
+  for (let attempt = 0;; attempt += 1) {
+    const listPayload = attempt === 0 ? initialReviewsPayload : await callGreptileMcpToolJson(options.apiBase, options.apiKey, "list_code_reviews", {
+      name: repoName,
+      remote: options.remote,
+      defaultBranch,
+      prNumber,
+      limit: 20
+    });
+    reviewsPayload = listPayload;
+    selectedReview = pickRelevantCodeReview(listPayload.codeReviews || [], triggerStartedAt, expectedHeadSha);
+    githubCheckRollup = loadGithubPullRequestCheckRollup(options.projectRoot, repoName, prNumber);
+    githubCheckState = classifyGithubGreptileCheckState(githubCheckRollup);
+    if (!shouldContinueGreptileMcpPolling({
+      attempt,
+      pollAttempts: options.pollAttempts,
+      githubCheckState,
+      selectedReview
+    })) {
+      break;
+    }
+    await Bun.sleep(options.pollIntervalMs);
+  }
+  const ciGate = evaluatePullRequestCiChecks(githubCheckRollup, repoName, prNumber);
+  if (ciGate.verdict !== "APPROVE") {
+    return {
+      verdict: ciGate.verdict,
+      feedback: "",
+      reasons: ciGate.reasons,
+      warnings,
+      rawPayload: { pr: options.prState, codeReviews: reviewsPayload, checkRollup: githubCheckRollup }
+    };
+  }
+  if (!selectedReview) {
+    reasons.push(`[AI Review] Greptile did not produce a review for ${repoName}#${prNumber}.`);
+    return {
+      verdict: "SKIP",
+      feedback: "",
+      reasons,
+      warnings,
+      rawPayload: { pr: options.prState, codeReviews: reviewsPayload }
+    };
+  }
+  if (selectedReview.status === "FAILED") {
+    reasons.push(`[AI Review] Greptile review failed for ${repoName}#${prNumber}.`);
+    return {
+      verdict: "SKIP",
+      feedback: "",
+      reasons,
+      warnings,
+      rawPayload: { pr: options.prState, codeReviews: reviewsPayload, selectedReview }
+    };
+  }
+  if (selectedReview.status === "SKIPPED") {
+    reasons.push(`[AI Review] Greptile skipped review for ${repoName}#${prNumber}.`);
+    return {
+      verdict: "SKIP",
+      feedback: "",
+      reasons,
+      warnings,
+      rawPayload: { pr: options.prState, codeReviews: reviewsPayload, selectedReview }
+    };
+  }
+  if (selectedReview.status !== "COMPLETED") {
+    if (githubCheckState.completed) {
+      return runGithubGreptileFallbackReviewForPr({
+        projectRoot: options.projectRoot,
+        taskId: options.taskId,
+        prState: options.prState,
+        reviewMode: options.reviewMode,
+        infrastructureError: `Greptile MCP review stayed ${selectedReview.status} after the GitHub Greptile check completed.`,
+        pollAttempts: options.pollAttempts,
+        pollIntervalMs: options.pollIntervalMs
+      });
+    }
+    reasons.push(`[AI Review] Greptile review for ${repoName}#${prNumber} did not finish before timeout (last status: ${selectedReview.status}).`);
+    return {
+      verdict: "SKIP",
+      feedback: "",
+      reasons,
+      warnings,
+      rawPayload: { pr: options.prState, codeReviews: reviewsPayload, selectedReview }
+    };
+  }
+  const reviewDetails = await callGreptileMcpToolJson(options.apiBase, options.apiKey, "get_code_review", { codeReviewId: selectedReview.id });
+  const commentsPayload = await callGreptileMcpToolJson(options.apiBase, options.apiKey, "list_merge_request_comments", {
+    name: repoName,
+    remote: options.remote,
+    defaultBranch,
+    prNumber,
+    greptileGenerated: true,
+    createdAfter: selectedReview.createdAt
+  });
+  const actionableComments = filterActionableGreptileComments(commentsPayload.comments || []);
+  const reviewBody = reviewDetails.codeReview?.body || "";
+  const score = parseGreptileScore(reviewBody);
+  const feedback = [
+    `## ${options.prState.repoLabel || repoName} PR Review`,
+    "",
+    `- PR: ${options.prState.url || `${repoName}#${prNumber}`}`,
+    `- Review ID: ${selectedReview.id}`,
+    `- Status: ${selectedReview.status}`,
+    "",
+    reviewBody ? stripHtml(reviewBody).trim() : "Greptile completed without summary body."
+  ].filter(Boolean).join(`
+`);
+  if (actionableComments.length > 0) {
+    for (const comment of actionableComments) {
+      reasons.push(`[AI Review] ${repoName}#${prNumber} has unresolved Greptile comment on ${comment.filePath}: ${summarizeComment(comment.body || "")}`);
+    }
+    return {
+      verdict: "REJECT",
+      feedback,
+      reasons,
+      warnings,
+      rawPayload: {
+        pr: options.prState,
+        codeReviews: reviewsPayload,
+        selectedReview,
+        reviewDetails,
+        comments: commentsPayload
+      }
+    };
+  }
+  if (/not safe to merge|unsafe to merge|do not merge|blocker/i.test(reviewBody)) {
+    reasons.push(`[AI Review] ${repoName}#${prNumber} summary indicates the PR is not safe to merge.`);
+    return {
+      verdict: "REJECT",
+      feedback,
+      reasons,
+      warnings,
+      rawPayload: {
+        pr: options.prState,
+        codeReviews: reviewsPayload,
+        selectedReview,
+        reviewDetails,
+        comments: commentsPayload
+      }
+    };
+  }
+  if (score) {
+    if (score.scale === 5 && score.value < 5 && options.reviewMode === "required") {
+      reasons.push(`[AI Review] ${repoName}#${prNumber} completed with Greptile confidence ${score.value}/${score.scale}; required mode needs 5/5 before merge.`);
+      return {
+        verdict: "REJECT",
+        feedback,
+        reasons,
+        warnings,
+        rawPayload: {
+          pr: options.prState,
+          codeReviews: reviewsPayload,
+          selectedReview,
+          reviewDetails,
+          comments: commentsPayload,
+          score
+        }
+      };
+    }
+    if (score.scale === 5 && score.value <= 2) {
+      reasons.push(`[AI Review] ${repoName}#${prNumber} completed with Greptile confidence ${score.value}/${score.scale}; this requires rework before merge.`);
+      return {
+        verdict: "REJECT",
+        feedback,
+        reasons,
+        warnings,
+        rawPayload: {
+          pr: options.prState,
+          codeReviews: reviewsPayload,
+          selectedReview,
+          reviewDetails,
+          comments: commentsPayload,
+          score
+        }
+      };
+    }
+    if (score.scale === 5 && score.value < 5) {
+      warnings.push(`[AI Review] ${repoName}#${prNumber} completed with Greptile confidence ${score.value}/${score.scale}; continue only after reviewing remaining risk.`);
+    }
+  }
+  return {
+    verdict: "APPROVE",
+    feedback,
+    reasons,
+    warnings,
+    rawPayload: {
+      pr: options.prState,
+      codeReviews: reviewsPayload,
+      selectedReview,
+      reviewDetails,
+      comments: commentsPayload
+    }
+  };
+}
+async function runGithubGreptileFallbackReviewForPr(options) {
+  const repoName = deriveRepoName(options.projectRoot, options.prState);
+  const prNumber = parsePullRequestNumber(options.prState.url || "");
+  const expectedHeadSha = resolvePrHeadSha(options.projectRoot, options.prState);
+  if (!repoName || !prNumber) {
+    return {
+      verdict: "SKIP",
+      feedback: "",
+      reasons: [],
+      warnings: buildGithubGreptileFallbackWarnings(options),
+      rawPayload: buildGithubGreptileFallbackRawPayload(options)
+    };
+  }
+  let reviews = [];
+  let selectedReview = null;
+  let latestReview = null;
+  let fallbackReview = null;
+  let threads = [];
+  let actionableThreads = [];
+  let checkRollup = [];
+  let checkState = { pending: false, completed: false };
+  for (let attempt = 0;; attempt += 1) {
+    reviews = runGhJson(options.projectRoot, ["api", `repos/${repoName}/pulls/${prNumber}/reviews`]);
+    selectedReview = pickRelevantGithubGreptileReview(reviews, expectedHeadSha);
+    latestReview = pickLatestGithubGreptileReview(reviews);
+    fallbackReview = selectedReview ?? latestReview;
+    threads = loadGithubReviewThreads(options.projectRoot, repoName, prNumber);
+    actionableThreads = filterActionableGithubGreptileThreads(threads);
+    checkRollup = loadGithubPullRequestCheckRollup(options.projectRoot, repoName, prNumber);
+    checkState = classifyGithubGreptileCheckState(checkRollup);
+    const approvedViaReviewedAncestor2 = !selectedReview && !!fallbackReview?.commit_id && !!expectedHeadSha && isCommitAncestorOfPrHead(options.projectRoot, options.prState, fallbackReview.commit_id, expectedHeadSha);
+    if (!shouldContinueGithubGreptileFallbackPolling({
+      attempt,
+      pollAttempts: options.pollAttempts,
+      checkState,
+      fallbackReview,
+      selectedReview,
+      approvedViaReviewedAncestor: approvedViaReviewedAncestor2
+    })) {
+      break;
+    }
+    await Bun.sleep(options.pollIntervalMs);
+  }
+  const ciGate = evaluatePullRequestCiChecks(checkRollup, repoName, prNumber);
+  if (ciGate.verdict !== "APPROVE") {
+    return {
+      verdict: ciGate.verdict,
+      feedback: "",
+      reasons: ciGate.reasons,
+      warnings: buildGithubGreptileFallbackWarnings(options),
+      rawPayload: { ...buildGithubGreptileFallbackRawPayload(options), reviews, threads, checkRollup }
+    };
+  }
+  const feedback = [
+    `## ${options.prState.repoLabel || repoName} PR Review`,
+    "",
+    `- PR: ${options.prState.url || `${repoName}#${prNumber}`}`,
+    "- Source: GitHub Greptile fallback",
+    fallbackReview?.html_url ? `- Review: ${fallbackReview.html_url}` : "",
+    fallbackReview?.state ? `- Status: ${fallbackReview.state}` : "",
+    "",
+    fallbackReview?.body?.trim() ? stripHtml(fallbackReview.body).trim() : "Greptile MCP was unavailable, so verification used GitHub review threads instead."
+  ].filter(Boolean).join(`
+`);
+  const warnings = buildGithubGreptileFallbackWarnings(options);
+  if (checkState.pending) {
+    return {
+      verdict: "SKIP",
+      feedback,
+      reasons: [
+        `[AI Review] Greptile GitHub review for ${repoName}#${prNumber} is still in progress.`
+      ],
+      warnings,
+      rawPayload: { ...buildGithubGreptileFallbackRawPayload(options), reviews, threads, checkRollup }
+    };
+  }
+  const approvedViaCompletedCheck = isGithubGreptileCheckApproved(checkRollup);
+  if (!fallbackReview) {
+    if (approvedViaCompletedCheck) {
+      warnings.push(`[AI Review Warning] ${repoName}#${prNumber} has no GitHub Greptile review object, but the Greptile check completed successfully and no unresolved Greptile threads remain.`);
+      return {
+        verdict: "APPROVE",
+        feedback,
+        reasons: [],
+        warnings,
+        rawPayload: { ...buildGithubGreptileFallbackRawPayload(options), reviews, threads, checkRollup }
+      };
+    }
+    return {
+      verdict: "SKIP",
+      feedback,
+      reasons: [
+        `[AI Review] Greptile GitHub review for ${repoName}#${prNumber} is not available.`
+      ],
+      warnings,
+      rawPayload: { ...buildGithubGreptileFallbackRawPayload(options), reviews, threads, checkRollup }
+    };
+  }
+  const approvedViaReviewedAncestor = !selectedReview && !!fallbackReview.commit_id && !!expectedHeadSha && isCommitAncestorOfPrHead(options.projectRoot, options.prState, fallbackReview.commit_id, expectedHeadSha);
+  if (actionableThreads.length > 0) {
+    return {
+      verdict: "REJECT",
+      feedback,
+      reasons: actionableThreads.map((comment) => `[AI Review] ${repoName}#${prNumber} has unresolved Greptile comment on ${comment.path}: ${summarizeComment(comment.body || "")}`),
+      warnings,
+      rawPayload: {
+        pr: options.prState,
+        selectedReview: fallbackReview,
+        reviews,
+        threads,
+        checkRollup,
+        actionableThreads,
+        ...buildGithubGreptileFallbackRawPayload(options)
+      }
+    };
+  }
+  if (!selectedReview && !approvedViaReviewedAncestor) {
+    if (approvedViaCompletedCheck) {
+      warnings.push(`[AI Review Warning] ${repoName}#${prNumber} has no fresh Greptile GitHub review on the current head, but the Greptile check completed successfully and all Greptile threads are resolved.`);
+      return {
+        verdict: "APPROVE",
+        feedback,
+        reasons: [],
+        warnings,
+        rawPayload: {
+          pr: options.prState,
+          selectedReview: fallbackReview,
+          reviews,
+          threads,
+          checkRollup,
+          ...buildGithubGreptileFallbackRawPayload(options)
+        }
+      };
+    }
+    return {
+      verdict: "SKIP",
+      feedback,
+      reasons: [
+        `[AI Review] Greptile GitHub review for ${repoName}#${prNumber} is not available for the current head.`
+      ],
+      warnings,
+      rawPayload: {
+        pr: options.prState,
+        selectedReview: fallbackReview,
+        reviews,
+        threads,
+        checkRollup,
+        ...buildGithubGreptileFallbackRawPayload(options)
+      }
+    };
+  }
+  if (approvedViaReviewedAncestor) {
+    warnings.push(`[AI Review Warning] ${repoName}#${prNumber} has no fresh Greptile review on the current head, but the latest reviewed commit is an ancestor and all Greptile threads are resolved.`);
+  }
+  return {
+    verdict: "APPROVE",
+    feedback,
+    reasons: [],
+    warnings,
+    rawPayload: {
+      pr: options.prState,
+      selectedReview: fallbackReview,
+      reviews,
+      threads,
+      checkRollup,
+      ...buildGithubGreptileFallbackRawPayload(options)
+    }
+  };
+}
+function buildGithubGreptileFallbackWarnings(options) {
+  if (!options.infrastructureError?.trim()) {
+    return [];
+  }
+  return [
+    asGreptileInfrastructureWarning(`Greptile infrastructure failure for ${options.prState.url || options.prState.branch || options.taskId}: ${options.infrastructureError}`)
+  ];
+}
+function buildGithubGreptileFallbackRawPayload(options) {
+  return options.infrastructureError?.trim() ? { pr: options.prState, error: options.infrastructureError } : { pr: options.prState };
+}
+async function callGreptileMcpTool(apiBase, apiKey, name, args) {
+  return callGreptileMcpToolWithTimeout(apiBase, apiKey, name, args, resolveGreptileRequestTimeoutMs(process.env.GREPTILE_REQUEST_TIMEOUT_MS));
+}
+async function callGreptileMcpToolWithTimeout(apiBase, apiKey, name, args, timeoutMs) {
+  const controller = new AbortController;
+  const timeoutId = setTimeout(() => {
+    controller.abort(new Error(`Greptile MCP tool ${name} timed out after ${timeoutMs}ms.`));
+  }, timeoutMs);
+  let response;
+  try {
+    response = await fetch(apiBase, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: `rig-${name}-${Date.now()}`,
+        method: "tools/call",
+        params: { name, arguments: args }
+      }),
+      signal: controller.signal
+    });
+  } catch (error) {
+    if (controller.signal.aborted) {
+      throw controller.signal.reason instanceof Error ? controller.signal.reason : new Error(`Greptile MCP tool ${name} timed out after ${timeoutMs}ms.`);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeoutId);
+  }
+  const raw = await response.text();
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status}: ${raw}`);
+  }
+  let envelope;
+  try {
+    envelope = JSON.parse(raw);
+  } catch {
+    throw new Error(`Malformed MCP response: ${raw}`);
+  }
+  if (envelope.error?.message) {
+    throw new Error(envelope.error.message);
+  }
+  const text = (envelope.result?.content || []).filter((item) => item.type === "text" && typeof item.text === "string").map((item) => item.text || "").join(`
+`).trim();
+  if (!text) {
+    throw new Error(`MCP tool ${name} returned no text payload.`);
+  }
+  return text;
+}
+function resolveGreptileRequestTimeoutMs(rawValue) {
+  const DEFAULT_GREPTILE_REQUEST_TIMEOUT_MS = 30000;
+  const parsed = Number.parseInt(rawValue || `${DEFAULT_GREPTILE_REQUEST_TIMEOUT_MS}`, 10);
+  return Number.isFinite(parsed) && parsed >= 1000 ? parsed : DEFAULT_GREPTILE_REQUEST_TIMEOUT_MS;
+}
+async function callGreptileMcpToolJson(apiBase, apiKey, name, args) {
+  const text = await callGreptileMcpTool(apiBase, apiKey, name, args);
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`MCP tool ${name} returned malformed JSON: ${text}`);
+  }
+}
+function pickRelevantCodeReview(reviews, triggerStartedAt, expectedHeadSha) {
+  const normalized = [...reviews].sort((a, b) => Date.parse(b.createdAt || "") - Date.parse(a.createdAt || ""));
+  const exactSha = normalized.find((review) => expectedHeadSha && review.metadata?.checkHeadSha === expectedHeadSha);
+  if (exactSha) {
+    return exactSha;
+  }
+  const triggered = normalized.find((review) => Date.parse(review.createdAt || "") >= triggerStartedAt - 1000);
+  return triggered || normalized[0] || null;
+}
+function filterActionableGreptileComments(comments) {
+  return comments.filter((comment) => comment.sourceType === "greptile" && typeof comment.filePath === "string" && comment.filePath.trim().length > 0 && comment.addressed === false);
+}
+function findGreptileReviewForHeadSha(reviews, expectedHeadSha) {
+  if (!expectedHeadSha) {
+    return null;
+  }
+  const normalized = [...reviews].sort((a, b) => Date.parse(b.createdAt || "") - Date.parse(a.createdAt || ""));
+  return normalized.find((review) => review.metadata?.checkHeadSha === expectedHeadSha) || null;
+}
+function isGreptileReviewTerminal(status) {
+  return status === "COMPLETED" || status === "FAILED" || status === "SKIPPED";
+}
+function shouldTriggerGreptileReview(existingReview, expectedHeadSha) {
+  if (!existingReview) {
+    return true;
+  }
+  if (!expectedHeadSha) {
+    return true;
+  }
+  if ((existingReview.metadata?.checkHeadSha || "") !== expectedHeadSha) {
+    return true;
+  }
+  return isGreptileReviewTerminal(existingReview.status);
+}
+function shouldContinueGreptileMcpPolling(options) {
+  if (options.githubCheckState.completed) {
+    return false;
+  }
+  if (options.selectedReview && !isGreptileReviewTerminal(options.selectedReview.status)) {
+    return true;
+  }
+  return options.attempt + 1 < options.pollAttempts;
+}
+function shouldContinueGithubGreptileFallbackPolling(options) {
+  const waitingForVisiblePendingReview = options.checkState.pending && (!options.fallbackReview || !options.selectedReview && !options.approvedViaReviewedAncestor);
+  if (waitingForVisiblePendingReview) {
+    return true;
+  }
+  const reviewNotVisibleYet = !options.fallbackReview && !options.checkState.pending && !options.checkState.completed;
+  if (reviewNotVisibleYet) {
+    return options.attempt + 1 < options.pollAttempts;
+  }
+  return false;
+}
+function resolveGreptilePollSettings(options) {
+  const DEFAULT_POLL_ATTEMPTS = 60;
+  const DEFAULT_POLL_INTERVAL_MS = 5000;
+  const REQUIRED_MODE_MIN_ATTEMPTS = 180;
+  const configuredAttempts = Number.parseInt(options.secrets.GREPTILE_POLL_ATTEMPTS || `${DEFAULT_POLL_ATTEMPTS}`, 10);
+  const configuredIntervalMs = Number.parseInt(options.secrets.GREPTILE_POLL_INTERVAL_MS || `${DEFAULT_POLL_INTERVAL_MS}`, 10);
+  const pollAttempts = Number.isFinite(configuredAttempts) && configuredAttempts > 0 ? configuredAttempts : DEFAULT_POLL_ATTEMPTS;
+  const pollIntervalMs = Number.isFinite(configuredIntervalMs) && configuredIntervalMs > 0 ? configuredIntervalMs : DEFAULT_POLL_INTERVAL_MS;
+  if (options.reviewMode !== "required") {
+    return { pollAttempts, pollIntervalMs };
+  }
+  return {
+    pollAttempts: Math.max(REQUIRED_MODE_MIN_ATTEMPTS, pollAttempts),
+    pollIntervalMs: Math.max(DEFAULT_POLL_INTERVAL_MS, pollIntervalMs)
+  };
+}
+function loadGithubPullRequestState(projectRoot, repoName, prNumber) {
+  const response = runGhJson(projectRoot, [
+    "api",
+    `repos/${repoName}/pulls/${prNumber}`
+  ]);
+  return {
+    state: response.state || "",
+    merged: response.merged,
+    merged_at: response.merged_at ?? null
+  };
+}
+function shouldPreferGithubGreptileFallback(prState) {
+  if ((prState?.state || "").toUpperCase() === "MERGED") {
+    return true;
+  }
+  if (prState?.merged === true) {
+    return true;
+  }
+  return typeof prState?.merged_at === "string" && prState.merged_at.trim().length > 0;
+}
+function parsePullRequestNumber(url) {
+  const match = /\/pull\/(\d+)(?:\/|$)/.exec(url);
+  return match ? Number.parseInt(match[1] || "0", 10) : 0;
+}
+function runGhJson(projectRoot, args) {
+  const result = runCapture(["gh", ...args], projectRoot);
+  if (result.exitCode !== 0) {
+    throw new Error(result.stderr || result.stdout || `gh ${args.join(" ")} failed`);
+  }
+  try {
+    return JSON.parse(result.stdout);
+  } catch {
+    throw new Error(`gh ${args.join(" ")} returned malformed JSON: ${result.stdout}`);
+  }
+}
+function deriveRepoName(projectRoot, prState) {
+  const fromUrl = /github\.com\/([^/]+\/[^/]+)\/pull\/\d+/.exec(prState.url || "");
+  if (fromUrl?.[1]) {
+    return fromUrl[1];
+  }
+  if (prState.target === "monorepo") {
+    return resolveRepoSlug(projectRoot);
+  }
+  return runCapture(["gh", "repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"], projectRoot).stdout.trim();
+}
+function resolvePrHeadSha(projectRoot, prState) {
+  const repoRoot = resolvePrRepoRoot(projectRoot, prState);
+  return runCapture(["git", "-C", repoRoot, "rev-parse", "HEAD"], projectRoot).stdout.trim();
+}
+function isGreptileGithubLogin(login) {
+  return (login || "").replace(/\[bot\]$/, "") === "greptile-apps";
+}
+function pickRelevantGithubGreptileReview(reviews, expectedHeadSha) {
+  const matching = sortGithubGreptileReviews(reviews);
+  if (expectedHeadSha) {
+    const exact = matching.find((review) => review.commit_id === expectedHeadSha);
+    if (exact) {
+      return exact;
+    }
+    return null;
+  }
+  return matching[0] || null;
+}
+function pickLatestGithubGreptileReview(reviews) {
+  return sortGithubGreptileReviews(reviews)[0] || null;
+}
+function sortGithubGreptileReviews(reviews) {
+  return reviews.filter((review) => isGreptileGithubLogin(review.user?.login)).sort((left, right) => Date.parse(right.submitted_at || "") - Date.parse(left.submitted_at || ""));
+}
+function loadGithubPullRequestCheckRollup(projectRoot, repoName, prNumber) {
+  const response = runGhJson(projectRoot, [
+    "pr",
+    "view",
+    `${prNumber}`,
+    "--repo",
+    repoName,
+    "--json",
+    "statusCheckRollup"
+  ]);
+  return response.statusCheckRollup || [];
+}
+function evaluatePullRequestCiChecks(checks, repoName, prNumber) {
+  const nonGreptileChecks = checks.filter((check) => {
+    const label = (check.name || check.context || "").toLowerCase();
+    return label.length > 0 && !label.includes("greptile");
+  });
+  const pending = nonGreptileChecks.filter((check) => {
+    if ((check.__typename || "") === "CheckRun") {
+      return (check.status || "").toUpperCase() !== "COMPLETED";
+    }
+    const state = (check.state || check.status || "").toUpperCase();
+    return state === "PENDING" || state === "EXPECTED" || state === "QUEUED" || state === "IN_PROGRESS";
+  });
+  if (pending.length > 0) {
+    return {
+      verdict: "SKIP",
+      reasons: pending.map((check) => `[CI] ${repoName}#${prNumber} check is still pending: ${check.name || check.context || "unknown"}.`)
+    };
+  }
+  const failing = nonGreptileChecks.filter((check) => {
+    if ((check.__typename || "") === "CheckRun") {
+      const conclusion = (check.conclusion || "").toUpperCase();
+      return conclusion.length > 0 && !["SUCCESS", "NEUTRAL", "SKIPPED"].includes(conclusion);
+    }
+    const state = (check.state || check.conclusion || "").toUpperCase();
+    return state.length > 0 && !["SUCCESS", "NEUTRAL", "SKIPPED"].includes(state);
+  });
+  if (failing.length > 0) {
+    return {
+      verdict: "REJECT",
+      reasons: failing.map((check) => `[CI] ${repoName}#${prNumber} check failed: ${check.name || check.context || "unknown"} (${check.conclusion || check.state || check.status || "unknown"}).`)
+    };
+  }
+  return { verdict: "APPROVE", reasons: [] };
+}
+function classifyGithubGreptileCheckState(checks) {
+  const greptileChecks = checks.filter((check) => {
+    const label = (check.name || check.context || "").toLowerCase();
+    return label.includes("greptile");
+  });
+  if (greptileChecks.length === 0) {
+    return { pending: false, completed: false };
+  }
+  for (const check of greptileChecks) {
+    if ((check.__typename || "") === "CheckRun") {
+      if ((check.status || "").toUpperCase() !== "COMPLETED") {
+        return { pending: true, completed: false };
+      }
+      return { pending: false, completed: true };
+    }
+    const state = (check.state || "").toUpperCase();
+    if (state === "PENDING" || state === "EXPECTED") {
+      return { pending: true, completed: false };
+    }
+    if (state) {
+      return { pending: false, completed: true };
+    }
+  }
+  return { pending: false, completed: false };
+}
+function isGithubGreptileCheckApproved(checks) {
+  const greptileChecks = checks.filter((check) => {
+    const label = (check.name || check.context || "").toLowerCase();
+    return label.includes("greptile");
+  });
+  if (greptileChecks.length === 0) {
+    return false;
+  }
+  for (const check of greptileChecks) {
+    if ((check.__typename || "") === "CheckRun") {
+      if ((check.status || "").toUpperCase() !== "COMPLETED") {
+        return false;
+      }
+      const conclusion = (check.conclusion || "").toUpperCase();
+      if (!["SUCCESS", "NEUTRAL", "SKIPPED"].includes(conclusion)) {
+        return false;
+      }
+      continue;
+    }
+    const state = (check.state || "").toUpperCase();
+    if (!["SUCCESS", "NEUTRAL", "SKIPPED"].includes(state)) {
+      return false;
+    }
+  }
+  return true;
+}
+function loadGithubReviewThreads(projectRoot, repoName, prNumber) {
+  const [owner, name] = repoName.split("/");
+  if (!owner || !name) {
+    return [];
+  }
+  const response = runGhJson(projectRoot, [
+    "api",
+    "graphql",
+    "-F",
+    `owner=${owner}`,
+    "-F",
+    `name=${name}`,
+    "-F",
+    `prNumber=${prNumber}`,
+    "-f",
+    "query=query($owner: String!, $name: String!, $prNumber: Int!) { repository(owner:$owner, name:$name) { pullRequest(number:$prNumber) { reviewThreads(first: 100) { nodes { isResolved isOutdated comments(first: 20) { nodes { author { login } body path url createdAt } } } } } } }"
+  ]);
+  return response.data?.repository?.pullRequest?.reviewThreads?.nodes || [];
+}
+function filterActionableGithubGreptileThreads(threads) {
+  return threads.flatMap((thread) => {
+    if (thread.isResolved || thread.isOutdated) {
+      return [];
+    }
+    const comments = thread.comments?.nodes || [];
+    const latestGreptileComment = [...comments].reverse().find((comment) => isGreptileGithubLogin(comment.author?.login));
+    if (!latestGreptileComment?.path?.trim()) {
+      return [];
+    }
+    return [latestGreptileComment];
+  });
+}
+function resolvePrRepoRoot(projectRoot, prState) {
+  const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (prState.target === "monorepo" && runtimeWorkspace && existsSync11(resolve13(runtimeWorkspace, ".git"))) {
+    return runtimeWorkspace;
+  }
+  const paths = resolveHarnessPaths(projectRoot);
+  return prState.target === "monorepo" ? paths.monorepoRoot : projectRoot;
+}
+function isCommitAncestorOfPrHead(projectRoot, prState, reviewedCommit, headCommit) {
+  if (!reviewedCommit || !headCommit) {
+    return false;
+  }
+  const repoRoot = resolvePrRepoRoot(projectRoot, prState);
+  return runCapture(["git", "-C", repoRoot, "merge-base", "--is-ancestor", reviewedCommit, headCommit], projectRoot).exitCode === 0;
+}
+function stripHtml(input) {
+  return input.replace(/<[^>]+>/g, " ").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/\r/g, "").replace(/\n{3,}/g, `
+
+`).trim();
+}
+function summarizeComment(input) {
+  const text = stripHtml(input).replace(/\s+/g, " ").trim();
+  return text.length > 160 ? `${text.slice(0, 157)}...` : text;
+}
+function asGreptileInfrastructureWarning(reason) {
+  return reason.startsWith("[AI Review]") ? reason.replace("[AI Review]", "[AI Review Warning]") : reason;
+}
+function isAiReviewApproved(input) {
+  if (input.reviewMode !== "required") {
+    return true;
+  }
+  return input.aiVerdict === "APPROVE" && input.aiReasons.length === 0;
+}
+function parseGreptileScore(input) {
+  const text = stripHtml(input);
+  const patterns = [
+    /confidence score:\s*(\d+)\s*\/\s*(\d+)/i,
+    /\bscore:\s*(\d+)\s*\/\s*(\d+)/i,
+    /\b(\d+)\s*\/\s*(\d+)\s*(?:confidence|score)/i
+  ];
+  for (const pattern of patterns) {
+    const match = pattern.exec(text);
+    if (!match) {
+      continue;
+    }
+    const value = Number.parseInt(match[1] || "", 10);
+    const scale = Number.parseInt(match[2] || "", 10);
+    if (Number.isFinite(value) && Number.isFinite(scale) && scale > 0) {
+      return { value, scale };
+    }
+  }
+  return null;
+}
+var __testOnly = {
+  asGreptileInfrastructureWarning,
+  callGreptileMcpToolWithTimeout,
+  classifyGithubGreptileCheckState,
+  filterActionableGithubGreptileThreads,
+  isGithubGreptileCheckApproved,
+  isAiReviewApproved,
+  parseGreptileScore,
+  pickLatestGithubGreptileReview,
+  pickRelevantGithubGreptileReview,
+  resolveGreptileRequestTimeoutMs,
+  resolveGreptilePollSettings,
+  shouldPreferGithubGreptileFallback,
+  shouldContinueGithubGreptileFallbackPolling,
+  shouldContinueGreptileMcpPolling,
+  shouldTriggerGreptileReview
+};
+export {
+  verifyTask,
+  pickRelevantCodeReview,
+  filterActionableGreptileComments,
+  __testOnly
+};