@h-rig/runtime 0.0.6-alpha.27 → 0.0.6-alpha.29

package/dist/src/control-plane/hooks/completion-verification.js

@@ -2,8 +2,8 @@
 // @bun
 
 // packages/runtime/src/control-plane/hooks/completion-verification.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync21, mkdirSync as mkdirSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync12 } from "fs";
-import { resolve as resolve25 } from "path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync21, mkdirSync as mkdirSync13, readFileSync as readFileSync13, writeFileSync as writeFileSync13 } from "fs";
+import { resolve as resolve24 } from "path";
 import {
   escapeRegExp as escapeRegExp2,
   resolveBunCli,
@@ -13,10 +13,15 @@ import {
   resolvePolicyContent
 } from "@rig/hook-kit";
 
-// packages/runtime/src/control-plane/runtime/events.ts
-import { appendFile, mkdir } from "fs/promises";
-import { randomUUID } from "crypto";
-import { dirname as dirname2, resolve as resolve2 } from "path";
+// packages/runtime/src/control-plane/runtime/guard.ts
+import { optimizeNextInvocation } from "bun:jsc";
+import { existsSync as existsSync4, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { resolve as resolve4 } from "path";
+
+// packages/runtime/src/control-plane/native/utils.ts
+import { ptr as ptr2 } from "bun:ffi";
+import { existsSync as existsSync3, readFileSync } from "fs";
+import { resolve as resolve3 } from "path";
 
 // packages/runtime/src/layout.ts
 import { existsSync } from "fs";
@@ -127,126 +132,13 @@ function resolveRigLayout(projectRoot) {
   };
 }
 
-// packages/runtime/src/control-plane/runtime/events.ts
-async function appendEvent(eventsFile, event) {
-  await mkdir(dirname2(eventsFile), { recursive: true });
-  await appendFile(eventsFile, `${JSON.stringify(event)}
-`, "utf-8");
-}
-function createEvent(runId, type, payload) {
-  return {
-    id: randomUUID(),
-    runId,
-    timestamp: new Date().toISOString(),
-    type,
-    payload
-  };
-}
-
-class RuntimeEventBus {
-  runId;
-  eventsFile;
-  memoryEvents = [];
-  constructor(options) {
-    this.runId = options.runId || randomUUID();
-    this.eventsFile = options.eventsFile ?? resolveRigLayout(options.projectRoot).controlPlaneEventsFile;
-  }
-  getRunId() {
-    return this.runId;
-  }
-  getEventsFile() {
-    return this.eventsFile;
-  }
-  getMemoryEvents() {
-    return [...this.memoryEvents];
-  }
-  async attachRuntimeBus(runtimeBus) {
-    if (runtimeBus.getEventsFile() === this.eventsFile) {
-      return;
-    }
-    for (const event of this.memoryEvents) {
-      await runtimeBus.ingest(event);
-    }
-  }
-  async attachRuntimeWorkspace(projectRoot) {
-    const runtimeBus = new RuntimeEventBus({ projectRoot, runId: this.runId });
-    await this.attachRuntimeBus(runtimeBus);
-    return runtimeBus;
-  }
-  async ingest(event) {
-    this.memoryEvents.push(event);
-    await appendEvent(this.eventsFile, event);
-  }
-  async emit(type, payload) {
-    const event = createEvent(this.runId, type, payload);
-    await this.ingest(event);
-    return event;
-  }
-}
-
-class GeneralCliEventBus {
-  runId;
-  eventsFile;
-  memoryEvents = [];
-  runtimeBuses = new Map;
-  constructor(options) {
-    this.runId = options.runId || randomUUID();
-    this.eventsFile = options.eventsFile ?? resolve2(options.projectRoot, ".rig", "logs", "control-plane.events.jsonl");
-  }
-  getRunId() {
-    return this.runId;
-  }
-  getEventsFile() {
-    return this.eventsFile;
-  }
-  getMemoryEvents() {
-    return [...this.memoryEvents];
-  }
-  async attachRuntimeBus(runtimeBus) {
-    const key = runtimeBus.getEventsFile();
-    if (this.runtimeBuses.has(key)) {
-      return;
-    }
-    this.runtimeBuses.set(key, runtimeBus);
-    for (const event of this.memoryEvents) {
-      await runtimeBus.ingest(event);
-    }
-  }
-  async attachRuntimeWorkspace(projectRoot) {
-    const runtimeBus = new RuntimeEventBus({ projectRoot, runId: this.runId });
-    await this.attachRuntimeBus(runtimeBus);
-    return runtimeBus;
-  }
-  async emit(type, payload) {
-    const event = createEvent(this.runId, type, payload);
-    this.memoryEvents.push(event);
-    await appendEvent(this.eventsFile, event);
-    await Promise.all(Array.from(this.runtimeBuses.values()).map((bus) => bus.ingest(event)));
-    return event;
-  }
-}
-
-// packages/runtime/src/control-plane/runtime/plugins.ts
-import { existsSync as existsSync5, readdirSync } from "fs";
-import { resolve as resolve6, basename as basename2 } from "path";
-
-// packages/runtime/src/control-plane/runtime/guard.ts
-import { optimizeNextInvocation } from "bun:jsc";
-import { existsSync as existsSync4, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
-import { resolve as resolve5 } from "path";
-
-// packages/runtime/src/control-plane/native/utils.ts
-import { ptr as ptr2 } from "bun:ffi";
-import { existsSync as existsSync3, readFileSync } from "fs";
-import { resolve as resolve4 } from "path";
-
 // packages/runtime/src/control-plane/native/runtime-native.ts
 import { dlopen, ptr, suffix, toBuffer } from "bun:ffi";
 import { copyFileSync, existsSync as existsSync2, mkdirSync, renameSync, rmSync, statSync } from "fs";
 import { tmpdir } from "os";
-import { dirname as dirname3, resolve as resolve3 } from "path";
-var sharedNativeRuntimeOutputDir = resolve3(tmpdir(), "rig-native");
-var sharedNativeRuntimeOutputPath = resolve3(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
+import { dirname as dirname2, resolve as resolve2 } from "path";
+var sharedNativeRuntimeOutputDir = resolve2(tmpdir(), "rig-native");
+var sharedNativeRuntimeOutputPath = resolve2(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
 var colocatedNativeRuntimeFileName = `runtime-native.${suffix}`;
 var nativeRuntimeLibrary = await loadNativeRuntimeLibrary();
 function requireNativeRuntimeLibrary(feature) {
@@ -282,12 +174,12 @@ async function loadNativeRuntimeLibrary() {
 }
 function nativePackageLibraryCandidates(fromDir, names) {
   const candidates = [];
-  let cursor = resolve3(fromDir);
+  let cursor = resolve2(fromDir);
   for (let index = 0;index < 8; index += 1) {
     for (const name of names) {
-      candidates.push(resolve3(cursor, "native", `${process.platform}-${process.arch}`, name), resolve3(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve3(cursor, "native", name), resolve3(cursor, "native", "lib", name));
+      candidates.push(resolve2(cursor, "native", `${process.platform}-${process.arch}`, name), resolve2(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve2(cursor, "native", name), resolve2(cursor, "native", "lib", name));
     }
-    const parent = dirname3(cursor);
+    const parent = dirname2(cursor);
     if (parent === cursor)
       break;
     cursor = parent;
@@ -296,17 +188,17 @@ function nativePackageLibraryCandidates(fromDir, names) {
 }
 function nativeRuntimeLibraryCandidates() {
   const explicit = process.env.RIG_NATIVE_RUNTIME_LIB?.trim() || "";
-  const execDir = process.execPath?.trim() ? dirname3(process.execPath.trim()) : "";
+  const execDir = process.execPath?.trim() ? dirname2(process.execPath.trim()) : "";
   const platformSpecific = `runtime-native-${process.platform}-${process.arch}.${suffix}`;
   return [...new Set([
     explicit,
     ...nativePackageLibraryCandidates(import.meta.dir, [colocatedNativeRuntimeFileName, platformSpecific]),
-    execDir ? resolve3(execDir, colocatedNativeRuntimeFileName) : "",
-    execDir ? resolve3(execDir, platformSpecific) : "",
-    execDir ? resolve3(execDir, "..", colocatedNativeRuntimeFileName) : "",
-    execDir ? resolve3(execDir, "..", platformSpecific) : "",
-    execDir ? resolve3(execDir, "lib", colocatedNativeRuntimeFileName) : "",
-    execDir ? resolve3(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve2(execDir, colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve2(execDir, platformSpecific) : "",
+    execDir ? resolve2(execDir, "..", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve2(execDir, "..", platformSpecific) : "",
+    execDir ? resolve2(execDir, "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve2(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
     sharedNativeRuntimeOutputPath
   ].filter(Boolean))];
 }
@@ -315,7 +207,7 @@ function resolveNativeRuntimeSourcePath() {
   if (explicit && existsSync2(explicit)) {
     return explicit;
   }
-  const bundled = resolve3(import.meta.dir, "../../../native/snapshot.zig");
+  const bundled = resolve2(import.meta.dir, "../../../native/snapshot.zig");
   return existsSync2(bundled) ? bundled : null;
 }
 async function buildNativeRuntimeLibrary(outputPath, options = {}) {
@@ -329,7 +221,7 @@ async function buildNativeRuntimeLibrary(outputPath, options = {}) {
   }
   const tempOutputPath = `${outputPath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
   try {
-    mkdirSync(dirname3(outputPath), { recursive: true });
+    mkdirSync(dirname2(outputPath), { recursive: true });
     const needsBuild = options.force === true || !existsSync2(outputPath) || statSync(sourcePath).mtimeMs > statSync(outputPath).mtimeMs;
     if (!needsBuild) {
       return true;
@@ -506,31 +398,31 @@ function unique(values) {
 function resolveHarnessPaths(projectRoot) {
   const hasRuntimeWorkspace = Boolean(process.env.RIG_TASK_WORKSPACE?.trim());
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
-  const harnessRoot = resolve4(projectRoot, "rig");
-  const stateRoot = resolve4(projectRoot, ".rig");
+  const harnessRoot = resolve3(projectRoot, "rig");
+  const stateRoot = resolve3(projectRoot, ".rig");
   const layout = hasRuntimeWorkspace ? resolveRigLayout(projectRoot) : null;
-  const stateDir = layout?.stateDir ?? resolve4(stateRoot, "state");
-  const logsDir = layout?.logsDir ?? resolve4(stateRoot, "logs");
-  const artifactsDir = layout?.artifactsRoot ?? resolve4(monorepoRoot, "artifacts");
-  const taskConfigPath = layout?.taskConfigPath ?? resolve4(monorepoRoot, ".rig", "task-config.json");
-  const binDir = layout?.binDir ?? resolve4(stateRoot, "bin");
+  const stateDir = layout?.stateDir ?? resolve3(stateRoot, "state");
+  const logsDir = layout?.logsDir ?? resolve3(stateRoot, "logs");
+  const artifactsDir = layout?.artifactsRoot ?? resolve3(monorepoRoot, "artifacts");
+  const taskConfigPath = layout?.taskConfigPath ?? resolve3(monorepoRoot, ".rig", "task-config.json");
+  const binDir = layout?.binDir ?? resolve3(stateRoot, "bin");
   return {
     harnessRoot,
     stateDir: process.env.RIG_STATE_DIR || stateDir,
     artifactsDir,
     logsDir: process.env.RIG_LOGS_DIR || logsDir,
     binDir,
-    hooksDir: resolve4(harnessRoot, "hooks"),
-    validationDir: resolve4(harnessRoot, "validation"),
+    hooksDir: resolve3(harnessRoot, "hooks"),
+    validationDir: resolve3(harnessRoot, "validation"),
     taskConfigPath,
-    sessionPath: process.env.RIG_SESSION_FILE || resolve4(stateRoot, "session", "session.json"),
+    sessionPath: process.env.RIG_SESSION_FILE || resolve3(stateRoot, "session", "session.json"),
     monorepoRoot,
-    tsApiTestsDir: process.env.TS_API_TESTS_DIR || resolve4(monorepoRoot, "TSAPITests"),
-    taskRepoCommitsPath: resolve4(stateDir, "task-repo-commits.json"),
-    baseRepoPinsPath: resolve4(stateDir, "base-repo-pins.json"),
-    failedApproachesPath: resolve4(stateDir, "failed_approaches.md"),
-    agentProfilePath: resolve4(stateDir, "agent-profile.json"),
-    reviewProfilePath: resolve4(stateDir, "review-profile.json")
+    tsApiTestsDir: process.env.TS_API_TESTS_DIR || resolve3(monorepoRoot, "TSAPITests"),
+    taskRepoCommitsPath: resolve3(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve3(stateDir, "base-repo-pins.json"),
+    failedApproachesPath: resolve3(stateDir, "failed_approaches.md"),
+    agentProfilePath: resolve3(stateDir, "agent-profile.json"),
+    reviewProfilePath: resolve3(stateDir, "review-profile.json")
   };
 }
 function normalizeRelativeScopePath(inputPath) {
@@ -658,7 +550,7 @@ function loadPolicy(projectRoot) {
   if (seededPolicyConfig) {
     return seededPolicyConfig;
   }
-  const configPath = resolve5(projectRoot, "rig/policy/policy.json");
+  const configPath = resolve4(projectRoot, "rig/policy/policy.json");
   if (!existsSync4(configPath)) {
     return defaultPolicy();
   }
@@ -889,28 +781,28 @@ function resolveAction(mode, matched) {
 }
 function resolveAbsolutePath(projectRoot, rawPath) {
   if (rawPath.startsWith("/"))
-    return resolve5(rawPath);
-  return resolve5(projectRoot, rawPath);
+    return resolve4(rawPath);
+  return resolve4(projectRoot, rawPath);
 }
 function isHarnessPath(projectRoot, rawPath) {
   const absPath = resolveAbsolutePath(projectRoot, rawPath);
   const managedRoots = [
-    resolve5(projectRoot, "rig"),
-    resolve5(projectRoot, ".rig"),
-    resolve5(projectRoot, "artifacts")
+    resolve4(projectRoot, "rig"),
+    resolve4(projectRoot, ".rig"),
+    resolve4(projectRoot, "artifacts")
   ];
   return managedRoots.some((root) => absPath === root || absPath.startsWith(root + "/"));
 }
 function isRuntimePath(projectRoot, rawPath, taskWorkspace) {
   const absPath = resolveAbsolutePath(projectRoot, rawPath);
   if (taskWorkspace) {
-    const workspaceRigRoot = resolve5(taskWorkspace, ".rig");
-    const workspaceArtifactsRoot = resolve5(taskWorkspace, "artifacts");
+    const workspaceRigRoot = resolve4(taskWorkspace, ".rig");
+    const workspaceArtifactsRoot = resolve4(taskWorkspace, "artifacts");
     if (absPath === workspaceRigRoot || absPath.startsWith(workspaceRigRoot + "/") || absPath === workspaceArtifactsRoot || absPath.startsWith(workspaceArtifactsRoot + "/")) {
       return true;
     }
   }
-  const runtimeRoot = resolve5(projectRoot, ".rig/runtime/agents");
+  const runtimeRoot = resolve4(projectRoot, ".rig/runtime/agents");
   return absPath === runtimeRoot || absPath.startsWith(runtimeRoot + "/");
 }
 function isTestFile(path) {
@@ -958,7 +850,7 @@ function evaluateScope(policy, context, filePath, access) {
     return allowed();
   }
   if (context.taskWorkspace && context.taskWorkspace !== context.projectRoot && filePath.startsWith("/")) {
-    const absPath = resolve5(filePath);
+    const absPath = resolve4(filePath);
     if (!absPath.startsWith(context.taskWorkspace + "/") && !isHarnessPath(context.projectRoot, filePath)) {
       const reason2 = `Absolute path '${filePath}' is outside task runtime boundary. Allowed root: ${context.taskWorkspace}`;
       const matched2 = [{ id: "scope:workspace-boundary", category: "command", reason: reason2 }];
@@ -1167,12 +1059,6 @@ function extractContentFromToolInput(input) {
     return input.new_string;
   return "";
 }
-function loadRuntimeImageConfig(projectRoot) {
-  return loadPolicy(projectRoot).runtime_image ?? {
-    deps: { ...DEFAULT_RUNTIME_IMAGE.deps },
-    plugins_require_binaries: DEFAULT_RUNTIME_IMAGE.plugins_require_binaries
-  };
-}
 var guardHotPathPrimed = false;
 function primeGuardHotPaths() {
   if (guardHotPathPrimed) {
@@ -1186,290 +1072,99 @@ function primeGuardHotPaths() {
 }
 primeGuardHotPaths();
 
-// packages/runtime/src/control-plane/runtime/plugin-mode.ts
-var LEGACY_PLUGIN_SCAN_ENV = "RIG_LEGACY_PLUGIN_SCAN";
-function isLegacyPluginScanEnabled(env = process.env) {
-  const value = env[LEGACY_PLUGIN_SCAN_ENV]?.trim().toLowerCase();
-  return value === "1" || value === "true" || value === "yes" || value === "on";
-}
+// packages/runtime/src/control-plane/native/git-ops.ts
+import { existsSync as existsSync20, lstatSync, mkdirSync as mkdirSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname10, isAbsolute as isAbsolute2, resolve as resolve23 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
-// packages/runtime/src/control-plane/runtime/plugins.ts
-class PluginManager {
-  eventBus;
-  context;
-  pluginDir;
-  pluginFiles;
-  pluginNames;
-  localBinDir;
-  pluginsRequireBinaries;
-  plugins;
-  loadPromise;
-  constructor(options) {
-    this.eventBus = options.eventBus;
-    this.context = options.context;
-    this.pluginDir = options.pluginDir;
-    this.pluginFiles = options.pluginFiles;
-    this.pluginNames = options.pluginNames;
-    this.localBinDir = options.localBinDir;
-    this.pluginsRequireBinaries = options.pluginsRequireBinaries;
-    this.plugins = options.preloadedPlugins ?? null;
-    this.loadPromise = null;
-  }
-  static disabled(options) {
-    const validatorProjectRoot = options.runtimeContext?.workspaceDir || options.projectRoot;
-    return new PluginManager({
-      eventBus: options.eventBus,
-      context: {
-        projectRoot: validatorProjectRoot,
-        runId: options.runId,
-        eventBus: options.eventBus
-      },
-      pluginDir: resolve6(options.projectRoot, "rig/plugins"),
-      pluginFiles: [],
-      pluginNames: [],
-      localBinDir: options.runtimeContext ? resolve6(options.runtimeContext.binDir, "plugins") : resolve6(options.projectRoot, "rig/plugins"),
-      pluginsRequireBinaries: false,
-      preloadedPlugins: []
-    });
-  }
-  static async load(options) {
-    const pluginDir = resolve6(options.projectRoot, "rig/plugins");
-    const runtimeImageConfig = loadRuntimeImageConfig(options.projectRoot);
-    const localBinDir = options.runtimeContext ? resolve6(options.runtimeContext.binDir, "plugins") : resolve6(options.projectRoot, "rig/plugins");
-    const legacyPluginScan = options.legacyPluginScan ?? isLegacyPluginScanEnabled(options.env);
-    const files = legacyPluginScan ? safeReadDir(pluginDir).filter((entry) => /\.(ts|js|mjs|cjs)$/.test(entry)) : [];
-    const pluginNames = files.map((file) => basename2(file).replace(/\.plugin\.(ts|js|mjs|cjs)$/, ""));
-    const validatorProjectRoot = options.runtimeContext?.workspaceDir || options.projectRoot;
-    const context = {
-      projectRoot: validatorProjectRoot,
-      runId: options.runId,
-      eventBus: options.eventBus
-    };
-    return new PluginManager({
-      eventBus: options.eventBus,
-      context,
-      pluginDir,
-      pluginFiles: files,
-      pluginNames,
-      localBinDir,
-      pluginsRequireBinaries: options.pluginsRequireBinaries ?? (runtimeImageConfig.plugins_require_binaries && Boolean(options.runtimeContext))
-    });
-  }
-  list() {
-    if (this.plugins) {
-      return this.plugins.map((plugin) => ({
-        name: plugin.name,
-        validators: plugin.validators?.map((validator) => validator.id) ?? []
-      }));
-    }
-    return this.pluginNames.map((name) => ({
-      name,
-      validators: []
-    }));
-  }
-  async beforeCommand(ctx) {
-    const plugins = await this.ensureLoaded();
-    for (const plugin of plugins) {
-      if (!plugin.beforeCommand) {
-        continue;
-      }
-      await this.safeInvoke(plugin.name, "beforeCommand", () => plugin.beforeCommand?.(ctx, this.context));
-    }
-  }
-  async afterCommand(result) {
-    const plugins = await this.ensureLoaded();
-    for (const plugin of plugins) {
-      if (!plugin.afterCommand) {
-        continue;
-      }
-      await this.safeInvoke(plugin.name, "afterCommand", () => plugin.afterCommand?.(result, this.context));
+// packages/runtime/src/control-plane/runtime/baked-secrets.ts
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve5 } from "path";
+var BAKED_RUNTIME_SECRETS = {
+  ANTHROPIC_API_KEY: typeof RIG_BAKED_ANTHROPIC_API_KEY !== "undefined" ? RIG_BAKED_ANTHROPIC_API_KEY : "",
+  OPENAI_API_KEY: typeof RIG_BAKED_OPENAI_API_KEY !== "undefined" ? RIG_BAKED_OPENAI_API_KEY : "",
+  OPENROUTER_API_KEY: typeof RIG_BAKED_OPENROUTER_API_KEY !== "undefined" ? RIG_BAKED_OPENROUTER_API_KEY : "",
+  AI_REVIEW_MODE: typeof RIG_BAKED_AI_REVIEW_MODE !== "undefined" ? RIG_BAKED_AI_REVIEW_MODE : "",
+  AI_REVIEW_PROVIDER: typeof RIG_BAKED_AI_REVIEW_PROVIDER !== "undefined" ? RIG_BAKED_AI_REVIEW_PROVIDER : "",
+  GREPTILE_API_BASE: typeof RIG_BAKED_GREPTILE_API_BASE !== "undefined" ? RIG_BAKED_GREPTILE_API_BASE : "",
+  GREPTILE_REMOTE: typeof RIG_BAKED_GREPTILE_REMOTE !== "undefined" ? RIG_BAKED_GREPTILE_REMOTE : "",
+  GREPTILE_REPOSITORY: typeof RIG_BAKED_GREPTILE_REPOSITORY !== "undefined" ? RIG_BAKED_GREPTILE_REPOSITORY : "",
+  GREPTILE_CONTEXT_BRANCH: typeof RIG_BAKED_GREPTILE_CONTEXT_BRANCH !== "undefined" ? RIG_BAKED_GREPTILE_CONTEXT_BRANCH : "",
+  GREPTILE_DEFAULT_BRANCH: typeof RIG_BAKED_GREPTILE_DEFAULT_BRANCH !== "undefined" ? RIG_BAKED_GREPTILE_DEFAULT_BRANCH : "",
+  GREPTILE_API_KEY: typeof RIG_BAKED_GREPTILE_API_KEY !== "undefined" ? RIG_BAKED_GREPTILE_API_KEY : "",
+  GREPTILE_GITHUB_TOKEN: typeof RIG_BAKED_GREPTILE_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GREPTILE_GITHUB_TOKEN : "",
+  GREPTILE_POLL_ATTEMPTS: typeof RIG_BAKED_GREPTILE_POLL_ATTEMPTS !== "undefined" ? RIG_BAKED_GREPTILE_POLL_ATTEMPTS : "",
+  GREPTILE_POLL_INTERVAL_MS: typeof RIG_BAKED_GREPTILE_POLL_INTERVAL_MS !== "undefined" ? RIG_BAKED_GREPTILE_POLL_INTERVAL_MS : "",
+  GH_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+  GITHUB_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
+  GITHUB_SSH_KEY: typeof RIG_BAKED_GITHUB_SSH_KEY !== "undefined" ? RIG_BAKED_GITHUB_SSH_KEY : "",
+  AWS_ACCESS_KEY_ID: typeof RIG_BAKED_AWS_ACCESS_KEY_ID !== "undefined" ? RIG_BAKED_AWS_ACCESS_KEY_ID : "",
+  AWS_SECRET_ACCESS_KEY: typeof RIG_BAKED_AWS_SECRET_ACCESS_KEY !== "undefined" ? RIG_BAKED_AWS_SECRET_ACCESS_KEY : "",
+  AWS_REGION: typeof RIG_BAKED_AWS_REGION !== "undefined" ? RIG_BAKED_AWS_REGION : "",
+  LINEAR_API_KEY: typeof RIG_BAKED_LINEAR_API_KEY !== "undefined" ? RIG_BAKED_LINEAR_API_KEY : "",
+  LINEAR_WEBHOOK_SECRET: typeof RIG_BAKED_LINEAR_WEBHOOK_SECRET !== "undefined" ? RIG_BAKED_LINEAR_WEBHOOK_SECRET : ""
+};
+function resolveRuntimeSecrets(env, baked = BAKED_RUNTIME_SECRETS) {
+  const resolved = {};
+  const keys = new Set([
+    ...Object.keys(BAKED_RUNTIME_SECRETS),
+    ...Object.keys(baked)
+  ]);
+  for (const key of keys) {
+    const envValue = env[key]?.trim();
+    const bakedValue = baked[key]?.trim();
+    if (envValue) {
+      resolved[key] = envValue;
+    } else if (bakedValue) {
+      resolved[key] = bakedValue;
     }
   }
-  async onEvent(event) {
-    const plugins = this.plugins;
-    if (!plugins) {
-      return;
-    }
-    for (const plugin of plugins) {
-      if (!plugin.onEvent) {
-        continue;
-      }
-      await this.safeInvoke(plugin.name, "onEvent", () => plugin.onEvent?.(event, this.context));
-    }
-  }
-  async runValidators(taskId) {
-    const plugins = await this.ensureLoaded();
-    const results = [];
-    for (const plugin of plugins) {
-      for (const validator of plugin.validators ?? []) {
-        await this.eventBus.emit("validator.started", {
-          plugin: plugin.name,
-          validator: validator.id,
-          taskId
-        });
-        try {
-          const result = await validator.run({ taskId, projectRoot: this.context.projectRoot }, this.context);
-          results.push(result);
-          await this.eventBus.emit("validator.finished", {
-            plugin: plugin.name,
-            validator: validator.id,
-            taskId,
-            passed: result.passed,
-            summary: result.summary
-          });
-        } catch (error) {
-          const failed = {
-            id: validator.id,
-            passed: false,
-            summary: `${plugin.name}/${validator.id} failed unexpectedly`,
-            details: `${error}`
-          };
-          results.push(failed);
-          await this.eventBus.emit("validator.finished", {
-            plugin: plugin.name,
-            validator: validator.id,
-            taskId,
-            passed: false,
-            summary: failed.summary,
-            details: failed.details
-          });
-        }
-      }
-    }
-    return results;
+  return resolved;
+}
+function loadDotEnvSecrets(projectRoot, env = process.env) {
+  const dotenvPath = resolve5(projectRoot, ".env");
+  if (!existsSync5(dotenvPath)) {
+    return {};
   }
-  async safeInvoke(pluginName, hook, call) {
-    try {
-      await call();
-    } catch (error) {
-      await this.eventBus.emit("plugin.error", {
-        plugin: pluginName,
-        phase: hook,
-        error: `${error}`
-      });
+  const parsed = {};
+  const lines = readFileSync3(dotenvPath, "utf-8").split(/\r?\n/);
+  for (const rawLine of lines) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) {
+      continue;
     }
-  }
-  async ensureLoaded() {
-    if (this.plugins) {
-      return this.plugins;
+    const exportMatch = line.match(/^(?:export\s+)?([A-Z0-9_]+)\s*=\s*(.*)$/);
+    if (!exportMatch) {
+      continue;
     }
-    if (this.loadPromise) {
-      return this.loadPromise;
+    const key = exportMatch[1];
+    if (!(key in BAKED_RUNTIME_SECRETS)) {
+      continue;
     }
-    this.loadPromise = this.loadCompiledPlugins();
-    try {
-      this.plugins = await this.loadPromise;
-      return this.plugins;
-    } finally {
-      this.loadPromise = null;
-    }
-  }
-  resolveBinPath(binName) {
-    const candidates = [this.localBinDir].filter(Boolean).map((dir) => resolve6(dir, binName));
-    return candidates.find((candidate) => existsSync5(candidate));
-  }
-  async loadCompiledPlugins() {
-    const plugins = [];
-    for (const file of this.pluginFiles) {
-      const binName = basename2(file).replace(/\.plugin\.(ts|js|mjs|cjs)$/, "");
-      let binPath = this.resolveBinPath(binName);
-      if (!binPath) {
-        const triedPaths = [this.localBinDir].filter(Boolean).map((dir) => resolve6(dir, binName));
-        const missingError = `Compiled plugin binary not found for '${binName}'. Tried: ${triedPaths.join(", ")}`;
-        await this.eventBus.emit("plugin.error", {
-          file: resolve6(this.pluginDir, file),
-          phase: "load",
-          error: missingError
-        });
-        if (this.pluginsRequireBinaries) {
-          throw new Error(missingError);
-        }
-        plugins.push({
-          name: binName,
-          validators: []
-        });
-        await this.eventBus.emit("plugin.loaded", {
-          plugin: binName,
-          file: resolve6(this.pluginDir, file),
-          source: "metadata-only"
-        });
-        continue;
-      }
-      const wrapper = createBinaryPluginWrapper(binName, binPath, this.context.projectRoot);
-      plugins.push(wrapper);
-      await this.eventBus.emit("plugin.loaded", {
-        plugin: wrapper.name,
-        file: binPath,
-        source: "compiled-binary"
-      });
+    const value = expandShellValue(exportMatch[2] ?? "", { ...env, ...parsed });
+    if (value) {
+      parsed[key] = value;
     }
-    return plugins;
   }
+  return parsed;
 }
-function createBinaryPluginWrapper(name, binPath, projectRoot) {
-  return {
-    name,
-    validators: [
-      {
-        id: `${name}:compiled`,
-        async run(ctx) {
-          const proc = Bun.spawn([binPath, "--validate", ctx.taskId, ctx.projectRoot], {
-            cwd: projectRoot,
-            stdout: "pipe",
-            stderr: "pipe"
-          });
-          const exitCode = await proc.exited;
-          const stdout = await new Response(proc.stdout).text();
-          const stderr = await new Response(proc.stderr).text();
-          if (exitCode !== 0) {
-            return {
-              id: `${name}:compiled`,
-              passed: false,
-              summary: `Plugin binary ${name} exited with code ${exitCode}`,
-              details: stderr || stdout
-            };
-          }
-          try {
-            const results = JSON.parse(stdout.trim());
-            const failed = results.filter((r) => !r.passed);
-            if (failed.length > 0) {
-              return {
-                id: `${name}:compiled`,
-                passed: false,
-                summary: `${failed.length} of ${results.length} validator(s) failed`,
-                details: failed.map((f) => `${f.id}: ${f.summary}`).join(`
-`)
-              };
-            }
-            return {
-              id: `${name}:compiled`,
-              passed: true,
-              summary: `All ${results.length} validator(s) passed`
-            };
-          } catch {
-            return {
-              id: `${name}:compiled`,
-              passed: false,
-              summary: `Failed to parse output from compiled plugin ${name}`,
-              details: stdout.slice(0, 500)
-            };
-          }
-        }
-      }
-    ]
-  };
-}
-function safeReadDir(path) {
-  try {
-    return readdirSync(path, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name).sort();
-  } catch {
-    return [];
+function expandShellValue(rawValue, env) {
+  let value = rawValue.trim();
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1);
   }
+  return value.replace(/\$\{([A-Z0-9_]+)(:-([^}]*))?\}/g, (_match, name, _defaultGroup, fallback) => {
+    const envValue = env[name]?.trim();
+    if (envValue) {
+      return envValue;
+    }
+    return fallback ?? "";
+  });
 }
 
 // packages/runtime/src/control-plane/runtime/context.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync } from "fs";
-import { dirname as dirname4, resolve as resolve7 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync } from "fs";
+import { dirname as dirname3, resolve as resolve6 } from "path";
 var RUNTIME_CONTEXT_ENV = "RIG_RUNTIME_CONTEXT_FILE";
 var runtimeContextStringFields = [
   "runtimeId",
@@ -1493,13 +1188,13 @@ var runtimeContextOptionalStringFields = [
   "monorepoBaseCommit"
 ];
 function loadRuntimeContext(path) {
-  const absPath = resolve7(path);
+  const absPath = resolve6(path);
   if (!existsSync6(absPath)) {
     throw new Error(`RuntimeTaskContext file not found: ${absPath}`);
   }
   let raw;
   try {
-    raw = JSON.parse(readFileSync3(absPath, "utf8"));
+    raw = JSON.parse(readFileSync4(absPath, "utf8"));
   } catch (err) {
     throw new Error(`Failed to parse RuntimeTaskContext at ${absPath}: ${String(err)}`);
   }
@@ -1622,13 +1317,13 @@ function loadRuntimeContextFromEnv(env = process.env) {
   return loadRuntimeContext(inferred);
 }
 function findRuntimeContextFile(startPath) {
-  let current = resolve7(startPath);
+  let current = resolve6(startPath);
   while (true) {
-    const candidate = resolve7(current, "runtime-context.json");
+    const candidate = resolve6(current, "runtime-context.json");
     if (existsSync6(candidate) && isAgentRuntimeContextPath(candidate)) {
       return candidate;
     }
-    const parent = dirname4(current);
+    const parent = dirname3(current);
     if (parent === current) {
       return "";
     }
@@ -1640,99 +1335,9 @@ function isAgentRuntimeContextPath(path) {
   return /\/\.rig\/runtime-context\.json$/.test(normalized);
 }
 
-// packages/runtime/src/control-plane/native/git-ops.ts
-import { existsSync as existsSync20, lstatSync, mkdirSync as mkdirSync11, readFileSync as readFileSync11, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname11, isAbsolute as isAbsolute2, resolve as resolve24 } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-
-// packages/runtime/src/control-plane/runtime/baked-secrets.ts
-import { existsSync as existsSync7, readFileSync as readFileSync4 } from "fs";
-import { resolve as resolve8 } from "path";
-var BAKED_RUNTIME_SECRETS = {
-  ANTHROPIC_API_KEY: typeof RIG_BAKED_ANTHROPIC_API_KEY !== "undefined" ? RIG_BAKED_ANTHROPIC_API_KEY : "",
-  OPENAI_API_KEY: typeof RIG_BAKED_OPENAI_API_KEY !== "undefined" ? RIG_BAKED_OPENAI_API_KEY : "",
-  OPENROUTER_API_KEY: typeof RIG_BAKED_OPENROUTER_API_KEY !== "undefined" ? RIG_BAKED_OPENROUTER_API_KEY : "",
-  AI_REVIEW_MODE: typeof RIG_BAKED_AI_REVIEW_MODE !== "undefined" ? RIG_BAKED_AI_REVIEW_MODE : "",
-  AI_REVIEW_PROVIDER: typeof RIG_BAKED_AI_REVIEW_PROVIDER !== "undefined" ? RIG_BAKED_AI_REVIEW_PROVIDER : "",
-  GREPTILE_API_BASE: typeof RIG_BAKED_GREPTILE_API_BASE !== "undefined" ? RIG_BAKED_GREPTILE_API_BASE : "",
-  GREPTILE_REMOTE: typeof RIG_BAKED_GREPTILE_REMOTE !== "undefined" ? RIG_BAKED_GREPTILE_REMOTE : "",
-  GREPTILE_REPOSITORY: typeof RIG_BAKED_GREPTILE_REPOSITORY !== "undefined" ? RIG_BAKED_GREPTILE_REPOSITORY : "",
-  GREPTILE_CONTEXT_BRANCH: typeof RIG_BAKED_GREPTILE_CONTEXT_BRANCH !== "undefined" ? RIG_BAKED_GREPTILE_CONTEXT_BRANCH : "",
-  GREPTILE_DEFAULT_BRANCH: typeof RIG_BAKED_GREPTILE_DEFAULT_BRANCH !== "undefined" ? RIG_BAKED_GREPTILE_DEFAULT_BRANCH : "",
-  GREPTILE_API_KEY: typeof RIG_BAKED_GREPTILE_API_KEY !== "undefined" ? RIG_BAKED_GREPTILE_API_KEY : "",
-  GREPTILE_GITHUB_TOKEN: typeof RIG_BAKED_GREPTILE_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GREPTILE_GITHUB_TOKEN : "",
-  GREPTILE_POLL_ATTEMPTS: typeof RIG_BAKED_GREPTILE_POLL_ATTEMPTS !== "undefined" ? RIG_BAKED_GREPTILE_POLL_ATTEMPTS : "",
-  GREPTILE_POLL_INTERVAL_MS: typeof RIG_BAKED_GREPTILE_POLL_INTERVAL_MS !== "undefined" ? RIG_BAKED_GREPTILE_POLL_INTERVAL_MS : "",
-  GH_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
-  GITHUB_TOKEN: typeof RIG_BAKED_GITHUB_TOKEN !== "undefined" ? RIG_BAKED_GITHUB_TOKEN : "",
-  GITHUB_SSH_KEY: typeof RIG_BAKED_GITHUB_SSH_KEY !== "undefined" ? RIG_BAKED_GITHUB_SSH_KEY : "",
-  AWS_ACCESS_KEY_ID: typeof RIG_BAKED_AWS_ACCESS_KEY_ID !== "undefined" ? RIG_BAKED_AWS_ACCESS_KEY_ID : "",
-  AWS_SECRET_ACCESS_KEY: typeof RIG_BAKED_AWS_SECRET_ACCESS_KEY !== "undefined" ? RIG_BAKED_AWS_SECRET_ACCESS_KEY : "",
-  AWS_REGION: typeof RIG_BAKED_AWS_REGION !== "undefined" ? RIG_BAKED_AWS_REGION : "",
-  LINEAR_API_KEY: typeof RIG_BAKED_LINEAR_API_KEY !== "undefined" ? RIG_BAKED_LINEAR_API_KEY : "",
-  LINEAR_WEBHOOK_SECRET: typeof RIG_BAKED_LINEAR_WEBHOOK_SECRET !== "undefined" ? RIG_BAKED_LINEAR_WEBHOOK_SECRET : ""
-};
-function resolveRuntimeSecrets(env, baked = BAKED_RUNTIME_SECRETS) {
-  const resolved = {};
-  const keys = new Set([
-    ...Object.keys(BAKED_RUNTIME_SECRETS),
-    ...Object.keys(baked)
-  ]);
-  for (const key of keys) {
-    const envValue = env[key]?.trim();
-    const bakedValue = baked[key]?.trim();
-    if (envValue) {
-      resolved[key] = envValue;
-    } else if (bakedValue) {
-      resolved[key] = bakedValue;
-    }
-  }
-  return resolved;
-}
-function loadDotEnvSecrets(projectRoot, env = process.env) {
-  const dotenvPath = resolve8(projectRoot, ".env");
-  if (!existsSync7(dotenvPath)) {
-    return {};
-  }
-  const parsed = {};
-  const lines = readFileSync4(dotenvPath, "utf-8").split(/\r?\n/);
-  for (const rawLine of lines) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#")) {
-      continue;
-    }
-    const exportMatch = line.match(/^(?:export\s+)?([A-Z0-9_]+)\s*=\s*(.*)$/);
-    if (!exportMatch) {
-      continue;
-    }
-    const key = exportMatch[1];
-    if (!(key in BAKED_RUNTIME_SECRETS)) {
-      continue;
-    }
-    const value = expandShellValue(exportMatch[2] ?? "", { ...env, ...parsed });
-    if (value) {
-      parsed[key] = value;
-    }
-  }
-  return parsed;
-}
-function expandShellValue(rawValue, env) {
-  let value = rawValue.trim();
-  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-    value = value.slice(1, -1);
-  }
-  return value.replace(/\$\{([A-Z0-9_]+)(:-([^}]*))?\}/g, (_match, name, _defaultGroup, fallback) => {
-    const envValue = env[name]?.trim();
-    if (envValue) {
-      return envValue;
-    }
-    return fallback ?? "";
-  });
-}
-
 // packages/runtime/src/control-plane/native/task-ops.ts
-import { appendFileSync, existsSync as existsSync19, mkdirSync as mkdirSync10, readFileSync as readFileSync10, writeFileSync as writeFileSync10 } from "fs";
-import { resolve as resolve23 } from "path";
+import { appendFileSync, existsSync as existsSync19, mkdirSync as mkdirSync11, readFileSync as readFileSync11, writeFileSync as writeFileSync11 } from "fs";
+import { resolve as resolve22 } from "path";
 
 // packages/runtime/src/build-time-config.ts
 function normalizeBuildConfig(value) {
@@ -1758,14 +1363,14 @@ function readBuildConfig() {
 
 // packages/runtime/src/control-plane/runtime/tooling/shell.ts
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename3, dirname as dirname5, resolve as resolve9 } from "path";
-var sharedNativeShellOutputDir = resolve9(tmpdir2(), "rig-native");
-var sharedNativeShellOutputPath = resolve9(sharedNativeShellOutputDir, `rig-shell-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+import { basename as basename2, dirname as dirname4, resolve as resolve7 } from "path";
+var sharedNativeShellOutputDir = resolve7(tmpdir2(), "rig-native");
+var sharedNativeShellOutputPath = resolve7(sharedNativeShellOutputDir, `rig-shell-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
 // packages/runtime/src/control-plane/runtime/tooling/file-tools.ts
 import { tmpdir as tmpdir3 } from "os";
-import { basename as basename4, dirname as dirname6, resolve as resolve10 } from "path";
-var sharedNativeToolsOutputDir = resolve10(tmpdir3(), "rig-native");
-var sharedNativeToolsOutputPath = resolve10(sharedNativeToolsOutputDir, `rig-tools-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+import { basename as basename3, dirname as dirname5, resolve as resolve8 } from "path";
+var sharedNativeToolsOutputDir = resolve8(tmpdir3(), "rig-native");
+var sharedNativeToolsOutputPath = resolve8(sharedNativeToolsOutputDir, `rig-tools-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
 // packages/runtime/src/control-plane/plugin-host-context.ts
 import { createPluginHost } from "@rig/core";
 import { loadConfig } from "@rig/core/load-config";
@@ -1912,7 +1517,7 @@ function createTaskFieldRegistry(extensions) {
 }
 
 // packages/runtime/src/control-plane/validators/runtime-registration.ts
-import { existsSync as existsSync8 } from "fs";
+import { existsSync as existsSync7 } from "fs";
 import { join } from "path";
 function createValidatorRegistry() {
   const map = new Map;
@@ -1945,7 +1550,7 @@ function registerBuiltInValidators(registry) {
 }
 async function runStdTypecheck(ctx) {
   const packageJsonPath = join(ctx.workspaceRoot, "package.json");
-  if (!existsSync8(packageJsonPath)) {
+  if (!existsSync7(packageJsonPath)) {
     return {
       id: "std:typecheck",
       passed: false,
@@ -1973,8 +1578,8 @@ async function runStdTypecheck(ctx) {
 }
 
 // packages/runtime/src/control-plane/hook-materializer.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname7, resolve as resolve11 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname6, resolve as resolve9 } from "path";
 var MARKER_PLUGIN = "_rigPlugin";
 var MARKER_HOOK_ID = "_rigHookId";
 function matcherToString(matcher) {
@@ -1988,8 +1593,8 @@ function isPluginOwned(cmd) {
   return typeof cmd[MARKER_PLUGIN] === "string";
 }
 function materializeHooks(projectRoot, entries) {
-  const settingsPath = resolve11(projectRoot, ".claude", "settings.json");
-  const existing = existsSync9(settingsPath) ? safeReadJson(settingsPath) : {};
+  const settingsPath = resolve9(projectRoot, ".claude", "settings.json");
+  const existing = existsSync8(settingsPath) ? safeReadJson(settingsPath) : {};
   const hooks = existing.hooks ?? {};
   for (const event of Object.keys(hooks)) {
     const groups = hooks[event] ?? [];
@@ -2031,7 +1636,7 @@ function materializeHooks(projectRoot, entries) {
   } else {
     delete next.hooks;
   }
-  mkdirSync3(dirname7(settingsPath), { recursive: true });
+  mkdirSync3(dirname6(settingsPath), { recursive: true });
   writeFileSync2(settingsPath, `${JSON.stringify(next, null, 2)}
 `, "utf-8");
   return settingsPath;
@@ -2044,6 +1649,49 @@ function safeReadJson(path) {
   }
 }
 
+// packages/runtime/src/control-plane/skill-materializer.ts
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync6, readdirSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve10 } from "path";
+import { loadSkill } from "@rig/skill-loader";
+var MARKER_FILENAME = ".rig-plugin";
+function skillDirName(id) {
+  return id.replace(/[^a-zA-Z0-9._-]+/g, "-");
+}
+async function materializeSkills(projectRoot, entries) {
+  const skillsRoot = resolve10(projectRoot, ".pi", "skills");
+  if (existsSync9(skillsRoot)) {
+    for (const name of readdirSync(skillsRoot)) {
+      const dir = resolve10(skillsRoot, name);
+      if (existsSync9(resolve10(dir, MARKER_FILENAME))) {
+        rmSync2(dir, { recursive: true, force: true });
+      }
+    }
+  }
+  const written = [];
+  for (const { pluginName, skill } of entries) {
+    const sourcePath = resolve10(projectRoot, skill.path);
+    if (!existsSync9(sourcePath)) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${sourcePath} does not exist`);
+      continue;
+    }
+    let body;
+    try {
+      await loadSkill(sourcePath);
+      body = readFileSync6(sourcePath, "utf-8");
+    } catch (err) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${err instanceof Error ? err.message : err}`);
+      continue;
+    }
+    const dir = resolve10(skillsRoot, skillDirName(skill.id));
+    mkdirSync4(dir, { recursive: true });
+    writeFileSync3(resolve10(dir, "SKILL.md"), body, "utf-8");
+    writeFileSync3(resolve10(dir, MARKER_FILENAME), `${JSON.stringify({ plugin: pluginName, skillId: skill.id }, null, 2)}
+`, "utf-8");
+    written.push({ id: skill.id, pluginName, directory: dir });
+  }
+  return written;
+}
+
 // packages/runtime/src/control-plane/plugin-host-context.ts
 async function buildPluginHostContext(projectRoot) {
   let config;
@@ -2080,6 +1728,17 @@ async function buildPluginHostContext(projectRoot) {
   } catch (err) {
     console.warn(`[plugin-host] hook materialization failed: ${err instanceof Error ? err.message : err}`);
   }
+  try {
+    const skillEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.skills ?? []).map((skill) => ({
+      pluginName: plugin.name,
+      skill
+    })));
+    if (skillEntries.length > 0) {
+      await materializeSkills(projectRoot, skillEntries);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] skill materialization failed: ${err instanceof Error ? err.message : err}`);
+  }
   return {
     config,
     pluginHost,
@@ -2093,12 +1752,12 @@ async function buildPluginHostContext(projectRoot) {
 
 // packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync11, readFileSync as readFileSync7, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
-import { basename as basename5, join as join2, resolve as resolve13 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync8, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
+import { basename as basename4, join as join2, resolve as resolve12 } from "path";
 
 // packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
-import { existsSync as existsSync10, readFileSync as readFileSync6 } from "fs";
-import { resolve as resolve12 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
+import { resolve as resolve11 } from "path";
 
 // packages/runtime/src/control-plane/tasks/task-record-reader.ts
 async function findTaskById(reader, id) {
@@ -2121,7 +1780,7 @@ class LegacyTaskConfigReadError extends Error {
   }
 }
 function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve12(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve11(projectRoot, ".rig", "task-config.json");
   const reader = {
     async listTasks() {
       return readLegacyTaskRecords(projectRoot, configPath);
@@ -2132,7 +1791,7 @@ function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
   };
   return reader;
 }
-function readLegacyTaskRecords(projectRoot, configPath = resolve12(projectRoot, ".rig", "task-config.json")) {
+function readLegacyTaskRecords(projectRoot, configPath = resolve11(projectRoot, ".rig", "task-config.json")) {
   if (!existsSync10(configPath)) {
     return [];
   }
@@ -2141,7 +1800,7 @@ function readLegacyTaskRecords(projectRoot, configPath = resolve12(projectRoot,
 }
 function readLegacyTaskConfigJson(projectRoot, configPath) {
   try {
-    const parsed = JSON.parse(readFileSync6(configPath, "utf8"));
+    const parsed = JSON.parse(readFileSync7(configPath, "utf8"));
     if (isPlainRecord(parsed)) {
       return parsed;
     }
@@ -2225,7 +1884,7 @@ function isPlainRecord(candidate) {
 var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
 var FILE_TASK_PATTERN = /\.(task\.)?json$/;
 function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve13(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve12(projectRoot, ".rig", "task-config.json");
   const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
   const spawnFn = options.spawn ?? spawnSync;
   const ghBinary = options.ghBinary ?? "gh";
@@ -2291,7 +1950,7 @@ async function readSourceAwareTaskStatus(projectRoot, taskId, options = {}) {
   }
 }
 function updateSourceAwareTaskConfigTask(projectRoot, taskId, update, options = {}) {
-  const configPath = options.configPath ?? resolve13(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve12(projectRoot, ".rig", "task-config.json");
   const rawEntry = readRawTaskEntry(configPath, taskId);
   if (!rawEntry) {
     const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
@@ -2344,10 +2003,10 @@ function readMaterializedTaskMetadata(entry) {
   return metadata;
 }
 function readConfiguredFilesTaskSourcePath(projectRoot) {
-  const jsonPath = resolve13(projectRoot, "rig.config.json");
+  const jsonPath = resolve12(projectRoot, "rig.config.json");
   if (existsSync11(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync7(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync8(jsonPath, "utf8"));
       if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
         const source = parsed.taskSource;
         return source.kind === "files" && typeof source.path === "string" ? source.path : null;
@@ -2356,12 +2015,12 @@ function readConfiguredFilesTaskSourcePath(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve13(projectRoot, "rig.config.ts");
+  const tsPath = resolve12(projectRoot, "rig.config.ts");
   if (!existsSync11(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync7(tsPath, "utf8");
+    const source = readFileSync8(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -2384,7 +2043,7 @@ function readRawTaskConfig(configPath) {
   if (!existsSync11(configPath)) {
     return null;
   }
-  const parsed = JSON.parse(readFileSync7(configPath, "utf8"));
+  const parsed = JSON.parse(readFileSync8(configPath, "utf8"));
   return isPlainRecord2(parsed) ? parsed : null;
 }
 function stripLegacyTaskConfigMetadata2(raw) {
@@ -2401,16 +2060,16 @@ function writeLegacyTaskStatus(configPath, taskId, status) {
     return;
   }
   entry.status = status;
-  writeFileSync3(configPath, `${JSON.stringify(rawConfig, null, 2)}
+  writeFileSync4(configPath, `${JSON.stringify(rawConfig, null, 2)}
 `, "utf8");
 }
 function updateFileBackedTask(projectRoot, sourcePath, taskId, update) {
-  const directory = resolve13(projectRoot, sourcePath);
+  const directory = resolve12(projectRoot, sourcePath);
   const file = findFileBackedTaskFile(directory, taskId);
   if (!file) {
     return false;
   }
-  const raw = JSON.parse(readFileSync7(file, "utf8"));
+  const raw = JSON.parse(readFileSync8(file, "utf8"));
   if (!isPlainRecord2(raw)) {
     return false;
   }
@@ -2427,12 +2086,12 @@ function updateFileBackedTask(projectRoot, sourcePath, taskId, update) {
       { body: update.comment, createdAt: new Date().toISOString(), source: "rig" }
     ];
   }
-  writeFileSync3(file, `${JSON.stringify(raw, null, 2)}
+  writeFileSync4(file, `${JSON.stringify(raw, null, 2)}
 `, "utf8");
   return true;
 }
 function listFileBackedTasks(projectRoot, sourcePath) {
-  const directory = resolve13(projectRoot, sourcePath);
+  const directory = resolve12(projectRoot, sourcePath);
   if (!existsSync11(directory)) {
     return [];
   }
@@ -2440,7 +2099,7 @@ function listFileBackedTasks(projectRoot, sourcePath) {
   for (const name of readdirSync2(directory)) {
     if (!FILE_TASK_PATTERN.test(name))
       continue;
-    const inferredId = basename5(name).replace(FILE_TASK_PATTERN, "");
+    const inferredId = basename4(name).replace(FILE_TASK_PATTERN, "");
     const task = readFileBackedTask(projectRoot, sourcePath, inferredId, {});
     if (task)
       tasks.push(task);
@@ -2448,11 +2107,11 @@ function listFileBackedTasks(projectRoot, sourcePath) {
   return tasks;
 }
 function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
-  const file = findFileBackedTaskFile(resolve13(projectRoot, sourcePath), taskId);
+  const file = findFileBackedTaskFile(resolve12(projectRoot, sourcePath), taskId);
   if (!file) {
     return null;
   }
-  const raw = JSON.parse(readFileSync7(file, "utf8"));
+  const raw = JSON.parse(readFileSync8(file, "utf8"));
   if (!isPlainRecord2(raw)) {
     return null;
   }
@@ -2475,8 +2134,8 @@ function findFileBackedTaskFile(directory, taskId) {
     try {
       if (!statSync3(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync7(file, "utf8"));
-      const inferredId = basename5(file).replace(FILE_TASK_PATTERN, "");
+      const raw = JSON.parse(readFileSync8(file, "utf8"));
+      const inferredId = basename4(file).replace(FILE_TASK_PATTERN, "");
       const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
       if (id === taskId) {
         return file;
@@ -2824,8 +2483,8 @@ function buildTaskRunLifecycleComment(input) {
 }
 
 // packages/runtime/src/control-plane/native/task-state.ts
-import { existsSync as existsSync13, readFileSync as readFileSync9, readdirSync as readdirSync3, statSync as statSync4, writeFileSync as writeFileSync5 } from "fs";
-import { basename as basename6, resolve as resolve15 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync10, readdirSync as readdirSync3, statSync as statSync4, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename5, resolve as resolve14 } from "path";
 
 // packages/runtime/src/control-plane/state-sync/types.ts
 var CANONICAL_TASK_LIFECYCLE_STATUSES = new Set([
@@ -2840,23 +2499,23 @@ var CANONICAL_TASK_LIFECYCLE_STATUSES = new Set([
   "cancelled"
 ]);
 // packages/runtime/src/control-plane/native/git-native.ts
-import { chmodSync, copyFileSync as copyFileSync2, existsSync as existsSync12, mkdirSync as mkdirSync4, readFileSync as readFileSync8, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { chmodSync, copyFileSync as copyFileSync2, existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync9, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { dirname as dirname8, isAbsolute, resolve as resolve14 } from "path";
+import { dirname as dirname7, isAbsolute, resolve as resolve13 } from "path";
 import { createHash } from "crypto";
-var sharedGitNativeOutputDir = resolve14(tmpdir4(), "rig-native");
-var sharedGitNativeOutputPath = resolve14(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+var sharedGitNativeOutputDir = resolve13(tmpdir4(), "rig-native");
+var sharedGitNativeOutputPath = resolve13(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
 var trackerCommandUsageProbe = "usage: rig-git fetch-ref <repo-path> <remote> <branch>";
 function temporaryGitBinaryOutputPath(outputPath) {
   const suffix2 = process.platform === "win32" ? ".exe" : "";
-  return resolve14(dirname8(outputPath), `.rig-git-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}${suffix2}`);
+  return resolve13(dirname7(outputPath), `.rig-git-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}${suffix2}`);
 }
 function publishGitBinary(tempOutputPath, outputPath) {
   try {
     renameSync2(tempOutputPath, outputPath);
   } catch (error) {
     if (process.platform === "win32" && existsSync12(outputPath)) {
-      rmSync2(outputPath, { force: true });
+      rmSync3(outputPath, { force: true });
       renameSync2(tempOutputPath, outputPath);
       return;
     }
@@ -2867,27 +2526,27 @@ function runtimeRigGitFileName() {
   return `rig-git${process.platform === "win32" ? ".exe" : ""}`;
 }
 function rigGitSourceCandidates() {
-  const execDir = process.execPath?.trim() ? dirname8(process.execPath.trim()) : "";
+  const execDir = process.execPath?.trim() ? dirname7(process.execPath.trim()) : "";
   const cwd = process.cwd()?.trim() || "";
   const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
   const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
-  const moduleRelativeSource = resolve14(import.meta.dir, "../../../native/rig-git.zig");
+  const moduleRelativeSource = resolve13(import.meta.dir, "../../../native/rig-git.zig");
   return [...new Set([
     process.env.RIG_NATIVE_GIT_SOURCE?.trim() || "",
     moduleRelativeSource,
-    projectRoot ? resolve14(projectRoot, "packages/runtime/native/rig-git.zig") : "",
-    hostProjectRoot ? resolve14(hostProjectRoot, "packages/runtime/native/rig-git.zig") : "",
-    cwd ? resolve14(cwd, "packages/runtime/native/rig-git.zig") : "",
-    execDir ? resolve14(execDir, "..", "..", "packages/runtime/native/rig-git.zig") : "",
-    execDir ? resolve14(execDir, "..", "native", "rig-git.zig") : ""
+    projectRoot ? resolve13(projectRoot, "packages/runtime/native/rig-git.zig") : "",
+    hostProjectRoot ? resolve13(hostProjectRoot, "packages/runtime/native/rig-git.zig") : "",
+    cwd ? resolve13(cwd, "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve13(execDir, "..", "..", "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve13(execDir, "..", "native", "rig-git.zig") : ""
   ].filter(Boolean))];
 }
 function nativePackageBinaryCandidates(fromDir, fileName) {
   const candidates = [];
-  let cursor = resolve14(fromDir);
+  let cursor = resolve13(fromDir);
   for (let index = 0;index < 8; index += 1) {
-    candidates.push(resolve14(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve14(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve14(cursor, "native", fileName), resolve14(cursor, "native", "bin", fileName));
-    const parent = dirname8(cursor);
+    candidates.push(resolve13(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve13(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve13(cursor, "native", fileName), resolve13(cursor, "native", "bin", fileName));
+    const parent = dirname7(cursor);
     if (parent === cursor)
       break;
     cursor = parent;
@@ -2895,15 +2554,15 @@ function nativePackageBinaryCandidates(fromDir, fileName) {
   return candidates;
 }
 function rigGitBinaryCandidates() {
-  const execDir = process.execPath?.trim() ? dirname8(process.execPath.trim()) : "";
+  const execDir = process.execPath?.trim() ? dirname7(process.execPath.trim()) : "";
   const fileName = runtimeRigGitFileName();
   const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
   return [...new Set([
     explicit,
     ...nativePackageBinaryCandidates(import.meta.dir, fileName),
-    execDir ? resolve14(execDir, fileName) : "",
-    execDir ? resolve14(execDir, "..", fileName) : "",
-    execDir ? resolve14(execDir, "..", "bin", fileName) : "",
+    execDir ? resolve13(execDir, fileName) : "",
+    execDir ? resolve13(execDir, "..", fileName) : "",
+    execDir ? resolve13(execDir, "..", "bin", fileName) : "",
     sharedGitNativeOutputPath
   ].filter(Boolean))];
 }
@@ -2954,14 +2613,14 @@ function hasMatchingNativeBuildManifestSync(manifestPath, buildKey) {
     return false;
   }
   try {
-    const manifest = JSON.parse(readFileSync8(manifestPath, "utf8"));
+    const manifest = JSON.parse(readFileSync9(manifestPath, "utf8"));
     return manifest.version === 1 && manifest.buildKey === buildKey;
   } catch {
     return false;
   }
 }
 function sha256FileSync(path) {
-  return createHash("sha256").update(readFileSync8(path)).digest("hex");
+  return createHash("sha256").update(readFileSync9(path)).digest("hex");
 }
 function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath()) {
   if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
@@ -2979,7 +2638,7 @@ function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath())
   if (!zigBinary) {
     throw new Error("zig is required to build native Rig git tools.");
   }
-  mkdirSync4(dirname8(outputPath), { recursive: true });
+  mkdirSync5(dirname7(outputPath), { recursive: true });
   const sourceDigest = sha256FileSync(sourcePath);
   const buildKey = JSON.stringify({
     version: 1,
@@ -3004,7 +2663,7 @@ function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath())
     "ReleaseFast",
     `-femit-bin=${tempOutputPath}`
   ], {
-    cwd: dirname8(sourcePath),
+    cwd: dirname7(sourcePath),
     stdout: "pipe",
     stderr: "pipe"
   });
@@ -3017,16 +2676,16 @@ function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath())
   }
   chmodSync(tempOutputPath, 493);
   if (existsSync12(outputPath) && hasMatchingNativeBuildManifestSync(manifestPath, buildKey)) {
-    rmSync2(tempOutputPath, { force: true });
+    rmSync3(tempOutputPath, { force: true });
     chmodSync(outputPath, 493);
     return outputPath;
   }
   publishGitBinary(tempOutputPath, outputPath);
   if (!binarySupportsTrackerCommandsSync(outputPath)) {
-    rmSync2(outputPath, { force: true });
+    rmSync3(outputPath, { force: true });
     throw new Error("Failed to build native Rig git tools: tracker command probe failed");
   }
-  writeFileSync4(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+  writeFileSync5(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
 `, "utf8");
   return outputPath;
 }
@@ -3135,7 +2794,7 @@ function readValidationDescriptions(projectRoot) {
   return readValidationDescriptionMap(raw);
 }
 function readSourceValidationDescriptions(projectRoot) {
-  const rootRaw = readJsonFile(resolve15(projectRoot, "rig", "task-config.json"), {});
+  const rootRaw = readJsonFile(resolve14(projectRoot, "rig", "task-config.json"), {});
   const sourcePath = findSourceTaskConfigPath(projectRoot);
   const sourceRaw = sourcePath ? readJsonFile(sourcePath, {}) : {};
   const rootDescriptions = readValidationDescriptionMap(rootRaw);
@@ -3226,16 +2885,16 @@ function lookupTask(projectRoot, input) {
 function artifactDirForId(projectRoot, id) {
   const workspaceDir = process.env.RIG_TASK_WORKSPACE?.trim();
   if (workspaceDir) {
-    const worktreeArtifacts = resolve15(workspaceDir, "artifacts", id);
-    if (existsSync13(worktreeArtifacts) || existsSync13(resolve15(workspaceDir, "artifacts"))) {
+    const worktreeArtifacts = resolve14(workspaceDir, "artifacts", id);
+    if (existsSync13(worktreeArtifacts) || existsSync13(resolve14(workspaceDir, "artifacts"))) {
       return worktreeArtifacts;
     }
   }
   try {
     const paths = resolveHarnessPaths(projectRoot);
-    return resolve15(paths.artifactsDir, id);
+    return resolve14(paths.artifactsDir, id);
   } catch {
-    return resolve15(resolveMonorepoRoot2(projectRoot), "artifacts", id);
+    return resolve14(resolveMonorepoRoot2(projectRoot), "artifacts", id);
   }
 }
 function resolveTaskConfigPath(projectRoot) {
@@ -3265,7 +2924,7 @@ function readAndSyncSourceTaskConfig(projectRoot) {
   const synced = synchronizeTaskConfigWithTracker(projectRoot, raw);
   if (sourcePath && synced.updated) {
     try {
-      writeFileSync5(sourcePath, `${JSON.stringify(synced.config, null, 2)}
+      writeFileSync6(sourcePath, `${JSON.stringify(synced.config, null, 2)}
 `, "utf-8");
     } catch {}
   }
@@ -3317,12 +2976,12 @@ function shouldRefreshAutoSyncedTaskConfigEntry(entry) {
   return !candidate.role;
 }
 function readSourceIssueRecords(projectRoot) {
-  const issuesPath = resolve15(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  const issuesPath = resolve14(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
   if (!existsSync13(issuesPath)) {
     return [];
   }
   const records = [];
-  for (const line of readFileSync9(issuesPath, "utf-8").split(/\r?\n/)) {
+  for (const line of readFileSync10(issuesPath, "utf-8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -3378,7 +3037,7 @@ function readConfiguredFileTaskConfig(projectRoot) {
   if (!sourcePath) {
     return {};
   }
-  const directory = resolve15(projectRoot, sourcePath);
+  const directory = resolve14(projectRoot, sourcePath);
   if (!existsSync13(directory)) {
     return {};
   }
@@ -3386,15 +3045,15 @@ function readConfiguredFileTaskConfig(projectRoot) {
   for (const name of readdirSync3(directory)) {
     if (!FILE_TASK_PATTERN2.test(name))
       continue;
-    const file = resolve15(directory, name);
+    const file = resolve14(directory, name);
     try {
       if (!statSync4(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync9(file, "utf8"));
+      const raw = JSON.parse(readFileSync10(file, "utf8"));
       if (!raw || typeof raw !== "object" || Array.isArray(raw))
         continue;
       const record = raw;
-      const inferredId = basename6(name).replace(FILE_TASK_PATTERN2, "");
+      const inferredId = basename5(name).replace(FILE_TASK_PATTERN2, "");
       const id = typeof record.id === "string" && record.id.trim().length > 0 ? record.id.trim() : inferredId;
       config[id] = fileTaskToConfigEntry(record, { kind: "files", path: sourcePath });
     } catch {}
@@ -3432,10 +3091,10 @@ function firstStringList2(...candidates) {
   return [];
 }
 function readConfiguredFilesTaskSourcePath2(projectRoot) {
-  const jsonPath = resolve15(projectRoot, "rig.config.json");
+  const jsonPath = resolve14(projectRoot, "rig.config.json");
   if (existsSync13(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync9(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync10(jsonPath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         const taskSource = parsed.taskSource;
         if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
@@ -3447,12 +3106,12 @@ function readConfiguredFilesTaskSourcePath2(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve15(projectRoot, "rig.config.ts");
+  const tsPath = resolve14(projectRoot, "rig.config.ts");
   if (!existsSync13(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync9(tsPath, "utf8");
+    const source = readFileSync10(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -3466,23 +3125,23 @@ function readConfiguredFilesTaskSourcePath2(projectRoot) {
 function sourceTaskConfigCandidates(projectRoot) {
   const runtimeContext = loadRuntimeContextFromEnv();
   return [
-    runtimeContext?.monorepoMainRoot ? resolve15(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
-    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve15(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
-    resolve15(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
+    runtimeContext?.monorepoMainRoot ? resolve14(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve14(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve14(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
   ].filter(Boolean);
 }
 
 // packages/runtime/src/control-plane/native/validator.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
-import { resolve as resolve20 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
+import { resolve as resolve19 } from "path";
 
 // packages/runtime/src/control-plane/native/validator-binaries.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync6, rmSync as rmSync4, statSync as statSync5 } from "fs";
-import { dirname as dirname10, resolve as resolve19 } from "path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync7, rmSync as rmSync5, statSync as statSync5 } from "fs";
+import { dirname as dirname9, resolve as resolve18 } from "path";
 
 // packages/runtime/src/binary-run.ts
-import { chmodSync as chmodSync2, cpSync, existsSync as existsSync14, mkdirSync as mkdirSync5, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename7, dirname as dirname9, resolve as resolve16 } from "path";
+import { chmodSync as chmodSync2, cpSync, existsSync as existsSync14, mkdirSync as mkdirSync6, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync7 } from "fs";
+import { basename as basename6, dirname as dirname8, resolve as resolve15 } from "path";
 import { fileURLToPath } from "url";
 import { drainMicrotasks, gcAndSweep } from "bun:jsc";
 var runtimeBinaryBuildQueue = Promise.resolve();
@@ -3508,9 +3167,9 @@ async function buildRuntimeBinary(options) {
   });
 }
 async function buildRuntimeBinaryInProcess(options, manifest) {
-  const tempBuildDir = resolve16(dirname9(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-  const tempOutputPath = resolve16(tempBuildDir, basename7(options.outputPath));
-  mkdirSync5(tempBuildDir, { recursive: true });
+  const tempBuildDir = resolve15(dirname8(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  const tempOutputPath = resolve15(tempBuildDir, basename6(options.outputPath));
+  mkdirSync6(tempBuildDir, { recursive: true });
   await withTemporaryEnv({
     ...options.env,
     ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
@@ -3550,7 +3209,7 @@ async function buildRuntimeBinaryInProcess(options, manifest) {
       });
     }
   })).finally(() => {
-    rmSync3(tempBuildDir, { recursive: true, force: true });
+    rmSync4(tempBuildDir, { recursive: true, force: true });
   });
 }
 function runBestEffortBuildGc() {
@@ -3567,8 +3226,8 @@ function runtimeBinaryCacheManifestPath(outputPath) {
 function resolveRuntimeBinaryBuildOptions(options) {
   return {
     ...options,
-    entrypoint: resolve16(options.cwd, options.sourcePath),
-    outputPath: resolve16(options.outputPath)
+    entrypoint: resolve15(options.cwd, options.sourcePath),
+    outputPath: resolve15(options.outputPath)
   };
 }
 function shouldUseRuntimeBinaryBuildWorker() {
@@ -3613,13 +3272,13 @@ async function buildRuntimeBinaryViaWorker(options) {
     new Response(build.stdout).text(),
     new Response(build.stderr).text()
   ]);
-  rmSync3(payloadPath, { force: true });
+  rmSync4(payloadPath, { force: true });
   if (exitCode !== 0) {
     throw new Error(`Failed to build ${options.entrypoint}: ${(stderr || stdout || `worker exited ${exitCode}`).trim()}`);
   }
 }
 function createRuntimeBinaryBuildWorkerPayloadPath(outputPath) {
-  return resolve16(dirname9(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+  return resolve15(dirname8(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
 }
 function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
   const envRoots = [
@@ -3628,12 +3287,12 @@ function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
     process.env.PROJECT_RIG_ROOT?.trim()
   ].filter(Boolean);
   for (const root of envRoots) {
-    const candidate = resolve16(root, "packages/runtime/src/binary-build-worker.ts");
+    const candidate = resolve15(root, "packages/runtime/src/binary-build-worker.ts");
     if (existsSync14(candidate)) {
       return candidate;
     }
   }
-  const localCandidate = resolve16(import.meta.dir, "binary-build-worker.ts");
+  const localCandidate = resolve15(import.meta.dir, "binary-build-worker.ts");
   return existsSync14(localCandidate) ? localCandidate : null;
 }
 function resolveRuntimeBinaryBuildWorkerInvocation() {
@@ -3719,7 +3378,7 @@ function normalizeBuildInputPath(cwd, inputPath) {
   if (inputPath.startsWith("<")) {
     return null;
   }
-  return resolve16(cwd, inputPath);
+  return resolve15(cwd, inputPath);
 }
 async function sha256File(path) {
   const hasher = new Bun.CryptoHasher("sha256");
@@ -3735,8 +3394,8 @@ function sortRecord(value) {
 async function runSerializedRuntimeBinaryBuild(action) {
   const previous = runtimeBinaryBuildQueue;
   let release;
-  runtimeBinaryBuildQueue = new Promise((resolve17) => {
-    release = resolve17;
+  runtimeBinaryBuildQueue = new Promise((resolve16) => {
+    release = resolve16;
   });
   await previous;
   try {
@@ -3781,11 +3440,11 @@ async function withTemporaryCwd(cwd, action) {
 }
 
 // packages/runtime/src/control-plane/runtime/provisioning-env.ts
-import { delimiter, resolve as resolve18 } from "path";
+import { delimiter, resolve as resolve17 } from "path";
 
 // packages/runtime/src/control-plane/runtime/runtime-paths.ts
 import { existsSync as existsSync15, readdirSync as readdirSync4, realpathSync } from "fs";
-import { resolve as resolve17 } from "path";
+import { resolve as resolve16 } from "path";
 
 // packages/runtime/src/control-plane/runtime/sandbox/utils.ts
 function uniq(values) {
@@ -3803,7 +3462,7 @@ function resolveBunBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve17(home, ".bun/bin/bun") : "",
+    home ? resolve16(home, ".bun/bin/bun") : "",
     "/opt/homebrew/bin/bun",
     "/usr/local/bin/bun",
     "/usr/bin/bun"
@@ -3831,8 +3490,8 @@ function resolveClaudeBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve17(home, ".local/bin/claude") : "",
-    home ? resolve17(home, ".local/share/claude/local/claude") : "",
+    home ? resolve16(home, ".local/bin/claude") : "",
+    home ? resolve16(home, ".local/share/claude/local/claude") : "",
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude",
     "/usr/bin/claude"
@@ -3846,51 +3505,51 @@ function resolveClaudeBinaryPath() {
   throw new Error("claude not found in PATH");
 }
 function resolveBunInstallDir(bunBinaryPath = resolveBunBinaryPath()) {
-  return resolve17(bunBinaryPath, "../..");
+  return resolve16(bunBinaryPath, "../..");
 }
 function resolveClaudeInstallDir() {
   const realPath = resolveClaudeBinaryPath();
-  return resolve17(realPath, "..");
+  return resolve16(realPath, "..");
 }
 function resolveNodeInstallDir() {
   const preferredNode = resolvePreferredNodeBinary();
   if (!preferredNode)
     return null;
   const explicitNode = process.env.RIG_NODE_BIN?.trim();
-  if (explicitNode && resolve17(explicitNode) === resolve17(preferredNode)) {
-    return preferredNode.endsWith("/bin/node") ? resolve17(preferredNode, "../..") : resolve17(preferredNode, "..");
+  if (explicitNode && resolve16(explicitNode) === resolve16(preferredNode)) {
+    return preferredNode.endsWith("/bin/node") ? resolve16(preferredNode, "../..") : resolve16(preferredNode, "..");
   }
   try {
     const realPath = realpathSync(preferredNode);
     if (realPath.endsWith("/bin/node")) {
-      return resolve17(realPath, "../..");
+      return resolve16(realPath, "../..");
     }
-    return resolve17(realPath, "..");
+    return resolve16(realPath, "..");
   } catch {
-    return resolve17(preferredNode, "..");
+    return resolve16(preferredNode, "..");
   }
 }
 function resolvePreferredNodeBinary() {
   const candidates = [];
   const envNode = process.env.RIG_NODE_BIN?.trim();
   if (envNode) {
-    const explicit = resolve17(envNode);
+    const explicit = resolve16(envNode);
     if (existsSync15(explicit)) {
       return explicit;
     }
   }
   const nvmBin = process.env.NVM_BIN?.trim();
   if (nvmBin) {
-    candidates.push(resolve17(nvmBin, "node"));
+    candidates.push(resolve16(nvmBin, "node"));
   }
   const home = process.env.HOME?.trim();
   if (home) {
-    const nvmVersionsDir = resolve17(home, ".nvm/versions/node");
+    const nvmVersionsDir = resolve16(home, ".nvm/versions/node");
     if (existsSync15(nvmVersionsDir)) {
       try {
         const versionDirs = readdirSync4(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
         for (const versionDir of versionDirs) {
-          candidates.push(resolve17(nvmVersionsDir, versionDir, "bin/node"));
+          candidates.push(resolve16(nvmVersionsDir, versionDir, "bin/node"));
         }
       } catch {}
     }
@@ -3899,7 +3558,7 @@ function resolvePreferredNodeBinary() {
   if (whichNode) {
     candidates.push(whichNode);
   }
-  const deduped = uniq(candidates.map((candidate) => resolve17(candidate)));
+  const deduped = uniq(candidates.map((candidate) => resolve16(candidate)));
   const existing = deduped.filter((candidate) => existsSync15(candidate));
   if (existing.length === 0) {
     return null;
@@ -3914,7 +3573,7 @@ function resolvePreferredNodeBinary() {
   return existing[0] ?? null;
 }
 function inferNodeMajor(nodeBinaryPath) {
-  const normalized = resolve17(nodeBinaryPath).replace(/\\/g, "/");
+  const normalized = resolve16(nodeBinaryPath).replace(/\\/g, "/");
   const match = normalized.match(/(?:^|\/)(?:node-)?v?(\d+)\.\d+\.\d+(?:\/|$)/);
   if (!match) {
     return null;
@@ -3926,7 +3585,7 @@ function normalizeExecutablePath(candidate) {
   if (!candidate) {
     return "";
   }
-  const normalized = resolve17(candidate);
+  const normalized = resolve16(candidate);
   if (!existsSync15(normalized)) {
     return "";
   }
@@ -3937,7 +3596,7 @@ function normalizeExecutablePath(candidate) {
   }
 }
 function looksLikeRuntimeGateway(candidate) {
-  const normalized = resolve17(candidate).replace(/\\/g, "/");
+  const normalized = resolve16(candidate).replace(/\\/g, "/");
   return normalized.includes("/.rig/bin/") || normalized.endsWith("/rig-shell") || normalized.endsWith("/rig-agent");
 }
 
@@ -3958,7 +3617,7 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     try {
       return resolveClaudeInstallDir();
     } catch {
-      return resolve18(claudeBinary, "..");
+      return resolve17(claudeBinary, "..");
     }
   })() : "";
   const nodeDir = resolveNodeInstallDir();
@@ -3968,8 +3627,8 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     `${bunDir}/bin`,
     claudeDir,
     nodeDir ? `${nodeDir}/bin` : "",
-    realHome ? resolve18(realHome, ".local/bin") : "",
-    realHome ? resolve18(realHome, ".cargo/bin") : "",
+    realHome ? resolve17(realHome, ".local/bin") : "",
+    realHome ? resolve17(realHome, ".cargo/bin") : "",
     ...inheritedPath,
     "/usr/local/bin",
     "/usr/local/sbin",
@@ -4000,9 +3659,9 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
 // packages/runtime/src/control-plane/native/validator-binaries.ts
 function resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext) {
   if (runtimeContext) {
-    return resolve19(runtimeContext.binDir, "validators", binaryName);
+    return resolve18(runtimeContext.binDir, "validators", binaryName);
   }
-  return resolve19(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
+  return resolve18(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
 }
 async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
   const match = checkId.match(/^([a-z][\w-]*):([a-z][\w-]*)$/);
@@ -4017,7 +3676,7 @@ async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
   const binaryName = `${category}-${check}`;
   const binaryPath = resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
   const hostProjectRoot = runtimeContext?.hostProjectRoot?.trim() || projectRoot;
-  const sourcePath = resolve19(hostProjectRoot, "packages/runtime/src/control-plane/validators", category, `${check}.ts`);
+  const sourcePath = resolve18(hostProjectRoot, "packages/runtime/src/control-plane/validators", category, `${check}.ts`);
   if (!existsSync16(sourcePath)) {
     return null;
   }
@@ -4026,10 +3685,10 @@ async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
   const binaryMtime = binaryExists ? statSync5(binaryPath).mtimeMs : 0;
   if (!binaryExists || sourceMtime > binaryMtime) {
     if (binaryExists) {
-      rmSync4(binaryPath, { force: true });
-      rmSync4(`${binaryPath}.build-manifest.json`, { force: true });
+      rmSync5(binaryPath, { force: true });
+      rmSync5(`${binaryPath}.build-manifest.json`, { force: true });
     }
-    mkdirSync6(dirname10(binaryPath), { recursive: true });
+    mkdirSync7(dirname9(binaryPath), { recursive: true });
     await buildRuntimeBinary({
       sourcePath: `packages/runtime/src/control-plane/validators/${category}/${check}.ts`,
       outputPath: binaryPath,
@@ -4075,14 +3734,14 @@ async function readTaskSourceValidation(projectRoot, taskId) {
 function resolveValidationPaths(projectRoot, taskId, runtimeContext) {
   if (runtimeContext) {
     return {
-      taskLogDir: resolve20(runtimeContext.logsDir, taskId),
-      artifactDir: resolve20(runtimeContext.workspaceDir, "artifacts", taskId)
+      taskLogDir: resolve19(runtimeContext.logsDir, taskId),
+      artifactDir: resolve19(runtimeContext.workspaceDir, "artifacts", taskId)
     };
   }
   const paths = resolveHarnessPaths(projectRoot);
   return {
-    taskLogDir: resolve20(paths.logsDir, taskId),
-    artifactDir: resolve20(paths.artifactsDir, taskId)
+    taskLogDir: resolve19(paths.logsDir, taskId),
+    artifactDir: resolve19(paths.artifactsDir, taskId)
   };
 }
 async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext) {
@@ -4099,7 +3758,7 @@ async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext)
     };
   }
   const validatorCwd = runtimeContext?.workspaceDir || resolveMonorepoRoot(projectRoot);
-  const runtimeShellPath = runtimeContext ? resolve20(runtimeContext.binDir, "rig-shell") : "";
+  const runtimeShellPath = runtimeContext ? resolve19(runtimeContext.binDir, "rig-shell") : "";
   const monorepoMainRoot = runtimeContext?.monorepoMainRoot || process.env.MONOREPO_MAIN_ROOT?.trim() || resolveMonorepoRoot(projectRoot);
   const validatorEnv = {
     PROJECT_RIG_ROOT: runtimeContext?.hostProjectRoot || projectRoot,
@@ -4154,8 +3813,8 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
   const configuredValidation = stringArray(taskConfig[taskId]?.validation);
   const commands = resolvedContext?.validation?.length ? resolvedContext.validation : configuredValidation.length > 0 ? configuredValidation : sourceValidation.validation;
   const { taskLogDir, artifactDir } = resolveValidationPaths(projectRoot, taskId, resolvedContext);
-  mkdirSync7(taskLogDir, { recursive: true });
-  mkdirSync7(artifactDir, { recursive: true });
+  mkdirSync8(taskLogDir, { recursive: true });
+  mkdirSync8(artifactDir, { recursive: true });
   if (commands.length === 0) {
     const skipped = {
       status: "skipped",
@@ -4164,7 +3823,7 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
       failed: 0,
       categories: []
     };
-    writeFileSync7(resolve20(artifactDir, "validation-summary.json"), `${JSON.stringify(skipped, null, 2)}
+    writeFileSync8(resolve19(artifactDir, "validation-summary.json"), `${JSON.stringify(skipped, null, 2)}
 `, "utf-8");
     return skipped;
   }
@@ -4199,18 +3858,18 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
         exit_code: 2,
         duration_seconds: 0
       });
-      const logFile2 = resolve20(taskLogDir, `invalid-entry-validation.log`);
-      mkdirSync7(taskLogDir, { recursive: true });
-      writeFileSync7(logFile2, `=== ${nowIso()} :: ${cmd} ===
+      const logFile2 = resolve19(taskLogDir, `invalid-entry-validation.log`);
+      mkdirSync8(taskLogDir, { recursive: true });
+      writeFileSync8(logFile2, `=== ${nowIso()} :: ${cmd} ===
 Invalid validation entry: not a check-ID. All entries must use format "category:check-name".
 `, "utf-8");
       continue;
     }
     const { result, exitCode } = await dispatchValidator(cmd, effectiveRegistry, validatorCtx, (id) => runValidatorBinary(projectRoot, taskId, id, resolvedContext));
     const durationSeconds = Math.max(0, Math.round((Date.now() - startedAt) / 1000));
-    const logFile = resolve20(taskLogDir, `${cmd.replace(":", "-")}-validation.log`);
-    mkdirSync7(taskLogDir, { recursive: true });
-    writeFileSync7(logFile, `=== ${nowIso()} :: ${cmd} ===
+    const logFile = resolve19(taskLogDir, `${cmd.replace(":", "-")}-validation.log`);
+    mkdirSync8(taskLogDir, { recursive: true });
+    writeFileSync8(logFile, `=== ${nowIso()} :: ${cmd} ===
 ${JSON.stringify(result, null, 2)}
 `, "utf-8");
     if (result.passed) {
@@ -4232,19 +3891,19 @@ ${JSON.stringify(result, null, 2)}
     failed,
     categories
   };
-  mkdirSync7(artifactDir, { recursive: true });
-  writeFileSync7(resolve20(artifactDir, "validation-summary.json"), `${JSON.stringify(summary, null, 2)}
+  mkdirSync8(artifactDir, { recursive: true });
+  writeFileSync8(resolve19(artifactDir, "validation-summary.json"), `${JSON.stringify(summary, null, 2)}
 `, "utf-8");
   return summary;
 }
 
 // packages/runtime/src/control-plane/native/verifier.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
-import { resolve as resolve22 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
+import { resolve as resolve21 } from "path";
 
 // packages/runtime/src/control-plane/native/pr-review-gate.ts
-import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
-import { resolve as resolve21 } from "path";
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
+import { resolve as resolve20 } from "path";
 function parseJsonObject(value) {
   if (!value?.trim())
     return { value: {}, error: "empty JSON output" };
@@ -5568,34 +5227,34 @@ function buildStrictPrGateSteeringPrompt(result) {
 }
 function persistPrReviewCycleArtifacts(input) {
   const cycleName = input.final ? `${input.cycle}-final` : String(input.cycle);
-  const taskArtifactRoot = input.artifactRoot?.trim() ? input.artifactRoot : resolve21(input.projectRoot, "artifacts", input.taskId);
-  const root = resolve21(taskArtifactRoot, "pr-review-cycles", cycleName);
-  mkdirSync8(root, { recursive: true });
-  const finalMergeGateResultPath = input.final ? resolve21(taskArtifactRoot, "merge-gate-final.json") : undefined;
+  const taskArtifactRoot = input.artifactRoot?.trim() ? input.artifactRoot : resolve20(input.projectRoot, "artifacts", input.taskId);
+  const root = resolve20(taskArtifactRoot, "pr-review-cycles", cycleName);
+  mkdirSync9(root, { recursive: true });
+  const finalMergeGateResultPath = input.final ? resolve20(taskArtifactRoot, "merge-gate-final.json") : undefined;
   const paths = {
     root,
-    prTitlePath: resolve21(root, "pr-title.md"),
-    prBodyPath: resolve21(root, "pr-body.md"),
-    prCommentsPath: resolve21(root, "pr-comments.json"),
-    reviewThreadsPath: resolve21(root, "review-threads.json"),
-    reviewCommentsPath: resolve21(root, "review-comments.json"),
-    checkRollupPath: resolve21(root, "check-rollup.json"),
-    greptileEvidencePath: resolve21(root, "greptile-evidence.json"),
-    mergeGateResultPath: resolve21(root, "merge-gate-result.json"),
-    steeringPromptPath: resolve21(root, "agent-steering-prompt.md"),
+    prTitlePath: resolve20(root, "pr-title.md"),
+    prBodyPath: resolve20(root, "pr-body.md"),
+    prCommentsPath: resolve20(root, "pr-comments.json"),
+    reviewThreadsPath: resolve20(root, "review-threads.json"),
+    reviewCommentsPath: resolve20(root, "review-comments.json"),
+    checkRollupPath: resolve20(root, "check-rollup.json"),
+    greptileEvidencePath: resolve20(root, "greptile-evidence.json"),
+    mergeGateResultPath: resolve20(root, "merge-gate-result.json"),
+    steeringPromptPath: resolve20(root, "agent-steering-prompt.md"),
     ...finalMergeGateResultPath ? { finalMergeGateResultPath } : {}
   };
-  writeFileSync8(paths.prTitlePath, input.result.evidence.title || "", "utf8");
-  writeFileSync8(paths.prBodyPath, input.result.evidence.body || "", "utf8");
-  writeFileSync8(paths.prCommentsPath, `${JSON.stringify(input.result.evidence.relevantIssueComments, null, 2)}
+  writeFileSync9(paths.prTitlePath, input.result.evidence.title || "", "utf8");
+  writeFileSync9(paths.prBodyPath, input.result.evidence.body || "", "utf8");
+  writeFileSync9(paths.prCommentsPath, `${JSON.stringify(input.result.evidence.relevantIssueComments, null, 2)}
 `, "utf8");
-  writeFileSync8(paths.reviewThreadsPath, `${JSON.stringify(input.result.evidence.reviewThreads, null, 2)}
+  writeFileSync9(paths.reviewThreadsPath, `${JSON.stringify(input.result.evidence.reviewThreads, null, 2)}
 `, "utf8");
-  writeFileSync8(paths.reviewCommentsPath, `${JSON.stringify(input.result.evidence.changedFileReviewComments, null, 2)}
+  writeFileSync9(paths.reviewCommentsPath, `${JSON.stringify(input.result.evidence.changedFileReviewComments, null, 2)}
 `, "utf8");
-  writeFileSync8(paths.checkRollupPath, `${JSON.stringify(input.result.evidence.statusCheckRollup, null, 2)}
+  writeFileSync9(paths.checkRollupPath, `${JSON.stringify(input.result.evidence.statusCheckRollup, null, 2)}
 `, "utf8");
-  writeFileSync8(paths.greptileEvidencePath, `${JSON.stringify(input.result.evidence.greptile, null, 2)}
+  writeFileSync9(paths.greptileEvidencePath, `${JSON.stringify(input.result.evidence.greptile, null, 2)}
 `, "utf8");
   const mergeGatePayload = {
     approved: input.result.approved,
@@ -5612,13 +5271,13 @@ function persistPrReviewCycleArtifacts(input) {
     evidence: input.result.evidence,
     cycleArtifactRoot: root
   };
-  writeFileSync8(paths.mergeGateResultPath, `${JSON.stringify(mergeGatePayload, null, 2)}
+  writeFileSync9(paths.mergeGateResultPath, `${JSON.stringify(mergeGatePayload, null, 2)}
 `, "utf8");
   if (paths.finalMergeGateResultPath) {
-    writeFileSync8(paths.finalMergeGateResultPath, `${JSON.stringify(mergeGatePayload, null, 2)}
+    writeFileSync9(paths.finalMergeGateResultPath, `${JSON.stringify(mergeGatePayload, null, 2)}
 `, "utf8");
   }
-  writeFileSync8(paths.steeringPromptPath, input.steeringPrompt, "utf8");
+  writeFileSync9(paths.steeringPromptPath, input.steeringPrompt, "utf8");
   return paths;
 }
 async function runStrictPrMergeGate(input) {
@@ -5635,7 +5294,7 @@ async function runStrictPrMergeGate(input) {
     final: input.final
   });
   const steeringPrompt = buildStrictPrGateSteeringPrompt({ ...base, artifacts });
-  writeFileSync8(artifacts.steeringPromptPath, steeringPrompt, "utf8");
+  writeFileSync9(artifacts.steeringPromptPath, steeringPrompt, "utf8");
   return { ...base, artifacts, steeringPrompt };
 }
 
@@ -5645,11 +5304,11 @@ async function verifyTask(options) {
   const taskId = options.taskId;
   const normalizedTaskId = lookupTask(options.projectRoot, taskId);
   const artifactDir = artifactDirForId(options.projectRoot, taskId);
-  mkdirSync9(artifactDir, { recursive: true });
-  const validationSummaryPath = resolve22(artifactDir, "validation-summary.json");
-  const reviewFeedbackPath = resolve22(artifactDir, "review-feedback.md");
-  const reviewStatePath = resolve22(artifactDir, "review-state.json");
-  const greptileRawPath = resolve22(artifactDir, "review-greptile-raw.json");
+  mkdirSync10(artifactDir, { recursive: true });
+  const validationSummaryPath = resolve21(artifactDir, "validation-summary.json");
+  const reviewFeedbackPath = resolve21(artifactDir, "review-feedback.md");
+  const reviewStatePath = resolve21(artifactDir, "review-state.json");
+  const greptileRawPath = resolve21(artifactDir, "review-greptile-raw.json");
   const prStates = readPrMetadata(options.projectRoot, taskId);
   const prState = prStates[0] || null;
   const localReasons = [];
@@ -5670,12 +5329,12 @@ async function verifyTask(options) {
     }
   }
   for (const file of ["task-result.json", "decision-log.md", "next-actions.md", "changed-files.txt"]) {
-    const requiredPath = resolve22(artifactDir, file);
+    const requiredPath = resolve21(artifactDir, file);
     if (!existsSync18(requiredPath)) {
       localReasons.push(`[Artifact Quality] Missing required artifact file: ${requiredPath}`);
     }
   }
-  const taskResultPath = resolve22(artifactDir, "task-result.json");
+  const taskResultPath = resolve21(artifactDir, "task-result.json");
   if (existsSync18(taskResultPath)) {
     const taskResult = await readJsonFile2(taskResultPath);
     const artifactStatus = typeof taskResult?.status === "string" ? taskResult.status.trim().toLowerCase() : "";
@@ -5689,7 +5348,7 @@ async function verifyTask(options) {
       localReasons.push("[Artifact Quality] task-result.json next actions indicate remaining implementation scope.");
     }
   }
-  const nextActionsPath = resolve22(artifactDir, "next-actions.md");
+  const nextActionsPath = resolve21(artifactDir, "next-actions.md");
   if (existsSync18(nextActionsPath)) {
     const nextActionsContent = await Bun.file(nextActionsPath).text();
     if (nextActionsContent.includes("TODO: Replace this scaffold") || nextActionsContent.includes("bd-<downstream-task-id>")) {
@@ -5703,12 +5362,6 @@ async function verifyTask(options) {
   if (sourceCloseoutIssueId) {
     localReasons.push(...evaluateGithubSourceIssuePrCloseout(options.projectRoot, prStates, sourceCloseoutIssueId));
   }
-  const pluginResults = await options.plugins.runValidators(taskId);
-  for (const result of pluginResults) {
-    if (!result.passed) {
-      localReasons.push(`[Plugin Validator] ${result.id}: ${result.summary}`);
-    }
-  }
   const reviewMode = await loadReviewMode(paths.reviewProfilePath, process.env.AI_REVIEW_MODE || "advisory");
   const reviewProvider = await loadReviewProvider(paths.reviewProfilePath, process.env.AI_REVIEW_PROVIDER || "greptile");
   if (!options.skipAiReview && localReasons.length === 0 && reviewProvider === "greptile" && reviewMode !== "off") {
@@ -5727,7 +5380,7 @@ async function verifyTask(options) {
       aiReasons.push(`[AI Review] Required mode needs a completed Greptile approval; current verdict is ${ai.verdict}.`);
     }
     if (persistArtifacts && ai.rawResponse) {
-      writeFileSync9(greptileRawPath, `${ai.rawResponse}
+      writeFileSync10(greptileRawPath, `${ai.rawResponse}
 `, "utf-8");
     }
   } else if (!options.skipAiReview && reviewMode === "off") {
@@ -6236,7 +5889,7 @@ function writeFeedbackFile(options) {
   if (options.aiRawFeedback) {
     lines.push("## Raw Reviewer Feedback", "", "```text", options.aiRawFeedback, "```", "");
   }
-  writeFileSync9(options.output, `${lines.join(`
+  writeFileSync10(options.output, `${lines.join(`
 `)}
 `, "utf-8");
 }
@@ -6253,7 +5906,7 @@ function writeReviewStateFile(options) {
     ai_warnings: options.aiWarnings,
     updated_at: nowIso()
   };
-  writeFileSync9(options.output, `${JSON.stringify(payload, null, 2)}
+  writeFileSync10(options.output, `${JSON.stringify(payload, null, 2)}
 `, "utf-8");
 }
 async function runGreptileReviewForPr(options) {
@@ -7040,7 +6693,7 @@ function filterActionableGithubGreptileThreads(threads) {
 }
 function resolvePrRepoRoot(projectRoot, prState) {
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  if (prState.target === "monorepo" && runtimeWorkspace && existsSync18(resolve22(runtimeWorkspace, ".git"))) {
+  if (prState.target === "monorepo" && runtimeWorkspace && existsSync18(resolve21(runtimeWorkspace, ".git"))) {
     return runtimeWorkspace;
   }
   const paths = resolveHarnessPaths(projectRoot);
@@ -7108,14 +6761,14 @@ function taskArtifacts(projectRoot, taskId) {
     throw new Error("No active task.");
   }
   const paths = resolveHarnessPaths(projectRoot);
-  const artifactDir = resolve23(paths.artifactsDir, activeTask);
-  mkdirSync10(artifactDir, { recursive: true });
+  const artifactDir = resolve22(paths.artifactsDir, activeTask);
+  mkdirSync11(artifactDir, { recursive: true });
   const changed = changedFilesForTask(projectRoot, activeTask, true);
-  writeFileSync10(resolve23(artifactDir, "changed-files.txt"), `${changed.join(`
+  writeFileSync11(resolve22(artifactDir, "changed-files.txt"), `${changed.join(`
 `)}
 `, "utf-8");
   console.log(`changed-files.txt: ${changed.length} files`);
-  const taskResultPath = resolve23(artifactDir, "task-result.json");
+  const taskResultPath = resolve22(artifactDir, "task-result.json");
   if (!existsSync19(taskResultPath)) {
     const template = {
       task_id: activeTask,
@@ -7123,24 +6776,24 @@ function taskArtifacts(projectRoot, taskId) {
       summary: "TODO: Write a one-line summary of what you did",
       completed_at: nowIso()
     };
-    writeFileSync10(taskResultPath, `${JSON.stringify(template, null, 2)}
+    writeFileSync11(taskResultPath, `${JSON.stringify(template, null, 2)}
 `, "utf-8");
     console.log("task-result.json: created (update the summary!)");
   } else {
     console.log("task-result.json: already exists");
   }
-  const decisionLogPath = resolve23(artifactDir, "decision-log.md");
+  const decisionLogPath = resolve22(artifactDir, "decision-log.md");
   if (!existsSync19(decisionLogPath)) {
     const content = `# Decision Log: ${activeTask}
 
 Record key decisions here using: rig-agent record decision "..."
 `;
-    writeFileSync10(decisionLogPath, content, "utf-8");
+    writeFileSync11(decisionLogPath, content, "utf-8");
     console.log("decision-log.md: created (record your decisions!)");
   } else {
     console.log("decision-log.md: already exists");
   }
-  const nextActionsPath = resolve23(artifactDir, "next-actions.md");
+  const nextActionsPath = resolve22(artifactDir, "next-actions.md");
   if (!existsSync19(nextActionsPath)) {
     const content = [
       `# Next Actions: ${activeTask}`,
@@ -7158,12 +6811,12 @@ Record key decisions here using: rig-agent record decision "..."
       ""
     ].join(`
 `);
-    writeFileSync10(nextActionsPath, content, "utf-8");
+    writeFileSync11(nextActionsPath, content, "utf-8");
     console.log("next-actions.md: created (add recommendations for downstream tasks!)");
   } else {
     console.log("next-actions.md: already exists");
   }
-  const validationSummaryPath = resolve23(artifactDir, "validation-summary.json");
+  const validationSummaryPath = resolve22(artifactDir, "validation-summary.json");
   if (existsSync19(validationSummaryPath)) {
     console.log("validation-summary.json: already exists");
   } else {
@@ -7230,7 +6883,7 @@ function collectTaskChangedFiles(projectRoot, taskId, includeCommitted) {
     [projectRoot, ""],
     [monorepoRepoRoot, ""]
   ]) {
-    if (!existsSync19(resolve23(repo, ".git"))) {
+    if (!existsSync19(resolve22(repo, ".git"))) {
       continue;
     }
     if (includeCommitted && repo === monorepoRepoRoot) {
@@ -7268,8 +6921,8 @@ function filterTaskChangedFiles(projectRoot, taskId, files, scoped) {
 }
 function resolveTaskMonorepoRoot(projectRoot) {
   const runtimeWorkspace = loadRuntimeContextFromEnv()?.workspaceDir || process.env.RIG_TASK_WORKSPACE?.trim();
-  if (runtimeWorkspace && existsSync19(resolve23(runtimeWorkspace, ".git"))) {
-    return resolve23(runtimeWorkspace);
+  if (runtimeWorkspace && existsSync19(resolve22(runtimeWorkspace, ".git"))) {
+    return resolve22(runtimeWorkspace);
   }
   return resolveHarnessPaths(projectRoot).monorepoRoot;
 }
@@ -7297,7 +6950,7 @@ function resolveRuntimeInitialHeadCommit(projectRoot, repo) {
   const runtimeContext = loadRuntimeContextFromEnv();
   if (runtimeContext?.initialHeadCommits?.monorepo?.trim()) {
     const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
-    if (resolve23(monorepoRoot) === resolve23(repo)) {
+    if (resolve22(monorepoRoot) === resolve22(repo)) {
       return runtimeContext.initialHeadCommits.monorepo.trim();
     }
   }
@@ -7307,7 +6960,7 @@ function resolveMonorepoBaseCommit(projectRoot, repo) {
   const runtimeContext = loadRuntimeContextFromEnv();
   if (runtimeContext?.monorepoBaseCommit?.trim()) {
     const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
-    if (resolve23(monorepoRoot) === resolve23(repo)) {
+    if (resolve22(monorepoRoot) === resolve22(repo)) {
       return runtimeContext.monorepoBaseCommit.trim();
     }
   }
@@ -7341,7 +6994,7 @@ function resolveRuntimeDirtyBaseline(projectRoot, repo) {
     return new Set;
   }
   const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
-  const selected = resolve23(repo) === resolve23(monorepoRoot) ? dirtyFiles.monorepo : resolve23(repo) === resolve23(projectRoot) ? dirtyFiles.project : undefined;
+  const selected = resolve22(repo) === resolve22(monorepoRoot) ? dirtyFiles.monorepo : resolve22(repo) === resolve22(projectRoot) ? dirtyFiles.project : undefined;
   return new Set((selected || []).map((file) => normalizeChangedFilePath(file)).filter(Boolean));
 }
 function normalizeChangedFilePath(file) {
@@ -7399,8 +7052,8 @@ function isRuntimeGatewayGhPath(candidate) {
 }
 function resolveOptionalMonorepoRoot(projectRoot) {
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  if (runtimeWorkspace && existsSync20(resolve24(runtimeWorkspace, ".git"))) {
-    return resolve24(runtimeWorkspace);
+  if (runtimeWorkspace && existsSync20(resolve23(runtimeWorkspace, ".git"))) {
+    return resolve23(runtimeWorkspace);
   }
   try {
     return resolveMonorepoRoot2(projectRoot);
@@ -7452,7 +7105,7 @@ function gitSyncBranch(projectRoot, taskId, targetRepo = "monorepo") {
   }
   const repoRoot = targetRepo === "monorepo" ? resolveOptionalMonorepoRoot(projectRoot) || resolveMonorepoRoot2(projectRoot) : projectRoot;
   const repoLabel = targetRepo === "monorepo" ? "Monorepo" : "Project";
-  if (!existsSync20(resolve24(repoRoot, ".git"))) {
+  if (!existsSync20(resolve23(repoRoot, ".git"))) {
     throw new Error(`${repoLabel} repo not found at ${repoRoot}`);
   }
   const branchId = resolveTaskBranchId(projectRoot, resolvedTask);
@@ -7512,7 +7165,7 @@ function gitOpenPr(options) {
   } else if (taskId) {
     gitSyncBranch(options.projectRoot, taskId, "project");
   }
-  if (!existsSync20(resolve24(repoRoot, ".git"))) {
+  if (!existsSync20(resolve23(repoRoot, ".git"))) {
     throw new Error(`Repository not available for open-pr target ${target}: ${repoRoot}`);
   }
   const branch = branchName(options.projectRoot, repoRoot);
@@ -7745,7 +7398,7 @@ function gitMergePr(options) {
   }
   const repoRoot = resolveRepoRoot(options.projectRoot, options.pr.target);
   const repoNameWithOwner = resolveRepoNameWithOwner(options.projectRoot, repoRoot);
-  if (!existsSync20(resolve24(repoRoot, ".git"))) {
+  if (!existsSync20(resolve23(repoRoot, ".git"))) {
     throw new Error(`Repository not available for merge-pr target ${options.pr.target}: ${repoRoot}`);
   }
   const prState = readPrViewState(gh, repoRoot, repoNameWithOwner, options.pr.url);
@@ -7806,12 +7459,12 @@ function assertPrHasNoGitConflicts(prState, repoLabel, baseRef) {
 }
 function writePrMetadata(projectRoot, taskId, result) {
   const dir = artifactDirForId(projectRoot, taskId);
-  mkdirSync11(dir, { recursive: true });
-  const path = resolve24(dir, "pr-state.json");
+  mkdirSync12(dir, { recursive: true });
+  const path = resolve23(dir, "pr-state.json");
   let prs = {};
   if (existsSync20(path)) {
     try {
-      const parsed = JSON.parse(readFileSync11(path, "utf-8"));
+      const parsed = JSON.parse(readFileSync12(path, "utf-8"));
       if (parsed && typeof parsed === "object" && parsed.prs && typeof parsed.prs === "object") {
         prs = parsed.prs;
       }
@@ -7827,16 +7480,16 @@ function writePrMetadata(projectRoot, taskId, result) {
     ...primary || {},
     updated_at: nowIso()
   };
-  writeFileSync11(path, `${JSON.stringify(artifact, null, 2)}
+  writeFileSync12(path, `${JSON.stringify(artifact, null, 2)}
 `, "utf-8");
 }
 function readPrMetadata(projectRoot, taskId) {
-  const path = resolve24(artifactDirForId(projectRoot, taskId), "pr-state.json");
+  const path = resolve23(artifactDirForId(projectRoot, taskId), "pr-state.json");
   if (!existsSync20(path)) {
     return [];
   }
   try {
-    const parsed = JSON.parse(readFileSync11(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync12(path, "utf-8"));
     if (!parsed || typeof parsed !== "object") {
       return [];
     }
@@ -7908,7 +7561,7 @@ function resolveGithubCliBinary(projectRoot) {
   }
   const explicitPathEntries = (process.env.PATH || "").split(":").map((entry) => entry.trim()).filter(Boolean);
   for (const entry of explicitPathEntries) {
-    candidates.add(resolve24(entry, "gh"));
+    candidates.add(resolve23(entry, "gh"));
   }
   const bunResolved = Bun.which("gh");
   if (bunResolved) {
@@ -7945,7 +7598,7 @@ function resolveRepoNameWithOwner(projectRoot, repoRoot) {
   return resolveGithubRepoNameWithOwnerFromGitRoot(projectRoot, repoRoot, repoRoot, visited);
 }
 function resolveGithubRepoNameWithOwnerFromGitRoot(projectRoot, gitRoot, cwd, visited) {
-  const normalizedGitRoot = resolve24(gitRoot);
+  const normalizedGitRoot = resolve23(gitRoot);
   if (visited.has(normalizedGitRoot)) {
     return "";
   }
@@ -8017,7 +7670,7 @@ function resolveNetworkRemoteName(projectRoot, repoRoot, repoNameWithOwner) {
   return remotes.includes("origin") ? "origin" : remotes[0];
 }
 function gitQuery(projectRoot, gitRoot, cwd, ...args) {
-  const gitArgs = existsSync20(resolve24(gitRoot, ".git")) ? gitCmd(projectRoot, gitRoot, ...args) : [resolveGitBinary(projectRoot), "--git-dir", gitRoot, ...args];
+  const gitArgs = existsSync20(resolve23(gitRoot, ".git")) ? gitCmd(projectRoot, gitRoot, ...args) : [resolveGitBinary(projectRoot), "--git-dir", gitRoot, ...args];
   return runCapture2(gitArgs, cwd, projectRoot);
 }
 function resolveLocalGitRemoteRoot(remoteUrl, gitRoot) {
@@ -8035,7 +7688,7 @@ function resolveLocalGitRemoteRoot(remoteUrl, gitRoot) {
   } else if (/^[a-z][a-z0-9+.-]*:\/\//i.test(normalized) || /^[^@]+@[^:]+:.+$/.test(normalized)) {
     return "";
   } else if (!isAbsolute2(normalized)) {
-    candidate = resolve24(gitRoot, normalized);
+    candidate = resolve23(gitRoot, normalized);
   }
   return existsSync20(candidate) ? candidate : "";
 }
@@ -8164,7 +7817,7 @@ function inferReviewerFromChangedFiles(projectRoot, repoRoot, baseRef, branchRef
   return best;
 }
 function commitRepo(projectRoot, repo, label, message, allowEmpty, scoped, files, changedFilesManifest) {
-  if (!existsSync20(resolve24(repo, ".git"))) {
+  if (!existsSync20(resolve23(repo, ".git"))) {
     console.log(`Skipping ${label}: repo not available (${repo})`);
     return;
   }
@@ -8196,18 +7849,18 @@ function commitRepo(projectRoot, repo, label, message, allowEmpty, scoped, files
   console.log(`Committed ${label}: ${message}`);
 }
 function readChangedFilesManifest(projectRoot, taskId) {
-  const manifestPath = resolve24(artifactDirForId(projectRoot, taskId), "changed-files.txt");
+  const manifestPath = resolve23(artifactDirForId(projectRoot, taskId), "changed-files.txt");
   if (!existsSync20(manifestPath)) {
     return [];
   }
-  const files = readFileSync11(manifestPath, "utf-8").split(/\r?\n/).map((line) => normalizeChangedFilePath2(line)).filter(Boolean);
+  const files = readFileSync12(manifestPath, "utf-8").split(/\r?\n/).map((line) => normalizeChangedFilePath2(line)).filter(Boolean);
   return [...new Set(files)];
 }
 function refreshChangedFilesManifest(projectRoot, taskId) {
-  const manifestPath = resolve24(artifactDirForId(projectRoot, taskId), "changed-files.txt");
-  mkdirSync11(dirname11(manifestPath), { recursive: true });
+  const manifestPath = resolve23(artifactDirForId(projectRoot, taskId), "changed-files.txt");
+  mkdirSync12(dirname10(manifestPath), { recursive: true });
   const changedFiles = changedFilesForTask(projectRoot, taskId, true);
-  writeFileSync11(manifestPath, `${changedFiles.join(`
+  writeFileSync12(manifestPath, `${changedFiles.join(`
 `)}
 `, "utf-8");
   return manifestPath;
@@ -8320,7 +7973,7 @@ function repoHasPathChange(projectRoot, repoRoot, relativePath) {
   return result.exitCode === 0 && result.stdout.trim().length > 0;
 }
 function stageExcludePathspecs(repoRoot) {
-  const patterns = existsSync20(resolve24(repoRoot, ".rig", "task-config.json")) ? [...TASK_RUNTIME_STAGE_EXCLUDES, ...GENERATED_STAGE_EXCLUDES] : [".rig/**", ...GENERATED_STAGE_EXCLUDES];
+  const patterns = existsSync20(resolve23(repoRoot, ".rig", "task-config.json")) ? [...TASK_RUNTIME_STAGE_EXCLUDES, ...GENERATED_STAGE_EXCLUDES] : [".rig/**", ...GENERATED_STAGE_EXCLUDES];
   return patterns.map((pattern) => `:(glob,exclude)${pattern}`);
 }
 function pathResolvesBeyondSymlink(repoRoot, relativePath) {
@@ -8330,7 +7983,7 @@ function pathResolvesBeyondSymlink(repoRoot, relativePath) {
   }
   let current = repoRoot;
   for (let index = 0;index < parts.length - 1; index += 1) {
-    current = resolve24(current, parts[index]);
+    current = resolve23(current, parts[index]);
     try {
       if (lstatSync(current).isSymbolicLink()) {
         return true;
@@ -8400,11 +8053,11 @@ function runCapture2(command, cwd, projectRoot = cwd) {
 }
 function runtimeGitEnv(projectRoot) {
   const { ctx, runtimeRoot } = resolveRuntimeMetadata(projectRoot);
-  const runtimeHome = runtimeRoot ? resolve24(runtimeRoot, "home") : "";
-  const runtimeTmp = runtimeRoot ? resolve24(runtimeRoot, "tmp") : "";
-  const runtimeCache = runtimeRoot ? resolve24(runtimeRoot, "cache") : "";
-  const runtimeKnownHosts = runtimeHome ? resolve24(runtimeHome, ".ssh", "known_hosts") : "";
-  const runtimeKey = runtimeHome ? resolve24(runtimeHome, ".ssh", "rig-agent-key") : "";
+  const runtimeHome = runtimeRoot ? resolve23(runtimeRoot, "home") : "";
+  const runtimeTmp = runtimeRoot ? resolve23(runtimeRoot, "tmp") : "";
+  const runtimeCache = runtimeRoot ? resolve23(runtimeRoot, "cache") : "";
+  const runtimeKnownHosts = runtimeHome ? resolve23(runtimeHome, ".ssh", "known_hosts") : "";
+  const runtimeKey = runtimeHome ? resolve23(runtimeHome, ".ssh", "rig-agent-key") : "";
   const env = {};
   if (ctx?.workspaceDir) {
     env.PROJECT_RIG_ROOT = projectRoot;
@@ -8496,12 +8149,12 @@ function loadPersistedRuntimeSecrets(runtimeRoot) {
   if (!runtimeRoot) {
     return {};
   }
-  const path = resolve24(runtimeRoot, "runtime-secrets.json");
+  const path = resolve23(runtimeRoot, "runtime-secrets.json");
   if (!existsSync20(path)) {
     return {};
   }
   try {
-    const parsed = JSON.parse(readFileSync11(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync12(path, "utf-8"));
     const entries = Object.entries(parsed).filter((entry) => typeof entry[1] === "string");
     return Object.fromEntries(entries);
   } catch {
@@ -8509,13 +8162,13 @@ function loadPersistedRuntimeSecrets(runtimeRoot) {
   }
 }
 function ensureRuntimeOpenSslConfig(runtimeHome) {
-  const sslDir = resolve24(runtimeHome, ".ssl");
-  const sslConfig = resolve24(sslDir, "openssl.cnf");
+  const sslDir = resolve23(runtimeHome, ".ssl");
+  const sslConfig = resolve23(sslDir, "openssl.cnf");
   if (!existsSync20(sslDir)) {
-    mkdirSync11(sslDir, { recursive: true });
+    mkdirSync12(sslDir, { recursive: true });
   }
   if (!existsSync20(sslConfig)) {
-    writeFileSync11(sslConfig, `# Rig runtime OpenSSL config placeholder
+    writeFileSync12(sslConfig, `# Rig runtime OpenSSL config placeholder
 `);
   }
   return sslConfig;
@@ -8533,7 +8186,7 @@ function resolveRuntimeMetadata(projectRoot) {
   if (contextFile) {
     return {
       ctx,
-      runtimeRoot: dirname11(resolve24(contextFile))
+      runtimeRoot: dirname10(resolve23(contextFile))
     };
   }
   const inferredContextFile = findRuntimeContextFile2(projectRoot);
@@ -8543,19 +8196,19 @@ function resolveRuntimeMetadata(projectRoot) {
     } catch {}
     return {
       ctx,
-      runtimeRoot: dirname11(inferredContextFile)
+      runtimeRoot: dirname10(inferredContextFile)
     };
   }
   return { ctx, runtimeRoot: "" };
 }
 function findRuntimeContextFile2(startPath) {
-  let current = resolve24(startPath);
+  let current = resolve23(startPath);
   while (true) {
-    const candidate = resolve24(current, "runtime-context.json");
+    const candidate = resolve23(current, "runtime-context.json");
     if (existsSync20(candidate)) {
       return candidate;
     }
-    const parent = dirname11(current);
+    const parent = dirname10(current);
     if (parent === current) {
       return "";
     }
@@ -8643,21 +8296,12 @@ async function main() {
   const policy = loadPolicy(projectRoot);
   const openPrEnabled = policy.completion.checks.includes("open-pr");
   const autoMergeEnabled = policy.completion.checks.includes("auto-merge");
-  const eventBus = new RuntimeEventBus({ projectRoot });
-  const runtimeContext = loadRuntimeContextFromEnv() ?? undefined;
-  const plugins = await PluginManager.load({
-    projectRoot,
-    runId: eventBus.getRunId(),
-    eventBus,
-    runtimeContext
-  });
   console.log(`
 [2/3] Verifier preflight...`);
   if (!failed) {
     const localVerifyOutcome = await verifyTask({
       projectRoot,
       taskId,
-      plugins,
       skipAiReview: true,
       persistArtifacts: false
     });
@@ -8728,8 +8372,7 @@ async function main() {
 [3/3] Verifier review...`);
   const verifyOutcome = await verifyTask({
     projectRoot,
-    taskId,
-    plugins
+    taskId
   });
   if (!verifyOutcome.approved) {
     console.log("REJECT:");
@@ -8801,9 +8444,9 @@ async function main() {
     console.log(`
 [post] Auto-merge: skipped (not in policy completion.checks)`);
   }
-  const artifactDir = resolve25(paths.artifactsDir, taskId);
-  mkdirSync12(artifactDir, { recursive: true });
-  writeFileSync12(resolve25(artifactDir, "review-status.txt"), failed ? `REJECTED
+  const artifactDir = resolve24(paths.artifactsDir, taskId);
+  mkdirSync13(artifactDir, { recursive: true });
+  writeFileSync13(resolve24(artifactDir, "review-status.txt"), failed ? `REJECTED
 ` : `APPROVED
 `, "utf-8");
   if (!failed) {
@@ -8850,7 +8493,7 @@ async function runBunTool(args, cwd) {
   };
 }
 async function runProtoQualityGate(monorepoRoot) {
-  const protosDir = resolve25(monorepoRoot, "packages", "protos");
+  const protosDir = resolve24(monorepoRoot, "packages", "protos");
   if (!existsSync21(protosDir)) {
     console.log(`FAIL: Proto workspace not found at ${protosDir}`);
     return false;
@@ -8899,12 +8542,12 @@ async function runProtoQualityGate(monorepoRoot) {
   } else {
     console.log("OK: Generated TypeScript compiles");
   }
-  const workflowPath = resolve25(monorepoRoot, ".github", "workflows", "pull-request-gate.yml");
+  const workflowPath = resolve24(monorepoRoot, ".github", "workflows", "pull-request-gate.yml");
   if (!existsSync21(workflowPath)) {
     console.log(`FAIL: Missing workflow gate file at ${workflowPath}`);
     ok = false;
   } else {
-    const workflow = readFileSync12(workflowPath, "utf-8");
+    const workflow = readFileSync13(workflowPath, "utf-8");
     if (workflow.includes("if: false && needs.detect.outputs.protos_changed == 'true'")) {
       console.log("FAIL: Proto quality CI gate is disabled in pull-request-gate.yml");
       ok = false;
@@ -8944,9 +8587,9 @@ async function readJsonFileIfPresent(path) {
 }
 async function recordVerifierFailure(projectRoot, taskId, paths) {
   const failedApproachesPath = paths.failedApproachesPath;
-  const artifactDir = resolve25(paths.artifactsDir, taskId);
-  const reviewStatePath = resolve25(artifactDir, "review-state.json");
-  const reviewFeedbackPath = resolve25(artifactDir, "review-feedback.md");
+  const artifactDir = resolve24(paths.artifactsDir, taskId);
+  const reviewStatePath = resolve24(artifactDir, "review-state.json");
+  const reviewFeedbackPath = resolve24(artifactDir, "review-feedback.md");
   let summary = "Verifier rejected completion. Read review-feedback.md for required fixes.";
   const parsedReviewState = await readJsonFileIfPresent(reviewStatePath);
   if (parsedReviewState) {
@@ -8957,11 +8600,11 @@ async function recordVerifierFailure(projectRoot, taskId, paths) {
   }
   let attempts = 1;
   if (existsSync21(failedApproachesPath)) {
-    const content = readFileSync12(failedApproachesPath, "utf-8");
+    const content = readFileSync13(failedApproachesPath, "utf-8");
     attempts = (content.match(new RegExp(`^## ${escapeRegExp2(taskId)}\\b`, "gm")) || []).length + 1;
   } else {
-    mkdirSync12(resolve25(failedApproachesPath, ".."), { recursive: true });
-    writeFileSync12(failedApproachesPath, `# Failed Approaches
+    mkdirSync13(resolve24(failedApproachesPath, ".."), { recursive: true });
+    writeFileSync13(failedApproachesPath, `# Failed Approaches
 
 `, "utf-8");
   }
@@ -8999,8 +8642,8 @@ async function recordTaskRepoCommits(projectRoot, taskId, paths) {
       recorded_at: new Date().toISOString(),
       repos
     };
-    mkdirSync12(resolve25(statePath, ".."), { recursive: true });
-    writeFileSync12(statePath, `${JSON.stringify(state, null, 2)}
+    mkdirSync13(resolve24(statePath, ".."), { recursive: true });
+    writeFileSync13(statePath, `${JSON.stringify(state, null, 2)}
 `, "utf-8");
   }
 }