@h-rig/runtime 0.0.6-alpha.3 → 0.0.6-alpha.30

package/dist/src/control-plane/native/harness-cli.js

@@ -1,11 +1,11 @@
 // @bun
 // packages/runtime/src/control-plane/native/harness-cli.ts
-import { existsSync as existsSync28 } from "fs";
-import { resolve as resolve29 } from "path";
+import { existsSync as existsSync29 } from "fs";
+import { resolve as resolve30 } from "path";
 
 // packages/runtime/src/control-plane/native/git-ops.ts
-import { existsSync as existsSync21, lstatSync, mkdirSync as mkdirSync10, readFileSync as readFileSync11, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname11, isAbsolute as isAbsolute2, resolve as resolve24 } from "path";
+import { existsSync as existsSync22, lstatSync, mkdirSync as mkdirSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname11, isAbsolute as isAbsolute2, resolve as resolve25 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // packages/runtime/src/control-plane/runtime/baked-secrets.ts
@@ -274,8 +274,8 @@ function isAgentRuntimeContextPath(path) {
 }
 
 // packages/runtime/src/control-plane/native/task-ops.ts
-import { appendFileSync, existsSync as existsSync20, mkdirSync as mkdirSync9, readFileSync as readFileSync10, writeFileSync as writeFileSync9 } from "fs";
-import { resolve as resolve23 } from "path";
+import { appendFileSync, existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync11, writeFileSync as writeFileSync10 } from "fs";
+import { resolve as resolve24 } from "path";
 
 // packages/runtime/src/build-time-config.ts
 function normalizeBuildConfig(value) {
@@ -760,6 +760,49 @@ function safeReadJson(path) {
   }
 }
 
+// packages/runtime/src/control-plane/skill-materializer.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, readdirSync, rmSync, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve7 } from "path";
+import { loadSkill } from "@rig/skill-loader";
+var MARKER_FILENAME = ".rig-plugin";
+function skillDirName(id) {
+  return id.replace(/[^a-zA-Z0-9._-]+/g, "-");
+}
+async function materializeSkills(projectRoot, entries) {
+  const skillsRoot = resolve7(projectRoot, ".pi", "skills");
+  if (existsSync5(skillsRoot)) {
+    for (const name of readdirSync(skillsRoot)) {
+      const dir = resolve7(skillsRoot, name);
+      if (existsSync5(resolve7(dir, MARKER_FILENAME))) {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    }
+  }
+  const written = [];
+  for (const { pluginName, skill } of entries) {
+    const sourcePath = resolve7(projectRoot, skill.path);
+    if (!existsSync5(sourcePath)) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${sourcePath} does not exist`);
+      continue;
+    }
+    let body;
+    try {
+      await loadSkill(sourcePath);
+      body = readFileSync4(sourcePath, "utf-8");
+    } catch (err) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${err instanceof Error ? err.message : err}`);
+      continue;
+    }
+    const dir = resolve7(skillsRoot, skillDirName(skill.id));
+    mkdirSync3(dir, { recursive: true });
+    writeFileSync3(resolve7(dir, "SKILL.md"), body, "utf-8");
+    writeFileSync3(resolve7(dir, MARKER_FILENAME), `${JSON.stringify({ plugin: pluginName, skillId: skill.id }, null, 2)}
+`, "utf-8");
+    written.push({ id: skill.id, pluginName, directory: dir });
+  }
+  return written;
+}
+
 // packages/runtime/src/control-plane/plugin-host-context.ts
 async function buildPluginHostContext(projectRoot) {
   let config;
@@ -796,6 +839,17 @@ async function buildPluginHostContext(projectRoot) {
   } catch (err) {
     console.warn(`[plugin-host] hook materialization failed: ${err instanceof Error ? err.message : err}`);
   }
+  try {
+    const skillEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.skills ?? []).map((skill) => ({
+      pluginName: plugin.name,
+      skill
+    })));
+    if (skillEntries.length > 0) {
+      await materializeSkills(projectRoot, skillEntries);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] skill materialization failed: ${err instanceof Error ? err.message : err}`);
+  }
   return {
     config,
     pluginHost,
@@ -809,12 +863,12 @@ async function buildPluginHostContext(projectRoot) {
 
 // packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync5, readdirSync, statSync, writeFileSync as writeFileSync3 } from "fs";
-import { basename as basename3, join as join2, resolve as resolve8 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync, writeFileSync as writeFileSync4 } from "fs";
+import { basename as basename3, join as join2, resolve as resolve9 } from "path";
 
 // packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { resolve as resolve7 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { resolve as resolve8 } from "path";
 
 // packages/runtime/src/control-plane/tasks/task-record-reader.ts
 async function findTaskById(reader, id) {
@@ -837,7 +891,7 @@ class LegacyTaskConfigReadError extends Error {
   }
 }
 function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve7(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve8(projectRoot, ".rig", "task-config.json");
   const reader = {
     async listTasks() {
       return readLegacyTaskRecords(projectRoot, configPath);
@@ -848,8 +902,8 @@ function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
   };
   return reader;
 }
-function readLegacyTaskRecords(projectRoot, configPath = resolve7(projectRoot, ".rig", "task-config.json")) {
-  if (!existsSync5(configPath)) {
+function readLegacyTaskRecords(projectRoot, configPath = resolve8(projectRoot, ".rig", "task-config.json")) {
+  if (!existsSync6(configPath)) {
     return [];
   }
   const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
@@ -857,7 +911,7 @@ function readLegacyTaskRecords(projectRoot, configPath = resolve7(projectRoot, "
 }
 function readLegacyTaskConfigJson(projectRoot, configPath) {
   try {
-    const parsed = JSON.parse(readFileSync4(configPath, "utf8"));
+    const parsed = JSON.parse(readFileSync5(configPath, "utf8"));
     if (isPlainRecord(parsed)) {
       return parsed;
     }
@@ -941,7 +995,7 @@ function isPlainRecord(candidate) {
 var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
 var FILE_TASK_PATTERN = /\.(task\.)?json$/;
 function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve8(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve9(projectRoot, ".rig", "task-config.json");
   const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
   const spawnFn = options.spawn ?? spawnSync;
   const ghBinary = options.ghBinary ?? "gh";
@@ -1024,10 +1078,10 @@ function readMaterializedTaskMetadata(entry) {
   return metadata;
 }
 function readConfiguredFilesTaskSourcePath(projectRoot) {
-  const jsonPath = resolve8(projectRoot, "rig.config.json");
-  if (existsSync6(jsonPath)) {
+  const jsonPath = resolve9(projectRoot, "rig.config.json");
+  if (existsSync7(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync5(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync6(jsonPath, "utf8"));
       if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
         const source = parsed.taskSource;
         return source.kind === "files" && typeof source.path === "string" ? source.path : null;
@@ -1036,12 +1090,12 @@ function readConfiguredFilesTaskSourcePath(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve8(projectRoot, "rig.config.ts");
-  if (!existsSync6(tsPath)) {
+  const tsPath = resolve9(projectRoot, "rig.config.ts");
+  if (!existsSync7(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync5(tsPath, "utf8");
+    const source = readFileSync6(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -1061,10 +1115,10 @@ function readRawTaskEntry(configPath, taskId) {
   return isPlainRecord2(entry) ? entry : null;
 }
 function readRawTaskConfig(configPath) {
-  if (!existsSync6(configPath)) {
+  if (!existsSync7(configPath)) {
     return null;
   }
-  const parsed = JSON.parse(readFileSync5(configPath, "utf8"));
+  const parsed = JSON.parse(readFileSync6(configPath, "utf8"));
   return isPlainRecord2(parsed) ? parsed : null;
 }
 function stripLegacyTaskConfigMetadata2(raw) {
@@ -1072,12 +1126,12 @@ function stripLegacyTaskConfigMetadata2(raw) {
   return tasks;
 }
 function listFileBackedTasks(projectRoot, sourcePath) {
-  const directory = resolve8(projectRoot, sourcePath);
-  if (!existsSync6(directory)) {
+  const directory = resolve9(projectRoot, sourcePath);
+  if (!existsSync7(directory)) {
     return [];
   }
   const tasks = [];
-  for (const name of readdirSync(directory)) {
+  for (const name of readdirSync2(directory)) {
     if (!FILE_TASK_PATTERN.test(name))
       continue;
     const inferredId = basename3(name).replace(FILE_TASK_PATTERN, "");
@@ -1088,11 +1142,11 @@ function listFileBackedTasks(projectRoot, sourcePath) {
   return tasks;
 }
 function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
-  const file = findFileBackedTaskFile(resolve8(projectRoot, sourcePath), taskId);
+  const file = findFileBackedTaskFile(resolve9(projectRoot, sourcePath), taskId);
   if (!file) {
     return null;
   }
-  const raw = JSON.parse(readFileSync5(file, "utf8"));
+  const raw = JSON.parse(readFileSync6(file, "utf8"));
   if (!isPlainRecord2(raw)) {
     return null;
   }
@@ -1105,17 +1159,17 @@ function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
   };
 }
 function findFileBackedTaskFile(directory, taskId) {
-  if (!existsSync6(directory)) {
+  if (!existsSync7(directory)) {
     return null;
   }
-  for (const name of readdirSync(directory)) {
+  for (const name of readdirSync2(directory)) {
     if (!FILE_TASK_PATTERN.test(name))
       continue;
     const file = join2(directory, name);
     try {
       if (!statSync(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync5(file, "utf8"));
+      const raw = JSON.parse(readFileSync6(file, "utf8"));
       const inferredId = basename3(file).replace(FILE_TASK_PATTERN, "");
       const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
       if (id === taskId) {
@@ -1198,8 +1252,8 @@ function githubStatusFor(issue) {
   return "open";
 }
 function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() ?? "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token };
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
 }
 function ghSpawnOptions() {
   return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
@@ -1275,8 +1329,8 @@ async function readConfiguredTaskSourceTask(projectRoot, taskId) {
 }
 
 // packages/runtime/src/control-plane/native/task-state.ts
-import { existsSync as existsSync14, readFileSync as readFileSync9, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
-import { basename as basename6, resolve as resolve16 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync10, readdirSync as readdirSync3, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename6, resolve as resolve17 } from "path";
 
 // packages/runtime/src/control-plane/state-sync/types.ts
 var SUPPORTED_TASK_STATE_SCHEMA_VERSION = 1;
@@ -1384,30 +1438,30 @@ function readTaskStateMetadataEnvelope(raw) {
   };
 }
 // packages/runtime/src/control-plane/state-sync/read.ts
-import { existsSync as existsSync13, readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve15 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync9 } from "fs";
+import { resolve as resolve16 } from "path";
 
 // packages/runtime/src/control-plane/native/git-native.ts
-import { chmodSync, copyFileSync, existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync6, renameSync, rmSync, writeFileSync as writeFileSync4 } from "fs";
+import { chmodSync, copyFileSync, existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync7, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname5, isAbsolute, resolve as resolve9 } from "path";
+import { dirname as dirname5, isAbsolute, resolve as resolve10 } from "path";
 import { createHash } from "crypto";
 function isTextTreeCommitUpdate(update) {
   return typeof update.content === "string";
 }
-var sharedGitNativeOutputDir = resolve9(tmpdir3(), "rig-native");
-var sharedGitNativeOutputPath = resolve9(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+var sharedGitNativeOutputDir = resolve10(tmpdir3(), "rig-native");
+var sharedGitNativeOutputPath = resolve10(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
 var trackerCommandUsageProbe = "usage: rig-git fetch-ref <repo-path> <remote> <branch>";
 function temporaryGitBinaryOutputPath(outputPath) {
   const suffix = process.platform === "win32" ? ".exe" : "";
-  return resolve9(dirname5(outputPath), `.rig-git-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}${suffix}`);
+  return resolve10(dirname5(outputPath), `.rig-git-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}${suffix}`);
 }
 function publishGitBinary(tempOutputPath, outputPath) {
   try {
     renameSync(tempOutputPath, outputPath);
   } catch (error) {
-    if (process.platform === "win32" && existsSync7(outputPath)) {
-      rmSync(outputPath, { force: true });
+    if (process.platform === "win32" && existsSync8(outputPath)) {
+      rmSync2(outputPath, { force: true });
       renameSync(tempOutputPath, outputPath);
       return;
     }
@@ -1422,22 +1476,22 @@ function rigGitSourceCandidates() {
   const cwd = process.cwd()?.trim() || "";
   const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
   const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
-  const moduleRelativeSource = resolve9(import.meta.dir, "../../../native/rig-git.zig");
+  const moduleRelativeSource = resolve10(import.meta.dir, "../../../native/rig-git.zig");
   return [...new Set([
     process.env.RIG_NATIVE_GIT_SOURCE?.trim() || "",
     moduleRelativeSource,
-    projectRoot ? resolve9(projectRoot, "packages/runtime/native/rig-git.zig") : "",
-    hostProjectRoot ? resolve9(hostProjectRoot, "packages/runtime/native/rig-git.zig") : "",
-    cwd ? resolve9(cwd, "packages/runtime/native/rig-git.zig") : "",
-    execDir ? resolve9(execDir, "..", "..", "packages/runtime/native/rig-git.zig") : "",
-    execDir ? resolve9(execDir, "..", "native", "rig-git.zig") : ""
+    projectRoot ? resolve10(projectRoot, "packages/runtime/native/rig-git.zig") : "",
+    hostProjectRoot ? resolve10(hostProjectRoot, "packages/runtime/native/rig-git.zig") : "",
+    cwd ? resolve10(cwd, "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve10(execDir, "..", "..", "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve10(execDir, "..", "native", "rig-git.zig") : ""
   ].filter(Boolean))];
 }
 function nativePackageBinaryCandidates(fromDir, fileName) {
   const candidates = [];
-  let cursor = resolve9(fromDir);
+  let cursor = resolve10(fromDir);
   for (let index = 0;index < 8; index += 1) {
-    candidates.push(resolve9(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve9(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve9(cursor, "native", fileName), resolve9(cursor, "native", "bin", fileName));
+    candidates.push(resolve10(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve10(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve10(cursor, "native", fileName), resolve10(cursor, "native", "bin", fileName));
     const parent = dirname5(cursor);
     if (parent === cursor)
       break;
@@ -1452,15 +1506,15 @@ function rigGitBinaryCandidates() {
   return [...new Set([
     explicit,
     ...nativePackageBinaryCandidates(import.meta.dir, fileName),
-    execDir ? resolve9(execDir, fileName) : "",
-    execDir ? resolve9(execDir, "..", fileName) : "",
-    execDir ? resolve9(execDir, "..", "bin", fileName) : "",
+    execDir ? resolve10(execDir, fileName) : "",
+    execDir ? resolve10(execDir, "..", fileName) : "",
+    execDir ? resolve10(execDir, "..", "bin", fileName) : "",
     sharedGitNativeOutputPath
   ].filter(Boolean))];
 }
 function resolveGitSourcePath() {
   for (const candidate of rigGitSourceCandidates()) {
-    if (candidate && existsSync7(candidate)) {
+    if (candidate && existsSync8(candidate)) {
       return candidate;
     }
   }
@@ -1471,7 +1525,7 @@ function resolveGitBinaryPath() {
     return null;
   }
   for (const candidate of rigGitBinaryCandidates()) {
-    if (candidate && existsSync7(candidate)) {
+    if (candidate && existsSync8(candidate)) {
       return candidate;
     }
   }
@@ -1501,18 +1555,18 @@ function nativeBuildManifestPath(outputPath) {
   return `${outputPath}.build-manifest.json`;
 }
 function hasMatchingNativeBuildManifestSync(manifestPath, buildKey) {
-  if (!existsSync7(manifestPath)) {
+  if (!existsSync8(manifestPath)) {
     return false;
   }
   try {
-    const manifest = JSON.parse(readFileSync6(manifestPath, "utf8"));
+    const manifest = JSON.parse(readFileSync7(manifestPath, "utf8"));
     return manifest.version === 1 && manifest.buildKey === buildKey;
   } catch {
     return false;
   }
 }
 function sha256FileSync(path) {
-  return createHash("sha256").update(readFileSync6(path)).digest("hex");
+  return createHash("sha256").update(readFileSync7(path)).digest("hex");
 }
 function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath()) {
   if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
@@ -1530,7 +1584,7 @@ function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath())
   if (!zigBinary) {
     throw new Error("zig is required to build native Rig git tools.");
   }
-  mkdirSync3(dirname5(outputPath), { recursive: true });
+  mkdirSync4(dirname5(outputPath), { recursive: true });
   const sourceDigest = sha256FileSync(sourcePath);
   const buildKey = JSON.stringify({
     version: 1,
@@ -1541,7 +1595,7 @@ function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath())
     sourceDigest
   });
   const manifestPath = nativeBuildManifestPath(outputPath);
-  const needsBuild = !existsSync7(outputPath) || !hasMatchingNativeBuildManifestSync(manifestPath, buildKey) || !binarySupportsTrackerCommandsSync(outputPath);
+  const needsBuild = !existsSync8(outputPath) || !hasMatchingNativeBuildManifestSync(manifestPath, buildKey) || !binarySupportsTrackerCommandsSync(outputPath);
   if (!needsBuild) {
     chmodSync(outputPath, 493);
     return outputPath;
@@ -1559,7 +1613,7 @@ function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath())
     stdout: "pipe",
     stderr: "pipe"
   });
-  if (build.exitCode !== 0 || !existsSync7(tempOutputPath)) {
+  if (build.exitCode !== 0 || !existsSync8(tempOutputPath)) {
     const stderr = build.stderr.toString().trim();
     const stdout = build.stdout.toString().trim();
     const details = [stderr, stdout].filter(Boolean).join(`
@@ -1567,17 +1621,17 @@ function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath())
     throw new Error(`Failed to build native Rig git tools: ${details || `zig exited with code ${build.exitCode}`}`);
   }
   chmodSync(tempOutputPath, 493);
-  if (existsSync7(outputPath) && hasMatchingNativeBuildManifestSync(manifestPath, buildKey)) {
-    rmSync(tempOutputPath, { force: true });
+  if (existsSync8(outputPath) && hasMatchingNativeBuildManifestSync(manifestPath, buildKey)) {
+    rmSync2(tempOutputPath, { force: true });
     chmodSync(outputPath, 493);
     return outputPath;
   }
   publishGitBinary(tempOutputPath, outputPath);
   if (!binarySupportsTrackerCommandsSync(outputPath)) {
-    rmSync(outputPath, { force: true });
+    rmSync2(outputPath, { force: true });
     throw new Error("Failed to build native Rig git tools: tracker command probe failed");
   }
-  writeFileSync4(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+  writeFileSync5(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
 `, "utf8");
   return outputPath;
 }
@@ -1599,7 +1653,7 @@ function runGitNative(command, args) {
     }
   } else {
     const explicitBinaryPath = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
-    binaryPath = explicitBinaryPath && existsSync7(explicitBinaryPath) ? explicitBinaryPath : !explicitBinaryPath ? resolveGitBinaryPath() : null;
+    binaryPath = explicitBinaryPath && existsSync8(explicitBinaryPath) ? explicitBinaryPath : !explicitBinaryPath ? resolveGitBinaryPath() : null;
     if (!binaryPath) {
       try {
         binaryPath = ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
@@ -1696,25 +1750,25 @@ function nativeFetchRef(repoPath, remote, branch) {
   return requireGitNativeString("fetch-ref", [repoPath, remote, branch]);
 }
 function nativeReadBlobAtRef(repoPath, ref, path) {
-  const requestDir = resolve9(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
-  mkdirSync3(requestDir, { recursive: true });
-  const outputPath = resolve9(requestDir, "blob.txt");
+  const requestDir = resolve10(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
+  mkdirSync4(requestDir, { recursive: true });
+  const outputPath = resolve10(requestDir, "blob.txt");
   try {
     requireGitNative("read-blob-at-ref", [repoPath, ref, path, outputPath]);
-    return readFileSync6(outputPath, "utf8");
+    return readFileSync7(outputPath, "utf8");
   } finally {
-    rmSync(requestDir, { recursive: true, force: true });
+    rmSync2(requestDir, { recursive: true, force: true });
   }
 }
 function nativeReadBlobBytesAtRef(repoPath, ref, path) {
-  const requestDir = resolve9(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
-  mkdirSync3(requestDir, { recursive: true });
-  const outputPath = resolve9(requestDir, "blob.bin");
+  const requestDir = resolve10(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
+  mkdirSync4(requestDir, { recursive: true });
+  const outputPath = resolve10(requestDir, "blob.bin");
   try {
     requireGitNative("read-blob-at-ref", [repoPath, ref, path, outputPath]);
-    return readFileSync6(outputPath);
+    return readFileSync7(outputPath);
   } finally {
-    rmSync(requestDir, { recursive: true, force: true });
+    rmSync2(requestDir, { recursive: true, force: true });
   }
 }
 function serializeTreeCommitUpdates(updates) {
@@ -1733,16 +1787,16 @@ function buildTreeCommitUpdatesJson(updates) {
 `;
 }
 function nativeWriteTreeCommit(repoPath, baseRef, updates, message) {
-  const requestDir = resolve9(sharedGitNativeOutputDir, "requests", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
-  mkdirSync3(requestDir, { recursive: true });
-  const messagePath = resolve9(requestDir, "message.txt");
-  const updatesPath = resolve9(requestDir, "updates.json");
+  const requestDir = resolve10(sharedGitNativeOutputDir, "requests", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
+  mkdirSync4(requestDir, { recursive: true });
+  const messagePath = resolve10(requestDir, "message.txt");
+  const updatesPath = resolve10(requestDir, "updates.json");
   try {
-    writeFileSync4(messagePath, message, "utf8");
-    writeFileSync4(updatesPath, buildTreeCommitUpdatesJson(updates), "utf8");
+    writeFileSync5(messagePath, message, "utf8");
+    writeFileSync5(updatesPath, buildTreeCommitUpdatesJson(updates), "utf8");
     return requireGitNativeString("write-tree-commit", [repoPath, baseRef, messagePath, updatesPath]);
   } finally {
-    rmSync(requestDir, { recursive: true, force: true });
+    rmSync2(requestDir, { recursive: true, force: true });
   }
 }
 function nativePushRefWithLease(repoPath, localOid, remoteRef, expectedOldOid, remote = "origin") {
@@ -1757,35 +1811,35 @@ function nativePushRefWithLease(repoPath, localOid, remoteRef, expectedOldOid, r
 
 // packages/runtime/src/control-plane/native/utils.ts
 import { ptr as ptr2 } from "bun:ffi";
-import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
-import { resolve as resolve12 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
+import { resolve as resolve13 } from "path";
 
 // packages/runtime/src/layout.ts
-import { existsSync as existsSync8 } from "fs";
-import { basename as basename4, dirname as dirname6, resolve as resolve10 } from "path";
+import { existsSync as existsSync9 } from "fs";
+import { basename as basename4, dirname as dirname6, resolve as resolve11 } from "path";
 var RIG_DEFINITION_DIRNAME = "rig";
 var RIG_ARTIFACTS_DIRNAME = "artifacts";
 function resolveMonorepoRoot(projectRoot) {
-  const normalizedProjectRoot = resolve10(projectRoot);
+  const normalizedProjectRoot = resolve11(projectRoot);
   const explicit = process.env.MONOREPO_ROOT?.trim();
   if (explicit) {
-    const explicitRoot = resolve10(explicit);
+    const explicitRoot = resolve11(explicit);
     const explicitParent = dirname6(explicitRoot);
     if (basename4(explicitParent) === ".worktrees") {
       const owner = dirname6(explicitParent);
-      const ownerHasGit = existsSync8(resolve10(owner, ".git"));
-      const ownerHasTaskConfig = existsSync8(resolve10(owner, ".rig", "task-config.json"));
-      const ownerHasRigConfig = existsSync8(resolve10(owner, "rig.config.ts"));
+      const ownerHasGit = existsSync9(resolve11(owner, ".git"));
+      const ownerHasTaskConfig = existsSync9(resolve11(owner, ".rig", "task-config.json"));
+      const ownerHasRigConfig = existsSync9(resolve11(owner, "rig.config.ts"));
       if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
         return owner;
       }
       throw new Error(`MONOREPO_ROOT points to worktree ${explicitRoot}, but the owner checkout is incomplete at ${owner}.`);
     }
-    if (!existsSync8(resolve10(explicitRoot, ".git"))) {
+    if (!existsSync9(resolve11(explicitRoot, ".git"))) {
       throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but no git checkout was found there.`);
     }
-    const hasTaskConfig = existsSync8(resolve10(explicitRoot, ".rig", "task-config.json"));
-    const hasRigConfig = existsSync8(resolve10(explicitRoot, "rig.config.ts"));
+    const hasTaskConfig = existsSync9(resolve11(explicitRoot, ".rig", "task-config.json"));
+    const hasRigConfig = existsSync9(resolve11(explicitRoot, "rig.config.ts"));
     if (!hasTaskConfig && !hasRigConfig) {
       throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but neither .rig/task-config.json nor rig.config.ts exists there.`);
     }
@@ -1794,9 +1848,9 @@ function resolveMonorepoRoot(projectRoot) {
   const projectParent = dirname6(normalizedProjectRoot);
   if (basename4(projectParent) === ".worktrees") {
     const worktreeOwner = dirname6(projectParent);
-    const ownerHasGit = existsSync8(resolve10(worktreeOwner, ".git"));
-    const ownerHasTaskConfig = existsSync8(resolve10(worktreeOwner, ".rig", "task-config.json"));
-    const ownerHasRigConfig = existsSync8(resolve10(worktreeOwner, "rig.config.ts"));
+    const ownerHasGit = existsSync9(resolve11(worktreeOwner, ".git"));
+    const ownerHasTaskConfig = existsSync9(resolve11(worktreeOwner, ".rig", "task-config.json"));
+    const ownerHasRigConfig = existsSync9(resolve11(worktreeOwner, "rig.config.ts"));
     if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
       return worktreeOwner;
     }
@@ -1804,28 +1858,28 @@ function resolveMonorepoRoot(projectRoot) {
   return normalizedProjectRoot;
 }
 function resolveRuntimeWorkspaceLayout(workspaceDir) {
-  const root = resolve10(workspaceDir);
-  const rigRoot = resolve10(root, ".rig");
-  const logsDir = resolve10(rigRoot, "logs");
-  const stateDir = resolve10(rigRoot, "state");
-  const runtimeDir = resolve10(rigRoot, "runtime");
-  const binDir = resolve10(rigRoot, "bin");
+  const root = resolve11(workspaceDir);
+  const rigRoot = resolve11(root, ".rig");
+  const logsDir = resolve11(rigRoot, "logs");
+  const stateDir = resolve11(rigRoot, "state");
+  const runtimeDir = resolve11(rigRoot, "runtime");
+  const binDir = resolve11(rigRoot, "bin");
   return {
     workspaceDir: root,
     rigRoot,
     stateDir,
     logsDir,
-    artifactsRoot: resolve10(root, RIG_ARTIFACTS_DIRNAME),
+    artifactsRoot: resolve11(root, RIG_ARTIFACTS_DIRNAME),
     runtimeDir,
-    homeDir: resolve10(rigRoot, "home"),
-    tmpDir: resolve10(rigRoot, "tmp"),
-    cacheDir: resolve10(rigRoot, "cache"),
-    sessionDir: resolve10(rigRoot, "session"),
+    homeDir: resolve11(rigRoot, "home"),
+    tmpDir: resolve11(rigRoot, "tmp"),
+    cacheDir: resolve11(rigRoot, "cache"),
+    sessionDir: resolve11(rigRoot, "session"),
     binDir,
-    distDir: resolve10(rigRoot, "dist"),
-    pluginBinDir: resolve10(binDir, "plugins"),
-    contextPath: resolve10(rigRoot, "runtime-context.json"),
-    controlPlaneEventsFile: resolve10(logsDir, "control-plane.events.jsonl")
+    distDir: resolve11(rigRoot, "dist"),
+    pluginBinDir: resolve11(binDir, "plugins"),
+    contextPath: resolve11(rigRoot, "runtime-context.json"),
+    controlPlaneEventsFile: resolve11(logsDir, "control-plane.events.jsonl")
   };
 }
 function resolveActiveRuntimeWorkspaceRoot(monorepoRoot) {
@@ -1833,14 +1887,14 @@ function resolveActiveRuntimeWorkspaceRoot(monorepoRoot) {
   if (!explicit) {
     throw new Error("No active runtime workspace. Set RIG_TASK_WORKSPACE or provision a task runtime first.");
   }
-  return resolve10(explicit);
+  return resolve11(explicit);
 }
 function resolveRigLayout(projectRoot) {
   const monorepoRoot = resolveMonorepoRoot(projectRoot);
-  const definitionRoot = resolve10(projectRoot, RIG_DEFINITION_DIRNAME);
+  const definitionRoot = resolve11(projectRoot, RIG_DEFINITION_DIRNAME);
   const runtimeWorkspaceRoot = resolveActiveRuntimeWorkspaceRoot(monorepoRoot);
   const runtimeLayout = resolveRuntimeWorkspaceLayout(runtimeWorkspaceRoot);
-  const policyDir = resolve10(definitionRoot, "policy");
+  const policyDir = resolve11(definitionRoot, "policy");
   return {
     projectRoot,
     monorepoRoot,
@@ -1848,34 +1902,34 @@ function resolveRigLayout(projectRoot) {
     runtimeWorkspaceRoot,
     stateRoot: runtimeLayout.rigRoot,
     artifactsRoot: runtimeLayout.artifactsRoot,
-    configPath: resolve10(definitionRoot, "config.sh"),
-    taskConfigPath: resolve10(runtimeWorkspaceRoot, ".rig", "task-config.json"),
+    configPath: resolve11(definitionRoot, "config.sh"),
+    taskConfigPath: resolve11(runtimeWorkspaceRoot, ".rig", "task-config.json"),
     policyDir,
-    policyFile: resolve10(policyDir, "policy.json"),
-    pluginsDir: resolve10(definitionRoot, "plugins"),
-    hooksDir: resolve10(definitionRoot, "hooks"),
-    toolsDir: resolve10(definitionRoot, "tools"),
-    templatesDir: resolve10(definitionRoot, "templates"),
-    validationDir: resolve10(definitionRoot, "validation"),
+    policyFile: resolve11(policyDir, "policy.json"),
+    pluginsDir: resolve11(definitionRoot, "plugins"),
+    hooksDir: resolve11(definitionRoot, "hooks"),
+    toolsDir: resolve11(definitionRoot, "tools"),
+    templatesDir: resolve11(definitionRoot, "templates"),
+    validationDir: resolve11(definitionRoot, "validation"),
     stateDir: runtimeLayout.stateDir,
     logsDir: runtimeLayout.logsDir,
-    notificationsDir: resolve10(definitionRoot, "notifications"),
+    notificationsDir: resolve11(definitionRoot, "notifications"),
     runtimeDir: runtimeLayout.runtimeDir,
     distDir: runtimeLayout.distDir,
     binDir: runtimeLayout.binDir,
     pluginBinDir: runtimeLayout.pluginBinDir,
-    keybindingsPath: resolve10(definitionRoot, "keybindings.json"),
+    keybindingsPath: resolve11(definitionRoot, "keybindings.json"),
     controlPlaneEventsFile: runtimeLayout.controlPlaneEventsFile
   };
 }
 
 // packages/runtime/src/control-plane/native/runtime-native.ts
 import { dlopen, ptr, suffix, toBuffer } from "bun:ffi";
-import { copyFileSync as copyFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync4, renameSync as renameSync2, rmSync as rmSync2, statSync as statSync2 } from "fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync5, renameSync as renameSync2, rmSync as rmSync3, statSync as statSync2 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { dirname as dirname7, resolve as resolve11 } from "path";
-var sharedNativeRuntimeOutputDir = resolve11(tmpdir4(), "rig-native");
-var sharedNativeRuntimeOutputPath = resolve11(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
+import { dirname as dirname7, resolve as resolve12 } from "path";
+var sharedNativeRuntimeOutputDir = resolve12(tmpdir4(), "rig-native");
+var sharedNativeRuntimeOutputPath = resolve12(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
 var colocatedNativeRuntimeFileName = `runtime-native.${suffix}`;
 var nativeRuntimeLibrary = await loadNativeRuntimeLibrary();
 function requireNativeRuntimeLibrary(feature) {
@@ -1888,14 +1942,14 @@ async function ensureNativeRuntimeLibraryPath(outputPath = sharedNativeRuntimeOu
   if (await buildNativeRuntimeLibrary(outputPath, options)) {
     return outputPath;
   }
-  return !options.force && existsSync9(outputPath) ? outputPath : null;
+  return !options.force && existsSync10(outputPath) ? outputPath : null;
 }
 async function loadNativeRuntimeLibrary() {
   if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
     return null;
   }
   for (const candidate of nativeRuntimeLibraryCandidates()) {
-    if (!candidate || !existsSync9(candidate)) {
+    if (!candidate || !existsSync10(candidate)) {
       continue;
     }
     const loaded = tryDlopenNativeRuntimeLibrary(candidate);
@@ -1911,10 +1965,10 @@ async function loadNativeRuntimeLibrary() {
 }
 function nativePackageLibraryCandidates(fromDir, names) {
   const candidates = [];
-  let cursor = resolve11(fromDir);
+  let cursor = resolve12(fromDir);
   for (let index = 0;index < 8; index += 1) {
     for (const name of names) {
-      candidates.push(resolve11(cursor, "native", `${process.platform}-${process.arch}`, name), resolve11(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve11(cursor, "native", name), resolve11(cursor, "native", "lib", name));
+      candidates.push(resolve12(cursor, "native", `${process.platform}-${process.arch}`, name), resolve12(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve12(cursor, "native", name), resolve12(cursor, "native", "lib", name));
     }
     const parent = dirname7(cursor);
     if (parent === cursor)
@@ -1930,22 +1984,22 @@ function nativeRuntimeLibraryCandidates() {
   return [...new Set([
     explicit,
     ...nativePackageLibraryCandidates(import.meta.dir, [colocatedNativeRuntimeFileName, platformSpecific]),
-    execDir ? resolve11(execDir, colocatedNativeRuntimeFileName) : "",
-    execDir ? resolve11(execDir, platformSpecific) : "",
-    execDir ? resolve11(execDir, "..", colocatedNativeRuntimeFileName) : "",
-    execDir ? resolve11(execDir, "..", platformSpecific) : "",
-    execDir ? resolve11(execDir, "lib", colocatedNativeRuntimeFileName) : "",
-    execDir ? resolve11(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve12(execDir, colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve12(execDir, platformSpecific) : "",
+    execDir ? resolve12(execDir, "..", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve12(execDir, "..", platformSpecific) : "",
+    execDir ? resolve12(execDir, "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve12(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
     sharedNativeRuntimeOutputPath
   ].filter(Boolean))];
 }
 function resolveNativeRuntimeSourcePath() {
   const explicit = process.env.RIG_NATIVE_RUNTIME_SOURCE?.trim();
-  if (explicit && existsSync9(explicit)) {
+  if (explicit && existsSync10(explicit)) {
     return explicit;
   }
-  const bundled = resolve11(import.meta.dir, "../../../native/snapshot.zig");
-  return existsSync9(bundled) ? bundled : null;
+  const bundled = resolve12(import.meta.dir, "../../../native/snapshot.zig");
+  return existsSync10(bundled) ? bundled : null;
 }
 async function buildNativeRuntimeLibrary(outputPath, options = {}) {
   if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
@@ -1958,8 +2012,8 @@ async function buildNativeRuntimeLibrary(outputPath, options = {}) {
   }
   const tempOutputPath = `${outputPath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
   try {
-    mkdirSync4(dirname7(outputPath), { recursive: true });
-    const needsBuild = options.force === true || !existsSync9(outputPath) || statSync2(sourcePath).mtimeMs > statSync2(outputPath).mtimeMs;
+    mkdirSync5(dirname7(outputPath), { recursive: true });
+    const needsBuild = options.force === true || !existsSync10(outputPath) || statSync2(sourcePath).mtimeMs > statSync2(outputPath).mtimeMs;
     if (!needsBuild) {
       return true;
     }
@@ -1977,14 +2031,14 @@ async function buildNativeRuntimeLibrary(outputPath, options = {}) {
       stderr: "pipe"
     });
     const exitCode = await build.exited;
-    if (exitCode !== 0 || !existsSync9(tempOutputPath)) {
-      rmSync2(tempOutputPath, { force: true });
+    if (exitCode !== 0 || !existsSync10(tempOutputPath)) {
+      rmSync3(tempOutputPath, { force: true });
       return false;
     }
     renameSync2(tempOutputPath, outputPath);
     return true;
   } catch {
-    rmSync2(tempOutputPath, { force: true });
+    rmSync3(tempOutputPath, { force: true });
     return false;
   }
 }
@@ -2108,11 +2162,11 @@ async function runCaptureAsync(command, cwd, env, timeoutMs) {
   return { exitCode, stdout, stderr };
 }
 function readJsonFile(path, fallback) {
-  if (!existsSync10(path)) {
+  if (!existsSync11(path)) {
     return fallback;
   }
   try {
-    return JSON.parse(readFileSync7(path, "utf-8"));
+    return JSON.parse(readFileSync8(path, "utf-8"));
   } catch {
     return fallback;
   }
@@ -2126,31 +2180,31 @@ function unique(values) {
 function resolveHarnessPaths(projectRoot) {
   const hasRuntimeWorkspace = Boolean(process.env.RIG_TASK_WORKSPACE?.trim());
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
-  const harnessRoot = resolve12(projectRoot, "rig");
-  const stateRoot = resolve12(projectRoot, ".rig");
+  const harnessRoot = resolve13(projectRoot, "rig");
+  const stateRoot = resolve13(projectRoot, ".rig");
   const layout = hasRuntimeWorkspace ? resolveRigLayout(projectRoot) : null;
-  const stateDir = layout?.stateDir ?? resolve12(stateRoot, "state");
-  const logsDir = layout?.logsDir ?? resolve12(stateRoot, "logs");
-  const artifactsDir = layout?.artifactsRoot ?? resolve12(monorepoRoot, "artifacts");
-  const taskConfigPath = layout?.taskConfigPath ?? resolve12(monorepoRoot, ".rig", "task-config.json");
-  const binDir = layout?.binDir ?? resolve12(stateRoot, "bin");
+  const stateDir = layout?.stateDir ?? resolve13(stateRoot, "state");
+  const logsDir = layout?.logsDir ?? resolve13(stateRoot, "logs");
+  const artifactsDir = layout?.artifactsRoot ?? resolve13(monorepoRoot, "artifacts");
+  const taskConfigPath = layout?.taskConfigPath ?? resolve13(monorepoRoot, ".rig", "task-config.json");
+  const binDir = layout?.binDir ?? resolve13(stateRoot, "bin");
   return {
     harnessRoot,
     stateDir: process.env.RIG_STATE_DIR || stateDir,
     artifactsDir,
     logsDir: process.env.RIG_LOGS_DIR || logsDir,
     binDir,
-    hooksDir: resolve12(harnessRoot, "hooks"),
-    validationDir: resolve12(harnessRoot, "validation"),
+    hooksDir: resolve13(harnessRoot, "hooks"),
+    validationDir: resolve13(harnessRoot, "validation"),
     taskConfigPath,
-    sessionPath: process.env.RIG_SESSION_FILE || resolve12(stateRoot, "session", "session.json"),
+    sessionPath: process.env.RIG_SESSION_FILE || resolve13(stateRoot, "session", "session.json"),
     monorepoRoot,
-    tsApiTestsDir: process.env.TS_API_TESTS_DIR || resolve12(monorepoRoot, "TSAPITests"),
-    taskRepoCommitsPath: resolve12(stateDir, "task-repo-commits.json"),
-    baseRepoPinsPath: resolve12(stateDir, "base-repo-pins.json"),
-    failedApproachesPath: resolve12(stateDir, "failed_approaches.md"),
-    agentProfilePath: resolve12(stateDir, "agent-profile.json"),
-    reviewProfilePath: resolve12(stateDir, "review-profile.json")
+    tsApiTestsDir: process.env.TS_API_TESTS_DIR || resolve13(monorepoRoot, "TSAPITests"),
+    taskRepoCommitsPath: resolve13(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve13(stateDir, "base-repo-pins.json"),
+    failedApproachesPath: resolve13(stateDir, "failed_approaches.md"),
+    agentProfilePath: resolve13(stateDir, "agent-profile.json"),
+    reviewProfilePath: resolve13(stateDir, "review-profile.json")
   };
 }
 function normalizeRelativeScopePath(inputPath) {
@@ -2243,34 +2297,34 @@ function createNativeScopeMatcher() {
 }
 
 // packages/runtime/src/control-plane/state-sync/repo.ts
-import { existsSync as existsSync12 } from "fs";
-import { resolve as resolve14 } from "path";
+import { existsSync as existsSync13 } from "fs";
+import { resolve as resolve15 } from "path";
 
 // packages/runtime/src/control-plane/repos/layout.ts
-import { existsSync as existsSync11 } from "fs";
-import { basename as basename5, dirname as dirname8, join as join3, resolve as resolve13 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { basename as basename5, dirname as dirname8, join as join3, resolve as resolve14 } from "path";
 function resolveRepoStateDir(projectRoot) {
-  const normalizedProjectRoot = resolve13(projectRoot);
+  const normalizedProjectRoot = resolve14(projectRoot);
   const projectParent = dirname8(normalizedProjectRoot);
   if (basename5(projectParent) === ".worktrees") {
     const ownerRoot = dirname8(projectParent);
-    const ownerHasRepoMarkers = existsSync11(resolve13(ownerRoot, ".git")) || existsSync11(resolve13(ownerRoot, ".rig", "state"));
+    const ownerHasRepoMarkers = existsSync12(resolve14(ownerRoot, ".git")) || existsSync12(resolve14(ownerRoot, ".rig", "state"));
     if (ownerHasRepoMarkers) {
-      return resolve13(ownerRoot, ".rig", "state");
+      return resolve14(ownerRoot, ".rig", "state");
     }
   }
-  return resolve13(projectRoot, ".rig", "state");
+  return resolve14(projectRoot, ".rig", "state");
 }
 function resolveManagedRepoLayout(projectRoot, repoId) {
-  const normalizedProjectRoot = resolve13(projectRoot);
+  const normalizedProjectRoot = resolve14(projectRoot);
   const entry = getManagedRepoEntry(repoId);
   const stateDir = resolveRepoStateDir(normalizedProjectRoot);
   const metadataRelativePath = join3("repos", entry.id);
-  const metadataRoot = resolve13(stateDir, metadataRelativePath);
+  const metadataRoot = resolve14(stateDir, metadataRelativePath);
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  const runsInsideTaskWorktree = runtimeWorkspace && resolve13(runtimeWorkspace) === normalizedProjectRoot || basename5(dirname8(normalizedProjectRoot)) === ".worktrees";
+  const runsInsideTaskWorktree = runtimeWorkspace && resolve14(runtimeWorkspace) === normalizedProjectRoot || basename5(dirname8(normalizedProjectRoot)) === ".worktrees";
   const isPrimaryManagedRepo = listManagedRepoEntries()[0]?.id === repoId;
-  const checkoutRoot = isPrimaryManagedRepo && runsInsideTaskWorktree ? resolveMonorepoRoot(normalizedProjectRoot) : entry.checkoutEnvVar && process.env[entry.checkoutEnvVar]?.trim() ? resolve13(process.env[entry.checkoutEnvVar].trim()) : resolve13(normalizedProjectRoot, entry.alias);
+  const checkoutRoot = isPrimaryManagedRepo && runsInsideTaskWorktree ? resolveMonorepoRoot(normalizedProjectRoot) : entry.checkoutEnvVar && process.env[entry.checkoutEnvVar]?.trim() ? resolve14(process.env[entry.checkoutEnvVar].trim()) : resolve14(normalizedProjectRoot, entry.alias);
   return {
     projectRoot: normalizedProjectRoot,
     repoId: entry.id,
@@ -2278,12 +2332,12 @@ function resolveManagedRepoLayout(projectRoot, repoId) {
     defaultBranch: entry.defaultBranch,
     remoteUrl: entry.remoteEnvVar && process.env[entry.remoteEnvVar]?.trim() ? process.env[entry.remoteEnvVar].trim() : entry.defaultRemoteUrl,
     checkoutRoot,
-    worktreesRoot: resolve13(checkoutRoot, ".worktrees"),
+    worktreesRoot: resolve14(checkoutRoot, ".worktrees"),
     stateDir,
     metadataRoot,
     metadataRelativePath,
-    mirrorRoot: resolve13(metadataRoot, "mirror.git"),
-    mirrorStatePath: resolve13(metadataRoot, "mirror-state.json"),
+    mirrorRoot: resolve14(metadataRoot, "mirror.git"),
+    mirrorStatePath: resolve14(metadataRoot, "mirror-state.json"),
     mirrorStateRelativePath: join3(metadataRelativePath, "mirror-state.json")
   };
 }
@@ -2305,7 +2359,7 @@ function resolveTrackerRepoPath(projectRoot) {
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
   try {
     const layout = resolveMonorepoRepoLayout(projectRoot);
-    if (existsSync12(resolve14(layout.mirrorRoot, "HEAD"))) {
+    if (existsSync13(resolve15(layout.mirrorRoot, "HEAD"))) {
       return layout.mirrorRoot;
     }
   } catch {}
@@ -2316,8 +2370,8 @@ function resolveTrackerRepoPath(projectRoot) {
 var DEFAULT_READ_DEPS = {
   fetchRef: nativeFetchRef,
   readBlobAtRef: nativeReadBlobAtRef,
-  exists: existsSync13,
-  readFile: (path) => readFileSync8(path, "utf8")
+  exists: existsSync14,
+  readFile: (path) => readFileSync9(path, "utf8")
 };
 function parseIssueStatus(rawStatus) {
   const normalized = normalizeTaskLifecycleStatus(rawStatus);
@@ -2398,12 +2452,12 @@ function shouldPreferLocalTrackerState(options) {
   if (runtimeContextPath) {
     return true;
   }
-  return existsSync13(resolve15(runtimeWorkspace, ".rig", "runtime-context.json"));
+  return existsSync14(resolve16(runtimeWorkspace, ".rig", "runtime-context.json"));
 }
 function readLocalTrackerState(projectRoot, deps) {
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
-  const issuesPath = resolve15(monorepoRoot, ".beads", "issues.jsonl");
-  const taskStatePath = resolve15(monorepoRoot, ".beads", "task-state.json");
+  const issuesPath = resolve16(monorepoRoot, ".beads", "issues.jsonl");
+  const taskStatePath = resolve16(monorepoRoot, ".beads", "task-state.json");
   return projectSyncedTrackerSnapshot({
     source: "local",
     issuesBaseOid: null,
@@ -2465,7 +2519,7 @@ function readValidationDescriptions(projectRoot) {
   return readValidationDescriptionMap(raw);
 }
 function readSourceValidationDescriptions(projectRoot) {
-  const rootRaw = readJsonFile(resolve16(projectRoot, "rig", "task-config.json"), {});
+  const rootRaw = readJsonFile(resolve17(projectRoot, "rig", "task-config.json"), {});
   const sourcePath = findSourceTaskConfigPath(projectRoot);
   const sourceRaw = sourcePath ? readJsonFile(sourcePath, {}) : {};
   const rootDescriptions = readValidationDescriptionMap(rootRaw);
@@ -2541,15 +2595,15 @@ function readValidationDescriptionsFromMeta(meta) {
   return meta.validation_descriptions;
 }
 function readLocalSourceTaskStateEnvelope(projectRoot) {
-  const taskStatePath = resolve16(resolveMonorepoRoot2(projectRoot), ".beads", "task-state.json");
+  const taskStatePath = resolve17(resolveMonorepoRoot2(projectRoot), ".beads", "task-state.json");
   return readTaskStateMetadataEnvelope(readJsonFile(taskStatePath, {}));
 }
 function readLocalSourceTaskLifecycleStatus(projectRoot, taskId) {
-  const issuesPath = resolve16(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
-  if (!existsSync14(issuesPath)) {
+  const issuesPath = resolve17(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync15(issuesPath)) {
     return null;
   }
-  for (const line of readFileSync9(issuesPath, "utf8").split(/\r?\n/)) {
+  for (const line of readFileSync10(issuesPath, "utf8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -2590,25 +2644,25 @@ function lookupTask(projectRoot, input) {
 function artifactDirForId(projectRoot, id) {
   const workspaceDir = process.env.RIG_TASK_WORKSPACE?.trim();
   if (workspaceDir) {
-    const worktreeArtifacts = resolve16(workspaceDir, "artifacts", id);
-    if (existsSync14(worktreeArtifacts) || existsSync14(resolve16(workspaceDir, "artifacts"))) {
+    const worktreeArtifacts = resolve17(workspaceDir, "artifacts", id);
+    if (existsSync15(worktreeArtifacts) || existsSync15(resolve17(workspaceDir, "artifacts"))) {
       return worktreeArtifacts;
     }
   }
   try {
     const paths = resolveHarnessPaths(projectRoot);
-    return resolve16(paths.artifactsDir, id);
+    return resolve17(paths.artifactsDir, id);
   } catch {
-    return resolve16(resolveMonorepoRoot2(projectRoot), "artifacts", id);
+    return resolve17(resolveMonorepoRoot2(projectRoot), "artifacts", id);
   }
 }
 function resolveTaskConfigPath(projectRoot) {
   const paths = resolveHarnessPaths(projectRoot);
-  if (existsSync14(paths.taskConfigPath)) {
+  if (existsSync15(paths.taskConfigPath)) {
     return paths.taskConfigPath;
   }
   for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
-    if (existsSync14(candidate)) {
+    if (existsSync15(candidate)) {
       return candidate;
     }
   }
@@ -2616,7 +2670,7 @@ function resolveTaskConfigPath(projectRoot) {
 }
 function findSourceTaskConfigPath(projectRoot) {
   for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
-    if (existsSync14(candidate)) {
+    if (existsSync15(candidate)) {
       return candidate;
     }
   }
@@ -2629,7 +2683,7 @@ function readAndSyncSourceTaskConfig(projectRoot) {
   const synced = synchronizeTaskConfigWithTracker(projectRoot, raw);
   if (sourcePath && synced.updated) {
     try {
-      writeFileSync5(sourcePath, `${JSON.stringify(synced.config, null, 2)}
+      writeFileSync6(sourcePath, `${JSON.stringify(synced.config, null, 2)}
 `, "utf-8");
     } catch {}
   }
@@ -2681,12 +2735,12 @@ function shouldRefreshAutoSyncedTaskConfigEntry(entry) {
   return !candidate.role;
 }
 function readSourceIssueRecords(projectRoot) {
-  const issuesPath = resolve16(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
-  if (!existsSync14(issuesPath)) {
+  const issuesPath = resolve17(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync15(issuesPath)) {
     return [];
   }
   const records = [];
-  for (const line of readFileSync9(issuesPath, "utf-8").split(/\r?\n/)) {
+  for (const line of readFileSync10(issuesPath, "utf-8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -2742,19 +2796,19 @@ function readConfiguredFileTaskConfig(projectRoot) {
   if (!sourcePath) {
     return {};
   }
-  const directory = resolve16(projectRoot, sourcePath);
-  if (!existsSync14(directory)) {
+  const directory = resolve17(projectRoot, sourcePath);
+  if (!existsSync15(directory)) {
     return {};
   }
   const config = {};
-  for (const name of readdirSync2(directory)) {
+  for (const name of readdirSync3(directory)) {
     if (!FILE_TASK_PATTERN2.test(name))
       continue;
-    const file = resolve16(directory, name);
+    const file = resolve17(directory, name);
     try {
       if (!statSync3(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync9(file, "utf8"));
+      const raw = JSON.parse(readFileSync10(file, "utf8"));
       if (!raw || typeof raw !== "object" || Array.isArray(raw))
         continue;
       const record = raw;
@@ -2796,10 +2850,10 @@ function firstStringList2(...candidates) {
   return [];
 }
 function readConfiguredFilesTaskSourcePath2(projectRoot) {
-  const jsonPath = resolve16(projectRoot, "rig.config.json");
-  if (existsSync14(jsonPath)) {
+  const jsonPath = resolve17(projectRoot, "rig.config.json");
+  if (existsSync15(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync9(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync10(jsonPath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         const taskSource = parsed.taskSource;
         if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
@@ -2811,12 +2865,12 @@ function readConfiguredFilesTaskSourcePath2(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve16(projectRoot, "rig.config.ts");
-  if (!existsSync14(tsPath)) {
+  const tsPath = resolve17(projectRoot, "rig.config.ts");
+  if (!existsSync15(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync9(tsPath, "utf8");
+    const source = readFileSync10(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -2830,23 +2884,23 @@ function readConfiguredFilesTaskSourcePath2(projectRoot) {
 function sourceTaskConfigCandidates(projectRoot) {
   const runtimeContext = loadRuntimeContextFromEnv();
   return [
-    runtimeContext?.monorepoMainRoot ? resolve16(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
-    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve16(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
-    resolve16(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
+    runtimeContext?.monorepoMainRoot ? resolve17(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve17(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve17(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
   ].filter(Boolean);
 }
 
 // packages/runtime/src/control-plane/native/validator.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
-import { resolve as resolve21 } from "path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
+import { resolve as resolve22 } from "path";
 
 // packages/runtime/src/control-plane/native/validator-binaries.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync6, rmSync as rmSync4, statSync as statSync4 } from "fs";
-import { dirname as dirname10, resolve as resolve20 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync7, rmSync as rmSync5, statSync as statSync4 } from "fs";
+import { dirname as dirname10, resolve as resolve21 } from "path";
 
 // packages/runtime/src/binary-run.ts
-import { chmodSync as chmodSync2, cpSync, existsSync as existsSync15, mkdirSync as mkdirSync5, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename7, dirname as dirname9, resolve as resolve17 } from "path";
+import { chmodSync as chmodSync2, cpSync, existsSync as existsSync16, mkdirSync as mkdirSync6, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync7 } from "fs";
+import { basename as basename7, dirname as dirname9, resolve as resolve18 } from "path";
 import { fileURLToPath } from "url";
 import { drainMicrotasks, gcAndSweep } from "bun:jsc";
 var runtimeBinaryBuildQueue = Promise.resolve();
@@ -2872,9 +2926,9 @@ async function buildRuntimeBinary(options) {
   });
 }
 async function buildRuntimeBinaryInProcess(options, manifest) {
-  const tempBuildDir = resolve17(dirname9(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-  const tempOutputPath = resolve17(tempBuildDir, basename7(options.outputPath));
-  mkdirSync5(tempBuildDir, { recursive: true });
+  const tempBuildDir = resolve18(dirname9(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  const tempOutputPath = resolve18(tempBuildDir, basename7(options.outputPath));
+  mkdirSync6(tempBuildDir, { recursive: true });
   await withTemporaryEnv({
     ...options.env,
     ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
@@ -2899,7 +2953,7 @@ async function buildRuntimeBinaryInProcess(options, manifest) {
 `);
       throw new Error(`Failed to build ${options.entrypoint}: ${details || "Bun.build() returned errors"}`);
     }
-    if (!existsSync15(tempOutputPath)) {
+    if (!existsSync16(tempOutputPath)) {
       const emitted = buildResult.outputs.map((output) => output.path).join(", ") || "(none)";
       throw new Error(`Failed to build ${options.entrypoint}: Bun.build() did not emit ${tempOutputPath}. Emitted: ${emitted}`);
     }
@@ -2914,7 +2968,7 @@ async function buildRuntimeBinaryInProcess(options, manifest) {
       });
     }
   })).finally(() => {
-    rmSync3(tempBuildDir, { recursive: true, force: true });
+    rmSync4(tempBuildDir, { recursive: true, force: true });
   });
 }
 function runBestEffortBuildGc() {
@@ -2931,8 +2985,8 @@ function runtimeBinaryCacheManifestPath(outputPath) {
 function resolveRuntimeBinaryBuildOptions(options) {
   return {
     ...options,
-    entrypoint: resolve17(options.cwd, options.sourcePath),
-    outputPath: resolve17(options.outputPath)
+    entrypoint: resolve18(options.cwd, options.sourcePath),
+    outputPath: resolve18(options.outputPath)
   };
 }
 function shouldUseRuntimeBinaryBuildWorker() {
@@ -2946,7 +3000,7 @@ function shouldUseRuntimeBinaryBuildWorker() {
 }
 async function buildRuntimeBinaryViaWorker(options) {
   const workerSourcePath = resolveRuntimeBinaryBuildWorkerSourcePath(options);
-  if (!workerSourcePath || !existsSync15(workerSourcePath)) {
+  if (!workerSourcePath || !existsSync16(workerSourcePath)) {
     await buildRuntimeBinaryInProcess(options, {
       manifestPath: runtimeBinaryCacheManifestPath(options.outputPath),
       buildKey: createRuntimeBinaryBuildKey({
@@ -2977,13 +3031,13 @@ async function buildRuntimeBinaryViaWorker(options) {
     new Response(build.stdout).text(),
     new Response(build.stderr).text()
   ]);
-  rmSync3(payloadPath, { force: true });
+  rmSync4(payloadPath, { force: true });
   if (exitCode !== 0) {
     throw new Error(`Failed to build ${options.entrypoint}: ${(stderr || stdout || `worker exited ${exitCode}`).trim()}`);
   }
 }
 function createRuntimeBinaryBuildWorkerPayloadPath(outputPath) {
-  return resolve17(dirname9(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+  return resolve18(dirname9(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
 }
 function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
   const envRoots = [
@@ -2992,13 +3046,13 @@ function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
     process.env.PROJECT_RIG_ROOT?.trim()
   ].filter(Boolean);
   for (const root of envRoots) {
-    const candidate = resolve17(root, "packages/runtime/src/binary-build-worker.ts");
-    if (existsSync15(candidate)) {
+    const candidate = resolve18(root, "packages/runtime/src/binary-build-worker.ts");
+    if (existsSync16(candidate)) {
       return candidate;
     }
   }
-  const localCandidate = resolve17(import.meta.dir, "binary-build-worker.ts");
-  return existsSync15(localCandidate) ? localCandidate : null;
+  const localCandidate = resolve18(import.meta.dir, "binary-build-worker.ts");
+  return existsSync16(localCandidate) ? localCandidate : null;
 }
 function resolveRuntimeBinaryBuildWorkerInvocation() {
   const bunPath = Bun.which("bun");
@@ -3034,7 +3088,7 @@ function createRuntimeBinaryBuildKey(input) {
   });
 }
 async function isRuntimeBinaryBuildFresh(input) {
-  if (!existsSync15(input.outputPath) || !existsSync15(input.manifestPath)) {
+  if (!existsSync16(input.outputPath) || !existsSync16(input.manifestPath)) {
     return false;
   }
   let manifest = null;
@@ -3047,7 +3101,7 @@ async function isRuntimeBinaryBuildFresh(input) {
     return false;
   }
   for (const [filePath, expectedDigest] of Object.entries(manifest.inputs || {})) {
-    if (!existsSync15(filePath)) {
+    if (!existsSync16(filePath)) {
       return false;
     }
     if (await sha256File(filePath) !== expectedDigest) {
@@ -3060,7 +3114,7 @@ async function writeRuntimeBinaryCacheManifest(input) {
   const inputs = {};
   for (const inputPath of Object.keys(input.metafile?.inputs || {}).sort()) {
     const normalized = normalizeBuildInputPath(input.cwd, inputPath);
-    if (!normalized || !existsSync15(normalized)) {
+    if (!normalized || !existsSync16(normalized)) {
       continue;
     }
     inputs[normalized] = await sha256File(normalized);
@@ -3083,7 +3137,7 @@ function normalizeBuildInputPath(cwd, inputPath) {
   if (inputPath.startsWith("<")) {
     return null;
   }
-  return resolve17(cwd, inputPath);
+  return resolve18(cwd, inputPath);
 }
 async function sha256File(path) {
   const hasher = new Bun.CryptoHasher("sha256");
@@ -3099,8 +3153,8 @@ function sortRecord(value) {
 async function runSerializedRuntimeBinaryBuild(action) {
   const previous = runtimeBinaryBuildQueue;
   let release;
-  runtimeBinaryBuildQueue = new Promise((resolve18) => {
-    release = resolve18;
+  runtimeBinaryBuildQueue = new Promise((resolve19) => {
+    release = resolve19;
   });
   await previous;
   try {
@@ -3145,11 +3199,11 @@ async function withTemporaryCwd(cwd, action) {
 }
 
 // packages/runtime/src/control-plane/runtime/provisioning-env.ts
-import { delimiter, resolve as resolve19 } from "path";
+import { delimiter, resolve as resolve20 } from "path";
 
 // packages/runtime/src/control-plane/runtime/runtime-paths.ts
-import { existsSync as existsSync16, readdirSync as readdirSync3, realpathSync } from "fs";
-import { resolve as resolve18 } from "path";
+import { existsSync as existsSync17, readdirSync as readdirSync4, realpathSync } from "fs";
+import { resolve as resolve19 } from "path";
 
 // packages/runtime/src/control-plane/runtime/sandbox/utils.ts
 function uniq(values) {
@@ -3167,7 +3221,7 @@ function resolveBunBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve18(home, ".bun/bin/bun") : "",
+    home ? resolve19(home, ".bun/bin/bun") : "",
     "/opt/homebrew/bin/bun",
     "/usr/local/bin/bun",
     "/usr/bin/bun"
@@ -3195,8 +3249,8 @@ function resolveClaudeBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve18(home, ".local/bin/claude") : "",
-    home ? resolve18(home, ".local/share/claude/local/claude") : "",
+    home ? resolve19(home, ".local/bin/claude") : "",
+    home ? resolve19(home, ".local/share/claude/local/claude") : "",
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude",
     "/usr/bin/claude"
@@ -3210,51 +3264,51 @@ function resolveClaudeBinaryPath() {
   throw new Error("claude not found in PATH");
 }
 function resolveBunInstallDir(bunBinaryPath = resolveBunBinaryPath()) {
-  return resolve18(bunBinaryPath, "../..");
+  return resolve19(bunBinaryPath, "../..");
 }
 function resolveClaudeInstallDir() {
   const realPath = resolveClaudeBinaryPath();
-  return resolve18(realPath, "..");
+  return resolve19(realPath, "..");
 }
 function resolveNodeInstallDir() {
   const preferredNode = resolvePreferredNodeBinary();
   if (!preferredNode)
     return null;
   const explicitNode = process.env.RIG_NODE_BIN?.trim();
-  if (explicitNode && resolve18(explicitNode) === resolve18(preferredNode)) {
-    return preferredNode.endsWith("/bin/node") ? resolve18(preferredNode, "../..") : resolve18(preferredNode, "..");
+  if (explicitNode && resolve19(explicitNode) === resolve19(preferredNode)) {
+    return preferredNode.endsWith("/bin/node") ? resolve19(preferredNode, "../..") : resolve19(preferredNode, "..");
   }
   try {
     const realPath = realpathSync(preferredNode);
     if (realPath.endsWith("/bin/node")) {
-      return resolve18(realPath, "../..");
+      return resolve19(realPath, "../..");
     }
-    return resolve18(realPath, "..");
+    return resolve19(realPath, "..");
   } catch {
-    return resolve18(preferredNode, "..");
+    return resolve19(preferredNode, "..");
   }
 }
 function resolvePreferredNodeBinary() {
   const candidates = [];
   const envNode = process.env.RIG_NODE_BIN?.trim();
   if (envNode) {
-    const explicit = resolve18(envNode);
-    if (existsSync16(explicit)) {
+    const explicit = resolve19(envNode);
+    if (existsSync17(explicit)) {
       return explicit;
     }
   }
   const nvmBin = process.env.NVM_BIN?.trim();
   if (nvmBin) {
-    candidates.push(resolve18(nvmBin, "node"));
+    candidates.push(resolve19(nvmBin, "node"));
   }
   const home = process.env.HOME?.trim();
   if (home) {
-    const nvmVersionsDir = resolve18(home, ".nvm/versions/node");
-    if (existsSync16(nvmVersionsDir)) {
+    const nvmVersionsDir = resolve19(home, ".nvm/versions/node");
+    if (existsSync17(nvmVersionsDir)) {
       try {
-        const versionDirs = readdirSync3(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
+        const versionDirs = readdirSync4(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
         for (const versionDir of versionDirs) {
-          candidates.push(resolve18(nvmVersionsDir, versionDir, "bin/node"));
+          candidates.push(resolve19(nvmVersionsDir, versionDir, "bin/node"));
         }
       } catch {}
     }
@@ -3263,8 +3317,8 @@ function resolvePreferredNodeBinary() {
   if (whichNode) {
     candidates.push(whichNode);
   }
-  const deduped = uniq(candidates.map((candidate) => resolve18(candidate)));
-  const existing = deduped.filter((candidate) => existsSync16(candidate));
+  const deduped = uniq(candidates.map((candidate) => resolve19(candidate)));
+  const existing = deduped.filter((candidate) => existsSync17(candidate));
   if (existing.length === 0) {
     return null;
   }
@@ -3278,7 +3332,7 @@ function resolvePreferredNodeBinary() {
   return existing[0] ?? null;
 }
 function inferNodeMajor(nodeBinaryPath) {
-  const normalized = resolve18(nodeBinaryPath).replace(/\\/g, "/");
+  const normalized = resolve19(nodeBinaryPath).replace(/\\/g, "/");
   const match = normalized.match(/(?:^|\/)(?:node-)?v?(\d+)\.\d+\.\d+(?:\/|$)/);
   if (!match) {
     return null;
@@ -3290,8 +3344,8 @@ function normalizeExecutablePath(candidate) {
   if (!candidate) {
     return "";
   }
-  const normalized = resolve18(candidate);
-  if (!existsSync16(normalized)) {
+  const normalized = resolve19(candidate);
+  if (!existsSync17(normalized)) {
     return "";
   }
   try {
@@ -3301,7 +3355,7 @@ function normalizeExecutablePath(candidate) {
   }
 }
 function looksLikeRuntimeGateway(candidate) {
-  const normalized = resolve18(candidate).replace(/\\/g, "/");
+  const normalized = resolve19(candidate).replace(/\\/g, "/");
   return normalized.includes("/.rig/bin/") || normalized.endsWith("/rig-shell") || normalized.endsWith("/rig-agent");
 }
 
@@ -3322,7 +3376,7 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     try {
       return resolveClaudeInstallDir();
     } catch {
-      return resolve19(claudeBinary, "..");
+      return resolve20(claudeBinary, "..");
     }
   })() : "";
   const nodeDir = resolveNodeInstallDir();
@@ -3332,8 +3386,8 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     `${bunDir}/bin`,
     claudeDir,
     nodeDir ? `${nodeDir}/bin` : "",
-    realHome ? resolve19(realHome, ".local/bin") : "",
-    realHome ? resolve19(realHome, ".cargo/bin") : "",
+    realHome ? resolve20(realHome, ".local/bin") : "",
+    realHome ? resolve20(realHome, ".cargo/bin") : "",
     ...inheritedPath,
     "/usr/local/bin",
     "/usr/local/sbin",
@@ -3364,9 +3418,9 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
 // packages/runtime/src/control-plane/native/validator-binaries.ts
 function resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext) {
   if (runtimeContext) {
-    return resolve20(runtimeContext.binDir, "validators", binaryName);
+    return resolve21(runtimeContext.binDir, "validators", binaryName);
   }
-  return resolve20(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
+  return resolve21(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
 }
 async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
   const match = checkId.match(/^([a-z][\w-]*):([a-z][\w-]*)$/);
@@ -3381,19 +3435,19 @@ async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
   const binaryName = `${category}-${check}`;
   const binaryPath = resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
   const hostProjectRoot = runtimeContext?.hostProjectRoot?.trim() || projectRoot;
-  const sourcePath = resolve20(hostProjectRoot, "packages/runtime/src/control-plane/validators", category, `${check}.ts`);
-  if (!existsSync17(sourcePath)) {
+  const sourcePath = resolve21(hostProjectRoot, "packages/runtime/src/control-plane/validators", category, `${check}.ts`);
+  if (!existsSync18(sourcePath)) {
     return null;
   }
   const sourceMtime = statSync4(sourcePath).mtimeMs;
-  const binaryExists = existsSync17(binaryPath);
+  const binaryExists = existsSync18(binaryPath);
   const binaryMtime = binaryExists ? statSync4(binaryPath).mtimeMs : 0;
   if (!binaryExists || sourceMtime > binaryMtime) {
     if (binaryExists) {
-      rmSync4(binaryPath, { force: true });
-      rmSync4(`${binaryPath}.build-manifest.json`, { force: true });
+      rmSync5(binaryPath, { force: true });
+      rmSync5(`${binaryPath}.build-manifest.json`, { force: true });
     }
-    mkdirSync6(dirname10(binaryPath), { recursive: true });
+    mkdirSync7(dirname10(binaryPath), { recursive: true });
     await buildRuntimeBinary({
       sourcePath: `packages/runtime/src/control-plane/validators/${category}/${check}.ts`,
       outputPath: binaryPath,
@@ -3402,7 +3456,7 @@ async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
       env: runtimeProvisioningEnv()
     });
   }
-  return existsSync17(binaryPath) ? binaryPath : null;
+  return existsSync18(binaryPath) ? binaryPath : null;
 }
 
 // packages/runtime/src/control-plane/native/validator.ts
@@ -3439,20 +3493,20 @@ async function readTaskSourceValidation(projectRoot, taskId) {
 function resolveValidationPaths(projectRoot, taskId, runtimeContext) {
   if (runtimeContext) {
     return {
-      taskLogDir: resolve21(runtimeContext.logsDir, taskId),
-      artifactDir: resolve21(runtimeContext.workspaceDir, "artifacts", taskId)
+      taskLogDir: resolve22(runtimeContext.logsDir, taskId),
+      artifactDir: resolve22(runtimeContext.workspaceDir, "artifacts", taskId)
     };
   }
   const paths = resolveHarnessPaths(projectRoot);
   return {
-    taskLogDir: resolve21(paths.logsDir, taskId),
-    artifactDir: resolve21(paths.artifactsDir, taskId)
+    taskLogDir: resolve22(paths.logsDir, taskId),
+    artifactDir: resolve22(paths.artifactsDir, taskId)
   };
 }
 async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext) {
   const binaryName = checkId.replace(":", "-");
   const binaryPath = await ensureValidatorBinary(projectRoot, checkId, runtimeContext) ?? resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
-  if (!existsSync18(binaryPath)) {
+  if (!existsSync19(binaryPath)) {
     return {
       result: {
         id: checkId,
@@ -3463,7 +3517,7 @@ async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext)
     };
   }
   const validatorCwd = runtimeContext?.workspaceDir || resolveMonorepoRoot(projectRoot);
-  const runtimeShellPath = runtimeContext ? resolve21(runtimeContext.binDir, "rig-shell") : "";
+  const runtimeShellPath = runtimeContext ? resolve22(runtimeContext.binDir, "rig-shell") : "";
   const monorepoMainRoot = runtimeContext?.monorepoMainRoot || process.env.MONOREPO_MAIN_ROOT?.trim() || resolveMonorepoRoot(projectRoot);
   const validatorEnv = {
     PROJECT_RIG_ROOT: runtimeContext?.hostProjectRoot || projectRoot,
@@ -3478,7 +3532,7 @@ async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext)
     validatorEnv.RIG_LOGS_DIR = runtimeContext.logsDir;
     validatorEnv.RIG_RUNTIME_BIN_DIR = runtimeContext.binDir;
   }
-  const { exitCode, stdout, stderr } = await runCaptureAsync(runtimeShellPath && existsSync18(runtimeShellPath) ? [runtimeShellPath, "run-binary", binaryPath] : [binaryPath], validatorCwd, validatorEnv);
+  const { exitCode, stdout, stderr } = await runCaptureAsync(runtimeShellPath && existsSync19(runtimeShellPath) ? [runtimeShellPath, "run-binary", binaryPath] : [binaryPath], validatorCwd, validatorEnv);
   try {
     const result = JSON.parse(stdout.trim());
     return { result, exitCode };
@@ -3518,8 +3572,8 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
   const configuredValidation = stringArray(taskConfig[taskId]?.validation);
   const commands = resolvedContext?.validation?.length ? resolvedContext.validation : configuredValidation.length > 0 ? configuredValidation : sourceValidation.validation;
   const { taskLogDir, artifactDir } = resolveValidationPaths(projectRoot, taskId, resolvedContext);
-  mkdirSync7(taskLogDir, { recursive: true });
-  mkdirSync7(artifactDir, { recursive: true });
+  mkdirSync8(taskLogDir, { recursive: true });
+  mkdirSync8(artifactDir, { recursive: true });
   if (commands.length === 0) {
     const skipped = {
       status: "skipped",
@@ -3528,7 +3582,7 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
       failed: 0,
       categories: []
     };
-    writeFileSync7(resolve21(artifactDir, "validation-summary.json"), `${JSON.stringify(skipped, null, 2)}
+    writeFileSync8(resolve22(artifactDir, "validation-summary.json"), `${JSON.stringify(skipped, null, 2)}
 `, "utf-8");
     return skipped;
   }
@@ -3563,18 +3617,18 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
         exit_code: 2,
         duration_seconds: 0
       });
-      const logFile2 = resolve21(taskLogDir, `invalid-entry-validation.log`);
-      mkdirSync7(taskLogDir, { recursive: true });
-      writeFileSync7(logFile2, `=== ${nowIso()} :: ${cmd} ===
+      const logFile2 = resolve22(taskLogDir, `invalid-entry-validation.log`);
+      mkdirSync8(taskLogDir, { recursive: true });
+      writeFileSync8(logFile2, `=== ${nowIso()} :: ${cmd} ===
 Invalid validation entry: not a check-ID. All entries must use format "category:check-name".
 `, "utf-8");
       continue;
     }
     const { result, exitCode } = await dispatchValidator(cmd, effectiveRegistry, validatorCtx, (id) => runValidatorBinary(projectRoot, taskId, id, resolvedContext));
     const durationSeconds = Math.max(0, Math.round((Date.now() - startedAt) / 1000));
-    const logFile = resolve21(taskLogDir, `${cmd.replace(":", "-")}-validation.log`);
-    mkdirSync7(taskLogDir, { recursive: true });
-    writeFileSync7(logFile, `=== ${nowIso()} :: ${cmd} ===
+    const logFile = resolve22(taskLogDir, `${cmd.replace(":", "-")}-validation.log`);
+    mkdirSync8(taskLogDir, { recursive: true });
+    writeFileSync8(logFile, `=== ${nowIso()} :: ${cmd} ===
 ${JSON.stringify(result, null, 2)}
 `, "utf-8");
     if (result.passed) {
@@ -3589,32 +3643,1277 @@ ${JSON.stringify(result, null, 2)}
       }
     }
   }
-  const summary = {
-    status: failed === 0 ? "pass" : "fail",
-    total: commands.length,
-    passed,
-    failed,
-    categories
+  const summary = {
+    status: failed === 0 ? "pass" : "fail",
+    total: commands.length,
+    passed,
+    failed,
+    categories
+  };
+  mkdirSync8(artifactDir, { recursive: true });
+  writeFileSync8(resolve22(artifactDir, "validation-summary.json"), `${JSON.stringify(summary, null, 2)}
+`, "utf-8");
+  return summary;
+}
+
+// packages/runtime/src/control-plane/native/verifier.ts
+import { existsSync as existsSync20, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
+import { resolve as resolve23 } from "path";
+
+// packages/runtime/src/control-plane/native/pr-review-gate.ts
+function parseJsonObject(value) {
+  if (!value?.trim())
+    return { value: {}, error: "empty JSON output" };
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? { value: parsed } : { value: {}, error: "JSON output was not an object" };
+  } catch (error) {
+    return { value: {}, error: error instanceof Error ? error.message : String(error) };
+  }
+}
+function flattenPaginatedArray(value) {
+  if (!Array.isArray(value))
+    return null;
+  if (value.every((entry) => Array.isArray(entry))) {
+    return value.flatMap((entry) => entry);
+  }
+  return value;
+}
+function parseConcatenatedJsonValues(value) {
+  const text = value.trim();
+  const docs = [];
+  let start = null;
+  let depth = 0;
+  let inString = false;
+  let escape = false;
+  for (let index = 0;index < text.length; index += 1) {
+    const char = text[index];
+    if (start === null) {
+      if (/\s/.test(char))
+        continue;
+      start = index;
+    }
+    if (inString) {
+      if (escape) {
+        escape = false;
+      } else if (char === "\\") {
+        escape = true;
+      } else if (char === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (char === '"') {
+      inString = true;
+      continue;
+    }
+    if (char === "{" || char === "[") {
+      depth += 1;
+      continue;
+    }
+    if (char === "}" || char === "]") {
+      depth -= 1;
+      if (depth < 0)
+        return { value: docs, error: "unexpected JSON close delimiter" };
+      if (depth === 0 && start !== null) {
+        const segment = text.slice(start, index + 1);
+        try {
+          docs.push(JSON.parse(segment));
+        } catch (error) {
+          return { value: docs, error: error instanceof Error ? error.message : String(error) };
+        }
+        start = null;
+      }
+    }
+  }
+  if (inString || depth !== 0 || start !== null)
+    return { value: docs, error: "incomplete JSON stream" };
+  return { value: docs };
+}
+function parseJsonArray(value) {
+  if (!value?.trim())
+    return { value: [], error: "empty JSON output" };
+  try {
+    const parsed = JSON.parse(value);
+    const flattened = flattenPaginatedArray(parsed);
+    return flattened ? { value: flattened } : { value: [], error: "JSON output was not an array" };
+  } catch (error) {
+    const streamed = parseConcatenatedJsonValues(value);
+    if (streamed.error)
+      return { value: [], error: error instanceof Error ? error.message : String(error) };
+    const flattened = streamed.value.flatMap((entry) => flattenPaginatedArray(entry) ?? []);
+    return flattened.length > 0 || streamed.value.length === 0 ? { value: flattened } : { value: [], error: "JSON output was not an array" };
+  }
+}
+function parseGithubPrUrl(prUrl) {
+  const match = /^https?:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)\/?$/i.exec(prUrl.trim());
+  if (!match)
+    return null;
+  const prNumber = Number.parseInt(match[3], 10);
+  if (!Number.isFinite(prNumber))
+    return null;
+  return { owner: match[1], repo: match[2], repoName: `${match[1]}/${match[2]}`, prNumber };
+}
+function checkName(check) {
+  return String(check.name ?? check.context ?? "").trim();
+}
+function checkState(check) {
+  return String(check.conclusion ?? check.state ?? check.status ?? "").trim().toLowerCase();
+}
+function isGreptileLabel(value) {
+  return String(value ?? "").toLowerCase().includes("greptile");
+}
+function isGreptileGithubLogin(value) {
+  const login = String(value ?? "").toLowerCase().replace(/\[bot\]$/, "");
+  return login === "greptile" || login === "greptile-ai" || login === "greptileai" || login === "greptile-apps";
+}
+function isPassingCheck(check) {
+  const state = checkState(check);
+  return ["success", "successful", "passed", "neutral", "skipped", "completed"].includes(state);
+}
+function isPendingCheck(check) {
+  const state = checkState(check);
+  return ["pending", "queued", "in_progress", "waiting", "requested", "expected", "action_required"].includes(state);
+}
+function isFailingCheck(check) {
+  const state = checkState(check);
+  return ["failure", "failed", "timed_out", "action_required", "cancelled", "canceled", "error"].includes(state);
+}
+function wildcardToRegExp(pattern) {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`, "i");
+}
+function isAllowedFailure(name, allowedFailures) {
+  return allowedFailures.some((pattern) => wildcardToRegExp(pattern).test(name));
+}
+function greptileScorePatterns() {
+  return [
+    /\b(?:confidence\s+score|confidence|rating|score)\s*:?\s*(\d+)\s*\/\s*(\d+)/gi,
+    /\b(\d+)\s*\/\s*(\d+)\s*(?:confidence|rating|score)/gi,
+    /\bgreptile[^\n]{0,80}?(\d+)\s*\/\s*(\d+)/gi
+  ];
+}
+function parseGreptileScores(input) {
+  const text = stripHtml(input);
+  const seen = new Set;
+  const scores = [];
+  for (const pattern of greptileScorePatterns()) {
+    for (const match of text.matchAll(pattern)) {
+      const value = Number.parseInt(match[1] || "", 10);
+      const scale = Number.parseInt(match[2] || "", 10);
+      if (!Number.isFinite(value) || !Number.isFinite(scale) || scale <= 0)
+        continue;
+      const raw = match[0] || `${value}/${scale}`;
+      const key = `${match.index ?? -1}:${value}/${scale}:${raw.toLowerCase()}`;
+      if (seen.has(key))
+        continue;
+      seen.add(key);
+      scores.push({ value, scale, raw });
+    }
+  }
+  return scores;
+}
+function parseGreptileScore(input) {
+  return parseGreptileScores(input)[0] ?? null;
+}
+function stripHtml(input) {
+  return input.replace(/<[^>]+>/g, " ").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/\r/g, "").replace(/\n{3,}/g, `
+
+`).trim();
+}
+function containsBlockerText(input) {
+  const text = stripHtml(input).replace(/\b(?:no|without|zero)\s+blockers?\b/gi, " ").replace(/\bno\s+changes\s+requested\b/gi, " ");
+  return /not safe(?: to merge)?|unsafe(?: to merge)?|do not merge|cannot merge|blockers?|must fix|changes requested|please fix|needs? fix|fix this|address this|\breject(?:ed|ion)?\b|\bskip(?:ped)?\b|status\s*:\s*(?:reject(?:ed)?|skip(?:ped)?|failed)/i.test(text);
+}
+function isStrictFiveOfFive(score) {
+  return score.value === 5 && score.scale === 5;
+}
+function containsConflictingScoreText(input) {
+  return parseGreptileScores(input).some((score) => !isStrictFiveOfFive(score));
+}
+function extractGreptileCommentBlock(input) {
+  const match = input.match(/<!--\s*greptile_comment\s*-->([\s\S]*?)<!--\s*\/greptile_comment\s*-->/i);
+  return match?.[1]?.trim() ?? null;
+}
+function extractGreptileBodyReviewedSha(input) {
+  const block = extractGreptileCommentBlock(input);
+  if (!block)
+    return null;
+  const commitLink = block.match(/\/commit\/([0-9a-f]{40})(?:\b|[^0-9a-f])/i);
+  return commitLink?.[1]?.toLowerCase() ?? null;
+}
+function isoAtOrAfter(value, floor) {
+  if (!value || !floor)
+    return false;
+  const valueMs = Date.parse(value);
+  const floorMs = Date.parse(floor);
+  return Number.isFinite(valueMs) && Number.isFinite(floorMs) && valueMs >= floorMs;
+}
+function greptileStatusVerdict(status) {
+  const normalized = String(status ?? "").trim().toUpperCase().replace(/[\s-]+/g, "_");
+  if (!normalized)
+    return null;
+  if (["APPROVE", "APPROVED"].includes(normalized))
+    return "approved";
+  if (["REJECT", "REJECTED", "CHANGES_REQUESTED", "CHANGE_REQUESTED"].includes(normalized))
+    return "rejected";
+  if (["SKIP", "SKIPPED"].includes(normalized))
+    return "skipped";
+  if (["FAIL", "FAILED", "FAILURE", "ERROR"].includes(normalized))
+    return "failed";
+  if (["PENDING", "QUEUED", "IN_PROGRESS", "RUNNING", "STARTED", "REQUESTED", "REVIEWING_FILES", "GENERATING_SUMMARY"].includes(normalized))
+    return "pending";
+  if (["COMPLETE", "COMPLETED"].includes(normalized))
+    return "completed";
+  return null;
+}
+function isBlockingGreptileVerdict(verdict) {
+  return verdict === "rejected" || verdict === "skipped" || verdict === "failed";
+}
+function greptileRequestTimeoutMs(env) {
+  const fallback = 30000;
+  const parsed = Number.parseInt(env.GREPTILE_REQUEST_TIMEOUT_MS || `${fallback}`, 10);
+  return Number.isFinite(parsed) && parsed >= 1000 ? parsed : fallback;
+}
+function normalizeGreptileMcpCodeReview(entry, fallbackId) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry))
+    return null;
+  const record = entry;
+  const id = typeof record.id === "string" ? record.id.trim() : fallbackId?.trim() ?? "";
+  if (!id)
+    return null;
+  const metadataRecord = record.metadata && typeof record.metadata === "object" && !Array.isArray(record.metadata) ? record.metadata : null;
+  return {
+    id,
+    status: typeof record.status === "string" ? record.status : null,
+    createdAt: typeof record.createdAt === "string" ? record.createdAt : null,
+    body: typeof record.body === "string" ? record.body : null,
+    metadata: metadataRecord ? { checkHeadSha: typeof metadataRecord.checkHeadSha === "string" ? metadataRecord.checkHeadSha : null } : null
+  };
+}
+function uniqueGreptileCodeReviews(reviews) {
+  const seen = new Set;
+  const unique2 = [];
+  for (const review of reviews) {
+    if (seen.has(review.id))
+      continue;
+    seen.add(review.id);
+    unique2.push(review);
+  }
+  return unique2;
+}
+function selectGreptileApiReviewsForGate(reviews, headSha) {
+  const sorted = [...reviews].sort((left, right) => Date.parse(right.createdAt ?? "") - Date.parse(left.createdAt ?? ""));
+  const current = headSha ? sorted.filter((review) => review.metadata?.checkHeadSha === headSha) : [];
+  const untied = sorted.filter((review) => !review.metadata?.checkHeadSha);
+  const latest = sorted.slice(0, 1);
+  return uniqueGreptileCodeReviews([...current, ...untied, ...latest]);
+}
+function greptileApiSignalFromCodeReview(review, details) {
+  const selected = details ?? review;
+  return {
+    id: selected.id || review.id,
+    body: selected.body ?? review.body ?? null,
+    reviewedSha: selected.metadata?.checkHeadSha ?? review.metadata?.checkHeadSha ?? null,
+    status: selected.status ?? review.status ?? null
+  };
+}
+async function callGreptileMcpToolForGate(input) {
+  const controller = new AbortController;
+  const timeoutId = setTimeout(() => {
+    controller.abort(new Error(`Greptile MCP tool ${input.name} timed out after ${input.timeoutMs}ms.`));
+  }, input.timeoutMs);
+  let response;
+  try {
+    response = await input.fetchFn(input.apiBase, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${input.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: `rig-strict-gate-${input.name}-${Date.now()}`,
+        method: "tools/call",
+        params: { name: input.name, arguments: input.args }
+      }),
+      signal: controller.signal
+    });
+  } catch (error) {
+    if (controller.signal.aborted) {
+      throw controller.signal.reason instanceof Error ? controller.signal.reason : new Error(`Greptile MCP tool ${input.name} timed out after ${input.timeoutMs}ms.`);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeoutId);
+  }
+  const raw = await response.text();
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status}: ${raw}`);
+  }
+  let envelope;
+  try {
+    envelope = JSON.parse(raw);
+  } catch {
+    throw new Error(`Malformed MCP response: ${raw}`);
+  }
+  if (envelope.error?.message) {
+    throw new Error(envelope.error.message);
+  }
+  const text = (envelope.result?.content ?? []).filter((item) => item.type === "text" && typeof item.text === "string").map((item) => item.text ?? "").join(`
+`).trim();
+  if (!text) {
+    throw new Error(`MCP tool ${input.name} returned no text payload.`);
+  }
+  return text;
+}
+async function callGreptileMcpToolJsonForGate(input) {
+  const text = await callGreptileMcpToolForGate(input);
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`MCP tool ${input.name} returned malformed JSON: ${text}`);
+  }
+}
+async function collectConfiguredGreptileApiSignals(input) {
+  if (!input.enabled || input.options?.enabled === false) {
+    return { signals: [], errors: [] };
+  }
+  const env = input.options?.env ?? process.env;
+  const secrets = resolveRuntimeSecrets(env);
+  const apiKey = secrets.GREPTILE_API_KEY?.trim() ?? "";
+  if (!apiKey) {
+    return { signals: [], errors: [] };
+  }
+  const fetchFn = input.options?.fetch ?? globalThis.fetch;
+  if (typeof fetchFn !== "function") {
+    return { signals: [], errors: ["Greptile API/MCP evidence read failed: fetch is not available."] };
+  }
+  const apiBase = secrets.GREPTILE_API_BASE?.trim() || "https://api.greptile.com/mcp";
+  const remote = secrets.GREPTILE_REMOTE?.trim() || "github";
+  const repository = secrets.GREPTILE_REPOSITORY?.trim() || input.repoName;
+  const defaultBranch = secrets.GREPTILE_DEFAULT_BRANCH?.trim() || input.baseRefName?.trim() || "main";
+  const timeoutMs = greptileRequestTimeoutMs(env);
+  try {
+    const listPayload = await callGreptileMcpToolJsonForGate({
+      apiBase,
+      apiKey,
+      name: "list_code_reviews",
+      args: {
+        name: repository,
+        remote,
+        defaultBranch,
+        prNumber: input.prNumber,
+        limit: 20
+      },
+      timeoutMs,
+      fetchFn
+    });
+    const reviews = (listPayload.codeReviews ?? []).map((entry) => normalizeGreptileMcpCodeReview(entry)).filter((review) => !!review);
+    const selectedReviews = selectGreptileApiReviewsForGate(reviews, input.headSha);
+    const signals = [];
+    for (const review of selectedReviews) {
+      const detailsPayload = await callGreptileMcpToolJsonForGate({
+        apiBase,
+        apiKey,
+        name: "get_code_review",
+        args: { codeReviewId: review.id },
+        timeoutMs,
+        fetchFn
+      });
+      const details = normalizeGreptileMcpCodeReview(detailsPayload.codeReview, review.id) ?? review;
+      signals.push(greptileApiSignalFromCodeReview(review, details));
+    }
+    return { signals, errors: [] };
+  } catch (error) {
+    return {
+      signals: [],
+      errors: [`Greptile API/MCP evidence read failed: ${error instanceof Error ? error.message : String(error)}`]
+    };
+  }
+}
+function firstString(record, keys) {
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "string")
+      return value;
+  }
+  return "";
+}
+function arrayField(record, key) {
+  const value = record[key];
+  return Array.isArray(value) ? value : [];
+}
+async function runJsonArray(command, args, cwd) {
+  const result = await command(args, { cwd });
+  const label = `gh ${args.join(" ")}`;
+  if (result.exitCode !== 0) {
+    return { value: [], error: `${label} failed (${result.exitCode}): ${result.stderr ?? result.stdout ?? ""}`.trim() };
+  }
+  const parsed = parseJsonArray(result.stdout);
+  return parsed.error ? { value: parsed.value, error: `${label} returned invalid JSON: ${parsed.error}` } : { value: parsed.value };
+}
+async function runJsonObject(command, args, cwd) {
+  const result = await command(args, { cwd });
+  const label = `gh ${args.join(" ")}`;
+  if (result.exitCode !== 0) {
+    return { value: {}, error: `${label} failed (${result.exitCode}): ${result.stderr ?? result.stdout ?? ""}`.trim() };
+  }
+  const parsed = parseJsonObject(result.stdout);
+  return parsed.error ? { value: parsed.value, error: `${label} returned invalid JSON: ${parsed.error}` } : { value: parsed.value };
+}
+function normalizeStatusCheck(entry) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry))
+    return null;
+  const record = entry;
+  const name = firstString(record, ["name", "context"]);
+  if (!name.trim())
+    return null;
+  const output = record.output && typeof record.output === "object" && !Array.isArray(record.output) ? record.output : null;
+  const app = record.app && typeof record.app === "object" && !Array.isArray(record.app) ? record.app : null;
+  return {
+    __typename: typeof record.__typename === "string" ? record.__typename : null,
+    name,
+    context: typeof record.context === "string" ? record.context : null,
+    status: typeof record.status === "string" ? record.status : null,
+    state: typeof record.state === "string" ? record.state : null,
+    conclusion: typeof record.conclusion === "string" ? record.conclusion : null,
+    detailsUrl: typeof record.detailsUrl === "string" ? record.detailsUrl : typeof record.details_url === "string" ? record.details_url : typeof record.html_url === "string" ? record.html_url : typeof record.link === "string" ? record.link : null,
+    link: typeof record.link === "string" ? record.link : typeof record.html_url === "string" ? record.html_url : null,
+    headSha: typeof record.headSha === "string" ? record.headSha : null,
+    head_sha: typeof record.head_sha === "string" ? record.head_sha : null,
+    output: output ? {
+      title: typeof output.title === "string" ? output.title : null,
+      summary: typeof output.summary === "string" ? output.summary : null,
+      text: typeof output.text === "string" ? output.text : null
+    } : null,
+    app: app ? {
+      slug: typeof app.slug === "string" ? app.slug : null,
+      name: typeof app.name === "string" ? app.name : null,
+      owner: app.owner && typeof app.owner === "object" ? app.owner : null
+    } : null
+  };
+}
+function normalizeReview(entry) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry))
+    return null;
+  const record = entry;
+  return {
+    id: typeof record.id === "string" ? record.id : typeof record.id === "number" ? String(record.id) : null,
+    state: typeof record.state === "string" ? record.state : null,
+    body: typeof record.body === "string" ? record.body : null,
+    commit_id: typeof record.commit_id === "string" ? record.commit_id : typeof record.commitId === "string" ? record.commitId : record.commit && typeof record.commit === "object" && typeof record.commit.oid === "string" ? record.commit.oid : null,
+    html_url: typeof record.html_url === "string" ? record.html_url : typeof record.url === "string" ? record.url : null,
+    author: record.author && typeof record.author === "object" ? record.author : record.user && typeof record.user === "object" ? record.user : null
+  };
+}
+function normalizeReviewComment(entry) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry))
+    return null;
+  const record = entry;
+  const body = typeof record.body === "string" ? record.body : null;
+  const path = typeof record.path === "string" ? record.path : null;
+  if (!body && !path)
+    return null;
+  return {
+    id: typeof record.id === "string" || typeof record.id === "number" ? record.id : null,
+    user: record.user && typeof record.user === "object" ? record.user : null,
+    author: record.author && typeof record.author === "object" ? record.author : null,
+    body,
+    path,
+    html_url: typeof record.html_url === "string" ? record.html_url : null,
+    url: typeof record.url === "string" ? record.url : null,
+    commit_id: typeof record.commit_id === "string" ? record.commit_id : null,
+    original_commit_id: typeof record.original_commit_id === "string" ? record.original_commit_id : null
+  };
+}
+function normalizeIssueComment(entry) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry))
+    return null;
+  const record = entry;
+  const body = typeof record.body === "string" ? record.body : null;
+  if (!body)
+    return null;
+  return {
+    id: typeof record.id === "string" || typeof record.id === "number" ? record.id : null,
+    user: record.user && typeof record.user === "object" ? record.user : null,
+    author: record.author && typeof record.author === "object" ? record.author : null,
+    body,
+    html_url: typeof record.html_url === "string" ? record.html_url : null,
+    url: typeof record.url === "string" ? record.url : null,
+    created_at: typeof record.created_at === "string" ? record.created_at : null
+  };
+}
+function normalizeReviewThread(entry) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry))
+    return null;
+  const record = entry;
+  return {
+    id: typeof record.id === "string" ? record.id : null,
+    isResolved: typeof record.isResolved === "boolean" ? record.isResolved : null,
+    isOutdated: typeof record.isOutdated === "boolean" ? record.isOutdated : null,
+    comments: record.comments && typeof record.comments === "object" ? record.comments : null
+  };
+}
+function relevantIssueComment(comment) {
+  const login = comment.user?.login ?? comment.author?.login ?? "";
+  const body = comment.body ?? "";
+  return isGreptileGithubLogin(login) || containsBlockerText(body) || /greptile|score|confidence|\b\d+\s*\/\s*5\b/i.test(body);
+}
+function latestThreadComment(thread) {
+  const nodes = thread.comments?.nodes ?? [];
+  return nodes.length > 0 ? nodes[nodes.length - 1] : null;
+}
+function unresolvedThreadSummaries(threads) {
+  return threads.flatMap((thread) => {
+    if (thread.isResolved === true || thread.isOutdated === true)
+      return [];
+    const latest = latestThreadComment(thread);
+    if (!latest)
+      return ["Unresolved review thread"];
+    const path = latest.path ? ` on ${latest.path}` : "";
+    return [`Unresolved review thread${path}: ${(latest.body ?? "").trim() || "(empty comment)"}`];
+  });
+}
+function collectBodies(evidence) {
+  return [
+    evidence.title ?? "",
+    evidence.body,
+    ...evidence.reviews.map((review) => review.body ?? ""),
+    ...evidence.changedFileReviewComments.map((comment) => comment.body ?? ""),
+    ...evidence.relevantIssueComments.map((comment) => comment.body ?? ""),
+    ...evidence.reviewThreads.flatMap((thread) => thread.comments?.nodes?.map((comment) => comment.body ?? "") ?? []),
+    ...(evidence.apiSignals ?? []).map((signal) => signal.body ?? "")
+  ].filter((body) => body.trim().length > 0);
+}
+function bodyExcerpt(body) {
+  const text = stripHtml(body).replace(/\s+/g, " ").trim();
+  return text.length > 240 ? `${text.slice(0, 237)}...` : text;
+}
+function makeGreptileSignal(input) {
+  const scores = parseGreptileScores(input.body);
+  const reviewedSha = input.reviewedSha?.trim() || null;
+  const current = reviewedSha ? reviewedSha === input.currentHeadSha : null;
+  const verdict = input.verdict ?? null;
+  const blocker = input.blocker ?? (isBlockingGreptileVerdict(verdict) || containsBlockerText(input.body));
+  const explicitApproval = input.explicitApproval ?? false;
+  return {
+    source: input.source,
+    trusted: input.trusted,
+    authorLogin: input.authorLogin ?? null,
+    reviewedSha,
+    current,
+    stale: current === false,
+    score: scores[0] ?? null,
+    scores,
+    explicitApproval,
+    verdict,
+    blocker,
+    actionable: input.actionable ?? blocker,
+    bodyExcerpt: bodyExcerpt(input.body),
+    body: input.body,
+    allScores: scores
+  };
+}
+function reviewAuthorLogin(review) {
+  return review.author?.login ?? null;
+}
+function commentAuthorLogin(comment) {
+  return comment.user?.login ?? comment.author?.login ?? null;
+}
+function collectGreptileSignals(evidence) {
+  const signals = [];
+  const greptileBodyReviewedSha = extractGreptileBodyReviewedSha(evidence.body);
+  const trustedGreptileBody = Boolean(greptileBodyReviewedSha && isGreptileGithubLogin(evidence.bodyEditorLogin) && isoAtOrAfter(evidence.bodyLastEditedAt, evidence.headCommittedDate));
+  const contextSources = [
+    { source: "pr-title", body: evidence.title ?? "" },
+    {
+      source: "pr-body",
+      body: evidence.body,
+      trusted: trustedGreptileBody,
+      authorLogin: trustedGreptileBody ? evidence.bodyEditorLogin ?? null : null,
+      reviewedSha: greptileBodyReviewedSha,
+      verdict: trustedGreptileBody ? "completed" : null
+    }
+  ];
+  for (const context of contextSources) {
+    if (!context.body.trim())
+      continue;
+    const contextBlocker = containsBlockerText(context.body);
+    if (!contextBlocker && !/greptile|score|confidence|\b\d+\s*\/\s*5\b/i.test(context.body))
+      continue;
+    signals.push(makeGreptileSignal({
+      source: context.source,
+      body: context.body,
+      currentHeadSha: evidence.currentHeadSha,
+      trusted: context.trusted === true,
+      authorLogin: context.authorLogin,
+      reviewedSha: context.reviewedSha,
+      verdict: context.verdict,
+      blocker: contextBlocker,
+      actionable: contextBlocker
+    }));
+  }
+  for (const apiSignal of evidence.apiSignals ?? []) {
+    const body = [apiSignal.status ? `Status: ${apiSignal.status}` : "", apiSignal.body ?? ""].filter(Boolean).join(`
+
+`) || "Status: UNKNOWN";
+    const verdict = greptileStatusVerdict(apiSignal.status);
+    signals.push(makeGreptileSignal({
+      source: "api",
+      body,
+      currentHeadSha: evidence.currentHeadSha,
+      trusted: true,
+      reviewedSha: apiSignal.reviewedSha ?? null,
+      explicitApproval: verdict === "approved",
+      verdict
+    }));
+  }
+  for (const review of evidence.reviews) {
+    const login = reviewAuthorLogin(review);
+    if (!isGreptileGithubLogin(login))
+      continue;
+    const state = String(review.state ?? "").toUpperCase();
+    const body = [state ? `Review state: ${state}` : "", review.body ?? ""].filter(Boolean).join(`
+
+`);
+    if (!body.trim())
+      continue;
+    const dismissed = state === "DISMISSED";
+    signals.push(makeGreptileSignal({
+      source: "github-review",
+      body,
+      currentHeadSha: evidence.currentHeadSha,
+      trusted: !dismissed,
+      authorLogin: login,
+      reviewedSha: review.commit_id ?? null,
+      explicitApproval: undefined,
+      blocker: state === "CHANGES_REQUESTED" || undefined
+    }));
+  }
+  for (const comment of evidence.relevantIssueComments) {
+    const login = commentAuthorLogin(comment);
+    const body = comment.body ?? "";
+    if (!body.trim() || !isGreptileGithubLogin(login))
+      continue;
+    signals.push(makeGreptileSignal({
+      source: "issue-comment",
+      body,
+      currentHeadSha: evidence.currentHeadSha,
+      trusted: true,
+      authorLogin: login
+    }));
+  }
+  for (const thread of evidence.reviewThreads) {
+    if (thread.isOutdated === true || thread.isResolved === true)
+      continue;
+    for (const comment of thread.comments?.nodes ?? []) {
+      const login = comment.author?.login ?? null;
+      const body = comment.body ?? "";
+      if (!body.trim() || !isGreptileGithubLogin(login))
+        continue;
+      signals.push(makeGreptileSignal({
+        source: "review-thread",
+        body,
+        currentHeadSha: evidence.currentHeadSha,
+        trusted: true,
+        authorLogin: login
+      }));
+    }
+  }
+  for (const check of evidence.checks) {
+    if (!isGreptileLabel(checkName(check)))
+      continue;
+    const reviewedSha = check.headSha ?? check.head_sha ?? null;
+    const label = `${checkName(check)} (${checkState(check) || "unknown"})`;
+    const body = [label, check.output?.title ?? "", check.output?.summary ?? "", check.output?.text ?? ""].filter((entry) => entry.trim().length > 0).join(`
+
+`);
+    signals.push(makeGreptileSignal({
+      source: "github-check",
+      body,
+      currentHeadSha: evidence.currentHeadSha,
+      trusted: false,
+      reviewedSha,
+      explicitApproval: false,
+      blocker: isFailingCheck(check),
+      actionable: isFailingCheck(check)
+    }));
+  }
+  return signals;
+}
+function unresolvedGreptileThreadSummaries(threads) {
+  return threads.flatMap((thread) => {
+    if (thread.isResolved === true || thread.isOutdated === true)
+      return [];
+    const comments = thread.comments?.nodes ?? [];
+    if (!comments.some((comment) => isGreptileGithubLogin(comment.author?.login)))
+      return [];
+    const latest = latestThreadComment(thread);
+    if (!latest)
+      return ["Unresolved Greptile review thread"];
+    const path = latest.path ? ` on ${latest.path}` : "";
+    return [`Unresolved Greptile review thread${path}: ${(latest.body ?? "").trim() || "(empty comment)"}`];
+  });
+}
+function actionableChangedFileCommentSummaries(_comments) {
+  return [];
+}
+function issueLevelBlockerSummaries(comments) {
+  return comments.flatMap((comment) => {
+    const body = comment.body?.trim() ?? "";
+    if (!body || !containsBlockerText(body) && !containsConflictingScoreText(body))
+      return [];
+    const login = commentAuthorLogin(comment) ?? "unknown";
+    const author = isGreptileGithubLogin(login) ? `Greptile issue comment by ${login}` : `Issue-level PR comment by ${login}`;
+    return [`${author}: ${body}`];
+  });
+}
+function reviewBodyBlockerSummaries(reviews) {
+  return reviews.flatMap((review) => {
+    const login = reviewAuthorLogin(review) ?? "unknown";
+    if (isGreptileGithubLogin(login))
+      return [];
+    const body = review.body?.trim() ?? "";
+    if (!body || !containsBlockerText(body) && !containsConflictingScoreText(body))
+      return [];
+    const state = review.state ? ` (${review.state})` : "";
+    return [`PR review summary by ${login}${state}: ${body}`];
+  });
+}
+function signalLabel(signal) {
+  const source = signal.source.replace(/-/g, " ");
+  const author = signal.authorLogin ? ` by ${signal.authorLogin}` : "";
+  const sha = signal.reviewedSha ? ` at ${signal.reviewedSha}` : "";
+  return `${source}${author}${sha}`;
+}
+function deriveGreptileEvidence(input) {
+  const rawBodies = collectBodies(input);
+  const signals = collectGreptileSignals(input);
+  const trustedSignals = signals.filter((signal) => signal.trusted);
+  const trustedScoreEntries = trustedSignals.flatMap((signal) => signal.allScores.map((score2) => ({ score: score2, signal })));
+  const contextScoreEntries = signals.filter((signal) => !signal.trusted).flatMap((signal) => signal.allScores.map((score2) => ({ score: score2, signal })));
+  const allScoreEntries = [...trustedScoreEntries, ...contextScoreEntries];
+  const staleSignals = signals.filter((signal) => !!signal.reviewedSha && signal.reviewedSha !== input.currentHeadSha && (signal.trusted || signal.source === "github-check"));
+  const isCurrentOrUntied = (signal) => !signal.reviewedSha || signal.reviewedSha === input.currentHeadSha;
+  const currentOrUntiedScoreEntries = allScoreEntries.filter((entry) => isCurrentOrUntied(entry.signal));
+  const lowScoreEntries = currentOrUntiedScoreEntries.filter((entry) => !isStrictFiveOfFive(entry.score));
+  const currentPendingApiSignals = trustedSignals.filter((signal) => signal.source === "api" && signal.verdict === "pending" && isCurrentOrUntied(signal));
+  const signalCanApproveByScore = (signal) => {
+    if (signal.source === "api")
+      return signal.verdict === "approved" || signal.verdict === "completed";
+    return signal.verdict !== "pending" && !isBlockingGreptileVerdict(signal.verdict);
+  };
+  const approvingScoreEntry = trustedScoreEntries.find((entry) => entry.signal.reviewedSha === input.currentHeadSha && entry.signal.source !== "github-check" && signalCanApproveByScore(entry.signal) && isStrictFiveOfFive(entry.score)) ?? null;
+  const approvingExplicitSignal = trustedSignals.find((signal) => signal.source === "api" && signal.reviewedSha === input.currentHeadSha && signal.explicitApproval === true && !signal.blocker) ?? null;
+  const approvedByScore = !!approvingScoreEntry;
+  const approvedByExplicitMapping = !!approvingExplicitSignal;
+  const approvingSignal = approvingScoreEntry?.signal ?? approvingExplicitSignal;
+  const lowestScore = lowScoreEntries.map((entry) => entry.score).sort((left, right) => left.value - right.value)[0] ?? null;
+  const score = lowestScore ?? approvingScoreEntry?.score ?? trustedScoreEntries[0]?.score ?? contextScoreEntries[0]?.score ?? null;
+  const failedGreptileChecks = input.checks.filter((check) => isGreptileLabel(checkName(check)) && isFailingCheck(check)).map((check) => `${checkName(check)} (${checkState(check) || "failed"})`);
+  const blockerSignals = signals.filter((signal) => (signal.blocker || signal.actionable) && (!signal.reviewedSha || signal.reviewedSha === input.currentHeadSha));
+  const staleBlockingSignals = [];
+  const blockers = [
+    ...blockerSignals.map((signal) => `${signalLabel(signal)}: ${signal.bodyExcerpt || "blocker text"}`),
+    ...reviewBodyBlockerSummaries(input.reviews),
+    ...issueLevelBlockerSummaries(input.relevantIssueComments),
+    ...lowScoreEntries.map((entry) => `Greptile score from ${signalLabel(entry.signal)} is ${entry.score.value}/${entry.score.scale}; strict merge requires trusted current-head 5/5.`),
+    ...staleBlockingSignals.map((signal) => `Greptile blocking signal from ${signalLabel(signal)} is stale; current PR head is ${input.currentHeadSha || "unknown"}.`),
+    ...failedGreptileChecks.map((entry) => `Greptile check failed: ${entry}`)
+  ];
+  const unresolvedComments = [
+    ...unresolvedGreptileThreadSummaries(input.reviewThreads),
+    ...actionableChangedFileCommentSummaries(input.changedFileReviewComments)
+  ];
+  const greptileChecks = input.checks.filter((check) => isGreptileLabel(checkName(check)));
+  const greptileReviews = input.reviews.filter((review) => isGreptileGithubLogin(review.author?.login));
+  const completedGreptileCheck = greptileChecks.some((check) => {
+    const reviewedSha2 = check.headSha ?? check.head_sha ?? null;
+    return reviewedSha2 === input.currentHeadSha && (isPassingCheck(check) || isFailingCheck(check));
+  });
+  const completedGreptileReview = greptileReviews.some((review) => {
+    const state = String(review.state ?? "").toUpperCase();
+    const completedState = ["APPROVED", "COMMENTED", "CHANGES_REQUESTED"].includes(state) || !!review.body?.trim();
+    return completedState && review.commit_id === input.currentHeadSha;
+  });
+  const completedGreptileApi = trustedSignals.some((signal) => signal.source === "api" && signal.reviewedSha === input.currentHeadSha && (signal.verdict === "approved" || signal.verdict === "rejected" || signal.verdict === "skipped" || signal.verdict === "failed" || signal.verdict === "completed"));
+  const approvalReviewedSha = approvingSignal?.reviewedSha ?? null;
+  const reviewedSha = approvalReviewedSha ?? staleSignals[0]?.reviewedSha ?? trustedSignals.map((signal) => signal.reviewedSha ?? null).find(Boolean) ?? null;
+  const fresh = !!approvalReviewedSha && approvalReviewedSha === input.currentHeadSha;
+  const completed = completedGreptileCheck || completedGreptileReview || completedGreptileApi || !!approvingSignal;
+  const hasGreptileEvidence = trustedSignals.length > 0 || signals.some((signal) => /greptile/i.test(signal.body));
+  const approved = fresh && completed && !blockers.length && !unresolvedComments.length && currentPendingApiSignals.length === 0 && (approvedByScore || approvedByExplicitMapping);
+  const mapping = !hasGreptileEvidence ? "missing" : staleSignals.length > 0 && !approvingSignal ? "stale" : approvedByScore ? "score-5-of-5" : approvedByExplicitMapping ? "explicit-approved" : "unproven";
+  const source = approvingSignal?.source === "api" ? "api" : approvingSignal?.source === "github-review" ? "github-review" : approvingSignal?.source === "pr-body" || approvingSignal?.source === "pr-title" ? "pr-body" : approvingSignal?.source === "changed-file-comment" || approvingSignal?.source === "issue-comment" || approvingSignal?.source === "review-thread" ? "github-comment" : greptileReviews.length > 0 && greptileChecks.length > 0 ? "combined" : greptileReviews.length > 0 ? "github-review" : greptileChecks.length > 0 ? "github-check" : signals.some((signal) => signal.source === "pr-body" || signal.source === "pr-title") ? "pr-body" : "missing";
+  return {
+    source,
+    currentHeadSha: input.currentHeadSha,
+    reviewedSha,
+    fresh,
+    completed,
+    approved,
+    score,
+    explicitApproval: approvedByExplicitMapping,
+    blockers,
+    unresolvedComments,
+    rawBodies,
+    signals: signals.map(({ body: _body, allScores: _allScores, ...signal }) => signal),
+    mapping
+  };
+}
+function isGreptileCheckDetail(check) {
+  return isGreptileLabel(checkName(check)) || isGreptileGithubLogin(check.app?.slug) || isGreptileGithubLogin(check.app?.owner?.login) || isGreptileLabel(check.app?.name);
+}
+async function collectGreptileCheckDetails(input) {
+  const checkRunsRead = await runJsonObject(input.command, [
+    "api",
+    `repos/${input.repoName}/commits/${input.headSha}/check-runs`,
+    "-F",
+    "per_page=100"
+  ], input.projectRoot);
+  const checkRuns = arrayField(checkRunsRead.value, "check_runs").map(normalizeStatusCheck).filter((entry) => !!entry).filter(isGreptileCheckDetail);
+  return checkRunsRead.error ? { value: checkRuns, error: checkRunsRead.error } : { value: checkRuns };
+}
+async function collectPullRequestProvenance(input) {
+  const response = await runJsonObject(input.command, [
+    "api",
+    "graphql",
+    "-F",
+    `owner=${input.owner}`,
+    "-F",
+    `name=${input.name}`,
+    "-F",
+    `prNumber=${input.prNumber}`,
+    "-f",
+    "query=query($owner: String!, $name: String!, $prNumber: Int!) { repository(owner:$owner, name:$name) { pullRequest(number:$prNumber) { lastEditedAt editor { login } commits(last: 1) { nodes { commit { oid committedDate } } } } } }"
+  ], input.projectRoot);
+  if (response.error)
+    return { value: {}, error: response.error };
+  const data = response.value.data;
+  const repository = data?.repository;
+  const pullRequest = repository?.pullRequest;
+  if (!pullRequest)
+    return { value: {}, error: "GitHub pullRequest provenance response did not include a pullRequest object" };
+  const editor = pullRequest.editor;
+  const commits = pullRequest.commits;
+  const nodes = Array.isArray(commits?.nodes) ? commits.nodes : [];
+  const latestCommitNode = nodes[nodes.length - 1];
+  const latestCommit = latestCommitNode?.commit;
+  return {
+    value: {
+      bodyEditorLogin: typeof editor?.login === "string" ? editor.login : null,
+      bodyLastEditedAt: typeof pullRequest.lastEditedAt === "string" ? pullRequest.lastEditedAt : null,
+      headCommittedDate: typeof latestCommit?.committedDate === "string" ? latestCommit.committedDate : null
+    }
+  };
+}
+async function collectReviewThreads(input) {
+  const reviewThreads = [];
+  let afterCursor = null;
+  for (let page = 0;page < 100; page += 1) {
+    const afterLiteral = afterCursor ? JSON.stringify(afterCursor) : "null";
+    const threadsResponse = await runJsonObject(input.command, [
+      "api",
+      "graphql",
+      "-F",
+      `owner=${input.owner}`,
+      "-F",
+      `name=${input.name}`,
+      "-F",
+      `prNumber=${input.prNumber}`,
+      "-f",
+      `query=query($owner: String!, $name: String!, $prNumber: Int!) { repository(owner:$owner, name:$name) { pullRequest(number:$prNumber) { reviewThreads(first: 100, after: ${afterLiteral}) { nodes { id isResolved isOutdated comments(first: 100) { nodes { author { login } body path url createdAt } pageInfo { hasNextPage endCursor } } } pageInfo { hasNextPage endCursor } } } } }`
+    ], input.projectRoot);
+    if (threadsResponse.error) {
+      return { value: reviewThreads, error: threadsResponse.error };
+    }
+    const data = threadsResponse.value.data;
+    const repository = data?.repository;
+    const pullRequest = repository?.pullRequest;
+    const threads = pullRequest?.reviewThreads;
+    const nodes = threads?.nodes;
+    if (!Array.isArray(nodes)) {
+      return { value: reviewThreads, error: "GitHub reviewThreads response did not include a nodes array" };
+    }
+    const normalized = nodes.map(normalizeReviewThread).filter((entry) => !!entry);
+    reviewThreads.push(...normalized);
+    const truncatedCommentThread = normalized.find((thread) => thread.comments?.pageInfo?.hasNextPage === true);
+    if (truncatedCommentThread) {
+      return { value: reviewThreads, error: `GitHub review thread ${truncatedCommentThread.id ?? "unknown"} has more than 100 comments; nested pagination is incomplete` };
+    }
+    const pageInfo = threads?.pageInfo;
+    if (!pageInfo) {
+      if (nodes.length >= 100) {
+        return { value: reviewThreads, error: "GitHub reviewThreads pagination metadata missing after a full page" };
+      }
+      return { value: reviewThreads };
+    }
+    if (pageInfo.hasNextPage !== true) {
+      return { value: reviewThreads };
+    }
+    if (typeof pageInfo.endCursor !== "string" || !pageInfo.endCursor.trim()) {
+      return { value: reviewThreads, error: "GitHub reviewThreads pagination reported hasNextPage without endCursor" };
+    }
+    afterCursor = pageInfo.endCursor;
+  }
+  return { value: reviewThreads, error: "GitHub reviewThreads pagination exceeded 100 pages" };
+}
+async function collectPrReviewEvidence(input) {
+  const parsed = parseGithubPrUrl(input.prUrl);
+  if (!parsed) {
+    throw new Error(`Cannot parse GitHub PR URL: ${input.prUrl}`);
+  }
+  const readErrors = [];
+  const viewRead = await runJsonObject(input.command, [
+    "pr",
+    "view",
+    input.prUrl,
+    "--json",
+    "title,body,headRefOid,headRefName,baseRefName,state,isDraft,mergeable,mergeStateStatus,reviewDecision,reviews,statusCheckRollup"
+  ], input.projectRoot);
+  if (viewRead.error)
+    readErrors.push(viewRead.error);
+  const view = viewRead.value;
+  if (!Array.isArray(view.statusCheckRollup)) {
+    readErrors.push("gh pr view did not return required statusCheckRollup array");
+  }
+  if (!Array.isArray(view.reviews)) {
+    readErrors.push("gh pr view did not return required reviews array");
+  }
+  const headSha = firstString(view, ["headRefOid", "headSha", "head_sha"]);
+  const baseRefName = firstString(view, ["baseRefName"]);
+  const statusCheckRollup = arrayField(view, "statusCheckRollup").map(normalizeStatusCheck).filter((entry) => !!entry);
+  const reviews = arrayField(view, "reviews").map(normalizeReview).filter((entry) => !!entry);
+  const provenanceRead = await collectPullRequestProvenance({
+    command: input.command,
+    projectRoot: input.projectRoot,
+    owner: parsed.owner,
+    name: parsed.repo,
+    prNumber: parsed.prNumber
+  });
+  const provenance = provenanceRead.value;
+  const reviewCommentsRead = await runJsonArray(input.command, ["api", `repos/${parsed.repoName}/pulls/${parsed.prNumber}/comments`, "--paginate"], input.projectRoot);
+  if (reviewCommentsRead.error)
+    readErrors.push(reviewCommentsRead.error);
+  const reviewComments = reviewCommentsRead.value.map(normalizeReviewComment).filter((entry) => !!entry);
+  const issueCommentsRead = await runJsonArray(input.command, ["api", `repos/${parsed.repoName}/issues/${parsed.prNumber}/comments`, "--paginate"], input.projectRoot);
+  if (issueCommentsRead.error)
+    readErrors.push(issueCommentsRead.error);
+  const issueComments = issueCommentsRead.value.map(normalizeIssueComment).filter((entry) => !!entry).filter(relevantIssueComment);
+  const reviewThreadsRead = await collectReviewThreads({
+    command: input.command,
+    projectRoot: input.projectRoot,
+    owner: parsed.owner,
+    name: parsed.repo,
+    prNumber: parsed.prNumber
+  });
+  if (reviewThreadsRead.error)
+    readErrors.push(reviewThreadsRead.error);
+  const reviewThreads = reviewThreadsRead.value;
+  const greptileRollupChecks = statusCheckRollup.filter((check) => isGreptileLabel(checkName(check)));
+  let greptileCheckDetails = [];
+  if (headSha && greptileRollupChecks.length > 0) {
+    const checkDetailsRead = await collectGreptileCheckDetails({
+      command: input.command,
+      projectRoot: input.projectRoot,
+      repoName: parsed.repoName,
+      headSha
+    });
+    greptileCheckDetails = checkDetailsRead.value;
+  }
+  const checksWithGreptileDetails = [...statusCheckRollup, ...greptileCheckDetails];
+  const shouldCollectConfiguredGreptileApi = input.greptileApi?.enabled !== false;
+  const configuredGreptileApiRead = await collectConfiguredGreptileApiSignals({
+    enabled: shouldCollectConfiguredGreptileApi,
+    options: input.greptileApi,
+    repoName: parsed.repoName,
+    prNumber: parsed.prNumber,
+    headSha,
+    baseRefName
+  });
+  readErrors.push(...configuredGreptileApiRead.errors);
+  const apiSignals = [...input.apiSignals ?? [], ...configuredGreptileApiRead.signals];
+  const checkFailures = statusCheckRollup.filter((check) => !isGreptileLabel(checkName(check)) && isFailingCheck(check) && !isAllowedFailure(checkName(check), input.allowedFailures ?? [])).map((check) => `Check failed: ${checkName(check)}${check.detailsUrl || check.link ? ` (${check.detailsUrl ?? check.link})` : ""}`);
+  const pendingChecks = statusCheckRollup.filter((check) => isPendingCheck(check) && (isGreptileLabel(checkName(check)) || !isAllowedFailure(checkName(check), input.allowedFailures ?? []))).map((check) => `Check pending: ${checkName(check)}`);
+  const evidenceBase = {
+    title: firstString(view, ["title"]),
+    body: firstString(view, ["body"]),
+    bodyEditorLogin: provenance.bodyEditorLogin ?? null,
+    bodyLastEditedAt: provenance.bodyLastEditedAt ?? null,
+    headCommittedDate: provenance.headCommittedDate ?? null,
+    reviews,
+    changedFileReviewComments: reviewComments,
+    relevantIssueComments: issueComments,
+    reviewThreads,
+    checks: checksWithGreptileDetails,
+    currentHeadSha: headSha,
+    apiSignals
+  };
+  const greptile = deriveGreptileEvidence(evidenceBase);
+  return {
+    prUrl: input.prUrl,
+    prNumber: parsed.prNumber,
+    repoName: parsed.repoName,
+    title: evidenceBase.title,
+    body: evidenceBase.body,
+    bodyEditorLogin: evidenceBase.bodyEditorLogin,
+    bodyLastEditedAt: evidenceBase.bodyLastEditedAt,
+    headCommittedDate: evidenceBase.headCommittedDate,
+    headSha,
+    headRefName: firstString(view, ["headRefName"]),
+    baseRefName,
+    state: firstString(view, ["state"]),
+    isDraft: typeof view.isDraft === "boolean" ? view.isDraft : null,
+    mergeable: firstString(view, ["mergeable"]),
+    mergeStateStatus: firstString(view, ["mergeStateStatus"]),
+    reviewDecision: firstString(view, ["reviewDecision"]),
+    reviews,
+    reviewThreads,
+    changedFileReviewComments: reviewComments,
+    relevantIssueComments: issueComments,
+    statusCheckRollup: checksWithGreptileDetails,
+    checkFailures,
+    pendingChecks,
+    readErrors,
+    greptile
+  };
+}
+function capGateMessage(value, maxChars = 1200) {
+  const normalized = value.trim();
+  return normalized.length > maxChars ? `${normalized.slice(0, maxChars)}
+[truncated for gate summary; see full evidence artifact]` : normalized;
+}
+function evaluateEvidence(evidence) {
+  const reasonDetails = [];
+  const warnings = [];
+  const seen = new Set;
+  const addReason = (reason) => {
+    const capped = { ...reason, message: capGateMessage(reason.message) };
+    const key = `${capped.code}:${capped.message}`;
+    if (seen.has(key))
+      return;
+    seen.add(key);
+    reasonDetails.push(capped);
+  };
+  const greptile = evidence.greptile;
+  const staleSignal = greptile.signals.find((signal) => signal.reviewedSha && signal.reviewedSha !== evidence.headSha);
+  const hasPendingGreptileCheck = evidence.pendingChecks.some((check) => /greptile/i.test(check));
+  const pendingGreptileApiSignals = greptile.signals.filter((signal) => signal.source === "api" && signal.verdict === "pending" && (!signal.reviewedSha || signal.reviewedSha === evidence.headSha));
+  const unknownGreptileApiSignals = greptile.signals.filter((signal) => signal.source === "api" && !signal.verdict && (!signal.reviewedSha || signal.reviewedSha === evidence.headSha));
+  const awaitingFreshGreptileProof = hasPendingGreptileCheck || pendingGreptileApiSignals.length > 0 || !greptile.completed || greptile.mapping === "missing" || greptile.mapping === "stale";
+  for (const error of evidence.readErrors) {
+    addReason({
+      code: "read_error",
+      reasonClass: "reject",
+      surface: error.startsWith("Greptile API/MCP") ? "greptile" : "github",
+      suggestedAction: "needs_attention",
+      message: `Required PR evidence surface could not be read completely: ${error}`,
+      headSha: evidence.headSha || null
+    });
+  }
+  if (!evidence.headSha) {
+    addReason({
+      code: "missing_head_sha",
+      reasonClass: "reject",
+      surface: "github",
+      suggestedAction: "needs_attention",
+      message: "PR head SHA could not be read; current-head Greptile approval cannot be proven.",
+      headSha: null
+    });
+  }
+  for (const failure of evidence.checkFailures) {
+    addReason({
+      code: "ci_failed",
+      reasonClass: "reject",
+      surface: "ci",
+      suggestedAction: "fix",
+      message: failure,
+      headSha: evidence.headSha || null
+    });
+  }
+  for (const pendingCheck of evidence.pendingChecks) {
+    addReason({
+      code: "check_pending",
+      reasonClass: "pending",
+      surface: "ci",
+      suggestedAction: "wait",
+      message: pendingCheck,
+      headSha: evidence.headSha || null
+    });
+  }
+  const reviewDecision = String(evidence.reviewDecision ?? "").toUpperCase();
+  if (reviewDecision === "CHANGES_REQUESTED" || reviewDecision === "REVIEW_REQUIRED") {
+    addReason({
+      code: "review_decision_blocking",
+      reasonClass: "reject",
+      surface: "review",
+      suggestedAction: "fix",
+      message: `Required review is unresolved (${evidence.reviewDecision}).`,
+      headSha: evidence.headSha || null
+    });
+  }
+  for (const thread of unresolvedThreadSummaries(evidence.reviewThreads)) {
+    addReason({
+      code: "review_thread_unresolved",
+      reasonClass: "reject",
+      surface: "review",
+      suggestedAction: "fix",
+      message: thread,
+      headSha: evidence.headSha || null
+    });
+  }
+  if (greptile.mapping === "missing") {
+    addReason({
+      code: "greptile_missing",
+      reasonClass: "pending",
+      surface: "greptile",
+      suggestedAction: "wait",
+      message: "Missing Greptile check/review evidence for this PR.",
+      headSha: evidence.headSha || null
+    });
+  }
+  if (greptile.mapping === "stale" || greptile.reviewedSha && greptile.reviewedSha !== evidence.headSha || !greptile.approved && staleSignal) {
+    addReason({
+      code: "greptile_stale",
+      reasonClass: "pending",
+      surface: "greptile",
+      suggestedAction: "wait",
+      message: `Greptile evidence is stale (reviewed ${greptile.reviewedSha ?? staleSignal?.reviewedSha ?? "unknown"}, current ${evidence.headSha || "unknown"}).`,
+      headSha: evidence.headSha || null,
+      reviewedSha: greptile.reviewedSha ?? staleSignal?.reviewedSha ?? null
+    });
+  }
+  for (const signal of pendingGreptileApiSignals) {
+    addReason({
+      code: "greptile_pending",
+      reasonClass: "pending",
+      surface: "greptile",
+      suggestedAction: "wait",
+      message: `Greptile API/MCP review is pending for the current PR head${signal.bodyExcerpt ? `: ${signal.bodyExcerpt}` : "."}`,
+      headSha: evidence.headSha || null,
+      reviewedSha: signal.reviewedSha ?? null
+    });
+  }
+  for (const signal of unknownGreptileApiSignals) {
+    addReason({
+      code: "greptile_api_status_unknown",
+      reasonClass: "reject",
+      surface: "greptile",
+      suggestedAction: "needs_attention",
+      message: `Greptile API/MCP review status is unknown; merge requires a known terminal APPROVED/COMPLETED 5/5 result or a known conservative status${signal.bodyExcerpt ? `: ${signal.bodyExcerpt}` : "."}`,
+      headSha: evidence.headSha || null,
+      reviewedSha: signal.reviewedSha ?? null
+    });
+  }
+  if (!greptile.completed) {
+    addReason({
+      code: "greptile_pending",
+      reasonClass: "pending",
+      surface: "greptile",
+      suggestedAction: "wait",
+      message: "Greptile check/review has not completed for the current PR head.",
+      headSha: evidence.headSha || null,
+      reviewedSha: greptile.reviewedSha ?? null
+    });
+  }
+  if (!greptile.fresh) {
+    addReason({
+      code: "greptile_not_current_head",
+      reasonClass: awaitingFreshGreptileProof ? "pending" : "reject",
+      surface: "greptile",
+      suggestedAction: awaitingFreshGreptileProof ? "wait" : "ask_greptile",
+      message: "Greptile approval is not tied to the current PR head SHA.",
+      headSha: evidence.headSha || null,
+      reviewedSha: greptile.reviewedSha ?? null
+    });
+  }
+  if (greptile.score && !(greptile.score.scale === 5 && greptile.score.value === 5)) {
+    addReason({
+      code: "greptile_score_not_5",
+      reasonClass: "reject",
+      surface: "greptile",
+      suggestedAction: "fix",
+      message: `Greptile score is ${greptile.score.value}/${greptile.score.scale}; strict merge requires trusted current-head 5/5.`,
+      headSha: evidence.headSha || null,
+      reviewedSha: greptile.reviewedSha ?? null
+    });
+  }
+  const hasApprovedMapping = greptile.mapping === "score-5-of-5" || greptile.mapping === "explicit-approved";
+  if (!greptile.score && !hasApprovedMapping) {
+    addReason({
+      code: "greptile_score_missing",
+      reasonClass: awaitingFreshGreptileProof ? "pending" : "reject",
+      surface: "greptile",
+      suggestedAction: awaitingFreshGreptileProof ? "wait" : "ask_greptile",
+      message: "No parseable Greptile 5/5 score or direct current-head Greptile API APPROVED mapping was found from trusted evidence; merge is blocked.",
+      headSha: evidence.headSha || null,
+      reviewedSha: greptile.reviewedSha ?? null
+    });
+  }
+  if (greptile.mapping === "unproven") {
+    addReason({
+      code: "greptile_mapping_unproven",
+      reasonClass: awaitingFreshGreptileProof ? "pending" : "reject",
+      surface: "greptile",
+      suggestedAction: awaitingFreshGreptileProof ? "wait" : "ask_greptile",
+      message: "Greptile approval mapping is unproven; PR body/title or a green check alone cannot approve merge.",
+      headSha: evidence.headSha || null,
+      reviewedSha: greptile.reviewedSha ?? null
+    });
+  }
+  for (const blocker of greptile.blockers) {
+    addReason({
+      code: "greptile_blocker_text",
+      reasonClass: "reject",
+      surface: "greptile",
+      suggestedAction: "fix",
+      message: `Greptile/blocker text: ${blocker}`,
+      headSha: evidence.headSha || null,
+      reviewedSha: greptile.reviewedSha ?? null
+    });
+  }
+  for (const comment of greptile.unresolvedComments) {
+    addReason({
+      code: "greptile_unresolved_comment",
+      reasonClass: "reject",
+      surface: "greptile",
+      suggestedAction: "fix",
+      message: comment,
+      headSha: evidence.headSha || null,
+      reviewedSha: greptile.reviewedSha ?? null
+    });
+  }
+  if (!greptile.approved)
+    warnings.push(`Greptile approval mapping is ${greptile.mapping}.`);
+  const pending = reasonDetails.length > 0 && reasonDetails.every((reason) => reason.reasonClass === "pending");
+  return { reasons: reasonDetails.map((reason) => reason.message), reasonDetails, warnings, pending };
+}
+function evaluateStrictPrMergeGate(evidence) {
+  const evaluated = evaluateEvidence(evidence);
+  const approved = evaluated.reasonDetails.length === 0 && evidence.greptile.approved;
+  return {
+    approved,
+    pending: evaluated.pending,
+    reasons: evaluated.reasons,
+    reasonDetails: evaluated.reasonDetails,
+    warnings: evaluated.warnings,
+    actionableFeedback: evaluated.reasons,
+    evidence
   };
-  mkdirSync7(artifactDir, { recursive: true });
-  writeFileSync7(resolve21(artifactDir, "validation-summary.json"), `${JSON.stringify(summary, null, 2)}
-`, "utf-8");
-  return summary;
 }
 
 // packages/runtime/src/control-plane/native/verifier.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
-import { resolve as resolve22 } from "path";
 async function verifyTask(options) {
   const paths = resolveHarnessPaths(options.projectRoot);
   const taskId = options.taskId;
   const normalizedTaskId = lookupTask(options.projectRoot, taskId);
   const artifactDir = artifactDirForId(options.projectRoot, taskId);
-  mkdirSync8(artifactDir, { recursive: true });
-  const validationSummaryPath = resolve22(artifactDir, "validation-summary.json");
-  const reviewFeedbackPath = resolve22(artifactDir, "review-feedback.md");
-  const reviewStatePath = resolve22(artifactDir, "review-state.json");
-  const greptileRawPath = resolve22(artifactDir, "review-greptile-raw.json");
+  mkdirSync9(artifactDir, { recursive: true });
+  const validationSummaryPath = resolve23(artifactDir, "validation-summary.json");
+  const reviewFeedbackPath = resolve23(artifactDir, "review-feedback.md");
+  const reviewStatePath = resolve23(artifactDir, "review-state.json");
+  const greptileRawPath = resolve23(artifactDir, "review-greptile-raw.json");
   const prStates = readPrMetadata(options.projectRoot, taskId);
   const prState = prStates[0] || null;
   const localReasons = [];
@@ -3626,7 +4925,7 @@ async function verifyTask(options) {
   if (!normalizedTaskId && !await hasConfiguredSourceTask(options.projectRoot, taskId)) {
     localReasons.push(`[Task Config] Unknown task id '${taskId}' in task-config or configured task source.`);
   }
-  if (!existsSync19(validationSummaryPath)) {
+  if (!existsSync20(validationSummaryPath)) {
     localReasons.push(`[Artifact Quality] validation-summary.json not found at ${validationSummaryPath}.`);
   } else {
     const summary = await parseValidationSummary(validationSummaryPath);
@@ -3635,13 +4934,13 @@ async function verifyTask(options) {
     }
   }
   for (const file of ["task-result.json", "decision-log.md", "next-actions.md", "changed-files.txt"]) {
-    const requiredPath = resolve22(artifactDir, file);
-    if (!existsSync19(requiredPath)) {
+    const requiredPath = resolve23(artifactDir, file);
+    if (!existsSync20(requiredPath)) {
       localReasons.push(`[Artifact Quality] Missing required artifact file: ${requiredPath}`);
     }
   }
-  const taskResultPath = resolve22(artifactDir, "task-result.json");
-  if (existsSync19(taskResultPath)) {
+  const taskResultPath = resolve23(artifactDir, "task-result.json");
+  if (existsSync20(taskResultPath)) {
     const taskResult = await readJsonFile2(taskResultPath);
     const artifactStatus = typeof taskResult?.status === "string" ? taskResult.status.trim().toLowerCase() : "";
     if (artifactStatus === "partial") {
@@ -3654,8 +4953,8 @@ async function verifyTask(options) {
       localReasons.push("[Artifact Quality] task-result.json next actions indicate remaining implementation scope.");
     }
   }
-  const nextActionsPath = resolve22(artifactDir, "next-actions.md");
-  if (existsSync19(nextActionsPath)) {
+  const nextActionsPath = resolve23(artifactDir, "next-actions.md");
+  if (existsSync20(nextActionsPath)) {
     const nextActionsContent = await Bun.file(nextActionsPath).text();
     if (nextActionsContent.includes("TODO: Replace this scaffold") || nextActionsContent.includes("bd-<downstream-task-id>")) {
       localReasons.push("[Artifact Quality] next-actions.md still contains scaffold placeholder text. Replace with real recommendations.");
@@ -3668,12 +4967,6 @@ async function verifyTask(options) {
   if (sourceCloseoutIssueId) {
     localReasons.push(...evaluateGithubSourceIssuePrCloseout(options.projectRoot, prStates, sourceCloseoutIssueId));
   }
-  const pluginResults = await options.plugins.runValidators(taskId);
-  for (const result of pluginResults) {
-    if (!result.passed) {
-      localReasons.push(`[Plugin Validator] ${result.id}: ${result.summary}`);
-    }
-  }
   const reviewMode = await loadReviewMode(paths.reviewProfilePath, process.env.AI_REVIEW_MODE || "advisory");
   const reviewProvider = await loadReviewProvider(paths.reviewProfilePath, process.env.AI_REVIEW_PROVIDER || "greptile");
   if (!options.skipAiReview && localReasons.length === 0 && reviewProvider === "greptile" && reviewMode !== "off") {
@@ -3692,7 +4985,7 @@ async function verifyTask(options) {
       aiReasons.push(`[AI Review] Required mode needs a completed Greptile approval; current verdict is ${ai.verdict}.`);
     }
     if (persistArtifacts && ai.rawResponse) {
-      writeFileSync8(greptileRawPath, `${ai.rawResponse}
+      writeFileSync9(greptileRawPath, `${ai.rawResponse}
 `, "utf-8");
     }
   } else if (!options.skipAiReview && reviewMode === "off") {
@@ -4031,7 +5324,7 @@ function isAcceptedValidationSummary(summary) {
   return summary.status === "skipped" && summary.total === 0 && summary.failed === 0;
 }
 async function loadReviewMode(reviewProfilePath, fallback) {
-  const parsed = existsSync19(reviewProfilePath) ? await readJsonFile2(reviewProfilePath) : null;
+  const parsed = existsSync20(reviewProfilePath) ? await readJsonFile2(reviewProfilePath) : null;
   const mode = parsed?.mode;
   if (mode === "off" || mode === "advisory" || mode === "required") {
     return mode;
@@ -4042,7 +5335,7 @@ async function loadReviewMode(reviewProfilePath, fallback) {
   return "advisory";
 }
 async function loadReviewProvider(reviewProfilePath, fallback) {
-  const parsed = existsSync19(reviewProfilePath) ? await readJsonFile2(reviewProfilePath) : null;
+  const parsed = existsSync20(reviewProfilePath) ? await readJsonFile2(reviewProfilePath) : null;
   const provider = parsed?.provider;
   if (typeof provider === "string" && provider.trim().length > 0) {
     return provider;
@@ -4201,7 +5494,7 @@ function writeFeedbackFile(options) {
   if (options.aiRawFeedback) {
     lines.push("## Raw Reviewer Feedback", "", "```text", options.aiRawFeedback, "```", "");
   }
-  writeFileSync8(options.output, `${lines.join(`
+  writeFileSync9(options.output, `${lines.join(`
 `)}
 `, "utf-8");
 }
@@ -4218,7 +5511,7 @@ function writeReviewStateFile(options) {
     ai_warnings: options.aiWarnings,
     updated_at: nowIso()
   };
-  writeFileSync8(options.output, `${JSON.stringify(payload, null, 2)}
+  writeFileSync9(options.output, `${JSON.stringify(payload, null, 2)}
 `, "utf-8");
 }
 async function runGreptileReviewForPr(options) {
@@ -4400,7 +5693,8 @@ async function runGreptileReviewForPr(options) {
       }
     };
   }
-  if (/not safe to merge|unsafe to merge|do not merge|blocker/i.test(reviewBody)) {
+  const blockerScanBody = stripHtml(reviewBody).replace(/\b(?:no|without|zero)\s+blockers?\b/gi, " ").replace(/\bno\s+changes\s+requested\b/gi, " ");
+  if (/not safe(?: to merge)?|unsafe(?: to merge)?|do not merge|cannot merge|blockers?|must fix|changes requested|please fix|needs? fix|fix this|address this|\breject(?:ed|ion)?\b|\bskip(?:ped)?\b|status\s*:\s*(?:reject(?:ed)?|skip(?:ped)?|failed)/i.test(blockerScanBody)) {
     reasons.push(`[AI Review] ${repoName}#${prNumber} summary indicates the PR is not safe to merge.`);
     return {
       verdict: "REJECT",
@@ -4416,44 +5710,79 @@ async function runGreptileReviewForPr(options) {
       }
     };
   }
-  if (score) {
-    if (score.scale === 5 && score.value < 5 && options.reviewMode === "required") {
-      reasons.push(`[AI Review] ${repoName}#${prNumber} completed with Greptile confidence ${score.value}/${score.scale}; required mode needs 5/5 before merge.`);
-      return {
-        verdict: "REJECT",
-        feedback,
-        reasons,
-        warnings,
-        rawPayload: {
-          pr: options.prState,
-          codeReviews: reviewsPayload,
-          selectedReview,
-          reviewDetails,
-          comments: commentsPayload,
-          score
-        }
-      };
-    }
-    if (score.scale === 5 && score.value <= 2) {
-      reasons.push(`[AI Review] ${repoName}#${prNumber} completed with Greptile confidence ${score.value}/${score.scale}; this requires rework before merge.`);
-      return {
-        verdict: "REJECT",
-        feedback,
-        reasons,
-        warnings,
-        rawPayload: {
-          pr: options.prState,
-          codeReviews: reviewsPayload,
-          selectedReview,
-          reviewDetails,
-          comments: commentsPayload,
-          score
+  if (score?.scale === 5 && score.value < 5) {
+    reasons.push(`[AI Review] ${repoName}#${prNumber} completed with Greptile confidence ${score.value}/${score.scale}; strict review requires 5/5 before merge.`);
+    return {
+      verdict: "REJECT",
+      feedback,
+      reasons,
+      warnings,
+      rawPayload: {
+        pr: options.prState,
+        codeReviews: reviewsPayload,
+        selectedReview,
+        reviewDetails,
+        comments: commentsPayload,
+        score
+      }
+    };
+  }
+  const prUrl = options.prState.url || `https://github.com/${repoName}/pull/${prNumber}`;
+  let strictGate = null;
+  try {
+    const strictEvidence = await collectStrictPrEvidenceForVerifier({
+      projectRoot: options.projectRoot,
+      taskId: options.taskId,
+      prUrl,
+      apiSignals: [{
+        id: selectedReview.id,
+        body: reviewBody,
+        reviewedSha: selectedReview.metadata?.checkHeadSha ?? null,
+        status: selectedReview.status
+      }]
+    });
+    strictGate = evaluateStrictPrMergeGate(strictEvidence);
+  } catch (error) {
+    reasons.push(`[AI Review] Strict Greptile evidence collection failed for ${repoName}#${prNumber}: ${error instanceof Error ? error.message : String(error)}`);
+    return {
+      verdict: "REJECT",
+      feedback,
+      reasons,
+      warnings,
+      rawPayload: {
+        pr: options.prState,
+        codeReviews: reviewsPayload,
+        selectedReview,
+        reviewDetails,
+        comments: commentsPayload,
+        score
+      }
+    };
+  }
+  if (!strictGate.approved) {
+    return {
+      verdict: strictGate.pending ? "SKIP" : "REJECT",
+      feedback,
+      reasons: strictGate.reasons.map((reason) => reason.startsWith("[AI Review]") ? reason : `[AI Review] ${reason}`),
+      warnings: [...warnings, ...strictGate.warnings],
+      rawPayload: {
+        pr: options.prState,
+        codeReviews: reviewsPayload,
+        selectedReview,
+        reviewDetails,
+        comments: commentsPayload,
+        score,
+        strictGate: {
+          approved: strictGate.approved,
+          pending: strictGate.pending,
+          reasons: strictGate.reasons,
+          reasonDetails: strictGate.reasonDetails,
+          warnings: strictGate.warnings,
+          greptile: strictGate.evidence.greptile,
+          readErrors: strictGate.evidence.readErrors
         }
-      };
-    }
-    if (score.scale === 5 && score.value < 5) {
-      warnings.push(`[AI Review] ${repoName}#${prNumber} completed with Greptile confidence ${score.value}/${score.scale}; continue only after reviewing remaining risk.`);
-    }
+      }
+    };
   }
   return {
     verdict: "APPROVE",
@@ -4465,7 +5794,16 @@ async function runGreptileReviewForPr(options) {
       codeReviews: reviewsPayload,
       selectedReview,
       reviewDetails,
-      comments: commentsPayload
+      comments: commentsPayload,
+      strictGate: {
+        approved: strictGate.approved,
+        pending: strictGate.pending,
+        reasons: strictGate.reasons,
+        reasonDetails: strictGate.reasonDetails,
+        warnings: strictGate.warnings,
+        greptile: strictGate.evidence.greptile,
+        readErrors: strictGate.evidence.readErrors
+      }
     }
   };
 }
@@ -4489,7 +5827,7 @@ async function runGithubGreptileFallbackReviewForPr(options) {
   let threads = [];
   let actionableThreads = [];
   let checkRollup = [];
-  let checkState = { pending: false, completed: false };
+  let checkState2 = { pending: false, completed: false };
   for (let attempt = 0;; attempt += 1) {
     reviews = runGhJson(options.projectRoot, ["api", `repos/${repoName}/pulls/${prNumber}/reviews`]);
     selectedReview = pickRelevantGithubGreptileReview(reviews, expectedHeadSha);
@@ -4498,15 +5836,15 @@ async function runGithubGreptileFallbackReviewForPr(options) {
     threads = loadGithubReviewThreads(options.projectRoot, repoName, prNumber);
     actionableThreads = filterActionableGithubGreptileThreads(threads);
     checkRollup = loadGithubPullRequestCheckRollup(options.projectRoot, repoName, prNumber);
-    checkState = classifyGithubGreptileCheckState(checkRollup);
-    const approvedViaReviewedAncestor2 = !selectedReview && !!fallbackReview?.commit_id && !!expectedHeadSha && isCommitAncestorOfPrHead(options.projectRoot, options.prState, fallbackReview.commit_id, expectedHeadSha);
+    checkState2 = classifyGithubGreptileCheckState(checkRollup);
+    const approvedViaReviewedAncestor = !selectedReview && !!fallbackReview?.commit_id && !!expectedHeadSha && isCommitAncestorOfPrHead(options.projectRoot, options.prState, fallbackReview.commit_id, expectedHeadSha);
     if (!shouldContinueGithubGreptileFallbackPolling({
       attempt,
       pollAttempts: options.pollAttempts,
-      checkState,
+      checkState: checkState2,
       fallbackReview,
       selectedReview,
-      approvedViaReviewedAncestor: approvedViaReviewedAncestor2
+      approvedViaReviewedAncestor
     })) {
       break;
     }
@@ -4534,7 +5872,7 @@ async function runGithubGreptileFallbackReviewForPr(options) {
   ].filter(Boolean).join(`
 `);
   const warnings = buildGithubGreptileFallbackWarnings(options);
-  if (checkState.pending) {
+  if (checkState2.pending) {
     return {
       verdict: "SKIP",
       feedback,
@@ -4545,34 +5883,20 @@ async function runGithubGreptileFallbackReviewForPr(options) {
       rawPayload: { ...buildGithubGreptileFallbackRawPayload(options), reviews, threads, checkRollup }
     };
   }
-  const approvedViaCompletedCheck = isGithubGreptileCheckApproved(checkRollup);
-  if (!fallbackReview) {
-    if (approvedViaCompletedCheck) {
-      warnings.push(`[AI Review Warning] ${repoName}#${prNumber} has no GitHub Greptile review object, but the Greptile check completed successfully and no unresolved Greptile threads remain.`);
-      return {
-        verdict: "APPROVE",
-        feedback,
-        reasons: [],
-        warnings,
-        rawPayload: { ...buildGithubGreptileFallbackRawPayload(options), reviews, threads, checkRollup }
-      };
-    }
-    return {
-      verdict: "SKIP",
-      feedback,
-      reasons: [
-        `[AI Review] Greptile GitHub review for ${repoName}#${prNumber} is not available.`
-      ],
-      warnings,
-      rawPayload: { ...buildGithubGreptileFallbackRawPayload(options), reviews, threads, checkRollup }
-    };
-  }
-  const approvedViaReviewedAncestor = !selectedReview && !!fallbackReview.commit_id && !!expectedHeadSha && isCommitAncestorOfPrHead(options.projectRoot, options.prState, fallbackReview.commit_id, expectedHeadSha);
-  if (actionableThreads.length > 0) {
+  const prUrl = options.prState.url || `https://github.com/${repoName}/pull/${prNumber}`;
+  let strictGate;
+  try {
+    const strictEvidence = await collectStrictPrEvidenceForVerifier({
+      projectRoot: options.projectRoot,
+      taskId: options.taskId,
+      prUrl
+    });
+    strictGate = evaluateStrictPrMergeGate(strictEvidence);
+  } catch (error) {
     return {
       verdict: "REJECT",
       feedback,
-      reasons: actionableThreads.map((comment) => `[AI Review] ${repoName}#${prNumber} has unresolved Greptile comment on ${comment.path}: ${summarizeComment(comment.body || "")}`),
+      reasons: [`[AI Review] Strict Greptile evidence collection failed for ${repoName}#${prNumber}: ${error instanceof Error ? error.message : String(error)}`],
       warnings,
       rawPayload: {
         pr: options.prState,
@@ -4585,44 +5909,31 @@ async function runGithubGreptileFallbackReviewForPr(options) {
       }
     };
   }
-  if (!selectedReview && !approvedViaReviewedAncestor) {
-    if (approvedViaCompletedCheck) {
-      warnings.push(`[AI Review Warning] ${repoName}#${prNumber} has no fresh Greptile GitHub review on the current head, but the Greptile check completed successfully and all Greptile threads are resolved.`);
-      return {
-        verdict: "APPROVE",
-        feedback,
-        reasons: [],
-        warnings,
-        rawPayload: {
-          pr: options.prState,
-          selectedReview: fallbackReview,
-          reviews,
-          threads,
-          checkRollup,
-          ...buildGithubGreptileFallbackRawPayload(options)
-        }
-      };
-    }
+  if (!strictGate.approved) {
     return {
-      verdict: "SKIP",
+      verdict: strictGate.pending ? "SKIP" : "REJECT",
       feedback,
-      reasons: [
-        `[AI Review] Greptile GitHub review for ${repoName}#${prNumber} is not available for the current head.`
-      ],
-      warnings,
+      reasons: strictGate.reasons.map((reason) => reason.startsWith("[AI Review]") ? reason : `[AI Review] ${reason}`),
+      warnings: [...warnings, ...strictGate.warnings],
       rawPayload: {
         pr: options.prState,
         selectedReview: fallbackReview,
         reviews,
         threads,
         checkRollup,
+        actionableThreads,
+        strictGate: {
+          approved: strictGate.approved,
+          pending: strictGate.pending,
+          reasons: strictGate.reasons,
+          reasonDetails: strictGate.reasonDetails,
+          warnings: strictGate.warnings,
+          greptile: strictGate.evidence.greptile
+        },
         ...buildGithubGreptileFallbackRawPayload(options)
       }
     };
   }
-  if (approvedViaReviewedAncestor) {
-    warnings.push(`[AI Review Warning] ${repoName}#${prNumber} has no fresh Greptile review on the current head, but the latest reviewed commit is an ancestor and all Greptile threads are resolved.`);
-  }
   return {
     verdict: "APPROVE",
     feedback,
@@ -4634,6 +5945,14 @@ async function runGithubGreptileFallbackReviewForPr(options) {
       reviews,
       threads,
       checkRollup,
+      strictGate: {
+        approved: strictGate.approved,
+        pending: strictGate.pending,
+        reasons: strictGate.reasons,
+        reasonDetails: strictGate.reasonDetails,
+        warnings: strictGate.warnings,
+        greptile: strictGate.evidence.greptile
+      },
       ...buildGithubGreptileFallbackRawPayload(options)
     }
   };
@@ -4746,19 +6065,25 @@ function shouldTriggerGreptileReview(existingReview, expectedHeadSha) {
   if ((existingReview.metadata?.checkHeadSha || "") !== expectedHeadSha) {
     return true;
   }
-  return isGreptileReviewTerminal(existingReview.status);
+  return false;
 }
 function shouldContinueGreptileMcpPolling(options) {
   if (options.githubCheckState.completed) {
     return false;
   }
+  if (options.attempt + 1 >= options.pollAttempts) {
+    return false;
+  }
   if (options.selectedReview && !isGreptileReviewTerminal(options.selectedReview.status)) {
     return true;
   }
-  return options.attempt + 1 < options.pollAttempts;
+  return true;
 }
 function shouldContinueGithubGreptileFallbackPolling(options) {
   const waitingForVisiblePendingReview = options.checkState.pending && (!options.fallbackReview || !options.selectedReview && !options.approvedViaReviewedAncestor);
+  if (options.attempt + 1 >= options.pollAttempts) {
+    return false;
+  }
   if (waitingForVisiblePendingReview) {
     return true;
   }
@@ -4819,6 +6144,20 @@ function runGhJson(projectRoot, args) {
     throw new Error(`gh ${args.join(" ")} returned malformed JSON: ${result.stdout}`);
   }
 }
+async function collectStrictPrEvidenceForVerifier(input) {
+  return collectPrReviewEvidence({
+    projectRoot: input.projectRoot,
+    prUrl: input.prUrl,
+    taskId: input.taskId,
+    runId: "verifier",
+    cycle: 0,
+    apiSignals: input.apiSignals ?? [],
+    command: async (args, options) => {
+      const result = runCapture(["gh", ...args], options?.cwd ?? input.projectRoot);
+      return { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr };
+    }
+  });
+}
 function deriveRepoName(projectRoot, prState) {
   const fromUrl = /github\.com\/([^/]+\/[^/]+)\/pull\/\d+/.exec(prState.url || "");
   if (fromUrl?.[1]) {
@@ -4833,8 +6172,9 @@ function resolvePrHeadSha(projectRoot, prState) {
   const repoRoot = resolvePrRepoRoot(projectRoot, prState);
   return runCapture(["git", "-C", repoRoot, "rev-parse", "HEAD"], projectRoot).stdout.trim();
 }
-function isGreptileGithubLogin(login) {
-  return (login || "").replace(/\[bot\]$/, "") === "greptile-apps";
+function isGreptileGithubLogin2(login) {
+  const normalized = (login || "").toLowerCase().replace(/\[bot\]$/, "");
+  return normalized === "greptile" || normalized === "greptile-ai" || normalized === "greptileai" || normalized === "greptile-apps";
 }
 function pickRelevantGithubGreptileReview(reviews, expectedHeadSha) {
   const matching = sortGithubGreptileReviews(reviews);
@@ -4851,7 +6191,7 @@ function pickLatestGithubGreptileReview(reviews) {
   return sortGithubGreptileReviews(reviews)[0] || null;
 }
 function sortGithubGreptileReviews(reviews) {
-  return reviews.filter((review) => isGreptileGithubLogin(review.user?.login)).sort((left, right) => Date.parse(right.submitted_at || "") - Date.parse(left.submitted_at || ""));
+  return reviews.filter((review) => isGreptileGithubLogin2(review.user?.login)).sort((left, right) => Date.parse(right.submitted_at || "") - Date.parse(left.submitted_at || ""));
 }
 function loadGithubPullRequestCheckRollup(projectRoot, repoName, prNumber) {
   const response = runGhJson(projectRoot, [
@@ -4924,32 +6264,6 @@ function classifyGithubGreptileCheckState(checks) {
   }
   return { pending: false, completed: false };
 }
-function isGithubGreptileCheckApproved(checks) {
-  const greptileChecks = checks.filter((check) => {
-    const label = (check.name || check.context || "").toLowerCase();
-    return label.includes("greptile");
-  });
-  if (greptileChecks.length === 0) {
-    return false;
-  }
-  for (const check of greptileChecks) {
-    if ((check.__typename || "") === "CheckRun") {
-      if ((check.status || "").toUpperCase() !== "COMPLETED") {
-        return false;
-      }
-      const conclusion = (check.conclusion || "").toUpperCase();
-      if (!["SUCCESS", "NEUTRAL", "SKIPPED"].includes(conclusion)) {
-        return false;
-      }
-      continue;
-    }
-    const state = (check.state || "").toUpperCase();
-    if (!["SUCCESS", "NEUTRAL", "SKIPPED"].includes(state)) {
-      return false;
-    }
-  }
-  return true;
-}
 function loadGithubReviewThreads(projectRoot, repoName, prNumber) {
   const [owner, name] = repoName.split("/");
   if (!owner || !name) {
@@ -4975,7 +6289,7 @@ function filterActionableGithubGreptileThreads(threads) {
       return [];
     }
     const comments = thread.comments?.nodes || [];
-    const latestGreptileComment = [...comments].reverse().find((comment) => isGreptileGithubLogin(comment.author?.login));
+    const latestGreptileComment = [...comments].reverse().find((comment) => isGreptileGithubLogin2(comment.author?.login));
     if (!latestGreptileComment?.path?.trim()) {
       return [];
     }
@@ -4984,7 +6298,7 @@ function filterActionableGithubGreptileThreads(threads) {
 }
 function resolvePrRepoRoot(projectRoot, prState) {
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  if (prState.target === "monorepo" && runtimeWorkspace && existsSync19(resolve22(runtimeWorkspace, ".git"))) {
+  if (prState.target === "monorepo" && runtimeWorkspace && existsSync20(resolve23(runtimeWorkspace, ".git"))) {
     return runtimeWorkspace;
   }
   const paths = resolveHarnessPaths(projectRoot);
@@ -4997,11 +6311,6 @@ function isCommitAncestorOfPrHead(projectRoot, prState, reviewedCommit, headComm
   const repoRoot = resolvePrRepoRoot(projectRoot, prState);
   return runCapture(["git", "-C", repoRoot, "merge-base", "--is-ancestor", reviewedCommit, headCommit], projectRoot).exitCode === 0;
 }
-function stripHtml(input) {
-  return input.replace(/<[^>]+>/g, " ").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/\r/g, "").replace(/\n{3,}/g, `
-
-`).trim();
-}
 function summarizeComment(input) {
   const text = stripHtml(input).replace(/\s+/g, " ").trim();
   return text.length > 160 ? `${text.slice(0, 157)}...` : text;
@@ -5010,31 +6319,14 @@ function asGreptileInfrastructureWarning(reason) {
   return reason.startsWith("[AI Review]") ? reason.replace("[AI Review]", "[AI Review Warning]") : reason;
 }
 function isAiReviewApproved(input) {
+  if (input.aiVerdict === "REJECT" && input.aiReasons.length > 0) {
+    return false;
+  }
   if (input.reviewMode !== "required") {
     return true;
   }
   return input.aiVerdict === "APPROVE" && input.aiReasons.length === 0;
 }
-function parseGreptileScore(input) {
-  const text = stripHtml(input);
-  const patterns = [
-    /confidence score:\s*(\d+)\s*\/\s*(\d+)/i,
-    /\bscore:\s*(\d+)\s*\/\s*(\d+)/i,
-    /\b(\d+)\s*\/\s*(\d+)\s*(?:confidence|score)/i
-  ];
-  for (const pattern of patterns) {
-    const match = pattern.exec(text);
-    if (!match) {
-      continue;
-    }
-    const value = Number.parseInt(match[1] || "", 10);
-    const scale = Number.parseInt(match[2] || "", 10);
-    if (Number.isFinite(value) && Number.isFinite(scale) && scale > 0) {
-      return { value, scale };
-    }
-  }
-  return null;
-}
 
 // packages/runtime/src/control-plane/provider/runtime-instructions.ts
 var CLAUDE_ROUTER_TOOL_NAMES = [
@@ -5378,16 +6670,16 @@ async function taskDeps(projectRoot, taskId) {
   for (const dep of deps) {
     const artifactDir = artifactDirForId(projectRoot, dep);
     console.log(`=== ${dep} ===`);
-    if (!existsSync20(artifactDir)) {
+    if (!existsSync21(artifactDir)) {
       console.log(`  (no artifacts yet)
 `);
       continue;
     }
-    printArtifactSection(resolve23(artifactDir, "decision-log.md"), "--- Decisions ---");
-    printArtifactSection(resolve23(artifactDir, "next-actions.md"), "--- Next Actions (for you) ---");
-    const changedFiles = resolve23(artifactDir, "changed-files.txt");
-    if (existsSync20(changedFiles)) {
-      const lines = readFileSync10(changedFiles, "utf-8").split(/\r?\n/).filter(Boolean);
+    printArtifactSection(resolve24(artifactDir, "decision-log.md"), "--- Decisions ---");
+    printArtifactSection(resolve24(artifactDir, "next-actions.md"), "--- Next Actions (for you) ---");
+    const changedFiles = resolve24(artifactDir, "changed-files.txt");
+    if (existsSync21(changedFiles)) {
+      const lines = readFileSync11(changedFiles, "utf-8").split(/\r?\n/).filter(Boolean);
       console.log(`--- Changed Files (${lines.length}) ---`);
       for (const line of lines) {
         console.log(line);
@@ -5432,12 +6724,12 @@ function taskRecord(projectRoot, type, text, taskId) {
     throw new Error("No active task.");
   }
   const paths = resolveHarnessPaths(projectRoot);
-  mkdirSync9(paths.stateDir, { recursive: true });
+  mkdirSync10(paths.stateDir, { recursive: true });
   if (type === "decision") {
-    const artifactDir = resolve23(paths.artifactsDir, activeTask);
-    mkdirSync9(artifactDir, { recursive: true });
+    const artifactDir = resolve24(paths.artifactsDir, activeTask);
+    mkdirSync10(artifactDir, { recursive: true });
     const timestamp = nowIso();
-    appendFileSync(resolve23(artifactDir, "decision-log.md"), `
+    appendFileSync(resolve24(artifactDir, "decision-log.md"), `
 ### ${timestamp}
 
 ${text}
@@ -5447,15 +6739,15 @@ ${text}
     return;
   }
   const failedPath = paths.failedApproachesPath;
-  if (!existsSync20(failedPath)) {
-    writeFileSync9(failedPath, `# Failed Approaches Log
+  if (!existsSync21(failedPath)) {
+    writeFileSync10(failedPath, `# Failed Approaches Log
 
 This file records approaches that did not work.
 
 `, "utf-8");
   }
-  const content = readFileSync10(failedPath, "utf-8");
-  const attempts = (content.match(new RegExp(`^## ${escapeRegExp2(activeTask)}\\b`, "gm")) || []).length + 1;
+  const content = readFileSync11(failedPath, "utf-8");
+  const attempts = (content.match(new RegExp(`^## ${escapeRegExp(activeTask)}\\b`, "gm")) || []).length + 1;
   appendFileSync(failedPath, `
 ## ${activeTask} - Attempt ${attempts} (${nowIso()})
 
@@ -5471,40 +6763,40 @@ function taskArtifacts(projectRoot, taskId) {
     throw new Error("No active task.");
   }
   const paths = resolveHarnessPaths(projectRoot);
-  const artifactDir = resolve23(paths.artifactsDir, activeTask);
-  mkdirSync9(artifactDir, { recursive: true });
+  const artifactDir = resolve24(paths.artifactsDir, activeTask);
+  mkdirSync10(artifactDir, { recursive: true });
   const changed = changedFilesForTask(projectRoot, activeTask, true);
-  writeFileSync9(resolve23(artifactDir, "changed-files.txt"), `${changed.join(`
+  writeFileSync10(resolve24(artifactDir, "changed-files.txt"), `${changed.join(`
 `)}
 `, "utf-8");
   console.log(`changed-files.txt: ${changed.length} files`);
-  const taskResultPath = resolve23(artifactDir, "task-result.json");
-  if (!existsSync20(taskResultPath)) {
+  const taskResultPath = resolve24(artifactDir, "task-result.json");
+  if (!existsSync21(taskResultPath)) {
     const template = {
       task_id: activeTask,
       status: "completed",
       summary: "TODO: Write a one-line summary of what you did",
       completed_at: nowIso()
     };
-    writeFileSync9(taskResultPath, `${JSON.stringify(template, null, 2)}
+    writeFileSync10(taskResultPath, `${JSON.stringify(template, null, 2)}
 `, "utf-8");
     console.log("task-result.json: created (update the summary!)");
   } else {
     console.log("task-result.json: already exists");
   }
-  const decisionLogPath = resolve23(artifactDir, "decision-log.md");
-  if (!existsSync20(decisionLogPath)) {
+  const decisionLogPath = resolve24(artifactDir, "decision-log.md");
+  if (!existsSync21(decisionLogPath)) {
     const content = `# Decision Log: ${activeTask}
 
 Record key decisions here using: rig-agent record decision "..."
 `;
-    writeFileSync9(decisionLogPath, content, "utf-8");
+    writeFileSync10(decisionLogPath, content, "utf-8");
     console.log("decision-log.md: created (record your decisions!)");
   } else {
     console.log("decision-log.md: already exists");
   }
-  const nextActionsPath = resolve23(artifactDir, "next-actions.md");
-  if (!existsSync20(nextActionsPath)) {
+  const nextActionsPath = resolve24(artifactDir, "next-actions.md");
+  if (!existsSync21(nextActionsPath)) {
     const content = [
       `# Next Actions: ${activeTask}`,
       "",
@@ -5521,13 +6813,13 @@ Record key decisions here using: rig-agent record decision "..."
       ""
     ].join(`
 `);
-    writeFileSync9(nextActionsPath, content, "utf-8");
+    writeFileSync10(nextActionsPath, content, "utf-8");
     console.log("next-actions.md: created (add recommendations for downstream tasks!)");
   } else {
     console.log("next-actions.md: already exists");
   }
-  const validationSummaryPath = resolve23(artifactDir, "validation-summary.json");
-  if (existsSync20(validationSummaryPath)) {
+  const validationSummaryPath = resolve24(artifactDir, "validation-summary.json");
+  if (existsSync21(validationSummaryPath)) {
     console.log("validation-summary.json: already exists");
   } else {
     console.log("validation-summary.json: not yet created (run: rig-agent validate)");
@@ -5570,12 +6862,12 @@ async function taskValidate(projectRoot, taskId, validatorRegistry) {
   console.log(`Validation passed: ${summary.passed}/${summary.total}`);
   return true;
 }
-async function taskVerify(projectRoot, plugins, taskId) {
+async function taskVerify(projectRoot, taskId) {
   const activeTask = taskId || currentTaskId(projectRoot);
   if (!activeTask) {
     throw new Error("No active task.");
   }
-  const outcome = await verifyTask({ projectRoot, taskId: activeTask, plugins });
+  const outcome = await verifyTask({ projectRoot, taskId: activeTask });
   if (!outcome.approved) {
     console.log("REJECT:");
     for (const reason of outcome.localReasons) {
@@ -5618,7 +6910,7 @@ function collectTaskChangedFiles(projectRoot, taskId, includeCommitted) {
     [projectRoot, ""],
     [monorepoRepoRoot, ""]
   ]) {
-    if (!existsSync20(resolve23(repo, ".git"))) {
+    if (!existsSync21(resolve24(repo, ".git"))) {
       continue;
     }
     if (includeCommitted && repo === monorepoRepoRoot) {
@@ -5656,8 +6948,8 @@ function filterTaskChangedFiles(projectRoot, taskId, files, scoped) {
 }
 function resolveTaskMonorepoRoot(projectRoot) {
   const runtimeWorkspace = loadRuntimeContextFromEnv()?.workspaceDir || process.env.RIG_TASK_WORKSPACE?.trim();
-  if (runtimeWorkspace && existsSync20(resolve23(runtimeWorkspace, ".git"))) {
-    return resolve23(runtimeWorkspace);
+  if (runtimeWorkspace && existsSync21(resolve24(runtimeWorkspace, ".git"))) {
+    return resolve24(runtimeWorkspace);
   }
   return resolveHarnessPaths(projectRoot).monorepoRoot;
 }
@@ -5685,7 +6977,7 @@ function resolveRuntimeInitialHeadCommit(projectRoot, repo) {
   const runtimeContext = loadRuntimeContextFromEnv();
   if (runtimeContext?.initialHeadCommits?.monorepo?.trim()) {
     const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
-    if (resolve23(monorepoRoot) === resolve23(repo)) {
+    if (resolve24(monorepoRoot) === resolve24(repo)) {
       return runtimeContext.initialHeadCommits.monorepo.trim();
     }
   }
@@ -5695,7 +6987,7 @@ function resolveMonorepoBaseCommit(projectRoot, repo) {
   const runtimeContext = loadRuntimeContextFromEnv();
   if (runtimeContext?.monorepoBaseCommit?.trim()) {
     const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
-    if (resolve23(monorepoRoot) === resolve23(repo)) {
+    if (resolve24(monorepoRoot) === resolve24(repo)) {
       return runtimeContext.monorepoBaseCommit.trim();
     }
   }
@@ -5729,7 +7021,7 @@ function resolveRuntimeDirtyBaseline(projectRoot, repo) {
     return new Set;
   }
   const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
-  const selected = resolve23(repo) === resolve23(monorepoRoot) ? dirtyFiles.monorepo : resolve23(repo) === resolve23(projectRoot) ? dirtyFiles.project : undefined;
+  const selected = resolve24(repo) === resolve24(monorepoRoot) ? dirtyFiles.monorepo : resolve24(repo) === resolve24(projectRoot) ? dirtyFiles.project : undefined;
   return new Set((selected || []).map((file) => normalizeChangedFilePath(file)).filter(Boolean));
 }
 function normalizeChangedFilePath(file) {
@@ -5829,12 +7121,12 @@ function printIndented(text) {
   }
 }
 function readLocalBeadsTasks(projectRoot) {
-  const issuesPath = resolve23(resolveMonorepoRoot2(projectRoot), ".beads/issues.jsonl");
-  if (!existsSync20(issuesPath)) {
+  const issuesPath = resolve24(resolveMonorepoRoot2(projectRoot), ".beads/issues.jsonl");
+  if (!existsSync21(issuesPath)) {
     return [];
   }
   const tasks = [];
-  for (const line of readFileSync10(issuesPath, "utf-8").split(/\r?\n/)) {
+  for (const line of readFileSync11(issuesPath, "utf-8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -5947,14 +7239,14 @@ function taskDependencies(projectRoot, taskId, tracker) {
   return [...ids].sort();
 }
 function printArtifactSection(path, header) {
-  if (!existsSync20(path)) {
+  if (!existsSync21(path)) {
     return;
   }
   console.log(header);
-  process.stdout.write(readFileSync10(path, "utf-8"));
+  process.stdout.write(readFileSync11(path, "utf-8"));
   console.log("");
 }
-function escapeRegExp2(value) {
+function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function changedFilesForTask(projectRoot, taskId, scoped) {
@@ -5983,16 +7275,16 @@ var TASK_ARTIFACT_STAGE_FALLBACK = new Set([
   "task-result.json",
   "validation-summary.json"
 ]);
-function resolveHostRigBinDir(root) {
-  return resolve24(root, ".rig", "bin");
-}
 function isRuntimeGatewayGitPath(candidate) {
   return /\/\.rig\/bin\/git$/.test(candidate.replace(/\\/g, "/"));
 }
+function isRuntimeGatewayGhPath(candidate) {
+  return /\/\.rig\/bin\/gh$/.test(candidate.replace(/\\/g, "/"));
+}
 function resolveOptionalMonorepoRoot(projectRoot) {
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  if (runtimeWorkspace && existsSync21(resolve24(runtimeWorkspace, ".git"))) {
-    return resolve24(runtimeWorkspace);
+  if (runtimeWorkspace && existsSync22(resolve25(runtimeWorkspace, ".git"))) {
+    return resolve25(runtimeWorkspace);
   }
   try {
     return resolveMonorepoRoot2(projectRoot);
@@ -6017,12 +7309,15 @@ function resolveGitBinary(projectRoot) {
     if (!candidate || isRuntimeGatewayGitPath(candidate)) {
       continue;
     }
-    if (existsSync21(candidate)) {
+    if (existsSync22(candidate)) {
       return candidate;
     }
   }
   return "git";
 }
+function escapeRegExp2(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 function safeCurrentTaskId(projectRoot) {
   try {
     const taskId = currentTaskId(projectRoot);
@@ -6074,11 +7369,11 @@ function gitPreflight(projectRoot, taskId, strict) {
   const expected = resolvedTask ? `rig/${resolveTaskBranchId(projectRoot, resolvedTask)}` : "";
   console.log("=== Git Flow Preflight ===");
   let issues = 0;
-  if (!existsSync21(resolve24(projectRoot, ".git"))) {
+  if (!existsSync22(resolve25(projectRoot, ".git"))) {
     console.log(`ERROR: project root is not a git repo (${projectRoot})`);
     issues += 1;
   }
-  if (monorepoRoot && existsSync21(resolve24(monorepoRoot, ".git"))) {
+  if (monorepoRoot && existsSync22(resolve25(monorepoRoot, ".git"))) {
     const monoBranch = branchName(projectRoot, monorepoRoot);
     if (expected && monoBranch !== expected) {
       console.log(`WARN: monorepo branch is ${monoBranch}, expected ${expected} for task ${resolvedTask}`);
@@ -6112,7 +7407,7 @@ function gitSyncBranch(projectRoot, taskId, targetRepo = "monorepo") {
   }
   const repoRoot = targetRepo === "monorepo" ? resolveOptionalMonorepoRoot(projectRoot) || resolveMonorepoRoot2(projectRoot) : projectRoot;
   const repoLabel = targetRepo === "monorepo" ? "Monorepo" : "Project";
-  if (!existsSync21(resolve24(repoRoot, ".git"))) {
+  if (!existsSync22(resolve25(repoRoot, ".git"))) {
     throw new Error(`${repoLabel} repo not found at ${repoRoot}`);
   }
   const branchId = resolveTaskBranchId(projectRoot, resolvedTask);
@@ -6156,8 +7451,8 @@ function gitCommit(options) {
 function gitSnapshot(projectRoot, taskId, outputPath) {
   const monorepoRoot = resolveOptionalMonorepoRoot(projectRoot);
   const resolvedTask = taskId || safeCurrentTaskId(projectRoot);
-  const output = outputPath || (resolvedTask ? resolveArtifactSnapshot(projectRoot, resolvedTask) : resolve24(resolve24(projectRoot, ".rig", "state"), "git-state.txt"));
-  mkdirSync10(dirname11(output), { recursive: true });
+  const output = outputPath || (resolvedTask ? resolveArtifactSnapshot(projectRoot, resolvedTask) : resolve25(resolve25(projectRoot, ".rig", "state"), "git-state.txt"));
+  mkdirSync11(dirname11(output), { recursive: true });
   const lines = ["# Git Snapshot", `timestamp: ${nowIso()}`];
   if (resolvedTask) {
     lines.push(`task: ${resolvedTask}`);
@@ -6167,7 +7462,7 @@ function gitSnapshot(projectRoot, taskId, outputPath) {
   if (monorepoRoot && monorepoRoot !== projectRoot) {
     lines.push(...snapshotRepo(projectRoot, "monorepo", monorepoRoot));
   }
-  writeFileSync10(output, `${lines.join(`
+  writeFileSync11(output, `${lines.join(`
 `)}
 `, "utf-8");
   return output;
@@ -6191,7 +7486,7 @@ function gitOpenPr(options) {
   } else if (taskId) {
     gitSyncBranch(options.projectRoot, taskId, "project");
   }
-  if (!existsSync21(resolve24(repoRoot, ".git"))) {
+  if (!existsSync22(resolve25(repoRoot, ".git"))) {
     throw new Error(`Repository not available for open-pr target ${target}: ${repoRoot}`);
   }
   const branch = branchName(options.projectRoot, repoRoot);
@@ -6236,10 +7531,11 @@ function gitOpenPr(options) {
     "",
     "## Task",
     `- beads: ${taskId || "n/a"}`,
+    ...defaultPrRunLines(taskId, repoNameWithOwner),
     "",
     "## Review",
     "- Completion verification will run validation, verifier review, and PR policy checks.",
-    "- When repository policy allows it, Rig enables GitHub auto-merge after approval."
+    "- When repository policy allows it, Rig attempts an immediate strict-gated, head-locked merge after approval."
   ].join(`
 `);
   const preCheck = runCapture2(withGhRepo([gh, "pr", "list", "--state", "merged", "--head", branch, "--json", "url,mergedAt", "--jq", ".[0]"], repoNameWithOwner), repoRoot);
@@ -6327,6 +7623,30 @@ function gitOpenPr(options) {
   }
   return result;
 }
+function defaultPrRunLines(taskId, repoNameWithOwner) {
+  const lines = [];
+  const runId = process.env.RIG_SERVER_RUN_ID?.trim();
+  if (runId) {
+    lines.push(`- Run: ${runId}`);
+  }
+  const closeout = defaultPrCloseoutLine(taskId, repoNameWithOwner);
+  if (closeout) {
+    lines.push(`- ${closeout}`);
+  }
+  return lines;
+}
+function defaultPrCloseoutLine(taskId, repoNameWithOwner) {
+  const sourceIssueId = loadRuntimeContextFromEnv()?.sourceTask?.sourceIssueId;
+  if (sourceIssueId) {
+    const match = sourceIssueId.match(/^([^#]+)#(\d+)$/);
+    if (match?.[1] && match[2]) {
+      const sourceRepo = match[1];
+      const issueNumber = match[2];
+      return sourceRepo.toLowerCase() === repoNameWithOwner.toLowerCase() ? `Closes #${issueNumber}` : `Closes ${sourceRepo}#${issueNumber}`;
+    }
+  }
+  return /^\d+$/.test(taskId) ? `Closes #${taskId}` : "";
+}
 function readPrViewState(gh, repoRoot, repoNameWithOwner, prUrl) {
   const view = runCapture2(withGhRepo([
     gh,
@@ -6379,12 +7699,12 @@ function assertPrHasNoGitConflicts(prState, repoLabel, baseRef) {
 }
 function writePrMetadata(projectRoot, taskId, result) {
   const dir = artifactDirForId(projectRoot, taskId);
-  mkdirSync10(dir, { recursive: true });
-  const path = resolve24(dir, "pr-state.json");
+  mkdirSync11(dir, { recursive: true });
+  const path = resolve25(dir, "pr-state.json");
   let prs = {};
-  if (existsSync21(path)) {
+  if (existsSync22(path)) {
     try {
-      const parsed = JSON.parse(readFileSync11(path, "utf-8"));
+      const parsed = JSON.parse(readFileSync12(path, "utf-8"));
       if (parsed && typeof parsed === "object" && parsed.prs && typeof parsed.prs === "object") {
         prs = parsed.prs;
       }
@@ -6400,16 +7720,16 @@ function writePrMetadata(projectRoot, taskId, result) {
     ...primary || {},
     updated_at: nowIso()
   };
-  writeFileSync10(path, `${JSON.stringify(artifact, null, 2)}
+  writeFileSync11(path, `${JSON.stringify(artifact, null, 2)}
 `, "utf-8");
 }
 function readPrMetadata(projectRoot, taskId) {
-  const path = resolve24(artifactDirForId(projectRoot, taskId), "pr-state.json");
-  if (!existsSync21(path)) {
+  const path = resolve25(artifactDirForId(projectRoot, taskId), "pr-state.json");
+  if (!existsSync22(path)) {
     return [];
   }
   try {
-    const parsed = JSON.parse(readFileSync11(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync12(path, "utf-8"));
     if (!parsed || typeof parsed !== "object") {
       return [];
     }
@@ -6422,8 +7742,8 @@ function readPrMetadata(projectRoot, taskId) {
   }
 }
 function resolveArtifactSnapshot(projectRoot, taskId) {
-  const artifactDir = resolve24(resolveHarnessPaths(projectRoot).artifactsDir, taskId);
-  return resolve24(artifactDir, "git-state.txt");
+  const artifactDir = resolve25(resolveHarnessPaths(projectRoot).artifactsDir, taskId);
+  return resolve25(artifactDir, "git-state.txt");
 }
 function isGitOpenPrResult(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -6477,32 +7797,19 @@ function resolveGithubCliBinary(projectRoot) {
   if (explicit) {
     candidates.add(explicit);
   }
+  for (const candidate of ["/usr/bin/gh", "/opt/homebrew/bin/gh", "/usr/local/bin/gh"]) {
+    candidates.add(candidate);
+  }
   const explicitPathEntries = (process.env.PATH || "").split(":").map((entry) => entry.trim()).filter(Boolean);
   for (const entry of explicitPathEntries) {
-    candidates.add(resolve24(entry, "gh"));
-  }
-  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim();
-  if (hostProjectRoot) {
-    candidates.add(resolve24(resolveHostRigBinDir(hostProjectRoot), "gh"));
-  }
-  candidates.add(resolve24(resolveHostRigBinDir(projectRoot), "gh"));
-  const runtimeContext = loadRuntimeContextFromEnv();
-  if (runtimeContext?.binDir) {
-    candidates.add(resolve24(runtimeContext.binDir, "gh"));
-  }
-  const runtimeHome = process.env.RIG_RUNTIME_HOME?.trim();
-  if (runtimeHome) {
-    candidates.add(resolve24(runtimeHome, "bin", "gh"));
-  }
-  for (const candidate of ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"]) {
-    candidates.add(candidate);
+    candidates.add(resolve25(entry, "gh"));
   }
   const bunResolved = Bun.which("gh");
   if (bunResolved) {
     candidates.add(bunResolved);
   }
   for (const candidate of candidates) {
-    if (candidate && existsSync21(candidate)) {
+    if (candidate && existsSync22(candidate) && !isRuntimeGatewayGhPath(candidate)) {
       return candidate;
     }
   }
@@ -6532,7 +7839,7 @@ function resolveRepoNameWithOwner(projectRoot, repoRoot) {
   return resolveGithubRepoNameWithOwnerFromGitRoot(projectRoot, repoRoot, repoRoot, visited);
 }
 function resolveGithubRepoNameWithOwnerFromGitRoot(projectRoot, gitRoot, cwd, visited) {
-  const normalizedGitRoot = resolve24(gitRoot);
+  const normalizedGitRoot = resolve25(gitRoot);
   if (visited.has(normalizedGitRoot)) {
     return "";
   }
@@ -6604,7 +7911,7 @@ function resolveNetworkRemoteName(projectRoot, repoRoot, repoNameWithOwner) {
   return remotes.includes("origin") ? "origin" : remotes[0];
 }
 function gitQuery(projectRoot, gitRoot, cwd, ...args) {
-  const gitArgs = existsSync21(resolve24(gitRoot, ".git")) ? gitCmd(projectRoot, gitRoot, ...args) : [resolveGitBinary(projectRoot), "--git-dir", gitRoot, ...args];
+  const gitArgs = existsSync22(resolve25(gitRoot, ".git")) ? gitCmd(projectRoot, gitRoot, ...args) : [resolveGitBinary(projectRoot), "--git-dir", gitRoot, ...args];
   return runCapture2(gitArgs, cwd, projectRoot);
 }
 function resolveLocalGitRemoteRoot(remoteUrl, gitRoot) {
@@ -6622,9 +7929,9 @@ function resolveLocalGitRemoteRoot(remoteUrl, gitRoot) {
   } else if (/^[a-z][a-z0-9+.-]*:\/\//i.test(normalized) || /^[^@]+@[^:]+:.+$/.test(normalized)) {
     return "";
   } else if (!isAbsolute2(normalized)) {
-    candidate = resolve24(gitRoot, normalized);
+    candidate = resolve25(gitRoot, normalized);
   }
-  return existsSync21(candidate) ? candidate : "";
+  return existsSync22(candidate) ? candidate : "";
 }
 function normalizeGithubRepoNameWithOwner(value) {
   const normalized = value.trim();
@@ -6655,7 +7962,7 @@ function inferRepositoryDefaultBase(projectRoot, repoRoot, repoNameWithOwner, re
   const remote = remoteName || "origin";
   const symbolic = runCapture2(gitCmd(projectRoot, repoRoot, "symbolic-ref", "--short", `refs/remotes/${remote}/HEAD`), projectRoot);
   if (symbolic.exitCode === 0) {
-    const ref = symbolic.stdout.trim().replace(new RegExp(`^${escapeRegExp(remote)}/`), "");
+    const ref = symbolic.stdout.trim().replace(new RegExp(`^${escapeRegExp2(remote)}/`), "");
     if (ref && ref !== "HEAD") {
       return ref;
     }
@@ -6751,7 +8058,7 @@ function inferReviewerFromChangedFiles(projectRoot, repoRoot, baseRef, branchRef
   return best;
 }
 function snapshotRepo(projectRoot, label, repo) {
-  if (!existsSync21(resolve24(repo, ".git"))) {
+  if (!existsSync22(resolve25(repo, ".git"))) {
     return [`## ${label}`, `repo: ${repo}`, "status: unavailable", ""];
   }
   const status = runCapture2(gitCmd(projectRoot, repo, "status", "--short"), projectRoot).stdout.trim();
@@ -6774,7 +8081,7 @@ function snapshotRepo(projectRoot, label, repo) {
   ];
 }
 function commitRepo(projectRoot, repo, label, message, allowEmpty, scoped, files, changedFilesManifest) {
-  if (!existsSync21(resolve24(repo, ".git"))) {
+  if (!existsSync22(resolve25(repo, ".git"))) {
     console.log(`Skipping ${label}: repo not available (${repo})`);
     return;
   }
@@ -6806,18 +8113,18 @@ function commitRepo(projectRoot, repo, label, message, allowEmpty, scoped, files
   console.log(`Committed ${label}: ${message}`);
 }
 function readChangedFilesManifest(projectRoot, taskId) {
-  const manifestPath = resolve24(artifactDirForId(projectRoot, taskId), "changed-files.txt");
-  if (!existsSync21(manifestPath)) {
+  const manifestPath = resolve25(artifactDirForId(projectRoot, taskId), "changed-files.txt");
+  if (!existsSync22(manifestPath)) {
     return [];
   }
-  const files = readFileSync11(manifestPath, "utf-8").split(/\r?\n/).map((line) => normalizeChangedFilePath2(line)).filter(Boolean);
+  const files = readFileSync12(manifestPath, "utf-8").split(/\r?\n/).map((line) => normalizeChangedFilePath2(line)).filter(Boolean);
   return [...new Set(files)];
 }
 function refreshChangedFilesManifest(projectRoot, taskId) {
-  const manifestPath = resolve24(artifactDirForId(projectRoot, taskId), "changed-files.txt");
-  mkdirSync10(dirname11(manifestPath), { recursive: true });
+  const manifestPath = resolve25(artifactDirForId(projectRoot, taskId), "changed-files.txt");
+  mkdirSync11(dirname11(manifestPath), { recursive: true });
   const changedFiles = changedFilesForTask(projectRoot, taskId, true);
-  writeFileSync10(manifestPath, `${changedFiles.join(`
+  writeFileSync11(manifestPath, `${changedFiles.join(`
 `)}
 `, "utf-8");
   return manifestPath;
@@ -6930,7 +8237,7 @@ function repoHasPathChange(projectRoot, repoRoot, relativePath) {
   return result.exitCode === 0 && result.stdout.trim().length > 0;
 }
 function stageExcludePathspecs(repoRoot) {
-  const patterns = existsSync21(resolve24(repoRoot, ".rig", "task-config.json")) ? [...TASK_RUNTIME_STAGE_EXCLUDES, ...GENERATED_STAGE_EXCLUDES] : [".rig/**", ...GENERATED_STAGE_EXCLUDES];
+  const patterns = existsSync22(resolve25(repoRoot, ".rig", "task-config.json")) ? [...TASK_RUNTIME_STAGE_EXCLUDES, ...GENERATED_STAGE_EXCLUDES] : [".rig/**", ...GENERATED_STAGE_EXCLUDES];
   return patterns.map((pattern) => `:(glob,exclude)${pattern}`);
 }
 function pathResolvesBeyondSymlink(repoRoot, relativePath) {
@@ -6940,7 +8247,7 @@ function pathResolvesBeyondSymlink(repoRoot, relativePath) {
   }
   let current = repoRoot;
   for (let index = 0;index < parts.length - 1; index += 1) {
-    current = resolve24(current, parts[index]);
+    current = resolve25(current, parts[index]);
     try {
       if (lstatSync(current).isSymbolicLink()) {
         return true;
@@ -6952,7 +8259,7 @@ function pathResolvesBeyondSymlink(repoRoot, relativePath) {
   return false;
 }
 function printRepoStatus(projectRoot, label, repo, expectedBranch) {
-  if (!existsSync21(resolve24(repo, ".git"))) {
+  if (!existsSync22(resolve25(repo, ".git"))) {
     console.log(`${label}: unavailable (${repo})`);
     return;
   }
@@ -6988,7 +8295,7 @@ function resolveTaskBranchId(projectRoot, taskId) {
     }
   } catch {}
   const artifactDir = artifactDirForId(projectRoot, taskId);
-  if (existsSync21(artifactDir)) {
+  if (existsSync22(artifactDir)) {
     return taskId;
   }
   throw new Error(`Unknown task id: ${taskId}`);
@@ -7024,11 +8331,11 @@ function runCapture2(command, cwd, projectRoot = cwd) {
 }
 function runtimeGitEnv(projectRoot) {
   const { ctx, runtimeRoot } = resolveRuntimeMetadata(projectRoot);
-  const runtimeHome = runtimeRoot ? resolve24(runtimeRoot, "home") : "";
-  const runtimeTmp = runtimeRoot ? resolve24(runtimeRoot, "tmp") : "";
-  const runtimeCache = runtimeRoot ? resolve24(runtimeRoot, "cache") : "";
-  const runtimeKnownHosts = runtimeHome ? resolve24(runtimeHome, ".ssh", "known_hosts") : "";
-  const runtimeKey = runtimeHome ? resolve24(runtimeHome, ".ssh", "rig-agent-key") : "";
+  const runtimeHome = runtimeRoot ? resolve25(runtimeRoot, "home") : "";
+  const runtimeTmp = runtimeRoot ? resolve25(runtimeRoot, "tmp") : "";
+  const runtimeCache = runtimeRoot ? resolve25(runtimeRoot, "cache") : "";
+  const runtimeKnownHosts = runtimeHome ? resolve25(runtimeHome, ".ssh", "known_hosts") : "";
+  const runtimeKey = runtimeHome ? resolve25(runtimeHome, ".ssh", "rig-agent-key") : "";
   const env = {};
   if (ctx?.workspaceDir) {
     env.PROJECT_RIG_ROOT = projectRoot;
@@ -7041,14 +8348,14 @@ function runtimeGitEnv(projectRoot) {
   if (runtimeRoot) {
     env.RIG_RUNTIME_HOME = runtimeRoot;
   }
-  if (runtimeHome && existsSync21(runtimeHome)) {
+  if (runtimeHome && existsSync22(runtimeHome)) {
     env.HOME = runtimeHome;
     env.OPENSSL_CONF = ensureRuntimeOpenSslConfig(runtimeHome);
   }
-  if (runtimeTmp && existsSync21(runtimeTmp)) {
+  if (runtimeTmp && existsSync22(runtimeTmp)) {
     env.TMPDIR = runtimeTmp;
   }
-  if (runtimeCache && existsSync21(runtimeCache)) {
+  if (runtimeCache && existsSync22(runtimeCache)) {
     env.XDG_CACHE_HOME = runtimeCache;
   }
   const workspaceSecrets = loadDotEnvSecrets(ctx?.workspaceDir || projectRoot, process.env);
@@ -7092,14 +8399,14 @@ function runtimeGitEnv(projectRoot) {
     env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
     applyGitHubCredentialHelperEnv(env);
   }
-  if (runtimeKnownHosts && existsSync21(runtimeKnownHosts)) {
+  if (runtimeKnownHosts && existsSync22(runtimeKnownHosts)) {
     const sshParts = [
       "ssh",
       `-o UserKnownHostsFile="${runtimeKnownHosts}"`,
       "-o StrictHostKeyChecking=yes",
       "-F /dev/null"
     ];
-    if (runtimeKey && existsSync21(runtimeKey)) {
+    if (runtimeKey && existsSync22(runtimeKey)) {
       sshParts.splice(1, 0, `-i "${runtimeKey}"`, "-o IdentitiesOnly=yes");
     }
     env.GIT_SSH_COMMAND = sshParts.join(" ");
@@ -7120,12 +8427,12 @@ function loadPersistedRuntimeSecrets(runtimeRoot) {
   if (!runtimeRoot) {
     return {};
   }
-  const path = resolve24(runtimeRoot, "runtime-secrets.json");
-  if (!existsSync21(path)) {
+  const path = resolve25(runtimeRoot, "runtime-secrets.json");
+  if (!existsSync22(path)) {
     return {};
   }
   try {
-    const parsed = JSON.parse(readFileSync11(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync12(path, "utf-8"));
     const entries = Object.entries(parsed).filter((entry) => typeof entry[1] === "string");
     return Object.fromEntries(entries);
   } catch {
@@ -7133,13 +8440,13 @@ function loadPersistedRuntimeSecrets(runtimeRoot) {
   }
 }
 function ensureRuntimeOpenSslConfig(runtimeHome) {
-  const sslDir = resolve24(runtimeHome, ".ssl");
-  const sslConfig = resolve24(sslDir, "openssl.cnf");
-  if (!existsSync21(sslDir)) {
-    mkdirSync10(sslDir, { recursive: true });
+  const sslDir = resolve25(runtimeHome, ".ssl");
+  const sslConfig = resolve25(sslDir, "openssl.cnf");
+  if (!existsSync22(sslDir)) {
+    mkdirSync11(sslDir, { recursive: true });
   }
-  if (!existsSync21(sslConfig)) {
-    writeFileSync10(sslConfig, `# Rig runtime OpenSSL config placeholder
+  if (!existsSync22(sslConfig)) {
+    writeFileSync11(sslConfig, `# Rig runtime OpenSSL config placeholder
 `);
   }
   return sslConfig;
@@ -7157,11 +8464,11 @@ function resolveRuntimeMetadata(projectRoot) {
   if (contextFile) {
     return {
       ctx,
-      runtimeRoot: dirname11(resolve24(contextFile))
+      runtimeRoot: dirname11(resolve25(contextFile))
     };
   }
   const inferredContextFile = findRuntimeContextFile2(projectRoot);
-  if (existsSync21(inferredContextFile)) {
+  if (existsSync22(inferredContextFile)) {
     try {
       ctx = loadRuntimeContext(inferredContextFile);
     } catch {}
@@ -7173,10 +8480,10 @@ function resolveRuntimeMetadata(projectRoot) {
   return { ctx, runtimeRoot: "" };
 }
 function findRuntimeContextFile2(startPath) {
-  let current = resolve24(startPath);
+  let current = resolve25(startPath);
   while (true) {
-    const candidate = resolve24(current, "runtime-context.json");
-    if (existsSync21(candidate)) {
+    const candidate = resolve25(current, "runtime-context.json");
+    if (existsSync22(candidate)) {
       return candidate;
     }
     const parent = dirname11(current);
@@ -7188,7 +8495,7 @@ function findRuntimeContextFile2(startPath) {
 }
 
 // packages/runtime/src/control-plane/native/profile-ops.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync12, writeFileSync as writeFileSync12 } from "fs";
 var DEFAULTS = {
   model: parseEnvOrDefault(process.env.DEFAULT_AGENT_MODEL, ["claude", "gpt-codex", "pi"], "pi"),
   runtime: parseEnvOrDefault(process.env.DEFAULT_AGENT_RUNTIME, ["claude-code", "codex-app-server", "pi"], "pi"),
@@ -7203,7 +8510,7 @@ function parseEnvOrDefault(value, allowed, fallback) {
   return allowed.includes(value) ? value : fallback;
 }
 async function readProfileFile(path) {
-  if (!existsSync22(path)) {
+  if (!existsSync23(path)) {
     return null;
   }
   try {
@@ -7256,14 +8563,14 @@ async function setProfile(projectRoot, options) {
     plugin = model === "gpt-codex" ? "codex" : model === "pi" ? "pi" : "claude";
   }
   const paths = resolveHarnessPaths(projectRoot);
-  mkdirSync11(paths.stateDir, { recursive: true });
+  mkdirSync12(paths.stateDir, { recursive: true });
   const next = {
     model,
     runtime,
     agent_plugin: plugin,
     updated_at: new Date().toISOString()
   };
-  writeFileSync11(paths.agentProfilePath, `${JSON.stringify(next, null, 2)}
+  writeFileSync12(paths.agentProfilePath, `${JSON.stringify(next, null, 2)}
 `, "utf-8");
   await showProfile(projectRoot, false);
 }
@@ -7299,13 +8606,13 @@ async function setReviewProfile(projectRoot, mode, provider) {
     throw new Error(`Invalid provider: ${resolvedProvider}. Supported: greptile.`);
   }
   const paths = resolveHarnessPaths(projectRoot);
-  mkdirSync11(paths.stateDir, { recursive: true });
+  mkdirSync12(paths.stateDir, { recursive: true });
   const next = {
     mode,
     provider: resolvedProvider,
     updated_at: new Date().toISOString()
   };
-  writeFileSync11(paths.reviewProfilePath, `${JSON.stringify(next, null, 2)}
+  writeFileSync12(paths.reviewProfilePath, `${JSON.stringify(next, null, 2)}
 `, "utf-8");
   await showReviewProfile(projectRoot);
 }
@@ -7343,44 +8650,44 @@ async function loadReviewProfile(path) {
 }
 
 // packages/runtime/src/control-plane/native/repo-ops.ts
-import { existsSync as existsSync26, mkdirSync as mkdirSync15, readFileSync as readFileSync13, readdirSync as readdirSync5, rmSync as rmSync6, writeFileSync as writeFileSync13 } from "fs";
-import { basename as basename8, dirname as dirname13, resolve as resolve28 } from "path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync16, readFileSync as readFileSync14, readdirSync as readdirSync6, rmSync as rmSync7, writeFileSync as writeFileSync14 } from "fs";
+import { basename as basename8, dirname as dirname13, resolve as resolve29 } from "path";
 // packages/runtime/src/control-plane/repos/mirror/bootstrap.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync13, realpathSync as realpathSync2 } from "fs";
-import { resolve as resolve26 } from "path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync14, realpathSync as realpathSync2 } from "fs";
+import { resolve as resolve27 } from "path";
 
 // packages/runtime/src/control-plane/authority-files.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync12, appendFileSync as appendFileSync2, copyFileSync as copyFileSync3, statSync as statSync5, readdirSync as readdirSync4, chmodSync as chmodSync3 } from "fs";
-import { dirname as dirname12, join as join4, relative, resolve as resolve25 } from "path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync13, readFileSync as readFileSync13, writeFileSync as writeFileSync13, appendFileSync as appendFileSync2, copyFileSync as copyFileSync3, statSync as statSync5, readdirSync as readdirSync5, chmodSync as chmodSync3 } from "fs";
+import { dirname as dirname12, join as join4, relative, resolve as resolve26 } from "path";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 function resolveAuthorityProjectStateDir(projectRoot) {
   const explicit = process.env.RIG_STATE_DIR?.trim();
   if (explicit) {
-    return resolve25(explicit);
+    return resolve26(explicit);
   }
-  return resolve25(resolve25(projectRoot), ".rig", "state");
+  return resolve26(resolve26(projectRoot), ".rig", "state");
 }
 function readJsonAtPath(path, fallback) {
-  if (!existsSync23(path)) {
+  if (!existsSync24(path)) {
     return fallback;
   }
   try {
-    return JSON.parse(readFileSync12(path, "utf-8"));
+    return JSON.parse(readFileSync13(path, "utf-8"));
   } catch {
     return fallback;
   }
 }
 function writeJsonAtPath(path, value) {
-  mkdirSync12(dirname12(path), { recursive: true });
-  writeFileSync12(path, `${JSON.stringify(value, null, 2)}
+  mkdirSync13(dirname12(path), { recursive: true });
+  writeFileSync13(path, `${JSON.stringify(value, null, 2)}
 `, "utf8");
   return path;
 }
 function readAuthorityProjectStateJson(projectRoot, relativePath, fallback) {
-  return readJsonAtPath(resolve25(resolveAuthorityProjectStateDir(projectRoot), relativePath), fallback);
+  return readJsonAtPath(resolve26(resolveAuthorityProjectStateDir(projectRoot), relativePath), fallback);
 }
 function writeAuthorityProjectStateJson(projectRoot, relativePath, value) {
-  return writeJsonAtPath(resolve25(resolveAuthorityProjectStateDir(projectRoot), relativePath), value);
+  return writeJsonAtPath(resolve26(resolveAuthorityProjectStateDir(projectRoot), relativePath), value);
 }
 
 // packages/runtime/src/control-plane/repos/mirror/state.ts
@@ -7440,7 +8747,7 @@ function sameExistingPath(left, right) {
   try {
     return realpathSync2(left) === realpathSync2(right);
   } catch {
-    return resolve26(left) === resolve26(right);
+    return resolve27(left) === resolve27(right);
   }
 }
 function repoLooksUsable(repoRoot, projectRoot) {
@@ -7476,7 +8783,7 @@ function resolveMirrorRemoteUrl(layout) {
       }
     }
   }
-  if (existsSync24(resolve26(layout.checkoutRoot, ".git")) && checkoutLooksUsable(layout)) {
+  if (existsSync25(resolve27(layout.checkoutRoot, ".git")) && checkoutLooksUsable(layout)) {
     const checkoutOrigin = runGit(["git", "-C", layout.checkoutRoot, "remote", "get-url", "origin"], layout.projectRoot);
     if (checkoutOrigin.exitCode === 0) {
       const currentOrigin = checkoutOrigin.stdout.trim();
@@ -7489,9 +8796,9 @@ function resolveMirrorRemoteUrl(layout) {
 }
 function ensureManagedRepoMirror(projectRoot, repoId) {
   const layout = resolveManagedRepoLayout(projectRoot, repoId);
-  mkdirSync13(layout.metadataRoot, { recursive: true });
+  mkdirSync14(layout.metadataRoot, { recursive: true });
   const remoteUrl = resolveMirrorRemoteUrl(layout);
-  if (!existsSync24(resolve26(layout.mirrorRoot, "HEAD"))) {
+  if (!existsSync25(resolve27(layout.mirrorRoot, "HEAD"))) {
     ensureGitSuccess(runGit(["git", "init", "--bare", layout.mirrorRoot], layout.projectRoot), ["git", "init", "--bare", layout.mirrorRoot]);
   }
   const getOrigin = runGit(["git", "--git-dir", layout.mirrorRoot, "remote", "get-url", "origin"], layout.projectRoot);
@@ -7511,8 +8818,8 @@ function ensureManagedRepoMirror(projectRoot, repoId) {
   return layout;
 }
 // packages/runtime/src/control-plane/repos/mirror/refresh.ts
-import { existsSync as existsSync25, mkdirSync as mkdirSync14, realpathSync as realpathSync3, rmSync as rmSync5 } from "fs";
-import { resolve as resolve27 } from "path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync15, realpathSync as realpathSync3, rmSync as rmSync6 } from "fs";
+import { resolve as resolve28 } from "path";
 function nowIso3() {
   return new Date().toISOString();
 }
@@ -7539,7 +8846,7 @@ function sameExistingPath2(left, right) {
   try {
     return realpathSync3(left) === realpathSync3(right);
   } catch {
-    return resolve27(left) === resolve27(right);
+    return resolve28(left) === resolve28(right);
   }
 }
 function ensureMirrorHead(layout) {
@@ -7585,12 +8892,12 @@ function checkoutLooksUsable2(layout) {
   return probe.exitCode === 0 && sameExistingPath2(probe.stdout.trim(), layout.checkoutRoot);
 }
 function ensureCheckoutFromMirror(layout) {
-  mkdirSync14(resolve27(layout.checkoutRoot, ".."), { recursive: true });
-  const gitPath = resolve27(layout.checkoutRoot, ".git");
-  if (existsSync25(layout.checkoutRoot) && (!existsSync25(gitPath) || !checkoutLooksUsable2(layout))) {
-    rmSync5(layout.checkoutRoot, { recursive: true, force: true });
+  mkdirSync15(resolve28(layout.checkoutRoot, ".."), { recursive: true });
+  const gitPath = resolve28(layout.checkoutRoot, ".git");
+  if (existsSync26(layout.checkoutRoot) && (!existsSync26(gitPath) || !checkoutLooksUsable2(layout))) {
+    rmSync6(layout.checkoutRoot, { recursive: true, force: true });
   }
-  if (!existsSync25(gitPath)) {
+  if (!existsSync26(gitPath)) {
     ensureGitSuccess2(runGit2(["git", "clone", layout.mirrorRoot, layout.checkoutRoot], layout.projectRoot), ["git", "clone", layout.mirrorRoot, layout.checkoutRoot]);
   }
   const getOrigin = runGit2(["git", "-C", layout.checkoutRoot, "remote", "get-url", "origin"], layout.projectRoot);
@@ -7691,7 +8998,7 @@ function repoDiscover(projectRoot, taskId) {
 }
 function repoBaseline(projectRoot, refresh = false) {
   const paths = resolveRepoDiscoveryPaths(projectRoot);
-  if (!refresh && existsSync26(paths.baseRepoPinsPath)) {
+  if (!refresh && existsSync27(paths.baseRepoPinsPath)) {
     const baseline = readJsonFile(paths.baseRepoPinsPath, { recorded_at: nowIso(), repos: {} });
     return baseline.repos || {};
   }
@@ -7715,8 +9022,8 @@ function ensureMonorepoReady(projectRoot) {
 }
 function persistBaselinePins(projectRoot, repos) {
   const paths = resolveRepoDiscoveryPaths(projectRoot);
-  mkdirSync15(resolve28(paths.baseRepoPinsPath, ".."), { recursive: true });
-  writeFileSync13(paths.baseRepoPinsPath, `${JSON.stringify({ recorded_at: nowIso(), repos }, null, 2)}
+  mkdirSync16(resolve29(paths.baseRepoPinsPath, ".."), { recursive: true });
+  writeFileSync14(paths.baseRepoPinsPath, `${JSON.stringify({ recorded_at: nowIso(), repos }, null, 2)}
 `, "utf-8");
   return repos;
 }
@@ -7795,28 +9102,28 @@ function readRepoDiscoveryTaskConfig(projectRoot) {
 function resolveRepoDiscoveryPaths(projectRoot) {
   const monorepoRoot = resolveMonorepoRepoLayout(projectRoot).checkoutRoot;
   const explicitHostProjectRoot = (process.env.RIG_HOST_PROJECT_ROOT || "").trim();
-  const normalizedProjectRoot = resolve28(projectRoot);
+  const normalizedProjectRoot = resolve29(projectRoot);
   const hostProjectRoot = explicitHostProjectRoot && shouldUseHostProjectStateRoot(normalizedProjectRoot) ? explicitHostProjectRoot : normalizedProjectRoot;
-  const stateDir = resolve28(hostProjectRoot, ".rig", "state");
+  const stateDir = resolve29(hostProjectRoot, ".rig", "state");
   return {
     monorepoRoot,
-    taskRepoCommitsPath: resolve28(stateDir, "task-repo-commits.json"),
-    baseRepoPinsPath: resolve28(stateDir, "base-repo-pins.json")
+    taskRepoCommitsPath: resolve29(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve29(stateDir, "base-repo-pins.json")
   };
 }
 function shouldUseHostProjectStateRoot(projectRoot) {
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  if (runtimeWorkspace && resolve28(runtimeWorkspace) === projectRoot) {
+  if (runtimeWorkspace && resolve29(runtimeWorkspace) === projectRoot) {
     return true;
   }
   return basename8(dirname13(projectRoot)) === ".worktrees";
 }
 function readPinFromArtifact(projectRoot, depTask, repoKey) {
-  const snapshot = resolve28(artifactDirForId(projectRoot, depTask), "git-state.txt");
-  if (!existsSync26(snapshot)) {
+  const snapshot = resolve29(artifactDirForId(projectRoot, depTask), "git-state.txt");
+  if (!existsSync27(snapshot)) {
     return "";
   }
-  const content = readFileSync13(snapshot, "utf-8");
+  const content = readFileSync14(snapshot, "utf-8");
   const chunk = content.split(/\r?\n/);
   let inSection = false;
   for (const line of chunk) {
@@ -7838,12 +9145,12 @@ function repoPath(projectRoot, key) {
   if (managed) {
     return managed.checkoutRoot;
   }
-  return key.startsWith("/") ? key : resolve28(projectRoot, key);
+  return key.startsWith("/") ? key : resolve29(projectRoot, key);
 }
 function applyPins(projectRoot, pins) {
   for (const [key, commit] of Object.entries(pins)) {
     const path = repoPath(projectRoot, key);
-    if (!existsSync26(resolve28(path, ".git"))) {
+    if (!existsSync27(resolve29(path, ".git"))) {
       throw new Error(`Repo for pin not available: ${key} (${path})`);
     }
     let hasCommit = runGitCapture(["git", "-C", path, "cat-file", "-e", `${commit}^{commit}`], projectRoot).exitCode === 0;
@@ -7872,7 +9179,7 @@ function verifyPins(projectRoot, pins) {
   let ok = true;
   for (const [key, expected] of Object.entries(pins)) {
     const path = repoPath(projectRoot, key);
-    if (!existsSync26(resolve28(path, ".git"))) {
+    if (!existsSync27(resolve29(path, ".git"))) {
       console.error(`ERROR: repo missing during pin verification: ${key}`);
       ok = false;
       continue;
@@ -7897,23 +9204,23 @@ function resolveRuntimeGitEnv() {
       GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND
     };
   }
-  const runtimeRoot = process.env.RIG_RUNTIME_HOME?.trim() || (process.env.RIG_RUNTIME_CONTEXT_FILE?.trim() ? resolve28(process.env.RIG_RUNTIME_CONTEXT_FILE, "..") : inferRuntimeRootFromWorkspace(process.cwd()));
-  const runtimeHome = runtimeRoot ? resolve28(runtimeRoot, "home") : process.env.HOME?.trim() || "";
+  const runtimeRoot = process.env.RIG_RUNTIME_HOME?.trim() || (process.env.RIG_RUNTIME_CONTEXT_FILE?.trim() ? resolve29(process.env.RIG_RUNTIME_CONTEXT_FILE, "..") : inferRuntimeRootFromWorkspace(process.cwd()));
+  const runtimeHome = runtimeRoot ? resolve29(runtimeRoot, "home") : process.env.HOME?.trim() || "";
   if (!runtimeHome) {
     return;
   }
-  const knownHostsPath = resolve28(runtimeHome, ".ssh", "known_hosts");
-  if (!existsSync26(knownHostsPath)) {
+  const knownHostsPath = resolve29(runtimeHome, ".ssh", "known_hosts");
+  if (!existsSync27(knownHostsPath)) {
     return { HOME: runtimeHome };
   }
-  const agentSshKey = resolve28(runtimeHome, ".ssh", "rig-agent-key");
+  const agentSshKey = resolve29(runtimeHome, ".ssh", "rig-agent-key");
   const sshParts = [
     "ssh",
     `-o UserKnownHostsFile="${knownHostsPath}"`,
     "-o StrictHostKeyChecking=yes",
     "-F /dev/null"
   ];
-  if (existsSync26(agentSshKey)) {
+  if (existsSync27(agentSshKey)) {
     sshParts.splice(1, 0, `-i "${agentSshKey}"`, "-o IdentitiesOnly=yes");
   }
   return {
@@ -7923,24 +9230,24 @@ function resolveRuntimeGitEnv() {
 }
 function inferRuntimeRootFromWorkspace(cwd) {
   const contextPath = findRuntimeContextFile3(cwd);
-  if (!contextPath || !existsSync26(contextPath)) {
+  if (!contextPath || !existsSync27(contextPath)) {
     return "";
   }
   try {
     loadRuntimeContext(contextPath);
-    return resolve28(contextPath, "..");
+    return resolve29(contextPath, "..");
   } catch {
     return "";
   }
 }
 function findRuntimeContextFile3(startPath) {
-  let current = resolve28(startPath);
+  let current = resolve29(startPath);
   while (true) {
-    const candidate = resolve28(current, "runtime-context.json");
-    if (existsSync26(candidate)) {
+    const candidate = resolve29(current, "runtime-context.json");
+    if (existsSync27(candidate)) {
       return candidate;
     }
-    const parent = resolve28(current, "..");
+    const parent = resolve29(current, "..");
     if (parent === current) {
       return "";
     }
@@ -7949,12 +9256,12 @@ function findRuntimeContextFile3(startPath) {
 }
 
 // packages/runtime/src/control-plane/memory-sync/cli.ts
-import { existsSync as existsSync27 } from "fs";
+import { existsSync as existsSync28 } from "fs";
 import { randomUUID } from "crypto";
 
 // packages/runtime/src/control-plane/memory-sync/db.ts
 import { Database } from "bun:sqlite";
-import { mkdirSync as mkdirSync16 } from "fs";
+import { mkdirSync as mkdirSync17 } from "fs";
 import { dirname as dirname14 } from "path";
 
 // packages/runtime/src/control-plane/memory-sync/types.ts
@@ -8551,7 +9858,7 @@ async function validateEventTargets(executor, event) {
   }
 }
 async function openMemoryDb(dbPath) {
-  mkdirSync16(dirname14(dbPath), { recursive: true });
+  mkdirSync17(dirname14(dbPath), { recursive: true });
   const sqlite = new Database(dbPath, { create: true, strict: true });
   const client = createMemoryDbClient(sqlite);
   const db = {
@@ -8970,7 +10277,7 @@ function formatMemoryQueryResults(results) {
 }
 
 // packages/runtime/src/control-plane/memory-sync/read.ts
-import { mkdtempSync, rmSync as rmSync7, writeFileSync as writeFileSync14 } from "fs";
+import { mkdtempSync, rmSync as rmSync8, writeFileSync as writeFileSync15 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
 import { join as join5 } from "path";
 var CANONICAL_MEMORY_DB_PATH = "rig/memory/project-memory.db";
@@ -8979,7 +10286,7 @@ var DEFAULT_READ_DEPS2 = {
   readBlobBytesAtRef: nativeReadBlobBytesAtRef,
   openMemoryDb,
   makeTempDir: () => mkdtempSync(join5(tmpdir5(), "memory-sync-read-")),
-  removeDir: (path) => rmSync7(path, { recursive: true, force: true })
+  removeDir: (path) => rmSync8(path, { recursive: true, force: true })
 };
 function isMissingCanonicalMemoryBlobError(error) {
   const message = error instanceof Error ? error.message : String(error);
@@ -8999,7 +10306,7 @@ async function readCanonicalMemoryDb(projectRoot, deps = {}) {
   try {
     try {
       const bytes = readDeps.readBlobBytesAtRef(repoPath2, baseOid, CANONICAL_MEMORY_DB_PATH);
-      writeFileSync14(dbPath, bytes);
+      writeFileSync15(dbPath, bytes);
     } catch (error) {
       if (!isMissingCanonicalMemoryBlobError(error)) {
         throw error;
@@ -9157,7 +10464,7 @@ function requireRuntimeMemoryContext(runtimeContext) {
 }
 async function ensureRuntimeMemoryUsable(runtimeContext) {
   const memory = requireRuntimeMemoryContext(runtimeContext);
-  if (!existsSync27(memory.hydratedPath)) {
+  if (!existsSync28(memory.hydratedPath)) {
     throw new Error(`Shared memory database is missing: ${memory.hydratedPath}`);
   }
   const db = await openMemoryDb(memory.hydratedPath);
@@ -9420,7 +10727,7 @@ async function executeMemoryCommand(options, deps = {}) {
 }
 
 // packages/runtime/src/control-plane/native/harness-cli.ts
-async function executeHarnessCommand(projectRoot, plugins, args, eventBus, pluginHostCtx) {
+async function executeHarnessCommand(projectRoot, args, eventBus, pluginHostCtx) {
   const [command = "help", ...rest] = args;
   switch (command) {
     case "memory": {
@@ -9458,8 +10765,8 @@ async function executeHarnessCommand(projectRoot, plugins, args, eventBus, plugi
     }
     case "completion-verification":
     case "completition-verification": {
-      const hookPath = resolve29(projectRoot, ".rig/bin/hooks/completion-verification");
-      if (!existsSync28(hookPath)) {
+      const hookPath = resolve30(projectRoot, ".rig/bin/hooks/completion-verification");
+      if (!existsSync29(hookPath)) {
         throw new Error(`completion-verification hook binary not found: ${hookPath}`);
       }
       const proc = Bun.spawn([hookPath], {
@@ -9477,7 +10784,7 @@ async function executeHarnessCommand(projectRoot, plugins, args, eventBus, plugi
     }
     case "verify": {
       const task = rest[0];
-      const ok = await taskVerify(projectRoot, plugins, task);
+      const ok = await taskVerify(projectRoot, task);
       if (!ok) {
         throw new Error("Verification rejected.");
       }