@h-rig/runtime 0.0.6-alpha.31 → 0.0.6-alpha.33

package/dist/src/control-plane/hooks/submodule-branch.js

@@ -457,121 +457,47 @@ function readBuildConfig() {
   }
 }
 
-// packages/runtime/src/control-plane/runtime/tooling/gateway.ts
-import { existsSync as existsSync7, rmSync as rmSync3, symlinkSync as symlinkSync3 } from "fs";
-import { resolve as resolve7 } from "path";
-
-// packages/runtime/src/control-plane/runtime/tooling/shell.ts
-import { chmodSync, copyFileSync, existsSync as existsSync4, mkdirSync as mkdirSync2 } from "fs";
+// packages/runtime/src/control-plane/native/git-native.ts
+import { chmodSync, copyFileSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
 import { tmpdir } from "os";
-import { basename as basename2, dirname as dirname3, resolve as resolve4 } from "path";
-var sharedNativeShellOutputDir = resolve4(tmpdir(), "rig-native");
-var sharedNativeShellOutputPath = resolve4(sharedNativeShellOutputDir, `rig-shell-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
-function runtimeRigShellFileName() {
-  return `rig-shell${process.platform === "win32" ? ".exe" : ""}`;
-}
-async function ensureRigShellBinaryPath(outputPath = sharedNativeShellOutputPath) {
-  const sourcePath = resolveRigShellSourcePath();
-  if (!sourcePath) {
-    const bundledBinary = resolveBundledRigShellBinaryPath();
-    if (bundledBinary) {
-      return bundledBinary;
-    }
-    throw new Error("rig-shell.zig source file not found.");
-  }
-  const zigBinary = Bun.which("zig");
-  if (!zigBinary) {
-    throw new Error("zig is required to build the native Rig shell.");
-  }
-  mkdirSync2(dirname3(outputPath), { recursive: true });
-  const sourceDigest = await sha256File(sourcePath);
-  const buildKey = JSON.stringify({
-    version: 1,
-    zigBinary,
-    platform: process.platform,
-    arch: process.arch,
-    sourcePath,
-    sourceDigest
-  });
-  const manifestPath = nativeBuildManifestPath(outputPath);
-  const needsBuild = !existsSync4(outputPath) || !await hasMatchingNativeBuildManifest(manifestPath, buildKey);
-  if (!needsBuild) {
-    return outputPath;
-  }
-  const build = Bun.spawn([
-    zigBinary,
-    "build-exe",
-    sourcePath,
-    "-O",
-    "ReleaseFast",
-    `-femit-bin=${outputPath}`
-  ], {
-    cwd: dirname3(sourcePath),
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    build.exited,
-    new Response(build.stdout).text(),
-    new Response(build.stderr).text()
-  ]);
-  if (exitCode !== 0 || !existsSync4(outputPath)) {
-    const details = [stderr.trim(), stdout.trim()].filter(Boolean).join(`
-`);
-    throw new Error(`Failed to build native Rig shell: ${details || `zig exited with code ${exitCode}`}`);
-  }
-  await Bun.write(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
-`);
-  return outputPath;
-}
-async function materializeRigShellBinary(targetDir) {
-  const sourcePath = await ensureRigShellBinaryPath();
-  const targetPath = resolve4(targetDir, runtimeRigShellFileName());
-  mkdirSync2(targetDir, { recursive: true });
-  const sourceDigest = await sha256File(sourcePath);
-  const buildKey = JSON.stringify({
-    version: 1,
-    sourcePath,
-    sourceDigest
-  });
-  const needsCopy = !existsSync4(targetPath) || !await hasMatchingNativeBuildManifest(nativeBuildManifestPath(targetPath), buildKey);
-  if (needsCopy) {
-    copyFileSync(sourcePath, targetPath);
-    chmodSync(targetPath, 493);
-    await Bun.write(nativeBuildManifestPath(targetPath), `${JSON.stringify({ version: 1, buildKey }, null, 2)}
-`);
-  }
-  return targetPath;
+import { dirname as dirname3, isAbsolute, resolve as resolve4 } from "path";
+import { createHash } from "crypto";
+var sharedGitNativeOutputDir = resolve4(tmpdir(), "rig-native");
+var sharedGitNativeOutputPath = resolve4(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+var trackerCommandUsageProbe = "usage: rig-git fetch-ref <repo-path> <remote> <branch>";
+function temporaryGitBinaryOutputPath(outputPath) {
+  const suffix = process.platform === "win32" ? ".exe" : "";
+  return resolve4(dirname3(outputPath), `.rig-git-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}${suffix}`);
 }
-function resolveRigShellSourcePath() {
-  for (const candidate of rigShellSourceCandidates()) {
-    if (candidate && existsSync4(candidate)) {
-      return candidate;
+function publishGitBinary(tempOutputPath, outputPath) {
+  try {
+    renameSync(tempOutputPath, outputPath);
+  } catch (error) {
+    if (process.platform === "win32" && existsSync4(outputPath)) {
+      rmSync(outputPath, { force: true });
+      renameSync(tempOutputPath, outputPath);
+      return;
     }
+    throw error;
   }
-  return null;
 }
-function resolveBundledRigShellBinaryPath() {
-  for (const candidate of rigShellBinaryCandidates()) {
-    if (candidate && existsSync4(candidate)) {
-      return candidate;
-    }
-  }
-  return null;
+function runtimeRigGitFileName() {
+  return `rig-git${process.platform === "win32" ? ".exe" : ""}`;
 }
-function rigShellSourceCandidates() {
+function rigGitSourceCandidates() {
   const execDir = process.execPath?.trim() ? dirname3(process.execPath.trim()) : "";
   const cwd = process.cwd()?.trim() || "";
   const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
   const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
+  const moduleRelativeSource = resolve4(import.meta.dir, "../../../native/rig-git.zig");
   return [...new Set([
-    process.env.RIG_NATIVE_SHELL_SOURCE?.trim() || "",
-    cwd ? resolve4(cwd, "packages/runtime/native/rig-shell.zig") : "",
-    projectRoot ? resolve4(projectRoot, "packages/runtime/native/rig-shell.zig") : "",
-    hostProjectRoot ? resolve4(hostProjectRoot, "packages/runtime/native/rig-shell.zig") : "",
-    execDir ? resolve4(execDir, "..", "..", "packages/runtime/native/rig-shell.zig") : "",
-    execDir ? resolve4(execDir, "..", "native", "rig-shell.zig") : "",
-    resolve4(import.meta.dir, "../../../../native/rig-shell.zig")
+    process.env.RIG_NATIVE_GIT_SOURCE?.trim() || "",
+    moduleRelativeSource,
+    projectRoot ? resolve4(projectRoot, "packages/runtime/native/rig-git.zig") : "",
+    hostProjectRoot ? resolve4(hostProjectRoot, "packages/runtime/native/rig-git.zig") : "",
+    cwd ? resolve4(cwd, "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve4(execDir, "..", "..", "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve4(execDir, "..", "native", "rig-git.zig") : ""
   ].filter(Boolean))];
 }
 function nativePackageBinaryCandidates(fromDir, fileName) {
@@ -586,55 +512,57 @@ function nativePackageBinaryCandidates(fromDir, fileName) {
   }
   return candidates;
 }
-function rigShellBinaryCandidates() {
+function rigGitBinaryCandidates() {
   const execDir = process.execPath?.trim() ? dirname3(process.execPath.trim()) : "";
-  const fileName = runtimeRigShellFileName();
+  const fileName = runtimeRigGitFileName();
+  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
   return [...new Set([
-    process.env.RIG_NATIVE_SHELL_BIN?.trim() || "",
+    explicit,
     ...nativePackageBinaryCandidates(import.meta.dir, fileName),
     execDir ? resolve4(execDir, fileName) : "",
     execDir ? resolve4(execDir, "..", fileName) : "",
-    execDir ? resolve4(execDir, "..", "bin", fileName) : ""
+    execDir ? resolve4(execDir, "..", "bin", fileName) : "",
+    sharedGitNativeOutputPath
   ].filter(Boolean))];
 }
-function runtimeToolGatewayNames() {
-  return [
-    "bash",
-    "sh",
-    "zsh",
-    "git",
-    "bun",
-    "node",
-    "python3",
-    "rg",
-    "grep",
-    "sed",
-    "cat",
-    "ls",
-    "find",
-    "tsc",
-    "gh",
-    "mkdir",
-    "rm",
-    "mv",
-    "cp",
-    "touch",
-    "pwd",
-    "head",
-    "tail",
-    "wc",
-    "sort",
-    "uniq",
-    "awk",
-    "xargs",
-    "dirname",
-    "basename",
-    "realpath",
-    "env",
-    "jq",
-    "tee",
-    "which"
-  ];
+function resolveGitSourcePath() {
+  for (const candidate of rigGitSourceCandidates()) {
+    if (candidate && existsSync4(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function resolveGitBinaryPath() {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return null;
+  }
+  for (const candidate of rigGitBinaryCandidates()) {
+    if (candidate && existsSync4(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function preferredGitBinaryOutputPath() {
+  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+  return explicit || sharedGitNativeOutputPath;
+}
+function binarySupportsTrackerCommandsSync(binaryPath) {
+  try {
+    const probe = Bun.spawnSync([binaryPath, "fetch-ref", "."], {
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const stdout = probe.stdout.toString().trim();
+    const stderr = probe.stderr.toString().trim();
+    if (stdout.includes('"error":"unknown command"')) {
+      return false;
+    }
+    return probe.exitCode === 2 && stderr.includes(trackerCommandUsageProbe);
+  } catch {
+    return false;
+  }
 }
 function nativeBuildManifestPath(outputPath) {
   return `${outputPath}.build-manifest.json`;
@@ -650,71 +578,43 @@ async function hasMatchingNativeBuildManifest(manifestPath, buildKey) {
     return false;
   }
 }
+function hasMatchingNativeBuildManifestSync(manifestPath, buildKey) {
+  if (!existsSync4(manifestPath)) {
+    return false;
+  }
+  try {
+    const manifest = JSON.parse(readFileSync3(manifestPath, "utf8"));
+    return manifest.version === 1 && manifest.buildKey === buildKey;
+  } catch {
+    return false;
+  }
+}
 async function sha256File(path) {
   const hasher = new Bun.CryptoHasher("sha256");
   hasher.update(await Bun.file(path).arrayBuffer());
   return hasher.digest("hex");
 }
-
-// packages/runtime/src/control-plane/runtime/tooling/browser-tools.ts
-import { existsSync as existsSync5, rmSync, symlinkSync } from "fs";
-import { resolve as resolve5 } from "path";
-function runtimeBrowserToolBinaryName() {
-  return `rig-browser-tool${process.platform === "win32" ? ".exe" : ""}`;
-}
-function runtimeBrowserToolNames() {
-  return [
-    "rig-browser-launch",
-    "rig-browser-check",
-    "rig-browser-attach-info",
-    "rig-browser-e2e",
-    "rig-browser-reset-profile"
-  ];
+function sha256FileSync(path) {
+  return createHash("sha256").update(readFileSync3(path)).digest("hex");
 }
-async function materializeRuntimeBrowserTools(targetDir) {
-  const binaryPath = resolve5(targetDir, runtimeBrowserToolBinaryName());
-  for (const tool of runtimeBrowserToolNames()) {
-    const toolPath = resolve5(targetDir, tool);
-    if (existsSync5(toolPath)) {
-      rmSync(toolPath, { force: true, recursive: true });
-    }
-    symlinkSync(binaryPath, toolPath);
+async function ensureRigGitBinaryPath(outputPath = sharedGitNativeOutputPath) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    throw new Error("Zig native git is disabled via RIG_DISABLE_ZIG_NATIVE=1");
   }
-  return binaryPath;
-}
-// packages/runtime/src/control-plane/runtime/tooling/file-tools.ts
-import { chmodSync as chmodSync2, copyFileSync as copyFileSync2, existsSync as existsSync6, mkdirSync as mkdirSync3, rmSync as rmSync2, symlinkSync as symlinkSync2 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { basename as basename3, dirname as dirname4, resolve as resolve6 } from "path";
-var sharedNativeToolsOutputDir = resolve6(tmpdir2(), "rig-native");
-var sharedNativeToolsOutputPath = resolve6(sharedNativeToolsOutputDir, `rig-tools-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
-function runtimeRigToolsFileName() {
-  return `rig-tools${process.platform === "win32" ? ".exe" : ""}`;
-}
-function runtimeFileToolNames() {
-  return [
-    "rig-read",
-    "rig-write",
-    "rig-edit",
-    "rig-glob",
-    "rig-grep"
-  ];
-}
-async function ensureRigToolsBinaryPath(outputPath = sharedNativeToolsOutputPath) {
-  const sourcePath = resolveRigToolsSourcePath();
+  const sourcePath = resolveGitSourcePath();
   if (!sourcePath) {
-    const bundledBinary = resolveBundledRigToolsBinaryPath();
-    if (bundledBinary) {
-      return bundledBinary;
+    const binaryPath = resolveGitBinaryPath();
+    if (binaryPath) {
+      return binaryPath;
     }
-    throw new Error("rig-tools.zig source file not found.");
+    throw new Error("rig-git.zig source file not found.");
   }
   const zigBinary = Bun.which("zig");
   if (!zigBinary) {
-    throw new Error("zig is required to build native Rig file tools.");
+    throw new Error("zig is required to build native Rig git tools.");
   }
-  mkdirSync3(dirname4(outputPath), { recursive: true });
-  const sourceDigest = await sha256File2(sourcePath);
+  mkdirSync2(dirname3(outputPath), { recursive: true });
+  const sourceDigest = await sha256File(sourcePath);
   const buildKey = JSON.stringify({
     version: 1,
     zigBinary,
@@ -723,20 +623,22 @@ async function ensureRigToolsBinaryPath(outputPath = sharedNativeToolsOutputPath
     sourcePath,
     sourceDigest
   });
-  const manifestPath = nativeBuildManifestPath2(outputPath);
-  const needsBuild = !existsSync6(outputPath) || !await hasMatchingNativeBuildManifest2(manifestPath, buildKey);
+  const manifestPath = nativeBuildManifestPath(outputPath);
+  const needsBuild = !existsSync4(outputPath) || !await hasMatchingNativeBuildManifest(manifestPath, buildKey) || !binarySupportsTrackerCommandsSync(outputPath);
   if (!needsBuild) {
+    chmodSync(outputPath, 493);
     return outputPath;
   }
+  const tempOutputPath = temporaryGitBinaryOutputPath(outputPath);
   const build = Bun.spawn([
     zigBinary,
     "build-exe",
     sourcePath,
     "-O",
     "ReleaseFast",
-    `-femit-bin=${outputPath}`
+    `-femit-bin=${tempOutputPath}`
   ], {
-    cwd: dirname4(sourcePath),
+    cwd: dirname3(sourcePath),
     stdout: "pipe",
     stderr: "pipe"
   });
@@ -745,1609 +647,1707 @@ async function ensureRigToolsBinaryPath(outputPath = sharedNativeToolsOutputPath
     new Response(build.stdout).text(),
     new Response(build.stderr).text()
   ]);
-  if (exitCode !== 0 || !existsSync6(outputPath)) {
+  if (exitCode !== 0 || !existsSync4(tempOutputPath)) {
     const details = [stderr.trim(), stdout.trim()].filter(Boolean).join(`
 `);
-    throw new Error(`Failed to build native Rig file tools: ${details || `zig exited with code ${exitCode}`}`);
+    throw new Error(`Failed to build native Rig git tools: ${details || `zig exited with code ${exitCode}`}`);
+  }
+  chmodSync(tempOutputPath, 493);
+  if (existsSync4(outputPath) && await hasMatchingNativeBuildManifest(manifestPath, buildKey)) {
+    rmSync(tempOutputPath, { force: true });
+    chmodSync(outputPath, 493);
+    return outputPath;
+  }
+  publishGitBinary(tempOutputPath, outputPath);
+  if (!binarySupportsTrackerCommandsSync(outputPath)) {
+    rmSync(outputPath, { force: true });
+    throw new Error("Failed to build native Rig git tools: tracker command probe failed");
   }
   await Bun.write(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
 `);
   return outputPath;
 }
-async function materializeRuntimeFileTools(targetDir) {
-  const sourcePath = await ensureRigToolsBinaryPath();
-  const targetPath = resolve6(targetDir, runtimeRigToolsFileName());
-  mkdirSync3(targetDir, { recursive: true });
-  const sourceDigest = await sha256File2(sourcePath);
+function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath()) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    throw new Error("Zig native git is disabled via RIG_DISABLE_ZIG_NATIVE=1");
+  }
+  const sourcePath = resolveGitSourcePath();
+  if (!sourcePath) {
+    const binaryPath = resolveGitBinaryPath();
+    if (binaryPath) {
+      return binaryPath;
+    }
+    throw new Error("rig-git.zig source file not found.");
+  }
+  const zigBinary = Bun.which("zig");
+  if (!zigBinary) {
+    throw new Error("zig is required to build native Rig git tools.");
+  }
+  mkdirSync2(dirname3(outputPath), { recursive: true });
+  const sourceDigest = sha256FileSync(sourcePath);
   const buildKey = JSON.stringify({
     version: 1,
+    zigBinary,
+    platform: process.platform,
+    arch: process.arch,
     sourcePath,
     sourceDigest
   });
-  const needsCopy = !existsSync6(targetPath) || !await hasMatchingNativeBuildManifest2(nativeBuildManifestPath2(targetPath), buildKey);
-  if (needsCopy) {
-    copyFileSync2(sourcePath, targetPath);
-    chmodSync2(targetPath, 493);
-    await Bun.write(nativeBuildManifestPath2(targetPath), `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+  const manifestPath = nativeBuildManifestPath(outputPath);
+  const needsBuild = !existsSync4(outputPath) || !hasMatchingNativeBuildManifestSync(manifestPath, buildKey) || !binarySupportsTrackerCommandsSync(outputPath);
+  if (!needsBuild) {
+    chmodSync(outputPath, 493);
+    return outputPath;
+  }
+  const tempOutputPath = temporaryGitBinaryOutputPath(outputPath);
+  const build = Bun.spawnSync([
+    zigBinary,
+    "build-exe",
+    sourcePath,
+    "-O",
+    "ReleaseFast",
+    `-femit-bin=${tempOutputPath}`
+  ], {
+    cwd: dirname3(sourcePath),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  if (build.exitCode !== 0 || !existsSync4(tempOutputPath)) {
+    const stderr = build.stderr.toString().trim();
+    const stdout = build.stdout.toString().trim();
+    const details = [stderr, stdout].filter(Boolean).join(`
 `);
+    throw new Error(`Failed to build native Rig git tools: ${details || `zig exited with code ${build.exitCode}`}`);
   }
-  for (const tool of runtimeFileToolNames()) {
-    const toolPath = resolve6(targetDir, tool);
-    if (existsSync6(toolPath)) {
-      rmSync2(toolPath, { force: true, recursive: true });
-    }
-    symlinkSync2(targetPath, toolPath);
+  chmodSync(tempOutputPath, 493);
+  if (existsSync4(outputPath) && hasMatchingNativeBuildManifestSync(manifestPath, buildKey)) {
+    rmSync(tempOutputPath, { force: true });
+    chmodSync(outputPath, 493);
+    return outputPath;
+  }
+  publishGitBinary(tempOutputPath, outputPath);
+  if (!binarySupportsTrackerCommandsSync(outputPath)) {
+    rmSync(outputPath, { force: true });
+    throw new Error("Failed to build native Rig git tools: tracker command probe failed");
+  }
+  writeFileSync2(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`, "utf8");
+  return outputPath;
+}
+async function materializeRigGitBinary(targetDir) {
+  const sourcePath = await ensureRigGitBinaryPath();
+  const targetPath = resolve4(targetDir, runtimeRigGitFileName());
+  mkdirSync2(targetDir, { recursive: true });
+  const sourceDigest = await sha256File(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    sourcePath,
+    sourceDigest
+  });
+  const needsCopy = !existsSync4(targetPath) || !await hasMatchingNativeBuildManifest(nativeBuildManifestPath(targetPath), buildKey);
+  if (needsCopy) {
+    copyFileSync(sourcePath, targetPath);
+    chmodSync(targetPath, 493);
+    await Bun.write(nativeBuildManifestPath(targetPath), `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
   }
   return targetPath;
 }
-function resolveRigToolsSourcePath() {
-  for (const candidate of rigToolsSourceCandidates()) {
-    if (candidate && existsSync6(candidate)) {
-      return candidate;
+function runGitNative(command, args) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return { ok: false, error: "rig-git native disabled" };
+  }
+  const trackerCommand = command === "fetch-ref" || command === "read-blob-at-ref" || command === "write-tree-commit" || command === "push-ref-with-lease";
+  let binaryPath = null;
+  if (trackerCommand) {
+    try {
+      binaryPath = ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message.includes("rig-git.zig source file not found")) {
+        return { ok: false, error: "rig-git binary not found" };
+      }
+      return { ok: false, error: message };
+    }
+  } else {
+    const explicitBinaryPath = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+    binaryPath = explicitBinaryPath && existsSync4(explicitBinaryPath) ? explicitBinaryPath : !explicitBinaryPath ? resolveGitBinaryPath() : null;
+    if (!binaryPath) {
+      try {
+        binaryPath = ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (message.includes("rig-git.zig source file not found")) {
+          return { ok: false, error: "rig-git binary not found" };
+        }
+        return { ok: false, error: message };
+      }
     }
   }
-  return null;
-}
-function resolveBundledRigToolsBinaryPath() {
-  for (const candidate of rigToolsBinaryCandidates()) {
-    if (candidate && existsSync6(candidate)) {
-      return candidate;
+  try {
+    const proc = Bun.spawnSync([binaryPath, command, ...args], {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: process.env
+    });
+    if (proc.exitCode !== 0) {
+      const stdoutText = proc.stdout.toString().trim();
+      if (stdoutText) {
+        try {
+          const parsed = JSON.parse(stdoutText);
+          if (!parsed.ok) {
+            return parsed;
+          }
+        } catch {}
+      }
+      const errText = proc.stderr.toString().trim() || `exit code ${proc.exitCode}`;
+      return { ok: false, error: errText };
     }
+    const output = proc.stdout.toString().trim();
+    return JSON.parse(output);
+  } catch (err) {
+    return { ok: false, error: String(err) };
   }
-  return null;
 }
-function rigToolsSourceCandidates() {
-  const execDir = process.execPath?.trim() ? dirname4(process.execPath.trim()) : "";
-  const cwd = process.cwd()?.trim() || "";
-  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
-  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
-  return [...new Set([
-    process.env.RIG_NATIVE_TOOLS_SOURCE?.trim() || "",
-    cwd ? resolve6(cwd, "packages/runtime/native/rig-tools.zig") : "",
-    projectRoot ? resolve6(projectRoot, "packages/runtime/native/rig-tools.zig") : "",
-    hostProjectRoot ? resolve6(hostProjectRoot, "packages/runtime/native/rig-tools.zig") : "",
-    execDir ? resolve6(execDir, "..", "..", "packages/runtime/native/rig-tools.zig") : "",
-    execDir ? resolve6(execDir, "..", "native", "rig-tools.zig") : "",
-    resolve6(import.meta.dir, "../../../../native/rig-tools.zig")
-  ].filter(Boolean))];
+function requireGitNative(command, args) {
+  const result = runGitNative(command, args);
+  if (!result.ok) {
+    throw new Error(`rig-git ${command} failed: ${result.error}`);
+  }
+  return result;
 }
-function nativePackageBinaryCandidates2(fromDir, fileName) {
-  const candidates = [];
-  let cursor = resolve6(fromDir);
-  for (let index = 0;index < 8; index += 1) {
-    candidates.push(resolve6(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve6(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve6(cursor, "native", fileName), resolve6(cursor, "native", "bin", fileName));
-    const parent = dirname4(cursor);
-    if (parent === cursor)
-      break;
-    cursor = parent;
+function requireGitNativeString(command, args) {
+  const result = requireGitNative(command, args);
+  if ("value" in result && typeof result.value === "string") {
+    return result.value;
   }
-  return candidates;
+  throw new Error(`rig-git ${command} returned an unexpected result payload`);
 }
-function rigToolsBinaryCandidates() {
-  const execDir = process.execPath?.trim() ? dirname4(process.execPath.trim()) : "";
-  const fileName = runtimeRigToolsFileName();
-  return [...new Set([
-    process.env.RIG_NATIVE_TOOLS_BIN?.trim() || "",
-    ...nativePackageBinaryCandidates2(import.meta.dir, fileName),
-    execDir ? resolve6(execDir, fileName) : "",
-    execDir ? resolve6(execDir, "..", fileName) : "",
-    execDir ? resolve6(execDir, "..", "bin", fileName) : ""
-  ].filter(Boolean))];
+function nativeBranchName(repoPath) {
+  const result = runGitNative("branch-name", [repoPath]);
+  if (!result.ok)
+    return null;
+  if ("value" in result && typeof result.value === "string")
+    return result.value;
+  return null;
 }
-function nativeBuildManifestPath2(outputPath) {
-  return `${outputPath}.build-manifest.json`;
+function nativeFetchRef(repoPath, remote, branch) {
+  return requireGitNativeString("fetch-ref", [repoPath, remote, branch]);
 }
-async function hasMatchingNativeBuildManifest2(manifestPath, buildKey) {
-  if (!existsSync6(manifestPath)) {
-    return false;
-  }
+function nativeReadBlobAtRef(repoPath, ref, path) {
+  const requestDir = resolve4(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
+  mkdirSync2(requestDir, { recursive: true });
+  const outputPath = resolve4(requestDir, "blob.txt");
   try {
-    const manifest = await Bun.file(manifestPath).json();
-    return manifest.version === 1 && manifest.buildKey === buildKey;
-  } catch {
-    return false;
+    requireGitNative("read-blob-at-ref", [repoPath, ref, path, outputPath]);
+    return readFileSync3(outputPath, "utf8");
+  } finally {
+    rmSync(requestDir, { recursive: true, force: true });
   }
 }
-async function sha256File2(path) {
-  const hasher = new Bun.CryptoHasher("sha256");
-  hasher.update(await Bun.file(path).arrayBuffer());
-  return hasher.digest("hex");
+function nativeReadBlobBytesAtRef(repoPath, ref, path) {
+  const requestDir = resolve4(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
+  mkdirSync2(requestDir, { recursive: true });
+  const outputPath = resolve4(requestDir, "blob.bin");
+  try {
+    requireGitNative("read-blob-at-ref", [repoPath, ref, path, outputPath]);
+    return readFileSync3(outputPath);
+  } finally {
+    rmSync(requestDir, { recursive: true, force: true });
+  }
 }
 
 // packages/runtime/src/control-plane/runtime/tooling/gateway.ts
-function runtimeGatewayToolNames() {
-  return runtimeToolGatewayNames();
+import { existsSync as existsSync8, rmSync as rmSync4, symlinkSync as symlinkSync3 } from "fs";
+import { resolve as resolve8 } from "path";
+
+// packages/runtime/src/control-plane/runtime/tooling/shell.ts
+import { chmodSync as chmodSync2, copyFileSync as copyFileSync2, existsSync as existsSync5, mkdirSync as mkdirSync3 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { basename as basename2, dirname as dirname4, resolve as resolve5 } from "path";
+var sharedNativeShellOutputDir = resolve5(tmpdir2(), "rig-native");
+var sharedNativeShellOutputPath = resolve5(sharedNativeShellOutputDir, `rig-shell-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+function runtimeRigShellFileName() {
+  return `rig-shell${process.platform === "win32" ? ".exe" : ""}`;
 }
-async function materializeRuntimeToolGateway(binDir) {
-  const shellPath = await materializeRigShellBinary(binDir);
-  for (const tool of runtimeGatewayToolNames()) {
-    const toolPath = resolve7(binDir, tool);
-    if (existsSync7(toolPath)) {
-      rmSync3(toolPath, { force: true, recursive: true });
+async function ensureRigShellBinaryPath(outputPath = sharedNativeShellOutputPath) {
+  const sourcePath = resolveRigShellSourcePath();
+  if (!sourcePath) {
+    const bundledBinary = resolveBundledRigShellBinaryPath();
+    if (bundledBinary) {
+      return bundledBinary;
     }
-    symlinkSync3(shellPath, toolPath);
+    throw new Error("rig-shell.zig source file not found.");
   }
-  await materializeRuntimeBrowserTools(binDir);
-  return resolve7(binDir, runtimeRigShellFileName());
-}
-// packages/runtime/src/control-plane/browser-contract.ts
-import { resolve as resolve8 } from "path";
-var DEFAULT_BROWSER_ATTACH_URL = "http://127.0.0.1:9333";
-var DEFAULT_BROWSER_MODE = "persistent";
-var RUNTIME_BROWSER_HELPERS = {
-  launch: "rig-browser-launch",
-  check: "rig-browser-check",
-  attachInfo: "rig-browser-attach-info",
-  e2e: "rig-browser-e2e",
-  resetProfile: "rig-browser-reset-profile"
-};
-var BASE_REMOTE_DEBUGGING_PORT = 9222;
-var REMOTE_DEBUGGING_PORT_SPREAD = 4000;
-function hashString(input) {
-  let hash = 0;
-  for (let index = 0;index < input.length; index += 1) {
-    hash = (hash << 5) - hash + input.charCodeAt(index) | 0;
-  }
-  return Math.abs(hash);
-}
-function derivePortFromProfile(profileName) {
-  return BASE_REMOTE_DEBUGGING_PORT + hashString(profileName) % REMOTE_DEBUGGING_PORT_SPREAD;
-}
-function parseAttachUrl(attachUrl) {
-  try {
-    return new URL((attachUrl || DEFAULT_BROWSER_ATTACH_URL).trim() || DEFAULT_BROWSER_ATTACH_URL);
-  } catch {
-    return new URL(DEFAULT_BROWSER_ATTACH_URL);
-  }
-}
-function sanitizeRuntimeSuffix(runtimeId) {
-  return runtimeId.replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 16) || "runtime";
-}
-function resolveBrowserStateDir(projectRoot, configuredStateDir) {
-  const trimmed = configuredStateDir?.trim() || ".tmp/rig-browser";
-  if (trimmed.startsWith("/")) {
-    return resolve8(trimmed);
-  }
-  return resolve8(projectRoot || process.cwd(), trimmed);
-}
-function resolveTaskBrowserContext(browser, options = {}) {
-  if (!browser?.required) {
-    return;
-  }
-  const defaultProfile = browser.profile?.trim() || "default";
-  const mode = browser.mode?.trim() || DEFAULT_BROWSER_MODE;
-  const defaultAttach = parseAttachUrl(browser.attach_url);
-  const shouldDeriveRuntimeProfile = Boolean(options.runtimeId?.trim()) && mode !== "shared";
-  const effectiveProfile = shouldDeriveRuntimeProfile ? `${defaultProfile}-${sanitizeRuntimeSuffix(options.runtimeId.trim())}` : defaultProfile;
-  const effectivePort = shouldDeriveRuntimeProfile ? derivePortFromProfile(effectiveProfile) : Number(defaultAttach.port || "80");
-  const effectiveAttach = new URL(defaultAttach.toString());
-  effectiveAttach.port = String(effectivePort);
-  return {
-    required: true,
-    preset: browser.preset?.trim() || "default",
-    mode,
-    stateDir: resolveBrowserStateDir(options.hostProjectRoot, browser.state_dir),
-    defaultProfile,
-    effectiveProfile,
-    defaultAttachUrl: defaultAttach.toString(),
-    effectiveAttachUrl: effectiveAttach.toString(),
-    devCommand: browser.dev_command?.trim() || undefined,
-    launchCommand: browser.launch_command?.trim() || undefined,
-    checkCommand: browser.check_command?.trim() || undefined,
-    e2eCommand: browser.e2e_command?.trim() || undefined,
-    launchHelper: RUNTIME_BROWSER_HELPERS.launch,
-    checkHelper: RUNTIME_BROWSER_HELPERS.check,
-    attachInfoHelper: RUNTIME_BROWSER_HELPERS.attachInfo,
-    e2eHelper: RUNTIME_BROWSER_HELPERS.e2e,
-    resetProfileHelper: RUNTIME_BROWSER_HELPERS.resetProfile
-  };
-}
-function buildBrowserGuidanceLines(browser) {
-  const lines = [
-    "This task requires Rig Browser.",
-    `Launch the browser: \`${browser.launchHelper}\`${browser.devCommand ? " or `rig-browser-launch --dev`" : ""}.`,
-    `Check the browser contract: \`${browser.checkHelper}\`.`,
-    `Show attach details: \`${browser.attachInfoHelper}\`.`,
-    `Attach Chrome DevTools MCP to ${browser.effectiveAttachUrl}.`,
-    `Preset: ${browser.preset}.`,
-    `Profile: ${browser.effectiveProfile}.`,
-    `State dir: ${browser.stateDir}.`,
-    `Reset the active profile with \`${browser.resetProfileHelper}\`.`
-  ];
-  if (browser.e2eCommand) {
-    lines.push(`Run app-owned browser e2e with \`${browser.e2eHelper}\`.`);
+  const zigBinary = Bun.which("zig");
+  if (!zigBinary) {
+    throw new Error("zig is required to build the native Rig shell.");
   }
-  if (browser.defaultProfile !== browser.effectiveProfile) {
-    lines.push(`Base profile: ${browser.defaultProfile}. Runtime launches derive an isolated effective profile.`);
+  mkdirSync3(dirname4(outputPath), { recursive: true });
+  const sourceDigest = await sha256File2(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    zigBinary,
+    platform: process.platform,
+    arch: process.arch,
+    sourcePath,
+    sourceDigest
+  });
+  const manifestPath = nativeBuildManifestPath2(outputPath);
+  const needsBuild = !existsSync5(outputPath) || !await hasMatchingNativeBuildManifest2(manifestPath, buildKey);
+  if (!needsBuild) {
+    return outputPath;
   }
-  return lines;
-}
-
-// packages/runtime/src/control-plane/plugin-host-context.ts
-import { createPluginHost } from "@rig/core";
-import { loadConfig } from "@rig/core/load-config";
-
-// packages/runtime/src/control-plane/task-source.ts
-function createTaskSourceRegistry() {
-  const byId = new Map;
-  const order = [];
-  return {
-    register(s) {
-      if (byId.has(s.id))
-        throw new Error(`task source already registered: ${s.id}`);
-      byId.set(s.id, s);
-      order.push(s);
-    },
-    resolveById(id) {
-      const s = byId.get(id);
-      if (!s)
-        throw new Error(`task source not registered: ${id}`);
-      return s;
-    },
-    resolveByKind(kind) {
-      for (const s of order)
-        if (s.kind === kind)
-          return s;
-      throw new Error(`no task source registered for kind: ${kind}`);
-    },
-    list: () => order
-  };
-}
-
-// packages/runtime/src/control-plane/task-source-bootstrap.ts
-function formatRegisteredKinds(pluginHost) {
-  const kinds = pluginHost ? pluginHost.listExecutableTaskSources().map((source) => source.kind) : [];
-  return kinds.length > 0 ? kinds.join(", ") : "none";
-}
-function buildTaskSourceRegistry(config, pluginHost) {
-  const registry = createTaskSourceRegistry();
-  const taskSourceConfig = config.taskSource;
-  const factory = pluginHost?.resolveTaskSourceFactoryByKind(taskSourceConfig.kind);
-  if (!factory) {
-    throw new Error(`No task source factory registered for kind "${taskSourceConfig.kind}". ` + `Registered kinds: ${formatRegisteredKinds(pluginHost)}. ` + "Load a plugin that contributes an executable task source factory for this kind.");
+  const build = Bun.spawn([
+    zigBinary,
+    "build-exe",
+    sourcePath,
+    "-O",
+    "ReleaseFast",
+    `-femit-bin=${outputPath}`
+  ], {
+    cwd: dirname4(sourcePath),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    build.exited,
+    new Response(build.stdout).text(),
+    new Response(build.stderr).text()
+  ]);
+  if (exitCode !== 0 || !existsSync5(outputPath)) {
+    const details = [stderr.trim(), stdout.trim()].filter(Boolean).join(`
+`);
+    throw new Error(`Failed to build native Rig shell: ${details || `zig exited with code ${exitCode}`}`);
   }
-  registry.register(factory.factory(taskSourceConfig));
-  return registry;
+  await Bun.write(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
+  return outputPath;
 }
-
-// packages/runtime/src/control-plane/repos/registry.ts
-function createRepoRegistry(entries) {
-  const map = new Map;
-  for (const e of entries) {
-    if (map.has(e.id))
-      throw new Error(`repo already registered: ${e.id}`);
-    map.set(e.id, { ...e });
+async function materializeRigShellBinary(targetDir) {
+  const sourcePath = await ensureRigShellBinaryPath();
+  const targetPath = resolve5(targetDir, runtimeRigShellFileName());
+  mkdirSync3(targetDir, { recursive: true });
+  const sourceDigest = await sha256File2(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    sourcePath,
+    sourceDigest
+  });
+  const needsCopy = !existsSync5(targetPath) || !await hasMatchingNativeBuildManifest2(nativeBuildManifestPath2(targetPath), buildKey);
+  if (needsCopy) {
+    copyFileSync2(sourcePath, targetPath);
+    chmodSync2(targetPath, 493);
+    await Bun.write(nativeBuildManifestPath2(targetPath), `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
   }
-  const ordered = Array.from(map.values());
-  return {
-    getById: (id) => map.get(id),
-    list: () => ordered
-  };
+  return targetPath;
 }
-var MANAGED_REPOS = new Map;
-function setManagedRepos(entries) {
-  const next = new Map;
-  for (const e of entries) {
-    if (next.has(e.id)) {
-      throw new Error(`managed repo already registered: ${e.id}`);
+function resolveRigShellSourcePath() {
+  for (const candidate of rigShellSourceCandidates()) {
+    if (candidate && existsSync5(candidate)) {
+      return candidate;
     }
-    next.set(e.id, e);
   }
-  MANAGED_REPOS = next;
-}
-function getManagedRepoEntry(repoId) {
-  const entry = MANAGED_REPOS.get(repoId);
-  if (!entry) {
-    throw new Error(`managed repo not registered: ${repoId}. Plugins contribute repos via RigPlugin.contributes.repoSources; ` + `make sure a plugin declares this id and the plugin host has been initialized.`);
-  }
-  return entry;
-}
-function listManagedRepoEntries() {
-  return Array.from(MANAGED_REPOS.values());
+  return null;
 }
-function resolveManagedRepoIdByAlias(alias) {
-  for (const entry of MANAGED_REPOS.values()) {
-    if (entry.alias === alias) {
-      return entry.id;
+function resolveBundledRigShellBinaryPath() {
+  for (const candidate of rigShellBinaryCandidates()) {
+    if (candidate && existsSync5(candidate)) {
+      return candidate;
     }
   }
   return null;
 }
-function repoRegistrationToManagedEntry(reg) {
-  if (!reg.defaultBranch) {
-    return null;
-  }
-  return {
-    id: reg.id,
-    alias: reg.defaultPath ?? reg.id,
-    defaultBranch: reg.defaultBranch,
-    defaultRemoteUrl: reg.url,
-    remoteEnvVar: reg.remoteEnvVar,
-    checkoutEnvVar: reg.checkoutEnvVar
-  };
+function rigShellSourceCandidates() {
+  const execDir = process.execPath?.trim() ? dirname4(process.execPath.trim()) : "";
+  const cwd = process.cwd()?.trim() || "";
+  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
+  return [...new Set([
+    process.env.RIG_NATIVE_SHELL_SOURCE?.trim() || "",
+    cwd ? resolve5(cwd, "packages/runtime/native/rig-shell.zig") : "",
+    projectRoot ? resolve5(projectRoot, "packages/runtime/native/rig-shell.zig") : "",
+    hostProjectRoot ? resolve5(hostProjectRoot, "packages/runtime/native/rig-shell.zig") : "",
+    execDir ? resolve5(execDir, "..", "..", "packages/runtime/native/rig-shell.zig") : "",
+    execDir ? resolve5(execDir, "..", "native", "rig-shell.zig") : "",
+    resolve5(import.meta.dir, "../../../../native/rig-shell.zig")
+  ].filter(Boolean))];
 }
-
-// packages/runtime/src/control-plane/agent-roles.ts
-function createAgentRoleRegistry(pluginRoles, configOverrides) {
-  const map = new Map;
-  for (const r of pluginRoles) {
-    if (map.has(r.id))
-      throw new Error(`agent role already registered: ${r.id}`);
-    const override = configOverrides?.[r.id];
-    const model = override?.model ?? r.defaultModel;
-    if (!model) {
-      throw new Error(`agent role "${r.id}" has no model \u2014 provide defaultModel in plugin or model in config.runtime.agentRoles.${r.id}`);
-    }
-    map.set(r.id, { ...r, model });
+function nativePackageBinaryCandidates2(fromDir, fileName) {
+  const candidates = [];
+  let cursor = resolve5(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    candidates.push(resolve5(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve5(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve5(cursor, "native", fileName), resolve5(cursor, "native", "bin", fileName));
+    const parent = dirname4(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
   }
-  return {
-    resolve(id) {
-      const r = map.get(id);
-      if (!r)
-        throw new Error(`agent role not registered: ${id}`);
-      return r;
-    },
-    list: () => Array.from(map.values())
-  };
+  return candidates;
 }
-
-// packages/runtime/src/control-plane/task-fields.ts
-function createTaskFieldRegistry(extensions) {
-  const byId = new Map;
-  for (const e of extensions) {
-    if (byId.has(e.id))
-      throw new Error(`task field extension already registered: ${e.id}`);
-    byId.set(e.id, e);
-  }
-  return {
-    get: (id) => byId.get(id),
-    list: () => Array.from(byId.values()),
-    fieldNames: () => Array.from(byId.values()).map((e) => e.fieldName),
-    validateTaskFields(task) {
-      const errors = [];
-      for (const ext of byId.values()) {
-        let schema;
-        try {
-          schema = JSON.parse(ext.schemaJson);
-        } catch {
-          errors.push(`task field "${ext.id}": schemaJson is not valid JSON`);
-          continue;
-        }
-        const isRequired = typeof schema === "object" && schema !== null && schema.required === true;
-        if (!isRequired)
-          continue;
-        const value = task[ext.fieldName];
-        if (value === undefined || value === null || value === "") {
-          errors.push(`task field "${ext.fieldName}" (from extension "${ext.id}") is required but missing`);
-        }
-      }
-      return errors.length === 0 ? { ok: true } : { ok: false, errors };
-    }
-  };
+function rigShellBinaryCandidates() {
+  const execDir = process.execPath?.trim() ? dirname4(process.execPath.trim()) : "";
+  const fileName = runtimeRigShellFileName();
+  return [...new Set([
+    process.env.RIG_NATIVE_SHELL_BIN?.trim() || "",
+    ...nativePackageBinaryCandidates2(import.meta.dir, fileName),
+    execDir ? resolve5(execDir, fileName) : "",
+    execDir ? resolve5(execDir, "..", fileName) : "",
+    execDir ? resolve5(execDir, "..", "bin", fileName) : ""
+  ].filter(Boolean))];
 }
-
-// packages/runtime/src/control-plane/validators/runtime-registration.ts
-import { existsSync as existsSync8 } from "fs";
-import { join } from "path";
-function createValidatorRegistry() {
-  const map = new Map;
-  const order = [];
-  const registry = {
-    register(v) {
-      if (map.has(v.id))
-        throw new Error(`validator already registered: ${v.id}`);
-      map.set(v.id, v);
-      order.push(v);
-    },
-    resolve(id) {
-      const v = map.get(id);
-      if (!v)
-        throw new Error(`validator not registered: ${id}`);
-      return v;
-    },
-    list: () => order
-  };
-  registerBuiltInValidators(registry);
-  return registry;
+function runtimeToolGatewayNames() {
+  return [
+    "bash",
+    "sh",
+    "zsh",
+    "git",
+    "bun",
+    "node",
+    "python3",
+    "rg",
+    "grep",
+    "sed",
+    "cat",
+    "ls",
+    "find",
+    "tsc",
+    "gh",
+    "mkdir",
+    "rm",
+    "mv",
+    "cp",
+    "touch",
+    "pwd",
+    "head",
+    "tail",
+    "wc",
+    "sort",
+    "uniq",
+    "awk",
+    "xargs",
+    "dirname",
+    "basename",
+    "realpath",
+    "env",
+    "jq",
+    "tee",
+    "which"
+  ];
 }
-function registerBuiltInValidators(registry) {
-  registry.register({
-    id: "std:typecheck",
-    category: "custom",
-    description: "Runs the package typecheck script when present.",
-    run: async (ctx) => runStdTypecheck(ctx)
-  });
+function nativeBuildManifestPath2(outputPath) {
+  return `${outputPath}.build-manifest.json`;
 }
-async function runStdTypecheck(ctx) {
-  const packageJsonPath = join(ctx.workspaceRoot, "package.json");
-  if (!existsSync8(packageJsonPath)) {
-    return {
-      id: "std:typecheck",
-      passed: false,
-      summary: `package.json not found at ${packageJsonPath}`
-    };
+async function hasMatchingNativeBuildManifest2(manifestPath, buildKey) {
+  if (!existsSync5(manifestPath)) {
+    return false;
+  }
+  try {
+    const manifest = await Bun.file(manifestPath).json();
+    return manifest.version === 1 && manifest.buildKey === buildKey;
+  } catch {
+    return false;
   }
-  const proc = Bun.spawn(["bun", "run", "typecheck"], {
-    cwd: ctx.workspaceRoot,
-    env: process.env,
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    proc.exited,
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text()
-  ]);
-  const output = `${stdout}${stderr}`.trim();
-  return {
-    id: "std:typecheck",
-    passed: exitCode === 0,
-    summary: exitCode === 0 ? "typecheck passed" : "typecheck failed",
-    ...output ? { details: output.slice(0, 4000) } : {}
-  };
-}
-
-// packages/runtime/src/control-plane/native/scope-rules.ts
-var activeRules = null;
-function setScopeRules(rules) {
-  activeRules = rules ?? null;
 }
-function getScopeRules() {
-  return activeRules;
+async function sha256File2(path) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(await Bun.file(path).arrayBuffer());
+  return hasher.digest("hex");
 }
 
-// packages/runtime/src/control-plane/hook-materializer.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname5, resolve as resolve9 } from "path";
-var MARKER_PLUGIN = "_rigPlugin";
-var MARKER_HOOK_ID = "_rigHookId";
-function matcherToString(matcher) {
-  if (matcher.kind === "all")
-    return;
-  if (matcher.kind === "tool")
-    return matcher.name;
-  return matcher.pattern;
+// packages/runtime/src/control-plane/runtime/tooling/browser-tools.ts
+import { existsSync as existsSync6, rmSync as rmSync2, symlinkSync } from "fs";
+import { resolve as resolve6 } from "path";
+function runtimeBrowserToolBinaryName() {
+  return `rig-browser-tool${process.platform === "win32" ? ".exe" : ""}`;
 }
-function isPluginOwned(cmd) {
-  return typeof cmd[MARKER_PLUGIN] === "string";
+function runtimeBrowserToolNames() {
+  return [
+    "rig-browser-launch",
+    "rig-browser-check",
+    "rig-browser-attach-info",
+    "rig-browser-e2e",
+    "rig-browser-reset-profile"
+  ];
 }
-function materializeHooks(projectRoot, entries) {
-  const settingsPath = resolve9(projectRoot, ".claude", "settings.json");
-  const existing = existsSync9(settingsPath) ? safeReadJson(settingsPath) : {};
-  const hooks = existing.hooks ?? {};
-  for (const event of Object.keys(hooks)) {
-    const groups = hooks[event] ?? [];
-    const cleaned = [];
-    for (const group of groups) {
-      const operatorHooks = group.hooks.filter((h) => !isPluginOwned(h));
-      if (operatorHooks.length > 0) {
-        cleaned.push({ ...group, hooks: operatorHooks });
-      }
-    }
-    if (cleaned.length > 0) {
-      hooks[event] = cleaned;
-    } else {
-      delete hooks[event];
+async function materializeRuntimeBrowserTools(targetDir) {
+  const binaryPath = resolve6(targetDir, runtimeBrowserToolBinaryName());
+  for (const tool of runtimeBrowserToolNames()) {
+    const toolPath = resolve6(targetDir, tool);
+    if (existsSync6(toolPath)) {
+      rmSync2(toolPath, { force: true, recursive: true });
     }
+    symlinkSync(binaryPath, toolPath);
   }
-  for (const { pluginName, hook } of entries) {
-    if (!hook.command) {
-      continue;
-    }
-    const event = hook.event;
-    const matcherString = matcherToString(hook.matcher);
-    const groups = hooks[event] ??= [];
-    let group = groups.find((g) => g.matcher === matcherString);
-    if (!group) {
-      group = matcherString === undefined ? { hooks: [] } : { matcher: matcherString, hooks: [] };
-      groups.push(group);
+  return binaryPath;
+}
+// packages/runtime/src/control-plane/runtime/tooling/file-tools.ts
+import { chmodSync as chmodSync3, copyFileSync as copyFileSync3, existsSync as existsSync7, mkdirSync as mkdirSync4, rmSync as rmSync3, symlinkSync as symlinkSync2 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { basename as basename3, dirname as dirname5, resolve as resolve7 } from "path";
+var sharedNativeToolsOutputDir = resolve7(tmpdir3(), "rig-native");
+var sharedNativeToolsOutputPath = resolve7(sharedNativeToolsOutputDir, `rig-tools-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+function runtimeRigToolsFileName() {
+  return `rig-tools${process.platform === "win32" ? ".exe" : ""}`;
+}
+function runtimeFileToolNames() {
+  return [
+    "rig-read",
+    "rig-write",
+    "rig-edit",
+    "rig-glob",
+    "rig-grep"
+  ];
+}
+async function ensureRigToolsBinaryPath(outputPath = sharedNativeToolsOutputPath) {
+  const sourcePath = resolveRigToolsSourcePath();
+  if (!sourcePath) {
+    const bundledBinary = resolveBundledRigToolsBinaryPath();
+    if (bundledBinary) {
+      return bundledBinary;
     }
-    group.hooks.push({
-      type: "command",
-      command: hook.command,
-      [MARKER_PLUGIN]: pluginName,
-      [MARKER_HOOK_ID]: hook.id
-    });
+    throw new Error("rig-tools.zig source file not found.");
   }
-  const next = { ...existing };
-  if (Object.keys(hooks).length > 0) {
-    next.hooks = hooks;
-  } else {
-    delete next.hooks;
+  const zigBinary = Bun.which("zig");
+  if (!zigBinary) {
+    throw new Error("zig is required to build native Rig file tools.");
   }
-  mkdirSync4(dirname5(settingsPath), { recursive: true });
-  writeFileSync2(settingsPath, `${JSON.stringify(next, null, 2)}
-`, "utf-8");
-  return settingsPath;
-}
-function safeReadJson(path) {
-  try {
-    return JSON.parse(readFileSync3(path, "utf-8"));
-  } catch {
-    return {};
+  mkdirSync4(dirname5(outputPath), { recursive: true });
+  const sourceDigest = await sha256File3(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    zigBinary,
+    platform: process.platform,
+    arch: process.arch,
+    sourcePath,
+    sourceDigest
+  });
+  const manifestPath = nativeBuildManifestPath3(outputPath);
+  const needsBuild = !existsSync7(outputPath) || !await hasMatchingNativeBuildManifest3(manifestPath, buildKey);
+  if (!needsBuild) {
+    return outputPath;
   }
+  const build = Bun.spawn([
+    zigBinary,
+    "build-exe",
+    sourcePath,
+    "-O",
+    "ReleaseFast",
+    `-femit-bin=${outputPath}`
+  ], {
+    cwd: dirname5(sourcePath),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    build.exited,
+    new Response(build.stdout).text(),
+    new Response(build.stderr).text()
+  ]);
+  if (exitCode !== 0 || !existsSync7(outputPath)) {
+    const details = [stderr.trim(), stdout.trim()].filter(Boolean).join(`
+`);
+    throw new Error(`Failed to build native Rig file tools: ${details || `zig exited with code ${exitCode}`}`);
+  }
+  await Bun.write(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
+  return outputPath;
 }
-
-// packages/runtime/src/control-plane/skill-materializer.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync4, readdirSync, rmSync as rmSync4, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve10 } from "path";
-import { loadSkill } from "@rig/skill-loader";
-var MARKER_FILENAME = ".rig-plugin";
-function skillDirName(id) {
-  return id.replace(/[^a-zA-Z0-9._-]+/g, "-");
-}
-async function materializeSkills(projectRoot, entries) {
-  const skillsRoot = resolve10(projectRoot, ".pi", "skills");
-  if (existsSync10(skillsRoot)) {
-    for (const name of readdirSync(skillsRoot)) {
-      const dir = resolve10(skillsRoot, name);
-      if (existsSync10(resolve10(dir, MARKER_FILENAME))) {
-        rmSync4(dir, { recursive: true, force: true });
-      }
-    }
+async function materializeRuntimeFileTools(targetDir) {
+  const sourcePath = await ensureRigToolsBinaryPath();
+  const targetPath = resolve7(targetDir, runtimeRigToolsFileName());
+  mkdirSync4(targetDir, { recursive: true });
+  const sourceDigest = await sha256File3(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    sourcePath,
+    sourceDigest
+  });
+  const needsCopy = !existsSync7(targetPath) || !await hasMatchingNativeBuildManifest3(nativeBuildManifestPath3(targetPath), buildKey);
+  if (needsCopy) {
+    copyFileSync3(sourcePath, targetPath);
+    chmodSync3(targetPath, 493);
+    await Bun.write(nativeBuildManifestPath3(targetPath), `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`);
   }
-  const written = [];
-  for (const { pluginName, skill } of entries) {
-    const sourcePath = resolve10(projectRoot, skill.path);
-    if (!existsSync10(sourcePath)) {
-      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${sourcePath} does not exist`);
-      continue;
+  for (const tool of runtimeFileToolNames()) {
+    const toolPath = resolve7(targetDir, tool);
+    if (existsSync7(toolPath)) {
+      rmSync3(toolPath, { force: true, recursive: true });
     }
-    let body;
-    try {
-      await loadSkill(sourcePath);
-      body = readFileSync4(sourcePath, "utf-8");
-    } catch (err) {
-      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${err instanceof Error ? err.message : err}`);
-      continue;
+    symlinkSync2(targetPath, toolPath);
+  }
+  return targetPath;
+}
+function resolveRigToolsSourcePath() {
+  for (const candidate of rigToolsSourceCandidates()) {
+    if (candidate && existsSync7(candidate)) {
+      return candidate;
     }
-    const dir = resolve10(skillsRoot, skillDirName(skill.id));
-    mkdirSync5(dir, { recursive: true });
-    writeFileSync3(resolve10(dir, "SKILL.md"), body, "utf-8");
-    writeFileSync3(resolve10(dir, MARKER_FILENAME), `${JSON.stringify({ plugin: pluginName, skillId: skill.id }, null, 2)}
-`, "utf-8");
-    written.push({ id: skill.id, pluginName, directory: dir });
   }
-  return written;
+  return null;
 }
-
-// packages/runtime/src/control-plane/plugin-host-context.ts
-async function buildPluginHostContext(projectRoot) {
-  let config;
-  try {
-    config = await loadConfig(projectRoot);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (msg.includes("no rig.config")) {
-      return null;
+function resolveBundledRigToolsBinaryPath() {
+  for (const candidate of rigToolsBinaryCandidates()) {
+    if (candidate && existsSync7(candidate)) {
+      return candidate;
     }
-    throw err;
   }
-  const pluginHost = createPluginHost(config.plugins);
-  setScopeRules(config.workspace.scopeNormalization);
-  const validatorRegistry = createValidatorRegistry();
-  for (const impl of pluginHost.listExecutableValidators()) {
-    validatorRegistry.register(impl);
+  return null;
+}
+function rigToolsSourceCandidates() {
+  const execDir = process.execPath?.trim() ? dirname5(process.execPath.trim()) : "";
+  const cwd = process.cwd()?.trim() || "";
+  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
+  return [...new Set([
+    process.env.RIG_NATIVE_TOOLS_SOURCE?.trim() || "",
+    cwd ? resolve7(cwd, "packages/runtime/native/rig-tools.zig") : "",
+    projectRoot ? resolve7(projectRoot, "packages/runtime/native/rig-tools.zig") : "",
+    hostProjectRoot ? resolve7(hostProjectRoot, "packages/runtime/native/rig-tools.zig") : "",
+    execDir ? resolve7(execDir, "..", "..", "packages/runtime/native/rig-tools.zig") : "",
+    execDir ? resolve7(execDir, "..", "native", "rig-tools.zig") : "",
+    resolve7(import.meta.dir, "../../../../native/rig-tools.zig")
+  ].filter(Boolean))];
+}
+function nativePackageBinaryCandidates3(fromDir, fileName) {
+  const candidates = [];
+  let cursor = resolve7(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    candidates.push(resolve7(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve7(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve7(cursor, "native", fileName), resolve7(cursor, "native", "bin", fileName));
+    const parent = dirname5(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
   }
-  const taskSourceRegistry = buildTaskSourceRegistry(config, pluginHost);
-  const repoRegistry = createRepoRegistry(pluginHost.listRepoSources());
-  const managedEntries = pluginHost.listRepoSources().map(repoRegistrationToManagedEntry).filter((e) => e !== null);
-  setManagedRepos(managedEntries);
-  const configRoleOverrides = config.runtime?.agentRoles;
-  const agentRoleRegistry = createAgentRoleRegistry(pluginHost.listAgentRoles(), configRoleOverrides);
-  const taskFieldRegistry = createTaskFieldRegistry(pluginHost.listTaskFieldExtensions());
-  try {
-    const hookEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.hooks ?? []).map((hook) => ({
-      pluginName: plugin.name,
-      hook
-    })));
-    if (hookEntries.length > 0) {
-      materializeHooks(projectRoot, hookEntries);
-    }
-  } catch (err) {
-    console.warn(`[plugin-host] hook materialization failed: ${err instanceof Error ? err.message : err}`);
+  return candidates;
+}
+function rigToolsBinaryCandidates() {
+  const execDir = process.execPath?.trim() ? dirname5(process.execPath.trim()) : "";
+  const fileName = runtimeRigToolsFileName();
+  return [...new Set([
+    process.env.RIG_NATIVE_TOOLS_BIN?.trim() || "",
+    ...nativePackageBinaryCandidates3(import.meta.dir, fileName),
+    execDir ? resolve7(execDir, fileName) : "",
+    execDir ? resolve7(execDir, "..", fileName) : "",
+    execDir ? resolve7(execDir, "..", "bin", fileName) : ""
+  ].filter(Boolean))];
+}
+function nativeBuildManifestPath3(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+async function hasMatchingNativeBuildManifest3(manifestPath, buildKey) {
+  if (!existsSync7(manifestPath)) {
+    return false;
   }
   try {
-    const skillEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.skills ?? []).map((skill) => ({
-      pluginName: plugin.name,
-      skill
-    })));
-    if (skillEntries.length > 0) {
-      await materializeSkills(projectRoot, skillEntries);
-    }
-  } catch (err) {
-    console.warn(`[plugin-host] skill materialization failed: ${err instanceof Error ? err.message : err}`);
+    const manifest = await Bun.file(manifestPath).json();
+    return manifest.version === 1 && manifest.buildKey === buildKey;
+  } catch {
+    return false;
   }
-  return {
-    config,
-    pluginHost,
-    validatorRegistry,
-    taskSourceRegistry,
-    repoRegistry,
-    agentRoleRegistry,
-    taskFieldRegistry
-  };
 }
-
-// packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
-import { spawnSync } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync2, writeFileSync as writeFileSync4 } from "fs";
-import { basename as basename4, join as join2, resolve as resolve12 } from "path";
-
-// packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
-import { existsSync as existsSync11, readFileSync as readFileSync5 } from "fs";
-import { resolve as resolve11 } from "path";
-
-// packages/runtime/src/control-plane/tasks/task-record-reader.ts
-async function findTaskById(reader, id) {
-  const tasks = await reader.listTasks();
-  return tasks.find((task) => task.id === id) ?? null;
+async function sha256File3(path) {
+  const hasher = new Bun.CryptoHasher("sha256");
+  hasher.update(await Bun.file(path).arrayBuffer());
+  return hasher.digest("hex");
 }
 
-// packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
-class LegacyTaskConfigReadError extends Error {
-  code = "LEGACY_TASK_CONFIG_READ_FAILED";
-  projectRoot;
-  configPath;
-  cause;
-  constructor(input) {
-    super(input.message, { cause: input.cause });
-    this.name = "LegacyTaskConfigReadError";
-    this.projectRoot = input.projectRoot;
-    this.configPath = input.configPath;
-    this.cause = input.cause;
-  }
+// packages/runtime/src/control-plane/runtime/tooling/gateway.ts
+function runtimeGatewayToolNames() {
+  return runtimeToolGatewayNames();
 }
-function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve11(projectRoot, ".rig", "task-config.json");
-  const reader = {
-    async listTasks() {
-      return readLegacyTaskRecords(projectRoot, configPath);
-    },
-    async getTask(id) {
-      return findTaskById(reader, id);
+async function materializeRuntimeToolGateway(binDir) {
+  const shellPath = await materializeRigShellBinary(binDir);
+  for (const tool of runtimeGatewayToolNames()) {
+    const toolPath = resolve8(binDir, tool);
+    if (existsSync8(toolPath)) {
+      rmSync4(toolPath, { force: true, recursive: true });
     }
-  };
-  return reader;
+    symlinkSync3(shellPath, toolPath);
+  }
+  await materializeRuntimeBrowserTools(binDir);
+  return resolve8(binDir, runtimeRigShellFileName());
 }
-function readLegacyTaskRecords(projectRoot, configPath = resolve11(projectRoot, ".rig", "task-config.json")) {
-  if (!existsSync11(configPath)) {
-    return [];
+// packages/runtime/src/control-plane/browser-contract.ts
+import { resolve as resolve9 } from "path";
+var DEFAULT_BROWSER_ATTACH_URL = "http://127.0.0.1:9333";
+var DEFAULT_BROWSER_MODE = "persistent";
+var RUNTIME_BROWSER_HELPERS = {
+  launch: "rig-browser-launch",
+  check: "rig-browser-check",
+  attachInfo: "rig-browser-attach-info",
+  e2e: "rig-browser-e2e",
+  resetProfile: "rig-browser-reset-profile"
+};
+var BASE_REMOTE_DEBUGGING_PORT = 9222;
+var REMOTE_DEBUGGING_PORT_SPREAD = 4000;
+function hashString(input) {
+  let hash = 0;
+  for (let index = 0;index < input.length; index += 1) {
+    hash = (hash << 5) - hash + input.charCodeAt(index) | 0;
   }
-  const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
-  return Object.entries(stripLegacyTaskConfigMetadata(rawConfig)).map(([id, entry]) => legacyTaskConfigEntryToRecord(id, entry)).filter((record) => record !== null);
+  return Math.abs(hash);
 }
-function readLegacyTaskConfigJson(projectRoot, configPath) {
+function derivePortFromProfile(profileName) {
+  return BASE_REMOTE_DEBUGGING_PORT + hashString(profileName) % REMOTE_DEBUGGING_PORT_SPREAD;
+}
+function parseAttachUrl(attachUrl) {
   try {
-    const parsed = JSON.parse(readFileSync5(configPath, "utf8"));
-    if (isPlainRecord(parsed)) {
-      return parsed;
-    }
-    throw new Error("task config root must be a JSON object");
-  } catch (cause) {
-    throw new LegacyTaskConfigReadError({
-      projectRoot,
-      configPath,
-      message: `Could not read legacy task config at ${configPath} for project ${projectRoot}: ${cause instanceof Error ? cause.message : String(cause)}`,
-      cause
-    });
+    return new URL((attachUrl || DEFAULT_BROWSER_ATTACH_URL).trim() || DEFAULT_BROWSER_ATTACH_URL);
+  } catch {
+    return new URL(DEFAULT_BROWSER_ATTACH_URL);
   }
 }
-function stripLegacyTaskConfigMetadata(raw) {
-  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
-  return tasks;
+function sanitizeRuntimeSuffix(runtimeId) {
+  return runtimeId.replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 16) || "runtime";
 }
-function legacyTaskConfigEntryToRecord(id, entry) {
-  if (!isPlainRecord(entry)) {
-    return null;
+function resolveBrowserStateDir(projectRoot, configuredStateDir) {
+  const trimmed = configuredStateDir?.trim() || ".tmp/rig-browser";
+  if (trimmed.startsWith("/")) {
+    return resolve9(trimmed);
   }
-  const deps = firstStringList(entry.deps, entry.dependencies, entry.validation_deps, entry.validationDeps);
-  const validation = readStringList(entry.validation);
-  const validators = readStringList(entry.validators);
-  const scope = readStringList(entry.scope);
-  const status = typeof entry.status === "string" ? entry.status : "open";
-  const title = typeof entry.title === "string" ? entry.title : undefined;
-  const description = typeof entry.description === "string" ? entry.description : undefined;
-  const acceptanceCriteria = typeof entry.acceptance_criteria === "string" ? entry.acceptance_criteria : typeof entry.acceptanceCriteria === "string" ? entry.acceptanceCriteria : undefined;
-  return {
-    id,
-    deps,
-    status,
-    source: "legacy-task-config",
-    ...title ? { title } : {},
-    ...description ? { description } : {},
-    ...acceptanceCriteria ? { acceptanceCriteria } : {},
-    ...scope.length > 0 ? { scope } : {},
-    ...validation.length > 0 ? { validation } : {},
-    ...validators.length > 0 ? { validators } : {},
-    ...preservedLegacyFields(entry)
-  };
+  return resolve9(projectRoot || process.cwd(), trimmed);
 }
-function preservedLegacyFields(entry) {
-  const preserved = {};
-  for (const key of [
-    "role",
-    "browser",
-    "repo_pins",
-    "criticality",
-    "queue_weight",
-    "creates_repo",
-    "auto_synced"
-  ]) {
-    if (entry[key] !== undefined) {
-      preserved[key] = entry[key];
-    }
+function resolveTaskBrowserContext(browser, options = {}) {
+  if (!browser?.required) {
+    return;
   }
-  return preserved;
+  const defaultProfile = browser.profile?.trim() || "default";
+  const mode = browser.mode?.trim() || DEFAULT_BROWSER_MODE;
+  const defaultAttach = parseAttachUrl(browser.attach_url);
+  const shouldDeriveRuntimeProfile = Boolean(options.runtimeId?.trim()) && mode !== "shared";
+  const effectiveProfile = shouldDeriveRuntimeProfile ? `${defaultProfile}-${sanitizeRuntimeSuffix(options.runtimeId.trim())}` : defaultProfile;
+  const effectivePort = shouldDeriveRuntimeProfile ? derivePortFromProfile(effectiveProfile) : Number(defaultAttach.port || "80");
+  const effectiveAttach = new URL(defaultAttach.toString());
+  effectiveAttach.port = String(effectivePort);
+  return {
+    required: true,
+    preset: browser.preset?.trim() || "default",
+    mode,
+    stateDir: resolveBrowserStateDir(options.hostProjectRoot, browser.state_dir),
+    defaultProfile,
+    effectiveProfile,
+    defaultAttachUrl: defaultAttach.toString(),
+    effectiveAttachUrl: effectiveAttach.toString(),
+    devCommand: browser.dev_command?.trim() || undefined,
+    launchCommand: browser.launch_command?.trim() || undefined,
+    checkCommand: browser.check_command?.trim() || undefined,
+    e2eCommand: browser.e2e_command?.trim() || undefined,
+    launchHelper: RUNTIME_BROWSER_HELPERS.launch,
+    checkHelper: RUNTIME_BROWSER_HELPERS.check,
+    attachInfoHelper: RUNTIME_BROWSER_HELPERS.attachInfo,
+    e2eHelper: RUNTIME_BROWSER_HELPERS.e2e,
+    resetProfileHelper: RUNTIME_BROWSER_HELPERS.resetProfile
+  };
 }
-function firstStringList(...candidates) {
-  for (const candidate of candidates) {
-    const list = readStringList(candidate);
-    if (list.length > 0) {
-      return list;
-    }
+function buildBrowserGuidanceLines(browser) {
+  const lines = [
+    "This task requires Rig Browser.",
+    `Launch the browser: \`${browser.launchHelper}\`${browser.devCommand ? " or `rig-browser-launch --dev`" : ""}.`,
+    `Check the browser contract: \`${browser.checkHelper}\`.`,
+    `Show attach details: \`${browser.attachInfoHelper}\`.`,
+    `Attach Chrome DevTools MCP to ${browser.effectiveAttachUrl}.`,
+    `Preset: ${browser.preset}.`,
+    `Profile: ${browser.effectiveProfile}.`,
+    `State dir: ${browser.stateDir}.`,
+    `Reset the active profile with \`${browser.resetProfileHelper}\`.`
+  ];
+  if (browser.e2eCommand) {
+    lines.push(`Run app-owned browser e2e with \`${browser.e2eHelper}\`.`);
   }
-  return [];
-}
-function readStringList(candidate) {
-  if (!Array.isArray(candidate)) {
-    return [];
+  if (browser.defaultProfile !== browser.effectiveProfile) {
+    lines.push(`Base profile: ${browser.defaultProfile}. Runtime launches derive an isolated effective profile.`);
   }
-  return candidate.filter((value) => typeof value === "string");
-}
-function isPlainRecord(candidate) {
-  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
+  return lines;
 }
 
-// packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
-var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
-var FILE_TASK_PATTERN = /\.(task\.)?json$/;
-function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve12(projectRoot, ".rig", "task-config.json");
-  const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
-  const spawnFn = options.spawn ?? spawnSync;
-  const ghBinary = options.ghBinary ?? "gh";
-  const allowLocalFallback = options.allowLocalTaskConfigStatusFallback ?? true;
+// packages/runtime/src/control-plane/plugin-host-context.ts
+import { createPluginHost } from "@rig/core";
+import { loadConfig } from "@rig/core/load-config";
+
+// packages/runtime/src/control-plane/task-source.ts
+function createTaskSourceRegistry() {
+  const byId = new Map;
+  const order = [];
   return {
-    async listTasks() {
-      const rawConfig = readRawTaskConfig(configPath);
-      if (!rawConfig) {
-        const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
-        return configuredFilesPath ? listFileBackedTasks(projectRoot, configuredFilesPath) : [];
-      }
-      const tasks = [];
-      const legacyTasks = await legacy.listTasks();
-      const legacyById = new Map(legacyTasks.map((task) => [task.id, task]));
-      for (const [id, rawEntry] of Object.entries(stripLegacyTaskConfigMetadata2(rawConfig))) {
-        if (!isPlainRecord2(rawEntry)) {
-          continue;
-        }
-        const metadata = readMaterializedTaskMetadata(rawEntry);
-        if (metadata.taskSource?.kind === "github-issues") {
-          tasks.push(readGithubIssueTask(ghBinary, spawnFn, id, metadata, rawEntry));
-          continue;
-        }
-        if (metadata.taskSource?.kind === "files" && metadata.taskSource.path) {
-          const fileTask = readFileBackedTask(projectRoot, metadata.taskSource.path, id, rawEntry);
-          if (fileTask)
-            tasks.push(fileTask);
-          continue;
-        }
-        if (!allowLocalFallback) {
-          continue;
-        }
-        const legacyTask = legacyById.get(id);
-        if (legacyTask) {
-          tasks.push(legacyTask);
-        }
-      }
-      return tasks;
+    register(s) {
+      if (byId.has(s.id))
+        throw new Error(`task source already registered: ${s.id}`);
+      byId.set(s.id, s);
+      order.push(s);
     },
-    async getTask(id) {
-      const rawEntry = readRawTaskEntry(configPath, id);
-      if (!rawEntry) {
-        const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
-        return configuredFilesPath ? readFileBackedTask(projectRoot, configuredFilesPath, id, {}) : null;
-      }
-      const metadata = readMaterializedTaskMetadata(rawEntry);
-      if (metadata.taskSource?.kind === "github-issues") {
-        return readGithubIssueTask(ghBinary, spawnFn, id, metadata, rawEntry);
-      }
-      if (metadata.taskSource?.kind === "files" && metadata.taskSource.path) {
-        return readFileBackedTask(projectRoot, metadata.taskSource.path, id, rawEntry);
-      }
-      return allowLocalFallback ? legacy.getTask(id) : null;
-    }
+    resolveById(id) {
+      const s = byId.get(id);
+      if (!s)
+        throw new Error(`task source not registered: ${id}`);
+      return s;
+    },
+    resolveByKind(kind) {
+      for (const s of order)
+        if (s.kind === kind)
+          return s;
+      throw new Error(`no task source registered for kind: ${kind}`);
+    },
+    list: () => order
   };
 }
-function readMaterializedTaskMetadata(entry) {
-  const rawRig = entry._rig;
-  if (!isPlainRecord2(rawRig)) {
-    return {};
-  }
-  const rawSource = rawRig.taskSource;
-  const metadata = {};
-  if (isPlainRecord2(rawSource)) {
-    const kind = typeof rawSource.kind === "string" ? rawSource.kind : "";
-    if (kind.length > 0) {
-      metadata.taskSource = {
-        kind,
-        ...typeof rawSource.path === "string" ? { path: rawSource.path } : {},
-        ...typeof rawSource.owner === "string" ? { owner: rawSource.owner } : {},
-        ...typeof rawSource.repo === "string" ? { repo: rawSource.repo } : {},
-        ...Array.isArray(rawSource.labels) ? { labels: rawSource.labels.filter((label) => typeof label === "string") } : {},
-        ...rawSource.state === "open" || rawSource.state === "closed" || rawSource.state === "all" ? { state: rawSource.state } : {}
-      };
-    }
-  }
-  if (typeof rawRig.sourceIssueId === "string") {
-    metadata.sourceIssueId = rawRig.sourceIssueId;
-  }
-  return metadata;
+
+// packages/runtime/src/control-plane/task-source-bootstrap.ts
+function formatRegisteredKinds(pluginHost) {
+  const kinds = pluginHost ? pluginHost.listExecutableTaskSources().map((source) => source.kind) : [];
+  return kinds.length > 0 ? kinds.join(", ") : "none";
 }
-function readConfiguredFilesTaskSourcePath(projectRoot) {
-  const jsonPath = resolve12(projectRoot, "rig.config.json");
-  if (existsSync12(jsonPath)) {
-    try {
-      const parsed = JSON.parse(readFileSync6(jsonPath, "utf8"));
-      if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
-        const source = parsed.taskSource;
-        return source.kind === "files" && typeof source.path === "string" ? source.path : null;
-      }
-    } catch {
-      return null;
-    }
-  }
-  const tsPath = resolve12(projectRoot, "rig.config.ts");
-  if (!existsSync12(tsPath)) {
-    return null;
+function buildTaskSourceRegistry(config, pluginHost) {
+  const registry = createTaskSourceRegistry();
+  const taskSourceConfig = config.taskSource;
+  const factory = pluginHost?.resolveTaskSourceFactoryByKind(taskSourceConfig.kind);
+  if (!factory) {
+    throw new Error(`No task source factory registered for kind "${taskSourceConfig.kind}". ` + `Registered kinds: ${formatRegisteredKinds(pluginHost)}. ` + "Load a plugin that contributes an executable task source factory for this kind.");
   }
-  try {
-    const source = readFileSync6(tsPath, "utf8");
-    const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
-    const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
-    if (kind !== "files") {
-      return null;
-    }
-    return taskSourceBlock.match(/path\s*:\s*["']([^"']+)["']/)?.[1] ?? null;
-  } catch {
-    return null;
+  registry.register(factory.factory(taskSourceConfig));
+  return registry;
+}
+
+// packages/runtime/src/control-plane/repos/registry.ts
+function createRepoRegistry(entries) {
+  const map = new Map;
+  for (const e of entries) {
+    if (map.has(e.id))
+      throw new Error(`repo already registered: ${e.id}`);
+    map.set(e.id, { ...e });
   }
+  const ordered = Array.from(map.values());
+  return {
+    getById: (id) => map.get(id),
+    list: () => ordered
+  };
 }
-function readRawTaskEntry(configPath, taskId) {
-  const rawConfig = readRawTaskConfig(configPath);
-  if (!rawConfig) {
-    return null;
+var MANAGED_REPOS = new Map;
+function setManagedRepos(entries) {
+  const next = new Map;
+  for (const e of entries) {
+    if (next.has(e.id)) {
+      throw new Error(`managed repo already registered: ${e.id}`);
+    }
+    next.set(e.id, e);
   }
-  const entry = stripLegacyTaskConfigMetadata2(rawConfig)[taskId];
-  return isPlainRecord2(entry) ? entry : null;
+  MANAGED_REPOS = next;
 }
-function readRawTaskConfig(configPath) {
-  if (!existsSync12(configPath)) {
-    return null;
+function getManagedRepoEntry(repoId) {
+  const entry = MANAGED_REPOS.get(repoId);
+  if (!entry) {
+    throw new Error(`managed repo not registered: ${repoId}. Plugins contribute repos via RigPlugin.contributes.repoSources; ` + `make sure a plugin declares this id and the plugin host has been initialized.`);
   }
-  const parsed = JSON.parse(readFileSync6(configPath, "utf8"));
-  return isPlainRecord2(parsed) ? parsed : null;
+  return entry;
 }
-function stripLegacyTaskConfigMetadata2(raw) {
-  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
-  return tasks;
+function listManagedRepoEntries() {
+  return Array.from(MANAGED_REPOS.values());
 }
-function listFileBackedTasks(projectRoot, sourcePath) {
-  const directory = resolve12(projectRoot, sourcePath);
-  if (!existsSync12(directory)) {
-    return [];
-  }
-  const tasks = [];
-  for (const name of readdirSync2(directory)) {
-    if (!FILE_TASK_PATTERN.test(name))
-      continue;
-    const inferredId = basename4(name).replace(FILE_TASK_PATTERN, "");
-    const task = readFileBackedTask(projectRoot, sourcePath, inferredId, {});
-    if (task)
-      tasks.push(task);
+function resolveManagedRepoIdByAlias(alias) {
+  for (const entry of MANAGED_REPOS.values()) {
+    if (entry.alias === alias) {
+      return entry.id;
+    }
   }
-  return tasks;
+  return null;
 }
-function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
-  const file = findFileBackedTaskFile(resolve12(projectRoot, sourcePath), taskId);
-  if (!file) {
+function repoRegistrationToManagedEntry(reg) {
+  if (!reg.defaultBranch) {
     return null;
   }
-  const raw = JSON.parse(readFileSync6(file, "utf8"));
-  if (!isPlainRecord2(raw)) {
-    return null;
+  return {
+    id: reg.id,
+    alias: reg.defaultPath ?? reg.id,
+    defaultBranch: reg.defaultBranch,
+    defaultRemoteUrl: reg.url,
+    remoteEnvVar: reg.remoteEnvVar,
+    checkoutEnvVar: reg.checkoutEnvVar
+  };
+}
+
+// packages/runtime/src/control-plane/agent-roles.ts
+function createAgentRoleRegistry(pluginRoles, configOverrides) {
+  const map = new Map;
+  for (const r of pluginRoles) {
+    if (map.has(r.id))
+      throw new Error(`agent role already registered: ${r.id}`);
+    const override = configOverrides?.[r.id];
+    const model = override?.model ?? r.defaultModel;
+    if (!model) {
+      throw new Error(`agent role "${r.id}" has no model \u2014 provide defaultModel in plugin or model in config.runtime.agentRoles.${r.id}`);
+    }
+    map.set(r.id, { ...r, model });
   }
   return {
-    id: typeof raw.id === "string" ? raw.id : taskId,
-    deps: Array.isArray(raw.deps) ? raw.deps : Array.isArray(raw.depends_on) ? raw.depends_on : [],
-    status: typeof raw.status === "string" ? raw.status : "ready",
-    title: typeof raw.title === "string" ? raw.title : typeof rawEntry.title === "string" ? rawEntry.title : taskId,
-    ...raw
+    resolve(id) {
+      const r = map.get(id);
+      if (!r)
+        throw new Error(`agent role not registered: ${id}`);
+      return r;
+    },
+    list: () => Array.from(map.values())
   };
 }
-function findFileBackedTaskFile(directory, taskId) {
-  if (!existsSync12(directory)) {
-    return null;
+
+// packages/runtime/src/control-plane/task-fields.ts
+function createTaskFieldRegistry(extensions) {
+  const byId = new Map;
+  for (const e of extensions) {
+    if (byId.has(e.id))
+      throw new Error(`task field extension already registered: ${e.id}`);
+    byId.set(e.id, e);
   }
-  for (const name of readdirSync2(directory)) {
-    if (!FILE_TASK_PATTERN.test(name))
-      continue;
-    const file = join2(directory, name);
-    try {
-      if (!statSync2(file).isFile())
-        continue;
-      const raw = JSON.parse(readFileSync6(file, "utf8"));
-      const inferredId = basename4(file).replace(FILE_TASK_PATTERN, "");
-      const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
-      if (id === taskId) {
-        return file;
+  return {
+    get: (id) => byId.get(id),
+    list: () => Array.from(byId.values()),
+    fieldNames: () => Array.from(byId.values()).map((e) => e.fieldName),
+    validateTaskFields(task) {
+      const errors = [];
+      for (const ext of byId.values()) {
+        let schema;
+        try {
+          schema = JSON.parse(ext.schemaJson);
+        } catch {
+          errors.push(`task field "${ext.id}": schemaJson is not valid JSON`);
+          continue;
+        }
+        const isRequired = typeof schema === "object" && schema !== null && schema.required === true;
+        if (!isRequired)
+          continue;
+        const value = task[ext.fieldName];
+        if (value === undefined || value === null || value === "") {
+          errors.push(`task field "${ext.fieldName}" (from extension "${ext.id}") is required but missing`);
+        }
       }
-    } catch {}
-  }
-  return null;
+      return errors.length === 0 ? { ok: true } : { ok: false, errors };
+    }
+  };
 }
-function readGithubIssueTask(bin, spawnFn, id, metadata, rawEntry) {
-  const source = requireGithubIssueSource(metadata, id);
-  const issue = runGh(bin, [
-    "issue",
-    "view",
-    String(id),
-    "--repo",
-    `${source.owner}/${source.repo}`,
-    "--json",
-    "number,title,body,labels,state,url,assignees"
-  ], spawnFn);
-  return githubIssueToTask(issue, source, rawEntry);
+
+// packages/runtime/src/control-plane/validators/runtime-registration.ts
+import { existsSync as existsSync9 } from "fs";
+import { join } from "path";
+function createValidatorRegistry() {
+  const map = new Map;
+  const order = [];
+  const registry = {
+    register(v) {
+      if (map.has(v.id))
+        throw new Error(`validator already registered: ${v.id}`);
+      map.set(v.id, v);
+      order.push(v);
+    },
+    resolve(id) {
+      const v = map.get(id);
+      if (!v)
+        throw new Error(`validator not registered: ${id}`);
+      return v;
+    },
+    list: () => order
+  };
+  registerBuiltInValidators(registry);
+  return registry;
 }
-function requireGithubIssueSource(metadata, id) {
-  const source = metadata.taskSource;
-  if (source?.kind === "github-issues" && source.owner && source.repo) {
-    return { owner: source.owner, repo: source.repo };
-  }
-  const parsed = metadata.sourceIssueId?.match(/^([^/]+)\/([^#]+)#(\d+)$/);
-  if (parsed && parsed[3] === id) {
-    return { owner: parsed[1], repo: parsed[2] };
-  }
-  throw new Error(`Task ${id} is marked as github-issues but has no owner/repo source metadata`);
+function registerBuiltInValidators(registry) {
+  registry.register({
+    id: "std:typecheck",
+    category: "custom",
+    description: "Runs the package typecheck script when present.",
+    run: async (ctx) => runStdTypecheck(ctx)
+  });
 }
-function githubIssueToTask(issue, source, rawEntry) {
-  const labelNames = (issue.labels ?? []).map((label) => label.name);
-  const scope = labelNames.filter((label) => label.startsWith("scope:")).map((label) => label.slice("scope:".length));
-  const roleLabel = labelNames.find((label) => label.startsWith("role:"));
-  const validators = labelNames.filter((label) => label.startsWith("validator:")).map((label) => label.slice("validator:".length));
-  const body = issue.body ?? "";
-  const repo = `${source.owner}/${source.repo}`;
+async function runStdTypecheck(ctx) {
+  const packageJsonPath = join(ctx.workspaceRoot, "package.json");
+  if (!existsSync9(packageJsonPath)) {
+    return {
+      id: "std:typecheck",
+      passed: false,
+      summary: `package.json not found at ${packageJsonPath}`
+    };
+  }
+  const proc = Bun.spawn(["bun", "run", "typecheck"], {
+    cwd: ctx.workspaceRoot,
+    env: process.env,
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    proc.exited,
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text()
+  ]);
+  const output = `${stdout}${stderr}`.trim();
   return {
-    id: String(issue.number),
-    deps: parseDeps(body),
-    status: githubStatusFor(issue),
-    title: issue.title,
-    body,
-    ...scope.length > 0 ? { scope } : {},
-    ...roleLabel ? { role: roleLabel.slice("role:".length) } : typeof rawEntry.role === "string" ? { role: rawEntry.role } : {},
-    ...validators.length > 0 ? { validators } : {},
-    ...issue.url ? { url: issue.url } : {},
-    issueType: issueTypeFor(labelNames),
-    sourceIssueId: `${repo}#${issue.number}`,
-    parentChildDeps: parseParents(body),
-    labels: labelNames,
-    raw: issue,
-    source: "github-issues",
-    _rig: {
-      taskSource: { kind: "github-issues", owner: source.owner, repo: source.repo },
-      sourceIssueId: `${repo}#${issue.number}`
-    }
+    id: "std:typecheck",
+    passed: exitCode === 0,
+    summary: exitCode === 0 ? "typecheck passed" : "typecheck failed",
+    ...output ? { details: output.slice(0, 4000) } : {}
   };
 }
-function githubStatusFor(issue) {
-  const state = (issue.state ?? "").toUpperCase();
-  if (state === "CLOSED")
-    return "closed";
-  const labelNames = (issue.labels ?? []).map((label) => label.name);
-  if (labelNames.includes("in-progress"))
-    return "in_progress";
-  if (labelNames.includes("blocked"))
-    return "blocked";
-  if (labelNames.includes("ready"))
-    return "ready";
-  if (labelNames.includes("under-review"))
-    return "under_review";
-  if (labelNames.includes("failed"))
-    return "failed";
-  if (labelNames.includes("cancelled"))
-    return "cancelled";
-  return "open";
+
+// packages/runtime/src/control-plane/native/scope-rules.ts
+var activeRules = null;
+function setScopeRules(rules) {
+  activeRules = rules ?? null;
 }
-function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
+function getScopeRules() {
+  return activeRules;
 }
-function ghSpawnOptions() {
-  return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
+
+// packages/runtime/src/control-plane/hook-materializer.ts
+import { existsSync as existsSync10, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname6, resolve as resolve10 } from "path";
+var MARKER_PLUGIN = "_rigPlugin";
+var MARKER_HOOK_ID = "_rigHookId";
+function matcherToString(matcher) {
+  if (matcher.kind === "all")
+    return;
+  if (matcher.kind === "tool")
+    return matcher.name;
+  return matcher.pattern;
 }
-function runGh(bin, args, spawnFn) {
-  const res = spawnFn(bin, [...args], ghSpawnOptions());
-  assertGhSuccess(args, res);
-  if (!res.stdout || res.stdout.trim() === "") {
-    throw new Error(`gh ${args.join(" ")} returned empty stdout`);
-  }
-  return JSON.parse(res.stdout);
+function isPluginOwned(cmd) {
+  return typeof cmd[MARKER_PLUGIN] === "string";
 }
-function assertGhSuccess(args, res) {
-  if (res.error) {
-    const msg = res.error.message ?? String(res.error);
-    throw new Error(`gh CLI not available \u2014 install gh (brew install gh / apt install gh): ${msg}`);
+function materializeHooks(projectRoot, entries) {
+  const settingsPath = resolve10(projectRoot, ".claude", "settings.json");
+  const existing = existsSync10(settingsPath) ? safeReadJson(settingsPath) : {};
+  const hooks = existing.hooks ?? {};
+  for (const event of Object.keys(hooks)) {
+    const groups = hooks[event] ?? [];
+    const cleaned = [];
+    for (const group of groups) {
+      const operatorHooks = group.hooks.filter((h) => !isPluginOwned(h));
+      if (operatorHooks.length > 0) {
+        cleaned.push({ ...group, hooks: operatorHooks });
+      }
+    }
+    if (cleaned.length > 0) {
+      hooks[event] = cleaned;
+    } else {
+      delete hooks[event];
+    }
   }
-  if (res.status !== 0) {
-    throw new Error(`gh ${args.join(" ")} failed (exit ${res.status}): ${res.stderr}`);
+  for (const { pluginName, hook } of entries) {
+    if (!hook.command) {
+      continue;
+    }
+    const event = hook.event;
+    const matcherString = matcherToString(hook.matcher);
+    const groups = hooks[event] ??= [];
+    let group = groups.find((g) => g.matcher === matcherString);
+    if (!group) {
+      group = matcherString === undefined ? { hooks: [] } : { matcher: matcherString, hooks: [] };
+      groups.push(group);
+    }
+    group.hooks.push({
+      type: "command",
+      command: hook.command,
+      [MARKER_PLUGIN]: pluginName,
+      [MARKER_HOOK_ID]: hook.id
+    });
   }
+  const next = { ...existing };
+  if (Object.keys(hooks).length > 0) {
+    next.hooks = hooks;
+  } else {
+    delete next.hooks;
+  }
+  mkdirSync5(dirname6(settingsPath), { recursive: true });
+  writeFileSync3(settingsPath, `${JSON.stringify(next, null, 2)}
+`, "utf-8");
+  return settingsPath;
 }
-function parseDeps(body) {
-  return parseIssueRefs(body, /^depends-on:\s*([^\n]+)/im);
-}
-function parseParents(body) {
-  return parseIssueRefs(body, /^parents?:\s*([^\n]+)/im);
-}
-function parseIssueRefs(body, pattern) {
-  const match = body.match(pattern);
-  if (!match)
-    return [];
-  return match[1].split(",").map((value) => value.trim()).map((value) => value.replace(/^#/, "").match(/^(\d+)/)?.[1] ?? "").filter((value) => value.length > 0);
-}
-function issueTypeFor(labels) {
-  const typed = labels.find((label) => label.startsWith("type:"));
-  if (typed)
-    return typed.slice("type:".length);
-  if (labels.includes("epic"))
-    return "epic";
-  return "task";
-}
-function isPlainRecord2(candidate) {
-  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
+function safeReadJson(path) {
+  try {
+    return JSON.parse(readFileSync4(path, "utf-8"));
+  } catch {
+    return {};
+  }
 }
 
-// packages/runtime/src/control-plane/tasks/source-lifecycle.ts
-function hasRunnableTaskSource(source) {
-  return Boolean(source && typeof source === "object" && !Array.isArray(source));
+// packages/runtime/src/control-plane/skill-materializer.ts
+import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync5, readdirSync, rmSync as rmSync5, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve11 } from "path";
+import { loadSkill } from "@rig/skill-loader";
+var MARKER_FILENAME = ".rig-plugin";
+function skillDirName(id) {
+  return id.replace(/[^a-zA-Z0-9._-]+/g, "-");
 }
-async function getPluginTask(projectRoot, taskId) {
-  const ctx = await buildPluginHostContext(projectRoot);
-  const [source] = ctx?.taskSourceRegistry.list() ?? [];
-  if (!hasRunnableTaskSource(source)) {
-    return ctx ? { configured: false, sourceKind: null, task: null } : null;
+async function materializeSkills(projectRoot, entries) {
+  const skillsRoot = resolve11(projectRoot, ".pi", "skills");
+  if (existsSync11(skillsRoot)) {
+    for (const name of readdirSync(skillsRoot)) {
+      const dir = resolve11(skillsRoot, name);
+      if (existsSync11(resolve11(dir, MARKER_FILENAME))) {
+        rmSync5(dir, { recursive: true, force: true });
+      }
+    }
   }
-  const task = source.get ? await source.get(taskId) ?? null : (await source.list()).find((entry) => entry.id === taskId) ?? null;
-  return {
-    configured: true,
-    sourceKind: source.kind,
-    task
-  };
-}
-async function readConfiguredTaskSourceTask(projectRoot, taskId) {
-  const pluginResult = await getPluginTask(projectRoot, taskId);
-  if (pluginResult)
-    return pluginResult;
-  const task = await createSourceAwareTaskConfigRecordReader(projectRoot).getTask(taskId);
-  return {
-    configured: false,
-    sourceKind: null,
-    task
-  };
+  const written = [];
+  for (const { pluginName, skill } of entries) {
+    const sourcePath = resolve11(projectRoot, skill.path);
+    if (!existsSync11(sourcePath)) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${sourcePath} does not exist`);
+      continue;
+    }
+    let body;
+    try {
+      await loadSkill(sourcePath);
+      body = readFileSync5(sourcePath, "utf-8");
+    } catch (err) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${err instanceof Error ? err.message : err}`);
+      continue;
+    }
+    const dir = resolve11(skillsRoot, skillDirName(skill.id));
+    mkdirSync6(dir, { recursive: true });
+    writeFileSync4(resolve11(dir, "SKILL.md"), body, "utf-8");
+    writeFileSync4(resolve11(dir, MARKER_FILENAME), `${JSON.stringify({ plugin: pluginName, skillId: skill.id }, null, 2)}
+`, "utf-8");
+    written.push({ id: skill.id, pluginName, directory: dir });
+  }
+  return written;
 }
 
-// packages/runtime/src/control-plane/native/task-state.ts
-import { existsSync as existsSync19, readFileSync as readFileSync10, readdirSync as readdirSync3, statSync as statSync4, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename6, resolve as resolve19 } from "path";
-
-// packages/runtime/src/control-plane/state-sync/types.ts
-var SUPPORTED_TASK_STATE_SCHEMA_VERSION = 1;
-var CANONICAL_TASK_LIFECYCLE_STATUSES = new Set([
-  "draft",
-  "open",
-  "ready",
-  "queued",
-  "in_progress",
-  "under_review",
-  "blocked",
-  "completed",
-  "cancelled"
-]);
-function normalizeTaskLifecycleStatus(status) {
-  switch (status) {
-    case "draft":
-    case "open":
-    case "ready":
-    case "queued":
-    case "in_progress":
-    case "under_review":
-    case "blocked":
-    case "completed":
-    case "cancelled":
-      return status;
-    case "closed":
-      return "completed";
-    case "running":
-      return "in_progress";
-    case "failed":
-      return "ready";
-    default:
+// packages/runtime/src/control-plane/plugin-host-context.ts
+async function buildPluginHostContext(projectRoot) {
+  let config;
+  try {
+    config = await loadConfig(projectRoot);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("no rig.config")) {
       return null;
+    }
+    throw err;
   }
-}
-function normalizeTaskStateMetadataStatus(status) {
-  if (CANONICAL_TASK_LIFECYCLE_STATUSES.has(status)) {
-    return status;
-  }
-  switch (status) {
-    case "closed":
-      return "completed";
-    case "running":
-      return "in_progress";
-    case "failed":
-      return "ready";
-    default:
-      return;
+  const pluginHost = createPluginHost(config.plugins);
+  setScopeRules(config.workspace.scopeNormalization);
+  const validatorRegistry = createValidatorRegistry();
+  for (const impl of pluginHost.listExecutableValidators()) {
+    validatorRegistry.register(impl);
   }
-}
-function canonicalizeTaskStateMetadata(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    return null;
+  const taskSourceRegistry = buildTaskSourceRegistry(config, pluginHost);
+  const repoRegistry = createRepoRegistry(pluginHost.listRepoSources());
+  const managedEntries = pluginHost.listRepoSources().map(repoRegistrationToManagedEntry).filter((e) => e !== null);
+  setManagedRepos(managedEntries);
+  const configRoleOverrides = config.runtime?.agentRoles;
+  const agentRoleRegistry = createAgentRoleRegistry(pluginHost.listAgentRoles(), configRoleOverrides);
+  const taskFieldRegistry = createTaskFieldRegistry(pluginHost.listTaskFieldExtensions());
+  try {
+    const hookEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.hooks ?? []).map((hook) => ({
+      pluginName: plugin.name,
+      hook
+    })));
+    if (hookEntries.length > 0) {
+      materializeHooks(projectRoot, hookEntries);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] hook materialization failed: ${err instanceof Error ? err.message : err}`);
   }
-  const metadata = raw;
-  const claimId = typeof metadata.claimId === "string" && metadata.claimId.length > 0 ? metadata.claimId : undefined;
-  const status = normalizeTaskStateMetadataStatus(metadata.status);
-  if (!status) {
-    return null;
+  try {
+    const skillEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.skills ?? []).map((skill) => ({
+      pluginName: plugin.name,
+      skill
+    })));
+    if (skillEntries.length > 0) {
+      await materializeSkills(projectRoot, skillEntries);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] skill materialization failed: ${err instanceof Error ? err.message : err}`);
   }
   return {
-    ...claimId ? { claimId } : {},
-    status,
-    ...typeof metadata.ownerId === "string" && metadata.ownerId.length > 0 ? { ownerId: metadata.ownerId } : {},
-    ...typeof metadata.claimedAt === "string" && metadata.claimedAt.length > 0 ? { claimedAt: metadata.claimedAt } : {},
-    ...typeof metadata.lastEvidenceAt === "string" && metadata.lastEvidenceAt.length > 0 ? { lastEvidenceAt: metadata.lastEvidenceAt } : {},
-    ...typeof metadata.runId === "string" && metadata.runId.length > 0 ? { runId: metadata.runId } : {},
-    ...typeof metadata.branchName === "string" && metadata.branchName.length > 0 ? { branchName: metadata.branchName } : {},
-    ...typeof metadata.prNumber === "number" ? { prNumber: metadata.prNumber } : {},
-    ...typeof metadata.prUrl === "string" && metadata.prUrl.length > 0 ? { prUrl: metadata.prUrl } : {},
-    ...typeof metadata.reviewState === "string" && metadata.reviewState.length > 0 ? { reviewState: metadata.reviewState } : {},
-    ...typeof metadata.blockerReason === "string" && metadata.blockerReason.length > 0 ? { blockerReason: metadata.blockerReason } : {},
-    ...typeof metadata.sourceCommit === "string" && metadata.sourceCommit.length > 0 ? { sourceCommit: metadata.sourceCommit } : {}
+    config,
+    pluginHost,
+    validatorRegistry,
+    taskSourceRegistry,
+    repoRegistry,
+    agentRoleRegistry,
+    taskFieldRegistry
   };
 }
-function discardMismatchedTaskStateMetadata(input) {
-  input.taskId;
-  const canonicalMetadata = canonicalizeTaskStateMetadata(input.metadata);
-  if (!canonicalMetadata || !input.lifecycleStatus) {
-    return null;
-  }
-  const metadataStatus = canonicalMetadata.status ?? null;
-  if (metadataStatus && metadataStatus !== input.lifecycleStatus) {
-    return null;
-  }
-  return canonicalMetadata;
+
+// packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync13, readFileSync as readFileSync7, readdirSync as readdirSync2, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
+import { basename as basename4, join as join2, resolve as resolve13 } from "path";
+
+// packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
+import { existsSync as existsSync12, readFileSync as readFileSync6 } from "fs";
+import { resolve as resolve12 } from "path";
+
+// packages/runtime/src/control-plane/tasks/task-record-reader.ts
+async function findTaskById(reader, id) {
+  const tasks = await reader.listTasks();
+  return tasks.find((task) => task.id === id) ?? null;
 }
-function readTaskStateMetadataEnvelope(raw) {
-  if (!raw || typeof raw !== "object") {
-    return { schemaVersion: SUPPORTED_TASK_STATE_SCHEMA_VERSION, supported: true, baseTrackerCommit: null, tasks: {} };
-  }
-  const envelope = raw;
-  const schemaVersion = typeof envelope.schemaVersion === "number" ? envelope.schemaVersion : SUPPORTED_TASK_STATE_SCHEMA_VERSION;
-  if (schemaVersion !== SUPPORTED_TASK_STATE_SCHEMA_VERSION) {
-    return { schemaVersion, supported: false, baseTrackerCommit: null, tasks: {} };
-  }
-  const rawTasks = envelope.tasks && typeof envelope.tasks === "object" && !Array.isArray(envelope.tasks) ? envelope.tasks : {};
-  const tasks = Object.fromEntries(Object.entries(rawTasks).map(([taskId, metadata]) => [taskId, canonicalizeTaskStateMetadata(metadata)]).filter((entry) => entry[1] != null));
-  return {
-    schemaVersion,
-    supported: true,
-    baseTrackerCommit: typeof envelope.baseTrackerCommit === "string" && envelope.baseTrackerCommit.length > 0 ? envelope.baseTrackerCommit : null,
-    tasks
+
+// packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
+class LegacyTaskConfigReadError extends Error {
+  code = "LEGACY_TASK_CONFIG_READ_FAILED";
+  projectRoot;
+  configPath;
+  cause;
+  constructor(input) {
+    super(input.message, { cause: input.cause });
+    this.name = "LegacyTaskConfigReadError";
+    this.projectRoot = input.projectRoot;
+    this.configPath = input.configPath;
+    this.cause = input.cause;
+  }
+}
+function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
+  const configPath = options.configPath ?? resolve12(projectRoot, ".rig", "task-config.json");
+  const reader = {
+    async listTasks() {
+      return readLegacyTaskRecords(projectRoot, configPath);
+    },
+    async getTask(id) {
+      return findTaskById(reader, id);
+    }
   };
+  return reader;
 }
-// packages/runtime/src/control-plane/state-sync/read.ts
-import { existsSync as existsSync18, readFileSync as readFileSync9 } from "fs";
-import { resolve as resolve18 } from "path";
-
-// packages/runtime/src/control-plane/native/git-native.ts
-import { chmodSync as chmodSync3, copyFileSync as copyFileSync3, existsSync as existsSync13, mkdirSync as mkdirSync6, readFileSync as readFileSync7, renameSync, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
-import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname6, isAbsolute, resolve as resolve13 } from "path";
-import { createHash } from "crypto";
-var sharedGitNativeOutputDir = resolve13(tmpdir3(), "rig-native");
-var sharedGitNativeOutputPath = resolve13(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
-var trackerCommandUsageProbe = "usage: rig-git fetch-ref <repo-path> <remote> <branch>";
-function temporaryGitBinaryOutputPath(outputPath) {
-  const suffix = process.platform === "win32" ? ".exe" : "";
-  return resolve13(dirname6(outputPath), `.rig-git-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}${suffix}`);
+function readLegacyTaskRecords(projectRoot, configPath = resolve12(projectRoot, ".rig", "task-config.json")) {
+  if (!existsSync12(configPath)) {
+    return [];
+  }
+  const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
+  return Object.entries(stripLegacyTaskConfigMetadata(rawConfig)).map(([id, entry]) => legacyTaskConfigEntryToRecord(id, entry)).filter((record) => record !== null);
 }
-function publishGitBinary(tempOutputPath, outputPath) {
+function readLegacyTaskConfigJson(projectRoot, configPath) {
   try {
-    renameSync(tempOutputPath, outputPath);
-  } catch (error) {
-    if (process.platform === "win32" && existsSync13(outputPath)) {
-      rmSync5(outputPath, { force: true });
-      renameSync(tempOutputPath, outputPath);
-      return;
+    const parsed = JSON.parse(readFileSync6(configPath, "utf8"));
+    if (isPlainRecord(parsed)) {
+      return parsed;
     }
-    throw error;
+    throw new Error("task config root must be a JSON object");
+  } catch (cause) {
+    throw new LegacyTaskConfigReadError({
+      projectRoot,
+      configPath,
+      message: `Could not read legacy task config at ${configPath} for project ${projectRoot}: ${cause instanceof Error ? cause.message : String(cause)}`,
+      cause
+    });
   }
 }
-function runtimeRigGitFileName() {
-  return `rig-git${process.platform === "win32" ? ".exe" : ""}`;
-}
-function rigGitSourceCandidates() {
-  const execDir = process.execPath?.trim() ? dirname6(process.execPath.trim()) : "";
-  const cwd = process.cwd()?.trim() || "";
-  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
-  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
-  const moduleRelativeSource = resolve13(import.meta.dir, "../../../native/rig-git.zig");
-  return [...new Set([
-    process.env.RIG_NATIVE_GIT_SOURCE?.trim() || "",
-    moduleRelativeSource,
-    projectRoot ? resolve13(projectRoot, "packages/runtime/native/rig-git.zig") : "",
-    hostProjectRoot ? resolve13(hostProjectRoot, "packages/runtime/native/rig-git.zig") : "",
-    cwd ? resolve13(cwd, "packages/runtime/native/rig-git.zig") : "",
-    execDir ? resolve13(execDir, "..", "..", "packages/runtime/native/rig-git.zig") : "",
-    execDir ? resolve13(execDir, "..", "native", "rig-git.zig") : ""
-  ].filter(Boolean))];
+function stripLegacyTaskConfigMetadata(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
 }
-function nativePackageBinaryCandidates3(fromDir, fileName) {
-  const candidates = [];
-  let cursor = resolve13(fromDir);
-  for (let index = 0;index < 8; index += 1) {
-    candidates.push(resolve13(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve13(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve13(cursor, "native", fileName), resolve13(cursor, "native", "bin", fileName));
-    const parent = dirname6(cursor);
-    if (parent === cursor)
-      break;
-    cursor = parent;
+function legacyTaskConfigEntryToRecord(id, entry) {
+  if (!isPlainRecord(entry)) {
+    return null;
   }
-  return candidates;
-}
-function rigGitBinaryCandidates() {
-  const execDir = process.execPath?.trim() ? dirname6(process.execPath.trim()) : "";
-  const fileName = runtimeRigGitFileName();
-  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
-  return [...new Set([
-    explicit,
-    ...nativePackageBinaryCandidates3(import.meta.dir, fileName),
-    execDir ? resolve13(execDir, fileName) : "",
-    execDir ? resolve13(execDir, "..", fileName) : "",
-    execDir ? resolve13(execDir, "..", "bin", fileName) : "",
-    sharedGitNativeOutputPath
-  ].filter(Boolean))];
+  const deps = firstStringList(entry.deps, entry.dependencies, entry.validation_deps, entry.validationDeps);
+  const validation = readStringList(entry.validation);
+  const validators = readStringList(entry.validators);
+  const scope = readStringList(entry.scope);
+  const status = typeof entry.status === "string" ? entry.status : "open";
+  const title = typeof entry.title === "string" ? entry.title : undefined;
+  const description = typeof entry.description === "string" ? entry.description : undefined;
+  const acceptanceCriteria = typeof entry.acceptance_criteria === "string" ? entry.acceptance_criteria : typeof entry.acceptanceCriteria === "string" ? entry.acceptanceCriteria : undefined;
+  return {
+    id,
+    deps,
+    status,
+    source: "legacy-task-config",
+    ...title ? { title } : {},
+    ...description ? { description } : {},
+    ...acceptanceCriteria ? { acceptanceCriteria } : {},
+    ...scope.length > 0 ? { scope } : {},
+    ...validation.length > 0 ? { validation } : {},
+    ...validators.length > 0 ? { validators } : {},
+    ...preservedLegacyFields(entry)
+  };
 }
-function resolveGitSourcePath() {
-  for (const candidate of rigGitSourceCandidates()) {
-    if (candidate && existsSync13(candidate)) {
-      return candidate;
+function preservedLegacyFields(entry) {
+  const preserved = {};
+  for (const key of [
+    "role",
+    "browser",
+    "repo_pins",
+    "criticality",
+    "queue_weight",
+    "creates_repo",
+    "auto_synced"
+  ]) {
+    if (entry[key] !== undefined) {
+      preserved[key] = entry[key];
     }
   }
-  return null;
+  return preserved;
 }
-function resolveGitBinaryPath() {
-  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
-    return null;
-  }
-  for (const candidate of rigGitBinaryCandidates()) {
-    if (candidate && existsSync13(candidate)) {
-      return candidate;
+function firstStringList(...candidates) {
+  for (const candidate of candidates) {
+    const list = readStringList(candidate);
+    if (list.length > 0) {
+      return list;
     }
   }
-  return null;
-}
-function preferredGitBinaryOutputPath() {
-  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
-  return explicit || sharedGitNativeOutputPath;
+  return [];
 }
-function binarySupportsTrackerCommandsSync(binaryPath) {
-  try {
-    const probe = Bun.spawnSync([binaryPath, "fetch-ref", "."], {
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    const stdout = probe.stdout.toString().trim();
-    const stderr = probe.stderr.toString().trim();
-    if (stdout.includes('"error":"unknown command"')) {
-      return false;
-    }
-    return probe.exitCode === 2 && stderr.includes(trackerCommandUsageProbe);
-  } catch {
-    return false;
+function readStringList(candidate) {
+  if (!Array.isArray(candidate)) {
+    return [];
   }
+  return candidate.filter((value) => typeof value === "string");
 }
-function nativeBuildManifestPath3(outputPath) {
-  return `${outputPath}.build-manifest.json`;
+function isPlainRecord(candidate) {
+  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
 }
-async function hasMatchingNativeBuildManifest3(manifestPath, buildKey) {
-  if (!existsSync13(manifestPath)) {
-    return false;
+
+// packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
+var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
+var FILE_TASK_PATTERN = /\.(task\.)?json$/;
+function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
+  const configPath = options.configPath ?? resolve13(projectRoot, ".rig", "task-config.json");
+  const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
+  const spawnFn = options.spawn ?? spawnSync;
+  const ghBinary = options.ghBinary ?? "gh";
+  const allowLocalFallback = options.allowLocalTaskConfigStatusFallback ?? true;
+  return {
+    async listTasks() {
+      const rawConfig = readRawTaskConfig(configPath);
+      if (!rawConfig) {
+        const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
+        return configuredFilesPath ? listFileBackedTasks(projectRoot, configuredFilesPath) : [];
+      }
+      const tasks = [];
+      const legacyTasks = await legacy.listTasks();
+      const legacyById = new Map(legacyTasks.map((task) => [task.id, task]));
+      for (const [id, rawEntry] of Object.entries(stripLegacyTaskConfigMetadata2(rawConfig))) {
+        if (!isPlainRecord2(rawEntry)) {
+          continue;
+        }
+        const metadata = readMaterializedTaskMetadata(rawEntry);
+        if (metadata.taskSource?.kind === "github-issues") {
+          tasks.push(readGithubIssueTask(ghBinary, spawnFn, id, metadata, rawEntry));
+          continue;
+        }
+        if (metadata.taskSource?.kind === "files" && metadata.taskSource.path) {
+          const fileTask = readFileBackedTask(projectRoot, metadata.taskSource.path, id, rawEntry);
+          if (fileTask)
+            tasks.push(fileTask);
+          continue;
+        }
+        if (!allowLocalFallback) {
+          continue;
+        }
+        const legacyTask = legacyById.get(id);
+        if (legacyTask) {
+          tasks.push(legacyTask);
+        }
+      }
+      return tasks;
+    },
+    async getTask(id) {
+      const rawEntry = readRawTaskEntry(configPath, id);
+      if (!rawEntry) {
+        const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
+        return configuredFilesPath ? readFileBackedTask(projectRoot, configuredFilesPath, id, {}) : null;
+      }
+      const metadata = readMaterializedTaskMetadata(rawEntry);
+      if (metadata.taskSource?.kind === "github-issues") {
+        return readGithubIssueTask(ghBinary, spawnFn, id, metadata, rawEntry);
+      }
+      if (metadata.taskSource?.kind === "files" && metadata.taskSource.path) {
+        return readFileBackedTask(projectRoot, metadata.taskSource.path, id, rawEntry);
+      }
+      return allowLocalFallback ? legacy.getTask(id) : null;
+    }
+  };
+}
+function readMaterializedTaskMetadata(entry) {
+  const rawRig = entry._rig;
+  if (!isPlainRecord2(rawRig)) {
+    return {};
   }
-  try {
-    const manifest = await Bun.file(manifestPath).json();
-    return manifest.version === 1 && manifest.buildKey === buildKey;
-  } catch {
-    return false;
+  const rawSource = rawRig.taskSource;
+  const metadata = {};
+  if (isPlainRecord2(rawSource)) {
+    const kind = typeof rawSource.kind === "string" ? rawSource.kind : "";
+    if (kind.length > 0) {
+      metadata.taskSource = {
+        kind,
+        ...typeof rawSource.path === "string" ? { path: rawSource.path } : {},
+        ...typeof rawSource.owner === "string" ? { owner: rawSource.owner } : {},
+        ...typeof rawSource.repo === "string" ? { repo: rawSource.repo } : {},
+        ...Array.isArray(rawSource.labels) ? { labels: rawSource.labels.filter((label) => typeof label === "string") } : {},
+        ...rawSource.state === "open" || rawSource.state === "closed" || rawSource.state === "all" ? { state: rawSource.state } : {}
+      };
+    }
+  }
+  if (typeof rawRig.sourceIssueId === "string") {
+    metadata.sourceIssueId = rawRig.sourceIssueId;
+  }
+  return metadata;
+}
+function readConfiguredFilesTaskSourcePath(projectRoot) {
+  const jsonPath = resolve13(projectRoot, "rig.config.json");
+  if (existsSync13(jsonPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync7(jsonPath, "utf8"));
+      if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
+        const source = parsed.taskSource;
+        return source.kind === "files" && typeof source.path === "string" ? source.path : null;
+      }
+    } catch {
+      return null;
+    }
   }
-}
-function hasMatchingNativeBuildManifestSync(manifestPath, buildKey) {
-  if (!existsSync13(manifestPath)) {
-    return false;
+  const tsPath = resolve13(projectRoot, "rig.config.ts");
+  if (!existsSync13(tsPath)) {
+    return null;
   }
   try {
-    const manifest = JSON.parse(readFileSync7(manifestPath, "utf8"));
-    return manifest.version === 1 && manifest.buildKey === buildKey;
+    const source = readFileSync7(tsPath, "utf8");
+    const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
+    const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
+    if (kind !== "files") {
+      return null;
+    }
+    return taskSourceBlock.match(/path\s*:\s*["']([^"']+)["']/)?.[1] ?? null;
   } catch {
-    return false;
+    return null;
   }
 }
-async function sha256File3(path) {
-  const hasher = new Bun.CryptoHasher("sha256");
-  hasher.update(await Bun.file(path).arrayBuffer());
-  return hasher.digest("hex");
-}
-function sha256FileSync(path) {
-  return createHash("sha256").update(readFileSync7(path)).digest("hex");
-}
-async function ensureRigGitBinaryPath(outputPath = sharedGitNativeOutputPath) {
-  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
-    throw new Error("Zig native git is disabled via RIG_DISABLE_ZIG_NATIVE=1");
-  }
-  const sourcePath = resolveGitSourcePath();
-  if (!sourcePath) {
-    const binaryPath = resolveGitBinaryPath();
-    if (binaryPath) {
-      return binaryPath;
-    }
-    throw new Error("rig-git.zig source file not found.");
+function readRawTaskEntry(configPath, taskId) {
+  const rawConfig = readRawTaskConfig(configPath);
+  if (!rawConfig) {
+    return null;
   }
-  const zigBinary = Bun.which("zig");
-  if (!zigBinary) {
-    throw new Error("zig is required to build native Rig git tools.");
+  const entry = stripLegacyTaskConfigMetadata2(rawConfig)[taskId];
+  return isPlainRecord2(entry) ? entry : null;
+}
+function readRawTaskConfig(configPath) {
+  if (!existsSync13(configPath)) {
+    return null;
   }
-  mkdirSync6(dirname6(outputPath), { recursive: true });
-  const sourceDigest = await sha256File3(sourcePath);
-  const buildKey = JSON.stringify({
-    version: 1,
-    zigBinary,
-    platform: process.platform,
-    arch: process.arch,
-    sourcePath,
-    sourceDigest
-  });
-  const manifestPath = nativeBuildManifestPath3(outputPath);
-  const needsBuild = !existsSync13(outputPath) || !await hasMatchingNativeBuildManifest3(manifestPath, buildKey) || !binarySupportsTrackerCommandsSync(outputPath);
-  if (!needsBuild) {
-    chmodSync3(outputPath, 493);
-    return outputPath;
+  const parsed = JSON.parse(readFileSync7(configPath, "utf8"));
+  return isPlainRecord2(parsed) ? parsed : null;
+}
+function stripLegacyTaskConfigMetadata2(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function listFileBackedTasks(projectRoot, sourcePath) {
+  const directory = resolve13(projectRoot, sourcePath);
+  if (!existsSync13(directory)) {
+    return [];
   }
-  const tempOutputPath = temporaryGitBinaryOutputPath(outputPath);
-  const build = Bun.spawn([
-    zigBinary,
-    "build-exe",
-    sourcePath,
-    "-O",
-    "ReleaseFast",
-    `-femit-bin=${tempOutputPath}`
-  ], {
-    cwd: dirname6(sourcePath),
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    build.exited,
-    new Response(build.stdout).text(),
-    new Response(build.stderr).text()
-  ]);
-  if (exitCode !== 0 || !existsSync13(tempOutputPath)) {
-    const details = [stderr.trim(), stdout.trim()].filter(Boolean).join(`
-`);
-    throw new Error(`Failed to build native Rig git tools: ${details || `zig exited with code ${exitCode}`}`);
+  const tasks = [];
+  for (const name of readdirSync2(directory)) {
+    if (!FILE_TASK_PATTERN.test(name))
+      continue;
+    const inferredId = basename4(name).replace(FILE_TASK_PATTERN, "");
+    const task = readFileBackedTask(projectRoot, sourcePath, inferredId, {});
+    if (task)
+      tasks.push(task);
   }
-  chmodSync3(tempOutputPath, 493);
-  if (existsSync13(outputPath) && await hasMatchingNativeBuildManifest3(manifestPath, buildKey)) {
-    rmSync5(tempOutputPath, { force: true });
-    chmodSync3(outputPath, 493);
-    return outputPath;
+  return tasks;
+}
+function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
+  const file = findFileBackedTaskFile(resolve13(projectRoot, sourcePath), taskId);
+  if (!file) {
+    return null;
   }
-  publishGitBinary(tempOutputPath, outputPath);
-  if (!binarySupportsTrackerCommandsSync(outputPath)) {
-    rmSync5(outputPath, { force: true });
-    throw new Error("Failed to build native Rig git tools: tracker command probe failed");
+  const raw = JSON.parse(readFileSync7(file, "utf8"));
+  if (!isPlainRecord2(raw)) {
+    return null;
   }
-  await Bun.write(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
-`);
-  return outputPath;
+  return {
+    id: typeof raw.id === "string" ? raw.id : taskId,
+    deps: Array.isArray(raw.deps) ? raw.deps : Array.isArray(raw.depends_on) ? raw.depends_on : [],
+    status: typeof raw.status === "string" ? raw.status : "ready",
+    title: typeof raw.title === "string" ? raw.title : typeof rawEntry.title === "string" ? rawEntry.title : taskId,
+    ...raw
+  };
 }
-function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath()) {
-  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
-    throw new Error("Zig native git is disabled via RIG_DISABLE_ZIG_NATIVE=1");
+function findFileBackedTaskFile(directory, taskId) {
+  if (!existsSync13(directory)) {
+    return null;
   }
-  const sourcePath = resolveGitSourcePath();
-  if (!sourcePath) {
-    const binaryPath = resolveGitBinaryPath();
-    if (binaryPath) {
-      return binaryPath;
-    }
-    throw new Error("rig-git.zig source file not found.");
+  for (const name of readdirSync2(directory)) {
+    if (!FILE_TASK_PATTERN.test(name))
+      continue;
+    const file = join2(directory, name);
+    try {
+      if (!statSync2(file).isFile())
+        continue;
+      const raw = JSON.parse(readFileSync7(file, "utf8"));
+      const inferredId = basename4(file).replace(FILE_TASK_PATTERN, "");
+      const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
+      if (id === taskId) {
+        return file;
+      }
+    } catch {}
   }
-  const zigBinary = Bun.which("zig");
-  if (!zigBinary) {
-    throw new Error("zig is required to build native Rig git tools.");
+  return null;
+}
+function readGithubIssueTask(bin, spawnFn, id, metadata, rawEntry) {
+  const source = requireGithubIssueSource(metadata, id);
+  const issue = runGh(bin, [
+    "issue",
+    "view",
+    String(id),
+    "--repo",
+    `${source.owner}/${source.repo}`,
+    "--json",
+    "number,title,body,labels,state,url,assignees"
+  ], spawnFn);
+  return githubIssueToTask(issue, source, rawEntry);
+}
+function requireGithubIssueSource(metadata, id) {
+  const source = metadata.taskSource;
+  if (source?.kind === "github-issues" && source.owner && source.repo) {
+    return { owner: source.owner, repo: source.repo };
   }
-  mkdirSync6(dirname6(outputPath), { recursive: true });
-  const sourceDigest = sha256FileSync(sourcePath);
-  const buildKey = JSON.stringify({
-    version: 1,
-    zigBinary,
-    platform: process.platform,
-    arch: process.arch,
-    sourcePath,
-    sourceDigest
-  });
-  const manifestPath = nativeBuildManifestPath3(outputPath);
-  const needsBuild = !existsSync13(outputPath) || !hasMatchingNativeBuildManifestSync(manifestPath, buildKey) || !binarySupportsTrackerCommandsSync(outputPath);
-  if (!needsBuild) {
-    chmodSync3(outputPath, 493);
-    return outputPath;
+  const parsed = metadata.sourceIssueId?.match(/^([^/]+)\/([^#]+)#(\d+)$/);
+  if (parsed && parsed[3] === id) {
+    return { owner: parsed[1], repo: parsed[2] };
   }
-  const tempOutputPath = temporaryGitBinaryOutputPath(outputPath);
-  const build = Bun.spawnSync([
-    zigBinary,
-    "build-exe",
-    sourcePath,
-    "-O",
-    "ReleaseFast",
-    `-femit-bin=${tempOutputPath}`
-  ], {
-    cwd: dirname6(sourcePath),
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  if (build.exitCode !== 0 || !existsSync13(tempOutputPath)) {
-    const stderr = build.stderr.toString().trim();
-    const stdout = build.stdout.toString().trim();
-    const details = [stderr, stdout].filter(Boolean).join(`
-`);
-    throw new Error(`Failed to build native Rig git tools: ${details || `zig exited with code ${build.exitCode}`}`);
+  throw new Error(`Task ${id} is marked as github-issues but has no owner/repo source metadata`);
+}
+function githubIssueToTask(issue, source, rawEntry) {
+  const labelNames = (issue.labels ?? []).map((label) => label.name);
+  const scope = labelNames.filter((label) => label.startsWith("scope:")).map((label) => label.slice("scope:".length));
+  const roleLabel = labelNames.find((label) => label.startsWith("role:"));
+  const validators = labelNames.filter((label) => label.startsWith("validator:")).map((label) => label.slice("validator:".length));
+  const body = issue.body ?? "";
+  const repo = `${source.owner}/${source.repo}`;
+  return {
+    id: String(issue.number),
+    deps: parseDeps(body),
+    status: githubStatusFor(issue),
+    title: issue.title,
+    body,
+    ...scope.length > 0 ? { scope } : {},
+    ...roleLabel ? { role: roleLabel.slice("role:".length) } : typeof rawEntry.role === "string" ? { role: rawEntry.role } : {},
+    ...validators.length > 0 ? { validators } : {},
+    ...issue.url ? { url: issue.url } : {},
+    issueType: issueTypeFor(labelNames),
+    sourceIssueId: `${repo}#${issue.number}`,
+    parentChildDeps: parseParents(body),
+    labels: labelNames,
+    raw: issue,
+    source: "github-issues",
+    _rig: {
+      taskSource: { kind: "github-issues", owner: source.owner, repo: source.repo },
+      sourceIssueId: `${repo}#${issue.number}`
+    }
+  };
+}
+function githubStatusFor(issue) {
+  const state = (issue.state ?? "").toUpperCase();
+  if (state === "CLOSED")
+    return "closed";
+  const labelNames = (issue.labels ?? []).map((label) => label.name);
+  if (labelNames.includes("in-progress"))
+    return "in_progress";
+  if (labelNames.includes("blocked"))
+    return "blocked";
+  if (labelNames.includes("ready"))
+    return "ready";
+  if (labelNames.includes("under-review"))
+    return "under_review";
+  if (labelNames.includes("failed"))
+    return "failed";
+  if (labelNames.includes("cancelled"))
+    return "cancelled";
+  return "open";
+}
+function selectedGitHubEnv() {
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
+}
+function ghSpawnOptions() {
+  return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
+}
+function runGh(bin, args, spawnFn) {
+  const res = spawnFn(bin, [...args], ghSpawnOptions());
+  assertGhSuccess(args, res);
+  if (!res.stdout || res.stdout.trim() === "") {
+    throw new Error(`gh ${args.join(" ")} returned empty stdout`);
   }
-  chmodSync3(tempOutputPath, 493);
-  if (existsSync13(outputPath) && hasMatchingNativeBuildManifestSync(manifestPath, buildKey)) {
-    rmSync5(tempOutputPath, { force: true });
-    chmodSync3(outputPath, 493);
-    return outputPath;
+  return JSON.parse(res.stdout);
+}
+function assertGhSuccess(args, res) {
+  if (res.error) {
+    const msg = res.error.message ?? String(res.error);
+    throw new Error(`gh CLI not available \u2014 install gh (brew install gh / apt install gh): ${msg}`);
   }
-  publishGitBinary(tempOutputPath, outputPath);
-  if (!binarySupportsTrackerCommandsSync(outputPath)) {
-    rmSync5(outputPath, { force: true });
-    throw new Error("Failed to build native Rig git tools: tracker command probe failed");
+  if (res.status !== 0) {
+    throw new Error(`gh ${args.join(" ")} failed (exit ${res.status}): ${res.stderr}`);
   }
-  writeFileSync5(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
-`, "utf8");
-  return outputPath;
 }
-async function materializeRigGitBinary(targetDir) {
-  const sourcePath = await ensureRigGitBinaryPath();
-  const targetPath = resolve13(targetDir, runtimeRigGitFileName());
-  mkdirSync6(targetDir, { recursive: true });
-  const sourceDigest = await sha256File3(sourcePath);
-  const buildKey = JSON.stringify({
-    version: 1,
-    sourcePath,
-    sourceDigest
-  });
-  const needsCopy = !existsSync13(targetPath) || !await hasMatchingNativeBuildManifest3(nativeBuildManifestPath3(targetPath), buildKey);
-  if (needsCopy) {
-    copyFileSync3(sourcePath, targetPath);
-    chmodSync3(targetPath, 493);
-    await Bun.write(nativeBuildManifestPath3(targetPath), `${JSON.stringify({ version: 1, buildKey }, null, 2)}
-`);
+function parseDeps(body) {
+  return parseIssueRefs(body, /^depends-on:\s*([^\n]+)/im);
+}
+function parseParents(body) {
+  return parseIssueRefs(body, /^parents?:\s*([^\n]+)/im);
+}
+function parseIssueRefs(body, pattern) {
+  const match = body.match(pattern);
+  if (!match)
+    return [];
+  return match[1].split(",").map((value) => value.trim()).map((value) => value.replace(/^#/, "").match(/^(\d+)/)?.[1] ?? "").filter((value) => value.length > 0);
+}
+function issueTypeFor(labels) {
+  const typed = labels.find((label) => label.startsWith("type:"));
+  if (typed)
+    return typed.slice("type:".length);
+  if (labels.includes("epic"))
+    return "epic";
+  return "task";
+}
+function isPlainRecord2(candidate) {
+  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
+}
+
+// packages/runtime/src/control-plane/tasks/source-lifecycle.ts
+function hasRunnableTaskSource(source) {
+  return Boolean(source && typeof source === "object" && !Array.isArray(source));
+}
+async function getPluginTask(projectRoot, taskId) {
+  const ctx = await buildPluginHostContext(projectRoot);
+  const [source] = ctx?.taskSourceRegistry.list() ?? [];
+  if (!hasRunnableTaskSource(source)) {
+    return ctx ? { configured: false, sourceKind: null, task: null } : null;
   }
-  return targetPath;
+  const task = source.get ? await source.get(taskId) ?? null : (await source.list()).find((entry) => entry.id === taskId) ?? null;
+  return {
+    configured: true,
+    sourceKind: source.kind,
+    task
+  };
 }
-function runGitNative(command, args) {
-  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
-    return { ok: false, error: "rig-git native disabled" };
+async function readConfiguredTaskSourceTask(projectRoot, taskId) {
+  const pluginResult = await getPluginTask(projectRoot, taskId);
+  if (pluginResult)
+    return pluginResult;
+  const task = await createSourceAwareTaskConfigRecordReader(projectRoot).getTask(taskId);
+  return {
+    configured: false,
+    sourceKind: null,
+    task
+  };
+}
+
+// packages/runtime/src/control-plane/native/task-state.ts
+import { existsSync as existsSync19, readFileSync as readFileSync10, readdirSync as readdirSync3, statSync as statSync4, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename6, resolve as resolve19 } from "path";
+
+// packages/runtime/src/control-plane/state-sync/types.ts
+var SUPPORTED_TASK_STATE_SCHEMA_VERSION = 1;
+var CANONICAL_TASK_LIFECYCLE_STATUSES = new Set([
+  "draft",
+  "open",
+  "ready",
+  "queued",
+  "in_progress",
+  "under_review",
+  "blocked",
+  "completed",
+  "cancelled"
+]);
+function normalizeTaskLifecycleStatus(status) {
+  switch (status) {
+    case "draft":
+    case "open":
+    case "ready":
+    case "queued":
+    case "in_progress":
+    case "under_review":
+    case "blocked":
+    case "completed":
+    case "cancelled":
+      return status;
+    case "closed":
+      return "completed";
+    case "running":
+      return "in_progress";
+    case "failed":
+      return "ready";
+    default:
+      return null;
   }
-  const trackerCommand = command === "fetch-ref" || command === "read-blob-at-ref" || command === "write-tree-commit" || command === "push-ref-with-lease";
-  let binaryPath = null;
-  if (trackerCommand) {
-    try {
-      binaryPath = ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      if (message.includes("rig-git.zig source file not found")) {
-        return { ok: false, error: "rig-git binary not found" };
-      }
-      return { ok: false, error: message };
-    }
-  } else {
-    const explicitBinaryPath = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
-    binaryPath = explicitBinaryPath && existsSync13(explicitBinaryPath) ? explicitBinaryPath : !explicitBinaryPath ? resolveGitBinaryPath() : null;
-    if (!binaryPath) {
-      try {
-        binaryPath = ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        if (message.includes("rig-git.zig source file not found")) {
-          return { ok: false, error: "rig-git binary not found" };
-        }
-        return { ok: false, error: message };
-      }
-    }
+}
+function normalizeTaskStateMetadataStatus(status) {
+  if (CANONICAL_TASK_LIFECYCLE_STATUSES.has(status)) {
+    return status;
   }
-  try {
-    const proc = Bun.spawnSync([binaryPath, command, ...args], {
-      stdout: "pipe",
-      stderr: "pipe",
-      env: process.env
-    });
-    if (proc.exitCode !== 0) {
-      const stdoutText = proc.stdout.toString().trim();
-      if (stdoutText) {
-        try {
-          const parsed = JSON.parse(stdoutText);
-          if (!parsed.ok) {
-            return parsed;
-          }
-        } catch {}
-      }
-      const errText = proc.stderr.toString().trim() || `exit code ${proc.exitCode}`;
-      return { ok: false, error: errText };
-    }
-    const output = proc.stdout.toString().trim();
-    return JSON.parse(output);
-  } catch (err) {
-    return { ok: false, error: String(err) };
+  switch (status) {
+    case "closed":
+      return "completed";
+    case "running":
+      return "in_progress";
+    case "failed":
+      return "ready";
+    default:
+      return;
   }
 }
-function requireGitNative(command, args) {
-  const result = runGitNative(command, args);
-  if (!result.ok) {
-    throw new Error(`rig-git ${command} failed: ${result.error}`);
+function canonicalizeTaskStateMetadata(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return null;
   }
-  return result;
-}
-function requireGitNativeString(command, args) {
-  const result = requireGitNative(command, args);
-  if ("value" in result && typeof result.value === "string") {
-    return result.value;
+  const metadata = raw;
+  const claimId = typeof metadata.claimId === "string" && metadata.claimId.length > 0 ? metadata.claimId : undefined;
+  const status = normalizeTaskStateMetadataStatus(metadata.status);
+  if (!status) {
+    return null;
   }
-  throw new Error(`rig-git ${command} returned an unexpected result payload`);
+  return {
+    ...claimId ? { claimId } : {},
+    status,
+    ...typeof metadata.ownerId === "string" && metadata.ownerId.length > 0 ? { ownerId: metadata.ownerId } : {},
+    ...typeof metadata.claimedAt === "string" && metadata.claimedAt.length > 0 ? { claimedAt: metadata.claimedAt } : {},
+    ...typeof metadata.lastEvidenceAt === "string" && metadata.lastEvidenceAt.length > 0 ? { lastEvidenceAt: metadata.lastEvidenceAt } : {},
+    ...typeof metadata.runId === "string" && metadata.runId.length > 0 ? { runId: metadata.runId } : {},
+    ...typeof metadata.branchName === "string" && metadata.branchName.length > 0 ? { branchName: metadata.branchName } : {},
+    ...typeof metadata.prNumber === "number" ? { prNumber: metadata.prNumber } : {},
+    ...typeof metadata.prUrl === "string" && metadata.prUrl.length > 0 ? { prUrl: metadata.prUrl } : {},
+    ...typeof metadata.reviewState === "string" && metadata.reviewState.length > 0 ? { reviewState: metadata.reviewState } : {},
+    ...typeof metadata.blockerReason === "string" && metadata.blockerReason.length > 0 ? { blockerReason: metadata.blockerReason } : {},
+    ...typeof metadata.sourceCommit === "string" && metadata.sourceCommit.length > 0 ? { sourceCommit: metadata.sourceCommit } : {}
+  };
 }
-function nativeBranchName(repoPath) {
-  const result = runGitNative("branch-name", [repoPath]);
-  if (!result.ok)
+function discardMismatchedTaskStateMetadata(input) {
+  input.taskId;
+  const canonicalMetadata = canonicalizeTaskStateMetadata(input.metadata);
+  if (!canonicalMetadata || !input.lifecycleStatus) {
+    return null;
+  }
+  const metadataStatus = canonicalMetadata.status ?? null;
+  if (metadataStatus && metadataStatus !== input.lifecycleStatus) {
     return null;
-  if ("value" in result && typeof result.value === "string")
-    return result.value;
-  return null;
-}
-function nativeFetchRef(repoPath, remote, branch) {
-  return requireGitNativeString("fetch-ref", [repoPath, remote, branch]);
-}
-function nativeReadBlobAtRef(repoPath, ref, path) {
-  const requestDir = resolve13(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
-  mkdirSync6(requestDir, { recursive: true });
-  const outputPath = resolve13(requestDir, "blob.txt");
-  try {
-    requireGitNative("read-blob-at-ref", [repoPath, ref, path, outputPath]);
-    return readFileSync7(outputPath, "utf8");
-  } finally {
-    rmSync5(requestDir, { recursive: true, force: true });
   }
+  return canonicalMetadata;
 }
-function nativeReadBlobBytesAtRef(repoPath, ref, path) {
-  const requestDir = resolve13(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
-  mkdirSync6(requestDir, { recursive: true });
-  const outputPath = resolve13(requestDir, "blob.bin");
-  try {
-    requireGitNative("read-blob-at-ref", [repoPath, ref, path, outputPath]);
-    return readFileSync7(outputPath);
-  } finally {
-    rmSync5(requestDir, { recursive: true, force: true });
+function readTaskStateMetadataEnvelope(raw) {
+  if (!raw || typeof raw !== "object") {
+    return { schemaVersion: SUPPORTED_TASK_STATE_SCHEMA_VERSION, supported: true, baseTrackerCommit: null, tasks: {} };
   }
+  const envelope = raw;
+  const schemaVersion = typeof envelope.schemaVersion === "number" ? envelope.schemaVersion : SUPPORTED_TASK_STATE_SCHEMA_VERSION;
+  if (schemaVersion !== SUPPORTED_TASK_STATE_SCHEMA_VERSION) {
+    return { schemaVersion, supported: false, baseTrackerCommit: null, tasks: {} };
+  }
+  const rawTasks = envelope.tasks && typeof envelope.tasks === "object" && !Array.isArray(envelope.tasks) ? envelope.tasks : {};
+  const tasks = Object.fromEntries(Object.entries(rawTasks).map(([taskId, metadata]) => [taskId, canonicalizeTaskStateMetadata(metadata)]).filter((entry) => entry[1] != null));
+  return {
+    schemaVersion,
+    supported: true,
+    baseTrackerCommit: typeof envelope.baseTrackerCommit === "string" && envelope.baseTrackerCommit.length > 0 ? envelope.baseTrackerCommit : null,
+    tasks
+  };
 }
+// packages/runtime/src/control-plane/state-sync/read.ts
+import { existsSync as existsSync18, readFileSync as readFileSync9 } from "fs";
+import { resolve as resolve18 } from "path";
 
 // packages/runtime/src/control-plane/native/utils.ts
 init_layout();