@h-rig/runtime 0.0.6-alpha.32 → 0.0.6-alpha.33

package/dist/src/control-plane/harness-main.js

@@ -304,1518 +304,1517 @@ function readBuildConfig() {
   }
 }
 
-// packages/runtime/src/control-plane/runtime/tooling/shell.ts
+// packages/runtime/src/control-plane/native/git-native.ts
+import { chmodSync, copyFileSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
 import { tmpdir } from "os";
-import { basename, dirname as dirname2, resolve as resolve3 } from "path";
-var sharedNativeShellOutputDir = resolve3(tmpdir(), "rig-native");
-var sharedNativeShellOutputPath = resolve3(sharedNativeShellOutputDir, `rig-shell-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
-function runtimeToolGatewayNames() {
-  return [
-    "bash",
-    "sh",
-    "zsh",
-    "git",
-    "bun",
-    "node",
-    "python3",
-    "rg",
-    "grep",
-    "sed",
-    "cat",
-    "ls",
-    "find",
-    "tsc",
-    "gh",
-    "mkdir",
-    "rm",
-    "mv",
-    "cp",
-    "touch",
-    "pwd",
-    "head",
-    "tail",
-    "wc",
-    "sort",
-    "uniq",
-    "awk",
-    "xargs",
-    "dirname",
-    "basename",
-    "realpath",
-    "env",
-    "jq",
-    "tee",
-    "which"
-  ];
-}
-// packages/runtime/src/control-plane/runtime/tooling/file-tools.ts
-import { tmpdir as tmpdir2 } from "os";
-import { basename as basename2, dirname as dirname3, resolve as resolve4 } from "path";
-var sharedNativeToolsOutputDir = resolve4(tmpdir2(), "rig-native");
-var sharedNativeToolsOutputPath = resolve4(sharedNativeToolsOutputDir, `rig-tools-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
-function runtimeFileToolNames() {
-  return [
-    "rig-read",
-    "rig-write",
-    "rig-edit",
-    "rig-glob",
-    "rig-grep"
-  ];
-}
-
-// packages/runtime/src/control-plane/runtime/tooling/gateway.ts
-function runtimeGatewayToolNames() {
-  return runtimeToolGatewayNames();
-}
-// packages/runtime/src/control-plane/browser-contract.ts
-import { resolve as resolve5 } from "path";
-var DEFAULT_BROWSER_ATTACH_URL = "http://127.0.0.1:9333";
-var DEFAULT_BROWSER_MODE = "persistent";
-var RUNTIME_BROWSER_HELPERS = {
-  launch: "rig-browser-launch",
-  check: "rig-browser-check",
-  attachInfo: "rig-browser-attach-info",
-  e2e: "rig-browser-e2e",
-  resetProfile: "rig-browser-reset-profile"
-};
-var BASE_REMOTE_DEBUGGING_PORT = 9222;
-var REMOTE_DEBUGGING_PORT_SPREAD = 4000;
-function hashString(input) {
-  let hash = 0;
-  for (let index = 0;index < input.length; index += 1) {
-    hash = (hash << 5) - hash + input.charCodeAt(index) | 0;
-  }
-  return Math.abs(hash);
+import { dirname as dirname2, isAbsolute, resolve as resolve3 } from "path";
+import { createHash } from "crypto";
+function isTextTreeCommitUpdate(update) {
+  return typeof update.content === "string";
 }
-function derivePortFromProfile(profileName) {
-  return BASE_REMOTE_DEBUGGING_PORT + hashString(profileName) % REMOTE_DEBUGGING_PORT_SPREAD;
+var sharedGitNativeOutputDir = resolve3(tmpdir(), "rig-native");
+var sharedGitNativeOutputPath = resolve3(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+var trackerCommandUsageProbe = "usage: rig-git fetch-ref <repo-path> <remote> <branch>";
+function temporaryGitBinaryOutputPath(outputPath) {
+  const suffix = process.platform === "win32" ? ".exe" : "";
+  return resolve3(dirname2(outputPath), `.rig-git-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}${suffix}`);
 }
-function parseAttachUrl(attachUrl) {
+function publishGitBinary(tempOutputPath, outputPath) {
   try {
-    return new URL((attachUrl || DEFAULT_BROWSER_ATTACH_URL).trim() || DEFAULT_BROWSER_ATTACH_URL);
-  } catch {
-    return new URL(DEFAULT_BROWSER_ATTACH_URL);
+    renameSync(tempOutputPath, outputPath);
+  } catch (error) {
+    if (process.platform === "win32" && existsSync3(outputPath)) {
+      rmSync(outputPath, { force: true });
+      renameSync(tempOutputPath, outputPath);
+      return;
+    }
+    throw error;
   }
 }
-function sanitizeRuntimeSuffix(runtimeId) {
-  return runtimeId.replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 16) || "runtime";
+function runtimeRigGitFileName() {
+  return `rig-git${process.platform === "win32" ? ".exe" : ""}`;
 }
-function resolveBrowserStateDir(projectRoot, configuredStateDir) {
-  const trimmed = configuredStateDir?.trim() || ".tmp/rig-browser";
-  if (trimmed.startsWith("/")) {
-    return resolve5(trimmed);
+function rigGitSourceCandidates() {
+  const execDir = process.execPath?.trim() ? dirname2(process.execPath.trim()) : "";
+  const cwd = process.cwd()?.trim() || "";
+  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
+  const moduleRelativeSource = resolve3(import.meta.dir, "../../../native/rig-git.zig");
+  return [...new Set([
+    process.env.RIG_NATIVE_GIT_SOURCE?.trim() || "",
+    moduleRelativeSource,
+    projectRoot ? resolve3(projectRoot, "packages/runtime/native/rig-git.zig") : "",
+    hostProjectRoot ? resolve3(hostProjectRoot, "packages/runtime/native/rig-git.zig") : "",
+    cwd ? resolve3(cwd, "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve3(execDir, "..", "..", "packages/runtime/native/rig-git.zig") : "",
+    execDir ? resolve3(execDir, "..", "native", "rig-git.zig") : ""
+  ].filter(Boolean))];
+}
+function nativePackageBinaryCandidates(fromDir, fileName) {
+  const candidates = [];
+  let cursor = resolve3(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    candidates.push(resolve3(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve3(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve3(cursor, "native", fileName), resolve3(cursor, "native", "bin", fileName));
+    const parent = dirname2(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
   }
-  return resolve5(projectRoot || process.cwd(), trimmed);
+  return candidates;
 }
-function resolveTaskBrowserContext(browser, options = {}) {
-  if (!browser?.required) {
-    return;
+function rigGitBinaryCandidates() {
+  const execDir = process.execPath?.trim() ? dirname2(process.execPath.trim()) : "";
+  const fileName = runtimeRigGitFileName();
+  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+  return [...new Set([
+    explicit,
+    ...nativePackageBinaryCandidates(import.meta.dir, fileName),
+    execDir ? resolve3(execDir, fileName) : "",
+    execDir ? resolve3(execDir, "..", fileName) : "",
+    execDir ? resolve3(execDir, "..", "bin", fileName) : "",
+    sharedGitNativeOutputPath
+  ].filter(Boolean))];
+}
+function resolveGitSourcePath() {
+  for (const candidate of rigGitSourceCandidates()) {
+    if (candidate && existsSync3(candidate)) {
+      return candidate;
+    }
   }
-  const defaultProfile = browser.profile?.trim() || "default";
-  const mode = browser.mode?.trim() || DEFAULT_BROWSER_MODE;
-  const defaultAttach = parseAttachUrl(browser.attach_url);
-  const shouldDeriveRuntimeProfile = Boolean(options.runtimeId?.trim()) && mode !== "shared";
-  const effectiveProfile = shouldDeriveRuntimeProfile ? `${defaultProfile}-${sanitizeRuntimeSuffix(options.runtimeId.trim())}` : defaultProfile;
-  const effectivePort = shouldDeriveRuntimeProfile ? derivePortFromProfile(effectiveProfile) : Number(defaultAttach.port || "80");
-  const effectiveAttach = new URL(defaultAttach.toString());
-  effectiveAttach.port = String(effectivePort);
-  return {
-    required: true,
-    preset: browser.preset?.trim() || "default",
-    mode,
-    stateDir: resolveBrowserStateDir(options.hostProjectRoot, browser.state_dir),
-    defaultProfile,
-    effectiveProfile,
-    defaultAttachUrl: defaultAttach.toString(),
-    effectiveAttachUrl: effectiveAttach.toString(),
-    devCommand: browser.dev_command?.trim() || undefined,
-    launchCommand: browser.launch_command?.trim() || undefined,
-    checkCommand: browser.check_command?.trim() || undefined,
-    e2eCommand: browser.e2e_command?.trim() || undefined,
-    launchHelper: RUNTIME_BROWSER_HELPERS.launch,
-    checkHelper: RUNTIME_BROWSER_HELPERS.check,
-    attachInfoHelper: RUNTIME_BROWSER_HELPERS.attachInfo,
-    e2eHelper: RUNTIME_BROWSER_HELPERS.e2e,
-    resetProfileHelper: RUNTIME_BROWSER_HELPERS.resetProfile
-  };
+  return null;
 }
-function buildBrowserGuidanceLines(browser) {
-  const lines = [
-    "This task requires Rig Browser.",
-    `Launch the browser: \`${browser.launchHelper}\`${browser.devCommand ? " or `rig-browser-launch --dev`" : ""}.`,
-    `Check the browser contract: \`${browser.checkHelper}\`.`,
-    `Show attach details: \`${browser.attachInfoHelper}\`.`,
-    `Attach Chrome DevTools MCP to ${browser.effectiveAttachUrl}.`,
-    `Preset: ${browser.preset}.`,
-    `Profile: ${browser.effectiveProfile}.`,
-    `State dir: ${browser.stateDir}.`,
-    `Reset the active profile with \`${browser.resetProfileHelper}\`.`
-  ];
-  if (browser.e2eCommand) {
-    lines.push(`Run app-owned browser e2e with \`${browser.e2eHelper}\`.`);
+function resolveGitBinaryPath() {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return null;
   }
-  if (browser.defaultProfile !== browser.effectiveProfile) {
-    lines.push(`Base profile: ${browser.defaultProfile}. Runtime launches derive an isolated effective profile.`);
+  for (const candidate of rigGitBinaryCandidates()) {
+    if (candidate && existsSync3(candidate)) {
+      return candidate;
+    }
   }
-  return lines;
+  return null;
 }
-
-// packages/runtime/src/control-plane/plugin-host-context.ts
-import { createPluginHost } from "@rig/core";
-import { loadConfig } from "@rig/core/load-config";
-
-// packages/runtime/src/control-plane/task-source.ts
-function createTaskSourceRegistry() {
-  const byId = new Map;
-  const order = [];
-  return {
-    register(s) {
-      if (byId.has(s.id))
-        throw new Error(`task source already registered: ${s.id}`);
-      byId.set(s.id, s);
-      order.push(s);
-    },
-    resolveById(id) {
-      const s = byId.get(id);
-      if (!s)
-        throw new Error(`task source not registered: ${id}`);
-      return s;
-    },
-    resolveByKind(kind) {
-      for (const s of order)
-        if (s.kind === kind)
-          return s;
-      throw new Error(`no task source registered for kind: ${kind}`);
-    },
-    list: () => order
-  };
+function preferredGitBinaryOutputPath() {
+  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+  return explicit || sharedGitNativeOutputPath;
 }
-
-// packages/runtime/src/control-plane/task-source-bootstrap.ts
-function formatRegisteredKinds(pluginHost) {
-  const kinds = pluginHost ? pluginHost.listExecutableTaskSources().map((source) => source.kind) : [];
-  return kinds.length > 0 ? kinds.join(", ") : "none";
+function binarySupportsTrackerCommandsSync(binaryPath) {
+  try {
+    const probe = Bun.spawnSync([binaryPath, "fetch-ref", "."], {
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const stdout = probe.stdout.toString().trim();
+    const stderr = probe.stderr.toString().trim();
+    if (stdout.includes('"error":"unknown command"')) {
+      return false;
+    }
+    return probe.exitCode === 2 && stderr.includes(trackerCommandUsageProbe);
+  } catch {
+    return false;
+  }
 }
-function buildTaskSourceRegistry(config, pluginHost) {
-  const registry = createTaskSourceRegistry();
-  const taskSourceConfig = config.taskSource;
-  const factory = pluginHost?.resolveTaskSourceFactoryByKind(taskSourceConfig.kind);
-  if (!factory) {
-    throw new Error(`No task source factory registered for kind "${taskSourceConfig.kind}". ` + `Registered kinds: ${formatRegisteredKinds(pluginHost)}. ` + "Load a plugin that contributes an executable task source factory for this kind.");
+function nativeBuildManifestPath(outputPath) {
+  return `${outputPath}.build-manifest.json`;
+}
+function hasMatchingNativeBuildManifestSync(manifestPath, buildKey) {
+  if (!existsSync3(manifestPath)) {
+    return false;
+  }
+  try {
+    const manifest = JSON.parse(readFileSync3(manifestPath, "utf8"));
+    return manifest.version === 1 && manifest.buildKey === buildKey;
+  } catch {
+    return false;
   }
-  registry.register(factory.factory(taskSourceConfig));
-  return registry;
 }
-
-// packages/runtime/src/control-plane/repos/registry.ts
-function createRepoRegistry(entries) {
-  const map = new Map;
-  for (const e of entries) {
-    if (map.has(e.id))
-      throw new Error(`repo already registered: ${e.id}`);
-    map.set(e.id, { ...e });
+function sha256FileSync(path) {
+  return createHash("sha256").update(readFileSync3(path)).digest("hex");
+}
+function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath()) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    throw new Error("Zig native git is disabled via RIG_DISABLE_ZIG_NATIVE=1");
   }
-  const ordered = Array.from(map.values());
-  return {
-    getById: (id) => map.get(id),
-    list: () => ordered
-  };
+  const sourcePath = resolveGitSourcePath();
+  if (!sourcePath) {
+    const binaryPath = resolveGitBinaryPath();
+    if (binaryPath) {
+      return binaryPath;
+    }
+    throw new Error("rig-git.zig source file not found.");
+  }
+  const zigBinary = Bun.which("zig");
+  if (!zigBinary) {
+    throw new Error("zig is required to build native Rig git tools.");
+  }
+  mkdirSync2(dirname2(outputPath), { recursive: true });
+  const sourceDigest = sha256FileSync(sourcePath);
+  const buildKey = JSON.stringify({
+    version: 1,
+    zigBinary,
+    platform: process.platform,
+    arch: process.arch,
+    sourcePath,
+    sourceDigest
+  });
+  const manifestPath = nativeBuildManifestPath(outputPath);
+  const needsBuild = !existsSync3(outputPath) || !hasMatchingNativeBuildManifestSync(manifestPath, buildKey) || !binarySupportsTrackerCommandsSync(outputPath);
+  if (!needsBuild) {
+    chmodSync(outputPath, 493);
+    return outputPath;
+  }
+  const tempOutputPath = temporaryGitBinaryOutputPath(outputPath);
+  const build = Bun.spawnSync([
+    zigBinary,
+    "build-exe",
+    sourcePath,
+    "-O",
+    "ReleaseFast",
+    `-femit-bin=${tempOutputPath}`
+  ], {
+    cwd: dirname2(sourcePath),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  if (build.exitCode !== 0 || !existsSync3(tempOutputPath)) {
+    const stderr = build.stderr.toString().trim();
+    const stdout = build.stdout.toString().trim();
+    const details = [stderr, stdout].filter(Boolean).join(`
+`);
+    throw new Error(`Failed to build native Rig git tools: ${details || `zig exited with code ${build.exitCode}`}`);
+  }
+  chmodSync(tempOutputPath, 493);
+  if (existsSync3(outputPath) && hasMatchingNativeBuildManifestSync(manifestPath, buildKey)) {
+    rmSync(tempOutputPath, { force: true });
+    chmodSync(outputPath, 493);
+    return outputPath;
+  }
+  publishGitBinary(tempOutputPath, outputPath);
+  if (!binarySupportsTrackerCommandsSync(outputPath)) {
+    rmSync(outputPath, { force: true });
+    throw new Error("Failed to build native Rig git tools: tracker command probe failed");
+  }
+  writeFileSync2(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`, "utf8");
+  return outputPath;
 }
-var MANAGED_REPOS = new Map;
-function setManagedRepos(entries) {
-  const next = new Map;
-  for (const e of entries) {
-    if (next.has(e.id)) {
-      throw new Error(`managed repo already registered: ${e.id}`);
+function runGitNative(command, args) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return { ok: false, error: "rig-git native disabled" };
+  }
+  const trackerCommand = command === "fetch-ref" || command === "read-blob-at-ref" || command === "write-tree-commit" || command === "push-ref-with-lease";
+  let binaryPath = null;
+  if (trackerCommand) {
+    try {
+      binaryPath = ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message.includes("rig-git.zig source file not found")) {
+        return { ok: false, error: "rig-git binary not found" };
+      }
+      return { ok: false, error: message };
+    }
+  } else {
+    const explicitBinaryPath = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+    binaryPath = explicitBinaryPath && existsSync3(explicitBinaryPath) ? explicitBinaryPath : !explicitBinaryPath ? resolveGitBinaryPath() : null;
+    if (!binaryPath) {
+      try {
+        binaryPath = ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (message.includes("rig-git.zig source file not found")) {
+          return { ok: false, error: "rig-git binary not found" };
+        }
+        return { ok: false, error: message };
+      }
     }
-    next.set(e.id, e);
   }
-  MANAGED_REPOS = next;
+  try {
+    const proc = Bun.spawnSync([binaryPath, command, ...args], {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: process.env
+    });
+    if (proc.exitCode !== 0) {
+      const stdoutText = proc.stdout.toString().trim();
+      if (stdoutText) {
+        try {
+          const parsed = JSON.parse(stdoutText);
+          if (!parsed.ok) {
+            return parsed;
+          }
+        } catch {}
+      }
+      const errText = proc.stderr.toString().trim() || `exit code ${proc.exitCode}`;
+      return { ok: false, error: errText };
+    }
+    const output = proc.stdout.toString().trim();
+    return JSON.parse(output);
+  } catch (err) {
+    return { ok: false, error: String(err) };
+  }
 }
-function getManagedRepoEntry(repoId) {
-  const entry = MANAGED_REPOS.get(repoId);
-  if (!entry) {
-    throw new Error(`managed repo not registered: ${repoId}. Plugins contribute repos via RigPlugin.contributes.repoSources; ` + `make sure a plugin declares this id and the plugin host has been initialized.`);
+function requireGitNative(command, args) {
+  const result = runGitNative(command, args);
+  if (!result.ok) {
+    throw new Error(`rig-git ${command} failed: ${result.error}`);
   }
-  return entry;
+  return result;
 }
-function listManagedRepoEntries() {
-  return Array.from(MANAGED_REPOS.values());
+function requireGitNativeString(command, args) {
+  const result = requireGitNative(command, args);
+  if ("value" in result && typeof result.value === "string") {
+    return result.value;
+  }
+  throw new Error(`rig-git ${command} returned an unexpected result payload`);
 }
-function resolveManagedRepoIdByAlias(alias) {
-  for (const entry of MANAGED_REPOS.values()) {
-    if (entry.alias === alias) {
-      return entry.id;
-    }
+function nativeBranchName(repoPath) {
+  const result = runGitNative("branch-name", [repoPath]);
+  if (!result.ok)
+    return null;
+  if ("value" in result && typeof result.value === "string")
+    return result.value;
+  return null;
+}
+function nativeHeadOid(repoPath) {
+  const result = runGitNative("head-oid", [repoPath]);
+  if (!result.ok)
+    return null;
+  if ("value" in result && typeof result.value === "string")
+    return result.value;
+  return null;
+}
+function nativeChangeCount(repoPath) {
+  const result = runGitNative("change-count", [repoPath]);
+  if (!result.ok)
+    return null;
+  if ("count" in result && typeof result.count === "number")
+    return result.count;
+  return null;
+}
+function nativePendingFiles(repoPath) {
+  const result = runGitNative("pending-files", [repoPath]);
+  if (!result.ok)
+    return null;
+  if ("files" in result && Array.isArray(result.files)) {
+    return result.files.map((f) => ({ path: f.path, status: f.status }));
   }
   return null;
 }
-function repoRegistrationToManagedEntry(reg) {
-  if (!reg.defaultBranch) {
+function nativeFileHasChanges(repoPath, filePath) {
+  const result = runGitNative("file-has-changes", [repoPath, filePath]);
+  if (!result.ok)
     return null;
+  if ("has_changes" in result && typeof result.has_changes === "boolean")
+    return result.has_changes;
+  return null;
+}
+function nativeFetchRef(repoPath, remote, branch) {
+  return requireGitNativeString("fetch-ref", [repoPath, remote, branch]);
+}
+function nativeReadBlobAtRef(repoPath, ref, path) {
+  const requestDir = resolve3(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
+  mkdirSync2(requestDir, { recursive: true });
+  const outputPath = resolve3(requestDir, "blob.txt");
+  try {
+    requireGitNative("read-blob-at-ref", [repoPath, ref, path, outputPath]);
+    return readFileSync3(outputPath, "utf8");
+  } finally {
+    rmSync(requestDir, { recursive: true, force: true });
   }
-  return {
-    id: reg.id,
-    alias: reg.defaultPath ?? reg.id,
-    defaultBranch: reg.defaultBranch,
-    defaultRemoteUrl: reg.url,
-    remoteEnvVar: reg.remoteEnvVar,
-    checkoutEnvVar: reg.checkoutEnvVar
-  };
 }
-
-// packages/runtime/src/control-plane/agent-roles.ts
-function createAgentRoleRegistry(pluginRoles, configOverrides) {
-  const map = new Map;
-  for (const r of pluginRoles) {
-    if (map.has(r.id))
-      throw new Error(`agent role already registered: ${r.id}`);
-    const override = configOverrides?.[r.id];
-    const model = override?.model ?? r.defaultModel;
-    if (!model) {
-      throw new Error(`agent role "${r.id}" has no model \u2014 provide defaultModel in plugin or model in config.runtime.agentRoles.${r.id}`);
+function nativeReadBlobBytesAtRef(repoPath, ref, path) {
+  const requestDir = resolve3(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
+  mkdirSync2(requestDir, { recursive: true });
+  const outputPath = resolve3(requestDir, "blob.bin");
+  try {
+    requireGitNative("read-blob-at-ref", [repoPath, ref, path, outputPath]);
+    return readFileSync3(outputPath);
+  } finally {
+    rmSync(requestDir, { recursive: true, force: true });
+  }
+}
+function serializeTreeCommitUpdates(updates) {
+  return updates.map((update) => {
+    if (isTextTreeCommitUpdate(update)) {
+      return { path: update.path, kind: "text", content: update.content };
     }
-    map.set(r.id, { ...r, model });
+    if (!isAbsolute(update.sourceFilePath)) {
+      throw new Error("tree commit binary updates require an absolute sourceFilePath");
+    }
+    return { path: update.path, kind: "file", sourceFilePath: update.sourceFilePath };
+  });
+}
+function buildTreeCommitUpdatesJson(updates) {
+  return `${JSON.stringify(serializeTreeCommitUpdates(updates), null, 2)}
+`;
+}
+function nativeWriteTreeCommit(repoPath, baseRef, updates, message) {
+  const requestDir = resolve3(sharedGitNativeOutputDir, "requests", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
+  mkdirSync2(requestDir, { recursive: true });
+  const messagePath = resolve3(requestDir, "message.txt");
+  const updatesPath = resolve3(requestDir, "updates.json");
+  try {
+    writeFileSync2(messagePath, message, "utf8");
+    writeFileSync2(updatesPath, buildTreeCommitUpdatesJson(updates), "utf8");
+    return requireGitNativeString("write-tree-commit", [repoPath, baseRef, messagePath, updatesPath]);
+  } finally {
+    rmSync(requestDir, { recursive: true, force: true });
   }
-  return {
-    resolve(id) {
-      const r = map.get(id);
-      if (!r)
-        throw new Error(`agent role not registered: ${id}`);
-      return r;
-    },
-    list: () => Array.from(map.values())
-  };
 }
-
-// packages/runtime/src/control-plane/task-fields.ts
-function createTaskFieldRegistry(extensions) {
-  const byId = new Map;
-  for (const e of extensions) {
-    if (byId.has(e.id))
-      throw new Error(`task field extension already registered: ${e.id}`);
-    byId.set(e.id, e);
-  }
-  return {
-    get: (id) => byId.get(id),
-    list: () => Array.from(byId.values()),
-    fieldNames: () => Array.from(byId.values()).map((e) => e.fieldName),
-    validateTaskFields(task) {
-      const errors = [];
-      for (const ext of byId.values()) {
-        let schema;
-        try {
-          schema = JSON.parse(ext.schemaJson);
-        } catch {
-          errors.push(`task field "${ext.id}": schemaJson is not valid JSON`);
-          continue;
-        }
-        const isRequired = typeof schema === "object" && schema !== null && schema.required === true;
-        if (!isRequired)
-          continue;
-        const value = task[ext.fieldName];
-        if (value === undefined || value === null || value === "") {
-          errors.push(`task field "${ext.fieldName}" (from extension "${ext.id}") is required but missing`);
-        }
-      }
-      return errors.length === 0 ? { ok: true } : { ok: false, errors };
-    }
-  };
-}
-
-// packages/runtime/src/control-plane/validators/runtime-registration.ts
-import { existsSync as existsSync3 } from "fs";
-import { join } from "path";
-function createValidatorRegistry() {
-  const map = new Map;
-  const order = [];
-  const registry = {
-    register(v) {
-      if (map.has(v.id))
-        throw new Error(`validator already registered: ${v.id}`);
-      map.set(v.id, v);
-      order.push(v);
-    },
-    resolve(id) {
-      const v = map.get(id);
-      if (!v)
-        throw new Error(`validator not registered: ${id}`);
-      return v;
-    },
-    list: () => order
-  };
-  registerBuiltInValidators(registry);
-  return registry;
-}
-function registerBuiltInValidators(registry) {
-  registry.register({
-    id: "std:typecheck",
-    category: "custom",
-    description: "Runs the package typecheck script when present.",
-    run: async (ctx) => runStdTypecheck(ctx)
-  });
-}
-async function runStdTypecheck(ctx) {
-  const packageJsonPath = join(ctx.workspaceRoot, "package.json");
-  if (!existsSync3(packageJsonPath)) {
-    return {
-      id: "std:typecheck",
-      passed: false,
-      summary: `package.json not found at ${packageJsonPath}`
-    };
-  }
-  const proc = Bun.spawn(["bun", "run", "typecheck"], {
-    cwd: ctx.workspaceRoot,
-    env: process.env,
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  const [exitCode, stdout, stderr] = await Promise.all([
-    proc.exited,
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text()
+function nativePushRefWithLease(repoPath, localOid, remoteRef, expectedOldOid, remote = "origin") {
+  return requireGitNativeString("push-ref-with-lease", [
+    repoPath,
+    localOid,
+    remoteRef,
+    expectedOldOid,
+    remote
   ]);
-  const output = `${stdout}${stderr}`.trim();
-  return {
-    id: "std:typecheck",
-    passed: exitCode === 0,
-    summary: exitCode === 0 ? "typecheck passed" : "typecheck failed",
-    ...output ? { details: output.slice(0, 4000) } : {}
-  };
 }
 
-// packages/runtime/src/control-plane/native/scope-rules.ts
-var activeRules = null;
-function setScopeRules(rules) {
-  activeRules = rules ?? null;
+// packages/runtime/src/control-plane/runtime/tooling/shell.ts
+import { tmpdir as tmpdir2 } from "os";
+import { basename, dirname as dirname3, resolve as resolve4 } from "path";
+var sharedNativeShellOutputDir = resolve4(tmpdir2(), "rig-native");
+var sharedNativeShellOutputPath = resolve4(sharedNativeShellOutputDir, `rig-shell-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+function runtimeToolGatewayNames() {
+  return [
+    "bash",
+    "sh",
+    "zsh",
+    "git",
+    "bun",
+    "node",
+    "python3",
+    "rg",
+    "grep",
+    "sed",
+    "cat",
+    "ls",
+    "find",
+    "tsc",
+    "gh",
+    "mkdir",
+    "rm",
+    "mv",
+    "cp",
+    "touch",
+    "pwd",
+    "head",
+    "tail",
+    "wc",
+    "sort",
+    "uniq",
+    "awk",
+    "xargs",
+    "dirname",
+    "basename",
+    "realpath",
+    "env",
+    "jq",
+    "tee",
+    "which"
+  ];
 }
-function getScopeRules() {
-  return activeRules;
+// packages/runtime/src/control-plane/runtime/tooling/file-tools.ts
+import { tmpdir as tmpdir3 } from "os";
+import { basename as basename2, dirname as dirname4, resolve as resolve5 } from "path";
+var sharedNativeToolsOutputDir = resolve5(tmpdir3(), "rig-native");
+var sharedNativeToolsOutputPath = resolve5(sharedNativeToolsOutputDir, `rig-tools-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+function runtimeFileToolNames() {
+  return [
+    "rig-read",
+    "rig-write",
+    "rig-edit",
+    "rig-glob",
+    "rig-grep"
+  ];
 }
 
-// packages/runtime/src/control-plane/hook-materializer.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname4, resolve as resolve6 } from "path";
-var MARKER_PLUGIN = "_rigPlugin";
-var MARKER_HOOK_ID = "_rigHookId";
-function matcherToString(matcher) {
-  if (matcher.kind === "all")
-    return;
-  if (matcher.kind === "tool")
-    return matcher.name;
-  return matcher.pattern;
-}
-function isPluginOwned(cmd) {
-  return typeof cmd[MARKER_PLUGIN] === "string";
-}
-function materializeHooks(projectRoot, entries) {
-  const settingsPath = resolve6(projectRoot, ".claude", "settings.json");
-  const existing = existsSync4(settingsPath) ? safeReadJson(settingsPath) : {};
-  const hooks = existing.hooks ?? {};
-  for (const event of Object.keys(hooks)) {
-    const groups = hooks[event] ?? [];
-    const cleaned = [];
-    for (const group of groups) {
-      const operatorHooks = group.hooks.filter((h) => !isPluginOwned(h));
-      if (operatorHooks.length > 0) {
-        cleaned.push({ ...group, hooks: operatorHooks });
-      }
-    }
-    if (cleaned.length > 0) {
-      hooks[event] = cleaned;
-    } else {
-      delete hooks[event];
-    }
-  }
-  for (const { pluginName, hook } of entries) {
-    if (!hook.command) {
-      continue;
-    }
-    const event = hook.event;
-    const matcherString = matcherToString(hook.matcher);
-    const groups = hooks[event] ??= [];
-    let group = groups.find((g) => g.matcher === matcherString);
-    if (!group) {
-      group = matcherString === undefined ? { hooks: [] } : { matcher: matcherString, hooks: [] };
-      groups.push(group);
-    }
-    group.hooks.push({
-      type: "command",
-      command: hook.command,
-      [MARKER_PLUGIN]: pluginName,
-      [MARKER_HOOK_ID]: hook.id
-    });
-  }
-  const next = { ...existing };
-  if (Object.keys(hooks).length > 0) {
-    next.hooks = hooks;
-  } else {
-    delete next.hooks;
-  }
-  mkdirSync2(dirname4(settingsPath), { recursive: true });
-  writeFileSync2(settingsPath, `${JSON.stringify(next, null, 2)}
-`, "utf-8");
-  return settingsPath;
+// packages/runtime/src/control-plane/runtime/tooling/gateway.ts
+function runtimeGatewayToolNames() {
+  return runtimeToolGatewayNames();
 }
-function safeReadJson(path) {
-  try {
-    return JSON.parse(readFileSync3(path, "utf-8"));
-  } catch {
-    return {};
+// packages/runtime/src/control-plane/browser-contract.ts
+import { resolve as resolve6 } from "path";
+var DEFAULT_BROWSER_ATTACH_URL = "http://127.0.0.1:9333";
+var DEFAULT_BROWSER_MODE = "persistent";
+var RUNTIME_BROWSER_HELPERS = {
+  launch: "rig-browser-launch",
+  check: "rig-browser-check",
+  attachInfo: "rig-browser-attach-info",
+  e2e: "rig-browser-e2e",
+  resetProfile: "rig-browser-reset-profile"
+};
+var BASE_REMOTE_DEBUGGING_PORT = 9222;
+var REMOTE_DEBUGGING_PORT_SPREAD = 4000;
+function hashString(input) {
+  let hash = 0;
+  for (let index = 0;index < input.length; index += 1) {
+    hash = (hash << 5) - hash + input.charCodeAt(index) | 0;
   }
+  return Math.abs(hash);
 }
-
-// packages/runtime/src/control-plane/skill-materializer.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, readdirSync, rmSync, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve7 } from "path";
-import { loadSkill } from "@rig/skill-loader";
-var MARKER_FILENAME = ".rig-plugin";
-function skillDirName(id) {
-  return id.replace(/[^a-zA-Z0-9._-]+/g, "-");
-}
-async function materializeSkills(projectRoot, entries) {
-  const skillsRoot = resolve7(projectRoot, ".pi", "skills");
-  if (existsSync5(skillsRoot)) {
-    for (const name of readdirSync(skillsRoot)) {
-      const dir = resolve7(skillsRoot, name);
-      if (existsSync5(resolve7(dir, MARKER_FILENAME))) {
-        rmSync(dir, { recursive: true, force: true });
-      }
-    }
-  }
-  const written = [];
-  for (const { pluginName, skill } of entries) {
-    const sourcePath = resolve7(projectRoot, skill.path);
-    if (!existsSync5(sourcePath)) {
-      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${sourcePath} does not exist`);
-      continue;
-    }
-    let body;
-    try {
-      await loadSkill(sourcePath);
-      body = readFileSync4(sourcePath, "utf-8");
-    } catch (err) {
-      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${err instanceof Error ? err.message : err}`);
-      continue;
-    }
-    const dir = resolve7(skillsRoot, skillDirName(skill.id));
-    mkdirSync3(dir, { recursive: true });
-    writeFileSync3(resolve7(dir, "SKILL.md"), body, "utf-8");
-    writeFileSync3(resolve7(dir, MARKER_FILENAME), `${JSON.stringify({ plugin: pluginName, skillId: skill.id }, null, 2)}
-`, "utf-8");
-    written.push({ id: skill.id, pluginName, directory: dir });
-  }
-  return written;
+function derivePortFromProfile(profileName) {
+  return BASE_REMOTE_DEBUGGING_PORT + hashString(profileName) % REMOTE_DEBUGGING_PORT_SPREAD;
 }
-
-// packages/runtime/src/control-plane/plugin-host-context.ts
-async function buildPluginHostContext(projectRoot) {
-  let config;
-  try {
-    config = await loadConfig(projectRoot);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    if (msg.includes("no rig.config")) {
-      return null;
-    }
-    throw err;
-  }
-  const pluginHost = createPluginHost(config.plugins);
-  setScopeRules(config.workspace.scopeNormalization);
-  const validatorRegistry = createValidatorRegistry();
-  for (const impl of pluginHost.listExecutableValidators()) {
-    validatorRegistry.register(impl);
-  }
-  const taskSourceRegistry = buildTaskSourceRegistry(config, pluginHost);
-  const repoRegistry = createRepoRegistry(pluginHost.listRepoSources());
-  const managedEntries = pluginHost.listRepoSources().map(repoRegistrationToManagedEntry).filter((e) => e !== null);
-  setManagedRepos(managedEntries);
-  const configRoleOverrides = config.runtime?.agentRoles;
-  const agentRoleRegistry = createAgentRoleRegistry(pluginHost.listAgentRoles(), configRoleOverrides);
-  const taskFieldRegistry = createTaskFieldRegistry(pluginHost.listTaskFieldExtensions());
-  try {
-    const hookEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.hooks ?? []).map((hook) => ({
-      pluginName: plugin.name,
-      hook
-    })));
-    if (hookEntries.length > 0) {
-      materializeHooks(projectRoot, hookEntries);
-    }
-  } catch (err) {
-    console.warn(`[plugin-host] hook materialization failed: ${err instanceof Error ? err.message : err}`);
-  }
+function parseAttachUrl(attachUrl) {
   try {
-    const skillEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.skills ?? []).map((skill) => ({
-      pluginName: plugin.name,
-      skill
-    })));
-    if (skillEntries.length > 0) {
-      await materializeSkills(projectRoot, skillEntries);
-    }
-  } catch (err) {
-    console.warn(`[plugin-host] skill materialization failed: ${err instanceof Error ? err.message : err}`);
-  }
-  return {
-    config,
-    pluginHost,
-    validatorRegistry,
-    taskSourceRegistry,
-    repoRegistry,
-    agentRoleRegistry,
-    taskFieldRegistry
-  };
-}
-
-// packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
-import { spawnSync } from "child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync, writeFileSync as writeFileSync4 } from "fs";
-import { basename as basename3, join as join2, resolve as resolve9 } from "path";
-
-// packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
-import { resolve as resolve8 } from "path";
-
-// packages/runtime/src/control-plane/tasks/task-record-reader.ts
-async function findTaskById(reader, id) {
-  const tasks = await reader.listTasks();
-  return tasks.find((task) => task.id === id) ?? null;
-}
-
-// packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
-class LegacyTaskConfigReadError extends Error {
-  code = "LEGACY_TASK_CONFIG_READ_FAILED";
-  projectRoot;
-  configPath;
-  cause;
-  constructor(input) {
-    super(input.message, { cause: input.cause });
-    this.name = "LegacyTaskConfigReadError";
-    this.projectRoot = input.projectRoot;
-    this.configPath = input.configPath;
-    this.cause = input.cause;
+    return new URL((attachUrl || DEFAULT_BROWSER_ATTACH_URL).trim() || DEFAULT_BROWSER_ATTACH_URL);
+  } catch {
+    return new URL(DEFAULT_BROWSER_ATTACH_URL);
   }
 }
-function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve8(projectRoot, ".rig", "task-config.json");
-  const reader = {
-    async listTasks() {
-      return readLegacyTaskRecords(projectRoot, configPath);
-    },
-    async getTask(id) {
-      return findTaskById(reader, id);
-    }
-  };
-  return reader;
-}
-function readLegacyTaskRecords(projectRoot, configPath = resolve8(projectRoot, ".rig", "task-config.json")) {
-  if (!existsSync6(configPath)) {
-    return [];
-  }
-  const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
-  return Object.entries(stripLegacyTaskConfigMetadata(rawConfig)).map(([id, entry]) => legacyTaskConfigEntryToRecord(id, entry)).filter((record) => record !== null);
+function sanitizeRuntimeSuffix(runtimeId) {
+  return runtimeId.replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 16) || "runtime";
 }
-function readLegacyTaskConfigJson(projectRoot, configPath) {
-  try {
-    const parsed = JSON.parse(readFileSync5(configPath, "utf8"));
-    if (isPlainRecord(parsed)) {
-      return parsed;
-    }
-    throw new Error("task config root must be a JSON object");
-  } catch (cause) {
-    throw new LegacyTaskConfigReadError({
-      projectRoot,
-      configPath,
-      message: `Could not read legacy task config at ${configPath} for project ${projectRoot}: ${cause instanceof Error ? cause.message : String(cause)}`,
-      cause
-    });
+function resolveBrowserStateDir(projectRoot, configuredStateDir) {
+  const trimmed = configuredStateDir?.trim() || ".tmp/rig-browser";
+  if (trimmed.startsWith("/")) {
+    return resolve6(trimmed);
   }
+  return resolve6(projectRoot || process.cwd(), trimmed);
 }
-function stripLegacyTaskConfigMetadata(raw) {
-  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
-  return tasks;
-}
-function legacyTaskConfigEntryToRecord(id, entry) {
-  if (!isPlainRecord(entry)) {
-    return null;
+function resolveTaskBrowserContext(browser, options = {}) {
+  if (!browser?.required) {
+    return;
   }
-  const deps = firstStringList(entry.deps, entry.dependencies, entry.validation_deps, entry.validationDeps);
-  const validation = readStringList(entry.validation);
-  const validators = readStringList(entry.validators);
-  const scope = readStringList(entry.scope);
-  const status = typeof entry.status === "string" ? entry.status : "open";
-  const title = typeof entry.title === "string" ? entry.title : undefined;
-  const description = typeof entry.description === "string" ? entry.description : undefined;
-  const acceptanceCriteria = typeof entry.acceptance_criteria === "string" ? entry.acceptance_criteria : typeof entry.acceptanceCriteria === "string" ? entry.acceptanceCriteria : undefined;
+  const defaultProfile = browser.profile?.trim() || "default";
+  const mode = browser.mode?.trim() || DEFAULT_BROWSER_MODE;
+  const defaultAttach = parseAttachUrl(browser.attach_url);
+  const shouldDeriveRuntimeProfile = Boolean(options.runtimeId?.trim()) && mode !== "shared";
+  const effectiveProfile = shouldDeriveRuntimeProfile ? `${defaultProfile}-${sanitizeRuntimeSuffix(options.runtimeId.trim())}` : defaultProfile;
+  const effectivePort = shouldDeriveRuntimeProfile ? derivePortFromProfile(effectiveProfile) : Number(defaultAttach.port || "80");
+  const effectiveAttach = new URL(defaultAttach.toString());
+  effectiveAttach.port = String(effectivePort);
   return {
-    id,
-    deps,
-    status,
-    source: "legacy-task-config",
-    ...title ? { title } : {},
-    ...description ? { description } : {},
-    ...acceptanceCriteria ? { acceptanceCriteria } : {},
-    ...scope.length > 0 ? { scope } : {},
-    ...validation.length > 0 ? { validation } : {},
-    ...validators.length > 0 ? { validators } : {},
-    ...preservedLegacyFields(entry)
-  };
-}
-function preservedLegacyFields(entry) {
-  const preserved = {};
-  for (const key of [
-    "role",
-    "browser",
-    "repo_pins",
-    "criticality",
-    "queue_weight",
-    "creates_repo",
-    "auto_synced"
-  ]) {
-    if (entry[key] !== undefined) {
-      preserved[key] = entry[key];
-    }
-  }
-  return preserved;
+    required: true,
+    preset: browser.preset?.trim() || "default",
+    mode,
+    stateDir: resolveBrowserStateDir(options.hostProjectRoot, browser.state_dir),
+    defaultProfile,
+    effectiveProfile,
+    defaultAttachUrl: defaultAttach.toString(),
+    effectiveAttachUrl: effectiveAttach.toString(),
+    devCommand: browser.dev_command?.trim() || undefined,
+    launchCommand: browser.launch_command?.trim() || undefined,
+    checkCommand: browser.check_command?.trim() || undefined,
+    e2eCommand: browser.e2e_command?.trim() || undefined,
+    launchHelper: RUNTIME_BROWSER_HELPERS.launch,
+    checkHelper: RUNTIME_BROWSER_HELPERS.check,
+    attachInfoHelper: RUNTIME_BROWSER_HELPERS.attachInfo,
+    e2eHelper: RUNTIME_BROWSER_HELPERS.e2e,
+    resetProfileHelper: RUNTIME_BROWSER_HELPERS.resetProfile
+  };
 }
-function firstStringList(...candidates) {
-  for (const candidate of candidates) {
-    const list = readStringList(candidate);
-    if (list.length > 0) {
-      return list;
-    }
+function buildBrowserGuidanceLines(browser) {
+  const lines = [
+    "This task requires Rig Browser.",
+    `Launch the browser: \`${browser.launchHelper}\`${browser.devCommand ? " or `rig-browser-launch --dev`" : ""}.`,
+    `Check the browser contract: \`${browser.checkHelper}\`.`,
+    `Show attach details: \`${browser.attachInfoHelper}\`.`,
+    `Attach Chrome DevTools MCP to ${browser.effectiveAttachUrl}.`,
+    `Preset: ${browser.preset}.`,
+    `Profile: ${browser.effectiveProfile}.`,
+    `State dir: ${browser.stateDir}.`,
+    `Reset the active profile with \`${browser.resetProfileHelper}\`.`
+  ];
+  if (browser.e2eCommand) {
+    lines.push(`Run app-owned browser e2e with \`${browser.e2eHelper}\`.`);
   }
-  return [];
-}
-function readStringList(candidate) {
-  if (!Array.isArray(candidate)) {
-    return [];
+  if (browser.defaultProfile !== browser.effectiveProfile) {
+    lines.push(`Base profile: ${browser.defaultProfile}. Runtime launches derive an isolated effective profile.`);
   }
-  return candidate.filter((value) => typeof value === "string");
-}
-function isPlainRecord(candidate) {
-  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
+  return lines;
 }
 
-// packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
-var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
-var FILE_TASK_PATTERN = /\.(task\.)?json$/;
-function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve9(projectRoot, ".rig", "task-config.json");
-  const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
-  const spawnFn = options.spawn ?? spawnSync;
-  const ghBinary = options.ghBinary ?? "gh";
-  const allowLocalFallback = options.allowLocalTaskConfigStatusFallback ?? true;
+// packages/runtime/src/control-plane/plugin-host-context.ts
+import { createPluginHost } from "@rig/core";
+import { loadConfig } from "@rig/core/load-config";
+
+// packages/runtime/src/control-plane/task-source.ts
+function createTaskSourceRegistry() {
+  const byId = new Map;
+  const order = [];
   return {
-    async listTasks() {
-      const rawConfig = readRawTaskConfig(configPath);
-      if (!rawConfig) {
-        const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
-        return configuredFilesPath ? listFileBackedTasks(projectRoot, configuredFilesPath) : [];
-      }
-      const tasks = [];
-      const legacyTasks = await legacy.listTasks();
-      const legacyById = new Map(legacyTasks.map((task) => [task.id, task]));
-      for (const [id, rawEntry] of Object.entries(stripLegacyTaskConfigMetadata2(rawConfig))) {
-        if (!isPlainRecord2(rawEntry)) {
-          continue;
-        }
-        const metadata = readMaterializedTaskMetadata(rawEntry);
-        if (metadata.taskSource?.kind === "github-issues") {
-          tasks.push(readGithubIssueTask(ghBinary, spawnFn, id, metadata, rawEntry));
-          continue;
-        }
-        if (metadata.taskSource?.kind === "files" && metadata.taskSource.path) {
-          const fileTask = readFileBackedTask(projectRoot, metadata.taskSource.path, id, rawEntry);
-          if (fileTask)
-            tasks.push(fileTask);
-          continue;
-        }
-        if (!allowLocalFallback) {
-          continue;
-        }
-        const legacyTask = legacyById.get(id);
-        if (legacyTask) {
-          tasks.push(legacyTask);
-        }
-      }
-      return tasks;
+    register(s) {
+      if (byId.has(s.id))
+        throw new Error(`task source already registered: ${s.id}`);
+      byId.set(s.id, s);
+      order.push(s);
     },
-    async getTask(id) {
-      const rawEntry = readRawTaskEntry(configPath, id);
-      if (!rawEntry) {
-        const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
-        return configuredFilesPath ? readFileBackedTask(projectRoot, configuredFilesPath, id, {}) : null;
-      }
-      const metadata = readMaterializedTaskMetadata(rawEntry);
-      if (metadata.taskSource?.kind === "github-issues") {
-        return readGithubIssueTask(ghBinary, spawnFn, id, metadata, rawEntry);
-      }
-      if (metadata.taskSource?.kind === "files" && metadata.taskSource.path) {
-        return readFileBackedTask(projectRoot, metadata.taskSource.path, id, rawEntry);
-      }
-      return allowLocalFallback ? legacy.getTask(id) : null;
-    }
+    resolveById(id) {
+      const s = byId.get(id);
+      if (!s)
+        throw new Error(`task source not registered: ${id}`);
+      return s;
+    },
+    resolveByKind(kind) {
+      for (const s of order)
+        if (s.kind === kind)
+          return s;
+      throw new Error(`no task source registered for kind: ${kind}`);
+    },
+    list: () => order
   };
 }
-function readMaterializedTaskMetadata(entry) {
-  const rawRig = entry._rig;
-  if (!isPlainRecord2(rawRig)) {
-    return {};
-  }
-  const rawSource = rawRig.taskSource;
-  const metadata = {};
-  if (isPlainRecord2(rawSource)) {
-    const kind = typeof rawSource.kind === "string" ? rawSource.kind : "";
-    if (kind.length > 0) {
-      metadata.taskSource = {
-        kind,
-        ...typeof rawSource.path === "string" ? { path: rawSource.path } : {},
-        ...typeof rawSource.owner === "string" ? { owner: rawSource.owner } : {},
-        ...typeof rawSource.repo === "string" ? { repo: rawSource.repo } : {},
-        ...Array.isArray(rawSource.labels) ? { labels: rawSource.labels.filter((label) => typeof label === "string") } : {},
-        ...rawSource.state === "open" || rawSource.state === "closed" || rawSource.state === "all" ? { state: rawSource.state } : {}
-      };
-    }
-  }
-  if (typeof rawRig.sourceIssueId === "string") {
-    metadata.sourceIssueId = rawRig.sourceIssueId;
-  }
-  return metadata;
+
+// packages/runtime/src/control-plane/task-source-bootstrap.ts
+function formatRegisteredKinds(pluginHost) {
+  const kinds = pluginHost ? pluginHost.listExecutableTaskSources().map((source) => source.kind) : [];
+  return kinds.length > 0 ? kinds.join(", ") : "none";
 }
-function readConfiguredFilesTaskSourcePath(projectRoot) {
-  const jsonPath = resolve9(projectRoot, "rig.config.json");
-  if (existsSync7(jsonPath)) {
-    try {
-      const parsed = JSON.parse(readFileSync6(jsonPath, "utf8"));
-      if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
-        const source = parsed.taskSource;
-        return source.kind === "files" && typeof source.path === "string" ? source.path : null;
-      }
-    } catch {
-      return null;
-    }
-  }
-  const tsPath = resolve9(projectRoot, "rig.config.ts");
-  if (!existsSync7(tsPath)) {
-    return null;
+function buildTaskSourceRegistry(config, pluginHost) {
+  const registry = createTaskSourceRegistry();
+  const taskSourceConfig = config.taskSource;
+  const factory = pluginHost?.resolveTaskSourceFactoryByKind(taskSourceConfig.kind);
+  if (!factory) {
+    throw new Error(`No task source factory registered for kind "${taskSourceConfig.kind}". ` + `Registered kinds: ${formatRegisteredKinds(pluginHost)}. ` + "Load a plugin that contributes an executable task source factory for this kind.");
   }
-  try {
-    const source = readFileSync6(tsPath, "utf8");
-    const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
-    const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
-    if (kind !== "files") {
-      return null;
-    }
-    return taskSourceBlock.match(/path\s*:\s*["']([^"']+)["']/)?.[1] ?? null;
-  } catch {
-    return null;
+  registry.register(factory.factory(taskSourceConfig));
+  return registry;
+}
+
+// packages/runtime/src/control-plane/repos/registry.ts
+function createRepoRegistry(entries) {
+  const map = new Map;
+  for (const e of entries) {
+    if (map.has(e.id))
+      throw new Error(`repo already registered: ${e.id}`);
+    map.set(e.id, { ...e });
   }
+  const ordered = Array.from(map.values());
+  return {
+    getById: (id) => map.get(id),
+    list: () => ordered
+  };
 }
-function readRawTaskEntry(configPath, taskId) {
-  const rawConfig = readRawTaskConfig(configPath);
-  if (!rawConfig) {
-    return null;
+var MANAGED_REPOS = new Map;
+function setManagedRepos(entries) {
+  const next = new Map;
+  for (const e of entries) {
+    if (next.has(e.id)) {
+      throw new Error(`managed repo already registered: ${e.id}`);
+    }
+    next.set(e.id, e);
   }
-  const entry = stripLegacyTaskConfigMetadata2(rawConfig)[taskId];
-  return isPlainRecord2(entry) ? entry : null;
+  MANAGED_REPOS = next;
 }
-function readRawTaskConfig(configPath) {
-  if (!existsSync7(configPath)) {
-    return null;
+function getManagedRepoEntry(repoId) {
+  const entry = MANAGED_REPOS.get(repoId);
+  if (!entry) {
+    throw new Error(`managed repo not registered: ${repoId}. Plugins contribute repos via RigPlugin.contributes.repoSources; ` + `make sure a plugin declares this id and the plugin host has been initialized.`);
   }
-  const parsed = JSON.parse(readFileSync6(configPath, "utf8"));
-  return isPlainRecord2(parsed) ? parsed : null;
+  return entry;
 }
-function stripLegacyTaskConfigMetadata2(raw) {
-  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
-  return tasks;
+function listManagedRepoEntries() {
+  return Array.from(MANAGED_REPOS.values());
 }
-function listFileBackedTasks(projectRoot, sourcePath) {
-  const directory = resolve9(projectRoot, sourcePath);
-  if (!existsSync7(directory)) {
-    return [];
-  }
-  const tasks = [];
-  for (const name of readdirSync2(directory)) {
-    if (!FILE_TASK_PATTERN.test(name))
-      continue;
-    const inferredId = basename3(name).replace(FILE_TASK_PATTERN, "");
-    const task = readFileBackedTask(projectRoot, sourcePath, inferredId, {});
-    if (task)
-      tasks.push(task);
+function resolveManagedRepoIdByAlias(alias) {
+  for (const entry of MANAGED_REPOS.values()) {
+    if (entry.alias === alias) {
+      return entry.id;
+    }
   }
-  return tasks;
+  return null;
 }
-function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
-  const file = findFileBackedTaskFile(resolve9(projectRoot, sourcePath), taskId);
-  if (!file) {
+function repoRegistrationToManagedEntry(reg) {
+  if (!reg.defaultBranch) {
     return null;
   }
-  const raw = JSON.parse(readFileSync6(file, "utf8"));
-  if (!isPlainRecord2(raw)) {
-    return null;
+  return {
+    id: reg.id,
+    alias: reg.defaultPath ?? reg.id,
+    defaultBranch: reg.defaultBranch,
+    defaultRemoteUrl: reg.url,
+    remoteEnvVar: reg.remoteEnvVar,
+    checkoutEnvVar: reg.checkoutEnvVar
+  };
+}
+
+// packages/runtime/src/control-plane/agent-roles.ts
+function createAgentRoleRegistry(pluginRoles, configOverrides) {
+  const map = new Map;
+  for (const r of pluginRoles) {
+    if (map.has(r.id))
+      throw new Error(`agent role already registered: ${r.id}`);
+    const override = configOverrides?.[r.id];
+    const model = override?.model ?? r.defaultModel;
+    if (!model) {
+      throw new Error(`agent role "${r.id}" has no model \u2014 provide defaultModel in plugin or model in config.runtime.agentRoles.${r.id}`);
+    }
+    map.set(r.id, { ...r, model });
   }
   return {
-    id: typeof raw.id === "string" ? raw.id : taskId,
-    deps: Array.isArray(raw.deps) ? raw.deps : Array.isArray(raw.depends_on) ? raw.depends_on : [],
-    status: typeof raw.status === "string" ? raw.status : "ready",
-    title: typeof raw.title === "string" ? raw.title : typeof rawEntry.title === "string" ? rawEntry.title : taskId,
-    ...raw
+    resolve(id) {
+      const r = map.get(id);
+      if (!r)
+        throw new Error(`agent role not registered: ${id}`);
+      return r;
+    },
+    list: () => Array.from(map.values())
   };
 }
-function findFileBackedTaskFile(directory, taskId) {
-  if (!existsSync7(directory)) {
-    return null;
+
+// packages/runtime/src/control-plane/task-fields.ts
+function createTaskFieldRegistry(extensions) {
+  const byId = new Map;
+  for (const e of extensions) {
+    if (byId.has(e.id))
+      throw new Error(`task field extension already registered: ${e.id}`);
+    byId.set(e.id, e);
   }
-  for (const name of readdirSync2(directory)) {
-    if (!FILE_TASK_PATTERN.test(name))
-      continue;
-    const file = join2(directory, name);
-    try {
-      if (!statSync(file).isFile())
-        continue;
-      const raw = JSON.parse(readFileSync6(file, "utf8"));
-      const inferredId = basename3(file).replace(FILE_TASK_PATTERN, "");
-      const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
-      if (id === taskId) {
-        return file;
+  return {
+    get: (id) => byId.get(id),
+    list: () => Array.from(byId.values()),
+    fieldNames: () => Array.from(byId.values()).map((e) => e.fieldName),
+    validateTaskFields(task) {
+      const errors = [];
+      for (const ext of byId.values()) {
+        let schema;
+        try {
+          schema = JSON.parse(ext.schemaJson);
+        } catch {
+          errors.push(`task field "${ext.id}": schemaJson is not valid JSON`);
+          continue;
+        }
+        const isRequired = typeof schema === "object" && schema !== null && schema.required === true;
+        if (!isRequired)
+          continue;
+        const value = task[ext.fieldName];
+        if (value === undefined || value === null || value === "") {
+          errors.push(`task field "${ext.fieldName}" (from extension "${ext.id}") is required but missing`);
+        }
       }
-    } catch {}
-  }
-  return null;
+      return errors.length === 0 ? { ok: true } : { ok: false, errors };
+    }
+  };
 }
-function readGithubIssueTask(bin, spawnFn, id, metadata, rawEntry) {
-  const source = requireGithubIssueSource(metadata, id);
-  const issue = runGh(bin, [
-    "issue",
-    "view",
-    String(id),
-    "--repo",
-    `${source.owner}/${source.repo}`,
-    "--json",
-    "number,title,body,labels,state,url,assignees"
-  ], spawnFn);
-  return githubIssueToTask(issue, source, rawEntry);
+
+// packages/runtime/src/control-plane/validators/runtime-registration.ts
+import { existsSync as existsSync4 } from "fs";
+import { join } from "path";
+function createValidatorRegistry() {
+  const map = new Map;
+  const order = [];
+  const registry = {
+    register(v) {
+      if (map.has(v.id))
+        throw new Error(`validator already registered: ${v.id}`);
+      map.set(v.id, v);
+      order.push(v);
+    },
+    resolve(id) {
+      const v = map.get(id);
+      if (!v)
+        throw new Error(`validator not registered: ${id}`);
+      return v;
+    },
+    list: () => order
+  };
+  registerBuiltInValidators(registry);
+  return registry;
 }
-function requireGithubIssueSource(metadata, id) {
-  const source = metadata.taskSource;
-  if (source?.kind === "github-issues" && source.owner && source.repo) {
-    return { owner: source.owner, repo: source.repo };
-  }
-  const parsed = metadata.sourceIssueId?.match(/^([^/]+)\/([^#]+)#(\d+)$/);
-  if (parsed && parsed[3] === id) {
-    return { owner: parsed[1], repo: parsed[2] };
-  }
-  throw new Error(`Task ${id} is marked as github-issues but has no owner/repo source metadata`);
+function registerBuiltInValidators(registry) {
+  registry.register({
+    id: "std:typecheck",
+    category: "custom",
+    description: "Runs the package typecheck script when present.",
+    run: async (ctx) => runStdTypecheck(ctx)
+  });
 }
-function githubIssueToTask(issue, source, rawEntry) {
-  const labelNames = (issue.labels ?? []).map((label) => label.name);
-  const scope = labelNames.filter((label) => label.startsWith("scope:")).map((label) => label.slice("scope:".length));
-  const roleLabel = labelNames.find((label) => label.startsWith("role:"));
-  const validators = labelNames.filter((label) => label.startsWith("validator:")).map((label) => label.slice("validator:".length));
-  const body = issue.body ?? "";
-  const repo = `${source.owner}/${source.repo}`;
+async function runStdTypecheck(ctx) {
+  const packageJsonPath = join(ctx.workspaceRoot, "package.json");
+  if (!existsSync4(packageJsonPath)) {
+    return {
+      id: "std:typecheck",
+      passed: false,
+      summary: `package.json not found at ${packageJsonPath}`
+    };
+  }
+  const proc = Bun.spawn(["bun", "run", "typecheck"], {
+    cwd: ctx.workspaceRoot,
+    env: process.env,
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  const [exitCode, stdout, stderr] = await Promise.all([
+    proc.exited,
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text()
+  ]);
+  const output = `${stdout}${stderr}`.trim();
   return {
-    id: String(issue.number),
-    deps: parseDeps(body),
-    status: githubStatusFor(issue),
-    title: issue.title,
-    body,
-    ...scope.length > 0 ? { scope } : {},
-    ...roleLabel ? { role: roleLabel.slice("role:".length) } : typeof rawEntry.role === "string" ? { role: rawEntry.role } : {},
-    ...validators.length > 0 ? { validators } : {},
-    ...issue.url ? { url: issue.url } : {},
-    issueType: issueTypeFor(labelNames),
-    sourceIssueId: `${repo}#${issue.number}`,
-    parentChildDeps: parseParents(body),
-    labels: labelNames,
-    raw: issue,
-    source: "github-issues",
-    _rig: {
-      taskSource: { kind: "github-issues", owner: source.owner, repo: source.repo },
-      sourceIssueId: `${repo}#${issue.number}`
-    }
+    id: "std:typecheck",
+    passed: exitCode === 0,
+    summary: exitCode === 0 ? "typecheck passed" : "typecheck failed",
+    ...output ? { details: output.slice(0, 4000) } : {}
   };
 }
-function githubStatusFor(issue) {
-  const state = (issue.state ?? "").toUpperCase();
-  if (state === "CLOSED")
-    return "closed";
-  const labelNames = (issue.labels ?? []).map((label) => label.name);
-  if (labelNames.includes("in-progress"))
-    return "in_progress";
-  if (labelNames.includes("blocked"))
-    return "blocked";
-  if (labelNames.includes("ready"))
-    return "ready";
-  if (labelNames.includes("under-review"))
-    return "under_review";
-  if (labelNames.includes("failed"))
-    return "failed";
-  if (labelNames.includes("cancelled"))
-    return "cancelled";
-  return "open";
+
+// packages/runtime/src/control-plane/native/scope-rules.ts
+var activeRules = null;
+function setScopeRules(rules) {
+  activeRules = rules ?? null;
 }
-function selectedGitHubEnv() {
-  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
-  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
+function getScopeRules() {
+  return activeRules;
 }
-function ghSpawnOptions() {
-  return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
+
+// packages/runtime/src/control-plane/hook-materializer.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname5, resolve as resolve7 } from "path";
+var MARKER_PLUGIN = "_rigPlugin";
+var MARKER_HOOK_ID = "_rigHookId";
+function matcherToString(matcher) {
+  if (matcher.kind === "all")
+    return;
+  if (matcher.kind === "tool")
+    return matcher.name;
+  return matcher.pattern;
 }
-function runGh(bin, args, spawnFn) {
-  const res = spawnFn(bin, [...args], ghSpawnOptions());
-  assertGhSuccess(args, res);
-  if (!res.stdout || res.stdout.trim() === "") {
-    throw new Error(`gh ${args.join(" ")} returned empty stdout`);
-  }
-  return JSON.parse(res.stdout);
+function isPluginOwned(cmd) {
+  return typeof cmd[MARKER_PLUGIN] === "string";
 }
-function assertGhSuccess(args, res) {
-  if (res.error) {
-    const msg = res.error.message ?? String(res.error);
-    throw new Error(`gh CLI not available \u2014 install gh (brew install gh / apt install gh): ${msg}`);
+function materializeHooks(projectRoot, entries) {
+  const settingsPath = resolve7(projectRoot, ".claude", "settings.json");
+  const existing = existsSync5(settingsPath) ? safeReadJson(settingsPath) : {};
+  const hooks = existing.hooks ?? {};
+  for (const event of Object.keys(hooks)) {
+    const groups = hooks[event] ?? [];
+    const cleaned = [];
+    for (const group of groups) {
+      const operatorHooks = group.hooks.filter((h) => !isPluginOwned(h));
+      if (operatorHooks.length > 0) {
+        cleaned.push({ ...group, hooks: operatorHooks });
+      }
+    }
+    if (cleaned.length > 0) {
+      hooks[event] = cleaned;
+    } else {
+      delete hooks[event];
+    }
+  }
+  for (const { pluginName, hook } of entries) {
+    if (!hook.command) {
+      continue;
+    }
+    const event = hook.event;
+    const matcherString = matcherToString(hook.matcher);
+    const groups = hooks[event] ??= [];
+    let group = groups.find((g) => g.matcher === matcherString);
+    if (!group) {
+      group = matcherString === undefined ? { hooks: [] } : { matcher: matcherString, hooks: [] };
+      groups.push(group);
+    }
+    group.hooks.push({
+      type: "command",
+      command: hook.command,
+      [MARKER_PLUGIN]: pluginName,
+      [MARKER_HOOK_ID]: hook.id
+    });
   }
-  if (res.status !== 0) {
-    throw new Error(`gh ${args.join(" ")} failed (exit ${res.status}): ${res.stderr}`);
+  const next = { ...existing };
+  if (Object.keys(hooks).length > 0) {
+    next.hooks = hooks;
+  } else {
+    delete next.hooks;
   }
+  mkdirSync3(dirname5(settingsPath), { recursive: true });
+  writeFileSync3(settingsPath, `${JSON.stringify(next, null, 2)}
+`, "utf-8");
+  return settingsPath;
 }
-function parseDeps(body) {
-  return parseIssueRefs(body, /^depends-on:\s*([^\n]+)/im);
-}
-function parseParents(body) {
-  return parseIssueRefs(body, /^parents?:\s*([^\n]+)/im);
-}
-function parseIssueRefs(body, pattern) {
-  const match = body.match(pattern);
-  if (!match)
-    return [];
-  return match[1].split(",").map((value) => value.trim()).map((value) => value.replace(/^#/, "").match(/^(\d+)/)?.[1] ?? "").filter((value) => value.length > 0);
-}
-function issueTypeFor(labels) {
-  const typed = labels.find((label) => label.startsWith("type:"));
-  if (typed)
-    return typed.slice("type:".length);
-  if (labels.includes("epic"))
-    return "epic";
-  return "task";
-}
-function isPlainRecord2(candidate) {
-  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
+function safeReadJson(path) {
+  try {
+    return JSON.parse(readFileSync4(path, "utf-8"));
+  } catch {
+    return {};
+  }
 }
 
-// packages/runtime/src/control-plane/tasks/source-lifecycle.ts
-function hasRunnableTaskSource(source) {
-  return Boolean(source && typeof source === "object" && !Array.isArray(source));
+// packages/runtime/src/control-plane/skill-materializer.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync5, readdirSync, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve8 } from "path";
+import { loadSkill } from "@rig/skill-loader";
+var MARKER_FILENAME = ".rig-plugin";
+function skillDirName(id) {
+  return id.replace(/[^a-zA-Z0-9._-]+/g, "-");
 }
-async function getPluginTask(projectRoot, taskId) {
-  const ctx = await buildPluginHostContext(projectRoot);
-  const [source] = ctx?.taskSourceRegistry.list() ?? [];
-  if (!hasRunnableTaskSource(source)) {
-    return ctx ? { configured: false, sourceKind: null, task: null } : null;
+async function materializeSkills(projectRoot, entries) {
+  const skillsRoot = resolve8(projectRoot, ".pi", "skills");
+  if (existsSync6(skillsRoot)) {
+    for (const name of readdirSync(skillsRoot)) {
+      const dir = resolve8(skillsRoot, name);
+      if (existsSync6(resolve8(dir, MARKER_FILENAME))) {
+        rmSync2(dir, { recursive: true, force: true });
+      }
+    }
   }
-  const task = source.get ? await source.get(taskId) ?? null : (await source.list()).find((entry) => entry.id === taskId) ?? null;
-  return {
-    configured: true,
-    sourceKind: source.kind,
-    task
-  };
-}
-async function readConfiguredTaskSourceTask(projectRoot, taskId) {
-  const pluginResult = await getPluginTask(projectRoot, taskId);
-  if (pluginResult)
-    return pluginResult;
-  const task = await createSourceAwareTaskConfigRecordReader(projectRoot).getTask(taskId);
-  return {
-    configured: false,
-    sourceKind: null,
-    task
-  };
+  const written = [];
+  for (const { pluginName, skill } of entries) {
+    const sourcePath = resolve8(projectRoot, skill.path);
+    if (!existsSync6(sourcePath)) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${sourcePath} does not exist`);
+      continue;
+    }
+    let body;
+    try {
+      await loadSkill(sourcePath);
+      body = readFileSync5(sourcePath, "utf-8");
+    } catch (err) {
+      console.warn(`[plugin-host] skill "${skill.id}" from plugin "${pluginName}" not materialized: ${err instanceof Error ? err.message : err}`);
+      continue;
+    }
+    const dir = resolve8(skillsRoot, skillDirName(skill.id));
+    mkdirSync4(dir, { recursive: true });
+    writeFileSync4(resolve8(dir, "SKILL.md"), body, "utf-8");
+    writeFileSync4(resolve8(dir, MARKER_FILENAME), `${JSON.stringify({ plugin: pluginName, skillId: skill.id }, null, 2)}
+`, "utf-8");
+    written.push({ id: skill.id, pluginName, directory: dir });
+  }
+  return written;
 }
 
-// packages/runtime/src/control-plane/native/task-state.ts
-import { existsSync as existsSync15, readFileSync as readFileSync10, readdirSync as readdirSync3, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename6, resolve as resolve17 } from "path";
-
-// packages/runtime/src/control-plane/state-sync/types.ts
-var SUPPORTED_TASK_STATE_SCHEMA_VERSION = 1;
-var CANONICAL_TASK_LIFECYCLE_STATUSES = new Set([
-  "draft",
-  "open",
-  "ready",
-  "queued",
-  "in_progress",
-  "under_review",
-  "blocked",
-  "completed",
-  "cancelled"
-]);
-function normalizeTaskLifecycleStatus(status) {
-  switch (status) {
-    case "draft":
-    case "open":
-    case "ready":
-    case "queued":
-    case "in_progress":
-    case "under_review":
-    case "blocked":
-    case "completed":
-    case "cancelled":
-      return status;
-    case "closed":
-      return "completed";
-    case "running":
-      return "in_progress";
-    case "failed":
-      return "ready";
-    default:
+// packages/runtime/src/control-plane/plugin-host-context.ts
+async function buildPluginHostContext(projectRoot) {
+  let config;
+  try {
+    config = await loadConfig(projectRoot);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("no rig.config")) {
       return null;
+    }
+    throw err;
   }
-}
-function normalizeTaskStateMetadataStatus(status) {
-  if (CANONICAL_TASK_LIFECYCLE_STATUSES.has(status)) {
-    return status;
-  }
-  switch (status) {
-    case "closed":
-      return "completed";
-    case "running":
-      return "in_progress";
-    case "failed":
-      return "ready";
-    default:
-      return;
+  const pluginHost = createPluginHost(config.plugins);
+  setScopeRules(config.workspace.scopeNormalization);
+  const validatorRegistry = createValidatorRegistry();
+  for (const impl of pluginHost.listExecutableValidators()) {
+    validatorRegistry.register(impl);
   }
-}
-function canonicalizeTaskStateMetadata(raw) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    return null;
+  const taskSourceRegistry = buildTaskSourceRegistry(config, pluginHost);
+  const repoRegistry = createRepoRegistry(pluginHost.listRepoSources());
+  const managedEntries = pluginHost.listRepoSources().map(repoRegistrationToManagedEntry).filter((e) => e !== null);
+  setManagedRepos(managedEntries);
+  const configRoleOverrides = config.runtime?.agentRoles;
+  const agentRoleRegistry = createAgentRoleRegistry(pluginHost.listAgentRoles(), configRoleOverrides);
+  const taskFieldRegistry = createTaskFieldRegistry(pluginHost.listTaskFieldExtensions());
+  try {
+    const hookEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.hooks ?? []).map((hook) => ({
+      pluginName: plugin.name,
+      hook
+    })));
+    if (hookEntries.length > 0) {
+      materializeHooks(projectRoot, hookEntries);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] hook materialization failed: ${err instanceof Error ? err.message : err}`);
   }
-  const metadata = raw;
-  const claimId = typeof metadata.claimId === "string" && metadata.claimId.length > 0 ? metadata.claimId : undefined;
-  const status = normalizeTaskStateMetadataStatus(metadata.status);
-  if (!status) {
-    return null;
+  try {
+    const skillEntries = config.plugins.flatMap((plugin) => (plugin.contributes?.skills ?? []).map((skill) => ({
+      pluginName: plugin.name,
+      skill
+    })));
+    if (skillEntries.length > 0) {
+      await materializeSkills(projectRoot, skillEntries);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] skill materialization failed: ${err instanceof Error ? err.message : err}`);
   }
   return {
-    ...claimId ? { claimId } : {},
-    status,
-    ...typeof metadata.ownerId === "string" && metadata.ownerId.length > 0 ? { ownerId: metadata.ownerId } : {},
-    ...typeof metadata.claimedAt === "string" && metadata.claimedAt.length > 0 ? { claimedAt: metadata.claimedAt } : {},
-    ...typeof metadata.lastEvidenceAt === "string" && metadata.lastEvidenceAt.length > 0 ? { lastEvidenceAt: metadata.lastEvidenceAt } : {},
-    ...typeof metadata.runId === "string" && metadata.runId.length > 0 ? { runId: metadata.runId } : {},
-    ...typeof metadata.branchName === "string" && metadata.branchName.length > 0 ? { branchName: metadata.branchName } : {},
-    ...typeof metadata.prNumber === "number" ? { prNumber: metadata.prNumber } : {},
-    ...typeof metadata.prUrl === "string" && metadata.prUrl.length > 0 ? { prUrl: metadata.prUrl } : {},
-    ...typeof metadata.reviewState === "string" && metadata.reviewState.length > 0 ? { reviewState: metadata.reviewState } : {},
-    ...typeof metadata.blockerReason === "string" && metadata.blockerReason.length > 0 ? { blockerReason: metadata.blockerReason } : {},
-    ...typeof metadata.sourceCommit === "string" && metadata.sourceCommit.length > 0 ? { sourceCommit: metadata.sourceCommit } : {}
+    config,
+    pluginHost,
+    validatorRegistry,
+    taskSourceRegistry,
+    repoRegistry,
+    agentRoleRegistry,
+    taskFieldRegistry
   };
 }
-function discardMismatchedTaskStateMetadata(input) {
-  input.taskId;
-  const canonicalMetadata = canonicalizeTaskStateMetadata(input.metadata);
-  if (!canonicalMetadata || !input.lifecycleStatus) {
-    return null;
+
+// packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync8, readFileSync as readFileSync7, readdirSync as readdirSync2, statSync, writeFileSync as writeFileSync5 } from "fs";
+import { basename as basename3, join as join2, resolve as resolve10 } from "path";
+
+// packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
+import { resolve as resolve9 } from "path";
+
+// packages/runtime/src/control-plane/tasks/task-record-reader.ts
+async function findTaskById(reader, id) {
+  const tasks = await reader.listTasks();
+  return tasks.find((task) => task.id === id) ?? null;
+}
+
+// packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
+class LegacyTaskConfigReadError extends Error {
+  code = "LEGACY_TASK_CONFIG_READ_FAILED";
+  projectRoot;
+  configPath;
+  cause;
+  constructor(input) {
+    super(input.message, { cause: input.cause });
+    this.name = "LegacyTaskConfigReadError";
+    this.projectRoot = input.projectRoot;
+    this.configPath = input.configPath;
+    this.cause = input.cause;
   }
-  const metadataStatus = canonicalMetadata.status ?? null;
-  if (metadataStatus && metadataStatus !== input.lifecycleStatus) {
-    return null;
+}
+function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
+  const configPath = options.configPath ?? resolve9(projectRoot, ".rig", "task-config.json");
+  const reader = {
+    async listTasks() {
+      return readLegacyTaskRecords(projectRoot, configPath);
+    },
+    async getTask(id) {
+      return findTaskById(reader, id);
+    }
+  };
+  return reader;
+}
+function readLegacyTaskRecords(projectRoot, configPath = resolve9(projectRoot, ".rig", "task-config.json")) {
+  if (!existsSync7(configPath)) {
+    return [];
   }
-  return canonicalMetadata;
+  const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
+  return Object.entries(stripLegacyTaskConfigMetadata(rawConfig)).map(([id, entry]) => legacyTaskConfigEntryToRecord(id, entry)).filter((record) => record !== null);
 }
-function readTaskStateMetadataEnvelope(raw) {
-  if (!raw || typeof raw !== "object") {
-    return { schemaVersion: SUPPORTED_TASK_STATE_SCHEMA_VERSION, supported: true, baseTrackerCommit: null, tasks: {} };
+function readLegacyTaskConfigJson(projectRoot, configPath) {
+  try {
+    const parsed = JSON.parse(readFileSync6(configPath, "utf8"));
+    if (isPlainRecord(parsed)) {
+      return parsed;
+    }
+    throw new Error("task config root must be a JSON object");
+  } catch (cause) {
+    throw new LegacyTaskConfigReadError({
+      projectRoot,
+      configPath,
+      message: `Could not read legacy task config at ${configPath} for project ${projectRoot}: ${cause instanceof Error ? cause.message : String(cause)}`,
+      cause
+    });
   }
-  const envelope = raw;
-  const schemaVersion = typeof envelope.schemaVersion === "number" ? envelope.schemaVersion : SUPPORTED_TASK_STATE_SCHEMA_VERSION;
-  if (schemaVersion !== SUPPORTED_TASK_STATE_SCHEMA_VERSION) {
-    return { schemaVersion, supported: false, baseTrackerCommit: null, tasks: {} };
+}
+function stripLegacyTaskConfigMetadata(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function legacyTaskConfigEntryToRecord(id, entry) {
+  if (!isPlainRecord(entry)) {
+    return null;
   }
-  const rawTasks = envelope.tasks && typeof envelope.tasks === "object" && !Array.isArray(envelope.tasks) ? envelope.tasks : {};
-  const tasks = Object.fromEntries(Object.entries(rawTasks).map(([taskId, metadata]) => [taskId, canonicalizeTaskStateMetadata(metadata)]).filter((entry) => entry[1] != null));
+  const deps = firstStringList(entry.deps, entry.dependencies, entry.validation_deps, entry.validationDeps);
+  const validation = readStringList(entry.validation);
+  const validators = readStringList(entry.validators);
+  const scope = readStringList(entry.scope);
+  const status = typeof entry.status === "string" ? entry.status : "open";
+  const title = typeof entry.title === "string" ? entry.title : undefined;
+  const description = typeof entry.description === "string" ? entry.description : undefined;
+  const acceptanceCriteria = typeof entry.acceptance_criteria === "string" ? entry.acceptance_criteria : typeof entry.acceptanceCriteria === "string" ? entry.acceptanceCriteria : undefined;
   return {
-    schemaVersion,
-    supported: true,
-    baseTrackerCommit: typeof envelope.baseTrackerCommit === "string" && envelope.baseTrackerCommit.length > 0 ? envelope.baseTrackerCommit : null,
-    tasks
+    id,
+    deps,
+    status,
+    source: "legacy-task-config",
+    ...title ? { title } : {},
+    ...description ? { description } : {},
+    ...acceptanceCriteria ? { acceptanceCriteria } : {},
+    ...scope.length > 0 ? { scope } : {},
+    ...validation.length > 0 ? { validation } : {},
+    ...validators.length > 0 ? { validators } : {},
+    ...preservedLegacyFields(entry)
   };
 }
-// packages/runtime/src/control-plane/state-sync/read.ts
-import { existsSync as existsSync14, readFileSync as readFileSync9 } from "fs";
-import { resolve as resolve16 } from "path";
-
-// packages/runtime/src/control-plane/native/git-native.ts
-import { chmodSync, copyFileSync, existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync7, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
-import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname5, isAbsolute, resolve as resolve10 } from "path";
-import { createHash } from "crypto";
-function isTextTreeCommitUpdate(update) {
-  return typeof update.content === "string";
-}
-var sharedGitNativeOutputDir = resolve10(tmpdir3(), "rig-native");
-var sharedGitNativeOutputPath = resolve10(sharedGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
-var trackerCommandUsageProbe = "usage: rig-git fetch-ref <repo-path> <remote> <branch>";
-function temporaryGitBinaryOutputPath(outputPath) {
-  const suffix = process.platform === "win32" ? ".exe" : "";
-  return resolve10(dirname5(outputPath), `.rig-git-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}${suffix}`);
-}
-function publishGitBinary(tempOutputPath, outputPath) {
-  try {
-    renameSync(tempOutputPath, outputPath);
-  } catch (error) {
-    if (process.platform === "win32" && existsSync8(outputPath)) {
-      rmSync2(outputPath, { force: true });
-      renameSync(tempOutputPath, outputPath);
-      return;
+function preservedLegacyFields(entry) {
+  const preserved = {};
+  for (const key of [
+    "role",
+    "browser",
+    "repo_pins",
+    "criticality",
+    "queue_weight",
+    "creates_repo",
+    "auto_synced"
+  ]) {
+    if (entry[key] !== undefined) {
+      preserved[key] = entry[key];
     }
-    throw error;
   }
+  return preserved;
 }
-function runtimeRigGitFileName() {
-  return `rig-git${process.platform === "win32" ? ".exe" : ""}`;
-}
-function rigGitSourceCandidates() {
-  const execDir = process.execPath?.trim() ? dirname5(process.execPath.trim()) : "";
-  const cwd = process.cwd()?.trim() || "";
-  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
-  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
-  const moduleRelativeSource = resolve10(import.meta.dir, "../../../native/rig-git.zig");
-  return [...new Set([
-    process.env.RIG_NATIVE_GIT_SOURCE?.trim() || "",
-    moduleRelativeSource,
-    projectRoot ? resolve10(projectRoot, "packages/runtime/native/rig-git.zig") : "",
-    hostProjectRoot ? resolve10(hostProjectRoot, "packages/runtime/native/rig-git.zig") : "",
-    cwd ? resolve10(cwd, "packages/runtime/native/rig-git.zig") : "",
-    execDir ? resolve10(execDir, "..", "..", "packages/runtime/native/rig-git.zig") : "",
-    execDir ? resolve10(execDir, "..", "native", "rig-git.zig") : ""
-  ].filter(Boolean))];
+function firstStringList(...candidates) {
+  for (const candidate of candidates) {
+    const list = readStringList(candidate);
+    if (list.length > 0) {
+      return list;
+    }
+  }
+  return [];
 }
-function nativePackageBinaryCandidates(fromDir, fileName) {
-  const candidates = [];
-  let cursor = resolve10(fromDir);
-  for (let index = 0;index < 8; index += 1) {
-    candidates.push(resolve10(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve10(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve10(cursor, "native", fileName), resolve10(cursor, "native", "bin", fileName));
-    const parent = dirname5(cursor);
-    if (parent === cursor)
-      break;
-    cursor = parent;
+function readStringList(candidate) {
+  if (!Array.isArray(candidate)) {
+    return [];
   }
-  return candidates;
+  return candidate.filter((value) => typeof value === "string");
 }
-function rigGitBinaryCandidates() {
-  const execDir = process.execPath?.trim() ? dirname5(process.execPath.trim()) : "";
-  const fileName = runtimeRigGitFileName();
-  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
-  return [...new Set([
-    explicit,
-    ...nativePackageBinaryCandidates(import.meta.dir, fileName),
-    execDir ? resolve10(execDir, fileName) : "",
-    execDir ? resolve10(execDir, "..", fileName) : "",
-    execDir ? resolve10(execDir, "..", "bin", fileName) : "",
-    sharedGitNativeOutputPath
-  ].filter(Boolean))];
+function isPlainRecord(candidate) {
+  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
 }
-function resolveGitSourcePath() {
-  for (const candidate of rigGitSourceCandidates()) {
-    if (candidate && existsSync8(candidate)) {
-      return candidate;
+
+// packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
+var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
+var FILE_TASK_PATTERN = /\.(task\.)?json$/;
+function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
+  const configPath = options.configPath ?? resolve10(projectRoot, ".rig", "task-config.json");
+  const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
+  const spawnFn = options.spawn ?? spawnSync;
+  const ghBinary = options.ghBinary ?? "gh";
+  const allowLocalFallback = options.allowLocalTaskConfigStatusFallback ?? true;
+  return {
+    async listTasks() {
+      const rawConfig = readRawTaskConfig(configPath);
+      if (!rawConfig) {
+        const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
+        return configuredFilesPath ? listFileBackedTasks(projectRoot, configuredFilesPath) : [];
+      }
+      const tasks = [];
+      const legacyTasks = await legacy.listTasks();
+      const legacyById = new Map(legacyTasks.map((task) => [task.id, task]));
+      for (const [id, rawEntry] of Object.entries(stripLegacyTaskConfigMetadata2(rawConfig))) {
+        if (!isPlainRecord2(rawEntry)) {
+          continue;
+        }
+        const metadata = readMaterializedTaskMetadata(rawEntry);
+        if (metadata.taskSource?.kind === "github-issues") {
+          tasks.push(readGithubIssueTask(ghBinary, spawnFn, id, metadata, rawEntry));
+          continue;
+        }
+        if (metadata.taskSource?.kind === "files" && metadata.taskSource.path) {
+          const fileTask = readFileBackedTask(projectRoot, metadata.taskSource.path, id, rawEntry);
+          if (fileTask)
+            tasks.push(fileTask);
+          continue;
+        }
+        if (!allowLocalFallback) {
+          continue;
+        }
+        const legacyTask = legacyById.get(id);
+        if (legacyTask) {
+          tasks.push(legacyTask);
+        }
+      }
+      return tasks;
+    },
+    async getTask(id) {
+      const rawEntry = readRawTaskEntry(configPath, id);
+      if (!rawEntry) {
+        const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
+        return configuredFilesPath ? readFileBackedTask(projectRoot, configuredFilesPath, id, {}) : null;
+      }
+      const metadata = readMaterializedTaskMetadata(rawEntry);
+      if (metadata.taskSource?.kind === "github-issues") {
+        return readGithubIssueTask(ghBinary, spawnFn, id, metadata, rawEntry);
+      }
+      if (metadata.taskSource?.kind === "files" && metadata.taskSource.path) {
+        return readFileBackedTask(projectRoot, metadata.taskSource.path, id, rawEntry);
+      }
+      return allowLocalFallback ? legacy.getTask(id) : null;
     }
-  }
-  return null;
+  };
 }
-function resolveGitBinaryPath() {
-  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
-    return null;
+function readMaterializedTaskMetadata(entry) {
+  const rawRig = entry._rig;
+  if (!isPlainRecord2(rawRig)) {
+    return {};
   }
-  for (const candidate of rigGitBinaryCandidates()) {
-    if (candidate && existsSync8(candidate)) {
-      return candidate;
+  const rawSource = rawRig.taskSource;
+  const metadata = {};
+  if (isPlainRecord2(rawSource)) {
+    const kind = typeof rawSource.kind === "string" ? rawSource.kind : "";
+    if (kind.length > 0) {
+      metadata.taskSource = {
+        kind,
+        ...typeof rawSource.path === "string" ? { path: rawSource.path } : {},
+        ...typeof rawSource.owner === "string" ? { owner: rawSource.owner } : {},
+        ...typeof rawSource.repo === "string" ? { repo: rawSource.repo } : {},
+        ...Array.isArray(rawSource.labels) ? { labels: rawSource.labels.filter((label) => typeof label === "string") } : {},
+        ...rawSource.state === "open" || rawSource.state === "closed" || rawSource.state === "all" ? { state: rawSource.state } : {}
+      };
     }
   }
-  return null;
-}
-function preferredGitBinaryOutputPath() {
-  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
-  return explicit || sharedGitNativeOutputPath;
+  if (typeof rawRig.sourceIssueId === "string") {
+    metadata.sourceIssueId = rawRig.sourceIssueId;
+  }
+  return metadata;
 }
-function binarySupportsTrackerCommandsSync(binaryPath) {
-  try {
-    const probe = Bun.spawnSync([binaryPath, "fetch-ref", "."], {
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    const stdout = probe.stdout.toString().trim();
-    const stderr = probe.stderr.toString().trim();
-    if (stdout.includes('"error":"unknown command"')) {
-      return false;
+function readConfiguredFilesTaskSourcePath(projectRoot) {
+  const jsonPath = resolve10(projectRoot, "rig.config.json");
+  if (existsSync8(jsonPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync7(jsonPath, "utf8"));
+      if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
+        const source = parsed.taskSource;
+        return source.kind === "files" && typeof source.path === "string" ? source.path : null;
+      }
+    } catch {
+      return null;
     }
-    return probe.exitCode === 2 && stderr.includes(trackerCommandUsageProbe);
-  } catch {
-    return false;
   }
-}
-function nativeBuildManifestPath(outputPath) {
-  return `${outputPath}.build-manifest.json`;
-}
-function hasMatchingNativeBuildManifestSync(manifestPath, buildKey) {
-  if (!existsSync8(manifestPath)) {
-    return false;
+  const tsPath = resolve10(projectRoot, "rig.config.ts");
+  if (!existsSync8(tsPath)) {
+    return null;
   }
   try {
-    const manifest = JSON.parse(readFileSync7(manifestPath, "utf8"));
-    return manifest.version === 1 && manifest.buildKey === buildKey;
+    const source = readFileSync7(tsPath, "utf8");
+    const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
+    const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
+    if (kind !== "files") {
+      return null;
+    }
+    return taskSourceBlock.match(/path\s*:\s*["']([^"']+)["']/)?.[1] ?? null;
   } catch {
-    return false;
+    return null;
   }
 }
-function sha256FileSync(path) {
-  return createHash("sha256").update(readFileSync7(path)).digest("hex");
-}
-function ensureRigGitBinaryPathSync(outputPath = preferredGitBinaryOutputPath()) {
-  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
-    throw new Error("Zig native git is disabled via RIG_DISABLE_ZIG_NATIVE=1");
-  }
-  const sourcePath = resolveGitSourcePath();
-  if (!sourcePath) {
-    const binaryPath = resolveGitBinaryPath();
-    if (binaryPath) {
-      return binaryPath;
-    }
-    throw new Error("rig-git.zig source file not found.");
+function readRawTaskEntry(configPath, taskId) {
+  const rawConfig = readRawTaskConfig(configPath);
+  if (!rawConfig) {
+    return null;
   }
-  const zigBinary = Bun.which("zig");
-  if (!zigBinary) {
-    throw new Error("zig is required to build native Rig git tools.");
+  const entry = stripLegacyTaskConfigMetadata2(rawConfig)[taskId];
+  return isPlainRecord2(entry) ? entry : null;
+}
+function readRawTaskConfig(configPath) {
+  if (!existsSync8(configPath)) {
+    return null;
   }
-  mkdirSync4(dirname5(outputPath), { recursive: true });
-  const sourceDigest = sha256FileSync(sourcePath);
-  const buildKey = JSON.stringify({
-    version: 1,
-    zigBinary,
-    platform: process.platform,
-    arch: process.arch,
-    sourcePath,
-    sourceDigest
-  });
-  const manifestPath = nativeBuildManifestPath(outputPath);
-  const needsBuild = !existsSync8(outputPath) || !hasMatchingNativeBuildManifestSync(manifestPath, buildKey) || !binarySupportsTrackerCommandsSync(outputPath);
-  if (!needsBuild) {
-    chmodSync(outputPath, 493);
-    return outputPath;
+  const parsed = JSON.parse(readFileSync7(configPath, "utf8"));
+  return isPlainRecord2(parsed) ? parsed : null;
+}
+function stripLegacyTaskConfigMetadata2(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function listFileBackedTasks(projectRoot, sourcePath) {
+  const directory = resolve10(projectRoot, sourcePath);
+  if (!existsSync8(directory)) {
+    return [];
   }
-  const tempOutputPath = temporaryGitBinaryOutputPath(outputPath);
-  const build = Bun.spawnSync([
-    zigBinary,
-    "build-exe",
-    sourcePath,
-    "-O",
-    "ReleaseFast",
-    `-femit-bin=${tempOutputPath}`
-  ], {
-    cwd: dirname5(sourcePath),
-    stdout: "pipe",
-    stderr: "pipe"
-  });
-  if (build.exitCode !== 0 || !existsSync8(tempOutputPath)) {
-    const stderr = build.stderr.toString().trim();
-    const stdout = build.stdout.toString().trim();
-    const details = [stderr, stdout].filter(Boolean).join(`
-`);
-    throw new Error(`Failed to build native Rig git tools: ${details || `zig exited with code ${build.exitCode}`}`);
+  const tasks = [];
+  for (const name of readdirSync2(directory)) {
+    if (!FILE_TASK_PATTERN.test(name))
+      continue;
+    const inferredId = basename3(name).replace(FILE_TASK_PATTERN, "");
+    const task = readFileBackedTask(projectRoot, sourcePath, inferredId, {});
+    if (task)
+      tasks.push(task);
   }
-  chmodSync(tempOutputPath, 493);
-  if (existsSync8(outputPath) && hasMatchingNativeBuildManifestSync(manifestPath, buildKey)) {
-    rmSync2(tempOutputPath, { force: true });
-    chmodSync(outputPath, 493);
-    return outputPath;
+  return tasks;
+}
+function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
+  const file = findFileBackedTaskFile(resolve10(projectRoot, sourcePath), taskId);
+  if (!file) {
+    return null;
   }
-  publishGitBinary(tempOutputPath, outputPath);
-  if (!binarySupportsTrackerCommandsSync(outputPath)) {
-    rmSync2(outputPath, { force: true });
-    throw new Error("Failed to build native Rig git tools: tracker command probe failed");
+  const raw = JSON.parse(readFileSync7(file, "utf8"));
+  if (!isPlainRecord2(raw)) {
+    return null;
   }
-  writeFileSync5(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
-`, "utf8");
-  return outputPath;
+  return {
+    id: typeof raw.id === "string" ? raw.id : taskId,
+    deps: Array.isArray(raw.deps) ? raw.deps : Array.isArray(raw.depends_on) ? raw.depends_on : [],
+    status: typeof raw.status === "string" ? raw.status : "ready",
+    title: typeof raw.title === "string" ? raw.title : typeof rawEntry.title === "string" ? rawEntry.title : taskId,
+    ...raw
+  };
 }
-function runGitNative(command, args) {
-  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
-    return { ok: false, error: "rig-git native disabled" };
+function findFileBackedTaskFile(directory, taskId) {
+  if (!existsSync8(directory)) {
+    return null;
   }
-  const trackerCommand = command === "fetch-ref" || command === "read-blob-at-ref" || command === "write-tree-commit" || command === "push-ref-with-lease";
-  let binaryPath = null;
-  if (trackerCommand) {
+  for (const name of readdirSync2(directory)) {
+    if (!FILE_TASK_PATTERN.test(name))
+      continue;
+    const file = join2(directory, name);
     try {
-      binaryPath = ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      if (message.includes("rig-git.zig source file not found")) {
-        return { ok: false, error: "rig-git binary not found" };
-      }
-      return { ok: false, error: message };
-    }
-  } else {
-    const explicitBinaryPath = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
-    binaryPath = explicitBinaryPath && existsSync8(explicitBinaryPath) ? explicitBinaryPath : !explicitBinaryPath ? resolveGitBinaryPath() : null;
-    if (!binaryPath) {
-      try {
-        binaryPath = ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        if (message.includes("rig-git.zig source file not found")) {
-          return { ok: false, error: "rig-git binary not found" };
-        }
-        return { ok: false, error: message };
+      if (!statSync(file).isFile())
+        continue;
+      const raw = JSON.parse(readFileSync7(file, "utf8"));
+      const inferredId = basename3(file).replace(FILE_TASK_PATTERN, "");
+      const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
+      if (id === taskId) {
+        return file;
       }
-    }
+    } catch {}
   }
-  try {
-    const proc = Bun.spawnSync([binaryPath, command, ...args], {
-      stdout: "pipe",
-      stderr: "pipe",
-      env: process.env
-    });
-    if (proc.exitCode !== 0) {
-      const stdoutText = proc.stdout.toString().trim();
-      if (stdoutText) {
-        try {
-          const parsed = JSON.parse(stdoutText);
-          if (!parsed.ok) {
-            return parsed;
-          }
-        } catch {}
-      }
-      const errText = proc.stderr.toString().trim() || `exit code ${proc.exitCode}`;
-      return { ok: false, error: errText };
-    }
-    const output = proc.stdout.toString().trim();
-    return JSON.parse(output);
-  } catch (err) {
-    return { ok: false, error: String(err) };
+  return null;
+}
+function readGithubIssueTask(bin, spawnFn, id, metadata, rawEntry) {
+  const source = requireGithubIssueSource(metadata, id);
+  const issue = runGh(bin, [
+    "issue",
+    "view",
+    String(id),
+    "--repo",
+    `${source.owner}/${source.repo}`,
+    "--json",
+    "number,title,body,labels,state,url,assignees"
+  ], spawnFn);
+  return githubIssueToTask(issue, source, rawEntry);
+}
+function requireGithubIssueSource(metadata, id) {
+  const source = metadata.taskSource;
+  if (source?.kind === "github-issues" && source.owner && source.repo) {
+    return { owner: source.owner, repo: source.repo };
+  }
+  const parsed = metadata.sourceIssueId?.match(/^([^/]+)\/([^#]+)#(\d+)$/);
+  if (parsed && parsed[3] === id) {
+    return { owner: parsed[1], repo: parsed[2] };
   }
+  throw new Error(`Task ${id} is marked as github-issues but has no owner/repo source metadata`);
 }
-function requireGitNative(command, args) {
-  const result = runGitNative(command, args);
-  if (!result.ok) {
-    throw new Error(`rig-git ${command} failed: ${result.error}`);
+function githubIssueToTask(issue, source, rawEntry) {
+  const labelNames = (issue.labels ?? []).map((label) => label.name);
+  const scope = labelNames.filter((label) => label.startsWith("scope:")).map((label) => label.slice("scope:".length));
+  const roleLabel = labelNames.find((label) => label.startsWith("role:"));
+  const validators = labelNames.filter((label) => label.startsWith("validator:")).map((label) => label.slice("validator:".length));
+  const body = issue.body ?? "";
+  const repo = `${source.owner}/${source.repo}`;
+  return {
+    id: String(issue.number),
+    deps: parseDeps(body),
+    status: githubStatusFor(issue),
+    title: issue.title,
+    body,
+    ...scope.length > 0 ? { scope } : {},
+    ...roleLabel ? { role: roleLabel.slice("role:".length) } : typeof rawEntry.role === "string" ? { role: rawEntry.role } : {},
+    ...validators.length > 0 ? { validators } : {},
+    ...issue.url ? { url: issue.url } : {},
+    issueType: issueTypeFor(labelNames),
+    sourceIssueId: `${repo}#${issue.number}`,
+    parentChildDeps: parseParents(body),
+    labels: labelNames,
+    raw: issue,
+    source: "github-issues",
+    _rig: {
+      taskSource: { kind: "github-issues", owner: source.owner, repo: source.repo },
+      sourceIssueId: `${repo}#${issue.number}`
+    }
+  };
+}
+function githubStatusFor(issue) {
+  const state = (issue.state ?? "").toUpperCase();
+  if (state === "CLOSED")
+    return "closed";
+  const labelNames = (issue.labels ?? []).map((label) => label.name);
+  if (labelNames.includes("in-progress"))
+    return "in_progress";
+  if (labelNames.includes("blocked"))
+    return "blocked";
+  if (labelNames.includes("ready"))
+    return "ready";
+  if (labelNames.includes("under-review"))
+    return "under_review";
+  if (labelNames.includes("failed"))
+    return "failed";
+  if (labelNames.includes("cancelled"))
+    return "cancelled";
+  return "open";
+}
+function selectedGitHubEnv() {
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
+}
+function ghSpawnOptions() {
+  return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
+}
+function runGh(bin, args, spawnFn) {
+  const res = spawnFn(bin, [...args], ghSpawnOptions());
+  assertGhSuccess(args, res);
+  if (!res.stdout || res.stdout.trim() === "") {
+    throw new Error(`gh ${args.join(" ")} returned empty stdout`);
   }
-  return result;
+  return JSON.parse(res.stdout);
 }
-function requireGitNativeString(command, args) {
-  const result = requireGitNative(command, args);
-  if ("value" in result && typeof result.value === "string") {
-    return result.value;
+function assertGhSuccess(args, res) {
+  if (res.error) {
+    const msg = res.error.message ?? String(res.error);
+    throw new Error(`gh CLI not available \u2014 install gh (brew install gh / apt install gh): ${msg}`);
+  }
+  if (res.status !== 0) {
+    throw new Error(`gh ${args.join(" ")} failed (exit ${res.status}): ${res.stderr}`);
   }
-  throw new Error(`rig-git ${command} returned an unexpected result payload`);
 }
-function nativeBranchName(repoPath) {
-  const result = runGitNative("branch-name", [repoPath]);
-  if (!result.ok)
-    return null;
-  if ("value" in result && typeof result.value === "string")
-    return result.value;
-  return null;
+function parseDeps(body) {
+  return parseIssueRefs(body, /^depends-on:\s*([^\n]+)/im);
 }
-function nativeHeadOid(repoPath) {
-  const result = runGitNative("head-oid", [repoPath]);
-  if (!result.ok)
-    return null;
-  if ("value" in result && typeof result.value === "string")
-    return result.value;
-  return null;
+function parseParents(body) {
+  return parseIssueRefs(body, /^parents?:\s*([^\n]+)/im);
 }
-function nativeChangeCount(repoPath) {
-  const result = runGitNative("change-count", [repoPath]);
-  if (!result.ok)
-    return null;
-  if ("count" in result && typeof result.count === "number")
-    return result.count;
-  return null;
+function parseIssueRefs(body, pattern) {
+  const match = body.match(pattern);
+  if (!match)
+    return [];
+  return match[1].split(",").map((value) => value.trim()).map((value) => value.replace(/^#/, "").match(/^(\d+)/)?.[1] ?? "").filter((value) => value.length > 0);
 }
-function nativePendingFiles(repoPath) {
-  const result = runGitNative("pending-files", [repoPath]);
-  if (!result.ok)
-    return null;
-  if ("files" in result && Array.isArray(result.files)) {
-    return result.files.map((f) => ({ path: f.path, status: f.status }));
-  }
-  return null;
+function issueTypeFor(labels) {
+  const typed = labels.find((label) => label.startsWith("type:"));
+  if (typed)
+    return typed.slice("type:".length);
+  if (labels.includes("epic"))
+    return "epic";
+  return "task";
 }
-function nativeFileHasChanges(repoPath, filePath) {
-  const result = runGitNative("file-has-changes", [repoPath, filePath]);
-  if (!result.ok)
-    return null;
-  if ("has_changes" in result && typeof result.has_changes === "boolean")
-    return result.has_changes;
-  return null;
+function isPlainRecord2(candidate) {
+  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
 }
-function nativeFetchRef(repoPath, remote, branch) {
-  return requireGitNativeString("fetch-ref", [repoPath, remote, branch]);
+
+// packages/runtime/src/control-plane/tasks/source-lifecycle.ts
+function hasRunnableTaskSource(source) {
+  return Boolean(source && typeof source === "object" && !Array.isArray(source));
 }
-function nativeReadBlobAtRef(repoPath, ref, path) {
-  const requestDir = resolve10(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
-  mkdirSync4(requestDir, { recursive: true });
-  const outputPath = resolve10(requestDir, "blob.txt");
-  try {
-    requireGitNative("read-blob-at-ref", [repoPath, ref, path, outputPath]);
-    return readFileSync7(outputPath, "utf8");
-  } finally {
-    rmSync2(requestDir, { recursive: true, force: true });
+async function getPluginTask(projectRoot, taskId) {
+  const ctx = await buildPluginHostContext(projectRoot);
+  const [source] = ctx?.taskSourceRegistry.list() ?? [];
+  if (!hasRunnableTaskSource(source)) {
+    return ctx ? { configured: false, sourceKind: null, task: null } : null;
   }
+  const task = source.get ? await source.get(taskId) ?? null : (await source.list()).find((entry) => entry.id === taskId) ?? null;
+  return {
+    configured: true,
+    sourceKind: source.kind,
+    task
+  };
 }
-function nativeReadBlobBytesAtRef(repoPath, ref, path) {
-  const requestDir = resolve10(sharedGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
-  mkdirSync4(requestDir, { recursive: true });
-  const outputPath = resolve10(requestDir, "blob.bin");
-  try {
-    requireGitNative("read-blob-at-ref", [repoPath, ref, path, outputPath]);
-    return readFileSync7(outputPath);
-  } finally {
-    rmSync2(requestDir, { recursive: true, force: true });
+async function readConfiguredTaskSourceTask(projectRoot, taskId) {
+  const pluginResult = await getPluginTask(projectRoot, taskId);
+  if (pluginResult)
+    return pluginResult;
+  const task = await createSourceAwareTaskConfigRecordReader(projectRoot).getTask(taskId);
+  return {
+    configured: false,
+    sourceKind: null,
+    task
+  };
+}
+
+// packages/runtime/src/control-plane/native/task-state.ts
+import { existsSync as existsSync15, readFileSync as readFileSync10, readdirSync as readdirSync3, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename6, resolve as resolve17 } from "path";
+
+// packages/runtime/src/control-plane/state-sync/types.ts
+var SUPPORTED_TASK_STATE_SCHEMA_VERSION = 1;
+var CANONICAL_TASK_LIFECYCLE_STATUSES = new Set([
+  "draft",
+  "open",
+  "ready",
+  "queued",
+  "in_progress",
+  "under_review",
+  "blocked",
+  "completed",
+  "cancelled"
+]);
+function normalizeTaskLifecycleStatus(status) {
+  switch (status) {
+    case "draft":
+    case "open":
+    case "ready":
+    case "queued":
+    case "in_progress":
+    case "under_review":
+    case "blocked":
+    case "completed":
+    case "cancelled":
+      return status;
+    case "closed":
+      return "completed";
+    case "running":
+      return "in_progress";
+    case "failed":
+      return "ready";
+    default:
+      return null;
   }
 }
-function serializeTreeCommitUpdates(updates) {
-  return updates.map((update) => {
-    if (isTextTreeCommitUpdate(update)) {
-      return { path: update.path, kind: "text", content: update.content };
-    }
-    if (!isAbsolute(update.sourceFilePath)) {
-      throw new Error("tree commit binary updates require an absolute sourceFilePath");
-    }
-    return { path: update.path, kind: "file", sourceFilePath: update.sourceFilePath };
-  });
+function normalizeTaskStateMetadataStatus(status) {
+  if (CANONICAL_TASK_LIFECYCLE_STATUSES.has(status)) {
+    return status;
+  }
+  switch (status) {
+    case "closed":
+      return "completed";
+    case "running":
+      return "in_progress";
+    case "failed":
+      return "ready";
+    default:
+      return;
+  }
 }
-function buildTreeCommitUpdatesJson(updates) {
-  return `${JSON.stringify(serializeTreeCommitUpdates(updates), null, 2)}
-`;
+function canonicalizeTaskStateMetadata(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return null;
+  }
+  const metadata = raw;
+  const claimId = typeof metadata.claimId === "string" && metadata.claimId.length > 0 ? metadata.claimId : undefined;
+  const status = normalizeTaskStateMetadataStatus(metadata.status);
+  if (!status) {
+    return null;
+  }
+  return {
+    ...claimId ? { claimId } : {},
+    status,
+    ...typeof metadata.ownerId === "string" && metadata.ownerId.length > 0 ? { ownerId: metadata.ownerId } : {},
+    ...typeof metadata.claimedAt === "string" && metadata.claimedAt.length > 0 ? { claimedAt: metadata.claimedAt } : {},
+    ...typeof metadata.lastEvidenceAt === "string" && metadata.lastEvidenceAt.length > 0 ? { lastEvidenceAt: metadata.lastEvidenceAt } : {},
+    ...typeof metadata.runId === "string" && metadata.runId.length > 0 ? { runId: metadata.runId } : {},
+    ...typeof metadata.branchName === "string" && metadata.branchName.length > 0 ? { branchName: metadata.branchName } : {},
+    ...typeof metadata.prNumber === "number" ? { prNumber: metadata.prNumber } : {},
+    ...typeof metadata.prUrl === "string" && metadata.prUrl.length > 0 ? { prUrl: metadata.prUrl } : {},
+    ...typeof metadata.reviewState === "string" && metadata.reviewState.length > 0 ? { reviewState: metadata.reviewState } : {},
+    ...typeof metadata.blockerReason === "string" && metadata.blockerReason.length > 0 ? { blockerReason: metadata.blockerReason } : {},
+    ...typeof metadata.sourceCommit === "string" && metadata.sourceCommit.length > 0 ? { sourceCommit: metadata.sourceCommit } : {}
+  };
 }
-function nativeWriteTreeCommit(repoPath, baseRef, updates, message) {
-  const requestDir = resolve10(sharedGitNativeOutputDir, "requests", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
-  mkdirSync4(requestDir, { recursive: true });
-  const messagePath = resolve10(requestDir, "message.txt");
-  const updatesPath = resolve10(requestDir, "updates.json");
-  try {
-    writeFileSync5(messagePath, message, "utf8");
-    writeFileSync5(updatesPath, buildTreeCommitUpdatesJson(updates), "utf8");
-    return requireGitNativeString("write-tree-commit", [repoPath, baseRef, messagePath, updatesPath]);
-  } finally {
-    rmSync2(requestDir, { recursive: true, force: true });
+function discardMismatchedTaskStateMetadata(input) {
+  input.taskId;
+  const canonicalMetadata = canonicalizeTaskStateMetadata(input.metadata);
+  if (!canonicalMetadata || !input.lifecycleStatus) {
+    return null;
+  }
+  const metadataStatus = canonicalMetadata.status ?? null;
+  if (metadataStatus && metadataStatus !== input.lifecycleStatus) {
+    return null;
   }
+  return canonicalMetadata;
 }
-function nativePushRefWithLease(repoPath, localOid, remoteRef, expectedOldOid, remote = "origin") {
-  return requireGitNativeString("push-ref-with-lease", [
-    repoPath,
-    localOid,
-    remoteRef,
-    expectedOldOid,
-    remote
-  ]);
+function readTaskStateMetadataEnvelope(raw) {
+  if (!raw || typeof raw !== "object") {
+    return { schemaVersion: SUPPORTED_TASK_STATE_SCHEMA_VERSION, supported: true, baseTrackerCommit: null, tasks: {} };
+  }
+  const envelope = raw;
+  const schemaVersion = typeof envelope.schemaVersion === "number" ? envelope.schemaVersion : SUPPORTED_TASK_STATE_SCHEMA_VERSION;
+  if (schemaVersion !== SUPPORTED_TASK_STATE_SCHEMA_VERSION) {
+    return { schemaVersion, supported: false, baseTrackerCommit: null, tasks: {} };
+  }
+  const rawTasks = envelope.tasks && typeof envelope.tasks === "object" && !Array.isArray(envelope.tasks) ? envelope.tasks : {};
+  const tasks = Object.fromEntries(Object.entries(rawTasks).map(([taskId, metadata]) => [taskId, canonicalizeTaskStateMetadata(metadata)]).filter((entry) => entry[1] != null));
+  return {
+    schemaVersion,
+    supported: true,
+    baseTrackerCommit: typeof envelope.baseTrackerCommit === "string" && envelope.baseTrackerCommit.length > 0 ? envelope.baseTrackerCommit : null,
+    tasks
+  };
 }
+// packages/runtime/src/control-plane/state-sync/read.ts
+import { existsSync as existsSync14, readFileSync as readFileSync9 } from "fs";
+import { resolve as resolve16 } from "path";
 
 // packages/runtime/src/control-plane/native/utils.ts
-import { ptr as ptr2 } from "bun:ffi";
 import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
 import { resolve as resolve13 } from "path";
 
@@ -1938,12 +1937,6 @@ var sharedNativeRuntimeOutputDir = resolve12(tmpdir4(), "rig-native");
 var sharedNativeRuntimeOutputPath = resolve12(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
 var colocatedNativeRuntimeFileName = `runtime-native.${suffix}`;
 var nativeRuntimeLibrary = await loadNativeRuntimeLibrary();
-function requireNativeRuntimeLibrary(feature) {
-  if (!nativeRuntimeLibrary) {
-    throw new Error(`Native Zig runtime is required for ${feature}`);
-  }
-  return nativeRuntimeLibrary;
-}
 async function ensureNativeRuntimeLibraryPath(outputPath = sharedNativeRuntimeOutputPath, options = {}) {
   if (await buildNativeRuntimeLibrary(outputPath, options)) {
     return outputPath;
@@ -2109,7 +2102,6 @@ function tryDlopenNativeRuntimeLibrary(outputPath) {
 function resolveMonorepoRoot2(projectRoot) {
   return resolveMonorepoRoot(projectRoot);
 }
-var nativeScopeMatcher = null;
 var scopeRegexCache = new Map;
 function runCapture(command, cwd, env) {
   const result = Bun.spawnSync(command, {
@@ -2266,41 +2258,6 @@ function monorepoSearchCandidates(inputPath) {
   }
   return [...candidates];
 }
-function scopeMatches(path, scopes) {
-  const matcher = getNativeScopeMatcher();
-  const pathVariants = unique([path, normalizeRelativeScopePath(path)]);
-  for (const scope of scopes) {
-    const scopeVariants = unique([scope, normalizeRelativeScopePath(scope)]);
-    for (const candidatePath of pathVariants) {
-      for (const candidateScope of scopeVariants) {
-        if (candidatePath === candidateScope) {
-          return true;
-        }
-        if (matcher.match(candidateScope, candidatePath)) {
-          return true;
-        }
-      }
-    }
-  }
-  return false;
-}
-function getNativeScopeMatcher() {
-  if (nativeScopeMatcher) {
-    return nativeScopeMatcher;
-  }
-  nativeScopeMatcher = createNativeScopeMatcher();
-  return nativeScopeMatcher;
-}
-function createNativeScopeMatcher() {
-  const library = requireNativeRuntimeLibrary("scope matching");
-  return {
-    match: (pattern, path) => {
-      const patternBuffer = Buffer.from(`${pattern}\x00`);
-      const pathBuffer = Buffer.from(`${path}\x00`);
-      return library.symbols.rig_scope_match(Number(ptr2(patternBuffer)), Number(ptr2(pathBuffer))) !== 0;
-    }
-  };
-}
 
 // packages/runtime/src/control-plane/state-sync/repo.ts
 import { existsSync as existsSync13 } from "fs";
@@ -6937,20 +6894,7 @@ function filterTaskChangedFiles(projectRoot, taskId, files, scoped) {
   if (!taskId) {
     return unique(uniqueFiles).sort();
   }
-  const filteredFiles = unique(uniqueFiles).filter((file) => !isGeneratedTaskChangePath(taskId, file));
-  if (!scoped) {
-    return filteredFiles.sort();
-  }
-  const paths = resolveHarnessPaths(projectRoot);
-  const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
-  const scopes = readTaskConfigForInvocation(projectRoot)[taskId]?.scope || [];
-  if (scopes.length === 0) {
-    return [];
-  }
-  return filteredFiles.filter((file) => {
-    const normalized = normalizePathToScope(projectRoot, monorepoRoot || paths.monorepoRoot, file);
-    return scopeMatches(file, scopes) || scopeMatches(normalized, scopes);
-  }).sort();
+  return unique(uniqueFiles).filter((file) => !isGeneratedTaskChangePath(taskId, file)).sort();
 }
 function resolveTaskMonorepoRoot(projectRoot) {
   const runtimeWorkspace = loadRuntimeContextFromEnv()?.workspaceDir || process.env.RIG_TASK_WORKSPACE?.trim();
@@ -7001,6 +6945,17 @@ function resolveMonorepoBaseCommit(projectRoot, repo) {
 }
 function collectWorkingTreeFiles(projectRoot, repo, baseline) {
   const files = new Set;
+  const nativeFiles = nativePendingFiles(repo);
+  if (nativeFiles !== null) {
+    for (const entry of nativeFiles) {
+      const normalized = normalizeChangedFilePath(entry.path);
+      if (!normalized || baseline.has(normalized)) {
+        continue;
+      }
+      files.add(normalized);
+    }
+    return [...files].sort();
+  }
   for (const args of [
     ["diff", "--name-only"],
     ["diff", "--cached", "--name-only"],