@h-rig/runtime 0.0.6-alpha.33 → 0.0.6-alpha.35

package/dist/src/control-plane/native/task-ops.js

@@ -1,7 +1,7 @@
 // @bun
 // packages/runtime/src/control-plane/native/task-ops.ts
-import { appendFileSync, existsSync as existsSync21, mkdirSync as mkdirSync11, readFileSync as readFileSync11, writeFileSync as writeFileSync11 } from "fs";
-import { resolve as resolve24 } from "path";
+import { appendFileSync, existsSync as existsSync23, mkdirSync as mkdirSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync12 } from "fs";
+import { resolve as resolve25 } from "path";
 
 // packages/runtime/src/build-time-config.ts
 function normalizeBuildConfig(value) {
@@ -680,6 +680,8 @@ function buildBrowserGuidanceLines(browser) {
 }
 
 // packages/runtime/src/control-plane/plugin-host-context.ts
+import { existsSync as existsSync7 } from "fs";
+import { resolve as resolvePath } from "path";
 import { createPluginHost } from "@rig/core";
 import { loadConfig } from "@rig/core/load-config";
 
@@ -1019,6 +1021,55 @@ async function materializeSkills(projectRoot, entries) {
   return written;
 }
 
+// packages/runtime/src/control-plane/pi-settings-materializer.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname6, resolve as resolve8 } from "path";
+var SETTINGS_RELATIVE_PATH = ".pi/settings.json";
+var MANAGED_RECORD_RELATIVE_PATH = ".rig/state/pi-managed-packages.json";
+function readJson(path, fallback) {
+  if (!existsSync6(path))
+    return fallback;
+  try {
+    return JSON.parse(readFileSync5(path, "utf-8"));
+  } catch {
+    return fallback;
+  }
+}
+function packageKey(entry) {
+  if (typeof entry === "string")
+    return entry;
+  if (entry && typeof entry === "object" && typeof entry.source === "string") {
+    return entry.source;
+  }
+  return JSON.stringify(entry);
+}
+function materializePiPackages(projectRoot, declaredPackages) {
+  const settingsPath = resolve8(projectRoot, SETTINGS_RELATIVE_PATH);
+  const managedRecordPath = resolve8(projectRoot, MANAGED_RECORD_RELATIVE_PATH);
+  const settings = readJson(settingsPath, {});
+  const previouslyManaged = new Set(readJson(managedRecordPath, []));
+  const existing = Array.isArray(settings.packages) ? settings.packages : [];
+  const operatorEntries = existing.filter((entry) => !previouslyManaged.has(packageKey(entry)));
+  const operatorKeys = new Set(operatorEntries.map(packageKey));
+  const managedToAdd = declaredPackages.filter((pkg) => !operatorKeys.has(pkg));
+  const nextPackages = [...operatorEntries, ...managedToAdd];
+  if (nextPackages.length > 0 || existsSync6(settingsPath)) {
+    const nextSettings = { ...settings };
+    if (nextPackages.length > 0) {
+      nextSettings.packages = nextPackages;
+    } else {
+      delete nextSettings.packages;
+    }
+    mkdirSync5(dirname6(settingsPath), { recursive: true });
+    writeFileSync5(settingsPath, `${JSON.stringify(nextSettings, null, 2)}
+`, "utf-8");
+  }
+  mkdirSync5(dirname6(managedRecordPath), { recursive: true });
+  writeFileSync5(managedRecordPath, `${JSON.stringify(managedToAdd, null, 2)}
+`, "utf-8");
+  return { settingsPath, packages: managedToAdd };
+}
+
 // packages/runtime/src/control-plane/plugin-host-context.ts
 async function buildPluginHostContext(projectRoot) {
   let config;
@@ -1066,6 +1117,14 @@ async function buildPluginHostContext(projectRoot) {
   } catch (err) {
     console.warn(`[plugin-host] skill materialization failed: ${err instanceof Error ? err.message : err}`);
   }
+  try {
+    const piPackages = config.runtime?.pi?.packages ?? [];
+    if (piPackages.length > 0 || existsSync7(resolvePath(projectRoot, ".rig/state/pi-managed-packages.json"))) {
+      materializePiPackages(projectRoot, piPackages);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] Pi package materialization failed: ${err instanceof Error ? err.message : err}`);
+  }
   return {
     config,
     pluginHost,
@@ -1079,12 +1138,12 @@ async function buildPluginHostContext(projectRoot) {
 
 // packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync6, readdirSync as readdirSync2, statSync, writeFileSync as writeFileSync5 } from "fs";
-import { basename as basename3, join as join2, resolve as resolve9 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync7, readdirSync as readdirSync2, statSync, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename3, join as join2, resolve as resolve10 } from "path";
 
 // packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
-import { resolve as resolve8 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { resolve as resolve9 } from "path";
 
 // packages/runtime/src/control-plane/tasks/task-record-reader.ts
 async function findTaskById(reader, id) {
@@ -1107,7 +1166,7 @@ class LegacyTaskConfigReadError extends Error {
   }
 }
 function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve8(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve9(projectRoot, ".rig", "task-config.json");
   const reader = {
     async listTasks() {
       return readLegacyTaskRecords(projectRoot, configPath);
@@ -1118,8 +1177,8 @@ function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
   };
   return reader;
 }
-function readLegacyTaskRecords(projectRoot, configPath = resolve8(projectRoot, ".rig", "task-config.json")) {
-  if (!existsSync6(configPath)) {
+function readLegacyTaskRecords(projectRoot, configPath = resolve9(projectRoot, ".rig", "task-config.json")) {
+  if (!existsSync8(configPath)) {
     return [];
   }
   const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
@@ -1127,7 +1186,7 @@ function readLegacyTaskRecords(projectRoot, configPath = resolve8(projectRoot, "
 }
 function readLegacyTaskConfigJson(projectRoot, configPath) {
   try {
-    const parsed = JSON.parse(readFileSync5(configPath, "utf8"));
+    const parsed = JSON.parse(readFileSync6(configPath, "utf8"));
     if (isPlainRecord(parsed)) {
       return parsed;
     }
@@ -1211,7 +1270,7 @@ function isPlainRecord(candidate) {
 var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
 var FILE_TASK_PATTERN = /\.(task\.)?json$/;
 function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve9(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve10(projectRoot, ".rig", "task-config.json");
   const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
   const spawnFn = options.spawn ?? spawnSync;
   const ghBinary = options.ghBinary ?? "gh";
@@ -1294,10 +1353,10 @@ function readMaterializedTaskMetadata(entry) {
   return metadata;
 }
 function readConfiguredFilesTaskSourcePath(projectRoot) {
-  const jsonPath = resolve9(projectRoot, "rig.config.json");
-  if (existsSync7(jsonPath)) {
+  const jsonPath = resolve10(projectRoot, "rig.config.json");
+  if (existsSync9(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync6(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync7(jsonPath, "utf8"));
       if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
         const source = parsed.taskSource;
         return source.kind === "files" && typeof source.path === "string" ? source.path : null;
@@ -1306,12 +1365,12 @@ function readConfiguredFilesTaskSourcePath(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve9(projectRoot, "rig.config.ts");
-  if (!existsSync7(tsPath)) {
+  const tsPath = resolve10(projectRoot, "rig.config.ts");
+  if (!existsSync9(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync6(tsPath, "utf8");
+    const source = readFileSync7(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -1331,10 +1390,10 @@ function readRawTaskEntry(configPath, taskId) {
   return isPlainRecord2(entry) ? entry : null;
 }
 function readRawTaskConfig(configPath) {
-  if (!existsSync7(configPath)) {
+  if (!existsSync9(configPath)) {
     return null;
   }
-  const parsed = JSON.parse(readFileSync6(configPath, "utf8"));
+  const parsed = JSON.parse(readFileSync7(configPath, "utf8"));
   return isPlainRecord2(parsed) ? parsed : null;
 }
 function stripLegacyTaskConfigMetadata2(raw) {
@@ -1342,8 +1401,8 @@ function stripLegacyTaskConfigMetadata2(raw) {
   return tasks;
 }
 function listFileBackedTasks(projectRoot, sourcePath) {
-  const directory = resolve9(projectRoot, sourcePath);
-  if (!existsSync7(directory)) {
+  const directory = resolve10(projectRoot, sourcePath);
+  if (!existsSync9(directory)) {
     return [];
   }
   const tasks = [];
@@ -1358,11 +1417,11 @@ function listFileBackedTasks(projectRoot, sourcePath) {
   return tasks;
 }
 function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
-  const file = findFileBackedTaskFile(resolve9(projectRoot, sourcePath), taskId);
+  const file = findFileBackedTaskFile(resolve10(projectRoot, sourcePath), taskId);
   if (!file) {
     return null;
   }
-  const raw = JSON.parse(readFileSync6(file, "utf8"));
+  const raw = JSON.parse(readFileSync7(file, "utf8"));
   if (!isPlainRecord2(raw)) {
     return null;
   }
@@ -1375,7 +1434,7 @@ function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
   };
 }
 function findFileBackedTaskFile(directory, taskId) {
-  if (!existsSync7(directory)) {
+  if (!existsSync9(directory)) {
     return null;
   }
   for (const name of readdirSync2(directory)) {
@@ -1385,7 +1444,7 @@ function findFileBackedTaskFile(directory, taskId) {
     try {
       if (!statSync(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync6(file, "utf8"));
+      const raw = JSON.parse(readFileSync7(file, "utf8"));
       const inferredId = basename3(file).replace(FILE_TASK_PATTERN, "");
       const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
       if (id === taskId) {
@@ -1545,8 +1604,8 @@ async function readConfiguredTaskSourceTask(projectRoot, taskId) {
 }
 
 // packages/runtime/src/control-plane/native/task-state.ts
-import { existsSync as existsSync14, readFileSync as readFileSync9, readdirSync as readdirSync3, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename6, resolve as resolve16 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync10, readdirSync as readdirSync3, statSync as statSync3, writeFileSync as writeFileSync7 } from "fs";
+import { basename as basename6, resolve as resolve17 } from "path";
 
 // packages/runtime/src/control-plane/state-sync/types.ts
 var SUPPORTED_TASK_STATE_SCHEMA_VERSION = 1;
@@ -1654,50 +1713,50 @@ function readTaskStateMetadataEnvelope(raw) {
   };
 }
 // packages/runtime/src/control-plane/state-sync/read.ts
-import { existsSync as existsSync13, readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve15 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync9 } from "fs";
+import { resolve as resolve16 } from "path";
 
 // packages/runtime/src/control-plane/native/utils.ts
-import { existsSync as existsSync10, readFileSync as readFileSync7 } from "fs";
-import { resolve as resolve12 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync8 } from "fs";
+import { resolve as resolve13 } from "path";
 
 // packages/runtime/src/layout.ts
-import { existsSync as existsSync8 } from "fs";
-import { basename as basename4, dirname as dirname6, resolve as resolve10 } from "path";
+import { existsSync as existsSync10 } from "fs";
+import { basename as basename4, dirname as dirname7, resolve as resolve11 } from "path";
 var RIG_DEFINITION_DIRNAME = "rig";
 var RIG_ARTIFACTS_DIRNAME = "artifacts";
 function resolveMonorepoRoot(projectRoot) {
-  const normalizedProjectRoot = resolve10(projectRoot);
+  const normalizedProjectRoot = resolve11(projectRoot);
   const explicit = process.env.MONOREPO_ROOT?.trim();
   if (explicit) {
-    const explicitRoot = resolve10(explicit);
-    const explicitParent = dirname6(explicitRoot);
+    const explicitRoot = resolve11(explicit);
+    const explicitParent = dirname7(explicitRoot);
     if (basename4(explicitParent) === ".worktrees") {
-      const owner = dirname6(explicitParent);
-      const ownerHasGit = existsSync8(resolve10(owner, ".git"));
-      const ownerHasTaskConfig = existsSync8(resolve10(owner, ".rig", "task-config.json"));
-      const ownerHasRigConfig = existsSync8(resolve10(owner, "rig.config.ts"));
+      const owner = dirname7(explicitParent);
+      const ownerHasGit = existsSync10(resolve11(owner, ".git"));
+      const ownerHasTaskConfig = existsSync10(resolve11(owner, ".rig", "task-config.json"));
+      const ownerHasRigConfig = existsSync10(resolve11(owner, "rig.config.ts"));
       if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
         return owner;
       }
       throw new Error(`MONOREPO_ROOT points to worktree ${explicitRoot}, but the owner checkout is incomplete at ${owner}.`);
     }
-    if (!existsSync8(resolve10(explicitRoot, ".git"))) {
+    if (!existsSync10(resolve11(explicitRoot, ".git"))) {
       throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but no git checkout was found there.`);
     }
-    const hasTaskConfig = existsSync8(resolve10(explicitRoot, ".rig", "task-config.json"));
-    const hasRigConfig = existsSync8(resolve10(explicitRoot, "rig.config.ts"));
+    const hasTaskConfig = existsSync10(resolve11(explicitRoot, ".rig", "task-config.json"));
+    const hasRigConfig = existsSync10(resolve11(explicitRoot, "rig.config.ts"));
     if (!hasTaskConfig && !hasRigConfig) {
       throw new Error(`MONOREPO_ROOT points to ${explicitRoot}, but neither .rig/task-config.json nor rig.config.ts exists there.`);
     }
     return explicitRoot;
   }
-  const projectParent = dirname6(normalizedProjectRoot);
+  const projectParent = dirname7(normalizedProjectRoot);
   if (basename4(projectParent) === ".worktrees") {
-    const worktreeOwner = dirname6(projectParent);
-    const ownerHasGit = existsSync8(resolve10(worktreeOwner, ".git"));
-    const ownerHasTaskConfig = existsSync8(resolve10(worktreeOwner, ".rig", "task-config.json"));
-    const ownerHasRigConfig = existsSync8(resolve10(worktreeOwner, "rig.config.ts"));
+    const worktreeOwner = dirname7(projectParent);
+    const ownerHasGit = existsSync10(resolve11(worktreeOwner, ".git"));
+    const ownerHasTaskConfig = existsSync10(resolve11(worktreeOwner, ".rig", "task-config.json"));
+    const ownerHasRigConfig = existsSync10(resolve11(worktreeOwner, "rig.config.ts"));
     if (ownerHasGit && (ownerHasTaskConfig || ownerHasRigConfig)) {
       return worktreeOwner;
     }
@@ -1705,28 +1764,28 @@ function resolveMonorepoRoot(projectRoot) {
   return normalizedProjectRoot;
 }
 function resolveRuntimeWorkspaceLayout(workspaceDir) {
-  const root = resolve10(workspaceDir);
-  const rigRoot = resolve10(root, ".rig");
-  const logsDir = resolve10(rigRoot, "logs");
-  const stateDir = resolve10(rigRoot, "state");
-  const runtimeDir = resolve10(rigRoot, "runtime");
-  const binDir = resolve10(rigRoot, "bin");
+  const root = resolve11(workspaceDir);
+  const rigRoot = resolve11(root, ".rig");
+  const logsDir = resolve11(rigRoot, "logs");
+  const stateDir = resolve11(rigRoot, "state");
+  const runtimeDir = resolve11(rigRoot, "runtime");
+  const binDir = resolve11(rigRoot, "bin");
   return {
     workspaceDir: root,
     rigRoot,
     stateDir,
     logsDir,
-    artifactsRoot: resolve10(root, RIG_ARTIFACTS_DIRNAME),
+    artifactsRoot: resolve11(root, RIG_ARTIFACTS_DIRNAME),
     runtimeDir,
-    homeDir: resolve10(rigRoot, "home"),
-    tmpDir: resolve10(rigRoot, "tmp"),
-    cacheDir: resolve10(rigRoot, "cache"),
-    sessionDir: resolve10(rigRoot, "session"),
+    homeDir: resolve11(rigRoot, "home"),
+    tmpDir: resolve11(rigRoot, "tmp"),
+    cacheDir: resolve11(rigRoot, "cache"),
+    sessionDir: resolve11(rigRoot, "session"),
     binDir,
-    distDir: resolve10(rigRoot, "dist"),
-    pluginBinDir: resolve10(binDir, "plugins"),
-    contextPath: resolve10(rigRoot, "runtime-context.json"),
-    controlPlaneEventsFile: resolve10(logsDir, "control-plane.events.jsonl")
+    distDir: resolve11(rigRoot, "dist"),
+    pluginBinDir: resolve11(binDir, "plugins"),
+    contextPath: resolve11(rigRoot, "runtime-context.json"),
+    controlPlaneEventsFile: resolve11(logsDir, "control-plane.events.jsonl")
   };
 }
 function resolveActiveRuntimeWorkspaceRoot(monorepoRoot) {
@@ -1734,14 +1793,14 @@ function resolveActiveRuntimeWorkspaceRoot(monorepoRoot) {
   if (!explicit) {
     throw new Error("No active runtime workspace. Set RIG_TASK_WORKSPACE or provision a task runtime first.");
   }
-  return resolve10(explicit);
+  return resolve11(explicit);
 }
 function resolveRigLayout(projectRoot) {
   const monorepoRoot = resolveMonorepoRoot(projectRoot);
-  const definitionRoot = resolve10(projectRoot, RIG_DEFINITION_DIRNAME);
+  const definitionRoot = resolve11(projectRoot, RIG_DEFINITION_DIRNAME);
   const runtimeWorkspaceRoot = resolveActiveRuntimeWorkspaceRoot(monorepoRoot);
   const runtimeLayout = resolveRuntimeWorkspaceLayout(runtimeWorkspaceRoot);
-  const policyDir = resolve10(definitionRoot, "policy");
+  const policyDir = resolve11(definitionRoot, "policy");
   return {
     projectRoot,
     monorepoRoot,
@@ -1749,48 +1808,48 @@ function resolveRigLayout(projectRoot) {
     runtimeWorkspaceRoot,
     stateRoot: runtimeLayout.rigRoot,
     artifactsRoot: runtimeLayout.artifactsRoot,
-    configPath: resolve10(definitionRoot, "config.sh"),
-    taskConfigPath: resolve10(runtimeWorkspaceRoot, ".rig", "task-config.json"),
+    configPath: resolve11(definitionRoot, "config.sh"),
+    taskConfigPath: resolve11(runtimeWorkspaceRoot, ".rig", "task-config.json"),
     policyDir,
-    policyFile: resolve10(policyDir, "policy.json"),
-    pluginsDir: resolve10(definitionRoot, "plugins"),
-    hooksDir: resolve10(definitionRoot, "hooks"),
-    toolsDir: resolve10(definitionRoot, "tools"),
-    templatesDir: resolve10(definitionRoot, "templates"),
-    validationDir: resolve10(definitionRoot, "validation"),
+    policyFile: resolve11(policyDir, "policy.json"),
+    pluginsDir: resolve11(definitionRoot, "plugins"),
+    hooksDir: resolve11(definitionRoot, "hooks"),
+    toolsDir: resolve11(definitionRoot, "tools"),
+    templatesDir: resolve11(definitionRoot, "templates"),
+    validationDir: resolve11(definitionRoot, "validation"),
     stateDir: runtimeLayout.stateDir,
     logsDir: runtimeLayout.logsDir,
-    notificationsDir: resolve10(definitionRoot, "notifications"),
+    notificationsDir: resolve11(definitionRoot, "notifications"),
     runtimeDir: runtimeLayout.runtimeDir,
     distDir: runtimeLayout.distDir,
     binDir: runtimeLayout.binDir,
     pluginBinDir: runtimeLayout.pluginBinDir,
-    keybindingsPath: resolve10(definitionRoot, "keybindings.json"),
+    keybindingsPath: resolve11(definitionRoot, "keybindings.json"),
     controlPlaneEventsFile: runtimeLayout.controlPlaneEventsFile
   };
 }
 
 // packages/runtime/src/control-plane/native/runtime-native.ts
 import { dlopen, ptr, suffix, toBuffer } from "bun:ffi";
-import { copyFileSync as copyFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync5, renameSync as renameSync2, rmSync as rmSync3, statSync as statSync2 } from "fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync11, mkdirSync as mkdirSync6, renameSync as renameSync2, rmSync as rmSync3, statSync as statSync2 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { dirname as dirname7, resolve as resolve11 } from "path";
-var sharedNativeRuntimeOutputDir = resolve11(tmpdir4(), "rig-native");
-var sharedNativeRuntimeOutputPath = resolve11(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
+import { dirname as dirname8, resolve as resolve12 } from "path";
+var sharedNativeRuntimeOutputDir = resolve12(tmpdir4(), "rig-native");
+var sharedNativeRuntimeOutputPath = resolve12(sharedNativeRuntimeOutputDir, `runtime-native-${process.platform}-${process.arch}.${suffix}`);
 var colocatedNativeRuntimeFileName = `runtime-native.${suffix}`;
 var nativeRuntimeLibrary = await loadNativeRuntimeLibrary();
 async function ensureNativeRuntimeLibraryPath(outputPath = sharedNativeRuntimeOutputPath, options = {}) {
   if (await buildNativeRuntimeLibrary(outputPath, options)) {
     return outputPath;
   }
-  return !options.force && existsSync9(outputPath) ? outputPath : null;
+  return !options.force && existsSync11(outputPath) ? outputPath : null;
 }
 async function loadNativeRuntimeLibrary() {
   if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
     return null;
   }
   for (const candidate of nativeRuntimeLibraryCandidates()) {
-    if (!candidate || !existsSync9(candidate)) {
+    if (!candidate || !existsSync11(candidate)) {
       continue;
     }
     const loaded = tryDlopenNativeRuntimeLibrary(candidate);
@@ -1806,12 +1865,12 @@ async function loadNativeRuntimeLibrary() {
 }
 function nativePackageLibraryCandidates(fromDir, names) {
   const candidates = [];
-  let cursor = resolve11(fromDir);
+  let cursor = resolve12(fromDir);
   for (let index = 0;index < 8; index += 1) {
     for (const name of names) {
-      candidates.push(resolve11(cursor, "native", `${process.platform}-${process.arch}`, name), resolve11(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve11(cursor, "native", name), resolve11(cursor, "native", "lib", name));
+      candidates.push(resolve12(cursor, "native", `${process.platform}-${process.arch}`, name), resolve12(cursor, "native", `${process.platform}-${process.arch}`, "lib", name), resolve12(cursor, "native", name), resolve12(cursor, "native", "lib", name));
     }
-    const parent = dirname7(cursor);
+    const parent = dirname8(cursor);
     if (parent === cursor)
       break;
     cursor = parent;
@@ -1820,27 +1879,27 @@ function nativePackageLibraryCandidates(fromDir, names) {
 }
 function nativeRuntimeLibraryCandidates() {
   const explicit = process.env.RIG_NATIVE_RUNTIME_LIB?.trim() || "";
-  const execDir = process.execPath?.trim() ? dirname7(process.execPath.trim()) : "";
+  const execDir = process.execPath?.trim() ? dirname8(process.execPath.trim()) : "";
   const platformSpecific = `runtime-native-${process.platform}-${process.arch}.${suffix}`;
   return [...new Set([
     explicit,
     ...nativePackageLibraryCandidates(import.meta.dir, [colocatedNativeRuntimeFileName, platformSpecific]),
-    execDir ? resolve11(execDir, colocatedNativeRuntimeFileName) : "",
-    execDir ? resolve11(execDir, platformSpecific) : "",
-    execDir ? resolve11(execDir, "..", colocatedNativeRuntimeFileName) : "",
-    execDir ? resolve11(execDir, "..", platformSpecific) : "",
-    execDir ? resolve11(execDir, "lib", colocatedNativeRuntimeFileName) : "",
-    execDir ? resolve11(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve12(execDir, colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve12(execDir, platformSpecific) : "",
+    execDir ? resolve12(execDir, "..", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve12(execDir, "..", platformSpecific) : "",
+    execDir ? resolve12(execDir, "lib", colocatedNativeRuntimeFileName) : "",
+    execDir ? resolve12(execDir, "..", "lib", colocatedNativeRuntimeFileName) : "",
     sharedNativeRuntimeOutputPath
   ].filter(Boolean))];
 }
 function resolveNativeRuntimeSourcePath() {
   const explicit = process.env.RIG_NATIVE_RUNTIME_SOURCE?.trim();
-  if (explicit && existsSync9(explicit)) {
+  if (explicit && existsSync11(explicit)) {
     return explicit;
   }
-  const bundled = resolve11(import.meta.dir, "../../../native/snapshot.zig");
-  return existsSync9(bundled) ? bundled : null;
+  const bundled = resolve12(import.meta.dir, "../../../native/snapshot.zig");
+  return existsSync11(bundled) ? bundled : null;
 }
 async function buildNativeRuntimeLibrary(outputPath, options = {}) {
   if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
@@ -1853,8 +1912,8 @@ async function buildNativeRuntimeLibrary(outputPath, options = {}) {
   }
   const tempOutputPath = `${outputPath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
   try {
-    mkdirSync5(dirname7(outputPath), { recursive: true });
-    const needsBuild = options.force === true || !existsSync9(outputPath) || statSync2(sourcePath).mtimeMs > statSync2(outputPath).mtimeMs;
+    mkdirSync6(dirname8(outputPath), { recursive: true });
+    const needsBuild = options.force === true || !existsSync11(outputPath) || statSync2(sourcePath).mtimeMs > statSync2(outputPath).mtimeMs;
     if (!needsBuild) {
       return true;
     }
@@ -1872,7 +1931,7 @@ async function buildNativeRuntimeLibrary(outputPath, options = {}) {
       stderr: "pipe"
     });
     const exitCode = await build.exited;
-    if (exitCode !== 0 || !existsSync9(tempOutputPath)) {
+    if (exitCode !== 0 || !existsSync11(tempOutputPath)) {
       rmSync3(tempOutputPath, { force: true });
       return false;
     }
@@ -2002,11 +2061,11 @@ async function runCaptureAsync(command, cwd, env, timeoutMs) {
   return { exitCode, stdout, stderr };
 }
 function readJsonFile(path, fallback) {
-  if (!existsSync10(path)) {
+  if (!existsSync12(path)) {
     return fallback;
   }
   try {
-    return JSON.parse(readFileSync7(path, "utf-8"));
+    return JSON.parse(readFileSync8(path, "utf-8"));
   } catch {
     return fallback;
   }
@@ -2020,31 +2079,31 @@ function unique(values) {
 function resolveHarnessPaths(projectRoot) {
   const hasRuntimeWorkspace = Boolean(process.env.RIG_TASK_WORKSPACE?.trim());
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
-  const harnessRoot = resolve12(projectRoot, "rig");
-  const stateRoot = resolve12(projectRoot, ".rig");
+  const harnessRoot = resolve13(projectRoot, "rig");
+  const stateRoot = resolve13(projectRoot, ".rig");
   const layout = hasRuntimeWorkspace ? resolveRigLayout(projectRoot) : null;
-  const stateDir = layout?.stateDir ?? resolve12(stateRoot, "state");
-  const logsDir = layout?.logsDir ?? resolve12(stateRoot, "logs");
-  const artifactsDir = layout?.artifactsRoot ?? resolve12(monorepoRoot, "artifacts");
-  const taskConfigPath = layout?.taskConfigPath ?? resolve12(monorepoRoot, ".rig", "task-config.json");
-  const binDir = layout?.binDir ?? resolve12(stateRoot, "bin");
+  const stateDir = layout?.stateDir ?? resolve13(stateRoot, "state");
+  const logsDir = layout?.logsDir ?? resolve13(stateRoot, "logs");
+  const artifactsDir = layout?.artifactsRoot ?? resolve13(monorepoRoot, "artifacts");
+  const taskConfigPath = layout?.taskConfigPath ?? resolve13(monorepoRoot, ".rig", "task-config.json");
+  const binDir = layout?.binDir ?? resolve13(stateRoot, "bin");
   return {
     harnessRoot,
     stateDir: process.env.RIG_STATE_DIR || stateDir,
     artifactsDir,
     logsDir: process.env.RIG_LOGS_DIR || logsDir,
     binDir,
-    hooksDir: resolve12(harnessRoot, "hooks"),
-    validationDir: resolve12(harnessRoot, "validation"),
+    hooksDir: resolve13(harnessRoot, "hooks"),
+    validationDir: resolve13(harnessRoot, "validation"),
     taskConfigPath,
-    sessionPath: process.env.RIG_SESSION_FILE || resolve12(stateRoot, "session", "session.json"),
+    sessionPath: process.env.RIG_SESSION_FILE || resolve13(stateRoot, "session", "session.json"),
     monorepoRoot,
-    tsApiTestsDir: process.env.TS_API_TESTS_DIR || resolve12(monorepoRoot, "TSAPITests"),
-    taskRepoCommitsPath: resolve12(stateDir, "task-repo-commits.json"),
-    baseRepoPinsPath: resolve12(stateDir, "base-repo-pins.json"),
-    failedApproachesPath: resolve12(stateDir, "failed_approaches.md"),
-    agentProfilePath: resolve12(stateDir, "agent-profile.json"),
-    reviewProfilePath: resolve12(stateDir, "review-profile.json")
+    tsApiTestsDir: process.env.TS_API_TESTS_DIR || resolve13(monorepoRoot, "TSAPITests"),
+    taskRepoCommitsPath: resolve13(stateDir, "task-repo-commits.json"),
+    baseRepoPinsPath: resolve13(stateDir, "base-repo-pins.json"),
+    failedApproachesPath: resolve13(stateDir, "failed_approaches.md"),
+    agentProfilePath: resolve13(stateDir, "agent-profile.json"),
+    reviewProfilePath: resolve13(stateDir, "review-profile.json")
   };
 }
 function normalizeRelativeScopePath(inputPath) {
@@ -2102,34 +2161,34 @@ function monorepoSearchCandidates(inputPath) {
 }
 
 // packages/runtime/src/control-plane/state-sync/repo.ts
-import { existsSync as existsSync12 } from "fs";
-import { resolve as resolve14 } from "path";
+import { existsSync as existsSync14 } from "fs";
+import { resolve as resolve15 } from "path";
 
 // packages/runtime/src/control-plane/repos/layout.ts
-import { existsSync as existsSync11 } from "fs";
-import { basename as basename5, dirname as dirname8, join as join3, resolve as resolve13 } from "path";
+import { existsSync as existsSync13 } from "fs";
+import { basename as basename5, dirname as dirname9, join as join3, resolve as resolve14 } from "path";
 function resolveRepoStateDir(projectRoot) {
-  const normalizedProjectRoot = resolve13(projectRoot);
-  const projectParent = dirname8(normalizedProjectRoot);
+  const normalizedProjectRoot = resolve14(projectRoot);
+  const projectParent = dirname9(normalizedProjectRoot);
   if (basename5(projectParent) === ".worktrees") {
-    const ownerRoot = dirname8(projectParent);
-    const ownerHasRepoMarkers = existsSync11(resolve13(ownerRoot, ".git")) || existsSync11(resolve13(ownerRoot, ".rig", "state"));
+    const ownerRoot = dirname9(projectParent);
+    const ownerHasRepoMarkers = existsSync13(resolve14(ownerRoot, ".git")) || existsSync13(resolve14(ownerRoot, ".rig", "state"));
     if (ownerHasRepoMarkers) {
-      return resolve13(ownerRoot, ".rig", "state");
+      return resolve14(ownerRoot, ".rig", "state");
     }
   }
-  return resolve13(projectRoot, ".rig", "state");
+  return resolve14(projectRoot, ".rig", "state");
 }
 function resolveManagedRepoLayout(projectRoot, repoId) {
-  const normalizedProjectRoot = resolve13(projectRoot);
+  const normalizedProjectRoot = resolve14(projectRoot);
   const entry = getManagedRepoEntry(repoId);
   const stateDir = resolveRepoStateDir(normalizedProjectRoot);
   const metadataRelativePath = join3("repos", entry.id);
-  const metadataRoot = resolve13(stateDir, metadataRelativePath);
+  const metadataRoot = resolve14(stateDir, metadataRelativePath);
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  const runsInsideTaskWorktree = runtimeWorkspace && resolve13(runtimeWorkspace) === normalizedProjectRoot || basename5(dirname8(normalizedProjectRoot)) === ".worktrees";
+  const runsInsideTaskWorktree = runtimeWorkspace && resolve14(runtimeWorkspace) === normalizedProjectRoot || basename5(dirname9(normalizedProjectRoot)) === ".worktrees";
   const isPrimaryManagedRepo = listManagedRepoEntries()[0]?.id === repoId;
-  const checkoutRoot = isPrimaryManagedRepo && runsInsideTaskWorktree ? resolveMonorepoRoot(normalizedProjectRoot) : entry.checkoutEnvVar && process.env[entry.checkoutEnvVar]?.trim() ? resolve13(process.env[entry.checkoutEnvVar].trim()) : resolve13(normalizedProjectRoot, entry.alias);
+  const checkoutRoot = isPrimaryManagedRepo && runsInsideTaskWorktree ? resolveMonorepoRoot(normalizedProjectRoot) : entry.checkoutEnvVar && process.env[entry.checkoutEnvVar]?.trim() ? resolve14(process.env[entry.checkoutEnvVar].trim()) : resolve14(normalizedProjectRoot, entry.alias);
   return {
     projectRoot: normalizedProjectRoot,
     repoId: entry.id,
@@ -2137,12 +2196,12 @@ function resolveManagedRepoLayout(projectRoot, repoId) {
     defaultBranch: entry.defaultBranch,
     remoteUrl: entry.remoteEnvVar && process.env[entry.remoteEnvVar]?.trim() ? process.env[entry.remoteEnvVar].trim() : entry.defaultRemoteUrl,
     checkoutRoot,
-    worktreesRoot: resolve13(checkoutRoot, ".worktrees"),
+    worktreesRoot: resolve14(checkoutRoot, ".worktrees"),
     stateDir,
     metadataRoot,
     metadataRelativePath,
-    mirrorRoot: resolve13(metadataRoot, "mirror.git"),
-    mirrorStatePath: resolve13(metadataRoot, "mirror-state.json"),
+    mirrorRoot: resolve14(metadataRoot, "mirror.git"),
+    mirrorStatePath: resolve14(metadataRoot, "mirror-state.json"),
     mirrorStateRelativePath: join3(metadataRelativePath, "mirror-state.json")
   };
 }
@@ -2160,7 +2219,7 @@ function resolveTrackerRepoPath(projectRoot) {
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
   try {
     const layout = resolveMonorepoRepoLayout(projectRoot);
-    if (existsSync12(resolve14(layout.mirrorRoot, "HEAD"))) {
+    if (existsSync14(resolve15(layout.mirrorRoot, "HEAD"))) {
       return layout.mirrorRoot;
     }
   } catch {}
@@ -2171,8 +2230,8 @@ function resolveTrackerRepoPath(projectRoot) {
 var DEFAULT_READ_DEPS = {
   fetchRef: nativeFetchRef,
   readBlobAtRef: nativeReadBlobAtRef,
-  exists: existsSync13,
-  readFile: (path) => readFileSync8(path, "utf8")
+  exists: existsSync15,
+  readFile: (path) => readFileSync9(path, "utf8")
 };
 function parseIssueStatus(rawStatus) {
   const normalized = normalizeTaskLifecycleStatus(rawStatus);
@@ -2253,12 +2312,12 @@ function shouldPreferLocalTrackerState(options) {
   if (runtimeContextPath) {
     return true;
   }
-  return existsSync13(resolve15(runtimeWorkspace, ".rig", "runtime-context.json"));
+  return existsSync15(resolve16(runtimeWorkspace, ".rig", "runtime-context.json"));
 }
 function readLocalTrackerState(projectRoot, deps) {
   const monorepoRoot = resolveMonorepoRoot2(projectRoot);
-  const issuesPath = resolve15(monorepoRoot, ".beads", "issues.jsonl");
-  const taskStatePath = resolve15(monorepoRoot, ".beads", "task-state.json");
+  const issuesPath = resolve16(monorepoRoot, ".beads", "issues.jsonl");
+  const taskStatePath = resolve16(monorepoRoot, ".beads", "task-state.json");
   return projectSyncedTrackerSnapshot({
     source: "local",
     issuesBaseOid: null,
@@ -2572,7 +2631,7 @@ function readValidationDescriptions(projectRoot) {
   return readValidationDescriptionMap(raw);
 }
 function readSourceValidationDescriptions(projectRoot) {
-  const rootRaw = readJsonFile(resolve16(projectRoot, "rig", "task-config.json"), {});
+  const rootRaw = readJsonFile(resolve17(projectRoot, "rig", "task-config.json"), {});
   const sourcePath = findSourceTaskConfigPath(projectRoot);
   const sourceRaw = sourcePath ? readJsonFile(sourcePath, {}) : {};
   const rootDescriptions = readValidationDescriptionMap(rootRaw);
@@ -2648,15 +2707,15 @@ function readValidationDescriptionsFromMeta(meta) {
   return meta.validation_descriptions;
 }
 function readLocalSourceTaskStateEnvelope(projectRoot) {
-  const taskStatePath = resolve16(resolveMonorepoRoot2(projectRoot), ".beads", "task-state.json");
+  const taskStatePath = resolve17(resolveMonorepoRoot2(projectRoot), ".beads", "task-state.json");
   return readTaskStateMetadataEnvelope(readJsonFile(taskStatePath, {}));
 }
 function readLocalSourceTaskLifecycleStatus(projectRoot, taskId) {
-  const issuesPath = resolve16(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
-  if (!existsSync14(issuesPath)) {
+  const issuesPath = resolve17(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync16(issuesPath)) {
     return null;
   }
-  for (const line of readFileSync9(issuesPath, "utf8").split(/\r?\n/)) {
+  for (const line of readFileSync10(issuesPath, "utf8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -2697,25 +2756,25 @@ function lookupTask(projectRoot, input) {
 function artifactDirForId(projectRoot, id) {
   const workspaceDir = process.env.RIG_TASK_WORKSPACE?.trim();
   if (workspaceDir) {
-    const worktreeArtifacts = resolve16(workspaceDir, "artifacts", id);
-    if (existsSync14(worktreeArtifacts) || existsSync14(resolve16(workspaceDir, "artifacts"))) {
+    const worktreeArtifacts = resolve17(workspaceDir, "artifacts", id);
+    if (existsSync16(worktreeArtifacts) || existsSync16(resolve17(workspaceDir, "artifacts"))) {
       return worktreeArtifacts;
     }
   }
   try {
     const paths = resolveHarnessPaths(projectRoot);
-    return resolve16(paths.artifactsDir, id);
+    return resolve17(paths.artifactsDir, id);
   } catch {
-    return resolve16(resolveMonorepoRoot2(projectRoot), "artifacts", id);
+    return resolve17(resolveMonorepoRoot2(projectRoot), "artifacts", id);
   }
 }
 function resolveTaskConfigPath(projectRoot) {
   const paths = resolveHarnessPaths(projectRoot);
-  if (existsSync14(paths.taskConfigPath)) {
+  if (existsSync16(paths.taskConfigPath)) {
     return paths.taskConfigPath;
   }
   for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
-    if (existsSync14(candidate)) {
+    if (existsSync16(candidate)) {
       return candidate;
     }
   }
@@ -2723,7 +2782,7 @@ function resolveTaskConfigPath(projectRoot) {
 }
 function findSourceTaskConfigPath(projectRoot) {
   for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
-    if (existsSync14(candidate)) {
+    if (existsSync16(candidate)) {
       return candidate;
     }
   }
@@ -2736,7 +2795,7 @@ function readAndSyncSourceTaskConfig(projectRoot) {
   const synced = synchronizeTaskConfigWithTracker(projectRoot, raw);
   if (sourcePath && synced.updated) {
     try {
-      writeFileSync6(sourcePath, `${JSON.stringify(synced.config, null, 2)}
+      writeFileSync7(sourcePath, `${JSON.stringify(synced.config, null, 2)}
 `, "utf-8");
     } catch {}
   }
@@ -2788,12 +2847,12 @@ function shouldRefreshAutoSyncedTaskConfigEntry(entry) {
   return !candidate.role;
 }
 function readSourceIssueRecords(projectRoot) {
-  const issuesPath = resolve16(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
-  if (!existsSync14(issuesPath)) {
+  const issuesPath = resolve17(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync16(issuesPath)) {
     return [];
   }
   const records = [];
-  for (const line of readFileSync9(issuesPath, "utf-8").split(/\r?\n/)) {
+  for (const line of readFileSync10(issuesPath, "utf-8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -2849,19 +2908,19 @@ function readConfiguredFileTaskConfig(projectRoot) {
   if (!sourcePath) {
     return {};
   }
-  const directory = resolve16(projectRoot, sourcePath);
-  if (!existsSync14(directory)) {
+  const directory = resolve17(projectRoot, sourcePath);
+  if (!existsSync16(directory)) {
     return {};
   }
   const config = {};
   for (const name of readdirSync3(directory)) {
     if (!FILE_TASK_PATTERN2.test(name))
       continue;
-    const file = resolve16(directory, name);
+    const file = resolve17(directory, name);
     try {
       if (!statSync3(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync9(file, "utf8"));
+      const raw = JSON.parse(readFileSync10(file, "utf8"));
       if (!raw || typeof raw !== "object" || Array.isArray(raw))
         continue;
       const record = raw;
@@ -2903,10 +2962,10 @@ function firstStringList2(...candidates) {
   return [];
 }
 function readConfiguredFilesTaskSourcePath2(projectRoot) {
-  const jsonPath = resolve16(projectRoot, "rig.config.json");
-  if (existsSync14(jsonPath)) {
+  const jsonPath = resolve17(projectRoot, "rig.config.json");
+  if (existsSync16(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync9(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync10(jsonPath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         const taskSource = parsed.taskSource;
         if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
@@ -2918,12 +2977,12 @@ function readConfiguredFilesTaskSourcePath2(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve16(projectRoot, "rig.config.ts");
-  if (!existsSync14(tsPath)) {
+  const tsPath = resolve17(projectRoot, "rig.config.ts");
+  if (!existsSync16(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync9(tsPath, "utf8");
+    const source = readFileSync10(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -2937,23 +2996,23 @@ function readConfiguredFilesTaskSourcePath2(projectRoot) {
 function sourceTaskConfigCandidates(projectRoot) {
   const runtimeContext = loadRuntimeContextFromEnv();
   return [
-    runtimeContext?.monorepoMainRoot ? resolve16(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
-    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve16(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
-    resolve16(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
+    runtimeContext?.monorepoMainRoot ? resolve17(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve17(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve17(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
   ].filter(Boolean);
 }
 
 // packages/runtime/src/control-plane/native/validator.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
-import { resolve as resolve21 } from "path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
+import { resolve as resolve22 } from "path";
 
 // packages/runtime/src/control-plane/native/validator-binaries.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync7, rmSync as rmSync5, statSync as statSync4 } from "fs";
-import { dirname as dirname10, resolve as resolve20 } from "path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync8, rmSync as rmSync5, statSync as statSync4 } from "fs";
+import { dirname as dirname11, resolve as resolve21 } from "path";
 
 // packages/runtime/src/binary-run.ts
-import { chmodSync as chmodSync2, cpSync, existsSync as existsSync15, mkdirSync as mkdirSync6, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync7 } from "fs";
-import { basename as basename7, dirname as dirname9, resolve as resolve17 } from "path";
+import { chmodSync as chmodSync2, cpSync, existsSync as existsSync17, mkdirSync as mkdirSync7, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "fs";
+import { basename as basename7, dirname as dirname10, resolve as resolve18 } from "path";
 import { fileURLToPath } from "url";
 import { drainMicrotasks, gcAndSweep } from "bun:jsc";
 var runtimeBinaryBuildQueue = Promise.resolve();
@@ -2979,9 +3038,9 @@ async function buildRuntimeBinary(options) {
   });
 }
 async function buildRuntimeBinaryInProcess(options, manifest) {
-  const tempBuildDir = resolve17(dirname9(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-  const tempOutputPath = resolve17(tempBuildDir, basename7(options.outputPath));
-  mkdirSync6(tempBuildDir, { recursive: true });
+  const tempBuildDir = resolve18(dirname10(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  const tempOutputPath = resolve18(tempBuildDir, basename7(options.outputPath));
+  mkdirSync7(tempBuildDir, { recursive: true });
   await withTemporaryEnv({
     ...options.env,
     ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
@@ -3006,7 +3065,7 @@ async function buildRuntimeBinaryInProcess(options, manifest) {
 `);
       throw new Error(`Failed to build ${options.entrypoint}: ${details || "Bun.build() returned errors"}`);
     }
-    if (!existsSync15(tempOutputPath)) {
+    if (!existsSync17(tempOutputPath)) {
       const emitted = buildResult.outputs.map((output) => output.path).join(", ") || "(none)";
       throw new Error(`Failed to build ${options.entrypoint}: Bun.build() did not emit ${tempOutputPath}. Emitted: ${emitted}`);
     }
@@ -3038,8 +3097,8 @@ function runtimeBinaryCacheManifestPath(outputPath) {
 function resolveRuntimeBinaryBuildOptions(options) {
   return {
     ...options,
-    entrypoint: resolve17(options.cwd, options.sourcePath),
-    outputPath: resolve17(options.outputPath)
+    entrypoint: resolve18(options.cwd, options.sourcePath),
+    outputPath: resolve18(options.outputPath)
   };
 }
 function shouldUseRuntimeBinaryBuildWorker() {
@@ -3053,7 +3112,7 @@ function shouldUseRuntimeBinaryBuildWorker() {
 }
 async function buildRuntimeBinaryViaWorker(options) {
   const workerSourcePath = resolveRuntimeBinaryBuildWorkerSourcePath(options);
-  if (!workerSourcePath || !existsSync15(workerSourcePath)) {
+  if (!workerSourcePath || !existsSync17(workerSourcePath)) {
     await buildRuntimeBinaryInProcess(options, {
       manifestPath: runtimeBinaryCacheManifestPath(options.outputPath),
       buildKey: createRuntimeBinaryBuildKey({
@@ -3090,7 +3149,7 @@ async function buildRuntimeBinaryViaWorker(options) {
   }
 }
 function createRuntimeBinaryBuildWorkerPayloadPath(outputPath) {
-  return resolve17(dirname9(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+  return resolve18(dirname10(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
 }
 function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
   const envRoots = [
@@ -3099,13 +3158,13 @@ function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
     process.env.PROJECT_RIG_ROOT?.trim()
   ].filter(Boolean);
   for (const root of envRoots) {
-    const candidate = resolve17(root, "packages/runtime/src/binary-build-worker.ts");
-    if (existsSync15(candidate)) {
+    const candidate = resolve18(root, "packages/runtime/src/binary-build-worker.ts");
+    if (existsSync17(candidate)) {
       return candidate;
     }
   }
-  const localCandidate = resolve17(import.meta.dir, "binary-build-worker.ts");
-  return existsSync15(localCandidate) ? localCandidate : null;
+  const localCandidate = resolve18(import.meta.dir, "binary-build-worker.ts");
+  return existsSync17(localCandidate) ? localCandidate : null;
 }
 function resolveRuntimeBinaryBuildWorkerInvocation() {
   const bunPath = Bun.which("bun");
@@ -3141,7 +3200,7 @@ function createRuntimeBinaryBuildKey(input) {
   });
 }
 async function isRuntimeBinaryBuildFresh(input) {
-  if (!existsSync15(input.outputPath) || !existsSync15(input.manifestPath)) {
+  if (!existsSync17(input.outputPath) || !existsSync17(input.manifestPath)) {
     return false;
   }
   let manifest = null;
@@ -3154,7 +3213,7 @@ async function isRuntimeBinaryBuildFresh(input) {
     return false;
   }
   for (const [filePath, expectedDigest] of Object.entries(manifest.inputs || {})) {
-    if (!existsSync15(filePath)) {
+    if (!existsSync17(filePath)) {
       return false;
     }
     if (await sha256File(filePath) !== expectedDigest) {
@@ -3167,7 +3226,7 @@ async function writeRuntimeBinaryCacheManifest(input) {
   const inputs = {};
   for (const inputPath of Object.keys(input.metafile?.inputs || {}).sort()) {
     const normalized = normalizeBuildInputPath(input.cwd, inputPath);
-    if (!normalized || !existsSync15(normalized)) {
+    if (!normalized || !existsSync17(normalized)) {
       continue;
     }
     inputs[normalized] = await sha256File(normalized);
@@ -3190,7 +3249,7 @@ function normalizeBuildInputPath(cwd, inputPath) {
   if (inputPath.startsWith("<")) {
     return null;
   }
-  return resolve17(cwd, inputPath);
+  return resolve18(cwd, inputPath);
 }
 async function sha256File(path) {
   const hasher = new Bun.CryptoHasher("sha256");
@@ -3206,8 +3265,8 @@ function sortRecord(value) {
 async function runSerializedRuntimeBinaryBuild(action) {
   const previous = runtimeBinaryBuildQueue;
   let release;
-  runtimeBinaryBuildQueue = new Promise((resolve18) => {
-    release = resolve18;
+  runtimeBinaryBuildQueue = new Promise((resolve19) => {
+    release = resolve19;
   });
   await previous;
   try {
@@ -3252,11 +3311,11 @@ async function withTemporaryCwd(cwd, action) {
 }
 
 // packages/runtime/src/control-plane/runtime/provisioning-env.ts
-import { delimiter, resolve as resolve19 } from "path";
+import { delimiter, resolve as resolve20 } from "path";
 
 // packages/runtime/src/control-plane/runtime/runtime-paths.ts
-import { existsSync as existsSync16, readdirSync as readdirSync4, realpathSync } from "fs";
-import { resolve as resolve18 } from "path";
+import { existsSync as existsSync18, readdirSync as readdirSync4, realpathSync } from "fs";
+import { resolve as resolve19 } from "path";
 
 // packages/runtime/src/control-plane/runtime/sandbox/utils.ts
 function uniq(values) {
@@ -3274,7 +3333,7 @@ function resolveBunBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve18(home, ".bun/bin/bun") : "",
+    home ? resolve19(home, ".bun/bin/bun") : "",
     "/opt/homebrew/bin/bun",
     "/usr/local/bin/bun",
     "/usr/bin/bun"
@@ -3302,8 +3361,8 @@ function resolveClaudeBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve18(home, ".local/bin/claude") : "",
-    home ? resolve18(home, ".local/share/claude/local/claude") : "",
+    home ? resolve19(home, ".local/bin/claude") : "",
+    home ? resolve19(home, ".local/share/claude/local/claude") : "",
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude",
     "/usr/bin/claude"
@@ -3317,51 +3376,51 @@ function resolveClaudeBinaryPath() {
   throw new Error("claude not found in PATH");
 }
 function resolveBunInstallDir(bunBinaryPath = resolveBunBinaryPath()) {
-  return resolve18(bunBinaryPath, "../..");
+  return resolve19(bunBinaryPath, "../..");
 }
 function resolveClaudeInstallDir() {
   const realPath = resolveClaudeBinaryPath();
-  return resolve18(realPath, "..");
+  return resolve19(realPath, "..");
 }
 function resolveNodeInstallDir() {
   const preferredNode = resolvePreferredNodeBinary();
   if (!preferredNode)
     return null;
   const explicitNode = process.env.RIG_NODE_BIN?.trim();
-  if (explicitNode && resolve18(explicitNode) === resolve18(preferredNode)) {
-    return preferredNode.endsWith("/bin/node") ? resolve18(preferredNode, "../..") : resolve18(preferredNode, "..");
+  if (explicitNode && resolve19(explicitNode) === resolve19(preferredNode)) {
+    return preferredNode.endsWith("/bin/node") ? resolve19(preferredNode, "../..") : resolve19(preferredNode, "..");
   }
   try {
     const realPath = realpathSync(preferredNode);
     if (realPath.endsWith("/bin/node")) {
-      return resolve18(realPath, "../..");
+      return resolve19(realPath, "../..");
     }
-    return resolve18(realPath, "..");
+    return resolve19(realPath, "..");
   } catch {
-    return resolve18(preferredNode, "..");
+    return resolve19(preferredNode, "..");
   }
 }
 function resolvePreferredNodeBinary() {
   const candidates = [];
   const envNode = process.env.RIG_NODE_BIN?.trim();
   if (envNode) {
-    const explicit = resolve18(envNode);
-    if (existsSync16(explicit)) {
+    const explicit = resolve19(envNode);
+    if (existsSync18(explicit)) {
       return explicit;
     }
   }
   const nvmBin = process.env.NVM_BIN?.trim();
   if (nvmBin) {
-    candidates.push(resolve18(nvmBin, "node"));
+    candidates.push(resolve19(nvmBin, "node"));
   }
   const home = process.env.HOME?.trim();
   if (home) {
-    const nvmVersionsDir = resolve18(home, ".nvm/versions/node");
-    if (existsSync16(nvmVersionsDir)) {
+    const nvmVersionsDir = resolve19(home, ".nvm/versions/node");
+    if (existsSync18(nvmVersionsDir)) {
       try {
         const versionDirs = readdirSync4(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
         for (const versionDir of versionDirs) {
-          candidates.push(resolve18(nvmVersionsDir, versionDir, "bin/node"));
+          candidates.push(resolve19(nvmVersionsDir, versionDir, "bin/node"));
         }
       } catch {}
     }
@@ -3370,8 +3429,8 @@ function resolvePreferredNodeBinary() {
   if (whichNode) {
     candidates.push(whichNode);
   }
-  const deduped = uniq(candidates.map((candidate) => resolve18(candidate)));
-  const existing = deduped.filter((candidate) => existsSync16(candidate));
+  const deduped = uniq(candidates.map((candidate) => resolve19(candidate)));
+  const existing = deduped.filter((candidate) => existsSync18(candidate));
   if (existing.length === 0) {
     return null;
   }
@@ -3385,7 +3444,7 @@ function resolvePreferredNodeBinary() {
   return existing[0] ?? null;
 }
 function inferNodeMajor(nodeBinaryPath) {
-  const normalized = resolve18(nodeBinaryPath).replace(/\\/g, "/");
+  const normalized = resolve19(nodeBinaryPath).replace(/\\/g, "/");
   const match = normalized.match(/(?:^|\/)(?:node-)?v?(\d+)\.\d+\.\d+(?:\/|$)/);
   if (!match) {
     return null;
@@ -3397,8 +3456,8 @@ function normalizeExecutablePath(candidate) {
   if (!candidate) {
     return "";
   }
-  const normalized = resolve18(candidate);
-  if (!existsSync16(normalized)) {
+  const normalized = resolve19(candidate);
+  if (!existsSync18(normalized)) {
     return "";
   }
   try {
@@ -3408,7 +3467,7 @@ function normalizeExecutablePath(candidate) {
   }
 }
 function looksLikeRuntimeGateway(candidate) {
-  const normalized = resolve18(candidate).replace(/\\/g, "/");
+  const normalized = resolve19(candidate).replace(/\\/g, "/");
   return normalized.includes("/.rig/bin/") || normalized.endsWith("/rig-shell") || normalized.endsWith("/rig-agent");
 }
 
@@ -3429,7 +3488,7 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     try {
       return resolveClaudeInstallDir();
     } catch {
-      return resolve19(claudeBinary, "..");
+      return resolve20(claudeBinary, "..");
     }
   })() : "";
   const nodeDir = resolveNodeInstallDir();
@@ -3439,8 +3498,8 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     `${bunDir}/bin`,
     claudeDir,
     nodeDir ? `${nodeDir}/bin` : "",
-    realHome ? resolve19(realHome, ".local/bin") : "",
-    realHome ? resolve19(realHome, ".cargo/bin") : "",
+    realHome ? resolve20(realHome, ".local/bin") : "",
+    realHome ? resolve20(realHome, ".cargo/bin") : "",
     ...inheritedPath,
     "/usr/local/bin",
     "/usr/local/sbin",
@@ -3471,9 +3530,9 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
 // packages/runtime/src/control-plane/native/validator-binaries.ts
 function resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext) {
   if (runtimeContext) {
-    return resolve20(runtimeContext.binDir, "validators", binaryName);
+    return resolve21(runtimeContext.binDir, "validators", binaryName);
   }
-  return resolve20(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
+  return resolve21(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
 }
 async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
   const match = checkId.match(/^([a-z][\w-]*):([a-z][\w-]*)$/);
@@ -3488,19 +3547,19 @@ async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
   const binaryName = `${category}-${check}`;
   const binaryPath = resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
   const hostProjectRoot = runtimeContext?.hostProjectRoot?.trim() || projectRoot;
-  const sourcePath = resolve20(hostProjectRoot, "packages/runtime/src/control-plane/validators", category, `${check}.ts`);
-  if (!existsSync17(sourcePath)) {
+  const sourcePath = resolve21(hostProjectRoot, "packages/runtime/src/control-plane/validators", category, `${check}.ts`);
+  if (!existsSync19(sourcePath)) {
     return null;
   }
   const sourceMtime = statSync4(sourcePath).mtimeMs;
-  const binaryExists = existsSync17(binaryPath);
+  const binaryExists = existsSync19(binaryPath);
   const binaryMtime = binaryExists ? statSync4(binaryPath).mtimeMs : 0;
   if (!binaryExists || sourceMtime > binaryMtime) {
     if (binaryExists) {
       rmSync5(binaryPath, { force: true });
       rmSync5(`${binaryPath}.build-manifest.json`, { force: true });
     }
-    mkdirSync7(dirname10(binaryPath), { recursive: true });
+    mkdirSync8(dirname11(binaryPath), { recursive: true });
     await buildRuntimeBinary({
       sourcePath: `packages/runtime/src/control-plane/validators/${category}/${check}.ts`,
       outputPath: binaryPath,
@@ -3509,7 +3568,7 @@ async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
       env: runtimeProvisioningEnv()
     });
   }
-  return existsSync17(binaryPath) ? binaryPath : null;
+  return existsSync19(binaryPath) ? binaryPath : null;
 }
 
 // packages/runtime/src/control-plane/native/validator.ts
@@ -3546,20 +3605,20 @@ async function readTaskSourceValidation(projectRoot, taskId) {
 function resolveValidationPaths(projectRoot, taskId, runtimeContext) {
   if (runtimeContext) {
     return {
-      taskLogDir: resolve21(runtimeContext.logsDir, taskId),
-      artifactDir: resolve21(runtimeContext.workspaceDir, "artifacts", taskId)
+      taskLogDir: resolve22(runtimeContext.logsDir, taskId),
+      artifactDir: resolve22(runtimeContext.workspaceDir, "artifacts", taskId)
     };
   }
   const paths = resolveHarnessPaths(projectRoot);
   return {
-    taskLogDir: resolve21(paths.logsDir, taskId),
-    artifactDir: resolve21(paths.artifactsDir, taskId)
+    taskLogDir: resolve22(paths.logsDir, taskId),
+    artifactDir: resolve22(paths.artifactsDir, taskId)
   };
 }
 async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext) {
   const binaryName = checkId.replace(":", "-");
   const binaryPath = await ensureValidatorBinary(projectRoot, checkId, runtimeContext) ?? resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
-  if (!existsSync18(binaryPath)) {
+  if (!existsSync20(binaryPath)) {
     return {
       result: {
         id: checkId,
@@ -3570,7 +3629,7 @@ async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext)
     };
   }
   const validatorCwd = runtimeContext?.workspaceDir || resolveMonorepoRoot(projectRoot);
-  const runtimeShellPath = runtimeContext ? resolve21(runtimeContext.binDir, "rig-shell") : "";
+  const runtimeShellPath = runtimeContext ? resolve22(runtimeContext.binDir, "rig-shell") : "";
   const monorepoMainRoot = runtimeContext?.monorepoMainRoot || process.env.MONOREPO_MAIN_ROOT?.trim() || resolveMonorepoRoot(projectRoot);
   const validatorEnv = {
     PROJECT_RIG_ROOT: runtimeContext?.hostProjectRoot || projectRoot,
@@ -3585,7 +3644,7 @@ async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext)
     validatorEnv.RIG_LOGS_DIR = runtimeContext.logsDir;
     validatorEnv.RIG_RUNTIME_BIN_DIR = runtimeContext.binDir;
   }
-  const { exitCode, stdout, stderr } = await runCaptureAsync(runtimeShellPath && existsSync18(runtimeShellPath) ? [runtimeShellPath, "run-binary", binaryPath] : [binaryPath], validatorCwd, validatorEnv);
+  const { exitCode, stdout, stderr } = await runCaptureAsync(runtimeShellPath && existsSync20(runtimeShellPath) ? [runtimeShellPath, "run-binary", binaryPath] : [binaryPath], validatorCwd, validatorEnv);
   try {
     const result = JSON.parse(stdout.trim());
     return { result, exitCode };
@@ -3625,8 +3684,8 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
   const configuredValidation = stringArray(taskConfig[taskId]?.validation);
   const commands = resolvedContext?.validation?.length ? resolvedContext.validation : configuredValidation.length > 0 ? configuredValidation : sourceValidation.validation;
   const { taskLogDir, artifactDir } = resolveValidationPaths(projectRoot, taskId, resolvedContext);
-  mkdirSync8(taskLogDir, { recursive: true });
-  mkdirSync8(artifactDir, { recursive: true });
+  mkdirSync9(taskLogDir, { recursive: true });
+  mkdirSync9(artifactDir, { recursive: true });
   if (commands.length === 0) {
     const skipped = {
       status: "skipped",
@@ -3635,7 +3694,7 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
       failed: 0,
       categories: []
     };
-    writeFileSync8(resolve21(artifactDir, "validation-summary.json"), `${JSON.stringify(skipped, null, 2)}
+    writeFileSync9(resolve22(artifactDir, "validation-summary.json"), `${JSON.stringify(skipped, null, 2)}
 `, "utf-8");
     return skipped;
   }
@@ -3670,18 +3729,18 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
         exit_code: 2,
         duration_seconds: 0
       });
-      const logFile2 = resolve21(taskLogDir, `invalid-entry-validation.log`);
-      mkdirSync8(taskLogDir, { recursive: true });
-      writeFileSync8(logFile2, `=== ${nowIso()} :: ${cmd} ===
+      const logFile2 = resolve22(taskLogDir, `invalid-entry-validation.log`);
+      mkdirSync9(taskLogDir, { recursive: true });
+      writeFileSync9(logFile2, `=== ${nowIso()} :: ${cmd} ===
 Invalid validation entry: not a check-ID. All entries must use format "category:check-name".
 `, "utf-8");
       continue;
     }
     const { result, exitCode } = await dispatchValidator(cmd, effectiveRegistry, validatorCtx, (id) => runValidatorBinary(projectRoot, taskId, id, resolvedContext));
     const durationSeconds = Math.max(0, Math.round((Date.now() - startedAt) / 1000));
-    const logFile = resolve21(taskLogDir, `${cmd.replace(":", "-")}-validation.log`);
-    mkdirSync8(taskLogDir, { recursive: true });
-    writeFileSync8(logFile, `=== ${nowIso()} :: ${cmd} ===
+    const logFile = resolve22(taskLogDir, `${cmd.replace(":", "-")}-validation.log`);
+    mkdirSync9(taskLogDir, { recursive: true });
+    writeFileSync9(logFile, `=== ${nowIso()} :: ${cmd} ===
 ${JSON.stringify(result, null, 2)}
 `, "utf-8");
     if (result.passed) {
@@ -3703,15 +3762,15 @@ ${JSON.stringify(result, null, 2)}
     failed,
     categories
   };
-  mkdirSync8(artifactDir, { recursive: true });
-  writeFileSync8(resolve21(artifactDir, "validation-summary.json"), `${JSON.stringify(summary, null, 2)}
+  mkdirSync9(artifactDir, { recursive: true });
+  writeFileSync9(resolve22(artifactDir, "validation-summary.json"), `${JSON.stringify(summary, null, 2)}
 `, "utf-8");
   return summary;
 }
 
 // packages/runtime/src/control-plane/native/verifier.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
-import { resolve as resolve23 } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
+import { resolve as resolve24 } from "path";
 
 // packages/runtime/src/control-plane/runtime/baked-secrets.ts
 var BAKED_RUNTIME_SECRETS = {
@@ -3757,8 +3816,8 @@ function resolveRuntimeSecrets(env, baked = BAKED_RUNTIME_SECRETS) {
 }
 
 // packages/runtime/src/control-plane/native/git-ops.ts
-import { existsSync as existsSync19, lstatSync, mkdirSync as mkdirSync9, readFileSync as readFileSync10, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname11, isAbsolute as isAbsolute2, resolve as resolve22 } from "path";
+import { existsSync as existsSync21, lstatSync, mkdirSync as mkdirSync10, readFileSync as readFileSync11, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname12, isAbsolute as isAbsolute2, resolve as resolve23 } from "path";
 
 // packages/runtime/src/control-plane/native/pr-review-gate.ts
 function parseJsonObject(value) {
@@ -5015,12 +5074,12 @@ var TASK_ARTIFACT_STAGE_FALLBACK = new Set([
   "validation-summary.json"
 ]);
 function readPrMetadata(projectRoot, taskId) {
-  const path = resolve22(artifactDirForId(projectRoot, taskId), "pr-state.json");
-  if (!existsSync19(path)) {
+  const path = resolve23(artifactDirForId(projectRoot, taskId), "pr-state.json");
+  if (!existsSync21(path)) {
     return [];
   }
   try {
-    const parsed = JSON.parse(readFileSync10(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync11(path, "utf-8"));
     if (!parsed || typeof parsed !== "object") {
       return [];
     }
@@ -5046,11 +5105,11 @@ async function verifyTask(options) {
   const taskId = options.taskId;
   const normalizedTaskId = lookupTask(options.projectRoot, taskId);
   const artifactDir = artifactDirForId(options.projectRoot, taskId);
-  mkdirSync10(artifactDir, { recursive: true });
-  const validationSummaryPath = resolve23(artifactDir, "validation-summary.json");
-  const reviewFeedbackPath = resolve23(artifactDir, "review-feedback.md");
-  const reviewStatePath = resolve23(artifactDir, "review-state.json");
-  const greptileRawPath = resolve23(artifactDir, "review-greptile-raw.json");
+  mkdirSync11(artifactDir, { recursive: true });
+  const validationSummaryPath = resolve24(artifactDir, "validation-summary.json");
+  const reviewFeedbackPath = resolve24(artifactDir, "review-feedback.md");
+  const reviewStatePath = resolve24(artifactDir, "review-state.json");
+  const greptileRawPath = resolve24(artifactDir, "review-greptile-raw.json");
   const prStates = readPrMetadata(options.projectRoot, taskId);
   const prState = prStates[0] || null;
   const localReasons = [];
@@ -5062,7 +5121,7 @@ async function verifyTask(options) {
   if (!normalizedTaskId && !await hasConfiguredSourceTask(options.projectRoot, taskId)) {
     localReasons.push(`[Task Config] Unknown task id '${taskId}' in task-config or configured task source.`);
   }
-  if (!existsSync20(validationSummaryPath)) {
+  if (!existsSync22(validationSummaryPath)) {
     localReasons.push(`[Artifact Quality] validation-summary.json not found at ${validationSummaryPath}.`);
   } else {
     const summary = await parseValidationSummary(validationSummaryPath);
@@ -5071,13 +5130,13 @@ async function verifyTask(options) {
     }
   }
   for (const file of ["task-result.json", "decision-log.md", "next-actions.md", "changed-files.txt"]) {
-    const requiredPath = resolve23(artifactDir, file);
-    if (!existsSync20(requiredPath)) {
+    const requiredPath = resolve24(artifactDir, file);
+    if (!existsSync22(requiredPath)) {
       localReasons.push(`[Artifact Quality] Missing required artifact file: ${requiredPath}`);
     }
   }
-  const taskResultPath = resolve23(artifactDir, "task-result.json");
-  if (existsSync20(taskResultPath)) {
+  const taskResultPath = resolve24(artifactDir, "task-result.json");
+  if (existsSync22(taskResultPath)) {
     const taskResult = await readJsonFile2(taskResultPath);
     const artifactStatus = typeof taskResult?.status === "string" ? taskResult.status.trim().toLowerCase() : "";
     if (artifactStatus === "partial") {
@@ -5090,8 +5149,8 @@ async function verifyTask(options) {
       localReasons.push("[Artifact Quality] task-result.json next actions indicate remaining implementation scope.");
     }
   }
-  const nextActionsPath = resolve23(artifactDir, "next-actions.md");
-  if (existsSync20(nextActionsPath)) {
+  const nextActionsPath = resolve24(artifactDir, "next-actions.md");
+  if (existsSync22(nextActionsPath)) {
     const nextActionsContent = await Bun.file(nextActionsPath).text();
     if (nextActionsContent.includes("TODO: Replace this scaffold") || nextActionsContent.includes("bd-<downstream-task-id>")) {
       localReasons.push("[Artifact Quality] next-actions.md still contains scaffold placeholder text. Replace with real recommendations.");
@@ -5122,7 +5181,7 @@ async function verifyTask(options) {
       aiReasons.push(`[AI Review] Required mode needs a completed Greptile approval; current verdict is ${ai.verdict}.`);
     }
     if (persistArtifacts && ai.rawResponse) {
-      writeFileSync10(greptileRawPath, `${ai.rawResponse}
+      writeFileSync11(greptileRawPath, `${ai.rawResponse}
 `, "utf-8");
     }
   } else if (!options.skipAiReview && reviewMode === "off") {
@@ -5365,7 +5424,7 @@ function evaluateSourceCloseoutChecks(prState, prLabel) {
   if (!Array.isArray(checks) || checks.length === 0) {
     return [`[Source Issue] PR ${prLabel} must have green check evidence before completion.`];
   }
-  const ciGate = evaluatePullRequestCiChecks(checks, "PR", 0);
+  const ciGate = evaluatePullRequestCiChecks(checks, "PR", 0, { mergeStateStatus: prState.mergeStateStatus });
   if (ciGate.verdict === "APPROVE") {
     return [];
   }
@@ -5461,7 +5520,7 @@ function isAcceptedValidationSummary(summary) {
   return summary.status === "skipped" && summary.total === 0 && summary.failed === 0;
 }
 async function loadReviewMode(reviewProfilePath, fallback) {
-  const parsed = existsSync20(reviewProfilePath) ? await readJsonFile2(reviewProfilePath) : null;
+  const parsed = existsSync22(reviewProfilePath) ? await readJsonFile2(reviewProfilePath) : null;
   const mode = parsed?.mode;
   if (mode === "off" || mode === "advisory" || mode === "required") {
     return mode;
@@ -5472,7 +5531,7 @@ async function loadReviewMode(reviewProfilePath, fallback) {
   return "advisory";
 }
 async function loadReviewProvider(reviewProfilePath, fallback) {
-  const parsed = existsSync20(reviewProfilePath) ? await readJsonFile2(reviewProfilePath) : null;
+  const parsed = existsSync22(reviewProfilePath) ? await readJsonFile2(reviewProfilePath) : null;
   const provider = parsed?.provider;
   if (typeof provider === "string" && provider.trim().length > 0) {
     return provider;
@@ -5631,7 +5690,7 @@ function writeFeedbackFile(options) {
   if (options.aiRawFeedback) {
     lines.push("## Raw Reviewer Feedback", "", "```text", options.aiRawFeedback, "```", "");
   }
-  writeFileSync10(options.output, `${lines.join(`
+  writeFileSync11(options.output, `${lines.join(`
 `)}
 `, "utf-8");
 }
@@ -5648,7 +5707,7 @@ function writeReviewStateFile(options) {
     ai_warnings: options.aiWarnings,
     updated_at: nowIso()
   };
-  writeFileSync10(options.output, `${JSON.stringify(payload, null, 2)}
+  writeFileSync11(options.output, `${JSON.stringify(payload, null, 2)}
 `, "utf-8");
 }
 async function runGreptileReviewForPr(options) {
@@ -5729,7 +5788,7 @@ async function runGreptileReviewForPr(options) {
     }
     await Bun.sleep(options.pollIntervalMs);
   }
-  const ciGate = evaluatePullRequestCiChecks(githubCheckRollup, repoName, prNumber);
+  const ciGate = evaluatePullRequestCiChecks(githubCheckRollup, repoName, prNumber, { mergeStateStatus: options.prState.mergeStateStatus });
   if (ciGate.verdict !== "APPROVE") {
     return {
       verdict: ciGate.verdict,
@@ -5987,7 +6046,7 @@ async function runGithubGreptileFallbackReviewForPr(options) {
     }
     await Bun.sleep(options.pollIntervalMs);
   }
-  const ciGate = evaluatePullRequestCiChecks(checkRollup, repoName, prNumber);
+  const ciGate = evaluatePullRequestCiChecks(checkRollup, repoName, prNumber, { mergeStateStatus: options.prState.mergeStateStatus });
   if (ciGate.verdict !== "APPROVE") {
     return {
       verdict: ciGate.verdict,
@@ -6342,7 +6401,7 @@ function loadGithubPullRequestCheckRollup(projectRoot, repoName, prNumber) {
   ]);
   return response.statusCheckRollup || [];
 }
-function evaluatePullRequestCiChecks(checks, repoName, prNumber) {
+function evaluatePullRequestCiChecks(checks, repoName, prNumber, options = {}) {
   const nonGreptileChecks = checks.filter((check) => {
     const label = (check.name || check.context || "").toLowerCase();
     return label.length > 0 && !label.includes("greptile");
@@ -6354,7 +6413,8 @@ function evaluatePullRequestCiChecks(checks, repoName, prNumber) {
     const state = (check.state || check.status || "").toUpperCase();
     return state === "PENDING" || state === "EXPECTED" || state === "QUEUED" || state === "IN_PROGRESS";
   });
-  if (pending.length > 0) {
+  const mergeClean = (options.mergeStateStatus || "").toUpperCase() === "CLEAN";
+  if (pending.length > 0 && !mergeClean) {
     return {
       verdict: "SKIP",
       reasons: pending.map((check) => `[CI] ${repoName}#${prNumber} check is still pending: ${check.name || check.context || "unknown"}.`)
@@ -6435,7 +6495,7 @@ function filterActionableGithubGreptileThreads(threads) {
 }
 function resolvePrRepoRoot(projectRoot, prState) {
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  if (prState.target === "monorepo" && runtimeWorkspace && existsSync20(resolve23(runtimeWorkspace, ".git"))) {
+  if (prState.target === "monorepo" && runtimeWorkspace && existsSync22(resolve24(runtimeWorkspace, ".git"))) {
     return runtimeWorkspace;
   }
   const paths = resolveHarnessPaths(projectRoot);
@@ -6815,16 +6875,16 @@ async function taskDeps(projectRoot, taskId) {
   for (const dep of deps) {
     const artifactDir = artifactDirForId(projectRoot, dep);
     console.log(`=== ${dep} ===`);
-    if (!existsSync21(artifactDir)) {
+    if (!existsSync23(artifactDir)) {
       console.log(`  (no artifacts yet)
 `);
       continue;
     }
-    printArtifactSection(resolve24(artifactDir, "decision-log.md"), "--- Decisions ---");
-    printArtifactSection(resolve24(artifactDir, "next-actions.md"), "--- Next Actions (for you) ---");
-    const changedFiles = resolve24(artifactDir, "changed-files.txt");
-    if (existsSync21(changedFiles)) {
-      const lines = readFileSync11(changedFiles, "utf-8").split(/\r?\n/).filter(Boolean);
+    printArtifactSection(resolve25(artifactDir, "decision-log.md"), "--- Decisions ---");
+    printArtifactSection(resolve25(artifactDir, "next-actions.md"), "--- Next Actions (for you) ---");
+    const changedFiles = resolve25(artifactDir, "changed-files.txt");
+    if (existsSync23(changedFiles)) {
+      const lines = readFileSync12(changedFiles, "utf-8").split(/\r?\n/).filter(Boolean);
       console.log(`--- Changed Files (${lines.length}) ---`);
       for (const line of lines) {
         console.log(line);
@@ -6869,12 +6929,12 @@ function taskRecord(projectRoot, type, text, taskId) {
     throw new Error("No active task.");
   }
   const paths = resolveHarnessPaths(projectRoot);
-  mkdirSync11(paths.stateDir, { recursive: true });
+  mkdirSync12(paths.stateDir, { recursive: true });
   if (type === "decision") {
-    const artifactDir = resolve24(paths.artifactsDir, activeTask);
-    mkdirSync11(artifactDir, { recursive: true });
+    const artifactDir = resolve25(paths.artifactsDir, activeTask);
+    mkdirSync12(artifactDir, { recursive: true });
     const timestamp = nowIso();
-    appendFileSync(resolve24(artifactDir, "decision-log.md"), `
+    appendFileSync(resolve25(artifactDir, "decision-log.md"), `
 ### ${timestamp}
 
 ${text}
@@ -6884,14 +6944,14 @@ ${text}
     return;
   }
   const failedPath = paths.failedApproachesPath;
-  if (!existsSync21(failedPath)) {
-    writeFileSync11(failedPath, `# Failed Approaches Log
+  if (!existsSync23(failedPath)) {
+    writeFileSync12(failedPath, `# Failed Approaches Log
 
 This file records approaches that did not work.
 
 `, "utf-8");
   }
-  const content = readFileSync11(failedPath, "utf-8");
+  const content = readFileSync12(failedPath, "utf-8");
   const attempts = (content.match(new RegExp(`^## ${escapeRegExp(activeTask)}\\b`, "gm")) || []).length + 1;
   appendFileSync(failedPath, `
 ## ${activeTask} - Attempt ${attempts} (${nowIso()})
@@ -6908,40 +6968,40 @@ function taskArtifacts(projectRoot, taskId) {
     throw new Error("No active task.");
   }
   const paths = resolveHarnessPaths(projectRoot);
-  const artifactDir = resolve24(paths.artifactsDir, activeTask);
-  mkdirSync11(artifactDir, { recursive: true });
+  const artifactDir = resolve25(paths.artifactsDir, activeTask);
+  mkdirSync12(artifactDir, { recursive: true });
   const changed = changedFilesForTask(projectRoot, activeTask, true);
-  writeFileSync11(resolve24(artifactDir, "changed-files.txt"), `${changed.join(`
+  writeFileSync12(resolve25(artifactDir, "changed-files.txt"), `${changed.join(`
 `)}
 `, "utf-8");
   console.log(`changed-files.txt: ${changed.length} files`);
-  const taskResultPath = resolve24(artifactDir, "task-result.json");
-  if (!existsSync21(taskResultPath)) {
+  const taskResultPath = resolve25(artifactDir, "task-result.json");
+  if (!existsSync23(taskResultPath)) {
     const template = {
       task_id: activeTask,
       status: "completed",
       summary: "TODO: Write a one-line summary of what you did",
       completed_at: nowIso()
     };
-    writeFileSync11(taskResultPath, `${JSON.stringify(template, null, 2)}
+    writeFileSync12(taskResultPath, `${JSON.stringify(template, null, 2)}
 `, "utf-8");
     console.log("task-result.json: created (update the summary!)");
   } else {
     console.log("task-result.json: already exists");
   }
-  const decisionLogPath = resolve24(artifactDir, "decision-log.md");
-  if (!existsSync21(decisionLogPath)) {
+  const decisionLogPath = resolve25(artifactDir, "decision-log.md");
+  if (!existsSync23(decisionLogPath)) {
     const content = `# Decision Log: ${activeTask}
 
 Record key decisions here using: rig-agent record decision "..."
 `;
-    writeFileSync11(decisionLogPath, content, "utf-8");
+    writeFileSync12(decisionLogPath, content, "utf-8");
     console.log("decision-log.md: created (record your decisions!)");
   } else {
     console.log("decision-log.md: already exists");
   }
-  const nextActionsPath = resolve24(artifactDir, "next-actions.md");
-  if (!existsSync21(nextActionsPath)) {
+  const nextActionsPath = resolve25(artifactDir, "next-actions.md");
+  if (!existsSync23(nextActionsPath)) {
     const content = [
       `# Next Actions: ${activeTask}`,
       "",
@@ -6958,13 +7018,13 @@ Record key decisions here using: rig-agent record decision "..."
       ""
     ].join(`
 `);
-    writeFileSync11(nextActionsPath, content, "utf-8");
+    writeFileSync12(nextActionsPath, content, "utf-8");
     console.log("next-actions.md: created (add recommendations for downstream tasks!)");
   } else {
     console.log("next-actions.md: already exists");
   }
-  const validationSummaryPath = resolve24(artifactDir, "validation-summary.json");
-  if (existsSync21(validationSummaryPath)) {
+  const validationSummaryPath = resolve25(artifactDir, "validation-summary.json");
+  if (existsSync23(validationSummaryPath)) {
     console.log("validation-summary.json: already exists");
   } else {
     console.log("validation-summary.json: not yet created (run: rig-agent validate)");
@@ -6978,8 +7038,8 @@ function taskArtifactDir(projectRoot, taskId) {
     throw new Error("No active task.");
   }
   const paths = resolveHarnessPaths(projectRoot);
-  const artifactDir = resolve24(paths.artifactsDir, activeTask);
-  mkdirSync11(artifactDir, { recursive: true });
+  const artifactDir = resolve25(paths.artifactsDir, activeTask);
+  mkdirSync12(artifactDir, { recursive: true });
   return artifactDir;
 }
 function taskArtifactWrite(projectRoot, filename, content, taskId) {
@@ -6988,10 +7048,10 @@ function taskArtifactWrite(projectRoot, filename, content, taskId) {
     throw new Error("No active task.");
   }
   const paths = resolveHarnessPaths(projectRoot);
-  const artifactDir = resolve24(paths.artifactsDir, activeTask);
-  mkdirSync11(artifactDir, { recursive: true });
-  const targetPath = resolve24(artifactDir, filename);
-  writeFileSync11(targetPath, content, "utf-8");
+  const artifactDir = resolve25(paths.artifactsDir, activeTask);
+  mkdirSync12(artifactDir, { recursive: true });
+  const targetPath = resolve25(artifactDir, filename);
+  writeFileSync12(targetPath, content, "utf-8");
   console.log(`Wrote: ${targetPath}`);
 }
 function taskArtifactRead(projectRoot, filename, options) {
@@ -7000,11 +7060,11 @@ function taskArtifactRead(projectRoot, filename, options) {
     throw new Error("No active task.");
   }
   const maxBytes = options?.maxBytes ?? 64 * 1024;
-  const targetPath = resolve24(taskArtifactDir(projectRoot, activeTask), filename);
-  if (!existsSync21(targetPath)) {
+  const targetPath = resolve25(taskArtifactDir(projectRoot, activeTask), filename);
+  if (!existsSync23(targetPath)) {
     throw new Error(`Artifact not found: ${targetPath}`);
   }
-  const buffer = readFileSync11(targetPath);
+  const buffer = readFileSync12(targetPath);
   const preview = buffer.subarray(0, maxBytes);
   return {
     path: targetPath,
@@ -7154,7 +7214,7 @@ function collectTaskChangedFiles(projectRoot, taskId, includeCommitted) {
     [projectRoot, ""],
     [monorepoRepoRoot, ""]
   ]) {
-    if (!existsSync21(resolve24(repo, ".git"))) {
+    if (!existsSync23(resolve25(repo, ".git"))) {
       continue;
     }
     if (includeCommitted && repo === monorepoRepoRoot) {
@@ -7179,12 +7239,22 @@ function filterTaskChangedFiles(projectRoot, taskId, files, scoped) {
 }
 function resolveTaskMonorepoRoot(projectRoot) {
   const runtimeWorkspace = loadRuntimeContextFromEnv()?.workspaceDir || process.env.RIG_TASK_WORKSPACE?.trim();
-  if (runtimeWorkspace && existsSync21(resolve24(runtimeWorkspace, ".git"))) {
-    return resolve24(runtimeWorkspace);
+  if (runtimeWorkspace && existsSync23(resolve25(runtimeWorkspace, ".git"))) {
+    return resolve25(runtimeWorkspace);
   }
   return resolveHarnessPaths(projectRoot).monorepoRoot;
 }
 function collectCommittedMonorepoFiles(projectRoot, repo) {
+  const defaultRef = runCapture(["git", "-C", repo, "rev-parse", "--abbrev-ref", "origin/HEAD"], projectRoot);
+  if (defaultRef.exitCode === 0 && defaultRef.stdout.trim()) {
+    const mergeBase = runCapture(["git", "-C", repo, "merge-base", "HEAD", defaultRef.stdout.trim()], projectRoot);
+    if (mergeBase.exitCode === 0 && mergeBase.stdout.trim()) {
+      const result = runCapture(["git", "-C", repo, "diff", "--name-only", `${mergeBase.stdout.trim()}..HEAD`], projectRoot);
+      if (result.exitCode === 0) {
+        return result.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+      }
+    }
+  }
   const initialHeadCommit = resolveRuntimeInitialHeadCommit(projectRoot, repo);
   if (initialHeadCommit) {
     const result = runCapture(["git", "-C", repo, "diff", "--name-only", `${initialHeadCommit}..HEAD`], projectRoot);
@@ -7208,7 +7278,7 @@ function resolveRuntimeInitialHeadCommit(projectRoot, repo) {
   const runtimeContext = loadRuntimeContextFromEnv();
   if (runtimeContext?.initialHeadCommits?.monorepo?.trim()) {
     const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
-    if (resolve24(monorepoRoot) === resolve24(repo)) {
+    if (resolve25(monorepoRoot) === resolve25(repo)) {
       return runtimeContext.initialHeadCommits.monorepo.trim();
     }
   }
@@ -7218,7 +7288,7 @@ function resolveMonorepoBaseCommit(projectRoot, repo) {
   const runtimeContext = loadRuntimeContextFromEnv();
   if (runtimeContext?.monorepoBaseCommit?.trim()) {
     const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
-    if (resolve24(monorepoRoot) === resolve24(repo)) {
+    if (resolve25(monorepoRoot) === resolve25(repo)) {
       return runtimeContext.monorepoBaseCommit.trim();
     }
   }
@@ -7263,7 +7333,7 @@ function resolveRuntimeDirtyBaseline(projectRoot, repo) {
     return new Set;
   }
   const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
-  const selected = resolve24(repo) === resolve24(monorepoRoot) ? dirtyFiles.monorepo : resolve24(repo) === resolve24(projectRoot) ? dirtyFiles.project : undefined;
+  const selected = resolve25(repo) === resolve25(monorepoRoot) ? dirtyFiles.monorepo : resolve25(repo) === resolve25(projectRoot) ? dirtyFiles.project : undefined;
   return new Set((selected || []).map((file) => normalizeChangedFilePath(file)).filter(Boolean));
 }
 function normalizeChangedFilePath(file) {
@@ -7363,12 +7433,12 @@ function printIndented(text) {
   }
 }
 function readLocalBeadsTasks(projectRoot) {
-  const issuesPath = resolve24(resolveMonorepoRoot2(projectRoot), ".beads/issues.jsonl");
-  if (!existsSync21(issuesPath)) {
+  const issuesPath = resolve25(resolveMonorepoRoot2(projectRoot), ".beads/issues.jsonl");
+  if (!existsSync23(issuesPath)) {
     return [];
   }
   const tasks = [];
-  for (const line of readFileSync11(issuesPath, "utf-8").split(/\r?\n/)) {
+  for (const line of readFileSync12(issuesPath, "utf-8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -7539,11 +7609,11 @@ function taskDependencies(projectRoot, taskId, tracker) {
   return [...ids].sort();
 }
 function printArtifactSection(path, header) {
-  if (!existsSync21(path)) {
+  if (!existsSync23(path)) {
     return;
   }
   console.log(header);
-  process.stdout.write(readFileSync11(path, "utf-8"));
+  process.stdout.write(readFileSync12(path, "utf-8"));
   console.log("");
 }
 function escapeRegExp(value) {