@h-rig/runtime 0.0.6-alpha.34 → 0.0.6-alpha.36

package/dist/src/control-plane/hooks/completion-verification.js

@@ -2,8 +2,8 @@
 // @bun
 
 // packages/runtime/src/control-plane/hooks/completion-verification.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync21, mkdirSync as mkdirSync13, readFileSync as readFileSync13, writeFileSync as writeFileSync13 } from "fs";
-import { resolve as resolve24 } from "path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync23, mkdirSync as mkdirSync14, readFileSync as readFileSync14, writeFileSync as writeFileSync14 } from "fs";
+import { resolve as resolve25 } from "path";
 import {
   escapeRegExp as escapeRegExp2,
   resolveBunCli,
@@ -1073,8 +1073,8 @@ function primeGuardHotPaths() {
 primeGuardHotPaths();
 
 // packages/runtime/src/control-plane/native/git-ops.ts
-import { existsSync as existsSync20, lstatSync, mkdirSync as mkdirSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync12 } from "fs";
-import { dirname as dirname10, isAbsolute as isAbsolute2, resolve as resolve23 } from "path";
+import { existsSync as existsSync22, lstatSync, mkdirSync as mkdirSync13, readFileSync as readFileSync13, writeFileSync as writeFileSync13 } from "fs";
+import { dirname as dirname11, isAbsolute as isAbsolute2, resolve as resolve24 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // packages/runtime/src/control-plane/runtime/baked-secrets.ts
@@ -1336,8 +1336,8 @@ function isAgentRuntimeContextPath(path) {
 }
 
 // packages/runtime/src/control-plane/native/task-ops.ts
-import { appendFileSync, existsSync as existsSync19, mkdirSync as mkdirSync11, readFileSync as readFileSync11, writeFileSync as writeFileSync11 } from "fs";
-import { resolve as resolve22 } from "path";
+import { appendFileSync, existsSync as existsSync21, mkdirSync as mkdirSync12, readFileSync as readFileSync12, writeFileSync as writeFileSync12 } from "fs";
+import { resolve as resolve23 } from "path";
 
 // packages/runtime/src/build-time-config.ts
 function normalizeBuildConfig(value) {
@@ -1653,6 +1653,8 @@ import { basename as basename3, dirname as dirname6, resolve as resolve9 } from
 var sharedNativeToolsOutputDir = resolve9(tmpdir4(), "rig-native");
 var sharedNativeToolsOutputPath = resolve9(sharedNativeToolsOutputDir, `rig-tools-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
 // packages/runtime/src/control-plane/plugin-host-context.ts
+import { existsSync as existsSync12 } from "fs";
+import { resolve as resolvePath } from "path";
 import { createPluginHost } from "@rig/core";
 import { loadConfig } from "@rig/core/load-config";
 
@@ -1973,6 +1975,55 @@ async function materializeSkills(projectRoot, entries) {
   return written;
 }
 
+// packages/runtime/src/control-plane/pi-settings-materializer.ts
+import { existsSync as existsSync11, mkdirSync as mkdirSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname8, resolve as resolve12 } from "path";
+var SETTINGS_RELATIVE_PATH = ".pi/settings.json";
+var MANAGED_RECORD_RELATIVE_PATH = ".rig/state/pi-managed-packages.json";
+function readJson(path, fallback) {
+  if (!existsSync11(path))
+    return fallback;
+  try {
+    return JSON.parse(readFileSync8(path, "utf-8"));
+  } catch {
+    return fallback;
+  }
+}
+function packageKey(entry) {
+  if (typeof entry === "string")
+    return entry;
+  if (entry && typeof entry === "object" && typeof entry.source === "string") {
+    return entry.source;
+  }
+  return JSON.stringify(entry);
+}
+function materializePiPackages(projectRoot, declaredPackages) {
+  const settingsPath = resolve12(projectRoot, SETTINGS_RELATIVE_PATH);
+  const managedRecordPath = resolve12(projectRoot, MANAGED_RECORD_RELATIVE_PATH);
+  const settings = readJson(settingsPath, {});
+  const previouslyManaged = new Set(readJson(managedRecordPath, []));
+  const existing = Array.isArray(settings.packages) ? settings.packages : [];
+  const operatorEntries = existing.filter((entry) => !previouslyManaged.has(packageKey(entry)));
+  const operatorKeys = new Set(operatorEntries.map(packageKey));
+  const managedToAdd = declaredPackages.filter((pkg) => !operatorKeys.has(pkg));
+  const nextPackages = [...operatorEntries, ...managedToAdd];
+  if (nextPackages.length > 0 || existsSync11(settingsPath)) {
+    const nextSettings = { ...settings };
+    if (nextPackages.length > 0) {
+      nextSettings.packages = nextPackages;
+    } else {
+      delete nextSettings.packages;
+    }
+    mkdirSync6(dirname8(settingsPath), { recursive: true });
+    writeFileSync5(settingsPath, `${JSON.stringify(nextSettings, null, 2)}
+`, "utf-8");
+  }
+  mkdirSync6(dirname8(managedRecordPath), { recursive: true });
+  writeFileSync5(managedRecordPath, `${JSON.stringify(managedToAdd, null, 2)}
+`, "utf-8");
+  return { settingsPath, packages: managedToAdd };
+}
+
 // packages/runtime/src/control-plane/plugin-host-context.ts
 async function buildPluginHostContext(projectRoot) {
   let config;
@@ -2020,6 +2071,14 @@ async function buildPluginHostContext(projectRoot) {
   } catch (err) {
     console.warn(`[plugin-host] skill materialization failed: ${err instanceof Error ? err.message : err}`);
   }
+  try {
+    const piPackages = config.runtime?.pi?.packages ?? [];
+    if (piPackages.length > 0 || existsSync12(resolvePath(projectRoot, ".rig/state/pi-managed-packages.json"))) {
+      materializePiPackages(projectRoot, piPackages);
+    }
+  } catch (err) {
+    console.warn(`[plugin-host] Pi package materialization failed: ${err instanceof Error ? err.message : err}`);
+  }
   return {
     config,
     pluginHost,
@@ -2033,12 +2092,12 @@ async function buildPluginHostContext(projectRoot) {
 
 // packages/runtime/src/control-plane/tasks/source-aware-task-config-source.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync9, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
-import { basename as basename4, join as join2, resolve as resolve13 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync10, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename4, join as join2, resolve as resolve14 } from "path";
 
 // packages/runtime/src/control-plane/tasks/legacy-task-config-source.ts
-import { existsSync as existsSync11, readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve12 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync9 } from "fs";
+import { resolve as resolve13 } from "path";
 
 // packages/runtime/src/control-plane/tasks/task-record-reader.ts
 async function findTaskById(reader, id) {
@@ -2061,7 +2120,7 @@ class LegacyTaskConfigReadError extends Error {
   }
 }
 function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve12(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve13(projectRoot, ".rig", "task-config.json");
   const reader = {
     async listTasks() {
       return readLegacyTaskRecords(projectRoot, configPath);
@@ -2072,8 +2131,8 @@ function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
   };
   return reader;
 }
-function readLegacyTaskRecords(projectRoot, configPath = resolve12(projectRoot, ".rig", "task-config.json")) {
-  if (!existsSync11(configPath)) {
+function readLegacyTaskRecords(projectRoot, configPath = resolve13(projectRoot, ".rig", "task-config.json")) {
+  if (!existsSync13(configPath)) {
     return [];
   }
   const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
@@ -2081,7 +2140,7 @@ function readLegacyTaskRecords(projectRoot, configPath = resolve12(projectRoot,
 }
 function readLegacyTaskConfigJson(projectRoot, configPath) {
   try {
-    const parsed = JSON.parse(readFileSync8(configPath, "utf8"));
+    const parsed = JSON.parse(readFileSync9(configPath, "utf8"));
     if (isPlainRecord(parsed)) {
       return parsed;
     }
@@ -2165,7 +2224,7 @@ function isPlainRecord(candidate) {
 var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
 var FILE_TASK_PATTERN = /\.(task\.)?json$/;
 function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
-  const configPath = options.configPath ?? resolve13(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve14(projectRoot, ".rig", "task-config.json");
   const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
   const spawnFn = options.spawn ?? spawnSync;
   const ghBinary = options.ghBinary ?? "gh";
@@ -2231,7 +2290,7 @@ async function readSourceAwareTaskStatus(projectRoot, taskId, options = {}) {
   }
 }
 function updateSourceAwareTaskConfigTask(projectRoot, taskId, update, options = {}) {
-  const configPath = options.configPath ?? resolve13(projectRoot, ".rig", "task-config.json");
+  const configPath = options.configPath ?? resolve14(projectRoot, ".rig", "task-config.json");
   const rawEntry = readRawTaskEntry(configPath, taskId);
   if (!rawEntry) {
     const configuredFilesPath = readConfiguredFilesTaskSourcePath(projectRoot);
@@ -2284,10 +2343,10 @@ function readMaterializedTaskMetadata(entry) {
   return metadata;
 }
 function readConfiguredFilesTaskSourcePath(projectRoot) {
-  const jsonPath = resolve13(projectRoot, "rig.config.json");
-  if (existsSync12(jsonPath)) {
+  const jsonPath = resolve14(projectRoot, "rig.config.json");
+  if (existsSync14(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync9(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync10(jsonPath, "utf8"));
       if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
         const source = parsed.taskSource;
         return source.kind === "files" && typeof source.path === "string" ? source.path : null;
@@ -2296,12 +2355,12 @@ function readConfiguredFilesTaskSourcePath(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve13(projectRoot, "rig.config.ts");
-  if (!existsSync12(tsPath)) {
+  const tsPath = resolve14(projectRoot, "rig.config.ts");
+  if (!existsSync14(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync9(tsPath, "utf8");
+    const source = readFileSync10(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -2321,10 +2380,10 @@ function readRawTaskEntry(configPath, taskId) {
   return isPlainRecord2(entry) ? entry : null;
 }
 function readRawTaskConfig(configPath) {
-  if (!existsSync12(configPath)) {
+  if (!existsSync14(configPath)) {
     return null;
   }
-  const parsed = JSON.parse(readFileSync9(configPath, "utf8"));
+  const parsed = JSON.parse(readFileSync10(configPath, "utf8"));
   return isPlainRecord2(parsed) ? parsed : null;
 }
 function stripLegacyTaskConfigMetadata2(raw) {
@@ -2341,16 +2400,16 @@ function writeLegacyTaskStatus(configPath, taskId, status) {
     return;
   }
   entry.status = status;
-  writeFileSync5(configPath, `${JSON.stringify(rawConfig, null, 2)}
+  writeFileSync6(configPath, `${JSON.stringify(rawConfig, null, 2)}
 `, "utf8");
 }
 function updateFileBackedTask(projectRoot, sourcePath, taskId, update) {
-  const directory = resolve13(projectRoot, sourcePath);
+  const directory = resolve14(projectRoot, sourcePath);
   const file = findFileBackedTaskFile(directory, taskId);
   if (!file) {
     return false;
   }
-  const raw = JSON.parse(readFileSync9(file, "utf8"));
+  const raw = JSON.parse(readFileSync10(file, "utf8"));
   if (!isPlainRecord2(raw)) {
     return false;
   }
@@ -2367,13 +2426,13 @@ function updateFileBackedTask(projectRoot, sourcePath, taskId, update) {
       { body: update.comment, createdAt: new Date().toISOString(), source: "rig" }
     ];
   }
-  writeFileSync5(file, `${JSON.stringify(raw, null, 2)}
+  writeFileSync6(file, `${JSON.stringify(raw, null, 2)}
 `, "utf8");
   return true;
 }
 function listFileBackedTasks(projectRoot, sourcePath) {
-  const directory = resolve13(projectRoot, sourcePath);
-  if (!existsSync12(directory)) {
+  const directory = resolve14(projectRoot, sourcePath);
+  if (!existsSync14(directory)) {
     return [];
   }
   const tasks = [];
@@ -2388,11 +2447,11 @@ function listFileBackedTasks(projectRoot, sourcePath) {
   return tasks;
 }
 function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
-  const file = findFileBackedTaskFile(resolve13(projectRoot, sourcePath), taskId);
+  const file = findFileBackedTaskFile(resolve14(projectRoot, sourcePath), taskId);
   if (!file) {
     return null;
   }
-  const raw = JSON.parse(readFileSync9(file, "utf8"));
+  const raw = JSON.parse(readFileSync10(file, "utf8"));
   if (!isPlainRecord2(raw)) {
     return null;
   }
@@ -2405,7 +2464,7 @@ function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
   };
 }
 function findFileBackedTaskFile(directory, taskId) {
-  if (!existsSync12(directory)) {
+  if (!existsSync14(directory)) {
     return null;
   }
   for (const name of readdirSync2(directory)) {
@@ -2415,7 +2474,7 @@ function findFileBackedTaskFile(directory, taskId) {
     try {
       if (!statSync3(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync9(file, "utf8"));
+      const raw = JSON.parse(readFileSync10(file, "utf8"));
       const inferredId = basename4(file).replace(FILE_TASK_PATTERN, "");
       const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
       if (id === taskId) {
@@ -2764,8 +2823,8 @@ function buildTaskRunLifecycleComment(input) {
 }
 
 // packages/runtime/src/control-plane/native/task-state.ts
-import { existsSync as existsSync13, readFileSync as readFileSync10, readdirSync as readdirSync3, statSync as statSync4, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename5, resolve as resolve14 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync11, readdirSync as readdirSync3, statSync as statSync4, writeFileSync as writeFileSync7 } from "fs";
+import { basename as basename5, resolve as resolve15 } from "path";
 
 // packages/runtime/src/control-plane/state-sync/types.ts
 var CANONICAL_TASK_LIFECYCLE_STATUSES = new Set([
@@ -2795,7 +2854,7 @@ function readValidationDescriptions(projectRoot) {
   return readValidationDescriptionMap(raw);
 }
 function readSourceValidationDescriptions(projectRoot) {
-  const rootRaw = readJsonFile(resolve14(projectRoot, "rig", "task-config.json"), {});
+  const rootRaw = readJsonFile(resolve15(projectRoot, "rig", "task-config.json"), {});
   const sourcePath = findSourceTaskConfigPath(projectRoot);
   const sourceRaw = sourcePath ? readJsonFile(sourcePath, {}) : {};
   const rootDescriptions = readValidationDescriptionMap(rootRaw);
@@ -2886,25 +2945,25 @@ function lookupTask(projectRoot, input) {
 function artifactDirForId(projectRoot, id) {
   const workspaceDir = process.env.RIG_TASK_WORKSPACE?.trim();
   if (workspaceDir) {
-    const worktreeArtifacts = resolve14(workspaceDir, "artifacts", id);
-    if (existsSync13(worktreeArtifacts) || existsSync13(resolve14(workspaceDir, "artifacts"))) {
+    const worktreeArtifacts = resolve15(workspaceDir, "artifacts", id);
+    if (existsSync15(worktreeArtifacts) || existsSync15(resolve15(workspaceDir, "artifacts"))) {
       return worktreeArtifacts;
     }
   }
   try {
     const paths = resolveHarnessPaths(projectRoot);
-    return resolve14(paths.artifactsDir, id);
+    return resolve15(paths.artifactsDir, id);
   } catch {
-    return resolve14(resolveMonorepoRoot2(projectRoot), "artifacts", id);
+    return resolve15(resolveMonorepoRoot2(projectRoot), "artifacts", id);
   }
 }
 function resolveTaskConfigPath(projectRoot) {
   const paths = resolveHarnessPaths(projectRoot);
-  if (existsSync13(paths.taskConfigPath)) {
+  if (existsSync15(paths.taskConfigPath)) {
     return paths.taskConfigPath;
   }
   for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
-    if (existsSync13(candidate)) {
+    if (existsSync15(candidate)) {
       return candidate;
     }
   }
@@ -2912,7 +2971,7 @@ function resolveTaskConfigPath(projectRoot) {
 }
 function findSourceTaskConfigPath(projectRoot) {
   for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
-    if (existsSync13(candidate)) {
+    if (existsSync15(candidate)) {
       return candidate;
     }
   }
@@ -2925,7 +2984,7 @@ function readAndSyncSourceTaskConfig(projectRoot) {
   const synced = synchronizeTaskConfigWithTracker(projectRoot, raw);
   if (sourcePath && synced.updated) {
     try {
-      writeFileSync6(sourcePath, `${JSON.stringify(synced.config, null, 2)}
+      writeFileSync7(sourcePath, `${JSON.stringify(synced.config, null, 2)}
 `, "utf-8");
     } catch {}
   }
@@ -2977,12 +3036,12 @@ function shouldRefreshAutoSyncedTaskConfigEntry(entry) {
   return !candidate.role;
 }
 function readSourceIssueRecords(projectRoot) {
-  const issuesPath = resolve14(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
-  if (!existsSync13(issuesPath)) {
+  const issuesPath = resolve15(resolveMonorepoRoot2(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync15(issuesPath)) {
     return [];
   }
   const records = [];
-  for (const line of readFileSync10(issuesPath, "utf-8").split(/\r?\n/)) {
+  for (const line of readFileSync11(issuesPath, "utf-8").split(/\r?\n/)) {
     const trimmed = line.trim();
     if (!trimmed) {
       continue;
@@ -3038,19 +3097,19 @@ function readConfiguredFileTaskConfig(projectRoot) {
   if (!sourcePath) {
     return {};
   }
-  const directory = resolve14(projectRoot, sourcePath);
-  if (!existsSync13(directory)) {
+  const directory = resolve15(projectRoot, sourcePath);
+  if (!existsSync15(directory)) {
     return {};
   }
   const config = {};
   for (const name of readdirSync3(directory)) {
     if (!FILE_TASK_PATTERN2.test(name))
       continue;
-    const file = resolve14(directory, name);
+    const file = resolve15(directory, name);
     try {
       if (!statSync4(file).isFile())
         continue;
-      const raw = JSON.parse(readFileSync10(file, "utf8"));
+      const raw = JSON.parse(readFileSync11(file, "utf8"));
       if (!raw || typeof raw !== "object" || Array.isArray(raw))
         continue;
       const record = raw;
@@ -3092,10 +3151,10 @@ function firstStringList2(...candidates) {
   return [];
 }
 function readConfiguredFilesTaskSourcePath2(projectRoot) {
-  const jsonPath = resolve14(projectRoot, "rig.config.json");
-  if (existsSync13(jsonPath)) {
+  const jsonPath = resolve15(projectRoot, "rig.config.json");
+  if (existsSync15(jsonPath)) {
     try {
-      const parsed = JSON.parse(readFileSync10(jsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync11(jsonPath, "utf8"));
       if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
         const taskSource = parsed.taskSource;
         if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
@@ -3107,12 +3166,12 @@ function readConfiguredFilesTaskSourcePath2(projectRoot) {
       return null;
     }
   }
-  const tsPath = resolve14(projectRoot, "rig.config.ts");
-  if (!existsSync13(tsPath)) {
+  const tsPath = resolve15(projectRoot, "rig.config.ts");
+  if (!existsSync15(tsPath)) {
     return null;
   }
   try {
-    const source = readFileSync10(tsPath, "utf8");
+    const source = readFileSync11(tsPath, "utf8");
     const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
     const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
     if (kind !== "files") {
@@ -3126,23 +3185,23 @@ function readConfiguredFilesTaskSourcePath2(projectRoot) {
 function sourceTaskConfigCandidates(projectRoot) {
   const runtimeContext = loadRuntimeContextFromEnv();
   return [
-    runtimeContext?.monorepoMainRoot ? resolve14(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
-    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve14(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
-    resolve14(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
+    runtimeContext?.monorepoMainRoot ? resolve15(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve15(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve15(resolveMonorepoRoot2(projectRoot), ".rig", "task-config.json")
   ].filter(Boolean);
 }
 
 // packages/runtime/src/control-plane/native/validator.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
-import { resolve as resolve19 } from "path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
+import { resolve as resolve20 } from "path";
 
 // packages/runtime/src/control-plane/native/validator-binaries.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync7, rmSync as rmSync5, statSync as statSync5 } from "fs";
-import { dirname as dirname9, resolve as resolve18 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync8, rmSync as rmSync5, statSync as statSync5 } from "fs";
+import { dirname as dirname10, resolve as resolve19 } from "path";
 
 // packages/runtime/src/binary-run.ts
-import { chmodSync as chmodSync2, cpSync, existsSync as existsSync14, mkdirSync as mkdirSync6, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync7 } from "fs";
-import { basename as basename6, dirname as dirname8, resolve as resolve15 } from "path";
+import { chmodSync as chmodSync2, cpSync, existsSync as existsSync16, mkdirSync as mkdirSync7, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "fs";
+import { basename as basename6, dirname as dirname9, resolve as resolve16 } from "path";
 import { fileURLToPath } from "url";
 import { drainMicrotasks, gcAndSweep } from "bun:jsc";
 var runtimeBinaryBuildQueue = Promise.resolve();
@@ -3168,9 +3227,9 @@ async function buildRuntimeBinary(options) {
   });
 }
 async function buildRuntimeBinaryInProcess(options, manifest) {
-  const tempBuildDir = resolve15(dirname8(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-  const tempOutputPath = resolve15(tempBuildDir, basename6(options.outputPath));
-  mkdirSync6(tempBuildDir, { recursive: true });
+  const tempBuildDir = resolve16(dirname9(options.outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  const tempOutputPath = resolve16(tempBuildDir, basename6(options.outputPath));
+  mkdirSync7(tempBuildDir, { recursive: true });
   await withTemporaryEnv({
     ...options.env,
     ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
@@ -3195,7 +3254,7 @@ async function buildRuntimeBinaryInProcess(options, manifest) {
 `);
       throw new Error(`Failed to build ${options.entrypoint}: ${details || "Bun.build() returned errors"}`);
     }
-    if (!existsSync14(tempOutputPath)) {
+    if (!existsSync16(tempOutputPath)) {
       const emitted = buildResult.outputs.map((output) => output.path).join(", ") || "(none)";
       throw new Error(`Failed to build ${options.entrypoint}: Bun.build() did not emit ${tempOutputPath}. Emitted: ${emitted}`);
     }
@@ -3227,8 +3286,8 @@ function runtimeBinaryCacheManifestPath(outputPath) {
 function resolveRuntimeBinaryBuildOptions(options) {
   return {
     ...options,
-    entrypoint: resolve15(options.cwd, options.sourcePath),
-    outputPath: resolve15(options.outputPath)
+    entrypoint: resolve16(options.cwd, options.sourcePath),
+    outputPath: resolve16(options.outputPath)
   };
 }
 function shouldUseRuntimeBinaryBuildWorker() {
@@ -3242,7 +3301,7 @@ function shouldUseRuntimeBinaryBuildWorker() {
 }
 async function buildRuntimeBinaryViaWorker(options) {
   const workerSourcePath = resolveRuntimeBinaryBuildWorkerSourcePath(options);
-  if (!workerSourcePath || !existsSync14(workerSourcePath)) {
+  if (!workerSourcePath || !existsSync16(workerSourcePath)) {
     await buildRuntimeBinaryInProcess(options, {
       manifestPath: runtimeBinaryCacheManifestPath(options.outputPath),
       buildKey: createRuntimeBinaryBuildKey({
@@ -3279,7 +3338,7 @@ async function buildRuntimeBinaryViaWorker(options) {
   }
 }
 function createRuntimeBinaryBuildWorkerPayloadPath(outputPath) {
-  return resolve15(dirname8(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+  return resolve16(dirname9(outputPath), `.bun-build-worker-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
 }
 function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
   const envRoots = [
@@ -3288,13 +3347,13 @@ function resolveRuntimeBinaryBuildWorkerSourcePath(options) {
     process.env.PROJECT_RIG_ROOT?.trim()
   ].filter(Boolean);
   for (const root of envRoots) {
-    const candidate = resolve15(root, "packages/runtime/src/binary-build-worker.ts");
-    if (existsSync14(candidate)) {
+    const candidate = resolve16(root, "packages/runtime/src/binary-build-worker.ts");
+    if (existsSync16(candidate)) {
       return candidate;
     }
   }
-  const localCandidate = resolve15(import.meta.dir, "binary-build-worker.ts");
-  return existsSync14(localCandidate) ? localCandidate : null;
+  const localCandidate = resolve16(import.meta.dir, "binary-build-worker.ts");
+  return existsSync16(localCandidate) ? localCandidate : null;
 }
 function resolveRuntimeBinaryBuildWorkerInvocation() {
   const bunPath = Bun.which("bun");
@@ -3330,7 +3389,7 @@ function createRuntimeBinaryBuildKey(input) {
   });
 }
 async function isRuntimeBinaryBuildFresh(input) {
-  if (!existsSync14(input.outputPath) || !existsSync14(input.manifestPath)) {
+  if (!existsSync16(input.outputPath) || !existsSync16(input.manifestPath)) {
     return false;
   }
   let manifest = null;
@@ -3343,7 +3402,7 @@ async function isRuntimeBinaryBuildFresh(input) {
     return false;
   }
   for (const [filePath, expectedDigest] of Object.entries(manifest.inputs || {})) {
-    if (!existsSync14(filePath)) {
+    if (!existsSync16(filePath)) {
       return false;
     }
     if (await sha256File(filePath) !== expectedDigest) {
@@ -3356,7 +3415,7 @@ async function writeRuntimeBinaryCacheManifest(input) {
   const inputs = {};
   for (const inputPath of Object.keys(input.metafile?.inputs || {}).sort()) {
     const normalized = normalizeBuildInputPath(input.cwd, inputPath);
-    if (!normalized || !existsSync14(normalized)) {
+    if (!normalized || !existsSync16(normalized)) {
       continue;
     }
     inputs[normalized] = await sha256File(normalized);
@@ -3379,7 +3438,7 @@ function normalizeBuildInputPath(cwd, inputPath) {
   if (inputPath.startsWith("<")) {
     return null;
   }
-  return resolve15(cwd, inputPath);
+  return resolve16(cwd, inputPath);
 }
 async function sha256File(path) {
   const hasher = new Bun.CryptoHasher("sha256");
@@ -3395,8 +3454,8 @@ function sortRecord(value) {
 async function runSerializedRuntimeBinaryBuild(action) {
   const previous = runtimeBinaryBuildQueue;
   let release;
-  runtimeBinaryBuildQueue = new Promise((resolve16) => {
-    release = resolve16;
+  runtimeBinaryBuildQueue = new Promise((resolve17) => {
+    release = resolve17;
   });
   await previous;
   try {
@@ -3441,11 +3500,11 @@ async function withTemporaryCwd(cwd, action) {
 }
 
 // packages/runtime/src/control-plane/runtime/provisioning-env.ts
-import { delimiter, resolve as resolve17 } from "path";
+import { delimiter, resolve as resolve18 } from "path";
 
 // packages/runtime/src/control-plane/runtime/runtime-paths.ts
-import { existsSync as existsSync15, readdirSync as readdirSync4, realpathSync } from "fs";
-import { resolve as resolve16 } from "path";
+import { existsSync as existsSync17, readdirSync as readdirSync4, realpathSync } from "fs";
+import { resolve as resolve17 } from "path";
 
 // packages/runtime/src/control-plane/runtime/sandbox/utils.ts
 function uniq(values) {
@@ -3463,7 +3522,7 @@ function resolveBunBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve16(home, ".bun/bin/bun") : "",
+    home ? resolve17(home, ".bun/bin/bun") : "",
     "/opt/homebrew/bin/bun",
     "/usr/local/bin/bun",
     "/usr/bin/bun"
@@ -3491,8 +3550,8 @@ function resolveClaudeBinaryPath() {
   }
   const home = process.env.HOME?.trim();
   const fallbackCandidates = [
-    home ? resolve16(home, ".local/bin/claude") : "",
-    home ? resolve16(home, ".local/share/claude/local/claude") : "",
+    home ? resolve17(home, ".local/bin/claude") : "",
+    home ? resolve17(home, ".local/share/claude/local/claude") : "",
     "/opt/homebrew/bin/claude",
     "/usr/local/bin/claude",
     "/usr/bin/claude"
@@ -3506,51 +3565,51 @@ function resolveClaudeBinaryPath() {
   throw new Error("claude not found in PATH");
 }
 function resolveBunInstallDir(bunBinaryPath = resolveBunBinaryPath()) {
-  return resolve16(bunBinaryPath, "../..");
+  return resolve17(bunBinaryPath, "../..");
 }
 function resolveClaudeInstallDir() {
   const realPath = resolveClaudeBinaryPath();
-  return resolve16(realPath, "..");
+  return resolve17(realPath, "..");
 }
 function resolveNodeInstallDir() {
   const preferredNode = resolvePreferredNodeBinary();
   if (!preferredNode)
     return null;
   const explicitNode = process.env.RIG_NODE_BIN?.trim();
-  if (explicitNode && resolve16(explicitNode) === resolve16(preferredNode)) {
-    return preferredNode.endsWith("/bin/node") ? resolve16(preferredNode, "../..") : resolve16(preferredNode, "..");
+  if (explicitNode && resolve17(explicitNode) === resolve17(preferredNode)) {
+    return preferredNode.endsWith("/bin/node") ? resolve17(preferredNode, "../..") : resolve17(preferredNode, "..");
   }
   try {
     const realPath = realpathSync(preferredNode);
     if (realPath.endsWith("/bin/node")) {
-      return resolve16(realPath, "../..");
+      return resolve17(realPath, "../..");
     }
-    return resolve16(realPath, "..");
+    return resolve17(realPath, "..");
   } catch {
-    return resolve16(preferredNode, "..");
+    return resolve17(preferredNode, "..");
   }
 }
 function resolvePreferredNodeBinary() {
   const candidates = [];
   const envNode = process.env.RIG_NODE_BIN?.trim();
   if (envNode) {
-    const explicit = resolve16(envNode);
-    if (existsSync15(explicit)) {
+    const explicit = resolve17(envNode);
+    if (existsSync17(explicit)) {
       return explicit;
     }
   }
   const nvmBin = process.env.NVM_BIN?.trim();
   if (nvmBin) {
-    candidates.push(resolve16(nvmBin, "node"));
+    candidates.push(resolve17(nvmBin, "node"));
   }
   const home = process.env.HOME?.trim();
   if (home) {
-    const nvmVersionsDir = resolve16(home, ".nvm/versions/node");
-    if (existsSync15(nvmVersionsDir)) {
+    const nvmVersionsDir = resolve17(home, ".nvm/versions/node");
+    if (existsSync17(nvmVersionsDir)) {
       try {
         const versionDirs = readdirSync4(nvmVersionsDir).map((entry) => entry.trim()).filter((entry) => /^v\d+\.\d+\.\d+$/.test(entry)).sort((a, b) => Bun.semver.order(b.replace(/^v/, ""), a.replace(/^v/, "")));
         for (const versionDir of versionDirs) {
-          candidates.push(resolve16(nvmVersionsDir, versionDir, "bin/node"));
+          candidates.push(resolve17(nvmVersionsDir, versionDir, "bin/node"));
         }
       } catch {}
     }
@@ -3559,8 +3618,8 @@ function resolvePreferredNodeBinary() {
   if (whichNode) {
     candidates.push(whichNode);
   }
-  const deduped = uniq(candidates.map((candidate) => resolve16(candidate)));
-  const existing = deduped.filter((candidate) => existsSync15(candidate));
+  const deduped = uniq(candidates.map((candidate) => resolve17(candidate)));
+  const existing = deduped.filter((candidate) => existsSync17(candidate));
   if (existing.length === 0) {
     return null;
   }
@@ -3574,7 +3633,7 @@ function resolvePreferredNodeBinary() {
   return existing[0] ?? null;
 }
 function inferNodeMajor(nodeBinaryPath) {
-  const normalized = resolve16(nodeBinaryPath).replace(/\\/g, "/");
+  const normalized = resolve17(nodeBinaryPath).replace(/\\/g, "/");
   const match = normalized.match(/(?:^|\/)(?:node-)?v?(\d+)\.\d+\.\d+(?:\/|$)/);
   if (!match) {
     return null;
@@ -3586,8 +3645,8 @@ function normalizeExecutablePath(candidate) {
   if (!candidate) {
     return "";
   }
-  const normalized = resolve16(candidate);
-  if (!existsSync15(normalized)) {
+  const normalized = resolve17(candidate);
+  if (!existsSync17(normalized)) {
     return "";
   }
   try {
@@ -3597,7 +3656,7 @@ function normalizeExecutablePath(candidate) {
   }
 }
 function looksLikeRuntimeGateway(candidate) {
-  const normalized = resolve16(candidate).replace(/\\/g, "/");
+  const normalized = resolve17(candidate).replace(/\\/g, "/");
   return normalized.includes("/.rig/bin/") || normalized.endsWith("/rig-shell") || normalized.endsWith("/rig-agent");
 }
 
@@ -3618,7 +3677,7 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     try {
       return resolveClaudeInstallDir();
     } catch {
-      return resolve17(claudeBinary, "..");
+      return resolve18(claudeBinary, "..");
     }
   })() : "";
   const nodeDir = resolveNodeInstallDir();
@@ -3628,8 +3687,8 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
     `${bunDir}/bin`,
     claudeDir,
     nodeDir ? `${nodeDir}/bin` : "",
-    realHome ? resolve17(realHome, ".local/bin") : "",
-    realHome ? resolve17(realHome, ".cargo/bin") : "",
+    realHome ? resolve18(realHome, ".local/bin") : "",
+    realHome ? resolve18(realHome, ".cargo/bin") : "",
     ...inheritedPath,
     "/usr/local/bin",
     "/usr/local/sbin",
@@ -3660,9 +3719,9 @@ function runtimeProvisioningEnv(baseEnv = process.env) {
 // packages/runtime/src/control-plane/native/validator-binaries.ts
 function resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext) {
   if (runtimeContext) {
-    return resolve18(runtimeContext.binDir, "validators", binaryName);
+    return resolve19(runtimeContext.binDir, "validators", binaryName);
   }
-  return resolve18(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
+  return resolve19(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
 }
 async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
   const match = checkId.match(/^([a-z][\w-]*):([a-z][\w-]*)$/);
@@ -3677,19 +3736,19 @@ async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
   const binaryName = `${category}-${check}`;
   const binaryPath = resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
   const hostProjectRoot = runtimeContext?.hostProjectRoot?.trim() || projectRoot;
-  const sourcePath = resolve18(hostProjectRoot, "packages/runtime/src/control-plane/validators", category, `${check}.ts`);
-  if (!existsSync16(sourcePath)) {
+  const sourcePath = resolve19(hostProjectRoot, "packages/runtime/src/control-plane/validators", category, `${check}.ts`);
+  if (!existsSync18(sourcePath)) {
     return null;
   }
   const sourceMtime = statSync5(sourcePath).mtimeMs;
-  const binaryExists = existsSync16(binaryPath);
+  const binaryExists = existsSync18(binaryPath);
   const binaryMtime = binaryExists ? statSync5(binaryPath).mtimeMs : 0;
   if (!binaryExists || sourceMtime > binaryMtime) {
     if (binaryExists) {
       rmSync5(binaryPath, { force: true });
       rmSync5(`${binaryPath}.build-manifest.json`, { force: true });
     }
-    mkdirSync7(dirname9(binaryPath), { recursive: true });
+    mkdirSync8(dirname10(binaryPath), { recursive: true });
     await buildRuntimeBinary({
       sourcePath: `packages/runtime/src/control-plane/validators/${category}/${check}.ts`,
       outputPath: binaryPath,
@@ -3698,7 +3757,7 @@ async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
       env: runtimeProvisioningEnv()
     });
   }
-  return existsSync16(binaryPath) ? binaryPath : null;
+  return existsSync18(binaryPath) ? binaryPath : null;
 }
 
 // packages/runtime/src/control-plane/native/validator.ts
@@ -3735,20 +3794,20 @@ async function readTaskSourceValidation(projectRoot, taskId) {
 function resolveValidationPaths(projectRoot, taskId, runtimeContext) {
   if (runtimeContext) {
     return {
-      taskLogDir: resolve19(runtimeContext.logsDir, taskId),
-      artifactDir: resolve19(runtimeContext.workspaceDir, "artifacts", taskId)
+      taskLogDir: resolve20(runtimeContext.logsDir, taskId),
+      artifactDir: resolve20(runtimeContext.workspaceDir, "artifacts", taskId)
     };
   }
   const paths = resolveHarnessPaths(projectRoot);
   return {
-    taskLogDir: resolve19(paths.logsDir, taskId),
-    artifactDir: resolve19(paths.artifactsDir, taskId)
+    taskLogDir: resolve20(paths.logsDir, taskId),
+    artifactDir: resolve20(paths.artifactsDir, taskId)
   };
 }
 async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext) {
   const binaryName = checkId.replace(":", "-");
   const binaryPath = await ensureValidatorBinary(projectRoot, checkId, runtimeContext) ?? resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
-  if (!existsSync17(binaryPath)) {
+  if (!existsSync19(binaryPath)) {
     return {
       result: {
         id: checkId,
@@ -3759,7 +3818,7 @@ async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext)
     };
   }
   const validatorCwd = runtimeContext?.workspaceDir || resolveMonorepoRoot(projectRoot);
-  const runtimeShellPath = runtimeContext ? resolve19(runtimeContext.binDir, "rig-shell") : "";
+  const runtimeShellPath = runtimeContext ? resolve20(runtimeContext.binDir, "rig-shell") : "";
   const monorepoMainRoot = runtimeContext?.monorepoMainRoot || process.env.MONOREPO_MAIN_ROOT?.trim() || resolveMonorepoRoot(projectRoot);
   const validatorEnv = {
     PROJECT_RIG_ROOT: runtimeContext?.hostProjectRoot || projectRoot,
@@ -3774,7 +3833,7 @@ async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext)
     validatorEnv.RIG_LOGS_DIR = runtimeContext.logsDir;
     validatorEnv.RIG_RUNTIME_BIN_DIR = runtimeContext.binDir;
   }
-  const { exitCode, stdout, stderr } = await runCaptureAsync(runtimeShellPath && existsSync17(runtimeShellPath) ? [runtimeShellPath, "run-binary", binaryPath] : [binaryPath], validatorCwd, validatorEnv);
+  const { exitCode, stdout, stderr } = await runCaptureAsync(runtimeShellPath && existsSync19(runtimeShellPath) ? [runtimeShellPath, "run-binary", binaryPath] : [binaryPath], validatorCwd, validatorEnv);
   try {
     const result = JSON.parse(stdout.trim());
     return { result, exitCode };
@@ -3814,8 +3873,8 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
   const configuredValidation = stringArray(taskConfig[taskId]?.validation);
   const commands = resolvedContext?.validation?.length ? resolvedContext.validation : configuredValidation.length > 0 ? configuredValidation : sourceValidation.validation;
   const { taskLogDir, artifactDir } = resolveValidationPaths(projectRoot, taskId, resolvedContext);
-  mkdirSync8(taskLogDir, { recursive: true });
-  mkdirSync8(artifactDir, { recursive: true });
+  mkdirSync9(taskLogDir, { recursive: true });
+  mkdirSync9(artifactDir, { recursive: true });
   if (commands.length === 0) {
     const skipped = {
       status: "skipped",
@@ -3824,7 +3883,7 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
       failed: 0,
       categories: []
     };
-    writeFileSync8(resolve19(artifactDir, "validation-summary.json"), `${JSON.stringify(skipped, null, 2)}
+    writeFileSync9(resolve20(artifactDir, "validation-summary.json"), `${JSON.stringify(skipped, null, 2)}
 `, "utf-8");
     return skipped;
   }
@@ -3859,18 +3918,18 @@ async function validateTask(projectRoot, taskId, runtimeContext, registry, optio
         exit_code: 2,
         duration_seconds: 0
       });
-      const logFile2 = resolve19(taskLogDir, `invalid-entry-validation.log`);
-      mkdirSync8(taskLogDir, { recursive: true });
-      writeFileSync8(logFile2, `=== ${nowIso()} :: ${cmd} ===
+      const logFile2 = resolve20(taskLogDir, `invalid-entry-validation.log`);
+      mkdirSync9(taskLogDir, { recursive: true });
+      writeFileSync9(logFile2, `=== ${nowIso()} :: ${cmd} ===
 Invalid validation entry: not a check-ID. All entries must use format "category:check-name".
 `, "utf-8");
       continue;
     }
     const { result, exitCode } = await dispatchValidator(cmd, effectiveRegistry, validatorCtx, (id) => runValidatorBinary(projectRoot, taskId, id, resolvedContext));
     const durationSeconds = Math.max(0, Math.round((Date.now() - startedAt) / 1000));
-    const logFile = resolve19(taskLogDir, `${cmd.replace(":", "-")}-validation.log`);
-    mkdirSync8(taskLogDir, { recursive: true });
-    writeFileSync8(logFile, `=== ${nowIso()} :: ${cmd} ===
+    const logFile = resolve20(taskLogDir, `${cmd.replace(":", "-")}-validation.log`);
+    mkdirSync9(taskLogDir, { recursive: true });
+    writeFileSync9(logFile, `=== ${nowIso()} :: ${cmd} ===
 ${JSON.stringify(result, null, 2)}
 `, "utf-8");
     if (result.passed) {
@@ -3892,19 +3951,19 @@ ${JSON.stringify(result, null, 2)}
     failed,
     categories
   };
-  mkdirSync8(artifactDir, { recursive: true });
-  writeFileSync8(resolve19(artifactDir, "validation-summary.json"), `${JSON.stringify(summary, null, 2)}
+  mkdirSync9(artifactDir, { recursive: true });
+  writeFileSync9(resolve20(artifactDir, "validation-summary.json"), `${JSON.stringify(summary, null, 2)}
 `, "utf-8");
   return summary;
 }
 
 // packages/runtime/src/control-plane/native/verifier.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
-import { resolve as resolve21 } from "path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
+import { resolve as resolve22 } from "path";
 
 // packages/runtime/src/control-plane/native/pr-review-gate.ts
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
-import { resolve as resolve20 } from "path";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
+import { resolve as resolve21 } from "path";
 function parseJsonObject(value) {
   if (!value?.trim())
     return { value: {}, error: "empty JSON output" };
@@ -5228,34 +5287,34 @@ function buildStrictPrGateSteeringPrompt(result) {
 }
 function persistPrReviewCycleArtifacts(input) {
   const cycleName = input.final ? `${input.cycle}-final` : String(input.cycle);
-  const taskArtifactRoot = input.artifactRoot?.trim() ? input.artifactRoot : resolve20(input.projectRoot, "artifacts", input.taskId);
-  const root = resolve20(taskArtifactRoot, "pr-review-cycles", cycleName);
-  mkdirSync9(root, { recursive: true });
-  const finalMergeGateResultPath = input.final ? resolve20(taskArtifactRoot, "merge-gate-final.json") : undefined;
+  const taskArtifactRoot = input.artifactRoot?.trim() ? input.artifactRoot : resolve21(input.projectRoot, "artifacts", input.taskId);
+  const root = resolve21(taskArtifactRoot, "pr-review-cycles", cycleName);
+  mkdirSync10(root, { recursive: true });
+  const finalMergeGateResultPath = input.final ? resolve21(taskArtifactRoot, "merge-gate-final.json") : undefined;
   const paths = {
     root,
-    prTitlePath: resolve20(root, "pr-title.md"),
-    prBodyPath: resolve20(root, "pr-body.md"),
-    prCommentsPath: resolve20(root, "pr-comments.json"),
-    reviewThreadsPath: resolve20(root, "review-threads.json"),
-    reviewCommentsPath: resolve20(root, "review-comments.json"),
-    checkRollupPath: resolve20(root, "check-rollup.json"),
-    greptileEvidencePath: resolve20(root, "greptile-evidence.json"),
-    mergeGateResultPath: resolve20(root, "merge-gate-result.json"),
-    steeringPromptPath: resolve20(root, "agent-steering-prompt.md"),
+    prTitlePath: resolve21(root, "pr-title.md"),
+    prBodyPath: resolve21(root, "pr-body.md"),
+    prCommentsPath: resolve21(root, "pr-comments.json"),
+    reviewThreadsPath: resolve21(root, "review-threads.json"),
+    reviewCommentsPath: resolve21(root, "review-comments.json"),
+    checkRollupPath: resolve21(root, "check-rollup.json"),
+    greptileEvidencePath: resolve21(root, "greptile-evidence.json"),
+    mergeGateResultPath: resolve21(root, "merge-gate-result.json"),
+    steeringPromptPath: resolve21(root, "agent-steering-prompt.md"),
     ...finalMergeGateResultPath ? { finalMergeGateResultPath } : {}
   };
-  writeFileSync9(paths.prTitlePath, input.result.evidence.title || "", "utf8");
-  writeFileSync9(paths.prBodyPath, input.result.evidence.body || "", "utf8");
-  writeFileSync9(paths.prCommentsPath, `${JSON.stringify(input.result.evidence.relevantIssueComments, null, 2)}
+  writeFileSync10(paths.prTitlePath, input.result.evidence.title || "", "utf8");
+  writeFileSync10(paths.prBodyPath, input.result.evidence.body || "", "utf8");
+  writeFileSync10(paths.prCommentsPath, `${JSON.stringify(input.result.evidence.relevantIssueComments, null, 2)}
 `, "utf8");
-  writeFileSync9(paths.reviewThreadsPath, `${JSON.stringify(input.result.evidence.reviewThreads, null, 2)}
+  writeFileSync10(paths.reviewThreadsPath, `${JSON.stringify(input.result.evidence.reviewThreads, null, 2)}
 `, "utf8");
-  writeFileSync9(paths.reviewCommentsPath, `${JSON.stringify(input.result.evidence.changedFileReviewComments, null, 2)}
+  writeFileSync10(paths.reviewCommentsPath, `${JSON.stringify(input.result.evidence.changedFileReviewComments, null, 2)}
 `, "utf8");
-  writeFileSync9(paths.checkRollupPath, `${JSON.stringify(input.result.evidence.statusCheckRollup, null, 2)}
+  writeFileSync10(paths.checkRollupPath, `${JSON.stringify(input.result.evidence.statusCheckRollup, null, 2)}
 `, "utf8");
-  writeFileSync9(paths.greptileEvidencePath, `${JSON.stringify(input.result.evidence.greptile, null, 2)}
+  writeFileSync10(paths.greptileEvidencePath, `${JSON.stringify(input.result.evidence.greptile, null, 2)}
 `, "utf8");
   const mergeGatePayload = {
     approved: input.result.approved,
@@ -5272,13 +5331,13 @@ function persistPrReviewCycleArtifacts(input) {
     evidence: input.result.evidence,
     cycleArtifactRoot: root
   };
-  writeFileSync9(paths.mergeGateResultPath, `${JSON.stringify(mergeGatePayload, null, 2)}
+  writeFileSync10(paths.mergeGateResultPath, `${JSON.stringify(mergeGatePayload, null, 2)}
 `, "utf8");
   if (paths.finalMergeGateResultPath) {
-    writeFileSync9(paths.finalMergeGateResultPath, `${JSON.stringify(mergeGatePayload, null, 2)}
+    writeFileSync10(paths.finalMergeGateResultPath, `${JSON.stringify(mergeGatePayload, null, 2)}
 `, "utf8");
   }
-  writeFileSync9(paths.steeringPromptPath, input.steeringPrompt, "utf8");
+  writeFileSync10(paths.steeringPromptPath, input.steeringPrompt, "utf8");
   return paths;
 }
 async function runStrictPrMergeGate(input) {
@@ -5295,7 +5354,7 @@ async function runStrictPrMergeGate(input) {
     final: input.final
   });
   const steeringPrompt = buildStrictPrGateSteeringPrompt({ ...base, artifacts });
-  writeFileSync9(artifacts.steeringPromptPath, steeringPrompt, "utf8");
+  writeFileSync10(artifacts.steeringPromptPath, steeringPrompt, "utf8");
   return { ...base, artifacts, steeringPrompt };
 }
 
@@ -5305,11 +5364,11 @@ async function verifyTask(options) {
   const taskId = options.taskId;
   const normalizedTaskId = lookupTask(options.projectRoot, taskId);
   const artifactDir = artifactDirForId(options.projectRoot, taskId);
-  mkdirSync10(artifactDir, { recursive: true });
-  const validationSummaryPath = resolve21(artifactDir, "validation-summary.json");
-  const reviewFeedbackPath = resolve21(artifactDir, "review-feedback.md");
-  const reviewStatePath = resolve21(artifactDir, "review-state.json");
-  const greptileRawPath = resolve21(artifactDir, "review-greptile-raw.json");
+  mkdirSync11(artifactDir, { recursive: true });
+  const validationSummaryPath = resolve22(artifactDir, "validation-summary.json");
+  const reviewFeedbackPath = resolve22(artifactDir, "review-feedback.md");
+  const reviewStatePath = resolve22(artifactDir, "review-state.json");
+  const greptileRawPath = resolve22(artifactDir, "review-greptile-raw.json");
   const prStates = readPrMetadata(options.projectRoot, taskId);
   const prState = prStates[0] || null;
   const localReasons = [];
@@ -5321,7 +5380,7 @@ async function verifyTask(options) {
   if (!normalizedTaskId && !await hasConfiguredSourceTask(options.projectRoot, taskId)) {
     localReasons.push(`[Task Config] Unknown task id '${taskId}' in task-config or configured task source.`);
   }
-  if (!existsSync18(validationSummaryPath)) {
+  if (!existsSync20(validationSummaryPath)) {
     localReasons.push(`[Artifact Quality] validation-summary.json not found at ${validationSummaryPath}.`);
   } else {
     const summary = await parseValidationSummary(validationSummaryPath);
@@ -5330,13 +5389,13 @@ async function verifyTask(options) {
     }
   }
   for (const file of ["task-result.json", "decision-log.md", "next-actions.md", "changed-files.txt"]) {
-    const requiredPath = resolve21(artifactDir, file);
-    if (!existsSync18(requiredPath)) {
+    const requiredPath = resolve22(artifactDir, file);
+    if (!existsSync20(requiredPath)) {
       localReasons.push(`[Artifact Quality] Missing required artifact file: ${requiredPath}`);
     }
   }
-  const taskResultPath = resolve21(artifactDir, "task-result.json");
-  if (existsSync18(taskResultPath)) {
+  const taskResultPath = resolve22(artifactDir, "task-result.json");
+  if (existsSync20(taskResultPath)) {
     const taskResult = await readJsonFile2(taskResultPath);
     const artifactStatus = typeof taskResult?.status === "string" ? taskResult.status.trim().toLowerCase() : "";
     if (artifactStatus === "partial") {
@@ -5349,8 +5408,8 @@ async function verifyTask(options) {
       localReasons.push("[Artifact Quality] task-result.json next actions indicate remaining implementation scope.");
     }
   }
-  const nextActionsPath = resolve21(artifactDir, "next-actions.md");
-  if (existsSync18(nextActionsPath)) {
+  const nextActionsPath = resolve22(artifactDir, "next-actions.md");
+  if (existsSync20(nextActionsPath)) {
     const nextActionsContent = await Bun.file(nextActionsPath).text();
     if (nextActionsContent.includes("TODO: Replace this scaffold") || nextActionsContent.includes("bd-<downstream-task-id>")) {
       localReasons.push("[Artifact Quality] next-actions.md still contains scaffold placeholder text. Replace with real recommendations.");
@@ -5381,7 +5440,7 @@ async function verifyTask(options) {
       aiReasons.push(`[AI Review] Required mode needs a completed Greptile approval; current verdict is ${ai.verdict}.`);
     }
     if (persistArtifacts && ai.rawResponse) {
-      writeFileSync10(greptileRawPath, `${ai.rawResponse}
+      writeFileSync11(greptileRawPath, `${ai.rawResponse}
 `, "utf-8");
     }
   } else if (!options.skipAiReview && reviewMode === "off") {
@@ -5624,7 +5683,7 @@ function evaluateSourceCloseoutChecks(prState, prLabel) {
   if (!Array.isArray(checks) || checks.length === 0) {
     return [`[Source Issue] PR ${prLabel} must have green check evidence before completion.`];
   }
-  const ciGate = evaluatePullRequestCiChecks(checks, "PR", 0);
+  const ciGate = evaluatePullRequestCiChecks(checks, "PR", 0, { mergeStateStatus: prState.mergeStateStatus });
   if (ciGate.verdict === "APPROVE") {
     return [];
   }
@@ -5720,7 +5779,7 @@ function isAcceptedValidationSummary(summary) {
   return summary.status === "skipped" && summary.total === 0 && summary.failed === 0;
 }
 async function loadReviewMode(reviewProfilePath, fallback) {
-  const parsed = existsSync18(reviewProfilePath) ? await readJsonFile2(reviewProfilePath) : null;
+  const parsed = existsSync20(reviewProfilePath) ? await readJsonFile2(reviewProfilePath) : null;
   const mode = parsed?.mode;
   if (mode === "off" || mode === "advisory" || mode === "required") {
     return mode;
@@ -5731,7 +5790,7 @@ async function loadReviewMode(reviewProfilePath, fallback) {
   return "advisory";
 }
 async function loadReviewProvider(reviewProfilePath, fallback) {
-  const parsed = existsSync18(reviewProfilePath) ? await readJsonFile2(reviewProfilePath) : null;
+  const parsed = existsSync20(reviewProfilePath) ? await readJsonFile2(reviewProfilePath) : null;
   const provider = parsed?.provider;
   if (typeof provider === "string" && provider.trim().length > 0) {
     return provider;
@@ -5890,7 +5949,7 @@ function writeFeedbackFile(options) {
   if (options.aiRawFeedback) {
     lines.push("## Raw Reviewer Feedback", "", "```text", options.aiRawFeedback, "```", "");
   }
-  writeFileSync10(options.output, `${lines.join(`
+  writeFileSync11(options.output, `${lines.join(`
 `)}
 `, "utf-8");
 }
@@ -5907,7 +5966,7 @@ function writeReviewStateFile(options) {
     ai_warnings: options.aiWarnings,
     updated_at: nowIso()
   };
-  writeFileSync10(options.output, `${JSON.stringify(payload, null, 2)}
+  writeFileSync11(options.output, `${JSON.stringify(payload, null, 2)}
 `, "utf-8");
 }
 async function runGreptileReviewForPr(options) {
@@ -5988,7 +6047,7 @@ async function runGreptileReviewForPr(options) {
     }
     await Bun.sleep(options.pollIntervalMs);
   }
-  const ciGate = evaluatePullRequestCiChecks(githubCheckRollup, repoName, prNumber);
+  const ciGate = evaluatePullRequestCiChecks(githubCheckRollup, repoName, prNumber, { mergeStateStatus: options.prState.mergeStateStatus });
   if (ciGate.verdict !== "APPROVE") {
     return {
       verdict: ciGate.verdict,
@@ -6246,7 +6305,7 @@ async function runGithubGreptileFallbackReviewForPr(options) {
     }
     await Bun.sleep(options.pollIntervalMs);
   }
-  const ciGate = evaluatePullRequestCiChecks(checkRollup, repoName, prNumber);
+  const ciGate = evaluatePullRequestCiChecks(checkRollup, repoName, prNumber, { mergeStateStatus: options.prState.mergeStateStatus });
   if (ciGate.verdict !== "APPROVE") {
     return {
       verdict: ciGate.verdict,
@@ -6601,19 +6660,31 @@ function loadGithubPullRequestCheckRollup(projectRoot, repoName, prNumber) {
   ]);
   return response.statusCheckRollup || [];
 }
-function evaluatePullRequestCiChecks(checks, repoName, prNumber) {
-  const nonGreptileChecks = checks.filter((check) => {
-    const label = (check.name || check.context || "").toLowerCase();
-    return label.length > 0 && !label.includes("greptile");
-  });
-  const pending = nonGreptileChecks.filter((check) => {
+function evaluatePullRequestCiChecks(checks, repoName, prNumber, options = {}) {
+  const isPendingCheck2 = (check) => {
     if ((check.__typename || "") === "CheckRun") {
       return (check.status || "").toUpperCase() !== "COMPLETED";
     }
     const state = (check.state || check.status || "").toUpperCase();
     return state === "PENDING" || state === "EXPECTED" || state === "QUEUED" || state === "IN_PROGRESS";
+  };
+  const pendingGreptile = checks.filter((check) => {
+    const label = (check.name || check.context || "").toLowerCase();
+    return label.includes("greptile") && isPendingCheck2(check);
   });
-  if (pending.length > 0) {
+  if (pendingGreptile.length > 0) {
+    return {
+      verdict: "SKIP",
+      reasons: pendingGreptile.map((check) => `[CI] ${repoName}#${prNumber} mandatory Greptile check is still pending: ${check.name || check.context || "unknown"}.`)
+    };
+  }
+  const nonGreptileChecks = checks.filter((check) => {
+    const label = (check.name || check.context || "").toLowerCase();
+    return label.length > 0 && !label.includes("greptile");
+  });
+  const pending = nonGreptileChecks.filter(isPendingCheck2);
+  const mergeClean = (options.mergeStateStatus || "").toUpperCase() === "CLEAN";
+  if (pending.length > 0 && !mergeClean) {
     return {
       verdict: "SKIP",
       reasons: pending.map((check) => `[CI] ${repoName}#${prNumber} check is still pending: ${check.name || check.context || "unknown"}.`)
@@ -6694,7 +6765,7 @@ function filterActionableGithubGreptileThreads(threads) {
 }
 function resolvePrRepoRoot(projectRoot, prState) {
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  if (prState.target === "monorepo" && runtimeWorkspace && existsSync18(resolve21(runtimeWorkspace, ".git"))) {
+  if (prState.target === "monorepo" && runtimeWorkspace && existsSync20(resolve22(runtimeWorkspace, ".git"))) {
     return runtimeWorkspace;
   }
   const paths = resolveHarnessPaths(projectRoot);
@@ -6762,40 +6833,40 @@ function taskArtifacts(projectRoot, taskId) {
     throw new Error("No active task.");
   }
   const paths = resolveHarnessPaths(projectRoot);
-  const artifactDir = resolve22(paths.artifactsDir, activeTask);
-  mkdirSync11(artifactDir, { recursive: true });
+  const artifactDir = resolve23(paths.artifactsDir, activeTask);
+  mkdirSync12(artifactDir, { recursive: true });
   const changed = changedFilesForTask(projectRoot, activeTask, true);
-  writeFileSync11(resolve22(artifactDir, "changed-files.txt"), `${changed.join(`
+  writeFileSync12(resolve23(artifactDir, "changed-files.txt"), `${changed.join(`
 `)}
 `, "utf-8");
   console.log(`changed-files.txt: ${changed.length} files`);
-  const taskResultPath = resolve22(artifactDir, "task-result.json");
-  if (!existsSync19(taskResultPath)) {
+  const taskResultPath = resolve23(artifactDir, "task-result.json");
+  if (!existsSync21(taskResultPath)) {
     const template = {
       task_id: activeTask,
       status: "completed",
       summary: "TODO: Write a one-line summary of what you did",
       completed_at: nowIso()
     };
-    writeFileSync11(taskResultPath, `${JSON.stringify(template, null, 2)}
+    writeFileSync12(taskResultPath, `${JSON.stringify(template, null, 2)}
 `, "utf-8");
     console.log("task-result.json: created (update the summary!)");
   } else {
     console.log("task-result.json: already exists");
   }
-  const decisionLogPath = resolve22(artifactDir, "decision-log.md");
-  if (!existsSync19(decisionLogPath)) {
+  const decisionLogPath = resolve23(artifactDir, "decision-log.md");
+  if (!existsSync21(decisionLogPath)) {
     const content = `# Decision Log: ${activeTask}
 
 Record key decisions here using: rig-agent record decision "..."
 `;
-    writeFileSync11(decisionLogPath, content, "utf-8");
+    writeFileSync12(decisionLogPath, content, "utf-8");
     console.log("decision-log.md: created (record your decisions!)");
   } else {
     console.log("decision-log.md: already exists");
   }
-  const nextActionsPath = resolve22(artifactDir, "next-actions.md");
-  if (!existsSync19(nextActionsPath)) {
+  const nextActionsPath = resolve23(artifactDir, "next-actions.md");
+  if (!existsSync21(nextActionsPath)) {
     const content = [
       `# Next Actions: ${activeTask}`,
       "",
@@ -6812,13 +6883,13 @@ Record key decisions here using: rig-agent record decision "..."
       ""
     ].join(`
 `);
-    writeFileSync11(nextActionsPath, content, "utf-8");
+    writeFileSync12(nextActionsPath, content, "utf-8");
     console.log("next-actions.md: created (add recommendations for downstream tasks!)");
   } else {
     console.log("next-actions.md: already exists");
   }
-  const validationSummaryPath = resolve22(artifactDir, "validation-summary.json");
-  if (existsSync19(validationSummaryPath)) {
+  const validationSummaryPath = resolve23(artifactDir, "validation-summary.json");
+  if (existsSync21(validationSummaryPath)) {
     console.log("validation-summary.json: already exists");
   } else {
     console.log("validation-summary.json: not yet created (run: rig-agent validate)");
@@ -6884,7 +6955,7 @@ function collectTaskChangedFiles(projectRoot, taskId, includeCommitted) {
     [projectRoot, ""],
     [monorepoRepoRoot, ""]
   ]) {
-    if (!existsSync19(resolve22(repo, ".git"))) {
+    if (!existsSync21(resolve23(repo, ".git"))) {
       continue;
     }
     if (includeCommitted && repo === monorepoRepoRoot) {
@@ -6909,12 +6980,22 @@ function filterTaskChangedFiles(projectRoot, taskId, files, scoped) {
 }
 function resolveTaskMonorepoRoot(projectRoot) {
   const runtimeWorkspace = loadRuntimeContextFromEnv()?.workspaceDir || process.env.RIG_TASK_WORKSPACE?.trim();
-  if (runtimeWorkspace && existsSync19(resolve22(runtimeWorkspace, ".git"))) {
-    return resolve22(runtimeWorkspace);
+  if (runtimeWorkspace && existsSync21(resolve23(runtimeWorkspace, ".git"))) {
+    return resolve23(runtimeWorkspace);
   }
   return resolveHarnessPaths(projectRoot).monorepoRoot;
 }
 function collectCommittedMonorepoFiles(projectRoot, repo) {
+  const defaultRef = runCapture(["git", "-C", repo, "rev-parse", "--abbrev-ref", "origin/HEAD"], projectRoot);
+  if (defaultRef.exitCode === 0 && defaultRef.stdout.trim()) {
+    const mergeBase = runCapture(["git", "-C", repo, "merge-base", "HEAD", defaultRef.stdout.trim()], projectRoot);
+    if (mergeBase.exitCode === 0 && mergeBase.stdout.trim()) {
+      const result = runCapture(["git", "-C", repo, "diff", "--name-only", `${mergeBase.stdout.trim()}..HEAD`], projectRoot);
+      if (result.exitCode === 0) {
+        return result.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+      }
+    }
+  }
   const initialHeadCommit = resolveRuntimeInitialHeadCommit(projectRoot, repo);
   if (initialHeadCommit) {
     const result = runCapture(["git", "-C", repo, "diff", "--name-only", `${initialHeadCommit}..HEAD`], projectRoot);
@@ -6938,7 +7019,7 @@ function resolveRuntimeInitialHeadCommit(projectRoot, repo) {
   const runtimeContext = loadRuntimeContextFromEnv();
   if (runtimeContext?.initialHeadCommits?.monorepo?.trim()) {
     const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
-    if (resolve22(monorepoRoot) === resolve22(repo)) {
+    if (resolve23(monorepoRoot) === resolve23(repo)) {
       return runtimeContext.initialHeadCommits.monorepo.trim();
     }
   }
@@ -6948,7 +7029,7 @@ function resolveMonorepoBaseCommit(projectRoot, repo) {
   const runtimeContext = loadRuntimeContextFromEnv();
   if (runtimeContext?.monorepoBaseCommit?.trim()) {
     const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
-    if (resolve22(monorepoRoot) === resolve22(repo)) {
+    if (resolve23(monorepoRoot) === resolve23(repo)) {
       return runtimeContext.monorepoBaseCommit.trim();
     }
   }
@@ -6993,7 +7074,7 @@ function resolveRuntimeDirtyBaseline(projectRoot, repo) {
     return new Set;
   }
   const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
-  const selected = resolve22(repo) === resolve22(monorepoRoot) ? dirtyFiles.monorepo : resolve22(repo) === resolve22(projectRoot) ? dirtyFiles.project : undefined;
+  const selected = resolve23(repo) === resolve23(monorepoRoot) ? dirtyFiles.monorepo : resolve23(repo) === resolve23(projectRoot) ? dirtyFiles.project : undefined;
   return new Set((selected || []).map((file) => normalizeChangedFilePath(file)).filter(Boolean));
 }
 function normalizeChangedFilePath(file) {
@@ -7051,8 +7132,8 @@ function isRuntimeGatewayGhPath(candidate) {
 }
 function resolveOptionalMonorepoRoot(projectRoot) {
   const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
-  if (runtimeWorkspace && existsSync20(resolve23(runtimeWorkspace, ".git"))) {
-    return resolve23(runtimeWorkspace);
+  if (runtimeWorkspace && existsSync22(resolve24(runtimeWorkspace, ".git"))) {
+    return resolve24(runtimeWorkspace);
   }
   try {
     return resolveMonorepoRoot2(projectRoot);
@@ -7077,7 +7158,7 @@ function resolveGitBinary(projectRoot) {
     if (!candidate || isRuntimeGatewayGitPath(candidate)) {
       continue;
     }
-    if (existsSync20(candidate)) {
+    if (existsSync22(candidate)) {
       return candidate;
     }
   }
@@ -7104,7 +7185,7 @@ function gitSyncBranch(projectRoot, taskId, targetRepo = "monorepo") {
   }
   const repoRoot = targetRepo === "monorepo" ? resolveOptionalMonorepoRoot(projectRoot) || resolveMonorepoRoot2(projectRoot) : projectRoot;
   const repoLabel = targetRepo === "monorepo" ? "Monorepo" : "Project";
-  if (!existsSync20(resolve23(repoRoot, ".git"))) {
+  if (!existsSync22(resolve24(repoRoot, ".git"))) {
     throw new Error(`${repoLabel} repo not found at ${repoRoot}`);
   }
   const branchId = resolveTaskBranchId(projectRoot, resolvedTask);
@@ -7164,7 +7245,7 @@ function gitOpenPr(options) {
   } else if (taskId) {
     gitSyncBranch(options.projectRoot, taskId, "project");
   }
-  if (!existsSync20(resolve23(repoRoot, ".git"))) {
+  if (!existsSync22(resolve24(repoRoot, ".git"))) {
     throw new Error(`Repository not available for open-pr target ${target}: ${repoRoot}`);
   }
   const branch = branchName(options.projectRoot, repoRoot);
@@ -7397,7 +7478,7 @@ function gitMergePr(options) {
   }
   const repoRoot = resolveRepoRoot(options.projectRoot, options.pr.target);
   const repoNameWithOwner = resolveRepoNameWithOwner(options.projectRoot, repoRoot);
-  if (!existsSync20(resolve23(repoRoot, ".git"))) {
+  if (!existsSync22(resolve24(repoRoot, ".git"))) {
     throw new Error(`Repository not available for merge-pr target ${options.pr.target}: ${repoRoot}`);
   }
   const prState = readPrViewState(gh, repoRoot, repoNameWithOwner, options.pr.url);
@@ -7458,12 +7539,12 @@ function assertPrHasNoGitConflicts(prState, repoLabel, baseRef) {
 }
 function writePrMetadata(projectRoot, taskId, result) {
   const dir = artifactDirForId(projectRoot, taskId);
-  mkdirSync12(dir, { recursive: true });
-  const path = resolve23(dir, "pr-state.json");
+  mkdirSync13(dir, { recursive: true });
+  const path = resolve24(dir, "pr-state.json");
   let prs = {};
-  if (existsSync20(path)) {
+  if (existsSync22(path)) {
     try {
-      const parsed = JSON.parse(readFileSync12(path, "utf-8"));
+      const parsed = JSON.parse(readFileSync13(path, "utf-8"));
       if (parsed && typeof parsed === "object" && parsed.prs && typeof parsed.prs === "object") {
         prs = parsed.prs;
       }
@@ -7479,16 +7560,16 @@ function writePrMetadata(projectRoot, taskId, result) {
     ...primary || {},
     updated_at: nowIso()
   };
-  writeFileSync12(path, `${JSON.stringify(artifact, null, 2)}
+  writeFileSync13(path, `${JSON.stringify(artifact, null, 2)}
 `, "utf-8");
 }
 function readPrMetadata(projectRoot, taskId) {
-  const path = resolve23(artifactDirForId(projectRoot, taskId), "pr-state.json");
-  if (!existsSync20(path)) {
+  const path = resolve24(artifactDirForId(projectRoot, taskId), "pr-state.json");
+  if (!existsSync22(path)) {
     return [];
   }
   try {
-    const parsed = JSON.parse(readFileSync12(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync13(path, "utf-8"));
     if (!parsed || typeof parsed !== "object") {
       return [];
     }
@@ -7560,14 +7641,14 @@ function resolveGithubCliBinary(projectRoot) {
   }
   const explicitPathEntries = (process.env.PATH || "").split(":").map((entry) => entry.trim()).filter(Boolean);
   for (const entry of explicitPathEntries) {
-    candidates.add(resolve23(entry, "gh"));
+    candidates.add(resolve24(entry, "gh"));
   }
   const bunResolved = Bun.which("gh");
   if (bunResolved) {
     candidates.add(bunResolved);
   }
   for (const candidate of candidates) {
-    if (candidate && existsSync20(candidate) && !isRuntimeGatewayGhPath(candidate)) {
+    if (candidate && existsSync22(candidate) && !isRuntimeGatewayGhPath(candidate)) {
       return candidate;
     }
   }
@@ -7597,7 +7678,7 @@ function resolveRepoNameWithOwner(projectRoot, repoRoot) {
   return resolveGithubRepoNameWithOwnerFromGitRoot(projectRoot, repoRoot, repoRoot, visited);
 }
 function resolveGithubRepoNameWithOwnerFromGitRoot(projectRoot, gitRoot, cwd, visited) {
-  const normalizedGitRoot = resolve23(gitRoot);
+  const normalizedGitRoot = resolve24(gitRoot);
   if (visited.has(normalizedGitRoot)) {
     return "";
   }
@@ -7669,7 +7750,7 @@ function resolveNetworkRemoteName(projectRoot, repoRoot, repoNameWithOwner) {
   return remotes.includes("origin") ? "origin" : remotes[0];
 }
 function gitQuery(projectRoot, gitRoot, cwd, ...args) {
-  const gitArgs = existsSync20(resolve23(gitRoot, ".git")) ? gitCmd(projectRoot, gitRoot, ...args) : [resolveGitBinary(projectRoot), "--git-dir", gitRoot, ...args];
+  const gitArgs = existsSync22(resolve24(gitRoot, ".git")) ? gitCmd(projectRoot, gitRoot, ...args) : [resolveGitBinary(projectRoot), "--git-dir", gitRoot, ...args];
   return runCapture2(gitArgs, cwd, projectRoot);
 }
 function resolveLocalGitRemoteRoot(remoteUrl, gitRoot) {
@@ -7687,9 +7768,9 @@ function resolveLocalGitRemoteRoot(remoteUrl, gitRoot) {
   } else if (/^[a-z][a-z0-9+.-]*:\/\//i.test(normalized) || /^[^@]+@[^:]+:.+$/.test(normalized)) {
     return "";
   } else if (!isAbsolute2(normalized)) {
-    candidate = resolve23(gitRoot, normalized);
+    candidate = resolve24(gitRoot, normalized);
   }
-  return existsSync20(candidate) ? candidate : "";
+  return existsSync22(candidate) ? candidate : "";
 }
 function normalizeGithubRepoNameWithOwner(value) {
   const normalized = value.trim();
@@ -7816,7 +7897,7 @@ function inferReviewerFromChangedFiles(projectRoot, repoRoot, baseRef, branchRef
   return best;
 }
 function commitRepo(projectRoot, repo, label, message, allowEmpty, scoped, files, changedFilesManifest) {
-  if (!existsSync20(resolve23(repo, ".git"))) {
+  if (!existsSync22(resolve24(repo, ".git"))) {
     console.log(`Skipping ${label}: repo not available (${repo})`);
     return;
   }
@@ -7848,18 +7929,18 @@ function commitRepo(projectRoot, repo, label, message, allowEmpty, scoped, files
   console.log(`Committed ${label}: ${message}`);
 }
 function readChangedFilesManifest(projectRoot, taskId) {
-  const manifestPath = resolve23(artifactDirForId(projectRoot, taskId), "changed-files.txt");
-  if (!existsSync20(manifestPath)) {
+  const manifestPath = resolve24(artifactDirForId(projectRoot, taskId), "changed-files.txt");
+  if (!existsSync22(manifestPath)) {
     return [];
   }
-  const files = readFileSync12(manifestPath, "utf-8").split(/\r?\n/).map((line) => normalizeChangedFilePath2(line)).filter(Boolean);
+  const files = readFileSync13(manifestPath, "utf-8").split(/\r?\n/).map((line) => normalizeChangedFilePath2(line)).filter(Boolean);
   return [...new Set(files)];
 }
 function refreshChangedFilesManifest(projectRoot, taskId) {
-  const manifestPath = resolve23(artifactDirForId(projectRoot, taskId), "changed-files.txt");
-  mkdirSync12(dirname10(manifestPath), { recursive: true });
+  const manifestPath = resolve24(artifactDirForId(projectRoot, taskId), "changed-files.txt");
+  mkdirSync13(dirname11(manifestPath), { recursive: true });
   const changedFiles = changedFilesForTask(projectRoot, taskId, true);
-  writeFileSync12(manifestPath, `${changedFiles.join(`
+  writeFileSync13(manifestPath, `${changedFiles.join(`
 `)}
 `, "utf-8");
   return manifestPath;
@@ -7972,7 +8053,7 @@ function repoHasPathChange(projectRoot, repoRoot, relativePath) {
   return result.exitCode === 0 && result.stdout.trim().length > 0;
 }
 function stageExcludePathspecs(repoRoot) {
-  const patterns = existsSync20(resolve23(repoRoot, ".rig", "task-config.json")) ? [...TASK_RUNTIME_STAGE_EXCLUDES, ...GENERATED_STAGE_EXCLUDES] : [".rig/**", ...GENERATED_STAGE_EXCLUDES];
+  const patterns = existsSync22(resolve24(repoRoot, ".rig", "task-config.json")) ? [...TASK_RUNTIME_STAGE_EXCLUDES, ...GENERATED_STAGE_EXCLUDES] : [".rig/**", ...GENERATED_STAGE_EXCLUDES];
   return patterns.map((pattern) => `:(glob,exclude)${pattern}`);
 }
 function pathResolvesBeyondSymlink(repoRoot, relativePath) {
@@ -7982,7 +8063,7 @@ function pathResolvesBeyondSymlink(repoRoot, relativePath) {
   }
   let current = repoRoot;
   for (let index = 0;index < parts.length - 1; index += 1) {
-    current = resolve23(current, parts[index]);
+    current = resolve24(current, parts[index]);
     try {
       if (lstatSync(current).isSymbolicLink()) {
         return true;
@@ -8016,7 +8097,7 @@ function resolveTaskBranchId(projectRoot, taskId) {
     }
   } catch {}
   const artifactDir = artifactDirForId(projectRoot, taskId);
-  if (existsSync20(artifactDir)) {
+  if (existsSync22(artifactDir)) {
     return taskId;
   }
   throw new Error(`Unknown task id: ${taskId}`);
@@ -8052,11 +8133,11 @@ function runCapture2(command, cwd, projectRoot = cwd) {
 }
 function runtimeGitEnv(projectRoot) {
   const { ctx, runtimeRoot } = resolveRuntimeMetadata(projectRoot);
-  const runtimeHome = runtimeRoot ? resolve23(runtimeRoot, "home") : "";
-  const runtimeTmp = runtimeRoot ? resolve23(runtimeRoot, "tmp") : "";
-  const runtimeCache = runtimeRoot ? resolve23(runtimeRoot, "cache") : "";
-  const runtimeKnownHosts = runtimeHome ? resolve23(runtimeHome, ".ssh", "known_hosts") : "";
-  const runtimeKey = runtimeHome ? resolve23(runtimeHome, ".ssh", "rig-agent-key") : "";
+  const runtimeHome = runtimeRoot ? resolve24(runtimeRoot, "home") : "";
+  const runtimeTmp = runtimeRoot ? resolve24(runtimeRoot, "tmp") : "";
+  const runtimeCache = runtimeRoot ? resolve24(runtimeRoot, "cache") : "";
+  const runtimeKnownHosts = runtimeHome ? resolve24(runtimeHome, ".ssh", "known_hosts") : "";
+  const runtimeKey = runtimeHome ? resolve24(runtimeHome, ".ssh", "rig-agent-key") : "";
   const env = {};
   if (ctx?.workspaceDir) {
     env.PROJECT_RIG_ROOT = projectRoot;
@@ -8069,14 +8150,14 @@ function runtimeGitEnv(projectRoot) {
   if (runtimeRoot) {
     env.RIG_RUNTIME_HOME = runtimeRoot;
   }
-  if (runtimeHome && existsSync20(runtimeHome)) {
+  if (runtimeHome && existsSync22(runtimeHome)) {
     env.HOME = runtimeHome;
     env.OPENSSL_CONF = ensureRuntimeOpenSslConfig(runtimeHome);
   }
-  if (runtimeTmp && existsSync20(runtimeTmp)) {
+  if (runtimeTmp && existsSync22(runtimeTmp)) {
     env.TMPDIR = runtimeTmp;
   }
-  if (runtimeCache && existsSync20(runtimeCache)) {
+  if (runtimeCache && existsSync22(runtimeCache)) {
     env.XDG_CACHE_HOME = runtimeCache;
   }
   const workspaceSecrets = loadDotEnvSecrets(ctx?.workspaceDir || projectRoot, process.env);
@@ -8120,14 +8201,14 @@ function runtimeGitEnv(projectRoot) {
     env.GH_TOKEN = env.GH_TOKEN || gitHubToken;
     applyGitHubCredentialHelperEnv(env);
   }
-  if (runtimeKnownHosts && existsSync20(runtimeKnownHosts)) {
+  if (runtimeKnownHosts && existsSync22(runtimeKnownHosts)) {
     const sshParts = [
       "ssh",
       `-o UserKnownHostsFile="${runtimeKnownHosts}"`,
       "-o StrictHostKeyChecking=yes",
       "-F /dev/null"
     ];
-    if (runtimeKey && existsSync20(runtimeKey)) {
+    if (runtimeKey && existsSync22(runtimeKey)) {
       sshParts.splice(1, 0, `-i "${runtimeKey}"`, "-o IdentitiesOnly=yes");
     }
     env.GIT_SSH_COMMAND = sshParts.join(" ");
@@ -8148,12 +8229,12 @@ function loadPersistedRuntimeSecrets(runtimeRoot) {
   if (!runtimeRoot) {
     return {};
   }
-  const path = resolve23(runtimeRoot, "runtime-secrets.json");
-  if (!existsSync20(path)) {
+  const path = resolve24(runtimeRoot, "runtime-secrets.json");
+  if (!existsSync22(path)) {
     return {};
   }
   try {
-    const parsed = JSON.parse(readFileSync12(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync13(path, "utf-8"));
     const entries = Object.entries(parsed).filter((entry) => typeof entry[1] === "string");
     return Object.fromEntries(entries);
   } catch {
@@ -8161,13 +8242,13 @@ function loadPersistedRuntimeSecrets(runtimeRoot) {
   }
 }
 function ensureRuntimeOpenSslConfig(runtimeHome) {
-  const sslDir = resolve23(runtimeHome, ".ssl");
-  const sslConfig = resolve23(sslDir, "openssl.cnf");
-  if (!existsSync20(sslDir)) {
-    mkdirSync12(sslDir, { recursive: true });
+  const sslDir = resolve24(runtimeHome, ".ssl");
+  const sslConfig = resolve24(sslDir, "openssl.cnf");
+  if (!existsSync22(sslDir)) {
+    mkdirSync13(sslDir, { recursive: true });
   }
-  if (!existsSync20(sslConfig)) {
-    writeFileSync12(sslConfig, `# Rig runtime OpenSSL config placeholder
+  if (!existsSync22(sslConfig)) {
+    writeFileSync13(sslConfig, `# Rig runtime OpenSSL config placeholder
 `);
   }
   return sslConfig;
@@ -8185,29 +8266,29 @@ function resolveRuntimeMetadata(projectRoot) {
   if (contextFile) {
     return {
       ctx,
-      runtimeRoot: dirname10(resolve23(contextFile))
+      runtimeRoot: dirname11(resolve24(contextFile))
     };
   }
   const inferredContextFile = findRuntimeContextFile2(projectRoot);
-  if (existsSync20(inferredContextFile)) {
+  if (existsSync22(inferredContextFile)) {
     try {
       ctx = loadRuntimeContext(inferredContextFile);
     } catch {}
     return {
       ctx,
-      runtimeRoot: dirname10(inferredContextFile)
+      runtimeRoot: dirname11(inferredContextFile)
     };
   }
   return { ctx, runtimeRoot: "" };
 }
 function findRuntimeContextFile2(startPath) {
-  let current = resolve23(startPath);
+  let current = resolve24(startPath);
   while (true) {
-    const candidate = resolve23(current, "runtime-context.json");
-    if (existsSync20(candidate)) {
+    const candidate = resolve24(current, "runtime-context.json");
+    if (existsSync22(candidate)) {
       return candidate;
     }
-    const parent = dirname10(current);
+    const parent = dirname11(current);
     if (parent === current) {
       return "";
     }
@@ -8443,9 +8524,9 @@ async function main() {
     console.log(`
 [post] Auto-merge: skipped (not in policy completion.checks)`);
   }
-  const artifactDir = resolve24(paths.artifactsDir, taskId);
-  mkdirSync13(artifactDir, { recursive: true });
-  writeFileSync13(resolve24(artifactDir, "review-status.txt"), failed ? `REJECTED
+  const artifactDir = resolve25(paths.artifactsDir, taskId);
+  mkdirSync14(artifactDir, { recursive: true });
+  writeFileSync14(resolve25(artifactDir, "review-status.txt"), failed ? `REJECTED
 ` : `APPROVED
 `, "utf-8");
   if (!failed) {
@@ -8492,8 +8573,8 @@ async function runBunTool(args, cwd) {
   };
 }
 async function runProtoQualityGate(monorepoRoot) {
-  const protosDir = resolve24(monorepoRoot, "packages", "protos");
-  if (!existsSync21(protosDir)) {
+  const protosDir = resolve25(monorepoRoot, "packages", "protos");
+  if (!existsSync23(protosDir)) {
     console.log(`FAIL: Proto workspace not found at ${protosDir}`);
     return false;
   }
@@ -8541,12 +8622,12 @@ async function runProtoQualityGate(monorepoRoot) {
   } else {
     console.log("OK: Generated TypeScript compiles");
   }
-  const workflowPath = resolve24(monorepoRoot, ".github", "workflows", "pull-request-gate.yml");
-  if (!existsSync21(workflowPath)) {
+  const workflowPath = resolve25(monorepoRoot, ".github", "workflows", "pull-request-gate.yml");
+  if (!existsSync23(workflowPath)) {
     console.log(`FAIL: Missing workflow gate file at ${workflowPath}`);
     ok = false;
   } else {
-    const workflow = readFileSync13(workflowPath, "utf-8");
+    const workflow = readFileSync14(workflowPath, "utf-8");
     if (workflow.includes("if: false && needs.detect.outputs.protos_changed == 'true'")) {
       console.log("FAIL: Proto quality CI gate is disabled in pull-request-gate.yml");
       ok = false;
@@ -8575,7 +8656,7 @@ function repoHasPublishedTaskBranch(projectRoot, repoRoot, taskId) {
   return runCapture(["git", "-C", repoRoot, "ls-remote", "--exit-code", "origin", `refs/heads/${branchRef}`], projectRoot).exitCode === 0;
 }
 async function readJsonFileIfPresent(path) {
-  if (!existsSync21(path)) {
+  if (!existsSync23(path)) {
     return null;
   }
   try {
@@ -8586,9 +8667,9 @@ async function readJsonFileIfPresent(path) {
 }
 async function recordVerifierFailure(projectRoot, taskId, paths) {
   const failedApproachesPath = paths.failedApproachesPath;
-  const artifactDir = resolve24(paths.artifactsDir, taskId);
-  const reviewStatePath = resolve24(artifactDir, "review-state.json");
-  const reviewFeedbackPath = resolve24(artifactDir, "review-feedback.md");
+  const artifactDir = resolve25(paths.artifactsDir, taskId);
+  const reviewStatePath = resolve25(artifactDir, "review-state.json");
+  const reviewFeedbackPath = resolve25(artifactDir, "review-feedback.md");
   let summary = "Verifier rejected completion. Read review-feedback.md for required fixes.";
   const parsedReviewState = await readJsonFileIfPresent(reviewStatePath);
   if (parsedReviewState) {
@@ -8598,12 +8679,12 @@ async function recordVerifierFailure(projectRoot, taskId, paths) {
     }
   }
   let attempts = 1;
-  if (existsSync21(failedApproachesPath)) {
-    const content = readFileSync13(failedApproachesPath, "utf-8");
+  if (existsSync23(failedApproachesPath)) {
+    const content = readFileSync14(failedApproachesPath, "utf-8");
     attempts = (content.match(new RegExp(`^## ${escapeRegExp2(taskId)}\\b`, "gm")) || []).length + 1;
   } else {
-    mkdirSync13(resolve24(failedApproachesPath, ".."), { recursive: true });
-    writeFileSync13(failedApproachesPath, `# Failed Approaches
+    mkdirSync14(resolve25(failedApproachesPath, ".."), { recursive: true });
+    writeFileSync14(failedApproachesPath, `# Failed Approaches
 
 `, "utf-8");
   }
@@ -8641,8 +8722,8 @@ async function recordTaskRepoCommits(projectRoot, taskId, paths) {
       recorded_at: new Date().toISOString(),
       repos
     };
-    mkdirSync13(resolve24(statePath, ".."), { recursive: true });
-    writeFileSync13(statePath, `${JSON.stringify(state, null, 2)}
+    mkdirSync14(resolve25(statePath, ".."), { recursive: true });
+    writeFileSync14(statePath, `${JSON.stringify(state, null, 2)}
 `, "utf-8");
   }
 }