@h-rig/standard-plugin 0.0.6-alpha.142 → 0.0.6-alpha.144

package/dist/src/index.js

@@ -1,1488 +1,1630 @@
 // @bun
-// packages/standard-plugin/src/plugin.ts
-import { resolve as resolve4 } from "path";
-import { definePlugin } from "@rig/core";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
-// packages/standard-plugin/src/github-issues-source.ts
-import { spawnSync } from "child_process";
-import { existsSync, readFileSync } from "fs";
-import { resolve } from "path";
-function cleanToken(value) {
-  const trimmed = value?.trim() ?? "";
-  return trimmed.length > 0 ? trimmed : null;
-}
-function createEnvGitHubCredentialProvider() {
-  return {
-    async resolveGitHubToken(input) {
-      if (input.purpose === "selected-repo") {
-        return { token: cleanToken(process.env.RIG_GITHUB_SELECTED_TOKEN ?? process.env.RIG_GITHUB_TOKEN ?? null) ?? "", source: "signed-in-user" };
-      }
-      const token = cleanToken(process.env.RIG_GITHUB_TOKEN ?? process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN ?? null);
-      if (!token) {
-        throw new Error("No host GitHub token is configured for admin fallback.");
-      }
-      return { token, source: "host-admin-fallback" };
-    }
-  };
-}
-function createStateGitHubCredentialProvider(options = {}) {
-  const stateFileCandidates = () => {
-    const candidates = [];
-    const explicitFile = options.stateFile ?? process.env.RIG_GITHUB_AUTH_STATE_FILE;
-    if (explicitFile?.trim())
-      candidates.push(resolve(explicitFile.trim()));
-    for (const dir of [options.stateDir, process.env.RIG_STATE_DIR]) {
-      if (dir?.trim())
-        candidates.push(resolve(dir.trim(), "github-auth.json"));
-    }
-    return candidates;
-  };
-  const readToken = () => {
-    for (const stateFile of stateFileCandidates()) {
-      if (!existsSync(stateFile))
-        continue;
-      try {
-        const parsed = JSON.parse(readFileSync(stateFile, "utf8"));
-        const token = typeof parsed.token === "string" ? cleanToken(parsed.token) : null;
-        if (token)
-          return token;
-      } catch {}
-    }
-    return null;
+// packages/standard-plugin/src/drift/metadata.ts
+import { Schema } from "effect";
+import { StageMutation as StageMutationSchema } from "@rig/contracts";
+var DOCS_DRIFT_VALIDATOR_ID = "std:docs-drift", DOCS_DRIFT_CLI_ID = "std:drift", DOCS_DRIFT_STAGE_ID = "docs-drift", DOCS_DRIFT_CAPABILITY_ID = "std:docs-drift-capability", DOCS_DRIFT_VALIDATOR, DOCS_DRIFT_STAGE_MUTATION, DOCS_DRIFT_CLI_COMMAND = "rig drift [--docs <csv>] [--ignore <csv>] [--fail-on-drift] [--json]";
+var init_metadata = __esm(() => {
+  DOCS_DRIFT_VALIDATOR = {
+    id: DOCS_DRIFT_VALIDATOR_ID,
+    category: "regression",
+    description: "Detect documentation references that drifted from the source tree."
   };
-  return {
-    async resolveGitHubToken(input) {
-      const token = readToken();
-      if (input.purpose === "selected-repo") {
-        return { token: token ?? cleanToken(process.env.RIG_GITHUB_SELECTED_TOKEN ?? process.env.RIG_GITHUB_TOKEN ?? null) ?? "", source: "signed-in-user" };
-      }
-      if (token) {
-        return { token, source: "signed-in-user" };
-      }
-      const fallback = cleanToken(process.env.RIG_GITHUB_TOKEN ?? process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN ?? null);
-      if (!fallback) {
-        throw new Error("No signed-in GitHub token is stored for Rig and no host admin fallback token is configured.");
-      }
-      return { token: fallback, source: "host-admin-fallback" };
+  DOCS_DRIFT_STAGE_MUTATION = Schema.decodeUnknownSync(StageMutationSchema)({
+    op: "insert",
+    stage: {
+      id: DOCS_DRIFT_STAGE_ID,
+      kind: "gate",
+      before: ["merge-gate"],
+      after: ["open-pr"]
+    },
+    contributedBy: DOCS_DRIFT_STAGE_ID
+  });
+});
+
+// packages/standard-plugin/src/drift/extract-refs.ts
+function stripFenceLines(markdown) {
+  const lines = markdown.split(/\r?\n/);
+  let fenced = false;
+  return lines.map((line) => {
+    if (/^\s*(```|~~~)/.test(line)) {
+      fenced = !fenced;
+      return "";
     }
-  };
+    return fenced ? "" : line;
+  });
 }
-var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
-var RIG_STATUS_COMMENT_MARKER = "<!-- rig:status-comment -->";
-var RIG_METADATA_START = "<!-- rig:metadata:start -->";
-var RIG_METADATA_END = "<!-- rig:metadata:end -->";
-var RIG_STATUS_LABELS = new Set(["rig:running", "rig:pr-open", "rig:ci-fixing", "rig:merging", "rig:done", "rig:needs-attention"]);
-var DEFAULT_GH_TIMEOUT_MS = 15000;
-var DEFAULT_GITHUB_ISSUE_LIST_LIMIT = 1000;
-function statusFor(issue) {
-  const state = (issue.state ?? "").toUpperCase();
-  if (state === "CLOSED")
-    return "closed";
-  const labelNames = labelNamesFor(issue);
-  if (labelNames.includes("in-progress"))
-    return "in_progress";
-  if (labelNames.includes("blocked"))
-    return "blocked";
-  if (labelNames.includes("ready"))
-    return "ready";
-  if (labelNames.includes("under-review"))
-    return "under_review";
-  if (labelNames.includes("failed"))
-    return "failed";
-  if (labelNames.includes("cancelled"))
-    return "cancelled";
-  return "open";
+function normalizeToken(raw) {
+  return raw.trim().replace(/^['"]|['"]$/g, "").replace(/[),.;:]+$/g, "").replace(/#L\d+(?:-L\d+)?$/i, "");
 }
-function parseIssueRefs(raw) {
-  return raw.split(",").map((s) => s.trim()).map((s) => s.replace(/^#/, "").match(/^(\d+)/)?.[1] ?? "").filter((s) => s.length > 0);
+function classifyReference(raw) {
+  if (raw.startsWith("@"))
+    return null;
+  if (PATH_REF.test(raw))
+    return "path";
+  if (SYMBOL_REF.test(raw))
+    return "symbol";
+  return null;
 }
-function parseMetadataList(body, key) {
-  const block = body.match(/<!-- rig:metadata:start -->\s*([\s\S]*?)\s*<!-- rig:metadata:end -->/);
-  if (!block)
-    return [];
-  const lines = block[1].split(/\r?\n/);
-  const values = [];
-  for (let index = 0;index < lines.length; index += 1) {
-    const line = lines[index];
-    const sameLine = line.match(new RegExp(`^${key}:\\s*(.+)$`, "i"));
-    if (sameLine) {
-      values.push(...parseIssueRefs(sameLine[1]));
-      continue;
+function pushReference(refs, seen, raw, line) {
+  const value = normalizeToken(raw);
+  if (!value)
+    return;
+  const kind = classifyReference(value);
+  if (!kind)
+    return;
+  const key = `${kind}:${value}:${line}`;
+  if (seen.has(key))
+    return;
+  seen.add(key);
+  refs.push({ kind, value, line });
+}
+function extractDriftReferences(markdown) {
+  const refs = [];
+  const seen = new Set;
+  const lines = stripFenceLines(markdown);
+  for (const [index, line] of lines.entries()) {
+    const lineNumber = index + 1;
+    for (const match of line.matchAll(INLINE_CODE)) {
+      pushReference(refs, seen, match[1] ?? "", lineNumber);
     }
-    if (!new RegExp(`^${key}:\\s*$`, "i").test(line))
-      continue;
-    for (let cursor = index + 1;cursor < lines.length; cursor += 1) {
-      const item = lines[cursor].match(/^\s*-\s*(.+)$/);
-      if (!item)
-        break;
-      values.push(...parseIssueRefs(item[1]));
+    for (const match of line.matchAll(MARKDOWN_LINK)) {
+      pushReference(refs, seen, match[1] ?? "", lineNumber);
     }
   }
-  return [...new Set(values)];
-}
-function parseDeps(body) {
-  const match = body.match(/^depends-on:\s*([^\n]+)/im);
-  const bodyRefs = match ? parseIssueRefs(match[1]) : [];
-  return [...new Set([...bodyRefs, ...parseMetadataList(body, "depends-on")])];
+  return refs;
 }
-function parseParents(body) {
-  const match = body.match(/^parents?:\s*([^\n]+)/im);
-  const bodyRefs = match ? parseIssueRefs(match[1]) : [];
-  return [...new Set([...bodyRefs, ...parseMetadataList(body, "parents")])];
+var INLINE_CODE, MARKDOWN_LINK, SYMBOL_REF, PATH_REF;
+var init_extract_refs = __esm(() => {
+  INLINE_CODE = /`([^`\n]+)`/g;
+  MARKDOWN_LINK = /\[[^\]]+\]\(([^)\s]+)\)/g;
+  SYMBOL_REF = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)?$/;
+  PATH_REF = /^(?:\.\.?\/)?(?:[A-Za-z0-9_.-]+\/)+[A-Za-z0-9_.-]+$|^[A-Za-z0-9_.-]+\.(?:ts|tsx|js|jsx|mjs|cjs|json|md|mdx|css|scss|html|yml|yaml|toml|rs|go|py|rb|java|kt|swift|c|cc|cpp|h|hpp)$/;
+});
+
+// packages/standard-plugin/src/drift/git-adapter.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+function processError(value) {
+  return value && typeof value === "object" ? value : null;
 }
-function issueTypeFor(issue) {
-  const labels = labelNamesFor(issue);
-  const typed = labels.find((l) => l.startsWith("type:"));
-  if (typed)
-    return typed.slice("type:".length);
-  if (labels.includes("epic"))
-    return "epic";
-  return "task";
+function lineCount(output) {
+  const trimmed = output.trim();
+  return trimmed ? trimmed.split(/\r?\n/).length : 0;
 }
-function issueToTask(issue, repo, nativeDependencies) {
-  const labelNames = labelNamesFor(issue);
-  const scope = labelNames.filter((l) => l.startsWith("scope:")).map((l) => l.slice("scope:".length));
-  const roleLabel = labelNames.find((l) => l.startsWith("role:"));
-  const role = roleLabel ? roleLabel.slice("role:".length) : undefined;
-  const validators = labelNames.filter((l) => l.startsWith("validator:")).map((l) => l.slice("validator:".length));
-  const body = issue.body ?? "";
-  const issueNodeId = issue.id ?? issue.nodeId ?? issue.node_id;
-  const parsedDeps = parseDeps(body);
-  const deps = nativeDependencies?.deps ? [...new Set([...parsedDeps, ...nativeDependencies.deps])] : parsedDeps;
+function makeDriftGit(projectRoot) {
+  async function git(args) {
+    const result = await execFileAsync("git", [...args], {
+      cwd: projectRoot,
+      encoding: "utf8",
+      maxBuffer: 10 * 1024 * 1024
+    });
+    return String(result.stdout);
+  }
+  async function grepCountAt(symbolOrPath, commit) {
+    try {
+      return lineCount(await git(["grep", "-F", "-n", "-e", symbolOrPath, commit, "--"]));
+    } catch (error) {
+      const detail = processError(error);
+      if (detail?.code === 1)
+        return 0;
+      throw error;
+    }
+  }
   return {
-    id: String(issue.number),
-    ...typeof issueNodeId === "string" && issueNodeId.trim() ? { issueNodeId: issueNodeId.trim() } : {},
-    deps,
-    status: statusFor(issue),
-    title: issue.title,
-    body,
-    scope,
-    role,
-    validators,
-    url: issue.url ?? issue.html_url,
-    issueType: issueTypeFor(issue),
-    sourceIssueId: `${repo}#${issue.number}`,
-    parentChildDeps: parseParents(body),
-    labels: labelNames,
-    ...nativeDependencies?.degraded ? { nativeDependenciesDegraded: true, nativeDependenciesError: nativeDependencies.degraded } : {},
-    raw: issue
+    async lastCommitTouching(path) {
+      const commit = (await git(["log", "-n", "1", "--format=%H", "--", path])).trim();
+      return commit || "HEAD";
+    },
+    async grepCount(symbolOrPath) {
+      return grepCountAt(symbolOrPath, "HEAD");
+    },
+    async grepCountAtCommit(symbolOrPath, commit) {
+      return grepCountAt(symbolOrPath, commit);
+    },
+    async wasRenamed(symbolOrPath, sinceCommit) {
+      if (!symbolOrPath.includes("/") && !symbolOrPath.includes("."))
+        return false;
+      try {
+        const output = await git(["log", "--name-status", "--format=", `${sinceCommit}..HEAD`]);
+        return output.split(/\r?\n/).some((line) => {
+          const match = line.match(/^R\d*\s+(.+?)\s+(.+)$/);
+          return Boolean(match && (match[1] === symbolOrPath || match[2] === symbolOrPath));
+        });
+      } catch (error) {
+        const detail = processError(error);
+        if (detail?.code === 128)
+          return false;
+        throw error;
+      }
+    }
   };
 }
-function labelNamesFor(issue) {
-  return (issue.labels ?? []).flatMap((label) => {
-    if (typeof label === "string")
-      return [label];
-    return typeof label.name === "string" ? [label.name] : [];
-  });
-}
-function yamlScalar(value) {
-  if (Array.isArray(value)) {
-    return value.length === 0 ? "[]" : `
-${value.map((entry) => `  - ${String(entry)}`).join(`
-`)}`;
-  }
-  if (value && typeof value === "object")
-    return JSON.stringify(value);
-  return String(value);
-}
-function updateRigOwnedMetadataBlock(body, metadata) {
-  const rendered = [
-    RIG_METADATA_START,
-    ...Object.entries(metadata).map(([key, value]) => Array.isArray(value) ? `${key}:${yamlScalar(value)}` : `${key}: ${yamlScalar(value)}`),
-    RIG_METADATA_END
-  ].join(`
-`);
-  const pattern = new RegExp(`${RIG_METADATA_START.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*[\\s\\S]*?\\s*${RIG_METADATA_END.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`);
-  if (pattern.test(body))
-    return body.replace(pattern, rendered);
-  return body.trim().length > 0 ? `${body.trimEnd()}
+var execFileAsync;
+var init_git_adapter = __esm(() => {
+  execFileAsync = promisify(execFile);
+});
 
-${rendered}
-` : `${rendered}
-`;
+// packages/standard-plugin/src/drift/detect.ts
+var exports_detect = {};
+__export(exports_detect, {
+  detectStaleAnchors: () => detectStaleAnchors,
+  detectDrift: () => detectDrift,
+  detectDeletedReferences: () => detectDeletedReferences
+});
+import { existsSync as existsSync3 } from "fs";
+import { readdir, readFile, stat } from "fs/promises";
+import { basename as basename2, extname, relative, resolve as resolve3 } from "path";
+function globLikeMatch(path, pattern) {
+  if (pattern === path)
+    return true;
+  if (pattern.startsWith("**/*"))
+    return path.endsWith(pattern.slice(4));
+  if (pattern.endsWith("/**"))
+    return path.startsWith(pattern.slice(0, -3));
+  if (pattern.includes("*")) {
+    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+    return new RegExp(`^${escaped}$`).test(path);
+  }
+  return path.startsWith(pattern);
 }
-function buildRigStickyStatusComment(input) {
-  const lines = [
-    RIG_STATUS_COMMENT_MARKER,
-    `### Rig status: ${input.status}`,
-    "",
-    input.summary
-  ];
-  if (input.runId)
-    lines.push("", `- Run: ${input.runId}`);
-  if (input.prUrl)
-    lines.push(`- PR: ${input.prUrl}`);
-  for (const detail of input.details ?? [])
-    lines.push(`- ${detail}`);
-  return lines.join(`
-`);
+function isDefaultDoc(path) {
+  const lower = basename2(path).toLowerCase();
+  return (path.endsWith(".md") || path.endsWith(".mdx")) && !lower.startsWith("changelog") && !lower.includes("generated");
 }
-function isRigStickyStatusComment(body) {
-  return body.includes(RIG_STATUS_COMMENT_MARKER);
+function isIgnored(path, patterns) {
+  return (patterns ?? []).some((pattern) => globLikeMatch(path, pattern));
 }
-function ghSpawnOptions(extraEnv, timeoutMs) {
-  return {
-    encoding: "utf-8",
-    timeout: timeoutMs,
-    env: {
-      ...process.env,
-      ...process.env.GH_TOKEN !== undefined ? { GH_TOKEN: process.env.GH_TOKEN } : {},
-      ...process.env.GITHUB_TOKEN !== undefined ? { GITHUB_TOKEN: process.env.GITHUB_TOKEN } : {},
-      ...process.env.RIG_GITHUB_TOKEN !== undefined ? { RIG_GITHUB_TOKEN: process.env.RIG_GITHUB_TOKEN } : {},
-      ...extraEnv ?? {}
+async function collectFiles(root, options) {
+  const files = [];
+  async function visit(dir) {
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+      if (entry.isDirectory() && DEFAULT_IGNORED_DIRS[entry.name])
+        continue;
+      const absolute = resolve3(dir, entry.name);
+      const rel = relative(root, absolute).replace(/\\/g, "/");
+      if (isIgnored(rel, options.ignore))
+        continue;
+      if (entry.isDirectory()) {
+        await visit(absolute);
+        continue;
+      }
+      if (!entry.isFile())
+        continue;
+      if (options.docs) {
+        const matchesConfigured = options.patterns && options.patterns.length > 0 ? options.patterns.some((pattern) => globLikeMatch(rel, pattern)) : isDefaultDoc(rel);
+        if (matchesConfigured)
+          files.push(rel);
+        continue;
+      }
+      if (SOURCE_EXTENSIONS[extname(entry.name)])
+        files.push(rel);
     }
-  };
+  }
+  await visit(root);
+  return files.sort();
 }
-function credentialEnv(token) {
-  const clean = token?.trim() ?? "";
-  return { GH_TOKEN: clean, GITHUB_TOKEN: clean, RIG_GITHUB_TOKEN: clean };
+async function sourceReferenceCount(projectRoot, reference, docPath) {
+  if (reference.kind === "path")
+    return existsSync3(resolve3(projectRoot, reference.value)) ? 1 : 0;
+  let count = 0;
+  const sourceFiles = await collectFiles(projectRoot, { docs: false });
+  for (const sourceFile of sourceFiles) {
+    if (sourceFile === docPath)
+      continue;
+    const text = await readFile(resolve3(projectRoot, sourceFile), "utf8").catch(() => "");
+    if (text.includes(reference.value))
+      count += 1;
+  }
+  return count;
 }
-async function resolveCredentialEnv(opts, purpose) {
-  if (!opts.credentialProvider)
-    return;
-  const input = {
-    owner: opts.owner,
-    repo: opts.repo,
-    workspaceId: opts.workspaceId ?? `${opts.owner}/${opts.repo}`,
-    ...opts.userId ? { userId: opts.userId } : {},
-    purpose
+function deletedReferenceFinding(docPath, reference) {
+  return {
+    kind: "deleted-reference",
+    docPath,
+    line: reference.line,
+    reference: reference.value,
+    detail: `Documented reference "${reference.value}" no longer exists in the source tree.`,
+    confidence: "high"
   };
-  const resolved = await opts.credentialProvider.resolveGitHubToken(input);
-  return credentialEnv(resolved.token);
 }
-function tokenDiagnostic(value) {
-  const clean = value?.trim() ?? "";
-  return clean ? `present(len=${clean.length})` : "missing";
+function staleAnchorFinding(docPath, reference) {
+  return {
+    kind: "stale-anchor",
+    docPath,
+    line: reference.line,
+    reference: reference.value,
+    detail: `Documented path "${reference.value}" changed after this doc was last updated.`,
+    confidence: "medium"
+  };
 }
-function runGh(bin, args, spawn, extraEnv, timeoutMs) {
-  const options = ghSpawnOptions(extraEnv, timeoutMs);
-  const res = spawn(bin, [...args], options);
-  assertGhSuccess(args, res, options.env);
-  if (!res.stdout || res.stdout.trim() === "")
-    return [];
-  return JSON.parse(res.stdout);
+async function detectDeletedReferences(projectRoot, docPath, git = makeDriftGit(projectRoot)) {
+  const markdown = await readFile(resolve3(projectRoot, docPath), "utf8");
+  const docCommit = await git.lastCommitTouching(docPath);
+  const findings = [];
+  for (const reference of extractDriftReferences(markdown)) {
+    if (await sourceReferenceCount(projectRoot, reference, docPath) > 0)
+      continue;
+    if (await git.wasRenamed(reference.value, docCommit))
+      continue;
+    findings.push(deletedReferenceFinding(docPath, reference));
+  }
+  return findings;
 }
-function runGhVoid(bin, args, spawn, extraEnv, timeoutMs) {
-  const options = ghSpawnOptions(extraEnv, timeoutMs);
-  const res = spawn(bin, [...args], options);
-  assertGhSuccess(args, res, options.env);
+async function detectStaleAnchors(projectRoot, docPath, git = makeDriftGit(projectRoot)) {
+  const markdown = await readFile(resolve3(projectRoot, docPath), "utf8");
+  const docCommit = await git.lastCommitTouching(docPath);
+  const findings = [];
+  for (const reference of extractDriftReferences(markdown).filter((ref) => ref.kind === "path")) {
+    if (!existsSync3(resolve3(projectRoot, reference.value)))
+      continue;
+    const sourceStat = await stat(resolve3(projectRoot, reference.value)).catch(() => null);
+    if (!sourceStat?.isFile())
+      continue;
+    const sourceCommit = await git.lastCommitTouching(reference.value);
+    if (sourceCommit !== docCommit && !await git.wasRenamed(reference.value, docCommit)) {
+      findings.push(staleAnchorFinding(docPath, reference));
+    }
+  }
+  return findings;
 }
-function assertGhSuccess(args, res, env) {
-  if (res.error) {
-    const msg = res.error.message ?? String(res.error);
-    throw new Error(`gh CLI not available \u2014 install gh (brew install gh / apt install gh): ${msg}`);
+async function detectDrift(options) {
+  const git = options.git ?? makeDriftGit(options.projectRoot);
+  const docs = await collectFiles(options.projectRoot, {
+    docs: true,
+    ...options.docsGlobs !== undefined ? { patterns: options.docsGlobs } : {},
+    ...options.ignoreGlobs !== undefined ? { ignore: options.ignoreGlobs } : {}
+  });
+  const findings = [];
+  let degraded = false;
+  for (const docPath of docs) {
+    try {
+      findings.push(...await detectDeletedReferences(options.projectRoot, docPath, git));
+      findings.push(...await detectStaleAnchors(options.projectRoot, docPath, git));
+    } catch {
+      degraded = true;
+    }
   }
-  if (res.status !== 0) {
-    throw new Error(`gh ${args.join(" ")} failed (exit ${res.status}): ${res.stderr}
-[rig gh env:standard-plugin] GH_TOKEN=${tokenDiagnostic(env.GH_TOKEN)} GITHUB_TOKEN=${tokenDiagnostic(env.GITHUB_TOKEN)} RIG_GITHUB_TOKEN=${tokenDiagnostic(env.RIG_GITHUB_TOKEN)}`);
+  return {
+    generatedAt: new Date().toISOString(),
+    scanned: docs.length,
+    degraded,
+    findings
+  };
+}
+var DEFAULT_IGNORED_DIRS, SOURCE_EXTENSIONS;
+var init_detect = __esm(() => {
+  init_extract_refs();
+  init_git_adapter();
+  DEFAULT_IGNORED_DIRS = {
+    ".git": true,
+    node_modules: true,
+    dist: true,
+    build: true,
+    coverage: true,
+    ".next": true,
+    vendor: true
+  };
+  SOURCE_EXTENSIONS = {
+    ".ts": true,
+    ".tsx": true,
+    ".js": true,
+    ".jsx": true,
+    ".mjs": true,
+    ".cjs": true,
+    ".rs": true,
+    ".go": true,
+    ".py": true,
+    ".rb": true,
+    ".java": true,
+    ".kt": true,
+    ".swift": true,
+    ".c": true,
+    ".cc": true,
+    ".cpp": true,
+    ".h": true,
+    ".hpp": true,
+    ".json": true,
+    ".toml": true,
+    ".yml": true,
+    ".yaml": true
+  };
+});
+
+// packages/standard-plugin/src/drift/plugin.ts
+var exports_plugin = {};
+__export(exports_plugin, {
+  runDriftCli: () => runDriftCli,
+  runDocsDriftValidation: () => runDocsDriftValidation,
+  highConfidenceDriftFindings: () => highConfidenceDriftFindings,
+  executeDrift: () => executeDrift,
+  driftGateResult: () => driftGateResult,
+  createDocsDriftValidator: () => createDocsDriftValidator,
+  createDocsDriftRuntimeCliCommand: () => createDocsDriftRuntimeCliCommand,
+  createDocsDriftGateStage: () => createDocsDriftGateStage,
+  DOCS_DRIFT_VALIDATOR_ID: () => DOCS_DRIFT_VALIDATOR_ID,
+  DOCS_DRIFT_VALIDATOR: () => DOCS_DRIFT_VALIDATOR,
+  DOCS_DRIFT_STAGE_MUTATION: () => DOCS_DRIFT_STAGE_MUTATION,
+  DOCS_DRIFT_STAGE_ID: () => DOCS_DRIFT_STAGE_ID,
+  DOCS_DRIFT_RUNTIME_CLI_COMMAND: () => DOCS_DRIFT_RUNTIME_CLI_COMMAND,
+  DOCS_DRIFT_CLI_ID: () => DOCS_DRIFT_CLI_ID,
+  DOCS_DRIFT_CLI_COMMAND: () => DOCS_DRIFT_CLI_COMMAND,
+  DOCS_DRIFT_CAPABILITY_ID: () => DOCS_DRIFT_CAPABILITY_ID
+});
+function highConfidenceDriftFindings(report) {
+  return report.findings.filter((finding) => finding.confidence === "high");
+}
+function driftGateResult(report, mode = "enforce") {
+  const high = highConfidenceDriftFindings(report);
+  if (mode === "enforce" && high.length > 0) {
+    return { kind: "block", reason: `${high.length} high-confidence documentation drift finding(s).` };
   }
+  return { kind: "allow" };
 }
-var DEFAULT_PROJECT_STATUSES = {
-  todo: "Todo",
-  running: "In Progress",
-  prOpen: "In Review",
-  ciFixing: "In Review",
-  merging: "In Review",
-  done: "Done",
-  needsAttention: "Needs Attention"
-};
-function asProjectRecord(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+function createDocsDriftGateStage(options = {}) {
+  return async (ctx) => {
+    const projectRoot = typeof ctx.metadata?.projectRoot === "string" ? ctx.metadata.projectRoot : process.cwd();
+    const report = await detectDrift({
+      projectRoot,
+      ...options.docsGlobs !== undefined ? { docsGlobs: options.docsGlobs } : {},
+      ...options.ignoreGlobs !== undefined ? { ignoreGlobs: options.ignoreGlobs } : {}
+    });
+    return driftGateResult(report, options.failOnDrift ? "enforce" : "observe");
+  };
 }
-function projectString(value) {
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+async function runDocsDriftValidation(options) {
+  const report = await detectDrift(options);
+  const high = highConfidenceDriftFindings(report);
+  const passed = options.failOnDrift ? high.length === 0 : true;
+  const findingWord = report.findings.length === 1 ? "finding" : "findings";
+  return {
+    id: DOCS_DRIFT_VALIDATOR_ID,
+    passed,
+    summary: `docs drift scanned ${report.scanned} doc(s), ${report.findings.length} ${findingWord}`,
+    details: JSON.stringify(report)
+  };
 }
-function projectLifecycleStatusForTaskStatus(status) {
-  const normalized = status?.trim().toLowerCase().replace(/[-\s]+/g, "_");
-  switch (normalized) {
-    case "draft":
-    case "open":
-    case "queued":
-    case "ready":
-      return "todo";
-    case "running":
-    case "in_progress":
-      return "running";
-    case "under_review":
-    case "review":
-    case "pr_open":
-      return "prOpen";
-    case "ci_fixing":
-    case "fixing":
-      return "ciFixing";
-    case "merging":
-    case "merge":
-      return "merging";
-    case "closed":
-    case "completed":
-    case "done":
-      return "done";
-    case "blocked":
-    case "cancelled":
-    case "failed":
-    case "needs_attention":
-      return "needsAttention";
-    default:
-      return null;
-  }
-}
-function ghGraphQLFetch(bin, spawnFn, extraEnv, timeoutMs) {
-  return async (query, variables) => {
-    const args = ["api", "graphql", "-f", `query=${query}`];
-    for (const [key, value] of Object.entries(variables)) {
-      if (value === undefined || value === null)
-        continue;
-      args.push("-f", `${key}=${String(value)}`);
+function createDocsDriftValidator(options = {}) {
+  return {
+    ...DOCS_DRIFT_VALIDATOR,
+    async run(ctx) {
+      return runDocsDriftValidation({
+        projectRoot: ctx.workspaceRoot,
+        ...options.docsGlobs !== undefined ? { docsGlobs: options.docsGlobs } : {},
+        ...options.ignoreGlobs !== undefined ? { ignoreGlobs: options.ignoreGlobs } : {},
+        ...options.failOnDrift !== undefined ? { failOnDrift: options.failOnDrift } : {}
+      });
     }
-    const response = runGh(bin, args, spawnFn, extraEnv, timeoutMs);
-    return asProjectRecord(response)?.data ?? response;
   };
 }
-function issueNodeIdFor(issue) {
-  const id = issue.id ?? issue.nodeId ?? issue.node_id;
-  return typeof id === "string" && id.trim().length > 0 ? id.trim() : null;
-}
-function nativeIssueDependencyRef(value, currentRepo) {
-  const record = asProjectRecord(value);
-  const number = typeof record?.number === "number" ? String(record.number) : projectString(record?.number);
-  if (!number)
-    return null;
-  const repository = asProjectRecord(record?.repository);
-  const owner = projectString(asProjectRecord(repository?.owner)?.login);
-  const name = projectString(repository?.name);
-  if (!owner || !name || `${owner}/${name}` === currentRepo)
-    return number;
-  return `${owner}/${name}#${number}`;
+function takeOptionValue(args, index, flag) {
+  const value = args[index + 1];
+  if (!value)
+    throw new Error(`${flag} requires a value`);
+  return value;
 }
-function nativeDependencyRefsFrom(data, currentRepo) {
-  const issue = asProjectRecord(asProjectRecord(data)?.node);
-  const blockedBy = asProjectRecord(issue?.blockedBy);
-  const nodes = Array.isArray(blockedBy?.nodes) ? blockedBy.nodes : [];
-  return [...new Set(nodes.flatMap((node) => {
-    const ref = nativeIssueDependencyRef(node, currentRepo);
-    return ref ? [ref] : [];
-  }))];
+function takeFlag(args, flag) {
+  const rest = [...args];
+  const index = rest.indexOf(flag);
+  if (index < 0)
+    return { value: false, rest };
+  rest.splice(index, 1);
+  return { value: true, rest };
 }
-async function readNativeDependenciesForIssue(input) {
-  const issueId = issueNodeIdFor(input.issue);
-  if (!issueId)
-    return { deps: [], degraded: "GitHub issue node id is unavailable." };
-  const query = `
-    query RigIssueNativeDependencies($issueId: ID!) {
-      node(id: $issueId) {
-        ... on Issue {
-          blockedBy(first: 100) {
-            nodes {
-              number
-              repository { name owner { login } }
-            }
-          }
-        }
-      }
-    }
-  `;
-  try {
-    return {
-      deps: nativeDependencyRefsFrom(await input.fetchGraphQL(query, { issueId }, "gh-cli"), input.repo)
-    };
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    return { deps: [], degraded: detail };
-  }
+function takeOption(args, flag) {
+  const rest = [...args];
+  const index = rest.indexOf(flag);
+  if (index < 0)
+    return { rest };
+  const value = rest[index + 1];
+  if (!value || value.startsWith("-"))
+    throw new Error(`${flag} requires a value.`);
+  rest.splice(index, 2);
+  return { value, rest };
 }
-function formatIssueReference(ref) {
-  const clean = ref.trim().replace(/^#/, "");
-  return /^\d+$/.test(clean) ? `#${clean}` : clean;
+function requireNoExtraArgs(args, usage) {
+  if (args.length > 0)
+    throw new Error(`Unexpected argument: ${args[0]}
+Usage: ${usage}`);
 }
-function appendReferenceLines(body, deps, parents) {
-  const lines = [];
-  const cleanDeps = (deps ?? []).map(formatIssueReference).filter((ref) => ref.length > 0);
-  const cleanParents = (parents ?? []).map(formatIssueReference).filter((ref) => ref.length > 0);
-  if (cleanDeps.length > 0)
-    lines.push(`depends-on: ${cleanDeps.join(", ")}`);
-  if (cleanParents.length > 0)
-    lines.push(`parents: ${cleanParents.join(", ")}`);
-  if (lines.length === 0)
-    return body;
-  return body.trim().length > 0 ? `${body.trimEnd()}
-
-${lines.join(`
-`)}` : lines.join(`
-`);
+function parseCsv(value) {
+  return value?.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) ?? [];
 }
-function bodyForCreatedTask(input) {
-  const metadata = { ...input.metadata ?? {} };
-  if (input.deps && input.deps.length > 0)
-    metadata["depends-on"] = input.deps.map(formatIssueReference);
-  if (input.parents && input.parents.length > 0)
-    metadata.parents = input.parents.map(formatIssueReference);
-  return updateRigOwnedMetadataBlock(appendReferenceLines(input.body, input.deps, input.parents), metadata);
+function driftSummary(report) {
+  const highConfidence = highConfidenceDriftFindings(report).length;
+  return { total: report.findings.length, highConfidence, degraded: report.degraded };
 }
-function projectStatusFieldFrom(data, projectId) {
-  const fields = asProjectRecord(asProjectRecord(asProjectRecord(data)?.node)?.fields)?.nodes;
-  for (const node of Array.isArray(fields) ? fields : []) {
-    const record = asProjectRecord(node);
-    if (projectString(record?.name)?.toLowerCase() !== "status")
-      continue;
-    const id = projectString(record?.id);
-    if (!id)
-      continue;
-    const options = Array.isArray(record?.options) ? record.options.flatMap((option) => {
-      const optionRecord = asProjectRecord(option);
-      const optionId = projectString(optionRecord?.id);
-      const name = projectString(optionRecord?.name);
-      return optionId && name ? [{ id: optionId, name }] : [];
-    }) : [];
-    return { id, name: "Status", options };
+async function executeDrift(context, args, options = {}) {
+  const json = takeFlag(args, "--json");
+  const docs = takeOption(json.rest, "--docs");
+  const ignore = takeOption(docs.rest, "--ignore");
+  const failOnDrift = takeFlag(ignore.rest, "--fail-on-drift");
+  requireNoExtraArgs(failOnDrift.rest, "rig drift [--docs <csv>] [--ignore <csv>] [--fail-on-drift] [--json]");
+  const docsGlobs = parseCsv(docs.value);
+  const ignoreGlobs = parseCsv(ignore.value);
+  const effectiveDocsGlobs = docsGlobs.length > 0 ? docsGlobs : options.docsGlobs;
+  const effectiveIgnoreGlobs = ignoreGlobs.length > 0 ? ignoreGlobs : options.ignoreGlobs;
+  const effectiveFailOnDrift = failOnDrift.value || options.failOnDrift === true;
+  const report = await detectDrift({
+    projectRoot: context.projectRoot,
+    ...effectiveDocsGlobs !== undefined ? { docsGlobs: effectiveDocsGlobs } : {},
+    ...effectiveIgnoreGlobs !== undefined ? { ignoreGlobs: effectiveIgnoreGlobs } : {}
+  });
+  const failed = effectiveFailOnDrift && highConfidenceDriftFindings(report).length > 0;
+  const details = { report, summary: driftSummary(report), failOnDrift: effectiveFailOnDrift, failed };
+  if (context.outputMode === "text") {
+    if (json.value)
+      console.log(JSON.stringify(details, null, 2));
+    else
+      console.log(report.findings.length === 0 ? `No drift findings across ${report.scanned} documents.` : report.findings.map((finding) => `${finding.docPath}:${finding.line ?? "?"}	${finding.kind}	${finding.confidence}	${finding.detail}`).join(`
+`));
   }
-  throw new Error(`GitHub Project ${projectId} does not expose a Status single-select field.`);
+  return { ok: !failed, group: "drift", command: "scan", details };
 }
-async function resolveProjectStatusField(input) {
-  const query = `
-    query RigProjectStatusField($projectId: ID!) {
-      node(id: $projectId) {
-        ... on ProjectV2 {
-          fields(first: 50) {
-            nodes {
-              ... on ProjectV2FieldCommon { id name }
-              ... on ProjectV2SingleSelectField { id name options { id name } }
-            }
-          }
-        }
-      }
-    }
-  `;
-  return projectStatusFieldFrom(await input.fetchGraphQL(query, { projectId: input.projectId }, input.token), input.projectId);
+function createDocsDriftRuntimeCliCommand(options = {}) {
+  return {
+    id: DOCS_DRIFT_CLI_ID,
+    family: "drift",
+    command: DOCS_DRIFT_CLI_COMMAND,
+    description: "Scan documentation for stale code references.",
+    usage: DOCS_DRIFT_CLI_COMMAND,
+    projectRequired: true,
+    run: (context, args) => executeDrift(context, args, options)
+  };
 }
-async function ensureIssueProjectItem(input) {
-  const query = `
-    query RigFindProjectIssueItem($projectId: ID!) {
-      node(id: $projectId) {
-        ... on ProjectV2 {
-          items(first: 100) { nodes { id content { ... on Issue { id } } } }
-        }
-      }
+async function runDriftCli(args, options = {}) {
+  const docsGlobs = [];
+  const ignoreGlobs = [];
+  let json = false;
+  let failOnDrift = false;
+  for (let index = 0;index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--json") {
+      json = true;
+      continue;
     }
-  `;
-  const data = await input.fetchGraphQL(query, { projectId: input.projectId }, input.token);
-  const nodes = asProjectRecord(asProjectRecord(asProjectRecord(data)?.node)?.items)?.nodes;
-  for (const node of Array.isArray(nodes) ? nodes : []) {
-    const record = asProjectRecord(node);
-    const content = asProjectRecord(record?.content);
-    if (projectString(content?.id) === input.issueNodeId) {
-      const id2 = projectString(record?.id);
-      if (id2)
-        return { id: id2, created: false };
+    if (arg === "--fail-on-drift") {
+      failOnDrift = true;
+      continue;
     }
-  }
-  const mutation = `
-    mutation RigAddIssueToProject($projectId: ID!, $contentId: ID!) {
-      addProjectV2ItemById(input: { projectId: $projectId, contentId: $contentId }) { item { id } }
+    if (arg === "--docs") {
+      docsGlobs.push(takeOptionValue(args, index, arg));
+      index += 1;
+      continue;
     }
-  `;
-  const created = await input.fetchGraphQL(mutation, { projectId: input.projectId, contentId: input.issueNodeId }, input.token);
-  const addResult = asProjectRecord(asProjectRecord(created)?.addProjectV2ItemById);
-  const id = projectString(asProjectRecord(addResult?.item)?.id);
-  if (!id)
-    throw new Error("GitHub Project item creation did not return an item id.");
-  return { id, created: true };
-}
-async function updateIssueProjectStatus(input) {
-  const mutation = `
-    mutation RigUpdateProjectStatus($projectId: ID!, $itemId: ID!, $fieldId: ID!, $optionId: String!) {
-      updateProjectV2ItemFieldValue(input: {
-        projectId: $projectId,
-        itemId: $itemId,
-        fieldId: $fieldId,
-        value: { singleSelectOptionId: $optionId }
-      }) { projectV2Item { id } }
+    if (arg === "--ignore") {
+      ignoreGlobs.push(takeOptionValue(args, index, arg));
+      index += 1;
+      continue;
     }
-  `;
-  await input.fetchGraphQL(mutation, {
-    projectId: input.projectId,
-    itemId: input.itemId,
-    fieldId: input.fieldId,
-    optionId: input.optionId
-  }, input.token);
-}
-function fetchIssueNodeId(bin, repo, spawnFn, id, extraEnv, timeoutMs) {
-  const issue = runGh(bin, ["issue", "view", String(id), "--repo", repo, "--json", "id"], spawnFn, extraEnv, timeoutMs);
-  return projectString(issue.id) ?? projectString(issue.nodeId) ?? projectString(issue.node_id);
-}
-async function syncGitHubProjectStatus(bin, repo, spawnFn, id, status, projects, extraEnv, timeoutMs) {
-  if (!projects?.enabled)
-    return;
-  const projectId = projectString(projects.projectId);
-  if (!projectId)
-    throw new Error("GitHub Projects status sync is enabled but projectId is missing.");
-  const lifecycleStatus = projectLifecycleStatusForTaskStatus(status);
-  if (!lifecycleStatus)
-    return;
-  const issueNodeId = fetchIssueNodeId(bin, repo, spawnFn, id, extraEnv, timeoutMs);
-  if (!issueNodeId)
-    throw new Error(`GitHub issue ${repo}#${id} did not expose a node id for Projects status sync.`);
-  const projectStatus = projectString(projects.statuses?.[lifecycleStatus]) ?? DEFAULT_PROJECT_STATUSES[lifecycleStatus];
-  const fetchGraphQL = ghGraphQLFetch(bin, spawnFn, extraEnv, timeoutMs);
-  const field = await resolveProjectStatusField({ projectId, token: "gh-cli", fetchGraphQL });
-  const option = field.options.find((candidate) => candidate.name.toLowerCase() === projectStatus.toLowerCase() || candidate.id === projectStatus);
-  if (!option)
-    throw new Error(`GitHub Project ${projectId} Status field does not contain option "${projectStatus}".`);
-  const item = await ensureIssueProjectItem({ projectId, issueNodeId, token: "gh-cli", fetchGraphQL });
-  await updateIssueProjectStatus({
-    projectId,
-    itemId: item.id,
-    fieldId: projectString(projects.statusFieldId) ?? field.id,
-    optionId: option.id,
-    token: "gh-cli",
-    fetchGraphQL
+    throw new Error(`Unknown rig drift argument: ${arg}`);
+  }
+  const report = await detectDrift({
+    projectRoot: options.projectRoot ?? process.cwd(),
+    ...docsGlobs.length > 0 ? { docsGlobs } : {},
+    ...ignoreGlobs.length > 0 ? { ignoreGlobs } : {}
   });
+  const write = options.write ?? ((message) => console.log(message));
+  if (json) {
+    write(JSON.stringify(report));
+  } else {
+    write(`Scanned ${report.scanned} doc(s); ${report.findings.length} drift finding(s).`);
+    for (const finding of report.findings) {
+      write(`${finding.confidence.toUpperCase()} ${finding.kind} ${finding.docPath}${finding.line ? `:${finding.line}` : ""} ${finding.reference ?? ""} \u2014 ${finding.detail}`);
+    }
+  }
+  const high = highConfidenceDriftFindings(report);
+  if (failOnDrift && high.length > 0) {
+    options.writeError?.(`${high.length} high-confidence drift finding(s).`);
+    return 2;
+  }
+  return 0;
 }
-var TERMINAL_TASK_STATUSES = new Set(["closed", "completed", "merged", "cancelled", "resolved", "done"]);
-function normalizeTaskStatusToken(status) {
-  return status?.trim().toLowerCase().replace(/[-\s]+/g, "_") ?? "";
+var DOCS_DRIFT_RUNTIME_CLI_COMMAND;
+var init_plugin = __esm(() => {
+  init_detect();
+  init_metadata();
+  init_metadata();
+  DOCS_DRIFT_RUNTIME_CLI_COMMAND = createDocsDriftRuntimeCliCommand();
+});
+
+// packages/standard-plugin/src/bundle.ts
+import { createBlockerClassifierPlugin } from "@rig/blocker-classifier-plugin/plugin";
+import { createDefaultLifecyclePlugin } from "@rig/bundle-default-lifecycle/plugin";
+import { createDependencyGraphPlugin } from "@rig/dependency-graph-plugin/plugin";
+import { createPlanningPlugin } from "@rig/planning-plugin/plugin";
+import { createSupervisorPlugin } from "@rig/supervisor-plugin/plugin";
+
+// packages/standard-plugin/src/run-worker-panels.ts
+var RIG_RUN_STOP_PANEL_ACTION = "rig-run:stop";
+var RIG_CAPABILITY_PANEL_SLOT = "capability";
+var RIG_SUPERVISOR_PANEL_ID = "supervisor";
+var RUN_SUPERVISOR_PANEL_REGISTRATION = {
+  id: RIG_SUPERVISOR_PANEL_ID,
+  slot: RIG_CAPABILITY_PANEL_SLOT,
+  title: "Supervisor",
+  capabilityId: "run.supervisor",
+  description: "Live run status, closeout progress, and operator stop control."
+};
+function buildSupervisorPanelPayload(context) {
+  const status = context.folded.status ?? "unknown";
+  const taskId = context.folded.record.taskId ?? context.taskIdAtStart;
+  const operatorActive = status === "running" || status === "validating" || status === "closing-out" || status === "needs-attention";
+  return {
+    status,
+    currentTask: taskId ? { id: taskId, title: context.runDisplayTitle } : null,
+    processed: context.folded.closeoutPhases.length,
+    succeeded: context.folded.closeoutPhases.filter((phase) => phase.outcome === "completed").length,
+    failed: context.folded.closeoutPhases.filter((phase) => phase.outcome === "failed").length,
+    skipped: 0,
+    plannedOrder: taskId ? [{ id: taskId, title: context.runDisplayTitle, status }] : [],
+    idleReason: operatorActive ? null : status,
+    stopActionId: operatorActive ? RIG_RUN_STOP_PANEL_ACTION : null,
+    closures: []
+  };
 }
-function issueUpdatesMode(value) {
-  return value === "off" || value === "minimal" || value === "lifecycle" ? value : "lifecycle";
+var RUN_SUPERVISOR_PANEL_PRODUCER = {
+  ...RUN_SUPERVISOR_PANEL_REGISTRATION,
+  produce(context) {
+    return buildSupervisorPanelPayload(context);
+  }
+};
+var RUN_WORKER_PANEL_PLUGIN = {
+  name: "@rig/standard-plugin:run-worker-panels",
+  version: "0.0.0-alpha.1",
+  contributes: {
+    panels: [RUN_SUPERVISOR_PANEL_REGISTRATION]
+  },
+  __runtime: {
+    panels: [RUN_SUPERVISOR_PANEL_PRODUCER]
+  }
+};
+
+// packages/standard-plugin/src/plugin.ts
+import { resolve as resolve4 } from "path";
+import { definePlugin } from "@rig/core/config";
+
+// packages/standard-plugin/src/github-issues-source.ts
+import { spawnSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { resolve } from "path";
+function cleanToken(value) {
+  const trimmed = value?.trim() ?? "";
+  return trimmed.length > 0 ? trimmed : null;
 }
-function isTerminalTaskStatus(status) {
-  return TERMINAL_TASK_STATUSES.has(normalizeTaskStatusToken(status));
+function createEnvGitHubCredentialProvider() {
+  return {
+    async resolveGitHubToken(input) {
+      if (input.purpose === "selected-repo") {
+        return { token: cleanToken(process.env.RIG_GITHUB_SELECTED_TOKEN ?? null) ?? "", source: "signed-in-user" };
+      }
+      const token = cleanToken(process.env.RIG_GITHUB_TOKEN ?? process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN ?? null);
+      if (!token) {
+        throw new Error("No host GitHub token is configured for admin fallback.");
+      }
+      return { token, source: "host-admin-fallback" };
+    }
+  };
 }
-function shouldWriteIssueUpdate(mode, status) {
-  if (mode === "off")
-    return false;
-  if (mode === "lifecycle")
-    return true;
-  return isTerminalTaskStatus(status);
+function createStateGitHubCredentialProvider(options = {}) {
+  const addCandidate = (candidates, path) => {
+    const trimmed = path?.trim();
+    if (!trimmed)
+      return;
+    const resolved = resolve(trimmed);
+    if (!candidates.includes(resolved))
+      candidates.push(resolved);
+  };
+  const addStateDir = (candidates, dir) => {
+    const trimmed = dir?.trim();
+    if (!trimmed)
+      return;
+    addCandidate(candidates, resolve(trimmed, "github-auth.json"));
+  };
+  const addProjectStateDir = (candidates, root) => {
+    const trimmed = root?.trim();
+    if (!trimmed)
+      return;
+    addStateDir(candidates, resolve(trimmed, ".rig", "state"));
+  };
+  const stateFileCandidates = () => {
+    const candidates = [];
+    addCandidate(candidates, options.stateFile ?? process.env.RIG_GITHUB_AUTH_STATE_FILE);
+    addStateDir(candidates, options.stateDir);
+    addStateDir(candidates, process.env.RIG_STATE_DIR);
+    addProjectStateDir(candidates, process.env.PROJECT_RIG_ROOT);
+    addProjectStateDir(candidates, process.env.RIG_PROJECT_ROOT);
+    addProjectStateDir(candidates, process.env.RIG_HOST_PROJECT_ROOT);
+    addProjectStateDir(candidates, process.cwd());
+    return candidates;
+  };
+  const readToken = () => {
+    for (const stateFile of stateFileCandidates()) {
+      if (!existsSync(stateFile))
+        continue;
+      try {
+        const parsed = JSON.parse(readFileSync(stateFile, "utf8"));
+        const token = typeof parsed.token === "string" ? cleanToken(parsed.token) : null;
+        if (token)
+          return token;
+      } catch {}
+    }
+    return null;
+  };
+  return {
+    async resolveGitHubToken(input) {
+      const token = readToken();
+      if (input.purpose === "selected-repo") {
+        return { token: token ?? cleanToken(process.env.RIG_GITHUB_SELECTED_TOKEN ?? null) ?? "", source: "signed-in-user" };
+      }
+      if (token) {
+        return { token, source: "signed-in-user" };
+      }
+      const fallback = cleanToken(process.env.RIG_GITHUB_TOKEN ?? process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN ?? null);
+      if (!fallback) {
+        throw new Error("No signed-in GitHub token is stored for Rig and no host admin fallback token is configured.");
+      }
+      return { token: fallback, source: "host-admin-fallback" };
+    }
+  };
 }
-function isRunningStatus(status) {
-  return normalizeTaskStatusToken(status) === "running";
+var STATUS_LABELS = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
+var RIG_STATUS_COMMENT_MARKER = "<!-- rig:status-comment -->";
+var RIG_METADATA_START = "<!-- rig:metadata:start -->";
+var RIG_METADATA_END = "<!-- rig:metadata:end -->";
+var RIG_STATUS_LABELS = new Set(["rig:running", "rig:pr-open", "rig:ci-fixing", "rig:merging", "rig:done", "rig:needs-attention"]);
+var DEFAULT_GH_TIMEOUT_MS = 15000;
+var DEFAULT_GITHUB_ISSUE_LIST_LIMIT = 1000;
+function statusFor(issue) {
+  const state = (issue.state ?? "").toUpperCase();
+  if (state === "CLOSED")
+    return "closed";
+  const labelNames = labelNamesFor(issue);
+  if (labelNames.includes("in-progress"))
+    return "in_progress";
+  if (labelNames.includes("blocked"))
+    return "blocked";
+  if (labelNames.includes("ready"))
+    return "ready";
+  if (labelNames.includes("under-review"))
+    return "under_review";
+  if (labelNames.includes("failed"))
+    return "failed";
+  if (labelNames.includes("cancelled"))
+    return "cancelled";
+  return "open";
 }
-function assignRunningIssue(bin, repo, spawnFn, id, assignee, extraEnv, timeoutMs) {
-  runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, "--add-assignee", assignee?.trim() || "@me"], spawnFn, extraEnv, timeoutMs);
+function parseIssueRefs(raw) {
+  const refs = [...raw.matchAll(/(?:^|[^\w/.-])(?:[\w.-]+\/[\w.-]+#|#)?(\d+)\b/g)].map((match) => match[1]).filter((value) => Boolean(value));
+  return [...new Set(refs)];
 }
-function statusLabelFor(status) {
-  switch (status) {
-    case "running":
-    case "in_progress":
-      return "in-progress";
-    case "blocked":
-      return "blocked";
-    case "ready":
-      return "ready";
-    case "under_review":
-      return "under-review";
-    case "failed":
-      return "failed";
-    case "cancelled":
-      return "cancelled";
-    case "ci_fixing":
-      return "under-review";
-    case "merging":
-      return "under-review";
-    case "needs_attention":
-      return "blocked";
-    case "closed":
-    case "completed":
-    case "open":
-      return null;
-    default:
-      throw new Error(`unsupported status: ${status}`);
+function metadataKeyPattern(keys) {
+  return new RegExp(`^(?:${keys.map((key) => key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")}):\\s*(.*)$`, "i");
+}
+function parseMetadataList(body, keys) {
+  const block = body.match(/<!-- rig:metadata:start -->\s*([\s\S]*?)\s*<!-- rig:metadata:end -->/);
+  if (!block)
+    return [];
+  const lines = block[1].split(/\r?\n/);
+  const values = [];
+  const keyPattern = metadataKeyPattern(keys);
+  for (let index = 0;index < lines.length; index += 1) {
+    const line = lines[index];
+    const sameLine = line.match(keyPattern);
+    if (!sameLine)
+      continue;
+    const inlineValue = sameLine[1]?.trim() ?? "";
+    if (inlineValue) {
+      values.push(...parseIssueRefs(inlineValue));
+      continue;
+    }
+    for (let cursor = index + 1;cursor < lines.length; cursor += 1) {
+      const item = lines[cursor].match(/^\s*-\s*(.+)$/);
+      if (!item)
+        break;
+      values.push(...parseIssueRefs(item[1]));
+    }
   }
+  return [...new Set(values)];
 }
-function rigStatusLabelFor(status) {
-  switch (status) {
-    case "running":
-    case "in_progress":
-      return "rig:running";
-    case "under_review":
-      return "rig:pr-open";
-    case "closed":
-    case "completed":
-      return "rig:done";
-    case "ci_fixing":
-      return "rig:ci-fixing";
-    case "merging":
-      return "rig:merging";
-    case "needs_attention":
-    case "failed":
-    case "blocked":
-      return "rig:needs-attention";
-    case "ready":
-    case "cancelled":
-    case "open":
-      return null;
-    default:
-      return null;
-  }
+function bodyWithoutRigMetadataBlock(body) {
+  return body.replace(/<!-- rig:metadata:start -->\s*[\s\S]*?\s*<!-- rig:metadata:end -->/g, "");
 }
-async function applyIssueStatus(bin, repo, spawnFn, id, status, projects, runningAssignee, issueUpdates, extraEnv, timeoutMs) {
-  const targetLabel = status === "closed" || status === "completed" ? null : statusLabelFor(status);
-  const targetRigLabel = rigStatusLabelFor(status);
-  const shouldSyncLifecycle = shouldWriteIssueUpdate(issueUpdates, status);
-  for (const l of [...STATUS_LABELS, ...RIG_STATUS_LABELS]) {
-    if (targetLabel !== null && l === targetLabel)
-      continue;
-    if (targetRigLabel !== null && l === targetRigLabel)
-      continue;
-    try {
-      runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, "--remove-label", l], spawnFn, extraEnv, timeoutMs);
-    } catch {}
-  }
-  for (const label of [targetLabel, targetRigLabel].filter((value) => Boolean(value))) {
-    try {
-      runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, "--add-label", label], spawnFn, extraEnv, timeoutMs);
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      if (!/not found/i.test(message)) {
-        throw error;
-      }
-      ensureStatusLabel(bin, repo, spawnFn, label, extraEnv, timeoutMs);
-      runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, "--add-label", label], spawnFn, extraEnv, timeoutMs);
-    }
-  }
-  if (isRunningStatus(status)) {
-    assignRunningIssue(bin, repo, spawnFn, id, runningAssignee, extraEnv, timeoutMs);
-    if (shouldSyncLifecycle) {
-      upsertRigStickyComment(bin, repo, spawnFn, String(id), buildRigStickyStatusComment({
-        status: "running",
-        summary: "Rig run started."
-      }), extraEnv, timeoutMs);
-    }
-  }
-  if (shouldSyncLifecycle) {
-    await syncGitHubProjectStatus(bin, repo, spawnFn, id, status, projects, extraEnv, timeoutMs);
-  }
-  if (status === "closed" || status === "completed") {
-    runGhVoid(bin, ["issue", "close", String(id), "--repo", repo], spawnFn, extraEnv, timeoutMs);
-  }
+function parseBodyKeyRefs(body, keys) {
+  const keyPattern = metadataKeyPattern(keys);
+  const values = bodyWithoutRigMetadataBlock(body).split(/\r?\n/).flatMap((line) => {
+    const match = line.match(keyPattern);
+    return match?.[1] ? parseIssueRefs(match[1]) : [];
+  });
+  return [...new Set(values)];
 }
-function ensureStatusLabel(bin, repo, spawnFn, label, extraEnv, timeoutMs) {
-  try {
-    runGhVoid(bin, [
-      "label",
-      "create",
-      label,
-      "--repo",
-      repo,
-      "--color",
-      "6f42c1",
-      "--description",
-      "Task status managed by Rig"
-    ], spawnFn, extraEnv, timeoutMs);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (!/already exists/i.test(message)) {
-      throw error;
-    }
-  }
+function parseDeps(body) {
+  const keys = ["depends-on", "deps", "blocked-by", "blocked_by"];
+  return [...new Set([...parseBodyKeyRefs(body, keys), ...parseMetadataList(body, keys)])];
 }
-function upsertRigStickyComment(bin, repo, spawnFn, id, body, extraEnv, timeoutMs) {
-  const comments = runGh(bin, ["api", `repos/${repo}/issues/${id}/comments`, "--paginate"], spawnFn, extraEnv, timeoutMs);
-  const existing = comments.find((comment) => typeof comment.body === "string" && comment.body.includes(RIG_STATUS_COMMENT_MARKER));
-  if (existing) {
-    runGhVoid(bin, ["api", "-X", "PATCH", `repos/${repo}/issues/comments/${existing.id}`, "-f", `body=${body}`], spawnFn, extraEnv, timeoutMs);
-    return;
-  }
-  runGhVoid(bin, ["api", "-X", "POST", `repos/${repo}/issues/${id}/comments`, "-f", `body=${body}`], spawnFn, extraEnv, timeoutMs);
+function parseParents(body) {
+  const keys = ["parents", "parent"];
+  return [...new Set([...parseBodyKeyRefs(body, keys), ...parseMetadataList(body, keys)])];
 }
-function notifyTaskChanged(onTaskChanged, repo, id, status) {
-  onTaskChanged?.({ repo, id, ...status ? { status } : {}, reason: "github-issue-updated" });
+function issueTypeFor(issue) {
+  const labels = labelNamesFor(issue);
+  const typed = labels.find((l) => l.startsWith("type:"));
+  if (typed)
+    return typed.slice("type:".length);
+  if (labels.includes("epic"))
+    return "epic";
+  return "task";
 }
-function fetchIssueBody(bin, repo, spawnFn, id, extraEnv, timeoutMs) {
-  const issue = runGh(bin, [
-    "issue",
-    "view",
-    String(id),
-    "--repo",
-    repo,
-    "--json",
-    "body"
-  ], spawnFn, extraEnv, timeoutMs);
-  return typeof issue.body === "string" ? issue.body : undefined;
+function issueToTask(issue, repo, nativeDependencies) {
+  const labelNames = labelNamesFor(issue);
+  const scope = labelNames.filter((l) => l.startsWith("scope:")).map((l) => l.slice("scope:".length));
+  const roleLabel = labelNames.find((l) => l.startsWith("role:"));
+  const role = roleLabel ? roleLabel.slice("role:".length) : undefined;
+  const validators = labelNames.filter((l) => l.startsWith("validator:")).map((l) => l.slice("validator:".length));
+  const body = issue.body ?? "";
+  const issueNodeId = issue.id ?? issue.nodeId ?? issue.node_id;
+  const parsedDeps = parseDeps(body);
+  const deps = nativeDependencies?.deps ? [...new Set([...parsedDeps, ...nativeDependencies.deps])] : parsedDeps;
+  return {
+    id: String(issue.number),
+    ...typeof issueNodeId === "string" && issueNodeId.trim() ? { issueNodeId: issueNodeId.trim() } : {},
+    deps,
+    status: statusFor(issue),
+    title: issue.title,
+    body,
+    scope,
+    role,
+    validators,
+    url: issue.url ?? issue.html_url,
+    issueType: issueTypeFor(issue),
+    sourceIssueId: `${repo}#${issue.number}`,
+    parentChildDeps: parseParents(body),
+    labels: labelNames,
+    ...nativeDependencies?.degraded ? { nativeDependenciesDegraded: true, nativeDependenciesError: nativeDependencies.degraded } : {},
+    raw: issue
+  };
 }
-function applyLabels(bin, repo, spawnFn, id, labels, action, extraEnv, timeoutMs) {
-  for (const rawLabel of labels) {
-    const label = rawLabel.trim();
-    if (!label)
-      continue;
-    if (action === "--add-label") {
-      try {
-        runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, action, label], spawnFn, extraEnv, timeoutMs);
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        if (!/not found/i.test(message))
-          throw error;
-        ensureStatusLabel(bin, repo, spawnFn, label, extraEnv, timeoutMs);
-        runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, action, label], spawnFn, extraEnv, timeoutMs);
-      }
-      continue;
-    }
-    try {
-      runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, action, label], spawnFn, extraEnv, timeoutMs);
-    } catch {}
-  }
+function labelNamesFor(issue) {
+  return (issue.labels ?? []).flatMap((label) => {
+    if (typeof label === "string")
+      return [label];
+    return typeof label.name === "string" ? [label.name] : [];
+  });
 }
-async function applyIssueUpdate(bin, repo, spawnFn, id, update, projects, runningAssignee, issueUpdates, extraEnv, timeoutMs) {
-  if (update.status) {
-    await applyIssueStatus(bin, repo, spawnFn, id, update.status, projects, runningAssignee, issueUpdates, extraEnv, timeoutMs);
-  }
-  if (update.comment?.trim() && shouldWriteIssueUpdate(issueUpdates, update.status)) {
-    if (isRigStickyStatusComment(update.comment)) {
-      upsertRigStickyComment(bin, repo, spawnFn, String(id), update.comment, extraEnv, timeoutMs);
-    } else {
-      runGhVoid(bin, ["issue", "comment", String(id), "--repo", repo, "--body", update.comment], spawnFn, extraEnv, timeoutMs);
-    }
-  }
-  const editArgs = ["issue", "edit", String(id), "--repo", repo];
-  if (update.title?.trim()) {
-    editArgs.push("--title", update.title.trim());
-  }
-  const nextBody = update.metadata ? updateRigOwnedMetadataBlock(update.body ?? fetchIssueBody(bin, repo, spawnFn, id, extraEnv, timeoutMs) ?? "", update.metadata) : update.body;
-  if (nextBody !== undefined) {
-    editArgs.push("--body", nextBody);
-  }
-  if (editArgs.length > 5) {
-    runGhVoid(bin, editArgs, spawnFn, extraEnv, timeoutMs);
+function yamlScalar(value) {
+  if (Array.isArray(value)) {
+    return value.length === 0 ? "[]" : `
+${value.map((entry) => `  - ${String(entry)}`).join(`
+`)}`;
   }
+  if (value && typeof value === "object")
+    return JSON.stringify(value);
+  return String(value);
 }
-function createGitHubIssuesTaskSource(opts) {
-  const bin = opts.ghBinary ?? "gh";
-  const state = opts.state ?? "open";
-  const repo = `${opts.owner}/${opts.repo}`;
-  const spawnFn = opts.spawn ?? spawnSync;
-  const timeoutMs = Math.max(1000, Math.trunc(opts.timeoutMs ?? DEFAULT_GH_TIMEOUT_MS));
-  const listLimit = Math.max(1, Math.trunc(opts.listLimit ?? DEFAULT_GITHUB_ISSUE_LIST_LIMIT));
-  const issueUpdates = issueUpdatesMode(opts.issueUpdates);
-  async function issueToTaskWithOptionalNativeDependencies(issue, env) {
-    if (!opts.useNativeDependencies)
-      return issueToTask(issue, repo);
-    const nativeDependencies = await readNativeDependenciesForIssue({
-      issue,
-      repo,
-      fetchGraphQL: ghGraphQLFetch(bin, spawnFn, env, timeoutMs)
-    });
-    return issueToTask(issue, repo, nativeDependencies);
+function updateRigOwnedMetadataBlock(body, metadata) {
+  const rendered = [
+    RIG_METADATA_START,
+    ...Object.entries(metadata).map(([key, value]) => Array.isArray(value) ? `${key}:${yamlScalar(value)}` : `${key}: ${yamlScalar(value)}`),
+    RIG_METADATA_END
+  ].join(`
+`);
+  const pattern = new RegExp(`${RIG_METADATA_START.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*[\\s\\S]*?\\s*${RIG_METADATA_END.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}`);
+  if (pattern.test(body))
+    return body.replace(pattern, rendered);
+  return body.trim().length > 0 ? `${body.trimEnd()}
+
+${rendered}
+` : `${rendered}
+`;
+}
+function buildRigStickyStatusComment(input) {
+  const lines = [
+    RIG_STATUS_COMMENT_MARKER,
+    `### Rig status: ${input.status}`,
+    "",
+    input.summary
+  ];
+  if (input.runId)
+    lines.push("", `- Run: ${input.runId}`);
+  if (input.prUrl)
+    lines.push(`- PR: ${input.prUrl}`);
+  for (const detail of input.details ?? [])
+    lines.push(`- ${detail}`);
+  return lines.join(`
+`);
+}
+function isRigStickyStatusComment(body) {
+  return body.includes(RIG_STATUS_COMMENT_MARKER);
+}
+function ghSpawnOptions(extraEnv, timeoutMs) {
+  const env = {
+    ...process.env,
+    ...process.env.GH_TOKEN !== undefined ? { GH_TOKEN: process.env.GH_TOKEN } : {},
+    ...process.env.GITHUB_TOKEN !== undefined ? { GITHUB_TOKEN: process.env.GITHUB_TOKEN } : {},
+    ...process.env.RIG_GITHUB_TOKEN !== undefined ? { RIG_GITHUB_TOKEN: process.env.RIG_GITHUB_TOKEN } : {}
+  };
+  for (const [key, value] of Object.entries(extraEnv ?? {})) {
+    if (value === undefined)
+      delete env[key];
+    else
+      env[key] = value;
   }
   return {
-    id: "std:github-issues",
-    kind: "github-issues",
-    async list() {
-      const labelArg = opts.labels && opts.labels.length > 0 ? ["--label", opts.labels.join(",")] : [];
-      const assigneeArg = opts.assignee?.trim() ? ["--assignee", opts.assignee.trim()] : [];
-      const args = [
-        "issue",
-        "list",
-        "--repo",
-        repo,
-        ...labelArg,
-        ...assigneeArg,
-        "--state",
-        state,
-        "--limit",
-        String(listLimit),
-        "--json",
-        "number,title,body,labels,state,url,assignees,id"
-      ];
-      const env = await resolveCredentialEnv(opts, "selected-repo");
-      const rawIssues = runGh(bin, args, spawnFn, env, timeoutMs);
-      if (rawIssues.length >= listLimit) {
-        throw new Error(`GitHub issue list for ${repo} reached the configured limit (${listLimit}); refusing to silently truncate matching issues. Increase taskSource.options.listLimit or narrow labels/state/assignee.`);
-      }
-      const issues = rawIssues.filter((issue) => !issue.pull_request);
-      return Promise.all(issues.map((issue) => issueToTaskWithOptionalNativeDependencies(issue, env)));
-    },
-    async get(id) {
-      const env = await resolveCredentialEnv(opts, "selected-repo");
-      let issue;
-      try {
-        issue = runGh(bin, [
-          "issue",
-          "view",
-          String(id),
-          "--repo",
-          repo,
-          "--json",
-          "number,title,body,labels,state,url,assignees,id"
-        ], spawnFn, env, timeoutMs);
-      } catch (error) {
-        const detail = error instanceof Error ? error.message : String(error);
-        if (/could not resolve to (an? )?(issue|pullrequest)|no issues? (found|matched)|404 not found|gh: not found|gh issue view\b[\s\S]*failed \(exit \d+\): not found\b/i.test(detail)) {
-          return;
-        }
-        throw new Error(`Failed to read task ${id} from GitHub repo ${repo}: ${detail}`);
-      }
-      return issueToTaskWithOptionalNativeDependencies(issue, env);
-    },
-    async updateStatus(id, status) {
-      const env = await resolveCredentialEnv(opts, "selected-repo");
-      await applyIssueStatus(bin, repo, spawnFn, id, status, opts.projects, opts.assignee, issueUpdates, env, timeoutMs);
-      notifyTaskChanged(opts.onTaskChanged, repo, id, status);
-    },
-    async updateTask(id, update) {
-      const env = await resolveCredentialEnv(opts, "selected-repo");
-      await applyIssueUpdate(bin, repo, spawnFn, id, update, opts.projects, opts.assignee, issueUpdates, env, timeoutMs);
-      notifyTaskChanged(opts.onTaskChanged, repo, id, update.status);
-    },
-    async addLabels(id, labels) {
-      const env = await resolveCredentialEnv(opts, "selected-repo");
-      applyLabels(bin, repo, spawnFn, id, labels, "--add-label", env, timeoutMs);
-      notifyTaskChanged(opts.onTaskChanged, repo, id);
-    },
-    async removeLabels(id, labels) {
-      const env = await resolveCredentialEnv(opts, "selected-repo");
-      applyLabels(bin, repo, spawnFn, id, labels, "--remove-label", env, timeoutMs);
-      notifyTaskChanged(opts.onTaskChanged, repo, id);
-    },
-    async createIssue(input) {
-      const env = await resolveCredentialEnv(opts, "selected-repo");
-      const body = input.body ?? "";
-      const args = [
-        "api",
-        "-X",
-        "POST",
-        `repos/${repo}/issues`,
-        "-f",
-        `title=${input.title}`,
-        "-f",
-        `body=${body}`,
-        ...(input.labels ?? []).flatMap((label) => ["-f", `labels[]=${label}`])
-      ];
-      const issue = runGh(bin, args, spawnFn, env, timeoutMs);
-      notifyTaskChanged(opts.onTaskChanged, repo, String(issue.number));
-      return issueToTask({ ...issue, body: issue.body ?? body }, repo);
-    },
-    async create(input) {
-      const env = await resolveCredentialEnv(opts, "selected-repo");
-      const body = bodyForCreatedTask(input);
-      const args = [
-        "api",
-        "-X",
-        "POST",
-        `repos/${repo}/issues`,
-        "-f",
-        `title=${input.title}`,
-        "-f",
-        `body=${body}`,
-        "-f",
-        "labels[]=rig:generated"
-      ];
-      const issue = runGh(bin, args, spawnFn, env, timeoutMs);
-      notifyTaskChanged(opts.onTaskChanged, repo, String(issue.number));
-      return issueToTask({ ...issue, body: issue.body ?? body }, repo);
-    },
-    async getIssueBody(id) {
-      const env = await resolveCredentialEnv(opts, "selected-repo");
-      return fetchIssueBody(bin, repo, spawnFn, id, env, timeoutMs);
-    }
+    encoding: "utf-8",
+    timeout: timeoutMs,
+    env
   };
 }
-
-// packages/standard-plugin/src/files-source.ts
-import { readFileSync as readFileSync2, readdirSync, existsSync as existsSync2, statSync, writeFileSync } from "fs";
-import { join, basename, isAbsolute, resolve as resolve2 } from "path";
-var DEFAULT_PATTERN = /\.(task\.)?json$/;
-function readTaskFile(file, pattern) {
-  const raw = JSON.parse(readFileSync2(file, "utf-8"));
-  const inferredId = basename(file).replace(pattern, "");
-  const labels = Array.isArray(raw.labels) ? raw.labels.filter((label) => typeof label === "string") : [];
-  const scope = labels.filter((label) => label.startsWith("scope:")).map((label) => label.slice("scope:".length));
-  const validators = labels.filter((label) => label.startsWith("validator:")).map((label) => label.slice("validator:".length));
-  const roleLabel = labels.find((label) => label.startsWith("role:"));
-  return {
-    id: raw["id"] ?? inferredId,
-    deps: raw["deps"] ?? raw["depends_on"] ?? [],
-    status: raw["status"] ?? "ready",
-    ...scope.length > 0 ? { scope } : {},
-    ...roleLabel ? { role: roleLabel.slice("role:".length) } : {},
-    ...validators.length > 0 ? { validators, validation: validators } : {},
-    ...raw
+function credentialEnv(token) {
+  const clean = token?.trim() ?? "";
+  if (clean)
+    return { GH_TOKEN: clean, GITHUB_TOKEN: clean, RIG_GITHUB_TOKEN: clean };
+  return { GH_TOKEN: undefined, GITHUB_TOKEN: undefined, RIG_GITHUB_TOKEN: undefined };
+}
+async function resolveCredentialEnv(opts, purpose) {
+  if (!opts.credentialProvider)
+    return;
+  const input = {
+    owner: opts.owner,
+    repo: opts.repo,
+    workspaceId: opts.workspaceId ?? `${opts.owner}/${opts.repo}`,
+    ...opts.userId ? { userId: opts.userId } : {},
+    purpose
   };
+  const resolved = await opts.credentialProvider.resolveGitHubToken(input);
+  return credentialEnv(resolved.token);
 }
-function createFilesTaskSource(opts) {
-  const pattern = opts.pattern ?? DEFAULT_PATTERN;
-  const configured = opts.path ?? opts.dir;
-  if (!configured) {
-    throw new Error("createFilesTaskSource: either `path` or `dir` must be provided");
+function tokenDiagnostic(value) {
+  const clean = value?.trim() ?? "";
+  return clean ? `present(len=${clean.length})` : "missing";
+}
+function runGh(bin, args, spawn, extraEnv, timeoutMs) {
+  const options = ghSpawnOptions(extraEnv, timeoutMs);
+  const res = spawn(bin, [...args], options);
+  assertGhSuccess(args, res, options.env);
+  if (!res.stdout || res.stdout.trim() === "")
+    return [];
+  return JSON.parse(res.stdout);
+}
+function runGhVoid(bin, args, spawn, extraEnv, timeoutMs) {
+  const options = ghSpawnOptions(extraEnv, timeoutMs);
+  const res = spawn(bin, [...args], options);
+  assertGhSuccess(args, res, options.env);
+}
+function assertGhSuccess(args, res, env) {
+  if (res.error) {
+    const msg = res.error.message ?? String(res.error);
+    throw new Error(`gh CLI not available \u2014 install gh (brew install gh / apt install gh): ${msg}`);
   }
-  const directory = isAbsolute(configured) ? configured : resolve2(opts.projectRoot ?? process.cwd(), configured);
-  const findTaskFile = (id) => {
-    if (!existsSync2(directory))
-      return;
-    for (const name of readdirSync(directory)) {
-      if (!pattern.test(name))
+  if (res.status !== 0) {
+    throw new Error(`gh ${args.join(" ")} failed (exit ${res.status}): ${res.stderr}
+[rig gh env:standard-plugin] GH_TOKEN=${tokenDiagnostic(env.GH_TOKEN)} GITHUB_TOKEN=${tokenDiagnostic(env.GITHUB_TOKEN)} RIG_GITHUB_TOKEN=${tokenDiagnostic(env.RIG_GITHUB_TOKEN)}`);
+  }
+}
+var DEFAULT_PROJECT_STATUSES = {
+  todo: "Todo",
+  running: "In Progress",
+  prOpen: "In Review",
+  ciFixing: "In Review",
+  merging: "In Review",
+  done: "Done",
+  needsAttention: "Needs Attention"
+};
+function asProjectRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function projectString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function projectLifecycleStatusForTaskStatus(status) {
+  const normalized = status?.trim().toLowerCase().replace(/[-\s]+/g, "_");
+  switch (normalized) {
+    case "draft":
+    case "open":
+    case "queued":
+    case "ready":
+      return "todo";
+    case "running":
+    case "in_progress":
+      return "running";
+    case "under_review":
+    case "review":
+    case "pr_open":
+      return "prOpen";
+    case "ci_fixing":
+    case "fixing":
+      return "ciFixing";
+    case "merging":
+    case "merge":
+      return "merging";
+    case "closed":
+    case "completed":
+    case "done":
+      return "done";
+    case "blocked":
+    case "cancelled":
+    case "failed":
+    case "needs_attention":
+      return "needsAttention";
+    default:
+      return null;
+  }
+}
+function ghGraphQLFetch(bin, spawnFn, extraEnv, timeoutMs) {
+  return async (query, variables) => {
+    const args = ["api", "graphql", "-f", `query=${query}`];
+    for (const [key, value] of Object.entries(variables)) {
+      if (value === undefined || value === null)
         continue;
-      const p = join(directory, name);
-      try {
-        if (!statSync(p).isFile())
-          continue;
-        if (readTaskFile(p, pattern).id === id)
-          return p;
-      } catch {}
+      args.push("-f", `${key}=${String(value)}`);
     }
-    return;
+    const response = runGh(bin, args, spawnFn, extraEnv, timeoutMs);
+    return asProjectRecord(response)?.data ?? response;
   };
-  const applyUpdate = (id, update) => {
-    const file = findTaskFile(id);
-    if (!file) {
-      throw new Error(`files task not found: ${id}`);
+}
+function issueNodeIdFor(issue) {
+  const id = issue.id ?? issue.nodeId ?? issue.node_id;
+  return typeof id === "string" && id.trim().length > 0 ? id.trim() : null;
+}
+function nativeIssueDependencyRef(value, currentRepo) {
+  const record = asProjectRecord(value);
+  const number = typeof record?.number === "number" ? String(record.number) : projectString(record?.number);
+  if (!number)
+    return null;
+  const repository = asProjectRecord(record?.repository);
+  const owner = projectString(asProjectRecord(repository?.owner)?.login);
+  const name = projectString(repository?.name);
+  if (!owner || !name || `${owner}/${name}` === currentRepo)
+    return number;
+  return `${owner}/${name}#${number}`;
+}
+function nativeDependencyRefsFrom(data, currentRepo) {
+  const issue = asProjectRecord(asProjectRecord(data)?.node);
+  const blockedBy = asProjectRecord(issue?.blockedBy);
+  const nodes = Array.isArray(blockedBy?.nodes) ? blockedBy.nodes : [];
+  return [...new Set(nodes.flatMap((node) => {
+    const ref = nativeIssueDependencyRef(node, currentRepo);
+    return ref ? [ref] : [];
+  }))];
+}
+async function readNativeDependenciesForIssue(input) {
+  const issueId = issueNodeIdFor(input.issue);
+  if (!issueId)
+    return { deps: [], degraded: "GitHub issue node id is unavailable." };
+  const query = `
+    query RigIssueNativeDependencies($issueId: ID!) {
+      node(id: $issueId) {
+        ... on Issue {
+          blockedBy(first: 100) {
+            nodes {
+              number
+              repository { name owner { login } }
+            }
+          }
+        }
+      }
     }
-    const raw = JSON.parse(readFileSync2(file, "utf-8"));
-    if (update.status)
-      raw.status = update.status;
-    if (update.title !== undefined)
-      raw.title = update.title;
-    if (update.body !== undefined)
-      raw.body = update.body;
-    if (update.comment?.trim()) {
-      const existing = Array.isArray(raw.comments) ? raw.comments : [];
-      raw.comments = [
-        ...existing,
-        {
-          body: update.comment,
-          createdAt: new Date().toISOString(),
-          source: "rig"
+  `;
+  try {
+    return {
+      deps: nativeDependencyRefsFrom(await input.fetchGraphQL(query, { issueId }, "gh-cli"), input.repo)
+    };
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return { deps: [], degraded: detail };
+  }
+}
+function formatIssueReference(ref) {
+  const clean = ref.trim().replace(/^#/, "");
+  return /^\d+$/.test(clean) ? `#${clean}` : clean;
+}
+function appendReferenceLines(body, deps, parents) {
+  const lines = [];
+  const cleanDeps = (deps ?? []).map(formatIssueReference).filter((ref) => ref.length > 0);
+  const cleanParents = (parents ?? []).map(formatIssueReference).filter((ref) => ref.length > 0);
+  if (cleanDeps.length > 0)
+    lines.push(`depends-on: ${cleanDeps.join(", ")}`);
+  if (cleanParents.length > 0)
+    lines.push(`parents: ${cleanParents.join(", ")}`);
+  if (lines.length === 0)
+    return body;
+  return body.trim().length > 0 ? `${body.trimEnd()}
+
+${lines.join(`
+`)}` : lines.join(`
+`);
+}
+function bodyForCreatedTask(input) {
+  const metadata = { ...input.metadata ?? {} };
+  if (input.deps && input.deps.length > 0)
+    metadata["depends-on"] = input.deps.map(formatIssueReference);
+  if (input.parents && input.parents.length > 0)
+    metadata.parents = input.parents.map(formatIssueReference);
+  return updateRigOwnedMetadataBlock(appendReferenceLines(input.body, input.deps, input.parents), metadata);
+}
+function projectStatusFieldFrom(data, projectId) {
+  const fields = asProjectRecord(asProjectRecord(asProjectRecord(data)?.node)?.fields)?.nodes;
+  for (const node of Array.isArray(fields) ? fields : []) {
+    const record = asProjectRecord(node);
+    if (projectString(record?.name)?.toLowerCase() !== "status")
+      continue;
+    const id = projectString(record?.id);
+    if (!id)
+      continue;
+    const options = Array.isArray(record?.options) ? record.options.flatMap((option) => {
+      const optionRecord = asProjectRecord(option);
+      const optionId = projectString(optionRecord?.id);
+      const name = projectString(optionRecord?.name);
+      return optionId && name ? [{ id: optionId, name }] : [];
+    }) : [];
+    return { id, name: "Status", options };
+  }
+  throw new Error(`GitHub Project ${projectId} does not expose a Status single-select field.`);
+}
+async function resolveProjectStatusField(input) {
+  const query = `
+    query RigProjectStatusField($projectId: ID!) {
+      node(id: $projectId) {
+        ... on ProjectV2 {
+          fields(first: 50) {
+            nodes {
+              ... on ProjectV2FieldCommon { id name }
+              ... on ProjectV2SingleSelectField { id name options { id name } }
+            }
+          }
         }
-      ];
+      }
     }
-    writeFileSync(file, `${JSON.stringify(raw, null, 2)}
-`, "utf-8");
-  };
-  return {
-    id: "std:files",
-    kind: "files",
-    async list() {
-      if (!existsSync2(directory))
-        return [];
-      const out = [];
-      for (const name of readdirSync(directory)) {
-        if (!pattern.test(name))
-          continue;
-        const p = join(directory, name);
-        try {
-          if (!statSync(p).isFile())
-            continue;
-          out.push(readTaskFile(p, pattern));
-        } catch (err) {
-          console.warn(`[files-source] skipped ${name}: ${err.message}`);
+  `;
+  return projectStatusFieldFrom(await input.fetchGraphQL(query, { projectId: input.projectId }, input.token), input.projectId);
+}
+async function ensureIssueProjectItem(input) {
+  const query = `
+    query RigFindProjectIssueItem($projectId: ID!) {
+      node(id: $projectId) {
+        ... on ProjectV2 {
+          items(first: 100) { nodes { id content { ... on Issue { id } } } }
         }
       }
-      return out;
-    },
-    async get(id) {
-      const all = await this.list();
-      return all.find((t) => t.id === id);
-    },
-    async updateStatus(id, status) {
-      applyUpdate(id, { status });
-    },
-    async updateTask(id, update) {
-      applyUpdate(id, update);
     }
-  };
-}
-
-// packages/standard-plugin/src/drift/plugin.ts
-import { Schema } from "effect";
-import { StageMutation as StageMutationSchema } from "@rig/contracts";
-
-// packages/standard-plugin/src/drift/detect.ts
-import { existsSync as existsSync3 } from "fs";
-import { readdir, readFile, stat } from "fs/promises";
-import { basename as basename2, extname, relative, resolve as resolve3 } from "path";
-
-// packages/standard-plugin/src/drift/extract-refs.ts
-var INLINE_CODE = /`([^`\n]+)`/g;
-var MARKDOWN_LINK = /\[[^\]]+\]\(([^)\s]+)\)/g;
-var SYMBOL_REF = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)?$/;
-var PATH_REF = /^(?:\.\.?\/)?(?:[A-Za-z0-9_.-]+\/)+[A-Za-z0-9_.-]+$|^[A-Za-z0-9_.-]+\.(?:ts|tsx|js|jsx|mjs|cjs|json|md|mdx|css|scss|html|yml|yaml|toml|rs|go|py|rb|java|kt|swift|c|cc|cpp|h|hpp)$/;
-function stripFenceLines(markdown) {
-  const lines = markdown.split(/\r?\n/);
-  let fenced = false;
-  return lines.map((line) => {
-    if (/^\s*(```|~~~)/.test(line)) {
-      fenced = !fenced;
-      return "";
+  `;
+  const data = await input.fetchGraphQL(query, { projectId: input.projectId }, input.token);
+  const nodes = asProjectRecord(asProjectRecord(asProjectRecord(data)?.node)?.items)?.nodes;
+  for (const node of Array.isArray(nodes) ? nodes : []) {
+    const record = asProjectRecord(node);
+    const content = asProjectRecord(record?.content);
+    if (projectString(content?.id) === input.issueNodeId) {
+      const id2 = projectString(record?.id);
+      if (id2)
+        return { id: id2, created: false };
     }
-    return fenced ? "" : line;
-  });
+  }
+  const mutation = `
+    mutation RigAddIssueToProject($projectId: ID!, $contentId: ID!) {
+      addProjectV2ItemById(input: { projectId: $projectId, contentId: $contentId }) { item { id } }
+    }
+  `;
+  const created = await input.fetchGraphQL(mutation, { projectId: input.projectId, contentId: input.issueNodeId }, input.token);
+  const addResult = asProjectRecord(asProjectRecord(created)?.addProjectV2ItemById);
+  const id = projectString(asProjectRecord(addResult?.item)?.id);
+  if (!id)
+    throw new Error("GitHub Project item creation did not return an item id.");
+  return { id, created: true };
 }
-function normalizeToken(raw) {
-  return raw.trim().replace(/^['"]|['"]$/g, "").replace(/[),.;:]+$/g, "").replace(/#L\d+(?:-L\d+)?$/i, "");
+async function updateIssueProjectStatus(input) {
+  const mutation = `
+    mutation RigUpdateProjectStatus($projectId: ID!, $itemId: ID!, $fieldId: ID!, $optionId: String!) {
+      updateProjectV2ItemFieldValue(input: {
+        projectId: $projectId,
+        itemId: $itemId,
+        fieldId: $fieldId,
+        value: { singleSelectOptionId: $optionId }
+      }) { projectV2Item { id } }
+    }
+  `;
+  await input.fetchGraphQL(mutation, {
+    projectId: input.projectId,
+    itemId: input.itemId,
+    fieldId: input.fieldId,
+    optionId: input.optionId
+  }, input.token);
 }
-function classifyReference(raw) {
-  if (raw.startsWith("@"))
-    return null;
-  if (PATH_REF.test(raw))
-    return "path";
-  if (SYMBOL_REF.test(raw))
-    return "symbol";
-  return null;
+function fetchIssueNodeId(bin, repo, spawnFn, id, extraEnv, timeoutMs) {
+  const issue = runGh(bin, ["issue", "view", String(id), "--repo", repo, "--json", "id"], spawnFn, extraEnv, timeoutMs);
+  return projectString(issue.id) ?? projectString(issue.nodeId) ?? projectString(issue.node_id);
 }
-function pushReference(refs, seen, raw, line) {
-  const value = normalizeToken(raw);
-  if (!value)
-    return;
-  const kind = classifyReference(value);
-  if (!kind)
+async function syncGitHubProjectStatus(bin, repo, spawnFn, id, status, projects, extraEnv, timeoutMs) {
+  if (!projects?.enabled)
     return;
-  const key = `${kind}:${value}:${line}`;
-  if (seen.has(key))
+  const projectId = projectString(projects.projectId);
+  if (!projectId)
+    throw new Error("GitHub Projects status sync is enabled but projectId is missing.");
+  const lifecycleStatus = projectLifecycleStatusForTaskStatus(status);
+  if (!lifecycleStatus)
     return;
-  seen.add(key);
-  refs.push({ kind, value, line });
+  const issueNodeId = fetchIssueNodeId(bin, repo, spawnFn, id, extraEnv, timeoutMs);
+  if (!issueNodeId)
+    throw new Error(`GitHub issue ${repo}#${id} did not expose a node id for Projects status sync.`);
+  const projectStatus = projectString(projects.statuses?.[lifecycleStatus]) ?? DEFAULT_PROJECT_STATUSES[lifecycleStatus];
+  const fetchGraphQL = ghGraphQLFetch(bin, spawnFn, extraEnv, timeoutMs);
+  const field = await resolveProjectStatusField({ projectId, token: "gh-cli", fetchGraphQL });
+  const option = field.options.find((candidate) => candidate.name.toLowerCase() === projectStatus.toLowerCase() || candidate.id === projectStatus);
+  if (!option)
+    throw new Error(`GitHub Project ${projectId} Status field does not contain option "${projectStatus}".`);
+  const item = await ensureIssueProjectItem({ projectId, issueNodeId, token: "gh-cli", fetchGraphQL });
+  await updateIssueProjectStatus({
+    projectId,
+    itemId: item.id,
+    fieldId: projectString(projects.statusFieldId) ?? field.id,
+    optionId: option.id,
+    token: "gh-cli",
+    fetchGraphQL
+  });
 }
-function extractDriftReferences(markdown) {
-  const refs = [];
-  const seen = new Set;
-  const lines = stripFenceLines(markdown);
-  for (const [index, line] of lines.entries()) {
-    const lineNumber = index + 1;
-    for (const match of line.matchAll(INLINE_CODE)) {
-      pushReference(refs, seen, match[1] ?? "", lineNumber);
-    }
-    for (const match of line.matchAll(MARKDOWN_LINK)) {
-      pushReference(refs, seen, match[1] ?? "", lineNumber);
-    }
+var TERMINAL_TASK_STATUSES = new Set(["closed", "completed", "merged", "cancelled", "resolved", "done"]);
+function normalizeTaskStatusToken(status) {
+  return status?.trim().toLowerCase().replace(/[-\s]+/g, "_") ?? "";
+}
+function issueUpdatesMode(value) {
+  return value === "off" || value === "minimal" || value === "lifecycle" ? value : "lifecycle";
+}
+function isTerminalTaskStatus(status) {
+  return TERMINAL_TASK_STATUSES.has(normalizeTaskStatusToken(status));
+}
+function shouldWriteIssueUpdate(mode, status) {
+  if (mode === "off")
+    return false;
+  if (mode === "lifecycle")
+    return true;
+  return isTerminalTaskStatus(status);
+}
+function isRunningStatus(status) {
+  return normalizeTaskStatusToken(status) === "running";
+}
+function assignRunningIssue(bin, repo, spawnFn, id, assignee, extraEnv, timeoutMs) {
+  runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, "--add-assignee", assignee?.trim() || "@me"], spawnFn, extraEnv, timeoutMs);
+}
+function statusLabelFor(status) {
+  switch (status) {
+    case "running":
+    case "in_progress":
+      return "in-progress";
+    case "blocked":
+      return "blocked";
+    case "ready":
+      return "ready";
+    case "under_review":
+      return "under-review";
+    case "failed":
+      return "failed";
+    case "cancelled":
+      return "cancelled";
+    case "ci_fixing":
+      return "under-review";
+    case "merging":
+      return "under-review";
+    case "needs_attention":
+      return "blocked";
+    case "closed":
+    case "completed":
+    case "open":
+      return null;
+    default:
+      throw new Error(`unsupported status: ${status}`);
   }
-  return refs;
-}
-
-// packages/standard-plugin/src/drift/git-adapter.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
-function processError(value) {
-  return value && typeof value === "object" ? value : null;
 }
-function lineCount(output) {
-  const trimmed = output.trim();
-  return trimmed ? trimmed.split(/\r?\n/).length : 0;
+function rigStatusLabelFor(status) {
+  switch (status) {
+    case "running":
+    case "in_progress":
+      return "rig:running";
+    case "under_review":
+      return "rig:pr-open";
+    case "closed":
+    case "completed":
+      return "rig:done";
+    case "ci_fixing":
+      return "rig:ci-fixing";
+    case "merging":
+      return "rig:merging";
+    case "needs_attention":
+    case "failed":
+    case "blocked":
+      return "rig:needs-attention";
+    case "ready":
+    case "cancelled":
+    case "open":
+      return null;
+    default:
+      return null;
+  }
 }
-function makeDriftGit(projectRoot) {
-  async function git(args) {
-    const result = await execFileAsync("git", [...args], {
-      cwd: projectRoot,
-      encoding: "utf8",
-      maxBuffer: 10 * 1024 * 1024
-    });
-    return String(result.stdout);
+async function applyIssueStatus(bin, repo, spawnFn, id, status, projects, runningAssignee, issueUpdates, extraEnv, timeoutMs) {
+  const targetLabel = status === "closed" || status === "completed" ? null : statusLabelFor(status);
+  const targetRigLabel = rigStatusLabelFor(status);
+  const shouldSyncLifecycle = shouldWriteIssueUpdate(issueUpdates, status);
+  for (const l of [...STATUS_LABELS, ...RIG_STATUS_LABELS]) {
+    if (targetLabel !== null && l === targetLabel)
+      continue;
+    if (targetRigLabel !== null && l === targetRigLabel)
+      continue;
+    try {
+      runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, "--remove-label", l], spawnFn, extraEnv, timeoutMs);
+    } catch {}
   }
-  async function grepCountAt(symbolOrPath, commit) {
+  for (const label of [targetLabel, targetRigLabel].filter((value) => Boolean(value))) {
     try {
-      return lineCount(await git(["grep", "-F", "-n", "-e", symbolOrPath, commit, "--"]));
+      runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, "--add-label", label], spawnFn, extraEnv, timeoutMs);
     } catch (error) {
-      const detail = processError(error);
-      if (detail?.code === 1)
-        return 0;
-      throw error;
-    }
-  }
-  return {
-    async lastCommitTouching(path) {
-      const commit = (await git(["log", "-n", "1", "--format=%H", "--", path])).trim();
-      return commit || "HEAD";
-    },
-    async grepCount(symbolOrPath) {
-      return grepCountAt(symbolOrPath, "HEAD");
-    },
-    async grepCountAtCommit(symbolOrPath, commit) {
-      return grepCountAt(symbolOrPath, commit);
-    },
-    async wasRenamed(symbolOrPath, sinceCommit) {
-      if (!symbolOrPath.includes("/") && !symbolOrPath.includes("."))
-        return false;
-      try {
-        const output = await git(["log", "--name-status", "--format=", `${sinceCommit}..HEAD`]);
-        return output.split(/\r?\n/).some((line) => {
-          const match = line.match(/^R\d*\s+(.+?)\s+(.+)$/);
-          return Boolean(match && (match[1] === symbolOrPath || match[2] === symbolOrPath));
-        });
-      } catch (error) {
-        const detail = processError(error);
-        if (detail?.code === 128)
-          return false;
+      const message = error instanceof Error ? error.message : String(error);
+      if (!/not found/i.test(message)) {
         throw error;
       }
+      ensureStatusLabel(bin, repo, spawnFn, label, extraEnv, timeoutMs);
+      runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, "--add-label", label], spawnFn, extraEnv, timeoutMs);
     }
-  };
-}
-
-// packages/standard-plugin/src/drift/detect.ts
-var DEFAULT_IGNORED_DIRS = {
-  ".git": true,
-  node_modules: true,
-  dist: true,
-  build: true,
-  coverage: true,
-  ".next": true,
-  vendor: true
-};
-var SOURCE_EXTENSIONS = {
-  ".ts": true,
-  ".tsx": true,
-  ".js": true,
-  ".jsx": true,
-  ".mjs": true,
-  ".cjs": true,
-  ".rs": true,
-  ".go": true,
-  ".py": true,
-  ".rb": true,
-  ".java": true,
-  ".kt": true,
-  ".swift": true,
-  ".c": true,
-  ".cc": true,
-  ".cpp": true,
-  ".h": true,
-  ".hpp": true,
-  ".json": true,
-  ".toml": true,
-  ".yml": true,
-  ".yaml": true
-};
-function globLikeMatch(path, pattern) {
-  if (pattern === path)
-    return true;
-  if (pattern.startsWith("**/*"))
-    return path.endsWith(pattern.slice(4));
-  if (pattern.endsWith("/**"))
-    return path.startsWith(pattern.slice(0, -3));
-  if (pattern.includes("*")) {
-    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-    return new RegExp(`^${escaped}$`).test(path);
   }
-  return path.startsWith(pattern);
-}
-function isDefaultDoc(path) {
-  const lower = basename2(path).toLowerCase();
-  return (path.endsWith(".md") || path.endsWith(".mdx")) && !lower.startsWith("changelog") && !lower.includes("generated");
-}
-function isIgnored(path, patterns) {
-  return (patterns ?? []).some((pattern) => globLikeMatch(path, pattern));
-}
-async function collectFiles(root, options) {
-  const files = [];
-  async function visit(dir) {
-    for (const entry of await readdir(dir, { withFileTypes: true })) {
-      if (entry.isDirectory() && DEFAULT_IGNORED_DIRS[entry.name])
-        continue;
-      const absolute = resolve3(dir, entry.name);
-      const rel = relative(root, absolute).replace(/\\/g, "/");
-      if (isIgnored(rel, options.ignore))
-        continue;
-      if (entry.isDirectory()) {
-        await visit(absolute);
-        continue;
-      }
-      if (!entry.isFile())
-        continue;
-      if (options.docs) {
-        const matchesConfigured = options.patterns && options.patterns.length > 0 ? options.patterns.some((pattern) => globLikeMatch(rel, pattern)) : isDefaultDoc(rel);
-        if (matchesConfigured)
-          files.push(rel);
-        continue;
-      }
-      if (SOURCE_EXTENSIONS[extname(entry.name)])
-        files.push(rel);
+  if (isRunningStatus(status)) {
+    assignRunningIssue(bin, repo, spawnFn, id, runningAssignee, extraEnv, timeoutMs);
+    if (shouldSyncLifecycle) {
+      upsertRigStickyComment(bin, repo, spawnFn, String(id), buildRigStickyStatusComment({
+        status: "running",
+        summary: "Rig run started."
+      }), extraEnv, timeoutMs);
     }
   }
-  await visit(root);
-  return files.sort();
+  if (shouldSyncLifecycle) {
+    await syncGitHubProjectStatus(bin, repo, spawnFn, id, status, projects, extraEnv, timeoutMs);
+  }
+  if (status === "closed" || status === "completed") {
+    runGhVoid(bin, ["issue", "close", String(id), "--repo", repo], spawnFn, extraEnv, timeoutMs);
+  }
 }
-async function sourceReferenceCount(projectRoot, reference, docPath) {
-  if (reference.kind === "path")
-    return existsSync3(resolve3(projectRoot, reference.value)) ? 1 : 0;
-  let count = 0;
-  const sourceFiles = await collectFiles(projectRoot, { docs: false });
-  for (const sourceFile of sourceFiles) {
-    if (sourceFile === docPath)
-      continue;
-    const text = await readFile(resolve3(projectRoot, sourceFile), "utf8").catch(() => "");
-    if (text.includes(reference.value))
-      count += 1;
+function ensureStatusLabel(bin, repo, spawnFn, label, extraEnv, timeoutMs) {
+  try {
+    runGhVoid(bin, [
+      "label",
+      "create",
+      label,
+      "--repo",
+      repo,
+      "--color",
+      "6f42c1",
+      "--description",
+      "Task status managed by Rig"
+    ], spawnFn, extraEnv, timeoutMs);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (!/already exists/i.test(message)) {
+      throw error;
+    }
   }
-  return count;
 }
-function deletedReferenceFinding(docPath, reference) {
-  return {
-    kind: "deleted-reference",
-    docPath,
-    line: reference.line,
-    reference: reference.value,
-    detail: `Documented reference "${reference.value}" no longer exists in the source tree.`,
-    confidence: "high"
-  };
+function upsertRigStickyComment(bin, repo, spawnFn, id, body, extraEnv, timeoutMs) {
+  const comments = runGh(bin, ["api", `repos/${repo}/issues/${id}/comments`, "--paginate"], spawnFn, extraEnv, timeoutMs);
+  const existing = comments.find((comment) => typeof comment.body === "string" && comment.body.includes(RIG_STATUS_COMMENT_MARKER));
+  if (existing) {
+    runGhVoid(bin, ["api", "-X", "PATCH", `repos/${repo}/issues/comments/${existing.id}`, "-f", `body=${body}`], spawnFn, extraEnv, timeoutMs);
+    return;
+  }
+  runGhVoid(bin, ["api", "-X", "POST", `repos/${repo}/issues/${id}/comments`, "-f", `body=${body}`], spawnFn, extraEnv, timeoutMs);
 }
-function staleAnchorFinding(docPath, reference) {
-  return {
-    kind: "stale-anchor",
-    docPath,
-    line: reference.line,
-    reference: reference.value,
-    detail: `Documented path "${reference.value}" changed after this doc was last updated.`,
-    confidence: "medium"
-  };
+function notifyTaskChanged(onTaskChanged, repo, id, status) {
+  onTaskChanged?.({ repo, id, ...status ? { status } : {}, reason: "github-issue-updated" });
 }
-async function detectDeletedReferences(projectRoot, docPath, git = makeDriftGit(projectRoot)) {
-  const markdown = await readFile(resolve3(projectRoot, docPath), "utf8");
-  const docCommit = await git.lastCommitTouching(docPath);
-  const findings = [];
-  for (const reference of extractDriftReferences(markdown)) {
-    if (await sourceReferenceCount(projectRoot, reference, docPath) > 0)
-      continue;
-    if (await git.wasRenamed(reference.value, docCommit))
-      continue;
-    findings.push(deletedReferenceFinding(docPath, reference));
-  }
-  return findings;
+function fetchIssueBody(bin, repo, spawnFn, id, extraEnv, timeoutMs) {
+  const issue = runGh(bin, [
+    "issue",
+    "view",
+    String(id),
+    "--repo",
+    repo,
+    "--json",
+    "body"
+  ], spawnFn, extraEnv, timeoutMs);
+  return typeof issue.body === "string" ? issue.body : undefined;
 }
-async function detectStaleAnchors(projectRoot, docPath, git = makeDriftGit(projectRoot)) {
-  const markdown = await readFile(resolve3(projectRoot, docPath), "utf8");
-  const docCommit = await git.lastCommitTouching(docPath);
-  const findings = [];
-  for (const reference of extractDriftReferences(markdown).filter((ref) => ref.kind === "path")) {
-    if (!existsSync3(resolve3(projectRoot, reference.value)))
-      continue;
-    const sourceStat = await stat(resolve3(projectRoot, reference.value)).catch(() => null);
-    if (!sourceStat?.isFile())
+function applyLabels(bin, repo, spawnFn, id, labels, action, extraEnv, timeoutMs) {
+  for (const rawLabel of labels) {
+    const label = rawLabel.trim();
+    if (!label)
+      continue;
+    if (action === "--add-label") {
+      try {
+        runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, action, label], spawnFn, extraEnv, timeoutMs);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (!/not found/i.test(message))
+          throw error;
+        ensureStatusLabel(bin, repo, spawnFn, label, extraEnv, timeoutMs);
+        runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, action, label], spawnFn, extraEnv, timeoutMs);
+      }
       continue;
-    const sourceCommit = await git.lastCommitTouching(reference.value);
-    if (sourceCommit !== docCommit && !await git.wasRenamed(reference.value, docCommit)) {
-      findings.push(staleAnchorFinding(docPath, reference));
     }
+    try {
+      runGhVoid(bin, ["issue", "edit", String(id), "--repo", repo, action, label], spawnFn, extraEnv, timeoutMs);
+    } catch {}
   }
-  return findings;
 }
-async function detectDrift(options) {
-  const git = options.git ?? makeDriftGit(options.projectRoot);
-  const docs = await collectFiles(options.projectRoot, {
-    docs: true,
-    ...options.docsGlobs !== undefined ? { patterns: options.docsGlobs } : {},
-    ...options.ignoreGlobs !== undefined ? { ignore: options.ignoreGlobs } : {}
-  });
-  const findings = [];
-  let degraded = false;
-  for (const docPath of docs) {
-    try {
-      findings.push(...await detectDeletedReferences(options.projectRoot, docPath, git));
-      findings.push(...await detectStaleAnchors(options.projectRoot, docPath, git));
-    } catch {
-      degraded = true;
+async function applyIssueUpdate(bin, repo, spawnFn, id, update, projects, runningAssignee, issueUpdates, extraEnv, timeoutMs) {
+  if (update.status) {
+    await applyIssueStatus(bin, repo, spawnFn, id, update.status, projects, runningAssignee, issueUpdates, extraEnv, timeoutMs);
+  }
+  if (update.comment?.trim() && shouldWriteIssueUpdate(issueUpdates, update.status)) {
+    if (isRigStickyStatusComment(update.comment)) {
+      upsertRigStickyComment(bin, repo, spawnFn, String(id), update.comment, extraEnv, timeoutMs);
+    } else {
+      runGhVoid(bin, ["issue", "comment", String(id), "--repo", repo, "--body", update.comment], spawnFn, extraEnv, timeoutMs);
     }
   }
-  return {
-    generatedAt: new Date().toISOString(),
-    scanned: docs.length,
-    degraded,
-    findings
-  };
-}
-
-// packages/standard-plugin/src/drift/plugin.ts
-var DOCS_DRIFT_VALIDATOR_ID = "std:docs-drift";
-var DOCS_DRIFT_CLI_ID = "std:drift";
-var DOCS_DRIFT_STAGE_ID = "docs-drift";
-var DOCS_DRIFT_CAPABILITY_ID = "std:docs-drift-capability";
-var DOCS_DRIFT_VALIDATOR = {
-  id: DOCS_DRIFT_VALIDATOR_ID,
-  category: "regression",
-  description: "Detect documentation references that drifted from the source tree."
-};
-var DOCS_DRIFT_STAGE_MUTATION = Schema.decodeUnknownSync(StageMutationSchema)({
-  op: "insert",
-  stage: {
-    id: DOCS_DRIFT_STAGE_ID,
-    kind: "gate",
-    before: ["merge-gate"],
-    after: ["open-pr"]
-  },
-  contributedBy: DOCS_DRIFT_STAGE_ID
-});
-var DOCS_DRIFT_CLI_COMMAND = "rig drift [--docs <csv>] [--ignore <csv>] [--fail-on-drift] [--json]";
-function highConfidenceDriftFindings(report) {
-  return report.findings.filter((finding) => finding.confidence === "high");
-}
-function driftGateResult(report, mode = "enforce") {
-  const high = highConfidenceDriftFindings(report);
-  if (mode === "enforce" && high.length > 0) {
-    return { kind: "block", reason: `${high.length} high-confidence documentation drift finding(s).` };
+  const editArgs = ["issue", "edit", String(id), "--repo", repo];
+  if (update.title?.trim()) {
+    editArgs.push("--title", update.title.trim());
+  }
+  const nextBody = update.metadata ? updateRigOwnedMetadataBlock(update.body ?? fetchIssueBody(bin, repo, spawnFn, id, extraEnv, timeoutMs) ?? "", update.metadata) : update.body;
+  if (nextBody !== undefined) {
+    editArgs.push("--body", nextBody);
+  }
+  if (editArgs.length > 5) {
+    runGhVoid(bin, editArgs, spawnFn, extraEnv, timeoutMs);
   }
-  return { kind: "allow" };
 }
-function createDocsDriftGateStage(options = {}) {
-  return async (ctx) => {
-    const projectRoot = typeof ctx.metadata?.projectRoot === "string" ? ctx.metadata.projectRoot : process.cwd();
-    const report = await detectDrift({
-      projectRoot,
-      ...options.docsGlobs !== undefined ? { docsGlobs: options.docsGlobs } : {},
-      ...options.ignoreGlobs !== undefined ? { ignoreGlobs: options.ignoreGlobs } : {}
+function createGitHubIssuesTaskSource(opts) {
+  const bin = opts.ghBinary ?? "gh";
+  const state = opts.state ?? "open";
+  const repo = `${opts.owner}/${opts.repo}`;
+  const spawnFn = opts.spawn ?? spawnSync;
+  const timeoutMs = Math.max(1000, Math.trunc(opts.timeoutMs ?? DEFAULT_GH_TIMEOUT_MS));
+  const listLimit = Math.max(1, Math.trunc(opts.listLimit ?? DEFAULT_GITHUB_ISSUE_LIST_LIMIT));
+  const issueUpdates = issueUpdatesMode(opts.issueUpdates);
+  async function issueToTaskWithOptionalNativeDependencies(issue, env) {
+    if (!opts.useNativeDependencies)
+      return issueToTask(issue, repo);
+    const nativeDependencies = await readNativeDependenciesForIssue({
+      issue,
+      repo,
+      fetchGraphQL: ghGraphQLFetch(bin, spawnFn, env, timeoutMs)
     });
-    return driftGateResult(report, options.failOnDrift ? "enforce" : "observe");
-  };
-}
-async function runDocsDriftValidation(options) {
-  const report = await detectDrift(options);
-  const high = highConfidenceDriftFindings(report);
-  const passed = options.failOnDrift ? high.length === 0 : true;
-  const findingWord = report.findings.length === 1 ? "finding" : "findings";
-  return {
-    id: DOCS_DRIFT_VALIDATOR_ID,
-    passed,
-    summary: `docs drift scanned ${report.scanned} doc(s), ${report.findings.length} ${findingWord}`,
-    details: JSON.stringify(report)
-  };
-}
-function createDocsDriftValidator(options = {}) {
-  return {
-    ...DOCS_DRIFT_VALIDATOR,
-    async run(ctx) {
-      return runDocsDriftValidation({
-        projectRoot: ctx.workspaceRoot,
-        ...options.docsGlobs !== undefined ? { docsGlobs: options.docsGlobs } : {},
-        ...options.ignoreGlobs !== undefined ? { ignoreGlobs: options.ignoreGlobs } : {},
-        ...options.failOnDrift !== undefined ? { failOnDrift: options.failOnDrift } : {}
-      });
-    }
-  };
-}
-function takeOptionValue(args, index, flag) {
-  const value = args[index + 1];
-  if (!value)
-    throw new Error(`${flag} requires a value`);
-  return value;
-}
-function takeFlag(args, flag) {
-  const rest = [...args];
-  const index = rest.indexOf(flag);
-  if (index < 0)
-    return { value: false, rest };
-  rest.splice(index, 1);
-  return { value: true, rest };
-}
-function takeOption(args, flag) {
-  const rest = [...args];
-  const index = rest.indexOf(flag);
-  if (index < 0)
-    return { rest };
-  const value = rest[index + 1];
-  if (!value || value.startsWith("-"))
-    throw new Error(`${flag} requires a value.`);
-  rest.splice(index, 2);
-  return { value, rest };
-}
-function requireNoExtraArgs(args, usage) {
-  if (args.length > 0)
-    throw new Error(`Unexpected argument: ${args[0]}
-Usage: ${usage}`);
-}
-function parseCsv(value) {
-  return value?.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0) ?? [];
-}
-function driftSummary(report) {
-  const highConfidence = highConfidenceDriftFindings(report).length;
-  return { total: report.findings.length, highConfidence, degraded: report.degraded };
-}
-async function executeDrift(context, args, options = {}) {
-  const json = takeFlag(args, "--json");
-  const docs = takeOption(json.rest, "--docs");
-  const ignore = takeOption(docs.rest, "--ignore");
-  const failOnDrift = takeFlag(ignore.rest, "--fail-on-drift");
-  requireNoExtraArgs(failOnDrift.rest, "rig drift [--docs <csv>] [--ignore <csv>] [--fail-on-drift] [--json]");
-  const docsGlobs = parseCsv(docs.value);
-  const ignoreGlobs = parseCsv(ignore.value);
-  const effectiveDocsGlobs = docsGlobs.length > 0 ? docsGlobs : options.docsGlobs;
-  const effectiveIgnoreGlobs = ignoreGlobs.length > 0 ? ignoreGlobs : options.ignoreGlobs;
-  const effectiveFailOnDrift = failOnDrift.value || options.failOnDrift === true;
-  const report = await detectDrift({
-    projectRoot: context.projectRoot,
-    ...effectiveDocsGlobs !== undefined ? { docsGlobs: effectiveDocsGlobs } : {},
-    ...effectiveIgnoreGlobs !== undefined ? { ignoreGlobs: effectiveIgnoreGlobs } : {}
-  });
-  const failed = effectiveFailOnDrift && highConfidenceDriftFindings(report).length > 0;
-  const details = { report, summary: driftSummary(report), failOnDrift: effectiveFailOnDrift, failed };
-  if (context.outputMode === "text") {
-    if (json.value)
-      console.log(JSON.stringify(details, null, 2));
-    else
-      console.log(report.findings.length === 0 ? `No drift findings across ${report.scanned} documents.` : report.findings.map((finding) => `${finding.docPath}:${finding.line ?? "?"}	${finding.kind}	${finding.confidence}	${finding.detail}`).join(`
-`));
+    return issueToTask(issue, repo, nativeDependencies);
   }
-  return { ok: !failed, group: "drift", command: "scan", details };
+  return {
+    id: "std:github-issues",
+    kind: "github-issues",
+    async list() {
+      const labelArg = opts.labels && opts.labels.length > 0 ? ["--label", opts.labels.join(",")] : [];
+      const assigneeArg = opts.assignee?.trim() ? ["--assignee", opts.assignee.trim()] : [];
+      const args = [
+        "issue",
+        "list",
+        "--repo",
+        repo,
+        ...labelArg,
+        ...assigneeArg,
+        "--state",
+        state,
+        "--limit",
+        String(listLimit),
+        "--json",
+        "number,title,body,labels,state,url,assignees,id"
+      ];
+      const env = await resolveCredentialEnv(opts, "selected-repo");
+      const rawIssues = runGh(bin, args, spawnFn, env, timeoutMs);
+      if (rawIssues.length >= listLimit) {
+        throw new Error(`GitHub issue list for ${repo} reached the configured limit (${listLimit}); refusing to silently truncate matching issues. Increase taskSource.options.listLimit or narrow labels/state/assignee.`);
+      }
+      const issues = rawIssues.filter((issue) => !issue.pull_request);
+      return Promise.all(issues.map((issue) => issueToTaskWithOptionalNativeDependencies(issue, env)));
+    },
+    async get(id) {
+      const env = await resolveCredentialEnv(opts, "selected-repo");
+      let issue;
+      try {
+        issue = runGh(bin, [
+          "issue",
+          "view",
+          String(id),
+          "--repo",
+          repo,
+          "--json",
+          "number,title,body,labels,state,url,assignees,id"
+        ], spawnFn, env, timeoutMs);
+      } catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        if (/could not resolve to (an? )?(issue|pullrequest)|no issues? (found|matched)|404 not found|gh: not found|gh issue view\b[\s\S]*failed \(exit \d+\): not found\b/i.test(detail)) {
+          return;
+        }
+        throw new Error(`Failed to read task ${id} from GitHub repo ${repo}: ${detail}`);
+      }
+      return issueToTaskWithOptionalNativeDependencies(issue, env);
+    },
+    async updateStatus(id, status) {
+      const env = await resolveCredentialEnv(opts, "selected-repo");
+      await applyIssueStatus(bin, repo, spawnFn, id, status, opts.projects, opts.assignee, issueUpdates, env, timeoutMs);
+      notifyTaskChanged(opts.onTaskChanged, repo, id, status);
+    },
+    async updateTask(id, update) {
+      const env = await resolveCredentialEnv(opts, "selected-repo");
+      await applyIssueUpdate(bin, repo, spawnFn, id, update, opts.projects, opts.assignee, issueUpdates, env, timeoutMs);
+      notifyTaskChanged(opts.onTaskChanged, repo, id, update.status);
+    },
+    async addLabels(id, labels) {
+      const env = await resolveCredentialEnv(opts, "selected-repo");
+      applyLabels(bin, repo, spawnFn, id, labels, "--add-label", env, timeoutMs);
+      notifyTaskChanged(opts.onTaskChanged, repo, id);
+    },
+    async removeLabels(id, labels) {
+      const env = await resolveCredentialEnv(opts, "selected-repo");
+      applyLabels(bin, repo, spawnFn, id, labels, "--remove-label", env, timeoutMs);
+      notifyTaskChanged(opts.onTaskChanged, repo, id);
+    },
+    async createIssue(input) {
+      const env = await resolveCredentialEnv(opts, "selected-repo");
+      const body = input.body ?? "";
+      const args = [
+        "api",
+        "-X",
+        "POST",
+        `repos/${repo}/issues`,
+        "-f",
+        `title=${input.title}`,
+        "-f",
+        `body=${body}`,
+        ...(input.labels ?? []).flatMap((label) => ["-f", `labels[]=${label}`])
+      ];
+      const issue = runGh(bin, args, spawnFn, env, timeoutMs);
+      notifyTaskChanged(opts.onTaskChanged, repo, String(issue.number));
+      return issueToTask({ ...issue, body: issue.body ?? body }, repo);
+    },
+    async create(input) {
+      const env = await resolveCredentialEnv(opts, "selected-repo");
+      const body = bodyForCreatedTask(input);
+      const args = [
+        "api",
+        "-X",
+        "POST",
+        `repos/${repo}/issues`,
+        "-f",
+        `title=${input.title}`,
+        "-f",
+        `body=${body}`,
+        "-f",
+        "labels[]=rig:generated"
+      ];
+      const issue = runGh(bin, args, spawnFn, env, timeoutMs);
+      notifyTaskChanged(opts.onTaskChanged, repo, String(issue.number));
+      return issueToTask({ ...issue, body: issue.body ?? body }, repo);
+    },
+    async getIssueBody(id) {
+      const env = await resolveCredentialEnv(opts, "selected-repo");
+      return fetchIssueBody(bin, repo, spawnFn, id, env, timeoutMs);
+    }
+  };
 }
-function createDocsDriftRuntimeCliCommand(options = {}) {
+
+// packages/standard-plugin/src/files-source.ts
+import { readFileSync as readFileSync2, readdirSync, existsSync as existsSync2, statSync, writeFileSync } from "fs";
+import { join, basename, isAbsolute, resolve as resolve2 } from "path";
+var DEFAULT_PATTERN = /\.(task\.)?json$/;
+function readTaskFile(file, pattern) {
+  const raw = JSON.parse(readFileSync2(file, "utf-8"));
+  const inferredId = basename(file).replace(pattern, "");
+  const labels = Array.isArray(raw.labels) ? raw.labels.filter((label) => typeof label === "string") : [];
+  const scope = labels.filter((label) => label.startsWith("scope:")).map((label) => label.slice("scope:".length));
+  const validators = labels.filter((label) => label.startsWith("validator:")).map((label) => label.slice("validator:".length));
+  const roleLabel = labels.find((label) => label.startsWith("role:"));
   return {
-    id: DOCS_DRIFT_CLI_ID,
-    family: "drift",
-    command: DOCS_DRIFT_CLI_COMMAND,
-    description: "Scan documentation for stale code references.",
-    usage: DOCS_DRIFT_CLI_COMMAND,
-    projectRequired: true,
-    run: (context, args) => executeDrift(context, args, options)
+    id: raw["id"] ?? inferredId,
+    deps: raw["deps"] ?? raw["depends_on"] ?? [],
+    status: raw["status"] ?? "ready",
+    ...scope.length > 0 ? { scope } : {},
+    ...roleLabel ? { role: roleLabel.slice("role:".length) } : {},
+    ...validators.length > 0 ? { validators, validation: validators } : {},
+    ...raw
   };
 }
-var DOCS_DRIFT_RUNTIME_CLI_COMMAND = createDocsDriftRuntimeCliCommand();
-async function runDriftCli(args, options = {}) {
-  const docsGlobs = [];
-  const ignoreGlobs = [];
-  let json = false;
-  let failOnDrift = false;
-  for (let index = 0;index < args.length; index += 1) {
-    const arg = args[index];
-    if (arg === "--json") {
-      json = true;
-      continue;
-    }
-    if (arg === "--fail-on-drift") {
-      failOnDrift = true;
-      continue;
+function createFilesTaskSource(opts) {
+  const pattern = opts.pattern ?? DEFAULT_PATTERN;
+  const configured = opts.path ?? opts.dir;
+  if (!configured) {
+    throw new Error("createFilesTaskSource: either `path` or `dir` must be provided");
+  }
+  const directory = isAbsolute(configured) ? configured : resolve2(opts.projectRoot ?? process.cwd(), configured);
+  const findTaskFile = (id) => {
+    if (!existsSync2(directory))
+      return;
+    for (const name of readdirSync(directory)) {
+      if (!pattern.test(name))
+        continue;
+      const p = join(directory, name);
+      try {
+        if (!statSync(p).isFile())
+          continue;
+        if (readTaskFile(p, pattern).id === id)
+          return p;
+      } catch {}
     }
-    if (arg === "--docs") {
-      docsGlobs.push(takeOptionValue(args, index, arg));
-      index += 1;
-      continue;
+    return;
+  };
+  const applyUpdate = (id, update) => {
+    const file = findTaskFile(id);
+    if (!file) {
+      throw new Error(`files task not found: ${id}`);
     }
-    if (arg === "--ignore") {
-      ignoreGlobs.push(takeOptionValue(args, index, arg));
-      index += 1;
-      continue;
+    const raw = JSON.parse(readFileSync2(file, "utf-8"));
+    if (update.status)
+      raw.status = update.status;
+    if (update.title !== undefined)
+      raw.title = update.title;
+    if (update.body !== undefined)
+      raw.body = update.body;
+    if (update.comment?.trim()) {
+      const existing = Array.isArray(raw.comments) ? raw.comments : [];
+      raw.comments = [
+        ...existing,
+        {
+          body: update.comment,
+          createdAt: new Date().toISOString(),
+          source: "rig"
+        }
+      ];
     }
-    throw new Error(`Unknown rig drift argument: ${arg}`);
-  }
-  const report = await detectDrift({
-    projectRoot: options.projectRoot ?? process.cwd(),
-    ...docsGlobs.length > 0 ? { docsGlobs } : {},
-    ...ignoreGlobs.length > 0 ? { ignoreGlobs } : {}
-  });
-  const write = options.write ?? ((message) => console.log(message));
-  if (json) {
-    write(JSON.stringify(report));
-  } else {
-    write(`Scanned ${report.scanned} doc(s); ${report.findings.length} drift finding(s).`);
-    for (const finding of report.findings) {
-      write(`${finding.confidence.toUpperCase()} ${finding.kind} ${finding.docPath}${finding.line ? `:${finding.line}` : ""} ${finding.reference ?? ""} \u2014 ${finding.detail}`);
+    writeFileSync(file, `${JSON.stringify(raw, null, 2)}
+`, "utf-8");
+  };
+  return {
+    id: "std:files",
+    kind: "files",
+    async list() {
+      if (!existsSync2(directory))
+        return [];
+      const out = [];
+      for (const name of readdirSync(directory)) {
+        if (!pattern.test(name))
+          continue;
+        const p = join(directory, name);
+        try {
+          if (!statSync(p).isFile())
+            continue;
+          out.push(readTaskFile(p, pattern));
+        } catch (err) {
+          console.warn(`[files-source] skipped ${name}: ${err.message}`);
+        }
+      }
+      return out;
+    },
+    async get(id) {
+      const all = await this.list();
+      return all.find((t) => t.id === id);
+    },
+    async updateStatus(id, status) {
+      applyUpdate(id, { status });
+    },
+    async updateTask(id, update) {
+      applyUpdate(id, update);
     }
-  }
-  const high = highConfidenceDriftFindings(report);
-  if (failOnDrift && high.length > 0) {
-    options.writeError?.(`${high.length} high-confidence drift finding(s).`);
-    return 2;
-  }
-  return 0;
-}
-// packages/standard-plugin/src/drift/judge.ts
-async function judgeDocumentationDrift(provider, input) {
-  const result = await provider.judge(input);
-  return result.mismatches.map((mismatch) => ({
-    kind: "semantic-mismatch",
-    docPath: input.docPath,
-    line: mismatch.line ?? null,
-    reference: mismatch.reference ?? input.reference ?? null,
-    detail: mismatch.detail,
-    confidence: mismatch.confidence ?? "medium"
-  }));
+  };
 }
+
 // packages/standard-plugin/src/plugin.ts
+init_metadata();
+init_metadata();
+import { createStandardProductEntrypointPlugin, standardProductEntrypointPlugin } from "@rig/product-entrypoint-plugin/plugin";
+import { createStandardTaskCliPlugin, standardTaskCliPlugin } from "@rig/task-cli-plugin/plugin";
 var DOCS_HEALTH_PANEL_ID = "docs-health";
 function requireStringField(config, field, kind) {
   const value = config[field];
@@ -1539,7 +1681,8 @@ function createDocsHealthPanelProducer(options = {}) {
     const projectRoot = panelProjectRoot(context);
     if (!projectRoot)
       return;
-    const report = await detectDrift({
+    const { detectDrift: detectDrift2 } = await Promise.resolve().then(() => (init_detect(), exports_detect));
+    const report = await detectDrift2({
       projectRoot,
       ...options.docsGlobs !== undefined ? { docsGlobs: options.docsGlobs } : {},
       ...options.ignoreGlobs !== undefined ? { ignoreGlobs: options.ignoreGlobs } : {}
@@ -1557,24 +1700,46 @@ function createDocsHealthPanelProducer(options = {}) {
     };
   };
 }
-function standardPlugin(opts = {}) {
+function createLazyDocsDriftValidator(options = {}) {
+  return {
+    ...DOCS_DRIFT_VALIDATOR,
+    async run(ctx) {
+      const { runDocsDriftValidation: runDocsDriftValidation2 } = await Promise.resolve().then(() => (init_plugin(), exports_plugin));
+      return runDocsDriftValidation2({
+        projectRoot: ctx.workspaceRoot,
+        ...options.docsGlobs !== undefined ? { docsGlobs: options.docsGlobs } : {},
+        ...options.ignoreGlobs !== undefined ? { ignoreGlobs: options.ignoreGlobs } : {},
+        ...options.failOnDrift !== undefined ? { failOnDrift: options.failOnDrift } : {}
+      });
+    }
+  };
+}
+function createLazyDocsDriftGateStage(options = {}) {
+  return async (ctx) => {
+    const { createDocsDriftGateStage: createDocsDriftGateStage2 } = await Promise.resolve().then(() => (init_plugin(), exports_plugin));
+    return createDocsDriftGateStage2(options)(ctx);
+  };
+}
+function createLazyDocsDriftRuntimeCliCommand(options = {}) {
+  return {
+    id: DOCS_DRIFT_CLI_ID,
+    family: "drift",
+    command: DOCS_DRIFT_CLI_COMMAND,
+    description: "Scan documentation for stale code references.",
+    usage: DOCS_DRIFT_CLI_COMMAND,
+    projectRequired: true,
+    run: async (context, args) => {
+      const { executeDrift: executeDrift2 } = await Promise.resolve().then(() => (init_plugin(), exports_plugin));
+      return executeDrift2(context, args, options);
+    }
+  };
+}
+function createStandardDocsDriftPlugin(opts = {}) {
   return definePlugin({
-    name: "rig-standard",
+    name: "@rig/standard-plugin:docs-drift",
     version: "0.1.0",
     contributes: {
       validators: [DOCS_DRIFT_VALIDATOR],
-      taskSources: [
-        {
-          id: "std:github-issues",
-          kind: "github-issues",
-          description: "GitHub Issues via gh CLI"
-        },
-        {
-          id: "std:files",
-          kind: "files",
-          description: "JSON files in a local directory"
-        }
-      ],
       capabilities: [
         { id: DOCS_DRIFT_CAPABILITY_ID, title: "Documentation drift detection", commandId: DOCS_DRIFT_CLI_ID, panelId: DOCS_HEALTH_PANEL_ID }
       ],
@@ -1593,15 +1758,36 @@ function standardPlugin(opts = {}) {
       stageMutations: [DOCS_DRIFT_STAGE_MUTATION]
     }
   }, {
-    validators: [createDocsDriftValidator(opts.drift)],
-    stages: { [DOCS_DRIFT_STAGE_ID]: createDocsDriftGateStage(opts.drift) },
+    validators: [createLazyDocsDriftValidator(opts)],
+    stages: { [DOCS_DRIFT_STAGE_ID]: createLazyDocsDriftGateStage(opts) },
     featureCapabilities: [
       { id: DOCS_DRIFT_CAPABILITY_ID, title: "Documentation drift detection", commandId: DOCS_DRIFT_CLI_ID, panelId: DOCS_HEALTH_PANEL_ID }
     ],
     panels: [
-      { id: DOCS_HEALTH_PANEL_ID, slot: "capability", title: "Documentation drift", capabilityId: DOCS_DRIFT_CAPABILITY_ID, produce: createDocsHealthPanelProducer(opts.drift) }
+      { id: DOCS_HEALTH_PANEL_ID, slot: "capability", title: "Documentation drift", capabilityId: DOCS_DRIFT_CAPABILITY_ID, produce: createDocsHealthPanelProducer(opts) }
     ],
-    cliCommands: [createDocsDriftRuntimeCliCommand(opts.drift)],
+    cliCommands: [createLazyDocsDriftRuntimeCliCommand(opts)]
+  });
+}
+function createStandardTaskSourcesPlugin(opts = {}) {
+  return definePlugin({
+    name: "@rig/standard-plugin:task-sources",
+    version: "0.1.0",
+    contributes: {
+      taskSources: [
+        {
+          id: "std:github-issues",
+          kind: "github-issues",
+          description: "GitHub Issues via gh CLI"
+        },
+        {
+          id: "std:files",
+          kind: "files",
+          description: "JSON files in a local directory"
+        }
+      ]
+    }
+  }, {
     taskSources: [
       {
         id: "std:github-issues",
@@ -1658,45 +1844,98 @@ function standardPlugin(opts = {}) {
     ]
   });
 }
+
 // packages/standard-plugin/src/bundle.ts
-import { createBlockerClassifierPlugin } from "@rig/blocker-classifier-plugin/plugin";
-import { createDefaultLifecyclePlugin } from "@rig/bundle-default-lifecycle/plugin";
-import { createDependencyGraphPlugin } from "@rig/dependency-graph-plugin/plugin";
-import { createPlanningPlugin } from "@rig/planning-plugin/plugin";
-import { createSupervisorPlugin } from "@rig/supervisor-plugin/plugin";
-function standardProjectPlugins(options = {}) {
+function standardPlugins(options = {}) {
   return [
     createDefaultLifecyclePlugin(),
     createDependencyGraphPlugin(),
     createBlockerClassifierPlugin(),
     createPlanningPlugin(),
     createSupervisorPlugin(),
-    standardPlugin(options.standard)
+    RUN_WORKER_PANEL_PLUGIN,
+    createStandardTaskSourcesPlugin(options.taskSources),
+    createStandardTaskCliPlugin(),
+    createStandardDocsDriftPlugin(options.drift),
+    createStandardProductEntrypointPlugin()
   ];
 }
+// packages/standard-plugin/src/cli-surface.ts
+var STANDARD_CLI_SURFACE_PLUGIN_NAME = "@rig/standard-plugin:cli-surface";
+function standardCliCommand(family, options) {
+  return {
+    id: `${STANDARD_CLI_SURFACE_PLUGIN_NAME}:${family}`,
+    family,
+    description: options.description,
+    ...options.usage ? { usage: options.usage } : {},
+    ...options.aliases ? { aliases: [...options.aliases] } : {},
+    projectRequired: options.projectRequired ?? false
+  };
+}
+var STANDARD_CLI_SURFACE_COMMAND_METADATA = [
+  standardCliCommand("init", { description: "Initialize Rig project configuration." }),
+  standardCliCommand("setup", { description: "Install and inspect local Rig setup." }),
+  standardCliCommand("check", { description: "Run Rig setup checks.", usage: "rig check" }),
+  standardCliCommand("install", { description: "Install Rig distribution artifacts.", usage: "rig install [options]" }),
+  standardCliCommand("github", { description: "Manage GitHub auth and integration state." }),
+  standardCliCommand("doctor", { description: "Inspect Rig environment health." }),
+  standardCliCommand("repo", { description: "Manage repository state.", projectRequired: true }),
+  standardCliCommand("profile", { description: "Manage runtime profile settings." }),
+  standardCliCommand("review", { description: "Run review helpers.", projectRequired: true }),
+  standardCliCommand("git", { description: "Run Rig git automation.", projectRequired: true }),
+  standardCliCommand("harness", { description: "Inspect native harness integration." }),
+  standardCliCommand("pi", { description: "Inspect Pi/OMP runtime integration." }),
+  standardCliCommand("plugin", { description: "Inspect and run plugin compatibility commands." }),
+  standardCliCommand("queue", { description: "Inspect dispatch queue state.", projectRequired: true }),
+  standardCliCommand("agent", { description: "Run agent lifecycle helpers.", projectRequired: true }),
+  standardCliCommand("dist", { description: "Build and inspect Rig distributions." }),
+  standardCliCommand("workspace", { description: "Inspect workspace topology." }),
+  standardCliCommand("remote", { description: "Manage remote endpoints." }),
+  standardCliCommand("test", { description: "Run Rig test helpers." }),
+  standardCliCommand("inspect", { description: "Inspect live/project Rig state." }),
+  standardCliCommand("run", { description: "Dispatch and inspect runs.", projectRequired: true }),
+  standardCliCommand("task", { description: "List and inspect task-source tasks.", projectRequired: true }),
+  standardCliCommand("inbox", { description: "Inspect and resolve run inbox items.", projectRequired: true }),
+  standardCliCommand("stats", { description: "Inspect run statistics.", projectRequired: true }),
+  standardCliCommand("server", { description: "Manage selected local/remote execution server.", projectRequired: true }),
+  standardCliCommand("config", { description: "Inspect Rig configuration." }),
+  standardCliCommand("triage", { description: "Run issue triage helpers.", projectRequired: true })
+];
+var standardCliSurfacePlugin = {
+  name: STANDARD_CLI_SURFACE_PLUGIN_NAME,
+  version: "0.0.0-alpha.1",
+  contributes: {
+    capabilities: [{ id: "surface.cli", title: "Rig CLI surface", description: "Registry-dispatched command-line surface." }],
+    cliCommands: STANDARD_CLI_SURFACE_COMMAND_METADATA
+  }
+};
 export {
-  standardProjectPlugins,
-  runDriftCli,
-  runDocsDriftValidation,
-  makeDriftGit,
-  judgeDocumentationDrift,
-  extractDriftReferences,
-  executeDrift,
-  driftGateResult,
-  detectStaleAnchors,
-  detectDrift,
-  detectDeletedReferences,
-  standardPlugin as default,
+  standardTaskCliPlugin,
+  standardProductEntrypointPlugin,
+  standardPlugins,
+  standardCliSurfacePlugin,
   createStateGitHubCredentialProvider,
+  createStandardTaskSourcesPlugin,
+  createStandardTaskCliPlugin,
+  createStandardProductEntrypointPlugin,
+  createStandardDocsDriftPlugin,
   createGitHubIssuesTaskSource,
   createFilesTaskSource,
   createEnvGitHubCredentialProvider,
-  createDocsDriftValidator,
-  createDocsDriftRuntimeCliCommand,
+  STANDARD_CLI_SURFACE_PLUGIN_NAME,
+  STANDARD_CLI_SURFACE_COMMAND_METADATA,
+  RUN_WORKER_PANEL_PLUGIN,
+  RUN_SUPERVISOR_PANEL_REGISTRATION,
+  RUN_SUPERVISOR_PANEL_PRODUCER,
+  RIG_SUPERVISOR_PANEL_ID,
+  RIG_RUN_STOP_PANEL_ACTION,
+  RIG_CAPABILITY_PANEL_SLOT,
   DOCS_HEALTH_PANEL_ID,
   DOCS_DRIFT_VALIDATOR_ID,
+  DOCS_DRIFT_VALIDATOR,
+  DOCS_DRIFT_STAGE_MUTATION,
   DOCS_DRIFT_STAGE_ID,
-  DOCS_DRIFT_RUNTIME_CLI_COMMAND,
   DOCS_DRIFT_CLI_ID,
+  DOCS_DRIFT_CLI_COMMAND,
   DOCS_DRIFT_CAPABILITY_ID
 };