@h-rig/task-sources-plugin 0.0.6-alpha.157 → 0.0.6-alpha.159

package/dist/src/plugin.js

@@ -1,11 +1,3875 @@
 // @bun
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+
+// packages/task-sources-plugin/src/control-plane/state-sync/types.ts
+function normalizeTaskLifecycleStatus(status) {
+  switch (status) {
+    case "draft":
+    case "open":
+    case "ready":
+    case "queued":
+    case "in_progress":
+    case "under_review":
+    case "blocked":
+    case "completed":
+    case "cancelled":
+      return status;
+    case "closed":
+      return "completed";
+    case "running":
+      return "in_progress";
+    case "failed":
+      return "ready";
+    default:
+      return null;
+  }
+}
+function normalizeTaskStateMetadataStatus(status) {
+  if (CANONICAL_TASK_LIFECYCLE_STATUSES.has(status)) {
+    return status;
+  }
+  switch (status) {
+    case "closed":
+      return "completed";
+    case "running":
+      return "in_progress";
+    case "failed":
+      return "ready";
+    default:
+      return;
+  }
+}
+function canonicalizeTaskStateMetadata(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return null;
+  }
+  const metadata = raw;
+  const claimId = typeof metadata.claimId === "string" && metadata.claimId.length > 0 ? metadata.claimId : undefined;
+  const status = normalizeTaskStateMetadataStatus(metadata.status);
+  if (!status) {
+    return null;
+  }
+  return {
+    ...claimId ? { claimId } : {},
+    status,
+    ...typeof metadata.ownerId === "string" && metadata.ownerId.length > 0 ? { ownerId: metadata.ownerId } : {},
+    ...typeof metadata.claimedAt === "string" && metadata.claimedAt.length > 0 ? { claimedAt: metadata.claimedAt } : {},
+    ...typeof metadata.lastEvidenceAt === "string" && metadata.lastEvidenceAt.length > 0 ? { lastEvidenceAt: metadata.lastEvidenceAt } : {},
+    ...typeof metadata.runId === "string" && metadata.runId.length > 0 ? { runId: metadata.runId } : {},
+    ...typeof metadata.branchName === "string" && metadata.branchName.length > 0 ? { branchName: metadata.branchName } : {},
+    ...typeof metadata.prNumber === "number" ? { prNumber: metadata.prNumber } : {},
+    ...typeof metadata.prUrl === "string" && metadata.prUrl.length > 0 ? { prUrl: metadata.prUrl } : {},
+    ...typeof metadata.reviewState === "string" && metadata.reviewState.length > 0 ? { reviewState: metadata.reviewState } : {},
+    ...typeof metadata.blockerReason === "string" && metadata.blockerReason.length > 0 ? { blockerReason: metadata.blockerReason } : {},
+    ...typeof metadata.sourceCommit === "string" && metadata.sourceCommit.length > 0 ? { sourceCommit: metadata.sourceCommit } : {}
+  };
+}
+function discardMismatchedTaskStateMetadata(input) {
+  input.taskId;
+  const canonicalMetadata = canonicalizeTaskStateMetadata(input.metadata);
+  if (!canonicalMetadata || !input.lifecycleStatus) {
+    return null;
+  }
+  const metadataStatus = canonicalMetadata.status ?? null;
+  if (metadataStatus && metadataStatus !== input.lifecycleStatus) {
+    return null;
+  }
+  return canonicalMetadata;
+}
+function readTaskStateMetadataEnvelope(raw) {
+  if (!raw || typeof raw !== "object") {
+    return { schemaVersion: SUPPORTED_TASK_STATE_SCHEMA_VERSION, supported: true, baseTrackerCommit: null, tasks: {} };
+  }
+  const envelope = raw;
+  const schemaVersion = typeof envelope.schemaVersion === "number" ? envelope.schemaVersion : SUPPORTED_TASK_STATE_SCHEMA_VERSION;
+  if (schemaVersion !== SUPPORTED_TASK_STATE_SCHEMA_VERSION) {
+    return { schemaVersion, supported: false, baseTrackerCommit: null, tasks: {} };
+  }
+  const rawTasks = envelope.tasks && typeof envelope.tasks === "object" && !Array.isArray(envelope.tasks) ? envelope.tasks : {};
+  const tasks = Object.fromEntries(Object.entries(rawTasks).map(([taskId, metadata]) => [taskId, canonicalizeTaskStateMetadata(metadata)]).filter((entry) => entry[1] != null));
+  return {
+    schemaVersion,
+    supported: true,
+    baseTrackerCommit: typeof envelope.baseTrackerCommit === "string" && envelope.baseTrackerCommit.length > 0 ? envelope.baseTrackerCommit : null,
+    tasks
+  };
+}
+var SUPPORTED_TASK_STATE_SCHEMA_VERSION = 1, CANONICAL_TASK_LIFECYCLE_STATUSES;
+var init_types = __esm(() => {
+  CANONICAL_TASK_LIFECYCLE_STATUSES = new Set([
+    "draft",
+    "open",
+    "ready",
+    "queued",
+    "in_progress",
+    "under_review",
+    "blocked",
+    "completed",
+    "cancelled"
+  ]);
+});
+
+// packages/task-sources-plugin/src/control-plane/native/native-git.ts
+import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir } from "os";
+import { dirname, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
+import { createHash } from "crypto";
+function nativePendingFiles(repoPath) {
+  const result = runGitNative("pending-files", [repoPath]);
+  if (!result.ok)
+    return null;
+  if ("files" in result && Array.isArray(result.files)) {
+    return result.files.map((file) => ({ path: file.path, status: file.status }));
+  }
+  return null;
+}
+function nativeFetchRef(repoPath, remote, branch) {
+  return requireGitNativeString("fetch-ref", [repoPath, remote, branch]);
+}
+function nativeReadBlobAtRef(repoPath, ref, path) {
+  const requestDir = resolve2(taskSourcesGitNativeOutputDir, "reads", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
+  mkdirSync(requestDir, { recursive: true });
+  const outputPath = resolve2(requestDir, "blob.txt");
+  try {
+    requireGitNative("read-blob-at-ref", [repoPath, ref, path, outputPath]);
+    return readFileSync2(outputPath, "utf8");
+  } finally {
+    rmSync(requestDir, { recursive: true, force: true });
+  }
+}
+function nativeWriteTreeCommit(repoPath, baseRef, updates, message) {
+  const requestDir = resolve2(taskSourcesGitNativeOutputDir, "requests", `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`);
+  mkdirSync(requestDir, { recursive: true });
+  const messagePath = resolve2(requestDir, "message.txt");
+  const updatesPath = resolve2(requestDir, "updates.json");
+  try {
+    writeFileSync2(messagePath, message, "utf8");
+    writeFileSync2(updatesPath, `${JSON.stringify(serializeTreeCommitUpdates(updates), null, 2)}
+`, "utf8");
+    return requireGitNativeString("write-tree-commit", [repoPath, baseRef, messagePath, updatesPath]);
+  } finally {
+    rmSync(requestDir, { recursive: true, force: true });
+  }
+}
+function nativePushRefWithLease(repoPath, localOid, remoteRef, expectedOldOid, remote = "origin") {
+  return requireGitNativeString("push-ref-with-lease", [repoPath, localOid, remoteRef, expectedOldOid, remote]);
+}
+function runGitNative(command, args) {
+  if (process.env.RIG_DISABLE_ZIG_NATIVE === "1") {
+    return { ok: false, error: "rig-git native disabled" };
+  }
+  let binaryPath;
+  try {
+    binaryPath = resolveGitBinaryPath() ?? ensureRigGitBinaryPathSync(preferredGitBinaryOutputPath());
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { ok: false, error: message.includes("rig-git.zig source file not found") ? "rig-git binary not found" : message };
+  }
+  try {
+    const proc = Bun.spawnSync([binaryPath, command, ...args], {
+      stdout: "pipe",
+      stderr: "pipe",
+      env: gitNativeEnv()
+    });
+    if (proc.exitCode !== 0) {
+      const stdoutText = proc.stdout.toString().trim();
+      if (stdoutText) {
+        try {
+          const parsed = JSON.parse(stdoutText);
+          if (!parsed.ok) {
+            return parsed;
+          }
+        } catch {}
+      }
+      const error = proc.stderr.toString().trim() || `exit code ${proc.exitCode}`;
+      return { ok: false, error };
+    }
+    return JSON.parse(proc.stdout.toString().trim());
+  } catch (error) {
+    return { ok: false, error: String(error) };
+  }
+}
+function requireGitNative(command, args) {
+  const result = runGitNative(command, args);
+  if (!result.ok) {
+    throw new Error(`rig-git ${command} failed: ${result.error}`);
+  }
+  return result;
+}
+function requireGitNativeString(command, args) {
+  const result = requireGitNative(command, args);
+  if ("value" in result && typeof result.value === "string") {
+    return result.value;
+  }
+  throw new Error(`rig-git ${command} returned an unexpected result payload`);
+}
+function serializeTreeCommitUpdates(updates) {
+  return updates.map((update) => {
+    if (typeof update.content === "string") {
+      return { path: update.path, kind: "text", content: update.content };
+    }
+    if (!isAbsolute2(update.sourceFilePath)) {
+      throw new Error("tree commit binary updates require an absolute sourceFilePath");
+    }
+    return { path: update.path, kind: "file", sourceFilePath: update.sourceFilePath };
+  });
+}
+function gitNativeEnv() {
+  const env = { ...process.env };
+  const token = env.GITHUB_TOKEN?.trim() || env.GH_TOKEN?.trim() || env.RIG_GITHUB_TOKEN?.trim() || "";
+  if (token) {
+    env.RIG_GITHUB_TOKEN = env.RIG_GITHUB_TOKEN || token;
+    env.GITHUB_TOKEN = env.GITHUB_TOKEN || token;
+    env.GH_TOKEN = env.GH_TOKEN || token;
+    env.GIT_TERMINAL_PROMPT = "0";
+    env.GIT_CONFIG_COUNT = "2";
+    env.GIT_CONFIG_KEY_0 = "credential.helper";
+    env.GIT_CONFIG_VALUE_0 = "";
+    env.GIT_CONFIG_KEY_1 = "credential.helper";
+    env.GIT_CONFIG_VALUE_1 = '!f() { test "$1" = get || exit 0; token="${GITHUB_TOKEN:-${GH_TOKEN:-${RIG_GITHUB_TOKEN:-}}}"; test -n "$token" || exit 0; echo username=x-access-token; echo password="$token"; }; f';
+  }
+  return env;
+}
+function runtimeRigGitFileName() {
+  return `rig-git${process.platform === "win32" ? ".exe" : ""}`;
+}
+function preferredGitBinaryOutputPath() {
+  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+  return explicit || taskSourcesGitNativeOutputPath;
+}
+function resolveGitBinaryPath() {
+  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+  if (explicit && existsSync2(explicit)) {
+    return explicit;
+  }
+  if (explicit) {
+    return null;
+  }
+  for (const candidate of rigGitBinaryCandidates()) {
+    if (candidate && existsSync2(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function ensureRigGitBinaryPathSync(outputPath = taskSourcesGitNativeOutputPath) {
+  const explicit = process.env.RIG_NATIVE_GIT_BIN?.trim() || "";
+  if (explicit && existsSync2(explicit)) {
+    return explicit;
+  }
+  const sourcePath = resolveGitSourcePath();
+  if (!sourcePath) {
+    const binaryPath = resolveGitBinaryPath();
+    if (binaryPath) {
+      return binaryPath;
+    }
+    throw new Error("rig-git.zig source file not found.");
+  }
+  const zigBinary = Bun.which("zig");
+  if (!zigBinary) {
+    throw new Error("zig is required to build native Rig git tools.");
+  }
+  mkdirSync(dirname(outputPath), { recursive: true });
+  const buildKey = JSON.stringify({
+    version: 1,
+    zigBinary,
+    platform: process.platform,
+    arch: process.arch,
+    sourcePath,
+    sourceDigest: createHash("sha256").update(readFileSync2(sourcePath)).digest("hex")
+  });
+  const manifestPath = `${outputPath}.build-manifest.json`;
+  if (nativeBuildIsFresh(outputPath, manifestPath, buildKey)) {
+    chmodSync(outputPath, 493);
+    return outputPath;
+  }
+  const tempOutputPath = resolve2(dirname(outputPath), `.rig-git-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}${process.platform === "win32" ? ".exe" : ""}`);
+  const build = Bun.spawnSync([
+    zigBinary,
+    "build-exe",
+    sourcePath,
+    "-O",
+    "ReleaseFast",
+    `-femit-bin=${tempOutputPath}`
+  ], {
+    cwd: dirname(sourcePath),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  if (build.exitCode !== 0 || !existsSync2(tempOutputPath)) {
+    const details = [build.stderr.toString().trim(), build.stdout.toString().trim()].filter(Boolean).join(`
+`);
+    throw new Error(`Failed to build native Rig git tools: ${details || `zig exited with code ${build.exitCode}`}`);
+  }
+  chmodSync(tempOutputPath, 493);
+  renameSync(tempOutputPath, outputPath);
+  if (!binarySupportsTrackerCommands(outputPath)) {
+    rmSync(outputPath, { force: true });
+    throw new Error("Failed to build native Rig git tools: tracker command probe failed");
+  }
+  writeFileSync2(manifestPath, `${JSON.stringify({ version: 1, buildKey }, null, 2)}
+`, "utf8");
+  return outputPath;
+}
+function nativeBuildIsFresh(outputPath, manifestPath, buildKey) {
+  if (!existsSync2(outputPath) || !existsSync2(manifestPath)) {
+    return false;
+  }
+  try {
+    const manifest = JSON.parse(readFileSync2(manifestPath, "utf8"));
+    return manifest.version === 1 && manifest.buildKey === buildKey && binarySupportsTrackerCommands(outputPath);
+  } catch {
+    return false;
+  }
+}
+function binarySupportsTrackerCommands(binaryPath) {
+  try {
+    const probe = Bun.spawnSync([binaryPath, "fetch-ref", "."], {
+      stdout: "pipe",
+      stderr: "pipe"
+    });
+    const stdout = probe.stdout.toString().trim();
+    const stderr = probe.stderr.toString().trim();
+    if (stdout.includes('"error":"unknown command"')) {
+      return false;
+    }
+    return probe.exitCode === 2 && stderr.includes(trackerCommandUsageProbe);
+  } catch {
+    return false;
+  }
+}
+function resolveGitSourcePath() {
+  for (const candidate of rigGitSourceCandidates()) {
+    if (candidate && existsSync2(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function rigGitSourceCandidates() {
+  const execDir = process.execPath?.trim() ? dirname(process.execPath.trim()) : "";
+  const cwd = process.cwd()?.trim() || "";
+  const projectRoot = process.env.PROJECT_RIG_ROOT?.trim() || "";
+  const hostProjectRoot = process.env.RIG_HOST_PROJECT_ROOT?.trim() || "";
+  return [...new Set([
+    process.env.RIG_NATIVE_GIT_SOURCE?.trim() || "",
+    resolve2(import.meta.dir, "../../../native/rig-git.zig"),
+    projectRoot ? resolve2(projectRoot, "packages/task-sources-plugin/native/rig-git.zig") : "",
+    projectRoot ? resolve2(projectRoot, "packages/isolation-plugin/native/rig-git.zig") : "",
+    projectRoot ? resolve2(projectRoot, "packages/shared/native/rig-git.zig") : "",
+    hostProjectRoot ? resolve2(hostProjectRoot, "packages/task-sources-plugin/native/rig-git.zig") : "",
+    hostProjectRoot ? resolve2(hostProjectRoot, "packages/isolation-plugin/native/rig-git.zig") : "",
+    hostProjectRoot ? resolve2(hostProjectRoot, "packages/shared/native/rig-git.zig") : "",
+    cwd ? resolve2(cwd, "packages/task-sources-plugin/native/rig-git.zig") : "",
+    cwd ? resolve2(cwd, "packages/isolation-plugin/native/rig-git.zig") : "",
+    cwd ? resolve2(cwd, "packages/shared/native/rig-git.zig") : "",
+    execDir ? resolve2(execDir, "..", "native", "rig-git.zig") : ""
+  ].filter(Boolean))];
+}
+function rigGitBinaryCandidates() {
+  const execDir = process.execPath?.trim() ? dirname(process.execPath.trim()) : "";
+  const fileName = runtimeRigGitFileName();
+  return [...new Set([
+    ...nativePackageBinaryCandidates(import.meta.dir, fileName),
+    execDir ? resolve2(execDir, fileName) : "",
+    execDir ? resolve2(execDir, "..", fileName) : "",
+    execDir ? resolve2(execDir, "..", "bin", fileName) : "",
+    taskSourcesGitNativeOutputPath
+  ].filter(Boolean))];
+}
+function nativePackageBinaryCandidates(fromDir, fileName) {
+  const candidates = [];
+  let cursor = resolve2(fromDir);
+  for (let index = 0;index < 8; index += 1) {
+    candidates.push(resolve2(cursor, "native", `${process.platform}-${process.arch}`, fileName), resolve2(cursor, "native", `${process.platform}-${process.arch}`, "bin", fileName), resolve2(cursor, "native", fileName), resolve2(cursor, "native", "bin", fileName));
+    const parent = dirname(cursor);
+    if (parent === cursor)
+      break;
+    cursor = parent;
+  }
+  return candidates;
+}
+var taskSourcesGitNativeOutputDir, taskSourcesGitNativeOutputPath, trackerCommandUsageProbe = "usage: rig-git fetch-ref <repo-path> <remote> <branch>";
+var init_native_git = __esm(() => {
+  taskSourcesGitNativeOutputDir = resolve2(tmpdir(), "rig-task-sources-native");
+  taskSourcesGitNativeOutputPath = resolve2(taskSourcesGitNativeOutputDir, `rig-git-${process.platform}-${process.arch}${process.platform === "win32" ? ".exe" : ""}`);
+});
+
+// packages/task-sources-plugin/src/control-plane/state-sync/native-git.ts
+var init_native_git2 = __esm(() => {
+  init_native_git();
+});
+
+// packages/task-sources-plugin/src/control-plane/native/utils.ts
+import { getScopeRules } from "@rig/core/scope-rules";
+import { unique } from "@rig/core/exec";
+import {
+  runCapture,
+  runCaptureAsync,
+  runInherit,
+  getValidationTimeoutMs,
+  readJsonFile,
+  nowIso,
+  unique as unique2,
+  fileLines
+} from "@rig/core/exec";
+import { resolveCheckoutRoot } from "@rig/core/checkout-root";
+import { resolveHarnessPaths } from "@rig/core/harness-paths";
+function normalizeRelativeScopePath(inputPath) {
+  let normalized = inputPath.replace(/^\.\//, "");
+  const rules = getScopeRules();
+  if (rules?.stripPrefixes) {
+    for (const prefix of rules.stripPrefixes) {
+      if (normalized.startsWith(prefix)) {
+        normalized = normalized.slice(prefix.length);
+      }
+    }
+  }
+  return normalized;
+}
+function normalizePathToScope(projectRoot, monorepoRoot, inputPath) {
+  let normalized = inputPath.replace(/^\.\//, "");
+  if (normalized.startsWith(projectRoot + "/")) {
+    normalized = normalized.slice(projectRoot.length + 1);
+  }
+  if (normalized.startsWith(monorepoRoot + "/")) {
+    normalized = normalized.slice(monorepoRoot.length + 1);
+  }
+  return normalizeRelativeScopePath(normalized);
+}
+function monorepoSearchCandidates(inputPath) {
+  const normalized = inputPath.replace(/^\.\//, "");
+  const candidates = new Set;
+  const add = (value) => {
+    const trimmed = value.replace(/^\.\//, "");
+    if (trimmed) {
+      candidates.add(trimmed);
+    }
+  };
+  add(normalized);
+  const stripped = normalizeRelativeScopePath(normalized);
+  add(stripped);
+  const rules = getScopeRules();
+  if (rules?.stripPrefixes) {
+    for (const prefix of rules.stripPrefixes) {
+      if (normalized.startsWith(prefix)) {
+        add(normalized.slice(prefix.length));
+      }
+    }
+  }
+  if (rules?.searchPrefixes) {
+    for (const rule of rules.searchPrefixes) {
+      const matchesStart = rule.matchStartsWith?.some((prefix) => stripped.startsWith(prefix)) ?? false;
+      const matchesExact = rule.matchExact?.includes(stripped) ?? false;
+      if (matchesStart || matchesExact) {
+        add(`${rule.prefix}${stripped}`);
+      }
+    }
+  }
+  return [...candidates];
+}
+var scopeRegexCache;
+var init_utils = __esm(() => {
+  scopeRegexCache = new Map;
+});
+
+// packages/task-sources-plugin/src/control-plane/state-sync/repo.ts
+import { existsSync as existsSync3 } from "fs";
+import { resolve as resolve3 } from "path";
+import { MANAGED_REPO_SERVICE_CAPABILITY } from "@rig/contracts";
+import { defineCapability } from "@rig/core/capability";
+import { getInstalledCapability } from "@rig/core/capability-loaders";
+function resolveTrackerRepoPath(projectRoot) {
+  const monorepoRoot = resolveCheckoutRoot(projectRoot);
+  const managedRepos = getInstalledCapability(defineCapability(MANAGED_REPO_SERVICE_CAPABILITY));
+  if (managedRepos) {
+    try {
+      const layout = managedRepos.resolveMonorepoRepoLayout(projectRoot);
+      if (existsSync3(resolve3(layout.mirrorRoot, "HEAD"))) {
+        return layout.mirrorRoot;
+      }
+    } catch {}
+  }
+  return monorepoRoot;
+}
+var init_repo = __esm(() => {
+  init_utils();
+});
+
+// packages/task-sources-plugin/src/control-plane/state-sync/read.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve4 } from "path";
+import { RUNTIME_CONTEXT_ENV } from "@rig/core/runtime-context";
+function parseIssueStatus(rawStatus) {
+  const normalized = normalizeTaskLifecycleStatus(rawStatus);
+  return normalized ?? "unknown";
+}
+function parseIssueDependencies(raw) {
+  if (!Array.isArray(raw)) {
+    return [];
+  }
+  return raw.filter((entry) => !!entry && typeof entry === "object" && !Array.isArray(entry)).map((entry) => ({
+    issueId: typeof entry.issue_id === "string" && entry.issue_id.trim() ? entry.issue_id.trim() : null,
+    dependsOnId: typeof entry.depends_on_id === "string" && entry.depends_on_id.trim() ? entry.depends_on_id.trim() : null,
+    id: typeof entry.id === "string" && entry.id.trim() ? entry.id.trim() : null,
+    type: typeof entry.type === "string" && entry.type.trim() ? entry.type.trim() : null
+  }));
+}
+function dependencyTargetId(dependency) {
+  for (const candidate of [dependency.dependsOnId, dependency.id ?? null, dependency.issueId]) {
+    if (typeof candidate === "string" && candidate.trim()) {
+      return candidate.trim();
+    }
+  }
+  return null;
+}
+function parseIssuesJsonl(raw) {
+  const issues = [];
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      const record = JSON.parse(trimmed);
+      const id = typeof record.id === "string" && record.id.trim() ? record.id.trim() : "";
+      if (!id) {
+        continue;
+      }
+      const rawStatus = typeof record.status === "string" && record.status.trim() ? record.status.trim() : null;
+      issues.push({
+        id,
+        title: typeof record.title === "string" && record.title.trim() ? record.title.trim() : null,
+        description: typeof record.description === "string" && record.description.trim() ? record.description.trim() : null,
+        acceptanceCriteria: typeof record.acceptance_criteria === "string" && record.acceptance_criteria.trim() ? record.acceptance_criteria.trim() : typeof record.acceptanceCriteria === "string" && record.acceptanceCriteria.trim() ? record.acceptanceCriteria.trim() : null,
+        issueType: typeof record.issue_type === "string" && record.issue_type.trim() ? record.issue_type.trim() : null,
+        status: parseIssueStatus(rawStatus),
+        rawStatus,
+        priority: typeof record.priority === "number" ? record.priority : null,
+        dependencies: parseIssueDependencies(record.dependencies)
+      });
+    } catch {}
+  }
+  return issues;
+}
+function parseTaskStateEnvelope(raw) {
+  if (!raw || !raw.trim()) {
+    return readTaskStateMetadataEnvelope(null);
+  }
+  try {
+    return readTaskStateMetadataEnvelope(JSON.parse(raw));
+  } catch {
+    return readTaskStateMetadataEnvelope(null);
+  }
+}
+function readRemoteBlobAtRef(deps, repoPath, ref, path, options) {
+  try {
+    return deps.readBlobAtRef(repoPath, ref, path);
+  } catch (error) {
+    if (options.required) {
+      throw error;
+    }
+    return null;
+  }
+}
+function shouldPreferLocalTrackerState(options) {
+  if (!options.allowLocalFallback) {
+    return false;
+  }
+  const runtimeWorkspace = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (!runtimeWorkspace) {
+    return false;
+  }
+  if (process.env.RIG_TASK_RUNTIME_ID?.trim()) {
+    return true;
+  }
+  const runtimeContextPath = process.env[RUNTIME_CONTEXT_ENV]?.trim();
+  if (runtimeContextPath) {
+    return true;
+  }
+  return existsSync4(resolve4(runtimeWorkspace, ".rig", "runtime-context.json"));
+}
+function readLocalTrackerState(projectRoot, deps) {
+  const monorepoRoot = resolveCheckoutRoot(projectRoot);
+  const issuesPath = resolve4(monorepoRoot, ".beads", "issues.jsonl");
+  const taskStatePath = resolve4(monorepoRoot, ".beads", "task-state.json");
+  return projectSyncedTrackerSnapshot({
+    source: "local",
+    issuesBaseOid: null,
+    issuesText: deps.exists(issuesPath) ? deps.readFile(issuesPath) : "",
+    taskStateBaseOid: null,
+    taskStateText: deps.exists(taskStatePath) ? deps.readFile(taskStatePath) : null
+  });
+}
+function projectSyncedTrackerSnapshot(input) {
+  if (input.source === "remote" && input.issuesBaseOid && input.taskStateBaseOid && input.issuesBaseOid !== input.taskStateBaseOid) {
+    throw new Error("Remote tracker files must be read from the same fetched base.");
+  }
+  return {
+    source: input.source,
+    baseOid: input.issuesBaseOid ?? input.taskStateBaseOid ?? null,
+    issues: parseIssuesJsonl(input.issuesText),
+    taskState: parseTaskStateEnvelope(input.taskStateText)
+  };
+}
+function readSyncedTrackerState(projectRoot, deps = {}, options = {}) {
+  const readDeps = { ...DEFAULT_READ_DEPS, ...deps };
+  const trackerRepoPath = resolveTrackerRepoPath(projectRoot);
+  if (shouldPreferLocalTrackerState(options)) {
+    return readLocalTrackerState(projectRoot, readDeps);
+  }
+  try {
+    const baseOid = readDeps.fetchRef(trackerRepoPath, "origin", "main");
+    return projectSyncedTrackerSnapshot({
+      source: "remote",
+      issuesBaseOid: baseOid,
+      issuesText: readRemoteBlobAtRef(readDeps, trackerRepoPath, baseOid, ".beads/issues.jsonl", {
+        required: true
+      }) ?? "",
+      taskStateBaseOid: baseOid,
+      taskStateText: readRemoteBlobAtRef(readDeps, trackerRepoPath, baseOid, ".beads/task-state.json", {
+        required: false
+      })
+    });
+  } catch (error) {
+    if (!options.allowLocalFallback) {
+      throw error;
+    }
+    return readLocalTrackerState(projectRoot, readDeps);
+  }
+}
+function listReadyTaskIdsFromTracker(snapshot) {
+  const tasks = snapshot.issues.filter((issue) => issue.issueType === "task");
+  const taskById = new Map(tasks.map((issue) => [issue.id, issue]));
+  const readyTaskIds = [];
+  for (const issue of tasks) {
+    if (issue.status === "ready") {
+      readyTaskIds.push(issue.id);
+      continue;
+    }
+    if (issue.status !== "open") {
+      continue;
+    }
+    const hasOpenBlocker = issue.dependencies.some((dependency) => {
+      if (dependency.type === "parent-child") {
+        return false;
+      }
+      const targetTaskId = dependencyTargetId(dependency);
+      if (!targetTaskId) {
+        return false;
+      }
+      const dependencyStatus = taskById.get(targetTaskId)?.status ?? "unknown";
+      return dependencyStatus !== "completed" && dependencyStatus !== "cancelled";
+    });
+    if (!hasOpenBlocker) {
+      readyTaskIds.push(issue.id);
+    }
+  }
+  return readyTaskIds;
+}
+var DEFAULT_READ_DEPS;
+var init_read = __esm(() => {
+  init_native_git2();
+  init_utils();
+  init_repo();
+  init_types();
+  DEFAULT_READ_DEPS = {
+    fetchRef: nativeFetchRef,
+    readBlobAtRef: nativeReadBlobAtRef,
+    exists: existsSync4,
+    readFile: (path) => readFileSync3(path, "utf8")
+  };
+});
+
+// packages/task-sources-plugin/src/control-plane/state-sync/reconcile.ts
+var STALE_CLAIM_MS;
+var init_reconcile = __esm(() => {
+  STALE_CLAIM_MS = 24 * 60 * 60 * 1000;
+});
+
+// packages/task-sources-plugin/src/control-plane/state-sync/write.ts
+import { isDeepStrictEqual } from "util";
+function parseIssuesJsonl2(raw) {
+  const rows = [];
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        rows.push(parsed);
+      }
+    } catch {}
+  }
+  return rows;
+}
+function parseRawTaskStateFile(raw) {
+  if (!raw || !raw.trim()) {
+    return {
+      schemaVersion: 1,
+      tasks: {}
+    };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    return {
+      schemaVersion: typeof parsed.schemaVersion === "number" ? parsed.schemaVersion : 1,
+      tasks: parsed.tasks && typeof parsed.tasks === "object" && !Array.isArray(parsed.tasks) ? parsed.tasks : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function parseTaskStateEnvelope2(raw, baseOid) {
+  if (!raw || !raw.trim()) {
+    return {
+      schemaVersion: 1,
+      supported: true,
+      baseTrackerCommit: baseOid,
+      tasks: {}
+    };
+  }
+  try {
+    const parsed = readTaskStateMetadataEnvelope(JSON.parse(raw));
+    return {
+      schemaVersion: parsed.supported ? parsed.schemaVersion : 1,
+      supported: true,
+      baseTrackerCommit: parsed.baseTrackerCommit ?? baseOid,
+      tasks: parsed.supported ? parsed.tasks : {}
+    };
+  } catch {
+    return {
+      schemaVersion: 1,
+      supported: true,
+      baseTrackerCommit: baseOid,
+      tasks: {}
+    };
+  }
+}
+function sanitizeTaskStateEnvelope(issueRows, envelope) {
+  const lifecycleByTaskId = new Map;
+  for (const row of issueRows) {
+    const taskId = typeof row.id === "string" ? row.id : null;
+    if (!taskId) {
+      continue;
+    }
+    lifecycleByTaskId.set(taskId, normalizeTaskLifecycleStatus(row.status));
+  }
+  return {
+    ...envelope,
+    tasks: Object.fromEntries(Object.entries(envelope.tasks).map(([taskId, metadata]) => [
+      taskId,
+      discardMismatchedTaskStateMetadata({
+        taskId,
+        lifecycleStatus: lifecycleByTaskId.get(taskId) ?? null,
+        metadata
+      })
+    ]).filter((entry) => entry[1] != null))
+  };
+}
+function serializeIssuesJsonl(rows) {
+  return `${rows.map((row) => JSON.stringify(row)).join(`
+`)}
+`;
+}
+function serializeTaskStateEnvelope(envelope) {
+  return `${JSON.stringify({
+    schemaVersion: envelope.schemaVersion,
+    baseTrackerCommit: envelope.baseTrackerCommit,
+    tasks: envelope.tasks
+  }, null, 2)}
+`;
+}
+function findIssueRowIndex(rows, taskId) {
+  return rows.findIndex((row) => typeof row.id === "string" && row.id === taskId);
+}
+function assertWritableTrackerStateBases(state) {
+  if (state.issuesBaseOid !== state.taskStateBaseOid) {
+    throw new TrackerStateMutationError("Tracker writes require issues.jsonl and task-state.json from the same remote base.", "same-base-required");
+  }
+}
+function readWritableTrackerState(projectRoot, deps) {
+  const repoPath = resolveTrackerRepoPath(projectRoot);
+  const baseOid = deps.fetchRef(repoPath, "origin", "main");
+  const issuesText = deps.readBlobAtRef(repoPath, baseOid, ".beads/issues.jsonl");
+  const taskStateText = (() => {
+    try {
+      return deps.readBlobAtRef(repoPath, baseOid, ".beads/task-state.json");
+    } catch {
+      return null;
+    }
+  })();
+  return {
+    repoPath,
+    baseOid,
+    issuesBaseOid: baseOid,
+    taskStateBaseOid: baseOid,
+    issueRows: parseIssuesJsonl2(issuesText),
+    taskStateEnvelope: sanitizeTaskStateEnvelope(parseIssuesJsonl2(issuesText), parseTaskStateEnvelope2(taskStateText, baseOid))
+  };
+}
+function cloneWritableState(state) {
+  return {
+    ...state,
+    issueRows: state.issueRows.map((row) => ({ ...row })),
+    taskStateEnvelope: {
+      ...state.taskStateEnvelope,
+      tasks: Object.fromEntries(Object.entries(state.taskStateEnvelope.tasks).map(([taskId, metadata]) => [taskId, { ...metadata }]))
+    }
+  };
+}
+function currentLifecycleStatus(state, taskId) {
+  const issueIndex = findIssueRowIndex(state.issueRows, taskId);
+  if (issueIndex === -1) {
+    throw new TrackerStateMutationError(`Task ${taskId} was not found in issues.jsonl.`, "task-not-found");
+  }
+  const status = normalizeTaskLifecycleStatus(state.issueRows[issueIndex]?.status);
+  if (!status) {
+    throw new TrackerStateMutationError(`Task ${taskId} has an invalid lifecycle status.`, "invalid-task-status");
+  }
+  return status;
+}
+function setLifecycleStatus(state, taskId, status) {
+  const issueIndex = findIssueRowIndex(state.issueRows, taskId);
+  if (issueIndex === -1) {
+    throw new TrackerStateMutationError(`Task ${taskId} was not found in issues.jsonl.`, "task-not-found");
+  }
+  state.issueRows[issueIndex] = {
+    ...state.issueRows[issueIndex],
+    status
+  };
+}
+function prepareLifecycleTaskMutation(state, input) {
+  assertWritableTrackerStateBases(state);
+  const next = cloneWritableState(state);
+  const lifecycleStatus = currentLifecycleStatus(next, input.taskId);
+  if (input.allowedFrom && !input.allowedFrom.includes(lifecycleStatus)) {
+    throw new TrackerStateMutationError(`Task ${input.taskId} is ${lifecycleStatus}, expected one of ${input.allowedFrom.join(", ")}.`, "status-conflict");
+  }
+  setLifecycleStatus(next, input.taskId, input.status);
+  next.taskStateEnvelope.baseTrackerCommit = next.baseOid;
+  if (input.clearMetadata || input.metadata == null) {
+    delete next.taskStateEnvelope.tasks[input.taskId];
+  } else {
+    next.taskStateEnvelope.tasks[input.taskId] = input.metadata;
+  }
+  return next;
+}
+function desiredTaskStateSatisfied(raw, desired) {
+  const issue = parseIssuesJsonl2(raw.issuesText).find((entry) => entry.id === desired.taskId);
+  if (!issue || issue.status !== desired.status) {
+    return false;
+  }
+  const rawTaskState = parseRawTaskStateFile(raw.taskStateText);
+  if (!rawTaskState || rawTaskState.schemaVersion !== 1) {
+    return false;
+  }
+  const rawMetadata = rawTaskState.tasks[desired.taskId] ?? null;
+  const snapshotMetadata = discardMismatchedTaskStateMetadata({
+    taskId: desired.taskId,
+    lifecycleStatus: desired.status,
+    metadata: rawMetadata
+  });
+  if (desired.metadata == null) {
+    return rawMetadata == null && snapshotMetadata == null;
+  }
+  if (rawMetadata == null || snapshotMetadata == null) {
+    return false;
+  }
+  return isDeepStrictEqual(snapshotMetadata ?? null, desired.metadata);
+}
+function persistTrackerState(projectRoot, state, desired, message, deps) {
+  const updates = [
+    { path: ".beads/issues.jsonl", content: serializeIssuesJsonl(state.issueRows) },
+    { path: ".beads/task-state.json", content: serializeTaskStateEnvelope(state.taskStateEnvelope) }
+  ];
+  const commitOid = deps.writeTreeCommit(state.repoPath, state.baseOid, updates, message);
+  try {
+    deps.pushRefWithLease(state.repoPath, commitOid, "refs/heads/main", state.baseOid);
+    return {
+      outcome: "applied",
+      snapshot: deps.readSnapshot(projectRoot),
+      commitOid
+    };
+  } catch (error) {
+    const latestBaseOid = deps.fetchRef(state.repoPath, "origin", "main");
+    const latestIssuesText = deps.readBlobAtRef(state.repoPath, latestBaseOid, ".beads/issues.jsonl");
+    const latestTaskStateText = (() => {
+      try {
+        return deps.readBlobAtRef(state.repoPath, latestBaseOid, ".beads/task-state.json");
+      } catch {
+        return null;
+      }
+    })();
+    const latestSnapshot = deps.readSnapshot(projectRoot);
+    if (desiredTaskStateSatisfied({
+      issuesText: latestIssuesText,
+      taskStateText: latestTaskStateText
+    }, desired)) {
+      return {
+        outcome: "noop",
+        snapshot: latestSnapshot,
+        commitOid: null
+      };
+    }
+    throw new TrackerStateMutationError(error instanceof Error ? error.message : String(error), "push-conflict");
+  }
+}
+function updateRemoteTrackerTaskLifecycle(projectRoot, input, deps = {}) {
+  const writerDeps = { ...DEFAULT_WRITER_DEPS, ...deps };
+  const nextState = prepareLifecycleTaskMutation(readWritableTrackerState(projectRoot, writerDeps), input);
+  return persistTrackerState(projectRoot, nextState, { taskId: input.taskId, status: input.status, metadata: input.clearMetadata ? null : nextState.taskStateEnvelope.tasks[input.taskId] ?? null }, `chore(tracker): ${input.reason ?? "update"} ${input.taskId} -> ${input.status}`, writerDeps);
+}
+var DEFAULT_WRITER_DEPS, TrackerStateMutationError;
+var init_write = __esm(() => {
+  init_native_git2();
+  init_read();
+  init_reconcile();
+  init_types();
+  init_repo();
+  DEFAULT_WRITER_DEPS = {
+    fetchRef: nativeFetchRef,
+    readBlobAtRef: nativeReadBlobAtRef,
+    writeTreeCommit: nativeWriteTreeCommit,
+    pushRefWithLease: nativePushRefWithLease,
+    readSnapshot: readSyncedTrackerState,
+    createClaimId: () => `claim-${crypto.randomUUID()}`,
+    now: () => new Date().toISOString()
+  };
+  TrackerStateMutationError = class TrackerStateMutationError extends Error {
+    code;
+    constructor(message, code) {
+      super(message);
+      this.code = code;
+    }
+  };
+});
+
+// packages/task-sources-plugin/src/control-plane/state-sync/index.ts
+var init_state_sync = __esm(() => {
+  init_types();
+  init_read();
+  init_reconcile();
+  init_write();
+});
+
+// packages/task-sources-plugin/src/control-plane/native/task-state.ts
+import { existsSync as existsSync5, readFileSync as readFileSync4, readdirSync as readdirSync2, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
+import { basename as basename2, resolve as resolve5 } from "path";
+import { assertPathInsideRoot, safePathSegment } from "@rig/core/safe-identifiers";
+import { loadRuntimeContextFromEnv } from "@rig/core/runtime-context";
+function readTaskConfig(projectRoot) {
+  const raw = readJsonFile(resolveTaskConfigPath(projectRoot), {});
+  return stripTaskConfigMetadata(raw);
+}
+function readSourceTaskConfig(projectRoot) {
+  const raw = readAndSyncSourceTaskConfig(projectRoot);
+  return stripTaskConfigMetadata(raw);
+}
+function readValidationDescriptions(projectRoot) {
+  const raw = readJsonFile(resolveTaskConfigPath(projectRoot), {});
+  return readValidationDescriptionMap(raw);
+}
+function readSourceValidationDescriptions(projectRoot) {
+  const rootRaw = readJsonFile(resolve5(projectRoot, "rig", "task-config.json"), {});
+  const sourcePath = findSourceTaskConfigPath(projectRoot);
+  const sourceRaw = sourcePath ? readJsonFile(sourcePath, {}) : {};
+  const rootDescriptions = readValidationDescriptionMap(rootRaw);
+  const sourceDescriptions = readValidationDescriptionMap(sourceRaw);
+  return {
+    ...rootDescriptions,
+    ...sourceDescriptions
+  };
+}
+function currentTaskId(projectRoot) {
+  const fromEnv = (process.env.RIG_TASK_ID || "").trim();
+  if (fromEnv) {
+    return fromEnv;
+  }
+  const runtimeId = (process.env.RIG_TASK_RUNTIME_ID || "").trim();
+  if (runtimeId.startsWith("task-") && runtimeId.length > "task-".length) {
+    return runtimeId.slice("task-".length);
+  }
+  const workspace = (process.env.RIG_TASK_WORKSPACE || "").trim();
+  const inferredFromWorkspace = inferTaskIdFromRuntimePath(workspace);
+  if (inferredFromWorkspace) {
+    return inferredFromWorkspace;
+  }
+  const inferredFromCwd = inferTaskIdFromRuntimePath(process.cwd());
+  if (inferredFromCwd) {
+    return inferredFromCwd;
+  }
+  try {
+    const paths = resolveHarnessPaths(projectRoot);
+    const session = readJsonFile(paths.sessionPath, {});
+    return session.activeTaskIds?.[0] || "";
+  } catch {
+    return "";
+  }
+}
+function readSourceTaskStateMetadata(projectRoot, taskId, lifecycleStatus, snapshot) {
+  const syncedSnapshot = snapshot ?? readSyncedTrackerState(projectRoot);
+  const syncedIssue = syncedSnapshot.issues.find((issue) => issue.id === taskId) ?? null;
+  const syncedLifecycleStatus = syncedIssue && syncedIssue.status !== "unknown" ? syncedIssue.status : readLocalSourceTaskLifecycleStatus(projectRoot, taskId);
+  const metadata = syncedSnapshot.taskState.tasks[taskId] ?? readLocalSourceTaskStateEnvelope(projectRoot).tasks[taskId] ?? null;
+  return discardMismatchedTaskStateMetadata({
+    taskId,
+    lifecycleStatus: syncedLifecycleStatus ?? normalizeTaskLifecycleStatus(lifecycleStatus),
+    metadata
+  });
+}
+function readValidationDescriptionMap(raw) {
+  return {
+    ...coerceValidationDescriptions(raw.validation_descriptions),
+    ...coerceValidationDescriptions(readValidationDescriptionsFromMeta(raw._meta))
+  };
+}
+function stripTaskConfigMetadata(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function coerceValidationDescriptions(candidate) {
+  if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) {
+    return {};
+  }
+  const descriptions = {};
+  for (const [key, value] of Object.entries(candidate)) {
+    if (typeof value === "string" && value.length > 0) {
+      descriptions[key] = value;
+    }
+  }
+  return descriptions;
+}
+function readValidationDescriptionsFromMeta(meta) {
+  if (!meta || typeof meta !== "object" || Array.isArray(meta)) {
+    return;
+  }
+  return meta.validation_descriptions;
+}
+function readLocalSourceTaskStateEnvelope(projectRoot) {
+  const taskStatePath = resolve5(resolveCheckoutRoot(projectRoot), ".beads", "task-state.json");
+  return readTaskStateMetadataEnvelope(readJsonFile(taskStatePath, {}));
+}
+function readLocalSourceTaskLifecycleStatus(projectRoot, taskId) {
+  const issuesPath = resolve5(resolveCheckoutRoot(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync5(issuesPath)) {
+    return null;
+  }
+  for (const line of readFileSync4(issuesPath, "utf8").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (parsed.id === taskId && parsed.issue_type === "task") {
+        return normalizeTaskLifecycleStatus(parsed.status);
+      }
+    } catch {}
+  }
+  return null;
+}
+function inferTaskIdFromRuntimePath(path) {
+  if (!path) {
+    return "";
+  }
+  const match = path.match(/\/\.rig\/runtime\/agents\/task-([^/]+)\/worktree(?:\/|$)/) || path.match(/\/\.worktrees\/([^/]+)(?:\/|$)/);
+  const candidate = match?.[1] || "";
+  return candidate.startsWith("bd-") ? candidate : "";
+}
+function lookupTask(projectRoot, input) {
+  if (!input) {
+    return "";
+  }
+  if (!input.startsWith("bd-")) {
+    return input;
+  }
+  try {
+    const taskConfig2 = readTaskConfig(projectRoot);
+    if (taskConfig2[input]) {
+      return input;
+    }
+  } catch {}
+  const taskConfig = readSourceTaskConfig(projectRoot);
+  return taskConfig[input] ? input : "";
+}
+function artifactDirForId(projectRoot, id) {
+  const safeId = safePathSegment(id, { fallback: "task", maxLength: 96 });
+  const workspaceDir = process.env.RIG_TASK_WORKSPACE?.trim();
+  if (workspaceDir) {
+    const worktreeArtifactsRoot = resolve5(workspaceDir, "artifacts");
+    const worktreeArtifacts = assertPathInsideRoot(worktreeArtifactsRoot, resolve5(worktreeArtifactsRoot, safeId), "artifact directory");
+    if (existsSync5(worktreeArtifacts) || existsSync5(worktreeArtifactsRoot)) {
+      return worktreeArtifacts;
+    }
+  }
+  try {
+    const paths = resolveHarnessPaths(projectRoot);
+    return assertPathInsideRoot(paths.artifactsDir, resolve5(paths.artifactsDir, safeId), "artifact directory");
+  } catch {
+    const artifactsRoot = resolve5(resolveCheckoutRoot(projectRoot), "artifacts");
+    return assertPathInsideRoot(artifactsRoot, resolve5(artifactsRoot, safeId), "artifact directory");
+  }
+}
+function resolveTaskConfigPath(projectRoot) {
+  const paths = resolveHarnessPaths(projectRoot);
+  if (existsSync5(paths.taskConfigPath)) {
+    return paths.taskConfigPath;
+  }
+  for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
+    if (existsSync5(candidate)) {
+      return candidate;
+    }
+  }
+  throw new Error(`Task config missing at ${paths.taskConfigPath}.`);
+}
+function findSourceTaskConfigPath(projectRoot) {
+  for (const candidate of sourceTaskConfigCandidates(projectRoot)) {
+    if (existsSync5(candidate)) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function readAndSyncSourceTaskConfig(projectRoot) {
+  const sourcePath = findSourceTaskConfigPath(projectRoot);
+  const raw = sourcePath ? readJsonFile(sourcePath, {}) : readConfiguredFileTaskConfig(projectRoot);
+  const synced = synchronizeTaskConfigWithTracker(projectRoot, raw);
+  if (sourcePath && synced.updated) {
+    try {
+      writeFileSync3(sourcePath, `${JSON.stringify(synced.config, null, 2)}
+`, "utf-8");
+    } catch {}
+  }
+  return synced.config;
+}
+function synchronizeTaskConfigWithTracker(projectRoot, rawConfig) {
+  const issues = readSourceIssueRecords(projectRoot);
+  if (issues.length === 0) {
+    return { config: rawConfig, updated: false };
+  }
+  const taskConfig = stripTaskConfigMetadata(rawConfig);
+  const mergedConfig = { ...taskConfig };
+  const validationDescriptions = coerceValidationDescriptions(rawConfig.validation_descriptions);
+  const metaValidationDescriptions = coerceValidationDescriptions(readValidationDescriptionsFromMeta(rawConfig._meta));
+  let updated = false;
+  for (const issue of issues) {
+    if (issue.issueType !== "task") {
+      continue;
+    }
+    if (mergedConfig[issue.id] && !shouldRefreshAutoSyncedTaskConfigEntry(mergedConfig[issue.id])) {
+      continue;
+    }
+    mergedConfig[issue.id] = buildAutoSyncedTaskConfigEntry(issue);
+    updated = true;
+  }
+  return {
+    config: {
+      ...mergedConfig,
+      ...Object.keys(validationDescriptions).length > 0 ? { validation_descriptions: validationDescriptions } : {},
+      ...Object.keys(metaValidationDescriptions).length > 0 ? { _meta: { validation_descriptions: metaValidationDescriptions } } : {}
+    },
+    updated
+  };
+}
+function shouldRefreshAutoSyncedTaskConfigEntry(entry) {
+  if (!entry || typeof entry !== "object") {
+    return false;
+  }
+  const candidate = entry;
+  if (!candidate.auto_synced) {
+    return false;
+  }
+  if (!Array.isArray(candidate.scope) || candidate.scope.length === 0) {
+    return true;
+  }
+  if (candidate.scope.some((glob) => typeof glob !== "string" || glob.trim().length === 0)) {
+    return true;
+  }
+  return !candidate.role;
+}
+function readSourceIssueRecords(projectRoot) {
+  const issuesPath = resolve5(resolveCheckoutRoot(projectRoot), ".beads", "issues.jsonl");
+  if (!existsSync5(issuesPath)) {
+    return [];
+  }
+  const records = [];
+  for (const line of readFileSync4(issuesPath, "utf-8").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(trimmed);
+      const id = typeof parsed.id === "string" ? parsed.id.trim() : "";
+      if (!id) {
+        continue;
+      }
+      records.push({
+        id,
+        title: typeof parsed.title === "string" ? parsed.title.trim() : "",
+        issueType: typeof parsed.issue_type === "string" ? parsed.issue_type.trim() : null,
+        labels: Array.isArray(parsed.labels) ? parsed.labels.filter((label) => typeof label === "string") : []
+      });
+    } catch {}
+  }
+  return records;
+}
+function buildAutoSyncedTaskConfigEntry(issue) {
+  return {
+    auto_synced: true,
+    role: inferAutoSyncedTaskRole(issue),
+    scope: inferAutoSyncedTaskScope(issue),
+    validation: []
+  };
+}
+function inferAutoSyncedTaskRole(issue) {
+  for (const label of issue.labels) {
+    if (label === "role:architect")
+      return "architect";
+    if (label === "role:extractor")
+      return "extractor";
+    if (label === "role:mechanic")
+      return "mechanic";
+    if (label === "role:verifier")
+      return "verifier";
+  }
+  if (/\bDESIGN\b/i.test(issue.title)) {
+    return "architect";
+  }
+  if (/\bInitialize\b/i.test(issue.title)) {
+    return "mechanic";
+  }
+  return "extractor";
+}
+function inferAutoSyncedTaskScope(issue) {
+  return [`artifacts/${issue.id}/**`];
+}
+function readConfiguredFileTaskConfig(projectRoot) {
+  const sourcePath = readConfiguredFilesTaskSourcePath(projectRoot);
+  if (!sourcePath) {
+    return {};
+  }
+  const directory = resolve5(projectRoot, sourcePath);
+  if (!existsSync5(directory)) {
+    return {};
+  }
+  const config = {};
+  for (const name of readdirSync2(directory)) {
+    if (!FILE_TASK_PATTERN.test(name))
+      continue;
+    const file = resolve5(directory, name);
+    try {
+      if (!statSync2(file).isFile())
+        continue;
+      const raw = JSON.parse(readFileSync4(file, "utf8"));
+      if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        continue;
+      const record = raw;
+      const inferredId = basename2(name).replace(FILE_TASK_PATTERN, "");
+      const id = typeof record.id === "string" && record.id.trim().length > 0 ? record.id.trim() : inferredId;
+      config[id] = fileTaskToConfigEntry(record, { kind: "files", path: sourcePath });
+    } catch {}
+  }
+  return config;
+}
+function fileTaskToConfigEntry(task, source) {
+  const labels = Array.isArray(task.labels) ? task.labels.filter((label) => typeof label === "string") : [];
+  const scope = firstStringList(task.scope, labels.filter((label) => label.startsWith("scope:")).map((label) => label.slice("scope:".length)));
+  const validation = firstStringList(task.validation, task.validators, labels.filter((label) => label.startsWith("validator:")).map((label) => label.slice("validator:".length)));
+  const roleLabel = labels.find((label) => label.startsWith("role:"));
+  const role = typeof task.role === "string" && task.role.trim().length > 0 ? task.role.trim() : roleLabel ? roleLabel.slice("role:".length) : undefined;
+  return {
+    auto_synced: true,
+    ...typeof task.title === "string" ? { title: task.title } : {},
+    ...typeof task.status === "string" ? { status: task.status } : {},
+    ...typeof task.description === "string" ? { description: task.description } : {},
+    ...typeof task.acceptance_criteria === "string" ? { acceptance_criteria: task.acceptance_criteria } : typeof task.acceptanceCriteria === "string" ? { acceptance_criteria: task.acceptanceCriteria } : {},
+    ...role ? { role } : {},
+    ...scope.length > 0 ? { scope } : {},
+    ...validation.length > 0 ? { validation } : {},
+    _rig: { taskSource: source }
+  };
+}
+function firstStringList(...candidates) {
+  for (const candidate of candidates) {
+    if (!Array.isArray(candidate)) {
+      continue;
+    }
+    const list = candidate.filter((entry) => typeof entry === "string" && entry.trim().length > 0);
+    if (list.length > 0) {
+      return list;
+    }
+  }
+  return [];
+}
+function readConfiguredFilesTaskSourcePath(projectRoot) {
+  const jsonPath = resolve5(projectRoot, "rig.config.json");
+  if (existsSync5(jsonPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync4(jsonPath, "utf8"));
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        const taskSource = parsed.taskSource;
+        if (taskSource && typeof taskSource === "object" && !Array.isArray(taskSource)) {
+          const record = taskSource;
+          return record.kind === "files" && typeof record.path === "string" ? record.path : null;
+        }
+      }
+    } catch {
+      return null;
+    }
+  }
+  const tsPath = resolve5(projectRoot, "rig.config.ts");
+  if (!existsSync5(tsPath)) {
+    return null;
+  }
+  try {
+    const source = readFileSync4(tsPath, "utf8");
+    const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
+    const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
+    if (kind !== "files") {
+      return null;
+    }
+    return taskSourceBlock.match(/path\s*:\s*["']([^"']+)["']/)?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+function sourceTaskConfigCandidates(projectRoot) {
+  const runtimeContext = loadRuntimeContextFromEnv();
+  return [
+    runtimeContext?.monorepoMainRoot ? resolve5(runtimeContext.monorepoMainRoot, ".rig", "task-config.json") : "",
+    process.env.MONOREPO_MAIN_ROOT?.trim() ? resolve5(process.env.MONOREPO_MAIN_ROOT.trim(), ".rig", "task-config.json") : "",
+    resolve5(resolveCheckoutRoot(projectRoot), ".rig", "task-config.json")
+  ].filter(Boolean);
+}
+var FILE_TASK_PATTERN;
+var init_task_state = __esm(() => {
+  init_state_sync();
+  init_utils();
+  FILE_TASK_PATTERN = /\.(task\.)?json$/;
+});
+
+// packages/task-sources-plugin/src/control-plane/task-source-bootstrap.ts
+import { buildTaskSourceRegistry } from "@rig/core/plugin-host-registries";
+var init_task_source_bootstrap = () => {};
+
+// packages/task-sources-plugin/src/control-plane/tasks/legacy-task-config-source.ts
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { resolve as resolve6 } from "path";
+import { findTaskById } from "@rig/core/task-record-reader";
+function createLegacyTaskConfigRecordReader(projectRoot, options = {}) {
+  const configPath = options.configPath ?? resolve6(projectRoot, ".rig", "task-config.json");
+  const reader = {
+    async listTasks() {
+      return readLegacyTaskRecords(projectRoot, configPath);
+    },
+    async getTask(id) {
+      return findTaskById(reader, id);
+    }
+  };
+  return reader;
+}
+function readLegacyTaskRecords(projectRoot, configPath = resolve6(projectRoot, ".rig", "task-config.json")) {
+  if (!existsSync6(configPath)) {
+    return [];
+  }
+  const rawConfig = readLegacyTaskConfigJson(projectRoot, configPath);
+  return Object.entries(stripLegacyTaskConfigMetadata(rawConfig)).map(([id, entry]) => legacyTaskConfigEntryToRecord(id, entry)).filter((record) => record !== null);
+}
+function readLegacyTaskConfigJson(projectRoot, configPath) {
+  try {
+    const parsed = JSON.parse(readFileSync5(configPath, "utf8"));
+    if (isPlainRecord(parsed)) {
+      return parsed;
+    }
+    throw new Error("task config root must be a JSON object");
+  } catch (cause) {
+    throw new LegacyTaskConfigReadError({
+      projectRoot,
+      configPath,
+      message: `Could not read legacy task config at ${configPath} for project ${projectRoot}: ${cause instanceof Error ? cause.message : String(cause)}`,
+      cause
+    });
+  }
+}
+function stripLegacyTaskConfigMetadata(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function legacyTaskConfigEntryToRecord(id, entry) {
+  if (!isPlainRecord(entry)) {
+    return null;
+  }
+  const deps = firstStringList2(entry.deps, entry.dependencies, entry.validation_deps, entry.validationDeps);
+  const validation = readStringList(entry.validation);
+  const validators = readStringList(entry.validators);
+  const scope = readStringList(entry.scope);
+  const status = typeof entry.status === "string" ? entry.status : "open";
+  const title = typeof entry.title === "string" ? entry.title : undefined;
+  const description = typeof entry.description === "string" ? entry.description : undefined;
+  const acceptanceCriteria = typeof entry.acceptance_criteria === "string" ? entry.acceptance_criteria : typeof entry.acceptanceCriteria === "string" ? entry.acceptanceCriteria : undefined;
+  return {
+    id,
+    deps,
+    status,
+    source: "legacy-task-config",
+    ...title ? { title } : {},
+    ...description ? { description } : {},
+    ...acceptanceCriteria ? { acceptanceCriteria } : {},
+    ...scope.length > 0 ? { scope } : {},
+    ...validation.length > 0 ? { validation } : {},
+    ...validators.length > 0 ? { validators } : {},
+    ...preservedLegacyFields(entry)
+  };
+}
+function preservedLegacyFields(entry) {
+  const preserved = {};
+  for (const key of [
+    "role",
+    "browser",
+    "repo_pins",
+    "criticality",
+    "queue_weight",
+    "creates_repo",
+    "auto_synced"
+  ]) {
+    if (entry[key] !== undefined) {
+      preserved[key] = entry[key];
+    }
+  }
+  return preserved;
+}
+function firstStringList2(...candidates) {
+  for (const candidate of candidates) {
+    const list = readStringList(candidate);
+    if (list.length > 0) {
+      return list;
+    }
+  }
+  return [];
+}
+function readStringList(candidate) {
+  if (!Array.isArray(candidate)) {
+    return [];
+  }
+  return candidate.filter((value) => typeof value === "string");
+}
+function isPlainRecord(candidate) {
+  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
+}
+var LegacyTaskConfigReadError;
+var init_legacy_task_config_source = __esm(() => {
+  LegacyTaskConfigReadError = class LegacyTaskConfigReadError extends Error {
+    code = "LEGACY_TASK_CONFIG_READ_FAILED";
+    projectRoot;
+    configPath;
+    cause;
+    constructor(input) {
+      super(input.message, { cause: input.cause });
+      this.name = "LegacyTaskConfigReadError";
+      this.projectRoot = input.projectRoot;
+      this.configPath = input.configPath;
+      this.cause = input.cause;
+    }
+  };
+});
+
+// packages/task-sources-plugin/src/control-plane/native/github-token-env.ts
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
+function cleanToken(value) {
+  const trimmed = value?.trim() ?? "";
+  return trimmed.length > 0 ? trimmed : null;
+}
+function authStateToken(env = process.env) {
+  const file = env.RIG_GITHUB_AUTH_STATE_FILE?.trim();
+  if (!file || !existsSync7(file))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync6(file, "utf8"));
+    return cleanToken(typeof parsed.token === "string" ? parsed.token : undefined);
+  } catch {
+    return null;
+  }
+}
+var init_github_token_env = () => {};
+
+// packages/task-sources-plugin/src/control-plane/tasks/source-aware-task-config-source.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync8, readFileSync as readFileSync7, readdirSync as readdirSync3, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
+import { basename as basename3, join as join2, resolve as resolve7 } from "path";
+function createSourceAwareTaskConfigRecordReader(projectRoot, options = {}) {
+  const configPath = options.configPath ?? resolve7(projectRoot, ".rig", "task-config.json");
+  const legacy = createLegacyTaskConfigRecordReader(projectRoot, { configPath });
+  const spawnFn = options.spawn ?? spawnSync2;
+  const ghBinary = options.ghBinary ?? "gh";
+  const allowLocalFallback = options.allowLocalTaskConfigStatusFallback ?? true;
+  return {
+    async listTasks() {
+      const rawConfig = readRawTaskConfig(configPath);
+      if (!rawConfig) {
+        const configuredFilesPath = readConfiguredFilesTaskSourcePath2(projectRoot);
+        return configuredFilesPath ? listFileBackedTasks(projectRoot, configuredFilesPath) : [];
+      }
+      const tasks = [];
+      const legacyTasks = await legacy.listTasks();
+      const legacyById = new Map(legacyTasks.map((task) => [task.id, task]));
+      for (const [id, rawEntry] of Object.entries(stripLegacyTaskConfigMetadata2(rawConfig))) {
+        if (!isPlainRecord2(rawEntry)) {
+          continue;
+        }
+        const metadata = readMaterializedTaskMetadata(rawEntry);
+        if (metadata.taskSource?.kind === "github-issues") {
+          tasks.push(readGithubIssueTask(ghBinary, spawnFn, id, metadata, rawEntry));
+          continue;
+        }
+        if (metadata.taskSource?.kind === "files" && metadata.taskSource.path) {
+          const fileTask = readFileBackedTask(projectRoot, metadata.taskSource.path, id, rawEntry);
+          if (fileTask)
+            tasks.push(fileTask);
+          continue;
+        }
+        if (!allowLocalFallback) {
+          continue;
+        }
+        const legacyTask = legacyById.get(id);
+        if (legacyTask) {
+          tasks.push(legacyTask);
+        }
+      }
+      return tasks;
+    },
+    async getTask(id) {
+      const rawEntry = readRawTaskEntry(configPath, id);
+      if (!rawEntry) {
+        const configuredFilesPath = readConfiguredFilesTaskSourcePath2(projectRoot);
+        return configuredFilesPath ? readFileBackedTask(projectRoot, configuredFilesPath, id, {}) : null;
+      }
+      const metadata = readMaterializedTaskMetadata(rawEntry);
+      if (metadata.taskSource?.kind === "github-issues") {
+        return readGithubIssueTask(ghBinary, spawnFn, id, metadata, rawEntry);
+      }
+      if (metadata.taskSource?.kind === "files" && metadata.taskSource.path) {
+        return readFileBackedTask(projectRoot, metadata.taskSource.path, id, rawEntry);
+      }
+      return allowLocalFallback ? legacy.getTask(id) : null;
+    }
+  };
+}
+async function readSourceAwareTaskStatus(projectRoot, taskId, options = {}) {
+  try {
+    const task = await createSourceAwareTaskConfigRecordReader(projectRoot, options).getTask(taskId);
+    return task?.status ?? null;
+  } catch {
+    return null;
+  }
+}
+function updateGithubIssueTaskBySourceIssueId(sourceIssueId, taskId, update, options = {}) {
+  const parsed = sourceIssueId?.trim().match(/^([^/]+)\/([^#]+)#(\d+)$/);
+  if (!parsed || parsed[3] !== taskId) {
+    return false;
+  }
+  applyGithubIssueUpdate(options.ghBinary ?? "gh", options.spawn ?? spawnSync2, parsed[3], {
+    sourceIssueId: sourceIssueId.trim(),
+    taskSource: { kind: "github-issues", owner: parsed[1], repo: parsed[2] }
+  }, update);
+  return true;
+}
+function updateSourceAwareTaskConfigTask(projectRoot, taskId, update, options = {}) {
+  const configPath = options.configPath ?? resolve7(projectRoot, ".rig", "task-config.json");
+  const rawEntry = readRawTaskEntry(configPath, taskId);
+  if (!rawEntry) {
+    const configuredFilesPath = readConfiguredFilesTaskSourcePath2(projectRoot);
+    return configuredFilesPath ? updateFileBackedTask(projectRoot, configuredFilesPath, taskId, update) : false;
+  }
+  const metadata = readMaterializedTaskMetadata(rawEntry);
+  const source = metadata.taskSource;
+  if (source?.kind === "github-issues") {
+    applyGithubIssueUpdate(options.ghBinary ?? "gh", options.spawn ?? spawnSync2, taskId, metadata, update);
+    return true;
+  }
+  if (source?.kind === "files" && source.path) {
+    return updateFileBackedTask(projectRoot, source.path, taskId, update);
+  }
+  if (source?.kind && source.kind !== "files" && source.kind !== "legacy-task-config") {
+    return false;
+  }
+  if (!source && options.allowLocalTaskConfigStatusFallback === false) {
+    return false;
+  }
+  if (typeof update.status !== "string" || update.status.trim().length === 0) {
+    return false;
+  }
+  writeLegacyTaskStatus(configPath, taskId, update.status);
+  return true;
+}
+function readMaterializedTaskMetadata(entry) {
+  const rawRig = entry._rig;
+  if (!isPlainRecord2(rawRig)) {
+    return {};
+  }
+  const rawSource = rawRig.taskSource;
+  const metadata = {};
+  if (isPlainRecord2(rawSource)) {
+    const kind = typeof rawSource.kind === "string" ? rawSource.kind : "";
+    if (kind.length > 0) {
+      metadata.taskSource = {
+        kind,
+        ...typeof rawSource.path === "string" ? { path: rawSource.path } : {},
+        ...typeof rawSource.owner === "string" ? { owner: rawSource.owner } : {},
+        ...typeof rawSource.repo === "string" ? { repo: rawSource.repo } : {},
+        ...Array.isArray(rawSource.labels) ? { labels: rawSource.labels.filter((label) => typeof label === "string") } : {},
+        ...rawSource.state === "open" || rawSource.state === "closed" || rawSource.state === "all" ? { state: rawSource.state } : {}
+      };
+    }
+  }
+  if (typeof rawRig.sourceIssueId === "string") {
+    metadata.sourceIssueId = rawRig.sourceIssueId;
+  }
+  return metadata;
+}
+function readConfiguredFilesTaskSourcePath2(projectRoot) {
+  const jsonPath = resolve7(projectRoot, "rig.config.json");
+  if (existsSync8(jsonPath)) {
+    try {
+      const parsed = JSON.parse(readFileSync7(jsonPath, "utf8"));
+      if (isPlainRecord2(parsed) && isPlainRecord2(parsed.taskSource)) {
+        const source = parsed.taskSource;
+        return source.kind === "files" && typeof source.path === "string" ? source.path : null;
+      }
+    } catch {
+      return null;
+    }
+  }
+  const tsPath = resolve7(projectRoot, "rig.config.ts");
+  if (!existsSync8(tsPath)) {
+    return null;
+  }
+  try {
+    const source = readFileSync7(tsPath, "utf8");
+    const taskSourceBlock = source.match(/taskSource\s*:\s*\{[\s\S]*?\}/m)?.[0] ?? "";
+    const kind = taskSourceBlock.match(/kind\s*:\s*["']([^"']+)["']/)?.[1];
+    if (kind !== "files") {
+      return null;
+    }
+    return taskSourceBlock.match(/path\s*:\s*["']([^"']+)["']/)?.[1] ?? null;
+  } catch {
+    return null;
+  }
+}
+function readRawTaskEntry(configPath, taskId) {
+  const rawConfig = readRawTaskConfig(configPath);
+  if (!rawConfig) {
+    return null;
+  }
+  const entry = stripLegacyTaskConfigMetadata2(rawConfig)[taskId];
+  return isPlainRecord2(entry) ? entry : null;
+}
+function readRawTaskConfig(configPath) {
+  if (!existsSync8(configPath)) {
+    return null;
+  }
+  const parsed = JSON.parse(readFileSync7(configPath, "utf8"));
+  return isPlainRecord2(parsed) ? parsed : null;
+}
+function stripLegacyTaskConfigMetadata2(raw) {
+  const { validation_descriptions: _legacyDescriptions, _meta, ...tasks } = raw;
+  return tasks;
+}
+function writeLegacyTaskStatus(configPath, taskId, status) {
+  const rawConfig = readRawTaskConfig(configPath);
+  if (!rawConfig) {
+    return;
+  }
+  const entry = rawConfig[taskId];
+  if (!isPlainRecord2(entry)) {
+    return;
+  }
+  entry.status = status;
+  writeFileSync4(configPath, `${JSON.stringify(rawConfig, null, 2)}
+`, "utf8");
+}
+function updateFileBackedTask(projectRoot, sourcePath, taskId, update) {
+  const directory = resolve7(projectRoot, sourcePath);
+  const file = findFileBackedTaskFile(directory, taskId);
+  if (!file) {
+    return false;
+  }
+  const raw = JSON.parse(readFileSync7(file, "utf8"));
+  if (!isPlainRecord2(raw)) {
+    return false;
+  }
+  if (update.status)
+    raw.status = update.status;
+  if (update.title !== undefined)
+    raw.title = update.title;
+  if (update.body !== undefined)
+    raw.body = update.body;
+  if (update.comment?.trim()) {
+    const existing = Array.isArray(raw.comments) ? raw.comments : [];
+    raw.comments = [
+      ...existing,
+      { body: update.comment, createdAt: new Date().toISOString(), source: "rig" }
+    ];
+  }
+  writeFileSync4(file, `${JSON.stringify(raw, null, 2)}
+`, "utf8");
+  return true;
+}
+function listFileBackedTasks(projectRoot, sourcePath) {
+  const directory = resolve7(projectRoot, sourcePath);
+  if (!existsSync8(directory)) {
+    return [];
+  }
+  const tasks = [];
+  for (const name of readdirSync3(directory)) {
+    if (!FILE_TASK_PATTERN2.test(name))
+      continue;
+    const inferredId = basename3(name).replace(FILE_TASK_PATTERN2, "");
+    const task = readFileBackedTask(projectRoot, sourcePath, inferredId, {});
+    if (task)
+      tasks.push(task);
+  }
+  return tasks;
+}
+function readFileBackedTask(projectRoot, sourcePath, taskId, rawEntry) {
+  const file = findFileBackedTaskFile(resolve7(projectRoot, sourcePath), taskId);
+  if (!file) {
+    return null;
+  }
+  const raw = JSON.parse(readFileSync7(file, "utf8"));
+  if (!isPlainRecord2(raw)) {
+    return null;
+  }
+  return {
+    id: typeof raw.id === "string" ? raw.id : taskId,
+    deps: Array.isArray(raw.deps) ? raw.deps : Array.isArray(raw.depends_on) ? raw.depends_on : [],
+    status: typeof raw.status === "string" ? raw.status : "ready",
+    title: typeof raw.title === "string" ? raw.title : typeof rawEntry.title === "string" ? rawEntry.title : taskId,
+    ...raw
+  };
+}
+function findFileBackedTaskFile(directory, taskId) {
+  if (!existsSync8(directory)) {
+    return null;
+  }
+  for (const name of readdirSync3(directory)) {
+    if (!FILE_TASK_PATTERN2.test(name))
+      continue;
+    const file = join2(directory, name);
+    try {
+      if (!statSync3(file).isFile())
+        continue;
+      const raw = JSON.parse(readFileSync7(file, "utf8"));
+      const inferredId = basename3(file).replace(FILE_TASK_PATTERN2, "");
+      const id = isPlainRecord2(raw) && typeof raw.id === "string" ? raw.id : inferredId;
+      if (id === taskId) {
+        return file;
+      }
+    } catch {}
+  }
+  return null;
+}
+function readGithubIssueTask(bin, spawnFn, id, metadata, rawEntry) {
+  const source = requireGithubIssueSource(metadata, id);
+  const issue = runGh2(bin, [
+    "issue",
+    "view",
+    String(id),
+    "--repo",
+    `${source.owner}/${source.repo}`,
+    "--json",
+    "number,title,body,labels,state,url,assignees"
+  ], spawnFn);
+  return githubIssueToTask(issue, source, rawEntry);
+}
+function applyGithubIssueUpdate(bin, spawnFn, id, metadata, update) {
+  const source = requireGithubIssueSource(metadata, id);
+  const repo = `${source.owner}/${source.repo}`;
+  if (update.status) {
+    applyGithubIssueStatus(bin, repo, spawnFn, id, update.status);
+  }
+  if (typeof update.comment === "string" && update.comment.trim().length > 0) {
+    runGhVoid2(bin, ["issue", "comment", String(id), "--repo", repo, "--body", update.comment], spawnFn);
+  }
+  const editArgs = ["issue", "edit", String(id), "--repo", repo];
+  if (typeof update.title === "string" && update.title.trim().length > 0) {
+    editArgs.push("--title", update.title.trim());
+  }
+  if (typeof update.body === "string") {
+    editArgs.push("--body", update.body);
+  }
+  if (editArgs.length > 5) {
+    runGhVoid2(bin, editArgs, spawnFn);
+  }
+}
+function requireGithubIssueSource(metadata, id) {
+  const source = metadata.taskSource;
+  if (source?.kind === "github-issues" && source.owner && source.repo) {
+    return { owner: source.owner, repo: source.repo };
+  }
+  const parsed = metadata.sourceIssueId?.match(/^([^/]+)\/([^#]+)#(\d+)$/);
+  if (parsed && parsed[3] === id) {
+    return { owner: parsed[1], repo: parsed[2] };
+  }
+  throw new Error(`Task ${id} is marked as github-issues but has no owner/repo source metadata`);
+}
+function githubIssueToTask(issue, source, rawEntry) {
+  const labelNames = (issue.labels ?? []).map((label) => label.name);
+  const scope = labelNames.filter((label) => label.startsWith("scope:")).map((label) => label.slice("scope:".length));
+  const roleLabel = labelNames.find((label) => label.startsWith("role:"));
+  const validators = labelNames.filter((label) => label.startsWith("validator:")).map((label) => label.slice("validator:".length));
+  const body = issue.body ?? "";
+  const repo = `${source.owner}/${source.repo}`;
+  return {
+    id: String(issue.number),
+    deps: parseDeps2(body),
+    status: githubStatusFor(issue),
+    title: issue.title,
+    body,
+    ...scope.length > 0 ? { scope } : {},
+    ...roleLabel ? { role: roleLabel.slice("role:".length) } : typeof rawEntry.role === "string" ? { role: rawEntry.role } : {},
+    ...validators.length > 0 ? { validators } : {},
+    ...issue.url ? { url: issue.url } : {},
+    issueType: issueTypeFor2(labelNames),
+    sourceIssueId: `${repo}#${issue.number}`,
+    parentChildDeps: parseParents2(body),
+    labels: labelNames,
+    raw: issue,
+    source: "github-issues",
+    _rig: {
+      taskSource: { kind: "github-issues", owner: source.owner, repo: source.repo },
+      sourceIssueId: `${repo}#${issue.number}`
+    }
+  };
+}
+function githubStatusFor(issue) {
+  const state = (issue.state ?? "").toUpperCase();
+  if (state === "CLOSED")
+    return "closed";
+  const labelNames = (issue.labels ?? []).map((label) => label.name);
+  if (labelNames.includes("in-progress"))
+    return "in_progress";
+  if (labelNames.includes("blocked"))
+    return "blocked";
+  if (labelNames.includes("ready"))
+    return "ready";
+  if (labelNames.includes("under-review"))
+    return "under_review";
+  if (labelNames.includes("failed"))
+    return "failed";
+  if (labelNames.includes("cancelled"))
+    return "cancelled";
+  return "open";
+}
+function applyGithubIssueStatus(bin, repo, spawnFn, id, status) {
+  if (status === "closed") {
+    runGhVoid2(bin, ["issue", "close", String(id), "--repo", repo], spawnFn);
+    return;
+  }
+  const targetLabel = statusLabelFor2(status);
+  for (const label of STATUS_LABELS2) {
+    if (targetLabel !== null && label === targetLabel) {
+      continue;
+    }
+    try {
+      runGhVoid2(bin, ["issue", "edit", String(id), "--repo", repo, "--remove-label", label], spawnFn);
+    } catch {}
+  }
+  if (targetLabel !== null) {
+    try {
+      runGhVoid2(bin, ["issue", "edit", String(id), "--repo", repo, "--add-label", targetLabel], spawnFn);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (!/not found/i.test(message)) {
+        throw error;
+      }
+      ensureStatusLabel2(bin, repo, spawnFn, targetLabel);
+      runGhVoid2(bin, ["issue", "edit", String(id), "--repo", repo, "--add-label", targetLabel], spawnFn);
+    }
+  }
+}
+function statusLabelFor2(status) {
+  switch (status) {
+    case "in_progress":
+      return "in-progress";
+    case "blocked":
+      return "blocked";
+    case "ready":
+      return "ready";
+    case "under_review":
+      return "under-review";
+    case "failed":
+      return "failed";
+    case "cancelled":
+      return "cancelled";
+    case "open":
+      return null;
+    default:
+      throw new Error(`unsupported status: ${status}`);
+  }
+}
+function ensureStatusLabel2(bin, repo, spawnFn, label) {
+  try {
+    runGhVoid2(bin, [
+      "label",
+      "create",
+      label,
+      "--repo",
+      repo,
+      "--color",
+      "6f42c1",
+      "--description",
+      "Task status managed by Rig"
+    ], spawnFn);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (!/already exists/i.test(message)) {
+      throw error;
+    }
+  }
+}
+function selectedGitHubEnv() {
+  const token = process.env.RIG_GITHUB_SELECTED_TOKEN?.trim() || process.env.RIG_GITHUB_TOKEN?.trim() || authStateToken(process.env) || "";
+  return { GH_TOKEN: token, GITHUB_TOKEN: token, RIG_GITHUB_TOKEN: token };
+}
+function ghSpawnOptions2() {
+  return { encoding: "utf-8", env: { ...process.env, ...selectedGitHubEnv() } };
+}
+function tokenDiagnostic2(value) {
+  const clean = value?.trim() ?? "";
+  return clean ? `present(len=${clean.length})` : "missing";
+}
+function runGh2(bin, args, spawnFn) {
+  const options = ghSpawnOptions2();
+  const res = spawnFn(bin, [...args], options);
+  assertGhSuccess2(args, res, options.env);
+  if (!res.stdout || res.stdout.trim() === "") {
+    throw new Error(`gh ${args.join(" ")} returned empty stdout`);
+  }
+  return JSON.parse(res.stdout);
+}
+function runGhVoid2(bin, args, spawnFn) {
+  const options = ghSpawnOptions2();
+  const res = spawnFn(bin, [...args], options);
+  assertGhSuccess2(args, res, options.env);
+}
+function assertGhSuccess2(args, res, env) {
+  if (res.error) {
+    const msg = res.error.message ?? String(res.error);
+    throw new Error(`gh CLI not available \u2014 install gh (brew install gh / apt install gh): ${msg}`);
+  }
+  if (res.status !== 0) {
+    throw new Error(`gh ${args.join(" ")} failed (exit ${res.status}): ${res.stderr}
+[rig gh env:source-aware] GH_TOKEN=${tokenDiagnostic2(env.GH_TOKEN)} GITHUB_TOKEN=${tokenDiagnostic2(env.GITHUB_TOKEN)} RIG_GITHUB_TOKEN=${tokenDiagnostic2(env.RIG_GITHUB_TOKEN)}`);
+  }
+}
+function parseDeps2(body) {
+  return parseIssueRefs2(body, /^depends-on:\s*([^\n]+)/im);
+}
+function parseParents2(body) {
+  return parseIssueRefs2(body, /^parents?:\s*([^\n]+)/im);
+}
+function parseIssueRefs2(body, pattern) {
+  const match = body.match(pattern);
+  if (!match)
+    return [];
+  return match[1].split(",").map((value) => value.trim()).map((value) => value.replace(/^#/, "").match(/^(\d+)/)?.[1] ?? "").filter((value) => value.length > 0);
+}
+function issueTypeFor2(labels) {
+  const typed = labels.find((label) => label.startsWith("type:"));
+  if (typed)
+    return typed.slice("type:".length);
+  if (labels.includes("epic"))
+    return "epic";
+  return "task";
+}
+function isPlainRecord2(candidate) {
+  return typeof candidate === "object" && candidate !== null && !Array.isArray(candidate);
+}
+var STATUS_LABELS2, FILE_TASK_PATTERN2;
+var init_source_aware_task_config_source = __esm(() => {
+  init_legacy_task_config_source();
+  init_github_token_env();
+  STATUS_LABELS2 = new Set(["ready", "blocked", "in-progress", "under-review", "failed", "cancelled"]);
+  FILE_TASK_PATTERN2 = /\.(task\.)?json$/;
+});
+
+// packages/task-sources-plugin/src/control-plane/tasks/source-lifecycle.ts
+import { resolvePluginHost } from "@rig/core/project-plugins";
+import { setScopeRules } from "@rig/core/scope-rules";
+async function resolveTaskSourceContext(projectRoot) {
+  let resolved;
+  try {
+    resolved = await resolvePluginHost(projectRoot);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (msg.includes("no rig.config"))
+      return null;
+    throw err;
+  }
+  const { config, host } = resolved;
+  setScopeRules(config.workspace.scopeNormalization);
+  return {
+    taskSourceRegistry: buildTaskSourceRegistry(config, host, { projectRoot })
+  };
+}
+function runSourceTaskIdentity(run) {
+  const sourceTask = run.sourceTask;
+  return sourceTask && typeof sourceTask === "object" && !Array.isArray(sourceTask) ? sourceTask : null;
+}
+function mapToTaskSourceStatus(status) {
+  return status;
+}
+function hasRunnableTaskSource(source) {
+  return Boolean(source && typeof source === "object" && !Array.isArray(source));
+}
+function cleanString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function taskIdFromSourceIssueId(value) {
+  const raw = cleanString(value);
+  if (!raw)
+    return null;
+  const issueNumber = raw.match(/#([^#\s]+)$/)?.[1];
+  return issueNumber ?? raw;
+}
+function resolveSourceTaskId(taskId, sourceTask) {
+  return cleanString(sourceTask?.id) ?? taskIdFromSourceIssueId(sourceTask?.sourceIssueId) ?? taskIdFromSourceIssueId(sourceTask?.source_issue_id) ?? taskId;
+}
+async function getPluginTask(projectRoot, taskId) {
+  const ctx = await resolveTaskSourceContext(projectRoot);
+  const [source] = ctx?.taskSourceRegistry.list() ?? [];
+  if (!hasRunnableTaskSource(source)) {
+    return ctx ? { configured: false, sourceKind: null, task: null } : null;
+  }
+  const task = source.get ? await source.get(taskId) ?? null : (await source.list()).find((entry) => entry.id === taskId) ?? null;
+  return {
+    configured: true,
+    sourceKind: source.kind,
+    task
+  };
+}
+async function readConfiguredTaskSourceTask(projectRoot, taskId) {
+  const pluginResult = await getPluginTask(projectRoot, taskId);
+  if (pluginResult)
+    return pluginResult;
+  const task = await createSourceAwareTaskConfigRecordReader(projectRoot).getTask(taskId);
+  return {
+    configured: false,
+    sourceKind: null,
+    task
+  };
+}
+async function updatePluginTaskSourceTask(projectRoot, taskId, update) {
+  const ctx = await resolveTaskSourceContext(projectRoot);
+  const [source] = ctx?.taskSourceRegistry.list() ?? [];
+  if (!hasRunnableTaskSource(source)) {
+    return ctx ? { taskId, updated: false, source: "none", sourceKind: null, status: null } : null;
+  }
+  if (source.updateTask) {
+    await source.updateTask(taskId, update);
+  } else if (update.status && source.updateStatus) {
+    await source.updateStatus(taskId, update.status);
+  } else {
+    return {
+      taskId,
+      updated: false,
+      source: "plugin",
+      sourceKind: source.kind,
+      status: null
+    };
+  }
+  const status = source.get ? (await source.get(taskId))?.status ?? update.status ?? null : update.status ?? null;
+  return {
+    taskId,
+    updated: true,
+    source: "plugin",
+    sourceKind: source.kind,
+    status
+  };
+}
+async function updateConfiguredTaskSourceTask(projectRoot, input) {
+  const taskId = resolveSourceTaskId(input.taskId, input.sourceTask);
+  let pluginResult = null;
+  try {
+    pluginResult = await updatePluginTaskSourceTask(projectRoot, taskId, input.update);
+  } catch (error) {
+    const fallbackUpdated = updateSourceAwareTaskConfigTask(projectRoot, taskId, input.update, {
+      allowLocalTaskConfigStatusFallback: false
+    });
+    if (!fallbackUpdated) {
+      throw error;
+    }
+    return {
+      taskId,
+      updated: true,
+      source: "compat",
+      sourceKind: null,
+      status: await readSourceAwareTaskStatus(projectRoot, taskId)
+    };
+  }
+  if (pluginResult) {
+    return pluginResult;
+  }
+  const updated = updateSourceAwareTaskConfigTask(projectRoot, taskId, input.update);
+  return {
+    taskId,
+    updated,
+    source: updated ? "compat" : "none",
+    sourceKind: null,
+    status: await readSourceAwareTaskStatus(projectRoot, taskId)
+  };
+}
+async function updateRunTaskSourceLifecycle(projectRoot, run, status, summary, options = {}) {
+  if (!run.taskId) {
+    return null;
+  }
+  const sourceTask = runSourceTaskIdentity(run);
+  return updateConfiguredTaskSourceTask(projectRoot, {
+    taskId: run.taskId,
+    sourceTask,
+    update: {
+      status: mapToTaskSourceStatus(status),
+      comment: buildTaskRunLifecycleComment({
+        runId: cleanString(run.runId) ?? run.taskId,
+        status,
+        summary,
+        runtimeWorkspace: cleanString(run.worktreePath),
+        logsDir: cleanString(run.logRoot),
+        sessionDir: cleanString(run.sessionPath),
+        errorText: options.errorText ?? cleanString(run.errorText)
+      })
+    }
+  });
+}
+function buildTaskRunLifecycleComment(input) {
+  const lines = [
+    "<!-- rig:status-comment -->",
+    `### Rig status: ${input.status}`,
+    "",
+    input.summary,
+    "",
+    `- Run: ${input.runId}`,
+    `- Status: ${input.status}`
+  ];
+  if (input.errorText?.trim()) {
+    lines.push(`- Error: ${input.errorText.trim()}`);
+  }
+  if (input.runtimeWorkspace?.trim()) {
+    lines.push(`- Runtime workspace: ${input.runtimeWorkspace.trim()}`);
+  }
+  if (input.logsDir?.trim()) {
+    lines.push(`- Logs: ${input.logsDir.trim()}`);
+  }
+  if (input.sessionDir?.trim()) {
+    lines.push(`- Session: ${input.sessionDir.trim()}`);
+  }
+  return lines.join(`
+`);
+}
+var init_source_lifecycle = __esm(() => {
+  init_task_source_bootstrap();
+  init_source_aware_task_config_source();
+});
+
+// packages/task-sources-plugin/src/control-plane/native/runtime-binary-build.ts
+import { chmodSync as chmodSync2, existsSync as existsSync9, mkdirSync as mkdirSync2, renameSync as renameSync2, rmSync as rmSync2 } from "fs";
+import { basename as basename4, dirname as dirname2, isAbsolute as isAbsolute3, resolve as resolve8 } from "path";
+async function buildRuntimeBinary(options) {
+  await runSerializedRuntimeBinaryBuild(async () => {
+    const entrypoint = isAbsolute3(options.sourcePath) ? options.sourcePath : resolve8(options.cwd, options.sourcePath);
+    const outputPath = resolve8(options.outputPath);
+    const tempBuildDir = resolve8(dirname2(outputPath), `.bun-build-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+    const tempOutputPath = resolve8(tempBuildDir, basename4(outputPath));
+    mkdirSync2(tempBuildDir, { recursive: true });
+    await withTemporaryEnv({
+      ...options.env,
+      ...options.define ? { RIG_BUILD_CONFIG_JSON: JSON.stringify(options.define) } : {}
+    }, async () => withTemporaryCwd(tempBuildDir, async () => {
+      const buildResult = await Bun.build({
+        entrypoints: [entrypoint],
+        compile: {
+          target: currentCompileTarget(),
+          outfile: tempOutputPath
+        },
+        target: "bun",
+        format: "esm",
+        minify: true,
+        bytecode: true,
+        ...options.external ? { external: options.external } : {},
+        ...options.define ? { define: { __RIG_BUILD_CONFIG__: JSON.stringify(options.define) } } : {}
+      });
+      if (!buildResult.success) {
+        const details = buildResult.logs.map((log) => [
+          log.message,
+          log.position?.file ? `${log.position.file}:${log.position.line}:${log.position.column}` : ""
+        ].filter(Boolean).join(" ")).filter(Boolean).join(`
+`);
+        throw new Error(`Failed to build ${entrypoint}: ${details || "Bun.build() returned errors"}`);
+      }
+      if (!existsSync9(tempOutputPath)) {
+        const emitted = buildResult.outputs.map((output) => output.path).join(", ") || "(none)";
+        throw new Error(`Failed to build ${entrypoint}: Bun.build() did not emit ${tempOutputPath}. Emitted: ${emitted}`);
+      }
+      renameSync2(tempOutputPath, outputPath);
+      chmodSync2(outputPath, 493);
+    })).finally(() => {
+      rmSync2(tempBuildDir, { recursive: true, force: true });
+    });
+  });
+}
+function currentCompileTarget() {
+  if (process.platform === "darwin") {
+    return process.arch === "arm64" ? "bun-darwin-arm64" : "bun-darwin-x64";
+  }
+  if (process.platform === "linux") {
+    return process.arch === "arm64" ? "bun-linux-arm64" : "bun-linux-x64";
+  }
+  return "bun-windows-x64";
+}
+async function runSerializedRuntimeBinaryBuild(action) {
+  const previous = runtimeBinaryBuildQueue;
+  let release;
+  runtimeBinaryBuildQueue = new Promise((resolveRelease) => {
+    release = resolveRelease;
+  });
+  await previous;
+  try {
+    return await action();
+  } finally {
+    release();
+  }
+}
+async function withTemporaryEnv(env, action) {
+  if (!env) {
+    return action();
+  }
+  const previousValues = new Map;
+  for (const [key, value] of Object.entries(env)) {
+    previousValues.set(key, process.env[key]);
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+  try {
+    return await action();
+  } finally {
+    for (const [key, value] of previousValues.entries()) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  }
+}
+async function withTemporaryCwd(cwd, action) {
+  const previousCwd = process.cwd();
+  process.chdir(cwd);
+  try {
+    return await action();
+  } finally {
+    process.chdir(previousCwd);
+  }
+}
+var runtimeBinaryBuildQueue;
+var init_runtime_binary_build = __esm(() => {
+  runtimeBinaryBuildQueue = Promise.resolve();
+});
+
+// packages/task-sources-plugin/src/control-plane/native/validator-binaries.ts
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, rmSync as rmSync3, statSync as statSync4 } from "fs";
+import { dirname as dirname3, resolve as resolve9 } from "path";
+import { runtimeProvisioningEnv } from "@rig/core/runtime-provisioning-env";
+import { resolveBunBinaryPath } from "@rig/core/runtime-paths";
+function resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext) {
+  if (runtimeContext) {
+    return resolve9(runtimeContext.binDir, "validators", binaryName);
+  }
+  return resolve9(resolveHarnessPaths(projectRoot).binDir, "validators", binaryName);
+}
+async function ensureValidatorBinary(projectRoot, checkId, runtimeContext) {
+  const match = checkId.match(/^([a-z][\w-]*):([a-z][\w-]*)$/);
+  if (!match) {
+    return null;
+  }
+  const category = match[1];
+  const check = match[2];
+  if (!category || !check) {
+    return null;
+  }
+  const binaryName = `${category}-${check}`;
+  const binaryPath = resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
+  const hostProjectRoot = runtimeContext?.hostProjectRoot?.trim() || projectRoot;
+  const sourcePath = resolve9(hostProjectRoot, "packages/validator-kit/src/validators", category, `${check}.ts`);
+  if (!existsSync10(sourcePath)) {
+    return null;
+  }
+  const sourceMtime = statSync4(sourcePath).mtimeMs;
+  const binaryExists = existsSync10(binaryPath);
+  const binaryMtime = binaryExists ? statSync4(binaryPath).mtimeMs : 0;
+  if (!binaryExists || sourceMtime > binaryMtime) {
+    if (binaryExists) {
+      rmSync3(binaryPath, { force: true });
+      rmSync3(`${binaryPath}.build-manifest.json`, { force: true });
+    }
+    mkdirSync3(dirname3(binaryPath), { recursive: true });
+    await buildRuntimeBinary({
+      sourcePath: `packages/validator-kit/src/validators/${category}/${check}.ts`,
+      outputPath: binaryPath,
+      cwd: hostProjectRoot,
+      define: { AGENT_BUN_PATH: resolveBunBinaryPath() },
+      env: runtimeProvisioningEnv()
+    });
+  }
+  return existsSync10(binaryPath) ? binaryPath : null;
+}
+var init_validator_binaries = __esm(() => {
+  init_runtime_binary_build();
+  init_utils();
+});
+
+// packages/task-sources-plugin/src/control-plane/native/validator.ts
+import { existsSync as existsSync11, mkdirSync as mkdirSync4, writeFileSync as writeFileSync5 } from "fs";
+import { resolve as resolve10 } from "path";
+import { assertPathInsideRoot as assertPathInsideRoot2, safePathSegment as safePathSegment2 } from "@rig/core/safe-identifiers";
+import { resolveMonorepoRoot } from "@rig/core/layout";
+import { createValidatorRegistry } from "@rig/validator-kit";
+function isCheckId(entry) {
+  return /^[a-z][\w-]*:[a-z][\w-]*$/.test(entry);
+}
+function stringArray(candidate) {
+  return Array.isArray(candidate) ? candidate.filter((entry) => typeof entry === "string") : [];
+}
+function safeReadTaskConfig(projectRoot) {
+  try {
+    return readTaskConfig(projectRoot);
+  } catch {
+    return {};
+  }
+}
+async function readTaskSourceValidation(projectRoot, taskId) {
+  const sourceTask = await readConfiguredTaskSourceTask(projectRoot, taskId).then((result) => result.task).catch(() => null);
+  if (!sourceTask) {
+    return { validation: [], scope: [], taskConfig: undefined };
+  }
+  const record = sourceTask;
+  const validation = stringArray(record.validation).length > 0 ? stringArray(record.validation) : stringArray(record.validators);
+  return {
+    validation,
+    scope: stringArray(record.scope),
+    taskConfig: {
+      ...typeof record.role === "string" ? { role: record.role } : {},
+      ...stringArray(record.scope).length > 0 ? { scope: stringArray(record.scope) } : {},
+      ...validation.length > 0 ? { validation } : {}
+    }
+  };
+}
+function resolveValidationPaths(projectRoot, taskId, runtimeContext) {
+  const taskSegment = safePathSegment2(taskId, { fallback: "task", maxLength: 96 });
+  if (runtimeContext) {
+    const runtimeArtifactsRoot = resolve10(runtimeContext.workspaceDir, "artifacts");
+    return {
+      taskLogDir: assertPathInsideRoot2(runtimeContext.logsDir, resolve10(runtimeContext.logsDir, taskSegment), "validation log directory"),
+      artifactDir: assertPathInsideRoot2(runtimeArtifactsRoot, resolve10(runtimeArtifactsRoot, taskSegment), "validation artifact directory")
+    };
+  }
+  const paths = resolveHarnessPaths(projectRoot);
+  return {
+    taskLogDir: assertPathInsideRoot2(paths.logsDir, resolve10(paths.logsDir, taskSegment), "validation log directory"),
+    artifactDir: assertPathInsideRoot2(paths.artifactsDir, resolve10(paths.artifactsDir, taskSegment), "validation artifact directory")
+  };
+}
+async function runValidatorBinary(projectRoot, taskId, checkId, runtimeContext) {
+  const binaryName = checkId.replace(":", "-");
+  const binaryPath = await ensureValidatorBinary(projectRoot, checkId, runtimeContext) ?? resolveValidatorBinaryPath(projectRoot, binaryName, runtimeContext);
+  if (!existsSync11(binaryPath)) {
+    return {
+      result: {
+        id: checkId,
+        passed: false,
+        summary: `Validator binary not found: ${binaryPath}`
+      },
+      exitCode: 2
+    };
+  }
+  const validatorCwd = runtimeContext?.workspaceDir || resolveMonorepoRoot(projectRoot);
+  const runtimeShellPath = runtimeContext ? resolve10(runtimeContext.binDir, "rig-shell") : "";
+  const monorepoMainRoot = runtimeContext?.monorepoMainRoot || process.env.MONOREPO_MAIN_ROOT?.trim() || resolveMonorepoRoot(projectRoot);
+  const validatorEnv = {
+    PROJECT_RIG_ROOT: runtimeContext?.hostProjectRoot || projectRoot,
+    RIG_HOST_PROJECT_ROOT: projectRoot,
+    RIG_TASK_WORKSPACE: validatorCwd,
+    MONOREPO_ROOT: validatorCwd,
+    MONOREPO_MAIN_ROOT: monorepoMainRoot,
+    RIG_TASK_ID: taskId
+  };
+  if (runtimeContext) {
+    validatorEnv.RIG_TASK_RUNTIME_ID = runtimeContext.runtimeId;
+    validatorEnv.RIG_LOGS_DIR = runtimeContext.logsDir;
+    validatorEnv.RIG_RUNTIME_BIN_DIR = runtimeContext.binDir;
+  }
+  const { exitCode, stdout, stderr } = await runCaptureAsync(runtimeShellPath && existsSync11(runtimeShellPath) ? [runtimeShellPath, "run-binary", binaryPath] : [binaryPath], validatorCwd, validatorEnv);
+  try {
+    const result = JSON.parse(stdout.trim());
+    return { result, exitCode };
+  } catch {
+    return {
+      result: {
+        id: checkId,
+        passed: false,
+        summary: `Failed to parse validator output: ${stderr || stdout}`.slice(0, 200)
+      },
+      exitCode: exitCode || 2
+    };
+  }
+}
+async function dispatchValidator(checkId, registry, ctx, subprocessFallback) {
+  let registered;
+  try {
+    registered = registry.resolve(checkId);
+  } catch {
+    return subprocessFallback(checkId);
+  }
+  const validatorResult = await registered.run(ctx);
+  return {
+    result: {
+      id: validatorResult.id,
+      passed: validatorResult.passed,
+      summary: validatorResult.summary,
+      ...validatorResult.details !== undefined ? { details: validatorResult.details } : {}
+    },
+    exitCode: validatorResult.passed ? 0 : 1
+  };
+}
+async function validateTask(projectRoot, taskId, runtimeContext, registry, options = {}) {
+  const resolvedContext = runtimeContext ?? null;
+  const taskConfig = resolvedContext ? {} : options.taskConfig ?? safeReadTaskConfig(projectRoot);
+  const sourceValidation = !resolvedContext ? await readTaskSourceValidation(projectRoot, taskId) : { validation: [], scope: [], taskConfig: undefined };
+  const configuredValidation = stringArray(taskConfig[taskId]?.validation);
+  const commands = resolvedContext?.validation?.length ? resolvedContext.validation : configuredValidation.length > 0 ? configuredValidation : sourceValidation.validation;
+  const { taskLogDir, artifactDir } = resolveValidationPaths(projectRoot, taskId, resolvedContext);
+  mkdirSync4(taskLogDir, { recursive: true });
+  mkdirSync4(artifactDir, { recursive: true });
+  if (commands.length === 0) {
+    const skipped = {
+      status: "skipped",
+      total: 0,
+      passed: 0,
+      failed: 0,
+      categories: []
+    };
+    writeFileSync5(assertPathInsideRoot2(artifactDir, resolve10(artifactDir, "validation-summary.json"), "validation summary file"), `${JSON.stringify(skipped, null, 2)}
+`, "utf-8");
+    return skipped;
+  }
+  const effectiveRegistry = registry ?? createValidatorRegistry();
+  const workspaceRoot = resolvedContext?.workspaceDir ?? resolveMonorepoRoot(projectRoot);
+  const monorepoRoot = resolvedContext?.monorepoMainRoot ?? process.env.MONOREPO_MAIN_ROOT?.trim() ?? resolveMonorepoRoot(projectRoot);
+  const validatorCtx = {
+    taskId,
+    workspaceRoot,
+    scope: resolvedContext?.scopes ?? (stringArray(taskConfig[taskId]?.scope).length > 0 ? stringArray(taskConfig[taskId]?.scope) : sourceValidation.scope),
+    monorepoRoot,
+    artifactsDir: artifactDir,
+    taskConfig: sourceValidation.taskConfig ?? taskConfig[taskId] ?? undefined
+  };
+  const valDescriptions = resolvedContext ? {} : options.validationDescriptions ?? (() => {
+    try {
+      return readValidationDescriptions(projectRoot);
+    } catch {
+      return {};
+    }
+  })();
+  const categories = [];
+  let passed = 0;
+  let failed = 0;
+  for (const cmd of commands) {
+    const startedAt = Date.now();
+    if (!isCheckId(cmd)) {
+      failed += 1;
+      categories.push({
+        category: cmd,
+        status: "fail",
+        exit_code: 2,
+        duration_seconds: 0
+      });
+      const logFile2 = assertPathInsideRoot2(taskLogDir, resolve10(taskLogDir, `invalid-entry-validation.log`), "validation log file");
+      mkdirSync4(taskLogDir, { recursive: true });
+      writeFileSync5(logFile2, `=== ${nowIso()} :: ${cmd} ===
+Invalid validation entry: not a check-ID. All entries must use format "category:check-name".
+`, "utf-8");
+      continue;
+    }
+    const { result, exitCode } = await dispatchValidator(cmd, effectiveRegistry, validatorCtx, (id) => runValidatorBinary(projectRoot, taskId, id, resolvedContext));
+    const durationSeconds = Math.max(0, Math.round((Date.now() - startedAt) / 1000));
+    const logFile = assertPathInsideRoot2(taskLogDir, resolve10(taskLogDir, `${cmd.replace(":", "-")}-validation.log`), "validation log file");
+    mkdirSync4(taskLogDir, { recursive: true });
+    writeFileSync5(logFile, `=== ${nowIso()} :: ${cmd} ===
+${JSON.stringify(result, null, 2)}
+`, "utf-8");
+    if (result.passed) {
+      passed += 1;
+      categories.push({ category: cmd, status: "pass", duration_seconds: durationSeconds });
+    } else {
+      failed += 1;
+      categories.push({ category: cmd, status: "fail", exit_code: exitCode, duration_seconds: durationSeconds });
+      const desc = valDescriptions[cmd];
+      if (desc) {
+        console.log(`  What this checks (${cmd}): ${desc}`);
+      }
+    }
+  }
+  const summary = {
+    status: failed === 0 ? "pass" : "fail",
+    total: commands.length,
+    passed,
+    failed,
+    categories
+  };
+  mkdirSync4(artifactDir, { recursive: true });
+  writeFileSync5(assertPathInsideRoot2(artifactDir, resolve10(artifactDir, "validation-summary.json"), "validation summary file"), `${JSON.stringify(summary, null, 2)}
+`, "utf-8");
+  return summary;
+}
+var init_validator = __esm(() => {
+  init_task_state();
+  init_source_lifecycle();
+  init_utils();
+  init_validator_binaries();
+});
+
+// packages/task-sources-plugin/src/control-plane/native/task-ops.ts
+import { appendFileSync, existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "fs";
+import { resolve as resolve11 } from "path";
+import { assertPathInsideRoot as assertPathInsideRoot3, safePathSegment as safePathSegment3 } from "@rig/core/safe-identifiers";
+import { readBuildConfig } from "@rig/core/build-time-config";
+import { loadRuntimeContextFromEnv as loadRuntimeContextFromEnv2 } from "@rig/core/runtime-context";
+import {
+  BROWSER_CONTRACT_SERVICE_CAPABILITY,
+  RUNTIME_INSTRUCTION,
+  RUNTIME_FILE_TOOL_NAMES,
+  RUNTIME_SHELL_TOOL_NAMES
+} from "@rig/contracts";
+import { defineCapability as defineCapability2 } from "@rig/core/capability";
+import { loadCapabilityForRoot } from "@rig/core/capability-loaders";
+function hasRuntimeWorkspace() {
+  return Boolean(process.env.RIG_TASK_WORKSPACE?.trim());
+}
+function readTaskConfigForInvocation(projectRoot) {
+  return hasRuntimeWorkspace() ? readTaskConfig(projectRoot) : readSourceTaskConfig(projectRoot);
+}
+function readValidationDescriptionsForInvocation(projectRoot) {
+  return hasRuntimeWorkspace() ? readValidationDescriptions(projectRoot) : readSourceValidationDescriptions(projectRoot);
+}
+function readStringList2(candidate) {
+  return Array.isArray(candidate) ? candidate.filter((value) => typeof value === "string") : [];
+}
+function taskConfigEntryFromSourceTask(task) {
+  if (!task)
+    return {};
+  const record = task;
+  const description = firstNonEmpty(typeof record.description === "string" ? record.description : undefined, typeof record.body === "string" ? record.body : undefined);
+  const acceptance = firstNonEmpty(typeof record.acceptanceCriteria === "string" ? record.acceptanceCriteria : undefined, typeof record.acceptance_criteria === "string" ? record.acceptance_criteria : undefined);
+  const validation = readStringList2(record.validation).length > 0 ? readStringList2(record.validation) : readStringList2(record.validators);
+  const scope = readStringList2(record.scope);
+  const browser = record.browser && typeof record.browser === "object" && !Array.isArray(record.browser) ? record.browser : undefined;
+  return {
+    ...typeof record.role === "string" ? { role: record.role } : {},
+    ...description ? { description } : {},
+    ...acceptance ? { acceptance_criteria: acceptance } : {},
+    ...scope.length > 0 ? { scope } : {},
+    ...validation.length > 0 ? { validation } : {},
+    ...browser ? { browser } : {}
+  };
+}
+function taskMetadataFromSourceTask(task) {
+  if (!task)
+    return null;
+  const record = task;
+  const description = firstNonEmpty(typeof record.description === "string" ? record.description : undefined, typeof record.body === "string" ? record.body : undefined);
+  const acceptanceCriteria = firstNonEmpty(typeof record.acceptanceCriteria === "string" ? record.acceptanceCriteria : undefined, typeof record.acceptance_criteria === "string" ? record.acceptance_criteria : undefined);
+  return {
+    title: typeof record.title === "string" && record.title.trim() ? record.title : task.id,
+    ...typeof record.status === "string" ? { status: record.status } : {},
+    ...typeof record.priority === "number" ? { priority: record.priority } : {},
+    ...description ? { description } : {},
+    ...acceptanceCriteria ? { acceptanceCriteria } : {}
+  };
+}
+function sourceTaskDependencyIds(task) {
+  if (!task)
+    return null;
+  const record = task;
+  return unique2([
+    ...readStringList2(record.deps),
+    ...readStringList2(record.dependencies)
+  ]).filter((id) => id !== task.id);
+}
+async function readTaskSourceRecordForInvocation(projectRoot, taskId) {
+  if (hasRuntimeWorkspace()) {
+    return null;
+  }
+  try {
+    const result = await readConfiguredTaskSourceTask(projectRoot, taskId);
+    return result.task;
+  } catch {
+    return null;
+  }
+}
+function runtimeToolSummary() {
+  const available = new Set(RUNTIME_SHELL_TOOL_NAMES);
+  const shell = ["bash", "sh", "python3", "tee", "cp", "mv", "rm", "mkdir", "touch"].filter((tool) => available.has(tool));
+  return { shell, file: [...RUNTIME_FILE_TOOL_NAMES] };
+}
+function providerToolReferenceLine(_provider) {
+  return "Pi tool names: `read`, `write`, `edit`, `bash`.";
+}
+async function taskInfo(projectRoot, taskId, runtimeProviderOverride) {
+  if (BAKED_INFO_OUTPUT) {
+    process.stdout.write(BAKED_INFO_OUTPUT);
+    return;
+  }
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask) {
+    throw new Error("No active task. Start one with: rig run start-serial");
+  }
+  const runtimeContext = loadRuntimeContextFromEnv2();
+  const sourceTask = runtimeContext?.sourceTask ?? await readTaskSourceRecordForInvocation(projectRoot, activeTask);
+  const tracker = loadReadonlyTaskTrackerContext(projectRoot);
+  const taskConfig = (() => {
+    try {
+      return readTaskConfigForInvocation(projectRoot);
+    } catch {
+      return {};
+    }
+  })();
+  const entry = { ...taskConfig[activeTask] || {}, ...taskConfigEntryFromSourceTask(sourceTask) };
+  const taskMeta = taskMetadataFromSourceTask(sourceTask) ?? await readTaskMetadata(projectRoot, activeTask, tracker);
+  const instructionService = await loadCapabilityForRoot(projectRoot, defineCapability2(RUNTIME_INSTRUCTION));
+  const runtimeProvider = runtimeProviderOverride ?? instructionService?.normalizeProvider(process.env.RIG_RUNTIME_ADAPTER) ?? "pi";
+  const description = firstNonEmpty(taskMeta?.description, entry.description);
+  const acceptanceCriteria = firstNonEmpty(taskMeta?.acceptanceCriteria, entry.acceptance_criteria);
+  const browserContractService = await loadCapabilityForRoot(projectRoot, defineCapability2(BROWSER_CONTRACT_SERVICE_CAPABILITY));
+  const browserContext = runtimeContext?.browser ?? browserContractService?.resolveTaskBrowserContext(entry.browser, {
+    hostProjectRoot: projectRoot
+  });
+  console.log(`=== Task: ${activeTask} ===`);
+  console.log("");
+  console.log(`Role:    ${entry.role || "unassigned"}`);
+  if (taskMeta) {
+    console.log(`Title:   ${taskMeta.title}`);
+    if (taskMeta.status) {
+      console.log(`Status:  ${taskMeta.status.toUpperCase()}`);
+    }
+    if (taskMeta.claimId) {
+      console.log(`Claim:   ${taskMeta.claimId}`);
+    }
+    if (typeof taskMeta.priority === "number") {
+      console.log(`Priority: P${taskMeta.priority}`);
+    }
+  } else {
+    console.log("Title:   (task metadata unavailable)");
+  }
+  if (description) {
+    console.log(`
+Description:`);
+    printIndented(description);
+  } else {
+    console.log('\nDescription: (not set; add one with `br update <task-id> --description "..."`)');
+  }
+  if (acceptanceCriteria) {
+    console.log(`
+Acceptance Criteria:`);
+    printIndented(acceptanceCriteria);
+  }
+  console.log(`
+Scope globs:`);
+  for (const scope of entry.scope || []) {
+    console.log(`  - ${scope}`);
+  }
+  if (entry.creates_repo) {
+    console.log(`
+  NOTE: This task creates a new repository. The scope directory does not exist yet \u2014 you are scaffolding it from scratch.`);
+  }
+  const valDescriptions = (() => {
+    try {
+      return readValidationDescriptionsForInvocation(projectRoot);
+    } catch {
+      return {};
+    }
+  })();
+  console.log(`
+Validation:`);
+  for (const cmd of entry.validation || []) {
+    const desc = valDescriptions[cmd];
+    console.log(desc ? `  $ ${cmd} \u2014 ${desc}` : `  $ ${cmd}`);
+  }
+  if (browserContext?.required) {
+    console.log(`
+Browser:`);
+    for (const line of browserContractService?.buildBrowserGuidanceLines(browserContext) ?? []) {
+      console.log(`  - ${line}`);
+    }
+  }
+  const runtimeTools = runtimeToolSummary();
+  console.log(`
+Runtime Tools:`);
+  console.log("  - This task runtime provides audited shell tooling and Rig-owned file tools.");
+  console.log("  - Use the Rig-owned router tools for all read, search, edit, and write work inside the task workspace.");
+  for (const line of instructionService?.buildRuntimeContextLines(runtimeProvider) ?? []) {
+    console.log(`  - ${line}`);
+  }
+  console.log("  - `write` and `edit` remain restricted to the scoped task workspace, plus the task artifact subtree at `artifacts/<taskId>/` for closeout files.");
+  console.log(`  - ${providerToolReferenceLine(runtimeProvider)}`);
+  console.log("  - Runtime tool location: `$RIG_TASK_WORKSPACE/.rig/bin`.");
+  if (runtimeTools.file.length > 0) {
+    console.log(`  - Runtime file binaries: ${runtimeTools.file.join(", ")}`);
+  }
+  if (runtimeTools.shell.length > 0) {
+    console.log(`  - Shell helpers: ${runtimeTools.shell.join(", ")}`);
+  }
+  console.log("  - Shell commands route through `rig-shell`; file-tool binaries enforce runtime workspace and scope boundaries directly.");
+  console.log(`
+Dependencies:`);
+  const deps = sourceTaskDependencyIds(sourceTask) ?? taskDependencies(projectRoot, activeTask, tracker);
+  if (deps.length === 0) {
+    console.log("  (none - root task)");
+  } else {
+    for (const dep of deps) {
+      const depMeta = readTaskMetadataFromTracker(projectRoot, dep, tracker);
+      const depStatus = depMeta?.status ? `status=${depMeta.status}` : "";
+      console.log(`  - ${dep} ${depStatus}`.trim());
+    }
+  }
+}
+async function taskReady(projectRoot) {
+  const readyTaskIds = listReadyTaskIds(loadReadonlyTaskTrackerContext(projectRoot));
+  if (readyTaskIds.length > 0) {
+    process.stdout.write(`${readyTaskIds.join(`
+`)}
+`);
+  }
+}
+async function taskScope(projectRoot, expandFiles, taskId) {
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask) {
+    throw new Error("No active task.");
+  }
+  const paths = resolveHarnessPaths(projectRoot);
+  const sourceTask = loadRuntimeContextFromEnv2()?.sourceTask ?? await readTaskSourceRecordForInvocation(projectRoot, activeTask);
+  const taskConfig = (() => {
+    try {
+      return readTaskConfigForInvocation(projectRoot);
+    } catch {
+      return {};
+    }
+  })();
+  const entry = { ...taskConfig[activeTask] || {}, ...taskConfigEntryFromSourceTask(sourceTask) };
+  const scopes = entry.scope || [];
+  if (scopes.length === 0) {
+    throw new Error(`No scope defined for ${activeTask}.`);
+  }
+  if (!expandFiles) {
+    console.log(`Scope globs for ${activeTask}:`);
+    for (const scope of scopes) {
+      console.log(`  ${scope}`);
+    }
+    console.log(`
+Use --files to expand globs to actual file paths.`);
+    return;
+  }
+  console.log(`Files matching scope for ${activeTask}:
+`);
+  const files = [];
+  for (const scope of scopes) {
+    const normalizedScope = normalizePathToScope(projectRoot, paths.monorepoRoot, scope);
+    const inMonorepo = /^(humanity|moongate|packages|shared-migrations|microservices|TSAPITests|hp-next)\//.test(normalizedScope);
+    if (inMonorepo) {
+      for (const candidate of monorepoSearchCandidates(scope)) {
+        const result = runCapture(["git", "-C", paths.monorepoRoot, "ls-files", candidate], projectRoot);
+        if (result.exitCode === 0) {
+          files.push(...result.stdout.split(/\r?\n/).filter(Boolean));
+        }
+      }
+    } else {
+      const result = runCapture(["git", "-C", projectRoot, "ls-files", scope], projectRoot);
+      if (result.exitCode === 0) {
+        files.push(...result.stdout.split(/\r?\n/).filter(Boolean));
+      }
+    }
+  }
+  if (files.length === 0) {
+    const taskEntry = entry;
+    if (taskEntry.creates_repo) {
+      console.log("(No files yet \u2014 this is a creates_repo task. You will create these directories.)");
+    } else {
+      console.log("(No files match scope globs.)");
+    }
+    return;
+  }
+  for (const file of unique2(files).sort()) {
+    console.log(file);
+  }
+}
+async function taskDeps(projectRoot, taskId) {
+  if (BAKED_DEPS_OUTPUT) {
+    process.stdout.write(BAKED_DEPS_OUTPUT);
+    return;
+  }
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask) {
+    throw new Error("No active task.");
+  }
+  const sourceTask = loadRuntimeContextFromEnv2()?.sourceTask ?? await readTaskSourceRecordForInvocation(projectRoot, activeTask);
+  const tracker = loadReadonlyTaskTrackerContext(projectRoot);
+  const deps = sourceTaskDependencyIds(sourceTask) ?? taskDependencies(projectRoot, activeTask, tracker);
+  if (deps.length === 0) {
+    console.log(`No dependencies for ${activeTask}.`);
+    return;
+  }
+  for (const dep of deps) {
+    const artifactDir = artifactDirForId(projectRoot, dep);
+    console.log(`=== ${dep} ===`);
+    if (!existsSync12(artifactDir)) {
+      console.log(`  (no artifacts yet)
+`);
+      continue;
+    }
+    printArtifactSection(resolve11(artifactDir, "decision-log.md"), "--- Decisions ---");
+    printArtifactSection(resolve11(artifactDir, "next-actions.md"), "--- Next Actions (for you) ---");
+    const changedFiles = resolve11(artifactDir, "changed-files.txt");
+    if (existsSync12(changedFiles)) {
+      const lines = readFileSync8(changedFiles, "utf-8").split(/\r?\n/).filter(Boolean);
+      console.log(`--- Changed Files (${lines.length}) ---`);
+      for (const line of lines) {
+        console.log(line);
+      }
+      console.log("");
+    }
+  }
+}
+function taskStatus(projectRoot) {
+  if (BAKED_STATUS_OUTPUT) {
+    process.stdout.write(BAKED_STATUS_OUTPUT);
+    return;
+  }
+  console.log(`=== Project Rig Progress ===
+`);
+  const tasks = readBeadsTasks(projectRoot, undefined, true);
+  if (tasks.length === 0) {
+    console.log("(no task tracker rows found)");
+    return;
+  }
+  const counts = tasks.reduce((acc, task) => {
+    const key = task.status || "open";
+    acc[key] = (acc[key] || 0) + 1;
+    return acc;
+  }, {});
+  const total = tasks.length;
+  console.log(`Total tasks: ${total}`);
+  for (const status of Object.keys(counts).sort()) {
+    console.log(`  ${status}: ${counts[status]}`);
+  }
+}
+function taskLookup(projectRoot, id) {
+  const result = lookupTask(projectRoot, id);
+  if (!result) {
+    throw new Error(`Not found: ${id}`);
+  }
+  return result;
+}
+function taskRecord(projectRoot, type, text, taskId) {
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask) {
+    throw new Error("No active task.");
+  }
+  const paths = resolveHarnessPaths(projectRoot);
+  mkdirSync5(paths.stateDir, { recursive: true });
+  if (type === "decision") {
+    const artifactDir = taskArtifactDir(projectRoot, activeTask);
+    mkdirSync5(artifactDir, { recursive: true });
+    const timestamp = nowIso();
+    appendFileSync(resolve11(artifactDir, "decision-log.md"), `
+### ${timestamp}
+
+${text}
+
+`, "utf-8");
+    console.log(`Decision recorded for ${activeTask}.`);
+    return;
+  }
+  const failedPath = paths.failedApproachesPath;
+  if (!existsSync12(failedPath)) {
+    writeFileSync6(failedPath, `# Failed Approaches Log
+
+This file records approaches that did not work.
+
+`, "utf-8");
+  }
+  const content = readFileSync8(failedPath, "utf-8");
+  const attempts = (content.match(new RegExp(`^## ${escapeRegExp(activeTask)}\\b`, "gm")) || []).length + 1;
+  appendFileSync(failedPath, `
+## ${activeTask} - Attempt ${attempts} (${nowIso()})
+
+**Reason:** ${text}
+
+---
+`, "utf-8");
+  console.log(`Failed approach #${attempts} recorded for ${activeTask}. Note: visible to future sessions, not re-read in this session.`);
+}
+function taskArtifacts(projectRoot, taskId) {
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask) {
+    throw new Error("No active task.");
+  }
+  const paths = resolveHarnessPaths(projectRoot);
+  const artifactDir = taskArtifactDir(projectRoot, activeTask);
+  mkdirSync5(artifactDir, { recursive: true });
+  const changed = changedFilesForTask(projectRoot, activeTask, true);
+  writeFileSync6(resolve11(artifactDir, "changed-files.txt"), `${changed.join(`
+`)}
+`, "utf-8");
+  console.log(`changed-files.txt: ${changed.length} files`);
+  const taskResultPath = resolve11(artifactDir, "task-result.json");
+  if (!existsSync12(taskResultPath)) {
+    const template = {
+      task_id: activeTask,
+      status: "completed",
+      summary: "TODO: Write a one-line summary of what you did",
+      completed_at: nowIso()
+    };
+    writeFileSync6(taskResultPath, `${JSON.stringify(template, null, 2)}
+`, "utf-8");
+    console.log("task-result.json: created (update the summary!)");
+  } else {
+    console.log("task-result.json: already exists");
+  }
+  const decisionLogPath = resolve11(artifactDir, "decision-log.md");
+  if (!existsSync12(decisionLogPath)) {
+    const content = `# Decision Log: ${activeTask}
+
+Record key decisions here using: rig-agent record decision "..."
+`;
+    writeFileSync6(decisionLogPath, content, "utf-8");
+    console.log("decision-log.md: created (record your decisions!)");
+  } else {
+    console.log("decision-log.md: already exists");
+  }
+  const nextActionsPath = resolve11(artifactDir, "next-actions.md");
+  if (!existsSync12(nextActionsPath)) {
+    const content = [
+      `# Next Actions: ${activeTask}`,
+      "",
+      "## For downstream tasks",
+      "",
+      "### bd-<downstream-task-id>",
+      "- **Decision impact:** What you decided that affects this downstream task",
+      "- **Recommended approach:** What they should do differently because of your work",
+      "- **Key files:** What files they should look at first",
+      "",
+      "## General notes",
+      "",
+      "- TODO: Replace this scaffold with real content before completion",
+      ""
+    ].join(`
+`);
+    writeFileSync6(nextActionsPath, content, "utf-8");
+    console.log("next-actions.md: created (add recommendations for downstream tasks!)");
+  } else {
+    console.log("next-actions.md: already exists");
+  }
+  const validationSummaryPath = resolve11(artifactDir, "validation-summary.json");
+  if (existsSync12(validationSummaryPath)) {
+    console.log("validation-summary.json: already exists");
+  } else {
+    console.log("validation-summary.json: not yet created (run: rig-agent validate)");
+  }
+  console.log(`
+Artifacts at: ${artifactDir}/`);
+}
+function taskArtifactDir(projectRoot, taskId) {
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask) {
+    throw new Error("No active task.");
+  }
+  const paths = resolveHarnessPaths(projectRoot);
+  const artifactDir = resolve11(paths.artifactsDir, safePathSegment3(activeTask, { fallback: "task", maxLength: 96 }));
+  assertPathInsideRoot3(paths.artifactsDir, artifactDir, "artifact directory");
+  mkdirSync5(artifactDir, { recursive: true });
+  return artifactDir;
+}
+function taskArtifactWrite(projectRoot, filename, content, taskId) {
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask) {
+    throw new Error("No active task.");
+  }
+  const paths = resolveHarnessPaths(projectRoot);
+  const artifactDir = resolve11(paths.artifactsDir, safePathSegment3(activeTask, { fallback: "task", maxLength: 96 }));
+  assertPathInsideRoot3(paths.artifactsDir, artifactDir, "artifact directory");
+  mkdirSync5(artifactDir, { recursive: true });
+  const targetPath = assertPathInsideRoot3(artifactDir, resolve11(artifactDir, filename), "artifact file");
+  writeFileSync6(targetPath, content, "utf-8");
+  console.log(`Wrote: ${targetPath}`);
+}
+function taskArtifactRead(projectRoot, filename, options) {
+  const activeTask = options?.taskId || currentTaskId(projectRoot);
+  if (!activeTask) {
+    throw new Error("No active task.");
+  }
+  const maxBytes = options?.maxBytes ?? 64 * 1024;
+  const artifactDir = taskArtifactDir(projectRoot, activeTask);
+  const targetPath = assertPathInsideRoot3(artifactDir, resolve11(artifactDir, filename), "artifact file");
+  if (!existsSync12(targetPath)) {
+    throw new Error(`Artifact not found: ${targetPath}`);
+  }
+  const buffer = readFileSync8(targetPath);
+  const preview = buffer.subarray(0, maxBytes);
+  return {
+    path: targetPath,
+    sizeBytes: buffer.length,
+    contents: preview.includes(0) ? "[binary content omitted]" : preview.toString("utf-8"),
+    truncated: buffer.length > maxBytes,
+    maxBytes
+  };
+}
+async function taskValidate(projectRoot, taskId, validatorRegistry) {
+  const activeTask = taskId || currentTaskId(projectRoot);
+  if (!activeTask) {
+    throw new Error("No active task.");
+  }
+  console.log(`Running validation for ${activeTask}...
+`);
+  const runtimeContext = loadRuntimeContextFromEnv2();
+  const summary = await validateTask(projectRoot, activeTask, runtimeContext, validatorRegistry, runtimeContext ? {} : {
+    taskConfig: (() => {
+      try {
+        return readTaskConfigForInvocation(projectRoot);
+      } catch {
+        return {};
+      }
+    })(),
+    validationDescriptions: (() => {
+      try {
+        return readValidationDescriptionsForInvocation(projectRoot);
+      } catch {
+        return {};
+      }
+    })()
+  });
+  if (summary.status === "skipped") {
+    console.log(`Validation skipped: no validation commands defined`);
+    return true;
+  }
+  if (summary.status !== "pass") {
+    console.log(`Validation failed: ${summary.failed}/${summary.total} failed`);
+    return false;
+  }
+  console.log(`Validation passed: ${summary.passed}/${summary.total}`);
+  return true;
+}
+function taskReopen(projectRoot, options) {
+  const dryRun = options.dryRun === true;
+  const tasks = readBeadsTasks(projectRoot);
+  const summary = {
+    mode: options.all ? "all" : "single",
+    requestedTaskId: options.taskId || null,
+    dryRun,
+    closedFound: 0,
+    reopened: [],
+    failed: [],
+    skipped: []
+  };
+  if (options.all) {
+    const reopenable = tasks.filter((task2) => {
+      const normalizedStatus2 = normalizeTaskLifecycleStatus(task2.status);
+      return normalizedStatus2 != null && REOPENABLE_TASK_STATUSES.has(normalizedStatus2);
+    }).map((task2) => task2.id);
+    summary.closedFound = reopenable.length;
+    if (reopenable.length === 0) {
+      console.log("No reopenable tasks found.");
+      return summary;
+    }
+    if (dryRun) {
+      console.log(`Dry-run: would reopen ${reopenable.length} task(s):`);
+      for (const id of reopenable) {
+        console.log(`- ${id}`);
+      }
+      return summary;
+    }
+    for (const id of reopenable) {
+      reopenSingleTask(projectRoot, id, summary);
+    }
+    printTaskReopenSummary(summary);
+    return summary;
+  }
+  if (!options.taskId) {
+    throw new Error("Missing task id. Use --task <beads-id> or --all.");
+  }
+  const task = tasks.find((entry) => entry.id === options.taskId);
+  if (!task) {
+    throw new Error(`Task not found in .beads/issues.jsonl: ${options.taskId}`);
+  }
+  const normalizedStatus = normalizeTaskLifecycleStatus(task.status);
+  if (!normalizedStatus || !REOPENABLE_TASK_STATUSES.has(normalizedStatus)) {
+    summary.skipped.push(options.taskId);
+    console.log(`Task ${options.taskId} is already open.`);
+    return summary;
+  }
+  summary.closedFound = 1;
+  if (dryRun) {
+    console.log(`Dry-run: would reopen task ${options.taskId}.`);
+    return summary;
+  }
+  reopenSingleTask(projectRoot, options.taskId, summary);
+  printTaskReopenSummary(summary);
+  return summary;
+}
+function collectTaskChangedFiles(projectRoot, taskId, includeCommitted) {
+  const paths = resolveHarnessPaths(projectRoot);
+  const monorepoRepoRoot = resolveTaskMonorepoRoot(projectRoot);
+  const files = [];
+  const projectBaseline = resolveRuntimeDirtyBaseline(projectRoot, projectRoot);
+  const monorepoBaseline = resolveRuntimeDirtyBaseline(projectRoot, monorepoRepoRoot);
+  for (const [repo, prefix] of [
+    [projectRoot, ""],
+    [monorepoRepoRoot, ""]
+  ]) {
+    if (!existsSync12(resolve11(repo, ".git"))) {
+      continue;
+    }
+    if (includeCommitted && repo === monorepoRepoRoot) {
+      for (const line of collectCommittedMonorepoFiles(projectRoot, repo)) {
+        files.push(`${prefix}${line}`);
+      }
+    }
+    const baseline = repo === paths.monorepoRoot ? monorepoBaseline : projectBaseline;
+    for (const line of collectWorkingTreeFiles(projectRoot, repo, baseline)) {
+      files.push(`${prefix}${line}`);
+    }
+  }
+  const uniqueFiles = unique2(files).map((file) => normalizeChangedFilePath(file)).filter(Boolean);
+  return filterTaskChangedFiles(projectRoot, taskId, uniqueFiles, false);
+}
+function filterTaskChangedFiles(projectRoot, taskId, files, scoped) {
+  const uniqueFiles = unique2(files).map((file) => normalizeChangedFilePath(file)).filter(Boolean);
+  if (!taskId) {
+    return unique2(uniqueFiles).sort();
+  }
+  return unique2(uniqueFiles).filter((file) => !isGeneratedTaskChangePath(taskId, file)).sort();
+}
+function resolveTaskMonorepoRoot(projectRoot) {
+  const runtimeWorkspace = loadRuntimeContextFromEnv2()?.workspaceDir || process.env.RIG_TASK_WORKSPACE?.trim();
+  if (runtimeWorkspace && existsSync12(resolve11(runtimeWorkspace, ".git"))) {
+    return resolve11(runtimeWorkspace);
+  }
+  return resolveHarnessPaths(projectRoot).monorepoRoot;
+}
+function collectCommittedMonorepoFiles(projectRoot, repo) {
+  const baseRefCandidates = [];
+  const originHead = runCapture(["git", "-C", repo, "rev-parse", "--abbrev-ref", "origin/HEAD"], projectRoot);
+  if (originHead.exitCode === 0 && originHead.stdout.trim()) {
+    baseRefCandidates.push(originHead.stdout.trim());
+  }
+  baseRefCandidates.push("origin/main", "origin/dev", "origin/master", "main", "dev", "master");
+  for (const baseRef of baseRefCandidates) {
+    const mergeBase = runCapture(["git", "-C", repo, "merge-base", "HEAD", baseRef], projectRoot);
+    if (mergeBase.exitCode !== 0 || !mergeBase.stdout.trim())
+      continue;
+    const result = runCapture(["git", "-C", repo, "diff", "--name-only", `${mergeBase.stdout.trim()}..HEAD`], projectRoot);
+    if (result.exitCode === 0) {
+      return result.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+    }
+  }
+  const initialHeadCommit = resolveRuntimeInitialHeadCommit(projectRoot, repo);
+  if (initialHeadCommit) {
+    const result = runCapture(["git", "-C", repo, "diff", "--name-only", `${initialHeadCommit}..HEAD`], projectRoot);
+    if (result.exitCode === 0) {
+      return result.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+    }
+  }
+  const baseCommit = resolveMonorepoBaseCommit(projectRoot, repo);
+  if (!baseCommit) {
+    return [];
+  }
+  for (const revision of [`${baseCommit}...HEAD`, `${baseCommit}..HEAD`]) {
+    const result = runCapture(["git", "-C", repo, "diff", "--name-only", revision], projectRoot);
+    if (result.exitCode === 0) {
+      return result.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+    }
+  }
+  return [];
+}
+function resolveRuntimeInitialHeadCommit(projectRoot, repo) {
+  const runtimeContext = loadRuntimeContextFromEnv2();
+  if (runtimeContext?.initialHeadCommits?.monorepo?.trim()) {
+    const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
+    if (resolve11(monorepoRoot) === resolve11(repo)) {
+      return runtimeContext.initialHeadCommits.monorepo.trim();
+    }
+  }
+  return "";
+}
+function resolveMonorepoBaseCommit(projectRoot, repo) {
+  const runtimeContext = loadRuntimeContextFromEnv2();
+  if (runtimeContext?.monorepoBaseCommit?.trim()) {
+    const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
+    if (resolve11(monorepoRoot) === resolve11(repo)) {
+      return runtimeContext.monorepoBaseCommit.trim();
+    }
+  }
+  return "";
+}
+function collectWorkingTreeFiles(projectRoot, repo, baseline) {
+  const files = new Set;
+  const nativeFiles = nativePendingFiles(repo);
+  if (nativeFiles !== null) {
+    for (const entry of nativeFiles) {
+      const normalized = normalizeChangedFilePath(entry.path);
+      if (!normalized || baseline.has(normalized)) {
+        continue;
+      }
+      files.add(normalized);
+    }
+    return [...files].sort();
+  }
+  for (const args of [
+    ["diff", "--name-only"],
+    ["diff", "--cached", "--name-only"],
+    ["ls-files", "--others", "--exclude-standard"]
+  ]) {
+    const result = runCapture(["git", "-C", repo, ...args], projectRoot);
+    if (result.exitCode !== 0) {
+      continue;
+    }
+    for (const line of result.stdout.split(/\r?\n/)) {
+      const normalized = normalizeChangedFilePath(line);
+      if (!normalized || baseline.has(normalized)) {
+        continue;
+      }
+      files.add(normalized);
+    }
+  }
+  return [...files].sort();
+}
+function resolveRuntimeDirtyBaseline(projectRoot, repo) {
+  const runtimeContext = loadRuntimeContextFromEnv2();
+  const dirtyFiles = runtimeContext?.initialDirtyFiles;
+  if (!dirtyFiles) {
+    return new Set;
+  }
+  const monorepoRoot = resolveTaskMonorepoRoot(projectRoot);
+  const selected = resolve11(repo) === resolve11(monorepoRoot) ? dirtyFiles.monorepo : resolve11(repo) === resolve11(projectRoot) ? dirtyFiles.project : undefined;
+  return new Set((selected || []).map((file) => normalizeChangedFilePath(file)).filter(Boolean));
+}
+function normalizeChangedFilePath(file) {
+  return file.trim().replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function isGeneratedTaskChangePath(taskId, file) {
+  const normalized = normalizeChangedFilePath(file);
+  if (!normalized) {
+    return true;
+  }
+  if (normalized.startsWith(".rig/") || normalized.startsWith(".beads/") || normalized.startsWith(".worktrees/")) {
+    return true;
+  }
+  const safeTaskId = safePathSegment3(taskId, { fallback: "task", maxLength: 96 });
+  const taskArtifactPrefix = `artifacts/${safeTaskId}/`;
+  if (!normalized.startsWith(taskArtifactPrefix)) {
+    return false;
+  }
+  const artifactRelativePath = normalized.slice(taskArtifactPrefix.length);
+  return GENERATED_TASK_ARTIFACT_FILES.has(artifactRelativePath) || artifactRelativePath.startsWith("runtime-snapshots/");
+}
+async function readTaskMetadata(projectRoot, taskId, tracker) {
+  const trackerMetadata = readTaskMetadataFromTracker(projectRoot, taskId, tracker);
+  if (trackerMetadata) {
+    return trackerMetadata;
+  }
+  try {
+    const task = await createSourceAwareTaskConfigRecordReader(projectRoot).getTask(taskId);
+    if (!task) {
+      return null;
+    }
+    const record = task;
+    const title = asNonEmptyString(record.title) || taskId;
+    const metadata = { title };
+    const status = asNonEmptyString(record.status);
+    if (status) {
+      metadata.status = normalizeTaskLifecycleStatus(status) ?? status;
+    }
+    const description = firstNonEmpty(asNonEmptyString(record.description), asNonEmptyString(record.body));
+    if (description)
+      metadata.description = description;
+    const acceptance = firstNonEmpty(asNonEmptyString(record.acceptance_criteria), asNonEmptyString(record.acceptanceCriteria));
+    if (acceptance)
+      metadata.acceptanceCriteria = acceptance;
+    const priority = record.priority;
+    if (typeof priority === "number")
+      metadata.priority = priority;
+    return metadata;
+  } catch {
+    return null;
+  }
+}
+function readTaskMetadataFromTracker(projectRoot, taskId, tracker) {
+  const context = tracker ?? loadTaskTrackerContext(projectRoot);
+  const record = context.tasksById.get(taskId);
+  if (!record?.title) {
+    return null;
+  }
+  const metadata = { title: record.title };
+  const status = asNonEmptyString(record.status);
+  if (status) {
+    const normalizedStatus = normalizeTaskLifecycleStatus(status);
+    metadata.status = normalizedStatus ?? status;
+    if (normalizedStatus) {
+      const taskState = readSourceTaskStateMetadata(projectRoot, taskId, normalizedStatus, context.snapshot);
+      if (taskState?.claimId) {
+        metadata.claimId = taskState.claimId;
+      }
+    }
+  }
+  if (typeof record.priority === "number")
+    metadata.priority = record.priority;
+  const description = asNonEmptyString(record.description);
+  if (description)
+    metadata.description = description;
+  const acceptance = firstNonEmpty(asNonEmptyString(record.acceptance_criteria), asNonEmptyString(record.acceptanceCriteria));
+  if (acceptance)
+    metadata.acceptanceCriteria = acceptance;
+  return metadata;
+}
+function asNonEmptyString(value) {
+  if (typeof value !== "string") {
+    return "";
+  }
+  return value.trim();
+}
+function firstNonEmpty(...values) {
+  for (const value of values) {
+    if (typeof value === "string" && value.trim()) {
+      return value.trim();
+    }
+  }
+  return "";
+}
+function printIndented(text) {
+  for (const line of text.split(/\r?\n/)) {
+    console.log(`  ${line}`);
+  }
+}
+function readLocalBeadsTasks(projectRoot) {
+  const issuesPath = resolve11(resolveCheckoutRoot(projectRoot), ".beads/issues.jsonl");
+  if (!existsSync12(issuesPath)) {
+    return [];
+  }
+  const tasks = [];
+  for (const line of readFileSync8(issuesPath, "utf-8").split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) {
+      continue;
+    }
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (parsed.issue_type === "task" && parsed.id) {
+        tasks.push({
+          id: parsed.id,
+          status: parsed.status || "open",
+          issue_type: parsed.issue_type,
+          title: parsed.title,
+          priority: parsed.priority,
+          description: parsed.description,
+          acceptance_criteria: parsed.acceptance_criteria,
+          acceptanceCriteria: parsed.acceptanceCriteria,
+          dependencies: Array.isArray(parsed.dependencies) ? parsed.dependencies : []
+        });
+      }
+    } catch {}
+  }
+  return tasks;
+}
+function readBeadsTasks(projectRoot, tracker, allowLocalFallback = false) {
+  return (tracker ?? loadTaskTrackerContext(projectRoot, undefined, allowLocalFallback)).tasks;
+}
+function loadTaskTrackerContext(projectRoot, snapshot, allowLocalFallback = false) {
+  const resolvedSnapshot = snapshot ?? readSyncedTrackerState(projectRoot, {}, allowLocalFallback ? { allowLocalFallback: true } : {});
+  const tasks = resolvedSnapshot.issues.filter((issue) => issue.issueType === "task").map(projectTaskRecordFromSyncedIssue);
+  const seenTaskIds = new Set(tasks.map((task) => task.id));
+  if (allowLocalFallback) {
+    for (const localTask of readLocalBeadsTasks(projectRoot)) {
+      if (seenTaskIds.has(localTask.id)) {
+        continue;
+      }
+      tasks.push(localTask);
+      seenTaskIds.add(localTask.id);
+    }
+  }
+  return {
+    snapshot: resolvedSnapshot,
+    tasks,
+    tasksById: new Map(tasks.map((task) => [task.id, task]))
+  };
+}
+function loadReadonlyTaskTrackerContext(projectRoot) {
+  return loadTaskTrackerContext(projectRoot, undefined, true);
+}
+function listReadyTaskIds(context) {
+  const readyTaskIds = [];
+  for (const issue of context.tasks) {
+    const normalizedStatus = normalizeTaskLifecycleStatus(issue.status) ?? issue.status;
+    if (normalizedStatus === "ready") {
+      readyTaskIds.push(issue.id);
+      continue;
+    }
+    if (normalizedStatus !== "open") {
+      continue;
+    }
+    const hasOpenBlocker = (issue.dependencies ?? []).some((dependency) => {
+      if (dependency.type === "parent-child") {
+        return false;
+      }
+      const targetTaskId = dependency.depends_on_id || dependency.issue_id || dependency.id || "";
+      if (!targetTaskId) {
+        return false;
+      }
+      const dependencyStatus = normalizeTaskLifecycleStatus(context.tasksById.get(targetTaskId)?.status) ?? "unknown";
+      return dependencyStatus !== "completed" && dependencyStatus !== "cancelled";
+    });
+    if (!hasOpenBlocker) {
+      readyTaskIds.push(issue.id);
+    }
+  }
+  return readyTaskIds;
+}
+function projectTaskRecordFromSyncedIssue(issue) {
+  const dependencies = issue.dependencies ?? [];
+  return {
+    id: issue.id,
+    status: issue.status === "unknown" ? issue.rawStatus || "open" : issue.status,
+    issue_type: "task",
+    title: issue.title ?? undefined,
+    priority: issue.priority ?? undefined,
+    description: issue.description ?? undefined,
+    acceptance_criteria: issue.acceptanceCriteria ?? undefined,
+    acceptanceCriteria: issue.acceptanceCriteria ?? undefined,
+    dependencies: dependencies.map((dependency) => ({
+      type: dependency.type ?? undefined,
+      issue_id: dependency.issueId ?? undefined,
+      depends_on_id: dependency.dependsOnId ?? undefined,
+      id: dependency.id ?? dependency.issueId ?? dependency.dependsOnId ?? undefined
+    }))
+  };
+}
+function reopenSingleTask(projectRoot, taskId, summary) {
+  try {
+    updateRemoteTrackerTaskLifecycle(projectRoot, {
+      taskId,
+      status: "open",
+      allowedFrom: ["completed", "cancelled", "blocked"],
+      clearMetadata: true,
+      reason: "reopen"
+    });
+    summary.reopened.push(taskId);
+    return;
+  } catch (error) {
+    summary.failed.push(taskId);
+    const details = error instanceof Error ? error.message.trim() : String(error).trim();
+    if (details) {
+      console.log(`WARN: failed to reopen ${taskId}: ${details}`);
+    } else {
+      console.log(`WARN: failed to reopen ${taskId}`);
+    }
+  }
+}
+function printTaskReopenSummary(summary) {
+  console.log(`Reopened: ${summary.reopened.length}`);
+  if (summary.failed.length > 0) {
+    console.log(`Failed: ${summary.failed.length}`);
+  }
+  if (summary.skipped.length > 0) {
+    console.log(`Skipped: ${summary.skipped.length}`);
+  }
+}
+function taskDependencyIds(projectRoot, taskId) {
+  const tracker = loadReadonlyTaskTrackerContext(projectRoot);
+  const canonicalTaskIds = new Set(tracker.tasks.map((task) => task.id));
+  const record = readBeadsTasks(projectRoot, tracker).find((entry) => entry.id === taskId);
+  if (!record?.dependencies?.length) {
+    return [];
+  }
+  const ids = new Set;
+  for (const edge of record.dependencies) {
+    if (!edge || edge.type === "parent-child") {
+      continue;
+    }
+    for (const candidate of [edge.depends_on_id, edge.id, edge.issue_id]) {
+      if (typeof candidate !== "string" || candidate === taskId || !canonicalTaskIds.has(candidate)) {
+        continue;
+      }
+      ids.add(candidate);
+    }
+  }
+  return [...ids].sort();
+}
+function taskDependencies(projectRoot, taskId, tracker) {
+  if (!tracker) {
+    return taskDependencyIds(projectRoot, taskId);
+  }
+  const canonicalTaskIds = new Set(tracker.tasks.map((task) => task.id));
+  const record = readBeadsTasks(projectRoot, tracker).find((entry) => entry.id === taskId);
+  if (!record?.dependencies?.length) {
+    return [];
+  }
+  const ids = new Set;
+  for (const edge of record.dependencies) {
+    if (!edge || edge.type === "parent-child") {
+      continue;
+    }
+    for (const candidate of [edge.depends_on_id, edge.id, edge.issue_id]) {
+      if (typeof candidate !== "string" || candidate === taskId || !canonicalTaskIds.has(candidate)) {
+        continue;
+      }
+      ids.add(candidate);
+    }
+  }
+  return [...ids].sort();
+}
+function printArtifactSection(path, header) {
+  if (!existsSync12(path)) {
+    return;
+  }
+  console.log(header);
+  process.stdout.write(readFileSync8(path, "utf-8"));
+  console.log("");
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function changedFilesForTask(projectRoot, taskId, scoped) {
+  return filterTaskChangedFiles(projectRoot, taskId, collectTaskChangedFiles(projectRoot, taskId, true), scoped);
+}
+function pendingFilesForTask(projectRoot, taskId, scoped) {
+  return filterTaskChangedFiles(projectRoot, taskId, collectTaskChangedFiles(projectRoot, taskId, false), scoped);
+}
+var BUILD_CONFIG, BAKED_INFO_OUTPUT, BAKED_DEPS_OUTPUT, BAKED_STATUS_OUTPUT, REOPENABLE_TASK_STATUSES, GENERATED_TASK_ARTIFACT_FILES;
+var init_task_ops = __esm(() => {
+  init_native_git();
+  init_source_lifecycle();
+  init_task_state();
+  init_source_aware_task_config_source();
+  init_state_sync();
+  init_validator();
+  init_utils();
+  BUILD_CONFIG = readBuildConfig();
+  BAKED_INFO_OUTPUT = BUILD_CONFIG.AGENT_INFO_OUTPUT ?? "";
+  BAKED_DEPS_OUTPUT = BUILD_CONFIG.AGENT_DEPS_OUTPUT ?? "";
+  BAKED_STATUS_OUTPUT = BUILD_CONFIG.AGENT_STATUS_OUTPUT ?? "";
+  REOPENABLE_TASK_STATUSES = new Set(["completed", "cancelled", "blocked"]);
+  GENERATED_TASK_ARTIFACT_FILES = new Set([
+    "changed-files.txt",
+    "decision-log.md",
+    "next-actions.md",
+    "task-result.json",
+    "validation-summary.json",
+    "review-feedback.md",
+    "review-state.json",
+    "review-status.txt",
+    "review-greptile-raw.json",
+    "pr-state.json",
+    "git-state.txt"
+  ]);
+});
+
+// packages/task-sources-plugin/src/control-plane/tasks/plugin-task-source.ts
+import { findTaskById as findTaskById2 } from "@rig/core/task-record-reader";
+function createPluginTaskRecordReader(context, options) {
+  const source = selectTaskSource(context.taskSourceRegistry, options);
+  return {
+    async listTasks() {
+      try {
+        return await source.list();
+      } catch (cause) {
+        throw readFailedError(source, options, "list", cause);
+      }
+    },
+    async getTask(id) {
+      try {
+        if (source.get) {
+          return await source.get(id) ?? null;
+        }
+        return findTaskById2({
+          listTasks: () => source.list(),
+          getTask: async () => null
+        }, id);
+      } catch (cause) {
+        throw readFailedError(source, options, "get", cause);
+      }
+    }
+  };
+}
+function selectTaskSource(registry, options) {
+  try {
+    if (options.sourceId) {
+      return registry.resolveById(options.sourceId);
+    }
+    if (options.sourceKind) {
+      return registry.resolveByKind(options.sourceKind);
+    }
+    const [source] = registry.list();
+    if (source) {
+      return source;
+    }
+  } catch (cause) {
+    throw new TaskRecordSourceError({
+      code: "TASK_SOURCE_NOT_CONFIGURED",
+      message: taskSourceSelectionMessage(options),
+      projectRoot: options.projectRoot,
+      operation: "select",
+      sourceId: options.sourceId ?? null,
+      sourceKind: options.sourceKind ?? null,
+      cause
+    });
+  }
+  throw new TaskRecordSourceError({
+    code: "TASK_SOURCE_NOT_CONFIGURED",
+    message: taskSourceSelectionMessage(options),
+    projectRoot: options.projectRoot,
+    operation: "select",
+    sourceId: options.sourceId ?? null,
+    sourceKind: options.sourceKind ?? null
+  });
+}
+function taskSourceSelectionMessage(options) {
+  const selector = options.sourceId ? `id "${options.sourceId}"` : options.sourceKind ? `kind "${options.sourceKind}"` : "the configured plugin task source";
+  return `No task source registered for ${selector} in project ${options.projectRoot}. Check rig.config.ts taskSource and loaded plugins.`;
+}
+function readFailedError(source, options, operation, cause) {
+  const causeMessage = cause instanceof Error ? cause.message : String(cause);
+  return new TaskRecordSourceError({
+    code: "TASK_SOURCE_READ_FAILED",
+    message: `Task source ${source.kind} (${source.id}) failed to ${operation} tasks for project ${options.projectRoot}: ${causeMessage}`,
+    projectRoot: options.projectRoot,
+    operation,
+    sourceId: source.id,
+    sourceKind: source.kind,
+    cause
+  });
+}
+var TaskRecordSourceError;
+var init_plugin_task_source = __esm(() => {
+  TaskRecordSourceError = class TaskRecordSourceError extends Error {
+    code;
+    projectRoot;
+    sourceId;
+    sourceKind;
+    operation;
+    cause;
+    constructor(input) {
+      super(input.message, { cause: input.cause });
+      this.name = "TaskRecordSourceError";
+      this.code = input.code;
+      this.projectRoot = input.projectRoot;
+      this.operation = input.operation;
+      this.sourceId = input.sourceId ?? null;
+      this.sourceKind = input.sourceKind ?? null;
+      this.cause = input.cause;
+    }
+  };
+});
+
+// packages/task-sources-plugin/src/control-plane/task-data-service.ts
+var exports_task_data_service = {};
+__export(exports_task_data_service, {
+  createTaskDataService: () => createTaskDataService
+});
+function createTaskDataService() {
+  return {
+    currentTaskId,
+    readTaskConfig,
+    readSourceTaskConfig,
+    lookupTask,
+    artifactDirForId,
+    taskInfo,
+    taskDeps,
+    taskStatus,
+    taskScope,
+    taskReady,
+    taskLookup,
+    taskRecord,
+    taskReopen,
+    taskValidate,
+    taskArtifacts,
+    taskArtifactDir,
+    taskArtifactWrite,
+    taskArtifactRead,
+    taskDependencyIds,
+    changedFilesForTask,
+    pendingFilesForTask,
+    readSourceAwareTaskStatus,
+    readConfiguredTaskSourceTask,
+    updateConfiguredTaskSourceTask,
+    buildTaskRunLifecycleComment,
+    updateGithubIssueTaskBySourceIssueId,
+    updateSourceAwareTaskConfigTask,
+    updateRunTaskSourceLifecycle,
+    createLegacyTaskConfigRecordReader,
+    createSourceAwareTaskConfigRecordReader,
+    createPluginTaskRecordReader,
+    readSyncedTrackerState,
+    listReadyTaskIdsFromTracker,
+    normalizeTaskLifecycleStatus
+  };
+}
+var init_task_data_service = __esm(() => {
+  init_task_state();
+  init_task_ops();
+  init_source_aware_task_config_source();
+  init_legacy_task_config_source();
+  init_plugin_task_source();
+  init_source_lifecycle();
+  init_state_sync();
+  init_types();
+});
+
+// packages/task-sources-plugin/src/control-plane/task-io-service.ts
+var exports_task_io_service = {};
+__export(exports_task_io_service, {
+  createTaskIoService: () => createTaskIoService
+});
+import { resolvePluginHost as resolvePluginHost2 } from "@rig/core/project-plugins";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function taskText(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function taskUrl(record) {
+  const metadata = record;
+  return taskText(metadata.url) ?? taskText(metadata.html_url) ?? taskText(metadata.webUrl);
+}
+function taskBody(record) {
+  const metadata = record;
+  return taskText(metadata.body) ?? taskText(metadata.description);
+}
+function taskTitle(record) {
+  const metadata = record;
+  return taskText(metadata.title) ?? taskText(metadata.name) ?? record.id;
+}
+function taskStringList(value) {
+  return Array.isArray(value) ? value.filter((entry) => typeof entry === "string" && entry.trim().length > 0) : [];
+}
+function taskDependencies2(record) {
+  const raw = record;
+  const dependencies = taskStringList(raw.dependencies);
+  if (dependencies.length > 0)
+    return dependencies;
+  const deps = taskStringList(raw.deps);
+  return deps.length > 0 ? deps : null;
+}
+function taskParentChildDeps(record) {
+  const raw = record;
+  const parentChildDeps = taskStringList(raw.parentChildDeps);
+  if (parentChildDeps.length > 0)
+    return parentChildDeps;
+  const parents = taskStringList(raw.parents);
+  return parents.length > 0 ? parents : null;
+}
+function taskCreateInput(task) {
+  const deps = Array.isArray(task.dependencies) ? task.dependencies.filter((entry) => typeof entry === "string") : Array.isArray(task.deps) ? task.deps.filter((entry) => typeof entry === "string") : [];
+  const parents = Array.isArray(task.parents) ? task.parents.filter((entry) => typeof entry === "string") : [];
+  return {
+    title: taskText(task.title) ?? taskText(task.name) ?? "Untitled task",
+    body: taskText(task.body) ?? taskText(task.description) ?? "",
+    ...deps.length > 0 ? { deps } : {},
+    ...parents.length > 0 ? { parents } : {},
+    metadata: { ...task }
+  };
+}
+function toRigTask(record, sourceKind) {
+  const dependencies = taskDependencies2(record);
+  const parentChildDeps = taskParentChildDeps(record);
+  return {
+    ...record,
+    id: record.id,
+    title: taskTitle(record),
+    status: typeof record.status === "string" ? record.status : null,
+    source: sourceKind,
+    url: taskUrl(record),
+    body: taskBody(record),
+    ...dependencies ? { dependencies } : {},
+    ...parentChildDeps ? { parentChildDeps } : {}
+  };
+}
+async function loadTaskSource(projectRoot) {
+  const { config, host: pluginHost } = await resolvePluginHost2(projectRoot);
+  const factory = pluginHost.resolveTaskSourceFactoryByKind(config.taskSource.kind);
+  if (!factory) {
+    const kinds = pluginHost.listExecutableTaskSources().map((entry) => entry.kind).join(", ") || "none";
+    throw new Error(`No task source factory registered for kind ${config.taskSource.kind}. Registered task sources: ${kinds}.`);
+  }
+  return { kind: config.taskSource.kind, source: factory.factory(config.taskSource, { projectRoot }) };
+}
+function getTaskCreator(source) {
+  const record = source;
+  if (typeof record.createTask === "function")
+    return record.createTask.bind(source);
+  if (typeof record.create === "function")
+    return (task) => record.create?.(taskCreateInput(task));
+  return null;
+}
+function createTaskIoService() {
+  return {
+    async listTasks(projectRoot) {
+      const { kind, source } = await loadTaskSource(projectRoot);
+      return (await source.list()).map((task) => toRigTask(task, kind));
+    },
+    async getTask(projectRoot, taskId) {
+      const { kind, source } = await loadTaskSource(projectRoot);
+      const task = source.get ? await source.get(taskId) ?? null : (await source.list()).find((entry) => entry.id === taskId) ?? null;
+      return task ? toRigTask(task, kind) : null;
+    },
+    async createTask(projectRoot, task) {
+      const { kind, source } = await loadTaskSource(projectRoot);
+      const creator = getTaskCreator(source);
+      if (!creator)
+        throw new Error(`The configured ${kind} task source does not expose a task creation API.`);
+      const result = await creator(task);
+      const taskId = typeof result === "string" ? result : isRecord(result) && typeof result.id === "string" ? result.id : null;
+      return { taskId, source: kind, result };
+    }
+  };
+}
+var init_task_io_service = () => {};
+
 // packages/task-sources-plugin/src/plugin.ts
-import { resolve as resolve2 } from "path";
+import { resolve as resolve12 } from "path";
 import { definePlugin } from "@rig/core/config";
+import { defineCapability as defineCapability3 } from "@rig/core/capability";
+import { TASK_DATA_SERVICE_CAPABILITY, TASK_IO_SERVICE_CAPABILITY } from "@rig/contracts";
 import {
   createEnvGitHubCredentialProvider,
   createStateGitHubCredentialProvider
-} from "@rig/github-provider-plugin";
+} from "@rig/github-lib";
 
 // packages/task-sources-plugin/src/github-issues-source.ts
 import { spawnSync } from "child_process";
@@ -954,16 +4818,16 @@ function requireStringField(config, field, kind) {
   }
   return value;
 }
-function isRecord(value) {
+function isRecord2(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 function optionalString(value) {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
 }
 function parseGitHubProjectsOptions(value) {
-  if (!isRecord(value))
+  if (!isRecord2(value))
     return;
-  const statusesSource = isRecord(value.statuses) ? value.statuses : undefined;
+  const statusesSource = isRecord2(value.statuses) ? value.statuses : undefined;
   const statuses = {};
   for (const key of ["todo", "running", "prOpen", "ciFixing", "merging", "done", "needsAttention"]) {
     const status = optionalString(statusesSource?.[key]);
@@ -984,86 +4848,85 @@ function parseGitHubProjectsOptions(value) {
   return parsed;
 }
 function githubProjectsOptionsFromConfig(config, context) {
-  const rigConfig = isRecord(context?.rigConfig) ? context.rigConfig : undefined;
-  const github = isRecord(rigConfig?.github) ? rigConfig.github : undefined;
+  const rigConfig = isRecord2(context?.rigConfig) ? context.rigConfig : undefined;
+  const github = isRecord2(rigConfig?.github) ? rigConfig.github : undefined;
   return parseGitHubProjectsOptions(config.options?.projects) ?? parseGitHubProjectsOptions(github?.projects);
 }
 function booleanOption(value) {
   return typeof value === "boolean" ? value : undefined;
 }
+var TaskDataCap = defineCapability3(TASK_DATA_SERVICE_CAPABILITY);
+var TaskIoCap = defineCapability3(TASK_IO_SERVICE_CAPABILITY);
 function createTaskSourcesPlugin(opts = {}) {
   return definePlugin({
     name: "@rig/standard-plugin:task-sources",
     version: "0.1.0",
     contributes: {
+      capabilities: [
+        TaskDataCap.provide(async () => (await Promise.resolve().then(() => (init_task_data_service(), exports_task_data_service))).createTaskDataService(), {
+          title: "Task data",
+          description: "Task-config/state reads, task commands, artifacts, validation, and synced-tracker projection."
+        }),
+        TaskIoCap.provide(async () => (await Promise.resolve().then(() => (init_task_io_service(), exports_task_io_service))).createTaskIoService(), {
+          title: "Task IO",
+          description: "Normalized task-source list/get/create operations for CLI and cockpit consumers."
+        })
+      ],
       taskSources: [
         {
           id: "std:github-issues",
           kind: "github-issues",
-          description: "GitHub Issues via gh CLI"
+          description: "GitHub Issues via gh CLI",
+          factory(config, context) {
+            const options = {
+              owner: requireStringField(config, "owner", "github-issues"),
+              repo: requireStringField(config, "repo", "github-issues")
+            };
+            const credentialProviderOptions = context?.projectRoot ? { stateDir: resolve12(context.projectRoot, ".rig", "state") } : {};
+            options.credentialProvider = opts.githubCredentialProvider ?? createStateGitHubCredentialProvider(credentialProviderOptions);
+            if (opts.githubWorkspaceId)
+              options.workspaceId = opts.githubWorkspaceId;
+            if (opts.githubUserId)
+              options.userId = opts.githubUserId;
+            if (opts.githubSpawn)
+              options.spawn = opts.githubSpawn;
+            if (opts.onGitHubTaskChanged)
+              options.onTaskChanged = opts.onGitHubTaskChanged;
+            if (config.labels !== undefined)
+              options.labels = config.labels;
+            if (config.state !== undefined)
+              options.state = config.state;
+            const assignee = typeof config.options?.assignee === "string" ? config.options.assignee : process.env.RIG_GITHUB_ASSIGNEE;
+            if (assignee?.trim())
+              options.assignee = assignee.trim();
+            const timeoutMs = typeof config.options?.timeoutMs === "number" ? config.options.timeoutMs : undefined;
+            if (timeoutMs !== undefined)
+              options.timeoutMs = timeoutMs;
+            const listLimit = typeof config.options?.listLimit === "number" ? config.options.listLimit : undefined;
+            if (listLimit !== undefined)
+              options.listLimit = listLimit;
+            const projects = githubProjectsOptionsFromConfig(config, context);
+            if (projects)
+              options.projects = projects;
+            const useNativeDependencies = booleanOption(config.options?.useNativeDependencies);
+            if (useNativeDependencies !== undefined)
+              options.useNativeDependencies = useNativeDependencies;
+            return createGitHubIssuesTaskSource(options);
+          }
         },
         {
           id: "std:files",
           kind: "files",
-          description: "JSON files in a local directory"
+          description: "JSON files in a local directory",
+          factory(config, context) {
+            return createFilesTaskSource({
+              path: requireStringField(config, "path", "files"),
+              ...context?.projectRoot ? { projectRoot: context.projectRoot } : {}
+            });
+          }
         }
       ]
     }
-  }, {
-    taskSources: [
-      {
-        id: "std:github-issues",
-        kind: "github-issues",
-        description: "GitHub Issues via gh CLI",
-        factory(config, context) {
-          const options = {
-            owner: requireStringField(config, "owner", "github-issues"),
-            repo: requireStringField(config, "repo", "github-issues")
-          };
-          const credentialProviderOptions = context?.projectRoot ? { stateDir: resolve2(context.projectRoot, ".rig", "state") } : {};
-          options.credentialProvider = opts.githubCredentialProvider ?? createStateGitHubCredentialProvider(credentialProviderOptions);
-          if (opts.githubWorkspaceId)
-            options.workspaceId = opts.githubWorkspaceId;
-          if (opts.githubUserId)
-            options.userId = opts.githubUserId;
-          if (opts.githubSpawn)
-            options.spawn = opts.githubSpawn;
-          if (opts.onGitHubTaskChanged)
-            options.onTaskChanged = opts.onGitHubTaskChanged;
-          if (config.labels !== undefined)
-            options.labels = config.labels;
-          if (config.state !== undefined)
-            options.state = config.state;
-          const assignee = typeof config.options?.assignee === "string" ? config.options.assignee : process.env.RIG_GITHUB_ASSIGNEE;
-          if (assignee?.trim())
-            options.assignee = assignee.trim();
-          const timeoutMs = typeof config.options?.timeoutMs === "number" ? config.options.timeoutMs : undefined;
-          if (timeoutMs !== undefined)
-            options.timeoutMs = timeoutMs;
-          const listLimit = typeof config.options?.listLimit === "number" ? config.options.listLimit : undefined;
-          if (listLimit !== undefined)
-            options.listLimit = listLimit;
-          const projects = githubProjectsOptionsFromConfig(config, context);
-          if (projects)
-            options.projects = projects;
-          const useNativeDependencies = booleanOption(config.options?.useNativeDependencies);
-          if (useNativeDependencies !== undefined)
-            options.useNativeDependencies = useNativeDependencies;
-          return createGitHubIssuesTaskSource(options);
-        }
-      },
-      {
-        id: "std:files",
-        kind: "files",
-        description: "JSON files in a local directory",
-        factory(config, context) {
-          return createFilesTaskSource({
-            path: requireStringField(config, "path", "files"),
-            ...context?.projectRoot ? { projectRoot: context.projectRoot } : {}
-          });
-        }
-      }
-    ]
   });
 }
 var createStandardTaskSourcesPlugin = createTaskSourcesPlugin;