diff --git a/.ci/scripts/README.md b/.ci/scripts/README.md
index 72fc4bd4af..c8c86698a0 100644
--- a/.ci/scripts/README.md
+++ b/.ci/scripts/README.md
@@ -6,7 +6,9 @@ This directory contains scripts for measuring and analyzing CI performance metri
 
 ### measure-ci-baseline.sh
 
-Collects workflow run data from GitHub Actions and calculates baseline metrics.
+Collects workflow run data from GitHub Actions and calculates baseline metrics via
+`cargo xtask ci-baseline` (the underlying implementation), with this wrapper
+script retained as a convenience entrypoint.
 
 **Features:**
 - Fetches workflow runs from specified branch
@@ -19,41 +21,49 @@ Collects workflow run data from GitHub Actions and calculates baseline metrics.
 
 **Prerequisites:**
 - [GitHub CLI (gh)](https://cli.github.com/) - installed and authenticated
-- [jq](https://stedolan.github.io/jq/) - for JSON processing
+- Rust toolchain - for the workspace xtask binary
+- `cargo` - comes with Rust, used to run `cargo xtask`
 
 **Installation of prerequisites:**
 
 ```bash
 # macOS
-brew install gh jq
+brew install gh
 
 # Ubuntu/Debian
-sudo apt install gh jq
+sudo apt install gh
 
-# Then authenticate
+# Authenticate once for CLI queries
 gh auth login
 ```
 
-**Usage:**
+**Usage (canonical):**
 
 ```bash
 # Basic usage (analyzes master branch, last 30 days)
-./measure-ci-baseline.sh
+cargo xtask ci-baseline
 
 # Analyze a different branch
-./measure-ci-baseline.sh --branch main
+cargo xtask ci-baseline --branch main
 
 # Analyze last 7 days only
-./measure-ci-baseline.sh --days 7
+cargo xtask ci-baseline --days 7
 
 # Fetch more runs for higher accuracy
-./measure-ci-baseline.sh --limit 500
+cargo xtask ci-baseline --limit 500
 
 # Custom output directory
-./measure-ci-baseline.sh --output ./reports
+cargo xtask ci-baseline --output ./reports
 
 # All options
-./measure-ci-baseline.sh --branch master --days 30 --limit 200 --output .ci
+cargo xtask ci-baseline --branch master --days 30 --limit 200 --output .ci
+```
+
+**Usage (wrapper shim):**
+
+```bash
+# Run the shim script (delegates to `cargo xtask ci-baseline`)
+./measure-ci-baseline.sh
 ```
 
 **Options:**
@@ -111,10 +121,10 @@ gh auth login
 
 ```bash
 # Run before making CI changes
-./measure-ci-baseline.sh --output .ci/before
+cargo xtask ci-baseline --output .ci/before
 
 # After changes
-./measure-ci-baseline.sh --output .ci/after
+cargo xtask ci-baseline --output .ci/after
 
 # Compare the JSON files to measure improvement
 ```
@@ -130,8 +140,8 @@ gh auth login
 
 ```bash
 # Compare feature branch to main
-./measure-ci-baseline.sh --branch main --output .ci/main-baseline
-./measure-ci-baseline.sh --branch feature-x --output .ci/feature-baseline
+cargo xtask ci-baseline --branch main --output .ci/main-baseline
+cargo xtask ci-baseline --branch feature-x --output .ci/feature-baseline
 ```
 
 ## Interpreting Results
@@ -168,20 +178,6 @@ gh auth login
 # Follow the prompts to authenticate
 ```
 
-### "jq: command not found"
-
-Install jq for your platform:
-```bash
-# macOS
-brew install jq
-
-# Ubuntu/Debian  
-sudo apt install jq
-
-# RHEL/CentOS
-sudo yum install jq
-```
-
 ### No workflow runs found
 
 - Verify the branch name exists
diff --git a/.ci/scripts/measure-ci-baseline.sh b/.ci/scripts/measure-ci-baseline.sh
index a79bb3e9fb..5fc382c55e 100755
--- a/.ci/scripts/measure-ci-baseline.sh
+++ b/.ci/scripts/measure-ci-baseline.sh
@@ -1,409 +1,14 @@
 #!/usr/bin/env bash
+# Canonical implementation: cargo xtask ci-baseline.
 #
-# measure-ci-baseline.sh - Measure CI baseline metrics from GitHub Actions
-#
-# This script collects workflow run data from GitHub Actions and calculates
-# baseline metrics including median duration, P95 duration, success rate,
-# and approximate billable minutes.
-#
-# Requirements:
-#   - gh CLI installed and authenticated (gh auth login)
-#   - jq for JSON processing
-#   - bc for calculations (optional, falls back to awk)
-#
-# Usage:
-#   ./measure-ci-baseline.sh [options]
-#
-# Options:
-#   -b, --branch BRANCH    Branch to analyze (default: master)
-#   -d, --days DAYS        Number of days to look back (default: 30)
-#   -l, --limit LIMIT      Max runs to fetch (default: 200)
-#   -o, --output DIR       Output directory (default: .ci)
-#   -h, --help             Show this help message
-#
-# Output:
-#   .ci/ci_baseline.json   Machine-readable metrics
-#   .ci/ci_baseline.md     Human-readable report
+# Supported flags are passed through to:
+#   cargo xtask ci-baseline --branch BRANCH --days DAYS --limit LIMIT --output DIR
 
 set -euo pipefail
 
-# Default configuration
-BRANCH="master"
-DAYS=30
-LIMIT=200
-OUTPUT_DIR=".ci"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 
-# Colors for output (disabled if not a terminal)
-if [[ -t 1 ]]; then
-    RED='\033[0;31m'
-    GREEN='\033[0;32m'
-    YELLOW='\033[1;33m'
-    BLUE='\033[0;34m'
-    NC='\033[0m' # No Color
-else
-    RED=''
-    GREEN=''
-    YELLOW=''
-    BLUE=''
-    NC=''
-fi
-
-log_info() { echo -e "${BLUE}[INFO]${NC} $*"; }
-log_success() { echo -e "${GREEN}[OK]${NC} $*"; }
-log_warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
-log_error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
-
-usage() {
-    head -30 "$0" | grep -E "^#" | sed 's/^# //' | sed 's/^#//'
-    exit 0
-}
-
-# Parse command line arguments
-while [[ $# -gt 0 ]]; do
-    case $1 in
-        -b|--branch) BRANCH="$2"; shift 2 ;;
-        -d|--days) DAYS="$2"; shift 2 ;;
-        -l|--limit) LIMIT="$2"; shift 2 ;;
-        -o|--output) OUTPUT_DIR="$2"; shift 2 ;;
-        -h|--help) usage ;;
-        *) log_error "Unknown option: $1"; usage ;;
-    esac
-done
-
-# Check prerequisites
-check_prerequisites() {
-    local missing=()
-    
-    if ! command -v gh &>/dev/null; then
-        missing+=("gh (GitHub CLI)")
-    fi
-    
-    if ! command -v jq &>/dev/null; then
-        missing+=("jq")
-    fi
-    
-    if [[ ${#missing[@]} -gt 0 ]]; then
-        log_error "Missing required tools: ${missing[*]}"
-        echo ""
-        echo "Installation instructions:"
-        echo "  gh:  https://cli.github.com/manual/installation"
-        echo "  jq:  https://stedolan.github.io/jq/download/"
-        exit 1
-    fi
-    
-    # Check gh authentication
-    if ! gh auth status &>/dev/null; then
-        log_error "GitHub CLI is not authenticated"
-        echo ""
-        echo "Please run: gh auth login"
-        exit 1
-    fi
-    
-    log_success "Prerequisites satisfied"
-}
-
-# Calculate percentile from sorted array (passed as newline-separated values)
-calculate_percentile() {
-    local percentile=$1
-    local values
-    mapfile -t values < <(sort -n)
-    local count=${#values[@]}
-    
-    if [[ $count -eq 0 ]]; then
-        echo "0"
-        return
-    fi
-    
-    local index
-    index=$(awk "BEGIN {printf \"%d\", ($count - 1) * $percentile / 100}")
-    echo "${values[$index]}"
-}
-
-# Calculate median
-calculate_median() {
-    calculate_percentile 50
-}
-
-# Calculate P95
-calculate_p95() {
-    calculate_percentile 95
-}
-
-# Convert ISO 8601 timestamp to epoch seconds
-iso_to_epoch() {
-    local ts="$1"
-    # Handle both GNU and BSD date
-    if date --version &>/dev/null 2>&1; then
-        date -d "$ts" +%s 2>/dev/null || echo "0"
-    else
-        date -j -f "%Y-%m-%dT%H:%M:%SZ" "$ts" +%s 2>/dev/null || echo "0"
-    fi
-}
-
-# Calculate duration between two ISO timestamps in seconds
-calculate_duration() {
-    local start="$1"
-    local end="$2"
-    local start_epoch end_epoch
-    
-    start_epoch=$(iso_to_epoch "$start")
-    end_epoch=$(iso_to_epoch "$end")
-    
-    if [[ "$start_epoch" -eq 0 ]] || [[ "$end_epoch" -eq 0 ]]; then
-        echo "0"
-        return
-    fi
-    
-    echo $((end_epoch - start_epoch))
-}
-
-# Format seconds as human-readable duration
-format_duration() {
-    local seconds=$1
-    if [[ $seconds -lt 60 ]]; then
-        echo "${seconds}s"
-    elif [[ $seconds -lt 3600 ]]; then
-        echo "$((seconds / 60))m $((seconds % 60))s"
-    else
-        echo "$((seconds / 3600))h $((seconds % 3600 / 60))m"
-    fi
-}
-
-# Main measurement function
-measure_ci_baseline() {
-    local cutoff_date
-    cutoff_date=$(date -d "-${DAYS} days" +%Y-%m-%d 2>/dev/null || date -v-${DAYS}d +%Y-%m-%d)
-    
-    log_info "Fetching workflow runs from branch '$BRANCH' (last $DAYS days, limit $LIMIT)"
-    
-    # Fetch workflow runs
-    local runs_json
-    runs_json=$(gh run list --limit "$LIMIT" --branch "$BRANCH" \
-        --json name,conclusion,createdAt,updatedAt,databaseId,workflowName,status)
-    
-    if [[ -z "$runs_json" ]] || [[ "$runs_json" == "[]" ]]; then
-        log_warn "No workflow runs found for branch '$BRANCH'"
-        return 1
-    fi
-    
-    local run_count
-    run_count=$(echo "$runs_json" | jq 'length')
-    log_info "Found $run_count workflow runs"
-    
-    # Get unique workflow names
-    local workflows
-    mapfile -t workflows < <(echo "$runs_json" | jq -r '.[].workflowName' | sort -u)
-    
-    log_info "Analyzing ${#workflows[@]} unique workflows..."
-    
-    # Initialize results
-    local results='{"generated_at": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'", "branch": "'$BRANCH'", "days_analyzed": '$DAYS', "workflows": {}}'
-    
-    # Process each workflow
-    for workflow in "${workflows[@]}"; do
-        log_info "  Processing: $workflow"
-        
-        # Filter runs for this workflow
-        local workflow_runs
-        workflow_runs=$(echo "$runs_json" | jq --arg wf "$workflow" '[.[] | select(.workflowName == $wf)]')
-        
-        local total_runs completed_runs success_count skipped_count failure_count
-        total_runs=$(echo "$workflow_runs" | jq 'length')
-        
-        # Count by conclusion
-        success_count=$(echo "$workflow_runs" | jq '[.[] | select(.conclusion == "success")] | length')
-        failure_count=$(echo "$workflow_runs" | jq '[.[] | select(.conclusion == "failure")] | length')
-        skipped_count=$(echo "$workflow_runs" | jq '[.[] | select(.conclusion == "skipped")] | length')
-        
-        # Only count non-skipped runs for duration analysis
-        completed_runs=$((success_count + failure_count))
-        
-        # Calculate success rate (excluding skipped)
-        local success_rate="0"
-        if [[ $completed_runs -gt 0 ]]; then
-            success_rate=$(awk "BEGIN {printf \"%.1f\", $success_count * 100 / $completed_runs}")
-        fi
-        
-        # Calculate durations for completed runs
-        local durations=()
-        while IFS= read -r run; do
-            local created updated duration
-            created=$(echo "$run" | jq -r '.createdAt')
-            updated=$(echo "$run" | jq -r '.updatedAt')
-            conclusion=$(echo "$run" | jq -r '.conclusion')
-            
-            # Skip skipped runs
-            if [[ "$conclusion" == "skipped" ]]; then
-                continue
-            fi
-            
-            duration=$(calculate_duration "$created" "$updated")
-            if [[ $duration -gt 0 ]]; then
-                durations+=("$duration")
-            fi
-        done < <(echo "$workflow_runs" | jq -c '.[]')
-        
-        # Calculate statistics
-        local median_duration=0 p95_duration=0 avg_duration=0
-        local total_duration=0
-        
-        if [[ ${#durations[@]} -gt 0 ]]; then
-            # Calculate median
-            median_duration=$(printf '%s\n' "${durations[@]}" | calculate_median)
-            
-            # Calculate P95
-            p95_duration=$(printf '%s\n' "${durations[@]}" | calculate_p95)
-            
-            # Calculate average
-            for d in "${durations[@]}"; do
-                total_duration=$((total_duration + d))
-            done
-            avg_duration=$((total_duration / ${#durations[@]}))
-        fi
-        
-        # Estimate billable minutes (rounded up to nearest minute per run)
-        local billable_minutes=0
-        for d in "${durations[@]}"; do
-            billable_minutes=$((billable_minutes + (d + 59) / 60))
-        done
-        
-        # Add workflow results
-        local workflow_key
-        workflow_key=$(echo "$workflow" | tr ' ' '_' | tr -cd '[:alnum:]_-')
-        
-        results=$(echo "$results" | jq --arg key "$workflow_key" \
-            --arg name "$workflow" \
-            --argjson total "$total_runs" \
-            --argjson completed "$completed_runs" \
-            --argjson success "$success_count" \
-            --argjson failure "$failure_count" \
-            --argjson skipped "$skipped_count" \
-            --arg rate "$success_rate" \
-            --argjson median "$median_duration" \
-            --argjson p95 "$p95_duration" \
-            --argjson avg "$avg_duration" \
-            --argjson billable "$billable_minutes" \
-            '.workflows[$key] = {
-                "name": $name,
-                "total_runs": $total,
-                "completed_runs": $completed,
-                "success_count": $success,
-                "failure_count": $failure,
-                "skipped_count": $skipped,
-                "success_rate_percent": ($rate | tonumber),
-                "median_duration_seconds": $median,
-                "p95_duration_seconds": $p95,
-                "avg_duration_seconds": $avg,
-                "billable_minutes": $billable
-            }')
-    done
-    
-    # Calculate totals
-    local total_billable total_runs total_success
-    total_billable=$(echo "$results" | jq '[.workflows[].billable_minutes] | add // 0')
-    total_runs=$(echo "$results" | jq '[.workflows[].total_runs] | add // 0')
-    total_success=$(echo "$results" | jq '[.workflows[].success_count] | add // 0')
-    total_completed=$(echo "$results" | jq '[.workflows[].completed_runs] | add // 0')
-    
-    local overall_success_rate="0"
-    if [[ $total_completed -gt 0 ]]; then
-        overall_success_rate=$(awk "BEGIN {printf \"%.1f\", $total_success * 100 / $total_completed}")
-    fi
-    
-    results=$(echo "$results" | jq \
-        --argjson total_runs "$total_runs" \
-        --argjson total_billable "$total_billable" \
-        --arg overall_rate "$overall_success_rate" \
-        '. + {
-            "summary": {
-                "total_runs": $total_runs,
-                "total_billable_minutes": $total_billable,
-                "overall_success_rate_percent": ($overall_rate | tonumber)
-            }
-        }')
-    
-    # Create output directory
-    mkdir -p "$OUTPUT_DIR"
-    
-    # Write JSON output
-    echo "$results" | jq '.' > "$OUTPUT_DIR/ci_baseline.json"
-    log_success "Written: $OUTPUT_DIR/ci_baseline.json"
-    
-    # Generate markdown report
-    generate_markdown_report "$results" "$OUTPUT_DIR/ci_baseline.md"
-    log_success "Written: $OUTPUT_DIR/ci_baseline.md"
-    
-    # Print summary
-    echo ""
-    echo "======================================"
-    echo "CI Baseline Summary"
-    echo "======================================"
-    echo "Branch:              $BRANCH"
-    echo "Analysis period:     Last $DAYS days"
-    echo "Total runs:          $total_runs"
-    echo "Total billable:      ${total_billable}m"
-    echo "Overall success:     ${overall_success_rate}%"
-    echo "======================================"
-}
-
-generate_markdown_report() {
-    local results="$1"
-    local output_file="$2"
-    
-    cat > "$output_file" << HEADER
-# CI Baseline Metrics Report
-
-**Generated:** $(date -u +"%Y-%m-%d %H:%M:%S UTC")
-**Branch:** $(echo "$results" | jq -r '.branch')
-**Analysis Period:** Last $(echo "$results" | jq -r '.days_analyzed') days
-
-## Summary
-
-| Metric | Value |
-|--------|-------|
-| Total Runs | $(echo "$results" | jq -r '.summary.total_runs') |
-| Overall Success Rate | $(echo "$results" | jq -r '.summary.overall_success_rate_percent')% |
-| Total Billable Minutes | $(echo "$results" | jq -r '.summary.total_billable_minutes')m |
-
-## Workflow Details
-
-| Workflow | Runs | Success Rate | Median | P95 | Billable |
-|----------|------|--------------|--------|-----|----------|
-HEADER
-
-    # Add each workflow
-    echo "$results" | jq -r '.workflows | to_entries[] | 
-        "| \(.value.name) | \(.value.completed_runs) | \(.value.success_rate_percent)% | \(.value.median_duration_seconds)s | \(.value.p95_duration_seconds)s | \(.value.billable_minutes)m |"' >> "$output_file"
-    
-    cat >> "$output_file" << 'FOOTER'
-
-## Notes
-
-- **Median Duration:** 50th percentile of run duration (in seconds)
-- **P95 Duration:** 95th percentile of run duration (in seconds)
-- **Billable Minutes:** Estimated billable time (each run rounded up to nearest minute)
-- **Success Rate:** Calculated excluding skipped runs
-
-## Recommendations
-
-Based on this baseline:
-
-1. **Monitor P95 durations** - Workflows with high P95 vs median ratio may have reliability issues
-2. **Success rate targets** - Aim for >95% success rate on critical workflows
-3. **Cost optimization** - Focus on high-billable workflows for optimization efforts
-
----
-*Generated by measure-ci-baseline.sh*
-FOOTER
-}
-
-# Entry point
-main() {
-    cd "$REPO_ROOT"
-    check_prerequisites
-    measure_ci_baseline
-}
+cd "$REPO_ROOT"
 
-main "$@"
+exec cargo xtask ci-baseline "$@"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 5ba3ee2dbc..8af2f4fd4b 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -95,6 +95,28 @@ bash scripts/install-githooks.sh
 1. Push your branch and open a PR
 2. Describe your changes and link related issues (e.g., "Fixes #123")
 3. All PRs run format checks, clippy, and tests automatically in CI
+4. Merge with a conventional, descriptive squash commit
+
+Once checks are green and reviews are complete, use an explicit conventional commit
+subject when squashing so history is release-friendly and changelog-friendly.
+
+```bash
+pr=<number>
+gh pr merge "$pr" --squash \
+  --subject "feat(lsp): ... " \
+  --body "PR summary:
+- ...
+```
+
+Conventional subject format:
+
+- `feat(scope): imperative summary`
+- `fix(scope): imperative summary`
+- `chore(scope): imperative summary`
+- include `!` for breaking changes, e.g. `feat!: ...`
+
+Do not rely on PR title defaults (often noisy, e.g. `(...#NNNN)`), because they
+break commit consistency for changelog generation.
 
 #### CI Labels (Opt-in)
 
@@ -118,6 +140,8 @@ For full CI details, see [CI & Automation](docs/project/CI.md).
 - Run `cargo fmt --all` before every commit
 - Fix all `cargo clippy --workspace` warnings
 - Use [conventional commits](https://www.conventionalcommits.org/): `feat:`, `fix:`, `docs:`, `refactor:`, `test:`, etc.
+- For squash merges, prefer scope-qualified forms such as
+  `feat(lsp): ...`, `fix(dap): ...`, `chore(release): ...`, etc.
 
 ### Banned in Production Code
 
diff --git a/Cargo.toml b/Cargo.toml
index 32700d79dd..d99977f6dc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -442,7 +442,6 @@ perl-parser-pest = { path = "crates/perl-parser-pest", version = "0.12.0" }
 
 # External dependencies
 tree-sitter-perl = { path = "crates/tree-sitter-perl-rs", features = ["pure-rust"] }
-tree-sitter-perl-c = { path = "crates/tree-sitter-perl-c" }
 tree-sitter = "0.26.6"
 ropey = "1.6.1"
 serde = { version = "1.0.228", features = ["derive"] }
diff --git a/docs/CHANGELOG_WORKFLOW.md b/docs/CHANGELOG_WORKFLOW.md
index f1a2621aa1..c1ff49c1ea 100644
--- a/docs/CHANGELOG_WORKFLOW.md
+++ b/docs/CHANGELOG_WORKFLOW.md
@@ -182,7 +182,7 @@ The changelog is automatically generated during releases via the release orchest
 ```bash
 # Recommended: run both workflow steps through gh automation.
 # Canonical command for RC orchestration:
-./scripts/release-turnkey-pr.sh <0.x.y>
+cargo xtask release-turnkey <0.x.y>
 ```
 
 ### Alternative Manual Release Process
@@ -190,7 +190,7 @@ The changelog is automatically generated during releases via the release orchest
 ```bash
 # 1. Generate changelog content
 # Use the same canonical flow entrypoint:
-./scripts/release-turnkey-pr.sh <0.x.y> --no-auto-merge --no-wait-release
+cargo xtask release-turnkey <0.x.y> --no-auto-merge --no-wait-release
 
 # 2. Manually review and merge the generated version bump PR.
 
@@ -286,13 +286,19 @@ Every commit should follow the conventional commit format. This ensures:
 - Proper categorization
 - Automatic semantic versioning
 
-### 3. Group Related Changes
+### 3. Keep Squash Merges Explicitly Conventional
 
-Use PR merges with conventional commit messages:
+Use explicit subject/body on squash merges so merged history stays descriptive:
 
 ```bash
-# Instead of multiple small commits, use PR title
-feat(parser): add comprehensive heredoc support (#123)
+pr=2943
+gh pr merge "$pr" --squash \
+  --subject "feat(lsp): improve type definition and implementation with OO inheritance support" \
+  --body "PR summary:
+- improve OO lookup fallback for type definitions and implementations
+- add coverage for inherited methods and signatures
+- preserve existing behavior for non-OO dispatch paths"
+  --delete-branch
 ```
 
 ### 4. Document Breaking Changes
diff --git a/docs/PUBLISHING.md b/docs/PUBLISHING.md
index 9b4b473648..aa1fc85c0e 100644
--- a/docs/PUBLISHING.md
+++ b/docs/PUBLISHING.md
@@ -82,7 +82,7 @@ After publish completes:
 To run the entire path from PR creation through publish dispatch:
 
 ```bash
-scripts/release-turnkey-pr.sh <0.x.y>
+cargo xtask release-turnkey <0.x.y>
 ```
 
 Use `--skip-crates` to run validation and release without crates.io publishing when needed.
diff --git a/docs/RELEASE_PROCESS.md b/docs/RELEASE_PROCESS.md
index de17b1df86..b665c9ed55 100644
--- a/docs/RELEASE_PROCESS.md
+++ b/docs/RELEASE_PROCESS.md
@@ -83,7 +83,7 @@ git checkout master
 git reset --hard origin/master
 
 # optional but recommended: use the turnkey orchestrator
-scripts/release-turnkey-pr.sh <0.x.y>
+cargo xtask release-turnkey <0.x.y>
 ```
 
 Or run the two workflow dispatches manually with `gh`:
diff --git a/docs/handoff/swarm-pack/commands/green-merge.md b/docs/handoff/swarm-pack/commands/green-merge.md
index 4c506d6794..8f0ea5e8cf 100644
--- a/docs/handoff/swarm-pack/commands/green-merge.md
+++ b/docs/handoff/swarm-pack/commands/green-merge.md
@@ -23,10 +23,41 @@ gh pr list --state open --json number,title,headRefName,mergeable,statusCheckRol
 ### 3. Merge green PRs sequentially
 For each green PR, in dependency order:
 ```bash
-gh pr merge <number> --squash --delete-branch
+pr=<number>
+gh pr merge "$pr" --squash \
+  --subject "feat(scope): <imperative summary>" \
+  --body "Merge PR #$pr
+
+- <change 1>
+- <change 2>"
 ```
 Wait for each merge to complete before the next. Sequential merging prevents race conditions.
 
+Rules for consistency:
+- Use a conventional prefix: `feat|fix|chore|refactor|docs` plus a single scope in parentheses.
+- Keep the subject imperative and <=72 characters if possible.
+- Make the summary specific to behavior impact, not generic PR intent.
+- Put bullet list details in the body so reviewers can audit intent after squash.
+
+Example commit subject patterns:
+- `feat(perl-lsp): add linked-editing capability wiring`
+- `fix(parser): recover nested here-doc parsing`
+- `chore(release): add release-turnkey xtask wrapper`
+- `refactor(semantic): simplify call-hierarchy parent map`
+
+If the PR title is not conventional, convert it before merge (do not keep `Merge pull request` defaults).
+
+Optional: derive a clearer subject from files changed:
+- `scope=lsp` if files are in `crates/perl-lsp/**`
+- `scope=dap` if files are in `crates/perl-dap/**`
+- `scope=parser` for `crates/perl-parser*`/`crates/perl-lexer*`/`crates/perl-parser-core*`
+- `scope=semantic` for `crates/perl-semantic-analyzer/**`/`crates/perl-workspace-index/**`
+- `scope=release` for `scripts/**`, `xtask/**`, `docs/**`, `.github/**`
+Examples used in this repo:
+- `feat(lsp): ...`
+- `fix(parser): ...`
+- `chore(release): ...`
+
 ### 4. Handle post-merge drift
 After all merges complete:
 ```bash
diff --git a/docs/project/CI_COST_TRACKING.md b/docs/project/CI_COST_TRACKING.md
index 93ac9d520e..5a205232da 100644
--- a/docs/project/CI_COST_TRACKING.md
+++ b/docs/project/CI_COST_TRACKING.md
@@ -334,42 +334,32 @@ jobs:
 
 ## Monitoring
 
-### Using `scripts/ci-cost-monitor.sh`
+### Monitoring CI cost
 
-**Note**: This script doesn't exist yet. Below is the specification for creating it.
+Run the XTASK implementation directly:
 
 ```bash
-#!/bin/bash
-# scripts/ci-cost-monitor.sh
-# Estimates CI costs from GitHub Actions API
+cargo xtask ci-cost-monitor
+```
 
-# Usage:
-#   bash scripts/ci-cost-monitor.sh [--month YYYY-MM] [--repo owner/name]
+If you prefer using the shim script, it delegates to the same command:
 
-# Fetch workflow runs for the month
-# Calculate total minutes per runner type
-# Multiply by pricing
-# Output cost breakdown and trends
+```bash
+# Via shim
+bash scripts/ci-cost-monitor.sh
 ```
 
-**Planned implementation** (Issue #211 Phase 3):
+Examples:
 
 ```bash
-# Show current month costs
-bash scripts/ci-cost-monitor.sh
+# Show costs for the last 30 days
+cargo xtask ci-cost-monitor
+
+# Show JSON output for CI automation
+cargo xtask ci-cost-monitor --json
 
-# Output:
-# CI Cost Report (2025-01)
-# ========================
-# Linux:    127 min × $0.008 = $1.02
-# Windows:   45 min × $0.016 = $0.72
-# macOS:      0 min × $0.080 = $0.00
-# ────────────────────────────────────
-# Total:                       $1.74
-#
-# PRs:        18
-# Avg/PR:     $0.097
-# Trend:      ↓ 12% vs last month
+# Show costs for the last 7 days
+cargo xtask ci-cost-monitor --days 7
 ```
 
 ### Reading GitHub Billing Reports
diff --git a/docs/project/CI_TEST_LANES.md b/docs/project/CI_TEST_LANES.md
index 0991225651..b418248dff 100644
--- a/docs/project/CI_TEST_LANES.md
+++ b/docs/project/CI_TEST_LANES.md
@@ -37,7 +37,7 @@ nix develop -c just ci-gate
 1. `cargo fmt --check --all` - Format check
 2. `cargo clippy --workspace --lib --locked -- -D warnings -A missing_docs` - Lint
 3. `cargo test --workspace --lib --locked` - Library tests
-4. `.ci/scripts/check-from-raw.sh` - Policy checks
+4. `cargo xtask check-from-raw` - Policy checks
 5. LSP semantic definition tests
 
 ### What `just ci-full` Adds
diff --git a/docs/project/PUBLISHING_ROADMAP.md b/docs/project/PUBLISHING_ROADMAP.md
index b0121b7d5f..24c89badb5 100644
--- a/docs/project/PUBLISHING_ROADMAP.md
+++ b/docs/project/PUBLISHING_ROADMAP.md
@@ -33,7 +33,7 @@ grep '^version' features.toml | head -1
 # Expected: version = "NEW_VERSION"
 
 # Automated check (must print nothing)
-bash scripts/check-version-sync.sh
+cargo xtask check-version-sync
 ```
 
 Fail if any string mismatches. Fix with:
@@ -636,7 +636,7 @@ gh workflow run release-orchestration.yml \
 | `CHANGELOG.md` | Promote `[Unreleased]` to `[NEW_VERSION] - DATE` | Manual edit |
 | `docs/project/status/index.md` | Release posture narrative | Manual edit after ship |
 
-The `scripts/check-version-sync.sh` script validates all of the above except `CHANGELOG.md`.
+`cargo xtask check-version-sync` validates all of the above except `CHANGELOG.md`.
 
 ---
 
diff --git a/docs/project/RELEASE_CHECKLIST.md b/docs/project/RELEASE_CHECKLIST.md
index dd68a8daba..e56ba1bbe8 100644
--- a/docs/project/RELEASE_CHECKLIST.md
+++ b/docs/project/RELEASE_CHECKLIST.md
@@ -47,7 +47,7 @@ All merge-blocking gates must pass:
 
 - [ ] All version strings agree across `Cargo.toml` (workspace), `features.toml`,
       `package.json` (VSCode extension), and any `build.rs` references
-- [ ] Verified by `scripts/check-version-sync.sh`
+- [ ] Verified by `just version-check`
 
 ### 4. SemVer Check **[automated]**
 
diff --git a/docs/project/XTASK_MIGRATION.md b/docs/project/XTASK_MIGRATION.md
index c5c7e23a51..b4a7f44c39 100644
--- a/docs/project/XTASK_MIGRATION.md
+++ b/docs/project/XTASK_MIGRATION.md
@@ -15,22 +15,59 @@ xtask subcommands (`cargo xtask <subcommand>`).
 
 | Subcommand | Module | Lines | Purpose |
 |------------|--------|------:|---------|
+| `ci-audit-workflows` | `ci_audit_workflows.rs` | 150 | Audit PR workflows for ungated non-trivial jobs |
+| `ci-baseline` | `ci_metrics.rs` | -- | Measure CI baseline from recent workflow runs |
+| `ci-cost-monitor` | `ci_metrics.rs` | -- | Analyze GitHub Actions spend over a period |
 | `ci` | `ci.rs` | 117 | Lean CI suite (format + clippy + tests) |
 | `check-only` | `ci.rs` | -- | Format and clippy checks only |
+| `ci-measure` | `ci_measure.rs` | -- | Measure CI lane runtimes and emit timing artifacts |
+| `targeted-checks` | `targeted_checks.rs` | 319 | Target changed crates and run fast checks |
 | `build` | `build.rs` | 69 | Build with configurable features/mode |
 | `test` | `test.rs` | 148 | Run tests with suite/coverage options |
 | `bench` | `bench.rs` | 355 | Run benchmarks |
+| `bench-alert` | `benchmarks.rs` | -- | Run benchmark alert checks |
+| `bench-alert-test` | `benchmarks.rs` | -- | Run benchmark alert regression test suite |
+| `bench-extract` | `benchmarks.rs` | -- | Extract and normalize criterion outputs |
+| `inject-sha-assets` | `inject_sha_assets.rs` | 206 | Generate Homebrew formula and VS Code asset map |
+| `update-homebrew` | `update_homebrew.rs` | 282 | Generate Homebrew formula from release SHA256SUMS |
+| `bench-compare` | `benchmarks.rs` | -- | Compare benchmark artifacts against baseline |
+| `bench-format` | `benchmarks.rs` | -- | Format benchmark JSON output |
+| `bench-run` | `benchmarks.rs` | -- | Wrapper for benchmark runner script |
 | `compare` | `compare.rs` | 1174 | C vs Rust benchmark comparison |
+| `build-timing-receipt` | `build_timing.rs` | -- | Collect build timing receipts and measurement baselines |
+| `compare-build-timing` | `build_timing.rs` | -- | Compare build timing receipts with markdown report |
 | `doc` | `doc.rs` | 35 | Generate documentation |
 | `check` | `check.rs` | 58 | Code quality checks (clippy, fmt) |
 | `fmt` | `fmt.rs` | 43 | Format code |
 | `clean` | `clean.rs` | 47 | Clean build artifacts |
 | `dev` | `dev.rs` | 178 | Development server with watch |
 | `parse-rust` | `parse_rust.rs` | 54 | Run pure Rust parser on a file |
+| `parser-matrix` | `parser_matrix.rs` | 338 | Generate `docs/reference/PARSER_FEATURE_MATRIX.md` from parser audit report |
+| `validate-workspace-exclusions` | `validate_workspace_exclusions.rs` | -- | Validate workspace exclusion strategy and dependency invariants |
 | `release` | `release.rs` | 223 | Prepare a release |
+| `security-hardening` | `hardening.rs` | -- | Production security hardening checks |
+| `release-turnkey` | `release_turnkey.rs` | -- | PR-driven release orchestration |
+| `performance-hardening` | `hardening.rs` | -- | Production performance hardening checks |
 | `bump-version` | `bump_version.rs` | 184 | Bump version numbers across project |
 | `publish-crates` | `publish.rs` | 203 | Publish crates to crates.io |
+| `forbid-fatal-constructs` | `forbid_fatal_constructs.rs` | -- | Run forbidden fatal construct checks via perl-ci-hygiene |
+| `forensics-dossier` | `forensics.rs` | -- | Generate complete PR dossier artifacts |
+| `forensics-harvest` | `forensics.rs` | -- | Harvest PR forensics metadata |
+| `forensics-render` | `forensics.rs` | -- | Render PR dossiers from existing YAML |
+| `forensics-telemetry-full` | `forensics.rs` | -- | Run full PR telemetry pipeline |
+| `forensics-telemetry-quick` | `forensics.rs` | -- | Run quick PR telemetry pipeline |
+| `forensics-temporal` | `forensics.rs` | -- | Analyze PR temporal topology |
+| `gh-backfill-prefixed-labels` | `github.rs` | -- | Backfill legacy issue labels into prefixed taxonomy |
+| `gh-labels` | `github.rs` | -- | Ensure GitHub label taxonomy is present |
+| `gh-triage` | `github.rs` | -- | Show issues missing required label taxonomy |
+| `ci-hygiene` | `ci_hygiene.rs` | -- | Pass-through to `perl-ci-hygiene` subcommands |
+| `worktree-cleanup` | `worktrees.rs` | 71 | Remove stale `.claude/worktrees` entries |
 | `publish-vscode` | `publish.rs` | -- | Publish VSCode extension |
+| `populate-book` | `populate_book.rs` | -- | Populate mdBook source directory from docs |
+| `e2e-validate` | `e2e_validate.rs` | -- | Run end-to-end validation suite |
+| `verify-publication-facts` | `publication_facts.rs` | -- | Verify PUBLICATION_FACTS_LEDGER metrics |
+| `publish-receipts` | `publish_receipts.rs` | -- | Publish phase-0 receipt bundle for review |
+| `prep-crates-io-launch` | `prep_crates_io_launch.rs` | -- | Launch preflight checks (`core` / `all`) |
 | `test-heredoc` | (delegates to `test.rs`) | -- | Heredoc-specific tests |
 | `test-edge-cases` | `edge_cases.rs` | 110 | Edge case test suite |
 | `corpus-audit` | `corpus_audit.rs` | 325 | Corpus coverage analysis |
@@ -43,6 +80,7 @@ xtask subcommands (`cargo xtask <subcommand>`).
 | `srp-microcrates` | `srp_microcrates.rs` | 194 | SRP microcrate inventory |
 | `validate-memory-profiler` | `compare.rs` | -- | Memory profiling validation |
 | `gates` | `gates.rs` | 1370 | CI gates with receipt generation |
+| `production-gates-validation` | `hardening.rs` | -- | Validate production gates and SLO posture |
 | `corpus` | `corpus.rs` | 625 | Corpus tests (legacy feature) |
 | `highlight` | `highlight.rs` | 272 | Highlight tests (parser-tasks feature) |
 | `bindings` | `bindings.rs` | 49 | Generate bindings (parser-tasks feature) |
@@ -53,61 +91,63 @@ xtask subcommands (`cargo xtask <subcommand>`).
 
 | Script | Lines | Xtask Equivalent | Status | Priority | Notes |
 |--------|------:|-------------------|--------|----------|-------|
-| `dead-code-check.sh` | 457 | -- | **Not Started** | High | Called from `just dead-code*`; complex logic with baseline comparison |
+| `dead-code-check.sh` | 457 | `cargo xtask dead-code` | **Replaced** | Low | Compatibility shim for `cargo xtask dead-code` |
 | `execute-gate.sh` | 112 | `cargo xtask gates` | **Replaced** | -- | Xtask `gates` subsumes single-gate execution with receipts |
 | `run-gates.sh` | 165 | `cargo xtask gates` | **Replaced** | -- | Xtask `gates` covers full gate runs |
 | `gate-local.sh` | 135 | `cargo xtask gates` / `cargo xtask ci` | **Replaced** | -- | WSL-safe local gate; xtask handles parallelism natively |
 | `generate-receipt.sh` | 133 | `cargo xtask gates --receipt` | **Replaced** | -- | Receipt generation built into xtask gates |
 | `generate-receipts.sh` | 121 | `cargo xtask gates --receipt` | **Replaced** | -- | Batch receipt generation |
 | `list-gates.py` | 21 | `cargo xtask gates --list` | **Replaced** | -- | Gate listing |
-| `forbid-fatal-constructs.sh` | 12 | -- | **Not Started** | High | Policy gate; called from justfile; small but CI-critical |
-| `check-version-sync.sh` | 12 | `cargo xtask bump-version` (partial) | **Partial** | Medium | Version sync check could be a `--check` flag on bump-version |
-| `update-current-status.py` | 454 | -- | **Not Started** | High | Core truth-surface script; called from justfile `status-*` recipes |
-| `debt-report.py` | 436 | -- | **Not Started** | High | Debt ledger reporter; called from `just debt-*` recipes |
-| `debt-pr-summary.py` | 36 | -- | **Not Started** | Low | Small PR summary formatter; pipes from debt-report |
-| `check_features_invariants.py` | 104 | `cargo xtask features verify` (partial) | **Partial** | Medium | Features invariant checking partially covered by xtask features |
-| `ci-audit-workflows.py` | 123 | -- | **Not Started** | Medium | CI spend audit; called from justfile |
-| `update-parser-matrix.py` | 255 | -- | **Not Started** | Low | Generates parser feature matrix from corpus audit report |
-| `release-turnkey-pr.sh` | 431 | `cargo xtask release` (partial) | **Partial** | High | Full release orchestration; xtask release handles prep but not GH workflow triggering |
-| `prepare-release.sh` | 61 | `cargo xtask release` | **Replaced** | -- | Basic release prep covered by xtask |
-| `publish-release.sh` | 94 | `cargo xtask publish-crates` | **Replaced** | -- | Crate publishing |
-| `publish-receipts.sh` | 68 | -- | **Not Started** | Low | Post-publish receipt archival |
+| `forbid-fatal-constructs.sh` | 12 | `cargo xtask forbid-fatal-constructs` | **Replaced** | High | Policy gate; canonical xtask command handles this |
+| `check-version-sync.sh` | 12 | `cargo xtask check-version-sync` | **Replaced** | Medium | Thin wrapper delegating to `cargo xtask` |
+| `update-current-status.py` | 454 | `cargo xtask update-status` | **Replaced** | High | Compatibility shim for `cargo xtask update-status` |
+| `debt-report.py` | 436 | `cargo xtask debt-report` | **Replaced** | High | Compatibility shim for `cargo xtask debt-report` |
+| `debt-pr-summary.py` | 36 | `cargo xtask debt-report --summary` | **Replaced** | Low | Small PR summary formatter; now delegated to `debt-report --summary` |
+| `check-doc-claims.py` | 123 | `cargo xtask doc-claims` | **Replaced** | Medium | Compatibility shim for `cargo xtask doc-claims` |
+| `check_features_invariants.py` | 104 | `cargo xtask features invariants` | **Replaced** | Medium | Feature catalog invariants now checked by `cargo xtask features invariants` |
+| `ci-audit-workflows.py` | 123 | `cargo xtask ci-audit-workflows` | **Replaced** | Medium | CI spend audit; now delegated to `ci-audit-workflows` task |
+| `update-parser-matrix.py` | 255 | `cargo xtask parser-matrix` | **Replaced** | Low | Compatibility shim for `cargo xtask parser-matrix` |
+| `release-turnkey-pr.sh` | 431 | `cargo xtask release-turnkey` | **Replaced** | High | Orchestration entrypoint now delegated through `xtask release-turnkey` |
+| `prepare-release.sh` | 61 | `cargo xtask release-turnkey` | **Replaced** | -- | Thin wrapper around `release-turnkey` flow |
+| `publish-release.sh` | 94 | `cargo xtask publish-release` | **Replaced** | -- | Crate publishing dispatch wrapper |
+| `publish-receipts.sh` | 68 | `cargo xtask publish-receipts` | **Replaced** | Low | Archives gate + receipt artifacts with provenance metadata |
 | `install.sh` | 236 | -- | **Keep** | -- | Curl-pipe installer; must remain shell for `curl \| bash` UX |
-| `install-githooks.sh` | 13 | -- | **Keep** | -- | Simple git hook installer; shell is the right tool |
+| `install-githooks.sh` | 13 | `cargo xtask ci-hygiene install-githooks` | **Replaced** | Low | Trivial pass-through wrapper |
 | `lsp-smoke.sh` | 107 | `cargo xtask test-lsp` (partial) | **Partial** | Medium | LSP smoke test over JSON-RPC; xtask test-lsp covers demo scripts |
-| `smoke-test-release.sh` | 74 | -- | **Not Started** | Medium | Post-release binary smoke test |
-| `ci-cost-monitor.sh` | 409 | -- | **Not Started** | Low | GitHub Actions cost analysis; uses `gh api` heavily |
+| `smoke-test-release.sh` | 74 | `cargo xtask smoke-test-release` | **Replaced** | Medium | Post-release binary smoke test |
+| `ci-cost-monitor.sh` | 409 | `cargo xtask ci-cost-monitor` | **Replaced** | Low | CI cost analysis and budget reporting now handled by `cargo xtask ci-cost-monitor` |
+| `cleanup-completed-worktrees.sh` | 98 | -- | **Keep** | -- | Mid-cycle cleanup with manual control |
 | `close-duplicate-prs.sh` | 63 | -- | **Keep** | -- | One-off GitHub housekeeping |
-| `inject-sha-assets.sh` | 140 | -- | **Not Started** | Low | Release asset SHA injection |
-| `update-homebrew.sh` | 132 | -- | **Not Started** | Low | Homebrew formula update; release-only |
-| `populate-book.sh` | 135 | -- | **Not Started** | Low | mdBook content assembly |
+| `cleanup-worktrees.sh` | 8 | `cargo xtask worktree-cleanup` | **Replaced** | Low | Worktree cleanup wrapper |
+| `inject-sha-assets.sh` | 140 | `cargo xtask inject-sha-assets` | **Replaced** | Low | Release asset SHA injection |
+| `update-homebrew.sh` | 132 | `cargo xtask update-homebrew` | **Replaced** | Low | Homebrew formula update; release-only |
+| `populate-book.sh` | 143 | `cargo xtask populate-book` | **Replaced** | Low | mdBook content assembly |
 | `render-docs.sh` | 130 | `cargo xtask doc` (partial) | **Partial** | Low | Full doc rendering pipeline; xtask doc handles cargo doc only |
-| `build-timing-receipt.sh` | 197 | -- | **Not Started** | Low | Build timing data collection |
-| `compare-build-timing.sh` | 214 | -- | **Not Started** | Low | Build timing comparison |
-| `validate-workspace-exclusions.sh` | 97 | -- | **Not Started** | Low | Workspace exclusion validation |
+| `build-timing-receipt.sh` | 197 | `cargo xtask build-timing-receipt` | **Replaced** | Low | Compatibility shim for build timing receipt generation |
+| `compare-build-timing.sh` | 214 | `cargo xtask compare-build-timing` | **Replaced** | Low | Compatibility shim for build timing comparison |
+| `validate-workspace-exclusions.sh` | 97 | `cargo xtask validate-workspace-exclusions` | **Replaced** | Low | Compatibility shim for `cargo xtask validate-workspace-exclusions` |
 | `validate_features.sh` | 71 | `cargo xtask features verify` | **Replaced** | -- | Feature validation |
-| `validate_tests.sh` | 234 | -- | **Not Started** | Low | Test infrastructure validation |
 | `validate-phase1.sh` | 85 | -- | **Keep** | -- | One-time phase validation; historical |
 | `validate_issue_146.sh` | 201 | -- | **Keep** | -- | One-time issue validation; historical |
-| `verify-test-infrastructure.sh` | 141 | -- | **Not Started** | Low | Test infra checks |
-| `verify_stacker.sh` | 11 | -- | **Keep** | -- | Trivial one-liner |
-| `devex-doctor.sh` | 109 | -- | **Not Started** | Medium | Developer environment diagnostics |
-| `devex-targeted-checks.sh` | 124 | -- | **Not Started** | Medium | Targeted devex checks |
-| `test-semver-integration.sh` | 107 | -- | **Not Started** | Low | SemVer integration tests |
-| `test-lsp-cancellation.sh` | 12 | -- | **Not Started** | Low | LSP cancellation test |
+| `verify_stacker.sh` | 11 | `cargo xtask ci-hygiene verify-stacker` | **Replaced** | Low | Trivial one-liner |
+| `devex-doctor.sh` | 109 | `cargo xtask devex-doctor` | **Replaced** | Medium | Developer environment diagnostics |
+| `swarm-summary.sh` | 25 | `cargo xtask swarm-summary` | **Replaced** | Low | Swarm metrics summary |
+| `verify-publication-facts.sh` | 262 | `cargo xtask verify-publication-facts` | **Replaced** | Medium | Publication claims and ledger drift checks |
+| `devex-targeted-checks.sh` | 124 | `cargo xtask targeted-checks` | **Replaced** | Medium | Targeted devex checks |
+| `test-lsp-cancellation.sh` | 12 | `cargo xtask ci-hygiene test-lsp-cancellation` | **Replaced** | Low | LSP cancellation test |
 | `cargo-package-workspace-dry-run.sh` | 47 | `cargo xtask publish-crates --dry-run` | **Replaced** | -- | Dry-run packaging |
-| `prep-crates-io-launch.sh` | 79 | -- | **Not Started** | Low | Pre-publish checklist |
+| `prep-crates-io-launch.sh` | 79 | `cargo xtask prep-crates-io-launch` | **Replaced** | Low | Pre-publish checklist (`core` and `all` modes) |
 | `llvm.sh` | 233 | -- | **Keep** | -- | LLVM toolchain setup; platform-specific by nature |
-| `security-hardening.sh` | 292 | -- | **Not Started** | Low | Production hardening; Phase 6 one-time |
-| `performance-hardening.sh` | 334 | -- | **Not Started** | Low | Production hardening; Phase 6 one-time |
-| `e2e-validation.sh` | 463 | -- | **Not Started** | Low | E2E validation; Phase 6 one-time |
-| `e2e-gate.sh` | 11 | -- | **Keep** | -- | Trivial wrapper |
-| `production-gates-validation.sh` | 333 | -- | **Not Started** | Low | Production gates; Phase 6 one-time |
-| `preflight.sh` | 11 | -- | **Keep** | -- | Trivial wrapper |
-| `test-capped.sh` | 11 | -- | **Keep** | -- | Trivial test wrapper |
-| `test-e2e-capped.sh` | 11 | -- | **Keep** | -- | Trivial test wrapper |
-| `quick-receipts.sh` | 12 | -- | **Keep** | -- | Trivial wrapper |
-| `ignored-test-count.sh` | 12 | -- | **Keep** | -- | Simple grep-based counter |
+| `security-hardening.sh` | 292 | `cargo xtask security-hardening` | **Replaced** | Low | Production hardening; Phase 6 one-time |
+| `performance-hardening.sh` | 334 | `cargo xtask performance-hardening` | **Replaced** | Low | Production hardening; Phase 6 one-time |
+| `e2e-validation.sh` | 463 | `cargo xtask e2e-validate` | **Replaced** | Low | Production hardening E2E validation |
+| `e2e-gate.sh` | 11 | `cargo xtask ci-hygiene e2e-gate` | **Replaced** | Low | Trivial wrapper |
+| `production-gates-validation.sh` | 333 | `cargo xtask production-gates-validation` | **Replaced** | Low | Production gates; Phase 6 one-time |
+| `preflight.sh` | 11 | `cargo xtask ci-hygiene preflight` | **Replaced** | Low | Trivial wrapper |
+| `test-capped.sh` | 11 | `cargo xtask ci-hygiene test-capped` | **Replaced** | Low | Trivial test wrapper |
+| `test-e2e-capped.sh` | 11 | `cargo xtask ci-hygiene test-e2e-capped` | **Replaced** | Low | Trivial test wrapper |
+| `quick-receipts.sh` | 12 | `cargo xtask ci-hygiene quick-receipts` | **Replaced** | Low | Trivial wrapper |
+| `ignored-test-count.sh` | 12 | `cargo xtask ci-hygiene ignored-test-count` | **Replaced** | Medium | Simple grep-based counter |
 
 ### scripts/ -- Benchmark Scripts (top-level)
 
@@ -122,7 +162,7 @@ xtask subcommands (`cargo xtask <subcommand>`).
 | `run_comparison_benchmarks.sh` | 305 | `cargo xtask compare` | **Replaced** | -- | Comparison benchmarks |
 | `run_comparison.sh` | 45 | `cargo xtask compare` | **Replaced** | -- | Comparison runner |
 | `run_comprehensive_benchmark.py` | 220 | `cargo xtask bench` | **Replaced** | -- | Comprehensive benchmarks |
-| `run_parser_comparison.sh` | 11 | `cargo xtask compare` | **Replaced** | -- | Parser comparison |
+| `run_parser_comparison.sh` | 11 | `cargo xtask ci-hygiene run-parser-comparison` | **Replaced** | -- | Parser comparison |
 | `setup_benchmark.sh` | 244 | `cargo xtask bench` (partial) | **Partial** | Low | Benchmark environment setup |
 | `simple_bench.sh` | 49 | `cargo xtask bench` | **Replaced** | -- | Simple benchmark |
 | `quick_bench.sh` | 69 | `cargo xtask bench` | **Replaced** | -- | Quick benchmark |
@@ -132,61 +172,61 @@ xtask subcommands (`cargo xtask <subcommand>`).
 | `test_comparison.py` | 385 | `cargo xtask compare` | **Replaced** | -- | Comparison tests |
 | `quick_test.py` | 57 | -- | **Keep** | -- | Quick ad-hoc test helper |
 | `test_edge_cases.sh` | 12 | `cargo xtask test-edge-cases` | **Replaced** | -- | Edge case tests |
-| `test_iterative_parser.sh` | 11 | -- | **Keep** | -- | Trivial test runner |
+| `test_iterative_parser.sh` | 11 | `cargo xtask ci-hygiene test-iterative-parser` | **Replaced** | Low | Trivial test runner |
 | `profile_stack_overflow.sh` | 51 | -- | **Keep** | -- | Debugging aid |
 | `apply-workspace-simplification.sh` | 86 | -- | **Keep** | -- | One-time refactoring script |
 | `deduplicate-crates.sh` | 93 | -- | **Keep** | -- | One-time deduplication |
-| `generate-badges.sh` | 11 | -- | **Keep** | -- | Trivial badge generation |
+| `generate-badges.sh` | 11 | `cargo xtask ci-hygiene generate-badges` | **Replaced** | Low | Trivial badge generation |
 
 ### scripts/gh/
 
 | Script | Lines | Xtask Equivalent | Status | Priority | Notes |
 |--------|------:|-------------------|--------|----------|-------|
-| `ensure-labels.sh` | 63 | -- | **Keep** | -- | GitHub label management; `gh` CLI is the right tool |
-| `issues-needing-triage.sh` | 26 | -- | **Keep** | -- | GitHub triage query |
-| `backfill-prefixed-labels.sh` | 68 | -- | **Keep** | -- | One-time label backfill |
+| `ensure-labels.sh` | 63 | `cargo xtask gh-labels` | **Replaced** | -- | GitHub label management; `gh` CLI is the right tool |
+| `issues-needing-triage.sh` | 26 | `cargo xtask gh-triage` | **Replaced** | -- | GitHub triage query |
+| `backfill-prefixed-labels.sh` | 68 | `cargo xtask gh-backfill-prefixed-labels` | **Replaced** | -- | One-time label backfill |
 
 ### scripts/forensics/
 
 | Script | Lines | Xtask Equivalent | Status | Priority | Notes |
 |--------|------:|-------------------|--------|----------|-------|
-| `pr-harvest.sh` | 408 | -- | **Not Started** | Low | PR data harvesting |
-| `temporal-analysis.sh` | 694 | -- | **Not Started** | Low | Temporal analysis |
-| `telemetry-runner.sh` | 1376 | -- | **Not Started** | Medium | Telemetry collection; largest script |
-| `dossier-runner.sh` | 285 | -- | **Not Started** | Low | Dossier generation |
-| `render-dossier.sh` | 590 | -- | **Not Started** | Low | Dossier rendering |
+| `pr-harvest.sh` | 408 | `cargo xtask forensics-harvest` | **Replaced** | Low | PR data harvesting |
+| `temporal-analysis.sh` | 694 | `cargo xtask forensics-temporal` | **Replaced** | Low | Temporal analysis |
+| `telemetry-runner.sh` | 1376 | `cargo xtask forensics-telemetry-full` / `cargo xtask forensics-telemetry-quick` | **Replaced** | Medium | Telemetry collection; largest script |
+| `dossier-runner.sh` | 285 | `cargo xtask forensics-dossier` | **Replaced** | Low | Dossier generation |
+| `render-dossier.sh` | 590 | `cargo xtask forensics-render` | **Replaced** | Low | Dossier rendering |
 | `lib_gh.sh` | 178 | -- | **Not Started** | Low | Shared GitHub API helpers |
 
 ### .ci/scripts/
 
 | Script | Lines | Xtask Equivalent | Status | Priority | Notes |
 |--------|------:|-------------------|--------|----------|-------|
-| `measure-ci-time.sh` | 114 | `cargo xtask gates --receipt` (partial) | **Partial** | Low | CI timing measurement |
-| `measure-ci-baseline.sh` | 409 | -- | **Not Started** | Low | Baseline CI timing |
-| `check-from-raw.sh` | 27 | -- | **Keep** | -- | Small CI helper |
+| `measure-ci-time.sh` | 114 | `cargo xtask ci-measure` | **Replaced** | Low | CI timing measurement |
+| `measure-ci-baseline.sh` | 409 | `cargo xtask ci-baseline` | **Replaced** | Low | Baseline CI timing now handled by `cargo xtask ci-baseline` |
+| `check-from-raw.sh` | 27 | `cargo xtask check-from-raw` | **Replaced** | -- | Small CI helper |
 
 ### benchmarks/scripts/
 
 | Script | Lines | Xtask Equivalent | Status | Priority | Notes |
 |--------|------:|-------------------|--------|----------|-------|
-| `run-benchmarks.sh` | 194 | `cargo xtask bench` | **Replaced** | -- | Benchmark runner |
-| `format-results.py` | 246 | -- | **Not Started** | Medium | Benchmark result formatting |
+| `run-benchmarks.sh` | 194 | `cargo xtask bench-run` | **Replaced** | -- | Benchmark runner |
+| `format-results.py` | 246 | `cargo xtask bench-format` | **Replaced** | Medium | Benchmark result formatting |
 | `compare.sh` | 13 | `cargo xtask compare` | **Replaced** | -- | Comparison wrapper |
 | `compare.py` | 276 | `cargo xtask compare --report` | **Replaced** | -- | Comparison analysis |
-| `alert.py` | 479 | -- | **Not Started** | Medium | Performance regression alerts |
-| `extract-criterion.py` | 195 | -- | **Not Started** | Low | Criterion output parser |
-| `test_alert_system.sh` | 233 | -- | **Not Started** | Low | Alert system tests |
+| `alert.py` | 479 | `cargo xtask bench-alert` | **Replaced** | Medium | Performance regression alerts |
+| `extract-criterion.py` | 195 | `cargo xtask bench-extract` | **Replaced** | Low | Criterion output parser |
+| `test_alert_system.sh` | 233 | `cargo xtask bench-alert-test` | **Replaced** | Low | Alert system tests |
 | `test_regression.py` | 31 | -- | **Keep** | -- | Small regression test |
 
 ## Summary
 
 | Category | Count | Total Lines |
 |----------|------:|------------:|
-| **Replaced** by xtask | 29 | ~3,800 |
-| **Partially** replaced | 8 | ~1,600 |
-| **Not Started** | 31 | ~9,500 |
-| **Keep** as shell | 24 | ~1,400 |
-| **Total scripts** | 92 | ~16,300 |
+| **Replaced** by xtask | 83 | ~14,150 |
+| **Partially** replaced | 4 | ~689 |
+| **Not Started** | 2 | ~1,128 |
+| **Keep** as shell | 12 | ~1,367 |
+| **Total scripts** | 101 | ~16,334 |
 
 ## Migration Criteria
 
@@ -209,38 +249,11 @@ xtask subcommands (`cargo xtask <subcommand>`).
 
 ## Recommended Migration Order
 
-### Wave 1 -- CI-Critical (High Priority)
+### Wave 1 -- Remaining Low-Priority Migrations
 
-These scripts are in the CI gate path and would benefit most from Rust error handling and cross-platform support.
+These scripts are the remaining not-started items.
 
-1. **`dead-code-check.sh`** (457 lines) -- Complex baseline comparison logic, called from 5 justfile recipes
-2. **`forbid-fatal-constructs.sh`** (12 lines) -- Small but CI-critical policy gate
-3. **`update-current-status.py`** (454 lines) -- Core truth-surface generator, called from justfile
-4. **`debt-report.py`** (436 lines) -- Debt ledger reporter, called from 5 justfile recipes
-
-### Wave 2 -- Release Flow (High Priority)
-
-5. **`release-turnkey-pr.sh`** (431 lines) -- Full release orchestration with GH workflow triggering
-6. **`smoke-test-release.sh`** (74 lines) -- Post-release verification
-
-### Wave 3 -- Developer Experience (Medium Priority)
-
-7. **`devex-doctor.sh`** (109 lines) -- Environment diagnostics
-8. **`devex-targeted-checks.sh`** (124 lines) -- Targeted checks
-9. **`lsp-smoke.sh`** (107 lines) -- LSP smoke testing
-10. **`ci-audit-workflows.py`** (123 lines) -- CI spend audit
-
-### Wave 4 -- Benchmarks and Reporting (Medium Priority)
-
-11. **`benchmarks/scripts/format-results.py`** (246 lines) -- Benchmark formatting
-12. **`benchmarks/scripts/alert.py`** (479 lines) -- Regression alerting
-13. **`check_features_invariants.py`** (104 lines) -- Feature invariant checks (extend `cargo xtask features verify`)
-
-### Wave 5 -- Forensics and Telemetry (Low Priority)
-
-14. **`scripts/forensics/telemetry-runner.sh`** (1376 lines) -- Largest script, telemetry collection
-15. **`scripts/forensics/temporal-analysis.sh`** (694 lines)
-16. **`scripts/forensics/render-dossier.sh`** (590 lines)
+1. **`lib_gh.sh`** (178 lines) -- Shared GitHub API helper library
 
 ## Cleanup Candidates
 
@@ -254,27 +267,68 @@ The following scripts are already fully replaced by xtask subcommands and can be
 | `generate-receipt.sh` | `cargo xtask gates --receipt` |
 | `generate-receipts.sh` | `cargo xtask gates --receipt` |
 | `list-gates.py` | `cargo xtask gates --list` |
-| `prepare-release.sh` | `cargo xtask release` |
-| `publish-release.sh` | `cargo xtask publish-crates` |
+| `prepare-release.sh` | `cargo xtask release-turnkey` |
+| `forbid-fatal-constructs.sh` | `cargo xtask forbid-fatal-constructs` |
+| `build-timing-receipt.sh` | `cargo xtask build-timing-receipt` |
+| `compare-build-timing.sh` | `cargo xtask compare-build-timing` |
+| `inject-sha-assets.sh` | `cargo xtask inject-sha-assets` |
+| `devex-targeted-checks.sh` | `cargo xtask targeted-checks` |
+| `publish-release.sh` | `cargo xtask publish-release` |
+| `publish-receipts.sh` | `cargo xtask publish-receipts` |
 | `cargo-package-workspace-dry-run.sh` | `cargo xtask publish-crates --dry-run` |
+| `generate-badges.sh` | `cargo xtask ci-hygiene generate-badges` |
+| `install-githooks.sh` | `cargo xtask ci-hygiene install-githooks` |
+| `populate-book.sh` | `cargo xtask populate-book` |
+| `verify-publication-facts.sh` | `cargo xtask verify-publication-facts` |
+| `ensure-labels.sh` | `cargo xtask gh-labels` |
+| `issues-needing-triage.sh` | `cargo xtask gh-triage` |
+| `backfill-prefixed-labels.sh` | `cargo xtask gh-backfill-prefixed-labels` |
+| `prep-crates-io-launch.sh` | `cargo xtask prep-crates-io-launch` |
+| `update-parser-matrix.py` | `cargo xtask parser-matrix` |
+| `validate-workspace-exclusions.sh` | `cargo xtask validate-workspace-exclusions` |
 | `validate_features.sh` | `cargo xtask features verify` |
+| `ignored-test-count.sh` | `cargo xtask ci-hygiene ignored-test-count` |
+| `preflight.sh` | `cargo xtask ci-hygiene preflight` |
+| `e2e-gate.sh` | `cargo xtask ci-hygiene e2e-gate` |
+| `test-capped.sh` | `cargo xtask ci-hygiene test-capped` |
+| `quick-receipts.sh` | `cargo xtask ci-hygiene quick-receipts` |
+| `verify_stacker.sh` | `cargo xtask ci-hygiene verify-stacker` |
+| `test-e2e-capped.sh` | `cargo xtask ci-hygiene test-e2e-capped` |
+| `test-lsp-cancellation.sh` | `cargo xtask ci-hygiene test-lsp-cancellation` |
+| `test_iterative_parser.sh` | `cargo xtask ci-hygiene test-iterative-parser` |
+| `run_parser_comparison.sh` | `cargo xtask ci-hygiene run-parser-comparison` |
+| `cleanup-worktrees.sh` | `cargo xtask worktree-cleanup` |
 | `benchmark_all.sh` | `cargo xtask bench` |
 | `benchmark_pure_rust_vs_c.sh` | `cargo xtask compare` |
 | `benchmark_rust_vs_c_simple.sh` | `cargo xtask compare` |
+| `ci-cost-monitor.sh` | `cargo xtask ci-cost-monitor` |
+| `.ci/scripts/measure-ci-baseline.sh` | `cargo xtask ci-baseline` |
 | `compare_all_levels.sh` | `cargo xtask compare` |
 | `run_actual_benchmark.sh` | `cargo xtask bench` |
 | `run_comparison_benchmarks.sh` | `cargo xtask compare` |
 | `run_comparison.sh` | `cargo xtask compare` |
 | `run_comprehensive_benchmark.py` | `cargo xtask bench` |
-| `run_parser_comparison.sh` | `cargo xtask compare` |
 | `simple_bench.sh` | `cargo xtask bench` |
 | `quick_bench.sh` | `cargo xtask bench` |
 | `optimized_benchmark.py` | `cargo xtask bench` |
 | `generate_comparison.py` | `cargo xtask compare --report` |
 | `test_comparison.py` | `cargo xtask compare` |
 | `test_edge_cases.sh` | `cargo xtask test-edge-cases` |
-| `benchmarks/scripts/run-benchmarks.sh` | `cargo xtask bench` |
+| `benchmarks/scripts/run-benchmarks.sh` | `cargo xtask bench-run` |
 | `benchmarks/scripts/compare.sh` | `cargo xtask compare` |
 | `benchmarks/scripts/compare.py` | `cargo xtask compare --report` |
+| `benchmarks/scripts/format-results.py` | `cargo xtask bench-format` |
+| `benchmarks/scripts/alert.py` | `cargo xtask bench-alert` |
+| `benchmarks/scripts/extract-criterion.py` | `cargo xtask bench-extract` |
+| `benchmarks/scripts/test_alert_system.sh` | `cargo xtask bench-alert-test` |
+| `scripts/security-hardening.sh` | `cargo xtask security-hardening` |
+| `scripts/performance-hardening.sh` | `cargo xtask performance-hardening` |
+| `scripts/e2e-validation.sh` | `cargo xtask e2e-validate` |
+| `scripts/production-gates-validation.sh` | `cargo xtask production-gates-validation` |
+| `scripts/forensics/pr-harvest.sh` | `cargo xtask forensics-harvest` |
+| `scripts/forensics/temporal-analysis.sh` | `cargo xtask forensics-temporal` |
+| `scripts/forensics/telemetry-runner.sh` | `cargo xtask forensics-telemetry-full` / `cargo xtask forensics-telemetry-quick` |
+| `scripts/forensics/dossier-runner.sh` | `cargo xtask forensics-dossier` |
+| `scripts/forensics/render-dossier.sh` | `cargo xtask forensics-render` |
 
 **Before deleting**: Update the corresponding justfile recipes to call `cargo xtask` and verify that the xtask subcommand produces equivalent behavior (exit codes, output format, receipt schema).
diff --git a/justfile b/justfile
index 0fd88df3a9..451a4f1395 100644
--- a/justfile
+++ b/justfile
@@ -185,17 +185,32 @@ security-audit:
 # Production hardening security scan
 security-hardening:
     @echo "Running production hardening security scan..."
-    @./scripts/security-hardening.sh
+    @cargo xtask security-hardening
 
 # Production hardening performance scan
 performance-hardening:
     @echo "Running production hardening performance scan..."
-    @./scripts/performance-hardening.sh
+    @cargo xtask performance-hardening
 
 # Production hardening E2E validation
 e2e-validation:
     @echo "Running production hardening E2E validation..."
-    @./scripts/e2e-validation.sh
+    @cargo xtask e2e-validate
+
+# Generate Homebrew formula + VS Code asset map from release checksums
+inject-sha-assets version owner repo prefix checksums brew_out asset_map_out:
+    @cargo xtask inject-sha-assets \
+        --version "{{version}}" \
+        --owner "{{owner}}" \
+        --repo "{{repo}}" \
+        --prefix "{{prefix}}" \
+        --checksums "{{checksums}}" \
+        --brew-out "{{brew_out}}" \
+        --asset-map-out "{{asset_map_out}}"
+
+# Generate Homebrew formula from release SHA256SUMS
+update-homebrew version:
+    @cargo xtask update-homebrew --version "{{version}}"
 
 # Complete production hardening validation
 production-hardening: security-hardening performance-hardening e2e-validation
@@ -205,7 +220,7 @@ production-hardening: security-hardening performance-hardening e2e-validation
 # Production gates validation
 production-gates-validation:
     @echo "Running production gates validation..."
-    @./scripts/production-gates-validation.sh
+    @cargo xtask production-gates-validation
 
 # Complete Phase 6 production readiness validation
 phase6-production-readiness: production-hardening production-gates-validation
@@ -280,17 +295,8 @@ fuzz-bounded:
     @cargo +nightly fuzz run unicode_positions -- -max_total_time=60 || echo "  Unicode positions fuzzing complete"
     @echo "✅ Fuzz testing complete"
 
-# Benchmarks (requires criterion) - legacy target, prefer 'just bench'
-benchmarks:
-    @echo "Running benchmarks..."
-    @mkdir -p benchmarks/results
-    @if cargo bench --workspace --locked --no-run 2>/dev/null; then \
-        cargo bench --workspace --locked -- --noplot 2>&1 | tee benchmarks/results/raw-output.txt || echo "Benchmark run completed"; \
-        echo ""; \
-        echo "For structured results, run: just bench"; \
-    else \
-        echo "SKIP: No benchmarks configured or build failed"; \
-    fi
+# `bench` is the canonical benchmark target; keep this as a compatibility alias.
+benchmarks: bench
 
 # ============================================================================
 # CI Aliases and Convenience Targets
@@ -312,7 +318,7 @@ doctor:
     @echo "=============================================="
     @echo "  perl-lsp developer environment doctor"
     @echo "=============================================="
-    @bash scripts/devex-doctor.sh
+    @cargo xtask devex-doctor
 
 # Short alias for the developer environment quick check
 devex: doctor
@@ -335,7 +341,7 @@ _check-tools-basic:
         echo "  Install nextest: cargo install cargo-nextest --locked"; \
         exit 1; \
     fi
-    @bash scripts/check-rust-toolchain.sh
+    @cargo xtask check-toolchain
 
 # ============================================================================
 # CI Validation Commands (Issue #211)
@@ -348,14 +354,16 @@ _check-tools-basic:
 # Phase 0: publish receipts to review/receipts/YYYY-MM-DD/
 receipts date='':
     @d="{{date}}"; \
-    if [ -z "$$d" ]; then d="$$(date -u +%Y-%m-%d)"; fi; \
-    echo "Publishing receipts for $$d"; \
-    bash scripts/publish-receipts.sh "$$d"
+    if [ -z "$$d" ]; then \
+        cargo xtask publish-receipts; \
+    else \
+        cargo xtask publish-receipts "$$d"; \
+    fi
 
 # Issue #211: measure CI lane runtimes locally (baseline before cleanup)
 ci-measure:
     @echo "Measuring CI lane runtimes..."
-    @bash .ci/scripts/measure-ci-time.sh
+    @cargo xtask ci-measure
 
 # Fast merge gate on MSRV (~2-5 min) - proves 1.92 compatibility
 ci-gate-msrv:
@@ -414,7 +422,7 @@ ci-check-no-nested-lock:
 
 # Audit workflows for ungated expensive jobs
 ci-workflow-audit:
-    @python3 scripts/ci-audit-workflows.py
+    @cargo xtask ci-audit-workflows
 
 # Fast merge gate (~2-5 min) - REQUIRED for all merges
 # This is the canonical pre-push check (same as merge-gate with legacy checks)
@@ -463,7 +471,7 @@ gates-list:
 # Run old shell-based gate runner (deprecated, kept for compatibility)
 gates-legacy:
     @echo "🧾 Running legacy gate runner..."
-    @bash scripts/run-gates.sh
+    @cargo xtask gates --tier merge-gate --receipt
 
 # Full CI pipeline (~10-20 min) - RECOMMENDED for large changes
 ci-full:
@@ -524,19 +532,19 @@ ci-clippy-gate:
 # Unwrap/panic-family ratchet (production source only)
 ci-unwrap-panic-ratchet:
     @echo "🛡️  Checking unwrap/panic-family ratchet..."
-    @bash ci/check_unwraps_prod.sh
+    @cargo xtask ci-hygiene check-unwraps-prod
     @echo "✅ Unwrap/panic-family ratchet passed"
 
 # Unsafe syntax ratchet (production source only)
 ci-unsafe-ratchet:
     @echo "🛡️  Checking unsafe syntax ratchet..."
-    @bash ci/check_unsafe_prod.sh
+    @cargo xtask ci-hygiene check-unsafe-prod
     @echo "✅ Unsafe syntax ratchet passed"
 
 # Forbid fatal constructs gate - catches abort/exit/panic that Clippy misses
 ci-forbid-fatal:
     @echo "🚫 Checking for forbidden fatal constructs..."
-    @bash scripts/forbid-fatal-constructs.sh --verbose
+    @cargo xtask forbid-fatal-constructs -- --verbose
     @echo "✅ No forbidden fatal constructs"
 
 # Core tests (fast, essential)
@@ -554,7 +562,7 @@ ci-test-lib:
 # V2 bundle sync guard (in-crate v2 files must match extracted perl-parser-pest v2 files)
 ci-v2-bundle-sync:
     @echo "🔍 Checking v2 bundle sync..."
-    bash scripts/check-v2-bundle-sync.sh
+    cargo xtask ci-hygiene check-v2-bundle-sync
     @echo "✅ V2 bundle sync check passed"
 
 # V2 parser parity guard (in-crate v2 vs extracted perl-parser-pest v2)
@@ -725,55 +733,55 @@ clean:
 # Missing docs ratcheting check (Issue #197)
 ci-docs-check:
     @echo "📝 Checking missing docs baseline..."
-    @bash ci/check_missing_docs.sh
+    @cargo xtask ci-hygiene check-missing-docs
     @echo "✅ Missing docs check passed"
 
 # Policy and governance checks
 ci-policy:
     @echo "⚖️  Checking project policies..."
     just ci-check-todos
-    @bash ./.ci/scripts/check-from-raw.sh
+    @cargo xtask check-from-raw
     just ci-doc-claims
 
 # Check article inline claims against PUBLICATION_FACTS_LEDGER.md
 ci-doc-claims:
     @echo "📄 Checking article claims against publication ledger..."
-    @python3 scripts/check-doc-claims.py
+    @cargo xtask doc-claims
     @echo "✅ Doc claims check passed"
 
 # Check all registered hook scripts are executable
 hook-check:
-    @bash ./.ci/scripts/check-hook-executable.sh
+    @cargo xtask hook-check
 
 # Check hook registry in settings.json matches files on disk
 hook-registry-check:
-    @bash ./.ci/scripts/check-hook-registry.sh
+    @cargo xtask hook-registry-check
 
 # Run all hook tests (behavior, registry, executable-bit)
 hook-tests:
-    @bash ./.ci/scripts/test-hooks.sh
+    @cargo xtask hook-tests
 
 # Show swarm metrics summary
 swarm-summary:
-    @bash scripts/swarm-summary.sh
+    @cargo xtask swarm-summary
 
 # Check for machine-specific paths in documentation
 ci-doc-paths:
     @echo "🔍 Checking documentation paths..."
-    @bash ci/check_doc_paths.sh docs
+    @cargo xtask ci-hygiene check-doc-paths docs
     @echo "✅ Documentation paths check passed"
 
 # Verify publication facts against live codebase metrics (informational, non-blocking)
 # Flags WARNING if delta >5%, ERROR if delta >10%. Use --strict to exit 1 on ERROR.
 verify-publication-facts *args='':
     @echo "📊 Verifying publication facts..."
-    @bash scripts/verify-publication-facts.sh {{args}}
+    @cargo xtask verify-publication-facts {{args}}
     @echo "✅ Publication facts verification complete"
 
 # Strict publication facts check for CI (exits 1 on ERROR-level drift)
 ci-publication-facts:
     @echo "📊 Checking publication facts (strict mode)..."
-    @bash scripts/verify-publication-facts.sh --strict
+    @cargo xtask verify-publication-facts --strict
     @echo "✅ Publication facts check passed"
 
 # Update derived metrics in docs/project/status/ subsystem files and ROADMAP.md.
@@ -823,17 +831,17 @@ parser-audit:
 # Check parser features baseline (CI mode, fails on regression)
 ci-parser-features-check:
     @echo "🔍 Checking parser features baseline..."
-    @bash ci/check_parse_errors.sh
+    @cargo xtask ci-hygiene check-parse-errors
 
 # Check features.toml invariants (GA+advertised must have tests, no duplicates)
 ci-features-invariants:
     @echo "🔍 Checking features.toml invariants..."
-    @python3 scripts/check_features_invariants.py
+    @cargo xtask features invariants
 
 # Update parser feature matrix document from audit report
 parser-matrix-update:
     @echo "📝 Updating parser feature matrix..."
-    @python3 scripts/update-parser-matrix.py
+    @cargo xtask parser-matrix
 
 # ============================================================================
 # GitHub Repository Management
@@ -842,23 +850,23 @@ parser-matrix-update:
 # Ensure label taxonomy exists (idempotent, safe to rerun)
 gh-labels:
     @echo "🏷️  Ensuring label taxonomy..."
-    @bash scripts/gh/ensure-labels.sh
+    @cargo xtask gh-labels
     @echo "✅ Labels ready"
 
 # Show issues missing required taxonomy labels
 gh-triage:
     @echo "🔍 Issues needing taxonomy labels..."
-    @bash scripts/gh/issues-needing-triage.sh 500
+    @cargo xtask gh-triage
 
 # Backfill prefixed labels from legacy labels (dry run)
 gh-backfill-dry:
     @echo "🔄 Dry run: showing labels to backfill..."
-    @bash scripts/gh/backfill-prefixed-labels.sh
+    @cargo xtask gh-backfill-prefixed-labels
 
 # Backfill prefixed labels from legacy labels (apply)
 gh-backfill:
     @echo "🔄 Applying prefixed label backfill..."
-    @bash scripts/gh/backfill-prefixed-labels.sh --apply
+    @cargo xtask gh-backfill-prefixed-labels --apply
 
 # ============================================================================
 # Bug Tracking (BUG category ignored tests)
@@ -868,7 +876,7 @@ gh-backfill:
 bugs:
     @echo "🐛 Bug Queue Status"
     @echo "==================="
-    @VERBOSE=1 bash scripts/ignored-test-count.sh 2>&1 | sed -n '/=== bug/,/===/p' | head -30
+    @VERBOSE=1 cargo xtask ci-hygiene ignored-test-count 2>&1 | sed -n '/=== bug/,/===/p' | head -30
 
 # Wave A: COMPLETE - these were test brittleness issues, not parser bugs
 bugs-wave-a:
@@ -957,15 +965,15 @@ health-detail:
 
 # Show ignored test counts (categorised summary with baseline delta)
 ignored-tests:
-    cargo run -p xtask -- ignored-tests
+    cargo xtask ignored-tests
 
 # Show ignored test counts with per-test detail
 ignored-tests-verbose:
-    cargo run -p xtask -- ignored-tests --verbose
+    cargo xtask ignored-tests --verbose
 
 # Update ignored test baseline after intentional changes
 ignored-tests-update:
-    cargo run -p xtask -- ignored-tests --update
+    cargo xtask ignored-tests --update
 
 # ============================================================================
 # Milestone Verification
@@ -979,7 +987,7 @@ milestone-v0_9-check:
     @just ci-gate
     @echo ""
     @echo "📋 Step 2: Checking ignored test breakdown..."
-    @bash scripts/ignored-test-count.sh
+    @cargo xtask ci-hygiene ignored-test-count
     @echo ""
     @echo "📋 Step 3: Verifying metrics consistency..."
     @just status-check
@@ -994,37 +1002,37 @@ milestone-v0_9-check:
 # Harvest raw facts from a merged PR
 forensics-harvest pr:
     @echo "🔬 Harvesting raw facts from PR {{pr}}..."
-    ./scripts/forensics/pr-harvest.sh {{pr}}
+    @cargo xtask forensics-harvest {{pr}}
     @echo "✅ Harvest complete"
 
 # Compute temporal topology (convergence, friction, oscillations)
 forensics-temporal pr:
     @echo "⏱️  Computing temporal topology for PR {{pr}}..."
-    ./scripts/forensics/temporal-analysis.sh {{pr}}
+    @cargo xtask forensics-temporal {{pr}}
     @echo "✅ Temporal analysis complete"
 
 # Run static analysis deltas (quick mode)
 forensics-telemetry-quick pr:
     @echo "📊 Running quick telemetry for PR {{pr}}..."
-    ./scripts/forensics/telemetry-runner.sh {{pr}} --mode quick
+    @cargo xtask forensics-telemetry-quick {{pr}}
     @echo "✅ Quick telemetry complete"
 
 # Run static analysis deltas (full mode with exhibit-grade tools)
 forensics-telemetry-full pr:
     @echo "📊 Running full telemetry for PR {{pr}}..."
-    ./scripts/forensics/telemetry-runner.sh {{pr}} --mode full
+    @cargo xtask forensics-telemetry-full {{pr}}
     @echo "✅ Full telemetry complete"
 
 # Generate complete dossier (runs full pipeline)
 forensics-dossier pr:
     @echo "📁 Generating complete dossier for PR {{pr}}..."
-    ./scripts/forensics/dossier-runner.sh {{pr}}
+    @cargo xtask forensics-dossier {{pr}}
     @echo "✅ Dossier generation complete"
 
 # Render dossier markdown from existing YAML outputs
 forensics-render pr format='full':
     @echo "📝 Rendering dossier for PR {{pr}} (format: {{format}})..."
-    ./scripts/forensics/render-dossier.sh {{pr}} --format {{format}}
+    @cargo xtask forensics-render {{pr}} --format {{format}}
     @echo "✅ Rendering complete"
 
 # ============================================================================
@@ -1037,28 +1045,28 @@ forensics-render pr format='full':
 bench:
     @echo "📊 Running full benchmark suite..."
     @mkdir -p benchmarks/results
-    ./benchmarks/scripts/run-benchmarks.sh --output benchmarks/results/latest.json
+    @cargo xtask bench-run --output benchmarks/results/latest.json
     @echo ""
     @echo "Results saved to benchmarks/results/latest.json"
-    @python3 ./benchmarks/scripts/format-results.py benchmarks/results/latest.json
+    @cargo xtask bench-format
 
 # Quick smoke benchmarks (fast, ~30s)
 bench-quick:
     @echo "⚡ Running quick benchmark smoke test..."
     @mkdir -p benchmarks/results
-    ./benchmarks/scripts/run-benchmarks.sh --quick --output benchmarks/results/latest.json
+    @cargo xtask bench-run --quick --output benchmarks/results/latest.json
     @echo ""
-    @python3 ./benchmarks/scripts/format-results.py benchmarks/results/latest.json --receipt
+    @cargo xtask bench-format --receipt
 
 # Compare current results against baseline
 bench-compare:
     @echo "📈 Comparing against baseline..."
-    ./benchmarks/scripts/compare.sh
+    @cargo xtask bench-compare
 
 # Compare with failure on regression (for CI)
 bench-compare-strict:
     @echo "📈 Comparing against baseline (strict mode)..."
-    ./benchmarks/scripts/compare.sh --fail-on-regression
+    @cargo xtask bench-compare --fail-on-regression
 
 # Save current results as a new baseline
 bench-baseline version='':
@@ -1079,47 +1087,57 @@ bench-baseline version='':
 # Run parser benchmarks only
 bench-parser:
     @echo "📊 Running parser benchmarks..."
-    ./benchmarks/scripts/run-benchmarks.sh --category parser
+    @cargo xtask bench-run --category parser --output benchmarks/results/latest.json
 
 # Run lexer benchmarks only
 bench-lexer:
     @echo "📊 Running lexer benchmarks..."
-    ./benchmarks/scripts/run-benchmarks.sh --category lexer
+    @cargo xtask bench-run --category lexer --output benchmarks/results/latest.json
 
 # Run LSP benchmarks only
 bench-lsp:
     @echo "📊 Running LSP benchmarks..."
-    ./benchmarks/scripts/run-benchmarks.sh --category lsp
+    @cargo xtask bench-run --category lsp --output benchmarks/results/latest.json
 
 # Run workspace index benchmarks only
 bench-index:
     @echo "📊 Running workspace index benchmarks..."
-    ./benchmarks/scripts/run-benchmarks.sh --category index
+    @cargo xtask bench-run --category index --output benchmarks/results/latest.json
 
 # Format benchmark results as receipt
 bench-receipt:
     @echo "📋 Generating benchmark receipt..."
-    @python3 ./benchmarks/scripts/format-results.py benchmarks/results/latest.json --receipt
+    @cargo xtask bench-format --receipt
 
 # Format benchmark results as markdown
 bench-markdown:
     @echo "📋 Generating benchmark markdown..."
-    @python3 ./benchmarks/scripts/format-results.py benchmarks/results/latest.json --markdown
+    @cargo xtask bench-format --markdown
 
 # Generate performance regression alerts (terminal)
 bench-alert:
     @echo "📊 Checking for performance regressions..."
-    @python3 ./benchmarks/scripts/alert.py
+    @cargo xtask bench-alert
 
 # Generate performance regression alerts (markdown for PR)
 bench-alert-md:
     @echo "📊 Generating performance alert (markdown)..."
-    @python3 ./benchmarks/scripts/alert.py --format markdown
+    @cargo xtask bench-alert --format markdown
 
 # Check for critical performance regressions (exits non-zero)
 bench-alert-check:
     @echo "🔍 Checking for critical regressions..."
-    @python3 ./benchmarks/scripts/alert.py --check
+    @cargo xtask bench-alert --check
+
+# Extract Criterion benchmark output from target/criterion artifacts
+bench-extract:
+    @echo "📊 Extracting benchmark results from Criterion..."
+    @cargo xtask bench-extract
+
+# Run benchmark alert regression self-checks
+bench-alert-test:
+    @echo "🧪 Running benchmark alert regression tests..."
+    @cargo xtask bench-alert-test
 
 
 # Run all performance benchmarks and save baseline for 0.12.0
@@ -1236,7 +1254,7 @@ debt-unquarantine name:
 debt-pr-summary:
     @echo "## Technical Debt Status"
     @echo ""
-    @cargo xtask debt-report --json | python3 scripts/debt-pr-summary.py
+    @cargo xtask debt-report --summary
 
 # ============================================================================
 # CI Guardrail Tests (Issue #364)
@@ -1269,7 +1287,14 @@ guardrail-run-ignored:
 # crates.io launch dry-run checks
 prep-crates-io-launch mode='core':
     @echo "🚀 Running crates.io launch prep (mode={{mode}})..."
-    @bash scripts/prep-crates-io-launch.sh --{{mode}}
+    @if [ "{{mode}}" = "--all" ] || [ "{{mode}}" = "all" ]; then \
+        cargo xtask prep-crates-io-launch --mode all; \
+    elif [ "{{mode}}" = "--core" ] || [ "{{mode}}" = "core" ]; then \
+        cargo xtask prep-crates-io-launch --mode core; \
+    else \
+        echo "Invalid mode '{{mode}}' (expected core/all or --core/--all)"; \
+        exit 1; \
+    fi
 
 # ============================================================================
 # SemVer Breaking Change Detection (Issue #277)
@@ -1416,7 +1441,7 @@ fuzz-regression duration='30':
 # Build documentation site with mdBook
 docs-build:
     @echo "📖 Building mdBook documentation site..."
-    @bash scripts/populate-book.sh
+    @cargo xtask populate-book
     mdbook build book
     @echo "✅ Documentation site built successfully"
     @echo "📂 Output: book/book/index.html"
@@ -1424,7 +1449,7 @@ docs-build:
 # Serve documentation site locally
 docs-serve:
     @echo "📖 Serving mdBook documentation site..."
-    @bash scripts/populate-book.sh
+    @cargo xtask populate-book
     @echo "🌐 Starting local server at http://localhost:3000"
     @echo "Press Ctrl+C to stop"
     mdbook serve book --port 3000 --open
@@ -1560,31 +1585,25 @@ ci-unwired-scan:
 
 # CI gate: check unlinked-item compliance
 ci-check-todos:
-    @bash ci/check_todos.sh
+    @cargo xtask ci-hygiene check-todos
 
 # Fast merge gate with receipt generation
 ci-gate-with-receipts:
     @echo "🚪 Running fast merge gate with receipts..."
     @mkdir -p .receipts/$(date +%Y%m%d)
-    @RECEIPT_DIR=".receipts/$(date +%Y%m%d)" bash -c '\
-        ./scripts/execute-gate.sh workflow-audit --receipt-dir "$RECEIPT_DIR" && \
-        ./scripts/execute-gate.sh no-nested-lock --receipt-dir "$RECEIPT_DIR" && \
-        ./scripts/execute-gate.sh format --receipt-dir "$RECEIPT_DIR" && \
-        ./scripts/execute-gate.sh clippy-lib --receipt-dir "$RECEIPT_DIR" && \
-        ./scripts/execute-gate.sh test-lib --receipt-dir "$RECEIPT_DIR" && \
-        ./scripts/execute-gate.sh policy --receipt-dir "$RECEIPT_DIR" && \
-        ./scripts/execute-gate.sh lsp-definition --receipt-dir "$RECEIPT_DIR" \
-    '
+    @for gate in workflow-audit no-nested-lock format clippy-lib test-lib policy lsp-definition; do \
+        cargo xtask gates --gate "$${gate}" --receipt --receipt-path ".receipts/$(date +%Y%m%d)/$${gate}.json" || exit 1; \
+    done
     @echo "✅ Merge gate passed with receipts!"
     @echo "📁 Receipts: .receipts/$(date +%Y%m%d)/"
 
 # Gate execution for individual gate (with receipt)
 gate-execute gate_id:
-    @./scripts/execute-gate.sh {{gate_id}} --receipt-dir .receipts/$(date +%Y%m%d)
+    @cargo xtask gates --gate "{{gate_id}}" --receipt --receipt-path ".receipts/$(date +%Y%m%d)/{{gate_id}}.json"
 
 # Show gate registry
 gate-list:
-    @python3 scripts/list-gates.py
+    @cargo xtask gates --list
 
 # ============================================================================
 # Release Gate (Slice C: Release candidate validation)
@@ -1598,12 +1617,19 @@ release-build:
 
 # Version sync check (Slice B: single source of version truth)
 version-check:
-    @echo "Checking version sync..."
-    @bash scripts/check-version-sync.sh
+    @cargo xtask check-version-sync
 
 # Turnkey PR-driven release orchestrator for 0.x.y releases.
-release-turnkey VERSION:
-    @bash scripts/release-turnkey-pr.sh "{{VERSION}}"
+release-turnkey VERSION *ARGS="":
+    @cargo xtask release-turnkey "{{VERSION}}" {{ARGS}}
+
+# Dispatch publish-to-crates.io workflow for a release version.
+publish-release VERSION *ARGS="":
+    @cargo xtask publish-release "{{VERSION}}" {{ARGS}}
+
+# Run post-release installed-binary smoke test for a release version.
+smoke-test-release VERSION:
+    @cargo xtask smoke-test-release "{{VERSION}}"
 
 # Release gate: full validation for release candidates (~10 min)
 # Composes: ci-gate + release-specific checks
diff --git a/scripts/DEPRECATED_RELEASE_SCRIPTS.md b/scripts/DEPRECATED_RELEASE_SCRIPTS.md
index 815ad620ec..331d8ec74c 100644
--- a/scripts/DEPRECATED_RELEASE_SCRIPTS.md
+++ b/scripts/DEPRECATED_RELEASE_SCRIPTS.md
@@ -2,9 +2,9 @@
 
 ## Authoritative path for RC orchestration
 
-Use `scripts/release-turnkey-pr.sh` for the supported release orchestration flow
-(or the equivalent `just release-turnkey`/xtask flow). This is the canonical
-entrypoint for RC-style releases.
+Use `just release-turnkey` (equivalent `cargo xtask release-turnkey`) for the
+supported release orchestration flow. This is the canonical entrypoint for
+RC-style releases.
 
 ## Deprecated / removed legacy scripts
 
@@ -14,3 +14,4 @@ current release operations:
 - `scripts/release.sh` (removed, legacy pre-flows)
 - `scripts/release-ga.sh` (removed, legacy GA helper)
 - `scripts/publish-v0.8.3.sh` (removed, historical one-off v0.8.3 helper)
+- `scripts/release-turnkey-pr.sh` (legacy orchestration wrapper; retained for compatibility)
diff --git a/scripts/build-timing-receipt.sh b/scripts/build-timing-receipt.sh
index 56c2c49ec8..32e5eaa6aa 100755
--- a/scripts/build-timing-receipt.sh
+++ b/scripts/build-timing-receipt.sh
@@ -1,197 +1,3 @@
 #!/usr/bin/env bash
-# Build timing receipt script for Perl LSP microcrate modularization
-# Usage:
-#   ./scripts/build-timing-receipt.sh [--clean] [--incremental] [--tests] [--output FILE] [--baseline]
-#
-# Options:
-#   --clean         Run clean build (cargo clean first)
-#   --incremental   Run incremental build (touch a file in target crate)
-#   --tests         Run test build
-#   --output FILE   Output file (default: artifacts/build-timing-receipt.json)
-#   --baseline      Save as baseline (artifacts/build-timing-baseline.json)
 
-set -euo pipefail
-
-# Set locale to C for consistent number formatting (prevent comma separators)
-export LC_ALL=C
-
-PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-ARTIFACTS_DIR="${PROJECT_ROOT}/artifacts"
-mkdir -p "${ARTIFACTS_DIR}"
-
-# Default values
-RUN_CLEAN=false
-RUN_INCREMENTAL=false
-RUN_TESTS=false
-OUTPUT_FILE="${ARTIFACTS_DIR}/build-timing-receipt.json"
-IS_BASELINE=false
-
-# Parse command line arguments
-while [[ $# -gt 0 ]]; do
-  case $1 in
-    --clean)
-      RUN_CLEAN=true
-      shift
-      ;;
-    --incremental)
-      RUN_INCREMENTAL=true
-      shift
-      ;;
-    --tests)
-      RUN_TESTS=true
-      shift
-      ;;
-    --output)
-      OUTPUT_FILE="$2"
-      shift 2
-      ;;
-    --baseline)
-      IS_BASELINE=true
-      OUTPUT_FILE="${ARTIFACTS_DIR}/build-timing-baseline.json"
-      shift
-      ;;
-    --help)
-      echo "Usage: $0 [--clean] [--incremental] [--tests] [--output FILE] [--baseline]"
-      echo ""
-      echo "Options:"
-      echo "  --clean         Run clean build (cargo clean first)"
-      echo "  --incremental   Run incremental build (touch a file in target crate)"
-      echo "  --tests         Run test build"
-      echo "  --output FILE   Output file (default: artifacts/build-timing-receipt.json)"
-      echo "  --baseline      Save as baseline (artifacts/build-timing-baseline.json)"
-      echo ""
-      echo "Examples:"
-      echo "  $0 --clean --incremental --tests --baseline"
-      echo "  $0 --clean --output my-timing.json"
-      echo "  $0 --incremental"
-      exit 0
-      ;;
-    *)
-      echo "Unknown option: $1" >&2
-      echo "Use --help for usage information" >&2
-      exit 1
-      ;;
-  esac
-done
-
-# If no specific options provided, run all measurements
-if [[ "$RUN_CLEAN" == false && "$RUN_INCREMENTAL" == false && "$RUN_TESTS" == false ]]; then
-  RUN_CLEAN=true
-  RUN_INCREMENTAL=true
-  RUN_TESTS=true
-fi
-
-cd "${PROJECT_ROOT}"
-
-# Gather system information
-TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-TOOLCHAIN=$(rustc --version 2>/dev/null || echo "unknown")
-CPU_CORES=$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo "unknown")
-MEMORY_GB=$(free -g 2>/dev/null | awk '/^Mem:/{print $2}' || sysctl -n hw.memsize 2>/dev/null | awk '{print int($1/1024/1024/1024)}' || echo "unknown")
-OS=$(uname -s -r 2>/dev/null || echo "unknown")
-
-# Start building JSON output
-JSON_OUTPUT="{"
-JSON_OUTPUT+='"timestamp":"'"${TIMESTAMP}"'",'
-JSON_OUTPUT+='"toolchain":"'"${TOOLCHAIN}"'",'
-JSON_OUTPUT+='"system":{'
-JSON_OUTPUT+='"cpu_cores":'"${CPU_CORES}"','
-JSON_OUTPUT+='"memory_gb":'"${MEMORY_GB}"','
-JSON_OUTPUT+='"os":"'"${OS}"'"'
-JSON_OUTPUT+='},'
-JSON_OUTPUT+='"measurements":{'
-
-# Temporary file for measurements
-MEASUREMENTS_FILE=$(mktemp)
-
-# Function to run a command and measure its time
-measure_time() {
-  local name="$1"
-  local command="$2"
-  local pre_command="${3:-}"
-
-  echo "=== Measuring: ${name} ==="
-  echo "Command: ${command}"
-
-  # Run pre-command if provided
-  if [[ -n "${pre_command}" ]]; then
-    echo "Pre-command: ${pre_command}"
-    eval "${pre_command}" > /dev/null 2>&1 || true
-  fi
-
-  # Measure time using bash's built-in time
-  local start_time end_time elapsed
-  start_time=$(date +%s.%N)
-  eval "${command}" > /dev/null 2>&1 || true
-  end_time=$(date +%s.%N)
-  elapsed=$(echo "${end_time} - ${start_time}" | bc)
-
-  echo "Duration: ${elapsed}s"
-  echo ""
-
-  # Escape the command for JSON
-  local escaped_command
-  escaped_command=$(echo "${command}" | sed 's/"/\\"/g')
-
-  # Write measurement to temp file as single line
-  echo '"'"${name}"'":{"duration_seconds":'"${elapsed}"',"command":"'"${escaped_command}"'"}' >> "${MEASUREMENTS_FILE}"
-}
-
-# Run clean build measurement
-if [[ "$RUN_CLEAN" == true ]]; then
-  measure_time "clean_build_workspace" "cargo build --workspace --locked" "cargo clean"
-fi
-
-# Run incremental build measurement
-if [[ "$RUN_INCREMENTAL" == true ]]; then
-  # First ensure we have a clean build to measure from
-  cargo build --workspace --locked > /dev/null 2>&1 || true
-
-  # Touch a file in perl-lsp-providers to trigger incremental rebuild
-  if [[ -d "${PROJECT_ROOT}/crates/perl-lsp-providers" ]]; then
-    touch "${PROJECT_ROOT}/crates/perl-lsp-providers/src/lib.rs" 2>/dev/null || true
-    measure_time "incremental_build_providers" "cargo build -p perl-lsp-providers --locked"
-  else
-    # If perl-lsp-providers doesn't exist yet, measure incremental on perl-parser
-    touch "${PROJECT_ROOT}/crates/perl-parser/src/lib.rs" 2>/dev/null || true
-    measure_time "incremental_build_parser" "cargo build -p perl-parser --locked"
-  fi
-fi
-
-# Run test build measurement
-if [[ "$RUN_TESTS" == true ]]; then
-  measure_time "test_build_workspace" "cargo test --workspace --lib --locked"
-fi
-
-# Read measurements from temp file and build final JSON
-MEASUREMENTS_JSON=$(cat "${MEASUREMENTS_FILE}" | paste -sd ',')
-
-# Clean up temp file
-rm -f "${MEASUREMENTS_FILE}"
-
-# Build final JSON
-FINAL_JSON="{"
-FINAL_JSON+='"timestamp":"'"${TIMESTAMP}"'",'
-FINAL_JSON+='"toolchain":"'"${TOOLCHAIN}"'",'
-FINAL_JSON+='"system":{'
-FINAL_JSON+='"cpu_cores":'"${CPU_CORES}"','
-FINAL_JSON+='"memory_gb":'"${MEMORY_GB}"','
-FINAL_JSON+='"os":"'"${OS}"'"'
-FINAL_JSON+='},'
-FINAL_JSON+='"measurements":{'"${MEASUREMENTS_JSON}"'}'
-FINAL_JSON+='}'
-
-# Write output to file
-echo "${FINAL_JSON}" | jq '.' > "${OUTPUT_FILE}"
-
-echo "=== Build Timing Receipt Generated ==="
-echo "Output: ${OUTPUT_FILE}"
-echo ""
-cat "${OUTPUT_FILE}"
-
-if [[ "$IS_BASELINE" == true ]]; then
-  echo ""
-  echo "Baseline saved to: ${OUTPUT_FILE}"
-  echo "Use this baseline to compare against future measurements:"
-  echo "  ./scripts/compare-build-timing.sh ${OUTPUT_FILE} <new-measurement.json>"
-fi
+exec cargo xtask build-timing-receipt "$@"
diff --git a/scripts/check-doc-claims.py b/scripts/check-doc-claims.py
index 8789dcbd6b..2813636345 100755
--- a/scripts/check-doc-claims.py
+++ b/scripts/check-doc-claims.py
@@ -1,98 +1,11 @@
 #!/usr/bin/env python3
-"""Check that article inline claims match values in PUBLICATION_FACTS_LEDGER.md.
 
-Flags known-stale string patterns found in docs/articles/*.md.
-This is a claim-match linter: it checks known-wrong values, not all numbers.
+"""Compatibility shim for `cargo xtask doc-claims`."""
 
-Exit code 0 = clean.
-Exit code 1 = stale claims detected.
-"""
-
-from __future__ import annotations
-
-import pathlib
-import sys
-
-ROOT = pathlib.Path(__file__).resolve().parents[1]
-ARTICLES_DIR = ROOT / "docs" / "articles"
-
-# Each entry: (stale_pattern, correct_replacement, description)
-# These are patterns that are known to be wrong based on PUBLICATION_FACTS_LEDGER.md.
-# Only scan docs/articles/*.md (not docs/articles/research/ — historical notes).
-STALE_PATTERNS: list[tuple[str, str, str]] = [
-    # Lines-of-Rust claims
-    ("563,228 lines", "591,034 lines", "LOC claim (563K is stale; ledger: 591,034)"),
-    ("563K lines", "591K lines", "LOC claim (563K is stale; ledger: 591K)"),
-    ("546,000", "591,034", "LOC claim (546K is stale; ledger: 591,034)"),
-    ("546K lines", "591K lines", "LOC claim (546K is stale; ledger: 591K)"),
-    # Workspace crate counts
-    ("131 crates", "133 crates", "Crate count (131 is stale; ledger: 133)"),
-    ("131 workspace crates", "133 workspace crates", "Crate count (131 is stale; ledger: 133)"),
-    ("132 workspace crates", "133 workspace crates", "Crate count (132 is stale; ledger: 133)"),
-    ("132 crates", "133 crates", "Crate count (132 is stale; ledger: 133)"),
-    # LSP feature counts
-    ("97 LSP and DAP features", "98 LSP and DAP features", "Feature count (97 is stale; ledger: 98)"),
-    ("97 LSP/DAP features", "98 LSP/DAP features", "Feature count (97 is stale; ledger: 98)"),
-    ("97 features defined", "98 features defined", "Feature count (97 is stale; ledger: 98)"),
-    ("97 features governed", "98 features governed", "Feature count (97 is stale; ledger: 98)"),
-    ("97 features:", "98 features:", "Feature count (97 is stale; ledger: 98)"),
-    # Commit counts
-    ("2,700+ commits", "3,200+ commits", "Commit count (2,700+ is stale; ledger: 3,210)"),
-    # PR counts
-    ("2,200+ pull requests", "2,646+ pull requests", "PR count (2,200+ is stale; ledger: 2,646+)"),
-    ("2,200+ PRs", "2,646+ PRs", "PR count (2,200+ is stale; ledger: 2,646+)"),
-]
-
-
-def scan_articles() -> list[tuple[pathlib.Path, int, str, str, str]]:
-    """Scan docs/articles/*.md for stale patterns.
-
-    Returns list of (file, line_number, matched_pattern, replacement, description).
-    """
-    hits: list[tuple[pathlib.Path, int, str, str, str]] = []
-
-    # Only scan top-level articles, not research/ subdirectory (historical notes)
-    for md_file in sorted(ARTICLES_DIR.glob("*.md")):
-        text = md_file.read_text(encoding="utf-8")
-        lines = text.splitlines()
-        for lineno, line in enumerate(lines, start=1):
-            for stale, replacement, description in STALE_PATTERNS:
-                if stale in line:
-                    hits.append((md_file, lineno, stale, replacement, description))
-
-    return hits
-
-
-def main() -> int:
-    hits = scan_articles()
-
-    if hits:
-        print("DOC CLAIM VIOLATIONS:", file=sys.stderr)
-        print("=" * 60, file=sys.stderr)
-        for filepath, lineno, stale, replacement, description in hits:
-            rel = filepath.relative_to(ROOT)
-            print(f"  {rel}:{lineno}: {description}", file=sys.stderr)
-            print(f"    found:    {stale!r}", file=sys.stderr)
-            print(f"    expected: {replacement!r}", file=sys.stderr)
-        print("=" * 60, file=sys.stderr)
-        print(
-            f"\n{len(hits)} stale claim(s) found in docs/articles/.",
-            file=sys.stderr,
-        )
-        print(
-            "\nTo fix: update the article to match docs/project/PUBLICATION_FACTS_LEDGER.md",
-            file=sys.stderr,
-        )
-        return 1
-
-    article_count = len(list(ARTICLES_DIR.glob("*.md")))
-    pattern_count = len(STALE_PATTERNS)
-    print(
-        f"Doc claims OK: {article_count} articles scanned, "
-        f"{pattern_count} stale patterns checked, 0 violations found"
-    )
-    return 0
+import subprocess
+from pathlib import Path
 
 
 if __name__ == "__main__":
-    raise SystemExit(main())
+    repo_root = Path(__file__).resolve().parents[1]
+    raise SystemExit(subprocess.call(["cargo", "xtask", "doc-claims"], cwd=repo_root))
diff --git a/scripts/check-version-sync.sh b/scripts/check-version-sync.sh
index 510087b62a..9dddd033e8 100755
--- a/scripts/check-version-sync.sh
+++ b/scripts/check-version-sync.sh
@@ -3,10 +3,6 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-BIN="${REPO_ROOT}/target/debug/perl-ci-hygiene"
+cd "$REPO_ROOT"
 
-if [ -x "$BIN" ]; then
-  exec "$BIN" check-version-sync
-fi
-
-exec cargo run --quiet --manifest-path "$REPO_ROOT/Cargo.toml" -p perl-ci-hygiene -- check-version-sync
+exec cargo xtask check-version-sync "$@"
diff --git a/scripts/check_features_invariants.py b/scripts/check_features_invariants.py
index 35262bb092..be306b9506 100755
--- a/scripts/check_features_invariants.py
+++ b/scripts/check_features_invariants.py
@@ -1,104 +1,13 @@
 #!/usr/bin/env python3
-"""Validate features.toml invariants for truth surface integrity.
 
-This script enforces rules that prevent the feature catalog from
-accidentally misrepresenting the project's capabilities:
+"""Compatibility shim for `cargo xtask features invariants`."""
 
-1. GA + advertised => tests must be non-empty (no claiming untested features)
-2. No duplicate feature IDs
-3. advertised=true + counts_in_coverage=true is the headline metric
-
-Exit code 0 = all invariants pass
-Exit code 1 = invariant violations found
-"""
-
-from __future__ import annotations
-
-import pathlib
-import sys
-from typing import Any
-
-try:
-    import tomllib
-except ImportError:
-    import tomli as tomllib
-
-
-ROOT = pathlib.Path(__file__).resolve().parents[1]
-FEATURES_TOML = ROOT / "features.toml"
-
-
-def check_invariants(features: list[dict[str, Any]]) -> list[str]:
-    """Check all invariants and return list of violations."""
-    violations: list[str] = []
-    seen_ids: set[str] = set()
-
-    for i, f in enumerate(features):
-        fid = f.get("id", f"<unnamed feature #{i}>")
-        advertised = f.get("advertised", False)
-        maturity = f.get("maturity", "planned")
-        tests = f.get("tests", [])
-        counts_in_coverage = f.get("counts_in_coverage", True)
-
-        # Rule 1: No duplicate IDs
-        if fid in seen_ids:
-            violations.append(f"DUPLICATE_ID: {fid!r} appears more than once")
-        seen_ids.add(fid)
-
-        # Rule 2: GA + advertised => tests must be non-empty
-        # This prevents claiming "GA" status for untested features
-        if advertised and maturity == "ga" and not tests:
-            # Exception: features with counts_in_coverage=false are protocol/plumbing
-            # and can be GA without tests (they're not in the headline metric)
-            if counts_in_coverage is not False:
-                violations.append(
-                    f"UNTESTED_GA: {fid!r} is advertised+GA but has no tests. "
-                    f"Either add tests or set counts_in_coverage=false (if it's protocol plumbing)."
-                )
-
-        # Rule 3: Warn if advertised but not counting in coverage
-        # (This is allowed but worth noting)
-        if advertised and counts_in_coverage is False and maturity == "ga":
-            # This is fine - just informational
-            pass
-
-    return violations
-
-
-def main() -> int:
-    data = tomllib.loads(FEATURES_TOML.read_text(encoding="utf-8"))
-    features = data.get("feature", [])
-
-    violations = check_invariants(features)
-
-    if violations:
-        print("FEATURE INVARIANT VIOLATIONS:", file=sys.stderr)
-        print("=" * 50, file=sys.stderr)
-        for v in violations:
-            print(f"  - {v}", file=sys.stderr)
-        print("=" * 50, file=sys.stderr)
-        print(f"\n{len(violations)} violation(s) found.", file=sys.stderr)
-        print("\nTo fix:", file=sys.stderr)
-        print("  - DUPLICATE_ID: Remove duplicate entries from features.toml", file=sys.stderr)
-        print("  - UNTESTED_GA: Either add tests[] entries or set counts_in_coverage=false", file=sys.stderr)
-        return 1
-
-    # Print summary
-    total = len(features)
-    ga_advertised = sum(
-        1 for f in features
-        if f.get("advertised") and f.get("maturity") == "ga"
-    )
-    headline_features = sum(
-        1 for f in features
-        if f.get("advertised")
-        and f.get("maturity") == "ga"
-        and f.get("counts_in_coverage", True) is not False
-    )
-
-    print(f"Feature invariants OK: {total} features, {ga_advertised} GA+advertised, {headline_features} in headline metric")
-    return 0
+import subprocess
+from pathlib import Path
 
 
 if __name__ == "__main__":
-    raise SystemExit(main())
+    repo_root = Path(__file__).resolve().parents[1]
+    raise SystemExit(
+        subprocess.call(["cargo", "xtask", "features", "invariants"], cwd=repo_root)
+    )
diff --git a/scripts/ci-audit-workflows.py b/scripts/ci-audit-workflows.py
index d913eaeb14..cb8a8e8061 100755
--- a/scripts/ci-audit-workflows.py
+++ b/scripts/ci-audit-workflows.py
@@ -1,123 +1,11 @@
 #!/usr/bin/env python3
-"""
-CI Workflow Spend Audit
 
-Enforces that expensive jobs in GitHub Actions workflows are gated behind labels
-or workflow_dispatch, preventing silent spend regression on PRs.
+"""Compatibility shim for `cargo xtask ci-audit-workflows`."""
 
-Exit codes:
-  0 - All jobs are properly gated or allowlisted
-  1 - Found ungated expensive jobs (potential spend risk)
-"""
-
-import sys
-import yaml
+import subprocess
 from pathlib import Path
 
-# Workflows that are allowed to have ungated jobs (cheap/essential)
-ALLOWED_WORKFLOWS = {
-    "ci.yml",           # Core fast gate (fmt → clippy → test → docs)
-    "check-ignored.yml", # Cheap check
-}
-
-# Jobs that are allowed to run ungated (very cheap, ~seconds)
-ALLOWED_UNGATED_JOBS = {
-    "tautology-check",  # ~1s grep-based check
-    "test-metrics",     # ~2s metric counting
-    "fmt",              # Fast rustfmt check
-    "clippy",           # Fast lint (when cached)
-}
-
-
-def parse_workflow(path: Path) -> dict:
-    """Parse a workflow YAML file."""
-    with open(path) as f:
-        return yaml.safe_load(f)
-
-
-def has_pr_trigger(workflow: dict) -> bool:
-    """Check if workflow runs on pull_request events."""
-    on_field = workflow.get("on", {})
-    if isinstance(on_field, list):
-        return "pull_request" in on_field
-    if isinstance(on_field, dict):
-        return "pull_request" in on_field
-    if isinstance(on_field, str):
-        return on_field == "pull_request"
-    return False
-
-
-def is_gated(job: dict) -> bool:
-    """Check if a job has an if: condition (gated)."""
-    return "if" in job
-
-
-def audit_workflows(workflows_dir: Path) -> list[str]:
-    """Audit all workflows for ungated expensive jobs."""
-    violations = []
-
-    for wf_path in workflows_dir.glob("*.yml"):
-        wf_name = wf_path.name
-
-        # Skip allowlisted workflows
-        if wf_name in ALLOWED_WORKFLOWS:
-            continue
-
-        try:
-            workflow = parse_workflow(wf_path)
-        except yaml.YAMLError as e:
-            violations.append(f"{wf_name}: YAML parse error: {e}")
-            continue
-
-        if not workflow:
-            continue
-
-        # Only check workflows with PR triggers
-        if not has_pr_trigger(workflow):
-            continue
-
-        jobs = workflow.get("jobs", {})
-        for job_name, job_config in jobs.items():
-            # Skip allowlisted jobs
-            if job_name in ALLOWED_UNGATED_JOBS:
-                continue
-
-            if not isinstance(job_config, dict):
-                continue
-
-            if not is_gated(job_config):
-                violations.append(
-                    f"{wf_name}:{job_name} - runs on PRs without if: condition"
-                )
-
-    return violations
-
-
-def main():
-    workflows_dir = Path(".github/workflows")
-
-    if not workflows_dir.exists():
-        print("✓ No .github/workflows directory found")
-        return 0
-
-    violations = audit_workflows(workflows_dir)
-
-    if violations:
-        print("❌ CI Spend Audit Failed")
-        print()
-        print("The following jobs run on every PR without gating:")
-        for v in violations:
-            print(f"  - {v}")
-        print()
-        print("Fix by adding one of:")
-        print("  1. if: contains(github.event.pull_request.labels.*.name, 'ci:<label>')")
-        print("  2. Add job to ALLOWED_UNGATED_JOBS in scripts/ci-audit-workflows.py")
-        print("  3. Add workflow to ALLOWED_WORKFLOWS (if entire workflow is cheap)")
-        return 1
-
-    print("✓ CI workflow spend audit passed")
-    return 0
-
 
 if __name__ == "__main__":
-    sys.exit(main())
+    repo_root = Path(__file__).resolve().parents[1]
+    raise SystemExit(subprocess.call(["cargo", "xtask", "ci-audit-workflows"], cwd=repo_root))
diff --git a/scripts/ci-cost-monitor.sh b/scripts/ci-cost-monitor.sh
index b9842ad8e8..5041035488 100755
--- a/scripts/ci-cost-monitor.sh
+++ b/scripts/ci-cost-monitor.sh
@@ -1,409 +1,15 @@
 #!/usr/bin/env bash
-# CI Cost Monitor for perl-lsp GitHub Actions
+# Canonical implementation: cargo xtask ci-cost-monitor.
 #
-# Queries GitHub Actions API to calculate estimated CI costs based on workflow runs.
-# Uses Linux runner pricing: $0.008/minute
-#
-# Usage:
-#   ./scripts/ci-cost-monitor.sh               # Show cost breakdown (last 30 days)
-#   ./scripts/ci-cost-monitor.sh --days 7      # Show last 7 days
-#   ./scripts/ci-cost-monitor.sh --json        # Output as JSON
-#   ./scripts/ci-cost-monitor.sh --help        # Show help message
-#
-# Requirements:
-#   - gh (GitHub CLI) authenticated
-#
-# Cost Reference:
-#   - GitHub Actions Linux runners: $0.008/minute
-#   - Target budget: $720/year savings from Issue #211
-#   - Monthly budget target: $60/month ($720/year)
+# Supported flags are:
+#   --days N     Number of days to analyze
+#   --json       JSON output
 
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-CYAN='\033[0;36m'
-BOLD='\033[1m'
-NC='\033[0m' # No Color
-
-# Configuration
-DAYS=30
-OUTPUT_JSON=false
-COST_PER_MINUTE=0.008  # GitHub Actions Linux runner pricing
-ANNUAL_BUDGET_TARGET=720  # From Issue #211
-MONTHLY_BUDGET_TARGET=60  # $720/year ÷ 12
-
-# Parse command line arguments
-while [[ $# -gt 0 ]]; do
-    case $1 in
-        --days)
-            DAYS="$2"
-            shift 2
-            ;;
-        --json)
-            OUTPUT_JSON=true
-            shift
-            ;;
-        --help|-h)
-            echo "Usage: $0 [OPTIONS]"
-            echo ""
-            echo "Options:"
-            echo "  --days N     Number of days to analyze (default: 30)"
-            echo "  --json       Output as JSON"
-            echo "  --help       Show this help message"
-            echo ""
-            echo "Examples:"
-            echo "  $0                    # Last 30 days"
-            echo "  $0 --days 7           # Last 7 days"
-            echo "  $0 --json             # JSON output"
-            exit 0
-            ;;
-        *)
-            echo "Unknown option: $1"
-            echo "Run '$0 --help' for usage information"
-            exit 1
-            ;;
-    esac
-done
-
-# Check for gh CLI
-if ! command -v gh &> /dev/null; then
-    echo -e "${RED}Error: gh CLI not found${NC}"
-    echo "Install from: https://cli.github.com/"
-    exit 1
-fi
-
-# Check gh authentication
-if ! gh auth status &> /dev/null; then
-    echo -e "${RED}Error: gh CLI not authenticated${NC}"
-    echo "Run: gh auth login"
-    exit 1
-fi
-
-# Get repository info
-REPO_OWNER=$(gh repo view --json owner -q .owner.login 2>/dev/null || echo "")
-REPO_NAME=$(gh repo view --json name -q .name 2>/dev/null || echo "")
-
-if [[ -z "$REPO_OWNER" || -z "$REPO_NAME" ]]; then
-    echo -e "${RED}Error: Could not determine repository owner/name${NC}"
-    echo "Make sure you're in a git repository with a GitHub remote"
-    exit 1
-fi
-
-# Calculate date range
-if [[ "$OSTYPE" == "darwin"* ]]; then
-    # macOS
-    START_DATE=$(date -v-${DAYS}d -u +%Y-%m-%dT%H:%M:%SZ)
-else
-    # Linux
-    START_DATE=$(date -u -d "$DAYS days ago" +%Y-%m-%dT%H:%M:%SZ)
-fi
-
-# Query workflow runs
-if ! $OUTPUT_JSON; then
-    echo -e "${BLUE}Fetching workflow runs for ${BOLD}${REPO_OWNER}/${REPO_NAME}${NC}"
-    echo -e "${BLUE}Period: Last $DAYS days (since $START_DATE)${NC}"
-    echo ""
-fi
-
-# Fetch all workflow runs in the date range
-WORKFLOW_RUNS=$(gh api "repos/${REPO_OWNER}/${REPO_NAME}/actions/runs" \
-    --paginate \
-    -X GET \
-    -F created=">${START_DATE}" \
-    -F per_page=100 \
-    --jq '.workflow_runs[] | select(.conclusion != null) | {
-        id: .id,
-        name: .name,
-        status: .status,
-        conclusion: .conclusion,
-        created_at: .created_at,
-        updated_at: .updated_at,
-        run_started_at: .run_started_at
-    }' 2>/dev/null || echo "[]")
-
-if [[ -z "$WORKFLOW_RUNS" || "$WORKFLOW_RUNS" == "[]" ]]; then
-    if ! $OUTPUT_JSON; then
-        echo -e "${YELLOW}No workflow runs found in the last $DAYS days${NC}"
-    else
-        echo '{"error": "No workflow runs found", "period_days": '$DAYS'}'
-    fi
-    exit 0
-fi
-
-# Process workflow runs and calculate costs
-declare -A workflow_minutes
-declare -A workflow_runs_count
-declare -A workflow_cost
-total_minutes=0
-total_runs=0
-successful_runs=0
-failed_runs=0
-
-while IFS= read -r run; do
-    if [[ -z "$run" ]]; then
-        continue
-    fi
-
-    workflow_name=$(echo "$run" | jq -r '.name')
-    conclusion=$(echo "$run" | jq -r '.conclusion')
-    run_started_at=$(echo "$run" | jq -r '.run_started_at // .created_at')
-    updated_at=$(echo "$run" | jq -r '.updated_at')
-
-    # Calculate duration in minutes
-    if [[ "$run_started_at" != "null" && "$updated_at" != "null" ]]; then
-        start_epoch=$(date -d "$run_started_at" +%s 2>/dev/null || date -j -f "%Y-%m-%dT%H:%M:%SZ" "$run_started_at" +%s 2>/dev/null || echo 0)
-        end_epoch=$(date -d "$updated_at" +%s 2>/dev/null || date -j -f "%Y-%m-%dT%H:%M:%SZ" "$updated_at" +%s 2>/dev/null || echo 0)
-
-        if [[ $start_epoch -gt 0 && $end_epoch -gt 0 ]]; then
-            duration_seconds=$((end_epoch - start_epoch))
-            duration_minutes=$((duration_seconds / 60))
-
-            # Add to totals
-            workflow_minutes["$workflow_name"]=$((${workflow_minutes["$workflow_name"]:-0} + duration_minutes))
-            workflow_runs_count["$workflow_name"]=$((${workflow_runs_count["$workflow_name"]:-0} + 1))
-            total_minutes=$((total_minutes + duration_minutes))
-            total_runs=$((total_runs + 1))
-
-            # Track success/failure
-            if [[ "$conclusion" == "success" ]]; then
-                successful_runs=$((successful_runs + 1))
-            else
-                failed_runs=$((failed_runs + 1))
-            fi
-        fi
-    fi
-done <<< "$WORKFLOW_RUNS"
-
-# Calculate costs per workflow
-for workflow in "${!workflow_minutes[@]}"; do
-    minutes=${workflow_minutes["$workflow"]}
-    cost=$(awk "BEGIN {printf \"%.2f\", $minutes * $COST_PER_MINUTE}")
-    workflow_cost["$workflow"]=$cost
-done
-
-# Calculate total cost
-total_cost=$(awk "BEGIN {printf \"%.2f\", $total_minutes * $COST_PER_MINUTE}")
-
-# Calculate projections
-monthly_minutes=$(awk "BEGIN {printf \"%.0f\", $total_minutes * 30 / $DAYS}")
-monthly_cost=$(awk "BEGIN {printf \"%.2f\", $monthly_minutes * $COST_PER_MINUTE}")
-annual_cost=$(awk "BEGIN {printf \"%.2f\", $monthly_cost * 12}")
-
-# Calculate budget status
-budget_percentage=$(awk "BEGIN {printf \"%.1f\", ($monthly_cost / $MONTHLY_BUDGET_TARGET) * 100}")
-
-# Output results
-if $OUTPUT_JSON; then
-    # JSON output
-    echo "{"
-    echo "  \"period_days\": $DAYS,"
-    echo "  \"start_date\": \"$START_DATE\","
-    echo "  \"repository\": \"${REPO_OWNER}/${REPO_NAME}\","
-    echo "  \"total_runs\": $total_runs,"
-    echo "  \"successful_runs\": $successful_runs,"
-    echo "  \"failed_runs\": $failed_runs,"
-    echo "  \"total_minutes\": $total_minutes,"
-    echo "  \"total_cost\": $total_cost,"
-    echo "  \"monthly_projection\": {"
-    echo "    \"minutes\": $monthly_minutes,"
-    echo "    \"cost\": $monthly_cost,"
-    echo "    \"budget_target\": $MONTHLY_BUDGET_TARGET,"
-    echo "    \"budget_percentage\": $budget_percentage"
-    echo "  },"
-    echo "  \"annual_projection\": {"
-    echo "    \"cost\": $annual_cost,"
-    echo "    \"budget_target\": $ANNUAL_BUDGET_TARGET"
-    echo "  },"
-    echo "  \"workflows\": ["
-
-    first=true
-    if [[ ${#workflow_minutes[@]} -gt 0 ]]; then
-        for workflow in $(printf '%s\n' "${!workflow_minutes[@]}" | sort); do
-            minutes=${workflow_minutes["$workflow"]:-0}
-            runs=${workflow_runs_count["$workflow"]:-0}
-            cost=${workflow_cost["$workflow"]:-0}
-
-            # Skip workflows with 0 runs or 0 minutes
-            if [[ $runs -eq 0 || $minutes -eq 0 ]]; then
-                continue
-            fi
-
-            if ! $first; then
-                echo ","
-            fi
-            first=false
-
-            avg_minutes=$(awk "BEGIN {printf \"%.1f\", $minutes / ($runs > 0 ? $runs : 1)}")
-
-            echo "    {"
-            echo "      \"name\": \"$workflow\","
-            echo "      \"runs\": $runs,"
-            echo "      \"total_minutes\": $minutes,"
-            echo "      \"average_minutes\": $avg_minutes,"
-            echo "      \"cost\": $cost"
-            echo -n "    }"
-        done
-    fi
-    echo ""
-    echo "  ]"
-    echo "}"
-else
-    # Human-readable output
-    echo "==============================================================================="
-    echo "                     CI Cost Analysis Report"
-    echo "==============================================================================="
-    echo ""
-    echo -e "${BOLD}Period:${NC} Last $DAYS days (since $START_DATE)"
-    echo -e "${BOLD}Repository:${NC} ${REPO_OWNER}/${REPO_NAME}"
-    echo ""
-    echo "==============================================================================="
-    echo "                          Summary"
-    echo "==============================================================================="
-    printf "%-30s %10d\n" "Total workflow runs:" "$total_runs"
-    printf "%-30s %10d (%.1f%%)\n" "  Successful:" "$successful_runs" "$(awk "BEGIN {if ($total_runs > 0) printf \"%.1f\", ($successful_runs / $total_runs) * 100; else print \"0.0\"}")"
-    printf "%-30s %10d (%.1f%%)\n" "  Failed:" "$failed_runs" "$(awk "BEGIN {if ($total_runs > 0) printf \"%.1f\", ($failed_runs / $total_runs) * 100; else print \"0.0\"}")"
-    printf "%-30s %10d minutes\n" "Total CI time:" "$total_minutes"
-    printf "%-30s %10s\n" "Total cost:" "\$${total_cost}"
-    echo ""
-
-    echo "==============================================================================="
-    echo "                       Monthly Projection"
-    echo "==============================================================================="
-    printf "%-30s %10d minutes\n" "Estimated monthly usage:" "$monthly_minutes"
-    printf "%-30s %10s\n" "Estimated monthly cost:" "\$${monthly_cost}"
-    printf "%-30s %10s\n" "Monthly budget target:" "\$${MONTHLY_BUDGET_TARGET}"
-
-    # Budget status with color
-    if (( $(awk "BEGIN {print ($monthly_cost <= $MONTHLY_BUDGET_TARGET)}") )); then
-        printf "%-30s ${GREEN}%9.1f%%${NC} " "Budget utilization:" "$budget_percentage"
-        echo -e "${GREEN}✓ Within budget${NC}"
-    else
-        printf "%-30s ${RED}%9.1f%%${NC} " "Budget utilization:" "$budget_percentage"
-        echo -e "${RED}⚠ Over budget${NC}"
-    fi
-    echo ""
-
-    echo "==============================================================================="
-    echo "                       Annual Projection"
-    echo "==============================================================================="
-    printf "%-30s %10s\n" "Estimated annual cost:" "\$${annual_cost}"
-    printf "%-30s %10s\n" "Annual budget target:" "\$${ANNUAL_BUDGET_TARGET}"
-
-    if (( $(awk "BEGIN {print ($annual_cost <= $ANNUAL_BUDGET_TARGET)}") )); then
-        echo -e "${GREEN}✓ Annual projection within budget${NC}"
-    else
-        savings_needed=$(awk "BEGIN {printf \"%.2f\", $annual_cost - $ANNUAL_BUDGET_TARGET}")
-        echo -e "${RED}⚠ Annual projection exceeds budget by \$${savings_needed}${NC}"
-    fi
-    echo ""
-
-    echo "==============================================================================="
-    echo "                    Per-Workflow Breakdown"
-    echo "==============================================================================="
-    printf "%-35s %8s %12s %12s %10s\n" "Workflow" "Runs" "Total Min" "Avg Min" "Cost"
-    echo "-------------------------------------------------------------------------------"
-
-    # Sort workflows by cost (descending)
-    if [[ ${#workflow_cost[@]} -gt 0 ]]; then
-        for workflow in $(for w in "${!workflow_cost[@]}"; do echo "$w ${workflow_cost[$w]}"; done | sort -k2 -rn | cut -d' ' -f1); do
-            minutes=${workflow_minutes["$workflow"]:-0}
-            runs=${workflow_runs_count["$workflow"]:-0}
-            cost=${workflow_cost["$workflow"]:-0.00}
-
-            # Skip workflows with 0 runs or 0 minutes
-            if [[ $runs -eq 0 || $minutes -eq 0 ]]; then
-                continue
-            fi
-
-            avg_minutes=$(awk "BEGIN {printf \"%.1f\", $minutes / ($runs > 0 ? $runs : 1)}")
-
-            # Truncate workflow name if too long
-            if [[ ${#workflow} -gt 35 ]]; then
-                display_name="${workflow:0:32}..."
-            else
-                display_name="$workflow"
-            fi
-
-            printf "%-35s %8d %12d %12s %10s\n" "$display_name" "$runs" "$minutes" "$avg_minutes" "\$${cost}"
-        done
-    fi
-    echo "==============================================================================="
-    echo ""
-
-    # Recommendations
-    echo "==============================================================================="
-    echo "                        Recommendations"
-    echo "==============================================================================="
-    echo ""
-
-    # Find most expensive workflow
-    most_expensive_workflow=""
-    most_expensive_cost=0
-    if [[ ${#workflow_cost[@]} -gt 0 ]]; then
-        for workflow in "${!workflow_cost[@]}"; do
-            cost=${workflow_cost["$workflow"]:-0}
-            if (( $(awk "BEGIN {print ($cost > $most_expensive_cost)}") )); then
-                most_expensive_cost=$cost
-                most_expensive_workflow="$workflow"
-            fi
-        done
-    fi
-
-    if [[ -n "$most_expensive_workflow" ]]; then
-        echo -e "${YELLOW}1. Most Expensive Workflow:${NC}"
-        echo "   '$most_expensive_workflow' costs \$${most_expensive_cost} ($(awk "BEGIN {printf \"%.1f\", ($most_expensive_cost / $total_cost) * 100}")% of total)"
-        echo "   Consider optimizing or gating behind labels"
-        echo ""
-    fi
-
-    # Check for failed runs
-    if [[ $failed_runs -gt 0 ]]; then
-        failure_rate=$(awk "BEGIN {printf \"%.1f\", ($failed_runs / $total_runs) * 100}")
-        echo -e "${YELLOW}2. Failed Runs:${NC}"
-        echo "   $failed_runs failed runs (${failure_rate}% failure rate)"
-        echo "   Failed runs waste CI budget - investigate and fix flaky tests"
-        echo ""
-    fi
-
-    # Concurrency cancellation savings
-    echo -e "${GREEN}3. Concurrency Cancellation:${NC}"
-    echo "   Ensure all workflows use concurrency.cancel-in-progress: true"
-    echo "   This prevents wasted minutes on superseded runs"
-    echo ""
-
-    # Caching recommendations
-    echo -e "${GREEN}4. Caching Strategy:${NC}"
-    echo "   Use Swatinem/rust-cache@v2 to reduce build times by 50-70%"
-    echo "   Ensure cache-on-failure: true to maximize cache hits"
-    echo ""
-
-    # Conditional execution
-    echo -e "${GREEN}5. Conditional Execution:${NC}"
-    echo "   Gate expensive workflows behind labels or workflow_dispatch"
-    echo "   Run benchmarks/mutation tests only when needed"
-    echo ""
-
-    echo "==============================================================================="
-    echo ""
+cd "$REPO_ROOT"
 
-    # Budget summary
-    if (( $(awk "BEGIN {print ($monthly_cost <= $MONTHLY_BUDGET_TARGET)}") )); then
-        echo -e "${GREEN}${BOLD}✓ CI costs are within budget${NC}"
-    else
-        echo -e "${RED}${BOLD}⚠ Action required: CI costs exceed budget${NC}"
-        echo ""
-        echo "Next steps:"
-        echo "  1. Review expensive workflows above"
-        echo "  2. Implement caching for all workflows"
-        echo "  3. Gate expensive tests behind labels"
-        echo "  4. Fix flaky tests to reduce failures"
-    fi
-    echo ""
-fi
+exec cargo xtask ci-cost-monitor "$@"
diff --git a/scripts/cleanup-worktrees.sh b/scripts/cleanup-worktrees.sh
index f0784c8308..1b15bfab66 100755
--- a/scripts/cleanup-worktrees.sh
+++ b/scripts/cleanup-worktrees.sh
@@ -1,29 +1,8 @@
 #!/usr/bin/env bash
-# Clean up stale agent worktrees from previous sessions
-# Safe: only removes worktrees under .claude/worktrees/ that are not the current session
-
 set -euo pipefail
 
-echo "=== Worktree Cleanup ==="
-
-# Prune references to deleted worktrees
-git worktree prune
-
-# Count current worktrees (excluding main and /tmp)
-STALE=$(git worktree list | grep -c '.claude/worktrees/' || echo 0)
-echo "Found $STALE agent worktrees"
-
-if [[ "$STALE" -eq 0 ]]; then
-    echo "No stale worktrees to clean up"
-    exit 0
-fi
-
-# Remove each worktree
-git worktree list | grep '.claude/worktrees/' | awk '{print $1}' | while read -r wt; do
-    echo "Removing: $wt"
-    git worktree remove --force "$wt" 2>/dev/null || rm -rf "$wt"
-done
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$REPO_ROOT"
 
-# Final prune
-git worktree prune
-echo "Cleanup complete"
+exec cargo xtask worktree-cleanup
diff --git a/scripts/compare-build-timing.sh b/scripts/compare-build-timing.sh
index a88391b9cb..e13c467940 100755
--- a/scripts/compare-build-timing.sh
+++ b/scripts/compare-build-timing.sh
@@ -1,214 +1,3 @@
 #!/usr/bin/env bash
-# Compare build timing receipts
-# Usage:
-#   ./scripts/compare-build-timing.sh BASELINE.json CURRENT.json
 
-set -euo pipefail
-
-# Set locale to C for consistent number formatting
-export LC_ALL=C
-
-PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-
-# Check for required arguments
-if [[ $# -lt 2 ]]; then
-  echo "Usage: $0 BASELINE.json CURRENT.json" >&2
-  echo ""
-  echo "Compare build timing receipts and generate a comparison report."
-  echo ""
-  echo "Arguments:"
-  echo "  BASELINE.json  Path to the baseline build timing receipt"
-  echo "  CURRENT.json   Path to the current build timing receipt"
-  echo ""
-  echo "Examples:"
-  echo "  $0 artifacts/build-timing-baseline.json artifacts/build-timing-receipt.json"
-  echo "  $0 baseline.json current.json > comparison.md"
-  exit 1
-fi
-
-BASELINE_FILE="$1"
-CURRENT_FILE="$2"
-
-# Check if files exist
-if [[ ! -f "${BASELINE_FILE}" ]]; then
-  echo "Error: Baseline file not found: ${BASELINE_FILE}" >&2
-  exit 1
-fi
-
-if [[ ! -f "${CURRENT_FILE}" ]]; then
-  echo "Error: Current file not found: ${CURRENT_FILE}" >&2
-  exit 1
-fi
-
-# Check if jq is available
-if ! command -v jq &> /dev/null; then
-  echo "Error: jq is required but not installed" >&2
-  exit 1
-fi
-
-# Read JSON files
-BASELINE_JSON=$(cat "${BASELINE_FILE}")
-CURRENT_JSON=$(cat "${CURRENT_FILE}")
-
-# Extract metadata
-BASELINE_TIMESTAMP=$(echo "${BASELINE_JSON}" | jq -r '.timestamp')
-CURRENT_TIMESTAMP=$(echo "${CURRENT_JSON}" | jq -r '.timestamp')
-BASELINE_TOOLCHAIN=$(echo "${BASELINE_JSON}" | jq -r '.toolchain')
-CURRENT_TOOLCHAIN=$(echo "${CURRENT_JSON}" | jq -r '.toolchain')
-
-# Generate markdown report
-cat <<EOF
-# Build Timing Comparison
-
-**Generated:** $(date -u +"%Y-%m-%dT%H:%M:%SZ")
-
-## Metadata
-
-| Property | Baseline | Current |
-|----------|----------|---------|
-| Timestamp | ${BASELINE_TIMESTAMP} | ${CURRENT_TIMESTAMP} |
-| Toolchain | ${BASELINE_TOOLCHAIN} | ${CURRENT_TOOLCHAIN} |
-
-## Build Timing Results
-
-EOF
-
-# Get all measurement keys from both files
-BASELINE_KEYS=$(echo "${BASELINE_JSON}" | jq -r '.measurements | keys[]')
-CURRENT_KEYS=$(echo "${CURRENT_JSON}" | jq -r '.measurements | keys[]')
-
-# Combine and deduplicate keys
-ALL_KEYS=$(echo -e "${BASELINE_KEYS}\n${CURRENT_KEYS}" | sort -u)
-
-# Print table header
-echo "| Metric | Baseline | Current | Change | Improvement |"
-echo "|--------|----------|---------|---------|-------------|"
-
-# Track summary statistics
-TOTAL_METRICS=0
-IMPROVEMENTS=0
-REGRESSIONS=0
-
-# Process each measurement
-for key in ${ALL_KEYS}; do
-  TOTAL_METRICS=$((TOTAL_METRICS + 1))
-
-  # Get baseline and current values
-  BASELINE_VALUE=$(echo "${BASELINE_JSON}" | jq -r ".measurements.${key}.duration_seconds // null")
-  CURRENT_VALUE=$(echo "${CURRENT_JSON}" | jq -r ".measurements.${key}.duration_seconds // null")
-
-  # Calculate change and improvement
-  if [[ "${BASELINE_VALUE}" != "null" && "${CURRENT_VALUE}" != "null" ]]; then
-    CHANGE=$(echo "${CURRENT_VALUE} - ${BASELINE_VALUE}" | bc -l)
-    ABS_CHANGE=$(echo "${CHANGE}" | tr -d '-')
-    IMPROVEMENT=$(echo "(${BASELINE_VALUE} - ${CURRENT_VALUE}) / ${BASELINE_VALUE} * 100" | bc -l)
-
-    # Format values
-    BASELINE_FMT=$(printf "%.1fs" "${BASELINE_VALUE}")
-    CURRENT_FMT=$(printf "%.1fs" "${CURRENT_VALUE}")
-    CHANGE_FMT=$(printf "%+.1fs" "${CHANGE}")
-    IMPROVEMENT_FMT=$(printf "%.1f%%" "${IMPROVEMENT}")
-
-    # Determine if improvement or regression
-    if (( $(echo "${IMPROVEMENT} > 0" | bc -l) )); then
-      IMPROVEMENTS=$((IMPROVEMENTS + 1))
-      IMPROVEMENT_FMT="🟢 ${IMPROVEMENT_FMT}"
-    elif (( $(echo "${IMPROVEMENT} < 0" | bc -l) )); then
-      REGRESSIONS=$((REGRESSIONS + 1))
-      IMPROVEMENT_FMT="🔴 ${IMPROVEMENT_FMT}"
-    fi
-
-    echo "| ${key} | ${BASELINE_FMT} | ${CURRENT_FMT} | ${CHANGE_FMT} | ${IMPROVEMENT_FMT} |"
-  elif [[ "${BASELINE_VALUE}" != "null" ]]; then
-    # Only baseline has this metric
-    BASELINE_FMT=$(printf "%.1fs" "${BASELINE_VALUE}")
-    echo "| ${key} | ${BASELINE_FMT} | N/A | N/A | N/A |"
-  elif [[ "${CURRENT_VALUE}" != "null" ]]; then
-    # Only current has this metric
-    CURRENT_FMT=$(printf "%.1fs" "${CURRENT_VALUE}")
-    echo "| ${key} | N/A | ${CURRENT_FMT} | N/A | N/A |"
-  fi
-done
-
-# Print summary
-cat <<EOF
-
-## Summary
-
-- **Total metrics compared:** ${TOTAL_METRICS}
-- **Improvements:** ${IMPROVEMENTS}
-- **Regressions:** ${REGRESSIONS}
-
-EOF
-
-# Check for specific targets
-CLEAN_BUILD_BASE=$(echo "${BASELINE_JSON}" | jq -r '.measurements.clean_build_workspace.duration_seconds // null')
-CLEAN_BUILD_CUR=$(echo "${CURRENT_JSON}" | jq -r '.measurements.clean_build_workspace.duration_seconds // null')
-
-INCREMENTAL_BUILD_BASE=$(echo "${BASELINE_JSON}" | jq -r '.measurements.incremental_build_providers.duration_seconds // .measurements.incremental_build_parser.duration_seconds // null')
-INCREMENTAL_BUILD_CUR=$(echo "${CURRENT_JSON}" | jq -r '.measurements.incremental_build_providers.duration_seconds // .measurements.incremental_build_parser.duration_seconds // null')
-
-TEST_BUILD_BASE=$(echo "${BASELINE_JSON}" | jq -r '.measurements.test_build_workspace.duration_seconds // null')
-TEST_BUILD_CUR=$(echo "${CURRENT_JSON}" | jq -r '.measurements.test_build_workspace.duration_seconds // null')
-
-cat <<EOF
-## Target Validation
-
-EOF
-
-# Clean build target (40% faster)
-if [[ "${CLEAN_BUILD_BASE}" != "null" && "${CLEAN_BUILD_CUR}" != "null" ]]; then
-  CLEAN_IMPROVEMENT=$(echo "(${CLEAN_BUILD_BASE} - ${CLEAN_BUILD_CUR}) / ${CLEAN_BUILD_BASE} * 100" | bc -l)
-  CLEAN_TARGET_MET=$(echo "${CLEAN_IMPROVEMENT} >= 40" | bc -l)
-
-  echo "### Full Workspace Build (Target: 40% faster)"
-  echo "- Baseline: $(printf "%.1fs" "${CLEAN_BUILD_BASE}")"
-  echo "- Current: $(printf "%.1fs" "${CLEAN_BUILD_CUR}")"
-  echo "- Improvement: $(printf "%.1f%%" "${CLEAN_IMPROVEMENT}")"
-  if [[ "${CLEAN_TARGET_MET}" == "1" ]]; then
-    echo "- Status: ✅ **Target Met**"
-  else
-    echo "- Status: ❌ **Target Not Met**"
-  fi
-  echo ""
-else
-  echo "### Full Workspace Build (Target: 40% faster)"
-  echo "- Status: ⚠️ **No data available**"
-  echo ""
-fi
-
-# Incremental build target (67% faster)
-if [[ "${INCREMENTAL_BUILD_BASE}" != "null" && "${INCREMENTAL_BUILD_CUR}" != "null" ]]; then
-  INCREMENTAL_IMPROVEMENT=$(echo "(${INCREMENTAL_BUILD_BASE} - ${INCREMENTAL_BUILD_CUR}) / ${INCREMENTAL_BUILD_BASE} * 100" | bc -l)
-  INCREMENTAL_TARGET_MET=$(echo "${INCREMENTAL_IMPROVEMENT} >= 67" | bc -l)
-
-  echo "### Incremental Build (Target: 67% faster)"
-  echo "- Baseline: $(printf "%.1fs" "${INCREMENTAL_BUILD_BASE}")"
-  echo "- Current: $(printf "%.1fs" "${INCREMENTAL_BUILD_CUR}")"
-  echo "- Improvement: $(printf "%.1f%%" "${INCREMENTAL_IMPROVEMENT}")"
-  if [[ "${INCREMENTAL_TARGET_MET}" == "1" ]]; then
-    echo "- Status: ✅ **Target Met**"
-  else
-    echo "- Status: ❌ **Target Not Met**"
-  fi
-  echo ""
-else
-  echo "### Incremental Build (Target: 67% faster)"
-  echo "- Status: ⚠️ **No data available**"
-  echo ""
-fi
-
-# Test build
-if [[ "${TEST_BUILD_BASE}" != "null" && "${TEST_BUILD_CUR}" != "null" ]]; then
-  TEST_IMPROVEMENT=$(echo "(${TEST_BUILD_BASE} - ${TEST_BUILD_CUR}) / ${TEST_BUILD_BASE} * 100" | bc -l)
-
-  echo "### Test Build"
-  echo "- Baseline: $(printf "%.1fs" "${TEST_BUILD_BASE}")"
-  echo "- Current: $(printf "%.1fs" "${TEST_BUILD_CUR}")"
-  echo "- Improvement: $(printf "%.1f%%" "${TEST_IMPROVEMENT}")"
-  echo ""
-else
-  echo "### Test Build"
-  echo "- Status: ⚠️ **No data available**"
-  echo ""
-fi
+exec cargo xtask compare-build-timing "$@"
diff --git a/scripts/dead-code-check.sh b/scripts/dead-code-check.sh
index 4671568e3c..d161883bd0 100755
--- a/scripts/dead-code-check.sh
+++ b/scripts/dead-code-check.sh
@@ -1,457 +1,15 @@
 #!/usr/bin/env bash
-# Dead code detection for perl-lsp workspace
-# Combines cargo-udeps (unused dependencies) and clippy dead_code lint
+# Compatibility wrapper for dead code detection.
+# Canonical implementation: cargo xtask dead-code.
 
 set -euo pipefail
 
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-cd "$REPO_ROOT"
+if [ "$#" -eq 0 ]; then
+  set -- check
+fi
 
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-NC='\033[0m' # No Color
+if [ "${DEAD_CODE_STRICT:-false}" = "true" ] && [[ "$*" != *"--strict"* ]]; then
+  set -- "$@" --strict
+fi
 
-# Configuration
-BASELINE_FILE=".ci/dead-code-baseline.yaml"
-MODE="${1:-check}" # check, baseline, or report
-STRICT="${DEAD_CODE_STRICT:-false}"
-
-log_info() {
-    echo -e "${BLUE}[INFO]${NC} $*"
-}
-
-log_success() {
-    echo -e "${GREEN}[SUCCESS]${NC} $*"
-}
-
-log_warn() {
-    echo -e "${YELLOW}[WARN]${NC} $*"
-}
-
-log_error() {
-    echo -e "${RED}[ERROR]${NC} $*"
-}
-
-# Check if required tools are available
-check_tools() {
-    local missing_tools=()
-
-    if ! command -v cargo >/dev/null 2>&1; then
-        missing_tools+=("cargo")
-    fi
-
-    # cargo-udeps requires nightly
-    if ! rustup toolchain list | grep -q nightly; then
-        log_warn "Nightly toolchain not installed (required for cargo-udeps)"
-        log_info "Install with: rustup toolchain install nightly"
-        return 1
-    fi
-
-    if [ "${#missing_tools[@]}" -gt 0 ]; then
-        log_error "Missing required tools: ${missing_tools[*]}"
-        log_info "Install cargo: https://rustup.rs"
-        return 1
-    fi
-
-    return 0
-}
-
-# Install cargo-udeps if not present
-install_udeps() {
-    if ! cargo +nightly udeps --version >/dev/null 2>&1; then
-        log_info "Installing cargo-udeps..."
-        cargo install cargo-udeps --locked
-    fi
-}
-
-# Run cargo-machete to detect unused dependencies (fast)
-check_unused_deps_machete() {
-    log_info "Checking for unused dependencies with cargo-machete..."
-
-    local output_file="target/dead-code/machete-output.txt"
-    mkdir -p "$(dirname "$output_file")"
-
-    if cargo machete 2>&1 | tee "$output_file"; then
-        if grep -q "unused dependencies" "$output_file"; then
-            local unused_count
-            unused_count=$(grep -c "Cargo.toml:" "$output_file") || unused_count=0
-            log_warn "Found $unused_count crates with unused dependencies"
-            return 0
-        else
-            log_success "No unused dependencies detected by machete"
-            return 0
-        fi
-    else
-        log_error "cargo-machete failed to run"
-        return 1
-    fi
-}
-
-# Run cargo-udeps to detect unused dependencies (deep)
-check_unused_deps_udeps() {
-    log_info "Checking for unused dependencies with cargo-udeps..."
-
-    local output_file="target/dead-code/udeps-output.txt"
-    mkdir -p "$(dirname "$output_file")"
-
-    # Run cargo-udeps on all workspace members
-    # Note: cargo-udeps requires nightly Rust
-    if cargo +nightly udeps --workspace --all-targets --locked 2>&1 | tee "$output_file"; then
-        local unused_count
-        unused_count=$(grep -c "unused" "$output_file") || unused_count=0
-
-        if [ "$unused_count" -eq 0 ]; then
-            log_success "No unused dependencies detected"
-            return 0
-        else
-            log_warn "Found $unused_count unused dependency warnings"
-            if [ "$MODE" = "check" ] && [ "$STRICT" = "true" ]; then
-                return 1
-            fi
-            return 0
-        fi
-    else
-        log_error "cargo-udeps failed to run"
-        return 1
-    fi
-}
-
-# Run clippy with dead_code lint
-check_dead_code_clippy() {
-    log_info "Checking for dead code with clippy..."
-
-    local output_file="target/dead-code/clippy-dead-code.txt"
-    mkdir -p "$(dirname "$output_file")"
-
-    # Run clippy with dead_code warnings
-    # We only check libraries and bins, not tests
-    if cargo clippy --workspace --lib --bins --locked \
-        -- -W dead_code -W unused_imports -W unused_variables \
-        2>&1 | tee "$output_file"; then
-
-        local dead_code_count
-        dead_code_count=$(grep -c "dead_code" "$output_file") || dead_code_count=0
-
-        if [ "$dead_code_count" -eq 0 ]; then
-            log_success "No dead code detected by clippy"
-            return 0
-        else
-            log_warn "Found $dead_code_count dead code warnings"
-            if [ "$MODE" = "check" ] && [ "$STRICT" = "true" ]; then
-                return 1
-            fi
-            return 0
-        fi
-    else
-        # Clippy may exit with error if there are warnings, that's expected
-        local dead_code_count
-        dead_code_count=$(grep -c "dead_code" "$output_file") || dead_code_count=0
-
-        if [ "$dead_code_count" -gt 0 ]; then
-            log_warn "Found $dead_code_count dead code warnings"
-        fi
-
-        # Don't fail on clippy warnings in non-strict mode
-        if [ "$STRICT" = "false" ]; then
-            return 0
-        fi
-        return 1
-    fi
-}
-
-# Generate baseline file
-generate_baseline() {
-    log_info "Generating dead code baseline..."
-
-    mkdir -p "$(dirname "$BASELINE_FILE")"
-
-    # Run checks and capture output
-    local udeps_output="target/dead-code/udeps-output.txt"
-    local clippy_output="target/dead-code/clippy-dead-code.txt"
-
-    mkdir -p target/dead-code
-
-    # Capture udeps results (don't fail on errors)
-    cargo +nightly udeps --workspace --all-targets --locked > "$udeps_output" 2>&1 || true
-
-    # Capture clippy results (don't fail on errors)
-    cargo clippy --workspace --lib --bins --locked \
-        -- -W dead_code -W unused_imports -W unused_variables \
-        > "$clippy_output" 2>&1 || true
-
-    # Count issues
-    local unused_deps_count
-    unused_deps_count=$(grep -c "unused" "$udeps_output") || unused_deps_count=0
-
-    local dead_code_count
-    dead_code_count=$(grep -c "dead_code" "$clippy_output") || dead_code_count=0
-
-    local unused_imports_count
-    unused_imports_count=$(grep -c "unused_imports" "$clippy_output") || unused_imports_count=0
-
-    local unused_vars_count
-    unused_vars_count=$(grep -c "unused_variables" "$clippy_output") || unused_vars_count=0
-
-    # Generate YAML baseline
-    cat > "$BASELINE_FILE" <<EOF
-# Dead Code Detection Baseline
-# Generated: $(date -u +"%Y-%m-%d %H:%M:%S UTC")
-#
-# This file tracks the baseline for dead code detection.
-# When new dead code is introduced, the checks will fail.
-#
-# To update this baseline: just dead-code-baseline
-
-schema_version: 1
-last_updated: "$(date -u +"%Y-%m-%d")"
-
-# Thresholds (fail if exceeded)
-thresholds:
-  # Maximum allowed unused dependencies
-  max_unused_dependencies: 5
-
-  # Maximum allowed dead code items (functions, types, etc.)
-  max_dead_code_items: 10
-
-  # Maximum allowed unused imports
-  max_unused_imports: 20
-
-  # Maximum allowed unused variables
-  max_unused_variables: 10
-
-# Current baseline counts
-baseline:
-  unused_dependencies: $unused_deps_count
-  dead_code_items: $dead_code_count
-  unused_imports: $unused_imports_count
-  unused_variables: $unused_vars_count
-
-# Allowed exceptions (items that are intentionally unused)
-allowed_exceptions:
-  # Example: functions that are part of public API but not used internally
-  # - crate: perl-parser
-  #   type: function
-  #   name: parse_legacy_syntax
-  #   reason: "Public API for backward compatibility"
-
-  # Example: dependencies used only in specific build configurations
-  # - crate: perl-lsp
-  #   dependency: tokio
-  #   reason: "Used in async runtime feature"
-
-# Known issues to be addressed
-known_issues:
-  # Track specific dead code items that need cleanup
-  # - crate: perl-parser-core
-  #   type: dead_code
-  #   item: legacy_parser_function
-  #   issue: "#XXX"
-  #   notes: "Remove after migration to v3 parser"
-
-# Policy
-policy:
-  # Enforcement level: strict, warn, or disabled
-  enforcement: warn
-
-  # Auto-update baseline on PR (requires manual approval)
-  auto_update_baseline: false
-
-  # Fail CI if baseline is exceeded
-  fail_on_baseline_exceeded: true
-
-  # Warn if approaching threshold (80% of max)
-  warn_threshold_percent: 80
-
-# Maintenance
-maintenance:
-  # Review dead code baseline every N days
-  review_interval_days: 30
-
-  # Next scheduled review
-  next_review: "$(date -u -d '+30 days' +"%Y-%m-%d" 2>/dev/null || date -v+30d -u +"%Y-%m-%d")"
-EOF
-
-    log_success "Baseline saved to $BASELINE_FILE"
-    echo ""
-    log_info "Current counts:"
-    echo "  Unused dependencies: $unused_deps_count"
-    echo "  Dead code items:     $dead_code_count"
-    echo "  Unused imports:      $unused_imports_count"
-    echo "  Unused variables:    $unused_vars_count"
-}
-
-# Compare current state against baseline
-check_against_baseline() {
-    if [ ! -f "$BASELINE_FILE" ]; then
-        log_warn "No baseline file found at $BASELINE_FILE"
-        log_info "Generate baseline with: just dead-code-baseline"
-        return 0
-    fi
-
-    log_info "Checking against baseline..."
-
-    # Run current checks
-    local udeps_output="target/dead-code/udeps-output.txt"
-    local clippy_output="target/dead-code/clippy-dead-code.txt"
-
-    mkdir -p target/dead-code
-
-    cargo +nightly udeps --workspace --all-targets --locked > "$udeps_output" 2>&1 || true
-    cargo clippy --workspace --lib --bins --locked \
-        -- -W dead_code -W unused_imports -W unused_variables \
-        > "$clippy_output" 2>&1 || true
-
-    # Count current issues
-    local current_unused_deps
-    current_unused_deps=$(grep -c "unused" "$udeps_output") || current_unused_deps=0
-
-    local current_dead_code
-    current_dead_code=$(grep -c "dead_code" "$clippy_output") || current_dead_code=0
-
-    # Extract baseline values
-    local baseline_unused_deps
-    baseline_unused_deps=$(grep "unused_dependencies:" "$BASELINE_FILE" | awk '{print $2}')
-
-    local baseline_dead_code
-    baseline_dead_code=$(grep "dead_code_items:" "$BASELINE_FILE" | awk '{print $2}')
-
-    # Extract thresholds
-    local max_unused_deps
-    max_unused_deps=$(grep "max_unused_dependencies:" "$BASELINE_FILE" | awk '{print $2}')
-
-    local max_dead_code
-    max_dead_code=$(grep "max_dead_code_items:" "$BASELINE_FILE" | awk '{print $2}')
-
-    log_info "Comparison:"
-    echo "  Unused dependencies: $current_unused_deps (baseline: $baseline_unused_deps, max: $max_unused_deps)"
-    echo "  Dead code items:     $current_dead_code (baseline: $baseline_dead_code, max: $max_dead_code)"
-
-    local failed=false
-
-    # Check if current exceeds thresholds
-    if [ "$current_unused_deps" -gt "$max_unused_deps" ]; then
-        log_error "Unused dependencies ($current_unused_deps) exceeds threshold ($max_unused_deps)"
-        failed=true
-    fi
-
-    if [ "$current_dead_code" -gt "$max_dead_code" ]; then
-        log_error "Dead code items ($current_dead_code) exceeds threshold ($max_dead_code)"
-        failed=true
-    fi
-
-    # Check if current exceeds baseline (regression)
-    if [ "$current_unused_deps" -gt "$baseline_unused_deps" ]; then
-        log_warn "Unused dependencies increased from $baseline_unused_deps to $current_unused_deps"
-        if [ "$STRICT" = "true" ]; then
-            failed=true
-        fi
-    fi
-
-    if [ "$current_dead_code" -gt "$baseline_dead_code" ]; then
-        log_warn "Dead code increased from $baseline_dead_code to $current_dead_code"
-        if [ "$STRICT" = "true" ]; then
-            failed=true
-        fi
-    fi
-
-    if [ "$failed" = "true" ]; then
-        log_error "Dead code checks failed"
-        return 1
-    fi
-
-    log_success "Dead code checks passed"
-    return 0
-}
-
-# Generate JSON report for CI integration
-generate_report() {
-    log_info "Generating JSON report..."
-
-    local report_file="target/dead-code/report.json"
-    mkdir -p "$(dirname "$report_file")"
-
-    # Run checks
-    local udeps_output="target/dead-code/udeps-output.txt"
-    local clippy_output="target/dead-code/clippy-dead-code.txt"
-
-    cargo +nightly udeps --workspace --all-targets --locked > "$udeps_output" 2>&1 || true
-    cargo clippy --workspace --lib --bins --locked \
-        -- -W dead_code -W unused_imports -W unused_variables \
-        > "$clippy_output" 2>&1 || true
-
-    local unused_deps
-    unused_deps=$(grep -c "unused" "$udeps_output") || unused_deps=0
-
-    local dead_code
-    dead_code=$(grep -c "dead_code" "$clippy_output") || dead_code=0
-
-    local unused_imports
-    unused_imports=$(grep -c "unused_imports" "$clippy_output") || unused_imports=0
-
-    local unused_vars
-    unused_vars=$(grep -c "unused_variables" "$clippy_output") || unused_vars=0
-
-    # Generate JSON
-    cat > "$report_file" <<EOF
-{
-  "schema_version": 1,
-  "timestamp": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")",
-  "results": {
-    "unused_dependencies": $unused_deps,
-    "dead_code_items": $dead_code,
-    "unused_imports": $unused_imports,
-    "unused_variables": $unused_vars,
-    "total_issues": $((unused_deps + dead_code + unused_imports + unused_vars))
-  },
-  "details": {
-    "udeps_output": "$udeps_output",
-    "clippy_output": "$clippy_output"
-  }
-}
-EOF
-
-    log_success "Report saved to $report_file"
-    cat "$report_file"
-}
-
-# Main execution
-main() {
-    log_info "Dead Code Detection (mode: $MODE)"
-    echo ""
-
-    if ! check_tools; then
-        log_error "Prerequisites not met"
-        exit 1
-    fi
-
-    case "$MODE" in
-        baseline)
-            install_udeps
-            generate_baseline
-            ;;
-        report)
-            install_udeps
-            generate_report
-            ;;
-        check)
-            if [ -f "$BASELINE_FILE" ]; then
-                check_against_baseline
-            else
-                log_info "No baseline file, running basic checks..."
-                check_unused_deps_machete
-                check_dead_code_clippy
-            fi
-            ;;
-        *)
-            log_error "Unknown mode: $MODE"
-            log_info "Usage: $0 [check|baseline|report]"
-            exit 1
-            ;;
-    esac
-}
-
-main "$@"
+exec cargo xtask dead-code "$@"
diff --git a/scripts/debt-pr-summary.py b/scripts/debt-pr-summary.py
index d0c577e226..5d954260b7 100755
--- a/scripts/debt-pr-summary.py
+++ b/scripts/debt-pr-summary.py
@@ -1,25 +1,24 @@
 #!/usr/bin/env python3
-"""
-Generate a markdown-formatted debt summary suitable for PR comments.
 
-Reads JSON from stdin (from debt-report.py --json) and outputs markdown table.
-"""
+"""Compatibility shim for PR debt summary output."""
 
 import json
+import subprocess
 import sys
+from pathlib import Path
 
 
-def main():
+def _print_summary_from_json(raw: str) -> int:
     try:
-        r = json.load(sys.stdin)
-    except json.JSONDecodeError as e:
-        print(f"Error: Invalid JSON input: {e}", file=sys.stderr)
-        sys.exit(1)
+        payload = json.loads(raw)
+    except json.JSONDecodeError as err:
+        print(f"Error: Invalid JSON input: {err}", file=sys.stderr)
+        return 1
 
-    s = r.get("summary", {})
-    q = s.get("quarantined_tests", {})
-    k = s.get("known_issues", {})
-    t = s.get("technical_debt", {})
+    summary = payload.get("summary", {})
+    q = summary.get("quarantined_tests", {})
+    k = summary.get("known_issues", {})
+    t = summary.get("technical_debt", {})
 
     print("| Category | Count | Budget | Status |")
     print("|----------|-------|--------|--------|")
@@ -31,6 +30,15 @@ def main():
         print("")
         print(f"**Warning:** {q['expired']} expired quarantine(s) need attention!")
 
+    return 0
+
 
 if __name__ == "__main__":
-    main()
+    raw = sys.stdin.read()
+    if raw.strip():
+        raise SystemExit(_print_summary_from_json(raw))
+
+    repo_root = Path(__file__).resolve().parents[1]
+    raise SystemExit(
+        subprocess.call(["cargo", "xtask", "debt-report", "--summary"], cwd=repo_root)
+    )
diff --git a/scripts/debt-report.py b/scripts/debt-report.py
index 6b881865ef..79df3b8251 100755
--- a/scripts/debt-report.py
+++ b/scripts/debt-report.py
@@ -1,436 +1,14 @@
 #!/usr/bin/env python3
-"""
-Debt Ledger Report Generator
 
-Reads .ci/debt-ledger.yaml and generates a report on current technical debt,
-flaky tests, and known issues. Can be used for:
-  - Console output (just debt-report)
-  - CI gates (just debt-check)
-  - Receipt integration (json output)
+"""Compatibility shim for `cargo xtask debt-report`."""
 
-Usage:
-    python3 scripts/debt-report.py              # Console report
-    python3 scripts/debt-report.py --check      # CI gate (exit 1 if over budget)
-    python3 scripts/debt-report.py --json       # JSON output for receipts
-    python3 scripts/debt-report.py --expired    # Show expired quarantines only
-"""
-
-import argparse
-import json
-import os
+import subprocess
 import sys
-from datetime import datetime, timedelta, timezone
 from pathlib import Path
-from typing import Any
-
-# Try to import yaml, fall back to basic parsing if not available
-try:
-    import yaml
-    HAS_YAML = True
-except ImportError:
-    HAS_YAML = False
-
-
-def parse_yaml_simple(content: str) -> dict[str, Any]:
-    """Simple YAML parser for basic structures (fallback when PyYAML unavailable)."""
-    # This is a very basic parser that handles the debt ledger structure
-    # For production use, PyYAML should be installed
-    result: dict[str, Any] = {
-        "schema_version": 1,
-        "budgets": {
-            "max_quarantined_tests": 10,
-            "max_known_issues": 20,
-            "max_technical_debt": 30,
-            "warning_threshold_percent": 80,
-            "critical_threshold_percent": 95,
-        },
-        "flaky_tests": [],
-        "known_issues": [],
-        "technical_debt": [],
-    }
-
-    # Extract budget values with regex-like parsing
-    import re
-
-    for line in content.split("\n"):
-        line = line.strip()
-        if line.startswith("max_quarantined_tests:"):
-            match = re.search(r":\s*(\d+)", line)
-            if match:
-                result["budgets"]["max_quarantined_tests"] = int(match.group(1))
-        elif line.startswith("max_known_issues:"):
-            match = re.search(r":\s*(\d+)", line)
-            if match:
-                result["budgets"]["max_known_issues"] = int(match.group(1))
-        elif line.startswith("max_technical_debt:"):
-            match = re.search(r":\s*(\d+)", line)
-            if match:
-                result["budgets"]["max_technical_debt"] = int(match.group(1))
-
-    # For the list sections, we need more complex parsing
-    # This fallback is intentionally simple - use PyYAML for full support
-
-    return result
-
-
-def load_ledger(ledger_path: Path) -> dict[str, Any]:
-    """Load and parse the debt ledger YAML file."""
-    if not ledger_path.exists():
-        return {
-            "schema_version": 1,
-            "budgets": {
-                "max_quarantined_tests": 10,
-                "max_known_issues": 20,
-                "max_technical_debt": 30,
-                "warning_threshold_percent": 80,
-                "critical_threshold_percent": 95,
-            },
-            "flaky_tests": [],
-            "known_issues": [],
-            "technical_debt": [],
-        }
-
-    content = ledger_path.read_text()
-
-    if HAS_YAML:
-        return yaml.safe_load(content)
-    else:
-        print("Warning: PyYAML not installed, using basic parser", file=sys.stderr)
-        return parse_yaml_simple(content)
-
-
-def calculate_expiry(item: dict[str, Any]) -> datetime | None:
-    """Calculate expiry date for a quarantined item."""
-    if "expires" in item:
-        try:
-            return datetime.strptime(item["expires"], "%Y-%m-%d")
-        except (ValueError, TypeError):
-            pass
-
-    if "added" in item and "quarantine_days" in item:
-        try:
-            added = datetime.strptime(item["added"], "%Y-%m-%d")
-            return added + timedelta(days=item["quarantine_days"])
-        except (ValueError, TypeError):
-            pass
-
-    return None
-
-
-def is_expired(item: dict[str, Any], now: datetime) -> bool:
-    """Check if a quarantined item has expired."""
-    expiry = calculate_expiry(item)
-    return expiry is not None and expiry < now
-
-
-def days_until_expiry(item: dict[str, Any], now: datetime) -> int | None:
-    """Get days until expiry (negative if expired)."""
-    expiry = calculate_expiry(item)
-    if expiry is None:
-        return None
-    return (expiry - now).days
-
-
-def count_by_status(items: list[dict[str, Any]], status: str) -> int:
-    """Count items with a specific status."""
-    return sum(1 for item in items if item.get("status") == status)
-
-
-def count_by_priority(items: list[dict[str, Any]], priority: str) -> int:
-    """Count items with a specific priority."""
-    return sum(1 for item in items if item.get("priority") == priority)
-
-
-def generate_report(ledger: dict[str, Any], now: datetime) -> dict[str, Any]:
-    """Generate a comprehensive debt report."""
-    budgets = ledger.get("budgets", {})
-    flaky_tests = ledger.get("flaky_tests", []) or []
-    known_issues = ledger.get("known_issues", []) or []
-    technical_debt = ledger.get("technical_debt", []) or []
-
-    # Count items
-    quarantined_count = len(flaky_tests)
-    known_issues_count = len(known_issues)
-    tech_debt_count = len(technical_debt)
-
-    # Budget limits
-    max_quarantined = budgets.get("max_quarantined_tests", 10)
-    max_issues = budgets.get("max_known_issues", 20)
-    max_debt = budgets.get("max_technical_debt", 30)
-    warning_pct = budgets.get("warning_threshold_percent", 80)
-    critical_pct = budgets.get("critical_threshold_percent", 95)
-
-    # Calculate percentages
-    quarantine_pct = (quarantined_count / max_quarantined * 100) if max_quarantined > 0 else 0
-    issues_pct = (known_issues_count / max_issues * 100) if max_issues > 0 else 0
-    debt_pct = (tech_debt_count / max_debt * 100) if max_debt > 0 else 0
-
-    # Find expired quarantines
-    expired_quarantines = [item for item in flaky_tests if is_expired(item, now)]
-    expiring_soon = [
-        item
-        for item in flaky_tests
-        if not is_expired(item, now)
-        and days_until_expiry(item, now) is not None
-        and 0 <= (days_until_expiry(item, now) or 0) <= 7
-    ]
-
-    # Determine status
-    def get_status(pct: float) -> str:
-        if pct >= critical_pct:
-            return "critical"
-        elif pct >= warning_pct:
-            return "warning"
-        else:
-            return "ok"
-
-    overall_status = "ok"
-    if any(get_status(p) == "critical" for p in [quarantine_pct, issues_pct, debt_pct]):
-        overall_status = "critical"
-    elif any(get_status(p) == "warning" for p in [quarantine_pct, issues_pct, debt_pct]):
-        overall_status = "warning"
-
-    # Add expired quarantine check
-    if expired_quarantines:
-        overall_status = "critical"
-
-    return {
-        "timestamp": now.isoformat() + "Z",
-        "schema_version": ledger.get("schema_version", 1),
-        "summary": {
-            "overall_status": overall_status,
-            "quarantined_tests": {
-                "count": quarantined_count,
-                "budget": max_quarantined,
-                "percent": round(quarantine_pct, 1),
-                "status": get_status(quarantine_pct),
-                "expired": len(expired_quarantines),
-                "expiring_soon": len(expiring_soon),
-            },
-            "known_issues": {
-                "count": known_issues_count,
-                "budget": max_issues,
-                "percent": round(issues_pct, 1),
-                "status": get_status(issues_pct),
-                "by_status": {
-                    "accepted": count_by_status(known_issues, "accepted"),
-                    "deferred": count_by_status(known_issues, "deferred"),
-                    "monitoring": count_by_status(known_issues, "monitoring"),
-                    "wontfix": count_by_status(known_issues, "wontfix"),
-                },
-            },
-            "technical_debt": {
-                "count": tech_debt_count,
-                "budget": max_debt,
-                "percent": round(debt_pct, 1),
-                "status": get_status(debt_pct),
-                "by_priority": {
-                    "critical": count_by_priority(technical_debt, "critical"),
-                    "high": count_by_priority(technical_debt, "high"),
-                    "medium": count_by_priority(technical_debt, "medium"),
-                    "low": count_by_priority(technical_debt, "low"),
-                },
-            },
-        },
-        "alerts": [],
-        "details": {
-            "expired_quarantines": [
-                {
-                    "name": item.get("name"),
-                    "issue": item.get("issue"),
-                    "expired": calculate_expiry(item).strftime("%Y-%m-%d") if calculate_expiry(item) else None,
-                    "days_overdue": -1 * (days_until_expiry(item, now) or 0),
-                }
-                for item in expired_quarantines
-            ],
-            "expiring_soon": [
-                {
-                    "name": item.get("name"),
-                    "issue": item.get("issue"),
-                    "expires": calculate_expiry(item).strftime("%Y-%m-%d") if calculate_expiry(item) else None,
-                    "days_remaining": days_until_expiry(item, now),
-                }
-                for item in expiring_soon
-            ],
-            "critical_debt": [
-                {
-                    "area": item.get("area"),
-                    "description": item.get("description"),
-                    "issue": item.get("issue"),
-                }
-                for item in technical_debt
-                if item.get("priority") == "critical"
-            ],
-        },
-    }
-
-
-def format_console_report(report: dict[str, Any]) -> str:
-    """Format report for console output."""
-    lines = []
-    summary = report["summary"]
-
-    # Status colors (ANSI)
-    colors = {
-        "ok": "\033[32m",      # Green
-        "warning": "\033[33m", # Yellow
-        "critical": "\033[31m", # Red
-        "reset": "\033[0m",
-    }
-
-    def status_color(status: str) -> str:
-        return colors.get(status, "") + status.upper() + colors["reset"]
-
-    lines.append("=" * 60)
-    lines.append("           Technical Debt Report")
-    lines.append("=" * 60)
-    lines.append(f"Generated: {report['timestamp']}")
-    lines.append(f"Overall Status: {status_color(summary['overall_status'])}")
-    lines.append("")
-
-    # Quarantined Tests
-    q = summary["quarantined_tests"]
-    lines.append(f"Quarantined Tests: {q['count']}/{q['budget']} ({q['percent']}%) [{status_color(q['status'])}]")
-    if q["expired"] > 0:
-        lines.append(f"  {colors['critical']}EXPIRED: {q['expired']} quarantine(s) need resolution!{colors['reset']}")
-    if q["expiring_soon"] > 0:
-        lines.append(f"  {colors['warning']}Expiring soon: {q['expiring_soon']} within 7 days{colors['reset']}")
-
-    # Known Issues
-    k = summary["known_issues"]
-    lines.append(f"Known Issues: {k['count']}/{k['budget']} ({k['percent']}%) [{status_color(k['status'])}]")
-    by_status = k["by_status"]
-    if any(by_status.values()):
-        status_parts = [f"{s}: {c}" for s, c in by_status.items() if c > 0]
-        lines.append(f"  {', '.join(status_parts)}")
-
-    # Technical Debt
-    t = summary["technical_debt"]
-    lines.append(f"Technical Debt: {t['count']}/{t['budget']} ({t['percent']}%) [{status_color(t['status'])}]")
-    by_priority = t["by_priority"]
-    if any(by_priority.values()):
-        priority_parts = [f"{p}: {c}" for p, c in by_priority.items() if c > 0]
-        lines.append(f"  {', '.join(priority_parts)}")
-
-    # Details
-    details = report["details"]
-
-    if details["expired_quarantines"]:
-        lines.append("")
-        lines.append(f"{colors['critical']}Expired Quarantines (action required):{colors['reset']}")
-        for item in details["expired_quarantines"]:
-            issue = f" ({item['issue']})" if item.get("issue") else ""
-            lines.append(f"  - {item['name']}{issue}: {item['days_overdue']} days overdue")
-
-    if details["expiring_soon"]:
-        lines.append("")
-        lines.append(f"{colors['warning']}Expiring Soon:{colors['reset']}")
-        for item in details["expiring_soon"]:
-            issue = f" ({item['issue']})" if item.get("issue") else ""
-            lines.append(f"  - {item['name']}{issue}: {item['days_remaining']} days remaining")
-
-    if details["critical_debt"]:
-        lines.append("")
-        lines.append(f"{colors['critical']}Critical Technical Debt:{colors['reset']}")
-        for item in details["critical_debt"]:
-            issue = f" ({item['issue']})" if item.get("issue") else ""
-            lines.append(f"  - [{item['area']}] {item['description']}{issue}")
-
-    lines.append("")
-    lines.append("=" * 60)
-    lines.append("Run `just debt-check` to verify debt budget compliance")
-    lines.append("Edit `.ci/debt-ledger.yaml` to add/remove tracked items")
-    lines.append("=" * 60)
-
-    return "\n".join(lines)
-
-
-def main():
-    parser = argparse.ArgumentParser(
-        description="Generate technical debt report from debt ledger"
-    )
-    parser.add_argument(
-        "--check",
-        action="store_true",
-        help="CI gate mode: exit 1 if over budget or expired quarantines",
-    )
-    parser.add_argument(
-        "--json",
-        action="store_true",
-        help="Output JSON format for receipt integration",
-    )
-    parser.add_argument(
-        "--expired",
-        action="store_true",
-        help="Show only expired quarantines",
-    )
-    parser.add_argument(
-        "--ledger",
-        type=Path,
-        default=None,
-        help="Path to debt ledger (default: .ci/debt-ledger.yaml)",
-    )
-
-    args = parser.parse_args()
-
-    # Find repo root and ledger
-    script_dir = Path(__file__).parent
-    repo_root = script_dir.parent
-    ledger_path = args.ledger or (repo_root / ".ci" / "debt-ledger.yaml")
-
-    # Load ledger
-    ledger = load_ledger(ledger_path)
-
-    # Generate report
-    now = datetime.now(timezone.utc).replace(tzinfo=None)
-    report = generate_report(ledger, now)
-
-    # Handle expired-only mode
-    if args.expired:
-        expired = report["details"]["expired_quarantines"]
-        if args.json:
-            print(json.dumps(expired, indent=2))
-        else:
-            if expired:
-                print("Expired Quarantines:")
-                for item in expired:
-                    print(f"  - {item['name']}: {item['days_overdue']} days overdue")
-                sys.exit(1)
-            else:
-                print("No expired quarantines")
-        sys.exit(0)
-
-    # Output format
-    if args.json:
-        print(json.dumps(report, indent=2))
-    else:
-        print(format_console_report(report))
-
-    # Check mode - exit 1 if over budget or expired
-    if args.check:
-        summary = report["summary"]
-        failures = []
-
-        # Check expired quarantines
-        expired_count = summary["quarantined_tests"]["expired"]
-        if expired_count > 0:
-            failures.append(f"{expired_count} expired quarantine(s)")
-
-        # Check budgets at critical level
-        if summary["quarantined_tests"]["status"] == "critical":
-            failures.append("quarantined tests at critical level")
-        if summary["known_issues"]["status"] == "critical":
-            failures.append("known issues at critical level")
-        if summary["technical_debt"]["status"] == "critical":
-            failures.append("technical debt at critical level")
-
-        if failures:
-            print(f"\nDebt check FAILED: {', '.join(failures)}", file=sys.stderr)
-            sys.exit(1)
-        else:
-            print("\nDebt check PASSED")
-            sys.exit(0)
 
 
 if __name__ == "__main__":
-    main()
+    repo_root = Path(__file__).resolve().parents[1]
+    raise SystemExit(
+        subprocess.call(["cargo", "xtask", "debt-report", *sys.argv[1:]], cwd=repo_root)
+    )
diff --git a/scripts/devex-doctor.sh b/scripts/devex-doctor.sh
index d8937d1bb0..5c489fc52c 100755
--- a/scripts/devex-doctor.sh
+++ b/scripts/devex-doctor.sh
@@ -1,115 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-pass() { printf '✅ %s\n' "$1"; }
-warn() { printf '⚠️  %s\n' "$1"; }
-fail() { printf '❌ %s\n' "$1"; }
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 
-has_cmd() {
-  command -v "$1" >/dev/null 2>&1
-}
-
-check_cmd() {
-  local cmd="$1"
-  local label="$2"
-  if has_cmd "$cmd"; then
-    pass "$label: found ($(command -v "$cmd"))"
-    return 0
-  fi
-  warn "$label: not found"
-  return 1
-}
-
-check_rust_component() {
-  local component="$1"
-  if ! has_cmd rustup; then
-    warn "rustup unavailable; cannot verify component '$component'"
-    return 1
-  fi
-
-  if rustup component list --installed 2>/dev/null | awk '{print $1}' | grep -Eq "^${component}(-|$)"; then
-    pass "rustup component installed: $component"
-    return 0
-  fi
-
-  warn "rustup component missing: $component (install: rustup component add $component)"
-  return 1
-}
-
-check_githook() {
-  local hook_path=".git/hooks/pre-push"
-  if [ -x "$hook_path" ]; then
-    pass "pre-push git hook installed: $hook_path"
-  else
-    warn "pre-push git hook not installed (run: bash scripts/install-githooks.sh)"
-  fi
-}
-
-show_version() {
-  local label="$1"
-  shift
-  if "$@" >/dev/null 2>&1; then
-    local out
-    out=$("$@" 2>/dev/null | head -n1)
-    pass "$label version: $out"
-  else
-    warn "$label version check failed"
-  fi
-}
-
-MISSING_REQUIRED=0
-
-echo "Repository: $(pwd)"
-
-echo
-printf '== Required ==\n'
-if ! check_cmd cargo "cargo"; then MISSING_REQUIRED=1; fi
-if ! check_cmd rustfmt "rustfmt"; then MISSING_REQUIRED=1; fi
-if ! check_cmd rustup "rustup"; then MISSING_REQUIRED=1; fi
-
-show_version "rustc" rustc --version
-show_version "cargo" cargo --version
-
-echo
-printf '== Recommended ==\n'
-check_cmd just "just" || true
-check_cmd nix "nix" || true
-check_cmd git "git" || true
-check_cmd rg "ripgrep (rg)" || true
-check_cmd cargo-audit "cargo-audit" || true
-check_githook
-
-echo
-printf '== Rust components ==\n'
-check_rust_component rustfmt || true
-check_rust_component clippy || true
-
-if [ -f rust-toolchain.toml ]; then
-  TOOLCHAIN=$(awk -F'"' '/channel/{print $2; exit}' rust-toolchain.toml)
-  if [ -n "${TOOLCHAIN:-}" ]; then
-    pass "Pinned toolchain: $TOOLCHAIN"
-    if ! bash scripts/check-rust-toolchain.sh doctor; then
-      MISSING_REQUIRED=1
-    fi
-  else
-    warn "Could not parse rust-toolchain.toml"
-  fi
-else
-  warn "rust-toolchain.toml not found"
-fi
-
-echo
-printf '== Suggested next commands ==\n'
-echo "  just devex            # quick environment diagnostics"
-echo "  just pr-fast          # fast validation before a full gate"
-echo "  just ci-gate          # repo-native local gate"
-echo "  nix develop -c just ci-gate"
-
-if [ "$MISSING_REQUIRED" -ne 0 ]; then
-  echo
-  fail "Missing required tools. Install Rust via https://rustup.rs"
-  exit 1
-fi
-
-echo
-pass "Doctor completed: required tooling is available"
+cd "$REPO_ROOT"
+exec cargo xtask devex-doctor
diff --git a/scripts/devex-targeted-checks.sh b/scripts/devex-targeted-checks.sh
index ee6cc593f0..5c74075ed3 100755
--- a/scripts/devex-targeted-checks.sh
+++ b/scripts/devex-targeted-checks.sh
@@ -1,124 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-usage() {
-  cat <<'USAGE'
-Usage: scripts/devex-targeted-checks.sh [--base <git-ref>] [--mode <clippy|test|all>]
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$REPO_ROOT"
 
-Runs fast, targeted checks only for crates changed since <git-ref>.
-
-Options:
-  --base <git-ref>   Base reference for diff (default: origin/master, fallback: HEAD~1)
-  --mode <mode>      Check mode: clippy, test, or all (default: all)
-  -h, --help         Show this help
-USAGE
-}
-
-BASE_REF="origin/master"
-MODE="all"
-
-while (($# > 0)); do
-  case "$1" in
-    --base)
-      BASE_REF="${2:-}"
-      shift 2
-      ;;
-    --mode)
-      MODE="${2:-}"
-      shift 2
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "Unknown argument: $1" >&2
-      usage >&2
-      exit 2
-      ;;
-  esac
-done
-
-if [[ -z "$BASE_REF" ]]; then
-  echo "--base requires a non-empty git reference" >&2
-  exit 2
-fi
-
-if [[ "$MODE" != "clippy" && "$MODE" != "test" && "$MODE" != "all" ]]; then
-  echo "--mode must be one of: clippy, test, all" >&2
-  exit 2
-fi
-
-if ! git rev-parse --verify "$BASE_REF" >/dev/null 2>&1; then
-  echo "⚠️  Base ref '$BASE_REF' not found; falling back to HEAD~1"
-  BASE_REF="HEAD~1"
-fi
-
-if ! git rev-parse --verify "$BASE_REF" >/dev/null 2>&1; then
-  echo "❌ Could not resolve a valid base ref (tried origin/master and HEAD~1)" >&2
-  exit 1
-fi
-
-mapfile -t crate_dirs < <(
-  git diff --name-only "$BASE_REF"...HEAD \
-    | rg '^crates/[^/]+/' -o \
-    | cut -d/ -f1-2 \
-    | sort -u
-)
-
-if (( ${#crate_dirs[@]} == 0 )); then
-  echo "✅ No crate changes detected since $BASE_REF; skipping targeted checks"
-  exit 0
-fi
-
-packages=()
-for dir in "${crate_dirs[@]}"; do
-  manifest="$dir/Cargo.toml"
-  if [[ ! -f "$manifest" ]]; then
-    continue
-  fi
-
-  pkg_name=$(awk -F' *= *' '
-    /^\[package\]$/ { in_package=1; next }
-    /^\[/ && $0 !~ /^\[package\]$/ { in_package=0 }
-    in_package && /^name *=/ {
-      gsub(/"/, "", $2)
-      print $2
-      exit
-    }
-  ' "$manifest")
-
-  if [[ -n "$pkg_name" ]]; then
-    packages+=("$pkg_name")
-  fi
-done
-
-if (( ${#packages[@]} == 0 )); then
-  echo "⚠️  Changed crates found, but no package names could be resolved"
-  exit 1
-fi
-
-mapfile -t uniq_packages < <(printf '%s\n' "${packages[@]}" | sort -u)
-
-package_args=()
-for pkg in "${uniq_packages[@]}"; do
-  package_args+=("-p" "$pkg")
-done
-
-echo "Detected changed packages since $BASE_REF:"
-printf '  - %s\n' "${uniq_packages[@]}"
-
-if [[ "$MODE" == "clippy" || "$MODE" == "all" ]]; then
-  echo
-  echo "▶ Running clippy for changed packages"
-  cargo clippy "${package_args[@]}" --locked -- -D warnings -A missing_docs
-fi
-
-if [[ "$MODE" == "test" || "$MODE" == "all" ]]; then
-  echo
-  echo "▶ Running tests for changed packages"
-  cargo test "${package_args[@]}" --lib --locked
-fi
-
-echo
-echo "✅ Targeted checks completed"
+exec cargo xtask targeted-checks "$@"
diff --git a/scripts/e2e-gate.sh b/scripts/e2e-gate.sh
index 4d5dc82f26..386d52a2e3 100755
--- a/scripts/e2e-gate.sh
+++ b/scripts/e2e-gate.sh
@@ -1,11 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-BIN="$REPO_ROOT/target/debug/perl-ci-hygiene"
 
-if [ -x "$BIN" ]; then
-  exec "$BIN" e2e-gate "$@"
-fi
-
-exec cargo run --quiet --manifest-path "$REPO_ROOT/Cargo.toml" -p perl-ci-hygiene -- e2e-gate "$@"
+exec cargo xtask ci-hygiene e2e-gate "$@"
diff --git a/scripts/forbid-fatal-constructs.sh b/scripts/forbid-fatal-constructs.sh
index 48c0d7f500..4d3e29b217 100644
--- a/scripts/forbid-fatal-constructs.sh
+++ b/scripts/forbid-fatal-constructs.sh
@@ -1,12 +1,7 @@
 #!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-BIN="$REPO_ROOT/target/debug/perl-ci-hygiene"
+# Compatibility wrapper for forbidden-fatal-construct checks.
+# Canonical implementation: cargo xtask forbid-fatal-constructs.
 
-if [ -x "$BIN" ]; then
-  exec "$BIN" forbid-fatal-constructs "$@"
-fi
+set -euo pipefail
 
-exec cargo run --quiet --manifest-path "$REPO_ROOT/Cargo.toml" -p perl-ci-hygiene -- forbid-fatal-constructs "$@"
+exec cargo xtask forbid-fatal-constructs -- "$@"
diff --git a/scripts/generate-badges.sh b/scripts/generate-badges.sh
index d14c48f538..8e1b984bc7 100755
--- a/scripts/generate-badges.sh
+++ b/scripts/generate-badges.sh
@@ -1,11 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-BIN="$REPO_ROOT/target/debug/perl-ci-hygiene"
 
-if [ -x "$BIN" ]; then
-  exec "$BIN" generate-badges
-fi
-
-exec cargo run --quiet --manifest-path "$REPO_ROOT/Cargo.toml" -p perl-ci-hygiene -- generate-badges
+exec cargo xtask ci-hygiene generate-badges "$@"
diff --git a/scripts/ignored-test-count.sh b/scripts/ignored-test-count.sh
index 99033a2c09..b181ab8470 100644
--- a/scripts/ignored-test-count.sh
+++ b/scripts/ignored-test-count.sh
@@ -1,12 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-BIN="$REPO_ROOT/target/debug/perl-ci-hygiene"
-
-if [ -x "$BIN" ]; then
-  exec "$BIN" ignored-test-count "$@"
-fi
-
-exec cargo run --quiet --manifest-path "$REPO_ROOT/Cargo.toml" -p perl-ci-hygiene -- ignored-test-count "$@"
+exec cargo xtask ci-hygiene ignored-test-count "$@"
diff --git a/scripts/install-githooks.sh b/scripts/install-githooks.sh
index ec9e1b8818..6b55009e22 100755
--- a/scripts/install-githooks.sh
+++ b/scripts/install-githooks.sh
@@ -1,13 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-BIN="$REPO_ROOT/target/debug/perl-ci-hygiene"
 
-if [ -x "$BIN" ]; then
-  echo "Using existing perl-ci-hygiene binary: $BIN"
-  exec "$BIN" install-githooks
-fi
-
-echo "Building perl-ci-hygiene (first run may take a minute)..."
-exec cargo run --manifest-path "$REPO_ROOT/Cargo.toml" -p perl-ci-hygiene -- install-githooks
+exec cargo xtask ci-hygiene install-githooks "$@"
diff --git a/scripts/preflight.sh b/scripts/preflight.sh
index 861d6cbfd9..0cd4648fe4 100755
--- a/scripts/preflight.sh
+++ b/scripts/preflight.sh
@@ -1,11 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-BIN="$REPO_ROOT/target/debug/perl-ci-hygiene"
 
-if [ -x "$BIN" ]; then
-  exec "$BIN" preflight "$@"
-fi
-
-exec cargo run --quiet --manifest-path "$REPO_ROOT/Cargo.toml" -p perl-ci-hygiene -- preflight "$@"
+exec cargo xtask ci-hygiene preflight "$@"
diff --git a/scripts/prep-crates-io-launch.sh b/scripts/prep-crates-io-launch.sh
index cff787da30..45efdacf0c 100755
--- a/scripts/prep-crates-io-launch.sh
+++ b/scripts/prep-crates-io-launch.sh
@@ -1,17 +1,14 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-
-MODE="core"
-
 usage() {
   cat <<'USAGE'
-Usage: scripts/prep-crates-io-launch.sh [--core|--all]
+Usage:
+  scripts/prep-crates-io-launch.sh [--core|--all]
 
-Runs crates.io launch readiness checks:
+Runs crates.io launch readiness checks through xtask:
   1) cargo check --locked for selected crates
-  2) cargo package dry-run validation for selected crates
+  2) cargo package --no-verify dry-run validation for selected crates
 
 Options:
   --core      Validate public launch crates (default)
@@ -20,60 +17,29 @@ Options:
 USAGE
 }
 
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --core)
-      MODE="core"
-      ;;
-    --all)
-      MODE="all"
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "Unknown option: $1" >&2
-      usage
-      exit 2
-      ;;
-  esac
-  shift
-done
-
-if [[ "$MODE" == "core" ]]; then
-  mapfile -t CRATES < <(printf '%s\n' \
-    perl-parser \
-    perl-lexer \
-    perl-lsp \
-    perl-dap \
-    perl-corpus)
-else
-  mapfile -t CRATES < <(
-    cd "$ROOT_DIR"
-    python3 - <<'PY'
-from pathlib import Path
-import tomllib
-
-data = tomllib.loads(Path("Cargo.toml").read_text())
-for crate in data["workspace"]["metadata"]["publish"]["allow"]:
-    print(crate)
-PY
-  )
+if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
+  usage
+  exit 0
 fi
 
-echo "🚀 crates.io launch prep (${MODE})"
-echo "📦 Running cargo check + cargo package dry-run for ${#CRATES[@]} crate(s)"
-
-for crate in "${CRATES[@]}"; do
-  echo ""
-  echo "==> ${crate}"
-  (
-    cd "$ROOT_DIR"
-    cargo check --locked -p "$crate"
-    CARGO_PACKAGE_NO_VERIFY=1 scripts/cargo-package-workspace-dry-run.sh "$crate" >/dev/null
-  )
-done
+MODE="${1:---core}"
+shift || true
+if [[ $# -gt 0 ]]; then
+  echo "Too many arguments" >&2
+  usage
+  exit 2
+fi
 
-echo ""
-echo "✅ crates.io launch prep completed (${MODE})"
+case "$MODE" in
+  --core|core)
+    exec cargo xtask prep-crates-io-launch --mode core
+    ;;
+  --all|all)
+    exec cargo xtask prep-crates-io-launch --mode all
+    ;;
+  *)
+    echo "Unknown mode: $MODE" >&2
+    usage
+    exit 2
+    ;;
+esac
diff --git a/scripts/prepare-release.sh b/scripts/prepare-release.sh
index e23dec55b5..32bf923430 100755
--- a/scripts/prepare-release.sh
+++ b/scripts/prepare-release.sh
@@ -4,8 +4,8 @@ set -euo pipefail
 usage() {
   cat <<'USAGE'
 Usage:
-  scripts/prepare-release.sh <0.x.y> [release-turnkey-pr options]
-  scripts/prepare-release.sh --version <0.x.y> [release-turnkey-pr options]
+  scripts/prepare-release.sh <0.x.y> [release-turnkey options]
+  scripts/prepare-release.sh --version <0.x.y> [release-turnkey options]
 
 Examples:
   scripts/prepare-release.sh 0.11.0
@@ -53,9 +53,7 @@ esac
 validate_version "$VERSION"
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-TURNKEY_SCRIPT="$SCRIPT_DIR/release-turnkey-pr.sh"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$REPO_ROOT"
 
-[[ -e "$TURNKEY_SCRIPT" ]] || die "missing release script: $TURNKEY_SCRIPT"
-[[ -x "$TURNKEY_SCRIPT" ]] || die "release script is not executable: $TURNKEY_SCRIPT"
-
-exec "$TURNKEY_SCRIPT" --version "$VERSION" "$@"
+exec cargo xtask release-turnkey --version "$VERSION" "$@"
diff --git a/scripts/publish-receipts.sh b/scripts/publish-receipts.sh
index 0584561fab..2945103a14 100755
--- a/scripts/publish-receipts.sh
+++ b/scripts/publish-receipts.sh
@@ -1,68 +1,11 @@
 #!/usr/bin/env bash
-# Publish a receipt bundle under review/receipts/YYYY-MM-DD/
-#
-# This makes Phase 0 executable: a single folder containing
-#  - the gate output
-#  - the receipt artifacts (artifacts/state.json etc.)
-#  - scope notes (README)
-set -euo pipefail
-
-DATE="${1:-$(date -u +%Y-%m-%d)}"
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-DEST="$ROOT/review/receipts/$DATE"
-ART="$ROOT/artifacts"
-
-mkdir -p "$DEST"
-mkdir -p "$DEST/artifacts"
-
-echo "Publishing receipts to: $DEST"
-echo ""
-
-echo "==> Running ci-gate (log only; authoritative merge gate)"
-(cd "$ROOT" && just ci-gate) 2>&1 | tee "$DEST/ci-gate.log"
-
-echo ""
-echo "==> Running generate-receipts.sh (writes to artifacts/)"
-(cd "$ROOT" && ./scripts/generate-receipts.sh) 2>&1 | tee "$DEST/generate-receipts.log"
-
-echo ""
-echo "==> Copying artifacts/"
-for f in test-output.txt test-summary.json rustdoc.log doc-summary.json state.json; do
-  if [[ -f "$ART/$f" ]]; then
-    cp -f "$ART/$f" "$DEST/artifacts/$f"
-  fi
-done
+# Compatibility wrapper for review receipt publication.
+# Canonical implementation: cargo xtask publish-receipts.
 
-sha="$(cd "$ROOT" && git rev-parse HEAD 2>/dev/null || echo UNVERIFIED)"
-rustc_ver="$(rustc --version 2>/dev/null || echo UNVERIFIED)"
-cargo_ver="$(cargo --version 2>/dev/null || echo UNVERIFIED)"
-uname_s="$(uname -a 2>/dev/null || echo UNVERIFIED)"
-
-cat > "$DEST/README.md" <<EOF
-# Receipt Bundle: $DATE
-
-## Provenance
-- Commit: \`$sha\`
-- rustc: \`$rustc_ver\`
-- cargo: \`$cargo_ver\`
-- Host: \`$uname_s\`
-
-## What ran
-- \`just ci-gate\` (see \`ci-gate.log\`)
-- \`./scripts/generate-receipts.sh\` (see \`generate-receipts.log\`)
-
-## Artifacts
-- \`artifacts/state.json\` (canonical consolidated receipt)
-- \`artifacts/test-summary.json\`
-- \`artifacts/doc-summary.json\`
-- \`artifacts/rustdoc.log\`
-- \`artifacts/test-output.txt\`
-
-## Scope notes
-- \`ci-gate\` is the merge contract.
-- \`generate-receipts.sh\` is a broader receipt generator (workspace tests + rustdoc count).
-  Treat it as evidence, not as the merge gate.
-EOF
+set -euo pipefail
 
-echo ""
-echo "Receipt bundle ready: $DEST"
+if [ $# -gt 0 ]; then
+  exec cargo xtask publish-receipts "$1"
+else
+  exec cargo xtask publish-receipts
+fi
diff --git a/scripts/publish-release.sh b/scripts/publish-release.sh
index ff75c425e1..ff2bb0cce5 100755
--- a/scripts/publish-release.sh
+++ b/scripts/publish-release.sh
@@ -13,82 +13,18 @@ Examples:
 USAGE
 }
 
-die() {
-  printf 'error: %s\n' "$*" >&2
-  exit 1
-}
-
-need() {
-  command -v "$1" >/dev/null 2>&1 || die "required command not found: $1"
-}
-
-validate_version() {
-  local version="$1"
-  if ! [[ "$version" =~ ^0\.[0-9]+\.[0-9]+(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$ ]]; then
-    die "invalid 0.x.y release version: $version"
-  fi
-}
-
 if [[ $# -eq 0 ]]; then
   usage
   exit 1
 fi
 
-case "${1:-}" in
-  --help|-h)
-    usage
-    exit 0
-    ;;
-  -* )
-    die "first argument must be the release version"
-    ;;
-  *)
-    VERSION="$1"
-    shift
-    ;;
-esac
-
-DRY_RUN=false
-REF=""
-
-while (($#)); do
-  case "$1" in
-    --dry-run)
-      DRY_RUN=true
-      shift
-      ;;
-    --ref)
-      [[ $# -ge 2 ]] || die "missing value for --ref"
-      REF="$2"
-      shift 2
-      ;;
-    --help|-h)
-      usage
-      exit 0
-      ;;
-    *)
-      die "unknown argument: $1"
-      ;;
-  esac
-done
-
-validate_version "$VERSION"
-need gh
-
-if [[ -z "$REF" ]]; then
-  REF="v${VERSION}"
+if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
+  usage
+  exit 0
 fi
 
-gh workflow run "Publish to crates.io" \
-  --ref "$REF" \
-  -f version="$VERSION" \
-  -f dry_run="$DRY_RUN"
-
-cat <<EOF
-Dispatched "Publish to crates.io" for ${VERSION} on ref ${REF}.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$REPO_ROOT"
 
-Next steps:
-1. gh run list --workflow "Publish to crates.io" --limit 5
-2. cargo search perl-lsp --limit 1
-3. cargo search perl-dap --limit 1
-4. scripts/smoke-test-release.sh ${VERSION}
+exec cargo xtask publish-release "$@"
diff --git a/scripts/quick-receipts.sh b/scripts/quick-receipts.sh
index 0188ca13f5..c7d28ac1f3 100644
--- a/scripts/quick-receipts.sh
+++ b/scripts/quick-receipts.sh
@@ -1,12 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-BIN="${REPO_ROOT}/target/debug/perl-ci-hygiene"
-
-if [ -x "$BIN" ]; then
-  exec "$BIN" quick-receipts
-fi
-
-exec cargo run --quiet --manifest-path "$REPO_ROOT/Cargo.toml" -p perl-ci-hygiene -- quick-receipts
+exec cargo xtask ci-hygiene quick-receipts "$@"
diff --git a/scripts/run_parser_comparison.sh b/scripts/run_parser_comparison.sh
index acdfa3cf67..a6c07c7de7 100755
--- a/scripts/run_parser_comparison.sh
+++ b/scripts/run_parser_comparison.sh
@@ -1,11 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-BIN="$REPO_ROOT/target/debug/perl-ci-hygiene"
 
-if [ -x "$BIN" ]; then
-  exec "$BIN" run-parser-comparison
-fi
-
-exec cargo run --quiet --manifest-path "$REPO_ROOT/Cargo.toml" -p perl-ci-hygiene -- run-parser-comparison
+exec cargo xtask ci-hygiene run-parser-comparison "$@"
diff --git a/scripts/smoke-test-release.sh b/scripts/smoke-test-release.sh
index 7ca9f64b36..23cb62fcb1 100755
--- a/scripts/smoke-test-release.sh
+++ b/scripts/smoke-test-release.sh
@@ -23,52 +23,72 @@ validate_version() {
   fi
 }
 
-if [[ $# -ne 1 ]]; then
-  usage
-  exit 1
-fi
+if [[ "${XTASK_SMOKE_TEST_RELEASE:-0}" == "1" ]]; then
+  if [[ $# -ne 1 ]]; then
+    usage
+    exit 1
+  fi
 
-if [[ "$1" == "--help" || "$1" == "-h" ]]; then
-  usage
-  exit 0
-fi
+  if [[ "$1" == "--help" || "$1" == "-h" ]]; then
+    usage
+    exit 0
+  fi
 
-RELEASE_VERSION="$1"
-validate_version "$RELEASE_VERSION"
+  RELEASE_VERSION="$1"
+  validate_version "$RELEASE_VERSION"
 
-TEMP_DIR="$(mktemp -d)"
-INSTALL_ROOT="$TEMP_DIR/install"
-trap 'rm -rf "$TEMP_DIR"' EXIT
+  TEMP_DIR="$(mktemp -d)"
+  INSTALL_ROOT="$TEMP_DIR/install"
+  trap 'rm -rf "$TEMP_DIR"' EXIT
 
-export PATH="$INSTALL_ROOT/bin:$PATH"
+  export PATH="$INSTALL_ROOT/bin:$PATH"
 
-printf 'Smoke testing release %s\n' "$RELEASE_VERSION"
-printf 'Temporary install root: %s\n\n' "$INSTALL_ROOT"
+  printf 'Smoke testing release %s\n' "$RELEASE_VERSION"
+  printf 'Temporary install root: %s\n\n' "$INSTALL_ROOT"
 
-cargo install perl-lsp --version "$RELEASE_VERSION" --locked --root "$INSTALL_ROOT"
-cargo install perl-dap --version "$RELEASE_VERSION" --locked --root "$INSTALL_ROOT"
+  cargo install perl-lsp --version "$RELEASE_VERSION" --locked --root "$INSTALL_ROOT"
+  cargo install perl-dap --version "$RELEASE_VERSION" --locked --root "$INSTALL_ROOT"
 
-LSP_VERSION="$(perl-lsp --version | head -n 1)"
-DAP_VERSION="$(perl-dap --version | head -n 1)"
+  LSP_VERSION="$(perl-lsp --version | head -n 1)"
+  DAP_VERSION="$(perl-dap --version | head -n 1)"
 
-[[ "$LSP_VERSION" == *"$RELEASE_VERSION"* ]] || die "perl-lsp version mismatch: $LSP_VERSION"
-[[ "$DAP_VERSION" == *"$RELEASE_VERSION"* ]] || die "perl-dap version mismatch: $DAP_VERSION"
+  [[ "$LSP_VERSION" == *"$RELEASE_VERSION"* ]] || die "perl-lsp version mismatch: $LSP_VERSION"
+  [[ "$DAP_VERSION" == *"$RELEASE_VERSION"* ]] || die "perl-dap version mismatch: $DAP_VERSION"
 
-perl-lsp --help >/dev/null
-perl-dap --help >/dev/null
+  perl-lsp --help >/dev/null
+  perl-dap --help >/dev/null
 
-printf 'Installed versions:\n'
-printf '  perl-lsp: %s\n' "$LSP_VERSION"
-printf '  perl-dap: %s\n\n' "$DAP_VERSION"
+  printf 'Installed versions:\n'
+  printf '  perl-lsp: %s\n' "$LSP_VERSION"
+  printf '  perl-dap: %s\n\n' "$DAP_VERSION"
 
-printf 'Sparse index checks:\n'
-cargo search perl-lsp --limit 1
-cargo search perl-dap --limit 1
-cargo search perl-parser --limit 1
+  printf 'Sparse index checks:\n'
+  cargo search perl-lsp --limit 1
+  cargo search perl-dap --limit 1
+  cargo search perl-parser --limit 1
 
-cat <<EOF
+  cat <<EOF
 
 Manual follow-up:
 1. Verify GitHub release assets for v${RELEASE_VERSION}.
 2. Verify the VS Code Marketplace and Open VSX list version ${RELEASE_VERSION}.
 3. Open VS Code against a Perl workspace and confirm the extension downloads or locates perl-lsp successfully.
+EOF
+  exit 0
+fi
+
+if [[ $# -eq 0 ]]; then
+  usage
+  exit 1
+fi
+
+if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
+  usage
+  exit 0
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$REPO_ROOT"
+
+exec cargo xtask smoke-test-release "$@"
diff --git a/scripts/swarm-summary.sh b/scripts/swarm-summary.sh
index 5000ba7a6c..4c6597c0d4 100755
--- a/scripts/swarm-summary.sh
+++ b/scripts/swarm-summary.sh
@@ -1,25 +1,8 @@
 #!/usr/bin/env bash
-# Usage: bash scripts/swarm-summary.sh [ops-dir]
-# Prints a readable summary of swarm-metrics.jsonl.
-OPS_DIR="${1:-.ops-perl-lsp}"
-METRICS="${OPS_DIR}/swarm-metrics.jsonl"
+set -euo pipefail
 
-if [[ ! -f "${METRICS}" ]]; then
-  echo "No metrics file found at ${METRICS}"
-  exit 1
-fi
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 
-echo "=== Swarm Metrics Summary ==="
-echo "Total entries: $(wc -l < "${METRICS}")"
-echo ""
-echo "By event type:"
-jq -r '.event // .action // "(none)"' "${METRICS}" | sort | uniq -c | sort -rn
-echo ""
-echo "By agent type:"
-jq -r '.agent_type // .type // "(none)"' "${METRICS}" | sort | uniq -c | sort -rn
-echo ""
-echo "Recent completions (last 5):"
-jq -r 'select(.event=="task_completed") | [.ts, .cwd] | @tsv' "${METRICS}" | tail -5
-echo ""
-echo "Recent stops (last 5):"
-jq -r 'select(.event=="subagent_stop") | [.ts, .agent_type, .worktree_path] | @tsv' "${METRICS}" | tail -5
+cd "$REPO_ROOT"
+exec cargo xtask swarm-summary "$@"
diff --git a/scripts/test-capped.sh b/scripts/test-capped.sh
index 3fba9d4a6c..3ddb18406c 100755
--- a/scripts/test-capped.sh
+++ b/scripts/test-capped.sh
@@ -1,11 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-BIN="$REPO_ROOT/target/debug/perl-ci-hygiene"
 
-if [ -x "$BIN" ]; then
-  exec "$BIN" test-capped "$@"
-fi
-
-exec cargo run --quiet --manifest-path "$REPO_ROOT/Cargo.toml" -p perl-ci-hygiene -- test-capped "$@"
+exec cargo xtask ci-hygiene test-capped "$@"
diff --git a/scripts/test-e2e-capped.sh b/scripts/test-e2e-capped.sh
index f330a66234..d28e2d9142 100755
--- a/scripts/test-e2e-capped.sh
+++ b/scripts/test-e2e-capped.sh
@@ -1,11 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-BIN="$REPO_ROOT/target/debug/perl-ci-hygiene"
 
-if [ -x "$BIN" ]; then
-  exec "$BIN" test-e2e-capped "$@"
-fi
-
-exec cargo run --quiet --manifest-path "$REPO_ROOT/Cargo.toml" -p perl-ci-hygiene -- test-e2e-capped "$@"
+exec cargo xtask ci-hygiene test-e2e-capped "$@"
diff --git a/scripts/test-lsp-cancellation.sh b/scripts/test-lsp-cancellation.sh
index 6eb38a1ea7..25cff467d1 100644
--- a/scripts/test-lsp-cancellation.sh
+++ b/scripts/test-lsp-cancellation.sh
@@ -1,12 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-BIN="${REPO_ROOT}/target/debug/perl-ci-hygiene"
-
-if [ -x "$BIN" ]; then
-  exec "$BIN" test-lsp-cancellation
-fi
-
-exec cargo run --quiet --manifest-path "$REPO_ROOT/Cargo.toml" -p perl-ci-hygiene -- test-lsp-cancellation
+exec cargo xtask ci-hygiene test-lsp-cancellation "$@"
diff --git a/scripts/test_edge_cases.sh b/scripts/test_edge_cases.sh
index c3ae79283a..893cf0df65 100755
--- a/scripts/test_edge_cases.sh
+++ b/scripts/test_edge_cases.sh
@@ -1,12 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-BIN="${REPO_ROOT}/target/debug/perl-ci-hygiene"
-
-if [ -x "$BIN" ]; then
-  exec "$BIN" test-edge-cases "$@"
-fi
-
-exec cargo run --quiet --manifest-path "$REPO_ROOT/Cargo.toml" -p perl-ci-hygiene -- test-edge-cases "$@"
+exec cargo xtask ci-hygiene test-edge-cases "$@"
diff --git a/scripts/test_iterative_parser.sh b/scripts/test_iterative_parser.sh
index daee7ac32b..ac19189ea3 100755
--- a/scripts/test_iterative_parser.sh
+++ b/scripts/test_iterative_parser.sh
@@ -1,11 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-BIN="$REPO_ROOT/target/debug/perl-ci-hygiene"
 
-if [ -x "$BIN" ]; then
-  exec "$BIN" test-iterative-parser
-fi
-
-exec cargo run --quiet --manifest-path "$REPO_ROOT/Cargo.toml" -p perl-ci-hygiene -- test-iterative-parser
+exec cargo xtask ci-hygiene test-iterative-parser "$@"
diff --git a/scripts/update-current-status.py b/scripts/update-current-status.py
index 5c3b660b9b..e9b4854c90 100644
--- a/scripts/update-current-status.py
+++ b/scripts/update-current-status.py
@@ -1,514 +1,14 @@
 #!/usr/bin/env python3
-from __future__ import annotations
 
-import argparse
-import pathlib
-import re
+"""Compatibility shim for `cargo xtask update-status`."""
+
 import subprocess
 import sys
-from collections import defaultdict
-from dataclasses import dataclass
-try:
-    import tomllib
-except ImportError:  # pragma: no cover
-    import tomli as tomllib
-
-
-ROOT = pathlib.Path(__file__).resolve().parents[1]
-FEATURES_TOML = ROOT / "features.toml"
-STATUS_DIR = ROOT / "docs" / "project" / "status"
-ROADMAP = ROOT / "docs" / "project" / "ROADMAP.md"
-TREE_SITTER_CORPUS = ROOT / "tree-sitter-perl" / "test" / "corpus"
-GAP_CORPUS = ROOT / "test_corpus"
-MISSING_DOCS_BASELINE = ROOT / "ci" / "missing_docs_baseline.txt"
-
-# Subsystem output files
-LSP_STATUS = STATUS_DIR / "lsp.md"
-TESTS_STATUS = STATUS_DIR / "tests.md"
-PARSER_STATUS = STATUS_DIR / "parser.md"
-QUALITY_STATUS = STATUS_DIR / "quality.md"
-
-ALL_SUBSYSTEMS = ("lsp", "tests", "parser", "quality")
-
-
-@dataclass(frozen=True)
-class TestCounts:
-    tier_a_lib_tests: int | None
-    ignored_total: int | None
-    bug_count: int | None
-    manual_count: int | None
-
-
-@dataclass(frozen=True)
-class LspCoverage:
-    ux_percent: int
-    ux_implemented: int
-    ux_total: int
-    protocol_percent: int
-    protocol_implemented: int
-    protocol_total: int
-
-
-def _run(cmd: list[str], timeout_s: int) -> str:
-    """Run a command and return combined stdout+stderr.
-
-    Never throw fake numbers into docs: if we can't measure, return "" and let callers mark UNVERIFIED.
-    """
-    try:
-        result = subprocess.run(
-            cmd,
-            capture_output=True,
-            text=True,
-            cwd=ROOT,
-            timeout=timeout_s,
-        )
-        return (result.stdout or "") + (result.stderr or "")
-    except (subprocess.TimeoutExpired, subprocess.SubprocessError, FileNotFoundError):
-        return ""
-
-
-def _count_tier_a_lib_tests() -> int | None:
-    """Count Tier A lib tests by enumerating test names.
-
-    This matches `just ci-test-lib` (workspace lib tests excluding the internal
-    tree-sitter validation harness crate).
-    We avoid parsing the fragile per-crate "X tests, Y benchmarks" summaries and instead count
-    actual test entries:
-      `foo::bar::baz: test`
-    """
-    output = _run(
-        ["cargo", "test", "--workspace", "--lib", "--exclude", "tree-sitter-perl", "--", "--list"],
-        timeout_s=180,
-    )
-    if not output:
-        return None
-    return len(re.findall(r":\s*test\s*$", output, re.MULTILINE))
-
-
-def _count_ignored_tracked() -> tuple[int | None, int | None, int | None]:
-    """Count ignored tests tracked by scripts/ignored-test-count.sh.
-
-    Returns (ignored_total, bug_count, manual_count). Any may be None if parsing fails.
-    """
-    output = _run(["bash", "scripts/ignored-test-count.sh"], timeout_s=60)
-    if not output:
-        return None, None, None
-
-    ignored_match = re.search(r"TOTAL\s+(\d+)", output)
-    bug_match = re.search(r"^bug\s+(\d+)", output, re.MULTILINE)
-    manual_match = re.search(r"^manual\s+(\d+)", output, re.MULTILINE)
-
-    ignored_total = int(ignored_match.group(1)) if ignored_match else None
-    bug_count = int(bug_match.group(1)) if bug_match else None
-    manual_count = int(manual_match.group(1)) if manual_match else None
-    return ignored_total, bug_count, manual_count
-
-
-def _count_tests() -> TestCounts:
-    tier_a = _count_tier_a_lib_tests()
-    ignored_total, bug_count, manual_count = _count_ignored_tracked()
-    return TestCounts(
-        tier_a_lib_tests=tier_a,
-        ignored_total=ignored_total,
-        bug_count=bug_count,
-        manual_count=manual_count,
-    )
-
-
-def _count_missing_docs_perl_parser() -> int | None:
-    """Count missing_docs warnings for perl-parser using JSON compiler messages (same method as ci/check_missing_docs.sh)."""
-    output = _run(
-        ["cargo", "check", "-p", "perl-parser", "--tests", "--message-format=json"],
-        timeout_s=300,
-    )
-    if not output:
-        return None
-
-    import json
-
-    count = 0
-    for line in output.splitlines():
-        line = line.strip()
-        if not line:
-            continue
-        try:
-            obj = json.loads(line)
-        except json.JSONDecodeError:
-            continue
-        if obj.get("reason") != "compiler-message":
-            continue
-        pkg_id = obj.get("package_id", "")
-        if not str(pkg_id).startswith("perl-parser "):
-            continue
-        msg = obj.get("message") or {}
-        if not msg:
-            continue
-        level = msg.get("level")
-        code = (msg.get("code") or {}).get("code")
-        if level == "warning" and code == "missing_docs":
-            count += 1
-    return count
-
-
-def _read_missing_docs_baseline() -> int | None:
-    try:
-        if not MISSING_DOCS_BASELINE.exists():
-            return None
-        raw = MISSING_DOCS_BASELINE.read_text(encoding="utf-8").strip()
-        return int(raw) if raw else None
-    except Exception:
-        return None
-
-
-def _count_lsp_coverage() -> LspCoverage:
-    """Calculate both UX coverage (headline) and protocol compliance metrics."""
-    data = tomllib.loads(FEATURES_TOML.read_text(encoding="utf-8"))
-    features = data.get("feature", [])
-
-    # UX Coverage: User-visible features that count toward public-facing metric
-    # Only include features where counts_in_coverage != false AND advertised = true
-    ux_trackable = [
-        f for f in features
-        if f.get("maturity") != "planned"
-        and f.get("counts_in_coverage", True) is not False
-        and bool(f.get("advertised"))
-    ]
-    ux_implemented = [
-        f for f in ux_trackable
-        if f.get("maturity") in ("ga", "production")
-    ]
-    ux_percent = round(len(ux_implemented) / len(ux_trackable) * 100) if ux_trackable else 0
-
-    # Protocol Compliance: All features regardless of counts_in_coverage
-    protocol_trackable = [f for f in features if f.get("maturity") != "planned"]
-    protocol_implemented = [
-        f
-        for f in protocol_trackable
-        if f.get("maturity") in ("ga", "production", "preview")
-    ]
-    protocol_percent = round(len(protocol_implemented) / len(protocol_trackable) * 100) if protocol_trackable else 0
-
-    return LspCoverage(
-        ux_percent=ux_percent,
-        ux_implemented=len(ux_implemented),
-        ux_total=len(ux_trackable),
-        protocol_percent=protocol_percent,
-        protocol_implemented=len(protocol_implemented),
-        protocol_total=len(protocol_trackable),
-    )
-
-
-def _compute_compliance_table() -> str:
-    """Compute the LSP compliance table from features.toml."""
-    data = tomllib.loads(FEATURES_TOML.read_text(encoding="utf-8"))
-    features = data.get("feature", [])
-
-    # Count by area
-    by_area: dict[str, dict[str, int]] = defaultdict(lambda: {"implemented": 0, "total": 0})
-
-    for f in features:
-        area = f.get("area", "other")
-        maturity = f.get("maturity", "planned")
-
-        by_area[area]["total"] += 1
-        if maturity in ("ga", "production", "preview"):
-            by_area[area]["implemented"] += 1
-
-    # Build table
-    lines = ["| Area | Implemented | Total | Coverage |"]
-    lines.append("|------|-------------|-------|----------|")
-
-    total_impl = 0
-    total_all = 0
-
-    for area in sorted(by_area.keys()):
-        impl = by_area[area]["implemented"]
-        total = by_area[area]["total"]
-        pct = round(impl / total * 100) if total else 0
-        lines.append(f"| {area} | {impl} | {total} | {pct}% |")
-        total_impl += impl
-        total_all += total
-
-    overall_pct = round(total_impl / total_all * 100) if total_all else 0
-    lines.append(f"| **Overall** | **{total_impl}** | **{total_all}** | **{overall_pct}%** |")
-
-    return "\n".join(lines)
-
-
-def _count_corpus_sections() -> int:
-    marker = re.compile(r"^=+\s*$")
-    total = 0
-    for path in TREE_SITTER_CORPUS.rglob("*.txt"):
-        with path.open(encoding="utf-8", errors="replace") as handle:
-            for line in handle:
-                if marker.match(line):
-                    total += 1
-    return total
-
-
-def _count_gap_files() -> int:
-    return sum(1 for _ in GAP_CORPUS.rglob("*.pl"))
-
-
-def _replace_block(text: str, begin_marker: str, end_marker: str, new_content: str) -> str:
-    """Replace content between markers (inclusive of markers)."""
-    pattern = re.compile(
-        rf"({re.escape(begin_marker)})\n.*?\n({re.escape(end_marker)})",
-        re.DOTALL
-    )
-    replacement = f"{begin_marker}\n{new_content}\n{end_marker}"
-    updated, count = pattern.subn(replacement, text)
-    if count != 1:
-        raise ValueError(f"Expected 1 match for block {begin_marker!r}, got {count}")
-    return updated
-
-
-# ---------------------------------------------------------------------------
-# Per-subsystem generators — each computes and returns updated file content
-# ---------------------------------------------------------------------------
-
-def generate_lsp_status(cov: LspCoverage, compliance_table: str) -> str:
-    """Compute lsp.md content with no side effects. Returns updated file text."""
-    lsp_target_pct = 100
-    lsp_status = "PASS" if cov.ux_percent >= lsp_target_pct else "In progress"
-    lsp_table_row = (
-        f"| **LSP Coverage** | {cov.ux_percent}% ({cov.ux_implemented}/{cov.ux_total} advertised features, `features.toml`) "
-        f"| {lsp_target_pct}% | {lsp_status} |"
-    )
-
-    lsp_coverage_bullet = (
-        f"- **LSP Coverage**: {cov.ux_percent}% user-visible feature coverage "
-        f"({cov.ux_implemented}/{cov.ux_total} advertised features from `features.toml`)"
-    )
-    protocol_compliance_bullet = (
-        f"- **Protocol Compliance**: {cov.protocol_percent}% overall LSP protocol support "
-        f"({cov.protocol_implemented}/{cov.protocol_total} including plumbing)"
-    )
-    if cov.ux_percent >= lsp_target_pct:
-        lsp_target = "**Target**: maintain 100% LSP coverage (no regressions)"
-    else:
-        lsp_target = f"**Target**: 100% LSP coverage (from current {cov.ux_percent}%)"
-
-    bullets_content = "\n".join([
-        lsp_coverage_bullet,
-        protocol_compliance_bullet,
-        "",
-        lsp_target,
-    ])
-
-    text = LSP_STATUS.read_text(encoding="utf-8")
-    text = _replace_block(text, "<!-- BEGIN: LSP_COVERAGE -->", "<!-- END: LSP_COVERAGE -->", lsp_table_row)
-    text = _replace_block(text, "<!-- BEGIN: LSP_METRICS_BULLETS -->", "<!-- END: LSP_METRICS_BULLETS -->", bullets_content)
-    text = _replace_block(text, "<!-- BEGIN: COMPLIANCE_TABLE -->", "<!-- END: COMPLIANCE_TABLE -->", compliance_table)
-    return text
-
-
-def generate_tests_status(tests: TestCounts, missing_docs_current: int | None, missing_docs_baseline: int | None) -> str:
-    """Compute tests.md content with no side effects. Returns updated file text."""
-    if tests.tier_a_lib_tests is None:
-        tier_a_tests_str = "UNVERIFIED"
-    else:
-        tier_a_tests_str = str(tests.tier_a_lib_tests)
-
-    if tests.ignored_total is None:
-        ignored_tests_str = "UNVERIFIED"
-    else:
-        ignored_tests_str = str(tests.ignored_total)
-
-    if tests.bug_count is None or tests.manual_count is None:
-        tracked_debt_str = "UNVERIFIED"
-        bug_count_str = "UNVERIFIED"
-        manual_count_str = "UNVERIFIED"
-    else:
-        tracked_debt = tests.bug_count + tests.manual_count
-        tracked_debt_str = str(tracked_debt)
-        bug_count_str = str(tests.bug_count)
-        manual_count_str = str(tests.manual_count)
-
-    if missing_docs_current is None:
-        missing_docs_str = "UNVERIFIED"
-    else:
-        missing_docs_str = str(missing_docs_current)
-
-    baseline_suffix = ""
-    if missing_docs_baseline is not None and missing_docs_current is not None:
-        baseline_suffix = f" (baseline {missing_docs_baseline})"
-
-    table_rows = "\n".join([
-        f"| **Tier A Tests** | {tier_a_tests_str} lib tests (discovered), {ignored_tests_str} ignores (tracked) | 100% pass | PASS |",
-        f"| **Tracked Test Debt** | {tracked_debt_str} ({bug_count_str} bug, {manual_count_str} manual) | 0 | Near-zero |",
-    ])
-
-    bullets_content = "\n".join([
-        f"- **Test Status**: {tier_a_tests_str} lib tests (Tier A), {ignored_tests_str} ignores tracked "
-        f"({tracked_debt_str} total tracked debt: {bug_count_str} bug, {manual_count_str} manual)",
-        f"- **Docs (perl-parser)**: missing_docs warnings = {missing_docs_str}{baseline_suffix}",
-    ])
-
-    text = TESTS_STATUS.read_text(encoding="utf-8")
-    text = _replace_block(text, "<!-- BEGIN: TESTS_TABLE_ROWS -->", "<!-- END: TESTS_TABLE_ROWS -->", table_rows)
-    text = _replace_block(text, "<!-- BEGIN: TESTS_METRICS_BULLETS -->", "<!-- END: TESTS_METRICS_BULLETS -->", bullets_content)
-    return text
-
-
-def generate_parser_status(corpus_sections: int, gap_files: int) -> str:
-    """Compute parser.md content with no side effects. Returns updated file text."""
-    parser_coverage_bullet = (
-        "- **Parser Coverage**: ~100% Perl 5 syntax via "
-        f"`tree-sitter-perl/test/corpus` (~{corpus_sections} sections) + "
-        f"`test_corpus/` ({gap_files} `.pl` files)"
-    )
-
-    text = PARSER_STATUS.read_text(encoding="utf-8")
-    text = _replace_block(
-        text,
-        "<!-- BEGIN: PARSER_METRICS_BULLETS -->",
-        "<!-- END: PARSER_METRICS_BULLETS -->",
-        parser_coverage_bullet,
-    )
-    return text
-
-
-def generate_quality_status() -> str:
-    """Compute quality.md content with no side effects. Returns updated file text."""
-    bullets_content = "\n".join([
-        "- **Quality Metrics**: 87% mutation score, <50ms LSP response times, 931ns incremental parsing",
-        "- **Production Status**: LSP server public alpha (`just ci-gate` passing)",
-    ])
-
-    text = QUALITY_STATUS.read_text(encoding="utf-8")
-    text = _replace_block(
-        text,
-        "<!-- BEGIN: QUALITY_METRICS_BULLETS -->",
-        "<!-- END: QUALITY_METRICS_BULLETS -->",
-        bullets_content,
-    )
-    return text
-
-
-def _update_roadmap() -> str:
-    """Update ROADMAP.md with computed compliance table."""
-    compliance_table = _compute_compliance_table()
-
-    text = ROADMAP.read_text(encoding="utf-8")
-
-    # Update the compliance table block
-    text = _replace_block(
-        text,
-        "<!-- BEGIN: COMPLIANCE_TABLE -->",
-        "<!-- END: COMPLIANCE_TABLE -->",
-        compliance_table
-    )
-
-    return text
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(
-        description="Update derived metrics in docs/project/status/ subsystem files."
-    )
-    parser.add_argument(
-        "--write",
-        action="store_true",
-        help="Write updates back to docs/project/status/",
-    )
-    parser.add_argument(
-        "--check",
-        action="store_true",
-        help="Check whether docs are up-to-date",
-    )
-    parser.add_argument(
-        "--only",
-        choices=list(ALL_SUBSYSTEMS),
-        metavar="SUBSYSTEM",
-        help=f"Only regenerate one subsystem: {', '.join(ALL_SUBSYSTEMS)}",
-    )
-    args = parser.parse_args()
-
-    if not args.write and not args.check:
-        args.check = True
-
-    subsystems_to_run = (args.only,) if args.only else ALL_SUBSYSTEMS
-
-    # Collect metrics only for the subsystems we need.
-    # This avoids running slow cargo invocations when not needed.
-    need_lsp = "lsp" in subsystems_to_run
-    need_tests = "tests" in subsystems_to_run
-    need_parser = "parser" in subsystems_to_run
-
-    # Shared collections (computed once)
-    cov: LspCoverage | None = None
-    compliance_table: str | None = None
-    tests: TestCounts | None = None
-    missing_docs_current: int | None = None
-    missing_docs_baseline: int | None = None
-    corpus_sections: int | None = None
-    gap_files: int | None = None
-
-    if need_lsp:
-        cov = _count_lsp_coverage()
-        compliance_table = _compute_compliance_table()
-
-    if need_tests:
-        tests = _count_tests()
-        missing_docs_current = _count_missing_docs_perl_parser()
-        missing_docs_baseline = _read_missing_docs_baseline()
-
-    if need_parser:
-        corpus_sections = _count_corpus_sections()
-        gap_files = _count_gap_files()
-
-    exit_code = 0
-    files_to_update: list[tuple[str, pathlib.Path, str]] = []
-
-    if "lsp" in subsystems_to_run:
-        assert cov is not None and compliance_table is not None
-        updated_lsp = generate_lsp_status(cov, compliance_table)
-        original_lsp = LSP_STATUS.read_text(encoding="utf-8")
-        if updated_lsp != original_lsp:
-            files_to_update.append(("docs/project/status/lsp.md", LSP_STATUS, updated_lsp))
-
-        # Also update ROADMAP.md compliance table (keep in sync)
-        updated_roadmap = _update_roadmap()
-        original_roadmap = ROADMAP.read_text(encoding="utf-8")
-        if updated_roadmap != original_roadmap:
-            files_to_update.append(("docs/project/ROADMAP.md", ROADMAP, updated_roadmap))
-
-    if "tests" in subsystems_to_run:
-        assert tests is not None
-        updated_tests = generate_tests_status(tests, missing_docs_current, missing_docs_baseline)
-        original_tests = TESTS_STATUS.read_text(encoding="utf-8")
-        if updated_tests != original_tests:
-            files_to_update.append(("docs/project/status/tests.md", TESTS_STATUS, updated_tests))
-
-    if "parser" in subsystems_to_run:
-        assert corpus_sections is not None and gap_files is not None
-        updated_parser = generate_parser_status(corpus_sections, gap_files)
-        original_parser = PARSER_STATUS.read_text(encoding="utf-8")
-        if updated_parser != original_parser:
-            files_to_update.append(("docs/project/status/parser.md", PARSER_STATUS, updated_parser))
-
-    if "quality" in subsystems_to_run:
-        updated_quality = generate_quality_status()
-        original_quality = QUALITY_STATUS.read_text(encoding="utf-8")
-        if updated_quality != original_quality:
-            files_to_update.append(("docs/project/status/quality.md", QUALITY_STATUS, updated_quality))
-
-    if not files_to_update:
-        return 0
-
-    if args.write:
-        for name, path, content in files_to_update:
-            path.write_text(content, encoding="utf-8")
-            sys.stderr.write(f"Updated {name}\n")
-        return 0
-
-    for name, _, _ in files_to_update:
-        sys.stderr.write(f"{name} is out of date.\n")
-    sys.stderr.write("Run `just status-update`\n")
-    sys.stderr.write("Then re-run `just ci-gate`\n")
-    return 1
+from pathlib import Path
 
 
 if __name__ == "__main__":
-    raise SystemExit(main())
+    repo_root = Path(__file__).resolve().parents[1]
+    raise SystemExit(
+        subprocess.call(["cargo", "xtask", "update-status", *sys.argv[1:]], cwd=repo_root)
+    )
diff --git a/scripts/update-homebrew.sh b/scripts/update-homebrew.sh
index a7fc51383d..acd0445ba2 100755
--- a/scripts/update-homebrew.sh
+++ b/scripts/update-homebrew.sh
@@ -1,133 +1,20 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Update Homebrew formula with actual SHA256 checksums after release
-# Usage: ./scripts/update-homebrew.sh v0.8.3
+# Canonical implementation: cargo xtask update-homebrew.
+# Usage: ./scripts/update-homebrew.sh <v0.8.3>
 
-VERSION="${1:-}"
-if [ -z "$VERSION" ]; then
-    echo "Usage: $0 <version>"
-    echo "Example: $0 v0.8.3"
-    exit 1
+if [[ $# -eq 0 ]]; then
+  echo "Usage: $0 <version>" >&2
+  echo "Example: $0 v0.8.3" >&2
+  exit 1
 fi
 
-# Remove 'v' prefix if present
-VERSION_NUM="${VERSION#v}"
+VERSION="$1"
+shift
 
-echo "Updating Homebrew formula for version $VERSION_NUM..."
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$REPO_ROOT"
 
-# Download SHA256SUMS file
-SUMS_URL="https://github.com/EffortlessMetrics/perl-lsp/releases/download/${VERSION}/SHA256SUMS"
-echo "Downloading checksums from $SUMS_URL"
-
-if ! curl -sSfL "$SUMS_URL" -o /tmp/SHA256SUMS; then
-    echo "Error: Could not download SHA256SUMS file"
-    echo "Make sure the release $VERSION exists"
-    exit 1
-fi
-
-# Extract checksums for each platform
-get_sha256() {
-    local pattern="$1"
-    grep "$pattern" /tmp/SHA256SUMS | awk '{print $1}'
-}
-
-SHA_AARCH64_DARWIN=$(get_sha256 "perl-lsp-v${VERSION_NUM}-aarch64-apple-darwin.tar.gz")
-SHA_X86_64_DARWIN=$(get_sha256 "perl-lsp-v${VERSION_NUM}-x86_64-apple-darwin.tar.gz")
-SHA_AARCH64_LINUX=$(get_sha256 "perl-lsp-v${VERSION_NUM}-aarch64-unknown-linux-gnu.tar.gz")
-SHA_X86_64_LINUX=$(get_sha256 "perl-lsp-v${VERSION_NUM}-x86_64-unknown-linux-gnu.tar.gz")
-
-if [ -z "$SHA_AARCH64_DARWIN" ] || [ -z "$SHA_X86_64_DARWIN" ] || [ -z "$SHA_AARCH64_LINUX" ] || [ -z "$SHA_X86_64_LINUX" ]; then
-    echo "Error: Could not extract all required checksums"
-    echo "Available checksums:"
-    cat /tmp/SHA256SUMS
-    exit 1
-fi
-
-# Create updated formula
-cat > homebrew/perl-lsp.rb << EOF
-class PerlLsp < Formula
-  desc "Fast, reliable Perl language server with 100% syntax coverage"
-  homepage "https://github.com/EffortlessMetrics/perl-lsp"
-  version "${VERSION_NUM}"
-  license "MIT"
-
-  on_macos do
-    if Hardware::CPU.arm?
-      url "https://github.com/EffortlessMetrics/perl-lsp/releases/download/${VERSION}/perl-lsp-v${VERSION_NUM}-aarch64-apple-darwin.tar.gz"
-      sha256 "${SHA_AARCH64_DARWIN}"
-    else
-      url "https://github.com/EffortlessMetrics/perl-lsp/releases/download/${VERSION}/perl-lsp-v${VERSION_NUM}-x86_64-apple-darwin.tar.gz"
-      sha256 "${SHA_X86_64_DARWIN}"
-    end
-  end
-
-  on_linux do
-    if Hardware::CPU.arm?
-      url "https://github.com/EffortlessMetrics/perl-lsp/releases/download/${VERSION}/perl-lsp-v${VERSION_NUM}-aarch64-unknown-linux-gnu.tar.gz"
-      sha256 "${SHA_AARCH64_LINUX}"
-    else
-      url "https://github.com/EffortlessMetrics/perl-lsp/releases/download/${VERSION}/perl-lsp-v${VERSION_NUM}-x86_64-unknown-linux-gnu.tar.gz"
-      sha256 "${SHA_X86_64_LINUX}"
-    end
-  end
-
-  def install
-    # Find the extracted directory (should be perl-lsp-v${VERSION_NUM}-{target})
-    extracted_dir = Dir.glob("perl-lsp-v*").first
-    if extracted_dir && File.directory?(extracted_dir)
-      bin.install "#{extracted_dir}/perl-lsp"
-    else
-      # Fallback: binary might be in the root
-      bin.install "perl-lsp"
-    end
-  end
-
-  def caveats
-    <<~EOS
-      To use perl-lsp with your editor:
-
-      VS Code:
-        Install the "Perl Language Server" extension from the marketplace
-
-      Neovim (with lspconfig):
-        require('lspconfig').perl_lsp.setup{
-          cmd = {'#{opt_bin}/perl-lsp', '--stdio'}
-        }
-
-      Emacs (with lsp-mode):
-        (lsp-register-client
-         (make-lsp-client :new-connection (lsp-stdio-connection '("#{opt_bin}/perl-lsp" "--stdio"))
-                          :activation-fn (lsp-activate-on "perl")
-                          :server-id 'perl-lsp))
-    EOS
-  end
-
-  test do
-    # Test that the binary runs and responds to version request
-    assert_match(/perl-lsp|Perl LSP/, shell_output("#{bin}/perl-lsp --version"))
-    
-    # Test LSP initialization
-    input = '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}'
-    output = pipe_output("#{bin}/perl-lsp --stdio", input, 0)
-    assert_match(/Content-Length/, output)
-  end
-end
-EOF
-
-echo "✅ Homebrew formula updated for version $VERSION_NUM"
-echo ""
-echo "Checksums:"
-echo "  macOS ARM64:  $SHA_AARCH64_DARWIN"
-echo "  macOS x86_64: $SHA_X86_64_DARWIN"
-echo "  Linux ARM64:  $SHA_AARCH64_LINUX"
-echo "  Linux x86_64: $SHA_X86_64_LINUX"
-echo ""
-echo "Next steps:"
-echo "1. Review the formula: cat homebrew/perl-lsp.rb"
-echo "2. Copy to your homebrew-tap repository"
-echo "3. Commit and push the updated formula"
-echo ""
-echo "Users can then install with:"
-echo "  brew tap effortlesssteven/tap"
-echo "  brew install perl-lsp"
\ No newline at end of file
+exec cargo xtask update-homebrew --version "$VERSION" "$@"
diff --git a/scripts/update-parser-matrix.py b/scripts/update-parser-matrix.py
index d7c4355c89..f4f54ce09b 100755
--- a/scripts/update-parser-matrix.py
+++ b/scripts/update-parser-matrix.py
@@ -1,255 +1,14 @@
 #!/usr/bin/env python3
-"""
-Generate PARSER_FEATURE_MATRIX.md from corpus_audit_report.json
 
-Issue #180: Parser feature baseline infrastructure
-"""
+"""Compatibility shim for `cargo xtask parser-matrix`."""
 
-import json
 import subprocess
-from datetime import datetime
+import sys
 from pathlib import Path
 
 
-def get_git_sha() -> str:
-    """Get current git commit SHA (short form)."""
-    try:
-        result = subprocess.run(
-            ["git", "rev-parse", "--short", "HEAD"],
-            capture_output=True, text=True, check=True
-        )
-        return result.stdout.strip()
-    except (subprocess.CalledProcessError, FileNotFoundError):
-        return "unknown"
-
-
-def get_crate_version(crate_name: str) -> str:
-    """Get version from Cargo.toml for a crate."""
-    cargo_path = Path(f"crates/{crate_name}/Cargo.toml")
-    if not cargo_path.exists():
-        return "unknown"
-    try:
-        content = cargo_path.read_text()
-        for line in content.split("\n"):
-            if line.startswith("version"):
-                # Extract version from 'version = "x.y.z"'
-                return line.split('"')[1]
-    except (IndexError, IOError):
-        pass
-    return "unknown"
-
-
-def main():
-    report_path = Path("corpus_audit_report.json")
-    output_path = Path("docs/reference/PARSER_FEATURE_MATRIX.md")
-    baseline_path = Path("ci/parse_errors_baseline.txt")
-
-    if not report_path.exists():
-        print(f"Error: {report_path} not found. Run 'just parser-audit' first.")
-        return 1
-
-    with open(report_path) as f:
-        report = json.load(f)
-
-    # Read baseline if it exists
-    baseline = None
-    if baseline_path.exists():
-        baseline = int(baseline_path.read_text().strip())
-
-    po = report["parse_outcomes"]
-    total = po["total"]
-    ok = po["ok"]
-    errors = po["error"]
-    timeouts = po["timeout"]
-    panics = po["panic"]
-
-    success_rate = (ok / total * 100) if total > 0 else 0
-    error_by_category = po.get("error_by_category", {})
-    failing_files = po.get("failing_files", [])
-    ga_coverage = report.get("ga_coverage", {}).get("coverage_percentage", 0)
-
-    # Get provenance info
-    git_sha = get_git_sha()
-    parser_version = get_crate_version("perl-parser")
-    generated_at = report.get("metadata", {}).get("generated_at", datetime.now().isoformat())
-    corpus_path = "test_corpus/"  # Default, could be extracted from report metadata
-
-    # Generate markdown
-    lines = [
-        "# Parser Feature Matrix",
-        "",
-        "> **Issue #180**: This document tracks parser coverage and missing features.",
-        "",
-        "## Provenance",
-        "",
-        "| Field | Value |",
-        "|-------|-------|",
-        f"| Generated | {datetime.now().strftime('%Y-%m-%d %H:%M')} |",
-        f"| Commit | `{git_sha}` |",
-        f"| perl-parser | v{parser_version} |",
-        f"| Corpus | `{corpus_path}` |",
-        f"| Command | `just parser-audit && just parser-matrix-update` |",
-        "",
-        "## Summary",
-        "",
-        "| Metric | Current | Target | Status |",
-        "|--------|---------|--------|--------|",
-        f"| Parse Success Rate | {success_rate:.0f}% ({ok}/{total} files) | 100% | {'Passing' if errors == 0 else 'In Progress'} |",
-        f"| Parse Errors | {errors} | 0 | {'Passing' if errors == 0 else 'Baseline Set'} |",
-        f"| Timeouts | {timeouts} | 0 | {'Passing' if timeouts == 0 else 'Failed'} |",
-        f"| Panics | {panics} | 0 | {'Passing' if panics == 0 else 'Failed'} |",
-        f"| Test Corpus Inventory | {ga_coverage:.0f}% | 100% | {'Passing' if ga_coverage >= 80 else 'In Progress'} |",
-    ]
-
-    if baseline is not None:
-        lines.append(f"| Baseline | {baseline} | 0 | Ratcheted |")
-
-    lines.extend([
-        "",
-        "*Test Corpus Inventory* measures whether the test corpus contains examples of each",
-        "GA (generally available) feature defined in `features.toml`. It does NOT measure",
-        "whether those features parse successfully—that's what Parse Success Rate tracks.",
-        "",
-        "## Error Breakdown by Category",
-        "",
-        "Errors are categorized to help prioritize implementation work:",
-        "",
-        "| Category | Count | Priority | Description |",
-        "|----------|-------|----------|-------------|",
-    ])
-
-    # Full taxonomy - show all categories even if count is 0
-    category_taxonomy = {
-        "ModernFeature": ("P1", "class/try/catch/field/method keywords"),
-        "QuoteLike": ("P2", "q/qq/qw/qx/qr, heredocs, strings"),
-        "Regex": ("P2", "m//, s///, tr///, patterns"),
-        "ControlFlow": ("P2", "given/when/default"),
-        "Dereference": ("P2", "->, postfix deref"),
-        "Subroutine": ("P2", "Signatures, prototypes"),
-        "General": ("P3", "Uncategorized"),
-    }
-
-    # Sort categories by count descending, then alphabetically for zero counts
-    all_categories = {cat: error_by_category.get(cat, 0) for cat in category_taxonomy}
-    sorted_categories = sorted(all_categories.items(), key=lambda x: (-x[1], x[0]))
-
-    for category, count in sorted_categories:
-        priority, desc = category_taxonomy[category]
-        lines.append(f"| {category} | {count} | {priority} | {desc} |")
-
-    lines.extend([
-        "",
-        "## Failing Files",
-        "",
-    ])
-
-    if failing_files:
-        for f in failing_files:
-            path = f['path']
-            category = f['category']
-
-            # Location info
-            line_num = f.get("line_number")
-            col = f.get("column")
-            location = ""
-            if line_num:
-                location = f"line {line_num}"
-                if col:
-                    location += f":{col}"
-
-            # Token info
-            found = f.get("found_token", "")
-            expected = f.get("expected", "")
-            token_info = ""
-            if expected and found:
-                token_info = f"expected `{expected}`, found `{found}`"
-            elif expected:
-                token_info = f"expected `{expected}`"
-
-            # Code snippet
-            snippet = f.get("code_snippet", "")
-
-            # Build the entry
-            lines.append(f"### `{path}`")
-            lines.append("")
-            lines.append(f"- **Category**: {category}")
-            if location:
-                lines.append(f"- **Location**: {location}")
-            if token_info:
-                lines.append(f"- **Error**: {token_info}")
-
-            if snippet:
-                lines.append("")
-                lines.append("```perl")
-                lines.append(snippet)
-                lines.append("```")
-
-            lines.append("")
-    else:
-        lines.append("*No failing files* ✅")
-
-    lines.extend([
-        "",
-        "## Coverage Roadmap",
-        "",
-        "### Phase 1: Stabilize Core (Current)",
-        "- [x] Establish baseline ratchet (Issue #180)",
-        "- [x] Add error categorization",
-        f"- {'[x]' if errors == 0 else '[ ]'} Reduce parse errors to 0",
-        "",
-        "### Phase 2: Modern Perl Features",
-        "- [ ] `class` keyword (Perl 5.38+, Corinna)",
-        "- [ ] `try`/`catch`/`finally` blocks",
-        "- [ ] `field` and `method` declarations",
-        "- [ ] `builtin::` functions",
-        "",
-        "### Phase 3: Edge Cases",
-        "- [ ] Complex heredoc scenarios",
-        "- [ ] Unicode in quote delimiters",
-        "- [ ] Recursive regex patterns",
-        "",
-        "## How to Use",
-        "",
-        "```bash",
-        "# View current parse status",
-        "just parser-audit",
-        "",
-        "# Check against baseline (CI mode)",
-        "just ci-parser-features-check",
-        "",
-        "# Update this document from latest audit",
-        "just parser-matrix-update",
-        "```",
-        "",
-        "## Baseline Ratchet",
-        "",
-        "The parse error count uses a ratchet mechanism:",
-        "",
-        "- Baseline stored in `ci/parse_errors_baseline.txt`",
-        "- CI fails if parse errors **increase**",
-        "- CI passes if parse errors stay same or decrease",
-        "- When errors decrease, update baseline: `echo N > ci/parse_errors_baseline.txt`",
-        "",
-        "**Philosophy**: Baseline updates are only allowed when the parser actually improves",
-        "(error count decreases), never to paper over regressions. The ratchet ensures the",
-        "codebase only gets easier to reason about over time.",
-        "",
-        "## Related Documentation",
-        "",
-        "- [CLAUDE.md](../CLAUDE.md) - Project overview and commands",
-        "- [LSP_IMPLEMENTATION_GUIDE.md](LSP_IMPLEMENTATION_GUIDE.md) - LSP server architecture",
-        "- [features.toml](../features.toml) - LSP feature catalog",
-    ])
-
-    with open(output_path, "w") as f:
-        f.write("\n".join(lines) + "\n")
-
-    print(f"Updated {output_path}")
-    print(f"  Parse success: {ok}/{total} ({success_rate:.0f}%)")
-    print(f"  Errors: {errors} ({len(error_by_category)} categories)")
-
-    return 0
-
-
 if __name__ == "__main__":
-    exit(main())
+    repo_root = Path(__file__).resolve().parents[1]
+    raise SystemExit(
+        subprocess.call(["cargo", "xtask", "parser-matrix", *sys.argv[1:]], cwd=repo_root)
+    )
diff --git a/scripts/validate-workspace-exclusions.sh b/scripts/validate-workspace-exclusions.sh
index 90718790ce..0a198a27dd 100755
--- a/scripts/validate-workspace-exclusions.sh
+++ b/scripts/validate-workspace-exclusions.sh
@@ -1,97 +1,3 @@
 #!/usr/bin/env bash
-# Validate workspace exclusion strategy
-#
-# This script validates that:
-# 1. Excluded crates are properly documented
-# 2. No workspace members depend on excluded crates
-# 3. workspace.dependencies doesn't reference excluded crates
 
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-CARGO_TOML="$REPO_ROOT/Cargo.toml"
-
-echo "Validating workspace exclusion strategy..."
-echo
-
-# Check 1: Verify excluded crates exist
-echo "✓ Checking excluded directories exist..."
-for dir in "tree-sitter-perl" "crates/tree-sitter-perl-c" "fuzz" "archive"; do
-    if [ ! -d "$REPO_ROOT/$dir" ]; then
-        echo "❌ ERROR: Excluded directory '$dir' does not exist"
-        exit 1
-    fi
-done
-echo "  All excluded directories exist"
-echo
-
-# Check 2: Verify exclusion documentation
-echo "✓ Checking exclusion documentation..."
-if ! grep -q "Workspace Exclusions" "$CARGO_TOML"; then
-    echo "❌ ERROR: Exclusion strategy not documented in Cargo.toml"
-    exit 1
-fi
-echo "  Exclusion strategy is documented"
-echo
-
-# Check 3: Verify workspace.dependencies doesn't reference excluded crates
-echo "✓ Checking workspace.dependencies..."
-if grep -A 100 "^\[workspace\.dependencies\]" "$CARGO_TOML" | \
-   grep -v "^#" | \
-   grep -E "tree-sitter-perl\s*=|tree-sitter-perl-c\s*=" > /dev/null 2>&1; then
-    echo "❌ ERROR: workspace.dependencies references excluded crates"
-    exit 1
-fi
-echo "  workspace.dependencies clean (no excluded crate references)"
-echo
-
-# Check 4: Verify excluded crates are listed in exclude section
-echo "✓ Checking exclude section..."
-for crate in "tree-sitter-perl" "tree-sitter-perl-c" "fuzz" "archive"; do
-    if ! grep -A 10 "^exclude = \[" "$CARGO_TOML" | grep -q "\"$crate\""; then
-        echo "❌ ERROR: '$crate' not found in exclude section"
-        exit 1
-    fi
-done
-echo "  All expected crates are in exclude section"
-echo
-
-# Check 5: Verify workspace members don't include excluded crates
-echo "✓ Checking workspace members..."
-WORKSPACE_MEMBERS=$(cargo metadata --format-version=1 --no-deps | jq -r '.workspace_members[]')
-if echo "$WORKSPACE_MEMBERS" | grep -q "tree-sitter-perl"; then
-    echo "❌ ERROR: Excluded crates found in workspace members"
-    exit 1
-fi
-MEMBER_COUNT=$(echo "$WORKSPACE_MEMBERS" | wc -l)
-echo "  Workspace has $MEMBER_COUNT members (excluded crates not included)"
-echo
-
-# Check 6: Verify no workspace member Cargo.toml depends on excluded crates
-echo "✓ Checking for dependencies on excluded crates..."
-FOUND_DEPS=0
-for cargo_toml in "$REPO_ROOT"/crates/*/Cargo.toml; do
-    if [ -f "$cargo_toml" ]; then
-        if grep -E "tree-sitter-perl\s*=|tree-sitter-perl-c\s*=" "$cargo_toml" > /dev/null 2>&1; then
-            echo "❌ ERROR: $(basename $(dirname $cargo_toml)) depends on excluded crate"
-            FOUND_DEPS=1
-        fi
-    fi
-done
-if [ $FOUND_DEPS -eq 1 ]; then
-    exit 1
-fi
-echo "  No workspace members depend on excluded crates"
-echo
-
-echo "=========================================="
-echo "✅ All workspace exclusion checks passed!"
-echo "=========================================="
-echo
-echo "Summary:"
-echo "  - 4 directories excluded from workspace"
-echo "  - Exclusion strategy clearly documented"
-echo "  - No accidental dependencies on excluded crates"
-echo "  - workspace.dependencies clean"
-echo
+cargo xtask validate-workspace-exclusions "$@"
diff --git a/scripts/verify_stacker.sh b/scripts/verify_stacker.sh
index 9171266490..a01f8e88a3 100755
--- a/scripts/verify_stacker.sh
+++ b/scripts/verify_stacker.sh
@@ -1,11 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-BIN="$REPO_ROOT/target/debug/perl-ci-hygiene"
 
-if [ -x "$BIN" ]; then
-  exec "$BIN" verify-stacker
-fi
-
-exec cargo run --quiet --manifest-path "$REPO_ROOT/Cargo.toml" -p perl-ci-hygiene -- verify-stacker
+exec cargo xtask ci-hygiene verify-stacker "$@"
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index 13b2272498..80b5d91ea8 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -3,7 +3,7 @@
 //! This binary provides custom automation tasks for building, testing,
 //! and maintaining the tree-sitter-perl project.
 
-use clap::{Parser, Subcommand};
+use clap::{Parser, Subcommand, ValueEnum};
 use color_eyre::eyre::Result;
 use std::path::PathBuf;
 
@@ -35,6 +35,14 @@ enum Commands {
     /// Run format and clippy checks only (no tests)
     CheckOnly,
 
+    /// Verify local Rust toolchain meets the pinned MSRV in rust-toolchain.toml.
+    CheckToolchain {
+        /// Show a warning when rustc satisfies the minimum MSRV but differs
+        /// from the exact pinned channel string.
+        #[arg(long)]
+        doctor: bool,
+    },
+
     /// Build project with various configurations
     Build {
         /// Build in release mode
@@ -123,6 +131,118 @@ enum Commands {
         report: bool,
     },
 
+    /// Run the benchmark script wrapper (`benchmarks/scripts/run-benchmarks.sh`).
+    BenchRun {
+        /// Write benchmark results to a JSON file.
+        #[arg(long)]
+        output: Option<PathBuf>,
+
+        /// Run quick smoke benchmarks with reduced sample size.
+        #[arg(long)]
+        quick: bool,
+
+        /// Restrict benchmarks to a specific category.
+        #[arg(long)]
+        category: Option<String>,
+    },
+
+    /// Compare benchmark output receipts (`benchmarks/scripts/compare.sh`).
+    BenchCompare {
+        /// Enable strict mode (exit non-zero on regression).
+        #[arg(long)]
+        fail_on_regression: bool,
+    },
+
+    /// Format benchmark JSON via `benchmarks/scripts/format-results.py`.
+    BenchFormat {
+        /// Emit a receipt summary for CI.
+        #[arg(long)]
+        receipt: bool,
+
+        /// Emit markdown summary.
+        #[arg(long)]
+        markdown: bool,
+    },
+
+    /// Extract and normalize Criterion benchmark outputs (`target/criterion/.../estimates.json`).
+    BenchExtract {
+        /// Root path that contains `target/criterion`.
+        #[arg(long)]
+        base_path: Option<PathBuf>,
+
+        /// Output JSON path.
+        #[arg(long)]
+        output: Option<PathBuf>,
+    },
+
+    /// Run benchmark alert checks (`benchmarks/scripts/alert.py`).
+    BenchAlert {
+        /// Output markdown alerts.
+        #[arg(long)]
+        format: Option<String>,
+
+        /// Run checks and fail on warning conditions.
+        #[arg(long)]
+        check: bool,
+    },
+
+    /// Run the local benchmark alert regression test suite.
+    BenchAlertTest,
+
+    /// Generate Homebrew formula and VS Code asset map from checksums JSON.
+    InjectShaAssets {
+        /// Version tag used by release artifacts (e.g. v0.8.3).
+        #[arg(long)]
+        version: String,
+
+        /// GitHub organization owning the release repository.
+        #[arg(long)]
+        owner: String,
+
+        /// GitHub repository name for releases.
+        #[arg(long)]
+        repo: String,
+
+        /// Artifact prefix for release filenames.
+        #[arg(long)]
+        prefix: String,
+
+        /// Path to checksums JSON from cargo-dist.
+        #[arg(long)]
+        checksums: PathBuf,
+
+        /// Optional output path for generated Homebrew formula.
+        #[arg(long)]
+        brew_out: Option<PathBuf>,
+
+        /// Optional output path for generated VS Code extension asset map.
+        #[arg(long)]
+        asset_map_out: Option<PathBuf>,
+    },
+
+    /// Generate Homebrew formula from a release SHA256SUMS file.
+    UpdateHomebrew {
+        /// Release version tag used by release artifacts (e.g. v0.8.3).
+        #[arg(long)]
+        version: String,
+
+        /// GitHub organization owning the release repository.
+        #[arg(long, default_value = "EffortlessMetrics")]
+        owner: String,
+
+        /// GitHub repository name for releases.
+        #[arg(long, default_value = "perl-lsp")]
+        repo: String,
+
+        /// Artifact prefix for release filenames.
+        #[arg(long, default_value = "perl-lsp")]
+        prefix: String,
+
+        /// Output path for generated Homebrew formula.
+        #[arg(long, default_value = "homebrew/perl-lsp.rb")]
+        output: PathBuf,
+    },
+
     /// Generate documentation
     Doc {
         /// Open docs in browser
@@ -209,6 +329,121 @@ enum Commands {
         strict: bool,
     },
 
+    /// Run a developer environment smoke check.
+    DevexDoctor,
+
+    /// Audit CI workflows for PR-safety and spend-risk controls.
+    CiAuditWorkflows,
+
+    /// Measure CI lane runtimes and emit timing artifacts.
+    CiMeasure,
+
+    /// Analyze GitHub Actions costs over a recent period.
+    CiCostMonitor {
+        /// Number of days to analyze.
+        #[arg(long, default_value_t = 30)]
+        days: u64,
+
+        /// Emit machine-readable output.
+        #[arg(long)]
+        json: bool,
+    },
+
+    /// Measure CI baseline from recent workflow runs.
+    CiBaseline {
+        /// Branch to analyze.
+        #[arg(short, long, default_value = "master")]
+        branch: String,
+
+        /// Number of days to analyze.
+        #[arg(short, long, default_value_t = 30)]
+        days: u64,
+
+        /// Max runs to fetch.
+        #[arg(short, long, default_value_t = 200)]
+        limit: usize,
+
+        /// Output directory for ci_baseline artifacts.
+        #[arg(short, long, default_value = ".ci")]
+        output: PathBuf,
+    },
+
+    /// Check for disallowed direct `ExitStatus::from_raw()` usage.
+    CheckFromRaw,
+
+    /// Run production security hardening checks.
+    SecurityHardening,
+
+    /// Run production performance hardening checks.
+    PerformanceHardening,
+
+    /// Validate production hardening gate posture and SLOs.
+    ProductionGatesValidation,
+
+    /// Harvest forensics data for a merged PR.
+    ForensicsHarvest {
+        /// PR number or identifier.
+        pr: String,
+    },
+
+    /// Analyze temporal behavior for a merged PR.
+    ForensicsTemporal {
+        /// PR number or identifier.
+        pr: String,
+    },
+
+    /// Run quick static telemetry for a merged PR.
+    ForensicsTelemetryQuick {
+        /// PR number or identifier.
+        pr: String,
+    },
+
+    /// Run full static telemetry for a merged PR.
+    ForensicsTelemetryFull {
+        /// PR number or identifier.
+        pr: String,
+    },
+
+    /// Generate a full forensics dossier for a merged PR.
+    ForensicsDossier {
+        /// PR number or identifier.
+        pr: String,
+    },
+
+    /// Render a forensics dossier for a merged PR.
+    ForensicsRender {
+        /// PR number or identifier.
+        pr: String,
+
+        /// Output format for the rendered dossier (`full` or `summary`).
+        #[arg(default_value = "full")]
+        format: String,
+    },
+
+    /// Verify publication claims from `docs/project/PUBLICATION_FACTS_LEDGER.md`.
+    VerifyPublicationFacts {
+        /// Forward extra args to the checker (`--strict`, `--json`).
+        #[arg(trailing_var_arg = true)]
+        args: Vec<String>,
+    },
+
+    /// Ensure issue labels are present and correctly configured in GitHub.
+    GhLabels,
+
+    /// Show open issues missing required taxonomy labels from GitHub.
+    GhTriage {
+        /// Maximum number of issues to list.
+        #[arg(default_value = "500")]
+        limit: usize,
+    },
+
+    /// Backfill prefixed labels on GitHub issues (dry run by default).
+    GhBackfillPrefixedLabels {
+        /// Apply label updates instead of dry run.
+        #[arg(long)]
+        apply: bool,
+    },
+
     /// Generate bindings
     #[cfg(feature = "parser-tasks")]
     Bindings {
@@ -260,6 +495,64 @@ enum Commands {
         yes: bool,
     },
 
+    /// Trigger PR-driven release orchestration workflow
+    ReleaseTurnkey {
+        /// Release version (preferred: use `--version`; positional is also accepted).
+        #[arg(long)]
+        version: Option<String>,
+
+        /// Release version as positional argument.
+        #[arg(value_name = "VERSION")]
+        positional_version: Option<String>,
+
+        /// Trigger prerelease mode for workflows.
+        #[arg(long)]
+        prerelease: bool,
+
+        /// Validate commands only; do not trigger workflows.
+        #[arg(long)]
+        dry_run: bool,
+
+        /// Skip crates.io publish workflow.
+        #[arg(long)]
+        skip_crates: bool,
+
+        /// Skip VSCode extension publish workflow.
+        #[arg(long)]
+        skip_extension: bool,
+
+        /// Skip Docker image publish workflow.
+        #[arg(long)]
+        skip_docker: bool,
+
+        /// Base branch for release orchestration.
+        #[arg(long)]
+        base_branch: Option<String>,
+
+        /// Do not auto-merge the version bump PR.
+        #[arg(long)]
+        no_auto_merge: bool,
+
+        /// Do not wait for the version bump PR merge.
+        #[arg(long)]
+        no_wait_pr_merge: bool,
+
+        /// Do not wait for release workflows to finish.
+        #[arg(long)]
+        no_wait_release: bool,
+
+        /// Workflow wait timeout in seconds.
+        #[arg(long)]
+        workflow_timeout: Option<u64>,
+    },
+
+    /// Run crates.io launch-preparation checks.
+    PrepCratesIoLaunch {
+        /// Launch mode: `core` for launch-critical crates, `all` for all publishable crates.
+        #[arg(long, value_enum, default_value = "core")]
+        mode: PrepCratesMode,
+    },
+
     /// Run heredoc-specific tests
     TestHeredoc {
         /// Run tests in release mode
@@ -305,6 +598,17 @@ enum Commands {
         fresh: bool,
     },
 
+    /// Generate parser feature matrix from a parser-audit report.
+    ParserMatrix {
+        /// Path to parser audit report JSON.
+        #[arg(long, default_value = "corpus_audit_report.json")]
+        report: PathBuf,
+
+        /// Output path for generated matrix documentation.
+        #[arg(long, default_value = "docs/reference/PARSER_FEATURE_MATRIX.md")]
+        output: PathBuf,
+    },
+
     /// Run three-way parser comparison
     #[cfg(feature = "legacy")]
     CompareThree {
@@ -353,6 +657,49 @@ enum Commands {
         dry_run: bool,
     },
 
+    /// Dispatch the "Publish to crates.io" workflow for a release
+    PublishRelease {
+        /// Release version (for example 0.x.y)
+        version: String,
+
+        /// Dry run (don't actually publish)
+        #[arg(long)]
+        dry_run: bool,
+
+        /// Target git ref (defaults to v<version>)
+        #[arg(long = "ref")]
+        git_ref: Option<String>,
+    },
+
+    /// Run a full release smoke test via installed binaries
+    SmokeTestRelease {
+        /// Release version to smoke-test (for example 0.x.y)
+        version: String,
+    },
+
+    /// Run forbidden-fatal construct checks from `perl-ci-hygiene`.
+    ForbidFatalConstructs {
+        /// Forwarded arguments for `forbid-fatal-constructs`.
+        #[arg(trailing_var_arg = true)]
+        args: Vec<String>,
+    },
+
+    /// Run arbitrary `perl-ci-hygiene` subcommands.
+    CiHygiene {
+        /// Subcommand name for `perl-ci-hygiene`.
+        command: String,
+
+        /// Arguments to pass to the subcommand.
+        #[arg(trailing_var_arg = true)]
+        args: Vec<String>,
+    },
+
+    /// Publish a review receipt bundle in `review/receipts/YYYY-MM-DD/`.
+    PublishReceipts {
+        /// Optional date override in `YYYY-MM-DD` format.
+        date: Option<String>,
+    },
+
     /// Publish VSCode extension to marketplace
     PublishVscode {
         /// Skip confirmation
@@ -449,6 +796,10 @@ enum Commands {
         #[arg(long)]
         json: bool,
 
+        /// Output a compact markdown summary table.
+        #[arg(long)]
+        summary: bool,
+
         /// Show only expired quarantines
         #[arg(long)]
         expired: bool,
@@ -458,6 +809,9 @@ enum Commands {
         ledger: Option<PathBuf>,
     },
 
+    /// Check invariants in features.toml
+    DocClaims,
+
     /// Manage feature catalog and LSP compliance
     Features {
         #[command(subcommand)]
@@ -588,6 +942,15 @@ enum Commands {
         verbose: bool,
     },
 
+    /// Verify hook scripts are executable.
+    HookCheck,
+
+    /// Verify hook registry references are present and executable.
+    HookRegistryCheck,
+
+    /// Run hook behavior tests and output summaries.
+    HookTests,
+
     /// Run targeted clippy/test checks for crates changed since a base ref
     ///
     /// Detects which crates have changed since the given base git ref
@@ -602,6 +965,53 @@ enum Commands {
         #[arg(long, value_enum, default_value = "all")]
         mode: CheckMode,
     },
+
+    /// Remove stale `.claude/worktrees` entries and prune Git metadata.
+    WorktreeCleanup,
+
+    /// Show summary statistics from swarm-metrics.jsonl.
+    SwarmSummary {
+        /// Path to operations directory (defaults to `.ops-perl-lsp`).
+        #[arg(default_value = ".ops-perl-lsp")]
+        ops_dir: PathBuf,
+    },
+
+    /// Populate mdBook source directory from `docs/`.
+    PopulateBook,
+
+    /// Validate workspace exclusion strategy and dependency invariants.
+    ValidateWorkspaceExclusions,
+
+    /// Generate a build-timing receipt JSON with workspace duration metrics.
+    BuildTimingReceipt {
+        /// Measure clean build with `cargo build --workspace --locked`.
+        #[arg(long)]
+        clean: bool,
+
+        /// Measure incremental rebuild using incremental crate touch.
+        #[arg(long)]
+        incremental: bool,
+
+        /// Measure test build with `cargo test --workspace --lib --locked`.
+        #[arg(long)]
+        tests: bool,
+
+        /// Output file for the generated receipt.
+        #[arg(long)]
+        output: Option<PathBuf>,
+
+        /// Write the baseline artifact (`artifacts/build-timing-baseline.json`).
+        #[arg(long)]
+        baseline: bool,
+    },
+
+    /// Compare two build-timing receipts and print a markdown report.
+    CompareBuildTiming {
+        /// Baseline receipt JSON path.
+        baseline: PathBuf,
+        /// Current receipt JSON path.
+        current: PathBuf,
+    },
 }
 
 #[derive(Subcommand)]
@@ -671,10 +1081,19 @@ enum FeaturesCommand {
     /// Verify features match capabilities
     Verify,
 
+    /// Run feature catalog invariant checks
+    Invariants,
+
     /// Generate compliance report
     Report,
 }
 
+#[derive(ValueEnum, Clone)]
+enum PrepCratesMode {
+    Core,
+    All,
+}
+
 fn main() -> Result<()> {
     color_eyre::install()?;
 
@@ -683,6 +1102,7 @@ fn main() -> Result<()> {
     match cli.command {
         Commands::Ci => ci::run(),
         Commands::CheckOnly => ci::check_only(),
+        Commands::CheckToolchain { doctor } => check_toolchain::run(doctor),
         Commands::Build { release, features, c_scanner, rust_scanner } => {
             build::run(release, features, c_scanner, rust_scanner)
         }
@@ -690,6 +1110,46 @@ fn main() -> Result<()> {
             test::run(release, suite, features, verbose, coverage)
         }
         Commands::Bench { name, save, output } => bench::run(name, save, output),
+        Commands::BenchRun { output, quick, category } => {
+            benchmarks::run_benchmarks(output, quick, category)
+        }
+        Commands::BenchCompare { fail_on_regression } => {
+            benchmarks::compare_benchmarks(fail_on_regression)
+        }
+        Commands::BenchFormat { receipt, markdown } => {
+            benchmarks::format_benchmarks(receipt, markdown)
+        }
+        Commands::BenchExtract { base_path, output } => {
+            benchmarks::extract_criterion(base_path, output)
+        }
+        Commands::BenchAlert { format, check } => benchmarks::alert_benchmarks(format, check),
+        Commands::BenchAlertTest => benchmarks::test_alert_system(),
+        Commands::InjectShaAssets {
+            version,
+            owner,
+            repo,
+            prefix,
+            checksums,
+            brew_out,
+            asset_map_out,
+        } => inject_sha_assets::run(inject_sha_assets::InjectShaAssetsConfig {
+            version,
+            owner,
+            repo,
+            prefix,
+            checksums,
+            brew_out,
+            asset_map_out,
+        }),
+        Commands::UpdateHomebrew { version, owner, repo, prefix, output } => {
+            update_homebrew::run(update_homebrew::UpdateHomebrewConfig {
+                version,
+                owner,
+                repo,
+                prefix,
+                output,
+            })
+        }
         Commands::Compare {
             c_only,
             rust_only,
@@ -721,10 +1181,41 @@ fn main() -> Result<()> {
         #[cfg(feature = "parser-tasks")]
         Commands::Bindings { header, output } => bindings::run(header, output),
         Commands::Dev { watch, port } => dev::run(watch, port),
+        Commands::DevexDoctor => devex_doctor::run(),
         Commands::ParseRust { source, sexp, ast, bench } => {
             parse_rust::run(source, sexp, ast, bench)
         }
         Commands::Release { version, yes } => release::run(version, yes),
+        Commands::ReleaseTurnkey {
+            version,
+            positional_version,
+            prerelease,
+            dry_run,
+            skip_crates,
+            skip_extension,
+            skip_docker,
+            base_branch,
+            no_auto_merge,
+            no_wait_pr_merge,
+            no_wait_release,
+            workflow_timeout,
+        } => release_turnkey::run(release_turnkey::ReleaseTurnkeyConfig {
+            version,
+            positional_version,
+            prerelease,
+            dry_run,
+            skip_crates,
+            skip_extension,
+            skip_docker,
+            base_branch,
+            no_auto_merge,
+            no_wait_pr_merge,
+            no_wait_release,
+            workflow_timeout,
+        }),
+        Commands::PrepCratesIoLaunch { mode } => {
+            prep_crates_io_launch::run(matches!(mode, PrepCratesMode::All))
+        }
         Commands::TestHeredoc { release, verbose } => {
             // Run heredoc tests using the test module with heredoc suite
             test::run(
@@ -736,6 +1227,26 @@ fn main() -> Result<()> {
             )
         }
         Commands::TestEdgeCases { bench, coverage, test } => edge_cases::run(bench, coverage, test),
+        Commands::CiAuditWorkflows => ci_audit_workflows::run(),
+        Commands::CiMeasure => ci_measure::run(),
+        Commands::CiCostMonitor { days, json } => ci_metrics::run_cost_monitor(days, json),
+        Commands::CiBaseline { branch, days, limit, output } => {
+            ci_metrics::run_ci_baseline(branch, days, limit, output)
+        }
+        Commands::CheckFromRaw => ci_policy::check_from_raw(),
+        Commands::SecurityHardening => hardening::security_hardening(),
+        Commands::PerformanceHardening => hardening::performance_hardening(),
+        Commands::ProductionGatesValidation => hardening::production_gates_validation(),
+        Commands::ForensicsHarvest { pr } => forensics::run_harvest(&pr),
+        Commands::ForensicsTemporal { pr } => forensics::run_temporal(&pr),
+        Commands::ForensicsTelemetryQuick { pr } => forensics::run_telemetry_quick(&pr),
+        Commands::ForensicsTelemetryFull { pr } => forensics::run_telemetry_full(&pr),
+        Commands::ForensicsDossier { pr } => forensics::run_dossier(&pr),
+        Commands::ForensicsRender { pr, format } => forensics::run_render(&pr, &format),
+        Commands::VerifyPublicationFacts { args } => publication_facts::run(args),
+        Commands::GhLabels => github::run_labels(),
+        Commands::GhTriage { limit } => github::run_issues_needing_triage(limit),
+        Commands::GhBackfillPrefixedLabels { apply } => github::run_backfill_prefixed_labels(apply),
         Commands::CorpusAudit { corpus_path, output, check, fresh } => {
             corpus_audit::run(corpus_audit::AuditConfig {
                 corpus_path,
@@ -745,6 +1256,7 @@ fn main() -> Result<()> {
                 check,
             })
         }
+        Commands::ParserMatrix { report, output } => parser_matrix::run_with_paths(report, output),
         #[cfg(feature = "legacy")]
         Commands::CompareThree { verbose, format } => {
             compare_parsers::run_three_way(verbose, format.as_str())
@@ -754,7 +1266,17 @@ fn main() -> Result<()> {
         }
         Commands::BumpVersion { version, yes } => bump_version::run(version, yes),
         Commands::PublishCrates { yes, dry_run } => publish::publish_crates(yes, dry_run),
+        Commands::PublishRelease { version, dry_run, git_ref } => {
+            publish::publish_release(version, dry_run, git_ref)
+        }
+        Commands::HookCheck => hook_checks::run_hook_check(),
+        Commands::HookRegistryCheck => hook_checks::run_hook_registry_check(),
+        Commands::HookTests => hook_checks::run_hook_tests(),
+        Commands::ForbidFatalConstructs { args } => forbid_fatal_constructs::run(args),
+        Commands::CiHygiene { command, args } => ci_hygiene::run(command, args),
         Commands::PublishVscode { yes, token } => publish::publish_vscode(yes, token),
+        Commands::SmokeTestRelease { version } => publish::smoke_test_release(version),
+        Commands::PublishReceipts { date } => publish_receipts::run(date),
         Commands::ParserCorpusSweep {
             roots,
             manifest,
@@ -825,12 +1347,20 @@ fn main() -> Result<()> {
         Commands::IgnoredTests { update, check, verbose } => {
             ignored_tests::run(update, check, verbose)
         }
-        Commands::DebtReport { check, json, expired, ledger } => {
-            debt_report::run(debt_report::DebtReportConfig { check, json, expired, ledger })
+        Commands::DebtReport { check, json, summary, expired, ledger } => {
+            debt_report::run(debt_report::DebtReportConfig {
+                check,
+                json,
+                summary,
+                expired,
+                ledger,
+            })
         }
+        Commands::DocClaims => doc_claims::run(),
         Commands::Features { command } => match command {
             FeaturesCommand::SyncDocs => features::sync_docs(),
             FeaturesCommand::Verify => features::verify(),
+            FeaturesCommand::Invariants => features::invariants(),
             FeaturesCommand::Report => features::report(),
         },
         Commands::UpdateStatus { write, check, only } => update_status::run(write, check, only),
@@ -872,5 +1402,15 @@ fn main() -> Result<()> {
             verbose,
         }),
         Commands::TargetedChecks { base, mode } => targeted_checks::run(base, mode),
+        Commands::WorktreeCleanup => worktrees::cleanup(),
+        Commands::SwarmSummary { ops_dir } => swarm_summary::run(ops_dir),
+        Commands::PopulateBook => populate_book::run(),
+        Commands::ValidateWorkspaceExclusions => validate_workspace_exclusions::run(),
+        Commands::BuildTimingReceipt { clean, incremental, tests, output, baseline } => {
+            build_timing::run_receipt(clean, incremental, tests, output, baseline)
+        }
+        Commands::CompareBuildTiming { baseline, current } => {
+            build_timing::run_compare(baseline, current)
+        }
     }
 }
diff --git a/xtask/src/tasks/benchmarks.rs b/xtask/src/tasks/benchmarks.rs
new file mode 100644
index 0000000000..10451b621a
--- /dev/null
+++ b/xtask/src/tasks/benchmarks.rs
@@ -0,0 +1,557 @@
+//! Benchmark task wrappers and helpers.
+
+use chrono::Utc;
+use color_eyre::eyre::{Context, Result, bail};
+use serde_json::{Map, Value};
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+use std::{fs, io};
+use walkdir::WalkDir;
+
+use crate::utils::project_root;
+
+pub fn run_benchmarks(
+    output: Option<PathBuf>,
+    quick: bool,
+    category: Option<String>,
+) -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("benchmarks").join("scripts").join("run-benchmarks.sh");
+
+    let mut args: Vec<String> = Vec::new();
+    if let Some(output_file) = output {
+        args.push("--output".to_string());
+        args.push(output_file.to_string_lossy().into_owned());
+    }
+    if quick {
+        args.push("--quick".to_string());
+    }
+    if let Some(category) = category {
+        args.push("--category".to_string());
+        args.push(category);
+    }
+
+    let arg_refs: Vec<&str> = args.iter().map(String::as_str).collect();
+    run_script(&script, &arg_refs, "benchmarks runner")
+}
+
+pub fn compare_benchmarks(fail_on_regression: bool) -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("benchmarks").join("scripts").join("compare.sh");
+
+    let args = if fail_on_regression { vec!["--fail-on-regression"] } else { Vec::<&str>::new() };
+    run_script(&script, &args, "benchmark comparison")
+}
+
+pub fn format_benchmarks(receipt: bool, markdown: bool) -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("benchmarks").join("scripts").join("format-results.py");
+    let source = Path::new("benchmarks/results/latest.json");
+
+    let mut args: Vec<String> = vec![source.display().to_string()];
+    if receipt {
+        args.push("--receipt".to_string());
+    }
+    if markdown {
+        args.push("--markdown".to_string());
+    }
+
+    let arg_refs: Vec<&str> = args.iter().map(String::as_str).collect();
+    run_python_script(&script, &arg_refs, "benchmark results formatter")
+}
+
+pub fn alert_benchmarks(format: Option<String>, check: bool) -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("benchmarks").join("scripts").join("alert.py");
+
+    let mut args = Vec::<String>::new();
+    if let Some(format) = format {
+        args.push("--format".to_string());
+        args.push(format);
+    }
+    if check {
+        args.push("--check".to_string());
+    }
+
+    let arg_refs: Vec<&str> = args.iter().map(String::as_str).collect();
+    run_python_script(&script, &arg_refs, "benchmark alerting")
+}
+
+pub fn extract_criterion(base_path: Option<PathBuf>, output: Option<PathBuf>) -> Result<()> {
+    let root = project_root()?;
+    let base_path = base_path.unwrap_or_else(|| root.clone());
+    let results_root = base_path.join("target").join("criterion");
+
+    let by_category = parse_criterion_results(&results_root)?;
+    let output_path = output.unwrap_or_else(|| root.join("benchmarks/results/latest.json"));
+    if let Some(parent) = output_path.parent() {
+        fs::create_dir_all(parent)
+            .with_context(|| format!("Failed to create {}", parent.display()))?;
+    }
+
+    let mut categories = Map::new();
+    let mut total = 0usize;
+    for (category, mut benchmarks) in by_category {
+        total += benchmarks.len();
+        benchmarks.insert("_category".to_string(), Value::String(category.clone()));
+        categories.insert(category, Value::Object(benchmarks));
+    }
+
+    let (git_sha, git_dirty) = git_status(&root)?;
+    let rust_version = rust_version()?;
+    let payload = serde_json::json!({
+        "version": "0.9.0",
+        "timestamp": Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string(),
+        "git_sha": git_sha,
+        "git_dirty": git_dirty,
+        "environment": {
+            "os": std::env::consts::OS,
+            "rust_version": rust_version,
+            "extracted_from": "criterion",
+        },
+        "results": categories,
+    });
+
+    fs::write(
+        &output_path,
+        serde_json::to_string_pretty(&payload).context("Failed to encode benchmark payload")?,
+    )
+    .with_context(|| format!("Failed to write {}", output_path.display()))?;
+
+    println!("Results extracted to {}", output_path.display());
+    println!("Total benchmarks: {total}");
+    for category in payload
+        .get("results")
+        .and_then(Value::as_object)
+        .into_iter()
+        .flat_map(|results| results.iter())
+    {
+        let count = category
+            .1
+            .as_object()
+            .map(|benchmarks| benchmarks.keys().filter(|name| !name.starts_with("_")).count())
+            .unwrap_or(0);
+        println!("  {}: {}", category.0, count);
+    }
+
+    Ok(())
+}
+
+pub fn test_alert_system() -> Result<()> {
+    let root = project_root()?;
+    let alert_script = root.join("benchmarks/scripts/alert.py");
+    let baseline_path = root.join("benchmarks/baselines/v0.9.0.json");
+    let config_path = root.join(".ci/benchmark-thresholds.yaml");
+    let workdir = root.join("target").join("xtask").join("bench-alert-test");
+    fs::create_dir_all(&workdir)
+        .with_context(|| format!("Failed to create {}", workdir.display()))?;
+
+    if !alert_script.exists() {
+        bail!("Missing benchmark alert script at {}", alert_script.display());
+    }
+    if !baseline_path.exists() {
+        bail!("Missing benchmark baseline at {}", baseline_path.display());
+    }
+    if !config_path.exists() {
+        bail!("Missing benchmark threshold config at {}", config_path.display());
+    }
+
+    let baseline = load_json(&baseline_path)?;
+
+    run_alert_case(
+        &root,
+        &alert_script,
+        &config_path,
+        &baseline_path,
+        &baseline,
+        workdir.join("alert_test_no_regression.json"),
+        1.0,
+        None,
+        &["No performance alerts detected"],
+        true,
+    )?;
+    run_alert_case(
+        &root,
+        &alert_script,
+        &config_path,
+        &baseline_path,
+        &baseline,
+        workdir.join("alert_test_warning.json"),
+        1.11,
+        None,
+        &["WARNING", "1"],
+        true,
+    )?;
+    run_alert_case(
+        &root,
+        &alert_script,
+        &config_path,
+        &baseline_path,
+        &baseline,
+        workdir.join("alert_test_regression.json"),
+        1.25,
+        None,
+        &["REGRESSION"],
+        true,
+    )?;
+    run_alert_case(
+        &root,
+        &alert_script,
+        &config_path,
+        &baseline_path,
+        &baseline,
+        workdir.join("alert_test_critical.json"),
+        1.60,
+        None,
+        &["CRITICAL"],
+        true,
+    )?;
+    run_alert_case(
+        &root,
+        &alert_script,
+        &config_path,
+        &baseline_path,
+        &baseline,
+        workdir.join("alert_test_markdown.json"),
+        1.25,
+        Some("markdown"),
+        &["## Performance Benchmark Results", "⚠️ Performance Regressions"],
+        true,
+    )?;
+    run_alert_check_case(
+        &root,
+        &alert_script,
+        &baseline_path,
+        &baseline,
+        workdir.join("alert_test_check.json"),
+    )?;
+    run_alert_case(
+        &root,
+        &alert_script,
+        &config_path,
+        &baseline_path,
+        &baseline,
+        workdir.join("alert_test_improvement.json"),
+        0.80,
+        None,
+        &["IMPROVED"],
+        true,
+    )?;
+
+    println!("All benchmark alert-system checks passed");
+    Ok(())
+}
+
+fn run_alert_case(
+    root: &Path,
+    alert_script: &Path,
+    config_path: &Path,
+    baseline_path: &Path,
+    baseline: &Value,
+    current_path: PathBuf,
+    multiplier: f64,
+    format: Option<&str>,
+    expected: &[&str],
+    expect_success: bool,
+) -> Result<()> {
+    let mut current = baseline.clone();
+    mutate_parse_simple_script(&mut current, multiplier)?;
+    fs::write(&current_path, serde_json::to_string_pretty(&current)?)
+        .with_context(|| format!("Failed to write {}", current_path.display()))?;
+
+    let mut args = vec![
+        alert_script.to_string_lossy().to_string(),
+        baseline_path.to_string_lossy().to_string(),
+        current_path.to_string_lossy().to_string(),
+        "--config".to_string(),
+        config_path.to_string_lossy().to_string(),
+    ];
+    if let Some(format) = format {
+        args.push("--format".to_string());
+        args.push(format.to_string());
+    }
+
+    let output = Command::new("python3")
+        .current_dir(root)
+        .args(&args)
+        .output()
+        .context("Failed to execute alert.py")?;
+
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    if expect_success != output.status.success() {
+        bail!("alert.py command status mismatch (expected success: {expect_success})");
+    }
+
+    for fragment in expected {
+        if !stdout.contains(fragment) {
+            bail!("Expected output to contain '{fragment}'");
+        }
+    }
+
+    Ok(())
+}
+
+fn run_alert_check_case(
+    root: &Path,
+    alert_script: &Path,
+    baseline_path: &Path,
+    baseline: &Value,
+    current_path: PathBuf,
+) -> Result<()> {
+    let mut current = baseline.clone();
+    mutate_parse_simple_script(&mut current, 1.60)?;
+
+    fs::write(&current_path, serde_json::to_string_pretty(&current)?)
+        .with_context(|| format!("Failed to write {}", current_path.display()))?;
+
+    let config_path =
+        root.join("target").join("xtask").join("bench-alert-test").join("critical_check.yaml");
+    let mut config_payload = String::new();
+    config_payload.push_str("defaults:\n");
+    config_payload.push_str("  warn_threshold_pct: 10\n");
+    config_payload.push_str("  regression_threshold_pct: 20\n");
+    config_payload.push_str("  critical_threshold_pct: 50\n");
+    config_payload.push_str("  improvement_threshold_pct: 10\n");
+    config_payload.push_str("alerting:\n");
+    config_payload.push_str("  fail_on_critical: true\n");
+    fs::write(&config_path, config_payload).context("Failed to write critical-check config")?;
+
+    let output = Command::new("python3")
+        .current_dir(root)
+        .args([
+            alert_script.to_str().ok_or_else(|| io::Error::other("Invalid alert script path"))?,
+            baseline_path.to_str().ok_or_else(|| io::Error::other("Invalid baseline path"))?,
+            current_path.to_str().ok_or_else(|| io::Error::other("Invalid current output path"))?,
+            "--config",
+            config_path.to_str().ok_or_else(|| io::Error::other("Invalid check config path"))?,
+            "--check",
+        ])
+        .output()
+        .context("Failed to execute alert.py with check flag")?;
+
+    if output.status.success() {
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        bail!("Expected critical check failure. output={stdout}");
+    }
+
+    Ok(())
+}
+
+fn mutate_parse_simple_script(data: &mut Value, multiplier: f64) -> Result<()> {
+    let parse_simple = data
+        .get_mut("benchmarks")
+        .and_then(|benchmarks| benchmarks.get_mut("parser"))
+        .and_then(|parser| parser.get_mut("parse_simple_script"))
+        .ok_or_else(|| color_eyre::eyre::eyre!("Missing benchmarks.parser.parse_simple_script"))?;
+
+    if let Some(mean) = parse_simple.get_mut("mean").and_then(Value::as_object_mut) {
+        if let Some(ns) = mean.get_mut("nanoseconds") {
+            multiply_json_number(ns, multiplier)?;
+            return Ok(());
+        }
+        if let Some(point_estimate) = mean.get_mut("point_estimate") {
+            multiply_json_number(point_estimate, multiplier)?;
+            return Ok(());
+        }
+    }
+
+    if let Some(mean_ns) = parse_simple.get_mut("mean_ns") {
+        multiply_json_number(mean_ns, multiplier)?;
+        return Ok(());
+    }
+
+    bail!("Could not find a supported parse_simple_script mean value")
+}
+
+fn multiply_json_number(value: &mut Value, multiplier: f64) -> Result<()> {
+    let parsed = value
+        .as_f64()
+        .or_else(|| value.as_u64().map(|value| value as f64))
+        .ok_or_else(|| color_eyre::eyre::eyre!("Expected numeric benchmark value"))?;
+    let next = (parsed * multiplier).round();
+    let next = serde_json::Number::from_f64(next.max(0.0))
+        .ok_or_else(|| color_eyre::eyre::eyre!("Failed to encode scaled benchmark value"))?;
+    *value = Value::Number(next);
+    Ok(())
+}
+
+fn parse_criterion_results(criterion_dir: &Path) -> Result<BTreeMap<String, Map<String, Value>>> {
+    if !criterion_dir.exists() {
+        return Ok(BTreeMap::new());
+    }
+
+    let mut by_category: BTreeMap<String, Map<String, Value>> = BTreeMap::new();
+    for entry in WalkDir::new(criterion_dir) {
+        let entry = entry?;
+        if !entry.file_type().is_file() || entry.file_name() != "estimates.json" {
+            continue;
+        }
+
+        let path = entry.path();
+        let relative = path
+            .strip_prefix(criterion_dir)
+            .context("Failed to relativize criterion result path")?;
+        let parts: Vec<_> = relative
+            .components()
+            .map(|part| part.as_os_str().to_string_lossy().to_string())
+            .collect();
+        if parts.len() < 3 {
+            eprintln!("Warning: unexpected criterion path {}", path.display());
+            continue;
+        }
+
+        let group = parts[0].as_str();
+        let bench_name = parts[1].as_str();
+        let category = categorize_benchmark(group, bench_name);
+
+        let file_content = fs::read_to_string(path)
+            .with_context(|| format!("Failed to read {}", path.display()))?;
+        let estimate: Value = serde_json::from_str(&file_content)
+            .with_context(|| format!("Invalid JSON in {}", path.display()))?;
+
+        let mean = match estimate.get("mean").and_then(Value::as_object) {
+            Some(mean) => mean,
+            None => {
+                eprintln!("Warning: missing mean entry in {}", path.display());
+                continue;
+            }
+        };
+        let mean_ns = extract_u64(mean.get("point_estimate")).or_else(|_| {
+            extract_u64(mean.get("estimate")).or_else(|_| extract_u64(mean.get("value")))
+        })?;
+        let confidence = mean.get("confidence_interval").and_then(Value::as_object);
+        let low_ns = confidence
+            .and_then(|object| object.get("lower_bound"))
+            .and_then(|value| extract_u64(Some(value)).ok())
+            .unwrap_or(mean_ns);
+        let high_ns = confidence
+            .and_then(|object| object.get("upper_bound"))
+            .and_then(|value| extract_u64(Some(value)).ok())
+            .unwrap_or(mean_ns);
+
+        let (unit, display) = display_duration(mean_ns);
+
+        let mut entry = Map::new();
+        entry.insert("mean_ns".to_string(), Value::from(mean_ns));
+        entry.insert("low_ns".to_string(), Value::from(low_ns));
+        entry.insert("high_ns".to_string(), Value::from(high_ns));
+        entry.insert("unit".to_string(), Value::String(unit));
+        entry.insert("display".to_string(), Value::String(display));
+
+        by_category
+            .entry(category)
+            .or_default()
+            .insert(bench_name.to_string(), Value::Object(entry));
+    }
+
+    Ok(by_category)
+}
+
+fn categorize_benchmark(group: &str, bench_name: &str) -> String {
+    let group = group.to_ascii_lowercase();
+    let bench = bench_name.to_ascii_lowercase();
+
+    if group.contains("parser") || bench.contains("parse") {
+        "parser".to_string()
+    } else if group.contains("lexer") || bench.contains("token") {
+        "lexer".to_string()
+    } else if group.contains("rope") || group.contains("position") || group.contains("lsp") {
+        "lsp".to_string()
+    } else if group.contains("index") || group.contains("workspace") || bench.contains("symbol") {
+        "index".to_string()
+    } else {
+        "other".to_string()
+    }
+}
+
+fn extract_u64(value: Option<&Value>) -> Result<u64> {
+    let value = value.ok_or_else(|| color_eyre::eyre::eyre!("Missing numeric value"))?;
+    value
+        .as_u64()
+        .or_else(|| value.as_f64().map(|value| value.max(0.0) as u64))
+        .or_else(|| value.as_i64().map(|value| value.max(0) as u64))
+        .ok_or_else(|| color_eyre::eyre::eyre!("Unsupported numeric value"))
+}
+
+fn display_duration(ns: u64) -> (String, String) {
+    if ns < 1_000 {
+        ("ns".to_string(), format!("{ns} ns"))
+    } else if ns < 1_000_000 {
+        ("us".to_string(), format!("{:.1} us", ns as f64 / 1_000.0))
+    } else if ns < 1_000_000_000 {
+        ("ms".to_string(), format!("{:.1} ms", ns as f64 / 1_000_000.0))
+    } else {
+        ("s".to_string(), format!("{:.2} s", ns as f64 / 1_000_000_000.0))
+    }
+}
+
+fn git_status(root: &Path) -> Result<(String, bool)> {
+    let sha_output = Command::new("git")
+        .current_dir(root)
+        .args(["rev-parse", "--short", "HEAD"])
+        .output()
+        .context("Failed to run git rev-parse")?;
+    let sha = if sha_output.status.success() {
+        String::from_utf8_lossy(&sha_output.stdout).trim().to_string()
+    } else {
+        "unknown".to_string()
+    };
+
+    let dirty = Command::new("git")
+        .current_dir(root)
+        .args(["diff", "--quiet"])
+        .status()
+        .map(|status| !status.success())
+        .unwrap_or(true);
+
+    Ok((sha, dirty))
+}
+
+fn rust_version() -> Result<String> {
+    let output =
+        Command::new("rustc").arg("--version").output().context("Failed to run rustc --version")?;
+    if !output.status.success() {
+        return Ok("unknown".to_string());
+    }
+
+    let line = String::from_utf8_lossy(&output.stdout);
+    let mut parts = line.split_whitespace();
+    parts.next();
+    Ok(parts.next().unwrap_or("unknown").to_string())
+}
+
+fn load_json(path: &Path) -> Result<Value> {
+    let content =
+        fs::read_to_string(path).with_context(|| format!("Failed to read {}", path.display()))?;
+    Ok(serde_json::from_str(&content)
+        .with_context(|| format!("Invalid JSON in {}", path.display()))?)
+}
+
+fn run_script(script: &Path, args: &[&str], label: &str) -> Result<()> {
+    let status = Command::new("bash")
+        .arg(script)
+        .args(args)
+        .status()
+        .with_context(|| format!("failed to execute {}", label))?;
+
+    if status.success() {
+        Ok(())
+    } else {
+        bail!("benchmark script failed: {}", label);
+    }
+}
+
+fn run_python_script(script: &Path, args: &[&str], label: &str) -> Result<()> {
+    let status = Command::new("python3")
+        .arg(script)
+        .args(args)
+        .status()
+        .with_context(|| format!("failed to execute {}", label))?;
+
+    if status.success() {
+        Ok(())
+    } else {
+        bail!("python benchmark task failed: {}", label);
+    }
+}
diff --git a/xtask/src/tasks/build_timing.rs b/xtask/src/tasks/build_timing.rs
new file mode 100644
index 0000000000..974064b27f
--- /dev/null
+++ b/xtask/src/tasks/build_timing.rs
@@ -0,0 +1,469 @@
+//! Build timing collection and comparison automation.
+
+use crate::utils::project_root;
+use chrono::Utc;
+use color_eyre::eyre::{Context, Result};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use std::collections::BTreeMap;
+use std::collections::BTreeSet;
+use std::fs::{self, OpenOptions};
+use std::io::Write;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+use std::time::Instant;
+
+const ARTIFACTS_DIR: &str = "artifacts";
+const TIMING_RECEIPT_FILE: &str = "build-timing-receipt.json";
+const TIMING_BASELINE_FILE: &str = "build-timing-baseline.json";
+const LSP_PROVIDERS_LIB: &str = "crates/perl-lsp-providers/src/lib.rs";
+const PARSER_LIB: &str = "crates/perl-parser/src/lib.rs";
+
+#[derive(Serialize)]
+struct BuildTimingReceipt {
+    timestamp: String,
+    toolchain: String,
+    system: SystemInfo,
+    measurements: BTreeMap<String, BuildMeasurement>,
+}
+
+#[derive(Serialize)]
+struct SystemInfo {
+    cpu_cores: Value,
+    memory_gb: Value,
+    os: String,
+}
+
+#[derive(Serialize, Deserialize)]
+struct BuildMeasurement {
+    duration_seconds: f64,
+    command: String,
+}
+
+#[derive(Deserialize)]
+struct MeasurableReceipt {
+    timestamp: String,
+    toolchain: String,
+    measurements: BTreeMap<String, BuildMeasurement>,
+}
+
+pub fn run_receipt(
+    run_clean: bool,
+    run_incremental: bool,
+    run_tests: bool,
+    output: Option<PathBuf>,
+    baseline: bool,
+) -> Result<()> {
+    let root = project_root()?;
+    let mut run_clean = run_clean;
+    let mut run_incremental = run_incremental;
+    let mut run_tests = run_tests;
+
+    if !run_clean && !run_incremental && !run_tests {
+        run_clean = true;
+        run_incremental = true;
+        run_tests = true;
+    }
+
+    let artifacts = root.join(ARTIFACTS_DIR);
+    fs::create_dir_all(&artifacts)
+        .with_context(|| format!("Failed to create artifacts directory {}", artifacts.display()))?;
+
+    let mut output_path = if let Some(output) = output {
+        if output.is_absolute() { output } else { root.join(output) }
+    } else {
+        artifacts.join(TIMING_RECEIPT_FILE)
+    };
+
+    if baseline {
+        output_path = artifacts.join(TIMING_BASELINE_FILE);
+    }
+
+    if let Some(parent) = output_path.parent() {
+        fs::create_dir_all(parent)
+            .with_context(|| format!("Failed to create output directory {}", parent.display()))?;
+    }
+
+    let system = collect_system_info(&root);
+    let mut measurements = BTreeMap::new();
+
+    if run_clean {
+        let measurement = measure_command(
+            &root,
+            "clean_build_workspace",
+            &["cargo", "build", "--workspace", "--locked"],
+            Some(&["cargo", "clean"]),
+        );
+        measurements.insert("clean_build_workspace".to_string(), measurement);
+    }
+
+    if run_incremental {
+        let providers_dir = root.join("crates/perl-lsp-providers");
+        run_command_silently(&root, &["cargo", "build", "--workspace", "--locked"]);
+        if providers_dir.exists() {
+            touch_file(&root.join(LSP_PROVIDERS_LIB))?;
+            let measurement = measure_command(
+                &root,
+                "incremental_build_providers",
+                &["cargo", "build", "-p", "perl-lsp-providers", "--locked"],
+                None,
+            );
+            measurements.insert("incremental_build_providers".to_string(), measurement);
+        } else {
+            touch_file(&root.join(PARSER_LIB))?;
+            let measurement = measure_command(
+                &root,
+                "incremental_build_parser",
+                &["cargo", "build", "-p", "perl-parser", "--locked"],
+                None,
+            );
+            measurements.insert("incremental_build_parser".to_string(), measurement);
+        }
+    }
+
+    if run_tests {
+        let measurement = measure_command(
+            &root,
+            "test_build_workspace",
+            &["cargo", "test", "--workspace", "--lib", "--locked"],
+            None,
+        );
+        measurements.insert("test_build_workspace".to_string(), measurement);
+    }
+
+    let receipt = BuildTimingReceipt {
+        timestamp: Utc::now().format("%Y-%m-%dT%H:%M:%SZ").to_string(),
+        toolchain: command_output_or_unknown(&["rustc", "--version"]),
+        system,
+        measurements,
+    };
+
+    let payload = serde_json::to_string_pretty(&receipt)
+        .context("Failed to serialize build timing receipt")?;
+    fs::write(&output_path, format!("{payload}\n")).context("Failed to write timing receipt")?;
+
+    println!("=== Build Timing Receipt Generated ===");
+    println!("Output: {}", output_path.display());
+    println!();
+    println!("{payload}");
+
+    if baseline {
+        println!();
+        println!("Baseline saved to: {}", output_path.display());
+        println!("Use this baseline to compare against future measurements:");
+        println!(
+            "  cargo xtask compare-build-timing {} <new-measurement.json>",
+            output_path.display()
+        );
+    }
+
+    Ok(())
+}
+
+pub fn run_compare(baseline: PathBuf, current: PathBuf) -> Result<()> {
+    let baseline_path = resolve_path(&baseline)?;
+    let current_path = resolve_path(&current)?;
+
+    let baseline_raw = fs::read_to_string(&baseline_path)
+        .with_context(|| format!("Failed to read {}", baseline_path.display()))?;
+    let current_raw = fs::read_to_string(&current_path)
+        .with_context(|| format!("Failed to read {}", current_path.display()))?;
+
+    let baseline: MeasurableReceipt =
+        serde_json::from_str(&baseline_raw).context("Failed to parse baseline receipt")?;
+    let current: MeasurableReceipt =
+        serde_json::from_str(&current_raw).context("Failed to parse current receipt")?;
+
+    println!("# Build Timing Comparison");
+    println!();
+    println!("**Generated:** {}", Utc::now().format("%Y-%m-%dT%H:%M:%SZ"));
+    println!();
+    println!("## Metadata");
+    println!("| Property | Baseline | Current |");
+    println!("|----------|----------|---------|");
+    println!("| Timestamp | {} | {} |", baseline.timestamp, current.timestamp);
+    println!("| Toolchain | {} | {} |", baseline.toolchain, current.toolchain);
+    println!();
+    println!("## Build Timing Results");
+    println!();
+    println!("| Metric | Baseline | Current | Change | Improvement |");
+    println!("|--------|----------|---------|---------|-------------|");
+
+    let mut all_keys = BTreeSet::new();
+    all_keys.extend(baseline.measurements.keys().cloned());
+    all_keys.extend(current.measurements.keys().cloned());
+
+    let mut total_metrics = 0usize;
+    let mut improvements = 0usize;
+    let mut regressions = 0usize;
+
+    for key in all_keys {
+        total_metrics += 1;
+        let baseline_measurement = baseline.measurements.get(&key);
+        let current_measurement = current.measurements.get(&key);
+        match (baseline_measurement, current_measurement) {
+            (Some(base), Some(curr)) => {
+                let change = curr.duration_seconds - base.duration_seconds;
+                let improvement = if base.duration_seconds != 0.0 {
+                    (base.duration_seconds - curr.duration_seconds) / base.duration_seconds * 100.0
+                } else {
+                    0.0
+                };
+
+                let mut improvement_label = format!("{improvement:.1}%");
+                if improvement > 0.0 {
+                    improvements += 1;
+                    improvement_label = format!("🟢 {improvement_label}");
+                } else if improvement < 0.0 {
+                    regressions += 1;
+                    improvement_label = format!("🔴 {improvement_label}");
+                }
+
+                println!(
+                    "| {key} | {} | {} | {} | {} |",
+                    format_seconds(base.duration_seconds),
+                    format_seconds(curr.duration_seconds),
+                    format_signed_seconds(change),
+                    improvement_label
+                );
+            }
+            (Some(base), None) => {
+                println!("| {key} | {} | N/A | N/A | N/A |", format_seconds(base.duration_seconds));
+            }
+            (None, Some(curr)) => {
+                println!("| {key} | N/A | {} | N/A | N/A |", format_seconds(curr.duration_seconds));
+            }
+            _ => {}
+        }
+    }
+
+    println!();
+    println!("## Summary");
+    println!();
+    println!("- **Total metrics compared:** {total_metrics}");
+    println!("- **Improvements:** {improvements}");
+    println!("- **Regressions:** {regressions}");
+    println!();
+
+    println!("## Target Validation");
+    println!();
+
+    print_target_validation(
+        "Full Workspace Build (Target: 40% faster)",
+        baseline.measurements.get("clean_build_workspace").map(|m| m.duration_seconds),
+        current.measurements.get("clean_build_workspace").map(|m| m.duration_seconds),
+        Some(40.0),
+    );
+
+    let baseline_incremental = baseline
+        .measurements
+        .get("incremental_build_providers")
+        .map(|m| m.duration_seconds)
+        .or_else(|| {
+            baseline.measurements.get("incremental_build_parser").map(|m| m.duration_seconds)
+        });
+    let current_incremental = current
+        .measurements
+        .get("incremental_build_providers")
+        .map(|m| m.duration_seconds)
+        .or_else(|| {
+            current.measurements.get("incremental_build_parser").map(|m| m.duration_seconds)
+        });
+
+    print_target_validation(
+        "Incremental Build (Target: 67% faster)",
+        baseline_incremental,
+        current_incremental,
+        Some(67.0),
+    );
+
+    print_target_validation_no_target(
+        "Test Build",
+        baseline.measurements.get("test_build_workspace").map(|m| m.duration_seconds),
+        current.measurements.get("test_build_workspace").map(|m| m.duration_seconds),
+    );
+
+    Ok(())
+}
+
+fn resolve_path(path: &PathBuf) -> Result<PathBuf> {
+    let root = project_root()?;
+    let candidate = if path.is_absolute() { path.clone() } else { root.join(path) };
+    Ok(candidate)
+}
+
+fn format_seconds(value: f64) -> String {
+    format!("{value:.1}s")
+}
+
+fn format_signed_seconds(value: f64) -> String {
+    format!("{value:+.1}s")
+}
+
+fn print_target_validation(
+    label: &str,
+    baseline: Option<f64>,
+    current: Option<f64>,
+    target: Option<f64>,
+) {
+    match (baseline, current) {
+        (Some(base), Some(cur)) => {
+            let improvement = if base != 0.0 { (base - cur) / base * 100.0 } else { 0.0 };
+
+            println!("### {label}");
+            println!("- Baseline: {}", format_seconds(base));
+            println!("- Current: {}", format_seconds(cur));
+            println!("- Improvement: {improvement:.1}%");
+            if let Some(target) = target {
+                if improvement >= target {
+                    println!("- Status: ✅ **Target Met**");
+                } else {
+                    println!("- Status: ❌ **Target Not Met**");
+                }
+            }
+            println!();
+        }
+        _ => {
+            println!("### {label}");
+            println!("- Status: ⚠️ **No data available**");
+            println!();
+        }
+    }
+}
+
+fn print_target_validation_no_target(label: &str, baseline: Option<f64>, current: Option<f64>) {
+    match (baseline, current) {
+        (Some(base), Some(cur)) => {
+            let improvement = if base != 0.0 { (base - cur) / base * 100.0 } else { 0.0 };
+
+            println!("### {label}");
+            println!("- Baseline: {}", format_seconds(base));
+            println!("- Current: {}", format_seconds(cur));
+            println!("- Improvement: {improvement:.1}%");
+            println!();
+        }
+        _ => {
+            println!("### {label}");
+            println!("- Status: ⚠️ **No data available**");
+            println!();
+        }
+    }
+}
+
+fn collect_system_info(_root: &Path) -> SystemInfo {
+    SystemInfo {
+        cpu_cores: command_output_parse_or_unknown(&["nproc"])
+            .or_else(|| command_output_parse_or_unknown(&["getconf", "_NPROCESSORS_ONLN"]))
+            .unwrap_or_else(|| Value::String("unknown".to_string())),
+        memory_gb: detect_memory_gb(),
+        os: command_output_or_unknown(&["uname", "-s", "-r"]),
+    }
+}
+
+fn detect_memory_gb() -> Value {
+    if let Some(mem) = parse_memory_from_free() {
+        return Value::from(mem);
+    }
+
+    command_output_parse_f64_or_unknown(&["sysctl", "-n", "hw.memsize"])
+        .and_then(|value| {
+            if value.is_number() {
+                if let Some(raw) = value.as_f64() {
+                    return Some(Value::from((raw / 1024.0 / 1024.0 / 1024.0).round() as u64));
+                }
+            }
+            None
+        })
+        .unwrap_or_else(|| Value::String("unknown".to_string()))
+}
+
+fn parse_memory_from_free() -> Option<u64> {
+    let output = command_output(&["free", "-g"])?;
+    for line in output.lines() {
+        if line.starts_with("Mem:") {
+            return line.split_whitespace().nth(1).and_then(|value| value.parse::<u64>().ok());
+        }
+    }
+    None
+}
+
+fn command_output_or_unknown(command: &[&str]) -> String {
+    match command_output(command) {
+        Some(value) => value,
+        None => "unknown".to_string(),
+    }
+}
+
+fn command_output_parse_or_unknown(command: &[&str]) -> Option<Value> {
+    command_output(command).and_then(|value| value.trim().parse::<u64>().ok().map(Value::from))
+}
+
+fn command_output_parse_f64_or_unknown(command: &[&str]) -> Option<Value> {
+    command_output(command).and_then(|value| value.trim().parse::<f64>().ok().map(Value::from))
+}
+
+fn command_output(command: &[&str]) -> Option<String> {
+    let (program, args) = command.split_first()?;
+    let output = Command::new(program).args(args).output().ok()?;
+    if !output.status.success() {
+        return None;
+    }
+    String::from_utf8(output.stdout).ok().map(|s| s.trim().to_string()).filter(|s| !s.is_empty())
+}
+
+fn touch_file(path: &Path) -> Result<()> {
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent)
+            .with_context(|| format!("Failed to create {} parent directories", parent.display()))?;
+    }
+
+    let mut file = OpenOptions::new().create(true).append(true).open(path)?;
+    file.write_all(&[])?;
+    Ok(())
+}
+
+fn measure_command(
+    root: &Path,
+    name: &str,
+    command: &[&str],
+    pre_command: Option<&[&str]>,
+) -> BuildMeasurement {
+    println!("=== Measuring: {name} ===");
+    println!("Command: {}", command_to_string(command));
+
+    if let Some(pre) = pre_command {
+        println!("Pre-command: {}", command_to_string(pre));
+        run_command_silently(root, pre);
+    }
+
+    let duration = run_command_silently(root, command);
+    println!("Duration: {duration:.4}s");
+    println!();
+
+    BuildMeasurement { duration_seconds: duration, command: command_to_string(command) }
+}
+
+fn run_command_silently(root: &Path, command: &[&str]) -> f64 {
+    let start = Instant::now();
+    let status = Command::new(command[0])
+        .current_dir(root)
+        .args(&command[1..])
+        .stdin(Stdio::null())
+        .stdout(Stdio::null())
+        .stderr(Stdio::null())
+        .status();
+
+    if let Ok(status) = status {
+        if !status.success() {
+            println!("⚠️ Command exited with status {status}");
+        }
+    } else {
+        println!("⚠️ Command failed to launch: {}", command_to_string(command));
+    }
+
+    start.elapsed().as_secs_f64()
+}
+
+fn command_to_string(command: &[&str]) -> String {
+    command.join(" ")
+}
diff --git a/xtask/src/tasks/check_toolchain.rs b/xtask/src/tasks/check_toolchain.rs
new file mode 100644
index 0000000000..0910f2fbb3
--- /dev/null
+++ b/xtask/src/tasks/check_toolchain.rs
@@ -0,0 +1,101 @@
+//! Rust toolchain check implementation.
+
+use color_eyre::eyre::{Context, Result, bail};
+use serde::Deserialize;
+use std::cmp::Ordering;
+use std::process::Command;
+
+use crate::utils::project_root;
+
+#[derive(Deserialize)]
+struct RustToolchainFile {
+    toolchain: RustToolchain,
+}
+
+#[derive(Deserialize)]
+struct RustToolchain {
+    channel: String,
+}
+
+pub fn run(doctor: bool) -> Result<()> {
+    let root = project_root()?;
+    let toolchain_file = root.join("rust-toolchain.toml");
+
+    if !toolchain_file.exists() {
+        println!("⚠️  rust-toolchain.toml not found; skipping pinned toolchain check");
+        return Ok(());
+    }
+
+    let raw = std::fs::read_to_string(&toolchain_file)
+        .with_context(|| format!("Failed to read {}", toolchain_file.display()))?;
+    let toolchain: RustToolchainFile =
+        toml::from_str(&raw).context("Failed to parse rust-toolchain.toml")?;
+    let required =
+        toolchain.toolchain.channel.trim().trim_matches('\"').trim_matches('\'').to_string();
+    let required_parts = parse_version_parts(&required);
+
+    if required_parts.is_empty() {
+        println!("⚠️  Could not parse pinned toolchain from rust-toolchain.toml");
+        return Ok(());
+    }
+
+    let rustc_output =
+        Command::new("rustc").arg("--version").output().context("Failed to run rustc --version")?;
+    let rustc_text = String::from_utf8(rustc_output.stdout)
+        .context("rustc --version output is not valid UTF-8")?;
+    let current = rustc_text
+        .split_whitespace()
+        .nth(1)
+        .ok_or_else(|| color_eyre::eyre::eyre!("Unexpected rustc --version output"))?
+        .to_string();
+    let current_parts = parse_version_parts(&current);
+
+    if current_parts.is_empty() {
+        bail!("Could not parse rustc version from {:?}", rustc_text);
+    }
+
+    match compare_versions(&current_parts, &required_parts) {
+        Ordering::Less => {
+            bail!(
+                "Rust {current} is older than pinned MSRV {required}; install {} and set override",
+                required
+            );
+        }
+        Ordering::Equal => {
+            println!("✅ Rust toolchain matches pinned version: {current}");
+        }
+        Ordering::Greater => {
+            if doctor {
+                println!(
+                    "⚠️  Using Rust {current} while rust-toolchain.toml pins {required}; use 'rustup override set {required}' for exact parity"
+                );
+            } else {
+                println!("✅ Rust {current} satisfies pinned MSRV {required}");
+            }
+        }
+    }
+
+    Ok(())
+}
+
+fn parse_version_parts(version: &str) -> Vec<u32> {
+    version
+        .split(|c| c == '.' || c == '-' || c == '+')
+        .filter_map(|part| {
+            part.chars().take_while(|c| c.is_ascii_digit()).collect::<String>().parse::<u32>().ok()
+        })
+        .collect()
+}
+
+fn compare_versions(actual: &[u32], required: &[u32]) -> Ordering {
+    let max_len = std::cmp::max(actual.len(), required.len());
+    for index in 0..max_len {
+        let a = actual.get(index).copied().unwrap_or(0);
+        let b = required.get(index).copied().unwrap_or(0);
+        match a.cmp(&b) {
+            Ordering::Equal => {}
+            other => return other,
+        }
+    }
+    Ordering::Equal
+}
diff --git a/xtask/src/tasks/check_version_sync.rs b/xtask/src/tasks/check_version_sync.rs
new file mode 100644
index 0000000000..0df0be913d
--- /dev/null
+++ b/xtask/src/tasks/check_version_sync.rs
@@ -0,0 +1,38 @@
+//! check-version-sync task wrapper.
+//!
+//! The historical shell script attempted to run a local `perl-ci-hygiene` binary
+//! if present and otherwise falls back to `cargo run`.
+
+use crate::utils::project_root;
+use color_eyre::eyre::{Context, Result, bail};
+use std::process::Command;
+
+pub fn run() -> Result<()> {
+    let root = project_root()?;
+    let local_binary = root.join("target/debug/perl-ci-hygiene");
+    let mut command = if local_binary.exists() {
+        let mut cmd = Command::new(local_binary);
+        cmd.arg("check-version-sync");
+        cmd
+    } else {
+        let mut cmd = Command::new("cargo");
+        cmd.args([
+            "run",
+            "--quiet",
+            "--manifest-path",
+            root.join("Cargo.toml").to_string_lossy().as_ref(),
+            "-p",
+            "perl-ci-hygiene",
+            "--",
+            "check-version-sync",
+        ]);
+        cmd
+    };
+
+    let status = command.status().context("failed to run check-version-sync")?;
+    if !status.success() {
+        bail!("check-version-sync command failed");
+    }
+
+    Ok(())
+}
diff --git a/xtask/src/tasks/ci_audit_workflows.rs b/xtask/src/tasks/ci_audit_workflows.rs
new file mode 100644
index 0000000000..a9c4a80ba9
--- /dev/null
+++ b/xtask/src/tasks/ci_audit_workflows.rs
@@ -0,0 +1,151 @@
+//! CI workflow spend audit task.
+//!
+//! Mirrors `scripts/ci-audit-workflows.py` by checking workflow files for
+//! pull-request-triggered jobs that do not have explicit gating (`if:`).
+
+use color_eyre::eyre::{Context, Result, eyre};
+use serde_yaml_ng::Value;
+use std::fs;
+use std::path::Path;
+
+use crate::utils::project_root;
+
+const ALLOWED_WORKFLOWS: &[&str] = &["ci.yml", "check-ignored.yml"];
+
+const ALLOWED_UNGATED_JOBS: &[&str] = &["tautology-check", "test-metrics", "fmt", "clippy"];
+
+pub fn run() -> Result<()> {
+    let root = project_root()?;
+    let workflows_dir = root.join(".github/workflows");
+
+    if !workflows_dir.exists() {
+        println!("✓ No .github/workflows directory found");
+        return Ok(());
+    }
+
+    let mut violations: Vec<String> = Vec::new();
+
+    for entry in fs::read_dir(&workflows_dir)
+        .with_context(|| format!("reading {}", workflows_dir.display()))?
+    {
+        let path = entry.context("reading workflow entry")?.path();
+        if path
+            .extension()
+            .and_then(|ext| ext.to_str())
+            .is_none_or(|ext| ext != "yml" && ext != "yaml")
+        {
+            continue;
+        }
+
+        let workflow_name = path.file_name().and_then(|p| p.to_str()).unwrap_or("<unknown>");
+        if ALLOWED_WORKFLOWS.contains(&workflow_name) {
+            continue;
+        }
+
+        let raw = fs::read_to_string(&path)
+            .with_context(|| format!("reading workflow file {}", path.display()))?;
+        let workflow: Value = match serde_yaml_ng::from_str(&raw) {
+            Ok(value) => value,
+            Err(err) => {
+                violations.push(format!("{workflow_name}: YAML parse error: {err}"));
+                continue;
+            }
+        };
+
+        if !has_pr_trigger(&workflow) {
+            continue;
+        }
+
+        let jobs = workflow.get("jobs");
+        if let Some(jobs) = jobs {
+            if let Some(jobs) = jobs.as_mapping() {
+                for (job_name, job_cfg) in jobs {
+                    let Some(name) = job_name.as_str() else {
+                        continue;
+                    };
+
+                    if ALLOWED_UNGATED_JOBS.contains(&name) {
+                        continue;
+                    }
+
+                    let Some(job_cfg) = job_cfg.as_mapping() else {
+                        continue;
+                    };
+
+                    if !job_cfg.contains_key(&Value::String("if".to_string())) {
+                        violations.push(format!(
+                            "{workflow_name}:{name} - runs on PRs without if: condition"
+                        ));
+                    }
+                }
+            }
+        }
+    }
+
+    if violations.is_empty() {
+        println!("✓ CI workflow spend audit passed");
+        return Ok(());
+    }
+
+    println!("❌ CI Spend Audit Failed");
+    println!();
+    println!("The following jobs run on every PR without gating:");
+    for violation in violations {
+        println!("  - {}", violation);
+    }
+    println!();
+    println!("Fix by adding one of:");
+    println!("  1. if: contains(github.event.pull_request.labels.*.name, 'ci:<label>')");
+    println!("  2. Add job to ALLOWED_UNGATED_JOBS in `cargo xtask ci-audit-workflows`");
+    println!("  3. Add workflow to ALLOWED_WORKFLOWS (if entire workflow is cheap)");
+    Err(eyre!("CI workflow spend audit found ungated jobs"))
+}
+
+fn has_pr_trigger(workflow: &Value) -> bool {
+    let on = workflow.get("on");
+    let Some(on) = on else {
+        return false;
+    };
+
+    match on {
+        Value::Sequence(values) => {
+            values.iter().any(|value| value.as_str() == Some("pull_request"))
+        }
+        Value::Mapping(values) => values.contains_key(&Value::String("pull_request".to_string())),
+        Value::String(value) => value == "pull_request",
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn pr_trigger_matches_map_form() {
+        let workflow = serde_yaml_ng::from_str(
+            r#"on:
+  pull_request:
+    types: [opened, synchronize]
+jobs:
+  check:
+    if: github.event_name == 'pull_request'
+"#,
+        )
+        .expect("valid yaml");
+        assert!(has_pr_trigger(&workflow));
+    }
+
+    #[test]
+    fn pr_trigger_matches_list_form() {
+        let workflow = serde_yaml_ng::from_str(r#"on: [push, pull_request]"#).expect("valid yaml");
+        assert!(has_pr_trigger(&workflow));
+    }
+
+    #[test]
+    fn pr_trigger_rejects_non_pr_trigger() {
+        let workflow =
+            serde_yaml_ng::from_str(r#"on: [push, workflow_dispatch]"#).expect("valid yaml");
+        assert!(!has_pr_trigger(&workflow));
+    }
+}
diff --git a/xtask/src/tasks/ci_hygiene.rs b/xtask/src/tasks/ci_hygiene.rs
new file mode 100644
index 0000000000..a4005ab1ab
--- /dev/null
+++ b/xtask/src/tasks/ci_hygiene.rs
@@ -0,0 +1,48 @@
+//! Pass-through wrapper for `perl-ci-hygiene` subcommands.
+//!
+//! This task keeps shell wrappers thin and delegates to the crate directly,
+//! either via an existing local debug binary or via `cargo run`.
+
+use color_eyre::eyre::{Context, Result, bail};
+use std::path::PathBuf;
+use std::process::Command;
+
+use crate::utils::project_root;
+
+const CI_HYGIENE_PACKAGE: &str = "perl-ci-hygiene";
+
+pub fn run(command: String, args: Vec<String>) -> Result<()> {
+    let root = project_root()?;
+    let status = {
+        let local_binary = local_binary_path(&root);
+        if local_binary.exists() {
+            Command::new(local_binary)
+                .arg(&command)
+                .args(&args)
+                .status()
+                .context("Failed to execute local perl-ci-hygiene binary")?
+        } else {
+            let mut cargo_command = Command::new("cargo");
+            cargo_command
+                .current_dir(&root)
+                .args(["run", "--quiet", "-p", CI_HYGIENE_PACKAGE, "--", &command])
+                .args(args)
+                .status()
+                .context("Failed to run perl-ci-hygiene via cargo")?
+        }
+    };
+
+    if !status.success() {
+        bail!("perl-ci-hygiene command '{command}' failed (exit code: {status})");
+    }
+
+    Ok(())
+}
+
+fn local_binary_path(root: &PathBuf) -> PathBuf {
+    let mut path = root.join("target").join("debug").join(CI_HYGIENE_PACKAGE);
+    if cfg!(windows) {
+        path.set_extension(std::env::consts::EXE_EXTENSION);
+    }
+    path
+}
diff --git a/xtask/src/tasks/ci_measure.rs b/xtask/src/tasks/ci_measure.rs
new file mode 100644
index 0000000000..57bb33971f
--- /dev/null
+++ b/xtask/src/tasks/ci_measure.rs
@@ -0,0 +1,95 @@
+use chrono::Utc;
+use color_eyre::eyre::{Context, Result, bail};
+use serde::Serialize;
+use std::fs;
+use std::process::Command;
+use std::time::Instant;
+
+use crate::utils::project_root;
+
+const LANE_COMMANDS: &[(&str, &[&str])] = &[
+    ("ci-format", &["ci-format"]),
+    ("ci-docs-check", &["ci-docs-check"]),
+    ("ci-clippy-lib", &["ci-clippy-lib"]),
+    ("clippy-prod-no-unwrap", &["clippy-prod-no-unwrap"]),
+    ("ci-test-lib", &["ci-test-lib"]),
+    ("ci-lsp-def", &["ci-lsp-def"]),
+    ("status-check", &["status-check"]),
+];
+
+#[derive(Serialize)]
+struct CiLaneResult {
+    name: String,
+    seconds: f64,
+    returncode: i32,
+}
+
+#[derive(Serialize)]
+struct CiMeasurePayload {
+    generated_at: String,
+    lanes: Vec<CiLaneResult>,
+    total_seconds: f64,
+}
+
+pub fn run() -> Result<()> {
+    let root = project_root()?;
+
+    let artifacts_dir = root.join("artifacts");
+    fs::create_dir_all(&artifacts_dir).context("Failed to create artifacts directory")?;
+
+    let mut lanes = Vec::new();
+    let mut total_seconds = 0.0;
+    let mut ndjson = String::new();
+
+    for &(name, args) in LANE_COMMANDS.iter() {
+        println!("==> {}", name);
+
+        let start = Instant::now();
+        let status = Command::new("just")
+            .current_dir(&root)
+            .args(args)
+            .status()
+            .with_context(|| format!("Failed to run '{name}' lane"))?;
+
+        let elapsed = (start.elapsed().as_secs_f64() * 1000.0).round() / 1000.0;
+        let returncode = status.code().unwrap_or(-1);
+        let record = CiLaneResult { name: name.to_string(), seconds: elapsed, returncode };
+        ndjson.push_str(&serde_json::to_string(&record)?);
+        ndjson.push('\n');
+
+        if !status.success() {
+            bail!("CI lane '{name}' failed with exit code {returncode}");
+        }
+
+        total_seconds += elapsed;
+        lanes.push(record);
+    }
+
+    let payload = CiMeasurePayload { generated_at: Utc::now().to_rfc3339(), lanes, total_seconds };
+
+    let ndjson_path = artifacts_dir.join("ci-time.ndjson");
+    let json_path = artifacts_dir.join("ci-time.json");
+    let md_path = artifacts_dir.join("ci-time.md");
+
+    fs::write(&ndjson_path, ndjson).context("Failed to write ci-time.ndjson")?;
+    fs::write(&json_path, serde_json::to_string_pretty(&payload)?.as_bytes())
+        .context("Failed to write ci-time.json")?;
+
+    let mut markdown = String::new();
+    markdown.push_str("# CI Timing Baseline\n\n");
+    markdown.push_str(&format!("- Generated at: `{}`\n", payload.generated_at));
+    markdown.push_str(&format!("- Total: `{}s`\n\n", payload.total_seconds));
+    markdown.push_str("| Lane | Seconds | RC |\n|------|---------|----|\n");
+    for lane in &payload.lanes {
+        markdown
+            .push_str(&format!("| `{}` | {} | {} |\n", lane.name, lane.seconds, lane.returncode));
+    }
+    fs::write(&md_path, markdown).context("Failed to write ci-time.md")?;
+
+    println!("Wrote:");
+    println!("  - {}", json_path.display());
+    println!("  - {}", md_path.display());
+    println!("  - {}", ndjson_path.display());
+
+    Ok(())
+}
diff --git a/xtask/src/tasks/ci_metrics.rs b/xtask/src/tasks/ci_metrics.rs
new file mode 100644
index 0000000000..ffb44a932e
--- /dev/null
+++ b/xtask/src/tasks/ci_metrics.rs
@@ -0,0 +1,815 @@
+use chrono::{DateTime, Duration as ChronoDuration, Utc};
+use color_eyre::eyre::{Context, Result, bail};
+use serde::{Deserialize, Serialize};
+use serde_json::{self, Value};
+use std::collections::{BTreeMap, HashMap};
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use crate::utils::project_root;
+
+const COST_PER_MINUTE: f64 = 0.008;
+const MONTHLY_BUDGET_TARGET: f64 = 60.0;
+const ANNUAL_BUDGET_TARGET: f64 = 720.0;
+
+#[derive(Deserialize)]
+struct RepoInfo {
+    owner: RepoOwner,
+    name: String,
+}
+
+#[derive(Deserialize)]
+struct RepoOwner {
+    login: String,
+}
+
+#[derive(Serialize)]
+struct CiCostWorkflow {
+    name: String,
+    runs: u64,
+    total_minutes: u64,
+    average_minutes: f64,
+    cost: f64,
+}
+
+#[derive(Serialize)]
+struct CostProjection {
+    minutes: u64,
+    cost: f64,
+    budget_target: f64,
+    budget_percentage: f64,
+}
+
+#[derive(Serialize)]
+struct AnnualProjection {
+    cost: f64,
+    budget_target: f64,
+}
+
+#[derive(Serialize)]
+pub struct CiCostReport {
+    period_days: u64,
+    start_date: String,
+    repository: String,
+    total_runs: u64,
+    successful_runs: u64,
+    failed_runs: u64,
+    total_minutes: u64,
+    total_cost: f64,
+    monthly_projection: CostProjection,
+    annual_projection: AnnualProjection,
+    workflows: Vec<CiCostWorkflow>,
+}
+
+#[derive(Default)]
+struct CostCounters {
+    runs: u64,
+    minutes: u64,
+    successful_runs: u64,
+    failed_runs: u64,
+}
+
+#[derive(Default)]
+struct BaselineCounters {
+    total_runs: u64,
+    success_count: u64,
+    failure_count: u64,
+    skipped_count: u64,
+    durations: Vec<u64>,
+    billable_minutes: u64,
+    name: String,
+}
+
+#[derive(Serialize)]
+struct BaselineWorkflow {
+    name: String,
+    total_runs: u64,
+    completed_runs: u64,
+    success_count: u64,
+    failure_count: u64,
+    skipped_count: u64,
+    success_rate_percent: f64,
+    median_duration_seconds: u64,
+    p95_duration_seconds: u64,
+    avg_duration_seconds: u64,
+    billable_minutes: u64,
+}
+
+#[derive(Serialize)]
+struct BaselineSummary {
+    total_runs: u64,
+    total_billable_minutes: u64,
+    overall_success_rate_percent: f64,
+}
+
+#[derive(Serialize)]
+struct BaselineReport {
+    generated_at: String,
+    branch: String,
+    days_analyzed: u64,
+    workflows: BTreeMap<String, BaselineWorkflow>,
+    summary: BaselineSummary,
+}
+
+pub fn run_cost_monitor(days: u64, json_output: bool) -> Result<()> {
+    let root = project_root()?;
+    if days == 0 {
+        bail!("--days must be greater than zero");
+    }
+
+    run_gh_auth_check(&root)?;
+    let repo_info = parse_repo_info(&root)?;
+    let repository = format!("{}/{}", repo_info.owner.login, repo_info.name);
+
+    let now = Utc::now();
+    let start_time = now - ChronoDuration::days(days as i64);
+    let start_date = start_time.format("%Y-%m-%dT%H:%M:%SZ").to_string();
+
+    let runs_json = run_gh_command(
+        &root,
+        "querying action runs",
+        vec![
+            "api".to_string(),
+            format!("repos/{repository}/actions/runs"),
+            "--paginate".to_string(),
+            "-X".to_string(),
+            "GET".to_string(),
+            "-F".to_string(),
+            format!("created=>{start_date}"),
+            "-F".to_string(),
+            "per_page=100".to_string(),
+        ],
+    )?;
+
+    let mut workflow_stats: HashMap<String, CostCounters> = HashMap::new();
+    let mut total_runs = 0_u64;
+    let mut successful_runs = 0_u64;
+    let mut failed_runs = 0_u64;
+    let mut total_minutes = 0_u64;
+
+    for page in serde_json::Deserializer::from_str(&runs_json).into_iter::<Value>() {
+        let page = page.context("failed to parse gh api response page")?;
+
+        let runs = if let Some(runs) = page.get("workflow_runs").and_then(Value::as_array) {
+            runs
+        } else if let Value::Array(values) = &page {
+            values
+        } else {
+            continue;
+        };
+
+        for run in runs {
+            let created = match read_timestamp(run, &["created_at", "createdAt"]) {
+                Some(value) => value,
+                None => continue,
+            };
+            if created < start_time {
+                continue;
+            }
+
+            let start = read_timestamp(run, &["run_started_at", "runStartedAt"]).unwrap_or(created);
+            let end = read_timestamp(run, &["updated_at", "updatedAt"])
+                .or_else(|| read_timestamp(run, &["completed_at", "completedAt"]))
+                .or_else(|| read_timestamp(run, &["finished_at", "finishedAt"]));
+
+            let elapsed_seconds = end.and_then(|end_ts| {
+                let elapsed = (end_ts - start).num_seconds();
+                if elapsed > 0 { u64::try_from(elapsed).ok() } else { None }
+            });
+
+            let elapsed_seconds = elapsed_seconds.unwrap_or(0);
+            let elapsed_minutes = (elapsed_seconds + 59) / 60;
+
+            let workflow_name = run
+                .get("name")
+                .and_then(Value::as_str)
+                .or_else(|| run.get("workflow_name").and_then(Value::as_str))
+                .or_else(|| run.get("workflowName").and_then(Value::as_str))
+                .unwrap_or("(unknown workflow)")
+                .to_string();
+
+            let conclusion = run.get("conclusion").and_then(Value::as_str).unwrap_or("");
+            if conclusion.is_empty() {
+                continue;
+            }
+            if conclusion == "skipped" {
+                continue;
+            }
+
+            let entry = workflow_stats.entry(workflow_name).or_default();
+            entry.runs += 1;
+            entry.minutes += elapsed_minutes;
+
+            total_runs += 1;
+            total_minutes += elapsed_minutes;
+
+            if conclusion == "success" {
+                entry.successful_runs += 1;
+                successful_runs += 1;
+            } else {
+                entry.failed_runs += 1;
+                failed_runs += 1;
+            }
+        }
+    }
+
+    if total_runs == 0 {
+        if json_output {
+            println!("{{\"error\": \"No workflow runs found\", \"period_days\": {days}}}",);
+        } else {
+            println!("No workflow runs found in the last {days} days");
+        }
+        return Ok(());
+    }
+
+    let mut sorted_workflows: Vec<(String, CostCounters)> =
+        workflow_stats.into_iter().map(|(name, counters)| (name, counters)).collect();
+
+    sorted_workflows.sort_by(|(name_a, counters_a), (name_b, counters_b)| {
+        let cost_a = counters_a.minutes as f64 * COST_PER_MINUTE;
+        let cost_b = counters_b.minutes as f64 * COST_PER_MINUTE;
+        cost_b
+            .partial_cmp(&cost_a)
+            .unwrap_or(std::cmp::Ordering::Equal)
+            .then_with(|| name_a.cmp(name_b))
+    });
+
+    let mut workflow_payloads = Vec::with_capacity(sorted_workflows.len());
+    for (name, counters) in sorted_workflows {
+        let average_minutes =
+            if counters.runs > 0 { counters.minutes as f64 / counters.runs as f64 } else { 0.0 };
+
+        workflow_payloads.push(CiCostWorkflow {
+            name,
+            runs: counters.runs,
+            total_minutes: counters.minutes,
+            average_minutes,
+            cost: round_two_decimals(counters.minutes as f64 * COST_PER_MINUTE),
+        });
+    }
+
+    let monthly_minutes = (total_minutes as f64) * 30.0 / (days as f64);
+    let monthly_minutes =
+        if monthly_minutes.is_sign_negative() { 0 } else { monthly_minutes.round() as u64 };
+    let monthly_cost = round_two_decimals(monthly_minutes as f64 * COST_PER_MINUTE);
+    let annual_cost = round_two_decimals(monthly_cost * 12.0);
+    let total_cost = round_two_decimals(total_minutes as f64 * COST_PER_MINUTE);
+    let budget_percentage = if MONTHLY_BUDGET_TARGET == 0.0 {
+        0.0
+    } else {
+        (monthly_cost / MONTHLY_BUDGET_TARGET) * 100.0
+    };
+
+    let report = CiCostReport {
+        period_days: days,
+        start_date,
+        repository,
+        total_runs,
+        successful_runs,
+        failed_runs,
+        total_minutes,
+        total_cost,
+        monthly_projection: CostProjection {
+            minutes: monthly_minutes,
+            cost: monthly_cost,
+            budget_target: MONTHLY_BUDGET_TARGET,
+            budget_percentage: round_one_decimal(budget_percentage),
+        },
+        annual_projection: AnnualProjection {
+            cost: annual_cost,
+            budget_target: ANNUAL_BUDGET_TARGET,
+        },
+        workflows: workflow_payloads,
+    };
+
+    if json_output {
+        println!(
+            "{}",
+            serde_json::to_string_pretty(&report).context("failed to serialize cost report")?
+        );
+        return Ok(());
+    }
+
+    println!("===============================================================================");
+    println!("                    CI Cost Analysis Report");
+    println!("===============================================================================");
+    println!("Period: Last {days} days (since {})", report.start_date);
+    println!("Repository: {}", report.repository);
+    println!("===============================================================================");
+    println!("                             Summary");
+    println!("===============================================================================");
+    println!("{:<30} {:>10}", "Total workflow runs:", report.total_runs);
+    println!(
+        "{:<30} {:>10} ({:.1}%)",
+        "  Successful:",
+        report.successful_runs,
+        percent(report.successful_runs, report.total_runs)
+    );
+    println!(
+        "{:<30} {:>10} ({:.1}%)",
+        "  Failed:",
+        report.failed_runs,
+        percent(report.failed_runs, report.total_runs)
+    );
+    println!("{:<30} {:>10} minutes", "Total CI time:", report.total_minutes);
+    println!("{:<30} ${:.2}", "Total cost:", report.total_cost);
+
+    println!("===============================================================================");
+    println!("                     Monthly Projection");
+    println!("===============================================================================");
+    println!("{:<30} {:>10} minutes", "Estimated monthly usage:", monthly_minutes);
+    println!("{:<30} ${:.2}", "Estimated monthly cost:", monthly_cost);
+    println!("{:<30} ${:.0}", "Monthly budget target:", MONTHLY_BUDGET_TARGET);
+    println!("{:<30} {:.1}%", "Budget utilization:", budget_percentage);
+    if monthly_cost <= MONTHLY_BUDGET_TARGET {
+        println!("Budget utilization: within budget");
+    } else {
+        println!("Budget utilization: over budget");
+    }
+
+    println!("===============================================================================");
+    println!("                      Annual Projection");
+    println!("===============================================================================");
+    println!("{:<30} ${:.2}", "Estimated annual cost:", annual_cost);
+    println!("{:<30} ${:.0}", "Annual budget target:", ANNUAL_BUDGET_TARGET);
+    if annual_cost <= ANNUAL_BUDGET_TARGET {
+        println!("Annual projection within budget");
+    } else {
+        let needed = round_two_decimals(annual_cost - ANNUAL_BUDGET_TARGET);
+        println!("Annual projection exceeds budget by ${needed}");
+    }
+
+    println!("===============================================================================");
+    println!("                   Per-Workflow Breakdown");
+    println!("===============================================================================");
+    println!(
+        "{:<35} {:>8} {:>12} {:>12} {:>10}",
+        "Workflow", "Runs", "Total Min", "Avg Min", "Cost"
+    );
+    println!("-------------------------------------------------------------------------------");
+    for workflow in &report.workflows {
+        println!(
+            "{:<35} {:>8} {:>12} {:>12.1} ${:>9.2}",
+            workflow.name,
+            workflow.runs,
+            workflow.total_minutes,
+            workflow.average_minutes,
+            workflow.cost
+        );
+    }
+
+    println!("===============================================================================");
+    println!("                        Recommendations");
+    println!("===============================================================================");
+    println!();
+
+    if let Some(most_expensive) = report
+        .workflows
+        .iter()
+        .max_by(|a, b| a.cost.partial_cmp(&b.cost).unwrap_or(std::cmp::Ordering::Equal))
+    {
+        let share = if total_cost > 0.0 {
+            round_one_decimal(most_expensive.cost * 100.0 / total_cost)
+        } else {
+            0.0
+        };
+        println!(
+            "1. Most Expensive Workflow: '{}' costs ${:.2} ({share:.1}% of total)",
+            most_expensive.name, most_expensive.cost
+        );
+    }
+
+    if failed_runs > 0 {
+        println!(
+            "2. Failed Runs: {} failed runs ({:.1}% failure rate)",
+            failed_runs,
+            percent(failed_runs, report.total_runs)
+        );
+    }
+
+    println!("3. Concurrency Cancellation:");
+    println!("   Use cancel-in-progress for all scheduled workflows.");
+    println!("4. Caching Strategy:");
+    println!("   Add or tune caching for expensive build/test steps.");
+    println!("5. Gating:");
+    println!("   Gate expensive workflows behind labels or workflow_dispatch where possible.");
+
+    Ok(())
+}
+
+pub fn run_ci_baseline(branch: String, days: u64, limit: usize, output_dir: PathBuf) -> Result<()> {
+    let root = project_root()?;
+    if days == 0 {
+        bail!("--days must be greater than zero");
+    }
+
+    run_gh_auth_check(&root)?;
+
+    let runs_json = run_gh_command(
+        &root,
+        "listing workflow runs",
+        vec![
+            "run".to_string(),
+            "list".to_string(),
+            "--limit".to_string(),
+            limit.to_string(),
+            "--branch".to_string(),
+            branch.clone(),
+            "--json".to_string(),
+            "name,conclusion,createdAt,updatedAt,databaseId,workflowName,status,startedAt"
+                .to_string(),
+        ],
+    )?;
+
+    let runs: Vec<Value> =
+        serde_json::from_str(&runs_json).context("failed to parse JSON output from gh run list")?;
+
+    let generated_at = Utc::now();
+    let cutoff = generated_at - ChronoDuration::days(days as i64);
+    let report = match build_baseline_report(&branch, days, generated_at, cutoff, &runs) {
+        Some(report) => report,
+        None => {
+            println!("No workflow runs found in requested period");
+            return Ok(());
+        }
+    };
+
+    let output_dir = root.join(output_dir);
+    fs::create_dir_all(&output_dir).context("failed to create output directory")?;
+
+    let json_path = output_dir.join("ci_baseline.json");
+    fs::write(
+        &json_path,
+        serde_json::to_string_pretty(&report).context("failed to serialize baseline report")?,
+    )
+    .with_context(|| format!("failed to write {}", json_path.display()))?;
+
+    let md_path = output_dir.join("ci_baseline.md");
+    let markdown = build_baseline_markdown(&report)?;
+    fs::write(&md_path, markdown)
+        .with_context(|| format!("failed to write {}", md_path.display()))?;
+
+    println!("");
+    println!("======================================");
+    println!("CI Baseline Summary");
+    println!("======================================");
+    println!("Branch:              {}", report.branch);
+    println!("Analysis period:     Last {} days", report.days_analyzed);
+    println!("Total runs:          {}", report.summary.total_runs);
+    println!("Total billable:      {}m", report.summary.total_billable_minutes);
+    println!("Overall success:     {:.1}%", report.summary.overall_success_rate_percent);
+    println!("Output JSON:         {}", json_path.display());
+    println!("Output markdown:     {}", md_path.display());
+    println!("======================================");
+
+    Ok(())
+}
+
+fn build_baseline_report(
+    branch: &str,
+    days: u64,
+    generated_at: DateTime<Utc>,
+    cutoff: DateTime<Utc>,
+    runs: &[Value],
+) -> Option<BaselineReport> {
+    let mut workflow_counters: BTreeMap<String, BaselineCounters> = BTreeMap::new();
+
+    for run in runs {
+        let created = match read_timestamp(run, &["createdAt", "created_at"]) {
+            Some(value) => value,
+            None => continue,
+        };
+        if created < cutoff {
+            continue;
+        }
+
+        let workflow_name = run
+            .get("workflowName")
+            .and_then(Value::as_str)
+            .or_else(|| run.get("name").and_then(Value::as_str))
+            .unwrap_or("(unknown workflow)");
+
+        let conclusion = run.get("conclusion").and_then(Value::as_str).unwrap_or("");
+        if conclusion.is_empty() {
+            continue;
+        }
+
+        let mut duration_seconds = 0_u64;
+        let start = read_timestamp(run, &["startedAt", "runStartedAt", "run_started_at"])
+            .or_else(|| read_timestamp(run, &["createdAt", "created_at"]));
+        let end = read_timestamp(run, &["updatedAt", "updated_at"]);
+        if let (Some(start_ts), Some(end_ts)) = (start, end) {
+            let elapsed = (end_ts - start_ts).num_seconds();
+            if elapsed > 0 {
+                duration_seconds = u64::try_from(elapsed).unwrap_or_default();
+            }
+        }
+
+        let key = workflow_key(workflow_name);
+        let counters = workflow_counters.entry(key).or_default();
+        counters.name = workflow_name.to_string();
+        counters.total_runs += 1;
+
+        match conclusion {
+            "success" => counters.success_count += 1,
+            "skipped" => counters.skipped_count += 1,
+            _ => counters.failure_count += 1,
+        }
+
+        if conclusion == "skipped" {
+            continue;
+        }
+
+        if duration_seconds > 0 {
+            counters.durations.push(duration_seconds);
+            counters.billable_minutes += (duration_seconds + 59) / 60;
+        }
+    }
+
+    if workflow_counters.is_empty() {
+        return None;
+    }
+
+    let mut workflow_reports = BTreeMap::new();
+    for (key, counters) in workflow_counters {
+        let mut durations = counters.durations.clone();
+        durations.sort_unstable();
+
+        let median_seconds = percentile(&durations, 50.0);
+        let p95_seconds = percentile(&durations, 95.0);
+        let avg_seconds = if durations.is_empty() {
+            0
+        } else {
+            let sum: u64 = durations.iter().sum();
+            sum / u64::try_from(durations.len()).unwrap_or(1)
+        };
+
+        let completed_runs = counters.success_count + counters.failure_count;
+        let success_rate_percent = if completed_runs > 0 {
+            (counters.success_count as f64 * 100.0) / (completed_runs as f64)
+        } else {
+            0.0
+        };
+
+        workflow_reports.insert(
+            key,
+            BaselineWorkflow {
+                name: counters.name,
+                total_runs: counters.total_runs,
+                completed_runs,
+                success_count: counters.success_count,
+                failure_count: counters.failure_count,
+                skipped_count: counters.skipped_count,
+                success_rate_percent,
+                median_duration_seconds: median_seconds,
+                p95_duration_seconds: p95_seconds,
+                avg_duration_seconds: avg_seconds,
+                billable_minutes: counters.billable_minutes,
+            },
+        );
+    }
+
+    let total_runs: u64 = workflow_reports.values().map(|workflow| workflow.total_runs).sum();
+
+    let total_billable: u64 =
+        workflow_reports.values().map(|workflow| workflow.billable_minutes).sum();
+
+    let total_success: u64 = workflow_reports.values().map(|workflow| workflow.success_count).sum();
+    let total_completed: u64 = workflow_reports
+        .values()
+        .map(|workflow| workflow.success_count + workflow.failure_count)
+        .sum();
+
+    let overall_success_rate_percent = if total_completed > 0 {
+        (total_success as f64 * 100.0) / (total_completed as f64)
+    } else {
+        0.0
+    };
+
+    Some(BaselineReport {
+        generated_at: generated_at.to_rfc3339(),
+        branch: branch.to_string(),
+        days_analyzed: days,
+        workflows: workflow_reports,
+        summary: BaselineSummary {
+            total_runs,
+            total_billable_minutes: total_billable,
+            overall_success_rate_percent,
+        },
+    })
+}
+
+fn run_gh_auth_check(root: &Path) -> Result<()> {
+    let status = Command::new("gh")
+        .current_dir(root)
+        .args(["auth", "status"])
+        .status()
+        .context("failed to run gh auth status")?;
+
+    if !status.success() {
+        bail!("gh CLI is not authenticated. Run 'gh auth login'.");
+    }
+
+    Ok(())
+}
+
+fn parse_repo_info(root: &Path) -> Result<RepoInfo> {
+    let repo_json = run_gh_command(
+        root,
+        "reading repository info",
+        vec![
+            "repo".to_string(),
+            "view".to_string(),
+            "--json".to_string(),
+            "owner,name".to_string(),
+        ],
+    )?;
+
+    serde_json::from_str(&repo_json).context("failed to parse gh repo view JSON")
+}
+
+fn run_gh_command(root: &Path, action: &str, args: Vec<String>) -> Result<String> {
+    let output = Command::new("gh")
+        .current_dir(root)
+        .args(&args)
+        .output()
+        .with_context(|| format!("failed to execute gh command while {action}"))?;
+
+    if !output.status.success() {
+        bail!("gh command failed while {action}: {}", String::from_utf8_lossy(&output.stderr));
+    }
+
+    Ok(String::from_utf8(output.stdout).context("gh output was not valid UTF-8")?)
+}
+
+fn read_timestamp(run: &Value, keys: &[&str]) -> Option<DateTime<Utc>> {
+    for key in keys {
+        let value = match run.get(*key).and_then(Value::as_str) {
+            Some(value) => value,
+            None => continue,
+        };
+        if let Ok(timestamp) = DateTime::parse_from_rfc3339(value) {
+            return Some(timestamp.with_timezone(&Utc));
+        }
+    }
+    None
+}
+
+fn round_two_decimals(value: f64) -> f64 {
+    (value * 100.0).round() / 100.0
+}
+
+fn round_one_decimal(value: f64) -> f64 {
+    (value * 10.0).round() / 10.0
+}
+
+fn percent(part: u64, total: u64) -> f64 {
+    if total == 0 { 0.0 } else { round_one_decimal((part as f64 * 100.0) / (total as f64)) }
+}
+
+fn percentile(values: &[u64], percentile: f64) -> u64 {
+    if values.is_empty() {
+        return 0;
+    }
+
+    let index = (((values.len() - 1) as f64) * (percentile / 100.0)).floor() as usize;
+    values[index]
+}
+
+fn workflow_key(name: &str) -> String {
+    let mut key = String::with_capacity(name.len());
+    for ch in name.chars() {
+        if ch.is_ascii_alphanumeric() || ch == '_' || ch == '-' {
+            key.push(ch);
+        } else if ch == ' ' {
+            key.push('_');
+        }
+    }
+
+    if key.is_empty() { "workflow".to_string() } else { key }
+}
+
+fn build_baseline_markdown(report: &BaselineReport) -> Result<String> {
+    let mut out = String::new();
+    out.push_str("# CI Baseline Metrics Report\n\n");
+    out.push_str(&format!("**Generated:** {}\n", report.generated_at.replace('T', " ")));
+    out.push_str(&format!("**Branch:** {}\n", report.branch));
+    out.push_str(&format!("**Analysis Period:** Last {} days\n\n", report.days_analyzed));
+
+    out.push_str("## Summary\n\n");
+    out.push_str("| Metric | Value |\n|--------|-------|\n");
+    out.push_str(&format!("| Total Runs | {} |\n", report.summary.total_runs));
+    out.push_str(&format!(
+        "| Overall Success Rate | {:.1}% |\n",
+        report.summary.overall_success_rate_percent
+    ));
+    out.push_str(&format!(
+        "| Total Billable Minutes | {}m |\n\n",
+        report.summary.total_billable_minutes
+    ));
+
+    out.push_str("## Workflow Details\n\n");
+    out.push_str("| Workflow | Runs | Success Rate | Median | P95 | Billable |\n");
+    out.push_str("|----------|------|--------------|--------|-----|----------|\n");
+
+    for workflow in report.workflows.values() {
+        out.push_str(&format!(
+            "| {} | {} | {:.1}% | {}s | {}s | {}m |\n",
+            workflow.name,
+            workflow.total_runs,
+            workflow.success_rate_percent,
+            workflow.median_duration_seconds,
+            workflow.p95_duration_seconds,
+            workflow.billable_minutes
+        ));
+    }
+
+    out.push_str("\n## Notes\n\n");
+    out.push_str("- Median Duration: 50th percentile of run duration (in seconds)\n");
+    out.push_str("- P95 Duration: 95th percentile of run duration (in seconds)\n");
+    out.push_str(
+        "- Billable Minutes: Estimated billable time (each run rounded up to nearest minute)\n",
+    );
+    out.push_str("- Success Rate: Calculated excluding skipped runs\n\n");
+
+    out.push_str("## Recommendations\n\n");
+    out.push_str("1. Monitor P95 durations for workflow variance.\n");
+    out.push_str("2. Track success-rate trends over time and investigate failures.\n");
+    out.push_str("3. Focus optimization on high billable workflows.\n\n");
+    out.push_str("---\nGenerated by cargo xtask ci-baseline\n");
+
+    Ok(out)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use color_eyre::eyre::eyre;
+    use serde_json::json;
+
+    #[test]
+    fn read_timestamp_uses_fallback_keys() -> Result<()> {
+        let run = json!({
+            "createdAt": "2026-03-25T12:00:00Z"
+        });
+
+        let timestamp = read_timestamp(&run, &["created_at", "createdAt"])
+            .ok_or_else(|| eyre!("expected timestamp"))?;
+
+        assert_eq!(
+            timestamp,
+            DateTime::parse_from_rfc3339("2026-03-25T12:00:00Z")?.with_timezone(&Utc)
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn baseline_report_keeps_zero_minute_runs_and_excludes_skips_from_success_rate() -> Result<()> {
+        let generated_at =
+            DateTime::parse_from_rfc3339("2026-03-25T12:00:00Z")?.with_timezone(&Utc);
+        let cutoff = DateTime::parse_from_rfc3339("2026-03-24T12:00:00Z")?.with_timezone(&Utc);
+        let runs = vec![
+            json!({
+                "workflowName": "CI",
+                "conclusion": "success",
+                "createdAt": "2026-03-25T11:00:00Z",
+                "startedAt": "2026-03-25T11:00:00Z",
+                "updatedAt": "2026-03-25T11:01:30Z"
+            }),
+            json!({
+                "workflowName": "CI",
+                "conclusion": "skipped",
+                "createdAt": "2026-03-25T10:00:00Z",
+                "startedAt": "2026-03-25T10:00:00Z",
+                "updatedAt": "2026-03-25T10:00:30Z"
+            }),
+            json!({
+                "workflowName": "CI",
+                "conclusion": "failure",
+                "createdAt": "2026-03-25T09:00:00Z",
+                "startedAt": "2026-03-25T09:00:00Z"
+            }),
+        ];
+
+        let report = build_baseline_report("master", 1, generated_at, cutoff, &runs)
+            .ok_or_else(|| eyre!("expected baseline report"))?;
+        let workflow =
+            report.workflows.get("CI").ok_or_else(|| eyre!("expected workflow report"))?;
+
+        assert_eq!(workflow.total_runs, 3);
+        assert_eq!(workflow.completed_runs, 2);
+        assert_eq!(workflow.success_count, 1);
+        assert_eq!(workflow.failure_count, 1);
+        assert_eq!(workflow.skipped_count, 1);
+        assert_eq!(workflow.billable_minutes, 2);
+        assert_eq!(report.summary.total_runs, 3);
+        assert_eq!(report.summary.total_billable_minutes, 2);
+        assert_eq!(report.summary.overall_success_rate_percent, 50.0);
+
+        let markdown = build_baseline_markdown(&report)?;
+        assert!(markdown.contains("| CI | 3 | 50.0% | 90s | 90s | 2m |"));
+
+        Ok(())
+    }
+}
diff --git a/xtask/src/tasks/ci_policy.rs b/xtask/src/tasks/ci_policy.rs
new file mode 100644
index 0000000000..0a4cdeaea5
--- /dev/null
+++ b/xtask/src/tasks/ci_policy.rs
@@ -0,0 +1,57 @@
+use color_eyre::eyre::{Context, Result, bail};
+use regex::Regex;
+use std::process::Command;
+
+use crate::utils::project_root;
+
+const FROM_RAW_PATTERN: &str = r"\b([A-Za-z_][A-Za-z0-9_:]*::)?ExitStatus::from_raw\(";
+const ALLOWED_FROM_RAW_PATTERN: &str = r"::from_raw\(\s*raw[_ ]?exit\s*\(";
+
+pub fn check_from_raw() -> Result<()> {
+    let root = project_root()?;
+
+    let output = Command::new("git")
+        .current_dir(&root)
+        .args([
+            "grep",
+            "-nE",
+            FROM_RAW_PATTERN,
+            "--",
+            "crates/**/*.rs",
+            "xtask/**/*.rs",
+            "examples/**/*.rs",
+            "tests/**/*.rs",
+            ":!**/target/**",
+            ":!**/generated/**",
+        ])
+        .output()
+        .context("Failed to run git grep")?;
+
+    if let Some(code) = output.status.code() {
+        if code > 1 {
+            let stderr = String::from_utf8_lossy(&output.stderr);
+            bail!("git grep command failed with exit code {}: {}", code, stderr.trim(),);
+        }
+    }
+
+    let output_text =
+        String::from_utf8(output.stdout).context("git grep output was not valid UTF-8")?;
+
+    let disallow_re = Regex::new(FROM_RAW_PATTERN)?;
+    let allowed_re = Regex::new(ALLOWED_FROM_RAW_PATTERN)?;
+    let violations: Vec<_> = output_text
+        .lines()
+        .filter(|line| disallow_re.is_match(line) && !allowed_re.is_match(line))
+        .collect();
+
+    if violations.is_empty() {
+        println!("ExitStatus policy check passed");
+        return Ok(());
+    }
+
+    for line in violations {
+        eprintln!("::error::Disallowed direct from_raw(): {line}");
+    }
+
+    bail!("CI policy check found disallowed ExitStatus::from_raw() usage");
+}
diff --git a/xtask/src/tasks/corpus_audit.rs b/xtask/src/tasks/corpus_audit.rs
index 5d07bcc3d5..7a2b5ac850 100644
--- a/xtask/src/tasks/corpus_audit.rs
+++ b/xtask/src/tasks/corpus_audit.rs
@@ -23,9 +23,11 @@ mod timeout_detection;
 use corpus::{CorpusFile, parse_corpus_files};
 use ga_alignment::check_ga_feature_alignment;
 use nodekind_analysis::analyze_nodekind_coverage;
-use report::{AuditReport, generate_report};
+use report::generate_report;
 use timeout_detection::{ParseOutcome, detect_timeout_risks, parse_with_timeout};
 
+pub use report::{AuditReport, FailingFile, ParseOutcomesSummary};
+
 /// Default timeout for parsing individual files
 const DEFAULT_TIMEOUT: Duration = Duration::from_secs(30);
 
diff --git a/xtask/src/tasks/debt_report.rs b/xtask/src/tasks/debt_report.rs
index 8b8bc14d7f..1ab1537ce3 100644
--- a/xtask/src/tasks/debt_report.rs
+++ b/xtask/src/tasks/debt_report.rs
@@ -198,6 +198,7 @@ struct CriticalDebt {
 pub struct DebtReportConfig {
     pub check: bool,
     pub json: bool,
+    pub summary: bool,
     pub expired: bool,
     pub ledger: Option<PathBuf>,
 }
@@ -523,6 +524,26 @@ fn format_console_report(report: &Report) -> String {
     lines.join("\n")
 }
 
+fn format_summary_markdown(report: &Report) -> String {
+    let mut lines: Vec<String> = Vec::new();
+    let q = &report.summary.quarantined_tests;
+    let k = &report.summary.known_issues;
+    let t = &report.summary.technical_debt;
+
+    lines.push("| Category | Count | Budget | Status |".to_string());
+    lines.push("|----------|-------|--------|--------|".to_string());
+    lines.push(format!("| Quarantined Tests | {} | {} | {} |", q.count, q.budget, q.status));
+    lines.push(format!("| Known Issues | {} | {} | {} |", k.count, k.budget, k.status));
+    lines.push(format!("| Technical Debt | {} | {} | {} |", t.count, t.budget, t.status));
+
+    if q.expired > 0 {
+        lines.push(String::new());
+        lines.push(format!("**Warning:** {0} expired quarantine(s) need attention!", q.expired));
+    }
+
+    lines.join("\n")
+}
+
 // ---------------------------------------------------------------------------
 // Public entry point
 // ---------------------------------------------------------------------------
@@ -555,6 +576,13 @@ pub fn run(config: DebtReportConfig) -> Result<()> {
         return Ok(());
     }
 
+    if config.summary {
+        println!("{}", format_summary_markdown(&report));
+        if !config.check {
+            return Ok(());
+        }
+    }
+
     // Produce output
     if config.json {
         let json = serde_json::to_string_pretty(&report).context("serialising report")?;
diff --git a/xtask/src/tasks/devex_doctor.rs b/xtask/src/tasks/devex_doctor.rs
new file mode 100644
index 0000000000..98f1f8d223
--- /dev/null
+++ b/xtask/src/tasks/devex_doctor.rs
@@ -0,0 +1,179 @@
+//! Developer doctor task.
+//! Mirrors `scripts/devex-doctor.sh` checks with native Rust execution.
+
+use color_eyre::eyre::{Context, Result, bail};
+use std::{
+    env,
+    path::Path,
+    process::{Command, Stdio},
+};
+
+pub fn run() -> Result<()> {
+    let root = env::current_dir().context("failed to determine current directory")?;
+    let root = root.to_string_lossy();
+
+    let mut missing_required = false;
+
+    println!("Repository: {root}");
+    println!();
+    println!("== Required ==");
+
+    check_command("cargo", "cargo", &mut missing_required);
+    check_command("rustfmt", "rustfmt", &mut missing_required);
+    check_command("rustup", "rustup", &mut missing_required);
+
+    show_version("rustc", "rustc", &["--version"]);
+    show_version("cargo", "cargo", &["--version"]);
+
+    println!();
+    println!("== Recommended ==");
+    check_command_optional("just", "just");
+    check_command_optional("nix", "nix");
+    check_command_optional("git", "git");
+    check_command_optional("rg", "rg");
+    check_command_optional("cargo-audit", "cargo-audit");
+
+    println!();
+    println!("== Rust components ==");
+    if has_command("rustup") {
+        if is_component_installed("rustfmt") {
+            pass("rustup component installed: rustfmt");
+        } else {
+            warn("rustup component missing: rustfmt (install: rustup component add rustfmt)");
+        }
+
+        if is_component_installed("clippy") {
+            pass("rustup component installed: clippy");
+        } else {
+            warn("rustup component missing: clippy (install: rustup component add clippy)");
+        }
+    } else {
+        warn("rustup unavailable; cannot verify components");
+    }
+
+    println!();
+    if Path::new("rust-toolchain.toml").exists() {
+        let status = Command::new("bash")
+            .arg("scripts/check-rust-toolchain.sh")
+            .arg("doctor")
+            .stdin(Stdio::null())
+            .stdout(Stdio::inherit())
+            .stderr(Stdio::inherit())
+            .status()
+            .context("failed to run scripts/check-rust-toolchain.sh")?;
+        if !status.success() {
+            missing_required = true;
+        }
+    } else {
+        warn("rust-toolchain.toml not found");
+    }
+
+    println!();
+    println!("== Suggested next commands ==");
+    println!("  just devex            # quick environment diagnostics");
+    println!("  just pr-fast          # fast validation before a full gate");
+    println!("  just ci-gate          # repo-native local gate");
+    println!("  nix develop -c just ci-gate");
+
+    if missing_required {
+        fail("Missing required tools. Install Rust via https://rustup.rs");
+        bail!("required checks did not pass");
+    }
+
+    println!();
+    pass("Doctor completed: required tooling is available");
+
+    Ok(())
+}
+
+fn check_command(program: &str, label: &str, missing_required: &mut bool) {
+    if has_command(program) {
+        pass(&format!("{label}: found ({})", command_path(program).unwrap_or(program.to_string())));
+    } else {
+        warn(&format!("{label}: not found"));
+        *missing_required = true;
+    }
+}
+
+fn check_command_optional(program: &str, label: &str) {
+    if has_command(program) {
+        pass(&format!("{label}: found ({})", command_path(program).unwrap_or(program.to_string())));
+    } else {
+        warn(&format!("{label}: not found"));
+    }
+}
+
+fn has_command(program: &str) -> bool {
+    if Path::new(program).exists() {
+        return true;
+    }
+
+    env::var_os("PATH").is_some_and(|paths| {
+        env::split_paths(&paths).any(|path| {
+            #[cfg(windows)]
+            {
+                let mut candidate = path.join(format!("{program}.exe"));
+                if candidate.exists() {
+                    return true;
+                }
+                candidate = path.join(format!("{program}.bat"));
+                if candidate.exists() {
+                    return true;
+                }
+                path.join(program).exists()
+            }
+
+            #[cfg(not(windows))]
+            {
+                path.join(program).exists()
+            }
+        })
+    })
+}
+
+fn command_path(program: &str) -> Option<String> {
+    if Path::new(program).is_file() {
+        return Some(program.to_string());
+    }
+    env::var_os("PATH").and_then(|paths| {
+        env::split_paths(&paths)
+            .map(|path| path.join(program))
+            .find(|candidate| candidate.is_file())
+            .map(|candidate| candidate.to_string_lossy().to_string())
+    })
+}
+
+fn is_component_installed(component: &str) -> bool {
+    let output = match Command::new("rustup").args(["component", "list", "--installed"]).output() {
+        Ok(output) if output.status.success() => output,
+        _ => return false,
+    };
+    let lines = String::from_utf8_lossy(&output.stdout);
+    lines.lines().any(|line| {
+        let value = line.split_whitespace().next().unwrap_or("");
+        value == component || value.starts_with(&(format!("{component}-")))
+    })
+}
+
+fn show_version(program: &str, command: &str, args: &[&str]) {
+    match Command::new(command).args(args).output() {
+        Ok(output) if output.status.success() => {
+            let output = String::from_utf8_lossy(&output.stdout);
+            let first_line = output.lines().next().unwrap_or("");
+            pass(&format!("{program} version: {first_line}"));
+        }
+        _ => warn(&format!("{program} version check failed")),
+    }
+}
+
+fn pass(message: &str) {
+    println!("✅ {message}");
+}
+
+fn warn(message: &str) {
+    println!("⚠️  {message}");
+}
+
+fn fail(message: &str) {
+    println!("❌ {message}");
+}
diff --git a/xtask/src/tasks/doc_claims.rs b/xtask/src/tasks/doc_claims.rs
new file mode 100644
index 0000000000..5f55d9a27a
--- /dev/null
+++ b/xtask/src/tasks/doc_claims.rs
@@ -0,0 +1,86 @@
+//! Validate known stale publication claims inside docs/articles.
+
+use crate::utils::project_root;
+use color_eyre::eyre::{Context, Result, bail};
+use std::{fs, path::PathBuf};
+
+const ARTICLES_DIR: &str = "docs/articles";
+
+const STALE_PATTERNS: &[(&str, &str, &str)] = &[
+    ("563,228 lines", "591,034 lines", "LOC claim (563K is stale; ledger: 591,034)"),
+    ("563K lines", "591K lines", "LOC claim (563K is stale; ledger: 591K)"),
+    ("546,000", "591,034", "LOC claim (546K is stale; ledger: 591,034)"),
+    ("546K lines", "591K lines", "LOC claim (546K is stale; ledger: 591K)"),
+    ("131 crates", "133 crates", "Crate count (131 is stale; ledger: 133)"),
+    ("131 workspace crates", "133 workspace crates", "Crate count (131 is stale; ledger: 133)"),
+    ("132 workspace crates", "133 workspace crates", "Crate count (132 is stale; ledger: 133)"),
+    ("132 crates", "133 crates", "Crate count (132 is stale; ledger: 133)"),
+    (
+        "97 LSP and DAP features",
+        "98 LSP and DAP features",
+        "Feature count (97 is stale; ledger: 98)",
+    ),
+    ("97 LSP/DAP features", "98 LSP/DAP features", "Feature count (97 is stale; ledger: 98)"),
+    ("97 features defined", "98 features defined", "Feature count (97 is stale; ledger: 98)"),
+    ("97 features governed", "98 features governed", "Feature count (97 is stale; ledger: 98)"),
+    ("97 features:", "98 features:", "Feature count (97 is stale; ledger: 98)"),
+    ("2,700+ commits", "3,200+ commits", "Commit count (2,700+ is stale; ledger: 3,210)"),
+    ("2,200+ pull requests", "2,646+ pull requests", "PR count (2,200+ is stale; ledger: 2,646+)"),
+    ("2,200+ PRs", "2,646+ PRs", "PR count (2,200+ is stale; ledger: 2,646+)"),
+];
+
+type ClaimHit = (PathBuf, usize, &'static str, &'static str, &'static str);
+
+pub fn run() -> Result<()> {
+    let root = project_root()?;
+    let articles_dir = root.join(ARTICLES_DIR);
+    let mut files = Vec::new();
+
+    if !articles_dir.is_dir() {
+        bail!("expected articles directory not found at {}", articles_dir.display());
+    }
+
+    for entry in fs::read_dir(&articles_dir).context("failed to read docs/articles directory")? {
+        let entry = entry.context("failed to read directory entry")?;
+        let path = entry.path();
+        if path.extension().is_some_and(|ext| ext == "md") && path.is_file() {
+            files.push(path);
+        }
+    }
+    files.sort();
+
+    let mut hits: Vec<ClaimHit> = Vec::new();
+    for md_file in &files {
+        let text = fs::read_to_string(md_file)
+            .with_context(|| format!("failed to read article file {}", md_file.display()))?;
+        for (line_no, line) in text.lines().enumerate() {
+            for &(stale, replacement, description) in STALE_PATTERNS {
+                if line.contains(stale) {
+                    hits.push((md_file.clone(), line_no + 1, stale, replacement, description));
+                }
+            }
+        }
+    }
+
+    if hits.is_empty() {
+        println!(
+            "Doc claims OK: {} articles scanned, {} stale patterns checked, 0 violations found",
+            files.len(),
+            STALE_PATTERNS.len()
+        );
+        return Ok(());
+    }
+
+    eprintln!("DOC CLAIM VIOLATIONS:");
+    eprintln!("{}", "=".repeat(60));
+    for (file, line_no, stale, replacement, description) in &hits {
+        let rel = file.strip_prefix(&root).map_or_else(|_| file.as_path(), |path| path);
+        eprintln!("  {}:{}: {}", rel.display(), line_no, description);
+        eprintln!("    found:    {:?}", stale);
+        eprintln!("    expected: {:?}", replacement);
+    }
+    eprintln!("{}", "=".repeat(60));
+    eprintln!("{} stale claim(s) found in docs/articles.", hits.len());
+    eprintln!("\nTo fix: update the article to match docs/project/PUBLICATION_FACTS_LEDGER.md");
+    bail!("doc claim check failed");
+}
diff --git a/xtask/src/tasks/features.rs b/xtask/src/tasks/features.rs
index 5269479cf2..effc2d2ef1 100644
--- a/xtask/src/tasks/features.rs
+++ b/xtask/src/tasks/features.rs
@@ -1,4 +1,4 @@
-use color_eyre::eyre::{Context, Result, eyre};
+use color_eyre::eyre::{Context, Result, bail, eyre};
 use perl_feature_catalog::{Catalog, Maturity};
 use std::collections::{BTreeMap, BTreeSet};
 use std::env;
@@ -18,6 +18,10 @@ pub fn report() -> Result<()> {
     generate_report()
 }
 
+pub fn invariants() -> Result<()> {
+    check_invariants()
+}
+
 fn load_features() -> Result<Catalog> {
     let manifest_dir = env::current_dir().context("Failed to get current working directory")?;
     let (catalog, _) = perl_feature_catalog::load_catalog_for_build(&manifest_dir)
@@ -25,6 +29,55 @@ fn load_features() -> Result<Catalog> {
     Ok(catalog)
 }
 
+fn check_invariants() -> Result<()> {
+    println!("🔍 Checking features.toml invariants...");
+
+    let catalog = load_features()?;
+    let mut violations = Vec::new();
+    let mut seen_ids = BTreeSet::new();
+
+    for feature in catalog.features() {
+        if !seen_ids.insert(feature.id.clone()) {
+            violations.push(format!("DUPLICATE_ID: {:?} appears more than once", feature.id));
+        }
+
+        if feature.advertised && feature.maturity == Maturity::Ga && feature.tests.is_empty() {
+            if feature.counts_in_coverage {
+                violations.push(format!(
+                    "UNTESTED_GA: {:?} is advertised+GA but has no tests. Either add tests or set counts_in_coverage=false (if it's protocol plumbing).",
+                    feature.id
+                ));
+            }
+        }
+    }
+
+    if !violations.is_empty() {
+        let violations_count = violations.len();
+        println!("FEATURE INVARIANT VIOLATIONS:");
+        println!("{}", "=".repeat(50));
+        for violation in violations {
+            println!("  - {violation}");
+        }
+        println!("{}", "=".repeat(50));
+        println!("{violations_count} violation(s) found.");
+        bail!("feature invariants check failed");
+    }
+
+    let total = catalog.features().len();
+    let ga_advertised =
+        catalog.features().iter().filter(|f| f.advertised && f.maturity == Maturity::Ga).count();
+    let headline_features = catalog
+        .features()
+        .iter()
+        .filter(|f| f.advertised && f.maturity == Maturity::Ga && f.counts_in_coverage)
+        .count();
+
+    println!(
+        "Feature invariants OK: {total} features, {ga_advertised} GA+advertised, {headline_features} in headline metric"
+    );
+    Ok(())
+}
+
 fn sync_docs_impl() -> Result<()> {
     println!("📝 Syncing documentation from features.toml...");
 
diff --git a/xtask/src/tasks/forbid_fatal_constructs.rs b/xtask/src/tasks/forbid_fatal_constructs.rs
new file mode 100644
index 0000000000..f8cada5c8c
--- /dev/null
+++ b/xtask/src/tasks/forbid_fatal_constructs.rs
@@ -0,0 +1,47 @@
+//! Wrapper task for forbidden-fatal-construct checks.
+//!
+//! Delegates to `perl-ci-hygiene forbid-fatal-constructs`, preferring the
+//! locally built binary when available for speed.
+
+use color_eyre::eyre::{Context, Result, bail};
+use std::path::PathBuf;
+use std::process::Command;
+
+use crate::utils::project_root;
+
+const CI_HYGIENE_PACKAGE: &str = "perl-ci-hygiene";
+
+fn local_binary_path(root: &PathBuf) -> PathBuf {
+    let mut path = root.join("target").join("debug").join(CI_HYGIENE_PACKAGE);
+    if cfg!(windows) {
+        path.set_extension(std::env::consts::EXE_EXTENSION);
+    }
+    path
+}
+
+pub fn run(args: Vec<String>) -> Result<()> {
+    let root = project_root()?;
+    let status = {
+        let local_binary = local_binary_path(&root);
+        if local_binary.exists() {
+            Command::new(local_binary)
+                .arg("forbid-fatal-constructs")
+                .args(&args)
+                .status()
+                .context("Failed to execute local perl-ci-hygiene binary")?
+        } else {
+            Command::new("cargo")
+                .current_dir(root)
+                .args(["run", "--quiet", "-p", CI_HYGIENE_PACKAGE, "--", "forbid-fatal-constructs"])
+                .args(args)
+                .status()
+                .context("Failed to run perl-ci-hygiene via cargo")?
+        }
+    };
+
+    if !status.success() {
+        bail!("forbid-fatal-constructs failed (exit code: {status})");
+    }
+
+    Ok(())
+}
diff --git a/xtask/src/tasks/forensics.rs b/xtask/src/tasks/forensics.rs
new file mode 100644
index 0000000000..83e6f558b4
--- /dev/null
+++ b/xtask/src/tasks/forensics.rs
@@ -0,0 +1,57 @@
+//! Forensics task wrappers.
+
+use color_eyre::eyre::{Context, Result, bail};
+use std::path::Path;
+use std::process::Command;
+
+use crate::utils::project_root;
+
+pub fn run_harvest(pr: &str) -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("scripts").join("forensics").join("pr-harvest.sh");
+    run_script(&script, &[pr])
+}
+
+pub fn run_temporal(pr: &str) -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("scripts").join("forensics").join("temporal-analysis.sh");
+    run_script(&script, &[pr])
+}
+
+pub fn run_telemetry_quick(pr: &str) -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("scripts").join("forensics").join("telemetry-runner.sh");
+    run_script(&script, &[pr, "--mode", "quick"])
+}
+
+pub fn run_telemetry_full(pr: &str) -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("scripts").join("forensics").join("telemetry-runner.sh");
+    run_script(&script, &[pr, "--mode", "full"])
+}
+
+pub fn run_dossier(pr: &str) -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("scripts").join("forensics").join("dossier-runner.sh");
+    run_script(&script, &[pr])
+}
+
+pub fn run_render(pr: &str, format: &str) -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("scripts").join("forensics").join("render-dossier.sh");
+    run_script(&script, &[pr, "--format", format])
+}
+
+fn run_script(script: &Path, args: &[&str]) -> Result<()> {
+    let status = Command::new("bash")
+        .arg(script)
+        .args(args)
+        .status()
+        .with_context(|| format!("failed to execute {}", script.display()))?;
+
+    if status.success() {
+        Ok(())
+    } else {
+        bail!("forensics script failed: {}", script.display());
+    }
+}
diff --git a/xtask/src/tasks/github.rs b/xtask/src/tasks/github.rs
new file mode 100644
index 0000000000..0c5738de03
--- /dev/null
+++ b/xtask/src/tasks/github.rs
@@ -0,0 +1,41 @@
+//! GitHub repository maintenance tasks delegated to the `gh` CLI.
+
+use color_eyre::eyre::{Context, Result, bail};
+use std::path::Path;
+use std::process::Command;
+
+pub fn run_labels() -> Result<()> {
+    let root = crate::utils::project_root()?;
+    let script = root.join("scripts").join("gh").join("ensure-labels.sh");
+    run_script(&script, &[])
+}
+
+pub fn run_issues_needing_triage(limit: usize) -> Result<()> {
+    let root = crate::utils::project_root()?;
+    let script = root.join("scripts").join("gh").join("issues-needing-triage.sh");
+    let limit = limit.to_string();
+    run_script(&script, &[limit.as_str()])
+}
+
+pub fn run_backfill_prefixed_labels(apply: bool) -> Result<()> {
+    let root = crate::utils::project_root()?;
+    let script = root.join("scripts").join("gh").join("backfill-prefixed-labels.sh");
+    if apply { run_script(&script, &["--apply"]) } else { run_script(&script, &[]) }
+}
+
+fn run_script(script: &Path, args: &[&str]) -> Result<()> {
+    let mut command = Command::new("bash");
+    command.arg(script);
+    for arg in args {
+        command.arg(arg);
+    }
+
+    let status =
+        command.status().with_context(|| format!("failed to execute {}", script.display()))?;
+
+    if status.success() {
+        Ok(())
+    } else {
+        bail!("github maintenance script failed: {}", script.display());
+    }
+}
diff --git a/xtask/src/tasks/hardening.rs b/xtask/src/tasks/hardening.rs
new file mode 100644
index 0000000000..f79717cc26
--- /dev/null
+++ b/xtask/src/tasks/hardening.rs
@@ -0,0 +1,39 @@
+//! Production hardening maintenance tasks.
+
+use color_eyre::eyre::{Context, Result, bail};
+use std::path::Path;
+use std::process::Command;
+
+use crate::utils::project_root;
+
+pub fn security_hardening() -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("scripts").join("security-hardening.sh");
+    run_script(&script, &[])
+}
+
+pub fn performance_hardening() -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("scripts").join("performance-hardening.sh");
+    run_script(&script, &[])
+}
+
+pub fn production_gates_validation() -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("scripts").join("production-gates-validation.sh");
+    run_script(&script, &[])
+}
+
+fn run_script(script: &Path, args: &[&str]) -> Result<()> {
+    let status = Command::new("bash")
+        .arg(script)
+        .args(args)
+        .status()
+        .with_context(|| format!("failed to execute {}", script.display()))?;
+
+    if status.success() {
+        Ok(())
+    } else {
+        bail!("production hardening task failed: {}", script.display());
+    }
+}
diff --git a/xtask/src/tasks/hook_checks.rs b/xtask/src/tasks/hook_checks.rs
new file mode 100644
index 0000000000..f3ba5d95fe
--- /dev/null
+++ b/xtask/src/tasks/hook_checks.rs
@@ -0,0 +1,395 @@
+use color_eyre::eyre::{Context, ContextCompat, Result, bail};
+use regex::Regex;
+use serde_json::Value;
+use std::collections::HashSet;
+use std::fs;
+use std::io::Write;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use crate::utils::project_root;
+
+#[cfg(unix)]
+use std::os::unix::fs::PermissionsExt;
+
+pub fn run_hook_check() -> Result<()> {
+    let root = project_root()?;
+    let hooks_dir = root.join(".claude/hooks");
+
+    if !hooks_dir.exists() {
+        println!("Hook executable check passed");
+        return Ok(());
+    }
+
+    let mut failed = 0u32;
+
+    for entry in fs::read_dir(&hooks_dir).context("Failed to read .claude/hooks")? {
+        let path = entry?.path();
+        if path.extension().and_then(|ext| ext.to_str()) != Some("sh") {
+            continue;
+        }
+
+        if !path.is_file() {
+            continue;
+        }
+
+        if !is_executable(&path)? {
+            println!("::error::Hook not executable: {}", path.display());
+            failed += 1;
+        }
+    }
+
+    if failed == 0 {
+        println!("Hook executable check passed");
+        Ok(())
+    } else {
+        bail!("Hook executable check failed for {failed} file(s)");
+    }
+}
+
+pub fn run_hook_registry_check() -> Result<()> {
+    let root = project_root()?;
+    let settings_path = root.join(".claude/settings.json");
+    let settings = fs::read_to_string(&settings_path)
+        .with_context(|| format!("Failed to read {}", settings_path.display()))?;
+
+    let document: Value = serde_json::from_str(&settings)
+        .with_context(|| format!("Failed to parse {}", settings_path.display()))?;
+
+    let commands = extract_hook_commands(&document);
+    if commands.is_empty() {
+        println!(
+            "No .sh hook scripts registered in {} -- nothing to check",
+            settings_path.display()
+        );
+        return Ok(());
+    }
+
+    let mut failed = 0u32;
+
+    for path in &commands {
+        let abs_path = root.join(&path);
+        if !abs_path.exists() {
+            println!("::error::Registered hook script missing: {}", path);
+            failed += 1;
+            continue;
+        }
+
+        if !is_executable(&abs_path)? {
+            println!("::error::Registered hook script not executable: {}", path);
+            failed += 1;
+            continue;
+        }
+
+        println!("  OK: {}", path);
+    }
+
+    if failed == 0 {
+        println!("Hook registry check passed ({} scripts verified)", commands.len());
+        Ok(())
+    } else {
+        bail!("Hook registry check failed for {failed} script(s)");
+    }
+}
+
+pub fn run_hook_tests() -> Result<()> {
+    let root = project_root()?;
+    let hooks_dir = root.join(".claude/hooks");
+
+    let task_completed = hooks_dir.join("task-completed.sh");
+    let subagent_stop = hooks_dir.join("subagent-stop.sh");
+    let pre_tool_use = hooks_dir.join("pre-tool-use.sh");
+
+    for path in [&task_completed, &subagent_stop, &pre_tool_use] {
+        if !path.exists() {
+            bail!("Required hook script missing: {}", path.display());
+        }
+
+        if !is_executable(path)? {
+            bail!("Hook script not executable: {}", path.display());
+        }
+    }
+
+    let ts_re = Regex::new(r#""ts":"[0-9]{4}-"#)?;
+
+    let mut pass = 0u32;
+    let mut fail = 0u32;
+
+    let task_completed_no_payload = run_script(task_completed.as_path(), None, None)?;
+    assert_exit_code(
+        0,
+        "task-completed passes with no staged .rs files",
+        task_completed_no_payload.status.code().unwrap_or(-1),
+        &mut pass,
+        &mut fail,
+    );
+
+    let temp_root = PathBuf::from(std::env::temp_dir()).join(format!(
+        "xtask-hook-tests-{}",
+        SystemTime::now().duration_since(UNIX_EPOCH)?.as_nanos()
+    ));
+    fs::create_dir_all(&temp_root).context("Failed to create temporary ops directory")?;
+
+    let sample_payload =
+        r#"{"subagent_name":"test-agent","subagent_type":"builder","session_id":"abc123"}"#;
+    let temp_ops = temp_root.join("subagent-stop");
+    fs::create_dir_all(&temp_ops).context("Failed to create temporary OPS_DIR")?;
+    let subagent_out = run_script(&subagent_stop, Some(sample_payload), Some(temp_ops.as_path()))?;
+    assert_exit_code(
+        0,
+        "subagent-stop exits 0 with payload",
+        subagent_out.status.code().unwrap_or(-1),
+        &mut pass,
+        &mut fail,
+    );
+
+    let output = read_file(temp_ops.join("swarm-metrics.jsonl"), "Subagent-stop output file")?;
+    assert_contains(
+        &output,
+        r#""event":"subagent_stop""#,
+        "subagent-stop writes subagent_stop event",
+        &mut pass,
+        &mut fail,
+    );
+    assert_contains(
+        &output,
+        r#""agent_name":"test-agent""#,
+        "subagent-stop writes agent_name",
+        &mut pass,
+        &mut fail,
+    );
+    assert_regex(&output, &ts_re, "subagent-stop includes ts timestamp", &mut pass, &mut fail);
+
+    let temp_ops = temp_root.join("task-completed-write");
+    fs::create_dir_all(&temp_ops).context("Failed to create temporary OPS_DIR")?;
+    let sample_payload_tc = r#"{"session_id":"abc123","cwd":"/repo/worktrees/agent-xyz"}"#;
+    let task_completed_with_payload =
+        run_script(&task_completed, Some(sample_payload_tc), Some(temp_ops.as_path()))?;
+    assert_exit_code(
+        0,
+        "task-completed exits 0 with metrics payload",
+        task_completed_with_payload.status.code().unwrap_or(-1),
+        &mut pass,
+        &mut fail,
+    );
+
+    let output = read_file(temp_ops.join("swarm-metrics.jsonl"), "task-completed metrics file")?;
+    assert_contains(
+        &output,
+        r#""event":"task_completed""#,
+        "task-completed writes task_completed event",
+        &mut pass,
+        &mut fail,
+    );
+    assert_contains(
+        &output,
+        r#""session_id":"abc123""#,
+        "task-completed captures session_id",
+        &mut pass,
+        &mut fail,
+    );
+
+    let temp_ops = temp_root.join("task-completed-empty");
+    fs::create_dir_all(&temp_ops).context("Failed to create temporary OPS_DIR")?;
+    let _ = run_script(&task_completed, Some("{}"), Some(temp_ops.as_path()))?;
+
+    let safe_payload = r#"{"tool_input":{"command":"git status"}}"#;
+    let pre_tool_safe = run_script(&pre_tool_use, Some(safe_payload), None)?;
+    assert_exit_code(
+        0,
+        "pre-tool-use allows safe commands",
+        pre_tool_safe.status.code().unwrap_or(-1),
+        &mut pass,
+        &mut fail,
+    );
+
+    let forced_payload = r#"{"tool_input":{"command":"git push --force"}}"#;
+    let pre_tool_forced = run_script(&pre_tool_use, Some(forced_payload), None)?;
+    assert_exit_code(
+        2,
+        "pre-tool-use blocks git push --force",
+        pre_tool_forced.status.code().unwrap_or(-1),
+        &mut pass,
+        &mut fail,
+    );
+
+    let reset_payload = r#"{"tool_input":{"command":"git reset --hard"}}"#;
+    let pre_tool_reset = run_script(&pre_tool_use, Some(reset_payload), None)?;
+    assert_exit_code(
+        2,
+        "pre-tool-use blocks git reset --hard",
+        pre_tool_reset.status.code().unwrap_or(-1),
+        &mut pass,
+        &mut fail,
+    );
+
+    let empty_payload = r#"{"tool_input":{}}"#;
+    let pre_tool_empty = run_script(&pre_tool_use, Some(empty_payload), None)?;
+    assert_exit_code(
+        0,
+        "pre-tool-use allows empty command",
+        pre_tool_empty.status.code().unwrap_or(-1),
+        &mut pass,
+        &mut fail,
+    );
+
+    let temp_ops = temp_root.join("subagent-stop-cwd");
+    fs::create_dir_all(&temp_ops).context("Failed to create temporary OPS_DIR")?;
+    let payload_with_cwd =
+        r#"{"subagent_type":"builder","cwd":"/repo/worktrees/agent-abc","session_id":"sess1"}"#;
+    let subagent_out =
+        run_script(&subagent_stop, Some(payload_with_cwd), Some(temp_ops.as_path()))?;
+    assert_exit_code(
+        0,
+        "subagent-stop exits 0 with cwd payload",
+        subagent_out.status.code().unwrap_or(-1),
+        &mut pass,
+        &mut fail,
+    );
+
+    if pass > 0 || fail > 0 {
+        println!("\n=== Results: {} passed, {} failed ===", pass, fail);
+    }
+
+    if fail > 0 {
+        bail!("hook tests failed");
+    }
+
+    // best effort cleanup
+    let _ = fs::remove_dir_all(&temp_root);
+
+    Ok(())
+}
+
+fn run_script(
+    path: &Path,
+    input: Option<&str>,
+    ops_dir: Option<&Path>,
+) -> Result<std::process::Output> {
+    let mut command = Command::new("bash");
+    command.arg(path);
+    if let Some(dir) = ops_dir {
+        command.env("OPS_DIR", dir);
+    }
+
+    command.stdout(Stdio::piped()).stderr(Stdio::piped());
+
+    if input.is_some() {
+        command.stdin(Stdio::piped());
+    }
+
+    let mut child = command.spawn().with_context(|| format!("Failed to run {}", path.display()))?;
+
+    if let Some(input) = input {
+        let stdin = child.stdin.as_mut().context("Failed to open stdin for script")?;
+        stdin.write_all(input.as_bytes()).context("Failed to write hook input")?;
+    }
+
+    let output = child.wait_with_output().context("Failed to read script output")?;
+    Ok(output)
+}
+
+fn is_executable(path: &Path) -> Result<bool> {
+    let metadata = path.metadata().context("Failed to read script metadata")?;
+    if metadata.is_dir() {
+        return Ok(false);
+    }
+
+    #[cfg(unix)]
+    {
+        Ok(metadata.permissions().mode() & 0o111 != 0)
+    }
+
+    #[cfg(not(unix))]
+    {
+        Ok(true)
+    }
+}
+
+fn extract_hook_commands(document: &Value) -> Vec<String> {
+    let mut commands = HashSet::new();
+    if let Some(root_hooks) = document.get("hooks").and_then(Value::as_object) {
+        for value in root_hooks.values() {
+            if let Some(entries) = value.as_array() {
+                for entry in entries {
+                    collect_commands(entry, &mut commands);
+                    if let Some(hooks) = entry.get("hooks").and_then(Value::as_array) {
+                        for hook in hooks {
+                            collect_commands(hook, &mut commands);
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    let mut out: Vec<String> =
+        commands.into_iter().filter(|command| command.ends_with(".sh")).collect();
+    out.sort_unstable();
+    out
+}
+
+fn collect_commands(document: &Value, out: &mut HashSet<String>) {
+    if let Some(command) = document.get("command").and_then(Value::as_str) {
+        if command.ends_with(".sh") {
+            out.insert(normalize_hook_path(command));
+        }
+    }
+
+    if let Some(map) = document.get("hooks").and_then(Value::as_object) {
+        for value in map.values() {
+            collect_commands(value, out);
+        }
+    }
+
+    if let Some(array) = document.get("hooks").and_then(Value::as_array) {
+        for value in array {
+            collect_commands(value, out);
+        }
+    }
+}
+
+fn normalize_hook_path(value: &str) -> String {
+    let mut normalized = value.replace("\"$CLAUDE_PROJECT_DIR\"/", "");
+    normalized = normalized.replace("$CLAUDE_PROJECT_DIR/", "");
+    normalized.trim_matches('"').trim_matches('\\').trim().to_string()
+}
+
+fn read_file(path: PathBuf, desc: &str) -> Result<String> {
+    if !path.exists() {
+        bail!("{desc} not found: {}", path.display());
+    }
+
+    fs::read_to_string(&path).with_context(|| format!("Failed to read {desc}: {}", path.display()))
+}
+
+fn assert_exit_code(expected: i32, desc: &str, actual: i32, pass: &mut u32, fail: &mut u32) {
+    if actual == expected {
+        println!("  PASS: {desc} (exit {actual})");
+        *pass += 1;
+    } else {
+        eprintln!("  FAIL: {desc} - expected exit {expected}, got {actual}");
+        *fail += 1;
+    }
+}
+
+fn assert_contains(content: &str, pattern: &str, desc: &str, pass: &mut u32, fail: &mut u32) {
+    if content.contains(pattern) {
+        println!("  PASS: {desc}");
+        *pass += 1;
+    } else {
+        eprintln!("  FAIL: {desc} - pattern '{pattern}' not found");
+        *fail += 1;
+    }
+}
+
+fn assert_regex(content: &str, pattern: &Regex, desc: &str, pass: &mut u32, fail: &mut u32) {
+    if pattern.is_match(content) {
+        println!("  PASS: {desc}");
+        *pass += 1;
+    } else {
+        eprintln!("  FAIL: {desc} - pattern '{pattern}' not found");
+        *fail += 1;
+    }
+}
diff --git a/xtask/src/tasks/inject_sha_assets.rs b/xtask/src/tasks/inject_sha_assets.rs
new file mode 100644
index 0000000000..f99fc905da
--- /dev/null
+++ b/xtask/src/tasks/inject_sha_assets.rs
@@ -0,0 +1,221 @@
+//! Generate Homebrew formula and VS Code asset metadata from cargo-dist checksums.
+
+use color_eyre::eyre::{Context, Result, eyre};
+use serde_json::{Map, Value, json};
+use std::collections::BTreeMap;
+use std::fs;
+use std::path::{Path, PathBuf};
+
+/// Arguments for `cargo xtask inject-sha-assets`.
+pub struct InjectShaAssetsConfig {
+    /// Version tag used by release artifacts (for example `v0.8.3`).
+    pub version: String,
+    /// GitHub organization/owner.
+    pub owner: String,
+    /// GitHub repository name.
+    pub repo: String,
+    /// Release artifact filename prefix.
+    pub prefix: String,
+    /// Path to cargo-dist checksums JSON map.
+    pub checksums: PathBuf,
+    /// Optional path for generated Homebrew formula.
+    pub brew_out: Option<PathBuf>,
+    /// Optional path for generated VS Code extension asset map.
+    pub asset_map_out: Option<PathBuf>,
+}
+
+const MAC_ARM: &str = "aarch64-apple-darwin.tar.gz";
+const MAC_X64: &str = "x86_64-apple-darwin.tar.gz";
+const LIN_ARM: &str = "aarch64-unknown-linux-musl.tar.gz";
+const LIN_X64: &str = "x86_64-unknown-linux-musl.tar.gz";
+const WIN_X64: &str = "x86_64-pc-windows-msvc.zip";
+const WIN_ARM: &str = "aarch64-pc-windows-msvc.zip";
+
+pub fn run(config: InjectShaAssetsConfig) -> Result<()> {
+    let checksums = load_checksums(&config.checksums)?;
+
+    let mac_sha_arm = checksum_for(&config, MAC_ARM, &checksums)?;
+    let mac_sha_x64 = checksum_for(&config, MAC_X64, &checksums)?;
+    let lin_sha_arm = checksum_for(&config, LIN_ARM, &checksums)?;
+    let lin_sha_x64 = checksum_for(&config, LIN_X64, &checksums)?;
+    let win_sha_x64 = checksum_for(&config, WIN_X64, &checksums)?;
+    let win_sha_arm = checksum_for(&config, WIN_ARM, &checksums)?;
+
+    let brew_formula = build_brew_formula(
+        &config,
+        &AssetShaMap {
+            mac_arm: &mac_sha_arm,
+            mac_x64: &mac_sha_x64,
+            lin_arm: &lin_sha_arm,
+            lin_x64: &lin_sha_x64,
+            win_x64: &win_sha_x64,
+            win_arm: &win_sha_arm,
+        },
+    );
+    let asset_map = build_asset_map(
+        &config,
+        &AssetShaMap {
+            mac_arm: &mac_sha_arm,
+            mac_x64: &mac_sha_x64,
+            lin_arm: &lin_sha_arm,
+            lin_x64: &lin_sha_x64,
+            win_x64: &win_sha_x64,
+            win_arm: &win_sha_arm,
+        },
+    )?;
+
+    write_output(config.brew_out.as_deref(), &brew_formula, "brew formula")?;
+    write_output(config.asset_map_out.as_deref(), &asset_map, "asset map")?;
+
+    Ok(())
+}
+
+fn load_checksums(path: &Path) -> Result<BTreeMap<String, String>> {
+    let raw = fs::read_to_string(path)
+        .with_context(|| format!("failed to read checksums file {}", path.display()))?;
+    serde_json::from_str(&raw)
+        .with_context(|| format!("expected JSON map in checksums file {}", path.display()))
+}
+
+fn checksum_for<'a>(
+    config: &InjectShaAssetsConfig,
+    artifact_suffix: &'a str,
+    checksums: &'a BTreeMap<String, String>,
+) -> Result<String> {
+    let filename = format!("{}-{}-{}", config.prefix, config.version, artifact_suffix);
+    checksums.get(&filename).cloned().ok_or_else(|| eyre!("missing checksum for {}", filename))
+}
+
+struct AssetShaMap<'a> {
+    mac_arm: &'a str,
+    mac_x64: &'a str,
+    lin_arm: &'a str,
+    lin_x64: &'a str,
+    win_x64: &'a str,
+    win_arm: &'a str,
+}
+
+fn build_brew_formula(config: &InjectShaAssetsConfig, assets: &AssetShaMap<'_>) -> String {
+    let base = release_base_url(config);
+
+    let mac_arm_filename = artifact_filename(&config.prefix, &config.version, MAC_ARM);
+    let mac_x64_filename = artifact_filename(&config.prefix, &config.version, MAC_X64);
+    let lin_arm_filename = artifact_filename(&config.prefix, &config.version, LIN_ARM);
+    let lin_x64_filename = artifact_filename(&config.prefix, &config.version, LIN_X64);
+
+    format!(
+        r##"class PerlLsp < Formula
+  desc "Perl language server"
+  homepage "https://github.com/{owner}/{repo}"
+  version "{version}"
+  license "MIT"
+
+  on_macos do
+    on_arm do
+      url "{base}/{mac_arm_filename}"
+      sha256 "{mac_arm_sha}"
+    end
+    on_intel do
+      url "{base}/{mac_x64_filename}"
+      sha256 "{mac_x64_sha}"
+    end
+  end
+
+  on_linux do
+    on_arm do
+      url "{base}/{lin_arm_filename}"
+      sha256 "{lin_arm_sha}"
+    end
+    on_intel do
+      url "{base}/{lin_x64_filename}"
+      sha256 "{lin_x64_sha}"
+    end
+  end
+
+  def install
+    bin.install "perl-lsp"
+  end
+
+  test do
+    assert_match "perl-lsp", shell_output("#{{bin}}/perl-lsp --version")
+  end
+end
+"##,
+        owner = config.owner,
+        repo = config.repo,
+        version = config.version,
+        base = base,
+        mac_arm_filename = mac_arm_filename,
+        mac_x64_filename = mac_x64_filename,
+        lin_arm_filename = lin_arm_filename,
+        lin_x64_filename = lin_x64_filename,
+        mac_arm_sha = assets.mac_arm,
+        mac_x64_sha = assets.mac_x64,
+        lin_arm_sha = assets.lin_arm,
+        lin_x64_sha = assets.lin_x64,
+    )
+}
+
+fn build_asset_map(config: &InjectShaAssetsConfig, assets: &AssetShaMap<'_>) -> Result<String> {
+    let base = release_base_url(config);
+    let linux_x64 = artifact_filename(&config.prefix, &config.version, LIN_X64);
+    let linux_arm = artifact_filename(&config.prefix, &config.version, LIN_ARM);
+    let mac_x64 = artifact_filename(&config.prefix, &config.version, MAC_X64);
+    let mac_arm = artifact_filename(&config.prefix, &config.version, MAC_ARM);
+    let win_x64 = artifact_filename(&config.prefix, &config.version, WIN_X64);
+    let win_arm = artifact_filename(&config.prefix, &config.version, WIN_ARM);
+
+    let url = |file: &str| format!("{base}/{file}");
+    let mut payload = Map::new();
+    payload.insert("v".to_string(), json!(&config.version));
+    payload.insert(
+        "linux-x64".to_string(),
+        json!({ "url": url(&linux_x64), "sha256": assets.lin_x64 }),
+    );
+    payload.insert(
+        "linux-arm64".to_string(),
+        json!({ "url": url(&linux_arm), "sha256": assets.lin_arm }),
+    );
+    payload
+        .insert("macos-x64".to_string(), json!({ "url": url(&mac_x64), "sha256": assets.mac_x64 }));
+    payload.insert(
+        "macos-arm64".to_string(),
+        json!({ "url": url(&mac_arm), "sha256": assets.mac_arm }),
+    );
+    payload
+        .insert("win-x64".to_string(), json!({ "url": url(&win_x64), "sha256": assets.win_x64 }));
+    payload
+        .insert("win-arm64".to_string(), json!({ "url": url(&win_arm), "sha256": assets.win_arm }));
+    let payload = Value::Object(payload);
+    serde_json::to_string_pretty(&payload).map_err(Into::into)
+}
+
+fn release_base_url(config: &InjectShaAssetsConfig) -> String {
+    format!(
+        "https://github.com/{}/{}/releases/download/{}",
+        config.owner, config.repo, config.version
+    )
+}
+
+fn artifact_filename(prefix: &str, version: &str, artifact_suffix: &str) -> String {
+    format!("{prefix}-{version}-{artifact_suffix}")
+}
+
+fn write_output(path: Option<&Path>, content: &str, name: &str) -> Result<()> {
+    let content = content.trim_end_matches('\n');
+    if let Some(path) = path {
+        if let Some(parent) = path.parent() {
+            if !parent.as_os_str().is_empty() {
+                fs::create_dir_all(parent).with_context(|| {
+                    format!("failed to create directory for {}", path.display())
+                })?;
+            }
+        }
+        fs::write(path, format!("{content}\n"))
+            .with_context(|| format!("failed to write {name} {}", path.display()))?;
+        println!("[inject] wrote {}", path.display());
+    } else {
+        print!("{content}\n");
+    }
+    Ok(())
+}
diff --git a/xtask/src/tasks/mod.rs b/xtask/src/tasks/mod.rs
index 3c4682ac6c..6e89c35ba5 100644
--- a/xtask/src/tasks/mod.rs
+++ b/xtask/src/tasks/mod.rs
@@ -1,12 +1,21 @@
 //! Task implementations for xtask automation
 
 pub mod bench;
+pub mod benchmarks;
 #[cfg(feature = "parser-tasks")]
 pub mod bindings;
 pub mod build;
+pub mod build_timing;
 pub mod bump_version;
 pub mod check;
+pub mod check_toolchain;
+pub mod check_version_sync;
 pub mod ci;
+pub mod ci_audit_workflows;
+pub mod ci_hygiene;
+pub mod ci_measure;
+pub mod ci_metrics;
+pub mod ci_policy;
 pub mod clean;
 pub mod compare;
 #[cfg(feature = "legacy")]
@@ -18,23 +27,41 @@ pub mod cpan_corpus;
 pub mod dead_code;
 pub mod debt_report;
 pub mod dev;
+pub mod devex_doctor;
 pub mod doc;
+pub mod doc_claims;
 pub mod e2e_validate;
 pub mod edge_cases;
 pub mod features;
 pub mod fmt;
+pub mod forbid_fatal_constructs;
+pub mod forensics;
 pub mod gates;
+pub mod github;
+pub mod hardening;
 #[cfg(feature = "parser-tasks")]
 pub mod highlight;
+pub mod hook_checks;
 pub mod ignored_tests;
+pub mod inject_sha_assets;
 pub mod parse_rust;
 pub mod parser_corpus_sweep;
+pub mod parser_matrix;
+pub mod populate_book;
+pub mod prep_crates_io_launch;
+pub mod publication_facts;
 pub mod publish;
+pub mod publish_receipts;
 pub mod receipts;
 pub mod release;
+pub mod release_turnkey;
 pub mod srp_microcrates;
+pub mod swarm_summary;
 pub mod targeted_checks;
 pub mod test;
 pub mod test_lsp;
 pub mod unwired_scan;
+pub mod update_homebrew;
 pub mod update_status;
+pub mod validate_workspace_exclusions;
+pub mod worktrees;
diff --git a/xtask/src/tasks/parser_matrix.rs b/xtask/src/tasks/parser_matrix.rs
new file mode 100644
index 0000000000..bc3aa00dd6
--- /dev/null
+++ b/xtask/src/tasks/parser_matrix.rs
@@ -0,0 +1,348 @@
+//! Generate the parser feature matrix documentation from a corpus audit report.
+
+use crate::tasks::corpus_audit;
+use crate::utils::project_root;
+use chrono::Local;
+use color_eyre::eyre::{Context, ContextCompat, Result, bail, eyre};
+use std::fs;
+use std::path::{Path, PathBuf};
+use std::process::Command;
+use toml::Value;
+
+use super::corpus_audit::{AuditReport, FailingFile, ParseOutcomesSummary};
+
+const DEFAULT_REPORT_PATH: &str = "corpus_audit_report.json";
+const DEFAULT_OUTPUT_PATH: &str = "docs/reference/PARSER_FEATURE_MATRIX.md";
+const BASELINE_PATH: &str = "ci/parse_errors_baseline.txt";
+const UNKNOWN: &str = "unknown";
+
+const CATEGORY_TAXONOMY: &[(&str, &str, &str)] = &[
+    ("ModernFeature", "P1", "class/try/catch/field/method keywords"),
+    ("QuoteLike", "P2", "q/qq/qw/qx/qr, heredocs, strings"),
+    ("Regex", "P2", "m//, s///, tr///, patterns"),
+    ("ControlFlow", "P2", "given/when/default"),
+    ("Dereference", "P2", "->, postfix deref"),
+    ("Subroutine", "P2", "Signatures, prototypes"),
+    ("General", "P3", "Uncategorized"),
+];
+
+pub fn run() -> Result<()> {
+    run_with_paths(PathBuf::from(DEFAULT_REPORT_PATH), PathBuf::from(DEFAULT_OUTPUT_PATH))
+}
+
+pub fn run_with_paths(report: PathBuf, output: PathBuf) -> Result<()> {
+    let root = project_root()?;
+    let report_path = root.join(&report);
+    let output_path = root.join(&output);
+
+    let report = load_report(&report_path)?;
+    let output = generate_matrix(&root, &report)?;
+    fs::create_dir_all(output_path.parent().context("matrix output parent path missing")?)?;
+    fs::write(&output_path, output)
+        .context(format!("failed to write {}", output_path.display()))?;
+
+    println!("Updated {}", output_path.display());
+    println!(
+        "  Parse success: {}/{} ({:.0}%)",
+        report.parse_outcomes.ok,
+        report.parse_outcomes.total,
+        success_rate(&report.parse_outcomes)
+    );
+    println!(
+        "  Errors: {} ({} categories)",
+        report.parse_outcomes.error,
+        report.parse_outcomes.error_by_category.len()
+    );
+
+    Ok(())
+}
+
+fn load_report(path: &Path) -> Result<AuditReport> {
+    if !path.exists() {
+        bail!("Error: {} not found. Run 'just parser-audit' first.", path.display());
+    }
+
+    let report_text = fs::read_to_string(path)
+        .with_context(|| format!("failed to read parser audit report {}", path.display()))?;
+    serde_json::from_str(&report_text).context("failed to parse parser audit report JSON")
+}
+
+fn get_git_sha(root: &Path) -> String {
+    let output =
+        Command::new("git").arg("rev-parse").arg("--short").arg("HEAD").current_dir(root).output();
+    match output {
+        Ok(result) => {
+            if result.status.success() {
+                let sha = String::from_utf8_lossy(&result.stdout).trim().to_string();
+                if sha.is_empty() { UNKNOWN.to_string() } else { sha }
+            } else {
+                UNKNOWN.to_string()
+            }
+        }
+        Err(_) => UNKNOWN.to_string(),
+    }
+}
+
+fn get_crate_version(root: &Path, crate_name: &str) -> String {
+    let cargo_path = root.join("crates").join(crate_name).join("Cargo.toml");
+    let cargo_text = match fs::read_to_string(&cargo_path) {
+        Ok(text) => text,
+        Err(_) => return UNKNOWN.to_string(),
+    };
+    let cargo_toml: Value = match toml::from_str(&cargo_text) {
+        Ok(value) => value,
+        Err(_) => return UNKNOWN.to_string(),
+    };
+    cargo_toml
+        .get("package")
+        .and_then(|pkg| pkg.get("version"))
+        .and_then(|version| version.as_str())
+        .map(ToString::to_string)
+        .unwrap_or_else(|| UNKNOWN.to_string())
+}
+
+fn success_rate(outcomes: &ParseOutcomesSummary) -> f64 {
+    if outcomes.total == 0 { 0.0 } else { outcomes.ok as f64 * 100.0 / outcomes.total as f64 }
+}
+
+fn format_location(file: &FailingFile) -> Option<String> {
+    file.line_number.map(|line_num| {
+        let location = match file.column {
+            Some(column) => format!("line {line_num}:{column}"),
+            None => format!("line {line_num}"),
+        };
+        location
+    })
+}
+
+fn format_token_info(file: &FailingFile) -> Option<String> {
+    match (file.expected.as_deref(), file.found_token.as_deref()) {
+        (Some(expected), Some(found)) => {
+            Some(format!("expected `{}`, found `{}`", expected, found))
+        }
+        (Some(expected), None) => Some(format!("expected `{}`", expected)),
+        (None, Some(found)) => Some(format!("found `{}`", found)),
+        (None, None) => None,
+    }
+}
+
+fn generate_matrix(root: &Path, report: &AuditReport) -> Result<String> {
+    let outcomes = &report.parse_outcomes;
+    let baseline = baseline_error_count(root)?;
+    let success_rate = success_rate(outcomes);
+    let ga_coverage = report.ga_coverage.coverage_percentage;
+    let mut lines: Vec<String> = Vec::new();
+
+    lines.push("# Parser Feature Matrix".to_string());
+    lines.push(String::new());
+    lines.push(
+        "> **Issue #180**: This document tracks parser coverage and missing features.".to_string(),
+    );
+    lines.push(String::new());
+    lines.push("## Provenance".to_string());
+    lines.push(String::new());
+    lines.push("| Field | Value |".to_string());
+    lines.push("|-------|-------|".to_string());
+    lines.push(format!("| Generated | {} |", Local::now().format("%Y-%m-%d %H:%M")));
+    lines.push(format!("| Commit | `{}` |", get_git_sha(root)));
+    lines.push(format!("| perl-parser | v{} |", get_crate_version(root, "perl-parser")));
+    lines.push("| Corpus | `test_corpus/` |".to_string());
+    lines.push("| Command | `just parser-audit && just parser-matrix-update` |".to_string());
+    lines.push(String::new());
+
+    lines.push("## Summary".to_string());
+    lines.push(String::new());
+    lines.push("| Metric | Current | Target | Status |".to_string());
+    lines.push("|--------|---------|--------|--------|".to_string());
+    lines.push(format!(
+        "| Parse Success Rate | {:.0}% ({}/{}) | 100% | {} |",
+        success_rate,
+        outcomes.ok,
+        outcomes.total,
+        if outcomes.error == 0 { "Passing" } else { "In Progress" }
+    ));
+    lines.push(format!(
+        "| Parse Errors | {} | 0 | {} |",
+        outcomes.error,
+        if outcomes.error == 0 { "Passing" } else { "Baseline Set" }
+    ));
+    lines.push(format!(
+        "| Timeouts | {} | 0 | {} |",
+        outcomes.timeout,
+        if outcomes.timeout == 0 { "Passing" } else { "Failed" }
+    ));
+    lines.push(format!(
+        "| Panics | {} | 0 | {} |",
+        outcomes.panic,
+        if outcomes.panic == 0 { "Passing" } else { "Failed" }
+    ));
+    lines.push(format!(
+        "| Test Corpus Inventory | {:.0}% | 100% | {} |",
+        ga_coverage,
+        if ga_coverage >= 80.0 { "Passing" } else { "In Progress" }
+    ));
+    if let Some(baseline) = baseline {
+        lines.push(format!("| Baseline | {} | 0 | Ratcheted |", baseline));
+    }
+
+    lines.push(String::new());
+    lines.push(
+        "*Test Corpus Inventory* measures whether the test corpus contains examples of each"
+            .to_string(),
+    );
+    lines.push(
+        "GA (generally available) feature defined in `features.toml`. It does NOT measure"
+            .to_string(),
+    );
+    lines.push(
+        "whether those features parse successfully—that's what Parse Success Rate tracks."
+            .to_string(),
+    );
+    lines.push(String::new());
+    lines.push("## Error Breakdown by Category".to_string());
+    lines.push(String::new());
+    lines.push("Errors are categorized to help prioritize implementation work:".to_string());
+    lines.push(String::new());
+    lines.push("| Category | Count | Priority | Description |".to_string());
+    lines.push("|----------|-------|----------|-------------|".to_string());
+
+    let mut categories: Vec<(String, usize, String, String)> = CATEGORY_TAXONOMY
+        .iter()
+        .map(|(name, priority, description)| {
+            (
+                name.to_string(),
+                *outcomes.error_by_category.get(*name).unwrap_or(&0),
+                priority.to_string(),
+                description.to_string(),
+            )
+        })
+        .collect::<Vec<_>>();
+    categories.sort_by(
+        |(a_name, a_count, ..): &(String, usize, String, String),
+         (b_name, b_count, ..): &(String, usize, String, String)| {
+            b_count.cmp(a_count).then_with(|| a_name.cmp(b_name))
+        },
+    );
+    for (name, count, priority, description) in categories {
+        lines.push(format!("| {name} | {count} | {priority} | {description} |"));
+    }
+
+    lines.push(String::new());
+    lines.push("## Failing Files".to_string());
+    lines.push(String::new());
+
+    if outcomes.failing_files.is_empty() {
+        lines.push("*No failing files* ✅".to_string());
+    } else {
+        for file in &outcomes.failing_files {
+            lines.push(format!("### `{}`", file.path));
+            lines.push(String::new());
+            lines.push(format!("- **Category**: {}", file.category));
+            if let Some(location) = format_location(file) {
+                lines.push(format!("- **Location**: {location}"));
+            }
+            if let Some(token_info) = format_token_info(file) {
+                lines.push(format!("- **Error**: {token_info}"));
+            }
+            if let Some(snippet) = &file.code_snippet {
+                lines.push(String::new());
+                lines.push("```perl".to_string());
+                lines.push(snippet.to_string());
+                lines.push("```".to_string());
+            }
+            lines.push(String::new());
+        }
+    }
+
+    lines.push(String::new());
+    lines.push("## Coverage Roadmap".to_string());
+    lines.push(String::new());
+    lines.push("### Phase 1: Stabilize Core (Current)".to_string());
+    lines.push("- [x] Establish baseline ratchet (Issue #180)".to_string());
+    lines.push("- [x] Add error categorization".to_string());
+    lines.push(format!(
+        "- {} Reduce parse errors to 0",
+        if outcomes.error == 0 { "[x]" } else { "[ ]" }
+    ));
+    lines.push(String::new());
+
+    lines.push("### Phase 2: Modern Perl Features".to_string());
+    lines.push("- [ ] `class` keyword (Perl 5.38+, Corinna)".to_string());
+    lines.push("- [ ] `try`/`catch`/`finally` blocks".to_string());
+    lines.push("- [ ] `field` and `method` declarations".to_string());
+    lines.push("- [ ] `builtin::` functions".to_string());
+    lines.push(String::new());
+
+    lines.push("### Phase 3: Edge Cases".to_string());
+    lines.push("- [ ] Complex heredoc scenarios".to_string());
+    lines.push("- [ ] Unicode in quote delimiters".to_string());
+    lines.push("- [ ] Recursive regex patterns".to_string());
+    lines.push(String::new());
+
+    lines.push("## How to Use".to_string());
+    lines.push(String::new());
+    lines.push("```bash".to_string());
+    lines.push("# View current parse status".to_string());
+    lines.push("just parser-audit".to_string());
+    lines.push(String::new());
+    lines.push("# Check against baseline (CI mode)".to_string());
+    lines.push("just ci-parser-features-check".to_string());
+    lines.push(String::new());
+    lines.push("# Update this document from latest audit".to_string());
+    lines.push("just parser-matrix-update".to_string());
+    lines.push("```".to_string());
+    lines.push(String::new());
+
+    lines.push("## Baseline Ratchet".to_string());
+    lines.push(String::new());
+    lines.push("The parse error count uses a ratchet mechanism:".to_string());
+    lines.push(String::new());
+    lines.push("- Baseline stored in `ci/parse_errors_baseline.txt`".to_string());
+    lines.push("- CI fails if parse errors **increase**".to_string());
+    lines.push("- CI passes if parse errors stay same or decrease".to_string());
+    lines.push(
+        "- When errors decrease, update baseline: `echo N > ci/parse_errors_baseline.txt`"
+            .to_string(),
+    );
+    lines.push(String::new());
+
+    lines.push(
+        "**Philosophy**: Baseline updates are only allowed when the parser actually improves"
+            .to_string(),
+    );
+    lines.push(
+        "(error count decreases), never to paper over regressions. The ratchet ensures the"
+            .to_string(),
+    );
+    lines.push("codebase only gets easier to reason about over time.".to_string());
+    lines.push(String::new());
+
+    lines.push("## Related Documentation".to_string());
+    lines.push(String::new());
+    lines.push("- [CLAUDE.md](../CLAUDE.md) - Project overview and commands".to_string());
+    lines.push(
+        "- [LSP_IMPLEMENTATION_GUIDE.md](LSP_IMPLEMENTATION_GUIDE.md) - LSP server architecture"
+            .to_string(),
+    );
+    lines.push("- [features.toml](../features.toml) - LSP feature catalog".to_string());
+
+    Ok(format!("{}\n", lines.join("\n")))
+}
+
+fn baseline_error_count(root: &Path) -> Result<Option<usize>> {
+    let baseline_path = root.join(BASELINE_PATH);
+    if !baseline_path.exists() {
+        return Ok(None);
+    }
+    let baseline_text = fs::read_to_string(&baseline_path)
+        .context("failed to read parser baseline file")?
+        .trim()
+        .to_string();
+    if baseline_text.is_empty() {
+        return Ok(None);
+    }
+    baseline_text
+        .parse::<usize>()
+        .map(Some)
+        .map_err(|_| eyre!("failed to parse baseline value as integer: {baseline_text}"))
+}
diff --git a/xtask/src/tasks/populate_book.rs b/xtask/src/tasks/populate_book.rs
new file mode 100644
index 0000000000..f6ecf06514
--- /dev/null
+++ b/xtask/src/tasks/populate_book.rs
@@ -0,0 +1,23 @@
+//! Populate mdBook source tree from project documentation files.
+
+use color_eyre::eyre::{Context, Result, bail};
+use std::process::Command;
+
+use crate::utils::project_root;
+
+pub fn run() -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("scripts").join("populate-book.sh");
+
+    let status = Command::new("bash")
+        .current_dir(&root)
+        .arg(script.clone())
+        .status()
+        .context("failed to execute scripts/populate-book.sh")?;
+
+    if status.success() {
+        Ok(())
+    } else {
+        bail!("populate-book failed");
+    }
+}
diff --git a/xtask/src/tasks/prep_crates_io_launch.rs b/xtask/src/tasks/prep_crates_io_launch.rs
new file mode 100644
index 0000000000..b4f3e6813a
--- /dev/null
+++ b/xtask/src/tasks/prep_crates_io_launch.rs
@@ -0,0 +1,201 @@
+//! crates.io launch-preparation helper.
+
+use color_eyre::eyre::{Context, Result, bail};
+use serde::Deserialize;
+use serde_json::Value as JsonValue;
+use std::collections::HashSet;
+use std::fs;
+use std::path::Path;
+use std::process::Command;
+
+use crate::utils::project_root;
+
+const CORE_LAUNCH_CRATES: &[&str] =
+    &["perl-parser", "perl-lexer", "perl-lsp", "perl-dap", "perl-corpus"];
+
+#[derive(Deserialize)]
+struct RootCargoManifest {
+    workspace: RootWorkspace,
+}
+
+#[derive(Deserialize)]
+struct RootWorkspace {
+    metadata: Option<RootWorkspaceMetadata>,
+}
+
+#[derive(Deserialize)]
+struct RootWorkspaceMetadata {
+    publish: Option<RootPublishMetadata>,
+}
+
+#[derive(Deserialize)]
+struct RootPublishMetadata {
+    allow: Option<Vec<String>>,
+}
+
+#[derive(Deserialize)]
+struct CargoMetadata {
+    workspace_root: String,
+    packages: Vec<MetadataPackage>,
+}
+
+#[derive(Deserialize)]
+struct MetadataPackage {
+    name: String,
+    manifest_path: String,
+    publish: Option<JsonValue>,
+}
+
+pub fn run(all: bool) -> Result<()> {
+    let root = project_root()?;
+    let launch_crates = if all {
+        load_publish_allowlist(&root)?
+    } else {
+        CORE_LAUNCH_CRATES.iter().map(|name| (*name).to_string()).collect()
+    };
+
+    let metadata = load_cargo_metadata(&root)?;
+    let patch_args = package_patch_args(&metadata);
+    let package_names: HashSet<_> =
+        metadata.packages.iter().map(|package| package.name.as_str()).collect();
+
+    let unknown = launch_crates
+        .iter()
+        .filter(|name| !package_names.contains(name.as_str()))
+        .collect::<Vec<_>>();
+
+    if !unknown.is_empty() {
+        let unknown_list = unknown.iter().map(|name| name.as_str()).collect::<Vec<_>>().join(", ");
+        bail!("unknown crates for launch prep: {unknown_list}");
+    }
+
+    println!(
+        "🚀 crates.io launch prep ({})",
+        if all { "all publish-allowlist crates" } else { "core launch crates" }
+    );
+    println!(
+        "📦 Running cargo check + cargo package (dry-run) for {} crate(s)",
+        launch_crates.len()
+    );
+
+    for crate_name in launch_crates {
+        println!();
+        println!("==> {crate_name}");
+        run_cargo_check(&root, &crate_name)?;
+        run_cargo_package_dry_run(&root, &crate_name, &patch_args)?;
+    }
+
+    println!();
+    println!("✅ crates.io launch prep completed ({})", if all { "all" } else { "core" });
+
+    Ok(())
+}
+
+fn package_patch_args(metadata: &CargoMetadata) -> Vec<String> {
+    let mut args = Vec::new();
+    let workspace_root = Path::new(&metadata.workspace_root);
+
+    for package in &metadata.packages {
+        if !is_publish_candidate(&package.publish) {
+            continue;
+        }
+
+        let manifest_path = Path::new(&package.manifest_path);
+        let crate_dir = match manifest_path.parent() {
+            Some(dir) => dir,
+            None => continue,
+        };
+        let rel_dir = crate_dir.strip_prefix(workspace_root).unwrap_or(crate_dir);
+
+        args.push(format!("--config=patch.crates-io.{}.path={}", package.name, rel_dir.display()));
+    }
+
+    args
+}
+
+fn is_publish_candidate(publish: &Option<JsonValue>) -> bool {
+    match publish {
+        Some(value) => match value.as_array() {
+            Some(entries) => !entries.is_empty(),
+            None => true,
+        },
+        None => true,
+    }
+}
+
+fn load_cargo_metadata(root: &Path) -> Result<CargoMetadata> {
+    let output = Command::new("cargo")
+        .current_dir(root)
+        .args(["metadata", "--format-version", "1", "--no-deps"])
+        .output()
+        .context("failed to run cargo metadata")?;
+
+    if !output.status.success() {
+        bail!("cargo metadata failed: {}", String::from_utf8_lossy(&output.stderr).trim_end());
+    }
+
+    let metadata: CargoMetadata =
+        serde_json::from_slice(&output.stdout).context("failed to parse cargo metadata output")?;
+    Ok(metadata)
+}
+
+fn load_publish_allowlist(root: &Path) -> Result<Vec<String>> {
+    let manifest_text = fs::read_to_string(root.join("Cargo.toml"))
+        .context("failed to read workspace Cargo.toml")?;
+    let manifest: RootCargoManifest =
+        toml::from_str(&manifest_text).context("failed to parse workspace Cargo.toml")?;
+
+    let allowlist = manifest
+        .workspace
+        .metadata
+        .and_then(|metadata| metadata.publish)
+        .and_then(|publish| publish.allow)
+        .ok_or_else(|| {
+            color_eyre::eyre::eyre!("[workspace.metadata.publish.allow] is missing from Cargo.toml")
+        })?;
+
+    if allowlist.is_empty() {
+        bail!("publish allowlist is empty");
+    }
+
+    Ok(allowlist)
+}
+
+fn run_cargo_check(root: &Path, crate_name: &str) -> Result<()> {
+    let output = Command::new("cargo")
+        .current_dir(root)
+        .args(["check", "--locked", "-p"])
+        .arg(crate_name)
+        .output()
+        .context("failed to run cargo check")?;
+
+    if !output.status.success() {
+        bail!(
+            "cargo check failed for {crate_name}: {}",
+            String::from_utf8_lossy(&output.stderr).trim_end()
+        );
+    }
+
+    Ok(())
+}
+
+fn run_cargo_package_dry_run(root: &Path, crate_name: &str, patch_args: &[String]) -> Result<()> {
+    let mut args = vec!["package".to_string(), "-p".to_string(), crate_name.to_string()];
+    args.push("--no-verify".to_string());
+    args.extend(patch_args.iter().cloned());
+
+    let output = Command::new("cargo")
+        .current_dir(root)
+        .args(args)
+        .output()
+        .context("failed to run cargo package")?;
+
+    if !output.status.success() {
+        bail!(
+            "cargo package dry-run failed for {crate_name}: {}",
+            String::from_utf8_lossy(&output.stderr).trim_end()
+        );
+    }
+
+    Ok(())
+}
diff --git a/xtask/src/tasks/publication_facts.rs b/xtask/src/tasks/publication_facts.rs
new file mode 100644
index 0000000000..c48e441a1c
--- /dev/null
+++ b/xtask/src/tasks/publication_facts.rs
@@ -0,0 +1,24 @@
+//! Publication facts verification task.
+
+use color_eyre::eyre::{Context, Result, bail};
+use std::process::Command;
+
+use crate::utils::project_root;
+
+pub fn run(args: Vec<String>) -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("scripts").join("verify-publication-facts.sh");
+
+    let status = Command::new("bash")
+        .current_dir(&root)
+        .arg(script)
+        .args(args)
+        .status()
+        .context("failed to execute scripts/verify-publication-facts.sh")?;
+
+    if status.success() {
+        Ok(())
+    } else {
+        bail!("verify-publication-facts failed");
+    }
+}
diff --git a/xtask/src/tasks/publish.rs b/xtask/src/tasks/publish.rs
index a074469b19..72fc1e8ee3 100644
--- a/xtask/src/tasks/publish.rs
+++ b/xtask/src/tasks/publish.rs
@@ -1,5 +1,6 @@
 //! Publishing functionality for crates and VSCode extension
 
+use crate::utils::project_root;
 use color_eyre::eyre::{Result, bail, eyre};
 use serde::Deserialize;
 use std::collections::{HashMap, HashSet};
@@ -201,3 +202,47 @@ pub fn publish_vscode(yes: bool, token: Option<String>) -> Result<()> {
 
     Ok(())
 }
+
+pub fn publish_release(version: String, dry_run: bool, git_ref: Option<String>) -> Result<()> {
+    let root = project_root()?;
+    let ref_name = git_ref.unwrap_or_else(|| format!("v{version}"));
+
+    let status = Command::new("gh")
+        .current_dir(&root)
+        .args([
+            "workflow",
+            "run",
+            "Publish to crates.io",
+            "--ref",
+            &ref_name,
+            "-f",
+            &format!("version={version}"),
+            "-f",
+            &format!("dry_run={dry_run}"),
+        ])
+        .status()?;
+
+    if !status.success() {
+        bail!("publish-release workflow dispatch failed");
+    }
+
+    println!("Dispatched \"Publish to crates.io\" for {version} on ref {ref_name}.");
+    Ok(())
+}
+
+pub fn smoke_test_release(version: String) -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("scripts").join("smoke-test-release.sh");
+    let status = Command::new("bash")
+        .arg(script)
+        .arg(version)
+        .current_dir(&root)
+        .env("XTASK_SMOKE_TEST_RELEASE", "1")
+        .status()?;
+
+    if !status.success() {
+        bail!("smoke-test-release failed");
+    }
+
+    Ok(())
+}
diff --git a/xtask/src/tasks/publish_receipts.rs b/xtask/src/tasks/publish_receipts.rs
new file mode 100644
index 0000000000..4bb3cce963
--- /dev/null
+++ b/xtask/src/tasks/publish_receipts.rs
@@ -0,0 +1,144 @@
+//! Publish a review receipt bundle under review/receipts/YYYY-MM-DD/.
+//!
+//! Combines `cargo xtask gates` and `cargo xtask receipts` into a single
+//! command, archives outputs, and writes a short README with provenance.
+
+use chrono::Utc;
+use color_eyre::eyre::{Context, Result, bail};
+use std::fs;
+use std::io::Write;
+use std::path::Path;
+use std::process::Command;
+
+use crate::utils::project_root;
+
+const RECEIPT_FILES: [&str; 5] =
+    ["test-output.txt", "test-summary.json", "rustdoc.log", "doc-summary.json", "state.json"];
+
+pub fn run(date: Option<String>) -> Result<()> {
+    let date = date.unwrap_or_else(|| Utc::now().format("%Y-%m-%d").to_string());
+    if date.trim().is_empty() {
+        bail!("receipt date cannot be empty");
+    }
+
+    let root = project_root()?;
+    let destination = root.join("review").join("receipts").join(&date);
+    let artifacts_source = root.join("artifacts");
+    let artifacts_destination = destination.join("artifacts");
+
+    fs::create_dir_all(&artifacts_destination)
+        .with_context(|| format!("Failed to create {}", artifacts_destination.display()))?;
+
+    println!("Publishing receipts to: {}", destination.display());
+
+    let ci_output = run_and_log(
+        "ci gate",
+        &root,
+        &mut cargo_xtask_gates("merge-gate"),
+        &destination.join("ci-gate.log"),
+    )?;
+    println!("{}", ci_output);
+
+    let receipts_output = run_and_log(
+        "receipt generation",
+        &root,
+        &mut command_receipts(),
+        &destination.join("generate-receipts.log"),
+    )?;
+    println!("{}", receipts_output);
+
+    let mut copied = 0usize;
+    for file in RECEIPT_FILES {
+        let source = artifacts_source.join(file);
+        let target = artifacts_destination.join(file);
+
+        match fs::copy(&source, &target) {
+            Ok(_) => copied += 1,
+            Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
+                println!("⚠️  Missing artifact file: {}", source.display());
+            }
+            Err(err) => {
+                bail!("failed to copy {} to {}: {}", source.display(), target.display(), err);
+            }
+        }
+    }
+
+    let readme = format!(
+        r#"# Receipt Bundle: {date}
+
+## Provenance
+- Commit: `{sha}`
+- rustc: `{rustc}`
+- cargo: `{cargo}`
+- Host: `{host}`
+
+## What ran
+- `cargo xtask gates --tier merge-gate --receipt` (see `ci-gate.log`)
+- `cargo xtask receipts` (see `generate-receipts.log`)
+- {copied} artifact file(s) copied from `artifacts/`
+"#,
+        date = date,
+        sha = command_output_or_unknown(&root, &["git", "rev-parse", "HEAD"], "UNVERIFIED"),
+        rustc = command_output_or_unknown(&root, &["rustc", "--version"], "UNVERIFIED"),
+        cargo = command_output_or_unknown(&root, &["cargo", "--version"], "UNVERIFIED"),
+        host = command_output_or_unknown(&root, &["uname", "-a"], "UNVERIFIED"),
+        copied = copied,
+    );
+
+    fs::write(destination.join("README.md"), readme)
+        .with_context(|| format!("Failed to write {}", destination.join("README.md").display()))?;
+
+    println!("Receipt bundle ready: {}", destination.display());
+    Ok(())
+}
+
+fn cargo_xtask_gates(tier: &str) -> Command {
+    let mut command = Command::new("cargo");
+    command.args(["xtask", "gates", "--tier", tier, "--receipt"]);
+    command
+}
+
+fn command_receipts() -> Command {
+    let mut command = Command::new("cargo");
+    command.args(["xtask", "receipts"]);
+    command
+}
+
+fn run_and_log(stage: &str, root: &Path, command: &mut Command, log_path: &Path) -> Result<String> {
+    let output = command.current_dir(root).output().with_context(|| {
+        format!("Failed to execute {stage} command in {}", root.join(".").display())
+    })?;
+
+    let combined = format!(
+        "{}{}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let mut log = fs::File::create(log_path)
+        .with_context(|| format!("Failed to create log at {}", log_path.display()))?;
+    log.write_all(combined.as_bytes())
+        .with_context(|| format!("Failed to write {}", log_path.display()))?;
+
+    if !output.status.success() {
+        bail!("{stage} failed (see {})", log_path.display());
+    }
+
+    Ok(combined)
+}
+
+fn command_output_or_unknown(root: &Path, args: &[&str], fallback: &str) -> String {
+    if args.is_empty() {
+        return fallback.to_string();
+    }
+
+    let mut command = Command::new(args[0]);
+    command.current_dir(root).args(&args[1..]);
+
+    match command.output() {
+        Ok(output) => {
+            let value = String::from_utf8_lossy(&output.stdout).trim().to_string();
+            if value.is_empty() { fallback.to_string() } else { value }
+        }
+        Err(_) => fallback.to_string(),
+    }
+}
diff --git a/xtask/src/tasks/release_turnkey.rs b/xtask/src/tasks/release_turnkey.rs
new file mode 100644
index 0000000000..bf9c084195
--- /dev/null
+++ b/xtask/src/tasks/release_turnkey.rs
@@ -0,0 +1,101 @@
+//! PR-driven release orchestration wrapper.
+//!
+//! This task delegates the existing shell flow in
+//! `scripts/release-turnkey-pr.sh` while exposing the command through
+//! `cargo xtask release-turnkey`.
+
+use color_eyre::eyre::{Context, Result, bail};
+use std::process::Command;
+
+use crate::utils::project_root;
+
+/// Configuration for the release turn-key wrapper task.
+pub struct ReleaseTurnkeyConfig {
+    pub version: Option<String>,
+    pub positional_version: Option<String>,
+    pub prerelease: bool,
+    pub dry_run: bool,
+    pub skip_crates: bool,
+    pub skip_extension: bool,
+    pub skip_docker: bool,
+    pub base_branch: Option<String>,
+    pub no_auto_merge: bool,
+    pub no_wait_pr_merge: bool,
+    pub no_wait_release: bool,
+    pub workflow_timeout: Option<u64>,
+}
+
+impl ReleaseTurnkeyConfig {
+    fn resolve_version(&self) -> Result<String> {
+        match (self.version.as_deref(), self.positional_version.as_deref()) {
+            (None, None) => bail!("release version is required"),
+            (Some(v), None) => Ok(v.to_string()),
+            (None, Some(v)) => Ok(v.to_string()),
+            (Some(v), Some(p)) if v == p => Ok(v.to_string()),
+            (Some(v), Some(p)) => {
+                bail!("version mismatch: --version {v} does not match positional {p}")
+            }
+        }
+    }
+
+    fn to_args(self, version: &str) -> Vec<String> {
+        let mut args = vec!["--version".to_string(), version.to_string()];
+
+        if self.prerelease {
+            args.push("--prerelease".to_string());
+        }
+        if self.dry_run {
+            args.push("--dry-run".to_string());
+        }
+        if self.skip_crates {
+            args.push("--skip-crates".to_string());
+        }
+        if self.skip_extension {
+            args.push("--skip-extension".to_string());
+        }
+        if self.skip_docker {
+            args.push("--skip-docker".to_string());
+        }
+        if let Some(base_branch) = self.base_branch {
+            args.push("--base-branch".to_string());
+            args.push(base_branch);
+        }
+        if self.no_auto_merge {
+            args.push("--no-auto-merge".to_string());
+        }
+        if self.no_wait_pr_merge {
+            args.push("--no-wait-pr-merge".to_string());
+        }
+        if self.no_wait_release {
+            args.push("--no-wait-release".to_string());
+        }
+        if let Some(workflow_timeout) = self.workflow_timeout {
+            args.push("--workflow-timeout".to_string());
+            args.push(workflow_timeout.to_string());
+        }
+
+        args
+    }
+}
+
+/// Execute the shell release driver via the canonical script path.
+pub fn run(config: ReleaseTurnkeyConfig) -> Result<()> {
+    let root = project_root()?;
+    let script = root.join("scripts").join("release-turnkey-pr.sh");
+
+    let version = config.resolve_version()?;
+    let args = config.to_args(&version);
+
+    let status = Command::new("bash")
+        .arg(&script)
+        .args(&args)
+        .current_dir(&root)
+        .status()
+        .with_context(|| format!("failed to run {}", script.display()))?;
+
+    if !status.success() {
+        bail!("release-turnkey command failed");
+    }
+
+    Ok(())
+}
diff --git a/xtask/src/tasks/swarm_summary.rs b/xtask/src/tasks/swarm_summary.rs
new file mode 100644
index 0000000000..87091af097
--- /dev/null
+++ b/xtask/src/tasks/swarm_summary.rs
@@ -0,0 +1,123 @@
+//! Swarm metrics summary task implementation.
+use std::{
+    borrow::Cow,
+    collections::HashMap,
+    fs::File,
+    io::{BufRead, BufReader},
+    path::PathBuf,
+};
+
+use color_eyre::eyre::{Context, Result, bail};
+use serde_json::Value;
+
+pub fn run(ops_dir: PathBuf) -> Result<()> {
+    let metrics_path = ops_dir.join("swarm-metrics.jsonl");
+    if !metrics_path.exists() {
+        bail!("No metrics file found at {}", metrics_path.display());
+    }
+
+    let file = File::open(&metrics_path)
+        .with_context(|| format!("Failed to open {}", metrics_path.display()))?;
+    let reader = BufReader::new(file);
+
+    let mut total_entries = 0usize;
+    let mut by_event: HashMap<String, usize> = HashMap::new();
+    let mut by_agent: HashMap<String, usize> = HashMap::new();
+    let mut task_completed: Vec<(String, String)> = Vec::new();
+    let mut subagent_stops: Vec<(String, String, String)> = Vec::new();
+
+    for line in reader.lines() {
+        let line = line.context("Failed to read swarm metrics line")?;
+        let line = line.trim();
+        if line.is_empty() {
+            continue;
+        }
+
+        let value: Value = serde_json::from_str(line)
+            .with_context(|| format!("Failed to parse JSON entry: {line}"))?;
+
+        total_entries += 1;
+
+        let event = pick_str_field(&value, &["event", "action"]);
+        let agent_type = pick_str_field(&value, &["agent_type", "type"]);
+        let ts = pick_str_field(&value, &["ts"]);
+        let cwd = pick_str_field(&value, &["cwd"]);
+        let worktree_path = pick_str_field(&value, &["worktree_path"]);
+
+        *by_event.entry(event.clone().into_owned()).or_insert(0) += 1;
+        *by_agent.entry(agent_type.clone().into_owned()).or_insert(0) += 1;
+
+        if event.as_ref() == "task_completed" {
+            task_completed.push((ts.to_string(), cwd.to_string()));
+        } else if event.as_ref() == "subagent_stop" {
+            subagent_stops.push((
+                ts.to_string(),
+                agent_type.to_string(),
+                worktree_path.to_string(),
+            ));
+        }
+    }
+
+    println!("=== Swarm Metrics Summary ===");
+    println!("Total entries: {total_entries}");
+    println!();
+    print_counts("By event type:", &by_event);
+    print_counts("By agent type:", &by_agent);
+
+    println!("Recent completions (last 5):");
+    print_last_pairs(&task_completed, 5, |ts, cwd| {
+        println!("{ts}\t{cwd}");
+    });
+    println!();
+
+    println!("Recent stops (last 5):");
+    print_last_triplets(&subagent_stops, 5, |ts, agent_type, worktree_path| {
+        println!("{ts}\t{agent_type}\t{worktree_path}");
+    });
+
+    Ok(())
+}
+
+fn pick_str_field<'a>(value: &'a Value, names: &[&str]) -> Cow<'a, str> {
+    for name in names {
+        if let Some(v) = value.get(name).and_then(Value::as_str) {
+            return Cow::Borrowed(v);
+        }
+    }
+    Cow::Borrowed("(none)")
+}
+
+fn print_counts(label: &str, counts: &HashMap<String, usize>) {
+    println!("{label}");
+    let mut rows: Vec<(&String, &usize)> = counts.iter().collect();
+    rows.sort_by(|(a_label, a_count), (b_label, b_count)| {
+        b_count.cmp(a_count).then_with(|| a_label.cmp(b_label))
+    });
+
+    for (key, count) in rows {
+        println!("{count:>5} {key}");
+    }
+    println!();
+}
+
+fn print_last_pairs<T>(rows: &[(T, T)], limit: usize, mut printer: impl FnMut(&T, &T)) {
+    if rows.is_empty() {
+        return;
+    }
+
+    let start = rows.len().saturating_sub(limit);
+    for (first, second) in &rows[start..] {
+        printer(first, second);
+    }
+}
+
+fn print_last_triplets<T>(rows: &[(T, T, T)], limit: usize, mut printer: impl FnMut(&T, &T, &T)) {
+    if rows.is_empty() {
+        return;
+    }
+
+    let start = rows.len().saturating_sub(limit);
+    for (first, second, third) in &rows[start..] {
+        printer(first, second, third);
+    }
+}
diff --git a/xtask/src/tasks/update_homebrew.rs b/xtask/src/tasks/update_homebrew.rs
new file mode 100644
index 0000000000..ba15ddf4e0
--- /dev/null
+++ b/xtask/src/tasks/update_homebrew.rs
@@ -0,0 +1,260 @@
+//! Generate Homebrew formula for release artifacts using SHA256SUMS.
+
+use color_eyre::eyre::{Context, Result, eyre};
+use std::collections::BTreeMap;
+use std::fs;
+use std::path::PathBuf;
+use std::process::Command;
+
+use crate::utils::project_root;
+
+/// Arguments for `cargo xtask update-homebrew`.
+pub struct UpdateHomebrewConfig {
+    /// Release tag used by the artifact URLs (for example `v0.8.3`).
+    pub version: String,
+    /// GitHub organization owning the release repository.
+    pub owner: String,
+    /// GitHub repository name.
+    pub repo: String,
+    /// Artifact filename prefix.
+    pub prefix: String,
+    /// Output path for generated Homebrew formula.
+    pub output: PathBuf,
+}
+
+const MAC_ARM: &str = "aarch64-apple-darwin.tar.gz";
+const MAC_X64: &str = "x86_64-apple-darwin.tar.gz";
+const LIN_ARM: &str = "aarch64-unknown-linux-gnu.tar.gz";
+const LIN_X64: &str = "x86_64-unknown-linux-gnu.tar.gz";
+
+pub fn run(config: UpdateHomebrewConfig) -> Result<()> {
+    let release_version = strip_version_prefix(config.version.trim());
+    let release_tag = config.version.trim().to_string();
+    let sums_url = format!(
+        "https://github.com/{}/{}/releases/download/{}/SHA256SUMS",
+        config.owner, config.repo, release_tag
+    );
+
+    let raw_sums = download_sha256sums(&sums_url)?;
+    let checksums = parse_sha256sums(&raw_sums)?;
+
+    let mac_sha_arm = checksum_for(&config, MAC_ARM, &checksums, &release_version)?;
+    let mac_sha_x64 = checksum_for(&config, MAC_X64, &checksums, &release_version)?;
+    let linux_sha_arm = checksum_for(&config, LIN_ARM, &checksums, &release_version)?;
+    let linux_sha_x64 = checksum_for(&config, LIN_X64, &checksums, &release_version)?;
+
+    let formula = build_brew_formula(
+        &config,
+        &release_tag,
+        &release_version,
+        &Checksums {
+            mac_arm: &mac_sha_arm,
+            mac_x64: &mac_sha_x64,
+            linux_arm: &linux_sha_arm,
+            linux_x64: &linux_sha_x64,
+        },
+    );
+    let output = resolve_output_path(config.output)?;
+    write_formula(&output, &formula)?;
+
+    println!("✅ Homebrew formula updated for version {release_version}");
+    println!();
+    println!("Checksums:");
+    println!("  macOS ARM64:  {mac_sha_arm}");
+    println!("  macOS x86_64: {mac_sha_x64}");
+    println!("  Linux ARM64:  {linux_sha_arm}");
+    println!("  Linux x86_64: {linux_sha_x64}");
+    println!();
+    println!("Next steps:");
+    println!("1. Review the formula: cat {}", output.display());
+    println!("2. Copy to your homebrew-tap repository");
+    println!("3. Commit and push the updated formula");
+    println!();
+    println!("Users can then install with:");
+    println!("  brew tap effortlesssteven/tap");
+    println!("  brew install perl-lsp");
+
+    Ok(())
+}
+
+struct Checksums<'a> {
+    mac_arm: &'a str,
+    mac_x64: &'a str,
+    linux_arm: &'a str,
+    linux_x64: &'a str,
+}
+
+fn strip_version_prefix(version: &str) -> String {
+    version.trim_start_matches('v').to_string()
+}
+
+fn resolve_output_path(path: PathBuf) -> Result<PathBuf> {
+    if path.is_absolute() {
+        return Ok(path);
+    }
+
+    let root = project_root()?;
+    Ok(root.join(path))
+}
+
+fn download_sha256sums(url: &str) -> Result<String> {
+    let output = Command::new("curl")
+        .args(["-sSfL", url])
+        .output()
+        .with_context(|| format!("failed to run curl for {url}"))?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        return Err(eyre!("failed to fetch SHA256SUMS from {url}: {stderr}"));
+    }
+
+    String::from_utf8(output.stdout)
+        .with_context(|| format!("response from {url} was not valid UTF-8"))
+}
+
+fn parse_sha256sums(raw: &str) -> Result<BTreeMap<String, String>> {
+    let mut map = BTreeMap::new();
+    for line in raw.lines() {
+        let mut parts = line.split_whitespace();
+        let hash = parts.next();
+        let file = parts.next();
+
+        if let (Some(hash), Some(file)) = (hash, file) {
+            map.insert(file.to_string(), hash.to_string());
+        }
+    }
+
+    if map.is_empty() {
+        return Err(eyre!("SHA256SUMS did not contain any valid checksums"));
+    }
+
+    Ok(map)
+}
+
+fn checksum_for(
+    config: &UpdateHomebrewConfig,
+    artifact: &str,
+    checksums: &BTreeMap<String, String>,
+    version: &str,
+) -> Result<String> {
+    let filename = format!("{}-{}-{artifact}", config.prefix, version);
+    checksums.get(&filename).cloned().ok_or_else(|| eyre!("missing checksum for {filename}"))
+}
+
+fn build_brew_formula(
+    config: &UpdateHomebrewConfig,
+    release_tag: &str,
+    version: &str,
+    checksums: &Checksums<'_>,
+) -> String {
+    let base = format!(
+        "https://github.com/{}/{}/releases/download/{release_tag}",
+        config.owner, config.repo
+    );
+    let mac_arm_filename = artifact_filename(&config.prefix, version, MAC_ARM);
+    let mac_x64_filename = artifact_filename(&config.prefix, version, MAC_X64);
+    let linux_arm_filename = artifact_filename(&config.prefix, version, LIN_ARM);
+    let linux_x64_filename = artifact_filename(&config.prefix, version, LIN_X64);
+
+    format!(
+        r##"class PerlLsp < Formula
+  desc "Fast, reliable Perl language server with 100% syntax coverage"
+  homepage "https://github.com/{owner}/{repo}"
+  version "{version}"
+  license "MIT"
+
+  on_macos do
+    if Hardware::CPU.arm?
+      url "{base}/{mac_arm_filename}"
+      sha256 "{mac_arm_sha}"
+    else
+      url "{base}/{mac_x64_filename}"
+      sha256 "{mac_x64_sha}"
+    end
+  end
+
+  on_linux do
+    if Hardware::CPU.arm?
+      url "{base}/{linux_arm_filename}"
+      sha256 "{linux_arm_sha}"
+    else
+      url "{base}/{linux_x64_filename}"
+      sha256 "{linux_x64_sha}"
+    end
+  end
+
+  def install
+    # Find the extracted directory (should be perl-lsp-v*).
+    extracted_dir = Dir.glob("perl-lsp-v*").first
+    if extracted_dir && File.directory?(extracted_dir)
+      bin.install "#{{extracted_dir}}/perl-lsp"
+    else
+      # Fallback: binary might be in the root
+      bin.install "perl-lsp"
+    end
+  end
+
+  def caveats
+    <<~EOS
+      To use perl-lsp with your editor:
+
+      VS Code:
+        Install the "Perl Language Server" extension from the marketplace
+
+      Neovim (with lspconfig):
+        require('lspconfig').perl_lsp.setup{{
+          cmd = {{'#{{opt_bin}}/perl-lsp', '--stdio'}}
+        }}
+
+      Emacs (with lsp-mode):
+        (lsp-register-client
+         (make-lsp-client :new-connection (lsp-stdio-connection '#{{opt_bin}}/perl-lsp' "--stdio")
+                          :activation-fn (lsp-activate-on "perl")
+                          :server-id 'perl-lsp))
+    EOS
+  end
+
+  test do
+    # Test that the binary runs and responds to version request
+    assert_match(/perl-lsp|Perl LSP/, shell_output("#{{bin}}/perl-lsp --version"))
+
+    # Test LSP initialization
+    input = '{{"jsonrpc":"2.0","id":1,"method":"initialize","params":{{}}}}'
+    output = pipe_output("#{{bin}}/perl-lsp --stdio", input, 0)
+    assert_match(/Content-Length/, output)
+  end
+end
+"##,
+        owner = config.owner,
+        repo = config.repo,
+        base = base,
+        version = version,
+        mac_arm_filename = mac_arm_filename,
+        mac_x64_filename = mac_x64_filename,
+        linux_arm_filename = linux_arm_filename,
+        linux_x64_filename = linux_x64_filename,
+        mac_arm_sha = checksums.mac_arm,
+        mac_x64_sha = checksums.mac_x64,
+        linux_arm_sha = checksums.linux_arm,
+        linux_x64_sha = checksums.linux_x64,
+    )
+}
+
+fn artifact_filename(prefix: &str, version: &str, artifact: &str) -> String {
+    format!("{prefix}-{version}-{artifact}")
+}
+
+fn write_formula(path: &std::path::Path, content: &str) -> Result<()> {
+    if let Some(parent) = path.parent() {
+        if !parent.as_os_str().is_empty() {
+            fs::create_dir_all(parent)
+                .with_context(|| format!("failed to create directory for {}", path.display()))?;
+        }
+    }
+
+    fs::write(path, format!("{content}\n"))
+        .with_context(|| format!("failed to write Homebrew formula to {}", path.display()))?;
+    println!("[homebrew] wrote {}", path.display());
+
+    Ok(())
+}
diff --git a/xtask/src/tasks/validate_workspace_exclusions.rs b/xtask/src/tasks/validate_workspace_exclusions.rs
new file mode 100644
index 0000000000..10737f3fbd
--- /dev/null
+++ b/xtask/src/tasks/validate_workspace_exclusions.rs
@@ -0,0 +1,378 @@
+//! Validate workspace exclusion strategy invariants.
+
+use crate::utils::project_root;
+use color_eyre::eyre::{Context, Result, bail, eyre};
+use regex::Regex;
+use serde::Deserialize;
+use std::collections::HashSet;
+use std::fs;
+use std::path::Path;
+use std::process::Command;
+use toml::Value;
+
+const REQUIRED_EXCLUDED_DIRECTORIES: &[&str] =
+    &["tree-sitter-perl", "crates/tree-sitter-perl-c", "fuzz"];
+const OPTIONAL_EXCLUDED_DIRECTORIES: &[&str] = &["archive"];
+const EXCLUDED_CRATES: &[&str] = &["tree-sitter-perl", "tree-sitter-perl-c", "perl-parser-fuzz"];
+const PROJECT_CARGO_TOML: &str = "Cargo.toml";
+
+#[derive(Deserialize)]
+struct Metadata {
+    workspace_members: Vec<String>,
+    packages: Vec<MetadataPackage>,
+}
+
+#[derive(Deserialize)]
+struct MetadataPackage {
+    id: String,
+    name: String,
+    manifest_path: String,
+}
+
+pub fn run() -> Result<()> {
+    let root = project_root()?;
+
+    println!("Validating workspace exclusion strategy...");
+    println!();
+
+    check_excluded_directories_exist(&root)?;
+    check_exclusion_documentation(&root)?;
+    check_workspace_dependencies(&root)?;
+    check_exclude_section(&root)?;
+    check_workspace_members(&root)?;
+    check_member_dependencies(&root)?;
+
+    println!("==========================================");
+    println!("✅ All workspace exclusion checks passed!");
+    println!("==========================================");
+    println!();
+    println!("Summary:");
+    println!("  - {} directories excluded from workspace", known_excluded_directories().count());
+    println!("  - Exclusion strategy clearly documented");
+    println!("  - No accidental dependencies on excluded crates");
+    println!("  - workspace.dependencies clean");
+
+    Ok(())
+}
+
+fn check_excluded_directories_exist(root: &Path) -> Result<()> {
+    println!("✓ Checking excluded directories exist...");
+
+    let missing = REQUIRED_EXCLUDED_DIRECTORIES
+        .iter()
+        .filter(|excluded| !root.join(excluded).exists())
+        .map(|excluded| excluded.to_string())
+        .collect::<Vec<_>>();
+
+    if !missing.is_empty() {
+        bail!("❌ ERROR: Excluded directories do not exist: {}", missing.join(", "));
+    }
+
+    println!("  All required excluded directories exist");
+    println!();
+    Ok(())
+}
+
+fn check_exclusion_documentation(root: &Path) -> Result<()> {
+    println!("✓ Checking exclusion documentation...");
+
+    let cargo_toml = root.join(PROJECT_CARGO_TOML);
+    let content = fs::read_to_string(&cargo_toml).with_context(|| {
+        format!("Failed to read workspace Cargo.toml at {}", cargo_toml.display())
+    })?;
+
+    if !content.contains("exclude = [") {
+        bail!("❌ ERROR: Exclusion strategy not documented in Cargo.toml");
+    }
+
+    println!("  Exclusion strategy is documented");
+    println!();
+    Ok(())
+}
+
+fn check_workspace_dependencies(root: &Path) -> Result<()> {
+    println!("✓ Checking workspace.dependencies...");
+
+    let cargo_toml = root.join(PROJECT_CARGO_TOML);
+    let content = fs::read_to_string(&cargo_toml).with_context(|| {
+        format!("Failed to read workspace Cargo.toml at {}", cargo_toml.display())
+    })?;
+    let manifest: Value =
+        toml::from_str(&content).context("Failed to parse workspace Cargo.toml")?;
+
+    let workspace_dependencies = manifest
+        .get("workspace")
+        .and_then(|workspace| workspace.get("dependencies"))
+        .and_then(Value::as_table);
+
+    if let Some(workspace_dependencies) = workspace_dependencies {
+        let excluded = excluded_set();
+        let offending = workspace_dependencies
+            .iter()
+            .filter_map(|(name, value)| {
+                if !excluded.contains(name.as_str()) {
+                    return None;
+                }
+
+                if name.as_str() == "tree-sitter-perl" {
+                    if value.as_table().and_then(|value| value.get("path")).and_then(Value::as_str)
+                        == Some("crates/tree-sitter-perl-rs")
+                    {
+                        return None;
+                    }
+                }
+
+                Some(name.as_str())
+            })
+            .collect::<Vec<_>>();
+
+        if !offending.is_empty() {
+            bail!("❌ ERROR: workspace.dependencies references excluded crates");
+        }
+    }
+
+    println!("  workspace.dependencies clean (no excluded crate references)");
+    println!();
+    Ok(())
+}
+
+fn check_exclude_section(root: &Path) -> Result<()> {
+    println!("✓ Checking exclude section...");
+
+    let cargo_toml = root.join(PROJECT_CARGO_TOML);
+    let content = fs::read_to_string(&cargo_toml).with_context(|| {
+        format!("Failed to read workspace Cargo.toml at {}", cargo_toml.display())
+    })?;
+    let manifest: Value =
+        toml::from_str(&content).context("Failed to parse workspace Cargo.toml")?;
+
+    let exclude_values = workspace_exclude_values(&manifest)?;
+    let missing = missing_required_excluded_directories(&exclude_values);
+
+    if !missing.is_empty() {
+        bail!("❌ ERROR: Excluded paths missing from [workspace].exclude: {}", missing.join(", "));
+    }
+
+    println!("  Required excluded paths are in [workspace].exclude");
+    println!();
+    Ok(())
+}
+
+fn check_workspace_members(root: &Path) -> Result<()> {
+    println!("✓ Checking workspace members don't include excluded crates...");
+
+    let metadata = load_cargo_metadata(root)?;
+    let offending = excluded_workspace_member_names(&metadata);
+    let member_count = metadata.workspace_members.len();
+
+    if !offending.is_empty() {
+        bail!("❌ ERROR: Excluded crates found in workspace members: {}", offending.join(", "));
+    }
+
+    println!("  Workspace has {} members (excluded crates not included)", member_count);
+    println!();
+    Ok(())
+}
+
+fn check_member_dependencies(root: &Path) -> Result<()> {
+    println!("✓ Checking for dependencies on excluded crates...");
+
+    let excluded = excluded_set();
+    let crate_pattern = format!(
+        r"(?m)^\s*({})\s*=",
+        excluded.iter().map(|entry| regex::escape(entry)).collect::<Vec<_>>().join("|")
+    );
+    let exclusion_re = Regex::new(&crate_pattern).context("Failed to compile dependency regex")?;
+
+    let mut offenders = Vec::new();
+    let crates_dir = root.join("crates");
+    for entry in fs::read_dir(&crates_dir).context("Unable to list crates directory")? {
+        let entry = entry?;
+        if !entry.file_type()?.is_dir() {
+            continue;
+        }
+
+        let manifest = entry.path().join("Cargo.toml");
+        if !manifest.exists() {
+            continue;
+        }
+
+        let crate_name =
+            entry.file_name().into_string().unwrap_or_else(|_| String::from("<invalid>"));
+        let content = fs::read_to_string(&manifest)
+            .with_context(|| format!("Failed to read {}", manifest.display()))?;
+
+        if has_excluded_dependency_reference(&content, &exclusion_re, &excluded) {
+            offenders.push(crate_name);
+        }
+    }
+
+    if !offenders.is_empty() {
+        bail!("❌ ERROR: Dependencies on excluded crates found in: {}", offenders.join(", "));
+    }
+
+    println!("  No workspace members depend on excluded crates");
+    println!();
+    Ok(())
+}
+
+fn has_excluded_dependency_reference(
+    manifest_content: &str,
+    pattern: &Regex,
+    excluded: &HashSet<&str>,
+) -> bool {
+    for line in manifest_content.lines() {
+        let trimmed = line.trim();
+        if trimmed.is_empty() || trimmed.starts_with('#') {
+            continue;
+        }
+
+        if pattern.is_match(trimmed) {
+            if let Some(capture) = pattern.captures(trimmed).and_then(|c| c.get(1)) {
+                if excluded.contains(capture.as_str()) {
+                    return true;
+                }
+            }
+        }
+    }
+
+    false
+}
+
+fn excluded_set() -> HashSet<&'static str> {
+    EXCLUDED_CRATES.iter().copied().collect()
+}
+
+fn known_excluded_directories() -> impl Iterator<Item = &'static str> {
+    REQUIRED_EXCLUDED_DIRECTORIES.iter().chain(OPTIONAL_EXCLUDED_DIRECTORIES.iter()).copied()
+}
+
+fn workspace_exclude_values<'a>(manifest: &'a Value) -> Result<Vec<&'a str>> {
+    let exclude = manifest
+        .get("workspace")
+        .and_then(|workspace| workspace.get("exclude"))
+        .and_then(Value::as_array)
+        .ok_or_else(|| eyre!("Workspace has no [workspace].exclude array"))?;
+
+    Ok(exclude.iter().filter_map(Value::as_str).collect())
+}
+
+fn missing_required_excluded_directories(exclude_values: &[&str]) -> Vec<String> {
+    REQUIRED_EXCLUDED_DIRECTORIES
+        .iter()
+        .filter(|entry| !exclude_values.contains(entry))
+        .map(|entry| entry.to_string())
+        .collect()
+}
+
+fn manifest_is_in_excluded_directory(manifest_path: &str) -> bool {
+    let manifest_dir =
+        Path::new(manifest_path).parent().unwrap_or_else(|| Path::new(manifest_path));
+
+    known_excluded_directories().any(|entry| manifest_dir.ends_with(entry))
+}
+
+fn excluded_workspace_member_names(metadata: &Metadata) -> Vec<String> {
+    let workspace_member_ids = metadata.workspace_members.iter().collect::<HashSet<_>>();
+
+    metadata
+        .packages
+        .iter()
+        .filter(|pkg| workspace_member_ids.contains(&pkg.id))
+        .filter(|pkg| manifest_is_in_excluded_directory(&pkg.manifest_path))
+        .map(|pkg| pkg.name.clone())
+        .collect()
+}
+
+fn load_cargo_metadata(root: &Path) -> Result<Metadata> {
+    let output = Command::new("cargo")
+        .current_dir(root)
+        .args(["metadata", "--format-version", "1", "--no-deps"])
+        .output()
+        .context("Failed to execute `cargo metadata`")?;
+
+    if !output.status.success() {
+        bail!("`cargo metadata` failed: {}", String::from_utf8_lossy(&output.stderr));
+    }
+
+    let stdout =
+        String::from_utf8(output.stdout).context("`cargo metadata` output was not valid UTF-8")?;
+    serde_json::from_str(&stdout).context("Failed to parse `cargo metadata` JSON")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn workspace_exclude_values_reads_workspace_table() -> Result<()> {
+        let manifest: Value = toml::from_str(
+            r#"
+exclude = ["wrong-root-level-entry"]
+
+[workspace]
+exclude = ["tree-sitter-perl", "crates/tree-sitter-perl-c", "fuzz"]
+"#,
+        )?;
+
+        let exclude = workspace_exclude_values(&manifest)?;
+
+        assert_eq!(exclude, vec!["tree-sitter-perl", "crates/tree-sitter-perl-c", "fuzz"]);
+        Ok(())
+    }
+
+    #[test]
+    fn missing_required_excluded_paths_ignores_optional_entries() {
+        let exclude_values = vec!["tree-sitter-perl", "crates/tree-sitter-perl-c", "fuzz"];
+
+        let missing = missing_required_excluded_directories(&exclude_values);
+
+        assert!(missing.is_empty());
+    }
+
+    #[test]
+    fn missing_required_excluded_paths_flags_missing_required_path() {
+        let exclude_values = vec!["tree-sitter-perl", "crates/tree-sitter-perl-c"];
+
+        let missing = missing_required_excluded_directories(&exclude_values);
+
+        assert_eq!(missing, vec!["fuzz".to_string()]);
+    }
+
+    #[test]
+    fn manifest_is_in_excluded_directory_uses_manifest_parent() -> Result<()> {
+        let manifest = Path::new("/repo/crates/tree-sitter-perl-c/Cargo.toml");
+        let manifest_dir =
+            manifest.parent().ok_or_else(|| eyre!("Expected manifest path to have a parent"))?;
+
+        assert!(manifest_dir.ends_with("crates/tree-sitter-perl-c"));
+        assert!(!manifest.ends_with("crates/tree-sitter-perl-c"));
+        assert!(manifest_is_in_excluded_directory("/repo/crates/tree-sitter-perl-c/Cargo.toml"));
+        Ok(())
+    }
+
+    #[test]
+    fn excluded_workspace_member_names_flags_members_by_manifest_directory() {
+        let excluded_id =
+            String::from("tree-sitter-perl-c 0.1.0 (path+file:///repo/crates/tree-sitter-perl-c)");
+        let metadata = Metadata {
+            workspace_members: vec![excluded_id.clone()],
+            packages: vec![
+                MetadataPackage {
+                    id: excluded_id,
+                    name: String::from("tree-sitter-perl-c"),
+                    manifest_path: String::from("/repo/crates/tree-sitter-perl-c/Cargo.toml"),
+                },
+                MetadataPackage {
+                    id: String::from("other 0.1.0 (path+file:///repo/crates/other)"),
+                    name: String::from("other"),
+                    manifest_path: String::from("/repo/crates/other/Cargo.toml"),
+                },
+            ],
+        };
+
+        let offending = excluded_workspace_member_names(&metadata);
+
+        assert_eq!(offending, vec!["tree-sitter-perl-c".to_string()]);
+    }
+}
diff --git a/xtask/src/tasks/worktrees.rs b/xtask/src/tasks/worktrees.rs
new file mode 100644
index 0000000000..9be0227e69
--- /dev/null
+++ b/xtask/src/tasks/worktrees.rs
@@ -0,0 +1,62 @@
+//! Worktree maintenance helpers used by local agent operations.
+
+use crate::utils::project_root;
+use color_eyre::eyre::{Result, bail, eyre};
+use std::process::{Command, Stdio};
+use std::str;
+
+/// Prune stale worktrees and remove entries under `.claude/worktrees`.
+pub fn cleanup() -> Result<()> {
+    let root = project_root()?;
+
+    let prune_status =
+        Command::new("git").current_dir(&root).args(["worktree", "prune"]).status()?;
+    if !prune_status.success() {
+        bail!("failed to prune git worktrees");
+    }
+
+    let list_output = Command::new("git")
+        .current_dir(&root)
+        .args(["worktree", "list"])
+        .stdout(Stdio::piped())
+        .output()?;
+    if !list_output.status.success() {
+        bail!("failed to list git worktrees");
+    }
+
+    let list = str::from_utf8(&list_output.stdout)?;
+    let stale = list
+        .lines()
+        .filter_map(|line| {
+            if line.contains(".claude/worktrees/") { line.split_whitespace().next() } else { None }
+        })
+        .collect::<Vec<_>>();
+
+    println!("Found {} agent worktrees", stale.len());
+
+    if stale.is_empty() {
+        println!("No stale worktrees to clean up");
+        return Ok(());
+    }
+
+    println!("=== Removing stale worktrees ===");
+    for worktree in stale {
+        println!("Removing: {}", worktree);
+        let remove_status = Command::new("git")
+            .current_dir(&root)
+            .args(["worktree", "remove", "--force", worktree])
+            .status()?;
+        if !remove_status.success() {
+            std::fs::remove_dir_all(worktree)?;
+        }
+    }
+
+    let final_prune_status =
+        Command::new("git").current_dir(&root).args(["worktree", "prune"]).status()?;
+    if !final_prune_status.success() {
+        bail!("failed to prune git worktrees after cleanup");
+    }
+
+    println!("Cleanup complete");
+    Ok(())
+}