@rig-c/create 0.0.0-stage → 1.0.1

package/src/amend.ts

@@ -0,0 +1,193 @@
+import { createHash } from 'node:crypto';
+import { writeFileSync } from 'node:fs';
+import { readFileSync, realpathSync } from './check-reads.ts';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+
+import { asArray, asString, collectSignoffs, isObject, type Finding } from './check.ts';
+import { readProject } from './feedback.ts';
+import { readVerbatim } from './record-input.ts';
+import { refuse, USAGE_EXIT } from './refusal.ts';
+import { newRefusals } from './refusal-baseline.ts';
+import { liveSignoff, type Reopen } from './reopen.ts';
+import { stageIndex, stageOfStep } from './stages.ts';
+import type { JsonObject } from './templates.ts';
+
+/** Fixed approval-kind → step-0 gap mapping. These are missing proofs, not inferred dependencies. */
+export const AMENDMENT_APPROVAL_GAPS: Readonly<Record<string, string>> = {
+  interview: 'G1',
+  'plan-approved': 'G2',
+  parts: 'G3',
+  'parts-review': 'G5',
+  'rigging-interview': 'G2',
+  rigging: 'G3',
+  'rig-review': 'G7',
+  'post-interview': 'G2',
+  post: 'G3',
+  'direction-review': 'G7',
+  accepted: 'G9',
+};
+
+export interface Amendment extends Reopen {
+  readonly index: number;
+  readonly target: JsonObject;
+}
+
+export interface AmendmentApproval {
+  readonly path: string;
+  readonly stage: string;
+  readonly checkpoint?: string;
+  readonly reason: string;
+  readonly gap?: string;
+}
+
+export interface AmendmentSummary {
+  readonly path: string;
+  readonly target: JsonObject;
+  readonly lapsed: AmendmentApproval[];
+  readonly upstream: AmendmentApproval[];
+  readonly keep_by_binding: AmendmentApproval[];
+}
+
+/** Future binding cards may populate this list with independently proved approvals. Ships empty. */
+export function keepByBinding(): AmendmentApproval[] {
+  return [];
+}
+
+/** Only well-formed human amendments can invalidate approvals. Historical bindings name recorded bytes. */
+export function collectAmendments(project: JsonObject, refusals: Finding[]): Amendment[] {
+  const out: Amendment[] = [];
+  const invalid = (code: string, path: string, why: string): void => {
+    refusals.push({ code, path, message: `${path}: ${why}; record a human amend with an artifact, its owning stage and new input hashes` });
+  };
+  if (project.amendments !== undefined && !Array.isArray(project.amendments)) {
+    invalid('AMENDMENT_MALFORMED', 'amendments', 'must be a list');
+    return out;
+  }
+  for (const [index, raw] of asArray(project.amendments).entries()) {
+    const path = `amendments[${index}]`;
+    if (!isObject(raw) || ['by', 'at', 'verbatim'].some(k => asString(raw[k]) === null)
+      || !(raw.by as string).trim() || !Number.isFinite(Date.parse(raw.at as string))
+      || (raw.source !== undefined && typeof raw.source !== 'string')) {
+      invalid('AMENDMENT_MALFORMED', path, 'needs by, a valid at, verbatim and optional text source');
+      continue;
+    }
+    if ((raw.by as string).trim().toLowerCase() === 'agent') {
+      invalid('SIGNOFF_NOT_HUMAN', path, 'signed by agent');
+      continue;
+    }
+    const target = raw.target;
+    if (!isObject(target) || !['part', 'config-field', 'motion-track', 'interview-answer'].includes(String(target.kind))
+      || typeof target.id !== 'string' || !target.id.trim() || typeof target.stage !== 'string'
+      || target.stage === 'accepted' || !Object.hasOwn(AMENDMENT_APPROVAL_GAPS, target.stage)) {
+      invalid('AMENDMENT_TARGET_INVALID', `${path}.target`, 'needs kind, non-empty artifact id and a non-terminal owning stage');
+      continue;
+    }
+    if (!Array.isArray(raw.changes) || raw.changes.length === 0 || raw.changes.some(c => !isObject(c)
+      || typeof c.path !== 'string' || !c.path.trim() || typeof c.sha256 !== 'string' || !/^[0-9a-f]{64}$/.test(c.sha256))
+      || new Set(raw.changes.map(c => (c as JsonObject).path)).size !== raw.changes.length) {
+      invalid('AMENDMENT_CHANGES_INVALID', `${path}.changes`, 'needs distinct new input paths and lowercase SHA-256 hashes');
+      continue;
+    }
+    out.push({ index, target, stage: target.stage, at: Date.parse(raw.at as string) });
+  }
+  return out;
+}
+
+/** Name each recorded approval act. Re-signatures remain separate acts in history. */
+export function amendmentSummaries(project: JsonObject, amendments: readonly Amendment[], events: readonly Reopen[]): AmendmentSummary[] {
+  const approvals = collectSignoffs(project, []).map(s => ({
+    path: `signoffs[${s.index}]`, stage: s.stage, at: s.at,
+    ...(s.checkpoint === null ? {} : { checkpoint: s.checkpoint }),
+  }));
+  for (const [vi, raw] of asArray(project.versions).entries()) {
+    if (!isObject(raw)) continue;
+    for (const [di, verdict] of asArray(raw.verdicts).entries()) {
+      if (!isObject(verdict) || verdict.verdict !== 'accepted' || typeof verdict.by !== 'string'
+        || verdict.by.toLowerCase() === 'agent' || !['rig-review', 'direction-review'].includes(String(verdict.review))) continue;
+      approvals.push({ path: `versions[${vi}].verdicts[${di}]`, stage: String(verdict.review), at: Date.parse(String(verdict.at)) });
+    }
+  }
+  return amendments.map(a => {
+    const lapsed: AmendmentApproval[] = [];
+    const upstream: AmendmentApproval[] = [];
+    for (const approval of approvals) {
+      if (approval.at > a.at || stageIndex(approval.stage) < 0) continue;
+      const named = { path: approval.path, stage: approval.stage, ...('checkpoint' in approval ? { checkpoint: approval.checkpoint } : {}) };
+      if (stageIndex(approval.stage) >= stageIndex(a.stage)) {
+        lapsed.push({ ...named, reason: 'no binding proves independence', gap: AMENDMENT_APPROVAL_GAPS[approval.stage] });
+      } else if (liveSignoff(events, approval.stage, approval.at)) {
+        upstream.push({ ...named, reason: 'stage precedes amended stage' });
+      }
+    }
+    return { path: `amendments[${a.index}]`, target: a.target, lapsed, upstream, keep_by_binding: keepByBinding() };
+  });
+}
+
+export const AMEND_HELP = `amend:
+  <stage> [<project dir>]  record a forward amendment, retaining project.stage
+  --kind <kind>           part, config-field, motion-track or interview-answer
+  --target <id>           artifact id, config pointer, track id or answer path
+  --change <file>         new input under the project, hashed by the writer (repeatable)
+  --by <who>              human signer (agent is refused)
+  --verbatim-file <file>  unchanged UTF-8 words, or - for stdin (default)
+  --source <text>         optional origin, separate from verbatim
+  --json                  print the amendment record
+  The clock supplies at. The owning stage and every later approval lapse.
+  Upstream steps keep their state. keep-by-binding ships empty.`;
+
+export function amendCommand(args: string[], now: number): { stdout: string; exit: number } {
+  const opts: Record<string, string> = {};
+  const positional: string[] = [];
+  const files: string[] = [];
+  let json = false;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i] as string;
+    if (arg === '--json') json = true;
+    else if (['--kind', '--target', '--change', '--by', '--verbatim-file', '--source'].includes(arg)) {
+      const value = args[++i];
+      if (value === undefined || !value.trim() || (arg !== '--change' && arg in opts)) refuse('AMENDMENT_OPTION_INVALID', `amendments: ${arg} needs one non-empty value; see amend help`, USAGE_EXIT);
+      if (arg === '--change') files.push(value);
+      else opts[arg] = value;
+    } else if (arg.startsWith('-')) refuse('UNKNOWN_OPTION', `amendments: unsupported ${arg}; see amend help`, USAGE_EXIT);
+    else positional.push(arg);
+  }
+  if (positional.length < 1 || positional.length > 2 || opts['--by'] === undefined || opts['--kind'] === undefined || opts['--target'] === undefined || files.length === 0) {
+    refuse('AMENDMENT_OPTION_INVALID', 'amendments: supply an owning stage, --kind, --target, --change and --by; see amend help', USAGE_EXIT);
+  }
+  const dir = resolve(positional[1] ?? process.cwd());
+  const { file, project } = readProject(dir);
+  const before = structuredClone(project);
+  const errors: Finding[] = [];
+  collectAmendments(project, errors);
+  if (errors[0] !== undefined) refuse(errors[0].code, errors[0].message);
+  const entry: JsonObject = {
+    target: { stage: positional[0] as string, kind: opts['--kind'], id: opts['--target'] },
+    by: opts['--by'], at: new Date(now).toISOString(), verbatim: '', changes: [],
+  };
+  if (opts['--source'] !== undefined) entry.source = opts['--source'];
+  // Check signer and target before reading stdin or any input file.
+  entry.changes = files.map(path => ({ path, sha256: '0'.repeat(64) }));
+  const entryErrors: Finding[] = [];
+  collectAmendments({ amendments: [entry] }, entryErrors);
+  if (entryErrors[0] !== undefined) refuse(entryErrors[0].code, entryErrors[0].message);
+  entry.changes = files.map(path => {
+    try {
+      const canonical = realpathSync(resolve(dir, path));
+      const local = relative(realpathSync(dir), canonical).split(sep).join('/');
+      if (isAbsolute(path) || local === '' || local === '..' || local.startsWith('../')) throw new Error('new inputs must stay under the project');
+      return { path: local, sha256: createHash('sha256').update(readFileSync(canonical)).digest('hex') };
+    } catch (error) {
+      refuse('AMENDMENT_INPUT_UNREAD', `amendments.changes ${path}: ${error instanceof Error ? error.message : String(error)}; retain the new input under the project and amend again`);
+    }
+  });
+  entry.verbatim = readVerbatim(opts['--verbatim-file'] ?? '-');
+  project.amendments = [...asArray(project.amendments), entry];
+  for (const raw of asArray(isObject(project.plan) ? project.plan.steps : undefined)) {
+    if (isObject(raw) && typeof raw.id === 'string' && (raw.phase === 'rig' || raw.phase === 'post')
+      && stageIndex(stageOfStep(raw.phase, raw.id)) >= stageIndex(positional[0] as string)) raw.status = 'pending';
+  }
+  const rejected = newRefusals(dir, before, project, { now })[0];
+  if (rejected !== undefined) refuse(rejected.code, rejected.message);
+  writeFileSync(file, `${JSON.stringify(project, null, 2)}\n`);
+  return { stdout: json ? JSON.stringify(entry, null, 2) : `amend: ${String(positional[0])} ${String(opts['--target'])} by ${String(entry.by)} at ${String(entry.at)}; stage retained`, exit: 0 };
+}

package/src/applied-review.ts

@@ -0,0 +1,104 @@
+import { retainedReviewRead, reviewReadLegacy, reviewSessionSource, selectedReviewFeedback, ReviewReadError } from './review-read.ts';
+import { configInputsLegacy } from './config-inputs.ts';
+/** A retained review Apply and the create version made from it (create#65). */
+import { isAbsolute, relative, resolve, sep, posix } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+
+import type { Json } from './templates.ts';
+import { asArray, isObject, type Ctx } from './check.ts';
+import { reviewConfigInputs, reviewHandoffInputs } from './review-package.ts';
+
+export const APPLIED_REVIEW_SINCE = '2026-11-06T00:00:00Z';
+const hex = (value: unknown): value is string => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+const inside = (root: string, path: string): boolean => {
+  const rel = relative(root, path);
+  return rel !== '' && rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+};
+
+/** Missing old declarations warn, while an explicit null records a build made without feedback. */
+export function checkAppliedReview(ctx: Pick<Ctx, 'dir' | 'project' | 'refusals' | 'warnings'>): void {
+  const versions = asArray(ctx.project.versions).filter(isObject);
+  for (const version of versions) {
+    if (version.pre_interview === true || !Number.isSafeInteger(version.n)) continue;
+    const path = `versions[v${String(version.n)}].review_origin`;
+    const push = (code: string, message: string): void => { ctx.refusals.push({ code, path, message: `${path}: ${message}` }); };
+    const record = version.review_origin;
+    if (record === undefined) {
+      const at = typeof version.at === 'string' ? Date.parse(version.at) : Number.NaN;
+      const legacy = !Number.isFinite(at) || at < Date.parse(APPLIED_REVIEW_SINCE);
+      const finding = { code: legacy ? 'APPLIED_REVIEW_LEGACY' : 'APPLIED_REVIEW_MISSING', path, message: `${path}: declare null for a build made without feedback, or { feedback: {path, sha256}, source_version, feedback_id, applied }; records before ${APPLIED_REVIEW_SINCE} retain their old contract` };
+      (legacy ? ctx.warnings : ctx.refusals).push(finding);
+      continue;
+    }
+    if (record === null) continue;
+    if (isObject(record) && record.review_read === undefined && reviewReadLegacy(version.at)) {
+      ctx.warnings.push({ code: 'REVIEW_READ_LEGACY', path, message: `${path}: historical applied review has no CLI response receipt; preserve history and query new results through rig-review feedback --format json` });
+      continue;
+    }
+    if (!isObject(record) || !isObject(record.feedback) || typeof record.feedback.path !== 'string'
+      || isAbsolute(record.feedback.path) || !inside(resolve(ctx.dir), resolve(ctx.dir, record.feedback.path))
+      || !hex(record.feedback.sha256) || !Number.isSafeInteger(record.source_version)
+      || typeof record.feedback_id !== 'string' || !record.feedback_id.trim() || !isObject(record.applied)
+      || typeof record.applied.schema !== 'string' || !record.applied.schema.startsWith('rig-review-applied/')
+      || !hex(record.applied.configHash) || !hex(record.applied.modelHash)) {
+      push('APPLIED_REVIEW_MALFORMED', 'expected feedback {project-relative path, sha256}, source_version, feedback_id and the complete context.applied object');
+      continue;
+    }
+    const earlier = versions.filter((v) => v.kind === version.kind && typeof v.n === 'number' && v.n < (version.n as number));
+    const source = earlier.reduce<(typeof versions)[number] | undefined>((latest, v) => latest === undefined || (v.n as number) > (latest.n as number) ? v : latest, undefined);
+    if (source === undefined || source.n !== record.source_version || versions.filter((v) => v.n === record.source_version).length !== 1) {
+      push('APPLIED_REVIEW_SOURCE', 'source_version must name the immediately preceding version of the same kind, without skipping a link');
+      continue;
+    }
+    let feedback: Json;
+    try {
+      feedback = retainedReviewRead(ctx.dir,record.review_read,record.feedback);
+    } catch (error) {
+      push(error instanceof ReviewReadError ? error.code : 'APPLIED_REVIEW_FILE', error instanceof Error ? error.message : String(error));
+      continue;
+    }
+    const reviewed = isObject(feedback) ? reviewSessionSource(feedback) : null;
+    if (!isObject(feedback) || reviewed === null
+      || feedback.schema === 'rig-review-session/1' && !Array.isArray(feedback.feedback)) {
+      push('APPLIED_REVIEW_FILE', 'expected the single-build JSON written by rig-review feedback');
+      continue;
+    }
+    const pkg = source.review_package;
+    const handoff = isObject(reviewed.handoff) ? reviewed.handoff : null;
+    const files = isObject(pkg) ? asArray(pkg.files) : [];
+    const fileHash = (name: string): Json | undefined => files.find((f) => isObject(f) && f.path === name);
+    const model = fileHash('out/check/build/skeleton.model.json');
+    let inputs: ReturnType<typeof reviewHandoffInputs> = [];
+    let named: ReturnType<typeof reviewConfigInputs> = [];
+    try {
+      if (isObject(pkg)) {
+        const issue = (reason: string, at: unknown): void => {
+          if (!configInputsLegacy(at)) throw new Error(reason);
+          ctx.warnings.push({ code: 'APPLIED_REVIEW_SOURCE', path, message: `${path}: ${reason}; preserve history and include the config inputs on the next build` });
+        };
+        named = reviewConfigInputs(pkg, ctx.dir, Number(source.n), name => issue(`config-named input ${name} is missing from source package`, source.at), error => issue(error.message, version.at));
+        inputs = reviewHandoffInputs(pkg, ctx.dir, Number(source.n), named);
+      }
+    } catch (error) { push('APPLIED_REVIEW_SOURCE', `${error instanceof Error ? error.message : String(error)}; restore the source config and its named input bindings`); continue; }
+    const handoffFiles = isObject(handoff) ? asArray(handoff.files) : [];
+    const missingNamed = named.filter(input => hex(input.sha256) && !handoffFiles.some(f => isObject(f) && typeof f.path === 'string' && posix.normalize(`out/check/${f.path}`) === input.path));
+    if (missingNamed.length && configInputsLegacy(version.at)) ctx.warnings.push({ code: 'APPLIED_REVIEW_SOURCE', path, message: `${path}: legacy handoff omits config-named inputs ${missingNamed.map(f => f.path).join(', ')}; preserve history and include them in the next rebuild` });
+    const requiredInputs = inputs.filter(f => !named.some(n => n.path === f.path && (!hex(n.sha256) || configInputsLegacy(version.at))));
+    const boundInputs = requiredInputs.every((input) => isObject(input) && handoffFiles.some((f) => isObject(f)
+      && typeof f.path === 'string' && posix.normalize(`out/check/${f.path}`) === input.path && f.sha256 === input.sha256));
+    if (!isObject(pkg) || !isObject(pkg.config) || !isObject(handoff?.config)
+      || handoff.config.sha256 !== pkg.config.sha256 || record.applied.configHash !== pkg.config.sha256
+      || !isObject(model) || !isObject(reviewed.rig) || reviewed.rig.path !== 'build/skeleton.model.json'
+      || reviewed.rig.sha256 !== model.sha256 || reviewed.motion !== null || !boundInputs
+      || !handoffFiles.every(f => isObject(f) && typeof f.path === 'string' && inputs.some(input => hex(input.sha256) && posix.normalize(`out/check/${f.path}`) === input.path && f.sha256 === input.sha256)) || new Set(handoffFiles.map(f => isObject(f) ? f.path : null)).size !== handoffFiles.length || asArray(handoff.missing).length !== 0) {
+      push('APPLIED_REVIEW_SOURCE', `feedback handoff inputs and inspected compiled model must match the source version package${named.length ? `; config-named inputs ${named.map(f => f.path).join(', ')} must carry their bound hashes` : ''}; include the source config inputs when rebuilding`);
+      continue;
+    }
+    const items = selectedReviewFeedback(feedback, record.feedback_id as string);
+    const item = items[0];
+    if (items.length !== 1 || !isObject(item) || !isObject(item.context) || !isObject(item.context.applied)
+      || !isDeepStrictEqual(record.applied, item.context.applied)) {
+      push('APPLIED_REVIEW_RESULT', 'feedback_id must select exactly one feedback item with the same non-null context.applied');
+    }
+  }
+}

package/src/ask-coverage.ts

@@ -0,0 +1,69 @@
+import { asArray, isDecision, isObject, type Ctx } from './check.ts';
+import { assembleAnswer, checkAssembleAnswers, PROJECTION_ASKS_SINCE } from './assemble-answers.ts';
+import { approvalStageOfGuide, hasStageOrder } from './stages.ts';
+import { WAYPOINT_ASKS } from './waypoints.ts';
+
+/** Independent of other contract dates; read the resolved guide's own at. */
+export const ASK_COVERAGE_SINCE = '2026-11-05T00:00:00Z';
+
+export function checkAskCoverage(ctx: Ctx): void {
+  const assemble = checkAssembleAnswers(ctx);
+  const rigType = ctx.items.find((item) => item.id === 'rig_type')?.state;
+  const rigValue = rigType?.state === 'user' ? rigType.answer.value
+    : rigType?.state === 'delegated' && isObject(rigType.answer.agent_decision) ? rigType.answer.agent_decision.value : null;
+  for (const item of ctx.items) {
+    if (item.kind !== 'waypoint' || (item.state.state !== 'user' && item.state.state !== 'delegated')) continue;
+    const answer = item.state.answer;
+    const asks = WAYPOINT_ASKS[item.id]?.filter((ask) => (ask.id !== 'ground' || item.id !== 'assemble' || assemble.visible)
+      && (ask.required_for === undefined || (ask.required_for === 'fullscreen.game_logic' ? rigValue === 'fullscreen.game_logic' : rigValue !== 'fullscreen.game_logic')));
+    if (asks === undefined) continue;
+    const path = `${item.path}.asks`;
+    if (!('asks' in answer)) {
+      const at = typeof answer.at === 'string' ? Date.parse(answer.at) : Number.NaN;
+      const legacy = !Number.isFinite(at) || at < Date.parse(ASK_COVERAGE_SINCE);
+      if (legacy) {
+        ctx.warnings.push({ code: 'GUIDE_ASKS_LEGACY', path, message: `${path}: no per-ask record; guide predates ${ASK_COVERAGE_SINCE} or has no readable at; preserve the legacy answer` });
+        continue;
+      }
+    }
+    const entries = asArray(answer.asks);
+    const ids = new Set(asks.map((ask) => ask.id));
+    const seen = new Set<string>();
+    let malformed = !Array.isArray(answer.asks) && 'asks' in answer;
+    for (const entry of entries) {
+      if (!isObject(entry) || typeof entry.id !== 'string' || (!ids.has(entry.id) && !(isObject(answer.choice) && item.id === 'assemble' && entry.id === 'ground')) || seen.has(entry.id)
+        || (entry.state !== 'user' && entry.state !== 'delegated' && !(isObject(answer.choice) && entry.state === 'other-pending'))
+        || (entry.state === 'user' && item.state.state !== 'user')) {
+        malformed = true;
+        continue;
+      }
+      seen.add(entry.id);
+    }
+    if (malformed) ctx.refusals.push({ code: 'GUIDE_ASKS_MALFORMED', path, message: `${path}: use one { id, state: 'user' | 'delegated' } per applicable ask, with known, unique ids; a full delegation cannot claim user answers` });
+    for (const ask of asks) {
+      const projectionAsk = item.id === 'assemble' && (ask.id === 'projection' || ask.id === 'ground');
+      if (projectionAsk && assemble.legacy && !seen.has(ask.id)) {
+        ctx.warnings.push({ code: 'GUIDE_ASKS_LEGACY', path: `${path}[${ask.id}]`, message: `${item.id}: '${ask.id}' predates ${PROJECTION_ASKS_SINCE}; preserve the old guide and ask when it is next revised` });
+        continue;
+      }
+      const value = projectionAsk ? assembleAnswer(answer, ask.id === 'projection' ? 'project' : 'ground') : undefined;
+      const valid = !projectionAsk || (ask.id === 'projection' ? value === 'core' || value === 'visible' : value === 'plain' || value === 'busy');
+      const pending = isObject(answer.choice) && entries.some(e => isObject(e) && (e.state === 'other-pending' || (e.id === ask.id && e.state === 'delegated' && !isDecision(answer.agent_decision))));
+      if (!seen.has(ask.id) || (!valid && !pending)) ctx.refusals.push({ code: 'GUIDE_ASK_UNANSWERED', path: `${path}[${ask.id}]`, message: `${item.id}: unanswered ask '${ask.id}': ${ask.text} Record its user answer or explicit delegation.` });
+    }
+    const partialDelegation = item.state.state === 'user' && entries.some((entry) => isObject(entry) && entry.state === 'delegated');
+    if (partialDelegation) {
+      const decision = answer.agent_decision;
+      if (!isObject(decision) || typeof decision.covers !== 'string' || decision.covers.trim() === '') {
+        if (!ctx.refusals.some((finding) => finding.code === 'GUIDE_PARTIAL_UNMARKED' && finding.path === item.path)) {
+          ctx.refusals.push({ code: 'GUIDE_PARTIAL_UNMARKED', path: item.path, message: `${item.path}: delegated asks need agent_decision.covers naming the remainder` });
+        }
+      }
+      const approved = ctx.signoffs.some((signoff) => signoff.stage === approvalStageOfGuide(item.id, false, hasStageOrder(ctx.project)) && signoff.checkpoint === null);
+      if (approved && !isDecision(decision)
+        && !ctx.refusals.some((finding) => finding.code === 'DELEGATION_UNDECIDED' && finding.path === item.path)) {
+        ctx.refusals.push({ code: 'DELEGATION_UNDECIDED', path: item.path, message: `${item.path}: delegated asks need agent_decision.value and reasoning before plan approval` });
+      }
+    }
+  }
+}

package/src/assemble-answers.ts

@@ -0,0 +1,53 @@
+import { existsSync } from './check-reads.ts';
+import { join, resolve } from 'node:path';
+
+import { asArray, asString, isObject, itemFor, type Ctx } from './check.ts';
+import { readObject } from './cg-gates.ts';
+import type { Json, JsonObject } from './templates.ts';
+
+/** New asks apply to guides made under the new contract. */
+export const PROJECTION_ASKS_SINCE = '2026-11-06T00:00:00Z';
+
+/** A partial delegation can decide either field beside the user's own value. */
+export function assembleAnswer(answer: JsonObject, field: 'project' | 'ground'): Json | undefined {
+  const entry = asArray(answer.asks).find((raw) => isObject(raw) && raw.id === (field === 'project' ? 'projection' : 'ground'));
+  if (!isObject(entry)) return undefined;
+  const value = entry.state === 'user' ? answer.value
+    : entry.state === 'delegated' && isObject(answer.agent_decision) ? answer.agent_decision.value : undefined;
+  return isObject(value) ? value[field] : undefined;
+}
+
+/** Read the current config and retained version configs with the existing hash/path checks. */
+export function checkAssembleAnswers(ctx: Ctx): { visible: boolean; legacy: boolean } {
+  const item = itemFor(ctx, 'assemble');
+  const state = item?.state;
+  const answer = state?.state === 'user' || state?.state === 'delegated' ? state.answer : {};
+  const at = typeof answer.at === 'string' ? Date.parse(answer.at) : Number.NaN;
+  const legacy = !Number.isFinite(at) || at < Date.parse(PROJECTION_ASKS_SINCE);
+  let visible = assembleAnswer(answer, 'project') === 'visible';
+  const configs: { path: string; sha: string | null; at: string }[] = [];
+  if (existsSync(join(ctx.dir, 'config.json'))) configs.push({ path: 'config.json', sha: null, at: 'config.json' });
+  asArray(ctx.project.versions).forEach((raw, i) => {
+    if (!isObject(raw) || raw.kind !== 'rig' || !isObject(raw.provenance) || !isObject(raw.provenance.config)) return;
+    const config = raw.provenance.config;
+    const path = asString(config.path);
+    if (path !== null) configs.push({ path, sha: asString(config.sha256), at: `versions[${typeof raw.n === 'number' ? `v${raw.n}` : i}].provenance.config` });
+  });
+  for (const config of configs) {
+    const read = readObject(ctx.dir, resolve(ctx.dir, config.path), config.sha);
+    // Missing retained files already have provenance checks; this check introduces no new core refusal.
+    if (!read.ok) continue;
+    const assemble = isObject(read.value.assemble) ? read.value.assemble : {};
+    if (assemble.project !== 'visible') continue;
+    visible = true;
+    const ground = assembleAnswer(answer, 'ground');
+    const pendingChoice = isObject(answer.choice) && asArray(answer.asks).some(a => isObject(a) && a.state === 'other-pending');
+    const decision = isObject(answer.agent_decision) ? answer.agent_decision : {};
+    const pendingGround = isObject(answer.choice)
+      && asArray(answer.asks).some(a => isObject(a) && a.id === 'ground' && a.state === 'delegated')
+      && !asArray(decision.fragments).some(f => isObject(f) && f.ask === 'ground');
+    if (legacy || pendingChoice || pendingGround || ground === 'plain' || ground === 'busy') continue;
+    ctx.refusals.push({ code: 'ASSEMBLE_GROUND_UNANSWERED', path: `${config.at} assemble.ground`, message: `${config.path}: assemble.project is visible with no ground answer; ask plain or busy, record the assemble guide's ground ask and value (or explicit decided delegation), then write assemble.ground in the config.` });
+  }
+  return { visible, legacy };
+}

package/src/cg-gates.ts

@@ -0,0 +1,211 @@
+/**
+ * The CG gates (docs/CHECKS.md § CG gates): a rig version of a full-screen
+ * scene (an illustration CG brought to life, `rig_type` `fullscreen.*`) is held
+ * to the three opt-in `@rig-c/parts` gates that measure what a CG build is for —
+ * every part's pixels trace to the split or to a receipted edit, no seam shows
+ * background in motion, no part boundary carries a colour step the pieces do
+ * not have:
+ *
+ * - `assemble.editor_receipts.trace_parts: true` in the version's config;
+ * - `seam_over_motion.required: true` and
+ * - `boundary_colour.max_step_excess` (an integer, at most
+ *   {@link CG_BOUNDARY_ALLOWANCE}) in the requirements file the config names
+ *   as `requirements`, so `rig-parts build` runs both from the config alone.
+ *
+ * create writes no config: the agent does. So the declarations are not
+ * written here; this check refuses, by name, a CG version whose config does
+ * not carry them, the same for every CG project. It reads the files; what the
+ * gates measure is parts' (`rig-parts build` / `check`), not create's.
+ *
+ * `rig_type` is also checked against the values docs/INTERVIEW.md lists, since
+ * a value outside them would decide nothing here and let a CG build through.
+ */
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from './check-reads.ts';
+import { dirname, relative, resolve, sep } from 'node:path';
+
+import { asString, isObject, itemFor, asArray, type Ctx } from './check.ts';
+import { validConfigLoss } from './pre-interview.ts';
+import type { Json, JsonObject } from './templates.ts';
+
+/** The `rig_type` values (docs/INTERVIEW.md § Framing). */
+export const RIG_TYPES: readonly string[] = ['character.idle', 'character.complex', 'character.monster', 'fullscreen.minimal', 'fullscreen.game_logic'];
+
+/** A `rig_type` with this prefix is a full-screen scene: create's notion of a CG build. */
+export const CG_RIG_TYPE_PREFIX = 'fullscreen.';
+
+/**
+ * The boundary colour allowance a CG version declares at most: parts' public
+ * examples read 1 to 4 clean and 21 and up planted (parts AUTHORING,
+ * *Boundary colour step*), and each declares 12. A lower value is stricter and
+ * allowed; a higher one is refused.
+ */
+export const CG_BOUNDARY_ALLOWANCE = 12;
+
+/** The first `@rig-c/parts` with all three gates (issues #969, #975, #976). A version built with an earlier one could not declare them. */
+export const CG_GATES_FROM_PARTS = '2.4.0';
+
+function versionLabel(v: JsonObject, index: number): string {
+  return typeof v.n === 'number' ? `versions[v${v.n}]` : `versions[${index}]`;
+}
+
+function semver(v: string): [number, number, number] | null {
+  const m = /^(\d+)\.(\d+)\.(\d+)$/.exec(v);
+  return m === null ? null : [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+
+function before(a: string, b: string): boolean {
+  const x = semver(a);
+  const y = semver(b);
+  if (x === null || y === null) return false;
+  for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return (x[i] as number) < (y[i] as number);
+  return false;
+}
+
+/** The answered `rig_type` value: the user's `value`, or the agent's decision on a delegation. */
+function rigTypeValue(ctx: Ctx): { value: Json | undefined; path: string } | null {
+  const item = itemFor(ctx, 'rig_type');
+  if (item === undefined) return null;
+  const s = item.state;
+  // A pending Other has no type yet; the choice gate refuses its interview/plan approval.
+  if (s.state === 'user' && s.answer.value === null && isObject(s.answer.choice) && asArray(s.answer.asks).some(a => isObject(a) && a.state === 'other-pending')) return null;
+  if (s.state === 'user') return { value: s.answer.value, path: item.path };
+  if (s.state === 'delegated' && s.decided && isObject(s.answer.agent_decision)) return { value: s.answer.agent_decision.value, path: item.path };
+  return null;
+}
+
+type Read = { ok: true; value: JsonObject; file: string } | { ok: false; why: string };
+
+function inside(dir: string, file: string): boolean {
+  const rel = relative(dir, file);
+  return rel !== '' && !rel.startsWith('..') && !rel.startsWith(sep);
+}
+
+export function readObject(dir: string, file: string, sha256: string | null): Read {
+  if (!inside(dir, file)) return { ok: false, why: `${relative(dir, file)} is not under the project` };
+  if (!existsSync(file)) return { ok: false, why: `${relative(dir, file)} is not there` };
+  let bytes: Buffer;
+  try {
+    bytes = readFileSync(file);
+  } catch {
+    return { ok: false, why: `${relative(dir, file)} cannot be read` };
+  }
+  if (sha256 !== null) {
+    const actual = createHash('sha256').update(bytes).digest('hex');
+    if (actual !== sha256) return { ok: false, why: `${relative(dir, file)} hashes to ${actual}, not the recorded ${sha256}` };
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(bytes.toString('utf8'));
+  } catch {
+    return { ok: false, why: `${relative(dir, file)} is not JSON` };
+  }
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) return { ok: false, why: `${relative(dir, file)} is not a JSON object` };
+  return { ok: true, value: parsed as JsonObject, file };
+}
+
+/** Refuses an unknown `rig_type` and, on a CG project, every rig version whose config does not declare the three gates. */
+export function checkCgGates(ctx: Ctx, recordOnly = false): void {
+  const rigType = rigTypeValue(ctx);
+  if (rigType === null) return; // unanswered or not applicable: reported by the answer checks
+  if (typeof rigType.value !== 'string' || !RIG_TYPES.includes(rigType.value)) {
+    ctx.refusals.push({
+      code: 'RIG_TYPE_UNKNOWN',
+      path: rigType.path,
+      message: `${rigType.path}: value ${JSON.stringify(rigType.value ?? null)} is none of ${RIG_TYPES.join(', ')}; the value decides which prompts apply and whether the build is a CG (fullscreen.*), so a value outside the list decides nothing`,
+    });
+    return;
+  }
+  // The answer domain belongs to record asks; build declarations do not.
+  if (recordOnly || !rigType.value.startsWith(CG_RIG_TYPE_PREFIX)) return;
+
+  asArray(ctx.project.versions).forEach((v, index) => {
+    if (!isObject(v) || v.kind !== 'rig') return;
+    const label = versionLabel(v, index);
+    const configLost = validConfigLoss(v);
+    if (configLost) {
+      ctx.warnings.push({
+        code: 'CG_GATES_CONFIG_LOST',
+        path: `${label}.config_lost`,
+        message: `${label}.config_lost: the historical config was lost, so its CG gates cannot be read; preserve the note and source, and build and accept a new rig with its retained config before post work`,
+      });
+    }
+    const builtWith = isObject(v.built_with) ? asString(v.built_with['@rig-c/parts']) : null;
+    if (builtWith !== null && before(builtWith, CG_GATES_FROM_PARTS)) {
+      ctx.warnings.push({
+        code: 'CG_GATES_PREDATE',
+        path: `${label}.built_with`,
+        message: `${label}: built with @rig-c/parts ${builtWith}, before the CG gates (${CG_GATES_FROM_PARTS}); it is not held to them, and the next CG version declares them`,
+      });
+      return;
+    }
+    if (configLost) return;
+    const prov = isObject(v.provenance) ? v.provenance : {};
+    const config = isObject(prov.config) ? prov.config : {};
+    const configPath = asString(config.path);
+    const at = `${label}.provenance.config`;
+    if (configPath === null) {
+      // A migrated pre-interview version without provenance.config is what `version config-lost` accepts (src/config-lost.ts).
+      const lost = v.pre_interview === true && (prov.config === null || prov.config === undefined)
+        ? `; if this pre-interview version's config did not survive, record the loss with rig-create version config-lost ${String(v.n)} --note <text> --source <text>` : '';
+      ctx.refusals.push({ code: 'CG_GATES_UNREAD', path: at, message: `${at}: no path; a CG version's gates are read from the config it was built from — keep it under the project and record its path and sha256${lost}` });
+      return;
+    }
+    const configSha = asString(config.sha256);
+    if (configSha === null || configSha === '') {
+      ctx.refusals.push({ code: 'CG_GATES_UNREAD', path: at, message: `${at}: no sha256; a CG version's gates are read from the config it was built from, verified by its recorded hash — record the config's sha256` });
+      return;
+    }
+    const cfg = readObject(ctx.dir, resolve(ctx.dir, configPath), configSha);
+    if (!cfg.ok) {
+      ctx.refusals.push({ code: 'CG_GATES_UNREAD', path: at, message: `${at}: ${cfg.why}; a CG version's gates are read from the config it was built from — keep it in evidence/v<N>/ (in git; outputs/ is ignored) at the recorded path and sha256` });
+      return;
+    }
+    const assemble = isObject(cfg.value.assemble) ? cfg.value.assemble : {};
+    const receipts = isObject(assemble.editor_receipts) ? assemble.editor_receipts : {};
+    if (receipts.trace_parts !== true) {
+      ctx.refusals.push({
+        code: 'CG_GATE_UNDECLARED',
+        path: `${at} assemble.editor_receipts.trace_parts`,
+        message: `${label}: ${configPath} does not declare assemble.editor_receipts.trace_parts: true; a CG build's every part traces to a layer of the split or a receipted edit (parts ASSEMBLE_PART_SOURCE)`,
+      });
+    }
+    const reqPath = asString(cfg.value.requirements);
+    if (reqPath === null || reqPath === '') {
+      ctx.refusals.push({
+        code: 'CG_GATE_UNDECLARED',
+        path: `${at} requirements`,
+        message: `${label}: ${configPath} names no requirements file; a CG config names one (config.requirements) declaring seam_over_motion.required: true and boundary_colour.max_step_excess, so the build runs both gates from the config alone`,
+      });
+      return;
+    }
+    const req = readObject(ctx.dir, resolve(dirname(cfg.file), reqPath), null);
+    if (!req.ok) {
+      ctx.refusals.push({ code: 'CG_GATES_UNREAD', path: `${at} requirements`, message: `${label}: the requirements file ${reqPath} (from ${configPath}): ${req.why}` });
+      return;
+    }
+    const seam = isObject(req.value.seam_over_motion) ? req.value.seam_over_motion : {};
+    if (seam.required !== true) {
+      ctx.refusals.push({
+        code: 'CG_GATE_UNDECLARED',
+        path: `${at} requirements seam_over_motion.required`,
+        message: `${label}: ${reqPath} does not declare seam_over_motion.required: true; a CG build shows no background at any declared seam on any frame (parts CHECK_SEAM_OVER_MOTION_REQUIRED)`,
+      });
+    }
+    const colour = isObject(req.value.boundary_colour) ? req.value.boundary_colour : {};
+    const allowance = colour.max_step_excess;
+    if (typeof allowance !== 'number' || !Number.isInteger(allowance) || allowance < 0) {
+      ctx.refusals.push({
+        code: 'CG_GATE_UNDECLARED',
+        path: `${at} requirements boundary_colour.max_step_excess`,
+        message: `${label}: ${reqPath} does not declare boundary_colour.max_step_excess as an integer; a CG build declares at most ${CG_BOUNDARY_ALLOWANCE} (parts CHECK_BOUNDARY_COLOUR_STEP)`,
+      });
+    } else if (allowance > CG_BOUNDARY_ALLOWANCE) {
+      ctx.refusals.push({
+        code: 'CG_BOUNDARY_ALLOWANCE_RAISED',
+        path: `${at} requirements boundary_colour.max_step_excess`,
+        message: `${label}: ${reqPath} declares boundary_colour.max_step_excess ${allowance}; a CG build declares at most ${CG_BOUNDARY_ALLOWANCE} — a step over it is the art's to fix (the piece's image or mesh), not the allowance's`,
+      });
+    }
+  });
+}