nccgs 1.0.0

package/.claude/skills/build-live-game/references/remote-config.md

@@ -0,0 +1,96 @@
+# Remote Config Reference
+
+## Table of Contents
+
+- [Overview](#overview)
+- [How It Works](#how-it-works)
+- [FetchConfigsAsync API](#fetchconfigsasync-api)
+- [.rc File Format](#rc-file-format)
+- [Game Overrides](#game-overrides)
+- [Common Patterns](#common-patterns)
+- [Code Template -- Load JSON Config](#code-template--load-json-config)
+
+## Overview
+
+Server-side game configuration. Store game definitions (achievement lists, battle pass tiers, shop catalogs) as JSON entries updatable without a client build. Accessed via `RemoteConfigService.Instance`.
+
+- **Namespace:** `Unity.Services.RemoteConfig`
+- **Package:** `com.unity.remote-config`
+
+## How It Works
+
+- Configuration is stored as key-value entries in the Unity Dashboard or deployed via `.rc` files through the Deployment Window.
+- The client fetches all config at once using `FetchConfigsAsync`.
+- Values are strongly typed: `string`, `bool`, `int`, `float`, `long`, and `JSON`.
+
+## FetchConfigsAsync API
+
+```csharp
+struct UserAttributes {}
+struct AppAttributes {}
+var result = await RemoteConfigService.Instance.FetchConfigsAsync(
+    new UserAttributes(), new AppAttributes());
+// Access values:
+string val = result.config.GetString("key");
+int num = result.config.GetInt("key");
+bool flag = result.config.GetBool("key");
+// For JSON values:
+var token = result.config["key"]; // JToken
+var obj = token.ToObject<MyType>();
+```
+
+- `UserAttributes` and `AppAttributes` are empty structs unless you use Game Overrides (audience targeting).
+- Results are cached locally; subsequent calls return cached data unless you call with different attributes.
+
+## .rc File Format
+
+```json
+{
+  "$schema": "https://ugs-config-schemas.unity3d.com/v1/remote-config.schema.json",
+  "entries": {
+    "my_string_key": "hello",
+    "my_int_key": 42,
+    "my_json_key": { "nested": true }
+  },
+  "types": {
+    "my_json_key": "JSON"
+  }
+}
+```
+
+- **Create via:** Right-click in Project window > Assets > Create > Services > Remote Config
+- **Deploy via:** the Deployment Window (Services > Deployment)
+- The `types` block is needed only for JSON entries; `string`, `int`, `bool`, `float`, and `long` are auto-detected.
+
+## Game Overrides
+
+Game Overrides (via `com.unity.services.tooling`) override Remote Config values for specific player segments. Remote Config itself does not provide A/B testing -- Game Overrides layer on top of it.
+
+- Game Overrides are defined as `.ugo` files.
+- Used for A/B testing and audience targeting.
+- Configured in the Unity Dashboard or deployed via `.ugo` files through the Deployment Window.
+- When active, `FetchConfigsAsync` returns the overridden values automatically.
+
+## Common Patterns
+
+- **Game definitions** (achievements, battle pass tiers) stored as JSON arrays under a single key.
+- **Feature flags** stored as booleans for toggling game features server-side.
+- **Version-specific config** with server-side updates -- change game balance without shipping a new client build.
+
+## Code Template -- Load JSON Config
+
+```csharp
+using Unity.Services.RemoteConfig;
+using Newtonsoft.Json.Linq;
+
+struct UserAttributes {}
+struct AppAttributes {}
+
+async Task<List<T>> LoadJsonConfigAsync<T>(string key)
+{
+    var result = await RemoteConfigService.Instance.FetchConfigsAsync(
+        new UserAttributes(), new AppAttributes());
+    var token = result.config[key];
+    return token.ToObject<List<T>>();
+}
+```

package/.claude/skills/build-live-game/references/tooling.md

@@ -0,0 +1,431 @@
+# Tooling Reference
+
+## Table of Contents
+
+- [Overview](#overview)
+- [Access Control](#access-control)
+  - [`.ac` File Format](#ac-file-format)
+  - [URN Pattern Format](#urn-pattern-format)
+  - [URN Reference by Service](#urn-reference-by-service)
+  - [Recommended Pattern: Deny-All-Then-Allow](#recommended-pattern-deny-all-then-allow)
+- [Game Overrides](#game-overrides)
+  - [`.ugo` File Format](#ugo-file-format)
+- [Editor API Models](#editor-api-models)
+
+Editor-only package. Registers **Access Control** (`.ac`) and **Game Overrides** (`.ugo`) file types with the Deployment Window (`com.unity.services.deployment`).
+
+- **Package:** `com.unity.services.tooling`
+- **Namespace:** `Unity.Services.Tooling.Editor.AccessControl.Authoring.Core.Model` / `Unity.Services.Tooling.Editor.GameOverrides.Authoring.Core.Model`
+
+---
+
+## Overview
+
+Tooling provides two cloud resource file types deployed through the Deployment Window:
+
+| File Type | Extension | Purpose |
+|---|---|---|
+| Access Control | `.ac` | Permit or deny player/service-account access to UGS services on a URN basis |
+| Game Overrides | `.ugo` | A/B testing and audience targeting by overriding Remote Config values for player segments |
+
+Both file types are created via right-click in the Project window → **Create > Unity Gaming Services** and deployed via **Services > Deployment**.
+
+---
+
+## Access Control
+
+Access Control policies permit or deny access to UGS services on a **URN basis**. Each statement targets a resource URN pattern and applies a `Read`, `Write`, or `*` action for a principal (`Player` or `ServiceAccount`). **Deny takes precedence over Allow.**
+
+| Concept | Description |
+|---|---|
+| **Effect** | `"Allow"` or `"Deny"` — Deny takes precedence over Allow |
+| **Action** | `"Read"`, `"Write"`, or `"*"` (both) |
+| **Principal** | `"Player"` (end user) or `"ServiceAccount"` (server/admin) |
+| **Resource** | URN pattern — `urn:ugs:<service>:/<path>` with `*` and `**` wildcards |
+
+Common use cases:
+- Deny direct player writes to Cloud Save (force writes through Cloud Code)
+- Deny player currency/inventory writes in Economy (only allow purchases)
+- Restrict Cloud Code module/script invocation to specific endpoints
+- Deny player account deletion or identity unlinking
+
+### `.ac` File Format
+
+**Create via:** Right-click in Project window → **Create > Unity Gaming Services > Access Control**
+
+```json
+{
+  "$schema": "https://ugs-config-schemas.unity3d.com/v1/project-access-policy.schema.json",
+  "statements": [
+    {
+      "Sid": "DenyPlayerCloudSaveWrites",
+      "Effect": "Deny",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**"
+    }
+  ]
+}
+```
+
+| Field | Type | Description |
+|---|---|---|
+| `Sid` | `string` | Unique statement ID within the file |
+| `Effect` | `string` | `"Allow"` or `"Deny"` — Deny wins over Allow |
+| `Action` | `string` or `string[]` | `"Read"`, `"Write"`, or `"*"` (both) |
+| `Principal` | `string` or `string[]` | `"Player"` (end user) or `"ServiceAccount"` (server/admin) |
+| `Resource` | `string` or `string[]` | URN pattern — `urn:ugs:<service>:/<path>` |
+
+### URN Pattern Format
+
+```
+urn:ugs:<service>:/<path>
+```
+
+- `*` matches a single path segment
+- `**` matches zero or more path segments (including nested)
+- `/**/` is commonly used to skip environment/version segments in the URL
+
+### URN Reference by Service
+
+#### Authentication (`player-auth`)
+
+| URN Pattern | Description |
+|---|---|
+| `urn:ugs:player-auth:/*/authentication/anonymous**` | Anonymous sign-up |
+| `urn:ugs:player-auth:/*/authentication/external-token**` | External token sign-in (social, platform) |
+| `urn:ugs:player-auth:/*/authentication/session-token**` | Session token sign-in |
+| `urn:ugs:player-auth:/*/authentication/link/**` | Link external identity |
+| `urn:ugs:player-auth:/*/authentication/unlink/**` | Unlink external identity |
+| `urn:ugs:player-auth:/*/users**` | Player info (Read) / Delete player (Write) |
+| `urn:ugs:player-auth:/.well-known/**` | JWKS public keys |
+
+#### Cloud Save (`cloud-save`)
+
+| URN Pattern | Description |
+|---|---|
+| `urn:ugs:cloud-save:/**` | All Cloud Save (blanket) |
+| `urn:ugs:cloud-save:/**/players/*/keys**` | List player data keys |
+| `urn:ugs:cloud-save:/**/players/*/items**` | Read/write player data items (own data only) |
+| `urn:ugs:cloud-save:/**/players/*/item-batch**` | Batch write player data items |
+| `urn:ugs:cloud-save:/**/players/query**` | Query Default player data |
+| `urn:ugs:cloud-save:/**/players/*/public/keys**` | Read another player's public keys |
+| `urn:ugs:cloud-save:/**/players/*/public/items**` | Read another player's public items |
+| `urn:ugs:cloud-save:/**/players/public/query**` | Query Public player data |
+| `urn:ugs:cloud-save:/**/custom/*/items**` | Read game-wide (Custom) data items |
+
+#### Economy (`economy`)
+
+| URN Pattern | Description |
+|---|---|
+| `urn:ugs:economy:/**/players/*/config**` | Read player economy configuration |
+| `urn:ugs:economy:/**/currencies**` | Player currencies (Read/Write) |
+| `urn:ugs:economy:/**/inventory**` | Player inventory (Read/Write) |
+| `urn:ugs:economy:/**/purchases/virtual**` | Virtual purchases |
+| `urn:ugs:economy:/**/purchases/googleplaystore**` | Google Play Store purchases |
+| `urn:ugs:economy:/**/purchases/appleappstore**` | Apple App Store purchases |
+
+#### Leaderboards (`leaderboards`)
+
+| URN Pattern | Description |
+|---|---|
+| `urn:ugs:leaderboards:/**/leaderboards/**` | All leaderboard operations |
+
+#### Cloud Code (`cloud-code`)
+
+| URN Pattern | Description |
+|---|---|
+| `urn:ugs:cloud-code:/**/modules/**` | Cloud Code module endpoints |
+| `urn:ugs:cloud-code:/**/scripts/**` | Cloud Code scripts (legacy JS) |
+| `urn:ugs:cloud-code:/**/subscriptions/tokens/**` | Subscription tokens |
+
+### Recommended Pattern: Deny-All-Then-Allow
+
+Start with a blanket deny, then explicitly allow only what the player needs. This ensures new services are locked down by default.
+
+```json
+{
+  "$schema": "https://ugs-config-schemas.unity3d.com/v1/project-access-policy.schema.json",
+  "statements": [
+    {
+      "Sid": "Deny-all-ugs-access",
+      "Effect": "Deny",
+      "Action": ["*"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:*:/**"
+    },
+    {
+      "Sid": "Allow-Anonymous-SignUp",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:player-auth:/*/authentication/anonymous**"
+    },
+    {
+      "Sid": "Allow-External-Token-SignIn",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:player-auth:/*/authentication/external-token**"
+    },
+    {
+      "Sid": "Allow-Session-Token-SignIn",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:player-auth:/*/authentication/session-token**"
+    },
+    {
+      "Sid": "Allow-Link-External-Id",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:player-auth:/*/authentication/link/**"
+    },
+    {
+      "Sid": "Allow-Get-PlayerInfo",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:player-auth:/*/users**"
+    },
+    {
+      "Sid": "Allow-Get-JWKS",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:player-auth:/.well-known/**"
+    },
+    {
+      "Sid": "Allow-Read-Economy-Config",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:economy:/**/players/*/config**"
+    },
+    {
+      "Sid": "Allow-Read-Currencies",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:economy:/**/currencies**"
+    },
+    {
+      "Sid": "Allow-Read-Inventory",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:economy:/**/inventory**"
+    },
+    {
+      "Sid": "Allow-Virtual-Purchases",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:economy:/**/purchases/virtual**"
+    },
+    {
+      "Sid": "Allow-GooglePlay-Purchases",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:economy:/**/purchases/googleplaystore**"
+    },
+    {
+      "Sid": "Allow-AppStore-Purchases",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:economy:/**/purchases/appleappstore**"
+    },
+    {
+      "Sid": "Allow-Read-Leaderboards",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:leaderboards:/**/leaderboards/**"
+    },
+    {
+      "Sid": "Allow-Read-CloudSave-PlayerKeys",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**/players/*/keys**"
+    },
+    {
+      "Sid": "Allow-CloudSave-PlayerItems",
+      "Effect": "Allow",
+      "Action": ["*"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**/players/*/items**"
+    },
+    {
+      "Sid": "Allow-CloudSave-PlayerItemBatch",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**/players/*/item-batch**"
+    },
+    {
+      "Sid": "Allow-Query-Default-PlayerData",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**/players/query**"
+    },
+    {
+      "Sid": "Allow-Read-Public-PlayerKeys",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**/players/*/public/keys**"
+    },
+    {
+      "Sid": "Allow-Read-Public-PlayerItems",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**/players/*/public/items**"
+    },
+    {
+      "Sid": "Allow-Query-Public-PlayerData",
+      "Effect": "Allow",
+      "Action": ["Write"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**/players/public/query**"
+    },
+    {
+      "Sid": "Allow-Read-GameData",
+      "Effect": "Allow",
+      "Action": ["Read"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-save:/**/custom/*/items**"
+    },
+    {
+      "Sid": "Allow-CloudCode-Modules",
+      "Effect": "Allow",
+      "Action": ["*"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-code:/**/modules/**"
+    },
+    {
+      "Sid": "Allow-CloudCode-Scripts",
+      "Effect": "Allow",
+      "Action": ["*"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-code:/**/scripts/**"
+    },
+    {
+      "Sid": "Allow-Subscription-Tokens",
+      "Effect": "Allow",
+      "Action": ["*"],
+      "Principal": "Player",
+      "Resource": "urn:ugs:cloud-code:/**/subscriptions/tokens/**"
+    }
+  ]
+}
+```
+
+This policy:
+- **Denies** all UGS access by default
+- **Allows** authentication (anonymous, external, session token sign-in; link external ID; read player info)
+- **Denies** identity unlinking and player deletion (inherited from blanket deny)
+- **Allows** economy reads (config, currencies, inventory) and purchases (virtual, Google Play, Apple App Store)
+- **Denies** direct currency/inventory writes (inherited from blanket deny — use Cloud Code for server grants)
+- **Allows** leaderboard reads
+- **Allows** Cloud Save player data reads/writes for own data (Default items), public data reads, game-wide data reads
+- **Denies** Cloud Save blanket writes (Protected data only writable via Cloud Code)
+- **Allows** Cloud Code module, script, and subscription token access
+
+---
+
+## Game Overrides
+
+Game Overrides are the A/B testing and audience targeting mechanism for UGS. They override **Remote Config** values for specific player segments (audiences). Remote Config itself does not provide A/B testing — Game Overrides layer on top of it.
+
+Use cases:
+- A/B test different XP multipliers for player segments
+- Roll out features gradually to targeted audiences
+- Run time-limited promotions with different reward values
+
+### `.ugo` File Format
+
+**Create via:** Right-click in Project window → **Create > Unity Gaming Services > Game Override**
+
+```json
+{
+  "GameOverrides": [
+    {
+      "id": "double-xp-weekend",
+      "name": "Double XP Weekend",
+      "enabled": true,
+      "audiences": ["high_engagement_players"],
+      "overrides": [
+        {
+          "key": "xp_multiplier",
+          "value": 2.0
+        }
+      ]
+    }
+  ]
+}
+```
+
+| Field | Type | Description |
+|---|---|---|
+| `id` | `string` | Unique override ID |
+| `name` | `string` | Human-readable name |
+| `enabled` | `bool` | Whether this override is active |
+| `audiences` | `string[]` | Segment IDs from Unity Segmentation |
+| `overrides[].key` | `string` | Remote Config key to override |
+| `overrides[].value` | `any` | Replacement value |
+
+---
+
+## Editor API Models
+
+### Access Control
+
+```csharp
+namespace Unity.Services.Tooling.Editor.AccessControl.Authoring.Core.Model
+{
+    interface IProjectAccessFile
+    {
+        string Path { get; }
+        string Name { get; }
+        List<IAccessControlStatement> Statements { get; }
+    }
+
+    interface IAccessControlStatement
+    {
+        string Sid { get; }          // Statement ID — unique within the file
+        string Effect { get; }       // "Allow" or "Deny" — Deny takes precedence
+        List<string> Action { get; } // "Read", "Write", or "*" (both)
+        List<string> Principal { get; } // "Player" or "ServiceAccount"
+        List<string> Resource { get; }  // URN pattern(s) the rule applies to
+    }
+}
+```
+
+### Game Overrides
+
+```csharp
+namespace Unity.Services.Tooling.Editor.GameOverrides.Authoring.Core.Model
+{
+    interface IGameOverride
+    {
+        string Id { get; }
+        string Name { get; }
+        bool Enabled { get; }
+        List<string> Audiences { get; }
+        List<OverrideConfig> Overrides { get; }
+    }
+
+    class GameOverridesConfigFile
+    {
+        public List<IGameOverride> GameOverrides { get; }
+    }
+}
+```
+
+Both file types are discovered automatically by the Deployment Window when `com.unity.services.deployment` is installed.

package/.claude/skills/closure/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: closure
+description: Evaluates and records final IMPLEMENTED, VERIFIED, VALIDATED, DONE, or BLOCKED state using project closure mode, linked artifacts, evidence, manual gates, and explicit waivers.
+allowed-tools: Read, Glob, Grep, Write, Edit, Bash
+---
+
+# Closure
+
+Read `.nccgs/project.yaml`, `.nccgs/state.md`, and the active context packet when present. Preserve Product Owner authority and unrelated work.
+
+Read project closure policy, feature contract, context packet, final diff, evidence review, required linked artifacts, PO gates, and waivers. Apply lean, linked, or strict rules from [closure policy](../work/references/closure.md). Update one canonical closure record; link rather than duplicate reports and registers. A waiver applies only to its named item. Synchronize state and technical status, but never modify canon to legitimize divergence. Report the exact final state and blockers.
+
+Return outcome, evidence, affected records, blockers or decisions, residual risk, and the exact next workflow. Do not claim DONE unless this is the `closure` skill and every configured gate passes.
+

package/.claude/skills/code-review/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: code-review
+description: Performs a read-only code review against requirements, architecture, Unity constraints, ownership, tests, performance, security, and regression risk.
+allowed-tools: Read, Glob, Grep, Bash, Task
+---
+
+# Code Review
+
+Read `.nccgs/project.yaml`, `.nccgs/state.md`, and the active context packet when present. Preserve Product Owner authority and unrelated work.
+
+Read the context packet, final diff, governing decisions, affected callers, and tests. Route distinct Unity, networking, security, performance, or UI lenses when needed. Report only actionable findings with severity, exact evidence, impact, and remediation direction. Verify that tests assert requirements and that serialized/lifecycle behavior is addressed. Do not edit or praise generally; state when no material issue is found.
+
+Return outcome, evidence, affected records, blockers or decisions, residual risk, and the exact next workflow. Do not claim DONE unless this is the `closure` skill and every configured gate passes.
+

package/.claude/skills/compatibility-review/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: compatibility-review
+description: Reviews save, serialization, API, network, content, platform, or migration compatibility and defines versioning, detection, fallback, tests, and rollback.
+allowed-tools: Read, Glob, Grep, Bash, Task
+---
+
+# Compatibility Review
+
+Read `.nccgs/project.yaml`, `.nccgs/state.md`, and the active context packet when present. Preserve Product Owner authority and unrelated work.
+
+Remain read-only unless a migration plan is requested. Inventory producers, consumers, stored/on-wire formats, versions, invariants, and failure modes. Identify breaking and ambiguous changes, old-data coverage, forward/backward expectations, migration idempotency, recovery, and telemetry. Return compatibility verdict, required tests, rollout/rollback, and Product Owner decisions.
+
+Return outcome, evidence, affected records, blockers or decisions, residual risk, and the exact next workflow. Do not claim DONE unless this is the `closure` skill and every configured gate passes.
+

package/.claude/skills/context-pack/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: context-pack
+description: Creates or refreshes a focused NCCGS context packet for STANDARD or CONTROLLED work, mapping requirements, canonical sections, decisions, ownership, dependencies, verification, and source revisions without copying whole documents.
+allowed-tools: Read, Glob, Grep, Write, Edit
+---
+
+# Context Pack
+
+Read `.nccgs/project.yaml`, `.nccgs/state.md`, and the active context packet when present. Preserve Product Owner authority and unrelated work.
+
+Read the [context packet protocol](../../nccgs/protocols/context-packets.md) and project policy. Resolve the feature ID, objective, classification, domains, and accountable owner. Map exact canonical sections and decision summaries with source revisions; list writable, read-only, protected, and generated paths; record dependencies, constraints, out-of-scope behavior, verification, and PO gates. Create or update `.nccgs/context/<feature-id>.yaml` from the template. Do not paste whole documents. Mark contradictions and the exact reason for any required full-source read. Report packet path and unresolved inputs.
+
+Return outcome, evidence, affected records, blockers or decisions, residual risk, and the exact next workflow. Do not claim DONE unless this is the `closure` skill and every configured gate passes.
+

package/.claude/skills/dependency-review/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: dependency-review
+description: Evaluates a proposed Unity package, SDK, service, or external dependency for necessity, fit, licensing, security, maintenance, compatibility, lock-in, migration, and rollback before adoption.
+allowed-tools: Read, Glob, Grep, Bash, Task, WebSearch, WebFetch
+---
+
+# Dependency Review
+
+Read `.nccgs/project.yaml`, `.nccgs/state.md`, and the active context packet when present. Preserve Product Owner authority and unrelated work.
+
+Remain read-only. Define the capability need and compare build, buy, existing-project, and no-change options. Verify current authoritative documentation, supported Unity/platform versions, license, data/privacy, operational cost, update policy, failure behavior, transitive risk, and exit plan. Recommend with evidence. Adoption or replacement requires explicit Product Owner authority and an architecture decision.
+
+Return outcome, evidence, affected records, blockers or decisions, residual risk, and the exact next workflow. Do not claim DONE unless this is the `closure` skill and every configured gate passes.
+

package/.claude/skills/design/SKILL.md

@@ -0,0 +1,20 @@
+---
+name: design
+description: Designs or revises player-facing mechanics, systems, UX, levels, economy, narrative, content, or accessibility before implementation. Routes to focused design roles and preserves Product Owner control of subjective and canonical decisions.
+allowed-tools: Read, Glob, Grep, Write, Edit, Task, AskUserQuestion, WebSearch, WebFetch
+---
+
+# Design
+
+Produce implementation-ready design truth with the smallest complete set of specialized perspectives.
+
+Read policy, state, relevant pillars/canon, interacting requirements, and the code constraints needed for feasibility. Distinguish exploration, focused design, and CONTROLLED cross-system change.
+
+Select the accountable design role and only the specialists required by the domain: systems, level, economy, UX, accessibility, narrative, art, audio, live ops, or prototyping. Use Opus leadership only for cross-creative conflict or product-wide synthesis.
+
+Separate established facts from proposals and Product Owner decisions. Batch meaningful choices with real alternatives, tradeoffs, and a recommendation. Do not ask implementation trivia.
+
+Define applicable rules, states, formulas, feedback, dependencies, edge cases, tuning surfaces, objective acceptance criteria, subjective gates, out-of-scope behavior, and traceable requirement IDs. Consult technical roles for feasibility without letting implementation redefine intended design.
+
+Persist accepted changes in mapped canonical sources; do not create a parallel GDD tree. Run `/design-review` for STANDARD or CONTROLLED changes. If implementation is included and decisions are closed, hand the accepted contract to `/work`.
+

package/.claude/skills/design-review/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: design-review
+description: Reviews a proposed or changed game design for clarity, player intent, systemic interactions, balance, UX, accessibility, canon, feasibility, and testability without approving subjective choices.
+allowed-tools: Read, Glob, Grep, Task
+---
+
+# Design Review
+
+Read `.nccgs/project.yaml`, `.nccgs/state.md`, and the active context packet when present. Preserve Product Owner authority and unrelated work.
+
+Remain read-only. Review the target against pillars, canonical decisions, interacting systems, platform constraints, and implementation evidence only where relevant. Use focused specialists for economy, UX, accessibility, level, narrative, art, or audio lenses. Separate contradictions, exploitable/degenerate behavior, untestable requirements, and optional improvements. Return prioritized findings, PO decisions, and implementation-readiness verdict.
+
+Return outcome, evidence, affected records, blockers or decisions, residual risk, and the exact next workflow. Do not claim DONE unless this is the `closure` skill and every configured gate passes.
+

package/.claude/skills/evidence-review/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: evidence-review
+description: Independently evaluates whether accumulated tests, runtime observations, builds, reports, and manual gates actually prove each requirement and support the claimed closure state.
+allowed-tools: Read, Glob, Grep, Bash, Task
+---
+
+# Evidence Review
+
+Read `.nccgs/project.yaml`, `.nccgs/state.md`, and the active context packet when present. Preserve Product Owner authority and unrelated work.
+
+Read the [evidence protocol](../../nccgs/protocols/evidence.md), requirements, evidence records, test outputs, runtime/build observations, baseline, and waivers. Map every criterion to PASS, FAIL, NOT PROVEN, PO GATE, or N/A. Detect stale source revisions, unexplained count/skip changes, evidence produced before the final diff, and claims based only on inspection. Return closure impact and exact evidence still required.
+
+Return outcome, evidence, affected records, blockers or decisions, residual risk, and the exact next workflow. Do not claim DONE unless this is the `closure` skill and every configured gate passes.
+

package/.claude/skills/hotfix/SKILL.md

@@ -0,0 +1,14 @@
+---
+name: hotfix
+description: Runs a tightly scoped CONTROLLED workflow for urgent production or release-critical defects with containment, minimal change, accelerated evidence, rollback, and follow-up debt.
+allowed-tools: Read, Glob, Grep, Write, Edit, Bash, Task, AskUserQuestion
+---
+
+# Hotfix
+
+Read `.nccgs/project.yaml`, `.nccgs/state.md`, and the active context packet when present. Preserve Product Owner authority and unrelated work.
+
+Confirm affected version, severity, user/data impact, reproduction, containment, release branch, and rollback. Build the smallest safe fix with one accountable writer; preserve compatibility and avoid unrelated refactors. Run targeted regression plus the release-critical checks justified by blast radius. Record evidence, known gaps, approval, release steps, rollback trigger, and required follow-up. Publication still requires explicit authority.
+
+Return outcome, evidence, affected records, blockers or decisions, residual risk, and the exact next workflow. Do not claim DONE unless this is the `closure` skill and every configured gate passes.
+