nccgs 1.0.0

package/scripts/install.mjs

@@ -0,0 +1,267 @@
+import { spawnSync } from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const root = path.resolve(scriptDir, "..");
+const args = process.argv.slice(2);
+const projectIndex = args.indexOf("--project");
+const dryRun = args.includes("--dry-run");
+const force = args.includes("--force");
+const allowNonUnity = args.includes("--allow-non-unity");
+const modelProfileIndex = args.indexOf("--model-profile");
+const requestedModelProfile = modelProfileIndex >= 0 ? args[modelProfileIndex + 1] : null;
+
+if (projectIndex >= 0 && !args[projectIndex + 1]) {
+  console.error("--project requires a directory path.");
+  process.exit(2);
+}
+
+const project = projectIndex >= 0 ? path.resolve(args[projectIndex + 1]) : process.cwd();
+if (!fs.existsSync(project) || !fs.statSync(project).isDirectory()) {
+  console.error(`Project directory does not exist: ${project}`);
+  process.exit(2);
+}
+if (project === root) {
+  console.error("The NCCGS package directory cannot be its own installation target.");
+  process.exit(2);
+}
+
+const unityMarkers = ["Assets", "Packages", "ProjectSettings"];
+const missingMarkers = unityMarkers.filter((item) => !fs.existsSync(path.join(project, item)));
+if (missingMarkers.length && !allowNonUnity) {
+  console.error(`Target does not look like a Unity project; missing: ${missingMarkers.join(", ")}`);
+  console.error("Use --allow-non-unity only when intentionally scaffolding before Unity project creation.");
+  process.exit(2);
+}
+
+const validation = spawnSync(process.execPath, [path.join(scriptDir, "validate.mjs")], {
+  cwd: root,
+  encoding: "utf8",
+});
+if (validation.status !== 0) {
+  process.stderr.write(validation.stdout ?? "");
+  process.stderr.write(validation.stderr ?? "");
+  console.error("NCCGS package validation failed; installation aborted.");
+  process.exit(1);
+}
+
+const frameworkSource = path.join(root, ".claude");
+const frameworkFiles = walk(frameworkSource).map((file) => ({
+  source: file,
+  relative: path.relative(root, file),
+  destination: path.join(project, path.relative(root, file)),
+}));
+const npmExcludedUnityFile = ".claude/skills/setup-vivox-voice-chat/evals/.gitignore";
+if (!frameworkFiles.some((item) => posix(item.relative) === npmExcludedUnityFile)) {
+  const fallback = path.join(root, "package-assets", "setup-vivox-voice-chat-evals.gitignore");
+  if (fs.existsSync(fallback)) {
+    frameworkFiles.push({
+      source: fallback,
+      relative: npmExcludedUnityFile.split("/").join(path.sep),
+      destination: path.join(project, ...npmExcludedUnityFile.split("/"))
+    });
+    frameworkFiles.sort((a, b) => a.relative.localeCompare(b.relative));
+  }
+}
+const installStatePath = path.join(project, ".claude", "nccgs", "install-state.json");
+let previousInstallState = null;
+if (fs.existsSync(installStatePath)) {
+  try { previousInstallState = JSON.parse(fs.readFileSync(installStatePath, "utf8")); }
+  catch (error) {
+    console.error(`Invalid NCCGS install state at ${installStatePath}: ${error.message}`);
+    process.exit(2);
+  }
+}
+const currentFrameworkNames = new Set(frameworkFiles.map((item) => posix(item.relative)));
+const staleFrameworkFiles = (previousInstallState?.files ?? [])
+  .filter((item) => !currentFrameworkNames.has(item.relative))
+  .map((item) => ({ ...item, destination: path.join(project, ...item.relative.split("/")) }))
+  .filter((item) => fs.existsSync(item.destination));
+
+const conflicts = frameworkFiles.filter((item) => {
+  if (!fs.existsSync(item.destination)) return false;
+  return !sameFile(item.source, item.destination);
+});
+
+if ((conflicts.length || staleFrameworkFiles.length) && !force) {
+  console.error(`Installation found ${conflicts.length} conflicting and ${staleFrameworkFiles.length} stale framework file(s):`);
+  for (const item of conflicts.slice(0, 30)) console.error(`- ${posix(item.relative)}`);
+  for (const item of staleFrameworkFiles.slice(0, 30)) console.error(`- stale: ${item.relative}`);
+  if (conflicts.length > 30) console.error(`- ... ${conflicts.length - 30} more`);
+  console.error("Re-run with --force to back up and replace these framework files.");
+  process.exit(2);
+}
+
+const newFiles = frameworkFiles.filter((item) => !fs.existsSync(item.destination));
+const identicalFiles = frameworkFiles.length - newFiles.length - conflicts.length;
+const scaffoldFiles = walk(path.join(root, "scaffold")).map((file) => ({
+  source: file,
+  relative: path.relative(path.join(root, "scaffold"), file),
+  destination: path.join(project, path.relative(path.join(root, "scaffold"), file)),
+}));
+const newScaffold = scaffoldFiles.filter((item) => !fs.existsSync(item.destination));
+const settingsPlan = planManagedSettings(project);
+const targetPolicyPath = path.join(project, ".nccgs", "project.yaml");
+const targetPolicy = fs.existsSync(targetPolicyPath) ? fs.readFileSync(targetPolicyPath, "utf8") : "";
+const policyModelProfile = targetPolicy.match(/^models:\s*$[\s\S]*?^\s+profile:\s*([^#\r\n]+)/m)?.[1]?.trim();
+const modelProfile = requestedModelProfile || policyModelProfile || "quality";
+if (!new Set(["quality", "balanced", "inherit"]).has(modelProfile)) {
+  console.error(`Unknown model profile: ${modelProfile}`);
+  process.exit(2);
+}
+
+console.log(`NCCGS installation target: ${project}`);
+console.log(`Framework files: ${frameworkFiles.length} (${newFiles.length} new, ${identicalFiles} identical, ${conflicts.length} replace)`);
+console.log(`Stale framework files to back up and remove: ${staleFrameworkFiles.length}`);
+console.log(`Project scaffold files to initialize: ${newScaffold.length}`);
+console.log(`Managed Claude settings: ${settingsPlan.changed ? "update" : "already current"}`);
+console.log(`Agent model profile: ${modelProfile}`);
+if (dryRun) {
+  console.log("Dry run complete; no files changed.");
+  process.exit(0);
+}
+
+const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+const backupRoot = path.join(project, ".nccgs", "backups", stamp);
+for (const item of conflicts) {
+  const backup = path.join(backupRoot, item.relative);
+  fs.mkdirSync(path.dirname(backup), { recursive: true });
+  fs.copyFileSync(item.destination, backup);
+}
+for (const item of staleFrameworkFiles) {
+  const backup = path.join(backupRoot, ...item.relative.split("/"));
+  fs.mkdirSync(path.dirname(backup), { recursive: true });
+  fs.copyFileSync(item.destination, backup);
+  fs.unlinkSync(item.destination);
+}
+
+for (const item of frameworkFiles) {
+  fs.mkdirSync(path.dirname(item.destination), { recursive: true });
+  fs.copyFileSync(item.source, item.destination);
+}
+
+for (const item of newScaffold) {
+  fs.mkdirSync(path.dirname(item.destination), { recursive: true });
+  fs.copyFileSync(item.source, item.destination);
+}
+
+installManagedSettings(settingsPlan, backupRoot);
+installClaudeImport(project, backupRoot);
+
+const modelConfiguration = spawnSync(process.execPath, [
+  path.join(project, ".claude", "nccgs", "tools", "configure-models.mjs"),
+  "--project", project,
+  "--profile", modelProfile,
+], { cwd: project, encoding: "utf8" });
+if (modelConfiguration.status !== 0) {
+  process.stderr.write(modelConfiguration.stdout ?? "");
+  process.stderr.write(modelConfiguration.stderr ?? "");
+  console.error("NCCGS was copied, but agent model configuration failed.");
+  process.exit(1);
+}
+
+writeInstallState(project, modelProfile, frameworkFiles, installStatePath);
+
+console.log("NCCGS installation complete.");
+if (conflicts.length) console.log(`Replaced files backed up under: ${backupRoot}`);
+console.log("Next: open Claude Code and run /migrate-project review for an existing project, or /status for a configured project.");
+
+function walk(directory) {
+  const output = [];
+  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    const full = path.join(directory, entry.name);
+    if (entry.isDirectory()) output.push(...walk(full));
+    else if (entry.isFile()) output.push(full);
+  }
+  return output.sort((a, b) => a.localeCompare(b));
+}
+
+function sameFile(left, right) {
+  const a = fs.readFileSync(left);
+  const b = fs.readFileSync(right);
+  return a.length === b.length && a.equals(b);
+}
+
+function hashFile(file) {
+  return crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+}
+
+function posix(value) {
+  return value.split(path.sep).join("/");
+}
+
+function planManagedSettings(projectRoot) {
+  const settingsPath = path.join(projectRoot, ".claude", "settings.json");
+  let current = {};
+  if (fs.existsSync(settingsPath)) {
+    try {
+      current = JSON.parse(fs.readFileSync(settingsPath, "utf8"));
+    } catch (error) {
+      console.error(`Cannot merge invalid JSON settings at ${settingsPath}: ${error.message}`);
+      process.exit(2);
+    }
+  }
+  const fragment = JSON.parse(fs.readFileSync(path.join(root, ".claude", "nccgs", "settings.fragment.json"), "utf8"));
+  const merged = structuredClone(current);
+  merged.permissions ??= {};
+  for (const key of ["allow", "deny", "ask"]) {
+    const existing = Array.isArray(merged.permissions[key]) ? merged.permissions[key] : [];
+    const additions = Array.isArray(fragment.permissions?.[key]) ? fragment.permissions[key] : [];
+    if (existing.length || additions.length) merged.permissions[key] = [...new Set([...existing, ...additions])];
+  }
+  merged.hooks ??= {};
+  for (const [event, groups] of Object.entries(fragment.hooks ?? {})) {
+    const existing = Array.isArray(merged.hooks[event]) ? merged.hooks[event] : [];
+    const retained = existing.filter((group) => !JSON.stringify(group).includes(".claude/nccgs/hooks/"));
+    merged.hooks[event] = [...retained, ...groups];
+  }
+  const nextText = `${JSON.stringify(merged, null, 2)}\n`;
+  const currentText = fs.existsSync(settingsPath) ? fs.readFileSync(settingsPath, "utf8") : "";
+  return { settingsPath, existed: fs.existsSync(settingsPath), nextText, changed: currentText !== nextText };
+}
+
+function installManagedSettings(plan, backupDirectory) {
+  if (!plan.changed) return;
+  if (plan.existed) {
+    const backup = path.join(backupDirectory, ".claude", "settings.json");
+    fs.mkdirSync(path.dirname(backup), { recursive: true });
+    fs.copyFileSync(plan.settingsPath, backup);
+  }
+  fs.mkdirSync(path.dirname(plan.settingsPath), { recursive: true });
+  fs.writeFileSync(plan.settingsPath, plan.nextText, "utf8");
+}
+
+function writeInstallState(projectRoot, profile, files, statePath) {
+  const state = {
+    schemaVersion: 1,
+    frameworkVersion: fs.readFileSync(path.join(root, "VERSION"), "utf8").trim(),
+    modelProfile: profile,
+    files: files.map((item) => ({
+      relative: posix(item.relative),
+      sha256: hashFile(path.join(projectRoot, item.relative))
+    }))
+  };
+  fs.mkdirSync(path.dirname(statePath), { recursive: true });
+  fs.writeFileSync(statePath, `${JSON.stringify(state, null, 2)}\n`, "utf8");
+}
+
+function installClaudeImport(projectRoot, backupDirectory) {
+  const claudePath = path.join(projectRoot, "CLAUDE.md");
+  const begin = "<!-- NCCGS:BEGIN -->";
+  const block = `${begin}\n@.claude/nccgs/constitution.md\n<!-- NCCGS:END -->`;
+  if (!fs.existsSync(claudePath)) {
+    fs.copyFileSync(path.join(root, "CLAUDE.md"), claudePath);
+    return;
+  }
+
+  const current = fs.readFileSync(claudePath, "utf8");
+  if (current.includes(begin) || current.includes("@.claude/nccgs/constitution.md")) return;
+
+  fs.mkdirSync(backupDirectory, { recursive: true });
+  fs.copyFileSync(claudePath, path.join(backupDirectory, "CLAUDE.md"));
+  const separator = current.endsWith("\n") ? "\n" : "\n\n";
+  fs.writeFileSync(claudePath, `${current}${separator}${block}\n`, "utf8");
+}

package/scripts/sync-unity-skills.mjs

@@ -0,0 +1,126 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const root = path.resolve(scriptDir, "..");
+const args = process.argv.slice(2);
+const dryRun = args.includes("--dry-run");
+const sourceIndex = args.indexOf("--source");
+
+if (sourceIndex < 0 || !args[sourceIndex + 1]) {
+  console.error("Usage: node scripts/sync-unity-skills.mjs --source <UnitySkills directory> [--dry-run]");
+  process.exit(2);
+}
+
+const source = path.resolve(args[sourceIndex + 1]);
+if (!fs.existsSync(source) || !fs.statSync(source).isDirectory()) {
+  console.error(`Unity Skills source directory does not exist: ${source}`);
+  process.exit(2);
+}
+
+const reserved = new Set(["work", "design", "audit", "migrate-project", "test", "review", "release", "status"]);
+const skillNames = fs.readdirSync(source, { withFileTypes: true })
+  .filter((entry) => entry.isDirectory() && fs.existsSync(path.join(source, entry.name, "SKILL.md")))
+  .map((entry) => entry.name)
+  .sort((a, b) => a.localeCompare(b));
+
+if (!skillNames.length) {
+  console.error(`No Unity Skills containing SKILL.md were found in: ${source}`);
+  process.exit(2);
+}
+
+for (const name of skillNames) {
+  if (reserved.has(name)) {
+    console.error(`Unity Skill collides with an NCCGS public skill: ${name}`);
+    process.exit(2);
+  }
+}
+
+const skillsRoot = path.join(root, ".claude", "skills");
+const manifestPath = path.join(root, ".claude", "nccgs", "unity-skills-manifest.json");
+let previous = { skills: [] };
+if (fs.existsSync(manifestPath)) {
+  previous = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+}
+const previousNames = new Set((previous.skills ?? []).map((item) => item.name));
+
+for (const name of skillNames) {
+  const destination = path.join(skillsRoot, name);
+  if (fs.existsSync(destination) && !previousNames.has(name)) {
+    console.error(`Destination collides with a non-vendored skill: .claude/skills/${name}`);
+    process.exit(2);
+  }
+}
+
+console.log(`${dryRun ? "Would sync" : "Syncing"} ${skillNames.length} Unity Skills from ${source}`);
+for (const name of skillNames) console.log(`- ${name}`);
+if (dryRun) process.exit(0);
+
+fs.mkdirSync(skillsRoot, { recursive: true });
+fs.mkdirSync(path.dirname(manifestPath), { recursive: true });
+
+const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+const stage = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-unity-skills-"));
+const backupRoot = path.join(root, ".nccgs-maintenance", "unity-skills-backups", stamp);
+
+try {
+  for (const name of skillNames) {
+    fs.cpSync(path.join(source, name), path.join(stage, name), { recursive: true });
+  }
+
+  for (const name of new Set([...previousNames, ...skillNames])) {
+    const destination = path.join(skillsRoot, name);
+    if (!fs.existsSync(destination)) continue;
+    fs.mkdirSync(backupRoot, { recursive: true });
+    fs.renameSync(destination, path.join(backupRoot, name));
+  }
+
+  for (const name of skillNames) {
+    fs.cpSync(path.join(stage, name), path.join(skillsRoot, name), { recursive: true });
+  }
+
+  const manifest = {
+    schema_version: 1,
+    source_repository: "https://github.com/Unity-Technologies/skills",
+    source_label: path.basename(source),
+    source_revision: "unknown-local-copy",
+    synced_at: new Date().toISOString(),
+    license: "Unity Companion License for Unity-dependent projects",
+    license_url: "https://unity3d.com/legal/licenses/unity_companion_license",
+    policy: "Vendored files are upstream-managed and must remain unmodified.",
+    skills: skillNames.map((name) => ({
+      name,
+      files: walk(path.join(skillsRoot, name)).map((file) => ({
+        path: posix(path.relative(path.join(skillsRoot, name), file)),
+        bytes: fs.statSync(file).size,
+        sha256: crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex"),
+      })),
+    })),
+  };
+  fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+  console.log(`Unity Skills manifest written: ${manifestPath}`);
+  if (fs.existsSync(backupRoot)) console.log(`Previous snapshot backed up: ${backupRoot}`);
+} catch (error) {
+  console.error(`Unity Skills sync failed: ${error.message}`);
+  console.error(`The package may be restored from: ${backupRoot}`);
+  process.exit(1);
+} finally {
+  if (fs.existsSync(stage)) fs.rmSync(stage, { recursive: true, force: true });
+}
+
+function walk(directory) {
+  const output = [];
+  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    const full = path.join(directory, entry.name);
+    if (entry.isDirectory()) output.push(...walk(full));
+    else if (entry.isFile()) output.push(full);
+  }
+  return output.sort((a, b) => a.localeCompare(b));
+}
+
+function posix(value) {
+  return value.split(path.sep).join("/");
+}

package/scripts/validate.mjs

@@ -0,0 +1,205 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const errors = [];
+const warnings = [];
+const posix = (value) => value.split(path.sep).join("/");
+
+function walk(directory) {
+  if (!fs.existsSync(directory)) return [];
+  const output = [];
+  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    const full = path.join(directory, entry.name);
+    if (entry.isDirectory()) output.push(...walk(full));
+    else if (entry.isFile()) output.push(full);
+  }
+  return output.sort((a, b) => a.localeCompare(b));
+}
+
+function sha256(file) {
+  return crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+}
+
+function frontmatter(file) {
+  const text = fs.readFileSync(file, "utf8");
+  const match = text.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
+  if (!match) return null;
+  const result = {};
+  for (const line of match[1].split(/\r?\n/)) {
+    const item = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
+    if (item) result[item[1]] = item[2].replace(/^['"]|['"]$/g, "").trim();
+  }
+  return result;
+}
+
+function requireFile(relative) {
+  if (!fs.existsSync(path.join(root, relative))) errors.push(`Missing required file: ${relative}`);
+}
+
+for (const relative of [
+  "VERSION", "README.md", "CLAUDE.md", "LICENSE", "package.json",
+  ".claude/nccgs/VERSION", ".claude/nccgs/constitution.md",
+  ".claude/nccgs/studio.json", ".claude/nccgs/workflow-catalog.json",
+  ".claude/nccgs/settings.fragment.json", ".claude/nccgs/unity-skills-manifest.json",
+  ".claude/nccgs/protocols/agent-contract.md", ".claude/nccgs/protocols/orchestration.md",
+  ".claude/nccgs/protocols/model-routing.md", ".claude/nccgs/protocols/context-packets.md",
+  ".claude/nccgs/protocols/evidence.md", ".claude/nccgs/protocols/unity-boundary.md",
+  "scaffold/.nccgs/project.yaml", "scaffold/.nccgs/state.md",
+  "scaffold/.nccgs/requirements.yaml", "scaffold/.nccgs/templates/context-packet.yaml",
+  "scaffold/.nccgs/templates/closure-record.md", "package-assets/setup-vivox-voice-chat-evals.gitignore",
+  "scripts/cli.mjs", "scripts/install.mjs",
+  "scripts/sync-unity-skills.mjs", "tests/framework.test.mjs"
+]) requireFile(relative);
+
+const versions = [
+  fs.readFileSync(path.join(root, "VERSION"), "utf8").trim(),
+  JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")).version,
+  fs.readFileSync(path.join(root, ".claude/nccgs/VERSION"), "utf8").trim()
+];
+if (new Set(versions).size !== 1) errors.push(`Version mismatch: ${versions.join(" / ")}`);
+
+const packageJson = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+if (packageJson.private === true) errors.push("package.json is marked private and cannot be published.");
+if (packageJson.bin?.nccgs !== "scripts/cli.mjs") errors.push("package.json does not expose the nccgs CLI.");
+
+const rootClaude = fs.readFileSync(path.join(root, "CLAUDE.md"), "utf8");
+if (!rootClaude.includes("@.claude/nccgs/constitution.md")) errors.push("CLAUDE.md does not import the NCCGS constitution.");
+
+const studio = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/studio.json"), "utf8"));
+const agentNames = new Set();
+for (const agent of studio.agents ?? []) {
+  if (agentNames.has(agent.name)) errors.push(`Duplicate catalog agent: ${agent.name}`);
+  agentNames.add(agent.name);
+  const file = path.join(root, ".claude", "agents", `${agent.name}.md`);
+  if (!fs.existsSync(file)) { errors.push(`Catalog agent file missing: ${agent.name}`); continue; }
+  const metadata = frontmatter(file);
+  if (metadata?.name !== agent.name || !metadata?.description) errors.push(`Invalid agent frontmatter: ${agent.name}`);
+  const expected = studio.modelProfiles[studio.defaultProfile]?.[agent.modelClass];
+  if (metadata?.model !== expected) errors.push(`Agent model mismatch: ${agent.name} expected ${expected}, found ${metadata?.model}`);
+  if ((metadata?.tools ?? "").split(/,\s*/).includes("Task")) errors.push(`Agent may recursively delegate: ${agent.name}`);
+  if (!fs.readFileSync(file, "utf8").includes("protocols/agent-contract.md")) errors.push(`Agent does not load common contract: ${agent.name}`);
+  if (fs.readFileSync(file, "utf8").split(/\r?\n/).length > 80) errors.push(`Agent entrypoint exceeds 80 lines: ${agent.name}`);
+}
+
+const actualAgents = walk(path.join(root, ".claude/agents")).filter((file) => file.endsWith(".md"));
+for (const file of actualAgents) {
+  if (!agentNames.has(path.basename(file, ".md"))) errors.push(`Uncataloged NCCGS agent: ${posix(path.relative(root, file))}`);
+}
+
+const workflows = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/workflow-catalog.json"), "utf8"));
+const workflowNames = new Set();
+for (const workflow of workflows.workflows ?? []) {
+  if (workflowNames.has(workflow.name)) errors.push(`Duplicate workflow: ${workflow.name}`);
+  workflowNames.add(workflow.name);
+  const file = path.join(root, ".claude", "skills", workflow.name, "SKILL.md");
+  if (!fs.existsSync(file)) { errors.push(`Workflow skill missing: ${workflow.name}`); continue; }
+  const metadata = frontmatter(file);
+  if (metadata?.name !== workflow.name || !metadata?.description) errors.push(`Invalid workflow frontmatter: ${workflow.name}`);
+  const lines = fs.readFileSync(file, "utf8").split(/\r?\n/).length;
+  if (lines > 120) errors.push(`Workflow entrypoint exceeds 120 lines: ${workflow.name}`);
+  if (fs.existsSync(path.join(path.dirname(file), "README.md"))) errors.push(`NCCGS-owned skill contains redundant README: ${workflow.name}`);
+  for (const role of workflow.primaryRoles ?? []) if (!agentNames.has(role)) errors.push(`Workflow ${workflow.name} references unknown role ${role}`);
+}
+for (const entry of workflows.entrypoints ?? []) if (!workflowNames.has(entry)) errors.push(`Missing entrypoint workflow: ${entry}`);
+
+const projectScaffold = fs.readFileSync(path.join(root, "scaffold/.nccgs/project.yaml"), "utf8");
+for (const pattern of [
+  /^schema_version:\s*2\s*$/m, /^studio:\s*$/m, /^models:\s*$/m,
+  /^context:\s*$/m, /^closure:\s*$/m, /max_agent_depth:\s*1/m,
+  /single_writer_per_path:\s*true/m, /independent_verification:\s*true/m,
+  /canonical_record:\s*"\.nccgs\/closures\/\{feature_id\}\.md"/m
+]) if (!pattern.test(projectScaffold)) errors.push(`Project scaffold lacks schema invariant: ${pattern}`);
+
+const settingsFragment = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/settings.fragment.json"), "utf8"));
+const hookCommands = [];
+for (const groups of Object.values(settingsFragment.hooks ?? {})) {
+  for (const group of groups) for (const hook of group.hooks ?? []) hookCommands.push(hook.command);
+}
+if (hookCommands.length !== new Set(hookCommands).size) errors.push("Managed hook command is duplicated.");
+for (const command of hookCommands) {
+  const match = command.match(/^node\s+([^\s]+\.mjs)/);
+  if (!match) { errors.push(`Managed hook is not a Node script: ${command}`); continue; }
+  const file = path.join(root, ...match[1].split("/"));
+  if (!fs.existsSync(file)) { errors.push(`Managed hook script missing: ${match[1]}`); continue; }
+  const check = spawnSync(process.execPath, ["--check", file], { encoding: "utf8" });
+  if (check.status !== 0) errors.push(`Hook syntax failure ${match[1]}: ${check.stderr.trim()}`);
+}
+for (const file of [path.join(root, ".claude/nccgs/tools/configure-models.mjs"), path.join(root, "scripts/cli.mjs"), path.join(root, "scripts/install.mjs")]) {
+  const check = spawnSync(process.execPath, ["--check", file], { encoding: "utf8" });
+  if (check.status !== 0) errors.push(`Script syntax failure ${posix(path.relative(root, file))}: ${check.stderr.trim()}`);
+}
+
+const rules = walk(path.join(root, ".claude/rules")).filter((file) => file.endsWith(".md"));
+if (rules.length < 11) errors.push(`Expected at least 11 path-scoped rules, found ${rules.length}.`);
+
+const manifestPath = path.join(root, ".claude/nccgs/unity-skills-manifest.json");
+const npmFallbackFiles = new Map([
+  ["setup-vivox-voice-chat/evals/.gitignore", path.join(root, "package-assets/setup-vivox-voice-chat-evals.gitignore")]
+]);
+let manifest;
+try { manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8")); }
+catch (error) { errors.push(`Unity Skills manifest is invalid JSON: ${error.message}`); }
+const allSkillNames = new Set();
+for (const directory of fs.readdirSync(path.join(root, ".claude/skills"), { withFileTypes: true })) {
+  if (!directory.isDirectory()) continue;
+  const skillFile = path.join(root, ".claude/skills", directory.name, "SKILL.md");
+  if (!fs.existsSync(skillFile)) { warnings.push(`Skill directory has no SKILL.md: ${directory.name}`); continue; }
+  const metadata = frontmatter(skillFile);
+  if (!metadata?.name || !metadata?.description) errors.push(`Skill lacks name/description: ${directory.name}`);
+  if (metadata?.name !== directory.name) errors.push(`Skill folder/name mismatch: ${directory.name} != ${metadata?.name}`);
+  if (allSkillNames.has(metadata?.name)) errors.push(`Duplicate skill name: ${metadata?.name}`);
+  allSkillNames.add(metadata?.name);
+}
+
+if (manifest) {
+  for (const skill of manifest.skills ?? []) {
+    const skillDir = path.join(root, ".claude/skills", skill.name);
+    if (!fs.existsSync(skillDir)) { errors.push(`Vendored Unity Skill missing: ${skill.name}`); continue; }
+    const expectedFiles = new Set();
+    for (const item of skill.files ?? []) {
+      expectedFiles.add(item.path);
+      let file = path.join(skillDir, ...item.path.split("/"));
+      if (!fs.existsSync(file)) file = npmFallbackFiles.get(`${skill.name}/${item.path}`) ?? file;
+      if (!fs.existsSync(file)) { errors.push(`Vendored Unity Skill file missing: ${skill.name}/${item.path}`); continue; }
+      if (sha256(file) !== item.sha256) errors.push(`Vendored Unity Skill modified: ${skill.name}/${item.path}`);
+    }
+    for (const file of walk(skillDir)) {
+      const relative = posix(path.relative(skillDir, file));
+      if (!expectedFiles.has(relative)) errors.push(`Untracked file in vendored Unity Skill: ${skill.name}/${relative}`);
+    }
+  }
+}
+
+const markdownRoots = [path.join(root, "README.md"), path.join(root, "docs"), path.join(root, ".claude/nccgs"), ...[...workflowNames].map((name) => path.join(root, ".claude/skills", name))];
+for (const item of markdownRoots) {
+  if (!fs.existsSync(item)) continue;
+  const files = fs.statSync(item).isDirectory() ? walk(item).filter((file) => file.endsWith(".md")) : [item];
+  for (const file of files) {
+    const text = fs.readFileSync(file, "utf8");
+    for (const match of text.matchAll(/\[[^\]]+\]\(([^)]+)\)/g)) {
+      const link = match[1].trim();
+      if (!link || link.startsWith("#") || /^[a-z]+:/i.test(link)) continue;
+      const target = path.resolve(path.dirname(file), link.split("#")[0]);
+      if (!fs.existsSync(target)) errors.push(`Broken relative link in ${posix(path.relative(root, file))}: ${link}`);
+    }
+  }
+}
+
+for (const warning of warnings) console.warn(`WARN: ${warning}`);
+if (errors.length) {
+  for (const error of errors) console.error(`ERROR: ${error}`);
+  console.error(`\nNCCGS validation failed with ${errors.length} error(s).`);
+  process.exit(1);
+}
+
+console.log("NCCGS validation passed.");
+console.log(`NCCGS workflows: ${workflowNames.size} (${workflows.entrypoints.length} entrypoints)`);
+console.log(`Studio agents: ${agentNames.size}`);
+console.log(`Path-scoped rules: ${rules.length}`);
+console.log(`Managed hooks: ${hookCommands.length}`);
+console.log(`Vendored Unity Skills: ${manifest?.skills?.length ?? 0}`);
+console.log(`Discoverable skills total: ${allSkillNames.size}`);