nccgs 1.1.0 → 1.3.0

package/tests/framework.test.mjs

@@ -6,13 +6,46 @@ import path from "node:path";
 import { spawnSync } from "node:child_process";
 import test from "node:test";
 import { fileURLToPath } from "node:url";
+import { compile, renderAgent } from "../.claude/nccgs/tools/compile-policy.mjs";
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const studio = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/studio.json"), "utf8"));
 const workflows = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/workflow-catalog.json"), "utf8"));
+const pipeline = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/pipeline.json"), "utf8"));
+function copyAgentFixture(temp) {
+  fs.cpSync(path.join(root, ".claude/nccgs"), path.join(temp, ".claude/nccgs"), { recursive: true });
+  fs.mkdirSync(path.join(temp, ".claude/agents"), { recursive: true });
+  for (const agent of studio.agents) {
+    const template = fs.readFileSync(path.join(root, ".claude/nccgs/agent-library", `${agent.name}.md`), "utf8");
+    fs.writeFileSync(path.join(temp, ".claude/agents", `${agent.name}.md`), renderAgent(template, pipeline.profiles["astra-claude"].models[agent.modelClass]));
+  }
+}
 const frameworkVersion = fs.readFileSync(path.join(root, "VERSION"), "utf8").trim();
 const sha256 = (value) => crypto.createHash("sha256").update(value).digest("hex");
 
+test("canonical policy changes invalidate generated routing until compilation", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-policy-test-"));
+  try {
+    copyAgentFixture(temp);
+    compile(temp, true);
+    assert.deepEqual(compile(temp), []);
+    const file = path.join(temp, ".claude/nccgs/pipeline.json");
+    const policy = JSON.parse(fs.readFileSync(file, "utf8"));
+    policy.profiles["astra-claude"].models.review.effort = "medium";
+    fs.writeFileSync(file, JSON.stringify(policy));
+    const stale = compile(temp);
+    assert.ok(stale.includes(".claude/agents/nccgs-adversarial-reviewer.md"));
+    assert.ok(stale.includes(".claude/nccgs/workflow-catalog.json"));
+    compile(temp, true);
+    assert.deepEqual(compile(temp), []);
+    const catalog = JSON.parse(fs.readFileSync(path.join(temp, ".claude/nccgs/studio.json"), "utf8"));
+    assert.equal(catalog.effortProfiles["astra-claude"].review, "medium");
+  } finally {
+    assert.ok(path.resolve(temp).startsWith(path.resolve(os.tmpdir()) + path.sep + "nccgs-policy-test-"));
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
 test("studio roles are unique and workflow references resolve", () => {
   const roles = new Set(studio.agents.map((agent) => agent.name));
   assert.equal(roles.size, studio.agents.length);
@@ -27,8 +60,116 @@ test("quality profile assigns all model classes", () => {
   }
 });
 
+test("optional specialists survive updates and can be disabled without changing core agents", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-optional-agents-"));
+  try {
+    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
+    const run = (...args) => spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), ...args], { cwd: temp, encoding: "utf8" });
+    const install = run("install");
+    assert.equal(install.status, 0, install.stderr || install.stdout);
+    const role = "nccgs-network-programmer";
+    const file = path.join(temp, ".claude/agents", `${role}.md`);
+    assert.ok(!fs.existsSync(file));
+    assert.equal(run("agents", "--enable", role).status, 0);
+    assert.match(fs.readFileSync(file, "utf8"), /model: claude-opus-5-5/);
+    const update = run("update");
+    assert.equal(update.status, 0, update.stderr || update.stdout);
+    assert.ok(fs.existsSync(file));
+    assert.equal(run("doctor").status, 0);
+    assert.equal(run("agents", "--disable", role).status, 0);
+    assert.ok(!fs.existsSync(file));
+    assert.notEqual(run("agents", "--disable", "nccgs-adversarial-reviewer").status, 0);
+    assert.equal(fs.readdirSync(path.join(temp, ".claude/agents")).length, pipeline.coreAgents.length);
+  } finally { fs.rmSync(temp, { recursive: true, force: true }); }
+});
+
+test("default install configures Opus coding and independent Fable review without erasing settings", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-astra-install-"));
+  try {
+    for (const marker of ["Assets", "Packages", "ProjectSettings", ".claude"]) fs.mkdirSync(path.join(temp, marker));
+    const settingsPath = path.join(temp, ".claude/settings.json");
+    fs.writeFileSync(settingsPath, JSON.stringify({ model: "sonnet", effortLevel: "medium", modelSettings: { "claude-opus-5-5": { effortLevel: "low" }, "claude-sonnet-4-6": { effortLevel: "medium" } }, permissions: { allow: ["Bash(git status*)"] }, env: { NCCGS_TEST: "preserved" } }));
+    const run = (...args) => spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), ...args], { cwd: temp, encoding: "utf8" });
+    const dry = run("install", "--dry-run");
+    assert.equal(dry.status, 0, dry.stderr || dry.stdout);
+    assert.equal(JSON.parse(fs.readFileSync(settingsPath)).model, "sonnet");
+    assert.ok(!fs.existsSync(path.join(temp, ".claude/agents")));
+    const install = run("install");
+    assert.equal(install.status, 0, install.stderr || install.stdout);
+    const settings = JSON.parse(fs.readFileSync(settingsPath));
+    assert.equal(settings.model, "claude-opus-5-5");
+    assert.equal(settings.effortLevel, "xhigh");
+    assert.equal(settings.modelSettings["claude-opus-5-5"].effortLevel, "xhigh");
+    assert.equal(settings.modelSettings["claude-sonnet-4-6"].effortLevel, "medium");
+    assert.equal(settings.env.NCCGS_TEST, "preserved");
+    assert.deepEqual(settings.permissions.allow, ["Bash(git status*)"]);
+    for (const agent of studio.agents) {
+      if (!pipeline.coreAgents.includes(agent.name)) {
+        assert.ok(!fs.existsSync(path.join(temp, ".claude/agents", `${agent.name}.md`)));
+        continue;
+      }
+      const text = fs.readFileSync(path.join(temp, ".claude/agents", `${agent.name}.md`), "utf8");
+      const expected = agent.name === "nccgs-adversarial-reviewer" ? "fable" : "claude-opus-5-5";
+      assert.equal(text.match(/^model:\s*(\S+)/m)?.[1], expected, agent.name);
+      const expectedEffort = agent.name === "nccgs-adversarial-reviewer" ? "high" : "xhigh";
+      assert.equal(text.match(/^effort:\s*(\S+)/m)?.[1], expectedEffort, agent.name);
+    }
+    assert.match(fs.readFileSync(path.join(temp, ".nccgs/project.yaml"), "utf8"), /profile: astra-claude/);
+    assert.ok(fs.existsSync(path.join(temp, ".nccgs/templates/implementation-report.md")));
+    const update = run("update");
+    assert.equal(update.status, 0, update.stderr || update.stdout);
+    assert.match(update.stdout, /0 preserved override/);
+    const doctor = run("doctor");
+    assert.equal(doctor.status, 0, doctor.stderr || doctor.stdout);
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test("profile changes clear effort pins and preserve skipped custom agents", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-effort-profile-"));
+  try {
+    fs.mkdirSync(path.join(temp, ".claude/nccgs"), { recursive: true });
+    fs.mkdirSync(path.join(temp, ".claude/agents"));
+    fs.mkdirSync(path.join(temp, ".nccgs"));
+    fs.copyFileSync(path.join(root, ".claude/nccgs/studio.json"), path.join(temp, ".claude/nccgs/studio.json"));
+    fs.writeFileSync(path.join(temp, ".nccgs/project.yaml"), "models:\n  profile: astra-claude\n");
+    copyAgentFixture(temp);
+    const run = (profile, ...args) => spawnSync(process.execPath, [path.join(root, ".claude/nccgs/tools/configure-models.mjs"), "--project", temp, "--profile", profile, ...args], { encoding: "utf8" });
+    for (const profile of ["inherit", "quality", "balanced", "astra-claude"]) {
+      const result = run(profile);
+      assert.equal(result.status, 0, result.stderr || result.stdout);
+      for (const agent of studio.agents) {
+        if (profile === "astra-claude" && !pipeline.coreAgents.includes(agent.name)) {
+          assert.ok(!fs.existsSync(path.join(temp, ".claude/agents", `${agent.name}.md`)));
+          continue;
+        }
+        const text = fs.readFileSync(path.join(temp, ".claude/agents", `${agent.name}.md`), "utf8");
+        assert.equal(text.match(/^model:\s*(\S+)/m)?.[1] ?? null, studio.modelProfiles[profile][agent.modelClass], agent.name);
+        const expectedEffort = profile === "astra-claude"
+          ? (agent.name === "nccgs-adversarial-reviewer" ? "high" : "xhigh") : null;
+        assert.equal(text.match(/^effort:\s*(\S+)/m)?.[1] ?? null, expectedEffort, agent.name);
+      }
+    }
+    const file = path.join(temp, ".claude/agents/nccgs-adversarial-reviewer.md");
+    const before = fs.readFileSync(file, "utf8");
+    assert.equal(run("inherit", "--skip-path", ".claude/agents/nccgs-adversarial-reviewer.md").status, 0);
+    assert.equal(fs.readFileSync(file, "utf8"), before);
+    const invalid = run("unknown");
+    assert.notEqual(invalid.status, 0);
+    assert.equal(fs.readFileSync(file, "utf8"), before);
+    fs.writeFileSync(path.join(temp, ".claude/settings.json"), "invalid JSON");
+    assert.notEqual(run("astra-claude").status, 0);
+    assert.equal(fs.readFileSync(file, "utf8"), before);
+    const other = fs.readFileSync(path.join(temp, ".claude/agents/nccgs-unity-implementer.md"), "utf8");
+    assert.ok(!/^model:/m.test(other), "invalid settings must fail before rewriting agents");
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
 test("migrate-project defaults to a single full run", () => {
-  const skill = fs.readFileSync(path.join(root, ".claude/skills/migrate-project/SKILL.md"), "utf8");
+  const skill = fs.readFileSync(path.join(root, ".claude/skills/migrate-project/references/legacy.md"), "utf8");
   assert.match(skill, /Default to `full`/);
   assert.match(skill, /review, plan, apply, and verify in one invocation/i);
 });
@@ -42,7 +183,7 @@ test("model configurator can remove and restore model pins", () => {
     fs.copyFileSync(path.join(root, ".claude/nccgs/studio.json"), path.join(temp, ".claude/nccgs/studio.json"));
     fs.copyFileSync(path.join(root, ".claude/nccgs/tools/configure-models.mjs"), path.join(temp, ".claude/nccgs/tools/configure-models.mjs"));
     fs.writeFileSync(path.join(temp, ".nccgs/project.yaml"), "models:\n  profile: quality\n", "utf8");
-    for (const agent of studio.agents) fs.copyFileSync(path.join(root, ".claude/agents", `${agent.name}.md`), path.join(temp, ".claude/agents", `${agent.name}.md`));
+    copyAgentFixture(temp);
     const tool = path.join(temp, ".claude/nccgs/tools/configure-models.mjs");
     assert.equal(spawnSync(process.execPath, [tool, "--project", temp, "--profile", "inherit"]).status, 0);
     assert.ok(!/^model:/m.test(fs.readFileSync(path.join(temp, ".claude/agents", `${studio.agents[0].name}.md`), "utf8")));
@@ -129,7 +270,7 @@ test("installer preserves project truth, merges settings, and applies inherit pr
   }
 });
 
-test("update replaces untouched managed files, blocks local edits, and doctor verifies state", () => {
+test("update replaces untouched files, preserves local overrides, and doctor gates review", () => {
   const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-idempotent-update-test-"));
   try {
     for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
@@ -148,20 +289,84 @@ test("update replaces untouched managed files, blocks local edits, and doctor ve
 
     const update = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "update"], { cwd: temp, encoding: "utf8" });
     assert.equal(update.status, 0, update.stderr || update.stdout);
-    assert.match(update.stdout, /1\.0\.0 -> 1\.1\.0/);
+    assert.match(update.stdout, new RegExp(`1\\.0\\.0 -> ${frameworkVersion.replace(/\./g, "\\.")}`));
     assert.match(update.stdout, /automatic update/);
     assert.match(update.stdout, /No project migration required/);
     assert.equal(fs.readFileSync(managedPath, "utf8"), fs.readFileSync(path.join(root, managedRelative), "utf8"));
 
-    const doctor = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "doctor"], { cwd: temp, encoding: "utf8" });
+    let doctor = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "doctor"], { cwd: temp, encoding: "utf8" });
     assert.equal(doctor.status, 0, doctor.stderr || doctor.stdout);
     assert.match(doctor.stdout, /NCCGS doctor passed/);
 
     fs.writeFileSync(managedPath, "project-local override\n", "utf8");
-    const blocked = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "update", "--dry-run"], { cwd: temp, encoding: "utf8" });
-    assert.equal(blocked.status, 2);
-    assert.match(blocked.stderr, /modified/);
+    const preserved = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "update"], { cwd: temp, encoding: "utf8" });
+    assert.equal(preserved.status, 0, preserved.stderr || preserved.stdout);
+    assert.match(preserved.stdout, /preserved override/);
+    assert.match(preserved.stdout, /Project migration required/);
     assert.equal(fs.readFileSync(managedPath, "utf8"), "project-local override\n");
+
+    const overridePath = path.join(temp, ".nccgs/framework-overrides.json");
+    const overrides = JSON.parse(fs.readFileSync(overridePath, "utf8"));
+    const override = overrides.overrides.find((item) => item.path === managedRelative);
+    assert.equal(override.status, "pending_review");
+    assert.equal(override.disposition, "preserve");
+
+    doctor = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "doctor"], { cwd: temp, encoding: "utf8" });
+    assert.equal(doctor.status, 1);
+    assert.match(doctor.stderr, /awaits \/migrate-project review/);
+
+    const approve = spawnSync(process.execPath, [path.join(temp, ".claude/nccgs/tools/approve-overrides.mjs"), "--project", temp, "--approve-pending"], { cwd: temp, encoding: "utf8" });
+    assert.equal(approve.status, 0, approve.stderr || approve.stdout);
+    doctor = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "doctor"], { cwd: temp, encoding: "utf8" });
+    assert.equal(doctor.status, 0, doctor.stderr || doctor.stdout);
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test("doctor accepts a legacy CRLF raw hash after Git normalizes the file to LF", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-eol-test-"));
+  try {
+    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
+    const install = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "install"], { cwd: temp, encoding: "utf8" });
+    assert.equal(install.status, 0, install.stderr || install.stdout);
+
+    const relative = ".claude/nccgs/constitution.md";
+    const file = path.join(temp, ...relative.split("/"));
+    const lf = fs.readFileSync(file, "utf8").replace(/\r\n?/g, "\n");
+    fs.writeFileSync(file, lf, "utf8");
+    const statePath = path.join(temp, ".claude/nccgs/install-state.json");
+    const state = JSON.parse(fs.readFileSync(statePath, "utf8"));
+    const record = state.files.find((item) => item.relative === relative);
+    record.sha256 = sha256(lf.replace(/\n/g, "\r\n"));
+    delete record.canonicalSha256;
+    state.schemaVersion = 2;
+    fs.writeFileSync(statePath, `${JSON.stringify(state, null, 2)}\n`, "utf8");
+
+    const doctor = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "doctor"], { cwd: temp, encoding: "utf8" });
+    assert.equal(doctor.status, 0, doctor.stderr || doctor.stdout);
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true });
+  }
+});
+
+test("update preserves an intentionally missing managed file until migration review", () => {
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-absent-override-test-"));
+  try {
+    for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(temp, marker));
+    const install = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "install"], { cwd: temp, encoding: "utf8" });
+    assert.equal(install.status, 0, install.stderr || install.stdout);
+
+    const relative = ".claude/skills/status/SKILL.md";
+    const file = path.join(temp, ...relative.split("/"));
+    fs.unlinkSync(file);
+    const update = spawnSync(process.execPath, [path.join(root, "scripts/cli.mjs"), "update"], { cwd: temp, encoding: "utf8" });
+    assert.equal(update.status, 0, update.stderr || update.stdout);
+    assert.ok(!fs.existsSync(file));
+    const manifest = JSON.parse(fs.readFileSync(path.join(temp, ".nccgs/framework-overrides.json"), "utf8"));
+    const override = manifest.overrides.find((item) => item.path === relative);
+    assert.equal(override.disposition, "absent");
+    assert.equal(override.status, "pending_review");
   } finally {
     fs.rmSync(temp, { recursive: true, force: true });
   }

package/tests/gates.test.mjs

@@ -0,0 +1,170 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import test from "node:test";
+import { initialize, snapshot, record, check, close, taskPath } from "../.claude/nccgs/tools/gates.mjs";
+import { artifact, atomicJson, json, hash } from "../.claude/nccgs/tools/policy.mjs";
+import { run } from "../.claude/nccgs/tools/task.mjs";
+import { observe } from "../.claude/nccgs/tools/runtime.mjs";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+function fixture(options = {}) {
+  const project = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-gates-"));
+  const write = (name, value) => {
+    const file = path.join(project, name);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, typeof value === "string" ? value : JSON.stringify(value));
+    return artifact(project, name);
+  };
+  for (const file of ["pipeline.json", "studio.json"]) write(`.claude/nccgs/${file}`, fs.readFileSync(path.join(root, ".claude/nccgs", file), "utf8"));
+  const policy = write(".nccgs/project.yaml", "schema_version: 2\nmodels:\n  profile: astra-claude\n");
+  write(".nccgs/gates.json", { schemaVersion: 1, policySha256: policy.sha256, requiredChecks: ["regression"], requiredArtifacts: options.artifacts ?? [], manualGates: options.manual ?? [] });
+  write("Assets/game.cs", "// initial implementation\n");
+  write(".nccgs/plan.md", "Astra plan: preserve health invariant and verify regression.");
+  initialize(project, "feature", ".nccgs/plan.md");
+  let index = 0;
+  const snap = () => snapshot(project).sha256;
+  const task = () => json(taskPath(project, "feature"));
+  function runtime(stage, overrides = {}) {
+    const source = `.nccgs/evidence/raw-${++index}.json`;
+    write(source, { taskId: "feature", snapshot: snap(), sessionId: "session", agentId: stage,
+      observedModel: stage === "implementation" ? "claude-opus-5-5" : "claude-fable-5-1",
+      observedEffort: stage === "implementation" ? "xhigh" : "high", capturedAt: new Date().toISOString(),
+      status: "completed", provenance: { kind: "provider-log", reference: "test fixture: captured runtime request metadata" }, ...overrides });
+    return run(["observe", "--project", project, "--id", "feature", "--file", source]);
+  }
+  const impl = (overrides = {}) => record(project, "feature", "implementation", { snapshot: snap(), runtime: runtime("implementation"),
+    checks: [{ name: "regression", status: "PASS", evidence: write(`.nccgs/evidence/test-${++index}.log`, "fixture regression: PASS") }], ...overrides });
+  const review = (overrides = {}) => record(project, "feature", "review", { snapshot: snap(), runtime: runtime("review"), verdict: "PASS", criteriaMet: true, findings: [], evidence: write(`.nccgs/evidence/review-${++index}.md`, "Fixture independent review findings: none"), ...overrides });
+  const report = (overrides = {}) => record(project, "feature", "report", { snapshot: snap(), evidence: write(`.nccgs/evidence/report-${++index}.md`, "Fixture report, review reference and evidence"), ...overrides });
+  const approval = (stage, overrides = {}) => record(project, "feature", stage, { snapshot: snap(), evidence: write(`.nccgs/approvals/${stage}-${++index}.json`, {
+    actor: stage === "astra" ? "Astra" : "Product Owner", decision: stage === "astra" ? "PASS" : "ACCEPTED",
+    taskId: "feature", snapshot: snap(), decidedAt: new Date().toISOString(), statement: "Explicit TEST FIXTURE approval", reference: "test-only external decision event", ...overrides }) });
+  return { project, write, snap, task, runtime, impl, review, report, approval,
+    dispose() {
+      const resolved = path.resolve(project);
+      assert.ok(resolved.startsWith(path.resolve(os.tmpdir()) + path.sep + "nccgs-gates-"));
+      fs.rmSync(resolved, { recursive: true, force: true });
+    } };
+}
+
+test("end-to-end gates require Fable, Astra and explicit acceptance in order", () => {
+  const f = fixture();
+  try {
+    assert.throws(() => close(f.project, "feature"), /implementation: missing/);
+    assert.throws(() => f.report(), /implementation: missing/);
+    f.impl();
+    assert.throws(() => f.report(), /review: missing/);
+    f.review();
+    assert.equal(check(f.project, f.task(), "report").allowed, true);
+    f.report();
+    assert.throws(() => close(f.project, "feature"), /astra: missing/);
+    f.approval("astra");
+    assert.throws(() => close(f.project, "feature"), /acceptance: missing/);
+    f.approval("acceptance");
+    assert.equal(close(f.project, "feature").phase, "DONE");
+  } finally { f.dispose(); }
+});
+
+test("source additions, deletions and edits invalidate review and approvals", () => {
+  const f = fixture();
+  try {
+    f.impl(); f.review(); f.report(); f.approval("astra"); f.approval("acceptance"); close(f.project, "feature");
+    const before = f.snap();
+    f.write("Assets/new.cs", "untracked new source");
+    assert.notEqual(f.snap(), before);
+    assert.throws(() => close(f.project, "feature"), /stale/);
+    fs.unlinkSync(path.join(f.project, "Assets/game.cs"));
+    assert.throws(() => check(f.project, f.task(), "report"), /stale/);
+    f.impl();
+    assert.deepEqual(Object.keys(f.task().stages), ["implementation"]);
+    assert.equal(f.task().closed, undefined);
+    assert.ok(f.task().history.length > 0);
+    assert.throws(() => f.report(), /review: missing/);
+  } finally { f.dispose(); }
+});
+
+test("unknown effort, wrong model, fallback, and same-agent review cannot pass", () => {
+  const f = fixture();
+  try {
+    assert.throws(() => f.impl({ runtime: f.runtime("implementation", { observedEffort: "high" }) }), /effort/);
+    assert.throws(() => f.impl({ runtime: f.runtime("implementation", { observedModel: "claude-sonnet-4-6" }) }), /model/);
+    f.impl();
+    assert.throws(() => f.review({ runtime: f.runtime("review", { agentId: "implementation" }) }), /independent/);
+    assert.throws(() => f.review({ runtime: f.runtime("review", { modelsUsed: ["claude-fable-5-1", "claude-opus-5-5"] }) }), /fallback/);
+    const event = observe(f.project, { session_id: "session", tool_input: { subagent_type: "nccgs-adversarial-reviewer" }, tool_response: { resolvedModel: "claude-fable-5-1", status: "completed", agentId: "native-review" } }, "agent_result");
+    assert.equal(event.observedEffort, null);
+    assert.equal(event.requestedEffort, "high");
+    assert.ok(event.missing.includes("effort"));
+    const ref = f.write(".nccgs/evidence/unknown-effort.json", { ...event, taskId: "feature", snapshot: f.snap() });
+    assert.throws(() => f.review({ runtime: ref }), /effort/);
+  } finally { f.dispose(); }
+});
+
+test("negative review and rejection remain blocking; amended evidence invalidates results", () => {
+  const f = fixture();
+  try {
+    f.impl(); f.review({ verdict: "CHANGES_REQUIRED", findings: [{ severity: "HIGH", status: "OPEN" }] });
+    assert.throws(() => f.report(), /not passed/);
+    assert.throws(() => f.review({ findings: [{ severity: "HIGH", status: "OPEN" }] }), /blocking findings/);
+    f.review(); f.report(); f.approval("astra"); f.approval("acceptance");
+    f.approval("acceptance", { decision: "REJECTED" });
+    assert.throws(() => close(f.project, "feature"), /explicit Product Owner/);
+    const evidence = f.task().stages.review.evidence;
+    f.write(evidence.path, "altered review");
+    assert.throws(() => check(f.project, f.task(), "report"), /stale artifact/);
+  } finally { f.dispose(); }
+});
+
+test("required checks, closure artifacts, manual gates and policy hashes are enforced", () => {
+  const f = fixture({ artifacts: [".nccgs/evidence/build.log"], manual: ["playtest"] });
+  try {
+    assert.throws(() => f.impl({ checks: [{ name: "unrelated", status: "PASS", evidence: f.write(".nccgs/evidence/unrelated.log", "PASS") }] }), /Required check missing/);
+    f.impl(); f.review();
+    assert.throws(() => f.report(), /closure artifact missing/);
+    f.report({ artifacts: [f.write(".nccgs/evidence/build.log", "Build successful")] });
+    f.approval("astra");
+    assert.throws(() => f.approval("acceptance"), /Manual gate missing/);
+    f.approval("acceptance", { gates: [{ id: "playtest", decision: "ACCEPTED", reference: "test fixture playtest decision" }] });
+    close(f.project, "feature");
+    f.write(".nccgs/plan.md", "Changed plan");
+    assert.throws(() => close(f.project, "feature"), /stale artifact/);
+  } finally { f.dispose(); }
+});
+
+test("path traversal and premature/fabricated external sign-offs fail", () => {
+  const f = fixture();
+  try {
+    assert.throws(() => taskPath(f.project, "../escape"), /Invalid task/);
+    assert.throws(() => artifact(f.project, "../outside.txt"), /escapes/);
+    f.impl(); f.review(); f.report();
+    assert.throws(() => f.approval("astra", { actor: "Claude" }), /explicit Astra/);
+    assert.throws(() => f.approval("astra", { decidedAt: "2000-01-01T00:00:00.000Z" }), /predates/);
+    const old = process.env.CLAUDECODE;
+    try { process.env.CLAUDECODE = "1"; assert.throws(() => f.approval("astra"), /outside the Claude/); }
+    finally { if (old === undefined) delete process.env.CLAUDECODE; else process.env.CLAUDECODE = old; }
+    const guard = spawnSync(process.execPath, [path.join(root, ".claude/nccgs/hooks/closure-guard.mjs"), "pre"], {
+      cwd: f.project, encoding: "utf8", input: JSON.stringify({ session_id: "session", tool_input: { file_path: path.join(f.project, ".nccgs/state.md"), content: "Final state: DONE" } }) });
+    assert.equal(guard.status, 2);
+    assert.match(guard.stderr, /bound to an NCCGS task/);
+  } finally { f.dispose(); }
+});
+
+test("verification runner captures real exit status and rejects changed logs", () => {
+  const f = fixture();
+  try {
+    const execute = source => run(["verify", "--project", f.project, "--id", "feature", "--name", "regression", "--", process.execPath, "-e", source]);
+    const failed = execute("process.exit(3)");
+    assert.equal(failed.status, "FAIL");
+    assert.throws(() => f.impl({ checks: [failed] }), /failed\/unproven/);
+    const passed = execute("console.log('fixture verification passed')");
+    assert.equal(passed.status, "PASS");
+    f.impl({ checks: [passed] });
+    const execution = json(path.join(f.project, passed.evidence.path));
+    f.write(execution.log.path, "tampered log");
+    assert.throws(() => check(f.project, f.task(), "review"), /stale artifact/);
+  } finally { f.dispose(); }
+});