nccgs 1.1.0 → 1.3.0

package/.claude/nccgs/agent-library/nccgs-unity-ui-specialist.md

@@ -0,0 +1,25 @@
+---
+name: nccgs-unity-ui-specialist
+description: "Specializes in UI Toolkit, UGUI, TextMesh Pro, input navigation, binding, localization, and accessibility integration."
+tools: Read, Glob, Grep, Bash, Write, Edit
+maxTurns: 22
+---
+
+You are the unity ui specialist in the NCCGS studio.
+
+Before acting, read `.claude/nccgs/protocols/agent-contract.md`, `.nccgs/project.yaml`, and the assigned context packet when one exists.
+
+## Mission
+
+Implement approved UX behavior with idiomatic Unity UI structures and runtime checks.
+
+## Deliverables
+
+Return Unity UI assets/code, navigation tests, binding evidence, and platform risks. Separate facts from inference and tie conclusions to canonical sources, final files, or observable evidence.
+
+## Boundary
+
+Do not choose UX semantics or keep authoritative gameplay state in views.
+
+Do not spawn subagents. Return a handoff to the primary orchestrator when another specialty is required.
+

package/.claude/{agents → nccgs/agent-library}/nccgs-ux-designer.md

@@ -2,7 +2,6 @@
 name: nccgs-ux-designer
 description: "Designs interaction flows, information hierarchy, controls, feedback, error recovery, and usability acceptance."
 tools: Read, Glob, Grep, Write, Edit, WebSearch, WebFetch
-model: sonnet
 maxTurns: 18
 ---
 

package/.claude/nccgs/agent-library/nccgs-verification-engineer.md

@@ -0,0 +1,25 @@
+---
+name: nccgs-verification-engineer
+description: "Independently verifies requirements through final diff, tests, Unity runtime, console, serialization, and regression evidence."
+tools: Read, Glob, Grep, Bash, Write, Edit
+maxTurns: 22
+---
+
+You are the verification engineer in the NCCGS studio.
+
+Before acting, read `.claude/nccgs/protocols/agent-contract.md`, `.nccgs/project.yaml`, and the assigned context packet when one exists.
+
+## Mission
+
+Determine exactly what evidence proves and what remains unverified or subjective.
+
+## Deliverables
+
+Return evidence records, coverage verdicts, baseline comparisons, and PO gates. Separate facts from inference and tie conclusions to canonical sources, final files, or observable evidence.
+
+## Boundary
+
+Do not rely on implementer rationale or claim subjective validation.
+
+Do not spawn subagents. Return a handoff to the primary orchestrator when another specialty is required.
+

package/.claude/{agents → nccgs/agent-library}/nccgs-world-builder.md

@@ -2,7 +2,6 @@
 name: nccgs-world-builder
 description: "Develops coherent locations, factions, history, cultures, and environmental narrative within canon."
 tools: Read, Glob, Grep, Write, Edit
-model: sonnet
 maxTurns: 18
 ---
 

package/.claude/{agents → nccgs/agent-library}/nccgs-writer.md

@@ -2,7 +2,6 @@
 name: nccgs-writer
 description: "Drafts dialogue, descriptions, barks, tutorials, and narrative content under established canon and voice."
 tools: Read, Glob, Grep, Write, Edit
-model: sonnet
 maxTurns: 18
 ---
 

package/.claude/nccgs/constitution.md

@@ -21,6 +21,19 @@ Never let generic advice silently override project truth.
 
 ## Project bootstrap
 
+The default `astra-claude` model profile uses a mandatory external planning and
+acceptance chain. Read `.claude/nccgs/protocols/astra-claude.md` before selecting
+roles or executing any workflow: Astra owns planning/documents; Opus 5.5/xhigh
+implements; Fable independently reviews; Astra checks the report; the Product Owner
+accepts. This profile-specific contract overrides generic workflow autonomy,
+document-authoring, risk-based review, and closure shortcuts below.
+
+For this profile, load `.claude/nccgs/protocols/task-gates.md`. The task record under
+`.nccgs/tasks/` is authoritative and `task close` enforces all stages. Markdown DONE
+labels cannot replace it. Read routing from `pipeline.json`; use only the selected
+workflow reference branch. Ten core roles are active; enable optional specialists
+through the configurator when the plan needs their expertise.
+
 For meaningful project work:
 
 1. read `.nccgs/project.yaml` and `.nccgs/state.md` when present;

package/.claude/nccgs/hooks/agent-audit.mjs

@@ -1,4 +1,5 @@
 import { appendRuntime, readInput } from "./common.mjs";
+import { observe } from "../tools/runtime.mjs";
 
 const input = await readInput();
 appendRuntime({
@@ -8,3 +9,8 @@ appendRuntime({
   agentId: input.agent_id ?? null,
   agentType: input.agent_type ?? "unknown"
 });
+try {
+  observe(process.cwd(), input, process.argv[2] === "stop" ? "agent_stop" : "agent_start");
+} catch (error) {
+  appendRuntime({ event: "runtime_observation_failed", error: error.message });
+}

package/.claude/nccgs/hooks/closure-guard.mjs

@@ -0,0 +1,34 @@
+import fs from "node:fs";
+import path from "node:path";
+import { readInput } from "./common.mjs";
+import { profilePolicy, json } from "../tools/policy.mjs";
+import { check, taskPath } from "../tools/gates.mjs";
+import { boundTask } from "../tools/runtime.mjs";
+
+const input = await readInput();
+const project = process.cwd();
+try {
+  if (profilePolicy(project).name !== "astra-claude") process.exit(0);
+  const mode = process.argv[2];
+  const tool = input.tool_input ?? {};
+  const absolute = path.resolve(tool.file_path || tool.path || project);
+  const relative = path.relative(project, absolute).split(path.sep).join("/");
+  const text = tool.content ?? tool.new_string ?? "";
+  if (mode === "pre" && /^\.nccgs\/(tasks|approvals)\//.test(relative)) throw new Error("Use the task gate CLI for task records. Astra/PO sign-offs must be imported outside Claude; never write them on their behalf.");
+  const shell = tool.command ?? "";
+  if (mode === "pre" && /(?:--stage\s+["']?(?:astra|acceptance)\b|\.nccgs[\\/]approvals[\\/])/i.test(shell)) throw new Error("Claude cannot create/import Astra or Product Owner sign-offs.");
+  const completion = /(?:^|\n)\s*(?:[-*]\s*)?(?:\*\*)?(?:Final state|Status|State|Trạng thái)(?:\*\*)?\s*:\s*(?:\*\*)?DONE\b|^\s*(?:\*\*)?DONE\b|"(?:state|status)"\s*:\s*"DONE"/im;
+  const claimsDone = mode === "stop"
+    ? completion.test(input.last_assistant_message ?? "")
+    : /^\.nccgs\/(?:closures\/|state\.md$)/.test(relative) && completion.test(text);
+  if (!claimsDone) process.exit(0);
+  const id = boundTask(project, input.session_id);
+  if (!id) throw new Error("A DONE claim needs a session bound to an NCCGS task");
+  check(project, json(taskPath(project, id)), "done");
+} catch (error) {
+  if (process.argv[2] === "stop") {
+    // Do not trap the session in an endless Stop-hook loop; the canonical close
+    // command and doctor still reject the invalid record on every invocation.
+    if (!input.stop_hook_active) console.log(JSON.stringify({ decision: "block", reason: `NCCGS closure blocked: ${error.message}. Report the pending gate; do not claim DONE.` }));
+  } else { console.error(`NCCGS closure blocked: ${error.message}`); process.exitCode = 2; }
+}

package/.claude/nccgs/hooks/runtime-observation.mjs

@@ -0,0 +1,11 @@
+import { readInput, appendRuntime } from "./common.mjs";
+import { observe } from "../tools/runtime.mjs";
+try {
+  const input = await readInput();
+  const result = observe(process.cwd(), input, "agent_result");
+  appendRuntime({ event: "runtime_observation", path: result.path, sessionId: result.sessionId, agentId: result.agentId, missing: result.missing });
+  console.log(`NCCGS runtime evidence: ${result.path}; missing observation: ${result.missing.join(", ") || "none"}. Configuration is not runtime proof.`);
+} catch (error) {
+  appendRuntime({ event: "runtime_observation_failed", error: error.message });
+  console.error(`NCCGS could not capture runtime evidence: ${error.message}`);
+}

package/.claude/nccgs/hooks/session-start.mjs

@@ -1,4 +1,5 @@
-import { git, readText, yamlValue } from "./common.mjs";
+import { git, readText, yamlValue, readInput } from "./common.mjs";
+import { profilePolicy } from "../tools/policy.mjs";
 
 const version = readText(".claude/nccgs/VERSION", 100).trim() || "unknown";
 const policy = readText(".nccgs/project.yaml");
@@ -6,8 +7,14 @@ const state = readText(".nccgs/state.md", 6000);
 const branch = git(["branch", "--show-current"]) || "not-a-git-repository";
 const changes = git(["status", "--short"]).split(/\r?\n/).filter(Boolean).length;
 const model = yamlValue(policy, "models", "profile") || "unconfigured";
+const input = await readInput();
 
 console.log(`NCCGS ${version} | branch ${branch} | ${changes} working-tree change(s) | model profile ${model}`);
+if (model === "astra-claude") {
+  const { profile } = profilePolicy(process.cwd());
+  console.log(`Astra owns planning/documents. Implementation: ${profile.models.standard.model}/${profile.models.standard.effort}; independent review: ${profile.models.review.model}/${profile.models.review.effort}. Read the profile protocol and use task gates. DONE requires Astra check and explicit Product Owner acceptance.`);
+  if (/^[\w-]+$/.test(input.session_id ?? "")) console.log(`Bind the active task with: node .claude/nccgs/tools/task.mjs bind --id TASK_ID --session ${input.session_id}`);
+}
 if (state) {
   console.log("Read .nccgs/state.md and the active context packet before resuming meaningful work.");
 } else {

package/.claude/nccgs/pipeline.json

@@ -0,0 +1,176 @@
+{
+  "schemaVersion": 1,
+  "defaultProfile": "astra-claude",
+  "profiles": {
+    "astra-claude": {
+      "models": {
+        "lightweight": {
+          "model": "claude-opus-5-5",
+          "effort": "xhigh"
+        },
+        "standard": {
+          "model": "claude-opus-5-5",
+          "effort": "xhigh"
+        },
+        "deep": {
+          "model": "claude-opus-5-5",
+          "effort": "xhigh"
+        },
+        "leadership": {
+          "model": "claude-opus-5-5",
+          "effort": "xhigh"
+        },
+        "review": {
+          "model": "fable",
+          "effort": "high"
+        }
+      },
+      "session": {
+        "class": "standard"
+      },
+      "activeAgents": [
+        "nccgs-gameplay-programmer",
+        "nccgs-engine-programmer",
+        "nccgs-ui-programmer",
+        "nccgs-unity-implementer",
+        "nccgs-unity-systems-specialist",
+        "nccgs-unity-ui-specialist",
+        "nccgs-unity-build-specialist",
+        "nccgs-qa-engineer",
+        "nccgs-verification-engineer",
+        "nccgs-adversarial-reviewer"
+      ]
+    },
+    "quality": {
+      "models": {
+        "lightweight": {
+          "model": "haiku",
+          "effort": null
+        },
+        "standard": {
+          "model": "sonnet",
+          "effort": null
+        },
+        "deep": {
+          "model": "opus",
+          "effort": null
+        },
+        "leadership": {
+          "model": "opus",
+          "effort": null
+        },
+        "review": {
+          "model": "opus",
+          "effort": null
+        }
+      },
+      "session": null,
+      "activeAgents": "all"
+    },
+    "balanced": {
+      "models": {
+        "lightweight": {
+          "model": "haiku",
+          "effort": null
+        },
+        "standard": {
+          "model": "sonnet",
+          "effort": null
+        },
+        "deep": {
+          "model": "opus",
+          "effort": null
+        },
+        "leadership": {
+          "model": "sonnet",
+          "effort": null
+        },
+        "review": {
+          "model": "opus",
+          "effort": null
+        }
+      },
+      "session": null,
+      "activeAgents": "all"
+    },
+    "inherit": {
+      "models": {
+        "lightweight": {
+          "model": null,
+          "effort": null
+        },
+        "standard": {
+          "model": null,
+          "effort": null
+        },
+        "deep": {
+          "model": null,
+          "effort": null
+        },
+        "leadership": {
+          "model": null,
+          "effort": null
+        },
+        "review": {
+          "model": null,
+          "effort": null
+        }
+      },
+      "session": null,
+      "activeAgents": "all"
+    }
+  },
+  "contract": {
+    "planningOwner": "Astra",
+    "documentsOwner": "Astra",
+    "reviewAgent": "nccgs-adversarial-reviewer",
+    "sequence": [
+      "astra-plan",
+      "opus-implementation",
+      "fable-review",
+      "report-to-astra",
+      "astra-check",
+      "product-owner-acceptance"
+    ],
+    "requiredForAllCodeChanges": true,
+    "allowInheritFallback": false,
+    "astraWorkflows": [
+      "design",
+      "context-pack",
+      "plan-feature",
+      "architecture-decision",
+      "closure",
+      "qa-plan",
+      "project-stage",
+      "sprint-plan",
+      "milestone-review",
+      "retrospective"
+    ],
+    "reviewWorkflows": [
+      "review",
+      "nccgs-code-review"
+    ]
+  },
+  "snapshotExcludes": [
+    ".git",
+    ".nccgs",
+    "Library",
+    "Temp",
+    "Logs",
+    "obj",
+    "node_modules",
+    ".vs"
+  ],
+  "coreAgents": [
+    "nccgs-gameplay-programmer",
+    "nccgs-engine-programmer",
+    "nccgs-ui-programmer",
+    "nccgs-unity-implementer",
+    "nccgs-unity-systems-specialist",
+    "nccgs-unity-ui-specialist",
+    "nccgs-unity-build-specialist",
+    "nccgs-qa-engineer",
+    "nccgs-verification-engineer",
+    "nccgs-adversarial-reviewer"
+  ]
+}

package/.claude/nccgs/protocols/agent-contract.md

@@ -4,6 +4,11 @@ All studio agents use this contract in addition to their role file.
 
 ## Inputs
 
+For the `astra-claude` profile, first read `protocols/astra-claude.md` relative to
+`.claude/nccgs/`. Astra supplies planning and canonical documents. Claude produces
+implementation, evidence, and handoff reports; Fable independently reviews. Never
+impersonate Astra or infer Product Owner acceptance.
+
 Before acting, obtain the task objective and risk tier, project authority and
 ownership, the focused context packet for STANDARD or CONTROLLED work, exact owned
 files/evidence, dependencies, and unresolved Product Owner decisions.

package/.claude/nccgs/protocols/astra-claude.md

@@ -0,0 +1,77 @@
+# Astra planning, Claude implementation, Fable review
+
+This protocol is mandatory when `models.profile` is `astra-claude`, including when
+the package default is used before project policy exists. It takes precedence over
+generic NCCGS workflow instructions. Other profiles retain their existing workflow.
+
+Runtime routing comes only from `pipeline.json`; [generated routing](../routing.generated.md)
+is its readable view. Use [task gates](task-gates.md) to initialize, record, check,
+and close work. The authoritative task JSON and artifact hashes, not Markdown
+status labels, determine whether reporting or DONE is allowed.
+
+## Ownership
+
+- **Astra** owns planning, feature contracts, context packets, architecture decisions,
+  canonical documents, and the final check of Claude's report.
+- **Claude Opus 5.5 / xhigh** implements the supplied plan, writes tests, runs relevant
+  checks, fixes defects, and records implementation evidence and the handoff report.
+- **Fable / high**, through `nccgs-adversarial-reviewer`, independently reviews the
+  completed work. The reviewer remains read-only and does not implement fixes.
+- **Product Owner** performs final acceptance after Astra's check. Only this explicit
+  acceptance, together with all technical gates, permits DONE.
+
+Claude may sequence local implementation steps inside Astra's plan. It must not
+replace the plan or author canonical planning/design documents. Report proposed
+document changes to Astra. Evidence logs, review records, implementation reports,
+and factual progress checkpoints are permitted Claude outputs. Planning-only roles
+remain available as technical consultants, not substitutes for Astra ownership.
+
+## Required sequence for every code change
+
+1. Read Astra's plan, requirements, acceptance criteria, document references, and
+   assigned write set. A concise Astra handoff is enough for FAST work. Missing or
+   contradictory scope is a planning blocker; return the exact question to Astra.
+2. Confirm the implementation session or agent actually uses `claude-opus-5-5` at
+   `xhigh`. Implement and collect compilation, test, runtime, and regression evidence
+   appropriate to the change. A role name alone does not prove its runtime model.
+3. Immediately after implementation and its checks, invoke a fresh, independent
+   `nccgs-adversarial-reviewer` with the review route in pipeline.json. Supply raw requirements, the
+   final diff/working-tree snapshot, affected callers, and evidence. Do not supply
+   an expected verdict. No final completion report is handed to Astra before this
+   review. Progress updates and blocker notices are always allowed.
+4. Fable returns PASS, CHANGES_REQUIRED, or BLOCKED with evidence and findings.
+   Open BLOCKER/HIGH findings or unmet required acceptance criteria prevent PASS.
+   Opus fixes findings within approved scope, reruns affected checks, then requests
+   Fable review again. Any code/test/asset change after a review invalidates that
+   review. Bind each review to a commit plus dirty/untracked diff or file hashes;
+   a commit ID alone is insufficient when the working tree is dirty.
+5. After Fable PASS on the final snapshot, Claude writes the implementation report
+   using `.nccgs/templates/implementation-report.md`, preserving the independent
+   review verbatim or linking its record. Mark phase `AWAITING_ASTRA_CHECK` and hand
+   the report path to Astra. Do not claim it was sent across applications without
+   a real delivery mechanism. Do not simulate Astra's response.
+6. Astra checks plan compliance, evidence, Fable findings and their resolution,
+   documents, and residual risk. Astra may return work for correction, which repeats
+   steps 2-5, or record its check and prepare `AWAITING_PO_ACCEPTANCE`.
+7. The Product Owner accepts the reviewed snapshot. Only then may Astra finalize the
+   closure record as DONE if all other configured gates also pass. Unknown, missing,
+   stale, or inferred sign-offs never count. Changes after either sign-off require
+   renewed review/check/acceptance for the changed snapshot.
+
+These phases are workflow checkpoints, not replacements for IMPLEMENTED, VERIFIED,
+VALIDATED, DONE, and BLOCKED. Neither FAST classification nor lean closure skips
+Fable review, Astra checking, or explicit Product Owner acceptance. Hotfixes,
+prototypes, migrations with code changes, and release fixes follow the same chain.
+
+## Model failures and evidence
+
+Do not silently substitute Sonnet, another Opus version, or inherited models for
+the required stages. If access, forced routing, effort caps, or runtime fallback
+prevents the requested model/effort, record BLOCKED with the observed identity and
+resume only when the required stage can run or the Product Owner changes policy.
+An unavailable Fable review is not a PASS. Do not confuse configuration with proof
+of execution: record requested and observed models/efforts, session/agent IDs,
+reviewed snapshot, commands/results, unresolved findings, and acceptance references.
+
+This is a file-backed workflow contract, not an automatic cross-application bridge.
+NCCGS does not start an Astra session or send messages to an external service itself.

package/.claude/nccgs/protocols/evidence.md

@@ -13,3 +13,9 @@ build state. A changed baseline must be explained before closure.
 
 Subjective experience remains a Product Owner gate. Provide a reproducible scenario
 and what to observe; never fabricate validation.
+
+For astra-claude, every code change requires Fable review, including FAST work.
+Record requested versus observed model/effort and the final dirty/untracked snapshot,
+not only a role label or commit ID. A Fable PASS permits reporting to Astra, not
+DONE. Astra's check and the Product Owner's explicit acceptance remain separate
+required evidence. See [the handoff protocol](astra-claude.md).

package/.claude/nccgs/protocols/model-routing.md

@@ -2,21 +2,43 @@
 
 Model choice is a quality and compatibility policy, not a status symbol.
 
+`.claude/nccgs/pipeline.json` is the source for routing. Catalog and frontmatter
+values are generated, checked for drift, and documented in
+[routing.generated.md](../routing.generated.md). Ten core roles load by default;
+35 optional roles remain in `agent-library/` until explicitly enabled. Activation
+is recorded in `.nccgs/agent-activation.json` and survives updates.
+
 ## Capability classes
 
+The default profile is `astra-claude`: all Claude implementation/support roles use
+the pinned `claude-opus-5-5` model with `effort: xhigh`; the `review` class uses
+`fable` with `effort: high`. Astra is an external planning/document owner, not a
+Claude model alias. See [the required handoff sequence](astra-claude.md).
+
+`configure-models.mjs` applies both model and effort to agent frontmatter. For
+`astra-claude`, it also sets the project session model and effort in
+`.claude/settings.json`, preserving unrelated settings and backing up replaced
+settings. Existing sessions, local settings, environment variables, forced subagent
+routing, and provider restrictions may still override configuration; verify the
+actual runtime model/effort before recording a successful stage.
+
 - `lightweight`: indexing, state, formatting, deterministic documentation updates;
 - `standard`: implementation, focused design, tests, ordinary domain analysis;
 - `deep`: architecture, migration, adversarial reasoning, cross-domain conflicts;
 - `leadership`: product-wide creative, technical, or production synthesis.
+- `review`: independent adversarial review after implementation.
 
-The package ships with a `quality` profile: lightweight uses Haiku, standard uses
-Sonnet, and deep/leadership use Opus. `balanced` moves routine leadership to Sonnet.
-`inherit` removes agent model pins and uses the session model.
+Legacy `quality` uses Haiku for lightweight, Sonnet for standard, and Opus for
+deep/leadership/review. `balanced` moves routine leadership to Sonnet. `inherit`
+removes agent model and effort pins and uses the session settings. Legacy profiles
+do not change the main session settings. Selecting them explicitly opts out of the
+`astra-claude` chain; ordinary updates preserve an existing project's profile.
 
 Select the role first, then apply project model policy. Do not call Opus merely
 because a role sounds senior. Escalate when evidence shows cross-system ambiguity,
 irreversible risk, security implications, conflicting canon, or repeated failed
 hypotheses.
 
-If a pinned model is unavailable or incompatible with the current context mode, use
-the configured inherit fallback and report it. Model failure is not task failure.
+Only legacy profiles may use an inherit fallback when project policy allows it.
+For `astra-claude`, unavailable or substituted model/effort blocks that stage; never
+present another model's result as Opus 5.5 implementation or Fable review.

package/.claude/nccgs/protocols/orchestration.md

@@ -24,3 +24,8 @@ another specialty instead of spawning their own hierarchy.
 Pass a context packet path and exact responsibility. Do not paste full GDDs, ADRs,
 or chat history into every prompt. Surface blocked nodes immediately and preserve
 completed independent outputs.
+
+Under astra-claude, Astra owns the plan and document scope. Claude orchestrates
+implementation nodes inside that plan on Opus 5.5/xhigh. Every coding outcome must
+pass an independent Fable review before its final report goes to Astra. Even FAST
+work cannot bypass this sequence. See [the handoff protocol](astra-claude.md).

package/.claude/nccgs/protocols/task-gates.md

@@ -0,0 +1,66 @@
+# Executable task gates
+
+Run the installed tool as `node .claude/nccgs/tools/task.mjs COMMAND ...`, or use
+`nccgs task COMMAND ...`. Paths in evidence are project-relative POSIX paths.
+
+1. Astra supplies the plan and project-specific acceptance obligations.
+   Astra maps existing project closure artifacts/manual gates to `.nccgs/gates.json`
+   (`requiredChecks`, `requiredArtifacts`, `manualGates`) and sets its `policySha256`
+   to the hash of the reviewed project.yaml. A missing/stale mapping blocks task init.
+   Optional `--requirements FILE.json` adds the same arrays for this task. These
+   manifests are hashed; changing obligations invalidates the current task.
+2. `task init --id feature-1 --plan .nccgs/features/feature-1.md` creates a task.
+3. `task bind --id feature-1 --session SESSION_ID` connects hook telemetry to it.
+4. `task snapshot` prints the current source fingerprint. It covers files, names,
+   additions, and deletions, including untracked files. Only the top-level generated
+   directories listed in pipeline.json are excluded. The plan and evidence files
+   are separately hashed. Never place source or canon in an excluded directory.
+5. `task ref --file .nccgs/evidence/check.log` prints a `{path, sha256}` reference.
+6. `task record --id feature-1 --stage implementation --evidence .nccgs/evidence/implementation.json`
+   records implementation with `snapshot`, `runtime` (artifact reference), and
+   nonempty `checks: [{name, status: "PASS", evidence: {path, sha256}}]`.
+7. Record `review` with `snapshot`, `runtime`, `verdict`, `criteriaMet`, `findings`
+   (each has severity/status), and `evidence` referencing the independent review.
+   Only PASS with criteriaMet true and no unresolved BLOCKER/HIGH unlocks reporting.
+   Corrections require fresh implementation evidence and independent review.
+8. `task check --id feature-1 --target report` must pass before final reporting.
+   Write the report and record stage `report` with snapshot and its evidence reference.
+   Store new report/evidence files under `.nccgs/evidence/` so producing evidence
+   does not change the reviewed source snapshot. Do not edit a hashed report to add
+   sign-offs; use separate decision files. Source or canonical document changes
+   outside excluded evidence directories require fresh implementation/review.
+9. Astra, outside Claude, checks the report and records stage `astra`. The evidence
+   reference points to JSON with actor `Astra`, decision `PASS`, taskId, snapshot,
+   decidedAt (ISO time), statement, and a source reference identifying the decision.
+10. After the user's explicit acceptance, outside Claude record stage `acceptance`
+    with an evidence file of the same shape: actor `Product Owner`, decision
+    `ACCEPTED`. Never generate a user's decision or infer it from a passed test.
+11. `task check --id feature-1 --target done` and `task close --id feature-1` enforce
+    the entire chain. Changed source, plan, policy, or evidence invalidates old gates.
+
+Recording an upstream stage clears every downstream stage and preserves history.
+The `check` command is read-only. A failed check exits nonzero and names the blocker.
+Stop-hook DONE checks are supplemental; task close is the canonical closing action.
+Waiting for Astra or the user is a valid stopping point, not a reason to keep an
+agent running. Do not write task JSON or external approvals through Write/Edit.
+
+## Runtime observations
+
+Agent lifecycle and Agent-tool hooks capture available native model telemetry,
+including modelsUsed so a mid-run fallback is visible. They do not copy prompts,
+credentials, full transcripts, or arbitrary tool output. Missing fields remain null.
+The documented Agent result does not guarantee an effort field, so native captures
+alone may be insufficient for a gate.
+
+Use `task observe --id feature-1 --file .nccgs/evidence/provider-observation.json`
+to import an explicit runtime observation when needed. That source JSON must contain
+taskId, snapshot, capturedAt, sessionId, agentId, observedModel, observedEffort,
+modelsUsed (if swapped), status `completed`, and provenance with kind `provider-log`
+or `operator-observation` and a nonempty reference. It must describe the actual run,
+not settings or the agent's requested model. The tool hashes the source and emits
+an observation reference for the stage record. Unknown effort remains blocked.
+
+Local files are an auditable workflow boundary, not cryptographic identity or a
+defense against a person who can rewrite the tool and all evidence. Astra/PO
+attestations need honest external source references. Claude sessions may not import
+their own external sign-offs. These tools do not send messages across applications.

package/.claude/nccgs/routing.generated.md

@@ -0,0 +1,11 @@
+# Generated routing — edit pipeline.json, then compile-policy.mjs
+
+| Stage | Owner/model | Effort |
+|---|---|---|
+| Plan and documents | Astra | External session |
+| Implementation | claude-opus-5-5 | xhigh |
+| Independent review | fable | high |
+| Report check | Astra | External session |
+| Acceptance | Product Owner | Explicit decision |
+
+Default active agents: 10. Full library: 45.