nccgs 1.3.0 → 2.0.0-rc.2

package/tests/orchestration-v15.test.mjs

@@ -0,0 +1,545 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import test from "node:test";
+import { reserve, claim, complete, reconcile, status, checkpoint, resume, telemetry, validateStageDispatch, extendDispatch } from "../.claude/nccgs/tools/orchestration.mjs";
+import { snapshot } from "../.claude/nccgs/tools/gates.mjs";
+import { pinInputs } from "../.claude/nccgs/tools/inputs.mjs";
+import { artifact, atomicJson, hash, json } from "../.claude/nccgs/tools/policy.mjs";
+import { persistRuntimeObservation } from "../.claude/nccgs/tools/evidence.mjs";
+import { observe } from "../.claude/nccgs/tools/runtime.mjs";
+import { validateStandaloneRuntime, initializeStandalone, recordStandalone } from "../.claude/nccgs/tools/lifecycle.mjs";
+import { guardTool } from "../.claude/nccgs/tools/tool-guard.mjs";
+
+// These are synthetic framework fixtures, never Claude Code execution evidence.
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const moduleUrl = pathToFileURL(path.join(root, ".claude/nccgs/tools/orchestration.mjs")).href;
+const agents = { implementation: "nccgs-gameplay-programmer", analysis: "nccgs-task-scout", review: "nccgs-adversarial-reviewer" };
+function fixture() {
+  const temporaryRoot = fs.realpathSync(os.tmpdir());
+  const project = fs.mkdtempSync(path.join(temporaryRoot, "nccgs-orchestration-v15-"));
+  const write = (relative, value) => {
+    const file = path.join(project, relative);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, Buffer.isBuffer(value) || typeof value === "string" ? value : `${JSON.stringify(value, null, 2)}\n`);
+    return artifact(project, relative);
+  };
+  for (const name of ["pipeline.json", "studio.json"]) write(`.claude/nccgs/${name}`, fs.readFileSync(path.join(root, ".claude/nccgs", name)));
+  write(".nccgs/project.yaml", "schema_version: 2\nmodels:\n  profile: claude-standalone\n");
+  write(".nccgs/execution.json", { schemaVersion: 1, name: "standalone", externalReview: { mode: "off" }, acceptanceRequired: false, requireObservedEffort: false, maxParallelWorkers: 2 });
+  write("Assets/game.cs", "// TEST FIXTURE source, not a game implementation\n");
+  write(".nccgs/requirements.yaml", "schema_version: 1\nrequirements: []\n");
+  function task(id, overrides = {}) {
+    const mode = overrides.mode ?? "implement";
+    const contract = { schemaVersion: 1, revision: 1, mode, scope: "local", target: "production-change", acceptance: [], analysisArtifacts: [".nccgs/evidence/analysis/plan.md"] };
+    const value = { schemaVersion: 2, id, mode, risk: "STANDARD", profile: "claude-standalone", createdAt: new Date().toISOString(),
+      contract, contractHash: hash(JSON.stringify(contract)), reviewBudget: { used: 0, limit: 3, extensions: [] },
+      implementationRoute: { class: "standard", model: "claude-opus-5-5", effort: "medium" },
+      canonicalInputs: pinInputs(project), stages: {}, history: [], parentId: null, ...overrides };
+    write(`.nccgs/tasks/${id}.json`, value);
+    return value;
+  }
+  let serial = 0;
+  function request(kind, overrides = {}) {
+    return { requestKey: `fixture-request-${++serial}`, kind, agent: agents[kind], writePaths: kind === "implementation" ? ["Assets/game.cs"] : [],
+      reason: "TEST FIXTURE bounded work", ...overrides };
+  }
+  function start(id, req = request("analysis")) {
+    const reservation = reserve(project, id, req);
+    const identity = { sessionId: `session-${++serial}`, toolUseId: `tool-${serial}`, agent: req.agent, kind: req.kind };
+    claim(project, reservation.id, identity);
+    return { reservation, identity, request: req, taskId: id };
+  }
+  function observation(run, overrides = {}, rawOverrides = {}) {
+    const current = json(path.join(project, `.nccgs/tasks/${run.taskId}.json`));
+    const data = { schemaVersion: 1, origin: "runtime-observation", observedProvider: "claude-code",
+      dispatchId: run.reservation.id, taskId: run.taskId, contractHash: current.contractHash,
+      snapshot: snapshot(project).sha256, capturedAt: new Date().toISOString(),
+      sessionId: run.identity.sessionId, toolUseId: run.identity.toolUseId, agentId: `agent-${run.reservation.id}`,
+      agentType: run.request.agent, observedModel: "claude-opus-5-5", observedEffort: null, modelsUsed: ["claude-opus-5-5"],
+      status: "completed", durationMs: null, toolUseCount: null, totalTokens: null, costUsd: null,
+      provenance: { kind: "provider-log", reference: "SYNTHETIC TEST FIXTURE ONLY; not a real provider run" }, ...overrides };
+    const source = write(`.nccgs/evidence/runtime/sources/fixture-${++serial}.json`, { ...data, ...rawOverrides });
+    return persistRuntimeObservation(project, { ...data, observationSource: source }, source);
+  }
+  return { project, write, task, request, start, observation,
+    dispose() {
+      const resolved = path.resolve(project);
+      assert.equal(path.dirname(resolved).toLowerCase(), temporaryRoot.toLowerCase());
+      assert.ok(path.basename(resolved).startsWith("nccgs-orchestration-v15-"));
+      assert.equal(fs.lstatSync(resolved).isSymbolicLink(), false);
+      assert.equal(fs.realpathSync(resolved).toLowerCase(), resolved.toLowerCase());
+      fs.rmSync(resolved, { recursive: true, force: true });
+    } };
+}
+function external(action) {
+  const saved = [process.env.CLAUDECODE, process.env.CLAUDE_CODE_ENTRYPOINT];
+  delete process.env.CLAUDECODE; delete process.env.CLAUDE_CODE_ENTRYPOINT;
+  try { return action(); } finally {
+    for (const [index, name] of ["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT"].entries()) {
+      if (saved[index] === undefined) delete process.env[name]; else process.env[name] = saved[index];
+    }
+  }
+}
+function failRun(f, run) {
+  return external(() => reconcile(f.project, run.reservation.id, { status: "failed", reason: "TEST FIXTURE process confirmed terminated", reference: "TEST FIXTURE external process-exit receipt" }));
+}
+test("external dispatch extension keeps spent attempts and parent cap, and rejects live or native changes", () => {
+  const f = fixture();
+  try {
+    f.task("parent"); f.task("child", { parentId: "parent" });
+    const parent = f.start("parent", f.request("analysis", { limits: { maxDispatches: 2 } }));
+    failRun(f, parent);
+    const child = f.start("child", f.request("analysis", { limits: { maxDispatches: 1 } }));
+    const decision = { previousLimit: 1, maxDispatches: 2, reason: "External fixture allocation", reference: f.write(".nccgs/evidence/authority.json", { fixture: true }) };
+    assert.throws(() => guardTool(f.project, { session_id: "coordinator", tool_name: "Bash", tool_input: {
+      command: "node .claude/nccgs/tools/task.mjs extend-dispatch --id child --request .nccgs/evidence/authority.json"
+    } }), /External decisions/);
+    assert.throws(() => external(() => extendDispatch(f.project, "child", decision)), /active dispatches/);
+    failRun(f, child);
+    external(() => {
+      process.env.CLAUDECODE = "1";
+      try { assert.throws(() => extendDispatch(f.project, "child", decision), /external operator/); }
+      finally { delete process.env.CLAUDECODE; }
+      assert.throws(() => extendDispatch(f.project, "child", { ...decision, previousLimit: 0 }), /stale/);
+      assert.throws(() => extendDispatch(f.project, "child", { ...decision, maxDispatches: 1 }), /increase/);
+      extendDispatch(f.project, "child", decision);
+    });
+    assert.equal(status(f.project, "child").usage.dispatches, 1);
+    assert.equal(status(f.project, "child").limits.maxDispatches, 2);
+    assert.throws(() => reserve(f.project, "child", f.request("analysis")), /budget exhausted for parent/);
+    assert.equal(json(path.join(f.project, ".nccgs/orchestration.json")).events.filter(e => e.action === "extend-dispatch").length, 1);
+  } finally { f.dispose(); }
+});
+
+test("native invocation completion cannot replace a declared missing handoff", () => {
+  const f = fixture();
+  try {
+    const task = f.task("handoff"), request = f.request("analysis", { handoffPaths: [".nccgs/evidence/analysis/plan.md"] });
+    const run = f.start("handoff", request), runtime = f.observation(run);
+    const completed = complete(f.project, run.reservation.id, { runtime });
+    assert.equal(completed.status, "failed"); assert.equal(completed.workStatus, "incomplete"); assert.equal(completed.invocationStatus, "completed");
+    assert.equal(completed.handoff.status, "missing"); assert.equal(status(f.project, "handoff").usage.dispatches, 1);
+    const trace = json(path.join(f.project, runtime.path));
+    assert.throws(() => validateStageDispatch(f.project, task, { dispatchId: completed.id, snapshot: completed.completedSnapshot, runtime }, trace, "analysis"), /handoff artifacts are missing/);
+    f.write(".nccgs/evidence/analysis/plan.md", "Late text is not the original worker handoff");
+    assert.equal(reserve(f.project, "handoff", request).id, completed.id);
+    assert.throws(() => validateStageDispatch(f.project, task, { dispatchId: completed.id, snapshot: completed.completedSnapshot, runtime }, trace, "analysis"), /handoff artifacts are missing/);
+  } finally { f.dispose(); }
+});
+async function simultaneousReservations(project, id, requests) {
+  const code = `import { reserve } from ${JSON.stringify(moduleUrl)};
+process.on('message', message => {
+  if (message !== 'go') return;
+  try { process.send({ result: { ok: true, value: reserve(process.argv[1], process.argv[2], JSON.parse(process.argv[3])) } }); }
+  catch (error) { process.send({ result: { ok: false, error: error.message } }); }
+  process.disconnect();
+});
+process.send({ ready: true });`;
+  const children = [];
+  try {
+    const workers = requests.map(item => {
+      const taskId = item.taskId ?? id, request = item.request ?? item;
+      const child = spawn(process.execPath, ["--input-type=module", "-e", code, project, taskId, JSON.stringify(request)], { windowsHide: true, stdio: ["ignore", "pipe", "pipe", "ipc"] });
+      children.push(child);
+      let stderr = "";
+      child.stderr.on("data", chunk => { stderr += chunk; });
+      let received;
+      let readyResolve;
+      const ready = new Promise(resolve => { readyResolve = resolve; });
+      const result = new Promise((resolve, reject) => {
+        const timer = setTimeout(() => { child.kill(); reject(new Error("Race subprocess timeout")); }, 20000);
+        child.on("message", message => { if (message.ready) readyResolve(); if (message.result) received = message.result; });
+        child.on("error", error => { clearTimeout(timer); readyResolve(); reject(error); });
+        child.on("exit", code => {
+          clearTimeout(timer); readyResolve();
+          if (code !== 0 || !received) reject(new Error(`Race subprocess failed (${code}): ${stderr}`)); else resolve(received);
+        });
+      });
+      return { child, ready, result };
+    });
+    await Promise.all(workers.map(worker => worker.ready));
+    for (const worker of workers) if (worker.child.connected) worker.child.send("go");
+    return await Promise.all(workers.map(worker => worker.result));
+  } finally { for (const child of children) if (child.exitCode === null) child.kill(); }
+}
+
+test("reservation retry is idempotent but cannot replace an existing request", () => {
+  const f = fixture();
+  try {
+    f.task("task");
+    const request = f.request("analysis");
+    const first = reserve(f.project, "task", request);
+    assert.equal(reserve(f.project, "task", structuredClone(request)).id, first.id);
+    assert.equal(status(f.project, "task").reservations.length, 1);
+    assert.throws(() => reserve(f.project, "task", { ...request, reason: "Changed request under reused key" }), /key|request|duplicate|different/i);
+    assert.throws(() => reserve(f.project, "task", { ...request, requestKey: "" }), /key|request/i);
+  } finally { f.dispose(); }
+});
+
+test("project path ownership covers descendants and Windows case aliases", () => {
+  const f = fixture();
+  try {
+    for (const id of ["owner", "other"]) f.task(id);
+    reserve(f.project, "owner", f.request("implementation", { writePaths: ["Assets/Actors"] }));
+    assert.throws(() => reserve(f.project, "other", f.request("implementation", { writePaths: ["Assets/Actors/player.cs"] })), /path|writer|overlap|conflict/i);
+    if (process.platform === "win32") assert.throws(() => reserve(f.project, "other", f.request("implementation", { writePaths: ["assets/actors/player.cs"] })), /path|writer|overlap|conflict/i);
+    assert.throws(() => reserve(f.project, "other", f.request("implementation", { writePaths: ["../outside.cs"] })), /path|relative|outside|travers/i);
+    assert.equal(status(f.project, "other").reservations.length, 0);
+  } finally { f.dispose(); }
+});
+
+test("no more than two implementation workers reserve across separate tasks", () => {
+  const f = fixture();
+  try {
+    for (const id of ["one", "two", "three"]) f.task(id);
+    reserve(f.project, "one", f.request("implementation", { writePaths: ["Assets/One"] }));
+    reserve(f.project, "two", f.request("implementation", { writePaths: ["Assets/Two"] }));
+    assert.throws(() => reserve(f.project, "three", f.request("implementation", { writePaths: ["Assets/Three"] })), /parallel|worker|concurr|limit/i);
+  } finally { f.dispose(); }
+});
+
+test("audit and plan cannot reserve source writers; read-only roles cannot become implementers", () => {
+  const f = fixture();
+  try {
+    // Check role capability before reserving any other read-only work, so a
+    // concurrency conflict cannot accidentally satisfy the role assertion.
+    f.task("code");
+    assert.throws(() => reserve(f.project, "code", f.request("implementation", { agent: agents.analysis })), /read.only|role|agent|implement/i);
+    for (const mode of ["audit", "plan"]) {
+      f.task(mode, { mode });
+      assert.throws(() => reserve(f.project, mode, f.request("implementation")), /mode|read.only|implement|audit|plan/i);
+      assert.throws(() => reserve(f.project, mode, f.request("analysis", { writePaths: ["Assets/game.cs"] })), /path|read.only|analysis|writ/i);
+      assert.ok(reserve(f.project, mode, f.request("analysis")).id);
+    }
+  } finally { f.dispose(); }
+});
+
+test("an already exhausted recorded review budget blocks a first managed reviewer", () => {
+  const f = fixture();
+  try {
+    f.task("task", { reviewBudget: { used: 3, limit: 3, extensions: [] } });
+    assert.throws(() => reserve(f.project, "task", f.request("review")), /review|budget|limit|exhaust/i);
+    assert.equal(status(f.project, "task").reservations.length, 0);
+  } finally { f.dispose(); }
+});
+
+test("two subprocess reviewers racing for the last round cannot both reserve", async () => {
+  const f = fixture();
+  try {
+    f.write(".nccgs/intake.json", { mode: "implement", objective: "Synthetic concurrency fixture", scope: "feature", readiness: "ready", requiredChecks: [] });
+    let task = initializeStandalone(f.project, "task", { intake: ".nccgs/intake.json" });
+    const run = f.start("task", f.request("implementation")), runtime = f.observation(run);
+    const done = complete(f.project, run.reservation.id, { runtime });
+    const evidence = f.write(".nccgs/evidence/synthetic-check.txt", "SYNTHETIC verification fixture");
+    task = recordStandalone(f.project, task, "implementation", { dispatchId: done.id, snapshot: done.completedSnapshot, runtime, checks: [{ name: "synthetic-check", status: "PASS", evidence }] });
+    task.reviewBudget.used = task.reviewBudget.limit - 1;
+    f.write(".nccgs/tasks/task.json", task);
+    const results = await simultaneousReservations(f.project, "task", [f.request("review"), f.request("review")]);
+    assert.equal(results.filter(result => result.ok).length, 1, JSON.stringify(results));
+    assert.equal(status(f.project, "task").active.filter(item => item.kind === "review").length, 1);
+  } finally { f.dispose(); }
+});
+
+test("claim identities and exact completion retries cannot duplicate accounting", () => {
+  const f = fixture();
+  try {
+    f.task("task");
+    const run = f.start("task");
+    claim(f.project, run.reservation.id, run.identity);
+    assert.throws(() => claim(f.project, run.reservation.id, { ...run.identity, toolUseId: "different-tool" }), /claim|identity|running|bound|dispatch/i);
+    const runtime = f.observation(run);
+    complete(f.project, run.reservation.id, { runtime });
+    const before = status(f.project, "task").usage;
+    complete(f.project, run.reservation.id, { runtime });
+    assert.deepEqual(status(f.project, "task").usage, before);
+    assert.equal(status(f.project, "task").active.length, 0);
+    assert.equal(reserve(f.project, "task", run.request).id, run.reservation.id);
+    assert.equal(telemetry(f.project, "task").attempts, 1);
+  } finally { f.dispose(); }
+});
+
+test("child dispatches consume the ancestor budget and new children cannot mint quota", () => {
+  const f = fixture();
+  try {
+    f.task("parent"); f.task("child", { parentId: "parent" }); f.task("new-child", { parentId: "parent" });
+    const parent = f.start("parent", f.request("analysis", { limits: { maxDispatches: 2 } }));
+    complete(f.project, parent.reservation.id, { runtime: f.observation(parent) });
+    const child = f.start("child");
+    failRun(f, child);
+    assert.equal(status(f.project, "parent").usage.dispatches, 2);
+    assert.equal(telemetry(f.project, "parent").attempts, 2);
+    assert.equal(telemetry(f.project, "parent").metrics.durationMs.expected, 2);
+    assert.throws(() => reserve(f.project, "new-child", f.request("analysis")), /budget|quota|dispatch|limit/i);
+    assert.throws(() => reserve(f.project, "parent", f.request("analysis", { limits: { maxDispatches: 20 } })), /budget|quota|limit|extend|chang/i);
+  } finally { f.dispose(); }
+});
+
+test("separate child processes racing for the last ancestor dispatch share one quota", async () => {
+  const f = fixture();
+  try {
+    f.task("parent"); f.task("first", { parentId: "parent" }); f.task("second", { parentId: "parent" });
+    const parent = f.start("parent", f.request("analysis", { limits: { maxDispatches: 2 } }));
+    complete(f.project, parent.reservation.id, { runtime: f.observation(parent) });
+    const results = await simultaneousReservations(f.project, "parent", [
+      { taskId: "first", request: f.request("analysis") }, { taskId: "second", request: f.request("analysis") }
+    ]);
+    assert.equal(results.filter(result => result.ok).length, 1, JSON.stringify(results));
+    assert.equal(status(f.project, "parent").usage.dispatches, 2);
+  } finally { f.dispose(); }
+});
+
+test("checkpoint and resume do not free an uncertain run or reset consumed budget", () => {
+  const f = fixture();
+  try {
+    f.task("task");
+    const run = f.start("task", f.request("implementation", { limits: { maxDispatches: 1 } }));
+    const before = status(f.project, "task");
+    checkpoint(f.project, "task", { reason: "TEST FIXTURE interrupted coordinator" });
+    resume(f.project, "task");
+    const after = status(f.project, "task");
+    assert.deepEqual(after.usage, before.usage);
+    assert.ok(after.active.some(item => item.id === run.reservation.id));
+    assert.throws(() => reserve(f.project, "task", f.request("implementation")), /budget|quota|dispatch|limit|path|writer/i);
+    failRun(f, run);
+    assert.equal(status(f.project, "task").active.length, 0);
+    assert.throws(() => reserve(f.project, "task", f.request("analysis")), /budget|quota|dispatch|limit/i);
+  } finally { f.dispose(); }
+});
+
+test("external reconciliation needs provenance and is rejected inside Claude", () => {
+  const f = fixture();
+  try {
+    f.task("task");
+    const run = f.start("task");
+    external(() => assert.throws(() => reconcile(f.project, run.reservation.id, { status: "failed", reason: "", reference: "" }), /reason|reference|provenance/i));
+    const original = process.env.CLAUDECODE;
+    process.env.CLAUDECODE = "1";
+    try { assert.throws(() => reconcile(f.project, run.reservation.id, { status: "failed", reason: "Self-declared stop", reference: "self" }), /external|Claude|operator/i); }
+    finally { if (original === undefined) delete process.env.CLAUDECODE; else process.env.CLAUDECODE = original; }
+    assert.equal(status(f.project, "task").active.length, 1);
+  } finally { f.dispose(); }
+});
+
+test("source or contract changes before claim make the reservation stale", () => {
+  const f = fixture();
+  try {
+    f.task("source");
+    const source = reserve(f.project, "source", f.request("analysis"));
+    f.write("Assets/game.cs", "// changed after reserve\n");
+    assert.throws(() => claim(f.project, source.id, { sessionId: "s", toolUseId: "u", agent: agents.analysis }), /stale|snapshot|changed/i);
+    f.task("contract");
+    const contract = reserve(f.project, "contract", f.request("analysis"));
+    const changed = json(path.join(f.project, ".nccgs/tasks/contract.json"));
+    changed.contractHash = hash("changed contract");
+    atomicJson(path.join(f.project, ".nccgs/tasks/contract.json"), changed);
+    assert.throws(() => claim(f.project, contract.id, { sessionId: "s", toolUseId: "v", agent: agents.analysis }), /contract|stale|changed/i);
+  } finally { f.dispose(); }
+});
+
+test("completion rejects stale, mismatched or corrupt durable evidence without releasing the slot", () => {
+  const f = fixture();
+  try {
+    f.task("task");
+    const run = f.start("task");
+    for (const override of [{ sessionId: "foreign-session" }, { toolUseId: "foreign-tool" }, { dispatchId: "foreign-dispatch" }, { taskId: "foreign-task" }, { contractHash: "foreign-contract" }, { snapshot: "stale-snapshot" }, { observedProvider: "codex" }]) {
+      assert.throws(() => complete(f.project, run.reservation.id, { runtime: f.observation(run, override) }), /identity|session|tool|dispatch|task|contract|snapshot|provider|Claude|stale|match/i);
+      assert.equal(status(f.project, "task").active.length, 1);
+    }
+    assert.throws(() => complete(f.project, run.reservation.id, { runtime: f.observation(run, { durationMs: 0 }, { durationMs: 100 }) }), /source|observation|duration|telemetry|match/i);
+    const runtime = f.observation(run);
+    const observation = json(path.join(f.project, runtime.path));
+    fs.appendFileSync(path.join(f.project, observation.observationSource.path), "\ncorruption");
+    assert.throws(() => complete(f.project, run.reservation.id, { runtime }), /artifact|hash|source|stale|JSON/i);
+    assert.equal(status(f.project, "task").active.length, 1);
+  } finally { f.dispose(); }
+});
+
+test("an analysis worker source mutation is retained as failure, never successful completion", () => {
+  const f = fixture();
+  try {
+    f.task("task", { mode: "audit" });
+    const run = f.start("task");
+    f.write("Assets/game.cs", "// forbidden analysis mutation\n");
+    complete(f.project, run.reservation.id, { runtime: f.observation(run) });
+    const entry = status(f.project, "task").reservations.find(item => item.id === run.reservation.id);
+    assert.equal(entry.status, "failed");
+    assert.equal(status(f.project, "task").usage.dispatches, 1);
+  } finally { f.dispose(); }
+});
+
+test("a failed provider observation releases concurrency but still consumes its dispatch", () => {
+  const f = fixture();
+  try {
+    f.task("task");
+    const run = f.start("task", f.request("implementation", { limits: { maxDispatches: 1 } }));
+    complete(f.project, run.reservation.id, { runtime: f.observation(run, { status: "failed", durationMs: 17 }) });
+    const result = status(f.project, "task");
+    assert.equal(result.active.length, 0);
+    assert.equal(result.reservations[0].status, "failed");
+    assert.equal(result.usage.dispatches, 1);
+    assert.equal(telemetry(f.project, "task").metrics.durationMs.total, 17);
+    assert.throws(() => reserve(f.project, "task", f.request("implementation")), /budget|quota|dispatch|limit/i);
+  } finally { f.dispose(); }
+});
+
+test("unknown telemetry remains null while observed zero stays measured zero", () => {
+  const f = fixture();
+  try {
+    f.task("unknown");
+    const unknown = f.start("unknown");
+    complete(f.project, unknown.reservation.id, { runtime: f.observation(unknown) });
+    const missing = telemetry(f.project, "unknown");
+    for (const key of ["durationMs", "toolUseCount", "totalTokens", "costUsd"]) {
+      assert.equal(missing.metrics[key].total, null, key);
+      assert.equal(missing.metrics[key].measured, 0, key);
+      assert.equal(missing.metrics[key].expected, 1, key);
+      assert.equal(missing.metrics[key].coverage, 0, key);
+    }
+    f.task("zero");
+    const zero = f.start("zero");
+    complete(f.project, zero.reservation.id, { runtime: f.observation(zero, { durationMs: 0, toolUseCount: 0, totalTokens: 0, costUsd: 0 }) });
+    for (const key of ["durationMs", "toolUseCount", "totalTokens", "costUsd"]) {
+      assert.equal(telemetry(f.project, "zero").metrics[key].total, 0, key);
+      assert.equal(telemetry(f.project, "zero").metrics[key].measured, 1, key);
+    }
+  } finally { f.dispose(); }
+});
+
+test("corrupt orchestration ledger fails closed instead of resetting quotas", () => {
+  const f = fixture();
+  try {
+    f.task("task");
+    reserve(f.project, "task", f.request("analysis", { limits: { maxDispatches: 1 } }));
+    f.write(".nccgs/orchestration.json", "{ broken durable ledger");
+    assert.throws(() => status(f.project, "task"), /JSON|corrupt|ledger|Unexpected|property/i);
+    assert.throws(() => reserve(f.project, "task", f.request("analysis")), /JSON|corrupt|ledger|Unexpected|property/i);
+    assert.equal(fs.readFileSync(path.join(f.project, ".nccgs/orchestration.json"), "utf8"), "{ broken durable ledger");
+  } finally { f.dispose(); }
+});
+
+test("losing an initialized ledger cannot silently restore exhausted dispatch quota", () => {
+  const f = fixture();
+  try {
+    f.task("task");
+    const run = f.start("task", f.request("analysis", { limits: { maxDispatches: 1 } }));
+    complete(f.project, run.reservation.id, { runtime: f.observation(run) });
+    fs.unlinkSync(path.join(f.project, ".nccgs/orchestration.json"));
+    assert.throws(() => reserve(f.project, "task", f.request("analysis")), /ledger|missing|history|recover|initial/i);
+  } finally { f.dispose(); }
+});
+
+test("a lost dispatch entry with surviving history cannot refund spent quota", () => {
+  const f = fixture();
+  try {
+    f.task("task");
+    const run = f.start("task", f.request("analysis", { limits: { maxDispatches: 1 } }));
+    complete(f.project, run.reservation.id, { runtime: f.observation(run) });
+    const file = path.join(f.project, ".nccgs/orchestration.json");
+    const ledger = json(file);
+    delete ledger.dispatches[run.reservation.id];
+    atomicJson(file, ledger);
+    assert.throws(() => reserve(f.project, "task", f.request("analysis")), /ledger|history|corrupt|dispatch|event/i);
+  } finally { f.dispose(); }
+});
+
+test("durable observations cannot complete against an ignored raw source", () => {
+  const f = fixture();
+  try {
+    f.task("task");
+    const run = f.start("task");
+    const good = f.observation(run);
+    const observation = json(path.join(f.project, good.path));
+    const sourceBytes = fs.readFileSync(path.join(f.project, observation.observationSource.path));
+    observation.observationSource = f.write(".nccgs/runtime/ignored-source.json", sourceBytes);
+    const runtime = f.write(".nccgs/evidence/runtime/observations/ignored-source-ref.json", observation);
+    assert.throws(() => complete(f.project, run.reservation.id, { runtime }), /durable|source|runtime/i);
+    assert.equal(status(f.project, "task").active.length, 1);
+  } finally { f.dispose(); }
+});
+
+test("valid task IDs that match object prototype properties can reserve normally", () => {
+  const f = fixture();
+  try {
+    for (const id of ["constructor", "toString"]) {
+      f.task(id);
+      assert.ok(reserve(f.project, id, f.request("analysis")).id);
+      assert.equal(status(f.project, id).reservations.length, 1);
+    }
+  } finally { f.dispose(); }
+});
+
+test("telemetry fails closed when the durable evidence behind measured totals is lost or corrupt", () => {
+  const f = fixture();
+  try {
+    f.task("task");
+    const run = f.start("task");
+    const runtime = f.observation(run, { durationMs: 31 });
+    complete(f.project, run.reservation.id, { runtime });
+    assert.equal(telemetry(f.project, "task").metrics.durationMs.total, 31);
+    const observation = json(path.join(f.project, runtime.path));
+    const sourcePath = path.join(f.project, observation.observationSource.path);
+    const originalBytes = fs.readFileSync(sourcePath);
+    fs.unlinkSync(sourcePath);
+    assert.throws(() => telemetry(f.project, "task"), /ENOENT|artifact|evidence|source|missing/i);
+    fs.writeFileSync(sourcePath, Buffer.concat([originalBytes, Buffer.from("\ncorrupt")]));
+    assert.throws(() => telemetry(f.project, "task"), /artifact|evidence|source|hash|stale/i);
+  } finally { f.dispose(); }
+});
+
+function nativeFixtureEvent(run) {
+  return { session_id: run.identity.sessionId, tool_use_id: run.identity.toolUseId,
+    tool_input: { subagent_type: run.request.agent, prompt: `[NCCGS-DISPATCH:${run.reservation.id}] SYNTHETIC TEST FIXTURE ONLY` },
+    tool_response: { status: "completed", agentId: `agent-${run.reservation.id}`, resolvedModel: "claude-opus-5-5",
+      modelsUsed: ["claude-opus-5-5"], totalDurationMs: 23, totalToolUseCount: 2, totalTokens: 10 } };
+}
+
+test("native standalone observation produces provenance accepted by runtime validation", () => {
+  const f = fixture();
+  try {
+    const task = f.task("task", { execution: { requireObservedEffort: false } });
+    const run = f.start("task", f.request("analysis", { agent: agents.implementation }));
+    const observation = observe(f.project, nativeFixtureEvent(run), "agent_result");
+    const stage = { runtime: artifact(f.project, observation.path) };
+    const verified = validateStandaloneRuntime(f.project, task, stage, task.implementationRoute, snapshot(f.project).sha256);
+    assert.equal(verified.observedProvider, "claude-code");
+    assert.equal(verified.observedEffort, null);
+    assert.equal(verified.effortEvidence, "UNKNOWN");
+  } finally { f.dispose(); }
+});
+
+test("duplicate native terminal callback is idempotent and keeps the original dispatch evidence", () => {
+  const f = fixture();
+  try {
+    f.task("task");
+    const run = f.start("task", f.request("analysis", { agent: agents.implementation }));
+    const event = nativeFixtureEvent(run);
+    observe(f.project, event, "agent_result");
+    const before = status(f.project, "task").reservations[0];
+    assert.doesNotThrow(() => observe(f.project, structuredClone(event), "agent_result"));
+    const after = status(f.project, "task").reservations[0];
+    assert.deepEqual(after.runtime, before.runtime);
+    assert.equal(telemetry(f.project, "task").attempts, 1);
+    assert.equal(telemetry(f.project, "task").metrics.durationMs.total, 23);
+  } finally { f.dispose(); }
+});
+
+test("coordinator verification allowance cannot hide trailing shell commands", () => {
+  const f = fixture();
+  const savedTask = process.env.NCCGS_TASK_ID;
+  try {
+    f.task("task");
+    process.env.NCCGS_TASK_ID = "task";
+    for (const suffix of ["; echo injected", " && echo injected", " | echo injected", "\necho injected"]) {
+      assert.throws(() => guardTool(f.project, { session_id: "coordinator", tool_name: "Bash", tool_input: {
+        command: `node .claude/nccgs/tools/task.mjs verify --id task --name regression -- node -e 0${suffix}`
+      } }), /shell|compos|verif|command|correlat|worker|blocked|unsafe/i);
+    }
+  } finally {
+    if (savedTask === undefined) delete process.env.NCCGS_TASK_ID; else process.env.NCCGS_TASK_ID = savedTask;
+    f.dispose();
+  }
+});