nccgs 1.3.0 → 2.0.0-rc.2

package/.claude/nccgs/protocols/orchestration.md

@@ -15,17 +15,58 @@ another specialty instead of spawning their own hierarchy.
 
 ## Team sizing
 
-- FAST: normally no subagent or one specialist.
-- STANDARD: one accountable implementer plus independent verification; add a design
+- FAST: one accountable lightweight implementer with a concise plan and report.
+- STANDARD: one accountable standard implementer plus independent verification; add a design
   or domain specialist only when the feature actually needs it.
-- CONTROLLED: decision owner, affected specialists, implementer, verification, and
+- CONTROLLED: one deep implementer accountable for integration, decision owner,
+  affected specialists, verification, and
   adversarial reviewer. Avoid ceremonial roles with no distinct deliverable.
 
 Pass a context packet path and exact responsibility. Do not paste full GDDs, ADRs,
 or chat history into every prompt. Surface blocked nodes immediately and preserve
 completed independent outputs.
 
-Under astra-claude, Astra owns the plan and document scope. Claude orchestrates
-implementation nodes inside that plan on Opus 5.5/xhigh. Every coding outcome must
+Standalone execution follows [the standalone protocol](standalone.md), including
+durable dispatch reservations, attempt budgets, mode guards and optional external
+review. Path ownership is checked for declared reservations and direct edit tools;
+opaque shell/MCP operations require independent diff review, not a sandbox claim.
+
+Under compatibility execution with astra-claude, Astra owns the plan and document scope. Claude orchestrates
+implementation nodes inside that plan using the task's risk-selected model/effort.
+Every coding outcome must
 pass an independent Fable review before its final report goes to Astra. Even FAST
 work cannot bypass this sequence. See [the handoff protocol](astra-claude.md).
+
+Use `nccgs-task-scout` only to close a named factual gap. Do not launch a scout,
+design consultation, or extra reviewer when existing evidence already answers the
+question. Each reviewer must cover a distinct risk. Preserve one accountable
+implementer even when independent support work runs in parallel.
+
+Keep only one reviewer in flight per task. Standalone checks work-stage readiness
+before reserving review and again before launch. A rejected launch is automatically
+marked failed only while demonstrably unclaimed; its quota stays spent. Claimed or
+uncertain invocations still require runtime evidence or external reconciliation.
+When technical checks prevent work-stage recording, use measured negative criteria
+to request an eligible protected repair instead of reserving a premature reviewer.
+
+Do not expand scope speculatively. Stop when the approved criteria and relevant
+checks pass with no actionable blockers; rerun only checks affected by changed
+inputs, failures, or new evidence. Turn unresolved subjective questions into a
+playable Product Owner test. Review budgets are enforced by task gates; context
+and time budgets are advisory. Exhaustion requires an evidence-backed stop and an
+explicit external extension, never automatic approval.
+
+Native agent `maxTurns` comes from the installed role frontmatter; a larger
+`Agent.max_turns` request is not evidence that the role cap increased. Templates
+are authoritative and policy compilation synchronizes the registry. Designer,
+gameplay/Unity implementation and review roles have bounded allowances of 48,
+120 and 64 turns respectively; lighter scout/FAST roles keep their short budgets.
+
+An external operator can reallocate a pinned dispatch limit with `task
+extend-dispatch --id TASK --request FILE`. The request must contain
+`previousLimit`, a larger finite `maxDispatches`, `reason`, and a hashed
+authorization artifact `reference`. All dispatches must be settled. The ledger
+records before/after limits; spent attempts, ancestor limits and protected slots
+remain unchanged. Claude cannot invoke this command. If a framework update changes
+a plan's source baseline, retain the old failed plan and create a bounded child
+under its preserved aggregate budget; do not reset the old baseline or history.

package/.claude/nccgs/protocols/review-handoff.md

@@ -0,0 +1,65 @@
+# Reviewer-owned verdict and remaining conditions
+
+New standalone installs enable `reviewContractRequired: true`. The completed
+review dispatch must pin the same Markdown handoff used as the review stage's
+`evidence`. The reviewer writes exactly one `nccgs-review` fenced JSON block:
+
+```nccgs-review
+{
+  "schemaVersion": 1,
+  "taskId": "TASK",
+  "contractHash": "CURRENT_CONTRACT_HASH",
+  "snapshot": "REVIEWED_SOURCE_SNAPSHOT",
+  "verdict": "BLOCKED",
+  "criteriaMet": false,
+  "findings": [],
+  "conditions": [
+    { "id": "C-01", "description": "Required baseline comparison has not been supplied or reviewed." }
+  ]
+}
+```
+
+Use actual task identity, hash and snapshot supplied by the coordinator. Findings
+retain the required severity, status, description and design acceptanceImpact.
+Finding severity must be BLOCKER, HIGH, MEDIUM, LOW or INFO; status must be OPEN,
+RESOLVED or ACCEPTED. Use ACCEPTED for an acknowledged informational limitation,
+not NOTED. The coordinator must not translate an invalid reviewer-owned value.
+Prose explains the evidence, scope and limits; the block is the authoritative
+verdict, assessment, findings and remaining conditions. Coordinator stage input
+must copy these four fields exactly, including an explicit `conditions` array.
+
+PASS requires `conditions: []`. If acceptance still depends on a diff, test,
+source read or other check, return BLOCKED or CHANGES_REQUIRED with that condition.
+A finished negative review may mark its handoff COMPLETE. Do not write a conditional
+PASS or hide pending acceptance work in a prose disclaimer. The framework checks
+the explicit contract; detecting an omitted semantic condition remains a reviewer
+responsibility. Neither a marker nor a schema proves complete semantic coverage.
+
+Supply required checks before launching review. When new evidence arrives after
+a completed conditional/negative review, retain that artifact and obtain a fresh
+independent review within the existing dispatch/round/time/cost limits. A coordinator
+cannot clear conditions, change the verdict, edit the captured handoff or relabel
+its own check as the reviewer's completed work. Report PARTIAL/BLOCKED when the
+remaining allowance cannot fund the required follow-up.
+
+For a broad delivery review, check the effective native role `maxTurns` before
+dispatch. A number in the assignment prompt does not override the role's limit.
+The shipped reviewer allows up to 200 turns; this is a ceiling, not a target.
+Keep session cost, time and dispatch limits active. Index current receipts, raw
+files and source changes before review, and use focused reads instead of repeatedly
+loading whole histories. Write a truthful PARTIAL handoff early and update it as
+checks finish, so interruption leaves concrete unresolved work. Only the reviewer
+may replace its own draft with the completed verdict before the dispatch ends.
+Capacity changes require an external allocation within the owner's authority;
+never reset failed attempts or loosen the acceptance requirements.
+
+The native harness can report an invocation `completed` and still say its worker
+stopped at a turn limit. Harness-designated incomplete notices override a COMPLETE
+file: the attempt fails as incomplete, all spent quota remains, and its evidence
+cannot certify a stage. Unsupported harness notices/metadata fail closed pending
+external inspection. Arbitrary quoted text in a worker's response is not harness
+metadata and does not itself change completion status. Captured observations retain
+the reported invocation status and a diagnosis/hash, not arbitrary response text.
+
+Older pinned policies remain unchanged. Upgrade policy only for fresh authorized
+tasks; never retrofit frozen evaluation records or reset attempts to obtain PASS.

package/.claude/nccgs/protocols/standalone-gates.md

@@ -0,0 +1,273 @@
+# NCCGS 2.0 RC — implementation and operation
+
+Version: **2.0.0-rc.2**. Target executor: **Claude Code**.
+Framework tests and scoped native delivery evidence exist. Fresh end-to-end
+qualification of this exact RC and published-1.3 upgrade qualification are pending. Read [MEMORY.md](../MEMORY.md) before interpreting evaluation results.
+
+## Policies and migration
+
+New installs use `.nccgs/execution.json`:
+
+```json
+{
+  "schemaVersion": 1,
+  "name": "standalone",
+  "externalReview": { "mode": "off" },
+  "acceptanceRequired": false,
+  "requireObservedEffort": false,
+  "maxParallelWorkers": 2,
+  "designReviewRequired": true,
+  "reviewContractRequired": true
+}
+```
+
+Model profile lives separately in `.nccgs/project.yaml`; the default is
+`claude-standalone`. Its Sonnet/Opus aliases are requests, never resolved observations.
+Missing execution.json resolves to compatibility. Changing a model profile alone
+does not remove an external, acceptance or historical task obligation.
+
+Use `nccgs migrate-execution --to standalone --dry-run` after a framework update;
+remove `--dry-run` to apply. Add `--model-profile claude-standalone` to explicitly
+change models too. Configuration archives live under `.nccgs/backups/execution/ID`.
+`--rollback ID --dry-run` checks restoration; rollback refuses changed configuration
+or corrupted backup hashes. Tasks/evidence/budgets are preserved. See
+the packaged UPGRADING.md for failure recovery and legacy task handling.
+
+## Intake, classification and modes
+
+Example `.nccgs/evidence/intake/hud-fix.json`:
+
+```json
+{
+  "schemaVersion": 1,
+  "objective": "Correct the pause-button offset at the declared reference resolution",
+  "mode": "implement",
+  "scope": "local",
+  "systems": ["HUD"],
+  "target": "fix",
+  "readiness": "ready",
+  "acceptance": [{ "id": "HUD-01", "description": "Offset matches the reference", "check": "layout-reference",
+    "assertions": [{ "artifact": ".nccgs/evidence/measurements/layout.json", "pointer": "/offsetMatches", "op": "eq", "value": true }] }],
+  "requiredChecks": ["layout-reference"],
+  "requiredArtifacts": [],
+  "manualGates": [],
+  "assumptions": ["Gameplay and input behavior remain unchanged"],
+  "reassessWhen": ["The layout defect crosses multiple UI systems"]
+}
+```
+
+This is a template, not evidence that the check ran. For `audit` or `plan`, declare
+`analysisArtifacts` such as `.nccgs/evidence/analysis/TASK-result.md`; source edits
+are prohibited. Include real `sources` paths to hash authoritative documents.
+Criteria with `check` add required objective checks; `{id,description,manual:true}`
+adds a manual acceptance gate. Project-level gate manifests remain mandatory.
+Automatic criteria require measured JSON assertions (`eq`, `gte`, `lte`); check-only
+criteria remain UNVERIFIED. The verifier captures changed measurement files into
+hashed per-job evidence. Failed/unverified criteria block PASS review, success report
+and DONE, independently of the helper's exit code. Inspect `task acceptance-status`.
+Use `checkpoint: "early"` only for a small delivery prerequisite that actually
+blocks dependent work. Bot survival/victory, damage headroom and product balance
+are not default expansion gates. See [delivery acceptance](delivery-acceptance.md)
+and [phase-2 operations](../../../docs/PHASE-2-OPERATIONS.md). The engine still
+enforces pinned criteria; revising scope requires an explicit reviewed contract.
+
+```text
+node .claude/nccgs/tools/task.mjs init --id hud-fix --intake .nccgs/evidence/intake/hud-fix.json
+node .claude/nccgs/tools/task.mjs bind --id hud-fix --session ACTUAL_SESSION_ID
+node .claude/nccgs/tools/task.mjs inspect --id hud-fix
+```
+
+Run each task command in its own shell tool call from the project directory.
+Do not append pipes, redirection (including `2>&1`), semicolons, `cd`, or other
+commands. The guard recognizes a plain task invocation; composed shell commands
+are not lifecycle commands and require a correlated implementation worker.
+Use `inspect` to read task state, and Read/Grep for command documentation.
+`status` and `--help` are not recognized lifecycle operations. If a plain command
+is rejected, retain the error and inspect its arguments instead of bypassing the
+guard or requesting an external bind before correcting the invocation.
+
+The classifier is deterministic and conservative, not a general semantic model.
+Ready/local/fix can be FAST. Unknown or feature scope defaults to STANDARD.
+Save/serialization, migration, network authority, commerce and cross-system signals
+require CONTROLLED. The coordinator must inspect real risk and supply `riskSignals`,
+reason and evidence; keyword absence is not proof of safety.
+
+Explicit `reclassify --classification FILE` requires `reason` and `evidence`; optional
+`risk`, `scope`, `target`, `readiness`, `systems` and `riskSignals` explain the change.
+To change intake content, update the same file and use `refresh-inputs --reason TEXT`.
+Reclassification invalidates affected stages while retaining old evidence and spent
+review rounds. Source/input/policy changes never reuse old approval. Execution policy
+changes cannot be adopted by input refresh: restore pinned policy for current work
+or explicitly scope new work while retaining prior history and spent budgets. Audit/plan
+baseline hashing still detects source edits after canonical inputs are refreshed.
+
+## Dispatch, budget and evidence
+
+Save a request under `.nccgs/evidence/requests/`:
+
+```json
+{
+  "requestKey": "hud-fix-implementation-1",
+  "kind": "implementation",
+  "agent": "nccgs-fast-implementer",
+  "writePaths": ["Assets/Game/UI/PauseButton.cs"],
+  "reason": "One ready local layout fix with a targeted reference check"
+}
+```
+
+```text
+node .claude/nccgs/tools/task.mjs reserve --id hud-fix --request .nccgs/evidence/requests/hud-fix.json
+```
+
+Use the returned ID in the Agent prompt prefix `[NCCGS-DISPATCH:ID]`, select the
+specified role and task route, and include contract, inputs, ownership and acceptance.
+PreToolUse claims the slot with actual session/tool-use identity. SubagentStart binds
+an unambiguous agent ID. Foreground PostToolUse completion captures final telemetry.
+For this preview use foreground calls; background runs hold slots until correlated
+final evidence or external reconciliation. SubagentStop alone cannot prove model,
+effort or complete usage. Ambiguous same-role starts are not guessed.
+
+Review requests use `kind: "review"`, `agent: "nccgs-adversarial-reviewer"`, and
+empty writePaths. Analysis requests also have no source ownership. Dispatch ceilings
+are 6/12/24 for new FAST/STANDARD/CONTROLLED tasks by default; first reservation may explicitly
+set `limits.maxDispatches`, `maxDurationMs`, `maxCostUsd`. Limits are pinned, counted
+across descendants, and cannot be raised by another reservation. Review limits are
+2/3/3. Failed, cancelled and uncertain attempts remain spent. Extensions of review
+rounds require a reasoned external operator decision and never grant approval.
+New implementation ledgers protect four slots within the total: two reviews, one
+repair and one read-only QA dispatch. Ordinary `purpose: "delivery"` cannot spend
+them. `purpose: "repair"` needs recorded negative review/measured acceptance feedback
+and a bounded `workPacket` with exact files, checks and one fresh handoff. Use
+`task dispatch-prompt --id TASK --dispatch ID` after reservation. See
+[bounded repair](bounded-repair.md) for enforced per-worker allowances;
+`purpose: "qa"` uses a QA/verification role after a completed repair with retained feedback.
+Audit/plan protect one review slot. Existing ledgers retain their pinned allocation.
+
+At most two implementation workers can reserve disjoint paths; review/analysis
+cannot overlap source writers. Direct edit tools enforce ownership. Opaque shell/MCP
+operations are not OS-sandboxed by NCCGS; inspect their actual diff and test effects.
+Audit/plan/review block arbitrary shells and unknown tools. Use read tools, declared
+analysis artifacts and externally supplied command evidence when required.
+
+`task verify --id TASK --name CHECK -- EXECUTABLE ARGS` records the actual command,
+exit code, bounded timeout, log hash and before/after source snapshot. Claude may
+run it only for implementation tasks. The verifier must not change source.
+Use `verify --timeout-ms 900000 --background` before `--` for a long real-time
+check when no check-specific timeout is configured. The requested timeout is
+recorded and pinned to the request key (100..7200000 ms); it cannot exceed an
+explicit check timeout or extend the supervisor's overall deadline. Windows jobs
+retain all descendants, even detached children: a quick launcher does not let a
+600-second player escape the default 300-second timeout. Keep long collection in
+the managed job with a sufficient bound, then validate its retained output.
+Do not use WMI or another parent process to escape job ownership. Poll the actual
+job with `job-status` or `job-wait --timeout-ms 30000`; do not create sleep-only
+verification jobs or keep waiting after the collector has exited.
+`task ref --file PATH` produces a `{path,sha256}` reference without inventing evidence.
+
+Record a completed work stage with a JSON payload (placeholders below must be
+replaced with returned values, never copied as observations):
+
+```json
+{
+  "snapshot": "ACTUAL_FINAL_SNAPSHOT",
+  "dispatchId": "ACTUAL_COMPLETED_DISPATCH_ID",
+  "runtime": { "path": ".nccgs/evidence/runtime/observations/ACTUAL.json", "sha256": "ACTUAL_HASH" },
+  "checks": [{ "name": "layout-reference", "status": "PASS", "evidence": { "path": ".nccgs/evidence/ACTUAL-check.json", "sha256": "ACTUAL_HASH" } }]
+}
+```
+
+Use `record --id TASK --stage implementation --evidence FILE`. Audit/plan use stage
+`analysis` and include `evidence` referencing the declared result artifact. Each
+accepted work/review dispatch can be consumed once, including across history.
+
+Review payload adds `verdict` (`PASS|CHANGES_REQUIRED|BLOCKED`), `criteriaMet`,
+`findings`, and a review-artifact `evidence` ref to snapshot/dispatchId/runtime.
+Findings include `severity` (`BLOCKER|HIGH|MEDIUM|LOW|INFO`), `status`
+(`OPEN|RESOLVED|ACCEPTED`) and `description`. An unresolved BLOCKER/HIGH or unmet
+required criterion prevents internal PASS. Review identity must differ from work.
+With reviewContractRequired, the completed reviewer's pinned handoff must contain
+exactly one nccgs-review JSON block; copy its verdict, criteriaMet, findings and
+conditions exactly into the stage payload. Pending conditions block PASS. Follow
+[review handoff](review-handoff.md); a coordinator cannot remove those conditions.
+For design revisions, run fixed `task design-compare --id TASK --baseline PINNED_SOURCE
+--file DECLARED_CANDIDATE` before the final review and supply its immutable receipt.
+
+## Reporting, external review and closure
+
+```text
+node .claude/nccgs/tools/task.mjs report --id TASK --outcome blocked --summary "Actual blocker and missing evidence"
+node .claude/nccgs/tools/task.mjs check --id TASK --target done
+node .claude/nccgs/tools/task.mjs close --id TASK
+```
+
+Reports accept `partial|blocked|failed` even when successful closure is unavailable.
+Success requires verified current work and independent review before any report is
+written. Generated Markdown includes evidence status and unresolved gates.
+`record --stage report` can supply `artifacts` refs for required closure outputs.
+Success wording does not override failed checks. Only `close` with all current gates
+passing establishes DONE. `inspect` remains usable with changed/malformed policy.
+
+`export-external --out .nccgs/evidence/external/requests/UNIQUE.json` writes an
+immutable task/contract/snapshot packet. An external actor reviews it and imports
+a receipt through `import-external --file FILE` outside the Claude executor:
+
+```json
+{
+  "schemaVersion": 1,
+  "id": "REVIEW_ID",
+  "taskId": "TASK",
+  "contractHash": "EXPORTED_HASH",
+  "snapshot": "EXPORTED_SNAPSHOT",
+  "actor": "ACTUAL_EXTERNAL_REVIEWER",
+  "verdict": "PASS",
+  "findings": [],
+  "reviewedAt": "ACTUAL_ISO_TIMESTAMP",
+  "source": "ACTUAL_REVIEW_REFERENCE"
+}
+```
+
+Off ignores external closure dependency. Advisory retains current findings without
+blocking. Required evaluates all active current receipts; a later empty PASS cannot
+erase earlier blocking findings. To replace a prior decision, include
+`supersedes: ["PRIOR_RECEIPT_ID"]` and `supersessionReason` identifying the new
+evidence. Old findings remain traceable. Stale/duplicate/malformed receipts fail.
+
+If acceptance is required, an external Product Owner decision references taskId,
+contractHash, snapshot, `actor: "Product Owner"`, `decision: "ACCEPTED"`, decidedAt,
+statement, reference and each manual gate `{id,decision:"ACCEPTED",reference}`.
+Import via `record --stage acceptance` with its evidence ref. Claude cannot accept
+on the user's behalf. NCCGS neither launches Astra nor sends external messages.
+
+## Recovery and telemetry
+
+Supervised verification pins the owning run's absolute deadline in its request and
+receipt. Its managed command tree ends at the earlier of that deadline and the
+check timeout, even if the coordinator exits. A long per-attempt timeout never
+extends the approved run. After expiry, existing request keys remain readable but
+new attempts are refused. Do not escape this ownership through WMI or services.
+
+Use `checkpoint --reason TEXT`, `resume`, `dispatch-status` and `telemetry` with
+`--id TASK`. Resume preserves reservations, findings, attempts and budgets. A lost
+callback or dead worker does not refund a slot by timeout. An external operator can
+use `dispatch-reconcile --dispatch ID --request FILE` with `status: failed|cancelled`,
+reason and observed reference after confirming the process is no longer running.
+Never manually reset the ledger. Missing initialized history or altered durable
+evidence fails closed. A crashed lock requires operator inspection before recovery.
+
+Telemetry reports known subtotals and coverage for duration, tool calls, tokens and
+cost. Total is null if any started attempt lacks that metric. Observed zero remains
+zero. These are worker measurements; coordinator work, human delay and billing are
+not automatically covered. A configured spend/time ceiling cannot interrupt an
+already running provider request and refuses new dispatch with unknown measurements.
+
+Native capture follows the documented Claude Code [hook inputs and Agent tool
+response](https://code.claude.com/docs/en/hooks): resolvedModel/modelsUsed and native
+duration/token/tool-use fields when present. It does not invent effort or cost.
+Actual field availability and correlation must be confirmed by the real pilot.
+
+## Release boundary
+
+Framework tests and the synthetic five-size benchmark validate mechanics. They
+cannot measure model reasoning, game quality or end-to-end team productivity.
+Use [the pilot protocol](standalone-pilot.md) before stable promotion. CP0 remains
+reference-only; it is not a valid scored run for this purpose.

package/.claude/nccgs/protocols/standalone-pilot.md

@@ -0,0 +1,144 @@
+> Historical development/reference document. Version, status, commands and plans
+> below describe their original scope, not the current package defaults. Read
+> [current release guidance](../MEMORY.md) before use. Research/benchmark proposals
+> do not automatically add requirements to a delivery contract.
+
+# Claude Code pilot and benchmark protocol
+
+Status: **prepared, not executed**. Framework version: **1.5.0-preview.1**.
+The authorized current work is framework development. Game work resumes later
+through Claude Code. Do not run a provider or change the game merely to fill this report.
+Evaluation scope follows [delivery acceptance](delivery-acceptance.md): measure
+brief fidelity, implementation, testing, review/repair and honest handoff. Balance
+research is a separate product assignment; bot outcomes are not studio scores.
+
+## Provenance and clean starting point
+
+Vector Survivors CP0 was built by Codex. Preserve it, label it contaminated, and
+exclude it from scored orchestration/efficiency results. A copy of its solution
+is not a fresh baseline. Prefer unseen tasks from later checkpoints or a new
+equivalent foundation with withheld solution code. Record solution exposure and
+exclude exposed tasks from independent quality/productivity claims.
+
+Freeze framework/package hash, game starting snapshot, contract, Unity version,
+machine, Claude Code version, permissions, model routes and available measurements
+before each run. Use real Claude Code agent identities and durable raw observations.
+Requested Sonnet/Opus aliases alone are insufficient. Label all synthetic fixture
+data separately; never import it into a real task as runtime evidence.
+
+## Start with a small real pilot
+
+1. Install the local preview into a fresh disposable Unity project. Review dry-run
+   and doctor results; preserve the existing CP0 game untouched.
+2. Start Claude Code, confirm managed hooks load, and read NCCGS memory.
+3. Run one fresh FAST fix in foreground with one worker and one reviewer. Confirm
+   PreToolUse -> SubagentStart -> PostToolUse IDs actually correlate. Inspect raw
+   metadata, model history, missing effort/cost and spent attempts. Do not fabricate
+   fields when the client does not provide them.
+4. Run one audit and one plan task. Attempt no source mutation; verify their outputs
+   and source baseline. Check a failed/blocked report as well as successful closure.
+5. Test an interrupted foreground/background worker, external reconciliation and
+   resume. Confirm no duplicate agent or refunded budget. Check one explicit policy
+   migration/rollback on a copy with pending legacy tasks.
+6. Only after these mechanics pass, run the size benchmark below. A blocked runtime
+   adapter is a pilot finding, not a reason to substitute Codex orchestration.
+
+## Five task sizes in the survivors game
+
+These are example *fresh* tasks. Freeze exact acceptance and withheld checks before
+dispatch; do not reuse a solved task from CP0. Shapes and simple colors are enough.
+
+| Size | Example | Expected route, subject to inspection | Required outcome |
+|---|---|---|---|
+| 1: tiny | Correct a HUD offset across fixed resolutions | implement / FAST if ready and local | Reference comparison, unchanged controls, one bounded fix |
+| 2: small prototype | Add one experimental weapon idea with a simple upgrade | implement / STANDARD | Playable loop and explicit learning questions; no production gate inflation |
+| 3: medium integration slice | Implement the specified timeline with progression, pause, loss/restart and feedback | implement / STANDARD; persistence raises risk | Deterministic state/timing tests, actual player integration checks, bug triage and a reproducible build; no bot-win requirement |
+| 4: medium-large system | Redesign spawning/pooling/performance or plan save-compatible progression | implement or plan / CONTROLLED when cross-system | Measured before/after, architecture rationale, relevant regressions and compatibility |
+| 5: large | Finish a large enemy/weapon/progression feature or audit the complete later game | implement or audit / CONTROLLED | Child contracts, integration/load tests, broad evidence and prioritized findings |
+
+For size 3, exercise normal operations from controlled, disclosed preconditions;
+check normal victory and defeat conditions independently of the bot's skill. A
+ten-minute game timer does not require every state test to wait ten real minutes.
+Verify shipped timer values and boundary logic, then cover the built player's
+relevant integration paths. Do not inject the expected terminal state itself.
+Human balance/feel studies, including participant count and sampling, belong to a
+separate research brief; do not make five playtesters a default NCCGS delivery gate.
+If a delivery brief explicitly requires human accessibility/usability inspection,
+retain that scoped obligation and record human waiting separately.
+For sizes 4–5, lock workload, seed where relevant, entity counts and
+machine/settings before profiling; measure p50/p95/p99 frame time, GC allocations,
+memory growth, restart stability, and relevant save/upgrade compatibility. Do not
+infer frame performance from framework snapshot timing.
+
+## Compare fairly
+
+Use two arms on matched, fresh work: plain Claude Code with a concise team workflow,
+and Claude Code with NCCGS preview. Keep model access, task acceptance and tools
+comparable; record actual route differences. Randomize order and use isolated
+projects/sessions so the second arm does not see the first solution. Blind quality
+review to the arm where practical. Astra is off for the primary benchmark; evaluate
+advisory/required review as a separate experiment, recording added benefit and delay.
+
+Start with two matched pairs per size (20 runs total) as an exploratory pilot. This
+is not enough to claim broad statistical superiority. Extend to the larger sample
+in the implementation plan only after runtime mechanics and task comparability pass.
+Failures, retries, abandoned attempts and intervention remain in the denominator.
+Do not replace failed tasks with easier ones or score only completed work.
+
+## Record useful efficiency and overthinking metrics
+
+| Dimension | Measure | Interpretation |
+|---|---|---|
+| Correctness | Acceptance pass rate; severity-weighted escaped defects | A cheap but incorrect result is not efficient |
+| Delivery | End-to-end elapsed, active executor time, human wait separately | Never compare worker time with another arm's whole task |
+| Resource use | Observed tokens/cost per accepted outcome, coverage and billing source | Unknown is null; report partial coverage |
+| Coordination | Dispatch count, useful specialist contributions, repeated reads, repeated unchanged reviews | Identify overhead that changed no decision or output |
+| Rework | Failed checks, accepted/rejected findings, fix/review rounds | Count every attempt and actual recovery work |
+| Autonomy | Human interventions and reasons; incorrect vs necessary escalations | Don't reward unsafe action or unexplained blocking |
+| Maintainability | Independent assessment of cohesion, clarity, tests and extension cost | Blind review with concrete evidence |
+| Resilience | Crash/resume, duplicate callback, missing evidence, budget conservation | No false success and no hidden attempt reset |
+
+Pre-register what counts as unnecessary analysis: e.g. a repeated unchanged-source
+review with no new evidence, repeated broad document loading with no decision
+dependency, or speculative refactor outside acceptance. A long task alone does
+not establish overthinking. Review whether extra reasoning prevented a real defect.
+
+Compute quality-adjusted productivity only when scope is comparable: accepted
+contract outcomes / total elapsed or observed spend. Show numerator, denominator,
+coverage and uncertainty. Do not fabricate monetary savings from model names.
+Preserve raw runs and per-size results; a single pooled average can hide tiny-task
+overhead behind large-task gains.
+
+## Promotion gates
+
+- **Preview -> stable 1.5:** real hook/identity/model evidence works on the supported
+  client; no known false-DONE, ownership, quota, migration or evidence-loss defect;
+  all five sizes have real results and documented failure recovery; scoped delivery
+  acceptance passes; measurements distinguish unknown values; owner accepts limitations.
+- **Consider 2.0:** demonstrate useful autonomy and repeatable quality/efficiency
+  gains across the agreed workload, including small tasks; assess migration/API
+  compatibility and maintenance cost; explicitly approve major-version scope.
+
+No version promotion is automatic merely because framework fixtures pass.
+
+## Run report template
+
+```text
+Run ID / arm / task size / mode / risk:
+Fresh baseline hash / solution-exposure declaration:
+Framework package hash / client version / Unity / machine:
+Contract + required checks + manual acceptance:
+Requested routes / actual models / missing fields:
+Dispatch IDs / all attempts / reviews / interventions:
+Outcome / accepted criteria / open findings / escaped defects:
+Requirement-to-code-to-test coverage / fixture interventions / independent review:
+Failure attribution: product code / verification helper / bot / orchestration / research:
+Separate product research questions and their status (not a delivery verdict):
+Elapsed / worker time / human wait:
+Tokens and cost / measurement coverage / raw source:
+Game profiling data when applicable:
+Unnecessary analysis observations and counterexamples:
+Recovery actions / budget before and after:
+Independent reviewer / Product Owner decision:
+Limitations and next concrete action:
+```