nccgs 1.3.0 → 2.0.0-rc.2

package/.claude/nccgs/tools/gates.mjs

@@ -1,6 +1,12 @@
 import fs from "node:fs";
 import path from "node:path";
-import { hash, json, contained, artifact, verifyArtifact, atomicJson, loadPipeline } from "./policy.mjs";
+import { performance } from "node:perf_hooks";
+import { hash, json, contained, artifact, verifyArtifact, atomicJson, loadPipeline, resolveExecution } from "./policy.mjs";
+import { canonicalInputs, pinInputs, inputPolicy, isOutput } from "./inputs.mjs";
+import { migrateTaskEvidence } from "./evidence.mjs";
+import { acquireLock } from "./process-lock.mjs";
+import { initializeStandalone, checkStandalone, recordStandalone, extendStandalone, refreshStandalone,
+  reclassifyStandalone, exportExternalStandalone, importExternalStandalone } from "./lifecycle.mjs";
 
 export const stages = ["implementation", "review", "report", "astra", "acceptance"];
 function requireValue(condition, message) { if (!condition) throw new Error(message); }
@@ -8,30 +14,67 @@ export function taskPath(project, id) {
   requireValue(typeof id === "string" && /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,79}$/.test(id), "Invalid task ID");
   return contained(project, `.nccgs/tasks/${id}.json`);
 }
-export function snapshot(project) {
+export function snapshot(project, task = null) {
+  const started = performance.now();
   const excluded = new Set(loadPipeline(project).snapshotExcludes);
+  const policy = inputPolicy(project);
+  const inputs = canonicalInputs(project, policy);
   const files = [];
+  let bytes = 0, readHashMs = 0;
   function walk(relative = "") {
     for (const entry of fs.readdirSync(path.join(project, relative), { withFileTypes: true })) {
       if (!relative && excluded.has(entry.name)) continue;
       const name = relative ? `${relative}/${entry.name}` : entry.name;
       const file = contained(project, name);
+      if (isOutput(name, policy)) continue;
       if (entry.isDirectory()) walk(name);
-      else if (entry.isFile()) files.push([name, hash(fs.readFileSync(file))]);
+      else if (entry.isFile()) {
+        const readStarted = performance.now();
+        const data = fs.readFileSync(file);
+        files.push([name, hash(data)]);
+        bytes += data.length;
+        readHashMs += performance.now() - readStarted;
+      }
       else throw new Error(`Unsupported snapshot entry: ${name}`);
     }
   }
   walk();
   files.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-  return { sha256: hash(JSON.stringify(files)), files: files.length };
+  return { sha256: hash(JSON.stringify({ files, canonicalInputs: inputs.sha256 })), sourceSha256: hash(JSON.stringify(files)), files: files.length,
+    bytes, canonicalInputSha256: inputs.sha256, canonicalInputFiles: inputs.entries.filter(e => e.kind === "file").length,
+    canonicalInputBytes: inputs.bytes, readHashMs: readHashMs + inputs.readHashMs, durationMs: performance.now() - started };
+}
+function tierRoute(pipeline, risk) {
+  const tier = pipeline.contract.taskTiers?.[risk];
+  requireValue(tier, "Task risk must be FAST, STANDARD or CONTROLLED; existing tasks without a risk tier must be recreated and evidence recorded again");
+  const route = pipeline.profiles["astra-claude"].models[tier.implementationClass];
+  requireValue(route && Number.isSafeInteger(tier.maxReviewRounds) && tier.maxReviewRounds > 0, "Invalid task tier policy");
+  return { tier, route: { class: tier.implementationClass, model: route.model, effort: route.effort } };
+}
+function taskRouting(pipeline, task) {
+  const { tier, route } = tierRoute(pipeline, task.risk);
+  requireValue(task.implementationRoute && ["class", "model", "effort"].every(key => task.implementationRoute[key] === route[key]), "Task implementation route missing or changed; create a new task against the current policy");
+  const budget = task.reviewBudget;
+  requireValue(budget && Number.isSafeInteger(budget.used) && budget.used >= 0 && Number.isSafeInteger(budget.limit) && Array.isArray(budget.extensions), "Task review budget missing or invalid; create a new task and record evidence again");
+  let limit = tier.maxReviewRounds;
+  for (const extension of budget.extensions) {
+    requireValue(Number.isSafeInteger(extension.rounds) && extension.rounds > 0 && extension.rounds <= tier.maxReviewRounds && extension.reason?.trim() && Number.isFinite(Date.parse(extension.at)) && extension.previousLimit === limit && extension.newLimit === limit + extension.rounds, "Invalid review budget extension audit");
+    limit = extension.newLimit;
+  }
+  requireValue(budget.limit === limit && budget.used <= limit, "Review budget does not match its extension audit");
+  return { tier, route, budget: { used: budget.used, limit, remaining: limit - budget.used } };
 }
-function initializeUnlocked(project, id, plan, requirements = null) {
+function initializeUnlocked(project, id, plan, requirements = null, risk = "STANDARD") {
   const file = taskPath(project, id);
   requireValue(!fs.existsSync(file), `Task already exists: ${id}`);
   const projectGates = artifact(project, ".nccgs/gates.json");
   const projectPolicy = artifact(project, ".nccgs/project.yaml");
   requireValue(json(verifyArtifact(project, projectGates)).policySha256 === projectPolicy.sha256, "Astra must map/review project gates against the current project.yaml hash");
-  const task = { schemaVersion: 1, id, profile: "astra-claude", createdAt: new Date().toISOString(), pipelineHash: hash(JSON.stringify(loadPipeline(project))), plan: artifact(project, plan), projectPolicy, projectGates, requirements: requirements ? artifact(project, requirements) : null, stages: {}, history: [] };
+  const pipeline = loadPipeline(project);
+  const { tier, route } = tierRoute(pipeline, risk);
+  const task = { schemaVersion: 1, id, profile: "astra-claude", risk, implementationRoute: route,
+    reviewBudget: { used: 0, limit: tier.maxReviewRounds, extensions: [] },
+    createdAt: new Date().toISOString(), pipelineHash: hash(JSON.stringify(pipeline)), plan: artifact(project, plan), projectPolicy, projectGates, requirements: requirements ? artifact(project, requirements) : null, canonicalInputs: pinInputs(project), stages: {}, history: [] };
   atomicJson(file, task);
   return task;
 }
@@ -42,8 +85,10 @@ function runtime(project, task, stage, expected, snap) {
   requireValue(trace.taskId === task.id && trace.snapshot === snap, "Runtime evidence belongs to another task/snapshot");
   requireValue(trace.status === "completed" && trace.sessionId && trace.agentId, "Runtime observation is incomplete");
   requireValue(Date.parse(trace.capturedAt) >= Date.parse(task.createdAt) && Date.parse(trace.capturedAt) <= Date.now(), "Runtime observation has invalid time");
+  requireValue(Date.parse(trace.capturedAt) >= Date.parse(task.canonicalInputs.pinnedAt), "Runtime observation predates current input pin; capture a fresh run");
   const models = trace.modelsUsed?.length ? trace.modelsUsed : [trace.observedModel];
-  const matches = (model) => expected.model === "fable" ? /^claude-fable-\d[\w.-]*$/.test(model ?? "") : model === expected.model;
+  const matches = (model) => expected.model === "fable" ? /^claude-fable-\d[\w.-]*$/.test(model ?? "")
+    : expected.model === "sonnet" ? /^claude-sonnet-\d[\w.-]*$/.test(model ?? "") : model === expected.model;
   requireValue(matches(trace.observedModel) && models.every(matches), "Observed model/fallback does not satisfy pipeline");
   requireValue(trace.observedEffort === expected.effort, "Observed effort missing or mismatched; configuration is not proof");
   requireValue(trace.observationSource, "Runtime observation requires a source artifact");
@@ -53,13 +98,30 @@ function runtime(project, task, stage, expected, snap) {
   requireValue(source.capturedAt === trace.capturedAt && source.status === trace.status, "Observation source time/status mismatch");
   const sourceModels = source.modelsUsed?.length ? source.modelsUsed : [source.observedModel ?? source.resolvedModel];
   requireValue(JSON.stringify(sourceModels) === JSON.stringify(models), "Observation dropped or changed source fallback history");
+  requireValue(stage.runtime.path.startsWith(".nccgs/evidence/runtime/observations/") && trace.observationSource.path.startsWith(".nccgs/evidence/runtime/sources/"), "Runtime evidence is not durable; run task migrate-evidence before closure");
   return trace;
 }
+function reviewEvidence(project, task, stage, expected, snap, implementer, allowNegative = false) {
+  const trace = runtime(project, task, stage, expected, snap);
+  requireValue(`${trace.sessionId}/${trace.agentId}` !== implementer, "Review must be independent of implementation");
+  requireValue(Date.parse(trace.capturedAt) >= Date.parse(task.stages.implementation.recordedAt), "Review runtime predates implementation evidence");
+  requireValue(Array.isArray(stage.findings) && typeof stage.criteriaMet === "boolean", "Review requires findings and an acceptance criteria assessment");
+  requireValue(stage.verdict === "PASS" || (allowNegative && ["CHANGES_REQUIRED", "BLOCKED"].includes(stage.verdict)), "Fable review has not passed");
+  if (stage.verdict === "PASS") {
+    requireValue(!stage.findings.some(f => ["BLOCKER", "HIGH"].includes(f.severity) && f.status !== "RESOLVED"), "Review has open blocking findings");
+    requireValue(stage.criteriaMet === true, "Required acceptance criteria are not proven");
+  }
+  verifyArtifact(project, stage.evidence);
+}
 export function check(project, task, target = "done") {
+  if (task.schemaVersion === 2) return checkStandalone(project, task, target);
   requireValue(task.schemaVersion === 1 && task.profile === "astra-claude", "Unsupported task record");
   taskPath(project, task.id);
   const pipeline = loadPipeline(project);
   requireValue(task.pipelineHash === hash(JSON.stringify(pipeline)), "Pipeline policy changed; create a new task against the new policy");
+  const routing = taskRouting(pipeline, task);
+  requireValue(task.canonicalInputs?.schemaVersion === 1 && Number.isFinite(Date.parse(task.canonicalInputs.pinnedAt)), "Legacy task lacks canonical input pins; run task refresh-inputs --reason TEXT and record fresh evidence");
+  requireValue(task.canonicalInputs.sha256 === canonicalInputs(project).sha256, "Canonical inputs are stale; review the changes, run task refresh-inputs --reason TEXT, and record fresh evidence");
   verifyArtifact(project, task.plan);
   verifyArtifact(project, task.projectPolicy);
   const obligations = [task.projectGates, task.requirements].filter(Boolean).map(ref => json(verifyArtifact(project, ref)));
@@ -77,9 +139,8 @@ export function check(project, task, target = "done") {
     requireValue(Number.isFinite(at) && at >= previous && at <= Date.now(), `${name}: invalid sequence timestamp`);
     previous = at;
     if (name === "implementation" || name === "review") {
-      const className = name === "review" ? "review" : "standard";
-      const trace = runtime(project, task, stage, pipeline.profiles[task.profile].models[className], snap);
       if (name === "implementation") {
+        const trace = runtime(project, task, stage, routing.route, snap);
         implementer = `${trace.sessionId}/${trace.agentId}`;
         requireValue(Array.isArray(stage.checks) && stage.checks.length > 0, "Implementation requires verification evidence");
         for (const test of stage.checks) {
@@ -89,18 +150,14 @@ export function check(project, task, target = "done") {
             const evidence = json(evidenceFile);
             if (evidence.origin === "verification-command") {
               requireValue(evidence.taskId === task.id && evidence.name === test.name && evidence.snapshot === snap && evidence.status === "PASS" && evidence.exitCode === 0 && evidence.sourceUnchanged === true, "Recorded verification execution failed or is stale");
+              requireValue(Date.parse(evidence.startedAt) >= Date.parse(task.canonicalInputs.pinnedAt), "Verification execution predates current input pin; rerun the check");
               verifyArtifact(project, evidence.log);
             }
           }
         }
         for (const spec of obligations) for (const name of spec.requiredChecks) requireValue(stage.checks.some(c => c.name === name && c.status === "PASS"), `Required check missing: ${name}`);
       } else {
-        requireValue(`${trace.sessionId}/${trace.agentId}` !== implementer, "Review must be independent of implementation");
-        requireValue(Date.parse(trace.capturedAt) >= Date.parse(task.stages.implementation.recordedAt), "Review runtime predates implementation evidence");
-        requireValue(stage.verdict === "PASS" && Array.isArray(stage.findings), "Fable review has not passed");
-        requireValue(!stage.findings.some(f => ["BLOCKER", "HIGH"].includes(f.severity) && f.status !== "RESOLVED"), "Review has open blocking findings");
-        requireValue(stage.criteriaMet === true, "Required acceptance criteria are not proven");
-        verifyArtifact(project, stage.evidence);
+        reviewEvidence(project, task, stage, pipeline.profiles[task.profile].models.review, snap, implementer);
       }
     } else if (name === "report") {
       verifyArtifact(project, stage.evidence);
@@ -121,15 +178,27 @@ export function check(project, task, target = "done") {
       if (name === "acceptance") for (const spec of obligations) for (const id of spec.manualGates) requireValue(approval.gates?.some(g => g.id === id && g.decision === "ACCEPTED" && g.reference?.trim()), `Manual gate missing: ${id}`);
     }
   }
-  return { allowed: true, target, snapshot: snap, phase: target === "done" ? "DONE" : `READY_FOR_${target.toUpperCase()}` };
+  const exhausted = target === "review" && routing.budget.remaining === 0;
+  return { allowed: !exhausted, target, snapshot: snap, risk: task.risk, implementationRoute: routing.route, reviewBudget: routing.budget,
+    ...(exhausted ? { message: `Review budget exhausted (${routing.budget.used}/${routing.budget.limit}); stop and escalate. An external operator may explicitly extend-review with a reason; exhausted budget never means PASS` } : {}),
+    phase: exhausted ? "REVIEW_BUDGET_EXHAUSTED" : target === "done" ? "DONE" : `READY_FOR_${target.toUpperCase()}` };
 }
 function recordUnlocked(project, id, name, input) {
+  const existing = json(taskPath(project, id));
+  if (existing.schemaVersion === 2) return recordStandalone(project, existing, name, input);
   requireValue(stages.includes(name), "Unknown pipeline stage");
   if (["astra", "acceptance"].includes(name) && (process.env.CLAUDECODE || process.env.CLAUDE_CODE_ENTRYPOINT)) throw new Error("External sign-offs must be imported outside the Claude session");
   const file = taskPath(project, id);
   const task = json(file);
   const status = check(project, task, name);
+  requireValue(status.allowed, status.message);
   requireValue(input.snapshot === status.snapshot, "Submitted evidence does not cover the current snapshot");
+  if (name === "review") {
+    const pipeline = loadPipeline(project);
+    const implementation = runtime(project, task, task.stages.implementation, status.implementationRoute, status.snapshot);
+    reviewEvidence(project, task, input, pipeline.profiles[task.profile].models.review, status.snapshot, `${implementation.sessionId}/${implementation.agentId}`, true);
+    task.reviewBudget.used += 1;
+  }
   task.history.push({ recordedAt: new Date().toISOString(), replacedFrom: name, stages: structuredClone(task.stages) });
   for (const downstream of stages.slice(stages.indexOf(name))) delete task.stages[downstream];
   task.stages[name] = { ...input, recordedAt: new Date().toISOString() };
@@ -144,6 +213,24 @@ function recordUnlocked(project, id, name, input) {
   atomicJson(file, task);
   return task;
 }
+function extendReviewUnlocked(project, id, reason, rounds) {
+  const existing = json(taskPath(project, id));
+  if (existing.schemaVersion === 2) return extendStandalone(project, existing, reason, rounds);
+  requireValue(!(process.env.CLAUDECODE || process.env.CLAUDE_CODE_ENTRYPOINT), "Review budget extensions must be requested outside the Claude session");
+  requireValue(typeof reason === "string" && reason.trim(), "Review budget extension requires a reason");
+  const file = taskPath(project, id);
+  const task = json(file);
+  check(project, task, "implementation");
+  const { tier } = taskRouting(loadPipeline(project), task);
+  requireValue(Number.isSafeInteger(rounds) && rounds > 0 && rounds <= tier.maxReviewRounds, `Review budget extension requires an integer from 1 to ${tier.maxReviewRounds}`);
+  requireValue(Number.isSafeInteger(task.reviewBudget.limit + rounds), "Review budget limit is too large");
+  const extension = { at: new Date().toISOString(), reason: reason.trim(), rounds, previousLimit: task.reviewBudget.limit, newLimit: task.reviewBudget.limit + rounds };
+  task.reviewBudget.limit = extension.newLimit;
+  task.reviewBudget.extensions.push(extension);
+  task.history.push({ recordedAt: extension.at, action: "extend-review", ...extension });
+  atomicJson(file, task);
+  return task;
+}
 function closeUnlocked(project, id) {
   const file = taskPath(project, id);
   const task = json(file);
@@ -153,15 +240,55 @@ function closeUnlocked(project, id) {
   return status;
 }
 
+function refreshInputsUnlocked(project, id, reason) {
+  const existing = json(taskPath(project, id));
+  if (existing.schemaVersion === 2) return refreshStandalone(project, existing, reason);
+  requireValue(typeof reason === "string" && reason.trim(), "Input refresh requires a reason");
+  const file = taskPath(project, id);
+  const task = json(file);
+  requireValue(task.schemaVersion === 1 && task.profile === "astra-claude", "Unsupported task record");
+  const pipeline = loadPipeline(project);
+  requireValue(task.pipelineHash === hash(JSON.stringify(pipeline)), "Input refresh cannot migrate a changed pipeline");
+  taskRouting(pipeline, task);
+  const projectPolicy = artifact(project, ".nccgs/project.yaml");
+  const projectGates = artifact(project, ".nccgs/gates.json");
+  requireValue(json(verifyArtifact(project, projectGates)).policySha256 === projectPolicy.sha256, "Project gates must be remapped to the current project.yaml hash before input refresh");
+  const plan = artifact(project, task.plan.path);
+  const requirements = task.requirements ? artifact(project, task.requirements.path) : null;
+  const pins = pinInputs(project);
+  task.history.push({ action: "refresh-inputs", recordedAt: pins.pinnedAt, reason: reason.trim(),
+    canonicalInputs: task.canonicalInputs ?? null, plan: task.plan, projectPolicy: task.projectPolicy,
+    projectGates: task.projectGates, requirements: task.requirements, stages: structuredClone(task.stages), closed: task.closed ?? null });
+  Object.assign(task, { canonicalInputs: pins, plan, projectPolicy, projectGates, requirements, stages: {} });
+  delete task.closed;
+  // Validate new mappings before committing; a failed refresh leaves the task intact.
+  check(project, task, "implementation");
+  atomicJson(file, task);
+  return task;
+}
+
 function mutate(project, id, action) {
-  const lock = `${taskPath(project, id)}.lock`;
-  fs.mkdirSync(path.dirname(lock), { recursive: true });
-  let descriptor;
-  try { descriptor = fs.openSync(lock, "wx"); }
-  catch (error) { if (error.code === "EEXIST") throw new Error(`Task ${id} is locked by another writer; inspect ${lock} before recovering a crashed writer`); throw error; }
-  try { fs.writeSync(descriptor, JSON.stringify({ pid: process.pid, at: new Date().toISOString() })); return action(); }
-  finally { fs.closeSync(descriptor); fs.unlinkSync(lock); }
+  const lock = acquireLock(`${taskPath(project, id)}.lock`, { taskId: id });
+  try { return action(); } finally { lock.release(); }
 }
-export const initialize = (project, id, plan, requirements = null) => mutate(project, id, () => initializeUnlocked(project, id, plan, requirements));
+export const withTask = mutate;
+export const initialize = (project, id, plan, requirements = null, risk = null, options = {}) => mutate(project, id, () =>
+  resolveExecution(project).name === "standalone"
+    ? initializeStandalone(project, id, { ...options, plan, requirements, ...(risk ? { risk } : {}) })
+    : initializeUnlocked(project, id, plan, requirements, risk || "STANDARD"));
 export const record = (project, id, stage, evidence) => mutate(project, id, () => recordUnlocked(project, id, stage, evidence));
+export const extendReview = (project, id, reason, rounds) => mutate(project, id, () => extendReviewUnlocked(project, id, reason, rounds));
 export const close = (project, id) => mutate(project, id, () => closeUnlocked(project, id));
+export const refreshInputs = (project, id, reason) => mutate(project, id, () => refreshInputsUnlocked(project, id, reason));
+export const reclassify = (project, id, changes) => mutate(project, id, () => reclassifyStandalone(project, json(taskPath(project, id)), changes));
+export const exportExternal = (project, id, relative) => mutate(project, id, () => exportExternalStandalone(project, json(taskPath(project, id)), relative));
+export const importExternal = (project, id, relative) => mutate(project, id, () => importExternalStandalone(project, json(taskPath(project, id)), relative));
+export const migrateEvidence = (project, id) => mutate(project, id, () => {
+  const file = taskPath(project, id);
+  const result = migrateTaskEvidence(project, json(file));
+  if (result.changed) {
+    result.task.history.push({ action: "migrate-evidence", recordedAt: new Date().toISOString(), migrations: result.migrations });
+    atomicJson(file, result.task);
+  }
+  return { id, changed: result.changed, migrations: result.migrations };
+});

package/.claude/nccgs/tools/inputs.mjs

@@ -0,0 +1,73 @@
+import fs from "node:fs";
+import { performance } from "node:perf_hooks";
+import { contained, json, hash } from "./policy.mjs";
+
+export const inputManifest = ".nccgs/inputs.json";
+export function inputPolicy(project) {
+  const file = contained(project, inputManifest);
+  const policy = fs.existsSync(file) ? json(file) : { schemaVersion: 1, canonicalInputs: [], outputDirectories: [], checks: {} };
+  if (policy.schemaVersion !== 1 || !Array.isArray(policy.canonicalInputs) || !Array.isArray(policy.outputDirectories)
+      || !policy.checks || typeof policy.checks !== "object" || Array.isArray(policy.checks)) throw new Error("Invalid .nccgs/inputs.json schema");
+  for (const key of Object.keys(policy)) if (!["schemaVersion", "canonicalInputs", "outputDirectories", "checks"].includes(key)) throw new Error(`Unknown input manifest field: ${key}`);
+  for (const relative of [...policy.canonicalInputs, ...policy.outputDirectories]) contained(project, relative);
+  for (const relative of policy.outputDirectories) {
+    // Keep source roots in the snapshot. Unity build destinations must be deliberately
+    // placed below these dedicated roots; arbitrary ignore globs are not supported.
+    if (!/^(Build|Builds)\/[A-Za-z0-9_-][A-Za-z0-9_./ -]*$/.test(relative)) throw new Error("Output directories must be explicit subdirectories of Build/ or Builds/");
+    const file = contained(project, relative);
+    if (fs.existsSync(file) && !fs.statSync(file).isDirectory()) throw new Error(`Output path is not a directory: ${relative}`);
+    for (const input of policy.canonicalInputs) if (overlaps(input, relative)) throw new Error(`Canonical input/output overlap: ${input} and ${relative}`);
+  }
+  for (const relative of policy.canonicalInputs) {
+    if (relative.toLowerCase() === ".nccgs" || /^\.nccgs\/(evidence|runtime|tasks|backups|closures)(\/|$)/i.test(relative)) throw new Error(`Generated state cannot be a canonical input: ${relative}`);
+  }
+  for (const [name, config] of Object.entries(policy.checks)) {
+    if (!name.trim() || !config || typeof config !== "object" || Array.isArray(config)
+        || Object.keys(config).some(key => key !== "timeoutMs") || !Number.isSafeInteger(config.timeoutMs)
+        || config.timeoutMs < 100 || config.timeoutMs > 7200000) throw new Error(`Check ${name}: timeoutMs must be an integer from 100 to 7200000`);
+  }
+  return policy;
+}
+function overlaps(a, b) {
+  a = a.toLowerCase(); b = b.toLowerCase();
+  return a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);
+}
+export function isOutput(relative, policy) {
+  const normalize = name => process.platform === "win32" ? name.toLowerCase() : name;
+  return policy.outputDirectories.some(dir => normalize(relative) === normalize(dir) || normalize(relative).startsWith(`${normalize(dir)}/`));
+}
+export function canonicalInputs(project, policy = inputPolicy(project)) {
+  const entries = new Map();
+  let bytes = 0, readHashMs = 0;
+  function capture(relative, optional = false) {
+    if (entries.has(relative)) return;
+    const file = contained(project, relative);
+    if (!fs.existsSync(file)) {
+      if (!optional) throw new Error(`Canonical input missing: ${relative}`);
+      entries.set(relative, { path: relative, kind: "missing" });
+      return;
+    }
+    const stat = fs.statSync(file);
+    if (stat.isDirectory()) {
+      entries.set(relative, { path: relative, kind: "directory" });
+      for (const name of fs.readdirSync(file).sort()) capture(`${relative}/${name}`);
+    } else if (stat.isFile()) {
+      const start = performance.now();
+      const data = fs.readFileSync(file);
+      entries.set(relative, { path: relative, sha256: hash(data), kind: "file" });
+      readHashMs += performance.now() - start;
+      bytes += data.length;
+    } else throw new Error(`Unsupported canonical input: ${relative}`);
+  }
+  capture(inputManifest, true);
+  capture(".nccgs/requirements.yaml", true);
+  capture(".nccgs/autonomy.json", true);
+  capture(".nccgs/decisions", true);
+  for (const relative of policy.canonicalInputs) capture(relative);
+  const files = [...entries.values()].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  return { schemaVersion: 1, sha256: hash(JSON.stringify(files)), entries: files, bytes, readHashMs };
+}
+export function pinInputs(project) {
+  const { schemaVersion, sha256, entries } = canonicalInputs(project);
+  return { schemaVersion, sha256, entries, pinnedAt: new Date().toISOString() };
+}