nccgs 2.0.0-rc.2 → 2.0.0

package/.claude/nccgs/tools/tool-guard.mjs

@@ -4,10 +4,11 @@ import { taskPath, check } from "./gates.mjs";
 import { boundTask } from "./runtime.mjs";
 import { claim, findDispatch, rejectUnclaimed, admitRepairTool, dispatchPrompt, pinnedRepairEvidence } from "./orchestration.mjs";
 import { requireDesignReady } from "./design-readiness.mjs";
+import { inFinalReviewPhase } from "./review-budget.mjs";
 
 const need = (condition, message) => { if (!condition) throw new Error(message); };
 const reads = new Set(["Read", "Glob", "Grep", "WebSearch", "WebFetch", "AskUserQuestion"]);
-const governance = new Set(["init", "bind", "inspect", "check", "snapshot", "ref", "record", "report", "reclassify", "refresh-inputs", "reserve", "dispatch-status", "dispatch-prompt", "checkpoint", "resume", "telemetry", "export-external", "close", "job-status", "job-wait", "acceptance-status", "design-validate", "design-compare"]);
+const governance = new Set(["init", "bind", "inspect", "check", "snapshot", "ref", "record", "report", "reclassify", "refresh-inputs", "reserve", "dispatch-status", "dispatch-prompt", "checkpoint", "resume", "telemetry", "export-external", "close", "job-status", "job-wait", "acceptance-status", "design-validate", "design-compare", "handoff-validate", "record-review", "slice-preview", "slice-plan", "slice-status", "budget-status"]);
 export function parseTaskCommand(command, project = process.cwd()) {
   // Parse data quotes without interpreting a shell. Punctuation inside report
   // text is data; composition/redirection/expansion outside quotes stays blocked.
@@ -47,6 +48,16 @@ export function safeVerifyCommand(command, project = process.cwd()) {
 export function recoveryTool(input, project = process.cwd()) {
   return !input.agent_id && ["Bash", "PowerShell"].includes(input.tool_name) && ["report", "inspect"].includes(safeTaskCommand(input.tool_input?.command ?? "", project));
 }
+function ownHandoffValidation(command, project, task, dispatch) {
+  const parsed = parseTaskCommand(command, project);
+  if (!parsed || parsed.command !== "handoff-validate" || parsed.forwarded || dispatch?.status !== "running") return false;
+  const values = new Map(), args = parsed.options.slice(3);
+  for (let i = 0; i < args.length; i += 2) {
+    if (!["--id", "--dispatch", "--file", "--project"].includes(args[i]) || values.has(args[i]) || !args[i + 1] || args[i + 1].startsWith("--")) return false;
+    values.set(args[i], args[i + 1]);
+  }
+  return values.get("--id") === task?.id && values.get("--dispatch") === dispatch.id && dispatch.handoffPaths?.includes(values.get("--file"));
+}
 export function guardTool(project, input) {
   if (recoveryTool(input, project)) return;
   if (resolveExecution(project).name !== "standalone") return;
@@ -68,7 +79,7 @@ export function guardTool(project, input) {
         const readiness = check(project, task, "review");
         need(readiness.allowed, readiness.message);
       }
-      const prompt = dispatch.workPacket ? dispatchPrompt(project, task.id, dispatch.id).prompt : null;
+      const prompt = dispatch.workPacket || dispatch.slice ? dispatchPrompt(project, task.id, dispatch.id).prompt : null;
       claim(project, dispatch.id, { sessionId: input.session_id, toolUseId: input.tool_use_id, agent: tool.subagent_type });
       if (prompt) return { updatedInput: { ...tool, prompt } };
     } catch (error) {
@@ -87,8 +98,9 @@ export function guardTool(project, input) {
     contained(project, relative);
     need(!/^\.(?:claude|nccgs)(?:\/|$)/i.test(relative) || relative.startsWith(".nccgs/evidence/"), "Framework/governance records must be changed through the task CLI or external configuration");
     if (relative.startsWith(".nccgs/evidence/")) {
+      need(!(dispatch?.handoffTransport === "native-result" && dispatch.handoffPaths?.includes(relative)), "Native-result handoff is captured only from the correlated final response; return text without writing this path");
       need(!pinnedRepairEvidence(project, relative), "Reserved repair packet/context evidence is immutable; preserve it and create a fresh packet for a new eligible attempt");
-      need(!/^\.nccgs\/evidence\/(?:(?:runtime|criteria|design-checks|checkpoints|external\/requests)\/|check-)/i.test(relative), "Captured runtime/checkpoint/verification/external request evidence is immutable and never authored by Claude");
+      need(!/^\.nccgs\/evidence\/(?:(?:runtime|criteria|design-checks|checkpoints|repair-operations|slices|external\/requests)\/|check-)/i.test(relative), "Captured runtime/checkpoint/verification/external request evidence is immutable and never authored by Claude");
       if (input.agent_id && readOnly) need(task?.contract.analysisArtifacts?.includes(relative), "Read-only worker may write only declared analysis artifacts");
       return;
     }
@@ -96,18 +108,20 @@ export function guardTool(project, input) {
     requireDesignReady(project, task);
     need(dispatch && dispatch.status === "running" && dispatch.agentId === input.agent_id, "Source writes require a running, correlated implementation dispatch");
     const lower = relative.toLowerCase();
+    if (dispatch.slice) need(dispatch.writePaths.some(p => lower === p.toLowerCase()), "Slice writes require an exact planned file; directory ownership is not granted");
     need(dispatch.writePaths.some(p => lower === p.toLowerCase() || lower.startsWith(p.toLowerCase() + "/")), "Write is outside this dispatch's owned paths");
     return;
   }
   if (["Bash", "PowerShell"].includes(name)) {
     const command = tool.command ?? "";
-    need(!/\b(?:dispatch-reconcile|extend-dispatch|extend-review|import-external|migrate-execution)\b|--stage\s+["']?(?:acceptance|astra)\b/i.test(command), "External decisions cannot be made by the Claude executor");
+    if (input.agent_id && ownHandoffValidation(command, project, task, dispatch)) return;
+    need(!/\b(?:dispatch-reconcile|extend-dispatch|extend-review|import-external|migrate-execution|migrate-framework|budget-plan)\b|--stage\s+["']?(?:acceptance|astra)\b/i.test(command), "External decisions cannot be made by the Claude executor");
     if (safeTaskCommand(command, project)) { need(!input.agent_id, "Coordinator owns lifecycle commands"); return; }
     need(task && !readOnly, "Audit/plan/review shell execution is blocked; use read tools or externally supplied verification evidence");
     requireDesignReady(project, task);
     // Coordinator may run declared checks after workers finish. This command
     // can execute a verifier, so it is allowed only for implementation tasks.
-    if (!input.agent_id && safeVerifyCommand(command, project)) return;
+    if (!input.agent_id && safeVerifyCommand(command, project)) { need(!inFinalReviewPhase(project, input.session_id), "Final-review reserve cannot run new verification jobs; use existing receipts"); return; }
     need(dispatch?.kind === "implementation" && dispatch.status === "running" && input.agent_id === dispatch.agentId, "Shell mutation requires a correlated implementation worker");
     return;
   }

package/.claude/nccgs/tools/unity-repair.mjs

@@ -0,0 +1,128 @@
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+import { artifact, atomicJson, contained, json, verifyArtifact } from "./policy.mjs";
+import { snapshot } from "./gates.mjs";
+
+const need = (ok, message) => { if (!ok) throw new Error(`Unity repair: ${message}`); };
+const keys = (value, allowed) => value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).every(k => allowed.includes(k));
+const code = /\.(?:cs|asmdef|asmref|shader|hlsl|cginc|compute|uxml|uss)$/i;
+const asset = /\.(?:unity|prefab|asset|mat|controller|overrideController|anim)$/i;
+export const unityCodePath = relative => relative.startsWith("Assets/") && code.test(relative);
+export const unitySceneSafety = "loaded-scenes-clean-v1";
+export const unityRepairProfiles = Object.freeze({
+  "unity-code": Object.freeze({ files: 8, workCalls: 24, readCalls: 12, handoffCalls: 3, durationMs: 900000 }),
+  "unity-editor": Object.freeze({ files: 8, workCalls: 20, readCalls: 8, handoffCalls: 3, durationMs: 900000 })
+});
+
+function guid(project, relative) {
+  const value = fs.readFileSync(contained(project, relative), "utf8").match(/^guid: ([a-f0-9]{32})\r?$/m)?.[1];
+  need(value, `missing or invalid Unity GUID in ${relative}`);
+  return value;
+}
+
+// The packet pins a chosen operation, not a general shell/MCP capability. The
+// installed Unity CLI binds every call to this project's absolute path.
+export function validateUnityRepair(project, packet) {
+  const profile = unityRepairProfiles[packet.repairType];
+  need(profile, "repairType must be unity-code or unity-editor");
+  need(fs.existsSync(contained(project, "ProjectSettings/ProjectVersion.txt")), "requires an existing Unity project");
+  need(packet.changes.length <= profile.files, `at most ${profile.files} exact files per packet`);
+  for (const change of packet.changes) {
+    need(keys(change, ["path", "operation", "instruction"]) && ["edit", "create"].includes(change.operation), "each change needs edit or create operation");
+    need(unityCodePath(change.path) || (packet.repairType === "unity-editor" && change.path.startsWith("Assets/") && asset.test(change.path)), "file type must match the repair profile under Assets/; no raw metadata, packages or project settings");
+    const file = contained(project, change.path);
+    need(fs.statSync(path.dirname(file)).isDirectory(), "create files only in existing folders; folder creation needs a separate scoped change");
+    if (change.operation === "edit") {
+      need(fs.existsSync(file) && fs.statSync(file).isFile(), "edit requires an existing file");
+      guid(project, `${change.path}.meta`);
+    } else need(!fs.existsSync(file) && !fs.existsSync(contained(project, `${change.path}.meta`)), "create target or companion metadata already exists");
+  }
+  need(keys(packet.unity, ["capabilities", "steps"]) && Array.isArray(packet.unity.steps) && packet.unity.steps.length <= 4, "unity requires capabilities and at most four fixed steps");
+  if (packet.unity.steps.length || packet.unity.capabilities !== undefined) {
+    need(packet.unity.capabilities?.path?.startsWith(".nccgs/evidence/") && !packet.unity.capabilities.path.startsWith(".nccgs/evidence/work-packets/"), "pin Unity command discovery evidence");
+    verifyArtifact(project, packet.unity.capabilities);
+  }
+  need((packet.repairType === "unity-code" && packet.changes.every(c => c.operation === "edit")) || packet.unity.steps.length > 0, "asset repairs and new code require an Editor/import step before completion");
+  const ids = new Set();
+  for (const step of packet.unity.steps) {
+    need(keys(step, ["id", "command", "arguments", "timeoutMs"]) && /^[a-zA-Z][\w-]{0,39}$/.test(step.id ?? "") && !ids.has(step.id), "steps need unique bounded IDs");
+    ids.add(step.id);
+    need(/^[a-zA-Z][\w-]{0,79}$/.test(step.command ?? "") && Array.isArray(step.arguments) && step.arguments.length <= 8 &&
+      step.arguments.every(a => typeof a === "string" && a.length <= 8000 && !a.startsWith("-") && !a.includes("\0")), "use a discovered command and positional arguments only; routing/global flags are generated");
+    need(Number.isSafeInteger(step.timeoutMs) && step.timeoutMs >= 1000 && step.timeoutMs <= 60000, "step timeoutMs must be 1000-60000; long verification belongs to managed jobs");
+    need(step.command === "eval" && step.arguments.length === 1, "new Editor steps require eval with one C# statement body so the dirty-scene check runs atomically before the operation");
+    need(!/^\s*(?:global\s+)?using\s+(?:static\s+)?[\w.]+\s*(?:=|;)/m.test(step.arguments[0]), "eval bodies must use fully qualified types; top-level using directives cannot follow the scene guard");
+  }
+  const { files, ...limits } = profile;
+  return limits;
+}
+
+export function captureUnityRepairScope(project, dispatch, source) {
+  if (dispatch.workPacket?.schemaVersion !== 2) return;
+  const metaGuids = Object.fromEntries(dispatch.workPacket.changes.map(c => [c.path, c.operation === "edit" ? guid(project, `${c.path}.meta`) : null]));
+  const relative = `.nccgs/evidence/work-packets/${dispatch.id}-scope.json`;
+  atomicJson(contained(project, relative), { schemaVersion: 1, taskId: dispatch.taskId, dispatchId: dispatch.id,
+    sourceSnapshot: source.sha256, fileEntries: source.fileEntries, metaGuids });
+  dispatch.workPacket.scope = artifact(project, relative);
+}
+
+export function verifyUnityRepairScope(project, dispatch, complete = false) {
+  if (dispatch.workPacket?.schemaVersion !== 2) return;
+  const p = dispatch.workPacket, baseline = json(verifyArtifact(project, p.scope));
+  need(baseline.dispatchId === dispatch.id && baseline.taskId === dispatch.taskId && baseline.sourceSnapshot === dispatch.snapshot, "scope baseline identity changed");
+  const before = new Map(baseline.fileEntries), after = new Map(snapshot(project, null, { includeFiles: true }).fileEntries);
+  const owned = new Set(p.changes.flatMap(c => [c.path, `${c.path}.meta`]));
+  for (const [file, hash] of before) {
+    need(after.has(file), `source file removed: ${file}; deletions/renames are outside this packet`);
+    need(after.get(file) === hash || owned.has(file), `source changed outside exact ownership: ${file}`);
+  }
+  for (const file of after.keys()) need(before.has(file) || owned.has(file), `source created outside exact ownership: ${file}`);
+  for (const c of p.changes) {
+    const meta = `${c.path}.meta`, present = after.has(meta);
+    if (present) {
+      const current = guid(project, meta);
+      need(!baseline.metaGuids[c.path] || current === baseline.metaGuids[c.path], `existing GUID changed: ${meta}`);
+    }
+    if (complete) need(after.has(c.path) && present, `output or imported metadata missing: ${c.path}; finish import before native completion`);
+  }
+}
+
+export function repairEditorCommand(dispatch, step) {
+  return `node .claude/nccgs/tools/task.mjs repair-editor --id ${dispatch.taskId} --dispatch ${dispatch.id} --step ${step.id}`;
+}
+
+export function unityEditorToolScope(dispatch, input) {
+  if (dispatch.workPacket?.schemaVersion !== 2 || input.tool_name !== "Bash") return null;
+  const tool = input.tool_input ?? {}, step = dispatch.workPacket.unity.steps.find(s => repairEditorCommand(dispatch, s) === tool.command);
+  need(step && keys(tool, ["command", "timeout", "description", "run_in_background"]) && tool.run_in_background !== true &&
+    Number.isSafeInteger(tool.timeout) && tool.timeout >= step.timeoutMs + 5000 && tool.timeout <= 120000,
+  "only the fixed repair-editor command is permitted, foreground, with timeout at least step timeoutMs + 5000");
+  return { bucket: "work", read: false, editorStep: step.id };
+}
+
+export function unityEditorInvocation(project, step, safety = null) {
+  need(safety === null || safety === unitySceneSafety, "unknown pinned scene safety policy");
+  let sceneGuard = null, args = step.arguments;
+  if (safety) {
+    need(step.command === "eval" && args.length === 1, "guarded Editor step requires one eval body");
+    sceneGuard = { policy: safety, token: crypto.randomUUID() };
+    // Same Editor eval, before any packet statement: includes untitled/additive
+    // loaded scenes. Never auto-save, discard or switch a dirty scene.
+    const prefix = `{ for (int nccgsSceneIndex = 0; nccgsSceneIndex < UnityEngine.SceneManagement.SceneManager.sceneCount; nccgsSceneIndex++) { var nccgsScene = UnityEngine.SceneManagement.SceneManager.GetSceneAt(nccgsSceneIndex); if (nccgsScene.isDirty) return new { nccgsSceneGuard = "${safety}", token = "${sceneGuard.token}", blockedScene = string.IsNullOrEmpty(nccgsScene.path) ? "<untitled>" : nccgsScene.path }; } }\n`;
+    args = [prefix + args[0]];
+  }
+  return { ...(sceneGuard ? { sceneGuard } : {}), executable: process.platform === "win32" ? "unity.exe" : "unity", arguments: ["command", step.command, ...args,
+    "--caller", "plugin", "--skill", "unity-cli",
+    "--project-path", fs.realpathSync(project), "--timeout", String(Math.ceil(step.timeoutMs / 1000)), "--format", "json", "--no-pager", "--non-interactive"] };
+}
+
+export function blockedUnityScene(invocation, result) {
+  if (!invocation.sceneGuard || result.status !== 0 || result.error || result.signal) return null;
+  try {
+    const response = JSON.parse(result.stdout), envelope = response.data?.result, value = envelope?.result;
+    if (response.success === true && envelope.success === true && value?.nccgsSceneGuard === invocation.sceneGuard.policy &&
+        value.token === invocation.sceneGuard.token && typeof value.blockedScene === "string") return value.blockedScene;
+  } catch { /* Unknown output retains existing conservative execution handling. */ }
+  return null;
+}

package/.claude/nccgs/tools/verification-jobs.mjs

@@ -8,6 +8,7 @@ import { snapshot, taskPath } from "./gates.mjs";
 import { inputPolicy } from "./inputs.mjs";
 import { acquireLock, ownerState, pidState } from "./process-lock.mjs";
 import { captureCriteria, measurementBaseline } from "./criteria.mjs";
+import { inFinalReviewPhase } from "./review-budget.mjs";
 
 const worker = fileURLToPath(new URL("./verification-worker.mjs", import.meta.url));
 const need = (condition, message) => { if (!condition) throw new Error(message); };
@@ -24,8 +25,14 @@ export function finishJob(project, job, result) {
   const directory = jobDirectory(project, job.id);
   const receipt = `.nccgs/evidence/check-${job.id}.json`;
   if (fs.existsSync(contained(project, receipt))) return jobStatus(project, job.id, job.taskId);
-  let after = null, snapshotError = null;
-  try { after = snapshot(project, json(taskPath(project, job.taskId))).sha256; } catch (error) { snapshotError = error.message; }
+  let after = null, afterGenerated = [], snapshotError = null;
+  try {
+    const captured = snapshot(project, json(taskPath(project, job.taskId)));
+    after = captured.sha256; afterGenerated = captured.unityGeneratedFiles ?? [];
+  } catch (error) { snapshotError = error.message; }
+  const beforeGenerated = new Map((job.unityGeneratedBaseline ?? []).map(file => [file.path, file.sha256]));
+  const generatedFileChanges = afterGenerated.filter(file => beforeGenerated.get(file.path) !== file.sha256)
+    .map(file => ({ path: file.path, beforeSha256: beforeGenerated.get(file.path) ?? null, afterSha256: file.sha256 }));
   const logPath = `.nccgs/evidence/check-${job.id}.log`;
   fs.mkdirSync(path.dirname(contained(project, logPath)), { recursive: true });
   if (!fs.existsSync(contained(project, logPath))) fs.writeFileSync(contained(project, logPath), result.error || "No command output captured\n");
@@ -38,6 +45,7 @@ export function finishJob(project, job, result) {
     timeoutMs: job.timeoutMs, supervisorDeadline: job.supervisorDeadline ?? null,
     timedOut: result.timedOut === true, signal: result.signal ?? null,
     snapshotError, executable: job.executable, arguments: job.arguments, exitCode: result.exitCode ?? null,
+    ...(job.unityGeneratedBaseline ? { unityGeneratedFiles: { before: job.unityGeneratedBaseline, after: afterGenerated, changes: generatedFileChanges } } : {}),
     error: result.error ?? null, sourceUnchanged: job.snapshot === after, status, log: artifact(project, logPath),
     acceptance: captureCriteria(project, job, status) });
   atomicJson(path.join(directory, "result.json"), { status, evidence: artifact(project, receipt) });
@@ -83,6 +91,7 @@ export function listJobs(project, taskId) {
 export function pendingJobs(project, taskId) { return listJobs(project, taskId).filter(job => !["PASS", "FAIL"].includes(job.status)); }
 export function startVerification(project, taskId, options) {
   project = fs.realpathSync(project);
+  need(!inFinalReviewPhase(project, process.env.NCCGS_SUPERVISED_SESSION), "Final-review reserve cannot run new verification jobs; use existing receipts");
   const task = json(taskPath(project, taskId));
   need(task.schemaVersion !== 2 || task.mode === "implement" || !(process.env.CLAUDECODE || process.env.CLAUDE_CODE_ENTRYPOINT), "Audit/plan tasks cannot run arbitrary verification commands inside Claude");
   need(typeof options.name === "string" && options.name.trim() && options.executable, "verify requires --name CHECK -- EXECUTABLE [ARGS]");
@@ -107,7 +116,7 @@ export function startVerification(project, taskId, options) {
   const lock = acquireLock(`${index}.lock`, { taskId, requestKey });
   let measurementLock;
   try {
-    const current = snapshot(project, task).sha256;
+    const captured = snapshot(project, task), current = captured.sha256;
     const spec = { taskId, name: options.name, executable: options.executable, arguments: options.arguments ?? [],
       timeoutMs, snapshot: current, contractHash: task.contractHash ?? null,
       ...(supervisorDeadline === undefined ? {} : { supervisorDeadline }),
@@ -133,6 +142,7 @@ export function startVerification(project, taskId, options) {
     fs.mkdirSync(directory, { recursive: true });
     fs.mkdirSync(contained(project, ".nccgs/evidence"), { recursive: true });
     const job = { schemaVersion: 1, id: jobId, project, ...spec, requestKey, requestHash, measurementBaseline: baseline, queuedAt: new Date().toISOString(),
+      ...(captured.unityGeneratedFiles ? { unityGeneratedBaseline: captured.unityGeneratedFiles } : {}),
       sessionId: process.env.NCCGS_SUPERVISED_SESSION || null };
     atomicJson(path.join(directory, "request.json"), job);
     atomicJson(index, { jobId, requestHash }); // pinned before launch: an ambiguous crash cannot mint a duplicate

package/.claude/nccgs/tools/windows-compiler-server.cs

@@ -0,0 +1,163 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.IO.Pipes;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+using System.Security.Principal;
+using System.Text;
+using System.Text.RegularExpressions;
+
+// Optional, fail-closed cleanup for the qualified Unity/Roslyn binary pair.
+// Never kill or exempt a descendant. The caller still waits for an empty Job.
+// Shutdown frame matches BuildRequest.CreateShutdown().WriteAsync() in Roslyn
+// 41a5af9d2c459a06c0795bf21a1c046200f375bf (4.3.1). Unknown builds are untouched.
+internal sealed class NccgsUnityCompilerShutdown {
+  const string CompilerHash = "a671cfd0e1ca5621845cc62c62e1de06233a9c48de76151bc51d36758cd1ca5f";
+  const string HostHash = "d2607dbc6c95c252baaba299b659f156b388c6130ac846f79eb4c768f91a019f";
+  const string Commit = "41a5af9d2c459a06c0795bf21a1c046200f375bf";
+  readonly HashSet<int> attempted = new HashSet<int>();
+  DateTime nextScan = DateTime.MinValue;
+  sealed class Candidate : IDisposable {
+    internal int Pid; internal IntPtr Handle; internal string Pipe;
+    public void Dispose() { if(Handle!=IntPtr.Zero) CloseHandle(Handle); Handle=IntPtr.Zero; }
+  }
+  [DllImport("kernel32.dll", SetLastError=true)] static extern bool QueryInformationJobObject(IntPtr job,int kind,IntPtr data,int size,IntPtr returned);
+  [DllImport("kernel32.dll", SetLastError=true)] static extern IntPtr OpenProcess(uint access,bool inherit,int pid);
+  [DllImport("kernel32.dll", SetLastError=true)] static extern bool IsProcessInJob(IntPtr process,IntPtr job,out bool member);
+  [DllImport("kernel32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern bool QueryFullProcessImageName(IntPtr process,int flags,StringBuilder name,ref int size);
+  [DllImport("kernel32.dll", SetLastError=true)] static extern bool GetNamedPipeServerProcessId(IntPtr pipe,out uint pid);
+  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
+  [DllImport("kernel32.dll")] static extern uint WaitForSingleObject(IntPtr handle,uint timeout);
+  [DllImport("kernel32.dll")] static extern IntPtr LocalFree(IntPtr memory);
+  [DllImport("ntdll.dll")] static extern int NtQueryInformationProcess(IntPtr process,int kind,IntPtr data,int size,out int needed);
+  [DllImport("shell32.dll", CharSet=CharSet.Unicode, SetLastError=true)] static extern IntPtr CommandLineToArgvW(string command,out int count);
+
+  static bool OwnedAlive(IntPtr job,IntPtr process) {
+    bool member;
+    return WaitForSingleObject(process,0)==258 && IsProcessInJob(process,job,out member) && member;
+  }
+  static int[] Members(IntPtr job) {
+    for(int size=4096;size<=1048576;size*=2) {
+      IntPtr data=Marshal.AllocHGlobal(size);
+      try {
+        if(!QueryInformationJobObject(job,3,data,size,IntPtr.Zero)) {
+          if(Marshal.GetLastWin32Error()==234) continue;
+          return null;
+        }
+        int count=Marshal.ReadInt32(data,4);
+        if(count<0 || count>(size-8)/IntPtr.Size) return null;
+        int[] result=new int[count];
+        for(int i=0;i<count;i++) result[i]=checked((int)Marshal.ReadIntPtr(data,8+i*IntPtr.Size).ToInt64());
+        return result;
+      } finally { Marshal.FreeHGlobal(data); }
+    }
+    return null;
+  }
+  static string Image(IntPtr process) {
+    int length=32768; var text=new StringBuilder(length);
+    return QueryFullProcessImageName(process,0,text,ref length) ? text.ToString() : null;
+  }
+  static string Command(IntPtr process) {
+    int needed; NtQueryInformationProcess(process,60,IntPtr.Zero,0,out needed);
+    if(needed<16 || needed>131072) return null;
+    IntPtr data=Marshal.AllocHGlobal(needed);
+    try {
+      int size; if(NtQueryInformationProcess(process,60,data,needed,out size)!=0) return null;
+      int bytes=(ushort)Marshal.ReadInt16(data);
+      IntPtr text=Marshal.ReadIntPtr(data,IntPtr.Size==8?8:4);
+      long offset=text.ToInt64()-data.ToInt64();
+      if(bytes%2!=0 || offset<0 || offset+bytes>needed) return null;
+      return Marshal.PtrToStringUni(text,bytes/2);
+    } finally { Marshal.FreeHGlobal(data); }
+  }
+  static string[] Arguments(string command) {
+    if(String.IsNullOrEmpty(command)) return null;
+    int count; IntPtr data=CommandLineToArgvW(command,out count);
+    if(data==IntPtr.Zero) return null;
+    try {
+      var result=new string[count];
+      for(int i=0;i<count;i++) result[i]=Marshal.PtrToStringUni(Marshal.ReadIntPtr(data,i*IntPtr.Size));
+      return result;
+    } finally { LocalFree(data); }
+  }
+  static string Digest(string file) {
+    using(var stream=File.OpenRead(file)) using(var hash=SHA256.Create())
+      return BitConverter.ToString(hash.ComputeHash(stream)).Replace("-","").ToLowerInvariant();
+  }
+  internal static string QualifiedPipe(string image,string[] args) {
+    if(image==null || args==null || args.Length!=4 || args[1]!="exec" || !Path.IsPathRooted(args[2])) return null;
+    string compiler=Path.GetFullPath(args[2]);
+    string suffix=Path.Combine("Editor","Data","DotNetSdkRoslyn","VBCSCompiler.dll");
+    if(!compiler.EndsWith(Path.DirectorySeparatorChar+suffix,StringComparison.OrdinalIgnoreCase)) return null;
+    string data=Path.GetDirectoryName(Path.GetDirectoryName(compiler));
+    if(!String.Equals(Path.GetFullPath(image),Path.Combine(data,"NetCoreRuntime","dotnet.exe"),StringComparison.OrdinalIgnoreCase)) return null;
+    if(!args[3].StartsWith("-pipename:",StringComparison.Ordinal)) return null;
+    string pipe=args[3].Substring(10);
+    if(!Regex.IsMatch(pipe,@"\A[A-Za-z0-9_.-]{1,160}\z")) return null;
+    if(Digest(compiler)!=CompilerHash || Digest(image)!=HostHash) return null;
+    return pipe;
+  }
+  internal static byte[] ShutdownFrame() {
+    using(var body=new MemoryStream()) {
+      using(var writer=new BinaryWriter(body,Encoding.Unicode,true)) {
+        writer.Write(Guid.Empty.ToByteArray()); writer.Write((uint)1146299681);
+        writer.Write(Commit); writer.Write(1); writer.Write(1360294437);
+        writer.Write(0); writer.Write(0); writer.Flush();
+      }
+      using(var framed=new MemoryStream()) using(var writer=new BinaryWriter(framed)) {
+        writer.Write(checked((int)body.Length)); writer.Write(body.ToArray()); return framed.ToArray();
+      }
+    }
+  }
+  static bool ReadExact(Stream stream,byte[] bytes) {
+    int offset=0;
+    while(offset<bytes.Length) {
+      var read=stream.ReadAsync(bytes,offset,bytes.Length-offset);
+      if(!read.Wait(1000) || read.Result==0) return false;
+      offset+=read.Result;
+    }
+    return true;
+  }
+  // Peer PID is verified on this exact open pipe before any bytes are written.
+  // A same-name pipe belonging to a foreign server receives no shutdown request.
+  internal static bool Request(IntPtr job,IntPtr process,int pid,string pipeName) {
+    using(var pipe=new NamedPipeClientStream(".",pipeName,PipeDirection.InOut,PipeOptions.Asynchronous,TokenImpersonationLevel.Identification)) {
+      pipe.Connect(250);
+      uint serverPid;
+      if(!GetNamedPipeServerProcessId(pipe.SafePipeHandle.DangerousGetHandle(),out serverPid) || serverPid!=(uint)pid || !OwnedAlive(job,process)) return false;
+      byte[] frame=ShutdownFrame();
+      if(!pipe.WriteAsync(frame,0,frame.Length).Wait(1000)) return false;
+      byte[] length=new byte[4]; if(!ReadExact(pipe,length) || BitConverter.ToInt32(length,0)!=8) return false;
+      byte[] response=new byte[8]; if(!ReadExact(pipe,response)) return false;
+      return BitConverter.ToInt32(response,0)==3 && BitConverter.ToInt32(response,4)==pid;
+    }
+  }
+  internal void TryRequest(IntPtr job) {
+    if(DateTime.UtcNow<nextScan) return;
+    nextScan=DateTime.UtcNow.AddMilliseconds(500);
+    var candidates=new List<Candidate>();
+    try {
+      int[] members=Members(job); if(members==null || members.Length==0) return;
+      foreach(int pid in members) {
+        IntPtr process=OpenProcess(0x00101000,false,pid);
+        if(process==IntPtr.Zero) return; // uncertain membership/liveness: leave ownership alone
+        var candidate=new Candidate { Pid=pid,Handle=process };
+        candidates.Add(candidate);
+        if(!OwnedAlive(job,process)) return;
+        string image=Image(process);
+        if(String.Equals(image,Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System),"conhost.exe"),StringComparison.OrdinalIgnoreCase)) continue;
+        candidate.Pipe=QualifiedPipe(image,Arguments(Command(process)));
+        // Do not shut down even a known compiler while another real worker remains.
+        if(candidate.Pipe==null) return;
+      }
+      foreach(var c in candidates) {
+        if(c.Pipe==null || !attempted.Add(c.Pid)) continue;
+        bool acknowledged=false;
+        try { acknowledged=Request(job,c.Handle,c.Pid,c.Pipe); } catch { /* keep original ownership and timeout */ }
+        Console.Error.WriteLine("[NCCGS] Owned Unity compiler {0}: graceful shutdown {1}; waiting for all descendants.",c.Pid,acknowledged?"acknowledged":"unconfirmed");
+      }
+    } catch { /* Unknown runtime/process data never authorizes cleanup or completion. */ }
+    finally { foreach(var c in candidates) c.Dispose(); }
+  }
+}

package/.claude/nccgs/tools/windows-job.cs

@@ -73,7 +73,14 @@ public static class NccgsWindowsJob {
       if(!CreateProcess(executable,command,IntPtr.Zero,IntPtr.Zero,true,0x00080000|0x08000000,IntPtr.Zero,cwd,ref start,out proc)) throw Error("Create process in Job Object");
       WaitForSingleObject(proc.process,0xffffffff); uint code; if(!GetExitCodeProcess(proc.process,out code)) throw Error("Process result");
       // A root exit is not completion: retain ownership until every descendant exits.
-      for(;;) { Accounting data; if(!QueryInformationJobObject(job,1,out data,Marshal.SizeOf(typeof(Accounting)),IntPtr.Zero)) throw Error("Descendant state"); if(data.active==0) break; System.Threading.Thread.Sleep(50); }
+      var compilerShutdown=new NccgsUnityCompilerShutdown();
+      for(;;) {
+        Accounting data;
+        if(!QueryInformationJobObject(job,1,out data,Marshal.SizeOf(typeof(Accounting)),IntPtr.Zero)) throw Error("Descendant state");
+        if(data.active==0) break;
+        compilerShutdown.TryRequest(job);
+        System.Threading.Thread.Sleep(50);
+      }
       return unchecked((int)code);
     } finally {
       if(proc.thread!=IntPtr.Zero) CloseHandle(proc.thread); if(proc.process!=IntPtr.Zero) CloseHandle(proc.process);

package/CHANGELOG.md

@@ -1,5 +1,118 @@
 # Changelog
 
+## 2.0.0 — 2026-10-28
+
+Prepared stable package; unpublished. Local preparation does not move npm tags.
+
+- Publish existing external operator Editor start, graceful shutdown command and
+  settled stop receipts into immutable reviewer-readable project bundles. Preserve
+  original bytes, hashes and ownership, reject inconsistent/uncertain/forced stops,
+  and identify historical imports without rewriting sealed tasks or verdicts.
+- Keep RC4 handoff, scene guard, source controls, process management, independent
+  review, acceptance and total-budget enforcement unchanged. No new game gate or
+  process permission is introduced.
+- Record scoped exact-RC4 native qualification: real dirty-scene refusal, new repair,
+  automatic PARTIAL handoff with no continuation, all 28 criteria/385 assertions,
+  independent PASS and normal closure. The original LOW evidence-location finding
+  remains in that sealed review; its addendum is assessed separately.
+- Stable archive validation and independent maintenance review are recorded in
+  release receipts. They do not claim another full Unity task through these bytes.
+
+
+## 2.0.0-rc.4 — 2026-10-28
+
+Prepared candidate; unpublished. No npm tag or stable promotion.
+
+- Settle a protected implementation work phase with a deterministic PARTIAL
+  report when current implementation and measured checks are ready for review.
+  A prose-only response no longer spends another continuation solely on handoff.
+  Preserve independent verdicts, all acceptance gates, history and original caps.
+- Pin an atomic loaded-scene precondition to new Unity repair reservations.
+  Dirty named, additive or untitled scenes block the operation without auto-save
+  or discard. Retain failed attempts and old reservations; no implicit retry.
+- Reserve final independent review money/time within the original root budget.
+  Share the work pool across design, slices, repair and verification. Admit
+  unknown worker cost only through verified, exclusive native session coverage;
+  missing session usage fails closed, and resumed cumulative cost is never summed
+  twice. The prior native reserve case qualified its disclosed new-script and
+  asset repair path with 28 criteria/385 assertions and independent final PASS.
+- RC4-specific handoff/scene changes receive framework tests and operator Unity
+  checks. A fresh native task through this exact archive remains pending.
+
+- Qualify the full component lifecycle on a fresh Unity project through actual
+  Claude Code: reviewed design, two dependent implementation slices from API
+  scaffolds, first-import verification, independent review, a disclosed fault,
+  typed repair and independent re-review. All 24 original criteria (349 assertions)
+  pass; the real failed PlayMode attempt remains recorded. The combined design and
+  implementation phases used 7/12 dispatches, three independent reviews and
+  USD 10.214066/12 within the original 75-minute envelope. Installed source guards,
+  process ownership, role limits, criteria and history remained unchanged. This
+  known-test component qualification does not establish broad game productivity.
+- Add opt-in exact `unityGeneratedFiles` declarations before task initialization
+  so Unity's first import can create IDE/local metadata without a false source
+  mutation failure. Pin the declaration as a canonical input and retain output
+  before/after hashes in managed receipts. Keep all undeclared files tracked;
+  reject source paths, folders, globs and canonical overlaps. Existing policies,
+  historical attempts, process ownership, review and budgets remain unchanged.
+- Settle cold Unity compilation without waiting for the qualified Roslyn server's
+  idle keepalive. After the command root exits and no other worker remains, request
+  graceful shutdown only from the verified compiler pipe inside the owned Windows
+  Job Object. Match the tested compiler/host binary hashes; unknown builds retain
+  the original wait/timeout behavior. Still drain every descendant and preserve the
+  command exit code, deadlines, independent review, criteria, history and budgets.
+- Avoid Unity CLI's two-minute idle auth broker in managed verification command
+  trees using the supported process-local `UNITY_NO_AUTH_BROKER=1` setting.
+  Preserve OS process ownership, descendant draining, failure/timeout semantics,
+  account settings, independent review, acceptance criteria and spent budgets.
+- Add bounded task slices with preview, pinned plans, dependency tracking and
+  focused worker prompts inside one original task. Final integration retains all
+  original criteria/checks and a reviewer independent of every contributor.
+- Protect aggregate dispatch capacity, original repair/QA/review reserves and
+  review limits. Preserve plan revisions, partial attempts and dependency history;
+  retries do not reset limits or create child/session budgets. Cost/time admission
+  stays unchanged.
+- Qualify the two-slice and existing-file `unity-code` repair path with actual
+  Claude Code workers and Unity tests on 2026-10-27. The controlled regression
+  retains all 24 criteria, failed evidence, both independent reviews and original
+  total budgets. This known-component case does not qualify large-game productivity,
+  new-file imports, Editor asset operations or the exact published RC archive.
+- Add opt-in schema-2 Unity repair packets: exact code edits/creation or pinned
+  Editor asset operations. Preserve schema-1 limits and historical reservations.
+- Bound Editor operations to one project, fixed positional arguments, finite
+  foreground calls and durable single-attempt receipts. Check source scope and
+  existing GUIDs; import new metadata before completion. Uncertain operations
+  retain ownership until externally reconciled, without refunds or automatic retry.
+- Unity repair still requires original measured checks, independent review and
+  manual/external acceptance. Synthetic tests do not qualify native Unity delivery.
+- Synchronize architecture and orchestration guidance with standalone defaults;
+  generate native role ceilings from agent-library frontmatter alongside routing.
+- Extend `task dispatch-prompt` to prepare registered implementation, analysis and
+  review assignments with safe PARTIAL handoff templates. Repair packets keep
+  their existing prompt and permissions.
+- Add read-only `task handoff-validate` for a worker's own declared handoff and
+  coordinator inspection, so schema errors can be corrected before completion.
+- Add coordinator `task record-review` to import a completed reviewer's exact
+  pinned result through the existing record gate. Review independence, objective
+  criteria, external/manual gates, task history and spent budgets are preserved.
+- The scoped native qualifications above predate the final RC4 handoff/scene
+  additions. Their frozen source, tests and historical evidence remain separate.
+
+## 2.0.0-rc.3 — 2026-10-07
+
+Published-1.3.0 upgrade correction on next; latest remains unchanged.
+
+- Fixed false overrides when a role generated by a 1.3.0 profile becomes a managed
+  file in 2.0. Existing generated fingerprints now identify unchanged agent files;
+  later user edits and explicit overrides still require review.
+- RC2 qualification exposed the issue in quality, balanced and inherit profiles.
+  The astra-claude path was unaffected. Original failed results are retained.
+- Release qualification uses the published 1.3.0 archive and the exact candidate
+  archive across four model profiles, owner settings and open task history,
+  override preservation, dry runs, explicit execution migration, rollback and
+  refusal of changed configuration/backups. See docs/UPGRADE-QUALIFICATION.md.
+- A new task executed by Claude Code through this exact release remains pending;
+  this correction does not promote stable or change the frozen game evaluation.
+
 ## 2.0.0-rc.2 — 2026-10-07
 
 Release documentation follow-up on next; latest remains unchanged.
@@ -40,3 +153,13 @@ The game case ran a frozen framework with a session-only reviewer turn-capacity
 override. This RC packages the maintained source. Upgrade qualification from
 published 1.3.0 and a fresh end-to-end task using this exact RC are pending.
 Try a disposable project or backed-up copy; see UPGRADING.md.
+# Stable preparation follow-up — 2.0.0 (unpublished)
+
+- Correct remaining current-version RC labels while retaining historical release
+  records and their original qualification scope.
+- Add opt-in, correlated native-result transport for read-only analysis/review
+  handoffs when the native client requires returned text. Copies exact output;
+  existing review, acceptance, source, process and budget gates still apply.
+- Failed audit attempts and their consumed allowances remain in their original
+  history. New qualification and publication require their own explicit evidence.
+

package/MEMORY.md

@@ -1,8 +1,9 @@
 # NCCGS — portable framework decisions
 
 NCCGS means **New Claude Code Game Studio** and targets **Claude Code**.
-This is the public 2.0.0-rc.2 release candidate, distributed through npm's next tag.
-It is not stable promotion. See README.md and CHANGELOG.md for release scope.
+This is the prepared 2.0.0 stable package. It has not been published.
+Local preparation does not change npm tags. Native RC4 qualification is scoped
+to its frozen archive; see README.md and CHANGELOG.md for evidence boundaries.
 Project-specific authorizations, provider sessions, budgets and internal development
 history are retained separately, outside the public package. Nothing in this file
 authorizes spending, provider access or changes to a user's project by itself.