nccgs 2.0.0 → 2.1.1

package/tests/policy-v15.test.mjs

@@ -1,234 +1,234 @@
-import assert from "node:assert/strict";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import test, { after, before } from "node:test";
-import { fileURLToPath } from "node:url";
-import { executionPolicy, resolveExecution } from "../.claude/nccgs/tools/policy.mjs";
-import { compile, generated } from "../.claude/nccgs/tools/compile-policy.mjs";
-
-const source = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const fixtures = [];
-let packageRoot;
-const temporary = () => { const file = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-v15-policy-")); fixtures.push(file); return file; };
-const write = (project, relative, value) => {
-  const file = path.join(project, relative); fs.mkdirSync(path.dirname(file), { recursive: true });
-  fs.writeFileSync(file, typeof value === "string" ? value : JSON.stringify(value, null, 2));
-};
-const read = (project, relative) => JSON.parse(fs.readFileSync(path.join(project, relative), "utf8"));
-const run = (project, ...args) => spawnSync(process.execPath, [path.join(packageRoot, "scripts/cli.mjs"), ...args], { cwd: project, encoding: "utf8" });
-const succeeds = result => assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
-const project = () => { const directory = temporary(); for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(directory, marker)); return directory; };
-before(() => {
-  packageRoot = temporary();
-  fs.cpSync(source, packageRoot, { recursive: true });
-  // Generate only this disposable package fixture. Source integration belongs to
-  // the root build step, not tests or installer mutation.
-  compile(packageRoot, true);
-});
-after(() => {
-  for (const file of fixtures.reverse()) {
-    assert.ok(path.resolve(file).startsWith(path.resolve(os.tmpdir()) + path.sep + "nccgs-v15-policy-"));
-    fs.rmSync(file, { recursive: true, force: true });
-  }
-});
-
-test("execution policy validates modes, types and compatibility obligations", () => {
-  for (const mode of ["off", "advisory", "required"]) {
-    const result = executionPolicy({ schemaVersion: 1, name: "standalone", externalReview: { mode } });
-    assert.equal(result.externalReview.mode, mode);
-    assert.equal(result.acceptanceRequired, false);
-    assert.equal(result.requireObservedEffort, false);
-    assert.equal(result.maxParallelWorkers, 2);
-  }
-  for (const value of [null, [], {}, { schemaVersion: 2, name: "standalone" },
-    { schemaVersion: 1, name: "other" }, { schemaVersion: 1, name: "standalone", unexpected: true },
-    { schemaVersion: 1, name: "standalone", externalReview: { mode: "auto" } },
-    { schemaVersion: 1, name: "standalone", externalReview: null },
-    { schemaVersion: 1, name: "standalone", externalReview: { mode: "off", actor: "Astra" } },
-    { schemaVersion: 1, name: "standalone", acceptanceRequired: "false" },
-    { schemaVersion: 1, name: "standalone", requireObservedEffort: null },
-    { schemaVersion: 1, name: "standalone", maxParallelWorkers: 5 },
-    { schemaVersion: 1, name: "standalone", maxParallelWorkers: 0 },
-    { schemaVersion: 1, name: "standalone", maxParallelWorkers: null },
-    { schemaVersion: 1, name: "compatibility", externalReview: { mode: "off" } },
-    { schemaVersion: 1, name: "compatibility", acceptanceRequired: false }]) assert.throws(() => executionPolicy(value));
-});
-
-test("missing execution config resolves compatibility independently of model profile", () => {
-  const target = project();
-  fs.cpSync(path.join(packageRoot, ".claude/nccgs"), path.join(target, ".claude/nccgs"), { recursive: true });
-  write(target, ".nccgs/project.yaml", "schema_version: 2\nmodels:\n  profile: claude-standalone\n");
-  const policy = resolveExecution(target);
-  assert.equal(policy.name, "compatibility");
-  assert.equal(policy.profileName, "claude-standalone");
-  assert.equal(policy.externalReview.mode, "required");
-  assert.equal(policy.acceptanceRequired, true);
-  assert.equal(policy.requireObservedEffort, true);
-  assert.equal(policy.maxParallelWorkers, 4);
-});
-
-test("legacy YAML without model selection resolves preserved metadata before package defaults", () => {
-  const target = project();
-  fs.cpSync(path.join(packageRoot, ".claude/nccgs"), path.join(target, ".claude/nccgs"), { recursive: true });
-  const legacy = "schema_version: 1\nownership:\n  protected_paths:\n    - Assets/HandTuned/**\n";
-  write(target, ".nccgs/project.yaml", legacy);
-  write(target, ".nccgs/agent-activation.json", { schemaVersion: 1, profile: "quality" });
-  assert.equal(resolveExecution(target).profileName, "quality");
-  write(target, ".claude/nccgs/install-state.json", { schemaVersion: 3, modelProfile: "inherit" });
-  assert.equal(resolveExecution(target).profileName, "inherit");
-  assert.equal(resolveExecution(target).name, "compatibility");
-  assert.equal(fs.readFileSync(path.join(target, ".nccgs/project.yaml"), "utf8"), legacy);
-  write(target, ".nccgs/project.yaml", legacy + "models:\n  profile: balanced\n");
-  assert.equal(resolveExecution(target).profileName, "balanced");
-});
-
-test("compiler separates standalone ownership from preserved Astra contract", () => {
-  const outputs = generated(packageRoot);
-  const catalog = JSON.parse(outputs.get(".claude/nccgs/workflow-catalog.json"));
-  assert.equal(catalog.executionContracts.standalone.planningOwner, "Claude Code");
-  assert.equal(catalog.executionContracts.compatibility.planningOwner, "Astra");
-  assert.equal(catalog.profileContracts["astra-claude"].reviewModel, "fable");
-  assert.equal(catalog.profileContracts["claude-standalone"].reviewModel, "opus");
-  for (const workflow of catalog.workflows) assert.equal(workflow.ownerByExecution.standalone, "Claude Code");
-  assert.match(outputs.get(".claude/agents/nccgs-adversarial-reviewer.md"), /^model: opus$/m);
-  assert.doesNotMatch(outputs.get(".claude/agents/nccgs-adversarial-reviewer.md"), /^model: fable$/m);
-});
-
-test("generated turn ceilings track the role template and stale documentation is detected", () => {
-  const target = temporary();
-  fs.cpSync(packageRoot, target, { recursive: true });
-  const role = ".claude/nccgs/agent-library/nccgs-adversarial-reviewer.md";
-  const template = fs.readFileSync(path.join(target, role), "utf8");
-  write(target, role, template.replace(/^maxTurns: \d+$/m, "maxTurns: 199"));
-  const outputs = generated(target), routing = outputs.get(".claude/nccgs/routing.generated.md");
-  assert.match(routing, /\| nccgs-adversarial-reviewer \| 199 \|/);
-  assert.match(outputs.get(".claude/agents/nccgs-adversarial-reviewer.md"), /^maxTurns: 199$/m);
-  assert.ok(compile(target).includes(".claude/nccgs/routing.generated.md"));
-  compile(target, true);
-  assert.deepEqual(compile(target), []);
-});
-
-test("new install defaults to standalone without erasing custom settings and hooks", () => {
-  const target = project();
-  const custom = { matcher: "Read", hooks: [{ type: "command", command: "echo project-owned" }] };
-  write(target, ".claude/settings.json", { env: { KEEP: "yes" }, hooks: { PreToolUse: [custom] }, permissions: { allow: ["Read(./docs/**)"] } });
-  succeeds(run(target, "install", "--dry-run"));
-  assert.equal(fs.existsSync(path.join(target, ".nccgs/execution.json")), false);
-  succeeds(run(target, "install"));
-  const policy = resolveExecution(target);
-  assert.equal(policy.name, "standalone");
-  assert.equal(policy.profileName, "claude-standalone");
-  assert.equal(policy.externalReview.mode, "off");
-  assert.deepEqual(policy.profile.models.standard, { model: "opus", effort: "medium" });
-  const settings = read(target, ".claude/settings.json");
-  assert.equal(settings.env.KEEP, "yes");
-  assert.ok(settings.hooks.PreToolUse.some(item => JSON.stringify(item) === JSON.stringify(custom)));
-  assert.ok(settings.permissions.allow.includes("Read(./docs/**)"));
-  assert.equal(settings.model, "opus");
-  succeeds(run(target, "doctor"));
-});
-
-test("update preserves missing legacy execution policy and exact legacy model routes", () => {
-  const target = project();
-  succeeds(run(target, "install", "--model-profile", "astra-claude"));
-  fs.unlinkSync(path.join(target, ".nccgs/execution.json"));
-  const historical = { schemaVersion: 1, id: "pending-legacy", stages: { plan: { actor: "Astra" } }, reviewBudget: { used: 2, limit: 3 } };
-  write(target, ".nccgs/tasks/pending-legacy.json", historical);
-  succeeds(run(target, "update"));
-  assert.equal(fs.existsSync(path.join(target, ".nccgs/execution.json")), false);
-  assert.equal(resolveExecution(target).name, "compatibility");
-  assert.equal(resolveExecution(target).profileName, "astra-claude");
-  assert.equal(read(target, ".claude/settings.json").model, "claude-opus-5-5");
-  assert.deepEqual(read(target, ".nccgs/tasks/pending-legacy.json"), historical);
-});
-
-test("update preserves required external review and custom agent content", () => {
-  const target = project();
-  succeeds(run(target, "install"));
-  const execution = { schemaVersion: 1, name: "standalone", externalReview: { mode: "required" }, acceptanceRequired: true, maxParallelWorkers: 1 };
-  write(target, ".nccgs/execution.json", execution);
-  const agent = ".claude/agents/nccgs-gameplay-programmer.md";
-  const content = fs.readFileSync(path.join(target, agent), "utf8") + "\nProject-owned convention.\n";
-  write(target, agent, content);
-  succeeds(run(target, "update"));
-  assert.deepEqual(read(target, ".nccgs/execution.json"), execution);
-  assert.equal(fs.readFileSync(path.join(target, agent), "utf8"), content);
-  assert.equal(read(target, ".nccgs/framework-overrides.json").overrides.find(item => item.path === agent).status, "pending_review");
-});
-
-test("execution migration previews, preserves task bytes and rolls back configuration", () => {
-  const target = project();
-  succeeds(run(target, "install", "--model-profile", "astra-claude"));
-  fs.unlinkSync(path.join(target, ".nccgs/execution.json"));
-  const taskText = '{"schemaVersion":1,"id":"active","reviewBudget":{"used":2,"limit":3},"stages":{}}\n';
-  write(target, ".nccgs/tasks/active.json", taskText);
-  const oldPolicy = fs.readFileSync(path.join(target, ".nccgs/project.yaml"), "utf8");
-  const oldSettings = fs.readFileSync(path.join(target, ".claude/settings.json"), "utf8");
-  const preview = run(target, "migrate-execution", "--to", "standalone", "--model-profile", "claude-standalone", "--dry-run");
-  succeeds(preview);
-  assert.match(preview.stdout, /Active tasks \(1\): active/);
-  assert.equal(fs.existsSync(path.join(target, ".nccgs/backups/execution")), false);
-  const applied = run(target, "migrate-execution", "--to", "standalone", "--model-profile", "claude-standalone", "--external-review", "advisory");
-  succeeds(applied);
-  const id = applied.stdout.match(/Execution migration ([0-9a-f-]{36}) applied/)[1];
-  assert.equal(resolveExecution(target).externalReview.mode, "advisory");
-  assert.equal(resolveExecution(target).profileName, "claude-standalone");
-  assert.equal(fs.readFileSync(path.join(target, ".nccgs/tasks/active.json"), "utf8"), taskText);
-  succeeds(run(target, "doctor"));
-  succeeds(run(target, "migrate-execution", "--rollback", id, "--dry-run"));
-  assert.equal(resolveExecution(target).name, "standalone");
-  succeeds(run(target, "migrate-execution", "--rollback", id));
-  assert.equal(resolveExecution(target).name, "compatibility");
-  assert.equal(fs.readFileSync(path.join(target, ".nccgs/project.yaml"), "utf8"), oldPolicy);
-  assert.equal(fs.readFileSync(path.join(target, ".claude/settings.json"), "utf8"), oldSettings);
-  assert.equal(fs.readFileSync(path.join(target, ".nccgs/tasks/active.json"), "utf8"), taskText);
-  succeeds(run(target, "doctor"));
-});
-
-test("rollback refuses changed configuration and backup tampering before writes", () => {
-  const target = project();
-  succeeds(run(target, "install"));
-  const migration = run(target, "migrate-execution", "--to", "standalone", "--external-review", "required");
-  succeeds(migration);
-  assert.equal(resolveExecution(target).designReviewRequired, true, "changing external review must preserve the reviewed-design gate");
-  const id = migration.stdout.match(/Execution migration ([0-9a-f-]{36}) applied/)[1];
-  const settings = fs.readFileSync(path.join(target, ".claude/settings.json"), "utf8");
-  write(target, ".claude/settings.json", settings + "\n");
-  let result = run(target, "migrate-execution", "--rollback", id);
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /Configuration changed after migration/);
-  assert.equal(resolveExecution(target).externalReview.mode, "required");
-  write(target, ".claude/settings.json", settings);
-  write(target, `.nccgs/backups/execution/${id}/files/.nccgs/execution.json`, "tampered");
-  result = run(target, "migrate-execution", "--rollback", id);
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /backup missing or changed/);
-  assert.equal(resolveExecution(target).externalReview.mode, "required");
-});
-
-test("doctor rejects malformed execution configuration", () => {
-  const target = project();
-  succeeds(run(target, "install"));
-  write(target, ".nccgs/execution.json", { schemaVersion: 1, name: "standalone", externalReview: { mode: "skip" } });
-  const result = run(target, "doctor");
-  assert.notEqual(result.status, 0);
-  assert.match(result.stderr, /Invalid execution policy/);
-});
-
-test("failed model migration restores prior execution and settings without touching tasks", () => {
-  const target = project();
-  succeeds(run(target, "install", "--model-profile", "astra-claude"));
-  fs.unlinkSync(path.join(target, ".nccgs/execution.json"));
-  write(target, ".claude/settings.json", "malformed-settings");
-  const taskText = '{"id":"failed-migration","schemaVersion":1,"reviewBudget":{"used":2,"limit":3},"stages":{}}';
-  write(target, ".nccgs/tasks/failed-migration.json", taskText);
-  const result = run(target, "migrate-execution", "--to", "standalone", "--model-profile", "claude-standalone");
-  assert.notEqual(result.status, 0);
-  assert.equal(resolveExecution(target).name, "compatibility");
-  assert.equal(fs.readFileSync(path.join(target, ".claude/settings.json"), "utf8"), "malformed-settings");
-  assert.equal(fs.readFileSync(path.join(target, ".nccgs/tasks/failed-migration.json"), "utf8"), taskText);
-  const archive = fs.readdirSync(path.join(target, ".nccgs/backups/execution"))[0];
-  assert.equal(read(target, `.nccgs/backups/execution/${archive}/manifest.json`).status, "failed-restored");
-});
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import test, { after, before } from "node:test";
+import { fileURLToPath } from "node:url";
+import { executionPolicy, resolveExecution } from "../.claude/nccgs/tools/policy.mjs";
+import { compile, generated } from "../.claude/nccgs/tools/compile-policy.mjs";
+
+const source = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const fixtures = [];
+let packageRoot;
+const temporary = () => { const file = fs.mkdtempSync(path.join(os.tmpdir(), "nccgs-v15-policy-")); fixtures.push(file); return file; };
+const write = (project, relative, value) => {
+  const file = path.join(project, relative); fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, typeof value === "string" ? value : JSON.stringify(value, null, 2));
+};
+const read = (project, relative) => JSON.parse(fs.readFileSync(path.join(project, relative), "utf8"));
+const run = (project, ...args) => spawnSync(process.execPath, [path.join(packageRoot, "scripts/cli.mjs"), ...args], { cwd: project, encoding: "utf8" });
+const succeeds = result => assert.equal(result.status, 0, `${result.stdout}\n${result.stderr}`);
+const project = () => { const directory = temporary(); for (const marker of ["Assets", "Packages", "ProjectSettings"]) fs.mkdirSync(path.join(directory, marker)); return directory; };
+before(() => {
+  packageRoot = temporary();
+  fs.cpSync(source, packageRoot, { recursive: true });
+  // Generate only this disposable package fixture. Source integration belongs to
+  // the root build step, not tests or installer mutation.
+  compile(packageRoot, true);
+});
+after(() => {
+  for (const file of fixtures.reverse()) {
+    assert.ok(path.resolve(file).startsWith(path.resolve(os.tmpdir()) + path.sep + "nccgs-v15-policy-"));
+    fs.rmSync(file, { recursive: true, force: true });
+  }
+});
+
+test("execution policy validates modes, types and compatibility obligations", () => {
+  for (const mode of ["off", "advisory", "required"]) {
+    const result = executionPolicy({ schemaVersion: 1, name: "standalone", externalReview: { mode } });
+    assert.equal(result.externalReview.mode, mode);
+    assert.equal(result.acceptanceRequired, false);
+    assert.equal(result.requireObservedEffort, false);
+    assert.equal(result.maxParallelWorkers, 2);
+  }
+  for (const value of [null, [], {}, { schemaVersion: 2, name: "standalone" },
+    { schemaVersion: 1, name: "other" }, { schemaVersion: 1, name: "standalone", unexpected: true },
+    { schemaVersion: 1, name: "standalone", externalReview: { mode: "auto" } },
+    { schemaVersion: 1, name: "standalone", externalReview: null },
+    { schemaVersion: 1, name: "standalone", externalReview: { mode: "off", actor: "Astra" } },
+    { schemaVersion: 1, name: "standalone", acceptanceRequired: "false" },
+    { schemaVersion: 1, name: "standalone", requireObservedEffort: null },
+    { schemaVersion: 1, name: "standalone", maxParallelWorkers: 5 },
+    { schemaVersion: 1, name: "standalone", maxParallelWorkers: 0 },
+    { schemaVersion: 1, name: "standalone", maxParallelWorkers: null },
+    { schemaVersion: 1, name: "compatibility", externalReview: { mode: "off" } },
+    { schemaVersion: 1, name: "compatibility", acceptanceRequired: false }]) assert.throws(() => executionPolicy(value));
+});
+
+test("missing execution config resolves compatibility independently of model profile", () => {
+  const target = project();
+  fs.cpSync(path.join(packageRoot, ".claude/nccgs"), path.join(target, ".claude/nccgs"), { recursive: true });
+  write(target, ".nccgs/project.yaml", "schema_version: 2\nmodels:\n  profile: claude-standalone\n");
+  const policy = resolveExecution(target);
+  assert.equal(policy.name, "compatibility");
+  assert.equal(policy.profileName, "claude-standalone");
+  assert.equal(policy.externalReview.mode, "required");
+  assert.equal(policy.acceptanceRequired, true);
+  assert.equal(policy.requireObservedEffort, true);
+  assert.equal(policy.maxParallelWorkers, 4);
+});
+
+test("legacy YAML without model selection resolves preserved metadata before package defaults", () => {
+  const target = project();
+  fs.cpSync(path.join(packageRoot, ".claude/nccgs"), path.join(target, ".claude/nccgs"), { recursive: true });
+  const legacy = "schema_version: 1\nownership:\n  protected_paths:\n    - Assets/HandTuned/**\n";
+  write(target, ".nccgs/project.yaml", legacy);
+  write(target, ".nccgs/agent-activation.json", { schemaVersion: 1, profile: "quality" });
+  assert.equal(resolveExecution(target).profileName, "quality");
+  write(target, ".claude/nccgs/install-state.json", { schemaVersion: 3, modelProfile: "inherit" });
+  assert.equal(resolveExecution(target).profileName, "inherit");
+  assert.equal(resolveExecution(target).name, "compatibility");
+  assert.equal(fs.readFileSync(path.join(target, ".nccgs/project.yaml"), "utf8"), legacy);
+  write(target, ".nccgs/project.yaml", legacy + "models:\n  profile: balanced\n");
+  assert.equal(resolveExecution(target).profileName, "balanced");
+});
+
+test("compiler separates standalone ownership from preserved Astra contract", () => {
+  const outputs = generated(packageRoot);
+  const catalog = JSON.parse(outputs.get(".claude/nccgs/workflow-catalog.json"));
+  assert.equal(catalog.executionContracts.standalone.planningOwner, "Claude Code");
+  assert.equal(catalog.executionContracts.compatibility.planningOwner, "Astra");
+  assert.equal(catalog.profileContracts["astra-claude"].reviewModel, "fable");
+  assert.equal(catalog.profileContracts["claude-standalone"].reviewModel, "fable");
+  for (const workflow of catalog.workflows) assert.equal(workflow.ownerByExecution.standalone, "Claude Code");
+  assert.match(outputs.get(".claude/agents/nccgs-adversarial-reviewer.md"), /^model: fable$/m);
+  assert.doesNotMatch(outputs.get(".claude/agents/nccgs-adversarial-reviewer.md"), /^model: opus$/m);
+});
+
+test("generated turn ceilings track the role template and stale documentation is detected", () => {
+  const target = temporary();
+  fs.cpSync(packageRoot, target, { recursive: true });
+  const role = ".claude/nccgs/agent-library/nccgs-adversarial-reviewer.md";
+  const template = fs.readFileSync(path.join(target, role), "utf8");
+  write(target, role, template.replace(/^maxTurns: \d+$/m, "maxTurns: 199"));
+  const outputs = generated(target), routing = outputs.get(".claude/nccgs/routing.generated.md");
+  assert.match(routing, /\| nccgs-adversarial-reviewer \| 199 \|/);
+  assert.match(outputs.get(".claude/agents/nccgs-adversarial-reviewer.md"), /^maxTurns: 199$/m);
+  assert.ok(compile(target).includes(".claude/nccgs/routing.generated.md"));
+  compile(target, true);
+  assert.deepEqual(compile(target), []);
+});
+
+test("new install defaults to standalone without erasing custom settings and hooks", () => {
+  const target = project();
+  const custom = { matcher: "Read", hooks: [{ type: "command", command: "echo project-owned" }] };
+  write(target, ".claude/settings.json", { env: { KEEP: "yes" }, hooks: { PreToolUse: [custom] }, permissions: { allow: ["Read(./docs/**)"] } });
+  succeeds(run(target, "install", "--dry-run"));
+  assert.equal(fs.existsSync(path.join(target, ".nccgs/execution.json")), false);
+  succeeds(run(target, "install"));
+  const policy = resolveExecution(target);
+  assert.equal(policy.name, "standalone");
+  assert.equal(policy.profileName, "claude-standalone");
+  assert.equal(policy.externalReview.mode, "off");
+  assert.deepEqual(policy.profile.models.standard, { model: "opus", effort: "high" });
+  const settings = read(target, ".claude/settings.json");
+  assert.equal(settings.env.KEEP, "yes");
+  assert.ok(settings.hooks.PreToolUse.some(item => JSON.stringify(item) === JSON.stringify(custom)));
+  assert.ok(settings.permissions.allow.includes("Read(./docs/**)"));
+  assert.equal(settings.model, "opus");
+  succeeds(run(target, "doctor"));
+});
+
+test("update preserves missing legacy execution policy and exact legacy model routes", () => {
+  const target = project();
+  succeeds(run(target, "install", "--model-profile", "astra-claude"));
+  fs.unlinkSync(path.join(target, ".nccgs/execution.json"));
+  const historical = { schemaVersion: 1, id: "pending-legacy", stages: { plan: { actor: "Astra" } }, reviewBudget: { used: 2, limit: 3 } };
+  write(target, ".nccgs/tasks/pending-legacy.json", historical);
+  succeeds(run(target, "update"));
+  assert.equal(fs.existsSync(path.join(target, ".nccgs/execution.json")), false);
+  assert.equal(resolveExecution(target).name, "compatibility");
+  assert.equal(resolveExecution(target).profileName, "astra-claude");
+  assert.equal(read(target, ".claude/settings.json").model, "claude-opus-5-5");
+  assert.deepEqual(read(target, ".nccgs/tasks/pending-legacy.json"), historical);
+});
+
+test("update preserves required external review and custom agent content", () => {
+  const target = project();
+  succeeds(run(target, "install"));
+  const execution = { schemaVersion: 1, name: "standalone", externalReview: { mode: "required" }, acceptanceRequired: true, maxParallelWorkers: 1 };
+  write(target, ".nccgs/execution.json", execution);
+  const agent = ".claude/agents/nccgs-gameplay-programmer.md";
+  const content = fs.readFileSync(path.join(target, agent), "utf8") + "\nProject-owned convention.\n";
+  write(target, agent, content);
+  succeeds(run(target, "update"));
+  assert.deepEqual(read(target, ".nccgs/execution.json"), execution);
+  assert.equal(fs.readFileSync(path.join(target, agent), "utf8"), content);
+  assert.equal(read(target, ".nccgs/framework-overrides.json").overrides.find(item => item.path === agent).status, "pending_review");
+});
+
+test("execution migration previews, preserves task bytes and rolls back configuration", () => {
+  const target = project();
+  succeeds(run(target, "install", "--model-profile", "astra-claude"));
+  fs.unlinkSync(path.join(target, ".nccgs/execution.json"));
+  const taskText = '{"schemaVersion":1,"id":"active","reviewBudget":{"used":2,"limit":3},"stages":{}}\n';
+  write(target, ".nccgs/tasks/active.json", taskText);
+  const oldPolicy = fs.readFileSync(path.join(target, ".nccgs/project.yaml"), "utf8");
+  const oldSettings = fs.readFileSync(path.join(target, ".claude/settings.json"), "utf8");
+  const preview = run(target, "migrate-execution", "--to", "standalone", "--model-profile", "claude-standalone", "--dry-run");
+  succeeds(preview);
+  assert.match(preview.stdout, /Active tasks \(1\): active/);
+  assert.equal(fs.existsSync(path.join(target, ".nccgs/backups/execution")), false);
+  const applied = run(target, "migrate-execution", "--to", "standalone", "--model-profile", "claude-standalone", "--external-review", "advisory");
+  succeeds(applied);
+  const id = applied.stdout.match(/Execution migration ([0-9a-f-]{36}) applied/)[1];
+  assert.equal(resolveExecution(target).externalReview.mode, "advisory");
+  assert.equal(resolveExecution(target).profileName, "claude-standalone");
+  assert.equal(fs.readFileSync(path.join(target, ".nccgs/tasks/active.json"), "utf8"), taskText);
+  succeeds(run(target, "doctor"));
+  succeeds(run(target, "migrate-execution", "--rollback", id, "--dry-run"));
+  assert.equal(resolveExecution(target).name, "standalone");
+  succeeds(run(target, "migrate-execution", "--rollback", id));
+  assert.equal(resolveExecution(target).name, "compatibility");
+  assert.equal(fs.readFileSync(path.join(target, ".nccgs/project.yaml"), "utf8"), oldPolicy);
+  assert.equal(fs.readFileSync(path.join(target, ".claude/settings.json"), "utf8"), oldSettings);
+  assert.equal(fs.readFileSync(path.join(target, ".nccgs/tasks/active.json"), "utf8"), taskText);
+  succeeds(run(target, "doctor"));
+});
+
+test("rollback refuses changed configuration and backup tampering before writes", () => {
+  const target = project();
+  succeeds(run(target, "install"));
+  const migration = run(target, "migrate-execution", "--to", "standalone", "--external-review", "required");
+  succeeds(migration);
+  assert.equal(resolveExecution(target).designReviewRequired, true, "changing external review must preserve the reviewed-design gate");
+  const id = migration.stdout.match(/Execution migration ([0-9a-f-]{36}) applied/)[1];
+  const settings = fs.readFileSync(path.join(target, ".claude/settings.json"), "utf8");
+  write(target, ".claude/settings.json", settings + "\n");
+  let result = run(target, "migrate-execution", "--rollback", id);
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /Configuration changed after migration/);
+  assert.equal(resolveExecution(target).externalReview.mode, "required");
+  write(target, ".claude/settings.json", settings);
+  write(target, `.nccgs/backups/execution/${id}/files/.nccgs/execution.json`, "tampered");
+  result = run(target, "migrate-execution", "--rollback", id);
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /backup missing or changed/);
+  assert.equal(resolveExecution(target).externalReview.mode, "required");
+});
+
+test("doctor rejects malformed execution configuration", () => {
+  const target = project();
+  succeeds(run(target, "install"));
+  write(target, ".nccgs/execution.json", { schemaVersion: 1, name: "standalone", externalReview: { mode: "skip" } });
+  const result = run(target, "doctor");
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /Invalid execution policy/);
+});
+
+test("failed model migration restores prior execution and settings without touching tasks", () => {
+  const target = project();
+  succeeds(run(target, "install", "--model-profile", "astra-claude"));
+  fs.unlinkSync(path.join(target, ".nccgs/execution.json"));
+  write(target, ".claude/settings.json", "malformed-settings");
+  const taskText = '{"id":"failed-migration","schemaVersion":1,"reviewBudget":{"used":2,"limit":3},"stages":{}}';
+  write(target, ".nccgs/tasks/failed-migration.json", taskText);
+  const result = run(target, "migrate-execution", "--to", "standalone", "--model-profile", "claude-standalone");
+  assert.notEqual(result.status, 0);
+  assert.equal(resolveExecution(target).name, "compatibility");
+  assert.equal(fs.readFileSync(path.join(target, ".claude/settings.json"), "utf8"), "malformed-settings");
+  assert.equal(fs.readFileSync(path.join(target, ".nccgs/tasks/failed-migration.json"), "utf8"), taskText);
+  const archive = fs.readdirSync(path.join(target, ".nccgs/backups/execution"))[0];
+  assert.equal(read(target, `.nccgs/backups/execution/${archive}/manifest.json`).status, "failed-restored");
+});