nccgs 2.1.0 → 2.1.1

package/scripts/doctor.mjs

@@ -1,261 +1,261 @@
-#!/usr/bin/env node
-
-import fs from "node:fs";
-import path from "node:path";
-import { matchesFingerprint, sameFingerprint } from "../.claude/nccgs/tools/integrity.mjs";
-import { check as checkTask, snapshot, stages } from "../.claude/nccgs/tools/gates.mjs";
-import { hash, json, profilePolicy, resolveExecution, verifyArtifact } from "../.claude/nccgs/tools/policy.mjs";
-import { assertProjectRoot, assertRelativePath, containedPath } from "../.claude/nccgs/tools/paths.mjs";
-import { inputPolicy } from "../.claude/nccgs/tools/inputs.mjs";
-import { autonomyPolicy } from "../.claude/nccgs/tools/autonomy.mjs";
-
-const args = process.argv.slice(2);
-const projectIndex = args.indexOf("--project");
-const allowMigrationRequired = args.includes("--allow-migration-required") || args.includes("--allow-policy-migration");
-const warnings = [];
-const errors = [];
-if (projectIndex >= 0 && !args[projectIndex + 1]) {
-  console.error("--project requires a directory path.");
-  process.exit(2);
-}
-
-const project = projectIndex >= 0 ? path.resolve(args[projectIndex + 1]) : process.cwd();
-try { assertProjectRoot(project); }
-catch (error) { console.error(`ERROR: ${error.message}`); process.exit(1); }
-for (const marker of ["Assets", "Packages", "ProjectSettings"]) {
-  const file = safePath(marker);
-  if (file && !fs.existsSync(file)) errors.push(`Missing Unity marker: ${marker}`);
-}
-
-const statePath = safePath(".claude/nccgs/install-state.json");
-const overridePath = safePath(".nccgs/framework-overrides.json");
-const state = readJson(statePath, "NCCGS install state", true);
-const overrideManifest = readJson(overridePath, "NCCGS framework override manifest", false);
-if (state && ![1, 2, 3].includes(state.schemaVersion)) errors.push(`Unsupported install-state schema: ${state.schemaVersion ?? "unknown"}.`);
-if (overrideManifest && overrideManifest.schemaVersion !== 1) errors.push(`Unsupported framework override schema: ${overrideManifest.schemaVersion ?? "unknown"}.`);
-
-const overrides = new Map();
-for (const item of overrideManifest?.overrides ?? []) {
-  if (!isManagedRelative(item.path) || !new Set(["preserve", "absent"]).has(item.disposition)
-      || !new Set(["approved", "pending_review"]).has(item.status)) {
-    errors.push(`Invalid framework override record: ${item.path ?? "path missing"}`);
-    continue;
-  }
-  if (overrides.has(item.path)) errors.push(`Duplicate framework override: ${item.path}`);
-  overrides.set(item.path, item);
-}
-
-let verifiedManaged = 0;
-if (state) {
-  for (const item of state.files ?? []) {
-    if (!isManagedRelative(item.relative)) {
-      errors.push(`Unsafe managed path in install state: ${item.relative ?? "missing"}`);
-      continue;
-    }
-    const file = safePath(item.relative);
-    if (!file) continue;
-    const override = overrides.get(item.relative);
-    if (override) {
-      const recordedUpstream = {
-        sha256: override.upstreamSha256,
-        canonicalSha256: override.upstreamCanonicalSha256
-      };
-      if (!sameFingerprint(item, recordedUpstream)) errors.push(`Framework override has stale upstream hashes: ${item.relative}`);
-      validateOverride(override, file);
-      verifiedManaged++;
-      continue;
-    }
-    if (!fs.existsSync(file)) errors.push(`Managed file is missing: ${item.relative}`);
-    else if (!matchesFingerprint(file, item)) errors.push(`Managed file was modified: ${item.relative}`);
-    else verifiedManaged++;
-  }
-}
-for (const item of overrides.values()) {
-  if ((state?.files ?? []).some((managed) => managed.relative === item.path)) continue;
-  const file = safePath(item.path);
-  if (file) validateOverride(item, file);
-}
-
-const claudePath = safePath("CLAUDE.md");
-if (claudePath && (!fs.existsSync(claudePath) || !fs.readFileSync(claudePath, "utf8").includes("@.claude/nccgs/constitution.md"))) {
-  errors.push("CLAUDE.md does not import the NCCGS constitution.");
-}
-
-const policyPath = safePath(".nccgs/project.yaml");
-let policySchema = null;
-if (policyPath && !fs.existsSync(policyPath)) errors.push(".nccgs/project.yaml is missing.");
-else if (policyPath) {
-  const policyText = fs.readFileSync(policyPath, "utf8");
-  const match = policyText.match(/^schema_version:\s*(\d+)\s*$/m);
-  policySchema = match ? Number(match[1]) : null;
-  if (policySchema !== 2) migrationIssue(`Project policy schema must be 2; found ${policySchema ?? "unknown"}.`);
-  if (/^profile_contracts:/m.test(policyText)) migrationIssue("Legacy embedded profile_contracts require Astra migration to pipeline.json plus project gate mapping.");
-}
-
-validateSettings();
-let execution = null;
-try {
-  execution = resolveExecution(project);
-  if (!fs.existsSync(containedPath(project, ".nccgs/execution.json"))) warnings.push("No execution.json: compatibility obligations remain active. Standalone requires explicit migrate-execution; updating does not waive pending external review.");
-  if (!execution.requireObservedEffort) warnings.push("Execution permits unknown observed effort; configured effort is intent, not runtime proof. Report unavailable provider model/effort evidence as unknown.");
-} catch (error) { errors.push(`Invalid execution policy: ${error.message}`); }
-try { inputPolicy(project); }
-catch (error) { errors.push(`Invalid canonical input/output policy: ${error.message}`); }
-
-const activationPath = safePath(".nccgs/agent-activation.json");
-if (activationPath && fs.existsSync(activationPath)) {
-  try {
-    const activation = json(activationPath);
-    for (const [relative, expected] of Object.entries(activation.generated)) {
-      const bytes = fs.readFileSync(containedPath(project, relative));
-      if (hash(bytes) !== expected && hash(bytes.toString("utf8").replace(/\r\n/g, "\n")) !== activation.generatedCanonical?.[relative]) errors.push(`Activated agent modified: ${relative}`);
-    }
-    for (const warning of activation.warnings ?? []) migrationIssue(warning);
-  } catch (error) { errors.push(`Invalid agent activation state: ${error.message}`); }
-}
-const tasksDir = safePath(".nccgs/tasks");
-if (tasksDir && fs.existsSync(tasksDir)) for (const file of fs.readdirSync(tasksDir).filter(f => f.endsWith(".json"))) {
-  try {
-    const task = json(containedPath(project, `.nccgs/tasks/${file}`));
-    if (task.schemaVersion !== 2 && execution?.name === "standalone") warnings.push(`Legacy task ${task.id} retains compatibility stages and budget; explicit continuation/re-pin is required to adopt standalone policy.`);
-    const executionCurrent = task.schemaVersion !== 2 || hash(JSON.stringify(execution)) === task.executionHash;
-    if (!executionCurrent) warnings.push(`Task ${task.id} is pinned to another execution policy; preserve its history and explicitly continue/re-pin before claiming completion.`);
-    if (!task.canonicalInputs) warnings.push(`Task ${task.id} predates canonical input pins; it is historical only until refresh-inputs and fresh evidence are recorded.`);
-    if (task.closed) {
-      const required = task.schemaVersion === 2 ? [task.mode === "implement" ? "implementation" : "analysis", "review", "report"] : stages;
-      const terminal = task.schemaVersion === 2 ? task.stages?.report : task.stages?.acceptance;
-      if (!required.every(s => task.stages?.[s]) || task.closed.snapshot !== terminal?.snapshot) throw new Error("Closure lacks its required stage records");
-      if (task.schemaVersion === 2 && (task.execution?.acceptanceRequired || task.contract?.acceptanceRequired) && !task.stages?.acceptance) throw new Error("Closure lacks required acceptance");
-      verifyStoredEvidence(task);
-      if (executionCurrent && task.canonicalInputs && task.closed.snapshot === snapshot(project, task).sha256) checkTask(project, task, "done");
-      else warnings.push(`Historical closure ${task.id} is for a different snapshot; it cannot approve current work.`);
-    }
-  } catch (error) { errors.push(`Invalid closed task ${file}: ${error.message}`); }
-}
-if (errors.length) {
-  for (const error of errors) console.error(`ERROR: ${error}`);
-  for (const warning of warnings) console.warn(`WARN: ${warning}`);
-  console.error(`NCCGS doctor failed with ${errors.length} error(s).`);
-  process.exit(1);
-}
-
-for (const warning of warnings) console.warn(`WARN: ${warning}`);
-console.log("NCCGS doctor passed.");
-console.log(`Framework version: ${state.frameworkVersion}`);
-console.log(`Model profile: ${state.modelProfile}`);
-console.log(`Execution policy: ${execution?.name}; external review: ${execution?.externalReview.mode}; maximum parallel workers: ${execution?.maxParallelWorkers}`);
-console.log(`Reviewed design gate: ${execution?.name === "standalone" && execution?.designReviewRequired === true ? "required for feature implementation" : "legacy/compatibility policy; not proof of document readiness"}`);
-console.log(`Managed files verified: ${verifiedManaged}`);
-console.log(`Framework overrides: ${overrides.size} (${[...overrides.values()].filter((item) => item.status !== "approved").length} pending review)`);
-console.log(`Project policy schema: ${policySchema ?? "migration required"}`);
-console.log("Settings scope: project settings and observable local overrides only; CLI, user/managed settings, provider routing and active-session model/effort still require runtime verification.");
-
-function validateOverride(item, file) {
-  if (item.status !== "approved") migrationIssue(`Framework override awaits /migrate-project review: ${item.path}`);
-  if (item.disposition === "absent") {
-    if (fs.existsSync(file)) errors.push(`Override expects a missing file, but it exists: ${item.path}`);
-    return;
-  }
-  if (!fs.existsSync(file)) errors.push(`Preserved framework override is missing: ${item.path}`);
-  else if (!matchesFingerprint(file, item)) errors.push(`Preserved framework override changed after it was recorded: ${item.path}`);
-}
-
-function migrationIssue(message) {
-  if (allowMigrationRequired) warnings.push(message);
-  else errors.push(message);
-}
-
-function readJson(file, label, required) {
-  if (!file) return null;
-  if (!fs.existsSync(file)) {
-    if (required) errors.push(`${label} is missing.`);
-    return null;
-  }
-  try { return JSON.parse(fs.readFileSync(file, "utf8")); }
-  catch (error) {
-    errors.push(`${label} is invalid JSON: ${error.message}`);
-    return null;
-  }
-}
-
-function isManagedRelative(value) {
-  try { return assertRelativePath(value).startsWith(".claude/"); }
-  catch { return false; }
-}
-
-function safePath(relative) {
-  try { return containedPath(project, relative); }
-  catch (error) { errors.push(`Unsafe NCCGS path: ${error.message}`); return null; }
-}
-
-function verifyStoredEvidence(task) {
-  const verify = (ref, runtime = false) => {
-    const file = verifyArtifact(project, ref);
-    if (!ref.path.endsWith(".json")) return;
-    const record = json(file);
-    if (runtime) {
-      verifyArtifact(project, record.observationSource);
-      if (record.evidenceMigration?.archivedObservation) verifyArtifact(project, record.evidenceMigration.archivedObservation);
-    } else if (record.origin === "verification-command") verifyArtifact(project, record.log);
-  };
-  for (const stage of Object.values(task.stages ?? {})) {
-    if (stage.runtime) verify(stage.runtime, true);
-    if (stage.evidence) verify(stage.evidence);
-    for (const check of stage.checks ?? []) verify(check.evidence);
-    for (const artifact of stage.artifacts ?? []) verify(artifact);
-  }
-  for (const receipt of task.externalReviews ?? []) verify(receipt.evidence);
-}
-
-function validateSettings() {
-  const settings = readJson(safePath(".claude/settings.json"), "Claude project settings", true);
-  const fragment = readJson(safePath(".claude/nccgs/settings.fragment.json"), "NCCGS settings fragment", true);
-  const local = readJson(safePath(".claude/settings.local.json"), "Claude local settings", false);
-  const object = value => value && typeof value === "object" && !Array.isArray(value);
-  if (!object(settings) || !object(fragment)) {
-    errors.push("Claude project settings and NCCGS settings fragment must be JSON objects.");
-    return;
-  }
-  if (local !== null && !object(local)) errors.push("Claude local settings must be a JSON object.");
-  for (const [label, value] of [["project", settings], ["local", local]]) {
-    if (value?.disableAllHooks === true) errors.push(`Claude ${label} settings disable all hooks.`);
-  }
-  for (const [event, groups] of Object.entries(fragment.hooks ?? {})) {
-    for (const expected of groups) for (const hook of expected.hooks ?? []) {
-      const actualGroups = Array.isArray(settings.hooks?.[event]) ? settings.hooks[event] : [];
-      const present = actualGroups.some(group => group && (group.matcher ?? "") === (expected.matcher ?? "")
-        && Array.isArray(group.hooks) && group.hooks.some(actual => actual && actual.type === hook.type && actual.command === hook.command
-          && actual.async !== true && (actual.timeout === undefined || actual.timeout >= hook.timeout)));
-      if (!present) errors.push(`Required NCCGS hook missing or altered: ${event} [${expected.matcher ?? ""}] ${hook.command}`);
-    }
-  }
-  let autonomy = "guarded";
-  try { autonomy = autonomyPolicy(project).mode; }
-  catch (error) { errors.push(error.message); }
-  for (const [key, required] of Object.entries(fragment.permissions ?? {})) {
-    for (const rule of required) if (!Array.isArray(settings.permissions?.[key]) || !settings.permissions[key].includes(rule)) {
-      errors.push(`Required NCCGS permission ${key} rule missing: ${rule}`);
-    }
-  }
-  if (autonomy === "full") {
-    console.log("Task autonomy: full (native permission mode requires nccgs run; configuration is not runtime proof).");
-    console.log("NCCGS integrity/destructive-action guards, explicit deny/ask rules and managed/OS restrictions remain effective.");
-  }
-  try {
-    if (!safePath(".claude/nccgs/pipeline.json")) return;
-    const { name, profile } = profilePolicy(project, state?.modelProfile);
-    const declared = policyPath && fs.existsSync(policyPath)
-      ? fs.readFileSync(policyPath, "utf8").match(/^models:[ \t]*\r?\n((?:[ \t]+[^\n]*\n?|\s*\n)*)/m)?.[1]?.match(/^\s+profile:\s*([^#\r\n]+)/m)?.[1]?.trim().replace(/^['"]|['"]$/g, "") : null;
-    if (declared && declared !== name) errors.push(`Project model profile ${declared} differs from installed profile ${name}; reconfigure models.`);
-    if (profile.session) {
-      const route = profile.models[profile.session.class];
-      if (settings.model !== route.model) errors.push(`Project session model must be ${route.model}; found ${settings.model ?? "missing"}.`);
-      if (settings.effortLevel !== route.effort) errors.push(`Project session effort must be ${route.effort}; found ${settings.effortLevel ?? "missing"}.`);
-      if (settings.modelSettings?.[route.model]?.effortLevel !== route.effort) errors.push(`Project per-model effort for ${route.model} must be ${route.effort}.`);
-      if (local?.model !== undefined && local.model !== route.model) errors.push(`Local settings override the required session model ${route.model}.`);
-      if (local?.effortLevel !== undefined && local.effortLevel !== route.effort) errors.push(`Local settings override the required session effort ${route.effort}.`);
-      if (local?.modelSettings?.[route.model]?.effortLevel !== undefined && local.modelSettings[route.model].effortLevel !== route.effort) errors.push(`Local settings override the required per-model effort for ${route.model}.`);
-    }
-  } catch (error) { errors.push(`Cannot verify session model policy: ${error.message}`); }
-  if (local) warnings.push("Local Claude settings are present; project requirements were checked without treating local hook additions as replacements. Runtime overrides are not fully observable by doctor.");
-}
+#!/usr/bin/env node
+import { requiredHookPresent } from "../.claude/nccgs/tools/hook-transport.mjs";
+
+import fs from "node:fs";
+import path from "node:path";
+import { matchesFingerprint, sameFingerprint } from "../.claude/nccgs/tools/integrity.mjs";
+import { check as checkTask, snapshot, stages } from "../.claude/nccgs/tools/gates.mjs";
+import { hash, json, profilePolicy, resolveExecution, verifyArtifact } from "../.claude/nccgs/tools/policy.mjs";
+import { assertProjectRoot, assertRelativePath, containedPath } from "../.claude/nccgs/tools/paths.mjs";
+import { inputPolicy } from "../.claude/nccgs/tools/inputs.mjs";
+import { autonomyPolicy } from "../.claude/nccgs/tools/autonomy.mjs";
+
+const args = process.argv.slice(2);
+const projectIndex = args.indexOf("--project");
+const allowMigrationRequired = args.includes("--allow-migration-required") || args.includes("--allow-policy-migration");
+const warnings = [];
+const errors = [];
+if (projectIndex >= 0 && !args[projectIndex + 1]) {
+  console.error("--project requires a directory path.");
+  process.exit(2);
+}
+
+const project = projectIndex >= 0 ? path.resolve(args[projectIndex + 1]) : process.cwd();
+try { assertProjectRoot(project); }
+catch (error) { console.error(`ERROR: ${error.message}`); process.exit(1); }
+for (const marker of ["Assets", "Packages", "ProjectSettings"]) {
+  const file = safePath(marker);
+  if (file && !fs.existsSync(file)) errors.push(`Missing Unity marker: ${marker}`);
+}
+
+const statePath = safePath(".claude/nccgs/install-state.json");
+const overridePath = safePath(".nccgs/framework-overrides.json");
+const state = readJson(statePath, "NCCGS install state", true);
+const overrideManifest = readJson(overridePath, "NCCGS framework override manifest", false);
+if (state && ![1, 2, 3].includes(state.schemaVersion)) errors.push(`Unsupported install-state schema: ${state.schemaVersion ?? "unknown"}.`);
+if (overrideManifest && overrideManifest.schemaVersion !== 1) errors.push(`Unsupported framework override schema: ${overrideManifest.schemaVersion ?? "unknown"}.`);
+
+const overrides = new Map();
+for (const item of overrideManifest?.overrides ?? []) {
+  if (!isManagedRelative(item.path) || !new Set(["preserve", "absent"]).has(item.disposition)
+      || !new Set(["approved", "pending_review"]).has(item.status)) {
+    errors.push(`Invalid framework override record: ${item.path ?? "path missing"}`);
+    continue;
+  }
+  if (overrides.has(item.path)) errors.push(`Duplicate framework override: ${item.path}`);
+  overrides.set(item.path, item);
+}
+
+let verifiedManaged = 0;
+if (state) {
+  for (const item of state.files ?? []) {
+    if (!isManagedRelative(item.relative)) {
+      errors.push(`Unsafe managed path in install state: ${item.relative ?? "missing"}`);
+      continue;
+    }
+    const file = safePath(item.relative);
+    if (!file) continue;
+    const override = overrides.get(item.relative);
+    if (override) {
+      const recordedUpstream = {
+        sha256: override.upstreamSha256,
+        canonicalSha256: override.upstreamCanonicalSha256
+      };
+      if (!sameFingerprint(item, recordedUpstream)) errors.push(`Framework override has stale upstream hashes: ${item.relative}`);
+      validateOverride(override, file);
+      verifiedManaged++;
+      continue;
+    }
+    if (!fs.existsSync(file)) errors.push(`Managed file is missing: ${item.relative}`);
+    else if (!matchesFingerprint(file, item)) errors.push(`Managed file was modified: ${item.relative}`);
+    else verifiedManaged++;
+  }
+}
+for (const item of overrides.values()) {
+  if ((state?.files ?? []).some((managed) => managed.relative === item.path)) continue;
+  const file = safePath(item.path);
+  if (file) validateOverride(item, file);
+}
+
+const claudePath = safePath("CLAUDE.md");
+if (claudePath && (!fs.existsSync(claudePath) || !fs.readFileSync(claudePath, "utf8").includes("@.claude/nccgs/constitution.md"))) {
+  errors.push("CLAUDE.md does not import the NCCGS constitution.");
+}
+
+const policyPath = safePath(".nccgs/project.yaml");
+let policySchema = null;
+if (policyPath && !fs.existsSync(policyPath)) errors.push(".nccgs/project.yaml is missing.");
+else if (policyPath) {
+  const policyText = fs.readFileSync(policyPath, "utf8");
+  const match = policyText.match(/^schema_version:\s*(\d+)\s*$/m);
+  policySchema = match ? Number(match[1]) : null;
+  if (policySchema !== 2) migrationIssue(`Project policy schema must be 2; found ${policySchema ?? "unknown"}.`);
+  if (/^profile_contracts:/m.test(policyText)) migrationIssue("Legacy embedded profile_contracts require Astra migration to pipeline.json plus project gate mapping.");
+}
+
+validateSettings();
+let execution = null;
+try {
+  execution = resolveExecution(project);
+  if (!fs.existsSync(containedPath(project, ".nccgs/execution.json"))) warnings.push("No execution.json: compatibility obligations remain active. Standalone requires explicit migrate-execution; updating does not waive pending external review.");
+  if (!execution.requireObservedEffort) warnings.push("Execution permits unknown observed effort; configured effort is intent, not runtime proof. Report unavailable provider model/effort evidence as unknown.");
+} catch (error) { errors.push(`Invalid execution policy: ${error.message}`); }
+try { inputPolicy(project); }
+catch (error) { errors.push(`Invalid canonical input/output policy: ${error.message}`); }
+
+const activationPath = safePath(".nccgs/agent-activation.json");
+if (activationPath && fs.existsSync(activationPath)) {
+  try {
+    const activation = json(activationPath);
+    for (const [relative, expected] of Object.entries(activation.generated)) {
+      const bytes = fs.readFileSync(containedPath(project, relative));
+      if (hash(bytes) !== expected && hash(bytes.toString("utf8").replace(/\r\n/g, "\n")) !== activation.generatedCanonical?.[relative]) errors.push(`Activated agent modified: ${relative}`);
+    }
+    for (const warning of activation.warnings ?? []) migrationIssue(warning);
+  } catch (error) { errors.push(`Invalid agent activation state: ${error.message}`); }
+}
+const tasksDir = safePath(".nccgs/tasks");
+if (tasksDir && fs.existsSync(tasksDir)) for (const file of fs.readdirSync(tasksDir).filter(f => f.endsWith(".json"))) {
+  try {
+    const task = json(containedPath(project, `.nccgs/tasks/${file}`));
+    if (task.schemaVersion !== 2 && execution?.name === "standalone") warnings.push(`Legacy task ${task.id} retains compatibility stages and budget; explicit continuation/re-pin is required to adopt standalone policy.`);
+    const executionCurrent = task.schemaVersion !== 2 || hash(JSON.stringify(execution)) === task.executionHash;
+    if (!executionCurrent) warnings.push(`Task ${task.id} is pinned to another execution policy; preserve its history and explicitly continue/re-pin before claiming completion.`);
+    if (!task.canonicalInputs) warnings.push(`Task ${task.id} predates canonical input pins; it is historical only until refresh-inputs and fresh evidence are recorded.`);
+    if (task.closed) {
+      const required = task.schemaVersion === 2 ? [task.mode === "implement" ? "implementation" : "analysis", "review", "report"] : stages;
+      const terminal = task.schemaVersion === 2 ? task.stages?.report : task.stages?.acceptance;
+      if (!required.every(s => task.stages?.[s]) || task.closed.snapshot !== terminal?.snapshot) throw new Error("Closure lacks its required stage records");
+      if (task.schemaVersion === 2 && (task.execution?.acceptanceRequired || task.contract?.acceptanceRequired) && !task.stages?.acceptance) throw new Error("Closure lacks required acceptance");
+      verifyStoredEvidence(task);
+      if (executionCurrent && task.canonicalInputs && task.closed.snapshot === snapshot(project, task).sha256) checkTask(project, task, "done");
+      else warnings.push(`Historical closure ${task.id} is for a different snapshot; it cannot approve current work.`);
+    }
+  } catch (error) { errors.push(`Invalid closed task ${file}: ${error.message}`); }
+}
+if (errors.length) {
+  for (const error of errors) console.error(`ERROR: ${error}`);
+  for (const warning of warnings) console.warn(`WARN: ${warning}`);
+  console.error(`NCCGS doctor failed with ${errors.length} error(s).`);
+  process.exit(1);
+}
+
+for (const warning of warnings) console.warn(`WARN: ${warning}`);
+console.log("NCCGS doctor passed.");
+console.log(`Framework version: ${state.frameworkVersion}`);
+console.log(`Model profile: ${state.modelProfile}`);
+console.log(`Execution policy: ${execution?.name}; external review: ${execution?.externalReview.mode}; maximum parallel workers: ${execution?.maxParallelWorkers}`);
+console.log(`Reviewed design gate: ${execution?.name === "standalone" && execution?.designReviewRequired === true ? "required for feature implementation" : "legacy/compatibility policy; not proof of document readiness"}`);
+console.log(`Managed files verified: ${verifiedManaged}`);
+console.log(`Framework overrides: ${overrides.size} (${[...overrides.values()].filter((item) => item.status !== "approved").length} pending review)`);
+console.log(`Project policy schema: ${policySchema ?? "migration required"}`);
+console.log("Settings scope: project settings and observable local overrides only; CLI, user/managed settings, provider routing and active-session model/effort still require runtime verification.");
+
+function validateOverride(item, file) {
+  if (item.status !== "approved") migrationIssue(`Framework override awaits /migrate-project review: ${item.path}`);
+  if (item.disposition === "absent") {
+    if (fs.existsSync(file)) errors.push(`Override expects a missing file, but it exists: ${item.path}`);
+    return;
+  }
+  if (!fs.existsSync(file)) errors.push(`Preserved framework override is missing: ${item.path}`);
+  else if (!matchesFingerprint(file, item)) errors.push(`Preserved framework override changed after it was recorded: ${item.path}`);
+}
+
+function migrationIssue(message) {
+  if (allowMigrationRequired) warnings.push(message);
+  else errors.push(message);
+}
+
+function readJson(file, label, required) {
+  if (!file) return null;
+  if (!fs.existsSync(file)) {
+    if (required) errors.push(`${label} is missing.`);
+    return null;
+  }
+  try { return JSON.parse(fs.readFileSync(file, "utf8")); }
+  catch (error) {
+    errors.push(`${label} is invalid JSON: ${error.message}`);
+    return null;
+  }
+}
+
+function isManagedRelative(value) {
+  try { return assertRelativePath(value).startsWith(".claude/"); }
+  catch { return false; }
+}
+
+function safePath(relative) {
+  try { return containedPath(project, relative); }
+  catch (error) { errors.push(`Unsafe NCCGS path: ${error.message}`); return null; }
+}
+
+function verifyStoredEvidence(task) {
+  const verify = (ref, runtime = false) => {
+    const file = verifyArtifact(project, ref);
+    if (!ref.path.endsWith(".json")) return;
+    const record = json(file);
+    if (runtime) {
+      verifyArtifact(project, record.observationSource);
+      if (record.evidenceMigration?.archivedObservation) verifyArtifact(project, record.evidenceMigration.archivedObservation);
+    } else if (record.origin === "verification-command") verifyArtifact(project, record.log);
+  };
+  for (const stage of Object.values(task.stages ?? {})) {
+    if (stage.runtime) verify(stage.runtime, true);
+    if (stage.evidence) verify(stage.evidence);
+    for (const check of stage.checks ?? []) verify(check.evidence);
+    for (const artifact of stage.artifacts ?? []) verify(artifact);
+  }
+  for (const receipt of task.externalReviews ?? []) verify(receipt.evidence);
+}
+
+function validateSettings() {
+  const settings = readJson(safePath(".claude/settings.json"), "Claude project settings", true);
+  const fragment = readJson(safePath(".claude/nccgs/settings.fragment.json"), "NCCGS settings fragment", true);
+  const local = readJson(safePath(".claude/settings.local.json"), "Claude local settings", false);
+  const object = value => value && typeof value === "object" && !Array.isArray(value);
+  if (!object(settings) || !object(fragment)) {
+    errors.push("Claude project settings and NCCGS settings fragment must be JSON objects.");
+    return;
+  }
+  if (local !== null && !object(local)) errors.push("Claude local settings must be a JSON object.");
+  for (const [label, value] of [["project", settings], ["local", local]]) {
+    if (value?.disableAllHooks === true) errors.push(`Claude ${label} settings disable all hooks.`);
+  }
+  for (const [event, groups] of Object.entries(fragment.hooks ?? {})) {
+    for (const expected of groups) for (const hook of expected.hooks ?? []) {
+      const actualGroups = Array.isArray(settings.hooks?.[event]) ? settings.hooks[event] : [];
+      const present = actualGroups.some(group => group && (group.matcher ?? "") === (expected.matcher ?? "")
+        && Array.isArray(group.hooks) && group.hooks.some(actual => requiredHookPresent(actual, hook)));
+      if (!present) errors.push(`Required NCCGS hook missing or altered: ${event} [${expected.matcher ?? ""}] ${hook.command}`);
+    }
+  }
+  let autonomy = "guarded";
+  try { autonomy = autonomyPolicy(project).mode; }
+  catch (error) { errors.push(error.message); }
+  for (const [key, required] of Object.entries(fragment.permissions ?? {})) {
+    for (const rule of required) if (!Array.isArray(settings.permissions?.[key]) || !settings.permissions[key].includes(rule)) {
+      errors.push(`Required NCCGS permission ${key} rule missing: ${rule}`);
+    }
+  }
+  if (autonomy === "full") {
+    console.log("Task autonomy: full (native permission mode requires nccgs run; configuration is not runtime proof).");
+    console.log("NCCGS integrity/destructive-action guards, explicit deny/ask rules and managed/OS restrictions remain effective.");
+  }
+  try {
+    if (!safePath(".claude/nccgs/pipeline.json")) return;
+    const { name, profile } = profilePolicy(project, state?.modelProfile);
+    const declared = policyPath && fs.existsSync(policyPath)
+      ? fs.readFileSync(policyPath, "utf8").match(/^models:[ \t]*\r?\n((?:[ \t]+[^\n]*\n?|\s*\n)*)/m)?.[1]?.match(/^\s+profile:\s*([^#\r\n]+)/m)?.[1]?.trim().replace(/^['"]|['"]$/g, "") : null;
+    if (declared && declared !== name) errors.push(`Project model profile ${declared} differs from installed profile ${name}; reconfigure models.`);
+    if (profile.session) {
+      const route = profile.models[profile.session.class];
+      if (settings.model !== route.model) errors.push(`Project session model must be ${route.model}; found ${settings.model ?? "missing"}.`);
+      if (settings.effortLevel !== route.effort) errors.push(`Project session effort must be ${route.effort}; found ${settings.effortLevel ?? "missing"}.`);
+      if (settings.modelSettings?.[route.model]?.effortLevel !== route.effort) errors.push(`Project per-model effort for ${route.model} must be ${route.effort}.`);
+      if (local?.model !== undefined && local.model !== route.model) errors.push(`Local settings override the required session model ${route.model}.`);
+      if (local?.effortLevel !== undefined && local.effortLevel !== route.effort) errors.push(`Local settings override the required session effort ${route.effort}.`);
+      if (local?.modelSettings?.[route.model]?.effortLevel !== undefined && local.modelSettings[route.model].effortLevel !== route.effort) errors.push(`Local settings override the required per-model effort for ${route.model}.`);
+    }
+  } catch (error) { errors.push(`Cannot verify session model policy: ${error.message}`); }
+  if (local) warnings.push("Local Claude settings are present; project requirements were checked without treating local hook additions as replacements. Runtime overrides are not fully observable by doctor.");
+}