nccgs 2.1.0 → 2.1.1

package/scripts/validate.mjs

@@ -1,280 +1,285 @@
-import crypto from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-import { spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import { compile } from "../.claude/nccgs/tools/compile-policy.mjs";
-import { executionPolicy } from "../.claude/nccgs/tools/policy.mjs";
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const errors = [];
-const warnings = [];
-const posix = (value) => value.split(path.sep).join("/");
-
-function walk(directory) {
-  if (!fs.existsSync(directory)) return [];
-  const output = [];
-  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
-    const full = path.join(directory, entry.name);
-    if (entry.isDirectory()) output.push(...walk(full));
-    else if (entry.isFile()) output.push(full);
-  }
-  return output.sort((a, b) => a.localeCompare(b));
-}
-
-function sha256(file) {
-  return crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
-}
-
-function frontmatter(file) {
-  const text = fs.readFileSync(file, "utf8");
-  const match = text.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
-  if (!match) return null;
-  const result = {};
-  for (const line of match[1].split(/\r?\n/)) {
-    const item = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
-    if (item) result[item[1]] = item[2].replace(/^['"]|['"]$/g, "").trim();
-  }
-  return result;
-}
-
-function requireFile(relative) {
-  if (!fs.existsSync(path.join(root, relative))) errors.push(`Missing required file: ${relative}`);
-}
-
-for (const relative of [
-  "VERSION", "README.md", "CLAUDE.md", "MEMORY.md", "LICENSE", "package.json",
-  "THIRD_PARTY_NOTICES.md", ".claude/nccgs/THIRD_PARTY_NOTICES.md",
-  ".claude/nccgs/VERSION", ".claude/nccgs/constitution.md", ".claude/nccgs/MEMORY.md",
-  ".claude/nccgs/studio.json", ".claude/nccgs/workflow-catalog.json",
-  ".claude/nccgs/pipeline.json", ".claude/nccgs/protocols/task-gates.md",
-  ".claude/nccgs/protocols/design-lifecycle.md", ".claude/nccgs/tools/design-readiness.mjs", "scaffold/.nccgs/templates/design-contract.json",
-  ".claude/nccgs/tools/task.mjs", ".claude/nccgs/tools/gates.mjs", ".claude/nccgs/tools/runtime.mjs",
-  ".claude/nccgs/tools/handoff.mjs", "docs/HANDOFF-AUTOMATION.md",
-  ".claude/nccgs/tools/task-slices.mjs", ".claude/nccgs/protocols/task-slices.md",
-  "scaffold/.nccgs/templates/task-slices.json", "docs/TASK-SLICING.md", "tests/task-slices.test.mjs",
-  ".claude/nccgs/tools/repair-packet.mjs", ".claude/nccgs/protocols/bounded-repair.md", "scaffold/.nccgs/templates/repair-packet.json", "docs/BOUNDED-REPAIR.md",
-  ".claude/nccgs/tools/unity-repair.mjs", "scaffold/.nccgs/templates/repair-unity-code.json", "scaffold/.nccgs/templates/repair-unity-editor.json",
-  "scaffold/.nccgs/gates.json", "scaffold/.nccgs/execution.json", "tests/gates.test.mjs",
-  ".claude/nccgs/settings.fragment.json", ".claude/nccgs/unity-skills-manifest.json",
-  ".claude/nccgs/protocols/agent-contract.md", ".claude/nccgs/protocols/orchestration.md",
-  ".claude/nccgs/protocols/model-routing.md", ".claude/nccgs/protocols/context-packets.md",
-  ".claude/nccgs/protocols/astra-claude.md", "scaffold/.nccgs/templates/implementation-report.md",
-  ".claude/nccgs/protocols/evidence.md", ".claude/nccgs/protocols/unity-boundary.md",
-  "scaffold/.nccgs/project.yaml", "scaffold/.nccgs/state.md",
-  "scaffold/.nccgs/requirements.yaml", "scaffold/.nccgs/templates/context-packet.yaml",
-  "scaffold/.nccgs/templates/closure-record.md", "package-assets/setup-vivox-voice-chat-evals.gitignore",
-  "package-assets/nccgs-project.gitignore",
-  "scripts/cli.mjs", "scripts/doctor.mjs", "scripts/install.mjs",
-  "scripts/uninstall.mjs", ".claude/nccgs/tools/installation-guard.mjs", "tests/uninstall.test.mjs", "docs/UNINSTALL.md",
-  "scripts/recover-session.mjs",
-  "scripts/sync-unity-skills.mjs", "tests/framework.test.mjs",
-  ".claude/nccgs/tools/integrity.mjs", ".claude/nccgs/tools/approve-overrides.mjs"
-]) requireFile(relative);
-
-const scaffoldIgnore = path.join(root, "scaffold/.nccgs/.gitignore");
-const scaffoldIgnoreFallback = path.join(root, "package-assets/nccgs-project.gitignore");
-if (fs.existsSync(scaffoldIgnore) && fs.readFileSync(scaffoldIgnore, "utf8") !== fs.readFileSync(scaffoldIgnoreFallback, "utf8")) {
-  errors.push("Scaffold .nccgs/.gitignore differs from its npm fallback asset.");
-}
-
-const versions = [
-  fs.readFileSync(path.join(root, "VERSION"), "utf8").trim(),
-  JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")).version,
-  fs.readFileSync(path.join(root, ".claude/nccgs/VERSION"), "utf8").trim()
-];
-if (new Set(versions).size !== 1) errors.push(`Version mismatch: ${versions.join(" / ")}`);
-
-const packageJson = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
-if (packageJson.private === true) errors.push("package.json is marked private and cannot be published.");
-if (packageJson.bin?.nccgs !== "scripts/cli.mjs") errors.push("package.json does not expose the nccgs CLI.");
-
-// This adaptation must remain attributable in the npm archive and installed tree.
-// Canonical LF comparison accepts a Windows checkout without changing license text.
-const ponytailDirectory = ".claude/nccgs/packages/ponytail";
-const ponytailFiles = ["manifest.json", "README.md", "engineering.md", "complexity-review.md", "NOTICE.md", "LICENSE"];
-for (const file of ponytailFiles) requireFile(`${ponytailDirectory}/${file}`);
-try {
-  const metadata = JSON.parse(fs.readFileSync(path.join(root, ponytailDirectory, "manifest.json"), "utf8"));
-  if (metadata.schemaVersion !== 1 || metadata.name !== "nccgs-ponytail" || metadata.kind !== "shared-guidance"
-    || metadata.entrypoint !== "README.md" || metadata.license !== "MIT"
-    || metadata.licenseFile !== "LICENSE" || metadata.noticeFile !== "NOTICE.md"
-    || JSON.stringify(metadata.files) !== JSON.stringify(ponytailFiles)) throw new Error("invalid package metadata or file inventory");
-  if (metadata.upstream?.repository !== "https://github.com/DietrichGebert/ponytail"
-    || !/^[a-f0-9]{40}$/.test(metadata.upstream?.commit ?? "")
-    || !metadata.upstream?.version || !metadata.upstream?.copyright) throw new Error("missing pinned upstream attribution");
-  const license = fs.readFileSync(path.join(root, ponytailDirectory, "LICENSE"), "utf8").replace(/\r\n/g, "\n");
-  const expected = metadata.upstream.sources.find(item => item.path === "LICENSE")?.sha256LF;
-  if (crypto.createHash("sha256").update(license).digest("hex") !== expected
-    || !license.includes(metadata.upstream.copyright)) throw new Error("upstream MIT license text differs from its source fingerprint");
-  for (const relative of ["THIRD_PARTY_NOTICES.md", ".claude/nccgs/THIRD_PARTY_NOTICES.md", `${ponytailDirectory}/NOTICE.md`]) {
-    const notice = fs.readFileSync(path.join(root, relative), "utf8");
-    if (!notice.includes("Ponytail") || !notice.includes(metadata.upstream.copyright)
-      || !notice.includes(metadata.upstream.commit)) throw new Error(`missing attribution in ${relative}`);
-  }
-} catch (error) { errors.push(`Invalid Ponytail shared package: ${error.message}`); }
-
-const rootClaude = fs.readFileSync(path.join(root, "CLAUDE.md"), "utf8");
-if (!rootClaude.includes("@.claude/nccgs/constitution.md")) errors.push("CLAUDE.md does not import the NCCGS constitution.");
-if (!/^@MEMORY\.md$/m.test(fs.readFileSync(path.join(root, ".claude/nccgs/constitution.md"), "utf8"))) errors.push("Constitution must import adjacent MEMORY.md using a relative path.");
-
-const studio = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/studio.json"), "utf8"));
-const pipeline = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/pipeline.json"), "utf8"));
-try {
-  const execution = executionPolicy(JSON.parse(fs.readFileSync(path.join(root, "scaffold/.nccgs/execution.json"), "utf8")));
-  if (execution.name !== "standalone" || execution.externalReview.mode !== "off") errors.push("New-install execution must default to standalone with external review off.");
-  if (execution.designReviewRequired !== true) errors.push("New installs must require reviewed design handoffs.");
-  if (execution.reviewContractRequired !== true) errors.push("New installs must require reviewer-owned verdicts and conditions.");
-} catch (error) { errors.push(`Invalid scaffold execution policy: ${error.message}`); }
-if (pipeline.defaultProfile !== "claude-standalone") errors.push("New-install default model profile must be claude-standalone.");
-if (pipeline.executionPolicies?.standalone?.runtime !== "claude-code" || pipeline.executionPolicies?.standalone?.planningOwner !== "Claude Code" || pipeline.executionPolicies?.standalone?.documentsOwner !== "Claude Code") errors.push("Standalone core must be owned by Claude Code.");
-for (const stale of compile(root)) errors.push(`Stale generated policy: ${stale}; run npm run policy:build`);
-const agentNames = new Set();
-for (const agent of studio.agents ?? []) {
-  if (agentNames.has(agent.name)) errors.push(`Duplicate catalog agent: ${agent.name}`);
-  agentNames.add(agent.name);
-  const active = pipeline.profiles[pipeline.defaultProfile].activeAgents.includes(agent.name);
-  const file = path.join(root, active ? ".claude/agents" : ".claude/nccgs/agent-library", `${agent.name}.md`);
-  if (!fs.existsSync(file)) { errors.push(`Catalog agent file missing: ${agent.name}`); continue; }
-  const metadata = frontmatter(file);
-  if (metadata?.name !== agent.name || !metadata?.description) errors.push(`Invalid agent frontmatter: ${agent.name}`);
-  const expected = studio.modelProfiles[studio.defaultProfile]?.[agent.modelClass];
-  if (active && metadata?.model !== expected) errors.push(`Agent model mismatch: ${agent.name} expected ${expected}, found ${metadata?.model}`);
-  const expectedEffort = studio.effortProfiles?.[studio.defaultProfile]?.[agent.modelClass];
-  if (active && metadata?.effort !== expectedEffort) errors.push(`Agent effort mismatch: ${agent.name} expected ${expectedEffort}, found ${metadata?.effort}`);
-  if ((metadata?.tools ?? "").split(/,\s*/).some(tool => ["Task", "Agent"].includes(tool))) errors.push(`Agent may recursively delegate: ${agent.name}`);
-  if (!fs.readFileSync(file, "utf8").includes("protocols/agent-contract.md")) errors.push(`Agent does not load common contract: ${agent.name}`);
-  if (fs.readFileSync(file, "utf8").split(/\r?\n/).length > 80) errors.push(`Agent entrypoint exceeds 80 lines: ${agent.name}`);
-}
-
-const actualAgents = walk(path.join(root, ".claude/agents")).filter((file) => file.endsWith(".md"));
-for (const file of actualAgents) {
-  if (!agentNames.has(path.basename(file, ".md"))) errors.push(`Uncataloged NCCGS agent: ${posix(path.relative(root, file))}`);
-  if (!pipeline.coreAgents.includes(path.basename(file, ".md"))) errors.push(`Non-core agent active in source package: ${posix(path.relative(root, file))}`);
-}
-
-const workflows = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/workflow-catalog.json"), "utf8"));
-const workflowNames = new Set();
-for (const workflow of workflows.workflows ?? []) {
-  if (workflowNames.has(workflow.name)) errors.push(`Duplicate workflow: ${workflow.name}`);
-  workflowNames.add(workflow.name);
-  const file = path.join(root, ".claude", "skills", workflow.name, "SKILL.md");
-  if (!fs.existsSync(file)) { errors.push(`Workflow skill missing: ${workflow.name}`); continue; }
-  const metadata = frontmatter(file);
-  if (metadata?.name !== workflow.name || !metadata?.description) errors.push(`Invalid workflow frontmatter: ${workflow.name}`);
-  const wrapper = fs.readFileSync(file, "utf8");
-  if (!wrapper.includes(".nccgs/execution.json") || !wrapper.includes("../../nccgs/protocols/standalone.md")) errors.push(`Workflow lacks execution-first standalone routing: ${workflow.name}`);
-  const lines = fs.readFileSync(file, "utf8").split(/\r?\n/).length;
-  if (lines > 120) errors.push(`Workflow entrypoint exceeds 120 lines: ${workflow.name}`);
-  if (fs.existsSync(path.join(path.dirname(file), "README.md"))) errors.push(`NCCGS-owned skill contains redundant README: ${workflow.name}`);
-  for (const role of workflow.primaryRoles ?? []) if (!agentNames.has(role)) errors.push(`Workflow ${workflow.name} references unknown role ${role}`);
-  for (const [profile, roles] of Object.entries(workflow.primaryRolesByProfile ?? {})) {
-    if (!studio.modelProfiles[profile]) errors.push(`Workflow ${workflow.name} references unknown profile ${profile}`);
-    for (const role of roles) if (!agentNames.has(role)) errors.push(`Workflow ${workflow.name} references unknown role ${role}`);
-  }
-}
-for (const entry of workflows.entrypoints ?? []) if (!workflowNames.has(entry)) errors.push(`Missing entrypoint workflow: ${entry}`);
-
-const projectScaffold = fs.readFileSync(path.join(root, "scaffold/.nccgs/project.yaml"), "utf8");
-for (const pattern of [
-  /^schema_version:\s*2\s*$/m, /^studio:\s*$/m, /^models:\s*$/m,
-  /^context:\s*$/m, /^closure:\s*$/m, /max_agent_depth:\s*1/m,
-  /single_writer_per_path:\s*true/m, /independent_verification:\s*true/m,
-  /canonical_record:\s*"\.nccgs\/closures\/\{feature_id\}\.md"/m
-]) if (!pattern.test(projectScaffold)) errors.push(`Project scaffold lacks schema invariant: ${pattern}`);
-
-const settingsFragment = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/settings.fragment.json"), "utf8"));
-const hookCommands = [];
-for (const groups of Object.values(settingsFragment.hooks ?? {})) {
-  for (const group of groups) for (const hook of group.hooks ?? []) hookCommands.push(hook.command);
-}
-if (hookCommands.length !== new Set(hookCommands).size) errors.push("Managed hook command is duplicated.");
-for (const command of hookCommands) {
-  const match = command.replace('"${CLAUDE_PROJECT_DIR}/', "").replace(/\.mjs"/, ".mjs").match(/^node\s+([^\s]+\.mjs)/);
-  if (!match) { errors.push(`Managed hook is not a Node script: ${command}`); continue; }
-  const file = path.join(root, ...match[1].split("/"));
-  if (!fs.existsSync(file)) { errors.push(`Managed hook script missing: ${match[1]}`); continue; }
-  const check = spawnSync(process.execPath, ["--check", file], { encoding: "utf8" });
-  if (check.status !== 0) errors.push(`Hook syntax failure ${match[1]}: ${check.stderr.trim()}`);
-}
-for (const file of [
-  ...walk(path.join(root, ".claude/nccgs/tools")).filter(file => file.endsWith(".mjs")),
-  path.join(root, "scripts/cli.mjs"),
-  path.join(root, "scripts/run.mjs"),
-  path.join(root, "scripts/doctor.mjs"),
-  path.join(root, "scripts/install.mjs")
-]) {
-  const check = spawnSync(process.execPath, ["--check", file], { encoding: "utf8" });
-  if (check.status !== 0) errors.push(`Script syntax failure ${posix(path.relative(root, file))}: ${check.stderr.trim()}`);
-}
-
-const rules = walk(path.join(root, ".claude/rules")).filter((file) => file.endsWith(".md"));
-if (rules.length < 11) errors.push(`Expected at least 11 path-scoped rules, found ${rules.length}.`);
-
-const manifestPath = path.join(root, ".claude/nccgs/unity-skills-manifest.json");
-const npmFallbackFiles = new Map([
-  ["setup-vivox-voice-chat/evals/.gitignore", path.join(root, "package-assets/setup-vivox-voice-chat-evals.gitignore")]
-]);
-let manifest;
-try { manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8")); }
-catch (error) { errors.push(`Unity Skills manifest is invalid JSON: ${error.message}`); }
-const allSkillNames = new Set();
-for (const directory of fs.readdirSync(path.join(root, ".claude/skills"), { withFileTypes: true })) {
-  if (!directory.isDirectory()) continue;
-  const skillFile = path.join(root, ".claude/skills", directory.name, "SKILL.md");
-  if (!fs.existsSync(skillFile)) { warnings.push(`Skill directory has no SKILL.md: ${directory.name}`); continue; }
-  const metadata = frontmatter(skillFile);
-  if (!metadata?.name || !metadata?.description) errors.push(`Skill lacks name/description: ${directory.name}`);
-  if (metadata?.name !== directory.name) errors.push(`Skill folder/name mismatch: ${directory.name} != ${metadata?.name}`);
-  if (allSkillNames.has(metadata?.name)) errors.push(`Duplicate skill name: ${metadata?.name}`);
-  allSkillNames.add(metadata?.name);
-}
-
-if (manifest) {
-  for (const skill of manifest.skills ?? []) {
-    const skillDir = path.join(root, ".claude/skills", skill.name);
-    if (!fs.existsSync(skillDir)) { errors.push(`Vendored Unity Skill missing: ${skill.name}`); continue; }
-    const expectedFiles = new Set();
-    for (const item of skill.files ?? []) {
-      expectedFiles.add(item.path);
-      let file = path.join(skillDir, ...item.path.split("/"));
-      if (!fs.existsSync(file)) file = npmFallbackFiles.get(`${skill.name}/${item.path}`) ?? file;
-      if (!fs.existsSync(file)) { errors.push(`Vendored Unity Skill file missing: ${skill.name}/${item.path}`); continue; }
-      if (sha256(file) !== item.sha256) errors.push(`Vendored Unity Skill modified: ${skill.name}/${item.path}`);
-    }
-    for (const file of walk(skillDir)) {
-      const relative = posix(path.relative(skillDir, file));
-      if (!expectedFiles.has(relative)) errors.push(`Untracked file in vendored Unity Skill: ${skill.name}/${relative}`);
-    }
-  }
-}
-
-const markdownRoots = [path.join(root, "README.md"), path.join(root, "docs"), path.join(root, ".claude/nccgs"), ...[...workflowNames].map((name) => path.join(root, ".claude/skills", name))];
-for (const item of markdownRoots) {
-  if (!fs.existsSync(item)) continue;
-  const files = fs.statSync(item).isDirectory() ? walk(item).filter((file) => file.endsWith(".md")) : [item];
-  for (const file of files) {
-    const text = fs.readFileSync(file, "utf8");
-    for (const match of text.matchAll(/\[[^\]]+\]\(([^)]+)\)/g)) {
-      const link = match[1].trim();
-      if (!link || link.startsWith("#") || /^[a-z]+:/i.test(link)) continue;
-      const target = path.resolve(path.dirname(file), link.split("#")[0]);
-      if (!fs.existsSync(target)) errors.push(`Broken relative link in ${posix(path.relative(root, file))}: ${link}`);
-    }
-  }
-}
-
-for (const warning of warnings) console.warn(`WARN: ${warning}`);
-if (errors.length) {
-  for (const error of errors) console.error(`ERROR: ${error}`);
-  console.error(`\nNCCGS validation failed with ${errors.length} error(s).`);
-  process.exit(1);
-}
-
-console.log("NCCGS validation passed.");
-console.log(`NCCGS workflows: ${workflowNames.size} (${workflows.entrypoints.length} entrypoints)`);
-console.log(`Studio agents: ${agentNames.size} in library; ${pipeline.coreAgents.length} active by default`);
-console.log(`Path-scoped rules: ${rules.length}`);
-console.log(`Managed hooks: ${hookCommands.length}`);
-console.log(`Vendored Unity Skills: ${manifest?.skills?.length ?? 0}`);
-console.log(`Discoverable skills total: ${allSkillNames.size}`);
+import { managedHookKey } from "../.claude/nccgs/tools/hook-transport.mjs";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { compile } from "../.claude/nccgs/tools/compile-policy.mjs";
+import { executionPolicy } from "../.claude/nccgs/tools/policy.mjs";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const errors = [];
+const warnings = [];
+const posix = (value) => value.split(path.sep).join("/");
+
+function walk(directory) {
+  if (!fs.existsSync(directory)) return [];
+  const output = [];
+  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    const full = path.join(directory, entry.name);
+    if (entry.isDirectory()) output.push(...walk(full));
+    else if (entry.isFile()) output.push(full);
+  }
+  return output.sort((a, b) => a.localeCompare(b));
+}
+
+function sha256(file) {
+  return crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+}
+
+function frontmatter(file) {
+  const text = fs.readFileSync(file, "utf8");
+  const match = text.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
+  if (!match) return null;
+  const result = {};
+  for (const line of match[1].split(/\r?\n/)) {
+    const item = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
+    if (item) result[item[1]] = item[2].replace(/^['"]|['"]$/g, "").trim();
+  }
+  return result;
+}
+
+function requireFile(relative) {
+  if (!fs.existsSync(path.join(root, relative))) errors.push(`Missing required file: ${relative}`);
+}
+
+for (const relative of [
+  "VERSION", "README.md", "CLAUDE.md", "MEMORY.md", "LICENSE", "package.json",
+  "THIRD_PARTY_NOTICES.md", ".claude/nccgs/THIRD_PARTY_NOTICES.md",
+  ".claude/nccgs/VERSION", ".claude/nccgs/constitution.md", ".claude/nccgs/MEMORY.md",
+  ".claude/nccgs/studio.json", ".claude/nccgs/workflow-catalog.json",
+  ".claude/nccgs/pipeline.json", ".claude/nccgs/protocols/task-gates.md",
+  ".claude/nccgs/protocols/design-lifecycle.md", ".claude/nccgs/tools/design-readiness.mjs", "scaffold/.nccgs/templates/design-contract.json",
+  ".claude/nccgs/tools/task.mjs", ".claude/nccgs/tools/gates.mjs", ".claude/nccgs/tools/runtime.mjs",
+  ".claude/nccgs/tools/handoff.mjs", "docs/HANDOFF-AUTOMATION.md",
+  ".claude/nccgs/tools/task-slices.mjs", ".claude/nccgs/protocols/task-slices.md",
+  "scaffold/.nccgs/templates/task-slices.json", "docs/TASK-SLICING.md", "tests/task-slices.test.mjs",
+  ".claude/nccgs/tools/repair-packet.mjs", ".claude/nccgs/protocols/bounded-repair.md", "scaffold/.nccgs/templates/repair-packet.json", "docs/BOUNDED-REPAIR.md",
+  ".claude/nccgs/tools/unity-repair.mjs", "scaffold/.nccgs/templates/repair-unity-code.json", "scaffold/.nccgs/templates/repair-unity-editor.json",
+  "scaffold/.nccgs/gates.json", "scaffold/.nccgs/execution.json", "tests/gates.test.mjs",
+  ".claude/nccgs/settings.fragment.json", ".claude/nccgs/unity-skills-manifest.json",
+  ".claude/nccgs/protocols/agent-contract.md", ".claude/nccgs/protocols/orchestration.md",
+  ".claude/nccgs/protocols/model-routing.md", ".claude/nccgs/protocols/context-packets.md",
+  ".claude/nccgs/protocols/astra-claude.md", "scaffold/.nccgs/templates/implementation-report.md",
+  ".claude/nccgs/protocols/evidence.md", ".claude/nccgs/protocols/unity-boundary.md",
+  "scaffold/.nccgs/project.yaml", "scaffold/.nccgs/state.md",
+  "scaffold/.nccgs/requirements.yaml", "scaffold/.nccgs/templates/context-packet.yaml",
+  "scaffold/.nccgs/templates/closure-record.md", "package-assets/setup-vivox-voice-chat-evals.gitignore",
+  "package-assets/nccgs-project.gitignore",
+  "scripts/cli.mjs", "scripts/doctor.mjs", "scripts/install.mjs",
+  "scripts/uninstall.mjs", ".claude/nccgs/tools/installation-guard.mjs", "tests/uninstall.test.mjs", "docs/UNINSTALL.md",
+  "scripts/recover-session.mjs",
+  "scripts/sync-unity-skills.mjs", "tests/framework.test.mjs",
+  ".claude/nccgs/tools/integrity.mjs", ".claude/nccgs/tools/approve-overrides.mjs"
+]) requireFile(relative);
+
+const scaffoldIgnore = path.join(root, "scaffold/.nccgs/.gitignore");
+const scaffoldIgnoreFallback = path.join(root, "package-assets/nccgs-project.gitignore");
+if (fs.existsSync(scaffoldIgnore) && fs.readFileSync(scaffoldIgnore, "utf8") !== fs.readFileSync(scaffoldIgnoreFallback, "utf8")) {
+  errors.push("Scaffold .nccgs/.gitignore differs from its npm fallback asset.");
+}
+
+const versions = [
+  fs.readFileSync(path.join(root, "VERSION"), "utf8").trim(),
+  JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8")).version,
+  fs.readFileSync(path.join(root, ".claude/nccgs/VERSION"), "utf8").trim()
+];
+if (new Set(versions).size !== 1) errors.push(`Version mismatch: ${versions.join(" / ")}`);
+
+const packageJson = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+if (packageJson.private === true) errors.push("package.json is marked private and cannot be published.");
+if (packageJson.bin?.nccgs !== "scripts/cli.mjs") errors.push("package.json does not expose the nccgs CLI.");
+
+// This adaptation must remain attributable in the npm archive and installed tree.
+// Canonical LF comparison accepts a Windows checkout without changing license text.
+const ponytailDirectory = ".claude/nccgs/packages/ponytail";
+const ponytailFiles = ["manifest.json", "README.md", "engineering.md", "complexity-review.md", "NOTICE.md", "LICENSE"];
+for (const file of ponytailFiles) requireFile(`${ponytailDirectory}/${file}`);
+try {
+  const metadata = JSON.parse(fs.readFileSync(path.join(root, ponytailDirectory, "manifest.json"), "utf8"));
+  if (metadata.schemaVersion !== 1 || metadata.name !== "nccgs-ponytail" || metadata.kind !== "shared-guidance"
+    || metadata.entrypoint !== "README.md" || metadata.license !== "MIT"
+    || metadata.licenseFile !== "LICENSE" || metadata.noticeFile !== "NOTICE.md"
+    || JSON.stringify(metadata.files) !== JSON.stringify(ponytailFiles)) throw new Error("invalid package metadata or file inventory");
+  if (metadata.upstream?.repository !== "https://github.com/DietrichGebert/ponytail"
+    || !/^[a-f0-9]{40}$/.test(metadata.upstream?.commit ?? "")
+    || !metadata.upstream?.version || !metadata.upstream?.copyright) throw new Error("missing pinned upstream attribution");
+  const license = fs.readFileSync(path.join(root, ponytailDirectory, "LICENSE"), "utf8").replace(/\r\n/g, "\n");
+  const expected = metadata.upstream.sources.find(item => item.path === "LICENSE")?.sha256LF;
+  if (crypto.createHash("sha256").update(license).digest("hex") !== expected
+    || !license.includes(metadata.upstream.copyright)) throw new Error("upstream MIT license text differs from its source fingerprint");
+  for (const relative of ["THIRD_PARTY_NOTICES.md", ".claude/nccgs/THIRD_PARTY_NOTICES.md", `${ponytailDirectory}/NOTICE.md`]) {
+    const notice = fs.readFileSync(path.join(root, relative), "utf8");
+    if (!notice.includes("Ponytail") || !notice.includes(metadata.upstream.copyright)
+      || !notice.includes(metadata.upstream.commit)) throw new Error(`missing attribution in ${relative}`);
+  }
+} catch (error) { errors.push(`Invalid Ponytail shared package: ${error.message}`); }
+
+const rootClaude = fs.readFileSync(path.join(root, "CLAUDE.md"), "utf8");
+if (!rootClaude.includes("@.claude/nccgs/constitution.md")) errors.push("CLAUDE.md does not import the NCCGS constitution.");
+if (!/^@MEMORY\.md$/m.test(fs.readFileSync(path.join(root, ".claude/nccgs/constitution.md"), "utf8"))) errors.push("Constitution must import adjacent MEMORY.md using a relative path.");
+
+const studio = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/studio.json"), "utf8"));
+const pipeline = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/pipeline.json"), "utf8"));
+try {
+  const execution = executionPolicy(JSON.parse(fs.readFileSync(path.join(root, "scaffold/.nccgs/execution.json"), "utf8")));
+  if (execution.name !== "standalone" || execution.externalReview.mode !== "off") errors.push("New-install execution must default to standalone with external review off.");
+  if (execution.designReviewRequired !== true) errors.push("New installs must require reviewed design handoffs.");
+  if (execution.reviewContractRequired !== true) errors.push("New installs must require reviewer-owned verdicts and conditions.");
+} catch (error) { errors.push(`Invalid scaffold execution policy: ${error.message}`); }
+if (pipeline.defaultProfile !== "claude-standalone") errors.push("New-install default model profile must be claude-standalone.");
+if (pipeline.executionPolicies?.standalone?.runtime !== "claude-code" || pipeline.executionPolicies?.standalone?.planningOwner !== "Claude Code" || pipeline.executionPolicies?.standalone?.documentsOwner !== "Claude Code") errors.push("Standalone core must be owned by Claude Code.");
+for (const stale of compile(root)) errors.push(`Stale generated policy: ${stale}; run npm run policy:build`);
+const agentNames = new Set();
+for (const agent of studio.agents ?? []) {
+  if (agentNames.has(agent.name)) errors.push(`Duplicate catalog agent: ${agent.name}`);
+  agentNames.add(agent.name);
+  const active = pipeline.profiles[pipeline.defaultProfile].activeAgents.includes(agent.name);
+  const file = path.join(root, active ? ".claude/agents" : ".claude/nccgs/agent-library", `${agent.name}.md`);
+  if (!fs.existsSync(file)) { errors.push(`Catalog agent file missing: ${agent.name}`); continue; }
+  const metadata = frontmatter(file);
+  if (metadata?.name !== agent.name || !metadata?.description) errors.push(`Invalid agent frontmatter: ${agent.name}`);
+  const expected = studio.modelProfiles[studio.defaultProfile]?.[agent.modelClass];
+  if (active && metadata?.model !== expected) errors.push(`Agent model mismatch: ${agent.name} expected ${expected}, found ${metadata?.model}`);
+  const expectedEffort = studio.effortProfiles?.[studio.defaultProfile]?.[agent.modelClass];
+  if (active && metadata?.effort !== expectedEffort) errors.push(`Agent effort mismatch: ${agent.name} expected ${expectedEffort}, found ${metadata?.effort}`);
+  if ((metadata?.tools ?? "").split(/,\s*/).some(tool => ["Task", "Agent"].includes(tool))) errors.push(`Agent may recursively delegate: ${agent.name}`);
+  if (!fs.readFileSync(file, "utf8").includes("protocols/agent-contract.md")) errors.push(`Agent does not load common contract: ${agent.name}`);
+  if (fs.readFileSync(file, "utf8").split(/\r?\n/).length > 80) errors.push(`Agent entrypoint exceeds 80 lines: ${agent.name}`);
+}
+
+const actualAgents = walk(path.join(root, ".claude/agents")).filter((file) => file.endsWith(".md"));
+for (const file of actualAgents) {
+  if (!agentNames.has(path.basename(file, ".md"))) errors.push(`Uncataloged NCCGS agent: ${posix(path.relative(root, file))}`);
+  if (!pipeline.coreAgents.includes(path.basename(file, ".md"))) errors.push(`Non-core agent active in source package: ${posix(path.relative(root, file))}`);
+}
+
+const workflows = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/workflow-catalog.json"), "utf8"));
+const workflowNames = new Set();
+for (const workflow of workflows.workflows ?? []) {
+  if (workflowNames.has(workflow.name)) errors.push(`Duplicate workflow: ${workflow.name}`);
+  workflowNames.add(workflow.name);
+  const file = path.join(root, ".claude", "skills", workflow.name, "SKILL.md");
+  if (!fs.existsSync(file)) { errors.push(`Workflow skill missing: ${workflow.name}`); continue; }
+  const metadata = frontmatter(file);
+  if (metadata?.name !== workflow.name || !metadata?.description) errors.push(`Invalid workflow frontmatter: ${workflow.name}`);
+  const wrapper = fs.readFileSync(file, "utf8");
+  if (!wrapper.includes(".nccgs/execution.json") || !wrapper.includes("../../nccgs/protocols/standalone.md")) errors.push(`Workflow lacks execution-first standalone routing: ${workflow.name}`);
+  const lines = fs.readFileSync(file, "utf8").split(/\r?\n/).length;
+  if (lines > 120) errors.push(`Workflow entrypoint exceeds 120 lines: ${workflow.name}`);
+  if (fs.existsSync(path.join(path.dirname(file), "README.md"))) errors.push(`NCCGS-owned skill contains redundant README: ${workflow.name}`);
+  for (const role of workflow.primaryRoles ?? []) if (!agentNames.has(role)) errors.push(`Workflow ${workflow.name} references unknown role ${role}`);
+  for (const [profile, roles] of Object.entries(workflow.primaryRolesByProfile ?? {})) {
+    if (!studio.modelProfiles[profile]) errors.push(`Workflow ${workflow.name} references unknown profile ${profile}`);
+    for (const role of roles) if (!agentNames.has(role)) errors.push(`Workflow ${workflow.name} references unknown role ${role}`);
+  }
+}
+for (const entry of workflows.entrypoints ?? []) if (!workflowNames.has(entry)) errors.push(`Missing entrypoint workflow: ${entry}`);
+
+const projectScaffold = fs.readFileSync(path.join(root, "scaffold/.nccgs/project.yaml"), "utf8");
+for (const pattern of [
+  /^schema_version:\s*2\s*$/m, /^studio:\s*$/m, /^models:\s*$/m,
+  /^context:\s*$/m, /^closure:\s*$/m, /max_agent_depth:\s*1/m,
+  /single_writer_per_path:\s*true/m, /independent_verification:\s*true/m,
+  /canonical_record:\s*"\.nccgs\/closures\/\{feature_id\}\.md"/m
+]) if (!pattern.test(projectScaffold)) errors.push(`Project scaffold lacks schema invariant: ${pattern}`);
+
+const settingsFragment = JSON.parse(fs.readFileSync(path.join(root, ".claude/nccgs/settings.fragment.json"), "utf8"));
+const hookCommands = [];
+for (const [event, groups] of Object.entries(settingsFragment.hooks ?? {})) {
+  for (const group of groups) for (const hook of group.hooks ?? []) {
+    hookCommands.push(hook);
+    if (["PreToolUse", "SubagentStart", "SubagentStop"].includes(event) && hook.onFailure !== "block") errors.push(`Integrity hook must block on runtime failure: ${event}`);
+  }
+}
+const hookKeys = hookCommands.map(managedHookKey);
+if (hookKeys.length !== new Set(hookKeys).size) errors.push("Managed hook command is duplicated.");
+for (const hook of hookCommands) {
+  const key = managedHookKey(hook);
+  if (!key || hook.command !== "node" || !Array.isArray(hook.args)) { errors.push("Managed hook must use direct Node argv"); continue; }
+  const relative = JSON.parse(key)[0], file = path.join(root, ...relative.split("/"));
+  if (!fs.existsSync(file)) { errors.push(`Managed hook script missing: ${relative}`); continue; }
+  const check = spawnSync(process.execPath, ["--check", file], { encoding: "utf8" });
+  if (check.status !== 0) errors.push(`Hook syntax failure ${relative}: ${check.stderr.trim()}`);
+}
+for (const file of [
+  ...walk(path.join(root, ".claude/nccgs/tools")).filter(file => file.endsWith(".mjs")),
+  path.join(root, "scripts/cli.mjs"),
+  path.join(root, "scripts/run.mjs"),
+  path.join(root, "scripts/doctor.mjs"),
+  path.join(root, "scripts/install.mjs")
+]) {
+  const check = spawnSync(process.execPath, ["--check", file], { encoding: "utf8" });
+  if (check.status !== 0) errors.push(`Script syntax failure ${posix(path.relative(root, file))}: ${check.stderr.trim()}`);
+}
+
+const rules = walk(path.join(root, ".claude/rules")).filter((file) => file.endsWith(".md"));
+if (rules.length < 11) errors.push(`Expected at least 11 path-scoped rules, found ${rules.length}.`);
+
+const manifestPath = path.join(root, ".claude/nccgs/unity-skills-manifest.json");
+const npmFallbackFiles = new Map([
+  ["setup-vivox-voice-chat/evals/.gitignore", path.join(root, "package-assets/setup-vivox-voice-chat-evals.gitignore")]
+]);
+let manifest;
+try { manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8")); }
+catch (error) { errors.push(`Unity Skills manifest is invalid JSON: ${error.message}`); }
+const allSkillNames = new Set();
+for (const directory of fs.readdirSync(path.join(root, ".claude/skills"), { withFileTypes: true })) {
+  if (!directory.isDirectory()) continue;
+  const skillFile = path.join(root, ".claude/skills", directory.name, "SKILL.md");
+  if (!fs.existsSync(skillFile)) { warnings.push(`Skill directory has no SKILL.md: ${directory.name}`); continue; }
+  const metadata = frontmatter(skillFile);
+  if (!metadata?.name || !metadata?.description) errors.push(`Skill lacks name/description: ${directory.name}`);
+  if (metadata?.name !== directory.name) errors.push(`Skill folder/name mismatch: ${directory.name} != ${metadata?.name}`);
+  if (allSkillNames.has(metadata?.name)) errors.push(`Duplicate skill name: ${metadata?.name}`);
+  allSkillNames.add(metadata?.name);
+}
+
+if (manifest) {
+  for (const skill of manifest.skills ?? []) {
+    const skillDir = path.join(root, ".claude/skills", skill.name);
+    if (!fs.existsSync(skillDir)) { errors.push(`Vendored Unity Skill missing: ${skill.name}`); continue; }
+    const expectedFiles = new Set();
+    for (const item of skill.files ?? []) {
+      expectedFiles.add(item.path);
+      let file = path.join(skillDir, ...item.path.split("/"));
+      if (!fs.existsSync(file)) file = npmFallbackFiles.get(`${skill.name}/${item.path}`) ?? file;
+      if (!fs.existsSync(file)) { errors.push(`Vendored Unity Skill file missing: ${skill.name}/${item.path}`); continue; }
+      if (sha256(file) !== item.sha256) errors.push(`Vendored Unity Skill modified: ${skill.name}/${item.path}`);
+    }
+    for (const file of walk(skillDir)) {
+      const relative = posix(path.relative(skillDir, file));
+      if (!expectedFiles.has(relative)) errors.push(`Untracked file in vendored Unity Skill: ${skill.name}/${relative}`);
+    }
+  }
+}
+
+const markdownRoots = [path.join(root, "README.md"), path.join(root, "docs"), path.join(root, ".claude/nccgs"), ...[...workflowNames].map((name) => path.join(root, ".claude/skills", name))];
+for (const item of markdownRoots) {
+  if (!fs.existsSync(item)) continue;
+  const files = fs.statSync(item).isDirectory() ? walk(item).filter((file) => file.endsWith(".md")) : [item];
+  for (const file of files) {
+    const text = fs.readFileSync(file, "utf8");
+    for (const match of text.matchAll(/\[[^\]]+\]\(([^)]+)\)/g)) {
+      const link = match[1].trim();
+      if (!link || link.startsWith("#") || /^[a-z]+:/i.test(link)) continue;
+      const target = path.resolve(path.dirname(file), link.split("#")[0]);
+      if (!fs.existsSync(target)) errors.push(`Broken relative link in ${posix(path.relative(root, file))}: ${link}`);
+    }
+  }
+}
+
+for (const warning of warnings) console.warn(`WARN: ${warning}`);
+if (errors.length) {
+  for (const error of errors) console.error(`ERROR: ${error}`);
+  console.error(`\nNCCGS validation failed with ${errors.length} error(s).`);
+  process.exit(1);
+}
+
+console.log("NCCGS validation passed.");
+console.log(`NCCGS workflows: ${workflowNames.size} (${workflows.entrypoints.length} entrypoints)`);
+console.log(`Studio agents: ${agentNames.size} in library; ${pipeline.coreAgents.length} active by default`);
+console.log(`Path-scoped rules: ${rules.length}`);
+console.log(`Managed hooks: ${hookCommands.length}`);
+console.log(`Vendored Unity Skills: ${manifest?.skills?.length ?? 0}`);
+console.log(`Discoverable skills total: ${allSkillNames.size}`);