nccgs 2.1.0 → 2.1.1

package/tests/design-readiness.test.mjs

@@ -1,200 +1,200 @@
-import assert from "node:assert/strict";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import test from "node:test";
-import { fileURLToPath } from "node:url";
-import { artifact, json } from "../.claude/nccgs/tools/policy.mjs";
-import { initialize, snapshot, taskPath, record, close, check, reclassify } from "../.claude/nccgs/tools/gates.mjs";
-import { reserve, claim, attachAgent, complete } from "../.claude/nccgs/tools/orchestration.mjs";
-import { validateDesign, validateDesignCommand, requireDesignReady } from "../.claude/nccgs/tools/design-readiness.mjs";
-import { run } from "../.claude/nccgs/tools/task.mjs";
-import { guardTool } from "../.claude/nccgs/tools/tool-guard.mjs";
-
-// All provider records here are synthetic. Native acceptance uses separate evidence.
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-function fixture() {
-  const parent = fs.realpathSync(os.tmpdir()), project = fs.mkdtempSync(path.join(parent, "nccgs-design-"));
-  const write = (relative, value) => {
-    const file = path.join(project, relative); fs.mkdirSync(path.dirname(file), { recursive: true });
-    fs.writeFileSync(file, typeof value === "string" ? value : JSON.stringify(value)); return artifact(project, relative);
-  };
-  fs.cpSync(path.join(root, ".claude/nccgs"), path.join(project, ".claude/nccgs"), { recursive: true });
-  write(".nccgs/project.yaml", "schema_version: 2\nmodels:\n  profile: claude-standalone\n");
-  write(".nccgs/execution.json", { schemaVersion: 1, name: "standalone", designReviewRequired: true });
-  write(".nccgs/inputs.json", { schemaVersion: 1, canonicalInputs: ["Design/brief.md"], outputDirectories: [], checks: {} });
-  write("Assets/game.cs", "// synthetic unchanged source");
-  const source = write("Design/brief.md", "Owner asks for two viable builds; human acceptance is required, bot diagnostics are not acceptance.");
-  const cite = { ...source, anchor: "Owner asks" };
-  const docPath = ".nccgs/evidence/analysis/design.json";
-  const document = { schemaVersion: 1, objective: "Two viable builds", scope: "feature", target: "production-change", readiness: "READY",
-    sources: [source], requirements: [{ id: "REQ-1", source: cite, statement: "Two viable builds", rules: "Keep both natural build paths and random upgrades; human judgement defines experience acceptance", kind: "fixed", criteria: ["AC-1"] }],
-    acceptance: [{ id: "AC-1", description: "Owner accepts both builds", manual: true, procedure: "Play both builds unassisted", environment: "Target Unity player", passCondition: "Owner explicitly accepts each build", rationale: "Experience requires human judgement, not all-seed bot wins", authority: cite }],
-    requiredChecks: [], manualGates: ["AC-1"], decisions: [], diagnostics: [{ id: "BOT", procedure: "Run seeded bot", limitations: "Bot policy is not human skill" }], outOfScope: [], risks: [] };
-  let count = 0;
-  const task = id => json(taskPath(project, id));
-  const init = (id, value) => {
-    write(`.nccgs/evidence/intake/${id}.json`, value);
-    return initialize(project, id, null, null, null, { intake: `.nccgs/evidence/intake/${id}.json` });
-  };
-  function worker(id, kind = "analysis") {
-    const n = ++count, t = task(id), agent = kind === "review" ? "nccgs-adversarial-reviewer" : "nccgs-game-designer";
-    const d = reserve(project, id, { requestKey: `r-${n}`, kind, agent, reason: "SYNTHETIC fixture", writePaths: [] });
-    claim(project, d.id, { sessionId: "fixture", toolUseId: `call-${n}`, agent });
-    attachAgent(project, d.id, `agent-${n}`);
-    const snap = snapshot(project, t).sha256;
-    const raw = `.nccgs/evidence/raw-${n}.json`;
-    write(raw, { taskId: id, contractHash: t.contractHash, snapshot: snap, dispatchId: d.id, sessionId: "fixture", toolUseId: `call-${n}`, agentId: `agent-${n}`, status: "completed", capturedAt: new Date().toISOString(), observedProvider: "claude-code", observedModel: "claude-opus-5-5", observedEffort: null, provenance: { kind: "provider-log", reference: "SYNTHETIC TEST; not actual Claude" } });
-    const runtime = run(["observe", "--project", project, "--id", id, "--file", raw]);
-    complete(project, d.id, { runtime }); return { snapshot: snap, dispatchId: d.id, runtime };
-  }
-  function design(value = document, verdict = "PASS", recordReview = true) {
-    init("design", { objective: "Produce and review the scoped design", mode: "plan", workflow: "design", readiness: "ready", requiredChecks: ["design-contract"], acceptance: [], sources: [source.path], analysisArtifacts: [docPath, ".nccgs/evidence/analysis/review.md"] });
-    write(docPath, value);
-    const author = worker("design");
-    const validation = validateDesignCommand(project, "design", docPath);
-    record(project, "design", "analysis", { ...author, evidence: artifact(project, docPath), checks: [{ name: "design-contract", status: "PASS", evidence: validation.evidence }] });
-    const reviewer = worker("design", "review");
-    const reviewInput = { ...reviewer, verdict, criteriaMet: verdict === "PASS", findings: [], evidence: write(".nccgs/evidence/analysis/review.md", "Synthetic independent document review") };
-    if (recordReview) record(project, "design", "review", reviewInput);
-    if (recordReview && verdict === "PASS") { record(project, "design", "report", { outcome: "success", summary: "Synthetic design accepted; game acceptance remains pending" }); close(project, "design"); }
-    return { author, validation, reviewer, reviewInput };
-  }
-  return { project, write, task, init, document, docPath, design, worker, dispose() {
-    assert.equal(path.dirname(fs.realpathSync(project)), parent); assert.ok(path.basename(project).startsWith("nccgs-design-"));
-    fs.rmSync(project, { recursive: true, force: true });
-  } };
-}
-const implRequest = { requestKey: "implementation", kind: "implementation", agent: "nccgs-gameplay-programmer", reason: "Synthetic dependent work", writePaths: ["Assets/game.cs"] };
-
-test("design false-pass and coverage findings block PASS even when accepted as medium risks", () => {
-  const f = fixture(); try {
-    const { reviewInput } = f.design(undefined, "CHANGES_REQUIRED", false);
-    const finding = { severity: "MEDIUM", status: "ACCEPTED", description: "A shared contaminated retry config can make both digests match while upgrades leak" };
-    assert.throws(() => record(f.project, "design", "review", { ...reviewInput, verdict: "PASS", criteriaMet: true, findings: [finding] }), /classify acceptanceImpact/);
-    for (const acceptanceImpact of ["false-pass", "missing-coverage", "authority-gap"]) {
-      assert.throws(() => record(f.project, "design", "review", { ...reviewInput, verdict: "PASS", criteriaMet: true, findings: [{ ...finding, acceptanceImpact }] }), /unresolved coverage\/authority gaps/);
-    }
-    assert.doesNotThrow(() => record(f.project, "design", "review", { ...reviewInput, findings: [{ ...finding, status: "OPEN", acceptanceImpact: "false-pass" }] }));
-    assert.throws(() => f.init("blocked-work", { mode: "implement", design: { taskId: "design" } }), /completed \/design plan/);
-    const nextReview = f.worker("design", "review");
-    assert.doesNotThrow(() => record(f.project, "design", "review", { ...reviewInput, ...nextReview, verdict: "PASS", criteriaMet: true, findings: [{ ...finding, acceptanceImpact: "none", description: "An explicitly nonblocking presentation preference" }] }));
-  } finally { f.dispose(); }
-});
-
-test("self-declared readiness cannot reserve implementation; partial reporting and analysis remain possible", () => {
-  const f = fixture(); try {
-    f.init("work", { objective: "New game feature", mode: "implement", readiness: "ready" });
-    assert.throws(() => reserve(f.project, "work", implRequest), /reviewed design missing/);
-    assert.equal(fs.existsSync(path.join(f.project, ".nccgs/orchestration.json")), false);
-    assert.throws(() => check(f.project, f.task("work"), "implementation"), /reviewed design missing/);
-    assert.equal(record(f.project, "work", "report", { outcome: "blocked", summary: "Needs independently reviewed design" }).phase, "BLOCKED");
-    assert.doesNotThrow(() => reserve(f.project, "work", { ...implRequest, kind: "analysis", writePaths: [] }));
-  } finally { f.dispose(); }
-});
-
-test("ready contract validates coverage, threshold authority, diagnostics and delegated tuning", () => {
-  const f = fixture(); try {
-    assert.doesNotThrow(() => validateDesign(f.project, f.document));
-    const bad = change => { const d = structuredClone(f.document); change(d); return d; };
-    for (const value of [bad(d => d.requirements[0].criteria = []), bad(d => d.acceptance[0].authority.anchor = ""),
-      bad(d => d.acceptance[0] = { ...d.acceptance[0], manual: false, check: "bot" }),
-      bad(d => d.decisions.push({ id: "open", status: "open", question: "What is viable?" })),
-      bad(d => d.diagnostics[0].id = "AC-1"), bad(d => d.requirements[0].kind = "delegated-tuning")]) {
-      assert.throws(() => validateDesign(f.project, value), /Design readiness/);
-    }
-  } finally { f.dispose(); }
-});
-
-test("independently reviewed design transfers exact acceptance and survives implementation source edits", () => {
-  const f = fixture(); try {
-    f.design(); const work = f.init("work", { mode: "implement", design: { taskId: "design" } });
-    assert.deepEqual(work.contract.acceptance, f.document.acceptance);
-    assert.deepEqual(work.contract.manualGates, ["AC-1"]);
-    const d = reserve(f.project, "work", implRequest);
-    claim(f.project, d.id, { sessionId: "implementation", toolUseId: "edit", agent: implRequest.agent });
-    attachAgent(f.project, d.id, "programmer");
-    assert.doesNotThrow(() => guardTool(f.project, { session_id: "implementation", agent_id: "programmer", tool_name: "Edit", tool_input: { file_path: "Assets/game.cs" } }));
-    f.write("Assets/game.cs", "// implementation progressed after design review");
-    assert.doesNotThrow(() => requireDesignReady(f.project, f.task("work")));
-    assert.ok(f.task("design").closed);
-  } finally { f.dispose(); }
-});
-
-test("conflicting implementation criteria and stale design source are refused without spending dispatches", () => {
-  const f = fixture(); try {
-    f.design();
-    assert.throws(() => f.init("weakened", { mode: "implement", design: { taskId: "design" }, acceptance: [] }), /differs from reviewed design/);
-    f.init("work", { mode: "implement", design: { taskId: "design" } });
-    f.write("Design/brief.md", "Changed owner instructions after review");
-    assert.throws(() => reserve(f.project, "work", implRequest), /stale artifact/);
-    assert.throws(() => check(f.project, f.task("work"), "implementation"), /stale artifact/);
-  } finally { f.dispose(); }
-});
-
-test("BLOCKED design can be validated and negatively reviewed but cannot receive PASS or unlock work", () => {
-  const f = fixture(); try {
-    const blocked = structuredClone(f.document); blocked.readiness = "BLOCKED"; blocked.decisions = [{ id: "D", question: "Resolve viable definition", status: "open" }];
-    const result = f.design(blocked, "BLOCKED");
-    assert.throws(() => record(f.project, "design", "review", { ...result.reviewInput, ...f.worker("design", "review"), verdict: "PASS", criteriaMet: true }), /BLOCKED design/);
-    assert.throws(() => f.init("work", { mode: "implement", design: { taskId: "design" } }), /completed \/design/);
-  } finally { f.dispose(); }
-});
-
-test("document receipts cannot be edited by tools or reused for a different analysis artifact", () => {
-  const f = fixture(); try {
-    const result = f.design();
-    assert.throws(() => guardTool(f.project, { tool_name: "Write", tool_input: { file_path: result.validation.evidence.path } }), /immutable/);
-    f.write(f.docPath, { ...f.document, objective: "Swapped after independent review" });
-    assert.throws(() => f.init("work", { mode: "implement", design: { taskId: "design" } }), /stale artifact/);
-  } finally { f.dispose(); }
-});
-
-test("ready local fixes keep a narrow exemption while feature reclassification requires design", () => {
-  const f = fixture(); try {
-    f.init("fix", { objective: "Repair a documented local formatting defect", mode: "implement", scope: "local", target: "fix", readiness: "ready", acceptance: [{ id: "A", description: "Existing formatting is restored", manual: true }] });
-    assert.doesNotThrow(() => requireDesignReady(f.project, f.task("fix")));
-    reclassify(f.project, "fix", { scope: "feature", risk: "STANDARD", reason: "Discovered broader feature semantics", evidence: [{ observation: "Synthetic discovery" }] });
-    assert.throws(() => reserve(f.project, "fix", implRequest), /reviewed design missing/);
-  } finally { f.dispose(); }
-});
-
-test("fixed design comparison captures exact changes and preserves the declared baseline", () => {
-  const f = fixture(); try {
-    const baselinePath = ".nccgs/evidence/context/baseline.json";
-    const baseline = f.write(baselinePath, f.document);
-    f.init("diff", { objective: "Review a narrow document correction", mode: "plan", workflow: "design", readiness: "ready",
-      sources: [baselinePath], requiredChecks: ["design-contract"], analysisArtifacts: [f.docPath], acceptance: [] });
-    const candidate = structuredClone(f.document);
-    candidate.requirements[0].rules += "; clarified wording";
-    candidate.acceptance[0].procedure += "; record the owner decision";
-    f.write(f.docPath, candidate);
-    const result = run(["design-compare", "--project", f.project, "--id", "diff", "--baseline", baselinePath, "--file", f.docPath]);
-    assert.deepEqual(result.requirements, { added: [], removed: [], changed: ["REQ-1"], orderChanged: false });
-    assert.deepEqual(result.acceptance.changed, ["AC-1"]);
-    assert.deepEqual(result.otherTopLevelChanges, []); assert.deepEqual(result.baseline, baseline);
-    assert.equal(result.origin, "design-contract-comparison");
-    assert.throws(() => guardTool(f.project, { tool_name: "Write", tool_input: { file_path: result.evidence.path } }), /immutable/);
-    assert.throws(() => run(["design-compare", "--project", f.project, "--id", "diff", "--baseline", f.docPath, "--file", f.docPath]), /distinct pinned/);
-    f.write(baselinePath, { ...f.document, objective: "Tampered baseline" });
-    assert.throws(() => run(["design-compare", "--project", f.project, "--id", "diff", "--baseline", baselinePath, "--file", f.docPath]), /stale artifact|changed|hash/i);
-  } finally { f.dispose(); }
-});
-
-test("design comparison reports additions removals order and outside-scope changes without calling them PASS", () => {
-  const f = fixture(); try {
-    const baselinePath = ".nccgs/evidence/context/baseline.json";
-    f.write(baselinePath, f.document);
-    f.init("diff", { objective: "Compare candidate", mode: "plan", workflow: "design", readiness: "ready", sources: [baselinePath],
-      requiredChecks: ["design-contract"], analysisArtifacts: [f.docPath], acceptance: [] });
-    const candidate = structuredClone(f.document);
-    candidate.requirements[0].id = "REQ-2"; candidate.manualGates = [];
-    f.write(f.docPath, candidate);
-    const result = run(["design-compare", "--project", f.project, "--id", "diff", "--baseline", baselinePath, "--file", f.docPath]);
-    assert.deepEqual(result.requirements.added, ["REQ-2"]); assert.deepEqual(result.requirements.removed, ["REQ-1"]);
-    assert.equal(result.requirements.orderChanged, true); assert.deepEqual(result.otherTopLevelChanges, ["manualGates"]);
-    assert.equal(result.status, undefined); // Computed diff, never scope or semantic acceptance.
-    candidate.acceptance.push(structuredClone(candidate.acceptance[0])); f.write(f.docPath, candidate);
-    assert.throws(() => run(["design-compare", "--project", f.project, "--id", "diff", "--baseline", baselinePath, "--file", f.docPath]), /unique ids/);
-  } finally { f.dispose(); }
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+import { artifact, json } from "../.claude/nccgs/tools/policy.mjs";
+import { initialize, snapshot, taskPath, record, close, check, reclassify } from "../.claude/nccgs/tools/gates.mjs";
+import { reserve, claim, attachAgent, complete } from "../.claude/nccgs/tools/orchestration.mjs";
+import { validateDesign, validateDesignCommand, requireDesignReady } from "../.claude/nccgs/tools/design-readiness.mjs";
+import { run } from "../.claude/nccgs/tools/task.mjs";
+import { guardTool } from "../.claude/nccgs/tools/tool-guard.mjs";
+
+// All provider records here are synthetic. Native acceptance uses separate evidence.
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+function fixture() {
+  const parent = fs.realpathSync(os.tmpdir()), project = fs.mkdtempSync(path.join(parent, "nccgs-design-"));
+  const write = (relative, value) => {
+    const file = path.join(project, relative); fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, typeof value === "string" ? value : JSON.stringify(value)); return artifact(project, relative);
+  };
+  fs.cpSync(path.join(root, ".claude/nccgs"), path.join(project, ".claude/nccgs"), { recursive: true });
+  write(".nccgs/project.yaml", "schema_version: 2\nmodels:\n  profile: claude-standalone\n");
+  write(".nccgs/execution.json", { schemaVersion: 1, name: "standalone", designReviewRequired: true });
+  write(".nccgs/inputs.json", { schemaVersion: 1, canonicalInputs: ["Design/brief.md"], outputDirectories: [], checks: {} });
+  write("Assets/game.cs", "// synthetic unchanged source");
+  const source = write("Design/brief.md", "Owner asks for two viable builds; human acceptance is required, bot diagnostics are not acceptance.");
+  const cite = { ...source, anchor: "Owner asks" };
+  const docPath = ".nccgs/evidence/analysis/design.json";
+  const document = { schemaVersion: 1, objective: "Two viable builds", scope: "feature", target: "production-change", readiness: "READY",
+    sources: [source], requirements: [{ id: "REQ-1", source: cite, statement: "Two viable builds", rules: "Keep both natural build paths and random upgrades; human judgement defines experience acceptance", kind: "fixed", criteria: ["AC-1"] }],
+    acceptance: [{ id: "AC-1", description: "Owner accepts both builds", manual: true, procedure: "Play both builds unassisted", environment: "Target Unity player", passCondition: "Owner explicitly accepts each build", rationale: "Experience requires human judgement, not all-seed bot wins", authority: cite }],
+    requiredChecks: [], manualGates: ["AC-1"], decisions: [], diagnostics: [{ id: "BOT", procedure: "Run seeded bot", limitations: "Bot policy is not human skill" }], outOfScope: [], risks: [] };
+  let count = 0;
+  const task = id => json(taskPath(project, id));
+  const init = (id, value) => {
+    write(`.nccgs/evidence/intake/${id}.json`, value);
+    return initialize(project, id, null, null, null, { intake: `.nccgs/evidence/intake/${id}.json` });
+  };
+  function worker(id, kind = "analysis") {
+    const n = ++count, t = task(id), agent = kind === "review" ? "nccgs-adversarial-reviewer" : "nccgs-game-designer";
+    const d = reserve(project, id, { requestKey: `r-${n}`, kind, agent, reason: "SYNTHETIC fixture", writePaths: [] });
+    claim(project, d.id, { sessionId: "fixture", toolUseId: `call-${n}`, agent });
+    attachAgent(project, d.id, `agent-${n}`);
+    const snap = snapshot(project, t).sha256;
+    const raw = `.nccgs/evidence/raw-${n}.json`;
+    write(raw, { taskId: id, contractHash: t.contractHash, snapshot: snap, dispatchId: d.id, sessionId: "fixture", toolUseId: `call-${n}`, agentId: `agent-${n}`, status: "completed", capturedAt: new Date().toISOString(), observedProvider: "claude-code", observedModel: kind === "review" ? "claude-fable-5-1" : "claude-opus-5-5", observedEffort: null, provenance: { kind: "provider-log", reference: "SYNTHETIC TEST; not actual Claude" } });
+    const runtime = run(["observe", "--project", project, "--id", id, "--file", raw]);
+    complete(project, d.id, { runtime }); return { snapshot: snap, dispatchId: d.id, runtime };
+  }
+  function design(value = document, verdict = "PASS", recordReview = true) {
+    init("design", { objective: "Produce and review the scoped design", mode: "plan", workflow: "design", readiness: "ready", requiredChecks: ["design-contract"], acceptance: [], sources: [source.path], analysisArtifacts: [docPath, ".nccgs/evidence/analysis/review.md"] });
+    write(docPath, value);
+    const author = worker("design");
+    const validation = validateDesignCommand(project, "design", docPath);
+    record(project, "design", "analysis", { ...author, evidence: artifact(project, docPath), checks: [{ name: "design-contract", status: "PASS", evidence: validation.evidence }] });
+    const reviewer = worker("design", "review");
+    const reviewInput = { ...reviewer, verdict, criteriaMet: verdict === "PASS", findings: [], evidence: write(".nccgs/evidence/analysis/review.md", "Synthetic independent document review") };
+    if (recordReview) record(project, "design", "review", reviewInput);
+    if (recordReview && verdict === "PASS") { record(project, "design", "report", { outcome: "success", summary: "Synthetic design accepted; game acceptance remains pending" }); close(project, "design"); }
+    return { author, validation, reviewer, reviewInput };
+  }
+  return { project, write, task, init, document, docPath, design, worker, dispose() {
+    assert.equal(path.dirname(fs.realpathSync(project)), parent); assert.ok(path.basename(project).startsWith("nccgs-design-"));
+    fs.rmSync(project, { recursive: true, force: true });
+  } };
+}
+const implRequest = { requestKey: "implementation", kind: "implementation", agent: "nccgs-gameplay-programmer", reason: "Synthetic dependent work", writePaths: ["Assets/game.cs"] };
+
+test("design false-pass and coverage findings block PASS even when accepted as medium risks", () => {
+  const f = fixture(); try {
+    const { reviewInput } = f.design(undefined, "CHANGES_REQUIRED", false);
+    const finding = { severity: "MEDIUM", status: "ACCEPTED", description: "A shared contaminated retry config can make both digests match while upgrades leak" };
+    assert.throws(() => record(f.project, "design", "review", { ...reviewInput, verdict: "PASS", criteriaMet: true, findings: [finding] }), /classify acceptanceImpact/);
+    for (const acceptanceImpact of ["false-pass", "missing-coverage", "authority-gap"]) {
+      assert.throws(() => record(f.project, "design", "review", { ...reviewInput, verdict: "PASS", criteriaMet: true, findings: [{ ...finding, acceptanceImpact }] }), /unresolved coverage\/authority gaps/);
+    }
+    assert.doesNotThrow(() => record(f.project, "design", "review", { ...reviewInput, findings: [{ ...finding, status: "OPEN", acceptanceImpact: "false-pass" }] }));
+    assert.throws(() => f.init("blocked-work", { mode: "implement", design: { taskId: "design" } }), /completed \/design plan/);
+    const nextReview = f.worker("design", "review");
+    assert.doesNotThrow(() => record(f.project, "design", "review", { ...reviewInput, ...nextReview, verdict: "PASS", criteriaMet: true, findings: [{ ...finding, acceptanceImpact: "none", description: "An explicitly nonblocking presentation preference" }] }));
+  } finally { f.dispose(); }
+});
+
+test("self-declared readiness cannot reserve implementation; partial reporting and analysis remain possible", () => {
+  const f = fixture(); try {
+    f.init("work", { objective: "New game feature", mode: "implement", readiness: "ready" });
+    assert.throws(() => reserve(f.project, "work", implRequest), /reviewed design missing/);
+    assert.equal(fs.existsSync(path.join(f.project, ".nccgs/orchestration.json")), false);
+    assert.throws(() => check(f.project, f.task("work"), "implementation"), /reviewed design missing/);
+    assert.equal(record(f.project, "work", "report", { outcome: "blocked", summary: "Needs independently reviewed design" }).phase, "BLOCKED");
+    assert.doesNotThrow(() => reserve(f.project, "work", { ...implRequest, kind: "analysis", writePaths: [] }));
+  } finally { f.dispose(); }
+});
+
+test("ready contract validates coverage, threshold authority, diagnostics and delegated tuning", () => {
+  const f = fixture(); try {
+    assert.doesNotThrow(() => validateDesign(f.project, f.document));
+    const bad = change => { const d = structuredClone(f.document); change(d); return d; };
+    for (const value of [bad(d => d.requirements[0].criteria = []), bad(d => d.acceptance[0].authority.anchor = ""),
+      bad(d => d.acceptance[0] = { ...d.acceptance[0], manual: false, check: "bot" }),
+      bad(d => d.decisions.push({ id: "open", status: "open", question: "What is viable?" })),
+      bad(d => d.diagnostics[0].id = "AC-1"), bad(d => d.requirements[0].kind = "delegated-tuning")]) {
+      assert.throws(() => validateDesign(f.project, value), /Design readiness/);
+    }
+  } finally { f.dispose(); }
+});
+
+test("independently reviewed design transfers exact acceptance and survives implementation source edits", () => {
+  const f = fixture(); try {
+    f.design(); const work = f.init("work", { mode: "implement", design: { taskId: "design" } });
+    assert.deepEqual(work.contract.acceptance, f.document.acceptance);
+    assert.deepEqual(work.contract.manualGates, ["AC-1"]);
+    const d = reserve(f.project, "work", implRequest);
+    claim(f.project, d.id, { sessionId: "implementation", toolUseId: "edit", agent: implRequest.agent });
+    attachAgent(f.project, d.id, "programmer");
+    assert.doesNotThrow(() => guardTool(f.project, { session_id: "implementation", agent_id: "programmer", tool_name: "Edit", tool_input: { file_path: "Assets/game.cs" } }));
+    f.write("Assets/game.cs", "// implementation progressed after design review");
+    assert.doesNotThrow(() => requireDesignReady(f.project, f.task("work")));
+    assert.ok(f.task("design").closed);
+  } finally { f.dispose(); }
+});
+
+test("conflicting implementation criteria and stale design source are refused without spending dispatches", () => {
+  const f = fixture(); try {
+    f.design();
+    assert.throws(() => f.init("weakened", { mode: "implement", design: { taskId: "design" }, acceptance: [] }), /differs from reviewed design/);
+    f.init("work", { mode: "implement", design: { taskId: "design" } });
+    f.write("Design/brief.md", "Changed owner instructions after review");
+    assert.throws(() => reserve(f.project, "work", implRequest), /stale artifact/);
+    assert.throws(() => check(f.project, f.task("work"), "implementation"), /stale artifact/);
+  } finally { f.dispose(); }
+});
+
+test("BLOCKED design can be validated and negatively reviewed but cannot receive PASS or unlock work", () => {
+  const f = fixture(); try {
+    const blocked = structuredClone(f.document); blocked.readiness = "BLOCKED"; blocked.decisions = [{ id: "D", question: "Resolve viable definition", status: "open" }];
+    const result = f.design(blocked, "BLOCKED");
+    assert.throws(() => record(f.project, "design", "review", { ...result.reviewInput, ...f.worker("design", "review"), verdict: "PASS", criteriaMet: true }), /BLOCKED design/);
+    assert.throws(() => f.init("work", { mode: "implement", design: { taskId: "design" } }), /completed \/design/);
+  } finally { f.dispose(); }
+});
+
+test("document receipts cannot be edited by tools or reused for a different analysis artifact", () => {
+  const f = fixture(); try {
+    const result = f.design();
+    assert.throws(() => guardTool(f.project, { tool_name: "Write", tool_input: { file_path: result.validation.evidence.path } }), /immutable/);
+    f.write(f.docPath, { ...f.document, objective: "Swapped after independent review" });
+    assert.throws(() => f.init("work", { mode: "implement", design: { taskId: "design" } }), /stale artifact/);
+  } finally { f.dispose(); }
+});
+
+test("ready local fixes keep a narrow exemption while feature reclassification requires design", () => {
+  const f = fixture(); try {
+    f.init("fix", { objective: "Repair a documented local formatting defect", mode: "implement", scope: "local", target: "fix", readiness: "ready", acceptance: [{ id: "A", description: "Existing formatting is restored", manual: true }] });
+    assert.doesNotThrow(() => requireDesignReady(f.project, f.task("fix")));
+    reclassify(f.project, "fix", { scope: "feature", risk: "STANDARD", reason: "Discovered broader feature semantics", evidence: [{ observation: "Synthetic discovery" }] });
+    assert.throws(() => reserve(f.project, "fix", implRequest), /reviewed design missing/);
+  } finally { f.dispose(); }
+});
+
+test("fixed design comparison captures exact changes and preserves the declared baseline", () => {
+  const f = fixture(); try {
+    const baselinePath = ".nccgs/evidence/context/baseline.json";
+    const baseline = f.write(baselinePath, f.document);
+    f.init("diff", { objective: "Review a narrow document correction", mode: "plan", workflow: "design", readiness: "ready",
+      sources: [baselinePath], requiredChecks: ["design-contract"], analysisArtifacts: [f.docPath], acceptance: [] });
+    const candidate = structuredClone(f.document);
+    candidate.requirements[0].rules += "; clarified wording";
+    candidate.acceptance[0].procedure += "; record the owner decision";
+    f.write(f.docPath, candidate);
+    const result = run(["design-compare", "--project", f.project, "--id", "diff", "--baseline", baselinePath, "--file", f.docPath]);
+    assert.deepEqual(result.requirements, { added: [], removed: [], changed: ["REQ-1"], orderChanged: false });
+    assert.deepEqual(result.acceptance.changed, ["AC-1"]);
+    assert.deepEqual(result.otherTopLevelChanges, []); assert.deepEqual(result.baseline, baseline);
+    assert.equal(result.origin, "design-contract-comparison");
+    assert.throws(() => guardTool(f.project, { tool_name: "Write", tool_input: { file_path: result.evidence.path } }), /immutable/);
+    assert.throws(() => run(["design-compare", "--project", f.project, "--id", "diff", "--baseline", f.docPath, "--file", f.docPath]), /distinct pinned/);
+    f.write(baselinePath, { ...f.document, objective: "Tampered baseline" });
+    assert.throws(() => run(["design-compare", "--project", f.project, "--id", "diff", "--baseline", baselinePath, "--file", f.docPath]), /stale artifact|changed|hash/i);
+  } finally { f.dispose(); }
+});
+
+test("design comparison reports additions removals order and outside-scope changes without calling them PASS", () => {
+  const f = fixture(); try {
+    const baselinePath = ".nccgs/evidence/context/baseline.json";
+    f.write(baselinePath, f.document);
+    f.init("diff", { objective: "Compare candidate", mode: "plan", workflow: "design", readiness: "ready", sources: [baselinePath],
+      requiredChecks: ["design-contract"], analysisArtifacts: [f.docPath], acceptance: [] });
+    const candidate = structuredClone(f.document);
+    candidate.requirements[0].id = "REQ-2"; candidate.manualGates = [];
+    f.write(f.docPath, candidate);
+    const result = run(["design-compare", "--project", f.project, "--id", "diff", "--baseline", baselinePath, "--file", f.docPath]);
+    assert.deepEqual(result.requirements.added, ["REQ-2"]); assert.deepEqual(result.requirements.removed, ["REQ-1"]);
+    assert.equal(result.requirements.orderChanged, true); assert.deepEqual(result.otherTopLevelChanges, ["manualGates"]);
+    assert.equal(result.status, undefined); // Computed diff, never scope or semantic acceptance.
+    candidate.acceptance.push(structuredClone(candidate.acceptance[0])); f.write(f.docPath, candidate);
+    assert.throws(() => run(["design-compare", "--project", f.project, "--id", "diff", "--baseline", baselinePath, "--file", f.docPath]), /unique ids/);
+  } finally { f.dispose(); }
 });

package/tests/fixtures/compiler-shutdown.cs

@@ -1,64 +1,67 @@
-using System;
-using System.Diagnostics;
-using System.IO;
-using System.IO.Pipes;
-using System.Runtime.InteropServices;
-using System.Threading;
-using System.Threading.Tasks;
-
-// Synthetic IPC guard fixture, not Unity execution evidence.
-public static class CompilerShutdownFixture {
-  [DllImport("kernel32.dll")] static extern IntPtr CreateJobObject(IntPtr attributes,string name);
-  [DllImport("kernel32.dll")] static extern bool AssignProcessToJobObject(IntPtr job,IntPtr process);
-  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
-  static void Need(bool ok,string message) { if(!ok) throw new Exception(message); }
-  static void Exchange(IntPtr job,IntPtr process,int pid,bool expected,bool answer) {
-    string name="nccgs-compiler-guard-"+Guid.NewGuid().ToString("N");
-    using(var server=new NamedPipeServerStream(name,PipeDirection.InOut,1,PipeTransmissionMode.Byte,PipeOptions.Asynchronous)) {
-      var connected=server.WaitForConnectionAsync();
-      var receive=Task.Run(()=>{
-        connected.GetAwaiter().GetResult();
-        var length=new byte[4]; int count=server.Read(length,0,4);
-        if(count==0) return 0; // Refused peers must receive no request bytes.
-        Need(count==4 && BitConverter.ToInt32(length,0)==117,"bad request frame");
-        int remaining=117; var buffer=new byte[117];
-        while(remaining>0) { int n=server.Read(buffer,117-remaining,remaining); Need(n>0,"truncated request"); remaining-=n; }
-        if(answer) {
-          using(var writer=new BinaryWriter(server,System.Text.Encoding.Unicode,true)) {
-            writer.Write(8); writer.Write(3); writer.Write(Process.GetCurrentProcess().Id); writer.Flush();
-          }
-        } else Thread.Sleep(1500);
-        return 121;
-      });
-      bool accepted=NccgsUnityCompilerShutdown.Request(job,process,pid,name);
-      Need(accepted==expected,"incorrect shutdown acknowledgement");
-      Need(receive.Wait(3000),"pipe fixture failed to settle");
-      if(!expected && answer) Need(receive.Result==0,"foreign/unowned peer received shutdown bytes");
-    }
-  }
-  public static int Main(string[] args) {
-    IntPtr job=CreateJobObject(IntPtr.Zero,null);
-    try {
-      Need(job!=IntPtr.Zero,"job creation failed");
-      var process=Process.GetCurrentProcess();
-      // Golden frame captured from the installed Roslyn 4.3.1 serializer, not a
-      // second implementation of our own encoder.
-      const string golden="75000000000000000000000000000000000000002125534450340031006100350061006600390064003200630034003500390061003000360063003000370039003500620066003200310061003100630030003400360032003000300066003300370035006200660001000000257214510000000000000000";
-      Need(BitConverter.ToString(NccgsUnityCompilerShutdown.ShutdownFrame()).Replace("-","").ToLowerInvariant()==golden,"Roslyn protocol changed");
-      Exchange(job,process.Handle,process.Id,false,true); // Same PID, foreign job.
-      Need(AssignProcessToJobObject(job,process.Handle),"fixture job assignment failed");
-      Exchange(job,process.Handle,process.Id+1000000,false,true); // Wrong pipe server PID.
-      Exchange(job,process.Handle,process.Id,true,true); // Exact owned pipe.
-      Exchange(job,process.Handle,process.Id,false,false); // Missing acknowledgement stays unconfirmed.
-      string data=Path.Combine(args[0],"Editor","Data");
-      string dll=Path.Combine(data,"DotNetSdkRoslyn","VBCSCompiler.dll"),host=Path.Combine(data,"NetCoreRuntime","dotnet.exe");
-      Directory.CreateDirectory(Path.GetDirectoryName(dll)); Directory.CreateDirectory(Path.GetDirectoryName(host));
-      File.WriteAllText(dll,"unqualified binary"); File.WriteAllText(host,"unqualified host");
-      Need(NccgsUnityCompilerShutdown.QualifiedPipe(host,new[]{host,"exec",dll,"-pipename:safe"})==null,"unqualified binaries accepted");
-      Need(NccgsUnityCompilerShutdown.QualifiedPipe(host,new[]{host,"exec",dll,"-pipename:../../foreign"})==null,"invalid pipe accepted");
-      Need(NccgsUnityCompilerShutdown.QualifiedPipe(host,new[]{host,"exec",dll,"-pipename:safe","-shutdown"})==null,"unexpected arguments accepted");
-      Console.WriteLine("compiler shutdown guards PASS"); return 0;
-    } catch(Exception error) { Console.Error.WriteLine(error); return 1; }
-    finally { if(job!=IntPtr.Zero) CloseHandle(job); }
-  }
-}
+using System;
+using System.Diagnostics;
+using System.IO;
+using System.IO.Pipes;
+using System.Runtime.InteropServices;
+using System.Threading;
+using System.Threading.Tasks;
+
+// Synthetic IPC guard fixture, not Unity execution evidence.
+public static class CompilerShutdownFixture {
+  [DllImport("kernel32.dll")] static extern IntPtr CreateJobObject(IntPtr attributes,string name);
+  [DllImport("kernel32.dll")] static extern bool AssignProcessToJobObject(IntPtr job,IntPtr process);
+  [DllImport("kernel32.dll")] static extern bool CloseHandle(IntPtr handle);
+  static void Need(bool ok,string message) { if(!ok) throw new Exception(message); }
+  static void Exchange(IntPtr job,IntPtr process,int pid,bool expected,bool answer) {
+    // The synthetic LOCAL namespace works in the existing Windows AppContainer.
+    // Production cleanup, peer PID/Job checks and the golden frame are unchanged.
+    // https://learn.microsoft.com/windows/apps/develop/communication/interprocess-communication
+    string name=@"LOCAL\nccgs-compiler-guard-"+Guid.NewGuid().ToString("N");
+    using(var server=new NamedPipeServerStream(name,PipeDirection.InOut,1,PipeTransmissionMode.Byte,PipeOptions.Asynchronous)) {
+      var connected=server.WaitForConnectionAsync();
+      var receive=Task.Run(()=>{
+        connected.GetAwaiter().GetResult();
+        var length=new byte[4]; int count=server.Read(length,0,4);
+        if(count==0) return 0; // Refused peers must receive no request bytes.
+        Need(count==4 && BitConverter.ToInt32(length,0)==117,"bad request frame");
+        int remaining=117; var buffer=new byte[117];
+        while(remaining>0) { int n=server.Read(buffer,117-remaining,remaining); Need(n>0,"truncated request"); remaining-=n; }
+        if(answer) {
+          using(var writer=new BinaryWriter(server,System.Text.Encoding.Unicode,true)) {
+            writer.Write(8); writer.Write(3); writer.Write(Process.GetCurrentProcess().Id); writer.Flush();
+          }
+        } else Thread.Sleep(1500);
+        return 121;
+      });
+      bool accepted=NccgsUnityCompilerShutdown.Request(job,process,pid,name);
+      Need(accepted==expected,"incorrect shutdown acknowledgement");
+      Need(receive.Wait(3000),"pipe fixture failed to settle");
+      if(!expected && answer) Need(receive.Result==0,"foreign/unowned peer received shutdown bytes");
+    }
+  }
+  public static int Main(string[] args) {
+    IntPtr job=CreateJobObject(IntPtr.Zero,null);
+    try {
+      Need(job!=IntPtr.Zero,"job creation failed");
+      var process=Process.GetCurrentProcess();
+      // Golden frame captured from the installed Roslyn 4.3.1 serializer, not a
+      // second implementation of our own encoder.
+      const string golden="75000000000000000000000000000000000000002125534450340031006100350061006600390064003200630034003500390061003000360063003000370039003500620066003200310061003100630030003400360032003000300066003300370035006200660001000000257214510000000000000000";
+      Need(BitConverter.ToString(NccgsUnityCompilerShutdown.ShutdownFrame()).Replace("-","").ToLowerInvariant()==golden,"Roslyn protocol changed");
+      Exchange(job,process.Handle,process.Id,false,true); // Same PID, foreign job.
+      Need(AssignProcessToJobObject(job,process.Handle),"fixture job assignment failed");
+      Exchange(job,process.Handle,process.Id+1000000,false,true); // Wrong pipe server PID.
+      Exchange(job,process.Handle,process.Id,true,true); // Exact owned pipe.
+      Exchange(job,process.Handle,process.Id,false,false); // Missing acknowledgement stays unconfirmed.
+      string data=Path.Combine(args[0],"Editor","Data");
+      string dll=Path.Combine(data,"DotNetSdkRoslyn","VBCSCompiler.dll"),host=Path.Combine(data,"NetCoreRuntime","dotnet.exe");
+      Directory.CreateDirectory(Path.GetDirectoryName(dll)); Directory.CreateDirectory(Path.GetDirectoryName(host));
+      File.WriteAllText(dll,"unqualified binary"); File.WriteAllText(host,"unqualified host");
+      Need(NccgsUnityCompilerShutdown.QualifiedPipe(host,new[]{host,"exec",dll,"-pipename:safe"})==null,"unqualified binaries accepted");
+      Need(NccgsUnityCompilerShutdown.QualifiedPipe(host,new[]{host,"exec",dll,"-pipename:../../foreign"})==null,"invalid pipe accepted");
+      Need(NccgsUnityCompilerShutdown.QualifiedPipe(host,new[]{host,"exec",dll,"-pipename:safe","-shutdown"})==null,"unexpected arguments accepted");
+      Console.WriteLine("compiler shutdown guards PASS"); return 0;
+    } catch(Exception error) { Console.Error.WriteLine(error); return 1; }
+    finally { if(job!=IntPtr.Zero) CloseHandle(job); }
+  }
+}