nccgs 2.1.1 → 3.0.0-rc.2

package/.claude/nccgs/protocols/orchestration.md

@@ -1,74 +0,0 @@
-# Orchestration protocol
-
-Use this protocol when work benefits from more than one studio role.
-
-1. Identify the smallest complete set of domains required by the approved outcome.
-2. Separate decision work, implementation work, and independent verification.
-3. Assign one accountable owner to every output and writable path.
-4. Express dependencies as a directed acyclic graph.
-5. Schedule independent work by dependency and ownership. In standalone 2.0.0,
-   launch foreground calls sequentially and collect each final result before the next.
-6. Stop dependent work when an upstream contract is unresolved.
-
-Default maximum subagent depth is one. The primary session composes the graph,
-passes context packets, merges handoffs, and owns closure. Agents return requests for
-another specialty instead of spawning their own hierarchy.
-
-## Team sizing
-
-- FAST: one accountable lightweight implementer with a concise plan and report.
-- STANDARD: one accountable standard implementer plus independent verification; add a design
-  or domain specialist only when the feature actually needs it.
-- CONTROLLED: one deep implementer accountable for integration, decision owner,
-  affected specialists, verification, and
-  adversarial reviewer. Avoid ceremonial roles with no distinct deliverable.
-
-Pass a context packet path and exact responsibility. Do not paste full GDDs, ADRs,
-or chat history into every prompt. Surface blocked nodes immediately and preserve
-completed independent outputs.
-
-Standalone execution follows [the standalone protocol](standalone.md), including
-durable dispatch reservations, attempt budgets, mode guards and optional external
-review. Path ownership is checked for declared reservations and direct edit tools;
-opaque shell/MCP operations require independent diff review, not a sandbox claim.
-
-Under compatibility execution with astra-claude, Astra owns the plan and document scope. Claude orchestrates
-implementation nodes inside that plan using the task's risk-selected model/effort.
-Every coding outcome must
-pass an independent Fable review before its final report goes to Astra. Even FAST
-work cannot bypass this sequence. See [the handoff protocol](astra-claude.md).
-
-Use `nccgs-task-scout` only to close a named factual gap. Do not launch a scout,
-design consultation, or extra reviewer when existing evidence already answers the
-question. Each reviewer must cover a distinct risk. Preserve one accountable
-implementer even when support spans multiple specialists.
-
-Keep only one reviewer in flight per task. Standalone checks work-stage readiness
-before reserving review and again before launch. A rejected launch is automatically
-marked failed only while demonstrably unclaimed; its quota stays spent. Claimed or
-uncertain invocations still require runtime evidence or external reconciliation.
-When technical checks prevent work-stage recording, use measured negative criteria
-to request an eligible protected repair instead of reserving a premature reviewer.
-
-Do not expand scope speculatively. Stop when the approved criteria and relevant
-checks pass with no actionable blockers; rerun only checks affected by changed
-inputs, failures, or new evidence. Turn unresolved subjective questions into a
-playable Product Owner test. Review budgets are enforced by task gates; context
-and time budgets are advisory. Exhaustion requires an evidence-backed stop and an
-explicit external extension, never automatic approval.
-
-Native agent `maxTurns` comes from the installed role frontmatter; a larger
-`Agent.max_turns` request is not evidence that the role cap increased. Templates
-are authoritative and policy compilation synchronizes the registry. Read the
-[generated turn-ceiling table](../routing.generated.md) rather than copying limits
-into assignments. Check installed frontmatter and session overrides before launch;
-these ceilings neither extend task budgets nor establish observed execution.
-
-An external operator can reallocate a pinned dispatch limit with `task
-extend-dispatch --id TASK --request FILE`. The request must contain
-`previousLimit`, a larger finite `maxDispatches`, `reason`, and a hashed
-authorization artifact `reference`. All dispatches must be settled. The ledger
-records before/after limits; spent attempts, ancestor limits and protected slots
-remain unchanged. Claude cannot invoke this command. If a framework update changes
-a plan's source baseline, retain the old failed plan and create a bounded child
-under its preserved aggregate budget; do not reset the old baseline or history.

package/.claude/nccgs/protocols/review-handoff.md

@@ -1,101 +0,0 @@
-# Reviewer-owned verdict and remaining conditions
-
-For a reservation with `handoffTransport: "native-result"`, return the entire
-Markdown handoff as one final text block and do not write a file. The native hook
-copies it verbatim into the single declared fresh handoff path. The consumer
-re-evaluates the actual response with the native completion policy and preserves
-any upstream completion failure. Only validated provider-designated informational
-leading/tail blocks are removed; exactly one nonempty model text block of at most
-262144 UTF-8 bytes must remain. Unknown, invalid, incomplete or ambiguous responses
-reject without publishing. Model-authored lookalike tags, review JSON, conditions
-and completion markers are never rewritten. The exact same
-review contract, independent identity and gates below still apply. Other
-reservations retain the existing file-writing workflow.
-
-New standalone installs enable `reviewContractRequired: true`. The completed
-review dispatch must pin the same Markdown handoff used as the review stage's
-`evidence`. The reviewer writes exactly one `nccgs-review` fenced JSON block:
-
-```nccgs-review
-{
-  "schemaVersion": 1,
-  "taskId": "TASK",
-  "contractHash": "CURRENT_CONTRACT_HASH",
-  "snapshot": "REVIEWED_SOURCE_SNAPSHOT",
-  "verdict": "BLOCKED",
-  "criteriaMet": false,
-  "findings": [],
-  "conditions": [
-    { "id": "C-01", "description": "Required baseline comparison has not been supplied or reviewed." }
-  ]
-}
-```
-
-Use actual task identity, hash and snapshot supplied by the coordinator. Findings
-retain the required severity, status, description and design acceptanceImpact.
-Finding severity must be BLOCKER, HIGH, MEDIUM, LOW or INFO; status must be OPEN,
-RESOLVED or ACCEPTED. Use ACCEPTED for an acknowledged informational limitation,
-not NOTED. The coordinator must not translate an invalid reviewer-owned value.
-Prose explains the evidence, scope and limits; the block is the authoritative
-verdict, assessment, findings and remaining conditions. Coordinator stage input
-must copy these four fields exactly, including an explicit `conditions` array.
-
-Use `task dispatch-prompt --id TASK --dispatch ID` to prepare the registered
-assignment and a PARTIAL draft. Before returning, the running reviewer can call
-the fixed `task handoff-validate --id TASK --dispatch ID --file PATH` operation
-for its own declared handoff. Correct structural errors in that draft while the
-invocation is still active. VALID checks structure only; it never approves work.
-After native completion, the coordinator uses `task record-review --id TASK
---dispatch ID --file PATH` to copy the pinned result through the existing review
-gate without retyping its fields. Run each as one plain invocation of
-`node .claude/nccgs/tools/task.mjs`. See [handoff operations](../../../docs/HANDOFF-AUTOMATION.md).
-
-PASS requires `conditions: []`. If acceptance still depends on a diff, test,
-source read or other check, return BLOCKED or CHANGES_REQUIRED with that condition.
-A finished negative review may mark its handoff COMPLETE. Do not write a conditional
-PASS or hide pending acceptance work in a prose disclaimer. The framework checks
-the explicit contract; detecting an omitted semantic condition remains a reviewer
-responsibility. Neither a marker nor a schema proves complete semantic coverage.
-
-Supply required checks before launching review. When new evidence arrives after
-a completed conditional/negative review, retain that artifact and obtain a fresh
-independent review within the existing dispatch/round/time/cost limits. A coordinator
-cannot clear conditions, change the verdict, edit the captured handoff or relabel
-its own check as the reviewer's completed work. Report PARTIAL/BLOCKED when the
-remaining allowance cannot fund the required follow-up.
-
-For a broad delivery review, check the effective native role `maxTurns` before
-dispatch. A number in the assignment prompt does not override the role's limit.
-Read the [generated native ceilings](../routing.generated.md); a ceiling is not a target.
-Keep session cost, time and dispatch limits active. Index current receipts, raw
-files and source changes before review, and use focused reads instead of repeatedly
-loading whole histories. Write a truthful PARTIAL handoff early and update it as
-checks finish, so interruption leaves concrete unresolved work. Only the reviewer
-may replace its own draft with the completed verdict before the dispatch ends.
-Capacity changes require an external allocation within the owner's authority;
-never reset failed attempts or loosen the acceptance requirements.
-
-The native harness can report an invocation `completed` and still say its worker
-stopped at a turn limit. Harness-designated incomplete notices override a COMPLETE
-file: the attempt fails as incomplete, all spent quota remains, and its evidence
-cannot certify a stage. Unsupported harness notices/metadata fail closed pending
-external inspection. Arbitrary quoted text in a worker's response is not harness
-metadata and does not itself change completion status. Captured observations retain
-the reported invocation status and a diagnosis/hash, not arbitrary response text.
-
-The provider-designated informational block
-`<tools-used-before-summary>Edit</tools-used-before-summary>` is recognized as a
-tool inventory. Recognition applies only inside the declared leading/tail harness
-blocks, never to the model handoff. The whole text block must be at most 4096
-characters and contain only that exact case-sensitive wrapper, one or more
-comma-separated tool identifiers, and optional surrounding whitespace. Identifiers
-start with an ASCII letter and continue with ASCII letters, digits, `_`, `.`, `:`
-or `-`; whitespace may surround commas. Empty lists, nested tags, extra prose,
-non-text blocks and any other advisory remain unrecognized and fail closed.
-Turn-limit notices retain priority even when mixed with a recognized inventory.
-An informational note preserves its hash and the provider's reported status;
-it never upgrades a failed or unknown invocation. This compatibility rule does
-not rewrite a previous failed dispatch or waive its consumed quota or review.
-
-Older pinned policies remain unchanged. Upgrade policy only for fresh authorized
-tasks; never retrofit frozen evaluation records or reset attempts to obtain PASS.

package/.claude/nccgs/protocols/shared-workflow-context.md

@@ -1,33 +0,0 @@
-# Optional shared Graphify context consumer
-
-Use this protocol only when the project has adopted the external Agent Project
-Workflow 1.7 tooling. Preserve NCCGS's existing internal execution and task gates.
-The approved outer assignment and actual source documents remain authoritative.
-
-Resolve the external implementation root from the accepted project workflow binding.
-The default common configuration is `docs/workflow/workflow.config.json`; it is owned
-by the shared workflow, not an NCCGS policy/freshness copy. Do not create it during
-ordinary intake. A missing configuration skips context operations without installing
-or bootstrapping Graphify.
-
-At task entry, after required direct instruction/source reads, run:
-
-```text
-node .claude/nccgs/tools/shared-context.mjs --project PROJECT_ROOT --workflow-root EXTERNAL_IMPLEMENTATION_ROOT --action status
-```
-
-Use `--action query --text TERM` only for suitable verified coverage. A held review
-adds the actual `--hold HOLD_ID --secret HOLD_CAPABILITY`; queries resolve the retained
-generation and pinned source. Preserve the hold capability as local operational state.
-At a settled write boundary use `--action refresh` only when accepted scope covers it.
-This consumer cannot perform setup, update or initial rebuild. Report unavailable,
-partial/stale or recovery-required coverage and continue with original sources.
-
-The external common adapter owns GC-01 through GC-04, one current commit and updater.
-Do not add a private graph, native hook, model change, independent source ignore rule,
-or copied freshness file. Link the common generation/result in the existing context
-packet/handoff. Graph context does not provide provider execution evidence or external
-acceptance; NCCGS internal DONE may return a candidate awaiting outer review.
-
-This source bridge has fixture coverage. It does not certify a Claude Code/native
-or Unity runtime session; adoption and host qualification remain explicit operations.

package/.claude/nccgs/protocols/standalone-gates.md

@@ -1,329 +0,0 @@
-# NCCGS 2.0.0 — implementation and operation
-
-Version: **2.0.0**. Target executor: **Claude Code**.
-Framework tests and scoped native delivery evidence exist. A new full Unity task
-through this exact stable archive is not claimed. Published-1.3 upgrade qualification
-passed within its documented fixture scope; see [release status](../../../docs/RELEASE-STATUS.md).
-Read [MEMORY.md](../MEMORY.md) before interpreting evaluation results.
-
-## Policies and migration
-
-New installs use `.nccgs/execution.json`:
-
-```json
-{
-  "schemaVersion": 1,
-  "name": "standalone",
-  "externalReview": { "mode": "off" },
-  "acceptanceRequired": false,
-  "requireObservedEffort": false,
-  "maxParallelWorkers": 2,
-  "designReviewRequired": true,
-  "reviewContractRequired": true
-}
-```
-
-Model profile lives separately in `.nccgs/project.yaml`; the default is
-`claude-standalone`. Its Sonnet/Opus aliases are requests, never resolved observations.
-Missing execution.json resolves to compatibility. Changing a model profile alone
-does not remove an external, acceptance or historical task obligation.
-
-Use `nccgs migrate-execution --to standalone --dry-run` after a framework update;
-remove `--dry-run` to apply. Add `--model-profile claude-standalone` to explicitly
-change models too. Configuration archives live under `.nccgs/backups/execution/ID`.
-`--rollback ID --dry-run` checks restoration; rollback refuses changed configuration
-or corrupted backup hashes. Tasks/evidence/budgets are preserved. See
-the packaged UPGRADING.md for failure recovery and legacy task handling.
-
-## Intake, classification and modes
-
-Before initializing a fresh Unity task, map its known generated IDE/local metadata
-as exact `unityGeneratedFiles` paths in `.nccgs/inputs.json` (see
-[input freshness](task-gates.md#input-freshness-and-bounded-verification)). Preserve
-other input mappings and timeout ceilings. Inspect existing IDE files: custom or
-build-input files stay tracked. No automatic directory/glob ignore is applied.
-The manifest is pinned at init; generated-file hashes remain in verification
-receipts, while source, assets, packages and ProjectSettings remain in the source
-snapshot. Existing tasks retain their original inputs and historical verdicts.
-
-Large implementation tasks may use `task slice-preview|slice-plan --id TASK --file
-PLAN` and `task slice-status --id TASK`; see [task slices](task-slices.md).
-These commands preserve the original task and gates. A pinned plan tracks bounded
-delivery assignments, not replacement contracts or additional budgets.
-
-Example `.nccgs/evidence/intake/hud-fix.json`:
-
-```json
-{
-  "schemaVersion": 1,
-  "objective": "Correct the pause-button offset at the declared reference resolution",
-  "mode": "implement",
-  "scope": "local",
-  "systems": ["HUD"],
-  "target": "fix",
-  "readiness": "ready",
-  "acceptance": [{ "id": "HUD-01", "description": "Offset matches the reference", "check": "layout-reference",
-    "assertions": [{ "artifact": ".nccgs/evidence/measurements/layout.json", "pointer": "/offsetMatches", "op": "eq", "value": true }] }],
-  "requiredChecks": ["layout-reference"],
-  "requiredArtifacts": [],
-  "manualGates": [],
-  "assumptions": ["Gameplay and input behavior remain unchanged"],
-  "reassessWhen": ["The layout defect crosses multiple UI systems"]
-}
-```
-
-This is a template, not evidence that the check ran. For `audit` or `plan`, declare
-`analysisArtifacts` such as `.nccgs/evidence/analysis/TASK-result.md`; source edits
-are prohibited. Include real `sources` paths to hash authoritative documents.
-Criteria with `check` add required objective checks; `{id,description,manual:true}`
-adds a manual acceptance gate. Project-level gate manifests remain mandatory.
-Automatic criteria require measured JSON assertions (`eq`, `gte`, `lte`); check-only
-criteria remain UNVERIFIED. The verifier captures changed measurement files into
-hashed per-job evidence. Failed/unverified criteria block PASS review, success report
-and DONE, independently of the helper's exit code. Inspect `task acceptance-status`.
-Use `checkpoint: "early"` only for a small delivery prerequisite that actually
-blocks dependent work. Bot survival/victory, damage headroom and product balance
-are not default expansion gates. See [delivery acceptance](delivery-acceptance.md)
-and [phase-2 operations](../../../docs/PHASE-2-OPERATIONS.md). The engine still
-enforces pinned criteria; revising scope requires an explicit reviewed contract.
-
-```text
-node .claude/nccgs/tools/task.mjs init --id hud-fix --intake .nccgs/evidence/intake/hud-fix.json
-node .claude/nccgs/tools/task.mjs bind --id hud-fix --session ACTUAL_SESSION_ID
-node .claude/nccgs/tools/task.mjs inspect --id hud-fix
-```
-
-Run each task command in its own shell tool call from the project directory.
-Do not append pipes, redirection (including `2>&1`), semicolons, `cd`, or other
-commands. The guard recognizes a plain task invocation; composed shell commands
-are not lifecycle commands and require a correlated implementation worker.
-Use `inspect` to read task state, and Read/Grep for command documentation.
-`status` and `--help` are not recognized lifecycle operations. If a plain command
-is rejected, retain the error and inspect its arguments instead of bypassing the
-guard or requesting an external bind before correcting the invocation.
-
-The classifier is deterministic and conservative, not a general semantic model.
-Ready/local/fix can be FAST. Unknown or feature scope defaults to STANDARD.
-Save/serialization, migration, network authority, commerce and cross-system signals
-require CONTROLLED. The coordinator must inspect real risk and supply `riskSignals`,
-reason and evidence; keyword absence is not proof of safety.
-
-Explicit `reclassify --classification FILE` requires `reason` and `evidence`; optional
-`risk`, `scope`, `target`, `readiness`, `systems` and `riskSignals` explain the change.
-To change intake content, update the same file and use `refresh-inputs --reason TEXT`.
-Reclassification invalidates affected stages while retaining old evidence and spent
-review rounds. Source/input/policy changes never reuse old approval. Execution policy
-changes cannot be adopted by input refresh: restore pinned policy for current work
-or explicitly scope new work while retaining prior history and spent budgets. Audit/plan
-baseline hashing still detects source edits after canonical inputs are refreshed.
-
-## Dispatch, budget and evidence
-
-Save a request under `.nccgs/evidence/requests/`:
-
-```json
-{
-  "requestKey": "hud-fix-implementation-1",
-  "kind": "implementation",
-  "agent": "nccgs-fast-implementer",
-  "writePaths": ["Assets/Game/UI/PauseButton.cs"],
-  "reason": "One ready local layout fix with a targeted reference check"
-}
-```
-
-```text
-node .claude/nccgs/tools/task.mjs reserve --id hud-fix --request .nccgs/evidence/requests/hud-fix.json
-```
-
-Use the returned ID in the Agent prompt prefix `[NCCGS-DISPATCH:ID]`, select the
-specified role and task route, and include contract, inputs, ownership and acceptance.
-PreToolUse claims the slot with actual session/tool-use identity. SubagentStart binds
-an unambiguous agent ID. Foreground PostToolUse completion captures final telemetry.
-Use foreground calls; background runs hold slots until correlated
-final evidence or external reconciliation. SubagentStop alone cannot prove model,
-effort or complete usage. Ambiguous same-role starts are not guessed.
-
-Review requests use `kind: "review"`, `agent: "nccgs-adversarial-reviewer"`, and
-empty writePaths. Analysis requests also have no source ownership. Dispatch ceilings
-are 6/12/24 for new FAST/STANDARD/CONTROLLED tasks by default; first reservation may explicitly
-set `limits.maxDispatches`, `maxDurationMs`, `maxCostUsd`. Limits are pinned, counted
-across descendants, and cannot be raised by another reservation. Review limits are
-2/3/3. Failed, cancelled and uncertain attempts remain spent. Extensions of review
-rounds require a reasoned external operator decision and never grant approval.
-New implementation ledgers protect four slots within the total: two reviews, one
-repair and one read-only QA dispatch. Ordinary `purpose: "delivery"` cannot spend
-them. `purpose: "repair"` needs recorded negative review/measured acceptance feedback
-and a bounded `workPacket` with exact files, checks and one fresh handoff. Use
-`task dispatch-prompt --id TASK --dispatch ID` after reservation. See
-[bounded repair](bounded-repair.md) for enforced per-worker allowances;
-`purpose: "qa"` uses a QA/verification role after a completed repair with retained feedback.
-Audit/plan protect one review slot. Existing ledgers retain their pinned allocation.
-
-At most two implementation workers can reserve disjoint paths; review/analysis
-cannot overlap source writers. Direct edit tools enforce ownership. Opaque shell/MCP
-operations are not OS-sandboxed by NCCGS; inspect their actual diff and test effects.
-Typed Unity repair requires exclusive project ownership, exact pinned Editor steps
-and a source-scope audit. An uncertain Editor operation retains that ownership
-even after the native worker returns; its observed usage and handoff remain recorded.
-Audit/plan/review block arbitrary shells and unknown tools. Use read tools, declared
-analysis artifacts and externally supplied command evidence when required.
-
-`task verify --id TASK --name CHECK -- EXECUTABLE ARGS` records the actual command,
-exit code, bounded timeout, log hash and before/after source snapshot. Claude may
-run it only for implementation tasks. The verifier must not change source.
-Use `verify --timeout-ms 900000 --background` before `--` for a long real-time
-check when no check-specific timeout is configured. The requested timeout is
-recorded and pinned to the request key (100..7200000 ms); it cannot exceed an
-explicit check timeout or extend the supervisor's overall deadline. Windows jobs
-retain all descendants, even detached children: a quick launcher does not let a
-600-second player escape the default 300-second timeout. Keep long collection in
-the managed job with a sufficient bound, then validate its retained output.
-Do not use WMI or another parent process to escape job ownership. Poll the actual
-job with `job-status` or `job-wait --timeout-ms 30000`; do not create sleep-only
-verification jobs or keep waiting after the collector has exited.
-`task ref --file PATH` produces a `{path,sha256}` reference without inventing evidence.
-
-Record a completed work stage with a JSON payload (placeholders below must be
-replaced with returned values, never copied as observations):
-
-```json
-{
-  "snapshot": "ACTUAL_FINAL_SNAPSHOT",
-  "dispatchId": "ACTUAL_COMPLETED_DISPATCH_ID",
-  "runtime": { "path": ".nccgs/evidence/runtime/observations/ACTUAL.json", "sha256": "ACTUAL_HASH" },
-  "checks": [{ "name": "layout-reference", "status": "PASS", "evidence": { "path": ".nccgs/evidence/ACTUAL-check.json", "sha256": "ACTUAL_HASH" } }]
-}
-```
-
-Use `record --id TASK --stage implementation --evidence FILE`. Audit/plan use stage
-`analysis` and include `evidence` referencing the declared result artifact. Each
-accepted work/review dispatch can be consumed once, including across history.
-
-Review payload adds `verdict` (`PASS|CHANGES_REQUIRED|BLOCKED`), `criteriaMet`,
-`findings`, and a review-artifact `evidence` ref to snapshot/dispatchId/runtime.
-Findings include `severity` (`BLOCKER|HIGH|MEDIUM|LOW|INFO`), `status`
-(`OPEN|RESOLVED|ACCEPTED`) and `description`. An unresolved BLOCKER/HIGH or unmet
-required criterion prevents internal PASS. Review identity must differ from work.
-With reviewContractRequired, the completed reviewer's pinned handoff must contain
-exactly one nccgs-review JSON block; copy its verdict, criteriaMet, findings and
-conditions exactly into the stage payload. Pending conditions block PASS. Follow
-[review handoff](review-handoff.md); a coordinator cannot remove those conditions.
-For source versions with handoff automation, the coordinator can instead use
-`task record-review --id TASK --dispatch ID --file PATH` to import those fields
-directly from the completed pinned handoff through the same record gate. The
-running worker can first use `task handoff-validate` on its own declared file to
-catch structure errors. See [handoff operations](../../../docs/HANDOFF-AUTOMATION.md).
-For design revisions, run fixed `task design-compare --id TASK --baseline PINNED_SOURCE
---file DECLARED_CANDIDATE` before the final review and supply its immutable receipt.
-
-## Reporting, external review and closure
-
-```text
-node .claude/nccgs/tools/task.mjs report --id TASK --outcome blocked --summary "Actual blocker and missing evidence"
-node .claude/nccgs/tools/task.mjs check --id TASK --target done
-node .claude/nccgs/tools/task.mjs close --id TASK
-```
-
-Reports accept `partial|blocked|failed` even when successful closure is unavailable.
-Success requires verified current work and independent review before any report is
-written. Generated Markdown includes evidence status and unresolved gates.
-`record --stage report` can supply `artifacts` refs for required closure outputs.
-Success wording does not override failed checks. Only `close` with all current gates
-passing establishes DONE. `inspect` remains usable with changed/malformed policy.
-
-`export-external --out .nccgs/evidence/external/requests/UNIQUE.json` writes an
-immutable task/contract/snapshot packet. An external actor reviews it and imports
-a receipt through `import-external --file FILE` outside the Claude executor:
-
-```json
-{
-  "schemaVersion": 1,
-  "id": "REVIEW_ID",
-  "taskId": "TASK",
-  "contractHash": "EXPORTED_HASH",
-  "snapshot": "EXPORTED_SNAPSHOT",
-  "actor": "ACTUAL_EXTERNAL_REVIEWER",
-  "verdict": "PASS",
-  "findings": [],
-  "reviewedAt": "ACTUAL_ISO_TIMESTAMP",
-  "source": "ACTUAL_REVIEW_REFERENCE"
-}
-```
-
-Off ignores external closure dependency. Advisory retains current findings without
-blocking. Required evaluates all active current receipts; a later empty PASS cannot
-erase earlier blocking findings. To replace a prior decision, include
-`supersedes: ["PRIOR_RECEIPT_ID"]` and `supersessionReason` identifying the new
-evidence. Old findings remain traceable. Stale/duplicate/malformed receipts fail.
-
-If acceptance is required, an external Product Owner decision references taskId,
-contractHash, snapshot, `actor: "Product Owner"`, `decision: "ACCEPTED"`, decidedAt,
-statement, reference and each manual gate `{id,decision:"ACCEPTED",reference}`.
-Import via `record --stage acceptance` with its evidence ref. Claude cannot accept
-on the user's behalf. NCCGS neither launches Astra nor sends external messages.
-
-## Recovery and telemetry
-
-Supervised verification pins the owning run's absolute deadline in its request and
-receipt. Its managed command tree ends at the earlier of that deadline and the
-check timeout, even if the coordinator exits. A long per-attempt timeout never
-extends the approved run. After expiry, existing request keys remain readable but
-new attempts are refused. Do not escape this ownership through WMI or services.
-
-Use `checkpoint --reason TEXT`, `resume`, `dispatch-status` and `telemetry` with
-`--id TASK`. Resume preserves reservations, findings, attempts and budgets. A lost
-callback or dead worker does not refund a slot by timeout. An external operator can
-use `dispatch-reconcile --dispatch ID --request FILE` with `status: failed|cancelled`,
-reason and observed reference after confirming the process is no longer running.
-Never manually reset the ledger. Missing initialized history or altered durable
-evidence fails closed. A crashed lock requires operator inspection before recovery.
-
-Telemetry reports known subtotals and coverage for duration, tool calls, tokens and
-cost. Total is null if any started attempt lacks that metric. Observed zero remains
-zero. These are worker measurements; coordinator work, human delay and billing are
-not automatically covered. A configured spend/time ceiling cannot interrupt an
-already running provider request. Unknown duration still blocks its optional cap.
-
-When worker cost is missing, `limits.maxCostUsd` can instead use a conservative
-supervised-session ceiling. `nccgs run --session-budget-usd` supplies the current
-whole-session allowance, including coordinator work. The guard adds verified
-terminal costs of every prior supervised session in the task ancestry and requires
-that total plus the current allowance fit the original cap. Every started worker
-must belong to those sessions; unknown/corrupt prior usage, expired deadlines,
-uncovered sessions or missing exclusive supervisor ownership block admission.
-Concurrent supervised sessions cannot reuse one project's remaining allowance.
-Each reservation records its budget basis and must launch in that same session.
-This does not backfill worker telemetry: preserve null cost, never allocate the
-session total to a worker or infer it from tokens. Without supervised coverage,
-the optional cost cap still requires complete worker measurements. Pinned limits
-cannot be unset through another reservation. `dispatch-reconcile` only settles
-active/uncertain slots; it does not backfill cost on a completed dispatch.
-
-For tasks with a pinned `budget-plan`, the root's protected final-review reserve
-also applies to every child. Work phases pay for design (including its review),
-implementation, checks and repair, leaving the reserved money and time intact.
-After recording implementation from the completed native worker and fresh checks,
-invoke `node .claude/nccgs/tools/task.mjs report --id TASK --outcome partial --summary "Awaiting protected independent review"`
-before ending the work session. A prose PARTIAL response alone does not write the
-lifecycle report. Do not dispatch the delivery reviewer inside the work phase.
-The external supervisor launches the same task with
-`--budget-phase final-review`. That phase may only dispatch independent delivery
-reviewers and settle existing evidence; it cannot fund repair or new checks.
-Read `task budget-status --id TASK` for the pinned terms and settled spend. A new
-session does not reset either allocation. Unknown in-flight cost remains unknown.
-If the final reviewer cannot finish, preserve PARTIAL; reserved funds are not a
-review verdict or permission to reduce acceptance. Only the external operator
-registers the plan before spending; a native worker/coordinator cannot edit it.
-
-Native capture follows the documented Claude Code [hook inputs and Agent tool
-response](https://code.claude.com/docs/en/hooks): resolvedModel/modelsUsed and native
-duration/token/tool-use fields when present. It does not invent effort or cost.
-Actual field availability and correlation must be confirmed by the real pilot.
-
-## Release boundary
-
-Framework tests and the synthetic five-size benchmark validate mechanics. They
-cannot measure model reasoning, game quality or end-to-end team productivity.
-The [historical pilot protocol](standalone-pilot.md) describes benchmark controls.
-Any qualification of this stable archive needs fresh scoped evidence; package
-preparation does not establish it. CP0 remains reference-only and cannot be scored.