nccgs 2.1.1 → 3.0.0-rc.2

package/.claude/nccgs/tools/evidence.mjs

@@ -1,153 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { artifact, contained, hash, verifyArtifact } from "./policy.mjs";
-
-const durableRoot = ".nccgs/evidence/runtime";
-const legacyRoot = ".nccgs/runtime/";
-const isRef = value => value && typeof value === "object" && typeof value.path === "string" && typeof value.sha256 === "string";
-const encode = value => Buffer.from(`${JSON.stringify(value, null, 2)}\n`, "utf8");
-
-function readReference(project, ref, label) {
-  try {
-    const file = verifyArtifact(project, ref);
-    const bytes = fs.readFileSync(file);
-    if (hash(bytes) !== ref.sha256) throw new Error("Evidence changed while being copied");
-    return bytes;
-  } catch (error) {
-    throw new Error(`${label}: missing, stale, or unsafe evidence '${ref?.path ?? "unknown"}': ${error.message}`);
-  }
-}
-
-// Content-addressed copies retain the original bytes. Plan every copy before any
-// writes so a missing legacy source cannot produce a partly migrated task.
-function copyPlan(project) {
-  const writes = new Map();
-  const migrations = [];
-  const seenMigrations = new Set();
-  const add = (kind, bytes) => {
-    const sha256 = hash(bytes);
-    const relative = `${durableRoot}/${kind}/${sha256}.json`;
-    const file = contained(project, relative);
-    if (fs.existsSync(file)) {
-      if (!fs.statSync(file).isFile() || hash(fs.readFileSync(file)) !== sha256) {
-        throw new Error(`Durable evidence collision or corruption: ${relative}`);
-      }
-    } else writes.set(relative, bytes);
-    return { path: relative, sha256 };
-  };
-  const note = (from, to, kind) => {
-    if (from.path === to.path && from.sha256 === to.sha256) return;
-    const key = `${kind}:${from.path}:${from.sha256}:${to.path}`;
-    if (!seenMigrations.has(key)) {
-      migrations.push({ kind, from: { ...from }, to: { ...to } });
-      seenMigrations.add(key);
-    }
-  };
-  const source = ref => {
-    const bytes = readReference(project, ref, "Runtime source");
-    if (ref.path.startsWith(`${durableRoot}/sources/`)) return { ...ref };
-    const durable = add("sources", bytes);
-    note(ref, durable, "source");
-    return durable;
-  };
-  const observation = (value, sourceRef) => {
-    const durableSource = source(sourceRef);
-    const normalized = { ...value, observationSource: durableSource };
-    if (sourceRef.path !== durableSource.path || sourceRef.sha256 !== durableSource.sha256) {
-      normalized.originalObservationSource = value.originalObservationSource ?? { ...sourceRef };
-    }
-    return add("observations", encode(normalized));
-  };
-  const commit = () => {
-    // Recheck destinations before writing; never overwrite an existing artifact.
-    for (const [relative, bytes] of writes) {
-      const file = contained(project, relative);
-      if (fs.existsSync(file) && (!fs.statSync(file).isFile() || hash(fs.readFileSync(file)) !== hash(bytes))) {
-        throw new Error(`Durable evidence collision or corruption: ${relative}`);
-      }
-    }
-    for (const [relative, bytes] of writes) {
-      const file = contained(project, relative);
-      fs.mkdirSync(path.dirname(file), { recursive: true });
-      try { fs.writeFileSync(file, bytes, { flag: "wx" }); }
-      catch (error) { if (error.code !== "EEXIST") throw error; }
-      if (artifact(project, relative).sha256 !== hash(bytes)) {
-        throw new Error(`Durable evidence copy failed verification: ${relative}`);
-      }
-    }
-  };
-  return { add, source, observation, note, migrations, commit };
-}
-
-/** Persist an observation and an exact durable copy of its raw source.
- * Callers retain responsibility for validating runtime identity and provenance.
- */
-export function persistRuntimeObservation(project, observation, sourceRef) {
-  if (!observation || typeof observation !== "object" || Array.isArray(observation)) {
-    throw new Error("Runtime observation must be an object");
-  }
-  const plan = copyPlan(project);
-  const result = plan.observation(observation, sourceRef);
-  plan.commit();
-  return result;
-}
-
-/** Return a migrated clone; the caller owns task locking and atomic task writes.
- * No source, stage, history entry, review counter, or original artifact is deleted.
- * This does not refresh snapshots, evidence times, approvals, or task validity.
- */
-export function migrateTaskEvidence(project, task) {
-  const plan = copyPlan(project);
-  const cache = new Map();
-  const migrateReference = ref => {
-    const key = `${ref.path}:${ref.sha256}`;
-    if (cache.has(key)) return { ...ref, ...cache.get(key) };
-    const bytes = readReference(project, ref, "Runtime observation");
-    let value;
-    try { value = JSON.parse(bytes.toString("utf8")); }
-    catch {
-      if (ref.path.includes("/observations/")) throw new Error(`Invalid runtime observation JSON: ${ref.path}`);
-    }
-    let result = ref;
-    if (value?.origin === "runtime-observation") {
-      if (!isRef(value.observationSource)) throw new Error(`Runtime observation has no verifiable raw source: ${ref.path}`);
-      const sourceRef = value.observationSource;
-      const source = plan.source(sourceRef);
-      const needsCopy = !ref.path.startsWith(`${durableRoot}/observations/`) || source.path !== sourceRef.path;
-      if (needsCopy) {
-        const archive = plan.add("sources", bytes);
-        plan.note(ref, archive, "observation-archive");
-        const migrated = { ...value, observationSource: source,
-          originalObservationSource: value.originalObservationSource ?? { ...sourceRef },
-          evidenceMigration: { originalObservation: { ...ref }, archivedObservation: archive,
-            ...(value.evidenceMigration ? { previous: value.evidenceMigration } : {}) } };
-        result = plan.add("observations", encode(migrated));
-        plan.note(ref, result, "observation");
-      }
-    } else if (ref.path.startsWith(legacyRoot)) {
-      if (ref.path.includes("/observations/")) throw new Error(`Invalid runtime observation origin: ${ref.path}`);
-      result = plan.source(ref);
-    }
-    cache.set(key, result);
-    return { ...ref, ...result };
-  };
-  const walk = (value, key = "") => {
-    if (Array.isArray(value)) return value.map(item => walk(item, key));
-    if (!value || typeof value !== "object") return value;
-    // Original paths in our audit records describe where bytes came from; they
-    // are not live dependencies after a clean copy removes the ignored runtime.
-    if (value.action === "migrate-evidence" ||
-        (["source", "observation", "observation-archive"].includes(value.kind) && isRef(value.from) && isRef(value.to))) {
-      return structuredClone(value);
-    }
-    if (isRef(value)) {
-      // Do not revalidate unrelated old plan/report refs when migrating history.
-      if (key === "runtime" || value.path.startsWith(legacyRoot)) return migrateReference(value);
-      return { ...value };
-    }
-    return Object.fromEntries(Object.entries(value).map(([name, child]) => [name, walk(child, name)]));
-  };
-  const migrated = walk(task);
-  plan.commit();
-  return { task: migrated, migrations: plan.migrations, changed: plan.migrations.length > 0 };
-}

package/.claude/nccgs/tools/gates.mjs

@@ -1,297 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { performance } from "node:perf_hooks";
-import { hash, json, contained, artifact, verifyArtifact, atomicJson, loadPipeline, resolveExecution } from "./policy.mjs";
-import { canonicalInputs, pinInputs, inputPolicy, isOutput, isUnityGenerated, unityGeneratedState } from "./inputs.mjs";
-import { migrateTaskEvidence } from "./evidence.mjs";
-import { acquireLock } from "./process-lock.mjs";
-import { initializeStandalone, checkStandalone, recordStandalone, extendStandalone, refreshStandalone,
-  reclassifyStandalone, exportExternalStandalone, importExternalStandalone } from "./lifecycle.mjs";
-
-export const stages = ["implementation", "review", "report", "astra", "acceptance"];
-function requireValue(condition, message) { if (!condition) throw new Error(message); }
-export function taskPath(project, id) {
-  requireValue(typeof id === "string" && /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,79}$/.test(id), "Invalid task ID");
-  return contained(project, `.nccgs/tasks/${id}.json`);
-}
-export function snapshot(project, task = null, { includeFiles = false } = {}) {
-  const started = performance.now();
-  const excluded = new Set(loadPipeline(project).snapshotExcludes);
-  const policy = inputPolicy(project);
-  const inputs = canonicalInputs(project, policy);
-  const files = [];
-  let bytes = 0, readHashMs = 0;
-  function walk(relative = "") {
-    for (const entry of fs.readdirSync(path.join(project, relative), { withFileTypes: true })) {
-      if (!relative && excluded.has(entry.name)) continue;
-      const name = relative ? `${relative}/${entry.name}` : entry.name;
-      const file = contained(project, name);
-      if (isOutput(name, policy) || isUnityGenerated(name, policy)) continue;
-      if (entry.isDirectory()) walk(name);
-      else if (entry.isFile()) {
-        const readStarted = performance.now();
-        const data = fs.readFileSync(file);
-        files.push([name, hash(data)]);
-        bytes += data.length;
-        readHashMs += performance.now() - readStarted;
-      }
-      else throw new Error(`Unsupported snapshot entry: ${name}`);
-    }
-  }
-  walk();
-  const generatedFiles = unityGeneratedState(project, policy);
-  files.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-  return { sha256: hash(JSON.stringify({ files, canonicalInputs: inputs.sha256 })), sourceSha256: hash(JSON.stringify(files)), files: files.length,
-    bytes, canonicalInputSha256: inputs.sha256, canonicalInputFiles: inputs.entries.filter(e => e.kind === "file").length,
-    canonicalInputBytes: inputs.bytes, readHashMs: readHashMs + inputs.readHashMs, durationMs: performance.now() - started,
-    ...(includeFiles ? { fileEntries: files } : {}),
-    ...(generatedFiles.length ? { unityGeneratedFiles: generatedFiles } : {}) };
-}
-function tierRoute(pipeline, risk) {
-  const tier = pipeline.contract.taskTiers?.[risk];
-  requireValue(tier, "Task risk must be FAST, STANDARD or CONTROLLED; existing tasks without a risk tier must be recreated and evidence recorded again");
-  const route = pipeline.profiles["astra-claude"].models[tier.implementationClass];
-  requireValue(route && Number.isSafeInteger(tier.maxReviewRounds) && tier.maxReviewRounds > 0, "Invalid task tier policy");
-  return { tier, route: { class: tier.implementationClass, model: route.model, effort: route.effort } };
-}
-function taskRouting(pipeline, task) {
-  const { tier, route } = tierRoute(pipeline, task.risk);
-  requireValue(task.implementationRoute && ["class", "model", "effort"].every(key => task.implementationRoute[key] === route[key]), "Task implementation route missing or changed; create a new task against the current policy");
-  const budget = task.reviewBudget;
-  requireValue(budget && Number.isSafeInteger(budget.used) && budget.used >= 0 && Number.isSafeInteger(budget.limit) && Array.isArray(budget.extensions), "Task review budget missing or invalid; create a new task and record evidence again");
-  let limit = tier.maxReviewRounds;
-  for (const extension of budget.extensions) {
-    requireValue(Number.isSafeInteger(extension.rounds) && extension.rounds > 0 && extension.rounds <= tier.maxReviewRounds && extension.reason?.trim() && Number.isFinite(Date.parse(extension.at)) && extension.previousLimit === limit && extension.newLimit === limit + extension.rounds, "Invalid review budget extension audit");
-    limit = extension.newLimit;
-  }
-  requireValue(budget.limit === limit && budget.used <= limit, "Review budget does not match its extension audit");
-  return { tier, route, budget: { used: budget.used, limit, remaining: limit - budget.used } };
-}
-function initializeUnlocked(project, id, plan, requirements = null, risk = "STANDARD") {
-  const file = taskPath(project, id);
-  requireValue(!fs.existsSync(file), `Task already exists: ${id}`);
-  const projectGates = artifact(project, ".nccgs/gates.json");
-  const projectPolicy = artifact(project, ".nccgs/project.yaml");
-  requireValue(json(verifyArtifact(project, projectGates)).policySha256 === projectPolicy.sha256, "Astra must map/review project gates against the current project.yaml hash");
-  const pipeline = loadPipeline(project);
-  const { tier, route } = tierRoute(pipeline, risk);
-  const task = { schemaVersion: 1, id, profile: "astra-claude", risk, implementationRoute: route,
-    reviewBudget: { used: 0, limit: tier.maxReviewRounds, extensions: [] },
-    createdAt: new Date().toISOString(), pipelineHash: hash(JSON.stringify(pipeline)), plan: artifact(project, plan), projectPolicy, projectGates, requirements: requirements ? artifact(project, requirements) : null, canonicalInputs: pinInputs(project), stages: {}, history: [] };
-  atomicJson(file, task);
-  return task;
-}
-function runtime(project, task, stage, expected, snap) {
-  const file = verifyArtifact(project, stage.runtime);
-  const trace = json(file);
-  requireValue(trace.schemaVersion === 1 && trace.origin === "runtime-observation", "Runtime evidence must be an observation, not configuration");
-  requireValue(trace.taskId === task.id && trace.snapshot === snap, "Runtime evidence belongs to another task/snapshot");
-  requireValue(trace.status === "completed" && trace.sessionId && trace.agentId, "Runtime observation is incomplete");
-  requireValue(Date.parse(trace.capturedAt) >= Date.parse(task.createdAt) && Date.parse(trace.capturedAt) <= Date.now(), "Runtime observation has invalid time");
-  requireValue(Date.parse(trace.capturedAt) >= Date.parse(task.canonicalInputs.pinnedAt), "Runtime observation predates current input pin; capture a fresh run");
-  const models = trace.modelsUsed?.length ? trace.modelsUsed : [trace.observedModel];
-  const matches = (model) => expected.model === "fable" ? /^claude-fable-\d[\w.-]*$/.test(model ?? "")
-    : expected.model === "sonnet" ? /^claude-sonnet-\d[\w.-]*$/.test(model ?? "") : model === expected.model;
-  requireValue(matches(trace.observedModel) && models.every(matches), "Observed model/fallback does not satisfy pipeline");
-  requireValue(trace.observedEffort === expected.effort, "Observed effort missing or mismatched; configuration is not proof");
-  requireValue(trace.observationSource, "Runtime observation requires a source artifact");
-  const source = json(verifyArtifact(project, trace.observationSource));
-  requireValue((source.observedModel ?? source.resolvedModel) === trace.observedModel && source.observedEffort === trace.observedEffort, "Observation differs from its raw model/effort source");
-  requireValue(source.taskId === task.id && source.snapshot === snap && source.sessionId === trace.sessionId && source.agentId === trace.agentId, "Observation source identity/snapshot mismatch");
-  requireValue(source.capturedAt === trace.capturedAt && source.status === trace.status, "Observation source time/status mismatch");
-  const sourceModels = source.modelsUsed?.length ? source.modelsUsed : [source.observedModel ?? source.resolvedModel];
-  requireValue(JSON.stringify(sourceModels) === JSON.stringify(models), "Observation dropped or changed source fallback history");
-  requireValue(stage.runtime.path.startsWith(".nccgs/evidence/runtime/observations/") && trace.observationSource.path.startsWith(".nccgs/evidence/runtime/sources/"), "Runtime evidence is not durable; run task migrate-evidence before closure");
-  return trace;
-}
-function reviewEvidence(project, task, stage, expected, snap, implementer, allowNegative = false) {
-  const trace = runtime(project, task, stage, expected, snap);
-  requireValue(`${trace.sessionId}/${trace.agentId}` !== implementer, "Review must be independent of implementation");
-  requireValue(Date.parse(trace.capturedAt) >= Date.parse(task.stages.implementation.recordedAt), "Review runtime predates implementation evidence");
-  requireValue(Array.isArray(stage.findings) && typeof stage.criteriaMet === "boolean", "Review requires findings and an acceptance criteria assessment");
-  requireValue(stage.verdict === "PASS" || (allowNegative && ["CHANGES_REQUIRED", "BLOCKED"].includes(stage.verdict)), "Fable review has not passed");
-  if (stage.verdict === "PASS") {
-    requireValue(!stage.findings.some(f => ["BLOCKER", "HIGH"].includes(f.severity) && f.status !== "RESOLVED"), "Review has open blocking findings");
-    requireValue(stage.criteriaMet === true, "Required acceptance criteria are not proven");
-  }
-  verifyArtifact(project, stage.evidence);
-}
-export function check(project, task, target = "done") {
-  if (task.schemaVersion === 2) return checkStandalone(project, task, target);
-  requireValue(task.schemaVersion === 1 && task.profile === "astra-claude", "Unsupported task record");
-  taskPath(project, task.id);
-  const pipeline = loadPipeline(project);
-  requireValue(task.pipelineHash === hash(JSON.stringify(pipeline)), "Pipeline policy changed; create a new task against the new policy");
-  const routing = taskRouting(pipeline, task);
-  requireValue(task.canonicalInputs?.schemaVersion === 1 && Number.isFinite(Date.parse(task.canonicalInputs.pinnedAt)), "Legacy task lacks canonical input pins; run task refresh-inputs --reason TEXT and record fresh evidence");
-  requireValue(task.canonicalInputs.sha256 === canonicalInputs(project).sha256, "Canonical inputs are stale; review the changes, run task refresh-inputs --reason TEXT, and record fresh evidence");
-  verifyArtifact(project, task.plan);
-  verifyArtifact(project, task.projectPolicy);
-  const obligations = [task.projectGates, task.requirements].filter(Boolean).map(ref => json(verifyArtifact(project, ref)));
-  requireValue(obligations.length > 0, "Project gate manifest is required");
-  for (const spec of obligations) requireValue(spec.schemaVersion === 1 && [spec.requiredChecks, spec.requiredArtifacts, spec.manualGates].every(Array.isArray), "Invalid gate manifest schema");
-  const snap = snapshot(project).sha256;
-  const end = target === "done" ? 5 : stages.indexOf(target);
-  requireValue(end >= 0, "Invalid gate target");
-  let previous = Date.parse(task.createdAt);
-  let implementer;
-  for (const name of stages.slice(0, end)) {
-    const stage = task.stages[name];
-    requireValue(stage && stage.snapshot === snap, `${name}: missing or stale for current snapshot`);
-    const at = Date.parse(stage.recordedAt);
-    requireValue(Number.isFinite(at) && at >= previous && at <= Date.now(), `${name}: invalid sequence timestamp`);
-    previous = at;
-    if (name === "implementation" || name === "review") {
-      if (name === "implementation") {
-        const trace = runtime(project, task, stage, routing.route, snap);
-        implementer = `${trace.sessionId}/${trace.agentId}`;
-        requireValue(Array.isArray(stage.checks) && stage.checks.length > 0, "Implementation requires verification evidence");
-        for (const test of stage.checks) {
-          requireValue(test.name && test.status === "PASS", "Verification contains missing/failed/unproven checks");
-          const evidenceFile = verifyArtifact(project, test.evidence);
-          if (test.evidence.path.endsWith(".json")) {
-            const evidence = json(evidenceFile);
-            if (evidence.origin === "verification-command") {
-              requireValue(evidence.taskId === task.id && evidence.name === test.name && evidence.snapshot === snap && evidence.status === "PASS" && evidence.exitCode === 0 && evidence.sourceUnchanged === true, "Recorded verification execution failed or is stale");
-              requireValue(Date.parse(evidence.startedAt) >= Date.parse(task.canonicalInputs.pinnedAt), "Verification execution predates current input pin; rerun the check");
-              verifyArtifact(project, evidence.log);
-            }
-          }
-        }
-        for (const spec of obligations) for (const name of spec.requiredChecks) requireValue(stage.checks.some(c => c.name === name && c.status === "PASS"), `Required check missing: ${name}`);
-      } else {
-        reviewEvidence(project, task, stage, pipeline.profiles[task.profile].models.review, snap, implementer);
-      }
-    } else if (name === "report") {
-      verifyArtifact(project, stage.evidence);
-      for (const spec of obligations) for (const relative of spec.requiredArtifacts) {
-        const ref = stage.artifacts?.find(item => item.path === relative);
-        requireValue(ref, `Required closure artifact missing: ${relative}`);
-        verifyArtifact(project, ref);
-      }
-    }
-    else {
-      const approval = json(verifyArtifact(project, stage.evidence));
-      const actor = name === "astra" ? "Astra" : "Product Owner";
-      const decision = name === "astra" ? "PASS" : "ACCEPTED";
-      requireValue(approval.actor === actor && approval.decision === decision, `${name}: explicit ${actor} decision required`);
-      requireValue(approval.taskId === task.id && approval.snapshot === snap, `${name}: sign-off covers a different snapshot`);
-      requireValue(approval.statement?.trim() && approval.reference?.trim(), `${name}: decision statement and source reference required`);
-      requireValue(Date.parse(approval.decidedAt) >= Date.parse(task.stages[name === "astra" ? "report" : "astra"].recordedAt) && Date.parse(approval.decidedAt) <= at, `${name}: sign-off predates its prerequisite`);
-      if (name === "acceptance") for (const spec of obligations) for (const id of spec.manualGates) requireValue(approval.gates?.some(g => g.id === id && g.decision === "ACCEPTED" && g.reference?.trim()), `Manual gate missing: ${id}`);
-    }
-  }
-  const exhausted = target === "review" && routing.budget.remaining === 0;
-  return { allowed: !exhausted, target, snapshot: snap, risk: task.risk, implementationRoute: routing.route, reviewBudget: routing.budget,
-    ...(exhausted ? { message: `Review budget exhausted (${routing.budget.used}/${routing.budget.limit}); stop and escalate. An external operator may explicitly extend-review with a reason; exhausted budget never means PASS` } : {}),
-    phase: exhausted ? "REVIEW_BUDGET_EXHAUSTED" : target === "done" ? "DONE" : `READY_FOR_${target.toUpperCase()}` };
-}
-function recordUnlocked(project, id, name, input) {
-  const existing = json(taskPath(project, id));
-  if (existing.schemaVersion === 2) return recordStandalone(project, existing, name, input);
-  requireValue(stages.includes(name), "Unknown pipeline stage");
-  if (["astra", "acceptance"].includes(name) && (process.env.CLAUDECODE || process.env.CLAUDE_CODE_ENTRYPOINT)) throw new Error("External sign-offs must be imported outside the Claude session");
-  const file = taskPath(project, id);
-  const task = json(file);
-  const status = check(project, task, name);
-  requireValue(status.allowed, status.message);
-  requireValue(input.snapshot === status.snapshot, "Submitted evidence does not cover the current snapshot");
-  if (name === "review") {
-    const pipeline = loadPipeline(project);
-    const implementation = runtime(project, task, task.stages.implementation, status.implementationRoute, status.snapshot);
-    reviewEvidence(project, task, input, pipeline.profiles[task.profile].models.review, status.snapshot, `${implementation.sessionId}/${implementation.agentId}`, true);
-    task.reviewBudget.used += 1;
-  }
-  task.history.push({ recordedAt: new Date().toISOString(), replacedFrom: name, stages: structuredClone(task.stages) });
-  for (const downstream of stages.slice(stages.indexOf(name))) delete task.stages[downstream];
-  task.stages[name] = { ...input, recordedAt: new Date().toISOString() };
-  // Failed reviews can be retained as evidence but never unlock the next stage.
-  const externalDecision = ["astra", "acceptance"].includes(name) ? json(verifyArtifact(project, input.evidence)).decision : null;
-  const negative = (name === "review" && ["CHANGES_REQUIRED", "BLOCKED"].includes(input.verdict)) || ["CHANGES_REQUIRED", "REJECTED"].includes(externalDecision);
-  if (!negative) {
-    const next = stages[stages.indexOf(name) + 1] ?? "done";
-    check(project, task, next);
-  }
-  delete task.closed;
-  atomicJson(file, task);
-  return task;
-}
-function extendReviewUnlocked(project, id, reason, rounds) {
-  const existing = json(taskPath(project, id));
-  if (existing.schemaVersion === 2) return extendStandalone(project, existing, reason, rounds);
-  requireValue(!(process.env.CLAUDECODE || process.env.CLAUDE_CODE_ENTRYPOINT), "Review budget extensions must be requested outside the Claude session");
-  requireValue(typeof reason === "string" && reason.trim(), "Review budget extension requires a reason");
-  const file = taskPath(project, id);
-  const task = json(file);
-  check(project, task, "implementation");
-  const { tier } = taskRouting(loadPipeline(project), task);
-  requireValue(Number.isSafeInteger(rounds) && rounds > 0 && rounds <= tier.maxReviewRounds, `Review budget extension requires an integer from 1 to ${tier.maxReviewRounds}`);
-  requireValue(Number.isSafeInteger(task.reviewBudget.limit + rounds), "Review budget limit is too large");
-  const extension = { at: new Date().toISOString(), reason: reason.trim(), rounds, previousLimit: task.reviewBudget.limit, newLimit: task.reviewBudget.limit + rounds };
-  task.reviewBudget.limit = extension.newLimit;
-  task.reviewBudget.extensions.push(extension);
-  task.history.push({ recordedAt: extension.at, action: "extend-review", ...extension });
-  atomicJson(file, task);
-  return task;
-}
-function closeUnlocked(project, id) {
-  const file = taskPath(project, id);
-  const task = json(file);
-  const status = check(project, task, "done");
-  task.closed = { snapshot: status.snapshot, at: new Date().toISOString() };
-  atomicJson(file, task);
-  return status;
-}
-
-function refreshInputsUnlocked(project, id, reason) {
-  const existing = json(taskPath(project, id));
-  if (existing.schemaVersion === 2) return refreshStandalone(project, existing, reason);
-  requireValue(typeof reason === "string" && reason.trim(), "Input refresh requires a reason");
-  const file = taskPath(project, id);
-  const task = json(file);
-  requireValue(task.schemaVersion === 1 && task.profile === "astra-claude", "Unsupported task record");
-  const pipeline = loadPipeline(project);
-  requireValue(task.pipelineHash === hash(JSON.stringify(pipeline)), "Input refresh cannot migrate a changed pipeline");
-  taskRouting(pipeline, task);
-  const projectPolicy = artifact(project, ".nccgs/project.yaml");
-  const projectGates = artifact(project, ".nccgs/gates.json");
-  requireValue(json(verifyArtifact(project, projectGates)).policySha256 === projectPolicy.sha256, "Project gates must be remapped to the current project.yaml hash before input refresh");
-  const plan = artifact(project, task.plan.path);
-  const requirements = task.requirements ? artifact(project, task.requirements.path) : null;
-  const pins = pinInputs(project);
-  task.history.push({ action: "refresh-inputs", recordedAt: pins.pinnedAt, reason: reason.trim(),
-    canonicalInputs: task.canonicalInputs ?? null, plan: task.plan, projectPolicy: task.projectPolicy,
-    projectGates: task.projectGates, requirements: task.requirements, stages: structuredClone(task.stages), closed: task.closed ?? null });
-  Object.assign(task, { canonicalInputs: pins, plan, projectPolicy, projectGates, requirements, stages: {} });
-  delete task.closed;
-  // Validate new mappings before committing; a failed refresh leaves the task intact.
-  check(project, task, "implementation");
-  atomicJson(file, task);
-  return task;
-}
-
-function mutate(project, id, action) {
-  const lock = acquireLock(`${taskPath(project, id)}.lock`, { taskId: id });
-  try { return action(); } finally { lock.release(); }
-}
-export const withTask = mutate;
-export const initialize = (project, id, plan, requirements = null, risk = null, options = {}) => mutate(project, id, () =>
-  resolveExecution(project).name === "standalone"
-    ? initializeStandalone(project, id, { ...options, plan, requirements, ...(risk ? { risk } : {}) })
-    : initializeUnlocked(project, id, plan, requirements, risk || "STANDARD"));
-export const record = (project, id, stage, evidence) => mutate(project, id, () => recordUnlocked(project, id, stage, evidence));
-export const extendReview = (project, id, reason, rounds) => mutate(project, id, () => extendReviewUnlocked(project, id, reason, rounds));
-export const close = (project, id) => mutate(project, id, () => closeUnlocked(project, id));
-export const refreshInputs = (project, id, reason) => mutate(project, id, () => refreshInputsUnlocked(project, id, reason));
-export const reclassify = (project, id, changes) => mutate(project, id, () => reclassifyStandalone(project, json(taskPath(project, id)), changes));
-export const exportExternal = (project, id, relative) => mutate(project, id, () => exportExternalStandalone(project, json(taskPath(project, id)), relative));
-export const importExternal = (project, id, relative) => mutate(project, id, () => importExternalStandalone(project, json(taskPath(project, id)), relative));
-export const migrateEvidence = (project, id) => mutate(project, id, () => {
-  const file = taskPath(project, id);
-  const result = migrateTaskEvidence(project, json(file));
-  if (result.changed) {
-    result.task.history.push({ action: "migrate-evidence", recordedAt: new Date().toISOString(), migrations: result.migrations });
-    atomicJson(file, result.task);
-  }
-  return { id, changed: result.changed, migrations: result.migrations };
-});

package/.claude/nccgs/tools/handoff.mjs

@@ -1,51 +0,0 @@
-import fs from "node:fs";
-import { artifact, json, verifyArtifact } from "./policy.mjs";
-import { check, record, taskPath } from "./gates.mjs";
-import { getDispatch } from "./orchestration.mjs";
-import { readReviewHandoff, validateReviewStructure } from "./review-handoff.mjs";
-
-const need = (ok, message) => { if (!ok) throw new Error(`Handoff: ${message}`); };
-
-function context(project, id, dispatchId, relative) {
-  const task = json(taskPath(project, id)), dispatch = getDispatch(project, id, dispatchId);
-  need(dispatch.contractHash === task.contractHash, "dispatch contract is stale");
-  need(dispatch.handoffPaths?.includes(relative), "file must be this dispatch's declared handoff");
-  need(["running", "completed"].includes(dispatch.status), "handoff inspection requires a running or completed dispatch");
-  const state = check(project, task, task.mode === "implement" ? "implementation" : "analysis");
-  need(state.allowed, state.message);
-  const expected = dispatch.status === "completed" ? dispatch.completedSnapshot : dispatch.kind === "implementation" ? state.snapshot : dispatch.snapshot;
-  need(state.snapshot === expected, "source snapshot is stale");
-  // A completed handoff is always read through its captured reference. A new hash
-  // cannot legitimize edits made after completion.
-  const evidence = dispatch.status === "completed"
-    ? dispatch.handoff?.artifacts?.find(ref => ref.path === relative) : artifact(project, relative);
-  need(evidence, "completed dispatch did not pin this handoff");
-  const content = fs.readFileSync(verifyArtifact(project, evidence), "utf8");
-  return { task, dispatch, snapshot: state.snapshot, evidence, content };
-}
-
-export function validateHandoff(project, id, dispatchId, relative) {
-  const ctx = context(project, id, dispatchId, relative);
-  const markers = [...ctx.content.matchAll(/^NCCGS-HANDOFF: (PARTIAL|COMPLETE)\r?$/gm)];
-  need(markers.length === 1, "exactly one PARTIAL or COMPLETE marker is required");
-  const complete = markers[0][1] === "COMPLETE";
-  if (ctx.dispatch.kind === "review") {
-    const { value } = readReviewHandoff(ctx.content, ctx.task, ctx.snapshot, false);
-    validateReviewStructure(value, ctx.task);
-  }
-  verifyArtifact(project, ctx.evidence);
-  return { status: "VALID", taskId: id, dispatchId, evidence: ctx.evidence, complete,
-    scope: "Structure only; not native completion, semantic review, verification or acceptance. No task, budget or handoff was changed." };
-}
-
-export function recordReviewHandoff(project, id, dispatchId, relative) {
-  const ctx = context(project, id, dispatchId, relative);
-  need(ctx.dispatch.kind === "review" && ctx.dispatch.status === "completed", "a completed independent review dispatch is required");
-  need(ctx.task.execution.reviewContractRequired === true, "automatic import requires the reviewer-owned contract policy; legacy records retain their workflow");
-  const { value } = readReviewHandoff(ctx.content, ctx.task, ctx.snapshot);
-  // No caller-supplied verdict, findings, conditions, runtime or snapshot. The
-  // existing record path checks independence, telemetry, criteria and budgets,
-  // appends history, and rejects reusing a dispatch. It never closes the task.
-  return record(project, id, "review", { snapshot: ctx.snapshot, dispatchId, runtime: ctx.dispatch.runtime, evidence: ctx.evidence,
-    verdict: value.verdict, criteriaMet: value.criteriaMet, findings: value.findings, conditions: value.conditions });
-}

package/.claude/nccgs/tools/hook-transport.mjs

@@ -1,34 +0,0 @@
-// Exact managed-hook identity across legacy shell and direct-executable forms.
-// Never identify a hook by the executable alone: many custom hooks use node.
-const scriptPattern = /^(?:\$\{CLAUDE_PROJECT_DIR\}\/)?(\.claude\/nccgs\/hooks\/[\w-]+\.mjs)$/;
-const phases = new Set(['pre', 'stop', 'start', 'failure']);
-
-export function managedHookKey(hook) {
-  if (!hook || hook.type !== 'command' || typeof hook.command !== 'string') return null;
-  let script, args;
-  if (Object.hasOwn(hook, 'args')) {
-    if (hook.command !== 'node' || !Array.isArray(hook.args) || !hook.args.every(x => typeof x === 'string')) return null;
-    [script, ...args] = hook.args;
-  } else {
-    const match = hook.command.match(/^node (?:"([^"\r\n]+)"|([^\s"'`$;&|<>]+))(?: (pre|stop|start|failure))?$/);
-    if (!match) return null;
-    script = match[1] ?? match[2];
-    args = match[3] ? [match[3]] : [];
-  }
-  const relative = typeof script === 'string' ? script.match(scriptPattern)?.[1] : null;
-  if (!relative || args.length > 1 || args.some(x => !phases.has(x))) return null;
-  return JSON.stringify([relative, ...args]);
-}
-
-export function requiredHookPresent(actual, expected) {
-  return actual && actual.type === expected.type && actual.command === expected.command
-    && JSON.stringify(actual.args) === JSON.stringify(expected.args)
-    && actual.onFailure === expected.onFailure
-    && actual.if === undefined && actual.once !== true && actual.async !== true
-    && (actual.timeout === undefined || actual.timeout >= expected.timeout);
-}
-
-export function referencesNccgsHook(hook) {
-  return [hook?.command, ...(Array.isArray(hook?.args) ? hook.args : [])]
-    .some(x => typeof x === 'string' && /(?:^|[\\/])\.claude[\\/]nccgs[\\/]/i.test(x));
-}

package/.claude/nccgs/tools/inputs.mjs

@@ -1,108 +0,0 @@
-import fs from "node:fs";
-import { performance } from "node:perf_hooks";
-import { contained, json, hash } from "./policy.mjs";
-
-export const inputManifest = ".nccgs/inputs.json";
-export function inputPolicy(project) {
-  const file = contained(project, inputManifest);
-  const policy = fs.existsSync(file) ? json(file) : { schemaVersion: 1, canonicalInputs: [], outputDirectories: [], checks: {} };
-  if (policy.schemaVersion !== 1 || !Array.isArray(policy.canonicalInputs) || !Array.isArray(policy.outputDirectories)
-      || !policy.checks || typeof policy.checks !== "object" || Array.isArray(policy.checks)) throw new Error("Invalid .nccgs/inputs.json schema");
-  for (const key of Object.keys(policy)) if (!["schemaVersion", "canonicalInputs", "outputDirectories", "checks", "unityGeneratedFiles"].includes(key)) throw new Error(`Unknown input manifest field: ${key}`);
-  const generated = policy.unityGeneratedFiles === undefined ? [] : policy.unityGeneratedFiles;
-  if (!Array.isArray(generated) || generated.length > 256) throw new Error("unityGeneratedFiles must be an array of at most 256 exact file paths");
-  const seenGenerated = new Set();
-  for (const relative of generated) {
-    const file = contained(project, relative);
-    // Opt-in derived metadata only. Never ignore whole directories, wildcards,
-    // nested tool projects, source, assets, packages or project settings.
-    if (!/^[^/]+\.(?:csproj|sln|slnx)$/.test(relative)
-        && !/^\.vscode\/(?:extensions|launch|settings)\.json$/.test(relative)
-        && !/^UserSettings\/(?:EditorUserSettings\.asset|Search\.settings)$/.test(relative)) {
-      throw new Error(`Unsupported Unity generated file: ${relative}`);
-    }
-    const key = relative.toLowerCase();
-    if (seenGenerated.has(key)) throw new Error(`Duplicate Unity generated file: ${relative}`);
-    seenGenerated.add(key);
-    if (fs.existsSync(file) && !fs.statSync(file).isFile()) throw new Error(`Unity generated path is not a file: ${relative}`);
-    for (const input of policy.canonicalInputs) if (overlaps(input, relative)) throw new Error(`Canonical input/generated file overlap: ${input} and ${relative}`);
-  }
-  if (generated.length) {
-    const version = contained(project, "ProjectSettings/ProjectVersion.txt");
-    if (!fs.existsSync(version) || !/^m_EditorVersion: \d+\.\d+\.\d+[abfp]\d+\s*$/m.test(fs.readFileSync(version, "utf8"))
-        || !fs.existsSync(contained(project, "Packages/manifest.json")) || !fs.statSync(contained(project, "Assets")).isDirectory()) {
-      throw new Error("unityGeneratedFiles requires a Unity project (Assets, Packages/manifest.json, ProjectSettings/ProjectVersion.txt)");
-    }
-  }
-  for (const relative of [...policy.canonicalInputs, ...policy.outputDirectories]) contained(project, relative);
-  for (const relative of policy.outputDirectories) {
-    // Keep source roots in the snapshot. Unity build destinations must be deliberately
-    // placed below these dedicated roots; arbitrary ignore globs are not supported.
-    if (!/^(Build|Builds)\/[A-Za-z0-9_-][A-Za-z0-9_./ -]*$/.test(relative)) throw new Error("Output directories must be explicit subdirectories of Build/ or Builds/");
-    const file = contained(project, relative);
-    if (fs.existsSync(file) && !fs.statSync(file).isDirectory()) throw new Error(`Output path is not a directory: ${relative}`);
-    for (const input of policy.canonicalInputs) if (overlaps(input, relative)) throw new Error(`Canonical input/output overlap: ${input} and ${relative}`);
-  }
-  for (const relative of policy.canonicalInputs) {
-    if (relative.toLowerCase() === ".nccgs" || /^\.nccgs\/(evidence|runtime|tasks|backups|closures)(\/|$)/i.test(relative)) throw new Error(`Generated state cannot be a canonical input: ${relative}`);
-  }
-  for (const [name, config] of Object.entries(policy.checks)) {
-    if (!name.trim() || !config || typeof config !== "object" || Array.isArray(config)
-        || Object.keys(config).some(key => key !== "timeoutMs") || !Number.isSafeInteger(config.timeoutMs)
-        || config.timeoutMs < 100 || config.timeoutMs > 7200000) throw new Error(`Check ${name}: timeoutMs must be an integer from 100 to 7200000`);
-  }
-  return policy;
-}
-function overlaps(a, b) {
-  a = a.toLowerCase(); b = b.toLowerCase();
-  return a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);
-}
-export function isOutput(relative, policy) {
-  const normalize = name => process.platform === "win32" ? name.toLowerCase() : name;
-  return policy.outputDirectories.some(dir => normalize(relative) === normalize(dir) || normalize(relative).startsWith(`${normalize(dir)}/`));
-}
-export function isUnityGenerated(relative, policy) {
-  const normalize = name => process.platform === "win32" ? name.toLowerCase() : name;
-  return (policy.unityGeneratedFiles ?? []).some(file => normalize(relative) === normalize(file));
-}
-export function unityGeneratedState(project, policy) {
-  return (policy.unityGeneratedFiles ?? []).map(relative => {
-    const file = contained(project, relative);
-    return { path: relative, sha256: fs.existsSync(file) ? hash(fs.readFileSync(file)) : null };
-  }).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
-}
-export function canonicalInputs(project, policy = inputPolicy(project)) {
-  const entries = new Map();
-  let bytes = 0, readHashMs = 0;
-  function capture(relative, optional = false) {
-    if (entries.has(relative)) return;
-    const file = contained(project, relative);
-    if (!fs.existsSync(file)) {
-      if (!optional) throw new Error(`Canonical input missing: ${relative}`);
-      entries.set(relative, { path: relative, kind: "missing" });
-      return;
-    }
-    const stat = fs.statSync(file);
-    if (stat.isDirectory()) {
-      entries.set(relative, { path: relative, kind: "directory" });
-      for (const name of fs.readdirSync(file).sort()) capture(`${relative}/${name}`);
-    } else if (stat.isFile()) {
-      const start = performance.now();
-      const data = fs.readFileSync(file);
-      entries.set(relative, { path: relative, sha256: hash(data), kind: "file" });
-      readHashMs += performance.now() - start;
-      bytes += data.length;
-    } else throw new Error(`Unsupported canonical input: ${relative}`);
-  }
-  capture(inputManifest, true);
-  capture(".nccgs/requirements.yaml", true);
-  capture(".nccgs/autonomy.json", true);
-  capture(".nccgs/decisions", true);
-  for (const relative of policy.canonicalInputs) capture(relative);
-  const files = [...entries.values()].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
-  return { schemaVersion: 1, sha256: hash(JSON.stringify(files)), entries: files, bytes, readHashMs };
-}
-export function pinInputs(project) {
-  const { schemaVersion, sha256, entries } = canonicalInputs(project);
-  return { schemaVersion, sha256, entries, pinnedAt: new Date().toISOString() };
-}