ultra-builder-pro-cli 0.10.0 → 0.12.1

package/mcp-server/tests/state-db.test.cjs

@@ -8,7 +8,7 @@ const path = require('node:path');
 
 const stateDb = require('../lib/state-db.cjs');
 
-test('initStateDb upgrades a pre-10.0 database in place with Context Spine state', () => {
+test('initStateDb upgrades a pre-10.0 database through Context Spine into baseline authority', () => {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ubp-db-upgrade-'));
   const file = path.join(dir, 'state.db');
   try {
@@ -59,7 +59,7 @@ test('initStateDb upgrades a pre-10.0 database in place with Context Spine state
     assert.ok(columns.includes('change_id'));
     const eventColumns = upgraded.db.prepare('PRAGMA table_info(events)').all().map((row) => row.name);
     assert.ok(eventColumns.includes('change_id'));
-    assert.equal(upgraded.schema_version, '10.0');
+    assert.equal(upgraded.schema_version, '11.0');
     assert.ok(upgraded.db.prepare("SELECT 1 FROM schema_version WHERE version = '10.0'").get());
     const contextColumns = upgraded.db.prepare('PRAGMA table_info(context_snapshots)').all()
       .map((row) => row.name);
@@ -69,12 +69,21 @@ test('initStateDb upgrades a pre-10.0 database in place with Context Spine state
     assert.ok(upgraded.db.prepare(
       "SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'spec_learning_candidates'",
     ).get());
+    const baseline = upgraded.db.prepare(
+      "SELECT mode, status FROM baselines WHERE id = 'migrated-baseline'",
+    ).get();
+    assert.deepEqual(baseline, { mode: 'migrated', status: 'ready' });
     const contextMigration = upgraded.db.prepare(
       "SELECT from_version, to_version, notes FROM migration_history WHERE to_version = '10.0' ORDER BY id DESC LIMIT 1",
     ).get();
     assert.equal(contextMigration.from_version, '9.1');
     assert.equal(contextMigration.to_version, '10.0');
     assert.match(contextMigration.notes, /Context Spine/);
+    const baselineMigration = upgraded.db.prepare(
+      "SELECT from_version, to_version, notes FROM migration_history WHERE to_version = '11.0' ORDER BY id DESC LIMIT 1",
+    ).get();
+    assert.equal(baselineMigration.from_version, '10.0');
+    assert.match(baselineMigration.notes, /baseline adoption/i);
     assert.ok(upgraded.db.prepare(
       "SELECT 1 FROM migration_history WHERE from_version = '8A.1' AND to_version = '9.1' AND notes LIKE '%Kimi%'",
     ).get());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra-builder-pro-cli",
-  "version": "0.10.0",
+  "version": "0.12.1",
   "description": "Multi-runtime installer for the Ultra Builder Pro agent engineering system — deploys commands, agents, skills, hooks, and MCP server to Claude Code, OpenCode, Codex CLI, and Kimi Code.",
   "bin": {
     "ultra-builder-pro-cli": "bin/install.js",
@@ -50,6 +50,7 @@
     "docs/ROADMAP.md",
     "docs/ARCHITECTURE.md",
     "docs/AGENT-CONTEXT.md",
+    "docs/SKILL-AUTHORING.md",
     "docs/COMMIT-HASH-BACKFILL.md",
     "docs/PLAN.zh-CN.md",
     "docs/STATE-DB-ACCESS-POLICY.md",
@@ -87,7 +88,7 @@
     "test:state": "node --test 'mcp-server/**/*.test.cjs'",
     "test:orch": "node --test 'orchestrator/**/*.test.cjs'",
     "test:spec": "node spec/scripts/test-all.cjs",
-    "test:rest": "node --test adapters/_shared/tests/*.test.cjs adapters/tests/*.test.cjs ultra-tools/*.test.cjs tests/conformance/**/*.test.cjs tests/install.test.cjs tests/package-smoke.test.cjs tests/retired-runtime.test.cjs",
+    "test:rest": "node --test adapters/_shared/tests/*.test.cjs adapters/tests/*.test.cjs ultra-tools/*.test.cjs tests/conformance/**/*.test.cjs tests/*.test.cjs",
     "test:all": "npm run test:state && npm run test:orch && npm run test:spec && npm run test:rest",
     "test:hooks": "pytest hooks/tests -q",
     "verify:release": "npm run test:all && npm run test:hooks && npm audit --omit=dev --audit-level=high",

package/skills/cc-collab/SKILL.md

@@ -1,26 +1,23 @@
 ---
 name: cc-collab
-description: "Use Claude Code as an explicitly requested, read-only advisor for bounded architecture, diagnosis, or review questions. The current host remains primary and verifies all claims."
-argument-hint: "review|understand|opinion|compare|free [target]"
-user-invocable: true
+description: Ask Claude Code for an independent read-only analysis of a bounded architecture, diagnosis, or review question. Use only when the user explicitly requests Claude Code or CC collaboration and the current host remains primary.
 ---
 
-# Claude Code Collaboration
+# Consult Claude Code read-only
 
-Use Claude Code only when the user explicitly requests a Claude/CC perspective. The current host
-owns scope, evidence, decisions, edits, and final verification. Claude Code is an untrusted,
-read-only advisor.
+Treat Claude Code as an untrusted advisor. The current host owns scope, evidence,
+decisions, edits, and final verification.
 
 ## Preconditions
 
-1. Confirm `claude --version` and authentication.
-2. Bound the workspace, files or diff, question, and expected response shape.
-3. Write the primary host's independent analysis first when independence matters.
-4. Do not pass credentials, unrelated files, or an unbounded home directory.
+1. Confirm the `claude` CLI and authentication.
+2. Bound the workspace, files or diff, question, evidence standard, and response shape.
+3. Write the primary host's analysis first when independence matters.
+4. Exclude credentials, unrelated files, and unbounded home-directory access.
 
 ## Invocation
 
-Run Claude Code without mutation or session persistence:
+Run without mutation or session persistence:
 
 ```bash
 claude --safe-mode -p "<bounded prompt>" \
@@ -30,12 +27,13 @@ claude --safe-mode -p "<bounded prompt>" \
   --no-session-persistence
 ```
 
-Store large output under `.ultra/collab/<session-id>/claude-output.md`. A missing CLI, failed auth,
-timeout, or empty response degrades to host-only analysis; it never blocks the task.
+Store large output under `.ultra/collab/<session-id>/claude-output.md`. A missing CLI,
+failed authentication, timeout, or empty response degrades to host-only analysis and
+never blocks the underlying task.
 
 ## Synthesis
 
-- Verify consequential claims against the current checkout, runtime, tests, or primary docs.
-- Separate agreement, useful dissent, and unsupported assertions.
-- Explain scope or version mismatches before comparing conclusions.
-- Return one host-owned conclusion, not a transcript or a model vote.
+Verify consequential claims against the current checkout, runtime, tests, or primary
+documentation. Separate verified agreement, useful dissent, and unsupported claims.
+Explain scope or version differences and return one host-owned conclusion rather than
+a transcript or model vote.

package/skills/code-review-expert/SKILL.md

@@ -1,118 +1,43 @@
 ---
 name: code-review-expert
-description: "Structured code review checklists: SOLID, security, performance, boundary conditions, removal planning. Injected into code-reviewer agent."
-user-invocable: false
+description: Review a bounded diff for consequential correctness, security, integration, and maintainability defects with evidence and precise locations. Use only when assigned to an Ultra review worker or an explicitly requested read-only code review.
 ---
 
-# Code Review Expert Checklists
-
-Provides structured review workflow and reference checklists for the code-reviewer agent.
-
-## Severity Levels
-
-| Level | Name | Description | Action |
-|-------|------|-------------|--------|
-| **P0** | Critical | Security vulnerability, data loss risk, correctness bug | Must block merge |
-| **P1** | High | Logic error, significant SOLID violation, performance regression | Should fix before merge |
-| **P2** | Medium | Code smell, maintainability concern, minor SOLID violation | Fix in this PR or create follow-up |
-| **P3** | Low | Style, naming, minor suggestion | Optional improvement |
-
-## Review Workflow
-
-### Step 1: Preflight Context
-
-- Run `git status -sb`, `git diff --stat`, and `git diff` to scope changes
-- Use `git diff --cached` to include staged changes
-- If needed, use Grep to find related modules, usages, and contracts
-
-**Edge cases:**
-- **No changes**: Inform user, ask if they want to review staged changes or a specific commit range
-- **Large diff (>500 lines)**: Summarize by file first, then review in batches by module/feature area
-- **Mixed concerns**: Group findings by logical feature, not just file order
-
-### Step 2: SOLID + Architecture Smells
-
-Load `references/solid-checklist.md` for detailed prompts.
-
-Look for SRP/OCP/LSP/ISP/DIP violations and common code smells. When proposing refactor, explain *why* it improves cohesion/coupling. Non-trivial refactors get incremental plans, not large rewrites.
-
-### Step 3: Removal Candidates
-
-Load `references/removal-plan.md` for template.
-
-Identify unused, redundant, or feature-flagged-off code. Distinguish **safe delete now** vs **defer with plan**. Provide follow-up steps with concrete checkpoints.
-
-### Step 4: Security and Reliability
-
-Load `references/security-checklist.md` for coverage.
-
-Check injection, auth gaps, secrets, race conditions, crypto, supply chain. Call out both **exploitability** and **impact**.
-
-### Step 5: Code Quality
-
-Load `references/code-quality-checklist.md` for coverage.
-
-Check error handling, performance/caching, boundary conditions. Flag issues that may cause silent failures or production incidents.
-
-### Step 5.5: Integration & Connectivity
-
-Load `references/integration-checklist.md` for detailed prompts.
-
-Check entry point tracing, contract validation, vertical slice assessment, integration test coverage, and data flow continuity. Flag orphan code, missing contracts, and horizontal-only changes.
-
-### Step 6: Output Format
-
-```markdown
-## Code Review Summary
-
-**Files reviewed**: X files, Y lines changed
-**Overall assessment**: [APPROVE / REQUEST_CHANGES / COMMENT]
-
----
-
-## Findings
-
-### P0 - Critical
-(none or list)
-
-### P1 - High
-- **[file:line]** Brief title
-  - Description of issue
-  - Suggested fix
-
-### P2 - Medium
-...
-
-### P3 - Low
-...
-
----
-
-## Removal/Iteration Plan
-(if applicable)
-
-## Additional Suggestions
-(optional improvements, not blocking)
-```
-
-### Step 7: Next Steps Confirmation
-
-After presenting findings, ask how to proceed:
-
-1. **Fix all** - Implement all suggested fixes
-2. **Fix P0/P1 only** - Address critical and high priority issues
-3. **Fix specific items** - User specifies which issues to fix
-4. **No changes** - Review complete, no implementation needed
-
-**Important**: Do NOT implement any changes until user explicitly confirms.
-
-## Additional Resources
-
-### Reference Files
-
-For detailed patterns and checklists, consult:
-- **`references/solid-checklist.md`** - SOLID violation detection and refactor heuristics
-- **`references/security-checklist.md`** - Security, reliability, and race condition checks
-- **`references/code-quality-checklist.md`** - Error handling, performance, boundary conditions
-- **`references/removal-plan.md`** - Deletion candidates and iteration planning template
-- **`references/integration-checklist.md`** - Entry point tracing, contract validation, data flow continuity
+# Review a bounded code change
+
+Prioritize defects that can change behavior, safety, operability, or delivery. Do not
+fill the report with style preferences or generic best-practice commentary.
+
+## Workflow
+
+1. Establish the exact diff, stated intent, acceptance evidence, current checkout, and
+   relevant repository guidance. If the scope is empty or ambiguous, report that
+   boundary instead of reviewing unrelated history.
+2. Trace changed behavior from a live entry point through state and side effects to a
+   consumer. Read callers, contracts, tests, and error paths needed to prove or refute
+   a finding.
+3. Load focused references only when their scope is present:
+   - `security-rules` for trust or authorization boundaries;
+   - `integration-rules` for cross-component behavior;
+   - `references/correctness-reliability.md` for a concrete behavioral risk;
+   - `references/design-boundaries.md` for a concrete ownership or coupling problem;
+   - `references/removal-plan.md` for code proposed for deletion.
+4. For every candidate finding, state the violated contract, triggering condition,
+   user or system impact, and evidence in the current source. Discard speculative
+   concerns that lack a plausible execution path.
+5. Assign severity from impact and likelihood:
+   - P0: exploitable security issue, data loss, or deterministic critical failure;
+   - P1: material correctness, authorization, reliability, or delivery failure;
+   - P2: bounded maintainability or edge-case defect with concrete future cost;
+   - P3: optional improvement that does not block the accepted outcome.
+6. Deduplicate findings by root cause and order them by severity, path, and line.
+
+## Finding contract
+
+Each finding includes a concise title, severity, tight file and line range,
+trigger, impact, evidence, and smallest complete remediation. Do not request a broad
+rewrite when a local fix satisfies the contract.
+
+If no actionable defect is supported, say so and name the remaining verification or
+coverage gap. Review is read-only unless a separate implementation request explicitly
+authorizes changes.

package/skills/code-review-expert/references/correctness-reliability.md

@@ -0,0 +1,30 @@
+# Correctness and reliability evidence
+
+Read this reference only when the diff changes behavior, state transitions, resource
+use, concurrency, caching, parsing, or failure handling.
+
+## Establish the contract
+
+Identify the input domain, preconditions, observable result, authoritative state, and
+caller-visible failure behavior. Repository code, tests, schemas, runtime configuration,
+and accepted specifications outrank generic conventions.
+
+## Trace material risks
+
+Inspect only risks supported by the changed path:
+
+- boundary values, empty or optional inputs, numeric range, encoding, and ordering;
+- partial writes, lost updates, duplicate execution, retry, idempotency, and rollback;
+- stale caches, key scope, invalidation, and cross-user or cross-tenant isolation;
+- unbounded work, repeated I/O, resource lifetime, timeout, and cancellation;
+- swallowed failures, false success, ambiguous fallback, and missing recovery signals;
+- deployment-time compatibility between readers, writers, clients, and stored data.
+
+A surface pattern is not a finding. Confirm the triggering condition, follow it to an
+observable impact, and check whether a guard or recovery path exists elsewhere.
+
+## Report
+
+State the violated contract, trigger, impact, current source evidence, and smallest
+complete remediation. If scale or concurrency is required to trigger the issue, name
+the evidence-backed operating condition instead of inventing a multiplier.

package/skills/code-review-expert/references/design-boundaries.md

@@ -0,0 +1,26 @@
+# Design boundary evidence
+
+Read this reference only when the diff changes ownership, invariants, public contracts,
+module boundaries, or a recurring variation point.
+
+## Questions grounded in the live path
+
+- Which module owns the invariant and can callers bypass it?
+- Does one authoritative representation exist, or can state diverge across layers?
+- Is the dependency direction compatible with the repository's established boundary?
+- Does a public contract expose implementation details that block a required consumer?
+- Does the change duplicate a domain rule or scatter one accepted change across
+  unrelated owners?
+- Is an abstraction justified by current callers and variants, or only hypothetical
+  future work?
+- Can the behavior be tested and recovered at its public seam?
+
+File size, method length, inheritance, primitive values, data-only types, and branch
+counts are investigation signals. Report them only when they produce a concrete
+correctness, compatibility, testing, recovery, or maintenance cost in this change.
+
+## Remediation
+
+Prefer the smallest boundary correction that restores ownership and the accepted
+contract. Do not prescribe a design pattern, framework, or broad rewrite without
+showing why the existing repository structure cannot satisfy the requirement.

package/skills/code-review-expert/references/removal-plan.md

@@ -1,52 +1,24 @@
-# Removal and Iteration Plan Template
+# Removal evidence
 
-## Priority Levels
+Read this reference only when the proposed change deletes or retires code, a contract,
+configuration, data, or a dependency.
 
-- **P0**: Immediate removal needed (security risk, significant cost, blocking other work)
-- **P1**: Remove in current sprint
-- **P2**: Backlog / next iteration
+## Prove reachability and ownership
 
----
+Search static references, registrations, dynamic loading, reflection, generated code,
+configuration, feature flags, scripts, documentation, and external interfaces that may
+consume the item. Distinguish no evidence of use from evidence of no use.
 
-## Safe to Remove Now
+## Determine the safe action
 
-### Item: [Name/Description]
+Record:
 
-| Field | Details |
-|-------|---------|
-| **Location** | `path/to/file.ts:line` |
-| **Rationale** | Why this should be removed |
-| **Evidence** | Unused (no references), dead feature flag, deprecated API |
-| **Impact** | None / Low - no active consumers |
-| **Deletion steps** | 1. Remove code 2. Remove tests 3. Remove config |
-| **Verification** | Run tests, check no runtime errors, monitor logs |
+- exact item and owner;
+- current consumers and supporting evidence;
+- compatibility, data, deployment, and operator impact;
+- prerequisites for removal when a consumer or migration remains;
+- focused deletion steps, verification, monitoring, and rollback.
 
----
-
-## Defer Removal (Plan Required)
-
-### Item: [Name/Description]
-
-| Field | Details |
-|-------|---------|
-| **Location** | `path/to/file.ts:line` |
-| **Why defer** | Active consumers, needs migration, stakeholder sign-off |
-| **Preconditions** | Feature flag off for 2 weeks, telemetry shows 0 usage |
-| **Breaking changes** | List any API/contract changes |
-| **Migration plan** | Steps for consumers to migrate |
-| **Timeline** | Target date or sprint |
-| **Owner** | Person/team responsible |
-| **Validation** | Metrics to confirm safe removal (error rates, usage counts) |
-| **Rollback plan** | How to restore if issues found |
-
----
-
-## Checklist Before Removal
-
-- [ ] Searched codebase for all references (Grep)
-- [ ] Checked for dynamic/reflection-based usage
-- [ ] Verified no external consumers (APIs, SDKs, docs)
-- [ ] Feature flag telemetry reviewed (if applicable)
-- [ ] Tests updated/removed
-- [ ] Documentation updated
-- [ ] Team notified (if shared code)
+Do not assign urgency from age, naming, or deprecation text alone. Severity follows the
+cost of retaining an actual hazard or deleting a reachable contract. When evidence is
+incomplete, report the missing proof instead of declaring the item safe to remove.

package/skills/codex-collab/SKILL.md

@@ -1,52 +1,47 @@
 ---
 name: codex-collab
-description: Ask Codex CLI for an explicitly requested, read-only second opinion on a bounded review, diagnosis, architecture, or comparison question.
+description: Ask Codex CLI for an independent read-only analysis of a bounded architecture, diagnosis, or review question. Use only when the user explicitly requests Codex collaboration and the current host remains primary.
 ---
 
-# Codex Collaboration
+# Consult Codex read-only
 
-Claude Code remains primary and owns scope, evidence, edits, verification, and the final answer.
-Codex is an untrusted read-only advisor. Use this skill only when the user explicitly requests a
-Codex perspective; do not invoke it as a routine substitute for native review or subagents.
+Treat Codex as an untrusted advisor. The current host owns scope, evidence, edits,
+verification, and the final answer.
 
 ## Preconditions
 
-1. Confirm `codex --version` and authentication.
-2. Fix the workspace, files or diff range, question, evidence standard, and expected response shape.
+1. Confirm the `codex` CLI and authentication.
+2. Bound the workspace, files or diff, question, evidence standard, and response shape.
 3. Write the primary analysis first when independence matters.
-4. Never send secrets, unrelated files, or an unbounded home directory.
+4. Exclude secrets, unrelated files, and unbounded home-directory access.
 
-## Modes
+## Invocation
 
-- `review`: findings against an exact diff or file set.
-- `understand`: a bounded architecture or flow question.
-- `opinion`: one decision with named constraints and alternatives.
-- `compare`: independent answers to the same question.
-- `free`: another tightly scoped read-only prompt.
-
-## Safe invocation
-
-Create a session directory under `.ultra/collab/`, then run Codex without workspace-write or
-danger-full-access:
+Create a session directory under `.ultra/collab/`, then run in a read-only sandbox:
 
 ```bash
-SESSION_PATH=".ultra/collab/$(date +%Y%m%d-%H%M%S)-codex-<mode>"
+SESSION_PATH=".ultra/collab/$(date +%Y%m%d-%H%M%S)-codex"
 mkdir -p "${SESSION_PATH}"
 codex exec -s read-only \
+  -a never \
+  --ephemeral \
+  --ignore-user-config \
+  --ignore-rules \
   -o "${SESSION_PATH}/codex-output.md" \
   "<bounded prompt>" \
   2> "${SESSION_PATH}/codex-error.log"
 ```
 
-Do not enable write-capable automation or permission bypass. This skill has no dependency on
-another Codex plugin or slash command.
+Do not enable write-capable automation or permission bypass. The isolation flags keep
+the advisory run independent from the user's Codex runtime configuration and rules;
+the normal Codex authentication store remains available.
 
 ## Synthesis
 
-1. Read the output only after the process exits and the file is non-empty.
-2. Verify consequential claims against the current checkout, tests, runtime, or primary docs.
-3. Separate agreement, useful dissent, and unsupported assertions.
-4. Return one Claude Code-owned conclusion; do not paste an unreviewed advisor transcript.
+Read output only after the process exits and the file is non-empty. Verify
+consequential claims against the current checkout, runtime, tests, or primary
+documentation. Separate verified agreement, useful dissent, and unsupported claims,
+then return one host-owned conclusion.
 
-If Codex is missing, unauthenticated, times out, or returns empty output, report the degraded path
-and continue with primary evidence. Never block the user's task solely on advisor failure.
+If Codex is unavailable, unauthenticated, times out, or returns empty output, report
+the degraded path and continue with primary evidence.

package/skills/codex-collab/evals/evals.json

@@ -2,38 +2,33 @@
   "skill_name": "codex-collab",
   "evals": [
     {
-      "id": 1,
-      "prompt": "/codex-collab review",
-      "expected_output": "Claude delegates to /codex:review (official plugin), then adds its own perspective and presents a dual-AI synthesis report",
+      "id": "explicit-review",
+      "prompt": "Ask Codex for an independent read-only review of the current diff, then verify its findings yourself.",
+      "should_trigger": true,
       "assertions": [
-        "Delegates to /codex:review instead of invoking codex CLI directly",
-        "Does NOT run 'codex review --uncommitted' directly",
-        "After receiving Codex output, Claude adds its own review perspective",
-        "Presents a synthesis with Consensus and Divergent Views sections"
+        "Bounds the repository and exact diff before launch",
+        "Runs codex exec with a read-only sandbox and file output",
+        "Treats Codex output as untrusted advisory evidence",
+        "Returns one primary-host conclusion after source verification"
       ]
     },
     {
-      "id": 2,
-      "prompt": "/codex-collab opinion 'Should we use a monorepo or polyrepo?'",
-      "expected_output": "Claude sends the question to Codex via exec mode with sandbox, reads output, and presents both opinions",
+      "id": "explicit-decision",
+      "prompt": "Have Codex independently assess whether this service should stay in the monorepo. Do not tell it our current preference.",
+      "should_trigger": true,
       "assertions": [
-        "Uses 'codex exec' (not codex review) for opinion mode",
-        "Uses --sandbox read-only for analysis-only task",
-        "Uses -o (--output-last-message) to capture clean output",
-        "Does NOT reveal Claude's position in the prompt",
-        "Creates session directory under .ultra/collab/",
-        "Presents both opinions with trade-off analysis"
+        "Writes the primary analysis first when independence matters",
+        "Does not prime Codex with the primary conclusion",
+        "Explains evidence or assumption differences before synthesis"
       ]
     },
     {
-      "id": 3,
-      "prompt": "/codex-collab review --base main with a focus on security",
-      "expected_output": "Claude delegates to /codex:adversarial-review for security-focused review, then synthesizes",
+      "id": "ordinary-review-negative",
+      "prompt": "Review the current diff for correctness and security issues.",
+      "should_trigger": false,
       "assertions": [
-        "Delegates to /codex:review or /codex:adversarial-review (official plugin)",
-        "Does NOT invoke codex CLI directly for review tasks",
-        "After receiving output, presents dual-AI synthesis",
-        "Reads output with Read tool, not Bash stdout"
+        "Uses the host's ordinary review workflow",
+        "Does not launch Codex without an explicit user request"
       ]
     }
   ]