ultra-builder-pro-cli 0.11.0 → 0.13.0

package/mcp-server/lib/state-db.cjs

@@ -9,10 +9,23 @@ const REPO_ROOT = process.env.UBP_RUNTIME_ROOT
   ? path.resolve(process.env.UBP_RUNTIME_ROOT)
   : path.resolve(__dirname, '..', '..');
 const SCHEMA_FILE = path.join(REPO_ROOT, 'spec', 'schemas', 'state-db.sql');
-const EXPECTED_VERSION = '10.0';
+const EXPECTED_VERSION = '12.0';
 const KIMI_SCHEMA_VERSION = '9.1';
+const CONTEXT_SCHEMA_VERSION = '10.0';
+const BASELINE_SCHEMA_VERSION = '11.0';
+
+const MIGRATED_GAPS = Object.freeze([{
+  id: 'legacy-rebaseline-required',
+  category: 'baseline_blocker',
+  status: 'open',
+  blocking: true,
+  summary: 'Legacy Ultra state requires evidence-backed brownfield re-adoption.',
+  evidence_refs: [],
+  owner: null,
+}]);
 
 const REQUIRED_TABLES = Object.freeze([
+  'baselines',
   'tasks',
   'events',
   'sessions',
@@ -31,6 +44,105 @@ const REQUIRED_TABLES = Object.freeze([
   'event_consumers',
 ]);
 
+function applyBaselineUpgrade(db, { legacyState = false } = {}) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS baselines (
+      id                  TEXT PRIMARY KEY,
+      project_name        TEXT NOT NULL,
+      project_type        TEXT,
+      stack               TEXT,
+      mode                TEXT NOT NULL CHECK (mode IN ('greenfield', 'brownfield', 'migrated')),
+      status              TEXT NOT NULL DEFAULT 'draft'
+                              CHECK (status IN ('draft', 'adopting', 'blocked', 'ready', 'superseded')),
+      repository_root     TEXT NOT NULL DEFAULT '.',
+      scope_json          TEXT NOT NULL DEFAULT '["."]',
+      repository_revision TEXT,
+      repository_branch   TEXT,
+      worktree_state      TEXT NOT NULL DEFAULT 'unavailable'
+                              CHECK (worktree_state IN ('clean', 'dirty', 'unavailable')),
+      worktree_digest     TEXT,
+      worktree_files_json TEXT NOT NULL DEFAULT '[]',
+      worktree_accepted   INTEGER NOT NULL DEFAULT 0 CHECK (worktree_accepted IN (0, 1)),
+      spec_refs_json      TEXT NOT NULL DEFAULT '[]',
+      evidence_json       TEXT NOT NULL DEFAULT '[]',
+      verification_json   TEXT NOT NULL DEFAULT '[]',
+      unknowns_json       TEXT NOT NULL DEFAULT '[]',
+      gaps_json           TEXT NOT NULL DEFAULT '[]',
+      classification_json TEXT NOT NULL DEFAULT '{}',
+      provider_refs_json  TEXT NOT NULL DEFAULT '{}',
+      approved_by         TEXT,
+      approval_note       TEXT,
+      started_at          TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+      updated_at          TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+      converged_at        TEXT
+    );
+    CREATE INDEX IF NOT EXISTS baselines_status ON baselines(status, updated_at);
+  `);
+  if (legacyState && db.prepare('SELECT COUNT(*) AS count FROM baselines').get().count === 0) {
+    db.prepare(
+      `INSERT OR IGNORE INTO baselines
+       (id, project_name, mode, status, gaps_json, approval_note)
+       VALUES ('migrated-baseline', 'Migrated Ultra project', 'migrated', 'adopting', ?,
+               'Legacy project preserved; owner re-adoption is required')`,
+    ).run(JSON.stringify(MIGRATED_GAPS));
+  }
+}
+
+function addColumnIfMissing(db, table, columns, name, definition) {
+  if (!columns.has(name)) {
+    db.exec(`ALTER TABLE ${table} ADD COLUMN ${name} ${definition}`);
+    columns.add(name);
+    return true;
+  }
+  return false;
+}
+
+function applyBaselineColumns(db) {
+  if (!tableNames(db).includes('baselines')) return false;
+  const columns = columnNames(db, 'baselines');
+  let changed = false;
+  changed = addColumnIfMissing(db, 'baselines', columns, 'repository_branch', 'TEXT') || changed;
+  changed = addColumnIfMissing(
+    db, 'baselines', columns, 'worktree_state',
+    "TEXT NOT NULL DEFAULT 'unavailable' CHECK (worktree_state IN ('clean', 'dirty', 'unavailable'))",
+  ) || changed;
+  changed = addColumnIfMissing(db, 'baselines', columns, 'worktree_digest', 'TEXT') || changed;
+  changed = addColumnIfMissing(
+    db, 'baselines', columns, 'worktree_files_json', "TEXT NOT NULL DEFAULT '[]'",
+  ) || changed;
+  changed = addColumnIfMissing(
+    db, 'baselines', columns, 'worktree_accepted',
+    'INTEGER NOT NULL DEFAULT 0 CHECK (worktree_accepted IN (0, 1))',
+  ) || changed;
+  changed = addColumnIfMissing(db, 'baselines', columns, 'gaps_json', "TEXT NOT NULL DEFAULT '[]'") || changed;
+  changed = addColumnIfMissing(
+    db, 'baselines', columns, 'classification_json', "TEXT NOT NULL DEFAULT '{}'",
+  ) || changed;
+  return changed;
+}
+
+function applyChangeColumns(db) {
+  if (!tableNames(db).includes('changes')) return false;
+  const columns = columnNames(db, 'changes');
+  return addColumnIfMissing(db, 'changes', columns, 'baseline_bypass_json', 'TEXT');
+}
+
+function quoteSqlString(value) {
+  return `'${String(value).replaceAll("'", "''")}'`;
+}
+
+function migrationBackup(db, dbPath, fromVersion, existingTables) {
+  if (existingTables.size === 0 || fromVersion === EXPECTED_VERSION) return null;
+  const parent = path.dirname(dbPath);
+  const backupDir = path.basename(parent) === '.ultra' ? path.join(parent, 'backups') : path.join(parent, 'backups');
+  fs.mkdirSync(backupDir, { recursive: true });
+  const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+  const version = String(fromVersion || 'unknown').replace(/[^a-zA-Z0-9_.-]/g, '_');
+  const backupPath = path.join(backupDir, `state-pre-${version}-to-${EXPECTED_VERSION}-${stamp}.db`);
+  db.exec(`VACUUM INTO ${quoteSqlString(backupPath)}`);
+  return backupPath;
+}
+
 function readSchemaSql() {
   if (!fs.existsSync(SCHEMA_FILE)) {
     throw new Error(`state-db schema missing at ${SCHEMA_FILE}`);
@@ -218,27 +330,82 @@ function upgradeRuntimeConstraints(db, fromVersion = latestSchemaVersion(db)) {
   return true;
 }
 
-function applyCompatibleUpgrades(db, fromVersion = latestSchemaVersion(db)) {
+function applyCompatibleUpgrades(db, fromVersion = latestSchemaVersion(db), { legacyState = false } = {}) {
   const runtimeChanged = upgradeRuntimeConstraints(db, fromVersion);
   db.transaction(() => {
     applyCompatibleColumns(db);
     const contextChanged = applyContextSpineUpgrade(db);
-    if (contextChanged || (fromVersion && fromVersion !== EXPECTED_VERSION)) {
+    const contextMigration = db.prepare(
+      "SELECT 1 FROM migration_history WHERE to_version = '10.0' AND status = 'success' LIMIT 1",
+    ).get();
+    const needsContextMigration = Boolean(
+      fromVersion && ![CONTEXT_SCHEMA_VERSION, BASELINE_SCHEMA_VERSION, EXPECTED_VERSION].includes(fromVersion)
+        && !contextMigration,
+    );
+    if (contextChanged || needsContextMigration) {
       db.prepare(
         `INSERT INTO migration_history
           (from_version, to_version, direction, status, notes)
          VALUES (?, ?, 'forward', 'success', ?)`,
       ).run(
         runtimeChanged ? KIMI_SCHEMA_VERSION : (fromVersion || 'unknown'),
-        EXPECTED_VERSION,
+        CONTEXT_SCHEMA_VERSION,
         'Add Context Spine role/gate readiness, execution contracts, breadcrumbs, and specification learning',
       );
     }
+    applyBaselineUpgrade(db, { legacyState });
+    applyBaselineColumns(db);
+    applyChangeColumns(db);
+    const baselineMigration = db.prepare(
+      "SELECT 1 FROM migration_history WHERE to_version = '11.0' AND status = 'success' LIMIT 1",
+    ).get();
+    if (fromVersion && ![BASELINE_SCHEMA_VERSION, EXPECTED_VERSION].includes(fromVersion)
+      && !baselineMigration) {
+      db.prepare(
+        `INSERT INTO migration_history
+          (from_version, to_version, direction, status, notes)
+         VALUES (?, ?, 'forward', 'success', ?)`,
+      ).run(
+        fromVersion === CONTEXT_SCHEMA_VERSION ? fromVersion : CONTEXT_SCHEMA_VERSION,
+        BASELINE_SCHEMA_VERSION,
+        'Add authoritative greenfield and brownfield baseline adoption, evidence, convergence, and drift state',
+      );
+    }
+    if (legacyState) {
+      db.prepare(
+        `UPDATE baselines SET status = 'adopting', approved_by = NULL, approval_note = ?,
+         converged_at = NULL, worktree_state = 'unavailable', worktree_digest = NULL,
+         worktree_files_json = '[]', worktree_accepted = 0,
+         gaps_json = CASE WHEN gaps_json IS NULL OR gaps_json = '[]' THEN ? ELSE gaps_json END,
+         updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+         WHERE mode = 'migrated' AND status != 'superseded'`,
+      ).run(
+        'Legacy project preserved; owner re-adoption is required',
+        JSON.stringify(MIGRATED_GAPS),
+      );
+      const adoptionMigration = db.prepare(
+        "SELECT 1 FROM migration_history WHERE to_version = '12.0' AND status = 'success' LIMIT 1",
+      ).get();
+      if (!adoptionMigration) {
+        db.prepare(
+          `INSERT INTO migration_history
+            (from_version, to_version, direction, status, notes)
+           VALUES (?, ?, 'forward', 'success', ?)`,
+        ).run(
+          BASELINE_SCHEMA_VERSION,
+          EXPECTED_VERSION,
+          'Add repository snapshots, authoritative gap ledger, incident governance, and required re-adoption',
+        );
+      }
+    }
     db.exec('CREATE INDEX IF NOT EXISTS tasks_change ON tasks(change_id) WHERE change_id IS NOT NULL');
     db.exec('CREATE INDEX IF NOT EXISTS events_change ON events(change_id, id)');
     db.prepare(
       'INSERT OR IGNORE INTO schema_version (version, description) VALUES (?, ?)',
-    ).run(EXPECTED_VERSION, 'Role-scoped context snapshots, deterministic breadcrumbs, and approval-gated specification learning');
+    ).run(
+      EXPECTED_VERSION,
+      'Evidence-backed repository snapshots, gap ledger, safe re-adoption, and incident break-glass governance',
+    );
   })();
 }
 
@@ -258,23 +425,36 @@ function ensureSchemaVersion(db) {
 }
 
 function initStateDb(dbPath) {
-  const db = openStateDb(dbPath);
-  const existing = new Set(tableNames(db));
-  const fromVersion = latestSchemaVersion(db);
-  applyCompatibleColumns(db);
-  const missing = REQUIRED_TABLES.filter((t) => !existing.has(t));
-  if (missing.length > 0) {
-    applySchema(db);
+  let db;
+  let backupPath = null;
+  try {
+    db = openStateDb(dbPath);
+    const existing = new Set(tableNames(db));
+    const fromVersion = latestSchemaVersion(db);
+    const legacyState = existing.size > 0 && fromVersion !== EXPECTED_VERSION;
+    backupPath = migrationBackup(db, dbPath, fromVersion, existing);
+    applyCompatibleColumns(db);
+    const missing = REQUIRED_TABLES.filter((t) => !existing.has(t));
+    if (missing.length > 0) {
+      applySchema(db);
+    }
+    applyCompatibleUpgrades(db, fromVersion, { legacyState });
+    const version = ensureSchemaVersion(db);
+    return {
+      db,
+      path: dbPath,
+      schema_version: version,
+      created: missing.length > 0,
+      backup_path: backupPath,
+      tables: tableNames(db).sort(),
+    };
+  } catch (error) {
+    if (backupPath && error && typeof error === 'object') {
+      error.migration_backup_path = backupPath;
+    }
+    closeStateDb(db);
+    throw error;
   }
-  applyCompatibleUpgrades(db, fromVersion);
-  const version = ensureSchemaVersion(db);
-  return {
-    db,
-    path: dbPath,
-    schema_version: version,
-    created: missing.length > 0,
-    tables: tableNames(db).sort(),
-  };
 }
 
 function closeStateDb(db) {
@@ -296,4 +476,5 @@ module.exports = {
   closeStateDb,
   tableNames,
   runScript,
+  MIGRATED_GAPS,
 };

package/mcp-server/lib/state-db.test.cjs

@@ -82,6 +82,135 @@ test('openStateDb on an empty file produces no tables until schema is applied',
   }
 });
 
+test('initStateDb upgrades an exact schema 11 project without replacing its approved baseline', () => {
+  const { dir, file } = tmpDbPath('ubp-schema-11-upgrade');
+  try {
+    const legacy = openStateDb(file);
+    legacy.exec(`
+      CREATE TABLE schema_version (
+        version TEXT PRIMARY KEY,
+        applied_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+        description TEXT
+      );
+      CREATE TABLE migration_history (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        from_version TEXT NOT NULL,
+        to_version TEXT NOT NULL,
+        direction TEXT NOT NULL CHECK (direction IN ('forward', 'rollback')),
+        ts TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+        status TEXT NOT NULL CHECK (status IN ('success', 'failed', 'dry_run')),
+        notes TEXT
+      );
+      CREATE TABLE baselines (
+        id TEXT PRIMARY KEY,
+        project_name TEXT NOT NULL,
+        project_type TEXT,
+        stack TEXT,
+        mode TEXT NOT NULL CHECK (mode IN ('greenfield', 'brownfield', 'migrated')),
+        status TEXT NOT NULL CHECK (status IN ('draft', 'adopting', 'blocked', 'ready', 'superseded')),
+        repository_root TEXT NOT NULL DEFAULT '.',
+        scope_json TEXT NOT NULL DEFAULT '["."]',
+        repository_revision TEXT,
+        spec_refs_json TEXT NOT NULL DEFAULT '[]',
+        evidence_json TEXT NOT NULL DEFAULT '[]',
+        verification_json TEXT NOT NULL DEFAULT '[]',
+        unknowns_json TEXT NOT NULL DEFAULT '[]',
+        provider_refs_json TEXT NOT NULL DEFAULT '{}',
+        approved_by TEXT,
+        approval_note TEXT,
+        started_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+        converged_at TEXT,
+        updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+      );
+      CREATE TABLE changes (
+        id TEXT PRIMARY KEY,
+        title TEXT NOT NULL,
+        kind TEXT NOT NULL CHECK (kind IN ('quick', 'standard', 'major', 'incident')),
+        status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'blocked', 'ready', 'archived', 'cancelled')),
+        intent TEXT NOT NULL,
+        docs_impact_json TEXT NOT NULL DEFAULT '{}',
+        provider_refs_json TEXT NOT NULL DEFAULT '{}',
+        base_commit TEXT,
+        artifact_root TEXT,
+        created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+        updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+        closed_at TEXT
+      );
+      INSERT INTO schema_version (version, description) VALUES ('11.0', 'baseline authority');
+      INSERT INTO baselines
+        (id, project_name, mode, status, approved_by, approval_note, converged_at)
+      VALUES
+        ('approved-baseline', 'legacy-project', 'brownfield', 'ready', 'owner', 'approved',
+         '2026-07-01T00:00:00.000Z');
+    `);
+    closeStateDb(legacy);
+
+    let upgraded;
+    try {
+      upgraded = initStateDb(file);
+    } catch (error) {
+      assert.fail(`schema 11 upgrade failed: ${error.message}\n${error.stack || ''}`);
+    }
+    try {
+      assert.equal(upgraded.schema_version, '12.0');
+      assert.ok(fs.existsSync(upgraded.backup_path));
+      const baseline = upgraded.db.prepare(
+        'SELECT id, mode, status, worktree_state, gaps_json FROM baselines',
+      ).get();
+      assert.deepEqual(baseline, {
+        id: 'approved-baseline', mode: 'brownfield', status: 'ready',
+        worktree_state: 'unavailable', gaps_json: '[]',
+      });
+      assert.equal(
+        upgraded.db.prepare("SELECT COUNT(*) AS count FROM baselines WHERE mode = 'migrated'").get().count,
+        0,
+      );
+      const changeColumns = upgraded.db.prepare('PRAGMA table_info(changes)').all().map((row) => row.name);
+      assert.ok(changeColumns.includes('baseline_bypass_json'));
+    } finally { closeStateDb(upgraded.db); }
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('initStateDb exposes its pre-migration backup when an incompatible legacy schema fails', () => {
+  const { dir, file } = tmpDbPath('ubp-schema-upgrade-failure');
+  try {
+    const legacy = openStateDb(file);
+    legacy.exec(`
+      CREATE TABLE schema_version (
+        version TEXT PRIMARY KEY,
+        applied_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+        description TEXT
+      );
+      CREATE TABLE migration_history (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        from_version TEXT NOT NULL,
+        to_version TEXT NOT NULL,
+        direction TEXT NOT NULL,
+        applied_at TEXT NOT NULL,
+        status TEXT NOT NULL,
+        notes TEXT
+      );
+      INSERT INTO schema_version (version, description) VALUES ('11.0', 'incompatible fixture');
+    `);
+    closeStateDb(legacy);
+
+    let failure;
+    try {
+      initStateDb(file);
+    } catch (error) {
+      failure = error;
+    }
+    assert.ok(failure, 'the incompatible migration_history table must fail schema application');
+    assert.match(failure.message, /no such column: ts/);
+    assert.ok(failure.migration_backup_path, 'failure must retain the backup location for recovery');
+    assert.ok(fs.existsSync(failure.migration_backup_path));
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 test('Phase 8A.1 schema: tasks.parent_id column + tasks_parent partial index + seed row', () => {
   const { dir, file } = tmpDbPath();
   try {
@@ -123,7 +252,7 @@ test('initStateDb migrates existing runtime constraints to Kimi without losing r
     const legacy = openStateDb(file);
     const legacySchema = fs.readFileSync(SCHEMA_FILE, 'utf8').replaceAll(", 'kimi'", '');
     legacy.exec(legacySchema);
-    legacy.prepare("DELETE FROM schema_version WHERE version IN ('9.1', '10.0')").run();
+    legacy.prepare("DELETE FROM schema_version WHERE version IN ('9.1', '10.0', '11.0', '12.0')").run();
     legacy.prepare(
       "INSERT INTO tasks (id, title, type, priority) VALUES ('task-old', 'Old', 'feature', 'P1')",
     ).run();
@@ -146,16 +275,24 @@ test('initStateDb migrates existing runtime constraints to Kimi without losing r
     closeStateDb(legacy);
 
     const upgraded = initStateDb(file);
-    assert.equal(upgraded.schema_version, '10.0');
+    assert.equal(upgraded.schema_version, '12.0');
+    assert.ok(upgraded.backup_path);
+    assert.ok(fs.existsSync(upgraded.backup_path));
     assert.equal(upgraded.db.prepare("SELECT runtime FROM sessions WHERE sid = 'session-old'").get().runtime, 'codex');
     assert.equal(upgraded.db.prepare("SELECT COUNT(*) AS n FROM telemetry WHERE session_id = 'session-old'").get().n, 1);
     assert.equal(upgraded.db.prepare("SELECT COUNT(*) AS n FROM incidents WHERE session_id = 'session-old'").get().n, 1);
     assert.deepEqual(upgraded.db.pragma('foreign_key_check'), []);
     const migrations = upgraded.db.prepare(
-      "SELECT to_version, notes FROM migration_history WHERE to_version IN ('9.1', '10.0') ORDER BY id",
+      "SELECT to_version, notes FROM migration_history WHERE to_version IN ('9.1', '10.0', '11.0', '12.0') ORDER BY id",
     ).all();
     assert.ok(migrations.some((row) => row.to_version === '9.1' && /Kimi/.test(row.notes)));
     assert.ok(migrations.some((row) => row.to_version === '10.0' && /Context Spine/.test(row.notes)));
+    assert.ok(migrations.some((row) => row.to_version === '11.0' && /baseline adoption/i.test(row.notes)));
+    assert.ok(migrations.some((row) => row.to_version === '12.0' && /gap ledger|re-adoption/i.test(row.notes)));
+    assert.deepEqual(
+      upgraded.db.prepare("SELECT mode, status FROM baselines WHERE id = 'migrated-baseline'").get(),
+      { mode: 'migrated', status: 'adopting' },
+    );
 
     upgraded.db.prepare(
       "INSERT INTO tasks (id, title, type, priority) VALUES ('task-kimi', 'Kimi', 'feature', 'P1')",

package/mcp-server/lib/state-ops.cjs

@@ -128,6 +128,60 @@ function listTasks(db, filter = {}) {
   }).map(rowToTask);
 }
 
+function assertChangeAcceptsTasks(db, changeId) {
+  if (changeId === null || changeId === undefined) return null;
+  const change = db.prepare('SELECT id, status FROM changes WHERE id = ?').get(changeId);
+  if (!change) throw new StateOpsError('CHANGE_NOT_FOUND', `change ${changeId} does not exist`);
+  if (!['active', 'blocked'].includes(change.status)) {
+    throw new StateOpsError('CHANGE_NOT_MUTABLE', `change ${changeId} is ${change.status}`);
+  }
+  return change;
+}
+
+function resolveTaskCreationChangeId(db, input = {}) {
+  const explicitlyAssigned = input.change_id !== undefined;
+  const requestedChangeId = explicitlyAssigned ? input.change_id : null;
+  if (!input.parent_id) {
+    assertChangeAcceptsTasks(db, requestedChangeId);
+    return requestedChangeId;
+  }
+  const parent = readTask(db, input.parent_id);
+  if (!parent) {
+    throw new StateOpsError('TASK_NOT_FOUND', `parent task ${input.parent_id} does not exist`);
+  }
+  if (explicitlyAssigned && requestedChangeId !== parent.change_id) {
+    throw new StateOpsError(
+      'TASK_CHANGE_OWNERSHIP_MISMATCH',
+      `child task change ${requestedChangeId || '(none)'} does not match parent ${parent.id} change ${parent.change_id || '(none)'}`,
+    );
+  }
+  assertChangeAcceptsTasks(db, parent.change_id);
+  return parent.change_id;
+}
+
+function assertTaskChangeAssignment(db, task, changeId) {
+  if (task.parent_id) {
+    const parent = readTask(db, task.parent_id);
+    if (!parent) throw new StateOpsError('TASK_NOT_FOUND', `parent task ${task.parent_id} does not exist`);
+    if (changeId !== parent.change_id) {
+      throw new StateOpsError(
+        'TASK_CHANGE_OWNERSHIP_MISMATCH',
+        `task ${task.id} must retain parent ${parent.id} change ${parent.change_id || '(none)'}`,
+      );
+    }
+  }
+  const mismatchedChild = db.prepare(
+    'SELECT id, change_id FROM tasks WHERE parent_id = ? AND change_id IS NOT ? LIMIT 1',
+  ).get(task.id, changeId);
+  if (mismatchedChild) {
+    throw new StateOpsError(
+      'TASK_CHANGE_OWNERSHIP_MISMATCH',
+      `task ${task.id} change must continue to match child ${mismatchedChild.id}`,
+    );
+  }
+  assertChangeAcceptsTasks(db, changeId);
+}
+
 function createTask(db, input) {
   if (!input || !input.id || !input.title || !input.type || !input.priority) {
     throw new StateOpsError('VALIDATION_ERROR', 'id, title, type, priority required');
@@ -160,9 +214,7 @@ function createTask(db, input) {
     updated_at: ts,
   };
   return tx(db, () => {
-    if (row.change_id && !db.prepare('SELECT id FROM changes WHERE id = ?').get(row.change_id)) {
-      throw new StateOpsError('CHANGE_NOT_FOUND', `change ${row.change_id} does not exist`);
-    }
+    row.change_id = resolveTaskCreationChangeId(db, input);
     try {
       db.prepare(
         `INSERT INTO tasks (${TASK_FIELDS.join(', ')})
@@ -188,6 +240,10 @@ function patchTask(db, id, patch = {}) {
   return tx(db, () => {
     const current = readTask(db, id);
     if (!current) throw new StateOpsError('TASK_NOT_FOUND', `no task ${id}`);
+    // A task owned by a change remains writable only while that change is an
+    // active execution authority. Ownership is durable once assigned: it may
+    // not be detached or moved to another change by a generic task patch.
+    assertChangeAcceptsTasks(db, current.change_id);
     const sets = [];
     const params = [];
     let nextStatus = null;
@@ -200,9 +256,14 @@ function patchTask(db, id, patch = {}) {
         throw new StateOpsError('VALIDATION_ERROR', `field ${key} is not patchable`);
       }
       let value = patch[key];
-      if (key === 'change_id' && value !== null
-        && !db.prepare('SELECT id FROM changes WHERE id = ?').get(value)) {
-        throw new StateOpsError('CHANGE_NOT_FOUND', `change ${value} does not exist`);
+      if (key === 'change_id') {
+        if (current.change_id !== null && value !== current.change_id) {
+          throw new StateOpsError(
+            'TASK_CHANGE_OWNERSHIP_MISMATCH',
+            `task ${current.id} already belongs to change ${current.change_id}`,
+          );
+        }
+        assertTaskChangeAssignment(db, current, value);
       }
       if (key === 'deps' || key === 'files_modified') {
         if (value !== null && !Array.isArray(value)) {
@@ -711,6 +772,7 @@ module.exports = {
   // tasks
   readTask,
   listTasks,
+  resolveTaskCreationChangeId,
   createTask,
   patchTask,
   updateTaskStatus,

package/mcp-server/lib/task-expander.cjs

@@ -10,6 +10,7 @@
 
 const Ajv = require('ajv/dist/2020');
 const ops = require('./state-ops.cjs');
+const changes = require('./change-workflow.cjs');
 const {
   buildExpandSystemPrompt,
   buildExpandUserPrompt,
@@ -51,7 +52,9 @@ class TaskExpandError extends Error {
   }
 }
 
-async function expandTask(db, { id, sub_count, strategy = 'llm', llmClient } = {}) {
+async function expandTask(db, {
+  id, sub_count, strategy = 'llm', llmClient, rootDir = process.cwd(),
+} = {}) {
   if (!id) throw new TaskExpandError('VALIDATION_ERROR', 'id required');
 
   const parent = ops.readTask(db, id);
@@ -65,6 +68,7 @@ async function expandTask(db, { id, sub_count, strategy = 'llm', llmClient } = {
   if (strategy !== 'llm') {
     throw new TaskExpandError('VALIDATION_ERROR', `unknown strategy "${strategy}"`);
   }
+  changes.assertTaskCreationAllowed(db, { change_id: parent.change_id }, { rootDir });
   if (!llmClient || typeof llmClient.completeJson !== 'function') {
     throw new TaskExpandError('NO_LLM_CLIENT', 'llmClient.completeJson is required');
   }
@@ -101,10 +105,12 @@ async function expandTask(db, { id, sub_count, strategy = 'llm', llmClient } = {
       files_modified: Array.isArray(c.files_modified) ? c.files_modified : [],
       parent_id: parent.id,
       tag: parent.tag,
+      change_id: parent.change_id,
     };
   });
 
   return ops.tx(db, () => {
+    changes.assertTaskCreationAllowed(db, { change_id: parent.change_id }, { rootDir });
     for (const child of children) {
       ops.createTask(db, child);
     }

package/mcp-server/lib/task-expander.test.cjs

@@ -13,11 +13,17 @@ const path = require('node:path');
 
 const { initStateDb, closeStateDb } = require('./state-db.cjs');
 const ops = require('./state-ops.cjs');
+const changes = require('./change-workflow.cjs');
 const { expandTask, TaskExpandError } = require('./task-expander.cjs');
 
 function tmpDb() {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ubp-expand-'));
   const { db } = initStateDb(path.join(dir, 'state.db'));
+  db.prepare(
+    `INSERT INTO baselines
+     (id, project_name, mode, status, approved_by, approval_note, converged_at)
+     VALUES ('test-baseline', 'fixture', 'greenfield', 'ready', 'test', 'fixture', ?)`,
+  ).run(new Date().toISOString());
   return { dir, db };
 }
 
@@ -251,3 +257,68 @@ test('expandTask: children inherit parent tag', async () => {
     cleanup(ctx);
   }
 });
+
+test('expandTask blocks new children when baseline authority is missing, draft, or migrated', async () => {
+  for (const baseline of ['missing', 'draft', 'migrated']) {
+    const ctx = tmpDb();
+    try {
+      seedParent(ctx.db);
+      if (baseline === 'missing') ctx.db.prepare('DELETE FROM baselines').run();
+      else if (baseline === 'draft') {
+        ctx.db.prepare("UPDATE baselines SET status = 'draft' WHERE id = 'test-baseline'").run();
+      } else {
+        ctx.db.prepare(
+          "UPDATE baselines SET mode = 'migrated', status = 'adopting' WHERE id = 'test-baseline'",
+        ).run();
+      }
+      await assert.rejects(
+        expandTask(ctx.db, {
+          id: 'parent-1', llmClient: fakeLlm(HAPPY_CHILDREN), rootDir: ctx.dir,
+        }),
+        (error) => error.code === 'BASELINE_NOT_READY',
+      );
+      assert.equal(ops.readTask(ctx.db, 'child-1'), null);
+      assert.equal(ops.readTask(ctx.db, 'parent-1').status, 'pending');
+    } finally { cleanup(ctx); }
+  }
+});
+
+test('expandTask preserves active ordinary and approved incident change ownership while adoption is incomplete', async () => {
+  for (const kind of ['quick', 'incident']) {
+    const ctx = tmpDb();
+    try {
+      if (kind === 'incident') {
+        ctx.db.prepare(
+          "UPDATE baselines SET mode = 'brownfield', status = 'adopting' WHERE id = 'test-baseline'",
+        ).run();
+      }
+      const changeId = `expand-${kind}`;
+      changes.createChange(ctx.db, {
+        id: changeId,
+        title: kind === 'incident' ? 'Recover production expansion' : 'Continue planned expansion',
+        kind,
+        intent: 'Keep every expanded child inside the already-authorized continuous change.',
+        ...(kind === 'incident' ? {
+          baseline_bypass: {
+            approved_by: 'incident-commander',
+            reason: 'Production recovery requires a bounded task expansion before adoption converges.',
+          },
+        } : {}),
+      }, { rootDir: ctx.dir });
+      seedParent(ctx.db, { change_id: changeId });
+      if (kind === 'quick') {
+        ctx.db.prepare(
+          "UPDATE baselines SET mode = 'brownfield', status = 'adopting' WHERE id = 'test-baseline'",
+        ).run();
+      }
+
+      const result = await expandTask(ctx.db, {
+        id: 'parent-1', llmClient: fakeLlm(HAPPY_CHILDREN), rootDir: ctx.dir,
+      });
+      assert.equal(result.children.length, HAPPY_CHILDREN.length);
+      for (const child of HAPPY_CHILDREN) {
+        assert.equal(ops.readTask(ctx.db, child.id).change_id, changeId);
+      }
+    } finally { cleanup(ctx); }
+  }
+});