ultra-builder-pro-cli 0.13.0 → 0.15.0

package/skills/ultra-research/references/99-synthesis.md

@@ -0,0 +1,35 @@
+# Research synthesis
+
+Use for workflow step `99-synthesis`.
+
+## Objective
+
+Verify that research artifacts form one traceable, planning-ready baseline without
+creating a second condensed authority.
+
+## Validate
+
+- Every consequential claim is marked `Observed`, `Verified`, `Decided`, or `Unknown`.
+- Product behavior traces from problem or constraint through actor, scenario,
+  requirement, acceptance, architecture, quality, and delivery evidence.
+- Current behavior and proposed behavior are not silently merged.
+- Scope reflects owner decisions and never an inferred MVP or reduction.
+- Documentation conflicts, known failures, and load-bearing unknowns are in the gap
+  ledger with owners or explicit decisions.
+- Verification commands and observed results are current.
+
+## Record
+
+Write `research-distillate.md` as a navigation and traceability artifact containing
+baseline ids, source document anchors, accepted decisions, blockers, gaps, verification
+evidence, and the exact planning entry. Do not duplicate the specifications' prose.
+
+Write the immutable `99-synthesis` step report, then complete the step with that report,
+all three baseline specification paths, the distillate path, and the evidence used for
+the synthesis. Read the completed workflow back before baseline convergence.
+
+## Semantic record
+
+Use kind `synthesis_trace`. Record one verified chain through `problem_id`,
+`scenario_id`, `requirement_ids`, `architecture_path_ids`, and `verification_refs`.
+Every referenced id must exist in an earlier selected step.

package/skills/ultra-review/SKILL.md

@@ -1,81 +1,65 @@
 ---
 name: ultra-review
-description: Run independent specification-fidelity and engineering reviews over one current diff using bounded workers and file-based evidence. Use when implementation needs a read-only review gate before task completion or delivery.
+description: Run independent specification-fidelity and engineering reviews over one current Ultra diff and persist bounded review evidence. Use when a task or change needs a read-only review gate before completion, convergence, or delivery.
 ---
 
 # Review one current diff
 
 Keep two verdict axes independent:
 
-1. `spec_fidelity`: intent, acceptance, delta, documentation impact, and public seam;
-2. `engineering_standards`: correctness, safety, maintainability, testing,
-   observability, and recovery.
-
-One axis cannot compensate for the other. Preserve each finding's source, severity,
-file and line, and axis during coordination.
-
-## Scope and context
-
-1. Resolve one explicit diff range and file set. Include staged and unstaged changes
-   for a default working-tree review.
-2. Bind the single matching change through `change.list` and `task.list`; require an id
-   when ambiguous.
-3. Compile `change.context` for the review role and gate with only the intent, delta,
-   acceptance, tests, diff paths, and public-seam contract needed for this review.
-4. Stop on stale HEAD, blocked readiness, empty scope, or missing acceptance evidence.
-5. Create `.ultra/reviews/<session-id>/` with the reviewed HEAD, range, change id,
-   selected workers, and a pending verdict.
-
-## Run the independent fidelity axis
-
-Always dispatch `review-spec` with only the accepted intent, delta, acceptance criteria,
-public-seam context, current HEAD, and diff scope. Do not give it engineering findings
-or an implementation rationale that is not part of the accepted contract. It writes
-`spec-fidelity.json` with `axis: spec_fidelity`.
-
-## Select engineering specialists
-
-Use the smallest set that covers the diff. The delivery gate runs all five:
-
-- `review-code`: correctness, security, and live-path reachability;
-- `review-tests`: behavioral coverage and feedback-loop evidence;
-- `review-errors`: hidden failures, recovery, and observability;
-- `review-design`: types, boundaries, complexity, and coupling;
-- `review-comments`: stale or misleading comments and documentation.
-
-Record why any engineering specialist is skipped. The independent specification
-worker is required for every change-linked review.
-
-## Execute bounded workers
-
-Use the current host's native bounded-worker mechanism. Dispatch `review-spec` and the
-selected engineering workers independently. Each worker must inspect only the supplied
-diff and role context. Resolve `references/unified-schema.md` from this
-Skill directory and pass that absolute path as `SCHEMA_PATH`; never make a worker infer
-the plugin installation root. Each worker writes `<session>/<worker>.json` following
-that contract, limits output to actionable findings, and returns only a short file
-acknowledgement to the parent context.
-
-Resolve bundled paths relative to this skill directory. Validate the exact expected
-artifacts before coordination:
-
-```bash
-python3 scripts/review_wait.py <session-path> agents spec-fidelity review-code review-tests
-```
-
-Pass only the engineering worker stems actually selected. Missing or invalid required
-artifacts make the corresponding axis incomplete; a partial set is never a pass.
-
-Run `review-coordinator` only after validation. It may merge duplicate root causes but
-must retain source identifiers and the highest original severity.
-Validate its summary with the same waiter.
-
-## Report and handoff
-
-Report both axis verdicts first, followed by blocking findings and artifact paths.
-Review is read-only except for review artifacts; fixes are a separate implementation
-action. Recheck only unresolved or changed scope after fixes.
-
-At the final HEAD, compile review context with one convergence action. Delivery must
-submit separate review evidence rows for `spec_fidelity` and
-`engineering_standards`; a single aggregate pass is invalid.
+- `spec_fidelity`: accepted intent, delta, behavior, docs impact, and public seam;
+- `engineering_standards`: correctness, safety, tests, maintainability, observability,
+  integration, and recovery.
+
+One axis cannot compensate for the other.
+
+## Bind durable scope
+
+1. Read `references/review-modes.md`. Select exactly one review mode: `task` for one
+   implementation slice, `change` for aggregate delivery readiness, or `plan` for an
+   approved plan before implementation. Bind only the evidence defined by that mode.
+2. Resolve one explicit diff range, current full HEAD, change, task set, and accepted
+   evidence. Stop on an empty or ambiguous scope.
+3. Resume or start a `review` workflow. Record `bind-diff` with revision, paths, mode,
+   and task set.
+4. Compile `change.context` for `review` using only accepted intent, delta, task
+   contracts, tests, public seams, and diff paths. Record `compile-context` only when
+   ready, with the immutable context manifest as the step output.
+5. Create `.ultra/reviews/<session-id>/` with mode, change id, exact task ids, full HEAD,
+   worktree digest, diff range, scope metadata, and pending verdicts.
+
+## Execute independent axes
+
+Always run the bounded `review-spec` worker for specification fidelity. Select the
+smallest necessary engineering workers using the mode and risk matrix; a change review
+for delivery runs every applicable role. Record every selected and skipped role with a
+scope-specific rationale. Invoke them through the current host's native bounded-worker
+mechanism. Keep workers independent and pass only the current diff plus their role
+context.
+
+Resolve `references/unified-schema.md` from this Skill directory and pass its absolute
+path as `SCHEMA_PATH`. Validate artifacts with `scripts/review_wait.py`; a missing,
+invalid, stale, or partial required artifact is not a pass.
+
+Record:
+
+- `review-specification` with `spec-fidelity.json` as an output;
+- `review-engineering` with every selected engineering artifact as outputs;
+- `coordinate-findings` with the coordinated summary output.
+
+The coordinator preserves every specialist finding unchanged in `SUMMARY.json`.
+Duplicate root causes may be grouped only in the human-readable summary. Review is
+read-only except for review artifacts; implementation fixes are a separate dev action.
+
+## Verify and complete
+
+Recheck reviewed HEAD, worktree digest, review-context digest, diff, acceptance, task
+set, artifact schemas, and both verdicts. Record `verify-review-gate`, then call
+`workflow.complete`. MCP
+derives each axis and the durable verdict from the specialist outputs, then requires
+`SUMMARY.json` to match their complete finding set. Prompt claims and a lossy
+coordinator summary cannot replace either axis. Any code, test, spec, or contract edit
+invalidates affected review evidence and requires a new or resumed run.
+
+Return both axis verdicts first, blocking findings, reviewed revision and paths,
+artifact digests, workflow id, skipped-role rationale, and one exact next route.

package/skills/ultra-review/references/review-modes.md

@@ -0,0 +1,27 @@
+# Review modes and worker selection
+
+Select one mode before creating review artifacts.
+
+## Task
+
+Review one completed task and its bounded diff. Require specification fidelity and the
+engineering roles implicated by the task's code, tests, errors, comments, or design.
+The result supports `review-slice`; it does not replace aggregate change review.
+
+## Change
+
+Review the current full change, accepted task set, test report, documentation impact,
+and convergence boundary. Run specification fidelity plus every engineering role that
+can materially affect delivery. This is the delivery-facing review.
+
+## Plan
+
+Review accepted intent, task coverage, seams, dependencies, recovery, and verification
+before implementation. Use a plan artifact as the bounded scope; code-diff-only roles
+may be skipped with a concrete rationale.
+
+## Selection record
+
+For every available worker, record `selected` or `skipped` and a rationale tied to the
+mode, changed paths, public seam, and risk flags. A role is applicable when its evidence
+could change either verdict axis. Tool availability alone is not a selection reason.

package/skills/ultra-review/references/unified-schema.md

@@ -67,8 +67,13 @@ preference as a defect. Preserve the source specialist's severity during coordin
 ```json
 {
   "$schema": "ultra-review-summary-v2",
+  "mode": "change",
   "session": "<session-id>",
+  "change_id": "<change-id>",
+  "task_ids": ["<task-id>"],
   "head": "<full-git-head>",
+  "worktree_digest": "<sha256-of-current-worktree>",
+  "context_digest": "<sha256-of-recorded-review-context>",
   "status": "complete",
   "verdict": "REQUEST_CHANGES",
   "axes": {
@@ -86,12 +91,32 @@ preference as a defect. Preserve the source specialist's severity during coordin
     "failed": [],
     "skipped": []
   },
+  "worker_selection": [
+    {
+      "worker": "review-spec",
+      "status": "selected",
+      "rationale": "The specification axis is required for every review mode."
+    },
+    {
+      "worker": "review-comments",
+      "status": "skipped",
+      "rationale": "The current diff does not change maintained comments or API documentation."
+    }
+  ],
   "findings": [],
   "positive_observations": [],
   "limitations": []
 }
 ```
 
+`findings` must contain every specialist finding unchanged. Group duplicates only in
+the human-readable summary; never delete or merge machine-readable records.
+
+`mode` is `task`, `change`, or `plan`. `worker_selection` contains every selected or
+skipped worker exactly once with a scope-specific rationale. Its selected set equals
+`workers.completed` plus `workers.failed`; its skipped set equals `workers.skipped`.
+`review-spec` is always selected and completed.
+
 The overall verdict is `APPROVE` only when both axes pass, artifacts are complete and
 current, and no P0 or P1 finding remains. Use `REQUEST_CHANGES` for a failed axis or
 blocking finding, and `INCOMPLETE` when required evidence or workers are missing.

package/skills/ultra-review/scripts/review_wait.py

@@ -23,6 +23,8 @@ AXES = {"spec_fidelity", "engineering_standards"}
 SEVERITIES = {"P0", "P1", "P2", "P3"}
 AXIS_VERDICTS = {"PASS", "FAIL", "INCOMPLETE"}
 OVERALL_VERDICTS = {"APPROVE", "REQUEST_CHANGES", "INCOMPLETE"}
+REVIEW_MODES = {"task", "change", "plan"}
+SELECTION_STATUSES = {"selected", "skipped"}
 ARTIFACT_STEM = re.compile(r"^[a-z][a-z0-9-]*$")
 FINDING_FIELDS = {
     "id", "axis", "severity", "category", "title", "file", "line", "trigger",
@@ -182,9 +184,16 @@ def expected_overall_verdict(data) -> str:
 def validate_summary(data):
     if data.get("$schema") != SUMMARY_SCHEMA:
         return f"$schema must be {SUMMARY_SCHEMA}"
-    for field in ["session", "head"]:
+    if data.get("mode") not in REVIEW_MODES:
+        return "mode must be task, change, or plan"
+    for field in ["session", "change_id", "head", "context_digest"]:
         if not nonempty_string(data.get(field)):
             return f"{field} must be a non-empty string"
+    if data.get("worktree_digest") is not None and not nonempty_string(data.get("worktree_digest")):
+        return "worktree_digest must be null or a non-empty string"
+    task_ids = data.get("task_ids")
+    if not isinstance(task_ids, list) or not all(nonempty_string(item) for item in task_ids):
+        return "task_ids must be a string array"
     if data.get("status") != "complete":
         return "status must be complete"
     if data.get("verdict") not in OVERALL_VERDICTS:
@@ -203,8 +212,36 @@ def validate_summary(data):
     if not isinstance(workers, dict):
         return "workers must be an object"
     for field in ["completed", "failed", "skipped"]:
-        if not isinstance(workers.get(field), list):
-            return f"workers.{field} must be an array"
+        values = workers.get(field)
+        if not isinstance(values, list) or not all(nonempty_string(item) for item in values):
+            return f"workers.{field} must be a string array"
+        if len(values) != len(set(values)):
+            return f"workers.{field} must not contain duplicates"
+    worker_selection = data.get("worker_selection")
+    if not isinstance(worker_selection, list) or not worker_selection:
+        return "worker_selection must be a non-empty array"
+    selected = set()
+    skipped = set()
+    seen_workers = set()
+    for item in worker_selection:
+        if not isinstance(item, dict):
+            return "worker_selection items must be objects"
+        worker = item.get("worker")
+        status = item.get("status")
+        if not nonempty_string(worker) or status not in SELECTION_STATUSES:
+            return "worker_selection requires worker and selected or skipped status"
+        if worker in seen_workers:
+            return f"duplicate worker selection: {worker}"
+        if not nonempty_string(item.get("rationale")):
+            return f"worker selection rationale is required: {worker}"
+        seen_workers.add(worker)
+        (selected if status == "selected" else skipped).add(worker)
+    if selected != set(workers["completed"]) | set(workers["failed"]):
+        return "selected workers must equal completed and failed workers"
+    if skipped != set(workers["skipped"]):
+        return "skipped worker selection must match workers.skipped"
+    if "review-spec" not in selected or "review-spec" not in set(workers["completed"]):
+        return "review-spec must be selected and completed"
     findings = data.get("findings")
     if not isinstance(findings, list):
         return "findings must be an array"

package/skills/ultra-status/SKILL.md

@@ -1,64 +1,60 @@
 ---
 name: ultra-status
-description: Report authoritative Ultra health, position, readiness, evidence freshness, and one deterministic next action. Use when the user asks where an Ultra project stands or what should happen next.
+description: Report authoritative Ultra project health, baseline, workflow position, task/session progress, evidence freshness, blockers, and one deterministic next action. Use when the user asks what is complete, blocked, stale, or next in an Ultra project.
 ---
 
-# Route from authoritative status
+# Route from authoritative state
 
-Answer status questions without reconstructing state from prose. `.ultra/state.db` is
-authoritative; reports and Markdown are evidence or projections.
+This workflow is read-only. Never reconstruct status from prose or generated task
+projections.
 
 ## Read order
 
-1. Call `system.doctor` in read-only mode. If authority is unhealthy, route only to
-   `ultra-doctor` and include the blocking diagnostic.
-2. Call `baseline.get` for mode, lifecycle status, repository revision, branch,
-   worktree snapshot, specification digest health, gap ledger, and adoption blockers.
-3. Call `change.breadcrumb` for the active change, task, role, gate, readiness,
-   blockers, advisory warnings, staleness, and next action.
-4. Call `task.list` and `session.list` for progress and active execution details.
-5. Read test and delivery reports only when present, and mark a report stale when its
-   HEAD differs from the current checkout.
-6. Read Git branch, HEAD, and worktree status without mutation.
-
-If MCP task or change state is unavailable, label that panel unavailable. Never fall
-back to generated task JSON, context frontmatter, or raw SQLite.
-
-## Routing
-
-Follow the breadcrumb's primary route and return one action, not a menu:
-
-- unhealthy authority: `ultra-doctor`;
-- missing Ultra project: `ultra-init`;
-- projection-only authority conflict: run the exact supported import command from the
-  MCP error, then `ultra-init`;
-- migrated or missing baseline evidence with no active change: `ultra-init`, then
-  `ultra-research` or `ultra-plan` according to the gap;
-- baseline or context-budget warning during an active change: keep the current route
-  and surface the warning; do not turn it into a refusal;
-- blocked or stale context: the workflow named by the breadcrumb;
-- ready implementation task: `ultra-dev <task-id>`;
-- completed tasks with missing or stale test evidence: `ultra-test`;
-- incomplete review or convergence: `ultra-review` or `ultra-deliver`;
-- ready change: `ultra-deliver`;
+1. Call `system.doctor` with repair disabled.
+2. Call `baseline.get` for classification, readiness, revision, worktree, spec digests,
+   research provenance, gaps, and blockers.
+3. Call `workflow.list`, then `workflow.get` for every active, blocked, or ready run.
+4. Call `change.breadcrumb`, `change.list`, `task.list`, and `session.list`.
+5. Inspect current Git branch, full HEAD, and worktree without mutation.
+6. Read test, review, and delivery artifacts only when referenced by DB workflow state;
+   compare their recorded digest and revision with current authority.
+
+If state is unreadable, report that panel unavailable and route to `ultra-doctor`.
+Never fall back to generated task JSON, raw SQLite queries, or context frontmatter.
+
+## Choose one route
+
+Prefer the breadcrumb and durable workflow position:
+
+- state integrity, schema, projection, or installed-asset failure: `ultra-doctor`;
+- missing project or migrated compatibility authority: `ultra-init`;
+- active/blocked research: `ultra-research` at its exact `current_step`;
+- ready research with unconverged baseline: finalize research, record, approve, and
+  converge through `ultra-research`;
+- active plan/change/dev/test/review/deliver run: its matching workflow at the exact
+  step or blocker;
+- ready baseline with no change: `ultra-change` to persist the requested outcome before
+  any planning;
 - archived change with fresh evidence: report completion without inventing more work.
 
-Require an explicit change id when several active changes make the route ambiguous.
+Context-size warnings are advisory. Missing authority, stale required refs or outputs,
+incomplete task contracts, failed evidence, unresolved learning, and missing approval
+are blockers.
 
 ## Output
 
-Use a compact shape:
+Report:
 
 ```text
 Ultra: <healthy|degraded> · <branch>@<head> · worktree <clean|dirty>
-Position: change=<id|none> task=<id|none> role=<role> gate=<gate>
-Baseline: <greenfield|brownfield|migrated>/<status> revision=<revision|none> gaps=<open>/<blocking>
-Readiness: <ready|blocked|stale> — <blockers or none>
-Warnings: <advisory conditions or none>
-Progress: <completed>/<total>; sessions=<active count>
-Evidence: tests=<fresh|stale|missing>; delivery=<fresh|stale|missing>
+Baseline: <mode>/<status> · research=<run/status> · gaps=<open>/<blocking>
+Workflow: <kind/id/status> · step=<current|finalize> · outputs=<fresh|stale>
+Change: <id/status|none> · Task: <id/status|none> · Sessions: <active>
+Evidence: test=<state> · review=<two axes> · delivery=<state>
+Blockers: <specific codes or none>
+Warnings: <advisory codes or none>
 Next: <one exact action>
 ```
 
-This workflow is read-only. It does not repair state, compile context, update tasks, or
-release software.
+Separate verified facts, inferences, and unavailable evidence. Do not modify state,
+compile context, repair, or release from this Skill.

package/skills/ultra-test/SKILL.md

@@ -1,59 +1,52 @@
 ---
 name: ultra-test
-description: Run an independent pre-delivery verification gate and record exact feedback-loop, reachability, recovery, and acceptance evidence. Use when scoped implementation tasks are complete and delivery readiness must be established.
+description: Verify completed Ultra tasks and one current change through independent acceptance, regression, build, public-seam, failure, and recovery evidence. Use when implementation needs a current test gate before review, convergence, or delivery.
 ---
 
-# Verify delivery readiness
-
-Run this gate from a fresh checking context. It complements task-level development
-tests and writes `.ultra/test-report.json`; it does not replace authoritative task or
-change state.
-
-## Entry gate
-
-1. Call `task.list` and require at least one completed task in scope.
-2. Call `change.list` and bind exactly one relevant change, or record a null change id
-   for an initial baseline.
-3. For a change, compile `change.context` for the checking role and verification gate
-   with only the specifications, tests, and source seams needed for acceptance.
-4. Call `change.breadcrumb`; stop when context is stale or readiness is blocked.
-
-Never use generated task JSON as authority or reuse the implementer's full
-conversation as test context.
-
-## Evidence matrix
-
-Map each acceptance claim to observable evidence:
-
-| Check | Evidence | Blocking result |
-|---|---|---|
-| Feedback loop | exact command and observed result | failure or missing baseline signal for a fix |
-| Public seam | reachable entry-to-consumer path | orphan, stub, or unwired behavior |
-| Regression | focused and adjacent suites | failure or weakened assertion |
-| Static/build | applicable type, lint, and build commands | non-zero result |
-| Error/recovery | exercised failure and recovery path | silent or unrecoverable critical path |
-| Security | relevant input, authorization, secret, and dependency checks | high-impact exploitable issue |
-| Docs/spec | delivered behavior matches the declared baseline or delta | drift or unknown impact |
-
-Use repository-native commands and real boundaries when practical. Use test doubles
-only at costly or nondeterministic external boundaries, and state why they preserve
-the contract being tested.
-
-Inspect tests for tautologies, empty assertions, hidden skips, excessive boundary
-mocking, changed exports without behavioral coverage, and code with no non-test
-consumer. Apply checks by risk and scope rather than forcing every category.
-
-## Report contract
-
-Write the report atomically with the current full HEAD, change id, context manifest
-hash, exact commands, baseline and final signals, verified public seams, checks, and
-blocking issues. Preserve concise failure excerpts instead of full logs.
-
-Set `passed: true` only when every required check passes, the report HEAD is current,
-and at least one declared public seam is verified. A not-applicable check needs a
-specific scope reason.
-
-## Exit
-
-Call `change.breadcrumb` and return one next action: fix a named blocker, run
-`ultra-review`, or run `ultra-deliver`. A stale report never routes to delivery.
+# Verify the current change
+
+Testing is independent checking. Do not reuse the implementer's conclusions as proof
+or use generated task JSON as authority.
+
+## Bind and execute
+
+1. Read `system.doctor`, `change.breadcrumb`, authoritative tasks, completed dev runs,
+   current HEAD/diff, and prior test report freshness.
+2. Resume or start a `test` workflow linked to the change and optional task. Record
+   `bind-scope` with the exact revision, task set, and acceptance ids.
+3. Compile `change.context` for `check`; record `compile-context` only when required
+   refs and DB-backed execution contracts are ready, with the immutable context
+   manifest as the step output.
+4. Map each accepted claim to an executable command or a specific bounded manual
+   observation. Record `map-acceptance`.
+5. Run repository-native focused and regression tests, applicable type/lint/build
+   checks, public-seam acceptance, and material error/recovery/security checks. Record
+   `execute-checks` and `verify-public-seam` with commands and observed results.
+
+Use real boundaries where practical. A test double is acceptable at a costly or
+nondeterministic external boundary only when the report explains why it preserves the
+contract. Reject tautologies, hidden skips, weakened assertions, and unconsumed code.
+
+## Report and converge
+
+Write `.ultra/reports/tests/<workflow-id>.json` atomically using
+`ultra-test-report-v1`: bind the full HEAD and worktree digest, change and exact task
+ids, the recorded checking-context digest, acceptance
+mapping, exact command results, public seams, failures, recovery evidence, run count,
+timestamp, and blocking issues. Populate every `verification_dimensions` entry:
+acceptance, regression, integration, static analysis, build, performance, security,
+and recovery. Use `not_applicable` only with a concrete rationale; `not_run` cannot
+support a passing gate. For an incident or any bugfix task, also record one
+deterministic `regression_signal` with the exact command, expected red symptom,
+observed red and green results, duration when known, and evidence. `passed` is true only when every recorded command and
+required public seam passes with no blocking issue at that exact checkout.
+
+Record `write-report` with the report output so MCP stores its digest. Re-read the file,
+HEAD, task set, and breadcrumb; record `verify-test-gate`, then call
+`workflow.complete`. MCP derives the durable test summary from the report rather than
+trusting a Prompt claim. A malformed, mismatched, changed, or stale report blocks
+completion.
+
+Return the workflow id, revision, pass/fail result, exact checks, verified seams,
+blocking failures, report path/digest, and one route to fix, `ultra-review`, or
+`ultra-deliver`.

package/skills/ultra-verify/SKILL.md

@@ -1,12 +1,13 @@
 ---
 name: ultra-verify
-description: Run independent two-model verification with the current host as primary and a read-only external advisor, then verify and synthesize both evidence sets. Use only when the user explicitly requests cross-model verification.
+description: Run independent two-model verification with the current host as primary and one installed read-only advisor, then verify and synthesize both evidence sets. Use only when the user explicitly requests cross-model verification.
 ---
 
 # Run independent cross-model verification
 
-Claude Code writes the first analysis, verifies consequential claims, and owns the
-final answer. Codex is an untrusted read-only advisor.
+Keep the current host responsible for scope, evidence, edits, verification, and the
+final answer. Use one installed collaboration companion that invokes a different CLI;
+never recurse into the current host or treat advisor output as authority.
 
 ## Modes
 
@@ -17,36 +18,26 @@ final answer. Codex is an untrusted read-only advisor.
 
 ## Workflow
 
-1. Confirm the advisor CLI and authentication. Define the exact workspace, question,
-   evidence standard, and response shape. Exclude secrets and unrelated files.
-2. Create `.ultra/collab/<session-id>/` and write the primary host's evidence-backed
-   analysis to `claude-analysis.md` before reading advisor output.
-3. Launch Codex with the raw bounded question and evidence in a read-only sandbox. Do
-   not include the primary conclusion when independence matters:
-
-   ```bash
-   codex exec -s read-only \
-     -a never \
-     --ephemeral \
-     --ignore-user-config \
-     --ignore-rules \
-     -o "${SESSION_PATH}/codex-output.md" \
-     "<bounded prompt>" \
-     2> "${SESSION_PATH}/codex-error.log"
-   ```
-4. Run `scripts/verify_wait.py` resolved relative to this skill directory. Use a
-   yielded or asynchronous shell session and poll at bounded intervals; do not hold a
-   blocking tool call longer than one minute.
+1. Define the workspace, question, evidence standard, and response shape. Confirm the
+   selected advisor CLI and authentication. Exclude secrets and unrelated files.
+2. Create `.ultra/collab/<session-id>/` and write the current host's independent,
+   evidence-backed analysis to `host-analysis.md` before reading advisor output.
+3. Follow the installed collaboration companion's read-only invocation contract. Give
+   the advisor the same bounded question and evidence, without the primary conclusion
+   when independence matters. Store its result as `advisor-output.md` and diagnostics
+   as `advisor-error.log`.
+4. Run `scripts/verify_wait.py <session-path> --advisor advisor --output
+   advisor-output.md` from this skill directory. Use a yielded shell session and poll
+   in bounded intervals; do not hold one blocking tool call longer than one minute.
 5. Read advisor output only after the waiter reports a complete, non-empty file.
-6. Verify both analyses against the current checkout, tests, runtime, or primary
-   documentation. Explain scope, version, evidence, and assumption differences before
-   judging disagreement.
-7. Write session metadata and a synthesis artifact, then return one host-owned
-   conclusion.
+6. Verify consequential claims against the current checkout, tests, runtime, or
+   primary documentation. Explain scope, version, evidence, and assumption differences
+   before resolving disagreement.
+7. Write `metadata.json` and `synthesis.md`, then return one host-owned conclusion.
 
 Read `references/cross-verify-modes.md` for mode-specific evidence and
-`references/confidence-system.md` when confidence language is useful. Model agreement
+`references/evidence-status.md` when the synthesis needs an evidence status. Model agreement
 never overrides failing tests or authoritative runtime evidence.
 
-Advisor failure degrades to the primary analysis with a single-source warning. It does
-not block the user's underlying task.
+Advisor failure degrades to the primary analysis with a single-source warning. It
+never blocks the user's underlying task.