ultra-builder-pro-cli 0.13.0 → 0.15.0

package/adapters/opencode.js

@@ -86,8 +86,8 @@ function openCodeTextTransform(input, assetName = '') {
     text = text.replaceAll('current host', 'OpenCode');
   }
   if (assetName === 'ultra-review') {
-    text = text.replaceAll(
-      "the current host's native bounded-worker mechanism",
+    text = text.replace(
+      /the current host's native bounded-worker\s+mechanism/g,
       'the OpenCode `task` tool using the installed bounded review agents',
     );
   }
@@ -304,135 +304,45 @@ function pluginSource() {
 import fs from "node:fs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
 
-const TERMINAL = new Set(["committed", "completed", "done", "cancelled"]);
 const TASKS_PROJECTION = ".ultra/tasks/tasks.json";
+const NODE_BINARY = ${JSON.stringify(process.execPath)};
+const PLUGIN_DIR = path.dirname(fileURLToPath(import.meta.url));
+const BREADCRUMB_CLI = path.resolve(
+  PLUGIN_DIR, "..", ${JSON.stringify(BUNDLE_DIR)}, "runtime", "breadcrumb.cjs",
+);
 
-function gitHead(root) {
-  try {
-    return execFileSync("git", ["rev-parse", "HEAD"], {
-      cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"],
-    }).trim();
-  } catch {
-    return null;
-  }
-}
-
-function findUltraContext(directory) {
+function findUltraRoot(directory) {
   let current = path.resolve(directory);
   while (true) {
     const ultra = path.join(current, ".ultra");
-    const currentHead = gitHead(current);
-    const workflowFile = path.join(ultra, "workflow-state.json");
-    const statePresent = fs.existsSync(path.join(ultra, "state.db"));
-    let workflow = null;
-    if (fs.existsSync(workflowFile)) {
-      try {
-        const state = JSON.parse(fs.readFileSync(workflowFile, "utf8"));
-        workflow = state && !TERMINAL.has(state.status) ? state : null;
-      } catch (error) {
-        process.stderr.write(\`[ultra-builder-pro] cannot read \${workflowFile}: \${error.message}\\n\`);
-      }
-    }
-    const changes = [];
-    const changeRoot = path.join(ultra, "changes", "active");
-    if (fs.existsSync(changeRoot)) {
-      for (const entry of fs.readdirSync(changeRoot, { withFileTypes: true })) {
-        if (!entry.isDirectory()) continue;
-        const manifestPath = path.join(changeRoot, entry.name, "context-manifest.json");
-        if (!fs.existsSync(manifestPath)) continue;
-        try {
-          const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
-          if (manifest?.change) {
-            const compiledHead = manifest.git?.head ?? null;
-            const legacyContext = manifest.schema_version !== "2.0" || !manifest.baseline;
-            const headStale = Boolean(compiledHead && currentHead && compiledHead !== currentHead);
-            const blockers = Array.isArray(manifest.readiness?.blockers)
-              ? [...manifest.readiness.blockers]
-              : [];
-            const warnings = Array.isArray(manifest.readiness?.warnings)
-              ? [...manifest.readiness.warnings]
-              : [];
-            if (headStale && !blockers.includes("CONTEXT_HEAD_STALE")) blockers.push("CONTEXT_HEAD_STALE");
-            if (legacyContext && !blockers.includes("CONTEXT_SNAPSHOT_UPGRADE_REQUIRED")) {
-              blockers.unshift("CONTEXT_SNAPSHOT_UPGRADE_REQUIRED");
-            }
-            changes.push({
-            id: manifest.change.id,
-            kind: manifest.change.kind,
-            status: manifest.change.status,
-            role: manifest.role ?? "plan",
-            gate: manifest.gate ?? "alignment",
-            nextAction: legacyContext
-              ? "Recompile change.context to upgrade this legacy context snapshot."
-              : headStale
-              ? "Git HEAD changed after context compilation; recompile change.context."
-              : (manifest.next_action ?? "Inspect Ultra status."),
-            readiness: legacyContext || headStale ? "blocked" : (manifest.readiness?.status ?? "ready"),
-            blockers,
-            warnings,
-            baseline: manifest.baseline ?? null,
-            taskId: manifest.selected_task?.id ?? manifest.resume?.task_id ?? null,
-            taskStatus: manifest.selected_task?.status ?? manifest.resume?.task_status ?? null,
-            tokenEstimate: manifest.context?.token_estimate ?? 0,
-            manifestPath: path.relative(current, manifestPath),
-          });
-          }
-        } catch (error) {
-          process.stderr.write(\`[ultra-builder-pro] cannot read \${manifestPath}: \${error.message}\\n\`);
-        }
-      }
-    }
-    if (statePresent || workflow || changes.length > 0) {
-      return { root: current, workflow, changes, statePresent };
-    }
+    if (fs.existsSync(ultra) && fs.statSync(ultra).isDirectory()) return current;
     const parent = path.dirname(current);
     if (parent === current) return null;
     current = parent;
   }
 }
 
-function contextText(active) {
-  const lines = [];
-  if (active.workflow) {
-    const state = active.workflow;
-    lines.push(
-      "[Ultra active workflow]",
-      \`Project: \${active.root}\`,
-      \`Command: \${state.command ?? "unknown"}\`,
-      \`Task: \${state.task_id ?? state.task ?? "unknown"}\`,
-      \`Step: \${state.step ?? "unknown"}\`,
-      \`Status: \${state.status ?? "active"}\`,
-    );
-  }
-  if (active.changes.length > 0) {
-    const change = active.changes[0];
-    lines.push(
-      "[Ultra context spine]",
-      \`Project: \${active.root}\`,
-      \`Change: \${change.id} (\${change.kind ?? "unknown"}, \${change.status ?? "active"})\`,
-      \`Task: \${change.taskId ?? "none"} (\${change.taskStatus ?? "none"})\`,
-      \`Role: \${change.role}\`,
-      \`Gate: \${change.gate}\`,
-      \`Readiness: \${change.readiness}\`,
-      ...(change.blockers.length > 0 ? [\`Blockers: \${change.blockers.join(", ")}\`] : []),
-      ...(change.warnings.length > 0 ? [\`Warnings: \${change.warnings.join(", ")}\`] : []),
-      \`Next: \${change.nextAction}\`,
-      \`Context manifest: \${change.manifestPath}\`,
-    );
-    if (active.changes.length > 1) lines.push(
-      \`Active change count: \${active.changes.length}; resolve scope with change.list before mutation.\`,
-    );
-  }
-  if (!active.workflow && active.changes.length === 0) {
-    lines.push(
-      "[Ultra baseline]",
-      \`Project: \${active.root}\`,
-      "No active continuous change. Run ultra-status; resume ultra-init when the baseline is missing, incomplete, or stale, otherwise start ultra-change.",
-    );
+function readUltraContext(directory) {
+  const root = findUltraRoot(directory);
+  if (!root) return null;
+  try {
+    const raw = execFileSync(NODE_BINARY, [BREADCRUMB_CLI, root], {
+      cwd: root,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 5000,
+    });
+    const value = JSON.parse(raw);
+    if (!value?.breadcrumb || typeof value.text !== "string" || !value.text) {
+      throw new Error("canonical breadcrumb response is incomplete");
+    }
+    return { root, breadcrumb: value.breadcrumb, text: value.text };
+  } catch (error) {
+    process.stderr.write(\`[ultra-builder-pro] cannot read canonical breadcrumb: \${error.message}\\n\`);
+    return { root, breadcrumb: null, text: null };
   }
-  lines.push("Authority: .ultra/state.db; JSON/Markdown remain projections or evidence artifacts.");
-  return lines.join("\\n");
 }
 
 function targetPaths(tool, args) {
@@ -456,19 +366,19 @@ function isTasksProjection(active, candidate) {
 
 export const UltraBuilderProPlugin = async ({ directory, worktree }) => {
   const root = worktree || directory;
-  let active = findUltraContext(root);
-  const refresh = () => { active = findUltraContext(root); };
+  let active = readUltraContext(root);
+  const refresh = () => { active = readUltraContext(root); };
   return {
     event: async ({ event }) => {
       if (["session.created", "session.compacted", "session.idle"].includes(event?.type)) refresh();
     },
     "experimental.chat.system.transform": async (_input, output) => {
       refresh();
-      if (active) output.system.push(contextText(active));
+      if (active?.text) output.system.push(active.text);
     },
     "experimental.session.compacting": async (_input, output) => {
       refresh();
-      if (active) output.context.push(contextText(active));
+      if (active?.text) output.context.push(active.text);
     },
     "tool.execute.before": async (input, output) => {
       refresh();
@@ -544,6 +454,7 @@ function install(ctx = {}) {
       host_plugin: { root: 'config', path: path.join('plugins', 'ultra-builder-pro.js') },
       mcp_config: { root: 'config', path: 'opencode.json' },
       mcp_launcher: { root: 'config', path: path.join(BUNDLE_DIR, 'runtime', 'launch.cjs') },
+      hook_event_helper: { root: 'config', path: path.join(BUNDLE_DIR, 'runtime', 'hook-event.cjs') },
     },
   });
   report.provenance.file = provenanceFile;

package/agents/review-coordinator.md

@@ -13,7 +13,8 @@ rewrite a specialist's severity.
 
 ## Required input
 
-- `SESSION_PATH`, reviewed HEAD, diff range, and expected worker list;
+- `SESSION_PATH`, review mode, reviewed HEAD, diff range, and expected worker list with
+  selection or skip rationale;
 - `SCHEMA_PATH` resolved by the parent from the active review Skill;
 - one complete `spec_fidelity` artifact;
 - every selected `engineering_standards` artifact.
@@ -24,10 +25,9 @@ rewrite a specialist's severity.
 2. Parse every expected artifact. Reject stale HEAD or range, malformed JSON, wrong
    axis, duplicate finding ids, and missing required fields. Record missing or invalid
    workers as limitations instead of silently continuing as complete.
-3. Deduplicate only findings on the same axis that describe the same root cause in the
-   same path with overlapping evidence. Preserve all source ids and agents, keep the
-   highest source severity, and retain the clearest trigger, impact, evidence, and
-   remediation. Similar symptoms with different causes remain separate.
+3. Preserve every specialist finding unchanged in `SUMMARY.json`. Group duplicate
+   root causes only in the human-readable `SUMMARY.md`; never drop, merge, rewrite, or
+   renumber their machine-readable source records.
 4. Order findings by severity, path, and line. Do not use confidence scores, reviewer
    counts, or finding-count thresholds to change severity or verdict.
 5. Set each axis to `PASS` only when its required current artifacts are complete and no
@@ -36,7 +36,10 @@ rewrite a specialist's severity.
 6. Set the overall verdict to `INCOMPLETE` when either axis is incomplete,
    `REQUEST_CHANGES` when either complete axis fails, and `APPROVE` only when both
    axes pass.
-7. Write `SUMMARY.json` as `ultra-review-summary-v2` and a concise `SUMMARY.md` with
+7. Record the review mode and every selected or skipped worker with its supplied
+   scope-specific rationale. The selection must match completed, failed, and skipped
+   worker state exactly.
+8. Write `SUMMARY.json` as `ultra-review-summary-v2` and a concise `SUMMARY.md` with
    the two axis verdicts, blocking findings, limitations, positive observations, and
    artifact paths. Validate both files before acknowledging completion.
 

package/docs/AGENT-CONTEXT.md

@@ -38,14 +38,14 @@ native command or skill -> MCP workflow-state operation -> .ultra/state.db
 | CLI | `ultra-tools`, `ubp-orchestrator` | Selected initialization, backup-first recovery, automation, and diagnostics; not a change-state mirror |
 
 `.ultra/state.db` is the only durable Ultra authority for baselines, changes, tasks,
-sessions, events, incidents, projection jobs/cursors, telemetry, review evidence,
+workflow runs/steps, sessions, events, incidents, projection jobs/cursors, telemetry, review evidence,
 and circuit-breaker state. `tasks.json`, context Markdown, execution plans, and
 reports are projections or workflow artifacts.
 
 ## 3. Live MCP and declared contracts
 
-`spec/mcp-tools.yaml` declares and the bundled server registers 36 tools across
-six families:
+`spec/mcp-tools.yaml` declares and the bundled server registers 41 tools across
+seven families:
 
 | Family | Live tools |
 |---|---|
@@ -53,6 +53,7 @@ six families:
 | `task.*` | create, update, list, get, switch_tag, delete, init_project, expand, parse_prd, dependency_topo, append_event, subscribe_events |
 | `session.*` | spawn, close, get, list, admission_check, heartbeat, subscribe_events |
 | `change.*` | create, update, get, list, context, breadcrumb, learning_propose, learning_resolve, converge, archive |
+| `workflow.*` | start, get, list, step, complete |
 | `system.*` | doctor |
 | `plan.*` | export, get |
 
@@ -60,12 +61,15 @@ Review, repository impact discovery, skill loading, and user interaction remain
 host-native capabilities rather than fake MCP contracts. The generated Codex
 capability map documents those replacements.
 
+The complete write, transition, invalidation, and recovery contract lives in
+[`WORKFLOW-LIFECYCLE.md`](./WORKFLOW-LIFECYCLE.md).
+
 Any new MCP contract starts in `spec/mcp-tools.yaml` with valid and invalid
 fixtures. Do not add an ad-hoc server handler first.
 
 ## 4. Context Spine contract
 
-Context Manifest v2 is a DB-backed role handoff, not a static codebase summary.
+Context Manifest v2 is an immutable DB-backed role handoff, not a static codebase summary.
 `change.context` compiles required references, digests, readiness, context budget,
 public seam, exact verification command, and one next action for `plan`,
 `implement`, `check`, or `review`. The default 12-file, about 12k-token, and 40%
@@ -111,10 +115,13 @@ the shared read-only `context_spine.py` breadcrumb helper:
 - `workflow_checkpoint.py` before compaction;
 - `workflow_resume.py` after compaction/resume;
 - `pre_stop_check.py` reports unfinished workflow position at stop without denial;
-- `subagent_tracker.py` for bounded worker lifecycle evidence.
+- `subagent_tracker.py` for minimal DB event evidence containing only lifecycle ids
+  and types, never transcript paths or messages.
 
-`workflow_context.py`, `active_task_context.py`, and `workflow_resume.py` read the
-same DB-derived breadcrumb through `context_spine.py`. `health_check.py` and
+`workflow_context.py`, `active_task_context.py`, `workflow_resume.py`, and the
+OpenCode plugin invoke the same bundled JavaScript `change.breadcrumb` reader
+through the thin `context_spine.py` bridge. No hook reimplements the state query.
+`health_check.py` and
 `workflow_context.py` may inspect any initialized project;
 `active_task_context.py` always protects the task projection but limits ordinary
 edit guidance to an active workflow. Compact/stop/subagent hooks remain
@@ -149,16 +156,19 @@ Archive before prune; the confirmation token is intentionally required.
 ```text
 .ultra/
 ├── state.db                 # authoritative SQLite store
-├── workflow-state.json      # active workflow/recovery checkpoint
+├── runtime/
+│   └── checkpoint.json      # advisory breadcrumb recovery projection
 ├── changes/
 │   ├── active/<id>/         # intent, delta, plan, context v2, learning, verification
 │   └── archive/             # converged packets after baseline reconciliation
 ├── tasks/                   # projections and task contexts
 ├── specs/                   # research/product/architecture artifacts
 ├── sessions/                # bounded runtime artifacts
-├── reviews/                 # review evidence
-├── test-report.json
-└── delivery-report.json
+├── reviews/                 # immutable review evidence by session id
+└── reports/
+    ├── templates/           # blank report schemas; never evidence
+    ├── tests/<workflow-id>.json
+    └── delivery/<workflow-id>.json
 ```
 
 ## 9. User handbook integration

package/docs/ARCHITECTURE.md

@@ -53,7 +53,7 @@ the supported hosts share.
 | Layer        | Role                                         | Form                                                  |
 |--------------|----------------------------------------------|-------------------------------------------------------|
 | **skill**    | knowledge carrier; tells the runtime *what to do* | `skills/<name>/SKILL.md` discovered natively by all supported runtimes |
-| **MCP**      | authoritative workflow-state and Context Spine API | stdio MCP server exposing 36 live tools across baseline/task/session/change/system/plan families in [`spec/mcp-tools.yaml`](../spec/mcp-tools.yaml) |
+| **MCP**      | authoritative workflow-state and Context Spine API | stdio MCP server exposing 41 live tools across task/session/baseline/change/workflow/system/plan families in [`spec/mcp-tools.yaml`](../spec/mcp-tools.yaml) |
 | **CLI**      | explicit initialization, recovery, diagnostics, and orchestration | `ultra-tools` / `ubp-orchestrator`; only commands listed by `--help` are executable (see [`spec/cli-protocol.md`](../spec/cli-protocol.md)) |
 
 Why three: skills give us behavior portability across runtimes; MCP gives
@@ -70,11 +70,11 @@ RPC, and host-native loaders own resolution and invocation.
 
 All durable Ultra workflow state lives in one SQLite file with WAL enabled. Schema is
 fixed in [`spec/schemas/state-db.sql`](../spec/schemas/state-db.sql) and
-covers seventeen tables:
+covers nineteen tables:
 
 | Table              | Holds                                             | Phase |
 |--------------------|---------------------------------------------------|-------|
-| `baselines`        | repository classification, greenfield/brownfield adoption, worktree snapshot, specs, evidence, verification, gap ledger, and approval | 12 |
+| `baselines`        | repository classification, greenfield/brownfield adoption, worktree snapshot, specs, evidence, verification, gap ledger, persisted known-red acceptance, and approval | 12→14 |
 | `tasks`            | task rows — id, status, deps, files_modified, …   | 2     |
 | `events`           | append-only event stream; `id` is subscription cursor (D31) | 2 |
 | `sessions`         | execution sessions, **including lease + heartbeat fields** (D32) | 4.5 |
@@ -91,6 +91,8 @@ covers seventeen tables:
 | `incidents`        | structured runtime failures and resolutions         | 8C    |
 | `projection_jobs` | durable projection outbox/retry state                | 8C    |
 | `event_consumers` | durable monotonic consumer cursors                   | 8C    |
+| `workflow_runs`   | init/research/plan/change/dev/test/review/deliver run authority, position, blockers, approval, and derived summary | 13 |
+| `workflow_steps`  | ordered step state, evidence, decisions, immutable output paths, and recorded SHA-256 digests | 13 |
 
 Two rules make this work:
 
@@ -103,12 +105,16 @@ Two rules make this work:
 2. **Single writer for mutable tables, multi-writer for `events`.**
    `.ultra/state.db` opens in WAL with `busy_timeout=5000`. The MCP
    server holds the single writer connection for `baselines`, `tasks`, `sessions`,
-   `changes`, `context_snapshots`, `spec_learning_candidates`, `telemetry`,
+   `changes`, `workflow_runs`, `workflow_steps`, `artifacts`, `context_snapshots`,
+   `spec_learning_candidates`, `incidents`, `projection_jobs`, `telemetry`,
    `specs_refs`, and `migration_history`; the CLI calls
    those tools over stdio rather than opening its own writer. The
    `events` table is append-only and explicitly multi-writer — CLI and
    orchestrator processes append directly to it under the same WAL +
    `busy_timeout` discipline, since independent INSERTs do not conflict.
+   External writers and public `task.append_event` may append observations only;
+   lifecycle event names are emitted by the mutation that owns the corresponding
+   DB transition and no event row can substitute for that transition.
    In `spec/mcp-tools.yaml` this split is captured by `writer_role: mcp`
    (must go through the MCP server) versus `writer_role: any` (any
    process may execute). Full policy lives in
@@ -143,14 +149,22 @@ produce a pre-migration backup. Compatibility state never grants baseline approv
 references, bounded repository/runtime evidence, actual verification results,
 known unknowns, repository branch and worktree snapshot, the categorized gap ledger,
 and metadata-only external provider references, and
-`baseline.converge` records explicit owner approval. A ready baseline is replaced
-only by an explicit re-adoption, preserving the superseded row for recovery.
+`baseline.converge` records explicit owner approval, including a durable
+`known_red_accepted` decision when applicable. Read paths continuously revalidate
+ready authority: scope, three specifications, source/runtime evidence, verification,
+known-red rationale and acceptance, research provenance and output digests, repository
+revision/worktree state, blocking gaps and unknowns, approver, and convergence time.
+A row cannot become trusted merely because its stored status says `ready`. A ready
+baseline is replaced only by an explicit re-adoption, preserving the superseded row
+for recovery.
 For a selected monorepo scope, the worktree digest and dirty-file list include only
 that scope; out-of-scope changes remain visible repository context but cannot be
 accepted implicitly by `accept_dirty_worktree`.
 
-New ordinary changes require a healthy `ready` baseline. A change that was already
-active may continue with baseline drift surfaced as a warning. A new incident can
+New ordinary changes require a healthy `ready` baseline. An active ordinary change may
+continue through only the expected HEAD/worktree/spec/source drift created after its
+durable `bind-baseline` step; loss of ready approval, missing evidence, blocking gaps,
+or any other structural defect stops task/context/stage progression. A new incident can
 start on an unhealthy baseline only with an explicit reason and approver stored in
 `baseline_bypass_json`. Ordinary convergence and archive reconcile HEAD, worktree,
 and tracked-spec drift atomically. Break-glass incident archive creates an open
@@ -167,7 +181,7 @@ active -> blocked -> active -> ready -> archived
    |                              |
    ├─ intent + delta + plan       └─ verification + baseline reconciliation
    ├─ linked tasks
-   ├─ context-manifest v2 (role + gate + readiness + execution seam)
+   ├─ immutable context snapshots (role + gate + readiness + execution seam)
    └─ spec-learning candidates (proposed -> approved/rejected -> applied)
 ```
 
@@ -178,22 +192,35 @@ impact, and no open incident. Memory and graph payloads never enter Ultra;
 
 ### Context Spine
 
-Context Manifest v2 is the handoff contract between planning, implementation,
-checking, review, convergence, and recovery. Each snapshot records:
+Context Manifest v2 is the immutable handoff contract between planning,
+implementation, checking, review, convergence, and recovery. Each snapshot records:
 
 - one role (`plan`, `implement`, `check`, or `review`) and lifecycle gate;
 - required context references with local digests and reasons;
 - readiness blockers for missing/stale required references or an incomplete
   execution contract;
 - advisory attention budgets (12 files / about 12k tokens / 40% by default);
-- an execution contract (`slice_kind`, public seam, exact verification command);
+- a DB-derived execution contract (`slice_kind`, public seam, exact verification command);
 - one deterministic next action.
 
+Prompt input may identify the intended role/gate, add bounded reference candidates,
+and lower advisory budgets. It cannot supply or override the task seam, verification
+command, task context references, evidence digest, gate verdict, workflow summary, or
+next action. Critical change/dev/test/review/deliver workflow steps record the matching
+snapshot as an output; test, review, and delivery reports carry its digest forward.
+
 `change.breadcrumb` derives the compact current position from state.db. Session,
-edit, and resume hooks inject only this breadcrumb, never the intent body,
+edit, resume, and OpenCode lifecycle hooks invoke one bundled read-only reader
+and inject only this breadcrumb, never the intent body,
 provider content, or a conversation summary. A changed git HEAD marks the
 snapshot stale and routes back to `change.context`.
 
+PRD decomposition and complex-task subdivision use the active host model. The
+MCP accepts the resulting structured tasks, validates schema, topology,
+baseline/change ownership, and transaction boundaries, then persists them. It
+does not call Anthropic, OpenAI, or another model provider and needs no separate
+model API credential.
+
 File count, token estimate, and context-share overflow produce warnings, never a
 refusal. The agent may narrow reads, load files lazily, or split a slice when that
 preserves correctness; it must not raise a threshold merely to clear a gate or
@@ -308,6 +335,7 @@ shippable; downstream slip never blocks an earlier release.
 | Exact SQLite schema?                               | [`spec/schemas/state-db.sql`](../spec/schemas/state-db.sql) |
 | What does a tasks.json look like after projection? | [`spec/fixtures/valid/tasks.v4.5.json`](../spec/fixtures/valid/tasks.v4.5.json) |
 | Phase-by-phase work breakdown + decision log       | [`docs/PLAN.zh-CN.md`](./PLAN.zh-CN.md)             |
+| When does each workflow write, invalidate, and converge state? | [`docs/WORKFLOW-LIFECYCLE.md`](./WORKFLOW-LIFECYCLE.md) |
 
 ## 10. Verifying the architecture
 

package/docs/PLAN.zh-CN.md

@@ -10,8 +10,9 @@
 > Kimi Code 采用各自 native plugin 呈现，其他旧 runtime adapter 已退役。下文所有与此冲突的
 > memory/hindsight 章节仅作为历史实施记录，不再是当前需求或运行时契约。
 
-**当前状态**：v0.13.0；四宿主 native plugin、36 个 live MCP tool、
-schema 12.0（17 表）、portable Skill authoring contract、双轴 review、
+**当前状态**：v0.15.0；四宿主 native plugin、41 个 live MCP tool、
+schema 15.0（19 表）、typed research semantics、complete Change Contract、
+acceptance coverage、mode-bound 双轴 review、verified learning/reconciliation provenance、
 Context Spine v2 / breadcrumb / spec-learning、持续 change/context/convergence/doctor、incident debug lane、
 checkpoint 恢复消费与跨宿主安装 provenance/doctor 已落地；npm 发布由
 `v*.*.*` tag 触发。以下 Phase 0-9 正文保留为 2026-04 的实施历史，不再作为

package/docs/ROADMAP.md

@@ -13,7 +13,7 @@ sharing one authoritative workflow store.
 
 **Distribution channels (v1.0)**: npm · Homebrew · pip.
 
-**Release line**: `0.11.x`; every release is gated by `npm run verify:release`.
+**Release line**: `0.14.x`; every release is gated by `npm run verify:release`.
 
 ---
 
@@ -45,24 +45,27 @@ sharing one authoritative workflow store.
 | 8C    | Continuous change packets + context compiler + convergence + doctor | ✅ done (D52) |
 | 10    | Context Spine v2 + breadcrumb + fresh-context budget + spec learning + two-axis review | ✅ done |
 | 11    | Greenfield/brownfield baseline adoption + advisory context budgets + convergence gate | ✅ done |
+| 12    | Repository evidence snapshots + gap ledger + migration re-adoption + incident governance | ✅ done |
+| 13    | Durable init-to-delivery workflows + task execution contracts + immutable stage evidence | ✅ done |
 | 9     | Release pipeline                               | npm tag publishing live; Homebrew / pip not implemented |
 
 ## What is in the repo today
 
 ```
 spec/                       ← Phase 1 single source of truth
-├── mcp-tools.yaml          (36 live tools across 6 families)
+├── mcp-tools.yaml          (41 live tools across 7 families)
 ├── cli-protocol.md         (CLI ↔ MCP mapping table)
 ├── schemas/                (state-db.sql + 4 JSON schemas)
 ├── fixtures/{valid,invalid}/  (+ v4.4-project for migration)
 └── scripts/test-all.cjs    (npm run test:spec — 7 validation stages)
 
 mcp-server/                 ← Phase 2 authoritative state layer
-├── server.cjs              (stdio MCP server, 36 baseline/task/session/change/system/plan tools)
+├── server.cjs              (stdio MCP server, 41 task/session/baseline/change/workflow/system/plan tools)
 ├── lib/
 │   ├── state-db.cjs        (SQLite + WAL + pragmas)
 │   ├── state-ops.cjs       (full write API, status state machine)
 │   ├── baseline-workflow.cjs (project adoption + approval + reconciliation)
+│   ├── workflow-state.cjs  (ordered stage runs, evidence, output digests, and gates)
 │   └── projector.cjs       (state.db → tasks.json + context md)
 └── tests/                  (npm run test:state)
 
@@ -70,7 +73,7 @@ ultra-tools/                ← CLI fallback, migration, and diagnostics
 ├── cli.cjs
 └── commands/
     ├── db.cjs              (init/checkpoint/vacuum/integrity/backup)
-    ├── migrate.cjs         (v4.4 projection → v4.5 authority; v4.5 projection → schema 12; dry/rollback)
+    ├── migrate.cjs         (v4.4 projection → v4.5 authority; v4.5 projection → current schema; dry/rollback)
     └── legacy-memory.cjs   (explicit inspect/archive/confirmed prune)
 
 bin/install.js              ← multi-runtime installer
@@ -81,6 +84,7 @@ hooks/                      ← 7 executable workflow hooks + shared Context Spi
 docs/
 ├── PLAN.zh-CN.md                historical phase plan + decision log
 ├── ARCHITECTURE.md              Phase 1 single-page entry point
+├── WORKFLOW-LIFECYCLE.md        baseline classification + DB transition contract
 ├── AGENT-CONTEXT.md             Phase 3 canonical runtime context contract
 ├── USER-HANDBOOK-CONTRACT.md    managed CLAUDE.md / AGENTS.md boundary
 ├── RUNTIME-COMPAT-MATRIX.md     Phase 4 runtime capability matrix
@@ -101,5 +105,5 @@ npm audit
 ## Out of scope for v1.0 (deferred)
 
 PLAN §13 lists Copilot / Cursor / Windsurf / 7 more runtimes, web
-dashboard / TUI, LLM provider abstraction, team-collab server, plugin
+dashboard / TUI, team-collab server, plugin
 marketplace.

package/docs/RUNTIME-COMPAT-MATRIX.md

@@ -46,7 +46,7 @@ not presented as nonexistent custom agents.
 
 | Lifecycle | Claude Code | OpenCode | Codex | Kimi Code 0.26+ |
 |---|---|---|---|---|
-| Session context/health | FULL, DB-derived Context Spine breadcrumb on native `SessionStart` | DEGRADED, projected v2 breadcrumb; health via `system.doctor` | FULL, DB-derived breadcrumb on native `SessionStart` | FULL, DB-derived breadcrumb via session-start skill + hooks |
+| Session context/health | FULL, DB-derived Context Spine breadcrumb on native `SessionStart` | FULL, the native JS plugin invokes the same bundled DB breadcrumb reader; health via `system.doctor` | FULL, DB-derived breadcrumb on native `SessionStart` | FULL, DB-derived breadcrumb via session-start skill + hooks |
 | Active edit boundary | FULL, `PreToolUse Edit|Write` | FULL, `tool.execute.before` rejects projection writes | FULL, `PreToolUse Edit|Write|apply_patch` | FULL, native `PreToolUse Edit|Write` deny contract |
 | Pre-compact checkpoint | FULL | FULL | FULL | FULL, native `PreCompact` |
 | Post-compact context injection | FULL | FULL, native compacting context | FULL, native `PostCompact` restore | DEGRADED; checkpoint restoration runs, but Kimi 0.26/0.27 does not reinject fire-and-forget hook text |
@@ -71,15 +71,15 @@ they do not deny edits or stop active incident work.
 | Capability | Claude Code | OpenCode | Codex | Kimi Code 0.26+ |
 |---|---|---|---|---|
 | stdio MCP registration | plugin `.mcp.json` | `opencode.json` local MCP entry | plugin `.mcp.json` | plugin `mcpServers` entry |
-| Live/declared contracts | 36 | 36 | 36 | 36 |
+| Live/declared contracts | 41 | 41 | 41 | 41 |
 | Greenfield/brownfield baseline adoption | FULL | FULL | FULL | FULL |
-| Context Spine v2 / breadcrumb | FULL | FULL, DB-generated projection consumed by native JS | FULL | FULL |
+| Context Spine v2 / breadcrumb | FULL | FULL, same bundled read-only DB reader as every hook | FULL | FULL |
 | Approval-gated spec learning | FULL | FULL | FULL | FULL |
 | Host-native review/discovery/ask | native | native | documented in `codex-capability-map.json` | native Kimi tools and workers |
 | Durable authority | project `.ultra/state.db` | project `.ultra/state.db` | project `.ultra/state.db` | project `.ultra/state.db` |
 | Ultra memory API | N/A | N/A | N/A | N/A |
 
-All 36 `baseline.*`, `task.*`, `session.*`, `change.*`, `system.*`, and `plan.*` operations
+All 41 `task.*`, `session.*`, `baseline.*`, `change.*`, `workflow.*`, `system.*`, and `plan.*` operations
 registered by `mcp-server/server.cjs` are live. Review, impact discovery, skill
 loading, and user interaction remain host-native surfaces.
 
@@ -126,9 +126,9 @@ records. Uninstall refuses an unmanaged or conflicting root.
 
 | Capability | Contract |
 |---|---|
-| Current state schema | `11.0` |
+| Current state schema | `15.0` |
 | Runtime values | `claude`, `opencode`, `codex`, `kimi` |
-| Upgrade from earlier schema | preserves runtime rows, adds Context Spine state through 10.0, then adds authoritative baseline adoption state transactionally in 11.0 |
+| Upgrade from earlier schema | preserves runtime rows, adds Context Spine state through 10.0, authoritative baseline adoption in 11.0, repository evidence in 12.0, durable workflows in 13.0, continuous baseline revalidation in 14.0, then typed research semantics, complete Change Contracts, verified learning application, and reconciliation provenance in 15.0 |
 | Preservation gate | rows, IDs, indexes, foreign keys, telemetry, incidents, and migration history remain intact |
 | Failure behavior | rollback; no partially upgraded authority database |