ultra-builder-pro-cli 0.19.1 → 0.21.1

package/skills/ultra-plan/SKILL.md

@@ -11,21 +11,47 @@ accepted Change Contract without adding ceremonial approval.
 
 ## Bind current authority
 
-1. Read doctor, baseline, change, decisions, existing plan runs, tasks, and current
-   checkout.
+1. Read doctor, baseline, change, breadcrumb `accepted_intent`, decisions, existing plan
+   runs, tasks, and current checkout.
 2. Require one mutable change with a healthy baseline or recorded incident bypass.
+   For the first delivery of a greenfield project, an accepted ready baseline may
+   already contain the complete delivery outcome. When no matching Change exists,
+   materialize one `change.create` contract from that accepted intent and read it back
+   without asking the owner to repeat the same choice. Do not invent scope, expand an
+   incomplete baseline, or use this shortcut for a later change.
 3. Complete the exact change-bound research disposition before planning.
-4. Resume the matching plan run or start one bound to the change and baseline.
+4. For a standard or major Change, read the current registered `change.delta` and
+   verify its baseline anchors and digest. A Direct Build route supplies the delta
+   directly from accepted intent; it skips Research, not this authority boundary.
+5. Resume the matching plan run. Do not start a new run until planning posture is
+   accepted.
 
 Read `references/semantic-preflight.md` and inspect requirements, real consumers,
 state, tests, deployment, and recovery paths.
 
+## Align planning posture
+
+Use the interaction protocol in `../ultra-think/references/decision-dialogue.md`.
+Normalize a posture already explicit in current intent. Otherwise recommend one based
+on the Change Contract, explain its scope effect, and use the host's native question
+surface:
+
+- `EXPAND`: surface evidence-backed opportunities beyond accepted scope;
+- `SELECTIVE`: hold accepted scope and offer optional expansions individually;
+- `HOLD`: preserve scope and strengthen completeness, failure handling, and recovery;
+- `REDUCE`: propose the smallest outcome that still satisfies revised acceptance.
+
+The user may select, modify, delegate, or defer the posture. Stop on an unanswered
+choice. Start `workflow.start` only after alignment and store `planning_posture` plus
+its rationale in workflow metadata. This is a scope boundary, not approval of the
+eventual technical design.
+
 ## Design with model autonomy
 
-Build a candidate plan privately. Ask the user only if the plan would change accepted
+Build a candidate plan from the Change Contract, current typed delta, and any selected
+research. Ask the user only if the plan would change accepted
 scope, public behavior, compatibility, security, material cost, external effects, or
-recovery. Use the host's native question UI when available and the interaction protocol
-in `../ultra-think/references/decision-dialogue.md`.
+recovery. Use the same host-native interaction protocol.
 
 When the candidate remains inside the accepted Change Contract, proceed without a
 second approval. A user may still request a plan review before persistence; that is an
@@ -34,26 +60,42 @@ interaction preference, not a runtime invariant.
 Record:
 
 1. `validate-baseline`
-2. `analyze-requirements`
-3. `analyze-codebase`
-4. `design-slices`
-5. `validate-dependencies`
-6. `persist-task-contracts`
-7. `verify-plan`
+2. `compile-context`
+3. `analyze-requirements`
+4. `analyze-codebase`
+5. `design-slices`
+6. `validate-dependencies`
+7. `persist-task-contracts`
+8. `verify-plan`
 
 Design a walking skeleton and subsequent vertical slices. Every slice reaches a real
 consumer and owns its validation, side effects, errors, documentation, migration,
 observability, and recovery obligations. Avoid unconsumed horizontal scaffolding.
 
+After starting or resuming the workflow, compile `change.context` with `role: plan`
+and `gate: planning`. Record its immutable manifest as the `compile-context` output.
+The packet is the accepted planning input, not a mutable plan draft. `change.context`
+must not update Change provider references; persist new provider metadata with
+`change.update` before recompiling.
+
 ## Persist task contracts
 
 Create each task with:
 
-- observable outcome and stable trace;
+- observable outcome (`purpose`) and stable trace (`why`);
 - `slice_kind`, public seam, and exact verification command;
 - structured acceptance mapped to Change acceptance ids;
-- bounded context refs and reasons;
-- documentation impact, ownership, dependencies, and affected files when known.
+- target seams and affected files when known;
+- bounded pattern/context refs with a reason, optional anchor and scope, and an
+  explicit freshness policy;
+- documentation impact, ownership, and dependencies.
+
+Use `digest` freshness with `expected_digest` for accepted inputs that must remain
+byte-current. Use `existence` for source targets expected to change during
+implementation. Use `advisory` only when drift should be visible but non-blocking.
+The compiled task context restores constraints and non-goals from the Change Contract,
+plus acceptance, recovery, documentation impact, and the definition of drift. Keep
+large referenced files lazy; do not paste their bodies into the plan packet.
 
 Use estimates only when evidence supports them. A quick change has exactly one task.
 Read every task back from DB. Never read or write `.ultra/tasks/tasks.json` directly;
@@ -66,8 +108,13 @@ evidence. Rebind the complete execution contract while clearing `stale` through
 the current Change authority digest. Never clear staleness merely to pass a gate.
 
 Validate the change-scoped graph with `task.dependency_topo`. Export
-`.ultra/execution-plan.json` with `plan.export`, read it through `plan.get`, and record
-it as the `verify-plan` output.
+the deterministic `<artifact_root>/plan.json` and `<artifact_root>/plan.md` pair with
+`plan.export { change_id }`. The JSON binds the exact planning context snapshot and
+manifest digest; the Markdown is a deterministic human view of the same task graph.
+Read the JSON through `plan.get` and record it as the `verify-plan` output. Do not
+choose an arbitrary output path or overwrite another Change's plan. A legacy global
+`.ultra/execution-plan.json` may be read for migration diagnosis only and is never a
+current write target.
 
 Call `workflow.complete`. `approval` is optional: include it only when a material plan
 decision actually required and received user approval. MCP derives task coverage and
@@ -75,8 +122,11 @@ topology from DB and must reject incomplete contracts, uncovered acceptance, cyc
 cross-change tasks, stale research, or a mismatched export.
 
 Do not advance or complete the Change workflow; change capture is already complete.
-Compile task context later for the consumer that needs it.
+Compile a separate task context later for each consumer that needs it. Planning,
+implementation, testing, review, and convergence snapshots are not interchangeable.
 
 Return topology, first executable slices, public seams, verification commands, plan
 workflow id, and allowed transitions. The host may recommend parallel or sequential
 execution based on dependency and conflict evidence.
+
+Never invoke the recommended capability here; wait for an explicit user invocation.

package/skills/ultra-research/SKILL.md

@@ -1,36 +1,39 @@
 ---
 name: ultra-research
-description: Build or refresh an evidence-backed product and architecture baseline with model-selected semantic coverage and low-load user alignment. Use when initialization, brownfield adoption, or an active change has a real evidence gap.
+description: Build or refresh an evidence-backed product and architecture baseline through recommended, user-selected semantic coverage and low-load alignment. Use when initialization, brownfield adoption, or an active change has a real evidence gap.
 ---
 
 # Research with adaptive coverage
 
-The host model owns investigation, synthesis, and coverage judgment. Ultra MCP owns the
-run, evidence references, semantic records, artifact digests, freshness, and
-convergence. The reference areas are an optional coverage catalog, not a mandatory
-questionnaire or a fixed sequence of user conversations.
+The model owns investigation, synthesis, and coverage recommendations; the user owns
+the accepted semantic route and material deferrals. MCP owns run state, evidence,
+semantic records, digests, freshness, and convergence, not a questionnaire.
 
 Read `../ultra-think/references/decision-dialogue.md` before asking a material question.
 
 ## Bind authority
 
-1. Read `system.doctor`, `baseline.get`, active decisions, and existing research runs.
+1. Read `system.doctor`, `baseline.get`, breadcrumb `accepted_intent`, active decisions,
+   and existing research runs.
 2. Resume the matching active, blocked, or ready run. Do not create parallel authority.
-3. If none exists, select:
-   - `full` for a greenfield baseline;
-   - `adoption` for a brownfield baseline;
-   - a bounded mode only for a recorded active-change research disposition.
+3. If none exists, use `full` for greenfield, `adoption` for brownfield, or a bounded
+   mode only for a recorded active-Change disposition. Focused baseline coverage
+   remains `full` or `adoption`; `custom` is Change-bound only.
 4. Before `workflow.start`, inspect current code, docs, tests, runtime, and prior
-   artifacts. Select the smallest sufficient set of applicable catalog areas. Include
-   only areas that need work or whose exclusion must remain auditable:
-   - `execute`: produce fresh evidence;
-   - `verify_existing`: verify a current artifact against its source;
-   - `reuse`: reuse evidence that is still current;
-   - `not_applicable`: exclude with an evidence reference and rationale;
-   - `deferred`: record the consequence and owner acceptance when deferral changes the
-     accepted scope or leaves material risk.
-5. Pass the evidence-based coverage rationale as `metadata.selection_reason`. Omitted
+   artifacts. Recommend the smallest sufficient set of applicable catalog areas.
+   Explain the net effect without dumping all 17 areas. Offer at most three credible
+   routes: the recommended adaptive set, the full catalog, and a focused or custom set.
+5. If current user intent does not already select a route, use the host's native
+   structured question surface. The user selects, modifies, delegates, or defers.
+   Treat a dismissal as unanswered, stop, and perform no route-dependent write.
+6. Normalize the answer and persist the accepted coverage through `workflow.start`.
+   Use `execute` for fresh evidence, `verify_existing` for source validation, `reuse`
+   for current evidence, `not_applicable` with evidence and rationale, or `deferred`
+   with consequence and owner acceptance when scope or material risk changes.
+7. Pass the evidence-based coverage rationale as `metadata.selection_reason`. Omitted
    catalog areas create no DB step and need no ceremonial disposition.
+8. Read back the created workflow and accepted coverage. When a durable decision thread
+   recorded the route, complete it with the workflow reference in `applied_refs`.
 
 `99-synthesis` must execute, verify, or reuse. A missing disposition is a coverage
 error only for an included area; a recorded exclusion with evidence is not incomplete.
@@ -69,15 +72,20 @@ For each active area:
    artifact. Do not copy prompts, transcripts, provider payloads, or internal chain of
    thought.
 
-For every required workflow step, write
-`.ultra/docs/research/<workflow-id>/<step-id>.md` with `Evidence`,
-`Specification updates`, and `Decisions and unknowns`. Call `workflow.step` with
-bounded evidence, the report output, and typed semantic records. Reused or verified
-evidence must still produce a current report and digest. Block the same step when
-required evidence or owner authority is missing.
+Every required step writes `Evidence`, `Specification updates`, and `Decisions and
+unknowns` to `.ultra/docs/research/<workflow-id>/<step-id>.md` for a baseline, or
+`<change-root>/research/<workflow-id>/<step-id>.md` for an active Change.
+
+Call `workflow.step` with bounded evidence, the report output, and typed semantic
+records. Reused or verified evidence must still produce a current report and digest.
+Block the same step when required evidence or owner authority is missing. For Change
+research, keep `findings.md` and every semantic output inside the same Change root and
+register them through workflow outputs; do not write baseline specifications.
 
 At synthesis, bind the current `discovery.md`, `product.md`, `architecture.md`, and
-`research-distillate.md` for initial/adoption research.
+`research-distillate.md` only for initial/adoption research. Change-bound synthesis
+updates the Change findings and specification overlay, then records or refreshes
+`change.delta`. It never mutates the accepted baseline.
 
 ## Baseline convergence
 
@@ -96,11 +104,16 @@ known failures, blocking gaps, and scope. Reuse an unambiguous current approval;
 ask twice. MCP must reject stale research, drift, missing evidence, and unaccepted
 failures.
 
-Reuse the final research checkpoint approval during baseline convergence; do not ask
-for an equivalent approval again. After initial or adoption convergence,
-`ultra-change` becomes an available transition. Bounded change research returns to
-its owning Change authority.
+Reuse the final research acceptance or current artifact checkpoint during baseline
+convergence; do not ask for an equivalent approval again. After initial or adoption
+convergence, `ultra-change` becomes an available transition. Bounded change research
+returns to its owning Change authority; the next route is still `ultra-plan`, never
+direct implementation.
 
 Return a compact coverage summary by disposition, current evidence or decision
-blocker, baseline state, gaps, and allowed transitions. The host chooses the semantic
-recommendation; MCP supplies only valid and required transitions.
+blocker, baseline state, gaps, and allowed transitions. Recommend a semantic next
+action from those transitions. If current intent does not already select it, present
+the recommendation and credible alternatives through the interaction protocol, then
+wait. MCP supplies only valid and required transitions.
+
+Never invoke the recommended capability here; wait for an explicit user invocation.

package/skills/ultra-review/SKILL.md

@@ -18,7 +18,7 @@ Neither axis can compensate for the other.
 1. Read `references/review-modes.md` and select `plan`, `task`, or `change` from the
    actual review request.
 2. Bind one explicit diff or plan artifact, full HEAD, worktree digest, task set,
-   acceptance, and current decision state.
+   acceptance, breadcrumb `accepted_intent`, and current decision state.
 3. Resume or start the review workflow and record `bind-diff`.
 4. Compile `change.context` for `review` and record the immutable manifest under
    `compile-context`.
@@ -37,8 +37,9 @@ not decide owner choices or edit source.
 
 Resolve `references/unified-schema.md` from this Skill directory and pass its absolute
 path as `SCHEMA_PATH`. Validate specialist artifacts with
-`scripts/review_wait.py`. Record outputs under `review-specification`,
-`review-engineering`, and `coordinate-findings`.
+`scripts/review_wait.py`. Store all specialist artifacts and `SUMMARY.json` below
+`.ultra/changes/active/<change-id>/review/<workflow-id>/`. Record outputs under
+`review-specification`, `review-engineering`, and `coordinate-findings`.
 
 The coordinator preserves every finding unchanged in `SUMMARY.json`; it may group
 duplicate root causes only in the human summary. A new material owner choice remains a
@@ -52,5 +53,8 @@ the durable verdict and rejects missing specialists, lossy coordination, stale
 artifacts, or prompt-supplied conclusions.
 
 Any relevant code, test, specification, or contract edit invalidates the affected
-review evidence. Return both verdict axes, blocking findings, reviewed scope, worker
-selection rationale, artifact digests, and allowed transitions.
+review evidence through registered provenance edges; unrelated evidence remains
+current. Return both verdict axes, blocking findings, reviewed scope, worker selection
+rationale, artifact digests, and allowed transitions.
+
+Never invoke the recommended capability here; wait for an explicit user invocation.

package/skills/ultra-status/SKILL.md

@@ -13,9 +13,11 @@ frontmatter when DB authority is missing or degraded.
 1. Run `system.doctor` without repair.
 2. Read baseline classification, revision, worktree, research provenance, gaps, and
    health.
-3. Read current decision state without exposing hidden future questions.
+3. Read current decision state and breadcrumb `accepted_intent` without exposing hidden
+   future questions.
 4. Read active, blocked, and ready workflows and their current steps.
-5. Read breadcrumb, changes, tasks, sessions, and current Git state.
+5. Read the active Change root, typed delta, plan, deterministic progress projection,
+   documentation reconciliation, findings, tasks, sessions, and current Git state.
 6. Read test, review, and delivery artifacts only through DB references and verify
    their digests and revisions.
 
@@ -42,8 +44,9 @@ Ultra: <healthy|degraded> · <branch>@<head|unborn|non-git> · worktree <state>
 Baseline: <mode>/<status> · research=<run/status> · gaps=<open>/<blocking>
 Workflow: <kind/id/status> · step=<current|complete> · outputs=<fresh|stale>
 Decision: <current|checkpoint|none>
-Change: <id/status|none> · Task: <id/status|none> · Sessions: <active>
-Evidence: test=<state> · review=<axes> · delivery=<state>
+Change: <id/status|none> · delta=<fresh|stale|missing> · docs=<fresh|stale|missing>
+Task: <id/status|none> · Sessions: <active>
+Evidence: plan=<state> · test=<state> · review=<axes> · delivery=<state>
 Blockers: <codes or none>
 Warnings: <codes or none>
 Allowed transitions: <capabilities>
@@ -52,3 +55,5 @@ Host recommendation: <capability and concise rationale>
 ```
 
 Separate verified facts, host inference, and unavailable evidence.
+
+Never invoke the recommended capability here; wait for an explicit user invocation.

package/skills/ultra-test/SKILL.md

@@ -10,8 +10,8 @@ projections as proof.
 
 ## Bind scope
 
-1. Read doctor, change, breadcrumb, decisions, task and dev evidence, current checkout,
-   and prior report freshness.
+1. Read doctor, change, breadcrumb `accepted_intent`, decisions, task and dev evidence,
+   current checkout, and prior report freshness.
 2. Resume or start a test workflow bound to the exact change and optional task.
 3. Record `bind-scope`, then compile `change.context` for `check` and record its
    immutable manifest under `compile-context`.
@@ -47,10 +47,12 @@ question UI and decision protocol; testing must not choose the desired outcome.
 
 ## Report
 
-Write `.ultra/reports/tests/<workflow-id>.json` with
+Write
+`.ultra/changes/active/<change-id>/test/<workflow-id>/report.json` with
 `ultra-test-report-v1`, binding:
 
-- change, exact task ids, HEAD, worktree digest, and checking-context digest;
+- change, exact task ids, current Change acceptance ids, HEAD, worktree digest, and
+  checking-context digest;
 - acceptance mapping, commands, public seams, failures, and recovery evidence;
 - `verification_profile` and the selected `verification_dimensions`;
 - regression signal when required;
@@ -58,8 +60,14 @@ Write `.ultra/reports/tests/<workflow-id>.json` with
 
 Record `execute-checks`, `verify-public-seam`, and `write-report`, then re-read the
 report and current checkout before `verify-test-gate`. `workflow.complete` derives its
-summary from the report and rejects stale, malformed, or contradictory evidence.
+summary from the report and rejects stale, malformed, contradictory, out-of-Change,
+or acceptance-incomplete evidence.
 
 Return the profile, exact results, verified seams, blockers, report digest, workflow
-state, and allowed transitions. The host decides whether a broader review, more
-implementation, or delivery is appropriate.
+state, and allowed transitions. Recommend broader review, more implementation, or
+delivery from those transitions. If current intent does not already select the
+semantic next action, use
+`../ultra-think/references/decision-dialogue.md` and wait for the user to select,
+modify, delegate, or defer it.
+
+Never invoke the recommended capability here; wait for an explicit user invocation.

package/skills/ultra-think/SKILL.md

@@ -37,6 +37,10 @@ Do not expose the hidden decision queue.
 For durable project decisions, use `decision.thread_start`, `decision.open`, and the
 appropriate resolve, delegate, defer, or supersede transition. Store normalized
 decisions and artifact references, never transcripts or internal reasoning.
+Apply any resulting change through its owning baseline, change, workflow, task, or
+semantic artifact operation, read it back, and pass typed `applied_refs` to
+`decision.complete`. If the decision record itself is the complete durable authority,
+the list may be empty. Completion is not another owner approval.
 
 Prepare and confirm a checkpoint only when the decision changes a durable contract or
 artifact and a checkpoint is needed for recovery. Do not add a ceremonial approval
@@ -49,3 +53,5 @@ contracts. Re-read the invoking workflow or breadcrumb and recommend one of its
 `allowed_transitions`; follow `required_transition` only when a hard invariant leaves
 no alternative. Thinking does not implement code, mutate unrelated state, or invent a
 canonical next action.
+
+Never invoke the recommended capability here; wait for an explicit user invocation.

package/skills/ultra-think/references/decision-dialogue.md

@@ -10,6 +10,7 @@ The user owns:
 
 - product intent and accepted outcomes;
 - material scope, compatibility, security, cost, and recovery tradeoffs;
+- semantic route selection and risk acceptance;
 - authorization for destructive or external effects.
 
 The model owns:
@@ -22,15 +23,40 @@ The model owns:
 MCP owns durable state, evidence references, digests, freshness, locks, valid
 transitions, and hard invariants. It does not choose semantic intent.
 
+## Follow the common selection flow
+
+1. **Inspect** repository authority, source, runtime, tests, and relevant primary
+   sources.
+2. **Suggest** one recommendation and only credible alternatives, with their effects.
+3. **Ask** through the host-native structured question surface only when current user
+   intent does not already resolve the material choice.
+4. **Normalize** a direct choice, modified route, delegation, or deferral. Treat a
+   dismissed question as unanswered.
+5. **Persist** the normalized result through MCP, then trust the DB record as current
+   authority across sessions.
+6. **Apply** the result to its owning baseline, change, workflow, task, specification,
+   or artifact when that authority has a corresponding field or content boundary.
+7. **Read back** the normalized decision and every changed owning authority before
+   continuing.
+
+The DB treats normalized intent as current authority. It does not prove that the user
+selected it, store a host interaction receipt, or judge whether the choice was wise.
+The host interaction is the semantic gate; MCP validates state shape, bindings,
+freshness, and legal transitions.
+
+When an unanswered material question must survive interruption, `decision.open` stores
+that pending question before the host presents it. A pending question is recovery
+state, not accepted user intent. Only the normalized resolution becomes intent
+authority.
+
 ## Decide whether to ask
 
 Before asking:
 
-1. Inspect repository authority, source, runtime, tests, and relevant primary sources.
-2. Separate `Observed`, `Verified`, `Decided`, `Delegated`, and `Unknown`.
-3. Resolve evidence-answerable unknowns autonomously.
-4. Normalize clear decisions already present in the user's current request.
-5. Ask only if the remaining choice changes accepted intent, public behavior,
+1. Separate `Observed`, `Verified`, `Decided`, `Delegated`, and `Unknown`.
+2. Resolve evidence-answerable unknowns autonomously.
+3. Normalize clear decisions already present in the user's current request.
+4. Ask only if the remaining choice changes accepted intent, public behavior,
    compatibility, security, material cost, external effects, or recovery.
 
 Do not ask about a reversible implementation detail already delegated by the contract.
@@ -50,8 +76,11 @@ that choice itself changes the outcome.
 ## Present questions
 
 Use the host-native structured question surface declared by the installed interaction
-contract when it exists. If that surface is unavailable in the current mode, ask one
-concise direct question instead of inventing a tool or foreign-host syntax.
+contract when it exists. If that surface is unavailable but normal conversation is
+permitted, ask one concise direct question instead of inventing a tool or foreign-host
+syntax. If the host mode forbids interaction entirely, keep the choice unanswered and
+stop before any route-dependent write. Do not convert host unavailability into
+delegated authority.
 
 Ask one question only for a dependent decision. STOP is mandatory after presenting
 that question: do not perform writes whose meaning depends on an unanswered choice.
@@ -70,27 +99,40 @@ low-cognitive-load facts when seeing them together improves consistency. Never d
 questionnaire, hidden queue, or every research area.
 
 The question tool or direct question ends the current interaction naturally.
+A dismissed or unavailable response is not acceptance of the recommendation.
 
-## Persist only when recovery needs it
+## Persist normalized authority
 
 For a project-bound material decision:
 
-1. Call `decision.list` and resume a matching active decision thread, or use
-   `decision.thread_start` for one new baseline-, change-, or workflow-bound thread.
-2. Use `decision.open` for only the current decision with evidence refs, recommendation, credible
-   alternatives, effects, and blocking consequence.
+1. Read breadcrumb `accepted_intent`, call `decision.list`, and resume a matching active
+   decision thread, or use `decision.thread_start` for one new baseline-, change-, or
+   workflow-bound thread.
+2. Use `decision.open` before presenting only the current decision, with evidence refs,
+   recommendation, credible alternatives, effects, and its real blocking consequence.
+   A non-blocking follow-up must not become a global workflow gate.
 3. After the answer:
    - `decision.resolve` for a direct user choice;
    - `decision.delegate` for explicit model delegation;
    - `decision.defer` with consequence and revisit condition;
    - `decision.supersede` when accepted intent actually changed.
-4. Use `decision.checkpoint` only for the digest-bound recovery boundary described
-   below.
+4. Apply the normalized result through the owning MCP operation or update the smallest
+   relevant semantic artifact. Do not leave a material answer only in conversation.
+5. Read back the owning baseline, change, workflow, task, specification digest, or
+   artifact record. If another authority changed, pass its typed reference in
+   `decision.complete.applied_refs`.
+6. Call `decision.complete` only after that read-back. This closes lifecycle state; it
+   is not another user approval. If the decision record itself is the complete durable
+   authority, `applied_refs` may remain empty.
+7. Use `decision.checkpoint` instead only for the digest-bound recovery boundary
+   described below.
 
 Keep fact acquisition autonomous and decision authority explicit.
 Never store raw prompts or transcripts; store normalized decisions, not internal
 chain of thought.
 Do not require a redundant confirmation after an unambiguous answer.
+An answered thread with no open or blocking deferred decision does not require a
+checkpoint merely to prove intent.
 
 Use a checkpoint only when a coherent decision cluster changes a durable contract or
 artifact and interruption recovery requires a digest-bound boundary. Present the
@@ -98,6 +140,11 @@ compact effect once, obtain any missing approval, update the artifact, and confi
 digest. Do not create ceremonial checkpoints for routine implementation detail or an
 already explicit current instruction.
 
+Every checkpoint binds the normalized decision digest. Change- and workflow-bound
+checkpoints also require at least one current artifact digest. A standalone baseline
+thread may instead record a specific `no_artifact_reason` when no durable artifact
+exists; that exception does not create interaction proof.
+
 ## Return to the capability graph
 
 After alignment, re-read the invoking workflow and breadcrumb. A

package/skills/ultra-verify/SKILL.md

@@ -20,8 +20,9 @@ never recurse into the current host or treat advisor output as authority.
 
 1. Define the workspace, question, evidence standard, and response shape. Confirm the
    selected advisor CLI and authentication. Exclude secrets and unrelated files.
-2. Create `.ultra/collab/<session-id>/` and write the current host's independent,
+2. Create `.ultra/.runtime/collab/<session-id>/` and write the current host's independent,
    evidence-backed analysis to `host-analysis.md` before reading advisor output.
+   Treat the directory as working scratch, not Ultra authority.
 3. Follow the installed collaboration companion's read-only invocation contract. Give
    the advisor the same bounded question and evidence, without the primary conclusion
    when independence matters. Store its result as `advisor-output.md` and diagnostics
@@ -34,6 +35,8 @@ never recurse into the current host or treat advisor output as authority.
    primary documentation. Explain scope, version, evidence, and assumption differences
    before resolving disagreement.
 7. Write `metadata.json` and `synthesis.md`, then return one host-owned conclusion.
+   Promote only verified conclusions into the invoking DB-bound workflow artifact or
+   report; files under `.ultra/.runtime/collab/` remain non-authoritative.
 
 Read `references/cross-verify-modes.md` for mode-specific evidence and
 `references/evidence-status.md` when the synthesis needs an evidence status. Model agreement

package/spec/cli-protocol.md

@@ -106,6 +106,8 @@ as a fallback unless `ultra-tools <family> --help` lists it.
 | `baseline.converge`       | `baseline converge`         | 11    | mcp     |
 | `change.create`           | `change create`             | 9     | mcp     |
 | `change.update`           | `change update`             | 9     | mcp     |
+| `change.delta`            | `change delta`              | 21    | mcp     |
+| `change.documentation_reconcile` | `change documentation-reconcile` | 21 | mcp |
 | `change.get`              | `change get`                | 9     | any     |
 | `change.list`             | `change list`               | 9     | any     |
 | `change.context`          | `change context`            | 9     | mcp     |
@@ -122,12 +124,17 @@ as a fallback unless `ultra-tools <family> --help` lists it.
 | `decision.delegate`       | `decision delegate`          | 16    | mcp     |
 | `decision.defer`          | `decision defer`             | 16    | mcp     |
 | `decision.supersede`      | `decision supersede`         | 16    | mcp     |
+| `decision.complete`       | `decision complete`          | 19    | mcp     |
 | `decision.checkpoint`     | `decision checkpoint`        | 16    | mcp     |
 | `workflow.start`          | `workflow start`            | 13    | mcp     |
 | `workflow.get`            | `workflow get`              | 13    | any     |
 | `workflow.list`           | `workflow list`             | 13    | any     |
 | `workflow.step`           | `workflow step`             | 13    | mcp     |
+| `workflow.revise`         | `workflow revise`           | 21    | mcp     |
+| `workflow.supersede`      | `workflow supersede`        | 21    | mcp     |
 | `workflow.complete`       | `workflow complete`         | 13    | mcp     |
+| `artifact.record`         | `artifact record`           | 20    | mcp     |
+| `artifact.get`            | `artifact get`              | 20    | any     |
 | `system.doctor`           | `system doctor`             | 9     | mcp     |
 | `plan.export`             | `plan export`               | 8a    | mcp     |
 | `plan.get`                | `plan get`                  | 8a    | any     |
@@ -135,7 +142,7 @@ as a fallback unless `ultra-tools <family> --help` lists it.
 Current executable maintenance surfaces are `task init-project`,
 `session close|get|list|admission|heartbeat|subscribe|reap`, `status`, `db`,
 `migrate`, `system doctor|restore|rebaseline`, and `legacy-memory`. In particular, `task create|update|list|get`
-and all `change` and `decision` lifecycle verbs are not CLI fallbacks. Change and decision state must use
+and all `change`, `decision`, and `artifact` lifecycle verbs are not CLI fallbacks. Their state must use
 the live MCP server; `system doctor` may additionally be exposed by the
 maintenance CLI because it is the recovery path when MCP startup is degraded.
 `task init-project --resume` preserves existing `.ultra` files and installs only
@@ -147,7 +154,7 @@ the same Git ancestry and dirty-state verifier as MCP and fails with
 `system doctor --repair` applies supported schema upgrades with a pre-migration
 backup before mechanical recovery.
 `system restore` requires the exact `REPLACE_CORRUPT_ULTRA_STATE` confirmation and a
-verified database inside `.ultra/backups`; it quarantines the corrupt state before
+verified database inside `.ultra/.runtime/backups`; it quarantines the corrupt state before
 atomic replacement. `system rebaseline` requires the exact
 `REBASELINE_CORRUPT_ULTRA_STATE` confirmation and preserves corrupt state plus the
 legacy task projection before starting a new brownfield adoption.
@@ -163,13 +170,18 @@ semantics, is a major bump. Major bumps require an entry in
 
 ## 7. `ubp-orchestrator`
 
-`ubp-orchestrator execute-plan` consumes the completed and current
-`.ultra/execution-plan.json` and resumes from the first unfinished dependency wave.
+`ubp-orchestrator execute-plan` resolves the completed current plan from the active
+Change's DB row and `<artifact_root>/plan.json`, then resumes from the first unfinished
+dependency wave. Use `--change <id>` when more than one active Change has a completed
+plan. The legacy global `.ultra/execution-plan.json` is never selected implicitly;
+`--plan <path>` is explicit read-only migration compatibility for an unbound legacy
+plan and cannot be combined with `--change`.
 Before creating a session it rejects an empty, malformed, cyclic, duplicate-task, or
 cross-change plan. For change-owned tasks, the plan must exactly match the current DB
-task graph and a healthy completed `plan` workflow; an exported but incomplete or
-stale artifact is not executable. A separate owner approval is present only when a
-material planning decision required it.
+task graph, planning-context digest, canonical Change artifact paths, and a healthy
+completed `plan` workflow; an exported but incomplete, displaced, or stale artifact is
+not executable. A separate owner approval is present only when a material planning
+decision required it.
 It returns `status: "paused"` when that wave still has non-terminal Ultra tasks and
 does not dispatch later waves. Worktrees are preserved unless `--auto-merge` is
 explicitly supplied and the corresponding change task has an exact completion commit,