ultra-builder-pro-cli 0.20.0 → 0.22.0

package/skills/ultra-init/SKILL.md

@@ -13,11 +13,13 @@ the next semantic workflow.
 
 1. Identify the repository root, existing `.ultra` state, Git state, meaningful source,
    monorepo boundaries, and current owner request.
-2. If `.ultra/state.db` exists, run `system.doctor` read-only and resume with
+2. If `.ultra/.runtime/state.db` exists, run `system.doctor` read-only and resume with
    `task.init_project` only when its report permits it.
-3. Otherwise call `task.init_project` with `mode: "auto"`, the project name, and an
+3. Read the Git-facing team checkpoint when present. Never parse a legacy
+   `.ultra/tasks/tasks.json` as current authority or edit it directly.
+4. Otherwise call `task.init_project` with `mode: "auto"`, the project name, and an
    explicit scope only when the repository contains multiple plausible roots.
-4. Leave `git_mode` as `auto` unless the user explicitly requires a non-Git workspace.
+5. Leave `git_mode` as `auto` unless the user explicitly requires a non-Git workspace.
 
 Use repository evidence to classify:
 
@@ -48,21 +50,27 @@ unresolved. Normalize clear intent already present in the request without asking
 
 The operation must:
 
-- create or migrate `.ultra/state.db` with a backup before schema migration;
+- create or migrate `.ultra/.runtime/state.db` with a backup before schema migration;
 - install only missing scaffold assets on resume;
+- create an empty `.ultra/tasks/tasks.json` team checkpoint for a new project;
+- import a validated team checkpoint on clone or resume, while requiring
+  checkout-local revalidation before an imported ready baseline can authorize work;
 - preserve existing artifacts and unrelated work;
 - preserve an existing Git repository and HEAD;
 - initialize Git and a safe `.gitignore` entry when Git is absent;
 - report an unborn repository as `initial_commit_required` without manufacturing a
   commit, remote, tag, or push;
-- read back the created DB, classification, projection, and Git result before
-  completing the init workflow.
+- read back the created DB, classification, local runtime projection, team checkpoint,
+  and Git result before completing the init workflow.
 
 Projection-only projects must use the exact backup-first migration command returned by
-the runtime. A migrated compatibility baseline requires a new brownfield adoption with
+the runtime. On the first supported team-checkpoint publication, a matching legacy
+task projection is copied byte-for-byte into `.ultra/.runtime/backups/task-ledger/`
+before replacement; any task-id or durable-field mismatch stops with a typed conflict.
+A migrated compatibility baseline requires a new brownfield adoption with
 `replace_migrated: true`. Replacing a healthy baseline requires explicit replacement
-authority. Corrupt DB, WAL, SHM, and backups must be preserved until the user chooses a
-documented recovery operation.
+authority. Corrupt DB, WAL, SHM, and backups must be preserved until the user chooses
+a documented recovery operation.
 
 ## Completion and handoff
 
@@ -79,5 +87,8 @@ Read the returned `allowed_transitions` and `required_transition`:
   capability and wait for an explicit user invocation.
 
 Report classification, scope, schema and backup result, Git state, init workflow id,
-baseline state, and allowed transitions. Do not claim that a baseline is ready until a
-separate research/adoption workflow has recorded and converged it.
+team-checkpoint import or revalidation state, baseline state, and allowed transitions.
+Do not claim that a baseline is ready until a separate research/adoption workflow has
+recorded and converged it in the current checkout.
+
+Never invoke the recommended capability here; wait for an explicit user invocation.

package/skills/ultra-plan/SKILL.md

@@ -11,11 +11,22 @@ accepted Change Contract without adding ceremonial approval.
 
 ## Bind current authority
 
-1. Read doctor, baseline, change, decisions, existing plan runs, tasks, and current
-   checkout.
+1. Read doctor, `task.ledger_get`, baseline, change, breadcrumb `accepted_intent`,
+   decisions, existing plan runs, tasks, and current checkout. If a new Git checkpoint
+   arrived after this MCP process started, call `task.ledger_import` before planning.
+   Stop on a typed baseline, Change, task, ancestry, or active-session conflict; never
+   choose one side by editing the ledger.
 2. Require one mutable change with a healthy baseline or recorded incident bypass.
+   For the first delivery of a greenfield project, an accepted ready baseline may
+   already contain the complete delivery outcome. When no matching Change exists,
+   materialize one `change.create` contract from that accepted intent and read it back
+   without asking the owner to repeat the same choice. Do not invent scope, expand an
+   incomplete baseline, or use this shortcut for a later change.
 3. Complete the exact change-bound research disposition before planning.
-4. Resume the matching plan run. Do not start a new run until planning posture is
+4. For a standard or major Change, read the current registered `change.delta` and
+   verify its baseline anchors and digest. A Direct Build route supplies the delta
+   directly from accepted intent; it skips Research, not this authority boundary.
+5. Resume the matching plan run. Do not start a new run until planning posture is
    accepted.
 
 Read `references/semantic-preflight.md` and inspect requirements, real consumers,
@@ -40,7 +51,8 @@ eventual technical design.
 
 ## Design with model autonomy
 
-Build a candidate plan privately. Ask the user only if the plan would change accepted
+Build a candidate plan from the Change Contract, current typed delta, and any selected
+research. Ask the user only if the plan would change accepted
 scope, public behavior, compatibility, security, material cost, external effects, or
 recovery. Use the same host-native interaction protocol.
 
@@ -51,30 +63,47 @@ interaction preference, not a runtime invariant.
 Record:
 
 1. `validate-baseline`
-2. `analyze-requirements`
-3. `analyze-codebase`
-4. `design-slices`
-5. `validate-dependencies`
-6. `persist-task-contracts`
-7. `verify-plan`
+2. `compile-context`
+3. `analyze-requirements`
+4. `analyze-codebase`
+5. `design-slices`
+6. `validate-dependencies`
+7. `persist-task-contracts`
+8. `verify-plan`
 
 Design a walking skeleton and subsequent vertical slices. Every slice reaches a real
 consumer and owns its validation, side effects, errors, documentation, migration,
 observability, and recovery obligations. Avoid unconsumed horizontal scaffolding.
 
+After starting or resuming the workflow, compile `change.context` with `role: plan`
+and `gate: planning`. Record its immutable manifest as the `compile-context` output.
+The packet is the accepted planning input, not a mutable plan draft. `change.context`
+must not update Change provider references; persist new provider metadata with
+`change.update` before recompiling.
+
 ## Persist task contracts
 
 Create each task with:
 
-- observable outcome and stable trace;
+- observable outcome (`purpose`) and stable trace (`why`);
 - `slice_kind`, public seam, and exact verification command;
 - structured acceptance mapped to Change acceptance ids;
-- bounded context refs and reasons;
-- documentation impact, ownership, dependencies, and affected files when known.
+- target seams and affected files when known;
+- bounded pattern/context refs with a reason, optional anchor and scope, and an
+  explicit freshness policy;
+- documentation impact, ownership, and dependencies.
+
+Use `digest` freshness with `expected_digest` for accepted inputs that must remain
+byte-current. Use `existence` for source targets expected to change during
+implementation. Use `advisory` only when drift should be visible but non-blocking.
+The compiled task context restores constraints and non-goals from the Change Contract,
+plus acceptance, recovery, documentation impact, and the definition of drift. Keep
+large referenced files lazy; do not paste their bodies into the plan packet.
 
 Use estimates only when evidence supports them. A quick change has exactly one task.
-Read every task back from DB. Never read or write `.ultra/tasks/tasks.json` directly;
-it is a generated projection, not authority.
+Read every task back from DB. Never read or write `.ultra/tasks/tasks.json` directly.
+It is the MCP-published Git team checkpoint, while
+`.ultra/.runtime/projections/tasks.json` is the generated checkout-local view.
 
 If a semantic `change.update` invalidated existing tasks, reconcile every affected
 task contract against the current intent, acceptance, decisions, and research
@@ -83,8 +112,16 @@ evidence. Rebind the complete execution contract while clearing `stale` through
 the current Change authority digest. Never clear staleness merely to pass a gate.
 
 Validate the change-scoped graph with `task.dependency_topo`. Export
-`.ultra/execution-plan.json` with `plan.export`, read it through `plan.get`, and record
-it as the `verify-plan` output.
+the deterministic `<artifact_root>/plan.json` and `<artifact_root>/plan.md` pair with
+`plan.export { change_id }`. The JSON binds the exact planning context snapshot and
+manifest digest; the Markdown is a deterministic human view of the same task graph.
+An accepted export also publishes the portable baseline, Change, task contracts,
+dependencies, and durable statuses to the team checkpoint. Local sessions, leases,
+`in_progress` ownership, telemetry, and completion hashes remain in `.ultra/.runtime`.
+Read the JSON through `plan.get` and record it as the `verify-plan` output. Do not
+choose an arbitrary output path or overwrite another Change's plan. A legacy global
+`.ultra/execution-plan.json` may be read for migration diagnosis only and is never a
+current write target.
 
 Call `workflow.complete`. `approval` is optional: include it only when a material plan
 decision actually required and received user approval. MCP derives task coverage and
@@ -92,8 +129,11 @@ topology from DB and must reject incomplete contracts, uncovered acceptance, cyc
 cross-change tasks, stale research, or a mismatched export.
 
 Do not advance or complete the Change workflow; change capture is already complete.
-Compile task context later for the consumer that needs it.
+Compile a separate task context later for each consumer that needs it. Planning,
+implementation, testing, review, and convergence snapshots are not interchangeable.
 
 Return topology, first executable slices, public seams, verification commands, plan
 workflow id, and allowed transitions. The host may recommend parallel or sequential
 execution based on dependency and conflict evidence.
+
+Never invoke the recommended capability here; wait for an explicit user invocation.

package/skills/ultra-research/SKILL.md

@@ -5,24 +5,20 @@ description: Build or refresh an evidence-backed product and architecture baseli
 
 # Research with adaptive coverage
 
-The model owns investigation, synthesis, and coverage recommendations. The user owns
-the accepted semantic route and material deferrals. Ultra MCP owns the run, evidence
-references, semantic records, artifact digests, freshness, and convergence. The
-reference areas are an optional catalog, not a mandatory questionnaire or fixed
-sequence of user conversations.
+The model owns investigation, synthesis, and coverage recommendations; the user owns the accepted semantic route and material deferrals.
+MCP owns run state, evidence, semantic records, digests, freshness, and convergence, not a questionnaire.
 
 Read `../ultra-think/references/decision-dialogue.md` before asking a material question.
 
 ## Bind authority
 
-1. Read `system.doctor`, `baseline.get`, active decisions, and existing research runs.
+1. Read `system.doctor`, `task.ledger_get`, `baseline.get`, breadcrumb
+   `accepted_intent`, active decisions, and existing research runs. Import a newer
+   descendant team checkpoint before binding coverage; stop on a typed merge conflict.
 2. Resume the matching active, blocked, or ready run. Do not create parallel authority.
-3. If none exists, determine the authority-bound mode:
-   - `full` for a greenfield baseline;
-   - `adoption` for a brownfield baseline;
-   - a bounded mode only for a recorded active-change research disposition.
-   Focused baseline coverage retains `full` or `adoption`; `custom` is only
-   change-bound and narrows coverage inside an active Change.
+3. If none exists, use `full` for greenfield, `adoption` for brownfield, or a bounded
+   mode only for a recorded active-Change disposition. Focused baseline coverage
+   remains `full` or `adoption`; `custom` is Change-bound only.
 4. Before `workflow.start`, inspect current code, docs, tests, runtime, and prior
    artifacts. Recommend the smallest sufficient set of applicable catalog areas.
    Explain the net effect without dumping all 17 areas. Offer at most three credible
@@ -30,18 +26,16 @@ Read `../ultra-think/references/decision-dialogue.md` before asking a material q
 5. If current user intent does not already select a route, use the host's native
    structured question surface. The user selects, modifies, delegates, or defers.
    Treat a dismissal as unanswered, stop, and perform no route-dependent write.
-6. Normalize the answer and persist the accepted coverage through `workflow.start`:
-   - `execute`: produce fresh evidence;
-   - `verify_existing`: verify a current artifact against its source;
-   - `reuse`: reuse evidence that is still current;
-   - `not_applicable`: exclude with an evidence reference and rationale;
-   - `deferred`: record the consequence and owner acceptance when deferral changes the
-     accepted scope or leaves material risk.
+6. Normalize the answer and persist the accepted coverage through `workflow.start`.
+   Use `execute` for fresh evidence, `verify_existing` for source validation, `reuse`
+   for current evidence, `not_applicable` with evidence and rationale, or `deferred`
+   with consequence and owner acceptance when scope or material risk changes.
 7. Pass the evidence-based coverage rationale as `metadata.selection_reason`. Omitted
    catalog areas create no DB step and need no ceremonial disposition.
+8. Read back the created workflow and accepted coverage. When a durable decision thread
+   recorded the route, complete it with the workflow reference in `applied_refs`.
 
-`99-synthesis` must execute, verify, or reuse. A missing disposition is a coverage
-error only for an included area; a recorded exclusion with evidence is not incomplete.
+`99-synthesis` must execute, verify, or reuse. A missing disposition is a coverage error only for an included area; a recorded exclusion with evidence is not incomplete.
 
 ## Coverage catalog
 
@@ -77,15 +71,20 @@ For each active area:
    artifact. Do not copy prompts, transcripts, provider payloads, or internal chain of
    thought.
 
-For every required workflow step, write
-`.ultra/docs/research/<workflow-id>/<step-id>.md` with `Evidence`,
-`Specification updates`, and `Decisions and unknowns`. Call `workflow.step` with
-bounded evidence, the report output, and typed semantic records. Reused or verified
-evidence must still produce a current report and digest. Block the same step when
-required evidence or owner authority is missing.
+Every required step writes `Evidence`, `Specification updates`, and `Decisions and
+unknowns` to `.ultra/docs/research/<workflow-id>/<step-id>.md` for a baseline, or
+`<change-root>/research/<workflow-id>/<step-id>.md` for an active Change.
+
+Call `workflow.step` with bounded evidence, the report output, and typed semantic
+records. Reused or verified evidence must still produce a current report and digest.
+Block the same step when required evidence or owner authority is missing. For Change
+research, keep `findings.md` and every semantic output inside the same Change root and
+register them through workflow outputs; do not write baseline specifications.
 
 At synthesis, bind the current `discovery.md`, `product.md`, `architecture.md`, and
-`research-distillate.md` for initial/adoption research.
+`research-distillate.md` only for initial/adoption research. Change-bound synthesis
+updates the Change findings and specification overlay, then records or refreshes
+`change.delta`. It never mutates the accepted baseline.
 
 ## Baseline convergence
 
@@ -102,15 +101,18 @@ run as blocked with `BASELINE_GIT_HEAD_REQUIRED`.
 Call `baseline.converge` only when the user has accepted the exact baseline snapshot,
 known failures, blocking gaps, and scope. Reuse an unambiguous current approval; do not
 ask twice. MCP must reject stale research, drift, missing evidence, and unaccepted
-failures.
+failures. Successful convergence publishes the portable baseline, Changes, and tasks
+to the Git team checkpoint; the receiving checkout must still revalidate a ready
+baseline against its own HEAD and files.
 
 Reuse the final research acceptance or current artifact checkpoint during baseline
 convergence; do not ask for an equivalent approval again. After initial or adoption
 convergence, `ultra-change` becomes an available transition. Bounded change research
-returns to its owning Change authority.
+returns to its owning Change authority; the next route is still `ultra-plan`, never
+direct implementation.
+
+Return a compact coverage summary by disposition, current evidence or decision blocker, baseline state, gaps, and allowed transitions.
+Recommend a semantic next action from those transitions. If current intent does not already select it, present the recommendation
+and credible alternatives through the interaction protocol, then wait. MCP supplies only valid and required transitions.
 
-Return a compact coverage summary by disposition, current evidence or decision
-blocker, baseline state, gaps, and allowed transitions. Recommend a semantic next
-action from those transitions. If current intent does not already select it, present
-the recommendation and credible alternatives through the interaction protocol, then
-wait. MCP supplies only valid and required transitions.
+Never invoke the recommended capability here; wait for an explicit user invocation.

package/skills/ultra-review/SKILL.md

@@ -17,10 +17,12 @@ Neither axis can compensate for the other.
 
 1. Read `references/review-modes.md` and select `plan`, `task`, or `change` from the
    actual review request.
-2. Bind one explicit diff or plan artifact, full HEAD, worktree digest, task set,
-   acceptance, and current decision state.
-3. Resume or start the review workflow and record `bind-diff`.
-4. Compile `change.context` for `review` and record the immutable manifest under
+2. Read doctor and `task.ledger_get`. Import a newer descendant checkpoint before
+   binding the review scope; stop on a typed merge conflict.
+3. Bind one explicit diff or plan artifact, full HEAD, worktree digest, task set,
+   acceptance, breadcrumb `accepted_intent`, and current decision state.
+4. Resume or start the review workflow and record `bind-diff`.
+5. Compile `change.context` for `review` and record the immutable manifest under
    `compile-context`.
 
 An empty, ambiguous, or stale scope cannot pass.
@@ -37,8 +39,9 @@ not decide owner choices or edit source.
 
 Resolve `references/unified-schema.md` from this Skill directory and pass its absolute
 path as `SCHEMA_PATH`. Validate specialist artifacts with
-`scripts/review_wait.py`. Record outputs under `review-specification`,
-`review-engineering`, and `coordinate-findings`.
+`scripts/review_wait.py`. Store all specialist artifacts and `SUMMARY.json` below
+`.ultra/changes/active/<change-id>/review/<workflow-id>/`. Record outputs under
+`review-specification`, `review-engineering`, and `coordinate-findings`.
 
 The coordinator preserves every finding unchanged in `SUMMARY.json`; it may group
 duplicate root causes only in the human summary. A new material owner choice remains a
@@ -52,5 +55,8 @@ the durable verdict and rejects missing specialists, lossy coordination, stale
 artifacts, or prompt-supplied conclusions.
 
 Any relevant code, test, specification, or contract edit invalidates the affected
-review evidence. Return both verdict axes, blocking findings, reviewed scope, worker
-selection rationale, artifact digests, and allowed transitions.
+review evidence through registered provenance edges; unrelated evidence remains
+current. Return both verdict axes, blocking findings, reviewed scope, worker selection
+rationale, artifact digests, and allowed transitions.
+
+Never invoke the recommended capability here; wait for an explicit user invocation.

package/skills/ultra-status/SKILL.md

@@ -5,18 +5,23 @@ description: Read authoritative Ultra health, workflows, decisions, changes, tas
 
 # Report authoritative state
 
-This Skill is read-only. Never fall back to generated task JSON, prose, or context
-frontmatter when DB authority is missing or degraded.
+This Skill is read-only. Never fall back to the Git team checkpoint, generated task
+JSON, prose, or context frontmatter when checkout-local DB authority is missing or
+degraded.
 
 ## Read
 
 1. Run `system.doctor` without repair.
-2. Read baseline classification, revision, worktree, research provenance, gaps, and
+2. Run `task.ledger_get`. Report `current`, `drifted`, `revalidation_required`,
+   `missing`, or a typed invalid/conflict state; do not import or publish from status.
+3. Read baseline classification, revision, worktree, research provenance, gaps, and
    health.
-3. Read current decision state without exposing hidden future questions.
-4. Read active, blocked, and ready workflows and their current steps.
-5. Read breadcrumb, changes, tasks, sessions, and current Git state.
-6. Read test, review, and delivery artifacts only through DB references and verify
+4. Read current decision state and breadcrumb `accepted_intent` without exposing hidden
+   future questions.
+5. Read active, blocked, and ready workflows and their current steps.
+6. Read the active Change root, typed delta, plan, deterministic progress projection,
+   documentation reconciliation, findings, tasks, sessions, and current Git state.
+7. Read test, review, and delivery artifacts only through DB references and verify
    their digests and revisions.
 
 If authority is unreadable, report the unavailable panel and the required doctor or
@@ -42,8 +47,10 @@ Ultra: <healthy|degraded> · <branch>@<head|unborn|non-git> · worktree <state>
 Baseline: <mode>/<status> · research=<run/status> · gaps=<open>/<blocking>
 Workflow: <kind/id/status> · step=<current|complete> · outputs=<fresh|stale>
 Decision: <current|checkpoint|none>
-Change: <id/status|none> · Task: <id/status|none> · Sessions: <active>
-Evidence: test=<state> · review=<axes> · delivery=<state>
+Change: <id/status|none> · delta=<fresh|stale|missing> · docs=<fresh|stale|missing>
+Task: <id/status|none> · Sessions: <active>
+Evidence: plan=<state> · test=<state> · review=<axes> · delivery=<state>
+Team checkpoint: <current|drifted|revalidation_required|missing|invalid> · generation=<n>
 Blockers: <codes or none>
 Warnings: <codes or none>
 Allowed transitions: <capabilities>
@@ -52,3 +59,5 @@ Host recommendation: <capability and concise rationale>
 ```
 
 Separate verified facts, host inference, and unavailable evidence.
+
+Never invoke the recommended capability here; wait for an explicit user invocation.

package/skills/ultra-test/SKILL.md

@@ -10,8 +10,9 @@ projections as proof.
 
 ## Bind scope
 
-1. Read doctor, change, breadcrumb, decisions, task and dev evidence, current checkout,
-   and prior report freshness.
+1. Read doctor, `task.ledger_get`, change, breadcrumb `accepted_intent`, decisions,
+   task and dev evidence, current checkout, and prior report freshness. Import a newer
+   descendant checkpoint before binding the task set; stop on a typed merge conflict.
 2. Resume or start a test workflow bound to the exact change and optional task.
 3. Record `bind-scope`, then compile `change.context` for `check` and record its
    immutable manifest under `compile-context`.
@@ -47,10 +48,12 @@ question UI and decision protocol; testing must not choose the desired outcome.
 
 ## Report
 
-Write `.ultra/reports/tests/<workflow-id>.json` with
+Write
+`.ultra/changes/active/<change-id>/test/<workflow-id>/report.json` with
 `ultra-test-report-v1`, binding:
 
-- change, exact task ids, HEAD, worktree digest, and checking-context digest;
+- change, exact task ids, current Change acceptance ids, HEAD, worktree digest, and
+  checking-context digest;
 - acceptance mapping, commands, public seams, failures, and recovery evidence;
 - `verification_profile` and the selected `verification_dimensions`;
 - regression signal when required;
@@ -58,7 +61,8 @@ Write `.ultra/reports/tests/<workflow-id>.json` with
 
 Record `execute-checks`, `verify-public-seam`, and `write-report`, then re-read the
 report and current checkout before `verify-test-gate`. `workflow.complete` derives its
-summary from the report and rejects stale, malformed, or contradictory evidence.
+summary from the report and rejects stale, malformed, contradictory, out-of-Change,
+or acceptance-incomplete evidence.
 
 Return the profile, exact results, verified seams, blockers, report digest, workflow
 state, and allowed transitions. Recommend broader review, more implementation, or
@@ -66,3 +70,5 @@ delivery from those transitions. If current intent does not already select the
 semantic next action, use
 `../ultra-think/references/decision-dialogue.md` and wait for the user to select,
 modify, delegate, or defer it.
+
+Never invoke the recommended capability here; wait for an explicit user invocation.

package/skills/ultra-think/SKILL.md

@@ -37,8 +37,10 @@ Do not expose the hidden decision queue.
 For durable project decisions, use `decision.thread_start`, `decision.open`, and the
 appropriate resolve, delegate, defer, or supersede transition. Store normalized
 decisions and artifact references, never transcripts or internal reasoning.
-Call `decision.complete` when normalized state is settled and no artifact-bound
-checkpoint is needed; completion is not another owner approval.
+Apply any resulting change through its owning baseline, change, workflow, task, or
+semantic artifact operation, read it back, and pass typed `applied_refs` to
+`decision.complete`. If the decision record itself is the complete durable authority,
+the list may be empty. Completion is not another owner approval.
 
 Prepare and confirm a checkpoint only when the decision changes a durable contract or
 artifact and a checkpoint is needed for recovery. Do not add a ceremonial approval
@@ -51,3 +53,5 @@ contracts. Re-read the invoking workflow or breadcrumb and recommend one of its
 `allowed_transitions`; follow `required_transition` only when a hard invariant leaves
 no alternative. Thinking does not implement code, mutate unrelated state, or invent a
 canonical next action.
+
+Never invoke the recommended capability here; wait for an explicit user invocation.

package/skills/ultra-think/references/decision-dialogue.md

@@ -34,6 +34,10 @@ transitions, and hard invariants. It does not choose semantic intent.
    dismissed question as unanswered.
 5. **Persist** the normalized result through MCP, then trust the DB record as current
    authority across sessions.
+6. **Apply** the result to its owning baseline, change, workflow, task, specification,
+   or artifact when that authority has a corresponding field or content boundary.
+7. **Read back** the normalized decision and every changed owning authority before
+   continuing.
 
 The DB treats normalized intent as current authority. It does not prove that the user
 selected it, store a host interaction receipt, or judge whether the choice was wise.
@@ -97,12 +101,13 @@ questionnaire, hidden queue, or every research area.
 The question tool or direct question ends the current interaction naturally.
 A dismissed or unavailable response is not acceptance of the recommendation.
 
-## Persist only when recovery needs it
+## Persist normalized authority
 
 For a project-bound material decision:
 
-1. Call `decision.list` and resume a matching active decision thread, or use
-   `decision.thread_start` for one new baseline-, change-, or workflow-bound thread.
+1. Read breadcrumb `accepted_intent`, call `decision.list`, and resume a matching active
+   decision thread, or use `decision.thread_start` for one new baseline-, change-, or
+   workflow-bound thread.
 2. Use `decision.open` before presenting only the current decision, with evidence refs,
    recommendation, credible alternatives, effects, and its real blocking consequence.
    A non-blocking follow-up must not become a global workflow gate.
@@ -111,9 +116,15 @@ For a project-bound material decision:
    - `decision.delegate` for explicit model delegation;
    - `decision.defer` with consequence and revisit condition;
    - `decision.supersede` when accepted intent actually changed.
-4. Call `decision.complete` when normalized state is settled and no artifact checkpoint
-   is needed. This closes lifecycle state; it is not another user approval.
-5. Use `decision.checkpoint` instead only for the digest-bound recovery boundary
+4. Apply the normalized result through the owning MCP operation or update the smallest
+   relevant semantic artifact. Do not leave a material answer only in conversation.
+5. Read back the owning baseline, change, workflow, task, specification digest, or
+   artifact record. If another authority changed, pass its typed reference in
+   `decision.complete.applied_refs`.
+6. Call `decision.complete` only after that read-back. This closes lifecycle state; it
+   is not another user approval. If the decision record itself is the complete durable
+   authority, `applied_refs` may remain empty.
+7. Use `decision.checkpoint` instead only for the digest-bound recovery boundary
    described below.
 
 Keep fact acquisition autonomous and decision authority explicit.

package/skills/ultra-verify/SKILL.md

@@ -20,8 +20,9 @@ never recurse into the current host or treat advisor output as authority.
 
 1. Define the workspace, question, evidence standard, and response shape. Confirm the
    selected advisor CLI and authentication. Exclude secrets and unrelated files.
-2. Create `.ultra/collab/<session-id>/` and write the current host's independent,
+2. Create `.ultra/.runtime/collab/<session-id>/` and write the current host's independent,
    evidence-backed analysis to `host-analysis.md` before reading advisor output.
+   Treat the directory as working scratch, not Ultra authority.
 3. Follow the installed collaboration companion's read-only invocation contract. Give
    the advisor the same bounded question and evidence, without the primary conclusion
    when independence matters. Store its result as `advisor-output.md` and diagnostics
@@ -34,6 +35,8 @@ never recurse into the current host or treat advisor output as authority.
    primary documentation. Explain scope, version, evidence, and assumption differences
    before resolving disagreement.
 7. Write `metadata.json` and `synthesis.md`, then return one host-owned conclusion.
+   Promote only verified conclusions into the invoking DB-bound workflow artifact or
+   report; files under `.ultra/.runtime/collab/` remain non-authoritative.
 
 Read `references/cross-verify-modes.md` for mode-specific evidence and
 `references/evidence-status.md` when the synthesis needs an evidence status. Model agreement

package/spec/cli-protocol.md

@@ -91,6 +91,9 @@ as a fallback unless `ultra-tools <family> --help` lists it.
 | `task.expand`             | `task expand`               | 8a    | mcp     |
 | `task.parse_prd`          | `task parse-prd`            | 8a    | mcp     |
 | `task.dependency_topo`    | `task topo`                 | 8a    | mcp     |
+| `task.ledger_get`         | `task ledger-get`           | 21    | any     |
+| `task.ledger_publish`     | `task ledger-publish`       | 21    | mcp     |
+| `task.ledger_import`      | `task ledger-import`        | 21    | mcp     |
 | `task.append_event`       | `task append-event`         | 2     | any (allowlisted observations only) |
 | `task.subscribe_events`   | `task subscribe`            | 2     | any     |
 | `session.spawn`           | `session spawn`             | 4.5   | mcp     |
@@ -106,6 +109,8 @@ as a fallback unless `ultra-tools <family> --help` lists it.
 | `baseline.converge`       | `baseline converge`         | 11    | mcp     |
 | `change.create`           | `change create`             | 9     | mcp     |
 | `change.update`           | `change update`             | 9     | mcp     |
+| `change.delta`            | `change delta`              | 21    | mcp     |
+| `change.documentation_reconcile` | `change documentation-reconcile` | 21 | mcp |
 | `change.get`              | `change get`                | 9     | any     |
 | `change.list`             | `change list`               | 9     | any     |
 | `change.context`          | `change context`            | 9     | mcp     |
@@ -128,7 +133,11 @@ as a fallback unless `ultra-tools <family> --help` lists it.
 | `workflow.get`            | `workflow get`              | 13    | any     |
 | `workflow.list`           | `workflow list`             | 13    | any     |
 | `workflow.step`           | `workflow step`             | 13    | mcp     |
+| `workflow.revise`         | `workflow revise`           | 21    | mcp     |
+| `workflow.supersede`      | `workflow supersede`        | 21    | mcp     |
 | `workflow.complete`       | `workflow complete`         | 13    | mcp     |
+| `artifact.record`         | `artifact record`           | 20    | mcp     |
+| `artifact.get`            | `artifact get`              | 20    | any     |
 | `system.doctor`           | `system doctor`             | 9     | mcp     |
 | `plan.export`             | `plan export`               | 8a    | mcp     |
 | `plan.get`                | `plan get`                  | 8a    | any     |
@@ -136,7 +145,7 @@ as a fallback unless `ultra-tools <family> --help` lists it.
 Current executable maintenance surfaces are `task init-project`,
 `session close|get|list|admission|heartbeat|subscribe|reap`, `status`, `db`,
 `migrate`, `system doctor|restore|rebaseline`, and `legacy-memory`. In particular, `task create|update|list|get`
-and all `change` and `decision` lifecycle verbs are not CLI fallbacks. Change and decision state must use
+and all `change`, `decision`, and `artifact` lifecycle verbs are not CLI fallbacks. Their state must use
 the live MCP server; `system doctor` may additionally be exposed by the
 maintenance CLI because it is the recovery path when MCP startup is degraded.
 `task init-project --resume` preserves existing `.ultra` files and installs only
@@ -148,7 +157,7 @@ the same Git ancestry and dirty-state verifier as MCP and fails with
 `system doctor --repair` applies supported schema upgrades with a pre-migration
 backup before mechanical recovery.
 `system restore` requires the exact `REPLACE_CORRUPT_ULTRA_STATE` confirmation and a
-verified database inside `.ultra/backups`; it quarantines the corrupt state before
+verified database inside `.ultra/.runtime/backups`; it quarantines the corrupt state before
 atomic replacement. `system rebaseline` requires the exact
 `REBASELINE_CORRUPT_ULTRA_STATE` confirmation and preserves corrupt state plus the
 legacy task projection before starting a new brownfield adoption.
@@ -164,13 +173,18 @@ semantics, is a major bump. Major bumps require an entry in
 
 ## 7. `ubp-orchestrator`
 
-`ubp-orchestrator execute-plan` consumes the completed and current
-`.ultra/execution-plan.json` and resumes from the first unfinished dependency wave.
+`ubp-orchestrator execute-plan` resolves the completed current plan from the active
+Change's DB row and `<artifact_root>/plan.json`, then resumes from the first unfinished
+dependency wave. Use `--change <id>` when more than one active Change has a completed
+plan. The legacy global `.ultra/execution-plan.json` is never selected implicitly;
+`--plan <path>` is explicit read-only migration compatibility for an unbound legacy
+plan and cannot be combined with `--change`.
 Before creating a session it rejects an empty, malformed, cyclic, duplicate-task, or
 cross-change plan. For change-owned tasks, the plan must exactly match the current DB
-task graph and a healthy completed `plan` workflow; an exported but incomplete or
-stale artifact is not executable. A separate owner approval is present only when a
-material planning decision required it.
+task graph, planning-context digest, canonical Change artifact paths, and a healthy
+completed `plan` workflow; an exported but incomplete, displaced, or stale artifact is
+not executable. A separate owner approval is present only when a material planning
+decision required it.
 It returns `status: "paused"` when that wave still has non-terminal Ultra tasks and
 does not dispatch later waves. Worktrees are preserved unless `--auto-merge` is
 explicitly supplied and the corresponding change task has an exact completion commit,