ultra-builder-pro-cli 0.21.1 → 0.22.0

package/.ultra-template/tasks/tasks.json

@@ -1,6 +1,13 @@
 {
-  "schema_version": "4.5",
-  "generated_at": "1970-01-01T00:00:00.000Z",
-  "source": ".ultra/.runtime/state.db",
+  "kind": "ultra-team-task-ledger",
+  "schema_version": "1.0",
+  "generation": 0,
+  "parent_digest": null,
+  "ancestors": [],
+  "state_digest": "5bf27fb3627b711c97abf72f0aad150ba693d35bcebdd57c2d80e325f495de6d",
+  "published_at": null,
+  "reason": "scaffold",
+  "baseline": null,
+  "changes": [],
   "tasks": []
 }

package/.ultra-template/templates/task-context.md

@@ -0,0 +1,19 @@
+<!-- Runtime task views are generated under .ultra/.runtime/projections/contexts/. -->
+
+# Task Context Reference
+
+Use this file only as a structure reference. Runtime task context views are generated
+from SQLite authority and must not be edited by hand. Stable specification learning
+must follow the Change workflow.
+
+## Implementation Notes
+
+- [Evidence-backed note with a source reference]
+
+## Open Questions
+
+- [Question, consequence, owner, and next evidence]
+
+## Recovery Notes
+
+- [Current safe resume point and any external prerequisite]

package/CHANGELOG.md

@@ -7,6 +7,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.22.0] — 2026-07-30
+
+### Added
+
+- Added a versioned, digest-chained Git team checkpoint at
+  `.ultra/tasks/tasks.json` for portable baseline, Change, task-contract,
+  dependency, and durable task-status handoff.
+- Added `task.ledger_get`, `task.ledger_publish`, and `task.ledger_import` with
+  per-record revisions, bounded ancestry, transactional fast-forward imports,
+  and typed baseline, Change, task, deletion, and active-session conflicts.
+- Added exact-byte backup and deterministic upgrade of matching legacy v4.4
+  and v4.5 task projections during project resume.
+
+### Changed
+
+- Moved generated task and context views under
+  `.ultra/.runtime/projections/`; SQLite remains checkout-local operational
+  authority while the Git checkpoint is the narrow team handoff.
+- Updated all public workflow Skills, project templates, hooks, adapters, and
+  documentation to inspect and synchronize the team checkpoint without
+  turning hooks or host adapters into semantic authorities.
+- Made imported ready baselines require checkout-local revalidation before
+  they may publish a descendant checkpoint.
+
+### Fixed
+
+- Fixed tracked task projections creating a self-referential
+  `BASELINE_HEAD_STALE` treadmill after every Ultra operation or metadata-only
+  commit. Baseline freshness now uses scoped source content plus Git ancestry
+  while continuing to detect specification and source drift.
+- Fixed task completion requiring a second bookkeeping commit. The completion
+  SHA is now backfilled only into local SQLite and generated views after the
+  single real completion commit.
+- Fixed resume, doctor, status, and four-host install paths disagreeing about
+  legacy task projections, team checkpoints, generated views, and protected
+  files.
+- Replaced the daemon's machine-speed-dependent 500ms release assertion with a
+  bounded observable-session wait while preserving the immediate-poll
+  behavior requirement.
+
 ## [0.21.1] — 2026-07-29
 
 ### Fixed

package/README.md

@@ -43,9 +43,11 @@ Ultra Builder Pro addresses those gaps with four ideas:
 2. **Low-load user alignment.** The agent investigates observable facts itself
    and asks the user only for material intent, scope, risk, or authorization
    decisions—normally one dependent decision at a time.
-3. **Durable project authority.** `.ultra/.runtime/state.db` records baselines, changes,
-   decisions, workflows, tasks, evidence digests, sessions, incidents, and
-   recovery state across hosts and sessions.
+3. **Durable project authority.** `.ultra/.runtime/state.db` records checkout-local
+   lifecycle, decisions, workflows, evidence digests, sessions, incidents, and
+   recovery state across host sessions. Tracked semantic artifacts plus the
+   MCP-published `.ultra/tasks/tasks.json` checkpoint carry reviewed project intent
+   across Git checkouts without committing SQLite, leases, or telemetry.
 4. **Convergent delivery.** Research, plans, implementation, tests, review, and
    specification updates must agree before a change is archived.
 
@@ -59,14 +61,40 @@ session resumes from that authority instead of reconstructing it from chat.
 ## The mental model
 
 ```mermaid
-flowchart LR
-    U["User<br/>intent and material decisions"] <--> H["Host agent<br/>reasoning and implementation"]
-    H <--> S["Ultra skills<br/>task-specific workflows"]
-    S <--> M["Ultra MCP<br/>state, evidence, freshness, recovery"]
-    M <--> D[(".ultra/.runtime/state.db")]
-    H --> A["Code, specifications,<br/>tests and review artifacts"]
-    A --> M
-    K["Lifecycle hooks<br/>breadcrumb and projection protection"] --> M
+flowchart TB
+    U["User<br/>goals, acceptance, trade-offs, risk, and external authorization"]
+
+    subgraph HOST["Supported coding host"]
+        UI["Host-native interaction<br/>Claude Code / Codex / OpenCode / Kimi Code"]
+        MODEL["Host agent<br/>inspect, recommend, implement, test, and review"]
+        ADAPTER["Host adapter<br/>native questions, commands, tools, and lifecycle wiring"]
+    end
+
+    SKILLS["Eleven explicit Ultra Skills<br/>init / research / think / change / plan / dev<br/>test / review / deliver / status / doctor"]
+    MCP["Ultra MCP<br/>60 typed tools across nine families"]
+    DB[(".ultra/.runtime/state.db<br/>SQLite lifecycle and index authority")]
+    LEDGER[".ultra/tasks/tasks.json<br/>Git team checkpoint for portable baseline, Change, and task state"]
+    VIEWS[".ultra/.runtime/projections<br/>checkout-local generated views"]
+    FILES["Digest-bound .ultra artifacts<br/>specification / research / change / plan / context<br/>test / review / delivery"]
+    HOOKS["Lifecycle hooks<br/>health, breadcrumbs, recovery hints, and managed-file protection"]
+    OPS["Operational tools<br/>ubp / ultra-tools / optional orchestrator"]
+    EXTERNAL["External memory and graph providers"]
+
+    U <-->|"intent, recommendation, and owner choice"| UI
+    UI <--> MODEL
+    ADAPTER --> UI
+    ADAPTER -.->|"discovers and presents"| SKILLS
+    MODEL -->|"explicit invocation"| SKILLS
+    SKILLS -->|"typed operations"| MCP
+    MCP <--> DB
+    MCP -->|"publish / validate / import"| LEDGER
+    MCP -->|"regenerate"| VIEWS
+    MODEL -->|"writes semantic and evidence bodies"| FILES
+    MCP <-->|"registers owner, digest, provenance, and freshness"| FILES
+    HOOKS -->|"observes and records lifecycle events"| MCP
+    OPS -->|"installation"| ADAPTER
+    OPS -->|"diagnosis, recovery, and approved dispatch"| MCP
+    EXTERNAL -.->|"bounded provider references only"| DB
 ```
 
 The responsibility split is deliberate:
@@ -75,14 +103,37 @@ The responsibility split is deliberate:
 |---|---|
 | **User** | Product intent, semantic route selection, material scope and trade-offs, risk acceptance, destructive actions, publishing and deployment authorization |
 | **Host model** | Fact-finding, synthesis, research-coverage and route recommendations, reversible implementation decisions |
-| **Ultra MCP** | Durable state, evidence references, digests, freshness, locks, valid transitions and hard recovery |
+| **Ultra MCP** | Checkout-local state, evidence references, digests, freshness, locks, valid transitions, hard recovery, and Git checkpoint publish/import |
 | **Host adapter** | Native Skill discovery, user questions, tool invocation, installation, and runtime wiring |
-| **Hooks** | Fast lifecycle observation, current breadcrumb injection, and protection of generated projections |
+| **Hooks** | Fast lifecycle observation, current breadcrumb injection, and protection of MCP-owned checkpoint and generated projection paths |
 
 The MCP does not replace the model's judgment. A hook does not decide product
 strategy. A prompt does not become durable authority merely because it appeared
 in a conversation.
 
+### How owner intent becomes durable authority
+
+```mermaid
+flowchart TD
+    CURRENT["Current Ultra workflow"] --> INSPECT["Host model inspects code, documents, and current authority"]
+    INSPECT --> SUGGEST["Model recommends a route and explains its consequences"]
+    SUGGEST --> CLEAR{"Is current owner intent already explicit?"}
+    CLEAR -->|"Yes"| NORMALIZE["Normalize the accepted intent"]
+    CLEAR -->|"No: a material choice remains"| ASK["Ask one dependent question through the host-native question tool"]
+    ASK --> NORMALIZE
+    NORMALIZE --> DECISION["Persist the normalized result through decision.*"]
+    DECISION --> APPLY["Apply it through the owning MCP operation or digest-bound artifact"]
+    APPLY --> AUTHORITY["Bind state, artifact digest, provenance, and downstream effects"]
+    AUTHORITY --> READBACK["Read back the authoritative result"]
+    READBACK --> RESUME["Resume the exact workflow step and recommend the next explicit capability"]
+```
+
+The interaction before the write establishes owner intent. Once the host model
+normalizes and persists that intent, MCP treats the stored result as current
+authority; it does not try to prove that the owner clicked a particular UI
+control. Ultra stores the accepted result and its scope, evidence, provenance,
+and effects—not chain-of-thought, raw prompts, transcripts, or UI receipts.
+
 ## What you get
 
 - Native plugins for **Claude Code**, **OpenCode**, **Codex**, and **Kimi Code**.
@@ -253,8 +304,11 @@ that rationale is useful. MCP validates state, evidence, and transitions; it
 does not store or prove the preceding UI interaction.
 
 Older projection-only Ultra projects are preserved and routed through a
-backup-first migration or rebaseline. Use `ultra-doctor` when initialization
-reports migration or authority damage; do not overwrite old state manually.
+backup-first migration or rebaseline. The first supported checkpoint publication
+replaces a v4.4/v4.5 task projection only when its ids and durable fields match
+SQLite, after copying its exact bytes to `.ultra/.runtime/backups/task-ledger/`.
+Use `ultra-doctor` when initialization reports migration, mismatch, or authority
+damage; do not overwrite old state manually.
 
 ### 3. Make daily changes
 
@@ -311,6 +365,61 @@ These eleven capabilities are the complete public Ultra command graph. Each capa
 returns current `allowed_transitions`; the host may recommend one, but another public
 capability starts only after an explicit user command or skill invocation.
 
+### Command interaction graph
+
+Every solid handoff below means: the current capability returns
+`allowed_transitions`, the model recommends a route, and the owner explicitly
+invokes the next public capability. It does not mean that one public command
+silently launches another.
+
+```mermaid
+flowchart TD
+    START["Project entry"] --> INIT["ultra-init"]
+    INIT --> CLASSIFY{"Repository classification"}
+
+    CLASSIFY -->|"Greenfield"| GREEN["Create scaffold<br/>verify Git and project authority"]
+    CLASSIFY -->|"Brownfield"| BROWN["Preserve the delivered system<br/>bootstrap adoption authority"]
+    CLASSIFY -->|"Legacy or damaged authority"| REPAIR["ultra-doctor<br/>migrate, recover, or rebaseline"]
+    REPAIR --> BROWN
+
+    GREEN --> RESEARCH["Explicit ultra-research"]
+    BROWN --> RESEARCH
+    RESEARCH --> BASELINE{"Has the baseline converged?"}
+    BASELINE -->|"Material decision gap"| THINK_BASE["ultra-think"]
+    THINK_BASE --> RESEARCH
+    BASELINE -->|"Evidence gap"| RESEARCH
+    BASELINE -->|"Approved and current"| CHANGE["Explicit ultra-change"]
+
+    CHANGE --> ROUTE{"Model recommends a route<br/>owner selects or modifies it"}
+    ROUTE -->|"Material intent remains unresolved"| THINK_CHANGE["ultra-think"]
+    THINK_CHANGE --> ROUTE
+    ROUTE -->|"Real evidence gap"| CHANGE_RESEARCH["Bounded ultra-research<br/>owned by the active Change"]
+    CHANGE_RESEARCH --> PLAN["ultra-plan"]
+    ROUTE -->|"Evidence is sufficient: Direct Build"| PLAN
+
+    PLAN --> DEV["ultra-dev<br/>one dependency-ready vertical task"]
+    DEV --> TASKS{"More executable tasks?"}
+    TASKS -->|"Yes"| DEV
+    TASKS -->|"No"| TEST["ultra-test<br/>risk-selected formal verification"]
+    TEST -->|"Failed or incomplete"| DEV
+    TEST -->|"Passing"| REVIEW["ultra-review<br/>specification fidelity and engineering quality"]
+    REVIEW -->|"Changes required"| DEV
+    REVIEW -->|"Approved"| DELIVER["ultra-deliver"]
+    DELIVER --> ARCHIVE["Reconcile specifications<br/>apply the Change overlay and archive evidence"]
+    ARCHIVE --> NEXT{"Continue"}
+    NEXT -->|"Next outcome"| CHANGE
+    NEXT -->|"Inspect current authority"| STATUS["ultra-status"]
+
+    ANY["Any active stage"] -.->|"read-only routing"| STATUS
+    ANY -.->|"mechanical health fault"| DOCTOR["ultra-doctor"]
+```
+
+“Direct Build” skips additional Research only. It still requires
+`ultra-plan`, current DB-backed task contracts, dependency ownership, and an
+immutable role-scoped Context Manifest before `ultra-dev`. `ultra-status` is a
+read-only side route, while `ultra-doctor` diagnoses and repairs mechanical
+health without selecting product intent.
+
 ## What lives in `.ultra/`
 
 ```text
@@ -318,6 +427,7 @@ capability starts only after an explicit user command or skill invocation.
   .runtime/                # local mutable state; ignored by Git
     state.db               # lifecycle, index, transition, and freshness authority
     checkpoint.json        # advisory recovery projection
+    projections/           # generated local task and task-context views
     backups/               # verified migration and recovery snapshots
     collab/                # local collaboration scratch
     sessions/              # local leases and session runtime
@@ -326,9 +436,14 @@ capability starts only after an explicit user command or skill invocation.
   specs/                   # digest-bound product and architecture baseline
   changes/
     active/<id>/           # all current Change semantics and evidence
+      intent.md            # accepted Change Contract
+      findings.md          # durable Change findings
+      progress.md          # generated human-readable projection
       research/            # Change-only findings and research reports
       delta/               # typed baseline overlay and semantic payloads
       documentation/       # documentation overlay and reconciliation evidence
+      plan.json            # machine-readable task topology
+      plan.md              # deterministic human plan projection
       contexts/            # immutable role/task context snapshots
       test/                # Change-scoped test reports
       review/              # Change-scoped review workers and summary
@@ -337,17 +452,20 @@ capability starts only after an explicit user command or skill invocation.
   docs/research/           # baseline-only research evidence
   reports/templates/       # blank report schemas; never delivery evidence
   tasks/
-    tasks.json             # generated projection, never the authority
-    contexts/              # bounded role/task context artifacts
+    tasks.json             # MCP-published Git team checkpoint; never hand-edited
+  templates/
+    task-context.md        # authored template, not a generated task context
 ```
 
 Together, `.ultra/` is Ultra's project-local cross-session workflow memory. The
 host model writes semantic specifications and evidence through the active
 workflow. MCP records lifecycle state, references, digests, provenance, and
 accepted intent, then rejects stale or illegal transitions. The DB is the
-lifecycle and index authority; registered digest-bound files carry the semantic
-or evidence bodies that the DB references. Generated projections and working
-scratch are not authority.
+lifecycle and index authority for one checkout; registered digest-bound files carry
+the semantic or evidence bodies that the DB references. The Git checkpoint is a
+portable, digest-chained handoff of baseline, Change, and durable task records. It is
+not a second live session authority. Generated projections and working scratch are
+not authority.
 
 Ultra does not store chain-of-thought, raw prompts, transcripts, general
 conversational or episodic memory, or code-graph payloads. External memory and
@@ -356,6 +474,29 @@ references to them as workflow context. Only `.ultra/.runtime/` is ignored by
 Git: semantic and evidence artifacts can travel with the repository, while
 SQLite, leases, telemetry, and recovery scratch remain checkout-local.
 
+### Team checkpoint protocol
+
+MCP publishes `.ultra/tasks/tasks.json` at durable boundaries: baseline convergence,
+Change creation or revision, accepted plan export, durable task-contract or status
+changes, task expansion or deletion, and Change convergence or archive. The file
+contains per-record revisions and digests plus checkpoint ancestry. It excludes
+`in_progress` ownership, session ids, leases, worktrees, telemetry, and
+`completion_commit`.
+
+After a pull or on a fresh checkout, MCP validates and imports the checkpoint. Clean
+records fast-forward independently. A baseline imported as `ready` is downgraded to
+checkout-local revalidation until its scope, files, verification, and HEAD are proven
+again. Concurrent edits to the same baseline, Change, or task, a non-descendant
+checkpoint, or remote modification of an active local task fail with a typed conflict;
+Ultra never silently picks a side. Re-importing the same checkpoint is read-only, and
+an imported ready baseline cannot publish another checkpoint until local revalidation
+converges.
+
+Baseline freshness does not use the checkpoint commit as a self-referential marker.
+It combines Git ancestry with a scoped content digest that excludes `.ultra/`.
+Consequently, a commit containing only Ultra metadata does not make the baseline stale,
+while a descendant commit that changes scoped application content does.
+
 See [Artifact authority](./docs/ARTIFACT-AUTHORITY.md) for the promotion and
 evidence rules.
 
@@ -409,8 +550,11 @@ host's existing model session.
   reinstall only the degraded host.
 - **Project state is unhealthy:** invoke `ultra-doctor` or run
   `ultra-tools system doctor`. Repairs and schema migrations are backup-first.
-- **A projection disagrees with MCP:** trust `.ultra/.runtime/state.db`; do not repair
-  `tasks.json` or generated context Markdown by hand.
+- **The team checkpoint disagrees with local state:** run `ultra-status`, inspect the
+  typed ledger condition, then use the recommended `task.ledger_import` or
+  `task.ledger_publish` path. Never edit `.ultra/tasks/tasks.json` by hand.
+- **A generated view disagrees with MCP:** trust `.ultra/.runtime/state.db`; never edit
+  `.ultra/.runtime/projections/` by hand.
 - **A workflow appears blocked:** use `ultra-status` to read the exact current
   workflow, blocker, owner decision, and mechanically valid transitions.
 - **Kimi reports a native-module ABI error:** ensure an external Node.js 22+

package/adapters/opencode.js

@@ -337,7 +337,8 @@ import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
-const TASKS_PROJECTION = ".ultra/tasks/tasks.json";
+const TEAM_TASK_LEDGER = ".ultra/tasks/tasks.json";
+const LIVE_TASK_PROJECTION = ".ultra/.runtime/projections/tasks.json";
 const NODE_BINARY = ${JSON.stringify(process.execPath)};
 const PLUGIN_DIR = path.dirname(fileURLToPath(import.meta.url));
 const BREADCRUMB_CLI = path.resolve(
@@ -382,20 +383,28 @@ function targetPaths(tool, args) {
   return [...new Set(paths)];
 }
 
-function projectionRootForTarget(baseRoot, candidate) {
+function managedTaskRootForTarget(baseRoot, candidate) {
   const target = path.isAbsolute(candidate)
     ? path.resolve(candidate)
     : path.resolve(baseRoot, candidate);
-  if (path.basename(target) !== "tasks.json"
-      || path.basename(path.dirname(target)) !== "tasks"
-      || path.basename(path.dirname(path.dirname(target))) !== ".ultra") {
-    return null;
+  if (target === path.resolve(baseRoot, TEAM_TASK_LEDGER)
+      || target === path.resolve(baseRoot, LIVE_TASK_PROJECTION)) return baseRoot;
+  if (path.basename(target) !== "tasks.json") return null;
+  const parent = path.dirname(target);
+  if (path.basename(parent) === "tasks"
+      && path.basename(path.dirname(parent)) === ".ultra") {
+    return path.dirname(path.dirname(parent));
+  }
+  if (path.basename(parent) === "projections"
+      && path.basename(path.dirname(parent)) === ".runtime"
+      && path.basename(path.dirname(path.dirname(parent))) === ".ultra") {
+    return path.dirname(path.dirname(path.dirname(parent)));
   }
-  return path.dirname(path.dirname(path.dirname(target)));
+  return null;
 }
 
-function protectsTasksProjection(baseRoot, candidate) {
-  const targetRoot = projectionRootForTarget(baseRoot, candidate);
+function protectsManagedTaskFile(baseRoot, candidate) {
+  const targetRoot = managedTaskRootForTarget(baseRoot, candidate);
   if (!targetRoot) return false;
   return Boolean(readUltraContext(targetRoot));
 }
@@ -421,11 +430,13 @@ export const UltraBuilderProPlugin = async ({ directory, worktree }) => {
       const tool = String(input?.tool ?? "").toLowerCase();
       if (!["write", "edit", "apply_patch"].includes(tool)) return;
       if (targetPaths(tool, output?.args).some(
-        (candidate) => protectsTasksProjection(root, candidate),
+        (candidate) => protectsManagedTaskFile(root, candidate),
       )) {
         throw new Error(
-          "Ultra Builder Pro refused a direct write to .ultra/tasks/tasks.json. " +
-          ".ultra/.runtime/state.db is authoritative; use MCP task tools and run ultra-doctor when state or projection health is degraded."
+          "Ultra Builder Pro refused a direct write to an MCP-managed task file. " +
+          ".ultra/tasks/tasks.json is the MCP-published team checkpoint and " +
+          ".ultra/.runtime/projections/tasks.json is the checkout-local DB view. " +
+          "Use the Ultra MCP task or task.ledger tools."
         );
       }
     },

package/docs/AGENT-CONTEXT.md

@@ -26,8 +26,10 @@ not put it in a plugin until that allowlist classifies it.
 
 ```text
 native command or skill -> MCP workflow-state operation -> .ultra/.runtime/state.db
+                                      | \
+                                      |  -> .ultra/tasks/tasks.json (Git checkpoint)
+                                      |  -> .ultra/.runtime/projections/ (local views)
                                       ^
-                                      |
               selected CLI init / doctor / diagnostics / orchestration
 ```
 
@@ -39,23 +41,25 @@ native command or skill -> MCP workflow-state operation -> .ultra/.runtime/state
 
 `.ultra/` is project-local cross-session workflow memory for normalized intent,
 progress, tasks, bounded context, specifications, evidence, provenance, and recovery.
-`.ultra/.runtime/state.db` is the only lifecycle, index, transition, freshness, and
-coordination authority for baselines, changes, decisions, tasks, workflow runs/steps,
-sessions, events, incidents, projection jobs/cursors, telemetry, review evidence, and
-circuit-breaker state. Registered digest-bound specifications and reports carry
-semantic or evidence bodies. `tasks.json`, generated task-context files, runtime
-checkpoints, and collaboration scratch are not independent authority. See
+`.ultra/.runtime/state.db` is checkout-local lifecycle, index, transition, freshness,
+and coordination authority for baselines, changes, decisions, tasks, workflow
+runs/steps, sessions, events, incidents, projection jobs/cursors, telemetry, review
+evidence, and circuit-breaker state. Registered digest-bound specifications and
+reports carry semantic or evidence bodies. `.ultra/tasks/tasks.json` is the
+MCP-published portable baseline/Change/task checkpoint; it is not live lease or session
+authority. Generated task views, runtime checkpoints, and collaboration scratch are
+not independent authority. See
 [`ARTIFACT-AUTHORITY.md`](./ARTIFACT-AUTHORITY.md).
 
 ## 3. Live MCP and declared contracts
 
-`spec/mcp-tools.yaml` declares and the bundled server registers 57 tools across
+`spec/mcp-tools.yaml` declares and the bundled server registers 60 tools across
 nine families:
 
 | Family | Live tools |
 |---|---|
 | `baseline.*` | start, record, get, converge |
-| `task.*` | create, update, list, get, switch_tag, delete, init_project, expand, parse_prd, dependency_topo, append_event, subscribe_events |
+| `task.*` | create, update, list, get, switch_tag, delete, init_project, expand, parse_prd, dependency_topo, append_event, subscribe_events, ledger_get, ledger_publish, ledger_import |
 | `session.*` | spawn, close, get, list, admission_check, heartbeat, subscribe_events |
 | `change.*` | create, update, delta, documentation_reconcile, get, list, context, breadcrumb, learning_propose, learning_resolve, converge, archive |
 | `decision.*` | thread_start, get, list, open, resolve, delegate, defer, supersede, complete, checkpoint |
@@ -176,10 +180,11 @@ OpenCode plugin invoke the same bundled JavaScript `change.breadcrumb` reader
 through the thin `context_spine.py` bridge. No hook reimplements the state query.
 `health_check.py` and
 `workflow_context.py` may inspect any initialized project;
-`active_task_context.py` always protects the task projection but limits ordinary
+`active_task_context.py` protects both the MCP-owned Git checkpoint and local task
+projection but limits ordinary
 edit guidance to an active workflow. Compact/stop/subagent hooks remain
 active-workflow scoped. OpenCode natively injects baseline/change context and
-protects the projection; full health inspection is available through
+protects both managed task paths; full health inspection is available through
 `system.doctor` rather than a session-start health hook.
 Advisory baseline or context-budget warnings are presentation only and never
 reject an edit, stop, or tool call.
@@ -213,14 +218,18 @@ sessions never call it, and it cannot collect, recall, or reflect memory.
 .ultra/
 ├── .runtime/
 │   ├── state.db             # authoritative SQLite lifecycle/index store
-│   └── checkpoint.json      # advisory breadcrumb recovery projection
+│   ├── checkpoint.json      # advisory breadcrumb recovery projection
+│   └── projections/         # generated checkout-local task views
 ├── changes/
 │   ├── active/<id>/         # all Change semantics and evidence
 │   │   ├── intent.md, findings.md, progress.md
 │   │   ├── research/, delta/, documentation/, plan.json, plan.md
 │   │   └── contexts/, test/, review/, delivery/
 │   └── archive/             # converged packets after baseline reconciliation
-├── tasks/                   # projections and task contexts
+├── tasks/
+│   └── tasks.json           # MCP-published Git team checkpoint
+├── templates/
+│   └── task-context.md      # authored task-context template
 ├── specs/                   # research/product/architecture artifacts
 └── reports/templates/      # blank report schemas; never evidence
 ```