ultra-builder-pro-cli 0.21.1 → 0.22.0

package/mcp-server/server.cjs

@@ -22,6 +22,7 @@ const {
 const { assertStateAuthority } = require('./lib/state-authority.cjs');
 const ops = require('./lib/state-ops.cjs');
 const projector = require('./lib/projector.cjs');
+const taskLedger = require('./lib/task-ledger.cjs');
 const telemetry = require('./lib/telemetry.cjs');
 const topo = require('./lib/topo.cjs');
 const parser = require('./lib/prd-parser.cjs');
@@ -62,6 +63,9 @@ const TASK_TOOLS = Object.freeze([
   'task.dependency_topo',
   'task.parse_prd',
   'task.expand',
+  'task.ledger_get',
+  'task.ledger_publish',
+  'task.ledger_import',
 ]);
 
 const SESSION_TOOLS = Object.freeze([
@@ -148,6 +152,7 @@ const STATELESS_TOOLS = new Set(['task.init_project']);
 const MUTATING_TOOLS = new Set([
   'task.create', 'task.update', 'task.delete', 'task.append_event', 'task.switch_tag',
   'task.parse_prd', 'task.expand',
+  'task.ledger_import',
   'session.spawn', 'session.close', 'session.heartbeat',
   'plan.export',
   'baseline.start', 'baseline.record', 'baseline.converge',
@@ -161,6 +166,14 @@ const MUTATING_TOOLS = new Set([
   'artifact.record',
 ]);
 
+const TEAM_LEDGER_SYNC_TOOLS = new Set([
+  'task.create', 'task.update', 'task.delete', 'task.parse_prd', 'task.expand',
+  'plan.export',
+  'baseline.start', 'baseline.record', 'baseline.converge',
+  'change.create', 'change.update', 'change.delta', 'change.documentation_reconcile',
+  'change.converge', 'change.archive',
+]);
+
 function loadRegisteredTools() {
   const manifest = yaml.load(fs.readFileSync(TOOLS_FILE, 'utf8'));
   return manifest.tools.filter((t) => REGISTERED_TOOLS.includes(t.name));
@@ -184,7 +197,18 @@ async function dispatchTool(name, input, db, ctx = {}) {
       return { id: task.id, status: task.status, created_at: task.created_at };
     }
     case 'task.update': {
+      const before = ops.readTask(db, input.id);
       const task = ops.patchTask(db, input.id, input.patch || {});
+      const durableChanged = before
+        && taskLedger.durableTask(before).digest !== taskLedger.durableTask(task).digest;
+      if (durableChanged) {
+        taskLedger.publishTaskLedger(db, {
+          rootDir: ctx.rootDir || process.cwd(),
+          reason: before.status !== task.status
+            ? `task_${task.status}`
+            : 'task_contract_updated',
+        });
+      }
       return { ok: true, task };
     }
     case 'task.list': {
@@ -201,7 +225,12 @@ async function dispatchTool(name, input, db, ctx = {}) {
       return { task };
     }
     case 'task.delete': {
-      return ops.deleteTask(db, input.id, { force: !!input.force });
+      const result = ops.deleteTask(db, input.id, { force: !!input.force });
+      taskLedger.publishTaskLedger(db, {
+        rootDir: ctx.rootDir || process.cwd(),
+        reason: 'task_deleted',
+      });
+      return result;
     }
     case 'task.init_project': {
       return initProject(input);
@@ -411,8 +440,58 @@ async function dispatchTool(name, input, db, ctx = {}) {
         children: input.children,
         rootDir,
       });
+      taskLedger.publishTaskLedger(db, {
+        rootDir,
+        reason: 'task_expanded',
+      });
       return { parent_id: result.parent_id, children: result.children };
     }
+    case 'task.ledger_get': {
+      const rootDir = ctx.rootDir || process.cwd();
+      return {
+        ledger: taskLedger.readTaskLedger(rootDir),
+        health: taskLedger.inspectTaskLedger(db, { rootDir }),
+      };
+    }
+    case 'task.ledger_publish': {
+      const result = taskLedger.publishTaskLedger(db, {
+        rootDir: ctx.rootDir || process.cwd(),
+        reason: input.reason || 'manual_checkpoint',
+      });
+      const output = {
+        changed: result.changed,
+        path: path.relative(ctx.rootDir || process.cwd(), result.path),
+        generation: result.ledger.generation,
+        state_digest: result.ledger.state_digest,
+      };
+      if (result.migrated_legacy_projection) {
+        output.migrated_legacy_projection = true;
+        output.legacy_backup_path = path.relative(
+          ctx.rootDir || process.cwd(),
+          result.legacy_backup_path,
+        );
+      }
+      return output;
+    }
+    case 'task.ledger_import': {
+      const result = taskLedger.importTaskLedger(db, {
+        rootDir: ctx.rootDir || process.cwd(),
+      });
+      return {
+        imported: result.imported,
+        preserved: result.preserved,
+        deleted: result.deleted,
+        imported_changes: result.imported_changes,
+        preserved_changes: result.preserved_changes,
+        imported_baseline: result.imported_baseline,
+        preserved_baseline: result.preserved_baseline,
+        generation: result.generation,
+        state_digest: result.state_digest,
+        requires_plan_revalidation: result.requires_plan_revalidation,
+        requires_baseline_revalidation: result.requires_baseline_revalidation,
+        already_current: result.already_current,
+      };
+    }
     case 'plan.export': {
       const rootDir = ctx.rootDir || process.cwd();
       const change = changes.readChange(db, input.change_id);
@@ -572,6 +651,10 @@ async function dispatchTool(name, input, db, ctx = {}) {
         // caller must see a typed failure and later mutations must stop.
         throw error;
       }
+      taskLedger.publishTaskLedger(db, {
+        rootDir,
+        reason: 'plan_accepted',
+      });
       return {
         plan_path: publication.plan_path,
         plan_md_path: publication.plan_md_path,
@@ -626,21 +709,42 @@ async function dispatchTool(name, input, db, ctx = {}) {
       };
     }
     case 'baseline.converge': {
-      return baselines.convergeBaseline(
+      const result = baselines.convergeBaseline(
         db, input, { rootDir: ctx.rootDir || process.cwd() },
       );
+      if (result.ready) {
+        taskLedger.publishTaskLedger(db, {
+          rootDir: ctx.rootDir || process.cwd(),
+          reason: 'baseline_converged',
+        });
+      }
+      return result;
     }
     case 'change.create': {
       const { randomUUID } = require('node:crypto');
       const id = input.id || `chg-${randomUUID().slice(0, 12)}`;
-      return changes.createChange(db, { ...input, id }, { rootDir: ctx.rootDir || process.cwd() });
+      const result = changes.createChange(
+        db,
+        { ...input, id },
+        { rootDir: ctx.rootDir || process.cwd() },
+      );
+      taskLedger.publishTaskLedger(db, {
+        rootDir: ctx.rootDir || process.cwd(),
+        reason: 'change_created',
+      });
+      return result;
     }
     case 'change.update': {
+      const change = changes.updateChange(
+        db, input.id, input.patch || {}, { rootDir: ctx.rootDir || process.cwd() },
+      );
+      taskLedger.publishTaskLedger(db, {
+        rootDir: ctx.rootDir || process.cwd(),
+        reason: 'change_updated',
+      });
       return {
         ok: true,
-        change: changes.updateChange(
-          db, input.id, input.patch || {}, { rootDir: ctx.rootDir || process.cwd() },
-        ),
+        change,
       };
     }
     case 'change.get': {
@@ -691,10 +795,24 @@ async function dispatchTool(name, input, db, ctx = {}) {
       };
     }
     case 'change.converge': {
-      return changes.convergeChange(db, input, { rootDir: ctx.rootDir || process.cwd() });
+      const result = changes.convergeChange(
+        db, input, { rootDir: ctx.rootDir || process.cwd() },
+      );
+      taskLedger.publishTaskLedger(db, {
+        rootDir: ctx.rootDir || process.cwd(),
+        reason: 'change_converged',
+      });
+      return result;
     }
     case 'change.archive': {
-      return changes.archiveChange(db, input, { rootDir: ctx.rootDir || process.cwd() });
+      const result = changes.archiveChange(
+        db, input, { rootDir: ctx.rootDir || process.cwd() },
+      );
+      taskLedger.publishTaskLedger(db, {
+        rootDir: ctx.rootDir || process.cwd(),
+        reason: 'change_archived',
+      });
+      return result;
     }
     case 'change.delta': {
       return changes.recordDelta(db, input, { rootDir: ctx.rootDir || process.cwd() });
@@ -874,6 +992,17 @@ function startServer({
         });
       }
       db = initStateDb(authorityDbPath).db;
+      const teamSync = assertStateAuthority(db, rootDir, { importTeamLedger: true });
+      if (teamSync?.status === 'imported') {
+        runtimeState.enqueueProjection(db, {
+          tool_name: 'task.ledger_import',
+        });
+        runtimeState.processProjectionJobs(db, {
+          rootDir,
+          project,
+          limit: 500,
+        });
+      }
       planRecovery = planStore.recoverPlanPublications(db, { rootDir });
     }
     if (toolName !== 'system.doctor'
@@ -954,6 +1083,9 @@ function startServer({
     try {
       toolDb = STATELESS_TOOLS.has(name) ? null : getDb(name);
       if (toolDb) assertStateAuthority(toolDb, rootDir);
+      if (toolDb && TEAM_LEDGER_SYNC_TOOLS.has(name)) {
+        taskLedger.syncTaskLedger(toolDb, { rootDir });
+      }
       result = await dispatchTool(
         name,
         args,
@@ -976,7 +1108,11 @@ function startServer({
     }
 
     let runtimeMeta = null;
-    if (toolDb && projectOnWrite && MUTATING_TOOLS.has(name)) {
+    const shouldProject = toolDb
+      && projectOnWrite
+      && MUTATING_TOOLS.has(name)
+      && !(name === 'task.ledger_import' && result.already_current === true);
+    if (shouldProject) {
       const job = runtimeState.enqueueProjection(toolDb, { tool_name: name });
       const processed = runtimeState.processProjectionJobs(toolDb, { rootDir, project, limit: 500 });
       const own = processed.jobs.find((item) => item.id === job.id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra-builder-pro-cli",
-  "version": "0.21.1",
+  "version": "0.22.0",
   "description": "Explicitly invoked Ultra Builder Pro workflows for Claude Code, OpenCode, Codex CLI, and Kimi Code, with project-local MCP authority and lifecycle recovery.",
   "bin": {
     "ultra-builder-pro-cli": "bin/install.js",

package/skills/ultra-change/SKILL.md

@@ -13,8 +13,10 @@ Read `../ultra-think/references/decision-dialogue.md` before asking a material q
 
 ## Inspect and align
 
-1. Read `system.doctor`, `baseline.get`, active changes, breadcrumb `accepted_intent`,
-   decisions, and `change.breadcrumb`.
+1. Read `system.doctor`, `task.ledger_get`, `baseline.get`, active changes, breadcrumb
+   `accepted_intent`, decisions, and `change.breadcrumb`. Import a newer descendant
+   checkpoint before capturing intent. Stop on a typed baseline, Change, task,
+   ancestry, or active-session conflict.
 2. Resume an existing change that matches the request. Do not duplicate authority.
 3. Ordinary work requires a healthy ready baseline. An incident may use only an
    explicit `baseline_bypass` reason and approver; urgency is not approval.
@@ -64,6 +66,12 @@ artifact, finding, plan, context, test result, review result, documentation upda
 and progress projection below `.ultra/changes/active/<id>/`. Incidents maintain the
 structured diagnosis artifact there as well.
 
+`change.create` and `change.update` publish the portable Change Contract to
+`.ultra/tasks/tasks.json`, even before the Change owns tasks. The tracked Change
+artifacts carry semantic bodies; the checkpoint carries normalized baseline, Change,
+and task records with digest ancestry. Never edit either generated checkpoint or
+checkout-local projection directly.
+
 Before planning a standard or major change, write the accepted specification updates
 to the Change overlay and call `change.delta` with exact baseline id, repository
 revision, specification digests, decisions, non-goals, acceptance, documentation

package/skills/ultra-deliver/SKILL.md

@@ -10,8 +10,9 @@ push, tag, registry publication, deployment, or another external effect.
 
 ## Bind current evidence
 
-1. Read doctor, baseline, change, breadcrumb `accepted_intent`, decisions, tasks, test,
-   review, learning, and current checkout.
+1. Read doctor, `task.ledger_get`, baseline, change, breadcrumb `accepted_intent`,
+   decisions, tasks, test, review, learning, and current checkout. Import a newer
+   descendant checkpoint before convergence; stop on any typed merge conflict.
 2. Resume or start a deliver workflow bound to the change and baseline.
 3. Require complete task evidence, a current test report, both review axes, current
    context, and resolved material decisions. Record `bind-evidence`.
@@ -39,6 +40,7 @@ and recovery sanity. Record the immutable context under `verify-candidate`.
 
 Call `change.converge`; MCP derives readiness from durable dev, test, review,
 typed delta, documentation reconciliation, diagnosis, and current checkout evidence.
+Successful convergence publishes the current portable team checkpoint.
 Record
 `converge-authority` only when ready.
 
@@ -46,7 +48,8 @@ Call `change.archive` with the summary. MCP preflights all target before states
 overlay digests, applies the complete packet atomically, refreshes baseline authority,
 rebinds every registered artifact into the self-contained archive, and rolls back or
 resumes from its transaction journal after interruption. A partial success is not
-delivery. Verify the refreshed baseline and archived packet, then record
+delivery. Archive publication refreshes the checkpoint with the archived Change and
+new baseline summary. Verify the refreshed baseline and archived packet, then record
 `archive-change`.
 
 Write `<archived-change-root>/delivery/<workflow-id>/report.json` with

package/skills/ultra-dev/SKILL.md

@@ -10,8 +10,10 @@ fresh context contract, session lease, evidence references, and recovery.
 
 ## Bind and resume
 
-1. Read doctor, breadcrumb `accepted_intent`, active decisions, task contract,
-   dependencies, dev runs, sessions, HEAD, and worktree.
+1. Read doctor, `task.ledger_get`, breadcrumb `accepted_intent`, active decisions, task
+   contract, dependencies, dev runs, sessions, HEAD, and worktree. Import a newer
+   descendant team checkpoint before taking a lease. Stop on a typed baseline, Change,
+   task, ancestry, or active-session conflict; do not merge authority by editing JSON.
 2. Resume the matching dev run or start one with `change_id` and `task_id`.
 3. Record `bind-task` with current authority and dependency evidence.
 4. Compile `change.context` with `role: implement` and `gate: implementation`. The
@@ -47,8 +49,18 @@ evidence, never task completion.
 5. Run a task-scoped independent review on specification fidelity and relevant
    engineering risks. Record `review-slice`. Fix blocking findings and refresh affected
    evidence.
-6. Create the authorized local task commit. Do not push, publish, tag, or deploy unless
-   the user separately authorized that external effect.
+6. In direct mode, update the task to `completed` only after verification and review
+   are current. This publishes the durable team ledger checkpoint. Create one
+   authorized local task commit containing code, semantic artifacts, and that
+   checkpoint. Read the resulting `HEAD`, then record it as `completion_commit`;
+   that hash remains checkout-local and must not create another Git commit. Do not
+   push, publish, tag, or deploy unless the user separately authorized that external
+   effect.
+
+The tracked team checkpoint contains durable task status and contract evidence, not
+live ownership. `in_progress`, `session_id`, leases, worktrees, telemetry, and
+`completion_commit` remain checkout-local. The local generated task view lives under
+`.ultra/.runtime/projections/` and is never committed.
 
 Treat the compiled task-context contract as the handoff boundary: purpose, why,
 constraints, non-goals, target seams/files, pattern refs, acceptance, documentation
@@ -69,8 +81,11 @@ those capabilities.
 ## Complete or recover
 
 In direct mode, integrate the task commit through the repository's accepted path,
-verify ancestry and the public seam, close the session, update the task to `completed`,
-record `record-completion`, and complete the dev workflow.
+verify ancestry and the public seam, close the session, record `record-completion`,
+and complete the dev workflow. If commit creation fails after the pre-commit
+completion checkpoint, move the still-session-owned task to `blocked`, preserve the
+worktree, and record the failure. A completion with a recorded commit remains
+terminal.
 
 Change convergence revalidates the exact latest
 `change_id + task_id + implement + implementation` snapshot for every executable

package/skills/ultra-doctor/SKILL.md

@@ -19,6 +19,8 @@ Run `system.doctor` without repair and inspect:
 - baseline and research provenance, gaps, digests, and Git/worktree drift;
 - workflow status, obsolete-step migration, blockers, and output freshness;
 - decisions and checkpoint artifact freshness;
+- Git team-checkpoint schema, ancestry, per-baseline, per-Change, and per-task drift,
+  plus checkout-local baseline revalidation requirements;
 - projection jobs and event cursors;
 - sessions, preserved worktrees, incidents, circuit state, and archive journals;
 - external provider boundaries.
@@ -39,11 +41,18 @@ With explicit repair authorization, `system.doctor` may:
 - recover missing workflow provenance as a blocked run requiring real evidence.
 
 It may not create a Git checkpoint, replace a healthy baseline, accept known failures,
-resolve decisions, regenerate semantic content, or edit application code.
+resolve decisions, regenerate semantic content, import or publish the team checkpoint,
+or edit application code. A missing or drifted valid checkpoint is a warning; invalid
+content or conflicting ancestry is degraded authority. Resolve semantic checkpoint
+state explicitly with `task.ledger_import` or `task.ledger_publish` after reviewing
+the typed conflict.
 
 Corrupt SQLite requires preservation of DB, WAL, and SHM followed by an explicit
 restore-or-rebaseline choice. Missing hook adapters or stale cache paths require
 `ubp --doctor` and adapter reinstall; never patch plugin cache contents by hand.
+A legacy task projection is never rewritten by doctor. The supported publication path
+first proves its durable task fields match SQLite and preserves its original bytes in
+the local runtime backup directory.
 
 After repair, rerun doctor read-only and verify backup paths, schema, installed hashes,
 entry points, MCP startup, and hook smoke tests as applicable.

package/skills/ultra-init/SKILL.md

@@ -15,9 +15,11 @@ the next semantic workflow.
    monorepo boundaries, and current owner request.
 2. If `.ultra/.runtime/state.db` exists, run `system.doctor` read-only and resume with
    `task.init_project` only when its report permits it.
-3. Otherwise call `task.init_project` with `mode: "auto"`, the project name, and an
+3. Read the Git-facing team checkpoint when present. Never parse a legacy
+   `.ultra/tasks/tasks.json` as current authority or edit it directly.
+4. Otherwise call `task.init_project` with `mode: "auto"`, the project name, and an
    explicit scope only when the repository contains multiple plausible roots.
-4. Leave `git_mode` as `auto` unless the user explicitly requires a non-Git workspace.
+5. Leave `git_mode` as `auto` unless the user explicitly requires a non-Git workspace.
 
 Use repository evidence to classify:
 
@@ -50,19 +52,25 @@ The operation must:
 
 - create or migrate `.ultra/.runtime/state.db` with a backup before schema migration;
 - install only missing scaffold assets on resume;
+- create an empty `.ultra/tasks/tasks.json` team checkpoint for a new project;
+- import a validated team checkpoint on clone or resume, while requiring
+  checkout-local revalidation before an imported ready baseline can authorize work;
 - preserve existing artifacts and unrelated work;
 - preserve an existing Git repository and HEAD;
 - initialize Git and a safe `.gitignore` entry when Git is absent;
 - report an unborn repository as `initial_commit_required` without manufacturing a
   commit, remote, tag, or push;
-- read back the created DB, classification, projection, and Git result before
-  completing the init workflow.
+- read back the created DB, classification, local runtime projection, team checkpoint,
+  and Git result before completing the init workflow.
 
 Projection-only projects must use the exact backup-first migration command returned by
-the runtime. A migrated compatibility baseline requires a new brownfield adoption with
+the runtime. On the first supported team-checkpoint publication, a matching legacy
+task projection is copied byte-for-byte into `.ultra/.runtime/backups/task-ledger/`
+before replacement; any task-id or durable-field mismatch stops with a typed conflict.
+A migrated compatibility baseline requires a new brownfield adoption with
 `replace_migrated: true`. Replacing a healthy baseline requires explicit replacement
-authority. Corrupt DB, WAL, SHM, and backups must be preserved until the user chooses a
-documented recovery operation.
+authority. Corrupt DB, WAL, SHM, and backups must be preserved until the user chooses
+a documented recovery operation.
 
 ## Completion and handoff
 
@@ -79,7 +87,8 @@ Read the returned `allowed_transitions` and `required_transition`:
   capability and wait for an explicit user invocation.
 
 Report classification, scope, schema and backup result, Git state, init workflow id,
-baseline state, and allowed transitions. Do not claim that a baseline is ready until a
-separate research/adoption workflow has recorded and converged it.
+team-checkpoint import or revalidation state, baseline state, and allowed transitions.
+Do not claim that a baseline is ready until a separate research/adoption workflow has
+recorded and converged it in the current checkout.
 
 Never invoke the recommended capability here; wait for an explicit user invocation.

package/skills/ultra-plan/SKILL.md

@@ -11,8 +11,11 @@ accepted Change Contract without adding ceremonial approval.
 
 ## Bind current authority
 
-1. Read doctor, baseline, change, breadcrumb `accepted_intent`, decisions, existing plan
-   runs, tasks, and current checkout.
+1. Read doctor, `task.ledger_get`, baseline, change, breadcrumb `accepted_intent`,
+   decisions, existing plan runs, tasks, and current checkout. If a new Git checkpoint
+   arrived after this MCP process started, call `task.ledger_import` before planning.
+   Stop on a typed baseline, Change, task, ancestry, or active-session conflict; never
+   choose one side by editing the ledger.
 2. Require one mutable change with a healthy baseline or recorded incident bypass.
    For the first delivery of a greenfield project, an accepted ready baseline may
    already contain the complete delivery outcome. When no matching Change exists,
@@ -98,8 +101,9 @@ plus acceptance, recovery, documentation impact, and the definition of drift. Ke
 large referenced files lazy; do not paste their bodies into the plan packet.
 
 Use estimates only when evidence supports them. A quick change has exactly one task.
-Read every task back from DB. Never read or write `.ultra/tasks/tasks.json` directly;
-it is a generated projection, not authority.
+Read every task back from DB. Never read or write `.ultra/tasks/tasks.json` directly.
+It is the MCP-published Git team checkpoint, while
+`.ultra/.runtime/projections/tasks.json` is the generated checkout-local view.
 
 If a semantic `change.update` invalidated existing tasks, reconcile every affected
 task contract against the current intent, acceptance, decisions, and research
@@ -111,6 +115,9 @@ Validate the change-scoped graph with `task.dependency_topo`. Export
 the deterministic `<artifact_root>/plan.json` and `<artifact_root>/plan.md` pair with
 `plan.export { change_id }`. The JSON binds the exact planning context snapshot and
 manifest digest; the Markdown is a deterministic human view of the same task graph.
+An accepted export also publishes the portable baseline, Change, task contracts,
+dependencies, and durable statuses to the team checkpoint. Local sessions, leases,
+`in_progress` ownership, telemetry, and completion hashes remain in `.ultra/.runtime`.
 Read the JSON through `plan.get` and record it as the `verify-plan` output. Do not
 choose an arbitrary output path or overwrite another Change's plan. A legacy global
 `.ultra/execution-plan.json` may be read for migration diagnosis only and is never a

package/skills/ultra-research/SKILL.md

@@ -5,16 +5,16 @@ description: Build or refresh an evidence-backed product and architecture baseli
 
 # Research with adaptive coverage
 
-The model owns investigation, synthesis, and coverage recommendations; the user owns
-the accepted semantic route and material deferrals. MCP owns run state, evidence,
-semantic records, digests, freshness, and convergence, not a questionnaire.
+The model owns investigation, synthesis, and coverage recommendations; the user owns the accepted semantic route and material deferrals.
+MCP owns run state, evidence, semantic records, digests, freshness, and convergence, not a questionnaire.
 
 Read `../ultra-think/references/decision-dialogue.md` before asking a material question.
 
 ## Bind authority
 
-1. Read `system.doctor`, `baseline.get`, breadcrumb `accepted_intent`, active decisions,
-   and existing research runs.
+1. Read `system.doctor`, `task.ledger_get`, `baseline.get`, breadcrumb
+   `accepted_intent`, active decisions, and existing research runs. Import a newer
+   descendant team checkpoint before binding coverage; stop on a typed merge conflict.
 2. Resume the matching active, blocked, or ready run. Do not create parallel authority.
 3. If none exists, use `full` for greenfield, `adoption` for brownfield, or a bounded
    mode only for a recorded active-Change disposition. Focused baseline coverage
@@ -35,8 +35,7 @@ Read `../ultra-think/references/decision-dialogue.md` before asking a material q
 8. Read back the created workflow and accepted coverage. When a durable decision thread
    recorded the route, complete it with the workflow reference in `applied_refs`.
 
-`99-synthesis` must execute, verify, or reuse. A missing disposition is a coverage
-error only for an included area; a recorded exclusion with evidence is not incomplete.
+`99-synthesis` must execute, verify, or reuse. A missing disposition is a coverage error only for an included area; a recorded exclusion with evidence is not incomplete.
 
 ## Coverage catalog
 
@@ -102,7 +101,9 @@ run as blocked with `BASELINE_GIT_HEAD_REQUIRED`.
 Call `baseline.converge` only when the user has accepted the exact baseline snapshot,
 known failures, blocking gaps, and scope. Reuse an unambiguous current approval; do not
 ask twice. MCP must reject stale research, drift, missing evidence, and unaccepted
-failures.
+failures. Successful convergence publishes the portable baseline, Changes, and tasks
+to the Git team checkpoint; the receiving checkout must still revalidate a ready
+baseline against its own HEAD and files.
 
 Reuse the final research acceptance or current artifact checkpoint during baseline
 convergence; do not ask for an equivalent approval again. After initial or adoption
@@ -110,10 +111,8 @@ convergence, `ultra-change` becomes an available transition. Bounded change rese
 returns to its owning Change authority; the next route is still `ultra-plan`, never
 direct implementation.
 
-Return a compact coverage summary by disposition, current evidence or decision
-blocker, baseline state, gaps, and allowed transitions. Recommend a semantic next
-action from those transitions. If current intent does not already select it, present
-the recommendation and credible alternatives through the interaction protocol, then
-wait. MCP supplies only valid and required transitions.
+Return a compact coverage summary by disposition, current evidence or decision blocker, baseline state, gaps, and allowed transitions.
+Recommend a semantic next action from those transitions. If current intent does not already select it, present the recommendation
+and credible alternatives through the interaction protocol, then wait. MCP supplies only valid and required transitions.
 
 Never invoke the recommended capability here; wait for an explicit user invocation.

package/skills/ultra-review/SKILL.md

@@ -17,10 +17,12 @@ Neither axis can compensate for the other.
 
 1. Read `references/review-modes.md` and select `plan`, `task`, or `change` from the
    actual review request.
-2. Bind one explicit diff or plan artifact, full HEAD, worktree digest, task set,
+2. Read doctor and `task.ledger_get`. Import a newer descendant checkpoint before
+   binding the review scope; stop on a typed merge conflict.
+3. Bind one explicit diff or plan artifact, full HEAD, worktree digest, task set,
    acceptance, breadcrumb `accepted_intent`, and current decision state.
-3. Resume or start the review workflow and record `bind-diff`.
-4. Compile `change.context` for `review` and record the immutable manifest under
+4. Resume or start the review workflow and record `bind-diff`.
+5. Compile `change.context` for `review` and record the immutable manifest under
    `compile-context`.
 
 An empty, ambiguous, or stale scope cannot pass.

package/skills/ultra-status/SKILL.md

@@ -5,20 +5,23 @@ description: Read authoritative Ultra health, workflows, decisions, changes, tas
 
 # Report authoritative state
 
-This Skill is read-only. Never fall back to generated task JSON, prose, or context
-frontmatter when DB authority is missing or degraded.
+This Skill is read-only. Never fall back to the Git team checkpoint, generated task
+JSON, prose, or context frontmatter when checkout-local DB authority is missing or
+degraded.
 
 ## Read
 
 1. Run `system.doctor` without repair.
-2. Read baseline classification, revision, worktree, research provenance, gaps, and
+2. Run `task.ledger_get`. Report `current`, `drifted`, `revalidation_required`,
+   `missing`, or a typed invalid/conflict state; do not import or publish from status.
+3. Read baseline classification, revision, worktree, research provenance, gaps, and
    health.
-3. Read current decision state and breadcrumb `accepted_intent` without exposing hidden
+4. Read current decision state and breadcrumb `accepted_intent` without exposing hidden
    future questions.
-4. Read active, blocked, and ready workflows and their current steps.
-5. Read the active Change root, typed delta, plan, deterministic progress projection,
+5. Read active, blocked, and ready workflows and their current steps.
+6. Read the active Change root, typed delta, plan, deterministic progress projection,
    documentation reconciliation, findings, tasks, sessions, and current Git state.
-6. Read test, review, and delivery artifacts only through DB references and verify
+7. Read test, review, and delivery artifacts only through DB references and verify
    their digests and revisions.
 
 If authority is unreadable, report the unavailable panel and the required doctor or
@@ -47,6 +50,7 @@ Decision: <current|checkpoint|none>
 Change: <id/status|none> · delta=<fresh|stale|missing> · docs=<fresh|stale|missing>
 Task: <id/status|none> · Sessions: <active>
 Evidence: plan=<state> · test=<state> · review=<axes> · delivery=<state>
+Team checkpoint: <current|drifted|revalidation_required|missing|invalid> · generation=<n>
 Blockers: <codes or none>
 Warnings: <codes or none>
 Allowed transitions: <capabilities>

package/skills/ultra-test/SKILL.md

@@ -10,8 +10,9 @@ projections as proof.
 
 ## Bind scope
 
-1. Read doctor, change, breadcrumb `accepted_intent`, decisions, task and dev evidence,
-   current checkout, and prior report freshness.
+1. Read doctor, `task.ledger_get`, change, breadcrumb `accepted_intent`, decisions,
+   task and dev evidence, current checkout, and prior report freshness. Import a newer
+   descendant checkpoint before binding the task set; stop on a typed merge conflict.
 2. Resume or start a test workflow bound to the exact change and optional task.
 3. Record `bind-scope`, then compile `change.context` for `check` and record its
    immutable manifest under `compile-context`.

package/spec/cli-protocol.md

@@ -91,6 +91,9 @@ as a fallback unless `ultra-tools <family> --help` lists it.
 | `task.expand`             | `task expand`               | 8a    | mcp     |
 | `task.parse_prd`          | `task parse-prd`            | 8a    | mcp     |
 | `task.dependency_topo`    | `task topo`                 | 8a    | mcp     |
+| `task.ledger_get`         | `task ledger-get`           | 21    | any     |
+| `task.ledger_publish`     | `task ledger-publish`       | 21    | mcp     |
+| `task.ledger_import`      | `task ledger-import`        | 21    | mcp     |
 | `task.append_event`       | `task append-event`         | 2     | any (allowlisted observations only) |
 | `task.subscribe_events`   | `task subscribe`            | 2     | any     |
 | `session.spawn`           | `session spawn`             | 4.5   | mcp     |