ultra-builder-pro-cli 0.23.0 → 0.24.1

package/spec/mcp-tools.yaml

@@ -3,41 +3,33 @@
 # Validated by spec/schemas/mcp-tools.schema.json (run `npm run test:spec`).
 # Current authority boundary: docs/DECISIONS.md.
 
-version: '1.3'
+version: '2.0'
 
 info:
   title: Ultra Builder Pro MCP tool contracts
-  phase: '1.2'
+  phase: '24'
   trace_to: 'docs/DECISIONS.md and mcp-server/server.cjs'
   notes: |
     This published contract contains only tools registered by the MCP server.
     Host-native review, impact, skill discovery, and human-interaction capabilities
     are documented by each adapter's capability map rather than advertised as MCP.
-    Generators consume this YAML to derive types, validators, and CLI parsers (R19).
-    cli_subcommand values reserve stable names; runtime availability is defined by
-    ultra-tools <family> --help. Task lifecycle skills use MCP and fail closed.
+    Generators consume this YAML to derive types, validators, and CLI parsers.
+    cli_subcommand values reserve stable names. Skills adapt semantic workflows;
+    MCP persists facts, creates immutable checkpoints, and protects only transactional
+    safety boundaries.
     Adding a tool requires: (a) update this file, (b) add valid+invalid
     fixture to spec/fixtures/{valid,invalid}/, (c) `npm run test:spec` green.
 
 families:
-  - { name: ultra,   description: 'narrow model-facing persistence and safety kernel', phase: '23' }
-  - { name: task,    description: 'authoritative task lifecycle on state.db', phase: '2' }
-  - { name: session, description: 'execution-unit lifecycle with single-active-lease admission (D33)', phase: '4.5' }
-  - { name: plan,    description: 'execution-plan artifact export and query (D34)', phase: '8a' }
-  - { name: baseline, description: 'project adoption, baseline evidence, convergence, and drift authority', phase: '11' }
-  - { name: change,  description: 'continuous post-delivery change lifecycle and convergence', phase: '9' }
-  - { name: decision, description: 'durable owner-agent alignment, one-question presentation, and approved checkpoints', phase: '16' }
-  - { name: workflow, description: 'durable cross-stage run position, evidence, outputs, blockers, and recovery', phase: '13' }
-  - { name: artifact, description: 'typed semantic and evidence artifact ownership, digest, provenance, and dependency graph', phase: '20' }
-  - { name: system,  description: 'read-only diagnostics and explicit backup-first repair', phase: '9' }
+  - { name: ultra, description: 'model-facing persistence and safety kernel', phase: '24' }
 
 tools:
 
   # ───────────────────── public model-facing kernel ─────────────────────
   - name: ultra.context
     family: ultra
-    description: Read the complete current Ultra spine and optionally compile one stage-scoped Context Manifest. This tool reports warnings and blockers without choosing the next semantic action.
-    phase: '23'
+    description: Read one bounded canonical Context Envelope. This tool is side-effect free and reports diagnostics without choosing the next semantic action.
+    phase: '24'
     readonly: true
     writer_role: mcp
     input_schema:
@@ -61,7 +53,7 @@ tools:
   - name: ultra.record
     family: ultra
     description: Record one or more typed draft facts or actions with per-entry idempotency. Semantic rejections are returned as mutable diagnostics rather than transport errors.
-    phase: '23'
+    phase: '24'
     writer_role: mcp
     input_schema:
       type: object
@@ -73,10 +65,29 @@ tools:
           minItems: 1
           items:
             type: object
-            required: [operation, data, idempotency_key]
+            required: [kind, action, data, idempotency_key]
             additionalProperties: false
             properties:
-              operation: { type: string, minLength: 3 }
+              kind:
+                type: string
+                enum: [baseline, change_contract, decision, task_contract, task_outcome, artifact, event]
+              action:
+                type: string
+                enum:
+                  - initialize
+                  - start
+                  - observe
+                  - accept
+                  - open
+                  - revise
+                  - cancel
+                  - define
+                  - remove
+                  - complete
+                  - block
+                  - reopen
+                  - bind
+                  - append
               data: { type: object }
               idempotency_key: { type: string, minLength: 3 }
     output_schema: { type: object }
@@ -89,8 +100,8 @@ tools:
 
   - name: ultra.checkpoint
     family: ultra
-    description: Attempt one semantic stage checkpoint. Failed semantic checks return blockers and leave the draft mutable; accepted checkpoints commit durable authority once.
-    phase: '23'
+    description: Commit one caller-declared stage checkpoint after validating scope, structure, idempotency, current file bytes, digests, and transactional publication. Semantic completeness remains a Skill/model judgment and is returned only as advisory diagnostics.
+    phase: '24'
     writer_role: mcp
     input_schema:
       type: object
@@ -111,20 +122,24 @@ tools:
       - { code: VALIDATION_ERROR, description: 'input failed structural validation' }
       - { code: STATE_CORRUPT, description: 'local authority cannot be checkpointed safely' }
       - { code: PATH_AUTHORITY_VIOLATION, description: 'checkpoint evidence escapes managed authority' }
+      - { code: CHECKPOINT_EVIDENCE_AUTHORITY_MISSING, description: 'declared checkpoint evidence is not current managed authority' }
+      - { code: CHECKPOINT_EVIDENCE_DIGEST_MISMATCH, description: 'declared checkpoint evidence bytes changed' }
+      - { code: CHECKPOINT_SCOPE_NOT_FOUND, description: 'the explicit Task or Change scope does not exist' }
+      - { code: CHECKPOINT_SCOPE_MISMATCH, description: 'the explicit Task does not belong to the supplied Change scope' }
     cli_subcommand: 'ultra checkpoint'
     emits_events: [ultra_checkpoint_accepted, ultra_checkpoint_rejected]
 
   - name: ultra.sync
     family: ultra
     description: Inspect, import, or publish the Git team checkpoint while preserving local sessions and rejecting real concurrent team-state conflicts.
-    phase: '23'
+    phase: '24'
     writer_role: mcp
     input_schema:
       type: object
       required: [action]
       additionalProperties: false
       properties:
-        action: { type: string, enum: [inspect, import, publish] }
+        action: { type: string, enum: [inspect, import, publish, migrate] }
         reason: { type: string }
         idempotency_key: { type: string }
     output_schema: { type: object }
@@ -137,7 +152,7 @@ tools:
   - name: ultra.session
     family: ultra
     description: Acquire, inspect, heartbeat, or release the small execution lease that requires transactional concurrency control.
-    phase: '23'
+    phase: '24'
     writer_role: mcp
     input_schema:
       type: object
@@ -157,8 +172,8 @@ tools:
 
   - name: ultra.archive
     family: ultra
-    description: Converge and archive one accepted Change through the recoverable filesystem and database transaction boundary.
-    phase: '23'
+    description: Archive one caller-declared local Change handoff through a recoverable filesystem and database transaction. The kernel validates authority, paths, digests, reconciliation structure, and recovery safety without requiring a fixed semantic stage sequence.
+    phase: '24'
     writer_role: mcp
     input_schema:
       type: object
@@ -178,7 +193,7 @@ tools:
   - name: ultra.doctor
     family: ultra
     description: Inspect mechanical health and optionally apply only backup-first deterministic repairs. Semantic choices remain with the model and owner.
-    phase: '23'
+    phase: '24'
     writer_role: mcp
     input_schema:
       type: object
@@ -190,2781 +205,3 @@ tools:
       - { code: STATE_CORRUPT, description: 'the state database cannot be inspected safely' }
       - { code: BACKUP_FAILED, description: 'a required recovery backup could not be created' }
     cli_subcommand: 'ultra doctor'
-
-  # ─────────────────────────── task family ────────────────────────────────
-  - name: task.create
-    family: task
-    description: Create a new task in state.db. Emits task_created event. If `id` is omitted the server mints a uuid. Child tasks inherit the parent's change ownership; conflicting ownership is rejected.
-    phase: '2'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [title, type, priority]
-      additionalProperties: false
-      properties:
-        id:             { type: string, pattern: '^[a-zA-Z0-9_\-]+$', description: 'optional caller-supplied id; otherwise server mints a uuid' }
-        title:          { type: string, minLength: 3 }
-        type:           { type: string, enum: [architecture, feature, bugfix] }
-        priority:       { type: string, enum: [P0, P1, P2, P3] }
-        complexity:     { type: integer, minimum: 1, maximum: 10 }
-        estimated_days: { type: number, exclusiveMinimum: 0, description: 'estimated implementation effort in days' }
-        deps:           { type: array, items: { type: string } }
-        files_modified: { type: array, items: { type: string }, description: 'Phase 8A conflict detection' }
-        parent_id:      { type: string, description: 'Phase 8A.3 parent reference; the child inherits this task change ownership' }
-        tag:            { type: string, description: 'git branch tag (Phase 7.2)' }
-        trace_to:       { type: string, description: 'spec anchor (e.g. spec/mcp-tools.yaml#task.create)' }
-        outcome:        { type: string, minLength: 1, description: 'observable result owned by this task' }
-        slice_kind:     { type: string, enum: [tracer_bullet, expand_contract, integration_checkpoint] }
-        public_seam:    { type: string, minLength: 1, description: 'public or integration seam exercised by the slice' }
-        verification_command: { type: string, minLength: 1, description: 'exact task-level verification command' }
-        acceptance:
-          type: array
-          minItems: 1
-          items:
-            type: object
-            required: [id, criterion, verification]
-            additionalProperties: false
-            properties:
-              id: { type: string, minLength: 1 }
-              criterion: { type: string, minLength: 1 }
-              verification: { type: string, minLength: 1 }
-        context_refs:
-          type: array
-          minItems: 1
-          items:
-            type: object
-            required: [ref, reason]
-            additionalProperties: false
-            properties:
-              ref: { type: string, minLength: 1 }
-              reason: { type: string, minLength: 1 }
-              kind: { type: string, enum: [spec, source, test, docs, external], default: source }
-              required: { type: boolean, default: true }
-              expected_digest: { type: string, pattern: '^[0-9a-f]{64}$' }
-              digest: { type: string, pattern: '^[0-9a-f]{64}$', description: 'legacy alias for expected_digest' }
-              anchor: { type: string, minLength: 1 }
-              scope: { type: string, minLength: 1 }
-              freshness_policy: { type: string, enum: [digest, existence, advisory] }
-        docs_impact:
-          type: object
-          required: [status, files, rationale]
-          additionalProperties: false
-          properties:
-            status: { type: string, enum: [unknown, required, none] }
-            files: { type: array, items: { type: string, minLength: 1 } }
-            rationale: { type: ['string', 'null'] }
-        ownership:
-          type: object
-          required: [owner]
-          additionalProperties: false
-          properties:
-            owner: { type: string, minLength: 1 }
-            reviewers: { type: array, items: { type: string, minLength: 1 }, default: [] }
-        change_id:      { type: string, pattern: '^[a-zA-Z0-9_\-]+$', description: 'active or blocked continuous change unit owning this task; inherited from parent_id when omitted' }
-    output_schema:
-      type: object
-      required: [id, status, created_at]
-      additionalProperties: false
-      properties:
-        id:         { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-        status:     { type: string, enum: [pending] }
-        created_at: { type: string, format: date-time }
-    errors:
-      - { code: VALIDATION_ERROR, description: 'input failed schema validation' }
-      - { code: DUPLICATE_TASK_ID, description: 'task id already exists' }
-      - { code: TASK_NOT_FOUND, description: 'parent task does not exist' }
-      - { code: CHANGE_NOT_FOUND, description: 'assigned change does not exist' }
-      - { code: CHANGE_NOT_MUTABLE, description: 'assigned change no longer accepts tasks' }
-      - { code: TASK_CHANGE_OWNERSHIP_MISMATCH, description: 'child ownership conflicts with its parent change' }
-      - { code: BASELINE_NOT_READY, description: 'ordinary task creation requires a ready baseline or an already-authorized active change' }
-      - { code: LEGACY_STATE_MIGRATION_REQUIRED, description: 'non-empty v4.4 projection must be migrated before state-backed tools can run' }
-      - { code: STATE_DB_LOCKED, description: 'database is locked', retriable: true }
-    cli_subcommand: task create
-    emits_events: [task_created]
-    trace_to: '§7.3, §7.1'
-
-  - name: task.update
-    family: task
-    description: Patch a task's mutable fields. status transitions enforced server-side.
-    phase: '2'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, patch]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-        patch:
-          type: object
-          additionalProperties: false
-          properties:
-            status:        { type: string, enum: [pending, in_progress, completed, blocked, expanded] }
-            priority:      { type: string, enum: [P0, P1, P2, P3] }
-            complexity:    { type: integer, minimum: 1, maximum: 10 }
-            estimated_days: { type: number, exclusiveMinimum: 0 }
-            deps:          { type: array, items: { type: string } }
-            files_modified: { type: array, items: { type: string } }
-            session_id:    { type: string }
-            stale:         { type: boolean }
-            tag:           { type: string }
-            trace_to:      { type: string }
-            outcome:       { type: string, minLength: 1 }
-            slice_kind:    { type: string, enum: [tracer_bullet, expand_contract, integration_checkpoint] }
-            public_seam:   { type: string, minLength: 1 }
-            verification_command: { type: string, minLength: 1 }
-            acceptance:    { type: array, items: { type: object } }
-            context_refs:  { type: array, items: { type: object } }
-            docs_impact:   { type: object }
-            ownership:     { type: object }
-            completion_commit: { type: string, pattern: '^[0-9a-f]{7,40}$' }
-            change_id:    { type: ['string', 'null'], pattern: '^[a-zA-Z0-9_\-]+$' }
-    output_schema:
-      type: object
-      required: [ok, task]
-      additionalProperties: false
-      properties:
-        ok:   { type: boolean }
-        task: { type: object }
-    errors:
-      - { code: TASK_NOT_FOUND, description: 'no task with given id' }
-      - { code: ILLEGAL_STATUS_TRANSITION, description: 'transition rejected by state machine' }
-      - { code: VALIDATION_ERROR, description: 'patch failed schema validation' }
-      - { code: CHANGE_NOT_FOUND, description: 'assigned change does not exist' }
-      - { code: CHANGE_NOT_MUTABLE, description: 'assigned change no longer accepts task updates' }
-      - { code: TASK_CHANGE_OWNERSHIP_MISMATCH, description: 'task ownership conflicts with its parent or children' }
-      - { code: TASK_EXECUTION_CONTRACT_INCOMPLETE, description: 'task is not executable until its outcome, seam, checks, evidence context, docs impact, ownership, and traceability are complete' }
-      - { code: TASK_STALE_RECONCILIATION_REQUIRED, description: 'stale can clear only while rebinding and validating the complete task execution contract' }
-      - { code: LEGACY_STATE_MIGRATION_REQUIRED, description: 'non-empty v4.4 projection must be migrated before state-backed tools can run' }
-    cli_subcommand: task update
-    emits_events: [task_started, task_completed, task_blocked, task_stale_marked, task_contract_updated, task_contract_reconciled]
-    trace_to: '§7.3, §7.2'
-
-  - name: task.list
-    family: task
-    description: List tasks filtered by status / tag / time window.
-    phase: '2'
-    readonly: true
-    writer_role: any
-    input_schema:
-      type: object
-      additionalProperties: false
-      properties:
-        status: { type: string, enum: [pending, in_progress, completed, blocked, expanded, any] }
-        tag:    { type: string }
-        change_id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-        since:  { type: string, format: date-time }
-        limit:  { type: integer, minimum: 1, maximum: 1000 }
-    output_schema:
-      type: object
-      required: [tasks, count]
-      additionalProperties: false
-      properties:
-        tasks: { type: array, items: { type: object } }
-        count: { type: integer, minimum: 0 }
-    errors:
-      - { code: VALIDATION_ERROR, description: 'filter failed schema validation' }
-      - { code: LEGACY_STATE_MIGRATION_REQUIRED, description: 'non-empty v4.4 projection must be migrated before state-backed tools can run' }
-    cli_subcommand: task list
-    emits_events: []
-    trace_to: '§7.3'
-
-  - name: task.get
-    family: task
-    description: Fetch one task with its full row.
-    phase: '2'
-    readonly: true
-    writer_role: any
-    input_schema:
-      type: object
-      required: [id]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-    output_schema:
-      type: object
-      required: [task]
-      additionalProperties: false
-      properties:
-        task: { type: object }
-    errors:
-      - { code: TASK_NOT_FOUND, description: 'no task with given id' }
-    cli_subcommand: task get
-    emits_events: []
-    trace_to: '§7.3'
-
-  - name: task.ledger_get
-    family: task
-    description: Read the Git-facing durable baseline, Change, and task checkpoint ledger and compare it with local SQLite authority.
-    phase: '21'
-    readonly: true
-    writer_role: any
-    input_schema:
-      type: object
-      additionalProperties: false
-    output_schema:
-      type: object
-      required: [ledger, health]
-      additionalProperties: false
-      properties:
-        ledger: { type: ['object', 'null'] }
-        health: { type: object }
-    errors:
-      - { code: TASK_LEDGER_INVALID, description: 'the Git ledger is malformed' }
-      - { code: TASK_LEDGER_DIGEST_MISMATCH, description: 'ledger content does not match its digest' }
-      - { code: TASK_LEDGER_UNSAFE, description: 'ledger path is a symlink or non-regular file' }
-    cli_subcommand: task ledger-get
-    emits_events: []
-    trace_to: 'docs/ARTIFACT-AUTHORITY.md#team-task-ledger'
-
-  - name: task.ledger_publish
-    family: task
-    description: Publish a low-frequency Git-facing baseline, Change, and task checkpoint from local SQLite authority.
-    phase: '21'
-    writer_role: mcp
-    input_schema:
-      type: object
-      additionalProperties: false
-      properties:
-        reason:
-          type: string
-          minLength: 1
-          default: manual_checkpoint
-    output_schema:
-      type: object
-      required: [changed, path, generation, state_digest]
-      additionalProperties: false
-      properties:
-        changed: { type: boolean }
-        path: { type: string }
-        generation: { type: integer, minimum: 0 }
-        state_digest: { type: string, pattern: '^[0-9a-f]{64}$' }
-        migrated_legacy_projection: { type: boolean }
-        legacy_backup_path: { type: string }
-    errors:
-      - { code: TASK_LEDGER_INVALID, description: 'the prior Git ledger is malformed' }
-      - { code: TASK_LEDGER_DIGEST_MISMATCH, description: 'prior ledger content does not match its digest' }
-      - { code: TASK_LEDGER_UNSAFE, description: 'ledger path is a symlink or non-regular file' }
-      - { code: TASK_LEDGER_CHANGE_MISSING, description: 'a task has no portable owning Change' }
-      - { code: TASK_LEDGER_LEGACY_CONFLICT, description: 'the legacy task projection differs from SQLite authority and cannot be replaced automatically' }
-      - { code: TASK_LEDGER_REVALIDATION_REQUIRED, description: 'an imported ready baseline must converge in this checkout before publication' }
-    cli_subcommand: task ledger-publish
-    emits_events: [task_ledger_published]
-    trace_to: 'docs/ARTIFACT-AUTHORITY.md#team-task-ledger'
-
-  - name: task.ledger_import
-    family: task
-    description: Import a validated Git checkpoint into local SQLite authority with per-baseline, per-Change, and per-task conflict checks.
-    phase: '21'
-    writer_role: mcp
-    input_schema:
-      type: object
-      additionalProperties: false
-    output_schema:
-      type: object
-      required: [imported, preserved, deleted, imported_changes, preserved_changes, imported_baseline, preserved_baseline, generation, state_digest, requires_plan_revalidation, requires_baseline_revalidation, already_current]
-      additionalProperties: false
-      properties:
-        imported: { type: integer, minimum: 0 }
-        preserved: { type: integer, minimum: 0 }
-        deleted: { type: integer, minimum: 0 }
-        imported_changes: { type: integer, minimum: 0 }
-        preserved_changes: { type: integer, minimum: 0 }
-        imported_baseline: { type: boolean }
-        preserved_baseline: { type: boolean }
-        generation: { type: integer, minimum: 0 }
-        state_digest: { type: string, pattern: '^[0-9a-f]{64}$' }
-        requires_plan_revalidation: { type: boolean }
-        requires_baseline_revalidation: { type: boolean }
-        already_current: { type: boolean }
-    errors:
-      - { code: TASK_LEDGER_INVALID, description: 'the Git ledger is malformed' }
-      - { code: TASK_LEDGER_DIGEST_MISMATCH, description: 'ledger content does not match its digest' }
-      - { code: TASK_LEDGER_UNSAFE, description: 'ledger path is a symlink or non-regular file' }
-      - { code: TASK_LEDGER_CONFLICT, description: 'the same task changed locally and in Git' }
-      - { code: TASK_LEDGER_ACTIVE_TASK_CONFLICT, description: 'Git changed a task with an active local session' }
-      - { code: TASK_LEDGER_STALE, description: 'the Git ledger is older than the last local checkpoint' }
-      - { code: TASK_LEDGER_HISTORY_CONFLICT, description: 'the Git ledger does not descend from the last local checkpoint' }
-      - { code: TASK_LEDGER_CHANGE_MISSING, description: 'a task references an unavailable Change' }
-      - { code: TASK_LEDGER_PARENT_MISSING, description: 'a task references an unavailable parent task' }
-      - { code: TASK_LEDGER_CHANGE_CONFLICT, description: 'the same Change changed locally and in Git' }
-      - { code: TASK_LEDGER_BASELINE_CONFLICT, description: 'the same baseline changed locally and in Git' }
-    cli_subcommand: task ledger-import
-    emits_events: [task_ledger_imported]
-    trace_to: 'docs/ARTIFACT-AUTHORITY.md#team-task-ledger'
-
-  - name: task.switch_tag
-    family: task
-    description: Change a task's tag (branch-scoped context partition, Phase 7.2). Emits task_tag_changed.
-    phase: '7.2'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, tag]
-      additionalProperties: false
-      properties:
-        id:  { type: string }
-        tag: { type: ['string', 'null'] }
-    output_schema:
-      type: object
-      required: [task_id, tag]
-      additionalProperties: false
-      properties:
-        task_id: { type: string }
-        tag:     { type: ['string', 'null'] }
-        from:    { type: ['string', 'null'] }
-    errors:
-      - { code: TASK_NOT_FOUND, description: 'no task with given id' }
-      - { code: VALIDATION_ERROR, description: 'task_id missing' }
-    cli_subcommand: task switch-tag
-    emits_events: [task_tag_changed]
-    trace_to: '§6, D26'
-
-  - name: task.delete
-    family: task
-    description: Hard-delete a task. Refuses if any in_progress session is bound.
-    phase: '2'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id]
-      additionalProperties: false
-      properties:
-        id:    { type: string }
-        force: { type: boolean, default: false }
-    output_schema:
-      type: object
-      required: [ok]
-      additionalProperties: false
-      properties:
-        ok: { type: boolean }
-    errors:
-      - { code: TASK_NOT_FOUND, description: 'no task with given id' }
-      - { code: SESSION_ACTIVE, description: 'task has an active session; pass force=true to override' }
-    cli_subcommand: task delete
-    emits_events: []
-    trace_to: '§7.3'
-
-  - name: task.init_project
-    family: task
-    description: |
-      Bootstrap `.ultra/`, classify the repository, initialize or preserve local
-      Git authority, and complete the initialization workflow. It creates no
-      research run; research begins only through an explicit workflow.start.
-    phase: '3'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [target_dir, project_name]
-      additionalProperties: false
-      properties:
-        target_dir:
-          type: string
-          description: absolute or repo-relative path of the project root where `.ultra/` will be created
-        project_name:
-          type: string
-          minLength: 1
-        project_type:
-          type: string
-          enum: [web, api, cli, fullstack, other]
-          description: optional; skill will pass detected value when available
-        stack:
-          type: string
-          description: optional tech stack descriptor (comma-separated for fullstack)
-        mode:
-          type: string
-          enum: [auto, greenfield, brownfield]
-          default: auto
-          description: auto detects whether meaningful project content already exists
-        git_mode:
-          type: string
-          enum: [auto, initialize, skip]
-          default: auto
-          description: preserve an existing repository, initialize a missing local repository by default, or explicitly keep a non-Git workspace
-        resume:
-          type: boolean
-          default: false
-          description: preserve an existing `.ultra/`, upgrade its schema, and install only missing current scaffold files
-        scope:
-          type: array
-          minItems: 1
-          uniqueItems: true
-          items: { type: string, minLength: 1 }
-          default: ['.']
-          description: project-relative repository roots governed by the initial baseline
-        overwrite:
-          type: boolean
-          default: false
-          description: when true, back up an existing `.ultra/` to `.ultra.backup.<ts>` then re-create
-        source_template:
-          type: string
-          description: override path to the template root (defaults to bundled templates/.ultra/)
-    output_schema:
-      type: object
-      required: [created_path, state_db_path, status, mode, baseline, copied_files, repository_profile, git, workflow]
-      additionalProperties: false
-      properties:
-        created_path:
-          type: string
-          description: absolute path to the created `.ultra/` directory
-        state_db_path:
-          type: string
-          description: absolute path to the initialized authoritative SQLite database
-        status:
-          type: string
-          enum: [created, overwritten, resumed]
-        mode:
-          type: string
-          enum: [greenfield, brownfield]
-        baseline:
-          type: object
-          required: [id, mode, status, scope]
-          additionalProperties: true
-        copied_files:
-          type: array
-          items: { type: string }
-          description: paths relative to created_path
-        repository_profile:
-          type: object
-          description: bounded classification evidence used to route greenfield or brownfield adoption
-        git:
-          type: object
-          required: [requested_mode, status, repository_root, branch, head, gitignore_path, gitignore_changed, initial_commit_required]
-          additionalProperties: false
-          properties:
-            requested_mode: { type: string, enum: [auto, initialize, skip] }
-            status: { type: string, enum: [initialized, existing, skipped] }
-            repository_root: { type: ['string', 'null'] }
-            branch: { type: ['string', 'null'] }
-            head: { type: ['string', 'null'] }
-            gitignore_path: { type: ['string', 'null'] }
-            gitignore_changed: { type: boolean }
-            initial_commit_required: { type: boolean }
-        workflow:
-          type: object
-          description: completed initialization provenance, research status, and the allowed or required transitions
-        backup_path:
-          type: string
-          description: set only when status=overwritten
-        migration_backup_path:
-          type: string
-          description: pre-migration database backup created while resuming an older schema
-        runtime_migration_backup_path:
-          type: string
-          description: verified backup of a legacy runtime layout moved into `.ultra/.runtime/`
-        team_checkpoint:
-          type: object
-          additionalProperties: false
-          required: [generation, state_digest, imported_tasks, deleted_tasks, imported_changes, imported_baseline, requires_plan_revalidation, requires_baseline_revalidation, already_current]
-          properties:
-            generation: { type: integer, minimum: 0 }
-            state_digest: { type: string, pattern: '^[0-9a-f]{64}$' }
-            imported_tasks: { type: integer, minimum: 0 }
-            deleted_tasks: { type: integer, minimum: 0 }
-            imported_changes: { type: integer, minimum: 0 }
-            imported_baseline: { type: boolean }
-            requires_plan_revalidation: { type: boolean }
-            requires_baseline_revalidation: { type: boolean }
-            already_current: { type: boolean }
-            published:
-              type: boolean
-              description: true when resume replaced a matching legacy task projection with a new team checkpoint
-            migrated_legacy_projection:
-              type: boolean
-              description: true when the prior tracked file used the supported legacy projection format
-            legacy_backup_path:
-              type: string
-              description: exact-byte backup of the replaced legacy task projection
-    errors:
-      - { code: ULTRA_DIR_EXISTS,  description: '.ultra/ already exists and overwrite=false' }
-      - { code: TEMPLATE_MISSING,  description: 'source_template path does not exist' }
-      - { code: TARGET_NOT_DIR,    description: 'target_dir is not a directory' }
-      - { code: BASELINE_SCOPE_MISSING, description: 'a selected baseline scope does not exist' }
-      - { code: LEGACY_STATE_MIGRATION_REQUIRED, description: 'projection-only tasks must be imported before resume' }
-      - { code: STATE_AUTHORITY_CONFLICT, description: 'projection tasks and authoritative state cannot be reconciled automatically' }
-      - { code: STATE_PROJECTION_INVALID, description: 'the existing task projection is malformed' }
-      - { code: TASK_LEDGER_LEGACY_CONFLICT, description: 'the legacy task projection differs from SQLite authority and cannot be upgraded automatically' }
-      - { code: GIT_INIT_FAILED, description: 'the local Git repository or Ultra ignore rule could not be initialized' }
-      - { code: GITIGNORE_UNSAFE, description: 'root .gitignore is a symlink or non-file and cannot be updated safely' }
-      - { code: GITIGNORE_INEFFECTIVE, description: 'the effective Git rules still expose the `.ultra` authority' }
-      - { code: IO_ERROR,          description: 'filesystem write failed', retriable: true }
-    cli_subcommand: task init-project
-    emits_events: [project_initialized, project_resumed]
-    trace_to: 'mcp-server/lib/init-project.cjs'
-
-  - name: task.expand
-    family: task
-    description: Validate and atomically persist child tasks derived by the current host from one parent task.
-    phase: '8a'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, children]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-        children:
-          type: array
-          minItems: 1
-          items:
-            type: object
-            required: [id, title, type, priority]
-            additionalProperties: false
-            properties:
-              id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-              title: { type: string, minLength: 3, maxLength: 200 }
-              type: { type: string, enum: [architecture, feature, bugfix] }
-              priority: { type: string, enum: [P0, P1, P2, P3] }
-              complexity: { type: integer, minimum: 1, maximum: 10 }
-              deps: { type: array, items: { type: string } }
-              files_modified: { type: array, items: { type: string } }
-    output_schema:
-      type: object
-      required: [parent_id, children]
-      additionalProperties: false
-      properties:
-        parent_id: { type: string }
-        children:  { type: array, items: { type: object } }
-    errors:
-      - { code: TASK_NOT_FOUND, description: 'parent id missing' }
-      - { code: ALREADY_EXPANDED, description: 'task is already expanded' }
-      - { code: CHANGE_NOT_FOUND, description: 'the parent task change does not exist' }
-      - { code: CHANGE_NOT_MUTABLE, description: 'the parent task change no longer accepts children' }
-      - { code: BASELINE_NOT_READY, description: 'child creation requires a ready baseline or the parent task to belong to an already-authorized active change' }
-      - { code: INVALID_OUTPUT, description: 'the host-derived child task graph is invalid' }
-    cli_subcommand: task expand
-    emits_events: [task_expanded]
-    trace_to: '§7.3, D34'
-
-  - name: task.parse_prd
-    family: task
-    description: Validate a host-derived PRD task graph and optionally persist it inside the current plan workflow.
-    phase: '8a'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [tasks]
-      additionalProperties: false
-      properties:
-        tasks:
-          type: array
-          minItems: 1
-          items:
-            type: object
-            required: [id, title, type, priority]
-            additionalProperties: false
-            properties:
-              id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-              title: { type: string, minLength: 3, maxLength: 200 }
-              type: { type: string, enum: [architecture, feature, bugfix] }
-              priority: { type: string, enum: [P0, P1, P2, P3] }
-              complexity: { type: integer, minimum: 1, maximum: 10 }
-              deps: { type: array, items: { type: string } }
-              files_modified: { type: array, items: { type: string } }
-        tag:      { type: string }
-        change_id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$', description: 'continuous change unit that will own every persisted parsed task' }
-        dry_run:  { type: boolean, default: false, description: 'when true, validate and preview without persisting to state.db' }
-    output_schema:
-      type: object
-      required: [tasks, topo]
-      additionalProperties: false
-      properties:
-        tasks: { type: array, items: { type: object } }
-        topo:  { type: array, items: { type: array, items: { type: string } } }
-    errors:
-      - { code: PARSE_FAILED, description: 'the host-derived PRD task graph is invalid' }
-      - { code: CYCLE_DETECTED, description: 'the proposed task graph contains a dependency cycle' }
-      - { code: CHANGE_REQUIRED, description: 'persisting a parsed task graph requires an owning change_id' }
-      - { code: CHANGE_NOT_FOUND, description: 'assigned change does not exist' }
-      - { code: CHANGE_NOT_MUTABLE, description: 'assigned change no longer accepts tasks' }
-      - { code: BASELINE_NOT_READY, description: 'persisting parsed tasks requires a ready baseline or an already-authorized active change' }
-    cli_subcommand: task parse-prd
-    emits_events: [task_created]
-    trace_to: '§7.3, D34'
-
-  - name: task.dependency_topo
-    family: task
-    description: Compute topological waves for a set of tasks; consumed by execution-plan.
-    phase: '8a'
-    readonly: true
-    input_schema:
-      type: object
-      additionalProperties: false
-      oneOf:
-        - required: [task_ids]
-        - required: [change_id]
-      properties:
-        task_ids: { type: array, minItems: 1, uniqueItems: true, items: { type: string } }
-        change_id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-    output_schema:
-      type: object
-      required: [waves]
-      additionalProperties: false
-      properties:
-        waves: { type: array, items: { type: array, items: { type: string } } }
-        cycles: { type: array, items: { type: array, items: { type: string } } }
-    errors:
-      - { code: CYCLE_DETECTED, description: 'dependency graph has cycles' }
-      - { code: TASK_NOT_FOUND, description: 'an explicitly requested task does not exist' }
-      - { code: CHANGE_NOT_FOUND, description: 'the requested owning change does not exist' }
-    cli_subcommand: task topo
-    emits_events: []
-    trace_to: '§7.3, D34'
-
-  - name: task.append_event
-    family: task
-    description: Append a non-authoritative observation to the event timeline. Lifecycle events are emitted only by their owning mutation tools. Returns the assigned subscribe cursor.
-    phase: '2'
-    writer_role: any
-    input_schema:
-      type: object
-      required: [type]
-      additionalProperties: false
-      properties:
-        task_id:    { type: string }
-        change_id:  { type: string }
-        session_id: { type: string }
-        runtime:    { type: string, enum: [claude, opencode, codex, kimi] }
-        type:
-          type: string
-          enum:
-            - context_updated
-            - commit_pushed
-            - merge_conflict
-            - cost_alert
-            - token_alert
-            - circuit_open
-        payload: { type: object }
-    output_schema:
-      type: object
-      required: [event_id, ts]
-      additionalProperties: false
-      properties:
-        event_id: { type: integer, minimum: 1 }
-        ts:       { type: string, format: date-time }
-    errors:
-      - { code: VALIDATION_ERROR, description: 'event payload failed validation' }
-      - { code: STATE_DB_LOCKED, description: 'database is locked', retriable: true }
-    cli_subcommand: task append-event
-    emits_events: []
-    trace_to: '§7.2, D31'
-
-  - name: task.subscribe_events
-    family: task
-    description: Pull events with id > since_id. Cursor is monotonic (D31, R26).
-    phase: '2'
-    readonly: true
-    input_schema:
-      type: object
-      required: [since_id]
-      additionalProperties: false
-      properties:
-        since_id: { type: integer, minimum: 0 }
-        types:    { type: array, items: { type: string } }
-        task_id:  { type: string }
-        limit:    { type: integer, minimum: 1, maximum: 500, default: 100 }
-    output_schema:
-      type: object
-      required: [events, next_since_id]
-      additionalProperties: false
-      properties:
-        events: { type: array, items: { type: object } }
-        next_since_id: { type: integer, minimum: 0 }
-    errors:
-      - { code: VALIDATION_ERROR, description: 'cursor or filter invalid' }
-    cli_subcommand: task subscribe
-    emits_events: []
-    trace_to: '§7.2, D31'
-
-  # ────────────────────────── session family ──────────────────────────────
-  - name: session.spawn
-    family: session
-    description: Admit a plan-authorized execution session, create its isolated Git worktree and artifact directory, and register the lease. Change-owned tasks must retain their complete accepted contract, current completed plan, dependency readiness, and non-stale executable status. The current host launches its bounded worker inside the returned worktree.
-    phase: '4.5'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [task_id, runtime]
-      additionalProperties: false
-      properties:
-        task_id:  { type: string }
-        runtime:  { type: string, enum: [claude, opencode, codex, kimi] }
-        takeover: { type: boolean, default: false, description: 'override active lease (D33 takeover strategy)' }
-        worktree_base:
-          type: string
-          description: optional path resolving inside the repository `.ultra/.runtime/worktrees` boundary; outside paths are rejected
-    output_schema:
-      type: object
-      required: [sid, worktree_path, artifact_dir, lease_expires_at, worktree_created]
-      additionalProperties: false
-      properties:
-        sid:               { type: string }
-        worktree_path:     { type: string }
-        artifact_dir:      { type: string }
-        lease_expires_at:  { type: string, format: date-time }
-        worktree_created:  { type: boolean }
-    errors:
-      - { code: TASK_NOT_FOUND, description: 'task id missing' }
-      - { code: ADMISSION_DENIED, description: 'active lease exists; choose takeover/resume/abandon' }
-      - { code: SESSION_CLOSE_PENDING, description: 'an unfinished durable close intent must recover before spawn or takeover' }
-      - { code: NESTED_SESSION_FORBIDDEN, description: 'an active worker must resume its assigned session instead of recursively spawning another one' }
-      - { code: TAKEOVER_FAILED, description: 'prior owned worker could not be terminated safely' }
-      - { code: TASK_EXECUTION_CONTRACT_INCOMPLETE, description: 'change-owned task contract is incomplete' }
-      - { code: WORKFLOW_TASK_NOT_EXECUTABLE, description: 'task status or staleness blocks execution' }
-      - { code: TASK_DEPENDENCIES_INCOMPLETE, description: 'one or more task dependencies have not converged' }
-      - { code: WORKFLOW_PLAN_NOT_COMPLETED, description: 'owning change has no healthy completed plan workflow' }
-      - { code: WORKFLOW_PLAN_TASK_SET_STALE, description: 'change task set differs from the current converged plan' }
-      - { code: WORKFLOW_PLAN_TASK_CONTRACT_STALE, description: 'task contract differs from the current converged plan' }
-      - { code: WORKFLOW_PLAN_CONTEXT_STALE, description: 'the planning Context no longer matches the current checkout or required references' }
-      - { code: WORKFLOW_IMPLEMENTATION_CONTEXT_REQUIRED, description: 'the task has no exact ready implementation Context' }
-      - { code: WORKFLOW_IMPLEMENTATION_CONTEXT_STALE, description: 'the task implementation Context is stale, blocked, or bound to different authority' }
-      - { code: WORKTREE_SCOPE_INVALID, description: 'requested worktree base escapes the managed project boundary' }
-      - { code: WORKTREE_FAILED, description: 'Git worktree creation failed or the repository has no usable HEAD' }
-      - { code: WORKTREE_AUTHORITY_MISSING, description: 'central `.ultra/.runtime/state.db` disappeared before worktree binding' }
-      - { code: WORKTREE_AUTHORITY_NOT_IGNORED, description: 'a safe local ignore rule for the `.ultra` authority link could not be established' }
-      - { code: WORKTREE_AUTHORITY_CONFLICT, description: 'the isolated checkout already contains a conflicting `.ultra` entry' }
-      - { code: WORKTREE_AUTHORITY_LINK_FAILED, description: 'the isolated checkout could not be linked to central Ultra authority' }
-    cli_subcommand: session spawn
-    emits_events: [session_spawned]
-    trace_to: '§7.3, D20, D33'
-
-  - name: session.close
-    family: session
-    description: Close a session and release its lease. Preserve the worktree by default; explicit cleanup succeeds only after Git proves it is clean and integrated.
-    phase: '4.5'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [sid, status]
-      additionalProperties: false
-      properties:
-        sid:    { type: string }
-        status: { type: string, enum: [completed, crashed] }
-        remove_worktree: { type: boolean, default: false }
-    output_schema:
-      type: object
-      required: [ok, worktree_preserved]
-      additionalProperties: false
-      properties:
-        ok: { type: boolean }
-        worktree_preserved: { type: boolean }
-    errors:
-      - { code: SESSION_NOT_FOUND, description: 'sid unknown' }
-      - { code: WORKER_SESSION_PARENT_OWNED, description: 'an active worker must exit and let its supervising parent settle the lease' }
-      - { code: SESSION_SCOPE_VIOLATION, description: 'an active worker attempted to close a session it does not own' }
-      - { code: WORKTREE_NOT_INTEGRATED, description: 'Explicit cleanup refused because work is uncommitted, unverified, or not integrated into the current checkout' }
-    cli_subcommand: session close
-    emits_events: [session_closed, session_crashed]
-    trace_to: '§7.3, D32'
-
-  - name: session.get
-    family: session
-    description: Fetch a session row.
-    phase: '4.5'
-    readonly: true
-    input_schema:
-      type: object
-      required: [sid]
-      additionalProperties: false
-      properties:
-        sid: { type: string }
-    output_schema:
-      type: object
-      required: [session]
-      additionalProperties: false
-      properties:
-        session: { type: object }
-    errors:
-      - { code: SESSION_NOT_FOUND, description: 'sid unknown' }
-    cli_subcommand: session get
-    emits_events: []
-    trace_to: '§7.3'
-
-  - name: session.list
-    family: session
-    description: List sessions filtered by status (default 'running') and optional task_id. Read-only snapshot for /ultra-status + orchestrator dashboards.
-    phase: '4.5'
-    readonly: true
-    input_schema:
-      type: object
-      additionalProperties: false
-      properties:
-        status:   { type: string, enum: [running, completed, crashed, orphan] }
-        task_id:  { type: string }
-        limit:    { type: integer, minimum: 1, maximum: 500, default: 100 }
-    output_schema:
-      type: object
-      required: [sessions, count]
-      additionalProperties: false
-      properties:
-        sessions: { type: array, items: { type: object } }
-        count:    { type: integer, minimum: 0 }
-    errors:
-      - { code: STATE_DB_ERROR, description: 'database unavailable', retriable: true }
-    cli_subcommand: session list
-    emits_events: []
-    trace_to: '§7.3, Phase 4.5.4'
-
-  - name: session.admission_check
-    family: session
-    description: Check the same task, dependency, current-plan, staleness, breaker, and lease gates enforced by session.spawn. Returns a recommended lease action only after workflow authority is executable.
-    phase: '4.5'
-    readonly: true
-    input_schema:
-      type: object
-      required: [task_id]
-      additionalProperties: false
-      properties:
-        task_id: { type: string }
-        runtime: { type: string, enum: [claude, opencode, codex, kimi] }
-    output_schema:
-      type: object
-      required: [can_spawn, recommended_action]
-      additionalProperties: false
-      properties:
-        can_spawn:          { type: boolean }
-        conflict:
-          type: object
-          properties:
-            sid:          { type: string }
-            status:       { type: string }
-            heartbeat_age_ms: { type: integer, minimum: 0 }
-        recommended_action:
-          type: string
-          enum: [spawn, takeover, resume, abandon, recover_close, blocked_by_breaker]
-    errors:
-      - { code: TASK_NOT_FOUND, description: 'task id missing' }
-      - { code: TASK_EXECUTION_CONTRACT_INCOMPLETE, description: 'change-owned task contract is incomplete' }
-      - { code: WORKFLOW_TASK_NOT_EXECUTABLE, description: 'task status or staleness blocks execution' }
-      - { code: TASK_DEPENDENCIES_INCOMPLETE, description: 'one or more task dependencies have not converged' }
-      - { code: WORKFLOW_PLAN_NOT_COMPLETED, description: 'owning change has no healthy completed plan workflow' }
-      - { code: WORKFLOW_PLAN_TASK_SET_STALE, description: 'change task set differs from the current converged plan' }
-      - { code: WORKFLOW_PLAN_TASK_CONTRACT_STALE, description: 'task contract differs from the current converged plan' }
-      - { code: WORKFLOW_PLAN_CONTEXT_STALE, description: 'the planning Context no longer matches the current checkout or required references' }
-      - { code: WORKFLOW_IMPLEMENTATION_CONTEXT_REQUIRED, description: 'the task has no exact ready implementation Context' }
-      - { code: WORKFLOW_IMPLEMENTATION_CONTEXT_STALE, description: 'the task implementation Context is stale, blocked, or bound to different authority' }
-    cli_subcommand: session admission
-    emits_events: []
-    trace_to: '§7.3, D33'
-
-  - name: session.heartbeat
-    family: session
-    description: Refresh lease for a running session. Lease expires after grace period without heartbeat.
-    phase: '4.5'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [sid]
-      additionalProperties: false
-      properties:
-        sid: { type: string }
-    output_schema:
-      type: object
-      required: [ok, lease_expires_at]
-      additionalProperties: false
-      properties:
-        ok:               { type: boolean }
-        lease_expires_at: { type: string, format: date-time }
-    errors:
-      - { code: SESSION_NOT_FOUND, description: 'sid unknown' }
-      - { code: LEASE_EXPIRED, description: 'lease already expired; need takeover/resume' }
-    cli_subcommand: session heartbeat
-    emits_events: [session_heartbeat_lost]
-    trace_to: '§7.3, D32'
-
-  - name: session.subscribe_events
-    family: session
-    description: Pull session-related events with cursor.
-    phase: '4.5'
-    readonly: true
-    input_schema:
-      type: object
-      required: [since_id]
-      additionalProperties: false
-      properties:
-        since_id: { type: integer, minimum: 0 }
-        sid:      { type: string }
-        limit:    { type: integer, minimum: 1, maximum: 500, default: 100 }
-    output_schema:
-      type: object
-      required: [events, next_since_id]
-      additionalProperties: false
-      properties:
-        events:        { type: array, items: { type: object } }
-        next_since_id: { type: integer, minimum: 0 }
-    errors:
-      - { code: VALIDATION_ERROR, description: 'cursor invalid' }
-    cli_subcommand: session subscribe
-    emits_events: []
-    trace_to: '§7.3, D31'
-
-  # ───────────────────────── baseline family ─────────────────────────────
-  - name: baseline.start
-    family: baseline
-    description: Start a greenfield baseline or brownfield adoption without overwriting a ready baseline implicitly.
-    phase: '11'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [project_name, mode]
-      additionalProperties: false
-      allOf:
-        - if:
-            required: [replace_ready]
-            properties: { replace_ready: { const: true } }
-          then: { required: [replacement_authorization] }
-        - if: { required: [replacement_authorization] }
-          then:
-            required: [replace_ready]
-            properties: { replace_ready: { const: true } }
-      properties:
-        id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$', default: project-baseline }
-        project_name: { type: string, minLength: 1 }
-        project_type: { type: string, enum: [web, api, cli, fullstack, other] }
-        stack: { type: string }
-        mode: { type: string, enum: [greenfield, brownfield] }
-        scope: { type: array, minItems: 1, items: { type: string, minLength: 1 }, default: ['.'] }
-        repository_revision: { type: string, minLength: 1 }
-        replace_ready: { type: boolean, default: false }
-        replacement_authorization:
-          type: object
-          required: [approved_by, reason]
-          additionalProperties: false
-          properties:
-            approved_by: { type: string, minLength: 1 }
-            reason: { type: string, minLength: 3 }
-        replace_migrated: { type: boolean, default: false, description: explicitly supersede a compatibility-only migrated baseline and start evidence-backed adoption }
-        classification: { type: object, description: bounded repository classification evidence; content is limited to 32 KiB }
-        provider_refs:
-          type: object
-          additionalProperties: false
-          properties:
-            memory:
-              type: object
-              required: [provider]
-              additionalProperties: false
-              properties:
-                provider: { type: string }
-                project: { type: string }
-                reference: { type: string }
-                revision: { type: string }
-                indexed_head: { type: string }
-                status: { type: string, enum: [available, unavailable, fresh, stale, unknown] }
-            code_graph:
-              type: object
-              required: [provider]
-              additionalProperties: false
-              properties:
-                provider: { type: string }
-                project: { type: string }
-                reference: { type: string }
-                revision: { type: string }
-                indexed_head: { type: string }
-                status: { type: string, enum: [available, unavailable, fresh, stale, unknown] }
-    output_schema:
-      type: object
-      required: [baseline]
-      additionalProperties: false
-      properties:
-        baseline: { type: object }
-    errors:
-      - { code: BASELINE_EXISTS, description: 'a ready baseline requires explicit replacement' }
-      - { code: BASELINE_IN_PROGRESS, description: 'another adoption is already active' }
-      - { code: BASELINE_REPLACEMENT_AUTHORIZATION_REQUIRED, description: 'ready-baseline replacement lacks durable owner approval and rationale' }
-      - { code: BASELINE_REPLACEMENT_INVALID, description: 'replacement flags do not match the current baseline lifecycle or authorization payload' }
-      - { code: BASELINE_SCOPE_MISSING, description: 'a selected baseline scope does not exist' }
-      - { code: PROVIDER_CONTENT_FORBIDDEN, description: 'provider payload content must remain external' }
-    cli_subcommand: baseline start
-    emits_events: [baseline_started]
-
-  - name: baseline.record
-    family: baseline
-    description: Replace the current adoption snapshot with bounded specification digests, evidence references, verification, unknowns, and provider metadata.
-    phase: '11'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id]
-      additionalProperties: false
-      properties:
-        id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-        repository_revision: { type: string, minLength: 1 }
-        scope: { type: array, minItems: 1, items: { type: string, minLength: 1 } }
-        spec_refs:
-          type: array
-          items:
-            type: object
-            required: [kind, path]
-            additionalProperties: false
-            properties:
-              kind: { type: string, enum: [discovery, product, architecture, quality, delivery, other] }
-              path: { type: string, minLength: 1 }
-        evidence:
-          type: array
-          items:
-            type: object
-            required: [kind, ref, summary]
-            additionalProperties: false
-            properties:
-              kind: { type: string, enum: [source, docs, runtime, test, deploy, external] }
-              ref: { type: string, minLength: 1 }
-              summary: { type: string, minLength: 1 }
-        verification:
-          type: array
-          items:
-            type: object
-            required: [name, command, status, evidence]
-            additionalProperties: false
-            properties:
-              name: { type: string, minLength: 1 }
-              command: { type: string, minLength: 1 }
-              status: { type: string, enum: [pass, known_red, not_run] }
-              evidence: { type: string, minLength: 1 }
-              rationale: { type: string, minLength: 1 }
-        unknowns:
-          type: array
-          items:
-            type: object
-            required: [summary, blocking]
-            additionalProperties: false
-            properties:
-              summary: { type: string, minLength: 1 }
-              blocking: { type: boolean }
-              owner: { type: string, minLength: 1 }
-        gaps:
-          type: array
-          items:
-            type: object
-            required: [id, category, summary]
-            additionalProperties: false
-            properties:
-              id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-              category: { type: string, enum: [baseline_blocker, documentation_drift, known_defect, technical_debt, unknown, future_change] }
-              status: { type: string, enum: [open, accepted, resolved, deferred], default: open }
-              blocking: { type: boolean, default: false }
-              summary: { type: string, minLength: 1 }
-              evidence_refs: { type: array, uniqueItems: true, items: { type: string, minLength: 1 }, default: [] }
-              owner: { type: ['string', 'null'], minLength: 1 }
-              resolution: { type: string, minLength: 1 }
-        classification: { type: object, description: bounded repository classification evidence; content is limited to 32 KiB }
-        provider_refs:
-          type: object
-          additionalProperties: false
-          properties:
-            memory:
-              type: object
-              required: [provider]
-              additionalProperties: false
-              properties:
-                provider: { type: string }
-                project: { type: string }
-                reference: { type: string }
-                revision: { type: string }
-                indexed_head: { type: string }
-                status: { type: string, enum: [available, unavailable, fresh, stale, unknown] }
-            code_graph:
-              type: object
-              required: [provider]
-              additionalProperties: false
-              properties:
-                provider: { type: string }
-                project: { type: string }
-                reference: { type: string }
-                revision: { type: string }
-                indexed_head: { type: string }
-                status: { type: string, enum: [available, unavailable, fresh, stale, unknown] }
-    output_schema:
-      type: object
-      required: [baseline]
-      additionalProperties: false
-      properties:
-        baseline: { type: object }
-    errors:
-      - { code: BASELINE_NOT_FOUND, description: 'baseline id does not exist' }
-      - { code: BASELINE_NOT_MUTABLE, description: 'ready and superseded baselines are immutable' }
-      - { code: BASELINE_GIT_HEAD_REQUIRED, description: 'Git is initialized but the owner-authorized initial checkpoint commit does not exist' }
-      - { code: BASELINE_SPEC_MISSING, description: 'a declared specification file does not exist' }
-      - { code: BASELINE_SCOPE_MISSING, description: 'a selected baseline scope does not exist' }
-      - { code: PROVIDER_CONTENT_FORBIDDEN, description: 'provider payload content must remain external' }
-    cli_subcommand: baseline record
-    emits_events: [baseline_recorded]
-
-  - name: baseline.get
-    family: baseline
-    description: Read the current or named authoritative baseline with live digest and repository-revision health.
-    phase: '11'
-    readonly: true
-    input_schema:
-      type: object
-      additionalProperties: false
-      properties:
-        id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-    output_schema:
-      type: object
-      required: [baseline, health]
-      additionalProperties: false
-      properties:
-        baseline: { type: object }
-        health: { type: object }
-    errors:
-      - { code: BASELINE_NOT_FOUND, description: 'no matching baseline exists' }
-    cli_subcommand: baseline get
-    emits_events: []
-
-  - name: baseline.converge
-    family: baseline
-    description: Approve a baseline only when its revision, specification digests, evidence, verification, and blocking unknowns satisfy deterministic gates.
-    phase: '11'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, expected_revision, approved_by, approval_note]
-      additionalProperties: false
-      properties:
-        id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-        expected_revision: { type: string, minLength: 1 }
-        approved_by: { type: string, minLength: 1 }
-        approval_note: { type: string, minLength: 3 }
-        accept_known_red: { type: boolean, default: false }
-        accept_dirty_worktree: { type: boolean, default: false, description: explicitly freeze the exact recorded dirty-worktree digest into the baseline }
-    output_schema:
-      type: object
-      required: [ready, status, blockers, baseline]
-      additionalProperties: false
-      properties:
-        ready: { type: boolean }
-        status: { type: string, enum: [blocked, ready] }
-        blockers: { type: array, items: { type: string } }
-        baseline: { type: object }
-    errors:
-      - { code: BASELINE_NOT_FOUND, description: 'baseline id does not exist' }
-      - { code: BASELINE_NOT_CONVERGEABLE, description: 'baseline lifecycle does not allow convergence' }
-      - { code: BASELINE_NOT_READY, description: 'baseline evidence, gaps, revision, branch, worktree, or verification still blocks convergence' }
-    cli_subcommand: baseline converge
-    emits_events: [baseline_blocked, baseline_converged]
-
-  # ────────────────────────── change family ──────────────────────────────
-  - name: change.create
-    family: change
-    description: Capture a continuous feature, fix, redesign, or incident change contract; incidents also register a five-section diagnosis artifact. Planning context is compiled separately.
-    phase: '9'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, title, kind, intent, contract, classification, research_disposition]
-      additionalProperties: false
-      properties:
-        id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-        title: { type: string, minLength: 3 }
-        kind: { type: string, enum: [quick, standard, major, incident] }
-        intent: { type: string, minLength: 3 }
-        contract: &change_contract
-          type: object
-          required: [outcome, acceptance, non_goals, public_seams, recovery, unresolved_decisions]
-          additionalProperties: false
-          properties:
-            outcome: { type: string, minLength: 1 }
-            acceptance:
-              type: array
-              minItems: 1
-              items:
-                type: object
-                required: [id, criterion, verification]
-                additionalProperties: false
-                properties:
-                  id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-                  criterion: { type: string, minLength: 1 }
-                  verification: { type: string, minLength: 1 }
-            non_goals: { type: array, minItems: 1, items: { type: string, minLength: 1 } }
-            public_seams: { type: array, minItems: 1, items: { type: string, minLength: 1 } }
-            recovery:
-              type: object
-              required: [strategy, verification]
-              additionalProperties: false
-              properties:
-                strategy: { type: string, minLength: 1 }
-                verification: { type: string, minLength: 1 }
-            unresolved_decisions:
-              type: array
-              items:
-                type: object
-                required: [id, summary, blocking]
-                additionalProperties: false
-                properties:
-                  id: { type: string, minLength: 1 }
-                  summary: { type: string, minLength: 1 }
-                  blocking: { type: boolean }
-                  owner: { type: ['string', 'null'] }
-        classification: &change_classification
-          type: object
-          required: [rationale, risk_flags]
-          additionalProperties: false
-          properties:
-            rationale: { type: string, minLength: 1 }
-            risk_flags:
-              type: array
-              uniqueItems: true
-              items:
-                type: string
-                enum: [public_contract, schema_migration, data_migration, authorization, security, multi_module, external_integration, release_semantics]
-        research_disposition: &change_research_disposition
-          type: object
-          required: [status, mode, selected_steps, rationale]
-          additionalProperties: false
-          properties:
-            status: { type: string, enum: [none, bounded, required] }
-            mode: { type: ['string', 'null'], enum: [product, feature, architecture, custom, null] }
-            selected_steps: { type: array, uniqueItems: true, items: { type: string, minLength: 1 } }
-            rationale: { type: string, minLength: 1 }
-        alignment_thread_id: { type: string, description: 'confirmed decision checkpoint that produced this change contract' }
-        base_commit: { type: string, pattern: '^[0-9a-f]{7,40}$' }
-        baseline_bypass:
-          type: object
-          required: [reason, approved_by]
-          additionalProperties: false
-          properties:
-            reason: { type: string, minLength: 3 }
-            approved_by: { type: string, minLength: 1 }
-          description: incident-only break-glass approval when the project baseline is unhealthy
-        docs_impact:
-          type: object
-          additionalProperties: false
-          properties:
-            status: { type: string, enum: [unknown, required, none] }
-            files: { type: array, items: { type: string } }
-            rationale: { type: ['string', 'null'] }
-        provider_refs:
-          type: object
-          additionalProperties: false
-          properties:
-            memory:
-              type: object
-              required: [provider]
-              additionalProperties: false
-              properties:
-                provider: { type: string }
-                project: { type: string }
-                reference: { type: string }
-                revision: { type: string }
-                indexed_head: { type: string }
-                status: { type: string, enum: [available, unavailable, fresh, stale, unknown] }
-            code_graph:
-              type: object
-              required: [provider]
-              additionalProperties: false
-              properties:
-                provider: { type: string }
-                project: { type: string }
-                reference: { type: string }
-                revision: { type: string }
-                indexed_head: { type: string }
-                status: { type: string, enum: [available, unavailable, fresh, stale, unknown] }
-    output_schema:
-      type: object
-      required: [change, intent_path, context_manifest_path, workflow]
-      additionalProperties: false
-      properties:
-        change: { type: object }
-        intent_path: { type: string }
-        context_manifest_path: { type: ['string', 'null'] }
-        workflow: { type: object }
-    errors:
-      - { code: DUPLICATE_CHANGE_ID, description: 'change id already exists' }
-      - { code: PROVIDER_CONTENT_FORBIDDEN, description: 'provider payload content must remain external' }
-      - { code: VALIDATION_ERROR, description: 'change input failed validation' }
-      - { code: BASELINE_NOT_READY, description: 'ordinary work is blocked until the project baseline is healthy' }
-      - { code: BASELINE_BYPASS_REQUIRED, description: 'an incident on an unhealthy baseline requires explicit break-glass approval' }
-      - { code: CHANGE_CONTRACT_REQUIRED, description: 'outcome, acceptance, seams, recovery, or decisions are incomplete' }
-      - { code: CHANGE_CLASSIFICATION_REQUIRED, description: 'classification rationale or risk flags are incomplete' }
-      - { code: CHANGE_RESEARCH_DISPOSITION_REQUIRED, description: 'research routing is incomplete or inconsistent' }
-      - { code: CHANGE_PROFILE_ESCALATION_REQUIRED, description: 'quick profile conflicts with material risk or research' }
-      - { code: CHANGE_ALIGNMENT_REQUIRED, description: 'declared alignment thread is missing, unconfirmed, stale, not artifact-bound, bound to another authority, or not scoped to the current baseline' }
-    cli_subcommand: change create
-    emits_events: [change_created, workflow_started, workflow_step_updated, workflow_completed]
-
-  - name: change.update
-    family: change
-    description: Update mutable change authority. Semantic changes invalidate only registered transitive consumers so affected tasks and contexts must be reconciled before execution.
-    phase: '9'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, patch]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-        patch:
-          type: object
-          additionalProperties: false
-          properties:
-            title: { type: string, minLength: 3 }
-            intent: { type: string, minLength: 3 }
-            status: { type: string, enum: [active, blocked, cancelled] }
-            docs_impact:
-              type: object
-              additionalProperties: false
-              properties:
-                status: { type: string, enum: [unknown, required, none] }
-                files: { type: array, items: { type: string } }
-                rationale: { type: ['string', 'null'] }
-            provider_refs:
-              type: object
-              additionalProperties: false
-              properties:
-                memory:
-                  type: object
-                  required: [provider]
-                  additionalProperties: false
-                  properties:
-                    provider: { type: string }
-                    project: { type: string }
-                    reference: { type: string }
-                    revision: { type: string }
-                    indexed_head: { type: string }
-                    status: { type: string, enum: [available, unavailable, fresh, stale, unknown] }
-                code_graph:
-                  type: object
-                  required: [provider]
-                  additionalProperties: false
-                  properties:
-                    provider: { type: string }
-                    project: { type: string }
-                    reference: { type: string }
-                    revision: { type: string }
-                    indexed_head: { type: string }
-                    status: { type: string, enum: [available, unavailable, fresh, stale, unknown] }
-            contract: *change_contract
-            classification: *change_classification
-            research_disposition: *change_research_disposition
-    output_schema:
-      type: object
-      required: [ok, change]
-      additionalProperties: false
-      properties:
-        ok: { type: boolean }
-        change: { type: object }
-    errors:
-      - { code: CHANGE_NOT_FOUND, description: 'change id does not exist' }
-      - { code: CHANGE_NOT_MUTABLE, description: 'ready, archived, and cancelled changes are immutable' }
-      - { code: ILLEGAL_CHANGE_TRANSITION, description: 'change transition is not permitted' }
-      - { code: PROVIDER_CONTENT_FORBIDDEN, description: 'provider payload content must remain external' }
-    cli_subcommand: change update
-    emits_events: [task_stale_marked, change_updated]
-
-  - name: change.delta
-    family: change
-    description: Record the typed Change-owned delta overlay against exact baseline anchors without mutating baseline specifications.
-    phase: '21'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required:
-        [id, baseline_anchor, decisions, non_goals, acceptance, documentation_impact, unknowns, mutations]
-      additionalProperties: false
-      properties:
-        id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-        baseline_anchor:
-          type: object
-          required: [baseline_id, repository_revision, specs]
-          additionalProperties: false
-          properties:
-            baseline_id: { type: string, minLength: 1 }
-            repository_revision: { type: ['string', 'null'] }
-            specs:
-              type: array
-              items:
-                type: object
-                required: [path, digest]
-                additionalProperties: false
-                properties:
-                  path: { type: string, minLength: 1 }
-                  digest: { type: string, pattern: '^[0-9a-f]{64}$' }
-        decisions:
-          type: array
-          items:
-            type: object
-            required: [id, summary]
-            additionalProperties: false
-            properties:
-              id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-              summary: { type: string, minLength: 1 }
-              rationale: { type: string, minLength: 1 }
-        non_goals: { type: array, uniqueItems: true, items: { type: string, minLength: 1 } }
-        acceptance:
-          type: array
-          minItems: 1
-          items:
-            type: object
-            required: [id, criterion, verification]
-            additionalProperties: false
-            properties:
-              id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-              criterion: { type: string, minLength: 1 }
-              verification: { type: string, minLength: 1 }
-        documentation_impact:
-          type: object
-          required: [status, files, rationale]
-          additionalProperties: false
-          properties:
-            status: { type: string, enum: [none, required] }
-            files: { type: array, uniqueItems: true, items: { type: string, minLength: 1 } }
-            rationale: { type: string, minLength: 3 }
-        unknowns:
-          type: array
-          items:
-            type: object
-            required: [id, summary, blocking]
-            additionalProperties: false
-            properties:
-              id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-              summary: { type: string, minLength: 1 }
-              blocking: { type: boolean }
-        no_semantic_change_reason: { type: string, minLength: 3 }
-        mutations:
-          type: array
-          items:
-            type: object
-            required:
-              [id, action, target_path, overlay_path, before_digest, after_digest, acceptance_refs, documentation_refs]
-            additionalProperties: false
-            properties:
-              id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-              action: { type: string, enum: [add, update] }
-              target_path: { type: string, minLength: 1 }
-              overlay_path: { type: string, minLength: 1 }
-              before_digest: { type: ['string', 'null'], pattern: '^[0-9a-f]{64}$' }
-              after_digest: { type: string, pattern: '^[0-9a-f]{64}$' }
-              acceptance_refs: { type: array, minItems: 1, uniqueItems: true, items: { type: string, minLength: 1 } }
-              documentation_refs: { type: array, uniqueItems: true, items: { type: string, minLength: 1 } }
-      allOf:
-        - if:
-            properties:
-              mutations: { maxItems: 0 }
-          then:
-            required: [no_semantic_change_reason]
-    output_schema:
-      type: object
-      required: [delta, artifact, payload_artifacts, progress_artifact]
-      additionalProperties: false
-      properties:
-        delta: { type: object }
-        artifact: { type: object }
-        payload_artifacts: { type: array, items: { type: object } }
-        progress_artifact: { type: object }
-    errors:
-      - { code: CHANGE_NOT_FOUND, description: 'change id does not exist' }
-      - { code: CHANGE_NOT_MUTABLE, description: 'terminal Change authority cannot accept a delta' }
-      - { code: CHANGE_DELTA_INVALID, description: 'delta shape or typed mutation contract is invalid' }
-      - { code: CHANGE_DELTA_CONTRACT_MISMATCH, description: 'delta does not match accepted Change non-goals, acceptance, or documentation impact' }
-      - { code: CHANGE_DELTA_BASELINE_CONFLICT, description: 'baseline id, revision, specification digest, or target bytes changed' }
-      - { code: CHANGE_DELTA_PAYLOAD_MISSING, description: 'a declared Change overlay file is missing' }
-      - { code: CHANGE_DELTA_PAYLOAD_STALE, description: 'a declared Change overlay digest is stale' }
-    cli_subcommand: change delta
-    emits_events: [artifact_recorded, spec_changed, change_delta_recorded]
-
-  - name: change.documentation_reconcile
-    family: change
-    description: Record Change-owned documentation before/after digests, delta and acceptance trace, verification, and explicit consumer or no-consumer evidence.
-    phase: '21'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, delta_artifact_id, delta_digest, documents]
-      additionalProperties: false
-      properties:
-        id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-        delta_artifact_id: { type: string, minLength: 1 }
-        delta_digest: { type: string, pattern: '^[0-9a-f]{64}$' }
-        no_change_reason: { type: string, minLength: 3 }
-        documents:
-          type: array
-          items:
-            type: object
-            required:
-              [path, action, overlay_path, before_digest, after_digest, delta_refs, acceptance_refs, verification, consumers]
-            additionalProperties: false
-            properties:
-              path: { type: string, minLength: 1 }
-              action: { type: string, enum: [add, update] }
-              overlay_path: { type: string, minLength: 1 }
-              before_digest: { type: ['string', 'null'], pattern: '^[0-9a-f]{64}$' }
-              after_digest: { type: string, pattern: '^[0-9a-f]{64}$' }
-              delta_refs: { type: array, minItems: 1, uniqueItems: true, items: { type: string } }
-              acceptance_refs: { type: array, minItems: 1, uniqueItems: true, items: { type: string } }
-              verification:
-                type: array
-                minItems: 1
-                items:
-                  type: object
-                  required: [command, status, evidence_refs]
-                  additionalProperties: false
-                  properties:
-                    command: { type: string, minLength: 1 }
-                    status: { type: string, const: pass }
-                    evidence_refs:
-                      type: array
-                      minItems: 1
-                      uniqueItems: true
-                      items: { type: string, minLength: 1 }
-              consumers:
-                type: array
-                items:
-                  type: object
-                  required: [type, id, relation]
-                  additionalProperties: false
-                  properties:
-                    type: { type: string, enum: [artifact, project, baseline, change, task, workflow, external] }
-                    id: { type: string, minLength: 1 }
-                    relation: { type: string, minLength: 1 }
-              no_consumer_reason: { type: string, minLength: 3 }
-      allOf:
-        - if:
-            properties:
-              documents: { maxItems: 0 }
-          then:
-            required: [no_change_reason]
-    output_schema:
-      type: object
-      required: [reconciliation, artifact, payload_artifacts, progress_artifact]
-      additionalProperties: false
-      properties:
-        reconciliation: { type: object }
-        artifact: { type: object }
-        payload_artifacts: { type: array, items: { type: object } }
-        progress_artifact: { type: object }
-    errors:
-      - { code: CHANGE_NOT_FOUND, description: 'change id does not exist' }
-      - { code: DOCUMENTATION_DELTA_AUTHORITY_INVALID, description: 'documentation is not bound to the current Change delta' }
-      - { code: DOCUMENTATION_RECONCILIATION_INCOMPLETE, description: 'declared documentation impact is not covered exactly' }
-      - { code: DOCUMENTATION_ORPHAN_UNRESOLVED, description: 'a changed document lacks a consumer or explicit no-consumer reason' }
-      - { code: DOCUMENTATION_BASELINE_CONFLICT, description: 'a documentation target changed after its before digest was recorded' }
-      - { code: DOCUMENTATION_EVIDENCE_STALE, description: 'documentation overlay bytes do not match the recorded after digest' }
-    cli_subcommand: change documentation-reconcile
-    emits_events: [artifact_recorded, spec_changed, documentation_reconciliation_recorded]
-
-  - name: change.get
-    family: change
-    description: Read one continuous change unit and its specification-learning candidates from authoritative state.
-    phase: '9'
-    readonly: true
-    input_schema:
-      type: object
-      required: [id]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-    output_schema:
-      type: object
-      required: [change]
-      additionalProperties: false
-      properties:
-        change: { type: object }
-    errors:
-      - { code: CHANGE_NOT_FOUND, description: 'change id does not exist' }
-    cli_subcommand: change get
-    emits_events: []
-
-  - name: change.list
-    family: change
-    description: List continuous changes by lifecycle status or change kind.
-    phase: '9'
-    readonly: true
-    input_schema:
-      type: object
-      additionalProperties: false
-      properties:
-        status: { type: string, enum: [active, blocked, ready, archived, cancelled] }
-        kind: { type: string, enum: [quick, standard, major, incident] }
-        limit: { type: integer, minimum: 1, maximum: 500 }
-    output_schema:
-      type: object
-      required: [changes, count]
-      additionalProperties: false
-      properties:
-        changes: { type: array, items: { type: object } }
-        count: { type: integer, minimum: 0 }
-    errors:
-      - { code: VALIDATION_ERROR, description: 'change filter failed validation' }
-    cli_subcommand: change list
-    emits_events: []
-
-  - name: change.context
-    family: change
-    description: Compile an immutable role-scoped Context Spine snapshot with authoritative readiness and allowed or required transitions. A host may attach a clearly non-authoritative recommendation.
-    phase: '10'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id]
-      additionalProperties: false
-      not:
-        required: [context_refs, spec_refs]
-      properties:
-        id: { type: string }
-        task_id: { type: string }
-        role: { type: string, enum: [plan, implement, check, review] }
-        gate: { type: string, enum: [alignment, planning, implementation, verification, review, convergence, recovery] }
-        spec_refs:
-          type: array
-          maxItems: 64
-          items:
-            type: object
-            required: [ref]
-            additionalProperties: false
-            properties:
-              ref: { type: string, minLength: 1, maxLength: 2048 }
-              reason: { type: string, minLength: 1, maxLength: 2048 }
-              required: { type: boolean, default: true }
-              expected_digest: { type: string, pattern: '^[0-9a-f]{64}$' }
-              anchor: { type: string, minLength: 1, maxLength: 512 }
-              scope: { type: string, minLength: 1, maxLength: 512 }
-              freshness_policy: { type: string, enum: [digest, existence, advisory] }
-        context_refs:
-          type: array
-          maxItems: 64
-          items:
-            type: object
-            required: [ref, reason]
-            additionalProperties: false
-            properties:
-              ref: { type: string, minLength: 1, maxLength: 2048 }
-              kind: { type: string, enum: [spec, source, test, docs, external], default: source }
-              reason: { type: string, minLength: 3, maxLength: 2048 }
-              required: { type: boolean, default: true }
-              digest: { type: string, pattern: '^[0-9a-f]{64}$' }
-              expected_digest: { type: string, pattern: '^[0-9a-f]{64}$' }
-              anchor: { type: string, minLength: 1, maxLength: 512 }
-              scope: { type: string, minLength: 1, maxLength: 512 }
-              freshness_policy: { type: string, enum: [digest, existence, advisory] }
-        budget:
-          type: object
-          additionalProperties: false
-          properties:
-            max_tokens: { type: integer, minimum: 1, default: 12000 }
-            max_files: { type: integer, minimum: 1, default: 12 }
-        execution_contract:
-          type: object
-          additionalProperties: false
-          properties:
-            context_budget_percent: { type: integer, minimum: 1, maximum: 100, default: 40 }
-        recommendation:
-          type: object
-          required: [workflow, rationale]
-          additionalProperties: false
-          properties:
-            workflow: { type: string, minLength: 1 }
-            rationale: { type: string, minLength: 3 }
-    output_schema:
-      type: object
-      required: [manifest_path, manifest_hash, manifest]
-      additionalProperties: false
-      properties:
-        manifest_path: { type: string }
-        manifest_hash: { type: string, pattern: '^[0-9a-f]{64}$' }
-        manifest: { type: object }
-    errors:
-      - { code: VALIDATION_ERROR, description: 'context role, gate, references, budget, or execution contract is invalid' }
-      - { code: CHANGE_NOT_FOUND, description: 'change id does not exist' }
-      - { code: CHANGE_TERMINAL, description: 'terminal change cannot compile a new context' }
-      - { code: TASK_NOT_FOUND, description: 'task id is not linked to the change' }
-      - { code: EXECUTION_CONTRACT_CONFLICT, description: 'Prompt input attempted to override the DB-backed task seam or verification command' }
-      - { code: EXECUTION_CONTEXT_REFS_CONFLICT, description: 'Prompt input attempted to override DB-backed task context references' }
-      - { code: CONTEXT_LEGACY_NEXT_ACTION_UNSUPPORTED, description: 'a canonical next action is not an MCP authority field; use a non-authoritative host recommendation' }
-      - { code: CONTEXT_PROVIDER_REFS_MUTATION_UNSUPPORTED, description: 'provider references must be updated through change.update before context compilation' }
-    cli_subcommand: change context
-    emits_events: [context_updated]
-
-  - name: change.breadcrumb
-    family: change
-    description: Read the compact DB-derived Context Spine position, readiness, allowed transitions, and any mechanically required recovery transition.
-    phase: '10'
-    readonly: true
-    writer_role: any
-    input_schema:
-      type: object
-      additionalProperties: false
-      properties:
-        id: { type: string }
-    output_schema:
-      type: object
-      required: [breadcrumb]
-      additionalProperties: false
-      properties:
-        breadcrumb: { type: object }
-    errors:
-      - { code: CHANGE_NOT_FOUND, description: 'explicit change id does not exist' }
-      - { code: STATE_DB_ERROR, description: 'runtime state could not be read' }
-    cli_subcommand: change breadcrumb
-    emits_events: []
-
-  - name: change.learning_propose
-    family: change
-    description: Propose one stable implementation discovery for approval-gated baseline specification convergence.
-    phase: '10'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [change_id, target_ref, summary]
-      additionalProperties: false
-      properties:
-        id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-        change_id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-        task_id: { type: string }
-        target_ref: { type: string, minLength: 1 }
-        summary: { type: string, minLength: 3 }
-        evidence: { type: array, items: { type: string, minLength: 1 } }
-    output_schema:
-      type: object
-      required: [candidate]
-      additionalProperties: false
-      properties:
-        candidate: { type: object }
-    errors:
-      - { code: VALIDATION_ERROR, description: 'candidate id, target, summary, or evidence is invalid' }
-      - { code: CHANGE_NOT_FOUND, description: 'change id does not exist' }
-      - { code: CHANGE_NOT_MUTABLE, description: 'learning must resolve before convergence' }
-      - { code: TASK_NOT_FOUND, description: 'task is not linked to the change' }
-      - { code: DUPLICATE_LEARNING_ID, description: 'candidate id already exists' }
-    cli_subcommand: change learning-propose
-    emits_events: [spec_learning_proposed]
-
-  - name: change.learning_resolve
-    family: change
-    description: Approve, reject, or mark applied one specification-learning candidate through a guarded state transition.
-    phase: '10'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [change_id, candidate_id, decision]
-      additionalProperties: false
-      properties:
-        change_id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-        candidate_id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-        decision: { type: string, enum: [approve, reject, apply] }
-        resolution: { type: string }
-        applied_ref: { type: string, minLength: 3 }
-        before_digest: { type: string, pattern: '^[0-9a-f]{64}$' }
-        after_digest: { type: string, pattern: '^[0-9a-f]{64}$' }
-        apply_evidence: { type: array, minItems: 1, uniqueItems: true, items: { type: string, minLength: 3 } }
-    output_schema:
-      type: object
-      required: [candidate]
-      additionalProperties: false
-      properties:
-        candidate: { type: object }
-    errors:
-      - { code: VALIDATION_ERROR, description: 'decision or required resolution is invalid' }
-      - { code: CHANGE_NOT_FOUND, description: 'change id does not exist' }
-      - { code: LEARNING_NOT_FOUND, description: 'candidate id does not exist for the change' }
-      - { code: ILLEGAL_LEARNING_TRANSITION, description: 'candidate state transition is not permitted' }
-      - { code: LEARNING_APPLY_EVIDENCE_REQUIRED, description: 'apply requires exact target, before and after digests, and evidence' }
-      - { code: LEARNING_APPLY_EVIDENCE_MISMATCH, description: 'apply evidence does not match the current target artifact' }
-    cli_subcommand: change learning-resolve
-    emits_events: [spec_learning_resolved]
-
-  - name: change.converge
-    family: change
-    description: Deterministically verify task, spec, test, documentation, review, context, and incident diagnosis structure before closure.
-    phase: '9'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-    output_schema:
-      type: object
-      required: [ready, status, blockers]
-      additionalProperties: false
-      properties:
-        ready: { type: boolean }
-        status: { type: string, enum: [blocked, ready] }
-        blockers: { type: array, items: { type: string } }
-        verification_path: { type: string }
-    errors:
-      - { code: CHANGE_NOT_FOUND, description: 'change id does not exist' }
-      - { code: CHANGE_NOT_CONVERGEABLE, description: 'change lifecycle does not allow convergence' }
-      - { code: CONVERGENCE_EVIDENCE_AUTHORITY_VIOLATION, description: 'Prompt-supplied gate verdicts cannot replace DB-backed workflow evidence' }
-    cli_subcommand: change converge
-    emits_events: [change_blocked, change_converged]
-
-  - name: change.archive
-    family: change
-    description: Archive a converged change after explicit baseline-spec reconciliation.
-    phase: '9'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, summary, reconciliation_path]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-        summary: { type: string, minLength: 3 }
-        baseline_updates: { type: array, items: { type: string } }
-        no_baseline_change_reason: { type: string, minLength: 3 }
-        reconciliation_path: { type: string, minLength: 3 }
-    output_schema:
-      type: object
-      required: [change, archive_path]
-      additionalProperties: false
-      properties:
-        change: { type: object }
-        archive_path: { type: string }
-    errors:
-      - { code: CHANGE_NOT_READY, description: 'change has not passed convergence' }
-      - { code: BASELINE_RECONCILIATION_REQUIRED, description: 'baseline update or explicit no-change reason required' }
-      - { code: BASELINE_FILE_MISSING, description: 'a declared baseline update does not exist' }
-      - { code: BASELINE_RECONCILIATION_INCOMPLETE, description: 'repository revision or tracked specification digests remain stale after reconciliation' }
-      - { code: BASELINE_RECONCILIATION_MANIFEST_REQUIRED, description: 'a change-bound reconciliation manifest is required' }
-      - { code: BASELINE_RECONCILIATION_MANIFEST_INVALID, description: 'semantic changes, digests, resolutions, or verification are invalid' }
-      - { code: ARCHIVE_EXISTS, description: 'archive target already exists' }
-    cli_subcommand: change archive
-    emits_events: [change_archived]
-
-  # ────────────────────────── decision family ────────────────────────────
-  - name: decision.thread_start
-    family: decision
-    description: Start one durable owner-agent alignment thread bound to baseline, change, or workflow authority.
-    phase: '16'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, purpose]
-      additionalProperties: false
-      properties:
-        id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-        purpose: { type: string, minLength: 3 }
-        mode: { type: string, enum: [guided, fast, autonomous, diagnostic], default: guided }
-        baseline_id: { type: string }
-        change_id: { type: string }
-        workflow_run_id: { type: string }
-    output_schema:
-      type: object
-      required: [thread]
-      additionalProperties: false
-      properties:
-        thread: { type: object }
-    errors:
-      - { code: DECISION_AUTHORITY_REQUIRED, description: 'thread has no baseline, change, or workflow authority' }
-      - { code: DECISION_AUTHORITY_MISMATCH, description: 'thread authority differs from its workflow binding' }
-      - { code: DECISION_THREAD_IN_PROGRESS, description: 'the same authority and purpose already has an active thread' }
-      - { code: DUPLICATE_DECISION_THREAD, description: 'decision thread id already exists' }
-      - { code: VALIDATION_ERROR, description: 'thread input is incomplete or invalid' }
-    cli_subcommand: decision thread-start
-    emits_events: [decision_thread_started]
-
-  - name: decision.get
-    family: decision
-    description: Read one decision thread with its current question, normalized decisions, and checkpoint authority.
-    phase: '16'
-    readonly: true
-    input_schema:
-      type: object
-      required: [id]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-    output_schema:
-      type: object
-      required: [thread]
-      additionalProperties: false
-      properties:
-        thread: { type: object }
-    errors:
-      - { code: DECISION_THREAD_NOT_FOUND, description: 'decision thread id does not exist' }
-    cli_subcommand: decision get
-    emits_events: []
-
-  - name: decision.list
-    family: decision
-    description: List durable decision threads by authority, mode, or lifecycle state for recovery and status reporting.
-    phase: '16'
-    readonly: true
-    input_schema:
-      type: object
-      additionalProperties: false
-      properties:
-        status: { type: string, enum: [active, checkpoint_ready, completed, confirmed, cancelled] }
-        mode: { type: string, enum: [guided, fast, autonomous, diagnostic] }
-        baseline_id: { type: string }
-        change_id: { type: string }
-        workflow_run_id: { type: string }
-        limit: { type: integer, minimum: 1, maximum: 500, default: 100 }
-    output_schema:
-      type: object
-      required: [threads, count]
-      additionalProperties: false
-      properties:
-        threads: { type: array, items: { type: object } }
-        count: { type: integer, minimum: 0 }
-    errors:
-      - { code: STATE_DB_ERROR, description: 'decision thread state could not be read' }
-    cli_subcommand: decision list
-    emits_events: []
-
-  - name: decision.open
-    family: decision
-    description: Open the sole user-facing decision in a thread with evidence, recommendation, credible alternatives, and durable effects.
-    phase: '16'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, thread_id, phase, question, why_now, recommendation, effects]
-      additionalProperties: false
-      properties:
-        id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-        thread_id: { type: string }
-        phase: { type: string, minLength: 1 }
-        question: { type: string, minLength: 1 }
-        why_now: { type: string, minLength: 1 }
-        recommendation: { type: string, minLength: 1 }
-        options:
-          type: array
-          maxItems: 3
-          items: &decision_option
-            type: object
-            required: [id, label, tradeoff]
-            additionalProperties: false
-            properties:
-              id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-              label: { type: string, minLength: 1 }
-              tradeoff: { type: string, minLength: 1 }
-        evidence_refs: { type: array, uniqueItems: true, items: { type: string, minLength: 1 } }
-        dependency_ids: { type: array, uniqueItems: true, items: { type: string, minLength: 1 } }
-        effects: { type: object, minProperties: 1 }
-        blocking: { type: boolean, default: true }
-    output_schema:
-      type: object
-      required: [thread]
-      additionalProperties: false
-      properties:
-        thread: { type: object }
-    errors:
-      - { code: DECISION_THREAD_NOT_FOUND, description: 'decision thread id does not exist' }
-      - { code: DECISION_ALREADY_OPEN, description: 'another decision is already awaiting an answer' }
-      - { code: DECISION_CHECKPOINT_PENDING, description: 'the prepared checkpoint must be confirmed or revised first' }
-      - { code: DECISION_DEPENDENCY_UNRESOLVED, description: 'a declared decision dependency is unresolved' }
-      - { code: DUPLICATE_DECISION_ID, description: 'decision item id already exists' }
-      - { code: VALIDATION_ERROR, description: 'question, recommendation, options, evidence, or effects are invalid' }
-    cli_subcommand: decision open
-    emits_events: [decision_opened]
-
-  - name: decision.resolve
-    family: decision
-    description: Resolve the current question as an explicit normalized owner decision without storing the conversation transcript.
-    phase: '16'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, decision, rationale, decided_by]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-        decision: { type: string, minLength: 1 }
-        rationale: { type: string, minLength: 1 }
-        decided_by: { type: string, minLength: 1 }
-    output_schema:
-      type: object
-      required: [thread]
-      additionalProperties: false
-      properties:
-        thread: { type: object }
-    errors:
-      - { code: DECISION_NOT_FOUND, description: 'decision item id does not exist' }
-      - { code: DECISION_NOT_OPEN, description: 'decision item is no longer awaiting an answer' }
-      - { code: VALIDATION_ERROR, description: 'normalized owner decision is incomplete' }
-    cli_subcommand: decision resolve
-    emits_events: [decision_resolved]
-
-  - name: decision.delegate
-    family: decision
-    description: Record explicit owner delegation for a reversible decision, including the selected result and non-negotiable guardrails.
-    phase: '16'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, delegated_to, decision, rationale, guardrails]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-        delegated_to: { type: string, minLength: 1 }
-        decision: { type: string, minLength: 1 }
-        rationale: { type: string, minLength: 1 }
-        guardrails: { type: array, minItems: 1, uniqueItems: true, items: { type: string, minLength: 1 } }
-    output_schema:
-      type: object
-      required: [thread]
-      additionalProperties: false
-      properties:
-        thread: { type: object }
-    errors:
-      - { code: DECISION_NOT_FOUND, description: 'decision item id does not exist' }
-      - { code: DECISION_NOT_OPEN, description: 'decision item is no longer awaiting an answer' }
-      - { code: VALIDATION_ERROR, description: 'delegation result or guardrails are incomplete' }
-    cli_subcommand: decision delegate
-    emits_events: [decision_resolved]
-
-  - name: decision.defer
-    family: decision
-    description: Defer the current decision with explicit consequences and a deterministic condition for revisiting it.
-    phase: '16'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, reason, consequences, revisit_condition]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-        reason: { type: string, minLength: 1 }
-        consequences: { type: string, minLength: 1 }
-        revisit_condition: { type: string, minLength: 1 }
-    output_schema:
-      type: object
-      required: [thread]
-      additionalProperties: false
-      properties:
-        thread: { type: object }
-    errors:
-      - { code: DECISION_NOT_FOUND, description: 'decision item id does not exist' }
-      - { code: DECISION_NOT_OPEN, description: 'decision item is no longer awaiting an answer' }
-      - { code: VALIDATION_ERROR, description: 'deferral consequence or revisit condition is incomplete' }
-    cli_subcommand: decision defer
-    emits_events: [decision_resolved]
-
-  - name: decision.supersede
-    family: decision
-    description: Preserve a prior resolved decision and reopen alignment with one replacement question when evidence or owner intent changes.
-    phase: '16'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, reason, replacement]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-        reason: { type: string, minLength: 1 }
-        replacement:
-          type: object
-          required: [id, phase, question, why_now, recommendation, effects]
-          additionalProperties: false
-          properties:
-            id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-            phase: { type: string, minLength: 1 }
-            question: { type: string, minLength: 1 }
-            why_now: { type: string, minLength: 1 }
-            recommendation: { type: string, minLength: 1 }
-            options: { type: array, maxItems: 3, items: *decision_option }
-            evidence_refs: { type: array, uniqueItems: true, items: { type: string, minLength: 1 } }
-            dependency_ids: { type: array, uniqueItems: true, items: { type: string, minLength: 1 } }
-            effects: { type: object, minProperties: 1 }
-            blocking: { type: boolean, default: true }
-    output_schema:
-      type: object
-      required: [thread]
-      additionalProperties: false
-      properties:
-        thread: { type: object }
-    errors:
-      - { code: DECISION_NOT_FOUND, description: 'decision item id does not exist' }
-      - { code: DECISION_NOT_SUPERSEDEABLE, description: 'decision item cannot be revised from its current state' }
-      - { code: DECISION_ALREADY_OPEN, description: 'another decision is already awaiting an answer' }
-      - { code: VALIDATION_ERROR, description: 'replacement question or revision reason is invalid' }
-    cli_subcommand: decision supersede
-    emits_events: [decision_opened]
-
-  - name: decision.complete
-    family: decision
-    description: Complete a decision thread after its normalized state is settled, without creating an approval receipt or artifact checkpoint.
-    phase: '19'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, summary]
-      additionalProperties: false
-      properties:
-        id: { type: string, minLength: 1 }
-        summary: { type: string, minLength: 1 }
-        applied_refs:
-          type: array
-          maxItems: 20
-          items:
-            type: object
-            required: [kind, ref]
-            additionalProperties: false
-            allOf:
-              - if:
-                  properties:
-                    kind: { enum: [baseline, change, workflow, task] }
-                  required: [kind]
-                then:
-                  required: [field, value]
-              - if:
-                  properties:
-                    kind: { enum: [spec, artifact] }
-                  required: [kind]
-                then:
-                  required: [digest]
-                  not:
-                    anyOf:
-                      - { required: [field] }
-                      - { required: [value] }
-            properties:
-              kind: { type: string, enum: [baseline, change, workflow, task, spec, artifact] }
-              ref: { type: string, minLength: 1 }
-              field: { type: string, minLength: 1 }
-              value: {}
-              digest: { type: string, pattern: '^[0-9a-f]{64}$' }
-    output_schema:
-      type: object
-      required: [thread]
-      additionalProperties: false
-      properties:
-        thread: { type: object }
-    errors:
-      - { code: DECISION_THREAD_NOT_FOUND, description: 'decision thread id does not exist' }
-      - { code: DECISION_THREAD_NOT_MUTABLE, description: 'the decision thread is already terminal' }
-      - { code: DECISION_CHECKPOINT_PENDING, description: 'a prepared artifact checkpoint must be confirmed or revised first' }
-      - { code: DECISION_ALIGNMENT_BLOCKING, description: 'an unanswered question or blocking deferral prevents completion' }
-      - { code: DECISION_APPLIED_REF_NOT_FOUND, description: 'an applied authority reference cannot be read back from the current project state' }
-      - { code: DECISION_APPLIED_REF_FIELD_NOT_FOUND, description: 'a row-backed applied authority field does not exist' }
-      - { code: DECISION_APPLIED_REF_VALUE_MISMATCH, description: 'a row-backed applied authority value does not match current state' }
-      - { code: DECISION_APPLIED_REF_STALE, description: 'an applied field, specification, or artifact digest does not match current content' }
-      - { code: VALIDATION_ERROR, description: 'the completion summary or applied authority references are invalid' }
-    cli_subcommand: decision complete
-    emits_events: [decision_thread_completed]
-
-  - name: decision.checkpoint
-    family: decision
-    description: Prepare or confirm a decision checkpoint, including renewal of unchanged decisions against current artifacts; change- and workflow-bound threads require an artifact, while a standalone baseline thread may record an explicit no-artifact reason.
-    phase: '16'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, action]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-        action: { type: string, enum: [prepare, confirm] }
-        summary: { type: string, minLength: 1 }
-        approved_by: { type: string, minLength: 1 }
-        approval_note: { type: string, minLength: 3 }
-        artifacts:
-          type: array
-          items:
-            type: object
-            required: [path, kind]
-            additionalProperties: false
-            properties:
-              path: { type: string, minLength: 1 }
-              kind: { type: string, minLength: 1 }
-        no_artifact_reason: { type: string, minLength: 3 }
-    output_schema:
-      type: object
-      required: [thread]
-      additionalProperties: false
-      properties:
-        thread: { type: object }
-    errors:
-      - { code: DECISION_THREAD_NOT_FOUND, description: 'decision thread id does not exist' }
-      - { code: DECISION_THREAD_NOT_MUTABLE, description: 'cancelled decision thread cannot be checkpointed' }
-      - { code: DECISION_ALIGNMENT_BLOCKING, description: 'an open or deferred blocking decision prevents checkpointing' }
-      - { code: DECISION_CHECKPOINT_STALE, description: 'prepared decision digest no longer matches current authority' }
-      - { code: DECISION_ARTIFACT_REQUIRED, description: 'confirmation lacks required artifact bindings; no-artifact reasons are allowed only for standalone baseline thinking' }
-      - { code: DECISION_ARTIFACT_MISSING, description: 'a declared checkpoint artifact does not exist' }
-      - { code: VALIDATION_ERROR, description: 'checkpoint action, approval, or artifact input is invalid' }
-    cli_subcommand: decision checkpoint
-    emits_events: [decision_checkpoint_prepared, decision_checkpoint_confirmed]
-
-  # ────────────────────────── workflow family ────────────────────────────
-  - name: workflow.start
-    family: workflow
-    description: Start one durable Ultra workflow run. For research, the host supplies normalized accepted semantic coverage after user-model alignment; MCP records and validates the state without choosing or proving user intent.
-    phase: '13'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [kind, subject]
-      additionalProperties: false
-      properties:
-        id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-        kind: { type: string, enum: [init, research, plan, change, dev, test, review, deliver] }
-        subject: { type: string, minLength: 3 }
-        mode: { type: string, enum: [full, adoption, product, feature, architecture, custom] }
-        selected_steps: { type: array, uniqueItems: true, items: { type: string } }
-        coverage:
-          type: array
-          minItems: 1
-          items:
-            type: object
-            required: [step_id, disposition, rationale]
-            additionalProperties: false
-            properties:
-              step_id: { type: string, minLength: 1 }
-              disposition: { type: string, enum: [execute, verify_existing, reuse, not_applicable, deferred] }
-              rationale: { type: string, minLength: 3 }
-              evidence_refs: { type: array, uniqueItems: true, items: { type: string, minLength: 1 } }
-              accepted_by: { type: string, minLength: 1 }
-              consequence: { type: string, minLength: 3 }
-        baseline_id: { type: string }
-        change_id: { type: string }
-        task_id: { type: string }
-        metadata: { type: object }
-    output_schema:
-      type: object
-      required: [workflow]
-      additionalProperties: false
-      properties:
-        workflow: { type: object }
-    errors:
-      - { code: VALIDATION_ERROR, description: 'definition, mode, selection, or linked authority is invalid' }
-      - { code: DUPLICATE_WORKFLOW_ID, description: 'workflow id already exists' }
-      - { code: WORKFLOW_IN_PROGRESS, description: 'the same authority already has an active workflow of this kind' }
-      - { code: WORKFLOW_CHANGE_NOT_FOUND, description: 'the requested change authority does not exist' }
-      - { code: WORKFLOW_SCOPE_INVALID, description: 'the workflow kind received a task or change scope that it does not own' }
-      - { code: WORKFLOW_CHANGE_RUN_REQUIRED, description: 'change-bound stages require the owning durable change workflow; legacy gaps route through doctor repair' }
-      - { code: WORKFLOW_BASELINE_MISMATCH, description: 'a supplied stage baseline differs from the baseline bound by the owning change workflow' }
-      - { code: WORKFLOW_BASELINE_NOT_READY, description: 'the baseline bound to the change is no longer ready' }
-      - { code: WORKFLOW_BASELINE_REQUIRED, description: 'a baseline-free plan is valid only for an approved incident break-glass change' }
-      - { code: WORKFLOW_CHANGE_NOT_MUTABLE, description: 'the owning change does not accept a new workflow of this stage' }
-      - { code: WORKFLOW_AUTHORITY_REQUIRED, description: 'the workflow is missing its required baseline, change, or task authority' }
-      - { code: WORKFLOW_CHANGE_DECISION_BLOCKING, description: 'the change contains unresolved material owner decisions' }
-      - { code: WORKFLOW_CHANGE_RESEARCH_INCOMPLETE, description: 'the change-bound research disposition is not current and complete' }
-      - { code: WORKFLOW_RESEARCH_COVERAGE_REQUIRED, description: 'research requires accepted coverage with at least one applicable semantic area beyond synthesis' }
-      - { code: WORKFLOW_RESEARCH_COVERAGE_EVIDENCE_REQUIRED, description: 'reuse, verification, and not-applicable dispositions require evidence references' }
-      - { code: WORKFLOW_RESEARCH_SYNTHESIS_REQUIRED, description: 'research synthesis must execute, verify, or reuse durable evidence' }
-      - { code: WORKFLOW_RESEARCH_MODE_MISMATCH, description: 'the selected research mode does not match its authority or baseline mode' }
-      - { code: WORKFLOW_SELECTION_REASON_REQUIRED, description: 'research requires the model evidence rationale for its selected coverage' }
-      - { code: TASK_EXECUTION_CONTRACT_INCOMPLETE, description: 'dev cannot start until the linked task contract is executable' }
-      - { code: TASK_CHANGE_OWNERSHIP_MISMATCH, description: 'linked task and change authority disagree' }
-      - { code: TASK_DEPENDENCIES_INCOMPLETE, description: 'dev cannot start while a task dependency remains incomplete' }
-      - { code: WORKFLOW_TASK_NOT_EXECUTABLE, description: 'the linked task status or stale marker forbids execution' }
-      - { code: WORKFLOW_PLAN_NOT_COMPLETED, description: 'dev requires a completed current change plan' }
-      - { code: WORKFLOW_PLAN_TASK_SET_STALE, description: 'the authoritative task set changed after plan convergence' }
-      - { code: WORKFLOW_PLAN_TASK_CONTRACT_STALE, description: 'a task contract was invalidated or changed after plan convergence' }
-    cli_subcommand: workflow start
-    emits_events: [workflow_started]
-
-  - name: workflow.get
-    family: workflow
-    description: Read one workflow run with every step, current recovery position, blockers, and output freshness.
-    phase: '13'
-    readonly: true
-    input_schema:
-      type: object
-      required: [id]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-    output_schema:
-      type: object
-      required: [workflow]
-      additionalProperties: false
-      properties:
-        workflow: { type: object }
-    errors:
-      - { code: WORKFLOW_NOT_FOUND, description: 'workflow id does not exist' }
-    cli_subcommand: workflow get
-    emits_events: []
-
-  - name: workflow.list
-    family: workflow
-    description: List workflow runs by phase, state, baseline, change, or task authority.
-    phase: '13'
-    readonly: true
-    input_schema:
-      type: object
-      additionalProperties: false
-      properties:
-        kind: { type: string, enum: [init, research, plan, change, dev, test, review, deliver] }
-        status: { type: string, enum: [active, blocked, ready, completed, cancelled] }
-        baseline_id: { type: string }
-        change_id: { type: string }
-        task_id: { type: string }
-        limit: { type: integer, minimum: 1, maximum: 500, default: 100 }
-    output_schema:
-      type: object
-      required: [workflows, count]
-      additionalProperties: false
-      properties:
-        workflows: { type: array, items: { type: object } }
-        count: { type: integer, minimum: 0 }
-    errors:
-      - { code: STATE_DB_ERROR, description: 'workflow state could not be read' }
-    cli_subcommand: workflow list
-    emits_events: []
-
-  - name: workflow.step
-    family: workflow
-    description: Record one canonical workflow-step transition with bounded evidence, durable output digests, decisions, or blockers.
-    phase: '13'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, step_id, status]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-        step_id: { type: string }
-        status: { type: string, enum: [in_progress, completed, skipped, blocked] }
-        evidence:
-          type: array
-          items:
-            type: object
-            required: [kind, ref, summary]
-            additionalProperties: false
-            properties:
-              kind: { type: string, minLength: 1 }
-              ref: { type: string, minLength: 1 }
-              summary: { type: string, minLength: 1 }
-        outputs:
-          type: array
-          items:
-            type: object
-            required: [path, kind]
-            additionalProperties: false
-            properties:
-              path: { type: string, minLength: 1 }
-              kind: { type: string, minLength: 1 }
-        decisions: { type: array, items: { type: object } }
-        semantic_records:
-          type: array
-          items:
-            type: object
-            required: [id, kind, status, summary, source_ref, evidence_refs, attributes, links]
-            additionalProperties: false
-            properties:
-              id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-              kind: { type: string, minLength: 1 }
-              status: { type: string, enum: [observed, verified, decided, accepted, unknown, not_applicable] }
-              summary: { type: string, minLength: 1 }
-              source_ref: { type: string, minLength: 3 }
-              evidence_refs: { type: array, minItems: 1, items: { type: string, minLength: 1 } }
-              attributes: { type: object }
-              links:
-                type: array
-                items:
-                  type: object
-                  required: [relation, target]
-                  additionalProperties: false
-                  properties:
-                    relation: { type: string, minLength: 1 }
-                    target: { type: string, minLength: 1 }
-        blockers: { type: array, uniqueItems: true, items: { type: string, minLength: 1 } }
-    output_schema:
-      type: object
-      required: [workflow]
-      additionalProperties: false
-      properties:
-        workflow: { type: object }
-    errors:
-      - { code: WORKFLOW_NOT_FOUND, description: 'workflow id does not exist' }
-      - { code: WORKFLOW_NOT_MUTABLE, description: 'completed and cancelled workflows cannot accept step updates' }
-      - { code: WORKFLOW_STEP_NOT_FOUND, description: 'step is not part of the canonical workflow' }
-      - { code: ILLEGAL_WORKFLOW_STEP_TRANSITION, description: 'the requested step-state transition is not permitted' }
-      - { code: WORKFLOW_STEP_OUT_OF_ORDER, description: 'an earlier selected step remains incomplete' }
-      - { code: VALIDATION_ERROR, description: 'step evidence, output, decision, semantic, or blocker input is malformed' }
-      - { code: WORKFLOW_EVIDENCE_REQUIRED, description: 'the step cannot complete without evidence' }
-      - { code: WORKFLOW_OUTPUT_REQUIRED, description: 'the step cannot complete without a durable output' }
-      - { code: WORKFLOW_OUTPUT_MISSING, description: 'a declared output file is missing' }
-      - { code: WORKFLOW_ARTIFACT_SCOPE_INVALID, description: 'a Change-bound semantic or evidence artifact escaped its owning Change root' }
-      - { code: WORKFLOW_RESEARCH_REPORT_REQUIRED, description: 'a research step requires its immutable workflow-and-step-bound report path' }
-      - { code: WORKFLOW_RESEARCH_REPORT_INVALID, description: 'the research report is missing its required evidence structure' }
-      - { code: WORKFLOW_RESEARCH_SYNTHESIS_INCOMPLETE, description: 'full or adoption synthesis did not bind all baseline specifications and the distillate' }
-      - { code: WORKFLOW_SEMANTIC_RECORDS_REQUIRED, description: 'a research step did not persist typed semantic results' }
-      - { code: WORKFLOW_SEMANTIC_RECORD_INVALID, description: 'a semantic record does not satisfy its step contract' }
-      - { code: WORKFLOW_SEMANTIC_SOURCE_INVALID, description: 'a semantic record source is missing, outside the project, or lacks an anchor' }
-      - { code: WORKFLOW_SYNTHESIS_TRACE_INVALID, description: 'synthesis references missing research semantic records' }
-      - { code: WORKFLOW_BLOCKER_REQUIRED, description: 'blocked state requires a specific blocker code' }
-      - { code: WORKFLOW_CONTEXT_OUTPUT_REQUIRED, description: 'the stage requires its immutable Context Manifest v3 output' }
-      - { code: WORKFLOW_CONTEXT_MISMATCH, description: 'the context role, gate, change, task, or readiness does not match the stage' }
-      - { code: WORKFLOW_CONTEXT_AUTHORITY_MISMATCH, description: 'the context artifact does not match its DB snapshot row' }
-      - { code: WORKFLOW_CONTEXT_STALE, description: 'the context artifact no longer matches the current checkout' }
-      - { code: WORKFLOW_TASKS_REQUIRED, description: 'the stage requires at least one task bound to the change' }
-      - { code: WORKFLOW_TASK_NOT_COMPLETED, description: 'the required task development state has not converged' }
-      - { code: WORKFLOW_GATE_MISSING, description: 'a required completed dev, test, or review gate is missing' }
-      - { code: WORKFLOW_GATE_STALE, description: 'a required task or gate no longer matches current authority or checkout state' }
-      - { code: WORKFLOW_REVIEW_NOT_APPROVED, description: 'the required independent review axes have not passed' }
-      - { code: WORKFLOW_TEST_NOT_PASSED, description: 'the required current test gate has not passed' }
-      - { code: WORKFLOW_SESSION_ACTIVE, description: 'delivery is blocked while a bound execution session remains active' }
-      - { code: DECISION_ALIGNMENT_BLOCKING, description: 'matching owner decisions or artifact checkpoints are not current' }
-    cli_subcommand: workflow step
-    emits_events: [workflow_step_updated, workflow_blocked]
-
-  - name: workflow.revise
-    family: workflow
-    description: Create a candidate revision of a completed workflow while preserving the accepted run and its provenance.
-    phase: '21'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, replacement_id, subject, reason]
-      additionalProperties: false
-      properties:
-        id: { type: string, minLength: 1 }
-        replacement_id: { type: string, minLength: 1 }
-        subject: { type: string, minLength: 1 }
-        reason: { type: string, minLength: 3 }
-    output_schema:
-      type: object
-      required: [workflow]
-      additionalProperties: false
-      properties:
-        workflow: { type: object }
-    errors:
-      - { code: WORKFLOW_NOT_FOUND, description: 'prior workflow id does not exist' }
-      - { code: WORKFLOW_REVISION_SOURCE_NOT_ACCEPTED, description: 'only a completed workflow can be revised' }
-      - { code: WORKFLOW_ALREADY_SUPERSEDED, description: 'the prior workflow already has a replacement authority' }
-      - { code: WORKFLOW_IN_PROGRESS, description: 'a competing active workflow owns the same scope' }
-    cli_subcommand: workflow revise
-    emits_events: [workflow_started, workflow_revision_started]
-
-  - name: workflow.supersede
-    family: workflow
-    description: Promote a completed candidate revision to current authority and invalidate only its transitive registry consumers.
-    phase: '21'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id, replacement_id, reason]
-      additionalProperties: false
-      properties:
-        id: { type: string, minLength: 1 }
-        replacement_id: { type: string, minLength: 1 }
-        reason: { type: string, minLength: 3 }
-    output_schema:
-      type: object
-      required: [superseded, workflow, invalidated, idempotent]
-      additionalProperties: false
-      properties:
-        superseded: { type: object }
-        workflow: { type: object }
-        invalidated: { type: array, items: { type: object } }
-        idempotent: { type: boolean }
-    errors:
-      - { code: WORKFLOW_NOT_FOUND, description: 'prior or replacement workflow id does not exist' }
-      - { code: WORKFLOW_SUPERSESSION_NOT_ACCEPTED, description: 'both workflow revisions must be completed' }
-      - { code: WORKFLOW_SUPERSESSION_AUTHORITY_MISMATCH, description: 'replacement binding or revision provenance differs' }
-      - { code: WORKFLOW_OUTPUT_STALE, description: 'replacement output authority is stale' }
-      - { code: WORKFLOW_ALREADY_SUPERSEDED, description: 'another replacement already owns authority' }
-    cli_subcommand: workflow supersede
-    emits_events: [workflow_superseded, workflow_invalidated, task_stale_marked]
-
-  - name: workflow.complete
-    family: workflow
-    description: Complete a ready workflow only when every selected step is complete and every recorded output digest remains current. Plan approval is optional unless the host identified a material owner decision.
-    phase: '13'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [id]
-      additionalProperties: false
-      properties:
-        id: { type: string }
-        approval:
-          type: object
-          required: [approved_by, approval_note]
-          additionalProperties: false
-          properties:
-            approved_by: { type: string, minLength: 1 }
-            approval_note: { type: string, minLength: 3 }
-            approved_at: { type: string, format: date-time }
-    output_schema:
-      type: object
-      required: [workflow]
-      additionalProperties: false
-      properties:
-        workflow: { type: object }
-    errors:
-      - { code: WORKFLOW_NOT_FOUND, description: 'workflow id does not exist' }
-      - { code: WORKFLOW_NOT_READY, description: 'selected steps or blockers remain incomplete' }
-      - { code: WORKFLOW_OUTPUT_STALE, description: 'a recorded output changed or disappeared' }
-      - { code: VALIDATION_ERROR, description: 'approval or completion input is malformed' }
-      - { code: WORKFLOW_TASKS_REQUIRED, description: 'plan completion requires a non-empty authoritative task set' }
-      - { code: TASK_NOT_FOUND, description: 'a task referenced by the authoritative plan no longer exists' }
-      - { code: TASK_EXECUTION_CONTRACT_INCOMPLETE, description: 'one or more planned tasks lack an executable contract' }
-      - { code: TASK_CHANGE_OWNERSHIP_MISMATCH, description: 'a planned task is not owned by the workflow change' }
-      - { code: TASK_DEPENDENCY_MISSING, description: 'a planned dependency does not exist' }
-      - { code: TASK_DEPENDENCY_CYCLE, description: 'the planned task graph contains a cycle' }
-      - { code: WORKFLOW_PLAN_ARTIFACT_INVALID, description: 'the plan workflow did not produce exactly one valid JSON execution plan' }
-      - { code: WORKFLOW_PLAN_ARTIFACT_STALE, description: 'the execution-plan artifact differs from current DB task authority' }
-      - { code: WORKFLOW_PLAN_COVERAGE_INCOMPLETE, description: 'one or more accepted change outcomes have no executable task coverage' }
-      - { code: WORKFLOW_PLAN_ORPHAN_TASK, description: 'a task trace does not resolve to accepted change or research authority' }
-      - { code: WORKFLOW_PLAN_TASK_CONTRACT_STALE, description: 'a task was invalidated or changed before plan convergence' }
-      - { code: WORKFLOW_QUICK_PLAN_TOO_LARGE, description: 'a quick change contains more than one executable task' }
-      - { code: WORKFLOW_TASK_NOT_COMPLETED, description: 'dev convergence requires its task to be completed' }
-      - { code: WORKFLOW_APPROVAL_REQUIRED, description: 'when optional plan approval is supplied it requires approved_by and approval_note fields' }
-      - { code: WORKFLOW_SUMMARY_AUTHORITY_VIOLATION, description: 'Prompt summary fields are not allowed to replace DB-derived gate evidence or the complete change task set' }
-      - { code: WORKFLOW_APPROVAL_AUTHORITY_VIOLATION, description: 'only the plan workflow accepts completion approval' }
-      - { code: WORKFLOW_GATE_MISSING, description: 'a required completed dev, test, or review gate is missing' }
-      - { code: WORKFLOW_GATE_STALE, description: 'a required gate no longer matches its task contract or commit ancestry' }
-      - { code: WORKFLOW_REPORT_INVALID, description: 'a required report is malformed or incomplete' }
-      - { code: WORKFLOW_REPORT_CONTEXT_MISMATCH, description: 'a report is not bound to the recorded stage context digest' }
-      - { code: WORKFLOW_REPORT_REVISION_STALE, description: 'a report does not match the current full Git HEAD' }
-      - { code: WORKFLOW_REPORT_WORKTREE_STALE, description: 'a report does not match the current worktree digest' }
-      - { code: WORKFLOW_REPORT_TASK_SET_STALE, description: 'a report task set no longer matches the authoritative execution scope' }
-      - { code: WORKFLOW_REPORT_BASELINE_MISMATCH, description: 'a report no longer matches current baseline authority' }
-      - { code: WORKFLOW_REPORT_CHANGE_MISMATCH, description: 'a report is bound to a different change' }
-      - { code: WORKFLOW_REPORT_VERDICT_CONFLICT, description: 'the declared verdict conflicts with failures or blocking evidence' }
-      - { code: WORKFLOW_VERIFICATION_PROFILE_INVALID, description: 'the selected verification dimensions or exclusion rationale are invalid' }
-      - { code: WORKFLOW_REGRESSION_SIGNAL_MISSING, description: 'a reported regression fix lacks a failing-before signal' }
-      - { code: WORKFLOW_REVIEW_MODE_MISMATCH, description: 'the review summary scope differs from the workflow scope' }
-      - { code: WORKFLOW_REVIEW_EVIDENCE_MISMATCH, description: 'the review worker roster differs from persisted specialist artifacts' }
-      - { code: WORKFLOW_REVIEW_FINDINGS_MISMATCH, description: 'the unified review findings differ from specialist evidence' }
-      - { code: WORKFLOW_REVIEW_NOT_APPROVED, description: 'both independent review axes must pass' }
-      - { code: WORKFLOW_TEST_NOT_PASSED, description: 'the current change-level test gate did not pass' }
-      - { code: WORKFLOW_SESSION_ACTIVE, description: 'delivery cannot converge while an execution session remains active' }
-      - { code: WORKFLOW_CONTEXT_NOT_READY, description: 'delivery evidence lacks a current ready context manifest' }
-      - { code: WORKFLOW_CONTEXT_STALE, description: 'a required Context reference or bound task/change authority changed after compilation; optional drift remains a summary warning' }
-      - { code: WORKFLOW_DELIVERY_CHECK_FAILED, description: 'one or more local delivery checks did not pass' }
-      - { code: WORKFLOW_CHANGE_NOT_ARCHIVED, description: 'delivery completion requires an archived change' }
-      - { code: WORKFLOW_RELEASE_AUTHORITY_MISMATCH, description: 'a local delivery report attempted to claim external release authority' }
-      - { code: DECISION_ALIGNMENT_BLOCKING, description: 'matching owner decisions or artifact checkpoints are not current' }
-    cli_subcommand: workflow complete
-    emits_events: [workflow_completed, plan_approved]
-
-  # ───────────────────────── artifact family ─────────────────────────────
-  - name: artifact.record
-    family: artifact
-    description: Register the current bytes of one semantic or evidence file, replace its dependency edges transactionally, and invalidate exact downstream consumers when its digest changes.
-    phase: '20'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [owner_type, owner_id, kind, path, provenance, source_refs, consumer_refs]
-      additionalProperties: false
-      properties:
-        id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-        owner_type: { type: string, enum: [project, baseline, change, task, workflow] }
-        owner_id: { type: string, minLength: 1 }
-        kind: { type: string, minLength: 1 }
-        path: { type: string, minLength: 1 }
-        status: { type: string, enum: [current, stale, terminal, archived], default: current }
-        expected_before_digest:
-          type: [string, 'null']
-          pattern: '^[a-f0-9]{64}$'
-        provenance: { type: object, additionalProperties: true }
-        metadata: { type: object, additionalProperties: true }
-        source_refs:
-          type: array
-          items:
-            type: object
-            required: [type, id, relation]
-            additionalProperties: false
-            properties:
-              type: { type: string, enum: [artifact, project, baseline, change, task, workflow, external] }
-              id: { type: string, minLength: 1 }
-              relation: { type: string, minLength: 1 }
-        consumer_refs:
-          type: array
-          items:
-            type: object
-            required: [type, id, relation]
-            additionalProperties: false
-            properties:
-              type: { type: string, enum: [artifact, project, baseline, change, task, workflow, external] }
-              id: { type: string, minLength: 1 }
-              relation: { type: string, minLength: 1 }
-    output_schema:
-      type: object
-      required: [artifact, changed, invalidated]
-      additionalProperties: false
-      properties:
-        artifact:
-          type: object
-          required: [id, owner_type, owner_id, kind, path, digest, before_digest, after_digest, managed, status, provenance, metadata, source_refs, consumer_refs, created_at, updated_at]
-          additionalProperties: false
-          properties:
-            id: { type: string }
-            owner_type: { type: string, enum: [project, baseline, change, task, workflow] }
-            owner_id: { type: string }
-            kind: { type: string }
-            path: { type: string }
-            digest: { type: [string, 'null'] }
-            before_digest: { type: [string, 'null'] }
-            after_digest: { type: [string, 'null'] }
-            managed: { type: boolean }
-            status: { type: string, enum: [current, stale, terminal, archived] }
-            provenance: { type: object }
-            metadata: { type: object }
-            source_refs:
-              type: array
-              items:
-                type: object
-                required: [type, id, relation]
-                additionalProperties: false
-                properties:
-                  type: { type: string }
-                  id: { type: string }
-                  relation: { type: string }
-            consumer_refs:
-              type: array
-              items:
-                type: object
-                required: [type, id, relation]
-                additionalProperties: false
-                properties:
-                  type: { type: string }
-                  id: { type: string }
-                  relation: { type: string }
-            created_at: { type: string }
-            updated_at: { type: string }
-        changed: { type: boolean }
-        invalidated:
-          type: array
-          items:
-            type: object
-            required: [type, id]
-            additionalProperties: false
-            properties:
-              type: { type: string }
-              id: { type: string }
-    errors:
-      - { code: ARTIFACT_FILE_MISSING, description: 'declared artifact file does not exist' }
-      - { code: ARTIFACT_PATH_INVALID, description: 'artifact path escapes the project or is not a regular file' }
-      - { code: ARTIFACT_PATH_EXEMPT, description: 'runtime, scratch, or generated projection path cannot become semantic authority' }
-      - { code: ARTIFACT_OWNER_MISSING, description: 'typed artifact owner does not exist' }
-      - { code: ARTIFACT_ENDPOINT_MISSING, description: 'a dependency endpoint does not exist' }
-      - { code: ARTIFACT_DIGEST_CONFLICT, description: 'expected prior digest does not match current registry authority' }
-      - { code: ARTIFACT_AUTHORITY_CONFLICT, description: 'artifact id is bound to another authority or the canonical path already has an active authority' }
-      - { code: ARTIFACT_GRAPH_SELF_EDGE, description: 'an artifact cannot directly depend on itself' }
-      - { code: ARTIFACT_GRAPH_CYCLE, description: 'replacement edges would create a dependency cycle' }
-    cli_subcommand: artifact record
-    emits_events: [artifact_recorded, spec_changed, task_stale_marked]
-
-  - name: artifact.get
-    family: artifact
-    description: Read one registered artifact together with its typed ownership, provenance, and normalized source and consumer edges.
-    phase: '20'
-    readonly: true
-    input_schema:
-      type: object
-      additionalProperties: false
-      oneOf:
-        - required: [id]
-        - required: [path]
-      properties:
-        id: { type: string, minLength: 1 }
-        path: { type: string, minLength: 1 }
-    output_schema:
-      type: object
-      required: [artifact]
-      additionalProperties: false
-      properties:
-        artifact:
-          type: object
-          required: [id, owner_type, owner_id, kind, path, digest, before_digest, after_digest, managed, status, provenance, metadata, source_refs, consumer_refs, created_at, updated_at]
-          additionalProperties: false
-          properties:
-            id: { type: string }
-            owner_type: { type: string, enum: [project, baseline, change, task, workflow] }
-            owner_id: { type: string }
-            kind: { type: string }
-            path: { type: string }
-            digest: { type: [string, 'null'] }
-            before_digest: { type: [string, 'null'] }
-            after_digest: { type: [string, 'null'] }
-            managed: { type: boolean }
-            status: { type: string, enum: [current, stale, terminal, archived] }
-            provenance: { type: object }
-            metadata: { type: object }
-            source_refs: { type: array, items: { type: object } }
-            consumer_refs: { type: array, items: { type: object } }
-            created_at: { type: string }
-            updated_at: { type: string }
-    errors:
-      - { code: ARTIFACT_NOT_FOUND, description: 'artifact id or path is not registered' }
-      - { code: ARTIFACT_DUPLICATE_AUTHORITY, description: 'path lookup resolves to multiple active authorities and requires an id' }
-      - { code: VALIDATION_ERROR, description: 'exactly one lookup key is required' }
-    cli_subcommand: artifact get
-    emits_events: []
-
-  # ────────────────────────── system family ──────────────────────────────
-  - name: system.doctor
-    family: system
-    description: Inspect Ultra runtime health and optionally perform backup-first recovery and projection repair.
-    phase: '9'
-    writer_role: mcp
-    input_schema:
-      type: object
-      additionalProperties: false
-      properties:
-        repair: { type: boolean, default: false }
-    output_schema:
-      type: object
-      required: [status, checks, repair_performed]
-      additionalProperties: true
-      properties:
-        status: { type: string, enum: [healthy, degraded] }
-        checks: { type: object }
-        repair_performed: { type: boolean }
-        backup_path: { type: string }
-        repair: { type: object }
-    errors:
-      - { code: BACKUP_FAILED, description: 'state database backup failed before repair' }
-      - { code: STATE_DB_ERROR, description: 'runtime state could not be inspected' }
-    cli_subcommand: system doctor
-    emits_events: []
-
-  # ────────────────────────── plan family (D34) ───────────────────────────
-  - name: plan.export
-    family: plan
-    description: Render deterministic plan.json and plan.md under the owning Change artifact root from the current planning Context Manifest.
-    phase: '8a'
-    writer_role: mcp
-    input_schema:
-      type: object
-      required: [change_id]
-      additionalProperties: false
-      properties:
-        change_id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-    output_schema:
-      type: object
-      required: [plan_path, plan_md_path, wave_count]
-      additionalProperties: false
-      properties:
-        plan_path:  { type: string }
-        plan_md_path: { type: string }
-        wave_count: { type: integer, minimum: 0 }
-    errors:
-      - { code: NO_TASKS, description: 'no tasks to plan' }
-      - { code: CHANGE_NOT_FOUND, description: 'owning change does not exist' }
-      - { code: CHANGE_NOT_MUTABLE, description: 'owning change no longer accepts planning output' }
-      - { code: PLAN_CONTEXT_REQUIRED, description: 'the owning Change has no plan/planning Context Manifest' }
-      - { code: PLAN_CONTEXT_STALE, description: 'the plan/planning Context Manifest is stale or blocked' }
-      - { code: PLAN_ARTIFACT_PATH_UNSAFE, description: 'the Change artifact root, an ancestor, or a plan target is a symlink or escapes the physical project root' }
-      - { code: PLAN_PUBLISH_CONFLICT, description: 'plan.json or plan.md changed after publication preparation; concurrent bytes are preserved' }
-      - { code: PLAN_PUBLISH_FAILED, description: 'the journaled plan.json and plan.md publication could not complete and was rolled back' }
-      - { code: PLAN_RECOVERY_REQUIRED, description: 'an interrupted plan publication must be recovered before state mutation continues' }
-      - { code: ARTIFACT_AUTHORITY_CONFLICT, description: 'plan.json or plan.md already has another active registry authority' }
-      - { code: ARTIFACT_DIGEST_CONFLICT, description: 'the registered plan authority changed before publication' }
-      - { code: WRITE_FAILED, description: 'cannot write plan file' }
-    cli_subcommand: plan export
-    emits_events: [plan_exported]
-    trace_to: '§7.3, D34'
-
-  - name: plan.get
-    family: plan
-    description: Read a section of the owning Change's persisted plan.json artifact.
-    phase: '8a'
-    readonly: true
-    input_schema:
-      type: object
-      required: [change_id]
-      additionalProperties: false
-      properties:
-        change_id: { type: string, pattern: '^[a-zA-Z0-9_\-]+$' }
-        section: { type: string, enum: [tasks, topo, conflicts, all], default: all }
-    output_schema:
-      type: object
-      required: [plan]
-      additionalProperties: false
-      properties:
-        plan: { type: object }
-    errors:
-      - { code: NO_PLAN, description: 'no plan has been computed yet' }
-      - { code: CHANGE_NOT_FOUND, description: 'owning change does not exist' }
-      - { code: PLAN_CHANGE_MISMATCH, description: 'current plan artifact belongs to another change' }
-      - { code: PLAN_ARTIFACT_INVALID, description: 'plan.json is unsafe, malformed, stale, or does not match the current Change-owned registry authority' }
-    cli_subcommand: plan get
-    emits_events: []
-    trace_to: '§7.3, D34'