ultra-builder-pro-cli 0.24.0 → 0.24.1

package/mcp-server/lib/ultra-facade.cjs

@@ -45,6 +45,10 @@ const HARD_ERROR_CODES = new Set([
   'ARCHIVE_RUNTIME_UNAVAILABLE',
   'BACKUP_FAILED',
   'CHECKPOINT_DIGEST_MISMATCH',
+  'CHECKPOINT_EVIDENCE_AUTHORITY_MISSING',
+  'CHECKPOINT_EVIDENCE_DIGEST_MISMATCH',
+  'CHECKPOINT_SCOPE_MISMATCH',
+  'CHECKPOINT_SCOPE_NOT_FOUND',
   'CONTEXT_ENVELOPE_LIMIT_EXCEEDED',
   'CONTEXT_ENVELOPE_DIGEST_MISMATCH',
   'CONTEXT_ENVELOPE_FILE_DRIFT',
@@ -142,15 +146,49 @@ function diagnostic(error, severity = 'needs_attention') {
 
 function selectedScope(db, input = {}) {
   const scope = input.scope || {};
-  if (scope.task_id) {
-    const task = ops.readTask(db, scope.task_id);
-    if (!task) return { task_id: scope.task_id };
+  const task = scope.task_id ? ops.readTask(db, scope.task_id) : null;
+  if (scope.task_id && !task) {
+    throw Object.assign(
+      new Error(`checkpoint task scope does not exist: ${scope.task_id}`),
+      {
+        code: 'CHECKPOINT_SCOPE_NOT_FOUND',
+        details: { scope_type: 'task', scope_id: scope.task_id },
+      },
+    );
+  }
+  const changeId = scope.change_id || task?.change_id || null;
+  const change = changeId ? changes.readChange(db, changeId) : null;
+  if (changeId && !change) {
+    throw Object.assign(
+      new Error(`checkpoint Change scope does not exist: ${changeId}`),
+      {
+        code: 'CHECKPOINT_SCOPE_NOT_FOUND',
+        details: { scope_type: 'change', scope_id: changeId },
+      },
+    );
+  }
+  if (task && scope.change_id && task.change_id !== scope.change_id) {
+    throw Object.assign(
+      new Error(
+        `checkpoint task ${task.id} belongs to Change ${task.change_id || '(none)'}, not ${scope.change_id}`,
+      ),
+      {
+        code: 'CHECKPOINT_SCOPE_MISMATCH',
+        details: {
+          task_id: task.id,
+          task_change_id: task.change_id || null,
+          requested_change_id: scope.change_id,
+        },
+      },
+    );
+  }
+  if (task) {
     return {
-      change_id: scope.change_id || task.change_id || undefined,
+      ...(changeId ? { change_id: changeId } : {}),
       task_id: task.id,
     };
   }
-  if (scope.change_id) return { change_id: scope.change_id };
+  if (change) return { change_id: change.id };
   const baseline = baselines.readBaseline(db);
   return baseline ? { baseline_id: baseline.id } : { project_id: 'project' };
 }
@@ -184,12 +222,16 @@ function baselineRecord(db, action, data, rootDir) {
     const result = baselines.convergeBaseline(db, data, { rootDir });
     return {
       ...result,
-      diagnostics: result.ready
-        ? []
-        : (result.blockers || []).map((code) => ({
+      diagnostics: [
+        ...(result.blockers || []).map((code) => ({
           code,
           severity: 'needs_attention',
         })),
+        ...(result.warnings || []).map((code) => ({
+          code,
+          severity: 'warning',
+        })),
+      ],
     };
   }
   throw Object.assign(new Error(`unsupported baseline action: ${action}`), {
@@ -423,14 +465,17 @@ function checkpointDiagnostics(input, context) {
     }));
 }
 
-function stageReadinessDiagnostics(db, input, scope) {
+function stageAdvisoryDiagnostics(db, input, scope) {
   const payload = input.payload || {};
   const evidence = Array.isArray(payload.evidence) ? payload.evidence : [];
-  const needs = (code, message) => ({ code, severity: 'needs_attention', message });
+  const warning = (code, message) => ({ code, severity: 'warning', message });
   if (input.stage === 'research') {
     return evidence.length > 0
       ? []
-      : [needs('RESEARCH_EVIDENCE_REQUIRED', 'Research checkpoint requires at least one evidence reference.')];
+      : [warning(
+        'RESEARCH_EVIDENCE_MISSING',
+        'No research evidence was declared; the caller remains responsible for semantic sufficiency.',
+      )];
   }
   if (input.stage === 'dev') {
     const task = scope.task_id ? ops.readTask(db, scope.task_id) : null;
@@ -442,14 +487,14 @@ function stageReadinessDiagnostics(db, input, scope) {
       ).get(task.id)
       : null;
     const diagnostics = [];
-    if (!task) diagnostics.push(needs('TASK_NOT_FOUND', 'Dev checkpoint requires a task scope.'));
+    if (!task) diagnostics.push(warning('TASK_NOT_FOUND', 'No task scope was found for this Dev checkpoint.'));
     else if (task.status !== 'completed') {
-      diagnostics.push(needs('TASK_OUTCOME_INCOMPLETE', `Task ${task.id} is not completed.`));
+      diagnostics.push(warning('TASK_OUTCOME_INCOMPLETE', `Task ${task.id} is not completed.`));
     }
     if (task && !outcome) {
-      diagnostics.push(needs(
-        'WORKER_OUTCOME_REQUIRED',
-        `Task ${task.id} requires an artifact bound to its exact Worker Packet.`,
+      diagnostics.push(warning(
+        'WORKER_OUTCOME_MISSING',
+        `Task ${task.id} has no current Worker Packet outcome artifact.`,
       ));
     }
     return diagnostics;
@@ -457,22 +502,32 @@ function stageReadinessDiagnostics(db, input, scope) {
   if (input.stage === 'test') {
     const result = String(payload.result || '').toLowerCase();
     const diagnostics = [];
-    if (!['pass', 'known_red'].includes(result)) {
-      diagnostics.push(needs('TEST_RESULT_REQUIRED', 'Test checkpoint requires result=pass or known_red.'));
+    if (!result) {
+      diagnostics.push(warning('TEST_RESULT_MISSING', 'No test result was declared.'));
+    } else if (!['pass', 'known_red'].includes(result)) {
+      diagnostics.push(warning(
+        'TEST_RESULT_RECORDED',
+        `The caller recorded test result ${result}; MCP does not reinterpret it.`,
+      ));
     }
     if (evidence.length === 0) {
-      diagnostics.push(needs('TEST_EVIDENCE_REQUIRED', 'Test checkpoint requires evidence.'));
+      diagnostics.push(warning('TEST_EVIDENCE_MISSING', 'No test evidence was declared.'));
     }
     return diagnostics;
   }
   if (input.stage === 'review') {
     const verdict = String(payload.verdict || '').toLowerCase();
     const diagnostics = [];
-    if (!['approve', 'pass'].includes(verdict)) {
-      diagnostics.push(needs('REVIEW_VERDICT_REQUIRED', 'Review checkpoint requires an approved verdict.'));
+    if (!verdict) {
+      diagnostics.push(warning('REVIEW_VERDICT_MISSING', 'No review verdict was declared.'));
+    } else if (!['approve', 'pass'].includes(verdict)) {
+      diagnostics.push(warning(
+        'REVIEW_VERDICT_RECORDED',
+        `The caller recorded review verdict ${verdict}; MCP does not reinterpret it.`,
+      ));
     }
     if (evidence.length === 0) {
-      diagnostics.push(needs('REVIEW_EVIDENCE_REQUIRED', 'Review checkpoint requires evidence.'));
+      diagnostics.push(warning('REVIEW_EVIDENCE_MISSING', 'No review evidence was declared.'));
     }
     return diagnostics;
   }
@@ -485,23 +540,87 @@ function stageReadinessDiagnostics(db, input, scope) {
         { change_id: scope.change_id },
         { includeDraft: false },
       )) {
-        diagnostics.push(needs(
-          `${stage.toUpperCase()}_CHECKPOINT_REQUIRED`,
-          `Deliver checkpoint requires an accepted ${stage} checkpoint.`,
+        diagnostics.push(warning(
+          `${stage.toUpperCase()}_CHECKPOINT_MISSING`,
+          `No accepted ${stage} checkpoint was found; the caller owns the delivery decision.`,
         ));
       }
     }
     if (String(payload.summary || '').trim().length < 3) {
-      diagnostics.push(needs('DELIVERY_SUMMARY_REQUIRED', 'Deliver checkpoint requires a summary.'));
+      diagnostics.push(warning('DELIVERY_SUMMARY_MISSING', 'No durable delivery summary was declared.'));
     }
     if (evidence.length === 0) {
-      diagnostics.push(needs('DELIVERY_EVIDENCE_REQUIRED', 'Deliver checkpoint requires evidence.'));
+      diagnostics.push(warning('DELIVERY_EVIDENCE_MISSING', 'No delivery evidence was declared.'));
     }
     return diagnostics;
   }
   return [];
 }
 
+function normalizeCheckpointEvidence(db, input, rootDir) {
+  const evidence = Array.isArray(input.payload?.evidence) ? input.payload.evidence : [];
+  return evidence.map((item, index) => {
+    if (!item || typeof item !== 'object' || Array.isArray(item)) {
+      const error = new Error(`checkpoint evidence[${index}] must be an object`);
+      error.code = 'VALIDATION_ERROR';
+      throw error;
+    }
+    const normalized = { ...item };
+    let relative = typeof item.ref === 'string' ? item.ref.trim() : '';
+    let artifact = null;
+    if (item.artifact_id) {
+      try {
+        artifact = artifactRegistry.getArtifact(db, { id: String(item.artifact_id) });
+      } catch (error) {
+        if (error?.code !== 'ARTIFACT_NOT_FOUND') throw error;
+      }
+      if (!artifact || artifact.status !== 'current') {
+        const error = new Error(`checkpoint evidence artifact is not current: ${item.artifact_id}`);
+        error.code = 'CHECKPOINT_EVIDENCE_AUTHORITY_MISSING';
+        throw error;
+      }
+      if (relative && artifact.path !== relative) {
+        const error = new Error(`checkpoint evidence path does not match artifact ${item.artifact_id}`);
+        error.code = 'CHECKPOINT_EVIDENCE_AUTHORITY_MISSING';
+        throw error;
+      }
+      relative = artifact.path;
+      normalized.artifact_id = artifact.id;
+      if (item.digest && String(item.digest) !== artifact.digest) {
+        const error = new Error(
+          `checkpoint evidence digest contradicts artifact ${item.artifact_id}`,
+        );
+        error.code = 'CHECKPOINT_EVIDENCE_DIGEST_MISMATCH';
+        error.details = {
+          path: relative,
+          expected: artifact.digest,
+          actual: String(item.digest),
+        };
+        throw error;
+      }
+    }
+    if (!item.digest && !item.artifact_id) return normalized;
+    if (!relative) {
+      const error = new Error(`checkpoint evidence[${index}] requires ref when digest is supplied`);
+      error.code = 'VALIDATION_ERROR';
+      throw error;
+    }
+    const read = readStableProjectFile(rootDir, relative);
+    const expected = item.artifact_id
+      ? artifact.digest
+      : String(item.digest);
+    if (read.digest !== expected) {
+      const error = new Error(`checkpoint evidence digest mismatch: ${relative}`);
+      error.code = 'CHECKPOINT_EVIDENCE_DIGEST_MISMATCH';
+      error.details = { path: relative, expected, actual: read.digest };
+      throw error;
+    }
+    normalized.ref = relative;
+    normalized.digest = read.digest;
+    return normalized;
+  });
+}
+
 async function checkpoint(db, input = {}, {
   rootDir = process.cwd(),
   runtime = 'unknown',
@@ -517,14 +636,22 @@ async function checkpoint(db, input = {}, {
     scope,
     detail: 'summary',
   }, { rootDir, runtime });
+  const evidence = normalizeCheckpointEvidence(db, input, rootDir);
   const diagnostics = [
     ...checkpointDiagnostics(input, view),
-    ...stageReadinessDiagnostics(db, input, scope),
+    ...stageAdvisoryDiagnostics(db, input, scope),
+    ...evidence
+      .filter((item) => !item.digest && !item.artifact_id)
+      .map((item, index) => ({
+        code: 'CHECKPOINT_EVIDENCE_UNBOUND',
+        severity: 'warning',
+        message: `Evidence declaration ${item.ref || item.kind || index} has no current digest or managed artifact binding.`,
+      })),
   ];
   let result = null;
 
   if (input.stage === 'plan'
-      && !diagnostics.some((item) => item.severity !== 'warning')) {
+      && !diagnostics.some((item) => item.severity === 'hard_conflict')) {
     try {
       result = planCheckpoint.publishPlan(db, {
         change_id: scope.change_id,
@@ -532,7 +659,7 @@ async function checkpoint(db, input = {}, {
       }, { rootDir, markRecoveryRequired: markPlanRecoveryRequired });
     } catch (error) {
       if (isHardError(error)) throw error;
-      diagnostics.push(diagnostic(error));
+      diagnostics.push(diagnostic(error, 'hard_conflict'));
     }
   }
 
@@ -548,12 +675,12 @@ async function checkpoint(db, input = {}, {
     payload: input.stage === 'plan' && result
       ? { ...(input.payload || {}), plan: result }
       : (input.payload || {}),
-    evidence: Array.isArray(input.payload?.evidence) ? input.payload.evidence : [],
+    evidence,
     diagnostics,
     context_envelope_id: context.id,
     idempotency_key: `${input.idempotency_key}:draft`,
   });
-  if (diagnostics.some((item) => item.severity !== 'warning')) {
+  if (diagnostics.some((item) => item.severity === 'hard_conflict')) {
     return {
       accepted: false,
       mutable: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra-builder-pro-cli",
-  "version": "0.24.0",
+  "version": "0.24.1",
   "description": "Explicitly invoked Ultra Builder Pro workflows for Claude Code, OpenCode, Codex CLI, Kimi Code, and Grok Build, with a project-local MCP persistence and safety kernel.",
   "bin": {
     "ultra-builder-pro-cli": "bin/install.js",

package/skills/ultra-change/SKILL.md

@@ -39,7 +39,8 @@ manufacturing a mutation.
 
 Changing accepted intent creates a new accepted checkpoint revision and makes only
 genuinely dependent evidence stale. Readiness is derived, not a stored absorbing
-state. A semantic rejection returns diagnostics; repair and retry the same draft.
+state. Semantic diagnostics remain advisory; structural, digest, path, or concurrency
+conflicts require repair and retry of the same draft.
 Use `change_contract / cancel` only when the owner intentionally abandons the Change.
 
 Publish the durable Change contract with `ultra.sync { action: publish }` when it is a

package/skills/ultra-deliver/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ultra-deliver
-description: Converge a verified Ultra Change, reconcile baseline specifications, and archive it with recoverable local evidence. Use when implementation, testing, and review are current.
+description: Reconcile and archive an explicitly accepted Ultra Change with recoverable local evidence. Use when the caller is ready to make a local delivery handoff with current managed evidence and an explicit rationale for any omitted capability.
 ---
 
 # Converge and archive local authority
@@ -12,8 +12,10 @@ publication, deployment, or another external effect.
 
 1. Call `ultra.context { stage: deliver, scope: { change_id }, detail: full }`.
 2. Import a newer team checkpoint with `ultra.sync`; stop on a real conflict.
-3. Require current task outcomes, test report, both review axes, accepted decisions,
-   typed delta, documentation reconciliation, and current checkout evidence.
+3. Inspect current task outcomes, tests, both review axes, accepted decisions, typed
+   delta, documentation reconciliation, and checkout evidence. Decide whether the
+   actual Change is sufficiently complete; explicitly record any omitted stage and its
+   evidence-based rationale instead of inventing a fixed recipe.
 4. Resolve every specification-learning candidate. Keep updates inside the Change
    overlay until archive.
 5. Write and register documentation reconciliation and an
@@ -27,20 +29,16 @@ Use one typed `ultra.record` batch for `artifact / bind`, any normalized
 ## Archive once
 
 Call `ultra.archive` once with the Change id, stable idempotency key, archive summary,
-reconciliation fields, delivery evidence steps, and report output. The operation
-internally:
-
-- compiles or reuses convergence context;
-- checks the deliver draft;
-- derives convergence from current dev, test, review, delta, docs, and checkout;
-- applies the overlay and archive through the recoverable filesystem/DB transaction;
-- rebinds registered artifacts into a self-contained archive;
-- accepts one immutable delivery checkpoint revision;
-- publishes the updated team checkpoint.
-
-A semantic rejection returns mutable blockers. Repair the same packet and retry. A
-hard corruption, path, concurrency, or recovery error remains fail-closed and routes to
-`ultra-doctor`.
+reconciliation fields, delivery evidence steps, explicit omissions, and report output.
+The model's report is the semantic handoff. MCP validates its current registered
+authority, paths, digests, reconciliation structure, and idempotency; applies the
+overlay and archive through the recoverable filesystem/DB transaction; rebinds
+registered artifacts into a self-contained archive; and publishes the updated team
+checkpoint. It does not require a hard-coded Plan/Dev/Test/Review/Deliver sequence.
+
+Semantic warnings remain in the archive history but do not reject an explicit local
+handoff. Corruption, unsafe paths, digest/CAS conflicts, permissions, or recovery
+failure remain fail-closed and route to `ultra-doctor`.
 
 Verify the archived packet, baseline, checkpoint, and rollback state. Handle any
 separately authorized Git or release effect only after local delivery and report it as

package/skills/ultra-dev/SKILL.md

@@ -45,7 +45,9 @@ Fix blocking findings and refresh affected evidence.
 
 Call `ultra.checkpoint` once with `stage: dev`, the exact Change/Task scope, evidence,
 and stable idempotency key. It binds the exact Context Envelope and Worker Packet and
-reports outcome diagnostics. A rejection leaves the draft mutable.
+reports outcome diagnostics. The model decides whether the implemented slice satisfies
+the Task; semantic warnings remain visible. A rejection means the declared authority,
+path, digest, or concurrency boundary was unsafe and leaves the draft mutable.
 
 After acceptance, mark the task durably completed, publish with `ultra.sync`, and
 create at most one authorized local task commit containing code and semantic

package/skills/ultra-doctor/SKILL.md

@@ -19,8 +19,8 @@ Call `ultra.doctor { repair: false }` and inspect:
 - projection jobs, sessions, leases, worktrees, and recovery journals;
 - installed plugin assets, MCP startup, and hook paths.
 
-An expected workflow pause, editable draft, failed semantic checkpoint, or awaiting
-owner decision is a warning, not corruption.
+An expected workflow pause, editable draft, semantic warning, or awaiting owner
+decision is not corruption.
 
 ## Repair
 

package/skills/ultra-init/references/brownfield-adoption.md

@@ -52,17 +52,20 @@ baseline is ready.
 Record every adoption gap with a stable id, evidence references, owner, blocking flag,
 and one category:
 
-- `baseline_blocker`: prevents trustworthy adoption;
+- `baseline_blocker`: the model should recommend against adoption until resolved or
+  the owner explicitly accepts the recorded risk;
 - `documentation_drift`: maintained prose conflicts with observed behavior;
 - `known_defect`: reproducible incorrect behavior;
 - `technical_debt`: accepted maintainability or quality cost;
 - `unknown`: evidence is insufficient;
 - `future_change`: desired behavior outside the current baseline.
 
-Use `open` for unresolved gaps, `accepted` for owner-accepted non-blocking debt,
+Use `open` for unresolved gaps, `accepted` for owner-accepted debt,
 `resolved` when evidence closes the gap, and `deferred` for explicitly postponed
-non-blocking work. Every open `baseline_blocker` remains blocking. Do not convert the
-ledger into hundreds of application tasks.
+work. Keep every open `baseline_blocker` visible as a semantic warning. It does not
+become a SQLite hard gate: the model explains the risk, recommends resolution, and may
+record owner-authorized adoption without erasing the gap. Do not convert the ledger
+into hundreds of application tasks.
 
 ## Record authority
 
@@ -88,9 +91,9 @@ worktree state, and material decisions to the owner. Use `ultra.record` with
 `accept_known_red` and `accept_dirty_worktree` only for the exact items the owner
 accepted.
 
-Resolve returned blockers through evidence or an owner decision, record the replacement
-snapshot, and retry. Adoption is complete only when `ultra.context` reports a current
-accepted baseline, the gap ledger has no open blocker, and project doctor has no
-authority failure. Route all selected work through `ultra-change`, including work
-described by a legacy plan. Import its accepted intent into a current Change Contract
-before planning.
+Resolve hard authority blockers, then present semantic warnings for evidence or an
+owner decision. Adoption is complete when `ultra.context` reports a current accepted
+baseline, every material open gap is visible with its owner/risk and any acceptance is
+explicit in the approval note, and project doctor has no mechanical authority failure.
+Route all selected work through `ultra-change`, including work described by a legacy
+plan. Import its accepted intent into a current Change Contract before planning.

package/skills/ultra-plan/SKILL.md

@@ -48,14 +48,16 @@ payload: planning posture, optional approval already obtained, context budget/re
 idempotency_key: stable semantic Plan checkpoint id
 ```
 
-The checkpoint compiles or reuses the content-addressed Context Envelope, derives
-coverage diagnostics, exports `plan.json` and `plan.md` inside the same recoverable
-publication, accepts one Plan revision, and publishes the team checkpoint. Do not
-export separately.
-
-If rejected, the same Plan draft stays mutable. Fix task contracts or evidence and
-retry. To replace an accepted Plan, submit a new checkpoint revision; never edit
-SQLite or open a parallel run to escape a diagnostic.
+The model decides whether decomposition, acceptance coverage, and context are
+sufficient and records any deliberate omission. The checkpoint compiles or reuses the
+content-addressed Context Envelope, reports advisory coverage diagnostics, exports
+`plan.json` and `plan.md` inside the same recoverable publication, accepts one Plan
+revision, and publishes the team checkpoint. Do not export separately.
+
+If rejected, the same Plan draft stays mutable. Fix only the reported structural,
+digest, path, or concurrency conflict and retry. To replace an accepted Plan, submit a
+new checkpoint revision; never edit SQLite or open a parallel run to escape a
+diagnostic.
 
 Return topology, executable slices, public seams, exact checks, checkpoint result, and
 the model's recommended execution order. Do not invoke `ultra-dev` automatically.

package/skills/ultra-research/SKILL.md

@@ -41,8 +41,9 @@ Use one `ultra.record` batch for typed durable facts:
 - `baseline / observe` or `baseline / accept` for baseline authority;
 - `change_contract / revise` for Change-bound findings.
 
-Every entry needs a stable idempotency key. A semantic rejection is a mutable
-diagnostic: correct the same draft and retry.
+Every entry needs a stable idempotency key. Structural or authority conflicts require
+repair; semantic warnings remain visible but do not decide whether the research is
+sufficient.
 
 ## Commit one research checkpoint
 
@@ -56,8 +57,11 @@ entries, then publish the team checkpoint with `ultra.sync { action: publish }`.
 For Change-bound research, keep all findings and delta artifacts below the Change
 root and never edit accepted baseline specs directly.
 
-If the checkpoint returns `accepted: false`, keep the same draft mutable, repair the
-reported evidence, and retry. Do not manufacture evidence or open a replacement run.
+The model decides whether the selected coverage and synthesis are sufficient, and
+states omissions or deferred areas in the payload. MCP validates declared evidence
+bytes and records that conclusion; its semantic diagnostics are advisory. If it
+returns `accepted: false`, repair the reported structural, digest, path, or concurrency
+conflict and retry the same draft.
 
 Return coverage, decisive evidence, remaining gaps, durable artifact paths, and a
 model recommendation for the next explicit capability, such as `ultra-change` after a

package/skills/ultra-review/SKILL.md

@@ -34,11 +34,13 @@ Register specialist and summary artifacts through one `ultra.record` batch using
 ## Checkpoint
 
 Call `ultra.checkpoint` once with `stage: review`, exact scope, evidence, and outputs
-tagged `spec_review`, `engineering_review`, or summary. The checkpoint compiles or
-reuses review context and derives both axes from registered artifacts.
+tagged `spec_review`, `engineering_review`, or summary. The model and bounded review
+agents own both evidence-derived axes. The checkpoint compiles or reuses review
+context, verifies declared artifact bytes and digests, and records the supplied axes
+without overriding findings.
 
-A rejected checkpoint leaves the draft mutable. Fix stale scope or evidence and retry;
-do not open a replacement run or suppress a finding.
+A rejected checkpoint leaves the draft mutable. Fix the structural, digest, path, or
+concurrency fault and retry; do not open a replacement run or suppress a finding.
 
 Return both axes, findings, reviewed scope, worker rationale, digests, and the model's
 recommended next explicit capability. Do not invoke it automatically.

package/skills/ultra-test/SKILL.md

@@ -30,11 +30,13 @@ profile, timestamp, blockers, and evidence-derived verdict. Register it with
 ## Checkpoint
 
 Call `ultra.checkpoint` once with `stage: test`, exact scope, evidence, and an output
-for the report (`kind: test-report`). The checkpoint compiles or reuses checking
-context and derives the verdict from the registered report.
+for the report (`kind: test-report`). The model owns the evidence-derived verdict and
+material exclusions. The checkpoint compiles or reuses checking context, verifies the
+declared report authority and digest, and records that verdict without re-judging it.
 
-If rejected, keep the same draft, repair evidence, and retry. Never weaken an
-assertion, hide a skip, or turn a warning into proof.
+If rejected, keep the same draft and repair the structural, digest, path, or
+concurrency fault. Never weaken an assertion, hide a skip, or turn a warning into
+proof.
 
 Return the profile, exact results, verified seams, blockers, report digest, and the
 model's recommended next explicit capability. Do not invoke it automatically.

package/skills/ultra-think/SKILL.md

@@ -30,8 +30,9 @@ Use one `ultra.record` batch with `decision / accept` and, when required,
 `supersedes_id`; accepted records remain immutable history. Store normalized decisions
 and artifact references, never transcripts or internal reasoning.
 
-A semantic rejection remains a mutable diagnostic. Correct the record; do not invent a
-new decision merely to satisfy a state machine.
+A structural or authority rejection remains a mutable diagnostic. Correct the record;
+do not invent a new decision merely to satisfy a state machine. Semantic disagreement
+belongs in the recommendation and visible decision record, not a kernel error.
 
 Return the conclusion, decisive evidence, uncertainty, affected authority, and the
 model's recommended next explicit capability. Thinking never performs unrelated

package/spec/mcp-tools.yaml

@@ -100,7 +100,7 @@ tools:
 
   - name: ultra.checkpoint
     family: ultra
-    description: Attempt one semantic stage checkpoint. Failed semantic checks return blockers and leave the draft mutable; accepted checkpoints commit durable authority once.
+    description: Commit one caller-declared stage checkpoint after validating scope, structure, idempotency, current file bytes, digests, and transactional publication. Semantic completeness remains a Skill/model judgment and is returned only as advisory diagnostics.
     phase: '24'
     writer_role: mcp
     input_schema:
@@ -122,6 +122,10 @@ tools:
       - { code: VALIDATION_ERROR, description: 'input failed structural validation' }
       - { code: STATE_CORRUPT, description: 'local authority cannot be checkpointed safely' }
       - { code: PATH_AUTHORITY_VIOLATION, description: 'checkpoint evidence escapes managed authority' }
+      - { code: CHECKPOINT_EVIDENCE_AUTHORITY_MISSING, description: 'declared checkpoint evidence is not current managed authority' }
+      - { code: CHECKPOINT_EVIDENCE_DIGEST_MISMATCH, description: 'declared checkpoint evidence bytes changed' }
+      - { code: CHECKPOINT_SCOPE_NOT_FOUND, description: 'the explicit Task or Change scope does not exist' }
+      - { code: CHECKPOINT_SCOPE_MISMATCH, description: 'the explicit Task does not belong to the supplied Change scope' }
     cli_subcommand: 'ultra checkpoint'
     emits_events: [ultra_checkpoint_accepted, ultra_checkpoint_rejected]
 
@@ -168,7 +172,7 @@ tools:
 
   - name: ultra.archive
     family: ultra
-    description: Converge and archive one accepted Change through the recoverable filesystem and database transaction boundary.
+    description: Archive one caller-declared local Change handoff through a recoverable filesystem and database transaction. The kernel validates authority, paths, digests, reconciliation structure, and recovery safety without requiring a fixed semantic stage sequence.
     phase: '24'
     writer_role: mcp
     input_schema: