ultra-builder-pro-cli 0.24.1 → 0.25.0

package/adapters/opencode.js

@@ -6,6 +6,8 @@ const fs = require('node:fs');
 const crypto = require('node:crypto');
 const os = require('node:os');
 const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { isDeepStrictEqual } = require('node:util');
 
 const {
   copyTree,
@@ -64,6 +66,79 @@ function resolveRepoRoot(ctx = {}) {
   return ctx.repoRoot || path.resolve(__dirname, '..');
 }
 
+function shouldRunHostCli(ctx = {}) {
+  if (typeof ctx.runHostCli === 'boolean') return ctx.runHostCli;
+  return ctx.scope === 'global' && !ctx.configDir;
+}
+
+function runOpenCodeCli(args, ctx = {}) {
+  const target = resolveTarget(ctx);
+  const result = spawnSync(ctx.opencodeBin || 'opencode', args, {
+    cwd: ctx.cwd || process.cwd(),
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    killSignal: 'SIGKILL',
+    env: {
+      ...process.env,
+      OPENCODE_CONFIG_DIR: target,
+    },
+    timeout: ctx.hostCliTimeoutMs || 30000,
+  });
+  if (result.error) {
+    if (result.error.code === 'ETIMEDOUT') {
+      const error = new Error(`opencode ${args.join(' ')} timed out`);
+      error.code = 'HOST_CLI_TIMEOUT';
+      throw error;
+    }
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    const detail = (result.stderr || result.stdout || '').trim();
+    throw new Error(`opencode ${args.join(' ')} failed${detail ? `: ${detail}` : ''}`);
+  }
+  return result.stdout;
+}
+
+function openCodeMcpRow(output, serverName) {
+  for (const rawLine of output.split(/\r?\n/)) {
+    const tokens = rawLine.trim().split(/\s+/);
+    if (tokens.some((token) => token === serverName)) return rawLine;
+  }
+  return '';
+}
+
+function inspectOpenCodeHost(ctx = {}) {
+  const target = resolveTarget(ctx);
+  const expectedLauncher = path.join(target, BUNDLE_DIR, 'runtime', 'launch.cjs');
+  const expected = managedMcpEntry(target);
+  const config = JSON.parse(runOpenCodeCli(['debug', 'config'], ctx));
+  const entry = config?.mcp?.[MCP_SERVER_NAME];
+  const configOk = isDeepStrictEqual(entry, expected);
+  const mcpOutput = runOpenCodeCli(['mcp', 'list'], ctx)
+    .replace(/\u001b\[[0-9;]*m/g, '');
+  const mcpLine = openCodeMcpRow(mcpOutput, MCP_SERVER_NAME);
+  const mcpOk = /\bconnected\b/i.test(mcpLine);
+  return { config, configOk, mcpOutput, mcpOk };
+}
+
+function managedMcpEntry(target) {
+  const command = mcpCommand(path.join(target, BUNDLE_DIR, 'runtime', 'launch.cjs'));
+  return {
+    type: 'local',
+    enabled: true,
+    command: [command.command, ...command.args],
+  };
+}
+
+function hasManagedMcpIdentity(entry, target) {
+  return Boolean(
+    entry
+    && typeof entry === 'object'
+    && !Array.isArray(entry)
+    && isDeepStrictEqual(entry.command, managedMcpEntry(target).command),
+  );
+}
+
 function lowercaseFrontmatterTransform(buf, relPath) {
   if (!relPath.endsWith('.md')) return buf;
   const text = buf.toString('utf8');
@@ -550,12 +625,7 @@ function buildStaging(repoRoot, staging, target) {
   const configFile = path.join(target, 'opencode.json');
   const existing = readJsonSafe(configFile, { rescue: true });
   const mcp = { ...(existing.mcp || {}) };
-  const command = mcpCommand(path.join(target, BUNDLE_DIR, 'runtime', 'launch.cjs'));
-  mcp[MCP_SERVER_NAME] = {
-    type: 'local',
-    enabled: true,
-    command: [command.command, ...command.args],
-  };
+  mcp[MCP_SERVER_NAME] = managedMcpEntry(target);
   const next = { ...existing, mcp };
   delete next[LEGACY_SENTINEL_KEY];
   writeAtomic(path.join(staging, 'opencode.json'), JSON.stringify(next, null, 2) + '\n');
@@ -720,12 +790,45 @@ function doctor(ctx = {}) {
     });
   }
   report.checks.registration = { status: registrationOk ? 'pass' : 'fail' };
+  if (shouldRunHostCli(ctx)) {
+    try {
+      const host = inspectOpenCodeHost(ctx);
+      report.checks.host_config = { status: host.configOk ? 'pass' : 'fail' };
+      report.checks.host_mcp = { status: host.mcpOk ? 'pass' : 'fail' };
+      if (!host.configOk) {
+        report.issues.push({
+          code: 'HOST_CONFIG_NOT_CONSUMED',
+          path: configFile,
+        });
+      }
+      if (!host.mcpOk) {
+        report.issues.push({
+          code: 'HOST_MCP_NOT_CONNECTED',
+          server: MCP_SERVER_NAME,
+        });
+      }
+    } catch (error) {
+      report.checks.host_config = { status: 'fail' };
+      report.checks.host_mcp = { status: 'fail' };
+      report.issues.push({
+        code: error.code === 'HOST_CLI_TIMEOUT'
+          ? 'HOST_CLI_TIMEOUT'
+          : 'HOST_CLI_INSPECTION_FAILED',
+        message: error.message,
+      });
+    }
+  }
   return applyNativeDoctor(report, path.join(target, BUNDLE_DIR, 'runtime'));
 }
 
 function uninstall(ctx = {}) {
   const target = resolveTarget(ctx);
-  const report = { target, removed: {}, config: { updated: false } };
+  const report = {
+    target,
+    removed: {},
+    config: { updated: false },
+    issues: [],
+  };
   const pluginFile = path.join(target, 'plugins', 'ultra-builder-pro.js');
   const bundleRoot = path.join(target, BUNDLE_DIR);
   const pluginOwned = fs.existsSync(pluginFile)
@@ -734,14 +837,31 @@ function uninstall(ctx = {}) {
   const configFile = path.join(target, 'opencode.json');
   if (fs.existsSync(configFile)) {
     const existing = readJsonSafe(configFile);
-    if (pluginOwned || bundleOwned || existing[LEGACY_SENTINEL_KEY]) {
+    const currentMcp = existing.mcp?.[MCP_SERVER_NAME];
+    const expectedMcp = managedMcpEntry(target);
+    const mcpOwned = hasManagedMcpIdentity(currentMcp, target);
+    if (currentMcp !== undefined && !mcpOwned) {
+      report.config.skipped = true;
+      report.config.reason = 'ownership-conflict';
+      report.issues.push({
+        code: 'MCP_OWNERSHIP_CONFLICT',
+        path: configFile,
+        server: MCP_SERVER_NAME,
+        expected: expectedMcp,
+        actual: currentMcp,
+      });
+      return report;
+    }
+    if (mcpOwned || existing[LEGACY_SENTINEL_KEY]) {
       const mcp = { ...(existing.mcp || {}) };
-      delete mcp[MCP_SERVER_NAME];
+      if (mcpOwned) delete mcp[MCP_SERVER_NAME];
       const next = { ...existing, mcp };
       delete next[LEGACY_SENTINEL_KEY];
       if (Object.keys(next.mcp || {}).length === 0) delete next.mcp;
-      writeAtomic(configFile, JSON.stringify(next, null, 2) + '\n');
-      report.config.updated = true;
+      if (!isDeepStrictEqual(next, existing)) {
+        writeAtomic(configFile, JSON.stringify(next, null, 2) + '\n');
+        report.config.updated = true;
+      }
     }
   }
   if (pluginOwned) {
@@ -792,6 +912,7 @@ module.exports = {
   SOURCE_TAG,
   BUNDLE_DIR,
   pluginSource,
+  inspectOpenCodeHost,
   resolveTarget,
   install,
   uninstall,

package/agents/code-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: code-reviewer
 description: Review an explicit diff or file set for consequential correctness, security, integration, test, and maintainability defects. Use for a bounded read-only review before commit, merge, or release.
-tools: Read, Grep, Glob, Bash, Write, Edit
+tools: Read, Grep, Glob, Bash, Write
 model: opus
 maxTurns: 30
 skills:
@@ -34,10 +34,9 @@ evidence. Default to read-only analysis.
 
 ## Mutation boundary
 
-Do not edit during an ordinary review. If the parent explicitly assigns review and
-fix, modify only findings within the accepted scope, preserve unrelated changes, and
-rerun the checks invalidated by each edit. Judgment-heavy or scope-expanding fixes
-return to the primary agent for a decision.
+Do not edit source. Write only the assigned evidence artifact. If remediation is
+authorized, return the smallest verified repair instructions to the primary host,
+which owns implementation and final judgment.
 
 Use the current checkout and parent-supplied packet only. Do not call Ultra MCP write
 tools. Return a concise review, not raw tool output.

package/agents/debugger.md

@@ -1,7 +1,7 @@
 ---
 name: debugger
-description: Find the earliest incorrect state behind an error, test failure, or unexpected behavior and return a minimal verified fix when implementation is authorized.
-tools: Read, Write, Edit, Bash, Grep, Glob
+description: Find the earliest incorrect state behind an error, test failure, or unexpected behavior and return bounded evidence plus a minimal verified remediation.
+tools: Read, Write, Bash, Grep, Glob
 model: opus
 maxTurns: 40
 ---
@@ -24,14 +24,14 @@ that violates the intended contract.
    distinguishes it from alternatives.
 5. Test the hypothesis without broad refactoring. Record evidence that accepts or
    rejects it.
-6. If implementation is authorized, write a regression test that fails for the
-   observed defect, apply the minimum root-cause fix, and rerun focused and adjacent
-   checks.
-7. Report the symptom, evidence trail, root cause, changed files when any, exact
+6. Describe the smallest regression test and root-cause repair that the primary host
+   should apply. Do not edit source.
+7. Report the symptom, evidence trail, root cause, proposed files, exact diagnostic
    verification, and residual uncertainty.
 
-Do not change code when the assignment is diagnosis-only. Do not use a passing test
-from another checkout as evidence.
+Write only the assigned evidence artifact. Do not change source, even when remediation
+is authorized; the primary host owns implementation and final judgment. Do not use a
+passing test from another checkout as evidence.
 
 If three distinct fix attempts expose different underlying failures, stop patching and
 return the evidence as an architectural boundary problem. For an Ultra incident, also

package/docs/AGENT-CONTEXT.md

@@ -11,7 +11,7 @@ Ultra owns:
   `ultra-change`, `ultra-plan`, `ultra-dev`, `ultra-test`, `ultra-review`,
   `ultra-deliver`, `ultra-status`, and `ultra-doctor`;
 - four internal worker-rule Skills;
-- bounded review/debug workers;
+- bounded evidence-only review/debug workers;
 - deterministic workflow Hooks;
 - exactly seven public MCP tools;
 - `.ultra` project authority, team sync, recovery, and the portable installer.
@@ -52,6 +52,26 @@ diagnostics and leaves the draft editable. Hard errors are limited to corruption
 unsafe paths, digest/CAS/lease conflicts, missing runtime prerequisites, permissions,
 and irreversible external effects.
 
+A rejected semantic attempt is appended as `ultra_kernel_attempt` audit history and
+appears alongside the next `ultra.context` envelope without changing its semantic
+digest. It never creates the rejected semantic row or claims that authority was
+committed. `_ultra.projection_commit` reports only the post-call generated-view cycle;
+it is not a semantic acceptance receipt.
+
+Every public input has one exact kind/action contract. Unknown fields, wrong scalar or
+container types, invalid enums, malformed digests, and mismatched scopes are diagnosed
+before SQLite affinity, filesystem writers, or host adapters can coerce them. A
+correctable rejection returns `accepted: false`, `mutable: true`, typed diagnostics,
+and bounded audit history; it is not an MCP transport failure. Reusing an idempotency
+key for a different request follows that same repairable path, while retrying the exact
+request returns the original result.
+
+Every accepted mutation and its idempotency receipt are one logical commit. DB-only
+writes share one immediate transaction. A write that also owns a managed file, team
+checkpoint, worktree, Worker Packet, or archive journal either publishes both sides or
+restores the prior bytes and rows. If compensation itself cannot be proven, the kernel
+returns a typed recovery requirement instead of reporting partial success.
+
 ## Context Envelope
 
 Every Skill begins by reading `ultra.context` for the relevant stage and scope. The
@@ -121,9 +141,10 @@ The packet binds:
 - exact output path;
 - `packet_digest`.
 
-Workers may inspect and write only the declared output. They do not write SQLite,
-accept checkpoints, modify another worker's result, or decide final delivery. Output
-must echo `packet_digest`; the primary host verifies and records it.
+Workers may inspect the assigned checkout and write only the declared evidence output.
+They do not edit source, write SQLite, accept checkpoints, modify another worker's
+result, or decide final delivery. Output must echo `packet_digest`; the primary host
+verifies it, performs any source repair, and records the resulting evidence.
 
 ## Hook boundary
 
@@ -163,3 +184,8 @@ state.
 
 Every semantic file must have one writer, owner, consumer, digest, promotion gate, and
 archive rule as defined in `ARTIFACT-AUTHORITY.md`.
+
+The production Change API has one Kernel behavior and exposes no legacy/current mode
+switch. Pre-v0.24 workflow and dialogue rows remain read-only migration/audit history:
+the public kernel cannot create workflow-owned artifacts or mutate those rows during
+current invalidation.

package/docs/ARCHITECTURE.md

@@ -43,7 +43,8 @@ There is no second semantic authority:
 - MCP owns structure validation, idempotency, digests, CAS, leases, safe paths,
   filesystem journals, recovery, and accepted checkpoints.
 - Hooks own deterministic observation and bounded injection only.
-- Agents receive one immutable Worker Packet and write only the declared output.
+- Agents receive one immutable Worker Packet and write only the declared evidence
+  output; the primary host owns every source change and final judgment.
 
 SQLite never chooses the next capability and never requires a fixed sequence of
 reasoning steps. Semantic gaps appear in `diagnostics`, `warnings`, or
@@ -66,9 +67,11 @@ Every host discovers exactly seven tools:
 | `ultra.doctor` | Mechanical diagnosis and backup-first repair |
 
 Retired fine-grained tool names are not registered and return `UNKNOWN_TOOL`. The
-source repository retains migration readers and regression fixtures for old authority,
-but those modules are excluded from the npm distribution and have no live public
-consumer.
+source repository retains migration readers, an explicitly named internal Change
+compatibility implementation, and regression fixtures for old authority. The
+production Change facade exposes one Kernel behavior with no mode flag; retired
+semantic supervisors are excluded from the npm distribution and no public call can
+write their workflow/dialogue authority.
 
 ## Canonical Context Envelope
 
@@ -130,6 +133,20 @@ Every delegated worker receives a digest-bound packet containing the exact Conte
 Envelope, accepted decisions, Git boundary, Task contract, acceptance, evidence
 references, output path, and output schema. The worker must echo `packet_digest`.
 Workers do not write SQLite or accept their own result.
+Review and debug workers do not edit source; their only mutation is the assigned
+evidence artifact, and the primary host applies any accepted remediation.
+
+### Rejected attempts and projection metadata
+
+Semantic diagnostics do not disappear when a caller corrects and retries. A rejected
+public call appends an `ultra_kernel_attempt` event containing the typed operation,
+scope, idempotency key, blockers, and diagnostics without storing raw prompts or
+creating the rejected semantic row. `ultra.context` exposes a bounded recent view of
+that audit history alongside, but outside the digest-bound semantic envelope.
+
+Server metadata uses `_ultra.projection_commit` only for the deterministic
+post-mutation projection job. It must never be interpreted as proof that a semantic
+record, checkpoint, or archive was accepted.
 
 ## `.ultra` storage planes
 
@@ -210,7 +227,9 @@ Contexts, and v0.22/v0.23 database and ledger authority.
 Migration is inspectable, exact-byte backup-first, transactional, and fail-closed on
 conflict. Old workflow and dialogue rows are retained as non-authoritative history;
 current Context, Decisions, Checkpoints, and the team ledger are rebuilt from verified
-facts. No user should edit SQLite or move a legacy file manually to recover.
+facts. Current artifact invalidation may traverse legacy graph edges to reach a live
+Task, but it never rewrites the legacy workflow row. No user should edit SQLite or move
+a legacy file manually to recover.
 
 ## External boundaries
 

package/docs/ARTIFACT-AUTHORITY.md

@@ -88,6 +88,19 @@ durable effects, typed applied references, Stage Checkpoint evidence, artifact h
 verification commands and results, provenance, events, and recovery state. It must not
 include chain-of-thought, UI-click proof, raw prompts, or conversation transcripts.
 
+Public kernel inputs are exact at their owning kind/action boundary. SQLite constraints
+remain defense in depth, not the first definition of a business vocabulary: wrong
+types, unsupported enums, unknown fields, malformed references, and invalid digests
+are rejected as typed mutable diagnostics before any row or file write. The rejected
+attempt is retained as audit evidence but never becomes semantic authority.
+
+An accepted mutation and its durable idempotency receipt form one logical transaction.
+DB-only operations commit them together. Operations that also publish managed files,
+the Git team checkpoint, a Session worktree/Worker Packet, or an archive packet use a
+recoverable journal or verified compensation. Failure restores the exact prior file
+bytes, rows, ledger generation, lease, packet, and worktree where applicable; an
+unprovable rollback becomes an explicit recovery condition rather than false success.
+
 Verified conclusions from `.ultra/.runtime/collab/` or other scratch locations must be promoted
 into the invoking DB-bound workflow artifact or report. Keeping a file in the scratch
 directory is not promotion.

package/docs/COMMIT-HASH-BACKFILL.md

@@ -11,27 +11,34 @@ longer changes any tracked file.
 
 After implementation, verification, and review are current:
 
-1. Update the task to `completed`. The MCP publishes its durable status and contract to
-   `.ultra/tasks/tasks.json`.
-2. Create one local task commit containing the implementation, semantic Ultra
-   artifacts, and the team ledger checkpoint.
-3. Read the resulting `HEAD` and update only `completion_commit` through `task.update`.
-4. Verify the task worktree `HEAD`, integration ancestry, review evidence, and public
-   seam; then close the session and complete the dev workflow.
-
-The third step changes only ignored runtime state. Repeating it with the same hash is
-byte-idempotent and leaves Git clean.
-
-If the commit fails after step 1, transition the still-session-owned task from
-`completed` to `blocked`, preserve the worktree, and record the failure. This recovery
-transition is accepted only while `completion_commit` is absent. A task with a recorded
-completion commit remains terminal.
+1. Record `task_outcome / complete { id, packet_digest }`. Completion validates the
+   assigned Worker Packet and durable output, and accepts neither an arbitrary `patch`
+   nor any commit hash.
+2. Publish the completed durable status and Task contract with `ultra.sync`.
+3. Create one local integration commit containing the implementation, semantic Ultra
+   artifacts, and `.ultra/tasks/tasks.json`.
+4. Read the resulting full `HEAD` and record
+   `task_outcome / attest_commit { id, completion_commit }`.
+5. Verify the task worktree head, integration ancestry, review evidence, and public
+   seam; then release the session.
+
+Attestation requires an already completed Task and a real commit integrated into the
+current checkout. It changes only ignored runtime state, does not republish team
+authority, and is idempotent for the same hash. Git remains clean, so no bookkeeping
+commit is permitted.
+
+If sync or the integration commit fails after completion, record
+`task_outcome / block { id }`, preserve the still-session-owned worktree, and record the
+failure. This recovery transition is accepted only while `completion_commit` is absent.
+An attested Task cannot use this block recovery; an explicit later reopen records the
+prior attestation in event history before clearing the current local proof.
 
 ## Parent-supervised workers
 
-A worker records evidence and exits without finalizing the parent-owned task. The
-primary host verifies and integrates the worker commit, publishes the task completion
-checkpoint, records the integrated commit hash locally, and settles the lease.
+A worker records evidence and exits without finalizing the parent-owned Task. The
+primary host validates and stages the worker result, records durable completion,
+publishes the team checkpoint, creates the single authoritative integration commit,
+attests that integrated hash locally, and settles the lease.
 
 ## Why the hash is local
 

package/docs/RUNTIME-COMPAT-MATRIX.md

@@ -106,6 +106,8 @@ instructions, project `.ultra`, unrelated plugins, and unrelated host configurat
 | Global flag | `--claude` | `--opencode` | `--codex` | `--kimi` | `--grok` |
 | Staging + atomic swap | FULL | FULL | FULL | FULL | FULL |
 | Exact-host preflight | FULL | FULL | FULL | FULL | FULL |
+| Native registration truth | host manifest | host config | plugin manifest/cache | installed registry | `grok plugin list/details` |
+| Active MCP truth | host MCP config | host MCP config | plugin cache | managed plugin config | `grok inspect` + `grok mcp doctor` |
 | Managed uninstall guard | FULL | FULL | FULL | FULL | FULL |
 | Preserve unrelated config | FULL | FULL | FULL | FULL | FULL |
 | Read-only Doctor | FULL | FULL | FULL | FULL | FULL |
@@ -114,6 +116,20 @@ Preflight uses the final manifest command and verifies initialize, `tools/list =
 public write/read, Doctor backup, close/reopen consistency, native provenance, and
 lazy project initialization.
 
+The Grok adapter probes the installed CLI's command and flag capabilities rather
+than branching on a Grok version number. Global installation uses Grok's native
+plugin registry, keeps a durable managed local source for native refresh, and
+resolves the MCP launcher through `${GROK_PLUGIN_ROOT}` after Grok copies the plugin
+under its dynamic `installed-plugins/<repo-key>` path. An older raw
+`$GROK_HOME/plugins/ultra-builder-pro` installation is backed up and migrated; a
+failed native install restores the prior source and registration.
+
+`grok mcp list` is not the plugin-MCP inventory surface in current Grok releases;
+it reports explicit user/project MCP configuration. Ultra therefore does not add a
+second `[mcp_servers]` entry merely to make that command display the plugin. The
+authoritative plugin consumer checks are the native plugin registry, merged
+`grok inspect` MCP source, and the live `grok mcp doctor` handshake.
+
 ## Durable compatibility
 
 | Capability | Contract |
@@ -138,5 +154,5 @@ are reconstructed only from verified authority.
   preservation.
 - `tests/package-smoke.test.cjs` installs the npm tarball and performs five real
   launcher write/read/backup/reopen round trips.
-- Grok acceptance also runs the available native plugin validate/inspect command and
-  camelCase Hook fixtures.
+- Grok acceptance runs capability probing, native install/list/details/enable,
+  merged inspect, MCP Doctor, migration rollback, and camelCase Hook fixtures.

package/docs/STATE-DB-ACCESS-POLICY.md

@@ -40,6 +40,8 @@ It does not grant lifecycle authority: external writers use the published observ
 allowlist, while lifecycle event
 names are emitted only inside the mutation that owns the corresponding state change.
 Consumers must verify mutable rows rather than infer success from an event name.
+Rejected semantic calls are recorded as `ultra_kernel_attempt` observations and shown
+by `ultra.context`; they do not create the rejected row or authorize a transition.
 
 ## 2. Connection discipline
 
@@ -80,7 +82,7 @@ resolve the mount/runtime constraint before retrying.
 | `decision_records` | MCP server through `ultra.record`; normalized accepted intent and applied references are stored, never UI receipts, prompts, or transcripts |
 | `stage_checkpoints` | MCP server through `ultra.checkpoint`; mutable drafts and immutable accepted/superseded revisions, never fixed reasoning steps |
 | `context_envelopes`, `worker_packets` | MCP server through `ultra.context`, `ultra.checkpoint`, and `ultra.session`; exact digest-bound handoff authority |
-| `decision_threads`, `decision_items`, `workflow_runs`, `workflow_steps` | legacy history retained for migration and audit; no current public writer or authorization role |
+| `decision_threads`, `decision_items`, `workflow_runs`, `workflow_steps` | read-only legacy history retained for migration and audit; no current public writer, invalidation mutation, or authorization role |
 | `artifacts`, `artifact_edges` | MCP server through `ultra.record` and checkpoint-owned registration |
 | `context_snapshots`, `spec_learning_candidates`, `trace_links` | MCP server through `ultra.record` and `ultra.checkpoint` |
 | `incidents`, `projection_jobs`, `event_consumers`, `circuit_breaker` | MCP server; backup-first doctor recovery may perform only documented mechanical transitions |
@@ -124,6 +126,11 @@ performs semantic import, publication, or conflict selection.
   than the orchestrator's boot-time WAL detector.
 - **No raw SQL in command md files.** Commands call MCP tools or
   `ultra-tools …` subcommands; the SQL lives in `mcp-server/lib`.
+- **No legacy authority mode switch.** Public Change callers use the single Kernel
+  facade. New workflow-owned artifacts and workflow/dialogue writes are rejected.
+- **No semantic meaning in projection metadata.** `_ultra.projection_commit` means
+  only that the generated-view job was durably enqueued and processed; acceptance is
+  read from the typed tool result and current authority.
 - **No `vacuum` / `wal_checkpoint(TRUNCATE)` from inside a transaction.**
   Maintenance subcommands open their own connection.