ultra-builder-pro-cli 0.25.1 → 0.26.0

package/commands/ultra-status.md

@@ -1,10 +0,0 @@
----
-description: Report authoritative Ultra health, evidence freshness, and valid capability transitions
-argument-hint: "[task-or-change-id]"
-workflow-ref: "@skills/ultra-status/SKILL.md"
----
-
-# Report Ultra status
-
-Read and follow `@skills/ultra-status/SKILL.md`, using `$ARGUMENTS` to select a specific task or change.
-Treat the referenced skill as the only workflow definition.

package/commands/ultra-test.md

@@ -1,10 +0,0 @@
----
-description: Run independent, risk-selected verification and record current acceptance evidence
-argument-hint: "[scope]"
-workflow-ref: "@skills/ultra-test/SKILL.md"
----
-
-# Verify delivery readiness
-
-Read and follow `@skills/ultra-test/SKILL.md`, using `$ARGUMENTS` to bound the verification scope.
-Treat the referenced skill as the only workflow definition.

package/commands/ultra-think.md

@@ -1,10 +0,0 @@
----
-description: Resolve a consequential question through evidence or one-decision-at-a-time alignment
-argument-hint: "[question]"
-workflow-ref: "@skills/ultra-think/SKILL.md"
----
-
-# Align on a consequential question
-
-Read and follow `@skills/ultra-think/SKILL.md`, treating `$ARGUMENTS` as the question to resolve.
-Treat the referenced skill as the only workflow definition.

package/docs/AGENT-CONTEXT.md

@@ -1,191 +0,0 @@
-# Ultra Builder Pro agent context contract
-
-This is the shared runtime contract for Claude Code, Codex, OpenCode, Kimi Code,
-and Grok Build.
-
-## Ownership
-
-Ultra owns:
-
-- eleven explicit workflow Skills: `ultra-init`, `ultra-research`, `ultra-think`,
-  `ultra-change`, `ultra-plan`, `ultra-dev`, `ultra-test`, `ultra-review`,
-  `ultra-deliver`, `ultra-status`, and `ultra-doctor`;
-- four internal worker-rule Skills;
-- bounded evidence-only review/debug workers;
-- deterministic workflow Hooks;
-- exactly seven public MCP tools;
-- `.ultra` project authority, team sync, recovery, and the portable installer.
-
-Ultra does not own general memory, code graphs, browser or deployment providers,
-framework guidance, global user instructions, or unrelated Skills.
-
-## Runtime model
-
-```text
-explicit Skill
-  -> canonical Context Envelope
-  -> host model reasoning and owner interaction
-  -> typed ultra.record
-  -> mutable Stage Checkpoint draft
-  -> accepted immutable revision
-  -> evidence / team sync / archive
-```
-
-The host model recommends semantic routes. The user selects material intent and
-external effects. MCP persists facts and enforces mechanical safety. A Hook may
-observe or inject context, but cannot create a decision or accept a checkpoint.
-
-## Seven public tools
-
-| Tool | Use |
-|---|---|
-| `ultra.context` | Read bounded current authority without mutation |
-| `ultra.record` | Persist typed facts, decisions, tasks, artifacts, outcomes, and observations |
-| `ultra.checkpoint` | Save or accept a stage-level revision |
-| `ultra.sync` | Inspect, migrate, import, or publish the Git checkpoint |
-| `ultra.session` | Acquire/release execution authority and create a Worker Packet |
-| `ultra.archive` | Perform recoverable local delivery convergence |
-| `ultra.doctor` | Diagnose or backup-first repair mechanical health |
-
-Retired operation names are not callable. Semantic incompleteness is returned as
-diagnostics and leaves the draft editable. Hard errors are limited to corruption,
-unsafe paths, digest/CAS/lease conflicts, missing runtime prerequisites, permissions,
-and irreversible external effects.
-
-A rejected semantic attempt is appended as `ultra_kernel_attempt` audit history and
-appears alongside the next `ultra.context` envelope without changing its semantic
-digest. It never creates the rejected semantic row or claims that authority was
-committed. `_ultra.projection_commit` reports only the post-call generated-view cycle;
-it is not a semantic acceptance receipt.
-
-Every public input has one exact kind/action contract. Unknown fields, wrong scalar or
-container types, invalid enums, malformed digests, and mismatched scopes are diagnosed
-before SQLite affinity, filesystem writers, or host adapters can coerce them. A
-correctable rejection returns `accepted: false`, `mutable: true`, typed diagnostics,
-and bounded audit history; it is not an MCP transport failure. Reusing an idempotency
-key for a different request follows that same repairable path, while retrying the exact
-request returns the original result.
-
-Every accepted mutation and its idempotency receipt are one logical commit. DB-only
-writes share one immediate transaction. A write that also owns a managed file, team
-checkpoint, worktree, Worker Packet, or archive journal either publishes both sides or
-restores the prior bytes and rows. If compensation itself cannot be proven, the kernel
-returns a typed recovery requirement instead of reporting partial success.
-
-## Context Envelope
-
-Every Skill begins by reading `ultra.context` for the relevant stage and scope. The
-same content-addressed generator supplies Hook breadcrumbs, compact recovery, Session
-handoff, and Worker Packets. It includes:
-
-- project/host identity and health;
-- Git head, scope digest, and drift classification;
-- accepted baseline and evidence references;
-- current Change and Task contracts;
-- accepted normalized Decision Records;
-- typed evidence references and freshness;
-- current execution lease/worktree/packet;
-- warnings, `needs_attention`, and hard conflicts.
-
-Summary output stays within 16 KiB. Selected full output stays within 64 KiB. Large
-file bodies remain lazy references. Identical authority must reuse one digest and
-snapshot.
-
-## Interaction
-
-```text
-inspect -> suggest -> host-native ask when needed -> normalize
-       -> persist -> apply -> read back
-```
-
-Do not ask again when the current user message already resolves the decision. Persist
-only the normalized question, recommendation, selection, effects, non-goals,
-provenance, applied references, status, digest, and supersession. Never persist raw
-conversation, chain-of-thought, full prompts, or UI receipts.
-
-Host question surfaces:
-
-- Claude Code and Kimi Code: `AskUserQuestion`;
-- Codex: `request_user_input` when available;
-- OpenCode: `question`;
-- Grok Build: its native structured question surface when available, otherwise one
-  concise conversational question.
-
-If the host mode forbids interaction, leave the decision unresolved.
-
-## Stage Checkpoints
-
-Skills describe adaptive evidence expectations and decide semantic sufficiency;
-SQLite does not authorize a fixed step sequence or reinterpret the supplied verdict.
-A stage has a mutable draft and immutable accepted revisions:
-
-```text
-draft N -> accepted N -> superseded by accepted N+1
-```
-
-Warnings and semantic gaps do not reject explicit acceptance. Structural, digest,
-path, publication, and concurrency conflicts leave the draft mutable. An accepted
-revision can be replaced by a later accepted revision without rewriting history.
-
-## Worker handoff
-
-Every worker must receive one immutable Worker Packet generated from current authority.
-The packet binds:
-
-- role, runtime, Change/Task scope, and output schema;
-- Context Envelope path/digest;
-- accepted Decision Records and digest;
-- Git head/diff/changed files;
-- Task contract, acceptance, and digest;
-- evidence references;
-- exact output path;
-- `packet_digest`.
-
-Workers may inspect the assigned checkout and write only the declared evidence output.
-They do not edit source, write SQLite, accept checkpoints, modify another worker's
-result, or decide final delivery. Output must echo `packet_digest`; the primary host
-verifies it, performs any source repair, and records the resulting evidence.
-
-## Hook boundary
-
-The canonical Hook bundle uses `context_envelope.py`, not a parallel context reader.
-Hooks may:
-
-- report health and inject a compact envelope;
-- protect MCP-owned team checkpoints and generated projections;
-- save/restore minimal compact recovery state;
-- append minimal lifecycle identifiers;
-- report an advisory Stop summary.
-
-Hooks may not select a route, manufacture a semantic record, capture prompts or
-transcripts, block ordinary work for semantic incompleteness, or claim an ignored
-stdout channel was injected. Every Skill still reads authoritative Context at entry.
-
-## Five host presentations
-
-| Host | Entry | Worker surface | Context behavior |
-|---|---|---|---|
-| Claude Code | `/ultra-builder-pro:ultra-*` | native agents | SessionStart compact + Skill full |
-| Codex | `$ultra-builder-pro:ultra-*` | managed TOML agents | session/prompt compact + Skill full |
-| OpenCode | `/ultra-*` | native agents | system transform + Skill full |
-| Kimi Code | `/ultra-builder-pro:ultra-*` | Agent/AgentSwarm templates | native compact where supported + Skill full |
-| Grok Build | native Ultra commands/Skills | plugin agent templates | Skill full is authoritative; Hook stdout limitations are explicit |
-
-Adapters own only translation and wiring. The active host remains primary; optional
-cross-host collaboration is explicit and read-only.
-
-## Storage
-
-Tracked `.ultra` files carry inspectable intent, specifications, plans, Decision
-Records, test/review/delivery evidence, and archives. `.ultra/tasks/tasks.json` is a
-digest-chained team checkpoint. `.ultra/.runtime/` is ignored and contains SQLite,
-generated projections, Sessions, worktrees, recovery, backups, telemetry, and debug
-state.
-
-Every semantic file must have one writer, owner, consumer, digest, promotion gate, and
-archive rule as defined in `ARTIFACT-AUTHORITY.md`.
-
-The production Change API has one Kernel behavior and exposes no legacy/current mode
-switch. Pre-v0.24 workflow and dialogue rows remain read-only migration/audit history:
-the public kernel cannot create workflow-owned artifacts or mutate those rows during
-current invalidation.

package/docs/COMMIT-HASH-BACKFILL.md

@@ -1,51 +0,0 @@
-# Commit-hash backfill
-
-`tasks.completion_commit` is checkout-local integration evidence. It lives in
-`.ultra/.runtime/state.db` and may appear in checkout-local projections, but it is
-deliberately absent from the Git-facing team ledger.
-
-This removes the old self-referential two-commit loop. Recording a commit hash no
-longer changes any tracked file.
-
-## Direct task completion
-
-After implementation, verification, and review are current:
-
-1. Record `task_outcome / complete { id, packet_digest }`. Completion validates the
-   assigned Worker Packet and durable output, and accepts neither an arbitrary `patch`
-   nor any commit hash.
-2. Publish the completed durable status and Task contract with `ultra.sync`.
-3. Create one local integration commit containing the implementation, semantic Ultra
-   artifacts, and `.ultra/tasks/tasks.json`.
-4. Read the resulting full `HEAD` and record
-   `task_outcome / attest_commit { id, completion_commit }`.
-5. Verify the task worktree head, integration ancestry, review evidence, and public
-   seam; then release the session.
-
-Attestation requires an already completed Task and a real commit integrated into the
-current checkout. It changes only ignored runtime state, does not republish team
-authority, and is idempotent for the same hash. Git remains clean, so no bookkeeping
-commit is permitted.
-
-If sync or the integration commit fails after completion, record
-`task_outcome / block { id }`, preserve the still-session-owned worktree, and record the
-failure. This recovery transition is accepted only while `completion_commit` is absent.
-An attested Task cannot use this block recovery; an explicit later reopen records the
-prior attestation in event history before clearing the current local proof.
-
-## Parent-supervised workers
-
-A worker records evidence and exits without finalizing the parent-owned Task. The
-primary host validates and stages the worker result, records durable completion,
-publishes the team checkpoint, creates the single authoritative integration commit,
-attests that integrated hash locally, and settles the lease.
-
-## Why the hash is local
-
-- A Git file cannot contain the hash of the commit that contains that same file.
-- Runtime integration evidence is checkout-specific and does not belong in a shared
-  semantic merge surface.
-- The team ledger needs the durable task outcome and status, not a self-referential
-  commit identifier.
-- Baseline freshness uses scoped content plus Git ancestry, so a metadata-only Ultra
-  checkpoint commit does not invalidate an otherwise unchanged baseline.

package/docs/LEGACY-CLI-CROSSWALK.md

@@ -1,175 +0,0 @@
-# Original Ultra Builder Pro to CLI crosswalk
-
-This document is the compatibility contract between the original
-[`rocky2431/ultra-builder-pro`](https://github.com/rocky2431/ultra-builder-pro)
-Claude Code harness and this multi-runtime CLI/MCP implementation. Comparisons and
-migration rationale live here, not in runtime Skill prompts.
-
-## Provenance
-
-- Original baseline inspected at
-  [`a82a9d73efe14a2a94a6ac6aa1fd44ba905b2159`](https://github.com/rocky2431/ultra-builder-pro/tree/a82a9d73efe14a2a94a6ac6aa1fd44ba905b2159).
-- The CLI repository was bootstrapped from the original harness at `6deca47`.
-- The original delivery spine is six stages:
-  `init -> research -> plan -> dev -> test -> deliver`.
-- `status` and `think` support that spine. The original review Skill is a mandatory
-  development/release gate even though it was not a separate slash command.
-
-The compatibility target is semantic, not file-for-file. Host-specific Claude Code
-mechanics are replaced only when the replacement preserves the observable workflow
-contract and adds stronger authority, recovery, or portability.
-
-## What the CLI preserves and strengthens
-
-| Original capability | Current implementation | Compatibility result |
-|---|---|---|
-| Init gathers project facts, creates Ultra files, and establishes Git | `task.init_project` performs deterministic classification, scaffold, schema, Git bootstrap, read-back verification, and then stops | Preserved and strengthened. Init has its own completion boundary and never starts research implicitly. |
-| Complete product and architecture research | `ultra-research` retains the semantic reference catalog while the model recommends evidence-relevant coverage and the owner selects, modifies, delegates, or defers the route | Preserved without questionnaire overload. Accepted dispositions, necessary reports, typed semantic records, source digests, and optional material decision checkpoints add durable evidence. |
-| Planning converts accepted research into executable work with dependencies | `ultra-plan` persists complete change-owned task contracts and an exact dependency graph | Preserved and strengthened with topology, acceptance coverage, public seams, verification commands, and plan digests. |
-| Development uses isolated Git work, TDD, verification, review, commit, and integration | `ultra-dev`, `session.*`, and the session runner create real worktrees and retain task/review/commit evidence | Preserved and strengthened. Process exit cannot complete a task; uncommitted or unintegrated worktrees cannot be deleted. |
-| Test checks wiring, acceptance, regression, build, performance, security, and failures | `ultra-test` emits a change-bound immutable report covering each applicable dimension | Preserved and strengthened with HEAD, context, task-set, and report-digest validation. |
-| Review challenges specification fidelity and engineering quality | `ultra-review` is a first-class stage with independent specification and engineering axes | Strengthened. A coordinated summary cannot replace either complete axis. |
-| Delivery verifies clean readiness, documentation, build, and evidence | `ultra-deliver` assesses the explicitly accepted evidence packet for the actual Change route, records deliberate omissions, reconciles current managed authority, and creates a recoverable local archive and immutable report | Preserved without a fixed stage gate and strengthened by path, digest, reconciliation, idempotency, and recovery validation. Publish, deploy, push, and other external effects remain separate explicitly authorized operations. |
-| Status restores the current workflow position | `ultra-status` reads DB authority, Git, sessions, artifacts, decisions, allowed transitions, and any hard recovery requirement | Strengthened. The host recommends the semantic route; projections and Prompt prose cannot override state. |
-| Thinking synchronizes owner and Agent intent | `ultra-think` plus `decision.*` persists one-question dialogue, non-ceremonial completion, and optional artifact checkpoints | Strengthened. Observable facts are resolved first; only load-bearing owner choices block. |
-
-## CLI-original capabilities
-
-The following are deliberate extensions built on the original spine:
-
-1. `.ultra/.runtime/state.db` as the only lifecycle and index authority; registered
-   digest-bound Markdown and JSON carry semantic or evidence bodies, while generated
-   views remain projections.
-2. Typed MCP transitions for baseline, change, decision, workflow, task, session,
-   incident, projection, and evidence state.
-3. Greenfield, brownfield, monorepo-scope, migrated, restore, and rebaseline paths.
-4. `ultra-change` as the continuous post-baseline delta and convergence unit.
-5. `ultra-doctor` plus backup-first migration, projection repair, incident reporting,
-   orphan recovery, and installed-asset provenance.
-6. Context Manifest v3, Change/task authority digests, DB-derived breadcrumbs,
-   adaptive transitions, advisory context budgets, and fresh-context handoffs.
-7. Approval-gated specification learning and baseline reconciliation.
-8. Independent two-axis review and immutable test/review/delivery evidence.
-9. Native adapters for Claude Code, OpenCode, Codex, and Kimi Code.
-10. Explicit worktree admission, leases, heartbeats, crash evidence, circuit breaking,
-    dependency waves, and optional verified cleanup.
-11. A digest-chained Git team checkpoint that keeps the original shareable task-ledger
-    benefit without committing SQLite, leases, sessions, or live `in_progress`
-    ownership.
-
-## Intentionally retired original baggage
-
-These items are not compatibility losses:
-
-- embedded prompt, transcript, observation journal, session summary, or general
-  conversational cross-session memory;
-- an internal code graph or memory store;
-- retired model runtimes and their prompts;
-- retired command-proxy integrations;
-- imported browser, deployment, framework, discovery, or third-party Skills;
-- model-tier routing, confidence percentages, forced option counts, forced task
-  counts, automatic MVP selection, or silent scope reduction;
-- handwritten `tasks.json` authority or direct specification dual-write;
-- unsafe automatic push, release, merge, or worktree deletion.
-
-External memory and graph providers own their content. Ultra may store only bounded
-metadata references.
-
-## Reference capability paths and gates
-
-These paths show common capability order and hard prerequisites. They are not a
-single mandatory pipeline: the model recommends among MCP-reported allowed
-transitions, while the owner selects or delegates the semantic route. MCP requires one
-route only for a unique mechanical recovery invariant.
-
-### New repository
-
-```text
-task.init_project
-  -> greenfield classification
-  -> Git bootstrap when absent
-  -> empty or imported team checkpoint
-  -> init read-back and completion
-  -> explicit full research with a model-recommended, owner-selected route
-  -> selected execute/verify/reuse work and synthesis
-  -> owner-authorized local checkpoint commit when Git is unborn
-  -> baseline.record
-  -> baseline.converge
-  -> ultra-change
-  -> optional bounded research/plan -> dev tasks -> test -> review -> local deliver
-```
-
-### Existing repository
-
-```text
-task.init_project
-  -> brownfield classification and selected scope
-  -> preserve current Git HEAD and dirty-state evidence
-  -> import portable team state and require local baseline revalidation when cloned
-  -> init read-back and completion
-  -> explicit adoption research with a model-recommended, owner-selected route
-  -> characterization verification + known-red/gap ledger
-  -> baseline.record + owner approval
-  -> baseline.converge
-  -> first ultra-change
-```
-
-### Earlier Ultra authority
-
-```text
-doctor/migrate with backup
-  -> migrated compatibility row
-  -> explicit brownfield re-adoption
-  -> current research and evidence convergence
-  -> normal change loop
-```
-
-### Daily change
-
-```text
-status
-  -> checkpoint condition + change intent capture
-  -> material alignment only when unresolved
-  -> model-recommended, owner-selected or delegated bounded research, plan,
-     current dev work, think, or status
-  -> session.spawn creates the real task worktree
-  -> red/green/verify/review
-  -> durable task checkpoint + one local task commit + local hash backfill
-  -> safe session close
-  -> aggregate test -> review -> deliver
-  -> atomic baseline reconciliation
-```
-
-## Breakpoint closure
-
-| Prior breakpoint | Required invariant |
-|---|---|
-| Init was incorrectly held open until research and baseline convergence | Init completes only after classification, Git/scaffold setup, state creation, and read-back verification; research starts explicitly and owns baseline convergence. |
-| A fresh project had `.ultra` but no Git | Auto init creates `main`, adds the symlink-safe `.ultra` ignore rule, and exposes `initial_commit_required`. |
-| Initialized Git had no HEAD but baseline used a workspace hash | `unborn` is a persisted state; `baseline.record` fails with `BASELINE_GIT_HEAD_REQUIRED`. |
-| Resume preserved an incorrect project name/type/stack | In-progress resume refreshes corrected metadata and records the change. |
-| MCP session reservation and runner session were separate | `session.spawn` creates the actual worktree and the single authoritative session row. |
-| Process exit zero marked a task completed | Exit success leaves the task `in_progress` until dev/test/review evidence converges. |
-| Dependency waves advanced after transport exit | The plan pauses at the first non-terminal wave and resumes only after its DB tasks converge. |
-| A crafted or merely exported plan could bypass current plan authority | Change-owned dispatch requires a healthy completed plan workflow and the exact current DB graph; malformed, cyclic, stale, duplicate-task, or cross-change plans fail before session creation. |
-| Direct session or daemon spawn bypassed the current plan | Every change-owned admission and spawn revalidates current task-contract digests, task set, dependencies, and staleness before takeover or worktree creation. |
-| A worker launched inside a worktree could create a second `.ultra/.runtime/state.db` | Every session checkout links its ignored `.ultra` entry to central authority and receives non-overridable DB/root bindings; legacy repositories get a local `info/exclude` rule without tracked drift, while unsafe ignore or link state rolls back before worker launch. |
-| Plan authority could drift between wave admission and actual spawn | The spawn-time gate converts this race into an authority pause without task-failure or circuit-breaker evidence. |
-| Explicit auto-merge could integrate before workflow gates | A change-owned auto-merge requires the exact completion commit, ready dev evidence, a current task review, and clean committed Git work; otherwise the worktree is preserved. |
-| Session close or auto-merge could delete uncommitted work | Close preserves by default; explicit cleanup verifies clean and integrated Git ancestry. |
-| Daemon could create a worktree with no worker | Dispatch refuses to start without an explicit executable command. |
-| Failure returned a task to pending without recovery evidence | Exit and spawn failures become `blocked` and record session-linked circuit-breaker evidence. |
-| A late resume failure could leave refreshed DB metadata behind | Resume snapshots DB authority and generated projections, then restores both together with Git rollback. |
-| A legacy schema migrated before a later resume failure | Resume restores the pre-migration backup, not the partially completed upgraded intermediate state. |
-| Tracked `tasks.json` made every Ultra write dirty and every metadata commit stale the baseline | Live projections moved below ignored `.ultra/.runtime/projections/`; the tracked file became a low-frequency MCP checkpoint, and baseline freshness excludes `.ultra` while still checking scoped source bytes plus Git ancestry. |
-| A local SQLite DB could not hand baseline, Change, and task authority to another checkout | The Git checkpoint carries portable records with per-record digests and ancestry; import fast-forwards clean records, rejects concurrency, and revalidates every ready baseline locally. |
-| A completed task needed a second commit to record its own commit hash | Durable task outcome enters the same task commit; the resulting hash is backfilled only into local SQLite/projections, so no self-referential metadata commit is created. |
-
-## Advancement rule
-
-A stage advances only when its DB workflow definition reports every required step
-current and the stage-specific verifier accepts the referenced outputs. A Prompt,
-child-process exit, generated projection, or old document can never advance a stage.
-On interruption, resume the same non-terminal workflow and current step. On authority
-damage, route to doctor; on missing owner authority, route to think. Never open a
-parallel run to escape a blocker.

package/docs/ROADMAP.md

@@ -1,101 +0,0 @@
-# Ultra Builder Pro roadmap
-
-The current product is a five-host adaptive delivery harness with a seven-tool
-persistence and safety kernel. `docs/DECISIONS.md` defines durable decisions;
-schemas, source, and contract tests define executable behavior.
-
-## Current release boundary
-
-- First-class hosts: Claude Code, OpenCode, Codex, Kimi Code, and Grok Build.
-- Distribution: npm package plus host-native generated plugins.
-- Public semantic workflows: 11 explicit Skills.
-- Public MCP surface: exactly 7 tools.
-- Local authority: `.ultra/.runtime/state.db`.
-- Team handoff: `.ultra/tasks/tasks.json` and tracked semantic/evidence artifacts.
-- General memory, code graph, browser, deployment, and framework guidance: external.
-
-## Current repository
-
-```text
-spec/
-├── mcp-tools.yaml
-├── cli-protocol.md
-├── schemas/
-└── fixtures/
-
-mcp-server/
-├── server.cjs
-├── hook-context.cjs
-└── lib/
-    ├── ultra-facade.cjs
-    ├── context-envelope.cjs
-    ├── decision-records.cjs
-    ├── stage-checkpoints.cjs
-    ├── worker-packet.cjs
-    ├── task-ledger.cjs
-    ├── state-db.cjs
-    ├── state-ops.cjs
-    ├── artifact-registry.cjs
-    ├── baseline-workflow.cjs
-    ├── change-workflow.cjs
-    ├── doctor.cjs
-    └── projector.cjs
-
-adapters/
-├── claude.js
-├── opencode.js
-├── codex.js
-├── kimi.js
-└── grok.js
-
-hooks/
-├── active_task_context.py
-├── context_envelope.py
-├── health_check.py
-├── pre_stop_check.py
-├── runtime_paths.py
-├── subagent_tracker.py
-├── workflow_checkpoint.py
-├── workflow_context.py
-└── workflow_resume.py
-
-skills/                 # 11 public, 4 internal, explicit collab companions
-agents/                 # bounded Worker Packet consumers
-ultra-tools/            # CLI diagnostics, migration, and recovery
-orchestrator/           # optional approved Worker Packet dispatch
-```
-
-Retired semantic-supervisor modules remain only in source migration/regression history
-and are excluded from the npm package. They do not authorize current Stage
-Checkpoints, Sessions, Skills, or archive.
-
-## Completed product invariants
-
-- MCP does not select semantic routes or pre-authorize reasoning steps.
-- Draft Stage Checkpoints are mutable; accepted revisions are immutable and
-  supersedable.
-- Context, accepted decisions, and evidence are visible across sessions and Git
-  checkout sync.
-- Every delegated worker receives an immutable Worker Packet.
-- All five host installers stage, preflight, and atomically swap complete native
-  runtimes.
-- v4.4/v4.5 and v0.22/v0.23 authority migrates backup-first.
-- Hooks are observation/injection/protection only.
-- `.runtime` stays local while reviewed intent and evidence remain team-trackable.
-
-## Verification
-
-```bash
-npm run verify:release
-npm pack --dry-run --json
-node bin/install.js --all --global --doctor --json
-```
-
-The release gate also installs the tarball into a clean consumer and exercises public
-write/read/backup/reopen through every generated host launcher.
-
-## Deferred product directions
-
-A web dashboard or TUI, a collaboration server, Homebrew/pip distribution, and an
-independent marketplace remain uncommitted product directions. They must enter through
-a new explicit decision and Change rather than this roadmap silently promising them.