ultra-builder-pro-cli 0.26.0 → 0.26.1

package/.ultra-template/contexts/TEMPLATE.md

@@ -32,6 +32,8 @@
 <!-- The verifiable definition of done. Read by mid_workflow_recall and session_context, and
      injected into agent context — keep every line testable and keep noise out. -->
 
+**Change Acceptance IDs**: [`AC-1`, `AC-3`, or `none` for task-local-only work]
+
 - [ ] `exact test command`
 - [ ] Pass: [scenario 1]
 - [ ] Pass: [scenario 2]
@@ -51,6 +53,11 @@
 
 **Source**: `.ultra/specs/product.md#section-id`
 
+**Hard Constraints**: [`HC-1`, `HC-3`, or `none` — the north-star constraints this
+task could plausibly violate. Read them before the first edit and again before
+marking complete. Crossing one stops the work and goes to the owner, however good
+the argument.]
+
 **Decisions**: [relevant `.ultra/decisions/<id>.md` entries, or `none`]
 
 ## Change Log

package/CHANGELOG.md

@@ -7,6 +7,61 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.26.1] — 2026-08-03
+
+### Added
+
+- Added reframing to `ultra-grilling`, five bounded framing questions, and checkable
+  resolved, stalled, and unavailable exits so a literal request can be translated
+  into the role and outcome the owner actually means.
+- Added `HC-<n>` hard-constraint identifiers, task-level constraint mapping,
+  executable Change verification, and a supported `changes/abandoned/` exit.
+- Added owner-authorized cross-model-family review for major or security-relevant
+  Changes, plus optional native fan-out inside independent research and test regions.
+
+### Changed
+
+- Made `ultra-dev` converge on each task's mapped Change acceptance IDs, track the
+  best-ever passing set, and stop after two no-progress rounds or three repair rounds.
+- Expanded delivery reconciliation to every repository document and kept its wiring
+  gate local to an explicitly invoked `ultra-deliver`; ordinary npm lifecycle commands
+  never depend on project `.ultra/` evidence.
+- Made `ultra-change` read relevant archive history before opening intent, preferring
+  `delivery.md` while supporting legacy archive summaries and verification records.
+- Made all six review lenses the default and required every skipped lens to preserve
+  its reason in the aggregate result.
+
+### Fixed
+
+- Prevented delegated workers from modifying `.ultra/`, including when `.` grants the
+  rest of an isolated checkout.
+- Made dangerous-command authorization reachable by hashing the protected effect
+  independently of its retry spelling.
+- Kept additive protected-branch publication on the host's native authority path instead
+  of hard-blocking an already owner-authorized release, retained exact-digest guards for
+  history rewrites and branch deletion, and stopped treating inert searches as effects.
+- Kept expandable interpreter heredocs inside dangerous-effect inspection while
+  continuing to treat quoted commit-message heredocs as data.
+- Required explicit owner authority before `ultra-review` can launch a cross-host
+  model-family recheck.
+- Bound `ultra-dev` convergence to the active Change acceptance IDs, with explicit
+  stalled and unreachable exits instead of an open-ended repair loop.
+- Made `ultra-change` recover archived intent from legacy archive evidence when the
+  preferred delivery record is absent.
+- Kept the `ultra-deliver` wiring gate local to an owner-invoked delivery workflow;
+  ordinary package commands remain independent of project `.ultra/` state.
+- Added the missing `changes/abandoned/` template directory and migrated completed WIP
+  evidence links to their canonical runtime document.
+
+### Verified
+
+- Completed an authenticated Claude-to-Codex continuation on one isolated
+  file-first task: Claude banked the failing test and Resume Note without changing
+  implementation, and Codex resumed from Git plus `.ultra/`, reached green, and
+  closed the ledger and canonical evidence without conversation transfer.
+- Verified the release candidate with 111 Node tests, 10 Hook tests, 14 Skill Creator
+  validations, five healthy host Doctor reports, and zero audit vulnerabilities.
+
 ## [0.26.0] — 2026-08-01
 
 ### Added
@@ -1167,7 +1222,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   skill manifest, CLI protocol + mapping table; 5 spec validators.
 - **Phase 0 — skeleton**: multi-runtime installer scaffolding.
 
-[Unreleased]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.20.0...HEAD
+[Unreleased]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.26.1...HEAD
+[0.26.1]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.26.0...v0.26.1
+[0.26.0]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.25.1...v0.26.0
+[0.25.1]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.25.0...v0.25.1
+[0.25.0]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.24.2...v0.25.0
+[0.24.2]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.24.1...v0.24.2
+[0.24.1]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.24.0...v0.24.1
+[0.24.0]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.23.0...v0.24.0
+[0.23.0]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.22.0...v0.23.0
+[0.22.0]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.21.1...v0.22.0
+[0.21.1]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.21.0...v0.21.1
+[0.21.0]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.20.0...v0.21.0
 [0.20.0]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.19.1...v0.20.0
 [0.19.1]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.19.0...v0.19.1
 [0.19.0]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.18.0...v0.19.0

package/README.md

@@ -219,7 +219,7 @@ Five optional hooks accelerate file reading and protect a narrow effect boundary
 | `mid_workflow_recall.py` | Restate acceptance before relevant source operations |
 | `compact_context.py` | Save and restore a disposable Git/file snapshot |
 | `post_edit_guard.py` | Record mechanical evidence observations after edits |
-| `block_dangerous_commands.py` | Deny named destructive shell effects until the exact command is authorized |
+| `block_dangerous_commands.py` | Advise on additive protected-branch publication; deny history rewrites and named destructive shell effects until the exact command is authorized |
 
 All five exit silently when `.ultra/` is absent. Details are in
 [Plugin Isolation](docs/PLUGIN-ISOLATION-CONTRACT.md).

package/bin/delegate-worker.cjs

@@ -7,6 +7,7 @@ const path = require('node:path');
 const { execFileSync, spawn } = require('node:child_process');
 
 const RESULT_SCHEMA = 'ultra-delegation-result-v1';
+const PROTECTED_ROOT = '.ultra';
 const MODEL_FIELDS = new Set([
   '$schema', 'status', 'summary', 'changed_files', 'checks', 'evidence',
   'questions', 'residual_risks',
@@ -148,7 +149,11 @@ function validateModelResult(payload) {
   return null;
 }
 
+// The project's memory has exactly one writer: the primary host. A worker that edits
+// `.ultra` in its own worktree collides in the files every later session reads to
+// resume, so no permission grants it — not even `writable_roots: ["."]`.
 function authorized(spec, file) {
+  if (file === PROTECTED_ROOT || file.startsWith(`${PROTECTED_ROOT}/`)) return false;
   return spec.writable_roots.some((root) => (
     root === '.' || file === root || file.startsWith(`${root}/`)
   ));

package/bin/delegate.cjs

@@ -12,6 +12,7 @@ const PERMISSION_SCHEMA = 'ultra-delegation-permission-v1';
 const RECEIPT_SCHEMA = 'ultra-delegation-receipt-v1';
 const RESULT_SCHEMA = 'ultra-delegation-result-v1';
 const PERMISSION_FIELDS = new Set(['$schema', 'writable_roots', 'external_effects']);
+const PROTECTED_ROOT = '.ultra';
 const RESULT_JSON_SCHEMA = Object.freeze({
   type: 'object',
   additionalProperties: false,
@@ -149,6 +150,12 @@ function readPermission(file, worktree) {
       throw new Error('permission writable_roots must not escape through symlinks');
     }
     const normalized = path.relative(worktree, real).split(path.sep).join('/') || '.';
+    // `.ultra` is the project's memory and has exactly one writer: the primary host.
+    // Rejected here so the delegation never starts, and again against the actual diff
+    // in the worker, which also covers the `.` grant.
+    if (normalized === PROTECTED_ROOT || normalized.startsWith(`${PROTECTED_ROOT}/`)) {
+      throw new Error(`permission writable_roots must not include ${PROTECTED_ROOT}; the primary host is its only writer`);
+    }
     if (!writableRoots.includes(normalized)) {
       writableRoots.push(normalized);
       writableRootPaths.push(real);

package/docs/ARCHITECTURE.md

@@ -87,7 +87,10 @@ the parent model runs the same references sequentially.
 Five hooks read canonical files and emit bounded context or observations. Their output
 under `.ultra/.runtime/`, `.ultra/progress/`, or `.ultra/reviews/` is derived and
 disposable. The dangerous-command hook is the only hard effect guard; it classifies a
-small named set of shell effects and provides an exact-command authorization repair.
+small named destructive set and provides an exact-command authorization repair.
+Additive protected-branch publication remains advisory when portable host wiring cannot
+project a trusted owner-approval receipt; history rewrites and branch deletion remain
+guarded.
 
 ## Completion and recovery
 

package/docs/DECISIONS.md

@@ -52,8 +52,10 @@ No single sensor is promoted into a semantic completion gate.
 
 The hook surface is session context, mid-workflow acceptance recall, compact snapshot,
 post-edit evidence observation, and dangerous-command protection. Every hook is silent
-without `.ultra/`. Only a narrow named destructive effect can be denied, and its repair
-is authorization scoped to the exact command digest.
+without `.ultra/`. Additive protected-branch publication is advisory because the
+portable hook cannot receive every host's trusted owner-approval receipt. History
+rewrites, branch deletion, and the narrower named destructive effects can be denied;
+their repair is authorization scoped to the exact command digest.
 
 ## Delegation is a process boundary
 

package/docs/PHILOSOPHY.md

@@ -61,16 +61,20 @@ agents to find loopholes (rename `mock` to `stub`, etc.). The cheaper path must
 
 ### C3 — Sensors not Blockers
 
-Hooks emit signal; agents and users decide. Block only the **truly irreversible**:
+Hooks emit signal; agents and users decide. Block only the **truly irreversible or
+privileged destructive** effects for which the hook has an exact repair:
 
-- `git push` to protected branches
 - Funds transfer / on-chain transactions
-- DB migrations / `DROP` / `TRUNCATE`
+- Protected-branch history rewrite or deletion
+- `DROP` / `TRUNCATE`
 - Hardcoded secret commit
 - Arbitrary code execution driven by user input
 
-Everything else is advisory on stderr — the work stands, the signal is delivered, the agent
-proceeds.
+Additive protected-branch publication and database migrations are advisory: the former
+remains recoverable through Git and the portable hook cannot receive every host's
+trusted approval receipt; the latter is not mechanically classifiable as reversible or
+irreversible. The work stands, the signal is delivered, and the agent proceeds inside
+the owner's authorized frame.
 
 > **Why this is absolute**: hard final gates and hard pre-commit gates each produced the same
 > over-correction loop in v7 — the agent weakened tests to escape the gate and drifted from the
@@ -102,6 +106,27 @@ boundary surfaces to the user.
   feature flags, in-memory replacing real persistence, scope reduction, external or irreversible
   effects
 
+**Which decisions reach the owner.** Inside/Crossing above sorts actions. Read from the owner's
+side, the same boundary sorts decisions into three:
+
+| Type | Definition | Handling |
+|---|---|---|
+| taste | no objectively correct answer; only the owner's preference settles it | always ask |
+| crossing | objectively decidable, but the consequence is irreversible | always ask |
+| everything else | has an objective answer, or is cheap to reverse | decide and proceed; asking is the error |
+
+How much lands in the third row is a function of how sharp the north star is. With constraints
+that can veto a concrete decision, most execution-time questions are answered by reading them.
+With vague ones, "does this cross a boundary?" cannot be decided at all, so every question
+degrades into taste and reaches the owner. **Interrupt frequency measures the north star, not
+the work.** Frequent interruptions mean going back to sharpen constraints, not asking faster.
+
+**Boundaries grow; they do not change.** Adding a hard constraint or a non-goal mid-flight is
+routine and needs no permission — the frame got sharper and no prior promise broke. Editing or
+deleting one is a REDUCTION under the test below. This is what makes iteration five cheaper than
+iteration one: the frame accumulates, and the share of decisions the model settles alone rises
+with it.
+
 **Operational test for spec changes.** When implementation and spec disagree, classify the change
 before touching the spec. Do not classify by intent — classify by asking one question that can be
 checked against the file:
@@ -119,6 +144,12 @@ not convert a REDUCTION into a CORRECTION; the rationale goes into the question
 This is the mechanism by which specs shrink silently, so it is the one place the model must not
 be allowed to self-certify.
 
+**Not to be confused with Planning Posture.** A Change's `## Planning Posture` uses
+EXPAND / SELECTIVE / HOLD / REDUCE to say how much work to plan right now. That is a scope
+decision about the future and is freely reversible. The classification above is about the past:
+whether a promise already made still holds. `REDUCE` the plan is routine; a `REDUCTION` of
+commitments stops the work and goes to the owner.
+
 > **Test**: any boundary-crossing action must trigger an owner question, an active task
 > `## Change Log` entry, or an accepted `.ultra/decisions/<id>.md`.
 

package/docs/PLUGIN-ISOLATION-CONTRACT.md

@@ -70,9 +70,12 @@ Every hook resolves the current project and checks for `.ultra/` before reading,
 writing, injecting context, or denying an effect. Without `.ultra/`, it emits no stdout,
 exits zero, and leaves the project untouched.
 
-The only hook denial is a named dangerous shell effect in an active Ultra project. The
-denial identifies the protected effect and supplies an exact-command SHA-256
-authorization path. All other hook failures are fail-open diagnostics.
+The only hook denial is a named destructive shell effect in an active Ultra project.
+The denial identifies the protected effect and supplies an exact-command SHA-256
+authorization path. Additive protected-branch publication is an advisory observation
+because a portable hook cannot consume every host's trusted owner-approval receipt;
+history rewrites and branch deletion remain guarded. All other hook failures are
+fail-open diagnostics.
 
 ## Project data boundary
 

package/docs/RUNTIME-COMPAT-MATRIX.md

@@ -60,7 +60,7 @@ host feature OpenCode does not expose.
 | mid-workflow recall | yes | handles `apply_patch` | native bridge | normalized | executed |
 | compact context | pre/start | pre/post | native compact event | pre/post | pre-compact |
 | post-edit observation | Write/Edit | Write/Edit/`apply_patch` | write/edit/patch | Write/Edit | Write/Edit/patch |
-| dangerous command guard | Bash | Bash | bash | Bash | Bash deny mapping |
+| dangerous command guard | Bash advisory/deny | Bash advisory/deny | bash advisory/deny | Bash advisory/deny | Bash allow/deny mapping |
 
 All hooks share the same `.ultra/` idle guard. Wire adapters normalize payload and
 output fields only; they do not change semantic policy. Codex installation health and
@@ -99,3 +99,45 @@ inherits the same isolated `HOME` and `CODEX_HOME`. Grok native registration is
 only in explicit isolated test mode. Lifecycle tests also require the isolated config
 and fake HOME to contain zero children after uninstall, while separate ownership tests
 prove that pre-existing empty Codex and Kimi registries survive.
+
+## Authenticated cross-host continuation evidence
+
+On 2026-08-03, one deliberately narrow task was run in an isolated Git repository to
+test the product's central recovery claim with real authenticated models. This was a
+continuation drill, not a full project workflow or a delegation receipt test.
+
+Both hosts used globally installed artifacts from the same clean source candidate:
+
+- source commit: `c473a248bde2afce77591f2ba382246d420b5c72`;
+- worktree digest: `e83bdcbe2905cf02cb06cb0219127f6ce0400484331a6e9fc95622bbe24b44bd`;
+- Doctor: Claude healthy with 83 assets and zero issues; Codex healthy with 99 assets
+  and zero issues, with optional hooks still `user_review_required`.
+
+The seed repository had one passing smoke test, one pending task, one mapped Change
+acceptance ID, and seed HEAD `cf27d62aeeae353e0650413de6d9a118b89a0406`.
+
+| Phase | Execution boundary | Observed result |
+|---|---|---|
+| Claude | One print-mode call, `acceptEdits`, no persistent session, empty MCP config, explicit file and local-test tools, USD 1.00 cap | Exit 0 at USD 0.741367 with zero web requests. It changed only the task ledger/context, added `test/slug.test.cjs`, and allowed the hook to write disposable progress. `src/slug.cjs` and completion evidence remained untouched. The task test exited 1 with actual `hello,-world!` versus expected `hello-world`; both task surfaces read `in_progress`, and the Resume Note named the exact next action. |
+| Codex | One ephemeral `workspace-write` call with sandbox network disabled and no conversation from Claude | Exit 0. It found and read the installed `ultra-dev` Skill, recovered the single task from Git and `.ultra/`, reproduced the same red, changed only the intended implementation, then passed the task test 1/1 and `npm test` 2/2. It wrote the three-command canonical evidence record and logs, completed both task status surfaces, and filled Completion and the final Resume Note. |
+| Independent check | Local commands after both model calls | `node --test test/slug.test.cjs` passed 1/1, `npm test` passed 2/2, `git diff --check` passed, and a structural check confirmed one completed task, six evidence dimensions, three existing command-log references, and matching ledger/context state. |
+
+The Codex process emitted non-blocking diagnostics for an older local model-cache
+schema and an unauthenticated user-config MCP startup. No MCP result was consumed and
+no external effect occurred; all task actions used local file and shell tools. This
+means the drill proves file-backed Claude-to-Codex continuation even while Codex hooks
+remain untrusted, but it does not claim that arbitrary user configuration starts
+without unrelated host diagnostics.
+
+The result establishes one real end-to-end example of cross-host resume without a
+shared conversation, database, MCP authority, daemon, or generated prompt projection.
+It does not establish output quality for every model, host, repository, or task shape.
+Task-level `ultra-review` and commits were intentionally excluded from the drill so the
+two host calls tested only the handoff boundary.
+
+Two older `.ultra` evidence snapshots originally named the completed WIP by its former
+path. The current-path artifact contract requires every reference to resolve in the
+checkout, so those two references now point here while their 2026-08-01 status and
+limitations remain explicitly historical. The original WIP is still recoverable from
+their pinned source commit `3f99189bc68697262cd90444685ac2d4857139c4` with
+`git show`; the live `docs/wip/` directory contains no unfinished document.

package/docs/WORKFLOW-LIFECYCLE.md

@@ -132,3 +132,7 @@ the common entry contract and compares the working tree with those claims.
 
 This path remains valid when hooks and `ubp` are disabled. A compact snapshot may be
 used as a hint, then checked against canonical files and Git.
+
+An authenticated Claude-to-Codex continuation using this path passed on 2026-08-03;
+the exact scope, provenance, results, and limitations are recorded in the
+[runtime compatibility matrix](RUNTIME-COMPAT-MATRIX.md#authenticated-cross-host-continuation-evidence).

package/hooks/README.md

@@ -9,7 +9,7 @@ directory and exits silently when the workflow is not active.
 | `mid_workflow_recall.py` | Before source reads or edits | Restate current acceptance only |
 | `compact_context.py` | Before/after compaction | Save and restore a disposable snapshot derived from files and Git |
 | `post_edit_guard.py` | After edits | Record mechanical evidence observations without deciding completion |
-| `block_dangerous_commands.py` | Before shell execution | Block a narrow named external effect until the exact command is owner-authorized |
+| `block_dangerous_commands.py` | Before shell execution | Advise on additive protected-branch publication; block history rewrites and a narrow destructive set until the exact command is owner-authorized |
 
 `_common.py` is a shared library, not a lifecycle registration. Compact snapshots and
 progress observations live under ignored `.ultra/.runtime/` or `.ultra/progress/`; the
@@ -18,5 +18,7 @@ canonical semantic facts remain the owner-readable files and Git.
 Claude Code runs the hooks directly. Codex, Kimi Code, and Grok Build use the small
 wire adapters under `hooks/adapters/`. OpenCode calls the same scripts from its native
 JavaScript plugin. A hook failure is advisory except for the explicitly classified
-external effects in `block_dangerous_commands.py`, whose denial includes a reachable
-SHA-256-scoped authorization path.
+destructive effects in `block_dangerous_commands.py`, whose denial includes a reachable
+SHA-256-scoped authorization path. Additive protected-branch publication stays advisory
+because portable hooks cannot consume every host's trusted owner-approval receipt;
+history rewrites and branch deletion remain guarded.

package/hooks/block_dangerous_commands.py

@@ -7,11 +7,88 @@ import hashlib
 import json
 import os
 import re
+import shlex
 import subprocess
 
 from _common import emit_context, project_root, read_payload
 
 
+APPROVAL_VAR = "UBP_DANGEROUS_COMMAND_APPROVED"
+APPROVAL_PREFIX = re.compile(rf"^\s*{APPROVAL_VAR}=\S*\s+")
+
+HEREDOC = re.compile(
+    r"<<-?\s*(['\"]?)(?P<tag>[A-Za-z_]\w*)\1(?P<rest>[^\n]*)\n(?P<body>.*?)^\s*(?P=tag)\s*$",
+    re.DOTALL | re.MULTILINE,
+)
+# Commands whose heredoc is a payload rather than a script. Deliberately short: an
+# unlisted sink keeps its body in scope, so the cost of an omission is a false positive,
+# never a missed effect.
+DATA_SINK = re.compile(r"\bgit\s+(?:commit|tag|notes)\b", re.IGNORECASE)
+SEARCH_COMMANDS = {"egrep", "fgrep", "grep", "rg"}
+SHELL_CONTROL = {";", ";;", "&", "&&", "|", "||", "(", ")", "\n"}
+
+
+def strip_data_heredocs(command: str) -> str:
+    """Drop heredoc bodies that are data for a known sink.
+
+    Describing an effect inside a commit message is not performing it, and a message
+    that mentions one used to be blocked as though it did.
+
+    Bodies are kept whenever they might be executed: an interpreter reading a heredoc
+    runs it, so stripping there would make quoting style a way around this gate. The
+    body survives unless the delimiter is quoted, the segment introducing it is a
+    listed data sink, and nothing on the heredoc's own line pipes it somewhere else.
+    An unquoted delimiter performs parameter, command and arithmetic expansion before
+    the sink receives the data, so its body remains executable shell input.
+    """
+    def resolve(match: re.Match) -> str:
+        segment = re.split(r"\|\||&&|[;&|\n]", command[:match.start()])[-1]
+        if (
+            not match.group(1)
+            or "|" in match.group("rest")
+            or not DATA_SINK.search(segment)
+        ):
+            return match.group(0)
+        tag = match.group("tag")
+        return f"<<{tag}\n{tag}"
+
+    return HEREDOC.sub(resolve, command)
+
+
+def effect_of(command: str) -> str:
+    """The command reduced to what it actually does.
+
+    Strips an inline approval assignment, then any heredoc body that is data for a
+    known sink. What remains is the effect: the part worth classifying and hashing.
+
+    The digest must identify the *effect*, not the spelling of the retry. Without this,
+    prepending the variable changes the command text, which changes the digest, which
+    means the quoted digest is never the one that matches -- the repair path is a loop.
+
+    The assigned value is discarded on purpose. Only the process environment authorizes,
+    because the command string is composed by the model and honouring an inline value
+    would let it approve itself.
+    """
+    return strip_data_heredocs(APPROVAL_PREFIX.sub("", command, count=1))
+
+
+def is_inert_search(command: str) -> bool:
+    """Return true when a search query is data, not executable shell input."""
+    if any(marker in command for marker in ("$(", "<(", ">(", "`")):
+        return False
+    try:
+        lexer = shlex.shlex(command, posix=True, punctuation_chars=";&|()\n")
+        lexer.whitespace = " \t\r"
+        lexer.whitespace_split = True
+        lexer.commenters = ""
+        tokens = list(lexer)
+    except ValueError:
+        return False
+    if not tokens or any(token in SHELL_CONTROL for token in tokens):
+        return False
+    return os.path.basename(tokens[0]) in SEARCH_COMMANDS
+
+
 def protected_push(command: str, root) -> bool:
     if not re.search(r"\bgit\s+push\b", command, re.IGNORECASE):
         return False
@@ -24,9 +101,26 @@ def protected_push(command: str, root) -> bool:
     return result.stdout.strip() in {"main", "master", "production", "prod"}
 
 
+def destructive_protected_push(command: str, root) -> bool:
+    """Detect history rewrites or deletion, not ordinary additive publication."""
+    if not protected_push(command, root):
+        return False
+    match = re.search(r"\bgit\s+push\b", command, re.IGNORECASE)
+    if match is None:
+        return False
+    segment = re.split(r"\|\||&&|[;&|\n]", command[match.end():], maxsplit=1)[0]
+    force_or_delete = re.search(
+        r"(?:^|\s)(?:-f|--force(?:-with-lease(?:=\S+)?|-if-includes)?|--delete)(?=\s|$)",
+        segment,
+        re.IGNORECASE,
+    )
+    forced_refspec = re.search(r"(?:^|\s)(?:\+\S+|:\S+)(?=\s|$)", segment)
+    return force_or_delete is not None or forced_refspec is not None
+
+
 def classify(command: str, root) -> str | None:
-    if protected_push(command, root):
-        return "protected branch push"
+    if destructive_protected_push(command, root):
+        return "protected branch history rewrite or deletion"
     if re.search(r"\b(?:drop\s+(?:table|database|schema)|truncate\s+(?:table\s+)?)\b", command, re.IGNORECASE):
         return "destructive database operation"
     if re.search(r"\b(?:cast\s+send|solana\s+transfer|bitcoin-cli\s+send|near\s+send|aptos\s+move\s+run)\b", command, re.IGNORECASE):
@@ -42,7 +136,14 @@ def classify(command: str, root) -> str | None:
     return None
 
 
-def advisory(command: str) -> str | None:
+def advisory(command: str, root) -> str | None:
+    if protected_push(command, root):
+        return (
+            "Ultra observed a protected branch push. This portable hook cannot receive "
+            "the host's trusted owner-approval receipt, so it does not replace the host's "
+            "native authority flow. Proceed only after explicit owner authorization and "
+            "verify the remote result."
+        )
     if re.search(
         r"\b(?:alembic\s+upgrade|prisma\s+migrate|knex\s+migrate|sequelize\s+db:migrate|rails\s+db:migrate|manage\.py\s+migrate)\b",
         command,
@@ -65,19 +166,24 @@ def main() -> int:
     command = tool_input.get("command")
     if not isinstance(command, str) or not command.strip():
         return 0
-    threat = classify(command, root)
+    effect = effect_of(command)
+    if is_inert_search(effect):
+        return 0
+    threat = classify(effect, root)
     if threat is None:
-        note = advisory(command)
+        note = advisory(effect, root)
         if note:
             emit_context("PreToolUse", note)
         return 0
-    digest = hashlib.sha256(command.encode()).hexdigest()
-    if os.environ.get("UBP_DANGEROUS_COMMAND_APPROVED") == digest:
+    digest = hashlib.sha256(effect.encode()).hexdigest()
+    if os.environ.get(APPROVAL_VAR) == digest:
         return 0
     reason = (
-        f"Ultra blocked {threat}. Protected effect: the exact shell command. "
-        f"After explicit owner authorization, rerun with "
-        f"UBP_DANGEROUS_COMMAND_APPROVED={digest}."
+        f"Ultra blocked {threat}. Protected effect: the exact shell command, "
+        f"digest {digest}. Authorization comes from the owner's environment, never from "
+        f"the command text. Either run it yourself, or export "
+        f"{APPROVAL_VAR}={digest} in the environment that launches the agent and ask "
+        f"again. Prefixing the assignment onto this command does not authorize it."
     )
     print(json.dumps({
         "decision": "block",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra-builder-pro-cli",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "description": "File-first Ultra Builder Pro workflows for Claude Code, OpenCode, Codex CLI, Kimi Code, and Grok Build.",
   "bin": {
     "ultra-builder-pro-cli": "bin/install.js",

package/skills/ultra-change/SKILL.md

@@ -16,6 +16,10 @@ disagreement instead of resolving it.
 2. Read `CONTEXT.md` for vocabulary and `.ultra/decisions/` for entries in scope.
 3. Read `.ultra/north-star.md` — a Change that does not serve it is worth
    questioning out loud before it is written down.
+4. Grep `.ultra/changes/archive/` for Changes that already touched this area. Read
+   `delivery.md` when present; otherwise read `archive-summary.md`, `verification.md` and
+   remaining owner-readable Markdown. A missing `delivery.md` does not mean no history;
+   a module that keeps reappearing is an architecture signal.
 
 ## Whether this skill applies at all
 
@@ -59,8 +63,14 @@ Sort what you find into three buckets, each with your recommended disposition:
 | Code implements it, no specification says so | Built and unpromised |
 | Both speak and they conflict | Contradictory |
 
-Take the buckets to the owner. This is confirmed rather than assumed, because a
-disposition can quietly be a REDUCTION.
+Take the buckets to the owner — confirmed rather than assumed, because a
+disposition can quietly withdraw a commitment. Sort by risk first and match the
+asking to it: anything that touches a `HC-<n>` hard constraint or removes
+something already promised goes one at a time with your recommendation; the
+remaining low-risk rows go as a single list with a recommended disposition each,
+for one confirmation. Twenty separate questions about rows that change nothing
+spends the owner's attention where it was not needed, and trains them to approve
+without reading.
 
 ## Write the intent
 
@@ -86,16 +96,24 @@ reconciliation justified, possibly a `.ultra/decisions/<id>.md`, and any
 vocabulary update. Recommend `ultra-research` for a real evidence gap or
 `ultra-plan` once the contract is evidenced enough; do not invoke either.
 
+## Abandoning a Change
+
+A Change that turns out to be the wrong thing to build exits by
+`git mv .ultra/changes/active/<id> .ultra/changes/abandoned/<id>`, plus one line in
+its `intent.md` saying why. Completed tasks keep their evidence; the work is
+unlinked from the frontier, not deleted. This is the owner's call and a cheap one —
+a Change kept alive to avoid admitting it was wrong poisons every later
+reconciliation, which then measures the code against promises nobody intends to keep.
+
 ## When the owner decides
 
-Every non-empty bucket, the Change boundary, and anything reconciliation turns up
-that shrinks a prior commitment. A change that makes no specification sentence
-false needs no permission at all.
+Every non-empty bucket, the Change boundary, abandonment, and anything
+reconciliation turns up that shrinks a prior commitment. A change that makes no
+specification sentence false needs no permission at all.
 
 ## References
 
 - `../ultra-grilling/SKILL.md` — the loop for settling the boundary.
 - `references/change-contract.md` — exact `intent.md` structure and profile fields.
-- `../ultra-think/references/autonomy-boundary.md` — read before dispositioning a
-  bucket in a way that removes something already promised.
+- `../ultra-think/references/autonomy-boundary.md` — read before removing a promise.
 - `../ultra-tdd/SKILL.md` — read for an evidenced one-slice correction.

package/skills/ultra-change/references/change-contract.md

@@ -31,6 +31,10 @@ stable enough to survive a fresh session.
 
 ## Planning Posture
 <EXPAND | SELECTIVE | HOLD | REDUCE, rationale, and owner confirmation>
+<!-- Scope for this Change only. Not the commitment classification: REDUCE here
+     means "plan less work now", while a REDUCTION in a Change Log means "a
+     promise the specification already made no longer holds". -->
+
 
 ## Recovery
 <reversal or recovery path and its verification>
@@ -45,8 +49,10 @@ heading, and do not add another file that restates the same contract.
 ## Contract fields
 
 - `outcome`: one externally observable result.
-- `acceptance`: stable ids with a criterion and exact verification for each accepted
-  behavior.
+- `acceptance`: stable ids, one criterion each, and a `Verification` that is an
+  **executable command** — something with an exit code, not a description of an
+  intention. `curl -sf localhost:3000/health` qualifies; "check that the endpoint
+  responds" does not.
 - `non_goals`: explicit boundaries that prevent accidental scope growth.
 - `public_seams`: entry points or outputs through which acceptance is observed.
 - `recovery`: a bounded reversal or recovery strategy and its verification.
@@ -55,6 +61,26 @@ heading, and do not add another file that restates the same contract.
 Resolve every blocking decision before planning. Keep non-blocking uncertainty visible
 in the task and verification contracts.
 
+## Why verification has to be executable
+
+A criterion whose verification cannot be run is not acceptance, it is a wish. Three
+consumers downstream depend on it being runnable:
+
+- task development can treat passing acceptance as an exit condition only when
+  something can actually decide "passing";
+- the review tests lens maps each acceptance claim to executable evidence, and can
+  only report an honest gap when there is something to map onto;
+- delivery cannot otherwise separate "shipped" from "believed shipped".
+
+Writing the command is also the cheapest way to find out that a criterion is vague.
+"The feature is wired up" resists a command until it becomes "this export has a
+non-test importer", which is a `grep`.
+
+Where a criterion is genuinely a judgement call — visual polish, wording, feel — it
+does not belong in Acceptance at all. Record it as a taste decision for the owner and
+keep Acceptance to what a machine can settle. Mixing the two is what makes an
+acceptance set undecidable.
+
 ## Profile
 
 - `quick`: one low-risk task, no material risk flags, and no research dependency.

package/skills/ultra-delegate/SKILL.md

@@ -21,6 +21,8 @@ semantic synthesis and remains the only writer of `.ultra/tasks.json`.
   spec digests remain unchanged.
 - The worker terminates as `finished`, `blocked` or `failed` in a schema-valid
   `result.json`; declared paths equal the actual Git diff and stay in writable roots.
+- No `writable_roots` entry is `.ultra/` or sits under it, and the actual diff touches
+  nothing there.
 - Timeout and cancellation reach a terminal failed result and release `run.lock`.
 - The primary host verifies the result against the delegated workflow's acceptance.
 
@@ -34,6 +36,11 @@ Write under `.ultra/.runtime/delegations/<id>/`:
 
 `writable_roots` is an array of existing worktree-relative directories. An empty array
 selects native read-only mode; one or more roots selects bounded write mode.
+**Neither `.ultra/` nor any path under it may appear in it.** The worktree carries a
+checkout of `.ultra` because Git tracks it, but the project's memory has exactly one
+writer. Two workers appending to `tasks.json`, `progress/` or `evidence/` in separate
+worktrees collide in the very files every later session reads to resume. Worker findings
+and state changes travel back in `result.json` and are applied by the primary host.
 `external_effects` must be empty in this portable launcher: commit, push, publish,
 deployment and other effects stay with the primary host. There is no `readable_roots`
 claim because the five host sandboxes do not share one mechanically enforceable read

package/skills/ultra-delegate/references/delegation-contract.md

@@ -12,8 +12,16 @@
 
 Fields are exact. Roots are normalized worktree-relative directories that already
 exist. An empty array selects native read-only mode; `.` deliberately grants the whole
-isolated checkout. Absolute paths, symlink escapes, unknown fields, `readable_roots`,
-and non-empty external effects are rejected.
+isolated checkout except `.ultra/`. Absolute paths, symlink escapes, unknown fields,
+`readable_roots`, `.ultra` or any path beneath it, and non-empty external effects are
+rejected.
+
+`.ultra/` is never writable by a worker under any root, `.` included. The project's
+memory has exactly one writer — the primary host — because two worktrees appending to
+`tasks.json`, `progress/` or `evidence/` collide in precisely the files a later session
+reads to resume. Enforced twice: the launcher rejects a `.ultra` root before the
+delegation starts, and the worker fails an actual diff that touches it with
+`unauthorized_write`.
 
 ## Model final response
 

package/skills/ultra-deliver/SKILL.md

@@ -18,7 +18,9 @@ separate effects; local readiness grants none of them automatically.
 
 ## Definition of done
 
-- Actual outcome, specifications, docs, tests and aggregate review have been reconciled.
+- Actual outcome, specifications, docs, tests and aggregate review have been reconciled,
+  with every documentation file checked against the actual diff rather than from memory.
+- Every changed export has a non-test consumer or a recorded owner disposition.
 - Every omitted stage is explicitly recorded with its evidence-based rationale.
 - Build and release checks have exact commands and real results.
 - The Change is archived with `git mv`, and rollback remains a normal Git operation.
@@ -34,13 +36,48 @@ against the resulting HEAD.
 
 1. Compare accepted intent and task traces with delivered behavior.
 2. Apply justified specification corrections; route any REDUCTION to the owner.
-3. Update CHANGELOG and README when public behavior changed. Record bounded debt only
-   in the active Change `delivery.md` under `## Technical Debt`.
+3. Reconcile every document against the actual diff, not only the ones you remember
+   touching. List the repository's documentation files, read the Change's full diff, and
+   repair each place a document now describes behavior that no longer exists. CHANGELOG
+   and README are the usual ones, but a stale example in a guide, a renamed flag in a
+   runbook and an obsolete field in an API note drift the same way and are found the
+   same way. Record bounded debt only in the active Change `delivery.md` under
+   `## Technical Debt`.
 4. Run the repository's build and packaging checks.
 5. Determine the version impact from the public contract and project convention.
 6. Follow `references/baseline-reconciliation.md` and write the one canonical active
    Change `delivery.md` with exact checks, residual risks, omissions and rollback.
 
+Step 3 is the **exit** reconciliation and does not duplicate `ultra-change`'s entry
+reconciliation. Entry asks whether the specifications already disagreed with the code
+before this Change was written; exit asks which documents this Change just made wrong.
+One keeps the intent from inheriting drift, the other keeps the Change from leaving new
+drift behind.
+
+## The one delivery gate
+
+This gate applies only after the owner explicitly invokes `ultra-deliver`; it does not
+attach itself to ordinary repository packaging outside this workflow.
+
+Everything else in this workflow reports and hands over. This is the exception, and it
+is deliberately narrow:
+
+**Do not package while an export this Change added or changed has no non-test consumer
+and no recorded owner disposition.**
+
+| | |
+|---|---|
+| Invariant | Every changed export is either reachable from a non-test caller or explicitly declared internal |
+| Fact source | The Wiring Verification results in `.ultra/test-report.json`, bound to the current HEAD — the audit already found these; this is not a fresh opinion |
+| Blocked effect | Packaging and the release effects after it. Local commit and archival are untouched |
+| Repair | Wire the export to its caller, or record the owner's disposition in `delivery.md` naming it internal-only and why. Either one clears the gate |
+
+"Written but never connected" is the single defect that passes every other check: tests
+green, review clean, evidence complete, feature absent. An advisory here would be
+ignored exactly when it matters, because everything else already reads as done. The gate
+sits at the last step rather than at edit time on purpose — a gate early in the loop
+gets escaped by damaging the work.
+
 ## Archive locally
 
 Move `.ultra/changes/active/<id>` to `.ultra/changes/archive/<id>` with `git mv` only

package/skills/ultra-dev/SKILL.md

@@ -42,16 +42,37 @@ Follow `../ultra-tdd/SKILL.md`, writing tests only on the seams the plan already
 confirmed, one slice at a time. Do no refactoring here — `ultra-review` owns it,
 because what is worth restructuring only becomes visible after several slices.
 
+## Converge on the task-scoped acceptance set
+
+Development ends when the task's acceptance commands pass, not when the code looks
+finished. Resolve the context's **Change Acceptance IDs** against the active `intent.md`
+and use each named row's executable `Verification`. Commands under the context's
+Acceptance Criteria may add task-local checks; they do not replace the Change mapping.
+
+Run one baseline before repairing anything. Track the best-ever passing set of mapped
+IDs and task-local commands, the total repair rounds, and consecutive rounds that add
+nothing to that set. The loop has three explicit exits:
+
+| Exit | Condition | Action |
+|---|---|---|
+| Converged | Every mapped Change verification and task-local command exits zero | Close out below |
+| Stalled | Two consecutive repair rounds add no new item to the best-ever passing set, or three repair rounds finish without convergence | Stop; report the remaining criteria and what each repair tried |
+| Unreachable | A command did not start because its executable, fixture, service or declared environment prerequisite is unavailable | Stop that criterion; report the missing prerequisite and its repair path |
+
+A nonzero exit normally means a failing criterion, not an unreachable one; inspect its
+output. A regression never shrinks the best-ever set, and the total round limit stops
+oscillation where different criteria alternate between pass and fail.
+
 ## Answer the six evidence dimensions
 
 Each has a rule you can check against the work rather than assert:
 
 | Dimension | Answered when |
 |---|---|
-| `tests_written` | This diff changes a test file |
+| `tests_written` | This diff adds or changes at least one assertion — touching a test file is not enough |
 | `tests_passed` | The last test run exited zero and covered the files this diff touched |
 | `persistence_real` | On any path that stores data, the test uses real storage or a container |
-| `feature_flags_audit` | No flag this task added defaults to off |
+| `feature_flags_audit` | No flag on this change's execution path defaults to off, including flags this task did not add but now depends on |
 | `vertical_slice` | One test's execution path runs from the entry point through to persistence |
 | `spec_trace` | The anchor the task's `trace_to` names exists in the specification |
 
@@ -92,9 +113,7 @@ as it stands and says so in the Resume Note instead of tidying it away.
 
 ## References
 
-- `../ultra-tdd/SKILL.md` — read before the first test, for the seam and the mock
-  boundary.
-- `../ultra-think/references/autonomy-boundary.md` — read the moment the
-  specification and the implementation disagree.
+- `../ultra-tdd/SKILL.md` — read before the first test, for the seam and mock boundary.
+- `../ultra-think/references/autonomy-boundary.md` — read when spec and code disagree.
 - `../ultra-review/SKILL.md` — read when implementation evidence is ready for review.
 - `references/debugging.md` — read for a reproduced failure before selecting a repair.

package/skills/ultra-grilling/SKILL.md

@@ -22,18 +22,37 @@ have answered by reading the repository spends the one input only they can give.
 
 ## Definition of done
 
-- Every branch reachable from the original ask is resolved, or deferred with the
-  reason recorded.
-- Each resolved branch carries the owner's confirmation in their own words,
-  rather than something that sounded like agreement.
+- Every field the caller named as required is either answered in the owner's own
+  words or explicitly deferred with the reason recorded. "Every branch of the
+  tree" is not something you can check against a file; the caller's field list is.
+- The reframe below was put to the owner and either confirmed or corrected. It is
+  never skipped because the original wording sounded clear.
+- Each answer carries the owner's confirmation, rather than something that
+  sounded like agreement.
 - The calling skill holds a decision list it can write to a file: one line per
   decision, each with the options rejected and why.
 
-## Extract first, then ask
+## Extract, reframe, then ask
 
-Restate what the owner already told you and ask them to confirm the restatement.
-Ask only about what is genuinely missing. Re-asking something they answered
-teaches them that answering does not stick.
+**Extract.** Restate what the owner already told you and ask them to confirm the
+restatement. Ask only about what is genuinely missing. Re-asking something they
+answered teaches them that answering does not stick.
+
+**Reframe.** The owner describes a *form* when they want a *role*. Say what you
+believe they actually want, name the gap against their wording, and end on a
+question:
+
+> You said a daily briefing app. What you described is a personal chief of staff
+> — the briefing is one of its outputs, not the thing itself. Have I got that
+> right?
+
+This is what separates the loop from a questionnaire. A form accepted at face
+value yields a specification that is internally consistent and builds the wrong
+product. Offer the reframe, never assert it, and treat a correction as the better
+outcome — "no, it really is just the briefing" is a constraint you did not have a
+minute ago. Read `references/reframing.md` for when it applies and how it fails.
+
+**Then ask** only what the confirmed reframe leaves open.
 
 ## One question per turn
 
@@ -44,14 +63,27 @@ the load-bearing one skipped.
 Every question carries your recommended answer and what would change it. A
 question without a recommendation hands your own work back to the owner.
 
-Order questions so that answering one unlocks the next, and prefer the ones whose
-answer changes what gets built:
+Order questions so that answering one unlocks the next. Ask the framing questions
+before the detail questions — a detail settled inside the wrong frame has to be
+asked again.
+
+**Framing questions** come first — at most five, from the table in
+`references/reframing.md`. They refuse the owner's framing on purpose, which is
+how they surface what the request left out. Stop early once the frame stops
+moving.
+
+**Detail questions** fill in the confirmed frame:
 
 - What happens when this goes wrong, and how would we find out?
 - Which of these options is cheaper to reverse?
 - What are we deliberately not doing?
 - What does done look like, concretely enough to check?
 
+An answer counts once it is specific enough to **rule something out**. "It should
+be fast" rules nothing out; "the list renders before they finish typing" does.
+When an answer rules nothing out, ask what would have to be true for the owner to
+*reject* a candidate solution.
+
 Skip what you can derive, what does not change the work, and what they already
 settled.
 
@@ -61,19 +93,26 @@ This whole skill is owner-facing, so the boundary is narrow: hold the loop open
 until each decision is confirmed explicitly, and start no implementation on an
 inferred consensus.
 
-Where the host cannot present a structured question, ask one plain question per
-turn instead. Where it cannot ask at all, stop at the last confirmed decision,
-record what remains open, and hand that back to the caller — neither guessing an
-answer nor blocking the owner's next move.
+## How the loop ends
+
+Every ending hands back the same artifact: the decisions written one per line,
+each with the options rejected and the reason they lost. The caller chooses where
+it lands — `north-star.md`, `discovery.md`, a Change intent, or a decision file.
 
-## Hand back a list
+- **Resolved** — every required field answered or explicitly deferred.
+- **Stalled** — two consecutive turns add no newly confirmed decision. Hand back
+  the open fields and what each one blocks.
+- **Unavailable** — the host cannot ask, or the owner stopped answering. Hand back
+  the last confirmed state, every unanswered field named.
 
-Once the tree is walked, write the decisions out one per line, each with the
-rejected options and the reason they lost. That list is the record. The caller
-chooses where it lands: `north-star.md`, `discovery.md`, a Change intent, or a
-decision file.
+A loop with no exit traps the owner as much as you: re-asking what they cannot
+currently answer costs more than deferring it. Deferral is a recorded outcome,
+not a failure. Where the host has no structured question surface, ask one plain
+question per turn instead.
 
 ## References
 
+- `references/reframing.md` — read before the first question: when to reframe,
+  how it fails, the five framing questions, and what counts as an answer.
 - `../ultra-think/references/autonomy-boundary.md` — read when an answer removes
   something the specification already promised, or otherwise crosses C5.

package/skills/ultra-grilling/references/reframing.md

@@ -0,0 +1,72 @@
+# Reframing: recovering the role from the form
+
+An owner fluent in their own domain still describes a **form** when what they
+want is a **role**. They are not being vague; they are naming the nearest thing
+they can picture. Taken at face value, that name produces a specification that is
+internally consistent and builds the wrong product.
+
+## When to reframe
+
+Most first asks qualify. Any one of these is enough:
+
+- the request names an artifact — an app, a dashboard, a bot, a script — rather
+  than an outcome;
+- the request names a solution whose problem has not been stated;
+- the request would be satisfied by something far smaller, or is impossible as
+  worded;
+- two readings of the request would lead to materially different builds;
+- the request describes what a competitor has, rather than what the owner needs.
+
+## How to put it
+
+State what you believe they want, name the gap against the words they used, and
+end on a question:
+
+> You said a daily briefing app. What you described is a personal chief of staff
+> — the briefing is one of its outputs, not the thing itself. Have I got that
+> right?
+
+Rules that keep this honest:
+
+- **One reframe at a time.** Two competing reinterpretations in one turn is a
+  quiz, and the owner will pick the one that sounds more flattering.
+- **Offer it, never assert it.** A reframe is a hypothesis about their intent,
+  and they are the only authority on it.
+- **A correction is the better outcome.** "No, it really is just the briefing" is
+  a constraint you did not have a minute ago. Record it as a decision.
+- **Never reframe toward what is easier to build.** If your reinterpretation
+  happens to shrink the work, say that out loud and let the owner weigh it.
+- **Stop after two rejected reframes.** A third is no longer listening. Take the
+  owner's framing as given and move to the framing questions below.
+
+## Framing questions
+
+These refuse the owner's framing on purpose, which is how they surface what the
+request left out. Ask at most five, and stop early once the frame stops moving.
+
+| Question | What it recovers |
+|---|---|
+| What do you do today, without this? | The real job, with the proposed form stripped off |
+| What would make you say this was a waste of effort? | Success via its negative — people picture failure far more concretely than they picture success |
+| What must never happen, even if it would work better? | The hard constraints they were never going to volunteer |
+| If it could only do one thing and you would still use it, which? | Core against periphery, before scope has a chance to spread |
+| Whose situation gets worse when this exists? | Stakeholders, and the constraints attached to them |
+
+Two of these are worth their place for a specific reason. Asking for success
+directly gets an aspiration; asking what would make it a waste gets a threshold.
+Asking who is made worse off surfaces the constraints an owner never thinks to
+state, because to them they are simply how the world is.
+
+## What counts as an answer
+
+An answer counts once it is specific enough to **rule something out**.
+
+| Not yet an answer | An answer |
+|---|---|
+| "It should be fast" | "The list renders before they finish typing" |
+| "It should be secure" | "A support agent must never see a full card number" |
+| "Keep costs reasonable" | "Under fifty dollars a month in API spend" |
+
+When an answer rules nothing out, do not re-ask the same question louder. Ask
+what would have to be true for the owner to **reject** a candidate solution — the
+rejection criterion is the constraint, stated from the other side.

package/skills/ultra-init/SKILL.md

@@ -26,6 +26,11 @@ or refute. A technology choice is a claim, so it is not initialization's busines
 ## Definition of done
 
 - `.ultra/north-star.md` carries the owner's one-line goal in their own words.
+- Every `## Hard Constraints` entry has a stable `HC-<n>` id and can veto a
+  concrete technical decision. "Should be usable" vetoes nothing and is not yet a
+  constraint; "first paint under two seconds" is. Same bar for the success
+  metric: a threshold, not an aspiration. See
+  `../ultra-grilling/references/reframing.md` for what counts as an answer.
 - Every file listed under **What gets written** exists; you read each one back
   after writing and stopped at the first one missing.
 - `.git` exists. Any initial commit is a separately authorized delivery effect.
@@ -56,7 +61,7 @@ genuinely missing. Five things come out of it:
 |---|---|
 | What you want to build, in one sentence, their words | `north-star.md`, `## One-line` |
 | What counts as success | `specs/product.md`, behavioral requirements and acceptance |
-| What must never happen | `north-star.md`, `## Hard Constraints` |
+| What must never happen | `north-star.md`, `## Hard Constraints`, one `HC-<n>` per line |
 | Who uses it, and how they cope today | `discovery.md`, marked as the owner's statement |
 | **What you already know you are unsure about** | `discovery.md` — research's priority queue |
 
@@ -76,7 +81,7 @@ placeholders from verified facts and owner decisions.
 .ultra/specs/{product,architecture,discovery}.md    ## Observed, ## Decisions, ## Unknowns
 .ultra/tasks.json                                   {"tasks": []}
 .ultra/test-report.json                             not-yet-run report with git_commit
-.ultra/contexts/  .ultra/decisions/  .ultra/evidence/
+.ultra/{contexts,decisions,evidence,research}/ and changes/{active,archive,abandoned}/
 CONTEXT.md                                          repository root, once a term is settled
 ```
 
@@ -99,8 +104,11 @@ authority that already exists and looks healthy is the owner's call, never a
 convenience on the way to a clean start — preserve it and report what you found.
 
 Where the host cannot ask at all, leave the one-line goal empty and say plainly
-that it is empty, that goal injection will therefore be empty, and that the next
-skill asks again. Do not infer it from the directory name.
+that it is empty. Do not infer it from the directory name. An empty one-line goal
+is a **blocking** state, not a note: goal injection, boundary read-back and a
+Change's touched-constraints field all read from it, so planning and development
+must not start until it is filled. Say that too, and recommend rerunning this
+skill on a host that can ask.
 
 ## References
 

package/skills/ultra-plan/SKILL.md

@@ -23,6 +23,10 @@ sessions and hosts; no runtime state decides whether the plan is meaningful.
 - The owner confirmed the scope posture and the seam list.
 - Every feature task is a tracer bullet touching at least two layers, unless the
   Change itself demonstrably touches only one layer.
+- Every context names the north-star hard constraints its work could violate, and
+  each `HC-<n>` it names resolves to a real entry in `.ultra/north-star.md`.
+- Every Change acceptance id maps to at least one task context, and every context id
+  resolves back to the active Change.
 - Coverage, dependency, trace, scope and context-budget checks have concrete results.
 
 ## Fix the planning posture
@@ -64,18 +68,27 @@ Each task records `id`, `title`, `type`, `priority`, `complexity`, `status`,
 splitting and context signal: 1–2 is local, 3–5 is bounded, 6–7 crosses a boundary,
 and complexity > 7 must split.
 
-Each context records Acceptance, confirmed seams, layers touched, target files,
-Implementation, verification commands, Definition of Drift, Change Log, Completion
-and Resume Note. Read every file back; task count and context count must match.
+Each context records Change Acceptance IDs, task-local Acceptance, confirmed seams,
+layers touched, target files, Implementation, verification commands, the hard
+constraints the work could violate, Definition of Drift, Change Log, Completion and
+Resume Note. Read every file back; task count and context count must match.
+
+Name a hard constraint whenever the task could plausibly breach it, not only when you
+expect it to. The entry costs one line and is what makes a later breach a checkable
+question instead of a judgement call; `none` is a legitimate answer for a task that
+touches nothing constrained.
 
 ## Verify the plan
 
-1. Map every in-scope user story or acceptance anchor to at least one task.
+1. Map every Change acceptance ID to at least one task context and reject dangling
+   context IDs. Map every in-scope user story or specification anchor to at least one task.
 2. Walk dependencies and repair every cycle with the exact cycle chain visible.
 3. Resolve every `trace_to` path and heading against a real file.
-4. Surface complexity, more than eight target files, or more than twenty tasks as
+4. Resolve every `HC-<n>` against `.ultra/north-star.md`. A dangling constraint id is
+   the same defect as a dangling `trace_to`: it reads as checked and never was.
+5. Surface complexity, more than eight target files, or more than twenty tasks as
    scope warnings; they are observations, not semantic verdicts.
-5. Estimate context at roughly `complexity × 5%`; surface anything above 40%.
+6. Estimate context at roughly `complexity × 5%`; surface anything above 40%.
 
 Report the graph, frontier, seams, warnings and first task. Recommend the next explicit
 capability from the files; do not invoke it.

package/skills/ultra-research/SKILL.md

@@ -39,6 +39,12 @@ The three checkpoints are `04-product-strategy`, `21-features-scope`, and
 recommendation, wait for the owner's decision, then continue. Other areas write their
 report and mapped section immediately without another ceremony.
 
+Areas sitting between two checkpoints are independent and may run in parallel through
+the host's native bounded subagents, each loading exactly one reference. That
+strengthens progressive disclosure rather than breaking it — the parent holds no step
+prompt at all. The checkpoints stay barriers: nothing after one starts until the owner
+has answered it, because its conclusion changes what the later areas are even asking.
+
 ## Investigate and write
 
 For each selected area:

package/skills/ultra-review/SKILL.md

@@ -28,8 +28,10 @@ happens here, after several slices make a useful structure visible, not inside T
 ## Run the lenses
 
 Use the host's native bounded subagents, in the background where available; otherwise
-run them sequentially. `review-spec` is always selected; select other lenses only when
-their evidence can change a verdict. Give each the packet path and digest,
+run them sequentially. **All six lenses are selected by default.** Skipping one requires
+a stated reason recorded in `SUMMARY.json` — "its evidence cannot change the verdict"
+is a judgement made before seeing the evidence, and left as a default it becomes a way
+to run less work rather than a considered choice. Give each the packet path and digest,
 `references/unified-schema.md`, and exactly one lens:
 
 - `references/code.md`
@@ -60,6 +62,28 @@ three or more files do so, write `UNRESOLVED.md` with `ARCHITECTURAL_CONCERN` an
 
 Report both axes, exact scope, checks, residual findings and any refactor performed.
 
+## Recheck across model families
+
+Six lenses are six angles from one model family, so they share blind spots: what all
+six miss, a seventh angle from the same family misses too. Independence comes from a
+different model, not from another lens.
+
+For a `major` Change, or one touching authorization, payments, personal data or
+migrations, recommend a cross-family recheck and wait for the owner's decision. Do not
+invoke `ultra-delegate` unless the owner has explicitly asked for another model or host
+for this review. Once that authority exists, follow `../ultra-delegate/SKILL.md`. For a
+`quick` profile, skip the recommendation and say so in the report.
+
+- Send the aggregated `SUMMARY.json` and the diff, **not** the raw lens artifacts. The
+  worker should form its own reading rather than grade this one.
+- Ask two things: which findings the evidence does not actually support, and what this
+  diff gets wrong that no finding mentions. The second question is why the recheck is
+  worth its cost.
+- A worker finding no local lens raised is a candidate, not a verdict. Verify it
+  against the source exactly as a lens finding is verified, and record its origin.
+- Disagreement is information, not a tie to break. `ultra-delegate` already forbids
+  turning a vote or a score into truth; record both readings with their evidence.
+
 ## When the owner decides
 
 The owner chooses risk acceptance, a scope reduction, or which stuck path to take.
@@ -70,4 +94,5 @@ Workers never edit source, task state or another lens artifact.
 - `references/unified-schema.md` — JSON contract shared by all lenses.
 - `references/worker-packet.md` — exact immutable input packet and digest procedure.
 - `references/review-modes.md` — choose task, Change, full, or delta scope.
+- `../ultra-delegate/SKILL.md` — read after the owner authorizes a cross-family recheck.
 - `../ultra-think/references/autonomy-boundary.md` — read before a fix reduces intent.

package/skills/ultra-test/SKILL.md

@@ -45,6 +45,11 @@ the owner decides what to fix or accept.
 6. **Security**: run the repository's dependency and security checks, then inspect the
    trust boundaries changed by this Change.
 
+The six are independent read-only audits and may run in parallel through the host's
+native bounded subagents. Each returns its findings; the parent writes the one report.
+A worker never writes `.ultra/test-report.json` itself — six writers on one canonical
+file is how a report loses findings.
+
 Read `references/export-syntax.md` before collecting exports. The table finds
 candidates; repository conventions and real consumers decide what is public.