ultra-builder-pro-cli 0.26.1 → 3.0.2

package/skills/ultra-status/SKILL.md

@@ -1,65 +1,179 @@
 ---
 name: ultra-status
-description: Infer the current Ultra workflow position, stale evidence, task risk, and installation health from repository files and host manifests. Use when the owner asks what is complete, blocked, stale, unhealthy, or useful to do next.
+description: Infer the current Ultra route, baseline gaps, stale evidence, task risk, and installation health from repository files and host manifests. Use when the owner asks what is complete, blocked, stale, unhealthy, or useful to do next.
 ---
 
 # Route from artifacts without changing them
 
-This router is read-only. It reports verified files, model inference and unavailable
-evidence separately, then recommends one explicit capability without invoking it.
+This router is read-only. It separates verified files, model inference, and unavailable
+evidence, then recommends one explicit public capability without invoking it. It never
+persists a workflow-position field.
 
 ## Before you start
 
-1. Read `.ultra/tasks.json` if present; read the active task's `context_file` and
-   closing `## Resume Note`.
-2. Read `CONTEXT.md` and relevant `.ultra/decisions/` entries when they exist.
-3. Inspect Git `HEAD`, worktree status, active/archive Change directories and installed
-   host manifests without repairing them.
+1. Read `../ultra-change/references/change-contract.md` and apply its **Active Change
+   authority resolution** before reading any active `intent.md` or relying on a current
+   `change_id`. A positively observed absent `.ultra` uses the existing `ultra-init`
+   route. Otherwise continue only from the rule's stable zero-or-one result; any typed
+   diagnostic stops routing until its stated repair or retry succeeds. With one active
+   Change, read `.ultra/tasks.json`, then tasks whose `change_id` matches it and the
+   frontier task's `context_file` and `## Resume Note`. `.ultra/tasks.json` is the sole
+   task-status authority. A Status or Complexity header in a legacy context is a
+   migration diagnostic; the ledger wins. Historical and abandoned tasks never define
+   the frontier.
+2. Read `.ultra/project-brief.md`, `.ultra/north-star.md`, `CONTEXT.md`, relevant
+   `.ultra/decisions/`, specifications, active, archived, or abandoned Changes, and
+   evidence. An abandoned Change supplies historical boundary and recovery context;
+   it never defines the current route.
+3. Inspect Git `HEAD`, worktree status, and installed host manifests without repair.
+4. When the active Change records a `durable work-package` Execution Grant, report it
+   as recorded authorization data — grant id, cited decision, and its recorded
+   subject, scope, topology, allowed effects, budgets, and invalidation — and state
+   plainly that stored grant text is inactive until a consuming Agent stably
+   verifies it per `../ultra-change/references/execution-grant.md`. Status itself
+   neither activates nor continues the grant; a `session-local` grant is reported as
+   requiring fresh owner activation.
 
 ## Definition of done
 
-- The artifact route below is evaluated in order and the matching evidence is named.
-- Stale test evidence, dirty worktree state and task graph risks are visible.
-- Installation health reports exact missing or drifted files without mutation.
-- The recommendation says why it follows; it does not launch the capability.
+- Evaluate the artifact route in order and name the evidence supporting the match.
+- Keep stale test evidence, dirty worktree state, baseline gaps, and task graph risks
+  visible without converting them into semantic failure.
+- Report exact installation drift and a reachable repair without mutating it.
+- Recommend one route and why; never launch it.
 
 ## Infer the route
 
-| Observable files | Recommendation |
+| Observable files and current need | Recommendation |
 |---|---|
 | No `.ultra/` | `ultra-init` |
-| Product specification missing or contains `[NEEDS CLARIFICATION]` | `ultra-research` |
+| Project Brief has no usable one-line and no legacy `## One-line` exists | `ultra-init` |
+| Project Brief or legacy seed exists and North Star status is `unresearched`, legacy, invalid, or not accepted for the current boundary | `ultra-research` |
 | A new request exists and no active Change exists | `ultra-change` |
-| An active Change exists and `.ultra/tasks.json` is missing or `tasks` is empty | `ultra-plan` |
-| A frontier task is pending or in progress | `ultra-dev`, naming the task |
-| All tasks completed and no current report | `ultra-test` |
-| `test-report.passed` is false | `ultra-dev`, with blocking findings |
-| Report passed and `git_commit` equals `HEAD` | `ultra-deliver` |
+| More than one active Change exists | Diagnose the conflicting directories and ask the owner which one remains active; do not route or move either automatically |
+| A primary-transfer handoff directory exists under `.ultra/.runtime/handoffs/` | Report its protocol state read-only (`offered`, `blocked`, `active`, or a terminal state) from `OFFER.json`/`ACK.json`/`RESULT.json`, verified with `node <ultra-change-skill-dir>/scripts/validate_primary_transfer.cjs <repository-root>`; receipts are derived observations, never authority |
+| An ACK-ready handoff has no terminal RESULT | The accepted receiver is the sole canonical writer for that work package; report the in-flight transfer and never route canonical writes to another Agent |
+| A handoff is `blocked` or its live re-verification is stale | Report the mismatched observation and the recovery path (fresh handoff id after owner re-confirmation); do not repair receipts |
+| The active intent is `draft` or has a blocking unresolved decision | `ultra-change` to finish and accept the contract |
+| The active `Research Disposition` names required exit evidence that is not satisfied | `ultra-research` for the named question and selected lenses |
+| Research evidence exists but the accepted intent has not reconciled it | `ultra-change` to update the bounded contract |
+| The accepted North Star revision or digest differs from the active intent trace | `ultra-change`; report the stale observation, preserve old evidence, and reconcile IDs before execution |
+| An active Change exists and `.ultra/tasks.json` has no tasks whose `change_id` matches it | `ultra-plan` |
+| The Change has exactly one `in_progress` task | `ultra-dev`, naming that task |
+| Only `pending` tasks remain (the frontier) | Report them as frontier candidates with their unresolved dependencies and recommend one exact task id for an explicit owner invocation of `ultra-dev`; a pending row is not active work and never auto-selects a route |
+| A ledger row says `completed` but its current `ultra-task-evidence-v2` record or task-review binding is missing, stale, or structurally invalid | `ultra-dev` to repair evidence and completion provenance; do not infer a context status or silently demote the row |
+| All matching tasks are completed, each has current `ultra-task-evidence-v2` plus a consumed task review, and no current report matches this Change | `ultra-test` |
+| A current false report has implementation, test, or wiring findings selected for repair | `ultra-dev` after owner disposition |
+| A current false report has missing external or product evidence selected for collection | `ultra-research` after owner disposition |
+| A current false report has an acceptance, scope, or existing-promise change selected for reconciliation | `ultra-change` after owner disposition; use `ultra-think` internally for one consequential trade-off |
+| Every current finding is explicitly accepted, deferred, or otherwise dispositioned | `ultra-deliver`, subject to its one orphan-export gate |
+| Report passed and all report identities match current files | `ultra-deliver` |
 | No active Change and no new request | Report the idle state; do not manufacture work |
 
-A report whose `git_commit` differs from `HEAD`, or whose recorded `worktree.diff_digest`
-differs from the result of resolving the installed `ultra-test` Skill and running
-`node <ultra-test-skill-dir>/scripts/worktree_digest.cjs --project <repository-root>`, is stale. A dirty
-worktree is a warning, not evidence of failure.
+An explicit `[NEEDS CLARIFICATION]` is evidence of an unresolved field, not proof that
+the entire project requires Research. Judge whether it can change the current boundary.
+Do not add `research_complete`, a score, or another state bit to replace that judgment.
+
+A test-report is stale when its `change_id` is not the active Change, its `task_ids` are not
+the exact ordered ids of tasks whose `change_id` matches that Change, `git_commit`
+differs from `HEAD`, or its `worktree.diff_digest` or `intent_digest` differs from
+running
+`node <ultra-test-skill-dir>/scripts/worktree_digest.cjs --project <repository-root> --change-id <change_id>`.
+A dirty worktree is a warning, not evidence of failure.
+The product-worktree digest has one fixed boundary: it excludes `.ultra/evidence/**`,
+whose command and external-observation entries bind raw bytes as
+`raw_evidence_sha256` before stable exact record bytes are bound as `evidence_digest`.
+Status must therefore use the exact ordered `task_evidence` projection and strict receipt
+consumers below for evidence provenance; it never adds another exclusion or treats
+excluded publication bytes as absent evidence.
+
+Freshness also requires the exact ordered `task_evidence` projection. Its
+`evidence_digest`, `task_review_session`, and `task_review_summary_digest` must match the
+current record and retained review — or, for an `external-manual` record, its
+`task_review_receipt_ref` and `task_review_receipt_digest` must match the current
+record and the bounded stable receipt bytes reverified through the sensor's
+`--verify-external-receipt` mode, and take its `--projection` output verbatim.
+Recheck whichever branch the record declares and never rewrite one branch into the
+other. For each item, take every command and
+external-observation `raw_evidence_ref` to bounded stable
+repository-contained bytes from an ordinary regular non-symlink file opened nonblocking
+and no-follow, with an 8 MiB ceiling and path/descriptor identity checks around the read.
+Recompute `raw_evidence_sha256` from that one snapshot and require an exact match, then
+recompute the stable exact `evidence.json` bytes as `evidence_digest` before comparing
+the projection. A raw or record mismatch routes to the owning task's explicit Dev repair.
+Run
+`node <ultra-plan-skill-dir>/scripts/validate_task_evidence.cjs <evidence-ref>`, and
+compare `task_id`, `schema`, `evidence_ref`, `task_review_session`, and
+`task_review_summary_digest` with the current ledger row, final evidence record, and
+retained strict task-review summary. The task evidence `subject` is an independently
+captured completion-snapshot freshness observation made after validated task Review and
+immediately before evidence publication. Its `task_review` separately binds the retained strict summary; neither Worker Packet v1 nor its nullable summary worktree digest proves
+the subject. Do not require that earlier observation to equal the report's later
+aggregate worktree digest. Recheck current Acceptance, criterion and verification type,
+owner record, review summary, and cited affected artifacts independently.
+
+Replay the report's strict aggregate review summary with the existing Review summary
+waiter, then run
+`node <ultra-test-skill-dir>/scripts/validate_review_transport.cjs --summary <summary-path> --report .ultra/test-report.json`.
+Require the exact `packet_digest`, `admission_digest`, `subject_digest`, and `summary_digest` bindings, plus session, summary path, execution mode, ordered findings, and report root subject.
+Each structural validator or sensor reports identity and provenance observations and never decides semantic acceptance, review quality, or `passed`.
+Any mismatch makes the report stale and routes repair to the responsible workflow.
+
+`passed: false` does not itself select a repair. Preserve each finding, ask for owner
+disposition where scope or risk changes, then route by the accepted response above.
+For a current task-review `REQUEST_CHANGES`, consume the exact validated current
+`SUMMARY.json.findings` array and preserve every finding id. Route every current P0/P1
+to resolution or authoritative disposition and refresh its affected evidence; never
+reuse a finding count or list from an older summary. P2 and P3 findings remain report
+entries or owner-selected backlog and never re-open a task on their own.
+Likewise, ledger completion and structurally valid v2 evidence are necessary for a
+current Test claim but never sufficient to manufacture `passed: true`. A validator
+reports schema, identity, provenance, and freshness observations only. It cannot decide
+whether an inspection supports a criterion, supply an `owner-judgment`, or turn an
+external receipt into product truth.
+
+Status remains read-only when later work invalidates a completed task. It names the
+affected criterion IDs and reason and recommends Dev. Dev records both in the context
+Change Log and Resume Note before the ledger-authoritative `completed` to `in_progress`
+transition; Status never silently demotes a task.
+
+A budget stop or `owner checkpoint` is displayed as-is: report the exhausted budget,
+the in-progress task it stopped, and the reachable owner decision (extend, retry,
+cancel, or abandon). Status never infers continuation, extension, or any semantic
+verdict from a budget stop, and never treats a pending frontier row as the active
+task behind one.
+
+The repository has one primary writer for canonical `.ultra` files. Native review
+workers and delegated CLIs may inspect or write isolated source roots, but their results
+return to that writer. Concurrent canonical writes require separate worktrees and
+explicit integration; this router does not invent locks or silently merge ledgers.
+
+Report the accepted North Star revision and digest, every active Change trace mismatch,
+and unresolved `FP-*`/`NS-*`/`HC-*` reference. A mismatch is stale evidence, never a
+mechanical verdict about truth or permission; supersession does not delete prior task,
+review, Test, or delivery evidence.
 
 ## Surface risk and installation health
 
-List unmet task dependencies, any `in_progress` task older than 3 days, complexity
-concentration and broken `trace_to` or `context_file` paths. These are sensors.
+List unmet task dependencies, more than one matching `in_progress` task under the
+single-writer contract, broken `trace_to` or `context_file` paths, stale subject or
+acceptance identities, unresolved task-review findings, and concrete evidence that a
+task can no longer resume reliably. A timestamp, complexity value, file count, or task
+count is context for the model, never a staleness or quality verdict.
 
-For installation health, compare the selected host's plugin path, skill inventory,
-version, provenance and hook manifest against the installed files. Report broken links
-and missing registrations. Recommend `ubp install` or `ubp update` as the reachable
-repair; this read-only skill never performs it.
+Compare the selected host's plugin path, skill inventory, version, provenance, and hook
+manifest with installed files. Recommend `ubp install` or `ubp update` as the repair;
+this read-only Skill never performs it.
 
 ## When the owner decides
 
-The owner chooses the next workflow, risk disposition and any reinstall. Contradictory
-file facts are reported as contradictions rather than silently selecting one.
+The owner chooses the next public workflow, risk disposition, and any reinstall.
+Contradictory facts remain visible instead of being resolved by routing heuristics.
 
 ## References
 
-- `../ultra-think/SKILL.md` — read only when contradictory evidence creates a real
+- `../ultra-change/references/change-contract.md` — canonical Active Change authority resolution.
+- `../ultra-think/SKILL.md` — read only when contradictory evidence creates one real
   decision rather than a mechanical repair.
 - `../ultra-think/references/autonomy-boundary.md` — read before recommending a route
   that would reduce an accepted commitment.

package/skills/ultra-tdd/SKILL.md

@@ -10,8 +10,17 @@ the loop that supplies it, and it serves Goal 3, Production-Ready.
 
 ## Before you start
 
-1. Read the current task context for the seams already confirmed during
-   planning. Tests live on those, and choosing a new one is a planning decision.
+1. When called from a planned Change, read
+   `../ultra-change/references/change-contract.md` and apply its **Active Change
+   authority resolution** before reading any active `intent.md`, resolving the current
+   `change_id` or task, reading its context, running the baseline, or executing red-green
+   product edits. A stable zero result stops with no current task; any typed diagnostic,
+   including non-unique authority, stops with its repair before the baseline, red-green,
+   or any product write. After one valid authority, read its intent, `.ultra/tasks.json`,
+   and the matching current task context for the seams confirmed during planning. For a
+   micro edit outside the Ultra lifecycle, no active task context is required; use the
+   accepted request, maintained specification, and an existing repository seam, and
+   create no Ultra task or delivery claim.
 2. Run the repository's existing test command once, unchanged, to see what
    passing currently looks like. Read `references/test-execution.md` before recording
    that run or any red/green evidence.
@@ -40,8 +49,8 @@ Write the failing test first and run it, so that red is observed rather than
 assumed. Then write the smallest code that turns it green. Predict no later
 tests and add no speculative capability. Then take the next slice.
 
-Refactoring is not part of this loop; `ultra-review` owns it, because the
-restructuring worth doing only becomes visible after three or four slices.
+Refactoring is not part of this loop; `ultra-review` owns it when observed duplication,
+coupling, or a boundary defect supplies evidence that restructuring is worthwhile.
 
 ## Three patterns that produce tests worth deleting
 
@@ -74,6 +83,7 @@ goes to the owner as one.
 
 ## References
 
+- `../ultra-change/references/change-contract.md` — canonical Active Change authority resolution.
 - `../ultra-think/references/autonomy-boundary.md` — read before replacing a real
   dependency with a fake, or when a test stands between the work and green.
 - `references/templates/README.md` — read when choosing which enabling template

package/skills/ultra-tdd/references/test-execution.md

@@ -11,8 +11,13 @@ For every baseline, red, and green run record:
 - runner-reported pass, fail, skip, and coverage counts when available;
 - first useful failure with tight source or test location;
 - whether it reproduces and whether it is product, test, environment, or flaky evidence;
-- raw output path under `.ultra/evidence/<task-id>/` when the output matters.
+- raw output path under `.ultra/evidence/<task-id>/` and the lowercase SHA-256 of its
+  exact bounded stable bytes when the output matters.
 
 Do not weaken flags, skip a relevant failure, edit test configuration to obtain green,
 or claim success when the command did not finish with exit zero. A concise evidence
 record may cite the raw log; it must not copy an entire transcript into task context.
+Before citing one, require a repository-contained ordinary regular non-symlink file,
+opened nonblocking and no-follow with an 8 MiB ceiling and unchanged path/descriptor
+identity around the read. Hash that one snapshot; a missing, escaped, special, symlinked,
+oversized, or replaced receipt is a typed evidence gap, not a successful run record.

package/skills/ultra-test/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ultra-test
-description: Audit whole-system integrity after the task ledger is complete by finding anti-patterns, coverage gaps, broken wiring, E2E failures, performance risk, and security risk. Use when preparing delivery or when locally green tasks may not form a working product.
+description: Audit whole-system integrity after tasks for the active Change are complete by finding anti-patterns, coverage gaps, broken wiring, E2E failures, performance risk, and security risk. Use when preparing delivery or when locally green tasks may not form a working product.
 ---
 
 # NOT for running unit tests (that's `ultra-dev`). This audits whole-system integrity before delivery.
@@ -11,23 +11,58 @@ the owner decides what to fix or accept.
 
 ## Before you start
 
-1. Read `.ultra/tasks.json` and every completed task's `context_file`, especially its
-   Acceptance, Completion and closing `## Resume Note`.
-2. Read `CONTEXT.md` for vocabulary and the relevant `.ultra/decisions/` entries.
-3. Read the active Change intent, the task evidence directories and the current Git
+1. If model-selected, verify the live execution grant in `../ultra-change/references/execution-grant.md` — a current session-local activation or a stably verified durable work-package grant; without either, stop.
+2. Read `../ultra-change/references/change-contract.md` and apply its **Active Change
+   authority resolution** before reading any active `intent.md` or resolving a current
+   `change_id`. This workflow requires its one valid active authority; any zero result
+   or typed diagnostic stops before audit input is read until the stated repair or retry
+   succeeds. Read `.ultra/tasks.json` and only tasks whose `change_id` matches the active
+   Change. Every matching task must be `completed` in that sole task-status authority.
+   Read each task's `context_file` Acceptance, Completion, Task Review and closing
+   `## Resume Note`.
+   Historical tasks are not part of this audit snapshot. For every current Change task,
+   require a current `ultra-task-evidence-v2` record whose context, subject, acceptance,
+   and task-review bindings satisfy `../ultra-plan/references/task-evidence-v2.md`.
+   A legacy context Status or Complexity header and v1 evidence remain migration
+   diagnostics only; recommend Dev repair rather than treating them as current Test input.
+3. Read `CONTEXT.md` for vocabulary and the relevant `.ultra/decisions/` entries.
+4. Read the active Change intent, the task evidence directories and the current Git
    `HEAD`; old output is evidence only for the commit it names.
-4. Resolve this loaded Skill's directory and run
-   `node <ultra-test-skill-dir>/scripts/worktree_digest.cjs --project <repository-root>`
-   before and after the audit. Its digest excludes
-   only `.ultra/test-report.json`, avoiding a self-referential report.
+   Resolve Change and task `FP-*`, `NS-*`, and `HC-*` IDs against the accepted North
+   Star revision. A stale trace is an explicit finding requiring reconciliation, not a
+   silent rewrite or automatic failure verdict.
+5. Resolve this loaded Skill's directory and run
+   `node <ultra-test-skill-dir>/scripts/worktree_digest.cjs --project <repository-root> --change-id <change_id>`
+   before and after the audit. It returns the stable Change id, exact intent SHA-256,
+   HEAD, and product-worktree digest. The product-worktree digest has one fixed boundary:
+   it excludes `.ultra/evidence/**`, whose command and external-observation entries bind
+   raw bytes as `raw_evidence_sha256` before stable exact record bytes are bound as
+   `evidence_digest`. It also excludes the report and
+   all active/archive/abandoned Change-directory metadata. Intent freshness is checked
+   separately, so publishing or refreshing evidence, writing delivery metadata, or moving
+   the same Change cannot self-invalidate its tested product snapshot. Exact task-evidence
+   and review-receipt digests remain mandatory through their existing consumers; this is
+   not a caller-configurable exclusion. This digest defines the aggregate Change subject
+   for the current whole Change; it is distinct from each task's earlier
+   completion-snapshot freshness observation.
 
 ## Definition of done
 
 - All six audit areas have an evidence-backed result or an explicit material omission.
 - Wiring lists each changed export and its non-test consumers; zero matches are visible
   as orphan findings.
-- `.ultra/test-report.json` records `git_commit`, commands, findings, omissions and the
-  owner's disposition without rewriting a finding into a pass.
+- `.ultra/test-report.json` records `change_id`, the exact current-Change `task_ids`,
+  `intent_digest`, `git_commit`, commands, findings, omissions and the owner's
+  disposition without rewriting a finding into a pass.
+- Every current task's v2 evidence and retained task-review summary is consumed; blocking
+  findings, resolutions, disagreements, and refresh references remain attributable.
+- One current aggregate Change review is referenced by session, packet digest, exact
+  admission and subject digests, execution mode, coverage, summary path, exact summary
+  SHA-256, and verdict.
+- The report names `ultra-review-findings-v4` and copies every review finding unchanged,
+  including `north_star_trace.first_principles`, `.serves`, and `.touches`, so each
+  finding carries its resolving `FP-*`/`NS-*`/`HC-*` IDs and Deliver can
+  test evidence against outcome without copying the North Star prose.
 
 ## Audit six areas
 
@@ -53,6 +88,95 @@ file is how a report loses findings.
 Read `references/export-syntax.md` before collecting exports. The table finds
 candidates; repository conventions and real consumers decide what is public.
 
+After the six areas, follow `../ultra-review/SKILL.md` for an aggregate Change review.
+Read only its validated summary, preserve its findings, and carry the review session,
+packet digest, admission digest, subject digest, execution mode, coverage refs, summary
+ref, verdict, and limitations into the report. Record
+`review.finding_schema: "ultra-review-findings-v4"`; copy each finding
+object unchanged from the v4 summary, including `north_star_trace`. An incomplete review
+stays an omission; it never becomes a silent pass. Historical v3 review is evidence only:
+run a fresh v4 aggregate review before a current Test claim.
+
+Before accepting copied review metadata or findings, replay the exact frozen
+`SUMMARY.json` through the sibling `ultra-review/scripts/review_wait.py` v4 summary
+validator. Strict v4 replay is the default and requires the same session's valid
+`ADMISSION.json`; `--legacy-v4` is an explicit read mode only for immutable historical
+pre-admission evidence and cannot support a current Test claim. Then bind its
+`change_id`, ordered `task_ids`, `head`, `admission_digest`, `subject_digest`,
+`context_digest`, and
+honest nullable `worktree_digest` to the Test report's root identity and `review`
+provenance fields. The transport sensor accepts only canonical
+`.ultra/test-report.json` and the normalized repository-relative
+`.ultra/reviews/<session>/SUMMARY.json` it names. Both use the same bounded stable
+raw-byte snapshot rule: every managed path component below the real repository root is
+non-symlink, the final entry is a repository-contained regular file, and an 8 MiB + 1
+byte observation returns a typed oversize diagnostic before JSON parsing or hashing.
+The final file is opened with `O_NONBLOCK` and `O_NOFOLLOW`; its descriptor is
+immediately required to be a regular file with the inspected path identity. A type or
+identity replacement returns the existing retryable snapshot diagnostic instead of
+waiting on a special file.
+The sensor uses one report snapshot for report parsing and subject comparisons, and one
+summary snapshot for summary parsing, SHA-256, comparisons, and the waiter's stdin
+validation. After writing those exact values and findings, run
+`node <ultra-test-skill-dir>/scripts/validate_review_transport.cjs --summary <validated-summary-path> --report .ultra/test-report.json`.
+Record that exact command, exit code, and evidence reference in `commands`. A nonzero
+result is a typed transport observation: repair the report copy and rerun it; never drop,
+merge, inject, or rewrite a finding to obtain a pass. This sensor compares exact summary
+bytes, review metadata, and finding objects only. It does not reinterpret a finding or
+decide the audit verdict.
+
+Validate each task evidence record with the shipped v2 structural sensor before using
+it. For every record whose `task_review.review_mode` is `external-manual`, rerun the
+sensor with `--verify-external-receipt` and recheck the declared receipt branch — the
+bounded stable receipt bytes, its recorded SHA-256, and its task/change/subject
+identity — instead of replaying a strict summary; strict-v4 records keep their exact
+waiter and transport replay. A task's declared branch is preserved as-is in the
+ordered `task_evidence` projection, consuming each item from the sensor's
+`--projection` output verbatim: an external-manual item carries `task_review_mode`,
+`task_review_receipt_ref`, and `task_review_receipt_digest` where a strict item
+carries its session and summary digest. Never rewrite one branch into the other. The CLI establishes only JSON shape, token syntax, and
+authority designation; it does not prove current identity, provenance, freshness,
+or semantic acceptance. Test
+takes each command and external-observation `raw_evidence_ref` to bounded stable
+repository-contained bytes from an ordinary regular non-symlink file opened nonblocking
+and no-follow, with an 8 MiB ceiling and path/descriptor identity checks around the read.
+Recompute `raw_evidence_sha256` from that one snapshot and require an exact match. Then
+recompute the stable exact `evidence.json` bytes as `evidence_digest` before copying the
+ordered `task_evidence` projection; a raw or record mismatch is an evidence gap returned
+to Dev.
+Test
+takes stable bytes independently, then rechecks and recomputes the current Acceptance-section SHA-256, aligns exact criterion IDs and verification types with the current context, and aligns the task-review session and summary digest with the retained strict summary. For `owner-judgment`, require that the durable owner record exists with its cited statement and disposition readable before rechecking all cited affected artifacts.
+The `subject` is an independently captured completion-snapshot freshness observation made after the final strict task Review validates and immediately before evidence publication; `task_review` separately binds the retained strict summary. Worker Packet v1 carries no task worktree digest and its summary records `worktree_digest: null`, so Test never claims that those review artifacts prove or cryptographically bind `subject.worktree_digest`. It also never replaces that earlier observation with the later aggregate Change digest.
+The owner alone supplies an owner-judgment result. A later task may change the aggregate
+worktree without invalidating an earlier task, but any changed acceptance, owner record,
+review binding, or cited artifact that no longer supports its criterion is a mismatch.
+Any mismatch is an evidence gap: return the affected task and criterion IDs to Dev, or
+return a missing owner judgment to the owner. Test never edits task status. Dev records the reason and performs
+the explicit ledger `completed` to `in_progress` reopen; no silent demotion is allowed.
+Never turn structural sensor success into any of those consumer conclusions.
+
+This is a cooperative-workspace drift sensor, not an operating-system isolation
+primitive. Use one fixed closing protocol: one complete primary observation followed by
+one terminal seal. A persistent mismatch observed inside or before that terminal seal
+returns typed `ULTRA_SNAPSHOT_CHANGED_DURING_OBSERVATION` recovery instead of publishing
+the tuple. A cooperative write after the completed terminal seal belongs to the next
+consumer, which must perform a fresh recapture before using the tuple. Hostile writers or
+interleavings require a native Host sandbox or an isolated worktree. Never add an
+unbounded success-seeking replay.
+
+Aggregate finding disposition is bounded: P2 and P3 findings are recorded as backlog or
+residual risk and never automatically returned to Dev, and this audit writes
+non-blocking refactor observations into the report instead of reopening a completed
+task. An implementation P0/P1 found here returns to Dev as at most one new
+owner-approved repair task; there is no unbounded Test ↔ Deliver bounce, and any
+re-entry through Test after a report is consumed requires an explicit owner
+disposition.
+
+The receipt is non-authoritative derived evidence, but retain it until both Test and
+Deliver have consumed the review. If it is missing, the current session and Test claim
+are `INCOMPLETE`; start a fresh review session. Do not reconstruct it or use
+`--legacy-v4` to bypass loss from a current strict session.
+
 ## Detect substantive stubs
 
 Report an empty return with no IO, a log-only function, a handler that only prevents
@@ -61,14 +185,28 @@ the smallest real boundary or implementation that would make it observable.
 
 ## Write the report
 
-Store the exact `git_commit`, timestamp, run count, commands and exit codes, the six
-area results, findings with paths, verified seams, material omissions, residual risk,
-and `passed` as the model's evidence-derived summary in the one canonical
+Store the exact `change_id`, ordered current-Change `task_ids`, `intent_digest`,
+`git_commit`, timestamp, run count, commands and exit codes, the six area results,
+findings with paths, verified seams, material omissions, residual risk, and `passed` as
+the model's evidence-derived summary in the one canonical
 `.ultra/test-report.json`. Each command records `command`, `exit_code`, and an
 `evidence_ref`; each area records `status`, `evidence_refs`, and `omissions`. Copy the
-script's `head`, `dirty`, and `diff_digest` into `git_commit` and `worktree`. A stale commit or digest is labelled stale;
+worktree script's `head`, `dirty`, `diff_digest`, and `intent_digest` into the report.
+That worktree identity binds the current whole Change, while ordered `task_evidence`
+items preserve each task's distinct completion-snapshot freshness observation and
+separate task-review identity.
+Copy the validated review summary's exact SHA-256 into `review.summary_digest`; the
+transport validator recomputes it before the report can be current evidence. A stale
+commit, product digest, intent digest, Change id, or task-id snapshot is labelled stale;
 it is never reused as current proof.
 
+`passed` is a one-way claim: `true` requires every current-Change task completed in the
+ledger, current v2 task evidence and task-review provenance, and no required area left
+`not_run`. Completed rows do not force `passed: true`; findings, omitted evidence, or a
+failed command may keep it false, while an explicitly dispositioned gap remains visible
+even if the model's evidence summary passes. Preserve the finding and the owner's
+disposition as separate fields. No validator result is itself semantic acceptance.
+
 Present the findings by consequence and recommend the highest-leverage response. The
 owner may fix all, fix selected findings, accept recorded risk, or reduce scope through
 the normal REDUCTION decision. Recommend the next capability; do not invoke it.
@@ -80,8 +218,12 @@ an observation, not permission to auto-fix, weaken a test or silently change sco
 
 ## References
 
+- `../ultra-change/references/change-contract.md` — canonical Active Change authority resolution.
 - `references/export-syntax.md` — read during Wiring Verification to find exported
   symbol candidates in TypeScript/JavaScript, Python, Go, Rust and Java.
 - `scripts/worktree_digest.cjs` — deterministic HEAD plus worktree evidence identity.
+- `../ultra-review/SKILL.md` — read for aggregate Change review after the six-area audit.
+- `../ultra-plan/references/task-evidence-v2.md` — canonical current task evidence and task-review contract.
+- `../ultra-change/references/execution-grant.md` — read only for grant-activated continuation.
 - `../ultra-think/references/autonomy-boundary.md` — read when a proposed response
   would make an existing specification commitment stop holding.