ultra-builder-pro-cli 0.26.2 → 5.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (82) hide show
  1. package/.ultra-template/contexts/TEMPLATE.md +70 -29
  2. package/.ultra-template/north-star.md +35 -18
  3. package/.ultra-template/tasks.json +1 -0
  4. package/.ultra-template/test-report.json +17 -1
  5. package/CHANGELOG.md +235 -1
  6. package/README.md +210 -50
  7. package/README.zh-CN.md +440 -0
  8. package/adapters/_shared/host-profile.cjs +3 -95
  9. package/adapters/_shared/plugin-core.cjs +61 -5
  10. package/adapters/_shared/runtime-assets.cjs +66 -5
  11. package/adapters/zcode.js +375 -0
  12. package/bin/delegate-worker.cjs +2 -325
  13. package/bin/delegate.cjs +3 -461
  14. package/bin/install.js +11 -6
  15. package/docs/ARCHITECTURE.md +133 -31
  16. package/docs/ARTIFACT-AUTHORITY.md +185 -24
  17. package/docs/DECISIONS.md +153 -18
  18. package/docs/PHILOSOPHY.md +58 -7
  19. package/docs/PLUGIN-ISOLATION-CONTRACT.md +34 -12
  20. package/docs/RUNTIME-COMPAT-MATRIX.md +195 -23
  21. package/docs/SKILL-AUTHORING.md +19 -6
  22. package/docs/WORKFLOW-LIFECYCLE.md +196 -44
  23. package/docs/evals/adversarial-review-2026-08-14.md +84 -0
  24. package/docs/evals/ultra-5-0-journey-results.md +62 -0
  25. package/docs/evals/ultra-5-0-live-acp-conformance.md +93 -0
  26. package/docs/evals/ultra-5-0-route-journeys.md +145 -0
  27. package/docs/evals/zcode-automation-2026-08-14.md +103 -0
  28. package/hooks/README.md +27 -4
  29. package/hooks/_common.py +1678 -61
  30. package/hooks/adapters/zcode.py +227 -0
  31. package/hooks/compact_context.py +176 -17
  32. package/hooks/mid_workflow_recall.py +27 -5
  33. package/hooks/post_edit_guard.py +133 -23
  34. package/hooks/session_context.py +707 -22
  35. package/package.json +7 -3
  36. package/skills/ultra-change/SKILL.md +69 -12
  37. package/skills/ultra-change/references/change-contract.md +93 -27
  38. package/skills/ultra-change/references/execution-grant.md +109 -0
  39. package/skills/ultra-change/references/primary-transfer.md +273 -0
  40. package/skills/ultra-change/scripts/validate_primary_transfer.cjs +1928 -0
  41. package/skills/ultra-delegate/SKILL.md +103 -8
  42. package/skills/ultra-delegate/patches/zcode-acp-0.1.0-zcode-0.16.5.patch +184 -0
  43. package/skills/ultra-delegate/references/delegation-contract.md +80 -1
  44. package/skills/ultra-delegate/scripts/acp-conformance.cjs +287 -0
  45. package/skills/ultra-delegate/scripts/acp-driver.cjs +762 -0
  46. package/skills/ultra-delegate/scripts/agent-execution-driver.cjs +320 -0
  47. package/skills/ultra-delegate/scripts/cli-driver.cjs +61 -0
  48. package/skills/ultra-delegate/scripts/delegate-worker.cjs +328 -0
  49. package/skills/ultra-delegate/scripts/delegate.cjs +690 -0
  50. package/skills/ultra-delegate/scripts/host-profile.cjs +267 -0
  51. package/skills/ultra-deliver/SKILL.md +98 -11
  52. package/skills/ultra-dev/SKILL.md +188 -42
  53. package/skills/ultra-grilling/SKILL.md +10 -7
  54. package/skills/ultra-grilling/references/reframing.md +7 -3
  55. package/skills/ultra-init/SKILL.md +56 -7
  56. package/skills/ultra-init/scripts/init_project.cjs +968 -21
  57. package/skills/ultra-plan/SKILL.md +91 -47
  58. package/skills/ultra-plan/references/task-evidence-v2.md +300 -0
  59. package/skills/ultra-plan/scripts/validate_task_evidence.cjs +859 -0
  60. package/skills/ultra-research/SKILL.md +70 -14
  61. package/skills/ultra-research/references/04-product-strategy.md +11 -2
  62. package/skills/ultra-research/references/21-features-scope.md +8 -0
  63. package/skills/ultra-research/references/22-success-metrics.md +4 -3
  64. package/skills/ultra-research/references/99-synthesis.md +19 -2
  65. package/skills/ultra-research/references/north-star-v2.md +168 -0
  66. package/skills/ultra-research/references/wayfinding.md +8 -0
  67. package/skills/ultra-research/scripts/validate_north_star.cjs +1174 -0
  68. package/skills/ultra-review/SKILL.md +201 -27
  69. package/skills/ultra-review/references/adversarial-evaluation.md +31 -0
  70. package/skills/ultra-review/references/spec.md +5 -0
  71. package/skills/ultra-review/references/unified-schema.md +146 -11
  72. package/skills/ultra-review/references/worker-packet.md +151 -8
  73. package/skills/ultra-review/scripts/review_wait.py +2653 -63
  74. package/skills/ultra-status/SKILL.md +129 -15
  75. package/skills/ultra-status/references/route-contract.md +100 -0
  76. package/skills/ultra-tdd/SKILL.md +11 -4
  77. package/skills/ultra-tdd/references/test-execution.md +6 -1
  78. package/skills/ultra-test/SKILL.md +161 -18
  79. package/skills/ultra-test/scripts/validate_review_transport.cjs +549 -0
  80. package/skills/ultra-test/scripts/worktree_digest.cjs +518 -30
  81. /package/{adapters/_shared → skills/ultra-delegate/scripts}/delegate-profiles/kimi-read-only.md +0 -0
  82. /package/{adapters/_shared → skills/ultra-delegate/scripts}/delegate-profiles/kimi-write.md +0 -0
@@ -1,10 +1,5 @@
1
1
  # Task {id}: {title}
2
2
 
3
- > **Status**: pending | **Priority**: {priority} | **Complexity**: {complexity}
4
-
5
- <!-- Status here and in tasks.json must always match. Both are written together, then both
6
- are read back to confirm. A single-sided write breaks cross-host resume. -->
7
-
8
3
  ## Context
9
4
 
10
5
  **What**: [what to build or change]
@@ -17,30 +12,54 @@
17
12
 
18
13
  ## Implementation
19
14
 
20
- **Target Files**:
21
- - `path/to/file.ts` (create)
22
- - `path/to/existing.ts` (modify: description)
23
-
24
- **Layers touched**: [entry point / use case / domain / persistence — must be ≥2]
15
+ **Layers touched**: [entry point / use case / domain / persistence]
25
16
 
26
17
  **Pattern**: [existing code to follow]
27
18
 
28
19
  **Tech Notes**: [framework or library specifics]
29
20
 
21
+ **Earliest observable slice**: [the first real consumer -> real data path ->
22
+ owner-visible observation, or `not applicable` with the concrete reason]
23
+
24
+ **Fresh-session recovery**: [repository root and HEAD -> active Change -> matching
25
+ ledger row -> this context and Resume Note -> exact safe resume command or path]
26
+
27
+ ## Planned Path Inventory
28
+
29
+ `MODIFY`:
30
+
31
+ - `path/to/existing.ts`
32
+
33
+ `CREATE`:
34
+
35
+ - `path/to/file.ts`
36
+
37
+ Any later addition, removal, or rename in this inventory or the Public Seams below is
38
+ plan-critical and requires a rebuilt Execution Packet plus owner reapproval before
39
+ implementation continues.
40
+
41
+ ## Public Seams
42
+
43
+ - `[entry point, schema, file contract, or other externally observable seam]`
44
+
45
+ ## Narrow Verification
46
+
47
+ - `exact command for the smallest relevant contract suite`
48
+ - `[inspection, owner record, or external observation required by the typed criteria]`
49
+
30
50
  ## Acceptance Criteria
31
51
 
32
- <!-- The verifiable definition of done. Read by mid_workflow_recall and session_context, and
33
- injected into agent context — keep every line testable and keep noise out. -->
52
+ <!-- The typed definition of done. Readers inject this section into agent context; keep
53
+ every criterion observable and keep noise out. The ledger is the sole Status source. -->
34
54
 
35
55
  **Change Acceptance IDs**: [`AC-1`, `AC-3`, or `none` for task-local-only work]
36
56
 
37
- - [ ] `exact test command`
38
- - [ ] Pass: [scenario 1]
39
- - [ ] Pass: [scenario 2]
40
- - [ ] Integration: [the one test proving this connects to its upstream/downstream boundary]
41
-
42
- <!-- Manual verification, deliberately outside the injected section:
43
- curl -X POST localhost:3000/api/example -->
57
+ | ID | Criterion | Verification type | Required evidence |
58
+ |---|---|---|---|
59
+ | A-01 | [observable criterion] | `command` | exact command, cwd, exit code, raw evidence ref, and freshness identity |
60
+ | A-02 | [observable criterion] | `inspection` | source/path, observed fact, and revision |
61
+ | A-03 | [owner decision when genuinely required] | `owner-judgment` | durable owner statement or explicit disposition |
62
+ | A-04 | [external fact when genuinely required] | `external-observation` | provider, run id, timestamp, raw evidence ref, and observation |
44
63
 
45
64
  ## Definition of Drift
46
65
 
@@ -53,10 +72,17 @@
53
72
 
54
73
  **Source**: `.ultra/specs/product.md#section-id`
55
74
 
56
- **Hard Constraints**: [`HC-1`, `HC-3`, or `none` — the north-star constraints this
57
- task could plausibly violate. Read them before the first edit and again before
58
- marking complete. Crossing one stops the work and goes to the owner, however good
59
- the argument.]
75
+ **First principles**: [`FP-1`, or every accepted principle this task relies on]
76
+
77
+ **Serves**: [`NS-1`, or every accepted outcome this task causally advances]
78
+
79
+ **Causal contribution**: [one task-local sentence connecting the planned seam to the
80
+ listed outcome through the listed principles; reference IDs and do not copy North Star
81
+ prose]
82
+
83
+ **Hard constraints**: [`HC-1`, `HC-3`, or `none` — the accepted constraints this task
84
+ could plausibly violate. Read them before the first edit and again before marking
85
+ complete. Crossing one stops the work and goes to the owner, however good the argument.]
60
86
 
61
87
  **Decisions**: [relevant `.ultra/decisions/<id>.md` entries, or `none`]
62
88
 
@@ -77,18 +103,33 @@ the argument.]
77
103
 
78
104
  ## Resume Note
79
105
 
80
- <!-- The single most important line for cross-session and cross-host continuation.
81
- Overwrite it whenever work pauses. Say where to pick up, not what was done. -->
106
+ <!-- Navigational state only: the current checkpoint, the next action a higher
107
+ authority has already allowed, unresolved prerequisites, and the cheapest
108
+ safe resume command or path. It cannot override current owner authority,
109
+ approved scope/budget, task acceptance, or a validated Review verdict, it
110
+ cannot promote P2/P3 findings into blockers, and it never requires a fresh
111
+ zero-finding review after a current APPROVE. It never carries or re-issues
112
+ an execution grant: continuing under a durable work-package grant requires
113
+ the consuming Agent to re-verify the recorded grant itself. Overwrite it
114
+ whenever work pauses. Say where to pick up, not what was done. When the
115
+ pause is owner-facing, the note answers the checkpoint semantics: why,
116
+ outcome, accepted boundary, delta, reality, decision needed, next bounded
117
+ action, and not-done. -->
82
118
 
83
119
  _(not started)_
84
120
 
85
121
  ## Completion
86
122
 
87
- > _Fill when the task is complete._
123
+ _Not completed._
124
+
125
+ ## Task Review
88
126
 
89
- - **Completed**: {date}
90
- - **Commit**: {hash}
91
- - **Summary**: {what was delivered}
127
+ - Execution Packet state/digest/limitation: `not_run`
128
+ - Review session identity and summary digest: `not_run`
129
+ - Blocking findings with resolution/disposition/evidence refresh refs: `not_run`
130
+ - Retention: retain the current strict review session until both aggregate Test and
131
+ Deliver consume it. Premature loss requires a fresh Review and Test; never reconstruct
132
+ the old receipt.
92
133
 
93
134
  ---
94
135
  *Generated by ultra-plan*
@@ -1,35 +1,52 @@
1
1
  # Project North Star
2
2
 
3
- > **Authority**: the accepted steering contract established by `ultra-research` from
4
- > owner decisions and cited evidence. Every Change and task must serve this contract.
3
+ > **Authority**: `ultra-research` is the first semantic writer. This placeholder is
4
+ > owner-readable structure only; it is not an accepted direction, metric, or boundary.
5
5
  >
6
- > **Scope**: this file owns the project direction, the one North Star outcome or metric
7
- > when one is justified, hard constraints, and explicit exclusions. Product requirements,
8
- > supporting measurements, actors, and scenarios stay in `specs/product.md`.
6
+ > **Adoption**: Init creates this file with status `unresearched` and no semantic IDs.
7
+ > Research replaces it only after evidence collection and explicit owner acceptance.
9
8
 
10
- ## Project Direction
9
+ ## Acceptance and Revision
11
10
 
12
- [NEEDS CLARIFICATION]
11
+ - Schema: `north-star-v2`
12
+ - Status: `unresearched`
13
+ - Revision: `none`
14
+ - Owner acceptance source: `none`
15
+ - Acceptance time: `not-recorded`
16
+ - Supersedes: `none`
13
17
 
14
- ## North Star Outcome
18
+ ## Problem Reality
15
19
 
16
- - `NS-01` outcome: [NEEDS CLARIFICATION]
17
- - Metric or observation contract: [NEEDS CLARIFICATION]
18
- - Why it represents delivered value: [NEEDS CLARIFICATION]
20
+ - Reality: [NEEDS RESEARCH]
21
+ - Evidence: [NEEDS RESEARCH]
22
+ - Unknowns: [NEEDS RESEARCH]
19
23
 
20
- A single metric is optional. When one would distort the product, record that decision and
21
- use an observable outcome plus guardrails instead of inventing numeric precision.
24
+ ## First-Principle Propositions
25
+
26
+ [NEEDS RESEARCH: Research creates stable proposition IDs only after owner acceptance.]
27
+
28
+ ## Value Causal Chain
29
+
30
+ [NEEDS RESEARCH: map accepted principles through capability and behavior to outcomes.]
31
+
32
+ ## North Star Outcomes
33
+
34
+ [NEEDS RESEARCH: do not create an outcome ID or metric during Init.]
22
35
 
23
36
  ## Hard Constraints
24
37
 
25
- - `HC-1`: [NEEDS CLARIFICATION]
38
+ [NEEDS RESEARCH: do not create a constraint ID during Init.]
26
39
 
27
40
  ## Explicit Exclusions
28
41
 
29
- - [NEEDS CLARIFICATION]
42
+ - [NEEDS RESEARCH]
43
+
44
+ ## Uncertainties and Revisit Triggers
45
+
46
+ - [NEEDS RESEARCH]
30
47
 
31
48
  ## Research Trace
32
49
 
33
- - Project brief: `project-brief.md`
34
- - Accepted research run: [NEEDS CLARIFICATION]
35
- - Decision references: [NEEDS CLARIFICATION]
50
+ - Project Brief: `project-brief.md`
51
+ - Research runs: none
52
+ - Sources and decisions: none
@@ -1,3 +1,4 @@
1
1
  {
2
+ "$schema": "ultra-task-ledger-v2",
2
3
  "tasks": []
3
4
  }
@@ -1,7 +1,8 @@
1
1
  {
2
- "$schema": "ultra-test-report-v1",
2
+ "$schema": "ultra-test-report-v2",
3
3
  "change_id": null,
4
4
  "task_ids": [],
5
+ "task_evidence": [],
5
6
  "git_commit": null,
6
7
  "intent_digest": null,
7
8
  "worktree": {
@@ -17,6 +18,21 @@
17
18
  "performance": {"status": "not_run", "evidence_refs": [], "omissions": ["Not yet run"]},
18
19
  "security": {"status": "not_run", "evidence_refs": [], "omissions": ["Not yet run"]}
19
20
  },
21
+ "review": {
22
+ "session": null,
23
+ "packet_digest": null,
24
+ "admission_digest": null,
25
+ "subject_digest": null,
26
+ "execution_mode": null,
27
+ "finding_schema": "ultra-review-findings-v4",
28
+ "summary_ref": null,
29
+ "summary_digest": null,
30
+ "context_digest": null,
31
+ "worktree_digest": null,
32
+ "verdict": "INCOMPLETE",
33
+ "coverage_refs": [],
34
+ "limitations": ["Not yet run"]
35
+ },
20
36
  "verified_seams": [],
21
37
  "findings": [],
22
38
  "omissions": ["Not yet run"],
package/CHANGELOG.md CHANGED
@@ -7,6 +7,237 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
7
7
 
8
8
  ## [Unreleased]
9
9
 
10
+ ## [5.0.0] — 2026-08-26
11
+
12
+ ### Added
13
+
14
+ - Added one owner-visible Route Contract for every public workflow transition:
15
+ invocation, mode, current position, observable exit condition, material checkpoint,
16
+ and next route are derived from repository authority rather than stored as another
17
+ semantic state machine.
18
+ - Added a canonical installed Skill-local delegation runtime and one replaceable
19
+ `AgentExecutionDriver` boundary. The stable ACP v1 driver handles negotiation, fresh
20
+ absolute-cwd sessions, bounded/redacted updates, permission requests, cancellation,
21
+ timeouts, and terminal observation while preserving the existing immutable packet,
22
+ Git-diff, and exact result validator. `CliDriver` remains result-compatible fallback.
23
+ - Added per-Host ACP capability/conformance selection and Doctor reporting for runner
24
+ health, selected driver, fallback reason, and transport maturity. ACP can activate
25
+ only for an executable stdio v1 candidate with a passed Host-specific evidence row.
26
+ - Added a 3.x migration and fourteen-journey acceptance harness covering byte- and
27
+ mode-preserving install/update/Doctor/uninstall, fresh-session recovery, degraded
28
+ authority, early observable slices, delegation, cancellation, and truthful STOPs.
29
+
30
+ ### Changed
31
+
32
+ - Made `ultra-change` the daily entry for an existing-project request. `ultra-research`
33
+ now owns the first baseline or one bounded evidence question; Change owns the delta
34
+ and its Research Disposition; Plan owns the smallest dependency-correct graph and the
35
+ earliest owner-observable vertical slice.
36
+ - Made fresh-session recovery explicitly file-first: resolve the unique active Change,
37
+ task ledger and context, Acceptance, Resume Note, decisions, evidence, and Git without
38
+ replaying completed Research or treating conversation memory as authority.
39
+ - Moved the canonical delegation launcher and its complete runtime closure under the
40
+ installed `ultra-delegate` Skill. The package-level `ubp delegate` command is a thin
41
+ one-release compatibility wrapper rather than a day-to-day runtime dependency.
42
+ - Activated ACP-first delivery for all six shipped Host profiles only while each exact
43
+ executable, candidate identity, protocol version, and current conformance receipt
44
+ remain valid. Any unavailable or stale boundary still returns the typed,
45
+ result-compatible CLI fallback without an automatic provider retry.
46
+ - Connected ZCode Desktop through the independently built `zcode-acp` v0.1.0 bridge at
47
+ commit `42fe149d4b501469343c01f23ba3801832306d53` plus the shipped digest-bound ZCode
48
+ 0.16.5 runtime-preferences patch. The verified provider path is domestic 智谱
49
+ BigModel Coding Plan, not international Z.AI OAuth; transport maturity remains
50
+ `experimental` and requires explicit acknowledgment.
51
+ - Kept Status and degraded Review read-only. Ambiguous authority reports the earliest
52
+ unsafe fact and reachable repair, retry, cancel, or abandon path without selecting an
53
+ intent, activating stored grant text, or writing semantic content.
54
+
55
+ ### Compatibility and scope
56
+
57
+ - Preserved every seeded accepted 3.x project artifact byte and mode through the real
58
+ isolated install, update, Doctor, and uninstall lifecycle.
59
+ - Deliberately excluded a daemon, remote workflow service, semantic state machine, A2A
60
+ network, Team Pack, remote marketplace, shared authority store, automatic ACP-to-CLI
61
+ retry after a started run, and unverified Host capability promotion.
62
+ - This package has no service deployment target. npm publication and GitHub Release are
63
+ the only release surfaces; Team Pack, a daemon, remote workflow service, provider
64
+ purchase, credential export, force-push, and npm unpublish remain excluded.
65
+
66
+ ### Verified
67
+
68
+ - Completed one bounded real ACP v1 provider session for Claude Code, Codex, OpenCode,
69
+ Kimi Code, Grok Build, and ZCode. Every receipt binds the exact Host candidate, clean
70
+ isolated Git subject, terminal worker observation, and redacted result facts.
71
+ - Installed 5.0.0 into all six real user Host homes after a mode-0700 recovery backup.
72
+ Final Doctor reports six healthy adapters, installed Skill-local ACP selection, and
73
+ ownership-safe ZCode uninstall/reinstall without changing the domestic-provider config.
74
+ - Passed the same-commit GitHub Actions matrix on Ubuntu and macOS with 661 Node tests,
75
+ 89 Hook tests, and zero production dependency vulnerabilities, plus Windows 27/27
76
+ real ACP tests including cancel and timeout cleanup of an actual grandchild process.
77
+ - Reproduced Windows checkout EOL and worktree-alias failures before fixing them with
78
+ LF-bound bridge patches and filesystem device/file-ID comparison; both failed
79
+ predecessor runs remain retained in the release evidence.
80
+
81
+ ## [3.0.2] — 2026-08-18
82
+
83
+ ### Added
84
+
85
+ - Implemented the r3 North Star projection under a verified primary transfer:
86
+ North Star revision `north-star-v2-r3` with the new `FP-8` (Agent handover is
87
+ exclusive, verified, and recoverable), a new acceptance decision and immutable
88
+ snapshot, and the exact ZCode sole-writer durable grant
89
+ `ubp3-r3-zcode-2026-08-17` recorded in `.ultra/decisions/`.
90
+ - Added the primary-transfer contract between Agents
91
+ (`skills/ultra-change/references/primary-transfer.md`): an owner-granted
92
+ OFFER → verified ACK → sole-writer execution → frozen terminal RESULT protocol
93
+ over canonical files and Git, mutually exclusive with delegated workers,
94
+ with derived receipts under `.ultra/.runtime/handoffs/` and a mechanical
95
+ validator (`skills/ultra-change/scripts/validate_primary_transfer.cjs`) plus
96
+ authority, permission, effect, stale/revoke/interrupt/resume/cancel, and
97
+ missing-receipt recovery regressions (`tests/primary-transfer.test.cjs`).
98
+ `ultra-change`, `ultra-status`, and `ultra-delegate` consume the contract.
99
+ - Added the versioned closeout-transition contract
100
+ (`ultra-primary-transfer-closeout-v1` in
101
+ `skills/ultra-change/references/primary-transfer.md`): the immutable
102
+ reviewed subject of a newest completed v2 RESULT is separated from exactly
103
+ one uncommitted prescribed post-review closeout (final evidence record,
104
+ task-context closeout sections, ledger `completed`) through a CLOSEOUT
105
+ receipt that starts no review or handoff and never commits, while
106
+ implementation, Acceptance, PPI, pre-review-evidence, and unrelated-ledger
107
+ drift stays typed-stale; owner-authorized continuations between freeze and
108
+ closeout are recorded, bounded, and pinned. The closed task's ledger row is
109
+ bound ex-status (unique, `in_progress` → `completed`, every other field
110
+ structure-equivalent, re-read live), and `authorized_by` binds the existing
111
+ `ultra-external-review-receipt-v1` semantics (read-only reviewer, exact
112
+ task/change identity, authority and reviewed-contract refs by stable bytes,
113
+ subject equal to the closeout start, `approve` with no P0/P1). Regressions
114
+ cover the terminal
115
+ green path without RESULT edit or commit, structural and citation
116
+ rejections, drift during/after closeout (including current-row field drift),
117
+ continuation bounds, and preserved
118
+ history (`tests/primary-transfer.test.cjs`).
119
+ - Repaired the contract in the owner-authorized Round 1 pass
120
+ (`ubp3-r3-zcode-desktop-r1`): transfer validation is now phase-correct (an
121
+ ACK is a pre-write boundary record, so expected receiver edits never
122
+ self-invalidate an active or completed transfer; a superseded or v1 terminal
123
+ receipt stays historical), all receipt and bound-input reads are bounded
124
+ ordinary-file no-follow identity-checked reads (typed rejection for symlinks,
125
+ FIFOs, directories, oversize, and replacement), and a v2 terminal RESULT
126
+ binds the recomputed final HEAD, product worktree digest, exact full product
127
+ path inventory, and final frozen-input digests. Review-budget precedence is
128
+ one rule — an exact current owner grant overrides the versioned product
129
+ default (one initial review plus at most two P0/P1 delta reviews); P2/P3
130
+ never auto-extend, and the same root surviving three failed fixes stops
131
+ point-patching as an architecture problem. The ZCode delegate transport now
132
+ requires visible `--ack-experimental` acknowledgment and stamps
133
+ `transport_maturity`/`transport_surface` truth on every receipt and result,
134
+ so an app-internal CLI run can never be presented as the documented ZCode
135
+ Desktop interactive surface.
136
+ - Closed the two Round 2 misses on the same roots: transfer validation is now
137
+ fail-closed (an unobservable HEAD/Git is a typed `git_unavailable` error
138
+ instead of a green warning) and every read goes through the worktree-digest
139
+ tool's one shared stable snapshot primitive with parent-chain walks, exact
140
+ handoff-directory replay, same-subject supersession, and one finite coherent
141
+ digest×manifest terminal observation; every delegated ZCode terminal result
142
+ (finished, failed, cancelled, interrupted) now mechanically carries
143
+ `experimental_ack: true` when `--ack-experimental` authorized the run.
144
+ - Closed the final Round 3 miss on the same root: repo-wide handoff-root
145
+ discovery reuses the one stable directory observation — a symlinked,
146
+ unreadable, malformed, drifting, or oversize handoffs root (or entry) fails
147
+ typed and closed instead of silently reading as zero handoffs with
148
+ `valid: true`, while an absent root still legitimately means no transfers.
149
+ - Implemented the accepted Ultra Builder Pro 3.0 design as one Mode B durable
150
+ work-package projection: North Star revision `north-star-v2-r2` with seven first
151
+ principles, five observable outcomes (`NS-01`-`NS-05`), and eight hard constraints;
152
+ the provider-neutral Ultra Core Protocol naming across public docs; the
153
+ owner-facing checkpoint contract (why, outcome, accepted boundary, delta, reality,
154
+ decision needed, next bounded action, not-done); the per-fact artifact-authority
155
+ matrix with an explicit Execution Grant row and four effect classes; and the
156
+ optional Graph/Loop control-plane boundary documented as not integrated.
157
+ - Added dual-mode execution grants: session-local by default, `durable work-package`
158
+ by exact owner record, with stable verification, invalidation, and portable
159
+ handoff semantics in `skills/ultra-change/references/execution-grant.md`;
160
+ Status reports a recorded durable grant as inactive data awaiting verification.
161
+ - Added work-package review convergence bounded by an owner-visible budget: the
162
+ released default is at most one initial Review plus two P0/P1 delta Reviews per
163
+ coherent package, with explicit terminal outcomes, no self-extended budget, and
164
+ mandatory stop signals when repairs expose distinct root causes. Exact defaults
165
+ live in the versioned product contract; exact overrides in owner grants.
166
+ - Added ZCode as a sixth native host with fourteen Skills, five hook registrations, a
167
+ managed local marketplace, inline-plugin activation, Doctor, update, uninstall, and
168
+ bounded source/target delegation profiles. The App-bundled headless CLI transport
169
+ is recorded `experimental` in the shared host profile until official documentation
170
+ plus a full recovery drill meet the support bar.
171
+ - Added canonical North Star traces from Research through Change, Plan, review, Test,
172
+ and delivery, plus adversarial challenges at Research checkpoints 04, 21, and 99.
173
+ - Added review coverage references, recorded isolated-versus-sequential execution mode,
174
+ mandatory Plan and aggregate Test reviews, blind cross-family probes, and a seeded
175
+ adversarial evaluation fixture.
176
+
177
+ ### Changed
178
+
179
+ - Made review topology owner-selected per stage with a one-reviewer default: initial
180
+ task review selects `review-spec` plus risk/touched-seam lenses, delta reviews rerun
181
+ only affected lenses, and the aggregate full-roster default applies only when
182
+ cross-task wiring justifies it — never a mandatory count or a quality proxy.
183
+ - Split `ultra-deliver` entry by invocation kind: a model-selected Deliver run under a
184
+ grant may reconcile, review, and report, then stops before finalization; writing
185
+ `delivery.md`, version/package posture, and archiving require a current explicit
186
+ owner invocation in every grant mode.
187
+ - Replaced the Change-scoped same-session Autonomy Envelope (superseded name,
188
+ historical) with the dual-mode
189
+ Execution Grant contract (`## Execution Grant` in every intent, `session-local`
190
+ default); renamed `AUTONOMY_CONTINUABLE_SKILLS` to `GRANT_CONTINUABLE_SKILLS` and
191
+ removed the unused `requiresAutonomyEnvelope` policy field.
192
+ - Closed the superseded `chg-v027-lifecycle-closure` Change with an exact
193
+ abandonment record citing the Mode B grant and successor `chg-ultra-3-0-mode-b`;
194
+ its pending v0.27 task rows remain inert append-only history.
195
+ - Made `validate_repo_path` in the review waiter reject symlink and non-directory
196
+ path components at validation time (Python 3.13 `resolve(strict=False)` no longer
197
+ raises on symlink loops).
198
+ - Made the task-evidence audit and review-wait fixtures derive the repository
199
+ North Star decision, snapshot, revision, and trace IDs dynamically instead of
200
+ locking revision r1.
201
+ - Raised the Grok delegation turn ceiling to twelve and retained launcher-side strict
202
+ result validation; Kimi delegation can now select a model explicitly.
203
+ - Made Claude delegation rely on strict launcher validation instead of a native schema
204
+ option rejected by current Claude Code.
205
+ - Embedded each digest-bound instruction and permission packet in the worker prompt so
206
+ OpenCode can keep external-directory access denied, and projected a Codex-compatible
207
+ native result schema while retaining stronger launcher validation.
208
+
209
+ ### Fixed
210
+
211
+ - Replaced the release gate's load-sensitive fixed delay for strict Review
212
+ admission pinning with an explicit subprocess read handshake, so a slow clean
213
+ CI checkout cannot capture the already-mutated receipt and falsely pass the
214
+ polling invariant.
215
+ - Made the release gate reproducible from a clean checkout: installer integration
216
+ tests use an isolated Codex CLI fixture, and completed-task audits consume canonical
217
+ evidence after Review and Handoff receipts have reached their documented GC boundary.
218
+ - Made no-op ZCode hook adapters emit an actually empty stdout response, matching the
219
+ host's strict hook parser instead of intermittently failing a benign tool call on `{}`.
220
+ - Shared the macOS App-bundled ZCode CLI fallback between native plugin lifecycle
221
+ checks and delegated target launches when `zcode` is not available on `PATH`.
222
+ - Removed a delegated-result prompt contradiction by listing `$schema` in the exact
223
+ required field set, matching the launcher's fail-closed result validator.
224
+ - Added a resident entry guard to every implicitly discoverable public workflow so a
225
+ missing live execution grant stops before workflow work begins: a session-local grant
226
+ requires current conversation activation, and a durable work-package grant requires
227
+ stable verification by the consuming Agent.
228
+ - Raised the direct `js-yaml` floor to 4.3.1 so the release dependency audit no longer
229
+ includes the high-severity `!!omap` quadratic-consumption advisory.
230
+
231
+ ### Verified
232
+
233
+ - Completed authenticated read-only target delegation with Claude Code, Codex,
234
+ OpenCode, Kimi Code, and ZCode; Grok Build's malformed terminal output failed closed.
235
+ - Re-ran ZCode target delegation without a binary override on a machine where `zcode`
236
+ is absent from `PATH`; the App-bundled fallback returned a validated empty-diff result.
237
+ - Completed one bounded ZCode automatic-coding run through Plan, adversarial reviews,
238
+ TDD, and Test with 3/3 tests passing, then stopped before ungranted delivery, commit,
239
+ push, publication, or deployment.
240
+
10
241
  ## [0.26.2] — 2026-08-04
11
242
 
12
243
  ### Added
@@ -1286,7 +1517,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
1286
1517
  skill manifest, CLI protocol + mapping table; 5 spec validators.
1287
1518
  - **Phase 0 — skeleton**: multi-runtime installer scaffolding.
1288
1519
 
1289
- [Unreleased]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.26.1...HEAD
1520
+ [Unreleased]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v5.0.0...HEAD
1521
+ [5.0.0]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v3.0.2...v5.0.0
1522
+ [3.0.2]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.26.2...v3.0.2
1523
+ [0.26.2]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.26.1...v0.26.2
1290
1524
  [0.26.1]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.26.0...v0.26.1
1291
1525
  [0.26.0]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.25.1...v0.26.0
1292
1526
  [0.25.1]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.25.0...v0.25.1