ultra-builder-pro-cli 0.26.2 → 5.0.0

package/skills/ultra-status/SKILL.md

@@ -9,20 +9,56 @@ This router is read-only. It separates verified files, model inference, and unav
 evidence, then recommends one explicit public capability without invoking it. It never
 persists a workflow-position field.
 
+## Route modes
+
+| Mode | Entry | Observable exit | Next |
+|---|---|---|---|
+| `route` | Owner asks what is current or what to do next | One artifact-derived Route Card names the matched facts, unavailable evidence, and one recommended route | The named explicit route, or `idle` |
+| `history` | Owner asks what changed, was rejected, or was superseded | Relevant decisions, Git revisions, archived/abandoned Changes, and unresolved contradictions are summarized without becoming authority | Return to `route` or the owner-selected revision route |
+| `installation` | Owner asks whether Ultra is discovered and healthy on a Host | Installed version, provenance, Skill/hook discovery, drift, and reachable repair are reported read-only | Recommend the exact install/update/Doctor repair |
+| `delegation` | Owner asks about a worker, handoff, ACP/CLI event, or terminal result | Transport observations and canonical authority are shown separately with a retry/cancel/integration path | Return to the requesting primary route |
+| `recovery` | Authority is absent, ambiguous, stale, malformed, or temporarily unreadable | The earliest unsafe or unavailable fact and cheapest safe repair, retry, cancel, abandon, or fresh-session path are named | Recommend only the repair-capable explicit route |
+
+Follow `references/route-contract.md` and use its `UBP Route Card` as the default output,
+not an optional appendix. Expand history, installation, delegation, or recovery details
+only when requested or needed to explain why the normal route is unavailable. Status is
+a `router`: the Owner invokes it for read-only diagnosis, its Host implicit bit remains
+off, and it supplies no continuation authority. Other public Skills derive their own
+cards from the shared reference rather than invoking Status.
+
 ## Before you start
 
-1. List directories containing `.ultra/changes/active/*/intent.md`. If exactly one
-   exists, its directory name is the current `change_id`. Read `.ultra/tasks.json`,
-   then tasks whose `change_id` matches it and the frontier task's `context_file` and
-   `## Resume Note`. Historical and abandoned tasks never define the frontier.
-2. Read `.ultra/project-brief.md`, `.ultra/north-star.md`, `CONTEXT.md`, relevant
-   `.ultra/decisions/`, specifications, active, archived, or abandoned Changes, and
-   evidence. An abandoned Change supplies historical boundary and recovery context;
-   it never defines the current route.
+1. Read `../ultra-change/references/change-contract.md` and apply its **Active Change
+   authority resolution** before reading any active `intent.md` or relying on a current
+   `change_id`. A positively observed absent `.ultra` uses the existing `ultra-init`
+   route. Otherwise continue only from the rule's stable zero-or-one result. A typed
+   diagnostic stops semantic routing from an ambiguous active Change, but it does not
+   stop Status: switch to `recovery` mode and report the diagnostic plus safe Git and
+   directory observations without reading any ambiguous `intent.md` as authority. With
+   one valid active Change, read `.ultra/tasks.json`, then tasks whose `change_id` matches it and the
+   frontier task's `context_file` and `## Resume Note`. `.ultra/tasks.json` is the sole
+   task-status authority. A Status or Complexity header in a legacy context is a
+   migration diagnostic; the ledger wins. Historical and abandoned tasks never define
+   the frontier.
+2. After stable authority resolution, read `.ultra/project-brief.md`,
+   `.ultra/north-star.md`, `CONTEXT.md`, relevant `.ultra/decisions/`, specifications,
+   active, archived, or abandoned Changes, and evidence. In `recovery` mode, read only
+   unaffected canonical files and safe directory/Git observations; do not interpret an
+   ambiguous active intent. An abandoned Change supplies historical boundary and
+   recovery context; it never defines the current route.
 3. Inspect Git `HEAD`, worktree status, and installed host manifests without repair.
+4. When the active Change records a `durable work-package` Execution Grant, report it
+   as recorded authorization data — grant id, cited decision, and its recorded
+   subject, scope, topology, allowed effects, budgets, and invalidation — and state
+   plainly that stored grant text is inactive until a consuming Agent stably
+   verifies it per `../ultra-change/references/execution-grant.md`. Status itself
+   neither activates nor continues the grant; a `session-local` grant is reported as
+   requiring fresh owner activation.
 
 ## Definition of done
 
+- Emit the current Route Card with an exact mode, observable exit, unfinished work, and
+  one next route or safe recovery path.
 - Evaluate the artifact route in order and name the evidence supporting the match.
 - Keep stale test evidence, dirty worktree state, baseline gaps, and task graph risks
   visible without converting them into semantic failure.
@@ -35,15 +71,21 @@ persists a workflow-position field.
 |---|---|
 | No `.ultra/` | `ultra-init` |
 | Project Brief has no usable one-line and no legacy `## One-line` exists | `ultra-init` |
-| Project Brief or legacy seed exists but no accepted North Star supports the current boundary | `ultra-research` |
+| Project Brief or legacy seed exists and North Star status is `unresearched`, legacy, invalid, or not accepted for the current boundary | `ultra-research` |
 | A new request exists and no active Change exists | `ultra-change` |
 | More than one active Change exists | Diagnose the conflicting directories and ask the owner which one remains active; do not route or move either automatically |
+| A primary-transfer handoff directory exists under `.ultra/.runtime/handoffs/` | Report its protocol state read-only (`offered`, `blocked`, `active`, or a terminal state) from `OFFER.json`/`ACK.json`/`RESULT.json`, verified with `node <ultra-change-skill-dir>/scripts/validate_primary_transfer.cjs <repository-root>`; receipts are derived observations, never authority |
+| An ACK-ready handoff has no terminal RESULT | The accepted receiver is the sole canonical writer for that work package; report the in-flight transfer and never route canonical writes to another Agent |
+| A handoff is `blocked` or its live re-verification is stale | Report the mismatched observation and the recovery path (fresh handoff id after owner re-confirmation); do not repair receipts |
 | The active intent is `draft` or has a blocking unresolved decision | `ultra-change` to finish and accept the contract |
 | The active `Research Disposition` names required exit evidence that is not satisfied | `ultra-research` for the named question and selected lenses |
 | Research evidence exists but the accepted intent has not reconciled it | `ultra-change` to update the bounded contract |
+| The accepted North Star revision or digest differs from the active intent trace | `ultra-change`; report the stale observation, preserve old evidence, and reconcile IDs before execution |
 | An active Change exists and `.ultra/tasks.json` has no tasks whose `change_id` matches it | `ultra-plan` |
-| A matching task is pending or in progress with same-Change dependencies satisfied | `ultra-dev`, naming that task |
-| All matching tasks are completed and no current report matches this Change | `ultra-test` |
+| The Change has exactly one `in_progress` task | `ultra-dev`, naming that task |
+| Only `pending` tasks remain (the frontier) | Report them as frontier candidates with their unresolved dependencies and recommend one exact task id for an explicit owner invocation of `ultra-dev`; a pending row is not active work and never auto-selects a route |
+| A ledger row says `completed` but its current `ultra-task-evidence-v2` record or task-review binding is missing, stale, or structurally invalid | `ultra-dev` to repair evidence and completion provenance; do not infer a context status or silently demote the row |
+| All matching tasks are completed, each has current `ultra-task-evidence-v2` plus a consumed task review, and no current report matches this Change | `ultra-test` |
 | A current false report has implementation, test, or wiring findings selected for repair | `ultra-dev` after owner disposition |
 | A current false report has missing external or product evidence selected for collection | `ultra-research` after owner disposition |
 | A current false report has an acceptance, scope, or existing-promise change selected for reconciliation | `ultra-change` after owner disposition; use `ultra-think` internally for one consequential trade-off |
@@ -61,22 +103,92 @@ differs from `HEAD`, or its `worktree.diff_digest` or `intent_digest` differs fr
 running
 `node <ultra-test-skill-dir>/scripts/worktree_digest.cjs --project <repository-root> --change-id <change_id>`.
 A dirty worktree is a warning, not evidence of failure.
+The product-worktree digest has one fixed boundary: it excludes `.ultra/evidence/**`,
+whose command and external-observation entries bind raw bytes as
+`raw_evidence_sha256` before stable exact record bytes are bound as `evidence_digest`.
+Status must therefore use the exact ordered `task_evidence` projection and strict receipt
+consumers below for evidence provenance; it never adds another exclusion or treats
+excluded publication bytes as absent evidence.
+
+Freshness also requires the exact ordered `task_evidence` projection. Its
+`evidence_digest`, `task_review_session`, and `task_review_summary_digest` must match the
+current record and retained review — or, for an `external-manual` record, its
+`task_review_receipt_ref` and `task_review_receipt_digest` must match the current
+record and the bounded stable receipt bytes reverified through the sensor's
+`--verify-external-receipt` mode, and take its `--projection` output verbatim.
+Recheck whichever branch the record declares and never rewrite one branch into the
+other. For each item, take every command and
+external-observation `raw_evidence_ref` to bounded stable
+repository-contained bytes from an ordinary regular non-symlink file opened nonblocking
+and no-follow, with an 8 MiB ceiling and path/descriptor identity checks around the read.
+Recompute `raw_evidence_sha256` from that one snapshot and require an exact match, then
+recompute the stable exact `evidence.json` bytes as `evidence_digest` before comparing
+the projection. A raw or record mismatch routes to the owning task's explicit Dev repair.
+Run
+`node <ultra-plan-skill-dir>/scripts/validate_task_evidence.cjs <evidence-ref>`, and
+compare `task_id`, `schema`, `evidence_ref`, `task_review_session`, and
+`task_review_summary_digest` with the current ledger row, final evidence record, and
+retained strict task-review summary. The task evidence `subject` is an independently
+captured completion-snapshot freshness observation made after validated task Review and
+immediately before evidence publication. Its `task_review` separately binds the retained strict summary; neither Worker Packet v1 nor its nullable summary worktree digest proves
+the subject. Do not require that earlier observation to equal the report's later
+aggregate worktree digest. Recheck current Acceptance, criterion and verification type,
+owner record, review summary, and cited affected artifacts independently.
+
+Replay the report's strict aggregate review summary with the existing Review summary
+waiter, then run
+`node <ultra-test-skill-dir>/scripts/validate_review_transport.cjs --summary <summary-path> --report .ultra/test-report.json`.
+Require the exact `packet_digest`, `admission_digest`, `subject_digest`, and `summary_digest` bindings, plus session, summary path, execution mode, ordered findings, and report root subject.
+Each structural validator or sensor reports identity and provenance observations and never decides semantic acceptance, review quality, or `passed`.
+Any mismatch makes the report stale and routes repair to the responsible workflow.
 
 `passed: false` does not itself select a repair. Preserve each finding, ask for owner
 disposition where scope or risk changes, then route by the accepted response above.
-Likewise, task completion is necessary for `passed: true` but never sufficient to
-manufacture it.
+For a current task-review `REQUEST_CHANGES`, consume the exact validated current
+`SUMMARY.json.findings` array and preserve every finding id. Route every current P0/P1
+to resolution or authoritative disposition and refresh its affected evidence; never
+reuse a finding count or list from an older summary. P2 and P3 findings remain report
+entries or owner-selected backlog and never re-open a task on their own.
+Likewise, ledger completion and structurally valid v2 evidence are necessary for a
+current Test claim but never sufficient to manufacture `passed: true`. A validator
+reports schema, identity, provenance, and freshness observations only. It cannot decide
+whether an inspection supports a criterion, supply an `owner-judgment`, or turn an
+external receipt into product truth.
+
+Status remains read-only when later work invalidates a completed task. It names the
+affected criterion IDs and reason and recommends Dev. Dev records both in the context
+Change Log and Resume Note before the ledger-authoritative `completed` to `in_progress`
+transition; Status never silently demotes a task.
+
+A budget stop or `owner checkpoint` is displayed as-is: report the exhausted budget,
+the in-progress task it stopped, and the reachable owner decision (extend, retry,
+cancel, or abandon). Status never infers continuation, extension, or any semantic
+verdict from a budget stop, and never treats a pending frontier row as the active
+task behind one.
 
 The repository has one primary writer for canonical `.ultra` files. Native review
 workers and delegated CLIs may inspect or write isolated source roots, but their results
 return to that writer. Concurrent canonical writes require separate worktrees and
 explicit integration; this router does not invent locks or silently merge ledgers.
 
+Report the accepted North Star revision and digest, every active Change trace mismatch,
+and unresolved `FP-*`/`NS-*`/`HC-*` reference. A mismatch is stale evidence, never a
+mechanical verdict about truth or permission; supersession does not delete prior task,
+review, Test, or delivery evidence.
+
+On a fresh session, use the current Change's exact matching contexts and closing Resume
+Note to reconstruct the card. Do not rerun completed Research or infer route from chat
+memory. In `history` mode, distinguish mutable draft edits from superseding accepted
+decision records and keep rejected or abandoned alternatives visible when they explain
+the current boundary.
+
 ## Surface risk and installation health
 
 List unmet task dependencies, more than one matching `in_progress` task under the
-single-writer contract, any `in_progress` task older than 3 days, complexity
-concentration, and broken `trace_to` or `context_file` paths. These are sensors.
+single-writer contract, broken `trace_to` or `context_file` paths, stale subject or
+acceptance identities, unresolved task-review findings, and concrete evidence that a
+task can no longer resume reliably. A timestamp, complexity value, file count, or task
+count is context for the model, never a staleness or quality verdict.
 
 Compare the selected host's plugin path, skill inventory, version, provenance, and hook
 manifest with installed files. Recommend `ubp install` or `ubp update` as the repair;
@@ -89,6 +201,8 @@ Contradictory facts remain visible instead of being resolved by routing heuristi
 
 ## References
 
+- `../ultra-change/references/change-contract.md` — canonical Active Change authority resolution.
+- `references/route-contract.md` — canonical Route Card, checkpoint, continuation, and recovery contract.
 - `../ultra-think/SKILL.md` — read only when contradictory evidence creates one real
   decision rather than a mechanical repair.
 - `../ultra-think/references/autonomy-boundary.md` — read before recommending a route

package/skills/ultra-status/references/route-contract.md

@@ -0,0 +1,100 @@
+# Route Contract
+
+This reference defines the owner-visible navigation surface shared by every public
+Ultra Skill. A Route Card is a derived observation from canonical project files, Git,
+and the current run. It is not workflow authority, a stage marker, or permission to
+continue.
+
+## Route Card
+
+Show a compact `UBP Route Card` at entry, at a material checkpoint, when pausing or
+blocked, at the observable exit, and before moving to another public Skill. Keep an
+unchanged field short, but never omit an unresolved decision or unfinished obligation.
+
+| Field | Meaning |
+|---|---|
+| `Route` | The current public Skill, or `idle` when no workflow is active |
+| `Mode` | One mode declared by that Skill |
+| `Why` | The current problem or evidence gap |
+| `Outcome` | The owner-visible result this route is trying to produce |
+| `Accepted boundary` | Accepted scope, exclusions, and authority that cover this run |
+| `Position` | Artifact-derived navigation such as selected reports or remaining tasks |
+| `Exit condition` | Observable evidence or owner decision that ends this mode |
+| `Delta` | Material facts changed since the prior card |
+| `Reality` | Live path, verification state, fakes, limitations, and unknowns |
+| `Decision needed` | One material owner decision, or `none` |
+| `Next` | The smallest covered continuation or one recommended public route |
+| `Not done` | Obligations left at a pause or exit |
+
+`Position` may report exact mechanical observations such as selected lenses with
+reports, dependency-ready tasks, or an ACP session waiting for permission. Never turn a
+count, validator result, finding total, or transport event into semantic progress or a
+numeric completion score.
+
+## Material checkpoints
+
+Stop and obtain the Owner's current decision before any of these changes or effects:
+
+1. a new or reduced North Star, specification, or Change commitment;
+2. a material delta to an active Change outcome, acceptance, non-goal, or public seam;
+3. evidence that materially changes the feasible direction or product boundary;
+4. wider Execution Grant scope, effects, budget, expiry, or Agent/provider topology;
+5. transfer of the canonical writer;
+6. unresolved P0/P1, risk acceptance, or the same root cause surviving three failed fixes;
+7. finalization, archive, commit, push, tag, publication, deployment, real installation,
+   credentials, provider spend, or another external or irreversible effect.
+
+Naming, internal design, ordinary technical choices, task decomposition, covered local
+edits and tests, and non-material evidence reconciliation remain model-owned inside the
+accepted boundary. Do not ask for confirmation when `Decision needed` is `none`.
+
+## Continuation
+
+Public modes belong to one of three invocation classes; model-only disciplines form a
+fourth class:
+
+| Invocation class | Owner entry | Model continuation |
+|---|---:|---:|
+| `explicit-entry` | yes | no |
+| `grant-continuable` | yes | only under a valid Execution Grant covering that mode |
+| `router` | yes | no; the Owner invokes read-only diagnosis explicitly |
+| `model-discipline` | no | only as an internal method of a covered workflow |
+
+Host metadata is only a coarse discovery bit. Before continuing, the Skill itself must
+verify its selected mode, the same active `change_id`, the valid Execution Grant,
+allowed local effects, stop conditions, and any material checkpoint. A coarse Host bit
+never permits an explicit-entry mode. Without a covering grant, stop with a Route Card
+and recommend the exact explicit route; never invoke another public Skill merely because
+its files appear ready.
+
+Within an accepted Change and valid grant, show the Route Card before each public Skill
+transition and continue without a confirmation question only when the next mode and all
+effects are covered. A material checkpoint still pauses. `Next` is either `continue:
+<route>/<mode>` when covered or `recommend: <route>/<mode>` when owner invocation is
+required.
+
+Execution events such as tool calls, plans, usage, permission requests, worker output,
+ACP updates, and process termination are transport observations. They may populate
+`Position`, `Delta`, or `Reality`; they never decide acceptance, task completion, or the
+next semantic route.
+
+## Recovery and degraded diagnosis
+
+On a fresh session or Host, reconstruct the card from the accepted North Star, Project
+Brief, active Change authority, task ledger and matching contexts, decisions, evidence,
+Git, and current installation/runtime observations. Read the closing `## Resume Note`
+for only the current work package. Do not rerun completed Research or create a route
+ledger to remember where the conversation stopped.
+
+If authority is absent, ambiguous, stale, malformed, or temporarily unreadable, stop
+semantic writes but keep read-only diagnosis reachable. Report the exact fact that
+prevents a normal route and the cheapest safe repair, retry, cancel, abandon, or fresh
+session path. Never describe a blocked route as an endless in-progress workflow.
+
+Owner revisions remain recoverable: edit a draft in place, supersede an accepted
+decision with a new owner record, and preserve Git/history. Status may summarize that
+history on request, but no event log becomes a second source of truth.
+
+When context pressure threatens reliable continuation, finish the nearest safe write,
+refresh the canonical context's Resume Note, show a final card, and recommend a fresh
+session. Context size is an observation, not a hard semantic gate.

package/skills/ultra-tdd/SKILL.md

@@ -10,8 +10,14 @@ the loop that supplies it, and it serves Goal 3, Production-Ready.
 
 ## Before you start
 
-1. When called from a planned Change, resolve the unique active `change_id` and read the
-   matching current task context for the seams already confirmed during planning. For a
+1. When called from a planned Change, read
+   `../ultra-change/references/change-contract.md` and apply its **Active Change
+   authority resolution** before reading any active `intent.md`, resolving the current
+   `change_id` or task, reading its context, running the baseline, or executing red-green
+   product edits. A stable zero result stops with no current task; any typed diagnostic,
+   including non-unique authority, stops with its repair before the baseline, red-green,
+   or any product write. After one valid authority, read its intent, `.ultra/tasks.json`,
+   and the matching current task context for the seams confirmed during planning. For a
    micro edit outside the Ultra lifecycle, no active task context is required; use the
    accepted request, maintained specification, and an existing repository seam, and
    create no Ultra task or delivery claim.
@@ -43,8 +49,8 @@ Write the failing test first and run it, so that red is observed rather than
 assumed. Then write the smallest code that turns it green. Predict no later
 tests and add no speculative capability. Then take the next slice.
 
-Refactoring is not part of this loop; `ultra-review` owns it, because the
-restructuring worth doing only becomes visible after three or four slices.
+Refactoring is not part of this loop; `ultra-review` owns it when observed duplication,
+coupling, or a boundary defect supplies evidence that restructuring is worthwhile.
 
 ## Three patterns that produce tests worth deleting
 
@@ -77,6 +83,7 @@ goes to the owner as one.
 
 ## References
 
+- `../ultra-change/references/change-contract.md` — canonical Active Change authority resolution.
 - `../ultra-think/references/autonomy-boundary.md` — read before replacing a real
   dependency with a fake, or when a test stands between the work and green.
 - `references/templates/README.md` — read when choosing which enabling template

package/skills/ultra-tdd/references/test-execution.md

@@ -11,8 +11,13 @@ For every baseline, red, and green run record:
 - runner-reported pass, fail, skip, and coverage counts when available;
 - first useful failure with tight source or test location;
 - whether it reproduces and whether it is product, test, environment, or flaky evidence;
-- raw output path under `.ultra/evidence/<task-id>/` when the output matters.
+- raw output path under `.ultra/evidence/<task-id>/` and the lowercase SHA-256 of its
+  exact bounded stable bytes when the output matters.
 
 Do not weaken flags, skip a relevant failure, edit test configuration to obtain green,
 or claim success when the command did not finish with exit zero. A concise evidence
 record may cite the raw log; it must not copy an entire transcript into task context.
+Before citing one, require a repository-contained ordinary regular non-symlink file,
+opened nonblocking and no-follow with an 8 MiB ceiling and unchanged path/descriptor
+identity around the read. Hash that one snapshot; a missing, escaped, special, symlinked,
+oversized, or replaced receipt is a typed evidence gap, not a successful run record.

package/skills/ultra-test/SKILL.md

@@ -9,22 +9,54 @@ This is the one end-of-change sensor allowed by PHILOSOPHY C4: an export cannot
 called orphaned while a later task may still wire it. It is a terminal sensor, never a gate;
 the owner decides what to fix or accept.
 
+## Route modes
+
+| Mode | Entry | Observable exit | Next |
+|---|---|---|---|
+| `audit` | Explicit invocation or a valid Execution Grant after every matching task has current completion evidence | One current whole-Change report and aggregate review preserve all six audit areas, findings, omissions, identities, and dispositions | Recommend `ultra-deliver/reconcile` when current, or the owner-selected responsible route |
+| `reaudit` | Explicit invocation or a valid Execution Grant after an owner-dispositioned repair invalidates the prior report | A fresh report binds the repaired Change snapshot without hiding earlier findings | Recommend `ultra-deliver/reconcile` when current, or another bounded owner disposition |
+
+Follow `../ultra-status/references/route-contract.md`. Show a Route Card at audit entry,
+before asking for finding disposition, and at the report exit. Audit counts and review
+events populate `Position` or `Reality`; they never choose repair, convergence, or risk
+acceptance. Test does not call its own repair route.
+
 ## Before you start
 
-1. Resolve exactly one `.ultra/changes/active/<change_id>/intent.md`. Read
-   `.ultra/tasks.json` and only tasks whose `change_id` matches the active Change. Every
-   matching task must be complete; read each task's `context_file` Acceptance, Completion and
-   closing `## Resume Note`. Historical tasks are not part of this audit snapshot.
-2. Read `CONTEXT.md` for vocabulary and the relevant `.ultra/decisions/` entries.
-3. Read the active Change intent, the task evidence directories and the current Git
+1. If model-selected, verify the live execution grant in `../ultra-change/references/execution-grant.md` — a current session-local activation or a stably verified durable work-package grant; without either, stop.
+2. Read `../ultra-change/references/change-contract.md` and apply its **Active Change
+   authority resolution** before reading any active `intent.md` or resolving a current
+   `change_id`. This workflow requires its one valid active authority; any zero result
+   or typed diagnostic stops before audit input is read until the stated repair or retry
+   succeeds. Read `.ultra/tasks.json` and only tasks whose `change_id` matches the active
+   Change. Every matching task must be `completed` in that sole task-status authority.
+   Read each task's `context_file` Acceptance, Completion, Task Review and closing
+   `## Resume Note`.
+   Historical tasks are not part of this audit snapshot. For every current Change task,
+   require a current `ultra-task-evidence-v2` record whose context, subject, acceptance,
+   and task-review bindings satisfy `../ultra-plan/references/task-evidence-v2.md`.
+   A legacy context Status or Complexity header and v1 evidence remain migration
+   diagnostics only; recommend Dev repair rather than treating them as current Test input.
+3. Read `CONTEXT.md` for vocabulary and the relevant `.ultra/decisions/` entries.
+4. Read the active Change intent, the task evidence directories and the current Git
    `HEAD`; old output is evidence only for the commit it names.
-4. Resolve this loaded Skill's directory and run
+   Resolve Change and task `FP-*`, `NS-*`, and `HC-*` IDs against the accepted North
+   Star revision. A stale trace is an explicit finding requiring reconciliation, not a
+   silent rewrite or automatic failure verdict.
+5. Resolve this loaded Skill's directory and run
    `node <ultra-test-skill-dir>/scripts/worktree_digest.cjs --project <repository-root> --change-id <change_id>`
    before and after the audit. It returns the stable Change id, exact intent SHA-256,
-   HEAD, and product-worktree digest. The product digest excludes the report and all
-   active/archive/abandoned Change-directory metadata; intent freshness is checked
-   separately, so writing delivery metadata or moving the same Change cannot invalidate
-   its tested product snapshot.
+   HEAD, and product-worktree digest. The product-worktree digest has one fixed boundary:
+   it excludes `.ultra/evidence/**`, whose command and external-observation entries bind
+   raw bytes as `raw_evidence_sha256` before stable exact record bytes are bound as
+   `evidence_digest`. It also excludes the report and
+   all active/archive/abandoned Change-directory metadata. Intent freshness is checked
+   separately, so publishing or refreshing evidence, writing delivery metadata, or moving
+   the same Change cannot self-invalidate its tested product snapshot. Exact task-evidence
+   and review-receipt digests remain mandatory through their existing consumers; this is
+   not a caller-configurable exclusion. This digest defines the aggregate Change subject
+   for the current whole Change; it is distinct from each task's earlier
+   completion-snapshot freshness observation.
 
 ## Definition of done
 
@@ -34,6 +66,15 @@ the owner decides what to fix or accept.
 - `.ultra/test-report.json` records `change_id`, the exact current-Change `task_ids`,
   `intent_digest`, `git_commit`, commands, findings, omissions and the owner's
   disposition without rewriting a finding into a pass.
+- Every current task's v2 evidence and retained task-review summary is consumed; blocking
+  findings, resolutions, disagreements, and refresh references remain attributable.
+- One current aggregate Change review is referenced by session, packet digest, exact
+  admission and subject digests, execution mode, coverage, summary path, exact summary
+  SHA-256, and verdict.
+- The report names `ultra-review-findings-v4` and copies every review finding unchanged,
+  including `north_star_trace.first_principles`, `.serves`, and `.touches`, so each
+  finding carries its resolving `FP-*`/`NS-*`/`HC-*` IDs and Deliver can
+  test evidence against outcome without copying the North Star prose.
 
 ## Audit six areas
 
@@ -59,6 +100,95 @@ file is how a report loses findings.
 Read `references/export-syntax.md` before collecting exports. The table finds
 candidates; repository conventions and real consumers decide what is public.
 
+After the six areas, follow `../ultra-review/SKILL.md` for an aggregate Change review.
+Read only its validated summary, preserve its findings, and carry the review session,
+packet digest, admission digest, subject digest, execution mode, coverage refs, summary
+ref, verdict, and limitations into the report. Record
+`review.finding_schema: "ultra-review-findings-v4"`; copy each finding
+object unchanged from the v4 summary, including `north_star_trace`. An incomplete review
+stays an omission; it never becomes a silent pass. Historical v3 review is evidence only:
+run a fresh v4 aggregate review before a current Test claim.
+
+Before accepting copied review metadata or findings, replay the exact frozen
+`SUMMARY.json` through the sibling `ultra-review/scripts/review_wait.py` v4 summary
+validator. Strict v4 replay is the default and requires the same session's valid
+`ADMISSION.json`; `--legacy-v4` is an explicit read mode only for immutable historical
+pre-admission evidence and cannot support a current Test claim. Then bind its
+`change_id`, ordered `task_ids`, `head`, `admission_digest`, `subject_digest`,
+`context_digest`, and
+honest nullable `worktree_digest` to the Test report's root identity and `review`
+provenance fields. The transport sensor accepts only canonical
+`.ultra/test-report.json` and the normalized repository-relative
+`.ultra/reviews/<session>/SUMMARY.json` it names. Both use the same bounded stable
+raw-byte snapshot rule: every managed path component below the real repository root is
+non-symlink, the final entry is a repository-contained regular file, and an 8 MiB + 1
+byte observation returns a typed oversize diagnostic before JSON parsing or hashing.
+The final file is opened with `O_NONBLOCK` and `O_NOFOLLOW`; its descriptor is
+immediately required to be a regular file with the inspected path identity. A type or
+identity replacement returns the existing retryable snapshot diagnostic instead of
+waiting on a special file.
+The sensor uses one report snapshot for report parsing and subject comparisons, and one
+summary snapshot for summary parsing, SHA-256, comparisons, and the waiter's stdin
+validation. After writing those exact values and findings, run
+`node <ultra-test-skill-dir>/scripts/validate_review_transport.cjs --summary <validated-summary-path> --report .ultra/test-report.json`.
+Record that exact command, exit code, and evidence reference in `commands`. A nonzero
+result is a typed transport observation: repair the report copy and rerun it; never drop,
+merge, inject, or rewrite a finding to obtain a pass. This sensor compares exact summary
+bytes, review metadata, and finding objects only. It does not reinterpret a finding or
+decide the audit verdict.
+
+Validate each task evidence record with the shipped v2 structural sensor before using
+it. For every record whose `task_review.review_mode` is `external-manual`, rerun the
+sensor with `--verify-external-receipt` and recheck the declared receipt branch — the
+bounded stable receipt bytes, its recorded SHA-256, and its task/change/subject
+identity — instead of replaying a strict summary; strict-v4 records keep their exact
+waiter and transport replay. A task's declared branch is preserved as-is in the
+ordered `task_evidence` projection, consuming each item from the sensor's
+`--projection` output verbatim: an external-manual item carries `task_review_mode`,
+`task_review_receipt_ref`, and `task_review_receipt_digest` where a strict item
+carries its session and summary digest. Never rewrite one branch into the other. The CLI establishes only JSON shape, token syntax, and
+authority designation; it does not prove current identity, provenance, freshness,
+or semantic acceptance. Test
+takes each command and external-observation `raw_evidence_ref` to bounded stable
+repository-contained bytes from an ordinary regular non-symlink file opened nonblocking
+and no-follow, with an 8 MiB ceiling and path/descriptor identity checks around the read.
+Recompute `raw_evidence_sha256` from that one snapshot and require an exact match. Then
+recompute the stable exact `evidence.json` bytes as `evidence_digest` before copying the
+ordered `task_evidence` projection; a raw or record mismatch is an evidence gap returned
+to Dev.
+Test
+takes stable bytes independently, then rechecks and recomputes the current Acceptance-section SHA-256, aligns exact criterion IDs and verification types with the current context, and aligns the task-review session and summary digest with the retained strict summary. For `owner-judgment`, require that the durable owner record exists with its cited statement and disposition readable before rechecking all cited affected artifacts.
+The `subject` is an independently captured completion-snapshot freshness observation made after the final strict task Review validates and immediately before evidence publication; `task_review` separately binds the retained strict summary. Worker Packet v1 carries no task worktree digest and its summary records `worktree_digest: null`, so Test never claims that those review artifacts prove or cryptographically bind `subject.worktree_digest`. It also never replaces that earlier observation with the later aggregate Change digest.
+The owner alone supplies an owner-judgment result. A later task may change the aggregate
+worktree without invalidating an earlier task, but any changed acceptance, owner record,
+review binding, or cited artifact that no longer supports its criterion is a mismatch.
+Any mismatch is an evidence gap: return the affected task and criterion IDs to Dev, or
+return a missing owner judgment to the owner. Test never edits task status. Dev records the reason and performs
+the explicit ledger `completed` to `in_progress` reopen; no silent demotion is allowed.
+Never turn structural sensor success into any of those consumer conclusions.
+
+This is a cooperative-workspace drift sensor, not an operating-system isolation
+primitive. Use one fixed closing protocol: one complete primary observation followed by
+one terminal seal. A persistent mismatch observed inside or before that terminal seal
+returns typed `ULTRA_SNAPSHOT_CHANGED_DURING_OBSERVATION` recovery instead of publishing
+the tuple. A cooperative write after the completed terminal seal belongs to the next
+consumer, which must perform a fresh recapture before using the tuple. Hostile writers or
+interleavings require a native Host sandbox or an isolated worktree. Never add an
+unbounded success-seeking replay.
+
+Aggregate finding disposition is bounded: P2 and P3 findings are recorded as backlog or
+residual risk and never automatically returned to Dev, and this audit writes
+non-blocking refactor observations into the report instead of reopening a completed
+task. An implementation P0/P1 found here returns to Dev as at most one new
+owner-approved repair task; there is no unbounded Test ↔ Deliver bounce, and any
+re-entry through Test after a report is consumed requires an explicit owner
+disposition.
+
+The receipt is non-authoritative derived evidence, but retain it until both Test and
+Deliver have consumed the review. If it is missing, the current session and Test claim
+are `INCOMPLETE`; start a fresh review session. Do not reconstruct it or use
+`--legacy-v4` to bypass loss from a current strict session.
+
 ## Detect substantive stubs
 
 Report an empty return with no IO, a log-only function, a handler that only prevents
@@ -73,19 +203,27 @@ findings with paths, verified seams, material omissions, residual risk, and `pas
 the model's evidence-derived summary in the one canonical
 `.ultra/test-report.json`. Each command records `command`, `exit_code`, and an
 `evidence_ref`; each area records `status`, `evidence_refs`, and `omissions`. Copy the
-script's `head`, `dirty`, `diff_digest`, and `intent_digest` into the report. A stale
+worktree script's `head`, `dirty`, `diff_digest`, and `intent_digest` into the report.
+That worktree identity binds the current whole Change, while ordered `task_evidence`
+items preserve each task's distinct completion-snapshot freshness observation and
+separate task-review identity.
+Copy the validated review summary's exact SHA-256 into `review.summary_digest`; the
+transport validator recomputes it before the report can be current evidence. A stale
 commit, product digest, intent digest, Change id, or task-id snapshot is labelled stale;
 it is never reused as current proof.
 
-`passed` is a one-way claim: `true` requires every current-Change task complete and no
-required area left `not_run`. Completed tasks do not force `passed: true`; findings,
-omitted evidence, or a failed command may keep it false, while an explicitly
-dispositioned gap remains visible even if the model's evidence summary passes. Preserve
-the finding and the owner's disposition as separate fields.
+`passed` is a one-way claim: `true` requires every current-Change task completed in the
+ledger, current v2 task evidence and task-review provenance, and no required area left
+`not_run`. Completed rows do not force `passed: true`; findings, omitted evidence, or a
+failed command may keep it false, while an explicitly dispositioned gap remains visible
+even if the model's evidence summary passes. Preserve the finding and the owner's
+disposition as separate fields. No validator result is itself semantic acceptance.
 
 Present the findings by consequence and recommend the highest-leverage response. The
 owner may fix all, fix selected findings, accept recorded risk, or reduce scope through
-the normal REDUCTION decision. Recommend the next capability; do not invoke it.
+the normal REDUCTION decision. Recommend the next capability. Continue only when the
+owner disposition or existing grant covers its exact mode and effects, and show the
+transition Route Card first; Test itself never manufactures that coverage.
 
 ## When the owner decides
 
@@ -94,8 +232,13 @@ an observation, not permission to auto-fix, weaken a test or silently change sco
 
 ## References
 
+- `../ultra-change/references/change-contract.md` — canonical Active Change authority resolution.
 - `references/export-syntax.md` — read during Wiring Verification to find exported
   symbol candidates in TypeScript/JavaScript, Python, Go, Rust and Java.
 - `scripts/worktree_digest.cjs` — deterministic HEAD plus worktree evidence identity.
+- `../ultra-review/SKILL.md` — read for aggregate Change review after the six-area audit.
+- `../ultra-plan/references/task-evidence-v2.md` — canonical current task evidence and task-review contract.
+- `../ultra-change/references/execution-grant.md` — read only for grant-activated continuation.
+- `../ultra-status/references/route-contract.md` — owner-visible route, checkpoint, and recovery output.
 - `../ultra-think/references/autonomy-boundary.md` — read when a proposed response
   would make an existing specification commitment stop holding.