ultra-builder-pro-cli 0.5.3 → 0.7.0

package/docs/ROADMAP.md

@@ -1,20 +1,19 @@
 # ultra-builder-pro-cli — Roadmap
 
-> **Authoritative roadmap**: [`PLAN.zh-CN.md`](./PLAN.zh-CN.md) (v0.3.1).
-> This file is a one-page summary; details, decisions, and time estimates
-> live in PLAN. If they disagree, PLAN wins.
+> **Current roadmap**. [`PLAN.zh-CN.md`](./PLAN.zh-CN.md) preserves the original
+> phase plan and decision history. Current executable contracts live in
+> `spec/`, `AGENT-CONTEXT.md`, and `RUNTIME-COMPAT-MATRIX.md`; those sources win
+> when historical plan text differs.
 
 **Goal**: distribute the Ultra Builder Pro engineering loop as native Claude
-Code, OpenCode, and Codex plugins, retain a Gemini compatibility extension, and
-run the loop with isolated sessions sharing one authoritative workflow store.
+Code, OpenCode, and Codex plugins, and run it with isolated sessions sharing one
+authoritative workflow store.
 
 **First-class runtimes**: Claude Code · OpenCode · Codex.
 
 **Distribution channels (v1.0)**: npm · Homebrew · pip.
 
-**Confidence**: 86% (PLAN §10).
-
-**Timeline**: 14–18 weeks AI-assisted (PLAN §11).
+**Release line**: `0.7.x`; every release is gated by `npm run verify:release`.
 
 ---
 
@@ -23,7 +22,7 @@ run the loop with isolated sessions sharing one authoritative workflow store.
 | Release | Week | Contents                                                                  |
 |---------|-----:|---------------------------------------------------------------------------|
 | **v0.1**| 8    | Rule layer + execution-lite (session isolation + admission + event subscribe + active-session visibility) — solves the core "independent conversations don't pollute each other" pain |
-| **v0.2**| 11   | Auto-recovery + monitoring + real-time code-review-graph + full conformance |
+| **v0.2**| 11   | Auto-recovery + monitoring + full conformance |
 | **v0.3**| 16   | PRD → execution-plan artifact → parallel dispatch / merge — coding factory |
 | **v1.0**| 17–18| Three-channel publish (npm + Homebrew + pip)                              |
 
@@ -38,30 +37,31 @@ run the loop with isolated sessions sharing one authoritative workflow store.
 | 4     | Cross-runtime distribution + 4.6a smoke flow   | ✅ done (D41, `5aa1fd0`) |
 | 4.5   | Execution-lite (session + admission + events)  | ✅ done (D42, `0d3e5ed`) — **v0.1 ready** |
 | 5     | Recovery + staleness + auto-routing            | ✅ done (D43) → v0.2 |
-| 6     | Monitoring + code-review-graph live watcher    | ✅ done (D44) → v0.2 |
+| 6     | Monitoring + telemetry                          | ✅ done (D44) → v0.2 |
 | 4.6b  | Full conformance suite                         | ✅ done (D45) — 20 conformance + 21 resolveTarget tests |
 | 7     | tagged tasks + skill mining; retired Ultra memory handed to cloud-mem/claude-mem | ✅ superseded by D50 boundary cleanup |
 | 8A    | Plan automation (parse / topo / expand + artifact + human gate) | ✅ done (D47, `a932cb8`) → v0.3 |
 | 8B    | Execution automation (dispatch / parallel worktree / merge) | ✅ done (D48, `8224159`) — **v0.3 ready** |
-| 9     | Release pipeline (npm / Homebrew / pip)        | pending → v1.0 |
+| 8C    | Continuous change packets + context compiler + convergence + doctor | ✅ done (D52) |
+| 9     | Release pipeline                               | npm tag publishing live; Homebrew / pip not implemented |
 
 ## What is in the repo today
 
 ```
 spec/                       ← Phase 1 single source of truth
-├── mcp-tools.yaml          (30 declared tools across 7 families; 21 live)
+├── mcp-tools.yaml          (29 live tools across 5 families)
 ├── cli-protocol.md         (CLI ↔ MCP mapping table)
 ├── schemas/                (state-db.sql + 4 JSON schemas)
 ├── fixtures/{valid,invalid}/  (+ v4.4-project for migration)
-└── scripts/test-all.cjs    (npm run test:spec — 5 validators)
+└── scripts/test-all.cjs    (npm run test:spec — 7 validation stages)
 
 mcp-server/                 ← Phase 2 authoritative state layer
-├── server.cjs              (stdio MCP server, 21 task/session/plan tools)
+├── server.cjs              (stdio MCP server, 29 task/session/change/system/plan tools)
 ├── lib/
 │   ├── state-db.cjs        (SQLite + WAL + pragmas)
 │   ├── state-ops.cjs       (full write API, status state machine)
 │   └── projector.cjs       (state.db → tasks.json + context md)
-└── tests/                  (npm run test:state — 44 tests)
+└── tests/                  (npm run test:state)
 
 ultra-tools/                ← CLI fallback, migration, and diagnostics
 ├── cli.cjs
@@ -72,11 +72,11 @@ ultra-tools/                ← CLI fallback, migration, and diagnostics
 
 bin/install.js              ← multi-runtime installer
 bin/handbook.js             ← explicit managed user-handbook sync
-adapters/                   ← native Claude/OpenCode/Codex plugin builders + Gemini compatibility
+adapters/                   ← native Claude/OpenCode/Codex plugin builders
 skills/                     ← allowlisted Ultra workflows, internal rules, and collab companions
 hooks/                      ← 7 workflow-only Python hooks; OpenCode uses native JavaScript hooks
 docs/
-├── PLAN.zh-CN.md                authoritative plan (1670+ lines)
+├── PLAN.zh-CN.md                historical phase plan + decision log
 ├── ARCHITECTURE.md              Phase 1 single-page entry point
 ├── AGENT-CONTEXT.md             Phase 3 canonical runtime context contract
 ├── USER-HANDBOOK-CONTRACT.md    managed CLAUDE.md / AGENTS.md boundary

package/docs/RUNTIME-COMPAT-MATRIX.md

@@ -1,89 +1,88 @@
 # Runtime Compatibility Matrix
 
 Current presentation contract for Ultra Builder Pro. Claude Code, OpenCode, and
-Codex are first-class native plugins; Gemini CLI remains a compatibility
-extension. The canonical asset boundary lives in
-`adapters/_shared/runtime-assets.cjs`.
+Codex are the supported native plugin hosts. The canonical asset boundary lives
+in `adapters/_shared/runtime-assets.cjs`.
 
-Legend: **FULL** = native host surface, **DEGRADED** = compatible but missing an
+Legend: **FULL** = native host surface, **DEGRADED** = supported but missing an
 equivalent lifecycle/control surface, **N/A** = intentionally not installed.
 
 ## 1. Plugin and workflow surface
 
-| Capability | Claude Code | OpenCode | Codex | Gemini CLI |
-|---|---|---|---|---|
-| Package form | `.claude-plugin` native plugin | native config bundle + JS plugin | personal `.codex-plugin` | compatibility extension |
-| Public entry | `/ultra-*`, `/learn` | `/ultra-*`, `/learn` | `$ultra-builder-pro:<skill>` | generated command TOML |
-| Public Ultra workflows | 10 | 10 | 10 | 10 |
-| Internal agent-rule skills | 4, non-user-facing | 4, non-user-facing | 4 with implicit invocation disabled | 4 prompt dependencies |
-| Collaboration companions | `codex-collab`, `gemini-collab`, `ultra-verify` | `cc-collab`, `codex-collab`, `gemini-collab`, `ultra-verify` | `cc-collab`, `gemini-collab`, `ultra-verify` | `cc-collab`, `codex-collab`, `ultra-verify` |
-| External browser/deploy/framework skills | N/A | N/A | N/A | N/A |
+| Capability | Claude Code | OpenCode | Codex |
+|---|---|---|---|
+| Package form | `.claude-plugin` native plugin | native config bundle + JS plugin | personal `.codex-plugin` |
+| Public entry | `/ultra-*`, `/learn` | `/ultra-*`, `/learn` | `$ultra-builder-pro:<skill>` |
+| Public Ultra workflows | 12 | 12 | 12 |
+| Internal agent-rule skills | 4, non-user-facing | 4, non-user-facing | 4 with implicit invocation disabled |
+| Collaboration companions | `codex-collab`, `ultra-verify` | `cc-collab`, `codex-collab`, `ultra-verify` | `cc-collab`, `ultra-verify` |
+| External browser/deploy/framework skills | N/A | N/A | N/A |
 
-Codex does not emulate deprecated custom slash prompts. Its adapter converts
-the workflows into namespaced skills and records nine legacy command mappings
-in `command-map.json`; `ultra-review` is directly invocable as a skill.
+Codex converts the workflows into namespaced skills and records eleven legacy
+command mappings in `command-map.json`; `ultra-review` remains directly
+invocable as a skill.
 
 ## 2. Agents and collaboration
 
-| Capability | Claude Code | OpenCode | Codex | Gemini CLI |
-|---|---|---|---|---|
-| Bundled review/debug agents | FULL, native Markdown agents | FULL, lowercased native agent frontmatter | FULL, nine managed TOML custom agents | N/A |
-| Native bounded delegation | `Task`/agent surface | native agent surface | native Codex subagents | evolving host surface, not packaged |
-| Cross-host advisor | explicit collab skill; read-only | explicit collab skill; read-only | explicit collab skill; read-only | explicit collab skill; read-only |
-| Primary-agent ownership | FULL | FULL | FULL | FULL |
+| Capability | Claude Code | OpenCode | Codex |
+|---|---|---|---|
+| Bundled review/debug agents | FULL, native Markdown agents | FULL, native agent frontmatter | FULL, nine managed TOML custom agents |
+| Native bounded delegation | native agent surface | native agent surface | native Codex subagents |
+| Cross-host advisor | explicit and read-only | explicit and read-only | explicit and read-only |
+| Primary-agent ownership | FULL | FULL | FULL |
 
-No bundled agent declares private persistent memory. It receives current
-checkout evidence and bounded context from the primary host, then returns a
-result for primary verification.
+No bundled agent owns private persistent memory. It receives current-checkout
+evidence and bounded context from the primary host, then returns a result for
+primary verification.
 
 ## 3. Workflow hooks
 
-| Lifecycle | Claude Code | OpenCode | Codex | Gemini CLI |
-|---|---|---|---|---|
-| Session context/health | FULL, native `SessionStart` | FULL, system transform + event refresh | FULL, native `SessionStart` | N/A |
-| Active edit boundary | FULL, `PreToolUse Edit|Write` | FULL, `tool.execute.before` rejects projection writes | FULL, `PreToolUse Edit|Write|apply_patch` | N/A |
-| Compaction recovery | FULL, `PreCompact` + compact resume matcher | FULL, native compacting context | FULL, `PreCompact` + `PostCompact` | N/A |
-| Incomplete-stop gate | FULL, native blocking `Stop` hook | DEGRADED, no equivalent blocking stop hook | FULL, native blocking `Stop` hook | N/A |
-| Subagent lifecycle evidence | FULL | DEGRADED, no equivalent packaged event | FULL | N/A |
-
-All reachable hooks are workflow-only and no-op without an active non-terminal
-`.ultra/workflow-state.json`. No runtime receives Ultra prompt capture,
-transcript capture, observation journal, session-summary memory, generic command
+| Lifecycle | Claude Code | OpenCode | Codex |
+|---|---|---|---|
+| Session context/health | FULL, native `SessionStart` | DEGRADED, native context; health via `system.doctor` | FULL, native `SessionStart` |
+| Active edit boundary | FULL, `PreToolUse Edit|Write` | FULL, `tool.execute.before` rejects projection writes | FULL, `PreToolUse Edit|Write|apply_patch` |
+| Compaction recovery | FULL, `PreCompact` + resume matcher | FULL, native compacting context | FULL, `PreCompact` + `PostCompact` |
+| Incomplete-stop gate | FULL, native blocking `Stop` | DEGRADED, no equivalent blocking stop hook | FULL, native blocking `Stop` |
+| Subagent lifecycle evidence | FULL | DEGRADED, no equivalent packaged event | FULL |
+
+Health/context hooks inspect initialized projects; projection protection also
+applies at baseline, while compact/stop/subagent enforcement remains active-workflow scoped.
+No host receives prompt capture, transcript
+capture, observation journaling, session-summary memory, generic command
 blocking, or generic post-edit policy.
 
 ## 4. MCP and state
 
-| Capability | Claude Code | OpenCode | Codex | Gemini CLI |
-|---|---|---|---|---|
-| stdio MCP registration | plugin `.mcp.json` | `opencode.json` local MCP entry | plugin `.mcp.json` | extension manifest |
-| Live contracts | 21 | 21 | 21 | 21 |
-| Declared upstream contracts | 30 | 30 | 30 | 30 |
-| Nine non-live contracts | host-native review/discovery/ask surfaces | host-native review/discovery/ask surfaces | explicit `codex-capability-map.json` | compatibility guidance |
-| Durable authority | project `.ultra/state.db` | project `.ultra/state.db` | project `.ultra/state.db` | project workflow state when invoked from the project |
-| Ultra memory API | N/A | N/A | N/A | N/A |
+| Capability | Claude Code | OpenCode | Codex |
+|---|---|---|---|
+| stdio MCP registration | plugin `.mcp.json` | `opencode.json` local MCP entry | plugin `.mcp.json` |
+| Live/declared contracts | 29 | 29 | 29 |
+| Host-native review/discovery/ask | native | native | documented in `codex-capability-map.json` |
+| Durable authority | project `.ultra/state.db` | project `.ultra/state.db` | project `.ultra/state.db` |
+| Ultra memory API | N/A | N/A | N/A |
 
-The seven declared tool families are `task`, `session`, `plan`, `review`,
-`impact`, `skill`, and `ask`. Only the 21 `task.*`, `session.*`, and `plan.*`
-operations registered by `mcp-server/server.cjs` are advertised as live.
+All 29 `task.*`, `session.*`, `change.*`, `system.*`, and `plan.*` operations
+registered by `mcp-server/server.cjs` are live. Review, impact discovery, skill
+loading, and user interaction remain host-native surfaces.
 
 ## 5. User handbook presentation
 
-| Capability | Claude Code | OpenCode | Codex | Gemini CLI |
-|---|---|---|---|---|
-| Durable user file | `~/.claude/CLAUDE.md` | `~/.config/opencode/AGENTS.md` | `~/.codex/AGENTS.md` | extension `GEMINI.md` context |
-| Automatic overwrite by plugin install | no | no | no | extension-owned context only |
-| Explicit managed-block sync | `ubp-handbook --runtime claude` | `ubp-handbook --runtime opencode` | `ubp-handbook --runtime codex` | N/A |
-| Backup before change | FULL | FULL | FULL | N/A |
+| Capability | Claude Code | OpenCode | Codex |
+|---|---|---|---|
+| Durable user file | `~/.claude/CLAUDE.md` | `~/.config/opencode/AGENTS.md` | `~/.codex/AGENTS.md` |
+| Automatic overwrite by plugin install | no | no | no |
+| Explicit managed-block sync | `ubp-handbook --runtime claude` | `ubp-handbook --runtime opencode` | `ubp-handbook --runtime codex` |
+| Backup before change | FULL | FULL | FULL |
 
 ## 6. Install, update, and uninstall
 
-| Capability | Claude Code | OpenCode | Codex | Gemini CLI |
-|---|---|---|---|---|
-| Adapter install | FULL | FULL | FULL | FULL compatibility |
-| Native registration/update | host loads plugin directory on next session | host loads local JS plugin on restart | cachebuster + `codex plugin add`; start a new task | host loads extension |
-| Removes stale managed assets | FULL | FULL | FULL | FULL while preserving extension runtime state |
-| Preserves unrelated user config | FULL | FULL | FULL | FULL inside user config; extension directory is managed |
-| Uninstall ownership guard | managed plugin root | sentinels + owned MCP entry | managed root/manifest/agent headers | extension `_ubp.source` |
+| Capability | Claude Code | OpenCode | Codex |
+|---|---|---|---|
+| Adapter install | FULL | FULL | FULL |
+| Native update | next host session | host restart | cachebuster + `codex plugin add`, then new task |
+| Removes stale managed assets | FULL | FULL | FULL |
+| Preserves unrelated config | FULL | FULL | FULL |
+| Uninstall ownership guard | managed plugin root | sentinels + owned MCP entry | managed root/manifest/agent headers |
 
 ## 7. Verification sources
 
@@ -91,8 +90,10 @@ operations registered by `mcp-server/server.cjs` are advertised as live.
 - `tests/conformance/<runtime>/*.test.cjs` verifies command/skill, hook, MCP,
   idempotency, and smoke presentation.
 - `adapters/_shared/tests/runtime-assets.test.cjs` prevents retired or external
-  skills and generic/memory hooks from re-entering any package.
-- `adapters/_shared/tests/handbook.test.cjs` verifies host rendering, safe
-  legacy-section migration, backup, and idempotency.
+  skills and generic/memory hooks from re-entering a package.
+- `tests/retired-runtime.test.cjs` prevents retired runtime code or prompt text
+  from re-entering active product surfaces.
+- `adapters/_shared/tests/handbook.test.cjs` verifies host rendering, backup,
+  migration, and idempotency.
 
 Any capability claim elsewhere must match current adapter code and these tests.

package/hooks/README.md

@@ -1,21 +1,22 @@
 # Ultra Builder Pro workflow hooks
 
-These hooks protect only a currently active Ultra workflow. Every hook is a no-op unless the
-project contains `.ultra/workflow-state.json` with a non-terminal status.
+These hooks observe only Ultra-owned state. Session health/context recognizes an initialized
+`.ultra/state.db` and active continuous changes; edit/compact/stop/subagent enforcement remains
+bounded to the relevant Ultra projection or a non-terminal workflow.
 
 | Lifecycle | Hook | Purpose |
 |---|---|---|
-| Session start | `health_check.py` | Advisory check of `.ultra/state.db` core tables |
-| Session start | `workflow_context.py` | Inject current command, task, step, and authority |
-| Before edit | `active_task_context.py` | Restate the active task boundary |
+| Session start | `health_check.py` | Read-only integrity, incident, projection, session, and change-artifact checks |
+| Session start | `workflow_context.py` | Inject baseline/active workflow/change context and filtered provider metadata references |
+| Before edit | `active_task_context.py` | Protect `tasks.json` projection and restate an active task boundary |
 | Before compact | `workflow_checkpoint.py` | Atomically save a minimal workflow checkpoint |
 | After compact/resume | `workflow_resume.py` | Re-inject the current workflow boundary |
 | Stop | `pre_stop_check.py` | Block once when the Ultra workflow is incomplete |
 | Subagent lifecycle | `subagent_tracker.py` | Append lifecycle evidence under `.ultra/runtime/` |
 
 The plugin deliberately does not capture prompts, tool observations, transcripts, summaries, or
-cross-session memory. Generic command blocking and post-edit policy are user/repository governance,
-not Ultra plugin hooks. Persistent memory belongs to the separately installed memory provider.
+cross-session memory or code-graph content. Generic command blocking and post-edit policy are
+user/repository governance. Persistent Memory/graph content belongs to separately installed providers.
 
 Runtime wiring:
 

package/hooks/active_task_context.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Remind an active Ultra workflow of its task boundary before edits."""
+"""Protect Ultra projections and restate an active task boundary before edits."""
 
 import json
 import sys
@@ -33,9 +33,28 @@ def main() -> None:
         data = {}
     start = Path(data.get("cwd") or Path.cwd()).resolve()
     for root in (start, *start.parents):
-        state_file = root / ".ultra" / "workflow-state.json"
-        if not state_file.is_file():
+        ultra = root / ".ultra"
+        state_file = ultra / "workflow-state.json"
+        initialized = (
+            (ultra / "state.db").is_file()
+            or state_file.is_file()
+            or (ultra / "changes" / "active").is_dir()
+        )
+        if not initialized:
             continue
+        if targets_tasks_projection(data, root):
+            print(json.dumps({"hookSpecificOutput": {
+                "hookEventName": "PreToolUse",
+                "permissionDecision": "deny",
+                "permissionDecisionReason": (
+                    "Refusing a direct write to the .ultra/tasks/tasks.json projection. "
+                    ".ultra/state.db is authoritative; use the Ultra MCP task tools and "
+                    "run ultra-doctor when state or projection health is degraded."
+                ),
+            }}))
+            return
+        if not state_file.is_file():
+            break
         try:
             state = json.loads(state_file.read_text(encoding="utf-8"))
         except (OSError, json.JSONDecodeError) as exc:
@@ -45,18 +64,6 @@ def main() -> None:
             break
         task = state.get("task_id", state.get("task", "unknown"))
         step = state.get("step", "unknown")
-        if targets_tasks_projection(data, root):
-            print(json.dumps({"hookSpecificOutput": {
-                "hookEventName": "PreToolUse",
-                "permissionDecision": "deny",
-                "permissionDecisionReason": (
-                    "Refusing a direct write to .ultra/tasks/tasks.json during an active Ultra "
-                    "workflow. .ultra/state.db is authoritative; use the Ultra MCP task tools. "
-                    "If they report LEGACY_STATE_MIGRATION_REQUIRED, run the v4.4 to v4.5 "
-                    "migration before continuing."
-                ),
-            }}))
-            return
         print(json.dumps({"hookSpecificOutput": {
             "hookEventName": "PreToolUse",
             "additionalContext": (

package/hooks/health_check.py

@@ -1,59 +1,157 @@
 #!/usr/bin/env python3
-"""Advisory health check for an active Ultra workflow.
-
-No memory, prompt, transcript, or generic host policy is inspected here.
-"""
+"""Fast, read-only Ultra runtime health inspection at session start."""
 
 import json
 import sqlite3
 import sys
 from pathlib import Path
 
-TERMINAL = {"committed", "completed", "done", "cancelled"}
-REQUIRED_TABLES = {"tasks", "events", "sessions", "schema_version"}
+
+REQUIRED_TABLES = {
+    "tasks", "events", "sessions", "schema_version", "migration_history",
+    "telemetry", "specs_refs", "circuit_breaker", "changes", "artifacts",
+    "context_snapshots", "trace_links", "incidents", "projection_jobs",
+    "event_consumers",
+}
 
 
-def main():
+def hook_input() -> dict:
     try:
-        raw = sys.stdin.read()
-        data = json.loads(raw) if raw.strip() else {}
-    except (json.JSONDecodeError, OSError) as exc:
+        value = json.loads(sys.stdin.read() or "{}")
+        return value if isinstance(value, dict) else {}
+    except json.JSONDecodeError as exc:
         print(f"[health_check] invalid hook input: {exc}", file=sys.stderr)
-        data = {}
-    start = Path(data.get("cwd") or Path.cwd()).resolve()
-    root = None
-    state = None
+        return {}
+
+
+def find_root(start: Path):
     for candidate in (start, *start.parents):
-        state_file = candidate / ".ultra" / "workflow-state.json"
-        if state_file.is_file():
-            try:
-                value = json.loads(state_file.read_text(encoding="utf-8"))
-            except (OSError, json.JSONDecodeError) as exc:
-                print(f"[health_check] cannot read {state_file}: {exc}", file=sys.stderr)
-                value = None
-            if isinstance(value, dict) and value.get("status") not in TERMINAL:
-                root, state = candidate, value
-            break
-    if root is None or state is None:
-        print(json.dumps({}))
-        return
-    issues = []
+        ultra = candidate / ".ultra"
+        if (
+            (ultra / "state.db").is_file()
+            or (ultra / "workflow-state.json").is_file()
+            or (ultra / "changes" / "active").is_dir()
+        ):
+            return candidate
+    return None
+
+
+def inspect(root: Path) -> dict:
     db_path = root / ".ultra" / "state.db"
+    report = {"status": "healthy", "project": str(root), "checks": {}}
+    issues = []
     if not db_path.is_file():
-        issues.append(".ultra/state.db is missing")
-    else:
-        try:
-            with sqlite3.connect(str(db_path), timeout=1) as conn:
-                tables = {row[0] for row in conn.execute(
+        report["checks"]["state_db"] = {"status": "fail", "reason": "missing"}
+        report["status"] = "degraded"
+        return report
+
+    try:
+        uri = f"file:{db_path}?mode=ro"
+        with sqlite3.connect(uri, uri=True, timeout=1) as conn:
+            quick = conn.execute("PRAGMA quick_check").fetchone()[0]
+            tables = {
+                row[0] for row in conn.execute(
                     "SELECT name FROM sqlite_master WHERE type='table'"
-                )}
+                )
+            }
             missing = sorted(REQUIRED_TABLES - tables)
+            report["checks"]["state_db"] = {
+                "status": "pass" if quick == "ok" and not missing else "fail",
+                "integrity": quick,
+                "missing_tables": missing,
+            }
+            if quick != "ok" or missing:
+                issues.append("state_db")
             if missing:
-                issues.append(f"state.db missing tables: {', '.join(missing)}")
-        except sqlite3.Error as exc:
-            issues.append(f"state.db unreadable: {exc}")
+                report["status"] = "degraded"
+                return report
+
+            incidents = [
+                {"id": row[0], "code": row[1], "severity": row[2], "retryable": bool(row[3])}
+                for row in conn.execute(
+                    """SELECT id, code, severity, retryable FROM incidents
+                       WHERE status = 'open' ORDER BY last_seen_at DESC LIMIT 20"""
+                )
+            ]
+            report["checks"]["incidents"] = {
+                "status": "pass" if not incidents else "fail",
+                "open": incidents,
+            }
+            if incidents:
+                issues.append("incidents")
+
+            pending = conn.execute(
+                "SELECT COUNT(*) FROM projection_jobs WHERE status = 'pending'"
+            ).fetchone()[0]
+            running = conn.execute(
+                "SELECT COUNT(*) FROM projection_jobs WHERE status = 'running'"
+            ).fetchone()[0]
+            failed = conn.execute(
+                "SELECT COUNT(*) FROM projection_jobs WHERE status = 'failed'"
+            ).fetchone()[0]
+            event_cursor = conn.execute(
+                "SELECT COALESCE(MAX(id), 0) FROM events"
+            ).fetchone()[0]
+            projected_cursor = conn.execute(
+                """SELECT COALESCE(MAX(event_cursor), 0) FROM projection_jobs
+                   WHERE status = 'completed'"""
+            ).fetchone()[0]
+            projection_ok = (
+                pending == 0 and running == 0 and failed == 0
+                and event_cursor <= projected_cursor
+            )
+            report["checks"]["projections"] = {
+                "status": "pass" if projection_ok else "fail",
+                "pending": pending,
+                "running": running,
+                "failed": failed,
+                "event_cursor": event_cursor,
+                "projected_cursor": projected_cursor,
+            }
+            if not projection_ok:
+                issues.append("projections")
+
+            orphan = conn.execute(
+                "SELECT COUNT(*) FROM sessions WHERE status = 'orphan'"
+            ).fetchone()[0]
+            report["checks"]["sessions"] = {
+                "status": "pass" if orphan == 0 else "fail", "orphan": orphan,
+            }
+            if orphan:
+                issues.append("sessions")
+
+            missing_artifacts = []
+            for change_id, artifact_root in conn.execute(
+                """SELECT id, artifact_root FROM changes
+                   WHERE status IN ('active', 'blocked', 'ready')"""
+            ):
+                if artifact_root and not (root / artifact_root).exists():
+                    missing_artifacts.append(change_id)
+            report["checks"]["change_artifacts"] = {
+                "status": "pass" if not missing_artifacts else "fail",
+                "missing": missing_artifacts,
+            }
+            if missing_artifacts:
+                issues.append("change_artifacts")
+    except sqlite3.Error as exc:
+        report["checks"]["state_db"] = {"status": "fail", "reason": str(exc)}
+        issues.append("state_db")
+
     if issues:
-        print("[Ultra health] " + "; ".join(issues), file=sys.stderr)
+        report["status"] = "degraded"
+    return report
+
+
+def main() -> None:
+    data = hook_input()
+    start = Path(data.get("cwd") or Path.cwd()).resolve()
+    root = find_root(start)
+    if root is None:
+        print(json.dumps({}))
+        return
+    report = inspect(root)
+    if report["status"] != "healthy":
+        print("[Ultra health] " + json.dumps(report, ensure_ascii=False, sort_keys=True), file=sys.stderr)
     print(json.dumps({}))