ultra-builder-pro-cli 0.6.0 → 0.8.1

package/skills/ultra-deliver/SKILL.md

@@ -1,17 +1,36 @@
 ---
 name: ultra-deliver
-description: "Release preparation — verify /ultra-test passed, update docs, build, version-bump, tag, push. Writes .ultra/delivery-report.json."
+description: "Converge and deliver a verified baseline or continuous change: reconcile specs, build/test, archive evidence, version, tag, and push."
 runtime: all
+mcp_tools_required:
+  - change.list
+  - change.get
+  - change.context
+  - change.converge
+  - change.archive
 cli_fallback: "direct user interaction"
 ---
 
 # ultra-deliver — Phase 3.5
 
-Release the current working tree. Driven entirely by file-level artifacts
-(`.ultra/test-report.json` as the gate; `.ultra/delivery-report.json` as the
-output). No state.db writes.
+Release the current working tree and close its continuous-change packet when
+one exists. `.ultra/test-report.json` is the test gate; `change.converge` is the
+deterministic closure gate; `.ultra/delivery-report.json` is the release report.
+Change lifecycle writes go through MCP only.
 
-## Prerequisites (Pre-Delivery Validations — both BLOCKING)
+## Prerequisites (all validations are blocking)
+
+### Validation 0 — Resolve continuous change
+
+Call `change.list` for `active`, `blocked`, and `ready` work.
+
+- Exactly one relevant change → bind delivery to that id.
+- More than one → require an explicit id; never guess which change to archive.
+- None → allow initial-baseline delivery, but record `change_id: null`.
+- Active/blocked change → its linked tasks must all be completed and its
+  `test-report.json.change_id` must match.
+- Ready change → do not rerun convergence blindly; verify its existing
+  verification artifact still matches current HEAD before archive.
 
 ### Validation 1 — `/ultra-test` passed
 
@@ -59,10 +78,19 @@ Commit failure (conflicts, hook rejection) → surface error and **EXIT**.
 2. If signatures changed, update README usage examples
 3. Verify examples match the new API
 
+**1.4 Baseline specification reconciliation** (continuous change):
+
+1. Read `intent.md`, `delta/`, and `docs_impact` from the bound change.
+2. Merge accepted deltas into the declared baseline documents.
+3. Record every updated project-relative path as `baseline_updates`.
+4. If no baseline file changes, write a specific `no_baseline_change_reason`.
+5. Verify no `[NEEDS CLARIFICATION]` or unresolved delta remains for delivered behavior.
+
 **Checklist**:
 - [ ] CHANGELOG.md updated
 - [ ] technical-debt.md refreshed
 - [ ] README.md reflects current API (if applicable)
+- [ ] active delta reconciled into baseline, or explicit no-change rationale exists
 
 Any unchecked → fix, then continue.
 
@@ -80,7 +108,7 @@ Non-zero exit → block with stderr captured, then ask the user:
 - A: "Fix error and retry"
 - B: "Abort delivery"
 
-### Step 3 — Version + Release (MANDATORY — all 5 sub-steps)
+### Step 3 — Version + convergence + release
 
 **3.1 Determine version bump**:
 - `git log <last-tag>..HEAD --oneline` → analyze commit types
@@ -91,6 +119,13 @@ Non-zero exit → block with stderr captured, then ask the user:
 - `package.json`, `Cargo.toml`, `pyproject.toml`, etc.
 - Verify: read the file; confirm new version.
 
+**3.2a Re-run release evidence after docs/version edits**:
+
+- Run the exact relevant test, type-check, build, and package commands again.
+- Capture command, exit code, and result. Any non-zero exit blocks delivery.
+- Do not reuse a test report whose `change_id` or pre-change HEAD belongs to a
+  different change as final evidence.
+
 **3.3 Release commit**:
 ```bash
 git add -A
@@ -98,13 +133,35 @@ git commit -m "chore(release): v<X.Y.Z>"
 ```
 Verify with `git log -1 --oneline`.
 
-**3.4 Git tag**:
+**3.4 Recompile context and converge the change** (skip only for initial baseline):
+
+For `active` or `blocked`, call `change.context` after the release commit so its
+git head and task set are current. Then call `change.converge` with the exact
+evidence required by kind:
+
+- `quick`: diff, tests, spec;
+- `standard` / `major`: diff, tests, spec, docs, review;
+- `incident`: diagnosis, diff, tests. The diagnosis evidence must point to the
+  completed `diagnosis.md`; convergence separately validates all five required
+  debugging sections and cannot be satisfied by the evidence string alone.
+
+Evidence must name concrete commands, artifacts, or file paths. If blockers are
+returned, stop before tag/push and route to the owning workflow. Do not weaken
+the change kind or mark failed evidence `not_applicable` merely to pass.
+
+**3.5 Archive after baseline reconciliation**:
+
+Call `change.archive` with the summary and either `baseline_updates` or the
+explicit no-change reason. This moves the packet from `changes/active` to the
+dated archive and records closure in state.db. Archive failure blocks release.
+
+**3.6 Git tag**:
 ```bash
 git tag v<X.Y.Z>
 ```
 Verify with `git tag -l v<X.Y.Z>`.
 
-**3.5 Push to remote**:
+**3.7 Push to remote**:
 ```bash
 git push origin main     # release commit
 git push origin v<X.Y.Z> # version tag
@@ -115,6 +172,7 @@ Verify with `git ls-remote --tags origin | grep v<X.Y.Z>`.
 - [ ] Version determined and displayed
 - [ ] Version file updated and verified
 - [ ] Release commit created and verified
+- [ ] Change context current, convergence ready, baseline reconciled, archive complete
 - [ ] Git tag created and verified
 - [ ] Commit and tag pushed and verified on remote
 
@@ -128,6 +186,10 @@ Any failure → stop immediately; do NOT continue; surface last-step error.
   "version": "<X.Y.Z>",
   "git_tag": "v<X.Y.Z>",
   "git_commit": "<HEAD SHA>",
+  "change_id": "<archived-change-id-or-null>",
+  "change_archive_path": "<path-or-null>",
+  "convergence_ready": true,
+  "baseline_updates": ["<project-relative-path>"],
   "changelog_updated": true,
   "technical_debt_refreshed": true,
   "build_success": true,
@@ -137,8 +199,9 @@ Any failure → stop immediately; do NOT continue; surface last-step error.
 
 ### Step 5 — Report
 
-Print a tight release summary: tag, commit, files touched in CHANGELOG,
-outstanding technical-debt count, next suggested action (deploy / announce).
+Print a tight release summary: change id/archive, baseline files reconciled,
+tag, commit, exact verification commands, outstanding technical-debt count,
+and next suggested action. After release, daily work starts with `/ultra-change`.
 
 ## Deliverables Checklist (final)
 
@@ -146,6 +209,7 @@ outstanding technical-debt count, next suggested action (deploy / announce).
 - [ ] Uncommitted changes handled
 - [ ] CHANGELOG + technical-debt refreshed (README if API changed)
 - [ ] Production build exit 0
+- [ ] Continuous change converged and archived (when present)
 - [ ] Version bumped, tagged, pushed
 - [ ] delivery-report.json written
 
@@ -155,17 +219,21 @@ outstanding technical-debt count, next suggested action (deploy / announce).
 |---------|----------|--------------|
 | Resolve dirty-tree action | none | current Host's native user-interaction surface |
 | Override version bump | none | current Host's native user-interaction surface |
+| Resolve/bind change | `change.list` / `change.get` | none; fail closed |
+| Refresh context | `change.context` | none; fail closed |
+| Deterministic closure | `change.converge` / `change.archive` | none; fail closed |
 
 ## What this skill DOES NOT do
 
-- Does NOT run tests (that is `/ultra-test`'s job)
+- Does NOT replace `/ultra-test`; it re-runs the exact release evidence after
+  documentation and version changes so the shipped commit is verified
 - Does NOT publish to npm / crates.io / PyPI (Phase 9 handles distribution)
-- Does NOT mutate state.db
+- Does NOT directly mutate state.db or external provider state
 
 ## Integration
 
 | | |
 |---|---|
-| **Input** | `.ultra/test-report.json` (gate), current repo |
-| **Output** | `.ultra/delivery-report.json`, git tag + remote push |
-| **Next** | Deploy target (Railway / Vercel / etc.) or release announcement |
+| **Input** | bound change (if any), test/review artifacts, current repo |
+| **Output** | archived change, reconciled baseline, delivery report, git tag + remote push |
+| **Next** | deploy/announce; next daily change begins with `/ultra-change` |

package/skills/ultra-dev/SKILL.md

@@ -6,6 +6,8 @@ mcp_tools_required:
   - task.update
   - task.get
   - task.list
+  - change.get
+  - change.context
 ---
 
 # ultra-dev — Phase 3.4
@@ -13,8 +15,9 @@ mcp_tools_required:
 Drive one task from `pending → completed` using a strict TDD loop, gated by
 `/ultra-review`. **state.db is the authority**: status transitions go through
 MCP `task.update`; the projector regenerates `tasks.json` and context-md
-frontmatter. The skill only writes context-md **bodies** (Change Log,
-Completion, Dual-Write notes).
+frontmatter. For a task linked by `change_id`, requirement discoveries go to
+the active change delta first; baseline reconciliation happens in
+`/ultra-deliver`.
 
 ## Authority failure boundary
 
@@ -85,6 +88,11 @@ Pick the first result (dependency-resolved) or the one matching `$1`.
 Read `.ultra/tasks/contexts/task-{id}.md` body for the Implementation /
 Acceptance sections. Use the Acceptance list as the initial todo set.
 
+If the task has `change_id`, call `change.get` and inspect its
+`context-manifest.json`. The task id, git head, allowed paths, spec refs, and
+external provider metadata must match the current slice. Call `change.context`
+before editing whenever they are stale. Provider content remains external.
+
 ### Step 1.5 — Status → in_progress (single-write)
 
 ```jsonc
@@ -266,6 +274,10 @@ Any unchecked → fix; do NOT commit.
    git push origin main && git branch -d feat/task-<id>-<slug>
    ```
 
+8. For a task with `change_id`, call `change.context` after the final commit,
+   rebase, and verification so the manifest records the actual HEAD and task
+   set used for convergence.
+
 Checkpoint `step="6", status="committed", commit=<sha>`.
 
 ### Step 7 — Report
@@ -274,16 +286,16 @@ Checkpoint `step="6", status="committed", commit=<sha>`.
 - Project progress (`task.list` → `completed/total`)
 - Next task suggestion (first remaining `pending` in topological order)
 
-## Dual-Write Mode
+## Delta-First Specification Mode
 
-Triggered when implementation reveals spec gaps or requirement changes.
+Triggered when implementation reveals specification gaps or requirement changes.
 
 **Classification (mandatory before updating specs)**:
 
 | Kind | Meaning | Action |
 |------|---------|--------|
-| **EXPANSION** | new requirement surfaced | update spec + Change Log |
-| **CORRECTION** | spec error/ambiguity | update spec + Change Log |
+| **EXPANSION** | new requirement surfaced | update active change delta + Change Log |
+| **CORRECTION** | spec error/ambiguity | update active change delta + Change Log |
 | **REDUCTION** | removing/weakening scope | **STOP** → ask the user for approval |
 
 **REDUCTION gate** — options:
@@ -291,16 +303,23 @@ Triggered when implementation reveals spec gaps or requirement changes.
 - B: "Keep original scope, find alternative implementation"
 - C: "Split into separate task, defer to next cycle"
 
-Update `.ultra/specs/` immediately so parallel tasks see current truth.
-Log in context-md body Change Log:
+For a task with `change_id`, update
+`.ultra/changes/active/<change-id>/delta/` immediately, then recompile
+`change.context`. Do not silently rewrite the baseline while parallel tasks are
+still executing. `/ultra-deliver` must reconcile the approved delta into the
+declared baseline files before archive.
+
+For an initial-baseline task with no `change_id`, update `.ultra/specs/`
+directly because no continuous-change packet exists yet. In both cases log the
+decision in the context-md body Change Log:
 
 ```markdown
 | <date> | <KIND> | <change desc> | specs/<file>#<section> | <reason> |
 ```
 
-**Principle**: `specs/` is source of truth; `contexts/` tracks implementation
-history. Specs may grow (EXPANSION) or be corrected (CORRECTION). Specs must
-never silently shrink (REDUCTION without gate).
+**Principle**: the baseline specs describe accepted product truth; the active
+delta describes proposed change; task contexts record implementation history.
+No layer may silently shrink scope without the REDUCTION gate.
 
 ## MCP failure matrix
 
@@ -311,6 +330,7 @@ never silently shrink (REDUCTION without gate).
 | Pre-review checkpoint | none | write `.ultra/workflow-state.json`; lifecycle hooks restore it |
 | Run review | none | `/ultra-review all` + Host-native review agents |
 | Status → completed | `task.update` (2) | stop; do not claim completion |
+| Refresh linked context | `change.context` (9) | stop; do not claim the change packet is current |
 | Ask user | none | current Host's native user-interaction surface |
 
 ## What this skill DOES NOT do
@@ -325,5 +345,5 @@ never silently shrink (REDUCTION without gate).
 | | |
 |---|---|
 | **Input** | state.db via MCP, plus the `context_file` body returned for the selected task |
-| **Writes** | state.db (via `task.update`), context-md body (Completion + Change Log), workflow-state.json checkpoints |
+| **Writes** | state.db (via `task.update`/`change.context`), active delta or baseline spec as classified, context-md body, workflow-state checkpoints |
 | **Next** | `/ultra-dev <next-id>` or `/ultra-test` when all Walking Skeleton + critical-path tasks complete |

package/skills/ultra-doctor/SKILL.md

@@ -0,0 +1,97 @@
+---
+name: ultra-doctor
+description: "Inspect Ultra state, projection, session, incident, and active-change health; optionally run explicit backup-first mechanical recovery."
+runtime: all
+mcp_tools_required:
+  - system.doctor
+cli_fallback: "system doctor"
+---
+
+# ultra-doctor — Runtime Diagnostics and Recovery
+
+Use this workflow when Ultra state appears empty, projections disagree with
+`state.db`, a hook reports a missing adapter, sessions are orphaned, a change
+artifact is missing, or MCP operations return degraded projection metadata.
+
+## Default is read-only
+
+Call `system.doctor` with `{ "repair": false }` unless the user explicitly
+requests repair. Read-only diagnosis reports:
+
+- SQLite integrity and required tables;
+- open structured incidents;
+- projection queue failures and event/projection cursor lag;
+- orphan sessions;
+- missing active-change artifact roots;
+- the external ownership boundary for Memory and code graph.
+
+Do not infer health from `tasks.json`. Do not mutate provider state, delete
+artifacts, rebuild a graph, or collect memory during diagnosis.
+
+## Interpret the report
+
+| Check | Meaning | Next action |
+|---|---|---|
+| `state_db` fail | schema/integrity problem | stop ordinary workflow; preserve DB evidence |
+| `incidents` fail | a structured runtime failure remains open | report code, source, retryability, and evidence |
+| `projections` fail | state commit is ahead of generated views or a projector failed | explicit repair is appropriate when authorized |
+| `sessions` fail | an orphan execution lease exists | repair may mark/reconcile it; never kill unrelated processes blindly |
+| `change_artifacts` fail | DB points to a missing active packet | recover from version control/backup or recreate deliberately |
+| `external_providers` pass | ownership is correctly external | provider availability must be checked with its own plugin/tool |
+
+## Explicit repair mode
+
+Only after the user asks for repair, call `system.doctor` with
+`{ "repair": true }`, or use the fallback:
+
+```bash
+ultra-tools system doctor --repair
+```
+
+The runtime must create `.ultra/backups/state-<timestamp>.db` before any
+mechanical repair. Repair is bounded to:
+
+- boot recovery for orphan sessions;
+- durable consumption of spec-staleness events;
+- requeueing projection jobs left `running` beyond the interruption cutoff;
+- requeueing failed projection jobs;
+- regenerating projections from authoritative state.
+
+If backup fails, repair must stop with `BACKUP_FAILED`. A repair result is not
+automatically healthy; inspect the returned post-repair report and keep any
+remaining incident unresolved.
+
+## Hook/path failures
+
+For an installed hook that points to a missing cached file:
+
+1. capture the exact hook config path and missing target;
+2. run the separate read-only installer boundary check:
+   `npx ultra-builder-pro-cli --<runtime> --local --doctor --json` (or use
+   `--global` when that is the actual install scope);
+3. preserve its provenance, asset-hash, and host-contract findings;
+4. reinstall or regenerate the host-native plugin through the adapter;
+5. rerun both installer doctor and `system.doctor`, then a host hook smoke test.
+
+`system.doctor` diagnoses project `.ultra/state.db` and workflow recovery.
+Installer `ubp --doctor` diagnoses the installed plugin files and host wiring.
+Neither report substitutes for the other.
+
+Do not bypass a broken hook by changing application implementation, and do not
+treat a hook failure as project-code evidence.
+
+## Output
+
+Lead with `healthy` or `degraded`, list only failing checks, and include:
+
+- incident ids/codes and sources;
+- event vs projected cursor;
+- whether repair ran;
+- backup path when repair ran;
+- unresolved actions and their owner (`Ultra`, host plugin, or external provider).
+
+## What this skill does not do
+
+- It does not fix project code or semantic specification conflicts.
+- It does not delete state, force-reset git, or close live healthy sessions.
+- It does not install, query, refresh, or repair external Memory/graph providers.

package/skills/ultra-init/SKILL.md

@@ -10,7 +10,8 @@ cli_fallback: "task init-project"
 # ultra-init — Phase 3.1
 
 把当前工作目录（或 `--target-dir`）初始化为一个 Ultra Builder Pro 项目：拉起
-`.ultra/` 骨架、写入 `tasks.json` 元数据、按需配 git。
+`.ultra/` 骨架、初始化权威 `state.db`、建立持续变更目录、写入 `tasks.json`
+初始元数据，并按需配置 git。
 
 真实的目录搭建 + 模板拷贝 + tasks.json 注入统一由 **MCP tool `task.init_project`** 完成；
 MCP 不可达时回退 `ultra-tools task init-project`。
@@ -18,7 +19,7 @@ MCP 不可达时回退 `ultra-tools task init-project`。
 ## 设计要点（对比 pre-Phase-3 行为）
 
 - **无 Claude 独占依赖**：`task.init_project` + `ultra-tools init-project` 两条路径
-  都不调 Claude 原生工具，4 个 runtime 都能走通。
+  都不调 Claude 原生工具，Claude Code、OpenCode、Codex 三个 runtime 都能走通。
 - **模板内置**：`.ultra/` 骨架来自仓内 `templates/.ultra/`；不再依赖 `~/.claude/.ultra-template/`。
 - **幂等**：二次 init 默认拒绝，`--overwrite` 才会备份旧 `.ultra/` 为
   `.ultra.backup.<ts>` 后重建。
@@ -83,9 +84,11 @@ MCP 不可达时回退 `ultra-tools task init-project`。
   "copied_files": [
     "specs/discovery.md", "specs/product.md", "specs/architecture.md",
     "tasks/tasks.json", "tasks/contexts/TEMPLATE.md",
+    "changes/active/.gitkeep", "changes/archive/.gitkeep",
     "docs/research/README.md",
     "test-report.json", "delivery-report.json"
-  ]
+  ],
+  "state_db_path": "/abs/path/to/project/.ultra/state.db"
 }
 ```
 
@@ -121,7 +124,8 @@ CLI 最后一行是 `{ "ok": true, "data": { ... } }`（见 spec/cli-protocol.md
 ### Step 4: 成功总结 + 下一步
 
 用中文输出：
-- ✅ `.ultra/` 骨架（specs / tasks / docs / reports）
+- ✅ `.ultra/` 骨架（specs / tasks / changes / docs / reports）
+- ✅ `.ultra/state.db` 已初始化为当前 schema，后续不再依赖第一次写操作懒创建
 - ✅ tasks.json 注入元数据（name / type / stack / created / updated）
 - ✅ git 状态（按选择）
 - ⚠️ **下一步**：跑 `/ultra-research` 做 17 步 discovery 填 spec；不要跳过直接 `/ultra-plan`
@@ -143,5 +147,4 @@ CLI 最后一行是 `{ "ok": true, "data": { ... } }`（见 spec/cli-protocol.md
 ## 不做的事
 
 - **不**创建业务 task（业务 task 由 `/ultra-plan` 在 spec 填完后批量创建）
-- **不**写入 state.db（state.db 由第一次 MCP 写操作或显式 `ultra-tools db init` 触发）
 - **不**调 web：离线可执行

package/skills/ultra-review/SKILL.md

@@ -2,6 +2,10 @@
 name: ultra-review
 description: "Parallel code review orchestration with 6 specialized agents + coordinator. Zero context pollution - all output via JSON files."
 user-invocable: true
+runtime: all
+mcp_tools_required:
+  - change.list
+  - task.list
 ---
 
 # /ultra-review - Ultra Review System
@@ -54,6 +58,7 @@ Orchestrates parallel code review using specialized agents. All findings written
 # 1. Determine session context
 BRANCH = git branch --show-current            # e.g., "feat/task-3-auth"
 ITER = count existing sessions matching this branch + 1  # iteration number
+CHANGE_ID = active change whose linked tasks/diff match this scope, else null
 
 # 2. Create session directory with full context
 SESSION_ID = "<YYYYMMDD-HHmmss>-<branch>-iter<N>"
@@ -94,6 +99,15 @@ git diff RANGE --name-only
 DIFF_RANGE="RANGE"
 ```
 
+**Continuous-change linkage**:
+
+Call `change.list` and `task.list`, then bind the review to the single active or
+blocked change whose linked task files intersect `DIFF_FILES`. If multiple
+changes match, require an explicit scope instead of guessing. Write
+`change_id` and reviewed HEAD into `SUMMARY.json` and the session index so
+`/ultra-deliver` can use this artifact as review evidence. Initial-baseline
+reviews may use `change_id: null`.
+
 ### Phase 2: Agent Selection
 
 Based on the mode argument and file classification:
@@ -277,6 +291,7 @@ A lightweight index file tracks all sessions for cross-referencing:
     {
       "id": "20260214-103000-feat-task-3-auth-iter1",
       "branch": "feat/task-3-auth",
+      "change_id": "auth-change",
       "iteration": 1,
       "mode": "full",
       "timestamp": "2026-02-14T10:30:00Z",
@@ -308,6 +323,7 @@ A lightweight index file tracks all sessions for cross-referencing:
 |-------|-------------|
 | `id` | Session directory name |
 | `branch` | Git branch at review time |
+| `change_id` | Continuous change reviewed, or null for initial baseline |
 | `iteration` | Nth review for this branch (auto-incremented) |
 | `mode` | Review mode used (full/quick/security/recheck/delta) |
 | `timestamp` | ISO 8601 |

package/skills/ultra-status/SKILL.md

@@ -7,6 +7,8 @@ mcp_tools_required:
   - task.get
   - session.list
   - session.subscribe_events
+  - change.list
+  - system.doctor
 cli_fallback: "status --cost --json"
 ---
 
@@ -15,6 +17,8 @@ cli_fallback: "status --cost --json"
 Single-call dashboard. Pulls task state from state.db (authoritative), layers
 in `.ultra/test-report.json` + `.ultra/delivery-report.json` (file artifacts),
 reports progress + risks + workflow routing.
+It never treats a completed initial delivery as a terminal state: a healthy
+baseline routes the next daily request through `/ultra-change`.
 
 ## Authority failure boundary
 
@@ -47,6 +51,12 @@ user to run `ultra-tools migrate --from=4.4 --to=4.5 --source-dir <project-root>
 // MCP: session.subscribe_events (recent events for the "last event" panel)
 { "since_id": 0, "limit": 20 }
 // → { events: [...], next_since_id: M }
+
+// MCP: change.list (continuous-change lane)
+{ "limit": 20 }
+
+// MCP: system.doctor (read-only runtime health)
+{ "repair": false }
 ```
 
 Also read:
@@ -60,6 +70,8 @@ Extract:
 - Most recent 20 events (by `events.id` DESC) — "last event" panel
 - Test passed / failed / stale (compare `git_commit` to HEAD)
 - Delivery readiness (tag + pushed)
+- Active/blocked/ready change, linked task counts, docs impact, and context freshness
+- Runtime health: open incidents, projection lag/failure, orphan sessions, missing change artifacts
 
 ### Phase 2 — Progress report
 
@@ -68,6 +80,8 @@ Compact multi-section output:
 - **Tasks**: counts per status + per priority
 - **Test**: pass/fail, `run_count`, `blocking_issues` if any
 - **Delivery**: `version` + `pushed` + last tag
+- **Change**: active id/kind/status, docs impact, task completion, context/provider freshness
+- **Runtime**: healthy/degraded with failing doctor checks only
 - **Risks**: auto-detected list (see Phase 3)
 - **Next**: recommended next task (see Phase 4)
 
@@ -81,6 +95,10 @@ Auto-detect:
 - **Test stale**: `test-report.json.git_commit ≠ HEAD`
 - **Orphan sessions**: any session with `lease_expires_at < now()` still status=running
   (uninitialized by orphan-reaper; escalate)
+- **Projection/incident failure**: read-only doctor is degraded → route to
+  `/ultra-doctor`; never infer recovery from a generated JSON file
+- **Context stale**: active change manifest head or task set differs from current state
+- **Docs drift**: change has `docs_impact.status=unknown` or declared required file is missing
 
 | Icon | Meaning | Action |
 |------|---------|--------|
@@ -105,12 +123,15 @@ Detect position from artifacts:
 |-----------|-------|
 | No `.ultra/` | `/ultra-init` |
 | Specs have `[NEEDS CLARIFICATION]` or missing | `/ultra-research` |
-| No tasks | `/ultra-plan` |
-| Any `pending` | `/ultra-dev` (show which) |
-| All `completed` | `/ultra-test` |
-| `test-report.json.passed === true` | `/ultra-deliver` |
+| No tasks and no delivered baseline | `/ultra-plan` |
+| Doctor degraded because of Ultra runtime state | `/ultra-doctor` |
+| No active/blocked/ready change and fresh delivery exists | `/ultra-change` for the next daily change |
+| Active change has any `pending` linked task | `/ultra-dev` (show which) |
+| Active change linked tasks all `completed` | `/ultra-test` |
+| Matching fresh `test-report.json.passed === true` | `/ultra-deliver` |
 | `test-report.json.passed === false` | `/ultra-dev` (show blocking issues) |
-| `delivery-report.json` exists + fresh | Done; suggest next milestone |
+| Change is `ready` | `/ultra-deliver` to reconcile/archive before release completion |
+| Latest change archived and delivery fresh | Baseline healthy; next work starts with `/ultra-change` |
 
 **Safety checks before routing**:
 - Routing to deliver but `test-report.git_commit ≠ HEAD` → warn "Tests stale"
@@ -143,6 +164,8 @@ session_id (if active), `context_file`, `trace_to`, stale flag, update history.
 |---------|----------|--------------|
 | List tasks | `task.list` | none; fail closed |
 | Single task detail | `task.get` | none; fail closed |
+| Change lane | `change.list` | none; fail closed |
+| Runtime health | `system.doctor { repair:false }` | `ultra-tools system doctor` |
 | Cost panel (Phase 6.3) | — | `ultra-tools status --cost --json --since 7d` |
 
 ## Cost panel (Phase 6.3)
@@ -154,7 +177,7 @@ is the conventional weekly window; override with ISO-8601 for custom ranges.
 
 ## What this skill DOES NOT do
 
-- Does NOT modify state
+- Does NOT modify or repair state
 - Does NOT run tests / build / deploy
 - Does NOT require all artifacts (partial reports are tolerated)
 
@@ -162,6 +185,6 @@ is the conventional weekly window; override with ISO-8601 for custom ranges.
 
 | | |
 |---|---|
-| **Input** | state.db (via `task.list`/`task.get`), `test-report.json`, `delivery-report.json`, git HEAD |
+| **Input** | state.db via task/change/session/system reads, test/delivery reports, git HEAD |
 | **Output** | console report (Chinese per project rule) |
 | **When** | anytime — idempotent read-only |

package/skills/ultra-test/SKILL.md

@@ -4,6 +4,7 @@ description: "Pre-delivery quality audit — Anti-Pattern + Coverage Gap + Wirin
 runtime: all
 mcp_tools_required:
   - task.list
+  - change.list
 ---
 
 # ultra-test — Phase 3.5
@@ -31,7 +32,9 @@ returns an authority error, stop the audit. Never fall back to
 
 1. Detect project type from config (`package.json` / `Cargo.toml` / `go.mod` / `pyproject.toml` / …)
 2. `task.list { status: "completed" }` → confirm ≥1 task delivered
-3. Find test files (suffix `.test.*`, `.spec.*`, `test_*.py`, `*_test.go`)
+3. `change.list` → identify the active/blocked change, if any; filter linked
+   tasks locally by `change_id`
+4. Find test files (suffix `.test.*`, `.spec.*`, `test_*.py`, `*_test.go`)
 
 Block with instructive error if any precheck fails.
 
@@ -144,8 +147,12 @@ If max reached → surface remaining issues; `passed=false`.
 {
   "timestamp": "<ISO8601>",
   "git_commit": "<HEAD>",
+  "change_id": "<active-change-id-or-null>",
   "passed": true,
   "run_count": 1,
+  "commands": [
+    { "command": "<exact command>", "exit_code": 0, "scope": "unit/integration/e2e/build" }
+  ],
   "gates": {
     "anti_pattern":  { "passed": true, "critical": 0, "warning": 1 },
     "coverage_gaps": { "passed": true, "high": 0, "medium": 3, "low": 5 },
@@ -162,6 +169,10 @@ Rules:
 - File exists → increment `run_count`
 - `passed = true` iff all gates `.passed === true`
 - `blocking_issues` lists human-readable strings for any fail
+- `commands` records exact executable evidence; prose such as “tests look good”
+  is not convergence evidence
+- when a continuous change is active, `change_id` must match it; never reuse a
+  report from another change
 
 ### Step 8 — Report
 
@@ -184,6 +195,7 @@ when `passed=true`.
 | Purpose | MCP tool | CLI fallback |
 |---------|----------|--------------|
 | Confirm ≥1 completed task | `task.list { status: "completed" }` | none; fail closed |
+| Identify active change | `change.list` | none; omit only for initial baseline delivery |
 | Confirm risky auto-fix | none | current Host's native user-interaction surface |
 
 ## What this skill DOES NOT do
@@ -197,5 +209,5 @@ when `passed=true`.
 | | |
 |---|---|
 | **Input** | Source + test files, state.db (read-only) |
-| **Output** | `.ultra/test-report.json`, `.ultra/docs/test-coverage-gaps.md` |
+| **Output** | `.ultra/test-report.json` with exact commands/change id, `.ultra/docs/test-coverage-gaps.md` |
 | **Next** | `/ultra-deliver` (only when `passed=true`) |