ultra-builder-pro-cli 3.0.2 → 5.0.1

package/skills/ultra-delegate/scripts/host-profile.cjs

@@ -0,0 +1,267 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const KIMI_PROFILE_ROOT = path.join(__dirname, 'delegate-profiles');
+const ZCODE_BUNDLED_CLI = '/Applications/ZCode.app/Contents/Resources/glm/zcode.cjs';
+const CLAUDE_ACP_PACKAGE = '@agentclientprotocol/claude-agent-acp@0.70.0';
+const CODEX_ACP_PACKAGE = '@agentclientprotocol/codex-acp@1.6.2';
+const ZCODE_ACP_SOURCE = Object.freeze({
+  repository: 'https://github.com/jpalmae/zcode-acp',
+  version: '0.1.0',
+  commit: '42fe149d4b501469343c01f23ba3801832306d53',
+  buildMarker: 'zcode-acp 0.1.0+ultra.zcode.0.16.5',
+  runtimeVersion: '0.16.5',
+  patch: Object.freeze({
+    path: 'skills/ultra-delegate/patches/zcode-acp-0.1.0-zcode-0.16.5.patch',
+    sha256: '174dfd0feafe84320556a84b5ae08b10e44c5515fea4992fd1d58af54cee4e3d',
+    compatibility: 'ZCode CLI 0.16.5 runtime-preferences handshake',
+  }),
+});
+
+// The ZCode app-bundled CLI is a verified-local surface, not a provider
+// stability promise: official documentation plus a full recovery drill must
+// both hold before any transport may claim 'supported'.
+const TRANSPORT_MATURITY = Object.freeze({
+  claude: 'documented+verified',
+  codex: 'documented+verified',
+  opencode: 'documented+verified',
+  kimi: 'documented+verified',
+  grok: 'documented+verified',
+  zcode: 'experimental',
+});
+
+const ACP_CONFORMANCE = Object.freeze({
+  claude: Object.freeze({
+    status: 'passed',
+    evidence: 'docs/evals/ultra-5-0-live-acp-conformance.md#claude-code',
+    receiptSha256: '9b1d88cbd5e5b66a56e0cf19f34e7f2107f9e4b8fde9d80b9eadcdfc8f4a25e3',
+  }),
+  codex: Object.freeze({
+    status: 'passed',
+    evidence: 'docs/evals/ultra-5-0-live-acp-conformance.md#codex',
+    receiptSha256: 'e82287609397807fb6968dff104d7f6569499b53c77be6a186aa33939a4c629e',
+  }),
+  opencode: Object.freeze({
+    status: 'passed',
+    evidence: 'docs/evals/ultra-5-0-live-acp-conformance.md#opencode',
+    receiptSha256: '3575b148f6feb8c9f1472add705390e6d47b87be080403ec7006b66a29f7873b',
+  }),
+  kimi: Object.freeze({
+    status: 'passed',
+    evidence: 'docs/evals/ultra-5-0-live-acp-conformance.md#kimi-code',
+    receiptSha256: '30d8adec2877f80fadf0b20c3cb7fa6b732dea3598d7484c143f9835770301fe',
+  }),
+  grok: Object.freeze({
+    status: 'passed',
+    evidence: 'docs/evals/ultra-5-0-live-acp-conformance.md#grok-build',
+    receiptSha256: '370eeae12d63443188d519825ed8040fd8bba9b27fddb82e499d9cb590f4a33d',
+  }),
+  zcode: Object.freeze({
+    status: 'passed',
+    evidence: 'docs/evals/ultra-5-0-live-acp-conformance.md#zcode',
+    receiptSha256: '156080f88ed84a013fb26d93e5138230732d2ef0e2b5b10a7c3deb501d3548e9',
+  }),
+});
+
+function zcodeBinary({ platform = process.platform, exists = fs.existsSync } = {}) {
+  return platform === 'darwin' && exists(ZCODE_BUNDLED_CLI)
+    ? ZCODE_BUNDLED_CLI
+    : 'zcode';
+}
+
+function opencodePermission(writableRoots) {
+  const edit = { '*': 'deny' };
+  for (const root of writableRoots) {
+    if (root === '.') edit['*'] = 'allow';
+    else edit[`${root}/**`] = 'allow';
+  }
+  return JSON.stringify({
+    share: 'disabled',
+    permission: {
+      '*': 'deny',
+      read: 'allow',
+      glob: 'allow',
+      grep: 'allow',
+      list: 'allow',
+      lsp: 'allow',
+      edit,
+      external_directory: 'deny',
+      bash: 'deny',
+      task: 'deny',
+      webfetch: 'deny',
+      websearch: 'deny',
+      question: 'deny',
+      skill: 'deny',
+    },
+  });
+}
+
+const PROFILES = Object.freeze({
+  claude: Object.freeze({
+    binary: 'claude',
+    acp: Object.freeze({
+      surface: `official ${CLAUDE_ACP_PACKAGE} stdio adapter`,
+      transport: 'stdio',
+      protocolVersions: [1],
+      conformance: ACP_CONFORMANCE.claude,
+      command: () => 'npx',
+      argv: () => ['--yes', CLAUDE_ACP_PACKAGE],
+    }),
+    delegateArgv: (prompt, _cwd, options) => [
+      '-p', prompt,
+      '--permission-mode', options.readOnly ? 'plan' : 'acceptEdits',
+      '--no-session-persistence',
+      '--output-format', 'json',
+      '--tools', options.readOnly ? 'Read,Grep,Glob' : 'Read,Write,Edit,Grep,Glob',
+    ],
+  }),
+  codex: Object.freeze({
+    binary: 'codex',
+    acp: Object.freeze({
+      surface: `official ${CODEX_ACP_PACKAGE} stdio adapter`,
+      transport: 'stdio',
+      protocolVersions: [1],
+      conformance: ACP_CONFORMANCE.codex,
+      command: () => 'npx',
+      argv: () => ['--yes', CODEX_ACP_PACKAGE],
+    }),
+    delegateArgv: (prompt, cwd, options) => [
+      'exec', '--ephemeral', '--ignore-user-config',
+      '--sandbox', options.readOnly ? 'read-only' : 'workspace-write',
+      '--cd', cwd,
+      '--config', 'sandbox_workspace_write.network_access=false',
+      '--output-schema', options.schemaFile,
+      '--output-last-message', options.hostOutput,
+      '--json', prompt,
+    ],
+  }),
+  opencode: Object.freeze({
+    binary: 'opencode',
+    acp: Object.freeze({
+      surface: 'native OpenCode ACP stdio server',
+      transport: 'stdio',
+      protocolVersions: [1],
+      conformance: ACP_CONFORMANCE.opencode,
+      command: ({ cliCommand }) => cliCommand,
+      argv: () => ['acp'],
+    }),
+    delegateArgv: (prompt, cwd) => [
+      'run', '--dir', cwd, '--format', 'json', '--auto', prompt,
+    ],
+    delegateEnv: (options) => ({
+      OPENCODE_CONFIG_CONTENT: opencodePermission(options.writableRoots),
+    }),
+  }),
+  kimi: Object.freeze({
+    binary: 'kimi',
+    supportsModelSelection: true,
+    acp: Object.freeze({
+      surface: 'Kimi Code ACP stdio server',
+      transport: 'stdio',
+      protocolVersions: [1],
+      conformance: ACP_CONFORMANCE.kimi,
+      command: ({ cliCommand }) => cliCommand,
+      argv: () => ['acp'],
+    }),
+    delegateArgv: (prompt, _cwd, options) => {
+      const args = ['-p', prompt, '--output-format', 'stream-json'];
+      if (options.model) args.push('--model', options.model);
+      args.push(
+        '--agent-file',
+        path.join(
+          KIMI_PROFILE_ROOT,
+          options.readOnly ? 'kimi-read-only.md' : 'kimi-write.md',
+        ),
+      );
+      return args;
+    },
+  }),
+  grok: Object.freeze({
+    binary: 'grok',
+    acp: Object.freeze({
+      surface: 'Grok agent stdio candidate',
+      transport: 'stdio',
+      protocolVersions: [1],
+      conformance: ACP_CONFORMANCE.grok,
+      command: ({ cliCommand }) => cliCommand,
+      argv: () => ['agent', 'stdio'],
+    }),
+    delegateArgv: (prompt, cwd, options) => [
+      '--cwd', cwd, '--single', prompt,
+      '--permission-mode', options.readOnly ? 'plan' : 'acceptEdits',
+      '--sandbox', options.readOnly ? 'read-only' : 'workspace',
+      '--no-memory', '--no-subagents', '--disable-web-search',
+      '--verbatim',
+      '--max-turns', '12',
+      '--output-format', 'json',
+    ],
+  }),
+  zcode: Object.freeze({
+    binary: zcodeBinary(),
+    installedRuntimeOnly: true,
+    acp: Object.freeze({
+      surface: `installed ZCode Desktop runtime through zcode-acp ${ZCODE_ACP_SOURCE.version}`,
+      transport: 'stdio',
+      protocolVersions: [1],
+      conformance: ACP_CONFORMANCE.zcode,
+      command: ({ env }) => env.ULTRA_ZCODE_ACP_COMMAND || 'zcode-acp',
+      argv: ({ cliCommand }) => ['--zcode-path', cliCommand, '--no-browser'],
+      identityProbes: ({ command, cliCommand }) => [
+        {
+          label: 'zcode_bridge',
+          command,
+          args: ['--version'],
+          expectedStdout: ZCODE_ACP_SOURCE.buildMarker,
+        },
+        {
+          label: 'zcode_runtime',
+          command: cliCommand.endsWith('.cjs') ? process.execPath : cliCommand,
+          args: cliCommand.endsWith('.cjs') ? [cliCommand, '--version'] : ['--version'],
+          expectedStdout: ZCODE_ACP_SOURCE.runtimeVersion,
+        },
+      ],
+    }),
+    delegateArgv: (prompt, cwd, options) => [
+      '--cwd', cwd,
+      '--mode', options.readOnly ? 'plan' : 'edit',
+      '--json', '--no-color',
+      '--disallowedTools', options.readOnly
+        ? 'Bash Write Edit ApplyPatch Agent WebFetch WebSearch'
+        : 'Bash Agent WebFetch WebSearch',
+      '--prompt', prompt,
+    ],
+  }),
+});
+
+function hostProfile(runtime) {
+  const profile = PROFILES[runtime];
+  if (!profile) throw new Error(`unsupported delegate host: ${runtime}`);
+  return { ...profile, transportMaturity: TRANSPORT_MATURITY[runtime] };
+}
+
+// The live delegate surface names honestly what a run actually used. The ZCode
+// headless transports are app-internal surfaces, never the documented ZCode
+// Desktop interactive primary path, so every receipt that records one says so.
+function transportSurface(runtime, binary = PROFILES[runtime] ? PROFILES[runtime].binary : undefined) {
+  if (runtime === 'zcode') {
+    const source = binary === ZCODE_BUNDLED_CLI ? 'the App-bundled headless CLI' : 'the zcode headless CLI on PATH';
+    return `${source} (experimental; not the documented ZCode Desktop interactive surface)`;
+  }
+  return 'documented non-interactive CLI';
+}
+
+module.exports = {
+  ACP_CONFORMANCE,
+  CLAUDE_ACP_PACKAGE,
+  CODEX_ACP_PACKAGE,
+  PROFILES,
+  TRANSPORT_MATURITY,
+  ZCODE_BUNDLED_CLI,
+  ZCODE_ACP_SOURCE,
+  hostProfile,
+  opencodePermission,
+  transportSurface,
+  zcodeBinary,
+};

package/skills/ultra-deliver/SKILL.md

@@ -7,6 +7,18 @@ description: Reconcile one Change whose matching tasks are complete, run aggrega
 
 Delivery closes the local Change; readiness grants no commit, push, tag, publish, or deploy authority.
 
+## Route modes
+
+| Mode | Entry | Observable exit | Next |
+|---|---|---|---|
+| `reconcile` | Explicit invocation or a valid Execution Grant for a tested active Change | Intent, implementation, specifications, documentation, evidence, and report agree, or changed files make the exact stale evidence visible | Recommend `ultra-test/reaudit` after changes, otherwise recommend explicit `ultra-deliver/finalize` |
+| `finalize` | Current explicit owner invocation only | Fresh transport/evidence checks pass, version and package posture are owner-set, `delivery.md` is written, and the Change is locally archived | Report `idle` plus every separately authorized or unfinished release effect |
+
+Follow `../ultra-status/references/route-contract.md`. Show a Route Card at entry, after
+reconciliation, before the finalization checkpoint, and after archive or any stop.
+Grant-aware continuation ends with `reconcile`; no Host metadata bit, report, or grant
+turns `finalize` into an implicit mode.
+
 ## Before you start
 
 1. If model-selected, verify the live execution grant in `../ultra-change/references/execution-grant.md` — a current session-local activation or a stably verified durable work-package grant; without either, stop. A model-selected Deliver run under that grant may reconcile, review, and report, and then MUST stop before finalization: its inputs, writes, and effects end at the report. Only a current explicit owner invocation of `ultra-deliver` may finalize — writing `delivery.md`, deciding the version decision and package posture, and archiving the stable Change id with `git mv` are owner-invocation-only in every grant mode, and a grant never covers them.
@@ -178,4 +190,5 @@ Without release authority, stop after the recoverable local archive and report i
   trade-off rather than an established repository rule.
 - `../ultra-think/references/autonomy-boundary.md` — read before scope or evidence shrinks.
 - `../ultra-change/references/execution-grant.md` — read only for grant-activated continuation.
+- `../ultra-status/references/route-contract.md` — owner-visible route, checkpoint, and recovery output.
 - `references/baseline-reconciliation.md` — exact `delivery.md` reconciliation contract.

package/skills/ultra-dev/SKILL.md

@@ -7,6 +7,20 @@ description: Carry one planned task from a written implementation plan through r
 
 The model owns code reasoning and edits; repository files own the resumable contract.
 
+## Route modes
+
+| Mode | Entry | Observable exit | Next |
+|---|---|---|---|
+| `execute` | Explicit task id or a valid Execution Grant covering one dependency-ready pending task | The named task has current acceptance evidence, final task review, completion context, and a read-back `completed` ledger row | Recommend the next exact `ultra-dev/execute` task or `ultra-test/audit` |
+| `resume` | Explicit task id or a valid Execution Grant covering the unique in-progress task | Existing work is reconciled from Git, context, and Resume Note, then reaches the same completion evidence or a typed stop | Recommend the next exact task, `ultra-test/audit`, or the responsible repair route |
+| `reopen` | Explicit task id or a valid Execution Grant after current evidence invalidates a completed task | The invalidated criteria are refreshed through a new review and the task is completed again, or the remaining gate is named | Recommend the next exact task or `ultra-test/reaudit` |
+
+Follow `../ultra-status/references/route-contract.md`. Show a Route Card before the
+first implementation edit, at material checkpoints or unavailable evidence, and after
+the ledger readback. When context pressure threatens reliable continuation, finish the
+nearest safe write, refresh the Resume Note, and recommend a fresh session rather than
+pretending the task is still making invisible progress.
+
 ## Before you start
 
 1. If model-selected, verify the live execution grant in `../ultra-change/references/execution-grant.md` — a current session-local activation or a stably verified durable work-package grant; without either, stop.
@@ -229,8 +243,9 @@ historical evidence, then write and read back the ledger transition. Refresh the
 evidence, run task review for the new snapshot, and repeat this closeout sequence.
 
 Report the changed paths, the seam, the exact checks run, the review result, the
-evidence gaps and the residual risk. Recommend the next capability from what the
-files now say; do not invoke it.
+evidence gaps and the residual risk. Recommend the next capability from what the files
+now say. Continue only when its exact mode and effects remain inside the valid grant and
+after showing the transition Route Card; otherwise do not invoke it.
 
 ## When the owner decides
 
@@ -245,5 +260,6 @@ authority. An interruption leaves the worktree as-is and names it in the Resume
 - `../ultra-think/references/autonomy-boundary.md` — read when spec and code disagree.
 - `../ultra-review/SKILL.md` — read when implementation evidence is ready for review.
 - `../ultra-change/references/execution-grant.md` — read only for grant-activated continuation.
+- `../ultra-status/references/route-contract.md` — owner-visible route, checkpoint, and recovery output.
 - `../ultra-plan/references/task-evidence-v2.md` — canonical evidence, disposition, and task-review shape.
 - `references/debugging.md` — read for a reproduced failure before selecting a repair.

package/skills/ultra-init/SKILL.md

@@ -9,6 +9,17 @@ Initialization establishes places for later authority and records raw owner inta
 does not validate the problem, establish a North Star, build a product or architecture
 baseline, settle domain language, choose a Change, or start another public workflow.
 
+## Route modes
+
+| Mode | Entry | Observable exit | Next |
+|---|---|---|---|
+| `create` | Explicit owner invocation when `.ultra/` is absent | Missing skeleton files and raw Project Brief are published and read back; Git exists | Recommend `ultra-research` in `baseline` mode |
+| `recover` | Explicit owner invocation when the skeleton is partial or uncertain | Missing files are restored, preserved authority is byte-identical, and every unresolved repair is named | Recommend `ultra-research` in `baseline` mode when the brief is usable; otherwise resume `ultra-init/recover` |
+
+Follow `../ultra-status/references/route-contract.md`. Derive a Route Card before the
+first write and at the exit or any repair stop. Init never continues into Research on
+its own, and its `Position` reports observed files rather than semantic progress.
+
 ## Before you start
 
 1. If `.ultra/changes/active/` exists, resolve at most one active `change_id`. Read
@@ -128,4 +139,5 @@ usable brief exists, but do not invoke it.
 
 - `../ultra-grilling/SKILL.md` — read before the first missing brief field.
 - `references/brownfield-adoption.md` — read when maintained behavior already exists.
+- `../ultra-status/references/route-contract.md` — owner-visible route, checkpoint, and recovery output.
 - `../ultra-think/references/autonomy-boundary.md` — read before replacing authority.

package/skills/ultra-plan/SKILL.md

@@ -7,6 +7,18 @@ description: Turn an evidenced Change intent into a dependency-valid task ledger
 
 Planning owns decomposition and technical design; files carry it across sessions and hosts.
 
+## Route modes
+
+| Mode | Entry | Observable exit | Next |
+|---|---|---|---|
+| `decompose` | Explicit invocation or a valid Execution Grant for one accepted, evidenced Change | A dependency-valid task graph, contexts, acceptance mapping, review, and earliest observable slice are read back | Recommend the exact first `ultra-dev/execute` task |
+| `recover` | Explicit invocation or a valid Execution Grant when the current Change's planning artifacts are incomplete or inconsistent | Ledger/context/trace defects are repaired or a bounded unavailable path is reported | Recommend the exact first `ultra-dev/execute` task, or `ultra-change/reconcile` for a product evidence gap |
+
+Follow `../ultra-status/references/route-contract.md`. Show the Route Card before
+decomposition, at any material posture decision, and after reporting the graph. The
+first executable slice must name its real consumer, real data path, and owner-visible
+observation; a task count or completed plan file is not early value.
+
 ## Before you start
 
 1. If model-selected, verify the live execution grant in `../ultra-change/references/execution-grant.md` — a current session-local activation or a stably verified durable work-package grant; without either, stop.
@@ -47,8 +59,11 @@ Keep the posture visible rather than silently drifting.
 Use `../ultra-grilling/SKILL.md` through the host-native question surface when the
 choice remains material, one question with a recommendation at a time.
 
-When the whole path is still unclear, recommend `ultra-research`; the Change is not yet
-evidenced enough to decompose. For one consequential trade-off, use `../ultra-think/SKILL.md`.
+When a product or contract evidence gap leaves the whole path unclear, return the exact
+gap to `ultra-change/reconcile`; Plan does not open Research directly. Change decides
+whether to record a bounded Research Disposition. For ordinary technical uncertainty,
+the model resolves it or writes one bounded spike/tracer task. For one consequential
+trade-off, use `../ultra-think/SKILL.md`.
 
 ## Choose the plan shape
 
@@ -126,7 +141,9 @@ reached, preserve the findings and return the evidence to the responsible model
 owner. Attempt and finding counts never manufacture convergence or failure.
 
 Report the graph, frontier, seams, warnings and first task. Recommend the next explicit
-capability from the files; do not invoke it.
+capability from the files. Under a valid grant covering that exact task, show the
+transition Route Card before allowing Dev to re-verify and continue; otherwise do not
+invoke it.
 
 ## When the owner decides
 
@@ -139,4 +156,5 @@ contract or material trade-off. The model owns decomposition and repairs broken
 - `../ultra-think/SKILL.md` — read when one evidenced decision blocks decomposition.
 - `../ultra-review/SKILL.md` — read after plan files pass mechanical verification.
 - `../ultra-change/references/execution-grant.md` — read only for grant-activated continuation.
+- `../ultra-status/references/route-contract.md` — owner-visible route, checkpoint, and recovery output.
 - `references/task-evidence-v2.md` — canonical typed task evidence and task-review contract.

package/skills/ultra-research/SKILL.md

@@ -10,9 +10,26 @@ baseline plus later evidence-backed corrections. Web
 search is one evidence source, not the workflow: repository files, Git, tests, runtime,
 maintained documentation, owner decisions, and current primary sources all count.
 
+## Route modes
+
+| Mode | Entry | Observable exit | Next |
+|---|---|---|---|
+| `baseline` | Explicit owner invocation with a usable Project Brief and no accepted baseline for the boundary | Selected reports, synthesis, specifications, vocabulary, and accepted North Star are read back; unknowns and omissions remain explicit | Recommend `ultra-change` in `intake` mode for the next bounded request |
+| `change-scoped` | Explicit invocation or a valid Execution Grant for one active Change's recorded Research Disposition | The named exit evidence exists and the selected canonical sections are refreshed without changing Change acceptance | Return to the same `ultra-change` in `reconcile` mode |
+
+Follow `../ultra-status/references/route-contract.md`. At entry, name the mode, entry
+question, selected coverage, observable stop condition, and return route. Refresh the
+Route Card at each material checkpoint, pause, and exit; lens counts are navigation, not
+proof that Research is semantically complete.
+
 ## Before you start
 
-1. If model-selected, verify the live execution grant in `../ultra-change/references/execution-grant.md` — a current session-local activation or a stably verified durable work-package grant; without either, stop.
+1. Resolve `baseline` or `change-scoped` from the artifacts and invocation. A
+   model-selected run is valid only for `change-scoped` mode under the live execution
+   grant in `../ultra-change/references/execution-grant.md` — a current session-local
+   activation or a stably verified durable work-package grant covering the same Change;
+   without it, stop and recommend explicit invocation. Baseline adoption is always an
+   explicit-entry mode.
 2. Resolve at most one active `change_id`, then read `.ultra/tasks.json` plus the
    `context_file` and `## Resume Note` of unfinished tasks whose `change_id` matches it,
    if any. Archived or abandoned unfinished rows are history, not the current frontier.
@@ -46,9 +63,15 @@ When coverage spans several lenses or the path itself is unclear, read
 for one already-bounded evidence question. Wayfinding selects the smallest useful
 coverage; it does not create workflow state or another semantic authority.
 
+The derived brief records the entry question, selected lenses, deliberate omissions,
+dependencies, source plan, material checkpoints, observable stop condition, and return
+route. Read it on a fresh session instead of restarting completed evidence collection.
+
 Map the brief and unresolved specification sections to seventeen focused evidence
-lenses. Confirm the proposed coverage once with the owner. Load one reference
-at a time; the parent holds the question map, not every step prompt.
+lenses. Show the proposed coverage once. Pause only when it expands an accepted boundary
+or creates another material checkpoint; a covering Change Research Disposition does not
+need a duplicate confirmation. Load one reference at a time; the parent holds the
+question map, not every step prompt.
 
 The first six lenses have real semantic dependencies:
 
@@ -88,7 +111,8 @@ For scoped Research inside an active Change, answer only its recorded `Research
 Disposition` question and produce the named exit evidence. Research writes reports and
 the mapped canonical baseline sections; it does not silently rewrite Change acceptance.
 Return the evidence paths so `ultra-change` can reconcile the accepted intent before
-planning when that contract must change.
+planning when that contract must change. The scoped run's return route is always the
+same stable Change, even when the evidence supports the original intent unchanged.
 
 If web access is unavailable, record `[UNVERIFIED: no web access]` and continue with
 other evidence. Missing tooling lowers confidence; it does not manufacture a blocker.
@@ -115,7 +139,10 @@ or grants execution.
 
 Load `references/99-synthesis.md` only after selected reports exist. Read every promoted
 file back, verify trace anchors and source hashes, and report exact unresolved gaps.
-Recommend the next explicit public workflow from the resulting files; do not invoke it.
+For `baseline`, recommend `ultra-change/intake`; for `change-scoped`, return the named
+evidence to `ultra-change/reconcile`. Invoke neither unless the latter continuation is
+covered by the same valid Execution Grant; when it is covered, show the transition Route
+Card first and let Change re-verify its own mode and grant.
 
 ## When the owner decides
 
@@ -136,4 +163,5 @@ selects methods, and updates accepted files inside that frame.
 - `references/north-star-v2.md` — exact semantic structure, adoption, validation, and
   supersession contract.
 - `../ultra-change/references/execution-grant.md` — read only for grant-activated continuation.
+- `../ultra-status/references/route-contract.md` — owner-visible route, checkpoint, and recovery output.
 - `../ultra-think/references/autonomy-boundary.md` — read before reducing authority.

package/skills/ultra-status/SKILL.md

@@ -9,22 +9,43 @@ This router is read-only. It separates verified files, model inference, and unav
 evidence, then recommends one explicit public capability without invoking it. It never
 persists a workflow-position field.
 
+## Route modes
+
+| Mode | Entry | Observable exit | Next |
+|---|---|---|---|
+| `route` | Owner asks what is current or what to do next | One artifact-derived Route Card names the matched facts, unavailable evidence, and one recommended route | The named explicit route, or `idle` |
+| `history` | Owner asks what changed, was rejected, or was superseded | Relevant decisions, Git revisions, archived/abandoned Changes, and unresolved contradictions are summarized without becoming authority | Return to `route` or the owner-selected revision route |
+| `installation` | Owner asks whether Ultra is discovered and healthy on a Host | Installed version, provenance, Skill/hook discovery, drift, and reachable repair are reported read-only | Recommend the exact install/update/Doctor repair |
+| `delegation` | Owner asks about a worker, handoff, ACP/CLI event, or terminal result | Transport observations and canonical authority are shown separately with a retry/cancel/integration path | Return to the requesting primary route |
+| `recovery` | Authority is absent, ambiguous, stale, malformed, or temporarily unreadable | The earliest unsafe or unavailable fact and cheapest safe repair, retry, cancel, abandon, or fresh-session path are named | Recommend only the repair-capable explicit route |
+
+Follow `references/route-contract.md` and use its `UBP Route Card` as the default output,
+not an optional appendix. Expand history, installation, delegation, or recovery details
+only when requested or needed to explain why the normal route is unavailable. Status is
+a `router`: the Owner invokes it for read-only diagnosis, its Host implicit bit remains
+off, and it supplies no continuation authority. Other public Skills derive their own
+cards from the shared reference rather than invoking Status.
+
 ## Before you start
 
 1. Read `../ultra-change/references/change-contract.md` and apply its **Active Change
    authority resolution** before reading any active `intent.md` or relying on a current
    `change_id`. A positively observed absent `.ultra` uses the existing `ultra-init`
-   route. Otherwise continue only from the rule's stable zero-or-one result; any typed
-   diagnostic stops routing until its stated repair or retry succeeds. With one active
-   Change, read `.ultra/tasks.json`, then tasks whose `change_id` matches it and the
+   route. Otherwise continue only from the rule's stable zero-or-one result. A typed
+   diagnostic stops semantic routing from an ambiguous active Change, but it does not
+   stop Status: switch to `recovery` mode and report the diagnostic plus safe Git and
+   directory observations without reading any ambiguous `intent.md` as authority. With
+   one valid active Change, read `.ultra/tasks.json`, then tasks whose `change_id` matches it and the
    frontier task's `context_file` and `## Resume Note`. `.ultra/tasks.json` is the sole
    task-status authority. A Status or Complexity header in a legacy context is a
    migration diagnostic; the ledger wins. Historical and abandoned tasks never define
    the frontier.
-2. Read `.ultra/project-brief.md`, `.ultra/north-star.md`, `CONTEXT.md`, relevant
-   `.ultra/decisions/`, specifications, active, archived, or abandoned Changes, and
-   evidence. An abandoned Change supplies historical boundary and recovery context;
-   it never defines the current route.
+2. After stable authority resolution, read `.ultra/project-brief.md`,
+   `.ultra/north-star.md`, `CONTEXT.md`, relevant `.ultra/decisions/`, specifications,
+   active, archived, or abandoned Changes, and evidence. In `recovery` mode, read only
+   unaffected canonical files and safe directory/Git observations; do not interpret an
+   ambiguous active intent. An abandoned Change supplies historical boundary and
+   recovery context; it never defines the current route.
 3. Inspect Git `HEAD`, worktree status, and installed host manifests without repair.
 4. When the active Change records a `durable work-package` Execution Grant, report it
    as recorded authorization data — grant id, cited decision, and its recorded
@@ -36,6 +57,8 @@ persists a workflow-position field.
 
 ## Definition of done
 
+- Emit the current Route Card with an exact mode, observable exit, unfinished work, and
+  one next route or safe recovery path.
 - Evaluate the artifact route in order and name the evidence supporting the match.
 - Keep stale test evidence, dirty worktree state, baseline gaps, and task graph risks
   visible without converting them into semantic failure.
@@ -153,6 +176,12 @@ and unresolved `FP-*`/`NS-*`/`HC-*` reference. A mismatch is stale evidence, nev
 mechanical verdict about truth or permission; supersession does not delete prior task,
 review, Test, or delivery evidence.
 
+On a fresh session, use the current Change's exact matching contexts and closing Resume
+Note to reconstruct the card. Do not rerun completed Research or infer route from chat
+memory. In `history` mode, distinguish mutable draft edits from superseding accepted
+decision records and keep rejected or abandoned alternatives visible when they explain
+the current boundary.
+
 ## Surface risk and installation health
 
 List unmet task dependencies, more than one matching `in_progress` task under the
@@ -173,6 +202,7 @@ Contradictory facts remain visible instead of being resolved by routing heuristi
 ## References
 
 - `../ultra-change/references/change-contract.md` — canonical Active Change authority resolution.
+- `references/route-contract.md` — canonical Route Card, checkpoint, continuation, and recovery contract.
 - `../ultra-think/SKILL.md` — read only when contradictory evidence creates one real
   decision rather than a mechanical repair.
 - `../ultra-think/references/autonomy-boundary.md` — read before recommending a route