ultra-builder-pro-cli 5.0.0 → 6.0.0

package/skills/ultra-status/SKILL.md

@@ -1,209 +0,0 @@
----
-name: ultra-status
-description: Infer the current Ultra route, baseline gaps, stale evidence, task risk, and installation health from repository files and host manifests. Use when the owner asks what is complete, blocked, stale, unhealthy, or useful to do next.
----
-
-# Route from artifacts without changing them
-
-This router is read-only. It separates verified files, model inference, and unavailable
-evidence, then recommends one explicit public capability without invoking it. It never
-persists a workflow-position field.
-
-## Route modes
-
-| Mode | Entry | Observable exit | Next |
-|---|---|---|---|
-| `route` | Owner asks what is current or what to do next | One artifact-derived Route Card names the matched facts, unavailable evidence, and one recommended route | The named explicit route, or `idle` |
-| `history` | Owner asks what changed, was rejected, or was superseded | Relevant decisions, Git revisions, archived/abandoned Changes, and unresolved contradictions are summarized without becoming authority | Return to `route` or the owner-selected revision route |
-| `installation` | Owner asks whether Ultra is discovered and healthy on a Host | Installed version, provenance, Skill/hook discovery, drift, and reachable repair are reported read-only | Recommend the exact install/update/Doctor repair |
-| `delegation` | Owner asks about a worker, handoff, ACP/CLI event, or terminal result | Transport observations and canonical authority are shown separately with a retry/cancel/integration path | Return to the requesting primary route |
-| `recovery` | Authority is absent, ambiguous, stale, malformed, or temporarily unreadable | The earliest unsafe or unavailable fact and cheapest safe repair, retry, cancel, abandon, or fresh-session path are named | Recommend only the repair-capable explicit route |
-
-Follow `references/route-contract.md` and use its `UBP Route Card` as the default output,
-not an optional appendix. Expand history, installation, delegation, or recovery details
-only when requested or needed to explain why the normal route is unavailable. Status is
-a `router`: the Owner invokes it for read-only diagnosis, its Host implicit bit remains
-off, and it supplies no continuation authority. Other public Skills derive their own
-cards from the shared reference rather than invoking Status.
-
-## Before you start
-
-1. Read `../ultra-change/references/change-contract.md` and apply its **Active Change
-   authority resolution** before reading any active `intent.md` or relying on a current
-   `change_id`. A positively observed absent `.ultra` uses the existing `ultra-init`
-   route. Otherwise continue only from the rule's stable zero-or-one result. A typed
-   diagnostic stops semantic routing from an ambiguous active Change, but it does not
-   stop Status: switch to `recovery` mode and report the diagnostic plus safe Git and
-   directory observations without reading any ambiguous `intent.md` as authority. With
-   one valid active Change, read `.ultra/tasks.json`, then tasks whose `change_id` matches it and the
-   frontier task's `context_file` and `## Resume Note`. `.ultra/tasks.json` is the sole
-   task-status authority. A Status or Complexity header in a legacy context is a
-   migration diagnostic; the ledger wins. Historical and abandoned tasks never define
-   the frontier.
-2. After stable authority resolution, read `.ultra/project-brief.md`,
-   `.ultra/north-star.md`, `CONTEXT.md`, relevant `.ultra/decisions/`, specifications,
-   active, archived, or abandoned Changes, and evidence. In `recovery` mode, read only
-   unaffected canonical files and safe directory/Git observations; do not interpret an
-   ambiguous active intent. An abandoned Change supplies historical boundary and
-   recovery context; it never defines the current route.
-3. Inspect Git `HEAD`, worktree status, and installed host manifests without repair.
-4. When the active Change records a `durable work-package` Execution Grant, report it
-   as recorded authorization data — grant id, cited decision, and its recorded
-   subject, scope, topology, allowed effects, budgets, and invalidation — and state
-   plainly that stored grant text is inactive until a consuming Agent stably
-   verifies it per `../ultra-change/references/execution-grant.md`. Status itself
-   neither activates nor continues the grant; a `session-local` grant is reported as
-   requiring fresh owner activation.
-
-## Definition of done
-
-- Emit the current Route Card with an exact mode, observable exit, unfinished work, and
-  one next route or safe recovery path.
-- Evaluate the artifact route in order and name the evidence supporting the match.
-- Keep stale test evidence, dirty worktree state, baseline gaps, and task graph risks
-  visible without converting them into semantic failure.
-- Report exact installation drift and a reachable repair without mutating it.
-- Recommend one route and why; never launch it.
-
-## Infer the route
-
-| Observable files and current need | Recommendation |
-|---|---|
-| No `.ultra/` | `ultra-init` |
-| Project Brief has no usable one-line and no legacy `## One-line` exists | `ultra-init` |
-| Project Brief or legacy seed exists and North Star status is `unresearched`, legacy, invalid, or not accepted for the current boundary | `ultra-research` |
-| A new request exists and no active Change exists | `ultra-change` |
-| More than one active Change exists | Diagnose the conflicting directories and ask the owner which one remains active; do not route or move either automatically |
-| A primary-transfer handoff directory exists under `.ultra/.runtime/handoffs/` | Report its protocol state read-only (`offered`, `blocked`, `active`, or a terminal state) from `OFFER.json`/`ACK.json`/`RESULT.json`, verified with `node <ultra-change-skill-dir>/scripts/validate_primary_transfer.cjs <repository-root>`; receipts are derived observations, never authority |
-| An ACK-ready handoff has no terminal RESULT | The accepted receiver is the sole canonical writer for that work package; report the in-flight transfer and never route canonical writes to another Agent |
-| A handoff is `blocked` or its live re-verification is stale | Report the mismatched observation and the recovery path (fresh handoff id after owner re-confirmation); do not repair receipts |
-| The active intent is `draft` or has a blocking unresolved decision | `ultra-change` to finish and accept the contract |
-| The active `Research Disposition` names required exit evidence that is not satisfied | `ultra-research` for the named question and selected lenses |
-| Research evidence exists but the accepted intent has not reconciled it | `ultra-change` to update the bounded contract |
-| The accepted North Star revision or digest differs from the active intent trace | `ultra-change`; report the stale observation, preserve old evidence, and reconcile IDs before execution |
-| An active Change exists and `.ultra/tasks.json` has no tasks whose `change_id` matches it | `ultra-plan` |
-| The Change has exactly one `in_progress` task | `ultra-dev`, naming that task |
-| Only `pending` tasks remain (the frontier) | Report them as frontier candidates with their unresolved dependencies and recommend one exact task id for an explicit owner invocation of `ultra-dev`; a pending row is not active work and never auto-selects a route |
-| A ledger row says `completed` but its current `ultra-task-evidence-v2` record or task-review binding is missing, stale, or structurally invalid | `ultra-dev` to repair evidence and completion provenance; do not infer a context status or silently demote the row |
-| All matching tasks are completed, each has current `ultra-task-evidence-v2` plus a consumed task review, and no current report matches this Change | `ultra-test` |
-| A current false report has implementation, test, or wiring findings selected for repair | `ultra-dev` after owner disposition |
-| A current false report has missing external or product evidence selected for collection | `ultra-research` after owner disposition |
-| A current false report has an acceptance, scope, or existing-promise change selected for reconciliation | `ultra-change` after owner disposition; use `ultra-think` internally for one consequential trade-off |
-| Every current finding is explicitly accepted, deferred, or otherwise dispositioned | `ultra-deliver`, subject to its one orphan-export gate |
-| Report passed and all report identities match current files | `ultra-deliver` |
-| No active Change and no new request | Report the idle state; do not manufacture work |
-
-An explicit `[NEEDS CLARIFICATION]` is evidence of an unresolved field, not proof that
-the entire project requires Research. Judge whether it can change the current boundary.
-Do not add `research_complete`, a score, or another state bit to replace that judgment.
-
-A test-report is stale when its `change_id` is not the active Change, its `task_ids` are not
-the exact ordered ids of tasks whose `change_id` matches that Change, `git_commit`
-differs from `HEAD`, or its `worktree.diff_digest` or `intent_digest` differs from
-running
-`node <ultra-test-skill-dir>/scripts/worktree_digest.cjs --project <repository-root> --change-id <change_id>`.
-A dirty worktree is a warning, not evidence of failure.
-The product-worktree digest has one fixed boundary: it excludes `.ultra/evidence/**`,
-whose command and external-observation entries bind raw bytes as
-`raw_evidence_sha256` before stable exact record bytes are bound as `evidence_digest`.
-Status must therefore use the exact ordered `task_evidence` projection and strict receipt
-consumers below for evidence provenance; it never adds another exclusion or treats
-excluded publication bytes as absent evidence.
-
-Freshness also requires the exact ordered `task_evidence` projection. Its
-`evidence_digest`, `task_review_session`, and `task_review_summary_digest` must match the
-current record and retained review — or, for an `external-manual` record, its
-`task_review_receipt_ref` and `task_review_receipt_digest` must match the current
-record and the bounded stable receipt bytes reverified through the sensor's
-`--verify-external-receipt` mode, and take its `--projection` output verbatim.
-Recheck whichever branch the record declares and never rewrite one branch into the
-other. For each item, take every command and
-external-observation `raw_evidence_ref` to bounded stable
-repository-contained bytes from an ordinary regular non-symlink file opened nonblocking
-and no-follow, with an 8 MiB ceiling and path/descriptor identity checks around the read.
-Recompute `raw_evidence_sha256` from that one snapshot and require an exact match, then
-recompute the stable exact `evidence.json` bytes as `evidence_digest` before comparing
-the projection. A raw or record mismatch routes to the owning task's explicit Dev repair.
-Run
-`node <ultra-plan-skill-dir>/scripts/validate_task_evidence.cjs <evidence-ref>`, and
-compare `task_id`, `schema`, `evidence_ref`, `task_review_session`, and
-`task_review_summary_digest` with the current ledger row, final evidence record, and
-retained strict task-review summary. The task evidence `subject` is an independently
-captured completion-snapshot freshness observation made after validated task Review and
-immediately before evidence publication. Its `task_review` separately binds the retained strict summary; neither Worker Packet v1 nor its nullable summary worktree digest proves
-the subject. Do not require that earlier observation to equal the report's later
-aggregate worktree digest. Recheck current Acceptance, criterion and verification type,
-owner record, review summary, and cited affected artifacts independently.
-
-Replay the report's strict aggregate review summary with the existing Review summary
-waiter, then run
-`node <ultra-test-skill-dir>/scripts/validate_review_transport.cjs --summary <summary-path> --report .ultra/test-report.json`.
-Require the exact `packet_digest`, `admission_digest`, `subject_digest`, and `summary_digest` bindings, plus session, summary path, execution mode, ordered findings, and report root subject.
-Each structural validator or sensor reports identity and provenance observations and never decides semantic acceptance, review quality, or `passed`.
-Any mismatch makes the report stale and routes repair to the responsible workflow.
-
-`passed: false` does not itself select a repair. Preserve each finding, ask for owner
-disposition where scope or risk changes, then route by the accepted response above.
-For a current task-review `REQUEST_CHANGES`, consume the exact validated current
-`SUMMARY.json.findings` array and preserve every finding id. Route every current P0/P1
-to resolution or authoritative disposition and refresh its affected evidence; never
-reuse a finding count or list from an older summary. P2 and P3 findings remain report
-entries or owner-selected backlog and never re-open a task on their own.
-Likewise, ledger completion and structurally valid v2 evidence are necessary for a
-current Test claim but never sufficient to manufacture `passed: true`. A validator
-reports schema, identity, provenance, and freshness observations only. It cannot decide
-whether an inspection supports a criterion, supply an `owner-judgment`, or turn an
-external receipt into product truth.
-
-Status remains read-only when later work invalidates a completed task. It names the
-affected criterion IDs and reason and recommends Dev. Dev records both in the context
-Change Log and Resume Note before the ledger-authoritative `completed` to `in_progress`
-transition; Status never silently demotes a task.
-
-A budget stop or `owner checkpoint` is displayed as-is: report the exhausted budget,
-the in-progress task it stopped, and the reachable owner decision (extend, retry,
-cancel, or abandon). Status never infers continuation, extension, or any semantic
-verdict from a budget stop, and never treats a pending frontier row as the active
-task behind one.
-
-The repository has one primary writer for canonical `.ultra` files. Native review
-workers and delegated CLIs may inspect or write isolated source roots, but their results
-return to that writer. Concurrent canonical writes require separate worktrees and
-explicit integration; this router does not invent locks or silently merge ledgers.
-
-Report the accepted North Star revision and digest, every active Change trace mismatch,
-and unresolved `FP-*`/`NS-*`/`HC-*` reference. A mismatch is stale evidence, never a
-mechanical verdict about truth or permission; supersession does not delete prior task,
-review, Test, or delivery evidence.
-
-On a fresh session, use the current Change's exact matching contexts and closing Resume
-Note to reconstruct the card. Do not rerun completed Research or infer route from chat
-memory. In `history` mode, distinguish mutable draft edits from superseding accepted
-decision records and keep rejected or abandoned alternatives visible when they explain
-the current boundary.
-
-## Surface risk and installation health
-
-List unmet task dependencies, more than one matching `in_progress` task under the
-single-writer contract, broken `trace_to` or `context_file` paths, stale subject or
-acceptance identities, unresolved task-review findings, and concrete evidence that a
-task can no longer resume reliably. A timestamp, complexity value, file count, or task
-count is context for the model, never a staleness or quality verdict.
-
-Compare the selected host's plugin path, skill inventory, version, provenance, and hook
-manifest with installed files. Recommend `ubp install` or `ubp update` as the repair;
-this read-only Skill never performs it.
-
-## When the owner decides
-
-The owner chooses the next public workflow, risk disposition, and any reinstall.
-Contradictory facts remain visible instead of being resolved by routing heuristics.
-
-## References
-
-- `../ultra-change/references/change-contract.md` — canonical Active Change authority resolution.
-- `references/route-contract.md` — canonical Route Card, checkpoint, continuation, and recovery contract.
-- `../ultra-think/SKILL.md` — read only when contradictory evidence creates one real
-  decision rather than a mechanical repair.
-- `../ultra-think/references/autonomy-boundary.md` — read before recommending a route
-  that would reduce an accepted commitment.

package/skills/ultra-status/references/route-contract.md

@@ -1,100 +0,0 @@
-# Route Contract
-
-This reference defines the owner-visible navigation surface shared by every public
-Ultra Skill. A Route Card is a derived observation from canonical project files, Git,
-and the current run. It is not workflow authority, a stage marker, or permission to
-continue.
-
-## Route Card
-
-Show a compact `UBP Route Card` at entry, at a material checkpoint, when pausing or
-blocked, at the observable exit, and before moving to another public Skill. Keep an
-unchanged field short, but never omit an unresolved decision or unfinished obligation.
-
-| Field | Meaning |
-|---|---|
-| `Route` | The current public Skill, or `idle` when no workflow is active |
-| `Mode` | One mode declared by that Skill |
-| `Why` | The current problem or evidence gap |
-| `Outcome` | The owner-visible result this route is trying to produce |
-| `Accepted boundary` | Accepted scope, exclusions, and authority that cover this run |
-| `Position` | Artifact-derived navigation such as selected reports or remaining tasks |
-| `Exit condition` | Observable evidence or owner decision that ends this mode |
-| `Delta` | Material facts changed since the prior card |
-| `Reality` | Live path, verification state, fakes, limitations, and unknowns |
-| `Decision needed` | One material owner decision, or `none` |
-| `Next` | The smallest covered continuation or one recommended public route |
-| `Not done` | Obligations left at a pause or exit |
-
-`Position` may report exact mechanical observations such as selected lenses with
-reports, dependency-ready tasks, or an ACP session waiting for permission. Never turn a
-count, validator result, finding total, or transport event into semantic progress or a
-numeric completion score.
-
-## Material checkpoints
-
-Stop and obtain the Owner's current decision before any of these changes or effects:
-
-1. a new or reduced North Star, specification, or Change commitment;
-2. a material delta to an active Change outcome, acceptance, non-goal, or public seam;
-3. evidence that materially changes the feasible direction or product boundary;
-4. wider Execution Grant scope, effects, budget, expiry, or Agent/provider topology;
-5. transfer of the canonical writer;
-6. unresolved P0/P1, risk acceptance, or the same root cause surviving three failed fixes;
-7. finalization, archive, commit, push, tag, publication, deployment, real installation,
-   credentials, provider spend, or another external or irreversible effect.
-
-Naming, internal design, ordinary technical choices, task decomposition, covered local
-edits and tests, and non-material evidence reconciliation remain model-owned inside the
-accepted boundary. Do not ask for confirmation when `Decision needed` is `none`.
-
-## Continuation
-
-Public modes belong to one of three invocation classes; model-only disciplines form a
-fourth class:
-
-| Invocation class | Owner entry | Model continuation |
-|---|---:|---:|
-| `explicit-entry` | yes | no |
-| `grant-continuable` | yes | only under a valid Execution Grant covering that mode |
-| `router` | yes | no; the Owner invokes read-only diagnosis explicitly |
-| `model-discipline` | no | only as an internal method of a covered workflow |
-
-Host metadata is only a coarse discovery bit. Before continuing, the Skill itself must
-verify its selected mode, the same active `change_id`, the valid Execution Grant,
-allowed local effects, stop conditions, and any material checkpoint. A coarse Host bit
-never permits an explicit-entry mode. Without a covering grant, stop with a Route Card
-and recommend the exact explicit route; never invoke another public Skill merely because
-its files appear ready.
-
-Within an accepted Change and valid grant, show the Route Card before each public Skill
-transition and continue without a confirmation question only when the next mode and all
-effects are covered. A material checkpoint still pauses. `Next` is either `continue:
-<route>/<mode>` when covered or `recommend: <route>/<mode>` when owner invocation is
-required.
-
-Execution events such as tool calls, plans, usage, permission requests, worker output,
-ACP updates, and process termination are transport observations. They may populate
-`Position`, `Delta`, or `Reality`; they never decide acceptance, task completion, or the
-next semantic route.
-
-## Recovery and degraded diagnosis
-
-On a fresh session or Host, reconstruct the card from the accepted North Star, Project
-Brief, active Change authority, task ledger and matching contexts, decisions, evidence,
-Git, and current installation/runtime observations. Read the closing `## Resume Note`
-for only the current work package. Do not rerun completed Research or create a route
-ledger to remember where the conversation stopped.
-
-If authority is absent, ambiguous, stale, malformed, or temporarily unreadable, stop
-semantic writes but keep read-only diagnosis reachable. Report the exact fact that
-prevents a normal route and the cheapest safe repair, retry, cancel, abandon, or fresh
-session path. Never describe a blocked route as an endless in-progress workflow.
-
-Owner revisions remain recoverable: edit a draft in place, supersede an accepted
-decision with a new owner record, and preserve Git/history. Status may summarize that
-history on request, but no event log becomes a second source of truth.
-
-When context pressure threatens reliable continuation, finish the nearest safe write,
-refresh the canonical context's Resume Note, show a final card, and recommend a fresh
-session. Context size is an observation, not a hard semantic gate.

package/skills/ultra-tdd/SKILL.md

@@ -1,91 +0,0 @@
----
-name: ultra-tdd
-description: Drive one slice of behavior through red then green — a failing test on a confirmed seam, then the smallest code that passes it. Use when another skill is about to write or change behavior and needs the feedback loop that proves the code actually runs, including a small change that goes straight to implementation.
----
-
-# Write one failing test on a seam, then just enough code to pass it
-
-Without feedback from code that actually ran, the work is blind flying. This is
-the loop that supplies it, and it serves Goal 3, Production-Ready.
-
-## Before you start
-
-1. When called from a planned Change, read
-   `../ultra-change/references/change-contract.md` and apply its **Active Change
-   authority resolution** before reading any active `intent.md`, resolving the current
-   `change_id` or task, reading its context, running the baseline, or executing red-green
-   product edits. A stable zero result stops with no current task; any typed diagnostic,
-   including non-unique authority, stops with its repair before the baseline, red-green,
-   or any product write. After one valid authority, read its intent, `.ultra/tasks.json`,
-   and the matching current task context for the seams confirmed during planning. For a
-   micro edit outside the Ultra lifecycle, no active task context is required; use the
-   accepted request, maintained specification, and an existing repository seam, and
-   create no Ultra task or delivery claim.
-2. Run the repository's existing test command once, unchanged, to see what
-   passing currently looks like. Read `references/test-execution.md` before recording
-   that run or any red/green evidence.
-3. Read `CONTEXT.md` for vocabulary — test names carry the domain words.
-
-## Definition of done
-
-- One slice is complete: one seam, one test, one minimal implementation.
-- The test was observed failing before the implementation existed, and observed
-  passing after. Both runs are real command output.
-- The test reads as a specification of behavior through a public interface, and
-  survives replacing the implementation underneath it.
-
-## Seams, and what a good test on one looks like
-
-A seam is a place where behavior can change without editing at that place — the
-module interface. Tests live on seams and never reach for internals. Prefer a
-seam that already exists, take the highest one that works, and one is the ideal
-number. Verify behavior through that public interface: a name like "user can
-checkout with a valid cart" shows at a glance what capability exists, and one
-logical assertion per test keeps it readable.
-
-## Red, then green
-
-Write the failing test first and run it, so that red is observed rather than
-assumed. Then write the smallest code that turns it green. Predict no later
-tests and add no speculative capability. Then take the next slice.
-
-Refactoring is not part of this loop; `ultra-review` owns it when observed duplication,
-coupling, or a boundary defect supplies evidence that restructuring is worthwhile.
-
-## Three patterns that produce tests worth deleting
-
-| Pattern | How you recognize it |
-|---|---|
-| Implementation-coupled | Mocks an internal collaborator, tests a private method, asserts on call counts or ordering, or reaches past the interface into the database. The check: behavior is unchanged after restructuring, yet the test breaks. |
-| Tautological | Recomputes the expected value the same way the implementation does, so it can never fail. Expected values come from an independent source — a known literal, a hand-worked example, the specification. |
-| All tests first | Writing every test before any implementation tests imagined behavior. It captures shape rather than user-visible behavior, is insensitive to real change, and freezes the test structure before the implementation is understood. Take one test, one implementation, and repeat. |
-
-## Mock only at the system boundary
-
-External APIs, time and randomness, sometimes the filesystem. Prefer a real test
-library over mocking the database. Your own classes, modules and internal
-collaborators stay real.
-
-Design for that boundary: inject dependencies, and give each external operation
-its own named function rather than one generic fetcher — mocking then needs no
-conditional logic, and which endpoints a test touches stays visible. When a real
-dependency is the right answer, copy
-`references/templates/testcontainer-postgres.ts` or
-`references/templates/testcontainer-postgres.py`, and
-`references/templates/vertical-slice.ts` for a path that runs end to end.
-
-## When the owner decides
-
-Weakening an assertion, skipping a relevant test, or adjusting an expected value
-to obtain green output crosses the C5 boundary — stop and surface it. A test that
-is genuinely wrong about the specification is a specification question, so it
-goes to the owner as one.
-
-## References
-
-- `../ultra-change/references/change-contract.md` — canonical Active Change authority resolution.
-- `../ultra-think/references/autonomy-boundary.md` — read before replacing a real
-  dependency with a fake, or when a test stands between the work and green.
-- `references/templates/README.md` — read when choosing which enabling template
-  fits the dependency you need to make real.
-- `references/test-execution.md` — exact command, failure and result evidence contract.

package/skills/ultra-tdd/references/templates/README.md

@@ -1,20 +0,0 @@
-# Enabling templates
-
-These runnable examples make the real integration path cheaper than a fake. Read this
-index when `ultra-tdd` reaches a database, feature flag, or multi-layer seam, then copy
-only the smallest relevant file into the project and adapt it to repository conventions.
-
-| Template | When to copy |
-|---|---|
-| [testcontainer-postgres.ts](testcontainer-postgres.ts) | A TypeScript/Node test needs real Postgres instead of an internal Repository mock |
-| [testcontainer-postgres.py](testcontainer-postgres.py) | A pytest test needs real Postgres instead of a `MagicMock` Repository |
-| [vertical-slice.ts](vertical-slice.ts) | One test must prove HTTP → use case → database → response |
-| [persistence-real.ts](persistence-real.ts) | A Repository needs real storage rather than an in-memory `Map` |
-| [feature-flag-default-audit.sh](feature-flag-default-audit.sh) | A Change must surface default-off flags that could hide unfinished work |
-
-The templates travel with the `ultra-tdd` skill; they are rule-side examples, not
-project authority. Do not copy this directory wholesale into `.ultra/`.
-
-Each template must remain runnable after its documented dependencies are installed,
-name the exact verification command in its header, stay short enough to inspect before
-use, and state which Ultra principle makes the example preferable.

package/skills/ultra-tdd/references/templates/feature-flag-default-audit.sh

@@ -1,79 +0,0 @@
-#!/usr/bin/env bash
-# feature-flag-default-audit.sh
-#
-# Surface every `default off` / `enabled: false` / commented-out feature so the
-# user knows what is *quietly* disabled. Catches the "agent shipped task by
-# turning the feature off" failure mode v7 fixes.
-#
-# Usage:
-#   bash feature-flag-default-audit.sh [path]
-#
-# Default path: src/  (override with first arg)
-#
-# PHILOSOPHY: enables C5 (Bounded Autonomy) — default-off without rationale is
-# scope reduction in disguise; this surfaces it so the user can decide.
-
-set -euo pipefail
-
-ROOT="${1:-src}"
-if [ ! -d "$ROOT" ]; then
-  echo "[audit] path not found: $ROOT" >&2
-  exit 1
-fi
-
-echo "## Feature-flag default audit"
-echo "Path: $ROOT"
-echo "Generated: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
-echo ""
-
-# Patterns we care about. Adjust per project conventions.
-patterns=(
-  '\benabled:\s*false\b'
-  '\bdefault\s*[:=]\s*false\b'
-  '\bDISABLED\s*=\s*true\b'
-  '\bif\s*\(\s*false\s*\)'
-  'FEATURE_[A-Z_]+\s*=\s*false'
-)
-
-found_any=0
-for p in "${patterns[@]}"; do
-  hits=$(grep -REn "$p" "$ROOT" \
-    --include='*.ts' --include='*.tsx' \
-    --include='*.js' --include='*.jsx' \
-    --include='*.py' --include='*.go' \
-    --include='*.rs' --include='*.sol' \
-    --include='*.yaml' --include='*.yml' \
-    --include='*.json' --include='*.toml' 2>/dev/null || true)
-
-  if [ -n "$hits" ]; then
-    found_any=1
-    echo "### Pattern: $p"
-    echo '```'
-    echo "$hits"
-    echo '```'
-    echo ""
-  fi
-done
-
-# Also surface TODO-style "off until later" markers
-todo_hits=$(grep -REn '(TODO|FIXME).*(enable|turn on|flip on)' "$ROOT" 2>/dev/null || true)
-if [ -n "$todo_hits" ]; then
-  found_any=1
-  echo "### TODOs to re-enable later"
-  echo '```'
-  echo "$todo_hits"
-  echo '```'
-  echo ""
-fi
-
-if [ "$found_any" -eq 0 ]; then
-  echo "_No default-off features detected._"
-  exit 0
-fi
-
-echo "---"
-echo ""
-echo "**Action**: For each entry above, confirm with the user whether it is:"
-echo "- (A) Pre-launch: feature is built but gated until release — fine"
-echo "- (B) Genuine kill-switch: stays off in normal operation — fine, document why"
-echo "- (C) Hiding incomplete work: agent shipped task by turning it off — **must fix**"

package/skills/ultra-tdd/references/templates/persistence-real.ts

@@ -1,78 +0,0 @@
-/**
- * Real-persistence Repository skeleton (TypeScript)
- *
- * Why this exists: in-memory `Map` Repositories are a v7 anti-pattern. They
- * pass tests, don't survive restart, hide migration bugs, and silently break
- * production. This template shows the minimum real Repository.
- *
- * Required deps:
- *   pnpm add pg
- *   # Optional ORM: drizzle / prisma / kysely
- *
- * PHILOSOPHY: enables C4 progress.json `persistence_real` dimension. Pair with
- * testcontainer-postgres.ts for the test side.
- */
-
-import type { Pool, PoolClient } from 'pg';
-
-// Domain entity — keep separate from row shape
-export type User = {
-  id: number;
-  email: string;
-  createdAt: Date;
-};
-
-// Optional: row→entity mapper if column names differ from field names
-function rowToUser(row: { id: number; email: string; created_at: Date }): User {
-  return { id: row.id, email: row.email, createdAt: row.created_at };
-}
-
-export class UserRepo {
-  constructor(private readonly pool: Pool) {}
-
-  async create(input: { email: string }): Promise<User> {
-    const { rows } = await this.pool.query<{
-      id: number;
-      email: string;
-      created_at: Date;
-    }>(
-      `INSERT INTO users (email) VALUES ($1)
-       RETURNING id, email, created_at`,
-      [input.email],
-    );
-    return rowToUser(rows[0]);
-  }
-
-  async findById(id: number): Promise<User | null> {
-    const { rows } = await this.pool.query<{
-      id: number;
-      email: string;
-      created_at: Date;
-    }>(
-      `SELECT id, email, created_at FROM users WHERE id = $1`,
-      [id],
-    );
-    return rows[0] ? rowToUser(rows[0]) : null;
-  }
-
-  // Multi-statement work — pass in a client to keep it on a single connection
-  async withTransaction<T>(work: (client: PoolClient) => Promise<T>): Promise<T> {
-    const client = await this.pool.connect();
-    try {
-      await client.query('BEGIN');
-      const result = await work(client);
-      await client.query('COMMIT');
-      return result;
-    } catch (e) {
-      await client.query('ROLLBACK');
-      throw e;
-    } finally {
-      client.release();
-    }
-  }
-}
-
-// What this template intentionally does NOT do (and why):
-// - No `Map<number, User>` field. That is the in-memory anti-pattern v7 surfaces.
-// - No silent error swallowing (catch + return-null). Errors propagate; callers handle.
-// - No mock-friendly singleton. Inject the Pool so testcontainers work cleanly.

package/skills/ultra-tdd/references/templates/testcontainer-postgres.py

@@ -1,78 +0,0 @@
-"""
-Testcontainer-Postgres starter (Python / pytest)
-
-Why this exists: Real DB in tests catches migration drift, schema bugs, and
-concurrency issues that mocked Repositories silently miss. Prefer this to
-`MagicMock(spec=Repo)` for any Repository or Service that touches data.
-
-Required deps:
-    pip install testcontainers[postgres] psycopg[binary] pytest
-
-Verify:
-    pytest tests/repo/test_user_repo_testcontainer.py -v
-
-PHILOSOPHY: enables C2 (Enabling > Defensive) — the cheaper path becomes the
-right path, so agents stop reaching for mocks under pressure.
-"""
-
-from __future__ import annotations
-
-import psycopg
-import pytest
-from testcontainers.postgres import PostgresContainer
-
-
-@pytest.fixture(scope="module")
-def pg():
-    """Module-scoped real Postgres. Slow on first pull, fast after."""
-    with PostgresContainer("postgres:16-alpine") as c:
-        with psycopg.connect(c.get_connection_url()) as conn:
-            with conn.cursor() as cur:
-                cur.execute("""
-                    CREATE TABLE users (
-                        id SERIAL PRIMARY KEY,
-                        email TEXT UNIQUE NOT NULL,
-                        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
-                    );
-                """)
-            conn.commit()
-        yield c
-
-
-@pytest.fixture
-def conn(pg):
-    """Per-test connection with truncate-reset so each test is independent."""
-    with psycopg.connect(pg.get_connection_url()) as c:
-        with c.cursor() as cur:
-            cur.execute("TRUNCATE users RESTART IDENTITY CASCADE")
-        c.commit()
-        yield c
-
-
-def make_user_repo(conn):
-    """Replace with import from your real Repository."""
-    class UserRepo:
-        def create(self, email: str) -> dict:
-            with conn.cursor() as cur:
-                cur.execute(
-                    "INSERT INTO users (email) VALUES (%s) RETURNING id, email, created_at",
-                    (email,),
-                )
-                row = cur.fetchone()
-            conn.commit()
-            return {"id": row[0], "email": row[1], "created_at": row[2]}
-
-        def find_by_id(self, user_id: int) -> dict | None:
-            with conn.cursor() as cur:
-                cur.execute("SELECT id, email, created_at FROM users WHERE id = %s", (user_id,))
-                row = cur.fetchone()
-            return None if row is None else {"id": row[0], "email": row[1], "created_at": row[2]}
-
-    return UserRepo()
-
-
-def test_insert_and_fetch_round_trips(conn):
-    repo = make_user_repo(conn)
-    created = repo.create("a@example.com")
-    found = repo.find_by_id(created["id"])
-    assert found == created