ultra-builder-pro-cli 5.0.1 → 6.0.0

package/docs/evals/ultra-5-0-live-acp-conformance.md

@@ -1,93 +0,0 @@
-# Ultra Builder Pro 5.0 live ACP conformance — 2026-08-26
-
-## 结论
-
-本报告把每个 Host 的 ACP 激活结论绑定到自己的真实 provider receipt；一个 Host 的
-结果不能提升另一个 Host。Claude Code、Codex、OpenCode、Kimi Code、Grok Build 与
-ZCode 当前全部为 `PASS`，六个 profile 都可以在对应 executable 存在时选择 ACP。
-
-`PASS` 的共同条件是：stable ACP v1、真实 provider、精确
-`ultra-delegation-result-v1`、只读 isolated worktree、Git unchanged，以及 worker
-进入 terminal state。`end_turn` 本身不是完成证据；它必须和 exact result/diff
-validator 一起成立。
-
-## 方法
-
-命令：
-
-```bash
-node skills/ultra-delegate/scripts/acp-conformance.cjs \
-  --host <host> \
-  --output .ultra/evidence/v50-live-acp-activation/host-<host>.json \
-  --timeout 240
-```
-
-Harness 经过真实 `delegate.cjs`、background worker、`AcpDriver`、exact result
-validator 和 Git-diff validator。Receipt 只保存候选命令、协议/result 状态、事件数量、
-子进程终态及临时 artifact digest；不保存 prompt、provider text、hidden reasoning、
-credential value 或 raw JSON-RPC。临时工作树和 raw artifacts 在计算 digest 后删除。
-
-## Host register
-
-| Host | Candidate | Result | Receipt SHA-256 | Observation |
-|---|---|---|---|---|
-| Claude Code | `npx --yes @agentclientprotocol/claude-agent-acp@0.70.0` | PASS | `9b1d88cbd5e5b66a56e0cf19f34e7f2107f9e4b8fde9d80b9eadcdfc8f4a25e3` | ACP v1, `end_turn`, exact result, clean Git, worker exited |
-| Codex | `npx --yes @agentclientprotocol/codex-acp@1.6.2` | PASS | `e82287609397807fb6968dff104d7f6569499b53c77be6a186aa33939a4c629e` | ACP v1, `end_turn`, exact result, clean Git; adapter was terminated after the logical turn |
-| OpenCode | `opencode acp` | PASS | `3575b148f6feb8c9f1472add705390e6d47b87be080403ec7006b66a29f7873b` | ACP v1, `end_turn`, exact result, clean Git, worker exited |
-| Grok Build | `grok agent stdio` | PASS | `370eeae12d63443188d519825ed8040fd8bba9b27fddb82e499d9cb590f4a33d` | ACP v1, exact result, clean Git; creation-time metadata was bounded and identity-checked before use |
-| Kimi Code | `kimi acp` | PASS | `30d8adec2877f80fadf0b20c3cb7fa6b732dea3598d7484c143f9835770301fe` | ACP v1, `end_turn`, exact result, clean Git, worker exited |
-| ZCode | `zcode-acp --zcode-path <installed-runtime> --no-browser` | PASS | `156080f88ed84a013fb26d93e5138230732d2ef0e2b5b10a7c3deb501d3548e9` | domestic BigModel provider, ACP v1, `end_turn`, exact result, clean Git, worker exited |
-
-## Claude Code
-
-The pinned official adapter completed the real read-only drill. Its profile may select
-ACP when `npx` is executable; `ULTRA_DELEGATE_FORCE_CLI=1` remains recovery.
-
-## Codex
-
-The pinned official adapter completed the real read-only drill. A nonzero adapter exit
-caused by client-owned stdin shutdown remains recorded separately and does not overturn
-an already validated protocol terminal and exact result.
-
-## OpenCode
-
-The native stdio server completed the real read-only drill through `opencode acp`.
-
-## Grok Build
-
-Grok emits bounded creation-time metadata before returning `session/new`. Ultra accepts
-only four metadata update kinds at that point, caps the transient buffer at 32 messages
-and 256 KiB, and validates each buffered session ID after the response. Early content,
-tool traffic, mismatched identity, or overflow remains a typed failure.
-
-## Kimi Code
-
-Kimi 1.49.0 completed an owner-authenticated, read-only ACP provider session and returned
-the exact Ultra result. Its profile may select native `kimi acp` when executable.
-
-## ZCode
-
-Ultra resolves independently installed `zcode-acp` v0.1.0 source commit
-`42fe149d4b501469343c01f23ba3801832306d53`, the digest-bound Ultra compatibility patch
-`174dfd0feafe84320556a84b5ae08b10e44c5515fea4992fd1d58af54cee4e3d`, and installed
-ZCode CLI 0.16.5. The patch answers the new `session/requestRuntimePreferences` request
-that otherwise deadlocks upstream v0.1.0 during `session/create`. Locked Rust tests,
-the 0.16.5 regression, patched fake app-server E2E, release build, installed binary
-digest, exact bridge build marker, and the real provider session all pass.
-
-Authentication uses the Owner's existing domestic BigModel Coding Plan provider at
-`https://open.bigmodel.cn/api/anthropic` with model `GLM-5.2`; it does not use the
-international Z.AI OAuth flow. Credential values are absent from this report and its
-receipt. The transport remains `experimental` because the downstream ZCode app-server
-is not a public stability contract.
-
-## Recovery
-
-- Missing adapter, bridge, candidate identity, protocol version, or evidence returns a
-  typed CLI fallback reason before provider execution. If `session/new` reports
-  `acp_auth_required` before a prompt is sent, Ultra invokes the bounded CLI fallback
-  once; it never retries any other ACP failure.
-- `ULTRA_DELEGATE_FORCE_CLI=1` selects the bounded CLI path explicitly.
-- A failed or stale Host receipt is replaced only by a fresh bounded drill for that Host.
-- Raw receipt bytes remain repository evidence under `.ultra/evidence/`; this packaged
-  report carries their SHA-256 bindings without packaging private provider output.

package/docs/evals/ultra-5-0-route-journeys.md

@@ -1,145 +0,0 @@
-# Ultra 5.0 Route Contract journey 评测 — 2026-08-25
-
-## 结论
-
-本轮以当前 Skill source 和 adapter policy 做静态 journey inspection。九个 public/router
-Skill 已共享一个 Route Contract；Greenfield、existing project、owner revision、early
-value、fresh session、degraded diagnosis 和 grant continuation 都有可达入口、可观察
-exit、material checkpoint 与 next/repair path。
-
-这不是 Host/provider 实跑。它验证的是模型拿到 Skill 后是否拥有一致的导航合同，不证明
-任何特定模型一定会生成高质量 Route Card，也不证明后续 ACP transport 已完成。live
-cross-host journey 留在 `v50-migration-journeys`。
-
-## 判定方法
-
-每个场景检查五个问题：
-
-1. 入口文件能否唯一判断 Route 与 Mode；
-2. Owner 能否看到 Why、Outcome、Accepted boundary、Position、Exit condition、Reality、
-   Decision needed、Next 与 Not done；
-3. 停止是否由 material checkpoint 或可观察 evidence 触发，而非计数器；
-4. 没有授权时是否推荐下一 route，有有效 Execution Grant 时是否只继续 covered mode；
-5. authority 损坏时是否仍有 read-only diagnosis 和最便宜恢复路径。
-
-`PASS` 表示当前 source 明确提供上述行为；它不是对业务语义或 live model output 的自动
-判定。
-
-## J1 — Greenfield baseline
-
-- 起点：无 `.ultra/`，Owner 给出一个原始产品想法。
-- 预期路线：`ultra-init/create` → 推荐 `ultra-research/baseline` → 推荐
-  `ultra-change/intake`。
-- 可观察 exit：Init read-back skeleton 与 raw Project Brief；Research read-back selected
-  reports、accepted North Star、specifications、vocabulary 与 synthesis。
-- material checkpoint：Owner 确认 raw outline；Research 的方向、scope、synthesis 和
-  North Star acceptance。
-- 禁止行为：Init 写 North Star；Research 没有 selected coverage/stop condition；任一
-  Skill 自动打开 Change。
-- source evidence：`skills/ultra-init/SKILL.md`、`skills/ultra-research/SKILL.md`。
-- 结果：`PASS (source inspection)`。
-
-## J2 — Existing project bounded evidence
-
-- 起点：已有 accepted baseline，无 active Change，Owner 提一个新 feature/fix。
-- 预期路线：`ultra-change/intake` → `evidence-needed` →
-  `ultra-research/change-scoped` → 同一 `change_id` 的 `ultra-change/reconcile` →
-  `accepted` → `ultra-plan/decompose`。
-- 可观察 exit：Change 先固定 bounded question 与 named exit evidence；Research 只完成该
-  question；Change 再决定 evidence 是否改变 intent；Plan 只消费 accepted Change。
-- 禁止行为：原始需求先自动进入 Research；Research 打开第二个 Change；Plan 直接打开
-  Research 或自己改变 product contract。
-- source evidence：`skills/ultra-change/SKILL.md`、`skills/ultra-research/SKILL.md`、
-  `skills/ultra-plan/SKILL.md`。
-- 结果：`PASS (source inspection)`。
-
-## J3 — Owner revision、拒绝选项与 history
-
-- 起点：Owner 修改尚未接受的 Change，或推翻一个已接受的 consequential decision。
-- 预期路线：draft 在同一 `intent.md` 内修订；accepted decision 以新的
-  `.ultra/decisions/<id>.md` 和 `supersedes` 保留历史；`ultra-status/history` 可按需解释
-  当前答案、被拒绝选项与旧边界。
-- Decision needed：只保留一个会实质改变 outcome/boundary 的问题；Owner 拒绝当前选项
-  时，Change 保持 draft/evidence-needed 并补证据或新选项，不假装 accepted，不进入 Plan。
-- 禁止行为：覆盖旧 accepted decision、用 event log 代替 authority、因 Owner 没选现有
-  选项就制造默认答案。
-- source evidence：`skills/ultra-change/SKILL.md`、`skills/ultra-status/SKILL.md`、
-  `docs/ARTIFACT-AUTHORITY.md#decisions-and-reductions`。
-- 结果：`PASS (source inspection)`。
-
-## J4 — Earliest observable value
-
-- 起点：accepted/evidenced Change 已进入 Plan。
-- 预期路线：`ultra-plan/decompose` 明确第一个 executable slice 的 real consumer、real
-  data path 与 owner-visible observation，再把 exact task 交给 `ultra-dev/execute`。
-- 产品或 contract evidence gap：返回 `ultra-change/reconcile`，由 Change 决定是否记录
-  bounded Research Disposition。
-- ordinary technical uncertainty：模型解决，或用 bounded spike/tracer task；不重新打开
-  product Research。
-- 禁止行为：先完成整层基础设施、用 task count 代表价值、Plan 直接启动 Research。
-- source evidence：`skills/ultra-plan/SKILL.md`。
-- 结果：`PASS (source inspection)`。
-
-## J5 — Fresh-session recovery
-
-- 起点：对话上下文丢失，但 repository 与 Git 仍在。
-- 预期路线：先读 root/HEAD，再唯一解析 active `change_id`，读取 matching task ledger、
-  context 与 closing Resume Note，然后核对 Brief、North Star、decisions、specs、evidence
-  和 worktree，重新推导 Route Card。
-- 可观察 exit：Owner 能看到当前 boundary、真实 diff/evidence、下一 exact task 或 repair；
-  已完成 Research 不被重跑。
-- context pressure：在最近 safe write 更新 Resume Note，显示 stop card，并建议 fresh
-  session；token/file count 不成为 semantic gate。
-- source evidence：`skills/ultra-status/references/route-contract.md`、
-  `skills/ultra-status/SKILL.md`、`skills/ultra-dev/SKILL.md`。
-- 结果：`PASS (source inspection)`。
-
-## J6 — Degraded authority diagnosis
-
-- 起点：两个 active Change、malformed intent、stale trace 或暂时不可读 authority。
-- 预期路线：`ultra-status/recovery` 停止从 ambiguous Change 做 semantic routing/write，
-  但仍用 typed diagnostic、安全的 Git/directory observations 和未冲突的 canonical files
-  显示原因与 repair/retry/cancel/abandon 路径。
-- 禁止行为：选第一个目录、把“不能写”表达为永久 in-progress、因为 authority 损坏而
-  关闭 Status/Review 的只读诊断。
-- source evidence：`skills/ultra-status/SKILL.md`、
-  `skills/ultra-status/references/route-contract.md`。
-- 结果：`PASS (source inspection)`。
-
-## J7 — Grant-aware continuation
-
-- 起点：同一 accepted Change 有当前有效 Execution Grant，覆盖 Plan、一个 exact Dev task、
-  Test 与 Deliver-reconcile 的 local reversible effects。
-- 预期路线：每次 public transition 先显示 Route Card；Skill 重新核对 Mode、`change_id`、
-  effects、budget 与 stop conditions，再继续 covered mode。
-- 必停点：Change acceptance/reduction、primary transfer、unresolved P0/P1、Deliver
-  finalization/archive，以及任何 commit/push/publish/deploy/provider spend。
-- 无 grant：同一路径在当前 Skill exit 停止，并把 `Next` 表达为 recommendation。
-- 禁止行为：Host implicit bit 授权 Change intake/acceptance 或 Deliver finalization；grant
-  自动扩展 scope；Route Card 自己成为 permission。
-- source evidence：`adapters/_shared/runtime-assets.cjs`、九个 public/router Skills、
-  `skills/ultra-status/references/route-contract.md`。
-- 结果：`PASS (source inspection)`。
-
-## J8 — Delegation event versus semantic route
-
-- 起点：Owner 显式授权一个 bounded task/research/aggregate worker slice。
-- 预期路线：`ultra-delegate` launch 前显示 primary Route Card；运行时 permission、tool、
-  plan、usage、process 或 ACP update 只进入 Position/Delta/Reality；terminal result 经验证
-  后回到原 primary Skill，由 primary writer 解释和集成。
-- 禁止行为：worker event 写 canonical `.ultra`、terminal `finished` 自动完成 task、
-  delegation 升级为 primary transfer。
-- source evidence：`skills/ultra-delegate/SKILL.md`、Route Contract。
-- 结果：`PASS (source inspection; ACP driver not implemented in this task)`。
-
-## Route Contract 冻结时本轮未证明
-
-- 尚未在六个真实 Host 上比较同一 fixture 的 Route Card 质量。
-- 本次 Route Contract inspection 没有证明 ACP v1 driver、CLI fallback、Skill-local
-  runner 或 ZCode bridge；这些能力必须由各自后续任务提供独立 evidence。
-- 尚未执行 3.x byte-preservation migration journey。
-- 尚未完成 5.0 package/release verification。
-
-这些缺口分别路由到 `v50-acp-execution-drivers`、`v50-skill-local-delegation`、
-`v50-migration-journeys` 与 `v50-release-candidate`，不会被本次 source inspection
-冒充为通过。

package/docs/evals/zcode-automation-2026-08-14.md

@@ -1,103 +0,0 @@
-# ZCode 自动编码与双向委派实测 — 2026-08-14
-
-## 结论
-
-当前实现已经证明两条不同的 live path：ZCode 可以作为第六个目标 Host 被 Ultra
-委派，也可以作为发起 Host 调用另一个 CLI；在 owner 明确激活的 Change-scoped
-Autonomy Envelope 内，它还可以在同一会话连续完成 Plan、Dev/TDD 和 Test，而不需要
-daemon、数据库、MCP 或语义状态机。
-
-这不是无限授权。实测 envelope 只覆盖一个任务、零次委派、零 external effects，并在
-through-test stop condition 后停止；Deliver finalization、archive、commit、push、publish
-和 deploy 都没有获得授权，也没有发生。
-
-## ZCode 原生插件
-
-- ZCode CLI: `0.16.3`
-- Managed plugin: `ultra-builder-pro@inline`
-- Native inventory: 14 Skills、5 Hooks、0 Commands、0 MCP
-- Activation: managed local marketplace 加 owner-configured `plugins.dirs` entry
-- Hook bridge: `hooks/adapters/zcode.py`
-
-安装后 `zcode plugins list` 报告插件 enabled，并能枚举全部十四个 qualified Skills。
-一次真实 no-op Bash tool call 在修复 hook transport 后以 exit 0 完成；无动作 adapter
-现在不再把 `{}` 发送给 ZCode 的 strict hook parser，而是保持 stdout 为空。
-
-## 同会话自动编码
-
-- Fixture: `/tmp/ubp-zcode-autonomy-20260814`
-- Seed HEAD: `7292d7654d228ac3dc7f9b07b2e28d226c6f6104`
-- Change: `C-AUTO`
-- Task: `T-AUTO-1`
-- ZCode session: `sess_49caffcb-1d8e-44be-825d-ec607d21b1e3`
-- Envelope: through-test、max tasks 1、max repairs 2、review budgets 1 each、delegations 0
-
-ZCode 读取 accepted intent 和 exact North Star revision 后完成：
-
-1. 写入一个 tracer-bullet task，并生成 Plan review；
-2. 通过 public seam 写出可发现的 failing test，再做最小实现修复；
-3. 生成 task review 和六维 evidence；
-4. 运行 whole-change Test、真实 consumer E2E 和 aggregate review；
-5. 写入 fresh `.ultra/test-report.json`，然后按 envelope 停止。
-
-独立复核命令 `npm test` exit 0，3 tests、3 pass、0 skipped。三份
-`SUMMARY.json` 都通过当前 `review_wait.py` 校验：Plan 为 APPROVE/0 findings，Task 和
-aggregate Change 均为 APPROVE/1 P3。Test 报告保留两个 P3 residual risk：finite-number
-合同缺少非整数例子，以及作为 library 的 export 没有仓内非测试 consumer。
-
-原会话第一次在所有产品工作完成后，因 no-op hook 把 `{}` 写到 stdout 而在最后一个
-benign Bash 验证上 exit 1。修复 adapter 并重装插件后，先独立复现该 Bash 为 exit 0，
-再 resume 同一个 session 做只读终检；resume exit 0，HEAD 仍是 seed commit，未生成
-commit。这条失败没有被隐藏，它直接产生了当前 hook 修复。
-
-## ZCode 作为目标 Host
-
-对抗性 fixture seed HEAD 为 `37c07dc8596cda64a93aac260917b3c091ad1b58`。一次
-`--to zcode` 的 read-only delegation 通过 instruction、permission、output-schema
-digest、空 diff 和 terminal-result 校验，并找到五类 hidden seed。terminal result
-SHA-256 为：
-
-`f9409cdd62a5e41a5b183cbed155e25e097ec9a27d0d0bfae0f9e74d87468956`
-
-语义评测与 six-lens 决定见 `docs/evals/adversarial-review-2026-08-14.md`。
-
-随后又专门验证了当前 macOS 上 `zcode` 不在 `PATH` 的默认路径。未设置
-`UBP_DELEGATE_ZCODE_BIN`，共享 profile 自动选择
-`/Applications/ZCode.app/Contents/Resources/glm/zcode.cjs`。第一次调用真实完成审查但
-省略 `$schema`；原因是共享 prompt 先要求该字段、随后列举“exact fields”时又漏掉它。
-launcher 按设计发布 `failed/missing_result`，没有把不合约输出算作成功。补上 prompt
-contract 回归并重新安装后，以新 delegation id 再跑：
-
-- Delegation id: `spec-zcode-default-fallback-2`
-- ZCode session: `sess_a985dc31-0eb5-4521-988d-97e92bee2c9a`
-- Selected command: `/Applications/ZCode.app/Contents/Resources/glm/zcode.cjs`
-- Override: absent
-- Result: `finished`、5 findings、empty diff、exit 0、stderr 为空
-- Result SHA-256: `71d973723b9317fe2ad31d3216a4f65e933d8ac18a8275244c94b84623dae852`
-
-这把“ZCode 可以作为 target”从手工 binary override 提升为当前安装形态下的默认真实
-路径，并同时验证了不合约结果的可恢复失败路径。
-
-## ZCode 作为发起 Host
-
-同一 fixture 上，ZCode session `sess_3ba3e9b2-6e3a-492d-876e-5e1a5e817d77`
-执行 `ubp delegate run --to claude`，等待 terminal artifact，再读取并汇报结果。Claude
-worker 只读定位到 `timeout-after-charge` 后无幂等键重试造成重复扣款的缺陷；worktree
-保持空 diff，result status 为 `finished`，exit code 0。
-
-- Delegation id: `zcode-to-claude-2`
-- Result SHA-256: `f2a9d9d88def969a0dc52ce494f0226e4c0f17f48c049c301e01241d449890da`
-- Instruction digest: `0d4a958db8c903eb6f5da6b8a6e6932a67398ad520424b32c8e4f83972618dd4`
-- Permission digest: `96f7f8ed4ddb77e4569519d8d20d2e29595c74a06b119d0dee8f3a7dd2cb`
-- Schema digest: `723230a485136ef52d0ef6f6fcbe804fc9b13544a11b93aefb2a75fe7ce3887d`
-
-这证明的是 ZCode→Ultra launcher→Claude 的真实 source path，不只是“ZCode 能被别的
-Host 调用”。第一次尝试也如实暴露了隔离 `HOME` 隐藏 Claude 登录的问题；第二次仅把
-已授权的真实 `HOME` 交给 nested launcher，未复制或打印任何凭据。
-
-## 六目标 Host 当前边界
-
-Claude、Codex、OpenCode、Kimi 和 ZCode 均完成了 schema-valid read-only target run。
-Grok Build 1.0.3 多轮 exit 0 但 terminal output 截断或畸形，launcher 正确发布
-`failed/missing_result`；其 partial text 不计入 findings。这个残余是当前 Grok 输出
-conformance ceiling，不能通过放松 result contract 来伪造成成功。

package/hooks/README.md

@@ -1,52 +0,0 @@
-# Ultra Builder Pro hooks
-
-Ultra ships five small file-first hooks. Every hook first looks for a `.ultra/`
-directory and exits silently when the workflow is not active.
-
-| Hook | Lifecycle | Purpose |
-|---|---|---|
-| `session_context.py` | Session start | Inject the accepted North Star or Project Brief fallback, plus acceptance from the unique active Change's current task |
-| `mid_workflow_recall.py` | Before source reads or edits | Restate acceptance only for a task matching the unique active `change_id` |
-| `compact_context.py` | Before/after compaction | Save and restore a disposable snapshot derived from files and Git |
-| `post_edit_guard.py` | After edits | Record mechanical evidence observations without deciding completion |
-| `block_dangerous_commands.py` | Before shell execution | Advise on additive protected-branch publication; block history rewrites and a narrow destructive set until the exact command is owner-authorized |
-
-`_common.py` is a shared library, not a lifecycle registration. Compact snapshots and
-progress observations live under ignored `.ultra/.runtime/` or `.ultra/progress/`; the
-canonical semantic facts remain the owner-readable files and Git.
-Legacy task rows with no `change_id` remain readable from an active-path `change_ref`
-during migration; a present canonical `change_id` always wins, and archived or
-abandoned paths are never revived as current work. `.ultra/tasks.json` is the sole
-task-status authority. A legacy context Status or Complexity header is emitted only as
-a migration diagnostic and never overrides the row. Task selection uses only the
-unique `in_progress` row of the active Change; a `pending` row is a frontier
-candidate that Hooks never activate, inject, or attribute edits to. When no task is
-live, the task-aware Hooks stay task-silent and progress-silent, and only read-only
-Status may report frontier candidates. A trusted exact-task invocation is
-invocation-local — it must mechanically match the ledger and is never persisted as a
-selector. The `.ultra/changes/active` directory chain and each active Change directory
-must be stable ordinary non-symlink directories; each `intent.md` must be a stable,
-readable regular file. More than one `in_progress` row emits the conflicting task ids
-and an exact repair while every task Hook remains task-silent. Task ids are globally
-unique, dependency ids are unique per row, and every
-dependency must resolve inside the same Change without self-edges or cycles. A malformed
-surface or graph emits an exact repair diagnostic while task content stays silent. Git
-or trace-source observation failures remain advisory typed diagnostics with a rendered
-repair and retry path; they never discard canonical Acceptance Criteria or the Resume
-Note. SessionStart retains both typed Acceptance and Resume Note content for the
-selected task, and every Resume injection carries the navigational limitation: a
-Resume Note cannot override owner authority, approved scope/budget, task acceptance,
-or a validated Review verdict, and it never reopens a review that already returned a
-current verdict. Hooks never launch, select, schedule, or recommend automatic
-invocation of `ultra-review` or any public workflow; routing belongs to the owner and
-the host model.
-Hook and validator observations never mark a task completed or supply a semantic
-acceptance disposition.
-
-Claude Code runs the hooks directly. Codex, Kimi Code, Grok Build, and ZCode use the small
-wire adapters under `hooks/adapters/`. OpenCode calls the same scripts from its native
-JavaScript plugin. A hook failure is advisory except for the explicitly classified
-destructive effects in `block_dangerous_commands.py`, whose denial includes a reachable
-SHA-256-scoped authorization path. Additive protected-branch publication stays advisory
-because portable hooks cannot consume every host's trusted owner-approval receipt;
-history rewrites and branch deletion remain guarded.