fix(mcp): enforce persistence kernel boundary

Cause:
The v0.24 kernel still discarded rejected semantic attempts, exposed misleading state-commit metadata, let retired workflow authority affect current artifacts, and allowed delegated review/debug agents to own source remediation.

Scope:
Persist bounded rejected-attempt audit history outside semantic digests, expose projection-only commit metadata, make the production Change facade single-mode, keep legacy workflow rows read-only, and constrain review/debug agents to evidence artifacts. Release as 0.24.2.

Verification:
npm run verify:release
npm pack --dry-run --json
git diff --cached --check

Residual risk:
The pre-v0.24 Change implementation remains packaged only as an internal compatibility layer for existing state and recovery paths; public tools cannot select it or create new legacy authority.

Rollback:
Revert this commit or reset to backup/v024-five-boundaries-20260731 before publication.

Author: rocky2431

CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.24.2] — 2026-07-31
+
+### Changed
+
+- Made the production Change facade single-mode and Kernel-only. The pre-v0.24
+  Change implementation is explicitly isolated for compatibility, while retired
+  workflow and dialogue rows remain read-only history with no public artifact owner
+  or invalidation writer.
+- Made review and debug agents evidence-only: delegated workers can write only their
+  assigned report, while the primary host owns source remediation and final judgment.
+
+### Fixed
+
+- Preserved rejected semantic calls as bounded `ultra_kernel_attempt` audit history
+  visible through `ultra.context`, without creating the rejected semantic authority.
+- Renamed misleading `_ultra.state_commit` response metadata to
+  `_ultra.projection_commit`; projection processing no longer resembles a semantic
+  acceptance receipt.
+- Removed current Change-packet decisions and artifact invalidation from retired
+  workflow/dialogue tables while retaining safe migration and historical reads.
+
 ## [0.24.1] — 2026-07-31
 
 ### Changed

README.md

@@ -132,6 +132,11 @@ Retired fine-grained operation names are neither discoverable nor callable. Work
 prose stays in Skills, model judgment stays with the host, and SQLite records what
 happened rather than deciding what the model is allowed to think next.
 
+Rejected semantic attempts remain visible as bounded `ultra_kernel_attempt` audit
+diagnostics in the next `ultra.context`; they do not create rejected authority.
+`_ultra.projection_commit` describes only generated-view processing, never semantic
+acceptance. The production Change API has no legacy/current mode switch.
+
 The enforcement gradient is:
 
 ```text
@@ -404,6 +409,11 @@ recommends the next capability from current context and owner intent; SQLite doe
 encode the semantic route. Another public capability starts only after an explicit
 user command or skill invocation.
 
+Review and debug agents are evidence-only workers. They may inspect the assigned
+checkout and write their declared report, but they never edit source or commit
+authority. The primary host evaluates the evidence, applies any repair, and records
+the verified outcome.
+
 ### Command interaction graph
 
 Every solid handoff below means: the current capability returns context and checkpoint

adapters/tests/opencode.test.cjs

@@ -12,7 +12,7 @@ const opencode = require('../opencode.js');
 const { parse: parseFm } = require('../_shared/frontmatter.cjs');
 const { CORE_PUBLIC_SKILLS, skillsForRuntime } = require('../_shared/runtime-assets.cjs');
 const { initStateDb, closeStateDb } = require('../../mcp-server/lib/state-db.cjs');
-const changes = require('../../mcp-server/lib/change-workflow.cjs');
+const changes = require('../../mcp-server/lib/legacy-change-workflow.cjs');
 const { createTask } = require('../../mcp-server/lib/state-ops.cjs');
 const { seedReadyBaseline } = require('../../mcp-server/test-support/ready-baseline.cjs');
 const { completeChangeInput } = require('../../mcp-server/test-support/change-contract.cjs');

agents/code-reviewer.md

@@ -1,7 +1,7 @@
 ---
 name: code-reviewer
 description: Review an explicit diff or file set for consequential correctness, security, integration, test, and maintainability defects. Use for a bounded read-only review before commit, merge, or release.
-tools: Read, Grep, Glob, Bash, Write, Edit
+tools: Read, Grep, Glob, Bash, Write
 model: opus
 maxTurns: 30
 skills:
@@ -34,10 +34,9 @@ evidence. Default to read-only analysis.
 
 ## Mutation boundary
 
-Do not edit during an ordinary review. If the parent explicitly assigns review and
-fix, modify only findings within the accepted scope, preserve unrelated changes, and
-rerun the checks invalidated by each edit. Judgment-heavy or scope-expanding fixes
-return to the primary agent for a decision.
+Do not edit source. Write only the assigned evidence artifact. If remediation is
+authorized, return the smallest verified repair instructions to the primary host,
+which owns implementation and final judgment.
 
 Use the current checkout and parent-supplied packet only. Do not call Ultra MCP write
 tools. Return a concise review, not raw tool output.

agents/debugger.md

@@ -1,7 +1,7 @@
 ---
 name: debugger
-description: Find the earliest incorrect state behind an error, test failure, or unexpected behavior and return a minimal verified fix when implementation is authorized.
-tools: Read, Write, Edit, Bash, Grep, Glob
+description: Find the earliest incorrect state behind an error, test failure, or unexpected behavior and return bounded evidence plus a minimal verified remediation.
+tools: Read, Write, Bash, Grep, Glob
 model: opus
 maxTurns: 40
 ---
@@ -24,14 +24,14 @@ that violates the intended contract.
    distinguishes it from alternatives.
 5. Test the hypothesis without broad refactoring. Record evidence that accepts or
    rejects it.
-6. If implementation is authorized, write a regression test that fails for the
-   observed defect, apply the minimum root-cause fix, and rerun focused and adjacent
-   checks.
-7. Report the symptom, evidence trail, root cause, changed files when any, exact
+6. Describe the smallest regression test and root-cause repair that the primary host
+   should apply. Do not edit source.
+7. Report the symptom, evidence trail, root cause, proposed files, exact diagnostic
    verification, and residual uncertainty.
 
-Do not change code when the assignment is diagnosis-only. Do not use a passing test
-from another checkout as evidence.
+Write only the assigned evidence artifact. Do not change source, even when remediation
+is authorized; the primary host owns implementation and final judgment. Do not use a
+passing test from another checkout as evidence.
 
 If three distinct fix attempts expose different underlying failures, stop patching and
 return the evidence as an architectural boundary problem. For an Ultra incident, also

docs/AGENT-CONTEXT.md

@@ -11,7 +11,7 @@ Ultra owns:
   `ultra-change`, `ultra-plan`, `ultra-dev`, `ultra-test`, `ultra-review`,
   `ultra-deliver`, `ultra-status`, and `ultra-doctor`;
 - four internal worker-rule Skills;
-- bounded review/debug workers;
+- bounded evidence-only review/debug workers;
 - deterministic workflow Hooks;
 - exactly seven public MCP tools;
 - `.ultra` project authority, team sync, recovery, and the portable installer.
@@ -52,6 +52,12 @@ diagnostics and leaves the draft editable. Hard errors are limited to corruption
 unsafe paths, digest/CAS/lease conflicts, missing runtime prerequisites, permissions,
 and irreversible external effects.
 
+A rejected semantic attempt is appended as `ultra_kernel_attempt` audit history and
+appears alongside the next `ultra.context` envelope without changing its semantic
+digest. It never creates the rejected semantic row or claims that authority was
+committed. `_ultra.projection_commit` reports only the post-call generated-view cycle;
+it is not a semantic acceptance receipt.
+
 ## Context Envelope
 
 Every Skill begins by reading `ultra.context` for the relevant stage and scope. The
@@ -121,9 +127,10 @@ The packet binds:
 - exact output path;
 - `packet_digest`.
 
-Workers may inspect and write only the declared output. They do not write SQLite,
-accept checkpoints, modify another worker's result, or decide final delivery. Output
-must echo `packet_digest`; the primary host verifies and records it.
+Workers may inspect the assigned checkout and write only the declared evidence output.
+They do not edit source, write SQLite, accept checkpoints, modify another worker's
+result, or decide final delivery. Output must echo `packet_digest`; the primary host
+verifies it, performs any source repair, and records the resulting evidence.
 
 ## Hook boundary
 
@@ -163,3 +170,8 @@ state.
 
 Every semantic file must have one writer, owner, consumer, digest, promotion gate, and
 archive rule as defined in `ARTIFACT-AUTHORITY.md`.
+
+The production Change API has one Kernel behavior and exposes no legacy/current mode
+switch. Pre-v0.24 workflow and dialogue rows remain read-only migration/audit history:
+the public kernel cannot create workflow-owned artifacts or mutate those rows during
+current invalidation.

docs/ARCHITECTURE.md

@@ -43,7 +43,8 @@ There is no second semantic authority:
 - MCP owns structure validation, idempotency, digests, CAS, leases, safe paths,
   filesystem journals, recovery, and accepted checkpoints.
 - Hooks own deterministic observation and bounded injection only.
-- Agents receive one immutable Worker Packet and write only the declared output.
+- Agents receive one immutable Worker Packet and write only the declared evidence
+  output; the primary host owns every source change and final judgment.
 
 SQLite never chooses the next capability and never requires a fixed sequence of
 reasoning steps. Semantic gaps appear in `diagnostics`, `warnings`, or
@@ -66,9 +67,11 @@ Every host discovers exactly seven tools:
 | `ultra.doctor` | Mechanical diagnosis and backup-first repair |
 
 Retired fine-grained tool names are not registered and return `UNKNOWN_TOOL`. The
-source repository retains migration readers and regression fixtures for old authority,
-but those modules are excluded from the npm distribution and have no live public
-consumer.
+source repository retains migration readers, an explicitly named internal Change
+compatibility implementation, and regression fixtures for old authority. The
+production Change facade exposes one Kernel behavior with no mode flag; retired
+semantic supervisors are excluded from the npm distribution and no public call can
+write their workflow/dialogue authority.
 
 ## Canonical Context Envelope
 
@@ -130,6 +133,20 @@ Every delegated worker receives a digest-bound packet containing the exact Conte
 Envelope, accepted decisions, Git boundary, Task contract, acceptance, evidence
 references, output path, and output schema. The worker must echo `packet_digest`.
 Workers do not write SQLite or accept their own result.
+Review and debug workers do not edit source; their only mutation is the assigned
+evidence artifact, and the primary host applies any accepted remediation.
+
+### Rejected attempts and projection metadata
+
+Semantic diagnostics do not disappear when a caller corrects and retries. A rejected
+public call appends an `ultra_kernel_attempt` event containing the typed operation,
+scope, idempotency key, blockers, and diagnostics without storing raw prompts or
+creating the rejected semantic row. `ultra.context` exposes a bounded recent view of
+that audit history alongside, but outside the digest-bound semantic envelope.
+
+Server metadata uses `_ultra.projection_commit` only for the deterministic
+post-mutation projection job. It must never be interpreted as proof that a semantic
+record, checkpoint, or archive was accepted.
 
 ## `.ultra` storage planes
 
@@ -210,7 +227,9 @@ Contexts, and v0.22/v0.23 database and ledger authority.
 Migration is inspectable, exact-byte backup-first, transactional, and fail-closed on
 conflict. Old workflow and dialogue rows are retained as non-authoritative history;
 current Context, Decisions, Checkpoints, and the team ledger are rebuilt from verified
-facts. No user should edit SQLite or move a legacy file manually to recover.
+facts. Current artifact invalidation may traverse legacy graph edges to reach a live
+Task, but it never rewrites the legacy workflow row. No user should edit SQLite or move
+a legacy file manually to recover.
 
 ## External boundaries
 

docs/STATE-DB-ACCESS-POLICY.md

@@ -40,6 +40,8 @@ It does not grant lifecycle authority: external writers use the published observ
 allowlist, while lifecycle event
 names are emitted only inside the mutation that owns the corresponding state change.
 Consumers must verify mutable rows rather than infer success from an event name.
+Rejected semantic calls are recorded as `ultra_kernel_attempt` observations and shown
+by `ultra.context`; they do not create the rejected row or authorize a transition.
 
 ## 2. Connection discipline
 
@@ -80,7 +82,7 @@ resolve the mount/runtime constraint before retrying.
 | `decision_records` | MCP server through `ultra.record`; normalized accepted intent and applied references are stored, never UI receipts, prompts, or transcripts |
 | `stage_checkpoints` | MCP server through `ultra.checkpoint`; mutable drafts and immutable accepted/superseded revisions, never fixed reasoning steps |
 | `context_envelopes`, `worker_packets` | MCP server through `ultra.context`, `ultra.checkpoint`, and `ultra.session`; exact digest-bound handoff authority |
-| `decision_threads`, `decision_items`, `workflow_runs`, `workflow_steps` | legacy history retained for migration and audit; no current public writer or authorization role |
+| `decision_threads`, `decision_items`, `workflow_runs`, `workflow_steps` | read-only legacy history retained for migration and audit; no current public writer, invalidation mutation, or authorization role |
 | `artifacts`, `artifact_edges` | MCP server through `ultra.record` and checkpoint-owned registration |
 | `context_snapshots`, `spec_learning_candidates`, `trace_links` | MCP server through `ultra.record` and `ultra.checkpoint` |
 | `incidents`, `projection_jobs`, `event_consumers`, `circuit_breaker` | MCP server; backup-first doctor recovery may perform only documented mechanical transitions |
@@ -124,6 +126,11 @@ performs semantic import, publication, or conflict selection.
   than the orchestrator's boot-time WAL detector.
 - **No raw SQL in command md files.** Commands call MCP tools or
   `ultra-tools …` subcommands; the SQL lives in `mcp-server/lib`.
+- **No legacy authority mode switch.** Public Change callers use the single Kernel
+  facade. New workflow-owned artifacts and workflow/dialogue writes are rejected.
+- **No semantic meaning in projection metadata.** `_ultra.projection_commit` means
+  only that the generated-view job was durably enqueued and processed; acceptance is
+  read from the typed tool result and current authority.
 - **No `vacuum` / `wal_checkpoint(TRUNCATE)` from inside a transaction.**
   Maintenance subcommands open their own connection.
 

mcp-server/lib/artifact-registry.cjs

@@ -473,6 +473,13 @@ function invalidateConsumersFromEndpointInTx(db, start, {
     const key = endpointKey(endpoint);
     if (seen.has(key) || excluded.has(key) || key === endpointKey(start)) continue;
     seen.add(key);
+    if (endpoint.type === 'workflow') {
+      // Workflow rows are retained only as pre-v0.24 audit history. Preserve
+      // graph traversal for downstream current authorities, but never rewrite
+      // the historical workflow row or claim that it was invalidated.
+      queue.push(...outgoingEdges(db, endpoint));
+      continue;
+    }
     invalidated.push({ type: endpoint.type, id: endpoint.id });
     if (endpoint.type === 'artifact') {
       const row = db.prepare('SELECT status FROM artifacts WHERE id = ?').get(endpoint.id);
@@ -503,62 +510,6 @@ function invalidateConsumersFromEndpointInTx(db, start, {
         });
       }
     }
-    if (endpoint.type === 'workflow') {
-      const row = db.prepare(
-        'SELECT status, metadata_json, change_id, task_id FROM workflow_runs WHERE id = ?',
-      ).get(endpoint.id);
-      if (row) {
-        const metadata = parseJson(row.metadata_json, {});
-        if (['active', 'blocked', 'ready'].includes(row.status)) {
-          delete metadata.authority_invalidation;
-          metadata.draft_dirty = true;
-          db.prepare(
-            `UPDATE workflow_runs
-             SET status = CASE WHEN status = 'ready' THEN 'active' ELSE status END,
-                 metadata_json = ?,
-                 updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
-             WHERE id = ?`,
-          ).run(JSON.stringify(metadata), endpoint.id);
-          ops.appendEventInTx(db, {
-            type: 'workflow_draft_changed',
-            change_id: row.change_id,
-            task_id: row.task_id,
-            payload: {
-              workflow_id: endpoint.id,
-              source_type: start.type,
-              source_id: start.id,
-              reason,
-            },
-          });
-          queue.push(...outgoingEdges(db, endpoint));
-          continue;
-        }
-        if (metadata.authority_invalidation?.invalidated !== true) {
-          metadata.authority_invalidation = {
-            invalidated: true,
-            source_type: start.type,
-            source_id: start.id,
-            reason,
-            invalidated_at: new Date().toISOString(),
-          };
-          db.prepare(
-            `UPDATE workflow_runs SET metadata_json = ?,
-             updated_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now') WHERE id = ?`,
-          ).run(JSON.stringify(metadata), endpoint.id);
-          ops.appendEventInTx(db, {
-            type: 'workflow_invalidated',
-            change_id: row.change_id,
-            task_id: row.task_id,
-            payload: {
-              workflow_id: endpoint.id,
-              source_type: start.type,
-              source_id: start.id,
-              reason,
-            },
-          });
-        }
-      }
-    }
     queue.push(...outgoingEdges(db, endpoint));
   }
   return invalidated;

mcp-server/lib/artifact-registry.test.cjs

@@ -195,7 +195,7 @@ test('artifact.record replaces edges transactionally and invalidates only exact
   }
 });
 
-test('updating an active draft artifact reopens its workflow instead of self-invalidating it', () => {
+test('updating a legacy workflow-owned artifact never mutates retired workflow history', () => {
   const fx = fixture();
   try {
     fx.db.prepare(
@@ -216,7 +216,7 @@ test('updating an active draft artifact reopens its workflow instead of self-inv
     }, { rootDir: fx.rootDir });
 
     write(fx.rootDir, '.ultra/changes/active/draft/plan.md', '# Plan v2\n');
-    artifacts.recordArtifact(fx.db, {
+    const second = artifacts.recordArtifact(fx.db, {
       id: 'draft-plan',
       owner_type: 'workflow',
       owner_id: 'draft-workflow',
@@ -232,9 +232,10 @@ test('updating an active draft artifact reopens its workflow instead of self-inv
       "SELECT status, metadata_json FROM workflow_runs WHERE id = 'draft-workflow'",
     ).get();
     const metadata = JSON.parse(row.metadata_json);
-    assert.equal(row.status, 'active');
-    assert.equal(metadata.draft_dirty, true);
+    assert.equal(row.status, 'ready');
+    assert.equal(metadata.draft_dirty, undefined);
     assert.equal(metadata.authority_invalidation, undefined);
+    assert.deepEqual(second.invalidated, []);
   } finally {
     cleanup(fx);
   }