release: ship Ultra Builder Pro 0.7.0

The initial Ultra delivery flow had no authoritative lifecycle for daily fixes,
features, redesigns, or incidents after baseline completion. Task projections
could diverge from state.db, projection failures were under-observed, recovery
was incomplete, and internal memory/graph and command-proxy surfaces violated
the intended plugin boundary.

This release closes those gaps in one coherent runtime contract:

1. Add ultra-change and ultra-doctor across Claude Code, OpenCode, and Codex,
   backed by seven change.* MCP tools plus system.doctor.
2. Advance state.db to schema 9.0 with authoritative changes, artifacts,
   context snapshots, trace links, incidents, projection jobs, and durable
   consumer cursors; initialize it during task.init_project.
3. Commit MCP mutations before durable projection dispatch, expose projection
   metadata, repair stale claims, persist incidents, and add backup-first
   doctor recovery and convergence/archive gates.
4. Wire spec-staleness consumption and projection processing into the live
   orchestrator, and update hooks to surface initialized baselines, active
   changes, incidents, and protected task projections.
5. Keep memory and code-graph content in external providers only; Ultra stores
   strict provider metadata references and removes its internal graph watcher.
6. Remove the retired command-proxy detector and every related installer,
   handbook, cache, prompt, configuration, dependency, test, and documentation
   surface. Remove the retired fourth-runtime advisor surface from active
   package content and prompts.
7. Align all three native plugin bundles, public workflows, commands, agents,
   MCP specs, handbooks, package contents, and release documentation on the
   same explicit Ultra-owned asset allowlist.

Verification:
- npm run verify:release: state/MCP 201/201, orchestrator 92/92,
  remaining suites 118/118, hooks 13/13, all seven spec validation groups,
  npm audit with zero vulnerabilities, and fresh packed-consumer smoke tests.
- node --test tests/conformance/codex/smoke.test.cjs: 10/10, including missing
  and retired hook-cache recovery across successful and failed refreshes.
- npm pack --dry-run --json: 211 files, 0 forbidden retired artifacts.
- Official Codex plugin validator: passed for the installed 0.7.0 plugin.
- Source and filename audit: zero active RTK or Gemini matches.

Intentional boundaries and recovery:
- External memory and graph providers are not migrated or modified by this
  package; only their metadata references participate in change context.
- The archived pre-CLI manual remains repository history but is excluded from
  the npm tarball.
- Existing v0.6.0 tags and local cleanup backups remain available for rollback.

Author: rocky2431

.gitignore

@@ -25,8 +25,6 @@ Temporary Items
 *.swo
 
 # ===== Local tool state =====
-# RTK (Rust Token Killer) per-project filter cache — local preference, not repo state
-.rtk/
 
 # ===== Backup Files =====
 *.backup

.ultra-template/changes/active/.gitkeep

@@ -0,0 +1 @@
+

.ultra-template/changes/archive/.gitkeep

@@ -0,0 +1 @@
+

CHANGELOG.md

@@ -7,6 +7,58 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.7.0] — 2026-07-17
+
+### Added
+
+- Added `ultra-change` and `ultra-doctor` as native workflows on Claude Code,
+  OpenCode, and Codex. Daily fixes, features, redesigns, and incidents now stay
+  attached to an explicit change packet after the initial baseline delivery.
+- Added seven `change.*` MCP tools and `system.doctor`, advancing the live MCP
+  contract to 29 tools and `.ultra/state.db` to schema `9.0` with 15 tables for
+  changes, artifacts, context snapshots, trace links, incidents, projection
+  jobs, and durable event-consumer cursors.
+- Added deterministic convergence and archive gates for task completion, spec
+  deltas, tests, documentation impact, review evidence, context freshness, and
+  baseline reconciliation.
+
+### Changed
+
+- `task.init_project` now initializes `state.db` immediately and creates active
+  and archived change roots. `tasks.json` remains a generated projection.
+- MCP mutations now commit authority first, enqueue a durable projection job,
+  process it, and expose projection status in MCP metadata instead of silently
+  swallowing projection failures.
+- Session-start and edit hooks now understand initialized baselines and active
+  changes. Health checks surface incidents, projection lag, orphan sessions,
+  and missing change artifacts; direct writes to the task projection remain
+  blocked even outside a command-scoped workflow.
+- Memory and code-graph content are exclusively owned by separately installed
+  providers. Ultra accepts only provider metadata references in compiled change
+  contexts and never stores recalled content, graph payloads, or embeddings.
+
+### Fixed
+
+- Wired spec-staleness consumption, crash recovery, projection processing, and
+  durable cursors into the real orchestrator loop instead of leaving production
+  helpers unconsumed.
+- Kept `intent.md` synchronized with authoritative change updates, linked task
+  status events to their newly assigned change, and included `plan.export`
+  events in projection accounting.
+- Added atomic projection claims and backup-first recovery for failed or stale
+  interrupted jobs so a crashed projector cannot remain invisibly `running`.
+- Kept all three native plugin bundles, MCP launchers, agents, hooks, commands,
+  and user-handbook renderings on one explicit Ultra-owned asset allowlist.
+
+### Removed
+
+- Removed the internal filesystem graph watcher and its dependency; external
+  graph providers own indexing and refresh.
+- Removed the retired command-proxy detector, installer option, managed handbook
+  block, cache artifacts, prompts, configuration, and documentation surface.
+- Stopped publishing the archived pre-CLI manual in the npm package; it remains
+  repository history and cannot be mistaken for an active plugin contract.
+
 ## [0.6.0] — 2026-07-17
 
 ### Changed
@@ -21,9 +73,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Removed
 
-- Removed the Gemini CLI adapter, `--gemini` installer surface, extension and
-  conformance packaging, pricing entries, `gemini-collab`, and all active Ultra
-  prompts and documentation that offered Gemini as an advisor or runtime.
+- Removed the retired fourth-runtime adapter, installer surface, extension and
+  conformance packaging, pricing entries, collaboration companion, and all
+  active Ultra prompts and documentation that offered it as an advisor.
 
 ### Fixed
 
@@ -189,8 +241,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - D49 tech-debt sweep: stale Phase comments (`"scheduled for Phase 1"`,
   `"not implemented in Phase 3.1"`) replaced with accurate `unknown verb`
-  messages; `docs/ROADMAP.md` status table synchronized; `.gitignore`
-  excludes `.rtk/` local filter cache.
+  messages; `docs/ROADMAP.md` status table synchronized.
 
 ### Tests
 
@@ -201,13 +252,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- **Phase 6 — monitoring + live code graph** (D44): RTK soft-dependency hook
-  (`adapters/_shared/rtk-detect.cjs`) with `--skip-rtk` flag and install hint;
-  token / cost telemetry with per-runtime pricing table, `telemetry` table +
+- **Phase 6 — monitoring + live code graph** (D44): token / cost telemetry
+  with per-runtime pricing table, `telemetry` table +
   daily `.ultra/telemetry/YYYY-MM-DD.jsonl`; `ultra-tools status --cost`
   panel with by-runtime / by-task / by-session aggregation; chokidar-based
-  code-graph watcher with debounce / awaitWriteFinish / batch thresholds,
-  opt-in via `--with-graph-watcher`.
+  then-experimental incremental graph watcher with debounce and batch thresholds.
 - **Phase 5 — execution resilience** (D43): `recovery.cjs` boot-time orphan
   scan using live PID probe; `circuit_breaker` table with `recordTaskFailure`
   counter and `resetCircuitBreaker` escape hatch; spec-change staleness
@@ -257,7 +306,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   skill manifest, CLI protocol + mapping table; 5 spec validators.
 - **Phase 0 — skeleton**: multi-runtime installer scaffolding.
 
-[Unreleased]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.5.3...HEAD
+[Unreleased]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.7.0...HEAD
+[0.7.0]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.6.0...v0.7.0
+[0.6.0]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.5.3...v0.6.0
 [0.5.3]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.5.2...v0.5.3
 [0.5.2]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.5.1...v0.5.2
 [0.5.1]: https://github.com/rocky2431/ultra-builder-pro-cli/compare/v0.5.0...v0.5.1

CLAUDE.md

@@ -301,7 +301,6 @@ Strong success criteria enable independent loops; weak criteria force clarificat
 **Completeness Principle**: KISS decides WHAT to build; Completeness decides HOW THOROUGH. Once committed to building a feature → tests, error handling, edge cases must be complete. Marginal cost is near-zero with AI; no half-finished features.
 </ask_user_format>
 
-@RTK.md
 # graphify
 - **graphify** (`~/.claude/skills/graphify/SKILL.md`) - any input to knowledge graph. Trigger: `/graphify`
 When the user types `/graphify`, invoke the Skill tool with `skill: "graphify"` before doing anything else.

README.md

@@ -8,7 +8,7 @@ authoritative `.ultra/state.db`.
 
 <div align="center">
 
-[![Version](https://img.shields.io/badge/version-0.6.0-blue)](./CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-0.7.0-blue)](./CHANGELOG.md)
 [![Tests](https://img.shields.io/badge/tests-passing-brightgreen)](#verification)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green)](./LICENSE)
 [![Node](https://img.shields.io/badge/node-%E2%89%A522-informational)](./package.json)
@@ -25,16 +25,21 @@ authoritative `.ultra/state.db`.
   Codex receive their own command/skill, agent, hook, and MCP representation.
   Install and uninstall are symmetric on every supported host.
 - **Shares state across runtimes.** `.ultra/state.db` (SQLite + WAL) is the
-  authoritative source for tasks, sessions, events, and telemetry. `tasks.json`
-  and context markdown are generated projections, not handwritten.
+  authoritative source for changes, tasks, sessions, events, incidents,
+  projection jobs, and telemetry. `tasks.json` and context markdown are
+  generated projections, not handwritten.
 - **Keeps memory ownership explicit.** Ultra Builder Pro does not collect
   prompts, transcripts, observations, summaries, or cross-session memory.
   Install cloud-mem/claude-mem separately if persistent memory is wanted.
 - **Runs real PRDs end-to-end.** `task.parse_prd` → `lib/topo.cjs` waves →
   `.ultra/execution-plan.json` → parallel worktree sessions → auto-merge back.
-- **Observes without overhead.** Per-task / per-session / per-runtime token
-  and cost telemetry; live code-review-graph watcher on file save;
-  subscribe-events cursor for real-time dashboards.
+- **Keeps daily work convergent.** `/ultra-change` creates a bounded delta and
+  context manifest; `/ultra-deliver` requires docs/test/review evidence and
+  baseline reconciliation before archive. `/ultra-doctor` reports incidents,
+  projection lag, orphan sessions, and backup-first mechanical recovery.
+- **Keeps external context external.** Memory and code-graph providers retain
+  their own content; Ultra stores only provider/project/revision/status metadata
+  references in a compiled change context.
 
 ## Quickstart
 
@@ -57,7 +62,7 @@ npx ultra-builder-pro-cli --all --local --uninstall
 After install, start a new host session/task and point it at the project.
 Claude Code and OpenCode expose native command forms. Codex exposes the same workflows as namespaced plugin
 skills such as `$ultra-builder-pro:ultra-init`, `$ultra-builder-pro:ultra-plan`,
-and `$ultra-builder-pro:ultra-dev`; `command-map.json` records the nine legacy
+and `$ultra-builder-pro:ultra-dev`; `command-map.json` records the eleven legacy
 command mappings (`ultra-review` remains a directly invocable skill).
 See [`docs/RUNTIME-COMPAT-MATRIX.md`](./docs/RUNTIME-COMPAT-MATRIX.md)
 for per-runtime capabilities.
@@ -68,16 +73,17 @@ for per-runtime capabilities.
 |-------|---------|----------------|
 | **skill** (`skills/ultra-*/`) | Knowledge — prompts, workflows, prose | Runtime's native skill/prompt loader picks them up after install |
 | **MCP** (`mcp-server/`) | Authoritative state — reads/writes `.ultra/state.db` via stdio JSON-RPC | Primary path for task / session / event / plan operations |
-| **CLI** (`ultra-tools`, `bin/*`) | Shell fallback for CI and non-MCP contexts | `ultra-tools task init-project`, `ubp-orchestrator run`, `ultra-tools status --cost` |
+| **CLI** (`ultra-tools`, `bin/*`) | Selected initialization, recovery, diagnostics, and orchestration surfaces | `ultra-tools task init-project`, `ultra-tools system doctor`, `ubp-orchestrator run` |
 
-The three layers share one `.ultra/state.db`. See
+The layers share one `.ultra/state.db`, but the CLI is not a mirror of every MCP
+tool: continuous change mutations are MCP-only and fail closed. See
 [`docs/ARCHITECTURE.md`](./docs/ARCHITECTURE.md) for the full contract and
-[`spec/cli-protocol.md`](./spec/cli-protocol.md) for the 21 live contracts.
+[`spec/cli-protocol.md`](./spec/cli-protocol.md) for the 29 live contracts.
 Review, impact discovery, skill resolution, and user interaction stay on each
 Host's native surfaces; the generated Codex capability map documents those
 replacements without advertising non-existent MCP tools.
 
-The package boundary is deliberate: ten public Ultra workflow skills, four
+The package boundary is deliberate: twelve public Ultra workflow skills, four
 internal review-rule skills, and host-specific collaboration companions. Browser,
 deployment, skill-discovery, and framework guidance belong to their original plugins.
 
@@ -99,30 +105,33 @@ Full details in [`docs/RUNTIME-COMPAT-MATRIX.md`](./docs/RUNTIME-COMPAT-MATRIX.m
 ## Typical workflow
 
 ```bash
-# 1. Initialize a project (writes .ultra/ skeleton; state.db stays lazy)
+# 1. Initialize a project (writes .ultra/ skeleton and initializes state.db)
 ultra-tools task init-project --name myapp
 
 # 2. Turn a PRD into a task graph + execution plan (human-gate via dry-run)
 #    (invoked by /ultra-plan skill or via MCP task.parse_prd + plan.export)
 
 # 3. Run the plan — parallel sessions, auto-merge back to main on success
-ubp-orchestrator run --with-graph-watcher
+ubp-orchestrator run
 
-# 4. Monitor cost and progress
+# 4. Monitor cost, progress, and runtime health
 ultra-tools status
 ultra-tools status --cost --since 24h
 ultra-tools session list --json
+ultra-tools system doctor
 ```
 
 Or let the skills drive it. In Codex, invoke
 `$ultra-builder-pro:ultra-plan` → `$ultra-builder-pro:ultra-dev` →
-`$ultra-builder-pro:ultra-status`; other runtimes retain their native command form.
+`$ultra-builder-pro:ultra-status`; after the baseline is delivered, daily work
+starts with `$ultra-builder-pro:ultra-change`. Other runtimes retain their
+native command form.
 
 ## CLI surface
 
 | Binary | Purpose |
 |--------|---------|
-| `ultra-builder-pro-cli` / `ubp` | Installer — `--claude / --opencode / --codex / --all`, `--local / --global`, `--uninstall`, `--skip-rtk` |
+| `ultra-builder-pro-cli` / `ubp` | Installer — `--claude / --opencode / --codex / --all`, `--local / --global`, `--uninstall` |
 | `ubp-orchestrator` | Session dispatch daemon — `run`, `start`, `stop`, `status` |
 | `ultra-tools` | State-layer CLI — `task`, `session`, `status`, `db`, `migrate`; explicit `legacy-memory` archive/prune migration |
 | `ubp-handbook` | Preview/apply the managed Ultra contract in `CLAUDE.md` / `AGENTS.md`, with backup |
@@ -169,15 +178,14 @@ Individual suites: `test:state`, `test:orch`, `test:spec`, `test:rest`.
 
 | Doc | What's in it |
 |-----|--------------|
-| [`docs/PLAN.zh-CN.md`](./docs/PLAN.zh-CN.md) | Authoritative 12-phase execution plan (zh-CN) — decisions, risks, timeline |
+| [`docs/PLAN.zh-CN.md`](./docs/PLAN.zh-CN.md) | Historical 12-phase plan and decision log with a current-boundary overlay |
 | [`docs/ROADMAP.md`](./docs/ROADMAP.md) | One-page English roadmap + phase status |
 | [`docs/ARCHITECTURE.md`](./docs/ARCHITECTURE.md) | Single-page system architecture |
 | [`docs/AGENT-CONTEXT.md`](./docs/AGENT-CONTEXT.md) | Canonical runtime context contract |
 | [`docs/USER-HANDBOOK-CONTRACT.md`](./docs/USER-HANDBOOK-CONTRACT.md) | Shared user-handbook policy and host renderings |
 | [`docs/RUNTIME-COMPAT-MATRIX.md`](./docs/RUNTIME-COMPAT-MATRIX.md) | Per-runtime capability matrix |
 | [`docs/STATE-DB-ACCESS-POLICY.md`](./docs/STATE-DB-ACCESS-POLICY.md) | Multi-process write contract |
 | [`docs/COMMIT-HASH-BACKFILL.md`](./docs/COMMIT-HASH-BACKFILL.md) | Two-commit task-completion flow |
-| [`docs/LEGACY-HERMES.md`](./docs/LEGACY-HERMES.md) | Archived pre-CLI "Hermes 6.6" documentation |
 | [`CHANGELOG.md`](./CHANGELOG.md) | v0.1 → current release notes |
 
 ## License

adapters/_shared/handbook.cjs

@@ -14,21 +14,21 @@ const HOSTS = Object.freeze({
   claude: Object.freeze({
     name: 'Claude Code',
     handbook: ['.claude', 'CLAUDE.md'],
-    invocation: '`/ultra-init`, `/ultra-research`, `/ultra-plan`, `/ultra-dev`, `/ultra-test`, `/ultra-review`, and `/ultra-deliver`; diagnostics use `/ultra-status` and `/ultra-think`',
+    invocation: '`/ultra-init`, `/ultra-research`, `/ultra-plan`, `/ultra-change`, `/ultra-dev`, `/ultra-test`, `/ultra-review`, and `/ultra-deliver`; diagnostics use `/ultra-status`, `/ultra-think`, and `/ultra-doctor`',
     collaboration: '`/codex-collab` is an explicitly requested read-only advisor',
     coordination: 'Claude Code task UI is host coordination; it does not replace Ultra task state',
   }),
   codex: Object.freeze({
     name: 'Codex',
     handbook: ['.codex', 'AGENTS.md'],
-    invocation: '`$ultra-builder-pro:ultra-init`, `$ultra-builder-pro:ultra-research`, `$ultra-builder-pro:ultra-plan`, `$ultra-builder-pro:ultra-dev`, `$ultra-builder-pro:ultra-test`, `$ultra-builder-pro:ultra-review`, and `$ultra-builder-pro:ultra-deliver`; diagnostics use `$ultra-builder-pro:ultra-status` and `$ultra-builder-pro:ultra-think`',
+    invocation: '`$ultra-builder-pro:ultra-init`, `$ultra-builder-pro:ultra-research`, `$ultra-builder-pro:ultra-plan`, `$ultra-builder-pro:ultra-change`, `$ultra-builder-pro:ultra-dev`, `$ultra-builder-pro:ultra-test`, `$ultra-builder-pro:ultra-review`, and `$ultra-builder-pro:ultra-deliver`; diagnostics use `$ultra-builder-pro:ultra-status`, `$ultra-builder-pro:ultra-think`, and `$ultra-builder-pro:ultra-doctor`',
     collaboration: '`$ultra-builder-pro:cc-collab` is an explicitly requested read-only advisor',
     coordination: 'The Codex plan is turn-facing coordination; it does not replace Ultra task state',
   }),
   opencode: Object.freeze({
     name: 'OpenCode',
     handbook: ['.config', 'opencode', 'AGENTS.md'],
-    invocation: '`/ultra-init`, `/ultra-research`, `/ultra-plan`, `/ultra-dev`, `/ultra-test`, `/ultra-review`, and `/ultra-deliver`; diagnostics use `/ultra-status` and `/ultra-think`',
+    invocation: '`/ultra-init`, `/ultra-research`, `/ultra-plan`, `/ultra-change`, `/ultra-dev`, `/ultra-test`, `/ultra-review`, and `/ultra-deliver`; diagnostics use `/ultra-status`, `/ultra-think`, and `/ultra-doctor`',
     collaboration: '`/cc-collab` and `/codex-collab` are explicitly requested read-only advisors',
     coordination: 'OpenCode session coordination does not replace Ultra task state',
   }),
@@ -52,11 +52,11 @@ function renderHandbook(runtime) {
     `- Workflow entry points: ${value.invocation}.`,
     `- Collaboration boundary: ${value.collaboration}. The current host remains primary and owns final verification.`,
     `- Coordination boundary: ${value.coordination}.`,
-    '- Authority: `.ultra/state.db` is the only durable Ultra authority for tasks, sessions, events, telemetry, and review evidence. Generated JSON and Markdown are projections or workflow artifacts.',
-    '- Memory boundary: Ultra Builder Pro does not capture prompts, transcripts, observations, summaries, or cross-session memory. Persistent memory belongs to a separately installed provider such as cloud-mem or claude-mem.',
-    '- Hook boundary: Ultra hooks are workflow-only lifecycle adapters and are no-ops unless `.ultra/workflow-state.json` describes an active non-terminal workflow. Generic command blocking and post-edit policy stay in user or repository governance.',
+    '- Authority: `.ultra/state.db` is the only durable Ultra authority for changes, tasks, sessions, events, incidents, projection state, telemetry, and review evidence. Generated JSON and Markdown are projections or workflow artifacts.',
+    '- Memory and graph boundary: Ultra Builder Pro does not capture prompts, transcripts, observations, summaries, cross-session memory, or code-graph content. Separately installed providers own that data; Ultra may store only their metadata references in a change context manifest.',
+    '- Hook boundary: Ultra hooks observe workflow/change lifecycle only. Health/context may run when `.ultra/state.db` exists; projection protection is always authoritative, while edit/compact/stop/subagent enforcement remains active-workflow scoped. Generic command blocking and post-edit policy stay in user or repository governance.',
     '- Agent boundary: the bundled review and debugging agents are bounded workers. They use the current checkout and parent-supplied context, do not own private persistent state, and never replace the primary agent.',
-    '- Package boundary: only the ten Ultra workflows, four internal review-rule skills, and host-specific collaboration companions belong to this plugin. General browser, deployment, discovery, and framework skills must be installed from their owners.',
+    '- Package boundary: only the twelve Ultra workflows, four internal review-rule skills, and host-specific collaboration companions belong to this plugin. General browser, deployment, discovery, and framework skills must be installed from their owners.',
     END_MARKER,
   ].join('\n');
 }