@adia-ai/adia-ui-forge 0.8.20 → 0.8.22

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "adia-forge",
-  "version": "0.8.20",
+  "version": "0.8.22",
   "description": "Maintain the adia-ui (@adia-ai) framework itself \u2014 author primitives and shells, run the A2UI generation pipeline and its corpus, review gen-UI quality, sweep QA, cut releases, deploy. The maintainer counterpart to adia-factory (the consumer/app-author plugin).",
   "author": {
     "name": "Kim",

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog — adia-forge
 
+## [0.8.22] — 2026-07-29
+
+### Fixed
+- **`release-pack.mjs` Step 10 failures name their reason** — `shOk` discarded stderr, so a release-create that failed twice reported "could not be created" with an expired gh token, a network reset, and a bad notes file all indistinguishable. Create calls now pass `{ report: true }` (stderr surfaced, first 3 lines); existence probes stay silent since their failure is the answer.
+- **`release-pack.mjs` Step 10 is idempotent and resumable** — the GH-release loop called `gh release create` unconditionally, so ONE network blip aborted the whole handoff. The v0.8.21 cut hit exactly that: `connection reset by peer` with 4 of 11 releases made, *after* tags were pushed and all 9 packages published — the irreversible half done, the bookkeeping half stranded, and a plain re-run then failing on "release already exists" for the first 4 (repaired by hand). Now: a non-throwing `shOk()` probe skips releases that already exist, one retry absorbs a transient reset, and a genuine failure reports created/skipped/failed counts plus the fact that tags and publishes are unaffected — re-running the same handoff command finishes the job. Verified against the live v0.8.21 releases: 11 detected as existing, 0 would be re-created, and the probe returns false for a bogus tag (no false-positive skips).
+
+### Maintenance
+- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (1 file(s), e.g. `scripts/release-pack.mjs`) — carried by the entries above.
+
+## [0.8.21] — 2026-07-28
+
+### Fixed
+- **Pre-cut gate roster 23 → 24** (`skills/adia-release/scripts/gate-roster.mjs`) — adds `check:brand-assets` (the Adia mark must be token-driven, never a baked `agent-ui-*.svg`; gh#473). `cut-procedure.md` §3.1's transcribed table and the SKILL/gates-catalog counts moved with it, and the cut-hygiene gate renumbered 23 → 24; doc-vs-module equality re-verified programmatically (24/24 in sync, contiguous numbering).
+
+- **`release-pack.mjs` stages the root CHANGELOG it promotes** — the gh#453 machinery renamed root `[Unreleased]` → `[X.Y.Z]` at Step 4 but the Step 5 stage roster predated it, so the v0.8.20 cut promoted the heading and shipped without it (main kept `[Unreleased]`; the rename sat uncommitted in the cutter's working tree). `CHANGELOG.md` joins `releaseFiles`; the stranded v0.8.20 rename rides this same PR.
+
+### Maintenance
+- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+
 ## [0.8.20] — 2026-07-28
 
 ### Maintenance

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adia-ai/adia-ui-forge",
-  "version": "0.8.20",
+  "version": "0.8.22",
   "description": "Maintain the adia-ui (@adia-ai) framework itself \u2014 author primitives and shells, run the A2UI generation pipeline and its corpus, review gen-UI quality, sweep QA, cut releases, deploy. The maintainer counterpart to adia-factory (the consumer/app-author plugin).",
   "keywords": [
     "adia-ui",

package/skills/adia-deploy/SKILL.md

@@ -95,7 +95,13 @@ delete-adjudication classes.
    prod-only runtime-written files (feedback logs wiped 2026-06-10).
 3. Snapshot prod: `cp -al /srv/<app>/dist /srv/<app>/dist.bak-<date>`
    (hardlink farm — instant, and the only rollback).
-4. Real rsync — the dry-run minus `-n`, SAME excludes.
+4. Real rsync — the dry-run minus `-n`, SAME excludes, and the SAME BYTES:
+   both jobs rsync the artifact-round-tripped tree, and the deploy job aborts
+   if its tree's sha256 fingerprint differs from the one whose delete summary
+   was approved (gh#425 — the dry-run used to read the build job's own
+   `dist/`, so the v0.8.14 summary listed 3,128 deletions the real send never
+   performed; an over-reporting summary trains reviewers to approve past scary
+   numbers, and the same gap can under-report).
 5. Verify a fixture **file** that only exists in the new build, then
    render-check a `/site/components/*` page headlessly (SPA returns 200 shell
    for any route; file presence alone misses the llm-404 class).

package/skills/adia-release/SKILL.md

@@ -93,7 +93,7 @@ assumed pass, or "published" without the actual `npm view` output.
 
 ## Mechanization (bundled `scripts/`, stdlib Node, all support `--dry`)
 
-`release-pack.mjs` walks the cycle in two phases per invariant 3 — `--mode cut` / `--mode from-scratch` promote `[Unreleased]` (BOTH modes now — a peer's hand-authored section must be promoted whichever mode cut it, and a loud guard blocks the bump if any of the 11 packages still carries non-empty `[Unreleased]` content after promotion), run Step 4f (pre-tag coverage `--fix` with the authoritative F-N1 matcher), and stop at the release commit (PR → merge); `--mode handoff` tags/publishes/deploys from post-merge main. **`--go` is the standard invocation for an operator-initiated release** — the single authorization covers the cycle; evidence blocks print as a log; granular `--yes`/`--push`/`--publish` remain for cautious manual runs (`--push` still refuses to auto-fire past any F-N1 finding). `--mode batch` is not implemented — it hard-rejects with a pointer to [`recovery-paths.md`](references/recovery-paths.md) §Scenario 2 rather than silently misbehaving; a real batch tags each version at its own release-merge SHA, which this single-version orchestrator has no model for. Pre-flight (Step 3) runs the full 23-gate roster from the single shared list in `scripts/gate-roster.mjs` — the same list [`cut-procedure.md`](references/cut-procedure.md) §3.1 transcribes, so a subset run requires editing that one file, not two.
+`release-pack.mjs` walks the cycle in two phases per invariant 3 — `--mode cut` / `--mode from-scratch` promote `[Unreleased]` (BOTH modes now — a peer's hand-authored section must be promoted whichever mode cut it, and a loud guard blocks the bump if any of the 11 packages still carries non-empty `[Unreleased]` content after promotion), run Step 4f (pre-tag coverage `--fix` with the authoritative F-N1 matcher), and stop at the release commit (PR → merge); `--mode handoff` tags/publishes/deploys from post-merge main. **`--go` is the standard invocation for an operator-initiated release** — the single authorization covers the cycle; evidence blocks print as a log; granular `--yes`/`--push`/`--publish` remain for cautious manual runs (`--push` still refuses to auto-fire past any F-N1 finding). `--mode batch` is not implemented — it hard-rejects with a pointer to [`recovery-paths.md`](references/recovery-paths.md) §Scenario 2 rather than silently misbehaving; a real batch tags each version at its own release-merge SHA, which this single-version orchestrator has no model for. Pre-flight (Step 3) runs the full 24-gate roster from the single shared list in `scripts/gate-roster.mjs` — the same list [`cut-procedure.md`](references/cut-procedure.md) §3.1 transcribes, so a subset run requires editing that one file, not two.
 
 The pieces are callable alone: `bump.mjs` (version fields + the factory `.mcp.json` a2ui-mcp pin, invariant 8), `promote-unreleased.mjs` / `insert-stub.mjs` (CHANGELOG blocks), `tag-lockstep.mjs` (12 tags, `--delete` to move), `dispatch-publish.mjs` (publish workflows; `--verify-triggered` re-dispatches only missing runs; `--after` enforces batch ordering — dispatch output states what WAS done, never a to-do phrased as if it hadn't fired), and `pr-bridge.mjs` (the two-phase bridge: pushes the release branch, opens the PR, waits out CI, and merges ONLY on all-non-fail-soft-checks-green + zero unresolved threads + no changes-requested; any other state stops with evidence — §5.7 mechanized, `--dry` to preview the decision). All fail fast outside a monorepo root (`assert-monorepo-root.mjs`); fork-configurable via `--host` / `--scope`. All 6 CLI scripts (plus `scripts/release/check-release.mjs`) have a `selftest` mode wired into CI's Plugin bin selftests step; the 3 helper modules (`assert-monorepo-root`, `gate-roster`, `package-paths`) are exercised through the CLIs' selftests, not their own.
 

package/skills/adia-release/references/cut-procedure.md

@@ -111,7 +111,8 @@ npm run verify:site-a2ui                       # 19 site-a2ui rows vs source fra
 npm run verify:contrast                        # 20 WCAG AA — canvas-text AND text-on-fill
 npm run check:token-semantics-sync             # 21 adia-tokens generated refs vs token sources
 npm run check:demo-routes                      # 22 demo surfaces routed + patterns indexed
-node scripts/release/check-cut-hygiene.mjs --version <mode-dependent>  # 23 README CDN-pin + version currency — CUT modes pre-flight at the PREVIOUS version (the README claim is exact-match and only moves at the Step-4 bump; Step 4g re-proves at the cut version), HANDOFF pre-flights at the CUT version (post-merge, the claim already moved)
+npm run check:brand-assets                     # 23 brand mark token-driven, not baked raster
+node scripts/release/check-cut-hygiene.mjs --version <mode-dependent>  # 24 README CDN-pin + version currency — CUT modes pre-flight at the PREVIOUS version (the README claim is exact-match and only moves at the Step-4 bump; Step 4g re-proves at the cut version), HANDOFF pre-flights at the CUT version (post-merge, the claim already moved)
 ```
 
 Any red → route via [`gates-catalog.md`](gates-catalog.md); fix at the source, re-run the narrowest gate, then re-run the full sequence. The canonical miss: a cut that ran 7 of the gates shipped a stale-embeddings defect that surfaced a day later and cost a tag-move recovery.

package/skills/adia-release/references/gates-catalog.md

@@ -202,7 +202,7 @@ npm run check:demo-shells
 
 Add `verify:corpus` + `check:embeddings-fresh` if chunks were touched; `check:lightningcss-build` if CSS was touched; F-N1 if unpushed release tags exist.
 
-**Full pre-cut sweep** — the 23-gate roster in [`cut-procedure.md`](cut-procedure.md) §Step 3, sourced from `` `${CLAUDE_PLUGIN_ROOT}/skills/adia-release/scripts/gate-roster.mjs` `` (the ONE list; `release-pack.mjs` imports and runs it in full — a subset run is impossible without editing that file). ~90s wall time.
+**Full pre-cut sweep** — the 24-gate roster in [`cut-procedure.md`](cut-procedure.md) §Step 3, sourced from `` `${CLAUDE_PLUGIN_ROOT}/skills/adia-release/scripts/gate-roster.mjs` `` (the ONE list; `release-pack.mjs` imports and runs it in full — a subset run is impossible without editing that file). ~90s wall time.
 
 **Omnibus** — `npm run check` invokes everything. Heavy; use when re-baselining a stale checkout.
 

package/skills/adia-release/scripts/gate-roster.mjs

@@ -54,11 +54,16 @@ export const GATE_ROSTER = [
   // components/modules with .examples.html need a /site/components route,
   // catalog patterns need their Pattern Library sitemap entry.
   { n: 22, cmd: 'npm run check:demo-routes',                   what: 'demo surfaces routed + patterns indexed' },
+  // gh#473: the brand mark must be token-driven (<adia-mark-ui>), never a
+  // baked agent-ui-*.svg — a light-only raster cannot invert for dark mode,
+  // and 54 authored files (mostly harvested *.contents.html) had been
+  // teaching the anti-pattern to the generative corpus.
+  { n: 23, cmd: 'npm run check:brand-assets',                  what: 'brand mark token-driven, not baked raster' },
   // versionArg: the runner appends ` --version X.Y.Z` (release-pack knows the
   // cut version; the roster stays a static list). Objective half of the
   // v0.7.13-retro hygiene checker — README CDN pins / "Current version"
   // claims vs the cut version; branch/worktree limbo prints as warns (H2).
-  { n: 23, cmd: 'node scripts/release/check-cut-hygiene.mjs',  what: 'README CDN-pin + version currency', versionArg: true },
+  { n: 24, cmd: 'node scripts/release/check-cut-hygiene.mjs',  what: 'README CDN-pin + version currency', versionArg: true },
 ];
 
 // -- CLI ------------------------------------------------------------------

package/skills/adia-release/scripts/release-pack.mjs

@@ -226,6 +226,28 @@ function shQuiet(cmd, args) {
   return execSync(cmd, { cwd: REPO, encoding: 'utf8' });
 }
 
+/** Run a command for its EXIT STATUS only — true on 0, false on anything
+ *  else, never throws and never streams. For probes and retryable steps
+ *  where a non-zero exit is an expected answer, not a crash (Step 10's
+ *  "does this release already exist?" and its one transient retry).
+ *  Pass { report: true } for the CREATE calls: stderr is then captured and
+ *  printed on failure, so "could not be created" names its reason — an
+ *  expired gh token, a network reset, and a bad notes file were previously
+ *  indistinguishable (reviewer note, 2026-07-29). Probes stay silent:
+ *  their failure IS the answer. */
+function shOk(cmd, { report = false } = {}) {
+  try {
+    execSync(cmd, { cwd: REPO, encoding: 'utf8', stdio: ['ignore', 'ignore', 'pipe'] });
+    return true;
+  } catch (e) {
+    if (report) {
+      const err = (e.stderr || e.message || '').toString().trim().split('\n').slice(0, 3).join('\n    ');
+      if (err) console.error(`    stderr: ${err}`);
+    }
+    return false;
+  }
+}
+
 // Runs a command and CAPTURES its combined output instead of streaming it —
 // used where the output itself becomes evidence in a later checkpoint's
 // evidence block (H5), rather than just scrolling past in the terminal.
@@ -453,6 +475,12 @@ function step5Commit(args) {
     // (REPO_PINNED_REFS); gate 18 (check-cut-hygiene doc-currency) exact-matches
     // it against the cut version, so it must ride the release commit.
     'README.md',
+    // Root CHANGELOG — the gh#453 promotion machinery renames its
+    // [Unreleased] heading at Step 4, but this roster predated it, so the
+    // v0.8.20 cut promoted the heading and then shipped WITHOUT it (the
+    // rename sat uncommitted in the cutter's working tree while main kept
+    // [Unreleased]). Promotion and staging must travel together.
+    'CHANGELOG.md',
     // gh#399: Step 4e generates this but never staged it before — it landed
     // in a second PR after the release commit instead (v0.8.11 cut).
     `docs/releases/v${args.version}.md`,
@@ -654,9 +682,47 @@ async function step10GhAndSite(args) {
     console.error(`ERROR: GH notes file not found: ${args.ghNotesFile}`);
     process.exit(2);
   }
+  // Idempotent + resumable (v0.8.21 incident): this loop used to `gh release
+  // create` unconditionally, so ONE network blip aborted the whole handoff —
+  // that cut died on `connection reset by peer` with 4 of 11 releases made,
+  // after tags were pushed and all 9 packages were already published. The
+  // irreversible half of the release had happened; only the bookkeeping half
+  // was half-done, and a plain re-run then failed on "release already exists"
+  // for the first 4. So: skip what exists, create what doesn't, retry a
+  // transient failure, and report what remains instead of throwing away the
+  // work that succeeded. Re-running Step 10 after ANY partial failure is now
+  // safe and finishes the job.
+  const created = [];
+  const skipped = [];
+  const failed = [];
   for (const pkg of PACKAGES) {
-    sh(`gh release create "${pkg}-v${args.version}" --title "${args.scope}/${pkg} v${args.version}" --notes-file ${args.ghNotesFile}`, args);
+    const tag = `${pkg}-v${args.version}`;
+    if (!args.dry && shOk(`gh release view "${tag}"`)) {
+      skipped.push(pkg);
+      console.log(`  = ${tag} — already exists, skipping`);
+      continue;
+    }
+    const cmd = `gh release create "${tag}" --title "${args.scope}/${pkg} v${args.version}" --notes-file ${args.ghNotesFile}`;
+    // One retry: the observed failure mode is a transient TLS/connection
+    // reset against api.github.com, not a bad request.
+    let ok = args.dry ? (sh(cmd, args), true) : shOk(cmd, { report: true });
+    if (!ok && !args.dry) {
+      console.log(`  … ${tag} failed once (transient?) — retrying in 3s`);
+      sh('sleep 3', args);
+      ok = shOk(cmd, { report: true });
+    }
+    (ok ? created : failed).push(pkg);
+    if (ok) console.log(`  ✓ ${tag}`);
+  }
+  if (failed.length > 0) {
+    console.error(`\nERROR: ${failed.length}/${PACKAGES.length} GH release(s) could not be created: ${failed.join(', ')}`);
+    console.error(`  ${created.length} created, ${skipped.length} already existed.`);
+    console.error('  Tags and npm publishes are DONE and unaffected — only the GH-release');
+    console.error('  bookkeeping is incomplete. Re-run this same handoff command: the loop');
+    console.error('  skips what exists and creates only the remainder.');
+    process.exit(1);
   }
+  console.log(`  ✓ GH releases: ${created.length} created, ${skipped.length} already present (${PACKAGES.length} total)`);
   if (args.skipSite) {
     console.log('  --skip-site set; skipping EXE deploy');
     return;