@adia-ai/adia-ui-forge 0.8.34 → 0.8.36

package/skills/adia-dogfood/SKILL.md

@@ -92,8 +92,7 @@ reports "matches this allowlist row" as part of its finding and stops.
 Never auto-fixed: `zero-area` (always human-eyeballed), `empty-control` on an
 unrecognized component, native-primitive replacement (attribute-shape
 decisions), card-header wrapper hoists (slot intent), any warning without an
-allowlist row. When sweeping `avatar-ui[name]`, never touch the deprecation-
-handler string inside `components/avatar/avatar.js` itself.
+allowlist row.
 **NEVER exceed 5 mechanical fixes per PR or apply a fix outside this
 allowlist** — blast radius stays human-reviewable.
 
@@ -111,8 +110,10 @@ same session — harvested training chunks silently hold stale values otherwise.
 
 ## Findings home + PR shape
 
-Reports and probe artifacts land in `qa/findings/` (visual baselines in
-`qa/baselines/`). Commit the report even on a zero-finding day — the paper
+Reports and probe artifacts land in `qa/findings/` (the geometry-probe
+baseline lives at `scripts/qa/empty-instantiation-baseline.json`; there is
+no visual-baseline directory — probes are geometry-only, gh#988). Commit
+the report even on a zero-finding day — the paper
 trail is how "used to be fine, now broken" is detected. PR title:
 `dogfood: <YYYY-MM-DD> — <N> critical, <M> warning`; body = report excerpt +
 auto-applied-fix checklist + left-for-human list.

package/skills/adia-dogfood/references/admin-shell-anatomy.md

@@ -3,8 +3,11 @@
 Script: `scripts/dev/audit-shell-composition.mjs` (repo-local), npm gates
 `audit:shell-composition{,:strict,:all}`. Static AST walk over
 `apps/**/*.html`, `playgrounds/**/*.html`, `catalog/page-shells/**/*.html` —
-no browser needed; pre-commit fast. The script mechanically checks a subset
-(the findings table below); this 13-part list is the full review standard.
+no browser needed; pre-commit fast. The script's own `PARTS` array is the
+mechanical census — it has grown past this list (count it in
+`scripts/dev/audit-shell-composition.mjs`, never from a hand-typed number
+here); this numbered list is the human review standard, and the findings
+table below samples common symptoms rather than the script's full roster.
 Canonical source: the monorepo's `site/index.html` — the markup that renders
 the live admin-dashboard example.
 

package/skills/adia-dogfood/references/app-shell-pitfalls.md

@@ -20,10 +20,17 @@ may stall — wait 30s, re-run.
 | 4 | Top-level `await` without async setup wrap | `[setup-failed]` console error | `export default async function setup(host) { … }` |
 | 5 | Vite import-analysis 500 on dynamic import | `[network-4xx] 500` for `./<name>.contents.js` | add `/* @vite-ignore */` to the dynamic import |
 | 6 | icon-ui not imported despite `<icon-ui>` / `[icon=…]` / icon-rendering composites | `[icon-ui-missing]` | `import "/packages/web-components/components/icon/icon.js"` |
+| 7 | `<admin-page-body>` emitted without its `<admin-page>` ancestor (gh#981) | *(no audit-app-shells.mjs tag — apps/-only script, doesn't sweep this surface)* | wrap in `<admin-page>` — `admin-page > admin-page-body { flex:1; … }` (`admin-shell.bespoke.css:144`) is a direct-child selector; without that literal parent, `admin-page-body` falls back to UA `display:inline` |
 
-Secondary signals: `[collapsed-element]` (registered but 0px tall),
-`[network-4xx]` (typoed stylesheet href, missing contents.html, stale
-`import.meta.url`).
+Secondary signals: `[collapsed-element]` (registered but 0px tall —
+`audit-app-shells.mjs`'s own threshold is <4px, so a shallower-but-still-broken
+collapse won't trip it), `[network-4xx]` (typoed stylesheet href, missing
+contents.html, stale `import.meta.url`). Row 7's specific case (gh#981, in
+`site/site.js`'s router, not swept by this script at all): the 150px isn't
+`admin-page-body`'s own height — it's a *replaced child* (an `<iframe>`)
+whose `height:100%` can't resolve, so it falls back to the browser's
+intrinsic default (300×150). The observable is a body rendering ~150px tall
+with no console error, regardless of real content height.
 
 ## Composite → internal primitives (undiscoverable from the markup)
 

package/skills/adia-dogfood/scripts/analyze.mjs

@@ -571,6 +571,8 @@ function renderReport(results, base) {
   lines.push('4. **Synonym-attr / synonym-slot drift** — markers documented in `.claude/docs/conventions/attribute-api-migration.md`.');
   lines.push('5. **Alert flex-row** — `alert-ui` with multiple bare `<text-ui>` children (need `<col-ui slot="content">` wrap).');
   lines.push('6. **Console** — every `console.error` and `console.warn` during page load + 800ms settling.');
+  lines.push('7. **Missing component CSS** — a rendered `*-ui` element with no resolved `--{prefix}-*` custom property, meaning its per-component stylesheet never loaded (controls render unstyled).');
+  lines.push('8. **Unstyled popover** — an OPEN `[popover]` with transparent background AND zero padding (transparent-host components like `feed-ui` allowlisted).');
   lines.push('');
 
   return lines.join('\n');

package/skills/adia-gen-review/SKILL.md

@@ -35,8 +35,15 @@ directives are findings.
 3. Zero P1 cosmetic findings (overflow entries auto-count as P1) — checked
    mechanically.
 4. Zero RENDER_FAILURE prompts; cycle `status: COMPLETE` — checked
-   mechanically (plus the human-QA block, ≥4/5).
-5. Human QA: 5 sampled prompts, `passCount ≥ 4`.
+   mechanically.
+5. **Human QA is per-sweep, not per-cycle** (spec-factory-dx-ws6-measurement.md
+   REQ-11, gh#1137 — retired from this exit gate 2026-08-12; the per-cycle
+   `humanQA` ledger field never held: null in 12 of 13 rows, and the one
+   populated row still said "gate pending"). The 5-sampled-prompts,
+   `passCount ≥ 4` bar is unchanged, but it now feeds `qa/dx/`'s R1 sweep
+   record (D5's induced-failure sample + D8's gallery term) instead of
+   blocking a single cycle's own exit condition. `gen-review-status.mjs
+   --check-exit` no longer reads `humanQA` off the ledger row.
 
 ## The Gen-Review Scorecard — the per-prompt output contract
 
@@ -182,7 +189,7 @@ map + FAILS/WORKS transpilation pairs:
 | New primitive / native tag in canvas | `TAG_TO_COMPONENT` in the decompose script (`Native*` prefix for natives); coverage-audit must go green |
 | New root-cause code | rubric-score.md table + `scores.schema.json` enum + `schemaVersion` bump |
 | New safe attribute | `ATTR_ALLOWLIST` — static enums only, never freeform-text attrs |
-| Threshold recalibration | rubric-score.md §Thresholds (pass-flip sweep) + the exit gate above |
+| Threshold recalibration | rubric-score.md §Thresholds (pass-flip sweep) + the exit gate above + `EXCELLENCE_THRESHOLD` at `scripts/gen-review-status.mjs:31` — the only mechanical enforcer; skip it and `--check-exit` silently keeps the old floor |
 
 ## Posture
 

package/skills/adia-gen-review/references/loop-protocol.md

@@ -161,12 +161,16 @@ never get fix plans. Reads ONLY the decomposed file.
    skill does not perform the edits.
 3. **Regenerate**: `npm run gallery:generate`; confirm 0 console
    errors/warnings in the canvas output.
-4. **Human QA gate — required for COMPLETE.** Operator reviews 5 random
-   PASSING prompts against: (a) serves the user's task? (b) right primary
-   primitive? (c) would ship unchanged? Record
-   `humanQA.{sampledPrompts,passCount,failCount}`. `failCount ≥ 2` → cycle
-   stays `OPEN`: the thresholds are miscalibrated — recalibrate
-   rubric-score.md §Thresholds against the human judgments.
+4. **Human QA sample — per-sweep, not per-cycle** (retired from this
+   cycle's own COMPLETE gate 2026-08-12, spec-factory-dx-ws6-measurement.md
+   REQ-11, gh#1137). Operator reviews 5 random PASSING prompts against:
+   (a) serves the user's task? (b) right primary primitive? (c) would ship
+   unchanged? Record the result in the next `qa/dx/` sweep record's
+   `humanQA.{sampledPrompts,pass,fail}` (`node scripts/qa/dx-status.mjs`),
+   not on this cycle's ledger row. `failCount ≥ 2` still means the
+   thresholds are miscalibrated — recalibrate rubric-score.md §Thresholds
+   against the human judgments — it just no longer blocks THIS cycle's own
+   `status: COMPLETE`.
 5. **Schema gate** (must exit 0 before touching the ledger):
 
    ```bash
@@ -175,8 +179,11 @@ never get fix plans. Reads ONLY the decomposed file.
 
 6. **Update ledger** (`review/cycle-ledger.json`): `cycleNumber`,
    `completedAt`, `engine`, `status`, `aggregate`
-   (passingCount/failingCount/renderFailureCount/meanScore/Δ), `humanQA`.
-   Remove the `cycle-{N}.lock` sentinel.
+   (passingCount/failingCount/renderFailureCount/meanScore/Δ). `humanQA` is
+   RETIRED from this per-cycle row (step 4) — do not populate it here; a
+   stray value is harmless (ignored) but the field's home is now the
+   per-sweep `qa/dx/sweeps/*.json` record. Remove the `cycle-{N}.lock`
+   sentinel.
 7. **Exit condition**:
 
    ```bash

package/skills/adia-gen-review/references/rubric-score.md

@@ -22,8 +22,11 @@ Max score 105 (D1–D5 at 20 each = 100; D6 mechanical = 0 or +5).
 **Recalibrating** (when human QA contradicts mechanical scores across 2+
 cycles): sweep candidate threshold values and read the pass-flips at each step
 against the human verdicts — never pick a round number by feel. A threshold
-change must also update the exit gate in SKILL.md and the schema comment, and
-new cause codes / dimensions bump `schemaVersion` in
+change must also update the exit gate in SKILL.md AND the
+`EXCELLENCE_THRESHOLD` constant at `scripts/gen-review-status.mjs:31` — that
+constant is the only mechanical enforcer (`--check-exit` reads nothing else;
+the schema carries no threshold), so missing it leaves the old floor silently
+enforced. New cause codes / dimensions bump `schemaVersion` in
 [scores.schema.json](scores.schema.json).
 
 ---

package/skills/adia-gen-review/scripts/gen-review-status.mjs

@@ -17,9 +17,14 @@
  *
  * Exit-condition (from scores.schema.json + SKILL.md §ExitCondition):
  *   - Every prompt PASSING (p1Count = 0 AND rubricScore.score ≥ 92)
- *   - humanQA.passCount ≥ 4 (of 5 sampled)
  *   - No RENDER_FAILURE prompts
  *   - Cycle status = COMPLETE (not OPEN or INTERRUPTED)
+ *
+ * humanQA is RETIRED from this per-cycle exit condition (spec-factory-dx-
+ * ws6-measurement.md REQ-11, gh#1137, 2026-08-12): the per-cycle ledger
+ * field never held (null in 12/13 rows), so it moved to a per-sweep
+ * obligation — `qa/dx/sweeps/*.json`'s `humanQA` field (dx-status.mjs)
+ * reads a 5-prompt sample per sweep instead of per cycle.
  */
 
 import { readFileSync, existsSync } from 'node:fs';
@@ -85,11 +90,8 @@ function checkExitCondition() {
     reasons.push(`Cycle ${latest.cycleNumber} status is "${latest.status}" (need COMPLETE)`);
   }
 
-  if (!latest.humanQA) {
-    reasons.push('Human QA gate not completed (humanQA block missing)');
-  } else if (latest.humanQA.passCount < 4) {
-    reasons.push(`Human QA pass count ${latest.humanQA.passCount}/5 (need ≥ 4)`);
-  }
+  // humanQA is RETIRED from this per-cycle check (REQ-11, gh#1137) — it's a
+  // per-sweep obligation now (qa/dx/sweeps/*.json), not a per-cycle gate.
 
   const agg = latest.aggregate;
   if (agg?.failingCount > 0) {

package/skills/adia-llm-internals/SKILL.md

@@ -25,7 +25,7 @@ Consumers depend on: the `StreamChunk` union, `ChatResult` (`text` / `usage` / `
 
 Three invariants override any cleanup instinct:
 
-1. **NEVER normalize `stopReason`.** Providers emit `end` / `stop` / `max_tokens` / `length` / `MAX_TOKENS` / `tool_use`; the downstream truncation detector reads the raw value. Collapsing to `end` hides truncation — a defect, not a cleanup.
+1. **Never collapse `stopReason` truncation values — and never invent a NEW normalization.** The one sanctioned mapping is OpenAI's own `finish_reason === 'stop'` → `end` (`openai.ts` `parseResponse`; adapter-contract.md §stopReason documents it as correct); everything else propagates raw. Providers emit `end` / `stop` / `max_tokens` / `length` / `MAX_TOKENS` / `tool_use`; the downstream truncation detector reads the raw value, so collapsing `max_tokens`/`length`/`MAX_TOKENS` to `end` hides truncation — a defect, not a cleanup.
 2. **`buildRequest()` is the single source of upstream shape** for direct AND passthrough-proxy mode; the dispatcher swaps only the URL. Never fork it per proxy flavor.
 3. **No real API key reaches the browser on a production host.** The same-origin passthrough proxy injects the key server-side; the sentinel-key + one-shot-warning path in `createAdapter()` must survive any refactor.
 

package/skills/adia-release/SKILL.md

@@ -3,8 +3,9 @@ name: adia-release
 description: >-
   Release engineering for the @adia-ai lockstep monorepo. Use when asked to
   cut and ship a release, promote [Unreleased] CHANGELOG entries, tag and push the
-  lockstep packages to origin, publish a 13-package release (11 npm
-  libraries + 2 Claude Code plugins), batch-push piled-up release commits,
+  lockstep packages to origin, publish a 13-package release (11
+  npm libraries + 2 Claude Code plugins, as of gh#607 — see
+  scripts/package-paths.mjs), batch-push piled-up release commits,
   recover a cut that landed wrong or whose publish workflows didn't fire,
   fix a check:lockstep bump failure or an F-N1 CHANGELOG-coverage warning,
   verify the release gates without cutting anything, or author release
@@ -17,7 +18,7 @@ user-invocable: true
 
 # adia-release
 
-Release engineering for an @adia-ai-style lockstep monorepo: the `@adia-ai/*` packages on the roster (`scripts/package-paths.mjs`, the single source — 13 as of gh#607: 11 npm libraries plus the 2 Claude Code plugins under `packages/plugins/*`) version and publish together (class A; the plugins joined the lockstep 2026-07-15 after class-B independence let npm drift a full harness-reset behind the repo). Class B (independent versioning) currently has no members; the procedure is retained for future genuinely-independent packages. The substrate — `scripts/release/*`, the `check:*` gates, the tag-triggered publish workflows — encodes the invariants; this skill routes, sequences, and stops at the judgment calls.
+Release engineering for an @adia-ai-style lockstep monorepo: the `@adia-ai/*` packages on the roster (`scripts/package-paths.mjs`, the single source — 13 lockstep as of gh#607: 11 npm libraries plus the 2 Claude Code plugins under `packages/plugins/*`) version and publish together (class A; the plugins joined the lockstep 2026-07-15 after class-B independence let npm drift a full harness-reset behind the repo). Class B (independent versioning) has one member — `@adia-ai/adia-plugins` (gh#1133/gh#1160, ADR-0045), the npm-sourced marketplace manifest package, marked `lockstep: false` on the roster; it cuts on its own version line and its own tag, never the umbrella ([`references/independent-package-release.md`](references/independent-package-release.md)). The substrate — `scripts/release/*`, the `check:*` gates, the tag-triggered publish workflows — encodes the invariants; this skill routes, sequences, and stops at the judgment calls.
 
 ## Authorization — one go, gates do the rest (operator ruling 2026-07-17)
 
@@ -34,7 +35,7 @@ Mechanics: `release-pack.mjs --go` auto-confirms all checkpoints (it equals `--y
 1. **Lockstep coherence** — every roster package bumps together (`check:lockstep`; the roster lives in `scripts/package-paths.mjs`, currently `web-components`, `web-modules`, `llm`, `agent`, `persona`, `a2ui-{runtime,compose,corpus,mcp,retrieval,validator}`, and the plugins `adia-ui-{factory,forge}`) (each plugin's `.claude-plugin/plugin.json` version moves with its package.json — `bump.mjs` handles both; `verify:plugins` gates the sync).
 2. **PATCH-cut asymmetry** — internal `@adia-ai/*` ranges hold at `^X.Y.0` during PATCH cuts; only MINOR bumps the floor. `^0.0.x` is forbidden (pre-1.0 caret locks exact — shipped a real stale-sibling bug).
 3. **Release commits land via PR, never a direct push to `main`** (repo policy, operator ruling 2026-07-12): commit on `release/vX.Y.Z` → PR → CI → merge — THEN tag at `main`'s post-merge HEAD, not at the bump commit; post-bump fixes merge before tagging and belong in the tarball. Exception: batch push tags each version at its own release-merge SHA.
-4. **One umbrella + one per-package tag per cut** (`vX.Y.Z` + 11 × `<pkg>-vX.Y.Z`); publish workflows key off the per-package tags. Push tags **one per `git push`** — a batched multi-tag push drops the trigger event.
+4. **One umbrella + one per-package tag per cut** (`vX.Y.Z` + 13 × `<pkg>-vX.Y.Z`, one per lockstep-roster package — `scripts/package-paths.mjs`); publish workflows key off the per-package tags. Push tags **one per `git push`** — a batched multi-tag push drops the trigger event.
 5. **F-N1 (`check:release --all-pending`) per-package clean** — the umbrella-tag mismatch error is expected noise. Coverage is mechanized at cut time: Step 4f (`check-release.mjs --pending-version X.Y.Z --fix`) runs the SAME matcher pre-PR and auto-appends verified Maintenance bullets, so a post-tag warn means something novel — stop and investigate, don't loop enrichment PRs.
 6. **`npm dist-tag latest` is set by publish order** — batch pushes publish oldest first and WAIT for settle.
 7. **A breaking (MINOR) cut MUST ship its MIGRATION GUIDE section in the same cycle** — MINOR is reserved for removed/renamed API symbols; everything else, including visible behavior changes, stays PATCH.
@@ -58,7 +59,7 @@ The release is done only when reality confirms it: **the npm registry, the GH re
 
 | Task shape | Done when |
 | --- | --- |
-| Lockstep cut / handoff | `npm view @adia-ai/<pkg> version` = X.Y.Z for all 11 AND `dist-tags.latest` = X.Y.Z AND a deployed content file (not an SPA route) serves real bytes |
+| Lockstep cut / handoff | `npm view @adia-ai/<pkg> version` = X.Y.Z for all 13 lockstep packages AND `dist-tags.latest` = X.Y.Z AND a deployed content file (not an SPA route) serves real bytes |
 | Batch push | every batched tag on `git ls-remote --tags origin` + every version on the registry, `latest` on the newest |
 | Verify-only | the failing gate re-runs green |
 | Recovery | the trip-wire that surfaced the issue passes |
@@ -74,7 +75,7 @@ Every cut reports, whether it ran inline or via `release-builder`:
 | --- | --- |
 | Version | X.Y.Z — all roster packages at this version (`check:lockstep`) |
 | Commit / PR | release commit SHA, PR # (merged) |
-| Tags | umbrella `vX.Y.Z` + 11 per-package tags pushed (or: which are still pending, and why) |
+| Tags | umbrella `vX.Y.Z` + 13 per-package tags pushed (or: which are still pending, and why) |
 | Registry | `npm view @adia-ai/<pkg> version` per package, cited (not "publish workflow green") |
 | `dist-tags.latest` | confirmed = X.Y.Z |
 | Deploy | dispatched (`deploy-site.yml` run URL) / N/A this cut |
@@ -93,9 +94,9 @@ assumed pass, or "published" without the actual `npm view` output.
 
 ## Mechanization (bundled `scripts/`, stdlib Node, all support `--dry`)
 
-`release-pack.mjs` walks the cycle in two phases per invariant 3 — `--mode cut` / `--mode from-scratch` promote `[Unreleased]` (BOTH modes now — a peer's hand-authored section must be promoted whichever mode cut it, and a loud guard blocks the bump if any roster package still carries non-empty `[Unreleased]` content after promotion), run Step 4f (pre-tag coverage `--fix` with the authoritative F-N1 matcher), and stop at the release commit (PR → merge); `--mode handoff` tags/publishes/deploys from post-merge main. **`--go` is the standard invocation for an operator-initiated release** — the single authorization covers the cycle; evidence blocks print as a log; granular `--yes`/`--push`/`--publish` remain for cautious manual runs (`--push` still refuses to auto-fire past any F-N1 finding). `--mode batch` is not implemented — it hard-rejects with a pointer to [`recovery-paths.md`](references/recovery-paths.md) §Scenario 2 rather than silently misbehaving; a real batch tags each version at its own release-merge SHA, which this single-version orchestrator has no model for. Pre-flight (Step 3) runs the full 24-gate roster from the single shared list in `scripts/gate-roster.mjs` — the same list [`cut-procedure.md`](references/cut-procedure.md) §3.1 transcribes, so a subset run requires editing that one file, not two.
+`release-pack.mjs` walks the cycle in two phases per invariant 3 — `--mode cut` / `--mode from-scratch` promote `[Unreleased]` (BOTH modes now — a peer's hand-authored section must be promoted whichever mode cut it, and a loud guard blocks the bump if any roster package still carries non-empty `[Unreleased]` content after promotion), run Step 4f (pre-tag coverage `--fix` with the authoritative F-N1 matcher), and stop at the release commit (PR → merge); `--mode handoff` tags/publishes/deploys from post-merge main. **`--go` is the standard invocation for an operator-initiated release** — the single authorization covers the cycle; evidence blocks print as a log; granular `--yes`/`--push`/`--publish` remain for cautious manual runs (`--push` still refuses to auto-fire past any F-N1 finding). `--mode batch` is not implemented — it hard-rejects with a pointer to [`recovery-paths.md`](references/recovery-paths.md) §Scenario 2 rather than silently misbehaving; a real batch tags each version at its own release-merge SHA, which this single-version orchestrator has no model for. Pre-flight (Step 3) runs the full 28-gate roster from the single shared list in `scripts/gate-roster.mjs` — the same list [`cut-procedure.md`](references/cut-procedure.md) §3.1 transcribes, so a subset run requires editing that one file, not two.
 
-The pieces are callable alone: `bump.mjs` (version fields + the factory `.mcp.json` a2ui-mcp pin, invariant 8), `promote-unreleased.mjs` / `insert-stub.mjs` (CHANGELOG blocks), `tag-lockstep.mjs` (12 tags, `--delete` to move), `dispatch-publish.mjs` (publish workflows; `--verify-triggered` re-dispatches missing AND dead — cancelled/failed/timed-out — runs, each gated behind an npm-registry check so an already-published version is never re-dispatched (gh#763); `--after` enforces batch ordering — dispatch output states what WAS done, never a to-do phrased as if it hadn't fired), and `pr-bridge.mjs` (the two-phase bridge: pushes the release branch, opens the PR, waits out CI, and merges ONLY on all-non-fail-soft-checks-green + zero unresolved threads + no changes-requested; any other state stops with evidence — §5.7 mechanized, `--dry` to preview the decision). All fail fast outside a monorepo root (`assert-monorepo-root.mjs`); fork-configurable via `--host` / `--scope`. All 6 CLI scripts (plus `scripts/release/check-release.mjs`) have a `selftest` mode wired into CI's Plugin bin selftests step; the 3 helper modules (`assert-monorepo-root`, `gate-roster`, `package-paths`) are exercised through the CLIs' selftests, not their own.
+The pieces are callable alone: `bump.mjs` (version fields + the factory `.mcp.json` a2ui-mcp pin, invariant 8), `promote-unreleased.mjs` / `insert-stub.mjs` (CHANGELOG blocks), `tag-lockstep.mjs` (umbrella + one tag per roster package — 14 today, `--delete` to move), `dispatch-publish.mjs` (publish workflows; `--verify-triggered` re-dispatches missing AND dead — cancelled/failed/timed-out — runs, each gated behind an npm-registry check so an already-published version is never re-dispatched (gh#763); `--after` enforces batch ordering — dispatch output states what WAS done, never a to-do phrased as if it hadn't fired), and `pr-bridge.mjs` (the two-phase bridge: pushes the release branch, opens the PR, waits out CI, and merges ONLY on all-non-fail-soft-checks-green + zero unresolved threads + no changes-requested; any other state stops with evidence — §5.7 mechanized, `--dry` to preview the decision). All fail fast outside a monorepo root (`assert-monorepo-root.mjs`); fork-configurable via `--host` / `--scope`. All 6 CLI scripts (plus `scripts/release/check-release.mjs`) have a `selftest` mode wired into CI's Plugin bin selftests step; the 3 helper modules (`assert-monorepo-root`, `gate-roster`, `package-paths`) are exercised through the CLIs' selftests, not their own.
 
 Site deploy (Step 10 of the handoff) dispatches `deploy-site.yml` (its own pre-flight verify → snapshot → hardened rsync → post-deploy verify → auto-rollback), never a raw local `rsync` — H1 (forge-campaign gh#268 audit): the script had drifted into bypassing that pipeline even though this doc already taught the workflow-dispatch path. The dispatch rides the cycle's single authorization (`--go`, or `--publish` on a manual run); the workflow's own GitHub environment gate is the human stop for the deploy itself.
 

package/skills/adia-release/references/cut-procedure.md

@@ -4,8 +4,9 @@
 > handoff). Companions: [`gates-catalog.md`](gates-catalog.md) (gate roster +
 > failure routing), [`changelog-discipline.md`](changelog-discipline.md) (promotion
 > + F-N1 enrichment), [`recovery-paths.md`](recovery-paths.md) (when it goes wrong).
-> The concrete gate names, 9 package paths, and `ui-kit.exe.xyz` deploy are the
-> @adia-ai monorepo's worked example of the portable discipline. `$REPO` = repo root.
+> The concrete gate names, the roster's package paths (`scripts/package-paths.mjs`,
+> 13 lockstep as of gh#607), and `ui-kit.exe.xyz` deploy are the @adia-ai
+> monorepo's worked example of the portable discipline. `$REPO` = repo root.
 
 Two entry variants, converging at Step 5:
 
@@ -113,6 +114,10 @@ npm run check:token-semantics-sync             # 21 adia-tokens generated refs v
 npm run check:demo-routes                      # 22 demo surfaces routed + patterns indexed
 npm run check:brand-assets                     # 23 brand mark token-driven, not baked raster
 node scripts/release/check-cut-hygiene.mjs --version <mode-dependent>  # 24 README CDN-pin + version currency — CUT modes pre-flight at the PREVIOUS version (the README claim is exact-match and only moves at the Step-4 bump; Step 4g re-proves at the cut version), HANDOFF pre-flights at the CUT version (post-merge, the claim already moved)
+python3 packages/plugins/adia-ui-factory/scripts/adia-scaffold selftest  # 25 scaffold specifiers resolve in packed @adia-ai/web-components + @adia-ai/web-modules tarballs (gh#1132)
+node scripts/release/check-dx-sweep-freshness.mjs  # 26 DX sweep fresh + not regression-RED (gh#1137 REQ-05 — FLAGGED, needs adia-release confirmation; see the script's own header)
+npm run eval:diff -- --engine free-form                    # 27 fresh free-form eval run (evals/health input, gh#1135)
+node scripts/release/write-eval-health.mjs --version <cut>  # 28 evals/health/<version>.json committed, AC-01/AC-02 run for real (gh#1135, WS-4 SPEC REQ-06)
 ```
 
 Any red → route via [`gates-catalog.md`](gates-catalog.md); fix at the source, re-run the narrowest gate, then re-run the full sequence. The canonical miss: a cut that ran 7 of the gates shipped a stale-embeddings defect that surfaced a day later and cost a tag-move recovery.
@@ -266,7 +271,7 @@ The operator's initiating instruction covers the whole cycle — no per-step re-
 
 | Evidence logged before | Content | Why it's still printed |
 | --- | --- | --- |
-| Tagging (Step 6) | The planned tag list (umbrella + 11 per-package) | The log line a recovery diagnoses from |
+| Tagging (Step 6) | The planned tag list (umbrella + 13 per-package) | The log line a recovery diagnoses from |
 | Pushing (Step 8) | The Step 7 F-N1 output + tag list + `origin/main..HEAD` count | F-N1's first real evidence — and its ERROR path still hard-stops unconditionally |
 | Publishing (Step 9) | The current registry snapshot (versions + `dist-tags.latest`) | Ordering is verified against what's LIVE, mechanically |
 | Deploying (Step 10) | The `deploy-site.yml` dispatch (never a raw rsync) | The workflow carries its own GitHub-environment human gate |
@@ -281,7 +286,7 @@ After the bump + lockfile, run the AUTHORITATIVE F-N1 matcher against the workin
 node scripts/release/check-release.mjs --pending-version X.Y.Z --fix
 ```
 
-Stage its CHANGELOG edits into the release commit (the Step-5 allowlist already covers `CHANGELOG.md`). It re-verifies its own output with the same matcher before writing — a `--fix` that doesn't satisfy the checker is a hard error, not a silent pass. Do NOT use `check-changelog-coverage.mjs` as the pre-tag gate: it carries a different matcher and a 9-package roster missing the 2 plugins — the drift that cost the v0.8.5 cut 3 enrichment PRs and 3 tag rewrites after "coverage clean" at cut time.
+Stage its CHANGELOG edits into the release commit (the Step-5 allowlist already covers `CHANGELOG.md`). It re-verifies its own output with the same matcher before writing — a `--fix` that doesn't satisfy the checker is a hard error, not a silent pass. (The former `check:changelog-coverage` gate — a different matcher and a 9-package roster missing the 2 plugins — cost the v0.8.5 cut 3 enrichment PRs and 3 tag rewrites after "coverage clean" at cut time; it was deleted 2026-07-19, so `check-release.mjs --pending-version` is now the only pre-tag coverage check.)
 
 ## §Step 6 — Tag
 
@@ -289,7 +294,7 @@ Log the planned tag list (evidence table above), then tag **at `main`'s post-mer
 
 ```bash
 node "${CLAUDE_PLUGIN_ROOT}/skills/adia-release/scripts/tag-lockstep.mjs" \
-  --version X.Y.Z                        # umbrella vX.Y.Z + 11 <pkg>-vX.Y.Z (incl. the 2 plugins, 2026-07-15 policy)
+  --version X.Y.Z                        # umbrella vX.Y.Z + 13 <pkg>-vX.Y.Z (11 npm + 2 plugins, 2026-07-15 policy)
 ```
 
 ## §Step 7 — F-N1 release trip-wire
@@ -330,8 +335,9 @@ node "${CLAUDE_PLUGIN_ROOT}/skills/adia-release/scripts/dispatch-publish.mjs" \
 Wait for the workflows to settle, then verify against the **registry**, never the workflow's green check:
 
 ```bash
-for pkg in web-components web-modules llm a2ui-runtime a2ui-compose a2ui-corpus \
-           a2ui-mcp a2ui-retrieval a2ui-validator adia-ui-factory adia-ui-forge; do
+for pkg in web-components web-modules llm agent persona a2ui-runtime a2ui-compose \
+           a2ui-corpus a2ui-mcp a2ui-retrieval a2ui-validator adia-ui-factory \
+           adia-ui-forge; do
   echo -n "$pkg: "; npm view "@adia-ai/$pkg" version
 done
 npm view @adia-ai/web-components dist-tags.latest   # must equal X.Y.Z
@@ -342,7 +348,9 @@ Zero workflows fired after a tag push → [`recovery-paths.md`](recovery-paths.m
 ## §Step 10 — GH releases + site deploy dispatch
 
 ```bash
-for pkg in <the 9>; do
+for pkg in web-components web-modules llm agent persona a2ui-runtime a2ui-compose \
+           a2ui-corpus a2ui-mcp a2ui-retrieval a2ui-validator adia-ui-factory \
+           adia-ui-forge; do
   gh release create "$pkg-vX.Y.Z" --title "@adia-ai/$pkg vX.Y.Z" --notes-file <body>.md
 done
 # Site deploy goes through the pipeline, never a raw rsync. The dispatch is

package/skills/adia-release/references/gates-catalog.md

@@ -14,7 +14,7 @@ Row layout per gate: **What** · **Typical failure** · **Recovery**.
 
 ### `npm run check:lockstep`
 
-- **What:** all 11 `@adia-ai/*` packages declare the same `version`; internal `@adia-ai/*` dep ranges match policy (`^X.Y.0` during PATCH cycles, bumped at MINOR).
+- **What:** all 13 lockstep `@adia-ai/*` packages declare the same `version` (the class-B `adia-plugins` package is excluded — `lockstep: false`, `scripts/package-paths.mjs`); internal `@adia-ai/*` dep ranges match policy (`^X.Y.0` during PATCH cycles, bumped at MINOR).
 - **Typical failure:** one package forgot to bump; a peer edited an internal range mid-PATCH; a `^0.0.x` range slipped in.
 - **Recovery:** version drift → `` `${CLAUDE_PLUGIN_ROOT}/skills/adia-release/scripts/bump.mjs` ``; range drift → `npm run check:lockstep:fix` auto-aligns, then re-run.
 - **Why `^0.0.x` is forbidden:** npm pre-1.0 semver only widens the caret when major+minor aren't both zero — `^0.0.6` resolves to `>=0.0.6 <0.0.7`, locked to exactly 0.0.6. An internal dep pinned that way silently installs a *stale* sibling on every fresh `npm i` (this shipped a real ~4-day-latent bug before the lockstep policy). The `^X.Y.0` floor (Y≥1) widens correctly across patches; trust the gate, don't reason about caret semantics by hand. Moot at 1.0.0.
@@ -153,6 +153,8 @@ The two `audit:*` probes are soft-fail pre-cut (exit-1 only on criticals); findi
 - **What:** the vitest suite (~1000+ tests).
 - **Stale-test failure:** the test asserts a behavior a peer deliberately changed (CHANGELOG-documented) without updating the assertion. Tell it apart by reading assertion vs CHANGELOG vs source: if the code matches the CHANGELOG's described behavior, the test is stale — update the assertion (see [`recovery-paths.md`](recovery-paths.md) §Scenario 5). Real regression → fix the regression.
 - **Parallel-contention flake:** heavy web-modules composite suites can fail under full parallelism on a loaded machine (`signals: drain loop exceeded 100 iterations`). Load-dependent, not a code defect. Sequential is the source of truth, and **the roster gate now runs it directly** (`npm run test:unit:serial` = `vitest run --no-file-parallelism`, gate 4 since 2026-07-19) — a parallel `test:unit` flake outside the roster still isn't a blocker, and don't raise the drain guard.
+- **Exit 143 (SIGTERM):** the vitest process was KILLED (resource pressure / a stray terminator), not a test failure — re-run the gate directly (`npx vitest run --no-file-parallelism`) before diagnosing anything; a clean re-run means transient, proceed (v0.8.34 handoff hit this).
+- **First-time-at-cut failures are REAL (v0.8.34):** this serial suite runs tests PR CI never does — `exit-gate.corpus` (dialect-catalog conformance over real harvested chunks) surfaces yaml-schema drift (e.g. an array prop missing `items.type`, the command/combobox `DynamicStringList` mis-map) only HERE, potentially weeks after the yaml edit merged green. Treat such a failure as a genuine latent defect to root-cause at the yaml SoT, never as release-blocking noise. (Structural fix — promoting the corpus batch into PR CI — tracked as a follow-up.)
 
 ### `npm run eval:diff -- --engine zettel`
 
@@ -202,7 +204,7 @@ npm run check:demo-shells
 
 Add `verify:corpus` + `check:embeddings-fresh` if chunks were touched; `check:lightningcss-build` if CSS was touched; F-N1 if unpushed release tags exist.
 
-**Full pre-cut sweep** — the 24-gate roster in [`cut-procedure.md`](cut-procedure.md) §Step 3, sourced from `` `${CLAUDE_PLUGIN_ROOT}/skills/adia-release/scripts/gate-roster.mjs` `` (the ONE list; `release-pack.mjs` imports and runs it in full — a subset run is impossible without editing that file). ~90s wall time.
+**Full pre-cut sweep** — the 28-gate roster in [`cut-procedure.md`](cut-procedure.md) §Step 3, sourced from `` `${CLAUDE_PLUGIN_ROOT}/skills/adia-release/scripts/gate-roster.mjs` `` (the ONE list; `release-pack.mjs` imports and runs it in full — a subset run is impossible without editing that file). ~90s wall time.
 
 **Omnibus** — `npm run check` invokes everything. Heavy; use when re-baselining a stale checkout.
 

package/skills/adia-release/references/independent-package-release.md

@@ -2,12 +2,16 @@
 
 > Load when releasing a package versioned **independently** of the lockstep set —
 > excluded from the lockstep gate, no umbrella tag, no demo-site deploy.
-> **Class B currently has NO members** (2026-07-15 policy change, operator
-> ruling): the Claude Code plugins under `packages/plugins/*` joined the
-> lockstep after class-B independence let npm drift a full harness-reset
-> behind the repo (npm served forge 0.1.3/factory 0.2.4 pre-reset content
-> while the rewritten estate sat unpublished at a regressed 0.1.0). This
-> procedure is retained for future genuinely-independent packages. The
+> **Class B's current member is `@adia-ai/adia-plugins`** (gh#1133/gh#1160,
+> ADR-0045) — the npm-sourced marketplace manifest package, marked
+> `lockstep: false` on the roster (`scripts/package-paths.mjs`). It's the
+> first member since the 2026-07-15 policy change (operator ruling) that
+> emptied the class: the Claude Code plugins under `packages/plugins/*`
+> joined the lockstep after class-B independence let npm drift a full
+> harness-reset behind the repo (npm served forge 0.1.3/factory 0.2.4
+> pre-reset content while the rewritten estate sat unpublished at a
+> regressed 0.1.0). This procedure covers both onboarding a NEW class-B
+> package and a routine cut of an existing one (adia-plugins). The
 > lockstep cut is [`cut-procedure.md`](cut-procedure.md).
 
 ## §Two release classes in one monorepo
@@ -15,7 +19,7 @@
 | | Class A — lockstep cut | Class B — independent package |
 | --- | --- | --- |
 | Versioning | whole set bumps together | own version line per package |
-| Lockstep gate | enforced (`check:lockstep` 11/11) | **excluded** — a class-B package is not listed in `check-lockstep.mjs`'s `PACKAGES` (none currently exist; `packages/plugins/*` joined class A 2026-07-15) |
+| Lockstep gate | enforced (`check:lockstep` 13/13) | **excluded** — a class-B package is not listed in `check-lockstep.mjs`'s `PACKAGES` (`adia-plugins`, the current member, is filtered out via `lockstep: false` — `scripts/package-paths.mjs`) |
 | Umbrella tag | `vX.Y.Z` + per-package | **none** — per-package tags only (versions differ) |
 | `dist-tag` ordering | cross-package publish order matters | N/A |
 | Demo-site deploy | yes | **none** |
@@ -39,11 +43,11 @@ Substrate fixes (release scripts / lockfile / CHANGELOG), landed once as a norma
 4. **Tag at the published commit** — `git tag <pkg>-vX.Y.Z` per package; versions differ; no umbrella. Dry-run the trip-wire over the tags (`node scripts/release/check-release.mjs <tags>`) before pushing. If the shared working tree is on a peer's branch, push tags from a throwaway worktree on `origin/main`.
 5. **Push the tags** → the per-package workflows run `npm ci → verify:plugins → npm publish --access public`.
 6. **Verify against npm, not the workflow:** `npm view @adia-ai/<pkg> version` returns the new independent version for each package. Watch runs (`gh run watch <id> --exit-status`), but the registry is the source of truth.
-7. **Marketplace cut-over** (if a plugin marketplace repo exists): point the manifest's per-plugin `source` at npm (`{ "source": "npm", "package": "@adia-ai/<pkg>" }`), `git rm -r` vendored copies, validate the JSON, commit, push. Consumers then `/plugin marketplace add <org>/<repo>` → `/plugin install <pkg>@<repo>`.
+7. **Marketplace cut-over** — per ADR-0045 the distribution channel is the npm-sourced manifest package `@adia-ai/adia-plugins` (no public git marketplace repo — that shape was considered and rejected). Bump/publish the manifest package so its `marketplace.json` entries reference the new plugin versions; consumers add the marketplace from npm, never from a git repo.
 
 ## §Verify target
 
-The published package(s) on the **npm registry** at their independent versions, plus (if a marketplace exists) its manifest referencing npm. NOT "all 11 + the demo site" — that's class A.
+The published package(s) on the **npm registry** at their independent versions, plus the npm-published `@adia-ai/adia-plugins` manifest referencing the new versions (ADR-0045). NOT "all 13 lockstep packages + the demo site" — that's class A.
 
 ## §Gotchas (from the first independent cut, factory v0.2.2 + forge v0.1.2)
 

package/skills/adia-release/references/recovery-paths.md

@@ -17,7 +17,7 @@
 
 1. Verify the skip: `npm view <pkg> versions --json | tail` (no X+1 on npm) + `git tag --list 'vX.Y.*'` (no tags). Run pre-flight at the peer's commit to confirm it's shippable.
 2. Correct the version via a **new commit on top** (not amend — the peer's commit stays for history).
-3. Sweep every occurrence of the wrong version: 9 × package.json, 9 × CHANGELOG (headers + body refs), any doc/CSS-comment refs, then regenerate the lockfile. Preserve filename references that intentionally encode the original label.
+3. Sweep every occurrence of the wrong version: 13 × package.json, 13 × CHANGELOG (headers + body refs — the lockstep roster, `scripts/package-paths.mjs`), any doc/CSS-comment refs, then regenerate the lockfile. Preserve filename references that intentionally encode the original label.
 4. Commit as `fix(release): correct vX.Y.Z+1 version-skip → vX.Y.Z` documenting the discovery, then resume [`cut-procedure.md`](cut-procedure.md) at Step 5.
 
 ## §Scenario 2 — Batch push
@@ -63,7 +63,7 @@
 
 ## §Scenario 7 — Tags pushed, ZERO publish workflows fired
 
-**Shape:** all 12 tags exist on origin, but no `publish-<pkg>.yml` run exists for them; npm latest unchanged; nothing errored.
+**Shape:** all 14 tags exist on origin (umbrella + one per lockstep-roster package — `scripts/package-paths.mjs`), but no `publish-<pkg>.yml` run exists for them; npm latest unchanged; nothing errored.
 
 **Root cause:** pushing many tags in **one** `git push` fires a single batched create event that GitHub Actions routinely drops. Re-pushing is a no-op (the tags already exist remotely).
 

package/skills/adia-release/scripts/bump.mjs

@@ -20,17 +20,21 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import process from 'node:process';
-import { PACKAGE_DIRS, PACKAGE_ROSTER } from './package-paths.mjs';
+import { PACKAGE_ROSTER } from './package-paths.mjs';
 
 // Single-sourced roster (H3, package-paths.mjs). Each plugin also carries a
 // .claude-plugin/plugin.json whose version MUST move with package.json —
 // plugin.json is the /plugin-update cache key (verify:plugins gates the sync).
-const PACKAGES = PACKAGE_DIRS;
+// Filtered to `lockstep !== false`: a class-B package (gh#1133's
+// adia-plugins) bumps on its own independent version line, never via this
+// lockstep --from/--to sweep. See package-paths.mjs's `lockstep` field note.
+const LOCKSTEP_ROSTER = PACKAGE_ROSTER.filter((p) => p.lockstep !== false);
+const PACKAGES = LOCKSTEP_ROSTER.map((p) => p.dir);
 
 // Sibling manifests bumped in the same pass as package.json (path relative to
 // the package dir) — derived from the roster's plugin flag.
 const SIBLING_MANIFESTS = Object.fromEntries(
-  PACKAGE_ROSTER.filter((p) => p.plugin).map((p) => [p.dir, '.claude-plugin/plugin.json']),
+  LOCKSTEP_ROSTER.filter((p) => p.plugin).map((p) => [p.dir, '.claude-plugin/plugin.json']),
 );
 
 // Cross-package EXACT pins bumped in the same pass — a different shape from a

package/skills/adia-release/scripts/dispatch-publish.mjs

@@ -20,14 +20,17 @@
 import { execFileSync } from 'node:child_process';
 import process from 'node:process';
 import { assertMonorepoRoot } from './assert-monorepo-root.mjs';
-import { PACKAGE_NAMES } from './package-paths.mjs';
+import { PACKAGE_ROSTER } from './package-paths.mjs';
 
 // Instance data — fork-configurable. The npm scope the lockstep roster publishes under.
 // Default preserves @adia-ai behavior; override via --scope or $ADIA_NPM_SCOPE.
 const DEFAULT_SCOPE = '@adia-ai';
 
 // Single-sourced roster (H3, package-paths.mjs); order = dispatch order.
-const PACKAGES = PACKAGE_NAMES;
+// Filtered to `lockstep !== false`: a class-B package (gh#1133's
+// adia-plugins) publishes via its own manual cut (independent-package-
+// release.md), never this lockstep dispatch loop.
+const PACKAGES = PACKAGE_ROSTER.filter((p) => p.lockstep !== false).map((p) => p.name);
 
 function parseArgs(argv) {
   const args = {

package/skills/adia-release/scripts/gate-roster.mjs

@@ -64,6 +64,35 @@ export const GATE_ROSTER = [
   // v0.7.13-retro hygiene checker — README CDN pins / "Current version"
   // claims vs the cut version; branch/worktree limbo prints as warns (H2).
   { n: 24, cmd: 'node scripts/release/check-cut-hygiene.mjs',  what: 'README CDN-pin + version currency', versionArg: true },
+  // gh#1132 (factory-dx-ws1-boot SPEC, REQ-04): npm-packs BOTH
+  // @adia-ai/web-components and @adia-ai/web-modules and resolves every
+  // specifier the scaffold templates emit against the extracted tarballs'
+  // real exports maps — the same blast radius gh#296's
+  // exports-wildcard-resolution.mjs gate covers, applied to the factory
+  // plugin's own templates instead of a consumer's hand-written import.
+  { n: 25, cmd: 'python3 packages/plugins/adia-ui-factory/scripts/adia-scaffold selftest', what: 'scaffold specifiers resolve in packed tarballs' },
+  // gh#1137 (factory-dx-ws6-measurement SPEC, REQ-05) — FLAGGED FOR
+  // CONFIRMATION: this entry was authored by the WS-6 build without a live
+  // adia-release sign-off (no operator was available mid-build to confirm
+  // the exact freshness window / regression semantics). Asserts a
+  // qa/dx/sweeps/ record exists dated within this cut's window AND its
+  // verdict is not a regression-RED (a plain floors<=1 baseline RED does
+  // NOT block a cut — only a floor that DROPPED since the prior sweep
+  // does). CONFIRMED by adia-release on the first live cut (v0.8.35,
+  // 2026-08-13): semantics hold, with one correction — the previous-cut
+  // comparison excludes the in-flight target version (self-reference fired
+  // on the handoff re-run, since the promoted heading was already on main).
+  { n: 26, cmd: 'node scripts/release/check-dx-sweep-freshness.mjs', targetVersionArg: true, what: 'DX sweep fresh + not regression-RED' },
+  // gh#1135 (WS-4 SPEC REQ-06): a fresh free-form eval run feeds the health
+  // record gate 28 writes — without it, "latest" under evals/mcp/runs/ could
+  // be a stale leftover from an earlier ad-hoc run, not this cut's own state.
+  { n: 27, cmd: 'npm run eval:diff -- --engine free-form',   what: 'fresh free-form eval run (evals/health input)' },
+  // REQ-06: commits evals/health/<version>.json — the version this record
+  // names is the CUT's target version from the start, never the
+  // pre/post-bump `hygieneVersion` gate 24 needs (a claim-validation
+  // concern this is not) — hence `targetVersionArg` rather than
+  // `versionArg`, a distinct flag release-pack.mjs's step3PreFlight reads.
+  { n: 28, cmd: 'node scripts/release/write-eval-health.mjs', what: 'evals/health/<version>.json committed, AC-01/AC-02 run for real', targetVersionArg: true },
 ];
 
 // -- CLI ------------------------------------------------------------------

package/skills/adia-release/scripts/package-paths.mjs

@@ -42,24 +42,52 @@ import path from 'node:path';
 // Order is the canonical publish/tag order (release-pack's historical order);
 // consumers needing a different ordering (check-lockstep sorts by path for
 // stable output) re-sort locally.
+//
+// `lockstep` (added gh#1133, onboarding the first class-B member since the
+// 2026-07-15 policy emptied that class — independent-package-release.md):
+// `true` (or omitted — every pre-2026-08 entry defaults true below) means the
+// package rides the coordinated cut — version-match/caret gate
+// (check-lockstep.mjs), the umbrella tag, the --pending-version sweep, bump.mjs's
+// --from/--to pass, the dispatch-publish loop, and generate-release-notes.mjs's
+// notes. `false` means class B: its own version line, its own manual tag +
+// publish (independent-package-release.md), NEVER the umbrella tag or a
+// lockstep bump/dispatch/notes pass. The ONE exception: the F-N1 release
+// trip-wire (check-release.mjs's per-tag `checkTag` lookup) reads the FULL
+// roster unfiltered — every pushed tag, lockstep or not, still needs its
+// package.json/CHANGELOG validated, so it must recognize a class-B tag too.
+// Every lockstep-scoped consumer must filter `p.lockstep !== false` itself
+// (this module intentionally does NOT pre-filter PACKAGE_NAMES/PACKAGE_DIRS —
+// they stay full-roster projections so a consumer's own filter is visible at
+// its point of use, not hidden upstream).
 export const PACKAGE_ROSTER = [
-  { name: 'web-components',  dir: 'packages/web-components' },
-  { name: 'web-modules',     dir: 'packages/web-modules' },
-  { name: 'llm',             dir: 'packages/llm' },
-  { name: 'agent',           dir: 'packages/agent' },
-  { name: 'persona',         dir: 'packages/persona' },
-  { name: 'a2ui-runtime',    dir: 'packages/a2ui/runtime' },
-  { name: 'a2ui-compose',    dir: 'packages/a2ui/compose' },
-  { name: 'a2ui-corpus',     dir: 'packages/a2ui/corpus' },
-  { name: 'a2ui-mcp',        dir: 'packages/a2ui/mcp' },
-  { name: 'a2ui-retrieval',  dir: 'packages/a2ui/retrieval' },
-  { name: 'a2ui-validator',  dir: 'packages/a2ui/validator' },
+  { name: 'web-components',  dir: 'packages/web-components',           lockstep: true },
+  { name: 'web-modules',     dir: 'packages/web-modules',               lockstep: true },
+  { name: 'llm',             dir: 'packages/llm',                       lockstep: true },
+  { name: 'agent',           dir: 'packages/agent',                     lockstep: true },
+  { name: 'persona',         dir: 'packages/persona',                   lockstep: true },
+  { name: 'a2ui-runtime',    dir: 'packages/a2ui/runtime',              lockstep: true },
+  { name: 'a2ui-compose',    dir: 'packages/a2ui/compose',              lockstep: true },
+  { name: 'a2ui-corpus',     dir: 'packages/a2ui/corpus',               lockstep: true },
+  { name: 'a2ui-mcp',        dir: 'packages/a2ui/mcp',                  lockstep: true },
+  { name: 'a2ui-retrieval',  dir: 'packages/a2ui/retrieval',            lockstep: true },
+  { name: 'a2ui-validator',  dir: 'packages/a2ui/validator',            lockstep: true },
   // Plugins joined the lockstep 2026-07-15 (check-lockstep.mjs POLICY note);
   // each carries a .claude-plugin/plugin.json that bumps with package.json.
-  { name: 'adia-ui-factory', dir: 'packages/plugins/adia-ui-factory', plugin: true },
-  { name: 'adia-ui-forge',   dir: 'packages/plugins/adia-ui-forge',   plugin: true },
+  { name: 'adia-ui-factory', dir: 'packages/plugins/adia-ui-factory',   lockstep: true, plugin: true },
+  { name: 'adia-ui-forge',   dir: 'packages/plugins/adia-ui-forge',     lockstep: true, plugin: true },
+  // adia-plugins is class B (gh#1133, ADR-0045/spec-factory-dx-ws2): the npm-
+  // sourced marketplace manifest package. No lockstep content (a roster of
+  // npm sources, no code) and REQ-03's unpinned sources mean it republishes
+  // only on its own roster change — cuts independently, own version line,
+  // never the umbrella tag. Not a Claude Code plugin itself (no `plugin.json`
+  // sidecar), so no `plugin: true`.
+  { name: 'adia-plugins',    dir: 'packages/plugins/adia-plugins',      lockstep: false },
 ];
 
+// Full-roster projections — every registered package, lockstep or not. A
+// lockstep-scoped consumer (bump, tag-lockstep, dispatch-publish, the
+// version-match gate, the notes generator, the docs gate) must filter
+// `.lockstep !== false` itself; see the `lockstep` field note above.
 export const PACKAGE_NAMES = PACKAGE_ROSTER.map((p) => p.name);
 export const PACKAGE_DIRS = PACKAGE_ROSTER.map((p) => p.dir);