@adia-ai/adia-ui-forge 0.8.35 → 0.8.36

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "adia-ui-kit-forge",
-  "version": "0.8.35",
+  "version": "0.8.36",
   "description": "Maintain the adia-ui (@adia-ai) framework itself \u2014 author primitives and shells, run the A2UI generation pipeline and its corpus, review gen-UI quality, sweep QA, cut releases, deploy. The maintainer counterpart to adia-factory (the consumer/app-author plugin).",
   "author": {
     "name": "Kim",

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog — adia-ui-kit-forge
 
+## [0.8.36] — 2026-08-13
+
+### Maintenance
+- **Lockstep version bump only.** No source changes in this package; bumped to maintain the lockstep version coherence enforced by `scripts/release/check-lockstep.mjs`. Substantive v0.8.36 work shipped in a2ui chain standalone-installable (gh#1186: unpublishable dep removed, 143 packed-import escapes fixed, packed-imports gate + boot probe) + ui-architect coordinator agent + MCP doc consolidation. See `packages/a2ui/mcp/CHANGELOG.md#0836--2026-08-13` for details.
+- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`skills/` touched in this release window** (6 file(s), e.g. `adia-release/SKILL.md`) — carried by the entries above.
+
 ## [0.8.35] — 2026-08-13
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adia-ai/adia-ui-forge",
-  "version": "0.8.35",
+  "version": "0.8.36",
   "description": "Maintain the adia-ui (@adia-ai) framework itself \u2014 author primitives and shells, run the A2UI generation pipeline and its corpus, review gen-UI quality, sweep QA, cut releases, deploy. The maintainer counterpart to adia-factory (the consumer/app-author plugin).",
   "keywords": [
     "adia-ui",

package/skills/adia-release/SKILL.md

@@ -3,8 +3,9 @@ name: adia-release
 description: >-
   Release engineering for the @adia-ai lockstep monorepo. Use when asked to
   cut and ship a release, promote [Unreleased] CHANGELOG entries, tag and push the
-  lockstep packages to origin, publish a 13-package release (11 npm
-  libraries + 2 Claude Code plugins), batch-push piled-up release commits,
+  lockstep packages to origin, publish a 13-package release (11
+  npm libraries + 2 Claude Code plugins, as of gh#607 — see
+  scripts/package-paths.mjs), batch-push piled-up release commits,
   recover a cut that landed wrong or whose publish workflows didn't fire,
   fix a check:lockstep bump failure or an F-N1 CHANGELOG-coverage warning,
   verify the release gates without cutting anything, or author release
@@ -17,7 +18,7 @@ user-invocable: true
 
 # adia-release
 
-Release engineering for an @adia-ai-style lockstep monorepo: the `@adia-ai/*` packages on the roster (`scripts/package-paths.mjs`, the single source — 13 as of gh#607: 11 npm libraries plus the 2 Claude Code plugins under `packages/plugins/*`) version and publish together (class A; the plugins joined the lockstep 2026-07-15 after class-B independence let npm drift a full harness-reset behind the repo). Class B (independent versioning) currently has no members; the procedure is retained for future genuinely-independent packages. The substrate — `scripts/release/*`, the `check:*` gates, the tag-triggered publish workflows — encodes the invariants; this skill routes, sequences, and stops at the judgment calls.
+Release engineering for an @adia-ai-style lockstep monorepo: the `@adia-ai/*` packages on the roster (`scripts/package-paths.mjs`, the single source — 13 lockstep as of gh#607: 11 npm libraries plus the 2 Claude Code plugins under `packages/plugins/*`) version and publish together (class A; the plugins joined the lockstep 2026-07-15 after class-B independence let npm drift a full harness-reset behind the repo). Class B (independent versioning) has one member — `@adia-ai/adia-plugins` (gh#1133/gh#1160, ADR-0045), the npm-sourced marketplace manifest package, marked `lockstep: false` on the roster; it cuts on its own version line and its own tag, never the umbrella ([`references/independent-package-release.md`](references/independent-package-release.md)). The substrate — `scripts/release/*`, the `check:*` gates, the tag-triggered publish workflows — encodes the invariants; this skill routes, sequences, and stops at the judgment calls.
 
 ## Authorization — one go, gates do the rest (operator ruling 2026-07-17)
 
@@ -34,7 +35,7 @@ Mechanics: `release-pack.mjs --go` auto-confirms all checkpoints (it equals `--y
 1. **Lockstep coherence** — every roster package bumps together (`check:lockstep`; the roster lives in `scripts/package-paths.mjs`, currently `web-components`, `web-modules`, `llm`, `agent`, `persona`, `a2ui-{runtime,compose,corpus,mcp,retrieval,validator}`, and the plugins `adia-ui-{factory,forge}`) (each plugin's `.claude-plugin/plugin.json` version moves with its package.json — `bump.mjs` handles both; `verify:plugins` gates the sync).
 2. **PATCH-cut asymmetry** — internal `@adia-ai/*` ranges hold at `^X.Y.0` during PATCH cuts; only MINOR bumps the floor. `^0.0.x` is forbidden (pre-1.0 caret locks exact — shipped a real stale-sibling bug).
 3. **Release commits land via PR, never a direct push to `main`** (repo policy, operator ruling 2026-07-12): commit on `release/vX.Y.Z` → PR → CI → merge — THEN tag at `main`'s post-merge HEAD, not at the bump commit; post-bump fixes merge before tagging and belong in the tarball. Exception: batch push tags each version at its own release-merge SHA.
-4. **One umbrella + one per-package tag per cut** (`vX.Y.Z` + 11 × `<pkg>-vX.Y.Z`); publish workflows key off the per-package tags. Push tags **one per `git push`** — a batched multi-tag push drops the trigger event.
+4. **One umbrella + one per-package tag per cut** (`vX.Y.Z` + 13 × `<pkg>-vX.Y.Z`, one per lockstep-roster package — `scripts/package-paths.mjs`); publish workflows key off the per-package tags. Push tags **one per `git push`** — a batched multi-tag push drops the trigger event.
 5. **F-N1 (`check:release --all-pending`) per-package clean** — the umbrella-tag mismatch error is expected noise. Coverage is mechanized at cut time: Step 4f (`check-release.mjs --pending-version X.Y.Z --fix`) runs the SAME matcher pre-PR and auto-appends verified Maintenance bullets, so a post-tag warn means something novel — stop and investigate, don't loop enrichment PRs.
 6. **`npm dist-tag latest` is set by publish order** — batch pushes publish oldest first and WAIT for settle.
 7. **A breaking (MINOR) cut MUST ship its MIGRATION GUIDE section in the same cycle** — MINOR is reserved for removed/renamed API symbols; everything else, including visible behavior changes, stays PATCH.
@@ -58,7 +59,7 @@ The release is done only when reality confirms it: **the npm registry, the GH re
 
 | Task shape | Done when |
 | --- | --- |
-| Lockstep cut / handoff | `npm view @adia-ai/<pkg> version` = X.Y.Z for all 11 AND `dist-tags.latest` = X.Y.Z AND a deployed content file (not an SPA route) serves real bytes |
+| Lockstep cut / handoff | `npm view @adia-ai/<pkg> version` = X.Y.Z for all 13 lockstep packages AND `dist-tags.latest` = X.Y.Z AND a deployed content file (not an SPA route) serves real bytes |
 | Batch push | every batched tag on `git ls-remote --tags origin` + every version on the registry, `latest` on the newest |
 | Verify-only | the failing gate re-runs green |
 | Recovery | the trip-wire that surfaced the issue passes |
@@ -74,7 +75,7 @@ Every cut reports, whether it ran inline or via `release-builder`:
 | --- | --- |
 | Version | X.Y.Z — all roster packages at this version (`check:lockstep`) |
 | Commit / PR | release commit SHA, PR # (merged) |
-| Tags | umbrella `vX.Y.Z` + 11 per-package tags pushed (or: which are still pending, and why) |
+| Tags | umbrella `vX.Y.Z` + 13 per-package tags pushed (or: which are still pending, and why) |
 | Registry | `npm view @adia-ai/<pkg> version` per package, cited (not "publish workflow green") |
 | `dist-tags.latest` | confirmed = X.Y.Z |
 | Deploy | dispatched (`deploy-site.yml` run URL) / N/A this cut |

package/skills/adia-release/references/cut-procedure.md

@@ -4,8 +4,9 @@
 > handoff). Companions: [`gates-catalog.md`](gates-catalog.md) (gate roster +
 > failure routing), [`changelog-discipline.md`](changelog-discipline.md) (promotion
 > + F-N1 enrichment), [`recovery-paths.md`](recovery-paths.md) (when it goes wrong).
-> The concrete gate names, 9 package paths, and `ui-kit.exe.xyz` deploy are the
-> @adia-ai monorepo's worked example of the portable discipline. `$REPO` = repo root.
+> The concrete gate names, the roster's package paths (`scripts/package-paths.mjs`,
+> 13 lockstep as of gh#607), and `ui-kit.exe.xyz` deploy are the @adia-ai
+> monorepo's worked example of the portable discipline. `$REPO` = repo root.
 
 Two entry variants, converging at Step 5:
 
@@ -270,7 +271,7 @@ The operator's initiating instruction covers the whole cycle — no per-step re-
 
 | Evidence logged before | Content | Why it's still printed |
 | --- | --- | --- |
-| Tagging (Step 6) | The planned tag list (umbrella + 11 per-package) | The log line a recovery diagnoses from |
+| Tagging (Step 6) | The planned tag list (umbrella + 13 per-package) | The log line a recovery diagnoses from |
 | Pushing (Step 8) | The Step 7 F-N1 output + tag list + `origin/main..HEAD` count | F-N1's first real evidence — and its ERROR path still hard-stops unconditionally |
 | Publishing (Step 9) | The current registry snapshot (versions + `dist-tags.latest`) | Ordering is verified against what's LIVE, mechanically |
 | Deploying (Step 10) | The `deploy-site.yml` dispatch (never a raw rsync) | The workflow carries its own GitHub-environment human gate |
@@ -285,7 +286,7 @@ After the bump + lockfile, run the AUTHORITATIVE F-N1 matcher against the workin
 node scripts/release/check-release.mjs --pending-version X.Y.Z --fix
 ```
 
-Stage its CHANGELOG edits into the release commit (the Step-5 allowlist already covers `CHANGELOG.md`). It re-verifies its own output with the same matcher before writing — a `--fix` that doesn't satisfy the checker is a hard error, not a silent pass. Do NOT use `check-changelog-coverage.mjs` as the pre-tag gate: it carries a different matcher and a 9-package roster missing the 2 plugins — the drift that cost the v0.8.5 cut 3 enrichment PRs and 3 tag rewrites after "coverage clean" at cut time.
+Stage its CHANGELOG edits into the release commit (the Step-5 allowlist already covers `CHANGELOG.md`). It re-verifies its own output with the same matcher before writing — a `--fix` that doesn't satisfy the checker is a hard error, not a silent pass. (The former `check:changelog-coverage` gate — a different matcher and a 9-package roster missing the 2 plugins — cost the v0.8.5 cut 3 enrichment PRs and 3 tag rewrites after "coverage clean" at cut time; it was deleted 2026-07-19, so `check-release.mjs --pending-version` is now the only pre-tag coverage check.)
 
 ## §Step 6 — Tag
 
@@ -293,7 +294,7 @@ Log the planned tag list (evidence table above), then tag **at `main`'s post-mer
 
 ```bash
 node "${CLAUDE_PLUGIN_ROOT}/skills/adia-release/scripts/tag-lockstep.mjs" \
-  --version X.Y.Z                        # umbrella vX.Y.Z + 11 <pkg>-vX.Y.Z (incl. the 2 plugins, 2026-07-15 policy)
+  --version X.Y.Z                        # umbrella vX.Y.Z + 13 <pkg>-vX.Y.Z (11 npm + 2 plugins, 2026-07-15 policy)
 ```
 
 ## §Step 7 — F-N1 release trip-wire
@@ -334,8 +335,9 @@ node "${CLAUDE_PLUGIN_ROOT}/skills/adia-release/scripts/dispatch-publish.mjs" \
 Wait for the workflows to settle, then verify against the **registry**, never the workflow's green check:
 
 ```bash
-for pkg in web-components web-modules llm a2ui-runtime a2ui-compose a2ui-corpus \
-           a2ui-mcp a2ui-retrieval a2ui-validator adia-ui-factory adia-ui-forge; do
+for pkg in web-components web-modules llm agent persona a2ui-runtime a2ui-compose \
+           a2ui-corpus a2ui-mcp a2ui-retrieval a2ui-validator adia-ui-factory \
+           adia-ui-forge; do
   echo -n "$pkg: "; npm view "@adia-ai/$pkg" version
 done
 npm view @adia-ai/web-components dist-tags.latest   # must equal X.Y.Z
@@ -346,7 +348,9 @@ Zero workflows fired after a tag push → [`recovery-paths.md`](recovery-paths.m
 ## §Step 10 — GH releases + site deploy dispatch
 
 ```bash
-for pkg in <the 9>; do
+for pkg in web-components web-modules llm agent persona a2ui-runtime a2ui-compose \
+           a2ui-corpus a2ui-mcp a2ui-retrieval a2ui-validator adia-ui-factory \
+           adia-ui-forge; do
   gh release create "$pkg-vX.Y.Z" --title "@adia-ai/$pkg vX.Y.Z" --notes-file <body>.md
 done
 # Site deploy goes through the pipeline, never a raw rsync. The dispatch is

package/skills/adia-release/references/gates-catalog.md

@@ -14,7 +14,7 @@ Row layout per gate: **What** · **Typical failure** · **Recovery**.
 
 ### `npm run check:lockstep`
 
-- **What:** all 11 `@adia-ai/*` packages declare the same `version`; internal `@adia-ai/*` dep ranges match policy (`^X.Y.0` during PATCH cycles, bumped at MINOR).
+- **What:** all 13 lockstep `@adia-ai/*` packages declare the same `version` (the class-B `adia-plugins` package is excluded — `lockstep: false`, `scripts/package-paths.mjs`); internal `@adia-ai/*` dep ranges match policy (`^X.Y.0` during PATCH cycles, bumped at MINOR).
 - **Typical failure:** one package forgot to bump; a peer edited an internal range mid-PATCH; a `^0.0.x` range slipped in.
 - **Recovery:** version drift → `` `${CLAUDE_PLUGIN_ROOT}/skills/adia-release/scripts/bump.mjs` ``; range drift → `npm run check:lockstep:fix` auto-aligns, then re-run.
 - **Why `^0.0.x` is forbidden:** npm pre-1.0 semver only widens the caret when major+minor aren't both zero — `^0.0.6` resolves to `>=0.0.6 <0.0.7`, locked to exactly 0.0.6. An internal dep pinned that way silently installs a *stale* sibling on every fresh `npm i` (this shipped a real ~4-day-latent bug before the lockstep policy). The `^X.Y.0` floor (Y≥1) widens correctly across patches; trust the gate, don't reason about caret semantics by hand. Moot at 1.0.0.

package/skills/adia-release/references/independent-package-release.md

@@ -2,12 +2,16 @@
 
 > Load when releasing a package versioned **independently** of the lockstep set —
 > excluded from the lockstep gate, no umbrella tag, no demo-site deploy.
-> **Class B currently has NO members** (2026-07-15 policy change, operator
-> ruling): the Claude Code plugins under `packages/plugins/*` joined the
-> lockstep after class-B independence let npm drift a full harness-reset
-> behind the repo (npm served forge 0.1.3/factory 0.2.4 pre-reset content
-> while the rewritten estate sat unpublished at a regressed 0.1.0). This
-> procedure is retained for future genuinely-independent packages. The
+> **Class B's current member is `@adia-ai/adia-plugins`** (gh#1133/gh#1160,
+> ADR-0045) — the npm-sourced marketplace manifest package, marked
+> `lockstep: false` on the roster (`scripts/package-paths.mjs`). It's the
+> first member since the 2026-07-15 policy change (operator ruling) that
+> emptied the class: the Claude Code plugins under `packages/plugins/*`
+> joined the lockstep after class-B independence let npm drift a full
+> harness-reset behind the repo (npm served forge 0.1.3/factory 0.2.4
+> pre-reset content while the rewritten estate sat unpublished at a
+> regressed 0.1.0). This procedure covers both onboarding a NEW class-B
+> package and a routine cut of an existing one (adia-plugins). The
 > lockstep cut is [`cut-procedure.md`](cut-procedure.md).
 
 ## §Two release classes in one monorepo
@@ -15,7 +19,7 @@
 | | Class A — lockstep cut | Class B — independent package |
 | --- | --- | --- |
 | Versioning | whole set bumps together | own version line per package |
-| Lockstep gate | enforced (`check:lockstep` 11/11) | **excluded** — a class-B package is not listed in `check-lockstep.mjs`'s `PACKAGES` (none currently exist; `packages/plugins/*` joined class A 2026-07-15) |
+| Lockstep gate | enforced (`check:lockstep` 13/13) | **excluded** — a class-B package is not listed in `check-lockstep.mjs`'s `PACKAGES` (`adia-plugins`, the current member, is filtered out via `lockstep: false` — `scripts/package-paths.mjs`) |
 | Umbrella tag | `vX.Y.Z` + per-package | **none** — per-package tags only (versions differ) |
 | `dist-tag` ordering | cross-package publish order matters | N/A |
 | Demo-site deploy | yes | **none** |
@@ -43,7 +47,7 @@ Substrate fixes (release scripts / lockfile / CHANGELOG), landed once as a norma
 
 ## §Verify target
 
-The published package(s) on the **npm registry** at their independent versions, plus the npm-published `@adia-ai/adia-plugins` manifest referencing the new versions (ADR-0045). NOT "all 11 + the demo site" — that's class A.
+The published package(s) on the **npm registry** at their independent versions, plus the npm-published `@adia-ai/adia-plugins` manifest referencing the new versions (ADR-0045). NOT "all 13 lockstep packages + the demo site" — that's class A.
 
 ## §Gotchas (from the first independent cut, factory v0.2.2 + forge v0.1.2)
 

package/skills/adia-release/references/recovery-paths.md

@@ -17,7 +17,7 @@
 
 1. Verify the skip: `npm view <pkg> versions --json | tail` (no X+1 on npm) + `git tag --list 'vX.Y.*'` (no tags). Run pre-flight at the peer's commit to confirm it's shippable.
 2. Correct the version via a **new commit on top** (not amend — the peer's commit stays for history).
-3. Sweep every occurrence of the wrong version: 9 × package.json, 9 × CHANGELOG (headers + body refs), any doc/CSS-comment refs, then regenerate the lockfile. Preserve filename references that intentionally encode the original label.
+3. Sweep every occurrence of the wrong version: 13 × package.json, 13 × CHANGELOG (headers + body refs — the lockstep roster, `scripts/package-paths.mjs`), any doc/CSS-comment refs, then regenerate the lockfile. Preserve filename references that intentionally encode the original label.
 4. Commit as `fix(release): correct vX.Y.Z+1 version-skip → vX.Y.Z` documenting the discovery, then resume [`cut-procedure.md`](cut-procedure.md) at Step 5.
 
 ## §Scenario 2 — Batch push
@@ -63,7 +63,7 @@
 
 ## §Scenario 7 — Tags pushed, ZERO publish workflows fired
 
-**Shape:** all 12 tags exist on origin, but no `publish-<pkg>.yml` run exists for them; npm latest unchanged; nothing errored.
+**Shape:** all 14 tags exist on origin (umbrella + one per lockstep-roster package — `scripts/package-paths.mjs`), but no `publish-<pkg>.yml` run exists for them; npm latest unchanged; nothing errored.
 
 **Root cause:** pushing many tags in **one** `git push` fires a single batched create event that GitHub Actions routinely drops. Re-pushing is a no-op (the tags already exist remotely).