@adia-ai/adia-ui-forge 0.8.57 → 0.8.59

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "adia-ui-kit-forge",
-  "version": "0.8.57",
+  "version": "0.8.59",
   "description": "Maintain the adia-ui (@adia-ai) framework itself \u2014 author primitives and shells, run the A2UI generation pipeline and its corpus, review gen-UI quality, sweep QA, cut releases, deploy. The maintainer counterpart to adia-ui-kit-factory (the consumer/app-author plugin).",
   "author": {
     "name": "Kim",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "adia-ui-kit-forge",
-  "version": "0.8.57",
+  "version": "0.8.59",
   "description": "Maintain the adia-ui (@adia-ai) framework itself — author primitives and shells, run the A2UI generation pipeline and its corpus, review gen-UI quality, sweep QA, cut releases, deploy. The maintainer counterpart to adia-ui-kit-factory (the consumer/app-author plugin).",
   "author": {
     "name": "Kim",

package/CHANGELOG.md

@@ -1,5 +1,69 @@
 # Changelog — adia-ui-kit-forge
 
+## [0.8.59] — 2026-09-04
+
+### Added
+- **`package-release`'s cut procedure gains Step 4a-pre: assemble `changes/<pr>.md` fragments into the right CHANGELOG's `[Unreleased]` before promotion (gh#2931).** New repo-root `scripts/release/assemble-changelog-fragments.mjs` (own selftest) reads every queued fragment, routes it to a package's own CHANGELOG (via an optional `(<package>)` parenthetical naming a `PACKAGE_ROSTER` entry) or the repo-root CHANGELOG.md (the plain, no-parenthetical form — every fragment filed to date), appends under the kind-mapped Keep-a-Changelog subsection (feature→Added, fix→Fixed, chore→Changed, docs→Docs), then deletes the consumed fragments. `references/cut-procedure.md` gains the new step (table row + detail + resume-path note); no new pre-cut roster gate — pending fragments are a normal between-PRs state, not a freshness defect a standing gate should flag.
+
+### Fixed
+- **`package-release` skill's `release-pack.mjs` rejects any `--substantive-packages`/`--stub-packages` name whose `scripts/package-paths.mjs` `PACKAGE_ROSTER` entry is unknown or `lockstep: false`, at parse time, before Step 1 runs (gh#2894).** The 0.8.58 cut passed `adia-plugins` (lockstep:false, gh#1133) in `--substantive-packages`, letting `promote-unreleased.mjs` rewrite that package's `[Unreleased]` header to a version it never ships; the cut only caught it at Step 5.6's unstaged-tracked-files guard, after the 34-gate pre-flight had already run. `selftest()` gains two new cases (a non-lockstep name, an unknown name); `references/cut-procedure.md` §Step 4a notes the guard.
+- fix: check-changelog-pr-gate.mjs refuses a direct package [Unreleased] edit — require a changes/<pr>.md fragment tagged (<package>) instead; validate every changes/*.md fragment's grammar unconditionally (kind, roster scope) rather than only on the coverage path; cut-procedure.md doc refresh (gh#3123, gh#3132) (#3148)
+- fix: package-release's bump script now rewrites icons-cdn.js's PACKAGE_VERSION literal (the jsDelivr manifest-fallback URL pin, gh#3228) on every lockstep bump, alongside the existing .mcp.json/README pins (gh#3240) (#3250)
+
+### Added
+- **`package-release`'s pre-cut roster gains gate 36 (gh#2912, plan-top-priority-verification.md item 4): `npm run check:treeshake`, the single-import build matrix (esbuild+rollup) over 10 representative `@adia-ai/web-components` components.** `gate-roster.mjs` appended (identities never renumber); `references/cut-procedure.md` §3.1 transcribed to match. See the root CHANGELOG and gh#2912's PR body for what the gate checks and its current known-red cells.
+- **`package-release` skill's pre-cut roster gains gate 37, `check:lint-efficacy` (gh#2911)** — the repo root's new seeded-violation/false-positive/mutation-hardening lint-bank gate (`scripts/verify/check-lint-efficacy.mjs`, not itself part of this package). `gate-roster.mjs` and `references/cut-procedure.md` §3.1 both updated; not wired into `npm run check` (the false-positive sweep alone measured ~100s, over the 60s bar — see repo-root CHANGELOG.md for the gate's own detail).
+
+### Changed
+- **`scripts/lint-rules.generated.mjs` (vendored lint-rule bank) regenerated after gh#2939's EXAMPLE-PROP-CONTRACT `data-*` exemption and GENUI-DOC-CONFLICT self-scope fix landed in the shared rule sources.** Derived-only, no source change in this package; the vendored bank picks up both predicate narrowings — full-corpus warn count 1413 → 1410 (see repo-root CHANGELOG.md for the gate's own detail).
+- **`scripts/lint-rules.generated.mjs` (vendored lint-rule bank) regenerated after gh#2937's `tagTree()` memoization landed in `scripts/lint/engine/primitives.mjs` (root).** Derived-only, no source change in this package; the vendored bank picks up the shared engine's single-slot memo, so the 48 generated `COMPOSITION-*` rules now share one tag-tree parse per file instead of each re-parsing it — full golden-corpus `check:lint-efficacy`: 110.9s → 9.45s. Byte-identical rule semantics (38/38 seeded-fixture catch rate, 0 error-severity across 438 files, unchanged).
+- **`scripts/lint-rules.generated.mjs` (vendored lint-rule bank) regenerated to carry `enum_meta` tier data for gh#2831 batch 2's 9 components** (feed-item-ui, inline-message-ui, link-ui, loading-overlay-ui, mark-ui, menu-item-ui, nav-group-ui, nav-item-ui, nav-ui). Derived-only, no source change in this package; the vendored bank follows the yaml `enum_meta` authored in `@adia-ai/web-components`.
+- **`scripts/lint-rules.generated.mjs` (vendored lint-rule bank) regenerated to carry `enum_meta` tier data for gh#2831 batch 3's 13 components** (pagination-ui, preview-ui, rating-ui, select-ui, shader-texture-ui, spinner-ui, table-toolbar-ui, tabs-ui, tag-ui, text-ui, timeline-item-ui, toast-ui, toggle-scheme-ui). Derived-only, no source change in this package; the vendored bank follows the yaml `enum_meta` authored in `@adia-ai/web-components`. Closes the 31-component sweep (gh#2831).
+- chore: cut-procedure.md §Step 3 cross-references the new read-only preflight-dry-run.mjs runner as the no-cut alternative to a real release pre-flight (gh#3063) (#3203)
+- chore: demo-audit mode 5 now censuses `<chat-shell>` / `<editor-shell>` anatomy alongside `<admin-shell>` — closes the blind spot where `apps/genui` (chat-shell + editor-shell only, no admin-shell) was never mechanically swept (gh#3207) (#3207)
+
+### Docs
+
+- docs: a2ui-maintenance pipeline-overview names registry.js as Class R (gh#3055) — new components enter through their yaml, aliases through registry.exceptions.json, never a hand edit (#3194)
+- docs: add admin-roster-ui and table-toolbar-ui rows to demo-audit's app-shell-pitfalls.md composite table, and document audit-app-shells.mjs's new --playgrounds flag (gh#3197) (#3214)
+- docs: repair stale check:component-md-fresh PR-blocking claims in component-md-authoring skill (gh#3223) (#3226)
+
+### Maintenance
+- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`) — carried by the entries above.
+- **`skills/` touched in this release window** (11 file(s), e.g. `references/pipeline-overview.md`) — carried by the entries above.
+
+## [0.8.58] — 2026-09-02
+### Fixed
+- **`forge-lint.mjs`'s PostToolUse hook gains a `timeout: 90` key (gh#2709), matching its Python siblings (`sidecar-prewrite-guard`, `release-pretag-docs-gate`) that already carry one.** Both `hooks.json` and the derived `adapters/claude/hooks.json` mirror updated.
+- **ATTR-TYPO/LLM-KEY-IN-CLIENT/NATIVE-PRIMITIVE matcher hardening (gh#2708)**, propagated to this plugin's vendored `scripts/lint-rules.generated.mjs` via `npm run build:lint-rules`, byte-identical to the shared lint-rule bank, no change to `forge-lint`'s own hook contract.
+- **`README.md`'s `site-postwrite-derivation-gate` hook description still described the retired site-a2ui fragment-staleness half ("docs-site pages must derive from their canonical source") after ADR-0072 Decision 2's active drain (gh#2410, #2665) removed that half of the hook, found by build-2692 during gh#2692/#2698, out of scope there (gh#2699).** Repointed at the hook's real remaining behavior: a `site/sitemap.json` edit must regenerate `site/llms.txt` and the patterns/templates index, the same two derived artifacts the hook's own `SITEMAP_REASON` message names (`scripts/site-postwrite-derivation-gate`, unchanged) and that #2698 itself regenerated.
+
+### Docs
+- **generated lint-rule bank refreshed (gh#2821, gh#2824)**: a full `npm run build:lint-rules` regen pass, run while rebasing the heatmap/noodles a11y fixes onto main, picked up `enum_meta` `tier`/`when` data already landed upstream (gh#2864) that this vendored copy hadn't caught up to yet; vendored copy byte-identical to the shared bank, no behavior change for this plugin's own `forge-lint.mjs`.
+- **generated lint-rule bank refreshed (ADR-0108 D5, gh#2856)**: four new manifest-derived rules (`UNKNOWN-TAG`, `UNKNOWN-ATTR`, `ENUM-VALUE`, `INTERNAL-TIER`, `scripts/build/gen-lab-posture-rules.mjs`) generated into `scripts/lint/rules/generated/lab-posture/`; the bank's export list widened so a new lab-posture write-time hook (adia-ui-factory plugin) can import the same matcher functions (mechanics: repo-root CHANGELOG.md); vendored copy byte-identical to the shared bank, no behavior change for this plugin's own `forge-lint.mjs`.
+- **`primitive-authoring/SKILL.md` gains the LLD-0018 R-6 checklist line (gh#2802).** A state or aria-behavior change on a yaml with a `component.md` sibling now points back at `component-md-authoring`'s authored `screenReader`/`behavioral` fields, the recommendation `component-md-authoring/SKILL.md` had carried since PR #2618 but that never landed on this skill's own side.
+- **generated lint-rule bank refreshed (gh#2845)**: `gen-composition-rules.mjs`'s scan widened from `<dirname>.yaml` only to every `*.yaml` in a component directory, discovering 14 previously-missed child/sub-item yamls; composition-rule count 34 → 48 (mechanics: repo-root CHANGELOG.md); vendored copy byte-identical to the shared bank, no behavior change.
+- **generated lint-rule bank refreshed (gh#2801)**: `gen-composition-rules.mjs`'s eligibility widened from 1 to 34 generated composition rules, decoupled from component.md pilot status (mechanics: repo-root CHANGELOG.md); vendored copy byte-identical to the shared bank, no behavior change.
+- **generated lint-rule bank refreshed** by wave-5A component.md eligibility regen (lld-0018).
+- **generated lint-rule bank refreshed** by wave-5B component.md eligibility regen (lld-0018).
+- **generated lint-rule bank refreshed**: wave-1A component.md eligibility added 3 composition rules (accordion/action-list/choice-card, lld-0018).
+- **`primitive-authoring` skill's description clarified to say "components" instead of "primitives" (ADR-0106, gh#2766).** The installed skill name and its `primitive-audit` cross-reference are deliberately NOT renamed (ADR-0106 Decision §4: rename cost across every cross-reference and derived multi-harness manifest exceeds the benefit; the charter already reads unambiguously in context). Codex (`agents/openai.yaml`) and the Python entry point (`__init__.py`) manifests regenerated via `npm run build:codex-manifests` + `npm run build:harness-manifests` to match.
+- **Region-styling rule ratified (proposed) as ADR-0105 (gh#2761).** Region elements, native `<header>`/`<section>`/`<footer>` and `<header-ui>`/`<section-ui>`/`<footer-ui>` (a CSS-only slot-routing anatomy stub, no JS/events/`.css` of its own), never carry their own layout CSS; the closest host pattern's `@scope` (`page-ui`/`card-ui`/`drawer-ui`/`modal-ui`/`anchor-bar`/the shells) always owns it, and a new host accepting region children must ship its own `@scope` treatment before it ships (gh#2760 is the live counter-example: `page-ui`'s header band missing the tabs-in-action-cluster grid `admin-page-header` carried). Harvested into `primitive-authoring/references/css-patterns.md`'s new §Region elements never self-style, cross-referenced from `shell-patterns.md`. A lint gate for the "region element ships its own CSS" direction is named as feasible future work; the "host's `@scope` treatment is incomplete for a shape" direction is rejected as a lint-gate candidate (demo-audit visual coverage is the correct mitigation).
+- **`package-release` cut-procedure gains the milestone close-out step (ADR-0103, gh#2729).** `cut-procedure.md` now instructs closing the release's GitHub Milestone and opening the next one at cut time, matching the planning-surfaces contract (`scripts/verify/check-planning-surfaces.mjs`, advisory).
+- **ADR knowledge-harvest batch (0095, 0098) applied to reference docs.** `primitive-authoring/references/form-control-sizing.md` gains a dated amendment note (2026-08-31, gh#2534, ADR-0095) scoping the square-minimum rule to a primitive's own outer inline-size floor, never an internal grid-column token like `--field-label-inline-min`. `demo-audit/references/{admin-shell-anatomy,app-shell-pitfalls}.md` and `primitive-authoring/references/shell-patterns.md` gain dated deprecation notes (ADR-0098) pointing the `admin-page` family and `admin-scroll` at their successors, `page-ui[band]` and `page-scroll`. adr-0097/adr-0056/adr-0059 candidates verified already satisfied by #2580.
+- **ADR hygiene + harvest batch 2 (2026-09-01): adr-0100 id collision resolved, adr-0101 ratified, adr-0100 badge-weight harvested.** decision-watcher's 2026-09-01T13:51:25Z firing found two `docs/ops/adr/` files both declaring `id: adr-0100` (`adr-0100-badge-weight-exemption.md`, accepted, and `adr-0100-text-ui-level-prop-native-heading-promotion.md`, proposed), `adr_checkpoint.py`'s dict-keyed scan silently dropped the accepted badge-weight content. The proposed text-ui-level file is renumbered `adr-0102` (frontmatter, filename, and every inbound reference: `lld-0017`, three `CHANGELOG.md` files, `renderer.js` comments, `text-level-tag.test.js`) and flipped `accepted`/`ratified: 2026-09-01` (shipped via gh#2683/PR #2685). `adr-0101-inspector-ui-keeps-preview-ui-tab-chrome.md` flips `proposed` → `accepted`, normalizing its nonstandard `ratified-by` field to this corpus's `ratified: 2026-09-01` convention (Kim's ruling + PR #2682). `adr-0084`'s locked body still read "Recommended for ratification, not yet ratified" despite an `accepted` frontmatter, a dated status-update note is appended (T4-compliant, the stale sentence itself untouched) citing PR #2694. Harvested: `primitive-authoring/references/token-contract.md`'s §11 exemption list gains `badge-ui[weight]` → `icon-ui[weight]`, ADR-0100 (the badge-weight file, which keeps its id).
+- **ADR harvest batch 3 (adr-0102, adr-0101).** `primitive-authoring/references/yaml-contract.md` gains a dated subsection (2026-09-01) documenting `text-ui[level]` as the worked example of a component-scoped (non-`CatalogComponentCommon`) prop, including the `0 = off` sentinel-default convention it shares with `lines: 0`. `primitive-authoring/references/token-contract.md` gains a dated note on why a `@scope` donor selector must stay tag-independent (`@scope (text-ui, [data-text])`) once a component can promote its own rendered tag, citing ADR-0102's `text-ui`/`toc-ui` fix. `primitive-authoring/references/anti-patterns.md` gains AP-R2, the mirror-don't-fold precedent from ADR-0101 (`inspector-ui`/`preview-ui`): two widgets converging visually but differing in content model get a CSS-mirrored chrome treatment, never a premature shared-module extraction.
+
+### Chore
+- **`package-release`'s pre-cut roster gains gates 34/35, `check:yaml-events` and `check:yaml-impl-coverage` (gh#2829).** gh#2808/PR #2815 (ADR-0108 ticket 3) promoted both scripts into `npm run check` but deliberately left the release pre-flight roster untouched, so a cut could still ship a yaml `events:` block that phantoms or misses a runtime dispatch, or a schema field with no implementation evidence, without either failing pre-flight. `gate-roster.mjs` (the single source) and `cut-procedure.md` §3.1 (its transcription) both updated; `cut-procedure.md` §3.1 also picked up gate 33 (`verify:patterns-index`), which had drifted out of the transcription independently. Root `AGENTS.md`'s release pre-flight gate count bumped 32 → 34 to match `GATE_ROSTER.length`.
+- **Author email in `package.json` updated to `kim.granlund@adia.ai`** (was a stale personal address).
+
+### Maintenance
+- **`.claude-plugin/plugin.json` version bump** — moves in lockstep with package.json (the `/plugin update` cache key).
+- **`.codex-plugin/` touched in this release window** (1 file(s), e.g. `.codex-plugin/plugin.json`) — carried by the entries above.
+- **`skills/` touched in this release window** (13 file(s), e.g. `references/pipeline-overview.md`) — carried by the entries above.
+
 ## [0.8.57] — 2026-09-01
 
 ### Removed

package/README.md

@@ -43,8 +43,8 @@ artifacts) · `release-pretag-docs-gate` (PreToolUse: release-tagging Bash
 calls need their docs gate) · `forge-lint` (PostToolUse advisory
 authoring-smell repair loop) · `demo-postwrite-pattern-gate` (PostToolUse:
 composite demos must cite a `Pattern source:`) · `site-postwrite-derivation-gate`
-(PostToolUse: docs-site pages must derive from their canonical source). All
-ship `selftest` modes.
+(PostToolUse: `site/sitemap.json` edits must regenerate `site/llms.txt` +
+the patterns/templates index). All ship `selftest` modes.
 
 ## Commands
 

package/__init__.py

@@ -14,7 +14,7 @@ def register(ctx):
     ctx.register_skill(
         name="component-md-authoring",
         path=Path(os.path.join(_HERE, "skills", "component-md-authoring", "SKILL.md")),
-        description="Author the two judgment sections of a component's `component.md` — Screen-reader spec and Behavioral spec — and keep it PR-fresh. Use when a component's states, composed children, aria behavior, or error/empty/ loading handling changes and it already has (or should grow) a `component.md`, or when asked to \"add component.md for X\" / \"write the screen-reader spec for X\" / \"why did check:component-md-fresh fail\". NOT the yaml prop/slot/event/token contract itself (primitive-authoring owns that — this skill only owns the two authored yaml fields, `screenReader`/`behavioral`, plus the optional `intent` field); NOT gen-ui corpus/retrieval wiring (a2ui-maintenance); NOT a component's CSS token audit (component-token-audit).",
+        description="Author the two judgment sections of a component's `component.md` — Screen-reader spec and Behavioral spec — and keep it PR-fresh. Use when a component's states, composed children, aria behavior, or error/empty/ loading handling changes and it already has (or should grow) a `component.md`, or when asked to \"add component.md for X\" / \"write the screen-reader spec for X\" / \"why is check:component-md-fresh warning\". NOT the yaml prop/slot/event/token contract itself (primitive-authoring owns that — this skill only owns the two authored yaml fields, `screenReader`/`behavioral`, plus the optional `intent` field); NOT gen-ui corpus/retrieval wiring (a2ui-maintenance); NOT a component's CSS token audit (component-token-audit).",
     )
     ctx.register_skill(
         name="cross-harness-authoring-standards",
@@ -29,7 +29,7 @@ def register(ctx):
     ctx.register_skill(
         name="demo-audit",
         path=Path(os.path.join(_HERE, "skills", "demo-audit", "SKILL.md")),
-        description="Seven-mode QA sweep of the monorepo's demo/app surfaces: visual probe, app-shell QA, attr-quote typos, native-primitive leak, admin-shell composition, card anatomy, plus an aggregated token/contrast/lifecycle drift battery (`npm run dogfood:status`). Use for \"run a dogfood sweep\", \"find broken demos\", \"audit native primitive leaks\". NOT for gen-UI gallery scoring (gen-ui-review) or authoring primitives (primitive-authoring).",
+        description="Seven-mode QA sweep of the monorepo's demo/app surfaces: visual probe, app-shell QA, attr-quote typos, native-primitive leak, shell (admin/chat/ editor) composition, card anatomy, plus an aggregated token/contrast/lifecycle drift battery (`npm run dogfood:status`). Use for \"run a dogfood sweep\", \"find broken demos\", \"audit native primitive leaks\". NOT for gen-UI gallery scoring (gen-ui-review) or authoring primitives (primitive-authoring).",
     )
     ctx.register_skill(
         name="gen-ui-review",
@@ -49,7 +49,7 @@ def register(ctx):
     ctx.register_skill(
         name="primitive-authoring",
         path=Path(os.path.join(_HERE, "skills", "primitive-authoring", "SKILL.md")),
-        description="Author or modify AdiaUI framework source inside the monorepo — primitives (packages/web-components), shells/composites (packages/web-modules), yaml SoTs, demos. Use to add a new primitive, fix a prop/slot/attribute/CSS variant, update a yaml, build or fix a shell (chat-shell, admin-shell, editor-shell — sidebar/pane/bespoke-tier composition), promote repeated inline content into a shared module, audit a component's four-axis contract/token usage/lifecycle for drift, or author a demo or examples.html. NOT for app screens (screen-composition), A2UI internals (a2ui-maintenance), @adia-ai/llm internals (llm-client-maintenance), or site/pages docs (site-docs-authoring).",
+        description="Author or modify AdiaUI framework source inside the monorepo — components (packages/web-components), shells/composites (packages/web-modules), yaml SoTs, demos. Use to add a new component, fix a prop/slot/attribute/CSS variant, update a yaml, build or fix a shell (chat-shell, admin-shell, editor-shell — sidebar/pane/bespoke-tier composition), promote repeated inline content into a shared module, audit a component's four-axis contract/token usage/lifecycle for drift, or author a demo or examples.html. NOT for app screens (screen-composition), A2UI internals (a2ui-maintenance), @adia-ai/llm internals (llm-client-maintenance), or site/pages docs (site-docs-authoring).",
     )
     ctx.register_skill(
         name="site-deployment",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adia-ai/adia-ui-forge",
-  "version": "0.8.57",
+  "version": "0.8.59",
   "description": "Maintain the adia-ui (@adia-ai) framework itself — author primitives and shells, run the A2UI generation pipeline and its corpus, review gen-UI quality, sweep QA, cut releases, deploy. The maintainer counterpart to adia-factory (the consumer/app-author plugin).",
   "keywords": [
     "adia-ui",
@@ -15,7 +15,7 @@
   "license": "MIT",
   "author": {
     "name": "Kim",
-    "email": "kim@sublimeheroics.com"
+    "email": "kim.granlund@adia.ai"
   },
   "bugs": {
     "email": "kim.granlund@adia.ai"

package/plugin.yaml

@@ -1,4 +1,4 @@
 name: "adia-ui-kit-forge"
-version: "0.8.57"
+version: "0.8.59"
 description: "Maintain the adia-ui (@adia-ai) framework itself — author primitives and shells, run the A2UI generation pipeline and its corpus, review gen-UI quality, sweep QA, cut releases, deploy. The maintainer counterpart to adia-ui-kit-factory (the consumer/app-author plugin)."
 manifest_version: 1