ultra11y 2.32.1 → 3.0.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "2.32.1",
+      "version": "3.0.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "2.32.1",
+  "version": "3.0.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "2.32.1",
+  "version": "3.0.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "2.32.1";
+const ULTRA11Y_PLUGIN_VERSION = "3.0.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/README.md

@@ -351,7 +351,9 @@ a test). See [`CONTRIBUTING.md`](CONTRIBUTING.md) and `skills/ultra11y/reference
   optionally, the **pages** (it can start your app, wait for it, then scan real URLs or your
   declared sample). The engine ships inside the action, so there is nothing to install and no
   `setup-node`. The gate runs **last**, after SARIF, annotations, the summary, the sticky PR
-  comment and the report — a red job is never a dead end. `ultra11y init --ci` writes a
+  comment and the report — a red job is never a dead end. `adjudicate: api|agent` optionally
+  rules on the judgment criteria that would otherwise stay « à évaluer » in CI, reading its key
+  from the job environment and skipping itself without one. `ultra11y init --ci` writes a
   workflow using it. See `references/ci.md`.
 - **CI surfaces** — a red job says *that* the build broke, not *where*. `--format sarif` emits
   SARIF 2.1.0 for GitHub code scanning, so each finding lands as an **inline annotation on the
@@ -378,6 +380,15 @@ adjudication leaves the audit untouched. All-`manual` with reasons is accepted,
 a correct answer. It is the **only** part of the tool that takes an API key; without one the
 command explains itself and exits, and nothing else changes.
 
+The GitHub Action wires this as `adjudicate: api`, and offers `adjudicate: agent` as the other
+half — the same worklist handed to a `claude-code-action` run, which can **open the cited files**
+instead of ruling from harvested evidence alone. Both end in the same fail-closed gate; they
+differ in evidence, not in trust. Both read `ANTHROPIC_API_KEY` from the **job environment**,
+never from an input, and **skip themselves when it is absent** — which is exactly what a fork's
+pull request looks like, so the job stays green and the criteria stay « à évaluer ». See
+`references/ci.md` for the cost per run and for `gate-adjudicated`, which lets a model-ruled
+non-conformity fail the build at the price of a red/green that no longer reproduces.
+
 ### Optional dynamic tier (axe-core)
 
 `scan` runs **axe-core in a headless browser** to decide the *needs-rendering* criteria the static engine leaves as residual risks — chiefly **computed colour contrast (1.4.3)** plus a 320px **reflow** check (1.4.10) and a render cross-check of the structural rules. Two runtimes (default `--runtime auto`): **`--runtime local`** uses a Playwright that resolves from your project (`--cwd`) — **no Docker** — and additionally probes focus visibility (2.4.7), 200% zoom (1.4.4), text spacing (1.4.12) and content-on-hover (1.4.13), plus **stateful** probes (fill inputs then re-measure overflow, and a live-region probe for status messages 4.1.3 — opt out with `--no-interact`, `--interact-clicks` for authed-scan button clicks), and takes `--storage-state` for authenticated pages; **`--runtime docker`** falls back to a self-contained image built on first use. `--merge` folds the findings into a static `AuditResult`, upgrading `manual` criteria to `C`/`NC`. A country-standard audit scans its declared page sample with `scan --sample` (lint it first with `sample check`):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "2.32.1",
+  "version": "3.0.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join45, relative as relative5, sep as sep7, dirname as dirname1
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "2.32.1";
+var VERSION = "3.0.0";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -58277,6 +58277,7 @@ Usage:
   ultra11y audit    [--changed | --since <ref> | --staged] [--max-files <n>] [--dedup exact|normalized|off] [--baseline <file>] [--fail-on blocking|major|minor]
   ultra11y audit    [--captures <dir>] [--no-captures] [--require-captures]   (rendered-DOM captures + .ultra11y/pages snapshots: audit real HTML)
   ultra11y audit    [--format sarif|github]        (CI: SARIF for code scanning, or inline annotations + job summary)
+  ultra11y audit    --in <audit.json> [--fail-on blocking|major|minor] [--format sarif|github]   (re-gate an audit already computed \u2014 e.g. one carrying adjudicated verdicts \u2014 without a second detection pass)
   ultra11y report   --in <audit.json> [--out <dir>] [--standard <pack>] [--format sarif|github] [--lang auto|en|fr]
   ultra11y prd      --in <audit.json> [--out <dir>] [--split criterion] [--format audit|doc|remediation] [--no-technical] [--standard <pack>] [--lang auto|en|fr]
   ultra11y tickets  --in <audit.json> [--provider auto|github|gitlab|jira] [--grain criterion|page|page-criterion|single|file] [--transport auto|cli|rest]
@@ -58869,7 +58870,73 @@ function emitCiFormat(result, format, standard, lang, failOn) {
     );
   }
 }
+async function cmdAuditFromFile(p, inPath) {
+  const scoping = [
+    "since",
+    "changed",
+    "staged",
+    "baseline",
+    "graph",
+    "cross-file",
+    "jsx",
+    "include",
+    "exclude",
+    "ext",
+    "max-files",
+    "dedup",
+    "captures",
+    "no-captures",
+    "require-captures",
+    "no-default-excludes",
+    "out"
+  ];
+  const offenders = scoping.filter((f) => p.flags[f] !== void 0);
+  if (p.positionals.length) offenders.unshift("<paths>");
+  if (offenders.length) {
+    console.error(
+      `ultra11y audit: --in re-gates an audit that already exists, so these have nothing left to change: ${offenders.join(", ")}. Drop them, or run a fresh audit without --in.`
+    );
+    return 2;
+  }
+  let result;
+  try {
+    const parsed = JSON.parse(inPath === "-" ? await readStdin() : readText(inPath));
+    if (!isCurrentAudit(parsed)) {
+      console.error("ultra11y audit: --in is not a current ultra11y AuditResult (WCAG-keyed, schema v2). Re-run `audit`.");
+      return 2;
+    }
+    result = parsed;
+  } catch {
+    console.error(`ultra11y audit: --in file not found or not valid JSON: ${inPath}.`);
+    return 2;
+  }
+  const lang = resolveLang(p.flags, { audit: result });
+  const failOnRaw = p.flags["fail-on"];
+  const failOnParsed = parseFailOn(failOnRaw);
+  if (failOnRaw !== void 0 && failOnParsed === null) {
+    console.error(`ultra11y audit: --fail-on must be blocking|major|minor (got "${String(failOnRaw)}").`);
+    return 2;
+  }
+  const ciFormat = parseCiFormat(p.flags.format);
+  if (ciFormat === null) {
+    console.error(`ultra11y audit: --format must be sarif|github (got "${String(p.flags.format)}").`);
+    return 2;
+  }
+  const failOnSet = failOnRaw !== void 0;
+  const failOn = failOnSet ? failOnParsed ?? "bloquant" : void 0;
+  const failing = failOn ? findingsAtOrAbove(result.findings, failOn) : [];
+  if (ciFormat) emitCiFormat(result, ciFormat, CORE2, lang, failOn);
+  else if (p.flags.json) console.log(JSON.stringify(result, null, 2));
+  else {
+    console.log(auditSummary(result, lang));
+    if (failOnSet && failing.length)
+      console.error(lang === "fr" ? `\u2717 ${failing.length} non-conformit\xE9(s) \u2265 ${failOn}.` : `\u2717 ${failing.length} non-conformity(ies) \u2265 ${failOn}.`);
+  }
+  return failing.length ? 1 : 0;
+}
 async function cmdAudit(p) {
+  const inFlag = p.flags.in;
+  if (typeof inFlag === "string" && inFlag) return cmdAuditFromFile(p, inFlag);
   const inputs = p.positionals.length ? p.positionals : ["."];
   if (inputs.length === 0) {
     console.error("ultra11y audit: provide files/globs, or '-' to read stdin.");

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 2.32.1
+  version: 3.0.0
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join45, relative as relative5, sep as sep7, dirname as dirname1
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "2.32.1";
+var VERSION = "3.0.0";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -58277,6 +58277,7 @@ Usage:
   ultra11y audit    [--changed | --since <ref> | --staged] [--max-files <n>] [--dedup exact|normalized|off] [--baseline <file>] [--fail-on blocking|major|minor]
   ultra11y audit    [--captures <dir>] [--no-captures] [--require-captures]   (rendered-DOM captures + .ultra11y/pages snapshots: audit real HTML)
   ultra11y audit    [--format sarif|github]        (CI: SARIF for code scanning, or inline annotations + job summary)
+  ultra11y audit    --in <audit.json> [--fail-on blocking|major|minor] [--format sarif|github]   (re-gate an audit already computed \u2014 e.g. one carrying adjudicated verdicts \u2014 without a second detection pass)
   ultra11y report   --in <audit.json> [--out <dir>] [--standard <pack>] [--format sarif|github] [--lang auto|en|fr]
   ultra11y prd      --in <audit.json> [--out <dir>] [--split criterion] [--format audit|doc|remediation] [--no-technical] [--standard <pack>] [--lang auto|en|fr]
   ultra11y tickets  --in <audit.json> [--provider auto|github|gitlab|jira] [--grain criterion|page|page-criterion|single|file] [--transport auto|cli|rest]
@@ -58869,7 +58870,73 @@ function emitCiFormat(result, format, standard, lang, failOn) {
     );
   }
 }
+async function cmdAuditFromFile(p, inPath) {
+  const scoping = [
+    "since",
+    "changed",
+    "staged",
+    "baseline",
+    "graph",
+    "cross-file",
+    "jsx",
+    "include",
+    "exclude",
+    "ext",
+    "max-files",
+    "dedup",
+    "captures",
+    "no-captures",
+    "require-captures",
+    "no-default-excludes",
+    "out"
+  ];
+  const offenders = scoping.filter((f) => p.flags[f] !== void 0);
+  if (p.positionals.length) offenders.unshift("<paths>");
+  if (offenders.length) {
+    console.error(
+      `ultra11y audit: --in re-gates an audit that already exists, so these have nothing left to change: ${offenders.join(", ")}. Drop them, or run a fresh audit without --in.`
+    );
+    return 2;
+  }
+  let result;
+  try {
+    const parsed = JSON.parse(inPath === "-" ? await readStdin() : readText(inPath));
+    if (!isCurrentAudit(parsed)) {
+      console.error("ultra11y audit: --in is not a current ultra11y AuditResult (WCAG-keyed, schema v2). Re-run `audit`.");
+      return 2;
+    }
+    result = parsed;
+  } catch {
+    console.error(`ultra11y audit: --in file not found or not valid JSON: ${inPath}.`);
+    return 2;
+  }
+  const lang = resolveLang(p.flags, { audit: result });
+  const failOnRaw = p.flags["fail-on"];
+  const failOnParsed = parseFailOn(failOnRaw);
+  if (failOnRaw !== void 0 && failOnParsed === null) {
+    console.error(`ultra11y audit: --fail-on must be blocking|major|minor (got "${String(failOnRaw)}").`);
+    return 2;
+  }
+  const ciFormat = parseCiFormat(p.flags.format);
+  if (ciFormat === null) {
+    console.error(`ultra11y audit: --format must be sarif|github (got "${String(p.flags.format)}").`);
+    return 2;
+  }
+  const failOnSet = failOnRaw !== void 0;
+  const failOn = failOnSet ? failOnParsed ?? "bloquant" : void 0;
+  const failing = failOn ? findingsAtOrAbove(result.findings, failOn) : [];
+  if (ciFormat) emitCiFormat(result, ciFormat, CORE2, lang, failOn);
+  else if (p.flags.json) console.log(JSON.stringify(result, null, 2));
+  else {
+    console.log(auditSummary(result, lang));
+    if (failOnSet && failing.length)
+      console.error(lang === "fr" ? `\u2717 ${failing.length} non-conformit\xE9(s) \u2265 ${failOn}.` : `\u2717 ${failing.length} non-conformity(ies) \u2265 ${failOn}.`);
+  }
+  return failing.length ? 1 : 0;
+}
 async function cmdAudit(p) {
+  const inFlag = p.flags.in;
+  if (typeof inFlag === "string" && inFlag) return cmdAuditFromFile(p, inFlag);
   const inputs = p.positionals.length ? p.positionals : ["."];
   if (inputs.length === 0) {
     console.error("ultra11y audit: provide files/globs, or '-' to read stdin.");

package/skills/ultra11y/SKILL.md

@@ -4,7 +4,7 @@ description: "Use to AUDIT existing HTML/CSS/JSX against WCAG 2.2 AA accessibili
 when_to_use: "Invoke when the user asks for an accessibility AUDIT or a formal deliverable: audit a repo, site or page against WCAG 2.2 AA or a country standard (RGAA, Section 508, EN 301 549); produce a dated conformance report, a criterion grid, a PRD backlog, or tickets (GitHub/GitLab/Jira); author accessible markup from scratch; wire the repo gate (init --hook/--ci) or a rendered-DOM capture pipeline. For a review of the code UNDER CHANGE (diff, branch, PR), use the `review-a11y` skill instead."
 license: MIT
 metadata:
-  version: 2.32.1
+  version: 3.0.0
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/references/ci.md

@@ -53,6 +53,69 @@ run and an RGAA run coexist rather than overwriting each other. The Markdown rep
 through `check` before being uploaded, so CI cannot publish a report citing an invented
 criterion.
 
+## Adjudicating the judgment criteria in CI (`adjudicate`)
+
+Of the 55 WCAG 2.2 AA criteria the engine decides a handful; **38 are judgment calls**, and
+under RGAA **81 of 106** can only ever derive `manual`. Inside a coding agent the agent rules
+on them. In CI nobody does, so they stay « à évaluer » and the published conformance rate is
+partial by construction. `adjudicate` closes that — opt-in, in two modes.
+
+```yaml
+env:
+  ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}   # the job's env, never an input
+steps:
+  - uses: maxgfr/ultra11y@v2
+    with:
+      standard: rgaa
+      adjudicate: api          # or `agent`
+```
+
+| input | default | |
+|---|---|---|
+| `adjudicate` | `none` | `api` · `agent` · `none` |
+| `adjudicate-model` | *(empty)* | model id for `api`; else `$ULTRA11Y_LLM_MODEL`, else the engine default |
+| `gate-adjudicated` | `false` | let a model-ruled NC fail the job |
+
+**`api`** sends the worklist to the Messages API in batches of 8 and folds the verdicts back.
+**`agent`** emits the worklist plus `orchestrate --eco`'s runbook and hands them to a
+`claude-code-action` run, then folds the same way. Both end in the **same fail-closed gate** an
+agent's verdicts pass through, so neither can assert a conformance the engine refuses.
+
+The difference between them is **evidence, not trust**. `judge` rules from the harvested
+evidence alone — capped at 30 items per criterion, snippets truncated — while the agent can
+open the cited files and read around them, which is what *link purpose **in context*** actually
+asks for. Expect the API mode to answer `manual` more often; that is it being honest, not
+broken. The metric that separates them is the count of criteria left to assess.
+
+**Both modes read `ANTHROPIC_API_KEY` from the job environment, never from an input** — a
+composite action's steps inherit it, and a secret that never travels through an input is one
+fewer secret to leak into a log. When the key is absent the tier **skips itself**: the job stays
+green, the report is still written, and the criteria stay « à évaluer ». That is not an edge
+case — it is precisely what a **fork's pull request** looks like, where secrets are never
+exposed. An adjudication that fails mid-flight (a rate-limited batch refuses the whole fold) is
+absorbed the same way, because losing the verdicts must never cost you the audit.
+
+**Cost is per run and does not amortise.** Roughly $0.20 for a WCAG run and $0.50 for RGAA at
+Sonnet pricing — the worklist is re-sent whole each time and no batch is large enough to earn
+prompt caching. On a busy repository that is real money per push; this belongs on the default
+branch or a schedule far more often than on every PR.
+
+**`gate-adjudicated` trades reproducibility for reach.** By default the gate re-audits the
+**source**, so the red/green is a pure function of the commit whatever a model said about it.
+Turn it on and the gate evaluates the adjudicated audit instead (`audit --in`), letting a
+model-ruled non-conformity fail the job — and accepting that two runs on the same commit may
+now disagree. Default off, deliberately.
+
+```sh
+# The same re-gate, outside the action:
+node scripts/ultra11y.mjs audit --in audits/audit-latest.json --fail-on blocking
+```
+
+`--in` re-gates an audit that already exists rather than computing one, which is the only way
+to gate on verdicts a second detection pass would not see. It refuses every flag that would
+change *what* is audited (`--since`, `--baseline`, paths…): a gate that silently dropped your
+scoping would be a gate nobody could trust.
+
 # The `--format` renderings
 
 A gate tells a developer *that* the build failed; it does not put the non-conformity **on the

package/skills/ultra11y/references/judgment.md

@@ -151,6 +151,14 @@ A rejected adjudication leaves `audit-latest.json` untouched.
 **Strictly opt-in.** With no key the command explains itself and exits 2; nothing else in the
 engine changes.
 
+**In the GitHub Action.** `adjudicate: api` runs exactly the command above; `adjudicate: agent`
+hands the same worklist — plus `orchestrate --eco`'s runbook and the adjudicator contract — to
+a `claude-code-action` run, then folds it with `verify --apply`. The agent mode exists because
+`judge` rules from the harvested evidence alone (30 items per criterion, snippets truncated)
+while an agent can open the cited files, which is what *link purpose in context* really needs.
+Both skip themselves when `ANTHROPIC_API_KEY` is absent from the job environment, and both
+absorb their own failure rather than taking the audit down with them. See `references/ci.md`.
+
 `--max` bounds the spend and says out loud which criteria it did not submit. It is **refused
 together with `--apply`**, before any call is made: the gate rejects an incomplete
 adjudication by design, so the pair could only ever bill you for a guaranteed failure. Drop

package/skills/ultra11y/references/orchestrators.md

@@ -64,6 +64,13 @@ verdict with no justification, an NC with no resolvable `normativeRef`, a criter
 from the adjudication — each is refused by name, and the run stops. That is what keeps the
 final report defensible.
 
+**The shipped GitHub Action now runs this pipeline for you.** `adjudicate: agent` performs
+steps 2–4 — `verify --manual`, then `orchestrate --run audits --phase adjudicate --eco`, then a
+`claude-code-action` run pointed at the emitted `RUNBOOK.md`, then `verify --apply`. Reach for
+the raw pipeline above when your orchestrator is *not* GitHub Actions, or when you want to fan
+step 3 out across subagents rather than walk the eco path. Either way steps 1, 2, 4, 5 and 6
+stay deterministic, and only step 3 involves a model.
+
 ## The adjudication contract
 
 `ADJUDICATE.todo.json` declares what may be written into it, so the filler never has to read

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join45, relative as relative5, sep as sep7, dirname as dirname1
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "2.32.1";
+var VERSION = "3.0.0";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -58277,6 +58277,7 @@ Usage:
   ultra11y audit    [--changed | --since <ref> | --staged] [--max-files <n>] [--dedup exact|normalized|off] [--baseline <file>] [--fail-on blocking|major|minor]
   ultra11y audit    [--captures <dir>] [--no-captures] [--require-captures]   (rendered-DOM captures + .ultra11y/pages snapshots: audit real HTML)
   ultra11y audit    [--format sarif|github]        (CI: SARIF for code scanning, or inline annotations + job summary)
+  ultra11y audit    --in <audit.json> [--fail-on blocking|major|minor] [--format sarif|github]   (re-gate an audit already computed \u2014 e.g. one carrying adjudicated verdicts \u2014 without a second detection pass)
   ultra11y report   --in <audit.json> [--out <dir>] [--standard <pack>] [--format sarif|github] [--lang auto|en|fr]
   ultra11y prd      --in <audit.json> [--out <dir>] [--split criterion] [--format audit|doc|remediation] [--no-technical] [--standard <pack>] [--lang auto|en|fr]
   ultra11y tickets  --in <audit.json> [--provider auto|github|gitlab|jira] [--grain criterion|page|page-criterion|single|file] [--transport auto|cli|rest]
@@ -58869,7 +58870,73 @@ function emitCiFormat(result, format, standard, lang, failOn) {
     );
   }
 }
+async function cmdAuditFromFile(p, inPath) {
+  const scoping = [
+    "since",
+    "changed",
+    "staged",
+    "baseline",
+    "graph",
+    "cross-file",
+    "jsx",
+    "include",
+    "exclude",
+    "ext",
+    "max-files",
+    "dedup",
+    "captures",
+    "no-captures",
+    "require-captures",
+    "no-default-excludes",
+    "out"
+  ];
+  const offenders = scoping.filter((f) => p.flags[f] !== void 0);
+  if (p.positionals.length) offenders.unshift("<paths>");
+  if (offenders.length) {
+    console.error(
+      `ultra11y audit: --in re-gates an audit that already exists, so these have nothing left to change: ${offenders.join(", ")}. Drop them, or run a fresh audit without --in.`
+    );
+    return 2;
+  }
+  let result;
+  try {
+    const parsed = JSON.parse(inPath === "-" ? await readStdin() : readText(inPath));
+    if (!isCurrentAudit(parsed)) {
+      console.error("ultra11y audit: --in is not a current ultra11y AuditResult (WCAG-keyed, schema v2). Re-run `audit`.");
+      return 2;
+    }
+    result = parsed;
+  } catch {
+    console.error(`ultra11y audit: --in file not found or not valid JSON: ${inPath}.`);
+    return 2;
+  }
+  const lang = resolveLang(p.flags, { audit: result });
+  const failOnRaw = p.flags["fail-on"];
+  const failOnParsed = parseFailOn(failOnRaw);
+  if (failOnRaw !== void 0 && failOnParsed === null) {
+    console.error(`ultra11y audit: --fail-on must be blocking|major|minor (got "${String(failOnRaw)}").`);
+    return 2;
+  }
+  const ciFormat = parseCiFormat(p.flags.format);
+  if (ciFormat === null) {
+    console.error(`ultra11y audit: --format must be sarif|github (got "${String(p.flags.format)}").`);
+    return 2;
+  }
+  const failOnSet = failOnRaw !== void 0;
+  const failOn = failOnSet ? failOnParsed ?? "bloquant" : void 0;
+  const failing = failOn ? findingsAtOrAbove(result.findings, failOn) : [];
+  if (ciFormat) emitCiFormat(result, ciFormat, CORE2, lang, failOn);
+  else if (p.flags.json) console.log(JSON.stringify(result, null, 2));
+  else {
+    console.log(auditSummary(result, lang));
+    if (failOnSet && failing.length)
+      console.error(lang === "fr" ? `\u2717 ${failing.length} non-conformit\xE9(s) \u2265 ${failOn}.` : `\u2717 ${failing.length} non-conformity(ies) \u2265 ${failOn}.`);
+  }
+  return failing.length ? 1 : 0;
+}
 async function cmdAudit(p) {
+  const inFlag = p.flags.in;
+  if (typeof inFlag === "string" && inFlag) return cmdAuditFromFile(p, inFlag);
   const inputs = p.positionals.length ? p.positionals : ["."];
   if (inputs.length === 0) {
     console.error("ultra11y audit: provide files/globs, or '-' to read stdin.");

package/src/cli.ts

@@ -69,6 +69,7 @@ Usage:
   ultra11y audit    [--changed | --since <ref> | --staged] [--max-files <n>] [--dedup exact|normalized|off] [--baseline <file>] [--fail-on blocking|major|minor]
   ultra11y audit    [--captures <dir>] [--no-captures] [--require-captures]   (rendered-DOM captures + .ultra11y/pages snapshots: audit real HTML)
   ultra11y audit    [--format sarif|github]        (CI: SARIF for code scanning, or inline annotations + job summary)
+  ultra11y audit    --in <audit.json> [--fail-on blocking|major|minor] [--format sarif|github]   (re-gate an audit already computed — e.g. one carrying adjudicated verdicts — without a second detection pass)
   ultra11y report   --in <audit.json> [--out <dir>] [--standard <pack>] [--format sarif|github] [--lang auto|en|fr]
   ultra11y prd      --in <audit.json> [--out <dir>] [--split criterion] [--format audit|doc|remediation] [--no-technical] [--standard <pack>] [--lang auto|en|fr]
   ultra11y tickets  --in <audit.json> [--provider auto|github|gitlab|jira] [--grain criterion|page|page-criterion|single|file] [--transport auto|cli|rest]
@@ -751,7 +752,90 @@ function emitCiFormat(result: AuditResult, format: CiFormat, standard: StandardI
   }
 }
 
+// `audit --in <audit.json>` — RE-GATE an audit that was already computed, instead of
+// computing one. It exists for one caller: a pipeline that folded ADJUDICATED verdicts into
+// audit-latest.json and now wants the same severity gate applied to that result. Re-running
+// detection there would be wrong twice over — it would not see the verdicts, and it would
+// spend a second full pass to reach a conclusion the file already holds.
+//
+// Deliberately narrow: this path GATES and RENDERS, nothing else. Every flag that would
+// change what is audited is refused rather than ignored, because a gate that silently drops
+// your scoping is a gate nobody can trust. Re-running detection is what `audit <globs>` is
+// for.
+async function cmdAuditFromFile(p: ParsedArgs, inPath: string): Promise<number> {
+  const scoping = [
+    "since",
+    "changed",
+    "staged",
+    "baseline",
+    "graph",
+    "cross-file",
+    "jsx",
+    "include",
+    "exclude",
+    "ext",
+    "max-files",
+    "dedup",
+    "captures",
+    "no-captures",
+    "require-captures",
+    "no-default-excludes",
+    "out",
+  ];
+  const offenders = scoping.filter((f) => p.flags[f] !== undefined);
+  if (p.positionals.length) offenders.unshift("<paths>");
+  if (offenders.length) {
+    console.error(
+      `ultra11y audit: --in re-gates an audit that already exists, so these have nothing left to change: ${offenders.join(", ")}. Drop them, or run a fresh audit without --in.`,
+    );
+    return 2;
+  }
+
+  let result: AuditResult;
+  try {
+    const parsed = JSON.parse(inPath === "-" ? await readStdin() : readText(inPath)) as unknown;
+    if (!isCurrentAudit(parsed)) {
+      console.error("ultra11y audit: --in is not a current ultra11y AuditResult (WCAG-keyed, schema v2). Re-run `audit`.");
+      return 2;
+    }
+    result = parsed;
+  } catch {
+    console.error(`ultra11y audit: --in file not found or not valid JSON: ${inPath}.`);
+    return 2;
+  }
+
+  const lang = resolveLang(p.flags, { audit: result });
+
+  const failOnRaw = p.flags["fail-on"];
+  const failOnParsed = parseFailOn(failOnRaw);
+  if (failOnRaw !== undefined && failOnParsed === null) {
+    console.error(`ultra11y audit: --fail-on must be blocking|major|minor (got "${String(failOnRaw)}").`);
+    return 2;
+  }
+  const ciFormat = parseCiFormat(p.flags.format);
+  if (ciFormat === null) {
+    console.error(`ultra11y audit: --format must be sarif|github (got "${String(p.flags.format)}").`);
+    return 2;
+  }
+
+  const failOnSet = failOnRaw !== undefined;
+  const failOn = failOnSet ? (failOnParsed ?? "bloquant") : undefined;
+  const failing = failOn ? findingsAtOrAbove(result.findings, failOn) : [];
+
+  if (ciFormat) emitCiFormat(result, ciFormat, CORE, lang, failOn);
+  else if (p.flags.json) console.log(JSON.stringify(result, null, 2));
+  else {
+    console.log(auditSummary(result, lang));
+    if (failOnSet && failing.length)
+      console.error(lang === "fr" ? `✗ ${failing.length} non-conformité(s) ≥ ${failOn}.` : `✗ ${failing.length} non-conformity(ies) ≥ ${failOn}.`);
+  }
+  return failing.length ? 1 : 0;
+}
+
 async function cmdAudit(p: ParsedArgs): Promise<number> {
+  const inFlag = p.flags.in;
+  if (typeof inFlag === "string" && inFlag) return cmdAuditFromFile(p, inFlag);
+
   const inputs = p.positionals.length ? p.positionals : ["."];
   if (inputs.length === 0) {
     console.error("ultra11y audit: provide files/globs, or '-' to read stdin.");

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "2.32.1";
+export const VERSION = "3.0.0";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,