ultra11y 5.3.3 → 5.3.4

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.3.3",
+      "version": "5.3.4",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.3.3",
+  "version": "5.3.4",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.3.3",
+  "version": "5.3.4",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.3.3";
+const ULTRA11Y_PLUGIN_VERSION = "5.3.4";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.3.3",
+  "version": "5.3.4",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join50, relative as relative5, resolve as resolve15, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.3.3";
+var VERSION = "5.3.4";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -56773,11 +56773,11 @@ function packGuidanceBlock(standard, criterionId, lang) {
 function plainTest(s) {
   return s.replace(/\[([^\]]+)\]\(#[^)]*\)/g, "$1");
 }
-function formatAdjudication(items, lang = "en", standard = CORE2) {
+function formatAdjudication(items, lang = "en", standard = CORE2, opts = {}) {
   const s = T2[lang];
   const pack = isCore(standard) ? void 0 : loadPack(standard);
-  const out2 = [s.title, "", s.intro, "", ...s.verdicts, "", s.rule, "", s.then, ""];
-  if (pack) out2.push(`> ${s.packIntro(pack.name)}`, "");
+  const out2 = opts.preamble === false ? [] : [s.title, "", s.intro, "", ...s.verdicts, "", s.rule, "", s.then, ""];
+  if (pack && opts.preamble !== false) out2.push(`> ${s.packIntro(pack.name)}`, "");
   for (const it of items) {
     out2.push(`## ${pack ? `${pack.name} ` : ""}${it.criteriaId}${it.title ? ` \u2014 ${it.title}` : ""}  _(${it.automatability})_`);
     out2.push("", `> ${s.evidence} (${it.evidence.length}${it.evidenceTruncated ? ` / ${it.evidenceTruncated.total}` : ""}):`, "");
@@ -56838,7 +56838,31 @@ function writeAdjudication(items, outDir, opts) {
   };
   writeFileSync10(todoPath, JSON.stringify(file, null, 2) + "\n");
   writeFileSync10(mdPath, formatAdjudication(items, opts.lang ?? "en", opts.standard));
-  return { todoPath, mdPath, count: items.length };
+  const verdictsPath = join35(outDir, "ADJUDICATE.verdicts.json");
+  writeFileSync10(verdictsPath, JSON.stringify({ ...file, items: slimAdjudicationItems(items) }, null, 2) + "\n");
+  const itemsDir = join35(outDir, "adjudicate");
+  mkdirSync9(itemsDir, { recursive: true });
+  for (const it of items) {
+    writeFileSync10(join35(itemsDir, `${it.criteriaId}.md`), formatAdjudication([it], opts.lang ?? "en", opts.standard, { preamble: false }));
+  }
+  return { todoPath, mdPath, verdictsPath, itemsDir, count: items.length };
+}
+function slimAdjudicationItems(items) {
+  return items.map((it) => {
+    const { evidence: _evidence, evidenceTruncated: _truncated, ...rest } = it;
+    return { ...rest, evidence: [] };
+  });
+}
+function hydrateAdjudication(adj, audit2, opts = {}) {
+  const needs = adj.items.filter((it) => !it.evidence || it.evidence.length === 0);
+  if (!needs.length) return;
+  const derived = new Map(buildAdjudicationWorklist(audit2, { ...opts, standard: adj.standard }).map((it) => [it.criteriaId, it]));
+  for (const it of needs) {
+    const full = derived.get(it.criteriaId);
+    if (!full) continue;
+    it.evidence = full.evidence;
+    if (full.evidenceTruncated) it.evidenceTruncated = full.evidenceTruncated;
+  }
 }
 
 // src/llm.ts
@@ -66559,6 +66583,7 @@ function applyAdjudicationFile(p, adj, lang) {
     console.error(`ultra11y verify: --in file not found or not valid JSON: ${inFlag}.`);
     return 2;
   }
+  hydrateAdjudication(adj, audit2, { cwd: typeof p.flags.cwd === "string" ? p.flags.cwd : void 0 });
   const r = applyAdjudication(audit2, adj);
   if (!r.ok) {
     if (p.flags.json) console.log(JSON.stringify(r, null, 2));

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 5.3.3
+  version: 5.3.4
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join50, relative as relative5, resolve as resolve15, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.3.3";
+var VERSION = "5.3.4";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -56773,11 +56773,11 @@ function packGuidanceBlock(standard, criterionId, lang) {
 function plainTest(s) {
   return s.replace(/\[([^\]]+)\]\(#[^)]*\)/g, "$1");
 }
-function formatAdjudication(items, lang = "en", standard = CORE2) {
+function formatAdjudication(items, lang = "en", standard = CORE2, opts = {}) {
   const s = T2[lang];
   const pack = isCore(standard) ? void 0 : loadPack(standard);
-  const out2 = [s.title, "", s.intro, "", ...s.verdicts, "", s.rule, "", s.then, ""];
-  if (pack) out2.push(`> ${s.packIntro(pack.name)}`, "");
+  const out2 = opts.preamble === false ? [] : [s.title, "", s.intro, "", ...s.verdicts, "", s.rule, "", s.then, ""];
+  if (pack && opts.preamble !== false) out2.push(`> ${s.packIntro(pack.name)}`, "");
   for (const it of items) {
     out2.push(`## ${pack ? `${pack.name} ` : ""}${it.criteriaId}${it.title ? ` \u2014 ${it.title}` : ""}  _(${it.automatability})_`);
     out2.push("", `> ${s.evidence} (${it.evidence.length}${it.evidenceTruncated ? ` / ${it.evidenceTruncated.total}` : ""}):`, "");
@@ -56838,7 +56838,31 @@ function writeAdjudication(items, outDir, opts) {
   };
   writeFileSync10(todoPath, JSON.stringify(file, null, 2) + "\n");
   writeFileSync10(mdPath, formatAdjudication(items, opts.lang ?? "en", opts.standard));
-  return { todoPath, mdPath, count: items.length };
+  const verdictsPath = join35(outDir, "ADJUDICATE.verdicts.json");
+  writeFileSync10(verdictsPath, JSON.stringify({ ...file, items: slimAdjudicationItems(items) }, null, 2) + "\n");
+  const itemsDir = join35(outDir, "adjudicate");
+  mkdirSync9(itemsDir, { recursive: true });
+  for (const it of items) {
+    writeFileSync10(join35(itemsDir, `${it.criteriaId}.md`), formatAdjudication([it], opts.lang ?? "en", opts.standard, { preamble: false }));
+  }
+  return { todoPath, mdPath, verdictsPath, itemsDir, count: items.length };
+}
+function slimAdjudicationItems(items) {
+  return items.map((it) => {
+    const { evidence: _evidence, evidenceTruncated: _truncated, ...rest } = it;
+    return { ...rest, evidence: [] };
+  });
+}
+function hydrateAdjudication(adj, audit2, opts = {}) {
+  const needs = adj.items.filter((it) => !it.evidence || it.evidence.length === 0);
+  if (!needs.length) return;
+  const derived = new Map(buildAdjudicationWorklist(audit2, { ...opts, standard: adj.standard }).map((it) => [it.criteriaId, it]));
+  for (const it of needs) {
+    const full = derived.get(it.criteriaId);
+    if (!full) continue;
+    it.evidence = full.evidence;
+    if (full.evidenceTruncated) it.evidenceTruncated = full.evidenceTruncated;
+  }
 }
 
 // src/llm.ts
@@ -66559,6 +66583,7 @@ function applyAdjudicationFile(p, adj, lang) {
     console.error(`ultra11y verify: --in file not found or not valid JSON: ${inFlag}.`);
     return 2;
   }
+  hydrateAdjudication(adj, audit2, { cwd: typeof p.flags.cwd === "string" ? p.flags.cwd : void 0 });
   const r = applyAdjudication(audit2, adj);
   if (!r.ok) {
     if (p.flags.json) console.log(JSON.stringify(r, null, 2));

package/skills/ultra11y/SKILL.md

@@ -4,7 +4,7 @@ description: "Use to AUDIT existing HTML/CSS/JSX against WCAG 2.2 AA accessibili
 when_to_use: "Invoke when the user asks for an accessibility AUDIT or a formal deliverable: audit a repo, site or page against WCAG 2.2 AA or a country standard (RGAA, Section 508, EN 301 549); produce a dated conformance report, a criterion grid, a PRD backlog, or tickets (GitHub/GitLab/Jira); author accessible markup from scratch; wire the repo gate (init --hook/--ci) or a rendered-DOM capture pipeline. For a review of the code UNDER CHANGE (diff, branch, PR), use the `review-a11y` skill instead."
 license: MIT
 metadata:
-  version: 5.3.3
+  version: 5.3.4
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/references/judgment.md

@@ -71,6 +71,31 @@ test).
    the **produced** HTML (see `render` / audit the build), otherwise the verdict is a false
    negative.
 
+## When the adjudicator has no shell (CI)
+
+`verify --manual` writes the worklist **twice**, plus one brief per criterion:
+
+| file | for |
+|---|---|
+| `ADJUDICATE.todo.json` · `ADJUDICATE.md` | a session **with a shell**: evidence inline, edit in place, fold yourself |
+| `ADJUDICATE.verdicts.json` | the **only file to write** when you have no shell — verdicts, no evidence |
+| `adjudicate/<criteriaId>.md` | one small brief per criterion: its evidence, its protocol, its citable tests |
+
+Why the split exists, measured rather than assumed: under RGAA the worklist is 96 criteria
+carrying 1590 harvested anchors — **536 KB** of JSON and **466 KB** of Markdown. An agent given
+`Read/Grep/Glob/Edit/Write` cannot work with that: reading either document swamps its context,
+and filling 96 verdicts inside half a megabyte is 96 exact-match edits. A real CI run spent 75
+of 424 turns, hit 17 permission denials trying to run the commands the runbook prescribes, and
+returned the file untouched — so the fail-closed fold discarded all 96 verdicts and every
+criterion stayed « to assess », in a job that reported success. The verdicts file is **37 KB**
+for the same worklist, and each brief is a few KB.
+
+`verify --apply` accepts either file. Given the verdicts-only one it **re-derives the evidence
+from the audit** (the worklist is a pure function of the audit) and then runs the identical
+fold: same coverage checks in both directions, same citation matching against *that criterion's*
+own anchors, same refusals. The smaller surface buys nothing from the gate — a `C` that cites
+an anchor it was never shown is refused exactly as before.
+
 ## Adversarial verification of the non-conformities — `verify --report`
 
 Unchanged: `node scripts/ultra11y.mjs verify --report audits/wcag-YYYY-MM-DD.md` writes `VERIFY.md`

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join50, relative as relative5, resolve as resolve15, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.3.3";
+var VERSION = "5.3.4";
 var SCHEMA_VERSION = 2;
 
 // src/audit.ts
@@ -56773,11 +56773,11 @@ function packGuidanceBlock(standard, criterionId, lang) {
 function plainTest(s) {
   return s.replace(/\[([^\]]+)\]\(#[^)]*\)/g, "$1");
 }
-function formatAdjudication(items, lang = "en", standard = CORE2) {
+function formatAdjudication(items, lang = "en", standard = CORE2, opts = {}) {
   const s = T2[lang];
   const pack = isCore(standard) ? void 0 : loadPack(standard);
-  const out2 = [s.title, "", s.intro, "", ...s.verdicts, "", s.rule, "", s.then, ""];
-  if (pack) out2.push(`> ${s.packIntro(pack.name)}`, "");
+  const out2 = opts.preamble === false ? [] : [s.title, "", s.intro, "", ...s.verdicts, "", s.rule, "", s.then, ""];
+  if (pack && opts.preamble !== false) out2.push(`> ${s.packIntro(pack.name)}`, "");
   for (const it of items) {
     out2.push(`## ${pack ? `${pack.name} ` : ""}${it.criteriaId}${it.title ? ` \u2014 ${it.title}` : ""}  _(${it.automatability})_`);
     out2.push("", `> ${s.evidence} (${it.evidence.length}${it.evidenceTruncated ? ` / ${it.evidenceTruncated.total}` : ""}):`, "");
@@ -56838,7 +56838,31 @@ function writeAdjudication(items, outDir, opts) {
   };
   writeFileSync10(todoPath, JSON.stringify(file, null, 2) + "\n");
   writeFileSync10(mdPath, formatAdjudication(items, opts.lang ?? "en", opts.standard));
-  return { todoPath, mdPath, count: items.length };
+  const verdictsPath = join35(outDir, "ADJUDICATE.verdicts.json");
+  writeFileSync10(verdictsPath, JSON.stringify({ ...file, items: slimAdjudicationItems(items) }, null, 2) + "\n");
+  const itemsDir = join35(outDir, "adjudicate");
+  mkdirSync9(itemsDir, { recursive: true });
+  for (const it of items) {
+    writeFileSync10(join35(itemsDir, `${it.criteriaId}.md`), formatAdjudication([it], opts.lang ?? "en", opts.standard, { preamble: false }));
+  }
+  return { todoPath, mdPath, verdictsPath, itemsDir, count: items.length };
+}
+function slimAdjudicationItems(items) {
+  return items.map((it) => {
+    const { evidence: _evidence, evidenceTruncated: _truncated, ...rest } = it;
+    return { ...rest, evidence: [] };
+  });
+}
+function hydrateAdjudication(adj, audit2, opts = {}) {
+  const needs = adj.items.filter((it) => !it.evidence || it.evidence.length === 0);
+  if (!needs.length) return;
+  const derived = new Map(buildAdjudicationWorklist(audit2, { ...opts, standard: adj.standard }).map((it) => [it.criteriaId, it]));
+  for (const it of needs) {
+    const full = derived.get(it.criteriaId);
+    if (!full) continue;
+    it.evidence = full.evidence;
+    if (full.evidenceTruncated) it.evidenceTruncated = full.evidenceTruncated;
+  }
 }
 
 // src/llm.ts
@@ -66559,6 +66583,7 @@ function applyAdjudicationFile(p, adj, lang) {
     console.error(`ultra11y verify: --in file not found or not valid JSON: ${inFlag}.`);
     return 2;
   }
+  hydrateAdjudication(adj, audit2, { cwd: typeof p.flags.cwd === "string" ? p.flags.cwd : void 0 });
   const r = applyAdjudication(audit2, adj);
   if (!r.ok) {
     if (p.flags.json) console.log(JSON.stringify(r, null, 2));

package/src/adjudicate.ts

@@ -909,11 +909,18 @@ function plainTest(s: string): string {
   return s.replace(/\[([^\]]+)\]\(#[^)]*\)/g, "$1");
 }
 
-export function formatAdjudication(items: AdjudicationItem[], lang: Lang = "en", standard: StandardId = CORE): string {
+/** `preamble: false` renders the criterion sections ALONE.
+ *
+ *  The preamble names the file to write into and the command to fold with, which is right for
+ *  the one combined document and wrong for a per-criterion brief: repeated 96 times it is 96
+ *  copies of instructions that contradict a CI adjudicator's toolset (it has no shell) and
+ *  point at the wrong file. The briefs carry evidence and protocol; the instructions live once,
+ *  in the worklist's `contract` field and the dispatch contract. */
+export function formatAdjudication(items: AdjudicationItem[], lang: Lang = "en", standard: StandardId = CORE, opts: { preamble?: boolean } = {}): string {
   const s = T[lang];
   const pack = isCore(standard) ? undefined : loadPack(standard);
-  const out: string[] = [s.title, "", s.intro, "", ...s.verdicts, "", s.rule, "", s.then, ""];
-  if (pack) out.push(`> ${s.packIntro(pack.name)}`, "");
+  const out: string[] = opts.preamble === false ? [] : [s.title, "", s.intro, "", ...s.verdicts, "", s.rule, "", s.then, ""];
+  if (pack && opts.preamble !== false) out.push(`> ${s.packIntro(pack.name)}`, "");
   for (const it of items) {
     out.push(`## ${pack ? `${pack.name} ` : ""}${it.criteriaId}${it.title ? ` — ${it.title}` : ""}  _(${it.automatability})_`);
     out.push("", `> ${s.evidence} (${it.evidence.length}${it.evidenceTruncated ? ` / ${it.evidenceTruncated.total}` : ""}):`, "");
@@ -970,6 +977,10 @@ export function formatAdjudication(items: AdjudicationItem[], lang: Lang = "en",
 export interface WriteAdjudicationResult {
   todoPath: string;
   mdPath: string;
+  /** The verdicts-only file, for an adjudicator that cannot edit half a megabyte of JSON. */
+  verdictsPath: string;
+  /** One small Markdown brief per criterion, for one that cannot read it either. */
+  itemsDir: string;
   count: number;
 }
 
@@ -992,5 +1003,60 @@ export function writeAdjudication(
   };
   writeFileSync(todoPath, JSON.stringify(file, null, 2) + "\n");
   writeFileSync(mdPath, formatAdjudication(items, opts.lang ?? "en", opts.standard));
-  return { todoPath, mdPath, count: items.length };
+
+  // THE SPLIT SURFACE, for an adjudicator that cannot shell out.
+  //
+  // The two documents above are sized for a session with a shell: 96 RGAA criteria carrying
+  // 30 evidence anchors each come to ~540 KB of JSON and ~470 KB of Markdown, and the runbook
+  // tells the reader to edit the JSON in place and then run the engine to fold it. That is
+  // fine locally. In CI the adjudicator is handed Read/Grep/Glob/Edit/Write and nothing else,
+  // and against those tools the same instructions are impossible: reading either document
+  // swamps the context, editing 96 verdicts inside half a megabyte of JSON is 96 exact-match
+  // edits, and every prescribed `node …` command is denied. Measured on a real run: 17
+  // permission denials, 75 of 424 turns used, and a todo file that came back untouched — so
+  // the fail-closed fold correctly discarded all 96 and every criterion stayed "to assess".
+  //
+  // So the same worklist is also written as one small file to WRITE and one small file per
+  // criterion to READ. Additive on purpose: the two documents above keep their exact shape and
+  // every existing caller, gate and test is untouched.
+  const verdictsPath = join(outDir, "ADJUDICATE.verdicts.json");
+  writeFileSync(verdictsPath, JSON.stringify({ ...file, items: slimAdjudicationItems(items) }, null, 2) + "\n");
+  const itemsDir = join(outDir, "adjudicate");
+  mkdirSync(itemsDir, { recursive: true });
+  for (const it of items) {
+    writeFileSync(join(itemsDir, `${it.criteriaId}.md`), formatAdjudication([it], opts.lang ?? "en", opts.standard, { preamble: false }));
+  }
+  return { todoPath, mdPath, verdictsPath, itemsDir, count: items.length };
+}
+
+/** The worklist with the evidence stripped: what an adjudicator has to WRITE, without the
+ *  bulk it only has to READ. Every field the fold requires — verdict, justification, reason,
+ *  findings, citations, recommendations — is kept, so a filled slim file carries a complete
+ *  decision. The evidence comes back at fold time via `hydrateAdjudication`. */
+export function slimAdjudicationItems(items: AdjudicationItem[]): AdjudicationItem[] {
+  return items.map((it) => {
+    const { evidence: _evidence, evidenceTruncated: _truncated, ...rest } = it;
+    return { ...rest, evidence: [] } as AdjudicationItem;
+  });
+}
+
+/** Put the evidence back on a slim adjudication, re-derived from the audit it was built from.
+ *
+ *  Safe because the worklist is a pure function of the audit: same audit, same harvesters, same
+ *  anchors. This is what lets `verify --apply` accept a verdicts-only file WITHOUT relaxing a
+ *  single check — the citation gate still matches each cited anchor against this criterion's
+ *  own harvested evidence, exactly as it does for an inline worklist.
+ *
+ *  An item the re-derivation does not know is left alone: it is a surplus verdict, and the
+ *  coverage check in `applyAdjudication` is what must reject it. */
+export function hydrateAdjudication(adj: AdjudicationFile, audit: AuditResult, opts: { cwd?: string } = {}): void {
+  const needs = adj.items.filter((it) => !it.evidence || it.evidence.length === 0);
+  if (!needs.length) return;
+  const derived = new Map(buildAdjudicationWorklist(audit, { ...opts, standard: adj.standard }).map((it) => [it.criteriaId, it]));
+  for (const it of needs) {
+    const full = derived.get(it.criteriaId);
+    if (!full) continue;
+    it.evidence = full.evidence;
+    if (full.evidenceTruncated) it.evidenceTruncated = full.evidenceTruncated;
+  }
 }

package/src/cli.ts

@@ -42,7 +42,14 @@ import { runCriteria, renderCriteriaReference } from "./criteria.js";
 import { checkReport, checkSemantic } from "./check.js";
 import { buildWorklist, writeWorklist, applyVerdicts, VERIFY_MAX, type VerifyItem } from "./verify.js";
 import { groundItems } from "./grounding.js";
-import { buildAdjudicationWorklist, formatAdjudication, writeAdjudication, applyAdjudication, type AdjudicationFile } from "./adjudicate.js";
+import {
+  buildAdjudicationWorklist,
+  formatAdjudication,
+  writeAdjudication,
+  applyAdjudication,
+  hydrateAdjudication,
+  type AdjudicationFile,
+} from "./adjudicate.js";
 import { BATCH_SIZE, apiKeyFromEnv, applyRawVerdicts, judgeAll, modelFromEnv } from "./llm.js";
 import { runScan, runScanMany, runCrawlScan, runSampleScan, mergeDynamic, mergeSnapshotAudit, cleanDynamic, dockerAvailable } from "./scan.js";
 import { runScanLocal, runScanManyLocal, runCrawlScanLocal, runSampleScanLocal, localAvailable } from "./scan-local.js";
@@ -2637,6 +2644,11 @@ function applyAdjudicationFile(p: ParsedArgs, adj: AdjudicationFile, lang: Lang)
     console.error(`ultra11y verify: --in file not found or not valid JSON: ${inFlag}.`);
     return 2;
   }
+  // A verdicts-only file (`ADJUDICATE.verdicts.json`) carries decisions without the evidence
+  // they were made against. Put it back from the audit before folding: the worklist is a pure
+  // function of the audit, so this reconstructs the very anchors the citation gate checks
+  // against — the fold below is the same fold, with the same refusals.
+  hydrateAdjudication(adj, audit, { cwd: typeof p.flags.cwd === "string" ? (p.flags.cwd as string) : undefined });
   const r = applyAdjudication(audit, adj);
   if (!r.ok) {
     if (p.flags.json) console.log(JSON.stringify(r, null, 2));

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.3.3";
+export const VERSION = "5.3.4";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,