wicked-garden 12.27.0

package/skills/persona/SKILL.md

@@ -0,0 +1,144 @@
+---
+name: wicked-garden-persona
+context: fork
+description: |
+  On-demand persona invocation system for applying named perspectives to any task.
+  Use when: invoking a named persona via persona:as, defining or listing
+  personas, or reviewing work through a specific role's perspective.
+disable-model-invocation: true
+phase_relevance: ["*"]
+archetype_relevance: ["*"]
+---
+
+# Persona System
+
+On-demand persona invocation for applying named perspectives to any task.
+Personas are behavioral modifiers — they change the lens through which a task
+is executed, not the tools available.
+
+## Quick Start
+
+```
+/wicked-garden:persona:as engineering "review this auth flow"
+/wicked-garden:persona:list
+/wicked-garden:persona:define pragmatic-tech-lead --focus "delivery over perfection"
+/wicked-garden:persona:submit pragmatic-tech-lead
+```
+
+## How It Works
+
+1. **Registry** merges built-in specialists + custom personas + plugin cache
+2. **persona:as** looks up a persona and dispatches to persona-agent
+3. **persona-agent** executes the task under the persona's behavioral profile
+4. **Behavior emerges** from personality, constraints, memories, and preferences
+
+## Commands
+
+| Command | Purpose |
+|---------|---------|
+| `persona:as <name> <task>` | Invoke a persona for any task |
+| `persona:list [--role R]` | List all available personas |
+| `persona:define <name> --focus "..." [--save]` | Create or update a custom persona |
+| `persona:submit <name>` | PR a custom persona to the repo |
+
+## Built-in Personas
+
+Names come from `.claude-plugin/specialist.json`; their rich profiles live in
+`scripts/persona/registry.py::_BUILTIN_RICH`. The built-ins are **illustrative
+exemplars**, not the product. A blinded, independently-graded lift eval
+(`tests/persona/EVAL_RESULTS.md`, run 2026-06-12) found the built-in personas
+produce **lift=0** against a strong base model — it already flags the targeted
+failure modes unprompted. So the curated surface was **reduced**: only the three
+**methodology exemplars** keep rich profiles (they show the GOOD pattern); the
+generic role personas were demoted to thin role records. For real leverage,
+define your OWN house persona (see "Custom Personas") — that is the actual product.
+
+### Methodology personas (carry a failure-mode defense — the GOOD pattern)
+
+Their registry records encode `FAILURE MODE — …` constraints + a `not_focus`
+scope guard the base model does not reliably self-apply. Kept as illustrative
+exemplars of what a worth-keeping persona looks like.
+
+| Name | Role | Defends against |
+|------|------|-----------------|
+| platform | devsecops | Silent secret exposure, irreversible deploy, privilege creep, unbounded blast radius |
+| qe | quality-engineering | Self-graded "done", happy-path-only tests, untested recovery, coverage theater |
+| agentic | agentic-architecture | Runaway loops, ungated irreversible actions, over-broad tool access, non-idempotent retries |
+
+(`skeptic`, a fallback persona, is also methodology — it forces an edge case
+before any approval.)
+
+### Generic role names (thin lens — no curated profile)
+
+These specialist names still resolve via `persona:as`, but carry **no curated
+constraints** — the eval showed the base model already plays these roles, so a
+rich profile added surface without lift. They apply the role as a plain lens.
+Any role name not in this list (e.g. an ad-hoc one) falls back gracefully —
+`persona:as` lists what's available rather than crashing. Want durable value
+from one of these lenses? `persona:define` your house version with a failure-mode
+constraint.
+
+| Name | Role | Plain lens for |
+|------|------|---------|
+| engineering | engineering | Code quality, architecture, implementation |
+| product | product | Requirements, UX, design review, business strategy |
+| data | data-engineering | Pipeline design, ML guidance, analytics |
+| jam | brainstorming | Ideation, exploration, multi-perspective analysis |
+
+## Custom Personas
+
+Create your own with `persona:define`. Stored in project-scoped DomainStore.
+
+```
+/wicked-garden:persona:define pragmatic-tech-lead \
+  --focus "delivery over perfection — ship iteratively, measure, adjust" \
+  --traits "direct,pragmatic,cost-aware" \
+  --role engineering
+```
+
+Use `--save` to promote to plugin-level cache for cross-project reuse:
+```
+/wicked-garden:persona:define my-persona --focus "..." --save
+```
+
+## Persona Schema
+
+Each persona has rich characteristics that create a genuine perspective:
+
+```
+name        — kebab-case identifier
+description — one-line summary
+focus       — the lens this persona applies
+traits      — behavioral adjectives
+role        — category for --role filtering
+personality — style, temperament, humor
+constraints — non-negotiable rules (MUST follow)
+memories    — formative experiences that inform judgment
+preferences — communication, code_style, review_focus, decision_making
+```
+
+## Cross-Domain Integration
+
+Route any code review through a persona's lens:
+```
+/wicked-garden:engineering:review --persona platform
+/wicked-garden:engineering:review --persona qe
+```
+
+Falls back to the built-in `architect` persona if the named persona is not found.
+
+## Fallback Personas
+
+If specialist.json is unavailable, three built-in personas are always available:
+- **architect** — system design, trade-offs, structural decisions
+- **skeptic** — challenges assumptions, finds edge cases
+- **advocate** — champions end-user perspective and simplicity
+
+## Source Priority
+
+When names collide across sources, higher priority wins:
+```
+custom (DomainStore) > cache (~/.claude/plugins/...) > builtin > fallback
+```
+
+This lets you override a built-in persona with a project-specific version.

package/skills/persona/refs/define.md

@@ -0,0 +1,133 @@
+# persona:define — Create / Update Persona Rubric
+
+Full rubric sourced from `commands/persona/define.md`.
+Stores a custom persona in the project-scoped DomainStore. This is the
+**mechanism** that lets an enterprise inject its house personas.
+
+## What makes a persona worth defining
+
+A persona earns its keep only when it encodes something the base model does NOT
+reliably supply on its own. Three kinds of durable value:
+
+1. **A named failure-mode defense** — a guard against a specific way work goes
+   wrong that the base model does not volunteer (e.g. "refuse a deploy with no
+   tested rollback").
+2. **A hard constraint** — a non-negotiable house rule (e.g. "no PII in logs,
+   ever — block the change").
+3. **A scope guard** (`--not-focus`) — what the persona deliberately does NOT
+   own, so it stays sharp instead of diffusing into a generic reviewer.
+
+A persona that only restates a role ("act like a senior engineer") has low
+durable value — the base model already does that, and the delta shrinks each
+model release. Don't claim a persona is better by assertion — if you want proof
+it lifts behaviour, add an eval (see `tests/persona/` and the model-eval cases
+in `tests/persona/eval_cases/`).
+
+## The GOOD pattern (constraint + named failure mode + rationale + scope guard)
+
+Author a house persona that defends a real failure mode, not a role restatement:
+
+```bash
+/wicked-garden:persona:define payments-reviewer \
+  --focus "money movement is irreversible — verify before it ships" \
+  --traits "exacting,paranoid,evidence-driven" \
+  --role finance \
+  --constraints "FAILURE MODE — double-charge: any retry on a charge/transfer path MUST carry an idempotency key; flag and block if absent; FAILURE MODE — silent rounding: every currency calc states its rounding mode and precision — unstated rounding is a defect; FAILURE MODE — unlogged money movement: every balance change MUST emit an auditable event before it is considered done" \
+  --not-focus "UI copy and layout — hand to product; general code style — hand to engineering" \
+  --save
+```
+
+Why this is GOOD, not generic:
+- Each constraint names the **failure mode** it defends (double-charge, silent
+  rounding, unlogged movement) — the base model does not raise these unprompted.
+- The **scope guard** (`--not-focus`) stops the persona from drifting into a
+  generic reviewer.
+- The **rationale** lives in the focus + the failure-mode names, so a future
+  reader knows WHY each constraint exists.
+
+A WEAK definition to avoid:
+
+```bash
+# Low durable value — restates a role the base model already plays.
+/wicked-garden:persona:define senior-dev --focus "write good clean code"
+```
+
+## Step 1: Parse and Validate
+
+Extract from `$ARGUMENTS`:
+
+- `name` (required): first non-flag token — kebab-case
+- `--focus` (required): the perspective this persona applies
+- `--traits` (optional): comma-separated behavioral adjectives
+- `--constraints` (optional): **semicolon-separated** non-negotiable rules. For a
+  methodology persona, phrase each as `FAILURE MODE — <name>: <the guard the base
+  model skips>`. (Semicolon, not comma — commas are common inside a single rule.)
+- `--not-focus` (optional): **semicolon-separated** concerns this persona does NOT
+  own (scope guard).
+- `--role` (optional): category for filtering (default: "custom")
+- `--save` (optional flag): also promote to plugin cache for cross-project reuse
+
+If `name` is missing:
+> "name is required. Usage: /wicked-garden:persona:define <name> --focus \"<focus>\""
+> STOP.
+
+If `--focus` is absent:
+> "focus is required — describe the perspective this persona applies."
+> "Example: /wicked-garden:persona:define pragmatic-tech-lead --focus \"delivery over perfection\""
+> STOP.
+
+If `--constraints` and `--not-focus` are both absent, gently nudge (do NOT block):
+> "Tip: a persona with no constraints mostly restates a role the base model
+> already plays. Consider adding `--constraints \"FAILURE MODE — …\"` so it
+> defends a specific failure mode."
+
+## Step 2: Store in DomainStore
+
+```bash
+RESULT=$(sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" \
+  "${CLAUDE_PLUGIN_ROOT}/scripts/_run.py" \
+  scripts/persona/registry.py \
+  --define "${name}" \
+  --focus "${focus}" \
+  [--traits "${traits}"] \
+  [--constraints "${constraints}"] \
+  [--not-focus "${not_focus}"] \
+  [--role "${role}"] \
+  --json)
+```
+
+Only include the optional flags that were actually provided.
+
+If the command fails (exit non-zero), show the error from stderr and STOP.
+
+## Step 3: Optionally Save to Plugin Cache
+
+If `--save` flag is present:
+
+```bash
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" \
+  "${CLAUDE_PLUGIN_ROOT}/scripts/_run.py" \
+  scripts/persona/registry.py \
+  --save-cache "${name}" \
+  --json
+```
+
+## Step 4: Confirm
+
+Check whether `_updated: true` (existing persona overwritten) or `_updated: false` (new).
+
+If new persona:
+> "Created persona '{name}'. Invoke with: `/wicked-garden:persona:as {name} <task>`"
+
+If existing updated:
+> "Updated persona '{name}'."
+
+If `--save` was used, add:
+> "Saved to plugin cache — available in all projects."
+
+Show persona summary:
+- **Focus**: {focus}
+- **Traits**: {traits comma-separated or "none"}
+- **Constraints**: {count, or "none — this persona mostly restates a role"}
+- **Not focus**: {not_focus joined, or "none"}
+- **Role**: {role}

package/skills/platform/actions/refs/actions.md

@@ -0,0 +1,114 @@
+# GitHub Actions Rubric
+
+Generate, optimize, and troubleshoot GitHub Actions workflows.
+
+## Parse Mode
+
+Determine operation mode from arguments:
+- **generate**: Create new workflow from stack detection
+- **optimize**: Improve existing workflow performance/security
+- **troubleshoot**: Debug failing workflow
+
+## Generate Mode
+
+Detect project stack:
+```bash
+ls package.json pyproject.toml Cargo.toml go.mod pom.xml 2>/dev/null
+```
+
+Generate workflow with all security + performance features:
+
+**Security-First Checklist:**
+- [ ] Explicit permissions declared (not `write-all`)
+- [ ] Action versions pinned to major or full hash
+- [ ] No direct input interpolation (injection risk)
+- [ ] Secrets via environment variables only
+- [ ] Timeout configured per job
+- [ ] Concurrency control enabled
+
+**Performance Checklist:**
+- [ ] Dependency caching enabled (`cache: 'npm'` / `actions/cache@v4`)
+- [ ] Concurrency group cancels stale runs
+- [ ] Path filtering skips doc-only changes
+- [ ] Matrix strategy for multi-version only when needed
+
+### Minimal Secure CI Template
+
+```yaml
+name: CI
+on:
+  push:
+    branches: [main]
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+      - run: npm ci
+      - run: npm test
+      - run: npm run lint
+```
+
+Adapt the setup action and run commands for Python (`setup-python@v5`, `pip install`, `pytest`),
+Go (`setup-go@v5`, `go test ./...`), Rust (`cargo test`), etc.
+
+## Optimize Mode
+
+Read the target workflow file. Apply this checklist:
+
+- [ ] `permissions:` block is explicit (remove `write-all` or omit→defaults)
+- [ ] All `uses:` actions pinned to a version tag or commit SHA
+- [ ] `concurrency:` group configured with `cancel-in-progress: true`
+- [ ] `timeout-minutes:` set on each job (default GitHub max is 6h — bad)
+- [ ] Dependency cache configured via setup action `cache:` param or `actions/cache@v4`
+- [ ] `paths-ignore:` or `paths:` on push/PR triggers for large repos
+- [ ] No `${{ github.event.*.body }}` or similar untrusted inputs in `run:` commands
+- [ ] No secrets printed or echoed in steps
+
+Return optimized YAML + annotated diff of every change with rationale.
+
+## Troubleshoot Mode
+
+```bash
+# Get most recent failure
+gh run list --status failure --limit 1 --json databaseId,name,headBranch -q '.[0]'
+
+# Get failure logs
+gh run view {id} --log-failed
+```
+
+Analyze the error output. Common patterns:
+| Error | Cause | Fix |
+|-------|-------|-----|
+| `Permission denied` on action | Missing `permissions:` | Add explicit block |
+| `Secret not found` | Wrong secret name | Check repo settings → Secrets |
+| `Cache miss every run` | Wrong key or path | Verify `hashFiles()` target |
+| `Process exited with code 1` in build | Test failure or bad cmd | Read log output |
+| `No such file` | Wrong working-directory | Add `working-directory:` |
+
+Provide root cause and the exact YAML fix.
+
+## Output Format
+
+**Generate/Optimize**: Provide complete workflow YAML, then a bullet list of security features applied
+and performance improvements with estimated savings.
+
+**Troubleshoot**: Root cause + the exact YAML or command fix. Offer `gh run rerun {id}` command.

package/skills/platform/audit/SKILL.md

@@ -0,0 +1,174 @@
+---
+name: audit
+description: |
+  Audit evidence collection and trail verification. Gathers artifacts,
+  validates controls, generates audit reports, and maintains compliance
+  documentation.
+
+  Use when: "audit trail", "collect evidence", "audit report",
+  "control testing", "compliance documentation"
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+
+# Audit Skill
+
+Collect evidence and verify audit trails for compliance.
+
+## When to Use
+
+- Preparing for external audit
+- Collecting evidence for compliance certification
+- Verifying audit trail completeness
+- Generating audit reports
+- User says "audit", "evidence", "audit trail", "control testing"
+
+## Commands
+
+```bash
+/wicked-garden:platform:audit [--controls] [--trail] [--report]
+```
+
+## Audit Process
+
+### 1. Define Scope
+
+Identify audit targets:
+- Code components
+- Data flows
+- Access controls
+- Infrastructure
+- Processes
+
+### 2. Collect Evidence
+
+**Code Evidence**:
+- Access control implementation
+- Encryption usage
+- Input validation
+- Error handling
+- Logging statements
+
+**Configuration Evidence**:
+- TLS/SSL settings
+- Database encryption
+- Key management
+- Network policies
+- IAM roles
+
+**Documentation Evidence**:
+- Architecture diagrams
+- Data flow diagrams
+- Security policies
+- Incident response plans
+
+**Operational Evidence**:
+- Access logs
+- Audit logs
+- Security events
+- Change logs
+
+See [refs/checklists-soc2-hipaa.md](refs/checklists-soc2-hipaa.md), [refs/checklists-gdpr-pci-evidence.md](refs/checklists-gdpr-pci-evidence.md), and [refs/checklists-evidence-operations.md](refs/checklists-evidence-operations.md) for comprehensive evidence checklists.
+
+### 3. Verify Controls
+
+Test each control:
+
+```bash
+# Check encryption
+grep -r "encrypt\|cipher\|AES\|TLS" {target}
+
+# Check access controls
+grep -r "authorize\|authenticate\|require.*auth" {target}
+
+# Check audit logging
+grep -r "log\|audit\|event" {target}
+```
+
+See [refs/frameworks-soc2-hipaa.md](refs/frameworks-soc2-hipaa.md) and [refs/frameworks-gdpr-pci.md](refs/frameworks-gdpr-pci.md) for framework-specific control testing procedures.
+
+### 4. Document Gaps
+
+Identify:
+- Controls without evidence
+- Incomplete audit trails
+- Missing documentation
+- Configuration gaps
+
+### 5. Generate Report
+
+Create report with:
+- Controls tested
+- Evidence collected
+- Gaps identified
+- Recommendations
+- Risk assessment
+
+## Evidence Types
+
+| Type | Description | Examples |
+|------|-------------|----------|
+| **Design** | Architecture | Diagrams, specs, policies |
+| **Implementation** | Code | Functions, configs, tests |
+| **Operational** | Runtime | Logs, metrics, incidents |
+| **Process** | Procedural | Approvals, reviews, training |
+
+## Integration
+
+### With native tasks
+
+Attach audit evidence by appending to the task description (reference file paths checked into the repo):
+```
+TaskUpdate(
+  taskId="{task_id}",
+  description="{previous}\n\n## Audit Evidence: {control_id}\nEvidence file: {evidence_path}"
+)
+```
+
+### With wicked-brain
+
+Find related evidence (FTS5 over indexed code):
+```bash
+wicked-brain:search "audit|logging|encrypt"
+```
+
+## Output Format
+
+```markdown
+## Audit Report: {Framework}
+
+**Status**: {READY|NEEDS WORK|NOT READY}
+**Controls Tested**: {count} | **Gaps**: {count}
+
+### Controls Tested
+| ID | Status | Evidence |
+|----|--------|----------|
+| CC6.1 | PASS | auth.py:15 |
+| CC7.2 | FAIL | Missing |
+
+### Evidence
+- Design: docs/arch.md
+- Code: src/auth.py, src/crypto.py
+- Operational: /var/log/audit.log
+
+### Critical Gaps (P0)
+1. Missing admin audit trail
+2. No TLS for PII endpoints
+
+### Recommendations
+1. Fix P0 gaps before certification
+2. Schedule follow-up audit
+```
+
+## Quality Standards
+
+Good audit evidence:
+- Specific file/line references
+- Clear control mapping
+- Complete artifact trails
+- Risk-prioritized gaps
+
+Bad audit evidence:
+- Generic statements
+- No source references
+- Missing artifacts