wicked-garden 12.27.0

package/skills/platform/gate-benchmark-rebaseline/SKILL.md

@@ -0,0 +1,108 @@
+---
+name: gate-benchmark-rebaseline
+description: |
+  Re-baseline procedure for the AC-11 gate-result benchmark lane
+  (`tests/crew/test_gate_result_benchmark.py`). The benchmark enforces a
+  2× p95 SLO on `gate-result.json` ingestion. When a deliberate perf change
+  lands on main (validator hardening, cache tuning, schema expansion), the
+  baseline needs updating. Never re-baseline to silence a regression.
+
+  Use when: "re-baseline AC-11 benchmark", "gate-result benchmark regression",
+  "p95 benchmark baseline out of date", "update benchmark_baseline.json",
+  "benchmark.yml failure", "gate-result p95 exceeds 2x baseline",
+  "rebaseline procedure", or `AC-11` baseline drift.
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+
+# Gate-Result Benchmark Re-baseline
+
+Operational procedure for updating `tests/crew/benchmark_baseline.json` after a legitimate perf change on `main`.
+
+## When to re-baseline
+
+Re-baseline **only** when a deliberate perf change lands on `main`. Examples:
+
+- Validator hardening (added / removed gate-result schema checks)
+- Cache eviction tuning (changes to gate-result ingestion memoization)
+- Schema expansion (new required fields in `gate-result.json`)
+- Sanitizer pattern changes (`scripts/qe/content_sanitizer.py`)
+
+**Do not re-baseline to silence a regression.** If the benchmark fails on a PR that didn't intend perf work, treat it as a real regression and find the cause.
+
+## How the lane works
+
+- **Workflow**: `.github/workflows/benchmark.yml`
+- **Trigger**: PRs touching `scripts/crew/phase_manager.py`, the gate-result schema/sanitizer (`scripts/qe/content_sanitizer.py`), or the benchmark test/baseline themselves. Other PRs skip the lane to keep default CI cost flat.
+- **Test**: `tests/crew/test_gate_result_benchmark.py::test_load_gate_result_p95_within_2x_baseline`
+- **Marker**: `benchmark` — opt-in. Local `uv run pytest` deselects it (see `pyproject.toml` `addopts = "-m 'not benchmark'"`).
+- **Explicit invocation**: `uv run pytest -m benchmark`
+- **Fixtures**: 50 deterministic `gate-result.json` files cycling through 1 KB / 4 KB / 16 KB / 60 KB (bounded by `MAX_SUMMARY_BYTES`). Each round clears the memoization cache so the full validate + sanitize + cache-insert path is measured. Cache-hit timing is **not** part of the SLO.
+- **Baseline**: `tests/crew/benchmark_baseline.json` — `p95_ns` in nanoseconds.
+- **Assertion**: `p95_current ≤ slo_multiplier × p95_baseline` (default `slo_multiplier = 2.0`). The workflow comments the delta on every triggered PR.
+- **Missing-baseline behavior**: if `benchmark_baseline.json` is deleted or malformed, the test soft-skips with a directive to record one. The SLO is not enforced until a valid baseline is present — so a re-baseline PR can merge without a circular dependency.
+
+## Re-baseline procedure
+
+1. **Check out the target main commit.**
+
+   ```bash
+   git checkout main && git pull
+   ```
+
+2. **Run the benchmark three times.** The SLO is against p95, and CI noise varies — taking the highest of three local runs adds margin.
+
+   ```bash
+   uv run pytest -m benchmark tests/crew/test_gate_result_benchmark.py -s
+   uv run pytest -m benchmark tests/crew/test_gate_result_benchmark.py -s
+   uv run pytest -m benchmark tests/crew/test_gate_result_benchmark.py -s
+   ```
+
+3. **Record the highest `p95_current` reading** from the three runs.
+
+4. **Update `tests/crew/benchmark_baseline.json`:**
+
+   | Field | New value |
+   |-------|-----------|
+   | `p95_ns` | The highest `p95_current` from step 3, rounded **up** |
+   | `recorded_on` | Today's date (`YYYY-MM-DD`) |
+   | `recorded_from_commit` | Short SHA of the target main commit |
+   | `slo_multiplier` | Leave at `2.0` unless the AC-11 contract changes |
+   | `rebaseline_procedure` | Leave at `wicked-garden:platform:gate-benchmark-rebaseline` |
+
+5. **Commit the baseline update in a dedicated PR.** Title convention:
+
+   ```
+   chore(benchmark): re-baseline AC-11 after {change-summary}
+   ```
+
+6. **The benchmark workflow runs on the PR and must pass** (p95 should be well under 2× the new baseline since you just measured it).
+
+## Pre-flip dependency (semantic-gate condition)
+
+Strict mode for gate-result ingestion (`WG_GATE_RESULT_STRICT_AFTER`, default `2026-06-18`) **requires** the AC-11 benchmark lane to be active in CI. Rationale: once strict-mode activates, a silent 2×+ perf regression would push every `approve_phase` call over the SLO without a guard.
+
+If the benchmark lane is broken or disabled on `main`:
+
+- **Before the flip date**: push `WG_GATE_RESULT_STRICT_AFTER` out (env var or default-constant update). Do not let strict-mode activate without benchmark enforcement.
+- **After the flip date**: fix the benchmark lane before touching the ingestion path.
+
+## Env-var rollback (preferred over revert)
+
+For production rollback of a specific ingestion check, prefer env-var soft-disable over git-revert:
+
+| Variable | Effect |
+|----------|--------|
+| `WG_GATE_RESULT_SCHEMA_VALIDATION=off` | Skip schema validator |
+| `WG_GATE_RESULT_CONTENT_SANITIZATION=off` | Skip content sanitizer |
+| `WG_GATE_RESULT_DISPATCH_CHECK=off` | Skip dispatch-log orphan check |
+
+All flags auto-expire at `WG_GATE_RESULT_STRICT_AFTER`.
+
+## References
+
+- Test: `tests/crew/test_gate_result_benchmark.py`
+- Baseline: `tests/crew/benchmark_baseline.json`
+- Workflow: `.github/workflows/benchmark.yml`
+- Ingestion path: `scripts/crew/phase_manager.py` (gate-result load + memoization)
+- Sanitizer: `scripts/qe/content_sanitizer.py`

package/skills/platform/gh/refs/gh.md

@@ -0,0 +1,105 @@
+# GitHub CLI Operations Rubric
+
+Advanced gh CLI operations for workflow debugging, PR management, and release automation.
+
+## Workflow Operations
+
+```bash
+# List recent workflow runs (failures first)
+gh run list --limit 10
+
+# View a failed workflow with logs
+gh run view {run-id} --log-failed
+
+# Re-run only failed jobs
+gh run rerun {run-id} --failed
+
+# Trigger a workflow manually
+gh workflow run {workflow-name}
+
+# List workflows
+gh workflow list
+```
+
+## PR Management Operations
+
+```bash
+# List open PRs with review status
+gh pr list --state open
+
+# View PR details and check status
+gh pr view {number} --comments
+
+# Check CI status for a PR
+gh pr checks {number}
+
+# Approve a PR
+gh pr review {number} --approve
+
+# Merge a PR
+gh pr merge {number} --squash
+
+# List PRs needing review
+gh pr list --review-requested @me
+```
+
+## Release Automation
+
+```bash
+# List releases
+gh release list
+
+# Create release with auto-generated notes
+gh release create v{version} --generate-notes
+
+# Create release with specific notes
+gh release create v{version} --notes "..."
+
+# View a release
+gh release view {tag}
+
+# Upload artifact to release
+gh release upload {tag} {file}
+
+# Delete a release
+gh release delete {tag}
+```
+
+## Repository Operations
+
+```bash
+# Repo overview
+gh repo view
+
+# Clone traffic stats
+gh api repos/{owner}/{repo}/traffic/clones
+
+# View statistics
+gh api repos/{owner}/{repo}/contributors
+
+# List open issues
+gh issue list
+
+# Create an issue
+gh issue create --title "..." --body "..."
+
+# View issue
+gh issue view {number}
+```
+
+## Multi-step / Complex Workflow Operations
+
+When the request involves multi-step CI/CD setup, workflow generation from scratch,
+or GitLab CI pipeline configuration — apply the workflow design rubric from
+`${CLAUDE_PLUGIN_ROOT}/skills/platform/actions/refs/actions.md`.
+
+## Output Format
+
+Results should include:
+- Summary of findings (table where appropriate)
+- Specific actionable next steps
+- Any exact commands to run (copy-pasteable)
+
+For workflow failures: root cause + fix + re-run command.
+For PR management: status summary + recommended action.
+For releases: release URL when created.

package/skills/platform/gh-cli/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: gh-cli
+description: |
+  Use when you need gh CLI patterns beyond the basics — debugging failed workflow runs, bulk PR operations,
+  release automation, or repo health checks. Provides composable gh invocations for power users.
+  NOT for simple git commands (use Bash) or GitLab (use the glab-cli skill).
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+
+# GitHub CLI Power Utilities
+
+Intelligent wrappers and patterns for GitHub CLI that go beyond basic commands.
+
+## When to Use
+
+- Debugging failed GitHub Actions (get actionable errors, not walls of logs)
+- Managing PRs across multiple repos
+- Automating releases with proper changelogs
+- Bulk operations on issues/PRs
+- Repository health checks
+
+## Prerequisites
+
+```bash
+brew install gh && gh auth login  # macOS
+```
+
+## Core Capabilities
+
+### 1. Smart Failure Analysis
+
+Don't wade through logs - get the actual errors.
+
+```bash
+# Get actionable error summary
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/skills/platform/gh-cli/scripts/gh_ops.py" diagnose
+
+# Specific repo
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/skills/platform/gh-cli/scripts/gh_ops.py" diagnose --repo owner/repo
+
+# With suggested fixes
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/skills/platform/gh-cli/scripts/gh_ops.py" diagnose --suggest-fixes
+```
+
+**Output:** Structured error summary with job timelines, extracted failures, and fix suggestions based on common patterns.
+
+### 2. PR Operations
+
+Bulk PR management that scales.
+
+```bash
+# List PRs needing review across your repos
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/skills/platform/gh-cli/scripts/gh_ops.py" pr-review-queue
+
+# Merge all approved PRs (with safety checks)
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/skills/platform/gh-cli/scripts/gh_ops.py" pr-merge-ready --dry-run
+
+# PR health check (conflicts, checks, reviews)
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/skills/platform/gh-cli/scripts/gh_ops.py" pr-status 123
+```
+
+### 3. Release Automation
+
+Generate releases with proper changelogs.
+
+```bash
+# Create release from unreleased commits
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/skills/platform/gh-cli/scripts/gh_ops.py" release --bump minor
+
+# Preview changelog without releasing
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/skills/platform/gh-cli/scripts/gh_ops.py" release --dry-run
+
+# Release with custom notes
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/skills/platform/gh-cli/scripts/gh_ops.py" release --notes "Breaking: API v2"
+```
+
+### 4. Repo Health
+
+Quick health check for repositories.
+
+```bash
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/skills/platform/gh-cli/scripts/gh_ops.py" health
+```
+
+**Checks:** Branch protection, required reviews, CI status, security advisories, dependency alerts.
+
+## Quick Patterns
+
+```bash
+# Watch CI and notify on completion
+gh run watch && osascript -e 'display notification "CI Done"'
+
+# Open PR for current branch
+gh pr create --fill --web
+
+# Checkout PR locally
+gh pr checkout 123
+
+# View PR diff in terminal
+gh pr diff 123
+
+# Re-run failed jobs only
+gh run rerun --failed
+
+# List your open PRs across all repos
+gh search prs --author=@me --state=open
+```
+
+## Integration with Other Tools
+
+Works well with:
+- **wicked-garden:search**: Find code patterns, then use gh to create issues
+- **Native tasks**: Track PR status alongside tasks via TaskUpdate description appends
+
+## References
+
+- `refs/gh-ops.md` - Full script documentation
+- `refs/patterns.md` - Common workflow patterns
+- `refs/automation.md` - CI/CD integration examples

package/skills/platform/gh-cli/refs/automation.md

@@ -0,0 +1,63 @@
+---
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+# CI/CD Integration Examples
+
+Integrate gh_ops.py into your automation workflows.
+
+## GitHub Actions Integration
+
+```yaml
+name: Monitor Failures
+on:
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+
+jobs:
+  report:
+    if: ${{ github.event.workflow_run.conclusion == 'failure' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: |
+          python3 scripts/gh_ops.py diagnose --suggest-fixes > report.json
+          # Send to Slack, email, etc.
+```
+
+## Slack Notification
+
+```bash
+#!/bin/bash
+result=$(python3 gh_ops.py diagnose --suggest-fixes)
+if echo "$result" | jq -e '.errors | length > 0' > /dev/null; then
+  curl -X POST "$SLACK_WEBHOOK" \
+    -H 'Content-type: application/json' \
+    -d "{\"text\": \"CI Failed: $(echo $result | jq -r '.run.url')\"}"
+fi
+```
+
+## Cron Job for Health Checks
+
+```bash
+# /etc/cron.d/repo-health
+0 9 * * * /usr/bin/python3 /path/to/gh_ops.py health >> /var/log/repo-health.log
+```
+
+## PR Dashboard
+
+```bash
+# Daily PR review reminder
+python3 gh_ops.py pr-review-queue | jq -r '.[] | "- [\(.title)](\(.url))"'
+```
+
+## Release Automation
+
+```bash
+#!/bin/bash
+# Auto-release on tag push
+if [[ "$GITHUB_REF" == refs/tags/* ]]; then
+  python3 gh_ops.py release --bump patch
+fi
+```

package/skills/platform/gh-cli/refs/gh-ops.md

@@ -0,0 +1,103 @@
+---
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+# gh_ops.py Reference
+
+Unified GitHub operations CLI with intelligent features.
+
+## Commands
+
+### diagnose
+
+Analyze failed workflow runs with categorized errors.
+
+```bash
+python3 gh_ops.py diagnose
+python3 gh_ops.py diagnose --repo owner/name
+python3 gh_ops.py diagnose --suggest-fixes
+```
+
+**Error categories detected:**
+- npm/node dependency issues
+- Python import errors
+- Rust compilation errors
+- Resource limits (OOM)
+- Rate limiting
+- Permission issues
+- Timeouts
+
+### pr-review-queue
+
+List PRs requesting your review across all repos.
+
+```bash
+python3 gh_ops.py pr-review-queue
+```
+
+### pr-merge-ready
+
+Find PRs that are approved, passing CI, and mergeable.
+
+```bash
+python3 gh_ops.py pr-merge-ready --dry-run
+```
+
+### pr-status
+
+Comprehensive PR status with checks, reviews, and stats.
+
+```bash
+python3 gh_ops.py pr-status 123
+python3 gh_ops.py pr-status 123 --repo owner/name
+```
+
+### release
+
+Auto-generate release with changelog from commits.
+
+```bash
+# Preview
+python3 gh_ops.py release --dry-run
+
+# Create patch release
+python3 gh_ops.py release --bump patch
+
+# Minor release with notes
+python3 gh_ops.py release --bump minor --notes "Breaking: new API"
+```
+
+**Changelog categories:**
+- Features: commits starting with "feat" or containing "add"
+- Bug Fixes: commits starting with "fix" or containing "bug"
+- Changes: everything else (excludes merge commits)
+
+### health
+
+Repository health check.
+
+```bash
+python3 gh_ops.py health
+python3 gh_ops.py health --repo owner/name
+```
+
+**Checks:**
+- Branch protection enabled
+- Security advisories count
+- Open Dependabot alerts
+- Recent CI failure rate
+
+## Output Format
+
+All commands output JSON for easy parsing:
+
+```bash
+# Pretty print
+python3 gh_ops.py diagnose | jq '.'
+
+# Extract just errors
+python3 gh_ops.py diagnose | jq '.errors[].message'
+
+# Get PR URLs needing review
+python3 gh_ops.py pr-review-queue | jq '.[].url'
+```

package/skills/platform/gh-cli/refs/patterns.md

@@ -0,0 +1,132 @@
+---
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+# Common gh CLI Patterns
+
+Quick reference for common GitHub CLI operations.
+
+## Workflow Debugging
+
+```bash
+# Watch current run
+gh run watch
+
+# Re-run only failed jobs
+gh run rerun --failed
+
+# View logs for specific job
+gh run view --log --job=build
+
+# Cancel running workflow
+gh run cancel
+```
+
+## PR Management
+
+```bash
+# Create PR with auto-fill
+gh pr create --fill
+
+# Create draft PR
+gh pr create --draft
+
+# Checkout PR locally
+gh pr checkout 123
+
+# View PR diff
+gh pr diff 123
+
+# Merge PR
+gh pr merge 123 --squash --delete-branch
+
+# Request review
+gh pr edit 123 --add-reviewer @username
+```
+
+## Search
+
+```bash
+# Your open PRs
+gh search prs --author=@me --state=open
+
+# PRs needing review
+gh search prs --review-requested=@me
+
+# Recent issues
+gh search issues --repo owner/name --sort=created
+
+# Code search
+gh search code "TODO" --language=python
+```
+
+## Repository
+
+```bash
+# Clone and cd
+gh repo clone owner/name -- --depth=1
+
+# Fork and clone
+gh repo fork --clone
+
+# Create from template
+gh repo create new-name --template owner/template
+
+# View repo info
+gh repo view --json description,stargazerCount
+```
+
+## Issues
+
+```bash
+# Create issue
+gh issue create --title "Bug" --body "Description"
+
+# Close with comment
+gh issue close 123 --comment "Fixed in #456"
+
+# List your issues
+gh issue list --assignee=@me
+```
+
+## Releases
+
+```bash
+# Create release
+gh release create v1.0.0 --generate-notes
+
+# Upload assets
+gh release upload v1.0.0 ./dist/*
+
+# Download assets
+gh release download v1.0.0
+```
+
+## API
+
+```bash
+# GET request
+gh api repos/:owner/:repo
+
+# POST with data
+gh api repos/:owner/:repo/issues -f title="Bug" -f body="desc"
+
+# Paginate
+gh api repos/:owner/:repo/issues --paginate
+
+# JQ filter
+gh api repos/:owner/:repo --jq '.stargazers_count'
+```
+
+## Aliases
+
+```bash
+# Create alias
+gh alias set pv 'pr view'
+
+# Use alias
+gh pv 123
+
+# List aliases
+gh alias list
+```