wicked-garden 12.27.0

package/commands/platform/assert.md

@@ -0,0 +1,18 @@
+---
+description: Run contract assertions against plugin subprocess outputs
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:platform:assert
+
+Run contract assertions to validate that plugin scripts return data matching their declared schemas.
+
+Instructions:
+- Parse arguments: `--plugin {name}` for single plugin, `--json` for machine-readable
+- Run the assertion script inline:
+  ```bash
+  sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/scripts/_run.py" scripts/platform/observability/assert_contracts.py {args}
+  ```
+- Display results: pass/fail per script, violation details for failures
+- Note: schemas must exist in `schemas/{plugin}/{script}.json` before assertions can run

package/commands/platform/audit.md

@@ -0,0 +1,23 @@
+---
+description: |
+  Use when gathering audit evidence for a compliance framework (SOC2, HIPAA, GDPR, PCI) — collects control
+  artifacts, verifies state, and generates compliance reports. NOT for defining compliance policies
+  (use platform:compliance) or ad hoc security checks (use platform:security).
+argument-hint: "<framework: soc2|hipaa|gdpr|pci> [control ID]"
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:platform:audit
+
+Collect audit evidence, verify controls, and generate compliance artifacts for SOC2/HIPAA/GDPR/PCI.
+
+## Run it inline (no dispatch)
+
+1. Parse `$ARGUMENTS`: `<framework> [control_id]` (framework = `soc2|hipaa|gdpr|pci`; control_id or `all`).
+2. `Read("${CLAUDE_PLUGIN_ROOT}/skills/platform/audit/refs/audit.md")` — full collection rubric,
+   control-testing checklist, SOC2/HIPAA control matrix, gap analysis, bus emit, and output format.
+3. For framework-specific checklists: `Read("${CLAUDE_PLUGIN_ROOT}/skills/platform/audit/refs/checklists-soc2-hipaa.md")`
+   or `refs/checklists-gdpr-pci-evidence.md`. For evidence scripts and organization: `refs/checklists-evidence-operations.md`.
+4. Apply the rubric directly: collect evidence via code search, verify each control, document
+   Pass/Partial/Fail with file:line refs, then emit the bus event and produce the audit report.

package/commands/platform/compliance.md

@@ -0,0 +1,20 @@
+---
+description: Regulatory compliance check (SOC2, HIPAA, GDPR, PCI)
+argument-hint: "<framework: soc2|hipaa|gdpr|pci> [path]"
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:platform:compliance
+
+Check code and architecture against regulatory compliance frameworks.
+
+## Run it inline (no dispatch)
+
+1. Parse `$ARGUMENTS`: `<framework> [path]` (framework = `soc2|hipaa|gdpr|pci`).
+2. `Read("${CLAUDE_PLUGIN_ROOT}/skills/platform/compliance/refs/compliance.md")` — data-classification
+   scan commands, per-framework control matrix (SOC2/HIPAA/GDPR/PCI), gap checklist, bus emit, output format.
+3. For detailed per-framework checklists: `Read("${CLAUDE_PLUGIN_ROOT}/skills/platform/compliance/refs/checklists.md")`.
+   For framework-specific patterns: `refs/frameworks.md`.
+4. Apply the rubric directly: scan for sensitive data, verify each control, classify gaps P0/P1/P2,
+   emit the bus event, and produce the compliance assessment report.

package/commands/platform/gh.md

@@ -0,0 +1,22 @@
+---
+description: |
+  Use when you need advanced gh CLI operations — debugging failed workflow runs, bulk PR management,
+  or release automation — that go beyond what a plain `gh` man-page example covers.
+  NOT for simple git operations (use Bash) or repo health (use platform:health).
+argument-hint: "<operation: workflows|prs|releases|repo> [args]"
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:platform:gh
+
+GitHub CLI operations for workflow debugging, PR management, and release automation.
+
+## Run it inline (no dispatch)
+
+1. Parse `$ARGUMENTS`: `<operation> [args]` (operation = `workflows|prs|releases|repo`).
+2. `Read("${CLAUDE_PLUGIN_ROOT}/skills/platform/gh/refs/gh.md")` — command reference for each
+   operation category, multi-step patterns, and output format.
+3. Execute the gh commands directly and deliver: for workflow failures, root cause + fix + re-run command;
+   for PR management, status summary + action; for releases, release URL when created.
+   For multi-step workflow generation from scratch, also load `skills/platform/actions/refs/actions.md`.

package/commands/platform/health.md

@@ -0,0 +1,22 @@
+---
+description: |
+  Use when checking system health, aggregating error patterns, or diagnosing service reliability —
+  covers health probes, error pattern detection, and multi-service observability in one command.
+  NOT for plugin-level diagnostics (use platform:plugin-health) or distributed tracing (use platform:traces).
+argument-hint: "[service name or 'all' for full assessment]"
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:platform:health
+
+Assess system health, aggregate observability data, and provide reliability recommendations.
+
+## Run it inline (no dispatch)
+
+1. Parse `$ARGUMENTS`: service name, or `all` for full assessment.
+2. `Read("${CLAUDE_PLUGIN_ROOT}/skills/platform/health/refs/health.md")` — discovery checklist,
+   per-source assessment steps, fallback code-analysis approach, common patterns, and output format.
+3. Apply the rubric directly: discover observability sources via `ListMcpResourcesTool`, query each,
+   correlate with recent deployments, and produce the health report with severity classification
+   (HEALTHY / DEGRADED / CRITICAL) and prioritized recommendations.

package/commands/platform/incident.md

@@ -0,0 +1,23 @@
+---
+description: Incident response and triage
+argument-hint: "<error message, alert, or symptom description>"
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:platform:incident
+
+Rapid incident triage with root cause correlation, blast radius assessment, and remediation guidance.
+
+> **Scope**: `platform:incident` is for **rapid active triage** — root cause, blast radius, remediation steps.
+> To **log** an incident against a crew project with traceability, use `/wicked-garden:crew:incident` instead.
+
+## Run it inline (no dispatch)
+
+1. Collect incident context from `$ARGUMENTS`: error/alert description, start time if given, affected scope.
+2. `Read("${CLAUDE_PLUGIN_ROOT}/skills/platform/incident/refs/incident.md")` — the 5-phase rubric
+   (triage → stabilize → investigate → resolve → follow-up), severity classification, common patterns,
+   output format, and communication templates.
+3. Apply the rubric directly: discover observability sources via `ListMcpResourcesTool`, correlate with
+   recent git changes, classify severity (SEV1–SEV4), and produce the incident report with blast radius,
+   mitigation actions, and rollback decision.

package/commands/platform/infra.md

@@ -0,0 +1,24 @@
+---
+description: |
+  Use when reviewing infrastructure-as-code (Terraform, CloudFormation, Pulumi) for correctness, cost,
+  or security posture. NOT for application architecture review (use engineering:arch) or
+  active incident response (use platform:incident).
+argument-hint: "<path to IaC files or 'scan' for discovery>"
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:platform:infra
+
+Review infrastructure-as-code and cloud architecture for security, cost, HA, and best-practice posture.
+
+## Run it inline (no dispatch)
+
+1. Parse `$ARGUMENTS`: path to IaC files, or `scan` to discover `.tf`, `.tfvars`, CloudFormation,
+   Pulumi, Kubernetes manifests, and `docker-compose` files.
+2. `Read("${CLAUDE_PLUGIN_ROOT}/skills/platform/infra/refs/infra.md")` — discovery commands,
+   security matrix, cost-optimization checklist, HA/DR checklist, platform best practices
+   (Terraform, Kubernetes, Docker Compose), and output format.
+3. Apply the rubric directly: discover IaC files, detect the platform, assess each dimension,
+   and produce the infrastructure review with resource inventory, security matrix, cost opportunities,
+   HA gaps, and prioritized fixes (critical first, then improvements).

package/commands/platform/peer-health.md

@@ -0,0 +1,103 @@
+---
+description: |
+  Run a health check on all wicked-* peer tools (wicked-vault, wicked-testing, wicked-brain, wicked-bus).
+  Reports reachability, version vs. pin, and declared capability status for each peer.
+  The replacement for `npx wicked-loom doctor` after Phase B absorption — peer-resolution
+  now runs in-process via scripts/loom/, no external wicked-loom needed.
+argument-hint: "[--peer <name>] [--strict] [--json]"
+phase_relevance: ["build", "review", "operate", "bootstrap"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:platform:peer-health
+
+Check reachability and version health of wicked-* peer tools.
+
+## Arguments
+
+- `--peer <name>` — check a single peer (vault, testing, brain, bus)
+- `--strict` — exit non-zero if any peer has capability-gap (status != wired)
+- `--json` — emit raw JSON rows instead of the formatted table
+
+## Instructions
+
+Run the internal loom doctor via the absorbed scripts/loom/compose module.
+No external wicked-loom process is needed — this runs in-process.
+
+```bash
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" -c "
+import sys, os, json
+sys.path.insert(0, os.path.join(os.environ.get('CLAUDE_PLUGIN_ROOT', '.'), 'scripts'))
+from loom import compose, manifest
+
+peer_arg = None
+import argparse
+p = argparse.ArgumentParser()
+p.add_argument('--peer', default=None)
+p.add_argument('--strict', action='store_true')
+p.add_argument('--json', dest='as_json', action='store_true')
+try:
+    args = p.parse_args()
+except SystemExit:
+    args = p.parse_args([])
+
+if args.peer:
+    rows = [compose.check_peer(args.peer)]
+else:
+    rows = compose.check_all()
+
+if args.as_json:
+    print(json.dumps(rows, indent=2))
+else:
+    # Human-readable table
+    print()
+    print(f'  {\"PEER\":<16} {\"STATUS\":<10} {\"VERSION\":<12} {\"CAPABILITY\":<14} PIN')
+    print('  ' + '-'*62)
+    for r in rows:
+        peer_name = r.get('peer', '?')
+        status = r.get('status', '?')
+        version = r.get('installed', '-')
+        cap = r.get('capability', '-') or '-'
+        cap_ok = r.get('capability_ok', False)
+        pin = r.get('pin', '-') or '-'
+        icon = '  ' if r.get('ok') else '!'
+        cap_icon = '' if cap_ok else ' (gap)'
+        print(f'{icon} {peer_name:<16} {status:<10} {version:<12} {cap:<14}{cap_ok and \"\" or \" (!gap)\"}  ^{pin}')
+    print()
+
+if args.strict:
+    gaps = [r['peer'] for r in rows if not r.get('capability_ok')]
+    if gaps:
+        print(f'STRICT: capability gaps on: {', '.join(gaps)}')
+        sys.exit(1)
+" $ARGUMENTS
+```
+
+## Status reference
+
+| Status | Meaning | Action |
+|---|---|---|
+| `ok` | Resolved, version meets pin | None needed |
+| `drift` | Resolved, version below pin | Update peer |
+| `present` | Resolved + responds, version unreadable | WARN — update or check CLI |
+| `missing` | Not found anywhere | Install the peer |
+| `error` | Probe raised (binary vanished, OS error) | Reinstall |
+
+## Capability status
+
+`capability` is distinct from reachability. A peer can be `ok` (reachable)
+but `experimental` or `planned` (not trusted for gating). The gate only
+trusts `wired` peers — anything else yields a `capability-gap` verdict.
+
+**wicked-brain** is currently `STATUS_EXPERIMENTAL` (bridge/deprecation period):
+garden exposes equivalent surfaces via wicked-estate MCP. New work must not
+declare brain as a required gate peer.
+
+## Usage examples
+
+```
+/wicked-garden:platform:peer-health
+/wicked-garden:platform:peer-health --peer vault
+/wicked-garden:platform:peer-health --strict
+/wicked-garden:platform:peer-health --json
+```

package/commands/platform/plugin-health.md

@@ -0,0 +1,58 @@
+---
+description: |
+  Use when diagnosing wicked-garden plugin health — runs readiness probes, views operational logs,
+  queries hook traces, or adjusts log verbosity. Single entry point for all plugin-level diagnostics.
+  NOT for distributed tracing (use platform:traces) or system-wide health (use platform:health).
+argument-hint: "[--plugin name] [--retry-auth] [--json]"
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:platform:plugin-health
+
+Run health probes to validate ecosystem integrity.
+
+## Arguments
+
+- `--plugin {name}` — probe a single plugin
+- `--retry-auth` — re-probe plugins that were flagged as unready at session start (use after authenticating a CLI mid-session)
+- `--json` — machine-readable output
+
+## Instructions
+
+### Standard Health Probe
+
+Run the health probe script inline (no agent delegation needed):
+```bash
+sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/scripts/_run.py" scripts/platform/observability/health_probe.py $ARGUMENTS
+```
+- Display results grouped by plugin, with severity icons
+- Exit code: 0=healthy, 1=warnings, 2=failures
+- Show path to latest.json for programmatic consumption
+
+### Plugin Auth Retry (`--retry-auth`)
+
+When the user passes `--retry-auth`, re-run the plugin readiness probes from bootstrap to check if previously unready plugins are now functional.
+
+1. Run the bootstrap probe function directly:
+   ```bash
+   python3 -c "
+   import sys, json, os
+   sys.path.insert(0, os.path.join(os.environ.get('CLAUDE_PLUGIN_ROOT', '.'), 'hooks', 'scripts'))
+   from bootstrap import _probe_plugin_readiness, _suggest_auth_fix
+   results = _probe_plugin_readiness()
+   if not results:
+       print(json.dumps({'status': 'all_ready', 'message': 'All installed plugins are ready.'}))
+   else:
+       out = []
+       for r in results:
+           fix = _suggest_auth_fix(r)
+           out.append({**r, 'fix': fix})
+       print(json.dumps({'status': 'unready', 'plugins': out}))
+   "
+   ```
+
+2. Report results:
+   - If all ready: "All plugins authenticated and ready."
+   - If still unready: show each plugin, its error, and the fix command.
+   - Suggest: "Run the fix command in your terminal, then retry with `/wicked-garden:platform:health --retry-auth`"

package/commands/platform/security.md

@@ -0,0 +1,38 @@
+---
+description: Security review and vulnerability assessment (real scanners, then triage)
+argument-hint: "<path, PR, or 'full' for comprehensive scan> [--scenarios]"
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:platform:security
+
+Run the real security scanners, then triage their actual output. Use for ad hoc vulnerability scans on code, PRs, or full repos. NOT for compliance evidence collection (use platform:audit) or IaC posture (use platform:infra).
+
+This command does NOT grep-guess. It detects which scanners are installed, runs the ones that exist, and feeds their findings to triage. A missing scanner is reported and skipped — the command never fails because a tool is absent.
+
+## 1. Detect + run scanners
+
+Set `TARGET="$ARGUMENTS"` (a path; default `.` if empty, or the PR's changed files when given a PR number). Then run, gracefully skipping any absent tool:
+
+```bash
+SC=$(command -v semgrep || true); GL=$(command -v gitleaks || true); NPM=$(command -v npm || true)
+TMP="${TMPDIR:-/tmp}"
+# Secrets — gitleaks. NOTE: exit 1 means "leaks found", NOT a tool error; ignore exit code, read the JSON.
+[ -n "$GL" ] && gitleaks detect --no-banner --redact -f json --report-path "$TMP/gitleaks.json" >/dev/null 2>&1; echo "gitleaks: ${GL:-ABSENT}"
+# SAST — semgrep auto ruleset (carries CWE/OWASP/severity per finding).
+[ -n "$SC" ] && semgrep --config auto --json "$TARGET" > "$TMP/semgrep.json" 2>/dev/null; echo "semgrep: ${SC:-ABSENT}"
+# Dependencies — npm audit, only where a package.json exists.
+[ -n "$NPM" ] && [ -f "$TARGET/package.json" ] && (cd "$TARGET" && npm audit --json > "$TMP/npm-audit.json" 2>/dev/null); echo "npm: ${NPM:-ABSENT}"
+```
+
+Read whichever report files exist (paths printed `ABSENT` were skipped — say so in the report, don't treat it as a failure):
+- `$TMP/gitleaks.json` — JSON array; each: `RuleID`, `Description`, `File`, `StartLine`, `Match`/`Secret` (redacted), `Entropy`, `Commit`. Scans full git **history** by default, so many hits are old/example secrets in docs — triage accordingly.
+- `$TMP/semgrep.json` — `{results:[{check_id, path, start.line, extra:{severity (ERROR|WARNING|INFO), message, metadata:{cwe, owasp}}}], errors[]}`.
+- `$TMP/npm-audit.json` — `{vulnerabilities:{<pkg>:{severity, via, range}}, metadata.vulnerabilities:{critical,high,...}}`.
+
+## 2. Triage the real findings
+
+Read `${CLAUDE_PLUGIN_ROOT}/agents/platform/security-engineer.md` for the triage rubric (your reference, NOT a thing to re-derive): the CWE table, severity bands, OWASP matrix, output format, `--scenarios` behaviour, and bus emit.
+
+Your job is to triage actual scanner output, not guess: dedupe, drop false positives (e.g. example secrets in `*.md`/scenarios, test fixtures), keep semgrep's own `cwe`/`owasp`/`severity` (don't reinvent them), and rank true findings CRITICAL→LOW with `file:line`. If `--scenarios` is set, emit a wicked-scenarios block per surviving CRITICAL/HIGH. Report risk level, the severity-ranked findings table, the OWASP matrix, prioritized fixes, and which scanners were ABSENT/skipped.

package/commands/platform/toolchain.md

@@ -0,0 +1,96 @@
+---
+description: Discover and query engineer monitoring tools (APM, logging, metrics, cloud)
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:platform:toolchain
+
+Discover monitoring CLIs available in the current environment and run queries against them.
+
+## Usage
+
+```
+/wicked-garden:platform:toolchain [--query "..."] [--category apm|logging|metrics|cloud]
+```
+
+## Arguments
+
+- `--query "..."` — Log/metric query to run against detected tools (optional)
+- `--category` — Limit discovery to one category: `apm`, `logging`, `metrics`, `cloud`
+
+## Instructions
+
+1. **Detect available tools** using `command -v` for each known binary:
+
+   ```bash
+   # APM
+   command -v datadog-agent && echo "datadog"
+   command -v newrelic      && echo "newrelic"
+   command -v dt            && echo "dynatrace"
+
+   # Logging
+   command -v splunk        && echo "splunk"
+   command -v elasticsearch && echo "elasticsearch"
+   command -v logcli        && echo "loki"
+
+   # Metrics
+   command -v promtool      && echo "prometheus"
+   command -v grafana-cli   && echo "grafana"
+   command -v influx        && echo "influxdb"
+
+   # Cloud
+   command -v aws           && echo "aws-cloudwatch"
+   command -v gcloud        && echo "gcp-monitoring"
+   command -v az            && echo "azure-monitor"
+   ```
+
+2. **If no `--query` given**: Report discovered tools grouped by category. For each found tool, show: binary path, version if quickly available (`datadog-agent version`, `newrelic version`, `gcloud version`).
+
+3. **If `--query` given**: Route the query to appropriate detected tool(s):
+   - Logging tools → search/filter for the query string in recent logs (last 1h default)
+   - Metrics tools → query for metric matching the query
+   - APM tools → search traces/events matching the query
+   - Cloud tools → query CloudWatch/Stackdriver/Azure logs for the string
+   - Run queries for each detected tool in the relevant category
+   - Present results side-by-side with tool attribution
+
+4. **If `--category` given**: Limit both discovery and query execution to that category.
+
+5. **Display format**:
+
+   ```
+   Monitoring Toolchain Discovery
+   ==============================
+
+   APM
+     datadog-agent  /usr/local/bin/datadog-agent  v7.58.0
+     newrelic       (not found)
+     dynatrace      (not found)
+
+   Logging
+     splunk         (not found)
+     loki/logcli    /usr/local/bin/logcli  v2.9.0
+
+   Metrics
+     prometheus     /usr/local/bin/promtool  v2.48.0
+     grafana-cli    (not found)
+
+   Cloud
+     aws (cloudwatch) /usr/local/bin/aws  aws-cli/2.15.0
+     gcloud (monitoring) (not found)
+     azure (az)     (not found)
+
+   Detected: datadog-agent, logcli, promtool, aws
+   ```
+
+6. **Suggest next steps** based on what was found:
+   - If APM found: suggest `datadog-agent status` or equivalent health check
+   - If logging found: suggest query patterns from [refs/toolchain-discovery.md](../skills/observability/refs/toolchain-discovery.md)
+   - If nothing found: note that monitoring CLIs can be installed and list quickstart install commands
+
+## Error Handling
+
+- If a tool is found but errors on query: show the error and continue with other tools
+- If no tools are found: report "No monitoring CLIs detected" and suggest installation options
+- Never fail — this command is read-only discovery

package/commands/platform/traces.md

@@ -0,0 +1,20 @@
+---
+description: Distributed tracing analysis for latency and dependencies
+argument-hint: "[service name, trace ID, or 'slow' for latency investigation]"
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:platform:traces
+
+Analyze distributed traces for latency investigation, service dependencies, and bottleneck detection.
+
+## Run it inline (no dispatch)
+
+1. Parse `$ARGUMENTS`: service name, trace ID, or `slow` for p99 latency investigation.
+2. `Read("${CLAUDE_PLUGIN_ROOT}/skills/platform/traces/refs/traces.md")` — tracing source discovery,
+   investigation checklist, fallback code-pattern analysis, common patterns (N+1, sequential fan-out,
+   cold-start), and output format.
+3. Apply the rubric directly: discover tracing sources via `ListMcpResourcesTool`, query the target,
+   and produce the trace analysis with latency breakdown, service dependencies, bottlenecks, and
+   optimization recommendations with expected impact.

package/commands/product/a11y.md

@@ -0,0 +1,19 @@
+---
+description: Accessibility audit — WCAG 2.1 AA compliance, keyboard navigation, screen reader support, color contrast
+argument-hint: "<target> [--level A|AA|AAA] [--quick]"
+phase_relevance: ["clarify", "design", "review"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:product:a11y
+
+Accessibility audit for UI code/components: WCAG 2.1 AA, keyboard nav, screen
+reader support, color contrast, semantic structure.
+
+## Run it inline (no dispatch)
+
+1. Parse `<target>`, `--level` (default AA), `--quick`.
+2. `Read("${CLAUDE_PLUGIN_ROOT}/skills/product/refs/a11y.md")` — the POUR rubric, checklist, common violations, and output format.
+3. Read the target file(s), apply the rubric directly, and emit the audit. For deeper WCAG/ARIA/keyboard/screen-reader detail, load the `accessibility` skill (`skills/product/accessibility/`).
+
+Track remediation via `TaskCreate`/`TaskUpdate` (`metadata.event_type="task"`); pair with `product:ux-review` for visual consistency.

package/commands/product/acceptance.md

@@ -0,0 +1,19 @@
+---
+description: Define acceptance criteria from requirements and design
+argument-hint: "<requirements/design path> [--story US-ID] [--feature name] [--format gherkin|table|markdown] [--scenarios]"
+phase_relevance: ["test", "review"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:product:acceptance
+
+Generate testable acceptance criteria from requirements/design. `acceptance`
+**defines** criteria; to **run** tests against them, use `/wicked-testing:execution`.
+
+## Run it inline (no dispatch)
+
+1. Read input: requirements/design docs or a user-story reference. Honor `--story`, `--feature`, `--format`, `--scenarios`.
+2. `Read("${CLAUDE_PLUGIN_ROOT}/skills/product/refs/acceptance.md")` — the Given/When/Then process, output format, and the `--scenarios` wicked-scenarios conversion (priority->difficulty, AC-type->category/tools, stub format).
+3. Apply the rubric directly: identify scenarios (happy/error/edge/non-functional), write + prioritize AC, specify test data, add QE handoff notes. When `--scenarios`, also emit wicked-scenarios stubs.
+
+AC feed into `/wicked-testing:plan`. Persist on the active clarify task via `TaskCreate`/`TaskUpdate` (`metadata={event_type:"task", chain_id:"{project}.clarify", source_agent:"requirements-analyst", phase:"clarify"}`) for QE traceability.

package/commands/product/align.md

@@ -0,0 +1,20 @@
+---
+description: |
+  Use when you have divergent stakeholder positions on scope, priority, or direction and need to surface
+  concerns, map them to trade-offs, and build consensus. NOT for requirements elicitation (use product:elicit)
+  or UX design (use product:ux).
+phase_relevance: ["clarify", "design", "review"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:product:align
+
+Facilitate stakeholder alignment, surface concerns, and build consensus.
+
+## Run it inline (no dispatch)
+
+1. Read context: the target document if provided, plus `--stakeholders`, `--focus` (concerns/tradeoffs/conflicts), `--conflict`.
+2. `Read("${CLAUDE_PLUGIN_ROOT}/skills/product/refs/align.md")` — the process, facilitation checklist, questions to ask, and output format.
+3. Apply the rubric directly: identify stakeholders, surface concerns, classify ALIGNED / CONFLICTED / UNCLEAR, propose compromises, and emit decisions-required + next steps (owner + deadline).
+
+Persist status via `TaskCreate`/`TaskUpdate` (`metadata.event_type="task"`); store stakeholder patterns via `wicked-brain:memory`.

package/commands/product/analyze.md

@@ -0,0 +1,23 @@
+---
+description: Analyze customer feedback for themes, sentiment, and trends
+argument-hint: "[--theme X] [--sentiment pos|neg] [--trend period]"
+next-step: "product:synthesize"
+phase_relevance: ["clarify", "design", "review"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:product:analyze
+
+Analyze aggregated customer feedback for themes, sentiment patterns, and trends.
+Pipeline step 2 of 3: listen -> **analyze** -> synthesize.
+
+## Run it inline (no dispatch)
+
+1. Load feedback data:
+   ```bash
+   PRODUCT_ROOT=$(sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/scripts/_run.py" scripts/resolve_path.py wicked-garden:product)
+   ls "${PRODUCT_ROOT}/voice/feedback/"
+   ```
+   If empty, tell the user to run `/wicked-garden:product:listen` first and stop.
+2. `Read("${CLAUDE_PLUGIN_ROOT}/skills/product/refs/analyze.md")` — sentiment classes, theme extraction, trend detection, segment analysis, techniques, rules, and output format.
+3. Apply the rubric directly, honoring `--theme`/`--sentiment`/`--trend`/`--segment`. Emit the analysis report, then point to `/wicked-garden:product:synthesize`.

package/commands/product/elicit.md

@@ -0,0 +1,19 @@
+---
+description: |
+  Use when turning a vague idea or stakeholder ask into structured user stories with acceptance criteria.
+  NOT for requirements traceability graphs (use the requirements-graph skill) or UX flows (use product:ux).
+phase_relevance: ["clarify", "design", "review"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:product:elicit
+
+Elicit requirements and write user stories with acceptance criteria.
+
+## Run it inline (no dispatch)
+
+1. Read context: the target document(s) (`outcome.md`, brief, `docs/requirements/`), or accept `--interactive`. Honor `--personas` and `--scope`.
+2. `Read("${CLAUDE_PLUGIN_ROOT}/skills/product/refs/elicit.md")` — the process, INVEST quality criteria, completeness check, traceability, and output format.
+3. Apply the rubric directly and emit user stories (priority + complexity + dependencies + AC) and open questions.
+
+For complexity >= 3 or compliance projects, produce a requirements **graph** instead — load the `requirements-analysis` / `requirements-graph` skills. Persist on the active clarify task via `TaskUpdate`.

package/commands/product/listen.md

@@ -0,0 +1,24 @@
+---
+description: Aggregate customer feedback from available sources
+argument-hint: "[--capability type] [--days N] [--tags x,y]"
+next-step: "product:analyze"
+phase_relevance: ["clarify", "design", "review"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:product:listen
+
+Aggregate customer feedback from discovered sources (support, surveys, social,
+direct). Pipeline step 1 of 3: **listen -> analyze -> synthesize**.
+
+## Run it inline (no dispatch)
+
+1. Discover sources:
+   ```bash
+   PRODUCT_ROOT=$(sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" "${CLAUDE_PLUGIN_ROOT}/scripts/_run.py" scripts/resolve_path.py wicked-garden:product)
+   ls "${PRODUCT_ROOT}/voice/feedback/" 2>/dev/null
+   find . -name "*feedback*" -o -name "*survey*" -o -name "*tickets*" 2>/dev/null | head -10
+   gh issue list --label "customer-reported" 2>/dev/null | head -5
+   ```
+2. `Read("${CLAUDE_PLUGIN_ROOT}/skills/product/refs/listen.md")` — normalization, tagging, prioritization, storage, and output format.
+3. Apply the rubric directly: extract + normalize + tag + prioritize feedback, honoring `--days`/`--since`/`--tags`/`--capability`/`--limit`. Emit the listening report, then point to `/wicked-garden:product:analyze`.

package/commands/product/mockup.md

@@ -0,0 +1,20 @@
+---
+description: |
+  Use when you need a quick ASCII wireframe or HTML mockup in-chat without Figma overhead.
+  NOT for production design work — use the figma plugin for that.
+argument-hint: "<description-or-target> [--format ascii|html|spec] [--fidelity low|medium|high]"
+phase_relevance: ["clarify", "design", "review"]
+archetype_relevance: ["*"]
+---
+
+# /wicked-garden:product:mockup
+
+Generate wireframes, mockups, and component specs at the right fidelity — ASCII for
+ideation, HTML/CSS for stakeholder review, annotated spec for developer handoff.
+
+## Run it inline (no dispatch)
+
+1. Parse `<description-or-target>`, `--format` (ascii/html/spec), `--fidelity` (low/medium/high). Auto-select format: bare description / low -> ascii; high / stakeholder context -> html; file path -> spec.
+2. Gather context: if a description, use as the brief; if a file path, read it to understand the current structure; recall design tokens via `wicked-brain:memory`.
+3. `Read("${CLAUDE_PLUGIN_ROOT}/skills/product/refs/mockup.md")` — fidelity selection, ASCII/HTML/spec formats, generation process, and output format.
+4. Apply the rubric directly and emit the mockup with state/responsive/a11y annotations and open questions. Pair with `product:ux` (flows) and `product:screenshot` (compare to built UI).