wicked-garden 12.30.0 → 12.32.0

package/.claude-plugin/components.json

@@ -2,8 +2,8 @@
   "_comment": "Issue #328: Component declarations for wicked-garden plugin. Claude Code plugin.json does not yet support inline component declarations beyond path overrides. This manifest documents all components for tooling, validation, and future schema support. When plugin.json gains a 'components' field, merge this data into plugin.json. The plugin is skills-only: former commands/ became actions of consolidated per-domain skills, and former agents/ became standalone context:fork worker skills (enumerated under fork_skills). Regenerate derived blocks with scripts/ci/sync_components.py.",
   "domains": ["agentic", "crew", "data", "engineering", "jam", "mem", "persona", "platform", "product", "qe", "search", "smaht"],
   "summary": {
-    "skills": 99,
-    "fork_skills": 38,
+    "skills": 141,
+    "fork_skills": 78,
     "hooks": 13,
     "specialists": 7
   },
@@ -35,7 +35,9 @@
     "jam": ["jam"],
     "jam-brainstorm-facilitator": ["jam-brainstorm-facilitator"],
     "jam-council": ["jam-council"],
-    "multi-model": ["multi-model"],
+    "mem": ["mem"],
+    "mem-capture": ["mem-capture"],
+    "mem-ingest": ["mem-ingest"],
     "persona": ["persona"],
     "persona-agent": ["persona-agent"],
     "platform": ["audit", "compliance", "errors", "gate-benchmark-rebaseline", "gh-cli", "github-actions", "gitlab-ci", "glab-cli", "health", "observability", "peer-health", "platform", "prereq-doctor"],
@@ -49,7 +51,47 @@
     "product-ux-designer": ["product-ux-designer"],
     "product-value-strategist": ["product-value-strategist"],
     "prove": ["prove"],
+    "qe": ["qe"],
+    "qe-a11y-test-engineer": ["qe-a11y-test-engineer"],
+    "qe-acceptance-test-executor": ["qe-acceptance-test-executor"],
+    "qe-acceptance-test-reviewer": ["qe-acceptance-test-reviewer"],
+    "qe-acceptance-test-writer": ["qe-acceptance-test-writer"],
+    "qe-ai-feature-test-engineer": ["qe-ai-feature-test-engineer"],
+    "qe-chaos-test-engineer": ["qe-chaos-test-engineer"],
+    "qe-code-analyzer": ["qe-code-analyzer"],
+    "qe-compliance-test-engineer": ["qe-compliance-test-engineer"],
+    "qe-contract-testing-engineer": ["qe-contract-testing-engineer"],
+    "qe-coverage-archaeologist": ["qe-coverage-archaeologist"],
+    "qe-data-quality-tester": ["qe-data-quality-tester"],
+    "qe-e2e-orchestrator": ["qe-e2e-orchestrator"],
+    "qe-exploratory-tester": ["qe-exploratory-tester"],
+    "qe-flaky-test-hunter": ["qe-flaky-test-hunter"],
+    "qe-fuzz-property-engineer": ["qe-fuzz-property-engineer"],
+    "qe-iac-test-engineer": ["qe-iac-test-engineer"],
+    "qe-incident-to-scenario-synthesizer": ["qe-incident-to-scenario-synthesizer"],
+    "qe-integration-test-engineer": ["qe-integration-test-engineer"],
+    "qe-load-performance-engineer": ["qe-load-performance-engineer"],
+    "qe-localization-test-engineer": ["qe-localization-test-engineer"],
+    "qe-mutation-test-engineer": ["qe-mutation-test-engineer"],
+    "qe-observability-test-engineer": ["qe-observability-test-engineer"],
+    "qe-production-quality-engineer": ["qe-production-quality-engineer"],
+    "qe-release-readiness-engineer": ["qe-release-readiness-engineer"],
+    "qe-requirements-quality-analyst": ["qe-requirements-quality-analyst"],
+    "qe-risk-assessor": ["qe-risk-assessor"],
+    "qe-scenario-executor": ["qe-scenario-executor"],
+    "qe-security-test-engineer": ["qe-security-test-engineer"],
     "qe-semantic-reviewer": ["qe-semantic-reviewer"],
+    "qe-snapshot-hygiene-auditor": ["qe-snapshot-hygiene-auditor"],
+    "qe-test-automation-engineer": ["qe-test-automation-engineer"],
+    "qe-test-code-quality-auditor": ["qe-test-code-quality-auditor"],
+    "qe-test-data-manager": ["qe-test-data-manager"],
+    "qe-test-designer": ["qe-test-designer"],
+    "qe-test-impact-analyzer": ["qe-test-impact-analyzer"],
+    "qe-test-oracle": ["qe-test-oracle"],
+    "qe-test-strategist": ["qe-test-strategist"],
+    "qe-testability-reviewer": ["qe-testability-reviewer"],
+    "qe-ui-component-test-engineer": ["qe-ui-component-test-engineer"],
+    "qe-visual-regression-engineer": ["qe-visual-regression-engineer"],
     "runtime-exec": ["runtime-exec"],
     "search": ["codebase-narrator", "search"],
     "smaht": ["discovery", "intent", "propose-skills", "smaht"],
@@ -58,7 +100,7 @@
     "workflow": ["workflow"],
     "worktrees": ["worktrees"]
   },
-  "fork_skills": ["wicked-garden-agentic-architect", "wicked-garden-agentic-performance-analyst", "wicked-garden-agentic-safety-reviewer", "wicked-garden-archetype", "wicked-garden-classify", "wicked-garden-crew-implementer", "wicked-garden-crew-researcher", "wicked-garden-crew-reviewer", "wicked-garden-data-engineer", "wicked-garden-domain-coverage", "wicked-garden-domain-extractor", "wicked-garden-domain-modeler", "wicked-garden-engineering-api-documentarian", "wicked-garden-engineering-conformance-reviewer", "wicked-garden-engineering-debugging", "wicked-garden-engineering-migration-engineer", "wicked-garden-engineering-solution-architect", "wicked-garden-ground", "wicked-garden-integration-discovery", "wicked-garden-jam-brainstorm-facilitator", "wicked-garden-jam-council", "wicked-garden-multi-model", "wicked-garden-persona-agent", "wicked-garden-platform-compliance-officer", "wicked-garden-platform-privacy-expert", "wicked-garden-platform-security-engineer", "wicked-garden-product-a11y-expert", "wicked-garden-product-requirements-analyst", "wicked-garden-product-ui-reviewer", "wicked-garden-product-ux-designer", "wicked-garden-product-value-strategist", "wicked-garden-qe-semantic-reviewer", "wicked-garden-runtime-exec", "wicked-garden-smaht", "wicked-garden-swarm", "wicked-garden-wickedizer", "wicked-garden-workflow", "wicked-garden-worktrees"],
+  "fork_skills": ["wicked-garden-agentic-architect", "wicked-garden-agentic-performance-analyst", "wicked-garden-agentic-safety-reviewer", "wicked-garden-archetype", "wicked-garden-classify", "wicked-garden-crew-implementer", "wicked-garden-crew-researcher", "wicked-garden-crew-reviewer", "wicked-garden-data-engineer", "wicked-garden-domain-coverage", "wicked-garden-domain-extractor", "wicked-garden-domain-modeler", "wicked-garden-engineering-api-documentarian", "wicked-garden-engineering-conformance-reviewer", "wicked-garden-engineering-debugging", "wicked-garden-engineering-migration-engineer", "wicked-garden-engineering-solution-architect", "wicked-garden-ground", "wicked-garden-integration-discovery", "wicked-garden-jam-brainstorm-facilitator", "wicked-garden-jam-council", "wicked-garden-mem-capture", "wicked-garden-mem-ingest", "wicked-garden-persona-agent", "wicked-garden-platform-compliance-officer", "wicked-garden-platform-privacy-expert", "wicked-garden-platform-security-engineer", "wicked-garden-product-a11y-expert", "wicked-garden-product-requirements-analyst", "wicked-garden-product-ui-reviewer", "wicked-garden-product-ux-designer", "wicked-garden-product-value-strategist", "wicked-garden-qe-a11y-test-engineer", "wicked-garden-qe-acceptance-test-executor", "wicked-garden-qe-acceptance-test-reviewer", "wicked-garden-qe-acceptance-test-writer", "wicked-garden-qe-ai-feature-test-engineer", "wicked-garden-qe-chaos-test-engineer", "wicked-garden-qe-code-analyzer", "wicked-garden-qe-compliance-test-engineer", "wicked-garden-qe-contract-testing-engineer", "wicked-garden-qe-coverage-archaeologist", "wicked-garden-qe-data-quality-tester", "wicked-garden-qe-e2e-orchestrator", "wicked-garden-qe-exploratory-tester", "wicked-garden-qe-flaky-test-hunter", "wicked-garden-qe-fuzz-property-engineer", "wicked-garden-qe-iac-test-engineer", "wicked-garden-qe-incident-to-scenario-synthesizer", "wicked-garden-qe-integration-test-engineer", "wicked-garden-qe-load-performance-engineer", "wicked-garden-qe-localization-test-engineer", "wicked-garden-qe-mutation-test-engineer", "wicked-garden-qe-observability-test-engineer", "wicked-garden-qe-production-quality-engineer", "wicked-garden-qe-release-readiness-engineer", "wicked-garden-qe-requirements-quality-analyst", "wicked-garden-qe-risk-assessor", "wicked-garden-qe-scenario-executor", "wicked-garden-qe-security-test-engineer", "wicked-garden-qe-semantic-reviewer", "wicked-garden-qe-snapshot-hygiene-auditor", "wicked-garden-qe-test-automation-engineer", "wicked-garden-qe-test-code-quality-auditor", "wicked-garden-qe-test-data-manager", "wicked-garden-qe-test-designer", "wicked-garden-qe-test-impact-analyzer", "wicked-garden-qe-test-oracle", "wicked-garden-qe-test-strategist", "wicked-garden-qe-testability-reviewer", "wicked-garden-qe-ui-component-test-engineer", "wicked-garden-qe-visual-regression-engineer", "wicked-garden-runtime-exec", "wicked-garden-smaht", "wicked-garden-swarm", "wicked-garden-wickedizer", "wicked-garden-workflow", "wicked-garden-worktrees"],
   "hooks": ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "PostToolUseFailure", "TaskCompleted", "SubagentStart", "SubagentStop", "PermissionRequest", "Notification", "PreCompact", "Stop", "SessionEnd"],
   "specialists": [
     {

package/.claude-plugin/marketplace.json

@@ -1,15 +1 @@
-{
-  "name": "wicked-garden",
-  "owner": {
-    "name": "Mike Parcewski"
-  },
-  "plugins": [
-    {
-      "name": "wicked-garden",
-      "source": "./",
-      "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (auto-installed via wicked-testing) and re-derives through garden's built-in engine; testing/brain/bus are opt-in layers.",
-      "version": "12.30.0"
-    }
-  ],
-  "version": "12.30.0"
-}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.32.0"}], "version": "12.32.0"}

package/.claude-plugin/plugin.json

@@ -1,10 +1,9 @@
 {
   "name": "wicked-garden",
-  "version": "12.30.0",
-  "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 codegraph + injected bus/dispatch/capability edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory (wicked-brain), real multi-model second opinions (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (wicked-testing). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault (installed automatically via wicked-testing); wicked-testing, wicked-brain, and wicked-bus are opt-in layers \u2014 install what you'll use, the toolkit works without the rest.",
-  "wicked_testing_version": "^0.8.0",
-  "wicked_vault_version": "^0.4.0",
-  "wicked_brain_version": "^0.18.0",
+  "version": "12.32.0",
+  "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), real multi-model second opinions (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
+  "wicked_vault_version": "^0.5.0",
+  "wicked_ledger_version": "^0.4.0",
   "wicked_bus_version": "^2.0.0",
   "author": {
     "name": "Mike Parcewski",

package/.claude-plugin/specialist.json

@@ -23,7 +23,7 @@
     {
       "name": "qe",
       "role": "quality-engineering",
-      "description": "Quality Engineering specialist powered by wicked-testing peer plugin. Crew dispatches QE agents by their wicked-testing:* subagent_type names. Covers test strategy, scenario generation, testability review, semantic alignment, risk assessment, test automation, and shift-left quality practices. Requires wicked-testing ^0.2 installed.",
+      "description": "Quality Engineering specialist — in-catalog qe domain (Phase 6b). Crew dispatches QE workers by their wicked-garden-qe-* skill names (router: wicked-garden-qe). Covers test strategy, scenario generation, testability review, semantic alignment, risk assessment, test automation, evidence-gated acceptance testing, and shift-left quality practices.",
       "enhances": ["clarify", "design", "qe", "build", "review", "operate", "*"]
     },
     {

package/.product/DES-001-technical-design.md

@@ -182,9 +182,10 @@ wicked-patch is the deterministic multi-file transformation engine. It is expose
 
 ```
 Developer invokes patch action: /wicked-garden-engineering patch-plan OldName
-  → engineering-patch skill reads codegraph from wicked-brain:
-      .codegraph/codegraph.db (structural graph, tree-sitter)
-      + injected edges (bus producer→consumer, dispatch, capability)
+  → engineering-patch skill reads the wicked-estate graph (ADR 0005):
+      built by `wicked-estate index` (75-language tree-sitter, in-binary),
+      adapted to the patch schema via estate_db.py (.codegraph/estate.db)
+      + injected edges (bus producer→consumer, dispatch, capability, archetype)
   → computes full affected file set:
       direct references (grep-visible)
       + injected-edge references (not grep-visible)
@@ -203,7 +204,7 @@ Developer invokes apply: /wicked-garden-engineering apply <patch-file>
 
 New language support: `/wicked-garden-engineering new-generator` creates a generator for an additional language. Generators implement a documented interface; adding one requires no change to the patch core.
 
-wicked-patch and wicked-brain share the same codegraph database (`.codegraph/codegraph.db`). The `wicked-garden-search index` action refreshes both layers — brain (semantic) and codegraph (structural).
+wicked-patch and the `wicked-garden-search` actions read the same wicked-estate graph. The `wicked-garden-search index` action (`wicked-estate index <path>`) refreshes the static graph and re-applies the injected-edge rules in one pass (ADR 0005).
 
 ---
 
@@ -254,9 +255,9 @@ Per-session ephemeral shared state. Not persisted across process restarts. Used
 
 wicked-bus integration. Emits events in 4-segment format (`wicked.<domain>.<noun>.<past-tense-verb>`). The bus provides at-least-once delivery, append-only event records, and FTS5 search via the wicked-bus backing store.
 
-### codegraph.db
+### estate graph
 
-Structural code graph built and maintained by wicked-brain at `.codegraph/codegraph.db`. Consumed by wicked-patch. The `search:index` action refreshes it.
+Structural code graph built and maintained by wicked-estate (`wicked-estate index <path>`; DB at `.wicked-estate/graph.db` by default, patch adapter DB at `.codegraph/estate.db`). Includes garden's injected archetype edges via `.wicked-estate-extractors/archetype.toml`. Consumed by wicked-patch and the search skill's actions. The `search:index` action refreshes it (ADR 0005).
 
 ---
 
@@ -304,6 +305,6 @@ Skills check for daemon availability before dispatching to it. If the daemon is
 | wicked-testing | `scripts/qe/` (acceptance pipeline) | Installed peer; invoked by acceptance skills |
 | wicked-brain | `scripts/crew/`, search/smaht skills | Brain server on port 4243; auto-starts on skill invocation |
 | wicked-bus | `scripts/_bus.py` | Installed peer; event emit/consume |
-| codegraph | `.codegraph/codegraph.db` | Built by wicked-brain; consumed by patch skill |
+| wicked-estate | `wicked-estate index` / estate MCP tools | `WICKED_ESTATE_BIN` env → PATH → `~/.local/bin`; consumed by search + patch skills |
 
 All peers degrade gracefully on absence — except the evidence gate, which fails closed when vault or loom is unreachable. A transient peer outage never invents a pass.

package/.product/RAID.md

@@ -16,7 +16,7 @@ review-required: true
 |----|------|-----------|--------|------------|
 | RISK-001 | Archetype detection accuracy degrades for ambiguous or very short prompts | Medium | Medium | Detector returns confidence score; low-confidence prompts prompt for clarification. Multi-archetype output handles mixed-intent work. |
 | RISK-002 | wicked-loom/wicked-vault peer absent → evidence gate fails closed | High (setup) | Low (expected) | Failing closed is the intended behavior. `/wg-check` validates peers at setup; setup skill guides installation. |
-| RISK-003 | codegraph not built → blast-radius/lineage/wicked-patch unavailable | High (optional) | Medium | codegraph is explicitly opt-in; skills degrade gracefully to text-search when graph is absent. |
+| RISK-003 | wicked-estate graph not built → blast-radius/lineage/wicked-patch unavailable | High (optional) | Medium | wicked-estate is explicitly opt-in; skills degrade gracefully to text-search when the graph is absent (and flag that injected relationships are missing). |
 | RISK-004 | Plugin not loaded in `claude -p` non-interactive mode | Medium | High | Documented mitigation: user must add `--plugin-dir` via clis.toml override (garden#994 resolution). Long-term fix: persistent worker sessions (core#13). |
 | RISK-005 | Council seat (Antigravity/Codex) unavailable or returns garbage | Medium | Low | Council aggregation tolerates partial failures; the skill surfaces which seats failed. |
 | RISK-006 | Hook scripts fail on Windows without correct Python fallback | Low | High | All scripts use cross-platform patterns (tempfile.gettempdir, python fallback chain). CI must include Windows runner. |
@@ -30,7 +30,7 @@ review-required: true
 |----|-----------|
 | ASS-001 | The host harness (Claude Code, Codex, Cursor, …) handles all planning, parallelism, and LLM calls. wicked-garden does not re-implement harness capabilities. |
 | ASS-002 | Users install the required peers (`wicked-testing`/`wicked-vault`, `wicked-loom`) before using the evidence gate. The setup skill validates this. |
-| ASS-003 | The codegraph (`.codegraph/codegraph.db`) is built and up-to-date when blast-radius/lineage/wicked-patch are used. |
+| ASS-003 | The wicked-estate graph (`wicked-estate index <path>`) is built and up-to-date when blast-radius/lineage/wicked-patch are used. |
 | ASS-004 | Harness plugins are loaded in interactive mode; non-interactive (`claude -p`) mode requires explicit plugin-dir configuration. |
 | ASS-005 | The `WICKED_VAULT_ACTOR` environment variable is set to a meaningful, stable actor identity for hard-gate evidence recording (not OS `$USER`). |
 | ASS-006 | wicked-bus is optional; garden emits events fail-open when bus is unavailable. |
@@ -55,8 +55,8 @@ review-required: true
 | wicked-vault ≥ 0.4.0 | Runtime | Yes (for evidence gate) | Evidence backend. `0.4.0` introduced fail-closed `attest` on weak identity. |
 | wicked-loom | Runtime | Yes (for evidence gate) | Gate/resolve engine. Resolved via `WICKED_LOOM_BIN` → config → PATH → `npx`. |
 | wicked-testing | Runtime | Yes (for acceptance) | The acceptance pipeline is the standard gate mechanism. |
-| wicked-brain | Runtime | Optional | Cross-session memory + codegraph. Required for blast-radius, lineage, wicked-patch. |
+| wicked-brain | Runtime | Optional | Cross-session memory + semantic search. |
 | wicked-bus | Runtime | Optional | Event audit trail. Garden emits events fail-open without it. |
-| codegraph (`@colbymchenry/codegraph`) | Runtime | Optional | Static graph builder. Powers blast-radius/lineage/wicked-patch. |
+| wicked-estate | Runtime | Optional | Code-graph owner (ADR 0005): `wicked-estate index` + MCP tools. Powers blast-radius/lineage/hotspots/wicked-patch. Resolved via `WICKED_ESTATE_BIN` → PATH → `~/.local/bin`. |
 | Python ≥ 3.9 | Runtime | Yes | Required for all hook scripts and CLI tools. |
 | node.js ≥ 18 | Runtime | Yes | Required for npm peer installs and wicked-vault/loom. |

package/.product/REQ-001-application-overview.md

@@ -15,7 +15,7 @@ review-required: true
 wicked-garden is a Claude Code plugin (v12.28.1) that fills the gaps modern coding-agent harnesses cannot close alone. The premise is direct: harnesses — Claude Code, Codex, Cursor, Aider, OpenCode, Zed/ACP, and others — already plan, parallelize, and execute well. wicked-garden does not compete with that; it adds only what a planner-executor genuinely cannot do on its own:
 
 - **Evidence-gated done** — re-derives "done" from recorded evidence via the internal loom engine and wicked-vault; a self-asserted "tests pass" cannot lie its way green.
-- **Relationships grep cannot see** — codegraph + injected event-bus/dispatch/capability edges power blast-radius and lineage analysis.
+- **Relationships grep cannot see** — the wicked-estate code graph + injected event-bus/dispatch/capability/archetype edges power blast-radius and lineage analysis (ADR 0005).
 - **Deterministic multi-file refactor** — wicked-patch applies graph-driven renames and field additions across an entire codebase without leaving silent half-applied states.
 - **Cross-session memory** — wicked-brain persists decisions, patterns, and gotchas across sessions; knowledge that only lives in chat history does not exist.
 - **Real multi-model second opinions** — the jam:council skill convenes external LLM CLIs (Claude Code, Antigravity, Codex, local models) for independent evaluation; it is not the model talking to itself.
@@ -86,7 +86,7 @@ The plugin installs via `/plugin install wicked-garden` into any Claude Code ses
 
 1. A developer needs to rename a domain type across a large codebase — source files, tests, migration files, configuration, and documentation.
 2. They invoke the patch skill: `/wicked-garden-engineering rename OldName NewName`.
-3. The `wicked-garden-engineering-patch` nested skill reads the codegraph from wicked-brain (`.codegraph/codegraph.db`), identifies all nodes referencing `OldName`, and computes the full set of affected files including injected edges (bus producer→consumer, dispatch links) that grep cannot see.
+3. The `wicked-garden-engineering-patch` nested skill reads the wicked-estate graph (built by `wicked-estate index`, adapted via `scripts/engineering/patch/estate_db.py`), identifies all nodes referencing `OldName`, and computes the full set of affected files including injected edges (bus producer→consumer, dispatch links) that grep cannot see.
 4. The skill shows the patch plan (files affected, kinds of change, risk surface). The developer approves or scopes the change.
 5. On approval, the patch applies deterministically using the language-specific generator for each file type. Generators exist out of the box for Python, TypeScript, Java, Go, SQL, Rust, Kotlin, C#, PHP, and Ruby. A `new-generator` action lets contributors add additional languages.
 6. The result is a complete, consistent rename across every file that references the symbol — including the relationships grep cannot see.

package/.product/REQ-002-technology-constraints.md

@@ -42,10 +42,10 @@ Three additional peers are opt-in:
 | Peer | npm Package | Required Version | Role |
 |------|-------------|-----------------|------|
 | wicked-testing | `wicked-testing` | `^0.8.0` | Acceptance testing gate; also installs wicked-vault as a transitive dependency |
-| wicked-brain | `wicked-brain` | `^0.18.0` | Cross-session memory, code graph, semantic search |
+| wicked-brain | `wicked-brain` | `^0.18.0` | Cross-session memory, semantic search (the code graph moved to wicked-estate, ADR 0005) |
 | wicked-bus | `wicked-bus` | `^2.0.0` | Event audit trail, append-only event store, FTS5 search |
 
-wicked-understanding (repo playbooks from HEAD) and codegraph (structural code intelligence) are additional optional integrations.
+wicked-understanding (repo playbooks from HEAD) and wicked-estate (structural code intelligence — the code graph, ADR 0005) are additional optional integrations.
 
 ---
 
@@ -57,7 +57,7 @@ wicked-understanding (repo playbooks from HEAD) and codegraph (structural code i
 
 **SessionState** (`scripts/_session.py`) — per-session ephemeral shared state. Does not persist across process restarts.
 
-**codegraph.db** — wicked-brain builds and maintains this structural code graph at `.codegraph/codegraph.db`. wicked-patch consumes it for multi-file refactor operations.
+**estate graph** — wicked-estate builds and maintains the structural code graph (`wicked-estate index <path>`, DB at `.wicked-estate/graph.db` by default; the patch adapter materializes `.codegraph/estate.db`). wicked-patch consumes it for multi-file refactor operations (ADR 0005).
 
 ---
 

package/.product/REQ-003-domain-model.md

@@ -184,7 +184,7 @@ Compiler
   → emitted gate resolves wicked-vault via npx (no wicked-garden runtime required)
 
 wicked-patch
-  → reads codegraph.db (wicked-brain structural graph + injected edges)
+  → reads the wicked-estate graph (structural graph + injected edges, ADR 0005)
   → computes affected file set (including injected edges grep cannot see)
   → applies language-specific generator per file
   → produces deterministic multi-file change

package/CHANGELOG.md

@@ -2,6 +2,71 @@
 
 ## [Unreleased]
 
+### Added
+- **AW-25 golden path — the wiki pipeline's own evidence-gated proof (recon arch-R21).** The guardrails program now applies its own DoD to itself: a committed, re-runnable acceptance scenario proves seed doc → `wicked-core rules ingest`/`fanout` (isolated stores; enforcement over the crew API, never CLI against a daemon store) → `rules.recall` over the **installed** `wicked-estate-mcp` 0.15.1 returning the rule with its digest-bearing provenance citation → an ISOLATED crew daemon's governed run deterministically tripping the canary trigger (the token rides the run INTENT, so the gate's evaluated context matches with no reliance on the worker model) → the gate denial citing the rule id + wiki URI (`POL-2500`, `wiki://aw25-golden#POL-2500` — via policy criteria AND `conform:` obligations, two independent citation paths) → the ConformanceClaim visible in `GET /runs/:id/acceptance` (deny-dominates, `guardrailed: false`). Ships as `scenarios/qe/aw25-golden-path.md` (scenario-format v1.1, category cli, isolation exclusive), `evidence/aw25-golden/` (seed ruleset with doc↔gate id-twinned `POL-2500`, `run.sh` fail-loud chain script, `campaign-recon.aw25.json` — spec-2 schema-validated plan with a machinery-verified claim ceiling, and the recorded `chain/` evidence 00–07 from a real run), plus `tests/qe/test_aw25_golden_artifacts.py` pinning the artifacts (schema validity, id-twinning, the AC-critical citation assertions in run.sh) hermetically. Evaluator≠creator: the verdict of record is crew's acceptance read, captured verbatim. Findings recorded in the evidence README: the <200-char PHASE SUBSTANCE GATE rejects a too-terse canary BEFORE any claim is recorded (first trip hit exactly this), and the ACP carrier reports `enforcement: enforced` with an empty `armedUnits` list.
+- **Flaky-verdict policy at the campaign acceptance gate (TH-21, ADR 0006 — RECON-TEST-HARNESS test-R23).** One flaky scenario can no longer silently deny OR silently pass a nightly campaign, and exclusions always carry reasons. New written policy `skills/qe/refs/campaign-flake-policy.md` + pure policy engine `scripts/qe/lib/flake-policy.mjs`, applied by `campaign-scoreboard.mjs` on every assembly: (a) **bounded diagnostic re-runs with BOTH verdicts recorded** — a re-run lands as its own runs+verdicts rows under the same stable scenario id (TH-6's flake history, now consumed at the gate via `flake_policy.history`); mixed outcomes are a `flake_signal` blocker naming `wicked-garden-qe-flaky-test-hunter` (never best-of-N), >1+2 runs of one rung is a `rerun_bound_exceeded` violation, and a `--runs` selection showing PASS while omitting a same-window deny-graded sibling is a `pass_laundering_risk` violation; (b) **quarantine lane with owner+deadline via the hunter's taxonomy** — the gate consumes the hunter's ledger `tasks` row fail-closed (`quarantined: true` + scenario binding + taxonomy cause + owner + unexpired `quarantine_expires`; invalid/expired records are reported and NOT honored — the scenario keeps denying); (c) **quarantined scenarios are excluded-with-reason** — rows stay on the scoreboard, the exclusion (id/cause/owner/deadline/reason/observed grades) rides `certification.excluded` + `certification.gate_summary`, and `gate.mjs --exclusions-from <scoreboard.json>` appends the canonical clause to `verdict_summary` so it reaches crew's acceptance payload (the 8-field `wicked.qe.gate.*` wire contract untouched; exclusions missing id/reason/owner/deadline exit 3). A fully-quarantined campaign cannot certify; a quarantined PASS is excluded too; structural violations are never excused. Hunter's SKILL.md §5/§6 now pin the machine contract (body gains required `owner`). Tests: `tests/qe/test_campaign_flake_policy.py` (9 CLI cases, hermetic) + `scripts/qe/runner/test/th21-flake-policy.test.mjs` (14 unit cases).
+- **qe campaign grading through the accept trio (TH-10, ADR 0006).** New `skills/qe/refs/campaign-grading.md` playbook: campaign evidence bundles grade through the SAME role-isolated reviewer as `refs/accept.md` (evidence PATHS only; isolation hard-enforced on Claude Code via host-level `allowed-tools`, advisory on Gemini/Codex/Cursor/Kiro — the boundary is now written down in both refs), with validate-before-grading against wicked-ledger's evidence-manifest 2.1 contract (schema-fail = INCONCLUSIVE; validator unavailable = fail closed). New deterministic glue `scripts/qe/lib/campaign-scoreboard.mjs` assembles the campaign-proven verbatim scoreboard shape `{id, grade, executor_claim, evidence_ok}` and makes self-grading structurally impossible: verdict rows by executor identities (`qe-runner/executor-claim`, `*executor*`, the `test-designer` dev-loop) are refused as grade sources and reported as `self_grade_attempt` violations; `executor_claim` derives from manifest-2.1 `scenario_evidence.status` (the contract's "executor's claim, never the verdict of record" field). Encodes the scenario-defect vs product-finding fork (verdict-reason tag `[scenario-defect]` → bounded re-author/re-run fix lane; `[product-finding]` → GH issue + idempotent ledger `tasks` mirror via `--mirror-tasks`) so certification terminates: `certification.disposition` is always `certified` or `not-certified`, never pending. Reviewer skill gains the campaign-bundle duties (structural floor re-check, claim-vs-evidence posture, mandatory non-PASS classification). Tests: `tests/qe/test_campaign_scoreboard.py` (8 cases, hermetic via a `WICKED_LEDGER_PKG_DIR` stub).
+- **`qe campaign` recon+generation action (TH-7, ADR 0006).** New `campaign` action on the `wicked-garden-qe` router (`skills/qe/refs/campaign.md`): derives a capability inventory from three lenses — the estate code graph when the target repo is indexed, docs recall via `wicked-garden-mem`, and live probing (health endpoints, crew's committed `packages/crew/endpoint-manifest.json`, DOM landmarks) — and emits a dependency-ordered campaign plan CONFORMING to `schemas/campaign-recon.schema.json` v1 (never a parallel format), persisted as a ledger `strategies` row + scenario-format v1 files under `.wicked-qe/campaigns/<name>/`. Assembly/validation glue is `scripts/qe/campaign_plan.py` (stdlib-only, fail-closed): honest `sources.estate: "unindexed"` degradation is DERIVED (an unindexed plan claiming estate-sourced entries is rejected), doc-derived claims are forced `status: "proposed"` pending human review (the incident-to-scenario pending-review pattern), ladder order + rung↔capability binding are enforced beyond the JSON schema, and generated stubs fail until authored (never a silent PASS). Tests: `tests/qe/test_campaign_action.py` validates a generated three-lens plan against the schema itself.
+- **qe dispatch guard (TH-7, guard half of the retired agent-surface cleanup — arch-R25 ≡ test-R20).** `scripts/qe/campaign_dispatch.py`: every qe dispatch resolves its specialist through `resolve_specialist()`, which asserts the resolved worker is a shipped `wicked-garden-qe-*` skill and BLOCKS retired `wicked-testing-*` / `wicked-brain-*` names at dispatch with a clear error naming the garden replacement (exit 2 on the CLI; never a silent rewrite). Wired into `skills/qe/SKILL.md` (fork workers) and `skills/qe/refs/execute.md` (dispatch block).
+
+### Fixed
+- **Re-landed TH-5's campaign-recon schema, clobbered by #1083's stale-base squash.** PR #1083 (TH-4) was squashed from a branch cut before #1082 merged, silently reverting `schemas/campaign-recon.schema.json`, `tests/qe/test_campaign_recon_schema.py`, and the `schemas/README.md` standalone-contract section. Restored byte-for-byte from the #1082 squash commit. (The same squash also reverted #1081's docs/peer-floor work — flagged to its owning lane, not restored here.)
+
+### Changed
+- **`wicked_ledger_version` floor `^0.2.0` → `^0.4.0` (recon XC-4 — the wicked-ledger 2.1 floor-bump wave).** wicked-ledger 0.4.0 ships evidence-manifest **2.1.0** (optional `scenario_evidence` block + first-class `claim_level` enum, `validateManifest` reviewer entry point — TH-5) and new-feature API surface, so the npm minor moved and the old caret (`^0.2.0` excludes 0.3+) had to move with it. Store compat is unchanged in every direction a garden consumer touches: SQLite `schema_version` stays **3** (no new migrations since 0.1.0), and manifest 2.1 is a **minor** — 2.0.0 bundles still validate (covered by the ledger's backward-compat smoke test) and 2.x readers gate on the major. The pin is single-sourced in `plugin.json`; the six qe skill files (`skills/qe/SKILL.md`, `skills/qe/refs/{accept,insight,integration}.md`, `skills/qe-release-readiness-engineer/SKILL.md`, `skills/qe-test-impact-analyzer/SKILL.md`) reference it symbolically and needed no edits — this completes the ledger-pin half DT-13 deferred to XC-4.
+- **Peer-floor and manifest truth pass (recon DT-13).** One consistent vault-floor story: every doc restatement now says **≥ 0.5.0** — the floor `scripts/loom/manifest.py` (`version_pin="0.5"`) and `plugin.json` (`wicked_vault_version ^0.5.0`) have carried since 12.31.0 (checked by the peer registry's health probe: `loom doctor` reports a below-floor vault as `drift` and exits non-zero) — replacing the stale `≥ 0.4.0` (README, CONTRIBUTING, `skills/archetype/refs/{review,incident,migrate,modernize,specify}.md`) and `^0.3.0` (`docs/required-peers.md`) claims. manifest.py + plugin.json are declared the single source; restatements carry a greppable `<!-- vault-floor -->` marker, and `docs/required-peers.md` documents the bump procedure. `skills/core/refs/setup.md` now checks the probed vault version against the floor and tells a below-floor (e.g. 0.4.x) user to upgrade via `npm i -g wicked-vault@latest`.
+- **`docs/required-peers.md` rewritten to the shipped truth.** The vault install command is now the working `npm i -g wicked-vault` form (was `npx wicked-vault-install`, which E404s on a fresh machine — no npm package of that name exists; it's a bin of `wicked-vault`). The loom row no longer presents a required external peer pinned `^0.2.0`: the engine has been absorbed in-package (`scripts/loom/`, dispatched in-process by `scripts/_loom.py`) since 12.27.0. **Decision (recon OQ-4):** the standalone `wicked-loom` npm package (0.4.0, not deprecated) is not a sanctioned install path — the pin is deleted, not bumped; `WICKED_LOOM_BIN` stays a debugging escape hatch.
+- **`.claude-plugin/plugin.json`: deleted the retired `wicked_brain_version` pin** (`^0.18.0` — wicked-brain retired 2026-08, Phase 5-S7; nothing reads the key). The `wicked_ledger_version ^0.2.0` pin is deliberately untouched here — it moves with the coordinated wicked-ledger 2.1 floor-bump wave.
+- **`.claude-plugin/marketplace.json`: retired-layers copy fixed** — "testing/brain/bus are opt-in layers" → estate/bus are the opt-in layers; wicked-testing and wicked-brain are retired (QE ships in-catalog as the `qe` domain; memory lives in wicked-estate).
+- **`docs/brain-chunk-format.md`: retirement banner added** (recon DT-18) — the doc read as live instructions to write chunks into `~/.wicked-brain`, which is a frozen archive that must never be written; the format is preserved as historical reference for the chunks migrated into wicked-estate.
+- **Site: the wicked-interactive card tells the document-engine story** (recon DT-12) — wicked-interactive moved planes rather than retiring: it is the foundation's document engine (storage, version lineage, HTML/PDF/PPTX/video rendering) that wicked-crew spawns and proxies, not a standalone visual builder. Install command unchanged (two-step marketplace add + install).
+- **Backfilled the 12.30.0 and 12.31.0 changelog entries below** (recon DT-17) — the previous release entry was 12.29.1 while npm shipped 12.31.0; the vault-direct-peer entry that sat under [Unreleased] shipped in 12.31.0 and now lives there.
+
+## [12.32.0] — 2026-08-30
+
+### Added
+- **qe campaign suite complete**: recon+generation w/ dispatch guard, intake propose-as-gate, accept-trio grading, flaky-verdict quarantine, degradation scenarios, campaign rerun+diff, CI recipes (PR subset / governed nightly), vault-backed evidence integrity (content-addressed, redaction-first), AW-25 golden-path evidence chain, dogfood corpus wiring.
+- **Per-turn rules source**: stop.py names `rules.recall` as THE per-turn source; guard_pipeline consumes a graph-derived rules dir with content-hash provenance; `WG_OUTGOV` defaults to advisory `warn`.
+- **Architecture-wiki pointers** in the mem/search/conformance skills (`knowledge.recall {"scope_prefix":"wiki:"}` + estate `rules.recall`).
+
+### Changed
+- Site version stamp injected at build from the plugin manifest (DT-7 — can never re-stale).
+- campaign-recon schema v2: `desktop` category tiers + `isolation` annotation in one bump.
+
+## [12.31.0] — 2026-08-25
+
+### Changed
+- **Phase 5 — wicked-brain retired; memory/knowledge/context re-homed onto wicked-estate.** The `mem` domain now runs over wicked-estate (S7 brain folds: vision ingest, session capture, cited answer — #1048); the auto-memorize loop rebuilt on estate (#1050); context assembly retargeted from wicked-brain onto wicked-estate (S4 — #1044) and the wicked-brain route retired outright — estate-only context stack (S7 — #1056). Reach plumbing: estate reach-shim so garden hooks can reach the estate stdio MCP (S2 — #1041) and a persistent stdio broker for ~50x faster estate calls (S3).
+- **ADR 0005 — the code-relationship graph re-homed to wicked-estate** (supersedes ADR 0004 — #1040): remaining graph consumers re-homed (S5: A1/A2/A4/A5/A6 + Section B — #1049) and wicked-patch's graph reader retargeted (A3 — #1045).
+- **Phase 6 — wicked-testing retired; QE ships in-catalog.** wicked-testing's capability set became the garden `qe` domain (Phase 6b — #1047); the wicked-testing peer retired and its `wicked_testing_version` pin dropped (Phase 6c — #1051); qe event/domain rebrand — `.wicked-qe` store dirname, qe stamps, in-catalog helpers, `wicked_vault_version` floor `^0.4.4` → `^0.5.0` and `wicked_ledger_version` `^0.1.0` → `^0.2.0` (#1052). (Earlier in the same release, the testing floor had been bumped `^0.8.0` → `^0.10.0` — #1037 — before the peer's retirement mooted it.)
+- **wicked-vault became a direct infra peer — no longer installed "via wicked-testing"** (#1039). `wicked-vault` is published from its own repo (mikeparcewski/wicked-vault): self-contained, zero runtime deps. The loom peer registry (`scripts/loom/manifest.py`) installs it directly (`install_cmd` = `["npm", "install", "-g", "wicked-vault@latest"]`, was `["npx", "wicked-testing", "install"]`); `plugin.json` `wicked_vault_version` floor `^0.4.0` → `^0.4.4` (raised again to `^0.5.0` by #1052 in this same release). Narrative corrected across `plugin.json` / `marketplace.json` descriptions, `docs/getting-started.md`, and `skills/core/refs/setup.md`; fixed a hardcoded `~/Projects/wicked-vault` dev path in `scripts/compiler/phase0/wire_vault.py`.
+- Site: wave-2 capability deep-dive — the catalog, the qe wall, the extension pitch (#1055); shared chrome re-pins (studio first-class — #1058, and digest updates); baseline Playwright smoke suite for the signature widgets (#1046).
+- Docs accuracy: removed the sunsetted Gemini CLI from the harness list and panel description (#1065).
+- Dependency wave: astro 7.2.x, react 19.2.18, motion v13, svgo, npm_and_yarn group.
+
+### Added
+- **Third-party extension contract (packs)** — drop-in packs, shipped conformance gate, crew routing (#1057).
+- Event hygiene: 6 wicked-core production events cataloged + a 4-segment `wicked.<domain>.<noun>.<verb>` format validator (#1061); 3-segment QE event names renamed to canonical 4-segment (#1060).
+
+### Fixed
+- Drift-guard: crew contract check re-pointed at `wicked-crew-api-types` (#1054).
+- Bootstrap perf: CH-02 legacy-scan result cached, eliminating a ~20s rglob on session start (#1064).
+- E2E: `BootstrapEndToEndTests` isolated from shared `HOME` state (#1066).
+
+## [12.30.0] — 2026-07-30
+
+### Added
+- **Domain extraction pipeline:** structural extraction loop — clusters, blast-radius framing, parallel workers (#1020); Message Batches API pipeline + direct-API adapter for rule extraction (#1025).
+
+### Fixed
+- Domain-extraction robustness chain: infra failures abort the pass instead of RISK-flooring (#1021); zero-yield batches abort as infra-suspect and floors never overwrite content (#1022, #1023); one in-pass retry before infra abort (#1024); batch timeouts retry once before flooring (#1026); rule statements phrased in product-functional terms with config trivia floored honestly (#1027); trailing-dot-tolerant symbol-id matching so model-normalized ids recanonize (#1028).
+- Scaffolding: YAML-quote template name placeholders — unquoted `{{name}}` broke codex's skill loader (#1029).
+
+### Changed
+- Site: version-free kicker chip — npm is the version authority (#1018).
+- CI: notify wicked-installer on release tags (#1030).
+- DoD bookkeeping: L3-009/L3-010 evidence checked off against the 12.29.1 release (#1015); shared deps updated to v19.2.8 (#1008).
+
 ## [12.29.1] — 2026-07-21
 
 ### Added

package/CONTRIBUTING.md

@@ -18,41 +18,24 @@ uv run pytest tests/ -x
 
 ## Escape Hatches
 
-### WG_SKIP_WICKED_TESTING_CHECK
-
-**For offline CI and dev environments without npm access only.**
-
-When set to `1`, the SessionStart wicked-testing probe is bypassed:
-
-```bash
-export WG_SKIP_WICKED_TESTING_CHECK=1
-```
-
-Effect:
-- `wicked_testing_missing` is set to `false` — crew commands proceed normally.
-- The probe subprocess (`npx wicked-testing --version`) is never invoked.
-- A single warning is emitted to **stderr** (not to the Claude session briefing):
-  `WG_SKIP_WICKED_TESTING_CHECK is set — wicked-testing version check bypassed (offline dev mode). Do not use in production.`
-
-**When to use**: CI pipelines where npm is unavailable; local development on
-machines without Node.js installed; offline development sessions.
-
-**When NOT to use**: Production environments, any session where crew QE gates
-will actually run (the bypass skips the version check but wicked-testing agents
-will still fail if the package is absent).
-
-This escape hatch is a developer override. It does NOT appear in user-facing help,
-setup wizard output, or the README. It is not a supported production configuration.
+> **Historical note (Phase 6c):** the `WG_SKIP_WICKED_TESTING_CHECK` escape
+> hatch and the SessionStart wicked-testing probe it bypassed were removed <!-- historical -->
+> when wicked-testing retired — the qe domain ships in-catalog (the <!-- historical -->
+> `wicked-garden-qe` router + specialists), so there is no peer package to
+> probe. The acceptance gate concept now lives in wicked-crew's
+> `/runs/:id/acceptance` route.
 
 ### WICKED_VAULT_BIN
 
 **For offline CI and dev environments without the wicked-vault peer only.**
 
-wicked-vault (npm, ≥0.3, install `npx wicked-testing install`) is a required peer
-alongside wicked-loom/bus/brain/testing. The garden's produces-gates re-derive
-evidence through **wicked-loom** — `scripts/qe/vault_gate.py` shells `wicked-loom
-gate`, which in turn shells `wicked-vault cross-check`, so the vault is the backend
-loom re-runs the verifier against. loom resolves the vault; the concrete-install
+wicked-vault (npm, ≥ 0.5.0 <!-- vault-floor -->, install `npm i -g wicked-vault`)
+is the one required peer (the loom engine is built into the garden; bus is an
+opt-in layer). The garden's produces-gates re-derive
+evidence through the built-in loom engine — `scripts/qe/vault_gate.py` runs
+`loom gate` in-process (`scripts/_loom.py` → `scripts/loom/`), which shells
+`wicked-vault cross-check`, so the vault is the backend loom re-runs the
+verifier against. loom resolves the vault; the concrete-install
 probe (`vault_available`) and the `WICKED_VAULT_BIN` kill-switch below still apply.
 The vault CLI is resolved in order:
 
@@ -62,8 +45,7 @@ The vault CLI is resolved in order:
 4. a local `node_modules/.bin/wicked-vault`
 5. `npx --yes wicked-vault`
 
-Setting `WICKED_VAULT_BIN=""` (set-but-empty) is the vault analogue of
-`WG_SKIP_WICKED_TESTING_CHECK`:
+Setting `WICKED_VAULT_BIN=""` (set-but-empty) disables vault resolution:
 
 ```bash
 export WICKED_VAULT_BIN=""
@@ -88,12 +70,8 @@ setup wizard output, or the README. It is not a supported production configurati
 
 ### Fail-open boundary
 
-The wicked-testing probe (`_wicked_testing_probe.probe()`) is called by
-`_probe_wicked_testing()` in `hooks/scripts/bootstrap.py` at SessionStart.
-Any exception that escapes the probe is caught by `_probe_wicked_testing()`
-which logs actionable detail to stderr and continues bootstrap (fail-open).
-
-**CH-02 close**: `crew_command_gate()` in `scripts/crew/_prerequisites.py`
-is fail-closed: if `session_state.extras["wicked_testing_probe"]` is absent
-(probe exception path), the gate treats this as missing rather than passing.
-This prevents silent unblocked crew runs when the probe fails silently.
+SessionStart probes in `hooks/scripts/bootstrap.py` (vault / bus / loom
+dependency checks) are fail-open: any exception is caught, logged to stderr
+with actionable detail, and bootstrap continues. Gates that *enforce*
+evidence are fail-closed at their own layer (`scripts/qe/vault_gate.py`),
+never at the probe.

package/ETHOS.md

@@ -18,11 +18,11 @@
 
 **Quality pressure must be structural, not delegated to willpower.** Reviews skipped under deadline pressure are gates that didn't exist. So enforcement lives in code, not prose: hard gates refuse to advance at runtime, produces re-derive through wicked-loom (which re-runs the verifier via the vault), and the audit trail is append-only. Good intentions don't have to survive a Friday afternoon — the gates do.
 
-**Knowledge compounds across sessions or it isn't knowledge.** If a decision, gotcha, or pattern lives only in the current chat, it dies with the chat. Every memorable thing belongs in a tier-appropriate memory store with confidence and decay rules. wicked-brain is the difference between learning once and learning every time.
+**Knowledge compounds across sessions or it isn't knowledge.** If a decision, gotcha, or pattern lives only in the current chat, it dies with the chat. Every memorable thing belongs in a tier-appropriate memory store with confidence and decay rules. The mem domain over wicked-estate is the difference between learning once and learning every time.
 
 **Native primitives over bespoke abstractions.** Claude Code's `TaskCreate`, `Skill`, `Agent`, and hooks are the surface. We extend them — we don't replace them. A task with metadata is more durable than a custom kanban; a skill with a frontmatter description is more discoverable than a registry call. The plugin is **skills-only**: user entry points are consolidated per-domain skills, and the former agents are fork-context worker skills — one surface, not three.
 
-**The gate is required; the rest is a toolkit.** wicked-garden's one non-negotiable is the evidence gate, so it stands on two required peers: **wicked-vault** (the backend that makes "done" re-derivable) and **wicked-loom** (the engine that re-runs the verifier). The core skill's `setup` action (`/wicked-garden-core setup`) blocks without them — a gate you can fake is worse than no gate. The other siblings are **opt-in layers**, not prerequisites: **wicked-testing** (acceptance testing), **wicked-brain** (cross-session memory — the *what*), **wicked-understanding** (repo playbooks — the *how*), **wicked-bus** (the audit trail). Install the ones you'll use; the toolkit works without the others — breadth you adopt incrementally, not a five-thing prerequisite wall. And required-at-install is not brittle-at-runtime: a transient outage degrades gracefully and never bricks a session — but a gate never pretends missing evidence is a pass; that path **fails closed**. We depend on the gate; we don't crash with the layers.
+**The gate is required; the rest is a toolkit.** wicked-garden's one non-negotiable is the evidence gate, so it stands on two required peers: **wicked-vault** (the backend that makes "done" re-derivable) and **wicked-loom** (the engine that re-runs the verifier). The core skill's `setup` action (`/wicked-garden-core setup`) blocks without them — a gate you can fake is worse than no gate. The other siblings are **opt-in layers**, not prerequisites: **wicked-estate** (cross-session memory + knowledge — the *what*), **wicked-understanding** (repo playbooks — the *how*), **wicked-bus** (the audit trail). Acceptance testing needs no sibling at all — the `qe` domain ships in-catalog. Install the ones you'll use; the toolkit works without the others — breadth you adopt incrementally, not a five-thing prerequisite wall. And required-at-install is not brittle-at-runtime: a transient outage degrades gracefully and never bricks a session — but a gate never pretends missing evidence is a pass; that path **fails closed**. We depend on the gate; we don't crash with the layers.
 
 **Cross-platform is non-negotiable.** macOS, Linux, Windows (Git Bash, WSL, native). Bare `python3` doesn't exist on Windows; bare `/tmp` doesn't exist on Windows; the shim and `${TMPDIR:-/tmp}` exist for a reason. If a contributor adds shell that breaks on Windows, the contribution is incomplete.
 
@@ -68,7 +68,7 @@
 
 **Not a single-language toolkit.** Cross-platform stdlib-only Python for the plumbing. wicked-patch's generators support Python, TypeScript, Java, Go, SQL, Rust, Kotlin, C#, PHP, Ruby out of the box; new languages plug in via the generator interface.
 
-**Not closed.** The siblings (vault + loom required for the gate; testing, brain, understanding, bus opt-in) are peers, not forks — and the compiler emits a vault-backed harness any repo can adopt **without installing wicked-garden at all**. The plugin's relationship to other tools is "stand on, and hand off," not "absorb."
+**Not closed.** The siblings (vault + loom required for the gate; estate, understanding, bus opt-in) are peers, not forks — and the compiler emits a vault-backed harness any repo can adopt **without installing wicked-garden at all**. The plugin's relationship to other tools is "stand on, and hand off," not "absorb."
 
 ---
 

package/README.md

@@ -17,7 +17,7 @@
 
 ## The premise
 
-Coding agents grew up. Claude Code, Codex, Cursor, Antigravity, Aider, OpenCode, Gemini CLI, Zed/ACP — they're not autocomplete anymore. They plan. They parallelize. And each has *strong opinions* about how it likes to work.
+Coding agents grew up. Claude Code, Codex, Cursor, Antigravity, Aider, OpenCode, Zed/ACP — they're not autocomplete anymore. They plan. They parallelize. And each has *strong opinions* about how it likes to work.
 
 Most plugins try to boss them around — re-implement planning, impose a workflow, make the agent dance. You end up fighting your own tools.
 
@@ -30,9 +30,9 @@ Most plugins try to boss them around — re-implement planning, impose a workflo
 | says *"tests pass"* (sometimes it's lying) | re-runs the proof. False "done" → **rejected.** Missing backend → **fails closed.** Never a vacuous green. |
 | greps and reads — blind to string-wired links | sees the **injected edges** (event→consumer, command→agent, agent→capability) grep never will → `blast-radius`, `lineage` |
 | refactors on a hope and a prayer | renames across files as a **graph operation**, not find-replace roulette → wicked-patch |
-| forgets everything at `exit` | remembers what session 1 decided when you're in session 47 → wicked-brain |
+| forgets everything at `exit` | remembers what session 1 decided when you're in session 47 → the mem domain over wicked-estate |
 | re-derives *how to work in this repo* every task — which file owns the bug, the wiring step, the test command | loads the repo's own playbooks (`fix-bug`/`add-feature`/`verify`…), generated from HEAD → wicked-understanding |
-| asks *itself* for a second opinion | convenes a **real multi-model panel** (Gemini / Codex / …) → the jam skill's `council` action |
+| asks *itself* for a second opinion | convenes a **real multi-model panel** (Antigravity / Codex / …) → the jam skill's `council` action |
 | re-derives WCAG/CWE/SOC2 from memory every time | loads the rubric on demand, ships it to any repo |
 | grades its own homework | author ≠ executor ≠ reviewer → evidence-gated testing |
 
@@ -54,14 +54,23 @@ No universal pipeline to obey. A hook reads each prompt's *shape* and that decid
 ## Install
 
 ```bash
-/plugin install wicked-garden      # in Claude Code
+claude plugins marketplace add mikeparcewski/wicked-garden
+claude plugins install wicked-garden
+```
+
+Or use the family installer — [`npx wicked-installer`](https://www.npmjs.com/package/wicked-installer)
+installs/updates the whole wicked-\* family (garden, its peers, and the rest).
+
+Then, in a Claude Code session:
+
+```bash
 /wicked-garden-core setup          # verifies peers; blocks only on the one the gate needs
 ```
 
 **One required peer, the rest opt-in.** The evidence gate is the floor we won't fake, so it needs one external peer — setup blocks without it:
 
 ```bash
-npx wicked-testing install     # installs wicked-vault (≥ 0.4.0), the honest-evidence backend the gate re-derives against
+npm i -g wicked-vault          # wicked-vault (≥ 0.5.0), the honest-evidence backend the gate re-derives against
 ```
 
 > The gate/resolve engine (formerly the separate `wicked-loom` package) is now **absorbed in-package** as of v12.27.0 (`scripts/loom/`) — nothing extra to install. The gate re-hashes recorded evidence and re-runs its verifier through that engine; a false "tests pass" is **rejected**, a missing backend **fails closed**.
@@ -69,12 +78,14 @@ npx wicked-testing install     # installs wicked-vault (≥ 0.4.0), the honest-e
 The rest of the kit is **opt-in layers** — add what you want, skip the rest and the toolkit still works:
 
 ```bash
-npx wicked-testing install     # the acceptance-testing layer (author ≠ executor ≠ reviewer)
-/plugin install wicked-brain   # the memory layer — cross-session recall + cited search (the "what")
-/plugin install wicked-bus     # the audit-trail layer (fire-and-forget; fail-open without it)
+# wicked-estate — the memory/knowledge layer (cross-session recall + cited search, the "what"):
+#   install the `wicked-estate` + `wicked-estate-mcp` binaries onto PATH or ~/.local/bin
+npm i -g wicked-bus && npx wicked-bus-install   # the audit-trail layer (fire-and-forget; fail-open without it)
 ```
 
-Optional, lights up the code graph: `npx @colbymchenry/codegraph` (Node ≥ 22.5) → powers `blast-radius` / `lineage` / `hotspots` / wicked-patch. Details: [`docs/required-peers.md`](docs/required-peers.md).
+> Evidence-gated acceptance testing (author ≠ executor ≠ reviewer) needs no extra install — it ships **in-catalog** as the `qe` domain (`wicked-garden-qe`).
+
+Optional, lights up the code graph: **wicked-estate** (single binary; `wicked-estate index <path>` + the estate MCP server) → powers `blast-radius` / `lineage` / `hotspots` / wicked-patch (ADR 0005 — no external codegraph engine, no Node version floor). Details: [`docs/required-peers.md`](docs/required-peers.md).
 
 ## Try it
 
@@ -94,6 +105,23 @@ Optional, lights up the code graph: `npx @colbymchenry/codegraph` (Node ≥ 22.5
 
 ---
 
+## Build on it
+
+The catalog is open: ship your own domain pack — a `wicked-pack.json`
+manifest plus `{vendor}-{domain}` router / `{vendor}-{domain}-{role}` fork
+workers — and the runtime discovers it without a garden PR: catalog listing,
+crew specialist routing, peer-floor probing, same evidence discipline.
+
+```bash
+npx wicked-garden pack check ./acme-seo-pack   # the shipped conformance gate
+npx wicked-installer pack add acme-seo-pack    # acquire + validate + install + register
+npx wicked-garden pack list                    # what the runtime sees
+```
+
+Full author guide: [`docs/extending.md`](docs/extending.md).
+
+---
+
 ## Principles
 
 - **Don't fight the harness.** Fill the gaps; never re-implement what it already does well.
@@ -104,11 +132,11 @@ Optional, lights up the code graph: `npx @colbymchenry/codegraph` (Node ≥ 22.5
 
 ## More
 
-[`ETHOS.md`](ETHOS.md) · [`docs/getting-started.md`](docs/getting-started.md) · [`docs/domains.md`](docs/domains.md) · [`docs/required-peers.md`](docs/required-peers.md) · [`docs/compiler.md`](docs/compiler.md)
+[`ETHOS.md`](ETHOS.md) · [`docs/getting-started.md`](docs/getting-started.md) · [`docs/domains.md`](docs/domains.md) · [`docs/required-peers.md`](docs/required-peers.md) · [`docs/compiler.md`](docs/compiler.md) · [`docs/extending.md`](docs/extending.md)
 
 ## Requirements
 
-A coding-agent harness ([Claude Code](https://docs.anthropic.com/en/docs/claude-code/overview) ≥ 1.0 for the plugin surface; the peers + compiled gate are harness-agnostic) · Python 3.9+ (stdlib-only hooks) · Node + `npx` · the gate's one required peer (`wicked-vault` ≥ 0.4.0) plus opt-in layers (`wicked-testing` · `wicked-brain` · `wicked-bus`).
+A coding-agent harness ([Claude Code](https://docs.anthropic.com/en/docs/claude-code/overview) ≥ 1.0 for the plugin surface; the peers + compiled gate are harness-agnostic) · Python 3.9+ (stdlib-only hooks) · Node + `npx` · the gate's one required peer (`wicked-vault` ≥ 0.5.0) plus opt-in layers (`wicked-estate` · `wicked-bus`).
 
 ## License