wicked-garden 12.32.0 → 12.32.2

package/.claude-plugin/components.json

@@ -2,7 +2,7 @@
   "_comment": "Issue #328: Component declarations for wicked-garden plugin. Claude Code plugin.json does not yet support inline component declarations beyond path overrides. This manifest documents all components for tooling, validation, and future schema support. When plugin.json gains a 'components' field, merge this data into plugin.json. The plugin is skills-only: former commands/ became actions of consolidated per-domain skills, and former agents/ became standalone context:fork worker skills (enumerated under fork_skills). Regenerate derived blocks with scripts/ci/sync_components.py.",
   "domains": ["agentic", "crew", "data", "engineering", "jam", "mem", "persona", "platform", "product", "qe", "search", "smaht"],
   "summary": {
-    "skills": 141,
+    "skills": 142,
     "fork_skills": 78,
     "hooks": 13,
     "specialists": 7
@@ -92,6 +92,7 @@
     "qe-testability-reviewer": ["qe-testability-reviewer"],
     "qe-ui-component-test-engineer": ["qe-ui-component-test-engineer"],
     "qe-visual-regression-engineer": ["qe-visual-regression-engineer"],
+    "repo-learn": ["repo-learn"],
     "runtime-exec": ["runtime-exec"],
     "search": ["codebase-narrator", "search"],
     "smaht": ["discovery", "intent", "propose-skills", "smaht"],

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.32.0"}], "version": "12.32.0"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.32.2"}], "version": "12.32.2"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.32.0",
+  "version": "12.32.2",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), real multi-model second opinions (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": "^0.5.0",
   "wicked_ledger_version": "^0.4.0",

package/CHANGELOG.md

@@ -22,6 +22,23 @@
 - **Site: the wicked-interactive card tells the document-engine story** (recon DT-12) — wicked-interactive moved planes rather than retiring: it is the foundation's document engine (storage, version lineage, HTML/PDF/PPTX/video rendering) that wicked-crew spawns and proxies, not a standalone visual builder. Install command unchanged (two-step marketplace add + install).
 - **Backfilled the 12.30.0 and 12.31.0 changelog entries below** (recon DT-17) — the previous release entry was 12.29.1 while npm shipped 12.31.0; the vault-direct-peer entry that sat under [Unreleased] shipped in 12.31.0 and now lives there.
 
+## [12.32.2] — 2026-09-10
+
+### Fixed
+- **`install.mjs` honours `CLAUDE_CONFIG_DIR` and `--dry-run`; registration is the installer's job (#1117, fixed in #1118).** `cmdInstall()`/`cmdStatus()` hard-coded `~/.claude/plugins/wicked-garden`, so with `CLAUDE_CONFIG_DIR` pointing at a non-default config dir the copy landed in a dir Claude Code never reads, and `--dry-run` (which wicked-installer passes through) was silently treated as an install. The target is now resolved the way wicked-installer's `install-claude.ts` resolves it: `--claude-home <dir>` (repeatable, also `--claude-home=<dir>`) is the full set → `CLAUDE_CONFIG_DIR` (authoritative whenever the key is present; may list several dirs, split on the platform list separator and `,`, `~`-expanded, de-duplicated; present but naming no directory — `""`, `:,`, blanks — fails closed with exit 2 instead of silently landing in `~/.claude`) → `~/.claude` only when the key is absent; the copy lands under `<dir>/plugins/wicked-garden` for EACH resolved dir and `status` reports per dir (config dir + origin, copy version vs package version, leftover transient dirs; an unreadable or corrupt manifest is a named diagnostic and exit 1). **A copy lands stage → verify → atomic swap:** the plugin is copied into a staging dir the run creates (`plugins/.staging-wicked-garden-<pid>-<hex>`, so no pre-existing symlink can ever be written through), the staged tree is lstat-walked (no symlinks; every directory realpath-contained via `path.relative`, case-insensitive on Windows), then rename(2)'d over `plugins/wicked-garden` — a previous copy passes through `plugins/.old-wicked-garden-<pid>-<hex>` and is removed ONLY after the installed tree passed post-swap verification (walk, containment, manifest parse, version == package); if that fails, the failed tree is set aside as `plugins/.failed-wicked-garden-<pid>-<hex>`, the previous copy is renamed back and re-verified, and the run exits 1 naming the failed check — a rollback that itself fails is never swallowed: `ROLLBACK FAILED: previous install left at …, failed install at …` and exit 3 (on any failure before the swap the staging dir is removed and the previous copy is left intact). `plugins/` and `plugins/wicked-garden` are refused when symlinked; manifests are opened `O_NOFOLLOW` (lstat-then-read on Windows); the installed tree is re-walked and re-verified after the swap. Documented residual: a parent directory swapped between our verify and our use (the same discipline as crew's v3.5). The three transient names are not plugins — a leftover after an interrupted install is safe to delete (README + `status` say so). `--dry-run` prints what would be staged/copied and that `uv sync` would run, writes nothing and **spawns nothing** (not even the `command -v uv` probe — proven under a `child_process` spawn-guard preload), exits 0; flags are accepted before or after the command, and `pack` verbs keep their verbatim pass-through. After a copy the script says so honestly — `copied (unregistered)` — and points at `npx wicked-installer install wicked-garden`, because Claude Code loads plugins through its marketplace registry and registration is owned by the installer (wicked-installer#18); the script deliberately does NOT grow a second registration code path. Argument handling is strict: unknown commands, unknown options and stray arguments exit 2 with usage on stderr (`--help`/`-h` print it on stdout); `--claude-home` never swallows an option in either form (`--claude-home --dry-run`, `--claude-home=--dry-run`, `--claude-home=-x`, blank values are usage errors — write `./-x` for a directory whose name starts with `-`); `--dry-run` is an install/update option — `status` is read-only and rejects it, and `--dry-run`/`--claude-home` given with any other command (`--dry-run pack check`, `--version --dry-run`) are a usage error too, never accepted-and-ignored while the command runs for real. A failed `uv sync` is reported (`WARNING` + the uv error on stderr), the summary is a non-success and the exit code is 1 — the copy still lands and setup retries, but the run never claims success. npm `bin`/`prepublishOnly` behaviour is unchanged. Tests: `tests/test_install_mjs.py` drives the real CLI against a temp HOME + temp `CLAUDE_CONFIG_DIR` with PATH reduced to an empty dir (`uv` unreachable unless a failing sentinel is planted; `tests/fixtures/spawn_guard.cjs` proves dry-run spawns nothing; a doctored package copy whose manifest version disagrees with package.json proves a post-swap failure restores the previous copy byte-for-byte, and the test-only `WICKED_GARDEN_INSTALL_FAULT=rollback-restore` proves the ROLLBACK FAILED path; hermetic; never touches the operator's config dirs).
+
+## [12.32.1] — 2026-09-09
+
+### Fixed
+- **Skills: the five dangling `${CLAUDE_PLUGIN_ROOT}` paths and the broken qe evidence-schema link (#1111, fixed in #1113).** wicked-crew's skills publish analyzer (crew#480) resolves every plugin-root and relative reference in the shipped plugin against the would-be snapshot; the five targets parked in `tests/test_skill_dispatch_refs_resolve.py::KNOWN_DANGLING_PATHS` are now fixed at the source and the allowlist is empty (the test fails if any of them dangles again). Imagery `alter`/`create` (+ `alter/refs/editing-reference.md` and the `scripts/{edit,generate}.sh` wrappers) invoke `skills/product/imagery/scripts/provider.py` — the sub-skills kept the pre-move `skills/imagery/` path after imagery moved under `skills/product/` (the wrappers' `PLUGIN_ROOT` fallback also climbed one directory too few); the requirements output-format ref's **Templates** section points at the two skeletons already inline instead of a `templates/` directory cut in v12.21; the user-story guide's "generate template" line (a script that never shipped) points at the inline **Template for New Stories** block; the runtime-exec example is written as the quoted `"path/to/your_script.py"` placeholder it always was (copy-safe, and no longer shaped like a plugin-root path); and `skills/qe/refs/evidence.md` cites `schemas/evidence.json` as shipped in the `wicked-vault` npm package (garden never vendored it, so the relative link had nothing to resolve to). `scripts/ci/validate.py` §6 now reports 0 broken script paths (was 11). Deliberately untouched: the architecture deployment-template links (`skills/engineering/architecture/refs/architecture-template-deployment.md`, they target the user's repo) and the domain vendor README's sibling-checkout prose.
+- **repo-learn: the tier/severity enum tokens are spelled out unmissably** in the skill, so capture workers stop drifting onto values wicked-estate's `proposal.submit` rejects (#1108).
+
+### Added
+- **`wicked-garden-repo-learn`** — churn-led repo-learning skill: churn → hotspots → captured memories + policy proposals (#1107).
+
+### Changed
+- Docs: the architecture-wiki skill pointers route to Steering (`STEERING.md` — #1103); site additive messaging refresh — steering, governed knowledge, requirements graph (#1109); stale doc counts, version stamp and markers corrected (#1110).
+
 ## [12.32.0] — 2026-08-30
 
 ### Added

package/README.md

@@ -61,6 +61,14 @@ claude plugins install wicked-garden
 Or use the family installer — [`npx wicked-installer`](https://www.npmjs.com/package/wicked-installer)
 installs/updates the whole wicked-\* family (garden, its peers, and the rest).
 
+> `npx wicked-garden install` makes a bare, **unregistered** copy under `<config-dir>/plugins/wicked-garden`
+> (honours `CLAUDE_CONFIG_DIR` / `--claude-home`, `--dry-run`); registration is
+> `npx wicked-installer install wicked-garden`. The copy is staged in `plugins/.staging-wicked-garden-<pid>-<hex>`
+> and swapped in atomically; a previous copy passes through `plugins/.old-wicked-garden-<pid>-<hex>` and is removed only
+> after the installed tree verified (a tree that fails verification is set aside as `plugins/.failed-wicked-garden-<pid>-<hex>`
+> and the previous copy is put back). Those transient dirs are **not plugins**; a leftover after an interrupted install is
+> safe to delete (`status` lists them).
+
 Then, in a Claude Code session:
 
 ```bash

package/docs/README.md

@@ -2,16 +2,16 @@
 
 Detailed guides for getting the most out of wicked-garden.
 
-Work in wicked-garden is organized around **9 work-shape archetypes** — not a fixed pipeline. Each prompt classifies into one or more archetypes (triage, explore, specify, decide, ship, review, incident, build, migrate); each owns its own phase shape, produces contract, and HITL discipline.
+Work in wicked-garden is organized around **10 work-shape archetypes** — not a fixed pipeline. Each prompt classifies into one or more archetypes (triage, explore, specify, decide, ship, review, incident, build, migrate, modernize); each owns its own phase shape, produces contract, and HITL discipline.
 
 ## Guides
 
 | Guide | Description |
 |-------|-------------|
 | [Getting Started](getting-started.md) | Installation, required peers, first session, common workflows |
-| [Archetypes](v11/archetypes.md) | The 9 work-shape archetypes — why the universal pipeline went away |
-| [Domains](domains.md) | The 10 domain skills archetypes invoke for expertise |
-| [Required Peers](required-peers.md) | The five required peer plugins and the install/runtime stance |
+| [Archetypes](v11/archetypes.md) | The 10 work-shape archetypes — why the universal pipeline went away |
+| [Domains](domains.md) | The 9 domain skills archetypes invoke for expertise |
+| [Required Peers](required-peers.md) | The one required peer (plus the opt-in layers) and the install/runtime stance |
 | [The Compiler](compiler.md) | `/wicked-garden-prove compile` — emit a self-contained vault-backed gate into any repo |
 | [Extending the Catalog](extending.md) | Ship a third-party pack — `{vendor}-{domain}-{role}` skills, the `wicked-pack.json` manifest, the shipped conformance gate, install + crew routing |
 | [Output Governance (Per-Turn)](outgov-per-turn.md) | The advisory hook lane — `WG_OUTGOV` modes (default `warn`), `rules.recall` as the single per-turn rule source, content-hash provenance for the graph-derived rules dir |

package/docs/brain-chunk-format.md

@@ -9,7 +9,7 @@
 > today, use wicked-garden's `mem` domain (`wicked-garden-mem` `store`/`ingest`)
 > over wicked-estate. Everything below is historical reference only.
 
-This document defines the wicked-brain chunk format so any CLI (Claude Code, Codex, Gemini, Copilot) can write chunks that integrate into the shared knowledge graph.
+This document defines the wicked-brain chunk format so any CLI (Claude Code, Antigravity, Codex, OpenCode, Pi) can write chunks that integrate into the shared knowledge graph.
 
 ## Chunk File Structure
 

package/docs/getting-started.md

@@ -50,7 +50,7 @@ fail-soft (degrades to `🌱 wg │ idle`), and never blocks a render.
 
 ## Your First Session
 
-There is no fixed pipeline. Work is organized around **9 work-shape archetypes** — `triage`, `explore`, `specify`, `decide`, `ship`, `review`, `incident`, `build`, and `migrate`. Each archetype owns its own phase shape, what it produces, and how much human-in-the-loop discipline it demands. After installing, you can invoke any skill immediately. Here are five ways to start:
+There is no fixed pipeline. Work is organized around **10 work-shape archetypes** — `triage`, `explore`, `specify`, `decide`, `ship`, `review`, `incident`, `build`, `migrate`, and `modernize`. Each archetype owns its own phase shape, what it produces, and how much human-in-the-loop discipline it demands. After installing, you can invoke any skill immediately. Here are five ways to start:
 
 ### 1. Just Describe What You Want
 
@@ -73,7 +73,7 @@ When you already know the shape of the work, skip auto-routing and call the arch
 /wicked-garden-archetype decide "Redis vs Postgres for session storage"
 ```
 
-All nine are available: `triage`, `explore`, `specify`, `decide`, `ship`, `review`, `incident`, `build`, `migrate`. Gates re-derive "done" through wicked-loom — which re-runs the verifier via wicked-vault — and fail closed if loom is unavailable; sign-off is evidence-backed, never self-asserted.
+All ten are available: `triage`, `explore`, `specify`, `decide`, `ship`, `review`, `incident`, `build`, `migrate`, `modernize`. Gates re-derive "done" through wicked-loom — which re-runs the verifier via wicked-vault — and fail closed if loom is unavailable; sign-off is evidence-backed, never self-asserted.
 
 ### 3. Use a Domain Skill Directly
 
@@ -201,7 +201,7 @@ Your data is stored locally in `~/.something-wicked/wicked-garden/` as JSON file
 
 ## Next Steps
 
-- [Archetypes](v11/archetypes.md) — the 9 work-shapes: phases, produces, human-in-the-loop (HITL) discipline, cost bands
+- [Archetypes](v11/archetypes.md) — the 10 work-shapes: phases, produces, human-in-the-loop (HITL) discipline, cost bands
 - [Required Peers](required-peers.md) — wicked-vault, wicked-estate, wicked-bus
 - [Compiler](compiler.md) — emit a standalone, vault-backed build gate into any repo
 - [Domains](domains.md) — browse the domain skills and their actions

package/docs/v11/archetypes.md

@@ -64,7 +64,7 @@ The dogfood findings were patches on a foundation that was wrong-shaped.
 
 ## The reframe
 
-Instead of one pipeline + a rigor dial, v11 has **9 archetypes**, each
+Instead of one pipeline + a rigor dial, v11 has **10 archetypes**, each
 with its own:
 
 - **Phase shape** — the actual phase order for that kind of work.
@@ -86,6 +86,7 @@ The archetypes:
 | incident  | triage → investigate → mitigate → resolve → followup    | mitigation / RCA / followup    | hard:mitigate         |
 | build     | plan → implement → test → review                        | shipped code / test report     | discrete:review       |
 | migrate   | plan → expand → backfill → cutover → contract           | shape change / rollback proof  | hard:cutover          |
+| modernize | discover → extract → blueprint → transform → parity → cutover | modernization blueprint / parity proof | hard:cutover-gate |
 
 Each archetype is self-contained. Phase names are NOT shared across
 archetypes — `plan` in `build` is not `plan` in `migrate`. We
@@ -188,12 +189,12 @@ See `CHANGELOG.md` v11.0.0 for the comprehensive list. Headlines:
 
 ## How to extend
 
-Adding a 10th archetype:
+Adding an 11th archetype:
 
 1. Add an entry to `.claude-plugin/archetypes.json`. Declare phases,
    produces, HITL, signals, etc.
 2. Write `skills/archetype/refs/{name}.md` — the playbook for the
-   archetype, ~70-100 lines, following the template of the existing 9.
+   archetype, ~70-100 lines, following the template of the existing 10.
 3. Register the new work-shape in `skills/archetype/SKILL.md` — add it to the
    dispatch table so `/wicked-garden-archetype {name}` loads its playbook. (The
    plugin is skills-only: there is no per-archetype command file; the archetype