wicked-garden 12.32.1 → 12.33.0

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.32.1"}], "version": "12.32.1"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.33.0"}], "version": "12.33.0"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.32.1",
+  "version": "12.33.0",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), real multi-model second opinions (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": "^0.5.0",
   "wicked_ledger_version": "^0.4.0",

package/.gitattributes

@@ -0,0 +1,2 @@
+# Windows command twins must keep CRLF line endings; everything else stays LF.
+*.cmd text eol=crlf

package/AGENTS.md

@@ -11,3 +11,7 @@ memory, storage, and security.
 This file is intentionally a thin pointer so there is exactly one source of truth.
 Other AI coding tools (Codex, Cursor, Aider, OpenCode, Zed/ACP, …) that read `AGENTS.md`:
 follow the link above to `.claude/CLAUDE.md`.
+
+## Cross-CLI skills (portability rule) — mirrored from `.claude/CLAUDE.md`
+
+A skill's text must work wherever it is installed — Claude Code (plugin), Codex, OpenCode, Pi and Antigravity (skills-only, flat by name) and wicked-crew's snapshot. Therefore, under `skills/`: (1) refer to your own files by a path relative to the skill's base directory (`refs/plan.md`), never `${CLAUDE_PLUGIN_ROOT}`, `${CLAUDE_SKILL_DIR}` or `../`; (2) refer to another skill by its **name** (`wicked-garden-qe`, "its `refs/review.md`"), never by a filesystem path — the installer lays skills out flat by name; every `wicked-garden-<x>` token must resolve to a declared skill, and an identifier that merely looks like one (an evaluator id, a sibling plugin) is marked right after the token: `` `wicked-garden-x` <!-- not-a-skill --> `` (token-scoped — a marker elsewhere on the line exempts nothing); (3) run shared runtime code only through the launcher: `wicked-garden run scripts/<path> [args]` (or `wicked-garden path <dir>`, `wicked-garden python -c …`), include the standard `## Runtime` block once (exact text in `tests/portability_rules.garden.json`; the shared rules crew also enforces are the vendored canonical `tests/portability_rules.json`), and give a manual alternative for hosts without it; (4) write harness features with a fallback: "invoke skill X (Skill tool) — otherwise open its SKILL.md and follow it inline", "ask the user (AskUserQuestion where available, else plain text and wait)"; (5) `context: fork` and `allowed-tools` are Claude Code loading hints, fine to keep — say in the body what to do when the harness cannot fork. Hooks (`hooks/`) are Claude-plugin mechanics and keep `${CLAUDE_PLUGIN_ROOT}`. `tests/test_skill_portability.py` fails the build on any violation; run `python3 scripts/wg/portability_codemod.py --dry-run` to see the fix. The launcher lives once in `scripts/wicked-garden.mjs` (twins `scripts/wicked-garden`, `scripts/wicked-garden.cmd`; npm bin `wicked-garden run|python|path|root|doctor`); root order `WICKED_GARDEN_ROOT` → `CLAUDE_PLUGIN_ROOT` → its own package; it never writes under the root.

package/CHANGELOG.md

@@ -2,25 +2,15 @@
 
 ## [Unreleased]
 
+## [12.33.0] — 2026-09-11
+
 ### Added
-- **AW-25 golden path — the wiki pipeline's own evidence-gated proof (recon arch-R21).** The guardrails program now applies its own DoD to itself: a committed, re-runnable acceptance scenario proves seed doc → `wicked-core rules ingest`/`fanout` (isolated stores; enforcement over the crew API, never CLI against a daemon store) → `rules.recall` over the **installed** `wicked-estate-mcp` 0.15.1 returning the rule with its digest-bearing provenance citation → an ISOLATED crew daemon's governed run deterministically tripping the canary trigger (the token rides the run INTENT, so the gate's evaluated context matches with no reliance on the worker model) → the gate denial citing the rule id + wiki URI (`POL-2500`, `wiki://aw25-golden#POL-2500` — via policy criteria AND `conform:` obligations, two independent citation paths) → the ConformanceClaim visible in `GET /runs/:id/acceptance` (deny-dominates, `guardrailed: false`). Ships as `scenarios/qe/aw25-golden-path.md` (scenario-format v1.1, category cli, isolation exclusive), `evidence/aw25-golden/` (seed ruleset with doc↔gate id-twinned `POL-2500`, `run.sh` fail-loud chain script, `campaign-recon.aw25.json` — spec-2 schema-validated plan with a machinery-verified claim ceiling, and the recorded `chain/` evidence 00–07 from a real run), plus `tests/qe/test_aw25_golden_artifacts.py` pinning the artifacts (schema validity, id-twinning, the AC-critical citation assertions in run.sh) hermetically. Evaluator≠creator: the verdict of record is crew's acceptance read, captured verbatim. Findings recorded in the evidence README: the <200-char PHASE SUBSTANCE GATE rejects a too-terse canary BEFORE any claim is recorded (first trip hit exactly this), and the ACP carrier reports `enforcement: enforced` with an empty `armedUnits` list.
-- **Flaky-verdict policy at the campaign acceptance gate (TH-21, ADR 0006 — RECON-TEST-HARNESS test-R23).** One flaky scenario can no longer silently deny OR silently pass a nightly campaign, and exclusions always carry reasons. New written policy `skills/qe/refs/campaign-flake-policy.md` + pure policy engine `scripts/qe/lib/flake-policy.mjs`, applied by `campaign-scoreboard.mjs` on every assembly: (a) **bounded diagnostic re-runs with BOTH verdicts recorded** — a re-run lands as its own runs+verdicts rows under the same stable scenario id (TH-6's flake history, now consumed at the gate via `flake_policy.history`); mixed outcomes are a `flake_signal` blocker naming `wicked-garden-qe-flaky-test-hunter` (never best-of-N), >1+2 runs of one rung is a `rerun_bound_exceeded` violation, and a `--runs` selection showing PASS while omitting a same-window deny-graded sibling is a `pass_laundering_risk` violation; (b) **quarantine lane with owner+deadline via the hunter's taxonomy** — the gate consumes the hunter's ledger `tasks` row fail-closed (`quarantined: true` + scenario binding + taxonomy cause + owner + unexpired `quarantine_expires`; invalid/expired records are reported and NOT honored — the scenario keeps denying); (c) **quarantined scenarios are excluded-with-reason** — rows stay on the scoreboard, the exclusion (id/cause/owner/deadline/reason/observed grades) rides `certification.excluded` + `certification.gate_summary`, and `gate.mjs --exclusions-from <scoreboard.json>` appends the canonical clause to `verdict_summary` so it reaches crew's acceptance payload (the 8-field `wicked.qe.gate.*` wire contract untouched; exclusions missing id/reason/owner/deadline exit 3). A fully-quarantined campaign cannot certify; a quarantined PASS is excluded too; structural violations are never excused. Hunter's SKILL.md §5/§6 now pin the machine contract (body gains required `owner`). Tests: `tests/qe/test_campaign_flake_policy.py` (9 CLI cases, hermetic) + `scripts/qe/runner/test/th21-flake-policy.test.mjs` (14 unit cases).
-- **qe campaign grading through the accept trio (TH-10, ADR 0006).** New `skills/qe/refs/campaign-grading.md` playbook: campaign evidence bundles grade through the SAME role-isolated reviewer as `refs/accept.md` (evidence PATHS only; isolation hard-enforced on Claude Code via host-level `allowed-tools`, advisory on Gemini/Codex/Cursor/Kiro — the boundary is now written down in both refs), with validate-before-grading against wicked-ledger's evidence-manifest 2.1 contract (schema-fail = INCONCLUSIVE; validator unavailable = fail closed). New deterministic glue `scripts/qe/lib/campaign-scoreboard.mjs` assembles the campaign-proven verbatim scoreboard shape `{id, grade, executor_claim, evidence_ok}` and makes self-grading structurally impossible: verdict rows by executor identities (`qe-runner/executor-claim`, `*executor*`, the `test-designer` dev-loop) are refused as grade sources and reported as `self_grade_attempt` violations; `executor_claim` derives from manifest-2.1 `scenario_evidence.status` (the contract's "executor's claim, never the verdict of record" field). Encodes the scenario-defect vs product-finding fork (verdict-reason tag `[scenario-defect]` → bounded re-author/re-run fix lane; `[product-finding]` → GH issue + idempotent ledger `tasks` mirror via `--mirror-tasks`) so certification terminates: `certification.disposition` is always `certified` or `not-certified`, never pending. Reviewer skill gains the campaign-bundle duties (structural floor re-check, claim-vs-evidence posture, mandatory non-PASS classification). Tests: `tests/qe/test_campaign_scoreboard.py` (8 cases, hermetic via a `WICKED_LEDGER_PKG_DIR` stub).
-- **`qe campaign` recon+generation action (TH-7, ADR 0006).** New `campaign` action on the `wicked-garden-qe` router (`skills/qe/refs/campaign.md`): derives a capability inventory from three lenses — the estate code graph when the target repo is indexed, docs recall via `wicked-garden-mem`, and live probing (health endpoints, crew's committed `packages/crew/endpoint-manifest.json`, DOM landmarks) — and emits a dependency-ordered campaign plan CONFORMING to `schemas/campaign-recon.schema.json` v1 (never a parallel format), persisted as a ledger `strategies` row + scenario-format v1 files under `.wicked-qe/campaigns/<name>/`. Assembly/validation glue is `scripts/qe/campaign_plan.py` (stdlib-only, fail-closed): honest `sources.estate: "unindexed"` degradation is DERIVED (an unindexed plan claiming estate-sourced entries is rejected), doc-derived claims are forced `status: "proposed"` pending human review (the incident-to-scenario pending-review pattern), ladder order + rung↔capability binding are enforced beyond the JSON schema, and generated stubs fail until authored (never a silent PASS). Tests: `tests/qe/test_campaign_action.py` validates a generated three-lens plan against the schema itself.
-- **qe dispatch guard (TH-7, guard half of the retired agent-surface cleanup — arch-R25 ≡ test-R20).** `scripts/qe/campaign_dispatch.py`: every qe dispatch resolves its specialist through `resolve_specialist()`, which asserts the resolved worker is a shipped `wicked-garden-qe-*` skill and BLOCKS retired `wicked-testing-*` / `wicked-brain-*` names at dispatch with a clear error naming the garden replacement (exit 2 on the CLI; never a silent rewrite). Wired into `skills/qe/SKILL.md` (fork workers) and `skills/qe/refs/execute.md` (dispatch block).
+- **Cross-CLI skill portability — one catalog that works wherever it is installed (F-079, #1120).** wicked-garden is installed directly into Claude Code, Codex, OpenCode, Pi and Antigravity by third parties (`npx wicked-installer` → a FLAT, skills-only copy laid out by skill NAME, with no `scripts/`, no venv and no plugin root) and snapshotted by wicked-crew for every seat; only Claude Code ever substituted `${CLAUDE_PLUGIN_ROOT}`, so 77 of the 142 skills crew publishes were `portable: false` and every non-Claude seat was denied them. The skill text itself is now cross-CLI — a convention, a launcher and a lint, all in this release. **Convention** (`.claude/CLAUDE.md`, "Cross-CLI skills"): a skill refers to its OWN files by a base-directory-relative path (`refs/plan.md` — every probed CLI announces or resolves the skill's base directory); to ANOTHER skill by **name** (`wicked-garden-qe` + its `refs/review.md`), never by a filesystem path (`../` and `${CLAUDE_PLUGIN_ROOT}/skills/…` both die in the flat layout); to the shared runtime only through the **launcher** — `wicked-garden run scripts/<x>.py [args]`, `wicked-garden path <dir>`, `wicked-garden python -c …` — with one standard `## Runtime` block per script-backed SKILL.md (exact text in `tests/portability_rules.json`) telling the model what to do when the launcher or Python is missing; harness mechanics carry an inline fallback (fork workers: "when your harness cannot fork, run it inline…"; `Skill(skill=…)` dispatch: "on any other harness open the named skill's SKILL.md and carry it out inline"; AskUserQuestion: plain-text-and-wait). **Launcher** — `scripts/wicked-garden.mjs` (node ≥ 20 — the package's `engines` floor — no deps; POSIX twin `scripts/wicked-garden` and Windows twin `scripts/wicked-garden.cmd` for crew's snapshot PATH; the npm bin `wicked-garden` delegates `run|python|path|root|doctor` to it): root order `WICKED_GARDEN_ROOT` (crew seats; REFUSED loudly when it is not a garden root — never falls back to a different garden) → `CLAUDE_PLUGIN_ROOT` → its own package dir; interpreter `.py` → `<root>/.venv` → `uv run --project <root> --frozen --no-dev` with `UV_PROJECT_ENVIRONMENT` under the user cache dir (never under the root; skipped without `uv.lock`, which the npm package now ships) → `python3` → `python` → `py -3`; `.mjs/.js/.cjs` → node, `.sh` → sh; the child keeps the caller's cwd and gets both root variables; every failure is one JSON line naming what was tried. **Lint** — `tests/test_skill_portability.py` fails CI on any `plugin-root` / `skill-dir-var` / `cwd-script` / `relative-link` / `cross-skill-path` / `unresolved-skill-name` / `missing-runtime-preamble` / `slash-form` / missing-fallback token over every text file under `skills/` (nested modules attributed to their own skill, exactly as crew's catalog does), with the rules as data: `tests/portability_rules.json` is wicked-crew's CANONICAL parity fixture vendored byte-for-byte (every regex, the fence walk, option skipping, bundle existence and `../` resolution come from it; its 86 `cases[]` are re-derived here, and `tests/test_portability_fixture_parity.py` pins the vendored bytes + re-computes its `sha256_of_rules`), `tests/portability_rules.garden.json` carries garden's additions (the exact `## Runtime` block, fallback sentences, name resolver, slash-form ban, bare `scripts/x.py <args>` spans), an EMPTY allowlist, and the non-vacuity guard INVERTED: 0 plugin-root refs (was 471 in 103 files), > 200 launcher calls (248 real call sites — the two template mentions inside each `## Runtime` block are not counted), 0 unresolved names. **Codemod** — `scripts/wg/portability_codemod.py --dry-run|--write` (dev tooling, not shipped) performed the rewrite mechanically (585 changes in 166 files, reproducible from `main`; ~20 sites by hand: inline-Python heredocs, the status-line snippet, the imagery shell wrappers, the legacy `crew:*` command table) and reports every rewrite and every unresolvable target. The four skill-local `scripts/` dirs (gh-cli, glab-cli, github-actions, imagery) are stdlib-only and are invoked base-dir-relatively (`python3 scripts/gh_ops.py …`); nested imagery modules reach the parent's `provider.py` through the launcher. `skills/qe/refs/campaign-ci.md` (a template for the TARGET repo's CI) pins `npx wicked-garden@12 run …`. `tests/test_launcher.py` covers root order, the loud refusal, venv preference, uv-outside-the-root (and never creating `<root>/.venv`), cwd, env handoff, twins + executable bit, `doctor`, Windows path building via the exported pure functions and the bin delegation; `tests/test_skill_dispatch_refs_resolve.py` now checks launcher targets exist. **Hooks**: `hooks/scripts/bootstrap.py` additionally exports `WICKED_GARDEN_ROOT` and prepends `<plugin root>/scripts` to the Bash tool's PATH via `CLAUDE_ENV_FILE`, so `wicked-garden run …` resolves to the plugin's own launcher on Claude Code with no npm install (hooks otherwise keep `${CLAUDE_PLUGIN_ROOT}` — they are Claude-plugin mechanics). **Migration for third parties / other CLIs:** on Codex, Pi, OpenCode and Antigravity the skills-only install has no `scripts/`, so `npm i -g wicked-garden` (or `npx wicked-garden`) is the runtime prerequisite for script-backed skills — the launcher resolves the runtime from its own package and reports what it found with `wicked-garden doctor`; prose-only skills need nothing. Under wicked-crew, `WICKED_GARDEN_ROOT=<snapshot>` + `<snapshot>/scripts` on the seat PATH (a wicked-core change in this wave) make the launcher use the snapshot and its synced `.venv`. Crew's publisher becomes a validator that reports per-reason portability (separate PR); after crew refreshes to this garden, all 142 skills are expected to publish `portable: true`.
 
-### Fixed
-- **Re-landed TH-5's campaign-recon schema, clobbered by #1083's stale-base squash.** PR #1083 (TH-4) was squashed from a branch cut before #1082 merged, silently reverting `schemas/campaign-recon.schema.json`, `tests/qe/test_campaign_recon_schema.py`, and the `schemas/README.md` standalone-contract section. Restored byte-for-byte from the #1082 squash commit. (The same squash also reverted #1081's docs/peer-floor work — flagged to its owning lane, not restored here.)
+## [12.32.2] — 2026-09-10
 
-### Changed
-- **`wicked_ledger_version` floor `^0.2.0` → `^0.4.0` (recon XC-4 — the wicked-ledger 2.1 floor-bump wave).** wicked-ledger 0.4.0 ships evidence-manifest **2.1.0** (optional `scenario_evidence` block + first-class `claim_level` enum, `validateManifest` reviewer entry point — TH-5) and new-feature API surface, so the npm minor moved and the old caret (`^0.2.0` excludes 0.3+) had to move with it. Store compat is unchanged in every direction a garden consumer touches: SQLite `schema_version` stays **3** (no new migrations since 0.1.0), and manifest 2.1 is a **minor** — 2.0.0 bundles still validate (covered by the ledger's backward-compat smoke test) and 2.x readers gate on the major. The pin is single-sourced in `plugin.json`; the six qe skill files (`skills/qe/SKILL.md`, `skills/qe/refs/{accept,insight,integration}.md`, `skills/qe-release-readiness-engineer/SKILL.md`, `skills/qe-test-impact-analyzer/SKILL.md`) reference it symbolically and needed no edits — this completes the ledger-pin half DT-13 deferred to XC-4.
-- **Peer-floor and manifest truth pass (recon DT-13).** One consistent vault-floor story: every doc restatement now says **≥ 0.5.0** — the floor `scripts/loom/manifest.py` (`version_pin="0.5"`) and `plugin.json` (`wicked_vault_version ^0.5.0`) have carried since 12.31.0 (checked by the peer registry's health probe: `loom doctor` reports a below-floor vault as `drift` and exits non-zero) — replacing the stale `≥ 0.4.0` (README, CONTRIBUTING, `skills/archetype/refs/{review,incident,migrate,modernize,specify}.md`) and `^0.3.0` (`docs/required-peers.md`) claims. manifest.py + plugin.json are declared the single source; restatements carry a greppable `<!-- vault-floor -->` marker, and `docs/required-peers.md` documents the bump procedure. `skills/core/refs/setup.md` now checks the probed vault version against the floor and tells a below-floor (e.g. 0.4.x) user to upgrade via `npm i -g wicked-vault@latest`.
-- **`docs/required-peers.md` rewritten to the shipped truth.** The vault install command is now the working `npm i -g wicked-vault` form (was `npx wicked-vault-install`, which E404s on a fresh machine — no npm package of that name exists; it's a bin of `wicked-vault`). The loom row no longer presents a required external peer pinned `^0.2.0`: the engine has been absorbed in-package (`scripts/loom/`, dispatched in-process by `scripts/_loom.py`) since 12.27.0. **Decision (recon OQ-4):** the standalone `wicked-loom` npm package (0.4.0, not deprecated) is not a sanctioned install path — the pin is deleted, not bumped; `WICKED_LOOM_BIN` stays a debugging escape hatch.
-- **`.claude-plugin/plugin.json`: deleted the retired `wicked_brain_version` pin** (`^0.18.0` — wicked-brain retired 2026-08, Phase 5-S7; nothing reads the key). The `wicked_ledger_version ^0.2.0` pin is deliberately untouched here — it moves with the coordinated wicked-ledger 2.1 floor-bump wave.
-- **`.claude-plugin/marketplace.json`: retired-layers copy fixed** — "testing/brain/bus are opt-in layers" → estate/bus are the opt-in layers; wicked-testing and wicked-brain are retired (QE ships in-catalog as the `qe` domain; memory lives in wicked-estate).
-- **`docs/brain-chunk-format.md`: retirement banner added** (recon DT-18) — the doc read as live instructions to write chunks into `~/.wicked-brain`, which is a frozen archive that must never be written; the format is preserved as historical reference for the chunks migrated into wicked-estate.
-- **Site: the wicked-interactive card tells the document-engine story** (recon DT-12) — wicked-interactive moved planes rather than retiring: it is the foundation's document engine (storage, version lineage, HTML/PDF/PPTX/video rendering) that wicked-crew spawns and proxies, not a standalone visual builder. Install command unchanged (two-step marketplace add + install).
-- **Backfilled the 12.30.0 and 12.31.0 changelog entries below** (recon DT-17) — the previous release entry was 12.29.1 while npm shipped 12.31.0; the vault-direct-peer entry that sat under [Unreleased] shipped in 12.31.0 and now lives there.
+### Fixed
+- **`install.mjs` honours `CLAUDE_CONFIG_DIR` and `--dry-run`; registration is the installer's job (#1117, fixed in #1118).** `cmdInstall()`/`cmdStatus()` hard-coded `~/.claude/plugins/wicked-garden`, so with `CLAUDE_CONFIG_DIR` pointing at a non-default config dir the copy landed in a dir Claude Code never reads, and `--dry-run` (which wicked-installer passes through) was silently treated as an install. The target is now resolved the way wicked-installer's `install-claude.ts` resolves it: `--claude-home <dir>` (repeatable, also `--claude-home=<dir>`) is the full set → `CLAUDE_CONFIG_DIR` (authoritative whenever the key is present; may list several dirs, split on the platform list separator and `,`, `~`-expanded, de-duplicated; present but naming no directory — `""`, `:,`, blanks — fails closed with exit 2 instead of silently landing in `~/.claude`) → `~/.claude` only when the key is absent; the copy lands under `<dir>/plugins/wicked-garden` for EACH resolved dir and `status` reports per dir (config dir + origin, copy version vs package version, leftover transient dirs; an unreadable or corrupt manifest is a named diagnostic and exit 1). **A copy lands stage → verify → atomic swap:** the plugin is copied into a staging dir the run creates (`plugins/.staging-wicked-garden-<pid>-<hex>`, so no pre-existing symlink can ever be written through), the staged tree is lstat-walked (no symlinks; every directory realpath-contained via `path.relative`, case-insensitive on Windows), then rename(2)'d over `plugins/wicked-garden` — a previous copy passes through `plugins/.old-wicked-garden-<pid>-<hex>` and is removed ONLY after the installed tree passed post-swap verification (walk, containment, manifest parse, version == package); if that fails, the failed tree is set aside as `plugins/.failed-wicked-garden-<pid>-<hex>`, the previous copy is renamed back and re-verified, and the run exits 1 naming the failed check — a rollback that itself fails is never swallowed: `ROLLBACK FAILED: previous install left at …, failed install at …` and exit 3 (on any failure before the swap the staging dir is removed and the previous copy is left intact). `plugins/` and `plugins/wicked-garden` are refused when symlinked; manifests are opened `O_NOFOLLOW` (lstat-then-read on Windows); the installed tree is re-walked and re-verified after the swap. Documented residual: a parent directory swapped between our verify and our use (the same discipline as crew's v3.5). The three transient names are not plugins — a leftover after an interrupted install is safe to delete (README + `status` say so). `--dry-run` prints what would be staged/copied and that `uv sync` would run, writes nothing and **spawns nothing** (not even the `command -v uv` probe — proven under a `child_process` spawn-guard preload), exits 0; flags are accepted before or after the command, and `pack` verbs keep their verbatim pass-through. After a copy the script says so honestly — `copied (unregistered)` — and points at `npx wicked-installer install wicked-garden`, because Claude Code loads plugins through its marketplace registry and registration is owned by the installer (wicked-installer#18); the script deliberately does NOT grow a second registration code path. Argument handling is strict: unknown commands, unknown options and stray arguments exit 2 with usage on stderr (`--help`/`-h` print it on stdout); `--claude-home` never swallows an option in either form (`--claude-home --dry-run`, `--claude-home=--dry-run`, `--claude-home=-x`, blank values are usage errors — write `./-x` for a directory whose name starts with `-`); `--dry-run` is an install/update option — `status` is read-only and rejects it, and `--dry-run`/`--claude-home` given with any other command (`--dry-run pack check`, `--version --dry-run`) are a usage error too, never accepted-and-ignored while the command runs for real. A failed `uv sync` is reported (`WARNING` + the uv error on stderr), the summary is a non-success and the exit code is 1 — the copy still lands and setup retries, but the run never claims success. npm `bin`/`prepublishOnly` behaviour is unchanged. Tests: `tests/test_install_mjs.py` drives the real CLI against a temp HOME + temp `CLAUDE_CONFIG_DIR` with PATH reduced to an empty dir (`uv` unreachable unless a failing sentinel is planted; `tests/fixtures/spawn_guard.cjs` proves dry-run spawns nothing; a doctored package copy whose manifest version disagrees with package.json proves a post-swap failure restores the previous copy byte-for-byte, and the test-only `WICKED_GARDEN_INSTALL_FAULT=rollback-restore` proves the ROLLBACK FAILED path; hermetic; never touches the operator's config dirs).
 
 ## [12.32.1] — 2026-09-09
 
@@ -36,14 +26,32 @@
 
 ## [12.32.0] — 2026-08-30
 
+_The detailed bullets below the three summary bullets were relocated here from `[Unreleased]` in the 12.33.0 cut: each landed before the `v12.32.0` tag and first shipped in it (`git tag --contains` on every landing commit), but the 12.32.0 cut summarised them and left the detail under `[Unreleased]`, where the 12.32.1/12.32.2 hotfix cuts deliberately left it._
+
 ### Added
 - **qe campaign suite complete**: recon+generation w/ dispatch guard, intake propose-as-gate, accept-trio grading, flaky-verdict quarantine, degradation scenarios, campaign rerun+diff, CI recipes (PR subset / governed nightly), vault-backed evidence integrity (content-addressed, redaction-first), AW-25 golden-path evidence chain, dogfood corpus wiring.
 - **Per-turn rules source**: stop.py names `rules.recall` as THE per-turn source; guard_pipeline consumes a graph-derived rules dir with content-hash provenance; `WG_OUTGOV` defaults to advisory `warn`.
 - **Architecture-wiki pointers** in the mem/search/conformance skills (`knowledge.recall {"scope_prefix":"wiki:"}` + estate `rules.recall`).
+- **AW-25 golden path — the wiki pipeline's own evidence-gated proof (recon arch-R21).** The guardrails program now applies its own DoD to itself: a committed, re-runnable acceptance scenario proves seed doc → `wicked-core rules ingest`/`fanout` (isolated stores; enforcement over the crew API, never CLI against a daemon store) → `rules.recall` over the **installed** `wicked-estate-mcp` 0.15.1 returning the rule with its digest-bearing provenance citation → an ISOLATED crew daemon's governed run deterministically tripping the canary trigger (the token rides the run INTENT, so the gate's evaluated context matches with no reliance on the worker model) → the gate denial citing the rule id + wiki URI (`POL-2500`, `wiki://aw25-golden#POL-2500` — via policy criteria AND `conform:` obligations, two independent citation paths) → the ConformanceClaim visible in `GET /runs/:id/acceptance` (deny-dominates, `guardrailed: false`). Ships as `scenarios/qe/aw25-golden-path.md` (scenario-format v1.1, category cli, isolation exclusive), `evidence/aw25-golden/` (seed ruleset with doc↔gate id-twinned `POL-2500`, `run.sh` fail-loud chain script, `campaign-recon.aw25.json` — spec-2 schema-validated plan with a machinery-verified claim ceiling, and the recorded `chain/` evidence 00–07 from a real run), plus `tests/qe/test_aw25_golden_artifacts.py` pinning the artifacts (schema validity, id-twinning, the AC-critical citation assertions in run.sh) hermetically. Evaluator≠creator: the verdict of record is crew's acceptance read, captured verbatim. Findings recorded in the evidence README: the <200-char PHASE SUBSTANCE GATE rejects a too-terse canary BEFORE any claim is recorded (first trip hit exactly this), and the ACP carrier reports `enforcement: enforced` with an empty `armedUnits` list.
+- **Flaky-verdict policy at the campaign acceptance gate (TH-21, ADR 0006 — RECON-TEST-HARNESS test-R23).** One flaky scenario can no longer silently deny OR silently pass a nightly campaign, and exclusions always carry reasons. New written policy `skills/qe/refs/campaign-flake-policy.md` + pure policy engine `scripts/qe/lib/flake-policy.mjs`, applied by `campaign-scoreboard.mjs` on every assembly: (a) **bounded diagnostic re-runs with BOTH verdicts recorded** — a re-run lands as its own runs+verdicts rows under the same stable scenario id (TH-6's flake history, now consumed at the gate via `flake_policy.history`); mixed outcomes are a `flake_signal` blocker naming `wicked-garden-qe-flaky-test-hunter` (never best-of-N), >1+2 runs of one rung is a `rerun_bound_exceeded` violation, and a `--runs` selection showing PASS while omitting a same-window deny-graded sibling is a `pass_laundering_risk` violation; (b) **quarantine lane with owner+deadline via the hunter's taxonomy** — the gate consumes the hunter's ledger `tasks` row fail-closed (`quarantined: true` + scenario binding + taxonomy cause + owner + unexpired `quarantine_expires`; invalid/expired records are reported and NOT honored — the scenario keeps denying); (c) **quarantined scenarios are excluded-with-reason** — rows stay on the scoreboard, the exclusion (id/cause/owner/deadline/reason/observed grades) rides `certification.excluded` + `certification.gate_summary`, and `gate.mjs --exclusions-from <scoreboard.json>` appends the canonical clause to `verdict_summary` so it reaches crew's acceptance payload (the 8-field `wicked.qe.gate.*` wire contract untouched; exclusions missing id/reason/owner/deadline exit 3). A fully-quarantined campaign cannot certify; a quarantined PASS is excluded too; structural violations are never excused. Hunter's SKILL.md §5/§6 now pin the machine contract (body gains required `owner`). Tests: `tests/qe/test_campaign_flake_policy.py` (9 CLI cases, hermetic) + `scripts/qe/runner/test/th21-flake-policy.test.mjs` (14 unit cases).
+- **qe campaign grading through the accept trio (TH-10, ADR 0006).** New `skills/qe/refs/campaign-grading.md` playbook: campaign evidence bundles grade through the SAME role-isolated reviewer as `refs/accept.md` (evidence PATHS only; isolation hard-enforced on Claude Code via host-level `allowed-tools`, advisory on Gemini/Codex/Cursor/Kiro — the boundary is now written down in both refs), with validate-before-grading against wicked-ledger's evidence-manifest 2.1 contract (schema-fail = INCONCLUSIVE; validator unavailable = fail closed). New deterministic glue `scripts/qe/lib/campaign-scoreboard.mjs` assembles the campaign-proven verbatim scoreboard shape `{id, grade, executor_claim, evidence_ok}` and makes self-grading structurally impossible: verdict rows by executor identities (`qe-runner/executor-claim`, `*executor*`, the `test-designer` dev-loop) are refused as grade sources and reported as `self_grade_attempt` violations; `executor_claim` derives from manifest-2.1 `scenario_evidence.status` (the contract's "executor's claim, never the verdict of record" field). Encodes the scenario-defect vs product-finding fork (verdict-reason tag `[scenario-defect]` → bounded re-author/re-run fix lane; `[product-finding]` → GH issue + idempotent ledger `tasks` mirror via `--mirror-tasks`) so certification terminates: `certification.disposition` is always `certified` or `not-certified`, never pending. Reviewer skill gains the campaign-bundle duties (structural floor re-check, claim-vs-evidence posture, mandatory non-PASS classification). Tests: `tests/qe/test_campaign_scoreboard.py` (8 cases, hermetic via a `WICKED_LEDGER_PKG_DIR` stub).
+- **`qe campaign` recon+generation action (TH-7, ADR 0006).** New `campaign` action on the `wicked-garden-qe` router (`skills/qe/refs/campaign.md`): derives a capability inventory from three lenses — the estate code graph when the target repo is indexed, docs recall via `wicked-garden-mem`, and live probing (health endpoints, crew's committed `packages/crew/endpoint-manifest.json`, DOM landmarks) — and emits a dependency-ordered campaign plan CONFORMING to `schemas/campaign-recon.schema.json` v1 (never a parallel format), persisted as a ledger `strategies` row + scenario-format v1 files under `.wicked-qe/campaigns/<name>/`. Assembly/validation glue is `scripts/qe/campaign_plan.py` (stdlib-only, fail-closed): honest `sources.estate: "unindexed"` degradation is DERIVED (an unindexed plan claiming estate-sourced entries is rejected), doc-derived claims are forced `status: "proposed"` pending human review (the incident-to-scenario pending-review pattern), ladder order + rung↔capability binding are enforced beyond the JSON schema, and generated stubs fail until authored (never a silent PASS). Tests: `tests/qe/test_campaign_action.py` validates a generated three-lens plan against the schema itself.
+- **qe dispatch guard (TH-7, guard half of the retired agent-surface cleanup — arch-R25 ≡ test-R20).** `scripts/qe/campaign_dispatch.py`: every qe dispatch resolves its specialist through `resolve_specialist()`, which asserts the resolved worker is a shipped `wicked-garden-qe-*` skill and BLOCKS retired `wicked-testing-*` / `wicked-brain-*` names at dispatch with a clear error naming the garden replacement (exit 2 on the CLI; never a silent rewrite). Wired into `skills/qe/SKILL.md` (fork workers) and `skills/qe/refs/execute.md` (dispatch block).
+
+### Fixed
+- **Re-landed TH-5's campaign-recon schema, clobbered by #1083's stale-base squash.** PR #1083 (TH-4) was squashed from a branch cut before #1082 merged, silently reverting `schemas/campaign-recon.schema.json`, `tests/qe/test_campaign_recon_schema.py`, and the `schemas/README.md` standalone-contract section. Restored byte-for-byte from the #1082 squash commit. (The same squash also reverted #1081's docs/peer-floor work — flagged to its owning lane, not restored here.)
 
 ### Changed
 - Site version stamp injected at build from the plugin manifest (DT-7 — can never re-stale).
 - campaign-recon schema v2: `desktop` category tiers + `isolation` annotation in one bump.
+- **`wicked_ledger_version` floor `^0.2.0` → `^0.4.0` (recon XC-4 — the wicked-ledger 2.1 floor-bump wave).** wicked-ledger 0.4.0 ships evidence-manifest **2.1.0** (optional `scenario_evidence` block + first-class `claim_level` enum, `validateManifest` reviewer entry point — TH-5) and new-feature API surface, so the npm minor moved and the old caret (`^0.2.0` excludes 0.3+) had to move with it. Store compat is unchanged in every direction a garden consumer touches: SQLite `schema_version` stays **3** (no new migrations since 0.1.0), and manifest 2.1 is a **minor** — 2.0.0 bundles still validate (covered by the ledger's backward-compat smoke test) and 2.x readers gate on the major. The pin is single-sourced in `plugin.json`; the six qe skill files (`skills/qe/SKILL.md`, `skills/qe/refs/{accept,insight,integration}.md`, `skills/qe-release-readiness-engineer/SKILL.md`, `skills/qe-test-impact-analyzer/SKILL.md`) reference it symbolically and needed no edits — this completes the ledger-pin half DT-13 deferred to XC-4.
+- **Peer-floor and manifest truth pass (recon DT-13).** One consistent vault-floor story: every doc restatement now says **≥ 0.5.0** — the floor `scripts/loom/manifest.py` (`version_pin="0.5"`) and `plugin.json` (`wicked_vault_version ^0.5.0`) have carried since 12.31.0 (checked by the peer registry's health probe: `loom doctor` reports a below-floor vault as `drift` and exits non-zero) — replacing the stale `≥ 0.4.0` (README, CONTRIBUTING, `skills/archetype/refs/{review,incident,migrate,modernize,specify}.md`) and `^0.3.0` (`docs/required-peers.md`) claims. manifest.py + plugin.json are declared the single source; restatements carry a greppable `<!-- vault-floor -->` marker, and `docs/required-peers.md` documents the bump procedure. `skills/core/refs/setup.md` now checks the probed vault version against the floor and tells a below-floor (e.g. 0.4.x) user to upgrade via `npm i -g wicked-vault@latest`.
+- **`docs/required-peers.md` rewritten to the shipped truth.** The vault install command is now the working `npm i -g wicked-vault` form (was `npx wicked-vault-install`, which E404s on a fresh machine — no npm package of that name exists; it's a bin of `wicked-vault`). The loom row no longer presents a required external peer pinned `^0.2.0`: the engine has been absorbed in-package (`scripts/loom/`, dispatched in-process by `scripts/_loom.py`) since 12.27.0. **Decision (recon OQ-4):** the standalone `wicked-loom` npm package (0.4.0, not deprecated) is not a sanctioned install path — the pin is deleted, not bumped; `WICKED_LOOM_BIN` stays a debugging escape hatch.
+- **`.claude-plugin/plugin.json`: deleted the retired `wicked_brain_version` pin** (`^0.18.0` — wicked-brain retired 2026-08, Phase 5-S7; nothing reads the key). The `wicked_ledger_version ^0.2.0` pin is deliberately untouched here — it moves with the coordinated wicked-ledger 2.1 floor-bump wave.
+- **`.claude-plugin/marketplace.json`: retired-layers copy fixed** — "testing/brain/bus are opt-in layers" → estate/bus are the opt-in layers; wicked-testing and wicked-brain are retired (QE ships in-catalog as the `qe` domain; memory lives in wicked-estate).
+- **`docs/brain-chunk-format.md`: retirement banner added** (recon DT-18) — the doc read as live instructions to write chunks into `~/.wicked-brain`, which is a frozen archive that must never be written; the format is preserved as historical reference for the chunks migrated into wicked-estate.
+- **Site: the wicked-interactive card tells the document-engine story** (recon DT-12) — wicked-interactive moved planes rather than retiring: it is the foundation's document engine (storage, version lineage, HTML/PDF/PPTX/video rendering) that wicked-crew spawns and proxies, not a standalone visual builder. Install command unchanged (two-step marketplace add + install).
+- **Backfilled the 12.30.0 and 12.31.0 changelog entries below** (recon DT-17) — the previous release entry was 12.29.1 while npm shipped 12.31.0; the vault-direct-peer entry that sat under [Unreleased] shipped in 12.31.0 and now lives there.
 
 ## [12.31.0] — 2026-08-25
 

package/README.md

@@ -61,6 +61,22 @@ claude plugins install wicked-garden
 Or use the family installer — [`npx wicked-installer`](https://www.npmjs.com/package/wicked-installer)
 installs/updates the whole wicked-\* family (garden, its peers, and the rest).
 
+> `npx wicked-garden install` makes a bare, **unregistered** copy under `<config-dir>/plugins/wicked-garden`
+> (honours `CLAUDE_CONFIG_DIR` / `--claude-home`, `--dry-run`); registration is
+> `npx wicked-installer install wicked-garden`. The copy is staged in `plugins/.staging-wicked-garden-<pid>-<hex>`
+> and swapped in atomically; a previous copy passes through `plugins/.old-wicked-garden-<pid>-<hex>` and is removed only
+> after the installed tree verified (a tree that fails verification is set aside as `plugins/.failed-wicked-garden-<pid>-<hex>`
+> and the previous copy is put back). Those transient dirs are **not plugins**; a leftover after an interrupted install is
+> safe to delete (`status` lists them).
+
+**Other CLIs (Codex, OpenCode, Pi, Antigravity)** — `npx wicked-installer install-<cli> wicked-garden` copies
+the skills only (flat, by name — no `scripts/`, no venv). Every skill's text works there as written: own files are
+referenced relative to the skill's directory, other skills by name, and the shared runtime only through the
+launcher — `wicked-garden run scripts/<x>.py …`. So for script-backed skills the runtime prerequisite on those
+CLIs is `npm i -g wicked-garden` (or `npx wicked-garden`); the launcher resolves the plugin root and the Python
+interpreter itself (`wicked-garden doctor` shows what it found) and never writes under the root. Prose-only
+skills need nothing. Under wicked-crew the same launcher points at the run's snapshot via `WICKED_GARDEN_ROOT`.
+
 Then, in a Claude Code session:
 
 ```bash

package/hooks/scripts/bootstrap.py

@@ -1201,12 +1201,23 @@ def main():
     # Export CLAUDE_PLUGIN_ROOT to CLAUDE_ENV_FILE so Bash tool calls can access it.
     # Hooks receive CLAUDE_PLUGIN_ROOT from the plugin runtime, but Bash tool calls
     # do not inherit it.  Writing to CLAUDE_ENV_FILE bridges the gap.
+    # Since 12.33 (cross-CLI skills, F-079) skill text reaches scripts/ only through
+    # the `wicked-garden` launcher, so the same bridge puts <root>/scripts on PATH
+    # (the launcher twin lives there — no npm install needed on Claude Code) and
+    # exports WICKED_GARDEN_ROOT, the launcher's first root candidate.
     env_file = os.environ.get("CLAUDE_ENV_FILE")
     plugin_root = os.environ.get("CLAUDE_PLUGIN_ROOT")
     if env_file and plugin_root:
         try:
             with open(env_file, "a") as f:
                 f.write(f'export CLAUDE_PLUGIN_ROOT="{plugin_root}"\n')
+                f.write(f'export WICKED_GARDEN_ROOT="{plugin_root}"\n')
+                # idempotent: SessionStart also fires on reconnects, and the env file is
+                # appended to — never let PATH grow one entry per fire
+                f.write(
+                    f'case ":$PATH:" in *":{plugin_root}/scripts:"*) ;; '
+                    f'*) export PATH="{plugin_root}/scripts:$PATH" ;; esac\n'
+                )
         except OSError:
             pass