wicked-garden 12.32.2 → 12.34.0

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.32.2"}], "version": "12.32.2"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.34.0"}], "version": "12.34.0"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.32.2",
+  "version": "12.34.0",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), real multi-model second opinions (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": "^0.5.0",
   "wicked_ledger_version": "^0.4.0",

package/.gitattributes

@@ -0,0 +1,2 @@
+# Windows command twins must keep CRLF line endings; everything else stays LF.
+*.cmd text eol=crlf

package/AGENTS.md

@@ -11,3 +11,7 @@ memory, storage, and security.
 This file is intentionally a thin pointer so there is exactly one source of truth.
 Other AI coding tools (Codex, Cursor, Aider, OpenCode, Zed/ACP, …) that read `AGENTS.md`:
 follow the link above to `.claude/CLAUDE.md`.
+
+## Cross-CLI skills (portability rule) — mirrored from `.claude/CLAUDE.md`
+
+A skill's text must work wherever it is installed — Claude Code (plugin), Codex, OpenCode, Pi and Antigravity (skills-only, flat by name) and wicked-crew's snapshot. Therefore, under `skills/`: (1) refer to your own files by a path relative to the skill's base directory (`refs/plan.md`), never `${CLAUDE_PLUGIN_ROOT}`, `${CLAUDE_SKILL_DIR}` or `../`; (2) refer to another skill by its **name** (`wicked-garden-qe`, "its `refs/review.md`"), never by a filesystem path — the installer lays skills out flat by name; every `wicked-garden-<x>` token must resolve to a declared skill, and an identifier that merely looks like one (an evaluator id, a sibling plugin) is marked right after the token: `` `wicked-garden-x` <!-- not-a-skill --> `` (token-scoped — a marker elsewhere on the line exempts nothing); (3) run shared runtime code only through the launcher: `wicked-garden run scripts/<path> [args]` (or `wicked-garden path <dir>`, `wicked-garden python -c …`), include the standard `## Runtime` block once (exact text in `tests/portability_rules.garden.json`; the shared rules crew also enforces are the vendored canonical `tests/portability_rules.json`), and give a manual alternative for hosts without it; (4) write harness features with a fallback: "invoke skill X (Skill tool) — otherwise open its SKILL.md and follow it inline", "ask the user (AskUserQuestion where available, else plain text and wait)"; (5) `context: fork` and `allowed-tools` are Claude Code loading hints, fine to keep — say in the body what to do when the harness cannot fork. Hooks (`hooks/`) are Claude-plugin mechanics and keep `${CLAUDE_PLUGIN_ROOT}`. `tests/test_skill_portability.py` fails the build on any violation; run `python3 scripts/wg/portability_codemod.py --dry-run` to see the fix. The launcher lives once in `scripts/wicked-garden.mjs` (twins `scripts/wicked-garden`, `scripts/wicked-garden.cmd`; npm bin `wicked-garden run|python|path|root|doctor`); root order `WICKED_GARDEN_ROOT` → `CLAUDE_PLUGIN_ROOT` → its own package; it never writes under the root.

package/CHANGELOG.md

@@ -2,25 +2,19 @@
 
 ## [Unreleased]
 
-### Added
-- **AW-25 golden path — the wiki pipeline's own evidence-gated proof (recon arch-R21).** The guardrails program now applies its own DoD to itself: a committed, re-runnable acceptance scenario proves seed doc → `wicked-core rules ingest`/`fanout` (isolated stores; enforcement over the crew API, never CLI against a daemon store) → `rules.recall` over the **installed** `wicked-estate-mcp` 0.15.1 returning the rule with its digest-bearing provenance citation → an ISOLATED crew daemon's governed run deterministically tripping the canary trigger (the token rides the run INTENT, so the gate's evaluated context matches with no reliance on the worker model) → the gate denial citing the rule id + wiki URI (`POL-2500`, `wiki://aw25-golden#POL-2500` — via policy criteria AND `conform:` obligations, two independent citation paths) → the ConformanceClaim visible in `GET /runs/:id/acceptance` (deny-dominates, `guardrailed: false`). Ships as `scenarios/qe/aw25-golden-path.md` (scenario-format v1.1, category cli, isolation exclusive), `evidence/aw25-golden/` (seed ruleset with doc↔gate id-twinned `POL-2500`, `run.sh` fail-loud chain script, `campaign-recon.aw25.json` — spec-2 schema-validated plan with a machinery-verified claim ceiling, and the recorded `chain/` evidence 00–07 from a real run), plus `tests/qe/test_aw25_golden_artifacts.py` pinning the artifacts (schema validity, id-twinning, the AC-critical citation assertions in run.sh) hermetically. Evaluator≠creator: the verdict of record is crew's acceptance read, captured verbatim. Findings recorded in the evidence README: the <200-char PHASE SUBSTANCE GATE rejects a too-terse canary BEFORE any claim is recorded (first trip hit exactly this), and the ACP carrier reports `enforcement: enforced` with an empty `armedUnits` list.
-- **Flaky-verdict policy at the campaign acceptance gate (TH-21, ADR 0006 — RECON-TEST-HARNESS test-R23).** One flaky scenario can no longer silently deny OR silently pass a nightly campaign, and exclusions always carry reasons. New written policy `skills/qe/refs/campaign-flake-policy.md` + pure policy engine `scripts/qe/lib/flake-policy.mjs`, applied by `campaign-scoreboard.mjs` on every assembly: (a) **bounded diagnostic re-runs with BOTH verdicts recorded** — a re-run lands as its own runs+verdicts rows under the same stable scenario id (TH-6's flake history, now consumed at the gate via `flake_policy.history`); mixed outcomes are a `flake_signal` blocker naming `wicked-garden-qe-flaky-test-hunter` (never best-of-N), >1+2 runs of one rung is a `rerun_bound_exceeded` violation, and a `--runs` selection showing PASS while omitting a same-window deny-graded sibling is a `pass_laundering_risk` violation; (b) **quarantine lane with owner+deadline via the hunter's taxonomy** — the gate consumes the hunter's ledger `tasks` row fail-closed (`quarantined: true` + scenario binding + taxonomy cause + owner + unexpired `quarantine_expires`; invalid/expired records are reported and NOT honored — the scenario keeps denying); (c) **quarantined scenarios are excluded-with-reason** — rows stay on the scoreboard, the exclusion (id/cause/owner/deadline/reason/observed grades) rides `certification.excluded` + `certification.gate_summary`, and `gate.mjs --exclusions-from <scoreboard.json>` appends the canonical clause to `verdict_summary` so it reaches crew's acceptance payload (the 8-field `wicked.qe.gate.*` wire contract untouched; exclusions missing id/reason/owner/deadline exit 3). A fully-quarantined campaign cannot certify; a quarantined PASS is excluded too; structural violations are never excused. Hunter's SKILL.md §5/§6 now pin the machine contract (body gains required `owner`). Tests: `tests/qe/test_campaign_flake_policy.py` (9 CLI cases, hermetic) + `scripts/qe/runner/test/th21-flake-policy.test.mjs` (14 unit cases).
-- **qe campaign grading through the accept trio (TH-10, ADR 0006).** New `skills/qe/refs/campaign-grading.md` playbook: campaign evidence bundles grade through the SAME role-isolated reviewer as `refs/accept.md` (evidence PATHS only; isolation hard-enforced on Claude Code via host-level `allowed-tools`, advisory on Gemini/Codex/Cursor/Kiro — the boundary is now written down in both refs), with validate-before-grading against wicked-ledger's evidence-manifest 2.1 contract (schema-fail = INCONCLUSIVE; validator unavailable = fail closed). New deterministic glue `scripts/qe/lib/campaign-scoreboard.mjs` assembles the campaign-proven verbatim scoreboard shape `{id, grade, executor_claim, evidence_ok}` and makes self-grading structurally impossible: verdict rows by executor identities (`qe-runner/executor-claim`, `*executor*`, the `test-designer` dev-loop) are refused as grade sources and reported as `self_grade_attempt` violations; `executor_claim` derives from manifest-2.1 `scenario_evidence.status` (the contract's "executor's claim, never the verdict of record" field). Encodes the scenario-defect vs product-finding fork (verdict-reason tag `[scenario-defect]` → bounded re-author/re-run fix lane; `[product-finding]` → GH issue + idempotent ledger `tasks` mirror via `--mirror-tasks`) so certification terminates: `certification.disposition` is always `certified` or `not-certified`, never pending. Reviewer skill gains the campaign-bundle duties (structural floor re-check, claim-vs-evidence posture, mandatory non-PASS classification). Tests: `tests/qe/test_campaign_scoreboard.py` (8 cases, hermetic via a `WICKED_LEDGER_PKG_DIR` stub).
-- **`qe campaign` recon+generation action (TH-7, ADR 0006).** New `campaign` action on the `wicked-garden-qe` router (`skills/qe/refs/campaign.md`): derives a capability inventory from three lenses — the estate code graph when the target repo is indexed, docs recall via `wicked-garden-mem`, and live probing (health endpoints, crew's committed `packages/crew/endpoint-manifest.json`, DOM landmarks) — and emits a dependency-ordered campaign plan CONFORMING to `schemas/campaign-recon.schema.json` v1 (never a parallel format), persisted as a ledger `strategies` row + scenario-format v1 files under `.wicked-qe/campaigns/<name>/`. Assembly/validation glue is `scripts/qe/campaign_plan.py` (stdlib-only, fail-closed): honest `sources.estate: "unindexed"` degradation is DERIVED (an unindexed plan claiming estate-sourced entries is rejected), doc-derived claims are forced `status: "proposed"` pending human review (the incident-to-scenario pending-review pattern), ladder order + rung↔capability binding are enforced beyond the JSON schema, and generated stubs fail until authored (never a silent PASS). Tests: `tests/qe/test_campaign_action.py` validates a generated three-lens plan against the schema itself.
-- **qe dispatch guard (TH-7, guard half of the retired agent-surface cleanup — arch-R25 ≡ test-R20).** `scripts/qe/campaign_dispatch.py`: every qe dispatch resolves its specialist through `resolve_specialist()`, which asserts the resolved worker is a shipped `wicked-garden-qe-*` skill and BLOCKS retired `wicked-testing-*` / `wicked-brain-*` names at dispatch with a clear error naming the garden replacement (exit 2 on the CLI; never a silent rewrite). Wired into `skills/qe/SKILL.md` (fork workers) and `skills/qe/refs/execute.md` (dispatch block).
+## [12.34.0] — 2026-09-11
+
+### Changed
+- **qe `author` / `review`: run what you claim, cite what you cover, deliver through the run (wave 6 — R4-r2, F-7R2-015/016).** The wave-6 acceptance review of a governed "New test" run found the worker had shipped a Playwright suite it never executed (it failed on its first check when run independently — 0 of 12 assertions reached), sold 22 pre-existing tests as a "29-scenario suite" without a single `file:line`, described wait-gating it had not written, and opened the PR itself with `gh pr create` from its shell — while seven default-allow gates passed it. The `wicked-garden-qe` router's `author` and `review` actions now carry the contract that makes that impossible to do honestly. **author** (`skills/qe/refs/author.md` § Verified-test contract, copied into every code-producing dispatch's args — a fork worker sees only its args): detect the repo's harness first (`package.json` scripts, `vitest`/`jest`/`playwright` configs, `pyproject.toml` pytest, an existing `e2e/` rig) and name the exact command; write BEHAVIOUR tests (observable outcome, never a mock asserting on a mock; know the source change that would fail each test); RUN every produced file with the harness's real command before claiming it and record file · exact command · result in the PLAN's execution table — a test not executed is `unverified`, never `covered`, never "passes"; claim pre-existing coverage only with `path:line` and report new vs pre-existing counts separately; label fixture-bound e2e `needs-fixture` with how to start it and run it against that fixture (selectors/test ids/text verified against the source); carry `not covered` rows for every intent gap; and NEVER `git push` / `gh pr create` / `gh pr merge` — the run's deliver phase opens the PR (standalone, the human does). The PLAN's status vocabulary is closed: `covered` · `unverified` · `needs-fixture` · `failing` · `not covered`. **review** (`skills/qe/refs/review.md` § Reviewing produced tests, dispatched to `wicked-garden-qe-test-code-quality-auditor` §9, which grades in a dedicated produced-test mode where `PASS` is reachable — every claim verified at `path:line`, every produced test executed and green, no `unverified`; P1/P2-only → `CONDITIONAL`; any P0 → `FAIL` — with a guarded source-mutation restore that never `git checkout`s over the author's uncommitted edit): open every `covered` claim at its `file:line` and reclassify unsupported ones; require an execution record for every produced file and FAIL the plan (`[unexecuted-test]`) when one is missing or a `needs-fixture` e2e was never run against its fixture; mutate-or-reason about at least two tested behaviours (apply a source mutation, confirm the test fails, restore — or name the mutation and the catching assertion when the harness cannot run); flag implementation-shaped tests; check every e2e oracle against the source on the visited route; check scope honesty; and never open, edit, merge or push the PR — the verdict goes back to the run. The same rules land in the workers the dispatches reach: `wicked-garden-qe-test-automation-engineer` ("Run what you write"), `wicked-garden-qe-e2e-orchestrator` (fixture named + started, oracles checked against the source, wait for the state you assert), `wicked-garden-qe-ui-component-test-engineer`, and — as one shared run-before-claim / cite / never-ship block pointing at the contract by skill name — the ten code-producing Tier-2 specialists (`test-data-manager`, `contract-testing-engineer`, `integration-test-engineer`, `visual-regression-engineer`, `a11y-test-engineer`, `load-performance-engineer`, `fuzz-property-engineer`, `localization-test-engineer`, `observability-test-engineer`, `data-quality-tester`), so a direct invocation on the flat Codex/Pi/OpenCode layout is bound the same way as a router dispatch. Cross-CLI wording throughout (the 12.33 portability convention — no CLI-specific delivery mechanics; "the run's deliver phase opens the PR"); `tests/test_skill_portability.py` stays at 0 violations and the router stays at the 200-line cap.
 
 ### Fixed
-- **Re-landed TH-5's campaign-recon schema, clobbered by #1083's stale-base squash.** PR #1083 (TH-4) was squashed from a branch cut before #1082 merged, silently reverting `schemas/campaign-recon.schema.json`, `tests/qe/test_campaign_recon_schema.py`, and the `schemas/README.md` standalone-contract section. Restored byte-for-byte from the #1082 squash commit. (The same squash also reverted #1081's docs/peer-floor work — flagged to its owning lane, not restored here.)
+- **Domain schema bundle re-vendored at `1.2.0`.** `skills/domain/vendor/VERSION` was still `1.1.0` while the live owner (wicked-core `crates/wicked-governance/schemas/`) had moved to `1.2.0` with the STEERING unification's optional fields on `conformance-rules.schema.json`, so `tests/domain/test_schema_vendor_pin.py::test_vendored_bundle_version_matches_owner_when_present` failed whenever a sibling `wicked-core` checkout was present (CI, with no sibling, skipped it). Re-vendored from wicked-core `main` @ `e421e87` per the vendor README's procedure: `domain-model.schema.json` is confirmed byte-identical to the owner copy (same git blob), only `VERSION` and the README's bundle-history prose moved; the document contract stays `domain-model@1.0.0`.
+- **`pyproject.toml` `version` documented as not a release anchor.** It had sat at `1.33.0` since the plugin was 1.x; the release train (`release.yml` → `npm version` → `.github/scripts/sync-plugin-version.mjs`) bumps package.json + `.claude-plugin/{plugin,marketplace}.json` only, this Python project is never built or published, and nothing reads the field — so instead of inventing a fourth anchor it is pinned to the `0.0.0` placeholder with the convention written above it (mirrored in `uv.lock`).
 
-### Changed
-- **`wicked_ledger_version` floor `^0.2.0` → `^0.4.0` (recon XC-4 — the wicked-ledger 2.1 floor-bump wave).** wicked-ledger 0.4.0 ships evidence-manifest **2.1.0** (optional `scenario_evidence` block + first-class `claim_level` enum, `validateManifest` reviewer entry point — TH-5) and new-feature API surface, so the npm minor moved and the old caret (`^0.2.0` excludes 0.3+) had to move with it. Store compat is unchanged in every direction a garden consumer touches: SQLite `schema_version` stays **3** (no new migrations since 0.1.0), and manifest 2.1 is a **minor** — 2.0.0 bundles still validate (covered by the ledger's backward-compat smoke test) and 2.x readers gate on the major. The pin is single-sourced in `plugin.json`; the six qe skill files (`skills/qe/SKILL.md`, `skills/qe/refs/{accept,insight,integration}.md`, `skills/qe-release-readiness-engineer/SKILL.md`, `skills/qe-test-impact-analyzer/SKILL.md`) reference it symbolically and needed no edits — this completes the ledger-pin half DT-13 deferred to XC-4.
-- **Peer-floor and manifest truth pass (recon DT-13).** One consistent vault-floor story: every doc restatement now says **≥ 0.5.0** — the floor `scripts/loom/manifest.py` (`version_pin="0.5"`) and `plugin.json` (`wicked_vault_version ^0.5.0`) have carried since 12.31.0 (checked by the peer registry's health probe: `loom doctor` reports a below-floor vault as `drift` and exits non-zero) — replacing the stale `≥ 0.4.0` (README, CONTRIBUTING, `skills/archetype/refs/{review,incident,migrate,modernize,specify}.md`) and `^0.3.0` (`docs/required-peers.md`) claims. manifest.py + plugin.json are declared the single source; restatements carry a greppable `<!-- vault-floor -->` marker, and `docs/required-peers.md` documents the bump procedure. `skills/core/refs/setup.md` now checks the probed vault version against the floor and tells a below-floor (e.g. 0.4.x) user to upgrade via `npm i -g wicked-vault@latest`.
-- **`docs/required-peers.md` rewritten to the shipped truth.** The vault install command is now the working `npm i -g wicked-vault` form (was `npx wicked-vault-install`, which E404s on a fresh machine — no npm package of that name exists; it's a bin of `wicked-vault`). The loom row no longer presents a required external peer pinned `^0.2.0`: the engine has been absorbed in-package (`scripts/loom/`, dispatched in-process by `scripts/_loom.py`) since 12.27.0. **Decision (recon OQ-4):** the standalone `wicked-loom` npm package (0.4.0, not deprecated) is not a sanctioned install path — the pin is deleted, not bumped; `WICKED_LOOM_BIN` stays a debugging escape hatch.
-- **`.claude-plugin/plugin.json`: deleted the retired `wicked_brain_version` pin** (`^0.18.0` — wicked-brain retired 2026-08, Phase 5-S7; nothing reads the key). The `wicked_ledger_version ^0.2.0` pin is deliberately untouched here — it moves with the coordinated wicked-ledger 2.1 floor-bump wave.
-- **`.claude-plugin/marketplace.json`: retired-layers copy fixed** — "testing/brain/bus are opt-in layers" → estate/bus are the opt-in layers; wicked-testing and wicked-brain are retired (QE ships in-catalog as the `qe` domain; memory lives in wicked-estate).
-- **`docs/brain-chunk-format.md`: retirement banner added** (recon DT-18) — the doc read as live instructions to write chunks into `~/.wicked-brain`, which is a frozen archive that must never be written; the format is preserved as historical reference for the chunks migrated into wicked-estate.
-- **Site: the wicked-interactive card tells the document-engine story** (recon DT-12) — wicked-interactive moved planes rather than retiring: it is the foundation's document engine (storage, version lineage, HTML/PDF/PPTX/video rendering) that wicked-crew spawns and proxies, not a standalone visual builder. Install command unchanged (two-step marketplace add + install).
-- **Backfilled the 12.30.0 and 12.31.0 changelog entries below** (recon DT-17) — the previous release entry was 12.29.1 while npm shipped 12.31.0; the vault-direct-peer entry that sat under [Unreleased] shipped in 12.31.0 and now lives there.
+## [12.33.0] — 2026-09-11
+
+### Added
+- **Cross-CLI skill portability — one catalog that works wherever it is installed (F-079, #1120).** wicked-garden is installed directly into Claude Code, Codex, OpenCode, Pi and Antigravity by third parties (`npx wicked-installer` → a FLAT, skills-only copy laid out by skill NAME, with no `scripts/`, no venv and no plugin root) and snapshotted by wicked-crew for every seat; only Claude Code ever substituted `${CLAUDE_PLUGIN_ROOT}`, so 77 of the 142 skills crew publishes were `portable: false` and every non-Claude seat was denied them. The skill text itself is now cross-CLI — a convention, a launcher and a lint, all in this release. **Convention** (`.claude/CLAUDE.md`, "Cross-CLI skills"): a skill refers to its OWN files by a base-directory-relative path (`refs/plan.md` — every probed CLI announces or resolves the skill's base directory); to ANOTHER skill by **name** (`wicked-garden-qe` + its `refs/review.md`), never by a filesystem path (`../` and `${CLAUDE_PLUGIN_ROOT}/skills/…` both die in the flat layout); to the shared runtime only through the **launcher** — `wicked-garden run scripts/<x>.py [args]`, `wicked-garden path <dir>`, `wicked-garden python -c …` — with one standard `## Runtime` block per script-backed SKILL.md (exact text in `tests/portability_rules.json`) telling the model what to do when the launcher or Python is missing; harness mechanics carry an inline fallback (fork workers: "when your harness cannot fork, run it inline…"; `Skill(skill=…)` dispatch: "on any other harness open the named skill's SKILL.md and carry it out inline"; AskUserQuestion: plain-text-and-wait). **Launcher** — `scripts/wicked-garden.mjs` (node ≥ 20 — the package's `engines` floor — no deps; POSIX twin `scripts/wicked-garden` and Windows twin `scripts/wicked-garden.cmd` for crew's snapshot PATH; the npm bin `wicked-garden` delegates `run|python|path|root|doctor` to it): root order `WICKED_GARDEN_ROOT` (crew seats; REFUSED loudly when it is not a garden root — never falls back to a different garden) → `CLAUDE_PLUGIN_ROOT` → its own package dir; interpreter `.py` → `<root>/.venv` → `uv run --project <root> --frozen --no-dev` with `UV_PROJECT_ENVIRONMENT` under the user cache dir (never under the root; skipped without `uv.lock`, which the npm package now ships) → `python3` → `python` → `py -3`; `.mjs/.js/.cjs` → node, `.sh` → sh; the child keeps the caller's cwd and gets both root variables; every failure is one JSON line naming what was tried. **Lint** — `tests/test_skill_portability.py` fails CI on any `plugin-root` / `skill-dir-var` / `cwd-script` / `relative-link` / `cross-skill-path` / `unresolved-skill-name` / `missing-runtime-preamble` / `slash-form` / missing-fallback token over every text file under `skills/` (nested modules attributed to their own skill, exactly as crew's catalog does), with the rules as data: `tests/portability_rules.json` is wicked-crew's CANONICAL parity fixture vendored byte-for-byte (every regex, the fence walk, option skipping, bundle existence and `../` resolution come from it; its 86 `cases[]` are re-derived here, and `tests/test_portability_fixture_parity.py` pins the vendored bytes + re-computes its `sha256_of_rules`), `tests/portability_rules.garden.json` carries garden's additions (the exact `## Runtime` block, fallback sentences, name resolver, slash-form ban, bare `scripts/x.py <args>` spans), an EMPTY allowlist, and the non-vacuity guard INVERTED: 0 plugin-root refs (was 471 in 103 files), > 200 launcher calls (248 real call sites — the two template mentions inside each `## Runtime` block are not counted), 0 unresolved names. **Codemod** — `scripts/wg/portability_codemod.py --dry-run|--write` (dev tooling, not shipped) performed the rewrite mechanically (585 changes in 166 files, reproducible from `main`; ~20 sites by hand: inline-Python heredocs, the status-line snippet, the imagery shell wrappers, the legacy `crew:*` command table) and reports every rewrite and every unresolvable target. The four skill-local `scripts/` dirs (gh-cli, glab-cli, github-actions, imagery) are stdlib-only and are invoked base-dir-relatively (`python3 scripts/gh_ops.py …`); nested imagery modules reach the parent's `provider.py` through the launcher. `skills/qe/refs/campaign-ci.md` (a template for the TARGET repo's CI) pins `npx wicked-garden@12 run …`. `tests/test_launcher.py` covers root order, the loud refusal, venv preference, uv-outside-the-root (and never creating `<root>/.venv`), cwd, env handoff, twins + executable bit, `doctor`, Windows path building via the exported pure functions and the bin delegation; `tests/test_skill_dispatch_refs_resolve.py` now checks launcher targets exist. **Hooks**: `hooks/scripts/bootstrap.py` additionally exports `WICKED_GARDEN_ROOT` and prepends `<plugin root>/scripts` to the Bash tool's PATH via `CLAUDE_ENV_FILE`, so `wicked-garden run …` resolves to the plugin's own launcher on Claude Code with no npm install (hooks otherwise keep `${CLAUDE_PLUGIN_ROOT}` — they are Claude-plugin mechanics). **Migration for third parties / other CLIs:** on Codex, Pi, OpenCode and Antigravity the skills-only install has no `scripts/`, so `npm i -g wicked-garden` (or `npx wicked-garden`) is the runtime prerequisite for script-backed skills — the launcher resolves the runtime from its own package and reports what it found with `wicked-garden doctor`; prose-only skills need nothing. Under wicked-crew, `WICKED_GARDEN_ROOT=<snapshot>` + `<snapshot>/scripts` on the seat PATH (a wicked-core change in this wave) make the launcher use the snapshot and its synced `.venv`. Crew's publisher becomes a validator that reports per-reason portability (separate PR); after crew refreshes to this garden, all 142 skills are expected to publish `portable: true`.
 
 ## [12.32.2] — 2026-09-10
 
@@ -41,14 +35,32 @@
 
 ## [12.32.0] — 2026-08-30
 
+_The detailed bullets below the three summary bullets were relocated here from `[Unreleased]` in the 12.33.0 cut: each landed before the `v12.32.0` tag and first shipped in it (`git tag --contains` on every landing commit), but the 12.32.0 cut summarised them and left the detail under `[Unreleased]`, where the 12.32.1/12.32.2 hotfix cuts deliberately left it._
+
 ### Added
 - **qe campaign suite complete**: recon+generation w/ dispatch guard, intake propose-as-gate, accept-trio grading, flaky-verdict quarantine, degradation scenarios, campaign rerun+diff, CI recipes (PR subset / governed nightly), vault-backed evidence integrity (content-addressed, redaction-first), AW-25 golden-path evidence chain, dogfood corpus wiring.
 - **Per-turn rules source**: stop.py names `rules.recall` as THE per-turn source; guard_pipeline consumes a graph-derived rules dir with content-hash provenance; `WG_OUTGOV` defaults to advisory `warn`.
 - **Architecture-wiki pointers** in the mem/search/conformance skills (`knowledge.recall {"scope_prefix":"wiki:"}` + estate `rules.recall`).
+- **AW-25 golden path — the wiki pipeline's own evidence-gated proof (recon arch-R21).** The guardrails program now applies its own DoD to itself: a committed, re-runnable acceptance scenario proves seed doc → `wicked-core rules ingest`/`fanout` (isolated stores; enforcement over the crew API, never CLI against a daemon store) → `rules.recall` over the **installed** `wicked-estate-mcp` 0.15.1 returning the rule with its digest-bearing provenance citation → an ISOLATED crew daemon's governed run deterministically tripping the canary trigger (the token rides the run INTENT, so the gate's evaluated context matches with no reliance on the worker model) → the gate denial citing the rule id + wiki URI (`POL-2500`, `wiki://aw25-golden#POL-2500` — via policy criteria AND `conform:` obligations, two independent citation paths) → the ConformanceClaim visible in `GET /runs/:id/acceptance` (deny-dominates, `guardrailed: false`). Ships as `scenarios/qe/aw25-golden-path.md` (scenario-format v1.1, category cli, isolation exclusive), `evidence/aw25-golden/` (seed ruleset with doc↔gate id-twinned `POL-2500`, `run.sh` fail-loud chain script, `campaign-recon.aw25.json` — spec-2 schema-validated plan with a machinery-verified claim ceiling, and the recorded `chain/` evidence 00–07 from a real run), plus `tests/qe/test_aw25_golden_artifacts.py` pinning the artifacts (schema validity, id-twinning, the AC-critical citation assertions in run.sh) hermetically. Evaluator≠creator: the verdict of record is crew's acceptance read, captured verbatim. Findings recorded in the evidence README: the <200-char PHASE SUBSTANCE GATE rejects a too-terse canary BEFORE any claim is recorded (first trip hit exactly this), and the ACP carrier reports `enforcement: enforced` with an empty `armedUnits` list.
+- **Flaky-verdict policy at the campaign acceptance gate (TH-21, ADR 0006 — RECON-TEST-HARNESS test-R23).** One flaky scenario can no longer silently deny OR silently pass a nightly campaign, and exclusions always carry reasons. New written policy `skills/qe/refs/campaign-flake-policy.md` + pure policy engine `scripts/qe/lib/flake-policy.mjs`, applied by `campaign-scoreboard.mjs` on every assembly: (a) **bounded diagnostic re-runs with BOTH verdicts recorded** — a re-run lands as its own runs+verdicts rows under the same stable scenario id (TH-6's flake history, now consumed at the gate via `flake_policy.history`); mixed outcomes are a `flake_signal` blocker naming `wicked-garden-qe-flaky-test-hunter` (never best-of-N), >1+2 runs of one rung is a `rerun_bound_exceeded` violation, and a `--runs` selection showing PASS while omitting a same-window deny-graded sibling is a `pass_laundering_risk` violation; (b) **quarantine lane with owner+deadline via the hunter's taxonomy** — the gate consumes the hunter's ledger `tasks` row fail-closed (`quarantined: true` + scenario binding + taxonomy cause + owner + unexpired `quarantine_expires`; invalid/expired records are reported and NOT honored — the scenario keeps denying); (c) **quarantined scenarios are excluded-with-reason** — rows stay on the scoreboard, the exclusion (id/cause/owner/deadline/reason/observed grades) rides `certification.excluded` + `certification.gate_summary`, and `gate.mjs --exclusions-from <scoreboard.json>` appends the canonical clause to `verdict_summary` so it reaches crew's acceptance payload (the 8-field `wicked.qe.gate.*` wire contract untouched; exclusions missing id/reason/owner/deadline exit 3). A fully-quarantined campaign cannot certify; a quarantined PASS is excluded too; structural violations are never excused. Hunter's SKILL.md §5/§6 now pin the machine contract (body gains required `owner`). Tests: `tests/qe/test_campaign_flake_policy.py` (9 CLI cases, hermetic) + `scripts/qe/runner/test/th21-flake-policy.test.mjs` (14 unit cases).
+- **qe campaign grading through the accept trio (TH-10, ADR 0006).** New `skills/qe/refs/campaign-grading.md` playbook: campaign evidence bundles grade through the SAME role-isolated reviewer as `refs/accept.md` (evidence PATHS only; isolation hard-enforced on Claude Code via host-level `allowed-tools`, advisory on Gemini/Codex/Cursor/Kiro — the boundary is now written down in both refs), with validate-before-grading against wicked-ledger's evidence-manifest 2.1 contract (schema-fail = INCONCLUSIVE; validator unavailable = fail closed). New deterministic glue `scripts/qe/lib/campaign-scoreboard.mjs` assembles the campaign-proven verbatim scoreboard shape `{id, grade, executor_claim, evidence_ok}` and makes self-grading structurally impossible: verdict rows by executor identities (`qe-runner/executor-claim`, `*executor*`, the `test-designer` dev-loop) are refused as grade sources and reported as `self_grade_attempt` violations; `executor_claim` derives from manifest-2.1 `scenario_evidence.status` (the contract's "executor's claim, never the verdict of record" field). Encodes the scenario-defect vs product-finding fork (verdict-reason tag `[scenario-defect]` → bounded re-author/re-run fix lane; `[product-finding]` → GH issue + idempotent ledger `tasks` mirror via `--mirror-tasks`) so certification terminates: `certification.disposition` is always `certified` or `not-certified`, never pending. Reviewer skill gains the campaign-bundle duties (structural floor re-check, claim-vs-evidence posture, mandatory non-PASS classification). Tests: `tests/qe/test_campaign_scoreboard.py` (8 cases, hermetic via a `WICKED_LEDGER_PKG_DIR` stub).
+- **`qe campaign` recon+generation action (TH-7, ADR 0006).** New `campaign` action on the `wicked-garden-qe` router (`skills/qe/refs/campaign.md`): derives a capability inventory from three lenses — the estate code graph when the target repo is indexed, docs recall via `wicked-garden-mem`, and live probing (health endpoints, crew's committed `packages/crew/endpoint-manifest.json`, DOM landmarks) — and emits a dependency-ordered campaign plan CONFORMING to `schemas/campaign-recon.schema.json` v1 (never a parallel format), persisted as a ledger `strategies` row + scenario-format v1 files under `.wicked-qe/campaigns/<name>/`. Assembly/validation glue is `scripts/qe/campaign_plan.py` (stdlib-only, fail-closed): honest `sources.estate: "unindexed"` degradation is DERIVED (an unindexed plan claiming estate-sourced entries is rejected), doc-derived claims are forced `status: "proposed"` pending human review (the incident-to-scenario pending-review pattern), ladder order + rung↔capability binding are enforced beyond the JSON schema, and generated stubs fail until authored (never a silent PASS). Tests: `tests/qe/test_campaign_action.py` validates a generated three-lens plan against the schema itself.
+- **qe dispatch guard (TH-7, guard half of the retired agent-surface cleanup — arch-R25 ≡ test-R20).** `scripts/qe/campaign_dispatch.py`: every qe dispatch resolves its specialist through `resolve_specialist()`, which asserts the resolved worker is a shipped `wicked-garden-qe-*` skill and BLOCKS retired `wicked-testing-*` / `wicked-brain-*` names at dispatch with a clear error naming the garden replacement (exit 2 on the CLI; never a silent rewrite). Wired into `skills/qe/SKILL.md` (fork workers) and `skills/qe/refs/execute.md` (dispatch block).
+
+### Fixed
+- **Re-landed TH-5's campaign-recon schema, clobbered by #1083's stale-base squash.** PR #1083 (TH-4) was squashed from a branch cut before #1082 merged, silently reverting `schemas/campaign-recon.schema.json`, `tests/qe/test_campaign_recon_schema.py`, and the `schemas/README.md` standalone-contract section. Restored byte-for-byte from the #1082 squash commit. (The same squash also reverted #1081's docs/peer-floor work — flagged to its owning lane, not restored here.)
 
 ### Changed
 - Site version stamp injected at build from the plugin manifest (DT-7 — can never re-stale).
 - campaign-recon schema v2: `desktop` category tiers + `isolation` annotation in one bump.
+- **`wicked_ledger_version` floor `^0.2.0` → `^0.4.0` (recon XC-4 — the wicked-ledger 2.1 floor-bump wave).** wicked-ledger 0.4.0 ships evidence-manifest **2.1.0** (optional `scenario_evidence` block + first-class `claim_level` enum, `validateManifest` reviewer entry point — TH-5) and new-feature API surface, so the npm minor moved and the old caret (`^0.2.0` excludes 0.3+) had to move with it. Store compat is unchanged in every direction a garden consumer touches: SQLite `schema_version` stays **3** (no new migrations since 0.1.0), and manifest 2.1 is a **minor** — 2.0.0 bundles still validate (covered by the ledger's backward-compat smoke test) and 2.x readers gate on the major. The pin is single-sourced in `plugin.json`; the six qe skill files (`skills/qe/SKILL.md`, `skills/qe/refs/{accept,insight,integration}.md`, `skills/qe-release-readiness-engineer/SKILL.md`, `skills/qe-test-impact-analyzer/SKILL.md`) reference it symbolically and needed no edits — this completes the ledger-pin half DT-13 deferred to XC-4.
+- **Peer-floor and manifest truth pass (recon DT-13).** One consistent vault-floor story: every doc restatement now says **≥ 0.5.0** — the floor `scripts/loom/manifest.py` (`version_pin="0.5"`) and `plugin.json` (`wicked_vault_version ^0.5.0`) have carried since 12.31.0 (checked by the peer registry's health probe: `loom doctor` reports a below-floor vault as `drift` and exits non-zero) — replacing the stale `≥ 0.4.0` (README, CONTRIBUTING, `skills/archetype/refs/{review,incident,migrate,modernize,specify}.md`) and `^0.3.0` (`docs/required-peers.md`) claims. manifest.py + plugin.json are declared the single source; restatements carry a greppable `<!-- vault-floor -->` marker, and `docs/required-peers.md` documents the bump procedure. `skills/core/refs/setup.md` now checks the probed vault version against the floor and tells a below-floor (e.g. 0.4.x) user to upgrade via `npm i -g wicked-vault@latest`.
+- **`docs/required-peers.md` rewritten to the shipped truth.** The vault install command is now the working `npm i -g wicked-vault` form (was `npx wicked-vault-install`, which E404s on a fresh machine — no npm package of that name exists; it's a bin of `wicked-vault`). The loom row no longer presents a required external peer pinned `^0.2.0`: the engine has been absorbed in-package (`scripts/loom/`, dispatched in-process by `scripts/_loom.py`) since 12.27.0. **Decision (recon OQ-4):** the standalone `wicked-loom` npm package (0.4.0, not deprecated) is not a sanctioned install path — the pin is deleted, not bumped; `WICKED_LOOM_BIN` stays a debugging escape hatch.
+- **`.claude-plugin/plugin.json`: deleted the retired `wicked_brain_version` pin** (`^0.18.0` — wicked-brain retired 2026-08, Phase 5-S7; nothing reads the key). The `wicked_ledger_version ^0.2.0` pin is deliberately untouched here — it moves with the coordinated wicked-ledger 2.1 floor-bump wave.
+- **`.claude-plugin/marketplace.json`: retired-layers copy fixed** — "testing/brain/bus are opt-in layers" → estate/bus are the opt-in layers; wicked-testing and wicked-brain are retired (QE ships in-catalog as the `qe` domain; memory lives in wicked-estate).
+- **`docs/brain-chunk-format.md`: retirement banner added** (recon DT-18) — the doc read as live instructions to write chunks into `~/.wicked-brain`, which is a frozen archive that must never be written; the format is preserved as historical reference for the chunks migrated into wicked-estate.
+- **Site: the wicked-interactive card tells the document-engine story** (recon DT-12) — wicked-interactive moved planes rather than retiring: it is the foundation's document engine (storage, version lineage, HTML/PDF/PPTX/video rendering) that wicked-crew spawns and proxies, not a standalone visual builder. Install command unchanged (two-step marketplace add + install).
+- **Backfilled the 12.30.0 and 12.31.0 changelog entries below** (recon DT-17) — the previous release entry was 12.29.1 while npm shipped 12.31.0; the vault-direct-peer entry that sat under [Unreleased] shipped in 12.31.0 and now lives there.
 
 ## [12.31.0] — 2026-08-25
 

package/README.md

@@ -69,6 +69,14 @@ installs/updates the whole wicked-\* family (garden, its peers, and the rest).
 > and the previous copy is put back). Those transient dirs are **not plugins**; a leftover after an interrupted install is
 > safe to delete (`status` lists them).
 
+**Other CLIs (Codex, OpenCode, Pi, Antigravity)** — `npx wicked-installer install-<cli> wicked-garden` copies
+the skills only (flat, by name — no `scripts/`, no venv). Every skill's text works there as written: own files are
+referenced relative to the skill's directory, other skills by name, and the shared runtime only through the
+launcher — `wicked-garden run scripts/<x>.py …`. So for script-backed skills the runtime prerequisite on those
+CLIs is `npm i -g wicked-garden` (or `npx wicked-garden`); the launcher resolves the plugin root and the Python
+interpreter itself (`wicked-garden doctor` shows what it found) and never writes under the root. Prose-only
+skills need nothing. Under wicked-crew the same launcher points at the run's snapshot via `WICKED_GARDEN_ROOT`.
+
 Then, in a Claude Code session:
 
 ```bash

package/hooks/scripts/bootstrap.py

@@ -1201,12 +1201,23 @@ def main():
     # Export CLAUDE_PLUGIN_ROOT to CLAUDE_ENV_FILE so Bash tool calls can access it.
     # Hooks receive CLAUDE_PLUGIN_ROOT from the plugin runtime, but Bash tool calls
     # do not inherit it.  Writing to CLAUDE_ENV_FILE bridges the gap.
+    # Since 12.33 (cross-CLI skills, F-079) skill text reaches scripts/ only through
+    # the `wicked-garden` launcher, so the same bridge puts <root>/scripts on PATH
+    # (the launcher twin lives there — no npm install needed on Claude Code) and
+    # exports WICKED_GARDEN_ROOT, the launcher's first root candidate.
     env_file = os.environ.get("CLAUDE_ENV_FILE")
     plugin_root = os.environ.get("CLAUDE_PLUGIN_ROOT")
     if env_file and plugin_root:
         try:
             with open(env_file, "a") as f:
                 f.write(f'export CLAUDE_PLUGIN_ROOT="{plugin_root}"\n')
+                f.write(f'export WICKED_GARDEN_ROOT="{plugin_root}"\n')
+                # idempotent: SessionStart also fires on reconnects, and the env file is
+                # appended to — never let PATH grow one entry per fire
+                f.write(
+                    f'case ":$PATH:" in *":{plugin_root}/scripts:"*) ;; '
+                    f'*) export PATH="{plugin_root}/scripts:$PATH" ;; esac\n'
+                )
         except OSError:
             pass
 

package/install.mjs

@@ -12,6 +12,11 @@
  *   npx wicked-garden update  [options]   Same as install
  *   npx wicked-garden status  [options]   Show the install state per config dir
  *   npx wicked-garden pack <verb>         Third-party pack tooling (check/register/list/…)
+ *   npx wicked-garden run <path> [args]   Launcher: run a plugin-root-relative script (delegates
+ *   npx wicked-garden python <path|-|-c>  to scripts/wicked-garden.mjs — root resolution
+ *   npx wicked-garden path <path>         WICKED_GARDEN_ROOT → CLAUDE_PLUGIN_ROOT → this package,
+ *   npx wicked-garden root                interpreter ladder .venv → uv → python3 → python → py -3;
+ *   npx wicked-garden doctor              this is how portable skill text reaches scripts/)
  *   npx wicked-garden --version           Print version
  *   npx wicked-garden --help              Print usage
  *
@@ -57,7 +62,9 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(join(__dirname, "package.json"), "utf8"));
 
 const PLUGIN_DIRS  = [".claude-plugin", "hooks", "scripts", "skills", "schemas"];
-const PLUGIN_FILES = ["ETHOS.md", "CHANGELOG.md", "README.md", "WICKED_GARDEN_BUS_EVENTS.md", "pyproject.toml"];
+// uv.lock rides along so the copy's `uv sync` (and the launcher's `uv run --frozen`) resolve
+// the same pins the release was tested with.
+const PLUGIN_FILES = ["ETHOS.md", "CHANGELOG.md", "README.md", "WICKED_GARDEN_BUS_EVENTS.md", "pyproject.toml", "uv.lock"];
 const SKIP         = [/__pycache__/, /\.pyc$/, /\.pyo$/, /\.DS_Store$/];
 // Dev-only subdirs within scripts/ — not needed at runtime
 const SCRIPTS_DEV  = ["ci", "wg"];
@@ -109,6 +116,11 @@ function findBin(name) {
 
 class UsageError extends Error {}
 
+// Launcher verbs — delegated verbatim to scripts/wicked-garden.mjs (the single implementation;
+// scripts/wicked-garden and scripts/wicked-garden.cmd are its PATH twins for crew snapshots).
+// Like `pack`, they own their flags: everything after the verb passes through untouched.
+const LAUNCHER_VERBS = new Set(["run", "python", "path", "root", "doctor"]);
+
 // A value-taking flag never swallows an option, in either form: `--claude-home --dry-run`,
 // `--claude-home=--dry-run` and `--claude-home=-x` are errors, as are empty/blank values.
 // A directory whose name really starts with "-" is written `./-x` or as an absolute path.
@@ -128,7 +140,7 @@ function parseArgs(argv) {
   const opts = { cmd: undefined, rest: [], claudeHomes: [], dryRun: false };
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
-    if (opts.cmd === "pack") { opts.rest.push(arg); continue; }
+    if (opts.cmd === "pack" || LAUNCHER_VERBS.has(opts.cmd)) { opts.rest.push(arg); continue; }
     if (arg === "--dry-run") {
       opts.dryRun = true;
     } else if (arg === "--claude-home") {
@@ -581,6 +593,11 @@ function usage() {
     "  npx wicked-garden install [options]   Install or update the plugin copy (`update` is an alias)",
     "  npx wicked-garden status  [options]   Show the install state per config dir (read-only)",
     "  npx wicked-garden pack <verb>         Third-party pack tooling (check/register/list/floors/install)",
+    "  npx wicked-garden run <path> [args]   Launcher: run a plugin-root-relative script (.py/.mjs/.js/.sh)",
+    "  npx wicked-garden python <path|-|-c>  Launcher: force the python interpreter (stdin / -c pass through)",
+    "  npx wicked-garden path <path>         Launcher: print the absolute path under the plugin root",
+    "  npx wicked-garden root                Launcher: print the resolved plugin root",
+    "  npx wicked-garden doctor              Launcher: JSON report (root, source, python, node, uv)",
     "  npx wicked-garden --version           Show version",
     "  npx wicked-garden --help              Show this usage",
     "",
@@ -629,6 +646,15 @@ switch (opts.cmd) {
   case "pack":
     process.exit(cmdPack(opts.rest));
     break;
+  case "run":
+  case "python":
+  case "path":
+  case "root":
+  case "doctor": {
+    const { main: launcherMain } = await import("./scripts/wicked-garden.mjs");
+    process.exit(launcherMain([opts.cmd, ...opts.rest]));
+    break;
+  }
   case "--version":
   case "-v":
     console.log(pkg.version);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.32.2",
+  "version": "12.34.0",
   "type": "module",
   "description": "Curated toolkit for what AI coding agents can't do alone: evidence-gated work, codegraph relationships, deterministic multi-file refactor, multi-model second opinions, and cross-session memory. Installs as a Claude Code plugin.",
   "keywords": [

package/pyproject.toml

@@ -1,6 +1,11 @@
 [project]
 name = "wicked-garden"
-version = "1.33.0"
+# NOT a release anchor. The plugin's version lives in package.json and is synced into
+# .claude-plugin/{plugin,marketplace}.json by `npm version` -> .github/scripts/sync-plugin-version.mjs
+# when the vX.Y.Z tag runs release.yml. This Python project is never built or published (the hatch
+# target exists only so uv can manage deps), nothing reads this field, and the release train does
+# not bump it — PEP 621 requires a value, so it is pinned to the placeholder 0.0.0 (mirrored in uv.lock).
+version = "0.0.0"
 description = "AI-Native SDLC delivered as a single Claude Code plugin"
 requires-python = ">=3.10"
 dependencies = [

package/scripts/_python.sh

@@ -5,7 +5,11 @@
 # Python may only be available as `python` or `py -3`.
 #
 # Usage:
-#   sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" script.py [args...]
+#   sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" script.py [args...]   # hooks (Claude Code substitutes the variable)
+#
+# Skill text does NOT use this shim: it is installed flat (no scripts/, no plugin root)
+# on Codex/Pi/OpenCode/Antigravity, so it calls the launcher instead —
+#   wicked-garden run scripts/<x>.py [args...]   (scripts/wicked-garden.mjs; see .claude/CLAUDE.md)
 #
 # This script tries python3, then python, then py -3, and exec's the
 # first one that exists. If none are found, exits with an error.

package/scripts/_run.py

@@ -9,8 +9,9 @@ Two modes:
      Executes normally. On argparse errors (exit code 2),
      automatically appends --help output for self-correction.
 
-Script paths are resolved relative to CLAUDE_PLUGIN_ROOT (or this
-script's parent directory as fallback).
+Script paths are resolved relative to CLAUDE_PLUGIN_ROOT — which the
+`wicked-garden` launcher exports (alongside WICKED_GARDEN_ROOT) on every
+host — or this script's parent directory as fallback.
 
 Examples:
   # Show usage before invoking
@@ -20,7 +21,7 @@ Examples:
   python3 scripts/_run.py scripts/crew/phase_manager.py create my-project --description "foo"
 
   # Works with uv for scripts that need deps
-  cd "${CLAUDE_PLUGIN_ROOT}" && uv run python scripts/_run.py scripts/crew/phase_manager.py status my-project
+  wicked-garden run scripts/_run.py scripts/crew/phase_manager.py status my-project
 """
 
 import json

package/scripts/crew/archetypes_v11.py

@@ -40,8 +40,7 @@ Usage (library):
     # directives -> [{"archetype": "build", "phases": [...], "next_action": ...}]
 
 Usage (CLI):
-    sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" \\
-      "${CLAUDE_PLUGIN_ROOT}/scripts/crew/archetypes_v11.py" \\
+    wicked-garden run scripts/crew/archetypes_v11.py \\
       detect --prompt "add caching to the dashboard"
 """
 

package/scripts/crew/stack_registry.py

@@ -21,8 +21,7 @@ Usage (library):
     # else                    -> r["gap_task"] = {title, body, ...}, dispatch is None
 
 Usage (CLI):
-    sh "${CLAUDE_PLUGIN_ROOT}/scripts/_python.sh" \\
-      "${CLAUDE_PLUGIN_ROOT}/scripts/crew/stack_registry.py" \\
+    wicked-garden run scripts/crew/stack_registry.py \\
       resolve --stack node-legacy-to-modern
 """
 

package/scripts/domain/validate_domain_model.py

@@ -53,7 +53,8 @@ def pinned_version() -> str:
     own ``metadata.schema_version`` const (== its ``$id`` version segment).
     Deliberately NOT the vendored bundle ``VERSION`` file — that tracks the
     owner's whole 4-schema bundle and moves when ANY sibling schema changes
-    (1.0.0→1.1.0 added conformance-rules.schema.json; this schema stayed 1.0.0)."""
+    (1.0.0→1.1.0 added conformance-rules.schema.json, 1.1.0→1.2.0 changed only
+    that sibling's steering fields; this schema stayed 1.0.0 throughout)."""
     schema = load_schema()
     return schema["properties"]["metadata"]["properties"]["schema_version"]["const"]
 

package/scripts/qe/lib/gate.mjs

@@ -18,7 +18,7 @@
  *     payload: run_id, project_id
  *
  * Usage (from a target repo's root):
- *   node "${CLAUDE_PLUGIN_ROOT}/scripts/qe/lib/gate.mjs" \
+ *   wicked-garden run scripts/qe/lib/gate.mjs \
  *     --project-id <id> --run-id <id> --verdict <PASS|FAIL|CONDITIONAL|SYSTEM_ERROR> \
  *     --verdict-summary "<text>" [--rationale-ref <path>] [--council-run-id <id>]
  *     [--mode gate|event|manual|crew_integration] [--exclusions-from <scoreboard.json>]

package/scripts/resolve_path.py

@@ -5,8 +5,8 @@ Used by command prompts to avoid hardcoded ~/.something-wicked/ paths.
 Prints the resolved path to stdout.
 
 Usage:
-    python3 "${CLAUDE_PLUGIN_ROOT}/scripts/resolve_path.py" wicked-delivery
-    python3 "${CLAUDE_PLUGIN_ROOT}/scripts/resolve_path.py" wicked-garden:search extracted
+    wicked-garden run scripts/resolve_path.py wicked-delivery
+    wicked-garden run scripts/resolve_path.py wicked-garden:search extracted
 """
 
 import sys

package/scripts/wicked-garden

@@ -0,0 +1,22 @@
+#!/bin/sh
+# wicked-garden launcher — POSIX twin of scripts/wicked-garden.mjs (the implementation).
+# wicked-crew prepends <snapshot>/scripts to a seat's PATH so `wicked-garden run …` in
+# skill text resolves here; it needs `node` (>= 20) on PATH and nothing else. When this
+# file is reached through a symlink (`ln -s <root>/scripts/wicked-garden ~/bin/…`) the
+# link is followed if `readlink` exists; otherwise $0 is used as-is. The logic lives
+# once, in wicked-garden.mjs — never edit it here.
+self=$0
+n=0
+while [ -h "$self" ] && [ "$n" -lt 16 ]; do
+  link=$(readlink "$self" 2>/dev/null) || break
+  case $link in
+    /*) self=$link ;;
+    *)  self=${self%/*}/$link ;;
+  esac
+  n=$((n + 1))
+done
+case $self in
+  */*) dir=${self%/*} ;;
+  *)   dir=. ;;
+esac
+exec node "$dir/wicked-garden.mjs" "$@"

package/scripts/wicked-garden.cmd

@@ -0,0 +1,4 @@
+@echo off
+rem wicked-garden launcher - Windows twin of scripts\wicked-garden.mjs (the implementation).
+rem Needs node (>= 20) on PATH. The logic lives once, in wicked-garden.mjs.
+node "%~dp0wicked-garden.mjs" %*