wicked-garden 12.34.0 → 12.36.0

package/.claude-plugin/components.json

@@ -2,8 +2,8 @@
   "_comment": "Issue #328: Component declarations for wicked-garden plugin. Claude Code plugin.json does not yet support inline component declarations beyond path overrides. This manifest documents all components for tooling, validation, and future schema support. When plugin.json gains a 'components' field, merge this data into plugin.json. The plugin is skills-only: former commands/ became actions of consolidated per-domain skills, and former agents/ became standalone context:fork worker skills (enumerated under fork_skills). Regenerate derived blocks with scripts/ci/sync_components.py.",
   "domains": ["agentic", "crew", "data", "engineering", "jam", "mem", "persona", "platform", "product", "qe", "search", "smaht"],
   "summary": {
-    "skills": 142,
-    "fork_skills": 78,
+    "skills": 144,
+    "fork_skills": 75,
     "hooks": 13,
     "specialists": 7
   },
@@ -25,11 +25,13 @@
     "domain-coverage": ["domain-coverage"],
     "domain-extractor": ["domain-extractor"],
     "domain-modeler": ["domain-modeler"],
+    "draft": ["draft"],
     "engineering": ["architecture", "backend", "debugging", "docs", "engineering", "frontend", "integration", "large-scale-migration", "patch", "system-design", "unit-test-quality"],
     "engineering-api-documentarian": ["engineering-api-documentarian"],
     "engineering-conformance-reviewer": ["engineering-conformance-reviewer"],
     "engineering-migration-engineer": ["engineering-migration-engineer"],
     "engineering-solution-architect": ["engineering-solution-architect"],
+    "governed-worker": ["governed-worker"],
     "ground": ["ground"],
     "integration-discovery": ["integration-discovery"],
     "jam": ["jam"],
@@ -101,7 +103,7 @@
     "workflow": ["workflow"],
     "worktrees": ["worktrees"]
   },
-  "fork_skills": ["wicked-garden-agentic-architect", "wicked-garden-agentic-performance-analyst", "wicked-garden-agentic-safety-reviewer", "wicked-garden-archetype", "wicked-garden-classify", "wicked-garden-crew-implementer", "wicked-garden-crew-researcher", "wicked-garden-crew-reviewer", "wicked-garden-data-engineer", "wicked-garden-domain-coverage", "wicked-garden-domain-extractor", "wicked-garden-domain-modeler", "wicked-garden-engineering-api-documentarian", "wicked-garden-engineering-conformance-reviewer", "wicked-garden-engineering-debugging", "wicked-garden-engineering-migration-engineer", "wicked-garden-engineering-solution-architect", "wicked-garden-ground", "wicked-garden-integration-discovery", "wicked-garden-jam-brainstorm-facilitator", "wicked-garden-jam-council", "wicked-garden-mem-capture", "wicked-garden-mem-ingest", "wicked-garden-persona-agent", "wicked-garden-platform-compliance-officer", "wicked-garden-platform-privacy-expert", "wicked-garden-platform-security-engineer", "wicked-garden-product-a11y-expert", "wicked-garden-product-requirements-analyst", "wicked-garden-product-ui-reviewer", "wicked-garden-product-ux-designer", "wicked-garden-product-value-strategist", "wicked-garden-qe-a11y-test-engineer", "wicked-garden-qe-acceptance-test-executor", "wicked-garden-qe-acceptance-test-reviewer", "wicked-garden-qe-acceptance-test-writer", "wicked-garden-qe-ai-feature-test-engineer", "wicked-garden-qe-chaos-test-engineer", "wicked-garden-qe-code-analyzer", "wicked-garden-qe-compliance-test-engineer", "wicked-garden-qe-contract-testing-engineer", "wicked-garden-qe-coverage-archaeologist", "wicked-garden-qe-data-quality-tester", "wicked-garden-qe-e2e-orchestrator", "wicked-garden-qe-exploratory-tester", "wicked-garden-qe-flaky-test-hunter", "wicked-garden-qe-fuzz-property-engineer", "wicked-garden-qe-iac-test-engineer", "wicked-garden-qe-incident-to-scenario-synthesizer", "wicked-garden-qe-integration-test-engineer", "wicked-garden-qe-load-performance-engineer", "wicked-garden-qe-localization-test-engineer", "wicked-garden-qe-mutation-test-engineer", "wicked-garden-qe-observability-test-engineer", "wicked-garden-qe-production-quality-engineer", "wicked-garden-qe-release-readiness-engineer", "wicked-garden-qe-requirements-quality-analyst", "wicked-garden-qe-risk-assessor", "wicked-garden-qe-scenario-executor", "wicked-garden-qe-security-test-engineer", "wicked-garden-qe-semantic-reviewer", "wicked-garden-qe-snapshot-hygiene-auditor", "wicked-garden-qe-test-automation-engineer", "wicked-garden-qe-test-code-quality-auditor", "wicked-garden-qe-test-data-manager", "wicked-garden-qe-test-designer", "wicked-garden-qe-test-impact-analyzer", "wicked-garden-qe-test-oracle", "wicked-garden-qe-test-strategist", "wicked-garden-qe-testability-reviewer", "wicked-garden-qe-ui-component-test-engineer", "wicked-garden-qe-visual-regression-engineer", "wicked-garden-runtime-exec", "wicked-garden-smaht", "wicked-garden-swarm", "wicked-garden-wickedizer", "wicked-garden-workflow", "wicked-garden-worktrees"],
+  "fork_skills": ["wicked-garden-agentic-architect", "wicked-garden-agentic-performance-analyst", "wicked-garden-agentic-safety-reviewer", "wicked-garden-archetype", "wicked-garden-classify", "wicked-garden-data-engineer", "wicked-garden-domain-coverage", "wicked-garden-domain-extractor", "wicked-garden-domain-modeler", "wicked-garden-engineering-api-documentarian", "wicked-garden-engineering-conformance-reviewer", "wicked-garden-engineering-debugging", "wicked-garden-engineering-migration-engineer", "wicked-garden-engineering-solution-architect", "wicked-garden-ground", "wicked-garden-integration-discovery", "wicked-garden-jam-brainstorm-facilitator", "wicked-garden-jam-council", "wicked-garden-mem-capture", "wicked-garden-mem-ingest", "wicked-garden-persona-agent", "wicked-garden-platform-compliance-officer", "wicked-garden-platform-privacy-expert", "wicked-garden-platform-security-engineer", "wicked-garden-product-a11y-expert", "wicked-garden-product-requirements-analyst", "wicked-garden-product-ui-reviewer", "wicked-garden-product-ux-designer", "wicked-garden-product-value-strategist", "wicked-garden-qe-a11y-test-engineer", "wicked-garden-qe-acceptance-test-executor", "wicked-garden-qe-acceptance-test-reviewer", "wicked-garden-qe-acceptance-test-writer", "wicked-garden-qe-ai-feature-test-engineer", "wicked-garden-qe-chaos-test-engineer", "wicked-garden-qe-code-analyzer", "wicked-garden-qe-compliance-test-engineer", "wicked-garden-qe-contract-testing-engineer", "wicked-garden-qe-coverage-archaeologist", "wicked-garden-qe-data-quality-tester", "wicked-garden-qe-e2e-orchestrator", "wicked-garden-qe-exploratory-tester", "wicked-garden-qe-flaky-test-hunter", "wicked-garden-qe-fuzz-property-engineer", "wicked-garden-qe-iac-test-engineer", "wicked-garden-qe-incident-to-scenario-synthesizer", "wicked-garden-qe-integration-test-engineer", "wicked-garden-qe-load-performance-engineer", "wicked-garden-qe-localization-test-engineer", "wicked-garden-qe-mutation-test-engineer", "wicked-garden-qe-observability-test-engineer", "wicked-garden-qe-production-quality-engineer", "wicked-garden-qe-release-readiness-engineer", "wicked-garden-qe-requirements-quality-analyst", "wicked-garden-qe-risk-assessor", "wicked-garden-qe-scenario-executor", "wicked-garden-qe-security-test-engineer", "wicked-garden-qe-semantic-reviewer", "wicked-garden-qe-snapshot-hygiene-auditor", "wicked-garden-qe-test-automation-engineer", "wicked-garden-qe-test-code-quality-auditor", "wicked-garden-qe-test-data-manager", "wicked-garden-qe-test-designer", "wicked-garden-qe-test-impact-analyzer", "wicked-garden-qe-test-oracle", "wicked-garden-qe-test-strategist", "wicked-garden-qe-testability-reviewer", "wicked-garden-qe-ui-component-test-engineer", "wicked-garden-qe-visual-regression-engineer", "wicked-garden-runtime-exec", "wicked-garden-smaht", "wicked-garden-swarm", "wicked-garden-wickedizer", "wicked-garden-workflow", "wicked-garden-worktrees"],
   "hooks": ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "PostToolUseFailure", "TaskCompleted", "SubagentStart", "SubagentStop", "PermissionRequest", "Notification", "PreCompact", "Stop", "SessionEnd"],
   "specialists": [
     {

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.34.0"}], "version": "12.34.0"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.36.0"}], "version": "12.36.0"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.34.0",
+  "version": "12.36.0",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), real multi-model second opinions (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": "^0.5.0",
   "wicked_ledger_version": "^0.4.0",

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+## [12.36.0] — 2026-09-13
+
+### Fixed
+- **Governed grounding goes through the estate stdio shim in `--readonly` with a pinned store — never the raw write CLI (garden#1130; the garden half of wicked-core#463/#471, ledger F-RC1-045/046/048).** Governed workers ground through `scripts/_estate_client.py` (the DEC-R shim the `mem` domain already uses) because an organization-managed Claude Code `allowedMcpServers` allowlist silently drops a handed `wicked-estate` MCP server, while a script the skill runs is unaffected and works on every seat CLI. The shim gains a governed / read-only mode: with `WICKED_RUN_ID` set (or `--readonly` on the backend argv, or `WICKED_ESTATE_READONLY=1`) every spawn is `wicked-estate-mcp --readonly [--db <store>]`; in a run the store MUST be pinned (`--db <path>`, or `WICKED_ESTATE_DB` / `WICKED_HOME` / `WICKED_MEMORY_DB` in the worker environment) and an unpinned store is refused without spawning (`{"ok": false, "reason": …}`), the same shape the gate hook denies as `no-pin`. `parse_cli_flags` accepts `--readonly` / `--db <path>` anywhere on a backend argv and rejects any other `--flag` as a usage error (a misspelt `--read-only` would otherwise fall through and spawn a WRITE-capable MCP — the remedy the fence coaches must work); `scripts/mem/estate_memory.py` forwards the flags instead of dropping them (before: `argv[2:]` was ignored, so the fence recorded ALLOW on a write-capable MCP). New shim actions: `propose` (`proposal.submit` — the safe write a read-only MCP still permits; `provenance` is never forwarded, the server stamps it from `WICKED_RUN_*`; returns `{ok,id}` or `{ok:false,reason,code}` so a `-32602` shape error is told apart from an unreachable estate) and `mode` (a no-spawn probe of governed / readonly / store_pinned / refusal). The persistent broker restarts when the read-only mode changes, not only when the db does. **Ladders**: `wicked-garden-search` and `wicked-garden-repo-learn` (and `refs/hotspots.md`, `refs/capture-proposals.md`, the `mem` skill) now open with a governed-run rung — the shim in `--readonly` with the store pinned from the env — then read-only CLI subcommands (`query|blast-radius|rank|stats|source|semantic|cross-graph`, `clusters` without `--annotate`), then grep flagged as missing injected edges; `wicked-estate index|scip|tfstate|import-telemetry|compact|watch` and `clusters --annotate` are never a rung in a governed run; every degrade names the rung that answered; a denied call is final (governed-worker A5). **Capture contract**: the repo-learn capture phase submits each proposal through the shim AND writes the exact `{kind_type, payload, facets}` objects as one JSON array to the deliverable file the run names — an absolute path in the unit's declared write root, never inside the repository (governed-worker E1) — so wicked-crew (crew#553) can land them when the shim path is unavailable on a seat; counts are reported derived / submitted / written-to-file / failed. **Lint**: `tests/test_skill_governed_grounding.py` fails the build when a write-CLI invocation appears in a governed-mode block of any skill text (a block that names the write CLI only to forbid it passes), and asserts the three ladders' governed blocks name the shim with `--readonly`. Release ordering: this must ship before any wicked-core-ts release that contains core#471 — that fence's deny remedy coaches `--readonly`, which shims older than this release ignore.
+
+### Added
+- **`wicked-garden-governed-worker` — the discipline every governed unit follows, by role (creator / evaluator / neutral), in the cross-CLI skill format (garden#1131; the pilot for garden#1132).** Ten distinct governed runs were lost on 2026-09-13 to one failure class: creators shipped without running the repo's checks and called red results "pre-existing" (F-RC1-019, F-RC1-070), hand-edited generated artifacts (F-RC1-019), evaluators wrote notes or fixes into the guarded worktree and were killed by the guard (F-RC1-060/062, F-RC1-071, F-RC2-037), triage units implemented because a steer addressed to the fix phase reached them (F-RC2-038), units asked "Shall I proceed?" into a headless run (F-RC2-038), skills shelled a denied CLI and retried variants (F-RC1-046), and results were reported "done" with nothing submitted (F-RC1-048). New top-level skill `skills/governed-worker/` carries the fourteen rules (A1–A6 for every unit, C1–C5 creator, E1–E2 evaluator, N1 neutral), the role-inference table, an output contract (what you did · commands + exit codes · derived/submitted/failed counts · verdict or plan · open questions as statements) and a Provenance table citing the ledger id behind each rule. Frontmatter is the cross-CLI closed set only — `name`, `description`, `metadata.role: worker`, `metadata.phases: "*"`, `metadata.roles` — no `context: fork`, `subagent_type`, `model`, `effort`, `max-turns`, `color` or `allowed-tools`; the body names tools generically ("your shell", "your file-edit tool", "the handed estate shim in read-only mode"), so codex / pi / opencode / copilot seats can honour it. wicked-core will prepend a role-keyed base-skill directive to every unit prompt (core#468) and wicked-crew will default it (crew#554); until then the skill is handed like any `skill_ref`.
+
+### Changed
+- **`wicked-garden-crew-implementer` / `-crew-reviewer` / `-crew-researcher` retired into `wicked-garden-governed-worker` (Creator / Evaluator / Neutral).** The trio were Claude Code fork-subagent definitions (`context: fork`, `subagent_type`, `model`, `allowed-tools`, `Task(`/`TaskUpdate(` plumbing) that no governed worker was ever handed and no other CLI could honour; their method content (work from the approved design and scenarios in small verified steps; validate against design and evidence with `file:line` verdicts; map structure, name files and risks, hand the plan on) moved into the role sections and each `skills/crew-*/SKILL.md` is now a 7-line redirect stub (`metadata.role: module`). Every in-repo reference follows the fold — swarm (SKILL + `refs/{fan-out,recon-synthesis,ship-discipline,independent-verification}.md`), archetype `refs/review.md`, qe / qe-code-analyzer disambiguation notes, jam-council seat dispatch (now `wicked-garden-governed-worker` with `Role: evaluator`), integration-discovery refs, the smaht delegation hint, the two pre_tool hook messages, the hooks.json #344 note, the site's orchestration group, `.claude/CLAUDE.md`, `.claude/commands/wg-test.md`, and the three tests that pinned worker identity on the trio (repointed to `wicked-garden-engineering-solution-architect`). `components.json` regenerated with `sync_components.py` (fork_skills 78 → 75; skills 143 → 144). No version bump.
+
+## [12.35.0] — 2026-09-13
+
+### Added
+- **`wicked-garden-draft` — the quality floor for document deliverables: contrast ≥ 4.5:1, an honoured page budget, cited claims and no placeholders (F-RECON-007/008/009).** The 2026-09 recon ran a governed brochure draft end to end through the studio and the deliverable that landed was unreadable, over-long and partly invented: the hero fact strip, footer requirements and KPI label rendered `rgba(255,255,255,0.14)`-class text on a `#1a1a26` card (≈1.5:1 — invisible in the PNG and the PDF; F-RECON-007), a "two pages" brief printed as **four** A4 pages because two `.page` wrappers each overflowed their sheet (F-RECON-008), and the copy carried an invented "live instance" URL claim, a command-center mock whose figures were called illustrative only inside an HTML comment, and a visible `[PLACEHOLDER: Customer validation]` box (F-RECON-009) — while every gate auto-allowed and the run's deliverable floor proved only that the file existed. Neither garden nor crew carried a document-drafting skill (crew's `interactive-draft` phases have `skill_ref: null`; the contract was inlined prose adapted from wicked-interactive's assist skill), so nothing re-derived any of it. **New top-level skill `skills/draft/`** (user-invocable; `refs/design-floor.md`, `refs/claims.md`, `refs/self-check.md`): design guidance for the three floors — READABLE (every text/background pair ≥ 4.5:1, 3:1 for large text, judged on the COMPOSITED colours; print text ≥ 7pt — thin 6–7pt type never reaches full pixel coverage, which is why the 4.9:1 fact strip still read as grey), SIZED TO THE BRIEF (the RENDERED page count meets the budget the brief names, default = exactly as asked, any format cap disclosed, wrappers are not pages), GROUNDED (every number/URL cites a repo path via `data-source="path:line"` plus a visible Sources strip, mocks carry `data-illustrative` AND a visible label, no placeholder ever ships — gaps go to the notes) — **and one mandatory self-check** the author runs on the saved file before "done", with a `PASS` / `FAIL` / `UNVERIFIED` verdict that is pasted into the reply, never paraphrased. **Runtime (`scripts/draft/`, stdlib-only, reachable as `wicked-garden run scripts/draft/…`)**: `contrast_check.py` cascades the document's own CSS (specificity, source order, inline, `!important`, `var()` with inheritance — including `:root` tokens when the instrumented deliverable has no `<html>` element — `@media print|screen`, alpha compositing over the real background, `opacity`, every gradient stop) and judges every text-bearing element; `page_count.py` reads the rendered count from an exported PDF (page-tree `/Count`, object streams inflated) or a headless-Chrome print (`--render`; `$WICKED_CHROME`), and otherwise reports the structural estimate as **UNVERIFIED (exit 3)** — never a pass; `claims_scan.py` scans the VISIBLE text for placeholders, uncited numbers, uncited/unsourced URLs (bare domains included), hidden or missing mock labels and, with `--repo`, dangling `data-source` paths and URLs no source mentions; `self_check.py` runs all three and exits 0/1/3. Against the recon's landed v1 (kept as `tests/draft/fixtures/recon-brochure-v1.html`) the checks reproduce the findings exactly — footer `.cta-reqs` and `.mockup-kpi-label` at 1.53:1, the 6.8pt fact strip under the size floor, the accent violet at 3.7:1 on cards, 4 PDF pages vs budget 2, the placeholder, the `3 active · 1 needs you` hidden-label mock, the uncited 2 s / 3 s latencies — and pass the same document once the tokens are lifted and the claims cited (`tests/draft/`, 60+ tests: colour maths, cascade, media modes, PDF page trees incl. object streams, a fake-Chrome render path, the citation forms, CLI exit codes). Cross-CLI per the 12.33 convention (skill-relative refs, the exact `## Runtime` block, no Claude-only mechanics; `tests/portability_rules.garden.json` gains quiet/trip corpus entries for the new launcher lines). The core help overview, `components.json` and the site's honest counts move to 143 skills (`draft` folded into the product & UX group). **Hardened after the independent review (same wave):** shrink-to-fit is judged, not rewarded — `zoom`, `transform: scale()`/`matrix()` and `scale:` on any ancestor multiply into the EFFECTIVE text size the 7pt floor is applied to (the reviewer's `body{zoom:.62}` on a corrected brochure went from a full `PASS` at ≈4.3pt to `FAIL`), an unevaluable transform makes the size UNVERIFIED, and the skill text forbids scaling a page to meet a budget; unsupported colour functions (`oklch()`, `lab()`, `color-mix()`, `light-dark()`…) and image-only backgrounds are reported as `[unknown]` UNVERIFIED pairs (exit 3) instead of silently inheriting or being judged "on white"; `@media not print|screen` is evaluated correctly (it was inverted); inline `!important` sits at the top of the cascade; `--mode both` reports a pair once (`print+screen`); colour-declaring rules with selectors the matcher skips (`:nth-child`, `:is`…) leave a note instead of vanishing; the CLIs never crash on a cp1252 console (Windows piped stdout — `errors="replace"`); `page_count.py` fails (exit 1) before it reports unverified when even the estimate exceeds the budget, ignores a forced break on the last element, refuses a `--pdf` path that does not exist (no silent render), and prints offline (`--host-resolver-rules=MAP * ~NOTFOUND`); `claims_scan.py` no longer flags prose dates, numbered headings, `Step N`/`Page N of M` and lone badge numerals; the skill spells out the two "done" states (`PASS`, or `UNVERIFIED` with a disclosure naming which check, why on this seat, and what a reviewer verifies — the check prints the `DISCLOSE` lines) and that `FAIL` is never done; `refs/design-floor.md` ratios recomputed with the module (`#94a3b8` on white is 2.6:1, not 3.2). **Follow-ups (other repos):** wicked-crew's `interactive-draft` / `-edit` / `-chat` phases should set `skill_ref: 'wicked-garden-draft'` and pass the budget/snapshot to the self-check, and the deliverable floor could run `self_check.py` as a deterministic tool phase; wicked-interactive's assist skill Step 5 can point at the same floor.
+
 ## [12.34.0] — 2026-09-11
 
 ### Changed

package/hooks/hooks.json

@@ -15,7 +15,7 @@
 
   "_TODO_341_http_hooks": "Issue #341: HTTP hook type (type: 'http') is not supported. When supported, add HTTP hooks for external service integration: POST crew phase transitions to a webhook URL, send gate results to a quality dashboard, notify Slack/Teams on crew project completion. Currently all hooks are type: 'command' (subprocess).",
 
-  "_TODO_344_isolation_worktree": "Issue #344: Skill frontmatter field 'isolation: worktree' is not supported. When supported, add isolation: worktree to the crew fork-worker skills (skills/crew-implementer, skills/crew-researcher, skills/crew-reviewer) so they operate in separate git worktrees. This would prevent destructive operations (branch switching, file modifications) in one worker from affecting others running in parallel.",
+  "_TODO_344_isolation_worktree": "Issue #344: Skill frontmatter field 'isolation: worktree' is not supported. When supported, add isolation: worktree to the context:fork worker skills that modify files so they operate in separate git worktrees. This would prevent destructive operations (branch switching, file modifications) in one worker from affecting others running in parallel. (The crew-implementer / crew-researcher / crew-reviewer trio this note used to name was retired 2026-09 into the cross-CLI wicked-garden-governed-worker skill, which carries no fork frontmatter.)",
 
   "_TODO_345_once_flag": "Issue #345: The 'once' flag is not documented as a supported hook property. When supported, add \"once\": true to the SessionStart bootstrap hook so it only fires on the first session start, not on reconnects. Currently bootstrap.py handles this by checking session state for staleness.",
 

package/hooks/scripts/pre_tool.py

@@ -421,8 +421,8 @@ def _check_challenge_gate(file_path: str) -> str:
             f"'{project_name}' (complexity={complexity}). {reason} "
             f"Invoke a contrarian reviewer to produce and clear "
             f"phases/design/challenge-artifacts.md before continuing build. "
-            f"Dispatch the reviewer fork skill: Skill("
-            f"skill='wicked-garden-crew-reviewer') with a contrarian challenge brief. "
+            f"Dispatch a reviewer that follows the evaluator section of the "
+            f"wicked-garden-governed-worker skill with a contrarian challenge brief. "
             f"To bypass temporarily, set WG_CHALLENGE_GATE=off."
         )
     except Exception:
@@ -1064,7 +1064,7 @@ def _warn_reviewer_report(phase_dir: Path, phase_name: str, complexity: int) ->
             f"[wicked-garden] Warning: phases/{phase_name}/reviewer-report.md is missing "
             f"for a complexity-{complexity} project. The async reviewer (Tier 2) should "
             f"have written this. Proceeding with approve, but consider dispatching "
-            f"Skill(skill='wicked-garden-crew-reviewer') to generate a reviewer report."
+            f"a reviewer that follows the wicked-garden-governed-worker skill's evaluator section to generate a reviewer report."
         )
     return ""
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.34.0",
+  "version": "12.36.0",
   "type": "module",
   "description": "Curated toolkit for what AI coding agents can't do alone: evidence-gated work, codegraph relationships, deterministic multi-file refactor, multi-model second opinions, and cross-session memory. Installs as a Claude Code plugin.",
   "keywords": [

package/scripts/_agents.py

@@ -13,7 +13,7 @@ Usage:
 
     loader = AgentLoader()
     loader.load_fork_skills(skills_dir)          # skills/ root
-    profile = loader.get("wicked-garden-crew-implementer")
+    profile = loader.get("wicked-garden-engineering-solution-architect")
 """
 
 import json
@@ -69,7 +69,7 @@ class AgentLoader:
     Lifecycle (called once in bootstrap.py):
         loader = AgentLoader()
         loader.load_fork_skills(skills_dir)
-        profile = loader.get("wicked-garden-crew-implementer")
+        profile = loader.get("wicked-garden-engineering-solution-architect")
     """
 
     def __init__(self) -> None:
@@ -174,7 +174,7 @@ def _parse_agent_md(path: Path, fork_only: bool = False) -> AgentProfile | None:
 
     Format:
         ---
-        name: wicked-garden-crew-implementer
+        name: wicked-garden-engineering-solution-architect
         description: |
           Optional description
         context: fork                # required when fork_only=True

package/scripts/_estate_client.py

@@ -32,12 +32,46 @@ The spawn-vs-broker choice is an implementation detail behind a single seam:
 and swappable via `set_dispatch()`). Every public function routes through it, so
 **no caller changes** when the transport does.
 
+Governed / read-only mode (wicked-garden #1130, DES-GROUNDING-001 §7)
+------------------------------------------------------------------
+A governed worker (a unit of a wicked-crew run, `WICKED_RUN_ID` set) grounds
+through THIS shim, never through a Claude-Code-registered MCP server (an
+organization-managed `allowedMcpServers` allowlist drops that silently) and
+never through the raw write CLI. In that mode every spawn is
+``wicked-estate-mcp --readonly [--db <store>]``:
+
+* ``--readonly`` is spelled literally — the MCP detects read-only by the exact
+  token and refuses every write tool except the safe ``proposal.submit``.
+  Read-only is on when a governed-unit marker is present (`GOVERNED_MARKERS`:
+  `WICKED_RUN_ID`, or the fence env the wrapped carrier sets on the worker —
+  `WICKED_GATE_SCOPE` / `WICKED_WRITE_ROOTS`), when the caller passed
+  ``--governed`` / ``--readonly`` on the backend argv (`parse_cli_flags` /
+  `set_governed` / `set_readonly`), or when ``WICKED_GOVERNED`` /
+  ``WICKED_ESTATE_READONLY`` is truthy. The markers are a CONFIRMATION, not
+  the definition: the skill text defines governed mode by the handed context
+  (a phase directive / the governed-worker skill), because no carrier stamps
+  `WICKED_RUN_ID` on the worker's own environment today and the ACP carrier
+  hands the child none of the fence env.
+* The store must be PINNED: ``--db <path>`` on the backend argv, or
+  ``WICKED_ESTATE_DB`` / ``WICKED_HOME`` / ``WICKED_MEMORY_DB`` in the worker
+  environment. In a governed run an unpinned store is REFUSED (no spawn,
+  `governed_refusal()` names the fix) — an unpinned MCP would resolve the
+  operator's defaults, which is exactly the leak the fence denies.
+* Backends forward the flags instead of dropping them: `parse_cli_flags(argv)`
+  strips ``--readonly`` / ``--db`` anywhere on argv and REJECTS any other
+  ``--flag`` (a misspelling such as ``--read-only`` must never fall through —
+  the MCP would run write-capable). The wicked-core gate hook allows a shim
+  invocation only with ``--readonly`` AND a pinned store (core #471); this
+  module produces exactly that argv shape for the spawned MCP.
+
 Fail-open contract
 ------------------
 Every public function is fail-open: on a missing binary, spawn failure,
 timeout, non-zero exit, malformed JSON, or a tool `isError`, it returns a safe
 empty value (`False` / `None` / `[]`) and never raises. Hooks degrade; they do
-not crash.
+not crash. The governed refusal above is the one deliberate "do not even try":
+it still returns the empty value — the CLI surfaces the reason as
+``{"ok": false, "reason": …}``.
 
 Cross-platform
 --------------
@@ -108,11 +142,14 @@ def resolve_estate_bin() -> Optional[str]:
 def resolve_db() -> Optional[str]:
     """Resolve the graph DB path, mirroring the binary's own resolution.
 
-    Order: WICKED_ESTATE_DB env > <cwd>/.wicked-estate/graph.db (if present) >
-    None. When None, callers omit `--db` and let the binary apply its default,
-    so we never fight the binary's resolution — we only *pin* it when we have a
-    concrete answer. `:memory:` is honoured (passed through) for tests.
+    Order: an explicit `--db` (`set_db` / `parse_cli_flags`) > WICKED_ESTATE_DB
+    env > <cwd>/.wicked-estate/graph.db (if present) > None. When None, callers
+    omit `--db` and let the binary apply its default, so we never fight the
+    binary's resolution — we only *pin* it when we have a concrete answer.
+    `:memory:` is honoured (passed through) for tests.
     """
+    if _db_override:
+        return _db_override
     env_db = os.environ.get("WICKED_ESTATE_DB")
     if env_db:
         return env_db
@@ -125,6 +162,153 @@ def resolve_db() -> Optional[str]:
     return None
 
 
+# ─────────────────────────────────────────────────────────────────────────────
+# Governed / read-only mode — the argv contract the gate hook allows (#1130)
+# ─────────────────────────────────────────────────────────────────────────────
+
+# Governed-unit markers — any of these non-empty in the environment means "you are a
+# unit of a wicked-crew run". `WICKED_RUN_ID` is what wicked-core stamps on the estate
+# MCP SERVER's launch env (`estate_provenance_env`), not on the worker's own Command env,
+# so on its own it is an unreliable cue inside a unit (garden #1134 HIGH-1). The fence
+# env the WRAPPED carrier does set on the worker Command is the reliable marker there —
+# wicked-core main `ad9a0c1`, `src/execute_wrapped.rs:853` (`WRITE_ROOTS_ENV` =
+# "WICKED_WRITE_ROOTS", `src/gate_hook.rs:114`) and `:863` (`GATE_SCOPE_ENV` =
+# "WICKED_GATE_SCOPE", `src/gate_hook.rs:56`). The ACP carrier hands its child none of
+# these today (`gate_hook.rs` `estate_store_pinned_for_child`), which is why the skill
+# text defines governed mode by the HANDED CONTEXT and `--governed` / WICKED_GOVERNED=1
+# let a seat (or a launcher) say so explicitly.
+GOVERNED_RUN_ENV = "WICKED_RUN_ID"
+GOVERNED_MARKERS = (GOVERNED_RUN_ENV, "WICKED_GATE_SCOPE", "WICKED_WRITE_ROOTS")
+GOVERNED_ENV = "WICKED_GOVERNED"              # explicit override (any truthy value)
+GOVERNED_FLAG = "--governed"                  # explicit override on the backend argv
+READONLY_ENV = "WICKED_ESTATE_READONLY"       # explicit read-only opt-in outside a run
+# Any of these, non-empty in the worker environment, pins the store the spawned
+# MCP resolves (the same set wicked-core's shim allow rule reads: core #471).
+STORE_PIN_ENV = ("WICKED_ESTATE_DB", "WICKED_HOME", "WICKED_MEMORY_DB")
+READONLY_FLAG = "--readonly"                  # exact token — the MCP matches it literally
+DB_FLAG = "--db"
+
+_readonly_flag: bool = False                  # set by --readonly / set_readonly()
+_governed_flag: bool = False                  # set by --governed / set_governed()
+_db_override: Optional[str] = None            # set by --db <path> / set_db()
+
+
+def set_governed(flag: bool = True) -> None:
+    """Declare this process a governed unit (`--governed`): read-only + pinned store required."""
+    global _governed_flag
+    _governed_flag = bool(flag)
+
+
+def set_readonly(flag: bool = True) -> None:
+    """Force read-only spawns (`--readonly` on the MCP argv) for this process."""
+    global _readonly_flag
+    _readonly_flag = bool(flag)
+
+
+def set_db(path: Optional[str]) -> None:
+    """Pin the store the spawned MCP opens (`--db <path>`); None clears the pin."""
+    global _db_override
+    _db_override = path or None
+
+
+def _env_truthy(name: str) -> bool:
+    return os.environ.get(name, "").strip().lower() not in ("", "0", "false", "no")
+
+
+def governed_marker() -> Optional[str]:
+    """Which cue says "governed unit": the `--governed` flag, `WICKED_GOVERNED`, or the
+    first `GOVERNED_MARKERS` variable set in the environment. None = no marker seen
+    (which does NOT prove a human session — see the module docstring)."""
+    if _governed_flag:
+        return GOVERNED_FLAG
+    if _env_truthy(GOVERNED_ENV):
+        return GOVERNED_ENV
+    for name in GOVERNED_MARKERS:
+        if os.environ.get(name, "").strip():
+            return name
+    return None
+
+
+def is_governed() -> bool:
+    """True when any governed-unit marker is present (`governed_marker`)."""
+    return governed_marker() is not None
+
+
+def read_only() -> bool:
+    """Spawn the MCP with `--readonly`? Governed run, explicit flag, or env opt-in."""
+    return _readonly_flag or is_governed() or _env_truthy(READONLY_ENV)
+
+
+def store_pinned() -> bool:
+    """Is the store named — `--db` on argv or a pin variable in the environment?"""
+    return bool(_db_override) or any(os.environ.get(k, "").strip() for k in STORE_PIN_ENV)
+
+
+def governed_refusal() -> Optional[str]:
+    """The reason NOT to spawn: a governed run with no pinned store. None = clear to go.
+
+    Belt-and-braces with the gate hook (which denies the same shape as `no-pin`):
+    the shim never resolves the operator's default stores from inside a run.
+    """
+    marker = governed_marker()
+    if marker is None or store_pinned():
+        return None
+    return (
+        f"governed unit ({marker} is set) but no estate store is pinned: pass "
+        f"{DB_FLAG} <path> or set {' / '.join(STORE_PIN_ENV)} in the worker environment; "
+        "refusing to spawn wicked-estate-mcp against an unpinned store (it would resolve "
+        "the operator's defaults)"
+    )
+
+
+def mcp_argv(exe: str, db: Optional[str]) -> list:
+    """The exact argv every transport spawns: `<exe> [--readonly] [--db <db>]`."""
+    argv = [exe]
+    if read_only():
+        argv.append(READONLY_FLAG)
+    if db:
+        argv += [DB_FLAG, db]
+    return argv
+
+
+def parse_cli_flags(argv: list) -> list:
+    """Strip the shim's own flags from a backend argv, apply them, return the rest.
+
+    `--readonly` → `set_readonly(True)`; `--governed` → `set_governed(True)`;
+    `--db <path>` / `--db=<path>` → `set_db`.
+    Flags are accepted ANYWHERE on argv (the gate hook's remedy coaches appending
+    `--readonly` to a denied command). Any other `--flag` raises ValueError — a
+    misspelling (`--read-only`, `--readonly=false`) must never pass through as a
+    positional, because the spawned MCP would then run write-capable. `-`
+    (read JSON from stdin) and JSON objects are positionals and pass through.
+    """
+    rest: list = []
+    it = iter(argv)
+    for tok in it:
+        if tok == READONLY_FLAG:
+            set_readonly(True)
+        elif tok == GOVERNED_FLAG:
+            set_governed(True)
+        elif tok == DB_FLAG:
+            value = next(it, None)
+            if not value or value.startswith("-"):
+                raise ValueError(f"{DB_FLAG} requires a store path")
+            set_db(value)
+        elif tok.startswith(DB_FLAG + "="):
+            value = tok[len(DB_FLAG) + 1:]
+            if not value:
+                raise ValueError(f"{DB_FLAG}= requires a store path")
+            set_db(value)
+        elif tok.startswith("--") and len(tok) > 2:
+            raise ValueError(
+                f"unknown flag {tok!r}: the estate shim accepts {READONLY_FLAG}, "
+                f"{GOVERNED_FLAG} and {DB_FLAG} <path> only (spell {READONLY_FLAG} exactly)"
+            )
+        else:
+            rest.append(tok)
+    return rest
+
+
 # ─────────────────────────────────────────────────────────────────────────────
 # Transport seam — spawn-per-call today; swappable for a broker later
 # ─────────────────────────────────────────────────────────────────────────────
@@ -139,14 +323,15 @@ def _dispatch(requests: list, *, db: Optional[str], timeout: float) -> dict:
     its `id`. Notifications (no `id`) produce no output and are simply absent.
 
     Fail-open: any failure returns {} — the caller treats a missing id as a
-    dead call and degrades.
+    dead call and degrades. A governed run with no pinned store never spawns
+    (`governed_refusal`).
     """
+    if governed_refusal():
+        return {}
     exe = resolve_mcp_bin()
     if not exe:
         return {}
-    argv = [exe]
-    if db:
-        argv += ["--db", db]
+    argv = mcp_argv(exe, db)
     payload = "".join(json.dumps(r, separators=(",", ":")) + "\n" for r in requests)
     try:
         proc = subprocess.Popen(
@@ -240,6 +425,7 @@ class _PersistentBroker:
         self._proc: Optional[subprocess.Popen] = None   # type: ignore[type-arg]
         self._init_resp: Optional[dict] = None           # cached after handshake
         self._db: Optional[str] = None                   # db the process was started with
+        self._readonly: bool = False                      # mode the process was started in
         self._q: queue.Queue = queue.Queue()             # response lines from reader thread
         self._failed: bool = False                        # permanent-degrade flag
         self._reconnect_used: bool = False               # one reconnect per lifetime
@@ -252,9 +438,8 @@ class _PersistentBroker:
         exe = resolve_mcp_bin()
         if not exe:
             return False
-        argv = [exe]
-        if db:
-            argv += ["--db", db]
+        readonly = read_only()
+        argv = mcp_argv(exe, db)
 
         # Fresh queue per session: a previous reader thread may enqueue an EOF
         # sentinel *after* any drain loop runs, corrupting the new session.
@@ -312,6 +497,7 @@ class _PersistentBroker:
         self._proc = proc
         self._init_resp = resp
         self._db = db
+        self._readonly = readonly
         return True
 
     @staticmethod
@@ -418,16 +604,17 @@ class _PersistentBroker:
 
     def _locked(self, requests: list, *, db: Optional[str], timeout: float) -> dict:
         """Called under self._lock. Returns {id: response}, {} on any failure."""
-        if self._failed:
+        if self._failed or governed_refusal():
             return {}
 
         # Ensure the process is running. Three cases:
         #  (a) First start: no process, no init_resp yet — start freely.
         #  (b) Unexpected death between calls: process gone, init_resp present —
         #      consumes the one reconnect budget; degrade if budget exhausted.
-        #  (c) Planned restart: DB changed while process is still alive —
-        #      close + restart, NOT counted against the reconnect budget.
-        if not self._is_alive() or self._db != db:
+        #  (c) Planned restart: DB or read-only mode changed while the process is
+        #      still alive — close + restart, NOT counted against the budget.
+        mode_changed = self._db != db or self._readonly != read_only()
+        if not self._is_alive() or mode_changed:
             previously_started = self._init_resp is not None
             if not self._is_alive() and previously_started:
                 # Case (b): death between calls.
@@ -435,8 +622,8 @@ class _PersistentBroker:
                     self._failed = True
                     return {}
                 self._reconnect_used = True
-            elif self._is_alive() and self._db != db:
-                # Case (c): DB changed — close old process before restarting.
+            elif self._is_alive() and mode_changed:
+                # Case (c): DB / mode changed — close old process before restarting.
                 self._close()
             if not self._start(db):
                 # Only mark permanently failed when this is a reconnect path
@@ -692,6 +879,42 @@ def knowledge_recall(query: str, token_budget: int = 2000, timeout: float = 8.0)
     return call("knowledge.recall", {"query": query, "token_budget": token_budget}, timeout=timeout)
 
 
+def propose(
+    kind_type: str,
+    payload: dict,
+    facets: Optional[dict] = None,
+    timeout: float = 8.0,
+) -> dict:
+    """Submit one inert proposal → estate `proposal.submit` (the safe write a
+    `--readonly` MCP still permits; it lands `pending` until an operator approves).
+
+    Returns ``{"ok": True, "id": <proposal-id>}`` or ``{"ok": False, "reason": …,
+    "code": <json-rpc code | None>}`` so a caller can tell a shape error (-32602 —
+    fix the args and resubmit) from an unreachable estate (code None — keep the
+    objects in the deliverable file / report instead). `provenance` is NEVER sent:
+    the server stamps it from its own `WICKED_RUN_*` environment.
+    """
+    arguments: dict = {"kind_type": kind_type, "payload": payload}
+    if facets:
+        arguments["facets"] = facets
+    envelope = call_raw("proposal.submit", arguments, timeout=timeout)
+    if envelope is None:
+        return {"ok": False, "reason": "estate unreachable (proposal.submit did not round-trip)",
+                "code": None}
+    error = envelope.get("error")
+    if isinstance(error, dict):
+        return {"ok": False, "reason": error.get("message") or "proposal.submit failed",
+                "code": error.get("code")}
+    result = _unwrap(envelope)
+    if isinstance(result, dict) and result.get("id"):
+        return {"ok": True, "id": result["id"]}
+    text = None
+    content = (envelope.get("result") or {}).get("content") if isinstance(envelope.get("result"), dict) else None
+    if isinstance(content, list) and content and isinstance(content[0], dict):
+        text = content[0].get("text")
+    return {"ok": False, "reason": text or "proposal.submit returned no id", "code": None}
+
+
 def stats(timeout: float = 8.0) -> Optional[dict]:
     """Index summary → the `wicked-estate stats` CLI, parsed to a dict.
 
@@ -735,22 +958,44 @@ def stats(timeout: float = 8.0) -> Optional[dict]:
 
 # ─────────────────────────────────────────────────────────────────────────────
 # CLI — the `wicked-estate-call` entry for non-Python / shell / markdown callers
-#   python3 scripts/_estate_client.py <action> [json-args]
+#   python3 scripts/_estate_client.py [--readonly] [--governed] [--db <path>] <action> [json-args]
 # Prints JSON to stdout; exit 0 always on a clean (even empty) result, 1 only on
 # a usage error. Never crashes a caller.
 # ─────────────────────────────────────────────────────────────────────────────
 
+_USAGE = (
+    "usage: _estate_client.py [--readonly] [--governed] [--db <path>] "
+    "<health|mode|search|context|recall|knowledge-recall|stats|list-tools|call|propose> "
+    "[json-args]"
+)
+
+
 def _emit(obj: Any) -> None:
     sys.stdout.write(json.dumps(obj))
     sys.stdout.write("\n")
 
 
 def main(argv: list) -> int:
+    try:
+        argv = parse_cli_flags(argv)
+    except ValueError as exc:
+        _emit({"error": f"{exc}; {_USAGE}"})
+        return 1
     if not argv:
-        _emit({"error": "usage: _estate_client.py <health|search|context|recall|"
-                        "knowledge-recall|stats|list-tools|call> [json-args]"})
+        _emit({"error": _USAGE})
         return 1
     action = argv[0]
+    if action == "mode":
+        # A pure local probe — reports the mode without spawning, refusal included.
+        _emit({"governed": is_governed(), "marker": governed_marker(),
+               "readonly": read_only(), "store_pinned": store_pinned(),
+               "db": resolve_db(), "refusal": governed_refusal()})
+        return 0
+    refusal = governed_refusal()
+    if refusal:
+        # Fail-open shape (exit 0): a degrade the worker reports, not a crash.
+        _emit({"ok": False, "reason": refusal, "governed": True})
+        return 0
     raw = argv[1] if len(argv) > 1 else "{}"
     try:
         args = json.loads(raw) if raw else {}
@@ -784,8 +1029,17 @@ def main(argv: list) -> int:
             _emit({"error": "call requires {\"tool\": \"<ToolName>\", \"arguments\": {...}}"})
             return 1
         _emit({"result": call(tool, args.get("arguments", {}))})
+    elif action == "propose":
+        kind_type = args.get("kind_type")
+        payload = args.get("payload")
+        if not isinstance(kind_type, str) or not kind_type or not isinstance(payload, dict):
+            _emit({"error": 'propose requires {"kind_type": "memory"|"policy:<type>", '
+                            '"payload": {...}, "facets": {...}?} — never "provenance"'})
+            return 1
+        # `provenance` is deliberately not forwarded (server-stamped from WICKED_RUN_*).
+        _emit(propose(kind_type, payload, args.get("facets")))
     else:
-        _emit({"error": f"unknown action: {action}"})
+        _emit({"error": f"unknown action: {action}; {_USAGE}"})
         return 1
     return 0
 

package/scripts/draft/__init__.py

@@ -0,0 +1,13 @@
+"""wicked-garden `draft` runtime — the self-checks behind the `wicked-garden-draft` skill.
+
+Stdlib-only. Every module is both importable (pure functions the tests drive) and a CLI the
+skill invokes through the launcher (`wicked-garden run scripts/draft/<x>.py …`):
+
+* ``contrast_check``  — WCAG contrast (and a minimum print size) for every text-bearing element,
+                        resolved from the document's own CSS (custom properties, alpha, media).
+* ``page_count``      — rendered page count of a PDF (or a Chrome print of the HTML) against the
+                        brief's page budget; a structural estimate when nothing can render.
+* ``claims_scan``     — placeholders, uncited numbers, hidden mock labels, dangling
+                        ``data-source`` paths and unsourced URLs in the visible text.
+* ``self_check``      — the one command the worker runs before "done": all three, one verdict.
+"""