wicked-garden 12.37.0 → 12.37.1

package/.claude-plugin/components.json

@@ -3,7 +3,7 @@
   "domains": ["agentic", "crew", "data", "engineering", "jam", "mem", "persona", "platform", "product", "qe", "search", "smaht"],
   "summary": {
     "skills": 144,
-    "fork_skills": 75,
+    "fork_skills": 73,
     "hooks": 13,
     "specialists": 7
   },
@@ -103,7 +103,7 @@
     "workflow": ["workflow"],
     "worktrees": ["worktrees"]
   },
-  "fork_skills": ["wicked-garden-agentic-architect", "wicked-garden-agentic-performance-analyst", "wicked-garden-agentic-safety-reviewer", "wicked-garden-archetype", "wicked-garden-classify", "wicked-garden-data-engineer", "wicked-garden-domain-coverage", "wicked-garden-domain-extractor", "wicked-garden-domain-modeler", "wicked-garden-engineering-api-documentarian", "wicked-garden-engineering-conformance-reviewer", "wicked-garden-engineering-debugging", "wicked-garden-engineering-migration-engineer", "wicked-garden-engineering-solution-architect", "wicked-garden-ground", "wicked-garden-integration-discovery", "wicked-garden-jam-brainstorm-facilitator", "wicked-garden-jam-council", "wicked-garden-mem-capture", "wicked-garden-mem-ingest", "wicked-garden-persona-agent", "wicked-garden-platform-compliance-officer", "wicked-garden-platform-privacy-expert", "wicked-garden-platform-security-engineer", "wicked-garden-product-a11y-expert", "wicked-garden-product-requirements-analyst", "wicked-garden-product-ui-reviewer", "wicked-garden-product-ux-designer", "wicked-garden-product-value-strategist", "wicked-garden-qe-a11y-test-engineer", "wicked-garden-qe-acceptance-test-executor", "wicked-garden-qe-acceptance-test-reviewer", "wicked-garden-qe-acceptance-test-writer", "wicked-garden-qe-ai-feature-test-engineer", "wicked-garden-qe-chaos-test-engineer", "wicked-garden-qe-code-analyzer", "wicked-garden-qe-compliance-test-engineer", "wicked-garden-qe-contract-testing-engineer", "wicked-garden-qe-coverage-archaeologist", "wicked-garden-qe-data-quality-tester", "wicked-garden-qe-e2e-orchestrator", "wicked-garden-qe-exploratory-tester", "wicked-garden-qe-flaky-test-hunter", "wicked-garden-qe-fuzz-property-engineer", "wicked-garden-qe-iac-test-engineer", "wicked-garden-qe-incident-to-scenario-synthesizer", "wicked-garden-qe-integration-test-engineer", "wicked-garden-qe-load-performance-engineer", "wicked-garden-qe-localization-test-engineer", "wicked-garden-qe-mutation-test-engineer", "wicked-garden-qe-observability-test-engineer", "wicked-garden-qe-production-quality-engineer", "wicked-garden-qe-release-readiness-engineer", "wicked-garden-qe-requirements-quality-analyst", "wicked-garden-qe-risk-assessor", "wicked-garden-qe-scenario-executor", "wicked-garden-qe-security-test-engineer", "wicked-garden-qe-semantic-reviewer", "wicked-garden-qe-snapshot-hygiene-auditor", "wicked-garden-qe-test-automation-engineer", "wicked-garden-qe-test-code-quality-auditor", "wicked-garden-qe-test-data-manager", "wicked-garden-qe-test-designer", "wicked-garden-qe-test-impact-analyzer", "wicked-garden-qe-test-oracle", "wicked-garden-qe-test-strategist", "wicked-garden-qe-testability-reviewer", "wicked-garden-qe-ui-component-test-engineer", "wicked-garden-qe-visual-regression-engineer", "wicked-garden-runtime-exec", "wicked-garden-smaht", "wicked-garden-swarm", "wicked-garden-wickedizer", "wicked-garden-workflow", "wicked-garden-worktrees"],
+  "fork_skills": ["wicked-garden-agentic-architect", "wicked-garden-agentic-performance-analyst", "wicked-garden-agentic-safety-reviewer", "wicked-garden-archetype", "wicked-garden-classify", "wicked-garden-data-engineer", "wicked-garden-domain-coverage", "wicked-garden-domain-extractor", "wicked-garden-domain-modeler", "wicked-garden-engineering-api-documentarian", "wicked-garden-engineering-conformance-reviewer", "wicked-garden-engineering-migration-engineer", "wicked-garden-engineering-solution-architect", "wicked-garden-ground", "wicked-garden-integration-discovery", "wicked-garden-jam-brainstorm-facilitator", "wicked-garden-jam-council", "wicked-garden-mem-capture", "wicked-garden-mem-ingest", "wicked-garden-persona-agent", "wicked-garden-platform-compliance-officer", "wicked-garden-platform-privacy-expert", "wicked-garden-platform-security-engineer", "wicked-garden-product-a11y-expert", "wicked-garden-product-requirements-analyst", "wicked-garden-product-ui-reviewer", "wicked-garden-product-ux-designer", "wicked-garden-product-value-strategist", "wicked-garden-qe-a11y-test-engineer", "wicked-garden-qe-acceptance-test-executor", "wicked-garden-qe-acceptance-test-reviewer", "wicked-garden-qe-acceptance-test-writer", "wicked-garden-qe-ai-feature-test-engineer", "wicked-garden-qe-chaos-test-engineer", "wicked-garden-qe-code-analyzer", "wicked-garden-qe-compliance-test-engineer", "wicked-garden-qe-contract-testing-engineer", "wicked-garden-qe-coverage-archaeologist", "wicked-garden-qe-data-quality-tester", "wicked-garden-qe-e2e-orchestrator", "wicked-garden-qe-exploratory-tester", "wicked-garden-qe-flaky-test-hunter", "wicked-garden-qe-fuzz-property-engineer", "wicked-garden-qe-iac-test-engineer", "wicked-garden-qe-incident-to-scenario-synthesizer", "wicked-garden-qe-integration-test-engineer", "wicked-garden-qe-load-performance-engineer", "wicked-garden-qe-localization-test-engineer", "wicked-garden-qe-mutation-test-engineer", "wicked-garden-qe-observability-test-engineer", "wicked-garden-qe-production-quality-engineer", "wicked-garden-qe-release-readiness-engineer", "wicked-garden-qe-requirements-quality-analyst", "wicked-garden-qe-risk-assessor", "wicked-garden-qe-scenario-executor", "wicked-garden-qe-security-test-engineer", "wicked-garden-qe-semantic-reviewer", "wicked-garden-qe-snapshot-hygiene-auditor", "wicked-garden-qe-test-automation-engineer", "wicked-garden-qe-test-code-quality-auditor", "wicked-garden-qe-test-data-manager", "wicked-garden-qe-test-designer", "wicked-garden-qe-test-impact-analyzer", "wicked-garden-qe-test-oracle", "wicked-garden-qe-test-strategist", "wicked-garden-qe-testability-reviewer", "wicked-garden-qe-ui-component-test-engineer", "wicked-garden-qe-visual-regression-engineer", "wicked-garden-smaht", "wicked-garden-swarm", "wicked-garden-wickedizer", "wicked-garden-workflow", "wicked-garden-worktrees"],
   "hooks": ["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "PostToolUseFailure", "TaskCompleted", "SubagentStart", "SubagentStop", "PermissionRequest", "Notification", "PreCompact", "Stop", "SessionEnd"],
   "specialists": [
     {

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.37.0"}], "version": "12.37.0"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.37.1"}], "version": "12.37.1"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.37.0",
+  "version": "12.37.1",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), real multi-model second opinions (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": "^0.5.0",
   "wicked_ledger_version": "^0.4.0",

package/.wicked/checks.json

@@ -0,0 +1,4 @@
+{
+  "test": ["node", "scripts/ci/run_pytest.js"],
+  "timeout_s": 1800
+}

package/CHANGELOG.md

@@ -2,6 +2,56 @@
 
 ## [Unreleased]
 
+## [12.37.1] — 2026-09-14
+
+### Changed
+- **`search` and `mem` have ONE way to the estate on every seat and in every session kind — the
+  two-ladder structure and the "human session" branch that routed symbol lookup to an estate MCP
+  tool are DELETED (FIX-IT-ALL L4-⑨b; D1 / D2; F-RC1-045 class in text, wave-1 P6 NO-GO recon Q1 /
+  Q4 #2).** After #1146 the `search` skill still said "resolve … with the estate `SearchEntity`
+  tool", listed "the estate MCP tools when connected" as rung 1 of a *human session* ladder, gated
+  the shim command behind "in a governed run" (a chat is not one), and its description — shown in
+  the skill listing before load — sent symbol lookup to "the wicked-estate MCP's SearchEntity";
+  `mem` gated `--readonly` the same way and called the engine "MCP tools". Now: every graph read
+  and every store read is the read-only shim — `wicked-garden run scripts/_estate_client.py --readonly call '{"tool":"<X>","arguments":{…}}'`, store
+  pinned by `WICKED_ESTATE_DB` / `WICKED_HOME` / `WICKED_MEMORY_DB` — on every seat (claude, codex,
+  pi, copilot, opencode) and in every session kind (a governed run's unit, a chat turn, a human
+  session); `SearchEntity` / `BlastRadius` / `Lineage` / `RankHotspots` / `rules.recall` are named
+  as tools reached through it, never as things to "connect"; the `wicked-estate` CLI is not a rung
+  (write verbs never from a seat, read verbs not how a seat grounds); a seat names the path that
+  answered (`shim` / `ungrounded`). `SearchEntity` `name` (exact / substring symbol) vs `query`
+  (full-text over the knowledge stores; 0 hits for a code symbol) is documented (F-W1-006).
+  `hotspots` / `service-map` / `answer` / `mem/refs/scopes.md` say the same one way. The `search`
+  description fits the 1024-character bound (its `description-too-long` baseline entry is gone —
+  0 stale, nothing added). No word "MCP" survives in `skills/search/**` or `skills/mem/**`.
+- **repo-learn = wicked-crew's three `capture-learnings` units; the deliverable-file fallback is
+  DELETED; one grounding rung (FIX-IT-ALL L4-⑨; D-20 / R13, R12 text; F-RC1-048 C2, F-RC1-049).**
+  `skills/repo-learn/SKILL.md` described FOUR phases while crew's def dispatches THREE units
+  (`churn` / `hotspots` / `capture` — `Phase n/3`), so a unit could not tell which row was its
+  work; the skill now names the three units (hotspots + read = unit 2), says "do only that row's
+  work; proposals are submitted ONLY in the capture unit", and describes the estate SHIM as the
+  one grounding transport (wicked-core ≥ 0.7.26 registers no estate MCP on any seat). The
+  "deliverable file the run names" fallback is gone from `SKILL.md` and
+  `refs/capture-proposals.md` — nothing in wicked-crew ever consumed it, so it promised a record
+  that never existed: on a failed `propose` the fenced `json` block in the unit's OUTPUT is the
+  only record, and counts read `derived N / submitted M / failed K`. The governed ladder in
+  `repo-learn` and `search` collapses to ONE rung — shim in `--readonly`; if it answers
+  `ok: false` or the fence denies the call, write `estate: not available (<reason>)` and continue
+  UNGROUNDED (never a grep approximation as the graph answer, never a retry of a denied call);
+  the read-only CLI stays fence-allowed but is no longer a documented rung. `mem/SKILL.md` and
+  the `_estate_client.py` docstrings now say the `WICKED_RUN_*` markers are stamped on the
+  worker's own environment by both carriers (the primary governed-mode cue) — code unchanged.
+
+- **Wave-2 catalog batch B3 (DES-L6 B5): `swarm` (+ `refs/fan-out`, `recon-synthesis`, `independent-verification`, `receipts-and-evidence`), `worktrees`, `workflow` (+ `refs/integration`) are cross-CLI (fixall L6-B3; D-21 — BC-37 / BC-39; the swarm verifier speaks the D-9 verdict grammar).** Three frontmatters carry the closed key set with `metadata.role: worker` plus `phases` / `archetypes` (`status: stable` and `context: fork` dropped); the three fork-isolation sentences are gone. **Verdict grammar in the swarm verifier wave:** `PARTIAL` is no longer a verdict — `independent-verification.md` renders `PASS / FAIL` and an incomplete or overstated change is FAIL with the gap named; the receipt template's `verdict:` field is `PASS | FAIL`; "never inflate a FAIL-with-a-gap to PASS"; the GAP / PARTIAL / ALREADY-COVERED marks for recon-finding COVERAGE are a different vocabulary and stay. `recon-synthesis.md`'s checkpoint no longer names `AskUserQuestion` (a harness without a native question prompt asks in plain text and waits). `worktrees` describes worktree-isolated agents generically and locates worktrees through `git worktree list` plus `<project state dir>/worktrees/crew-*` — the Claude-specific `.claude/worktrees/agent-*` path and a home-directory example path are gone from the body. `workflow/refs/integration.md`: the `TaskCreate(` / `TaskUpdate(` pseudo-calls become the field list every harness's task list can carry, with one **Hand-off (harness-specific)** paragraph for the Claude Code task-list tools; the three `Skill(skill="wicked-garden-mem", …)` calls are Hand-off paragraphs (store decision, recall, store episode). `tests/cross_cli_baseline.json` shrinks by exactly this batch (11 pairs across 5 files → 305; 0 stale; nothing added); `components.json` unchanged (the three stay workers). **Folded from the B2 review (review-garden-1147):** N1 — the fork-isolation sentence B1 removed from its workers is now gone from `classify`, `ground` and `runtime-exec` too, `classify` no longer says "You are `context: fork`" or cites `allowed-tools`, and `prove` says "never as a hand-off"; N2 — the setup / install / reset question-mode text says the detector keys on the Claude harness's dangerous-mode flag only and every other seat reads PLAIN_TEXT regardless (the detector itself, `scripts/setup/detect_state.py`, is a later L6 item — no tooling change in a text batch); N3 — on wicked-crew ≤ 0.7.35 the translated ROUTERS (`core`, `deliberate`, `prove`, `draft`, `domain`) publish `kind: module` too, not only the workers (fork-first then `user-invocable`; cosmetic — the studio badge; 0 functional consumers) until crew's role-first `skillKindOf` (0.7.36); N4 — `docs/cross-cli-skill-format.md` documents the `Hand-off (harness-specific)` variant; N5 — the `runtime-exec → core/refs/runtime.md` fold is owned by L6's fold/retire batch (wave-2 B10 = DES B12, with mem-capture / mem-ingest / smaht / integration-discovery); N6 — `governed-worker` E1 says an in-tree tee is refused (R7). **Fan-out is role-keyed and runs on every seat (review-garden-1148 H2):** the swarm's implementer and verifier waves are Hand-offs to `wicked-garden-governed-worker` (Creator / Evaluator) or the named verifier skill, one per unit — in parallel where the harness runs parallel sub-agents, **serially otherwise as the sanctioned degradation** (`serial_reason` recorded; each unit's output in its own scratch file); the structural rule that survives every harness is verifier ≠ implementer, and "fork skill" / the model hint are gone. `workflow/refs/integration.md`'s cut `TaskUpdate(` fence is repaired (H1: fences even again; every heading after it renders as a heading) and the remaining task-tool residue (`TaskList()` / `TaskGet(`, the PreToolUse sentences, the persistence path) lives inside the harness-specific Hand-off (M1); the setup PLAIN_TEXT bullet keeps its STOP-and-wait sentence and install's PLAIN_TEXT label says it is the normal mode on every non-Claude seat (N1). BM-style check for the wave-2 P2b/BM re-run: a non-claude seat receives `wicked-garden-swarm` / `wicked-garden-worktrees` / `wicked-garden-workflow` in `skillsSnapshotHanded` with 0 `seatConstraint`, and a swarm verifier unit on that seat ends its receipt with `PASS` or `FAIL` only.
+- **Wave-2 catalog batch B4 (DES-L6 B6): `archetype` + its 8 playbook refs (`build`, `decide`, `incident`, `migrate`, `modernize`, `review`, `ship`, `specify`) are cross-CLI (fixall L6-B4; D-21 — BC-37 / BC-39).** The v11 work-shape playbook dispatcher keeps every archetype's phase shape, produces, HITL discipline and cost band byte-for-byte — only the dispatch prose changes. `archetype/SKILL.md` carries the closed key set with `metadata.role: worker` (what `skill_role()` inferred at HEAD — `components.json`, crew's `skillKindOf` and the AgentProfile registry classify it the same as before); `context: fork`, `user-invocable`, `allowed-tools` and the fork-isolation sentence are gone. The eight refs' gate paragraphs no longer name `wicked-loom` as a "required peer": the gate re-derives **through the garden's in-process gate engine** (`scripts/qe/vault_gate.py` → `scripts/loom/`, which shells `wicked-vault cross-check`), and **wicked-vault is the one required peer** (installed by the `wicked-garden-core` skill's `setup` action); the fail-closed semantics (`gate: "unavailable"`, `satisfied: false`, `--no-require`) are unchanged. `review.md`'s specialist dispatch (`Skill(skill="…")` + the fork sentence) is a **Hand-off** naming the worker skills, and the stale `wicked-garden:jam:council` colon name is the real `wicked-garden-jam-council` skill. `tests/cross_cli_baseline.json` shrinks by exactly this batch (12 pairs across 9 files → 293 after B3's 11; 0 stale; nothing added); `components.json` unchanged. BM-style check for the wave-2 P2b/BM re-run: a non-claude seat receives `wicked-garden-archetype` in `skillsSnapshotHanded` with 0 `seatConstraint`, and an archetype `review` unit on that seat hands off to a worker skill by name (no `Skill(` in its output) while its gate still fails closed without the vault.
+- **Wave-2 catalog batch B5 (DES-L6 B7): the `engineering` domain — the router, `engineering-api-documentarian` / `engineering-conformance-reviewer` / `engineering-migration-engineer` / `engineering-solution-architect`, ten nested knowledge modules and three refs — is cross-CLI; the F-RC1-013 architecture half is closed (fixall L6-B5; D-21 — BC-37 / BC-39).** The router carries the closed key set with `metadata.role: router` (phases `design,build,review`; description ≤ 1024 with the same triggers); the four workers `role: worker` (Claude hints, fork sentences and the pre-v12.25 `Task(subagent_type=…)` compat tails dropped — a worker is reached by name through a Hand-off); the nested modules `role: module` (`portability` / `status` / the `# TODO … Claude Code supports 'paths'` comments dropped) — `engineering/debugging`, the one nested skill that carried `context: fork` and is referenced by name nowhere, is a module too (`.claude-plugin/components.json` regenerated, `fork_skills` 74 → 73). The router's "Fork workers" table is "Workers" with a Hand-off paragraph; the debug step names the `superpowers` plugin's `systematic-debugging` skill where the seat has it and gives the inline loop otherwise; `architecture`'s `TaskCreate(` block is the task-field description pointing at `wicked-garden-workflow`'s `refs/integration.md`; `wicked-garden:platform:security-engineer` → the skill name; "wicked-loom / wicked-vault availability" → "the gate engine / wicked-vault". **F-RC1-013 (architecture half):** `architecture/refs/architecture-template-deployment.md`'s three `../` template links are `<path to …>` placeholders crew's publisher no longer resolves. **Six pre-existing fence breaks repaired** (each made everything after it render as code): a doubled closer (`versioning-breaking-changes`), an unclosed trailing block (`versioning-migration-strategies`), a stray EOF closer (`interface-template-lifecycle`), a stray closer + a 3-backtick wrapper holding 3-backtick blocks → 4-backtick wrapper (`component-template-maintenance`, `refs/docs.md` README template), and `core/SKILL.md`'s wrapped prose line that began with "```json fence for paste)" — a fence opener to any CommonMark renderer (B2's file, folded forward). **Folded from the B4 review (review-garden-1149):** the eight gate paragraphs read "The gate engine ships inside wicked-garden; wicked-vault (the evidence backend) is the one required peer" (N1); the seven plugin colon-form names in `decide` / `build` / `incident` / `migrate` / `modernize` are skill names — the platform ones the `wicked-garden-platform-health` module and the `wicked-garden-platform` skill's `traces` / `incident` actions (N2 — 24 distinct colon names remain catalog-wide; a B18 token or a docs-pass sanction is owed); `review.md` lists the Evaluator section of the `wicked-garden-governed-worker` **floor**, not a "worker skill" (N3); B4's bullet total corrected to 293 after B3. Deferred, owner named: the DES's `conformance-reviewer → ref` fold (with `runtime-exec → core/refs/runtime.md`) lands in L6's fold/retire batch (wave-2 B10 = DES B12); `scripts/platform/guard_pipeline.py:1217` names the skill by name and is unchanged. `tests/cross_cli_baseline.json` shrinks by exactly this batch (28 pairs across 16 files → 265; 0 stale; nothing added). BM-style check for the wave-2 P2b/BM re-run: a non-claude seat receives the router and the four workers in `skillsSnapshotHanded` with 0 `seatConstraint`; an `arch` unit on that seat hands off to `wicked-garden-engineering-solution-architect` by name, and a publish over this garden reports 0 `unresolved-ref` warnings for the architecture template (F-RC1-013 closed on both halves).
+- **Wave-2 catalog batch B6 (DES-L6 B8): the `platform` domain — the router, `platform-security-engineer` / `platform-compliance-officer` / `platform-privacy-expert`, and twelve nested modules — is cross-CLI (fixall L6-B6; D-21 — BC-37 / BC-39).** The router carries the closed key set with `metadata.role: router` (phases `build,review,operate`), its "Fork workers" section is "Workers" with a Hand-off paragraph naming the three worker skills; the workers `role: worker` (Claude hints, fork sentences and the pre-v12.25 `Task(subagent_type=…)` compat tails dropped — reached by name through a Hand-off), and each worker's `TaskUpdate(` findings block is "append the analysis to the current task's description — the harness's task list where it has one (`wicked-garden-workflow`'s `refs/integration.md`), else your working notes" with the description template kept verbatim; the nested modules `role: module` (`peer-health` keeps `bootstrap`; `portability` and the `# TODO … Claude Code supports 'paths'` comments dropped) — `audit` / `compliance` / `prereq-doctor` lose the dispatch fallback sentence, their `TaskUpdate(` one-liners read as task-description appends, their `Skill(skill="wicked-garden-mem", …)` recalls and `prereq-doctor`'s self-dispatch are Hand-off paragraphs, `errors` names the `wicked-garden-engineering-debugging` module instead of a `skills/engineering/debugging/` path (review-garden-1150 N4), and `peer-health` says "no external loom process". `tests/cross_cli_baseline.json` shrinks by exactly this batch (32 pairs across 16 files → 233; 0 stale; nothing added); `components.json` unchanged. BM-style check for the wave-2 P2b/BM re-run: a non-claude seat receives the router and the three workers in `skillsSnapshotHanded` with 0 `seatConstraint`, and a platform `security` unit on that seat hands off to `wicked-garden-platform-security-engineer` by name, recording findings as task text or working notes.
+- **Wave-2 catalog batch B7 (DES-L6 B9): the `product` domain — the router, `product-a11y-expert` / `product-requirements-analyst` / `product-ui-reviewer` / `product-ux-designer` / `product-value-strategist`, nineteen nested modules and two refs — is cross-CLI (fixall L6-B7; D-21 — BC-37 / BC-39).** The router carries the closed key set with `metadata.role: router` (phases `clarify,design,test,review`); its `strategy --focus all` and `ux-review --focus all` steps replace the `Skill(skill="wicked-garden-product-…")` blocks with Hand-off paragraphs naming the worker skills (the ux-review Hand-off carries all three asks, run concurrently where the harness can), `align` persists status in the harness's task list where it has one (`wicked-garden-workflow`'s `refs/integration.md`), else working notes, the `screenshot` action opens the image with the harness's file reader, and "Knowledge modules and fork workers" is "Knowledge modules and workers"; the five workers `role: worker` (Claude hints, fork sentences and the pre-v12.25 `Task(subagent_type="wicked-garden:product:…")` compat tails dropped — reached by name through a Hand-off; `wicked-garden:search` ids read "the `wicked-garden-search` skill"), and each worker's `TaskCreate(` / `TaskUpdate(` findings block is "track / append in the harness's task list where it has one, else your working notes" with the subject and description template kept verbatim in a ```markdown fence; the nested modules `role: module` (phases `clarify,design,review`; `portability` dropped) — `listen` / `requirements-analysis` / `strategy` and the `requirements-example-export-integration` ref lose the dispatch fallback sentence and their `Skill(skill="wicked-garden-mem", …)` store/recall calls are Hand-off paragraphs, their `TaskCreate(` / `TaskUpdate(` blocks read as task-list entries, `screenshot` / `refs/screenshot.md` / `accessibility` / `ux-review` / `product-ui-reviewer` say "the harness's file reader" and "the seat's multimodal vision" instead of the Read tool and Claude's vision, and `accessibility` / `ux-review` / `visual-review` name the `wicked-garden-search` skill. Kept on purpose: `resolve_path.py wicked-garden:product` (a script argument — the store id, not a skill reference), the `{local_root}/wicked-garden:product/voice/…` path segments, and the description trigger phrases (`former /wicked-garden:product:{action} invocation`) — the B18 colon-form token rules on those. `tests/cross_cli_baseline.json` shrinks by exactly this batch (57 pairs across 27 files → 176; 0 stale; nothing added); `components.json` unchanged (no fork skill leaves the set). BM-style check for the wave-2 P2b/BM re-run: a non-claude seat receives the router and the five workers in `skillsSnapshotHanded` with 0 `seatConstraint`, and a product `ux-review --focus all` unit on that seat hands off to `wicked-garden-product-ux-designer`, `wicked-garden-product-ui-reviewer` and `wicked-garden-product-a11y-expert` by name, recording findings as task text or working notes. Review fold (review-garden-1153): the five `Read(file_path=…)` and one `Glob(pattern=…)` pseudo-call fences in `screenshot`, `refs/screenshot.md` and `analyze` read as harness-neutral instructions, the ux-review fan-out reads like the swarm's ("in parallel where your harness runs parallel sub-agents, serially otherwise — record `serial_reason`"), and the portability lint gains an eighth cross-CLI token, `claude-tool-call` (`Read(` / `Write(` / `Edit(` / `MultiEdit(` / `Bash(` / `Glob(` / `Grep(` / `WebFetch(` / `WebSearch(` / `NotebookEdit(` with an argument shape) — the class was lint-blind for two batches; its baseline is empty, every hit was in this batch.
+- **Wave-2 catalog batch B8 (DES-L6 B10): the `data` and `agentic` domains — two routers, `agentic-architect` / `agentic-performance-analyst` / `agentic-safety-reviewer` / `data-engineer`, five agentic knowledge modules and seven refs — are cross-CLI (fixall L6-B8; D-21 — BC-37 / BC-39).** The routers carry the closed key set with `metadata.role: router` (`agentic` phases `design,review`; `data` phases `clarify,design,build`, its description trimmed under 1024 chars and its `# TODO … Claude Code supports 'paths'` hint dropped): `agentic`'s "Heavyweight full review" hands off to the three worker skills — in parallel where the harness runs parallel sub-agents, serially otherwise with `serial_reason` recorded — through a Hand-off paragraph, and `data`'s inline-vs-delegated paragraph hands off to `wicked-garden-data-engineer` the same way (its H1 is "Data Domain", no colon id). The four workers are `role: worker` (Claude hint keys incl. `tool-capabilities` — it resolves into `allowed-tools` — fork sentences and `data-engineer`'s pre-v12.25 `Task(subagent_type=…)` compat tail dropped; `wicked-garden:search` ids read "the `wicked-garden-search` skill"; each `TaskUpdate(` findings block is "append the findings to the current task's description — the harness's task list where it has one, else your working notes" with the template kept verbatim in a ```markdown fence; `agentic-architect`'s ADK checklist says "review how each agent is instantiated" instead of naming `Agent(model=...)`). The two oversized workers shed `skill-too-large`: `agentic-performance-analyst` (721 lines) and `agentic-safety-reviewer` (685 lines) keep their focus, integration, anti-pattern and quick-reference sections and point at new `refs/process.md` (the step-by-step process, incl. the per-strategy optimization template) and `refs/output-format.md` (the report template, now a 4-backtick wrapper because it holds ```-blocks) — 141 / 145 lines after. The five agentic modules are `role: module` (`portability` dropped). Refs: `data/refs/data-examples.md`'s `TaskCreate(` block is a task-list entry; the three pre-existing early-closing template wrappers (`agentic/refs/design.md`, `agentic/review-methodology/refs/issue-taxonomy-quality-testing.md`, `data/refs/ml.md`) are 4-backtick wrappers and leave `FENCE_PAIRING_BASELINE` (7 left). The `claude-dispatch` regex learns that an assignment, constructor or lambda context (`x = Agent(`, `new Agent({`, `lambda: Agent(`, `t = Task(`) is framework code in a sample, not a dispatch — the agentic domain's six CrewAI / AutoGen / ADK sample refs were the only files it mis-flagged (four table rows pin it; a bare `Agent(prompt=…)` still trips). Kept on purpose: the `TaskCreate/TaskUpdate with metadata={…}` prose bullets (no call shape, as in B5–B7), the description trigger phrases, and `agentic/refs/design.md`'s `agentic:review` / `agentic:audit` action shorthands → the B18 colon-form token. `tests/cross_cli_baseline.json` shrinks by exactly this batch (36 pairs across 18 files → 140; 0 stale; nothing added); `components.json` unchanged. BM-style check for the wave-2 P2b/BM re-run: a non-claude seat receives both routers and the four workers in `skillsSnapshotHanded` with 0 `seatConstraint`, and an agentic `review` heavyweight unit on that seat hands off to `wicked-garden-agentic-architect`, `wicked-garden-agentic-safety-reviewer` and `wicked-garden-agentic-performance-analyst` by name, recording findings as task text or working notes. Revision (review-garden-1154): the dispatch-regex lookbehinds apply to the framework-ambiguous `Task(` / `Agent(` only — `Skill(`, `TaskCreate(`, `TaskUpdate(`, `TodoWrite(` trip in every context (BC-38 holds; four adversarial rows pin it); `agentic-architect`'s and `review-methodology/refs/deliverable-templates.md`'s ```markdown wrappers held tagged blocks and swallowed real sections — 4-backtick wrappers now, and the repo pairing walk flags that signature (a bare fence holding both a heading and a tagged fence; two pre-existing files baselined shrink-only); the `tool-capabilities` frontmatter reader in `scripts/_agents.py` and its vacuous test are deleted (0 declarers) — the resolver / registry / bootstrap step 3b / `wg-check` §4b retire in a dedicated follow-up.
+- **Wave-2 catalog batch B2 (DES-L6 B4): the core group — `core` (+ `refs/install`, `report-issue`, `reset`, `setup`, `templates`), `classify`, `deliberate` (+ `refs/run-workflow`), `ground`, `prove`, `runtime-exec` — is cross-CLI (fixall L6-B2; D-21 — BC-37 / BC-39).** Six frontmatters carry the closed key set with `metadata.role` (`router` for `core` / `deliberate` / `prove` with `phases` / `archetypes`; `worker` for `classify` / `ground`; `module` for `runtime-exec`, which is `user-invocable: false` and never dispatched by name — the DES's fold into `core/refs/runtime.md` is a follow-up, not this batch) — `context: fork`, `user-invocable`, `allowed-tools`, `portability`, `phase_relevance`, `archetype_relevance` are gone. Every `Skill(skill="wicked-garden-mem", …)` dispatch (report-issue recall, run-workflow recall + store, setup ingest + three onboarding stores, ground's per-term recall) is now a **Hand-off** paragraph naming the skill and its action; the deliberate `Task(subagent_type="Explore")` block hands its prompt to "your harness's exploration agent" or runs inline; ground's `Agent(Explore)` mentions read the same way; the bus query is a Hand-off to the wicked-bus `query` skill when the bus plugin is present. The setup / install / reset wizards no longer name `AskUserQuestion`: INTERACTIVE mode is "your harness's native question prompt where it has one", PLAIN_TEXT (numbered list, STOP and wait) is the cross-CLI default — the same two modes, same answer verification. `Claude Code` prose is generic ("the host CLI's plugin copy / plugin root", "manual report from the coding-agent session", the four `templates.md` attributions); the one inherently Claude-specific step (setup 6.5, the `.claude/CLAUDE.md` hint block) is a **Hand-off (harness-specific)** paragraph that other seats skip. `wicked-loom` references in `install.md`, `setup.md` and `prove` read "the loom engine / loom package" (the text retires the reference ahead of the CI peer). `.claude-plugin/components.json` regenerated (`fork_skills` 75 → 74: `runtime-exec` is a module). `tests/cross_cli_baseline.json` shrinks by exactly this batch (30 pairs across the 12 files → 316; 0 stale; nothing added). **Also folded from the B1 review (review-garden-1145):** `domain`'s Hand-off drops "(a fresh context)" — the Skill tool no longer isolates once `context: fork` is gone (BC-37); `draft`'s description carries its exact triggers again ("print-ready A4 / Letter", "make it two pages", the 3:1 large-text clause) at ≤ 1024 chars; and, disclosed: on wicked-crew ≤ 0.7.35 the translated workers' snapshot `kind` reads `module` (the studio badge) until crew's role-first `skillKindOf` (PR-L6-3, 0.7.36) — no engine or crew logic reads `kind`. **L4-granted one-liner (review-garden-1146 N4):** `governed-worker` E1 names the notes root as the tee target (`| tee <notes root>/<name>.log`, never into the checkout). BM-style check for the wave-2 P2b/BM re-run: a non-claude seat receives these six skills in `skillsSnapshotHanded` with 0 `seatConstraint`, and a `core` setup on such a seat runs its wizards in PLAIN_TEXT mode end to end.
+- **Wave-2 catalog batch B1 (DES-L6 B3): `draft`, `domain`, `domain-extractor`, `domain-modeler`, `domain-coverage` are cross-CLI (fixall L6-B1; D-21 — BC-37 / BC-39; F-RC1-013 half).** The first translated batch after B0: the five frontmatters carry only the closed key set with `metadata.role` (`router` for `draft` / `domain` with `phases` / `archetypes` replacing the legacy `phase_relevance` / `archetype_relevance`; `worker` for the three domain workers) — `context: fork`, `subagent_type`, `model`, `effort`, `max-turns`, `color`, `allowed-tools`, `user-invocable` are gone (no other CLI, nor wicked-crew / wicked-core, read them); the `domain` router's `Task(subagent_type=…)` dispatch is now the one cross-CLI **Hand-off** paragraph naming the three worker skills; the three workers lose the Claude fork-isolation sentence (the Hand-off keeps their output separate on every seat); the `draft` / `domain` descriptions fit the 1024-character bound (same triggers, tighter wording). `skills/domain/vendor/README.md` names the sibling `wicked-core` checkout without the `../wicked-core/…` path token crew's publisher reported as an `unresolved-ref` warning (F-RC1-013, the domain half; the architecture half rides B7). `tests/cross_cli_baseline.json` shrinks by exactly this batch (9 pairs across the 5 files → 346; 0 stale); no baseline entry added. Classification unchanged: the three workers stay workers (`components.json` in sync), the two routers stay routers. BM-style check for the wave-2 P2b/BM re-run: a non-claude seat (pi / opencode / codex) receives these five skills in `skillsSnapshotHanded` with 0 `seatConstraint`, and a `domain` run hands off to the workers by name.
+- **Worker identity is role-keyed, not fork-keyed: `metadata.role ∈ {worker, router, module, floor}` read by ONE helper, and the lint judges the Claude shape itself (FIX-IT-ALL L6 B0 / PR-L6-2; garden #1132, F-079, the G2 audit's D1–D4, D6–D8, D10).** Twenty-five loaders, registries, resolvers, CI gates, hooks and tests each re-derived "is this a dispatchable worker?" by line-scanning for Claude Code's `context: fork`; drop that key from a skill and it silently vanished from `AgentLoader`, the specialist resolver, `components.json`, the registry validator and `pack check`, while the portability lint REQUIRED the Claude-first shapes (a "when your harness cannot fork" sentence on every fork worker, a dispatch-fallback sentence beside every `Skill(`, a plain-text fallback beside every `AskUserQuestion`, and ≥ 3 fork skills carrying a `subagent_type`). New `scripts/_skill_meta.py` is the one reader: `skill_role(frontmatter)` returns the declared `metadata.role` (an unknown value is `module`, never a silent worker) and, during the transition, infers the legacy keys in wicked-crew's exact `skillKindOf` order (`context: fork` → worker, `user-invocable: true` → router, else module); `parse_frontmatter`/`read_frontmatter` handle the nested `metadata:` mapping; `claude_only_keys` names every top-level key outside the closed cross-CLI set `{name, description, license, compatibility, metadata, mandates}`; `metadata_value` reads `metadata.phases`/`archetypes` with the legacy `phase_relevance`/`archetype_relevance` fallback (the relevance lint accepts either spelling). Every consumer calls it: `_agents.py` (`load_fork_skills` keeps its name, loads role `worker` only), `_validate_registry.py` (registers workers only — never `wicked-garden-governed-worker`), `crew/specialist_resolver.py` (garden and pack walks), `ci/validate.py` (worker frontmatter check; the router/module line cap is role-aware and moves 200 → 500, the same bound as the new `skill-too-large` token; `worker` and `floor` exempt), `ci/sync_components.py` (`fork_skills` keeps its key name), `ci/find_orphan_agents.py`, `pack/check.py` (**PK015** "a router must not be a worker", **PK016** "a `{vendor}-{domain}-{role}`-named skill must declare `metadata.role: worker`" — a role-less worker-shaped skill now FAILS LOUD with the fix named, never a silent drop; **PK020** exempts `worker` + `floor`), `wg/check_conflation.py`, `wg/check_pattern_a_gate.py`, the hooks' docstrings, and the tests (`test_skill_naming`, `test_help_skill_tree` — help entries are exactly the `router` role — `test_skill_dispatch_refs_resolve` — a `Task(` ref resolves to a `worker`; the `>= 3 fork skills` assertion is gone — and the pack suites). `wicked-garden-governed-worker` declares `metadata.role: floor` (kept as a role: handed to every governed unit, never dispatchable, never an AgentProfile, cap-exempt like a worker). **Lint** (`tests/test_skill_portability.py`, `tests/portability_rules.garden.json`): the three fallback tokens `fork-no-fallback` / `dispatch-no-fallback` / `ask-no-fallback` and their sentences are DELETED (the codemod no longer inserts them); seven cross-CLI tokens are added — `claude-frontmatter-key`, `claude-dispatch` (`Task(` / `Skill(` / `Agent(` / `TaskCreate(` / `TaskUpdate(` / `TodoWrite(` / `subagent_type` / `AskUserQuestion`), `claude-only-prose` (tool nouns, `.claude/` paths, "Claude Code" outside a Hand-off paragraph), `handoff-missing`, `retired-product-ref` (wicked-testing / wicked-brain / wicked-signals / wicked-loom without `<!-- historical -->`), `description-too-long` (> 1024 chars), `skill-too-large` (> 500 lines / 24 KiB) — seeded from HEAD into the new `tests/cross_cli_baseline.json` per (token, file): a listed pair is tolerated, an unlisted hit fails, a listed pair that no longer trips is STALE and fails, so each 12.37.x batch shrinks the file in the same change and the strict release (12.38.0) deletes it. `verdict-spelling` and its legacy-footer list are untouched. **Docs**: `docs/cross-cli-skill-format.md` (the closed key set, the role table, the Hand-off paragraph — the one cross-CLI dispatch shape — and the tooling). No skill BODY changes; `components.json` unchanged (75 workers). Rides garden 12.37.x after 12.37.0; the 12.37.x governed batches (B3–B17) depend on it; the strict lint (B18) lands after wicked-core-ts 0.7.26 (L4 ⑨). **Review (review-L6-B):** the baseline test asserts the file's SHAPE only (`generated_from` sha, every token present, every listed file exists) — never a size floor, because the file is shrink-only and a floor would turn CI red on a batch that did exactly what the design asks; `cross_cli.dispatch_regex` requires an argument shape after the paren (a quote, a keyword argument, a brace, `...`/`…`, or the line end of a multi-line call), so the prose plurals `Task(s)` / `Agent(s)` never trip `claude-dispatch`; stale `context: fork` prose in the pack fixture, `check_conflation` / `check_pattern_a_gate` docstrings and the smaht / health-probe comments now reads role-keyed; `docs/cross-cli-skill-format.md` says the skill TEXT retires the `wicked-loom` reference ahead of the peer itself (still the prove gate's CI peer).
+
 ## [12.37.0] — 2026-09-14
 
 ### Changed
@@ -858,5 +908,6 @@ through `v9.2.18`. Major themes across that span:
 
 For each of those releases, see the corresponding tag in git history.
 
-[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.37.0...HEAD
+[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.37.1...HEAD
+[12.37.1]: https://github.com/mikeparcewski/wicked-garden/compare/v12.37.0...v12.37.1
 [12.37.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.36.0...v12.37.0

package/docs/cross-cli-skill-format.md

@@ -0,0 +1,92 @@
+# Cross-CLI skill format
+
+wicked-garden is installed into Claude Code, Codex, OpenCode, Pi and Antigravity by third
+parties and snapshotted by wicked-crew for every seat. Only Claude Code reads Claude Code's
+plugin frontmatter — so a skill's identity, dispatch shape and prose must not depend on it.
+This page is the format; `scripts/_skill_meta.py` is its one reader; the lint
+(`tests/test_skill_portability.py`) enforces it; `tests/cross_cli_baseline.json` lists what
+still has to be translated (12.37.x batches; the strict release deletes the baseline).
+
+## Frontmatter: the closed key set
+
+```yaml
+---
+name: wicked-garden-<dir segments joined by '-'>
+description: "One paragraph. What it does, when to use it. ≤ 1024 characters."
+license: MIT                       # optional
+compatibility: any                 # optional
+mandates:                          # optional — skills this one requires the seat to hold
+  - wicked-garden-core
+metadata:                          # string → string; the ONLY nesting
+  role: worker                     # worker | router | module | floor  (required)
+  phases: "build,review"           # or "*" — replaces the legacy phase_relevance
+  archetypes: "build,modernize"    # or "*" — replaces the legacy archetype_relevance
+---
+```
+
+Exactly these top-level keys: `name`, `description`, `license`, `compatibility`, `metadata`,
+`mandates`. Everything else — `context`, `subagent_type`, `allowed-tools`, `model`, `effort`,
+`max-turns`, `color`, `user-invocable`, `disable-model-invocation`, `tool-capabilities`,
+`phase_relevance`, `archetype_relevance`, `portability`, `status` — is a Claude Code plugin hint
+no other CLI (and neither wicked-crew nor wicked-core) reads; the lint token
+`claude-frontmatter-key` flags it. `metadata` values are strings (`"a,b"` lists, `"*"` for all).
+
+## `metadata.role` — the closed role set
+
+| role | meaning | who reads it |
+|---|---|---|
+| `worker` | a dispatchable specialist (`skills/<domain>-<role>/`); the only role loaders register as an AgentProfile / crew phase worker | `_agents.py`, `_validate_registry.py`, `crew/specialist_resolver.py`, `ci/sync_components.py`, `ci/find_orphan_agents.py`, `pack/check.py` PK015/PK016, hooks |
+| `router` | an operator-facing entry point (`skills/<domain>/SKILL.md`), listed in help | `tests/test_help_skill_tree.py`, `pack/check.py` PK015 |
+| `module` | NOT an entry point: a nested reference module a router/worker pulls in, or a retired redirect stub — the same meaning wicked-crew's `skillKindOf` gives `module` | everyone else, by exclusion |
+| `floor` | a discipline handed whole to every governed unit (`wicked-garden-governed-worker`); never dispatchable, never an AgentProfile, exempt from the router line cap like a worker | `ci/validate.py` cap, `pack/check.py` PK020 |
+
+**Transition inference** (`skill_role()`, mirrors wicked-crew's fallback order): a declared
+`metadata.role` always wins (an unknown value reads `module` — never a silent worker); with none
+declared, `context: fork` → `worker`, `user-invocable: true` → `router`, else `module`. Pack
+authors: a `{vendor}-{domain}-{role}`-named skill with no `metadata.role: worker` **fails**
+`pack check` (PK016) — a worker is never dropped silently.
+
+## Dispatch: the Hand-off paragraph
+
+No `Task(`, `Skill(`, `Agent(`, `TaskCreate(`/`TaskUpdate(`/`TodoWrite(`, `subagent_type` or
+`AskUserQuestion` in a skill body (`claude-dispatch`; for the framework-ambiguous `Task(` / `Agent(` only, an assignment, constructor
+or lambda context — `x = Agent(`, `new Agent({`, `lambda: Agent(` — is framework code in a sample, not a
+dispatch; `Skill(`, `TaskCreate(`, `TaskUpdate(`, `TodoWrite(` trip in every context), and no Claude tool call either — `Read(`,
+`Write(`, `Edit(`, `MultiEdit(`, `Bash(`, `Glob(`, `Grep(`, `WebFetch(`, `WebSearch(`, `NotebookEdit(`
+with an argument shape after the paren (`claude-tool-call`): say what to do with your harness's file
+reader / shell / file search instead. The one cross-CLI dispatch shape is a paragraph that starts with
+`Hand-off` and names the skill:
+
+> **Hand-off** — open the `wicked-garden-qe` skill and run its `review` action with the PLAN path
+> as the argument; on Claude Code this is the Skill tool, on any other seat open the named skill
+> from your catalog and carry it out inline, then continue here.
+
+Inside that paragraph Claude-specific words are allowed; anywhere else a tool noun (`the Read
+tool`), a `.claude/` path or the words `Claude Code` is `claude-only-prose`. A file that dispatches
+without a Hand-off paragraph is `handoff-missing`. A line ending in `<!-- historical -->` is never a
+finding (it documents a retired shape).
+
+**The `Hand-off (harness-specific)` variant.** A step that exists on ONE harness only (the setup
+wizard's `.claude/CLAUDE.md` hint block; the task-list tools' field mapping) is written as a paragraph
+starting `**Hand-off (harness-specific)**` that names the harness, says what it does there and says
+what every other seat does instead (usually: skip it). It hands the step to the harness, not to a
+skill; the same exemption applies inside it. Use it sparingly — a step every seat can do is written
+generically instead.
+
+## Products and size
+
+`wicked-testing`, `wicked-brain`, `wicked-signals` are retired and `wicked-loom` is being replaced — the skill TEXT retires the `wicked-loom` reference ahead of the peer itself (`wicked-loom` stays the prove gate's CI peer in `test.yml` / `tests/qe/test_prove.py` until the prove/loom-cutover seam removes it; DES-L6 B6 / review F3) —
+by the in-process gate — name their successors (the `qe` domain, wicked-estate through the `mem` /
+`search` skills, the built-in gate) or mark the line `<!-- historical -->` (`retired-product-ref`).
+A SKILL.md stays under 500 lines and 24 KiB (`skill-too-large`; `scripts/ci/validate.py` applies
+the same bound to routers and modules); detail goes in `refs/`. Skill-relative paths, the
+`## Runtime` block and the launcher rules from 12.33 are unchanged.
+
+## Tooling
+
+- `python3 tests/test_skill_portability.py` — the report (0 violations, 0 stale baseline entries).
+- `python3 tests/test_skill_portability.py --write-baseline` — regenerate the baseline **at B0
+  only**; afterwards the file only shrinks (a batch deletes the entries it translated; a stale entry
+  fails CI; B18 deletes the file).
+- `python3 scripts/ci/validate.py && python3 scripts/_validate_registry.py` — the release gate,
+  role-aware.

package/hooks/hooks.json

@@ -15,7 +15,7 @@
 
   "_TODO_341_http_hooks": "Issue #341: HTTP hook type (type: 'http') is not supported. When supported, add HTTP hooks for external service integration: POST crew phase transitions to a webhook URL, send gate results to a quality dashboard, notify Slack/Teams on crew project completion. Currently all hooks are type: 'command' (subprocess).",
 
-  "_TODO_344_isolation_worktree": "Issue #344: Skill frontmatter field 'isolation: worktree' is not supported. When supported, add isolation: worktree to the context:fork worker skills that modify files so they operate in separate git worktrees. This would prevent destructive operations (branch switching, file modifications) in one worker from affecting others running in parallel. (The crew-implementer / crew-researcher / crew-reviewer trio this note used to name was retired 2026-09 into the cross-CLI wicked-garden-governed-worker skill, which carries no fork frontmatter.)",
+  "_TODO_344_isolation_worktree": "Issue #344: Skill frontmatter field 'isolation: worktree' is not supported. When supported, add isolation: worktree to the worker skills (metadata.role: worker) that modify files so they operate in separate git worktrees. This would prevent destructive operations (branch switching, file modifications) in one worker from affecting others running in parallel. (The crew-implementer / crew-researcher / crew-reviewer trio this note used to name was retired 2026-09 into the cross-CLI wicked-garden-governed-worker skill, which carries no fork frontmatter.)",
 
   "_TODO_345_once_flag": "Issue #345: The 'once' flag is not documented as a supported hook property. When supported, add \"once\": true to the SessionStart bootstrap hook so it only fires on the first session start, not on reconnects. Currently bootstrap.py handles this by checking session state for staleness.",
 

package/hooks/scripts/bootstrap.py

@@ -292,7 +292,9 @@ def _suggest_auth_fix(probe_result):
 
 
 def _load_agents():
-    """Load dynamic workers (context:fork skills). Returns (agent_count, agents_dict)."""
+    """Load dynamic workers (skills whose role is ``worker`` — ``metadata.role: worker``,
+    legacy ``context: fork`` inferred by ``_skill_meta.skill_role``). Returns
+    (agent_count, agents_dict)."""
     try:
         from _agents import AgentLoader
         loader = AgentLoader()

package/hooks/scripts/subagent_lifecycle.py

@@ -176,9 +176,9 @@ def _parse_specialist_from_agent_type(agent_type: str, specialist_domains: set):
       the legacy ``subagent_type`` frontmatter). The domain must be a
       known specialist domain (``specialist_domains`` from
       ``specialist.json``) for the engagement tracker to accept it.
-    * Fork-skill name: ``wicked-garden-{domain}-{role}`` — resolved by
+    * Worker-skill name: ``wicked-garden-{domain}-{role}`` — resolved by
       :mod:`crew.specialist_resolver`, which walks ``skills/**/SKILL.md``
-      (context: fork) frontmatter.
+      frontmatter and keeps role ``worker`` (``_skill_meta.skill_role``).
     * Bare role: ``requirements-analyst`` — resolved the same way. This
       is the path the facilitator emits by default.
 
@@ -203,8 +203,8 @@ def _parse_specialist_from_agent_type(agent_type: str, specialist_domains: set):
 
         return domain, agent_name
 
-    # Fork-skill-name or bare-role path (Issue #573): resolve via
-    # skills/**/SKILL.md (context: fork) frontmatter. Fail-closed to the
+    # Worker-skill-name or bare-role path (Issue #573): resolve via
+    # skills/**/SKILL.md frontmatter (role worker). Fail-closed to the
     # old behavior on any resolver error — engagement tracking is
     # best-effort and the hook must never block the agent.
     try:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.37.0",
+  "version": "12.37.1",
   "type": "module",
   "description": "Curated toolkit for what AI coding agents can't do alone: evidence-gated work, codegraph relationships, deterministic multi-file refactor, multi-model second opinions, and cross-session memory. Installs as a Claude Code plugin.",
   "keywords": [

package/scripts/_agents.py

@@ -1,12 +1,15 @@
 #!/usr/bin/env python3
 """
-_agents.py — Dynamic fork-skill (worker) loader.
+_agents.py — Dynamic worker-skill loader.
 
 The plugin is skills-only: the former agents/{domain}/*.md worker definitions
-now live as standalone skills at skills/<domain>-<role>/SKILL.md with
-``context: fork`` frontmatter. This loader scans skills/**/SKILL.md and loads
-every fork-context skill as an AgentProfile (name/domain/system_prompt/
-capabilities), preserving the profile shape downstream consumers expect.
+now live as standalone skills at skills/<domain>-<role>/SKILL.md whose role is
+``worker`` (``metadata.role: worker``; the legacy ``context: fork`` is inferred
+by ``scripts/_skill_meta.skill_role`` during the cross-CLI transition). This
+loader scans skills/**/SKILL.md and loads every WORKER skill as an AgentProfile
+(name/domain/system_prompt/capabilities), preserving the profile shape
+downstream consumers expect. Routers, modules and the ``floor`` skill
+(``wicked-garden-governed-worker``) are never AgentProfiles.
 
 Usage:
     from _agents import AgentLoader
@@ -22,6 +25,13 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
 
+# scripts/ is not always on sys.path (hooks import by path; CI runs from a subdir).
+try:
+    from _skill_meta import skill_role
+except ImportError:  # pragma: no cover - path setup only
+    sys.path.insert(0, str(Path(__file__).resolve().parent))
+    from _skill_meta import skill_role
+
 # ---------------------------------------------------------------------------
 # AgentProfile dataclass
 # ---------------------------------------------------------------------------
@@ -80,13 +90,16 @@ class AgentLoader:
     # ------------------------------------------------------------------
 
     def load_fork_skills(self, skills_dir: Path) -> dict[str, AgentProfile]:
-        """Scan skills_dir recursively for SKILL.md files declaring
-        ``context: fork`` and load each as an AgentProfile.
+        """Scan skills_dir recursively for SKILL.md files whose role is
+        ``worker`` (``metadata.role: worker``, or the legacy ``context: fork``
+        inferred by ``_skill_meta.skill_role``) and load each as an
+        AgentProfile. Routers, modules and the ``floor`` skill are skipped —
+        only a worker is dispatchable. The method keeps its historical name.
 
         Each SKILL.md must have YAML frontmatter with at least a `name`
         field. Additional recognized frontmatter keys: domain, description,
         capabilities (list), traits (list), model, color, effort, max-turns,
-        allowed-tools, tool-capabilities.
+        allowed-tools.
 
         The body of the SKILL.md (after frontmatter) becomes system_prompt.
 
@@ -170,14 +183,16 @@ _FRONTMATTER_END = "---"
 
 
 def _parse_agent_md(path: Path, fork_only: bool = False) -> AgentProfile | None:
-    """Parse a worker SKILL.md (context: fork) into an AgentProfile.
+    """Parse a worker SKILL.md (role ``worker``) into an AgentProfile.
 
     Format:
         ---
         name: wicked-garden-engineering-solution-architect
         description: |
           Optional description
-        context: fork                # required when fork_only=True
+        metadata:
+          role: worker               # required when fork_only=True (legacy
+                                     # ``context: fork`` is inferred)
         domain: engineering          # optional
         capabilities:                # optional list
           - code-review
@@ -193,7 +208,7 @@ def _parse_agent_md(path: Path, fork_only: bool = False) -> AgentProfile | None:
 
     Returns:
         AgentProfile, or None if the file lacks a valid name field or
-        (when fork_only) does not declare ``context: fork``.
+        (when fork_only) its role is not ``worker``.
     """
     try:
         raw = path.read_text(encoding="utf-8")
@@ -203,7 +218,7 @@ def _parse_agent_md(path: Path, fork_only: bool = False) -> AgentProfile | None:
     frontmatter, body = _split_frontmatter(raw)
     if frontmatter is None:
         if fork_only:
-            # A worker must declare context: fork in frontmatter
+            # A worker declares its role in frontmatter (metadata.role: worker)
             return None
         # No frontmatter — use filename as name, whole file as system_prompt
         name = path.stem
@@ -216,7 +231,8 @@ def _parse_agent_md(path: Path, fork_only: bool = False) -> AgentProfile | None:
         )
 
     parsed = _parse_simple_yaml(frontmatter)
-    if fork_only and parsed.get("context") != "fork":
+    # ONE reader of role: metadata.role first, legacy context: fork inferred.
+    if fork_only and skill_role(frontmatter) != "worker":
         return None
     name = parsed.get("name") or (path.parent.name if path.name == "SKILL.md" else path.stem)
     if not name:
@@ -231,11 +247,6 @@ def _parse_agent_md(path: Path, fork_only: bool = False) -> AgentProfile | None:
     extra_meta["source"] = "disk"
     extra_meta["file"] = str(path)
 
-    # Extract tool-capabilities for capability-based dynamic tool routing
-    tool_caps = _to_list(parsed.get("tool-capabilities"))
-    if tool_caps:
-        extra_meta["tool_capabilities"] = tool_caps
-
     # Parse allowed-tools into a list for the resolver
     allowed_tools_list = _to_list(parsed.get("allowed-tools"))
     if allowed_tools_list:

package/scripts/_estate_client.py

@@ -43,15 +43,15 @@ never through the raw write CLI. In that mode every spawn is
 * ``--readonly`` is spelled literally — the MCP detects read-only by the exact
   token and refuses every write tool except the safe ``proposal.submit``.
   Read-only is on when a governed-unit marker is present (`GOVERNED_MARKERS`:
-  `WICKED_RUN_ID`, or the fence env the wrapped carrier sets on the worker —
-  `WICKED_GATE_SCOPE` / `WICKED_WRITE_ROOTS`), when the caller passed
-  ``--governed`` / ``--readonly`` on the backend argv (`parse_cli_flags` /
-  `set_governed` / `set_readonly`), or when ``WICKED_GOVERNED`` /
-  ``WICKED_ESTATE_READONLY`` is truthy. The markers are a CONFIRMATION, not
-  the definition: the skill text defines governed mode by the handed context
-  (a phase directive / the governed-worker skill), because no carrier stamps
-  `WICKED_RUN_ID` on the worker's own environment today and the ACP carrier
-  hands the child none of the fence env.
+  `WICKED_RUN_ID` — stamped on the worker's OWN environment by BOTH carriers
+  since wicked-core 0.7.26 (R12, `stamp_run_markers`), the PRIMARY cue — or
+  the fence env the wrapped carrier sets on the worker, `WICKED_GATE_SCOPE` /
+  `WICKED_WRITE_ROOTS`), when the caller passed ``--governed`` / ``--readonly``
+  on the backend argv (`parse_cli_flags` / `set_governed` / `set_readonly`), or
+  when ``WICKED_GOVERNED`` / ``WICKED_ESTATE_READONLY`` is truthy (wicked-core
+  sets ``WICKED_ESTATE_READONLY=1`` on every worker child since 0.7.26, D-7).
+  The skill text's handed-context definition (a phase directive / the
+  governed-worker skill) CONFIRMS what the markers say.
 * The store must be PINNED: ``--db <path>`` on the backend argv, or
   ``WICKED_ESTATE_DB`` / ``WICKED_HOME`` / ``WICKED_MEMORY_DB`` in the worker
   environment. In a governed run an unpinned store is REFUSED (no spawn,
@@ -167,16 +167,16 @@ def resolve_db() -> Optional[str]:
 # ─────────────────────────────────────────────────────────────────────────────
 
 # Governed-unit markers — any of these non-empty in the environment means "you are a
-# unit of a wicked-crew run". `WICKED_RUN_ID` is what wicked-core stamps on the estate
-# MCP SERVER's launch env (`estate_provenance_env`), not on the worker's own Command env,
-# so on its own it is an unreliable cue inside a unit (garden #1134 HIGH-1). The fence
-# env the WRAPPED carrier does set on the worker Command is the reliable marker there —
-# wicked-core main `ad9a0c1`, `src/execute_wrapped.rs:853` (`WRITE_ROOTS_ENV` =
-# "WICKED_WRITE_ROOTS", `src/gate_hook.rs:114`) and `:863` (`GATE_SCOPE_ENV` =
-# "WICKED_GATE_SCOPE", `src/gate_hook.rs:56`). The ACP carrier hands its child none of
-# these today (`gate_hook.rs` `estate_store_pinned_for_child`), which is why the skill
-# text defines governed mode by the HANDED CONTEXT and `--governed` / WICKED_GOVERNED=1
-# let a seat (or a launcher) say so explicitly.
+# unit of a wicked-crew run". `WICKED_RUN_ID` (with `WICKED_RUN_UNIT` / `WICKED_RUN_AGENT`)
+# is stamped on the worker's OWN Command env by BOTH carriers since wicked-core 0.7.26
+# (`execute_wrapped::stamp_run_markers`, DES-L4 PR-③ / R12) and inherited by this shim and
+# the `wicked-estate-mcp` it spawns (which stamps `proposal.submit` provenance from it) —
+# the PRIMARY marker (it closes garden #1134 HIGH-1: before 0.7.26 only the estate MCP
+# server's launch env carried it). The fence env the WRAPPED carrier also sets on the
+# worker Command stays a second marker (`WICKED_WRITE_ROOTS` / `WICKED_GATE_SCOPE`); the
+# ACP carrier sets the run markers and `WICKED_ESTATE_DB` / `WICKED_ESTATE_READONLY` on
+# its child too. `--governed` / WICKED_GOVERNED=1 let a seat (or a launcher) say so
+# explicitly, and the skill text's handed-context definition confirms it.
 GOVERNED_RUN_ENV = "WICKED_RUN_ID"
 GOVERNED_MARKERS = (GOVERNED_RUN_ENV, "WICKED_GATE_SCOPE", "WICKED_WRITE_ROOTS")
 GOVERNED_ENV = "WICKED_GOVERNED"              # explicit override (any truthy value)