wicked-garden 12.38.1 → 12.40.0

package/.claude-plugin/components.json

@@ -1,8 +1,8 @@
 {
   "_comment": "Issue #328: Component declarations for wicked-garden plugin. Claude Code plugin.json does not yet support inline component declarations beyond path overrides. This manifest documents all components for tooling, validation, and future schema support. When plugin.json gains a 'components' field, merge this data into plugin.json. The plugin is skills-only: former commands/ became actions of consolidated per-domain skills, and former agents/ became standalone context:fork worker skills (enumerated under fork_skills). Regenerate derived blocks with scripts/ci/sync_components.py.",
-  "domains": ["agentic", "crew", "data", "engineering", "jam", "mem", "persona", "platform", "product", "qe", "search"],
+  "domains": ["agentic", "crew", "data", "demo", "engineering", "jam", "mem", "persona", "platform", "product", "qe", "search"],
   "summary": {
-    "skills": 133,
+    "skills": 136,
     "fork_skills": 69,
     "hooks": 13,
     "specialists": 7
@@ -18,6 +18,7 @@
     "data": ["data"],
     "data-engineer": ["data-engineer"],
     "deliberate": ["deliberate"],
+    "demo": ["demo"],
     "domain": ["domain"],
     "domain-coverage": ["domain-coverage"],
     "domain-extractor": ["domain-extractor"],
@@ -32,6 +33,8 @@
     "jam": ["jam"],
     "jam-brainstorm-facilitator": ["jam-brainstorm-facilitator"],
     "jam-council": ["jam-council"],
+    "mcp": ["mcp"],
+    "mcp-scaffold": ["mcp-scaffold"],
     "mem": ["mem"],
     "mem-capture": ["mem-capture"],
     "mem-ingest": ["mem-ingest"],

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.38.1"}], "version": "12.38.1"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.40.0"}], "version": "12.40.0"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.38.1",
+  "version": "12.40.0",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), real multi-model second opinions (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": "^0.5.0",
   "wicked_ledger_version": "^0.4.0",

package/.gitattributes

@@ -1,2 +1,5 @@
 # Windows command twins must keep CRLF line endings; everything else stays LF.
 *.cmd text eol=crlf
+
+# Pack editor fixtures are pinned by sha256: never rewrite their line endings.
+tests/fixtures/packs/**/editors/** -text

package/CHANGELOG.md

@@ -2,6 +2,34 @@
 
 ## [Unreleased]
 
+## [12.40.0] — 2026-10-02
+
+### Added
+- **QE ledger rows name the governed crew run they were written in (WT-G4, DES-walkthrough-proof §4.14).** Inside a wicked-crew run (`WICKED_RUN_ID` set), the qe-runner's `runs` row (`scripts/qe/runner/src/evidence.mjs`), the gate's `verdicts` row (`scripts/qe/lib/gate.mjs`), the accept playbook's run and verdict rows and every QE specialist's verdict write carry a top-level `crew_run_id`, so crew's acceptance reader attributes the QE run `kind: 'stamped'` instead of inferring it from the run's lifetime. Outside a governed run nothing is stamped. One helper, `scripts/qe/lib/crew-run.mjs`.
+- **`mem`: the decision-report codebook for wicked-crew's chat recorder (DC-S5, DES-decision-capture §4.3.3).** `skills/mem/refs/decision-report.md` (under 2 KB, strict frontmatter) tells a chat seat how to end its reply with a fenced `wicked-decisions` JSON block: `quote`, `decision_text`, `type`, `codify`, `ambiguous`, `steering_type`, `approves_proposal`, `same_as`. The unit is the (previous reply, operator message) pair: when the operator approves or picks from the seat's proposal, `decision_text` is written from the approved proposal plus any amendment, never from the operator's short wording. Labels are suggestions; crew decides what is remembered. `tests/mem/test_decision_report_codebook.py` pins the size, the parse, the vocabulary and the pair rule, plus a local-only copy guard against the operator corpus.
+- **Packs: `wicked-pack.json` spec 2 with `editors[]` and `blocks[]`, and `pack check` for them (EP-G1, DES-artifact-editor-plugins §5.2).** A spec-2 manifest keeps every spec-1 field and adds artifact editors (one self-contained HTML entry inside the pack, pinned by sha256, with kinds, sizes, protocol and permissions, each with its reason) and blocks (the preset that produces the pack's kind, with the pack skills it uses). `domains` becomes optional when `editors` is present. Spec-1 packs stay valid. `pack check` gains PK060–PK072, one code and message per refusal: the entry escaping the pack (including by symlink), not one `.html` file, over its limit or the host's 5 MiB cap, a hash mismatch, a script/stylesheet/frame loaded from outside the file, an unknown kind/size/permission or one without its "why", a malformed block, a block naming a skill the pack does not ship. A `wicked`/`wicked-*` editor id is refused in every pack, and since this is a structural check, `pack register --force` refuses it too. The JSON schema matches, and now accepts the `$schema` key its own fixture already carried.
+
+### Changed
+- **Demo recorder: the fixture origin is the one write door, and a failed take keeps its evidence (WT-G1, DES-walkthrough-proof).** `scripts/demo/readonly.mjs` `armGuard(context, { writableOrigin })` replaces `armReadOnly`: with `record.mjs --fixture-origin <origin>` (a loopback http(s) origin you started for the recording; anything else is refused before recording), writes and page WebSocket frames to exactly that origin pass, and every other write is still aborted and listed. With no fixture origin a recording stays fully read-only. The environment switch that lifted the guard is deleted. A take that fails now keeps its timeline, a video built from the frames it has, and `failure.json` (error, blocked requests, `failed_at_sec`) under `segments/<key>/failed-<take>/`; the stitch and `--reencode` refuse a segment whose last take failed (`failed_take`). `guard.json` gains `take`, `failed` and `writableOrigin`; `recording.json` labels a segment `fixture-writable`.
+
+## [12.39.0] — 2026-09-29
+
+### Added
+- **`repo-learn` + `governed-worker`: a capture unit ends with a machine-readable capture report (wicked-core#535, BC-80).** A capture-learnings run whose skill loaded but never ran produced 0 proposals and reported `completed` — nothing told that apart from a repository with nothing worth capturing. The capture unit's output now ends with `wicked-capture-report {"derived": N, "submitted": M, "failed": K}`, **always**, including a degrade and a legitimate 0 (an honest `0/0/0` is a pass). A proposal counts as `submitted` only when the shim answered `{"ok": true, …}`, so `submitted` below `derived`, or any `failed`, is the loss the engine's capture-report floor stops — the derived items are in the unit's fenced `json` block and a human must act on them. Stated in `skills/repo-learn/SKILL.md` ("In a governed run" step 3 and the degrade rules), `skills/repo-learn/refs/capture-proposals.md` and `governed-worker` A4, so every carrier of the honest-counts rule spells it the same way.
+- **`mcp` skill: a governed unit reaches MCP tools through the wicked-crew broker on every seat (DES-MCP-TOOLS-001 S4).** `scripts/mcp/shim.py list` answers the tools the unit's capability token (`WICKED_MCP_TOKEN`) may try, each with its class and whether a call runs (`allow`) or waits for approval (`ask`); `scripts/mcp/shim.py call mcp:<server>/<tool> --args JSON` sends the call to the broker (`WICKED_CREW_URL`, `POST /api/v1/mcp/call`) and prints its answer. It prints one JSON object and exits by outcome: `0` ok, `3` denied or withheld, `4` pending approval, `5` unavailable (budget, breaker, upstream), `2` no MCP channel or bad arguments, `1` anything else. The token is never printed. Standard library only. `skills/mcp/SKILL.md` names the commands, the exit codes and the rules (only through the broker, the token is a credential, a denied call is final); `tests/mcp/test_mcp_shim.py` pins the shim against a broker-shaped HTTP server.
+- **`mcp-scaffold` skill: build an MCP server the wicked-crew broker can register and govern (DES-MCP-TOOLS-001 S5b).** `skills/mcp-scaffold/` ships two zero-dependency stdio templates (`assets/node/server.mjs`, `assets/python/server.py`) that answer `initialize` (with version negotiation), `ping`, `tools/list` and `tools/call`, with one read and one write example tool. `scripts/mcp/scaffold.py` stamps a template into a directory and never overwrites; `scripts/mcp/probe.py` spawns any stdio server with a minimal environment, runs `initialize` + `tools/list` (following `nextCursor`) and derives each tool's class the way the broker does (`readOnlyHint: true` is read, `destructiveHint` absent or true is destructive, otherwise write; no annotations is write). The skill states the rules the broker relies on: honest annotations, secrets only from the injected environment, stdout for protocol frames only, and first-use approval before any call runs. `tests/mcp/test_mcp_scaffold.py` proves both templates answer initialize + tools/list in CI.
+
+- **Demo recorder is read-only against the app it films (wicked-studio#373, wicked-crew#565).** `scripts/demo/readonly.mjs` aborts every request that is not GET/HEAD/OPTIONS, and every WebSocket frame the page sends, while `record.mjs` records; the segment then fails `side_effect_blocked`, naming each, even when the blocked write made the storyline's own wait time out. A blocked or failed take is never kept as video: it leaves only its `guard.json` (no `segment.mp4`, no `timeline.json` for `--reencode` to rebuild from), and `--reencode` and `--stitch` refuse to run while any segment's last take was blocked, so it is never rebuilt, stitched, or quietly left out. A read-only recording blocks service workers, whose requests the guard's routes would not see. `recording.json` says `readOnly` only when every stitched segment's guard blocked nothing. `DEMO_ALLOW_WRITES=1` lifts the guard, for disposable targets only. Each segment writes `guard.json`, and the stitch writes `recording.json` (`readOnly` is true only when every stitched segment was recorded read-only). `tests/demo/test_readonly_recorder.py` proves no write reaches a local app whose submit button the storyline presses.
+
+### Fixed
+- **`claims_scan.py` #1184: the citation rule is now written down and implemented once — a `data-source="path:N"` asserts the text of THE ELEMENT THAT CARRIES IT and is verified against that element's own text, never a sibling's and never a wider block.** Every carrier of a line citation is checked against its own `all_text()`: the element, each inline wrapper between it and its block (previously dropped entirely), and the block. The dedup key is `(source, id(carrier))`, so two inline siblings carrying the same source are two checks against two texts — the layer-5 skip, where a wrong citation on one `<span>` was satisfied by its sibling's text, is gone. Verification now needs a CONTENT word in common (a `STOPWORDS`-only overlap verifies nothing and is reported as such), and a range `path:N-M` is scored against the best span of ITS OWN WIDTH instead of against single lines, so a wide range no longer ties its way to a pass; a verified range is counted and disclosed separately (`cited_ranges`, in the summary as "N by line range"). `add()`'s dedup key gained the detail, so two different bad citations on one element are two findings and `stats["cite_off"]` can no longer disagree with the findings list. The rule is stated in the module docstring, beside `_check_cite_off`, and in `skills/draft/refs/claims.md`. Both sides of the span comparison are scored on CONTENT tokens, so a line sharing nothing but "it is" can no longer outscore the cited line that carries the claim's one content word (which reported a correct citation as `cite-off`), and the finding dedup keys on NODE IDENTITY rather than `path()` — which carries no sibling index — so two sibling carriers with the same text and the same bad source are two findings.
+- **`claims_scan.py` cite-off dedup: this file has now produced the same defect class at three layers — `return None` meaning "verified", then the double-report, then this sibling skip (keying the dedup on `path()` instead of node identity) — each fix introducing the next; the next reader should approach this code expecting that pattern.**
+- **`claims_scan.py` #1178: a `data-source="path:N"` whose line number is past end-of-file (or ≤ 0) is now a `cite-off` finding instead of silently clamping to the last line and reporting clean.** Both the single-line spec `N` and the range spec `N-M` fail closed when `N > len(lines)`, `N < 1`, or (for the range) `M > len(lines)`, with a detail naming the real file length (e.g., `"data-source README.md:9999 is past end of file (3 lines)"`).
+- **`claims_scan.py` #1179: a citation whose overlap with the block text is beaten by a strictly higher-scoring line elsewhere in the file is now a `cite-off` finding instead of silently passing on shared stopwords.** A block whose true text is on line 1, cited at line 2, where the two lines share only stopwords (`"is"`, `"the"`, `"for"`), now produces `cite-off`. The cited line must be the best or tied-best match to pass; the hint message names the nearest-match line.
+- **`claims_scan.py` #1181 (three sub-cases): `_check_cite_off` now distinguishes VERIFIED (`""`) from COULD-NOT-VERIFY (`_UNVERIFIABLE` sentinel), which the caller treats as a `cite-off` finding. `None` means path-only citation (no `:N` suffix, nothing to verify); `""` means verified clean.** Could-not-verify cases that previously returned `None` and incremented `cited_lines`: (A) an inline-wrapped citation — `<li data-source="README.md:1"><span>text</span></li>` — is now resolved through the enclosing block's `all_text()` and the block's own direct `data-source` attributes, so the invisible citation is checked against the full block text; (B) a block whose token set is all single characters (e.g. `"7"`) now keeps digit tokens (`len(t) >= 2 or t.isdigit()`), and an empty set after filtering fails closed per the sentinel; (C) a `data-source` that names a directory no longer passes the `is_file()` check, and an `OSError` on one repo now `continue`s to the next rather than aborting the entire search.
+- **`claims_scan.py`: a `data-source="path:N"` on an existing file now verifies that the cited lines carry the block's own text — a mismatch is reported as `cite-off` ("data-source README.md:7 does not carry this text — nearest match: line 4") and fails the floor exactly like `dangling-source` (#1176).** Path-only citations remain valid; inherited (ancestor-level) citations are not checked for line content — only per-element citations are verified. The summary line gains `cited_lines (N cite-off)` counts. `skills/draft/SKILL.md` §3 Grounded now instructs authors to re-open the file at the line before writing the citation, and the verdict table's FAIL row lists `cite-off`. `self_check.py` surfaces `cite-off` automatically (it calls `claims_scan.run`).
+- **`scripts/ci/validate.py` judges the checkout you asked about, not every tree nested inside it (#1180, second half).** Check 8 walked `root.glob("**/*.json")`, which descends into gitignored scratch (`tmp/` held 11,518 files after run `b7084e9d`) and into nested checkouts — governed-run worktrees are created inside the repo — so an operator running the validator in a run worktree got exit 1 with 5 errors that were pytest's deliberately-malformed fixtures and another tree's files: a failure a correct tree could not avoid, whose obvious wrong fix was to edit the fixtures. The file list now comes from git's own view of the tree (`ls-files --cached --others --exclude-standard`), which is exactly "tracked, or new and not ignored" and reports a nested repository as one opaque entry instead of walking into it; outside a git work tree the filesystem walk remains, now with a warning that says scratch and nested checkouts cannot be excluded. `validate.py` also takes `--root <checkout>` so the tree under judgement can be named (the default is unchanged). `tests/test_validate_scope.py` rebuilds the incident tree and pins both halves, including that the pre-fix glob DOES report the two foreign files. The first half of #1180 (`tmp/` unignored) landed in #1182.
+
 ## [12.38.1] — 2026-09-15
 
 ### Fixed
@@ -933,7 +961,9 @@ through `v9.2.18`. Major themes across that span:
 
 For each of those releases, see the corresponding tag in git history.
 
-[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.38.1...HEAD
+[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.40.0...HEAD
+[12.40.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.39.0...v12.40.0
+[12.39.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.38.1...v12.39.0
 [12.38.1]: https://github.com/mikeparcewski/wicked-garden/compare/v12.38.0...v12.38.1
 [12.38.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.37.2...v12.38.0
 [12.37.2]: https://github.com/mikeparcewski/wicked-garden/compare/v12.37.1...v12.37.2

package/docs/extending.md

@@ -80,6 +80,23 @@ A complete working example (used as garden's own e2e fixture):
 7. **Events** (if you emit them): 4-segment
    `wicked.<domain>.<noun>.<past-verb>` — bus SPEC.md is the authority.
 
+### Spec 2: editors and blocks
+
+Manifest `spec: 2` keeps every spec-1 field and adds two arrays. A spec-1 pack stays valid as it is.
+
+- `editors[]`: artifact editors the pack ships. Each one is **one self-contained HTML file** inside the
+  pack (`entry`), pinned by its `sha256`, with an `id`, a plain-words `title`, its own `version`, the
+  `protocol` versions it speaks, the artifact `kinds` it opens, the `sizes` it supports (`inline` is
+  required), and the `permissions` it asks for, each with a `why` shown at install. An optional
+  `limits.bundleBytes` may only be lower than the host's cap (5 MiB). With `editors` present, `domains`
+  is optional: an editor-only pack ships no skills.
+- `blocks[]`: the block that **produces** the pack's kind: an `id`, a `label`, a `preset` JSON file
+  inside the pack, the `produces_kind`, and the pack `skills` it uses (approved together at install).
+
+`wicked` and `wicked-*` editor and block ids are refused in every pack: first-party editors ship inside
+wicked-studio and first-party blocks are core presets. Example (garden's own spec-2 fixture):
+[`tests/fixtures/packs/acme-terms/`](../tests/fixtures/packs/acme-terms/).
+
 ## Validate: the shipped conformance gate
 
 ```bash
@@ -90,8 +107,9 @@ npx wicked-garden pack check ./acme-seo-pack --json   # CI
 Exit 0 = conformant (warnings allowed), 1 = errors. The gate checks the
 manifest, router/worker shape, naming, disclosure tiers, NOT-THIS-WHEN
 reciprocity, produces contracts (archetype names must exist in garden's
-catalog), and peer-floor syntax — rule codes PK001–PK050, each with an
-actionable message. It runs anywhere Python ≥ 3.10 exists; no garden install
+catalog), peer-floor syntax, and for spec 2 every editor (inside the pack, one `.html` file, its
+hash, its size, nothing loaded from outside it, kinds, sizes, permissions) and block (preset file,
+produced kind, pack skills): rule codes PK001–PK072, each with an actionable message. It runs anywhere Python ≥ 3.10 exists; no garden install
 required (`scripts/pack/check.py` ships in the npm package).
 
 ## Install + register

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.38.1",
+  "version": "12.40.0",
   "type": "module",
   "description": "Curated toolkit for what AI coding agents can't do alone: evidence-gated work, codegraph relationships, deterministic multi-file refactor, multi-model second opinions, and cross-session memory. Installs as a Claude Code plugin.",
   "keywords": [

package/schemas/wicked-pack.schema.json

@@ -1,15 +1,19 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://github.com/mikeparcewski/wicked-garden/blob/main/schemas/wicked-pack.schema.json",
-  "title": "wicked-pack.json — third-party skill-pack manifest",
-  "description": "Drop-in registration manifest for a third-party pack (extension contract, SKILL-RATIONALIZATION §5). Placed at the pack root next to its skills/ tree. Garden discovers it at runtime from WICKED_PACK_PATH, the registered-pack file, Claude Code plugin dirs, and <project>/.wicked/packs/ — no garden PR required. Executable validation: `npx wicked-garden pack check <dir>` (scripts/pack/check.py).",
+  "title": "wicked-pack.json — third-party pack manifest (skills, editors, blocks)",
+  "description": "Drop-in registration manifest for a third-party pack (extension contract, SKILL-RATIONALIZATION §5). Spec 2 adds editors[] and blocks[] (DES-artifact-editor-plugins §5.2); spec-1 packs stay valid. Placed at the pack root next to its skills/ tree. Garden discovers it at runtime from WICKED_PACK_PATH, the registered-pack file, Claude Code plugin dirs, and <project>/.wicked/packs/ — no garden PR required. Executable validation: `npx wicked-garden pack check <dir>` (scripts/pack/check.py).",
   "type": "object",
-  "required": ["spec", "name", "vendor", "version", "domains"],
+  "required": ["spec", "name", "vendor", "version"],
   "additionalProperties": false,
   "properties": {
+    "$schema": {
+      "type": "string",
+      "description": "Optional pointer to this schema, for editors."
+    },
     "spec": {
-      "const": 1,
-      "description": "Manifest spec version. Currently 1."
+      "enum": [1, 2],
+      "description": "Manifest spec version. 1: skills only. 2: adds editors[] and blocks[]; domains becomes optional when editors is present."
     },
     "name": {
       "type": "string",
@@ -40,7 +44,7 @@
     "domains": {
       "type": "array",
       "minItems": 1,
-      "description": "The domains this pack contributes. Each declared domain must have exactly one router skill named {vendor}-{domain}; its workers are {vendor}-{domain}-{role} fork skills.",
+      "description": "The domains this pack contributes. Each declared domain must have exactly one router skill named {vendor}-{domain}; its workers are {vendor}-{domain}-{role} fork skills. Required, except in a spec-2 pack that declares editors.",
       "items": {
         "type": "object",
         "required": ["name"],
@@ -104,20 +108,189 @@
     "peers": {
       "type": "object",
       "description": "Peer version floors (extension-contract gap 6), e.g. {\"wicked-garden\": \">=12.29.0\", \"wicked-vault\": \">=0.5.0\"}. Checked FAIL-OPEN: violations are surfaced at SessionStart and by `pack floors`, never blocked on.",
-      "additionalProperties": {
-        "type": "string",
-        "pattern": "^(>=|\\^)\\s*\\d+\\.\\d+\\.\\d+$"
-      }
+      "additionalProperties": { "type": "string", "pattern": "^(>=|\\^)\\s*\\d+\\.\\d+\\.\\d+$" }
     },
     "provenance": {
       "type": "object",
       "description": "Declared provenance (extension-contract gap 4 — minimal + honest). Registration additionally records a sha256 of this manifest and a content hash of the skills tree. There is NO signing: hashes detect post-registration drift, they do not prove authorship. Install packs only from sources you trust — skills carry shell.",
       "additionalProperties": false,
       "properties": {
-        "source": { "type": "string", "description": "Canonical origin URL (git repo or npm page)." },
+        "source": {
+          "type": "string",
+          "description": "Canonical origin URL (git repo or npm page)."
+        },
         "publisher": { "type": "string", "description": "Vendor / maintainer identity as published." },
         "license": { "type": "string" }
       }
+    },
+    "editors": {
+      "type": "array",
+      "minItems": 1,
+      "description": "Spec 2. Artifact editors this pack ships (DES-artifact-editor-plugins §5.2). Each is ONE self-contained HTML entry inside the pack, pinned by sha256. `pack check` also verifies the file: inside the pack, the hash, the size, and no script/stylesheet/frame loaded from outside it.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "title", "version", "protocol", "kinds", "entry", "sha256", "sizes", "permissions"],
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^(?!wicked($|-))[a-z0-9]+(-[a-z0-9]+)*$",
+            "maxLength": 64,
+            "description": "Unique per install. 'wicked' and 'wicked-*' are refused in every pack: first-party editors ship inside studio."
+          },
+          "title": {
+            "type": "string",
+            "minLength": 1,
+            "pattern": "\\S",
+            "description": "Plain words, shown in Settings → Editors."
+          },
+          "version": {
+            "type": "string",
+            "pattern": "^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$",
+            "description": "The editor's own SemVer, anchored."
+          },
+          "protocol": {
+            "type": "array",
+            "minItems": 1,
+            "items": { "type": "integer", "minimum": 1 },
+            "description": "wicked.editor protocol versions it speaks."
+          },
+          "kinds": {
+            "type": "array",
+            "minItems": 1,
+            "items": { "type": "string", "pattern": "^[a-z][a-z0-9-]{1,40}$" },
+            "description": "Artifact kinds it can open."
+          },
+          "entry": {
+            "type": "string",
+            "pattern": "\\.html$",
+            "description": "Relative path of the single HTML file (scripts inline)."
+          },
+          "sha256": {
+            "type": "string",
+            "pattern": "^[0-9a-f]{64}$",
+            "description": "sha256 of the entry file; pinned at install."
+          },
+          "sizes": {
+            "type": "array",
+            "items": {
+              "enum": ["inline", "pane", "full"]
+            },
+            "contains": { "const": "inline" },
+            "description": "'inline' is required; a missing 'pane' morphs inline to full."
+          },
+          "panels": {
+            "type": "array",
+            "items": {
+              "enum": ["checks"]
+            },
+            "description": "Optional host-fed panels it renders."
+          },
+          "permissions": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["id", "why"],
+              "properties": {
+                "id": {
+                  "enum": ["artifact.read", "artifact.write", "selection.chip", "composer.draft", "checks.read", "checks.contribute", "sources.read", "media.read", "artifact.export", "ui.fullscreen", "network.media"]
+                },
+                "why": {
+                  "type": "string",
+                  "pattern": "\\S",
+                  "description": "The reason shown at install."
+                }
+              }
+            },
+            "description": "What it asks for (§6.1), each with its reason."
+          },
+          "limits": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "bundleBytes": {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 5242880,
+                "description": "May only be lower than the host's cap (5 MiB)."
+              }
+            }
+          }
+        }
+      }
+    },
+    "blocks": {
+      "type": "array",
+      "description": "Spec 2. Blocks that PRODUCE this pack's kind (DES-artifact-editor-plugins §9.2): each names a crew preset file inside the pack and the pack skills it uses, approved together at install.",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "label", "preset", "produces_kind"],
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^(?!wicked($|-))[a-z0-9]+(-[a-z0-9]+)*$",
+            "maxLength": 64,
+            "description": "'wicked' and 'wicked-*' are refused: first-party blocks are core presets."
+          },
+          "label": {
+            "type": "string",
+            "minLength": 1,
+            "pattern": "\\S",
+            "description": "Plain words the block is offered with."
+          },
+          "preset": {
+            "type": "string",
+            "description": "Relative path of the preset JSON inside the pack."
+          },
+          "produces_kind": { "type": "string", "pattern": "^[a-z][a-z0-9-]{1,40}$" },
+          "skills": {
+            "type": "array",
+            "items": { "type": "string", "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$" },
+            "description": "Skills of this pack the block uses."
+          }
+        }
+      }
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "spec": { "const": 1 }
+        }
+      },
+      "then": {
+        "required": ["domains"],
+        "not": {
+          "anyOf": [
+            {
+              "required": ["editors"]
+            },
+            {
+              "required": ["blocks"]
+            }
+          ]
+        }
+      }
+    },
+    {
+      "if": {
+        "properties": {
+          "spec": { "const": 2 }
+        }
+      },
+      "then": {
+        "anyOf": [
+          {
+            "required": ["domains"]
+          },
+          {
+            "required": ["editors"]
+          }
+        ]
+      }
     }
-  }
+  ]
 }

package/scripts/_pack_registry.py

@@ -52,7 +52,11 @@ from datetime import datetime, timezone
 from pathlib import Path
 
 MANIFEST_NAME = "wicked-pack.json"
-SPEC_VERSION = 1
+SPEC_VERSION = 1          # the registered-pack file's own format
+# Manifest specs this garden reads. Spec 2 adds ``editors[]`` (artifact editors) and ``blocks[]``
+# (the preset that produces the pack's kind), keeps every spec-1 field, and makes ``domains``
+# optional when ``editors`` is present (DES-artifact-editor-plugins §5.2). Spec-1 packs stay valid.
+MANIFEST_SPECS = (1, 2)
 
 # ``wicked`` is the reserved first-party vendor prefix — third-party packs
 # must never claim it (ruling naming rule #3).
@@ -126,8 +130,22 @@ def structural_errors(manifest: dict, root: Path) -> list:
     errors: list = []
 
     spec = manifest.get("spec")
-    if spec != SPEC_VERSION:
-        errors.append(f"spec must be {SPEC_VERSION} (got {spec!r})")
+    if spec not in MANIFEST_SPECS or isinstance(spec, bool):
+        errors.append(f"spec must be 1 or 2 (got {spec!r})")
+    editors = manifest.get("editors")
+    if spec == 1 and ("editors" in manifest or "blocks" in manifest):
+        errors.append("editors and blocks need manifest spec 2 (this pack declares spec 1)")
+    # An editor id that is exactly "wicked" or starts with "wicked-" is refused in EVERY pack, here (not
+    # only in `pack check`) so that even a forced registration cannot carry one: first-party editors ship
+    # inside studio, never as a pack. As for vendors, a name that merely starts with the letters
+    # ("wickedly-terms") is allowed.
+    for editor in editors if isinstance(editors, list) else []:
+        eid = editor.get("id") if isinstance(editor, dict) else None
+        if isinstance(eid, str) and any(eid == r or eid.startswith(r + "-") for r in RESERVED_VENDOR_PREFIXES):
+            errors.append(
+                f"editor id {eid!r} uses the reserved prefix 'wicked' (first-party editors ship "
+                "inside studio, never in a pack)"
+            )
 
     name = manifest.get("name")
     vendor = manifest.get("vendor")
@@ -165,15 +183,17 @@ def structural_errors(manifest: dict, root: Path) -> list:
             or normalized.startswith("/")
             or bool(re.match(r"^[A-Za-z]:", skills_rel))
         )
+    # Spec 2: an editor-only pack (editors, no domains) may ship no skills at all.
+    editor_only = spec == 2 and isinstance(editors, list) and bool(editors) and "domains" not in manifest
     if escapes_root:
         errors.append(f"skills_dir must be a relative path inside the pack (got {skills_rel!r})")
-    else:
+    elif not editor_only:
         skills_dir = Path(root) / skills_rel
         if not skills_dir.is_dir():
             errors.append(f"skills dir not found: {skills_dir}")
 
     domains = manifest.get("domains")
-    if not isinstance(domains, list) or not domains:
+    if not editor_only and (not isinstance(domains, list) or not domains):
         errors.append("domains must be a non-empty array")
 
     return errors

package/scripts/demo/_playwright.mjs

@@ -0,0 +1,25 @@
+// Part of the wicked-garden-demo skill. Playwright lives in a per-user cache directory, outside the plugin tree:
+// an install inside the plugin leaves node_modules symlinks the garden installer refuses, and a garden upgrade
+// would drop it. Default: <garden cache dir>/demo-deps — the launcher's per-user cache (~/.cache/wicked-garden,
+// %LOCALAPPDATA%\wicked-garden\cache on Windows, or WICKED_GARDEN_CACHE_DIR). Override with WICKED_DEMO_DEPS.
+// Install it once with `wicked-garden run scripts/demo/setup.mjs`.
+import path from "node:path";
+import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
+import { cacheDir } from "../wicked-garden.mjs";
+
+export const DEPS_DIR = path.resolve(
+  process.env.WICKED_DEMO_DEPS || path.join(cacheDir(), "demo-deps"),
+);
+
+/** Playwright's chromium, loaded from DEPS_DIR on first use. */
+export async function loadChromium() {
+  let entry;
+  try {
+    entry = createRequire(path.join(DEPS_DIR, "package.json")).resolve("playwright");
+  } catch {
+    throw new Error(`Playwright is not installed in ${DEPS_DIR}; run: wicked-garden run scripts/demo/setup.mjs`);
+  }
+  const pw = await import(pathToFileURL(entry).href);
+  return pw.chromium ?? pw.default.chromium;
+}