wicked-garden 12.44.0 → 12.45.0

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.44.0"}], "version": "12.44.0"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.45.0"}], "version": "12.45.0"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.44.0",
+  "version": "12.45.0",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), real multi-model second opinions (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": "^0.5.0",
   "wicked_ledger_version": "^0.4.0",

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+## [12.45.0] — 2026-10-08
+
+### Fixed
+- **Walkthrough: `record` re-runs the storyline lint before it records (wicked-garden#1240, DES-walkthrough-proof §4.4 step 1).** The storyline may have been edited since the `walkthrough_plan` step linted it, so `scripts/demo/walkthrough.mjs record` now runs `lintStoryline` on the storyline it loaded, against the tree it staged (`git archive` of `WICKED_TREE` plus the `fixture.reuse` links, so a `fixture.start` script must be one the tree under review declares), after staging and before the fixture starts. Any finding refuses: `result.json` `{overall: "INCONCLUSIVE", cause: "storyline_refused", reason: "lint: <rule> at <where>: <detail>; ..."}` with every chapter listed INCONCLUSIVE, `progress.json` and the seal line written, exit 0 — nothing is started, filmed or captured. Without `jq` the lint cannot run a check's negative samples and fails closed (`negative_unverified`). Recorder test storylines now pass the lint through `tests/demo/fixtures/lint_complete.mjs` (a negative sample on every check, plus passing pad checks — a `#status` locator, a `probe.mjs` probe, their join, one guard — for any class a chapter lacks, checked after the chapter's own `run()`); tests that pinned a path the lint now refuses first assert the named refusal, and three new tests pin it (a tautology negative, the unpadded fixture, a `fixture.start` script not in the tree). The demo skill and `refs/walkthrough-author.md` say record re-runs the lint.
+
 ## [12.44.0] — 2026-10-08
 
 ### Added
@@ -994,7 +999,8 @@ through `v9.2.18`. Major themes across that span:
 
 For each of those releases, see the corresponding tag in git history.
 
-[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.44.0...HEAD
+[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.45.0...HEAD
+[12.45.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.44.0...v12.45.0
 [12.44.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.43.0...v12.44.0
 [12.43.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.42.0...v12.43.0
 [12.42.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.41.0...v12.42.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.44.0",
+  "version": "12.45.0",
   "type": "module",
   "description": "Curated toolkit for what AI coding agents can't do alone: evidence-gated work, codegraph relationships, deterministic multi-file refactor, multi-model second opinions, and cross-session memory. Installs as a Claude Code plugin.",
   "keywords": [

package/scripts/demo/walkthrough.mjs

@@ -9,6 +9,7 @@
 // The storyline: --storyline <path>, else $WICKED_WALKTHROUGH_AUTHOR/storyline.mjs (the walkthrough_plan step's
 // author dir, which the engine hands the record tool); with neither, record refuses (storyline_refused).
 // lint (walkthrough-lint.mjs, DES §4.5) is the walkthrough_plan step's pinned validator: exit 0 = no finding.
+// record re-runs it on the storyline it loaded (DES §4.4 step 1): any finding refuses (storyline_refused).
 // Safety: WICKED_WALKTHROUGH_JAIL must be set; without it writes INCONCLUSIVE(unjailed_host) and exits 0.
 //
 // What the proof root holds is ONE contract with crew's walkthrough view and acceptance
@@ -43,7 +44,7 @@ import { tmpdir } from "node:os";
 import { makeSegmentRecorder, failedAtInVideo, stitchParts, extractFrame, SEGMENT_TRIM_START } from "./record.mjs";
 import { fixtureOrigin } from "./readonly.mjs";
 import { crewRunStamp } from "../qe/lib/crew-run.mjs";
-import { lintAction } from "./walkthrough-lint.mjs";
+import { lintAction, lintStoryline } from "./walkthrough-lint.mjs";
 
 // ---- arg parsing ---------------------------------------------------------------
 const [action, ...rawArgs] = process.argv.slice(2);
@@ -950,6 +951,23 @@ async function main() {
     }
   }
 
+  // Re-run the lint (DES-walkthrough-proof §4.4 step 1): the storyline may have been edited since the
+  // walkthrough_plan step linted it, so a storyline the lint refuses is never started or recorded. It
+  // runs on the staged tree (with its fixture.reuse links), so fixture.start must name a script the tree
+  // under review declares.
+  let lint;
+  try { lint = lintStoryline(story, { tree: appDir }); } catch (e) {
+    lint = { findings: [{ rule: "storyline_unreadable", where: storyPath, detail: String(e?.message ?? e).split("\n")[0] }] };
+  }
+  if (lint.findings.length) {
+    const shown = lint.findings.slice(0, 5).map((f) => `${f.rule} at ${f.where}: ${f.detail}`);
+    const more = lint.findings.length > shown.length ? ` (+${lint.findings.length - shown.length} more)` : "";
+    writeResult(ROOT, { overall: "INCONCLUSIVE", cause: "storyline_refused", reason: `lint: ${shown.join("; ")}${more}`, chapters: allChapters });
+    writeProgress(ROOT, { overall: "INCONCLUSIVE", cause: "storyline_refused" });
+    finishWithSeal(ROOT, { tree: TREE, storyline_sha: storySha, contract_shas: {}, overall: "INCONCLUSIVE", cause: "storyline_refused", chapters: allChapters });
+    process.exit(0);
+  }
+
   // 3. Spawn fixture, poll ready
   const dataDir = path.join(ROOT, "data");
   fs.mkdirSync(dataDir, { recursive: true });

package/skills/demo/SKILL.md

@@ -191,7 +191,8 @@ again until it exits 0. The rules, in short: `baseUrl: "fixture"`; `fixture.star
 the tree declares (no `-e`/`-c`, nothing outside the tree, no secret-shaped env name); every chapter `proves` plan
 step ids and has a `locator` check, a `probe` or `artifact` check, and a `join` of the two; the walkthrough has a
 `guard` check; every check carries `negative` samples its `jq_pred` verifier FAILS on. The record tool
-(`walkthrough_review`) reads the same file through `WICKED_WALKTHROUGH_AUTHOR`. Full rules and a passing
+(`walkthrough_review`) reads the same file through `WICKED_WALKTHROUGH_AUTHOR` and re-runs the lint first: a
+finding refuses the recording (`storyline_refused`). Full rules and a passing
 example: `refs/walkthrough-author.md`.
 
 ### Probe selectors (read-only)

package/skills/demo/refs/walkthrough-author.md

@@ -13,7 +13,9 @@ review and judges every check through the vault. No model judges a check.
   `wicked-garden run scripts/demo/walkthrough.mjs lint --root <author dir>`. It denies the step until the
   lint exits 0.
 - The record step reads the same file through `WICKED_WALKTHROUGH_AUTHOR` (the author dir the engine hands
-  it). Outside a run, pass `--storyline <path>` to `record` and `lint`.
+  it) and re-runs the lint before it records anything: a finding refuses the recording
+  (`INCONCLUSIVE`, cause `storyline_refused`, the rules in `reason`). Outside a run, pass
+  `--storyline <path>` to `record` and `lint`.
 
 ## Lint rules