wicked-garden 12.48.0 → 12.49.0

package/.claude-plugin/components.json

@@ -2,7 +2,7 @@
   "_comment": "Issue #328: Component declarations for wicked-garden plugin. Claude Code plugin.json does not yet support inline component declarations beyond path overrides. This manifest documents all components for tooling, validation, and future schema support. When plugin.json gains a 'components' field, merge this data into plugin.json. The plugin is skills-only: former commands/ became actions of consolidated per-domain skills, and former agents/ became standalone context:fork worker skills (enumerated under fork_skills). Regenerate derived blocks with scripts/ci/sync_components.py.",
   "domains": ["agentic", "crew", "data", "demo", "engineering", "jam", "mem", "persona", "platform", "product", "qe", "search"],
   "summary": {
-    "skills": 136,
+    "skills": 137,
     "fork_skills": 69,
     "hooks": 13,
     "specialists": 7
@@ -24,6 +24,7 @@
     "domain-extractor": ["domain-extractor"],
     "domain-modeler": ["domain-modeler"],
     "draft": ["draft"],
+    "editor-scaffold": ["editor-scaffold"],
     "engineering": ["architecture", "backend", "debugging", "docs", "engineering", "frontend", "integration", "large-scale-migration", "patch", "system-design", "unit-test-quality"],
     "engineering-api-documentarian": ["engineering-api-documentarian"],
     "engineering-migration-engineer": ["engineering-migration-engineer"],

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, real multi-model second opinions. Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.48.0"}], "version": "12.48.0"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.49.0"}], "version": "12.49.0"}

package/.claude-plugin/plugin.json

@@ -1,9 +1,9 @@
 {
   "name": "wicked-garden",
-  "version": "12.48.0",
-  "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), real multi-model second opinions (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
+  "version": "12.49.0",
+  "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), multi-model second opinions (fallback seats labelled) (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": "^0.5.0",
-  "wicked_ledger_version": "^0.4.0",
+  "wicked_ledger_version": "^0.6.0",
   "wicked_bus_version": "^2.0.0",
   "author": {
     "name": "Mike Parcewski",

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+## [12.49.0] — 2026-10-11
+
+### Added
+- **`wicked-garden-editor-scaffold`: build, check and install an artifact editor plugin (X3, PR #1269).** A new skill plus `scripts/editor/`.
+- **Inventory-report codebook (crew#721, PR #1266).** An enumerating step says whether its list is complete.
+
+### Fixed
+- **QE acceptance inside a governed crew run records into the run's ledger, not the worktree (wicked-crew#951, PR #1270).** When `WICKED_QE_LEDGER_DIR` is set, it is the ledger root. A governed run hands its QE unit the run's own ledger, outside the worktree, this way.
+  - The preflight config check, setup's scaffold and `config.json`, accept's evidence dir, the executor and reviewer briefs, and the vault-record argument all use that root.
+  - accept resolves it through wicked-ledger's `resolveLedgerRoot`.
+  - Before, a governed `qe accept` wrote `<worktree>/.wicked-qe`; the run's guard discarded it, the PASS with it, and delivery was refused.
+
+### Changed
+- **`wicked_ledger_version` is `^0.6.0`** (PR #1270): `resolveLedgerRoot` honours `WICKED_QE_LEDGER_DIR`. The QE runner requires wicked-ledger `^0.5.0` (PR #1267).
+- Docs: guidance and the site say what ships, and what blocks vs what advises (PR #1265). Python 3.15 (PR #1268).
+
 ## [12.48.0] — 2026-10-09
 
 ### Added

package/README.md

@@ -32,11 +32,11 @@ Most plugins try to boss them around — re-implement planning, impose a workflo
 | refactors on a hope and a prayer | renames across files as a **graph operation**, not find-replace roulette → wicked-patch |
 | forgets everything at `exit` | remembers what session 1 decided when you're in session 47 → the mem domain over wicked-estate |
 | re-derives *how to work in this repo* every task — which file owns the bug, the wiring step, the test command | loads the repo's own playbooks (`fix-bug`/`add-feature`/`verify`…), generated from HEAD → wicked-understanding |
-| asks *itself* for a second opinion | convenes a **real multi-model panel** (Antigravity / Codex / …) → the jam skill's `council` action |
+| asks *itself* for a second opinion | convenes a **review panel** → the jam skill's `council` action: usable external CLIs (Antigravity / Codex / …) take the seats; with fewer than two it fills them with isolated same-family workers and **labels them as weaker diversity**, and below two isolated seats it reports *no quorum* instead of synthesizing |
 | re-derives WCAG/CWE/SOC2 from memory every time | loads the rubric on demand, ships it to any repo |
-| grades its own homework | author ≠ executor ≠ reviewer → evidence-gated testing |
+| grades its own homework | author ≠ executor ≠ reviewer as separate workers → evidence-gated testing (the `qe` domain) |
 
-The throughline: **done is re-derived, not asserted.** Verdicts you can trust on the first read — not green checkmarks you can't.
+The throughline: **done is re-derived, not asserted** — wherever the gate actually runs. Which entry paths block and which only advise is spelled out in [What blocks, what advises](#what-blocks-what-advises).
 
 ## What it's *not*
 
@@ -106,14 +106,14 @@ Optional, lights up the code graph: **wicked-estate** (single binary; `wicked-es
 ## Try it
 
 ```bash
-# Just work — the hook applies the right rigor underneath, quietly
+# Just work — in Claude Code the plugin's hook reads the work's shape and suggests the rigor (advisory)
 "implement caching for the dashboard"
 
 # Or reach for a gap-filler on purpose — everything is a skill now
 /wicked-garden-prove                              # re-derive "done" from evidence (fail-closed)
 /wicked-garden-search blast-radius emit_event     # impact, incl. edges grep can't see
 /wicked-garden-engineering-patch rename oldField newField  # deterministic, graph-driven
-/wicked-garden-jam council "redis or memcached?"  # a panel that isn't just you
+/wicked-garden-jam council "redis or memcached?"  # a panel; it says which seats were external models
 
 # Stamp the evidence gate into ANY repo (runs with no wicked-garden installed)
 /wicked-garden-prove compile ~/path/to/repo --trigger ci
@@ -121,6 +121,24 @@ Optional, lights up the code graph: **wicked-estate** (single binary; `wicked-es
 
 ---
 
+## What blocks, what advises
+
+"Done is re-derived" is a property of the **gate**, not of every surface the toolkit touches. What a
+false "done" runs into depends on the host and the entry path:
+
+| Host · entry path | Blocks | Only advises |
+|---|---|---|
+| **Any host — the gate, invoked** (`wicked-garden-prove`, an archetype's produces-gate → `scripts/qe/vault_gate.py`) | Re-hashes the recorded evidence and re-runs its verifier through `wicked-vault`: a false claim is **rejected**, an unresolvable backend **fails closed** (`gate: "unavailable"`). Hard gates also need an attestation under an explicit `--actor` that differs from the author's — a local label, not an authenticated identity. The verdict stops whatever acts on it. | With `--no-require`, a backend that cannot run falls back to the claim-only tracker and says so (`claim-only`, not re-derived); a working backend still re-derives. |
+| **Claude Code — plugin hooks** (plain conversation, "just work") | `PreToolUse` denies a few specific tool calls: native `EnterPlanMode` (always — planning goes through the archetype playbooks), writes to `MEMORY.md` / the auto-memory dir, build-phase writes on a high-complexity crew project with no challenge artifacts, a `phase_manager.py approve` whose gate preflight fails, a worktree cwd leak, and — only in `strict` mode (default `warn`) — invalid task metadata (`WG_TASK_METADATA`) and orphan state writes (`WG_BUS_EMIT_LINT`). Prompts are held until `/wicked-garden-core setup` completes. | Everything else. The archetype detector **steers** (it does not gate), the Stop-time claim sentinel is a fail-open **nudge** when a "done/passing" claim has no verdict for HEAD, `TaskCompleted` never blocks, and output governance is advisory. A completion claim is **not** blocked unless a gate is run. |
+| **Codex · OpenCode · Pi · Antigravity — skills only** (`npx wicked-installer install-<cli> wicked-garden`) | Nothing by itself: no plugin hooks are installed on those hosts. | The skill text tells the agent to run the gate; it blocks only when the agent does run it (and the launcher + `wicked-vault` are present). |
+| **Compiled repo gate** (`/wicked-garden-prove compile <repo> --trigger hook,ci`) | `.wicked/gate.py` fails the **git pre-push hook / CI job** it is wired into, with no wicked-garden installed. | Without a trigger it is a script you run by hand. |
+| **wicked-crew governed run** | crew's engine decides each gated phase deny-dominates, on the layers that actually ran — deterministic floors, repo checks, policies, a judge. Review moves to a distinct seat when the roster has an eligible one; team runs refuse without one. | An ordinary run on a too-small roster keeps review on the creator seat and labels it "evaluator ≠ creator not held"; a pinned floor with no distinct judge is labelled "floor only"; a phase nothing gated is "approved by default, not verified". |
+
+Garden's own daemon `/council` endpoint is a single-model synthesis (v0.1); the multi-model panel is
+the jam skill's `council` action above.
+
+---
+
 ## Build on it
 
 The catalog is open: ship your own domain pack — a `wicked-pack.json`
@@ -141,7 +159,7 @@ Full author guide: [`docs/extending.md`](docs/extending.md).
 ## Principles
 
 - **Don't fight the harness.** Fill the gaps; never re-implement what it already does well.
-- **Done is re-derived, not asserted.** Every gate recomputes the evidence; the gates that matter are signed by someone who isn't the author.
+- **Done is re-derived, not asserted.** Every gate recomputes the evidence; the gates that matter need an attestation recorded under an actor other than the author (a declared label, not an authenticated identity).
 - **Steering, not blocking.** Rigor follows the shape of the work, applied only where it earns its keep.
 - **Enforcement that travels.** The gate compiles into any repo and runs without wicked-garden present.
 - **Borrow the harness's primitives.** Extend `TaskCreate`/`Task()`/skills/hooks — don't rebuild them.

package/docs/extending.md

@@ -97,6 +97,16 @@ Manifest `spec: 2` keeps every spec-1 field and adds two arrays. A spec-1 pack s
 wicked-studio and first-party blocks are core presets. Example (garden's own spec-2 fixture):
 [`tests/fixtures/packs/acme-terms/`](../tests/fixtures/packs/acme-terms/).
 
+**Building an editor-only pack.** The `wicked-garden-editor-scaffold` skill writes one
+(`scripts/editor/scaffold.py`), from a template that already speaks `wicked.editor/1`; `scripts/editor/pin.py`
+re-pins the entry hash after each edit; `scripts/editor/conformance.py` runs the plugin's conformance
+cases in headless Chromium inside studio's own conformance host page; and `scripts/editor/install.py`
+stages the pack under `~/.wicked/editors/<name>/current/` and installs it into a wicked-crew daemon,
+which re-runs `pack check` and the conformance cases itself before it records the editor (fail closed:
+no headless browser is a refusal). A pack that also ships skills or blocks is not installable yet: their
+own approval step is still to come. The governed route is the `editor-plugin` workflow (studio
+Settings → Developer → Create an editor plugin).
+
 ## Validate: the shipped conformance gate
 
 ```bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.48.0",
+  "version": "12.49.0",
   "type": "module",
   "description": "Curated toolkit for what AI coding agents can't do alone: evidence-gated work, codegraph relationships, deterministic multi-file refactor, multi-model second opinions, and cross-session memory. Installs as a Claude Code plugin.",
   "keywords": [

package/scripts/editor/_pack.py

@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+"""Shared helpers for the editor-plugin scripts (scaffold, pin, conformance, install).
+
+An editor plugin is a ``wicked-pack.json`` spec-2 pack (DES-artifact-editor-plugins §5.2): the
+manifest lists ``editors[]``, each with ONE self-contained HTML ``entry`` inside the pack and that
+file's full sha256. These helpers read such a pack; none of them writes outside the pack directory.
+Standard library only.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+from pathlib import Path
+
+MANIFEST_NAME = "wicked-pack.json"
+# The editor id and pack name shape (garden's kebab names, <= 64); `wicked`/`wicked-*` is reserved
+# for the editors that ship inside studio and is refused in every pack (schema, PK061).
+ID_RE = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
+RESERVED_RE = re.compile(r"^wicked(?:$|-)")
+KIND_RE = re.compile(r"^[a-z][a-z0-9-]{1,40}$")
+SEMVER_RE = re.compile(r"^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$")
+SIZES = ("inline", "pane", "full")
+# §6.1's permission table, with the plain words the install sheet shows.
+PERMISSIONS = {
+    "artifact.read": "to read the artifact it opens",
+    "artifact.write": "to change it, as new versions you can undo",
+    "selection.chip": "to point at parts of it in your message box",
+    "composer.draft": "to suggest what to ask the helpers (you send it)",
+    "checks.read": "to see the checks and their evidence",
+    "checks.contribute": "to point things out, marked as its own notes",
+    "sources.read": "to see the sources attached to it",
+    "media.read": "to play the recording",
+    "artifact.export": "to download it",
+    "ui.fullscreen": "to go full screen",
+    "network.media": "to load images and fonts from the internet",
+}
+HOST_BUNDLE_CAP = 5 * 1024 * 1024
+
+
+class PackError(Exception):
+    """A pack that cannot be read as an editor pack, with the reason."""
+
+
+def sha256_file(path: Path) -> str:
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def read_manifest(pack: Path) -> dict:
+    path = pack / MANIFEST_NAME
+    if not path.is_file():
+        raise PackError(f"{pack} holds no {MANIFEST_NAME}")
+    try:
+        manifest = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError) as exc:
+        raise PackError(f"{path} is not JSON: {exc}") from exc
+    if not isinstance(manifest, dict):
+        raise PackError(f"{path} is not a JSON object")
+    return manifest
+
+
+def editors_of(manifest: dict) -> list[dict]:
+    editors = manifest.get("editors")
+    if manifest.get("spec") != 2 or not isinstance(editors, list) or not editors:
+        raise PackError("the pack declares no editors (wicked-pack.json spec 2 `editors[]`)")
+    return [e for e in editors if isinstance(e, dict)]
+
+
+def entry_path(pack: Path, editor: dict) -> Path:
+    """The editor's entry file, resolved inside the pack (a path that escapes it is refused)."""
+    entry = editor.get("entry")
+    if not isinstance(entry, str) or not entry.endswith(".html"):
+        raise PackError(f"editor {editor.get('id')!r}: entry must name one .html file")
+    # A plain relative POSIX path: no absolute or drive-qualified form, no backslash, no `..` or `.`
+    # part — the same string is joined under a staging directory, so it must not climb out of one.
+    parts = entry.split("/")
+    if entry.startswith("/") or "\\" in entry or ":" in entry or any(p in ("", ".", "..") for p in parts):
+        raise PackError(f"editor {editor.get('id')!r}: entry {entry!r} must be a plain relative path inside the pack")
+    root = pack.resolve()
+    target = (pack / entry).resolve()
+    if root != target and root not in target.parents:
+        raise PackError(f"editor {editor.get('id')!r}: entry {entry} is outside the pack")
+    if not target.is_file():
+        raise PackError(f"editor {editor.get('id')!r}: entry {entry} is missing")
+    if target.stat().st_size > HOST_BUNDLE_CAP:
+        raise PackError(f"editor {editor.get('id')!r}: entry {entry} is over the host's {HOST_BUNDLE_CAP}-byte cap")
+    return target
+
+
+def write_manifest(pack: Path, manifest: dict) -> None:
+    path = pack / MANIFEST_NAME
+    tmp = path.with_suffix(".json.tmp")
+    tmp.write_text(json.dumps(manifest, indent=2) + "\n", encoding="utf-8", newline="\n")
+    tmp.replace(path)