wicked-garden 12.50.0 → 12.51.1

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.50.0"}], "version": "12.50.0"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.51.1"}], "version": "12.51.1"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.50.0",
+  "version": "12.51.1",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), multi-model second opinions (fallback seats labelled) (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": "^0.5.0",
   "wicked_ledger_version": "^0.6.0",

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 ## [Unreleased]
 
+## [12.51.1] — 2026-10-11
+
+### Fixed
+- **Memory scope is the checkout, not the cwd (w9-memfix2, codex post-merge review of #1274).** `project:<name>` now comes from the git checkout (a linked worktree resolves to its main checkout), so recalling from `app/src` sees what was stored from `app/`; `WICKED_ESTATE_MEMORY_SCOPE` is the configured project for both capture and recall. Two unrelated checkouts with the same name still share a scope unless one is configured.
+- **The durability gate keeps durable constants and constraints.** A version is refused only next to release status ("released 2.4.1"), so "keep SQLite >= 3.35.0 because RETURNING" is stored; a hex run counts as a commit SHA only when long (>= 12) or in commit context, so a CRC32 polynomial or a colour is kept.
+- **repo-learn no longer submits unapprovable knowledge proposals.** Estate promotes only `memory` and `policy:*`, so the shim refuses `kind_type: "knowledge"` and repo-learn lists those objects as pending in its report until estate's knowledge proposal type ships.
+
+## [12.51.0] — 2026-10-11
+
+### Fixed
+- **`wicked-garden-qe` setup scaffolds the ledger root with Python (wicked-core#881, wicked-crew#951, PR #1277).** It no longer uses a shell `mkdir` of `$WICKED_QE_LEDGER_DIR`. A governed run's write fence judges a shell write target as written, and the unexpanded variable read as a path inside the worktree, so a governed QE unit's scaffold was refused (rig run 46fb2c04). With wicked-core#889 (core-ts 0.9.2), the QE unit runs garden's pipeline into its own roots.
+
+
 ## [12.50.0] — 2026-10-11
 
 ### Added
@@ -13,6 +26,12 @@
 
 ### Changed
 - **The estate client follows estate's paging cursor to the whole answer (estate#279, PR #1272).**
+- **Memory creation keeps learnings, not narration (w9-memfix, PR #1274).**
+  - The Stop hook's regex fact extraction and its auto-memorize drain are removed: `scripts/mem/session_fact_extractor.py`, `scripts/mem/auto_memorize.py`, and the `wicked.garden.fact.extracted` event. They filed about 333 sentence fragments as semantic facts.
+  - `pre_compact` saves a working memory only when tasks are in progress, always scoped `project:<cwd-basename>` (it wrote one empty, unscoped "WIP snapshot" per compaction).
+  - Memory recall (`recall`, `sources`, the hooks' context backend) defaults to the current project and its ancestors; every scope is the explicit `scope_prefix: ""` opt-in. `recall`/`sources` pass the repo intent, so faceted repo-learn memories are reachable, and `sources` labels every item `memory · <kind> · <date> · <scope>` or `knowledge · src <source>`.
+  - `store` / `capture-batch` refuse non-durable content (SHAs, versions, PR/run ids, PIDs, "today", first-person narration, under 40 chars) and source-cited claims (knowledge: use `write`). mem-capture and mem store apply the durability and told/witnessed/decided tests; the event → episode row is gone.
+  - Shim proposals need `facets.project`; repo-learn proposes code facts as `kind_type: "knowledge"` (`content, class, source, source_rev`) and never graph metrics.
 
 ## [12.49.0] — 2026-10-11
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.50.0",
+  "version": "12.51.1",
   "type": "module",
   "description": "Curated toolkit for what AI coding agents can't do alone: evidence-gated work, codegraph relationships, deterministic multi-file refactor, multi-model second opinions, and cross-session memory. Installs as a Claude Code plugin.",
   "keywords": [

package/scripts/_context_backend.py

@@ -77,9 +77,6 @@ def _memory_scope() -> str:
     its ancestors (root-scoped memories included) but not other projects.
     Override via WICKED_ESTATE_MEMORY_SCOPE.
     """
-    pinned = os.environ.get("WICKED_ESTATE_MEMORY_SCOPE", "").strip()
-    if pinned:
-        return pinned
     import _estate_client
 
     return _estate_client.project_scope()

package/scripts/_estate_client.py

@@ -963,15 +963,49 @@ def context(
     return call("ContextBundle", args, timeout=timeout)
 
 
-def project_scope() -> str:
-    """The current project's memory scope, ``project:<cwd-basename>``.
+def checkout_root() -> Optional[Path]:
+    """The git checkout the cwd is in, resolved through linked worktrees.
 
-    The one default for both directions: memories are stored here, and recall
-    sees this scope plus its ancestors (root-scoped memories included). Reading
-    every project's memories is an explicit opt-in (``scope_prefix: ""``).
+    Walks up to the nearest ``.git``. A linked worktree's ``.git`` is a file
+    (``gitdir: <main>/.git/worktrees/<name>``): its project is the MAIN checkout,
+    so a run worktree shares the repo's memories. None outside any checkout.
     """
     try:
-        name = Path.cwd().name or "unknown"
+        here = Path.cwd().resolve()
+    except OSError:
+        return None
+    for d in (here, *here.parents):
+        git = d / ".git"
+        if git.is_dir():
+            return d
+        if git.is_file():
+            try:
+                line = git.read_text(encoding="utf-8").strip()
+            except OSError:
+                return d
+            gitdir = line[len("gitdir:"):].strip() if line.startswith("gitdir:") else ""
+            marker = f"{os.sep}.git{os.sep}worktrees{os.sep}"
+            norm = gitdir.replace("/", os.sep)
+            return Path(norm.split(marker)[0]) if marker in norm else d
+    return None
+
+
+def project_scope() -> str:
+    """The current project's memory scope: one identity for capture AND recall.
+
+    ``WICKED_ESTATE_MEMORY_SCOPE`` (the configured project) wins; else
+    ``project:<checkout name>`` from :func:`checkout_root` (stable across
+    subdirectories and worktrees); else ``project:<cwd-basename>``. Two
+    unrelated checkouts with the same name share a scope unless one is
+    configured. Recall sees this scope plus its ancestors (root-scoped
+    memories included); every project is the explicit ``scope_prefix: ""``.
+    """
+    pinned = os.environ.get("WICKED_ESTATE_MEMORY_SCOPE", "").strip()
+    if pinned:
+        return pinned
+    root = checkout_root()
+    try:
+        name = (root.name if root else Path.cwd().name) or "unknown"
     except OSError:
         name = "unknown"
     return f"project:{name}"
@@ -1051,6 +1085,13 @@ def propose(
     run's `WICKED_RUN_PROJECT` supplies): an unscoped proposal is refused here
     with the shape-error code, so it never lands project-less in the queue.
     """
+    if kind_type == "knowledge":
+        # Gate (DES-memory-vs-knowledge K3): estate's approve promotes only memory + policy:*,
+        # so a knowledge proposal would strand in the queue. Lift when estate ships the type.
+        return {"ok": False, "code": -32602,
+                "reason": 'kind_type "knowledge" is not approvable yet (estate promotes only '
+                          'memory and policy:*): keep the object in your report under '
+                          '"knowledge (pending)"; do not re-file it as a memory'}
     facets = _scope_facets_to_run_project(facets)
     project = (facets or {}).get("project")
     if not isinstance(project, str) or not project.strip():

package/scripts/mem/estate_memory.py

@@ -135,15 +135,11 @@ def _default_intent():
     (the umbrella, e.g. ``wicked`` for ``wicked/wicked-estate``). Outside a git
     checkout: {} (unfaceted memories only, as before).
     """
-    try:
-        here = Path.cwd().resolve()
-    except OSError:
+    root = _estate_client.checkout_root()
+    if root is None:
         return {}
-    for d in (here, *here.parents):
-        if (d / ".git").exists():
-            project = (os.environ.get("WICKED_RUN_PROJECT") or "").strip() or d.parent.name
-            return {k: v for k, v in (("repo", d.name), ("project", project)) if v}
-    return {}
+    project = (os.environ.get("WICKED_RUN_PROJECT") or "").strip() or root.parent.name
+    return {k: v for k, v in (("repo", root.name), ("project", project)) if v}
 
 
 def _memory_recall_args(args, query, budget):
@@ -209,11 +205,21 @@ def _parse_budget(args):
 # narration and status never reach the store even when the judgment slips.
 MIN_CONTENT_CHARS = 40
 _HEX_RUN = re.compile(r"\b[0-9a-f]{7,40}\b")
+# A hex run is a commit id when it is long (>= 12) or sits in commit context; a short one
+# alone (a CRC32 polynomial, a colour) is a constant, and constants are durable.
+_COMMIT_CONTEXT = re.compile(
+    r"\b(?:commit|sha|rev(?:ision)?|cherry-?pick(?:ed)?|revert(?:ed)?|fixed in|landed in|merged as"
+    r"|pin(?:ned)?(?: moved)? (?:to|at))\b|@[0-9a-f]{7}", re.I)
+# A version is narration only next to release status ("released 2.4.1", "shipped 0.7.26"); a
+# version constraint ("keep SQLite >= 3.35.0 because RETURNING") is a durable rule.
+_VERSION = re.compile(r"(?<![\w.])v?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.]+)?(?![.\d])")
+_RELEASE_STATUS = re.compile(
+    r"\b(?:released|shipped|published|tagged|cut|bumped|landed|merged|deployed|rolled out"
+    r"|upgraded to|is out|went out|now on)\b", re.I)
 _NON_DURABLE = (
     (re.compile(r"\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b", re.I),
      "a run/session id (uuid)"),
     # x.y.z, but not a dotted quad (127.0.0.1) or a longer dotted run.
-    (re.compile(r"(?<![\w.])v?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.]+)?(?![.\d])"), "a version number"),
     # PR #12 / issue #12 / run 38093054271 / core#880 / a bare #880 — not "run 3 retries".
     (re.compile(r"\b(?:pr|pull request|issue|run|job)\s*(?:#\s*\d+|\d{5,})\b"
                 r"|\b[a-z][\w.-]*#\d+\b|(?<![\w&])#\d+\b", re.I), "a PR/issue/run id"),
@@ -235,7 +241,8 @@ def _is_sha(token):
 def durability_rejects(content):
     """Why ``content`` is not a durable learning ([] = it may be stored).
 
-    Deterministic and offline: empty or too-short bodies, commit SHAs, versions,
+    Deterministic and offline: empty or too-short bodies, commit SHAs (long, or
+    in commit context), versions next to release status,
     PR/issue/run ids, PIDs, "today"-style dates, and first-person narration
     ("I'll retry", "going to guess again") are records of a moment; the repo,
     CHANGELOG or tracker already holds those.
@@ -245,8 +252,11 @@ def durability_rejects(content):
         return [f"too short to state a rule, why it holds and when it applies "
                 f"(< {MIN_CONTENT_CHARS} chars)"]
     reasons = []
-    if any(_is_sha(m.group(0)) for m in _HEX_RUN.finditer(text.lower())):
+    shas = [m.group(0) for m in _HEX_RUN.finditer(text.lower()) if _is_sha(m.group(0))]
+    if any(len(h) >= 12 for h in shas) or (shas and _COMMIT_CONTEXT.search(text)):
         reasons.append("a commit SHA")
+    if _VERSION.search(text) and _RELEASE_STATUS.search(text):
+        reasons.append("release status (a version that was shipped/released)")
     reasons += [why for rx, why in _NON_DURABLE if rx.search(text)]
     return reasons
 

package/skills/mem/SKILL.md

@@ -85,7 +85,8 @@ A chat seat asked by wicked-crew to label the operator's decisions reads
 1. Apply the durability test: *would this help a fresh session, on a
    different task, three months from now?* Store a rule, why it holds, and
    when it applies, in 1–3 self-contained sentences. Never store progress or
-   status, versions, SHAs, PR/run ids, PIDs, "today", or what the repo,
+   status, release versions ("shipped 2.4.1"), commit SHAs, PR/run ids, PIDs,
+   "today", or what the repo,
    CHANGELOG or tracker already records. The backend refuses the mechanical
    cases with `not a durable learning`; treat that as "don't store", not as
    an error to work around.

package/skills/mem-capture/SKILL.md

@@ -47,11 +47,14 @@ Reject, and do not rephrase into something that sneaks past:
 
 - progress and status: what you did, are doing or will do ("I'll retry",
   "going to try again", "shipped", "merged", "now green");
-- versions, commit SHAs, PR / issue / run ids, PIDs, ports picked by hand,
+- release versions ("shipped 2.4.1"), commit SHAs, PR / issue / run ids, PIDs,
+  ports picked by hand,
   and anything dated ("today", "this morning");
 - anything the repo, its CHANGELOG or the tracker already records.
 
-The backend refuses the mechanical cases (ids, versions, SHAs, PIDs, "today",
+A version *constraint* ("needs SQLite >= 3.35.0 because …") and a fixed constant
+(a CRC polynomial, a colour) are durable; keep them.
+The backend refuses the mechanical cases (ids, release versions, commit SHAs, PIDs, "today",
 first-person narration, bodies under 40 characters) with
 `not a durable learning`. A refusal means the candidate failed the test:
 drop it, unless it holds a real rule you can state without the moment.

package/skills/qe/refs/setup.md

@@ -49,11 +49,19 @@ npx --no-install cypress --version > /dev/null 2>&1 && echo "npx-cypress: true"
 The ledger root is `$WICKED_QE_LEDGER_DIR` when it is set (a governed crew run's own ledger,
 outside the worktree), else `.wicked-qe`:
 
+Create it with Python, not a shell `mkdir` of the variable: a governed run's write fence
+judges a shell write target as written, and an unexpanded `"$WICKED_QE_LEDGER_DIR/..."` reads
+as a path inside the worktree, so it is refused.
+
 ```bash
-QE_ROOT="${WICKED_QE_LEDGER_DIR:-.wicked-qe}"
-mkdir -p "$QE_ROOT/projects" "$QE_ROOT/strategies" "$QE_ROOT/scenarios" \
-         "$QE_ROOT/runs" "$QE_ROOT/verdicts" "$QE_ROOT/tasks" \
-         "$QE_ROOT/evidence"
+PY="$(command -v python3 || command -v python)"
+"$PY" -c "
+import os
+root = os.environ.get('WICKED_QE_LEDGER_DIR') or '.wicked-qe'
+for d in ('projects', 'strategies', 'scenarios', 'runs', 'verdicts', 'tasks', 'evidence'):
+    os.makedirs(os.path.join(root, d), exist_ok=True)
+print(root)
+"
 ```
 
 ### 3. Write config.json

package/skills/repo-learn/SKILL.md

@@ -138,9 +138,12 @@ when the proposal is approved, so the learning is lost):
 - **Knowledge** — how the code works, read from the code (*acquired*, so it is
   knowledge, not memory: DES-memory-vs-knowledge). `kind_type: "knowledge"`; payload
   `{"content": "<1–3 sentences>", "class": "concept", "source": "<repo>:<path>",
-  "source_rev": "<commit sha>"}`. Most repo-learn findings are this kind. Never
-  propose a graph metric (PageRank rank, churn count, blast-radius size): estate's
-  tools re-derive those on demand.
+  "source_rev": "<commit sha>"}`. Most repo-learn findings are this kind. **Not
+  submittable yet:** estate cannot approve a knowledge proposal until its knowledge
+  proposal type ships, so the shim refuses `kind_type: "knowledge"`. List these objects
+  in your report's fenced `json` block under `knowledge (pending)` and leave them out
+  of the `wicked-capture-report` counts. Never propose a graph metric (PageRank rank,
+  churn count, blast-radius size): estate's tools re-derive those on demand.
 - **Memory** — only something *witnessed* while studying (a gotcha you hit, with
   why) or *told* by the operator. Split a mixed finding: "we chose fail-closed
   because of incident X" is memory, "the implementation fails closed" is

package/skills/repo-learn/refs/capture-proposals.md

@@ -71,7 +71,14 @@ estate/steering types — pick the one the rule governs, not a freeform tag.
 ## Knowledge payload (code facts: the usual case)
 
 What you learn by reading code is **acquired**, so it is knowledge, not memory
-(DES-memory-vs-knowledge §3). Propose it as:
+(DES-memory-vs-knowledge §3).
+
+**Not submittable yet.** Estate's `proposal.approve` promotes only `memory` and
+`policy:*`; a knowledge proposal would sit unapprovable in the queue, so the shim
+refuses `kind_type: "knowledge"` (`-32602`) until estate's knowledge proposal type
+ships. Until then, put each object below in your report's fenced `json` block under
+`knowledge (pending)`, and leave them out of the `wicked-capture-report` counts. Do
+not re-file a code fact as a `memory` to get it through. The shape is:
 
 ```json
 {
@@ -120,7 +127,8 @@ implementation fails closed" is knowledge.
   `WICKED_RUN_PROJECT` supplies it.
 - `content` must pass the durability test: a rule, why it holds, and when it
   applies, useful to a fresh session on a different task months from now. No
-  versions, SHAs, PR/run ids or progress notes.
+  release-status versions ("shipped 2.4.1"), commit SHAs, PR/run ids or progress
+  notes. A version *constraint* ("needs SQLite >= 3.35.0 because …") is fine.
 
 ## Policy payload + facets