wicked-garden 12.53.0 → 12.53.1

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.53.0"}], "version": "12.53.0"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.53.1"}], "version": "12.53.1"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.53.0",
+  "version": "12.53.1",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), multi-model second opinions (fallback seats labelled) (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": "^0.5.0",
   "wicked_ledger_version": "^0.6.0",

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [12.53.1] — 2026-10-11
+
+### Fixed
+- **One wicked-ledger resolver, `$WICKED_LEDGER_PKG_DIR` first (PR #1284, crew#951).** `wicked-garden-qe` accept, the gate and the campaign scoreboard resolve wicked-ledger through one resolver that honours `$WICKED_LEDGER_PKG_DIR` first (wicked-crew 0.9.7 sets it for a governed run), so a governed QE unit records its verdict without the repository installing wicked-ledger.
+- **Learn: the author computes claim ids (PR #1288, E2E F-LEARN-1);** synthesize leaves them.
+
 ## [12.53.0] — 2026-10-11
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.53.0",
+  "version": "12.53.1",
   "type": "module",
   "description": "Curated toolkit for what AI coding agents can't do alone: evidence-gated work, codegraph relationships, deterministic multi-file refactor, multi-model second opinions, and cross-session memory. Installs as a Claude Code plugin.",
   "keywords": [

package/scripts/qe/lib/campaign-scoreboard.mjs

@@ -93,6 +93,7 @@
 import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join, dirname, resolve, isAbsolute } from "node:path";
 import { pathToFileURL } from "node:url";
+import { resolveLedgerModule } from "./ledger-pkg.mjs";
 import { parseArgs } from "node:util";
 
 import {
@@ -168,54 +169,9 @@ export function resolveLedgerRootLocal(repoRoot, env = process.env) {
   return current;
 }
 
-// --- wicked-ledger resolution (target-repo-anchored, like gate.mjs) ----------
-
-function esmEntryForPackageDir(pkgDir) {
-  const pj = join(pkgDir, "package.json");
-  if (!existsSync(pj)) return null;
-  const pkg = readJsonSafe(pj);
-  if (!pkg) return null;
-  const dot = pkg.exports && pkg.exports["."] !== undefined ? pkg.exports["."] : pkg.exports;
-  const rel =
-    (dot && typeof dot === "object" && (dot.import || dot.default)) ||
-    (typeof dot === "string" ? dot : null) ||
-    pkg.module ||
-    pkg.main ||
-    "index.js";
-  return join(pkgDir, rel);
-}
+// --- wicked-ledger resolution: the shared resolver (./ledger-pkg.mjs) -----------
 
-export async function resolveLedgerModule(repoRoot, env = process.env) {
-  // 1. explicit override (tests, TH-6 wiring, unpublished-floor installs)
-  if (env.WICKED_LEDGER_PKG_DIR) {
-    const entry = esmEntryForPackageDir(env.WICKED_LEDGER_PKG_DIR);
-    if (entry && existsSync(entry)) return await import(pathToFileURL(entry).href);
-    return null;
-  }
-  // 2. bare import (global / hoisted install)
-  try {
-    return await import("wicked-ledger");
-  } catch {
-    /* fall through */
-  }
-  // 3. walk up from the target repo root
-  let dir = resolve(repoRoot);
-  for (let i = 0; i < 10; i++) {
-    const cand = join(dir, "node_modules", "wicked-ledger");
-    const entry = esmEntryForPackageDir(cand);
-    if (entry && existsSync(entry)) {
-      try {
-        return await import(pathToFileURL(entry).href);
-      } catch {
-        return null;
-      }
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}
+export { resolveLedgerModule } from "./ledger-pkg.mjs";
 
 // --- evidence extraction ------------------------------------------------------
 

package/scripts/qe/lib/gate.mjs

@@ -83,50 +83,15 @@ import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, dirname, isAbsolute } from "node:path";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
 
 import { buildExclusionsClause } from "./flake-policy.mjs";
 import { resolveVaultModule, applyVaultIntegrity, VaultEvidenceError } from "./vault-evidence.mjs";
 import { crewRunStamp } from "./crew-run.mjs";
+import { resolveLedgerModule } from "./ledger-pkg.mjs";
 
-// --- wicked-ledger resolution (cwd-anchored; mirrors wicked-vault's bus.mjs) ---
-
-function esmEntryForPackage(resolvedFile) {
-  let dir = dirname(resolvedFile);
-  for (let i = 0; i < 10; i++) {
-    const pj = join(dir, "package.json");
-    if (existsSync(pj)) {
-      let pkg;
-      try { pkg = JSON.parse(readFileSync(pj, "utf8")); } catch { return null; }
-      const dot = pkg.exports && pkg.exports["."] !== undefined ? pkg.exports["."] : pkg.exports;
-      const rel =
-        (dot && typeof dot === "object" && (dot.import || dot.default)) ||
-        (typeof dot === "string" ? dot : null) ||
-        pkg.module || pkg.main || "index.js";
-      return join(dir, rel);
-    }
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}
-
-async function resolveLedgerModule(cwd) {
-  try {
-    return await import("wicked-ledger");
-  } catch { /* fall through */ }
-  try {
-    const require = createRequire(join(cwd, "__qe_gate_anchor__.js"));
-    const located = require.resolve("wicked-ledger");
-    const esm = esmEntryForPackage(located) || located;
-    return await import(pathToFileURL(esm).href);
-  } catch {
-    return null;
-  }
-}
+// --- wicked-ledger resolution: the shared resolver (./ledger-pkg.mjs, $WICKED_LEDGER_PKG_DIR first) ---
 
 /**
  * Resolve the ledger root the gate writes to (TH-6). MUST mirror the TH-2
@@ -357,7 +322,7 @@ export async function runGate({ projectId, runId, verdict, verdictSummary, ratio
     process.stderr.write(
       JSON.stringify({
         error: "LEDGER_UNRESOLVABLE",
-        detail: "wicked-ledger is not resolvable from this repo — npm i --no-save wicked-ledger",
+        detail: "wicked-ledger is not resolvable — set WICKED_LEDGER_PKG_DIR (a governed crew run sets it) or npm i --no-save wicked-ledger",
       }) + "\n"
     );
     process.exit(3);

package/scripts/qe/lib/ledger-pkg.mjs

@@ -0,0 +1,74 @@
+/**
+ * The ONE wicked-ledger resolver of garden's QE pipeline (accept, the gate, the campaign
+ * scoreboard). wicked-ledger is resolved for the TARGET repo — the plugin ships no node_modules —
+ * in this order:
+ *
+ *   1. `$WICKED_LEDGER_PKG_DIR` — an explicit package dir. wicked-crew exports its OWN bundled
+ *      wicked-ledger here (wicked-crew#951), so a governed run's QE unit records its verdict with
+ *      the very package crew's acceptance check reads it with, and needs no install in the
+ *      worktree (a fenced governed seat cannot `npm i`, and an install would change the tree).
+ *      Set but unusable ⇒ `null` (an explicit pin never falls back to a different package).
+ *   2. a bare `import("wicked-ledger")` (a global / hoisted install);
+ *   3. a walk up from the target repo for `node_modules/wicked-ledger`.
+ *
+ * `null` when none resolves; callers say so (never a silent no-op).
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+export const LEDGER_PKG_ENV = "WICKED_LEDGER_PKG_DIR";
+
+/** The ESM entry file of a package dir (its `exports["."]` import/default, else module/main). */
+export function esmEntryForPackageDir(pkgDir) {
+  const pj = join(pkgDir, "package.json");
+  if (!existsSync(pj)) return null;
+  let pkg;
+  try {
+    pkg = JSON.parse(readFileSync(pj, "utf8"));
+  } catch {
+    return null;
+  }
+  const dot = pkg.exports && pkg.exports["."] !== undefined ? pkg.exports["."] : pkg.exports;
+  const rel =
+    (dot && typeof dot === "object" && (dot.import || dot.default)) ||
+    (typeof dot === "string" ? dot : null) ||
+    pkg.module ||
+    pkg.main ||
+    "index.js";
+  return join(pkgDir, rel);
+}
+
+/** The resolved wicked-ledger module for `repoRoot`, or `null`. */
+export async function resolveLedgerModule(repoRoot = process.cwd(), env = process.env) {
+  const pinned = env[LEDGER_PKG_ENV]?.trim();
+  if (pinned) {
+    const entry = esmEntryForPackageDir(pinned);
+    if (!entry || !existsSync(entry)) return null;
+    try {
+      return await import(pathToFileURL(entry).href);
+    } catch {
+      return null;
+    }
+  }
+  try {
+    return await import("wicked-ledger");
+  } catch {
+    /* fall through */
+  }
+  let dir = resolve(repoRoot);
+  for (let i = 0; i < 10; i++) {
+    const entry = esmEntryForPackageDir(join(dir, "node_modules", "wicked-ledger"));
+    if (entry && existsSync(entry)) {
+      try {
+        return await import(pathToFileURL(entry).href);
+      } catch {
+        return null;
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}

package/skills/learn/SKILL.md

@@ -43,9 +43,9 @@ Relative paths in this skill are relative to the directory that contains this SK
 |---|---|---|---|
 | `scope` | neutral | nothing | Name the slug (kebab-case, at most 64 characters), the kind (`topic` or `event`), 3 to 7 questions to answer, what is out of scope, and the source policy: primary sources first (specs, official docs, release notes, the project's own site), dated reporting for events. Read `.wicked/knowledge/<slug>/` if it exists: then this run is a **refresh** (see refs/refresh.md). |
 | `research` | neutral | nothing | Fetch sources with your web tools (or `curl -sL`). For each source, record the URL, title, published date when the page states one, and `observed_at` = now in UTC. Draft candidate claims, each tied to the sources that support it. No network: write `research: no web access` and stop; never answer from memory as if it were sourced. |
-| `synthesize` | neutral | nothing | Turn the candidates into the claims ledger (refs/claims.md): one atomic, checkable statement per claim, deduplicated, ids from `claim_id`. Keep only claims that would help a fresh session in 3 months. On a refresh, output the diff against the existing ledger. |
+| `synthesize` | neutral | nothing | Turn the candidates into the claims ledger (refs/claims.md): one atomic, checkable statement per claim, deduplicated. Leave new claim ids to the author (a neutral seat may not run scripts); on a refresh keep each existing id. Keep only claims that would help a fresh session in 3 months. On a refresh, output the diff against the existing ledger. |
 | `walkthrough` | neutral | nothing | Teach it in the run thread: a 5-line summary, a worked example, what changed (on a refresh), the open questions, and 3 to 5 check questions. The operator answers, asks or corrects by sending the step back; answer each point, re-teach what was unclear, and mark which corrections you verified against a source. |
-| `author` | creator | `.wicked/knowledge/<slug>/`, skills | Write the files (refs/claims.md), then run the check below and paste its JSON and exit code. |
+| `author` | creator | `.wicked/knowledge/<slug>/`, skills | Compute each new claim's id (`wicked-garden run scripts/learn/check.py --claim-id "<text>"`), write the files (refs/claims.md), then run the check below and paste its JSON and exit code. |
 | `review` | evaluator | nothing | Re-run the check yourself; re-fetch and spot-check at least 3 claims (every retirement, too); judge the durability test; last line `VERDICT: PASS` or `VERDICT: FAIL`. |
 | `check` | any | nothing | `wicked-garden run scripts/learn/check.py --repo . [--slug <slug>]` |
 | `index` | human or daemon only | estate knowledge | `wicked-garden run scripts/learn/index.py --repo <default-branch checkout>` after the PR merged. It refuses inside a governed run. |

package/skills/qe/refs/accept.md

@@ -123,7 +123,15 @@ the run's canonical UUID. This serves three goals at once:
 // Resolve the ledger root (wicked-ledger >= 0.6.0): WICKED_QE_LEDGER_DIR when set — inside a
 // governed wicked-crew run, the run's own ledger OUTSIDE the worktree (crew#951) — else dual-read
 // (Phase 6c): '.wicked-qe', or a legacy '.wicked-testing' root written before the rename. <!-- historical -->
-import { createDomainStore, resolveLedgerRoot } from 'wicked-ledger';
+// wicked-ledger through the ONE resolver ($WICKED_LEDGER_PKG_DIR — set by a governed crew run —,
+// else an install the target repo resolves); see § wicked-ledger resolution.
+import { pathToFileURL } from 'node:url';
+import { join as joinPath } from 'node:path';
+// {WT_LIB} is a native path (Windows too): import it as a file URL, never a bare string.
+const { resolveLedgerModule } = await import(pathToFileURL(joinPath(String.raw`{WT_LIB}`, 'ledger-pkg.mjs')).href);
+const ledger = await resolveLedgerModule(process.cwd());
+if (!ledger) throw new Error("wicked-ledger is not resolvable: set WICKED_LEDGER_PKG_DIR or npm i --no-save wicked-ledger");
+const { createDomainStore, resolveLedgerRoot } = ledger;
 import { join } from 'node:path';
 const LEDGER_ROOT = resolveLedgerRoot(process.cwd());
 const store = createDomainStore({ root: LEDGER_ROOT });
@@ -394,7 +402,7 @@ const verdictRecord = store.create('verdicts', {
 });
 
 // 3. Materialize the public manifest at the contract path
-import { buildManifest, emitBusEvent } from 'wicked-ledger';
+const { buildManifest, emitBusEvent } = ledger;   // the same resolved wicked-ledger as step 0
 import { readFileSync } from 'node:fs';
 const pkgVersion = JSON.parse(readFileSync('package.json','utf8')).version;
 const runAfter = store.get('runs', run.id);
@@ -475,7 +483,13 @@ WT_LIB="$(wicked-garden path scripts/qe/lib)"
 ## wicked-ledger resolution
 
 `wicked-ledger` (npm) is the QE data layer — DomainStore, oracle queries, and
-manifest building. Import-style snippets above must run where the package
-resolves: the target project's `node_modules` (`npm i --no-save wicked-ledger`)
-or any directory with it installed. The pinned range lives in
-`.claude-plugin/plugin.json` → `wicked_ledger_version`.
+manifest building. The snippets above load it through `{WT_LIB}/ledger-pkg.mjs`,
+the one resolver the gate shares:
+
+1. `$WICKED_LEDGER_PKG_DIR`. Inside a governed wicked-crew run it is set to crew's
+   own wicked-ledger, the package crew's acceptance check reads the verdict with.
+   Do not `npm i` in a governed run: a fenced seat is refused the install, and it
+   would change the tree under review.
+2. otherwise, an install the target repo resolves (`npm i --no-save wicked-ledger`).
+
+The pinned range lives in `.claude-plugin/plugin.json` → `wicked_ledger_version`.