wicked-garden 12.56.0 → 12.58.0

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.56.0"}], "version": "12.56.0"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.58.0"}], "version": "12.58.0"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.56.0",
+  "version": "12.58.0",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), multi-model second opinions (fallback seats labelled) (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": ">=0.8.0",
   "wicked_ledger_version": "^0.6.0",

package/.codex-plugin/mcp.json

@@ -0,0 +1,27 @@
+{
+  "mcpServers": {
+    "wicked-estate": {
+      "command": "wicked-garden",
+      "args": [
+        "run",
+        "scripts/estate_mcp.mjs"
+      ],
+      "env_vars": [
+        "WICKED_ESTATE_MCP_BIN",
+        "WICKED_ESTATE_DB",
+        "WICKED_HOME",
+        "WICKED_MEMORY_DB",
+        "WICKED_KNOWLEDGE_DB",
+        "WICKED_XEDGE_DB",
+        "WICKED_ESTATE_READONLY",
+        "WICKED_GOVERNED",
+        "WICKED_RUN_ID",
+        "WICKED_RUN_UNIT",
+        "WICKED_RUN_AGENT",
+        "WICKED_RUN_PROJECT",
+        "WICKED_GATE_SCOPE",
+        "WICKED_WRITE_ROOTS"
+      ]
+    }
+  }
+}

package/.codex-plugin/plugin.json

@@ -0,0 +1,27 @@
+{
+  "name": "wicked-garden",
+  "version": "12.58.0",
+  "description": "The skills your coding agent can't build alone: \"done\" re-checked from evidence, graph-aware search and multi-file refactor, 40 QE specialists, review panels from other models, and cross-session memory. Works in Claude Code, Codex, Antigravity, OpenCode and Pi, in CI, or in a wicked-crew job.",
+  "keywords": [
+    "coding-agent",
+    "evidence-gate",
+    "code-graph",
+    "refactoring",
+    "testing",
+    "memory",
+    "multi-model"
+  ],
+  "skills": "./skills",
+  "mcpServers": "./.codex-plugin/mcp.json",
+  "hooks": {
+    "description": "No hooks on Codex: hooks/hooks.json is Claude Code's event model; garden's skills run the gate themselves on skills-only hosts.",
+    "hooks": {}
+  },
+  "interface": {
+    "displayName": "Wicked Garden",
+    "shortDescription": "Evidence-gated done, graph-aware search and refactor, QE specialists, review panels, cross-session memory.",
+    "developerName": "Mike Parcewski",
+    "category": "Developer Tools",
+    "websiteURL": "https://github.com/mikeparcewski/wicked-garden"
+  }
+}

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## [Unreleased]
 
+## [12.58.0] — 2026-10-20
+
+### Added
+- **garden is a registered Codex plugin (#1326).** `.codex-plugin/plugin.json` (Codex prefers it over `.claude-plugin/plugin.json`) declares the skills directory (`./skills`; Codex namespaces them `wicked-garden:<skill>`), the `wicked-estate` MCP server (`.codex-plugin/mcp.json`) and an explicit empty `hooks` block, because without one Codex would load `hooks/hooks.json`, which is Claude Code's hook model. Codex installs it from the existing `.claude-plugin/marketplace.json`: `codex plugin marketplace add <garden package root>`, then `codex plugin add wicked-garden@wicked-garden`. The MCP server starts through `wicked-garden run scripts/estate_mcp.mjs`. That new launcher finds `wicked-estate-mcp` the way `scripts/_estate_client.py` does (`WICKED_ESTATE_MCP_BIN`, then PATH, then `~/.local/bin`), so no install path is written into the manifest. The server forwards the binary override, estate's store pins (`WICKED_ESTATE_DB`, `WICKED_HOME`, `WICKED_*_DB`), the read-only opt-in and the run markers through `env_vars`, because Codex hands a stdio MCP server only a default allowlist (PATH, HOME, …) plus the variables named there. The launcher also applies `_estate_client.py`'s rules. It accepts only `--readonly`, `--governed` and `--db <path>`/`--db=<path>`, and refuses a misspelt flag. `--readonly` is added for the flag, for `WICKED_ESTATE_READONLY`, `WICKED_GOVERNED` or `--governed`, and for a run marker. A governed unit with no pinned store is refused. The child gets `[--readonly] [--db <path>]`, the only spelling estate reads. It passes stdio, arguments, cwd and the exit code through, and when no binary is found it prints one JSON line and exits 1. A `wicked-estate` server in the user's Codex config takes precedence over the plugin's.
+- **The Codex manifest is kept in version lockstep and checked in CI (#1326).** `sync-plugin-version.mjs` (the npm `version` hook the release runs) now bumps `.codex-plugin/plugin.json` too, and so does the dev `release.py` (with `package.json`). `scripts/ci/validate.py` runs `scripts/ci/codex_plugin.py`, which applies the rules Codex 0.163 uses: name matches the Claude manifest, and the Codex and Claude versions both match `package.json`; paths start with `./` and stay under the root; the hooks opt-out is present; the estate server goes through a launcher script under the root. It also requires that the skills Codex would discover (recursive, hidden directories skipped, string names of at most 64 characters, a string description present) are exactly the catalog's. `tests/test_codex_plugin_manifest.py` checks that the npm package ships those same skills plus the manifest files.
+
+### Fixed
+- **Governed-worker evaluators defer delivery-only criteria instead of failing them (rule E6, #1328).** A criterion whose evidence exists only after the deliver phase pushes (CI on the opened pull request, the pull request's title or body, a merge, a release) is now DEFERRED, neither PASS nor FAIL. Every part the run can show is still judged, and a failing in-run part still FAILs the item (deny-dominates). The evaluator names each deferred item (`ITEM <n>: DEFERRED — <the artifact it waits for>`, or a "Deferred to delivery" list) so the deliver gate can show it to the operator; a deferred item never fails the verdict by itself. E6 is distinct from E3: an in-run item the creator left as a follow-up is still judged. Pinned by `tests/test_governed_worker_rules.py`.
+
+## [12.57.0] — 2026-10-18
+
+### Added
+- **The estate shim relays through wicked-crew's broker on a container seat (wicked-core#1018).** A seat on the container floor has no estate of its own (no store is mounted, no `wicked-estate-mcp` is installed, no store pin reaches it), so every blast-radius, hotspot and recall lookup and every capture proposal was refused there. When a governed unit holds the broker channel (`WICKED_CREW_URL` + `WICKED_MCP_TOKEN`) and cannot reach estate locally (wicked-core's `WICKED_ESTATE_BROKER` marker, no pinned store, or no local binary), `scripts/_estate_client.py` sends each call to `POST /api/v1/mcp/call` as `mcp:estate/<tool>`; crew answers it on the host, scoped to the run. It is one more transport behind the same seam, so the skills that call the shim are unchanged: `--readonly` keeps its meaning (the read-only lookups plus `proposal.submit`), a `-32602` from estate keeps its code, and `health` asks the broker without spending a call. With neither a pinned store nor the channel, a governed unit still fails closed, and the reason now names both fixes. A relayed call the broker refused returns the usual empty value plus `broker_refusal` with its reason; `mode` reports the `transport`. Needs wicked-crew with the estate relay.
+
 ## [12.56.0] — 2026-10-17
 
 ### Added
@@ -1165,7 +1179,9 @@ through `v9.2.18`. Major themes across that span:
 
 For each of those releases, see the corresponding tag in git history.
 
-[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.56.0...HEAD
+[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.58.0...HEAD
+[12.58.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.57.0...v12.58.0
+[12.57.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.56.0...v12.57.0
 [12.56.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.55.1...v12.56.0
 [12.55.1]: https://github.com/mikeparcewski/wicked-garden/compare/v12.55.0...v12.55.1
 [12.55.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.54.0...v12.55.0

package/README.md

@@ -69,7 +69,17 @@ installs/updates the whole wicked-\* family (garden, its peers, and the rest).
 > and the previous copy is put back). Those transient dirs are **not plugins**; a leftover after an interrupted install is
 > safe to delete (`status` lists them).
 
-**Other CLIs (Codex, OpenCode, Pi, Antigravity)** — `npx wicked-installer install-<cli> wicked-garden` copies
+**Codex (codex-cli with `codex plugin`, 0.163+)** — garden is a registered Codex plugin: `.codex-plugin/plugin.json`
+declares the skills (`./skills`, namespaced `wicked-garden:<skill>`), the `wicked-estate` MCP server (started through
+`wicked-garden run scripts/estate_mcp.mjs`, which finds `wicked-estate-mcp` the way garden's scripts do:
+`WICKED_ESTATE_MCP_BIN` → PATH → `~/.local/bin`; that override, estate's store pins and the read-only/run markers are forwarded through `env_vars`, since Codex passes an MCP server only those plus PATH/HOME and the like, and `WICKED_ESTATE_READONLY` or a run marker adds `--readonly` as garden's estate client does), and no hooks (`hooks/hooks.json` is Claude Code's). By hand:
+`npm i -g wicked-garden`, then `codex plugin marketplace add "$(npm root -g)/wicked-garden"` and
+`codex plugin add wicked-garden@wicked-garden`. wicked-installer's Codex script does the same (pick Codex in
+`npx wicked-installer`, or run `node "$(npm root -g)/wicked-installer/dist/install-codex.js" wicked-garden`) and
+removes the loose skill copies it made earlier. A `[mcp_servers.wicked-estate]` entry in your Codex config takes
+precedence over the plugin's server.
+
+**Other CLIs (OpenCode, Pi, Antigravity, and Codex without `codex plugin`)** — `npx wicked-installer install-<cli> wicked-garden` copies
 the skills only (flat, by name — no `scripts/`, no venv). Every skill's text works there as written: own files are
 referenced relative to the skill's directory, other skills by name, and the shared runtime only through the
 launcher — `wicked-garden run scripts/<x>.py …`. So for script-backed skills the runtime prerequisite on those
@@ -130,7 +140,7 @@ false "done" runs into depends on the host and the entry path:
 |---|---|---|
 | **Any host — the gate, invoked** (`wicked-garden-prove`, an archetype's produces-gate → `scripts/qe/vault_gate.py`) | Re-hashes the recorded evidence and re-runs its verifier through `wicked-vault`: a false claim is **rejected**, an unresolvable backend **fails closed** (`gate: "unavailable"`). Hard gates also need an attestation under an explicit `--actor` that differs from the author's — a local label, not an authenticated identity. The verdict stops whatever acts on it. | With `--no-require`, a backend that cannot run falls back to the claim-only tracker and says so (`claim-only`, not re-derived); a working backend still re-derives. |
 | **Claude Code — plugin hooks** (plain conversation, "just work") | `PreToolUse` denies a few specific tool calls: native `EnterPlanMode` (always — planning goes through the archetype playbooks), writes to `MEMORY.md` / the auto-memory dir, build-phase writes on a high-complexity crew project with no challenge artifacts, a `phase_manager.py approve` whose gate preflight fails, a worktree cwd leak, and — only in `strict` mode (default `warn`) — invalid task metadata (`WG_TASK_METADATA`) and orphan state writes (`WG_BUS_EMIT_LINT`). Prompts are held until `/wicked-garden-core setup` completes. | Everything else. The archetype detector **steers** (it does not gate), the Stop-time claim sentinel is a fail-open **nudge** when a "done/passing" claim has no verdict for HEAD, `TaskCompleted` never blocks, and output governance is advisory. A completion claim is **not** blocked unless a gate is run. |
-| **Codex · OpenCode · Pi · Antigravity — skills only** (`npx wicked-installer install-<cli> wicked-garden`) | Nothing by itself: no plugin hooks are installed on those hosts. | The skill text tells the agent to run the gate; it blocks only when the agent does run it (and the launcher + `wicked-vault` are present). |
+| **Codex (plugin) · OpenCode · Pi · Antigravity — skills only** (`npx wicked-installer install-<cli> wicked-garden`) | Nothing by itself: no hooks are installed on those hosts (the Codex plugin opts out of them). | The skill text tells the agent to run the gate; it blocks only when the agent does run it (and the launcher + `wicked-vault` are present). |
 | **Compiled repo gate** (`/wicked-garden-prove compile <repo> --trigger hook,ci`) | `.wicked/gate.py` fails the **git pre-push hook / CI job** it is wired into, with no wicked-garden installed. | Without a trigger it is a script you run by hand. |
 | **wicked-crew governed run** | crew's engine decides each gated phase deny-dominates, on the layers that actually ran — deterministic floors, repo checks, policies, a judge. Review moves to a distinct seat when the roster has an eligible one; team runs refuse without one. | An ordinary run on a too-small roster keeps review on the creator seat and labels it "evaluator ≠ creator not held"; a pinned floor with no distinct judge is labelled "floor only"; a phase nothing gated is "approved by default, not verified". |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.56.0",
+  "version": "12.58.0",
   "type": "module",
   "description": "The skills your coding agent can't build alone: \"done\" re-checked from evidence, graph-aware search and multi-file refactor, 40 QE specialists, review panels from other models, and cross-session memory. Works in Claude Code, Codex, Antigravity, OpenCode and Pi, in CI, or in a wicked-crew job.",
   "keywords": [
@@ -34,7 +34,7 @@
   "main": "install.mjs",
   "scripts": {
     "test": "node scripts/ci/run_pytest.js",
-    "version": "node .github/scripts/sync-plugin-version.mjs && git add .claude-plugin/plugin.json .claude-plugin/marketplace.json",
+    "version": "node .github/scripts/sync-plugin-version.mjs && git add .claude-plugin/plugin.json .claude-plugin/marketplace.json .codex-plugin/plugin.json",
     "prepublishOnly": "node install.mjs --version"
   },
   "engines": {

package/scripts/_estate_client.py

@@ -64,6 +64,24 @@ never through the raw write CLI. In that mode every spawn is
   invocation only with ``--readonly`` AND a pinned store (core #471); this
   module produces exactly that argv shape for the spawned MCP.
 
+Container seats: the broker relay (wicked-core#1018)
+----------------------------------------------------
+A seat on wicked-crew's container floor has no estate of its own: the host's
+stores are never mounted into it (SQLite WAL across the VM file share is a
+corruption risk), the seat image ships no ``wicked-estate-mcp``, and no store
+pin reaches it. Its one way out is wicked-crew's broker, which every governed
+unit can reach with ``WICKED_CREW_URL`` + ``WICKED_MCP_TOKEN`` (a token bound
+to that unit). So in a governed unit that cannot reach estate locally (the
+container marker ``WICKED_ESTATE_BROKER`` is set, no store is pinned, or no
+``wicked-estate-mcp`` resolves) and that holds the broker channel, every call
+is RELAYED: ``POST <WICKED_CREW_URL>/api/v1/mcp/call {token, subject:
+"mcp:estate/<tool>", args}``. Crew answers it on the host, scoped to the run
+the token belongs to: the read-only lookups plus ``proposal.submit``, exactly
+what a ``--readonly`` MCP allows. No caller changes: the relay is one more
+transport behind the same seam (`_transport`). With neither a pinned local
+store nor the broker channel, a governed unit still fails closed with a reason
+(`governed_refusal`).
+
 Fail-open contract
 ------------------
 Every public function is fail-open: on a missing binary, spawn failure,
@@ -88,6 +106,8 @@ import shutil
 import subprocess
 import sys
 import threading
+import urllib.error
+import urllib.request
 from pathlib import Path
 from typing import Any, Callable, Optional
 
@@ -192,6 +212,22 @@ DB_FLAG = "--db"
 # capture proposals (`facets.project`), overriding whatever the worker self-derived;
 # absent/blank (older cores, or a non-run invocation) it changes nothing.
 RUN_PROJECT_ENV = "WICKED_RUN_PROJECT"
+# The broker relay (wicked-core#1018). wicked-core sets the marker on a container seat whose
+# gateway reaches crew's broker; the URL and the unit-bound token are on every governed unit.
+BROKER_ENV = "WICKED_ESTATE_BROKER"
+CREW_URL_ENV = "WICKED_CREW_URL"
+MCP_TOKEN_ENV = "WICKED_MCP_TOKEN"
+BROKER_SUBJECT_PREFIX = "mcp:estate/"
+# The broker's own per-call deadline is 30 s; the HTTP wait outlasts it so the broker, not the
+# client, decides a slow call (a proposal that timed out client-side may still have landed).
+BROKER_MIN_TIMEOUT_S = 35.0
+# The tools crew relays (`wicked-crew` `src/mcp/estate-relay.ts`): what `list-tools` reports in
+# relay mode. A tool off this list is refused by the broker with its reason.
+BROKER_TOOLS = (
+    "SearchEntity", "RetrieveEntity", "TraverseGraph", "Path", "BlastRadius", "Lineage",
+    "RankHotspots", "Communities", "RulesInventory", "rules.recall", "memory.recall",
+    "knowledge.recall", "proposal.submit",
+)
 
 _readonly_flag: bool = False                  # set by --readonly / set_readonly()
 _governed_flag: bool = False                  # set by --governed / set_governed()
@@ -249,20 +285,48 @@ def store_pinned() -> bool:
     return bool(_db_override) or any(os.environ.get(k, "").strip() for k in STORE_PIN_ENV)
 
 
+def broker_channel() -> Optional[tuple]:
+    """``(url, token)`` for crew's broker when this unit holds the channel, else None."""
+    url = os.environ.get(CREW_URL_ENV, "").strip().rstrip("/")
+    token = os.environ.get(MCP_TOKEN_ENV, "").strip()
+    if not url or not token or not (url.startswith("http://") or url.startswith("https://")):
+        return None
+    return url, token
+
+
+def use_broker() -> bool:
+    """Relay through crew's broker? A governed unit that holds the broker channel and cannot
+    reach estate locally: the container marker is set, no store is pinned, or no
+    `wicked-estate-mcp` resolves (module docstring, wicked-core#1018)."""
+    if not is_governed() or broker_channel() is None:
+        return False
+    return _env_truthy(BROKER_ENV) or not store_pinned() or resolve_mcp_bin() is None
+
+
+def transport_name() -> Optional[str]:
+    """``broker`` (relayed), ``local`` (spawn a pinned `wicked-estate-mcp`), or None (refused)."""
+    if use_broker():
+        return "broker"
+    return None if governed_refusal() else "local"
+
+
 def governed_refusal() -> Optional[str]:
-    """The reason NOT to spawn: a governed run with no pinned store. None = clear to go.
+    """The reason NOT to call estate: a governed run with no pinned store and no broker
+    channel. None = clear to go.
 
     Belt-and-braces with the gate hook (which denies the same shape as `no-pin`):
-    the shim never resolves the operator's default stores from inside a run.
+    the shim never resolves the operator's default stores from inside a run. A unit
+    that holds the broker channel relays instead (`use_broker`): crew picks the store.
     """
     marker = governed_marker()
-    if marker is None or store_pinned():
+    if marker is None or store_pinned() or use_broker():
         return None
     return (
-        f"governed unit ({marker} is set) but no estate store is pinned: pass "
-        f"{DB_FLAG} <path> or set {' / '.join(STORE_PIN_ENV)} in the worker environment; "
-        "refusing to spawn wicked-estate-mcp against an unpinned store (it would resolve "
-        "the operator's defaults)"
+        f"governed unit ({marker} is set) but no estate store is pinned and no broker "
+        f"channel is present: pass {DB_FLAG} <path> or set {' / '.join(STORE_PIN_ENV)} in "
+        f"the worker environment, or run where wicked-crew hands the unit {CREW_URL_ENV} "
+        f"and {MCP_TOKEN_ENV} (its estate relay); refusing to spawn wicked-estate-mcp "
+        "against an unpinned store (it would resolve the operator's defaults)"
     )
 
 
@@ -684,6 +748,120 @@ def _maybe_install_broker() -> None:
 _maybe_install_broker()
 
 
+# ─────────────────────────────────────────────────────────────────────────────
+# Broker relay transport (wicked-core#1018) — same contract as `_dispatch`
+# ─────────────────────────────────────────────────────────────────────────────
+
+#: The last reason the broker gave for not answering (a refusal, an unreachable broker), so
+#: the CLI can say WHY a relayed call came back empty instead of a bare empty result.
+_last_broker_refusal: Optional[str] = None
+
+
+def _broker_post(url: str, body: dict, timeout: float) -> "tuple[Optional[int], Optional[dict], Optional[str]]":
+    """POST JSON to the broker: ``(status, body, None)``, or ``(None, None, why)`` unreachable."""
+    req = urllib.request.Request(url, data=json.dumps(body).encode("utf-8"), method="POST",
+                                 headers={"Content-Type": "application/json"})
+    try:
+        with urllib.request.urlopen(req, timeout=timeout) as res:
+            status, raw = res.status, res.read()
+    except urllib.error.HTTPError as err:
+        status, raw = err.code, err.read()
+    except (urllib.error.URLError, OSError, ValueError) as err:
+        return None, None, f"the broker at {url} did not answer: {getattr(err, 'reason', err)}"
+    try:
+        parsed = json.loads(raw.decode("utf-8")) if raw else {}
+    except (UnicodeDecodeError, json.JSONDecodeError):
+        return status, None, f"the broker answered {status} with a body that is not JSON"
+    return (status, parsed, None) if isinstance(parsed, dict) else (status, None, "not a JSON object")
+
+
+def _broker_init(rid: Any) -> dict:
+    return {"jsonrpc": "2.0", "id": rid, "result": {
+        "protocolVersion": "2024-11-05", "capabilities": {},
+        "serverInfo": {"name": "wicked-estate", "version": "relay"}}}
+
+
+def _broker_dispatch(requests: list, *, db: Optional[str], timeout: float) -> dict:
+    """Relay transport: answer a JSON-RPC batch through crew's broker. Return {id: response}.
+
+    * ``initialize`` is answered once the broker has answered anything in the batch; alone
+      (a `health()` probe) it asks the broker for this unit's tool list, which spends no
+      call budget, so a dead broker or a revoked token is unhealthy.
+    * ``tools/list`` lists the relayed tools (`BROKER_TOOLS`).
+    * ``tools/call`` is ``POST /api/v1/mcp/call`` with subject ``mcp:estate/<name>``. An
+      ``ok`` answer hands back the envelope crew relayed; a JSON-RPC error estate raised
+      (``result.rpcError``) becomes the same ``error`` a local server would send, code kept
+      (``-32602`` = fix the arguments). Any refusal becomes an ``error`` with code None
+      and its reason and remedy, also kept in `_last_broker_refusal`.
+
+    ``db`` is ignored: crew picks the store (the run's own). Fail-open: an unreachable
+    broker leaves the ids out, as a dead local server does.
+    """
+    global _last_broker_refusal
+    _last_broker_refusal = None
+    channel = broker_channel()
+    if channel is None:
+        return {}
+    url, token = channel
+    calls = [r for r in requests if r.get("id") is not None and r.get("method") == "tools/call"]
+    responses: dict = {}
+    if not calls:
+        # `health()` / `list_tools()`: ask the broker for this unit's tool list — it checks the
+        # token and spends no call budget. A dead broker or a revoked token answers nothing.
+        status, body, why = _broker_post(f"{url}/api/v1/mcp/tools", {"token": token}, max(timeout, 5.0))
+        if status != 200 or body is None:
+            _last_broker_refusal = why or str((body or {}).get("error") or f"the broker answered {status}")
+            return {}
+        for req in requests:
+            rid = req.get("id")
+            if rid is None:
+                continue
+            if req.get("method") == "initialize":
+                responses[rid] = _broker_init(rid)
+            elif req.get("method") == "tools/list":
+                responses[rid] = {"jsonrpc": "2.0", "id": rid,
+                                  "result": {"tools": [{"name": t} for t in BROKER_TOOLS]}}
+        return responses
+    reached = False
+    for req in calls:
+        rid = req["id"]
+        params = req.get("params") or {}
+        tool = str(params.get("name") or "")
+        status, body, why = _broker_post(
+            f"{url}/api/v1/mcp/call",
+            {"token": token, "subject": BROKER_SUBJECT_PREFIX + tool, "args": params.get("arguments") or {}},
+            max(timeout, BROKER_MIN_TIMEOUT_S))
+        if status is None or body is None:
+            _last_broker_refusal = why
+            continue
+        reached = True
+        result = body.get("result")
+        if body.get("outcome") == "ok" and isinstance(result, dict):
+            rpc = result.get("rpcError")
+            if isinstance(rpc, dict):
+                responses[rid] = {"jsonrpc": "2.0", "id": rid, "error": {
+                    "code": rpc.get("code"), "message": rpc.get("message") or "estate error"}}
+            else:
+                responses[rid] = {"jsonrpc": "2.0", "id": rid, "result": result}
+            continue
+        outcome = body.get("outcome") or body.get("code") or f"http {status}"
+        reason = body.get("reason") or body.get("error") or "refused"
+        remedy = body.get("remedy")
+        message = f"broker {outcome}: {reason}" + (f" ({remedy})" if remedy else "")
+        _last_broker_refusal = message
+        responses[rid] = {"jsonrpc": "2.0", "id": rid, "error": {"code": None, "message": message}}
+    if reached:
+        for req in requests:
+            if req.get("method") == "initialize" and req.get("id") is not None:
+                responses[req["id"]] = _broker_init(req["id"])
+    return responses
+
+
+def _transport() -> Callable[..., dict]:
+    """The transport this call uses: the broker relay when `use_broker`, else the local seam."""
+    return _broker_dispatch if use_broker() else _active_dispatch
+
+
 # ─────────────────────────────────────────────────────────────────────────────
 # JSON-RPC — handshake + one tool call, all fail-open
 # ─────────────────────────────────────────────────────────────────────────────
@@ -721,7 +899,7 @@ def _rpc(method: str, params: dict, *, timeout: float) -> Optional[dict]:
         {"jsonrpc": "2.0", "method": "notifications/initialized", "params": {}},
         {"jsonrpc": "2.0", "id": 2, "method": method, "params": params},
     ]
-    responses = _active_dispatch(requests, db=resolve_db(), timeout=timeout)
+    responses = _transport()(requests, db=resolve_db(), timeout=timeout)
     if 1 not in responses:  # handshake never landed → estate unreachable
         return None
     return responses.get(2)
@@ -787,7 +965,7 @@ def health(timeout: float = 5.0) -> bool:
     """
     try:
         requests = [_initialize_request()]
-        responses = _active_dispatch(requests, db=resolve_db(), timeout=timeout)
+        responses = _transport()(requests, db=resolve_db(), timeout=timeout)
         resp = responses.get(1)
         return bool(
             isinstance(resp, dict)
@@ -1189,6 +1367,10 @@ _USAGE = (
 
 
 def _emit(obj: Any) -> None:
+    # A relayed call that came back empty says why (the broker's reason and remedy), additively:
+    # the fail-open empty value is unchanged.
+    if isinstance(obj, dict) and _last_broker_refusal and "broker_refusal" not in obj:
+        obj = {**obj, "broker_refusal": _last_broker_refusal}
     sys.stdout.write(json.dumps(obj))
     sys.stdout.write("\n")
 
@@ -1207,7 +1389,8 @@ def main(argv: list) -> int:
         # A pure local probe — reports the mode without spawning, refusal included.
         _emit({"governed": is_governed(), "marker": governed_marker(),
                "readonly": read_only(), "store_pinned": store_pinned(),
-               "db": resolve_db(), "refusal": governed_refusal()})
+               "db": resolve_db(), "transport": transport_name(),
+               "broker": broker_channel() is not None, "refusal": governed_refusal()})
         return 0
     refusal = governed_refusal()
     if refusal:

package/scripts/estate_mcp.mjs

@@ -0,0 +1,188 @@
+#!/usr/bin/env node
+/**
+ * estate_mcp.mjs — start the wicked-estate MCP server over stdio for a host that loads garden as
+ * a plugin (Codex: `.codex-plugin/mcp.json` runs `wicked-garden run scripts/estate_mcp.mjs`).
+ *
+ * The binary is found the way garden's own estate client finds it
+ * (`scripts/_estate_client.py` `resolve_mcp_bin`), so the plugin and the skills talk to the same
+ * binary and no install path is written into the manifest:
+ *
+ *   1. WICKED_ESTATE_MCP_BIN, when it names an existing file;
+ *   2. `wicked-estate-mcp` on PATH — an executable file, as `shutil.which` requires (PATHEXT on
+ *      Windows);
+ *   3. ~/.local/bin/wicked-estate-mcp (or `.exe`).
+ *
+ * stdin/stdout/stderr are inherited (the MCP stream passes straight through), the caller's cwd is
+ * kept (the binary resolves its store from it), and arguments after the script name are passed
+ * on. The read-only and governed-unit rules of `_estate_client.py` apply here too: `--readonly`
+ * is added when WICKED_ESTATE_READONLY / WICKED_GOVERNED is truthy or a run marker
+ * (WICKED_RUN_ID, WICKED_GATE_SCOPE, WICKED_WRITE_ROOTS) is set — estate only honours the
+ * literal flag — and a governed unit with no pinned store (--db, WICKED_ESTATE_DB, WICKED_HOME,
+ * WICKED_MEMORY_DB) is refused rather than pointed at the operator's default stores. The exit code is the server's; SIGINT/SIGTERM/SIGHUP are forwarded. When no binary is found
+ * it writes one JSON line on stderr — {"ok": false, "reason": …, "tried": […]} — and exits 1, so
+ * the host reports a failed MCP server rather than a hung one.
+ *
+ * Pure helpers are exported for tests (tests/test_codex_plugin_manifest.py).
+ */
+import { accessSync, constants as fsConstants, realpathSync, statSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { homedir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const MCP_BIN_NAME = "wicked-estate-mcp";
+export const OVERRIDE_ENV = "WICKED_ESTATE_MCP_BIN";
+
+function isFile(p) {
+  try {
+    return statSync(p).isFile();
+  } catch {
+    return false;
+  }
+}
+
+/** shutil.which's test: a regular file the user may execute (Windows has no execute bit). */
+function isExecutableFile(p, platform = process.platform) {
+  if (!isFile(p)) return false;
+  if (platform === "win32") return true;
+  try {
+    accessSync(p, fsConstants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Resolve the estate MCP binary. Returns { bin, tried } — `bin` is null when nothing qualifies.
+ * `env`, `platform`, `home` and `fileExists` are seams for tests.
+ */
+export function resolveEstateMcpBin({
+  env = process.env,
+  platform = process.platform,
+  home = homedir(),
+  fileExists = isFile,
+  isExecutable = (p) => isExecutableFile(p, platform),
+} = {}) {
+  const p = platform === "win32" ? path.win32 : path.posix;
+  const tried = [];
+  const override = env[OVERRIDE_ENV];
+  if (override) {
+    tried.push(`${OVERRIDE_ENV}=${override}`);
+    if (fileExists(override)) return { bin: override, tried };
+  }
+  const exts = platform === "win32"
+    ? ["", ...(env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean).map((e) => e.toLowerCase())]
+    : [""];
+  const pathVar = env.PATH ?? env.Path ?? "";
+  for (const dir of pathVar.split(platform === "win32" ? ";" : ":")) {
+    if (!dir) continue;
+    for (const ext of exts) {
+      const candidate = p.join(dir, MCP_BIN_NAME + ext);
+      // PATH entries must be executable (as shutil.which requires); the override and
+      // ~/.local/bin only need to be files, exactly as _estate_client.py checks them.
+      if (isExecutable(candidate)) return { bin: candidate, tried: [...tried, "PATH"] };
+    }
+  }
+  tried.push("PATH");
+  const local = p.join(home, ".local", "bin");
+  for (const name of [MCP_BIN_NAME, `${MCP_BIN_NAME}.exe`]) {
+    const candidate = p.join(local, name);
+    tried.push(candidate);
+    if (fileExists(candidate)) return { bin: candidate, tried };
+  }
+  return { bin: null, tried };
+}
+
+const GOVERNED_MARKERS = ["WICKED_RUN_ID", "WICKED_GATE_SCOPE", "WICKED_WRITE_ROOTS"];
+const STORE_PIN_ENV = ["WICKED_ESTATE_DB", "WICKED_HOME", "WICKED_MEMORY_DB"];
+const truthy = (v) => !["", "0", "false", "no"].includes(String(v ?? "").trim().toLowerCase());
+
+/**
+ * The argv to hand estate, or the reason to refuse — `_estate_client.parse_cli_flags()`,
+ * `read_only()`, `governed_refusal()` and `mcp_argv()` applied to the launcher's own argv and
+ * environment. Accepted flags: `--readonly`, `--governed`, `--db <path>` / `--db=<path>`
+ * (anywhere); any other `--flag` is refused (a misspelt `--read-only` must never reach a
+ * write-capable server). The child argv is `[--readonly] [--db <path>] …positionals`, the only
+ * `--db` spelling estate reads.
+ */
+export function estateArgv(argv, env = process.env) {
+  let readonlyFlag = false;
+  let governedFlag = false;
+  let db = null;
+  const rest = [];
+  for (let i = 0; i < argv.length; i += 1) {
+    const tok = argv[i];
+    if (tok === "--readonly") readonlyFlag = true;
+    else if (tok === "--governed") governedFlag = true;
+    else if (tok === "--db") {
+      const value = argv[i + 1];
+      if (!value || value.startsWith("-")) return { usage: "--db requires a store path" };
+      db = value;
+      i += 1;
+    } else if (tok.startsWith("--db=")) {
+      const value = tok.slice("--db=".length);
+      if (!value) return { usage: "--db= requires a store path" };
+      db = value;
+    } else if (tok.startsWith("--") && tok.length > 2) {
+      return { usage: `unknown flag ${JSON.stringify(tok)}: the estate launcher accepts --readonly, --governed and --db <path> only (spell --readonly exactly)` };
+    } else rest.push(tok);
+  }
+  const marker = governedFlag ? "--governed"
+    : truthy(env.WICKED_GOVERNED) ? "WICKED_GOVERNED"
+    : GOVERNED_MARKERS.find((k) => String(env[k] ?? "").trim());
+  const pinned = !!db || STORE_PIN_ENV.some((k) => String(env[k] ?? "").trim());
+  if (marker && !pinned) {
+    return { refusal: `governed unit (${marker} is set) but no estate store is pinned: set ${STORE_PIN_ENV.join(" / ")} or pass --db; refusing to start wicked-estate-mcp against the operator's default stores` };
+  }
+  const readOnly = readonlyFlag || !!marker || truthy(env.WICKED_ESTATE_READONLY);
+  return { argv: [...(readOnly ? ["--readonly"] : []), ...(db ? ["--db", db] : []), ...rest] };
+}
+
+function main(argv) {
+  const plan = estateArgv(argv);
+  if (plan.usage || plan.refusal) {
+    process.stderr.write(JSON.stringify({ ok: false, reason: plan.usage ?? plan.refusal, tried: [] }) + "\n");
+    return process.exit(plan.usage ? 2 : 1);
+  }
+  argv = plan.argv;
+  const { bin, tried } = resolveEstateMcpBin();
+  if (!bin) {
+    process.stderr.write(JSON.stringify({
+      ok: false,
+      reason: `${MCP_BIN_NAME} not found — install wicked-estate (npx wicked-installer install wicked-estate) or set ${OVERRIDE_ENV}`,
+      tried,
+    }) + "\n");
+    return process.exit(1);
+  }
+  const child = spawn(bin, argv, { stdio: "inherit", shell: false });
+  for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) {
+    process.on(sig, () => {
+      try {
+        child.kill(sig);
+      } catch {
+        /* already gone */
+      }
+    });
+  }
+  child.on("error", (err) => {
+    process.stderr.write(JSON.stringify({ ok: false, reason: `could not start ${bin}: ${err.message}`, tried }) + "\n");
+    process.exit(1);
+  });
+  child.on("exit", (code, signal) => {
+    process.exit(code ?? (signal ? 128 + (signalNumber(signal) || 1) : 1));
+  });
+}
+
+function signalNumber(name) {
+  return { SIGHUP: 1, SIGINT: 2, SIGKILL: 9, SIGTERM: 15 }[name];
+}
+
+function invokedDirectly() {
+  try {
+    return Boolean(process.argv[1]) && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+if (invokedDirectly()) main(process.argv.slice(2));

package/skills/governed-worker/SKILL.md

@@ -139,6 +139,19 @@ verdict with reasons. You are output-only.
   creator's reason. An unjustified duplicate is at least a Concern. So is new code
   whose output records no built-in check (C8). Code that swaps out the framework the
   user or a policy chose is a Critical.
+- **E6 — Judge what the run can show; defer what only delivery can.** A
+  criterion whose evidence exists only after the deliver phase pushes — CI
+  results on the opened pull request, the pull request's title or body, a merge,
+  a release — is DEFERRED: neither PASS nor FAIL. Judge every part you can check
+  before delivery (the tree, your own runs in it, the floor record: tests,
+  format, lint, CHANGELOG). An item that mixes the two FAILs when its in-run part
+  fails; a deferral never lifts a failing in-run part. Otherwise name what waits:
+  `ITEM <n>: DEFERRED — <the artifact it waits for>` when your brief asks for item
+  lines, else a "Deferred to delivery" list above the verdict line. A deferred
+  item never fails the unit by itself, and a promise that CI will pass is never a
+  PASS. The deliver gate shows each deferred check to the operator. This is not
+  a creator's deferral (E3): an in-run item the creator left as a follow-up is
+  still judged.
 
 Method: read the outcome and design, then the changed files; for each, ask
 whether it follows the design, whether tests cover the key paths, and whether
@@ -146,7 +159,8 @@ the evidence (commands + exit codes) supports the claims; re-run what you can
 without mutating; sort findings into Critical (must fix), Concern, Suggestion;
 verdict: make the LAST line of your output exactly `VERDICT: PASS` or
 `VERDICT: FAIL` — one plain-text line (no `**`, backticks or `#` around it),
-findings above it. FAIL needs at least one Critical or a CONDITIONS list;
+findings above it. FAIL needs at least one Critical or a CONDITIONS list; a
+DEFERRED item (E6) is neither, so it never makes the verdict FAIL;
 there is no conditional pass (CONDITIONAL, APPROVE, REJECT and SKIP are not
 verdicts); never quote another VERDICT line in your message; no verdict line
 = FAIL (human gate). If you are the seat that created the work, say so and
@@ -207,6 +221,7 @@ Rules cite the acceptance-program findings that motivated them.
 | E3 | garden#1223 (companion to wicked-core#760) |
 | E4 | garden#1253 (S19a: `before:1` vs the form's `before:2`, passed on presence) |
 | E5 | operator ruling 2026-10-12 (wicked-core POL-2101) |
+| E6 | operator-approved fix, 2026-10-19 (runs 290a7fee and a74f51ac: reviews FAILed "CI green on every OS" and "PR body says Closes #N", which cannot exist before the deliver phase) |
 | N1 | F-RC2-038 |
 
 History: the `crew-implementer`, `crew-reviewer` and `crew-researcher` fork-agent definitions

package/skills/repo-learn/refs/capture-proposals.md

@@ -41,9 +41,10 @@ wicked-garden run scripts/_estate_client.py --readonly propose '{"kind_type":"kn
 
 `--readonly` is literal (the shim spawns `wicked-estate-mcp --readonly`; `proposal.submit`
 is the safe write it still permits). The store is pinned from the worker environment
-(`WICKED_ESTATE_DB` / `WICKED_HOME` / `WICKED_MEMORY_DB`) or `--db <path>`; in a run an
-unpinned store is refused with `{"ok": false, "reason": …}` — report it, do not guess a
-store. The shim answers `{"ok": true, "id": "<proposal-id>"}` or `{"ok": false,
+(`WICKED_ESTATE_DB` / `WICKED_HOME` / `WICKED_MEMORY_DB`) or `--db <path>`; a container seat
+relays the same `propose` through wicked-crew's broker (`WICKED_CREW_URL` + `WICKED_MCP_TOKEN`),
+which files it under the run's project. With neither, a run refuses it with `{"ok": false,
+"reason": …}` — report it, do not guess a store. The shim answers `{"ok": true, "id": "<proposal-id>"}` or `{"ok": false,
 "reason": …, "code": <json-rpc code or null>}`: `-32602` is a *your-args* bug (fix the
 shape), `null` means the estate was unreachable (keep the objects — next section). Pass
 the JSON as ONE quoted argument, even when it is long: `propose` does not read stdin. A

package/skills/search/SKILL.md

@@ -87,10 +87,13 @@ wicked-garden run scripts/_estate_client.py --readonly call '{"tool":"BlastRadiu
 ```
 `--readonly` is literal (the spawned estate binary reads only; `WICKED_ESTATE_READONLY=1` rides
 every worker so it spawns read-only by default). The store rides `WICKED_ESTATE_DB` /
-`WICKED_HOME` / `WICKED_MEMORY_DB` from the environment, or `--db <path>`; the shim refuses an
-unpinned store (`{"ok": false, "reason": …}`) — report that, never guess a store. There is no
-other transport: no estate tool is registered on any seat, so there is nothing to "connect",
-nothing to fall back to, and no second rung — a grep is not the graph.
+`WICKED_HOME` / `WICKED_MEMORY_DB` from the environment, or `--db <path>`. A container seat has
+no local store: the same command relays through wicked-crew's broker (the run hands the seat
+its address and a unit token), which answers from the run's own graph. With neither, the shim refuses
+(`{"ok": false, "reason": …}`); a relayed call the broker refused names why in
+`broker_refusal` — report either, never guess a store. There is no other transport: no estate
+tool is registered on any seat, so there is nothing to "connect", nothing to fall back to, and
+no second rung — a grep is not the graph.
 
 **Resolve the symbol.** Estate tools take symbol **names** directly (a file node's name is its
 repo-relative path, e.g. `scripts/_bus.py`); when a name is ambiguous or you need the node id,