wicked-garden 12.57.0 → 12.59.0

package/.claude-plugin/components.json

@@ -2,7 +2,7 @@
   "_comment": "Issue #328: Component declarations for wicked-garden plugin. Claude Code plugin.json does not yet support inline component declarations beyond path overrides. This manifest documents all components for tooling, validation, and future schema support. When plugin.json gains a 'components' field, merge this data into plugin.json. The plugin is skills-only: former commands/ became actions of consolidated per-domain skills, and former agents/ became standalone context:fork worker skills (enumerated under fork_skills). Regenerate derived blocks with scripts/ci/sync_components.py.",
   "domains": ["agentic", "crew", "data", "demo", "engineering", "jam", "mem", "persona", "platform", "product", "qe", "search"],
   "summary": {
-    "skills": 138,
+    "skills": 139,
     "fork_skills": 69,
     "hooks": 13,
     "specialists": 7
@@ -13,6 +13,7 @@
     "agentic-performance-analyst": ["agentic-performance-analyst"],
     "agentic-safety-reviewer": ["agentic-safety-reviewer"],
     "archetype": ["archetype"],
+    "build-guide": ["build-guide"],
     "classify": ["classify"],
     "core": ["core"],
     "data": ["data"],

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.57.0"}], "version": "12.57.0"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.59.0"}], "version": "12.59.0"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.57.0",
+  "version": "12.59.0",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), multi-model second opinions (fallback seats labelled) (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": ">=0.8.0",
   "wicked_ledger_version": "^0.6.0",

package/.codex-plugin/mcp.json

@@ -0,0 +1,27 @@
+{
+  "mcpServers": {
+    "wicked-estate": {
+      "command": "wicked-garden",
+      "args": [
+        "run",
+        "scripts/estate_mcp.mjs"
+      ],
+      "env_vars": [
+        "WICKED_ESTATE_MCP_BIN",
+        "WICKED_ESTATE_DB",
+        "WICKED_HOME",
+        "WICKED_MEMORY_DB",
+        "WICKED_KNOWLEDGE_DB",
+        "WICKED_XEDGE_DB",
+        "WICKED_ESTATE_READONLY",
+        "WICKED_GOVERNED",
+        "WICKED_RUN_ID",
+        "WICKED_RUN_UNIT",
+        "WICKED_RUN_AGENT",
+        "WICKED_RUN_PROJECT",
+        "WICKED_GATE_SCOPE",
+        "WICKED_WRITE_ROOTS"
+      ]
+    }
+  }
+}

package/.codex-plugin/plugin.json

@@ -0,0 +1,27 @@
+{
+  "name": "wicked-garden",
+  "version": "12.59.0",
+  "description": "The skills your coding agent can't build alone: \"done\" re-checked from evidence, graph-aware search and multi-file refactor, 40 QE specialists, review panels from other models, and cross-session memory. Works in Claude Code, Codex, Antigravity, OpenCode and Pi, in CI, or in a wicked-crew job.",
+  "keywords": [
+    "coding-agent",
+    "evidence-gate",
+    "code-graph",
+    "refactoring",
+    "testing",
+    "memory",
+    "multi-model"
+  ],
+  "skills": "./skills",
+  "mcpServers": "./.codex-plugin/mcp.json",
+  "hooks": {
+    "description": "No hooks on Codex: hooks/hooks.json is Claude Code's event model; garden's skills run the gate themselves on skills-only hosts.",
+    "hooks": {}
+  },
+  "interface": {
+    "displayName": "Wicked Garden",
+    "shortDescription": "Evidence-gated done, graph-aware search and refactor, QE specialists, review panels, cross-session memory.",
+    "developerName": "Mike Parcewski",
+    "category": "Developer Tools",
+    "websiteURL": "https://github.com/mikeparcewski/wicked-garden"
+  }
+}

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 ## [Unreleased]
 
+## [12.59.0] — 2026-10-25
+
+### Added
+- **`wicked-garden-build-guide`: discover how a repo builds and tests, and propose its build/test guide (#1332, DES-BUILD-GUIDE; pairs with wicked-core#1066).** The guide is `.wicked/build-guide.json` in contract v1. The wicked-core floor interprets it instead of hardcoding runners, and reads it from the base tree.
+  - **Discover.** `scripts/build_guide/discover.py` reads CI config first, then the manifests, follows `make`/`just`/`npm` one level into what they run, and lists every test candidate with its `file:line`. It holds no runner table. The agent then learns each runner's formats and its list, run-one and deselect flags from the runner's own `--version` and `--help`.
+  - **Results.** Structured results come first, but only when their ids round-trip through `list`, `alone` and `deselect`. Otherwise the skill writes a text parser: RE2-only, `^…$` rules on the runner's own final summary.
+  - **Validate.** The skill writes two mutation probes (`mutation`, `mutation2`), then runs `wicked-core floor probe`, which alone writes `verified`. It stops after at most 3 attempts per check. When the probe is unavailable, it says plainly that the guide is unverified and the floor will not use it for exclusion.
+  - **Propose.** The guide lands as a PR, or through the deliver gate inside a crew run. It is never written silently.
+  - **Scripts.** `check.py` validates a guide against `schemas/build-guide.v1.json`, vendored byte for byte from wicked-core main (72da31b, the file as #1066 landed it) and pinned to its git blob by a test. The stdlib validator implements `propertyNames`, so the schema's env-name rule is checked. For a test check (one with `list`), it flags what the floor requires: a non-empty `failedExit`, `alone`, `deselect`, a `text`/`junit` kind and two distinct mutation probes. It also flags a missing `version` piece and any required probe that did not pass. It reports the floor's load-time refusals in core's words: an empty `run`, a bad `stage`, a `list` with no `failedExit`, a `0` in `failedExit`, an invalid `cwd` (`""`, a `.` or empty segment, `..`, `\`, `:` or a drive), a check `name` that is not 1-64 of `A-Z a-z 0-9 . _ -` (or is `.`/`..`), an env name that is not `[A-Z_][A-Z0-9_]*` or is a loader/shell hook, and `{ids:re|}` among the per-id tokens or beside `{q}`. JUnit is read with a real XML parser (`xml.etree`), as core reads it with roxmltree. With `--repo`, it warns for every CI step that no check declares in that step's working directory. In the directories its checks cover, a guide's checks replace the floor's detection, so gates such as install, build and lint must be declared too, sub-packages included. `rehearse.py` mirrors the core probe (`list`, `run`, `mutation`, `ids`, `alone`, `deselect`, `multi`, `affected`, `version`) in a scratch copy. Like core, it needs a green clean run. When any probe fails, it re-runs the whole probe once on a fresh copy and records that retry, each result marked `(retried)`. It composes argvs around `--` as core does, and it skips gates. The skill tells the user to onboard from a green commit. `probe.py` wraps the core command, and the probe records `runnerVersion` from the check's `version` piece. Like core, `rehearse.py` runs the guide's `install` step for the check's `cwd` first in every fresh copy (a failed install fails every probe; with an install step nothing is linked to the host repo), and writes a mutation file only inside the copy, never through a link. A check name is unique per `cwd` (one `install` per directory). `discover.py` resolves a step's `make`/`just`/`npm` command against its own `working-directory`, ends a `- run: |` block at the step's other keys, and counts a CI wrapper whose recipe runs the tests (`make check`) as a candidate; `check.py --repo` counts a recipe as declared only when every command in it is, reports a schema-invalid guide instead of crashing, and no longer flags an escaped metacharacter (`C\++`) as a non-RE2 construct.
+  - **Seeds** for cargo/libtest (reconciled with wicked-core's own probed guide: merged stderr, binary-qualified ids), pytest (text on the short summary, `--force-short-summary`) and vitest (JUnit, `results.id: ["name"]`); each test check carries two mutation probes and a `version` piece, and each seed declares its fixture's CI gates.
+  - **Onboarding.** Full onboarding in `wicked-garden-core` `setup` (step E) hands off to it.
+  - **Tests and evals.** `tests/build_guide/` holds real-runner tests on five fixture repos: cargo with a text parser, pytest with JUnit, vitest with a JUnit reporter, a fake runner with no structured output, and a repo with no tests. It also holds five eval cases with a deterministic grader.
+  - **Contract notes.** The skill's `refs/contract-notes.md` records the pinned semantics and the coordinator's rulings: `{id:re}`/`{ids:re|}` regex placeholders, the `version` piece, retry once, exit-code classes, and guide checks replacing detection. It also explains why the pytest seed is text: JUnit cannot rebuild a class method's node id.
+
+### Fixed
+- Constrain the MCP TypeScript template's `@opentelemetry/api` dependency to `~1.9.0`, so a fresh `npm install` no longer hits the `@opentelemetry/sdk-logs` peer conflict now that API 1.10.0 is published (#1344).
+- **`install.mjs` finds a binary on PATH without spawning a shell (#1345).** `findBin` ran `command -v` (`where` on Windows) under a 2-second timeout, so on a loaded machine a slow fork read as "not installed": `pack check` said Python was missing, and `install` skipped `uv sync` as if uv were absent. Found by the build guide's floor probe on a host at load 50-110, where `tests/packs/*` and `test_uv_sync_failure_is_surfaced_not_swallowed` failed for that reason alone. It now scans PATH itself and returns the absolute path of the first executable file `command -v` or `where` would name: an empty POSIX entry is the current directory, a relative entry is read against the current directory, and Windows looks in the current directory first and tries each `PATHEXT` extension unless the name already ends with one. The dry-run spawn-guard test's positive control now plants a `python3` on PATH, and its negative plants a `uv` the install would run; new tests pin that uv is found without a child process, that a non-executable file is not a binary, and that relative and empty PATH entries resolve as `command -v` resolves them.
+
+## [12.58.0] — 2026-10-20
+
+### Added
+- **garden is a registered Codex plugin (#1326).** `.codex-plugin/plugin.json` (Codex prefers it over `.claude-plugin/plugin.json`) declares the skills directory (`./skills`; Codex namespaces them `wicked-garden:<skill>`), the `wicked-estate` MCP server (`.codex-plugin/mcp.json`) and an explicit empty `hooks` block, because without one Codex would load `hooks/hooks.json`, which is Claude Code's hook model. Codex installs it from the existing `.claude-plugin/marketplace.json`: `codex plugin marketplace add <garden package root>`, then `codex plugin add wicked-garden@wicked-garden`. The MCP server starts through `wicked-garden run scripts/estate_mcp.mjs`. That new launcher finds `wicked-estate-mcp` the way `scripts/_estate_client.py` does (`WICKED_ESTATE_MCP_BIN`, then PATH, then `~/.local/bin`), so no install path is written into the manifest. The server forwards the binary override, estate's store pins (`WICKED_ESTATE_DB`, `WICKED_HOME`, `WICKED_*_DB`), the read-only opt-in and the run markers through `env_vars`, because Codex hands a stdio MCP server only a default allowlist (PATH, HOME, …) plus the variables named there. The launcher also applies `_estate_client.py`'s rules. It accepts only `--readonly`, `--governed` and `--db <path>`/`--db=<path>`, and refuses a misspelt flag. `--readonly` is added for the flag, for `WICKED_ESTATE_READONLY`, `WICKED_GOVERNED` or `--governed`, and for a run marker. A governed unit with no pinned store is refused. The child gets `[--readonly] [--db <path>]`, the only spelling estate reads. It passes stdio, arguments, cwd and the exit code through, and when no binary is found it prints one JSON line and exits 1. A `wicked-estate` server in the user's Codex config takes precedence over the plugin's.
+- **The Codex manifest is kept in version lockstep and checked in CI (#1326).** `sync-plugin-version.mjs` (the npm `version` hook the release runs) now bumps `.codex-plugin/plugin.json` too, and so does the dev `release.py` (with `package.json`). `scripts/ci/validate.py` runs `scripts/ci/codex_plugin.py`, which applies the rules Codex 0.163 uses: name matches the Claude manifest, and the Codex and Claude versions both match `package.json`; paths start with `./` and stay under the root; the hooks opt-out is present; the estate server goes through a launcher script under the root. It also requires that the skills Codex would discover (recursive, hidden directories skipped, string names of at most 64 characters, a string description present) are exactly the catalog's. `tests/test_codex_plugin_manifest.py` checks that the npm package ships those same skills plus the manifest files.
+
+### Fixed
+- **Governed-worker evaluators defer delivery-only criteria instead of failing them (rule E6, #1328).** A criterion whose evidence exists only after the deliver phase pushes (CI on the opened pull request, the pull request's title or body, a merge, a release) is now DEFERRED, neither PASS nor FAIL. Every part the run can show is still judged, and a failing in-run part still FAILs the item (deny-dominates). The evaluator names each deferred item (`ITEM <n>: DEFERRED — <the artifact it waits for>`, or a "Deferred to delivery" list) so the deliver gate can show it to the operator; a deferred item never fails the verdict by itself. E6 is distinct from E3: an in-run item the creator left as a follow-up is still judged. Pinned by `tests/test_governed_worker_rules.py`.
+
 ## [12.57.0] — 2026-10-18
 
 ### Added
@@ -1170,7 +1197,9 @@ through `v9.2.18`. Major themes across that span:
 
 For each of those releases, see the corresponding tag in git history.
 
-[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.57.0...HEAD
+[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.59.0...HEAD
+[12.59.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.58.0...v12.59.0
+[12.58.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.57.0...v12.58.0
 [12.57.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.56.0...v12.57.0
 [12.56.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.55.1...v12.56.0
 [12.55.1]: https://github.com/mikeparcewski/wicked-garden/compare/v12.55.0...v12.55.1

package/README.md

@@ -69,7 +69,17 @@ installs/updates the whole wicked-\* family (garden, its peers, and the rest).
 > and the previous copy is put back). Those transient dirs are **not plugins**; a leftover after an interrupted install is
 > safe to delete (`status` lists them).
 
-**Other CLIs (Codex, OpenCode, Pi, Antigravity)** — `npx wicked-installer install-<cli> wicked-garden` copies
+**Codex (codex-cli with `codex plugin`, 0.163+)** — garden is a registered Codex plugin: `.codex-plugin/plugin.json`
+declares the skills (`./skills`, namespaced `wicked-garden:<skill>`), the `wicked-estate` MCP server (started through
+`wicked-garden run scripts/estate_mcp.mjs`, which finds `wicked-estate-mcp` the way garden's scripts do:
+`WICKED_ESTATE_MCP_BIN` → PATH → `~/.local/bin`; that override, estate's store pins and the read-only/run markers are forwarded through `env_vars`, since Codex passes an MCP server only those plus PATH/HOME and the like, and `WICKED_ESTATE_READONLY` or a run marker adds `--readonly` as garden's estate client does), and no hooks (`hooks/hooks.json` is Claude Code's). By hand:
+`npm i -g wicked-garden`, then `codex plugin marketplace add "$(npm root -g)/wicked-garden"` and
+`codex plugin add wicked-garden@wicked-garden`. wicked-installer's Codex script does the same (pick Codex in
+`npx wicked-installer`, or run `node "$(npm root -g)/wicked-installer/dist/install-codex.js" wicked-garden`) and
+removes the loose skill copies it made earlier. A `[mcp_servers.wicked-estate]` entry in your Codex config takes
+precedence over the plugin's server.
+
+**Other CLIs (OpenCode, Pi, Antigravity, and Codex without `codex plugin`)** — `npx wicked-installer install-<cli> wicked-garden` copies
 the skills only (flat, by name — no `scripts/`, no venv). Every skill's text works there as written: own files are
 referenced relative to the skill's directory, other skills by name, and the shared runtime only through the
 launcher — `wicked-garden run scripts/<x>.py …`. So for script-backed skills the runtime prerequisite on those
@@ -130,7 +140,7 @@ false "done" runs into depends on the host and the entry path:
 |---|---|---|
 | **Any host — the gate, invoked** (`wicked-garden-prove`, an archetype's produces-gate → `scripts/qe/vault_gate.py`) | Re-hashes the recorded evidence and re-runs its verifier through `wicked-vault`: a false claim is **rejected**, an unresolvable backend **fails closed** (`gate: "unavailable"`). Hard gates also need an attestation under an explicit `--actor` that differs from the author's — a local label, not an authenticated identity. The verdict stops whatever acts on it. | With `--no-require`, a backend that cannot run falls back to the claim-only tracker and says so (`claim-only`, not re-derived); a working backend still re-derives. |
 | **Claude Code — plugin hooks** (plain conversation, "just work") | `PreToolUse` denies a few specific tool calls: native `EnterPlanMode` (always — planning goes through the archetype playbooks), writes to `MEMORY.md` / the auto-memory dir, build-phase writes on a high-complexity crew project with no challenge artifacts, a `phase_manager.py approve` whose gate preflight fails, a worktree cwd leak, and — only in `strict` mode (default `warn`) — invalid task metadata (`WG_TASK_METADATA`) and orphan state writes (`WG_BUS_EMIT_LINT`). Prompts are held until `/wicked-garden-core setup` completes. | Everything else. The archetype detector **steers** (it does not gate), the Stop-time claim sentinel is a fail-open **nudge** when a "done/passing" claim has no verdict for HEAD, `TaskCompleted` never blocks, and output governance is advisory. A completion claim is **not** blocked unless a gate is run. |
-| **Codex · OpenCode · Pi · Antigravity — skills only** (`npx wicked-installer install-<cli> wicked-garden`) | Nothing by itself: no plugin hooks are installed on those hosts. | The skill text tells the agent to run the gate; it blocks only when the agent does run it (and the launcher + `wicked-vault` are present). |
+| **Codex (plugin) · OpenCode · Pi · Antigravity — skills only** (`npx wicked-installer install-<cli> wicked-garden`) | Nothing by itself: no hooks are installed on those hosts (the Codex plugin opts out of them). | The skill text tells the agent to run the gate; it blocks only when the agent does run it (and the launcher + `wicked-vault` are present). |
 | **Compiled repo gate** (`/wicked-garden-prove compile <repo> --trigger hook,ci`) | `.wicked/gate.py` fails the **git pre-push hook / CI job** it is wired into, with no wicked-garden installed. | Without a trigger it is a script you run by hand. |
 | **wicked-crew governed run** | crew's engine decides each gated phase deny-dominates, on the layers that actually ran — deterministic floors, repo checks, policies, a judge. Review moves to a distinct seat when the roster has an eligible one; team runs refuse without one. | An ordinary run on a too-small roster keeps review on the creator seat and labels it "evaluator ≠ creator not held"; a pinned floor with no distinct judge is labelled "floor only"; a phase nothing gated is "approved by default, not verified". |
 

package/install.mjs

@@ -49,14 +49,14 @@
  *             diagnostic names where the previous and the failed trees were left).
  */
 import {
-  closeSync, constants, cpSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync,
-  readdirSync, readFileSync, realpathSync, renameSync, rmSync,
+  accessSync, closeSync, constants, cpSync, existsSync, fstatSync, lstatSync, mkdirSync, openSync,
+  readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync,
 } from "node:fs";
-import { join, dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { delimiter, join, dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { randomBytes } from "node:crypto";
-import { execSync, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(join(__dirname, "package.json"), "utf8"));
@@ -97,16 +97,32 @@ function skip(src) {
   return false;
 }
 
+// The first `name` on PATH, as `command -v` (POSIX) or `where` (Windows) would find it, read from
+// the filesystem: no subprocess. The old `command -v` spawn had a 2 s timeout, and on a loaded
+// machine a slow fork read as "not installed": pack tooling said Python was missing, and `install`
+// skipped `uv sync` as if uv were absent. Parity with those commands: an empty POSIX entry is the
+// current directory; Windows looks in the current directory first and tries each PATHEXT extension
+// (unless the name already ends with one). The result is absolute, so a caller may run it from
+// another working directory.
 function findBin(name) {
-  try {
-    const out = execSync(
-      process.platform === "win32" ? `where ${name}` : `command -v ${name}`,
-      { stdio: ["ignore", "pipe", "ignore"], timeout: 2000, encoding: "utf8" }
-    ).trim().split("\n")[0];
-    return out || undefined;
-  } catch {
-    return undefined;
+  const win = process.platform === "win32";
+  const pathext = (process.env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
+  const exts = win && !pathext.some((e) => name.toLowerCase().endsWith(e.toLowerCase())) ? pathext : [""];
+  const dirs = (process.env.PATH || "").split(delimiter).map((d) => (d === "" && !win ? "." : d)).filter(Boolean);
+  if (win) dirs.unshift(".");
+  for (const dir of dirs) {
+    for (const ext of exts) {
+      const candidate = resolve(dir, name + ext);
+      try {
+        if (!statSync(candidate).isFile()) continue;
+        if (!win) accessSync(candidate, constants.X_OK);
+        return candidate;
+      } catch {
+        // not here, or not executable: keep looking
+      }
+    }
   }
+  return undefined;
 }
 
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.57.0",
+  "version": "12.59.0",
   "type": "module",
   "description": "The skills your coding agent can't build alone: \"done\" re-checked from evidence, graph-aware search and multi-file refactor, 40 QE specialists, review panels from other models, and cross-session memory. Works in Claude Code, Codex, Antigravity, OpenCode and Pi, in CI, or in a wicked-crew job.",
   "keywords": [
@@ -34,7 +34,7 @@
   "main": "install.mjs",
   "scripts": {
     "test": "node scripts/ci/run_pytest.js",
-    "version": "node .github/scripts/sync-plugin-version.mjs && git add .claude-plugin/plugin.json .claude-plugin/marketplace.json",
+    "version": "node .github/scripts/sync-plugin-version.mjs && git add .claude-plugin/plugin.json .claude-plugin/marketplace.json .codex-plugin/plugin.json",
     "prepublishOnly": "node install.mjs --version"
   },
   "engines": {

package/schemas/README.md

@@ -26,6 +26,7 @@ cosmetic and pre-dates them):
 | Schema | Format it defines | Version field | Validated by |
 |--------|-------------------|---------------|--------------|
 | `wicked-pack.schema.json` | Third-party skill-pack manifest (`wicked-pack.json`) | `spec` (currently 1) | `npx wicked-garden pack check <dir>` (`scripts/pack/check.py`) |
+| `build-guide.v1.json` | A repo's build/test guide (`.wicked/build-guide.json`, DES-BUILD-GUIDE contract v1). **Vendored byte for byte from wicked-core** main (re-vendor whenever core's copy changes) | `version` (1) | `scripts/build_guide/check.py`; `tests/build_guide/test_build_guide_check.py` pins the copy to core's git blob |
 | `campaign-recon.schema.json` | qe campaign recon + plan artifact (capability inventory, environment-manifest ref, dependency-ordered scenario ladder with pass criteria, claim ceilings and per-rung `isolation` — ADR 0006) | `spec` (1 \| 2 — v2 is the TH-16+TH-22 shared bump: rung `isolation` + desktop stub-eligibility; v1 plans still validate) | `tests/qe/test_campaign_recon_schema.py` (fixture round-trip + nonconforming rejection). The sibling evidence contract (`scenario_evidence` + `claim_level`) is owned by wicked-ledger (manifest 2.1). |
 
 ## Usage

package/schemas/build-guide.v1.json

@@ -0,0 +1,210 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://wickedagile.com/schemas/build-guide.v1.json",
+  "title": "Build guide (DES-BUILD-GUIDE, contract v1)",
+  "description": "A repository's build/test guide: `.wicked/build-guide.json`, committed, read by the repo-checks floor from the BASE tree only. When the base carries a guide, its `checks` (for the stage) ARE the floor's checks for the directories they cover (their `cwd`s, at any stage): there their argv, cwd and stage replace detection (a build, lint or install step is declared as a check), while a detected package no check covers keeps its detected checks, exit codes only. A STALE guide (a `derivedFrom` file changed on the base since the guide was last committed or since a check was verified, or the change touches one) may name outdated commands: in the directories it covers, the floor then runs the UNION of its checks and the detected ones (an identical argv in the same directory once), more checks and never fewer. Accepted by design: a directory whose checks are all `verify`-only has no checks at the creator floor; the creator floor is fast feedback, and the verify floor runs every check before delivery. With no guide, or one that does not parse or fails the load-time checks (a non-empty `run`, `stage` values, `failedExit` on a check with a `list`), detection is the whole floor. Each check's pieces are checked by `wicked-core floor probe`; the floor relies on a check's exclusion only when every probe passed on a commit that is an ancestor of the base, no `derivedFrom` or `invalidatedBy` file changed on the base since, and the change touches neither (a deletion, a rename's old path and a type change, such as a file replaced by a link, count as touching). All regexes are RE2 syntax, applied to one line at a time.",
+  "type": "object",
+  "required": ["version", "checks"],
+  "additionalProperties": false,
+  "properties": {
+    "version": { "const": 1 },
+    "derivedFrom": {
+      "description": "Repo-relative paths (git pathspecs: globs such as `crates/*/Cargo.toml` match) the guide was derived from (CI files, manifests): a change to one, on the base since the guide or a check's verification or in the change itself, makes the guide stale: no check's exclusion is relied on, and detection runs beside the guide's checks where they cover a directory.",
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "checks": { "type": "array", "items": { "$ref": "#/$defs/check" } }
+  },
+  "$defs": {
+    "argv": { "type": "array", "items": { "type": "string" }, "minItems": 1 },
+    "regex": { "type": "string", "minLength": 1 },
+    "mutation": {
+      "type": "object",
+      "required": ["file", "content", "expectId"],
+      "additionalProperties": false,
+      "properties": {
+        "file": { "type": "string", "description": "Relative to `cwd`." },
+        "content": { "type": "string", "description": "A deliberately failing test." },
+        "expectId": { "type": "string" },
+        "expectQ": { "type": "string" }
+      }
+    },
+    "check": {
+      "type": "object",
+      "description": "A test check has a `list` (and so `results`); a gate check (a build, a lint, an install) has neither and gates on its exit code alone. A check named `install` is the floor's install step: the install timeout, never compared with the base, and a failure reads as an environment finding; declare it before the checks that need it (the floor's sandbox confines writes, not the network). `version` is for test checks only.",
+      "required": ["name", "run"],
+      "dependentRequired": { "list": ["results", "failedExit"], "version": ["list"] },
+      "additionalProperties": false,
+      "properties": {
+        "name": { "type": "string", "pattern": "^(?!\\.\\.?$)[A-Za-z0-9._-]{1,64}$", "description": "1-64 of `A-Z a-z 0-9 . _ -`, never `.` or `..` (it keys files the engine writes). A check named `install` is the floor's install step." },
+        "cwd": {
+          "type": "string",
+          "default": ".",
+          "description": "Relative to the repo root: `.` or `/`-separated segments, none empty, `.` or `..`, and no `\\` or `:` (no Windows drive).",
+          "pattern": "^(\\.|(?!.*(^|/)\\.\\.?(/|$))[^/\\\\:]+(/[^/\\\\:]+)*)$"
+        },
+        "stage": {
+          "description": "The floor stages the check runs at; absent or empty = both.",
+          "type": "array",
+          "items": { "enum": ["creator", "verify"] }
+        },
+        "run": {
+          "$ref": "#/$defs/argv",
+          "description": "The exact argv. Exclusion happens only for a floor check whose argv equals this exactly: the guide is the allowlist."
+        },
+        "failedExit": {
+          "description": "Exit codes that mean 'tests failed'. Any other non-zero exit (a crash, a build error) decides the check `could_not_run`. A failing exit whose results name no test gives the base no candidates (`base_red_unseparated`), and a deselected head run that fails with nothing named is still a failure (`new_failure`): exclusion never passes a run that failed.",
+          "type": "array",
+          "minItems": 1,
+          "items": { "type": "integer", "not": { "const": 0 } }
+        },
+        "results": {
+          "type": "object",
+          "required": ["kind"],
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "enum": ["text", "junit", "json-lines", "tap"],
+              "description": "v1 reads `text` and `junit`; `json-lines` and `tap` are reserved."
+            },
+            "how": {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "argvAppend": {
+                  "description": "Added to every argv whose results are read (the base run, the probes' runs). Composition with an argv that has an end of options (`--`), for this and for `deselect.append`: the tokens before the list's own `--` (all of them when it has none) go just before the argv's `--` (at the end when it has none); the tokens after it go last, behind ONE `--`. A second `--` is never emitted.",
+                  "type": "array",
+                  "items": { "type": "string" }
+                },
+                "env": { "type": "object", "propertyNames": { "pattern": "^(?!(LD_|DYLD_))(?!(BASH_ENV|ENV|SHELLOPTS|BASHOPTS|IFS|GCONV_PATH|LOCPATH)$)[A-Z_][A-Z0-9_]*$" }, "additionalProperties": { "type": "string" }, "description": "Set on the command INSIDE the floor sandbox only (never on the sandbox launcher). Names are `[A-Z_][A-Z0-9_]*` and never a loader or shell hook: `LD_*`, `DYLD_*`, `BASH_ENV`, `ENV`, `SHELLOPTS`, `BASHOPTS`, `IFS`, `GCONV_PATH`, `LOCPATH`." },
+                "path": { "type": "string", "description": "The results file, relative to `cwd`, when not stdout." },
+                "merge": {
+                  "type": "boolean",
+                  "description": "Capture stderr into the same stream as stdout, in order (a runner that names its test binaries on stderr)."
+                }
+              }
+            },
+            "id": {
+              "description": "(junit) The testcase attributes whose values, joined by `idJoin`, form an id. Default [\"classname\", \"name\"].",
+              "type": "array",
+              "items": { "type": "string" }
+            },
+            "idJoin": {
+              "description": "(junit) What joins the `id` attributes (default `::`), so the ids can be the list's.",
+              "type": "string"
+            }
+          }
+        },
+        "parser": {
+          "description": "Only for results.kind = text.",
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "section": {
+              "$ref": "#/$defs/regex",
+              "description": "Lines that open a qualifier scope (a test binary), with a named group `q`; ids are (q, id)."
+            },
+            "failed": {
+              "type": "array",
+              "items": { "$ref": "#/$defs/regex" },
+              "description": "Per-line failures, each with a named group `id`."
+            },
+            "blocks": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "required": ["start", "item", "end"],
+                "additionalProperties": false,
+                "properties": {
+                  "start": { "$ref": "#/$defs/regex" },
+                  "item": { "$ref": "#/$defs/regex", "description": "With a named group `id`." },
+                  "end": { "$ref": "#/$defs/regex" },
+                  "use": {
+                    "enum": ["last-before-end", "all"],
+                    "default": "last-before-end",
+                    "description": "A block is the contiguous item lines (blank lines allowed) after a start; any other line ends it. At an end, the last block since the previous end (or every one) is taken."
+                  }
+                }
+              }
+            }
+          }
+        },
+        "list": {
+          "type": "object",
+          "required": ["run", "item"],
+          "additionalProperties": false,
+          "properties": {
+            "run": { "$ref": "#/$defs/argv" },
+            "item": { "$ref": "#/$defs/regex", "description": "With a named group `id`." },
+            "section": {
+              "$ref": "#/$defs/regex",
+              "description": "With a named group `q`. Without it ids carry no qualifier, and results are compared by id alone."
+            },
+            "merge": { "type": "boolean" }
+          }
+        },
+        "alone": {
+          "type": "object",
+          "required": ["run"],
+          "additionalProperties": false,
+          "properties": { "run": { "$ref": "#/$defs/argv", "description": "With `{id}` (and optionally `{q}`, `{id:re}`, `{ids:re|}`, as in `deselect.append`): values fill whole argv elements and never pass through a shell, so no escaping is needed." } }
+        },
+        "deselect": {
+          "type": "object",
+          "required": ["append"],
+          "additionalProperties": false,
+          "properties": {
+            "append": {
+              "type": "array",
+              "items": { "type": "string" },
+              "description": "`{ids:re|}` and `{q}` never appear in the same `deselect.append` (the pattern cannot bind ids to qualifiers). Tokens before the first one with `{id}`/`{q}` are appended once, the tokens from the first through the last such one are repeated once per id, the rest once. So a flag and its value must be ONE token (`--skip={id}`, not `--skip`, `{id}`). `{id}`/`{q}` values fill whole argv elements verbatim and never pass through a shell: no escaping is needed. For a runner that takes a regex: `{id:re}` is the id regex-escaped, repeated per id like `{id}`; `{ids:re|}` is EVERY id, regex-escaped and joined by `|`, in ONE token that is never repeated (`--testNamePattern=^(?!(?:{ids:re|})$)`); a guide that puts `{ids:re|}` among the per-id tokens is refused. The tokens are then composed onto the argv around its `--` (see `results.how.argvAppend`)."
+            }
+          }
+        },
+        "affected": {
+          "type": "object",
+          "required": ["run"],
+          "additionalProperties": false,
+          "properties": { "run": { "$ref": "#/$defs/argv", "description": "With `{files}`; absent = the full run at every stage." } }
+        },
+        "version": {
+          "description": "The runner's version command. `floor probe` runs it and records its first output line (stdout and stderr merged) as `verified.runnerVersion`; the floor runs it too, and a check whose runner now prints something else is stale (exit codes only).",
+          "type": "object",
+          "required": ["run"],
+          "additionalProperties": false,
+          "properties": { "run": { "$ref": "#/$defs/argv" } }
+        },
+        "invalidatedBy": {
+          "description": "Globs (`**`, `*`, `?`): a file that matches one, changed on the base since the check was verified or touched by the change (deleted, renamed away or type-changed included), disables exclusion for this check.",
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "probes": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "mutation": { "$ref": "#/$defs/mutation" },
+            "mutation2": {
+              "$ref": "#/$defs/mutation",
+              "description": "A second deliberately failing test (another file): with both written, both must be parsed and deselecting both must run clean."
+            }
+          }
+        },
+        "verified": {
+          "description": "Written by `wicked-core floor probe`, which first runs the guide's `install` check for the same `cwd` in every fresh copy it probes (an install that fails fails every probe). `results` keys: list, run, ids, alone, deselect, mutation, multi, plus affected and version when the check has that piece. The probes need a green clean run. When any probe fails, the whole probe re-runs once on a fresh copy and that retry's results are recorded, each marked ` (retried)`: `pass (retried)` counts as a pass, `fail: … (retried)` does not.",
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "baseSha": { "type": "string" },
+            "runnerVersion": { "type": "string", "description": "The `version` command's first output line when the probes ran; empty without a `version` piece." },
+            "at": { "type": "string" },
+            "results": {
+              "type": "object",
+              "additionalProperties": { "type": "string", "pattern": "^(pass( \\(retried\\))?|fail: .*)$" }
+            }
+          }
+        }
+      }
+    }
+  }
+}