wicked-garden 12.59.0 → 12.61.0

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.59.0"}], "version": "12.59.0"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.61.0"}], "version": "12.61.0"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.59.0",
+  "version": "12.61.0",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), multi-model second opinions (fallback seats labelled) (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": ">=0.8.0",
   "wicked_ledger_version": "^0.6.0",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.59.0",
+  "version": "12.61.0",
   "description": "The skills your coding agent can't build alone: \"done\" re-checked from evidence, graph-aware search and multi-file refactor, 40 QE specialists, review panels from other models, and cross-session memory. Works in Claude Code, Codex, Antigravity, OpenCode and Pi, in CI, or in a wicked-crew job.",
   "keywords": [
     "coding-agent",

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## [Unreleased]
 
+## [12.61.0] — 2026-10-26
+
+### Fixed
+- **`install.py --from-run` finds the pack in a real run (editor and MCP) (#1351).** The engine runs the install-plan and install Tool phases in the run's worktree and sets `WICKED_TREE` to that worktree's git tree id (wicked-core#776), not a path. Both install scripts read it as a directory, found nothing, and every editor-plugin run failed at install-plan with "found 0 (none)", so the install consent gate was never reached. `--from-run` now searches the worktree (the cwd) and uses `WICKED_TREE` only when it names a directory.
+- **A credential-free MCP server installs (`scripts/mcp/install.py`) (#1351).** The installer assumed every server reads a `<SERVER>_TOKEN` secret. A local-computation server has no upstream, and its config names no `baseUrl` and no auth scheme (`auth` absent, null or `{"scheme": "none"}`). The installer still sent `auth: env:<SERVER>_TOKEN`, crew answered `secret_missing`, and the server was never registered, so a design that correctly invented no credential could not be installed. Such a server now smokes and registers with no secret variable. A server with an upstream, and `--from-npm` installs, are unchanged.
+- **An MCP server delivered without a `package-lock.json` installs (`scripts/mcp/install.py`) (#1352).** A container seat can't reach the npm registry, so the server a `/workflow-mcp-server` run delivers has no lockfile. `npm ci` refuses such a tree, so the install failed after the operator had consented, with only npm's debug-log path as the reason. The installer now copies the server to a transient `<root>/<key>/resolve/`, resolves the dependencies there once with `npm install --package-lock=true --ignore-scripts`, and builds there. The staged copy installs from that lock, and the delivered tree is never written. An npm that writes no lock (`package-lock=false`) fails before anything is built. The plan and the install record say `"lockfile": "resolved at install"`, because those versions were picked at install time and the run never reviewed them. A delivered lock still goes through `npm ci`, and the output says `"lockfile": "delivered"`. A failing npm step now reports npm's own reason instead of its debug-log path. That is the `npm error code` line and the first line after it that isn't metadata, plus the script's own last line (tsc's error) when `npm run build` fails.
+
+## [12.60.0] — 2026-10-26
+
+### Fixed
+- **Per-turn hooks stop injecting on prompts they don't fit (#1333).** The prompt and Stop hooks run on every turn, on every seat that loads garden. An injection that misfires costs context and teaches agents to skim past reminders.
+  - **Context Assembly is decided per prompt.** The session intent is sticky, so once a session's first prompt read as research, every later prompt got the directive, including "agree", "still waiting" and "how is it going?". It now fires only when the prompt itself names code, files, symbols, repos or past decisions AND has more than 12 words or asks a question. Acknowledgements (including short ones such as "yes, sounds good to me"), status checks and one- or two-word replies get nothing, even when they name a file or symbol ("how is repo_checks.rs going?"). The directive no longer names the estate MCP `SearchEntity` tool (no estate MCP is registered on a seat). It points at the mem and search skills and the read-only shim instead.
+  - **Output Governance runs once per session and does the work itself.** The per-turn line ("If the estate MCP is connected: call `rules.recall`…") could never run. The first Stop of a session now calls `rules.recall {"rule_type":"policy"}` through the read-only shim. When the store holds policy rules, the hook names the count and the top three once, with the command that lists them all. The once-per-session claim is an atomic marker file, so a prompt hook saving a stale session state can't re-arm it. Zero rules, an unreachable estate or an error: silent. `WG_OUTGOV=off` still opts out.
+  - **No `classify-due` nag.** When the regex router falls through, the hook emits nothing. A medium-confidence regex match (one keyword, such as "outage" in a status question) emits nothing either. Only a high-confidence match (≥ 0.7) tags the turn.
+  - **`prove:` lines ride only a confident archetype** (score ≥ 0.7, from the regex or from a persisted model classification), never a fall-through. A persisted classification (the model's own, from `wicked-garden-classify`) is echoed back once per classification, not on every turn, and only its confident archetypes.
+- **The agent memory path is one line (#1333).**
+  - `_estate_client.py <action> -` reads its JSON from stdin. It used to parse `-` as a literal string, so `propose -` failed with a generic shape error.
+  - `propose` errors name the exact field: `missing kind_type`, `payload must be an object, got str`, `json-args is not valid JSON`; a missing `facets.project` is still reported by name.
+  - New `wicked-garden-mem` action `propose`: `wicked-garden run scripts/mem/estate_memory.py --readonly propose '<text>'` (or `propose -` with text or JSON on stdin) builds the envelope itself: `kind_type: memory`, `payload {content, tier}`, `facets {repo, project}` from the cwd's checkout (outside a checkout, `project` = the cwd name; default `recall` now sends that same intent, so the approved memory is recalled from where it was proposed). It applies the same durability refusals as `store`. It is the write a read-only seat still has, and the memory lands pending until an operator approves it.
+  - The hook that blocks writes to `MEMORY.md` and the native memory directory now prints that exact command.
+
+
 ## [12.59.0] — 2026-10-25
 
 ### Added
@@ -1197,7 +1219,9 @@ through `v9.2.18`. Major themes across that span:
 
 For each of those releases, see the corresponding tag in git history.
 
-[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.59.0...HEAD
+[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.61.0...HEAD
+[12.61.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.60.0...v12.61.0
+[12.60.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.59.0...v12.60.0
 [12.59.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.58.0...v12.59.0
 [12.58.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.57.0...v12.58.0
 [12.57.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.56.0...v12.57.0

package/docs/README.md

@@ -14,7 +14,7 @@ Work in wicked-garden is organized around **10 work-shape archetypes** — not a
 | [Required Peers](required-peers.md) | The one required peer (plus the opt-in layers) and the install/runtime stance |
 | [The Compiler](compiler.md) | `/wicked-garden-prove compile` — emit a self-contained vault-backed gate into any repo |
 | [Extending the Catalog](extending.md) | Ship a third-party pack — `{vendor}-{domain}-{role}` skills, the `wicked-pack.json` manifest, the shipped conformance gate, install + crew routing |
-| [Output Governance (Per-Turn)](outgov-per-turn.md) | The advisory hook lane — `WG_OUTGOV` modes (default `warn`), `rules.recall` as the single per-turn rule source, content-hash provenance for the graph-derived rules dir |
+| [Output Governance (hook-side)](outgov-per-turn.md) | The advisory hook lane — `WG_OUTGOV` modes (default `warn`), a once-per-session `rules.recall` audit through the read-only shim, content-hash provenance for the graph-derived rules dir |
 | [Brain Chunk Format](brain-chunk-format.md) | Historical: how content was chunked for the retired wicked-brain index (the migrated chunks in wicked-estate keep this shape) | <!-- historical -->
 
 ## Quick Links

package/docs/outgov-per-turn.md

@@ -1,4 +1,4 @@
-# Output Governance — the Per-Turn Advisory Lane
+# Output Governance — the Hook-Side Advisory Lane
 
 How the interactive (hook-side) half of output governance works after AW-16
 (arch-R14): **one source of per-turn truth, default-on advisory, fail-open by
@@ -10,7 +10,7 @@ Enforcement in the wicked platform is two-tier (TARGET-ARCHITECTURE contract 3):
 
 | Tier | Where | Behavior |
 |------|-------|----------|
-| **Advisory** | garden hooks (`stop.py` per-turn advisory, `guard_pipeline` Check 6) | fail-open — surfaces findings, never blocks |
+| **Advisory** | garden hooks (`stop.py` session audit, `guard_pipeline` Check 6) | fail-open — surfaces findings, never blocks |
 | **Enforcing** | crew/core gates (`output-gate-hook`, acceptance gate) | fail-closed — deny dominates |
 
 There is **no third tier**. `WG_OUTGOV=strict` only strengthens the advisory's
@@ -23,11 +23,16 @@ enforced belongs in the crew/core gates, not here.
 Both hook-side consumers read the **estate graph** — never an independent
 rulebook:
 
-1. **Per-turn advisory** (`hooks/scripts/stop.py::_check_outgov_compliance`):
-   the Stop-hook systemMessage directs the model at the estate MCP tool
-   **`rules.recall`** (`{"rule_type": "policy"}`, severity-ordered,
-   graph-backed) — the wire twin of wicked-governance's `recall_rules`. If
-   estate or the tool is unavailable, the advisory says to skip silently.
+1. **Session audit** (`hooks/scripts/stop.py::_check_outgov_compliance`):
+   on the FIRST Stop of a session the hook itself runs **`rules.recall`**
+   (`{"rule_type": "policy"}`, severity-ordered, graph-backed, the wire twin
+   of wicked-governance's `recall_rules`) through the read-only shim
+   (`scripts/_estate_client.py --readonly call`). When the store holds policy
+   rules it names the count and the top three once, with the command that
+   lists them all. Zero rules, an unreachable estate or any error: silent.
+   It used to be a per-turn line telling the model to call the tool "if the
+   estate MCP is connected", which no seat ever is (by design), so it could
+   never run (garden#1333).
 
 2. **Session-close pattern check**
    (`scripts/platform/guard_pipeline.py::check_outgov_pattern`, Check 6):
@@ -39,13 +44,15 @@ rulebook:
 
 ## `WG_OUTGOV` modes and the default
 
-| Value | Per-turn advisory (stop.py) | Check 6 (guard_pipeline) |
-|-------|------------------------------|---------------------------|
-| *(unset)* → **`warn`** | fires (default-on advisory) | runs |
-| `warn` | fires | runs |
-| `strict` | fires with stronger wording — still advisory | runs |
+| Value | Session audit (stop.py) | Check 6 (guard_pipeline) |
+|-------|-------------------------|---------------------------|
+| *(unset)* → **`warn`** | runs once per session (default-on advisory) | runs |
+| `warn` | runs once per session | runs |
+| `strict` | runs once, stronger wording — still advisory | runs |
 | `off` (or any other value) | silent | skips |
 
+The audit is also silent when `WICKED_CONTEXT_BACKEND=off`.
+
 **The default flipped from `off` to `warn` in AW-16**, after the seed corpus
 (AW-13) gave the advisory real rules to recall. Every mode is fail-open: a
 missing estate, a missing rules dir, or a broken bundle can only *reduce*
@@ -63,7 +70,8 @@ The flip is **default-on in code, per-repo in practice**:
 - **Noise budget owner**: whoever keeps a repo opted in owns its noise budget
   (the repo maintainer by default). The advisory costs at most one
   systemMessage per Stop; Check 6 findings are capped by the guard-pipeline
-  budget and profile.
+  budget and profile. The audit costs at most one systemMessage per session,
+  and none when the store has no policy rules.
 - If recall noise is systemic (bad rules, not bad wiring), fix the corpus —
   retire or re-scope the offending rules in the graph — rather than muting the
   lane ecosystem-wide.
@@ -127,18 +135,18 @@ Hermetic tests — no live estate needed, fixture rules dirs only:
   **missing rules dir ⇒ skip with a note, zero findings, no block**; stale
   provenance ⇒ warn-severity finding only, rules still surfaced; hash
   determinism + generator/consumer recipe equality.
-- `tests/hooks/test_stop_outgov.py` — the per-turn directive names
-  `rules.recall`; default-on; `off` opts out; `strict` stays advisory; any
-  internal error returns no message.
+- `tests/hooks/test_stop_outgov.py` — the audit runs `rules.recall` once per
+  session; silent on zero rules, an unreachable estate or an error; names no
+  MCP; default-on; `off` opts out; `strict` stays advisory.
 
 ## Pointers
 
-- `hooks/scripts/stop.py` — `_check_outgov_compliance` (per-turn advisory)
+- `hooks/scripts/stop.py` — `_check_outgov_compliance` (once-per-session audit)
 - `scripts/platform/guard_pipeline.py` — Check 6 (`check_outgov_pattern`),
   `compute_rules_content_hash`, `write_rules_provenance`, the `hash` CLI
 - `skills/engineering/refs/conformance.md` — the agent-half rubric that
   evaluates Check 6's surfaced rules semantically
 - wicked-core `crates/wicked-governance` — the graph side: `rules ingest`,
   `rules fanout` (the manifest + store split), `rules.recall`'s Rust twin
-- History: garden#983 (pattern check), garden#984 (per-turn guardrail, closed),
+- History: garden#983 (pattern check), garden#984 (per-turn guardrail, closed), garden#1333 (per-turn line → session audit),
   AW-16 / arch-R14 (this document's change)

package/hooks/scripts/pre_tool.py

@@ -280,17 +280,19 @@ def _handle_write_guard(tool_input: dict) -> str:
     is_auto_memory = _AUTO_MEMORY_MARKER in file_path and "/memory/" in file_path
 
     if is_memory_md or is_auto_memory:
-        # Name the memory surface (estate memory.capture). Fail-open to the
-        # same wording.
+        # garden#1333: hand over the exact one-line command, not a skill name
+        # the agent then has to route through (and that refuses `store` on a
+        # read-only seat). Fail-open to the same literal command.
         try:
-            from _context_backend import memory_directive_target
-            _mem_target = memory_directive_target()
+            from _context_backend import MEMORY_PROPOSE_COMMAND as _mem_cmd
         except Exception:
-            _mem_target = "the wicked-garden-mem skill (store action)"
+            _mem_cmd = ("wicked-garden run scripts/mem/estate_memory.py --readonly propose "
+                        "'<the rule, why it holds, when it applies>'")
         return _deny(
-            "Do not write to MEMORY.md or the auto memory directory. "
-            "This project uses wicked-garden memory for persistence. "
-            f"Use {_mem_target} to save decisions, patterns, and gotchas instead."
+            "Do not write to MEMORY.md or the auto memory directory; this project keeps "
+            "memory in wicked-estate. Save the learning with one command instead "
+            "(it files a memory proposal for this project; pipe longer text with `propose -`):\n"
+            f"{_mem_cmd}"
         )
 
     # Issue #442: challenge-artifacts gate for build-phase writes

package/hooks/scripts/prompt_submit.py

@@ -185,51 +185,73 @@ def _with_prove_hints(directive: str, archetypes: list[str]) -> str:
         return directive
 
 
+# garden#1333: a `prove:` line is steering the agent acts on at the gate
+# phase, so it rides only a confident classification. Mirrors
+# archetypes_v11.HIGH_CONFIDENCE (kept literal so the hook needs no import
+# to decide; tests lock the two together).
+_PROVE_MIN_SCORE = 0.7
+
+
 def _build_archetype_directive(prompt: str, intent: str, state=None) -> str | None:
     """v11 — emit a slim work-shape archetype steering directive.
 
     Two-tier classification:
 
-    1. **Persisted (LLM)**: when SessionState carries a recent
-       `classified_at` + `archetypes_v11`, prefer that — the model
-       already classified through the wicked-garden-classify skill.
-    2. **Fallback (regex)**: when no persisted classification exists,
-       run archetypes_v11.detect_archetypes() against the prompt
-       directly. If the prompt is non-trivial (intent != simple-edit)
-       AND the regex result is weak (only triage matched), emit a
-       directive asking the model to invoke the classify skill —
-       LLM reasoning beats regex on ambiguous prompts.
-
-    Skips emission when intent is 'simple-edit' (silence is the signal).
-    Fail-open on any error.
+    1. **Persisted (LLM)**: when SessionState carries `archetypes_v11` (the
+       model classified through the wicked-garden-classify skill), emit its
+       tag / shape card.
+    2. **Fallback (regex)**: archetypes_v11.detect_archetypes() on the
+       prompt. Emits only a HIGH-confidence match; a fall-through (only
+       triage) or a medium keyword hit emits nothing (garden#1333: the
+       fall-through used to ask for a model classification on every
+       ordinary question, and medium hits misrouted status questions).
+
+    Both tiers emit only archetypes scored >= _PROVE_MIN_SCORE, so a
+    `prove:` line never rides a low-confidence route; the persisted tier
+    is echoed once per classification.
+    Silent on simple-edit sessions and on chatter (acknowledgements, status
+    checks, short replies). Fail-open on any error.
     """
     if not prompt or not prompt.strip():
         return None
     if intent == "simple-edit":
         return None
+    try:
+        if _is_chatter(prompt):
+            return None
+    except Exception:
+        return None
 
     # Tier 1: persisted classification from the classify skill
     persisted = (getattr(state, "archetypes_v11", None) or []) if state else []
     if persisted:
-        # Filter triage out unless sole match; emit shape-card from persisted.
-        real = [a for a in persisted if a.get("name") != "triage"]
+        # The model classified this itself (wicked-garden-classify). Echo it
+        # back once per classification, and only its confident archetypes:
+        # repeating it on every later turn added nothing (garden#1333).
+        real = [a for a in persisted
+                if a.get("name") != "triage"
+                and float(a.get("score", 0)) >= _PROVE_MIN_SCORE][:3]
         if not real:
             return None
-        if len(real) == 1 and float(real[0].get("score", 0)) >= 0.7:
+        key = f"{getattr(state, 'classified_at', None)}|" + json.dumps(real, sort_keys=True)
+        if getattr(state, "archetype_echoed", None) == key:
+            return None
+        try:
+            state.update(archetype_echoed=key)
+        except Exception:
+            pass
+        if len(real) == 1:
             n = real[0]["name"]
             s = float(real[0]["score"])
             base = f"<wg archetype=\"{n}\" score=\"{s:.2f}\" classified=\"llm\" />"
             return _with_prove_hints(base, [n])
-        shape_lines = [
-            f"  - {a['name']} ({float(a.get('score', 0)):.2f})"
-            for a in real[:3]
-        ]
+        shape_lines = [f"  - {a['name']} ({float(a['score']):.2f})" for a in real]
         base = (
             "<wg archetypes classified=\"llm\">\n"
             + "\n".join(shape_lines)
             + "\n</wg>"
         )
-        return _with_prove_hints(base, [a["name"] for a in real[:3]])
+        return _with_prove_hints(base, [a["name"] for a in real])
 
     # Tier 2: regex fallback
     try:
@@ -240,7 +262,7 @@ def _build_archetype_directive(prompt: str, intent: str, state=None) -> str | No
         for p in (_scripts, _crew):
             if str(p) not in _sys.path:
                 _sys.path.append(str(p))
-        from archetypes_v11 import detect_archetypes, HIGH_CONFIDENCE
+        from archetypes_v11 import detect_archetypes
     except Exception:
         return None
 
@@ -249,33 +271,25 @@ def _build_archetype_directive(prompt: str, intent: str, state=None) -> str | No
     except Exception:
         return None
 
-    real = [(n, s, e) for (n, s, e) in matches if n != "triage"]
-
-    if not real:
-        # Regex couldn't classify cleanly — ask the model to do it instead.
-        # This is the LLM-classifier opt-in path: the model invokes the
-        # wicked-garden-classify skill, persists the result, and on the
-        # next turn the persisted-tier branch above takes over.
-        return (
-            "<wg classify-due />\n"
-            "Regex classifier could not route this prompt to a v11 archetype. "
-            "Invoke the `wicked-garden-classify` skill to classify with model "
-            "reasoning, then run the chosen archetype's playbook."
-        )
-
-    high = [(n, s, e) for (n, s, e) in real if s >= HIGH_CONFIDENCE]
-    if len(high) == 1 and len(real) == 1:
-        n, s, _ = high[0]
+    high = [(n, s) for (n, s, _e) in matches
+            if n != "triage" and s >= _PROVE_MIN_SCORE]
+    if not high:
+        # Fall-through or medium-only: the regex has no confident route, so
+        # it says nothing (garden#1333). The classify skill stays available
+        # for the agent to invoke when the work shape matters.
+        return None
+    if len(high) == 1:
+        n, s = high[0]
         base = f"<wg archetype=\"{n}\" score=\"{s:.2f}\" classified=\"regex\" />"
         return _with_prove_hints(base, [n])
 
-    shape_lines = [f"  - {n} ({s:.2f})" for (n, s, _) in real[:3]]
+    shape_lines = [f"  - {n} ({s:.2f})" for (n, s) in high[:3]]
     base = (
         "<wg archetypes classified=\"regex\">\n"
         + "\n".join(shape_lines)
         + "\n</wg>"
     )
-    return _with_prove_hints(base, [n for (n, _s, _e) in real[:3]])
+    return _with_prove_hints(base, [n for (n, _s) in high[:3]])
 
 
 def _suggest_jam(prompt: str, state) -> str | None:
@@ -444,6 +458,122 @@ def _has_imperative_technical_verb(prompt_lower: str) -> bool:
     return any(verb in prompt_lower for verb in _IMPERATIVE_TECHNICAL_VERBS)
 
 
+# ---------------------------------------------------------------------------
+# garden#1333 — per-prompt grounding gate
+#
+# The session intent above is sticky: once a session's first prompt read as
+# feature/research, every later prompt ("agree", "still waiting", "how is it
+# going?") got the Context Assembly directive. That trained agents to skim
+# past it. The directive is now decided per prompt, from what the prompt
+# itself names: it fires only when the prompt names code, files, symbols,
+# repos or past decisions AND is long enough to need grounding (more than
+# _GROUNDING_MIN_WORDS words) or asks a question about them.
+# ---------------------------------------------------------------------------
+
+_GROUNDING_MIN_WORDS = 12  # "more than ~12 words" (garden#1333 item 1)
+
+# Strong code signals: the prompt points at a concrete thing in the codebase.
+_IDENTIFIER_PATTERN = re.compile(
+    r"\b[A-Za-z][A-Za-z0-9]*_[A-Za-z0-9_]+\b"      # snake_case / SCREAMING_CASE
+    r"|\b[a-z]+[A-Z][A-Za-z0-9]*\b"                # camelCase
+    r"|\b[A-Z][a-z0-9]+[A-Z][A-Za-z0-9]*\b"        # PascalCase (two humps)
+    r"|\b\w+::\w+"                                # Rust/C++ paths
+    r"|\b\w+\(\)"                                # call()
+    r"|\bwicked-[a-z][a-z0-9-]*\b"                  # a wicked-* repo
+)
+_DECISION_PATTERN = re.compile(
+    r"\b(?:why did we|what did we decide|did we decide|we decided|decision|"
+    r"adr|rationale|why do we)\b",
+    re.IGNORECASE,
+)
+# Weak code signals: code nouns. They ground only a question or a long prompt.
+_CODE_NOUN_PATTERN = re.compile(
+    r"\b(?:function|method|class|module|crate|package|codebase|repo|repository|"
+    r"hook|endpoint|schema|symbol|api|script|test|tests|struct|trait|interface|"
+    r"config|migration|query|branch|commit)s?\b",
+    re.IGNORECASE,
+)
+# Status checks and acknowledgements never need grounding.
+_STATUS_PATTERN = re.compile(
+    r"\b(?:how(?:'s| is| are)\b.*\bgoing|status|any (?:update|news|progress)|"
+    r"still (?:waiting|running|working|going)|where are we|are (?:you|we) done|"
+    r"is it done|done yet|how far|eta|progress|update me|what'?s left)\b",
+    re.IGNORECASE,
+)
+_ACKNOWLEDGEMENTS = frozenset({
+    "agree", "agreed", "yes", "ok", "okay", "sure", "yep", "yup", "go",
+    "go ahead", "do it", "continue", "proceed", "thanks", "thank you", "ty",
+    "lgtm", "looks good", "sounds good", "great", "perfect", "nice", "cool",
+    "approved", "approve", "no", "nope", "stop", "wait", "next", "done",
+    "keep going", "carry on", "makes sense", "got it", "right", "correct",
+})
+# `do` opens a question only with a subject ("do we…"), never an imperative
+# ("do not touch the config").
+_QUESTION_START = re.compile(
+    r"^\s*(?:why|how|what|where|which|who|when|does|is|are|can|could|should|"
+    r"would|will|do\s+(?:we|you|i|they|these|those|it)\b)\b",
+    re.IGNORECASE,
+)
+# A reply that opens with an acknowledgement and stays short ("yes, sounds
+# good to me", "thanks for doing that") is still an acknowledgement.
+_ACK_PREFIX = re.compile(
+    r"^\s*(?:yes|yep|yup|ok|okay|sure|thanks|thank you|ty|agreed?|i agree|"
+    r"sounds good|looks good|lgtm|great|perfect|nice|cool|go ahead|do it|"
+    r"makes sense|got it)\b",
+    re.IGNORECASE,
+)
+_ACK_PREFIX_MAX_WORDS = 8
+_SHORT_REPLY_MAX_WORDS = 2  # "go", "still waiting", "repo_checks.rs?"
+
+
+def _normalize(prompt: str) -> str:
+    return re.sub(r"[^\w\s'-]", "", prompt.strip().lower()).strip()
+
+
+def _has_strong_code_signal(prompt: str) -> bool:
+    return (
+        _has_file_path(prompt)
+        or _has_code_markers(prompt)
+        or bool(_IDENTIFIER_PATTERN.search(prompt))
+        or bool(_DECISION_PATTERN.search(prompt))
+    )
+
+
+def _is_chatter(prompt: str) -> bool:
+    """True for acknowledgements, status checks and one- or two-word replies,
+    whatever they name. No per-turn directive belongs on these."""
+    if not prompt or not prompt.strip():
+        return True
+    if _normalize(prompt) in _ACKNOWLEDGEMENTS:
+        return True
+    if _STATUS_PATTERN.search(prompt):
+        return True
+    words = len(prompt.split())
+    if words <= _SHORT_REPLY_MAX_WORDS:
+        return True
+    return (
+        words <= _ACK_PREFIX_MAX_WORDS
+        and bool(_ACK_PREFIX.match(prompt))
+        and not _has_strong_code_signal(prompt)
+    )
+
+
+def _prompt_needs_grounding(prompt: str) -> bool:
+    """garden#1333: the Context Assembly gate, decided per prompt.
+
+    True only when the prompt names code, files, symbols, repos or past
+    decisions AND either has more than _GROUNDING_MIN_WORDS words or asks a
+    question. Never on acknowledgements, status checks or one-word replies.
+    """
+    if _is_chatter(prompt):
+        return False
+    strong = _has_strong_code_signal(prompt)
+    if not strong and not _CODE_NOUN_PATTERN.search(prompt):
+        return False
+    question = "?" in prompt or bool(_QUESTION_START.match(prompt))
+    return question or len(prompt.split()) > _GROUNDING_MIN_WORDS
+
+
 # ---------------------------------------------------------------------------
 # Setup gate
 # ---------------------------------------------------------------------------
@@ -723,16 +853,15 @@ def _build_intent_directive(intent: str, turn_count: int, state=None) -> str:
         grounding = grounding_directive_lines()
     except Exception:
         grounding = [
-            "1. Ground in the knowledge layer via the wicked-garden-mem skill "
-            "(recall/answer over wicked-estate knowledge + memory) — concepts, "
-            "files, and past decisions, with source attribution; use the estate "
-            "MCP SearchEntity tool for symbol lookup.",
+            "1. Recall what is already known: the wicked-garden-mem skill "
+            "(`recall` / `answer`) for past decisions, the wicked-garden-search "
+            "skill for symbols and blast radius.",
             "2. Open the cited sources with Read before answering; do not answer "
             "from recall snippets alone.",
         ]
     directive_lines = [
-        f"[Context Assembly — intent={intent}] Deep context needed before answering.",
-        "BEFORE drafting a response:",
+        f"[Context Assembly — intent={intent}] This prompt names code or past "
+        "decisions; ground it before answering:",
         *grounding,
     ]
     if intent == "rigor":
@@ -942,9 +1071,12 @@ def main():
         # turns produce an empty directive; feature/research/rigor produce
         # the synthesis directive.
         _intent = getattr(state, "intent", None) if state else None
-        intent_directive = _build_intent_directive(
-            _intent or "simple-edit", turn_count, state
-        )
+        # garden#1333: the sticky session intent only labels the directive;
+        # whether it fires is decided by THIS prompt (_prompt_needs_grounding).
+        intent_directive = ""
+        if _prompt_needs_grounding(prompt):
+            label = _intent if _intent in ("feature", "research", "rigor") else "research"
+            intent_directive = _build_intent_directive(label, turn_count, state)
 
         # WIP recovery: surface native in-progress tasks (v5 ticket rail gone)
         wip_block = _build_wip_recovery_block(session_id, project)