wicked-garden 12.60.0 → 12.62.0

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.60.0"}], "version": "12.60.0"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.62.0"}], "version": "12.62.0"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.60.0",
+  "version": "12.62.0",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), multi-model second opinions (fallback seats labelled) (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": ">=0.8.0",
   "wicked_ledger_version": "^0.6.0",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.60.0",
+  "version": "12.62.0",
   "description": "The skills your coding agent can't build alone: \"done\" re-checked from evidence, graph-aware search and multi-file refactor, 40 QE specialists, review panels from other models, and cross-session memory. Works in Claude Code, Codex, Antigravity, OpenCode and Pi, in CI, or in a wicked-crew job.",
   "keywords": [
     "coding-agent",

package/CHANGELOG.md

@@ -2,6 +2,82 @@
 
 ## [Unreleased]
 
+## [12.62.0] — 2026-11-01
+
+### Added
+
+- **Every seat proposes a memory for what it witnessed (governed-worker A7).** On the rig, every memory in the review queue came from the pi seat. That was the seat seated first for a capture-learnings run's capture phase, or the seat that distils a finished run. The claude and codex seats that did the work in bug and feature runs proposed none, because the floor every seat follows had no rule asking them to. A7 gives every role a fixed moment to check (before its final message; in power mode, before each `CHECKPOINT:` or `HANDOFF:` line) and asks it to propose what bit for a reason the code does not show: a command that failed because of the toolchain, the environment or the setup and what made it pass, a tool trap, or an operator ruling. A reviewer's finding with such a cause counts too. At most three per unit go through the one-line `scripts/mem/estate_memory.py --readonly propose` path the shim already relays from a container seat. The run, the unit and the seat are stamped as provenance, so the proposal names the seat that saw it. A unit that proposes none says what it checked. Code facts stay knowledge. The `wicked-capture-report` line is now a capture-phase contract only (A4), so an evaluator's VERDICT line stays last.
+- **A domain-extraction run keeps mapping page after page until the target (pairs with wicked-core's bounded loop).** The new host step `extract-next` (`scripts/domain/next_page.py`) runs after each page's `extract-apply`: it measures the mapped share against the repository's target (`wicked-core requirements-target`: the repository's own, else the daemon minimum), prints one progress line ("Mapping wicked-crew · 3% → 12% → 19% · target 80% · page 4 · about 2 h left") and decides: another page, done, or an ask when the budget per grant is spent (`WICKED_DOMAIN_MAX_PAGES` 20, `WICKED_DOMAIN_MAX_MINUTES` 240), nothing is left to map, or two pages mapped nothing new. The ask's choices: map more (a fresh grant), or lower the target for this repository to the share mapped so far and build the graph; Stop ends the run and keeps what was mapped. (As released, the loop counts REAL requirements, see Changed: the stall ask comes after two pages that add no real requirement, "map more" is offered only while units are left to ask, "lower the minimum" only when the real share is at least 1%. With nothing left to ask and nothing to lower to, the run goes on to coverage, except after a low-yield last page, whose ask offers Finish.) The generation's record (`scripts/domain/generation.py`: its start, a point per page, the grant) lives beside the store, never in the seat-writable worktree. A page is 500 behaviours by default (`WICKED_DOMAIN_PAGE_SIZE`).
+
+- **`wicked-garden-repo-learn` has a style lens, and writing is a source.** Studio's Learn → Style (program DES-LEARN §3.1) runs `capture-learnings` on a showcase repository to learn how the person or team works, not only how the code works. When the run asks for style, phase 2 also reads naming, structure, test shape, change size, and commit and review tone, each with a stated cap (`git log -n 200 --shortstat`, `-n 100 --format=%s`, 3 to 5 reviews when `gh` is signed in). Phase 3 captures those as style memories (`reach: "operator"`, so the person decides at review whether they apply everywhere). An enforced convention stays a policy and what the code does stays knowledge. The same lens covers writing (a blog, a docs site, a document): a sample of at most 10 pages is read, the patterns are found, and they're captured as memories, because the person's own voice is told, not acquired. `refs/style-lens.md`.
+
+### Changed
+
+- **The domain skills and docs describe the loop as it now runs (#1380).** `domain`, `domain-extractor`,
+  `domain-coverage`, `domain-modeler` and their refs, `docs/domains.md`, `docs/getting-started.md` and the README say
+  real requirements and the configured minimum, the page loop, and the current worker names. They say the harness
+  checks a rule's shape and that its source is readable product code, while grounding is judged by the page review
+  and the coverage evaluator. The README's paragraph under the bold line says what garden does, and where (#1383).
+- **A domain-extraction run maps until REAL requirements reach the target (pairs with wicked-core#1233).** The target
+  counts resolved behaviours only; risk-flagged placeholders are shown, never counted.
+  - `extract-prepare` frames the unmapped behaviours, then the placeholders an earlier page left (empty, or under
+    the confidence threshold), hub-first. It skips any unit an earlier page of the same run closed: one the seat
+    answered and the host wrote or kept, recorded in the generation's record beside the store, so a unit left empty
+    again cannot loop the run. A unit the seat never reached (its turn ran out) goes back to the pool for the next
+    page. `extract-apply` accepts entries for placeholders; an empty answer never overwrites a statement.
+  - `extract-next` measures the real share: "Mapping wicked-crew · real requirements 23% → 25% · target 80% · page
+    2 · 4331 placeholders · last page resolved 93 of 100 units · about 3 h left". A page of 20 or more units that
+    resolved under 1 in 20 asks the operator instead of mapping on (wicked-crew run 4b49cbe1 passed a page with 3
+    rules for 500 units). The stall ask is now "two pages added no real requirement".
+  - The extractor's file-mode instructions and the rule prompt say most product code encodes a rule (a check, a
+    refusal, a limit, a default, an ordering, a permission, a state change, a required field) and to leave a
+    statement empty for pure plumbing, and (as the Fixed entry below says) for a plain interface or field list that
+    encodes no business constraint. On the same 100 wicked-crew units (27 unmapped, 73 placeholders, all
+    sourced), codex resolved 85 with the old instructions and 93 with the new.
+  - The vendored domain-model schema is bundle 1.3.0 (`metadata.coverage` is `real_pct`, `real`, `placeholders`,
+    `unmapped`, `not_product`).
+
+- **Domain extraction maps hub-first and stops gating on 100% (operator ruling 2026-10-31; pairs with wicked-core#1215).**
+  - *Hub-first, fan-out order.* `scripts/domain/extract_loop.py` takes the unmapped worklist in graph order: the most central symbols first (estate's PageRank via `wicked-estate rank`, `CliEstateClient.rank`; the store's own degree when the command is unavailable, said on stderr), then their neighbours and onward by hop distance over the use graph (calls, references, type relations, a route serving a handler; never contains/imports/data flow). The hub count scales with the graph (about √n/4, 1..25). The order is deterministic, so a re-invoked pass or a later run re-derives it and resumes at the frontier (each batch logs `frontier: <symbol> (hop H, position P of T)`); `--cluster-offset N` is now this worker's index among `--workers` (default offset + 1): with the hub-first order, worker k of N takes only stripe windows w with w % N == k, so workers given the same `--workers` do not pick the same window; a lone worker owns every window, and without the store's order (the flat fallback) there is no striping.
+  - *Fail-closed below the configured minimum.* The domain skills (`domain`, `domain-extractor`, `domain-coverage`, `domain-modeler`, refs) say the graph is built once the share reaches the configured minimum (as released, the REAL share: risk-flagged placeholders are mapped but never counted, see Changed) (crew's `requirementsGraph.minCoveragePct`, `WICKED_REQUIREMENTS_MIN_COVERAGE_PCT`, default 80), not 1.0; below it the run says "N% mapped, minimum M%" and keeps the mapping. The coverage evaluator runs `wicked-core coverage … --min-coverage-pct` and its verdict follows that check; holes above the minimum are NOTEs, the next run's frontier.
+  - *Schema re-vendored at domain-model 1.1.0 (bundle 1.2.3).* The optional `metadata.coverage` and `requirement.corroboration` core now emits (validated by two or more independent sources, or unconfirmed with why). `validate_domain_model.py` accepts every version the schema's `schema_version` enum lists (1.0.0 and 1.1.0); garden's own emitter still writes 1.0.0.
+
+### Fixed
+
+- **The domain loop's line says "minimum", as studio does, and prints counts as "2,174".** The progress line, the
+  repeat gate's ask and its choices read "target 80% · 2174 placeholders" while studio's requirements view beside them
+  read "minimum 80% · 2,174 placeholders". `extract-next` now says "minimum 80%", "minimum out of reach in this run",
+  "Lower the minimum to N%" and "minimum lowered to N%", and every count it prints carries thousands separators.
+- **No time estimate for a target the run cannot reach.** On wicked-crew run 29bbbfb1 the line read "about 3 h 37 min
+  left" with about 2,000 more real requirements needed and about 1,900 units left to ask. When the units left to ask
+  are fewer than the real requirements still needed, the line now says "target out of reach in this run: N more real
+  requirements needed, M units left to ask" in place of an ETA; with none left, no ETA at all.
+- **The extractor no longer states a rule for a plain interface (follow-up to #1375).** The file-mode instructions
+  said "an interface or type states what a request or record must hold". On wicked-crew run 29bbbfb1, page 3 (500
+  units), codex stated 441 rules, all at confidence 0.9, and most of them restated interface fields. The page review
+  failed it: they describe code. A type is now a rule only when it encodes a constraint the business relies on (a
+  closed set of values, a limit, a required field whose comment says what it means). A plain field list or any
+  restated shape is left empty. A constraint visible in the unit's definition, whether in its body or its type,
+  is high confidence; a rule guessed from a name, a comment alone or a cut-off slice is low. Each confidence is
+  judged on its own and never stamped across the page. The bounded rule model's prompt says the same.
+- **The seat's reviewed confidence decides whether a rule resolves, never its Louvain community.** On the same run,
+  page 3 restated 230 grounded rules at 0.80 to 0.84, and the page review passed them. Apply resolved only 42.
+  A unit with no community took a 0.85 penalty (0.84 x 0.85 < 0.75), while a community boost of up to 1.1 raised
+  rules the seat was unsure of. Communities still frame a unit on the worklist; `extract-apply` no longer reads
+  them.
+
+- **Hub-first extraction starts at the product's code, not builtin-name collisions (#1366).** On a TypeScript store, `s.startsWith(...)` or `map.get(k)` resolves to any local symbol of that name, so a one-line helper collected thousands of callers and became the first hub. A JS/TS symbol named like a builtin method, or a symbol in a test or fixture file, never seeds the fan-out; a collision with callers in 8 or more files is not fanned out from; tests and fixtures come after the product's code in the worklist.
+- **Communities are read when estate warns that the index is stale.** estate prints `STALENESS: …` before its JSON, so `clusters` failed to parse and every node framed as a singleton community; the cohesion penalty then pushed most stated rules under the resolve threshold (rig run 7588cff1: 99 resolved, 201 risk-flagged out of 300). The document now starts at the first line that opens one.
+- **`extract-apply` reads each write back with one query** instead of a third estate process per rule (30 rules: 35 s → 27.6 s on a copy of wicked-crew's store).
+- **The domain extraction harness can write against estate 0.30 (#1361).** estate >= 0.30 refuses `semantics --validated` without `--validated-by`, so `extract_loop.py`'s first write (a RESOLVED or a RISK node) exited with a usage error and the pass aborted before mapping anything; a `domain-extraction` run could never reach its coverage step. `CliEstateClient.set_requirement` now names its validator, and the harness's writes name the seat: `extract-loop:<WICKED_RUN_AGENT>` as the semantics validator and the business-rule annotation's `--author`, which is what wicked-core's corroboration counts as an extractor seat. That holds for the in-process loop (`extract_loop.py`). Since #1363 the default file-mode path applies on the host as `extract-loop`: the seat named in the rules file is recorded only as `declared_seat` in the apply report, never as the author, so those writes carry no independent seat attribution for corroboration. Proven against the real estate 0.30.0 and wicked-core main on a copy of tiny-math's store: 8 of 8 mapped hub-first, `coverage --min-coverage-pct` passes, `domain-graph --repo-root` writes the graph (sum/mean/clamp validated by callers, tests and the README; the package.json keys unconfirmed, `config_only`).
+
+## [12.61.0] — 2026-10-26
+
+### Fixed
+- **`install.py --from-run` finds the pack in a real run (editor and MCP) (#1351).** The engine runs the install-plan and install Tool phases in the run's worktree and sets `WICKED_TREE` to that worktree's git tree id (wicked-core#776), not a path. Both install scripts read it as a directory, found nothing, and every editor-plugin run failed at install-plan with "found 0 (none)", so the install consent gate was never reached. `--from-run` now searches the worktree (the cwd) and uses `WICKED_TREE` only when it names a directory.
+- **A credential-free MCP server installs (`scripts/mcp/install.py`) (#1351).** The installer assumed every server reads a `<SERVER>_TOKEN` secret. A local-computation server has no upstream, and its config names no `baseUrl` and no auth scheme (`auth` absent, null or `{"scheme": "none"}`). The installer still sent `auth: env:<SERVER>_TOKEN`, crew answered `secret_missing`, and the server was never registered, so a design that correctly invented no credential could not be installed. Such a server now smokes and registers with no secret variable. A server with an upstream, and `--from-npm` installs, are unchanged.
+- **An MCP server delivered without a `package-lock.json` installs (`scripts/mcp/install.py`) (#1352).** A container seat can't reach the npm registry, so the server a `/workflow-mcp-server` run delivers has no lockfile. `npm ci` refuses such a tree, so the install failed after the operator had consented, with only npm's debug-log path as the reason. The installer now copies the server to a transient `<root>/<key>/resolve/`, resolves the dependencies there once with `npm install --package-lock=true --ignore-scripts`, and builds there. The staged copy installs from that lock, and the delivered tree is never written. An npm that writes no lock (`package-lock=false`) fails before anything is built. The plan and the install record say `"lockfile": "resolved at install"`, because those versions were picked at install time and the run never reviewed them. A delivered lock still goes through `npm ci`, and the output says `"lockfile": "delivered"`. A failing npm step now reports npm's own reason instead of its debug-log path. That is the `npm error code` line and the first line after it that isn't metadata, plus the script's own last line (tsc's error) when `npm run build` fails.
+
 ## [12.60.0] — 2026-10-26
 
 ### Fixed
@@ -1212,7 +1288,9 @@ through `v9.2.18`. Major themes across that span:
 
 For each of those releases, see the corresponding tag in git history.
 
-[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.60.0...HEAD
+[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.62.0...HEAD
+[12.62.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.61.0...v12.62.0
+[12.61.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.60.0...v12.61.0
 [12.60.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.59.0...v12.60.0
 [12.59.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.58.0...v12.59.0
 [12.58.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.57.0...v12.58.0

package/README.md

@@ -11,6 +11,14 @@
 
 **Your coding agent already plans and swarms. wicked-garden is the curated toolkit for what it can't do alone.**
 
+It works inside Claude Code, Codex, Antigravity, OpenCode and Pi, in CI, or inside a wicked-crew job. Its proof gate
+re-checks "done" from evidence, rejecting unsupported claims and failing closed by default when it cannot run. With
+wicked-estate's code graph it sees the event and command links grep never will, and its patch skill renames across files
+as a graph operation. Its 40 QE specialist skills include an acceptance pipeline whose reviewer never runs inline with the
+test writer or the executor (those two also run as separate workers where the host can start them), and a disputed
+decision goes to a review panel of your other agents, with a labelled same-family fallback and no verdict without a quorum. Which entry paths block and which only advise is spelled out in
+[What blocks, what advises](#what-blocks-what-advises).
+
 > 📖 Docs → [wg.wickedagile.com](https://wg.wickedagile.com). Identity & beliefs → [`ETHOS.md`](ETHOS.md). How it works → [`CLAUDE.md`](.claude/CLAUDE.md).
 
 ---
@@ -34,6 +42,7 @@ Most plugins try to boss them around — re-implement planning, impose a workflo
 | re-derives *how to work in this repo* every task — which file owns the bug, the wiring step, the test command | loads the repo's own playbooks (`fix-bug`/`add-feature`/`verify`…), generated from HEAD → wicked-understanding |
 | asks *itself* for a second opinion | convenes a **review panel** → the jam skill's `council` action: usable external CLIs (Antigravity / Codex / …) take the seats; with fewer than two it fills them with isolated same-family workers and **labels them as weaker diversity**, and below two isolated seats it reports *no quorum* instead of synthesizing |
 | re-derives WCAG/CWE/SOC2 from memory every time | loads the rubric on demand, ships it to any repo |
+| reads the code, but can't say what it *requires* | states the business rule behind each behaviour onto estate's graph, so wicked-core builds a **requirements graph** that counts only stated rules toward its minimum, never placeholders → the domain skill |
 | grades its own homework | author ≠ executor ≠ reviewer as separate workers → evidence-gated testing (the `qe` domain) |
 
 The throughline: **done is re-derived, not asserted** — wherever the gate actually runs. Which entry paths block and which only advise is spelled out in [What blocks, what advises](#what-blocks-what-advises).

package/docs/domains.md

@@ -6,7 +6,7 @@ Work is shaped by the **archetypes** (triage, explore, specify, decide, ship, re
 
 The plugin is **skills-only** (v12.25). Each domain is one consolidated, user-invokable skill — `skills/{domain}/SKILL.md`, frontmatter name `wicked-garden-{domain}` — that routes to its **actions** (the former `/wicked-garden:{domain}:{command}` surfaces) and loads rubrics on demand from `skills/{domain}/refs/` and nested knowledge modules. The former dispatch agents are **fork worker skills** — `skills/{domain}-{role}/SKILL.md` with `context: fork`, frontmatter name `wicked-garden-{domain}-{role}` — reached by `Skill()`/`Task()` dispatch, never invoked as entry points. Invoke a domain action as `/wicked-garden-{domain} {action} [args]` (or just describe what you want — the skill descriptions carry the triggers).
 
-There are **8 domains**: engineering, platform, product, data, jam, search, agentic, persona.
+There are **9 domains** here: engineering, platform, product, data, jam, search, agentic, persona, domain. The `qe` (evidence-gated testing) and `mem` (memory over wicked-estate) domains are covered in the [README](../README.md).
 
 > **v12 cleanup (ADR 0002).** Most former domain commands were *rubric-wrappers* — a checklist the agent already applies. These were **collapsed**: the rubric moved to an on-demand `skills/{domain}/refs/{name}.md` and the action now loads it and works **inline** (no `Task` dispatch hop). Dispatch is kept only where it earns it — real parallelism (multiple lenses at once), a real external tool, or an independent gate. The dispatch-only agents that nothing reaches anymore were removed; workers still referenced by a surviving action, skill, scenario, or the specialist registry live on as fork skills. Capability is preserved; only the token-burning hop is gone.
 
@@ -161,6 +161,18 @@ They do not overlap; pick by target:
 
 **Worker**: none — the former `wicked-garden-persona-agent` worker is retired into `refs/as.md` (wave-2 B9): the `as` action builds the profile from the registry at runtime and embodies it inline. `define` runs inline from `refs/define.md`; the no-op `persona:submit` stub was deleted.
 
+## domain — The Domain Model and the Requirements Graph
+
+`wicked-garden-domain` — extracts a codebase's domain (testable business rules with a confidence and a provenance, entities, requirements) onto the estate graph, so wicked-core can build the repository's **requirements graph**. A shared substrate: `modernize` derives from it, and build, migrate, review, specify and explore read the same model.
+
+| Worker | What It Does |
+|--------|-------------|
+| `wicked-garden-domain-extractor` | States one business rule per behaviour (hub-first, the most central symbols first) and annotates the estate store |
+| `wicked-garden-domain-modeler` | Groups the rules into domains and invokes `wicked-core domain-graph`, which saves the graph into the estate store |
+| `wicked-garden-domain-coverage` | Checks the share against the minimum and threat-models the extracted model before the build (ungrounded rules, reason-less drops, holes) |
+
+Only **real requirements** count toward the minimum (80% by default; a repository can keep its own with `wicked-core requirements-target`): behaviours with a business rule at or above the confidence threshold, or a validated requirement. A placeholder (a risk flag, or a rule under the threshold) is shown and never counted. Test, spec and fixture files are left out by path, and so are data and document files, except an extracted rules-engine rule. The extractor checks each rule's shape and source before writing it; the page's review and the coverage evaluator judge whether it is grounded. In wicked-crew, a `domain-extraction` run maps a repository page by page until real requirements reach the minimum, printing one line per page ("Mapping wicked-crew · real requirements 3% → 12% → 19% · minimum 80% · page 4 · 2,174 placeholders · about 2 h left"), and asks the operator when its budget is spent or the pages stall: map more, lower the minimum for this repository, or stop.
+
 ## How archetypes invoke domains
 
 An archetype playbook (`skills/archetype/refs/{archetype}.md`) doesn't hardcode a domain pipeline — it reaches for whatever expertise the work needs:

package/docs/getting-started.md

@@ -103,6 +103,8 @@ Skill(skill="wicked-garden-mem", args="store \"Chose Postgres over Redis for ses
 Skill(skill="wicked-garden-mem", args="recall \"session storage decisions\"")
 ```
 
+Inside a wicked-crew governed run, every seat also proposes what it witnessed and the code doesn't show (a command that failed because of the toolchain and what made it pass, a tool trap, an operator ruling), at most three per unit. Proposals land inert in the review queue until a person accepts them; the run, the unit and the seat are stamped on each (rule A7 of the `wicked-garden-governed-worker` skill).
+
 Search the same knowledge layer instead of grep — the `wicked-garden-search` skill gives structural code intelligence, lineage, and blast radius over the estate graph.
 
 ## Common Workflows

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "wicked-garden",
-  "version": "12.60.0",
+  "version": "12.62.0",
   "type": "module",
-  "description": "The skills your coding agent can't build alone: \"done\" re-checked from evidence, graph-aware search and multi-file refactor, 40 QE specialists, review panels from other models, and cross-session memory. Works in Claude Code, Codex, Antigravity, OpenCode and Pi, in CI, or in a wicked-crew job.",
+  "description": "The skills your coding agent can't build alone: a proof gate that re-checks \"done\" from evidence, graph-aware search and cross-file renames (with wicked-estate), 40 QE specialists, and review panels with labelled fallbacks. Works in Claude Code, Codex, Antigravity, OpenCode and Pi, in CI, or in a wicked-crew job.",
   "keywords": [
     "ai",
     "coding-agent",

package/pyproject.toml

@@ -19,6 +19,10 @@ dependencies = [
     "pathspec>=0.11.0",
     "pyyaml>=6.0",
     "flask>=3.0",
+    # The code-graph store keeps file content zstd-compressed; domain extraction slices each
+    # behaviour's source out of it (wicked-garden#1370). Python 3.14+ decodes it in the stdlib
+    # (`compression.zstd`); before that, without this, every source fell back to a checkout.
+    "zstandard>=0.22; python_version < '3.14'",
 ]
 
 [project.optional-dependencies]

package/scripts/domain/_clients.py

@@ -135,6 +135,18 @@ def _run_json(argv: list[str]) -> Any:
     try:
         return json.loads(out)
     except json.JSONDecodeError as e:
+        # estate prints advisory lines BEFORE its JSON on stdout ("STALENESS: 1 commit(s) since
+        # last index — run `wicked-estate index …`"): the document starts at the first line that
+        # opens one. Read without that, `clusters` failed and every node framed as a singleton
+        # community, which pulled each rule's confidence under the resolve threshold.
+        lines = out.splitlines()
+        for start in range(1, len(lines)):
+            if lines[start].lstrip()[:1] not in ("[", "{"):
+                continue
+            try:
+                return json.loads("\n".join(lines[start:]))
+            except json.JSONDecodeError:
+                continue  # an advisory line that itself opens with a bracket: keep looking
         raise RuntimeError(f"{argv[0]} output is not JSON: {e}: {out[:200]!r}") from e
 
 
@@ -230,6 +242,19 @@ class CliEstateClient:
             )
         return data
 
+    def rank(self, limit: int = 200) -> list[str]:
+        """The store's most central symbols, most central first — estate's PageRank over
+        Calls+Imports (`rank --json`, the CLI twin of the `RankHotspots` MCP tool the search
+        domain's hotspots use). The tool clamps `limit` to its own ceiling. Fail-loud on a
+        shape break; callers that can do without centrality catch and fall back."""
+        data = _run_json(self._argv("rank", "--limit", str(int(limit)), "--json"))
+        hot = data.get("hotspots") if isinstance(data, dict) else None
+        if not isinstance(hot, list):
+            raise RuntimeError(
+                "wicked-estate rank returned no `hotspots` array — expected {hotspots:[{symbol,…}]}"
+            )
+        return [h["symbol"] for h in hot if isinstance(h, dict) and isinstance(h.get("symbol"), str)]
+
     def source(self, name_or_symbol: str) -> str:
         """The source slice(s) for a symbol (`source <name>`) — the untrusted DATA
         the model reads to state a rule. Fail-loud (empty ⇒ no slice to reason over)."""
@@ -255,7 +280,7 @@ class CliEstateClient:
 
     def annotate(self, symbol_id: str, type: str, key: str, value: str,
                  confidence: float | None = None, provenance: str | None = None,
-                 replace: bool = True) -> None:
+                 replace: bool = True, author: str | None = None) -> None:
         if not _looks_like_symbol_id(symbol_id):
             raise ValueError(
                 f"refusing annotate on non-SymbolId {symbol_id!r} — a bare name fans "
@@ -267,20 +292,28 @@ class CliEstateClient:
             argv += ["--confidence", repr(float(confidence))]
         if provenance is not None:
             argv += ["--provenance", provenance]
+        if author:
+            # The seat that stated it: wicked-core's corroboration counts extractor SEATS by
+            # annotation author (never provenance), so two seats agreeing read as two sources.
+            argv += ["--author", author]
         if replace:
             argv.append("--replace")  # else the CLI APPENDs (stacks duplicates)
         _run(argv)
 
     def set_requirement(self, symbol_id: str, requirement: str,
-                        validated: bool) -> None:
+                        validated: bool, validated_by: str = "extract-loop") -> None:
         if not _looks_like_symbol_id(symbol_id):
             raise ValueError(
                 f"refusing set_requirement on non-SymbolId {symbol_id!r} — a bare "
                 "name is a silent no-op in estate; resolve() first"
             )
-        # node_semantics (requirement/validated), a SEPARATE subcommand from annotate.
+        # node_semantics (requirement/validated), a SEPARATE subcommand from annotate. estate
+        # >= 0.30 refuses `--validated` without `--validated-by` (who made the claim), so every
+        # write names its validator — a usage error here used to abort the whole pass on its first
+        # node.
         _run(self._argv("semantics", symbol_id, "--requirement", requirement,
-                        "--validated", "true" if validated else "false"))
+                        "--validated", "true" if validated else "false",
+                        "--validated-by", validated_by or "extract-loop"))
 
     def read_annotations(self, symbol_id: str) -> list[dict[str, Any]]:
         if not _looks_like_symbol_id(symbol_id):
@@ -339,6 +372,34 @@ class CliCoreClient:
         _run([*self._bin, "coverage", "--db", db, "--out", out])
         return _read_output_json(out, "wicked-core coverage")
 
+    def coverage_against_minimum(self, db: str, out: str) -> tuple[dict[str, Any], bool, str]:
+        """Emit the coverage report to ``out`` checked against the CONFIGURED minimum
+        (``--min-coverage-pct``: ``WICKED_REQUIREMENTS_MIN_COVERAGE_PCT``, else 80). Returns
+        (report, at_or_above_minimum, the CLI's "N% real requirements, minimum M%" line; "N%
+        mapped" from an older wicked-core). Below the minimum is an answer (exit 3), not an
+        error; any other non-zero exit fails loud."""
+        proc = _invoke([*self._bin, "coverage", "--db", db, "--out", out, "--min-coverage-pct"])
+        if proc.returncode not in (0, 3):
+            raise RuntimeError(f"{self._bin[0]} coverage exited {proc.returncode}: "
+                               f"{(proc.stderr or proc.stdout).strip()[:300]}")
+        lines = [ln.strip() for ln in (proc.stderr or "").splitlines()
+                 if "real requirements" in ln or "mapped" in ln]
+        return _read_output_json(out, "wicked-core coverage"), proc.returncode == 0, \
+            (lines[-1] if lines else "")
+
+    def requirements_target(self, db: str, set_pct: int | None = None) -> tuple[int, str]:
+        """The coverage target this repository's graph is held to and where it comes from
+        (``"repository"``: its own, kept in its store; ``"daemon"``: the configured minimum).
+        ``set_pct`` WRITES the repository's own target first. Fails loud."""
+        argv = [*self._bin, "requirements-target", "--db", db, "--json"]
+        if set_pct is not None:
+            argv += ["--set", str(int(set_pct))]
+        doc = _run_json(argv)
+        pct = doc.get("min_coverage_pct") if isinstance(doc, dict) else None
+        if not isinstance(pct, int) or isinstance(pct, bool) or not 1 <= pct <= 100:
+            raise RuntimeError(f"wicked-core requirements-target answered no target: {doc!r}")
+        return pct, str(doc.get("source") or "")
+
     def domain_graph(self, db: str, out: str,
                      coverage: str | None = None) -> dict[str, Any]:
         """Build ``requirements_graph.json`` from the annotated store and return
@@ -373,12 +434,24 @@ def unaccounted_nodes(coverage_doc: dict[str, Any]) -> list[dict[str, Any]]:
     return nodes
 
 
+def placeholder_nodes(coverage_doc: dict[str, Any]) -> list[dict[str, Any]]:
+    """The coverage report's risk-flagged placeholders (accounted, not real requirements: an
+    empty statement, a rule under the confidence threshold, or one written unconfirmed), each
+    {symbol_id,name,kind,file,…}: what a page may revisit to raise the REAL share
+    (wicked-core#1233). Optional on the wire (an older wicked-core lists none), so absent is [];
+    present and not a list of objects fails loud."""
+    nodes = coverage_doc.get("placeholder_nodes", [])
+    if not isinstance(nodes, list) or not all(isinstance(n, dict) for n in nodes):
+        raise RuntimeError("`placeholder_nodes` is not a list of nodes")
+    return nodes
+
+
 def total_node_community(clusters: list[dict[str, Any]],
                          all_nodes: list[dict[str, Any]]) -> dict[str, str]:
     """Port of anti-legacy `_cluster_from_native`: map EVERY node → a community
     label — Louvain members keep their community, and every node the engine omitted
     is SINGLETON-assigned its own symbol_id as label, so ``node_community`` is TOTAL.
-    Feeds the cohesion framing signal ONLY (resolved-vs-RISK quality), NOT the
+    Feeds the community label a worklist unit is framed with ONLY (never its verdict), NOT the
     coverage denominator (which `unaccounted_nodes` owns)."""
     node_community: dict[str, str] = {}
     for comm in clusters:
@@ -426,9 +499,63 @@ def estate_client(db: Optional[str] = None,
     return EstateClient()
 
 
+# The engine's own CLI as wicked-crew resolved it (crew exports it to the daemon; the engine's
+# Tool steps inherit it). It matches the running engine, so it wins over config and PATH.
+ENGINE_CORE_ENV = "WICKED_CORE_EXE"
+
+
+def _resolve_trusted(env_vars: tuple[str, ...], package: str) -> Optional[list[str]]:
+    """The HOST steps' resolver (`prepare_worklist.py`, `apply_rules.py`): they run as the daemon
+    user in a worktree a seat can write, so a binary may come only from the operator and the
+    engine — the env (set-but-empty = the kill-switch), config, or PATH — never from the working
+    directory (no `node_modules/.bin` fallback), and every answer is pinned to the real path of
+    the file that will run (`rules_file.trusted_executable`)."""
+    from domain import rules_file  # stdlib-only sibling; imported late to keep this module light
+    choice: Optional[str] = None
+    for env_var in env_vars:
+        if env_var in os.environ:
+            choice = os.environ[env_var].strip()
+            if not choice:
+                return None
+            break
+    if choice is None:
+        choice = _config_preference(package) or package
+    pinned = rules_file.trusted_executable(choice)
+    return [pinned] if pinned else None
+
+
+def host_estate_client(db: str) -> "CliEstateClient":
+    """The real estate client for a host step, from a trusted binary only (fails loud)."""
+    bin_argv = _resolve_trusted((ESTATE_ENV,), "wicked-estate")
+    if not bin_argv:
+        raise RuntimeError("wicked-estate is not resolvable on this host (WICKED_ESTATE_BIN or "
+                           "PATH)")
+    return CliEstateClient(bin_argv, db)
+
+
+def host_core_client() -> "CliCoreClient":
+    """The real core client for a host step: WICKED_CORE_BIN, else the engine's WICKED_CORE_EXE,
+    else config or PATH — never the working directory (fails loud)."""
+    if CORE_ENV in os.environ:
+        bin_argv = _resolve_trusted((CORE_ENV,), "wicked-core")
+    else:
+        bin_argv = _resolve_trusted((ENGINE_CORE_ENV,), "wicked-core") \
+            if (os.environ.get(ENGINE_CORE_ENV) or "").strip() \
+            else _resolve_trusted((), "wicked-core")
+    if not bin_argv:
+        raise RuntimeError("wicked-core is not resolvable on this host (WICKED_CORE_BIN, "
+                           "WICKED_CORE_EXE or PATH)")
+    return CliCoreClient(bin_argv)
+
+
 def core_client(project_dir: Optional[Path] = None) -> Optional[CliCoreClient]:
     """A CLI-backed :class:`CliCoreClient` when ``wicked-core`` resolves, else
     ``None`` (the caller falls back to the hermetic ``_mocks.BrainClient`` +
-    ``emit_domain_model`` doc-assembly lane)."""
+    ``emit_domain_model`` doc-assembly lane). ``WICKED_CORE_BIN`` (set-but-empty = the
+    kill-switch) wins; then the engine's ``WICKED_CORE_EXE``; then config, PATH, node_modules."""
+    if CORE_ENV not in os.environ:
+        engine = (os.environ.get(ENGINE_CORE_ENV) or "").strip()
+        if engine:
+            return CliCoreClient([engine])
     bin_argv = _resolve_bin(CORE_ENV, "wicked-core", project_dir)
     return CliCoreClient(bin_argv) if bin_argv else None

package/scripts/domain/_mocks.py

@@ -89,7 +89,7 @@ class EstateClient:
 
     def annotate(self, symbol_id: str, type: str, key: str, value: str,
                  confidence: float | None = None, provenance: str | None = None,
-                 replace: bool = True) -> None:
+                 replace: bool = True, author: str | None = None) -> None:
         if not _looks_like_symbol_id(symbol_id):
             raise ValueError(
                 f"refusing annotate on non-SymbolId {symbol_id!r} — a bare name "
@@ -98,10 +98,11 @@ class EstateClient:
         self.annotation_writes.append({
             "symbol_id": symbol_id, "type": type, "key": key, "value": value,
             "confidence": confidence, "provenance": provenance, "replace": replace,
+            "author": author,
         })
 
     def set_requirement(self, symbol_id: str, requirement: str,
-                        validated: bool) -> None:
+                        validated: bool, validated_by: str = "extract-loop") -> None:
         if not _looks_like_symbol_id(symbol_id):
             raise ValueError(
                 f"refusing set_requirement on non-SymbolId {symbol_id!r} — a bare "

package/scripts/domain/_rule_extractor.py

@@ -36,8 +36,15 @@ _PROMPT_HEADER = (
     'or \\"\\" if you cannot state it safely>", "confidence": <number 0..1>, '
     '"provenance": {"source": "<repo/module>", "ref": "<the symbol_id>", '
     '"source_kinds": ["code-body"|"type-def"|"comment"|"doc", ...]}}\n'
-    "If a unit’s behavior is unclear, set statement to \"\" and confidence low — do "
-    "NOT guess. Ground trusted rules in code-body/type-def, not comment/doc alone.\n"
+    "Most product code encodes a rule: a check, a refusal, a limit, a default, an "
+    "ordering, a permission or a state change is a rule even when it is small, so state "
+    "it. A type or interface is a rule only when it encodes a constraint the business "
+    "relies on (a closed set of values, a limit, a required field whose comment says what "
+    "it means); a plain list of fields describes code, so its statement is \"\". Leave a "
+    "statement \"\" for pure plumbing too (a re-export, a trivial getter, a pass-through "
+    "wrapper, formatting) or when the unit's behavior is unclear, with confidence low — do "
+    "NOT guess. Judge each confidence on its own evidence. Ground trusted rules in "
+    "code-body/type-def, not comment/doc alone.\n"
     "State each rule in PRODUCT-FUNCTIONAL terms: what the business requires, not the "
     "implementation. Name a specific tool, library, or technology ONLY when the source "
     "makes that tool itself the requirement — otherwise state the capability (e.g. "
@@ -137,21 +144,23 @@ def validate_rule(rule: Any, batch_ids: set[str]) -> tuple[bool, str]:
     return True, "ok"
 
 
-def extract_rules(batch: list[dict[str, Any]], model_argv: list[str]) -> list[dict[str, Any]]:
+def extract_rules(batch: list[dict[str, Any]], model_argv: list[str],
+                  timeout: float | None = None) -> list[dict[str, Any]]:
     """Shell the bounded model CLI over one batch of framed contexts; return the
     parsed (UNvalidated) rule objects. Fail-loud on a non-zero exit / timeout /
     unparseable output — the caller then validates each rule and RISK-floors the
     residue, so a model failure degrades to RISK, never to a silent gap."""
     prompt = _build_prompt(batch)
+    limit = _MODEL_TIMEOUT if timeout is None else max(1.0, min(float(_MODEL_TIMEOUT), timeout))
     try:
         proc = subprocess.run(
             model_argv, input=prompt, capture_output=True, text=True,
-            encoding="utf-8", timeout=_MODEL_TIMEOUT,
+            encoding="utf-8", timeout=limit,
         )
     except FileNotFoundError as e:
         raise RuntimeError(f"rule model {model_argv[0]} not found: {e}") from e
     except subprocess.TimeoutExpired as e:
-        raise RuntimeError(f"rule model exceeded {_MODEL_TIMEOUT}s") from e
+        raise RuntimeError(f"rule model exceeded {int(limit)}s") from e
     if proc.returncode != 0:
         raise RuntimeError(
             f"rule model exited {proc.returncode}: {(proc.stderr or proc.stdout).strip()[:300]}"