wicked-garden

v11 work-shape archetype runner. When a prompt has been routed to one of the archetypes (triage, explore, specify, decide, ship, review, incident, build, migrate, modernize), this skill is the entry point. It picks the right per-archetype playbook from refs/ and executes the phase shape declared in `.claude-plugin/archetypes.json`. Use when: a `<wg archetype="X">` or `<wg archetypes>` system-reminder tag appears, an explicit "let's run the X archetype" request, or a direct per-archetype ask — "triage this prompt", "review this PR / artifact", "build this feature", "decide between these options", "explore this problem", "handle this incident", "run this migration", "modernize / port this legacy app", "ship this release", "write acceptance criteria" (invoke with archetype=<name> plus the user's args — see the Direct invocation table).

Pattern-conformance agent-half: evaluates a produced artifact or diff against a set of architectural/design pattern rules from the conformance-rule store (wicked_governance schema). Returns structured findings with rule ID, severity, and rationale — the deterministic half (mechanical rule recall) is done by the guard pipeline; this is the semantic evaluation step. Triggered by: the guard_pipeline `outgov_pattern` check (session-close), or explicitly by an engineering review when WICKED_OUTGOV_RULES_DIR is populated. NOT a replacement for the full `engineering` review skill — focuses only on conformance to stored Pattern rules; architecture and code-quality checks live in the `engineering` skill. Semantic evaluation reuses `wicked-garden-qe-semantic-reviewer` as the designated agent-half evaluator (per garden#983 spec). This skill is the orchestrating wrapper that loads applicable Pattern rules and delegates the per-rule semantic judgment to qe-semantic-reviewer.

Coverage evaluator + pre-build threat model for the domain-extraction workflow (CONTRACT-3 §2). Emits `coverage-report.json` from the estate store, then adversarially reviews the extracted domain model: hunts missing error paths, ungrounded rules, reason-less drops, cross-cluster smears, and coverage holes. Use when: dispatched as the `coverage` phase of a domain-extraction workflow run. The phase runs in a git worktree; WICKED_ESTATE_DB points at the live estate store. NOT for mining rules (domain-extractor) or grouping domains (domain-modeler). This worker EMITS coverage evidence AND CRITIQUES the domain model.

Core utility surface for the wicked-garden plugin: help/overview, first-run setup + codebase onboarding, the wicked-* peer installer, selective state reset, the where-am-i path manifest, and structured issue filing. Use when: "wicked-garden help", "show wicked-garden commands", "what can wicked-garden do", "set up wicked-garden", "setup", "--reconfigure", "onboard this codebase", "install wicked tools", "add peers", "install layers", "reset wicked-garden", "clear state", "--list-projects", "where am I", "path manifest", "report issue", "file a bug", "--list-unfiled", or any former /wicked-garden:{help|setup|install|reset| where-am-i|report-issue} invocation.

Rule-extraction fork worker for the FOUNDATIONAL domain-model capability. Mines testable business rules from a codebase — each with a numeric confidence and a provenance{source, ref, source_kinds} — and annotates them into the estate store so wicked-core can build the domain-model requirements graph (coverage-gated). This is a substrate, not a modernization tool: the `modernize` archetype DERIVES from it, and build / migrate / review / specify / explore can consume the same domain model — none OWN it. Use when: dispatched by wicked-garden-domain to mine the business_rules of a codebase (or a module); "extract the domain rules", "what does this system require", building the requirements half of a domain model. NOT for grouping into domains (that is domain-modeler) or judging coverage (that is domain-coverage — a seat-distinct evaluator).

Domain-graph fork worker for the modernize archetype. Groups the estate's Louvain communities into business domains, attaches each requirement to its cluster (advisory cluster_id provenance), and invokes wicked-core's domain-graph build (which reads the annotated estate store, recomputes coverage fail-closed, and builds the requirements graph) — then validates core's output against the vendored schema. Use when: dispatched by wicked-garden-domain after rule extraction to turn a flat rule set into cluster-keyed domains; "group these into domains", "build the requirements graph", "translate clusters into a domain model". NOT for mining the rules themselves (that is domain-extractor) or threat-modeling (that is domain-coverage).

The FOUNDATIONAL domain-model capability: extract a codebase's domain — testable business rules (with confidence + provenance), entities, requirements — as a schema-conformant model on the estate graph. The workers annotate the store; wicked-core reads it and builds the requirements graph, coverage-gating fail-closed. Steers three fork workers. A shared substrate, not a modernization tool. The `modernize` archetype DERIVES from it; build / migrate / review / specify / explore consume the SAME domain model — none OWN it. Understanding a codebase's domain is upstream of almost everything else garden does. Use when: "extract the business rules / domain model from this codebase", "build a requirements graph from the code", "what does this system actually require", "reverse-engineer the domain before we build/port/migrate". Works on ANY codebase (modern or legacy) — the value is the domain model, not the porting. NOT the code transform itself (that is the archetype consuming this model). This skill produces the

Role-plays as focus group personas and synthesizes brainstorming discussions. Use when: brainstorming, ideation, running a full jam session with evidence gathering, discussion rounds, and decision record storage — dispatched by the wicked-garden-jam skill's brainstorm sub-action.

Runs structured multi-model council evaluations using external LLM CLIs. Use when: multi-model evaluation, council verdict on defined options, high-stakes decision needing genuinely independent model perspectives — dispatched by the wicked-garden-jam skill's council sub-action.

Audit evidence collection and trail verification. Gathers artifacts, validates controls, generates audit reports, and maintains compliance documentation. Use when: "audit trail", "collect evidence", "audit report", "control testing", "compliance documentation", "gather audit evidence for SOC2/HIPAA/GDPR/PCI", or any former /wicked-garden:platform:audit invocation. NOT for defining compliance policies (use the compliance sub-skill) or ad hoc security checks (use the platform domain skill's security action).

Regulatory compliance expert. Use when: SOC2, HIPAA, GDPR, PCI, regulatory compliance analysis of code and systems — identifies sensitive data handling, verifies required controls, detects violations, and provides prioritized remediation with evidence.

Use when checking code or architecture against a regulatory framework (SOC2, HIPAA, GDPR, PCI) or translating a policy document into actionable controls — detects violations and provides prioritized remediation guidance. NOT for gathering audit evidence artifacts (use platform/audit). Use when: "is this compliant", "compliance check", "regulatory requirements", "check against SOC2/HIPAA/GDPR/PCI", or any former /wicked-garden:platform:compliance invocation.

Security scanning and vulnerability assessment from DevSecOps perspective. Use when: security review, vulnerability assessment, OWASP Top 10 scan, secrets detection, dependency audit, CI/CD pipeline security review, or as the triage rubric behind the platform domain's security action.

Platform domain skill: security scanning, incident triage, infrastructure review, and distributed-trace analysis. Routes to one of four inline actions (security | incident | infra | traces) backed by the rubrics in refs/, and links out to the domain's sub-skills (audit, compliance, health, observability, CI/CD tooling, peer-health) and fork workers. Use when: "security scan", "vulnerability assessment", "scan this PR for vulnerabilities", "run the security scanners", "incident", "production is down", "triage this alert", "root cause this error", "review our Terraform", "IaC review", "infrastructure review", "cloud cost review", "trace analysis", "why is this endpoint slow", "latency investigation", or any former /wicked-garden:platform:{security|incident|infra|traces} invocation.

Component scaffolding toolkit for creating skills, context:fork worker skills, and hooks within the unified wicked-garden plugin. Generates complete, valid structures that pass validation out-of-the-box. Use when creating new domain components, setting up boilerplate, or ensuring proper structure from the start.

Use when designing or analyzing multi-agent architectures — covers core patterns (sequential, hierarchical, parallel, event-driven), anti-patterns, and the five-layer model (Cognition → Context → Interaction → Runtime → Governance) for separating concerns in production-grade agentic systems. NOT for reviewing existing agentic code (use review-methodology) or framework selection (use the frameworks skill).

Five-layer architecture validation, agent topology analysis, orchestration pattern assessment, and framework detection for agentic systems. Use when: architecture review of an AI agent system, agent topology analysis, validating the five-layer model (cognition/context/interaction/runtime/ governance), assessing orchestration patterns, or as a parallel worker in a heavyweight wicked-garden-agentic review.

Context window management, token optimization, and memory patterns for efficient multi-agent systems. Use when: optimizing token usage in an agentic pipeline, designing memory scope for short / long-term / episodic state, or applying a context-loading strategy (anticipatory / JIT / hybrid).

Use when selecting or comparing agentic frameworks (LangChain, LangGraph, CrewAI, AutoGen, etc.) — curated comparison by use case, language, and maturity. Gets latest context via Context7 when available. NOT for reviewing existing agentic code (use review-methodology) or architecture patterns (use agentic-patterns).

Token optimization, latency budgets, cost analysis, caching strategy, and parallelization assessment for agentic systems. Use when: performance optimization of an AI agent system, cost analysis or token-budget review, latency profiling, cache-strategy assessment, parallelization opportunities, or as a parallel worker in a heavyweight wicked-garden-agentic review.

Use when reviewing an agentic codebase for issues, risks, and maturity gaps — covers the four-phase review process (Detect → Analyze → Prioritize → Report) and the five-level maturity model (Prototype → Functional → Reliable → Production → Optimized) for assessing production readiness. NOT for architecture design (use agentic-patterns) or live agentic review with a subagent (use agentic:review command).

Guardrails, prompt injection defense, PII protection, human-in-the-loop gates, and hallucination mitigation for agentic systems. Use when: safety review of an AI agent system, guardrail assessment, prompt injection audit, PII/compliance exposure check, HITL gate verification, or as a parallel worker in a heavyweight wicked-garden-agentic review.

Agentic-systems domain skill: review, design, audit, and framework selection for AI agent systems. Routes to one of four actions (review | design | audit | frameworks) backed by the rubrics in refs/. Use when: "agentic review", "review this agent system", "full agentic codebase review", "trust and safety audit", "audit my agents for GDPR/HIPAA/SOC2/NIST compliance", "design an agentic system", "design a multi-agent architecture", "which agentic framework should I use", "compare LangChain vs CrewAI vs AutoGen", or any former /wicked-garden:agentic:{review|design|audit|frameworks} invocation. Disambiguation: this domain reviews and designs **AI agent systems**. For ordinary source code use the engineering review; for a binding go/no-go verdict use the archetype review (see docs/domains.md → "review appears in three domains").

Trust, safety, and control patterns for production agentic systems with human-in-the-loop gates and guardrails. Use when: designing guardrails or human-in-the-loop gates for an agent, or hardening an agentic system against prompt injection.

v11 LLM-based work-shape classifier. Replaces the regex archetype detector with the model's own reasoning. Reads the user's prompt, picks the right archetype(s) from the catalog, identifies signals (blast_radius, novelty, reversibility, etc.), and persists to SessionState so subsequent turns steer correctly. Use when: the prompt_submit hook emitted a `<wg classify-due />` directive, OR explicitly invoked at session start, OR when re-classifying after the user changes scope mid-session.

Execute implementation tasks according to approved designs and test strategies. Use when: executing implementation tasks from approved designs and test strategies, building features against phase artifacts, parallel dispatch of independent sub-tasks (single-message multi-Task batch), tracking work via the TaskCreate/TaskUpdate lifecycle with structured Evidence sections.

Explore codebase and gather context before design or implementation choices. Use when: codebase exploration, pattern discovery, dependency mapping, read-only recon before design decisions, gathering context ahead of implementation, or fanning out as a recon worker in a swarm's recon wave.

Perform basic code review and validation. Use when: general code review without a domain-specific specialist available, validating implementation against design and evidence quality, gate reviews requiring reviewer separation (evaluator != creator)

ETL pipeline design, data quality assessment, schema validation, and performance optimization as a delegated fork worker. Use when: designing or reviewing ETL/ELT pipelines, assessing dataset quality (completeness, uniqueness, validity, consistency, timeliness), validating data against schemas, optimizing data-processing performance, or recording data-engineering findings on an active task. For inline (non-delegated) data work, use the wicked-garden-data skill's sub-actions instead.

Data engineering, analysis, and ML toolkit. One skill, routed sub-actions: analyze (interactive EDA on a CSV/Excel/data file), profile / validate / quality (schema-level data engineering ops), ml review / ml pipeline (model review + training-pipeline design), pipeline design / pipeline review (ETL architecture), and ontology (recommend Schema.org, Dublin Core, DCAT, FOAF, GoodRelations, SKOS, or a custom shape for a dataset). Use when: "analyze this CSV/Excel/data file" / "explore this dataset" / one-off data exploration; "profile this dataset" / "validate data against a schema" / "generate a data quality report" (completeness, uniqueness, validity); "review this ML model" / "design an ML training pipeline"; "design a data pipeline" / "review this ETL" / "optimize data processing"; "recommend an ontology for this data" / "map columns to a public ontology". Replaces the former /wicked-garden:data:* commands (analyze, data, ml, ontology, pipeline). NOT for delegated subagent work — dispatch the wicked-garden-

Critical thinking framework applied before doing work. Challenges assumptions, reframes problems, identifies hidden opportunities, and validates whether the stated ask is the right ask. A way of approaching work, not a specialist discipline. Use when: challenging assumptions before implementation, reframing a stated problem, asking whether the right thing is being asked at all, "deliberate on this", "deliberate #42" (a GitHub issue number), "critically analyze this request before implementing", `--deep` (blast-radius analysis), `--batch` (multiple issues, shared root causes), or any former /wicked-garden:deliberate invocation.

Specialize in API documentation — OpenAPI specs, endpoint documentation, request/response examples, error documentation, and authentication docs. Use when: API docs, OpenAPI specs, "document this API/endpoint", generating endpoint reference documentation from code, or when the engineering domain skill's `docs` action routes an api-type request here.

Complete solution architecture design with patterns, decisions, and diagrams. Define overall system structure, technology choices, and architectural trade-offs. Use when: "design the architecture", "what's the overall structure", "architecture patterns", "technology stack", "system architecture"

Backend engineering specialist for APIs, databases, server-side patterns, data modeling, scalability, and integrations. Use when: "design an API", "database schema", "how to handle auth", "backend performance", "REST endpoint", "query optimization", "server-side architecture"

Systematic debugging and root cause analysis for investigating errors, diagnosing complex issues, and performance profiling. Use when: "debug this error", "why is this failing", "root cause analysis", "fix this bug", "investigate crash", "stack trace", "not working"

Use when generating documentation from code, auditing documentation coverage for gaps, or detecting code-doc drift after a refactor. Covers generate (API docs, READMEs), audit (coverage metrics, undocumented exports), and sync (stale docs detection) in one skill. NOT for architecture documentation (use the architecture skill) or product requirements (use product/requirements-analysis).

Frontend engineering specialist for React, CSS, browser APIs, component design, accessibility, and performance. This skill should be used when the user asks about UI implementation, component review, or frontend-specific questions. Use when: "build a React component", "CSS layout issue", "frontend performance", "browser API", "component design", "accessibility check", "responsive design"

Design API contracts, service boundaries, and integration patterns. Define how components and services communicate and interoperate. Use when: "API design", "service integration", "how do these communicate", "API contract", "integration pattern", "REST API", "GraphQL", "event schema"

How to execute a LARGE MECHANICAL change across any codebase with LEVERAGE instead of an agent-grind or hand-edits — a cross-cutting migration, refactor, rename, dialect/framework/DB port, library adoption, or bulk transform. The map→transform→gate pattern: a deterministic transform driven by a source-of-truth map, proven by a differential-equivalence gate. Use when the work is "migrate all X to Y", "rename Z everywhere", "port to a new DB/dialect/framework", "adopt a library across N files", "refactor this pattern in M places", or any change touching dozens-to-thousands of sites. Language/DB/framework-agnostic — the thinking, not a specific tool.

Schema migrations, data backfills, deprecation paths, rollback plans, and the expand-contract pattern for changing live production systems without breaking them. Use when: schema migration, data backfill, splitting/merging tables or services, renaming fields or primary keys in production, changing data types or tightening constraints, sunsetting API versions, breaking changes to event payloads, or "how do we ship this breaking change safely?". NOT for large mechanical codebase changes with no production data in flight — use the engineering/large-scale-migration knowledge module (map→transform→gate) for those.