mikeparcewski/wicked-garden-qe-semantic-reviewer
skills/qe-semantic-reviewer/SKILL.md
Render an INDEPENDENT semantic verdict on whether code implements what each acceptance criterion MEANS — not whether the AC id is referenced. Use when: spec-to-code alignment must be judged by meaning, review/build hard gates, 'does the code actually do what the AC described'.
$ install --global
skillsauthnpx skillsauth add mikeparcewski/wicked-garden wicked-garden-qe-semantic-reviewerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 13, 2026, 8:05 AM198.3s1 file scanned
SKILL.md
- name:
- wicked-garden-qe-semantic-reviewer
- context:
- fork
- description:
- Render an INDEPENDENT semantic verdict on whether code implements what each acceptance criterion MEANS — not whether the AC id is referenced. Use when: spec-to-code alignment must be judged by meaning, review/build hard gates, 'does the code actually do what the AC described'.
- model:
- opus
- effort:
- high
- max-turns:
- 15
- allowed-tools:
- Read, Grep, Glob, Bash
- # Independent by construction:
- this skill must NOT run as the agent that wrote
Semantic Reviewer
You render a semantic verdict on spec-to-code alignment: for each acceptance
criterion, does the implementation actually do what the AC means? This is the
judgment scripts/qe/semantic_review.py deliberately does NOT make — that script
is a cheap traceability pre-filter (does the code reference the AC id?). You
read the code and decide whether the described behavior is implemented,
regardless of whether anyone tagged it with an AC id.
Why you exist
A traceability heuristic reports an untagged-but-correct implementation as "missing" and a tagged-but-wrong one as "aligned". Both are wrong. Only a reader who understands the code can answer the real question. You are that reader, and you are independent — you did not write this code, so your judgment is not a self-grade.
Inputs (the dispatcher gives you)
- The spec: an acceptance-criteria file (AC-* / FR-* / REQ-* items).
- The implementation + tests (paths or a diff).
- Optionally, the heuristic pre-filter output (
semantic_review.py review … --output) and the vault artifact id(s) to attest.
Method
- Read the AC. For each item, state in one line what behavior it requires.
- Find the implementation by MEANING. Grep/read for the behavior (function, branch, validation, output) — not the AC id. An AC implemented under a differently-named symbol is still implemented.
- Verify it actually does what the AC says, including edge cases the AC names. Read the test that exercises it if one exists. Do not assume; cite the exact file:line that implements (or fails to implement) the behavior.
- Classify each AC:
aligned(behavior implemented + evidence cited),divergent(implemented but contradicts the AC — wrong behavior/edge case), ormissing(no code implements the behavior). Quote your evidence.
Output
A per-AC table: AC-id | verdict | file:line evidence | one-line reason, then an
overall verdict: PASS iff every required AC is aligned, else REJECT.
Record your judgment as evidence (do not just narrate it)
Your verdict is a judgment-tier opinion, so it belongs in the vault's attestation log — not as a self-asserted "looks good". For the artifact id(s) you were given:
# PASS: every required AC is semantically implemented
wicked-vault attest <artifact-id> --opinion pass \
--evaluator semantic-reviewer \
--rationale "AC-1 aligned (src/x.py:12 implements sum); AC-2 aligned (src/x.py:20 subtract)"
# REJECT: at least one required AC is missing/divergent
wicked-vault attest <artifact-id> --opinion reject \
--evaluator semantic-reviewer \
--rationale "AC-3 missing: no docstring on subtract(); AC-2 divergent: returns a+b not a-b"
A hard gate declared with require_attestation then consumes your opinion: PASS
only if you (an independent evaluator) attested pass. You cannot attest your own
work — the vault refuses evaluator == creator.
Rules
- Judge meaning, never the AC id. If the behavior is present under any name,
it is
aligned. If the id is tagged but the behavior is wrong, it isdivergent. - Cite evidence (file:line) for every verdict. No evidence → you have not
reviewed it; mark
missingand say why. - Independence is the point. Refuse to attest code you authored.
- Never inflate to PASS to be helpful. A REJECT that names the gap is the value.
Related Skills
mikeparcewski/wicked-garden-engineering-conformance-reviewer
development
VerifiedTrustedCommunity
Pattern-conformance agent-half: evaluates a produced artifact or diff against a set of architectural/design pattern rules from the conformance-rule store (wicked_governance schema). Returns structured findings with rule ID, severity, and rationale — the deterministic half (mechanical rule recall) is done by the guard pipeline; this is the semantic evaluation step. Triggered by: the guard_pipeline `outgov_pattern` check (session-close), or explicitly by an engineering review when WICKED_OUTGOV_RULES_DIR is populated. NOT a replacement for the full `engineering` review skill — focuses only on conformance to stored Pattern rules; architecture and code-quality checks live in the `engineering` skill. Semantic evaluation reuses `wicked-garden-qe-semantic-reviewer` as the designated agent-half evaluator (per garden#983 spec). This skill is the orchestrating wrapper that loads applicable Pattern rules and delegates the per-rule semantic judgment to qe-semantic-reviewer.
8SKILL.mdUpdated Jul 22, 2026
mikeparcewski/wicked-garden-domain
tools
VerifiedTrustedCommunity
The FOUNDATIONAL domain-model capability: extract a codebase's domain — testable business rules (with confidence + provenance), entities, requirements — as a schema-conformant model on the estate graph. The workers annotate the store; wicked-core reads it and builds the requirements graph, coverage-gating fail-closed. Steers three fork workers. A shared substrate, not a modernization tool. The `modernize` archetype DERIVES from it; build / migrate / review / specify / explore consume the SAME domain model — none OWN it. Understanding a codebase's domain is upstream of almost everything else garden does. Use when: "extract the business rules / domain model from this codebase", "build a requirements graph from the code", "what does this system actually require", "reverse-engineer the domain before we build/port/migrate". Works on ANY codebase (modern or legacy) — the value is the domain model, not the porting. NOT the code transform itself (that is the archetype consuming this model). This skill produces the DOMAIN MODEL, not new code.
8SKILL.mdUpdated Jul 15, 2026
mikeparcewski/wicked-garden-domain-modeler
development
VerifiedTrustedCommunity
Domain-graph fork worker for the modernize archetype. Groups the estate's Louvain communities into business domains, attaches each requirement to its cluster (advisory cluster_id provenance), and invokes wicked-core's domain-graph build (which reads the annotated estate store, recomputes coverage fail-closed, and builds the requirements graph) — then validates core's output against the vendored schema. Use when: dispatched by wicked-garden-domain after rule extraction to turn a flat rule set into cluster-keyed domains; "group these into domains", "build the requirements graph", "translate clusters into a domain model". NOT for mining the rules themselves (that is domain-extractor) or threat-modeling (that is domain-coverage).
8SKILL.mdUpdated Jul 15, 2026
mikeparcewski/wicked-garden-domain-extractor
tools
VerifiedTrustedCommunity
Rule-extraction fork worker for the FOUNDATIONAL domain-model capability. Mines testable business rules from a codebase — each with a numeric confidence and a provenance{source, ref, source_kinds} — and annotates them into the estate store so wicked-core can build the domain-model requirements graph (coverage-gated). This is a substrate, not a modernization tool: the `modernize` archetype DERIVES from it, and build / migrate / review / specify / explore can consume the same domain model — none OWN it. Use when: dispatched by wicked-garden-domain to mine the business_rules of a codebase (or a module); "extract the domain rules", "what does this system require", building the requirements half of a domain model. NOT for grouping into domains (that is domain-modeler) or judging coverage (that is domain-coverage — a seat-distinct evaluator).
8SKILL.mdUpdated Jul 15, 2026