Platform Domain

One entry point for the platform domain. Pick the action from the request,
parse its args, load its ref, and apply it inline.

Action router

Routing hints:

• Compliance evidence collection → the audit sub-skill, not security.
• Compliance policy/framework checking → the compliance sub-skill.
• System/service health aggregation → the health sub-skill.
• Plugin-level diagnostics (probes, hook traces, contract assertions) → the
  observability sub-skill.
• Application architecture review → engineering domain (arch), not infra.

Action: security

Run the real security scanners, then triage their actual output. This action
does NOT grep-guess: it detects which scanners are installed, runs the ones
that exist, and feeds their findings to triage. A missing scanner is reported
and skipped — the action never fails because a tool is absent.

1. Set the target from args (a path; default ., or the PR's changed files
   when given a PR number). Note --scenarios if passed.
2. Read refs/security-scan.md (relative to this skill's base directory) — the
   scanner detect+run block, the report formats for each scanner's JSON
   output, and the triage step.
3. For the triage rubric (CWE table, severity bands, OWASP matrix, output
   format, --scenarios behaviour, bus emit), read
   the wicked-garden-platform-security-engineer skill (its SKILL.md) — your
   reference, NOT a thing to re-derive.

NOT for compliance evidence collection (use the audit sub-skill) or IaC
posture (use the infra action).

Action: incident

Rapid incident triage with root cause correlation, blast radius assessment,
and remediation guidance.

Scope: this action is for rapid active triage — root cause, blast
radius, remediation steps. To log an incident against a crew project
with traceability, use the crew incident flow (crew:incident) instead.

1. Collect incident context from the args: error/alert description, start time
   if given, affected scope.
2. Read incident/refs/incident.md —
   the 5-phase rubric (triage → stabilize → investigate → resolve →
   follow-up), severity classification, common patterns, output format, and
   communication templates.
3. Apply the rubric directly: discover observability sources via
   ListMcpResourcesTool, correlate with recent git changes, classify
   severity (SEV1–SEV4), and produce the incident report with blast radius,
   mitigation actions, and rollback decision.

Action: infra

Review infrastructure-as-code and cloud architecture for security, cost, HA,
and best-practice posture. NOT for application architecture review (use the
engineering domain's arch review) or active incident response (use the
incident action).

1. Parse args: path to IaC files, or scan to discover .tf, .tfvars,
   CloudFormation, Pulumi, Kubernetes manifests, and docker-compose files.
2. Read infra/refs/infra.md —
   discovery commands, security matrix, cost-optimization checklist, HA/DR
   checklist, platform best practices (Terraform, Kubernetes, Docker
   Compose), and output format.
3. Apply the rubric directly: discover IaC files, detect the platform, assess
   each dimension, and produce the infrastructure review with resource
   inventory, security matrix, cost opportunities, HA gaps, and prioritized
   fixes (critical first, then improvements).

Action: traces

Analyze distributed traces for latency investigation, service dependencies,
and bottleneck detection. This is distributed tracing across services —
for wicked-garden hook execution traces, use the observability sub-skill
(scripts/platform/observability/ops_log_viewer.py).

1. Parse args: service name, trace ID, or slow for p99 latency
   investigation.
2. Read traces/refs/traces.md —
   tracing source discovery, investigation checklist, fallback code-pattern
   analysis, common patterns (N+1, sequential fan-out, cold-start), and
   output format.
3. Apply the rubric directly: discover tracing sources via
   ListMcpResourcesTool, query the target, and produce the trace analysis
   with latency breakdown, service dependencies, bottlenecks, and
   optimization recommendations with expected impact.

Sub-skills

Loaded on demand — each is its own skill beside this one:

Workers

Specialist workers for delegated deep passes — each reached by name through a Hand-off:

• skills/platform-security-engineer/ — security scanning + vulnerability
  assessment (also the triage rubric for the security action)
• skills/platform-compliance-officer/ — regulatory compliance analysis
• skills/platform-privacy-expert/ — PII/PHI detection and privacy-by-design

Hand-off — open the worker skill by name (wicked-garden-platform-security-engineer, wicked-garden-platform-compliance-officer, wicked-garden-platform-privacy-expert) with the target and the ask as the argument; on Claude Code this is the Skill tool, on any other seat open the named skill from your catalog and carry it out inline, then continue here.