0xray 3.5.4 → 4.0.0

package/vendor/@0xray/repertoire/scripts/run-live-synthesis-checkpoint.mjs

@@ -0,0 +1,215 @@
+#!/usr/bin/env node
+/**
+ * Live synthesis checkpoint driver — repertoire core (real .xray/state, not tmp).
+ *
+ * Usage:
+ *   node scripts/run-live-synthesis-checkpoint.mjs seed [--session-id=ID]
+ *   node scripts/run-live-synthesis-checkpoint.mjs status
+ *   node scripts/run-live-synthesis-checkpoint.mjs complete-todo --id=s.1
+ *   node scripts/run-live-synthesis-checkpoint.mjs finish
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const root = join(__dirname, '..');
+const xrayRoot = join(root, 'node_modules/0xray');
+const stateDir = join(root, '.xray', 'state');
+const checkpointPath = join(stateDir, 'synthesis-checkpoint.json');
+const planPath = join(stateDir, 'lead-dev-plan.json');
+
+const DEFAULT_SESSION = 'live-synthesis-repertoire';
+
+const log = (msg) => process.stdout.write(`${msg}\n`);
+const err = (msg) => process.stderr.write(`${msg}\n`);
+
+function parseSessionId() {
+  const arg = process.argv.find((a) => a.startsWith('--session-id='));
+  return arg?.split('=')[1] || process.env.GROK_SESSION_ID || DEFAULT_SESSION;
+}
+
+function loadFeatures() {
+  return JSON.parse(readFileSync(join(root, '.xray/features.json'), 'utf8'));
+}
+
+async function loadXray() {
+  const synthesis = await import(join(xrayRoot, 'dist/nucleus/synthesis.js'));
+  const persistence = await import(join(xrayRoot, 'dist/nucleus/lead-dev-plan-persistence.js'));
+  const kernel = await import(join(xrayRoot, 'dist/nucleus/autonomy-kernel.js'));
+  return { synthesis, persistence, kernel };
+}
+
+async function cmdSeed() {
+  const sessionId = parseSessionId();
+  const grokSession = process.env.GROK_SESSION_ID;
+  if (grokSession && grokSession !== sessionId) {
+    err(
+      `❌ GROK_SESSION_ID (${grokSession}) ≠ seed sessionId (${sessionId}) — hooks will skip synthesis due`,
+    );
+    process.exit(1);
+  }
+  const features = loadFeatures();
+  const threshold = features.synthesis?.every_n_gates ?? 12;
+  if (!features.synthesis?.enabled) {
+    err('❌ synthesis.enabled is false in .xray/features.json');
+    process.exit(1);
+  }
+
+  mkdirSync(stateDir, { recursive: true });
+  const { synthesis, kernel, persistence } = await loadXray();
+
+  // Reset prior checkpoint for clean live run
+  if (existsSync(checkpointPath)) {
+    const prior = synthesis.loadSynthesisCheckpointState(root);
+    if (prior?.synthesisDue) {
+      log('ℹ️  Clearing prior due checkpoint for fresh live run');
+    }
+  }
+
+  let becameDue = false;
+  for (let i = 0; i < threshold; i++) {
+    const result = synthesis.recordExecutionSlice('gate', { projectRoot: root, sessionId });
+    if (result.becameDue) becameDue = true;
+  }
+
+  const state = synthesis.loadSynthesisCheckpointState(root);
+  const due = synthesis.isSynthesisCheckpointDue(root, sessionId);
+
+  log(`📊 sessionId: ${sessionId}`);
+  log(`📊 gate slices recorded: ${threshold}`);
+  log(`📊 synthesisDue: ${due}`);
+  log(`📊 dueReason: ${state?.dueReason ?? 'null'}`);
+  log(`📊 synthesisCount: ${state?.synthesisCount ?? 0}`);
+
+  if (!due) {
+    err('❌ Checkpoint not due after seeding');
+    process.exit(1);
+  }
+
+  // Write session boot marker for hooks
+  writeFileSync(
+    join(stateDir, 'session-boot.json'),
+    JSON.stringify(
+      {
+        hook: 'live-synthesis-seed',
+        lead_dev_mode: true,
+        sessionId,
+        workspaceRoot: root,
+        timestamp: new Date().toISOString(),
+      },
+      null,
+      2,
+    ),
+  );
+
+  log('\n✅ Live synthesis checkpoint SEEDED');
+  log('Next: CallMcpTool xray-orchestrator analyze-complexity with sessionId');
+  log(`      sessionId: "${sessionId}"`);
+}
+
+async function cmdStatus() {
+  const sessionId = parseSessionId();
+  const { synthesis, persistence } = await loadXray();
+  const state = synthesis.loadSynthesisCheckpointState(root);
+  const due = synthesis.isSynthesisCheckpointDue(root, sessionId);
+  const plan = persistence.loadPersistedLeadDevPlan(root);
+  const consultTodos = plan ? persistence.getSynthesisConsultTodos(plan) : [];
+
+  log(JSON.stringify(
+    {
+      sessionId,
+      synthesisDue: due,
+      dueReason: state?.dueReason ?? null,
+      synthesisCount: state?.synthesisCount ?? 0,
+      planActive: plan?.active ?? false,
+      phaseId: plan?.phases?.[0]?.id ?? null,
+      consultTodos: consultTodos.map((t) => ({ id: t.id, subagent: t.subagent, status: t.status })),
+    },
+    null,
+    2,
+  ));
+}
+
+async function cmdCompleteTodo() {
+  const todoId = process.argv.find((a) => a.startsWith('--id='))?.split('=')[1];
+  const verdict = process.argv.find((a) => a.startsWith('--verdict='))?.split('=')[1];
+  if (!todoId) {
+    err('Usage: complete-todo --id=s.1 --verdict=PASS|CONDITIONAL|FAIL');
+    process.exit(1);
+  }
+  if (!verdict || !['PASS', 'CONDITIONAL', 'FAIL'].includes(verdict)) {
+    err('❌ --verdict=PASS|CONDITIONAL|FAIL required (consult receipt gate)');
+    process.exit(1);
+  }
+
+  const sessionId = parseSessionId();
+  const { persistence } = await loadXray();
+  const { writeSynthesisConsultReceipt } = await import(
+    join(xrayRoot, 'dist/nucleus/synthesis-consult-receipt.js'),
+  );
+
+  const plan = persistence.loadPersistedLeadDevPlan(root);
+  const consultTodo = plan
+    ? persistence.getSynthesisConsultTodos(plan).find((t) => t.id === todoId)
+    : null;
+  if (!consultTodo) {
+    err(`❌ Consult todo ${todoId} not found in lead-dev plan`);
+    process.exit(1);
+  }
+
+  writeSynthesisConsultReceipt(
+    todoId,
+    {
+      sessionId: plan?.sessionId ?? sessionId,
+      subagent: consultTodo.subagent,
+      verdict,
+      topRisks: [],
+      hardeningNote: process.argv.find((a) => a.startsWith('--note='))?.split('=')[1] ?? '',
+    },
+    root,
+  );
+
+  const updated = persistence.updatePlanTodoStatus(todoId, 'completed', root);
+  if (!updated) {
+    err(`❌ Receipt gate blocked completion for ${todoId}`);
+    process.exit(1);
+  }
+
+  const refreshed = persistence.loadPersistedLeadDevPlan(root);
+  const todos = refreshed ? persistence.getSynthesisConsultTodos(refreshed) : [];
+  const allDone = todos.length > 0 && todos.every((t) => t.status === 'completed');
+  log(`✅ Marked ${todoId} completed (receipt: ${verdict})`);
+  log(`📊 consult todos: ${todos.map((t) => `${t.id}:${t.status}`).join(', ')}`);
+  if (allDone) log('🎉 All consult todos complete — checkpoint should clear on next gate eval');
+}
+
+async function cmdFinish() {
+  const sessionId = parseSessionId();
+  const { synthesis } = await loadXray();
+  const due = synthesis.isSynthesisCheckpointDue(root, sessionId);
+  const state = synthesis.loadSynthesisCheckpointState(root);
+  if (due) {
+    err('❌ Checkpoint still due — complete all consult todos first');
+    await cmdStatus();
+    process.exit(1);
+  }
+  log('✅ Live synthesis checkpoint CLEARED');
+  log(`📊 synthesisCount: ${state?.synthesisCount ?? 0}`);
+  log(`📊 lastSynthesisAt: ${state?.lastSynthesisAt ?? 'null'}`);
+}
+
+const cmd = process.argv[2] || 'seed';
+const handlers = {
+  seed: cmdSeed,
+  status: cmdStatus,
+  'complete-todo': cmdCompleteTodo,
+  finish: cmdFinish,
+};
+
+const handler = handlers[cmd];
+if (!handler) {
+  err(`Unknown command: ${cmd}`);
+  process.exit(1);
+}
+await handler();

package/vendor/@0xray/repertoire/scripts/suit-bridge-shared.mjs

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+/**
+ * Consumer-side helpers for suit verification — constants from 0xray bridge-mcp-wiring (SSOT).
+ */
+import { createRequire } from 'node:module';
+import { execSync, spawn } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+const packageRoot = resolve(import.meta.dirname, '..');
+
+/** Consumer project root (hoisted 0xray lives here, not under @0xray/repertoire). */
+export function resolveConsumerRoot() {
+  if (process.env.SUIT_VERIFY_ROOT) return resolve(process.env.SUIT_VERIFY_ROOT);
+  if (existsSync(join(process.cwd(), '.xray', 'features.json'))) return resolve(process.cwd());
+  return packageRoot;
+}
+
+function xrayPathCandidates(...segments) {
+  const consumerRoot = resolveConsumerRoot();
+  const roots =
+    consumerRoot === packageRoot ? [packageRoot] : [consumerRoot, packageRoot];
+  const candidates = roots.map((r) => join(r, 'node_modules/0xray', ...segments));
+  candidates.push(resolve(packageRoot, '../xray', ...segments));
+  return candidates;
+}
+
+function resolveXrayBridgeModule() {
+  const found = xrayPathCandidates('scripts/node/bridge-mcp-wiring.cjs').find((p) =>
+    existsSync(p),
+  );
+  if (!found) {
+    throw new Error('0xray bridge-mcp-wiring.cjs missing — run npm install');
+  }
+  return createRequire(import.meta.url)(found);
+}
+
+const wiring = resolveXrayBridgeModule();
+
+export const {
+  XRAY_MCP_SERVERS,
+  HERMES_CONFIG_PATH,
+  HERMES_PLUGIN_DIR,
+  OPENCLAW_CONFIG_PATH,
+  OPENCLAW_STATE_DIR,
+} = wiring;
+
+/** Repertoire consumer MCP surface (local dist when developing this repo). */
+export const REPERTOIRE_MCP = {
+  name: 'repertoire',
+  npxArgs: ['-y', '@0xray/repertoire', 'mcp'],
+  localArgs: ['node', 'dist/mcp/server.js'],
+};
+
+export function resolveXrayScript(filename) {
+  return xrayPathCandidates('scripts/node', filename).find((p) => existsSync(p)) ?? null;
+}
+
+export function readInstalledXrayVersion() {
+  const pkgPath = xrayPathCandidates('package.json').find((p) => existsSync(p));
+  if (!pkgPath) return 'unknown';
+  try {
+    const pkg = createRequire(import.meta.url)(pkgPath);
+    return pkg.version ?? 'unknown';
+  } catch {
+    return 'unknown';
+  }
+}
+
+/** Re-run native install when xray-consumer-root.txt points at wrong cwd (e.g. npx cache). */
+export function ensureConsumerRootMarker(markerPath, installCmd) {
+  const consumerRoot = resolveConsumerRoot();
+  let marked = '';
+  if (existsSync(markerPath)) {
+    marked = readFileSync(markerPath, 'utf8').trim();
+    if (marked === consumerRoot) return consumerRoot;
+  }
+  process.stdout.write(
+    `⚠  consumer root ${marked ? `drift (${marked})` : 'missing'} — running ${installCmd}\n`,
+  );
+  execSync(installCmd, { cwd: consumerRoot, stdio: 'inherit' });
+  return consumerRoot;
+}
+
+export function mcpStdioInitializeProbe({ cwd, command, args, env = {}, timeoutMs = 6000 }) {
+  return new Promise((resolveProbe, rejectProbe) => {
+    const init = JSON.stringify({
+      jsonrpc: '2.0',
+      id: 1,
+      method: 'initialize',
+      params: {
+        protocolVersion: '2024-11-05',
+        capabilities: {},
+        clientInfo: { name: 'suit-bridge-probe', version: '1.0' },
+      },
+    });
+
+    const proc = spawn(command, args, {
+      cwd,
+      env: { ...process.env, ...env },
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    let out = '';
+    const timer = setTimeout(() => {
+      proc.kill();
+      rejectProbe(new Error(`timeout after ${timeoutMs}ms`));
+    }, timeoutMs);
+
+    const finish = (ok) => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timer);
+      try {
+        proc.kill('SIGTERM');
+      } catch {
+        /* already exited */
+      }
+      if (ok) resolveProbe(out);
+      else rejectProbe(new Error(out.slice(0, 200) || 'no serverInfo in MCP response'));
+    };
+
+    let finished = false;
+
+    const onData = (chunk) => {
+      out += chunk.toString();
+      if (out.includes('serverInfo')) finish(true);
+    };
+
+    proc.stdout.on('data', onData);
+    proc.stderr.on('data', onData);
+
+    proc.on('close', () => {
+      if (!finished) finish(out.includes('serverInfo'));
+    });
+
+    proc.stdin.write(`${init}\n`);
+    proc.stdin.end();
+  });
+}

package/vendor/@0xray/repertoire/scripts/verify-grok-suit.mjs

@@ -0,0 +1,304 @@
+#!/usr/bin/env node
+/**
+ * Verify 0xRay suit is fully wearable in Grok Build for this repo.
+ * Run: npm run build && node scripts/verify-grok-suit.mjs
+ */
+import { execSync } from 'node:child_process';
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { mcpStdioInitializeProbe, resolveConsumerRoot } from './suit-bridge-shared.mjs';
+
+function resolveMemoryProviderPath(projectRoot) {
+  const local = join(projectRoot, 'dist/provider/memory-routing-provider.js');
+  if (existsSync(local)) return local;
+  const installed = join(
+    projectRoot,
+    'node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js',
+  );
+  if (existsSync(installed)) return installed;
+  return local;
+}
+
+const root = resolveConsumerRoot();
+let failed = 0;
+
+function pass(name, detail = '') {
+  console.log(`✅ ${name}${detail ? ` — ${detail}` : ''}`);
+}
+
+function fail(name, detail = '') {
+  failed++;
+  console.error(`❌ ${name}${detail ? ` — ${detail}` : ''}`);
+}
+
+function resolveLiveHook(name) {
+  const candidates = [
+    join(root, 'node_modules/0xray/dist/integrations/grok/hooks', name),
+    join(homedir(), 'dev/xray/dist/integrations/grok/hooks', name),
+  ];
+  return candidates.find((p) => existsSync(p)) || null;
+}
+
+function tailActivityLog(workspace, tailBytes = 32768) {
+  const logFile = join(workspace, 'logs', 'framework', 'activity.log');
+  if (!existsSync(logFile)) return '';
+  const stat = statSync(logFile);
+  const start = Math.max(0, stat.size - tailBytes);
+  const buf = readFileSync(logFile).subarray(start);
+  return buf.toString('utf8');
+}
+
+function runHook(hookPath, fixture, env = {}) {
+  const payload = JSON.stringify(fixture);
+  return execSync(`printf '%s' '${payload.replace(/'/g, "'\\''")}' | node "${hookPath}"`, {
+    encoding: 'utf8',
+    env: { ...process.env, GROK_WORKSPACE_ROOT: root, ...env },
+  });
+}
+
+// 1. .xray layout
+for (const f of ['codex.json', 'features.json', 'config.json']) {
+  const p = join(root, '.xray', f);
+  existsSync(p) ? pass(`.xray/${f}`) : fail(`.xray/${f}`, 'missing');
+}
+
+// 2. features.json contract
+try {
+  const features = JSON.parse(readFileSync(join(root, '.xray/features.json'), 'utf8'));
+  let installedXrayVersion = 'unknown';
+  try {
+    const xrayPkg = JSON.parse(
+      readFileSync(join(root, 'node_modules/0xray/package.json'), 'utf8'),
+    );
+    installedXrayVersion = xrayPkg.version ?? 'unknown';
+  } catch {
+    /* optional */
+  }
+  if (features.version === installedXrayVersion) {
+    pass('features.json version', installedXrayVersion);
+  } else {
+    fail('features.json version', `got ${features.version}, expected ${installedXrayVersion}`);
+  }
+  if (features.inference_governance?.enabled) pass('inference_governance');
+  else fail('inference_governance', 'not enabled');
+  if (features.memory_routing?.enabled) pass('memory_routing');
+  else fail('memory_routing', 'not enabled');
+  if (features.synthesis?.enabled) pass('synthesis.enabled');
+  else fail('synthesis.enabled', 'not enabled');
+} catch (e) {
+  fail('features.json parse', e.message);
+}
+
+// 3. Memory provider built (local dist or installed @0xray/repertoire)
+const provider = resolveMemoryProviderPath(root);
+existsSync(provider)
+  ? pass('memory-routing-provider.js')
+  : fail('memory-routing-provider.js', 'npm install @0xray/repertoire or npm run build');
+
+// 4. .mcp.json — 7 xray + repertoire
+try {
+  const mcp = JSON.parse(readFileSync(join(root, '.mcp.json'), 'utf8'));
+  const servers = Object.keys(mcp.mcpServers || {});
+  const xrayCount = servers.filter((s) => s.startsWith('xray-')).length;
+  if (xrayCount === 7) pass('.mcp.json xray servers', '7/7');
+  else fail('.mcp.json xray servers', `${xrayCount}/7`);
+  servers.includes('repertoire') ? pass('.mcp.json repertoire') : fail('.mcp.json repertoire', 'missing');
+  const mcpRaw = readFileSync(join(root, '.mcp.json'), 'utf8');
+  if (/\/Users\/[^"'\s]+/.test(mcpRaw)) {
+    fail('.mcp.json portable paths', 'absolute /Users/ path in committed .mcp.json');
+  } else {
+    pass('.mcp.json portable paths');
+  }
+} catch (e) {
+  fail('.mcp.json', e.message);
+}
+
+// 5. Grok plugin + UserPromptSubmit boot hook
+const grokPlugin = join(homedir(), '.grok/plugins/0xray');
+const grokHooks = join(grokPlugin, 'hooks/hooks.json');
+existsSync(grokPlugin) ? pass('Grok plugin', grokPlugin) : fail('Grok plugin', 'run: npx 0xray grok install --force');
+if (existsSync(grokHooks)) {
+  const hooksRaw = readFileSync(grokHooks, 'utf8');
+  hooksRaw.includes('session-start.js')
+    ? pass('SessionStart hook')
+    : fail('SessionStart hook', 're-run: npx 0xray grok install --force');
+  hooksRaw.includes('pre-tool-use.js')
+    ? pass('PreToolUse hook (live Grok path)')
+    : fail('PreToolUse hook', 'missing from hooks.json');
+  hooksRaw.includes('UserPromptSubmit')
+    ? pass('UserPromptSubmit boot hook')
+    : fail('UserPromptSubmit boot hook', 'add session-start.js — npx 0xray grok install --force');
+} else {
+  fail('Grok hooks.json', 'missing');
+}
+
+try {
+  const features = JSON.parse(readFileSync(join(root, '.xray/features.json'), 'utf8'));
+  if (features.multi_agent_orchestration?.lead_dev_mode) pass('lead_dev_mode in features.json');
+  else fail('lead_dev_mode', 'not enabled');
+  if (features.multi_agent_orchestration?.no_new_surface !== false) pass('no_new_surface in features.json');
+  else fail('no_new_surface', 'disabled');
+} catch (e) {
+  fail('lead_dev_mode', e.message);
+}
+
+try {
+  const codex = JSON.parse(readFileSync(join(root, '.xray/codex.json'), 'utf8'));
+  if (codex.terms?.['69']) pass('codex term 69 (no new surface)');
+  else fail('codex term 69', 'missing');
+} catch (e) {
+  fail('codex term 69', e.message);
+}
+
+// 6. 0xray package xray field (server-config-registry — no fallback)
+try {
+  const xrayPkg = JSON.parse(
+    readFileSync(join(root, 'node_modules/0xray/package.json'), 'utf8'),
+  );
+  if (xrayPkg.xray?.mcpServersPath || xrayPkg.xray?.dist) pass('0xray package.json xray field');
+  else fail('0xray package.json xray field', 'missing — npm link ~/dev/xray && rebuild');
+} catch (e) {
+  fail('0xray package.json xray field', e.message);
+}
+
+// 7. CLI health
+try {
+  execSync('npx 0xray health', { cwd: root, stdio: 'pipe', encoding: 'utf8' });
+  pass('npx 0xray health');
+} catch {
+  fail('npx 0xray health');
+}
+
+const preToolHook = resolveLiveHook('pre-tool-use.js');
+const sessionHook = resolveLiveHook('session-start.js');
+if (!preToolHook) fail('Live PreToolUse hook path', 'not found in node_modules/0xray');
+else pass('Live PreToolUse hook path', preToolHook);
+
+if (!sessionHook) fail('Live SessionStart hook path', 'not found');
+else pass('Live SessionStart hook path', sessionHook);
+
+// 8. SessionStart → session-boot.json + activity.log
+const bootPath = join(root, '.xray', 'state', 'session-boot.json');
+const activityBefore = tailActivityLog(root);
+if (sessionHook) {
+  try {
+    runHook(
+      sessionHook,
+      {
+        hookEventName: 'session_start',
+        sessionId: 'verify-suit-probe',
+        workspaceRoot: root,
+        cwd: root,
+      },
+      { GROK_HOOK_EVENT: 'session_start', GROK_SESSION_ID: 'verify-suit-probe' },
+    );
+    if (existsSync(bootPath)) {
+      const boot = JSON.parse(readFileSync(bootPath, 'utf8'));
+      if (boot.lead_dev_mode === true) pass('session-boot.json written', 'lead_dev_mode=true');
+      else fail('session-boot.json', 'lead_dev_mode not true');
+    } else {
+      fail('session-boot.json', 'missing after SessionStart hook');
+    }
+    const activityAfter = tailActivityLog(root);
+    if (/grok-session-start.*session-boot-written/.test(activityAfter)) {
+      pass('SessionStart logged to activity.log');
+    } else {
+      fail('SessionStart activity.log', 'no grok-session-start entry');
+    }
+  } catch (e) {
+    fail('SessionStart hook probe', e.message?.slice(0, 160));
+  }
+}
+
+// 9. PreToolUse deny + activity.log (same path Grok uses live)
+if (preToolHook) {
+  try {
+    const out = runHook(preToolHook, {
+      toolName: 'search_replace',
+      workspaceRoot: root,
+      toolInput: { path: 'src/mcps/new-thing.server.ts', new_string: 'export {}' },
+    });
+    if (/"decision"\s*:\s*"deny"/.test(out)) pass('PreToolUse deny (live hook path)');
+    else fail('PreToolUse deny', `got: ${out.slice(0, 120)}`);
+
+    const activity = tailActivityLog(root);
+    if (/grok-pre-tool-use.*deny/.test(activity)) {
+      pass('PreToolUse deny logged to activity.log');
+    } else {
+      fail('PreToolUse activity.log', 'no grok-pre-tool-use deny entry');
+    }
+  } catch (e) {
+    fail('PreToolUse hook probe', e.message?.slice(0, 160));
+  }
+}
+
+// 10. MCP enforcer stdio + no server-config-registry fallback (Node probe — no GNU timeout)
+const activityBeforeEnforcer = tailActivityLog(root);
+try {
+  await mcpStdioInitializeProbe({
+    cwd: root,
+    command: 'npx',
+    args: ['0xray', 'mcp', 'enforcer'],
+    timeoutMs: 6000,
+  });
+  pass('MCP enforcer stdio');
+
+  const activityNew = tailActivityLog(root).slice(activityBeforeEnforcer.length);
+  if (/using-fallback-path/.test(activityNew)) {
+    fail('server-config-registry', 'using-fallback-path in activity.log after enforcer boot');
+  } else {
+    pass('server-config-registry resolved (no fallback warning)');
+  }
+} catch (e) {
+  fail('MCP enforcer stdio', e.message?.slice(0, 120));
+}
+
+// 11. Orchestrator behavior assertions (0xray@3.4.10+)
+const behaviorScript = join(root, 'node_modules/0xray/scripts/mjs/verify-orchestrator-behavior.mjs');
+if (!existsSync(behaviorScript)) {
+  fail('Orchestrator behavior assertions', 'missing script — npm install 0xray@^3.4.10');
+} else {
+  try {
+    execSync(`node "${behaviorScript}"`, { cwd: root, stdio: 'pipe', encoding: 'utf8' });
+    pass('Orchestrator behavior assertions');
+  } catch (e) {
+    const detail = (e.stderr || e.stdout || e.message || '').toString().slice(0, 160);
+    fail('Orchestrator behavior assertions', detail);
+  }
+}
+
+// 12. Grok delegation + synthesis gate fixtures (0xray@3.5.0+)
+for (const [label, scriptName] of [
+  ['Grok delegation gate fixture', 'verify-grok-delegation-gate.mjs'],
+  ['Grok synthesis gate fixture', 'verify-grok-synthesis-gate.mjs'],
+]) {
+  const gateScript = join(root, 'node_modules/0xray/scripts/mjs', scriptName);
+  if (!existsSync(gateScript)) {
+    fail(label, 'missing script — npm install 0xray@main (3.5.0+)');
+  } else {
+    try {
+      execSync(`node "${gateScript}"`, { cwd: root, stdio: 'pipe', encoding: 'utf8' });
+      pass(label);
+    } catch (e) {
+      const detail = (e.stderr || e.stdout || e.message || '').toString().slice(0, 160);
+      fail(label, detail);
+    }
+  }
+}
+
+// 13. Installed Grok plugin PostToolUse hook (3.5.0 auto-chain)
+const installedGrokHooks = join(grokPlugin, 'hooks/hooks.json');
+if (existsSync(installedGrokHooks)) {
+  const installedRaw = readFileSync(installedGrokHooks, 'utf8');
+  if (installedRaw.includes('PostToolUse') && installedRaw.includes('post-tool-use.js')) {
+    pass('Grok plugin PostToolUse hook installed');
+  } else {
+    fail('Grok plugin PostToolUse hook', 'run: npx 0xray grok install --force');
+  }
+} else {
+  fail('Grok plugin PostToolUse hook', 'hooks.json missing — npx 0xray grok install --force');
+}
+
+console.log('\n' + (failed === 0 ? '🎉 Suit wearable — operate within 0xRay.' : `⚠️  ${failed} check(s) failed — fix before tuning.`));
+process.exit(failed === 0 ? 0 : 1);