0xray 4.0.0 → 4.0.2

package/.mcp.json

@@ -1,79 +1,39 @@
 {
   "mcpServers": {
     "xray-governance": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "0xray",
-        "mcp",
-        "governance"
-      ],
+      "command": "node",
+      "args": ["dist/cli/index.js", "mcp", "governance"],
       "env": {
         "XRAY_FORCE_MCP_GOVERNANCE": "true"
       }
     },
     "xray-skills": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "0xray",
-        "mcp",
-        "skills"
-      ]
+      "command": "node",
+      "args": ["dist/cli/index.js", "mcp", "skills"]
     },
     "xray-enforcer": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "0xray",
-        "mcp",
-        "enforcer"
-      ]
+      "command": "node",
+      "args": ["dist/cli/index.js", "mcp", "enforcer"]
     },
     "xray-orchestrator": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "0xray",
-        "mcp",
-        "orchestrator"
-      ]
+      "command": "node",
+      "args": ["dist/cli/index.js", "mcp", "orchestrator"]
     },
     "xray-researcher": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "0xray",
-        "mcp",
-        "researcher"
-      ]
+      "command": "node",
+      "args": ["dist/cli/index.js", "mcp", "researcher"]
     },
     "xray-code-review": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "0xray",
-        "mcp",
-        "code-review"
-      ]
+      "command": "node",
+      "args": ["dist/cli/index.js", "mcp", "code-review"]
     },
     "xray-architect-tools": {
-      "command": "npx",
-      "args": [
-        "-y",
-        "0xray",
-        "mcp",
-        "architect-tools"
-      ]
+      "command": "node",
+      "args": ["dist/cli/index.js", "mcp", "architect-tools"]
     },
     "repertoire": {
       "command": "node",
-      "args": [
-        "/tmp/xray-v4-validate/node_modules/@0xray/repertoire/dist/mcp/server.js"
-      ],
-      "env": {
-        "XRAY_ROOT": "/tmp/xray-v4-validate"
-      }
+      "args": ["scripts/mjs/run-repertoire-mcp.mjs"]
     }
   }
 }

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",
@@ -182,4 +182,4 @@
       "onChain": false
     }
   }
-}
+}

package/AGENTS-consumer.md

@@ -2,11 +2,11 @@
 
 <!-- 0xray-managed -->
 
-Quick reference for the 0xRay AI orchestration framework (shipped to your project on `npm install 0xray`).
+Quick reference for the 0xRay AI orchestration framework worn on **{{CONSUMER_NAME}}**{{CONSUMER_VERSION_PAREN}}.
 
-**v4.0.0** — a suit that survives the context window.
+**4.0** — a suit that survives the context window
 
-**v4.0.0** — same **three-subsystem OS** as v2 (Inference · External Governance · Autonomous Engine). Constitution always on. Temperament scales ceremony. Four platform bridges. Repertoire auto-enables when the module is present; otherwise `memory_routing` stays off. Trim fat, do not gut the design.
+Same **three-subsystem OS** as v2 (Inference · External Governance · Autonomous Engine). Constitution always on. Temperament scales ceremony. Four platform bridges. Repertoire organ ships **on** (vendored 0.2); opt out with `"enabled": false, "provider": "repertoire"`. Trim fat, do not gut the design.
 
 **Governance always on** (Codex PreToolUse, no new surface, no `eval`). **Engine ceremony** (analyze-complexity before spawn, confer) is **guided** by default so free-model OpenCode/Hermes stay in check. Frontier hosts (Grok 4.6 class) with `suit_temperament.profile: auto` **warn** on spawn-without-plan instead of deny — the engine is still there. Existing `.xray/features.json` without `suit_temperament` stays **guided**. Docs: v3 from v2 · Suit temperament.
 
@@ -19,9 +19,9 @@ Before other work, Read `.xray/state/STATION.md`. Compaction and host change are
 `npm install 0xray` runs `install-bridges.cjs` and:
 
 - Copies this file → **`AGENTS.md`** in your project root
-- Ships root **`SKILLS.md`** and syncs **45 skills** to platform skill directories
+- Syncs **45 mill skills** to platform skill directories, then overlays **your** `src/skills` (same name wins). Does **not** write root **`SKILLS.md`**
 - Seeds **`.gitignore`** (from template, if absent)
-- Deploys **`.xray/`** (`codex.json`, `features.json`, `config.json`)
+- Deploys **`.xray/`** (`codex.json`, `features.json`, `config.json`) then overlays **your** mill SSOT (`xray/codex.json`, `xray/features.json`, `src/skills`, `src/opencode/agents`; remap with `foundry.json`)
 - Writes **`.mcp.json`** with 7 MCPs servers (`npx -y 0xray mcp …`)
 - Installs bridges: **OpenCode**, **Grok**, **Hermes**, **OpenClaw**
 
@@ -63,7 +63,7 @@ Governance deliberation uses **code-review**, **security-audit** (via enforcer/s
 
 xray operates under the three-subsystem model: **Inference** + **External Governance** (Dynamo Solar SSOT) + **Autonomous Engine** (thinDispatch 7-flow in MCP orchestrator). All actions are validated against the Universal Development Codex before execution.
 
-**Codex**: `.xray/codex.json` — **68 terms** across all agent interactions.
+**Codex**: `.xray/codex.json` — **69 terms** across all agent interactions.
 
 ## thinDispatch Routing
 

package/AGENTS.md

@@ -1,8 +1,8 @@
 # xray Agents
 
-Quick reference for the xray AI orchestration framework (**v4.0.0**).
+Quick reference for the xray AI orchestration framework (**4.0**).
 
-**v4.0.0** — a suit that survives the context window.
+**4.0** — a suit that survives the context window.
 
 **Exo, not catalog.** Three-subsystem OS (Inference · External Governance · Autonomous Engine) · constitution always on · temperament by host · 4 floors · Repertoire when it resolves.
 
@@ -16,7 +16,7 @@ Before other work, Read `.xray/state/STATION.md`. Compaction and host change are
 
 xray provides intelligent multi-agent orchestration with automatic delegation and Codex compliance validation under the pure v2 three-subsystem model:
 
-- **Inference** — proposals, reflection, memory routing (optional)
+- **Inference** — proposals, reflection, memory routing (Repertoire organ on in 4.0)
 - **External Governance** — Dynamo Solar SSOT, 69-term Codex
 - **Autonomous Engine** — thinDispatch 7-flow, AsideContext, confidence gate
 
@@ -38,12 +38,12 @@ Registered in `.mcp.json`, invoked via `npx -y 0xray mcp <cmd>`:
 
 Governance deliberation: **code-review**, **security-audit**, **researcher** within the 7-server set.
 
-## Postinstall (v3.4.1)
+## Postinstall
 
 `postinstall.cjs` → `installAllBridges()`:
 
 1. `AGENTS-consumer.md` → `AGENTS.md`
-2. `SKILLS.md` + 46 skills → platform skill directories
+2. `SKILLS.md` + 45 skills → platform skill directories
 3. `.gitignore.default` → `.gitignore` (if absent)
 4. `.xray/` config (`codex.json`, `features.json`, `config.json`)
 5. `.mcp.json` (7 servers)
@@ -58,11 +58,11 @@ Governance deliberation: **code-review**, **security-audit**, **researcher** wit
 "memory_routing": {
   "enabled": true,
   "provider": "repertoire",
-  "module_path": "../repertoire/dist/provider/memory-routing-provider.js",
+  "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
   "config": {
-    "dataDir": "../repertoire/data",
-    "signalsPath": "../repertoire/data/curated_signals.json",
-    "logDir": "../repertoire/logs/groover-inference"
+    "signalsPath": "node_modules/@0xray/repertoire/data/curated_signals.json",
+    "statePath": ".xray/state/repertoire/inference-state.json",
+    "feedbackDir": ".xray/state/repertoire/feedback"
   }
 }
 ```

package/README.md

@@ -1,6 +1,8 @@
 # xray — exo for coding agents
 
-**v4.0.0** — a suit that survives the context window. Constitution always on. Temperament scales ceremony. Four host floors. Repertoire is the muscle for handoffs.
+**4.0** — a suit that survives the context window
+
+![0xRay v4 exo — CONSTITUTION ON](docs-site/static/img/exo-skeleton-v4.jpg)
 
 Not a catalog of agents. The product is the **skeleton you wear**.
 
@@ -48,7 +50,7 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 
 | Version | Highlights |
 |---------|------------|
-| **4.0.0** | Exo + temperament. Constitution always on; ceremony by host. Repertoire enable-when-resolves + session resume. Survive the context window — still in development, not on npm yet. [vision](docs-site/docs/architecture/v4-vision.md) · [now](docs-site/docs/architecture/v4-now.md) |
+| **4.0.0** | Exo + temperament. Constitution always on; ceremony by host. Repertoire organ on (vendored 0.2). Station card survives compact/host-swap. **On npm.** [vision](docs-site/docs/architecture/v4-vision.md) · [now](docs-site/docs/architecture/v4-now.md) |
 | **3.4.1** | Unified `install-bridges.cjs` on postinstall — OpenCode, Grok, Hermes, OpenClaw in one pass. All 7 MCPs servers via `npx -y 0xray mcp <cmd>` (no `dist/` paths). Canonical `release.mjs` pipeline. |
 | **3.3.1** | Orchestrator confidence gate wired into execution planning. |
 | **3.3.0** | Pluggable **Memory Routing** (`features.json` → `memory_routing`). Repertoire is the default provider in the framework repo. |
@@ -149,11 +151,11 @@ Pluggable `memory_routing` block in `features.json` (validated by `features.sche
 "memory_routing": {
   "enabled": true,
   "provider": "repertoire",
-  "module_path": "../repertoire/dist/provider/memory-routing-provider.js",
+  "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
   "config": {
-    "dataDir": "../repertoire/data",
-    "signalsPath": "../repertoire/data/curated_signals.json",
-    "logDir": "../repertoire/logs/groover-inference"
+    "signalsPath": "node_modules/@0xray/repertoire/data/curated_signals.json",
+    "statePath": ".xray/state/repertoire/inference-state.json",
+    "feedbackDir": ".xray/state/repertoire/feedback"
   }
 }
 ```
@@ -183,7 +185,7 @@ Docs: [memory routing](docs-site/docs/guides/memory-routing.md) · [Repertoire](
 
 ## Governance & Codex
 
-- **68 terms** in `.xray/codex.json` — core, architecture, testing, performance, security, operations, governance
+- **69 terms** in `.xray/codex.json` — core, architecture, testing, performance, security, operations, governance (Codex 69: no new MCP/skill/handler surface)
 - CodexPolicyService — Governance-owned SSOT for codex loading
 - Pre-governance gate blocks non-compliant proposals
 - Active codex snapshot via `get_active_codex` MCP tool
@@ -191,27 +193,25 @@ Docs: [memory routing](docs-site/docs/guides/memory-routing.md) · [Repertoire](
 
 ## Testing
 
-| Suite | Status (v3.4.1) |
+| Suite | Status (v4.0.1) |
 |-------|-----------------|
-| Unit / Integration | 185 files, **3,226 passed** |
-| OpenCode E2E | 42/42 solo, 34/34 orchestrator |
-| Grok CLI E2E | 62/0 failures (v3.2.0 verified) |
-| OpenClaw E2E | 9/9 (v3.2.0 verified) |
-| Hermes E2E | 44/0/0 (v3.2.0 verified) |
-| Consumer smoke | `npm run release:gate` — pack → clean install → 7 MCPs + 4 bridges |
+| Four-floor consumer e2e | OpenCode 34/0 · Grok 63/0 · Hermes 39/0/2 · OpenClaw 96/0/1 (npm 4.0.0 pack) |
+| Consumer smoke | `npm run release:gate` — pack → clean install → 7 MCPs + 4 bridges + organ on |
 
 ```bash
 npm test
-npm run release:gate    # full release gate
+npm run release:gate    # full release gate (before upload)
+npm run release:npm     # gate + prepare + npm publish --access public
 ```
 
 ## Release
 
+Product **4.0.0** is on npm. Do **not** run `release:major` to ship a 4.x fix (that becomes 5.0.0). Do **not** put a `scripts.publish` lifecycle that re-runs the gate after the registry PUT.
+
 ```bash
-npm run release:patch   # canonical pipeline
-npm run release:minor
-npm run release:major
-npm run release:patch -- --dry-run
+npm run release:gate
+npm run release:npm     # after gate is green; uses npm publish --access public
+npm run release:patch   # version bump pipeline (not for a already-bumped 4.0.0)
 ```
 
 Pipeline: reconcile-version → release-gate (build + test + consumer smoke) → CHANGELOG/README/AGENTS artifacts → commit → tag → npm publish.

package/SKILLS.md

@@ -1,6 +1,6 @@
 # 0xray Skills
 
-**v4.0.0** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
+**4.0** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
 
 xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) across the full software lifecycle. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`), agent `@mentions`, or platform skill directories after postinstall.
 
@@ -157,7 +157,7 @@ npx 0xray skill:install <source>
 |---------|------------------|
 | **Memory routing** (v3.3) | Researcher uses Repertoire signals; optional `@0xray/repertoire` MCP |
 | **AsideContext** (v3.2) | Orchestrator subcontexts during skill dispatch |
-| **7 MCP servers** (v3.4.1) | `xray-skills` is the primary skill invocation surface |
+| **7 MCP servers** (v4.0.1) | `xray-skills` is the primary skill invocation surface |
 
 Docs: [AGENTS.md](AGENTS.md) · [README.md](README.md) · [Docusaurus guides](docs-site/docs/guides/)
 

package/dist/AGENTS.md

@@ -1,8 +1,8 @@
 # xray Agents
 
-Quick reference for the xray AI orchestration framework (**v4.0.0**).
+Quick reference for the xray AI orchestration framework (**4.0**).
 
-**v4.0.0** — a suit that survives the context window.
+**4.0** — a suit that survives the context window.
 
 **Exo, not catalog.** Three-subsystem OS (Inference · External Governance · Autonomous Engine) · constitution always on · temperament by host · 4 floors · Repertoire when it resolves.
 
@@ -16,7 +16,7 @@ Before other work, Read `.xray/state/STATION.md`. Compaction and host change are
 
 xray provides intelligent multi-agent orchestration with automatic delegation and Codex compliance validation under the pure v2 three-subsystem model:
 
-- **Inference** — proposals, reflection, memory routing (optional)
+- **Inference** — proposals, reflection, memory routing (Repertoire organ on in 4.0)
 - **External Governance** — Dynamo Solar SSOT, 69-term Codex
 - **Autonomous Engine** — thinDispatch 7-flow, AsideContext, confidence gate
 
@@ -38,12 +38,12 @@ Registered in `.mcp.json`, invoked via `npx -y 0xray mcp <cmd>`:
 
 Governance deliberation: **code-review**, **security-audit**, **researcher** within the 7-server set.
 
-## Postinstall (v3.4.1)
+## Postinstall
 
 `postinstall.cjs` → `installAllBridges()`:
 
 1. `AGENTS-consumer.md` → `AGENTS.md`
-2. `SKILLS.md` + 46 skills → platform skill directories
+2. `SKILLS.md` + 45 skills → platform skill directories
 3. `.gitignore.default` → `.gitignore` (if absent)
 4. `.xray/` config (`codex.json`, `features.json`, `config.json`)
 5. `.mcp.json` (7 servers)
@@ -58,11 +58,11 @@ Governance deliberation: **code-review**, **security-audit**, **researcher** wit
 "memory_routing": {
   "enabled": true,
   "provider": "repertoire",
-  "module_path": "../repertoire/dist/provider/memory-routing-provider.js",
+  "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
   "config": {
-    "dataDir": "../repertoire/data",
-    "signalsPath": "../repertoire/data/curated_signals.json",
-    "logDir": "../repertoire/logs/groover-inference"
+    "signalsPath": "node_modules/@0xray/repertoire/data/curated_signals.json",
+    "statePath": ".xray/state/repertoire/inference-state.json",
+    "feedbackDir": ".xray/state/repertoire/feedback"
   }
 }
 ```

package/dist/CHANGELOG.md

@@ -4,9 +4,61 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Conventional Commits](https://www.conventionalcommits.org/).
 
-## [4.0.0] - 2026-08-28
+## [Unreleased]
 
-First ship of the **temperament** line on the **v2 three-subsystem OS** (Inference · External Governance · Autonomous Engine). npm is still `3.5.5`; this line is **4.0.0** on `feat/v4-temperament` — **still in development, not published**.
+### 🔧 Maintenance
+- Foundry mill: one bumper (`reconcile-version.mjs`); `version-manager.mjs` is `--artifacts-only` (JSON + CHANGELOG). Bump and `--tag` are refused.
+- Docs mill verifies era kernel headers (`4.0`) and skill counts; it does not rewrite markdown prose.
+- Exo cannot ship: `executeReleaseWorkflow` is blocked (`FOUNDRY_EXO_CANNOT_SHIP`).
+- Full `release-gate` now runs `validate-release-docs` (not only `--verify-only`).
+- `VersionComplianceProcessor` treats `package.json` as SSOT; UVM is frozen.
+- CI: version-compliance and AGENTS.md workflows target `main`; mill check is `validate-release-docs` (not UVM 1-ahead). `publish.yml` runs the docs mill before PUT.
+- Mill extracted to `scripts/foundry/` (`@0xray/foundry`). `release:npm` is `release.mjs --publish-only`. UVM file removed. Consumer mint writes `foundry-inventory.json` from their package.json.
+- Consumer postinstall overlays their mill SSOT onto the hanger: constitution (`xray/codex.json`), features/temperament, config, `src/skills/<name>/SKILL.md`, `src/opencode/agents/*.yml`. Remap with `foundry.json`. Overlay is **project** skill hangers. JSON mill-fill always merges. CLI re-wear mints once after mill copies. `npx @0xray/foundry mint` reapplies overlay.
+- `@0xray/foundry@0.1.0` mills `FOUNDRY_ROOT` or cwd. Full docs corpus only on the 0xray exo; light mill otherwise. Stamp creates CHANGELOG when missing. Publish refuses a nameless `package.json`. Mill PUT is `cd scripts/foundry && npm publish`; stranger `release` does not force `--access public`. Deprecated `sync-versions.mjs` and `release.js` wrappers removed.
+- Honesty: consumer card does not claim it writes root `SKILLS.md`; mill help is `npx @0xray/foundry`; shims mill cwd; mill-managed `AGENTS.md` overlays from `xray/AGENTS.md`. Mill-fill stays law.
+- Scar tissue cut: no `homeSkills`, no `codexMode`/`featuresMode`/`configMode`. JSON always merge. One `mintConsumerSuit` after mill copies (not inside `syncBuiltinSkills`).
+- Mill flesh: live `npx @0xray/foundry release` is opt-in (`--i-mean-it` / `FOUNDRY_RELEASE=1`). Packed mill mint and Unreleased stamp are executed tests. `@0xray/foundry` tree is 0.1.1 (not a 0xray bump).
+- Mill CI: `0xRay CI/CD` is the mill gate on `main` (typecheck, lint, mill tests, build, curated tests, smoke). Monitor reports Actions; it does not auto-push. `npx @0xray/foundry ci` / `hooks`. Mill package 0.1.2.
+- GitHub Pages: stop copying stale `docs-site/static/index.html` over the Docusaurus homepage (unprefixed `/docs` links 404ed). `npx @0xray/foundry docs-build` is the mill Docusaurus build. Mill 0.1.3.
+- Mill self-host: `0xRay CI/CD` lives in `mill-ci.yml` so GitHub registers push/PR after the inactivity disable. Mill CI always builds Docusaurus.
+- GitHub Pages homepage: no client `<Redirect to="/docs/…">` (that 404s at the org root). Meta refresh + `useBaseUrl('/docs/')`. `.nojekyll` in static.
+- Mill CI report: `mill-monitor.yml` (fresh workflow ID) listens for mill CI completion. Report only.
+- Published mill `hooks` uses the 0xray garment installer (`node_modules/0xray/scripts/hooks`), not `node_modules/@0xray/hooks`. Mill tree 0.1.4 (not a 0xray bump).
+- Nested mill in the 0xray tarball (`scripts/foundry/`). Wear no longer needs a second `npm i @0xray/foundry` for mint-on-install. 4.0.2.
+
+---
+
+## [4.0.2] - 2026-09-04
+
+Nested mill in the **0xray tarball**. `npm i 0xray` mill-fills via `scripts/foundry/` (postinstall + CLI re-wear `require` it). `@0xray/foundry` stays the standalone mill CLI (**0.1.4**). Not 5.0.0.
+
+Pack tests and consumer smoke require `scripts/foundry/mint-suit.cjs` in the tarball. Mill self-host (mill-ci, mill-monitor, Pages `docs-build`, mill-fill overlay) was already on main; this patch is the npm PUT of that mill next to the garment.
+
+### 🐛 Bug Fixes
+- Processor-test ESLint config is ESLint 9 ESM
+
+---
+
+## [4.0.1] - 2026-09-02
+
+Patch on the 4.0 temperament line. npm **4.0.0** stays latest until this tag publishes.
+
+### 🐛 Bug Fixes
+- CLI `-V` / `--version` no longer dumps a Commander stack after `exitOverride`
+- Hermes: post-processor logs `[nudge]`; e2e calls `session-start`
+- OpenClaw e2e reads `plugins.entries` (OpenClaw 2026.8.2)
+- Release gate: consumer smoke expects organ **on**; no `scripts.publish` after the registry PUT; reconcile allows tagged-but-unpublished
+
+### 📚 Documentation
+- Archive catalog / enterprise Docusaurus boiler; live site is exo wear
+- Version-manager stamps live Docusaurus kernel headers (no archived `docs-site/docs/README.md`)
+
+---
+
+## [4.0.0] - 2026-09-02
+
+First ship of the **temperament** line on the **v2 three-subsystem OS** (Inference · External Governance · Autonomous Engine). npm **4.0.0**. Tag `v4.0.0` on `0xRayAI/xray` `main` (`f80b42c`).
 
 ### ✨ Features
 - **Factory memory organ** — `@0xray/repertoire@0.2.0` vendored as a runtime dependency. Shipped `memory_routing` is **on** (8 factory primitives). Extra host MCP stays `repertoire`, not an 8th `xray-*` server. Compact ingest writes `.xray/state/repertoire/`. Explicit opt-out: `enabled: false` + `provider: "repertoire"`.

package/dist/README.md

@@ -1,6 +1,8 @@
 # xray — exo for coding agents
 
-**v4.0.0** — a suit that survives the context window. Constitution always on. Temperament scales ceremony. Four host floors. Repertoire is the muscle for handoffs.
+**4.0** — a suit that survives the context window
+
+![0xRay v4 exo — CONSTITUTION ON](docs-site/static/img/exo-skeleton-v4.jpg)
 
 Not a catalog of agents. The product is the **skeleton you wear**.
 
@@ -48,7 +50,7 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 
 | Version | Highlights |
 |---------|------------|
-| **4.0.0** | Exo + temperament. Constitution always on; ceremony by host. Repertoire enable-when-resolves + session resume. Survive the context window — still in development, not on npm yet. [vision](docs-site/docs/architecture/v4-vision.md) · [now](docs-site/docs/architecture/v4-now.md) |
+| **4.0.0** | Exo + temperament. Constitution always on; ceremony by host. Repertoire organ on (vendored 0.2). Station card survives compact/host-swap. **On npm.** [vision](docs-site/docs/architecture/v4-vision.md) · [now](docs-site/docs/architecture/v4-now.md) |
 | **3.4.1** | Unified `install-bridges.cjs` on postinstall — OpenCode, Grok, Hermes, OpenClaw in one pass. All 7 MCPs servers via `npx -y 0xray mcp <cmd>` (no `dist/` paths). Canonical `release.mjs` pipeline. |
 | **3.3.1** | Orchestrator confidence gate wired into execution planning. |
 | **3.3.0** | Pluggable **Memory Routing** (`features.json` → `memory_routing`). Repertoire is the default provider in the framework repo. |
@@ -149,11 +151,11 @@ Pluggable `memory_routing` block in `features.json` (validated by `features.sche
 "memory_routing": {
   "enabled": true,
   "provider": "repertoire",
-  "module_path": "../repertoire/dist/provider/memory-routing-provider.js",
+  "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
   "config": {
-    "dataDir": "../repertoire/data",
-    "signalsPath": "../repertoire/data/curated_signals.json",
-    "logDir": "../repertoire/logs/groover-inference"
+    "signalsPath": "node_modules/@0xray/repertoire/data/curated_signals.json",
+    "statePath": ".xray/state/repertoire/inference-state.json",
+    "feedbackDir": ".xray/state/repertoire/feedback"
   }
 }
 ```
@@ -183,7 +185,7 @@ Docs: [memory routing](docs-site/docs/guides/memory-routing.md) · [Repertoire](
 
 ## Governance & Codex
 
-- **68 terms** in `.xray/codex.json` — core, architecture, testing, performance, security, operations, governance
+- **69 terms** in `.xray/codex.json` — core, architecture, testing, performance, security, operations, governance (Codex 69: no new MCP/skill/handler surface)
 - CodexPolicyService — Governance-owned SSOT for codex loading
 - Pre-governance gate blocks non-compliant proposals
 - Active codex snapshot via `get_active_codex` MCP tool
@@ -191,27 +193,25 @@ Docs: [memory routing](docs-site/docs/guides/memory-routing.md) · [Repertoire](
 
 ## Testing
 
-| Suite | Status (v3.4.1) |
+| Suite | Status (v4.0.1) |
 |-------|-----------------|
-| Unit / Integration | 185 files, **3,226 passed** |
-| OpenCode E2E | 42/42 solo, 34/34 orchestrator |
-| Grok CLI E2E | 62/0 failures (v3.2.0 verified) |
-| OpenClaw E2E | 9/9 (v3.2.0 verified) |
-| Hermes E2E | 44/0/0 (v3.2.0 verified) |
-| Consumer smoke | `npm run release:gate` — pack → clean install → 7 MCPs + 4 bridges |
+| Four-floor consumer e2e | OpenCode 34/0 · Grok 63/0 · Hermes 39/0/2 · OpenClaw 96/0/1 (npm 4.0.0 pack) |
+| Consumer smoke | `npm run release:gate` — pack → clean install → 7 MCPs + 4 bridges + organ on |
 
 ```bash
 npm test
-npm run release:gate    # full release gate
+npm run release:gate    # full release gate (before upload)
+npm run release:npm     # gate + prepare + npm publish --access public
 ```
 
 ## Release
 
+Product **4.0.0** is on npm. Do **not** run `release:major` to ship a 4.x fix (that becomes 5.0.0). Do **not** put a `scripts.publish` lifecycle that re-runs the gate after the registry PUT.
+
 ```bash
-npm run release:patch   # canonical pipeline
-npm run release:minor
-npm run release:major
-npm run release:patch -- --dry-run
+npm run release:gate
+npm run release:npm     # after gate is green; uses npm publish --access public
+npm run release:patch   # version bump pipeline (not for a already-bumped 4.0.0)
 ```
 
 Pipeline: reconcile-version → release-gate (build + test + consumer smoke) → CHANGELOG/README/AGENTS artifacts → commit → tag → npm publish.

package/dist/SKILLS.md

@@ -1,6 +1,6 @@
 # 0xray Skills
 
-**v4.0.0** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
+**4.0** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
 
 xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) across the full software lifecycle. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`), agent `@mentions`, or platform skill directories after postinstall.
 
@@ -157,7 +157,7 @@ npx 0xray skill:install <source>
 |---------|------------------|
 | **Memory routing** (v3.3) | Researcher uses Repertoire signals; optional `@0xray/repertoire` MCP |
 | **AsideContext** (v3.2) | Orchestrator subcontexts during skill dispatch |
-| **7 MCP servers** (v3.4.1) | `xray-skills` is the primary skill invocation surface |
+| **7 MCP servers** (v4.0.1) | `xray-skills` is the primary skill invocation surface |
 
 Docs: [AGENTS.md](AGENTS.md) · [README.md](README.md) · [Docusaurus guides](docs-site/docs/guides/)
 

package/dist/cli/commands/foundry-mint-wear.d.ts

@@ -0,0 +1,2 @@
+/** Re-apply mill overlay after CLI re-wear copies mill skills. */
+export declare function mintAfterWear(targetDir: string): void;

package/dist/cli/commands/foundry-mint-wear.js

@@ -0,0 +1,14 @@
+import path from "path";
+import { createRequire } from "module";
+import { fileURLToPath } from "url";
+import { frameworkLogger } from "../../core/framework-logger.js";
+const require = createRequire(import.meta.url);
+const packageRoot = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
+/** Re-apply mill overlay after CLI re-wear copies mill skills. */
+export function mintAfterWear(targetDir) {
+    const { mintConsumerSuit } = require(path.join(packageRoot, "scripts/foundry/mint-suit.cjs"));
+    mintConsumerSuit(packageRoot, targetDir, (component, action, status, details) => {
+        const level = status === "error" ? "error" : "info";
+        frameworkLogger.log(component, action, level, details);
+    });
+}

package/dist/cli/commands/hermes-install.js

@@ -4,6 +4,7 @@ import { homedir } from 'os';
 import { createRequire } from 'module';
 import { frameworkLogger } from '../../core/framework-logger.js';
 import { syncBuiltinSkills } from './skill-install.js';
+import { mintAfterWear } from './foundry-mint-wear.js';
 const __dirname = path.dirname(new URL(import.meta.url).pathname);
 const require = createRequire(import.meta.url);
 const packageRoot = path.join(__dirname, '..', '..', '..');
@@ -68,6 +69,7 @@ async function installForHermes(options = {}) {
             frameworkLogger.log('hermes-integration', 'hooks-copied', 'info', {});
         }
         const wired = wiring.wireHermesBridge(targetDir);
+        mintAfterWear(targetDir);
         console.log(`\x1b[32m✓ Wired Hermes mcp_servers (${wired.count} servers)\x1b[0m`);
         console.log(`\x1b[32m✓ Consumer root → ${targetDir}\x1b[0m`);
         const afterInstallPath = path.join(targetPluginDir, 'after-install.md');

package/dist/cli/commands/openclaw-install.js

@@ -4,6 +4,7 @@ import { homedir } from 'os';
 import { createRequire } from 'module';
 import { frameworkLogger } from '../../core/framework-logger.js';
 import { syncBuiltinSkills } from './skill-install.js';
+import { mintAfterWear } from './foundry-mint-wear.js';
 import { OpenClawConfigLoader } from '../../integrations/openclaw/config.js';
 import { writeSuitSessionBoot } from '../../nucleus/suit-temperament.js';
 const __dirname = path.dirname(new URL(import.meta.url).pathname);
@@ -45,6 +46,7 @@ async function installForOpenClaw(options = {}) {
             console.log(`\x1b[32m✓ Synced ${skillsCopied} builtin skills to ~/.openclaw/skills/\x1b[0m`);
         }
         frameworkLogger.log('openclaw-integration', 'skills-synced', 'info', { count: skillsCopied });
+        mintAfterWear(targetDir);
         const wired = wiring.wireOpenClawBridge(targetDir);
         console.log(`\x1b[32m✓ Wired OpenClaw MCP servers (${wired.count} via ${wired.method}) → ${wired.path}\x1b[0m`);
         console.log(`\x1b[32m✓ Consumer root → ${targetDir}\x1b[0m`);

package/dist/cli/commands/opencode-install.js

@@ -3,6 +3,7 @@ import path from 'path';
 import { createRequire } from 'module';
 import { frameworkLogger } from '../../core/framework-logger.js';
 import { syncBuiltinSkills } from './skill-install.js';
+import { mintAfterWear } from './foundry-mint-wear.js';
 const __dirname = path.dirname(new URL(import.meta.url).pathname);
 const require = createRequire(import.meta.url);
 const wiring = require(path.join(__dirname, '..', '..', '..', 'scripts', 'node', 'bridge-mcp-wiring.cjs'));
@@ -133,6 +134,7 @@ async function installForOpencode(options = {}) {
             console.log(`\x1b[32m✓ Seeded opencode.json from 0xRay template\x1b[0m`);
         }
         const mcpCount = wiring.wireOpencodeBridge(process.cwd());
+        mintAfterWear(process.cwd());
         console.log(`\x1b[32m✓ Wired opencode.json mcp (${mcpCount} servers)\x1b[0m`);
         console.log('\n✅ 0xRay OpenCode plugin installed!');
         console.log('Restart OpenCode or run `opencode mcp list` to verify MCP servers.');

package/dist/cli/index.js

@@ -984,4 +984,13 @@ For more information, visit: https://github.com/0xRayAI/xray
 `);
 // Parse command line arguments
 program.exitOverride();
-program.parse();
+try {
+    program.parse();
+}
+catch (err) {
+    const code = err && typeof err === 'object' && 'code' in err ? String(err.code) : '';
+    if (code === 'commander.helpDisplayed' || code === 'commander.help' || code === 'commander.version') {
+        process.exit(0);
+    }
+    throw err;
+}

package/dist/enforcement/enforcer-tools.d.ts

@@ -18,6 +18,13 @@ export declare function preProcessAndRoute(operation: string, context: RuleValid
     enhancedContext: RuleValidationContext;
     routing: RoutingRecommendation;
 }>;
+/** Foundry mill ships. The worn exo must not bump, commit, or publish. */
+export declare const FOUNDRY_EXO_CANNOT_SHIP = "Exo cannot ship. Use: node scripts/node/release.mjs [patch|minor|major]";
+/**
+ * Release keyword used to run version-manager + git add -A + npm publish from the exo.
+ * That path is refused. Canonical mill: reconcile → artifacts-only → gate → PUT → tag.
+ */
+export declare function executeReleaseWorkflow(operation: string, _context: RuleValidationContext, jobId: string, _routing: RoutingRecommendation): Promise<EnforcementResult>;
 export interface EnforcementResult {
     operation: string;
     passed: boolean;