0xray 4.0.1 → 4.0.2

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/AGENTS-consumer.md

@@ -2,9 +2,9 @@
 
 <!-- 0xray-managed -->
 
-Quick reference for the 0xRay AI orchestration framework (shipped to your project on `npm install 0xray`).
+Quick reference for the 0xRay AI orchestration framework worn on **{{CONSUMER_NAME}}**{{CONSUMER_VERSION_PAREN}}.
 
-**v4.0.1** — a suit that survives the context window
+**4.0** — a suit that survives the context window
 
 Same **three-subsystem OS** as v2 (Inference · External Governance · Autonomous Engine). Constitution always on. Temperament scales ceremony. Four platform bridges. Repertoire organ ships **on** (vendored 0.2); opt out with `"enabled": false, "provider": "repertoire"`. Trim fat, do not gut the design.
 
@@ -19,9 +19,9 @@ Before other work, Read `.xray/state/STATION.md`. Compaction and host change are
 `npm install 0xray` runs `install-bridges.cjs` and:
 
 - Copies this file → **`AGENTS.md`** in your project root
-- Ships root **`SKILLS.md`** and syncs **45 skills** to platform skill directories
+- Syncs **45 mill skills** to platform skill directories, then overlays **your** `src/skills` (same name wins). Does **not** write root **`SKILLS.md`**
 - Seeds **`.gitignore`** (from template, if absent)
-- Deploys **`.xray/`** (`codex.json`, `features.json`, `config.json`)
+- Deploys **`.xray/`** (`codex.json`, `features.json`, `config.json`) then overlays **your** mill SSOT (`xray/codex.json`, `xray/features.json`, `src/skills`, `src/opencode/agents`; remap with `foundry.json`)
 - Writes **`.mcp.json`** with 7 MCPs servers (`npx -y 0xray mcp …`)
 - Installs bridges: **OpenCode**, **Grok**, **Hermes**, **OpenClaw**
 

package/AGENTS.md

@@ -1,8 +1,8 @@
 # xray Agents
 
-Quick reference for the xray AI orchestration framework (**v4.0.1**).
+Quick reference for the xray AI orchestration framework (**4.0**).
 
-**v4.0.1** — a suit that survives the context window.
+**4.0** — a suit that survives the context window.
 
 **Exo, not catalog.** Three-subsystem OS (Inference · External Governance · Autonomous Engine) · constitution always on · temperament by host · 4 floors · Repertoire when it resolves.
 
@@ -38,7 +38,7 @@ Registered in `.mcp.json`, invoked via `npx -y 0xray mcp <cmd>`:
 
 Governance deliberation: **code-review**, **security-audit**, **researcher** within the 7-server set.
 
-## Postinstall (v4.0.1)
+## Postinstall
 
 `postinstall.cjs` → `installAllBridges()`:
 

package/README.md

@@ -1,6 +1,6 @@
 # xray — exo for coding agents
 
-**v4.0.1** — a suit that survives the context window
+**4.0** — a suit that survives the context window
 
 ![0xRay v4 exo — CONSTITUTION ON](docs-site/static/img/exo-skeleton-v4.jpg)
 

package/SKILLS.md

@@ -1,6 +1,6 @@
 # 0xray Skills
 
-**v4.0.1** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
+**4.0** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
 
 xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) across the full software lifecycle. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`), agent `@mentions`, or platform skill directories after postinstall.
 

package/dist/AGENTS.md

@@ -1,8 +1,8 @@
 # xray Agents
 
-Quick reference for the xray AI orchestration framework (**v4.0.1**).
+Quick reference for the xray AI orchestration framework (**4.0**).
 
-**v4.0.1** — a suit that survives the context window.
+**4.0** — a suit that survives the context window.
 
 **Exo, not catalog.** Three-subsystem OS (Inference · External Governance · Autonomous Engine) · constitution always on · temperament by host · 4 floors · Repertoire when it resolves.
 
@@ -38,7 +38,7 @@ Registered in `.mcp.json`, invoked via `npx -y 0xray mcp <cmd>`:
 
 Governance deliberation: **code-review**, **security-audit**, **researcher** within the 7-server set.
 
-## Postinstall (v4.0.1)
+## Postinstall
 
 `postinstall.cjs` → `installAllBridges()`:
 

package/dist/CHANGELOG.md

@@ -4,6 +4,42 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Conventional Commits](https://www.conventionalcommits.org/).
 
+## [Unreleased]
+
+### 🔧 Maintenance
+- Foundry mill: one bumper (`reconcile-version.mjs`); `version-manager.mjs` is `--artifacts-only` (JSON + CHANGELOG). Bump and `--tag` are refused.
+- Docs mill verifies era kernel headers (`4.0`) and skill counts; it does not rewrite markdown prose.
+- Exo cannot ship: `executeReleaseWorkflow` is blocked (`FOUNDRY_EXO_CANNOT_SHIP`).
+- Full `release-gate` now runs `validate-release-docs` (not only `--verify-only`).
+- `VersionComplianceProcessor` treats `package.json` as SSOT; UVM is frozen.
+- CI: version-compliance and AGENTS.md workflows target `main`; mill check is `validate-release-docs` (not UVM 1-ahead). `publish.yml` runs the docs mill before PUT.
+- Mill extracted to `scripts/foundry/` (`@0xray/foundry`). `release:npm` is `release.mjs --publish-only`. UVM file removed. Consumer mint writes `foundry-inventory.json` from their package.json.
+- Consumer postinstall overlays their mill SSOT onto the hanger: constitution (`xray/codex.json`), features/temperament, config, `src/skills/<name>/SKILL.md`, `src/opencode/agents/*.yml`. Remap with `foundry.json`. Overlay is **project** skill hangers. JSON mill-fill always merges. CLI re-wear mints once after mill copies. `npx @0xray/foundry mint` reapplies overlay.
+- `@0xray/foundry@0.1.0` mills `FOUNDRY_ROOT` or cwd. Full docs corpus only on the 0xray exo; light mill otherwise. Stamp creates CHANGELOG when missing. Publish refuses a nameless `package.json`. Mill PUT is `cd scripts/foundry && npm publish`; stranger `release` does not force `--access public`. Deprecated `sync-versions.mjs` and `release.js` wrappers removed.
+- Honesty: consumer card does not claim it writes root `SKILLS.md`; mill help is `npx @0xray/foundry`; shims mill cwd; mill-managed `AGENTS.md` overlays from `xray/AGENTS.md`. Mill-fill stays law.
+- Scar tissue cut: no `homeSkills`, no `codexMode`/`featuresMode`/`configMode`. JSON always merge. One `mintConsumerSuit` after mill copies (not inside `syncBuiltinSkills`).
+- Mill flesh: live `npx @0xray/foundry release` is opt-in (`--i-mean-it` / `FOUNDRY_RELEASE=1`). Packed mill mint and Unreleased stamp are executed tests. `@0xray/foundry` tree is 0.1.1 (not a 0xray bump).
+- Mill CI: `0xRay CI/CD` is the mill gate on `main` (typecheck, lint, mill tests, build, curated tests, smoke). Monitor reports Actions; it does not auto-push. `npx @0xray/foundry ci` / `hooks`. Mill package 0.1.2.
+- GitHub Pages: stop copying stale `docs-site/static/index.html` over the Docusaurus homepage (unprefixed `/docs` links 404ed). `npx @0xray/foundry docs-build` is the mill Docusaurus build. Mill 0.1.3.
+- Mill self-host: `0xRay CI/CD` lives in `mill-ci.yml` so GitHub registers push/PR after the inactivity disable. Mill CI always builds Docusaurus.
+- GitHub Pages homepage: no client `<Redirect to="/docs/…">` (that 404s at the org root). Meta refresh + `useBaseUrl('/docs/')`. `.nojekyll` in static.
+- Mill CI report: `mill-monitor.yml` (fresh workflow ID) listens for mill CI completion. Report only.
+- Published mill `hooks` uses the 0xray garment installer (`node_modules/0xray/scripts/hooks`), not `node_modules/@0xray/hooks`. Mill tree 0.1.4 (not a 0xray bump).
+- Nested mill in the 0xray tarball (`scripts/foundry/`). Wear no longer needs a second `npm i @0xray/foundry` for mint-on-install. 4.0.2.
+
+---
+
+## [4.0.2] - 2026-09-04
+
+Nested mill in the **0xray tarball**. `npm i 0xray` mill-fills via `scripts/foundry/` (postinstall + CLI re-wear `require` it). `@0xray/foundry` stays the standalone mill CLI (**0.1.4**). Not 5.0.0.
+
+Pack tests and consumer smoke require `scripts/foundry/mint-suit.cjs` in the tarball. Mill self-host (mill-ci, mill-monitor, Pages `docs-build`, mill-fill overlay) was already on main; this patch is the npm PUT of that mill next to the garment.
+
+### 🐛 Bug Fixes
+- Processor-test ESLint config is ESLint 9 ESM
+
+---
+
 ## [4.0.1] - 2026-09-02
 
 Patch on the 4.0 temperament line. npm **4.0.0** stays latest until this tag publishes.

package/dist/README.md

@@ -1,6 +1,6 @@
 # xray — exo for coding agents
 
-**v4.0.1** — a suit that survives the context window
+**4.0** — a suit that survives the context window
 
 ![0xRay v4 exo — CONSTITUTION ON](docs-site/static/img/exo-skeleton-v4.jpg)
 

package/dist/SKILLS.md

@@ -1,6 +1,6 @@
 # 0xray Skills
 
-**v4.0.1** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
+**4.0** — **45 skills** · invoked via `xray-skills` MCP · synced on postinstall
 
 xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) across the full software lifecycle. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`), agent `@mentions`, or platform skill directories after postinstall.
 

package/dist/cli/commands/foundry-mint-wear.d.ts

@@ -0,0 +1,2 @@
+/** Re-apply mill overlay after CLI re-wear copies mill skills. */
+export declare function mintAfterWear(targetDir: string): void;

package/dist/cli/commands/foundry-mint-wear.js

@@ -0,0 +1,14 @@
+import path from "path";
+import { createRequire } from "module";
+import { fileURLToPath } from "url";
+import { frameworkLogger } from "../../core/framework-logger.js";
+const require = createRequire(import.meta.url);
+const packageRoot = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
+/** Re-apply mill overlay after CLI re-wear copies mill skills. */
+export function mintAfterWear(targetDir) {
+    const { mintConsumerSuit } = require(path.join(packageRoot, "scripts/foundry/mint-suit.cjs"));
+    mintConsumerSuit(packageRoot, targetDir, (component, action, status, details) => {
+        const level = status === "error" ? "error" : "info";
+        frameworkLogger.log(component, action, level, details);
+    });
+}

package/dist/cli/commands/hermes-install.js

@@ -4,6 +4,7 @@ import { homedir } from 'os';
 import { createRequire } from 'module';
 import { frameworkLogger } from '../../core/framework-logger.js';
 import { syncBuiltinSkills } from './skill-install.js';
+import { mintAfterWear } from './foundry-mint-wear.js';
 const __dirname = path.dirname(new URL(import.meta.url).pathname);
 const require = createRequire(import.meta.url);
 const packageRoot = path.join(__dirname, '..', '..', '..');
@@ -68,6 +69,7 @@ async function installForHermes(options = {}) {
             frameworkLogger.log('hermes-integration', 'hooks-copied', 'info', {});
         }
         const wired = wiring.wireHermesBridge(targetDir);
+        mintAfterWear(targetDir);
         console.log(`\x1b[32m✓ Wired Hermes mcp_servers (${wired.count} servers)\x1b[0m`);
         console.log(`\x1b[32m✓ Consumer root → ${targetDir}\x1b[0m`);
         const afterInstallPath = path.join(targetPluginDir, 'after-install.md');

package/dist/cli/commands/openclaw-install.js

@@ -4,6 +4,7 @@ import { homedir } from 'os';
 import { createRequire } from 'module';
 import { frameworkLogger } from '../../core/framework-logger.js';
 import { syncBuiltinSkills } from './skill-install.js';
+import { mintAfterWear } from './foundry-mint-wear.js';
 import { OpenClawConfigLoader } from '../../integrations/openclaw/config.js';
 import { writeSuitSessionBoot } from '../../nucleus/suit-temperament.js';
 const __dirname = path.dirname(new URL(import.meta.url).pathname);
@@ -45,6 +46,7 @@ async function installForOpenClaw(options = {}) {
             console.log(`\x1b[32m✓ Synced ${skillsCopied} builtin skills to ~/.openclaw/skills/\x1b[0m`);
         }
         frameworkLogger.log('openclaw-integration', 'skills-synced', 'info', { count: skillsCopied });
+        mintAfterWear(targetDir);
         const wired = wiring.wireOpenClawBridge(targetDir);
         console.log(`\x1b[32m✓ Wired OpenClaw MCP servers (${wired.count} via ${wired.method}) → ${wired.path}\x1b[0m`);
         console.log(`\x1b[32m✓ Consumer root → ${targetDir}\x1b[0m`);

package/dist/cli/commands/opencode-install.js

@@ -3,6 +3,7 @@ import path from 'path';
 import { createRequire } from 'module';
 import { frameworkLogger } from '../../core/framework-logger.js';
 import { syncBuiltinSkills } from './skill-install.js';
+import { mintAfterWear } from './foundry-mint-wear.js';
 const __dirname = path.dirname(new URL(import.meta.url).pathname);
 const require = createRequire(import.meta.url);
 const wiring = require(path.join(__dirname, '..', '..', '..', 'scripts', 'node', 'bridge-mcp-wiring.cjs'));
@@ -133,6 +134,7 @@ async function installForOpencode(options = {}) {
             console.log(`\x1b[32m✓ Seeded opencode.json from 0xRay template\x1b[0m`);
         }
         const mcpCount = wiring.wireOpencodeBridge(process.cwd());
+        mintAfterWear(process.cwd());
         console.log(`\x1b[32m✓ Wired opencode.json mcp (${mcpCount} servers)\x1b[0m`);
         console.log('\n✅ 0xRay OpenCode plugin installed!');
         console.log('Restart OpenCode or run `opencode mcp list` to verify MCP servers.');

package/dist/enforcement/enforcer-tools.d.ts

@@ -18,6 +18,13 @@ export declare function preProcessAndRoute(operation: string, context: RuleValid
     enhancedContext: RuleValidationContext;
     routing: RoutingRecommendation;
 }>;
+/** Foundry mill ships. The worn exo must not bump, commit, or publish. */
+export declare const FOUNDRY_EXO_CANNOT_SHIP = "Exo cannot ship. Use: node scripts/node/release.mjs [patch|minor|major]";
+/**
+ * Release keyword used to run version-manager + git add -A + npm publish from the exo.
+ * That path is refused. Canonical mill: reconcile → artifacts-only → gate → PUT → tag.
+ */
+export declare function executeReleaseWorkflow(operation: string, _context: RuleValidationContext, jobId: string, _routing: RoutingRecommendation): Promise<EnforcementResult>;
 export interface EnforcementResult {
     operation: string;
     passed: boolean;

package/dist/enforcement/enforcer-tools.js

@@ -199,121 +199,31 @@ function buildTaskDescription(operation, context) {
     }
     return parts.join(" ");
 }
+/** Foundry mill ships. The worn exo must not bump, commit, or publish. */
+export const FOUNDRY_EXO_CANNOT_SHIP = "Exo cannot ship. Use: node scripts/node/release.mjs [patch|minor|major]";
 /**
- * Execute the full release workflow
- * Triggered when user says: release, npm publish, publish to npm, bump and publish, ship it
+ * Release keyword used to run version-manager + git add -A + npm publish from the exo.
+ * That path is refused. Canonical mill: reconcile → artifacts-only → gate → PUT → tag.
  */
-async function executeReleaseWorkflow(operation, context, jobId, routing) {
-    const { execSync } = await import('child_process');
-    // Extract release options from routing context
-    const releaseContext = routing.context || {};
-    const bumpType = releaseContext.bumpType || 'patch';
-    const createTag = releaseContext.createTag || false;
-    await frameworkLogger.log("enforcer-tools", "release-workflow-starting", "info", { jobId, bumpType, createTag });
-    const steps = [];
-    const errors = [];
-    // HARD STOP: Build must pass before release
-    await frameworkLogger.log("enforcer-tools", "release-build-check", "info", { step: "Verifying build passes..." });
-    try {
-        execSync(`npm run build`, {
-            cwd: process.cwd(),
-            stdio: 'pipe'
-        });
-        steps.push("✅ Build verified");
-    }
-    catch (e) {
-        const errorMsg = `🛑 RELEASE STOPPED: Build failed before publishing. Fix build errors first.`;
-        frameworkLogger.log("enforcer-tools", "release-blocked", "error", {
-            message: errorMsg,
-        });
-        frameworkLogger.log("enforcer-tools", "release-build-error", "error", {
-            message: `Error: ${e}`,
-            error: e,
-        });
-        return {
-            operation: "release",
-            passed: false,
-            blocked: true,
-            errors: [errorMsg, `Build error: ${e}`],
-            warnings: [],
-            fixes: [],
-            report: {
-                passed: false,
-                operation: "release",
-                errors: [errorMsg, `Build error: ${e}`],
-                warnings: [],
-                results: [],
-                timestamp: new Date(),
-            },
-        };
-    }
-    try {
-        // Step 1: Run version-manager to bump version and generate changelog
-        await frameworkLogger.log("enforcer-tools", "release-step-1-version", "info", { step: "Bumping version..." });
-        try {
-            const versionArg = createTag ? '--tag' : '';
-            execSync(`node scripts/node/version-manager.mjs ${bumpType} ${versionArg}`, {
-                cwd: process.cwd(),
-                stdio: 'inherit'
-            });
-            steps.push("✅ Version bumped + changelog generated");
-        }
-        catch (e) {
-            errors.push(`Version bump failed: ${e}`);
-        }
-        // Step 2: Git commit and push
-        await frameworkLogger.log("enforcer-tools", "release-step-2-git", "info", { step: "Committing and pushing..." });
-        try {
-            execSync(`git add -A && git commit -m "release: v${bumpType} - Changelog updated" && git push`, {
-                cwd: process.cwd(),
-                stdio: 'inherit'
-            });
-            steps.push("✅ Git commit + push");
-        }
-        catch (e) {
-            errors.push(`Git commit/push failed: ${e}`);
-        }
-        // Step 3: npm publish
-        await frameworkLogger.log("enforcer-tools", "release-step-3-npm", "info", { step: "Publishing to npm..." });
-        try {
-            execSync(`npm publish`, {
-                cwd: process.cwd(),
-                stdio: 'inherit'
-            });
-            steps.push("✅ npm published");
-        }
-        catch (e) {
-            errors.push(`npm publish failed: ${e}`);
-        }
-        // Step 4: Generate tweet context
-        await frameworkLogger.log("enforcer-tools", "release-step-4-tweet", "info", { step: "Generating tweet..." });
-        try {
-            execSync(`node scripts/node/release-tweet.mjs`, {
-                cwd: process.cwd(),
-                stdio: 'inherit'
-            });
-            steps.push("✅ Tweet context generated - ready for @growth-strategist");
-        }
-        catch (e) {
-            errors.push(`Tweet generation failed: ${e}`);
-        }
-    }
-    catch (e) {
-        errors.push(`Release workflow failed: ${e}`);
-    }
+export async function executeReleaseWorkflow(operation, _context, jobId, _routing) {
+    await frameworkLogger.log("enforcer-tools", "release-workflow-refused", "error", {
+        jobId,
+        operation,
+        reason: "foundry-exo-cannot-ship",
+    });
     return {
         operation: "release",
-        passed: errors.length === 0,
-        blocked: false,
-        errors,
+        passed: false,
+        blocked: true,
+        errors: [FOUNDRY_EXO_CANNOT_SHIP],
         warnings: [],
         fixes: [],
         report: {
-            passed: errors.length === 0,
+            passed: false,
             operation: "release",
-            errors,
-            warnings: steps,
-            results: steps.map(s => ({ rule: 'release', passed: true, message: s })),
+            errors: [FOUNDRY_EXO_CANNOT_SHIP],
+            warnings: [],
+            results: [],
             timestamp: new Date(),
         },
     };
@@ -457,8 +367,7 @@ export async function ruleValidation(operation, context) {
         await frameworkLogger.log("enforcer-tools", "release-workflow-triggered", "info", {
             jobId,
             operation,
-            bumpType: routing.context?.bumpType || 'patch',
-            createTag: routing.context?.createTag || false,
+            reason: "foundry-exo-cannot-ship",
         });
         // Execute the release workflow
         return await executeReleaseWorkflow(operation, context, jobId, routing);

package/dist/integrations/grok/grok-cli.js

@@ -20,6 +20,7 @@ import path from 'path';
 import { execSync } from 'child_process';
 import { createRequire } from 'module';
 import { syncBuiltinSkills } from '../../cli/commands/skill-install.js';
+import { mintAfterWear } from '../../cli/commands/foundry-mint-wear.js';
 // ESM-compatible __dirname (this file is compiled to ESM)
 const __dirname = path.dirname(new URL(import.meta.url).pathname);
 const packageRoot = path.resolve(__dirname, '..', '..', '..');
@@ -101,6 +102,7 @@ export async function installForGrokCLI(options = {}) {
             wearGrokHookCommands(projectPluginDir, packageRoot, targetDir);
         }
         writeProjectRepertoireMcp(targetDir);
+        mintAfterWear(targetDir);
         // Attempt auto-trust (best effort)
         try {
             execSync(`grok plugins trust "${targetPluginDir}"`, { stdio: 'ignore' });

package/dist/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.1",
+  "version": "4.0.2",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/dist/processors/implementations/version-compliance-processor.d.ts

@@ -5,10 +5,9 @@
  * commits or publishes. Integrates with 0xRay's processor pipeline.
  *
  * Rules Enforced:
- * 1. Universal Version Manager MUST be 1 ahead of NPM published version
- * 2. package.json SHOULD match UVM (warning if not)
- * 3. Source files MUST be synchronized to UVM version
- * 4. README SHOULD reference current version
+ * 1. package.json version is the SSOT (semver)
+ * 2. Mill SSOT is package.json via scripts/foundry/reconcile-version.mjs
+ * 3. Do not bump or publish from this processor (foundry mill ships)
  *
  * @processor_type pre
  * @priority 25 (high - runs early, after preValidate, before errorBoundary)
@@ -31,12 +30,6 @@ export interface VersionFix {
     command: string;
     autoFixable: boolean;
 }
-export interface VersionInfo {
-    major: number;
-    minor: number;
-    patch: number;
-    raw: string;
-}
 export declare class VersionComplianceProcessor {
     private projectRoot;
     private errors;
@@ -67,34 +60,10 @@ export declare class VersionComplianceProcessor {
      * Get NPM published version
      */
     private getNpmVersion;
-    /**
-     * Get Universal Version Manager version
-     */
-    private getUvmVersion;
     /**
      * Get package.json version
      */
     private getPackageVersion;
-    /**
-     * Get version from source files
-     */
-    private getSourceVersion;
-    /**
-     * Get version from README
-     */
-    private getReadmeVersion;
-    /**
-     * Parse version string into components
-     */
-    private parseVersion;
-    /**
-     * Format version components back to string
-     */
-    private formatVersion;
-    /**
-     * Increment patch version
-     */
-    private incrementPatch;
     /**
      * Auto-fix version compliance issues
      */