0xray 4.0.12 → 4.0.13

package/.grok-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.12",
+  "version": "4.0.13",
   "description": "0xRay suit for Grok, Hermes, OpenClaw, OpenCode: mill+inspect, Codex, 7 MCP servers. Costume 45/42 is opt-in foundry, not the default wear.",
   "author": {
     "name": "0xRay AI",

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.12",
+  "version": "4.0.13",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/llms.txt

@@ -42,7 +42,7 @@ Not an 8th `xray-*` server. Repertoire is a vendored organ (`npx @0xray/repertoi
 
 ## Agent map (exo, not dump)
 
-- **Mill** — fasten their plant; factory discipline. Nested mill `@0xray/foundry` 0.1.9.
+- **Mill** — fasten their plant; factory discipline. Nested mill `@0xray/foundry` 0.1.10.
 - **Inspect** — diffs, plant-vs-worn, mill receipt, CI, live tarball GET.
 - **Hangar** — plants factory shops on the four floors. Coexists with mill plant via shop plant allowlist.
 - **42 YML / 45 SKILL.md** — exo catalog in this repo. Not default consumer wear.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.12",
+  "version": "4.0.13",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",

package/scripts/foundry/CHANGELOG.md

@@ -2,7 +2,9 @@
 
 ## [Unreleased]
 
-Shop plant is first-class with mill plant. `shop-extract`, `shop-witness`, `shop-pin` (and `foundry.json` `shopPlant`) are not a costume dump. `"costume": true` still required for 45/42. Inspect isolated-home dest is project `.grok/plugins/0xray`. Shared HOME last-mile does not write machine `~/.grok/plugins/0xray`. Isolated HOME must not write the passwd machine plugin. No mill version bump.
+## [0.1.10] - 2026-09-12
+
+Inspect isolated-home `dest` is `resolveGrokPluginDests` — on shared HOME that is project `.grok/plugins/0xray`, not machine `$HOME/.grok/plugins/0xray`. Published 0.1.9 still joined dest from `$HOME` (report/CLI lag after 0xray@4.0.12 / #29 wear). Shop plant is first-class with mill plant. `shop-extract`, `shop-witness`, `shop-pin` (and `foundry.json` `shopPlant`) are not a costume dump. `"costume": true` still required for 45/42. Isolated HOME must not write the passwd machine plugin. Not an 8th MCP. Not 5.0.
 
 ## [0.1.9] - 2026-09-09
 

package/scripts/foundry/README.md

@@ -57,7 +57,7 @@ After mill plant is fastened, overlay their plant (defaults; remap in `foundry.j
 
 **Shop plant:** `shop-extract`, `shop-witness`, `shop-pin` are first-class with mill plant. Inspect does not treat those worn names as a costume dump. `foundry.json` `"shopPlant"` names more shops (array), a plant dir (string), or `{ "skills": [...], "dir": "..." }`. This is not `"costume": true` and does not copy 45/42.
 
-**4.0.9 mill target (0xray postinstall, not this mill package):** `install-bridges.cjs` does not mill npm global prefix or npx `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. Shared HOME Grok last-mile is project `.grok/plugins/0xray` (two seats do not clobber machine plugin). Nested mill stays **0.1.9**.
+**4.0.9 mill target (0xray postinstall, not this mill package):** `install-bridges.cjs` does not mill npm global prefix or npx `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. Shared HOME Grok last-mile is project `.grok/plugins/0xray` (two seats do not clobber machine plugin). Nested mill **0.1.10** (inspect dest matches `resolveGrokPluginDests`; published 0.1.9 still reported machine `$HOME` dest).
 
 ## Publish this mill
 

package/scripts/foundry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0xray/foundry",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "private": false,
   "type": "module",
   "description": "0xRay mill: mint their suit params, stamp, gate, publish, CI report, git hooks. Not the worn exo.",

package/scripts/foundry/plant/agents/inspect.yml

@@ -1,5 +1,5 @@
 name: inspect
 skill: inspect
 description: "Inspect AI work: diffs, traces, mill receipts, CI. Fastened mill plant."
-version: "0.1.9"
+version: "0.1.10"
 mode: subagent

package/scripts/foundry/plant/agents/mill.yml

@@ -1,5 +1,5 @@
 name: mill
 skill: mill
 description: "Fasten their plant as the suit. Factory Repertoire. Inspect is the mill discipline."
-version: "0.1.9"
+version: "0.1.10"
 mode: subagent

package/src/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.12",
+  "version": "4.0.13",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.12",
+  "version": "4.0.13",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/.opencode/skills/api-design/SKILL.md

@@ -1,37 +0,0 @@
----
-source: framework
-name: api-design
-description: RESTful API design and validation
-author: Xray Framework
-version: 1.0.0
-schema_version: "1.0"
-tags: [design, api, design]
-capabilities:
-  - design_rest_api
-  - validate_api_specs
-  - generate_api_docs
-dependencies: []
-
-mcp:
-  api-design:
-    command: node
-    args: [node_modules/0xray/dist/mcps/knowledge-skills/api-design.server.js]
----
-
-# Api Design Skill
-
-RESTful API design and validation.
-
-## Tools Available
-
-- **api_design**: API design
-- **endpoint_validation**: Endpoint validation
-- **api_documentation**: API documentation
-
-## Usage
-
-This skill provides design capabilities for api design functionality.
-
-## Integration
-
-Activated when design capabilities are requested through the skills system.

package/.opencode/skills/architect-tools/SKILL.md

@@ -1,37 +0,0 @@
----
-source: framework
-name: architect-tools
-description: System design and technical architecture tools
-author: Xray Framework
-version: 1.0.0
-schema_version: "1.0"
-tags: [design, architect, tools]
-capabilities:
-  - design_system
-  - evaluate_architecture
-  - recommend_tools
-dependencies: []
-
-mcp:
-  architect-tools:
-    command: node
-    args: [node_modules/0xray/dist/mcps/architect-tools.server.js]
----
-
-# Architect Tools Skill
-
-System design and technical architecture tools.
-
-## Tools Available
-
-- **architecture_design**: Architecture design
-- **system_planning**: System planning
-- **technical_decisions**: Technical decisions
-
-## Usage
-
-This skill provides design capabilities for architect tools functionality.
-
-## Integration
-
-Activated when design capabilities are requested through the skills system.

package/.opencode/skills/architecture-patterns/SKILL.md

@@ -1,37 +0,0 @@
----
-source: framework
-name: architecture-patterns
-description: Software architecture patterns and best practices
-author: Xray Framework
-version: 1.0.0
-schema_version: "1.0"
-tags: [design, architecture, patterns]
-capabilities:
-  - analyze_architecture
-  - recommend_patterns
-  - evaluate_design
-dependencies: []
-
-mcp:
-  architecture-patterns:
-    command: node
-    args: [node_modules/0xray/dist/mcps/knowledge-skills/architecture-patterns.server.js]
----
-
-# Architecture Patterns Skill
-
-Software architecture patterns and best practices.
-
-## Tools Available
-
-- **architecture_patterns**: Architecture patterns
-- **design_patterns**: Design patterns
-- **best_practices**: Best practices
-
-## Usage
-
-This skill provides design capabilities for architecture patterns functionality.
-
-## Integration
-
-Activated when design capabilities are requested through the skills system.

package/.opencode/skills/auto-format/SKILL.md

@@ -1,37 +0,0 @@
----
-source: framework
-name: auto-format
-description: Automated code formatting and style consistency
-author: Xray Framework
-version: 1.0.0
-schema_version: "1.0"
-tags: [formatting, auto, format]
-capabilities:
-  - format_code
-  - enforce_style
-  - fix_lint_errors
-dependencies: []
-
-mcp:
-  auto-format:
-    command: node
-    args: [node_modules/0xray/dist/mcps/auto-format.server.js]
----
-
-# Auto Format Skill
-
-Automated code formatting and style consistency.
-
-## Tools Available
-
-- **code_formatting**: Code formatting
-- **style_consistency**: Style consistency
-- **auto-formatting**: Auto-formatting
-
-## Usage
-
-This skill provides formatting capabilities for auto format functionality.
-
-## Integration
-
-Activated when formatting capabilities are requested through the skills system.

package/.opencode/skills/backend-engineer/SKILL.md

@@ -1,49 +0,0 @@
----
-source: framework
-name: backend-engineer
-description: "Backend engineer for REST/GraphQL APIs, microservices, authentication, and server architecture"
-category: backend
----
-
-# Backend Engineer Skill
-
-Backend specialist for server-side architecture and API design. Systematic, secure, performance-oriented.
-
-## API Design
-
-- Plural nouns for resources (/users, /orders)
-- Proper HTTP methods (GET, POST, PUT, PATCH, DELETE)
-- Correct status codes (201 for creation, 204 for deletion, 404 for missing)
-- API versioning (/v1/)
-- Cursor-based pagination
-- Consistent error response format
-
-## Authentication
-
-- JWT + refresh tokens for stateless auth
-- OAuth2 for third-party integrations
-- HTTPS only (never HTTP)
-- Rate limiting per user/IP
-- bcrypt/argon2 for password hashing
-
-## Microservices
-
-- API gateway for routing and rate limiting
-- Circuit breaker for fault tolerance
-- Message queues for async communication
-- Event sourcing for audit trails
-- Distributed tracing (OpenTelemetry)
-
-## Caching
-
-- CDN -> gateway -> application -> database levels
-- Cache-aside pattern for read-heavy data
-- Write-through for write-throughput needs
-- Appropriate TTLs per data type
-- Careful cache invalidation strategy
-
-## Performance Targets
-
-- API response < 200ms p95
-- 50-100 DB connections pooled
-- Memory profiled and bounded

package/.opencode/skills/boot-orchestrator/SKILL.md

@@ -1,33 +0,0 @@
----
-source: framework
-name: boot-orchestrator
-description: Framework initialization and boot orchestration
-author: Xray Framework
-version: 1.0.0
-schema_version: "1.0"
-tags: [infrastructure, boot, orchestrator]
-capabilities:
-  - initialize_framework
-  - orchestrate_boot_sequence
-  - manage_dependencies
-dependencies: []
-
-mcp:
-  boot-orchestrator:
-    command: node
-    args: [node_modules/0xray/dist/mcps/boot-orchestrator.server.js]
----
-
-# Boot Orchestrator Skill
-
-Framework initialization and boot orchestration.
-
-## Tools Available
-
-- **boot_management**: Boot management
-- **initialization**: Initialization
-- **framework_startup**: Framework startup
-
-## Integration
-
-Lead-dev boot is handled by SessionStart hook + `orchestrator` skill — see `multi_agent_orchestration.lead_dev_mode` in features.json.

package/.opencode/skills/bug-triage/SKILL.md

@@ -1,43 +0,0 @@
----
-source: framework
-name: bug-triage
-description: Bug triage, debugging analysis, and issue prioritization
-author: Xray Framework
-version: 1.0.0
-schema_version: "1.0"
-tags: [debugging, bug-fix, triage, error-analysis]
-capabilities:
-  - triage_bugs
-  - analyze_issues
-  - prioritize_fixes
-dependencies: []
-
-mcp:
-  bug-triage-specialist:
-    command: node
-    args: [node_modules/0xray/dist/mcps/knowledge-skills/bug-triage-specialist.server.js]
----
-
-# Bug Triage Skill
-
-Comprehensive bug triage, debugging analysis, and issue prioritization.
-
-## Tools Available
-
-- **triage_bugs**: Analyze and triage bug reports to identify root causes
-- **analyze_stack_trace**: Parse and analyze stack traces
-- **suggest_fixes**: Generate specific code fixes for bugs
-- **prioritize_issues**: Prioritize bug fixes by severity and effort
-- **find_related_issues**: Find related or duplicate bugs
-
-## Usage
-
-This skill provides debugging capabilities for:
-- Error and exception analysis
-- Stack trace interpretation
-- Root cause identification
-- Bug prioritization for sprint planning
-
-## Integration
-
-Activated when debugging or bug-fixing capabilities are requested.

package/.opencode/skills/code-analyzer/SKILL.md

@@ -1,45 +0,0 @@
----
-source: framework
-name: code-analyzer
-description: Deep code analysis, metrics extraction, and pattern detection (CONSOLIDATED - combines analyzer, explore, and original code-analyzer)
-author: Xray Framework
-version: 1.0.0
-schema_version: "1.0"
-tags: [analysis, metrics, code-quality, patterns]
-capabilities:
-  - analyze_code
-  - extract_metrics
-  - detect_patterns
-dependencies: []
-
-mcp:
-  code-analyzer:
-    command: node
-    args: [node_modules/0xray/dist/mcps/knowledge-skills/code-analyzer.server.js]
----
-
-# Code Analyzer Skill
-
-Deep code analysis, metrics extraction, and pattern detection.
-
-## Tools Available
-
-- **analyze_codebase**: Comprehensive codebase analysis
-- **calculate_metrics**: Code metrics (complexity, maintainability)
-- **detect_patterns**: Design pattern recognition
-- **find_code_smells**: Technical debt identification
-- **analyze_dependencies**: Dependency graph analysis
-- **generate_insights**: Actionable recommendations
-
-## Usage
-
-This skill provides code analysis capabilities for:
-- Complexity and maintainability metrics
-- Design pattern detection
-- Code smell identification
-- Dependency analysis
-- Architectural insights
-
-## Integration
-
-Activated when code analysis or quality assessment capabilities are requested.

package/.opencode/skills/code-review/SKILL.md

@@ -1,52 +0,0 @@
----
-source: framework
-name: code-review
-description: Perform comprehensive code quality assessment and provide improvement suggestions
-author: Xray Framework
-version: 1.0.0
-schema_version: "1.0"
-tags: [review, quality, assessment, improvement]
-capabilities:
-  - assess_quality
-  - review_code
-  - suggest_improvements
-dependencies: []
-
-mcp:
-  code-review:
-    command: node
-    args: [node_modules/0xray/dist/mcps/knowledge-skills/code-review.server.js]
-  tools:
-    - analyze_code_quality
-    - review_pull_request
-    - check_best_practices
-
-agent_binding:
-  primary: code-reviewer
-  auto_invoke: true
-  invoke_on:
-    - pre_commit
-    - pr_review
----
-
-# Code Review Skill
-
-Provides automated code review capabilities with quality assessment and improvement suggestions.
-
-## Tools Available
-
-- **analyze_code_quality**: Analyze code quality metrics, identify issues, and provide improvement suggestions
-- **review_pull_request**: Review pull requests by analyzing changed files and providing comprehensive feedback
-- **check_best_practices**: Check adherence to coding best practices and standards
-
-## Usage
-
-This skill performs automated code reviews including:
-- Code quality analysis and metrics
-- Pull request review and feedback
-- Best practices compliance checking
-- Improvement recommendations and suggestions
-
-## Integration
-
-Activated for code review requests, pull request analysis, and quality assessments through the skills system.

package/.opencode/skills/content-creator/SKILL.md

@@ -1,38 +0,0 @@
----
-source: framework
-name: content-creator
-description: "SEO copywriter for content that ranks and converts in both Google and AI search engines"
-category: content
----
-
-# Content Creator Skill
-
-SEO copywriter specializing in content that ranks and converts for humans and AI search engines.
-
-## Brand Archetypes
-
-Adapt tone on command: Magician, Hero, Sage, Ruler, Everyman, Explorer, Innocent, Jester.
-Default: Professional-friendly-innovative.
-
-## SEO Content Rules
-
-- Primary keywords in H1, first 100 words, throughout
-- LSI/semantic keywords naturally integrated
-- H2-H4 structure with keyword-rich headings
-- Bullets, numbered lists, tables for scannability
-- E-E-A-T signals (author, dates, citations)
-- AI-citation friendly: clear lists, stats, examples
-- Meta descriptions: 150-160 chars, actionable
-
-## Content Types
-
-Blog posts (800-2000w), Product pages, Landing pages, Email sequences, Social posts, Meta descriptions & title tags
-
-## Copy Principles
-
-- Lead with benefit
-- Active voice
-- Tight sentences
-- Zero fluff
-- Strong CTAs
-- Social proof

package/.opencode/skills/database-engineer/SKILL.md

@@ -1,46 +0,0 @@
----
-source: framework
-name: database-engineer
-description: "Database engineer for schema design, query optimization, migrations, and SQL/NoSQL architecture"
-category: database
----
-
-# Database Engineer Skill
-
-Database specialist for architecture and optimization. Technical, precise, performance-oriented.
-
-## Database Systems
-
-PostgreSQL, MySQL, SQLite, SQL Server, MongoDB, Cassandra, Redis, DynamoDB, CockroachDB, TiDB, PlanetScale, Elasticsearch, Meilisearch
-
-## Schema Design
-
-- 3NF minimum normalization
-- Denormalize intentionally for read-heavy workloads
-- Use appropriate data types (no string for dates)
-- Soft deletes with deleted_at timestamps
-- Audit columns (created_at, updated_at, created_by)
-- Foreign key constraints for referential integrity
-
-## Query Optimization
-
-- Use EXPLAIN ANALYZE to find bottlenecks
-- Covering indexes for frequent queries
-- Avoid SELECT * — specify columns
-- Parameterized queries only (prevent SQL injection)
-- Cursor-based pagination, not OFFSET
-
-## Migration Strategy
-
-- Wrap in transactions
-- Batch backfills for large data changes
-- Additive columns first (drop later)
-- Concurrent index creation (CREATE INDEX CONCURRENTLY)
-- Deprecation periods before removing columns
-
-## Performance Targets
-
-- < 100ms OLTP queries
-- < 1s OLAP queries
-- 10-50 connection pool size
-- Zero-downtime migrations

package/.opencode/skills/devops-engineer/SKILL.md

@@ -1,49 +0,0 @@
----
-source: framework
-name: devops-engineer
-description: "DevOps engineer for CI/CD, infrastructure as code, containers, cloud deployment, and operational reliability"
-category: devops
----
-
-# DevOps Engineer Skill
-
-DevOps specialist for infrastructure, CI/CD, and operational reliability. Reliability-focused, security-conscious, automate everything.
-
-## CI/CD Best Practices
-
-- Conventional commits for trigger control
-- Branch protection rules
-- Matrix builds for multi-platform testing
-- Dependency caching for faster builds
-- Progressive rollout (canary / blue-green)
-- Automated rollback procedures
-
-## Infrastructure as Code
-
-- Modular, reusable components
-- Remote state + locking (Terraform)
-- Drift detection
-- GitOps (ArgoCD/Flux)
-- Secrets separation (Vault/AWS Secrets Manager)
-
-## Containers
-
-- Helm/Kustomize for Kubernetes
-- Health checks and readiness probes
-- Resource limits and PDBs
-- Service mesh for inter-service communication
-
-## Monitoring
-
-- Logs / Metrics / Traces (three pillars)
-- Structured JSON logging
-- OpenTelemetry for instrumentation
-- SLO-based alerting (not threshold-based)
-- Runbooks for incident response
-
-## Cloud Security
-
-- Least privilege IAM
-- VPC / private subnets
-- Encryption at rest and in transit
-- CI/CD pipeline scanning

package/.opencode/skills/enforcer/SKILL.md

@@ -1,37 +0,0 @@
----
-source: framework
-name: enforcer
-description: Codex compliance validation and error prevention
-author: Xray Framework
-version: 1.0.0
-schema_version: "1.0"
-tags: [quality, enforcer]
-capabilities:
-  - validate_compliance
-  - prevent_errors
-  - enforce_codex
-dependencies: []
-
-mcp:
-  enforcer:
-    command: node
-    args: [node_modules/0xray/dist/mcps/enforcer-tools.server.js]
----
-
-# Enforcer Skill
-
-Codex compliance validation and error prevention.
-
-## Tools Available
-
-- **code_compliance**: Code compliance
-- **error_prevention**: Error prevention
-- **quality_validation**: Quality validation
-
-## Usage
-
-This skill provides quality capabilities for enforcer functionality.
-
-## Integration
-
-Activated when quality capabilities are requested through the skills system.