0xray 4.0.12 → 4.0.14

package/llms.txt

@@ -4,7 +4,7 @@
 
 **4.0** — mill+inspect plant, 7 MCPs, Codex 69. Constitution always on.
 
-Default consumer wear is **mill plant** (`mill` + `inspect`), not a 45-skill / 42-agent costume dump. `foundry.json` `"costume": true` is the opt-in dump. Do not use costume to land hangar shops.
+Default consumer wear is **mill plant** (`mill` + `inspect`), not a 45-skill / 42-agent costume dump. `foundry.json` `"costume": true` is the opt-in dump. Do not use costume to land hangar shops. Sound seats: `"plant": "sound"` fastens `sound` + `sound-inspect` (mill off). Blip seats: `"plant": "blip"` fastens `blip` + `blip-inspect` (mill off). Inspect reports the last bed or blip receipt. Not costume.
 
 ## Wear (what a stranger gets)
 
@@ -34,7 +34,7 @@ Registered in `.mcp.json` as `npx -y 0xray mcp <cmd>`:
 | `xray-code-review` | Proposal quality |
 | `xray-architect-tools` | System design |
 
-Not an 8th `xray-*` server. Repertoire is a vendored organ (`npx @0xray/repertoire mcp`), enable-when-resolves.
+Not an 8th `xray-*` server. Repertoire is a vendored organ (`npx @0xray/repertoire mcp`), enable-when-resolves. Survive compact is **Station** (Read `.xray/state/STATION.md`), not Repertoire 0.1.8.
 
 ## Codex 69 (always on)
 
@@ -42,8 +42,10 @@ Not an 8th `xray-*` server. Repertoire is a vendored organ (`npx @0xray/repertoi
 
 ## Agent map (exo, not dump)
 
-- **Mill** — fasten their plant; factory discipline. Nested mill `@0xray/foundry` 0.1.9.
-- **Inspect** — diffs, plant-vs-worn, mill receipt, CI, live tarball GET.
+- **Mill** — fasten their plant; factory discipline. Nested mill `@0xray/foundry` 0.1.10.
+- **Inspect** — diffs, plant-vs-worn, mill receipt, CI, live tarball GET. Sound seat: last bed PASS/FAIL. Blip seat: last 4.44s PASS/FAIL.
+- **Sound** — factory-sound plant. Brief → seed → genre → crystal mill wav (Rippel membrane/metal/mixer) → metrics gate. Not a mill copy. Not a 3-sine toy.
+- **Blip** — factory-blip plant (sibling to mill + sound, not a mill copy). Brief → seed → still|motion:<id> → 4.44s mp4 + audio bed. Motions are Rippel v2 VisualConfig at ≥720p (sharp look + tempo/frequency animation on all five). Sparse seed mesh plus field accents (stars, grids, gradients, blinkers) are the NFT fingerprints. v0: still + Rippel five. `kapow` is a growth stub. `still` is the Power Plant ident (plate dissolves, not a frozen poster). Hangar shop pair later.
 - **Hangar** — plants factory shops on the four floors. Coexists with mill plant via shop plant allowlist.
 - **42 YML / 45 SKILL.md** — exo catalog in this repo. Not default consumer wear.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.12",
+  "version": "4.0.14",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",
@@ -61,6 +61,8 @@
   },
   "scripts": {
     "prepublishOnly": "node scripts/node/reconcile-version.mjs --check && npm run prepare-consumer && npm run build:all && find dist -name '*.js.map' -o -name '*.d.ts.map' | xargs rm -f 2>/dev/null || true",
+    "prepack": "node scripts/foundry/assert-packed-dist-cli.mjs",
+    "assert:packed-dist": "node scripts/foundry/assert-packed-dist-cli.mjs",
     "version:bump": "node scripts/foundry/reconcile-version.mjs",
     "version": "node scripts/foundry/version-manager.mjs",
     "prebuild": "rm -rf dist tsconfig.tsbuildinfo tsconfig.*.tsbuildinfo",
@@ -79,7 +81,7 @@
     "test:processors": "npm test -- src/__tests__/unit/processor-activation.test.ts src/__tests__/unit/typescript-compilation-processor.test.ts",
     "test:miscellaneous": "npm test -- src/__tests__/unit/blocked-test.test.ts",
     "test:quick": "npm test -- src/__tests__/integration/boot-orchestrator.integration.test.ts src/__tests__/unit/config-loader.test.ts src/__tests__/unit/state-manager.test.ts",
-    "test:comprehensive": "npm run typecheck && npm run test:unit && npm run test:core-framework && npm run test:security && npm run test:performance && npm run test:session-management && npm run test:code-analysis && npm run test:processors && npm run test:miscellaneous && npm test -- src/__tests__/unit/llm-governance-provider.test.ts src/__tests__/unit/mcp-server-smoke.test.ts",
+    "test:comprehensive": "npm run typecheck && npm run test:unit && npm run test:core-framework && npm run test:security && npm run test:performance && npm run test:session-management && npm run test:code-analysis && npm run test:processors && npm run test:miscellaneous && npm test -- src/__tests__/unit/llm-governance-provider.test.ts src/__tests__/unit/mcp-server-smoke.test.ts src/__tests__/unit/cursor-hooks.test.ts src/__tests__/unit/host-vs-mill-score.test.ts",
     "test:integration-all": "npm test -- src/__tests__/integration/",
     "test:performance-all": "npm test -- src/__tests__/performance/ src/__tests__/unit/performance-system.test.ts src/__tests__/unit/benchmark.test.ts src/__tests__/unit/analytics.test.ts",
     "test:agents-all": "echo 'Legacy agents test entry retired'",

package/scripts/foundry/CHANGELOG.md

@@ -2,7 +2,43 @@
 
 ## [Unreleased]
 
-Shop plant is first-class with mill plant. `shop-extract`, `shop-witness`, `shop-pin` (and `foundry.json` `shopPlant`) are not a costume dump. `"costume": true` still required for 45/42. Inspect isolated-home dest is project `.grok/plugins/0xray`. Shared HOME last-mile does not write machine `~/.grok/plugins/0xray`. Isolated HOME must not write the passwd machine plugin. No mill version bump.
+Factory-blip phrase eases (hookEase/turnEase/tagEase). Still plates dissolve (~300ms). Focus orb wears field + mesh mass. Ambient bed is a 3-section score (turn crash, tag stab). Mill stays deterministic — no LLM in the render loop.
+
+Factory-blip is a 4.44s Short: hook → turn → tag on the shared motion grid (picture + bed). Motif lines, pad in-key, bass an octave down. Voices: polyBLEP + biquad, layered kick, FM hat + noise, 2-op rhodes. Mix pocket + short plate on color/hat.
+
+Factory-blip look variants: seed + `--look focus|cage`. `focus` restores the sharp-dogfood solid cyan disc + gold pupil + orbiting satellites. `cage` keeps Wu hairline + field. Receipt `visualConfig.lookKind`.
+
+Factory-blip mux is stereo AAC. Inspect FAILs a missing stream or an inaudible bed (max volume ≤ −40 dB). A silent wav is no longer a PASS.
+
+Factory-blip orb nucleus is orb-only (disc / eclipse / pulse, color + size on the grid). Swirl / snap / spark no longer stamp the same double circle.
+
+Factory-blip audio syncopates to the motion grid: same seed + tempo + phase0=0. Downbeat kick locks to `kickAccent`; AND hat locks to `andAccent`. Not a flat bed under unrelated LFOs.
+
+Factory-blip auto bed is the music — same seed / tempo / phase0 as the picture. 4.44s beds hit on the first downbeat (no 0.5s duck). Kick + AND hat + bass/rhodes on the grid. Pad sits under.
+
+Factory-blip lines: Wu hairline (solid 1px core, coverage AA as the only glow). Cyan/gold/blue along the stroke. Vertex beads gone.
+
+Factory-blip lines iridesce: cyan/gold/blue travel + glow + beat fireflies on the sparse cage. Field stars / grids / gradients / blinkers are luminous, not CAD ticks. Not more wire. Not a strobe.
+
+Factory-blip field accents: uniqueness is stars / grids (`floor` `meridian` `ticks`) / gradients / blinkers around one sparse seed cage. Receipt `visualConfig.mesh` + `visualConfig.field`. Not more wire in the middle.
+
+Factory-blip meshes: every mint gets a seed-unique polyhedron (12 families + gait). Worn by all five viz and the Power Plant ident.
+
+Factory-blip Power Plant is a living ident (`look: power-plant-blip`) — titlecard / corridor / rain / endcard dissolve over 4.44s at ≥720p. Not a frozen 320×180 poster.
+
+Factory-blip Rippel v2: the sharp orb look (`stampFocusDisc` opaque body + crisp rim + short glow) is now the look on **all five** viz — swirl / snap / waves / spark were still Phase 1 bokeh strokes. Animation is the complex Rippel set, paced as a 4.44s blip (fast abstract travel, soft gold tints — no hard strobe). Video LFOs share the crystal-mill genre tempo + `CircleConfig.frequency` with the audio bed. Mandatory 4.44s mux unchanged. No version bump.
+
+Factory-blip Phase 1 (TICKET-BLIP-RENDERER-UPGRADE): default motion path is the Rippel converter spine (`VisualConfig.circles` → SimplifiedVisualConverter viz ids) at ≥720p, not ffmpeg geometry labeled as orb. `htafolla/rippel-synapse-flow@e5014cd`. Every Blip muxes a 4.44s audio bed (`--bed` or auto sound mill); silent mp4 = inspect FAIL. ffmpeg wireframe is `--engine wireframe` only. Still stays the Power Plant plate until Phase 2. No `@0xray/foundry` bump.
+
+Factory-blip plant (`blip` + `blip-inspect`) — sibling to mill + sound, not a mill copy. `foundry.json` `"plant": "blip"` fastens the tiny-video factory and turns mill off. Dynamic motion registry (not a frozen Rippel enum). v0: still + Rippel five. `kapow` is a growth stub. Still generator wears the Power Plant intro plate (`#08090B` `#F5F7FA` `#3DE0E8` `#F5C518` `#4A7FD4`). Headless 4.44s mp4 + receipt. Inspect reports last blip PASS/FAIL. Not costume. No version bump — dogfood from branch / pack.
+
+Sound plant retool: crystal-clear mill of Rippel SSOT chains (membrane / metal / duo-bass / mixer), not the Lovable volume-hack soup and not #62 sine beds. Tone.Offline blocked in Node. `phonk` first-class. No version bump.
+
+Factory-sound plant (`sound` + `sound-inspect`). `foundry.json` `"plant": "sound"` fastens the bed factory and turns mill off. Headless render + metrics receipt. Inspect reports last bed PASS/FAIL. Not a mill copy. Not costume. No version bump — dogfood from branch / pack.
+
+## [0.1.10] - 2026-09-12
+
+Inspect isolated-home `dest` is `resolveGrokPluginDests` — on shared HOME that is project `.grok/plugins/0xray`, not machine `$HOME/.grok/plugins/0xray`. Published 0.1.9 still joined dest from `$HOME` (report/CLI lag after 0xray@4.0.12 / #29 wear). Shop plant is first-class with mill plant. `shop-extract`, `shop-witness`, `shop-pin` (and `foundry.json` `shopPlant`) are not a costume dump. `"costume": true` still required for 45/42. Isolated HOME must not write the passwd machine plugin. Not an 8th MCP. Not 5.0.
 
 ## [0.1.9] - 2026-09-09
 

package/scripts/foundry/README.md

@@ -24,6 +24,10 @@ npx @0xray/foundry release --publish-only --dry-run
 npx @0xray/foundry release --publish-only --i-mean-it
 npx @0xray/foundry mint
 npx @0xray/foundry inspect [--skip-live]
+npx @0xray/foundry sound render [--brief TEXT] [--genre ambient|techno|jazz]
+npx @0xray/foundry sound inspect
+npx @0xray/foundry blip render --brief TEXT --mode still|motion:<id> [--bed PATH] [--engine rippel|wireframe]
+npx @0xray/foundry blip inspect
 npx @0xray/foundry ci [--commit SHA] [--report]
 npx @0xray/foundry hooks
 ```
@@ -55,9 +59,17 @@ After mill plant is fastened, overlay their plant (defaults; remap in `foundry.j
 
 **Default mill plant:** `mill` + `inspect` (inspect AI work). Fastens a suit, not an empty one. Not 45/42 costume. `foundry.json` `"costume": true` copies that dump. Factory Repertoire still enable-when-resolves. PPE stays worn.
 
+**Sound plant (factory-sound):** `foundry.json` `"plant": "sound"` fastens `sound` + `sound-inspect` and turns mill off. Spine: brief → checksum seed → genre (`ambient` | `techno` | `jazz` | `phonk`) → crystal-clear headless wav (Rippel membrane + metal + mixer, not a 3-sine toy) → metrics gate → `.xray/sound-bed-receipt.json`. Tone.Offline is blocked in Node (no `OfflineAudioContext`); `sound-rippel.cjs` is the lean mill port of `htafolla/rippel-synapse-flow`. Inspect reports the plant plus last bed `PASS`/`FAIL`. Not costume. No `@0xray/foundry` bump.
+
+A friend would hear: the sound mill mills Dist beds like Rippel’s prototype grew up — kick membranes, metal hats, and a crystal-clear mixer, not a muddy toy and not a 3-sine pad.
+
+**Blip plant (factory-blip):** sibling factory plant to mill + sound — not a mill copy. `foundry.json` `"plant": "blip"` fastens `blip` + `blip-inspect` and turns mill off. Motions live in `plant/motions/registry.json` (not a frozen Rippel enum). v0: `still` + Rippel five (`orb` `swirl` `snap` `waves` `spark`). `kapow` is a growth stub (FAIL until a renderer ships). Unknown id FAIL. Rippel v2 default motion path is the Rippel converter (`VisualConfig.circles` → canvas / 3d-sacred / neural / waveform / particles) at ≥720p — sharp look + tempo/frequency animation on all five. Audio syncopates to the motion grid (same seed, tempo, phase0=0). Each mint wears a sparse seed mesh plus field accents (stars, grids, gradients, blinkers) so 4.44s is unique blip art; receipt `visualConfig.mesh` + `visualConfig.field` are the fingerprints. ffmpeg wireframe is `--engine wireframe` only. `still` is the Power Plant ident (void `#08090B` · ink `#F5F7FA` · cyan `#3DE0E8` · gold `#F5C518` · agent blue `#4A7FD4`) — titlecard / corridor / rain / endcard dissolve over 4.44s at ≥720p, not a frozen poster. Every 4.44s mp4 muxes a stereo AAC bed (`--bed` or auto sound mill) → `.xray/blip/receipt.json`. Missing stream or inaudible bed = inspect FAIL. Inspect reports the plant, live ids, plus last blip `PASS`/`FAIL`. Not costume. No `@0xray/foundry` bump.
+
+A friend would hear: Blips should look like Rippel living motions with sound, not a silent wireframe box.
+
 **Shop plant:** `shop-extract`, `shop-witness`, `shop-pin` are first-class with mill plant. Inspect does not treat those worn names as a costume dump. `foundry.json` `"shopPlant"` names more shops (array), a plant dir (string), or `{ "skills": [...], "dir": "..." }`. This is not `"costume": true` and does not copy 45/42.
 
-**4.0.9 mill target (0xray postinstall, not this mill package):** `install-bridges.cjs` does not mill npm global prefix or npx `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. Shared HOME Grok last-mile is project `.grok/plugins/0xray` (two seats do not clobber machine plugin). Nested mill stays **0.1.9**.
+**4.0.9 mill target (0xray postinstall, not this mill package):** `install-bridges.cjs` does not mill npm global prefix or npx `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. Shared HOME Grok last-mile is project `.grok/plugins/0xray` (two seats do not clobber machine plugin). Nested mill **0.1.10** (inspect dest matches `resolveGrokPluginDests`; published 0.1.9 still reported machine `$HOME` dest).
 
 ## Publish this mill
 

package/scripts/foundry/assert-packed-dist-cli.mjs

@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+/**
+ * Fail if the tarball npm would publish does not contain dist/cli/index.js.
+ *
+ * 0xray@4.0.13 listed dist/ in package.json files[] but packed 0 dist files.
+ * npm pack silently omits missing files[] entries when dist/ is not on disk.
+ *
+ * Dry-run uses --ignore-scripts so this can run from prepack without recursion.
+ */
+
+import { execSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { isXrayExoRepo, resolveMillRoot } from "./mill-root.mjs";
+
+export const REQUIRED_PACK_PATHS = [
+  "dist/cli/index.js",
+  "dist/mcps/orchestrator.server.js",
+  "dist/integrations/grok/hooks/session-start.js",
+];
+
+export function packedFilePaths(files) {
+  if (!Array.isArray(files)) return [];
+  return files
+    .map((f) => (typeof f === "string" ? f : f && typeof f.path === "string" ? f.path : ""))
+    .filter(Boolean)
+    .map((p) => p.replace(/^package\//, ""));
+}
+
+export function parseNpmPackJson(raw) {
+  const text = String(raw ?? "");
+  const start = text.search(/[\[{]/);
+  if (start < 0) {
+    throw new Error("npm pack --json produced no JSON");
+  }
+  const parsed = JSON.parse(text.slice(start));
+  const entry = Array.isArray(parsed) ? parsed[0] : parsed;
+  return packedFilePaths(entry?.files);
+}
+
+export function assertPackedPaths(paths, required = REQUIRED_PACK_PATHS) {
+  const set = new Set((paths ?? []).map((p) => String(p).replace(/^package\//, "")));
+  const missing = required.filter((p) => !set.has(p));
+  if (missing.length > 0) {
+    throw new Error(
+      `npm pack omitted ${missing.join(", ")}. ` +
+        `package.json files[] lists dist/ but npm omits it when dist/ is missing on disk. ` +
+        `Run npm run build. Do not publish. (0xray@4.0.13 shipped 0 dist files.)`,
+    );
+  }
+}
+
+export function assertDistCliOnDisk(rootDir) {
+  const cli = path.join(rootDir, "dist", "cli", "index.js");
+  if (!fs.existsSync(cli)) {
+    throw new Error(
+      `dist/cli/index.js missing on disk at ${cli}. Run npm run build before pack/publish.`,
+    );
+  }
+}
+
+export function listPackedPathsDryRun(rootDir) {
+  const out = execSync("npm pack --dry-run --json --ignore-scripts", {
+    cwd: rootDir,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  return parseNpmPackJson(out);
+}
+
+export function assertPackedDistCli(rootDir = resolveMillRoot()) {
+  if (!isXrayExoRepo(rootDir)) {
+    return { skipped: true, reason: "not 0xray exo" };
+  }
+  assertDistCliOnDisk(rootDir);
+  const paths = listPackedPathsDryRun(rootDir);
+  assertPackedPaths(paths);
+  return { skipped: false, paths: REQUIRED_PACK_PATHS };
+}
+
+const isMain =
+  process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+
+if (isMain) {
+  try {
+    const result = assertPackedDistCli();
+    if (result.skipped) {
+      process.stdout.write(`ℹ️  packed dist/cli check skipped (${result.reason})\n`);
+    } else {
+      process.stdout.write(`✅ pack includes ${REQUIRED_PACK_PATHS.join(", ")}\n`);
+    }
+  } catch (err) {
+    process.stderr.write(`❌ ${err.message}\n`);
+    process.exit(1);
+  }
+}