0xray 4.0.14 → 4.0.16

package/.grok-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.14",
+  "version": "4.0.16",
   "description": "0xRay suit for Grok, Hermes, OpenClaw, OpenCode: mill+inspect, Codex, 7 MCP servers. Costume 45/42 is opt-in foundry, not the default wear.",
   "author": {
     "name": "0xRay AI",

package/.opencode/init.sh

@@ -35,8 +35,15 @@ XRAY_VERSION=$(node -e "console.log(require('$FRAMEWORK_ROOT/package.json').vers
 # Dedup guard — prevent duplicate runs during startup
 # Uses a TTL lockfile (10s window) since OpenCode may trigger config hook
 # from multiple plugin copies in quick succession
-# Key by PROJECT_ROOT (md5) so all invocations in the same project share one lock
-LOCK_KEY=$(echo -n "$PROJECT_ROOT" | md5 | cut -c1-16)
+# Key by PROJECT_ROOT so all invocations in the same project share one lock.
+# md5 is macOS; Linux has md5sum. Do not fail the boot on a leftover Mac tool.
+if command -v md5 >/dev/null 2>&1; then
+    LOCK_KEY=$(echo -n "$PROJECT_ROOT" | md5 | cut -c1-16)
+elif command -v md5sum >/dev/null 2>&1; then
+    LOCK_KEY=$(echo -n "$PROJECT_ROOT" | md5sum | awk '{print $1}' | cut -c1-16)
+else
+    LOCK_KEY=$(echo -n "$PROJECT_ROOT" | cksum | awk '{print $1}')
+fi
 LOCK_FILE="/tmp/xray-init-${LOCK_KEY}.lock"
 LOCK_TTL=10
 if [ -f "$LOCK_FILE" ]; then
@@ -123,8 +130,11 @@ else
     PLUGIN_STATUS="❌"
 fi
 
-# Framework config check
-if [ ! -f "$PROJECT_ROOT/.opencode/enforcer-config.json" ]; then
+# Framework config check — consumer wear is .xray/codex.json, not leftover enforcer-config.json
+if [ ! -f "$PROJECT_ROOT/.opencode/enforcer-config.json" ] \
+    && [ ! -f "$PROJECT_ROOT/.xray/codex.json" ] \
+    && [ ! -f "$PROJECT_ROOT/node_modules/0xray/.xray/codex.json" ] \
+    && [ ! -f "$PROJECT_ROOT/.mcp.json" ]; then
     echo -e "${PURPLE}//   ❌ Framework configuration not found                     //${NC}"
     exit 1
 fi

package/.opencode/skills/orchestrator/SKILL.md

@@ -58,4 +58,23 @@ When `multi_agent_orchestration.lead_dev_mode` is true in `features.json` (defau
 - **SessionStart** → `session-start.js` boots lead_dev_mode
 - **PreToolUse** → hints `per_suite_triage_required` on full `npm test`
 
-Config: `features.json` → `multi_agent_orchestration.lead_dev_mode`
+Config: `features.json` → `multi_agent_orchestration.lead_dev_mode`
+
+## Lead cadence (syncopation)
+
+The seven rules are the engine. The cadence is the time signature. Disk SSOT: `grok-bot/ops/LEAD-CADENCE.md`.
+
+- **Peer test:** another instance with only worn 0xRay continues the ticket. No command stream.
+- **Wear first:** Read `.xray/state/STATION.md`. Same cloud. Same critic (resume only). Dummy Reads Station.
+- **Dummy tests `SKILLS.md`:** a suited dummy proves the worn catalog. Same-sess bodies keep context and hold a Station card.
+- **Ship track:** always branch + worktree/aside + PR. Docs as you go. Builds. Rollback = close the PR.
+- **Publish:** stay logged in (do not `npm logout`). Every time run `npm publish --access public` in the live TTY. Paste the clickable `auth/cli` URL. No Enter, no VM browser, no subagent, no 6-digit code in chat. Poll `npm view` until live. Then prove **fresh** and **upgrade** registry installs. `npx 0xray validate` is the wear check (not leftover init.sh). `npm view` is not an install.
+- **Peer boot:** four-line dispatch. They Read Station + this cadence and install without a command novel. Not a twin critic.
+- **Live tick, not pacer:** `/loop` runs work now. Keep workstreams moving. Do not idle-wait 12 minutes.
+- **Board clock:** PR events + resume the same critic. Not two idle pacers. Merge after PASS+CI (gate A). Publish only after mill-gate D + `foundry gate`.
+- **Dispatch:** ticket + PR URLs + “Wear, then review.” The critic Reads `SEATS.md` Reviewer. Do not paste a command novel. When a law is spoken twice, encode it this wake.
+- **Close:** loop until Station is done. Compact: Station survives the cut. Repertoire keeps names.
+- **Board:** critic Strict comments; forge implements; lead stays main thread.
+- **Codex 69:** rewire this skill and existing ops. Do not add a new `SKILL.md` to hold the cadence.
+- **Ship matrix:** `LEAD-CADENCE.md` Decision matrix — A PR+CI · B pack · C `release:docs-check` · D `foundry release --i-mean-it`. Green CI is not ship. Spend / credentials stay Ask-first.
+- **Metamorphosis:** LLM → OP-PROC is in-context worn seats (same critic, same dummy, resume only). Not more bots.

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.14",
+  "version": "4.0.16",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",
@@ -162,7 +162,7 @@
     "provider": "repertoire",
     "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
     "config": {
-      "signalsPath": "node_modules/@0xray/repertoire/data/curated_signals.json",
+      "signalsPath": ".xray/state/repertoire/curated_signals.json",
       "statePath": ".xray/state/repertoire/inference-state.json",
       "feedbackDir": ".xray/state/repertoire/feedback"
     }

package/AGENTS-consumer.md

@@ -6,7 +6,7 @@ Quick reference for the 0xRay AI orchestration framework worn on **{{CONSUMER_NA
 
 **4.0** — a suit that survives the context window
 
-Same **three-subsystem OS** as v2 (Inference · External Governance · Autonomous Engine). Constitution always on. Temperament scales ceremony. Four platform bridges. Repertoire organ ships **on** (vendored 0.2); opt out with `"enabled": false, "provider": "repertoire"`. Trim fat, do not gut the design.
+Same **three-subsystem OS** as v2 (Inference · External Governance · Autonomous Engine). Constitution always on. Temperament scales ceremony. Four chat bridges plus Cursor project hooks. Repertoire organ ships **on** (vendored 0.2); opt out with `"enabled": false, "provider": "repertoire"`. Trim fat, do not gut the design.
 
 **Governance always on** (Codex PreToolUse, no new surface, no `eval`). **Engine ceremony** (analyze-complexity before spawn, confer) is **guided** by default so free-model OpenCode/Hermes stay in check. Frontier hosts (Grok 4.6 class) with `suit_temperament.profile: auto` **warn** on spawn-without-plan instead of deny — the engine is still there. Existing `.xray/features.json` without `suit_temperament` stays **guided**. Docs: v3 from v2 · Suit temperament.
 
@@ -14,17 +14,19 @@ Same **three-subsystem OS** as v2 (Inference · External Governance · Autonomou
 
 Before other work, Read `.xray/state/STATION.md`. Compaction and host change are the same cut. Continue the card. Do not restart the job. Grok does not inject the card (OpenCode does) — this Read is the Grok contract. Do not thicken the Grok exo.
 
+A peer lead continues from this card + Repertoire + the `orchestrator` skill. Dummy tests `SKILLS.md`. Same-sess bodies wear the suit. Branch + worktree + PR. Loop until Station is done. Live work ticks, not idle pacers. Same critic seat (resume only). Ship when mill-gate D + `foundry gate` PASS — green CI is not ship. Spend / credentials stay Ask-first. OTP in a browser, poll the new version before the next cut.
+
 ## Postinstall (automatic)
 
 `npm install 0xray` runs `install-bridges.cjs` and:
 
 - Copies this file → **`AGENTS.md`** in your project root
-- Fastens mill plant (`mill` + `inspect`) then overlays **your** `src/skills` (same name wins). Sound seats: `foundry.json` `"plant": "sound"` fastens `sound` + `sound-inspect` (mill off). Blip seats: `foundry.json` `"plant": "blip"` fastens `blip` + `blip-inspect` (mill off). `npx @0xray/foundry inspect` runs the mill checks; on a sound seat it also reports the last bed receipt; on a blip seat the last 4.44s receipt. Chat is not a receipt. Does **not** dump 45/42 costume unless `foundry.json` `"costume": true`. Does **not** write root **`SKILLS.md`**
+- Fastens mill plant (`mill` + `inspect`) then overlays **your** `src/skills` (same name wins). Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares (blip-inspect, blip-vibe, blip-looker, sound-inspect, sound-mixer live in the mill). `npx @0xray/foundry sound mix` / `sound render` / `blip render` are CLI shims (0.1.11+). `npx @0xray/foundry inspect` runs mill-exported inspect; on a sound seat the last bed receipt; on a blip seat the last 4.44s receipt. Chat is not a receipt. Does **not** dump 45/42 costume unless `foundry.json` `"costume": true`. Does **not** write root **`SKILLS.md`**
 - Factory shop plant (`shop-extract`, `shop-witness`, `shop-pin` from groover-hangar) is first-class with mill plant. Extra shops: `foundry.json` `"shopPlant"`. Not costume.
 - Seeds **`.gitignore`** (from template, if absent)
 - Deploys **`.xray/`** (`codex.json`, `features.json`, `config.json`) then overlays **your** mill SSOT (`xray/codex.json`, `xray/features.json`, `src/skills`, `src/opencode/agents`; remap with `foundry.json`)
 - Writes **`.mcp.json`** with 7 MCPs servers (`npx -y 0xray mcp …`)
-- Installs bridges: **OpenCode**, **Grok**, **Hermes**, **OpenClaw**
+- Installs bridges: **OpenCode**, **Grok**, **Hermes**, **OpenClaw**, plus **Cursor** `.cursor/hooks.json`
 
 Optional extras: `npx 0xray setup`
 
@@ -61,7 +63,10 @@ Governance deliberation uses **code-review**, **security-audit** (via enforcer/s
 | `npx 0xray mcp <server>` | Start an MCP server (stdio) |
 | `npx @0xray/foundry inspect` | Mill inspect (nested mill). Sound seat: plant + last bed PASS/FAIL. Blip seat: last 4.44s PASS/FAIL. Chat is not a receipt. |
 | `npx @0xray/foundry sound render` | Factory-sound bed: brief → seed → genre → crystal mill wav → metrics receipt. |
-| `npx @0xray/foundry blip render` | Factory-blip plant: brief → seed → still\|motion:<id> → 4.44s mp4 + audio bed. Motions are Rippel v2 VisualConfig at ≥720p. Sparse seed mesh plus field accents (stars, grids, gradients, blinkers) are the NFT fingerprints. `still` is the Power Plant ident (plate dissolves, not a frozen poster). |
+| `npx @0xray/foundry sound mix` | sound-mixer: level every genre × tempo × motif (hats / plate / glue). |
+| `npx @0xray/foundry blip render` | Factory-blip mill (`@0xray/blip`): brief → seed → still\|motion:<id> → 4.44s mp4 + audio bed. Motions are Rippel v2 VisualConfig at ≥720p. `kapow` is a design opt (two-tier comic stamp). Sparse seed mesh plus field accents are the NFT fingerprints. `still` is the Power Plant ident (plate dissolves, not a frozen poster). Fasten is foundry-plant/0 (`@0xray/foundry@0.1.12`); CLI shims remain (0.1.11+). |
+| `npx @0xray/foundry blip vibe` | Stamp density. Appeal 0–10. Ship bar is 8. |
+| `npx @0xray/foundry blip look` | Friend hitting replay (looker). Appeal 0–10. Ship bar is 8. |
 
 ## Governance
 
@@ -90,7 +95,7 @@ Configure in `.xray/features.json`:
   "provider": "repertoire",
   "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
   "config": {
-    "signalsPath": "node_modules/@0xray/repertoire/data/curated_signals.json",
+    "signalsPath": ".xray/state/repertoire/curated_signals.json",
     "statePath": ".xray/state/repertoire/inference-state.json",
     "feedbackDir": ".xray/state/repertoire/feedback"
   }

package/AGENTS.md

@@ -12,6 +12,8 @@ Quick reference for the xray AI orchestration framework (**4.0**).
 
 Before other work, Read `.xray/state/STATION.md`. Compaction and host change are the same cut. Continue the card. Do not restart the job. Grok does not inject the card (OpenCode does) — this Read is the Grok contract. Do not thicken the Grok exo.
 
+**Lead cadence:** a peer wearing this file + Station + Repertoire continues without a command stream. Dummy bodies test `SKILLS.md`. Same-sess bodies wear the suit and keep a Station card. Always branch + worktree + PR. Ship when mill-gate D + `foundry gate` PASS (`LEAD-CADENCE.md` Decision matrix) — green CI is not ship. npm OTP in a browser, then poll the new version before moving on. Loop until Station is done. Live ticks and moving workstreams — not idle pacers. Same critic (resume only). Disk SSOT: `grok-bot/ops/LEAD-CADENCE.md`. Playbook: `orchestrator` skill.
+
 ## What is xray?
 
 xray provides intelligent multi-agent orchestration with automatic delegation and Codex compliance validation under the pure v2 three-subsystem model:
@@ -43,22 +45,23 @@ Governance deliberation: **code-review**, **security-audit**, **researcher** wit
 `postinstall.cjs` → `installAllBridges()`:
 
 1. `AGENTS-consumer.md` → `AGENTS.md` (does **not** write consumer-root `SKILLS.md`)
-2. Fasten mill plant (`mill` + `inspect`). Sound seats: `foundry.json` `"plant": "sound"` fastens `sound` + `sound-inspect` and turns mill off. Blip seats: `foundry.json` `"plant": "blip"` fastens `blip` + `blip-inspect` and turns mill off. Not a 45-skill costume dump unless `foundry.json` `"costume": true`
+2. Fasten mill plant (`mill` + `inspect`). Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares (looker, vibe, mixer, blip-inspect, blip-vibe, blip-looker, sound-inspect, sound-mixer live in the mill). Not a 45-skill costume dump unless `foundry.json` `"costume": true`
 3. `.gitignore.default` → `.gitignore` (if absent)
 4. `.xray/` config (`codex.json`, `features.json`, `config.json`) then overlay their plant
 5. `.mcp.json` (7 servers)
-6. Four bridges: OpenCode, Grok, Hermes, OpenClaw. Grok last-mile dest is project `.grok/plugins/0xray` (shared HOME does not last-wins clobber machine `~/.grok/plugins/0xray`)
-7. Optional git hooks
+6. Four chat bridges: OpenCode, Grok, Hermes, OpenClaw. Grok last-mile dest is project `.grok/plugins/0xray` (shared HOME does not last-wins clobber machine `~/.grok/plugins/0xray`)
+7. Cursor fifth wear: fasten `.cursor/hooks.json` when absent (preToolUse / preCompact / afterFileEdit). Leaves an existing file alone. Not a fifth chat TUI.
+8. Optional git hooks
 
 **Shop plant:** `shop-extract`, `shop-witness`, `shop-pin` (groover-hangar) are first-class with mill plant. Extra shops: `foundry.json` `shopPlant`. Not `"costume": true`. `npx @0xray/foundry inspect --skip-live` is the receipt.
 
-**Sound plant:** Dist audio beds get a real plant like mill. `"plant": "sound"` + `npx @0xray/foundry sound render` writes a crystal-clear wav (Rippel membrane/metal/mixer, not a sine toy) and a bed receipt. Inspect checks loudness/smoothness gates — not fake code-mill skills on a sound seat.
+**Sound plant:** Dist audio beds are a mill (`@0xray/blip`), not a foundry organ catalog. Alias `"plant": "sound"` + `npx @0xray/foundry sound render` writes a crystal-clear wav (Rippel membrane/metal/mixer, not a sine toy) and a bed receipt. `sound-mixer` (`npx @0xray/foundry sound mix`) lives in the mill and levels every genre × tempo × motif — hats, plate, glue — not just the last bed. CLI shim `foundry sound` remains (0.1.11+). Inspect is mill-exported — not fake code-mill skills on a sound seat.
 
-**Blip plant:** New factory plant sibling to mill + sound (not a mill copy). Hangar shop pair later. `"plant": "blip"` + `npx @0xray/foundry blip render --brief "..." --mode still|motion:orb` writes a 4.44s mp4 **with an audio bed**. Registry v0: still + Rippel five (`orb` `swirl` `snap` `waves` `spark`). Motions are Rippel v2 `VisualConfig.circles` at ≥720p — sharp look + tempo/frequency animation on all five (wireframe is `--engine wireframe` only). Auto bed syncopates to the motion grid. Each mint wears a sparse seed mesh plus field accents (stars, grids, gradients, blinkers); receipt `visualConfig.mesh` + `visualConfig.field` are the fingerprints. `kapow` is a growth stub. `still` is the Power Plant ident — plate dissolves over 4.44s at ≥720p (`#08090B` `#F5F7FA` `#3DE0E8` `#F5C518` `#4A7FD4`), not a frozen poster. Inspect checks duration / mode id / file / audio.
+**Blip plant:** Product mill `@0xray/blip` (not a mill copy). Hangar shop pair later. Alias `"plant": "blip"` + `npx @0xray/foundry blip render --brief "..." --mode still|motion:orb` writes a 4.44s mp4 **with an audio bed**. Registry v0: still + Rippel five (`orb` `swirl` `snap` `waves` `spark`). Motions are Rippel v2 `VisualConfig.circles` at ≥720p — sharp look + tempo/frequency animation on all five (wireframe is `--engine wireframe` only). Auto bed syncopates to the motion grid. Each mint wears a sparse seed mesh plus field accents (stars, grids, gradients, blinkers); receipt `visualConfig.mesh` + `visualConfig.field` are the fingerprints. `kapow` is a design opt (`motion:kapow`) — two-tier comic stamp on the same stanza. Organs live in the mill: `blip-vibe` (`npx @0xray/foundry blip vibe`) scores stamp density; `blip-looker` (`npx @0xray/foundry blip look`) is the friend hitting replay; appeal 0–10; ship bar is **8**. `still` is the Power Plant ident — plate dissolves over 4.44s at ≥720p (`#08090B` `#F5F7FA` `#3DE0E8` `#F5C518` `#4A7FD4`), not a frozen poster. Adding an organ is a mill publish, not an xray catalog PR. CLI shim `foundry blip` remains (0.1.11+). Inspect checks duration / mode id / file / audio.
 
 ## Memory routing + Repertoire (v3.3+)
 
-**Station is the successor card** (Read `.xray/state/STATION.md`). Repertoire 0.2 is a thin routing seed (8 factory names). 0.1.0–0.1.8 were the same judgment organ; do not pin 0.1.8 for mill wear. Split: `docs-site/docs/guides/station-vs-repertoire.md`.
+**Station is the successor card** (Read `.xray/state/STATION.md`). Repertoire 0.2 is a thin routing seed (8 factory names). The worn mill reads the **project copy** under `.xray/state/repertoire/`. 0.1.0–0.1.8 were the same judgment organ; do not pin 0.1.8 for mill wear. Split: `docs-site/docs/guides/station-vs-repertoire.md`.
 
 `xray/features.json` → `memory_routing` (schema: `features.schema.json`):
 
@@ -68,7 +71,7 @@ Governance deliberation: **code-review**, **security-audit**, **researcher** wit
   "provider": "repertoire",
   "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
   "config": {
-    "signalsPath": "node_modules/@0xray/repertoire/data/curated_signals.json",
+    "signalsPath": ".xray/state/repertoire/curated_signals.json",
     "statePath": ".xray/state/repertoire/inference-state.json",
     "feedbackDir": ".xray/state/repertoire/feedback"
   }

package/README.md

@@ -13,14 +13,14 @@ Not a catalog of agents. The product is the **skeleton you wear**.
 - **Bone** — three-subsystem OS: Inference · External Governance (Dynamo / Codex) · Autonomous Engine (thinDispatch)
 - **Always on** — Codex 11 / 29 / 69, destructive shell, no new MCP/skill/handler surface
 - **Temperament** — `frontier` | `guided` | `strict` | `auto` — how loud the engine is, not whether governance exists
-- **Wear** — Grok, OpenCode, Hermes, OpenClaw. One SSOT gate
+- **Wear** — Grok, OpenCode, Hermes, OpenClaw, plus Cursor project hooks. One SSOT gate
 - **Muscle** — Repertoire: auto-enables when the module resolves; session-start writes a one-line resume so the next station is not born amnesiac
 
 ```bash
 npm install 0xray
 ```
 
-Consumer `npm install 0xray` auto-wires four platform bridges and seven MCP servers. Repertoire **0.2** is the factory memory organ (vendored): seed primitives, in-process routing, extra host MCP `repertoire`. Not an eighth `xray-*` server. Opt out with `"enabled": false, "provider": "repertoire"`.
+Consumer `npm install 0xray` auto-wires four chat bridges, Cursor project hooks, and seven MCP servers. Repertoire **0.2** is the factory memory organ (vendored): seed primitives, in-process routing, extra host MCP `repertoire`. Not an eighth `xray-*` server. Opt out with `"enabled": false, "provider": "repertoire"`.
 
 ## Quick Start
 
@@ -51,7 +51,7 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 
 | Version | Highlights |
 |---------|------------|
-| **Unreleased** | Shop plant first-class (`shop-extract`, `shop-witness`, `shop-pin` + `foundry.json` `shopPlant`). Not `"costume": true`. Root `llms.txt`. Pack→tmp fasten proof. |
+| **Unreleased** | Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill declares (looker / vibe / mixer live in the mill). Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip\|sound` remain (0.1.11+). Shop plant first-class (`shop-extract`, `shop-witness`, `shop-pin` + `foundry.json` `shopPlant`). 0xray stays 4.0.15. |
 | **4.0.9** | Mill target: postinstall does not mill npm global prefix or `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. |
 | **4.0.0** | Exo + temperament. Constitution always on; ceremony by host. Repertoire organ on (vendored 0.2). Station card survives compact/host-swap. **On npm.** [vision](docs-site/docs/architecture/v4-vision.md) · [now](docs-site/docs/architecture/v4-now.md) |
 | **3.4.1** | Unified `install-bridges.cjs` on postinstall — OpenCode, Grok, Hermes, OpenClaw in one pass. All 7 MCPs servers via `npx -y 0xray mcp <cmd>` (no `dist/` paths). Canonical `release.mjs` pipeline. |
@@ -103,11 +103,11 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 On `npm install 0xray` in a consumer project, postinstall automatically:
 
 1. Copies **`AGENTS-consumer.md` → `AGENTS.md`**. Does **not** write consumer-root **`SKILLS.md`**.
-2. Fastens **mill plant** (`mill` + `inspect`). Sound seats: `foundry.json` `"plant": "sound"` fastens the bed factory (`sound` + `sound-inspect`) and turns mill off. Blip seats: `foundry.json` `"plant": "blip"` fastens the tiny-video factory (`blip` + `blip-inspect`) and turns mill off. Not a 45-skill / 42-agent costume dump. `foundry.json` `"costume": true` is the opt-in dump.
+2. Fastens **mill plant** (`mill` + `inspect`). Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares — organs (looker, vibe, mixer) live in the mill, not an xray catalog. Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip|sound` still exist on foundry 0.1.11+; fasten is the new cut. Not a 45-skill / 42-agent costume dump. `foundry.json` `"costume": true` is the opt-in dump.
 3. Seeds **`.gitignore`** from `.gitignore.default` (if absent)
 4. Deploys **`.xray/`** config (`codex.json`, `features.json`, `config.json`) then overlays **their** plant
 5. Writes project **`.mcp.json`** with 7 MCPs servers (`npx -y 0xray mcp …`)
-6. Installs **4 bridges**: OpenCode, Grok, Hermes, OpenClaw (PPE + wiring; mill plant, not costume)
+6. Installs **4 chat bridges**: OpenCode, Grok, Hermes, OpenClaw, plus **Cursor** `.cursor/hooks.json` (PPE + wiring; mill plant, not costume)
 7. Factory shop plant (`shop-extract`, `shop-witness`, `shop-pin` from groover-hangar) may coexist when worn. Extra shops: `foundry.json` `shopPlant`. Not costume.
 8. Installs git pre-commit hook (non-blocking if not a git repo)
 
@@ -159,7 +159,7 @@ Pluggable `memory_routing` block in `features.json` (validated by `features.sche
   "provider": "repertoire",
   "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
   "config": {
-    "signalsPath": "node_modules/@0xray/repertoire/data/curated_signals.json",
+    "signalsPath": ".xray/state/repertoire/curated_signals.json",
     "statePath": ".xray/state/repertoire/inference-state.json",
     "feedbackDir": ".xray/state/repertoire/feedback"
   }
@@ -188,6 +188,7 @@ Docs: [memory routing](docs-site/docs/guides/memory-routing.md) · [Repertoire](
 | **Grok CLI / Build** | `npx 0xray grok install` | Project `.grok/plugins/0xray` (shared HOME does not clobber machine plugin), 7 MCPs servers |
 | **Hermes Agent** | `npx 0xray hermes install` | `~/.hermes/plugins/xray-hermes`, consumer root marker |
 | **OpenClaw** | `npx 0xray openclaw install` | `.xray/config/openclaw.json`, skill sync |
+| **Cursor** | postinstall (`installCursorBridge`) | Fastens `.cursor/hooks.json` (preToolUse / preCompact / afterFileEdit). Leaves an existing file alone. Not a fifth chat TUI. |
 
 ## Governance & Codex
 
@@ -202,7 +203,7 @@ Docs: [memory routing](docs-site/docs/guides/memory-routing.md) · [Repertoire](
 | Suite | Status (v4.0.1) |
 |-------|-----------------|
 | Four-floor consumer e2e | OpenCode 34/0 · Grok 63/0 · Hermes 39/0/2 · OpenClaw 96/0/1 (npm 4.0.0 pack) |
-| Consumer smoke | `npm run release:gate` — pack → clean install → 7 MCPs + 4 bridges + organ on |
+| Consumer smoke | `npm run release:gate` — pack → clean install → 7 MCPs + 4 chat bridges + Cursor hooks + organ on |
 | Pack → tmp proof | `npm run pack:tmp-proof` — tgz install + `foundry mint --skip-live` + hangar shops + inspect (no costume dump). Playwright n/a (CLI). |
 
 ```bash

package/SKILLS.md

@@ -2,7 +2,7 @@
 
 **4.0** — a suit that survives the context window
 
-**45 skills** in this exo catalog. Default consumer plant is **`mill` + `inspect`**, not this dump. `npm install 0xray` does **not** sync 45 skills unless `foundry.json` `"costume": true`. Factory shop plant (`shop-extract`, `shop-witness`, `shop-pin`) coexists with mill plant when a hangar wears those shops. Extra shops: `foundry.json` `shopPlant`. Sound seats: `foundry.json` `"plant": "sound"` (foundry plant, not this catalog). Blip seats: `foundry.json` `"plant": "blip"` (foundry plant, not this catalog). Agent map: [llms.txt](llms.txt).
+**45 skills** in this exo catalog. Default consumer plant is **`mill` + `inspect`**, not this dump. `npm install 0xray` does **not** sync 45 skills unless `foundry.json` `"costume": true`. Factory shop plant (`shop-extract`, `shop-witness`, `shop-pin`) coexists with mill plant when a hangar wears those shops. Extra shops: `foundry.json` `shopPlant`. Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares — organs (looker, vibe, mixer) live in the mill, not this catalog. Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip|sound` still exist on foundry 0.1.11+. Agent map: [llms.txt](llms.txt).
 
 xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) as the **costume / self-plant catalog**. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`) or when you plant them. This file is the exo catalog — mill does **not** write it to the consumer root.
 
@@ -76,7 +76,7 @@ xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) as the **costume /
 
 | Skill | Agent | Description |
 |-------|-------|-------------|
-| `orchestrator` | @orchestrator | Multi-agent coordination + **lead-dev mode** (codex 67–68) |
+| `orchestrator` | @orchestrator | Multi-agent coordination + **lead-dev mode** (codex 67–68) + lead cadence (dispatch four lines; critic Reads SEATS; ship matrix A–D in `LEAD-CADENCE.md`) |
 | `xray-orchestrator` | — | xray orchestration skill (MCP orchestrator surface) |
 | `processor-pipeline` | — | Data processing pipeline management |
 | `boot-orchestrator` | — | Framework boot orchestration |
@@ -150,6 +150,7 @@ npx 0xray skill:install <source>
 | OpenCode (after setup) | `.opencode/skills/<name>/SKILL.md` |
 | Grok | project `.grok/plugins/0xray/skills/<name>/SKILL.md` (machine `~/.grok/plugins/0xray` is not last-wins) |
 | Hermes / OpenClaw | Platform skill dirs (postinstall sync) |
+| Cursor | Project `.cursor/hooks.json` (PPE + Station heat). Not a skill dump. |
 
 ## Related features (since 3.1)
 

package/dist/AGENTS.md

@@ -12,6 +12,8 @@ Quick reference for the xray AI orchestration framework (**4.0**).
 
 Before other work, Read `.xray/state/STATION.md`. Compaction and host change are the same cut. Continue the card. Do not restart the job. Grok does not inject the card (OpenCode does) — this Read is the Grok contract. Do not thicken the Grok exo.
 
+**Lead cadence:** a peer wearing this file + Station + Repertoire continues without a command stream. Dummy bodies test `SKILLS.md`. Same-sess bodies wear the suit and keep a Station card. Always branch + worktree + PR. Ship when mill-gate D + `foundry gate` PASS (`LEAD-CADENCE.md` Decision matrix) — green CI is not ship. npm OTP in a browser, then poll the new version before moving on. Loop until Station is done. Live ticks and moving workstreams — not idle pacers. Same critic (resume only). Disk SSOT: `grok-bot/ops/LEAD-CADENCE.md`. Playbook: `orchestrator` skill.
+
 ## What is xray?
 
 xray provides intelligent multi-agent orchestration with automatic delegation and Codex compliance validation under the pure v2 three-subsystem model:
@@ -43,22 +45,23 @@ Governance deliberation: **code-review**, **security-audit**, **researcher** wit
 `postinstall.cjs` → `installAllBridges()`:
 
 1. `AGENTS-consumer.md` → `AGENTS.md` (does **not** write consumer-root `SKILLS.md`)
-2. Fasten mill plant (`mill` + `inspect`). Sound seats: `foundry.json` `"plant": "sound"` fastens `sound` + `sound-inspect` and turns mill off. Blip seats: `foundry.json` `"plant": "blip"` fastens `blip` + `blip-inspect` and turns mill off. Not a 45-skill costume dump unless `foundry.json` `"costume": true`
+2. Fasten mill plant (`mill` + `inspect`). Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares (looker, vibe, mixer, blip-inspect, blip-vibe, blip-looker, sound-inspect, sound-mixer live in the mill). Not a 45-skill costume dump unless `foundry.json` `"costume": true`
 3. `.gitignore.default` → `.gitignore` (if absent)
 4. `.xray/` config (`codex.json`, `features.json`, `config.json`) then overlay their plant
 5. `.mcp.json` (7 servers)
-6. Four bridges: OpenCode, Grok, Hermes, OpenClaw. Grok last-mile dest is project `.grok/plugins/0xray` (shared HOME does not last-wins clobber machine `~/.grok/plugins/0xray`)
-7. Optional git hooks
+6. Four chat bridges: OpenCode, Grok, Hermes, OpenClaw. Grok last-mile dest is project `.grok/plugins/0xray` (shared HOME does not last-wins clobber machine `~/.grok/plugins/0xray`)
+7. Cursor fifth wear: fasten `.cursor/hooks.json` when absent (preToolUse / preCompact / afterFileEdit). Leaves an existing file alone. Not a fifth chat TUI.
+8. Optional git hooks
 
 **Shop plant:** `shop-extract`, `shop-witness`, `shop-pin` (groover-hangar) are first-class with mill plant. Extra shops: `foundry.json` `shopPlant`. Not `"costume": true`. `npx @0xray/foundry inspect --skip-live` is the receipt.
 
-**Sound plant:** Dist audio beds get a real plant like mill. `"plant": "sound"` + `npx @0xray/foundry sound render` writes a crystal-clear wav (Rippel membrane/metal/mixer, not a sine toy) and a bed receipt. Inspect checks loudness/smoothness gates — not fake code-mill skills on a sound seat.
+**Sound plant:** Dist audio beds are a mill (`@0xray/blip`), not a foundry organ catalog. Alias `"plant": "sound"` + `npx @0xray/foundry sound render` writes a crystal-clear wav (Rippel membrane/metal/mixer, not a sine toy) and a bed receipt. `sound-mixer` (`npx @0xray/foundry sound mix`) lives in the mill and levels every genre × tempo × motif — hats, plate, glue — not just the last bed. CLI shim `foundry sound` remains (0.1.11+). Inspect is mill-exported — not fake code-mill skills on a sound seat.
 
-**Blip plant:** New factory plant sibling to mill + sound (not a mill copy). Hangar shop pair later. `"plant": "blip"` + `npx @0xray/foundry blip render --brief "..." --mode still|motion:orb` writes a 4.44s mp4 **with an audio bed**. Registry v0: still + Rippel five (`orb` `swirl` `snap` `waves` `spark`). Motions are Rippel v2 `VisualConfig.circles` at ≥720p — sharp look + tempo/frequency animation on all five (wireframe is `--engine wireframe` only). Auto bed syncopates to the motion grid. Each mint wears a sparse seed mesh plus field accents (stars, grids, gradients, blinkers); receipt `visualConfig.mesh` + `visualConfig.field` are the fingerprints. `kapow` is a growth stub. `still` is the Power Plant ident — plate dissolves over 4.44s at ≥720p (`#08090B` `#F5F7FA` `#3DE0E8` `#F5C518` `#4A7FD4`), not a frozen poster. Inspect checks duration / mode id / file / audio.
+**Blip plant:** Product mill `@0xray/blip` (not a mill copy). Hangar shop pair later. Alias `"plant": "blip"` + `npx @0xray/foundry blip render --brief "..." --mode still|motion:orb` writes a 4.44s mp4 **with an audio bed**. Registry v0: still + Rippel five (`orb` `swirl` `snap` `waves` `spark`). Motions are Rippel v2 `VisualConfig.circles` at ≥720p — sharp look + tempo/frequency animation on all five (wireframe is `--engine wireframe` only). Auto bed syncopates to the motion grid. Each mint wears a sparse seed mesh plus field accents (stars, grids, gradients, blinkers); receipt `visualConfig.mesh` + `visualConfig.field` are the fingerprints. `kapow` is a design opt (`motion:kapow`) — two-tier comic stamp on the same stanza. Organs live in the mill: `blip-vibe` (`npx @0xray/foundry blip vibe`) scores stamp density; `blip-looker` (`npx @0xray/foundry blip look`) is the friend hitting replay; appeal 0–10; ship bar is **8**. `still` is the Power Plant ident — plate dissolves over 4.44s at ≥720p (`#08090B` `#F5F7FA` `#3DE0E8` `#F5C518` `#4A7FD4`), not a frozen poster. Adding an organ is a mill publish, not an xray catalog PR. CLI shim `foundry blip` remains (0.1.11+). Inspect checks duration / mode id / file / audio.
 
 ## Memory routing + Repertoire (v3.3+)
 
-**Station is the successor card** (Read `.xray/state/STATION.md`). Repertoire 0.2 is a thin routing seed (8 factory names). 0.1.0–0.1.8 were the same judgment organ; do not pin 0.1.8 for mill wear. Split: `docs-site/docs/guides/station-vs-repertoire.md`.
+**Station is the successor card** (Read `.xray/state/STATION.md`). Repertoire 0.2 is a thin routing seed (8 factory names). The worn mill reads the **project copy** under `.xray/state/repertoire/`. 0.1.0–0.1.8 were the same judgment organ; do not pin 0.1.8 for mill wear. Split: `docs-site/docs/guides/station-vs-repertoire.md`.
 
 `xray/features.json` → `memory_routing` (schema: `features.schema.json`):
 
@@ -68,7 +71,7 @@ Governance deliberation: **code-review**, **security-audit**, **researcher** wit
   "provider": "repertoire",
   "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
   "config": {
-    "signalsPath": "node_modules/@0xray/repertoire/data/curated_signals.json",
+    "signalsPath": ".xray/state/repertoire/curated_signals.json",
     "statePath": ".xray/state/repertoire/inference-state.json",
     "feedbackDir": ".xray/state/repertoire/feedback"
   }

package/dist/CHANGELOG.md

@@ -6,11 +6,82 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 
 ## [Unreleased]
 
+### ✨ Features
+- **Cursor fifth wear** — `install-bridges.cjs` fastens project `.cursor/hooks.json` (preToolUse / preCompact / afterFileEdit) so Cursor Cloud heats Station and gates tools. Leaves an existing file alone. Not a fifth chat TUI. No new MCP/skill surface. Pack gate (`REQUIRED_PACK_PATHS`) now requires `dist/integrations/cursor/hooks/{hooks.json,pre-tool-use.js,pre-compact.js,after-file-edit.js,cursor-hook-utils.js,cursor-usage-receipt.js}` so a published tarball cannot ship a dead consumer command. `preToolUse` / `afterFileEdit` rewrite the card when git HEAD or Repertoire count diverges — Ticket / Durable / Seed stay. OP-PROC stays in the hook, not on Station.
+
+### 📚 Documentation
+- Cursor fifth wear in README integrations table, AGENTS / AGENTS-consumer / SKILLS / llms.txt, and Docusaurus integrations / getting-started / consumer-migration.
+- **Lead cadence (syncopation)** — `grok-bot/ops/LEAD-CADENCE.md` is the peer-lead OP-PROC: dummy `SKILLS.md` tests, same-sess wear + Station card, npm OTP+poll, always branch/worktree/PR, loop until Station is done, workstreams not idle pacers. Wired into `orchestrator` skill, AGENTS hot-swap, OPS-CATALOG. Not a new skill (Codex 69).
+- **Repertoire project copy** — shipped `memory_routing.config.signalsPath` is `.xray/state/repertoire/curated_signals.json`. The factory tarball stays read-only. After compact the suit routes the living project names, not the 8-name seed.
+- **Board clock** — critique board wakes on PR events and resumes the same critic. Two idle pacers (reviewer + lead-reader) are forbidden; they inflate context and cause compact. Merge after PASS+CI (gate A). Publish only after mill-gate D + `foundry gate`.
+- **Dispatch encode** — lead cards ticket + PR URLs + “Wear, then review.” Critic OP-PROC lives on `SEATS.md` Reviewer. When a law is spoken twice, write it to disk this wake. No new skill.
+- **Ship decision matrix** — lead-owned. A PR+CI · B pack (`assert-packed-dist-cli` + consumer smoke) · C `npm run release:docs-check` · D `npx @0xray/foundry release --i-mean-it`. Green CI is not ship. Spend / credentials stay Ask-first. Host Auto Review may still card npm/Railway; that is not the OS decision.
+- **Metamorphosis** — an LLM becomes OP-PROC through in-context worn seats (same critic, same dummy, four-line dispatch). Spawning more bots is the old skin.
+- **Publish OTP latch** — stay logged in (do not `npm logout`). Every time run `npm publish --access public` in the live TTY (no `--auth-type=web`, no `--otp=` from chat, no `tee`). Paste the clickable `auth/cli` URL. Do not ask for a 6-digit authenticator code in chat. Do not press Enter. Do not hand publish to a browser subagent. Poll `npm view` until the version is live. Then prove **fresh** and **upgrade** registry installs. `npm view` is not an install.
+- **`npx 0xray validate` cleansed** — no longer shells leftover `.opencode/init.sh` (macOS `md5` + `enforcer-config.json`). Wear check: `REQUIRED_PACK_PATHS`, Cursor hooks, mill+inspect, repertoire. `init.sh` still boots OpenCode but accepts Linux `md5sum` and consumer `.xray/codex.json`.
+- **Swamp reflection (new arch)** — `docs/reflections/swamp-new-arch-reflection-2026-09-20.md`. Card, organ, hook. Lying metal. Live tarball lag.
+
+### 🔄 Changes
+- **Durable Hold npm** — heat + `cursorBootNeedsRefresh` + `npx 0xray validate` drop/fail `Hold npm` on Station. Identity stays. Mill-gate holds the ship latch. Not a new skill.
+- **Hangar catalog** — mill hangar docs use Clearing `GET /v1/catalog` as the directory (listed hangars: Groover DID + pin, plus solar + live shop), not a hardcoded extract/witness/pin route table. Groover MCP `list_hangars` reads that catalog. 0xray stays 4.0.15.
+- **foundry-plant/0** — fasten is a protocol any mill implements, not a 0xray-owned catalog of plant kinds. Builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (alias `"blip"`) fastens whatever that mill package declares. Organs (looker, vibe, mixer) live in the mill; adding one is a mill publish, not an xray catalog PR. Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip|sound` still exist on foundry 0.1.11+. 0xray stays 4.0.15.
+- **Blip/sound mills moved to `@0xray/blip`** — 4.44s drawers (render, kapow, vibe, wow-pass listen/cel, sound bed/mixer, looker) live in the blip product mill. `@0xray/foundry@0.1.11` shims `foundry blip|sound` including `blip look`. Railway plant consumes the product mill, not a hand-vendored copy. 0xray stays 4.0.15.
+
+---
+
+## [4.0.16] - 2026-09-20
+
+### 🔄 Changes
+
+### 🐛 Bug Fixes
+- fix: type validate pack paths — no untyped mjs import in src/cli (ff936b276)
+- fix: cleanse npx 0xray validate — wear check, not leftover init.sh (741cca410)
+
+### 📚 Documentation
+- docs: new-arch reflection after wading part of the swamp (12d1fff69)
+- docs: persist peer-boot seat bc-49e17122 after four-line wear (5c8be98bb)
+- docs: encode registry install as live-verify after npm view (bd32bd1c4)
+- docs: encode npm CLI OTP latch — lead publishes, no subagent (d600d12a2)
+
+### 🔎 Other Changes
+- Merge branch 'cursor/npm-cli-otp-fbe0' — OTP latch, two-path live-verify, cleanse leftover validate (568797952)
+
+---
+
+## [4.0.15] - 2026-09-17
+
+### ✨ Features
+- **Factory-blip vibe seat** — `blip-vibe` plant agent scores still + Rippel five + kapow on the same aesthetic organ. Appeal 0–10. Ship bar is **8**. Shared fill / tint / contrast / outline / flash / differ; kapow extras stay kapow-only. Kapow is a comic burst: 8–10 outer points, 6–8 inner, some spikes longer than others. `npx @0xray/foundry blip vibe`. Inspect stays duration / mode / file. No `@0xray/foundry` bump.
+- **Factory-sound mixer seat** — `sound-mixer` plant agent levels every genre × tempo × motif (hats, plate, glue, phrase). `npx @0xray/foundry sound mix`. Dries the plate, pulls hot hats, eases glue. Inspect stays the last-bed gate. No `@0xray/foundry` bump.
+- **Factory-blip kapow opt** — `--mode motion:kapow` is a two-tier stamp on the same stanza (outer cyan burst winds, inner gold burst + `KAPOW!` hit the jewel cut). Not a third look. v0 five stay. No `@0xray/foundry` bump.
+
+### 🐛 Bug Fixes
+- **Mixer matrix CI timeout** — the 60-seat `mixMatrix` mill test keeps the same gates; the `all` project 30s cap was killing a ~34s PASS on GitHub runners. Per-test timeout is 120s. No `@0xray/foundry` bump.
+
+### 🔄 Changes
+
+### 📚 Documentation
+- docs: Claim C compact 8 — quiz-first no restates (e66ffe11f)
+- docs: mention blip render on the consumer agents card (9cd6662bc)
+- docs: Claim C compact 7 — quiz-first still summarizer keep (931547be6)
+- docs: Claim C compact 6 — summarizer kept canaries, not the old window (a3a6a83a8)
+- docs: Claim C memory protocol — quiz-first, no canary values (b38dcd5d4)
+- docs: Station guide also denies mind-survival overclaim (af7b686ca)
+- docs: compact scores disk, not conversation memory (6cf1d5d2f)
+- docs: Station is survive-the-cut; Repertoire 0.1 is judgment (d87a39d37)
+
+### 🧪 Tests
+- test: Claim C quiz printer and canary leak scan for compact 7 (d1cff2de4)
+
 ---
 
 ## [4.0.14] - 2026-09-16
 
 ### ✨ Features
+- **Factory-blip music drop** — every genre bed hits on the jewel cut (shared crash + motif answer), stamps the hook cell on the tag, and keeps six tellable bodies. Not a sectionGain fader. Inspect still PASSes. No `@0xray/foundry` bump.
+- **Factory-blip drop seats** — cage recoils then whips (shards off the lantern). Cameras read as different shots (top flattens, low hero-lifts, dutch slashes the floor). Snap still cracks. Looker still eclipses. No `@0xray/foundry` bump.
+- **Factory-blip drop rupture** — orb-cage and snap crack on the turn (gold lantern / held slash through the noun), not a linear spin. Looker wears one large eclipse moon the noun eats. Floor still fades; the punch lives on the jewel. No `@0xray/foundry` bump.
+- **Factory-blip camera seats** — six seed shots (`front` `three-quarter` `top` `low` `dutch` `side`) plus a phrase travel / turn push-in. Cube jewel keeps its faces (quads → tris). Large faces actually fill. Floor fades on the turn. Horizon wash stays cyan/blue (no olive). Inner moons graze the disc so the noun can occlude. Embers stay tethered after the burst. `--camera` overrides; seed picks if omitted. Receipt `visualConfig.mesh.camera`. No `@0xray/foundry` bump.
 - **Factory-blip prod-grade phrase** — hook/turn/tag now crossfade (`hookEase`/`turnEase`/`tagEase`). Still plates dissolve (~300ms) instead of hard-cutting. Focus orb wears field + mesh mass so two briefs do not clone. Ambient bed writes a 3-section score (turn crash, tag stab, walk on turn). Mill stays deterministic — no LLM in the render loop. No `@0xray/foundry` bump.
 - **Factory-blip Rippel v2** — 4.44s is a Short: hook → turn → tag on one motion grid for picture and bed. Two looks (`focus` disc-satellites | `cage` Wu+field). Stereo AAC bed with a written motif (not `pick()` soup), better voices, mix pocket. Missing stream or inaudible bed FAILs inspect. No `@0xray/foundry` bump.
 - **Factory-blip plant** — new factory plant sibling to mill + sound (not a mill copy). `foundry.json` `"plant": "blip"` fastens `blip` + `blip-inspect`. Dynamic motion registry (not a frozen Rippel enum). v0: still + Rippel five (`still` `orb` `swirl` `snap` `waves` `spark`). `kapow` is a growth stub. Still generator wears the Power Plant intro plate (void `#08090B` · ink `#F5F7FA` · cyan `#3DE0E8` · gold `#F5C518` · agent blue `#4A7FD4`). Hangar shop pair later. Brief → seed → still|motion:<id> → 4.44s mp4 → `.xray/blip/receipt.json`. Unknown id FAIL. No `@0xray/foundry` bump.

package/dist/README.md

@@ -13,14 +13,14 @@ Not a catalog of agents. The product is the **skeleton you wear**.
 - **Bone** — three-subsystem OS: Inference · External Governance (Dynamo / Codex) · Autonomous Engine (thinDispatch)
 - **Always on** — Codex 11 / 29 / 69, destructive shell, no new MCP/skill/handler surface
 - **Temperament** — `frontier` | `guided` | `strict` | `auto` — how loud the engine is, not whether governance exists
-- **Wear** — Grok, OpenCode, Hermes, OpenClaw. One SSOT gate
+- **Wear** — Grok, OpenCode, Hermes, OpenClaw, plus Cursor project hooks. One SSOT gate
 - **Muscle** — Repertoire: auto-enables when the module resolves; session-start writes a one-line resume so the next station is not born amnesiac
 
 ```bash
 npm install 0xray
 ```
 
-Consumer `npm install 0xray` auto-wires four platform bridges and seven MCP servers. Repertoire **0.2** is the factory memory organ (vendored): seed primitives, in-process routing, extra host MCP `repertoire`. Not an eighth `xray-*` server. Opt out with `"enabled": false, "provider": "repertoire"`.
+Consumer `npm install 0xray` auto-wires four chat bridges, Cursor project hooks, and seven MCP servers. Repertoire **0.2** is the factory memory organ (vendored): seed primitives, in-process routing, extra host MCP `repertoire`. Not an eighth `xray-*` server. Opt out with `"enabled": false, "provider": "repertoire"`.
 
 ## Quick Start
 
@@ -51,7 +51,7 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 
 | Version | Highlights |
 |---------|------------|
-| **Unreleased** | Shop plant first-class (`shop-extract`, `shop-witness`, `shop-pin` + `foundry.json` `shopPlant`). Not `"costume": true`. Root `llms.txt`. Pack→tmp fasten proof. |
+| **Unreleased** | Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill declares (looker / vibe / mixer live in the mill). Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip\|sound` remain (0.1.11+). Shop plant first-class (`shop-extract`, `shop-witness`, `shop-pin` + `foundry.json` `shopPlant`). 0xray stays 4.0.15. |
 | **4.0.9** | Mill target: postinstall does not mill npm global prefix or `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. |
 | **4.0.0** | Exo + temperament. Constitution always on; ceremony by host. Repertoire organ on (vendored 0.2). Station card survives compact/host-swap. **On npm.** [vision](docs-site/docs/architecture/v4-vision.md) · [now](docs-site/docs/architecture/v4-now.md) |
 | **3.4.1** | Unified `install-bridges.cjs` on postinstall — OpenCode, Grok, Hermes, OpenClaw in one pass. All 7 MCPs servers via `npx -y 0xray mcp <cmd>` (no `dist/` paths). Canonical `release.mjs` pipeline. |
@@ -103,11 +103,11 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 On `npm install 0xray` in a consumer project, postinstall automatically:
 
 1. Copies **`AGENTS-consumer.md` → `AGENTS.md`**. Does **not** write consumer-root **`SKILLS.md`**.
-2. Fastens **mill plant** (`mill` + `inspect`). Sound seats: `foundry.json` `"plant": "sound"` fastens the bed factory (`sound` + `sound-inspect`) and turns mill off. Blip seats: `foundry.json` `"plant": "blip"` fastens the tiny-video factory (`blip` + `blip-inspect`) and turns mill off. Not a 45-skill / 42-agent costume dump. `foundry.json` `"costume": true` is the opt-in dump.
+2. Fastens **mill plant** (`mill` + `inspect`). Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares — organs (looker, vibe, mixer) live in the mill, not an xray catalog. Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip|sound` still exist on foundry 0.1.11+; fasten is the new cut. Not a 45-skill / 42-agent costume dump. `foundry.json` `"costume": true` is the opt-in dump.
 3. Seeds **`.gitignore`** from `.gitignore.default` (if absent)
 4. Deploys **`.xray/`** config (`codex.json`, `features.json`, `config.json`) then overlays **their** plant
 5. Writes project **`.mcp.json`** with 7 MCPs servers (`npx -y 0xray mcp …`)
-6. Installs **4 bridges**: OpenCode, Grok, Hermes, OpenClaw (PPE + wiring; mill plant, not costume)
+6. Installs **4 chat bridges**: OpenCode, Grok, Hermes, OpenClaw, plus **Cursor** `.cursor/hooks.json` (PPE + wiring; mill plant, not costume)
 7. Factory shop plant (`shop-extract`, `shop-witness`, `shop-pin` from groover-hangar) may coexist when worn. Extra shops: `foundry.json` `shopPlant`. Not costume.
 8. Installs git pre-commit hook (non-blocking if not a git repo)
 
@@ -159,7 +159,7 @@ Pluggable `memory_routing` block in `features.json` (validated by `features.sche
   "provider": "repertoire",
   "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
   "config": {
-    "signalsPath": "node_modules/@0xray/repertoire/data/curated_signals.json",
+    "signalsPath": ".xray/state/repertoire/curated_signals.json",
     "statePath": ".xray/state/repertoire/inference-state.json",
     "feedbackDir": ".xray/state/repertoire/feedback"
   }
@@ -188,6 +188,7 @@ Docs: [memory routing](docs-site/docs/guides/memory-routing.md) · [Repertoire](
 | **Grok CLI / Build** | `npx 0xray grok install` | Project `.grok/plugins/0xray` (shared HOME does not clobber machine plugin), 7 MCPs servers |
 | **Hermes Agent** | `npx 0xray hermes install` | `~/.hermes/plugins/xray-hermes`, consumer root marker |
 | **OpenClaw** | `npx 0xray openclaw install` | `.xray/config/openclaw.json`, skill sync |
+| **Cursor** | postinstall (`installCursorBridge`) | Fastens `.cursor/hooks.json` (preToolUse / preCompact / afterFileEdit). Leaves an existing file alone. Not a fifth chat TUI. |
 
 ## Governance & Codex
 
@@ -202,7 +203,7 @@ Docs: [memory routing](docs-site/docs/guides/memory-routing.md) · [Repertoire](
 | Suite | Status (v4.0.1) |
 |-------|-----------------|
 | Four-floor consumer e2e | OpenCode 34/0 · Grok 63/0 · Hermes 39/0/2 · OpenClaw 96/0/1 (npm 4.0.0 pack) |
-| Consumer smoke | `npm run release:gate` — pack → clean install → 7 MCPs + 4 bridges + organ on |
+| Consumer smoke | `npm run release:gate` — pack → clean install → 7 MCPs + 4 chat bridges + Cursor hooks + organ on |
 | Pack → tmp proof | `npm run pack:tmp-proof` — tgz install + `foundry mint --skip-live` + hangar shops + inspect (no costume dump). Playwright n/a (CLI). |
 
 ```bash

package/dist/SKILLS.md

@@ -2,7 +2,7 @@
 
 **4.0** — a suit that survives the context window
 
-**45 skills** in this exo catalog. Default consumer plant is **`mill` + `inspect`**, not this dump. `npm install 0xray` does **not** sync 45 skills unless `foundry.json` `"costume": true`. Factory shop plant (`shop-extract`, `shop-witness`, `shop-pin`) coexists with mill plant when a hangar wears those shops. Extra shops: `foundry.json` `shopPlant`. Sound seats: `foundry.json` `"plant": "sound"` (foundry plant, not this catalog). Blip seats: `foundry.json` `"plant": "blip"` (foundry plant, not this catalog). Agent map: [llms.txt](llms.txt).
+**45 skills** in this exo catalog. Default consumer plant is **`mill` + `inspect`**, not this dump. `npm install 0xray` does **not** sync 45 skills unless `foundry.json` `"costume": true`. Factory shop plant (`shop-extract`, `shop-witness`, `shop-pin`) coexists with mill plant when a hangar wears those shops. Extra shops: `foundry.json` `shopPlant`. Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares — organs (looker, vibe, mixer) live in the mill, not this catalog. Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip|sound` still exist on foundry 0.1.11+. Agent map: [llms.txt](llms.txt).
 
 xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) as the **costume / self-plant catalog**. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`) or when you plant them. This file is the exo catalog — mill does **not** write it to the consumer root.
 
@@ -76,7 +76,7 @@ xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) as the **costume /
 
 | Skill | Agent | Description |
 |-------|-------|-------------|
-| `orchestrator` | @orchestrator | Multi-agent coordination + **lead-dev mode** (codex 67–68) |
+| `orchestrator` | @orchestrator | Multi-agent coordination + **lead-dev mode** (codex 67–68) + lead cadence (dispatch four lines; critic Reads SEATS; ship matrix A–D in `LEAD-CADENCE.md`) |
 | `xray-orchestrator` | — | xray orchestration skill (MCP orchestrator surface) |
 | `processor-pipeline` | — | Data processing pipeline management |
 | `boot-orchestrator` | — | Framework boot orchestration |
@@ -150,6 +150,7 @@ npx 0xray skill:install <source>
 | OpenCode (after setup) | `.opencode/skills/<name>/SKILL.md` |
 | Grok | project `.grok/plugins/0xray/skills/<name>/SKILL.md` (machine `~/.grok/plugins/0xray` is not last-wins) |
 | Hermes / OpenClaw | Platform skill dirs (postinstall sync) |
+| Cursor | Project `.cursor/hooks.json` (PPE + Station heat). Not a skill dump. |
 
 ## Related features (since 3.1)
 

package/dist/cli/commands/hermes-install.js

@@ -1,10 +1,11 @@
 import fs from 'fs';
 import path from 'path';
 import { createRequire } from 'module';
+import { fileURLToPath } from 'node:url';
 import { frameworkLogger } from '../../core/framework-logger.js';
 import { syncBuiltinSkills } from './skill-install.js';
 import { mintAfterWear } from './foundry-mint-wear.js';
-const __dirname = path.dirname(new URL(import.meta.url).pathname);
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const require = createRequire(import.meta.url);
 const packageRoot = path.join(__dirname, '..', '..', '..');
 const millSuit = require(path.join(packageRoot, 'scripts', 'foundry', 'mint-suit.cjs'));

package/dist/cli/commands/openclaw-install.js

@@ -1,12 +1,13 @@
 import fs from 'fs';
 import path from 'path';
 import { createRequire } from 'module';
+import { fileURLToPath } from 'node:url';
 import { frameworkLogger } from '../../core/framework-logger.js';
 import { syncBuiltinSkills } from './skill-install.js';
 import { mintAfterWear } from './foundry-mint-wear.js';
 import { OpenClawConfigLoader } from '../../integrations/openclaw/config.js';
 import { writeSuitSessionBoot } from '../../nucleus/suit-temperament.js';
-const __dirname = path.dirname(new URL(import.meta.url).pathname);
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const require = createRequire(import.meta.url);
 const millSuit = require(path.join(__dirname, '..', '..', '..', 'scripts', 'foundry', 'mint-suit.cjs'));
 const wiring = require(path.join(__dirname, '..', '..', '..', 'scripts', 'node', 'bridge-mcp-wiring.cjs'));

package/dist/cli/commands/opencode-install.js

@@ -1,10 +1,11 @@
 import fs from 'fs';
 import path from 'path';
 import { createRequire } from 'module';
+import { fileURLToPath } from 'node:url';
 import { frameworkLogger } from '../../core/framework-logger.js';
 import { syncBuiltinSkills } from './skill-install.js';
 import { mintAfterWear, wantsCostume } from './foundry-mint-wear.js';
-const __dirname = path.dirname(new URL(import.meta.url).pathname);
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const require = createRequire(import.meta.url);
 const wiring = require(path.join(__dirname, '..', '..', '..', 'scripts', 'node', 'bridge-mcp-wiring.cjs'));
 export function registerOpencodeCommands(opencodeCmd) {