0xray 4.0.18 → 4.0.19

package/.grok-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.18",
+  "version": "4.0.19",
   "description": "0xRay suit for Grok, Hermes, OpenClaw, OpenCode: mill+inspect, Codex, 7 MCP servers. Costume 45/42 is opt-in foundry, not the default wear.",
   "author": {
     "name": "0xRay AI",

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.18",
+  "version": "4.0.19",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/dist/CHANGELOG.md

@@ -7,6 +7,7 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 ## [Unreleased]
 
 ### ✨ Features
+- **Vendored Repertoire 0.2.5** — `vendor/@0xray/repertoire` is the published 0.2.5 package (overlays included). Wear replaces an older leftover in `node_modules`. A newer user-installed copy is left alone. Boot reads worn `node_modules`, then vendor, then a sibling checkout last. Repertoire stays optional (`enabled: false` + `provider: repertoire`); Station is the memory when it is off.
 - **Cursor fifth wear** — `install-bridges.cjs` fastens project `.cursor/hooks.json` (preToolUse / preCompact / afterFileEdit) so Cursor Cloud heats Station and gates tools. Leaves an existing file alone. Not a fifth chat TUI. No new MCP/skill surface. Pack gate (`REQUIRED_PACK_PATHS`) now requires `dist/integrations/cursor/hooks/{hooks.json,pre-tool-use.js,pre-compact.js,after-file-edit.js,cursor-hook-utils.js,cursor-usage-receipt.js}` so a published tarball cannot ship a dead consumer command. `preToolUse` / `afterFileEdit` rewrite the card when git HEAD or Repertoire count diverges — Ticket / Durable / Seed stay. OP-PROC stays in the hook, not on Station.
 
 ### 📚 Documentation
@@ -34,6 +35,17 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 
 ---
 
+## [4.0.19] - 2026-09-22
+
+### ✨ Features
+- **Vendored Repertoire 0.2.5** — published 0.2.5 lives in `vendor/@0xray/repertoire`. Wear replaces older leftovers. Optional; Station is the memory when it is off.
+
+### 🔎 Other Changes
+- Load worn Repertoire first; sibling checkout last. (f8a90b531)
+- Put published Repertoire 0.2.5 inside 0xray vendor and wear it. (a90b0a7a4)
+
+---
+
 ## [4.0.18] - 2026-09-22
 
 ### 🔄 Changes

package/dist/integrations/hooks/station-hook-runtime.cjs

@@ -229,8 +229,8 @@ function notesPath(root) {
 function repertoirePackageRoots(root) {
   const candidates = [
     join(root, "node_modules", "@0xray", "repertoire"),
-    join(root, "..", "repertoire"),
     join(root, "vendor", "@0xray", "repertoire"),
+    join(root, "..", "repertoire"),
   ];
   const out = [];
   for (const pkgRoot of candidates) {
@@ -535,7 +535,9 @@ function buildRepertoireResume(root) {
 }
 
 function applyStationHeat(root, host, extra = {}, existing = {}) {
-  const hydrate = hydrateDestOnWake(root);
+  const mr = readMemoryRoutingConfig(root);
+  const memoryOff = isExplicitMemoryRoutingOptOut(mr);
+  const hydrate = memoryOff ? { dest: null, added: 0, destCount: 0 } : hydrateDestOnWake(root);
   const captured = maybeCaptureSessionOnHeadMove(root);
   const pickup = readNotesPickup(root);
   const approaches = readLatestSessionApproaches(root);
@@ -569,7 +571,7 @@ function applyStationHeat(root, host, extra = {}, existing = {}) {
   }
   const priorWorking = readRepertoireWorking(root);
   const destCount = hydrate.destCount || (existsSync(destSignalsPath(root)) ? countCuratedSignals(destSignalsPath(root)) : 0);
-  if (!matchedSignals.length && matchText) {
+  if (!memoryOff && !matchedSignals.length && matchText) {
     if (
       !rematch &&
       priorWorking &&
@@ -608,6 +610,7 @@ function applyStationHeat(root, host, extra = {}, existing = {}) {
   const working = persistRepertoireWorking(root, workingSnapshot);
   const pickupChanged = Boolean(pickup && (!priorWorking || priorWorking.pickup !== pickup));
   if (
+    !memoryOff &&
     matchedSignals.length &&
     (isCompactHook(extra) || hydrate.added > 0 || pickupChanged)
   ) {

package/dist/integrations/hooks/station-memory-match.mjs

@@ -32,19 +32,19 @@ function providerCandidates() {
       : join(root, routing.module_path)
     : null;
   const raw = [
-    join(root, '..', 'repertoire', 'dist', 'provider', 'memory-routing-provider.js'),
-    join(root, 'node_modules', '@0xray', 'repertoire', 'dist', 'provider', 'memory-routing-provider.js'),
     configured,
+    join(root, 'node_modules', '@0xray', 'repertoire', 'dist', 'provider', 'memory-routing-provider.js'),
     join(root, 'vendor', '@0xray', 'repertoire', 'dist', 'provider', 'memory-routing-provider.js'),
+    join(root, '..', 'repertoire', 'dist', 'provider', 'memory-routing-provider.js'),
   ].filter(Boolean);
-  const withSubject = [];
-  const rest = [];
+  const seen = new Set();
+  const out = [];
   for (const dest of raw) {
-    const overlay = dest.replace(/dist\/provider\/memory-routing-provider\.js$/, 'data/subject-overlay.json');
-    if (existsSync(overlay)) withSubject.push(dest);
-    else rest.push(dest);
+    if (seen.has(dest)) continue;
+    seen.add(dest);
+    out.push(dest);
   }
-  return [...withSubject, ...rest];
+  return out;
 }
 
 async function loadProvider() {

package/dist/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.18",
+  "version": "4.0.19",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.18",
+  "version": "4.0.19",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",

package/scripts/node/consumer-install-smoke.mjs

@@ -92,7 +92,7 @@ function assertOrganRequire(tmpRoot) {
   if (organPkg.name !== "@0xray/repertoire") {
     throw new Error(`required organ name ${organPkg.name}`);
   }
-  if (organPkg.version !== "0.2.0") {
+  if (organPkg.version !== "0.2.5") {
     throw new Error(`required organ version ${organPkg.version}`);
   }
   if (fs.existsSync(path.join(tmpRoot, "vendor"))) {
@@ -165,8 +165,8 @@ function assertFreshInstallDefaults(tmpRoot, version) {
     throw new Error("vendored @0xray/repertoire missing from fresh tarball install");
   }
   const organ = JSON.parse(fs.readFileSync(organPkg, "utf-8"));
-  if (organ.version !== "0.2.0") {
-    throw new Error(`expected organ 0.2.0, got ${organ.version}`);
+  if (organ.version !== "0.2.5") {
+    throw new Error(`expected organ 0.2.5, got ${organ.version}`);
   }
   console.log("  ✅ .xray/features.json fresh-install defaults (opt-in off)");
   return { consumerFeaturesPath, features };

package/scripts/node/wear-vendored-repertoire.cjs

@@ -37,6 +37,41 @@ function destIsUsableRepertoire(dest) {
   return repertoirePackageName(dest) === "@0xray/repertoire";
 }
 
+function packageVersion(dir) {
+  try {
+    const version = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8")).version;
+    return typeof version === "string" ? version : "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+
+function versionLessThan(left, right) {
+  const a = String(left || "0").split(".").map((n) => Number.parseInt(n, 10) || 0);
+  const b = String(right || "0").split(".").map((n) => Number.parseInt(n, 10) || 0);
+  const n = Math.max(a.length, b.length);
+  for (let i = 0; i < n; i += 1) {
+    const av = a[i] || 0;
+    const bv = b[i] || 0;
+    if (av < bv) return true;
+    if (av > bv) return false;
+  }
+  return false;
+}
+
+function removeDestTree(dest) {
+  try {
+    const st = fs.lstatSync(dest);
+    if (st.isSymbolicLink()) {
+      fs.unlinkSync(dest);
+      return;
+    }
+  } catch {
+    return;
+  }
+  fs.rmSync(dest, { recursive: true, force: true });
+}
+
 function removeBrokenDest(dest) {
   try {
     const st = fs.lstatSync(dest);
@@ -51,7 +86,10 @@ function removeBrokenDest(dest) {
 function wearOne(vendor, dest, log) {
   removeBrokenDest(dest);
   if (destAlreadyWorn(dest, vendor)) return true;
-  if (fs.existsSync(dest) && destIsUsableRepertoire(dest)) return true;
+  if (fs.existsSync(dest) && destIsUsableRepertoire(dest)) {
+    if (!versionLessThan(packageVersion(dest), packageVersion(vendor))) return true;
+    removeDestTree(dest);
+  }
 
   fs.mkdirSync(path.dirname(dest), { recursive: true });
   const rel = path.relative(path.dirname(dest), vendor);

package/src/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.18",
+  "version": "4.0.19",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/vendor/@0xray/repertoire/AGENTS.md

@@ -74,9 +74,11 @@ Configure in `.xray/features.json`:
 "memory_routing": {
   "enabled": true,
   "provider": "repertoire",
-  "module_path": "../repertoire/dist/provider/memory-routing-provider.js",
+  "module_path": "./dist/provider/memory-routing-provider.js",
   "config": {
-    "signalsPath": "../repertoire/data/curated_signals.json"
+    "signalsPath": ".xray/state/repertoire/curated_signals.json",
+    "statePath": ".xray/state/repertoire/inference-state.json",
+    "feedbackDir": ".xray/state/repertoire/feedback"
   }
 }
 ```
@@ -94,6 +96,10 @@ Without Repertoire: `{ "enabled": false, "provider": "null" }`.
 
 Tools: `repertoire__get_task_confidence`, `repertoire__get_high_confidence_signals`, `repertoire__search_primitives`, `repertoire__ingest_feedback`.
 
+Factory seed (`data/curated_signals.json`) is read-only (8 names). `data/stack-overlay.json` merges into the project copy on hydrate so stack language survives a new clone. `data/subject-overlay.json` merges after that so dest knows what each organ/hangar is. `reloadOpProc` is factory + stack only. Live writes hydrate `.xray/state/repertoire/` even when cwd is this organ repo. Do not pin 0.1.8. Station is the survive-the-cut card — not this organ.
+
+Lead cadence lives in worn 0xRay (`grok-bot/ops/LEAD-CADENCE.md` + `orchestrator` skill). Project-local names `lead-cadence-syncopation`, `live-loop-not-pacer`, `peer-wears-without-commands` must route on this copy. A peer continues from Station + these names — no command stream.
+
 ## Codex OS (always on — not optional)
 
 The Universal Development Codex (`.xray/codex.json`, **69 terms**) is enforced by **PreToolUse** (blocks) and this section (brain). MCP enforcer is audit — not the gate.

package/vendor/@0xray/repertoire/README.md

@@ -2,7 +2,7 @@
 
 Factory memory organ for [0xRay](https://github.com/0xRayAI/xray): seed primitives, in-process memory routing, extra MCP (not an 8th `xray-*` server).
 
-**v0.2.0** · 0xRay **4.0** wear. Runtime does **not** depend on `0xray` (optional peer for suit-verify scripts).
+**v0.2.5** · 0xRay **4.0** wear. Runtime does **not** depend on `0xray` (optional peer for suit-verify scripts).
 
 ## Install
 
@@ -43,13 +43,17 @@ Default operating model: **`autonomy-command`** — lead dev, phased todos, suba
 }
 ```
 
-Bundled `data/curated_signals.json` is used by default. Override with env:
+Bundled `data/curated_signals.json` is **read-only** (8 factory trap names). `data/stack-overlay.json` is the committed stack-language overlay (OP-PROC). `data/subject-overlay.json` is what each workspace organ/hangar *is*. The provider hydrates a project copy under `.xray/state/repertoire/curated_signals.json` (seed + stack + subject) — including when cwd is this organ repo. Feedback never writes the tarball seed. Do not pin 0.1.8.
+
+Override with env:
 
 | Env | Default |
 |-----|---------|
-| `CURATED_SIGNALS_PATH` | `<package>/data/curated_signals.json` |
-| `REPERTOIRE_DATA_DIR` | `<package>/data` |
-| `REPERTOIRE_LOG_DIR` | `<package>/logs/groover-inference` |
+| `CURATED_SIGNALS_PATH` | factory seed (hydrated to `.xray/state/repertoire/curated_signals.json`) |
+| `REPERTOIRE_DATA_DIR` | `.xray/state/repertoire` |
+| `REPERTOIRE_STATE_PATH` | `.xray/state/repertoire/inference-state.json` |
+| `REPERTOIRE_LOG_DIR` | `.xray/state/repertoire/logs` |
+| `REPERTOIRE_FEEDBACK_DIR` | `.xray/state/repertoire/feedback` |
 
 ### Tools
 
@@ -60,6 +64,8 @@ Bundled `data/curated_signals.json` is used by default. Override with env:
 | `repertoire__get_high_confidence_signals` | Validated signals above threshold |
 | `repertoire__ingest_feedback` | Record orchestrator outcomes |
 
+Routing confidence is **time-weighted**: excess above the 0.55 gate fades after a 14-day grace (60-day half-life). Factory seed sitting on the gate keeps routing. `npm run signals:hygiene` reports decay on the hydrated project copy under `.xray/state/repertoire/`; it dry-runs in this repo unless `--i-mean-it` (writes the project copy, never the tarball).
+
 ## 0xRay memory routing (in-process)
 
 In `.xray/features.json` or `xray/features.json`:
@@ -76,8 +82,10 @@ In `.xray/features.json` or `xray/features.json`:
 
 ```json
 "config": {
-  "signalsPath": ".xray/curated_signals.json",
-  "logDir": "logs/groover-inference"
+  "signalsPath": ".xray/state/repertoire/curated_signals.json",
+  "statePath": ".xray/state/repertoire/inference-state.json",
+  "feedbackDir": ".xray/state/repertoire/feedback",
+  "logDir": ".xray/state/repertoire/logs"
 }
 ```
 
@@ -98,7 +106,26 @@ provider.getTaskConfidence?.({
 
 ## Field actuation add-ons (optional)
 
-Repertoire has **no Moltbook dependency**. It ingests **enriched JSONL** from any producer (`matched_primitives` + `match_confidence`) and closes the memory loop via consult, feedback, and post-tick ingest.
+Repertoire has **no Moltbook dependency**. It ingests **enriched JSONL** from an **explicit** producer (`matched_primitives` + `match_confidence`) and can grow the project dest — unknown primitives that pass the 0.55 gate are proposed as `field-observed`. **Groover is not Repertoire.** Groover was a broken experiment of how this organ was supposed to work. Do not treat Groover field (145-name `repertoire-brain`, sibling inference JSONL) as the dest becoming real. The factory seed stays 8 names. Do not pin `0.1.8`.
+
+```bash
+REPERTOIRE_FIELD_LOGS=/path/to/this-project/enriched npm run ingest
+npm run health:repertoire
+```
+
+`ingest` without `--path` and `--source groover` reads `REPERTOIRE_FIELD_LOGS` only. It does **not** walk `../groover/`. Health reads `.xray/state/repertoire/`, not the package tarball.
+
+## Compact reload (the 37 overlay names are OP-PROC)
+
+Station is the ticket. The overlay names (`station-survives-the-cut`, `repertoire-is-long-running-kb`, `compact-rekey-from-disk`, …) are the operating procedure.
+
+After compact the suit reloads OP-PROC by hydrating `.xray/state/repertoire/curated_signals.json` and reading that dest — not by restating commands and not by dumping names onto `STATION.md`. `reloadOpProc()` is that snapshot. 0xRay heat writes the same names onto `.xray/state/repertoire-working.json`.
+
+```bash
+npm run ingest -- --source xray
+```
+
+Walks `docs/inference` / `.xray/inference` `session-*.json` on this project and suited siblings. Grows dest from session-capture. Heats overlay names that already live on dest. `REPERTOIRE_XRAY_LOGS` is an explicit extra colon list.
 
 Each project activates its own public field surface if it wants one: