0xray 4.0.20 → 4.0.22

package/dist/memory-routing/provider-loader.js

@@ -59,7 +59,9 @@ function defaultPathForProvider(provider, cwd) {
 export function isExplicitMemoryRoutingOptOut(config) {
     return config.enabled === false && config.provider === 'repertoire';
 }
-/** Leftover shipped default: enabled false + provider null. Not an explicit opt-out. */
+/** Leftover shipped default: enabled false + provider null. Not an explicit opt-out.
+ *  resolveLeftoverEnabledConfig migrates old tarballs when the organ is on disk.
+ *  Explicit opt-out is enabled: false + provider: repertoire. */
 export function isLeftoverMemoryRoutingOff(config) {
     if (config.enabled === true)
         return false;

package/dist/nucleus/suit-temperament.d.ts

@@ -27,11 +27,6 @@ export declare function resolveSuitProfile(raw: SuitTemperamentConfig | undefine
  * A Hermes/OpenCode host ignores a leftover Grok boot (and vice versa).
  */
 export declare function resolveRuntimeSuitProfile(projectRoot: string, host?: SuitHost): SuitProfile;
-/**
- * Write station heat when this host/session has no live card yet.
- * OpenClaw has no SessionStart — PreToolUse is the session boundary.
- * Install/init cards without a session id are not a live session.
- */
 export declare function maybeHeatHostStation(projectRoot: string, host: SuitHost, extra?: Record<string, unknown>): string | null;
 /** Merge temperament fields into session-boot.json for the host that just started. */
 export declare function writeSuitSessionBoot(projectRoot: string, host: SuitHost, extra?: Record<string, unknown>): string;

package/dist/nucleus/suit-temperament.js

@@ -95,7 +95,13 @@ function concreteSessionId(value) {
  * OpenClaw has no SessionStart — PreToolUse is the session boundary.
  * Install/init cards without a session id are not a live session.
  */
+function isCursorWorkspaceWrapper(projectRoot) {
+    return (fs.existsSync(path.join(projectRoot, 'repos', 'xray')) ||
+        fs.existsSync(path.join(projectRoot, 'repos', 'repertoire')));
+}
 export function maybeHeatHostStation(projectRoot, host, extra = {}) {
+    if (isCursorWorkspaceWrapper(projectRoot))
+        return null;
     const bootPath = path.join(projectRoot, '.xray', 'state', 'session-boot.json');
     const cardPath = path.join(projectRoot, '.xray', 'state', 'STATION.md');
     let existing = {};
@@ -124,8 +130,14 @@ export function maybeHeatHostStation(projectRoot, host, extra = {}) {
 export function writeSuitSessionBoot(projectRoot, host, extra = {}) {
     const profile = resolveSuitProfile(loadSuitTemperamentRaw(projectRoot), host);
     const stateDir = path.join(projectRoot, '.xray', 'state');
-    fs.mkdirSync(stateDir, { recursive: true });
     const bootPath = path.join(stateDir, 'session-boot.json');
+    try {
+        fs.mkdirSync(stateDir, { recursive: true });
+    }
+    catch {
+        /* Cloud workspace wrapper is often unwritable — fail open */
+        return bootPath;
+    }
     let existing = {};
     if (fs.existsSync(bootPath)) {
         try {

package/dist/nucleus/thin-dispatch.js

@@ -7,7 +7,7 @@
  * Import from here or from delegation/index.ts (which re-exports these).
  */
 import { frameworkLogger } from "../core/framework-logger.js";
-import { getLevelFromScore, getAgentForTier, levelToTier, } from "../delegation/complexity-core.js";
+import { getLevelFromScore, getAgentForTier, getAgentCountForLevel, getStrategyForLevel, levelToTier, } from "../delegation/complexity-core.js";
 import { ComplexityAnalyzer } from "../delegation/complexity-analyzer.js";
 import { getMemoryRoutingProviderSync, initializeMemoryRouting, } from "../memory-routing/index.js";
 initializeMemoryRouting();
@@ -18,6 +18,9 @@ export const NUCLEUS_THIN_DISPATCH_VERSION = "0.1.0";
  */
 export function scoreComplexity(operation, context, thresholds) {
     const analyzer = new ComplexityAnalyzer();
+    if (thresholds) {
+        analyzer.setThresholds(thresholds);
+    }
     const metrics = analyzer.analyzeComplexity(operation, context);
     const score = analyzer.calculateComplexityScore(metrics);
     frameworkLogger.log("nucleus-thin-dispatch", "score-complexity", "info", {
@@ -76,7 +79,13 @@ export function scoreAndRoute(operation, context, thresholds) {
             signals: resolved.context.matchedSignals,
         });
         return {
-            score: { ...score, score: resolved.adjustedScore, level: adjustedLevel },
+            score: {
+                ...score,
+                score: resolved.adjustedScore,
+                level: adjustedLevel,
+                recommendedStrategy: getStrategyForLevel(adjustedLevel),
+                estimatedAgents: getAgentCountForLevel(adjustedLevel),
+            },
             agent,
             memoryRouting,
         };

package/dist/processors/implementations/agents-md-validation-processor.js

@@ -224,7 +224,7 @@ export class AgentsMdValidationProcessor {
                 "",
                 "## Codex",
                 "",
-                `0xRay enforces Universal Development Codex (60 terms) for systematic error prevention.`,
+                `0xRay enforces Universal Development Codex (69 terms) for systematic error prevention.`,
                 "",
             ].join("\n"),
             "## CLI Commands": [

package/dist/skills/hermes-agent/SKILL.md

@@ -64,7 +64,7 @@ Returns: pass/fail with per-file results and violations.
 
 ### xray_codex_check
 
-Validate code against the 60-term Universal Development Codex. Checks error-handling, type-safety, performance, security, architecture.
+Validate code against the 69-term Universal Development Codex. Checks error-handling, type-safety, performance, security, architecture.
 
 ```
 xray_codex_check(code="const x: any = foo()", operation="create")

package/dist/skills/orchestrator/SKILL.md

@@ -64,6 +64,10 @@ Config: `features.json` → `multi_agent_orchestration.lead_dev_mode`
 
 The seven rules are the engine. The cadence is the time signature. Disk SSOT: `grok-bot/ops/LEAD-CADENCE.md`.
 
+Jargon is not the job. Review and cadence ask whether the change works. Do not spend the loop reciting dest names, mill liturgy, or host mantras.
+
+- **Feat rebase:** when the mandated work turns into mantra, or the job has split across planes that no longer share one present, stop. Go up a level and answer the original message again from this seat. Do not continue the side thread and call that the job.
+
 - **Peer test:** another instance with only worn 0xRay continues the ticket. No command stream.
 - **Wear first:** Read `.xray/state/STATION.md`. Same cloud. Same critic (resume only). Dummy Reads Station.
 - **Dummy tests `SKILLS.md`:** a suited dummy proves the worn catalog. Same-sess bodies keep context and hold a Station card.
@@ -73,8 +77,26 @@ The seven rules are the engine. The cadence is the time signature. Disk SSOT: `g
 - **Live tick, not pacer:** `/loop` runs work now. Keep workstreams moving. Do not idle-wait 12 minutes. **Clean ticks every cycle** — unsubscribe then resubscribe so the prompt matches metal. Name-dedupe does not rewrite. A stale prompt (waiting URL after live, Hold after strip) is dirty: rewrite, do not act. **If the card and WAVEBOARD are idle, unsubscribe and do not resubscribe.**
 - **Board clock:** PR events + resume the same critic. Not two idle pacers. Merge after PASS+CI (gate A). Publish only after mill-gate D + `foundry gate`.
 - **Dispatch:** ticket + PR URLs + “Wear, then review.” The critic Reads `SEATS.md` Reviewer. Do not paste a command novel. When a law is spoken twice, encode it this wake.
+- **Cascade:** Chat is not the brain. A cascade that must survive compaction is a named repertoire signal on the stack overlay, hydrated onto the project law list. NOTES holds the same cascade for the second Read. Station stays the ticket. A reflection is not this capture. Capture priority: a law is an invariant you would otherwise re-read the source to relearn. One law per subsystem bone. Heat touches last_seen and does not append a confidence sample, so more hits do not raise conviction. Heat touches last_seen only when the diary contains that signal's name; two definition words are not a hit; a weak session score is not lifted to 0.55 and a sample below 0.55 is not recorded. Constructing the organ does not append workspace samples. Hero names: `heat-is-not-conviction`, `inference-cycle-invariant`, `governance-vote-invariant`, `thin-dispatch-invariant`. Repertoire mergeStackOverlay refreshes a changed stack definition and keeps observation stats.
+- **Cold brief:** a new critic or any new subagent that does not already have this thread gets the latest commit SHA on the branch under review (fetch it; do not reuse an earlier SHA from a previous pass) and the Station card (`.xray/state/STATION.md`: intent, plan, git). If the card is missing, give branch + HEAD + what just changed. If the branch moves after you brief them, send the new SHA before they verdict.
+- **Control:** The lead keeps control. Do not assume the subagent has the context. Give the duty, the latest SHA, the Station card, and the laws that apply. The subagent wears the applicable 0xRay suit before it works: the tree under review, built and installed. An older published package is not that suit. The lead checks the result.
+
+### Engine cadence
+
+This suite is the engine that builds the engine. When a seat sees OP-PROC, write it onto these existing surfaces in the same wake. Do not open a new skill.
+
+1. Change the engine with precision.
+2. Ship it local: build and install the tree. A live npm version stays live. Once a version is live, the stamper strips every present-tense patch pin from shipped guides and shipped OP-PROC, or reconcile advances the next cut. The stamper does not edit Station, NOTES, dest, or node_modules. It does not publish.
+3. Test the change.
+4. Run another deep review of the diff you just made.
+5. Monitor long-term memory (dest name count and whether observations are the only growth) and short-term memory (Station: intent, plan, git).
+6. Ship the PR.
+
+### Planes
+
+Operating planes: code, OP-PROC, model, suit, mill, host, and test/ship. Test/ship is the critical OP-PROC plane. Test then ship is the hero. Ship without that proof is the catastrophe. Long-term memory is the project law list. Each wake refreshes a changed stack definition and keeps observation stats. Heat writes the matched names onto Station, the short-term card that survives compaction. Reactive decisions move out of TypeScript into OP-PROC as the model improves. That move is why the mill and the suit exist. It is not fully proved. Once a version is live, the stamper strips every present-tense patch pin from shipped guides and shipped OP-PROC, or reconcile advances the next cut. The stamper does not edit Station, NOTES, dest, or node_modules. It does not publish. Do not freeze the live cut.
 - **Close:** loop until Station is done. Compact: Station survives the cut. Overlay dest names are OP-PROC — reload `repertoire-working.json` `opProcNames`, not Station.
 - **Board:** critic Strict comments; forge implements; lead stays main thread.
 - **Codex 69:** rewire this skill and existing ops. Do not add a new `SKILL.md` to hold the cadence.
-- **Ship matrix:** `LEAD-CADENCE.md` Decision matrix — A PR+CI · B pack · C `release:docs-check` · D `foundry release --i-mean-it`. Green CI is not ship. Spend / credentials stay Ask-first.
+- **Ship matrix:** `LEAD-CADENCE.md` Decision matrix — A PR+CI · B pack · C `release:docs-check` (`reconcile --check`; no patch stamps on guides) · D `foundry release --i-mean-it`. Green CI is not ship. Spend / credentials stay Ask-first. Patch number lives in `package.json` + CHANGELOG.
 - **Metamorphosis:** LLM → OP-PROC is in-context worn seats (same critic, same dummy, resume only). Not more bots.

package/llms.txt

@@ -35,7 +35,7 @@ Registered in `.mcp.json` as `npx -y 0xray mcp <cmd>`:
 | `xray-code-review` | Proposal quality |
 | `xray-architect-tools` | System design |
 
-Not an 8th `xray-*` server. Repertoire is a vendored organ (`npx @0xray/repertoire mcp`), enable-when-resolves. Survive compact is **Station** (Read `.xray/state/STATION.md`), not Repertoire 0.1.8.
+Not an 8th `xray-*` server. **Repertoire is preferred** — vendored 0.2.5 ships on (`npx @0xray/repertoire mcp`). Dest is named laws, not hangar `repo-*` or git slugs. Survive compact is **Station** (Read `.xray/state/STATION.md`). Station is the ticket, not a substitute for Repertoire. Do not pin 0.1.8.
 
 ## Codex 69 (always on)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.20",
+  "version": "4.0.22",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",
@@ -106,7 +106,7 @@
     "debug:inference:force": "XRAY_FORCE_MCP_GOVERNANCE=true XRAY_DEV_PATH=dist node dist/cli/index.js inference:run --force",
     "validate:full": "npm run validate",
     "test:unified": "node scripts/test/test-unified-framework.mjs",
-    "test:consumer": "node scripts/test/test-consumer-readiness.cjs",
+    "test:consumer": "node scripts/mjs/test-consumer-readiness.mjs",
     "config:setup": "node scripts/config/utils.js setup-dev",
     "monitoring:start": "node scripts/monitoring/daemon.js start",
     "monitoring:stop": "node scripts/monitoring/daemon.js stop",
@@ -124,7 +124,7 @@
     "consumer:smoke": "node scripts/node/consumer-install-smoke.mjs",
     "pack:tmp-proof": "node scripts/node/pack-tmp-suit-proof.mjs",
     "release:gate": "node scripts/foundry/release-gate.mjs",
-    "release:docs-check": "node scripts/foundry/validate-release-docs.mjs",
+    "release:docs-check": "node scripts/foundry/reconcile-version.mjs --check && node scripts/foundry/validate-release-docs.mjs",
     "pre-publish-guard": "node scripts/node/pre-publish-guard.js",
     "safe-publish": "npm run prepare-consumer && npm run build",
     "release:npm": "node scripts/foundry/release.mjs --publish-only",

package/scripts/foundry/CHANGELOG.md

@@ -4,6 +4,8 @@
 
 Shim `sound-voice.cjs` → `@0xray/blip/sound-voice`. Depend on published `@0xray/blip@^0.1.2`. Foundry stamp stays 0.1.12. Do not vendor mill drawers.
 
+Inspect `--go` emits a shop-style forge GO receipt (harness profile: bare / suited / partial). Observational by default: Cursor/Grok `hooks.json` bound, Repertoire fastened (`node_modules` or `.xray/state/repertoire`), Station present. `--require-harness=` gates dual-cloud A/B. Vendor Repertoire source and `memory_routing` declaration are not fasten. Not an 8th MCP. Not PPE. Not 5.0.
+
 ## [0.1.12] - 2026-09-18
 
 Fasten is foundry-plant/0: mill packages declare plants in package.json (`mill.protocol`, prefix selection when skills/agents are omitted) and foundry copies organs from that package. Builtin catalog is mill+inspect only; foundry does not catalog mill organs. `foundry.json` `"plant": "blip"|"sound"` are package aliases for `@0xray/blip`, not skill lists. Unknown mill packages fail closed (`npm i`). Inventory records `millPackage` and `millProtocol` when a mill package was used.

package/scripts/foundry/README.md

@@ -23,7 +23,7 @@ npx @0xray/foundry release [patch|minor|major] --i-mean-it
 npx @0xray/foundry release --publish-only --dry-run
 npx @0xray/foundry release --publish-only --i-mean-it
 npx @0xray/foundry mint
-npx @0xray/foundry inspect [--skip-live]
+npx @0xray/foundry inspect [--skip-live] [--go] [--go-out PATH] [--require-harness=bare|suited|partial]
 npx @0xray/foundry sound render [--brief TEXT] [--genre ambient|techno|jazz]
 npx @0xray/foundry sound inspect
 npx @0xray/foundry sound mix
@@ -39,7 +39,7 @@ npx @0xray/foundry hooks
 
 `FOUNDRY_ROOT` overrides cwd (the repo being milled).
 
-`gate` is build + test + docs-check. `docs-build` runs Docusaurus on the 0xray exo (`docs-site/`); stranger mills skip. `inspect` runs the six mill checks (diff, plant vs worn, receipt, CI, live tarball GET, isolated HOME). Mint fails on a costume dump. Isolated HOME skips machine `~/.grok`. Shared HOME last-mile dest is project `.grok/plugins/0xray` (no last-wins machine plugin). `ci` reports GitHub Actions (no auto-push). `hooks` installs git pre/post hooks. GitHub `0xRay CI/CD` is the mill gate on `main`. `Deploy Docs` is the mill Pages put.
+`gate` is build + test + docs-check. `docs-build` runs Docusaurus on the 0xray exo (`docs-site/`); stranger mills skip. `inspect` runs the six mill checks (diff, plant vs worn, receipt, CI, live tarball GET, isolated HOME) plus observational harness (Cursor/Grok hooks bound, Repertoire fastened, Station present). `--go` emits a shop-style forge GO receipt; `--require-harness=bare|suited|partial` turns that observation into a gate. Mint fails on a costume dump. Isolated HOME skips machine `~/.grok`. Shared HOME last-mile dest is project `.grok/plugins/0xray` (no last-wins machine plugin). `ci` reports GitHub Actions (no auto-push). `hooks` installs git pre/post hooks. GitHub `0xRay CI/CD` is the mill gate on `main`. `Deploy Docs` is the mill Pages put.
 
 `docs-check` and `gate` run **full** 0xRay corpus only when the milled `package.json` name is `0xray` and `docs-site/` exists. Otherwise **light**: `package.json` + CHANGELOG.
 
@@ -60,7 +60,7 @@ After mill plant is fastened, overlay their plant (defaults; remap in `foundry.j
 
 **Mill-fill is law:** their keys/files win; mill names they did not plant stay unless they overlay the same name. JSON facets always merge. Skill overlay is project dirs on every TUI floor (OpenCode, Grok, Hermes, OpenClaw). YML agents stay OpenCode. CLI re-wear calls mint **once** after mill copies. Isolated HOME is passwd home, not `os.homedir()`. CI report is `.xray/foundry-ci-report.json` (`.opencode/logs` shim).
 
-**Default mill plant:** `mill` + `inspect` (inspect AI work). Fasten is **foundry-plant/0**: builtin plant is mill+inspect only (files from this package `plant/`). Fastens a suit, not an empty one. Not 45/42 costume. `foundry.json` `"costume": true` copies that dump. Factory Repertoire still enable-when-resolves. PPE stays worn.
+**Default mill plant:** `mill` + `inspect` (inspect AI work). Fasten is **foundry-plant/0**: builtin plant is mill+inspect only (files from this package `plant/`). Fastens a suit, not an empty one. Not 45/42 costume. `foundry.json` `"costume": true` copies that dump. **Repertoire is preferred** (vendored, dest = laws). PPE stays worn.
 
 **foundry-plant/0:** `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares and ships in its own `plant/`. Organs (looker, vibe, mixer) live in the mill. Adding an organ is a mill publish, not a foundry catalog PR. CLI shims `foundry blip|sound` still exist on foundry 0.1.11+; fasten is the new cut. Foundry **0.1.12**.
 
@@ -76,7 +76,7 @@ A friend would hear: Blips should look like Rippel living motions with sound, no
 
 **Shop plant:** `shop-extract`, `shop-witness`, `shop-pin` are first-class with mill plant. Inspect does not treat those worn names as a costume dump. `foundry.json` `"shopPlant"` names more shops (array), a plant dir (string), or `{ "skills": [...], "dir": "..." }`. This is not `"costume": true` and does not copy 45/42.
 
-**4.0.9 mill target (0xray postinstall, not this mill package):** `install-bridges.cjs` does not mill npm global prefix or npx `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. Shared HOME Grok last-mile is project `.grok/plugins/0xray` (two seats do not clobber machine plugin). Nested mill **0.1.12** (foundry-plant/0; blip/sound drawers in `@0xray/blip`; inspect dest matches `resolveGrokPluginDests`).
+**Mill target (0xray postinstall, not this mill package):** `install-bridges.cjs` does not mill npm global prefix or npx `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. Shared HOME Grok last-mile is project `.grok/plugins/0xray` (two seats do not clobber machine plugin). Nested mill ships in the 0xray tarball (foundry-plant/0; blip/sound drawers in `@0xray/blip`; inspect dest matches `resolveGrokPluginDests`).
 
 ## Publish this mill
 

package/scripts/foundry/assert-packed-dist-cli.mjs

@@ -24,6 +24,10 @@ export const REQUIRED_PACK_PATHS = [
   "dist/integrations/cursor/hooks/after-file-edit.js",
   "dist/integrations/cursor/hooks/cursor-hook-utils.js",
   "dist/integrations/cursor/hooks/cursor-usage-receipt.js",
+  "dist/integrations/cursor/hooks/xray-cloud-hook.sh",
+  "dist/integrations/cursor/hooks/pre-tool-use.sh",
+  "dist/integrations/cursor/hooks/pre-compact.sh",
+  "dist/integrations/cursor/hooks/after-file-edit.sh",
 ];
 
 export function packedFilePaths(files) {

package/scripts/foundry/cli.mjs

@@ -29,7 +29,7 @@ const HELP =
   "Mill, not exo. FOUNDRY_ROOT overrides cwd (the repo being milled).\n" +
   "release bumps/commits/pushes/publishes the milled cwd — pass --dry-run or --i-mean-it (or FOUNDRY_RELEASE=1).\n" +
   "Mint fastens the requested factory plant (default mill; foundry.json plant: sound|blip turns mill off), then inspect.\n" +
-  "inspect runs mill checks plus, on a sound seat, last bed receipt PASS/FAIL; on a blip seat, last blip receipt.\n" +
+  "inspect runs mill checks plus, on a sound seat, last bed receipt PASS/FAIL; on a blip seat, last blip receipt. Observational harness (hooks / Repertoire / Station). --go emits a forge GO receipt. Not an 8th MCP.\n" +
   "sound render|inspect|mix is the factory-sound plant (brief → seed → genre → wav → metrics; mix levels every variation). Sibling to mill, not a mill copy.\n" +
   "blip render|inspect|vibe|look is the factory-blip plant (brief → seed → still|motion:<id> → 4.44s mp4; vibe is stamp density, look is the friend hitting replay, ship bar 8). Sibling to mill + sound.\n" +
   "gate is build+test. docs-build is Docusaurus on the 0xray exo. ci reports GitHub Actions (no auto-push). hooks installs git pre/post hooks.\n";

package/scripts/foundry/inspect.mjs

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
 /**
- * Mill inspect organ. Runs the six checks. Not an 8th MCP. Not PPE.
+ * Mill inspect organ. Runs the six plant checks plus observational harness.
+ * Not an 8th MCP. Not PPE. Does not fasten hooks or Repertoire.
  *
- *   npx @0xray/foundry inspect [--skip-live]
+ *   npx @0xray/foundry inspect [--skip-live] [--go] [--go-out PATH]
+ *     [--require-harness=bare|suited|partial] [--goal TEXT]
  */
 
 import { spawnSync } from "node:child_process";
@@ -63,6 +65,140 @@ function readJson(file) {
   }
 }
 
+const HARNESS_PROFILES = new Set(["bare", "suited", "partial"]);
+
+export function parseInspectArgs(argv = process.argv.slice(2)) {
+  const out = {
+    skipLive: false,
+    go: false,
+    goOut: null,
+    requireHarness: null,
+    goal: null,
+  };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--skip-live") out.skipLive = true;
+    else if (arg === "--go") out.go = true;
+    else if (arg === "--go-out") out.goOut = argv[++i] || null;
+    else if (arg.startsWith("--go-out=")) out.goOut = arg.slice("--go-out=".length);
+    else if (arg === "--require-harness") out.requireHarness = argv[++i] || null;
+    else if (arg.startsWith("--require-harness=")) {
+      out.requireHarness = arg.slice("--require-harness=".length);
+    } else if (arg === "--goal") out.goal = argv[++i] || null;
+    else if (arg.startsWith("--goal=")) out.goal = arg.slice("--goal=".length);
+  }
+  if (out.goOut) out.go = true;
+  return out;
+}
+
+function hooksFileBound(file) {
+  if (!fs.existsSync(file)) return false;
+  const json = readJson(file);
+  const hooks = json?.hooks;
+  if (!hooks || typeof hooks !== "object") return false;
+  return Object.values(hooks).some(
+    (list) =>
+      Array.isArray(list) &&
+      list.some((entry) => typeof entry?.command === "string" && entry.command.trim()),
+  );
+}
+
+export function classifyHarnessProfile({ hooksBound, repertoireFastened, stationPresent }) {
+  if (!hooksBound && !repertoireFastened && !stationPresent) return "bare";
+  if (hooksBound && repertoireFastened) return "suited";
+  return "partial";
+}
+
+export function probeHarness(root) {
+  const cursorHooks = path.join(root, ".cursor", "hooks.json");
+  const grokHooks = path.join(root, ".grok", "plugins", "0xray", "hooks", "hooks.json");
+  const grokPluginHooks = path.join(root, ".grok-plugin", "hooks", "hooks.json");
+  const hooks = {
+    cursor: hooksFileBound(cursorHooks),
+    grok: hooksFileBound(grokHooks) || hooksFileBound(grokPluginHooks),
+  };
+  hooks.bound = Boolean(hooks.cursor || hooks.grok);
+
+  const repertoire = {
+    nodeModules: fs.existsSync(path.join(root, "node_modules", "@0xray", "repertoire")),
+    state: fs.existsSync(path.join(root, ".xray", "state", "repertoire")),
+    vendorSource: fs.existsSync(path.join(root, "vendor", "@0xray", "repertoire")),
+  };
+  repertoire.fastened = Boolean(repertoire.nodeModules || repertoire.state);
+
+  const features =
+    readJson(path.join(root, ".xray", "features.json")) ||
+    readJson(path.join(root, "xray", "features.json"));
+  repertoire.memoryRoutingDeclared = features?.memory_routing?.provider === "repertoire";
+
+  const stationPresent = fs.existsSync(path.join(root, ".xray", "state", "STATION.md"));
+  const profile = classifyHarnessProfile({
+    hooksBound: hooks.bound,
+    repertoireFastened: repertoire.fastened,
+    stationPresent,
+  });
+
+  return {
+    id: "harness",
+    hooks,
+    repertoire,
+    station: { present: stationPresent },
+    profile,
+  };
+}
+
+export function checkHarness(root, requireHarness = null) {
+  const probe = probeHarness(root);
+  if (requireHarness && !HARNESS_PROFILES.has(requireHarness)) {
+    return {
+      ...probe,
+      ok: false,
+      require: requireHarness,
+      detail: `unknown --require-harness=${requireHarness} (bare|suited|partial)`,
+    };
+  }
+  if (requireHarness && probe.profile !== requireHarness) {
+    return {
+      ...probe,
+      ok: false,
+      require: requireHarness,
+      detail: `harness profile ${probe.profile} != required ${requireHarness}`,
+    };
+  }
+  return {
+    ...probe,
+    ok: true,
+    require: requireHarness,
+    skipped: !requireHarness,
+    detail: requireHarness ? null : "observational — pass --require-harness to gate",
+  };
+}
+
+function gitRemote(root) {
+  const remote = spawnSync("git", ["config", "--get", "remote.origin.url"], {
+    cwd: root,
+    encoding: "utf8",
+  });
+  if (remote.error || remote.status !== 0) return null;
+  return (remote.stdout || "").trim() || null;
+}
+
+export function buildForgeGo(root, harness, opts = {}) {
+  return {
+    kind: "forge-go",
+    mill: "inspect",
+    profile: harness.profile,
+    hooksBound: Boolean(harness.hooks?.bound),
+    repertoireFastened: Boolean(harness.repertoire?.fastened),
+    stationPresent: Boolean(harness.station?.present),
+    require: harness.require || null,
+    ok: harness.ok !== false,
+    goal: opts.goal || process.env.FOUNDRY_GO_GOAL || null,
+    repo: gitRemote(root),
+    generatedAt: new Date().toISOString(),
+  };
+}
+
 function checkDiff(root) {
   const status = spawnSync("git", ["status", "-sb"], { cwd: root, encoding: "utf8" });
   if (status.error || status.status === 128) {
@@ -412,6 +548,9 @@ export async function inspectSuit(root, opts = {}) {
   const skipLive = Boolean(opts.skipLive);
   const env = opts.env || process.env;
   const machineHome = opts.machineHome || mint.machineHome();
+  const requireHarness = opts.requireHarness || null;
+  const go = Boolean(opts.go);
+  const goal = opts.goal || null;
 
   const checks = [];
   checks.push(checkDiff(root));
@@ -445,22 +584,38 @@ export async function inspectSuit(root, opts = {}) {
   }
 
   checks.push(checkIsolatedHome(root, env, machineHome));
+  checks.push(checkHarness(root, requireHarness));
 
   const failed = checks.filter((c) => c.ok === false);
   const receipt = checks.find((c) => c.id === "receipt") || {};
-  return {
+  const harness = checks.find((c) => c.id === "harness") || {};
+  const report = {
     ok: failed.length === 0,
     failed: failed.map((c) => c.id),
     checks,
     dna: receipt.dna || null,
     pack: "0xray-suit",
   };
+  if (go) {
+    report.go = buildForgeGo(root, harness, { goal });
+  }
+  return report;
 }
 
 async function main() {
-  const skipLive = process.argv.includes("--skip-live");
+  const args = parseInspectArgs(process.argv.slice(2));
   const root = resolveMillRoot();
-  const report = await inspectSuit(root, { skipLive });
+  const report = await inspectSuit(root, {
+    skipLive: args.skipLive,
+    requireHarness: args.requireHarness,
+    go: args.go,
+    goal: args.goal,
+  });
+  if (args.goOut) {
+    const dest = path.isAbsolute(args.goOut) ? args.goOut : path.join(root, args.goOut);
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
+    fs.writeFileSync(dest, `${JSON.stringify(report.go || report, null, 2)}\n`);
+  }
   process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
   process.exit(report.ok ? 0 : 1);
 }

package/scripts/foundry/plant/skills/inspect/SKILL.md

@@ -17,6 +17,7 @@ Mill **does** these checks (`npx @0xray/foundry inspect`). Mint fails on a costu
 4. **CI.** GitHub mill CI report (`.opencode/logs/ci-cd-monitor-report.json`), not a green check in chat. No token is a skip, not a pass invented.
 5. **Live PUT.** HTTP 200 on the npm `.tgz`. Metadata without a tarball is not shipped.
 6. **Isolated HOME.** Last-mile dest is project `.grok/plugins/0xray`. Isolated HOME may wear `$HOME/.grok/plugins/0xray` and must not write machine `~/.grok/plugins/0xray`. Shared HOME (passwd `$HOME`) does not last-wins clobber the machine plugin. Mill compares `$HOME` to the passwd home (`os.userInfo().homedir`), not `os.homedir()` (which follows `$HOME`).
+7. **Harness (observational).** Bound Cursor/Grok hooks, fastened Repertoire organ, Station card. Profiles: `bare` / `suited` / `partial`. Does **not** fasten. `--go` prints a forge GO receipt so cloud return is mill, not chat. `--require-harness=bare|suited|partial` fails when the live plant disagrees.
 
 ## How to work
 
@@ -28,6 +29,7 @@ Mill **does** these checks (`npx @0xray/foundry inspect`). Mint fails on a costu
 ```bash
 npx @0xray/foundry mint
 npx @0xray/foundry inspect
+npx @0xray/foundry inspect --skip-live --go --require-harness=bare
 npx @0xray/foundry ci --report
 ```
 

package/scripts/foundry/plant/skills/mill/SKILL.md

@@ -11,7 +11,7 @@ The mill **fastens** a suit. Default mill plant is **inspect** (inspecting AI wo
 
 **Mill-fill:** their keys/files win. Mill plant names they did not overlay stay. JSON always merges.
 
-**Factory:** Repertoire enable-when-resolves. Seven generated MCP. Constitution (PPE) stays worn. Not a fifth MCP. Not 5.0.
+**Factory:** **Repertoire is preferred** (vendored 0.2.5 ships on; dest = named laws). Seven generated MCP. Constitution (PPE) stays worn. Not a fifth MCP. Not 5.0.
 
 **Costume:** `foundry.json` `"costume": true` copies the 45/42 mill costume.
 

package/scripts/foundry/validate-release-docs.mjs

@@ -18,6 +18,7 @@ import {
   DOCS_SITE_HEADER_FILES,
   getFrameworkCounts,
   getReleaseArtifactPaths,
+  patchRefStripRelPaths,
 } from './version-manager.mjs';
 import { isXrayExoRepo, resolveMillRoot } from './mill-root.mjs';
 
@@ -29,6 +30,23 @@ function kernelLineHasPatchStamp(content) {
   return /^\*\*v?\d+\.\d+\.\d+\*\*/m.test(content);
 }
 
+/**
+ * Present-tense cut pins. Keep: package.json, CHANGELOG, stamped JSON,
+ * features-since headings. The check set is the stamper set: shipped guides
+ * and shipped OP-PROC, including the mill-gate skill. Seat memory is not in it.
+ */
+const PRESENT_TENSE_PATCH_RE =
+  /This cut is|Do not republish \d+\.\d+\.\d+|0xray@\d+\.\d+\.\d+|npm is \*\*\d+\.\d+\.\d+\*\*|Product \*\*\d+\.\d+\.\d+\*\* is on npm/;
+
+const NO_PRESENT_TENSE_PATCH = patchRefStripRelPaths();
+
+function presentTensePatchPinErrors(content) {
+  if (PRESENT_TENSE_PATCH_RE.test(content)) {
+    return ['present-tense patch pin — keep versions in package.json + CHANGELOG + stamped JSON only'];
+  }
+  return [];
+}
+
 /** Guides that must exist and reference the current release (body or header). */
 const REQUIRED_GUIDES = [
   'docs-site/docs/guides/features-since-3.1.md',
@@ -36,6 +54,7 @@ const REQUIRED_GUIDES = [
   'docs-site/docs/guides/memory-routing.md',
   'docs-site/docs/guides/aside-context.md',
   'docs-site/docs/guides/repertoire.md',
+  'docs-site/docs/guides/station-vs-repertoire.md',
   'docs-site/docs/guides/integrations.md',
   'docs-site/docs/guides/consumer-migration.md',
   'docs-site/docs/mcp/README.md',
@@ -53,6 +72,18 @@ function millLawLagErrors(content) {
   return errors;
 }
 
+/** Opt-out is features.json, not package-absence. */
+function repertoireOptOutErrors(content) {
+  const errors = [];
+  if (/\(no @0xray\/repertoire\)/.test(content)) {
+    errors.push('opt-out must not teach package-absence (no @0xray/repertoire)');
+  }
+  if (/memory_routing stays off/.test(content)) {
+    errors.push('opt-out must not teach memory_routing stays off on npm install');
+  }
+  return errors;
+}
+
 function millPlantMentionErrors(content) {
   if (!content.includes('mill') || !content.includes('inspect')) {
     return ['missing mill+inspect plant'];
@@ -310,7 +341,24 @@ export function validateReleaseDocs(rootDir = resolveMillRoot()) {
     if (content.trim().length < 200) {
       errors.push(`${rel}: guide too short — likely stub`);
     }
+  }
+
+  for (const rel of NO_PRESENT_TENSE_PATCH) {
+    const content = readFile(rootDir, rel);
+    if (!content) {
+      errors.push(`${rel}: file missing`);
+      continue;
+    }
+    for (const e of presentTensePatchPinErrors(content)) {
+      errors.push(`${rel}: ${e}`);
+    }
+  }
 
+  const stationVs = readFile(rootDir, 'docs-site/docs/guides/station-vs-repertoire.md');
+  if (stationVs) {
+    for (const e of repertoireOptOutErrors(stationVs)) {
+      errors.push(`docs-site/docs/guides/station-vs-repertoire.md: ${e}`);
+    }
   }
 
   const docusaurus = readFile(rootDir, 'docs-site/docusaurus.config.ts');