0xray 4.0.21 → 4.0.23

package/.grok-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.21",
+  "version": "4.0.23",
   "description": "0xRay suit for Grok, Hermes, OpenClaw, OpenCode: mill+inspect, Codex, 7 MCP servers. Costume 45/42 is opt-in foundry, not the default wear.",
   "author": {
     "name": "0xRay AI",

package/.opencode/skills/hermes-agent/SKILL.md

@@ -64,7 +64,7 @@ Returns: pass/fail with per-file results and violations.
 
 ### xray_codex_check
 
-Validate code against the 60-term Universal Development Codex. Checks error-handling, type-safety, performance, security, architecture.
+Validate code against the 69-term Universal Development Codex. Checks error-handling, type-safety, performance, security, architecture.
 
 ```
 xray_codex_check(code="const x: any = foo()", operation="create")

package/.opencode/skills/orchestrator/SKILL.md

@@ -7,15 +7,15 @@ version: 1.0.0
 schema_version: "1.0"
 tags: [orchestration, orchestrator, lead-dev]
 capabilities:
-  - coordinate_agents
-  - delegate_tasks
-  - manage_workflow
+ - coordinate_agents
+ - delegate_tasks
+ - manage_workflow
 dependencies: []
 
 mcp:
-  orchestrator:
-    command: node
-    args: [node_modules/0xray/dist/mcps/orchestrator.server.js]
+ orchestrator:
+ command: node
+ args: [node_modules/0xray/dist/mcps/orchestrator.server.js]
 ---
 
 # Orchestrator Skill — includes lead-dev operating model
@@ -64,6 +64,10 @@ Config: `features.json` → `multi_agent_orchestration.lead_dev_mode`
 
 The seven rules are the engine. The cadence is the time signature. Disk SSOT: `grok-bot/ops/LEAD-CADENCE.md`.
 
+Jargon is not the job. Review and cadence ask whether the change works. Do not spend the loop reciting dest names, mill liturgy, or host mantras.
+
+- **Feat rebase:** when the mandated work turns into mantra, or the job has split across planes that no longer share one present, stop. Go up a level and answer the original message again from this seat. Do not continue the side thread and call that the job.
+
 - **Peer test:** another instance with only worn 0xRay continues the ticket. No command stream.
 - **Wear first:** Read `.xray/state/STATION.md`. Same cloud. Same critic (resume only). Dummy Reads Station.
 - **Dummy tests `SKILLS.md`:** a suited dummy proves the worn catalog. Same-sess bodies keep context and hold a Station card.
@@ -73,6 +77,24 @@ The seven rules are the engine. The cadence is the time signature. Disk SSOT: `g
 - **Live tick, not pacer:** `/loop` runs work now. Keep workstreams moving. Do not idle-wait 12 minutes. **Clean ticks every cycle** — unsubscribe then resubscribe so the prompt matches metal. Name-dedupe does not rewrite. A stale prompt (waiting URL after live, Hold after strip) is dirty: rewrite, do not act. **If the card and WAVEBOARD are idle, unsubscribe and do not resubscribe.**
 - **Board clock:** PR events + resume the same critic. Not two idle pacers. Merge after PASS+CI (gate A). Publish only after mill-gate D + `foundry gate`.
 - **Dispatch:** ticket + PR URLs + “Wear, then review.” The critic Reads `SEATS.md` Reviewer. Do not paste a command novel. When a law is spoken twice, encode it this wake.
+- **Cascade:** Chat is not the brain. A cascade that must survive compaction is a named repertoire signal on the stack overlay, hydrated onto the project law list. NOTES holds the same cascade for the second Read. Station stays the ticket. A reflection is not this capture. Capture priority: a law is an invariant you would otherwise re-read the source to relearn. One law per subsystem bone. Heat touches last_seen and does not append a confidence sample, so more hits do not raise conviction. Heat touches last_seen when the diary contains that signal's name or a local clause of four definition content words; two definition words are not a hit; the same words scattered through a long diary are not a hit; a weak session score is not lifted to 0.55 and a sample below 0.55 is not recorded. Constructing the organ does not append workspace samples. Hero names: `heat-is-not-conviction`, `inference-cycle-invariant`, `governance-vote-invariant`, `thin-dispatch-invariant`. Repertoire mergeStackOverlay refreshes a changed stack definition and keeps observation stats. A floor observation count does not change a route. Feedback moves conviction by a tenth, and a failure can leave 0.55. learned-conviction.json beside dest restores that average when a wake flattens it to 0.55. It does not store the observation count.
+- **Cold brief:** a new critic or any new subagent that does not already have this thread gets the latest commit SHA on the branch under review (fetch it; do not reuse an earlier SHA from a previous pass) and the Station card (`.xray/state/STATION.md`: intent, plan, git). If the card is missing, give branch + HEAD + what just changed. If the branch moves after you brief them, send the new SHA before they verdict.
+- **Control:** The lead keeps control. Do not assume the subagent has the context. Give the duty, the latest SHA, the Station card, and the laws that apply. The subagent wears the applicable 0xRay suit before it works: the tree under review, built and installed. An older published package is not that suit. The lead checks the result.
+
+### Engine cadence
+
+This suite is the engine that builds the engine. When a seat sees OP-PROC, write it onto these existing surfaces in the same wake. Do not open a new skill.
+
+1. Change the engine with precision.
+2. Ship it local: build and install the tree. A live npm version stays live. Once a version is live, the stamper strips every present-tense patch pin from shipped guides and shipped OP-PROC, or reconcile advances the next cut. The stamper does not edit Station, NOTES, dest, or node_modules. It does not publish.
+3. Test the change.
+4. Run another deep review of the diff you just made.
+5. Monitor long-term memory (dest name count and whether observations are the only growth) and short-term memory (Station: intent, plan, git).
+6. Ship the PR.
+
+### Planes
+
+Operating planes: code, OP-PROC, model, suit, mill, host, and test/ship. Test/ship is the critical OP-PROC plane. Test then ship is the hero. Ship without that proof is the catastrophe. Long-term memory is the project law list. Each wake refreshes a changed stack definition and keeps observation stats. Heat writes the matched names onto Station, the short-term card that survives compaction. Reactive decisions move out of TypeScript into OP-PROC as the model improves. That move is why the mill and the suit exist. It is not fully proved. Once a version is live, the stamper strips every present-tense patch pin from shipped guides and shipped OP-PROC, or reconcile advances the next cut. The stamper does not edit Station, NOTES, dest, or node_modules. It does not publish. Do not freeze the live cut.
 - **Close:** loop until Station is done. Compact: Station survives the cut. Overlay dest names are OP-PROC — reload `repertoire-working.json` `opProcNames`, not Station.
 - **Board:** critic Strict comments; forge implements; lead stays main thread.
 - **Codex 69:** rewire this skill and existing ops. Do not add a new `SKILL.md` to hold the cadence.

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.21",
+  "version": "4.0.23",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/AGENTS-consumer.md

@@ -57,7 +57,7 @@ Governance deliberation uses **code-review**, **security-audit** (via enforcer/s
 | `npx 0xray hermes install` | Hermes plugin bridge |
 | `npx 0xray openclaw install` | OpenClaw config + skills |
 | `npx 0xray skill:install` | Install starter skills |
-| `npx 0xray validate` | Validate codex compliance |
+| `npx 0xray validate` | Wear check (pack paths, Cursor hooks, mill, repertoire) — not leftover init.sh |
 | `npx 0xray codex check` | Check codex rules |
 | `npx 0xray health` | Framework health check |
 | `npx 0xray mcp <server>` | Start an MCP server (stdio) |
@@ -91,14 +91,14 @@ Configure in `.xray/features.json`:
 
 ```json
 "memory_routing": {
-  "enabled": true,
-  "provider": "repertoire",
-  "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
-  "config": {
-    "signalsPath": ".xray/state/repertoire/curated_signals.json",
-    "statePath": ".xray/state/repertoire/inference-state.json",
-    "feedbackDir": ".xray/state/repertoire/feedback"
-  }
+ "enabled": true,
+ "provider": "repertoire",
+ "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
+ "config": {
+ "signalsPath": ".xray/state/repertoire/curated_signals.json",
+ "statePath": ".xray/state/repertoire/inference-state.json",
+ "feedbackDir": ".xray/state/repertoire/feedback"
+ }
 }
 ```
 
@@ -108,8 +108,8 @@ Configure in `.xray/features.json`:
 
 ```json
 "repertoire": {
-  "command": "npx",
-  "args": ["-y", "@0xray/repertoire", "mcp"]
+ "command": "npx",
+ "args": ["-y", "@0xray/repertoire", "mcp"]
 }
 ```
 

package/AGENTS.md

@@ -67,14 +67,14 @@ Governance deliberation: **code-review**, **security-audit**, **researcher** wit
 
 ```json
 "memory_routing": {
-  "enabled": true,
-  "provider": "repertoire",
-  "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
-  "config": {
-    "signalsPath": ".xray/state/repertoire/curated_signals.json",
-    "statePath": ".xray/state/repertoire/inference-state.json",
-    "feedbackDir": ".xray/state/repertoire/feedback"
-  }
+ "enabled": true,
+ "provider": "repertoire",
+ "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
+ "config": {
+ "signalsPath": ".xray/state/repertoire/curated_signals.json",
+ "statePath": ".xray/state/repertoire/inference-state.json",
+ "feedbackDir": ".xray/state/repertoire/feedback"
+ }
 }
 ```
 

package/README.md

@@ -25,20 +25,20 @@ Consumer `npm install 0xray` auto-wires four chat bridges, Cursor project hooks,
 ## Quick Start
 
 ```bash
-npm install 0xray          # postinstall: mill+inspect plant + 4 bridges + 7 MCPs + AGENTS.md + .mcp.json
-npx 0xray status          # verify install
-npx 0xray setup            # optional: symlinks, hook extras
-npx @0xray/foundry inspect --skip-live   # mill receipt (chat is not a receipt)
+npm install 0xray # postinstall: mill+inspect plant + 4 bridges + 7 MCPs + AGENTS.md + .mcp.json
+npx 0xray status # verify install
+npx 0xray setup # optional: symlinks, hook extras
+npx @0xray/foundry inspect --skip-live # mill receipt (chat is not a receipt)
 ```
 
 Manual per-platform install (idempotent, same result as postinstall):
 
 ```bash
 npx 0xray opencode install
-npx 0xray grok install     # 7 MCPs servers + project .grok/plugins/0xray (not machine last-wins)
+npx 0xray grok install # 7 MCPs servers + project .grok/plugins/0xray (not machine last-wins)
 npx 0xray hermes install
 npx 0xray openclaw install
-npx 0xray skill:install    # starter skills
+npx 0xray skill:install # starter skills
 ```
 
 ## Autonomy command (default operating model)
@@ -81,16 +81,16 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 
 ```
 ┌─────────────────────────────────────────────────┐
-│                  Inference                       │
-│  Proposals · Reflection · Memory routing        │
+│ Inference │
+│ Proposals · Reflection · Memory routing │
 ├─────────────────────────────────────────────────┤
-│           External Governance (Dynamo)           │
-│  Codex enforcement · Resonance/Isotopic · SSOT    │
-│  3 deliberation MCPs: code-review, security,     │
-│  researcher (within 7-server consumer surface)  │
+│ External Governance (Dynamo) │
+│ Codex enforcement · Resonance/Isotopic · SSOT │
+│ 3 deliberation MCPs: code-review, security, │
+│ researcher (within 7-server consumer surface) │
 ├─────────────────────────────────────────────────┤
-│          Autonomous Engine (thinDispatch)        │
-│  7-flow · AsideContext · Confidence gate        │
+│ Autonomous Engine (thinDispatch) │
+│ 7-flow · AsideContext · Confidence gate │
 └─────────────────────────────────────────────────┘
 ```
 
@@ -155,14 +155,14 @@ See [AGENTS.md](AGENTS.md) and [SKILLS.md](SKILLS.md) for the full agent and ski
 
 ```json
 "memory_routing": {
-  "enabled": true,
-  "provider": "repertoire",
-  "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
-  "config": {
-    "signalsPath": ".xray/state/repertoire/curated_signals.json",
-    "statePath": ".xray/state/repertoire/inference-state.json",
-    "feedbackDir": ".xray/state/repertoire/feedback"
-  }
+ "enabled": true,
+ "provider": "repertoire",
+ "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
+ "config": {
+ "signalsPath": ".xray/state/repertoire/curated_signals.json",
+ "statePath": ".xray/state/repertoire/inference-state.json",
+ "feedbackDir": ".xray/state/repertoire/feedback"
+ }
 }
 ```
 
@@ -208,9 +208,9 @@ Docs: [memory routing](docs-site/docs/guides/memory-routing.md) · [Repertoire](
 
 ```bash
 npm test
-npm run pack:tmp-proof  # pack → tmp fasten + hangar inspect
-npm run release:gate    # full release gate (before upload)
-npm run release:npm     # gate + prepare + npm publish --access public
+npm run pack:tmp-proof # pack → tmp fasten + hangar inspect
+npm run release:gate # full release gate (before upload)
+npm run release:npm # gate + prepare + npm publish --access public
 ```
 
 ## Release
@@ -219,8 +219,8 @@ The **4.0** line is on npm. Do **not** run `release:major` to ship a 4.x fix (th
 
 ```bash
 npm run release:gate
-npm run release:npm     # after gate is green; uses npm publish --access public
-npm run release:patch   # version bump pipeline (not for an already-bumped package.json)
+npm run release:npm # after gate is green; uses npm publish --access public
+npm run release:patch # version bump pipeline (not for an already-bumped package.json)
 ```
 
 Pipeline: reconcile-version → release-gate (build + test + consumer smoke) → CHANGELOG/README/AGENTS artifacts → commit → tag → npm publish.

package/SKILLS.md

@@ -129,7 +129,7 @@ xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) as the **costume /
 Configured in project `.mcp.json` on postinstall:
 
 ```bash
-npx -y 0xray mcp skills    # stdio server
+npx -y 0xray mcp skills # stdio server
 ```
 
 MCP tools include: `invoke-skill`, `list-skills`, `skill-code-review`, `skill-security-audit`, `skill-api-design`, `skill-testing-strategy`, and more.

package/dist/AGENTS.md

@@ -67,14 +67,14 @@ Governance deliberation: **code-review**, **security-audit**, **researcher** wit
 
 ```json
 "memory_routing": {
-  "enabled": true,
-  "provider": "repertoire",
-  "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
-  "config": {
-    "signalsPath": ".xray/state/repertoire/curated_signals.json",
-    "statePath": ".xray/state/repertoire/inference-state.json",
-    "feedbackDir": ".xray/state/repertoire/feedback"
-  }
+ "enabled": true,
+ "provider": "repertoire",
+ "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
+ "config": {
+ "signalsPath": ".xray/state/repertoire/curated_signals.json",
+ "statePath": ".xray/state/repertoire/inference-state.json",
+ "feedbackDir": ".xray/state/repertoire/feedback"
+ }
 }
 ```
 

package/dist/CHANGELOG.md

@@ -6,6 +6,104 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 
 ## [Unreleased]
 
+### Features
+- **Feat rebase.** When the mandated work turns into mantra, or the job has split across planes that no longer share one present, stop and answer the original message again from this seat. On `LEAD-CADENCE.md`, the orchestrator skill, and the ship-ready mill gate. Project dest grows the name `feat-rebase` from the stack overlay. Not a new skill.
+
+### Fixed
+- **A governed proposal teaches.** A route lookup does not write a lesson. When a vote finishes, the cycle grades the signals that proposal's sessions already named. A session that names a stored signal is graded even when that name appears once. Landed approaches and no wrong turn clear the solid band. A wrong turn stays below the cutoff. Earlier rejects of other codify proposals do not pull that grade down. Approve steps those signals up by a tenth. Reject steps them down by a tenth. Needs-revision, an abstain, a governance error, and a proposal whose sessions named nothing do not write. Proposal ids stay on the signal and the sessions not yet graded, so a later cycle does not teach those sessions again. A new session is a new id. Those ids remain after the history window of 50 fills, including with empty cycles. A proposal that carries an empty name list does not fall through to matching its text. A grade that passes appends one line — the task, the decision, and the approaches, solutions, or wrong turn from the sessions that named the law — on that signal and beside the average. The same task does not append again. The route for a law above 0.55 includes the law text and those lines, and Station's lessons section is refreshed from dest. Not a new skill.
+- **Dynamo client on a required external call.** `govern_proposals` with external governance required starts `InferenceGovernanceIntegration` even when `inference_governance.enabled` is false. Boot still skips that client while the flag is off, and the inference cycle still uses the local matrix unless the flag is on or `XRAY_FORCE_MCP_GOVERNANCE=true`. An unreadable MCP payload is stored as the error text, not an abstain at 0.5. The MCP wait matches the governance budget (90s). Not a new skill.
+- **Subsystem pass.** A session file with no `metrics.commits` is not a session, and a captured pattern with no `evidence` array is empty evidence, so the inference cycle no longer dies before it writes state. `scoreAndRoute` loads the memory organ on the first call with a synchronous require, before any dynamic import of that module. A cached null provider does not block that load, and a late null load does not replace an organ already in hand. Not a new skill.
+- **Local governance pass.** When `inference_governance.enabled` is false, the inference cycle scores each proposal with the local decision matrix. That miss is not stored as a reject at confidence 0, and Dynamo is not called. The governance MCP path stays in place when the flag is on. Not a new skill.
+- **Learned conviction.** A floor observation count does not change a route. Feedback moves conviction by a tenth, and a failure can leave 0.55. Retrieval hits a local clause of four definition content words. Two definition words are not a hit. The same words scattered through a long diary are not a hit. x402 prose alone is not a hit. `learned-conviction.json` beside dest restores the average when a wake flattens it to 0.55 and does not store the observation count. The vendored organ dist matches that behavior. Not a new skill.
+- **Seeded conviction.** Load writes `learned-conviction.json` for dest averages already above 0.55, including historical averages with no evidence count. Evidence is the existing positive count, otherwise 1. Floor averages, including float dust at 0.55, stay out of the file. A later load restores those averages after a flatten. The vendored organ dist matches that behavior. Not a new skill.
+- **Lock matches the cut.** `package-lock.json` root version and `packages[""].version` follow `package.json` on stamp. The 4.0.22 release left the lock at 4.0.21. Not a new skill.
+- **Bumper writes the lock.** `reconcile --apply` updates `package.json` and the lock version fields together. `reconcile --check` (the docs mill in CI) fails when they differ. Not a new skill.
+- **Cursor gate root.** The suit mill already has synthesis off. Cursor tools follow that mill when it is in the heat set, so a sibling repo's leftover synthesis checkpoint does not deny the host. Not a new skill.
+- **Engine cadence.** Change the engine, ship it local (build and install the tree; a live cut stays live), test, review the diff, monitor dest and Station, then ship the PR. Missing moral fusion is not an isotopic reject; vote confidence is a clamped weighted mean; thinDispatch strategy follows the adjusted level; an empty inference cycle saves state and later getInstance options apply. On `LEAD-CADENCE.md`, the orchestrator skill, and the ship-ready mill gate. Not a new skill.
+- **Operating planes.** Code, OP-PROC, model, suit, mill, host, and test/ship. Test then ship is the hero; ship without that proof is the catastrophe. Project long-term memory refreshes a changed stack definition and keeps observation stats. Heat writes the matched names onto Station. Name `operating-planes` on the stack overlay. Not a new skill.
+- **Wake cascade.** Chat is not the brain. A cascade that must survive compaction is the repertoire name `wake-cascade` on the stack overlay, with the same text in NOTES for the second Read. A reflection is not this capture. Not a new skill.
+- **Hero invariants.** Capture priority is an invariant you would otherwise re-read the source to relearn. Names: `heat-is-not-conviction`, `inference-cycle-invariant`, `governance-vote-invariant`, `thin-dispatch-invariant`. Heat touches last_seen and does not append a confidence sample. Heat touches last_seen when the diary contains that signal's name or a local clause of four definition content words; two definition words are not a hit; the same words scattered through a long diary are not a hit; a weak session score is not lifted to 0.55 and a sample below 0.55 is not recorded. Constructing the organ does not append workspace samples. Repertoire `mergeStackOverlay` refreshes a changed stack definition and keeps observation stats. Not a new skill.
+- **Stamper strip set.** Once a version is live, the stamper strips every present-tense patch pin from shipped guides and shipped OP-PROC, or reconcile advances the next cut. The stamper does not edit Station, NOTES, dest, or node_modules. It does not publish. The release docs check uses that same strip set, including `grok-bot/skills/ship-ready-mill-gate/SKILL.md`. Proposal text stays a keyword map over session problem strings, and `generateProposals` also emits recurring-pattern titles. Not a new skill.
+- **Heat + capture leftover** — module-missing resume is `Repertoire: module unresolved`, not “memory_routing stays off”. Session capture writes `matched_primitives` from existing dest laws in git. Grow receipt is post-prune dest count + heated length. Leftover `provider: null` still migrates old tarballs; explicit opt-out stays `enabled: false` + `provider: repertoire`. Does not republish.
+
+### 📚 Documentation
+- **Cold brief.** A new critic or any new subagent that does not already have this thread gets the latest commit SHA on the branch under review (fetch it) and the Station card. If the branch moves, send the new SHA before they verdict. On `LEAD-CADENCE.md` + ship-ready mill gate + orchestrator cadence. Not a new skill.
+- **Jargon is not the job.** Review and cadence ask whether the change works. Do not spend the loop reciting dest names, mill liturgy, or host mantras. On `LEAD-CADENCE.md` + ship-ready mill gate + orchestrator cadence. Not a new Codex term.
+- **Leftover after #102** — `station-vs-repertoire.md` opt-out ASCII no longer teaches package-absence (`no @0xray/repertoire` / `memory_routing stays off`). Explicit opt-out is `enabled: false` + `provider: repertoire`. Dead integrate note is history. Compact seed drops leftover “optional MCP”. `validate-release-docs` now gates that guide. Does not republish.
+- **Leftover after #101** — stamp `package-lock.json` and `.xray/features.json` to the live package version. Rewire `updateFeaturesJsonVersion` so both features files stamp together. Guides that still called Repertoire optional now say preferred + explicit opt-out; Station is the compact ticket.
+
+### 🧹 Cleanup
+- Drop unused `src/mcps/shared/security-scanner.ts` and its unused validator twin. Live scanner stays `src/security/`.
+- Archive root `integrations/` costume SKILL dump → `docs/archive/integrations-costume/`. Live wear is `src/integrations`.
+- Archive root `commands/` stale copy → `docs/archive/commands-copy/`. Live wear is `src/opencode/commands`.
+
+## [4.0.23] - 2026-09-23
+
+### 🔄 Changes
+
+### 🐛 Bug Fixes
+- fix: start the Dynamo client when external governance is required (d17b9cf19)
+- fix: score proposals locally when inference governance is off (ae8075116)
+- fix: finish the inference cycle and load the organ before routing (69522e6c3)
+- fix: vendor the organ that seeds conviction above the floor (103961128)
+- fix: vendor the organ that routes on conviction, not a floor count (24d215a5a)
+- fix: reconcile writes the lock version when it bumps (434ddafef)
+- fix: package-lock version follows package.json on stamp (026c36d55)
+
+---
+
+## [4.0.22] - 2026-09-23
+
+### 🔄 Changes
+
+### ✨ Features
+- feat: rebase — answer the original message from this seat (a9a9e432b)
+
+### 🐛 Bug Fixes
+- fix: cursor gate follows the suit mill, not a sibling synthesis checkpoint (7a21cd996)
+- fix: stamper strips every present-tense patch pin from shipped prose (4962b353f)
+- fix: docs check uses the stamper strip set (f46377822)
+- fix: stamper strips shipped prose only and proposals name recurring patterns (2b98354f7)
+- fix: worn heat matches the signal id and dest keeps that law (9952f6dc2)
+- fix: wake does not append a floor sample on heat (fe0492c98)
+- fix: heat law matches the organ that touches last_seen (35390de44)
+- fix: stack law refresh stays on the wake hook (f4a0c5d82)
+- fix: store hero invariants as repertoire laws (9deed910b)
+- fix: store the wake cascade as a repertoire law (ebf5aed8a)
+- fix: test/ship plane and law refresh onto Station (87ad30bc5)
+- fix: encode six planes and the live-cut hand (2eb24387e)
+- fix: engine cadence and the three-module defects (d11b796d9)
+- fix: heat resume and session match leftover after #103 (#104) (664a2039b)
+- fix: persist heated length on the working receipt (2e28d1dbe)
+- fix: heat resume and session match leftover (0f8b5b4ab)
+- fix: leftover opt-out teaching after #102 (#103) (b8fc6bef7)
+- fix: leftover stamps and dest-as-laws docs after #101 (#102) (910a739c4)
+- fix: stamp leftover lock and worn features to the live package version (41f648d43)
+- fix: dest stays laws — compact boot holds (#101) (9b731441d)
+- fix: cleanse stale 4.0.15 pins and leftover validate wording (5ea8e0dff)
+
+### 📚 Documentation
+- docs: cold brief is latest SHA plus Station (55c2497e4)
+- docs: jargon is not the job — results first on cadence (3699a56d0)
+- docs: leftover opt-out ASCII after #102 (3974a2920)
+- docs: leftover Repertoire optional language after #101 (5f64b68f3)
+- docs: archive unused v2-refactor harness and fix migrate leftover URLs (23042fb7e)
+- docs: archive StringRay leftover reports and update mill seed (eaa85fe5a)
+
+### 🧪 Tests
+- test: gate station-vs-repertoire opt-out leftover (aef80e538)
+
+### 🔧 Maintenance
+- chore: drop unused MCP scanner twin and archive costume dumps (49fc4c96c)
+- chore: drop leftover root test toys and stamp live 4.0.19 (5997a5924)
+- chore: archive leftover sync-docs script that wipes the live site (a23205b5b)
+- chore: alias leftover consumer check and drop blaze pipeline paths (ef98637d9)
+- chore: archive unused duplicate e2e runners (7806bd21e)
+- chore: tidy leftover CI harnesses, kernel repro, and live npm pins (fe1f08ad0)
+- chore: tidy leftover vote harnesses, debug repro, and shipped Unreleased pins (05587368e)
+
+---
+
 ## [4.0.21] - 2026-09-23
 
 ### ✨ Features

package/dist/README.md

@@ -25,20 +25,20 @@ Consumer `npm install 0xray` auto-wires four chat bridges, Cursor project hooks,
 ## Quick Start
 
 ```bash
-npm install 0xray          # postinstall: mill+inspect plant + 4 bridges + 7 MCPs + AGENTS.md + .mcp.json
-npx 0xray status          # verify install
-npx 0xray setup            # optional: symlinks, hook extras
-npx @0xray/foundry inspect --skip-live   # mill receipt (chat is not a receipt)
+npm install 0xray # postinstall: mill+inspect plant + 4 bridges + 7 MCPs + AGENTS.md + .mcp.json
+npx 0xray status # verify install
+npx 0xray setup # optional: symlinks, hook extras
+npx @0xray/foundry inspect --skip-live # mill receipt (chat is not a receipt)
 ```
 
 Manual per-platform install (idempotent, same result as postinstall):
 
 ```bash
 npx 0xray opencode install
-npx 0xray grok install     # 7 MCPs servers + project .grok/plugins/0xray (not machine last-wins)
+npx 0xray grok install # 7 MCPs servers + project .grok/plugins/0xray (not machine last-wins)
 npx 0xray hermes install
 npx 0xray openclaw install
-npx 0xray skill:install    # starter skills
+npx 0xray skill:install # starter skills
 ```
 
 ## Autonomy command (default operating model)
@@ -81,16 +81,16 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 
 ```
 ┌─────────────────────────────────────────────────┐
-│                  Inference                       │
-│  Proposals · Reflection · Memory routing        │
+│ Inference │
+│ Proposals · Reflection · Memory routing │
 ├─────────────────────────────────────────────────┤
-│           External Governance (Dynamo)           │
-│  Codex enforcement · Resonance/Isotopic · SSOT    │
-│  3 deliberation MCPs: code-review, security,     │
-│  researcher (within 7-server consumer surface)  │
+│ External Governance (Dynamo) │
+│ Codex enforcement · Resonance/Isotopic · SSOT │
+│ 3 deliberation MCPs: code-review, security, │
+│ researcher (within 7-server consumer surface) │
 ├─────────────────────────────────────────────────┤
-│          Autonomous Engine (thinDispatch)        │
-│  7-flow · AsideContext · Confidence gate        │
+│ Autonomous Engine (thinDispatch) │
+│ 7-flow · AsideContext · Confidence gate │
 └─────────────────────────────────────────────────┘
 ```
 
@@ -155,14 +155,14 @@ See [AGENTS.md](AGENTS.md) and [SKILLS.md](SKILLS.md) for the full agent and ski
 
 ```json
 "memory_routing": {
-  "enabled": true,
-  "provider": "repertoire",
-  "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
-  "config": {
-    "signalsPath": ".xray/state/repertoire/curated_signals.json",
-    "statePath": ".xray/state/repertoire/inference-state.json",
-    "feedbackDir": ".xray/state/repertoire/feedback"
-  }
+ "enabled": true,
+ "provider": "repertoire",
+ "module_path": "node_modules/@0xray/repertoire/dist/provider/memory-routing-provider.js",
+ "config": {
+ "signalsPath": ".xray/state/repertoire/curated_signals.json",
+ "statePath": ".xray/state/repertoire/inference-state.json",
+ "feedbackDir": ".xray/state/repertoire/feedback"
+ }
 }
 ```
 
@@ -208,9 +208,9 @@ Docs: [memory routing](docs-site/docs/guides/memory-routing.md) · [Repertoire](
 
 ```bash
 npm test
-npm run pack:tmp-proof  # pack → tmp fasten + hangar inspect
-npm run release:gate    # full release gate (before upload)
-npm run release:npm     # gate + prepare + npm publish --access public
+npm run pack:tmp-proof # pack → tmp fasten + hangar inspect
+npm run release:gate # full release gate (before upload)
+npm run release:npm # gate + prepare + npm publish --access public
 ```
 
 ## Release
@@ -219,8 +219,8 @@ The **4.0** line is on npm. Do **not** run `release:major` to ship a 4.x fix (th
 
 ```bash
 npm run release:gate
-npm run release:npm     # after gate is green; uses npm publish --access public
-npm run release:patch   # version bump pipeline (not for an already-bumped package.json)
+npm run release:npm # after gate is green; uses npm publish --access public
+npm run release:patch # version bump pipeline (not for an already-bumped package.json)
 ```
 
 Pipeline: reconcile-version → release-gate (build + test + consumer smoke) → CHANGELOG/README/AGENTS artifacts → commit → tag → npm publish.

package/dist/SKILLS.md

@@ -129,7 +129,7 @@ xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) as the **costume /
 Configured in project `.mcp.json` on postinstall:
 
 ```bash
-npx -y 0xray mcp skills    # stdio server
+npx -y 0xray mcp skills # stdio server
 ```
 
 MCP tools include: `invoke-skill`, `list-skills`, `skill-code-review`, `skill-security-audit`, `skill-api-design`, `skill-testing-strategy`, and more.

package/dist/governance/governance-core.d.ts

@@ -9,7 +9,8 @@
 import type { GovernanceVote, GovernanceResult } from './governance-types.js';
 export interface DecisionMatrixInput {
     resonance: number;
-    isotopicRatio: number;
+    /** Present only when a real moralFusion number was supplied. Absent is not 0.5. */
+    isotopicRatio?: number;
     vortexVolume?: number;
     historicalCoherence?: number;
     solarActivity?: 'quiet' | 'moderate' | 'active' | 'storm';

package/dist/governance/governance-core.js

@@ -61,22 +61,28 @@ export function applyDecisionMatrix(input) {
         voteWeight *= 1.05;
         reasons.push(`Moral alignment confirmed (score: ${(moralScore * 100).toFixed(0)}%)`);
     }
-    if (resonance >= 0.92 && isotopicRatio >= 0.95) {
+    // Cutoffs stay the literals the tests lock (0.92/0.95, 0.82/0.88, 0.75/0.80).
+    // PHI and TAU are not those cutoffs, so reasons do not claim them.
+    const ratio = typeof isotopicRatio === 'number' && Number.isFinite(isotopicRatio) ? isotopicRatio : undefined;
+    const highBand = resonance >= 0.92 && (ratio === undefined || ratio >= 0.95);
+    const solidBand = resonance >= 0.82 && (ratio === undefined || ratio >= 0.88);
+    const belowCutoff = resonance < 0.75 || (ratio !== undefined && ratio < 0.80);
+    if (highBand) {
         recommendation = 'PASS';
         confidence = 0.97;
         voteWeight = 1.4;
-        reasons.push('High symbiotic resonance (PHI-aligned)');
+        reasons.push('High symbiotic resonance');
     }
-    else if (resonance >= 0.82 && isotopicRatio >= 0.88) {
+    else if (solidBand) {
         recommendation = 'PASS';
         confidence = 0.89;
         voteWeight = 1.15;
-        reasons.push('Solid alignment above TAU threshold');
+        reasons.push('Solid alignment above the resonance cutoff');
     }
-    else if (resonance < 0.75 || isotopicRatio < 0.80) {
+    else if (belowCutoff) {
         recommendation = 'REJECT';
         confidence = 0.84;
-        reasons.push('Signal below critical threshold (1 - TAU)');
+        reasons.push('Signal below the critical resonance or isotopic cutoff');
     }
     else {
         reasons.push('Moderate resonance - requires refinement');
@@ -124,14 +130,17 @@ export function mergeVotes(votes) {
             reasoningSummary: 'No votes received',
         };
     }
+    const weightOf = (vote) => vote.weight ?? 1;
     const approveWeight = votes
         .filter(v => v.decision === 'approve')
-        .reduce((sum, v) => sum + (v.weight ?? 1) * v.confidence, 0);
-    const totalWeight = votes.reduce((sum, v) => sum + (v.weight ?? 1) * v.confidence, 0);
-    const avgConfidence = totalWeight > 0 ? totalWeight / votes.length : 0.5;
+        .reduce((sum, v) => sum + weightOf(v) * v.confidence, 0);
+    const weightedConfidenceSum = votes.reduce((sum, v) => sum + weightOf(v) * v.confidence, 0);
+    const weightSum = votes.reduce((sum, v) => sum + weightOf(v), 0);
+    const rawMean = weightSum > 0 ? weightedConfidenceSum / weightSum : 0.5;
+    const avgConfidence = Math.min(1, Math.max(0, rawMean));
     let finalDecision = 'needs_revision';
-    if (totalWeight > 0) {
-        const approveRatio = approveWeight / totalWeight;
+    if (weightedConfidenceSum > 0) {
+        const approveRatio = approveWeight / weightedConfidenceSum;
         if (approveRatio > 0.66) {
             finalDecision = 'approve';
         }

package/dist/governance/governance-service.js

@@ -136,22 +136,24 @@ export class GovernanceService {
                 let finalDecision = merged.finalDecision;
                 let averageConfidence = merged.averageConfidence;
                 let moralOverride = 'none';
-                if (externalVote?.moralTension ||
-                    externalVote?.moralScore != null ||
-                    externalVote?.moralFusion != null) {
+                if (externalVote &&
+                    (externalVote.moralTension ||
+                        externalVote.moralScore != null ||
+                        externalVote.moralFusion != null)) {
                     const matrixInput = {
                         resonance: averageConfidence,
-                        isotopicRatio: externalVote.moralFusion ?? 0.5,
                     };
+                    const fusion = externalVote.moralFusion;
+                    if (typeof fusion === 'number' && Number.isFinite(fusion)) {
+                        matrixInput.isotopicRatio = fusion;
+                        matrixInput.moralFusion = fusion;
+                    }
                     if (externalVote.moralTension != null) {
                         matrixInput.moralTension = externalVote.moralTension;
                     }
                     if (externalVote.moralScore != null) {
                         matrixInput.moralScore = externalVote.moralScore;
                     }
-                    if (externalVote.moralFusion != null) {
-                        matrixInput.moralFusion = externalVote.moralFusion;
-                    }
                     const matrix = applyDecisionMatrix(matrixInput);
                     moralOverride = matrix.moralOverride ?? 'none';
                     if (matrix.recommendation === 'REJECT') {