0xray 4.0.22 → 4.0.24

package/dist/processors/implementations/inference-improvement-processor.js

@@ -13,6 +13,9 @@ import { PostProcessor } from "../processor-interfaces.js";
 import { frameworkLogger } from "../../core/framework-logger.js";
 import { getConfigDir } from "../../core/config-paths.js";
 import { featuresConfigLoader } from "../../core/features-config.js";
+import { captureCompletedInferenceOperation, saveReflectionSession } from "../../inference/session-capture.js";
+import { loadReflectionInferences } from "../../inference/inference-accumulator.js";
+import { InferenceCycle } from "../../inference/inference-cycle.js";
 export class InferenceImprovementProcessor extends PostProcessor {
     name = "inferenceImprovement";
     priority = 5;
@@ -55,7 +58,8 @@ export class InferenceImprovementProcessor extends PostProcessor {
         try {
             const workflowContext = await this.prepareWorkflowContext(directory);
             await this.saveWorkflowContext(directory, workflowContext);
-            await this.triggerAgentWorkflow(workflowContext);
+            const workflowId = await this.triggerAgentWorkflow(workflowContext);
+            await this.captureFinishedOperationSpeech(directory, workflowId);
             await frameworkLogger.log("inference-improvement", "workflow_triggered", "info", {
                 dataFiles: workflowContext.dataLocations.reflections.length +
                     workflowContext.dataLocations.logs.length +
@@ -251,12 +255,107 @@ Final validation and application of approved changes:
         });
         const workflowBase = path.isAbsolute(this.workflowDir) ? this.workflowDir : path.join(process.cwd(), this.workflowDir);
         const outputPath = path.join(workflowBase, "workflow-status.json");
+        const workflowId = `inference-${Date.now()}`;
         fs.writeFileSync(outputPath, JSON.stringify({
             status: "in_progress",
             phase: "data_gathering",
             nextAgent: "researcher",
             message: "Invoke @researcher to begin data gathering phase",
-            workflowId: `inference-${Date.now()}`
+            workflowId
         }, null, 2));
+        return workflowId;
+    }
+    /**
+     * The operation is finished once its prompt result text is on disk.
+     * One session per operation id. Empty speech writes nothing.
+     */
+    async captureFinishedOperationSpeech(directory, currentOperationId) {
+        const workflowBase = path.isAbsolute(this.workflowDir)
+            ? this.workflowDir
+            : path.join(directory, this.workflowDir);
+        const promptsDir = path.join(workflowBase, "prompts");
+        const inferenceDir = path.join(directory, "docs", "inference");
+        const signalNames = readStoredSignalNames(directory);
+        const ids = operationIdsToCapture(promptsDir, currentOperationId);
+        let captured = 0;
+        for (const operationId of ids) {
+            const saved = captureCompletedInferenceOperation({
+                operationId,
+                promptsDir,
+                inferenceDir,
+                signalNames,
+            });
+            if (!saved)
+                continue;
+            captured += 1;
+            await frameworkLogger.log("inference-improvement", "operation_session_captured", "info", { operationId, saved });
+        }
+        let reflectionSaved = 0;
+        for (const session of loadReflectionInferences(inferenceDir)) {
+            const saved = saveReflectionSession(session, inferenceDir);
+            if (!saved)
+                continue;
+            reflectionSaved += 1;
+            await frameworkLogger.log("inference-improvement", "reflection_session_written", "info", {
+                sessionId: session.sessionId,
+                saved,
+            });
+        }
+        if (captured === 0 && reflectionSaved === 0)
+            return;
+        const cycle = new InferenceCycle(directory, undefined, {
+            force: true,
+            skipApply: true,
+            skipDeployVerify: true,
+        });
+        await cycle.maybeRunCycle();
+    }
+}
+function operationIdsToCapture(promptsDir, currentOperationId) {
+    const ids = new Set();
+    if (currentOperationId.trim().length > 0)
+        ids.add(currentOperationId);
+    if (!fs.existsSync(promptsDir))
+        return [...ids];
+    for (const name of fs.readdirSync(promptsDir)) {
+        const stem = /^(inference-\d+)\.result\.(md|txt)$/i.exec(name);
+        if (stem?.[1])
+            ids.add(stem[1]);
+        const full = path.join(promptsDir, name);
+        if (!name.endsWith(".md") && !name.endsWith(".txt"))
+            continue;
+        let text = "";
+        try {
+            text = fs.readFileSync(full, "utf8");
+        }
+        catch {
+            continue;
+        }
+        const declared = /^operation:\s*(\S+)\s*$/im.exec(text);
+        if (declared?.[1])
+            ids.add(declared[1]);
+    }
+    return [...ids];
+}
+function readStoredSignalNames(directory) {
+    const dest = path.join(directory, ".xray", "state", "repertoire", "curated_signals.json");
+    if (!fs.existsSync(dest))
+        return [];
+    try {
+        const parsed = JSON.parse(fs.readFileSync(dest, "utf8"));
+        if (!Array.isArray(parsed.signals))
+            return [];
+        const names = [];
+        for (const signal of parsed.signals) {
+            if (!signal || typeof signal !== "object")
+                continue;
+            const name = signal.name;
+            if (typeof name === "string" && name.trim().length > 0)
+                names.push(name.trim());
+        }
+        return names;
+    }
+    catch {
+        return [];
     }
 }

package/dist/processors/implementations/storytelling-trigger-processor.js

@@ -5,7 +5,6 @@ import { PostProcessor } from "../processor-interfaces.js";
 import { frameworkLogger } from "../../core/framework-logger.js";
 import { featuresConfigLoader } from "../../core/features-config.js";
 import { analyzeStructuralPatterns, } from "../../inference/semantic-patterns.js";
-import { captureSessionInference, saveSessionInference, } from "../../inference/session-capture.js";
 export class StorytellingTriggerProcessor extends PostProcessor {
     name = "storytelling-trigger";
     priority = 5;
@@ -327,16 +326,7 @@ export class StorytellingTriggerProcessor extends PostProcessor {
                 inferences.push(`${p.name} pattern detected [${Math.round(p.confidence * 100)}%]: ${p.description}${evidence}`);
             }
             if (semanticPatterns.length > 0) {
-                try {
-                    const session = captureSessionInference(sinceRef, untilRef);
-                    if (session) {
-                        const savedPath = saveSessionInference(session);
-                        inferences.push(`Structured inference captured → ${path.basename(savedPath)}`);
-                    }
-                }
-                catch {
-                    // session capture is best-effort
-                }
+                inferences.push("Semantic patterns stay on the reflection. A graded session comes from finished operation speech, not from commit subjects.");
             }
         }
         if (diff.filesAdded.some(f => f.includes("implementations/") && f.endsWith(".ts"))) {

package/dist/processors/processor-manager.d.ts

@@ -68,7 +68,7 @@ export declare class ProcessorManager {
         success: boolean;
         results: ProcessorResult[];
     }>;
-    executePostProcessors(operation: string, data: any, preResults: ProcessorResult[]): Promise<ProcessorResult[]>;
+    executePostProcessors(operation: string, data: unknown, preResults: ProcessorResult[]): Promise<ProcessorResult[]>;
     private executeProcessor;
     private updateMetrics;
     getProcessorHealth(): ProcessorHealth[];

package/dist/processors/processor-manager.js

@@ -1,6 +1,24 @@
 import { frameworkLogger } from "../core/framework-logger.js";
 import { readdir } from "fs/promises";
-import { join, basename } from "path";
+import { join, basename, dirname } from "path";
+import { fileURLToPath } from "url";
+const moduleDir = dirname(fileURLToPath(import.meta.url));
+function asProcessorContext(ctx) {
+    return ctx;
+}
+function readContextString(ctx, key) {
+    const direct = ctx[key];
+    if (typeof direct === "string" && direct.length > 0)
+        return direct;
+    const toolInput = ctx.toolInput;
+    if (!toolInput || typeof toolInput !== "object")
+        return undefined;
+    const args = toolInput.args;
+    if (!args || typeof args !== "object")
+        return undefined;
+    const value = args[key];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
 export class ProcessorManager {
     processors = new Map();
     metrics = new Map();
@@ -13,24 +31,34 @@ export class ProcessorManager {
         this.registerBuiltInFactories();
     }
     registerProcessorInstance(processor) {
-        if (this.factories.has(processor.name)) {
-            return false;
+        const factoryExisted = this.factories.has(processor.name);
+        if (!factoryExisted) {
+            this.factories.set(processor.name, {
+                execute: async (ctx) => {
+                    const result = await processor.execute(asProcessorContext(ctx));
+                    return result.data;
+                },
+            });
+        }
+        const processorExisted = this.processors.has(processor.name);
+        if (!processorExisted) {
+            this.registerProcessor({
+                name: processor.name,
+                type: processor.type,
+                priority: processor.priority,
+                enabled: processor.enabled,
+            });
         }
-        this.factories.set(processor.name, {
-            execute: async (ctx) => {
-                const result = await processor.execute(ctx);
-                return result.data;
-            },
-        });
         frameworkLogger.log("processor-manager", "auto-discovered-processor", "info", {
             name: processor.name,
             type: processor.type,
             priority: processor.priority,
+            registered: !processorExisted,
         });
-        return true;
+        return !factoryExisted || !processorExisted;
     }
     async discoverProcessors(directory) {
-        const dir = directory || join(__dirname, "implementations");
+        const dir = directory || join(moduleDir, "implementations");
         const discovered = [];
         let files;
         try {
@@ -130,8 +158,8 @@ export class ProcessorManager {
             execute: async (ctx) => {
                 const { LogProtectionProcessor } = await import("./implementations/log-protection-processor.js");
                 const p = new LogProtectionProcessor();
-                const filePath = ctx.filePath || ctx.toolInput?.args?.filePath;
-                const operation = ctx.operation || ctx.toolInput?.args?.operation;
+                const filePath = readContextString(ctx, "filePath");
+                const operation = readContextString(ctx, "operation");
                 const result = await p.execute({ filePath, operation });
                 return result.data;
             },
@@ -229,7 +257,7 @@ export class ProcessorManager {
         f.set("testAutoCreation", {
             execute: async (ctx) => {
                 const { testAutoCreationProcessor } = await import("./implementations/test-auto-creation-processor.js");
-                const result = await testAutoCreationProcessor.execute(ctx);
+                const result = await testAutoCreationProcessor.execute(asProcessorContext(ctx));
                 return { success: result.success, message: result.message, data: result.data };
             },
             init: async () => {
@@ -249,8 +277,8 @@ export class ProcessorManager {
                 const { AgentsMdValidationProcessor } = await import("./implementations/agents-md-validation-processor.js");
                 const p = new AgentsMdValidationProcessor(process.cwd());
                 const result = await p.execute({
-                    tool: ctx.tool || "validate",
-                    operation: ctx.operation || "pre-commit",
+                    tool: readContextString(ctx, "tool") ?? "validate",
+                    operation: readContextString(ctx, "operation") ?? "pre-commit",
                 });
                 return {
                     success: result.success,
@@ -283,7 +311,7 @@ export class ProcessorManager {
         f.set("typescriptCompilation", {
             execute: async (ctx) => {
                 const { runTypeScriptCompilation } = await import("./implementations/typescript-compilation-processor.js");
-                const cwd = ctx.directory || process.cwd();
+                const cwd = readContextString(ctx, "directory") ?? process.cwd();
                 return runTypeScriptCompilation(cwd);
             },
             init: async () => {
@@ -762,10 +790,14 @@ export class ProcessorManager {
         if (Array.isArray(context)) {
             return { valid: true, errors: [] };
         }
-        const contextData = context.data;
+        const record = context;
+        const contextData = record.data;
         if (contextData && typeof contextData !== "object") {
             return { valid: true, errors: [] };
         }
+        const dataRecord = contextData && typeof contextData === "object"
+            ? contextData
+            : {};
         const requiredFields = {
             preValidate: ["operation"],
             codexCompliance: ["operation"],
@@ -779,7 +811,7 @@ export class ProcessorManager {
         };
         const required = requiredFields[processorName] || [];
         for (const field of required) {
-            if (!(field in context) && !(field in (context.data || {}))) {
+            if (!(field in record) && !(field in dataRecord)) {
                 errors.push(`Missing required field: ${field}`);
             }
         }
@@ -787,7 +819,7 @@ export class ProcessorManager {
             frameworkLogger.log("processor-manager", "context-validation-warnings", "info", {
                 processor: processorName,
                 errors,
-                contextKeys: Object.keys(context),
+                contextKeys: Object.keys(record),
             });
         }
         return { valid: errors.length === 0, errors };

package/dist/skills/orchestrator/SKILL.md

@@ -7,15 +7,15 @@ version: 1.0.0
 schema_version: "1.0"
 tags: [orchestration, orchestrator, lead-dev]
 capabilities:
-  - coordinate_agents
-  - delegate_tasks
-  - manage_workflow
+ - coordinate_agents
+ - delegate_tasks
+ - manage_workflow
 dependencies: []
 
 mcp:
-  orchestrator:
-    command: node
-    args: [node_modules/0xray/dist/mcps/orchestrator.server.js]
+ orchestrator:
+ command: node
+ args: [node_modules/0xray/dist/mcps/orchestrator.server.js]
 ---
 
 # Orchestrator Skill — includes lead-dev operating model
@@ -77,7 +77,7 @@ Jargon is not the job. Review and cadence ask whether the change works. Do not s
 - **Live tick, not pacer:** `/loop` runs work now. Keep workstreams moving. Do not idle-wait 12 minutes. **Clean ticks every cycle** — unsubscribe then resubscribe so the prompt matches metal. Name-dedupe does not rewrite. A stale prompt (waiting URL after live, Hold after strip) is dirty: rewrite, do not act. **If the card and WAVEBOARD are idle, unsubscribe and do not resubscribe.**
 - **Board clock:** PR events + resume the same critic. Not two idle pacers. Merge after PASS+CI (gate A). Publish only after mill-gate D + `foundry gate`.
 - **Dispatch:** ticket + PR URLs + “Wear, then review.” The critic Reads `SEATS.md` Reviewer. Do not paste a command novel. When a law is spoken twice, encode it this wake.
-- **Cascade:** Chat is not the brain. A cascade that must survive compaction is a named repertoire signal on the stack overlay, hydrated onto the project law list. NOTES holds the same cascade for the second Read. Station stays the ticket. A reflection is not this capture. Capture priority: a law is an invariant you would otherwise re-read the source to relearn. One law per subsystem bone. Heat touches last_seen and does not append a confidence sample, so more hits do not raise conviction. Heat touches last_seen only when the diary contains that signal's name; two definition words are not a hit; a weak session score is not lifted to 0.55 and a sample below 0.55 is not recorded. Constructing the organ does not append workspace samples. Hero names: `heat-is-not-conviction`, `inference-cycle-invariant`, `governance-vote-invariant`, `thin-dispatch-invariant`. Repertoire mergeStackOverlay refreshes a changed stack definition and keeps observation stats.
+- **Cascade:** Chat is not the brain. A cascade that must survive compaction is a named repertoire signal on the stack overlay, hydrated onto the project law list. NOTES holds the same cascade for the second Read. Station stays the ticket. A reflection is not this capture. Capture priority: a law is an invariant you would otherwise re-read the source to relearn. One law per subsystem bone. Heat touches last_seen and does not append a confidence sample, so more hits do not raise conviction. Heat touches last_seen when the diary contains that signal's name or a local clause of four definition content words; two definition words are not a hit; the same words scattered through a long diary are not a hit; a weak session score is not lifted to 0.55 and a sample below 0.55 is not recorded. Constructing the organ does not append workspace samples. Hero names: `heat-is-not-conviction`, `inference-cycle-invariant`, `governance-vote-invariant`, `thin-dispatch-invariant`. Repertoire mergeStackOverlay refreshes a changed stack definition and keeps observation stats. A floor observation count does not change a route. Feedback moves conviction by a tenth, and a failure can leave 0.55. learned-conviction.json beside dest restores that average when a wake flattens it to 0.55. It does not store the observation count.
 - **Cold brief:** a new critic or any new subagent that does not already have this thread gets the latest commit SHA on the branch under review (fetch it; do not reuse an earlier SHA from a previous pass) and the Station card (`.xray/state/STATION.md`: intent, plan, git). If the card is missing, give branch + HEAD + what just changed. If the branch moves after you brief them, send the new SHA before they verdict.
 - **Control:** The lead keeps control. Do not assume the subagent has the context. Give the duty, the latest SHA, the Station card, and the laws that apply. The subagent wears the applicable 0xRay suit before it works: the tree under review, built and installed. An older published package is not that suit. The lead checks the result.
 

package/llms.txt

@@ -35,7 +35,7 @@ Registered in `.mcp.json` as `npx -y 0xray mcp <cmd>`:
 | `xray-code-review` | Proposal quality |
 | `xray-architect-tools` | System design |
 
-Not an 8th `xray-*` server. **Repertoire is preferred** — vendored 0.2.5 ships on (`npx @0xray/repertoire mcp`). Dest is named laws, not hangar `repo-*` or git slugs. Survive compact is **Station** (Read `.xray/state/STATION.md`). Station is the ticket, not a substitute for Repertoire. Do not pin 0.1.8.
+Not an 8th `xray-*` server. **Repertoire is preferred** — vendored 0.2.8 ships on (`npx @0xray/repertoire mcp`). Dest is named laws, not hangar `repo-*` or git slugs. Survive compact is **Station** (Read `.xray/state/STATION.md`). Station is the ticket, not a substitute for Repertoire. Do not pin 0.1.8.
 
 ## Codex 69 (always on)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.22",
+  "version": "4.0.24",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",

package/scripts/foundry/plant/skills/mill/SKILL.md

@@ -11,7 +11,7 @@ The mill **fastens** a suit. Default mill plant is **inspect** (inspecting AI wo
 
 **Mill-fill:** their keys/files win. Mill plant names they did not overlay stay. JSON always merges.
 
-**Factory:** **Repertoire is preferred** (vendored 0.2.5 ships on; dest = named laws). Seven generated MCP. Constitution (PPE) stays worn. Not a fifth MCP. Not 5.0.
+**Factory:** **Repertoire is preferred** (vendored 0.2.8 ships on; dest = named laws). Seven generated MCP. Constitution (PPE) stays worn. Not a fifth MCP. Not 5.0.
 
 **Costume:** `foundry.json` `"costume": true` copies the 45/42 mill costume.
 

package/scripts/foundry/reconcile-version.mjs

@@ -9,6 +9,9 @@
  *   npx @0xray/foundry reconcile --check
  *   npx @0xray/foundry reconcile patch
  *   npx @0xray/foundry reconcile patch --apply
+ *
+ * --apply writes package.json and the package-lock.json version fields.
+ * --check fails when the lock does not match package.json.
  */
 
 import { execSync } from "child_process";
@@ -16,6 +19,7 @@ import fs from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
 import { readRootPackage, resolveMillRoot } from "./mill-root.mjs";
+import { packageLockVersions, syncPackageLockVersion } from "./version-manager.mjs";
 
 const rootDir = resolveMillRoot();
 const pkgPath = path.join(rootDir, "package.json");
@@ -101,8 +105,12 @@ function main() {
   }
 
   console.log("\n=== Version Reconcile ===\n");
+  const lockBefore = packageLockVersions(rootDir);
   console.log(`  npm registry : ${npm}`);
   console.log(`  package.json : ${local}`);
+  console.log(
+    `  package-lock : ${lockBefore ? `${lockBefore.root} / ${lockBefore.pkg}` : "(none)"}`,
+  );
   console.log(`  latest tag   : ${tag ? `v${tag}` : "(none)"}`);
   if (bumpType) {
     console.log(`  bump ${bumpType}  : ${target} (from baseline ${baseline})`);
@@ -112,7 +120,13 @@ function main() {
     const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
     pkg.version = target;
     fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
-    console.log(`\n✅ Updated package.json → ${target}`);
+    const synced = syncPackageLockVersion(rootDir, target);
+    if (synced === "unmatched") {
+      fail(
+        `package-lock.json version fields were not updated to ${target}. Refusing to leave the lock behind package.json.`,
+      );
+    }
+    console.log(`\n✅ Updated package.json and package-lock.json → ${target}`);
   }
 
   if (!checkMode) {
@@ -129,6 +143,14 @@ function main() {
     fail(`package.json (${local}) must be > npm (${npm}). Run: npx @0xray/foundry reconcile patch --apply`);
   }
 
+  const pkgVersion = readLocalVersion();
+  const lockNow = packageLockVersions(rootDir);
+  if (lockNow && (lockNow.root !== pkgVersion || lockNow.pkg !== pkgVersion)) {
+    fail(
+      `package-lock.json (${lockNow.root} / ${lockNow.pkg}) must match package.json (${pkgVersion}). The bumper writes both: npx @0xray/foundry reconcile patch --apply`,
+    );
+  }
+
   if (tag && compare(local, tag) < 0) {
     fail(`package.json (${local}) is behind latest tag v${tag}`);
   }

package/scripts/foundry/release.mjs

@@ -3,7 +3,7 @@
 /**
  * Canonical 0xRay release script.
  *
- * 1. Bump version from npm registry baseline (reconcile-version)
+ * 1. Bump version from npm registry baseline (reconcile-version writes package.json and package-lock.json)
  * 2. Release artifacts (CHANGELOG / README / AGENTS / docs) — before gate so docs tests pass
  * 3. Release gate (build + test + consumer smoke)
  * 4. Commit release artifacts → push

package/scripts/foundry/version-manager.mjs

@@ -333,6 +333,57 @@ function updateFeaturesJsonVersion(newVersion) {
   updateJsonVersionField('.xray/features.json', newVersion);
 }
 
+export function packageLockVersions(dir) {
+  const full = path.join(dir, 'package-lock.json');
+  if (!fs.existsSync(full)) return null;
+  const lock = JSON.parse(fs.readFileSync(full, 'utf-8'));
+  const root = typeof lock.version === 'string' ? lock.version : '';
+  const pkg = typeof lock.packages?.['']?.version === 'string' ? lock.packages[''].version : '';
+  return { root, pkg };
+}
+
+/**
+ * Write the root lock version and packages[""].version to match package.json.
+ * Returns 'missing' | 'same' | 'updated' | 'unmatched'.
+ * Does not rewrite the rest of the lock.
+ */
+export function syncPackageLockVersion(dir, newVersion) {
+  const full = path.join(dir, 'package-lock.json');
+  if (!fs.existsSync(full)) return 'missing';
+  const raw = fs.readFileSync(full, 'utf-8');
+  const current = packageLockVersions(dir);
+  if (current && current.root === newVersion && current.pkg === newVersion) return 'same';
+  const previous = current?.root ?? '';
+  const lines = raw.split('\n');
+  let rootDone = false;
+  let pkgDone = false;
+  const next = lines.map((line) => {
+    if (!rootDone && line === `  "version": "${previous}",`) {
+      rootDone = true;
+      return `  "version": "${newVersion}",`;
+    }
+    if (rootDone && !pkgDone && line === `      "version": "${previous}",`) {
+      pkgDone = true;
+      return `      "version": "${newVersion}",`;
+    }
+    return line;
+  });
+  if (!rootDone || !pkgDone) return 'unmatched';
+  fs.writeFileSync(full, next.join('\n'));
+  return 'updated';
+}
+
+function updatePackageLockVersion(newVersion) {
+  const synced = syncPackageLockVersion(rootDir, newVersion);
+  if (synced === 'updated') {
+    console.log(`✅ Updated package-lock.json (version: ${newVersion})`);
+  }
+  if (synced === 'unmatched') {
+    console.error(`\n❌ package-lock.json version fields did not match the expected shape for ${newVersion}\n`);
+    process.exit(1);
+  }
+}
+
 function updateOpenclawPluginVersion(newVersion) {
   updateJsonVersionField('src/integrations/openclaw/plugin/xray-pre-tool/package.json', newVersion);
 }
@@ -482,6 +533,7 @@ export function getReleaseArtifactPaths(baseDir = resolveMillRoot()) {
     'docs-site/sidebars.ts',
     'xray/features.json',
     '.xray/features.json',
+    'package-lock.json',
     'docs/PIPELINE-FACET-SNAPSHOT.json',
     'src/integrations/openclaw/plugin/xray-pre-tool/package.json',
   ];
@@ -497,6 +549,7 @@ function updateReleaseArtifactsOnly(changeDescription = '') {
   updateChangelog(current, changeDescription);
   updatePluginJsonVersion(current);
   updateFeaturesJsonVersion(current);
+  updatePackageLockVersion(current);
   updateOpenclawPluginVersion(current);
   const stripped = stripLivePatchRefs(rootDir, current);
   if (stripped.length > 0) {

package/scripts/node/consumer-install-smoke.mjs

@@ -92,7 +92,7 @@ function assertOrganRequire(tmpRoot) {
   if (organPkg.name !== "@0xray/repertoire") {
     throw new Error(`required organ name ${organPkg.name}`);
   }
-  if (organPkg.version !== "0.2.5") {
+  if (organPkg.version !== "0.2.8") {
     throw new Error(`required organ version ${organPkg.version}`);
   }
   if (fs.existsSync(path.join(tmpRoot, "vendor"))) {
@@ -165,8 +165,8 @@ function assertFreshInstallDefaults(tmpRoot, version) {
     throw new Error("vendored @0xray/repertoire missing from fresh tarball install");
   }
   const organ = JSON.parse(fs.readFileSync(organPkg, "utf-8"));
-  if (organ.version !== "0.2.5") {
-    throw new Error(`expected organ 0.2.5, got ${organ.version}`);
+  if (organ.version !== "0.2.8") {
+    throw new Error(`expected organ 0.2.8, got ${organ.version}`);
   }
   console.log("  ✅ .xray/features.json fresh-install defaults (opt-in off)");
   return { consumerFeaturesPath, features };

package/src/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.22",
+  "version": "4.0.24",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/src/mcps/governance.server.ts

@@ -245,8 +245,19 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
     }
   }
 
+  /** Boot stays flag-gated. A required external call starts the client on demand. */
+  private async armRequiredDynamo(requireExternal: boolean): Promise<void> {
+    if (!requireExternal) return;
+    const integration = await initializeGovernanceIntegration();
+    if (!integration.isAvailable()) {
+      await integration.ensureDynamoClient();
+    }
+  }
+
   private async handleGovernProposals(args: GovernProposalsArgs): Promise<CallToolResult> {
     const service = getGovernanceService();
+    const requireExternal = this.resolveRequireExternal(args.options?.require_external);
+    await this.armRequiredDynamo(requireExternal);
 
     const request: GovernanceRequest = {
       proposals: args.proposals.map((p, i) => ({
@@ -260,7 +271,7 @@ class GovernanceServer extends XrayKnowledgeSkillBase {
       })),
       context: args.context || {},
       options: {
-        requireExternalDynamo: this.resolveRequireExternal(args.options?.require_external),
+        requireExternalDynamo: requireExternal,
       },
     };