0xray 4.0.34 → 4.0.35

package/.grok-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.34",
+  "version": "4.0.35",
   "description": "0xRay suit for Grok, Hermes, OpenClaw, OpenCode: mill+inspect, Codex, 7 MCP servers. Costume 45/42 is opt-in foundry, not the default wear.",
   "author": {
     "name": "0xRay AI",

package/.xray/codex.json

@@ -1,6 +1,6 @@
 {
   "version": "3.1.0",
-  "lastUpdated": "2026-08-24",
+  "lastUpdated": "2026-10-01",
   "errorPreventionTarget": 0.998,
   "terms": {
     "1": {
@@ -62,7 +62,7 @@
     "8": {
       "number": 8,
       "title": "Prevent Infinite Loops",
-      "description": "Guarantee termination in all iterative processes. All loops must have clear termination conditions. Recursive functions must have base cases. Event loops must have exit strategies. Async operations must have timeout mechanisms.",
+      "description": "Guarantee termination in all iterative processes. All loops must have clear termination conditions. Recursive functions must have base cases. Event loops must have exit strategies. Async operations must have timeout mechanisms. A job names when it is done and when it stops.",
       "category": "core",
       "zeroTolerance": true,
       "enforcementLevel": "blocking"
@@ -230,7 +230,7 @@
     "29": {
       "number": 29,
       "title": "Security by Design",
-      "description": "Validate all inputs. Sanitize data before rendering. Use HTTPS for all requests. Implement rate limiting. Never expose sensitive data.",
+      "description": "Validate all inputs. Sanitize data before rendering. Use HTTPS for all requests. Implement rate limiting. Never expose sensitive data. Do not trust Host or X-Forwarded-Host to choose an environment. A refusal in the UI needs the same check on the server.",
       "category": "security",
       "zeroTolerance": true,
       "enforcementLevel": "blocking"
@@ -534,7 +534,7 @@
     "67": {
       "number": 67,
       "title": "Use Best Subagents, Reuse Session Context",
-      "description": "Delegate work to the best-suited subagent for each task. Stay responsive to user inquiries, additional todos, and course corrections. Reuse the same subagent via session ID to preserve context and avoid restarting from zero. Do not spawn fresh agents when an existing one has the relevant context.",
+      "description": "Delegate work to the best-suited subagent for each task. Stay responsive to user inquiries, additional todos, and course corrections. Reuse the same subagent via session ID to preserve context and avoid restarting from zero. Do not spawn fresh agents when an existing one has the relevant context. Reuse one cloud for a workstream. Do not launch a new agent for a check the seat can run.",
       "category": "process",
       "zeroTolerance": false,
       "enforcementLevel": "high"
@@ -554,6 +554,14 @@
       "category": "process",
       "zeroTolerance": true,
       "enforcementLevel": "blocking"
+    },
+    "70": {
+      "number": 70,
+      "title": "Current Copy Before Edits",
+      "description": "Before an edit, be on the latest main and run the current package. If this repo is 0xray, this repo is that package. An older package waits. Compare set-aside work to main before you throw it away.",
+      "category": "process",
+      "zeroTolerance": true,
+      "enforcementLevel": "blocking"
     }
   },
   "interweaves": [

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.34",
+  "version": "4.0.35",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/AGENTS-consumer.md

@@ -72,14 +72,14 @@ Governance deliberation uses **code-review**, **security-audit** (via enforcer/s
 
 xray operates under the three-subsystem model: **Inference** + **External Governance** (Dynamo Solar SSOT) + **Autonomous Engine** (thinDispatch 7-flow in MCP orchestrator). All actions are validated against the Universal Development Codex before execution.
 
-**Codex**: `.xray/codex.json` — **69 terms** across all agent interactions.
+**Codex**: `.xray/codex.json` — **70 terms** across all agent interactions.
 
 ## thinDispatch Routing
 
-- Simple (≤15): Single agent
-- Moderate (≤25): Single agent with tools
-- Complex (≤50): Multi-agent coordination
-- Enterprise (>50): Orchestrator-led team
+- Simple (≤15): single-agent
+- Moderate (≤25): multi-agent
+- Complex (≤50): orchestrator-led
+- Enterprise (>50): orchestrator-led
 
 ## AsideContext (v3.2+)
 
@@ -117,7 +117,7 @@ Tools: `repertoire__get_task_confidence`, `repertoire__get_high_confidence_signa
 
 ## Codex OS (always on — not optional)
 
-The Universal Development Codex (`.xray/codex.json`, **69 terms**) is enforced by **PreToolUse** (blocks) and this section (brain). MCP enforcer is audit — not the gate.
+The Universal Development Codex (`.xray/codex.json`, **70 terms**) is enforced by **PreToolUse** (blocks) and this section (brain). MCP enforcer is audit — not the gate.
 
 | Term | Rule | Enforcement |
 |------|------|-------------|

package/AGENTS.md

@@ -125,7 +125,7 @@ Governance deliberation: **code-review**, **security-audit**, **researcher** wit
 | **3.2.0** | AsideContext wired, SelfProposalEngine, pre-tool-use hook |
 | **3.1.1** | 0xRay rename, marketplace, AGENTS/SKILLS consumer seeding |
 
-**Removed:** `hermes bridge`, `.opencode/xray/` fallback, `advanced-features/` on consumer boot.
+**Removed:** `hermes bridge`, `.opencode/xray/` fallback, `advanced-features/`.
 
 ## Default operating mode: autonomy-command
 
@@ -209,10 +209,10 @@ Full skill mapping: [SKILLS.md](SKILLS.md).
 
 ## thinDispatch routing
 
-- Simple (≤15): Single agent
-- Moderate (≤25): Single agent with tools
-- Complex (≤50): Multi-agent coordination
-- Enterprise (>50): Orchestrator-led team
+- Simple (≤15): single-agent
+- Moderate (≤25): multi-agent
+- Complex (≤50): orchestrator-led
+- Enterprise (>50): orchestrator-led
 
 ## Documentation
 

package/README.md

@@ -78,7 +78,7 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 - **`hermes bridge`** CLI removed — use `npx 0xray hermes install`.
 - **`.opencode/xray/` fallback** removed from auto-reflection-generator (3.1.1).
 - **~180 stale `@version` JSDoc tags** and **"xray 2.0" command doc strings** cleaned (3.2.0).
-- **`advanced-features/`** decoupled from core boot — not on the consumer install path.
+- **`advanced-features/`** removed. The live Grok hook is `pre-tool-use.js`.
 - **PostProcessor** soft-deprecated since 3.0 (`enablePostProcessor: false` default).
 
 ## Three-Subsystem Architecture
@@ -196,7 +196,7 @@ Docs: [memory routing](docs-site/docs/guides/memory-routing.md) · [Repertoire](
 
 ## Governance & Codex
 
-- **69 terms** in `.xray/codex.json` — core, architecture, testing, performance, security, operations, governance (Codex 69: no new MCP/skill/handler surface)
+- **70 terms** in `.xray/codex.json` — core, architecture, testing, performance, security, operations, governance (Codex 69: no new MCP/skill/handler surface; Codex 70: current copy before edits)
 - CodexPolicyService — Governance-owned SSOT for codex loading
 - Pre-governance gate blocks non-compliant proposals
 - Active codex snapshot via `get_active_codex` MCP tool

package/dist/AGENTS.md

@@ -125,7 +125,7 @@ Governance deliberation: **code-review**, **security-audit**, **researcher** wit
 | **3.2.0** | AsideContext wired, SelfProposalEngine, pre-tool-use hook |
 | **3.1.1** | 0xRay rename, marketplace, AGENTS/SKILLS consumer seeding |
 
-**Removed:** `hermes bridge`, `.opencode/xray/` fallback, `advanced-features/` on consumer boot.
+**Removed:** `hermes bridge`, `.opencode/xray/` fallback, `advanced-features/`.
 
 ## Default operating mode: autonomy-command
 
@@ -209,10 +209,10 @@ Full skill mapping: [SKILLS.md](SKILLS.md).
 
 ## thinDispatch routing
 
-- Simple (≤15): Single agent
-- Moderate (≤25): Single agent with tools
-- Complex (≤50): Multi-agent coordination
-- Enterprise (>50): Orchestrator-led team
+- Simple (≤15): single-agent
+- Moderate (≤25): multi-agent
+- Complex (≤50): orchestrator-led
+- Enterprise (>50): orchestrator-led
 
 ## Documentation
 

package/dist/CHANGELOG.md

@@ -42,6 +42,22 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 - Archive root `integrations/` costume SKILL dump → `docs/archive/integrations-costume/`. Live wear is `src/integrations`.
 - Archive root `commands/` stale copy → `docs/archive/commands-copy/`. Live wear is `src/opencode/commands`.
 
+## [4.0.35] - 2026-10-02
+
+### 🔄 Changes
+
+### 🐛 Bug Fixes
+- fix: wear rewrites a checkout dist/cli launch to node_modules/0xray (aa44ae462)
+
+### 📚 Documentation
+- docs: point the trim restore at 601cdafc0 (be2a4e91d)
+- docs: say what each chat can actually do (0c70532a6)
+
+### 🔧 Maintenance
+- chore: drop unused modules and wait for the registry before tagging (3a29409a8)
+
+---
+
 ## [4.0.34] - 2026-10-01
 
 ### 🔄 Changes

package/dist/README.md

@@ -78,7 +78,7 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 - **`hermes bridge`** CLI removed — use `npx 0xray hermes install`.
 - **`.opencode/xray/` fallback** removed from auto-reflection-generator (3.1.1).
 - **~180 stale `@version` JSDoc tags** and **"xray 2.0" command doc strings** cleaned (3.2.0).
-- **`advanced-features/`** decoupled from core boot — not on the consumer install path.
+- **`advanced-features/`** removed. The live Grok hook is `pre-tool-use.js`.
 - **PostProcessor** soft-deprecated since 3.0 (`enablePostProcessor: false` default).
 
 ## Three-Subsystem Architecture
@@ -196,7 +196,7 @@ Docs: [memory routing](docs-site/docs/guides/memory-routing.md) · [Repertoire](
 
 ## Governance & Codex
 
-- **69 terms** in `.xray/codex.json` — core, architecture, testing, performance, security, operations, governance (Codex 69: no new MCP/skill/handler surface)
+- **70 terms** in `.xray/codex.json` — core, architecture, testing, performance, security, operations, governance (Codex 69: no new MCP/skill/handler surface; Codex 70: current copy before edits)
 - CodexPolicyService — Governance-owned SSOT for codex loading
 - Pre-governance gate blocks non-compliant proposals
 - Active codex snapshot via `get_active_codex` MCP tool

package/dist/cli/index.js

@@ -411,13 +411,10 @@ program
         process.exit(1);
     }
 });
-// Analytics command - pattern analysis, insights, and consent management
+// Analytics command - pattern analysis from recent task completions
 program
     .command("analytics")
-    .description("xray Central Analytics - Pattern analysis, insights, and consent management\n" +
-    "  In v1.7.2+: Includes consent management with granular control\n" +
-    "  Use 'npx xray analytics enable' to opt-in to data sharing\n" +
-    "  Core classes: ConsentManager, AnonymizationEngine available programmatically")
+    .description("Pattern analysis from recent task completions")
     .option("-l, --limit <number>", "Limit analysis to last N task completions")
     .option("-o, --output <file>", "Save report to file")
     .action(async (opts) => {

package/dist/governance/governance-service.js

@@ -310,7 +310,7 @@ export class GovernanceService {
                         decision: result.vote === 'YES' ? 'approve' : result.vote === 'NO' ? 'reject' : 'needs_revision',
                         confidence: result.governanceResponse?.confidence ?? 0.85,
                         reasoning: result.reason || 'Dynamo Solar SSOT filter decision',
-                        weight: 1.1,
+                        weight: typeof result.weight === 'number' ? result.weight : 1.1,
                         moralTension: result.moralTension,
                         moralScore: result.moralScore,
                         moralFusion: result.moralFusion,

package/dist/integrations/base/README.md

@@ -18,7 +18,6 @@ src/integrations/
 │   ├── types.ts           # TypeScript interfaces and types
 │   ├── Integration.ts     # BaseIntegration abstract class
 │   ├── registry.ts        # IntegrationRegistry class
-│   ├── ExampleIntegration.ts  # Example implementation
 │   └── index.ts           # Module exports
 ├── core/                  # Core framework integrations
 │   └── xray-integration.ts  # Cross-framework integration
@@ -417,14 +416,7 @@ await this.log('debug', 'Debug information', { data });
 
 ## Example Integration
 
-See [`ExampleIntegration.ts`](./ExampleIntegration.ts) for a complete example demonstrating:
-
-- Custom integration class extending `BaseIntegration`
-- Using `createSimpleIntegration` factory
-- Event handling
-- Error handling
-- Health checks
-- Configuration management
+A host integration extends `BaseIntegration` in `Integration.ts`. `createSimpleIntegration` is the short factory. Register the instance from `registry.ts`.
 
 ## Testing
 

package/dist/integrations/base/index.d.ts

@@ -8,4 +8,3 @@
 export * from "./types.js";
 export * from "./Integration.js";
 export * from "./registry.js";
-export * from "./ExampleIntegration.js";

package/dist/integrations/base/index.js

@@ -11,5 +11,3 @@ export * from "./types.js";
 export * from "./Integration.js";
 // Re-export registry
 export * from "./registry.js";
-// Re-export example (for documentation/testing)
-export * from "./ExampleIntegration.js";

package/dist/integrations/governance/index.js

@@ -11,6 +11,20 @@ import { DEFAULT_GOVERNANCE_CONFIG, resolveDynamoBaseUrl } from './types.js';
 import { GovernanceClient } from './governance-client.js';
 import { frameworkLogger } from '../../core/framework-logger.js';
 import { featuresConfigLoader } from '../../core/features-config.js';
+const SOLAR_VERDICTS = ['PASS', 'NEEDS_REVISION', 'REJECT'];
+function isSolarVerdict(value) {
+    return value === 'PASS' || value === 'NEEDS_REVISION' || value === 'REJECT';
+}
+/**
+ * Dynamo's `recommendation` is the decision.
+ * A missing or unrecognized verdict fails closed. Solar mood is not a verdict.
+ */
+function readSolarVerdict(response) {
+    if (isSolarVerdict(response.recommendation)) {
+        return response.recommendation;
+    }
+    return 'NEEDS_REVISION';
+}
 /**
  * Main Governance Integration class
  *
@@ -150,10 +164,19 @@ export class InferenceGovernanceIntegration extends BaseIntegration {
             baseVoteWeight: this.configData.decisionLogic.voteWeightMultiplier,
         });
         const adjustment = solarResponse.confidenceAdjustment;
-        const recommendation = adjustment <= -0.10 ? 'NEEDS_REVISION' : 'PASS';
+        const recommendation = readSolarVerdict(solarResponse);
+        const resonanceScore = solarResponse.resonanceScore
+            ?? solarResponse.structuralResonance
+            ?? solarResponse.solarContext.solarIsotopicResonance
+            ?? solarResponse.solarContext.solarResonance
+            ?? 0;
+        const confidence = typeof solarResponse.confidence === 'number'
+            ? Math.max(0, Math.min(1, solarResponse.confidence))
+            : Math.max(0, Math.min(1, proposal.confidence));
         const reasons = [
             solarResponse.solarContext.recommendation,
-            `Solar activity: ${solarResponse.solarContext.solarActivityLevel} (adjustment: ${(adjustment * 100).toFixed(0)}%, resonance: ${(solarResponse.solarContext.solarIsotopicResonance ?? solarResponse.solarContext.solarResonance ?? 0).toFixed(4)})`,
+            `Solar activity: ${solarResponse.solarContext.solarActivityLevel} (adjustment: ${(adjustment * 100).toFixed(0)}%, resonance: ${resonanceScore.toFixed(4)})`,
+            `Dynamo recommendation: ${recommendation}`,
         ];
         if (solarResponse.finalRecommendation && solarResponse.finalRecommendation !== solarResponse.originalRecommendation) {
             reasons.push(solarResponse.finalRecommendation);
@@ -169,12 +192,12 @@ export class InferenceGovernanceIntegration extends BaseIntegration {
             success: true,
             proposalId: proposal.id,
             governanceIsotopeId: `solar-${solarResponse.solarContext.solarActivityLevel}`,
-            resonanceScore: solarResponse.solarContext.solarIsotopicResonance ?? solarResponse.solarContext.solarResonance ?? 0,
+            resonanceScore,
             isotopicRatio: 0,
             vortexVolume: 0,
             historicalCoherence: 0,
             recommendation,
-            confidence: Math.max(0, Math.min(1, proposal.confidence + adjustment)),
+            confidence,
             voteWeight: solarResponse.adjustedVoteWeight,
             reasons,
         };
@@ -277,9 +300,9 @@ export class InferenceGovernanceIntegration extends BaseIntegration {
      */
     createFallbackVote(proposal) {
         return {
-            vote: proposal.confidence >= 0.7 ? 'YES' : 'ABSTAIN',
+            vote: 'ABSTAIN',
             weight: 1.0,
-            reason: 'Fallback: governance endpoint unavailable',
+            reason: 'Fallback: governance endpoint unavailable — fail closed',
             governanceResponse: {
                 success: false,
                 proposalId: proposal.id,
@@ -291,9 +314,9 @@ export class InferenceGovernanceIntegration extends BaseIntegration {
                 recommendation: 'NEEDS_REVISION',
                 confidence: proposal.confidence,
                 voteWeight: 1.0,
-                reasons: ['Governance endpoint unavailable, using local confidence'],
+                reasons: ['Governance endpoint unavailable — fail closed, not a local pass'],
             },
-            passed: proposal.confidence >= 0.7,
+            passed: false,
         };
     }
     /**

package/dist/integrations/grok/hooks/grok-hook-utils.js

@@ -303,7 +303,7 @@ export function buildSessionBootPayload(root, source = '0xray/grok-session-start
     ceremony: gateFeatures.ceremony ?? 'full',
     spawn_plan_mode: gateFeatures.spawn_plan_mode ?? 'deny',
     codexBlockingTermCount: blockingTerms.length,
-    codexTerms: [59, 67, 68, 69],
+    codexTerms: [59, 67, 68, 69, 70],
     rules: features.lead_dev_mode ? LEAD_DEV_RULES : [],
     mcpIntake: frontier
       ? 'xray-orchestrator analyze-complexity optional on frontier (spawn warns, does not deny)'

package/dist/integrations/grok/hooks/session-start.js

@@ -23,6 +23,7 @@ import {
   runInferenceImprovementLight,
 } from '../../hooks/pipeline-hook-runtime.mjs';
 import { maintainLens } from '../../hooks/goggles-pipeline.mjs';
+import { readSavedFreshness, refreshFreshness } from '../../../nucleus/work-freshness.mjs';
 
 function resolveHookEvent(event) {
   if (process.env.GROK_HOOK_EVENT) return process.env.GROK_HOOK_EVENT;
@@ -150,12 +151,23 @@ async function main() {
     const matchedSignals =
       HOOK_EVENT === 'user_prompt_submit' ? [] : await matchStationSignals(eventRoot, intent);
     const compact = COMPACT_EVENTS.has(HOOK_EVENT);
+    let freshnessLine = null;
+    if (!compact) {
+      try {
+        freshnessLine = HOOK_EVENT === 'session_start'
+          ? refreshFreshness(eventRoot).freshnessLine
+          : readSavedFreshness(eventRoot);
+      } catch {
+        freshnessLine = null;
+      }
+    }
     const payload = buildSessionBootPayload(eventRoot, source, {
       hookEvent: HOOK_EVENT,
       sessionId: event.sessionId || process.env.GROK_SESSION_ID || null,
       ...(intent ? { intent } : {}),
       ...(!compact && intent ? { cardText: intent } : {}),
       ...(matchedSignals.length ? { matchedSignals } : {}),
+      ...(freshnessLine ? { freshnessLine } : {}),
     });
 
     const bootPath = writeSessionBoot(eventRoot, payload) || ensureSessionBoot(eventRoot, source);

package/dist/integrations/hooks/goggles-pipeline.mjs

@@ -3,6 +3,7 @@
  * A named plane returns its view. Field pipes fill what they can see.
  * The view keeps every field for the next look.
  * A held plane stays quiet. A leave is denied.
+ * On this host a search is grep. The lens file stays open.
  */
 import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
@@ -684,12 +685,58 @@ export function suitHint(text) {
 }
 
 const DEEP_SEARCH = /search_codebase|find_implementation|get_documentation/i;
+const HOLDS_ON_NAME = new Set(['dichotomy', 'syncopate', 'synthesis']);
+
+function mapFiles() {
+  try {
+    const data = JSON.parse(readFileSync(planesFile(), 'utf8'));
+    const files = [];
+    for (const name of [...CARD_PLANES, ...WORN_PLANES]) {
+      const entry = data[name];
+      if (!entry || typeof entry !== 'object') continue;
+      const candidates = [entry.file, entry.worn, entry.skills];
+      if (Array.isArray(entry.files)) candidates.push(...entry.files);
+      for (const file of candidates) {
+        if (typeof file === 'string' && file.includes('.') && file.includes('/')) files.push(file);
+      }
+    }
+    return files;
+  } catch {
+    return [];
+  }
+}
+
+function opensLensFile(text) {
+  const spoken = String(text || '');
+  return mapFiles().some((file) => spoken.includes(file));
+}
 
 function researchCall(toolName, text) {
   const tool = String(toolName || '');
   const spoken = String(text || '');
   if (/researcher|explorer|deep[- ]?research/i.test(tool) || DEEP_SEARCH.test(tool)) return true;
-  return /bash|shell/i.test(tool) && (/researcher|explorer|deep[- ]?research/i.test(spoken) || DEEP_SEARCH.test(spoken));
+  if (/bash|shell/i.test(tool) && (/researcher|explorer|deep[- ]?research/i.test(spoken) || DEEP_SEARCH.test(spoken))) return true;
+  if (/^grep$/i.test(tool)) return true;
+  return /^read_file$/i.test(tool) && !opensLensFile(spoken);
+}
+
+function passPath(root) {
+  return join(root, '.xray', 'state', 'goggles-lens-pass.json');
+}
+
+function loadReadPass(root) {
+  try {
+    const data = JSON.parse(readFileSync(passPath(root), 'utf8'));
+    return Boolean(data && data.read === true);
+  } catch {
+    return false;
+  }
+}
+
+function saveReadPass(root) {
+  const file = passPath(root);
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, `${JSON.stringify({ read: true })}\n`);
 }
 
 /** One plane: the files the suit continues with. A look with no plane stops. Two planes stay quiet. */
@@ -724,11 +771,17 @@ function stampPlane(root, id) {
   }
 }
 
-/** A search stays stopped. The next move is the file on the lens, not the same search again. */
+/** A search stays stopped. The lens file stays open. One later read may go on. */
 export function lensBeforeResearch(root, toolName, text) {
   const spoken = String(text || '');
   if (!researchCall(toolName, spoken)) return null;
   const names = CARD_PLANES.filter((name) => intentWords(spoken).includes(name));
+  if (/^read_file$/i.test(String(toolName || ''))) {
+    if (loadReadPass(root)) return null;
+    if (names.length === 1) stampPlane(root, names[0]);
+    saveReadPass(root);
+    return { gate: 'lens', decision: 'deny', reason: lensPage(root, names) };
+  }
   if (names.length === 1) stampPlane(root, names[0]);
   return { gate: 'lens', decision: 'deny', reason: lensPage(root, names) };
 }
@@ -876,17 +929,13 @@ function isGogglesWork(text) {
 
 
 export function cardStop(root, toolName, text, paths = []) {
-  const spoken = String(text || '');
-  if (spoken.length <= 200 && isGogglesWork(spoken) && !(paths || []).some((item) => /goggles/i.test(String(item)))) {
-    clearReading(root);
-    clearCardLine(root);
-    return null;
-  }
   const held = loadReading(root);
   if (!held) return null;
   const drift = actualityLine();
   if (drift) return organDeny(drift);
-  return organStop(held, { tool: toolName, text, paths });
+  const stopped = organStop(held, { tool: toolName, text, paths });
+  if (stopped) return stopped;
+  return { gate: 'goggles', decision: 'allow' };
 }
 
 function stationFile(root) {
@@ -928,14 +977,16 @@ export function handCard(root, intent) {
       clearCardLine(root);
       return null;
     }
-    if (!lookVerb(words)) return null;
+    const asked = lookVerb(words);
+    const planes = acceptedPlanes().filter((name) => words.includes(name));
+    if (!asked && planes.length === 0) return null;
+    if (!asked && planes.length === 1 && !HOLDS_ON_NAME.has(planes[0])) return null;
     clearCardLine(root);
     const looked = readGoggles(words);
     if (looked.text.startsWith('Actuality. Drift')) {
       saveReading(root, { drift: looked.text });
       return null;
     }
-    const planes = acceptedPlanes().filter((name) => words.includes(name));
     if (planes.length !== 1) {
       clearReading(root);
       return null;

package/dist/integrations/hooks/host-truth.mjs

@@ -0,0 +1,74 @@
+/**
+ * What each chat can actually do.
+ * Friend line first. Hook names are labels, not the sentence.
+ *
+ * stopsTool — the host can refuse a tool before it runs.
+ * noticesDeath — a crush/compact hook runs.
+ * note — what comes back into the chat: none, one-line, or the whole card.
+ */
+
+export const HOST_TRUTH = [
+  {
+    id: 'cursor',
+    name: 'Cursor',
+    stopsTool: true,
+    noticesDeath: true,
+    note: 'one-line',
+    hooks: 'preToolUse, preCompact',
+    line: 'Cursor can stop a tool. When the chat dies, it can leave one line in the next message. The rest of the card is a file. Read it.',
+  },
+  {
+    id: 'grok',
+    name: 'Grok',
+    stopsTool: true,
+    noticesDeath: true,
+    note: 'none',
+    hooks: 'PreToolUse, PreCompact',
+    line: 'Grok can stop a tool. When the chat dies, the hook still writes the file, and the host throws the note away. Read the file.',
+  },
+  {
+    id: 'grok-bot',
+    name: 'Grok Bot',
+    stopsTool: false,
+    noticesDeath: false,
+    note: 'none',
+    hooks: 'none',
+    line: 'Grok Bot cannot stop a tool and cannot leave a note. The house is how a team shares rules there.',
+  },
+  {
+    id: 'openclaw',
+    name: 'OpenClaw',
+    stopsTool: true,
+    noticesDeath: false,
+    note: 'none',
+    hooks: 'PreToolUse',
+    line: 'OpenClaw can stop a tool. It has no hook for when the chat dies, and it does not leave a note.',
+  },
+  {
+    id: 'hermes',
+    name: 'Hermes',
+    stopsTool: true,
+    noticesDeath: false,
+    note: 'none',
+    hooks: 'pre_tool_call',
+    line: 'Hermes can stop a tool. It does not register a hook for when the chat dies, and it does not leave a note.',
+  },
+  {
+    id: 'opencode',
+    name: 'OpenCode',
+    stopsTool: true,
+    noticesDeath: false,
+    note: 'whole-card',
+    hooks: 'tool.execute.before',
+    line: 'OpenCode can stop a tool. It does not register a hook for when the chat dies. When the card file exists, the whole card is already in the prompt.',
+  },
+];
+
+export function hostTruthById(id) {
+  return HOST_TRUTH.find((row) => row.id === id) ?? null;
+}
+
+/** The card a person reads. One paragraph per chat. */
+export function hostTruthCard() {
+  return HOST_TRUTH.map((row) => row.line).join('\n\n');
+}

package/dist/integrations/hooks/station-hook-runtime.cjs

@@ -1252,6 +1252,9 @@ function formatStationMarkdown(fields) {
   } else {
     lines.push("Git: n/a");
   }
+  if (fields.freshnessLine) {
+    lines.push(fields.freshnessLine);
+  }
   lines.push(fields.repertoireResume || "Repertoire: module unresolved");
   if (fields.workingLine) {
     lines.push(fields.workingLine);

package/dist/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.34",
+  "version": "4.0.35",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/dist/mcps/knowledge-skills/storyteller.server.js

@@ -13,7 +13,6 @@ const STORY_TYPES = ['reflection', 'saga', 'journey', 'narrative'];
 function resolveSkillMd() {
     const here = dirname(fileURLToPath(import.meta.url));
     const candidates = [
-        join(here, '../../../skills/storyteller/SKILL.md'),
         join(here, '../../skills/storyteller/SKILL.md'),
         join(process.cwd(), 'node_modules/0xray/dist/skills/storyteller/SKILL.md'),
         join(process.cwd(), 'node_modules/xray/dist/skills/storyteller/SKILL.md'),

package/dist/nucleus/delegation-gate.d.ts

@@ -1,7 +1,7 @@
 /**
  * Multi-host delegation gate SSOT — pending-delegations + spawn todo enforcement.
  * Grok / Hermes / OpenCode adapters call evaluatePreToolGate via delegation-gate-runtime.
- * Constitution (11/29/69 + destructive shell) lives here. Grok may still extra-block Codex 2/7.
+ * Constitution (11/29/69/70 + destructive shell) lives here. Grok may still extra-block Codex 2/7.
  */
 import { type PendingDelegation } from './pending-delegations.js';
 export { getActivePendingDelegations } from './pending-delegations.js';
@@ -91,7 +91,7 @@ export declare function evaluateSpawnPlanGate(toolName: string, toolInput: ToolG
 export declare function evaluateSynthesisGate(toolName: string, toolInput: ToolGateInput, ctx: PreToolGateContext): PreToolGateResult;
 /** Block writes / unrelated work while pending delegations exist. */
 export declare function evaluatePendingDelegationGate(toolName: string, toolInput: ToolGateInput, ctx: PreToolGateContext): PreToolGateResult;
-/** Codex 11 / 29 / 69 + destructive shell — always on, all hosts that call this SSOT. */
+/** Codex 11 / 29 / 69 / 70 + destructive shell — always on, all hosts that call this SSOT. */
 export declare function evaluateConstitutionGate(toolName: string, toolInput: ToolGateInput, ctx: PreToolGateContext): PreToolGateResult;
 export declare function evaluatePreToolGate(toolName: string, toolInput: ToolGateInput, ctx: PreToolGateContext): PreToolGateResult;
 export declare function evaluatePostToolSpawn(toolName: string, toolInput: ToolGateInput, projectRoot: string, options?: PostToolSpawnOptions): PostToolSpawnResult;