0xray 4.0.34 → 4.0.35

package/docs-site/docs/plates/routing.md

@@ -5,14 +5,14 @@ sidebar_label: Routing
 
 # Routing
 
-Task text becomes an agent. thinDispatch scores the work. Repertoire may adjust the score when the organ is worn.
+Task text becomes an agent. `scoreAndRoute` scores the work, then `routeToAgent` picks the tier agent. Repertoire may replace that agent when a law matches. Naming no plane stops before that pick and returns nobody.
 
 ```
 ┌──────────────────────────────────────────────────────────────┐
 │ INPUT LAYER                                                  │
 │                                                              │
 │   ┌──────────────┐   ┌──────────────┐   ┌────────────────┐  │
-│   │ task text    │   │ @agent       │   │ scoreAndRoute  │  │
+│   │ task text    │   │ context      │   │ thresholds     │  │
 │   └──────┬───────┘   └──────┬───────┘   └───────┬────────┘  │
 │          └──────────────────┴─────────┬─────────┘           │
 └────────────────────────────────────────┼─────────────────────┘
@@ -21,22 +21,30 @@ Task text becomes an agent. thinDispatch scores the work. Repertoire may adjust
 │ PROCESSING LAYER                       │                     │
 │                                        v                     │
 │   ┌──────────────────────────────────────────────────────┐  │
-│   │ TaskSkillRouter                                      │  │
-│   │ keyword facade into the route                        │  │
+│   │ scoreComplexity                                      │  │
+│   │ ≤15 simple · single-agent                            │  │
+│   │ ≤25 moderate · multi-agent                           │  │
+│   │ ≤50 complex · orchestrator-led                       │  │
+│   │ >50 enterprise · orchestrator-led                    │  │
 │   └──────────────────────────┬───────────────────────────┘  │
 │                              v                              │
 │   ┌──────────────────────────────────────────────────────┐  │
-│   │ thinDispatch                                         │  │
-│   │ ≤15 single agent                                     │  │
-│   │ ≤25 single agent with tools                          │  │
-│   │ ≤50 multi-agent                                      │  │
-│   │ >50 orchestrator-led                                 │  │
+│   │ lensPlane                                            │  │
+│   │ no plane named stops here and the agent is empty     │  │
+│   │ one plane attaches that file                         │  │
 │   └──────────────────────────┬───────────────────────────┘  │
 │                              v                              │
 │   ┌──────────────────────────────────────────────────────┐  │
-│   │ Repertoire resolveThinDispatch                       │  │
-│   │ worn organ may change agent and score                │  │
+│   │ routeToAgent                                         │  │
+│   │ simple → code-reviewer                               │  │
+│   │ moderate, complex, enterprise → architect            │  │
+│   └──────────────────────────┬───────────────────────────┘  │
+│                              v                              │
+│   ┌──────────────────────────────────────────────────────┐  │
+│   │ resolveThinDispatch                                  │  │
+│   │ worn repertoire may change agent and score           │  │
 │   │ null provider leaves the score alone                 │  │
+│   │ a stop never reaches this step                       │  │
 │   └──────────────────────────┬───────────────────────────┘  │
 └──────────────────────────────┼──────────────────────────────┘
                                v
@@ -45,5 +53,8 @@ Task text becomes an agent. thinDispatch scores the work. Repertoire may adjust
 │   ┌────────────┐   ┌────────────────┐   ┌────────────────┐ │
 │   │ agent      │   │ strategy       │   │ adjusted score │ │
 │   └────────────┘   └────────────────┘   └────────────────┘ │
+│   ┌────────────┐                                            │
+│   │ file       │                                            │
+│   └────────────┘                                            │
 └──────────────────────────────────────────────────────────────┘
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.34",
+  "version": "4.0.35",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",
@@ -73,7 +73,7 @@
     "test": "vitest run",
     "test:batch": "npm test",
     "test:unit": "npm test -- src/__tests__/unit/config-loader.test.ts src/__tests__/unit/state-manager.test.ts src/__tests__/unit/state-manager-persistence.test.ts src/__tests__/unit/context-loader.test.ts src/__tests__/unit/pattern-analyzer.test.ts src/__tests__/unit/complexity-calibrator.test.ts",
-    "test:core-framework": "npm test -- src/__tests__/unit/self-direction-activation.test.ts src/__tests__/unit/ast-code-parser.test.ts src/__tests__/unit/v2-deletion-protection.test.ts",
+    "test:core-framework": "npm test -- src/__tests__/unit/v2-deletion-protection.test.ts",
     "test:security": "npm test -- src/__tests__/unit/security/security-hardener.test.ts src/__tests__/unit/security/security-headers.test.ts src/__tests__/unit/security/security-auditor.test.ts",
     "test:performance": "npm test -- src/__tests__/unit/monitoring.test.ts src/__tests__/unit/benchmark.test.ts src/__tests__/unit/analytics.test.ts",
     "test:session-management": "npm test -- src/__tests__/unit/session-state-manager.test.ts src/__tests__/unit/session-security-validator.test.ts src/__tests__/unit/session-coordination-validator.test.ts src/__tests__/unit/session-migration-validator.test.ts src/__tests__/unit/session-migration-logic.test.ts",

package/scripts/foundry/release.mjs

@@ -9,7 +9,8 @@
  * 4. Commit release artifacts → push
  * 5. Verify gate (reconcile + git + release docs + smoke)
  * 6. npm publish (idempotent — skip if version already on registry)
- * 7. Tag → push tag (only after successful publish)
+ * 7. Poll npm view until the registry lists that version
+ * 8. Tag → push tag (only after the registry lists it)
  *
  * Usage:
  *   npx @0xray/foundry release [patch|minor|major] --dry-run
@@ -90,9 +91,13 @@ function currentBranch() {
   return execSync("git rev-parse --abbrev-ref HEAD", { cwd: rootDir, encoding: "utf-8" }).trim();
 }
 
+function say(line) {
+  process.stdout.write(`${line}\n`);
+}
+
 function npmVersionPublished(version) {
   try {
-    const out = execSync(`npm view ${packageName()}@${version} version`, {
+    const out = execSync(`npm view ${packageName()}@${version} version --prefer-online`, {
       cwd: rootDir,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
@@ -103,20 +108,58 @@ function npmVersionPublished(version) {
   }
 }
 
+function sleepMs(ms) {
+  const seconds = Math.max(1, Math.round(Number(ms) / 1000));
+  execSync(`sleep ${seconds}`, { stdio: "ignore" });
+}
+
+/**
+ * npm publish exits 0 while the registry still says the version is processing.
+ * Tag only after npm view lists it. Returns false when the wait runs out.
+ * @param {string} version
+ * @param {object} [hooks]
+ */
+export function waitUntilListed(version, hooks = {}) {
+  const name = hooks.name ?? packageName();
+  const listed = hooks.listed ?? (() => npmVersionPublished(version));
+  const sleep = hooks.sleep ?? sleepMs;
+  const now = hooks.now ?? Date.now;
+  const log = hooks.log ?? say;
+  const fail = hooks.fail ?? ((line) => {
+    process.stderr.write(`${line}\n`);
+    process.exit(1);
+  });
+  const intervalMs = hooks.intervalMs ?? Number(process.env.FOUNDRY_PUBLISH_POLL_MS || 15000);
+  const timeoutMs = hooks.timeoutMs ?? Number(process.env.FOUNDRY_PUBLISH_TIMEOUT_MS || 20 * 60 * 1000);
+  const started = now();
+  let attempt = 0;
+  while (!listed()) {
+    if (now() - started >= timeoutMs) {
+      fail(`❌ ${name}@${version} was uploaded but the registry has not listed it. Tag not pushed.`);
+      return false;
+    }
+    attempt += 1;
+    log(`… registry has not listed ${name}@${version} yet (try ${attempt})`);
+    sleep(intervalMs);
+  }
+  return true;
+}
+
 function publishIdempotent(version) {
   if (dryRun) {
-    console.log(`  would: ${npmPublishCmd()} (check ${packageName()}@${version} first)`);
+    say(`  would: ${npmPublishCmd()} then poll npm view ${packageName()}@${version} until listed`);
     return;
   }
   if (npmVersionPublished(version)) {
-    console.log(`ℹ️  ${packageName()}@${version} already on npm — skipping publish`);
+    say(`ℹ️  ${packageName()}@${version} already on npm — skipping publish`);
     return;
   }
   if (isXrayExoRepo(rootDir)) {
     runMill("assert-packed-dist-cli.mjs", [], "packed dist/cli");
   }
   execSync(npmPublishCmd(), { cwd: rootDir, stdio: "inherit", encoding: "utf-8" });
-  console.log(`✅ Published ${packageName()}@${version}`);
+  if (!waitUntilListed(version)) process.exit(1);
+  say(`✅ Published ${packageName()}@${version}`);
 }
 
 async function main() {

package/scripts/mjs/test-consumer-readiness.mjs

@@ -213,6 +213,7 @@ class ConsumerReadinessCheck {
 async function runPathVerification() {
   const isConsumerEnv = process.cwd().includes('test-') || 
                         process.cwd().includes('tmp') ||
+                        fs.existsSync('node_modules/0xray') ||
                         fs.existsSync('node_modules/xray');
   
   if (isConsumerEnv) {

package/scripts/mjs/test-mcp-functionality.mjs

@@ -14,10 +14,15 @@ import { fileURLToPath } from "url";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
+function isInstalledPackagePath(value) {
+  const normalized = String(value).replace(/\\/g, "/");
+  return normalized.includes("node_modules/0xray") || normalized.includes("node_modules/xray");
+}
+
 class MCPFunctionalityTest {
   constructor() {
     this.results = { passed: [], failed: [] };
-    this.isConsumerEnvironment = __dirname.includes("node_modules/xray");
+    this.isConsumerEnvironment = isInstalledPackagePath(__dirname);
   }
 
   async testMCPFunctionality() {
@@ -95,9 +100,9 @@ class MCPFunctionalityTest {
       // Determine environment: dev vs consumer vs CI
       // - Dev: running from project root with src/ directory
       // - CI: running from project root but building first (has dist/)
-      // - Consumer: running from node_modules/xray/
+      // - Consumer: running from node_modules/0xray/ (legacy node_modules/xray/)
       const cwd = process.cwd();
-      const isConsumerEnv = cwd.includes("node_modules/xray");
+      const isConsumerEnv = isInstalledPackagePath(cwd);
       const hasPackageJson = fs.existsSync(path.join(cwd, "package.json"));
       const hasDistDir = fs.existsSync(path.join(cwd, "dist"));
       
@@ -155,16 +160,16 @@ class MCPFunctionalityTest {
         if (serverPath) {
           // Handle various path formats:
           // - ./dist/mcps/xxx.js (local dev)
-          // - node_modules/xray/dist/mcps/xxx.js (consumer)
+          // - node_modules/0xray/dist/mcps/xxx.js (consumer; legacy node_modules/xray/)
           // - dist/mcps/xxx.js (after stripping ./)
           let normalizedPath = serverPath.startsWith("./") 
             ? serverPath.slice(2) 
             : serverPath;
             
-          // If path contains node_modules/xray/, extract just the relative part
-          if (normalizedPath.includes("node_modules/xray/")) {
-            normalizedPath = normalizedPath.replace("node_modules/xray/", "");
-          }
+          normalizedPath = normalizedPath
+            .replace(/\\/g, "/")
+            .replace("node_modules/0xray/", "")
+            .replace("node_modules/xray/", "");
             
           // In CI/build environment, files are in cwd/dist/, not in node_modules
           // Try local paths first, then fall back to node_modules
@@ -249,7 +254,7 @@ class MCPFunctionalityTest {
     try {
       // Determine environment - reuse same logic
       const cwd = process.cwd();
-      const isConsumerEnv = cwd.includes("node_modules/xray");
+      const isConsumerEnv = isInstalledPackagePath(cwd);
       const hasPackageJson = fs.existsSync(path.join(cwd, "package.json"));
       const isDevOrCi = hasPackageJson && !isConsumerEnv;
       

package/scripts/node/basic-security-audit.cjs

@@ -150,7 +150,6 @@ class BasicSecurityAuditor {
       /LightweightValidator\.ts$/,
       /codex-parser\.ts$/,
       /openclaw/,
-      /advanced-features/,
       /tests\//,
       /global-processor-mocks/,
     ];

package/scripts/node/bridge-mcp-wiring.cjs

@@ -218,10 +218,69 @@ function readInstalledXrayVersion() {
   return pkg.version;
 }
 
+/**
+ * npm installs the package named `0xray` at `node_modules/0xray`.
+ * `node_modules/xray` is the pre-rename folder. Use it only when that tree
+ * is the one on disk. Never prefer the old name over the real install.
+ */
+const INSTALLED_PACKAGE_DIRS = ["0xray", "xray"];
+
+function normalizeLaunchToken(token) {
+  return String(token).replace(/\\/g, "/");
+}
+
 function localXrayCli(targetDir) {
   if (!targetDir) return null;
-  const cli = path.join(targetDir, "node_modules", "0xray", "dist", "cli", "index.js");
-  return fs.existsSync(cli) ? cli : null;
+  for (const dirName of INSTALLED_PACKAGE_DIRS) {
+    const cli = path.join(targetDir, "node_modules", dirName, "dist", "cli", "index.js");
+    if (fs.existsSync(cli)) return cli;
+  }
+  return null;
+}
+
+function isInstalledPackageCli(token) {
+  const normalized = normalizeLaunchToken(token);
+  return INSTALLED_PACKAGE_DIRS.some((dirName) =>
+    normalized.includes(`node_modules/${dirName}/dist/cli/index.js`),
+  );
+}
+
+/** Project-root `dist/cli/index.js` is the factory checkout. It is gitignored and goes stale. */
+function isCheckoutDistCliLaunch(server) {
+  return launchTokens(server).some((token) => {
+    const normalized = normalizeLaunchToken(token);
+    const isDistCli =
+      normalized === "dist/cli/index.js" ||
+      normalized === "./dist/cli/index.js" ||
+      normalized.endsWith("/dist/cli/index.js");
+    return isDistCli && !isInstalledPackageCli(normalized);
+  });
+}
+
+function isLegacyXrayCliLaunch(server) {
+  return launchTokens(server).some((token) => {
+    const normalized = normalizeLaunchToken(token);
+    return normalized.includes("node_modules/xray/dist/cli/index.js");
+  });
+}
+
+function mcpSubcommand(inner) {
+  if (!inner || !Array.isArray(inner.args)) return null;
+  const idx = inner.args.indexOf("mcp");
+  if (idx >= 0 && inner.args[idx + 1]) return inner.args[idx + 1];
+  return null;
+}
+
+/**
+ * A checkout `dist/cli` launch is replaced with the installed package.
+ * A legacy `node_modules/xray` launch is replaced only when `node_modules/0xray` exists.
+ */
+function shouldRepinToInstalledCli(inner, targetDir) {
+  if (!inner || hasVersionPin(inner)) return false;
+  if (isCheckoutDistCliLaunch(inner)) return true;
+  if (!isLegacyXrayCliLaunch(inner)) return false;
+  const cli = localXrayCli(targetDir);
+  return Boolean(cli && normalizeLaunchToken(cli).includes("/node_modules/0xray/"));
 }
 
 /** Prefer the installed CLI. Else pin npx to this package version. Never bare `0xray`. */
@@ -388,7 +447,7 @@ function mcpCmdFromInner(inner) {
   return inner.args.length > 0 ? inner.args[inner.args.length - 1] : null;
 }
 
-/** Framework fills gaps. User env, enabled/disabled, and version pins win. Unpinned `0xray` is repinned. Launch is `node mcp-launch.cjs --keep names -- cmd`. */
+/** Framework fills gaps. User env, enabled/disabled, and version pins win. Unpinned `0xray` and a checkout `dist/cli` launch are repinned to the installed package. Launch is `node mcp-launch.cjs --keep names -- cmd`. */
 function mergeUserWinsServer(framework, user, targetDir) {
   if (!user || typeof user !== "object") return framework;
   if (!framework || typeof framework !== "object") return user;
@@ -403,6 +462,10 @@ function mergeUserWinsServer(framework, user, targetDir) {
     const mcpCmd = mcpCmdFromInner(inner);
     if (mcpCmd) inner = pinnedMcpLaunch(targetDir, mcpCmd);
   }
+  if (inner && shouldRepinToInstalledCli(inner, targetDir)) {
+    const mcpCmd = mcpSubcommand(inner);
+    if (mcpCmd) inner = pinnedMcpLaunch(targetDir, mcpCmd);
+  }
   if (!inner) return framework;
   const mergedEnv = mergeScopedEnv([
     baseScopedEnv(targetDir),

package/scripts/node/postinstall.cjs

@@ -75,7 +75,7 @@ function deployManagedAgents(packageRoot, targetDir, log) {
   if (updated !== current) fs.writeFileSync(agentsDest, updated);
 }
 
-/** npm install links vendored @0xray/repertoire and nothing else. The suit is `npx 0xray wear`. */
+/** npm install links vendored @0xray/repertoire and does not write `.mcp.json`. `npx 0xray wear` rewrites a checkout `dist/cli` launch to `node_modules/0xray`. */
 function runPostinstall(packageRoot, targetDir, _log) {
   linkVendoredRepertoire(packageRoot, targetDir);
   console.log("Run `npx 0xray wear`");

package/scripts/node/prepare-consumer.cjs

@@ -33,21 +33,25 @@ function updatePathsInFile(filePath) {
     let content = fs.readFileSync(filePath, 'utf-8');
     let updated = false;
 
-    // Transform development paths back to consumer paths (plain xray; legacy @0xray/xray removed)
-    // Only transform if it's not already a consumer path
-    if (content.includes('dist/plugin/mcps/') && !content.includes('node_modules/xray/dist/plugin/mcps/')) {
+    // The published package name is 0xray, so the installed tree is node_modules/0xray.
+    // Upgrade a pre-rename node_modules/xray path before prefixing bare dist/ paths.
+    if (content.includes('node_modules/xray/')) {
+      content = content.replace(/node_modules\/xray\//g, 'node_modules/0xray/');
+      updated = true;
+    }
+
+    if (content.includes('dist/plugin/mcps/') && !content.includes('node_modules/0xray/dist/plugin/mcps/')) {
       content = content.replace(
         /dist\/plugin\/mcps\//g,
-        'node_modules/xray/dist/plugin/mcps/'
+        'node_modules/0xray/dist/plugin/mcps/'
       );
       updated = true;
     }
 
-    // Transform plugin paths back to consumer format (only the relative dev paths)
     if (content.includes('../../../dist/plugin/')) {
       content = content.replace(
         /\.\.\/\.\.\/\.\.\/dist\/plugin\//g,
-        'node_modules/xray/dist/plugin/'
+        'node_modules/0xray/dist/plugin/'
       );
       updated = true;
     }
@@ -140,4 +144,4 @@ function addJsExtensionsToDist() {
 addJsExtensionsToDist();
 
 structuredLog('prepare-consumer', 'xray v2 Consumer Preparation: Complete!', 'success');
-structuredLog('prepare-consumer', 'Package is now ready for consumer installation (plain xray technical identity).', 'info');
+structuredLog('prepare-consumer', 'Package is now ready for consumer installation (node_modules/0xray).', 'info');

package/scripts/node/setup-dev.cjs

@@ -23,32 +23,24 @@ function updatePathsInFile(filePath) {
     let content = fs.readFileSync(filePath, 'utf-8');
     let updated = false;
 
-    // Transform MCP server paths (specific first)
-    if (content.includes('node_modules/xray/dist/plugin/mcps/')) {
-      content = content.replace(
-        /node_modules\/xray\/dist\/plugin\/mcps\//g,
-        'dist/plugin/mcps/'
-      );
-      updated = true;
-    }
-
-    // Transform plugin paths (go up 3 directories from .opencode to project root)
-    if (content.includes('node_modules/xray/dist/plugin/plugins/')) {
-      content = content.replace(
-        /node_modules\/xray\/dist\/plugin\/plugins\//g,
-        '../../../dist/plugin/plugins/'
-      );
-      updated = true;
-    }
-
-    // Transform any remaining node_modules paths (but not plugin-specific ones we already handled)
-    if (content.includes('node_modules/xray/dist/') &&
-        !content.includes('dist/plugin/')) {  // Avoid double transformation
-      content = content.replace(
-        /node_modules\/xray\/dist\//g,
-        'dist/'
-      );
-      updated = true;
+    // npm installs at node_modules/0xray. node_modules/xray is the pre-rename folder.
+    // Specific plugin paths first so the general dist/ strip does not flatten them.
+    for (const dirName of ['0xray', 'xray']) {
+      const plugins = `node_modules/${dirName}/dist/plugin/plugins/`;
+      if (content.includes(plugins)) {
+        content = content.replaceAll(plugins, '../../../dist/plugin/plugins/');
+        updated = true;
+      }
+      const mcps = `node_modules/${dirName}/dist/plugin/mcps/`;
+      if (content.includes(mcps)) {
+        content = content.replaceAll(mcps, 'dist/plugin/mcps/');
+        updated = true;
+      }
+      const prefix = `node_modules/${dirName}/dist/`;
+      if (content.includes(prefix)) {
+        content = content.replaceAll(prefix, 'dist/');
+        updated = true;
+      }
     }
 
     if (updated) {

package/scripts/node/validate-mcp-connectivity.js

@@ -18,7 +18,8 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
 // Detect if running in consumer environment (node_modules)
-const isConsumerEnvironment = __dirname.includes("node_modules/xray");
+const isConsumerEnvironment = __dirname.includes(`${path.sep}node_modules${path.sep}0xray${path.sep}`)
+  || __dirname.includes(`${path.sep}node_modules${path.sep}xray${path.sep}`);
 const pathPrefix = isConsumerEnvironment ? "" : "";
 
 const MCP_SERVERS = [

package/src/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.34",
+  "version": "4.0.35",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/src/mcps/knowledge-skills/storyteller.server.ts

@@ -24,7 +24,6 @@ interface WriteStoryArgs {
 function resolveSkillMd(): string {
   const here = dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    join(here, '../../../skills/storyteller/SKILL.md'),
     join(here, '../../skills/storyteller/SKILL.md'),
     join(process.cwd(), 'node_modules/0xray/dist/skills/storyteller/SKILL.md'),
     join(process.cwd(), 'node_modules/xray/dist/skills/storyteller/SKILL.md'),

package/xray/agents_template.md

@@ -30,14 +30,14 @@ All seven use `npx -y 0xray mcp <cmd>`:
 
 xray operates under the three-subsystem model: Inference + External Governance (Dynamo Solar SSOT) + Autonomous Engine (thinDispatch 7-flow in MCP orchestrator). All actions are validated against the Universal Development Codex before execution.
 
-**Codex**: `.xray/codex.json` — **69 terms** across all agent interactions.
+**Codex**: `.xray/codex.json` — **70 terms** across all agent interactions.
 
 ## thinDispatch Routing
 
-- Simple (≤15): Single agent
-- Moderate (≤25): Single agent with tools
-- Complex (≤50): Multi-agent coordination
-- Enterprise (>50): Orchestrator-led team
+- Simple (≤15): single-agent
+- Moderate (≤25): multi-agent
+- Complex (≤50): orchestrator-led
+- Enterprise (>50): orchestrator-led
 
 ## File Organization
 

package/xray/codex.json

@@ -1,6 +1,6 @@
 {
   "version": "3.1.0",
-  "lastUpdated": "2026-08-24",
+  "lastUpdated": "2026-10-01",
   "errorPreventionTarget": 0.998,
   "terms": {
     "1": {
@@ -62,7 +62,7 @@
     "8": {
       "number": 8,
       "title": "Prevent Infinite Loops",
-      "description": "Guarantee termination in all iterative processes. All loops must have clear termination conditions. Recursive functions must have base cases. Event loops must have exit strategies. Async operations must have timeout mechanisms.",
+      "description": "Guarantee termination in all iterative processes. All loops must have clear termination conditions. Recursive functions must have base cases. Event loops must have exit strategies. Async operations must have timeout mechanisms. A job names when it is done and when it stops.",
       "category": "core",
       "zeroTolerance": true,
       "enforcementLevel": "blocking"
@@ -230,7 +230,7 @@
     "29": {
       "number": 29,
       "title": "Security by Design",
-      "description": "Validate all inputs. Sanitize data before rendering. Use HTTPS for all requests. Implement rate limiting. Never expose sensitive data.",
+      "description": "Validate all inputs. Sanitize data before rendering. Use HTTPS for all requests. Implement rate limiting. Never expose sensitive data. Do not trust Host or X-Forwarded-Host to choose an environment. A refusal in the UI needs the same check on the server.",
       "category": "security",
       "zeroTolerance": true,
       "enforcementLevel": "blocking"
@@ -534,7 +534,7 @@
     "67": {
       "number": 67,
       "title": "Use Best Subagents, Reuse Session Context",
-      "description": "Delegate work to the best-suited subagent for each task. Stay responsive to user inquiries, additional todos, and course corrections. Reuse the same subagent via session ID to preserve context and avoid restarting from zero. Do not spawn fresh agents when an existing one has the relevant context.",
+      "description": "Delegate work to the best-suited subagent for each task. Stay responsive to user inquiries, additional todos, and course corrections. Reuse the same subagent via session ID to preserve context and avoid restarting from zero. Do not spawn fresh agents when an existing one has the relevant context. Reuse one cloud for a workstream. Do not launch a new agent for a check the seat can run.",
       "category": "process",
       "zeroTolerance": false,
       "enforcementLevel": "high"
@@ -554,6 +554,14 @@
       "category": "process",
       "zeroTolerance": true,
       "enforcementLevel": "blocking"
+    },
+    "70": {
+      "number": 70,
+      "title": "Current Copy Before Edits",
+      "description": "Before an edit, be on the latest main and run the current package. If this repo is 0xray, this repo is that package. An older package waits. Compare set-aside work to main before you throw it away.",
+      "category": "process",
+      "zeroTolerance": true,
+      "enforcementLevel": "blocking"
     }
   },
   "interweaves": [

package/xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.34",
+  "version": "4.0.35",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/dist/agents/known-names.d.ts

@@ -1,26 +0,0 @@
-/**
- * Known Names — Single combined vocabulary for agent names, skill names,
- * system service names, and opencode built-in types. All consumers import
- * from here instead of defining their own hardcoded lists.
- *
- * Imports:
- *   - registry.ts (AGENT_REGISTRY, AGENT_KEYS) — canonical agent definitions
- *   - mcps/index.ts (MCP_SERVERS) — canonical MCP server manifest
- */
-import { AGENT_KEYS, type AgentKey } from "./registry.js";
-import { MCP_SERVERS } from "../mcps/index.js";
-export { AGENT_KEYS, type AgentKey };
-export type { AgentKey as AgentName };
-/** All agent names as a mutable array */
-export declare function getAgentNames(): string[];
-export declare const SYSTEM_SERVICE_NAMES: readonly ["enforcer", "orchestrator", "analyzer"];
-export declare const OPENCODE_BUILTIN_TYPES: readonly ["explore", "general"];
-export declare const ALL_KNOWN_NAMES: readonly [...string[], "enforcer", "orchestrator", "analyzer", "explore", "general"];
-export type KnownName = typeof ALL_KNOWN_NAMES[number];
-export declare const BOOT_AGENTS: readonly ["enforcer", "architect", "bug-triage-specialist", "code-reviewer", "security-auditor", "refactorer", "testing-lead"];
-export declare function isValidType(name: string): boolean;
-export declare const AGENT_TO_SKILL_MAP: Record<string, string>;
-/** Resolve agent name to skill name via alias map, fallback to identity */
-export declare function resolveSkill(agentOrSkill: string): string;
-export { MCP_SERVERS };
-export declare function getSkillNames(): string[];