0xray 4.0.34 → 4.0.36

package/dist/integrations/hooks/goggles-pipeline.mjs

@@ -3,6 +3,8 @@
  * A named plane returns its view. Field pipes fill what they can see.
  * The view keeps every field for the next look.
  * A held plane stays quiet. A leave is denied.
+ * On this host a search is grep, glob, or a shell that runs one.
+ * The lens file stays open. One later read may go on, then the next read stops.
  */
 import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
@@ -72,9 +74,12 @@ export function organStop(held, action) {
   const text = String(action?.text || '');
   const paths = (action?.paths || []).map(String).filter(Boolean);
   const tool = String(action?.tool || '');
-  if (/docs-site\/docs\/plates\/[a-z0-9-]+\.md/i.test([text, ...paths].join('\n'))) {
+  const spoken = [text, ...paths].join('\n');
+  if (/docs-site\/docs\/plates\/[a-z0-9-]+\.md/i.test(spoken)) {
     return organDeny(`The reading is ${plane}. That drawing is not the plane.`);
   }
+  const otherFile = otherPlaneFile(plane, spoken);
+  if (otherFile) return organDeny(`The reading is ${plane}. The action is ${otherFile}.`);
   const stripped = withoutPaths(text);
   const others = acceptedPlanes().filter((name) => name !== plane && planeWord(name, stripped));
   const namesThis = planeWord(plane, stripped);
@@ -255,10 +260,10 @@ function cardView(plane, scope, flavor, root) {
     teardown: plane.teardown || '',
     worn: plane.worn || '',
   };
+  view.exam = examinePlane(plane, root).text;
   if (flavor === 'triage') {
     const filled = new Set(filledOf(plane));
     view.empty = FIELD_ORDER.filter((name) => !filled.has(name));
-    view.exam = examinePlane(plane, root).text;
   }
   return view;
 }
@@ -283,6 +288,8 @@ function formatCardText(view) {
     if (view.empty.length) lines.push(`Empty: ${view.empty.join(', ')}`);
     lines.push(view.exam);
     text = `${text}\n${lines.join('\n')}`;
+  } else if (typeof view.exam === 'string' && view.exam.startsWith('Drift:')) {
+    text = `${text}\n${view.exam}`;
   }
   return text;
 }
@@ -304,6 +311,8 @@ export function formatCardPane(view) {
   if (view.flavor === 'triage') {
     if (Array.isArray(view.empty) && view.empty.length) rows.push(['Empty', view.empty.join(', ')]);
     if (view.exam) rows.push(['', view.exam]);
+  } else if (typeof view.exam === 'string' && view.exam.startsWith('Drift:')) {
+    rows.push(['', view.exam]);
   }
   const body = rows.map(([label, value]) => (label ? `${label.padEnd(8)} ${value}` : value).trimEnd());
   const title = `${view.flavor} · ${view.plane}`;
@@ -684,12 +693,86 @@ export function suitHint(text) {
 }
 
 const DEEP_SEARCH = /search_codebase|find_implementation|get_documentation/i;
+const HOLDS_ON_NAME = new Set(['dichotomy', 'syncopate', 'synthesis']);
+const SHELL_SEARCH = /(?:^|&&|\|\||[;&|`(\n])\s*(?:(?:\/[\w.+/-]+\/)|(?:npx\s+))?(?:rg|grep|ag|ack|fd|find)\b|\bgit\s+grep\b/;
+
+function shellSearches(text) {
+  return SHELL_SEARCH.test(String(text || ''));
+}
+
+function mappedPlaneFiles(name) {
+  try {
+    const data = JSON.parse(readFileSync(planesFile(), 'utf8'));
+    const entry = data[name];
+    if (!entry || typeof entry !== 'object') return [];
+    const candidates = [entry.file, entry.worn, entry.skills];
+    if (Array.isArray(entry.files)) candidates.push(...entry.files);
+    return candidates.filter((file) => typeof file === 'string' && file.includes('.') && file.includes('/'));
+  } catch {
+    return [];
+  }
+}
+
+function otherPlaneFile(held, spoken) {
+  const text = String(spoken || '');
+  for (const name of acceptedPlanes()) {
+    if (name === held) continue;
+    if (mappedPlaneFiles(name).some((file) => text.includes(file))) return name;
+  }
+  return '';
+}
+
+function mapFiles() {
+  try {
+    const data = JSON.parse(readFileSync(planesFile(), 'utf8'));
+    const files = [];
+    for (const name of [...CARD_PLANES, ...WORN_PLANES]) {
+      const entry = data[name];
+      if (!entry || typeof entry !== 'object') continue;
+      const candidates = [entry.file, entry.worn, entry.skills];
+      if (Array.isArray(entry.files)) candidates.push(...entry.files);
+      for (const file of candidates) {
+        if (typeof file === 'string' && file.includes('.') && file.includes('/')) files.push(file);
+      }
+    }
+    return files;
+  } catch {
+    return [];
+  }
+}
+
+function opensLensFile(text) {
+  const spoken = String(text || '');
+  return mapFiles().some((file) => spoken.includes(file));
+}
 
 function researchCall(toolName, text) {
   const tool = String(toolName || '');
   const spoken = String(text || '');
   if (/researcher|explorer|deep[- ]?research/i.test(tool) || DEEP_SEARCH.test(tool)) return true;
-  return /bash|shell/i.test(tool) && (/researcher|explorer|deep[- ]?research/i.test(spoken) || DEEP_SEARCH.test(spoken));
+  if (/bash|shell/i.test(tool) && (/researcher|explorer|deep[- ]?research/i.test(spoken) || DEEP_SEARCH.test(spoken) || shellSearches(spoken))) return true;
+  if (/^(grep|glob)$/i.test(tool)) return true;
+  return /^read_file$/i.test(tool) && !opensLensFile(spoken);
+}
+
+function passPath(root) {
+  return join(root, '.xray', 'state', 'goggles-lens-pass.json');
+}
+
+function loadReadPass(root) {
+  try {
+    const data = JSON.parse(readFileSync(passPath(root), 'utf8'));
+    if (!data || data.read !== true) return null;
+    return data.spent === true ? 'spent' : 'armed';
+  } catch {
+    return null;
+  }
+}
+
+function saveReadPass(root, spent) {
+  const file = passPath(root);
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, `${JSON.stringify({ read: true, spent: Boolean(spent) })}\n`);
 }
 
 /** One plane: the files the suit continues with. A look with no plane stops. Two planes stay quiet. */
@@ -724,11 +807,22 @@ function stampPlane(root, id) {
   }
 }
 
-/** A search stays stopped. The next move is the file on the lens, not the same search again. */
+/** A search stays stopped. The lens file stays open. One later read may go on, then the next read stops. */
 export function lensBeforeResearch(root, toolName, text) {
   const spoken = String(text || '');
   if (!researchCall(toolName, spoken)) return null;
   const names = CARD_PLANES.filter((name) => intentWords(spoken).includes(name));
+  if (/^read_file$/i.test(String(toolName || ''))) {
+    if (loadReadPass(root) === 'armed') {
+      saveReadPass(root, true);
+      return null;
+    }
+    if (loadReadPass(root) !== 'spent') {
+      if (names.length === 1) stampPlane(root, names[0]);
+      saveReadPass(root, false);
+    }
+    return { gate: 'lens', decision: 'deny', reason: lensPage(root, names) };
+  }
   if (names.length === 1) stampPlane(root, names[0]);
   return { gate: 'lens', decision: 'deny', reason: lensPage(root, names) };
 }
@@ -772,22 +866,17 @@ function seenFields(plane, root) {
   };
 }
 
-function kept(stored, seen, key) {
-  if (key === 'files') {
-    if (Array.isArray(seen.files) && seen.files.length) return seen.files.map(String);
-    return Array.isArray(stored.files) ? stored.files.map(String) : [];
-  }
-  if (seen[key]) return seen[key];
-  return stored[key] || '';
+function freshField(seen, key) {
+  if (key === 'files') return Array.isArray(seen.files) ? seen.files.map(String) : [];
+  return seen[key] || '';
 }
 
 export function growPlane(id, platesDir, root) {
   const seen = seenFields(assemblePlane(id, platesDir), sourceRoot(platesDir));
   const views = loadViews(root);
-  const stored = views[id] && typeof views[id] === 'object' ? views[id] : {};
   const grown = { id };
-  for (const key of VIEW_KEYS) grown[key] = kept(stored, seen, key);
-  if (id === 'ground') grown.from = stored.from || '';
+  for (const key of VIEW_KEYS) grown[key] = freshField(seen, key);
+  if (id === 'ground') grown.from = '';
   views[id] = {};
   for (const key of VIEW_KEYS) views[id][key] = grown[key];
   saveViews(root, views);
@@ -876,17 +965,13 @@ function isGogglesWork(text) {
 
 
 export function cardStop(root, toolName, text, paths = []) {
-  const spoken = String(text || '');
-  if (spoken.length <= 200 && isGogglesWork(spoken) && !(paths || []).some((item) => /goggles/i.test(String(item)))) {
-    clearReading(root);
-    clearCardLine(root);
-    return null;
-  }
   const held = loadReading(root);
   if (!held) return null;
   const drift = actualityLine();
   if (drift) return organDeny(drift);
-  return organStop(held, { tool: toolName, text, paths });
+  const stopped = organStop(held, { tool: toolName, text, paths });
+  if (stopped) return stopped;
+  return { gate: 'goggles', decision: 'allow' };
 }
 
 function stationFile(root) {
@@ -928,14 +1013,16 @@ export function handCard(root, intent) {
       clearCardLine(root);
       return null;
     }
-    if (!lookVerb(words)) return null;
+    const asked = lookVerb(words);
+    const planes = acceptedPlanes().filter((name) => words.includes(name));
+    if (!asked && planes.length === 0) return null;
+    if (!asked && planes.length === 1 && !HOLDS_ON_NAME.has(planes[0])) return null;
     clearCardLine(root);
     const looked = readGoggles(words);
     if (looked.text.startsWith('Actuality. Drift')) {
       saveReading(root, { drift: looked.text });
       return null;
     }
-    const planes = acceptedPlanes().filter((name) => words.includes(name));
     if (planes.length !== 1) {
       clearReading(root);
       return null;

package/dist/integrations/hooks/host-truth.mjs

@@ -0,0 +1,74 @@
+/**
+ * What each chat can actually do.
+ * Friend line first. Hook names are labels, not the sentence.
+ *
+ * stopsTool — the host can refuse a tool before it runs.
+ * noticesDeath — a crush/compact hook runs.
+ * note — what comes back into the chat: none, one-line, or the whole card.
+ */
+
+export const HOST_TRUTH = [
+  {
+    id: 'cursor',
+    name: 'Cursor',
+    stopsTool: true,
+    noticesDeath: true,
+    note: 'one-line',
+    hooks: 'preToolUse, preCompact',
+    line: 'Cursor can stop a tool. When the chat dies, it can leave one line in the next message. The rest of the card is a file. Read it.',
+  },
+  {
+    id: 'grok',
+    name: 'Grok',
+    stopsTool: true,
+    noticesDeath: true,
+    note: 'none',
+    hooks: 'PreToolUse, PreCompact',
+    line: 'Grok can stop a tool. When the chat dies, the hook still writes the file, and the host throws the note away. Read the file.',
+  },
+  {
+    id: 'grok-bot',
+    name: 'Grok Bot',
+    stopsTool: false,
+    noticesDeath: false,
+    note: 'none',
+    hooks: 'none',
+    line: 'Grok Bot cannot stop a tool and cannot leave a note. The house is how a team shares rules there.',
+  },
+  {
+    id: 'openclaw',
+    name: 'OpenClaw',
+    stopsTool: true,
+    noticesDeath: false,
+    note: 'none',
+    hooks: 'PreToolUse',
+    line: 'OpenClaw can stop a tool. It has no hook for when the chat dies, and it does not leave a note.',
+  },
+  {
+    id: 'hermes',
+    name: 'Hermes',
+    stopsTool: true,
+    noticesDeath: false,
+    note: 'none',
+    hooks: 'pre_tool_call',
+    line: 'Hermes can stop a tool. It does not register a hook for when the chat dies, and it does not leave a note.',
+  },
+  {
+    id: 'opencode',
+    name: 'OpenCode',
+    stopsTool: true,
+    noticesDeath: false,
+    note: 'whole-card',
+    hooks: 'tool.execute.before',
+    line: 'OpenCode can stop a tool. It does not register a hook for when the chat dies. When the card file exists, the whole card is already in the prompt.',
+  },
+];
+
+export function hostTruthById(id) {
+  return HOST_TRUTH.find((row) => row.id === id) ?? null;
+}
+
+/** The card a person reads. One paragraph per chat. */
+export function hostTruthCard() {
+  return HOST_TRUTH.map((row) => row.line).join('\n\n');
+}

package/dist/integrations/hooks/station-hook-runtime.cjs

@@ -1252,6 +1252,9 @@ function formatStationMarkdown(fields) {
   } else {
     lines.push("Git: n/a");
   }
+  if (fields.freshnessLine) {
+    lines.push(fields.freshnessLine);
+  }
   lines.push(fields.repertoireResume || "Repertoire: module unresolved");
   if (fields.workingLine) {
     lines.push(fields.workingLine);

package/dist/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.34",
+  "version": "4.0.36",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/dist/mcps/knowledge-skills/storyteller.server.js

@@ -13,7 +13,6 @@ const STORY_TYPES = ['reflection', 'saga', 'journey', 'narrative'];
 function resolveSkillMd() {
     const here = dirname(fileURLToPath(import.meta.url));
     const candidates = [
-        join(here, '../../../skills/storyteller/SKILL.md'),
         join(here, '../../skills/storyteller/SKILL.md'),
         join(process.cwd(), 'node_modules/0xray/dist/skills/storyteller/SKILL.md'),
         join(process.cwd(), 'node_modules/xray/dist/skills/storyteller/SKILL.md'),

package/dist/nucleus/delegation-gate.d.ts

@@ -1,7 +1,7 @@
 /**
  * Multi-host delegation gate SSOT — pending-delegations + spawn todo enforcement.
  * Grok / Hermes / OpenCode adapters call evaluatePreToolGate via delegation-gate-runtime.
- * Constitution (11/29/69 + destructive shell) lives here. Grok may still extra-block Codex 2/7.
+ * Constitution (11/29/69/70 + destructive shell) lives here. Grok may still extra-block Codex 2/7.
  */
 import { type PendingDelegation } from './pending-delegations.js';
 export { getActivePendingDelegations } from './pending-delegations.js';
@@ -91,7 +91,7 @@ export declare function evaluateSpawnPlanGate(toolName: string, toolInput: ToolG
 export declare function evaluateSynthesisGate(toolName: string, toolInput: ToolGateInput, ctx: PreToolGateContext): PreToolGateResult;
 /** Block writes / unrelated work while pending delegations exist. */
 export declare function evaluatePendingDelegationGate(toolName: string, toolInput: ToolGateInput, ctx: PreToolGateContext): PreToolGateResult;
-/** Codex 11 / 29 / 69 + destructive shell — always on, all hosts that call this SSOT. */
+/** Codex 11 / 29 / 69 / 70 + destructive shell — always on, all hosts that call this SSOT. */
 export declare function evaluateConstitutionGate(toolName: string, toolInput: ToolGateInput, ctx: PreToolGateContext): PreToolGateResult;
 export declare function evaluatePreToolGate(toolName: string, toolInput: ToolGateInput, ctx: PreToolGateContext): PreToolGateResult;
 export declare function evaluatePostToolSpawn(toolName: string, toolInput: ToolGateInput, projectRoot: string, options?: PostToolSpawnOptions): PostToolSpawnResult;

package/dist/nucleus/delegation-gate.js

@@ -1,7 +1,7 @@
 /**
  * Multi-host delegation gate SSOT — pending-delegations + spawn todo enforcement.
  * Grok / Hermes / OpenCode adapters call evaluatePreToolGate via delegation-gate-runtime.
- * Constitution (11/29/69 + destructive shell) lives here. Grok may still extra-block Codex 2/7.
+ * Constitution (11/29/69/70 + destructive shell) lives here. Grok may still extra-block Codex 2/7.
  */
 import * as fs from 'fs';
 import * as path from 'path';
@@ -11,6 +11,7 @@ import { allPlanTodos, areSynthesisConsultTodosComplete, findRecentStalePlanArch
 import { getSynthesisDueReason, isSynthesisCheckpointDue, recordExecutionSlice, } from './synthesis.js';
 import { isSynthesisConsultTodoId, tryRecordSynthesisConsultReceipt, } from './synthesis-consult-receipt.js';
 import { resolveSpawnPlan, hasValidSpawnPlanContext } from './spawn-plan-resolution.js';
+import { probeFreshness } from './work-freshness.mjs';
 import { isUserAsidesEnabled, isUserAsideTodoId, loadActiveAsidePointer, loadActiveUserAside, } from './user-aside.js';
 import { validateAsideWorktreeCwd, } from './aside-worktree.js';
 import { ceremonyForProfile, resolveSuitProfile, spawnPlanModeForProfile, writeSuitSessionBoot, maybeHeatHostStation, } from './suit-temperament.js';
@@ -416,11 +417,21 @@ function collectWritePaths(toolInput) {
     }
     return paths;
 }
-/** Codex 11 / 29 / 69 + destructive shell — always on, all hosts that call this SSOT. */
+/** Codex 11 / 29 / 69 / 70 + destructive shell — always on, all hosts that call this SSOT. */
 export function evaluateConstitutionGate(toolName, toolInput, ctx) {
     const content = collectWriteContent(toolInput);
     const paths = collectWritePaths(toolInput);
     const writing = isWriteTool(toolName, ctx.host ?? 'generic');
+    if (writing) {
+        const freshness = probeFreshness(ctx.projectRoot);
+        if (freshness.stale) {
+            return {
+                allow: false,
+                reason: freshness.reason,
+                gate: 'codex-70',
+            };
+        }
+    }
     if (writing && ctx.features.no_new_surface !== false) {
         for (const p of paths) {
             const normalized = p.replace(/\\/g, '/');

package/dist/nucleus/work-freshness.mjs

@@ -0,0 +1,189 @@
+/**
+ * Codex 70. An edit waits until this copy is on the latest main
+ * and the package is not older than the published one.
+ * This repo is that package when package.json name is 0xray.
+ * The check is saved at session start. The edit gate reads the saved result.
+ * A temp directory inside a repo is not the workspace, so unit tests stay quiet.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+export function compareVersions(left, right) {
+  const a = String(left).split('.').map((part) => parseInt(part, 10) || 0);
+  const b = String(right).split('.').map((part) => parseInt(part, 10) || 0);
+  const length = Math.max(a.length, b.length);
+  for (let i = 0; i < length; i += 1) {
+    const da = a[i] || 0;
+    const db = b[i] || 0;
+    if (da !== db) return da < db ? -1 : 1;
+  }
+  return 0;
+}
+
+export function decideFreshness(input) {
+  const behind = Number(input.behind) || 0;
+  if (behind > 0) {
+    const commits = behind === 1 ? '1 commit' : `${behind} commits`;
+    return {
+      stale: true,
+      reason: `Codex 70: this copy is ${commits} behind main. Update before you edit. Compare set-aside work to main before you throw it away.`,
+    };
+  }
+  const repoVersion = input.repoName === '0xray' ? input.repoVersion || null : null;
+  const worn = input.wornSuit || repoVersion;
+  const published = input.publishedSuit || null;
+  const target = published || repoVersion;
+  if (target && worn && compareVersions(worn, target) < 0) {
+    return {
+      stale: true,
+      reason: `Codex 70: package ${worn} is older than ${target}. Install the current one before you edit.`,
+    };
+  }
+  return { stale: false, reason: '' };
+}
+
+export function describeFreshness(input) {
+  const behind = Number(input.behind) || 0;
+  const parts = [behind > 0 ? `${behind} behind main` : 'up to date'];
+  if (input.wornSuit) parts.push(`package ${input.wornSuit}`);
+  if (input.publishedSuit) parts.push(`published ${input.publishedSuit}`);
+  const stashCount = Number(input.stashCount) || 0;
+  if (stashCount > 0) parts.push(`${stashCount} set aside, compare before drop`);
+  return `Fresh: ${parts.join('. ')}.`;
+}
+
+function run(cmd, args, cwd, timeout) {
+  return execFileSync(cmd, args, {
+    cwd,
+    encoding: 'utf8',
+    timeout,
+    stdio: ['ignore', 'pipe', 'ignore'],
+  }).trim();
+}
+
+function gitTop(cwd) {
+  try {
+    return run('git', ['rev-parse', '--show-toplevel'], cwd, 3000);
+  } catch {
+    return null;
+  }
+}
+
+function readJson(file) {
+  try {
+    return JSON.parse(readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+export function wornSuitVersion(projectRoot, opts = {}) {
+  if (projectRoot) {
+    const local = readJson(join(projectRoot, 'node_modules', '0xray', 'package.json'));
+    if (local && local.version) return String(local.version);
+  }
+  const candidates = [
+    '/opt/homebrew/lib/node_modules/0xray/package.json',
+    '/usr/local/lib/node_modules/0xray/package.json',
+  ];
+  for (const file of candidates) {
+    const pkg = readJson(file);
+    if (pkg && pkg.version) return String(pkg.version);
+  }
+  if (!opts.liveGlobal) return null;
+  try {
+    const root = run('npm', ['root', '-g'], projectRoot || process.cwd(), 8000);
+    const pkg = readJson(join(root, '0xray', 'package.json'));
+    return pkg && pkg.version ? String(pkg.version) : null;
+  } catch {
+    return null;
+  }
+}
+
+export function readWorkSnapshot(projectRoot) {
+  const top = gitTop(projectRoot);
+  let behind = 0;
+  let stashCount = 0;
+  if (top && resolve(top) === resolve(projectRoot)) {
+    try {
+      behind = Number(run('git', ['rev-list', '--count', 'HEAD..origin/main'], projectRoot, 4000)) || 0;
+    } catch {
+      behind = 0;
+    }
+    try {
+      const list = run('git', ['stash', 'list'], projectRoot, 4000);
+      stashCount = list ? list.split('\n').filter(Boolean).length : 0;
+    } catch {
+      stashCount = 0;
+    }
+  }
+  const repo = readJson(join(projectRoot, 'package.json'));
+  const saved = readJson(join(projectRoot, '.xray', 'state', 'freshness.json'));
+  return {
+    behind,
+    stashCount,
+    repoName: repo && repo.name ? String(repo.name) : null,
+    repoVersion: repo && repo.version ? String(repo.version) : null,
+    wornSuit: wornSuitVersion(projectRoot),
+    publishedSuit: saved && saved.publishedSuit ? String(saved.publishedSuit) : null,
+  };
+}
+
+function freshnessFile(projectRoot) {
+  return join(projectRoot, '.xray', 'state', 'freshness.json');
+}
+
+export function readSavedFreshness(projectRoot) {
+  const saved = readJson(freshnessFile(projectRoot));
+  return saved ? describeFreshness(saved) : null;
+}
+
+export function probeFreshness(projectRoot) {
+  const saved = readJson(freshnessFile(projectRoot));
+  if (saved && saved.behind != null) return decideFreshness(saved);
+  return decideFreshness(readWorkSnapshot(projectRoot));
+}
+
+export function refreshFreshness(projectRoot) {
+  const top = gitTop(projectRoot);
+  if (top && resolve(top) === resolve(projectRoot)) {
+    try {
+      run('git', ['fetch', 'origin', '--prune'], projectRoot, 8000);
+    } catch {
+      /* offline fetch must not block the boot */
+    }
+  }
+  let publishedSuit = null;
+  try {
+    publishedSuit = run('npm', ['view', '0xray', 'version'], projectRoot, 8000);
+  } catch {
+    publishedSuit = null;
+  }
+  const snapshot = readWorkSnapshot(projectRoot);
+  if (publishedSuit) snapshot.publishedSuit = publishedSuit;
+  if (snapshot.repoName === '0xray' && snapshot.repoVersion) {
+    snapshot.wornSuit = snapshot.repoVersion;
+  } else {
+    const globalWorn = wornSuitVersion(projectRoot, { liveGlobal: true });
+    if (globalWorn) snapshot.wornSuit = globalWorn;
+  }
+  try {
+    const dir = join(projectRoot, '.xray', 'state');
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(freshnessFile(projectRoot), `${JSON.stringify({
+      publishedSuit: snapshot.publishedSuit,
+      wornSuit: snapshot.wornSuit,
+      behind: snapshot.behind,
+      stashCount: snapshot.stashCount,
+      checkedAt: new Date().toISOString(),
+    }, null, 2)}\n`);
+  } catch {
+    /* the gate still reads git and the worn package */
+  }
+  return {
+    ...snapshot,
+    freshnessLine: describeFreshness(snapshot),
+  };
+}

package/dist/processors/implementations/agents-md-validation-processor.js

@@ -224,7 +224,7 @@ export class AgentsMdValidationProcessor {
                 "",
                 "## Codex",
                 "",
-                `0xRay enforces Universal Development Codex (69 terms) for systematic error prevention.`,
+                `0xRay enforces Universal Development Codex (70 terms) for systematic error prevention.`,
                 "",
             ].join("\n"),
             "## CLI Commands": [

package/docs-site/docs/plates/boot.md

@@ -20,6 +20,11 @@ sidebar_label: Boot
 ┌─────────────────────────────┼──────────────────────────────┐
 │ PROCESSING LAYER            v                              │
 │   ┌────────────────────────────────────────────────────┐  │
+│   │ memory monitoring                                  │  │
+│   │ setupMemoryMonitoring                              │  │
+│   └──────────────────────────┬─────────────────────────┘  │
+│                              v                            │
+│   ┌────────────────────────────────────────────────────┐  │
 │   │ load .xray config                                  │  │
 │   └──────────────────────────┬─────────────────────────┘  │
 │                              v                            │
@@ -33,12 +38,22 @@ sidebar_label: Boot
 │                              v                            │
 │   ┌────────────────────────────────────────────────────┐  │
 │   │ activateProcessors (PROCESSOR_DEFS)                │  │
-│   │ legacy boot list, then agents and plugins          │  │
+│   └──────────────────────────┬─────────────────────────┘  │
+│                              v                            │
+│   ┌────────────────────────────────────────────────────┐  │
+│   │ processor health                                   │  │
+│   │ validateProcessorHealth                            │  │
+│   └──────────────────────────┬─────────────────────────┘  │
+│                              v                            │
+│   ┌────────────────────────────────────────────────────┐  │
+│   │ agents and plugins                                 │  │
+│   │ loadRemainingAgents · initializePluginSystem       │  │
 │   └──────────────────────────┬─────────────────────────┘  │
 │                              v                            │
 │   ┌────────────────────────────────────────────────────┐  │
 │   │ enforcement · codex compliance                     │  │
-│   │ Dynamo governance integration                      │  │
+│   │ finalizeSecurityIntegration                        │  │
+│   │ governance init when that flag is not false        │  │
 │   └──────────────────────────┬─────────────────────────┘  │
 └──────────────────────────────┼────────────────────────────┘
                                v

package/docs-site/docs/plates/governance.md

@@ -5,7 +5,7 @@ sidebar_label: Governance
 
 # Governance
 
-A proposal is deliberated inside the suit, filtered by Dynamo Solar, then merged. The PreToolUse codex gate stands beside the vote.
+A proposal is deliberated inside the suit, filtered by Dynamo Solar, then merged. The vote is approve, reject, or needs_revision. The PreToolUse codex gate stands beside the vote.
 
 ```
 ┌────────────────────────────────────────────────────────────┐
@@ -44,7 +44,8 @@ A proposal is deliberated inside the suit, filtered by Dynamo Solar, then merged
 │ OUTPUT LAYER                 v                            │
 │   ┌──────────────────────┐      ┌──────────────────────┐ │
 │   │ vote                 │      │ codex decision       │ │
-│   │ approve / reject     │      │ allow / deny         │ │
+│   │ approve / reject /   │      │ allow / deny         │ │
+│   │ needs_revision       │      │                      │ │
 │   └──────────────────────┘      └──────────────────────┘ │
 └────────────────────────────────────────────────────────────┘
 ```

package/docs-site/docs/plates/index.md

@@ -23,6 +23,8 @@ Plates have a type. A domain model plate shows how named parts fit. A state flow
 
 [House](./house.md)
 
-## Not yet typed
+## Pipeline
 
 [Routing](./routing.md) · [Governance](./governance.md) · [Boot](./boot.md) · [Orchestration](./orchestration.md) · [Processor](./processor.md) · [Reporting](./reporting.md) · [Memory recall](./memory-recall.md)
+
+These seven are the lens planes. Each drawing is an input layer, a processing layer, and an output layer. Ground has no plate file.