0xray 4.0.38 → 4.0.40

package/.grok-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.38",
+  "version": "4.0.40",
   "description": "0xRay suit for Grok, Hermes, OpenClaw, OpenCode: mill+inspect, Codex, 7 MCP servers. Costume 45/42 is opt-in foundry, not the default wear.",
   "author": {
     "name": "0xRay AI",

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.38",
+  "version": "4.0.40",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/AGENTS-consumer.md

@@ -6,7 +6,7 @@ Quick reference for the 0xRay AI orchestration framework worn on **{{CONSUMER_NA
 
 **4.0** — a suit that survives the context window
 
-Same **three-subsystem OS** as v2 (Inference · External Governance · Autonomous Engine). Constitution always on. Temperament scales ceremony. Four chat bridges plus Cursor project hooks. **Repertoire is preferred** — vendored 0.2.8 ships **on**. Dest is named laws, not keywords. Station is the compact ticket, not a substitute. Explicit opt-out only: `"enabled": false, "provider": "repertoire"`. Trim fat, do not gut the design.
+Same **three-subsystem OS** as v2 (Inference · External Governance · Autonomous Engine). Constitution always on. Temperament scales ceremony. Four chat bridges plus Cursor project hooks. **Repertoire is preferred** — vendored 0.2.9 ships **on**. Dest is named laws, not keywords. Station is the compact ticket, not a substitute. Explicit opt-out only: `"enabled": false, "provider": "repertoire"`. Trim fat, do not gut the design.
 
 **Governance always on** (Codex PreToolUse, no new surface, no `eval`). **Engine ceremony** (analyze-complexity before spawn, confer) is **guided** by default so free-model OpenCode/Hermes stay in check. Frontier hosts (Grok 4.6 class) with `suit_temperament.profile: auto` **warn** on spawn-without-plan instead of deny — the engine is still there. Existing `.xray/features.json` without `suit_temperament` stays **guided**. Docs: v3 from v2 · Suit temperament.
 

package/AGENTS.md

@@ -4,7 +4,7 @@ Quick reference for the xray AI orchestration framework (**4.0**).
 
 **4.0** — a suit that survives the context window.
 
-**Exo, not catalog.** Three-subsystem OS (Inference · External Governance · Autonomous Engine) · constitution always on · temperament by host · 4 floors · **Repertoire preferred** (vendored 0.2.8, dest = laws).
+**Exo, not catalog.** Three-subsystem OS (Inference · External Governance · Autonomous Engine) · constitution always on · temperament by host · 4 floors · **Repertoire preferred** (vendored 0.2.9, dest = laws).
 
 **Temperament:** ceremony (analyze-complexity before spawn, confer) is **guided** by default so free-model OpenCode/Hermes stay in check. Frontier hosts (Grok 4.6 class) with `suit_temperament.profile: auto` **warn** on spawn-without-plan; Codex 11/29/69 still **deny**. Missing `suit_temperament` stays guided. See `docs-site/docs/architecture/v3-from-v2.md`.
 

package/README.md

@@ -14,13 +14,13 @@ Not a catalog of agents. The product is the **skeleton you wear**.
 - **Always on** — Codex 11 / 29 / 69, destructive shell, no new MCP/skill/handler surface
 - **Temperament** — `frontier` | `guided` | `strict` | `auto` — how loud the engine is, not whether governance exists
 - **Wear** — Grok, OpenCode, Hermes, OpenClaw, plus Cursor project hooks. One SSOT gate
-- **Muscle** — **Repertoire is preferred.** Vendored 0.2.8 ships **on**. Dest is named laws, not hangar `repo-*` or git slugs. Station is the compact-survival ticket — not a substitute for Repertoire.
+- **Muscle** — **Repertoire is preferred.** Vendored 0.2.9 ships **on**. Dest is named laws, not hangar `repo-*` or git slugs. Station is the compact-survival ticket — not a substitute for Repertoire.
 
 ```bash
 npm install 0xray
 ```
 
-Consumer `npm install 0xray` auto-wires four chat bridges, Cursor project hooks, and seven MCP servers. **Repertoire is preferred** — vendored **0.2.8** ships on: factory + stack laws, in-process routing, extra host MCP `repertoire`. Not an eighth `xray-*` server. Dest is a judgment index. Explicit opt-out only: `"enabled": false, "provider": "repertoire"`. Do not pin 0.1.8.
+Consumer `npm install 0xray` auto-wires four chat bridges, Cursor project hooks, and seven MCP servers. **Repertoire is preferred** — vendored **0.2.9** ships on: factory + stack laws, in-process routing, extra host MCP `repertoire`. Not an eighth `xray-*` server. Dest is a judgment index. Explicit opt-out only: `"enabled": false, "provider": "repertoire"`. Do not pin 0.1.8.
 
 ## Quick Start
 

package/SKILLS.md

@@ -4,7 +4,7 @@
 
 **45 skills** in this exo catalog. Default consumer plant is **`mill` + `inspect`**, not this dump. `npm install 0xray` does **not** sync 45 skills unless `foundry.json` `"costume": true`. Factory shop plant (`shop-extract`, `shop-witness`, `shop-pin`) coexists with mill plant when a hangar wears those shops. Extra shops: `foundry.json` `shopPlant`. Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares — organs (looker, vibe, mixer) live in the mill, not this catalog. Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip|sound` still exist on foundry 0.1.11+. Agent map: [llms.txt](llms.txt).
 
-xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) as the **costume / self-plant catalog**. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. **Repertoire is preferred** for long-term judgment (vendored 0.2.8, dest = named laws). Station is the compact ticket, not a skill and not a keyword store. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`) or when you plant them. This file is the exo catalog — mill does **not** write it to the consumer root.
+xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) as the **costume / self-plant catalog**. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. **Repertoire is preferred** for long-term judgment (vendored 0.2.9, dest = named laws). Station is the compact ticket, not a skill and not a keyword store. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`) or when you plant them. This file is the exo catalog — mill does **not** write it to the consumer root.
 
 ---
 

package/dist/AGENTS.md

@@ -4,7 +4,7 @@ Quick reference for the xray AI orchestration framework (**4.0**).
 
 **4.0** — a suit that survives the context window.
 
-**Exo, not catalog.** Three-subsystem OS (Inference · External Governance · Autonomous Engine) · constitution always on · temperament by host · 4 floors · **Repertoire preferred** (vendored 0.2.8, dest = laws).
+**Exo, not catalog.** Three-subsystem OS (Inference · External Governance · Autonomous Engine) · constitution always on · temperament by host · 4 floors · **Repertoire preferred** (vendored 0.2.9, dest = laws).
 
 **Temperament:** ceremony (analyze-complexity before spawn, confer) is **guided** by default so free-model OpenCode/Hermes stay in check. Frontier hosts (Grok 4.6 class) with `suit_temperament.profile: auto` **warn** on spawn-without-plan; Codex 11/29/69 still **deny**. Missing `suit_temperament` stays guided. See `docs-site/docs/architecture/v3-from-v2.md`.
 

package/dist/CHANGELOG.md

@@ -42,6 +42,31 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 - Archive root `integrations/` costume SKILL dump → `docs/archive/integrations-costume/`. Live wear is `src/integrations`.
 - Archive root `commands/` stale copy → `docs/archive/commands-copy/`. Live wear is `src/opencode/commands`.
 
+## [4.0.40] - 2026-10-05
+
+### 🔄 Changes
+
+### 🔎 Other Changes
+- house/live-mesh: full loop — feed watch, mesh render, direction, deploy, `/health`, X ledger both ways (#214, #215).
+- house: define Ping-pong in OP-PROC lexicon (#213).
+- house: OP-PROC cadence cleanup — muse-house lock, fleet forge0x1-merge, quiet/budget, sudo-copy seats (#216).
+- house: OP-PROC eng PR coach stack + 2026-10-04 eng state lock (#210, #212).
+- docs/dist: Dist packet note for 0xray 4.0.39 / repertoire 0.2.9 (#211).
+
+---
+
+## [4.0.39] - 2026-10-03
+
+### 🔄 Changes
+
+### 🔎 Other Changes
+- Keep the seven stack laws already worn in the suit. (427b0538e)
+- Vendor repertoire 0.2.9. (b45ed22f9)
+- Merge pull request #209 from 0xRayAI/cursor/evidence-before-grade-d703 (92a4d6dd9)
+- house: add Evidence before grade rules under §3 (0fa229981)
+
+---
+
 ## [4.0.38] - 2026-10-03
 
 ### 🔄 Changes

package/dist/README.md

@@ -14,13 +14,13 @@ Not a catalog of agents. The product is the **skeleton you wear**.
 - **Always on** — Codex 11 / 29 / 69, destructive shell, no new MCP/skill/handler surface
 - **Temperament** — `frontier` | `guided` | `strict` | `auto` — how loud the engine is, not whether governance exists
 - **Wear** — Grok, OpenCode, Hermes, OpenClaw, plus Cursor project hooks. One SSOT gate
-- **Muscle** — **Repertoire is preferred.** Vendored 0.2.8 ships **on**. Dest is named laws, not hangar `repo-*` or git slugs. Station is the compact-survival ticket — not a substitute for Repertoire.
+- **Muscle** — **Repertoire is preferred.** Vendored 0.2.9 ships **on**. Dest is named laws, not hangar `repo-*` or git slugs. Station is the compact-survival ticket — not a substitute for Repertoire.
 
 ```bash
 npm install 0xray
 ```
 
-Consumer `npm install 0xray` auto-wires four chat bridges, Cursor project hooks, and seven MCP servers. **Repertoire is preferred** — vendored **0.2.8** ships on: factory + stack laws, in-process routing, extra host MCP `repertoire`. Not an eighth `xray-*` server. Dest is a judgment index. Explicit opt-out only: `"enabled": false, "provider": "repertoire"`. Do not pin 0.1.8.
+Consumer `npm install 0xray` auto-wires four chat bridges, Cursor project hooks, and seven MCP servers. **Repertoire is preferred** — vendored **0.2.9** ships on: factory + stack laws, in-process routing, extra host MCP `repertoire`. Not an eighth `xray-*` server. Dest is a judgment index. Explicit opt-out only: `"enabled": false, "provider": "repertoire"`. Do not pin 0.1.8.
 
 ## Quick Start
 

package/dist/SKILLS.md

@@ -4,7 +4,7 @@
 
 **45 skills** in this exo catalog. Default consumer plant is **`mill` + `inspect`**, not this dump. `npm install 0xray` does **not** sync 45 skills unless `foundry.json` `"costume": true`. Factory shop plant (`shop-extract`, `shop-witness`, `shop-pin`) coexists with mill plant when a hangar wears those shops. Extra shops: `foundry.json` `shopPlant`. Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares — organs (looker, vibe, mixer) live in the mill, not this catalog. Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip|sound` still exist on foundry 0.1.11+. Agent map: [llms.txt](llms.txt).
 
-xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) as the **costume / self-plant catalog**. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. **Repertoire is preferred** for long-term judgment (vendored 0.2.8, dest = named laws). Station is the compact ticket, not a skill and not a keyword store. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`) or when you plant them. This file is the exo catalog — mill does **not** write it to the consumer root.
+xray ships 45 knowledge skills (`src/skills/<name>/SKILL.md`) as the **costume / self-plant catalog**. Lead-dev operating model lives in **`orchestrator`** skill + `multi_agent_orchestration.lead_dev_mode` in features.json. **Repertoire is preferred** for long-term judgment (vendored 0.2.9, dest = named laws). Station is the compact ticket, not a skill and not a keyword store. Skills load on demand via the **xray-skills** MCP server (`npx -y 0xray mcp skills`) or when you plant them. This file is the exo catalog — mill does **not** write it to the consumer root.
 
 ---
 

package/dist/integrations/hooks/goggles-planes.json

@@ -8,7 +8,7 @@
       "src",
       "grok-bot/OP-PROC.md",
       "src/opencode/agents",
-      "Agents.md",
+      "AGENTS.md",
       "src/integrations",
       "package.json",
       "scripts/foundry"

package/dist/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.38",
+  "version": "4.0.40",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/docs-site/docs/plates/activity-log.md

@@ -35,4 +35,4 @@ Today those writers append `logs/framework/activity.log`. The features default s
 
 When: on the tool hook, on framework logger flush, and on boot when file logging is on. Why: the report and the pulse read one tail, not a pile of copies.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/cursor-compact.md

@@ -32,4 +32,4 @@ Cursor preCompact writes the station card and cannot block the compact.
 
 The file is `src/integrations/cursor/hooks/pre-compact.js`. The message tells the seat to read STATION.md. The plates that belong here are payload-heat and station-heat.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/grok-compact.md

@@ -32,4 +32,4 @@ Grok PreCompact runs session-start.js with the pre_compact event.
 
 The hook is `session-start.js --hook-event=pre_compact`. It calls `buildSessionBootPayload`, writes the station card, and prints nothing. It does not match the conversation. Grok ignores hook stdout. The plates that belong here are payload-heat, cursor-compact, and work-fresh.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/grokbot.md

@@ -38,4 +38,4 @@ Give your bots a house: shared rules, one board for the work, and memory that st
   code links: suit → memory, house → doctor, memory → station. Other lines show reading order only.
 ```
 
-stamped · 0xray 4.0.30 · @0xray/grok-bot 0.1.8
+stamped · 0xray 4.0.40 · @0xray/grok-bot 0.1.8

package/docs-site/docs/plates/house.md

@@ -50,4 +50,4 @@ A state flow plate: the stages a house goes through before doctor says House: PA
   └──────────────────────────────┘
 ```
 
-stamped · 0xray 4.0.30 · @0xray/grok-bot 0.1.8
+stamped · 0xray 4.0.40 · @0xray/grok-bot 0.1.8

package/docs-site/docs/plates/index.md

@@ -21,7 +21,7 @@ Plates have a type. A domain model plate shows how named parts fit. A state flow
 
 ## State flow
 
-[House](./house.md) · [Review](./review.md)
+[House](./house.md) · [Live mesh](./live-mesh.md) · [Review](./review.md)
 
 ## Pipeline
 

package/docs-site/docs/plates/inference-files.md

@@ -32,4 +32,4 @@ Inference cycle state already lives under .xray/inference.
 
 Cycle state, history, graded ids, and governance state are already there. Session files still fall back to `docs/inference` until the writers move.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/kept-line.md

@@ -32,4 +32,4 @@ A station rewrite keeps one Fresh line and drops the copies.
 
 mergeStationMarkdown in src/integrations/hooks/station-hook-runtime.cjs treats a Fresh line as stock. Copies are not preserved. When the new card has no Fresh line, the latest one is kept. The plates that belong here are station-card and work-fresh.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/lens-gate.md

@@ -32,4 +32,4 @@ A search names one plane or it stops.
 
 lensBeforeResearch in src/integrations/hooks/goggles-pipeline.mjs returns null when the call is not research, and when the spoken text names exactly one card plane. Zero names, or more than one, deny with Name one plane. A shell that reads a project source file is research. The first open of a source file that no lens lists is allowed and remembered. The next search stops until that file is on a lens and the plate is on disk. The hook does not author the plate. The plate that belongs here is pre-tool.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/lens-page.md

@@ -32,4 +32,4 @@ The lens page is the card for one plane.
 
 `formatCardPane` in `src/integrations/hooks/goggles-pipeline.mjs` draws the card. Read the card instead of searching the tree. The plates that belong here are record-map and lens-gate.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/live-mesh.md

@@ -0,0 +1,41 @@
+---
+title: Live mesh
+sidebar_label: Live mesh
+plate_type: pipeline
+---
+
+# Live mesh
+
+Ping-pong eng events become one ordered JSON feed, then a mesh render. Markdown is never the source.
+
+```
+┌────────────────────────────────────────────────────────────┐
+│ INPUT LAYER                                                │
+│   ┌──────────────┐ ┌──────────┐ ┌─────────┐ ┌───────────┐ │
+│   │ GitHub REST  │ │ deploy   │ │ /health │ │ X ledger  │ │
+│   │ PR/issue     │ │ muse     │ │ probe   │ │ herald    │ │
+│   └──────┬───────┘ └────┬─────┘ └────┬────┘ └─────┬─────┘ │
+│          └──────────────┴────────────┴────────────┘        │
+└─────────────────────────────┬──────────────────────────────┘
+                              v
+┌─────────────────────────────┼──────────────────────────────┐
+│ PROCESSING LAYER            v                              │
+│   ┌────────────────────────────────────────────────────┐  │
+│   │ fetch_feed.py                                      │  │
+│   │ poll → dedupe on id → rewrite live-events.json     │  │
+│   │ --watch keeps the feed warm                        │  │
+│   └──────────────────────────┬─────────────────────────┘  │
+└──────────────────────────────┼────────────────────────────┘
+                               v
+┌──────────────────────────────┼────────────────────────────┐
+│ OUTPUT LAYER                 v                            │
+│   ┌──────────────────────┐  ┌──────────────────────────┐ │
+│   │ live-events.json     │  │ render_mesh.py           │ │
+│   │ (+ jsonl append)     │  │ mp4 / --follow           │ │
+│   └──────────────────────┘  └──────────────────────────┘ │
+└────────────────────────────────────────────────────────────┘
+```
+
+Paths live under `house/live-mesh/`. Schema is `schema.json`. The plate that belongs here is house.
+
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/notes-page.md

@@ -32,4 +32,4 @@ Notes are the body the station card cannot hold.
 
 The page is `.xray/state/NOTES.md`. The pickup line equals the station intent. The default depth is the working notes: the point, the coverage, the library, the open pull requests, the rituals, and the next cut. A pickup line alone does not survive a compact. PreCompact calls `stampNotesPickup`, which updates only that line and leaves the body alone. The hook does not check the body. The seat writes it before the compact. Do not commit this file. Do not feed it to Repertoire.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/package-face.md

@@ -32,4 +32,4 @@ A release writes the package face, and the agent reads it.
 
 The face is `README.md`, `package.json`, `AGENTS.md`, `llms.txt`, `CHANGELOG.md`, and `SKILLS.md`. Do not hand-bump the version.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/payload-heat.md

@@ -32,4 +32,4 @@ buildSessionBootPayload calls applyStationHeat and writes the station card.
 
 The function is in `src/integrations/grok/hooks/grok-hook-utils.js`. The plates that belong here are station-heat and pickup-stamp.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/pickup-stamp.md

@@ -32,4 +32,4 @@ stampNotesPickup writes one pickup line and leaves the rest of NOTES.md alone.
 
 The comment on the function is one pickup line. There is no check that the working notes are present. The plate that belongs here is notes-page.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/pre-tool.md

@@ -32,4 +32,4 @@ The tool hook is where the lens gate runs.
 
 pre-tool-use.js joins the command, the written content, and the paths, then calls lensBeforeResearch. A deny ends the hook. The plate that belongs here is lens-gate.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/record-map.md

@@ -38,4 +38,4 @@ Trail: state and logs under `.xray`. Codex is already loaded. This plate is the
 
 The published manual is `docs-site/docs/`. The rule sheet is `grok-bot/OP-PROC.md`. Neither is one of the five pages.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/reflection-page.md

@@ -32,4 +32,4 @@ A reflection is one episode written under docs/reflections.
 
 The loader is `loadReflectionInferences` in `src/inference/inference-accumulator.ts`. A reflection is not a repertoire law.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/review.md

@@ -54,4 +54,4 @@ A state flow plate: one critic pass, one fix, one re-review, then stop.
 
 A FAIL names the file and a test that fails on the old code. One author fixes that hole. A second session waits while the verdict is open. Re-review that new head. A hole the new test did not lock returns to ONE FIX. A PASS ends the plate. A note stays a note and does not open another lap.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/session-capture.md

@@ -35,4 +35,4 @@ Today that file is `docs/inference/latest-session.json`. The home is `.xray/infe
 
 Station reads the file for heat. The inference accumulator reads `session-*.json` beside it. Do not mint a `session-<date>-<sha>` file for the station note.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/site-manual.md

@@ -32,4 +32,4 @@ The published manual is docs-site/docs.
 
 Guides, architecture, and introduction live here. Factory notes under `docs/` are a different set. Reflections stay in `docs/reflections/`.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/stamp-plate.md

@@ -32,4 +32,4 @@ A stamped plate is one drawing for one plane.
 
 The file is `docs-site/docs/plates/<id>.md`. Each opened segue gets its own plate. The hook does not author this file. The plate that belongs here is review.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/station-card.md

@@ -32,4 +32,4 @@ The station card is the one-line ticket at .xray/state/STATION.md.
 
 Read it after a compact. Leave Intent alone. The plan is the next cut. The long body belongs in notes.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/station-heat.md

@@ -32,4 +32,4 @@ On a compact event applyStationHeat stamps the notes pickup line.
 
 `isCompactHook` is true when the hook name contains compact. The body of NOTES.md is left alone. The plates that belong here are pickup-stamp and notes-page.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/suit-organs.md

@@ -35,4 +35,4 @@ Reporting reads the activity log and may write a report. Station reads `latest-s
 
 Repertoire already keeps `inference-state.json` and the day log under `.xray/state/repertoire/`. Goggles does not write these files. It reads a plate when one plane is named.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/suit-settings.md

@@ -32,4 +32,4 @@ Suit settings are features, config, and codex.
 
 There is no settings.json. The files are `.xray/features.json`, `.xray/config.json`, and `.xray/codex.json`. The package copies live under `xray/`.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/suit-wear.md

@@ -34,4 +34,4 @@ Wear copies hooks, features.json, and the consumer gitignore into the project, a
 
 A worn project is a consumer. Its writes go to its own `.xray/logs` and `.xray/inference`, not into `docs/` and not into `.opencode/logs`.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/trail-state.md

@@ -32,4 +32,4 @@ The suit writes its trail under .xray.
 
 Session boot, the lens match line, and the station card are state. The agent reads them. Do not commit `.xray/state`.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/work-fresh.md

@@ -32,4 +32,4 @@ Refresh writes one Fresh line from git and the published package.
 
 refreshFreshness in src/nucleus/work-freshness.mjs fetches origin, reads npm view 0xray version, and returns that one line. A compact hook does not call it. The plate that belongs here is station-card.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/docs-site/docs/plates/write-home.md

@@ -35,4 +35,4 @@ The path table is `src/integrations/hooks/write-home.cjs`. Writers use it. Reade
 
 Still on the old path until each caller is rewired: the activity logger, the framework logger, the pipeline hook, the Grok hook, the Hermes bridge, station capture, `saveSessionInference`, reporting, pulse, monitor, and `features.json` `log_path`.
 
-stamped · 0xray 4.0.36
+stamped · 0xray 4.0.40

package/llms.txt

@@ -41,7 +41,7 @@ Registered in `.mcp.json` as `npx -y 0xray mcp <cmd>`:
 | `xray-code-review` | Proposal quality |
 | `xray-architect-tools` | System design |
 
-Not an 8th `xray-*` server. **Repertoire is preferred** — vendored 0.2.8 ships on (`npx @0xray/repertoire mcp`). Dest is named laws, not hangar `repo-*` or git slugs. Survive compact is **Station** (Read `.xray/state/STATION.md`). Station is the ticket, not a substitute for Repertoire. Do not pin 0.1.8.
+Not an 8th `xray-*` server. **Repertoire is preferred** — vendored 0.2.9 ships on (`npx @0xray/repertoire mcp`). Dest is named laws, not hangar `repo-*` or git slugs. Survive compact is **Station** (Read `.xray/state/STATION.md`). Station is the ticket, not a substitute for Repertoire. Do not pin 0.1.8.
 
 ## Codex 69 (always on)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.38",
+  "version": "4.0.40",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",
@@ -226,6 +226,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^9.39.2",
+    "@playwright/test": "^1.55.0",
     "@types/express": "^5.0.0",
     "@types/jsonwebtoken": "^9.0.7",
     "@types/node": "^22.10.2",

package/scripts/foundry/plant/skills/mill/SKILL.md

@@ -11,7 +11,7 @@ The mill **fastens** a suit. Default mill plant is **inspect** (inspecting AI wo
 
 **Mill-fill:** their keys/files win. Mill plant names they did not overlay stay. JSON always merges.
 
-**Factory:** **Repertoire is preferred** (vendored 0.2.8 ships on; dest = named laws). Seven generated MCP. Constitution (PPE) stays worn. Not a fifth MCP. Not 5.0.
+**Factory:** **Repertoire is preferred** (vendored 0.2.9 ships on; dest = named laws). Seven generated MCP. Constitution (PPE) stays worn. Not a fifth MCP. Not 5.0.
 
 **Costume:** `foundry.json` `"costume": true` copies the 45/42 mill costume.
 

package/scripts/node/consumer-install-smoke.mjs

@@ -90,7 +90,7 @@ function assertOrganRequire(tmpRoot) {
   if (organPkg.name !== "@0xray/repertoire") {
     throw new Error(`required organ name ${organPkg.name}`);
   }
-  if (organPkg.version !== "0.2.8") {
+  if (organPkg.version !== "0.2.9") {
     throw new Error(`required organ version ${organPkg.version}`);
   }
   if (fs.existsSync(path.join(tmpRoot, "vendor"))) {
@@ -163,8 +163,8 @@ function assertFreshInstallDefaults(tmpRoot, version) {
     throw new Error("vendored @0xray/repertoire missing from fresh tarball install");
   }
   const organ = JSON.parse(fs.readFileSync(organPkg, "utf-8"));
-  if (organ.version !== "0.2.8") {
-    throw new Error(`expected organ 0.2.8, got ${organ.version}`);
+  if (organ.version !== "0.2.9") {
+    throw new Error(`expected organ 0.2.9, got ${organ.version}`);
   }
   console.log("  ✅ .xray/features.json fresh-install defaults (opt-in off)");
   return { consumerFeaturesPath, features };

package/scripts/node/playwright-smoke-server.cjs

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+/**
+ * Minimal static server for the Arch1 Playwright release-gate battery.
+ * Serves one HTML page with a tiny script so chromium coverage has a target.
+ */
+const http = require('http');
+const port = Number(process.env.PLAYWRIGHT_SMOKE_PORT || 3000);
+const html = `<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><title>0xray release gate</title></head>
+<body>
+  <main id="gate">release-gate-ok</main>
+  <script>
+    window.__XRAY_RELEASE_GATE__ = function mark() {
+      return document.getElementById('gate').textContent;
+    };
+    window.__XRAY_RELEASE_GATE__();
+  </script>
+</body>
+</html>`;
+const server = http.createServer((req, res) => {
+  res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+  res.end(html);
+});
+server.listen(port, '127.0.0.1', () => {
+  process.stdout.write(`playwright-smoke-server listening on ${port}\n`);
+});

package/src/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.38",
+  "version": "4.0.40",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/vendor/@0xray/repertoire/README.md

@@ -2,7 +2,7 @@
 
 Factory memory organ for [0xRay](https://github.com/0xRayAI/xray): seed primitives, in-process memory routing, extra MCP (not an 8th `xray-*` server).
 
-**v0.2.8** · 0xRay **4.0** wear. Runtime does **not** depend on `0xray` (optional peer for suit-verify scripts).
+**v0.2.9** · 0xRay **4.0** wear. Runtime does **not** depend on `0xray` (optional peer for suit-verify scripts).
 
 ## Install
 

package/vendor/@0xray/repertoire/dist/RepertoireService.js

@@ -32,6 +32,7 @@ export class RepertoireService {
         this.metaInference = new MetaInferenceEngine({
             logDir: this.logDir,
             statePath: options.statePath ?? writable.statePath,
+            reportPath: join(this.projectRoot, 'logs', 'meta-inference', 'synthesis.md'),
         });
         this.feedbackIngester = new OrchestratorFeedbackIngester(options.feedbackDir ?? writable.feedbackDir);
         if (shouldAutoSyncField(options.syncField)) {

package/vendor/@0xray/repertoire/dist/orchestrator-bridge/RepertoireOrchestratorBridge.js

@@ -94,7 +94,10 @@ export class RepertoireOrchestratorBridge {
         const repertoireContext = this.buildRoutingContext(operation);
         const adjustedScore = this.injector.adjustComplexityScore(complexityScore, repertoireContext, confidenceContext);
         let agent = baseAgent;
-        if (confidenceContext.highConfidenceTrapPresent && adjustedScore >= 26) {
+        // Trap name alone must not change the agent. Crossing the architect line
+        // (debug / investigate / redesign / explicit architect) may route to architect.
+        const crossesArchitectLine = /\b(debug|investigate|redesign|architect)\b/i.test(operation);
+        if (confidenceContext.highConfidenceTrapPresent && adjustedScore >= 26 && crossesArchitectLine) {
             agent = 'architect';
         }
         else if (repertoireContext.matchedTags.includes('provenance-failure') &&

package/vendor/@0xray/repertoire/dist/orchestrator-bridge/signal-injector.d.ts

@@ -24,6 +24,11 @@ export declare class SignalInjector {
      */
     adjustComplexityScore(baseScore: number, context: RepertoireRoutingContext, confidenceContext?: ReturnType<typeof getConfidenceForTask>): number;
     private resolveSynthesisReportPath;
+    /**
+     * A dry or UNREVIEWED report is not inference. It must not become an excerpt
+     * or a routing flag.
+     */
+    private consumableSynthesisPath;
     private getSynthesisExcerpt;
     private readCodexExcerpt;
     private readPlanExcerpt;

package/vendor/@0xray/repertoire/dist/orchestrator-bridge/signal-injector.js

@@ -177,13 +177,23 @@ export class SignalInjector {
             const custom = this.synthesisReportPath.startsWith('/')
                 ? this.synthesisReportPath
                 : join(this.projectRoot, this.synthesisReportPath);
-            return existsSync(custom) ? custom : null;
+            return this.consumableSynthesisPath(custom);
         }
-        const candidates = [
-            join(this.projectRoot, 'logs/meta-inference/synthesis.md'),
-            join(this.projectRoot, 'logs/meta-inference/dry-synthesis.md'),
-        ];
-        return candidates.find((candidate) => existsSync(candidate)) ?? null;
+        return this.consumableSynthesisPath(join(this.projectRoot, 'logs/meta-inference/synthesis.md'));
+    }
+    /**
+     * A dry or UNREVIEWED report is not inference. It must not become an excerpt
+     * or a routing flag.
+     */
+    consumableSynthesisPath(candidate) {
+        if (!existsSync(candidate))
+            return null;
+        const content = readFileSync(candidate, 'utf8');
+        if (content.trim().length === 0)
+            return null;
+        if (/\bUNREVIEWED\b/.test(content))
+            return null;
+        return candidate;
     }
     getSynthesisExcerpt(maxChars) {
         const reportPath = this.resolveSynthesisReportPath();

package/vendor/@0xray/repertoire/dist/paths.js

@@ -421,8 +421,7 @@ export function reloadOpProc(cwd = process.cwd()) {
 }
 function mergeProjectOverlays(destPath) {
     mergeStackOverlay(destPath);
-    // Suit heat keeps repo-* off the project file. A wake that merges them
-    // and then prunes them records a fake 59 → 45 drop on every compact.
+    // Suit wake / REPERTOIRE_SUBJECT_OVERLAY=0 keeps repo-* subject flesh off the project file.
     if (process.env.REPERTOIRE_SUBJECT_OVERLAY === '0')
         return;
     mergeSubjectOverlay(destPath);