0xray 4.0.4 → 4.0.6

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.4",
+  "version": "4.0.1",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/AGENTS-consumer.md

@@ -19,7 +19,7 @@ Before other work, Read `.xray/state/STATION.md`. Compaction and host change are
 `npm install 0xray` runs `install-bridges.cjs` and:
 
 - Copies this file → **`AGENTS.md`** in your project root
-- Fastens mill plant (`mill` + `inspect`) then overlays **your** `src/skills` (same name wins). Inspect AI work is the mill discipline. Does **not** dump 45/42 costume unless `foundry.json` `"costume": true`. Does **not** write root **`SKILLS.md`**
+- Fastens mill plant (`mill` + `inspect`) then overlays **your** `src/skills` (same name wins). `npx @0xray/foundry inspect` runs the mill checks (chat is not a receipt). Does **not** dump 45/42 costume unless `foundry.json` `"costume": true`. Does **not** write root **`SKILLS.md`**
 - Seeds **`.gitignore`** (from template, if absent)
 - Deploys **`.xray/`** (`codex.json`, `features.json`, `config.json`) then overlays **your** mill SSOT (`xray/codex.json`, `xray/features.json`, `src/skills`, `src/opencode/agents`; remap with `foundry.json`)
 - Writes **`.mcp.json`** with 7 MCPs servers (`npx -y 0xray mcp …`)
@@ -58,6 +58,7 @@ Governance deliberation uses **code-review**, **security-audit** (via enforcer/s
 | `npx 0xray codex check` | Check codex rules |
 | `npx 0xray health` | Framework health check |
 | `npx 0xray mcp <server>` | Start an MCP server (stdio) |
+| `npx @0xray/foundry inspect` | Mill inspect (nested mill). Chat is not a receipt. |
 
 ## Governance
 

package/dist/CHANGELOG.md

@@ -28,6 +28,20 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 - Nested mill in the 0xray tarball (`scripts/foundry/`). Wear no longer needs a second `npm i @0xray/foundry` for mint-on-install. 4.0.2.
 - Empty garment: mill plant (`mill` skill) is the hanger. Not 45/42 costume unless `foundry.json` `"costume": true`. Mill 0.1.5.
 - Mill plant fastens **inspect** (inspect AI work) plus `mill`. Not empty. Mill 0.1.6.
+- Nested mill **0.1.7**: inspect organ, four floors, passwd HOME, mill CI receipt. 4.0.5.
+- Nested mill **0.1.8**: isolated Hermes/OpenClaw, consumer tarball GET, CLI mint inspects. 4.0.6.
+
+---
+
+## [4.0.6] - 2026-09-09
+
+Nested mill **0.1.8**. Isolated HOME skips machine Hermes/OpenClaw. Inspect GETs public consumer `.tgz`. CLI `mint` runs inspect (chat is not done). Postinstall does not inspect. Not 5.0.0.
+
+---
+
+## [4.0.5] - 2026-09-04
+
+Nested mill **0.1.7**. Inspect is a mill command (`npx @0xray/foundry inspect`): costume dump fails mint, live PUT GETs the `.tgz`, four project floors, mill CI receipt, passwd HOME isolation. Mill plant stays `mill` + `inspect`. Not 45/42 costume. Not 5.0.0.
 
 ---
 

package/dist/cli/commands/hermes-install.js

@@ -1,6 +1,5 @@
 import fs from 'fs';
 import path from 'path';
-import { homedir } from 'os';
 import { createRequire } from 'module';
 import { frameworkLogger } from '../../core/framework-logger.js';
 import { syncBuiltinSkills } from './skill-install.js';
@@ -8,6 +7,7 @@ import { mintAfterWear } from './foundry-mint-wear.js';
 const __dirname = path.dirname(new URL(import.meta.url).pathname);
 const require = createRequire(import.meta.url);
 const packageRoot = path.join(__dirname, '..', '..', '..');
+const millSuit = require(path.join(packageRoot, 'scripts', 'foundry', 'mint-suit.cjs'));
 const wiring = require(path.join(packageRoot, 'scripts', 'node', 'bridge-mcp-wiring.cjs'));
 export function registerHermesCommands(hermesCmd) {
     hermesCmd
@@ -21,8 +21,10 @@ export function registerHermesCommands(hermesCmd) {
 }
 async function installForHermes(options = {}) {
     frameworkLogger.log('hermes-integration', 'install-start', 'info', { options });
-    const home = homedir();
-    const targetPluginDir = path.join(home, '.hermes/plugins/xray-hermes');
+    const isolated = millSuit.isIsolatedHome();
+    const targetPluginDir = isolated
+        ? path.join(process.cwd(), '.hermes/plugins/xray-hermes')
+        : path.join(millSuit.machineHome(), '.hermes/plugins/xray-hermes');
     const possibleSources = [
         path.join(__dirname, '..', '..', '..', 'dist/integrations/hermes-agent'),
         path.join(__dirname, '..', '..', '..', 'src/integrations/hermes-agent'),
@@ -65,10 +67,10 @@ async function installForHermes(options = {}) {
             frameworkLogger.log('hermes-integration', 'skills-synced', 'info', { count: skillsCopied });
         }
         wiring.copyHermesFindProjectRootHelper(packageRoot, targetPluginDir);
-        if (wiring.copyHermesHookRuntimes(packageRoot)) {
+        if (!isolated && wiring.copyHermesHookRuntimes(packageRoot)) {
             frameworkLogger.log('hermes-integration', 'hooks-copied', 'info', {});
         }
-        const wired = wiring.wireHermesBridge(targetDir);
+        const wired = isolated ? { count: 0 } : wiring.wireHermesBridge(targetDir);
         mintAfterWear(targetDir);
         console.log(`\x1b[32m✓ Wired Hermes mcp_servers (${wired.count} servers)\x1b[0m`);
         console.log(`\x1b[32m✓ Consumer root → ${targetDir}\x1b[0m`);

package/dist/cli/commands/openclaw-install.js

@@ -1,6 +1,5 @@
 import fs from 'fs';
 import path from 'path';
-import { homedir } from 'os';
 import { createRequire } from 'module';
 import { frameworkLogger } from '../../core/framework-logger.js';
 import { syncBuiltinSkills } from './skill-install.js';
@@ -9,6 +8,7 @@ import { OpenClawConfigLoader } from '../../integrations/openclaw/config.js';
 import { writeSuitSessionBoot } from '../../nucleus/suit-temperament.js';
 const __dirname = path.dirname(new URL(import.meta.url).pathname);
 const require = createRequire(import.meta.url);
+const millSuit = require(path.join(__dirname, '..', '..', '..', 'scripts', 'foundry', 'mint-suit.cjs'));
 const wiring = require(path.join(__dirname, '..', '..', '..', 'scripts', 'node', 'bridge-mcp-wiring.cjs'));
 export function registerOpenClawCommands(openclawCmd) {
     openclawCmd
@@ -40,14 +40,19 @@ async function installForOpenClaw(options = {}) {
             const relative = path.relative(process.cwd(), configPath);
             console.log(`\x1b[32m✓ Created OpenClaw config at ${relative}\x1b[0m`);
         }
-        const openclawSkillsDir = path.join(homedir(), '.openclaw', 'skills');
+        const isolated = millSuit.isIsolatedHome();
+        const openclawSkillsDir = isolated
+            ? path.join(targetDir, '.openclaw', 'skills')
+            : path.join(millSuit.machineHome(), '.openclaw', 'skills');
         const skillsCopied = syncBuiltinSkills(openclawSkillsDir);
         if (skillsCopied > 0) {
             console.log(`\x1b[32m✓ Synced ${skillsCopied} builtin skills to ~/.openclaw/skills/\x1b[0m`);
         }
         frameworkLogger.log('openclaw-integration', 'skills-synced', 'info', { count: skillsCopied });
         mintAfterWear(targetDir);
-        const wired = wiring.wireOpenClawBridge(targetDir);
+        const wired = isolated
+            ? { count: 0, path: configPath, method: 'skipped-isolated-home' }
+            : wiring.wireOpenClawBridge(targetDir);
         console.log(`\x1b[32m✓ Wired OpenClaw MCP servers (${wired.count} via ${wired.method}) → ${wired.path}\x1b[0m`);
         console.log(`\x1b[32m✓ Consumer root → ${targetDir}\x1b[0m`);
         try {
@@ -57,8 +62,8 @@ async function installForOpenClaw(options = {}) {
             /* session-boot is best-effort */
         }
         const packageRoot = path.resolve(__dirname, '..', '..', '..');
-        const hookInstalled = wiring.installOpenClawHostWear(packageRoot);
-        const cliBackend = wiring.maybeWriteOpenClawCliBackend();
+        const hookInstalled = isolated ? null : wiring.installOpenClawHostWear(packageRoot);
+        const cliBackend = isolated ? false : wiring.maybeWriteOpenClawCliBackend();
         frameworkLogger.log('openclaw-integration', 'cli-backend', 'info', { written: cliBackend });
         if (hookInstalled) {
             console.log(`\x1b[32m✓ OpenClaw PreToolUse hook → ${hookInstalled}\x1b[0m`);

package/dist/integrations/grok/grok-cli.js

@@ -50,8 +50,18 @@ function registerGrokMcpServers(targetDir) {
 }
 export async function installForGrokCLI(options = {}) {
     frameworkLogger.log('grok-integration', 'install-start', 'info', { options });
+    const millSuit = requireCjs(path.join(packageRoot, 'scripts/foundry/mint-suit.cjs'));
     const home = process.env.HOME || process.env.USERPROFILE || '';
+    const machine = millSuit.machineHome();
     const targetPluginDir = path.join(home, '.grok/plugins/0xray');
+    if (millSuit.wouldClobberMachineGrok(targetPluginDir, process.env, machine)) {
+        frameworkLogger.log('grok-integration', 'refuse-machine-grok-clobber', 'error', {
+            home,
+            machineHome: machine,
+            targetPluginDir,
+        });
+        throw new Error('foundry-inspect: isolated HOME must not clobber ~/.grok/plugins/0xray');
+    }
     // Try to find the plugin source from the installed package
     const possibleSources = [
         path.join(__dirname, '..', '..', '..', 'src/integrations/grok/plugin/0xray'), // dev

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.4",
+  "version": "4.0.6",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",

package/scripts/foundry/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.1.8] - 2026-09-09
+
+Isolated HOME skips machine `~/.hermes` and `~/.openclaw` (passwd home, same gate as Grok). Inspect GETs a public consumer tarball (`@0xray/review-suit`). CLI `mint` runs inspect after overlay; postinstall does not. Not an 8th MCP. Not 5.0.
+
+## [0.1.7] - 2026-09-04
+
+Inspect is mill flesh: `npx @0xray/foundry inspect` runs diff, plant vs worn (mint fails costume dump), mill receipt, CI, GET the `.tgz` (HTTP 200), isolated HOME vs passwd home. Four project skill floors created on fasten (OpenCode, Grok, Hermes, OpenClaw). CI report is `.xray/foundry-ci-report.json`. Not an 8th MCP. Not 5.0.
+
 ## [0.1.6] - 2026-09-04
 
 Mill plant fastens an **inspect** suit: inspect AI work (diffs, traces, mill receipts, CI). Not empty. `mill` + `inspect` skills. Costume dump still opt-in.

package/scripts/foundry/README.md

@@ -23,6 +23,7 @@ npx @0xray/foundry release [patch|minor|major] --i-mean-it
 npx @0xray/foundry release --publish-only --dry-run
 npx @0xray/foundry release --publish-only --i-mean-it
 npx @0xray/foundry mint
+npx @0xray/foundry inspect [--skip-live]
 npx @0xray/foundry ci [--commit SHA] [--report]
 npx @0xray/foundry hooks
 ```
@@ -31,7 +32,7 @@ npx @0xray/foundry hooks
 
 `FOUNDRY_ROOT` overrides cwd (the repo being milled).
 
-`gate` is build + test + docs-check. `docs-build` runs Docusaurus on the 0xray exo (`docs-site/`); stranger mills skip. `ci` reports GitHub Actions (no auto-push). `hooks` installs git pre/post hooks. GitHub `0xRay CI/CD` is the mill gate on `main`. `Deploy Docs` is the mill Pages put.
+`gate` is build + test + docs-check. `docs-build` runs Docusaurus on the 0xray exo (`docs-site/`); stranger mills skip. `inspect` runs the six mill checks (diff, plant vs worn, receipt, CI, live tarball GET, isolated HOME). Mint fails on a costume dump. Isolated HOME skips machine `~/.grok`. `ci` reports GitHub Actions (no auto-push). `hooks` installs git pre/post hooks. GitHub `0xRay CI/CD` is the mill gate on `main`. `Deploy Docs` is the mill Pages put.
 
 `docs-check` and `gate` run **full** 0xRay corpus only when the milled `package.json` name is `0xray` and `docs-site/` exists. Otherwise **light**: `package.json` + CHANGELOG.
 
@@ -41,16 +42,16 @@ npx @0xray/foundry hooks
 
 After mill plant is fastened, overlay their plant (defaults; remap in `foundry.json` or `.xray/foundry.json`):
 
-| Facet | Default plant | Hanger |
+| Facet | Default plant | Worn |
 |---|---|---|
 | Constitution | `xray/codex.json` | `.xray/codex.json` |
 | Features / temperament | `xray/features.json` | `.xray/features.json` |
 | Config | `xray/config.json` | `.xray/config.json` |
-| Skills | `src/skills/<name>/SKILL.md` | `.opencode/skills/` and project `.grok/plugins/0xray/skills` if that dir exists |
-| Agents | `src/opencode/agents/*.yml` | `.opencode/agents/` (OpenCode hangar; other floors do not read mill YML agents) |
+| Skills | `src/skills/<name>/SKILL.md` | project `.opencode/skills`, `.grok/plugins/0xray/skills`, `.hermes/plugins/xray-hermes/skills`, `.openclaw/skills` (created on fasten; never machine home) |
+| Agents | `src/opencode/agents/*.yml` | `.opencode/agents/` (OpenCode wear dir; other floors do not read mill YML agents) |
 | Agents card | `xray/AGENTS.md` | `AGENTS.md` if mill-managed |
 
-**Mill-fill is law:** their keys/files win; mill names they did not plant stay unless they overlay the same name. JSON facets always merge. Skill overlay is project dirs only (`.opencode/skills`, project Grok plugin skills). CLI re-wear calls mint **once** after mill copies.
+**Mill-fill is law:** their keys/files win; mill names they did not plant stay unless they overlay the same name. JSON facets always merge. Skill overlay is project dirs on every TUI floor (OpenCode, Grok, Hermes, OpenClaw). YML agents stay OpenCode. CLI re-wear calls mint **once** after mill copies. Isolated HOME is passwd home, not `os.homedir()`. CI report is `.xray/foundry-ci-report.json` (`.opencode/logs` shim).
 
 **Default mill plant:** `mill` + `inspect` (inspect AI work). Fastens a suit, not an empty one. Not 45/42 costume. `foundry.json` `"costume": true` copies that dump. Factory Repertoire still enable-when-resolves. PPE stays worn.
 

package/scripts/foundry/ci-monitor.mjs

@@ -16,11 +16,15 @@ const commitIdx = args.indexOf("--commit");
 const shaArg = commitIdx >= 0 ? args[commitIdx + 1] : "";
 const sha = (shaArg && !shaArg.startsWith("-") ? shaArg : process.env.GITHUB_SHA || "").trim();
 const root = resolveMillRoot();
-const reportPath = path.join(root, ".opencode", "logs", "ci-cd-monitor-report.json");
+const millReportPath = path.join(root, ".xray", "foundry-ci-report.json");
+const shimReportPath = path.join(root, ".opencode", "logs", "ci-cd-monitor-report.json");
 
 function writeReport(report) {
-  fs.mkdirSync(path.dirname(reportPath), { recursive: true });
-  fs.writeFileSync(reportPath, `${JSON.stringify(report, null, 2)}\n`);
+  const body = `${JSON.stringify(report, null, 2)}\n`;
+  for (const reportPath of [millReportPath, shimReportPath]) {
+    fs.mkdirSync(path.dirname(reportPath), { recursive: true });
+    fs.writeFileSync(reportPath, body);
+  }
 }
 
 function emptyReport(status, reason) {

package/scripts/foundry/cli.mjs

@@ -2,7 +2,7 @@
 /**
  * @0xray/foundry CLI — mill, not exo. No fifth MCP.
  *
- *   npx @0xray/foundry <reconcile|stamp|gate|release|docs-check|docs-build|mint|ci|hooks> [...args]
+ *   npx @0xray/foundry <reconcile|stamp|gate|release|docs-check|docs-build|mint|inspect|ci|hooks> [...args]
  */
 
 import { spawnSync } from "node:child_process";
@@ -16,16 +16,18 @@ const COMMANDS = {
   "docs-check": { script: "validate-release-docs.mjs", preset: [] },
   "docs-build": { script: "docs-build.mjs", preset: [] },
   mint: { script: "mint.mjs", preset: [] },
+  inspect: { script: "inspect.mjs", preset: [] },
   ci: { script: "ci-monitor.mjs", preset: [] },
   hooks: { script: "hooks.mjs", preset: [] },
 };
 
 const HELP =
-  "Usage: npx @0xray/foundry <reconcile|stamp|gate|release|docs-check|docs-build|mint|ci|hooks> [...args]\n" +
+  "Usage: npx @0xray/foundry <reconcile|stamp|gate|release|docs-check|docs-build|mint|inspect|ci|hooks> [...args]\n" +
   "\n" +
   "Mill, not exo. FOUNDRY_ROOT overrides cwd (the repo being milled).\n" +
   "release bumps/commits/pushes/publishes the milled cwd — pass --dry-run or --i-mean-it (or FOUNDRY_RELEASE=1).\n" +
-  "Mint fastens mill plant then overlays their plant (mill-fill JSON). PPE stays worn.\n" +
+  "Mint fastens mill plant then overlays their plant (mill-fill JSON), then runs inspect. PPE stays worn.\n" +
+  "inspect runs the six mill checks (diff, plant vs worn, receipt, CI, live tarball GET, isolated HOME). Not an 8th MCP.\n" +
   "gate is build+test. docs-build is Docusaurus on the 0xray exo. ci reports GitHub Actions (no auto-push). hooks installs git pre/post hooks.\n";
 
 const cmd = process.argv[2];

package/scripts/foundry/inspect.mjs

@@ -0,0 +1,295 @@
+#!/usr/bin/env node
+/**
+ * Mill inspect organ. Runs the six checks. Not an 8th MCP. Not PPE.
+ *
+ *   npx @0xray/foundry inspect [--skip-live]
+ */
+
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { millPackageDir, resolveMillRoot } from "./mill-root.mjs";
+
+const require = createRequire(import.meta.url);
+const mint = require("./mint-suit.cjs");
+
+export function npmTarballUrl(name, version) {
+  if (typeof name !== "string" || !name || typeof version !== "string" || !version) return null;
+  if (name.startsWith("@")) {
+    const slash = name.indexOf("/");
+    if (slash < 1) return null;
+    const pkg = name.slice(slash + 1);
+    return `https://registry.npmjs.org/${name}/-/${pkg}-${version}.tgz`;
+  }
+  return `https://registry.npmjs.org/${name}/-/${name}-${version}.tgz`;
+}
+
+export function isIsolatedHome(env = process.env, machine = mint.machineHome()) {
+  return mint.isIsolatedHome(env, machine);
+}
+
+export function machineGrokPluginDir(machine = mint.machineHome()) {
+  return mint.machineGrokPluginDir(machine);
+}
+
+export function wouldClobberMachineGrok(
+  dest,
+  env = process.env,
+  machine = mint.machineHome(),
+) {
+  return mint.wouldClobberMachineGrok(dest, env, machine);
+}
+
+function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function checkDiff(root) {
+  const status = spawnSync("git", ["status", "-sb"], { cwd: root, encoding: "utf8" });
+  if (status.error || status.status === 128) {
+    return {
+      id: "diff",
+      ok: true,
+      skipped: true,
+      detail: status.stderr?.trim() || "not a git repo",
+    };
+  }
+  const diff = spawnSync("git", ["diff", "--stat"], { cwd: root, encoding: "utf8" });
+  return {
+    id: "diff",
+    ok: true,
+    status: (status.stdout || "").trim(),
+    diffStat: (diff.stdout || "").trim(),
+  };
+}
+
+function checkPlantVsWorn(root, millRoot) {
+  const plantDir = mint.millPlantDir(millRoot);
+  const millPlant = {
+    skills: plantDir ? mint.listSkillNamesAt(path.join(plantDir, "skills")) : [],
+    agents: plantDir ? mint.listAgentFilesAt(path.join(plantDir, "agents")) : [],
+  };
+  const params = mint.loadFoundryParams(root);
+  const tree = {
+    skills: mint.listConsumerSkillNames(root, params.skills),
+    agents: mint.listConsumerAgentFiles(root, params.agents),
+  };
+  try {
+    mint.assertNoCostumeDump(root, millPlant, tree);
+    return {
+      id: "plant-vs-worn",
+      ok: true,
+      millPlant: millPlant.skills,
+      tree: tree.skills,
+      worn: mint.wornSkillNames(root),
+    };
+  } catch (err) {
+    return {
+      id: "plant-vs-worn",
+      ok: false,
+      detail: err instanceof Error ? err.message : String(err),
+      extraSkills: err.extraSkills || [],
+      extraAgents: err.extraAgents || [],
+    };
+  }
+}
+
+function checkReceipt(root) {
+  const file = path.join(root, ".xray", "foundry-inventory.json");
+  if (mint.isDogfood(millPackageDir(), root)) {
+    return { id: "receipt", ok: true, skipped: true, detail: "dogfood / exo — no consumer inventory" };
+  }
+  const inventory = readJson(file);
+  if (!inventory) {
+    return { id: "receipt", ok: false, detail: "missing .xray/foundry-inventory.json" };
+  }
+  const millPlantSkills = inventory.millPlant?.skills || [];
+  const hasMill = millPlantSkills.includes("mill");
+  const hasInspect = millPlantSkills.includes("inspect");
+  const ok = hasMill && hasInspect;
+  return {
+    id: "receipt",
+    ok,
+    suit: inventory.suit,
+    mill: inventory.mill,
+    millPlant: millPlantSkills,
+    detail: ok ? null : "millPlant.skills must include mill and inspect",
+  };
+}
+
+function checkCi(root) {
+  const millPath = path.join(root, ".xray", "foundry-ci-report.json");
+  const shimPath = path.join(root, ".opencode", "logs", "ci-cd-monitor-report.json");
+  const report = readJson(millPath) || readJson(shimPath);
+  if (!report) {
+    return {
+      id: "ci",
+      ok: true,
+      skipped: true,
+      detail: "no mill ci report — run npx @0xray/foundry ci --report",
+    };
+  }
+  const status = String(report.ci_status || "");
+  if (status === "failure" || status === "unhealthy") {
+    return { id: "ci", ok: false, status, reason: report.reason || null };
+  }
+  return {
+    id: "ci",
+    ok: true,
+    skipped: status === "unknown",
+    status,
+    reason: report.reason || null,
+  };
+}
+
+export async function checkLivePut(packages, fetchFn = fetch) {
+  const results = [];
+  for (const pkg of packages) {
+    const url = npmTarballUrl(pkg.name, pkg.version);
+    if (!url) {
+      results.push({ name: pkg.name, version: pkg.version, ok: false, detail: "missing name/version" });
+      continue;
+    }
+    let status = 0;
+    try {
+      const head = await fetchFn(url, { method: "HEAD" });
+      status = head.status;
+      if (status === 405 || status === 501) {
+        const get = await fetchFn(url, { method: "GET" });
+        status = get.status;
+      }
+    } catch (err) {
+      results.push({
+        name: pkg.name,
+        version: pkg.version,
+        url,
+        ok: false,
+        detail: err instanceof Error ? err.message : String(err),
+      });
+      continue;
+    }
+    results.push({ name: pkg.name, version: pkg.version, url, status, ok: status === 200 });
+  }
+  return results;
+}
+
+export function packagesToProbe(root) {
+  const pkgs = [];
+  const inventory = readJson(path.join(root, ".xray", "foundry-inventory.json"));
+  if (inventory?.mill?.name && inventory?.mill?.version) {
+    pkgs.push({ name: inventory.mill.name, version: inventory.mill.version });
+  }
+  const worn = readJson(path.join(root, "node_modules", "0xray", "package.json"));
+  if (worn?.name && worn?.version) {
+    pkgs.push({ name: worn.name, version: worn.version });
+  }
+  const self = readJson(path.join(root, "package.json"));
+  if (self?.name === "0xray" && self?.version) {
+    pkgs.push({ name: "0xray", version: self.version });
+  }
+  if (
+    self &&
+    self.private !== true &&
+    inventory?.consumer?.name &&
+    inventory?.consumer?.version
+  ) {
+    pkgs.push({
+      name: inventory.consumer.name,
+      version: inventory.consumer.version,
+    });
+  }
+  const seen = new Set();
+  return pkgs.filter((p) => {
+    const key = `${p.name}@${p.version}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+
+function checkIsolatedHome(env = process.env, machine = mint.machineHome()) {
+  const isolated = isIsolatedHome(env, machine);
+  const machinePlugin = machineGrokPluginDir(machine);
+  const home = env.HOME || env.USERPROFILE || "";
+  const dest = home ? path.join(home, ".grok", "plugins", "0xray") : "";
+  const clobber = wouldClobberMachineGrok(dest, env, machine);
+  if (clobber) {
+    return {
+      id: "isolated-home",
+      ok: false,
+      isolated,
+      detail: `isolated HOME must not write ${machinePlugin}`,
+    };
+  }
+  return {
+    id: "isolated-home",
+    ok: true,
+    isolated,
+    machinePlugin,
+    dest: dest || null,
+  };
+}
+
+export async function inspectSuit(root, opts = {}) {
+  const millRoot = opts.millRoot || millPackageDir();
+  const fetchFn = opts.fetch || fetch;
+  const skipLive = Boolean(opts.skipLive);
+  const env = opts.env || process.env;
+  const machineHome = opts.machineHome || mint.machineHome();
+
+  const checks = [];
+  checks.push(checkDiff(root));
+  checks.push(checkPlantVsWorn(root, millRoot));
+  checks.push(checkReceipt(root));
+  checks.push(checkCi(root));
+
+  if (skipLive) {
+    checks.push({ id: "live-put", ok: true, skipped: true, detail: "--skip-live" });
+  } else {
+    const pkgs = packagesToProbe(root);
+    if (pkgs.length === 0) {
+      checks.push({
+        id: "live-put",
+        ok: true,
+        skipped: true,
+        detail: "no mill/0xray package identity to GET",
+      });
+    } else {
+      const puts = await checkLivePut(pkgs, fetchFn);
+      checks.push({
+        id: "live-put",
+        ok: puts.every((p) => p.ok),
+        packages: puts,
+      });
+    }
+  }
+
+  checks.push(checkIsolatedHome(env, machineHome));
+
+  const failed = checks.filter((c) => c.ok === false);
+  return {
+    ok: failed.length === 0,
+    failed: failed.map((c) => c.id),
+    checks,
+  };
+}
+
+async function main() {
+  const skipLive = process.argv.includes("--skip-live");
+  const root = resolveMillRoot();
+  const report = await inspectSuit(root, { skipLive });
+  process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+  process.exit(report.ok ? 0 : 1);
+}
+
+const isMain =
+  process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  main();
+}

package/scripts/foundry/mint-suit.cjs

@@ -7,6 +7,7 @@
  */
 
 const fs = require("fs");
+const os = require("os");
 const path = require("path");
 
 const DEFAULT_PARAMS = {
@@ -135,7 +136,7 @@ function listAgentFilesAt(agentsSrc) {
     .map((entry) => entry.name);
 }
 
-/** Mill mill-fill mill plant: mill mill mill mill-fill mill names they did not plant stay. */
+/** Fasten mill plant first. Mill names they did not plant stay; same-name overlay wins. */
 function fastenMillPlant(millPackageRoot, targetDir, log) {
   const plant = millPlantDir(millPackageRoot);
   if (!plant) return { skills: [], agents: [] };
@@ -180,12 +181,57 @@ function isDirectory(p) {
   }
 }
 
-/** Project skill dirs only (.opencode/skills, project Grok plugin skills). */
+/** Passwd home. `os.homedir()` follows $HOME and cannot detect last-mile isolation. */
+function machineHome() {
+  try {
+    const passwd = os.userInfo().homedir;
+    if (typeof passwd === "string" && passwd) return passwd;
+  } catch {
+    /* no passwd */
+  }
+  return os.homedir();
+}
+
+function processHome(env) {
+  const e = env || process.env;
+  return e.HOME || e.USERPROFILE || "";
+}
+
+function isIsolatedHome(env, machine) {
+  const home = processHome(env);
+  if (!home) return false;
+  const real = machine || machineHome();
+  try {
+    return path.resolve(home) !== path.resolve(real);
+  } catch {
+    return false;
+  }
+}
+
+function machineGrokPluginDir(machine) {
+  return path.join(machine || machineHome(), ".grok", "plugins", "0xray");
+}
+
+function wouldClobberMachineGrok(dest, env, machine) {
+  if (!dest) return false;
+  const realMachine = machine || machineHome();
+  if (!isIsolatedHome(env, realMachine)) return false;
+  const real = path.resolve(machineGrokPluginDir(realMachine));
+  const target = path.resolve(dest);
+  return target === real || target.startsWith(`${real}${path.sep}`);
+}
+
+/**
+ * Project skill dirs on every TUI floor. Create on fasten. Never machine home.
+ * YML agents stay OpenCode (`.opencode/agents`).
+ */
 function listProjectSkillDirs(targetDir) {
-  const dests = [path.join(targetDir, ".opencode", "skills")];
-  const projectGrok = path.join(targetDir, ".grok", "plugins", "0xray", "skills");
-  if (isDirectory(projectGrok)) dests.push(projectGrok);
-  return dests;
+  return [
+    path.join(targetDir, ".opencode", "skills"),
+    path.join(targetDir, ".grok", "plugins", "0xray", "skills"),
+    path.join(targetDir, ".hermes", "plugins", "xray-hermes", "skills"),
+    path.join(targetDir, ".openclaw", "skills"),
+  ];
 }
 
 function overlayJsonFacet(src, dest) {
@@ -238,6 +284,69 @@ function overlayAgentsCard(targetDir, params) {
   return true;
 }
 
+function wornSkillNames(targetDir) {
+  const names = new Set();
+  for (const dir of listProjectSkillDirs(targetDir)) {
+    for (const name of listSkillNamesAt(dir)) names.add(name);
+  }
+  return [...names];
+}
+
+function wornAgentFiles(targetDir) {
+  return listAgentFilesAt(path.join(targetDir, ".opencode", "agents"));
+}
+
+function previousTreeAllowlist(targetDir) {
+  const file = path.join(targetDir, ".xray", "foundry-inventory.json");
+  if (!fs.existsSync(file)) return { skills: [], agents: [] };
+  try {
+    const inventory = JSON.parse(fs.readFileSync(file, "utf8"));
+    return {
+      skills: Array.isArray(inventory?.tree?.skills) ? inventory.tree.skills : [],
+      agents: Array.isArray(inventory?.tree?.agents) ? inventory.tree.agents : [],
+    };
+  } catch {
+    return { skills: [], agents: [] };
+  }
+}
+
+/** Extra worn names that are neither mill plant, their plant, nor a prior overlay. */
+function costumeDumpExtras(targetDir, millPlant, tree) {
+  const prior = previousTreeAllowlist(targetDir);
+  const allowedSkills = new Set([
+    ...(Array.isArray(millPlant?.skills) ? millPlant.skills : []),
+    ...(Array.isArray(tree?.skills) ? tree.skills : []),
+    ...prior.skills,
+  ]);
+  const allowedAgents = new Set([
+    ...(Array.isArray(millPlant?.agents) ? millPlant.agents : []),
+    ...(Array.isArray(tree?.agents) ? tree.agents : []),
+    ...prior.agents,
+  ]);
+  return {
+    extraSkills: wornSkillNames(targetDir).filter((name) => !allowedSkills.has(name)),
+    extraAgents: wornAgentFiles(targetDir).filter((name) => !allowedAgents.has(name)),
+  };
+}
+
+function assertNoCostumeDump(targetDir, millPlant, tree) {
+  if (wantsCostume(targetDir)) {
+    return { ok: true, extraSkills: [], extraAgents: [] };
+  }
+  const extras = costumeDumpExtras(targetDir, millPlant, tree);
+  if (extras.extraSkills.length > 0 || extras.extraAgents.length > 0) {
+    const listed = [...extras.extraSkills, ...extras.extraAgents].join(", ");
+    const err = new Error(
+      `foundry-inspect: costume dump without foundry.json "costume": true (${listed})`,
+    );
+    err.code = "FOUNDRY_COSTUME_DUMP";
+    err.extraSkills = extras.extraSkills;
+    err.extraAgents = extras.extraAgents;
+    throw err;
+  }
+  return { ok: true, extraSkills: [], extraAgents: [] };
+}
+
 function overlayConsumerTree(targetDir, log, params) {
   const resolved = params || loadFoundryParams(targetDir);
   const skillsRel = resolved.skills;
@@ -365,6 +474,7 @@ function mintConsumerSuit(millPackageRoot, targetDir, log) {
     path.join(targetDir, ".xray", "config.json"),
   );
   tree.agentsCard = overlayAgentsCard(targetDir, params);
+  assertNoCostumeDump(targetDir, millPlant, tree);
   if (log && (tree.codex || tree.features || tree.config)) {
     log("foundry-mint", "Overlaid consumer suit facets onto .xray", "info", {
       constitution: tree.codex,
@@ -382,6 +492,8 @@ module.exports = {
   loadFoundryExtra,
   wantsCostume,
   millPlantDir,
+  listSkillNamesAt,
+  listAgentFilesAt,
   fastenMillPlant,
   resolveInside,
   overlayJsonFacet,
@@ -394,4 +506,13 @@ module.exports = {
   mintConsumerSuit,
   isDogfood,
   readPackageIdentity,
+  wornSkillNames,
+  wornAgentFiles,
+  costumeDumpExtras,
+  assertNoCostumeDump,
+  machineHome,
+  processHome,
+  isIsolatedHome,
+  machineGrokPluginDir,
+  wouldClobberMachineGrok,
 };

package/scripts/foundry/mint.mjs

@@ -8,21 +8,32 @@ import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { millPackageDir, resolveMillRoot } from "./mill-root.mjs";
+import { inspectSuit } from "./inspect.mjs";
 
 const require = createRequire(import.meta.url);
 const { mintConsumerSuit } = require("./mint-suit.cjs");
 
-function main() {
+async function main() {
   const target = resolveMillRoot();
   const millRoot = millPackageDir();
-  const inventory = mintConsumerSuit(millRoot, target, (component, action, status) => {
-    process.stdout.write(`${component} ${action} ${status}\n`);
-  });
+  const skipLive = process.argv.includes("--skip-live");
+  let inventory;
+  try {
+    inventory = mintConsumerSuit(millRoot, target, (component, action, status) => {
+      process.stdout.write(`${component} ${action} ${status}\n`);
+    });
+  } catch (err) {
+    process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+    process.exit(1);
+  }
   if (inventory.skipped) {
     process.stderr.write("mint: skipped dogfood / 0xray exo plant (not a consumer project)\n");
     process.exit(0);
   }
   process.stdout.write(`${JSON.stringify(inventory, null, 2)}\n`);
+  const report = await inspectSuit(target, { millRoot, skipLive });
+  process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+  if (!report.ok) process.exit(1);
 }
 
 const isMain =

package/scripts/foundry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0xray/foundry",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "private": false,
   "type": "module",
   "description": "0xRay mill: mint their suit params, stamp, gate, publish, CI report, git hooks. Not the worn exo.",
@@ -37,6 +37,7 @@
     "./release-gate": "./release-gate.mjs",
     "./mill-root": "./mill-root.mjs",
     "./mint-suit": "./mint-suit.cjs",
+    "./inspect": "./inspect.mjs",
     "./ci-monitor": "./ci-monitor.mjs",
     "./hooks": "./hooks.mjs",
     "./docs-build": "./docs-build.mjs"

package/scripts/foundry/plant/agents/inspect.yml

@@ -1,5 +1,5 @@
 name: inspect
 skill: inspect
 description: "Inspect AI work: diffs, traces, mill receipts, CI. Fastened mill plant."
-version: "0.1.6"
+version: "0.1.8"
 mode: subagent

package/scripts/foundry/plant/agents/mill.yml

@@ -1,5 +1,5 @@
 name: mill
 skill: mill
-description: "Mill mill-fill mill plant. Their plant is the suit. Factory Repertoire."
-version: "0.1.6"
+description: "Fasten their plant as the suit. Factory Repertoire. Inspect is the mill discipline."
+version: "0.1.8"
 mode: subagent

package/scripts/foundry/plant/skills/inspect/SKILL.md

@@ -7,16 +7,16 @@ description: Inspect AI work — diffs, tool traces, mill receipts, CI. Factory
 
 This mill **fastens** a suit for **inspecting AI work**. Not an empty suit. Not a copy of 0xRay's 45/42 costume.
 
-Use this when an agent (or a mill) just wrote, minted, or shipped something. Read the work. Do not trust the receipt until you have opened the files.
+Mill **does** these checks (`npx @0xray/foundry inspect`). Mint fails on a costume dump. Live PUT GETs the `.tgz`. Isolated HOME refuses `~/.grok/plugins/0xray`. Not an 8th MCP.
 
-## What to inspect
+## What mill inspects
 
-1. **Diff.** What actually changed. Ignore the agent's summary if the diff disagrees.
-2. **Plant vs worn.** `src/skills`, `src/opencode/agents`, `xray/*.json` vs `.opencode/skills`, `.opencode/agents`, `.xray/`. Same name: plant should win. Costume dump (45 skills / 42 agents they did not plant) is a fail unless `foundry.json` has `"costume": true`.
-3. **Mill receipt.** `.xray/foundry-inventory.json` — mill name/version, `suit` (`fastened` / `overlay` / `costume`), `millPlant.skills` should include `mill` and `inspect`.
-4. **CI.** GitHub mill CI and mill-monitor report, not just a green check in chat.
-5. **Live PUT.** `npm view <pkg> version` and HTTP 200 on the `.tgz`. Metadata without a tarball is not shipped.
-6. **Machine hangar.** Isolated HOME last-mile must not clobber `~/.grok/plugins/0xray`.
+1. **Diff.** `git status` / `git diff --stat` of the milled cwd. Ignore the agent's summary if the diff disagrees.
+2. **Plant vs worn.** `src/skills`, `src/opencode/agents` vs `.opencode/skills`, `.opencode/agents`. Same name: plant wins. Costume dump (worn names they did not plant and mill did not fasten) fails mint unless `foundry.json` has `"costume": true`.
+3. **Mill receipt.** `.xray/foundry-inventory.json` — mill name/version, `suit` (`fastened` / `overlay` / `costume`), `millPlant.skills` must include `mill` and `inspect`.
+4. **CI.** GitHub mill CI report (`.opencode/logs/ci-cd-monitor-report.json`), not a green check in chat. No token is a skip, not a pass invented.
+5. **Live PUT.** HTTP 200 on the npm `.tgz`. Metadata without a tarball is not shipped.
+6. **Isolated HOME.** Last-mile must not clobber `~/.grok/plugins/0xray`. Mill compares `$HOME` to the passwd home (`os.userInfo().homedir`), not `os.homedir()` (which follows `$HOME`).
 
 ## How to work
 
@@ -27,5 +27,8 @@ Use this when an agent (or a mill) just wrote, minted, or shipped something. Rea
 
 ```bash
 npx @0xray/foundry mint
+npx @0xray/foundry inspect
 npx @0xray/foundry ci --report
 ```
+
+CLI `mint` runs inspect after overlay (exit 1 if inspect fails). Postinstall mint does not; `--skip-live` skips the tarball GET. Chat is not a receipt.

package/scripts/node/bridge-mcp-wiring.cjs

@@ -222,13 +222,21 @@ function isEphemeralInstallRoot(targetDir) {
   return /\/T\/|\/tmp\/|\/var\/folders\/|\/Temp\//i.test(normalized);
 }
 
+const millSuit = require("../foundry/mint-suit.cjs");
+
+/** Last-mile isolated HOME vs passwd home. `os.homedir()` follows $HOME. */
+function isIsolatedHome(env = process.env, machine = millSuit.machineHome()) {
+  return millSuit.isIsolatedHome(env, machine);
+}
+
 function copyHermesHookRuntimes(packageRoot) {
+  if (millSuit.isIsolatedHome()) return false;
   const hooksSrc = [
     path.join(packageRoot, "dist", "integrations", "hooks"),
     path.join(packageRoot, "src", "integrations", "hooks"),
   ].find((p) => fs.existsSync(p));
   if (!hooksSrc) return false;
-  const hooksDst = path.join(os.homedir(), ".hermes", "plugins", "hooks");
+  const hooksDst = path.join(millSuit.machineHome(), ".hermes", "plugins", "hooks");
   fs.mkdirSync(hooksDst, { recursive: true });
   fs.cpSync(hooksSrc, hooksDst, { recursive: true, force: true });
   return true;
@@ -421,10 +429,11 @@ function resolveOpenClawPluginDir(packageRoot) {
 }
 
 function installOpenClawHostWear(packageRoot) {
+  if (millSuit.isIsolatedHome()) return null;
   const source = resolveOpenClawPreToolHookSource(packageRoot);
   if (!source) return null;
 
-  const hookDir = path.join(os.homedir(), ".openclaw", "hooks");
+  const hookDir = path.join(millSuit.machineHome(), ".openclaw", "hooks");
   fs.mkdirSync(hookDir, { recursive: true });
   const dest = path.join(hookDir, "xray-pre-tool.mjs");
   fs.copyFileSync(source, dest);
@@ -560,6 +569,7 @@ module.exports = {
   isDefaultMemoryRoutingOff,
   enableMemoryRoutingIfResolves,
   isEphemeralInstallRoot,
+  isIsolatedHome,
   copyHermesHookRuntimes,
   resolveOpenClawPreToolHookSource,
   resolveOpenClawPluginDir,

package/scripts/node/install-bridges.cjs

@@ -8,7 +8,7 @@ const fs = require("fs");
 const path = require("path");
 const os = require("os");
 const { execSync } = require("child_process");
-const { wantsCostume } = require("../foundry/mint-suit.cjs");
+const { wantsCostume, isIsolatedHome, machineHome } = require("../foundry/mint-suit.cjs");
 const {
   wireHermesBridge,
   wireOpencodeBridge,
@@ -375,18 +375,25 @@ function installGrokBridge(targetDir, packageRoot, log) {
     return;
   }
 
-  const home = os.homedir();
+  const machine = machineHome();
   const ephemeral = isEphemeralInstallRoot(targetDir);
+  const isolated = isIsolatedHome();
   const targets = [path.join(targetDir, ".grok", "plugins", "0xray")];
-  if (!ephemeral) {
-    targets.push(path.join(home, ".grok", "plugins", "0xray"));
+  if (!ephemeral && !isolated) {
+    targets.push(path.join(machine, ".grok", "plugins", "0xray"));
   } else {
-    log("grok-bridge", "skip machine ~/.grok plugin — ephemeral consumer", "info");
+    log(
+      "grok-bridge",
+      isolated
+        ? "skip machine ~/.grok plugin — isolated HOME"
+        : "skip machine ~/.grok plugin — ephemeral consumer",
+      "info",
+    );
   }
 
   for (const dest of targets) {
     if (copyPluginDir(sourceDir, dest)) {
-      const rel = dest.startsWith(home) ? dest.replace(home, "~") : path.relative(targetDir, dest);
+      const rel = dest.startsWith(machine) ? dest.replace(machine, "~") : path.relative(targetDir, dest);
       log("grok-bridge", "plugin copied", "info", { path: rel || dest });
       writePluginMcpJson(dest, targetDir, log, "grok-bridge");
       patchGrokHooks(dest, packageRoot, targetDir, log, "grok-bridge");
@@ -395,8 +402,8 @@ function installGrokBridge(targetDir, packageRoot, log) {
     }
   }
 
-  if (!ephemeral) {
-    const grokGlobalSkills = path.join(home, ".grok", "skills");
+  if (!ephemeral && !isolated) {
+    const grokGlobalSkills = path.join(machine, ".grok", "skills");
     const globalCopied = syncCostumeSkills(grokGlobalSkills, packageRoot, targetDir);
     if (globalCopied > 0) {
       log("grok-bridge", `global skills synced (${globalCopied})`, "info", { path: "~/.grok/skills/" });
@@ -416,7 +423,16 @@ function installHermesBridge(targetDir, packageRoot, log) {
     return;
   }
 
-  const targetPluginDir = path.join(os.homedir(), ".hermes", "plugins", "xray-hermes");
+  const ephemeral = isEphemeralInstallRoot(targetDir);
+  const isolated = isIsolatedHome();
+  const machine = machineHome();
+  const targetPluginDir =
+    ephemeral || isolated
+      ? path.join(targetDir, ".hermes", "plugins", "xray-hermes")
+      : path.join(machine, ".hermes", "plugins", "xray-hermes");
+  if (isolated) {
+    log("hermes-bridge", "skip machine ~/.hermes plugin — isolated HOME", "info");
+  }
   fs.mkdirSync(targetPluginDir, { recursive: true });
   for (const entry of fs.readdirSync(sourceDir)) {
     const src = path.join(sourceDir, entry);
@@ -428,10 +444,15 @@ function installHermesBridge(targetDir, packageRoot, log) {
     }
   }
   copyHermesFindProjectRootHelper(packageRoot, targetPluginDir);
-  if (copyHermesHookRuntimes(packageRoot)) {
+  if (!ephemeral && !isolated && copyHermesHookRuntimes(packageRoot)) {
     log("hermes-bridge", "hook runtimes copied", "info", { path: "~/.hermes/plugins/hooks" });
   }
-  log("hermes-bridge", "plugin copied", "info", { path: "~/.hermes/plugins/xray-hermes" });
+  log(
+    "hermes-bridge",
+    "plugin copied",
+    "info",
+    { path: ephemeral || isolated ? path.relative(targetDir, targetPluginDir) : "~/.hermes/plugins/xray-hermes" },
+  );
 
   writePluginMcpJson(targetPluginDir, targetDir, log, "hermes-bridge");
 
@@ -446,11 +467,13 @@ function installHermesBridge(targetDir, packageRoot, log) {
     log("hermes-bridge", "skip machine consumer marker — ephemeral consumer", "info");
   }
 
-  try {
-    const result = wireHermesBridge(targetDir);
-    log("hermes-bridge", `mcp_servers wired (${result.count} servers)`, "info");
-  } catch (e) {
-    log("hermes-bridge", "mcp_servers wire failed", "warn", { error: e.message });
+  if (!ephemeral && !isolated) {
+    try {
+      const result = wireHermesBridge(targetDir);
+      log("hermes-bridge", `mcp_servers wired (${result.count} servers)`, "info");
+    } catch (e) {
+      log("hermes-bridge", "mcp_servers wire failed", "warn", { error: e.message });
+    }
   }
 }
 
@@ -487,26 +510,52 @@ function installOpenclawBridge(targetDir, packageRoot, log) {
     log("openclaw-bridge", "config created", "info", { path: ".xray/config/openclaw.json" });
   }
 
-  const copied = syncCostumeSkills(path.join(os.homedir(), ".openclaw", "skills"), packageRoot, targetDir);
-  if (copied > 0) log("openclaw-bridge", `skills synced (${copied})`, "info", { path: "~/.openclaw/skills/" });
+  const ephemeralOpenclaw = isEphemeralInstallRoot(targetDir);
+  const isolatedOpenclaw = isIsolatedHome();
+  if (!ephemeralOpenclaw && !isolatedOpenclaw) {
+    const copied = syncCostumeSkills(
+      path.join(machineHome(), ".openclaw", "skills"),
+      packageRoot,
+      targetDir,
+    );
+    if (copied > 0) {
+      log("openclaw-bridge", `skills synced (${copied})`, "info", { path: "~/.openclaw/skills/" });
+    }
+  } else {
+    log(
+      "openclaw-bridge",
+      isolatedOpenclaw
+        ? "skip machine ~/.openclaw skills — isolated HOME"
+        : "skip machine ~/.openclaw skills — ephemeral consumer",
+      "info",
+    );
+  }
 
-  try {
-    const result = wireOpenClawBridge(targetDir);
-    log("openclaw-bridge", `openclaw.json mcp wired (${result.count} servers)`, "info", {
-      method: result.method,
-    });
-  } catch (e) {
-    log("openclaw-bridge", "openclaw.json mcp wire failed", "warn", { error: e.message });
+  if (!ephemeralOpenclaw && !isolatedOpenclaw) {
+    try {
+      const result = wireOpenClawBridge(targetDir);
+      log("openclaw-bridge", `openclaw.json mcp wired (${result.count} servers)`, "info", {
+        method: result.method,
+      });
+    } catch (e) {
+      log("openclaw-bridge", "openclaw.json mcp wire failed", "warn", { error: e.message });
+    }
   }
 
-  if (!isEphemeralInstallRoot(targetDir)) {
+  if (!ephemeralOpenclaw && !isolatedOpenclaw) {
     const hook = installOpenClawHostWear(packageRoot);
     if (hook) log("openclaw-bridge", "PreToolUse hook installed", "info", { path: hook });
     if (maybeWriteOpenClawCliBackend()) {
       log("openclaw-bridge", "opencode-cli backend written", "info");
     }
   } else {
-    log("openclaw-bridge", "skip machine PreToolUse wear — ephemeral consumer", "info");
+    log(
+      "openclaw-bridge",
+      isolatedOpenclaw
+        ? "skip machine PreToolUse wear — isolated HOME"
+        : "skip machine PreToolUse wear — ephemeral consumer",
+      "info",
+    );
   }
 }
 
@@ -706,5 +755,6 @@ module.exports = {
   grokHookShellCommand,
   writeGrokDiscoveredHooks,
   isEphemeralInstallRoot,
+  isIsolatedHome,
   installFrameworkDogfoodWear,
 };

package/xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.4",
+  "version": "4.0.1",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",