0xray 4.0.40 → 4.0.41

package/.opencode/commands/sisyphus-validation.md

@@ -0,0 +1,128 @@
+#!/bin/bash
+
+# xray - Sisyphus Orchestrator Validation
+
+# Tests async multi-agent coordination capabilities
+
+echo "🎭 xray - Sisyphus Orchestrator Validation"
+echo "==================================================================="
+
+# Initialize orchestration test
+
+AGENTS=("enforcer" "architect" "code-reviewer" "testing-lead" "security-auditor")
+COORDINATION_SUCCESS=true
+TASK_RESULTS=()
+
+echo "🔄 Testing async multi-agent coordination..."
+
+# Simulate task distribution (mock orchestration)
+
+for agent in "${AGENTS[@]}"; do
+echo "📤 Coordinating with ${agent} agent..."
+
+    # Check if agent configuration exists
+    if [ -f ".opencode/agents/${agent}.md" ]; then
+        echo "✅ ${agent} agent available for coordination"
+        TASK_RESULTS+=("${agent}:coordination_successful")
+    else
+        echo "❌ ${agent} agent configuration missing"
+        TASK_RESULTS+=("${agent}:coordination_failed")
+        COORDINATION_SUCCESS=false
+    fi
+
+    # Simulate async processing delay
+    sleep 0.1
+
+done
+
+echo ""
+echo "🔗 Testing workflow pattern coordination..."
+
+# Test complex workflow patterns
+
+WORKFLOW_PATTERNS=("complex-refactor" "security-audit" "new-feature" "bug-fix")
+for pattern in "${WORKFLOW_PATTERNS[@]}"; do
+echo "🔄 Coordinating ${pattern} workflow..."
+
+    case $pattern in
+        "complex-refactor")
+            REQUIRED_AGENTS=("architect" "refactorer" "testing-lead")
+            ;;
+        "security-audit")
+            REQUIRED_AGENTS=("security-auditor" "enforcer" "code-reviewer")
+            ;;
+        "new-feature")
+            REQUIRED_AGENTS=("architect" "code-reviewer" "testing-lead")
+            ;;
+        "bug-fix")
+            REQUIRED_AGENTS=("bug-triage-specialist" "code-reviewer" "testing-lead")
+            ;;
+    esac
+
+    WORKFLOW_SUCCESS=true
+    for agent in "${REQUIRED_AGENTS[@]}"; do
+        if [ ! -f ".opencode/agents/${agent}.md" ]; then
+            WORKFLOW_SUCCESS=false
+            break
+        fi
+    done
+
+    if [ "$WORKFLOW_SUCCESS" = true ]; then
+        echo "✅ ${pattern} workflow coordination successful"
+        TASK_RESULTS+=("${pattern}_workflow:successful")
+    else
+        echo "❌ ${pattern} workflow coordination failed"
+        TASK_RESULTS+=("${pattern}_workflow:failed")
+        COORDINATION_SUCCESS=false
+    fi
+
+done
+
+echo ""
+echo "📊 MCP Knowledge Skills Integration..."
+
+# Test MCP knowledge skills integration
+
+MCP_SKILLS=("project-analysis" "testing-strategy" "architecture-patterns" "performance-optimization" "git-workflow" "api-design")
+for skill in "${MCP_SKILLS[@]}"; do
+    if [ -f ".opencode/mcps/${skill}.mcp.json" ]; then
+echo "✅ MCP skill integrated: ${skill}"
+        TASK_RESULTS+=("${skill}\_mcp:integrated")
+else
+echo "❌ MCP skill missing: ${skill}"
+        TASK_RESULTS+=("${skill}\_mcp:missing")
+COORDINATION_SUCCESS=false
+fi
+done
+
+echo ""
+echo "🎭 SISYPHUS ORCHESTRATION REPORT"
+echo "==============================="
+
+if [ "$COORDINATION_SUCCESS" = true ]; then
+echo "✅ ASYNC SUBAGENT ORCHESTRATION SUCCESSFUL"
+echo "All agents and workflows properly coordinated"
+else
+echo "❌ ORCHESTRATION ISSUES DETECTED"
+echo ""
+echo "Coordination failures:"
+for result in "${TASK_RESULTS[@]}"; do
+if [[$result == _":failed"_]] || [[$result == *":missing"*]]; then
+echo " - 🔴 $result"
+fi
+done
+echo ""
+echo "Orchestration requires attention"
+exit 1
+fi
+
+echo ""
+echo "📈 Coordination Statistics:"
+echo " - Agents coordinated: ${#AGENTS[@]}"
+echo " - Workflow patterns: ${#WORKFLOW_PATTERNS[@]}"
+echo " - MCP skills integrated: ${#MCP_SKILLS[@]}"
+echo " - Total coordination points: $((${#AGENTS[@]} + ${#WORKFLOW_PATTERNS[@]} + ${#MCP_SKILLS[@]}))"
+
+echo ""
+echo "🎭 xray: SISYPHUS OPERATIONAL"
+echo "Async multi-agent orchestration validated"

package/.opencode/commands/summary-logger.md

@@ -0,0 +1,83 @@
+# xray - Summary Logger
+
+# Automatically logs AI-generated summaries and analysis to REFACTORING_LOG.md
+
+# 🚨 CRITICAL RULE: REFACTORING LOG IS APPEND-ONLY 🚨
+
+#
+
+# The REFACTORING_LOG.md file serves as an immutable audit trail of the project's evolution.
+
+# This file must NEVER be edited or modified after creation - only NEW entries may be appended.
+
+#
+
+# ❌ NEVER edit existing entries
+
+# ❌ NEVER delete entries
+
+# ❌ NEVER reorder entries
+
+# ❌ NEVER modify timestamps or content
+
+#
+
+# ✅ ONLY append new entries to the end
+
+# ✅ ONLY add new information, never change old information
+
+# ✅ ONLY use this automated logging system for consistency
+
+#
+
+# This ensures the refactoring log remains a reliable, immutable record of all changes.
+
+# If you need to correct information, append a new entry documenting the correction.
+
+#
+
+# 🚨 VIOLATION OF THIS RULE WILL BREAK THE PROJECT'S HISTORICAL RECORD 🚨
+
+echo "📝 xray - Summary Logger" >&2
+echo "====================================" >&2
+
+# Get script directory and project root
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+REFACTORING_LOG="${PROJECT_ROOT}/docs/REFACTORING_LOG.md"
+
+# Check if summary content is provided via environment variable or stdin (XRAY_ primary)
+
+if [ -n "$XRAY_SUMMARY_CONTENT" ]; then
+SUMMARY_CONTENT="$XRAY_SUMMARY_CONTENT"
+elif [ -n "$XRAY_SUMMARY_CONTENT" ]; then
+SUMMARY_CONTENT="$XRAY_SUMMARY_CONTENT"
+elif [ ! -t 0 ]; then
+    # Read from stdin
+    SUMMARY_CONTENT=$(cat)
+else
+echo "❌ No summary content provided. Use XRAY_SUMMARY_CONTENT environment variable or pipe content."
+echo "Usage:"
+echo " export XRAY_SUMMARY_CONTENT='summary content' && bash .opencode/commands/summary-logger.md"
+echo " echo 'summary content' | bash .opencode/commands/summary-logger.md"
+exit 1
+fi
+
+# Validate REFACTORING_LOG.md exists
+
+if [ ! -f "$REFACTORING_LOG" ]; then
+echo "❌ $REFACTORING_LOG not found"
+exit 1
+fi
+
+# Generate timestamp
+
+TIMESTAMP=$(date '+%B %Y')
+
+# Log raw content directly without wrapper
+
+echo "$SUMMARY_CONTENT" >> "$REFACTORING_LOG"
+
+echo "✅ Summary successfully logged to docs/REFACTORING_LOG.md"
+echo "📊 Entry added with timestamp: $(date '+%Y-%m-%d %H:%M:%S')"

package/.opencode/enforcer-config.json

@@ -0,0 +1,282 @@
+{
+  "description": "Codex-compliant framework configuration",
+  "thresholds": {
+    "bundleSize": {
+      "maxSize": "3MB",
+      "warningThreshold": "2.5MB",
+      "criticalThreshold": "3MB",
+      "optimizationTarget": "2.5MB"
+    },
+    "testCoverage": {
+      "minPercentage": 10,
+      "targetPercentage": 50,
+      "criticalThreshold": 5,
+      "progressiveTarget": 25
+    },
+    "codeDuplication": {
+      "maxPercentage": 5,
+      "warningThreshold": 3,
+      "criticalThreshold": 7
+    },
+    "componentSize": {
+      "maxLines": 300,
+      "warningThreshold": 200,
+      "criticalThreshold": 400
+    },
+    "hookComplexity": {
+      "maxResponsibilities": 3,
+      "warningThreshold": 2
+    },
+    "circularDependencies": {
+      "maxAllowed": 0,
+      "warningThreshold": 1
+    },
+    "typeSafety": {
+      "strictMode": false,
+      "anyTypeLimit": 10,
+      "unknownTypeLimit": 5
+    },
+    "security": {
+      "vulnerabilityLevel": "moderate",
+      "maxOutdatedPackages": 10,
+      "requireHttps": true
+    },
+    "automation": {
+      "hooks": {
+        "preCommit": [
+          "pre-commit-introspection"
+        ],
+        "postCommit": [
+          "auto-format"
+        ],
+        "daily": [
+          "enforcer-daily-scan"
+        ],
+        "security": [
+          "security-scan"
+        ],
+        "deployment": [
+          "post-deployment-audit"
+        ]
+      },
+      "workflows": {
+        "ci": [
+          "lint",
+          "typecheck",
+          "test",
+          "security-scan"
+        ],
+        "cd": [
+          "build",
+          "post-deployment-audit"
+        ],
+        "daily": [
+          "enforcer-daily-scan",
+          "security-scan"
+        ]
+      }
+    },
+    "agents": {
+      "enforcer": {
+        "capabilities": [
+          "compliance-monitoring",
+          "threshold-enforcement",
+          "automation-orchestration"
+        ],
+        "triggers": [
+          "file-changes",
+          "schedule",
+          "deployment"
+        ]
+      },
+      "architect": {
+        "capabilities": [
+          "design-review",
+          "architecture-validation",
+          "dependency-analysis"
+        ],
+        "triggers": [
+          "code-reviews",
+          "new-features"
+        ]
+      },
+      "orchestrator": {
+        "capabilities": [
+          "task-coordination",
+          "multi-agent-orchestration",
+          "workflow-management"
+        ],
+        "triggers": [
+          "complex-tasks",
+          "integration-events"
+        ]
+      },
+      "bug-triage-specialist": {
+        "capabilities": [
+          "error-analysis",
+          "root-cause-identification",
+          "fix-suggestions"
+        ],
+        "triggers": [
+          "test-failures",
+          "error-reports"
+        ]
+      },
+      "code-reviewer": {
+        "capabilities": [
+          "code-quality-assessment",
+          "best-practice-validation",
+          "security-review"
+        ],
+        "triggers": [
+          "pull-requests",
+          "code-commits"
+        ]
+      },
+      "refactorer": {
+        "capabilities": [
+          "code-modernization",
+          "debt-reduction",
+          "consolidation"
+        ],
+        "triggers": [
+          "legacy-code-detection",
+          "complexity-alerts"
+        ]
+      },
+      "security-auditor": {
+        "capabilities": [
+          "vulnerability-detection",
+          "threat-analysis",
+          "security-validation"
+        ],
+        "triggers": [
+          "security-scans",
+          "dependency-updates"
+        ]
+      },
+      "testing-lead": {
+        "capabilities": [
+          "test-strategy-design",
+          "coverage-optimization",
+          "behavioral-testing"
+        ],
+        "triggers": [
+          "new-features",
+          "code-changes"
+        ]
+      }
+    },
+    "mcps": {
+      "project-analysis": {
+        "description": "Codebase structure and pattern analysis",
+        "capabilities": [
+          "structure-mapping",
+          "pattern-recognition",
+          "complexity-analysis"
+        ]
+      },
+      "testing-strategy": {
+        "description": "Test approach planning and coverage optimization",
+        "capabilities": [
+          "test-planning",
+          "coverage-analysis",
+          "quality-assessment"
+        ]
+      },
+      "architecture-patterns": {
+        "description": "System design guidance and pattern validation",
+        "capabilities": [
+          "design-review",
+          "pattern-matching",
+          "architecture-validation"
+        ]
+      },
+      "performance-optimization": {
+        "description": "Speed and bottleneck identification",
+        "capabilities": [
+          "performance-analysis",
+          "bottleneck-detection",
+          "optimization-suggestions"
+        ]
+      },
+      "git-workflow": {
+        "description": "Version control best practices and workflow optimization",
+        "capabilities": [
+          "commit-analysis",
+          "branch-strategy",
+          "merge-conflict-resolution"
+        ]
+      },
+      "api-design": {
+        "description": "REST/GraphQL patterns and standards validation",
+        "capabilities": [
+          "api-review",
+          "standard-compliance",
+          "endpoint-validation"
+        ]
+      }
+    },
+    "codex": {
+      "terms": [
+        1,
+        2,
+        3,
+        4,
+        5,
+        6,
+        7,
+        8,
+        9,
+        10,
+        15,
+        24,
+        29,
+        32,
+        38,
+        42,
+        43
+      ],
+      "principles": [
+        "progressive-prod-ready-code",
+        "no-patches-boiler-stubs",
+        "surgical-fixes-only",
+        "incremental-phases-with-tracking",
+        "resolve-all-errors",
+        "prevent-infinite-loops",
+        "single-source-of-truth",
+        "batched-introspection-cycles",
+        "zero-tolerance-code-rot",
+        "90-percent-runtime-error-prevention"
+      ]
+    },
+    "project": {
+      "name": "Credible UI",
+      "type": "React/TypeScript",
+      "framework": "Vite + React + shadcn/ui",
+      "blockchain": "Sui",
+      "testing": "Vitest + Playwright",
+      "deployment": "Vercel"
+    },
+    "optimization_recommendations": {
+      "immediate": [
+        "Increase test coverage from 0% to minimum 10% threshold",
+        "Optimize bundle size from 2.5MB toward 2MB target",
+        "Implement lazy loading for calculator components"
+      ],
+      "short_term": [
+        "Add comprehensive error boundaries (currently 0% coverage)",
+        "Implement proper test suites for all 135 TypeScript files",
+        "Reduce component sizes (39 components exceed 300-line limit)"
+      ],
+      "performance_status": "OPTIMIZATION_COMPLETE",
+      "monitoring_enabled": true
+    }
+  },
+  "disabled_agents": [
+    "frontend-ui-ux-engineer",
+    "tech-writer",
+    "strategist",
+    "multimodal-looker"
+  ]
+}

package/.opencode/workflows/post-deployment-audit.yml

@@ -0,0 +1,123 @@
+name: Post-Deployment Audit
+description: Comprehensive post-deployment validation and monitoring workflow
+
+# Universal Development Framework - Post-Deployment Audit Workflow
+# Automated validation pipeline triggered after successful deployments
+
+on:
+  deployment:
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: "Target environment"
+        required: true
+        default: "production"
+        type: choice
+        options:
+          - production
+          - staging
+          - development
+
+jobs:
+  post-deployment-audit:
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment || 'production' }}
+
+    steps:
+      # 1. Environment Validation
+      - name: Validate Deployment Environment
+        run: |
+          echo "🌐 Validating deployment environment..."
+          echo "Environment: ${{ inputs.environment || 'production' }}"
+          echo "Deployment status: ${{ github.event.deployment.status }}"
+          echo "✅ Environment validation complete"
+
+      # 2. Health Check Validation
+      - name: Application Health Check
+        run: |
+          echo "🏥 Performing application health checks..."
+          # Implement health check logic here
+          # Check API endpoints, database connections, etc.
+          echo "✅ Health checks passed"
+
+      # 3. Performance Validation
+      - name: Performance Benchmarking
+        run: |
+          echo "⚡ Running performance benchmarks..."
+          # Implement Lighthouse CI or similar
+          # Check Core Web Vitals, bundle sizes, etc.
+          echo "✅ Performance benchmarks within thresholds"
+
+      # 4. Security Post-Deployment Scan
+      - name: Security Validation
+        run: |
+          echo "🔒 Executing post-deployment security scan..."
+          # Run security scans on deployed environment
+          # Check for exposed secrets, misconfigurations, etc.
+          echo "✅ Security validation complete"
+
+      # 5. Integration Testing
+      - name: Integration Test Suite
+        run: |
+          echo "🔗 Running integration tests..."
+          # Execute integration tests against deployed environment
+          # API tests, end-to-end flows, etc.
+          echo "✅ Integration tests passed"
+
+      # 6. Monitoring Setup Validation
+      - name: Monitoring Configuration Check
+        run: |
+          echo "📊 Validating monitoring configuration..."
+          # Check error tracking, analytics, logging setup
+          echo "✅ Monitoring configuration verified"
+
+      # 7. Rollback Readiness Assessment
+      - name: Rollback Plan Validation
+        run: |
+          echo "🔄 Assessing rollback readiness..."
+          # Verify rollback procedures and backup integrity
+          echo "✅ Rollback procedures validated"
+
+      # 8. Compliance Audit
+      - name: Framework Compliance Audit
+        run: |
+          echo "📋 Executing framework compliance audit..."
+          # Run framework-specific compliance checks
+          # Code quality, security standards, performance metrics
+          echo "✅ Framework compliance verified"
+
+  notification:
+    needs: post-deployment-audit
+    runs-on: ubuntu-latest
+    if: always()
+
+    steps:
+      - name: Deployment Status Notification
+        run: |
+          echo "📢 Deployment Audit Complete"
+          if [ "${{ needs.post-deployment-audit.result }}" = "success" ]; then
+            echo "✅ Deployment successful - all validations passed"
+            # Send success notifications
+          else
+            echo "❌ Deployment issues detected - review required"
+            # Send failure notifications and alerts
+          fi
+
+  cleanup:
+    needs: [post-deployment-audit, notification]
+    runs-on: ubuntu-latest
+    if: always()
+
+    steps:
+      - name: Audit Log Archival
+        run: |
+          echo "📁 Archiving audit logs..."
+          # Archive logs, metrics, and audit results
+          echo "✅ Audit logs archived"
+
+      - name: Temporary Resource Cleanup
+        run: |
+          echo "🧹 Cleaning up temporary resources..."
+          # Clean up any temporary resources created during audit
+          echo "✅ Cleanup complete"

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.40",
+  "version": "4.0.41",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",

package/dist/CHANGELOG.md

@@ -42,6 +42,22 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 - Archive root `integrations/` costume SKILL dump → `docs/archive/integrations-costume/`. Live wear is `src/integrations`.
 - Archive root `commands/` stale copy → `docs/archive/commands-copy/`. Live wear is `src/opencode/commands`.
 
+## [4.0.41] - 2026-10-07
+
+### 🔄 Changes
+
+- Wake cascade. Station and the notes page stay on the station module. Heat writes `Cascade: record-map · notes N current` on the card. A memory-recall look returns that plane, the matched law names, and the current lines from the session-note index beside the laws.
+- Session notes sit in `.xray/state/repertoire/session-notes.json` beside the laws. A replaced note stays history. The short index returns the current line. A stale page does not revive a replaced line.
+- `Sleeve: on` means the previous ticket came back, the worn plate matched the package, the previous ticket matched the working record, and inspect passed. Session start and compact run that check. The card keeps the named plane. Judgement is continue, retry N, stop, or start. The same miss keeps its retry. A different ticket stops. Payments is on only when the ticket is a payment.
+- A fresh wear fastens mill and inspect. The durable copy is staged beside the live wear. Hooks and MCP launchers are not pinned at a temporary checkout.
+- Goggles. A checkout named `0xray` records `scripts/mjs/run-goggles-mcp.mjs`. A consumer records `node_modules/0xray`. An upgrade that removes a self-install no longer leaves the handshake on a missing file.
+- A machine-level Grok plugin does not fail the mill and is not stored in the mill receipt. A change to the worn skills drops that pass until the next session start or compact. When the plate or the mill is the miss, that miss is the plan until the line is on again. A copied role skill whose text was edited still stops wear.
+- A SessionStart event that carries the opening prompt stays a session start, so the check runs before that first card is read.
+- Live page. The mesh plays in the browser, with rewind and seat images. The watch survives a dropped connection. Fleet pushes go out as packets.
+- The Playwright release-gate smoke stays on the Playwright battery. The unit runner does not load that spec.
+
+---
+
 ## [4.0.40] - 2026-10-05
 
 ### 🔄 Changes

package/dist/integrations/grok/hooks/grok-hook-utils.js

@@ -282,6 +282,25 @@ export function loadConferPending(root = workspaceRoot(), sessionId = null) {
   }
 }
 
+export function resolveGrokHookEvent(event = {}, argv = process.argv, env = process.env) {
+  if (env && env.GROK_HOOK_EVENT) return env.GROK_HOOK_EVENT;
+  const flag = (argv || []).find((arg) => String(arg).startsWith('--hook-event='));
+  if (flag) return String(flag).slice('--hook-event='.length);
+  const named = String((event && (event.hookEventName || event.hook)) || '')
+    .toLowerCase()
+    .replace(/[-_\s]/g, '');
+  if (named === 'precompact') return 'pre_compact';
+  if (named === 'postcompact') return 'post_compact';
+  if (named === 'sessionstart') return 'session_start';
+  if (
+    (event && (event.prompt != null || event.userMessage != null || event.user_prompt != null)) ||
+    named === 'userpromptsubmit'
+  ) {
+    return 'user_prompt_submit';
+  }
+  return 'session_start';
+}
+
 export function buildSessionBootPayload(root, source = '0xray/grok-session-start', extra = {}) {
   const features = loadFeatures(root);
   const blockingTerms = loadBlockingCodexTerms();
@@ -318,6 +337,7 @@ export function buildSessionBootPayload(root, source = '0xray/grok-session-start
     ...extra,
     ...heat,
     ...compactHold,
+    arrivedHook: extra && extra.hookEvent ? String(extra.hookEvent) : "",
     hook: source,
     source,
     timestamp: new Date().toISOString(),
@@ -328,8 +348,8 @@ export function writeSessionBoot(root, payload) {
   try {
     const stateDir = path.join(root, '.xray', 'state');
     fs.mkdirSync(stateDir, { recursive: true });
-    fs.writeFileSync(sessionBootPath(root), JSON.stringify(payload, null, 2));
     writeStationMarkdown(root, payload);
+    fs.writeFileSync(sessionBootPath(root), JSON.stringify(payload, null, 2));
     const hook = String((payload && (payload.hookEvent || payload.source)) || "");
     if (!/compact/i.test(hook)) {
       try {