0xray 4.0.41 → 4.1.0

package/.grok-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.41",
+  "version": "4.1.0",
   "description": "0xRay suit for Grok, Hermes, OpenClaw, OpenCode: mill+inspect, Codex, 7 MCP servers. Costume 45/42 is opt-in foundry, not the default wear.",
   "author": {
     "name": "0xRay AI",

package/.opencode/skills/orchestrator/SKILL.md

@@ -72,6 +72,18 @@ The hold lasts for the work that named the plane. A sentence that does not say l
 
 Config: `features.json` → `multi_agent_orchestration.lead_dev_mode`
 
+## Confer
+
+The TUI that is wearing the suit already spawned the MCP servers. Confer uses those servers. It does not start a private server and it does not run `hermes -z`.
+
+When `.xray/state/confer-ask-s.1.json`, `confer-ask-s.2.json`, and `confer-ask-s.3.json` are on disk:
+
+1. Call the server and tool named in each ask. Researcher and code-review return evidence. Architect returns the assessment with `Verdict: UNREVIEWED`.
+2. Write one verdict line from this TUI's model: `Verdict: PASS`, `Verdict: CONDITIONAL`, or `Verdict: FAIL`, plus top risks and a hardening note.
+3. Call `record_confer_receipt` on `xray-governance` with `todoId`, `subagent`, `sessionId`, and that text.
+
+Only `Verdict: PASS` completes the todo. FAIL, CONDITIONAL, and UNREVIEWED stay open. A session id that does not match the plan does not complete the todo. Grok, OpenCode, Hermes, and OpenClaw use these same three steps. Hermes is a voter only when Hermes is the TUI, and then only as that TUI's own model.
+
 ## Lead cadence (syncopation)
 
 The seven rules are the engine. The cadence is the time signature. Disk SSOT: `grok-bot/OP-PROC.md` (team specifics live in `house/`).

package/.plugin/plugin.json

@@ -2,7 +2,7 @@
   "id": "0xray",
   "name": "0xRay",
   "version": "3.1.0",
-  "description": "Multi-agent orchestration, Codex governance, and AI-powered development tools. 13 MCP tools (code review, security audit, API design, database design, project analysis, testing, performance, UI/UX, DevOps, documentation, storytelling) plus 44 knowledge skills for best-practice guidance across the full software development lifecycle.",
+  "description": "Three-subsystem autonomous engine. The suit is the wear: memory, judgement, payments, and the wake. Seven consumer MCP servers. The skill catalog is opt-in.",
   "author": "0xRay AI",
   "homepage": "https://github.com/0xRayAI/xray",
   "components": {

package/.xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.41",
+  "version": "4.1.0",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",
@@ -54,16 +54,16 @@
       "auto_provision_worktree": false
     }
   },
-  "grok_postprocessor_light": true,
+  "grok_postprocessor_light": false,
   "inference_session_capture": {
     "enabled": true,
     "min_commits": 3,
     "lookback_commits": 20
   },
   "autonomous_reporting": {
-    "enabled": true,
+    "enabled": false,
     "interval_minutes": 60,
-    "auto_schedule": true,
+    "auto_schedule": false,
     "include_health_assessment": true,
     "include_agent_activities": true,
     "include_pipeline_operations": true,
@@ -174,7 +174,7 @@
     "every_n_todos_completed": 0
   },
   "inference": {
-    "description": "Self-improvement cycle that grades a new named session into repertoire",
+    "description": "The cycle runs from the CLI command inference:run and the session wake does not start it.",
     "enabled": true,
     "workflow_dir": ".xray/inference",
     "reports_dir": ".xray/reports",

package/.xray/features.schema.json

@@ -45,7 +45,7 @@
         },
         "confer_on_synthesis": {
           "type": "boolean",
-          "description": "Auto-run 3-agent confer quorum at synthesis checkpoint (default true)"
+          "description": "Opt in to the 3-agent confer quorum. A missing key stays off."
         },
         "confer": {
           "type": "object",

package/AGENTS-consumer.md

@@ -2,11 +2,13 @@
 
 <!-- 0xray-managed -->
 
-Quick reference for the 0xRay AI orchestration framework worn on **{{CONSUMER_NAME}}**{{CONSUMER_VERSION_PAREN}}.
+Quick reference for the 0xRay suit worn on **{{CONSUMER_NAME}}**{{CONSUMER_VERSION_PAREN}}.
 
-**4.0** — a suit that survives the context window
+**4.1** — a suit that survives the context window
 
-Same **three-subsystem OS** as v2 (Inference · External Governance · Autonomous Engine). Constitution always on. Temperament scales ceremony. Four chat bridges plus Cursor project hooks. **Repertoire is preferred** — vendored 0.2.9 ships **on**. Dest is named laws, not keywords. Station is the compact ticket, not a substitute. Explicit opt-out only: `"enabled": false, "provider": "repertoire"`. Trim fat, do not gut the design.
+Confer votes. Burst runs the swarm.
+
+0xRay is a three-subsystem autonomous engine (Inference · External Governance · Autonomous Engine). The suit is the wear. Constitution always on. Temperament scales ceremony. Four chat bridges plus Cursor project hooks. **Repertoire is preferred** — vendored 0.2.9 ships **on**. Dest is named laws, not keywords. Station is the wake ticket, not a substitute. Explicit opt-out only: `"enabled": false, "provider": "repertoire"`.
 
 **Governance always on** (Codex PreToolUse, no new surface, no `eval`). **Engine ceremony** (analyze-complexity before spawn, confer) is **guided** by default so free-model OpenCode/Hermes stay in check. Frontier hosts (Grok 4.6 class) with `suit_temperament.profile: auto` **warn** on spawn-without-plan instead of deny — the engine is still there. Existing `.xray/features.json` without `suit_temperament` stays **guided**. Docs: v3 from v2 · Suit temperament.
 
@@ -18,7 +20,9 @@ A peer lead continues from this card + Repertoire + the `orchestrator` skill. Du
 
 ## Postinstall (automatic)
 
-`npm install 0xray` runs `install-bridges.cjs` and:
+`npm install 0xray` links vendored `@0xray/repertoire` and prints `npx 0xray wear`. It does not write `AGENTS.md`, `.mcp.json`, or the chat bridges.
+
+`npx 0xray wear` writes the consumer suit:
 
 - Copies this file → **`AGENTS.md`** in your project root
 - Fastens mill plant (`mill` + `inspect`) then overlays **your** `src/skills` (same name wins). Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares (blip-inspect, blip-vibe, blip-looker, sound-inspect, sound-mixer live in the mill). `npx @0xray/foundry sound mix` / `sound render` / `blip render` are CLI shims (0.1.11+). `npx @0xray/foundry inspect` runs mill-exported inspect; on a sound seat the last bed receipt; on a blip seat the last 4.44s receipt. Chat is not a receipt. Does **not** dump 45/42 costume unless `foundry.json` `"costume": true`. Does **not** write root **`SKILLS.md`**
@@ -52,7 +56,7 @@ Governance deliberation uses **code-review**, **security-audit** (via enforcer/s
 |---------|-------------|
 | `npx 0xray setup` | Symlinks, hook extras, Hermes skill sync |
 | `npx 0xray status` | Verify installation |
-| `npx 0xray opencode install` | OpenCode bridge (also runs on postinstall) |
+| `npx 0xray opencode install` | OpenCode bridge. `npx 0xray wear` writes it too. |
 | `npx 0xray grok install` | Project `.grok/plugins/0xray` + 7 MCPs servers (machine plugin not last-wins) |
 | `npx 0xray hermes install` | Hermes plugin bridge |
 | `npx 0xray openclaw install` | OpenClaw config + skills |
@@ -158,7 +162,7 @@ When the suit is worn, **lead dev mode** is ON via existing config + hooks:
 
 ## Skills
 
-Full catalog in root **`SKILLS.md`** (shipped on postinstall). **`orchestrator`** skill documents lead-dev mode. Invoke via `@orchestrator` or `xray-skills` MCP (`invoke-skill`, `list-skills`).
+Full catalog in root **`SKILLS.md`**. Wear does not write a consumer-root `SKILLS.md`. **`orchestrator`** skill documents lead-dev mode. Invoke via `@orchestrator` or `xray-skills` MCP (`invoke-skill`, `list-skills`).
 
 ## File Organization
 

package/AGENTS.md

@@ -1,10 +1,12 @@
 # xray Agents
 
-Quick reference for the xray AI orchestration framework (**4.0**).
+Quick reference for the 0xRay suit (**4.1**).
 
-**4.0** — a suit that survives the context window.
+**4.1** — a suit that survives the context window.
 
-**Exo, not catalog.** Three-subsystem OS (Inference · External Governance · Autonomous Engine) · constitution always on · temperament by host · 4 floors · **Repertoire preferred** (vendored 0.2.9, dest = laws).
+Confer votes. Burst runs the swarm.
+
+**The suit is the wear.** Three-subsystem autonomous engine (Inference · External Governance · Autonomous Engine) · constitution always on · temperament by host · 4 floors · **Repertoire preferred** (vendored 0.2.9, dest = laws).
 
 **Temperament:** ceremony (analyze-complexity before spawn, confer) is **guided** by default so free-model OpenCode/Hermes stay in check. Frontier hosts (Grok 4.6 class) with `suit_temperament.profile: auto` **warn** on spawn-without-plan; Codex 11/29/69 still **deny**. Missing `suit_temperament` stays guided. See `docs-site/docs/architecture/v3-from-v2.md`.
 
@@ -16,10 +18,10 @@ Before other work, Read `.xray/state/STATION.md`. Compaction and host change are
 
 ## What is xray?
 
-xray provides intelligent multi-agent orchestration with automatic delegation and Codex compliance validation under the pure v2 three-subsystem model:
+0xRay is a three-subsystem autonomous engine. The suit is the wear. The host you already run wears it. When the window closes, the next session wakes with the job.
 
 - **Inference** — proposals, reflection, memory routing (Repertoire organ on in 4.0)
-- **External Governance** — Dynamo Solar SSOT, 69-term Codex
+- **External Governance** — Dynamo Solar SSOT, 69-term Codex. Judgement stays on.
 - **Autonomous Engine** — thinDispatch 7-flow, AsideContext, confidence gate
 
 Agents are declared in `src/opencode/agents/*.yml` — the YML SSOT. Skills live in `src/skills/*/SKILL.md` — see [SKILLS.md](SKILLS.md) for the exo catalog. Consumer default plant is **mill + inspect**, not a 45-skill sync (`AGENTS-consumer.md` → `AGENTS.md`). Factory hangar shops coexist via shop plant. See [llms.txt](llms.txt).
@@ -42,7 +44,9 @@ Governance deliberation: **code-review**, **security-audit**, **researcher** wit
 
 ## Postinstall
 
-`postinstall.cjs` → `installAllBridges()`:
+`postinstall.cjs` links vendored `@0xray/repertoire` and prints `npx 0xray wear`. It does not write `.mcp.json` or the chat bridges.
+
+`npx 0xray wear` runs `installAllBridges()` from `install-bridges.cjs`:
 
 1. `AGENTS-consumer.md` → `AGENTS.md` (does **not** write consumer-root `SKILLS.md`)
 2. Fasten mill plant (`mill` + `inspect`). Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares (looker, vibe, mixer, blip-inspect, blip-vibe, blip-looker, sound-inspect, sound-mixer live in the mill). Not a 45-skill costume dump unless `foundry.json` `"costume": true`
@@ -61,7 +65,7 @@ Governance deliberation: **code-review**, **security-audit**, **researcher** wit
 
 ## Memory routing + Repertoire (preferred, v3.3+)
 
-**Wear Repertoire.** It is the long-term judgment organ. Dest is named invariants (factory + stack laws), not hangar `repo-*` or git slugs. **Station is the compact ticket** (Read `.xray/state/STATION.md`) — not a substitute for Repertoire. The worn mill reads the **project copy** under `.xray/state/repertoire/`. 0.1.0–0.1.8 were the same judgment organ; do not pin 0.1.8. Split: `docs-site/docs/guides/station-vs-repertoire.md`.
+**Wear Repertoire.** It is the long-term judgment organ. Dest is named invariants (factory + stack laws), not hangar `repo-*` or git slugs. **Station is the wake ticket** (Read `.xray/state/STATION.md`) — not a substitute for Repertoire. The worn mill reads the **project copy** under `.xray/state/repertoire/`. 0.1.0–0.1.8 were the same judgment organ; do not pin 0.1.8. Split: `docs-site/docs/guides/station-vs-repertoire.md`.
 
 `xray/features.json` → `memory_routing` (schema: `features.schema.json`):
 
@@ -228,8 +232,15 @@ Full skill mapping: [SKILLS.md](SKILLS.md).
 | Station vs Repertoire 0.1 | `docs-site/docs/guides/station-vs-repertoire.md` |
 | AsideContext | `docs-site/docs/guides/aside-context.md` |
 | Consumer migration | `docs-site/docs/guides/consumer-migration.md` |
+| Bifrost board | `docs-site/docs/plates/bifrost.md` |
+| Seat wake | `grok-bot/templates/house/fleet/WAKE-ROUTINE.md` |
+| Fleet lexicon | `grok-bot/LEXICON.md` |
 | Docusaurus site | https://0xrayai.github.io/xray/ |
 
+## Live board
+
+The board seats see is the collector board (`house/live/feed/live_mesh.py`). A cloud agent is a board row (`bcId`, owning seat, linked card, state `running`, `finished`, or `failed`). The seat wake is `grok-bot/templates/house/fleet/WAKE-ROUTINE.md`: `live-inbox <seat> --turn start` on every turn, and `--turn end` on every exit. `live-inbox` requires `LIVE_URL`, `SEAT_KEYS_DIR`, and `LIVE_CURSORS`. A missing or empty one exits 2 and names it. A stuck card sends L1 to the next owner or the card owner, and L2 to the CoS role. An unacked line and a missing handoff stay on that seat through L3, and the CoS role is woken at L3.
+
 ## Release artifacts
 
-`npm run release:patch` updates: `package.json`, `CHANGELOG.md`, `README.md`, `AGENTS.md`, `AGENTS-consumer.md`, `SKILLS.md`, `llms.txt`, Docusaurus guides.
+`npm run release:patch` updates: `package.json`, `CHANGELOG.md`, `README.md`, `AGENTS.md`, `AGENTS-consumer.md`, `SKILLS.md`, `llms.txt`, Docusaurus guides.

package/LICENSE

@@ -18,4 +18,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+SOFTWARE.

package/README.md

@@ -1,37 +1,45 @@
-# xray — exo for coding agents
+# xray — a suit for coding agents
 
-**4.0** — a suit that survives the context window
+![0xRay — A Power Suit for AI Agents. survive compaction. build foundries. monitor the swarm.](docs-site/static/img/readme-hero.jpg)
 
-![0xRay v4 exo — CONSTITUTION ON](docs-site/static/img/exo-skeleton-v4.jpg)
+**4.1** — a suit that survives the context window
 
-Not a catalog of agents. The product is the **skeleton you wear**.
+Bifrost is the live board. Goggles reads one named plane.
+
+0xRay is a three-subsystem autonomous engine. The suit is the wear. Inference remembers. External Governance judges. The Autonomous Engine runs the work. The host you already run wears it: Grok, OpenCode, Hermes, OpenClaw, or Cursor. Memory, judgement, and payments come on with the suit. When the window closes, the next session wakes with the job, the page, and the laws.
+
+Bifrost turns each pull request, issue, and comment into one card and a line in the right seat's inbox, then wakes that seat. Confer still completes only on a real yes. A foundry is built from mills and hangars. The mill builds and ships. The hangar is the shop.
+
+The product is the **skeleton you wear**.
 
 ## Your AI Power Suit
 
 **Your AI Power ⚡️ Suit 🦾** — an exoskeleton that blocks AI slop from becoming real damage.
 
-- **Bone** — three-subsystem OS: Inference · External Governance (Dynamo / Codex) · Autonomous Engine (thinDispatch)
+- **Bone** — three-subsystem engine: Inference · External Governance (Dynamo / Codex) · Autonomous Engine (thinDispatch)
 - **Always on** — Codex 11 / 29 / 69, destructive shell, no new MCP/skill/handler surface
 - **Temperament** — `frontier` | `guided` | `strict` | `auto` — how loud the engine is, not whether governance exists
 - **Wear** — Grok, OpenCode, Hermes, OpenClaw, plus Cursor project hooks. One SSOT gate
-- **Muscle** — **Repertoire is preferred.** Vendored 0.2.9 ships **on**. Dest is named laws, not hangar `repo-*` or git slugs. Station is the compact-survival ticket — not a substitute for Repertoire.
+- **Muscle** — **Repertoire is preferred.** Vendored 0.2.9 ships **on**. Dest is named laws, not hangar `repo-*` or git slugs. Station is the wake ticket — not a substitute for Repertoire.
 
 ```bash
 npm install 0xray
+npx 0xray wear
 ```
 
-Consumer `npm install 0xray` auto-wires four chat bridges, Cursor project hooks, and seven MCP servers. **Repertoire is preferred** — vendored **0.2.9** ships on: factory + stack laws, in-process routing, extra host MCP `repertoire`. Not an eighth `xray-*` server. Dest is a judgment index. Explicit opt-out only: `"enabled": false, "provider": "repertoire"`. Do not pin 0.1.8.
+`npm install 0xray` links vendored `@0xray/repertoire` and prints `npx 0xray wear`. It does not write `.mcp.json` or the chat bridges. Wear writes the consumer suit: managed `AGENTS.md`, `.xray` config, seven MCP servers, and the OpenCode, Grok, Hermes, and OpenClaw bridges (`install-bridges.cjs`). Inside a git checkout, wear also fastens Cursor project hooks. **Repertoire is preferred** — vendored **0.2.9** ships on: factory + stack laws, in-process routing, extra host MCP `repertoire`. Not an eighth `xray-*` server. Dest is a judgment index. Explicit opt-out only: `"enabled": false, "provider": "repertoire"`. Do not pin 0.1.8.
 
 ## Quick Start
 
 ```bash
-npm install 0xray # postinstall: mill+inspect plant + 4 bridges + 7 MCPs + AGENTS.md + .mcp.json
-npx 0xray status # verify install
-npx 0xray setup # optional: symlinks, hook extras
+npm install 0xray
+npx 0xray wear
+npx 0xray status
+npx 0xray setup --git-hooks # optional: git hooks only
 npx @0xray/foundry inspect --skip-live # mill receipt (chat is not a receipt)
 ```
 
-Manual per-platform install (idempotent, same result as postinstall):
+Manual per-platform install (idempotent, same bridges wear writes):
 
 ```bash
 npx 0xray opencode install
@@ -51,12 +59,50 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 
 | Version | Highlights |
 |---------|------------|
-| **Unreleased** | Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill declares (looker / vibe / mixer live in the mill). Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip\|sound` remain (0.1.11+). Shop plant first-class (`shop-extract`, `shop-witness`, `shop-pin` + `foundry.json` `shopPlant`). |
+| **4.1.0** | Bifrost is the collector board. A cloud agent is a board row. A stuck card's L2 nudge goes to the CoS role. `live-inbox` requires `LIVE_URL`, `SEAT_KEYS_DIR`, and `LIVE_CURSORS`. Goggles reads one named plane. |
+| **4.0.43** | Confer completes only on a real PASS. Cursor gate events fail closed, except EACCES when a cloud wrapper cannot write dest. Gate C cannot be skipped. |
+| **4.0.42** | Confer votes. Burst runs the swarm. |
+| **4.0.41** | Wake cascade stays on the station module. A fresh wear fastens mill and inspect. Goggles records the worn package path. The live page plays the mesh in the browser. |
+| **4.0.40** | Live mesh runs the full loop: feed watch, render, direction, deploy, health, and the ledger both ways. |
+| **4.0.39** | The seven stack laws stay worn. Repertoire in the suit is 0.2.9. |
+| **4.0.38** | Codex term 70 requires the current source and the worn npm package. Dynamo's recommendation is honored. |
+| **4.0.37** | A naked checkout wakes with repertoire on. |
+| **4.0.36** | Goggles holds the stop through search, read, and a dist wipe. |
+| **4.0.35** | Wear rewrites a checkout `dist/cli` launch to `node_modules/0xray`. |
+| **4.0.34** | The lens stays on the worn build when the source is not packed. |
+| **4.0.33** | Version bump. |
+| **4.0.32** | `0xray look` opens one plane. Digest and triage return the card. Calling and confer stay off. |
+| **4.0.31** | Goggles looks at one pipeline. Kind 0 stays quiet when the worn list matches the map. Calling and confer stay off. |
 | **4.0.30** | Fixes 4.0.29: `npx 0xray wear` and `setup` work outside a git checkout again. They write the 4.0.28 project setup, skip only Cursor hooks, and print one warning. Inside a git checkout they restore the 4.0.28 project setup, and `wear` adds Cursor hooks plus the unwear snapshot. Companion `@0xray/grok-bot` 0.1.8. Released 2026-09-28. |
 | **4.0.29** | `npm install` only creates the relative `node_modules/@0xray/repertoire` link to the vendored repertoire and prints `npx 0xray wear`. Run `npx 0xray wear` after install. Wear writes only the consumer project's `.cursor/hooks.json` (installed dist hooks, beside user entries); `npx 0xray unwear` restores the snapshot. Companion `@0xray/grok-bot` 0.1.8. Released 2026-09-28. |
 | **4.0.28** | MCP servers start through `scripts/node/mcp-launch.cjs` and only see PATH, HOME, XRAY_ROOT, plus names on their keep list. Tokens such as NPM_TOKEN are not inherited. User env values stay out of argv. Postinstall keeps user edits to AGENTS.md, .mcp.json, and opencode.json. `house init` does not copy EXAMPLE.md; doctor FAILs while `house/EXAMPLE.md` exists. Inspect adds a machinePlugin check. The Cursor hook defaults XRAY_ROOT to the suit. Companion `@0xray/grok-bot` 0.1.7. Released 2026-09-27. |
 | **4.0.27** | Host compact proof needs a generation id and a numeric usage percent, and the same preCompact receipt is mirrored to nested consumer wear roots. Memory scoring: [docs/memory-scoring.md](docs/memory-scoring.md) (orchestrator links it). Companion `@0xray/grok-bot` 0.1.6: general page vs `house/` overlay, `templates/house/`, `grok-bot house init`, doctor `GROK_BOT_HOUSE` or walk-up. Released 2026-09-26. |
+| **4.0.26** | A lesson is stored when the task matches no signal. A Cursor compact cut is proved with a session log and a per-session receipt. |
+| **4.0.25** | Plate schematics ship in the package. A worn suit resolves them from `dist/integrations/hooks/plates.cjs`. |
+| **4.0.24** | Compaction and a host change are the same cut. The station card is the handoff. Repertoire in that suit is 0.2.8. |
+| **4.0.23** | The Dynamo client starts when external governance is required. Proposals score locally when that governance is off. |
+| **4.0.22** | The stamper strips present-tense patch pins from shipped prose. The cursor gate follows the suit mill. |
+| **4.0.21** | Dest is named laws, not hangar slugs. Cleanup heat grows the project copy when Repertoire is on. |
+| **4.0.20** | Heat grows the project copy. Session boot rewrites when HEAD moves. |
+| **4.0.19** | Vendored Repertoire 0.2.5. Wear replaces older leftovers. |
+| **4.0.18** | Wake heat joins bookmark, index, and mind. |
+| **4.0.17** | Cursor heat writes session files when HEAD moves. |
+| **4.0.16** | `npx 0xray validate` is a wear check. |
+| **4.0.15** | Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill declares (looker / vibe / mixer live in the mill). Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip\|sound` remain (0.1.11+). Shop plant first-class (`shop-extract`, `shop-witness`, `shop-pin` + `foundry.json` `shopPlant`). |
+| **4.0.14** | Factory-blip beds stamp the hook cell and keep six tellable bodies. |
+| **4.0.13** | Station PreCompact merge keeps custom STATION.md keys. |
+| **4.0.12** | Project-scoped Grok plugin dest so multi-seat wear does not clobber the machine plugin. |
+| **4.0.11** | The npm pack includes `.grok-plugin/` so the Grok marketplace manifest ships. |
+| **4.0.10** | Version bump. |
 | **4.0.9** | Mill target: postinstall does not mill npm global prefix or `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. |
+| **4.0.8** | Confer abstains locally instead of rubber-stamping a proposal. |
+| **4.0.7** | Nested mill 0.1.9. Inventory writes `dna`. The mill does not mint on chain. |
+| **4.0.6** | Nested mill 0.1.8. Isolated HOME skips machine Hermes and OpenClaw. |
+| **4.0.5** | Inspect is a mill command. A costume dump fails mint. Mill plant stays mill + inspect. |
+| **4.0.4** | Mill fastens an inspect suit. Costume is opt-in with `foundry.json` `"costume": true`. |
+| **4.0.3** | Their plant is the suit. The mill plant is the factory discipline on the hanger. |
+| **4.0.2** | The nested mill ships in the 0xray tarball. `@0xray/foundry` stays the standalone mill CLI. |
+| **4.0.1** | CLI `--version` no longer dumps a Commander stack. The release gate smokes the organ and does not run another publish from a lifecycle script. |
 | **4.0.0** | Exo + temperament. Constitution always on; ceremony by host. Repertoire organ on (vendored 0.2). Station card survives compact/host-swap. **On npm.** [vision](docs-site/docs/architecture/v4-vision.md) · [now](docs-site/docs/architecture/v4-now.md) |
 | **3.4.1** | Unified `install-bridges.cjs` on postinstall — OpenCode, Grok, Hermes, OpenClaw in one pass. All 7 MCPs servers via `npx -y 0xray mcp <cmd>` (no `dist/` paths). Canonical `release.mjs` pipeline. |
 | **3.3.1** | Orchestrator confidence gate wired into execution planning. |
@@ -102,9 +148,9 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 - **External Governance** — Dynamo Solar SSOT; CodexPolicyService; weighted PHI/TAU deliberation.
 - **Autonomous Engine** — thinDispatch 7-flow routing; orchestrator confidence gate (v3.3.1).
 
-## Consumer Install (postinstall)
+## Consumer Install (wear)
 
-On `npm install 0xray` in a consumer project, postinstall automatically:
+`npm install 0xray` links the vendored repertoire and prints `npx 0xray wear`. Wear then:
 
 1. Copies **`AGENTS-consumer.md` → `AGENTS.md`**. Does **not** write consumer-root **`SKILLS.md`**.
 2. Fastens **mill plant** (`mill` + `inspect`). Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares — organs (looker, vibe, mixer) live in the mill, not an xray catalog. Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip|sound` still exist on foundry 0.1.11+; fasten is the new cut. Not a 45-skill / 42-agent costume dump. `foundry.json` `"costume": true` is the opt-in dump.
@@ -113,7 +159,7 @@ On `npm install 0xray` in a consumer project, postinstall automatically:
 5. Writes project **`.mcp.json`** with 7 MCPs servers (`npx -y 0xray mcp …`)
 6. Installs **4 chat bridges**: OpenCode, Grok, Hermes, OpenClaw, plus **Cursor** `.cursor/hooks.json` (PPE + wiring; mill plant, not costume)
 7. Factory shop plant (`shop-extract`, `shop-witness`, `shop-pin` from groover-hangar) may coexist when worn. Extra shops: `foundry.json` `shopPlant`. Not costume.
-8. Installs git pre-commit hook (non-blocking if not a git repo)
+8. Inside a git checkout, fastens Cursor `.cursor/hooks.json` and the hook scripts, and keeps an unwear snapshot. Outside a git checkout, skips those hooks and prints one warning. `npx 0xray setup --git-hooks` is what installs git hooks.
 
 See [llms.txt](llms.txt) for the agent map. Catalog of 45 skills lives in [SKILLS.md](SKILLS.md) — that is the exo catalog, not default consumer wear.
 
@@ -186,13 +232,13 @@ Docs: [memory routing](docs-site/docs/guides/memory-routing.md) · [Repertoire](
 
 ## Integrations
 
-| Platform | Install | Postinstall behavior |
+| Platform | Install | What that command writes |
 |----------|---------|----------------------|
 | **OpenCode** | `npx 0xray opencode install` | Merges `opencode.json`, copies agent YML surfaces |
 | **Grok CLI / Build** | `npx 0xray grok install` | Project `.grok/plugins/0xray` (shared HOME does not clobber machine plugin), 7 MCPs servers |
 | **Hermes Agent** | `npx 0xray hermes install` | `~/.hermes/plugins/xray-hermes`, consumer root marker |
 | **OpenClaw** | `npx 0xray openclaw install` | `.xray/config/openclaw.json`, skill sync |
-| **Cursor** | postinstall (`installCursorBridge`) | Fastens `.cursor/hooks.json` + relative `.cursor/hooks/*.sh`. Rewrites leftover env-assignment one-liners. Not a fifth chat TUI. |
+| **Cursor** | `npx 0xray wear` inside a git checkout | Fastens `.cursor/hooks.json` + relative `.cursor/hooks/*.sh`. Rewrites leftover env-assignment one-liners. Not a fifth chat TUI. |
 
 ## Governance & Codex
 
@@ -219,7 +265,7 @@ npm run release:npm # gate + prepare + npm publish --access public
 
 ## Release
 
-The **4.0** line is on npm. Do **not** run `release:major` to ship a 4.x fix (that becomes 5.0.0). Do **not** put a `scripts.publish` lifecycle that re-runs the gate after the registry PUT. Patch number lives in `package.json` + CHANGELOG.
+The **4.1** line is on npm. Do **not** run `release:major` to ship a 4.x fix (that becomes 5.0.0). Do **not** put a `scripts.publish` lifecycle that re-runs the gate after the registry PUT. Patch number lives in `package.json` + CHANGELOG.
 
 ```bash
 npm run release:gate
@@ -235,4 +281,4 @@ MIT — see [LICENSE](LICENSE)
 
 ---
 
-*xray — MCP-centric, governed, autonomous. Pure v2 three-subsystem.*
+*xray — a three-subsystem autonomous engine. The suit is the wear.*

package/SKILLS.md

@@ -1,6 +1,10 @@
 # 0xray Skills
 
-**4.0** — a suit that survives the context window
+**4.1** — a suit that survives the context window
+
+Confer votes. Burst runs the swarm.
+
+0xRay is a three-subsystem autonomous engine. The suit is the wear. This file is the catalog.
 
 **45 skills** in this exo catalog. Default consumer plant is **`mill` + `inspect`**, not this dump. `npm install 0xray` does **not** sync 45 skills unless `foundry.json` `"costume": true`. Factory shop plant (`shop-extract`, `shop-witness`, `shop-pin`) coexists with mill plant when a hangar wears those shops. Extra shops: `foundry.json` `shopPlant`. Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares — organs (looker, vibe, mixer) live in the mill, not this catalog. Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip|sound` still exist on foundry 0.1.11+. Agent map: [llms.txt](llms.txt).
 

package/dist/AGENTS.md

@@ -1,10 +1,12 @@
 # xray Agents
 
-Quick reference for the xray AI orchestration framework (**4.0**).
+Quick reference for the 0xRay suit (**4.1**).
 
-**4.0** — a suit that survives the context window.
+**4.1** — a suit that survives the context window.
 
-**Exo, not catalog.** Three-subsystem OS (Inference · External Governance · Autonomous Engine) · constitution always on · temperament by host · 4 floors · **Repertoire preferred** (vendored 0.2.9, dest = laws).
+Confer votes. Burst runs the swarm.
+
+**The suit is the wear.** Three-subsystem autonomous engine (Inference · External Governance · Autonomous Engine) · constitution always on · temperament by host · 4 floors · **Repertoire preferred** (vendored 0.2.9, dest = laws).
 
 **Temperament:** ceremony (analyze-complexity before spawn, confer) is **guided** by default so free-model OpenCode/Hermes stay in check. Frontier hosts (Grok 4.6 class) with `suit_temperament.profile: auto` **warn** on spawn-without-plan; Codex 11/29/69 still **deny**. Missing `suit_temperament` stays guided. See `docs-site/docs/architecture/v3-from-v2.md`.
 
@@ -16,10 +18,10 @@ Before other work, Read `.xray/state/STATION.md`. Compaction and host change are
 
 ## What is xray?
 
-xray provides intelligent multi-agent orchestration with automatic delegation and Codex compliance validation under the pure v2 three-subsystem model:
+0xRay is a three-subsystem autonomous engine. The suit is the wear. The host you already run wears it. When the window closes, the next session wakes with the job.
 
 - **Inference** — proposals, reflection, memory routing (Repertoire organ on in 4.0)
-- **External Governance** — Dynamo Solar SSOT, 69-term Codex
+- **External Governance** — Dynamo Solar SSOT, 69-term Codex. Judgement stays on.
 - **Autonomous Engine** — thinDispatch 7-flow, AsideContext, confidence gate
 
 Agents are declared in `src/opencode/agents/*.yml` — the YML SSOT. Skills live in `src/skills/*/SKILL.md` — see [SKILLS.md](SKILLS.md) for the exo catalog. Consumer default plant is **mill + inspect**, not a 45-skill sync (`AGENTS-consumer.md` → `AGENTS.md`). Factory hangar shops coexist via shop plant. See [llms.txt](llms.txt).
@@ -42,7 +44,9 @@ Governance deliberation: **code-review**, **security-audit**, **researcher** wit
 
 ## Postinstall
 
-`postinstall.cjs` → `installAllBridges()`:
+`postinstall.cjs` links vendored `@0xray/repertoire` and prints `npx 0xray wear`. It does not write `.mcp.json` or the chat bridges.
+
+`npx 0xray wear` runs `installAllBridges()` from `install-bridges.cjs`:
 
 1. `AGENTS-consumer.md` → `AGENTS.md` (does **not** write consumer-root `SKILLS.md`)
 2. Fasten mill plant (`mill` + `inspect`). Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares (looker, vibe, mixer, blip-inspect, blip-vibe, blip-looker, sound-inspect, sound-mixer live in the mill). Not a 45-skill costume dump unless `foundry.json` `"costume": true`
@@ -61,7 +65,7 @@ Governance deliberation: **code-review**, **security-audit**, **researcher** wit
 
 ## Memory routing + Repertoire (preferred, v3.3+)
 
-**Wear Repertoire.** It is the long-term judgment organ. Dest is named invariants (factory + stack laws), not hangar `repo-*` or git slugs. **Station is the compact ticket** (Read `.xray/state/STATION.md`) — not a substitute for Repertoire. The worn mill reads the **project copy** under `.xray/state/repertoire/`. 0.1.0–0.1.8 were the same judgment organ; do not pin 0.1.8. Split: `docs-site/docs/guides/station-vs-repertoire.md`.
+**Wear Repertoire.** It is the long-term judgment organ. Dest is named invariants (factory + stack laws), not hangar `repo-*` or git slugs. **Station is the wake ticket** (Read `.xray/state/STATION.md`) — not a substitute for Repertoire. The worn mill reads the **project copy** under `.xray/state/repertoire/`. 0.1.0–0.1.8 were the same judgment organ; do not pin 0.1.8. Split: `docs-site/docs/guides/station-vs-repertoire.md`.
 
 `xray/features.json` → `memory_routing` (schema: `features.schema.json`):
 
@@ -228,8 +232,15 @@ Full skill mapping: [SKILLS.md](SKILLS.md).
 | Station vs Repertoire 0.1 | `docs-site/docs/guides/station-vs-repertoire.md` |
 | AsideContext | `docs-site/docs/guides/aside-context.md` |
 | Consumer migration | `docs-site/docs/guides/consumer-migration.md` |
+| Bifrost board | `docs-site/docs/plates/bifrost.md` |
+| Seat wake | `grok-bot/templates/house/fleet/WAKE-ROUTINE.md` |
+| Fleet lexicon | `grok-bot/LEXICON.md` |
 | Docusaurus site | https://0xrayai.github.io/xray/ |
 
+## Live board
+
+The board seats see is the collector board (`house/live/feed/live_mesh.py`). A cloud agent is a board row (`bcId`, owning seat, linked card, state `running`, `finished`, or `failed`). The seat wake is `grok-bot/templates/house/fleet/WAKE-ROUTINE.md`: `live-inbox <seat> --turn start` on every turn, and `--turn end` on every exit. `live-inbox` requires `LIVE_URL`, `SEAT_KEYS_DIR`, and `LIVE_CURSORS`. A missing or empty one exits 2 and names it. A stuck card sends L1 to the next owner or the card owner, and L2 to the CoS role. An unacked line and a missing handoff stay on that seat through L3, and the CoS role is woken at L3.
+
 ## Release artifacts
 
-`npm run release:patch` updates: `package.json`, `CHANGELOG.md`, `README.md`, `AGENTS.md`, `AGENTS-consumer.md`, `SKILLS.md`, `llms.txt`, Docusaurus guides.
+`npm run release:patch` updates: `package.json`, `CHANGELOG.md`, `README.md`, `AGENTS.md`, `AGENTS-consumer.md`, `SKILLS.md`, `llms.txt`, Docusaurus guides.

package/dist/CHANGELOG.md

@@ -6,6 +6,89 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 
 ## [Unreleased]
 
+Groundwork before the 4.1.0 publish. The notes under [4.1.0] are the cut. npm latest is still 4.0.42.
+
+## [4.1.0] - 2026-10-15
+
+Work on main after 4.0.42. The [4.0.43] section below is the earlier confer and hook cut. 4.0.43 was stamped and not published.
+
+### Bifrost board
+
+The board seats see is the collector board. `house/live/feed/live_mesh.py` runs the collector and the board every `LIVE_WATCH_S` seconds (default 45). An empty box board does not replace those cards.
+
+- A pull request or issue is one card. Reviews, merges, CI, pushes, reopens, drafts, and a quiet pull request land on that card. CI stays on the card and is not board traffic.
+- `merged_by` is the GitHub user who merged. A pulls list that omits `merged_by`, or that only has the author, is corrected with `GET /pulls/:n` (`house/live/feed/live_collect.py`). The author is not stored as the merger.
+- `live-inbox <seat> --card <owner/repo#n> --start-after <ISO>` parks the card until that time, then one inbox line wakes the owning seat. A GitHub comment whose first line is `Start after: <ISO>` sets the same field only when the comment is from the card owner or a fleet seat, and only within 30 days.
+- Handoff is `live-inbox <seat> --handoff <to> --pr <owner/repo#n> --kind <ready|critic_fail|live_pass|merge|ci_fail> --sha <head>`. `--sha` is 7 to 64 hex digits. The command posts one inbox packet and prints the 1:1 line. A room post does not clear a missing packet.
+- Railway deploy polls stamp BUILDING, then DEPLOYING, then the terminal status. A poll that first sees SUCCESS backfills the stages it missed.
+- Deploy goes through `house/live/app/deploy.sh`, which assembles `collector/`. A Railway build straight from git stops in the Dockerfile with `ERROR: collector/ is not assembled`.
+- A cloud agent is a board row (`cloud_agents`, also `board.cloud_agents` when a card board is present). Each row has `bcId`, owning seat, linked card, `pr` when the webhook sent one, state `running`, `finished`, or `failed`, and `updated_ct`. `POST /cursor/webhook` appends `agents.jsonl` after the signature check. `POST /activity` with kind `cloud_agent` or `agent` and action `launch`, `reply`, `finished`, or `cancel` is the other feed. Webhook `ERROR`, `FAILED`, `TIMED_OUT`, and `CANCELLED` are `failed`. The newest line sets the state. (#367)
+
+### Nudge
+
+`evalNudges` in `house/live/app/server.mjs` is the one nudge path.
+
+- A live card with no beat for `NUDGE_L1_S` (default 3600) sends L1 to the next owner, or else the card owner. L2 goes to the CoS role after `NUDGE_L2_S` (default 1800). L3 repeats to the L1 seat after `NUDGE_L3_S` (default 7200), and the CoS role is woken once to reassign.
+- An unacked inbox line steps L1, L2, and L3 on that same seat, `NUDGE_LINE_S` apart (default 900). The CoS role is woken at L3.
+- A missing handoff nudges the owing seat at L1, again at L2, and again at L3. The CoS role is woken once at L3.
+
+### Wake routine
+
+`grok-bot/templates/house/fleet/WAKE-ROUTINE.md` is the seat wake. Every turn runs `live-inbox <seat> --turn start`. Turn end runs on every exit. An owner message runs `live-inbox <seat> --prompt` first. Compaction is a wake: read Station, then NOTES, before the inbox. Notes are appended after every beat. Before launching a cloud agent for a card, the seat checks for one already running or finished with a pull request for that card.
+
+### live-inbox
+
+`house/live/tools/live-inbox` requires `LIVE_URL`, `SEAT_KEYS_DIR`, and `LIVE_CURSORS`. A missing or empty one exits 2 and names it. The tool does not guess. The installed copy is `$HOME/.burst/bin/live-inbox` unless `LIVE_INBOX_BIN` is set. The wake template ships the export line.
+
+### Lexicon
+
+`grok-bot/LEXICON.md` records the handoff `--sha` row and the practice **button up**: when weekly burn hits the hold line, every seat stops new work, runs no local builds, tests, or deploys on its own computer, pauses its Bifrost inbox wake until the reset, leaves only cloud agents for anything essential, and reports and acks in the room.
+
+### Nudge monitor
+
+`src/monitoring/nudge-watchdog.ts` is now `nudge-monitor.ts` (`NudgeMonitor`, `nudgeMonitor`, `getNudgeMonitor`) and the config key is `features.nudge_monitor`. The old key `features.nudge_watchdog` still works as a deprecated alias when `nudge_monitor` is unset (the new key wins if both are set) and logs a one-time deprecation warning. (#303)
+
+## [4.0.43] - 2026-10-12
+
+### 🔄 Changes
+
+- A Cursor pre-tool error denies the tool unless that error is EACCES. A cloud wrapper that cannot write dest still allows the tool.
+- Cursor gate events (preToolUse, beforeShellExecution, beforeReadFile) fail closed. A crashed gate, empty or malformed input, or a missing node or hook file denies the tool. The one exception is EACCES when a cloud wrapper cannot write dest, which still allows the tool. Wear and re-wear set failClosed on those events.
+- Hermes, OpenCode, OpenClaw, and Cursor run the lens and the repertoire route on the pre-tool allow path. The lens sees the tool path. A research call with no named plane stops. One named plane allows.
+- The shipped plant does not write the autonomous-reporting schedule or the post-tool light marker. Turn either switch on and the writer still runs. The inference cycle still starts from `inference:run`.
+- Consumer smoke inspects an empty machine home, so a Grok plugin on the real machine does not fail that seat.
+- OpenCode mill install copies the plugin and leaves leftover init.sh uncopied.
+- Gate C cannot be skipped. Gate D is proven only when npm lists the version, the annotated tag points at that commit, and the GitHub Release page exists. A local gate pass is not that proof.
+
+### 🐛 Bug Fixes
+- fix: stop the vendored complete-todo command from minting PASS (39c88c8fa)
+- fix: bind Confer receipts to a synthesis cycle (5134c5d05)
+- fix: treat ambiguous Confer text as UNREVIEWED (06acc24f1)
+- fix: complete Confer only on a real approve (8776562d7)
+- fix: parse only the first Confer DECISION token (c06747d95)
+- fix: keep Confer off unless it is explicitly enabled (8cd356c24). These confer fixes, and the no-LLM confer test below, are ancestors of the v4.0.42 tag. The new work in this stamp is the Cursor fail-closed cut (#255).
+
+### 🧪 Tests
+- test: lock no-LLM confer votes out of a PASS merge (e30628fef)
+
+---
+
+## [4.0.42] - 2026-10-09
+
+### 🔄 Changes
+
+Confer votes. Burst runs the swarm.
+
+- Confer asks the MCP servers the wearing chat already spawned. Only a real PASS completes the consult. A PASS that belongs to another session is asked again.
+- Wear pins Grok at the installed CLI. Hermes codex-check catches a console call. OpenClaw stays on the installed plugin. Cursor hooks stay on a git checkout.
+- Burst runs the swarm live. The board keeps an honest LIVE pill and one seat state. The box posts one delta while `push.sh` holds the lock, retries once on 409, and keeps the ingest secret in the header.
+- A SENT prompt holds that seat working for 10 minutes. A posted seat must match the installation token. Legacy prompt lines are still read from `fleet/prompts.jsonl`. Seats post a prompt with `live-inbox <seat> --prompt`.
+
+
+### Notes above this cut in the published package
+
+These notes were `[Unreleased]` in the 4.0.42 package. #368 removed them from `main`. They are not new in 4.1. `[4.0.22]` through `[4.0.41]` keep the short commit lines. This is the prose.
+
 ### Features
 - **Goggles.** Proposed plates for goggles, suit, kits, host pack, and glossary. Goggles views one plane. Recall opens a plate when speech names that plate. Plates only. Not a new skill.
 - **Plates.** Pipeline schematics live in `docs-site/docs/plates/` (routing, governance, boot, orchestration, processor, reporting, memory-recall). Station keeps one pointer line. Pre-compact and the `MEMORY_ROUTING` inject carry that one schematic. A lesson is an episode. A plate is the machine. Not a new skill.
@@ -42,6 +125,8 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 - Archive root `integrations/` costume SKILL dump → `docs/archive/integrations-costume/`. Live wear is `src/integrations`.
 - Archive root `commands/` stale copy → `docs/archive/commands-copy/`. Live wear is `src/opencode/commands`.
 
+---
+
 ## [4.0.41] - 2026-10-07
 
 ### 🔄 Changes

package/dist/LICENSE

@@ -18,4 +18,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+SOFTWARE.