0xray 4.0.41 → 4.1.0

package/dist/README.md

@@ -1,37 +1,45 @@
-# xray — exo for coding agents
+# xray — a suit for coding agents
 
-**4.0** — a suit that survives the context window
+![0xRay — A Power Suit for AI Agents. survive compaction. build foundries. monitor the swarm.](docs-site/static/img/readme-hero.jpg)
 
-![0xRay v4 exo — CONSTITUTION ON](docs-site/static/img/exo-skeleton-v4.jpg)
+**4.1** — a suit that survives the context window
 
-Not a catalog of agents. The product is the **skeleton you wear**.
+Bifrost is the live board. Goggles reads one named plane.
+
+0xRay is a three-subsystem autonomous engine. The suit is the wear. Inference remembers. External Governance judges. The Autonomous Engine runs the work. The host you already run wears it: Grok, OpenCode, Hermes, OpenClaw, or Cursor. Memory, judgement, and payments come on with the suit. When the window closes, the next session wakes with the job, the page, and the laws.
+
+Bifrost turns each pull request, issue, and comment into one card and a line in the right seat's inbox, then wakes that seat. Confer still completes only on a real yes. A foundry is built from mills and hangars. The mill builds and ships. The hangar is the shop.
+
+The product is the **skeleton you wear**.
 
 ## Your AI Power Suit
 
 **Your AI Power ⚡️ Suit 🦾** — an exoskeleton that blocks AI slop from becoming real damage.
 
-- **Bone** — three-subsystem OS: Inference · External Governance (Dynamo / Codex) · Autonomous Engine (thinDispatch)
+- **Bone** — three-subsystem engine: Inference · External Governance (Dynamo / Codex) · Autonomous Engine (thinDispatch)
 - **Always on** — Codex 11 / 29 / 69, destructive shell, no new MCP/skill/handler surface
 - **Temperament** — `frontier` | `guided` | `strict` | `auto` — how loud the engine is, not whether governance exists
 - **Wear** — Grok, OpenCode, Hermes, OpenClaw, plus Cursor project hooks. One SSOT gate
-- **Muscle** — **Repertoire is preferred.** Vendored 0.2.9 ships **on**. Dest is named laws, not hangar `repo-*` or git slugs. Station is the compact-survival ticket — not a substitute for Repertoire.
+- **Muscle** — **Repertoire is preferred.** Vendored 0.2.9 ships **on**. Dest is named laws, not hangar `repo-*` or git slugs. Station is the wake ticket — not a substitute for Repertoire.
 
 ```bash
 npm install 0xray
+npx 0xray wear
 ```
 
-Consumer `npm install 0xray` auto-wires four chat bridges, Cursor project hooks, and seven MCP servers. **Repertoire is preferred** — vendored **0.2.9** ships on: factory + stack laws, in-process routing, extra host MCP `repertoire`. Not an eighth `xray-*` server. Dest is a judgment index. Explicit opt-out only: `"enabled": false, "provider": "repertoire"`. Do not pin 0.1.8.
+`npm install 0xray` links vendored `@0xray/repertoire` and prints `npx 0xray wear`. It does not write `.mcp.json` or the chat bridges. Wear writes the consumer suit: managed `AGENTS.md`, `.xray` config, seven MCP servers, and the OpenCode, Grok, Hermes, and OpenClaw bridges (`install-bridges.cjs`). Inside a git checkout, wear also fastens Cursor project hooks. **Repertoire is preferred** — vendored **0.2.9** ships on: factory + stack laws, in-process routing, extra host MCP `repertoire`. Not an eighth `xray-*` server. Dest is a judgment index. Explicit opt-out only: `"enabled": false, "provider": "repertoire"`. Do not pin 0.1.8.
 
 ## Quick Start
 
 ```bash
-npm install 0xray # postinstall: mill+inspect plant + 4 bridges + 7 MCPs + AGENTS.md + .mcp.json
-npx 0xray status # verify install
-npx 0xray setup # optional: symlinks, hook extras
+npm install 0xray
+npx 0xray wear
+npx 0xray status
+npx 0xray setup --git-hooks # optional: git hooks only
 npx @0xray/foundry inspect --skip-live # mill receipt (chat is not a receipt)
 ```
 
-Manual per-platform install (idempotent, same result as postinstall):
+Manual per-platform install (idempotent, same bridges wear writes):
 
 ```bash
 npx 0xray opencode install
@@ -51,12 +59,50 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 
 | Version | Highlights |
 |---------|------------|
-| **Unreleased** | Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill declares (looker / vibe / mixer live in the mill). Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip\|sound` remain (0.1.11+). Shop plant first-class (`shop-extract`, `shop-witness`, `shop-pin` + `foundry.json` `shopPlant`). |
+| **4.1.0** | Bifrost is the collector board. A cloud agent is a board row. A stuck card's L2 nudge goes to the CoS role. `live-inbox` requires `LIVE_URL`, `SEAT_KEYS_DIR`, and `LIVE_CURSORS`. Goggles reads one named plane. |
+| **4.0.43** | Confer completes only on a real PASS. Cursor gate events fail closed, except EACCES when a cloud wrapper cannot write dest. Gate C cannot be skipped. |
+| **4.0.42** | Confer votes. Burst runs the swarm. |
+| **4.0.41** | Wake cascade stays on the station module. A fresh wear fastens mill and inspect. Goggles records the worn package path. The live page plays the mesh in the browser. |
+| **4.0.40** | Live mesh runs the full loop: feed watch, render, direction, deploy, health, and the ledger both ways. |
+| **4.0.39** | The seven stack laws stay worn. Repertoire in the suit is 0.2.9. |
+| **4.0.38** | Codex term 70 requires the current source and the worn npm package. Dynamo's recommendation is honored. |
+| **4.0.37** | A naked checkout wakes with repertoire on. |
+| **4.0.36** | Goggles holds the stop through search, read, and a dist wipe. |
+| **4.0.35** | Wear rewrites a checkout `dist/cli` launch to `node_modules/0xray`. |
+| **4.0.34** | The lens stays on the worn build when the source is not packed. |
+| **4.0.33** | Version bump. |
+| **4.0.32** | `0xray look` opens one plane. Digest and triage return the card. Calling and confer stay off. |
+| **4.0.31** | Goggles looks at one pipeline. Kind 0 stays quiet when the worn list matches the map. Calling and confer stay off. |
 | **4.0.30** | Fixes 4.0.29: `npx 0xray wear` and `setup` work outside a git checkout again. They write the 4.0.28 project setup, skip only Cursor hooks, and print one warning. Inside a git checkout they restore the 4.0.28 project setup, and `wear` adds Cursor hooks plus the unwear snapshot. Companion `@0xray/grok-bot` 0.1.8. Released 2026-09-28. |
 | **4.0.29** | `npm install` only creates the relative `node_modules/@0xray/repertoire` link to the vendored repertoire and prints `npx 0xray wear`. Run `npx 0xray wear` after install. Wear writes only the consumer project's `.cursor/hooks.json` (installed dist hooks, beside user entries); `npx 0xray unwear` restores the snapshot. Companion `@0xray/grok-bot` 0.1.8. Released 2026-09-28. |
 | **4.0.28** | MCP servers start through `scripts/node/mcp-launch.cjs` and only see PATH, HOME, XRAY_ROOT, plus names on their keep list. Tokens such as NPM_TOKEN are not inherited. User env values stay out of argv. Postinstall keeps user edits to AGENTS.md, .mcp.json, and opencode.json. `house init` does not copy EXAMPLE.md; doctor FAILs while `house/EXAMPLE.md` exists. Inspect adds a machinePlugin check. The Cursor hook defaults XRAY_ROOT to the suit. Companion `@0xray/grok-bot` 0.1.7. Released 2026-09-27. |
 | **4.0.27** | Host compact proof needs a generation id and a numeric usage percent, and the same preCompact receipt is mirrored to nested consumer wear roots. Memory scoring: [docs/memory-scoring.md](docs/memory-scoring.md) (orchestrator links it). Companion `@0xray/grok-bot` 0.1.6: general page vs `house/` overlay, `templates/house/`, `grok-bot house init`, doctor `GROK_BOT_HOUSE` or walk-up. Released 2026-09-26. |
+| **4.0.26** | A lesson is stored when the task matches no signal. A Cursor compact cut is proved with a session log and a per-session receipt. |
+| **4.0.25** | Plate schematics ship in the package. A worn suit resolves them from `dist/integrations/hooks/plates.cjs`. |
+| **4.0.24** | Compaction and a host change are the same cut. The station card is the handoff. Repertoire in that suit is 0.2.8. |
+| **4.0.23** | The Dynamo client starts when external governance is required. Proposals score locally when that governance is off. |
+| **4.0.22** | The stamper strips present-tense patch pins from shipped prose. The cursor gate follows the suit mill. |
+| **4.0.21** | Dest is named laws, not hangar slugs. Cleanup heat grows the project copy when Repertoire is on. |
+| **4.0.20** | Heat grows the project copy. Session boot rewrites when HEAD moves. |
+| **4.0.19** | Vendored Repertoire 0.2.5. Wear replaces older leftovers. |
+| **4.0.18** | Wake heat joins bookmark, index, and mind. |
+| **4.0.17** | Cursor heat writes session files when HEAD moves. |
+| **4.0.16** | `npx 0xray validate` is a wear check. |
+| **4.0.15** | Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill declares (looker / vibe / mixer live in the mill). Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip\|sound` remain (0.1.11+). Shop plant first-class (`shop-extract`, `shop-witness`, `shop-pin` + `foundry.json` `shopPlant`). |
+| **4.0.14** | Factory-blip beds stamp the hook cell and keep six tellable bodies. |
+| **4.0.13** | Station PreCompact merge keeps custom STATION.md keys. |
+| **4.0.12** | Project-scoped Grok plugin dest so multi-seat wear does not clobber the machine plugin. |
+| **4.0.11** | The npm pack includes `.grok-plugin/` so the Grok marketplace manifest ships. |
+| **4.0.10** | Version bump. |
 | **4.0.9** | Mill target: postinstall does not mill npm global prefix or `_npx` as a consumer. Isolated HOME skips machine `~/.grok`. |
+| **4.0.8** | Confer abstains locally instead of rubber-stamping a proposal. |
+| **4.0.7** | Nested mill 0.1.9. Inventory writes `dna`. The mill does not mint on chain. |
+| **4.0.6** | Nested mill 0.1.8. Isolated HOME skips machine Hermes and OpenClaw. |
+| **4.0.5** | Inspect is a mill command. A costume dump fails mint. Mill plant stays mill + inspect. |
+| **4.0.4** | Mill fastens an inspect suit. Costume is opt-in with `foundry.json` `"costume": true`. |
+| **4.0.3** | Their plant is the suit. The mill plant is the factory discipline on the hanger. |
+| **4.0.2** | The nested mill ships in the 0xray tarball. `@0xray/foundry` stays the standalone mill CLI. |
+| **4.0.1** | CLI `--version` no longer dumps a Commander stack. The release gate smokes the organ and does not run another publish from a lifecycle script. |
 | **4.0.0** | Exo + temperament. Constitution always on; ceremony by host. Repertoire organ on (vendored 0.2). Station card survives compact/host-swap. **On npm.** [vision](docs-site/docs/architecture/v4-vision.md) · [now](docs-site/docs/architecture/v4-now.md) |
 | **3.4.1** | Unified `install-bridges.cjs` on postinstall — OpenCode, Grok, Hermes, OpenClaw in one pass. All 7 MCPs servers via `npx -y 0xray mcp <cmd>` (no `dist/` paths). Canonical `release.mjs` pipeline. |
 | **3.3.1** | Orchestrator confidence gate wired into execution planning. |
@@ -102,9 +148,9 @@ Docs: [guides/autonomy-command](docs-site/docs/guides/autonomy-command.md) · Sk
 - **External Governance** — Dynamo Solar SSOT; CodexPolicyService; weighted PHI/TAU deliberation.
 - **Autonomous Engine** — thinDispatch 7-flow routing; orchestrator confidence gate (v3.3.1).
 
-## Consumer Install (postinstall)
+## Consumer Install (wear)
 
-On `npm install 0xray` in a consumer project, postinstall automatically:
+`npm install 0xray` links the vendored repertoire and prints `npx 0xray wear`. Wear then:
 
 1. Copies **`AGENTS-consumer.md` → `AGENTS.md`**. Does **not** write consumer-root **`SKILLS.md`**.
 2. Fastens **mill plant** (`mill` + `inspect`). Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares — organs (looker, vibe, mixer) live in the mill, not an xray catalog. Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip|sound` still exist on foundry 0.1.11+; fasten is the new cut. Not a 45-skill / 42-agent costume dump. `foundry.json` `"costume": true` is the opt-in dump.
@@ -113,7 +159,7 @@ On `npm install 0xray` in a consumer project, postinstall automatically:
 5. Writes project **`.mcp.json`** with 7 MCPs servers (`npx -y 0xray mcp …`)
 6. Installs **4 chat bridges**: OpenCode, Grok, Hermes, OpenClaw, plus **Cursor** `.cursor/hooks.json` (PPE + wiring; mill plant, not costume)
 7. Factory shop plant (`shop-extract`, `shop-witness`, `shop-pin` from groover-hangar) may coexist when worn. Extra shops: `foundry.json` `shopPlant`. Not costume.
-8. Installs git pre-commit hook (non-blocking if not a git repo)
+8. Inside a git checkout, fastens Cursor `.cursor/hooks.json` and the hook scripts, and keeps an unwear snapshot. Outside a git checkout, skips those hooks and prints one warning. `npx 0xray setup --git-hooks` is what installs git hooks.
 
 See [llms.txt](llms.txt) for the agent map. Catalog of 45 skills lives in [SKILLS.md](SKILLS.md) — that is the exo catalog, not default consumer wear.
 
@@ -186,13 +232,13 @@ Docs: [memory routing](docs-site/docs/guides/memory-routing.md) · [Repertoire](
 
 ## Integrations
 
-| Platform | Install | Postinstall behavior |
+| Platform | Install | What that command writes |
 |----------|---------|----------------------|
 | **OpenCode** | `npx 0xray opencode install` | Merges `opencode.json`, copies agent YML surfaces |
 | **Grok CLI / Build** | `npx 0xray grok install` | Project `.grok/plugins/0xray` (shared HOME does not clobber machine plugin), 7 MCPs servers |
 | **Hermes Agent** | `npx 0xray hermes install` | `~/.hermes/plugins/xray-hermes`, consumer root marker |
 | **OpenClaw** | `npx 0xray openclaw install` | `.xray/config/openclaw.json`, skill sync |
-| **Cursor** | postinstall (`installCursorBridge`) | Fastens `.cursor/hooks.json` + relative `.cursor/hooks/*.sh`. Rewrites leftover env-assignment one-liners. Not a fifth chat TUI. |
+| **Cursor** | `npx 0xray wear` inside a git checkout | Fastens `.cursor/hooks.json` + relative `.cursor/hooks/*.sh`. Rewrites leftover env-assignment one-liners. Not a fifth chat TUI. |
 
 ## Governance & Codex
 
@@ -219,7 +265,7 @@ npm run release:npm # gate + prepare + npm publish --access public
 
 ## Release
 
-The **4.0** line is on npm. Do **not** run `release:major` to ship a 4.x fix (that becomes 5.0.0). Do **not** put a `scripts.publish` lifecycle that re-runs the gate after the registry PUT. Patch number lives in `package.json` + CHANGELOG.
+The **4.1** line is on npm. Do **not** run `release:major` to ship a 4.x fix (that becomes 5.0.0). Do **not** put a `scripts.publish` lifecycle that re-runs the gate after the registry PUT. Patch number lives in `package.json` + CHANGELOG.
 
 ```bash
 npm run release:gate
@@ -235,4 +281,4 @@ MIT — see [LICENSE](LICENSE)
 
 ---
 
-*xray — MCP-centric, governed, autonomous. Pure v2 three-subsystem.*
+*xray — a three-subsystem autonomous engine. The suit is the wear.*

package/dist/SKILLS.md

@@ -1,6 +1,10 @@
 # 0xray Skills
 
-**4.0** — a suit that survives the context window
+**4.1** — a suit that survives the context window
+
+Confer votes. Burst runs the swarm.
+
+0xRay is a three-subsystem autonomous engine. The suit is the wear. This file is the catalog.
 
 **45 skills** in this exo catalog. Default consumer plant is **`mill` + `inspect`**, not this dump. `npm install 0xray` does **not** sync 45 skills unless `foundry.json` `"costume": true`. Factory shop plant (`shop-extract`, `shop-witness`, `shop-pin`) coexists with mill plant when a hangar wears those shops. Extra shops: `foundry.json` `shopPlant`. Fasten is **foundry-plant/0**: builtin plant is mill+inspect only. `foundry.json` `"plant": "@0xray/blip"` (aliases `"plant": "blip"` / `"plant": "sound"`) fastens whatever that mill package declares — organs (looker, vibe, mixer) live in the mill, not this catalog. Nested mill `@0xray/foundry@0.1.12`. CLI shims `foundry blip|sound` still exist on foundry 0.1.11+. Agent map: [llms.txt](llms.txt).
 

package/dist/cli/commands/openclaw-install.js

@@ -69,7 +69,7 @@ async function installForOpenClaw(options = {}) {
             /* session-boot is best-effort */
         }
         const packageRoot = path.resolve(__dirname, '..', '..', '..');
-        const hookInstalled = isolated ? null : wiring.installOpenClawHostWear(packageRoot);
+        const hookInstalled = isolated ? null : wiring.installOpenClawHostWear(packageRoot, targetDir);
         const cliBackend = isolated ? false : wiring.maybeWriteOpenClawCliBackend();
         frameworkLogger.log('openclaw-integration', 'cli-backend', 'info', { written: cliBackend });
         if (hookInstalled) {

package/dist/cli/commands/plugin-commands.d.ts

@@ -16,3 +16,7 @@ export declare function pluginEnableCommand(pluginName: string): Promise<void>;
 export declare function pluginDisableCommand(pluginName: string): Promise<void>;
 export declare function pluginStatusCommand(pluginName: string): Promise<void>;
 export declare function pluginUninstallCommand(pluginName: string): Promise<void>;
+type YamlMap = Record<string, unknown>;
+/** Subset of YAML used by plugin.yaml: maps, scalar lists, and lists of maps. */
+export declare function parseYaml(content: string): YamlMap;
+export {};

package/dist/cli/commands/plugin-commands.js

@@ -152,24 +152,25 @@ export async function pluginStatusCommand(pluginName) {
     console.log(`  Type:        ${m.type}`);
     console.log(`  Description: ${m.description}`);
     console.log(`  License:     ${m.license || "N/A"}`);
-    if (m.capabilities) {
+    if (Array.isArray(m.capabilities)) {
         console.log("\n  Capabilities:");
         for (const cap of m.capabilities) {
-            console.log(`    - ${cap}`);
+            console.log(`    - ${String(cap)}`);
         }
     }
-    if (m.tools) {
+    if (Array.isArray(m.tools)) {
         console.log("\n  Tools:");
         for (const tool of m.tools) {
-            console.log(`    - ${tool.name}: ${tool.description}`);
+            const row = tool;
+            console.log(`    - ${String(row.name)}: ${String(row.description)}`);
         }
     }
-    if (m.runtime) {
+    if (m.runtime && typeof m.runtime === "object" && !Array.isArray(m.runtime)) {
         const runtime = m.runtime;
         console.log("\n  Runtime:");
-        console.log(`    Command: ${runtime.command}`);
-        if (runtime.args) {
-            console.log(`    Args:    ${runtime.args.join(" ")}`);
+        console.log(`    Command: ${String(runtime.command)}`);
+        if (Array.isArray(runtime.args)) {
+            console.log(`    Args:    ${runtime.args.map((arg) => String(arg)).join(" ")}`);
         }
     }
     console.log("\n" + "═".repeat(50) + "\n");
@@ -195,51 +196,93 @@ function validateManifest(manifest) {
         }
     }
 }
-function parseYaml(content) {
-    const lines = content.split("\n");
-    const result = {};
-    let currentKey = "";
-    const stack = [
-        { indent: -1, obj: result },
-    ];
-    for (const line of lines) {
+function parseScalar(raw) {
+    const value = raw.trim();
+    if ((value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'"))) {
+        return value.slice(1, -1);
+    }
+    if (value.startsWith("[") && value.endsWith("]")) {
+        const inner = value.slice(1, -1).trim();
+        if (!inner)
+            return [];
+        return inner.split(",").map((part) => parseScalar(part));
+    }
+    if (value === "true")
+        return true;
+    if (value === "false")
+        return false;
+    if (/^-?\d+$/.test(value))
+        return Number(value);
+    return value;
+}
+/** Subset of YAML used by plugin.yaml: maps, scalar lists, and lists of maps. */
+export function parseYaml(content) {
+    const root = {};
+    const stack = [{ indent: -1, container: root }];
+    for (const line of content.split("\n")) {
         const trimmed = line.trim();
         if (!trimmed || trimmed.startsWith("#"))
             continue;
         const indent = line.search(/\S/);
-        const isListItem = trimmed.startsWith("- ");
-        if (isListItem) {
-            const value = trimmed.slice(2).trim();
+        while (stack.length > 1) {
             const top = stack[stack.length - 1];
-            if (top && currentKey && !Array.isArray(top.obj[currentKey])) {
-                top.obj[currentKey] = [];
-            }
-            if (top && currentKey) {
-                top.obj[currentKey].push(value);
-            }
-            continue;
+            if (!top || indent > top.indent)
+                break;
+            stack.pop();
         }
-        const colonIndex = trimmed.indexOf(":");
-        if (colonIndex > 0) {
-            const key = trimmed.slice(0, colonIndex).trim();
-            const value = trimmed.slice(colonIndex + 1).trim();
-            const top = stack[stack.length - 1];
-            while (top && stack.length > 1 && indent <= top.indent) {
+        if (trimmed.startsWith("- ")) {
+            let owner = stack[stack.length - 1];
+            if (owner &&
+                !Array.isArray(owner.container) &&
+                Object.keys(owner.container).length === 0 &&
+                stack.length > 1) {
+                const holder = stack[stack.length - 2];
+                const emptyIndent = owner.indent;
                 stack.pop();
+                if (holder && !Array.isArray(holder.container) && holder.key) {
+                    const list = [];
+                    holder.container[holder.key] = list;
+                    stack.push({ indent: emptyIndent, container: list });
+                }
+                owner = stack[stack.length - 1];
             }
-            const current = stack[stack.length - 1];
-            if (!current)
+            if (!owner || !Array.isArray(owner.container))
                 continue;
-            const parent = current.obj;
-            if (value) {
-                parent[key] = value;
+            const rest = trimmed.slice(2).trim();
+            const colon = rest.indexOf(":");
+            const quoted = rest.startsWith('"') || rest.startsWith("'");
+            if (!quoted && colon > 0) {
+                const item = {};
+                const key = rest.slice(0, colon).trim();
+                const value = rest.slice(colon + 1).trim();
+                item[key] = value ? parseScalar(value) : {};
+                owner.container.push(item);
+                stack.push({ indent, container: item, key });
             }
             else {
-                parent[key] = {};
-                stack.push({ indent, obj: parent[key] });
+                owner.container.push(parseScalar(rest));
             }
-            currentKey = key;
+            continue;
+        }
+        const colonIndex = trimmed.indexOf(":");
+        if (colonIndex <= 0)
+            continue;
+        const key = trimmed.slice(0, colonIndex).trim();
+        const value = trimmed.slice(colonIndex + 1).trim();
+        const current = stack[stack.length - 1];
+        if (!current || Array.isArray(current.container))
+            continue;
+        if (value) {
+            current.container[key] = parseScalar(value);
+            current.key = key;
+        }
+        else {
+            const child = {};
+            current.container[key] = child;
+            current.key = key;
+            stack.push({ indent, container: child });
         }
     }
-    return result;
+    return root;
 }

package/dist/cli/index.js

@@ -116,6 +116,18 @@ program
     .action((args) => {
     runGoggles(args);
 });
+program
+    .command("confer")
+    .argument("<state>", "on or off")
+    .description("Turn confer on or off in .xray/features.json. A missing key stays off until this runs.")
+    .action((state) => {
+    try {
+        runNodeScript("confer-switch.cjs", [state]);
+    }
+    catch {
+        process.exit(1);
+    }
+});
 program
     .command("wear")
     .description("Wear the 0xray suit in this git checkout")

package/dist/core/config-loader.js

@@ -93,9 +93,9 @@ export class XrayConfigLoader {
         }
         const cfg = config;
         return {
-            enabled: typeof cfg.enabled === 'boolean' ? cfg.enabled : true,
+            enabled: typeof cfg.enabled === 'boolean' ? cfg.enabled : false,
             interval_minutes: Math.max(5, Math.min(1440, typeof cfg.interval_minutes === 'number' ? cfg.interval_minutes : 60)),
-            auto_schedule: typeof cfg.auto_schedule === 'boolean' ? cfg.auto_schedule : true,
+            auto_schedule: typeof cfg.auto_schedule === 'boolean' ? cfg.auto_schedule : false,
             include_health_assessment: typeof cfg.include_health_assessment === 'boolean' ? cfg.include_health_assessment : true,
             include_agent_activities: typeof cfg.include_agent_activities === 'boolean' ? cfg.include_agent_activities : true,
             include_pipeline_operations: typeof cfg.include_pipeline_operations === 'boolean' ? cfg.include_pipeline_operations : true,
@@ -123,9 +123,9 @@ export class XrayConfigLoader {
                 session_persistence: true,
             },
             autonomous_reporting: {
-                enabled: true,
+                enabled: false,
                 interval_minutes: 60,
-                auto_schedule: true,
+                auto_schedule: false,
                 include_health_assessment: true,
                 include_agent_activities: true,
                 include_pipeline_operations: true,

package/dist/core/features-config.d.ts

@@ -406,7 +406,7 @@ export interface FeaturesConfig {
         enabled?: boolean;
     };
     memory_routing?: MemoryRoutingConfig;
-    /** P2.2 — lightweight Grok write-tool postprocessor marker */
+    /** Marker is opt-in and the shipped default is off. */
     grok_postprocessor_light?: boolean;
     /** P2 — git post-commit session inference capture */
     inference_session_capture?: {

package/dist/core/features-config.js

@@ -342,9 +342,9 @@ export class FeaturesConfigLoader {
                 no_new_surface: true,
             },
             autonomous_reporting: {
-                enabled: true,
+                enabled: false,
                 interval_minutes: 60,
-                auto_schedule: true,
+                auto_schedule: false,
                 include_health_assessment: true,
                 include_agent_activities: true,
                 include_pipeline_operations: true,
@@ -410,7 +410,7 @@ export class FeaturesConfigLoader {
                 max_cache_size_mb: 50,
             },
             inference: {
-                description: "Self-improvement cycle that grades a new named session into repertoire",
+                description: "The cycle runs from the CLI command inference:run and the session wake does not start it.",
                 enabled: true,
                 workflow_dir: ".xray/inference",
                 reports_dir: ".xray/reports",

package/dist/enforcement/index.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Enforcement entry. The Hermes bridge loads ValidatorRegistry from this file.
+ */
+export { ValidatorRegistry, globalValidatorRegistry, } from "./validators/index.js";

package/dist/enforcement/index.js

@@ -0,0 +1,4 @@
+/**
+ * Enforcement entry. The Hermes bridge loads ValidatorRegistry from this file.
+ */
+export { ValidatorRegistry, globalValidatorRegistry, } from "./validators/index.js";

package/dist/enforcement/validators/code-quality-validators.js

@@ -322,13 +322,15 @@ export class ConsoleLogUsageValidator extends BaseValidator {
     severity = "error";
     async validate(context) {
         const { newCode } = context;
-        // Skip validation if no code to check
         if (!newCode) {
             return this.createSuccessResult("No code to validate for console.log usage");
         }
-        // Check for console.log usage
-        if (newCode.includes("await frameworkLogger.log('rule-enforcer', '-return-passed-false-message-console-log-', 'info', { message: ")) {
-            return this.createFailureResult("await frameworkLogger.log('rule-enforcer', '-', 'info', { message:  } }); detected - use frameworkLogger for production logs or remove for debugging");
+        const codeWithoutComments = newCode
+            .replace(/\/\/.*$/gm, "")
+            .replace(/\/\*[\s\S]*?\*\//g, "");
+        const consoleCall = /console\.(?:log|debug|info|warn|error|trace)\s*\(/;
+        if (consoleCall.test(codeWithoutComments)) {
+            return this.createFailureResult("console method detected — use frameworkLogger", ["Use frameworkLogger instead of console methods"]);
         }
         return this.createSuccessResult("Console log usage follows proper guidelines");
     }

package/dist/governance/llm-governance-provider.d.ts

@@ -1,4 +1,9 @@
-export type GovernanceRole = "code-review" | "security-audit" | "researcher";
+export type GovernanceRole = "code-review" | "security-audit" | "researcher" | "architect";
+export type GovernanceMiss = "not-configured" | "error" | "timeout" | "empty" | "unparseable";
+export interface GovernanceAttempt {
+    vote: GovernanceVote | null;
+    miss: GovernanceMiss | null;
+}
 export interface GovernanceVote {
     decision: "approve" | "reject" | "abstain";
     confidence: number;
@@ -7,6 +12,7 @@ export interface GovernanceVote {
 export declare function resolveHermesBin(): string;
 export declare function isGovernanceLlmConfigured(): boolean;
 export declare function hermesCliAvailable(): boolean;
+export declare function attemptLLMGovernance(role: GovernanceRole, proposalTitle: string, proposalDescription: string, evidence: string[], proposalType: string): Promise<GovernanceAttempt>;
 export declare function tryLLMGovernance(role: GovernanceRole, proposalTitle: string, proposalDescription: string, evidence: string[], proposalType: string): Promise<GovernanceVote | null>;
 export declare function checkHermesOAuthStatus(): {
     configured: boolean;

package/dist/governance/llm-governance-provider.js

@@ -41,6 +41,19 @@ Respond with a structured vote in exactly this format:
 DECISION: approve|reject|abstain
 CONFIDENCE: <0.0-1.0>
 REASONING: <2-4 sentence analysis of the proposal's broader project impact>`,
+    architect: `You are a senior architect on a governance committee for a software project. Analyze the following proposal and architecture assessment.
+
+Consider:
+- Does the change fit the existing architecture?
+- Does it raise coupling, complexity, or scaling risk?
+- Should the work stop until a structural problem is fixed?
+
+Respond with a structured vote in exactly this format:
+DECISION: approve|reject|abstain
+CONFIDENCE: <0.0-1.0>
+REASONING: <2-4 sentence analysis>
+
+reject means the architecture should not proceed.`,
 };
 function resolveHermesProvider() {
     return process.env.HERMES_PROVIDER?.trim() || DEFAULT_HERMES_PROVIDER;
@@ -151,18 +164,43 @@ function runHermesGovernanceInference(prompt, config) {
         maxBuffer: 10 * 1024 * 1024,
     }).trim();
 }
+function sanitizeVoteReasoning(reasoning) {
+    return reasoning
+        .split("\n")
+        .map((line) => /^\s*(?:[-*•]\s*)?(?:Verdict:|DECISION:)/i.test(line) ? `> ${line.trim()}` : line)
+        .join("\n")
+        .trim();
+}
 function parseVote(text) {
-    const decisionMatch = text.match(/DECISION:\s*(approve|reject|abstain)/i);
-    const confidenceMatch = text.match(/CONFIDENCE:\s*([0-9.]+)/i);
-    const reasoningMatch = text.match(/REASONING:\s*(.+)/is);
-    if (!decisionMatch || !decisionMatch[1])
+    // First exact token before REASONING. The prompt menu and anything the model
+    // writes inside the reasoning body are not a second vote.
+    const lines = text.split("\n");
+    const reasoningIdx = lines.findIndex((line) => /^REASONING:/i.test(line.trim()));
+    const headerLines = reasoningIdx < 0 ? lines : lines.slice(0, reasoningIdx);
+    let decisionWord;
+    for (const line of headerLines) {
+        const match = line.trim().match(/^DECISION:\s*(approve|reject|abstain)\s*$/i);
+        if (match?.[1]) {
+            decisionWord = match[1];
+            break;
+        }
+    }
+    if (!decisionWord)
         return null;
+    const header = headerLines.join("\n");
+    const confidenceMatch = header.match(/CONFIDENCE:\s*([0-9.]+)/i);
     const rawConfidence = confidenceMatch?.[1];
     const confidence = rawConfidence ? parseFloat(rawConfidence) : 0.5;
+    const reasoningBody = reasoningIdx < 0
+        ? ""
+        : lines
+            .slice(reasoningIdx)
+            .join("\n")
+            .replace(/^REASONING:\s*/i, "");
     return {
-        decision: decisionMatch[1].toLowerCase(),
-        confidence: isNaN(confidence) ? 0.5 : Math.min(1, Math.max(0, confidence)),
-        reasoning: reasoningMatch?.[1]?.trim() || "No reasoning provided",
+        decision: decisionWord.toLowerCase(),
+        confidence: Number.isNaN(confidence) ? 0.5 : Math.min(1, Math.max(0, confidence)),
+        reasoning: sanitizeVoteReasoning(reasoningBody) || "No reasoning provided",
     };
 }
 async function callDirectLlm(role, config, proposalTitle, proposalDescription, evidence, proposalType) {
@@ -209,11 +247,28 @@ Please provide your structured vote.`;
     const message = choices?.[0]?.message;
     return message?.content ?? null;
 }
-export async function tryLLMGovernance(role, proposalTitle, proposalDescription, evidence, proposalType) {
+function missFromThrown(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const code = typeof error === "object" && error !== null && "code" in error
+        ? String(error.code ?? "")
+        : "";
+    const killed = typeof error === "object" &&
+        error !== null &&
+        "killed" in error &&
+        error.killed === true;
+    if (code === "ETIMEDOUT" || killed || /ETIMEDOUT|timed out/i.test(message)) {
+        return "timeout";
+    }
+    if (/invalid_grant|not configured|unauthorized|no credentials|authentication/i.test(message)) {
+        return "not-configured";
+    }
+    return "error";
+}
+export async function attemptLLMGovernance(role, proposalTitle, proposalDescription, evidence, proposalType) {
     const config = getConfig();
     if (!config) {
         process.stderr.write(`[llm] no config for role=${role}\n`);
-        return null;
+        return { vote: null, miss: "not-configured" };
     }
     if (config.mode === "hermes") {
         process.stderr.write(`[llm] using hermes -z provider=${config.provider} model=${config.model}\n`);
@@ -230,12 +285,12 @@ export async function tryLLMGovernance(role, proposalTitle, proposalDescription,
         const content = config.mode === "hermes"
             ? runHermesGovernanceInference(buildGovernancePrompt(role, proposalTitle, proposalDescription, evidence, proposalType), config)
             : await callDirectLlm(role, config, proposalTitle, proposalDescription, evidence, proposalType);
-        if (!content) {
+        if (!content?.trim()) {
             frameworkLogger.log("llm-governance", "parse", "warning", {
                 issue: "missing content in response",
                 role,
             });
-            return null;
+            return { vote: null, miss: "empty" };
         }
         const vote = parseVote(content);
         if (!vote) {
@@ -244,23 +299,26 @@ export async function tryLLMGovernance(role, proposalTitle, proposalDescription,
                 snippet: content.slice(0, 200),
                 role,
             });
-            return null;
+            return { vote: null, miss: "unparseable" };
         }
         frameworkLogger.log("llm-governance", "vote", "success", {
             role,
             decision: vote.decision,
             confidence: vote.confidence,
         });
-        return vote;
+        return { vote, miss: null };
     }
     catch (error) {
         frameworkLogger.log("llm-governance", "error", "error", {
             error: String(error),
             role,
         });
-        return null;
+        return { vote: null, miss: missFromThrown(error) };
     }
 }
+export async function tryLLMGovernance(role, proposalTitle, proposalDescription, evidence, proposalType) {
+    return (await attemptLLMGovernance(role, proposalTitle, proposalDescription, evidence, proposalType)).vote;
+}
 export function checkHermesOAuthStatus() {
     const direct = getDirectLlmConfig();
     if (direct) {