0xray 4.0.42 → 4.1.0

package/scripts/foundry/release-gate.mjs

@@ -3,10 +3,12 @@
  * release-gate.mjs — Single release checkpoint.
  *
  * Modes:
- *   (default)     build + test + consumer smoke (fresh + upgrade merge)
+ *   (default)     build + test + docs + consumer smoke (fresh + upgrade merge)
  *   --verify-only git + reconcile + release docs + consumer smoke — after push, before publish
  *   --skip-smoke  skip consumer install smoke
- *   --skip-docs   skip release docs validation (not recommended for publish)
+ *   --prove-published  Gate D only: npm lists this version, the annotated tag points at HEAD,
+ *                      and the GitHub Release exists. This command does not publish.
+ *   --skip-docs   refused. Gate C runs on every gate.
  *
  * Usage:
  *   npx @0xray/foundry gate
@@ -21,7 +23,7 @@ import { isXrayExoRepo, millScript, readRootPackage, resolveMillRoot } from "./m
 const rootDir = resolveMillRoot();
 const verifyOnly = process.argv.includes("--verify-only");
 const skipSmoke = process.argv.includes("--skip-smoke");
-const skipDocs = process.argv.includes("--skip-docs");
+const provePublished = process.argv.includes("--prove-published");
 
 function step(label, cmd) {
   console.log(`\n${"─".repeat(60)}\n🔄 ${label}\n${"─".repeat(60)}\n`);
@@ -32,18 +34,114 @@ function docsCheckCmd() {
   return `${JSON.stringify(process.execPath)} ${JSON.stringify(millScript("validate-release-docs.mjs"))}`;
 }
 
+
+/** Gate C is the docs check. A ship gate that skips it is not a pass. */
+export function gateCRefusal(argv = process.argv) {
+  if (argv.includes("--skip-docs")) {
+    return "Gate C cannot be skipped. Remove --skip-docs. The docs check runs on every gate.";
+  }
+  return null;
+}
+
+/**
+ * Gate D facts. listed, tagAnnotated, and tagMatchesHead are booleans.
+ * releaseUrl is the GitHub Release page, or empty when that page is missing.
+ */
+export function provePublishedRelease(proof) {
+  const version = proof.version;
+  const errors = [];
+  if (proof.listed !== true) errors.push(`npm does not list ${version}`);
+  if (proof.tagAnnotated !== true) errors.push(`annotated tag v${version} is missing`);
+  if (proof.tagMatchesHead !== true) errors.push(`annotated tag v${version} does not point at HEAD`);
+  if (typeof proof.releaseUrl !== "string" || proof.releaseUrl.length === 0) {
+    errors.push(`GitHub Release v${version} is missing`);
+  }
+  return errors;
+}
+
+function gitOut(cmd) {
+  return execSync(cmd, { cwd: rootDir, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+}
+
+function originSlug() {
+  const url = gitOut("git remote get-url origin");
+  const match = url.match(/github\.com[:/]([^/]+)\/([^/.]+)(?:\.git)?$/);
+  if (!match) throw new Error(`origin is not a GitHub repo: ${url}`);
+  return { owner: match[1], repo: match[2] };
+}
+
+function collectPublishedProof() {
+  const pkg = readRootPackage(rootDir);
+  const version = pkg.version;
+  const name = pkg.name;
+  let listed = false;
+  try {
+    const view = gitOut(`npm view ${name}@${version} version`);
+    listed = view.split(/\s+/).includes(version);
+  } catch {
+    listed = false;
+  }
+  let tagAnnotated = false;
+  let tagMatchesHead = false;
+  try {
+    tagAnnotated = gitOut(`git cat-file -t v${version}`) === "tag";
+    const tagged = gitOut(`git rev-parse v${version}^{}`);
+    const head = gitOut("git rev-parse HEAD");
+    tagMatchesHead = tagAnnotated && tagged === head;
+  } catch {
+    tagAnnotated = false;
+    tagMatchesHead = false;
+  }
+  let releaseUrl = "";
+  try {
+    const { owner, repo } = originSlug();
+    const body = gitOut(
+      `curl -fsS -H "Accept: application/vnd.github+json" -H "User-Agent: 0xray-release-gate" https://api.github.com/repos/${owner}/${repo}/releases/tags/v${version}`,
+    );
+    const parsed = JSON.parse(body);
+    releaseUrl = typeof parsed.html_url === "string" ? parsed.html_url : "";
+  } catch {
+    releaseUrl = "";
+  }
+  return { version, name, listed, tagAnnotated, tagMatchesHead, releaseUrl };
+}
+
+function runProvePublished() {
+  const proof = collectPublishedProof();
+  const errors = provePublishedRelease(proof);
+  process.stdout.write(`\nGate D — ${proof.name}@${proof.version}\n`);
+  if (errors.length) {
+    for (const error of errors) process.stderr.write(`❌ ${error}\n`);
+    process.stderr.write("\n❌ GATE D FAILED — npm listing, annotated tag at HEAD, and GitHub Release are all required\n\n");
+    process.exit(1);
+  }
+  process.stdout.write(`✅ npm lists ${proof.version}\n`);
+  process.stdout.write(`✅ annotated tag v${proof.version} points at HEAD\n`);
+  process.stdout.write(`✅ GitHub Release ${proof.releaseUrl}\n`);
+  process.stdout.write("\n✅ GATE D PROVEN\n\n");
+}
+
 function runLightGate() {
   const pkg = readRootPackage(rootDir);
   if (verifyOnly) {
-    if (!skipDocs) step("1/1 Release docs (light)", docsCheckCmd());
+    step("1/1 Release docs (light)", docsCheckCmd());
     return;
   }
   if (pkg.scripts.build) step("1/3 Build", "npm run build");
   if (pkg.scripts.test) step("2/3 Tests", "npm test");
-  if (!skipDocs) step("3/3 Release docs (light)", docsCheckCmd());
+  step("3/3 Release docs (light)", docsCheckCmd());
 }
 
 function main() {
+  const refused = gateCRefusal();
+  if (refused) {
+    process.stderr.write(`\n❌ ${refused}\n\n`);
+    process.exit(1);
+  }
+  if (provePublished) {
+    runProvePublished();
+    return;
+  }
   const mode = verifyOnly ? "verify" : "full";
   console.log("\n╔════════════════════════════════════════════════════════╗");
   console.log(`║        🛡️  0xRay Release Gate (${mode})`.padEnd(57) + "║");
@@ -54,9 +152,7 @@ function main() {
       runLightGate();
     } else if (verifyOnly) {
       step("1/6 Git + reconcile", "node scripts/node/pre-publish-guard.js --verify-only");
-      if (!skipDocs) {
-        step("2/6 Release docs", docsCheckCmd());
-      }
+      step("2/6 Release docs", docsCheckCmd());
       step(
         "3/6 Plugin infrastructure",
         "node scripts/test/validate-plugins-e2e.cjs --structural-only",
@@ -75,9 +171,7 @@ function main() {
         `${JSON.stringify(process.execPath)} ${JSON.stringify(millScript("assert-packed-dist-cli.mjs"))}`,
       );
       step("3/8 Tests", "npm run test:comprehensive");
-      if (!skipDocs) {
-        step("4/8 Release docs", docsCheckCmd());
-      }
+      step("4/8 Release docs", docsCheckCmd());
       step(
         "5/8 Consumer hook verifiers",
         "npm run verify:pre-commit-diff && npm run verify:pre-push-diff && node scripts/mjs/verify-delegation-gate-core.mjs --host=grok && node scripts/mjs/verify-delegation-gate-core.mjs --host=hermes && node scripts/mjs/verify-delegation-gate-core.mjs --host=opencode && node scripts/mjs/verify-hermes-session-start.mjs && node scripts/mjs/verify-confer-core.mjs && npm run verify:user-aside && npm run build && node scripts/mjs/verify-pipeline-facets.mjs --package-only",
@@ -91,9 +185,11 @@ function main() {
       }
     }
 
-    console.log("\n╔════════════════════════════════════════════════════════╗");
-    console.log("║  ✅ RELEASE GATE PASSED                                ║");
-    console.log("╚════════════════════════════════════════════════════════╝\n");
+    process.stdout.write("\n╔════════════════════════════════════════════════════════╗\n");
+    process.stdout.write("║  ✅ GATE A–C LOCAL PASS                                ║\n");
+    process.stdout.write("║  Gate D is not proven by this command.                 ║\n");
+    process.stdout.write("╚════════════════════════════════════════════════════════╝\n");
+    process.stdout.write("Prove D after publish: npx @0xray/foundry gate --prove-published\n\n");
   } catch {
     console.error("\n❌ RELEASE GATE FAILED — do not tag or publish\n");
     process.exit(1);
@@ -105,4 +201,4 @@ const isMain =
 
 if (isMain) {
   main();
-}
+}

package/scripts/foundry/release.mjs

@@ -191,6 +191,8 @@ async function main() {
       }
     }
     run(`git push origin v${version}`, "push tag");
+    say("Step 8: Gate D");
+    runMill("release-gate.mjs", ["--prove-published"], "gate D");
     return;
   }
 
@@ -281,6 +283,12 @@ async function main() {
     console.log(`  would: git tag -a v${newVersion}`);
   }
   run(`git push origin v${newVersion}`, "push tag");
+  say("Step 8: Gate D");
+  runMill("release-gate.mjs", ["--prove-published"], "gate D");
+  if (dryRun) {
+    say("Dry run did not prove Gate D.");
+    return;
+  }
 
   console.log("\n╔════════════════════════════════════════════════════════╗");
   console.log("║        ✅ Release Complete!                            ║");

package/scripts/mjs/verify-pipeline-facets.mjs

@@ -110,7 +110,7 @@ if (packageOnly) {
   }
 
   // P1 — autonomous reporting
-  if (features?.autonomous_reporting?.enabled === true) {
+  if (features?.autonomous_reporting?.enabled === false) {
     pass('autonomous_reporting.enabled');
   } else {
     fail('autonomous_reporting.enabled');

package/scripts/node/install-bridges.cjs

@@ -1016,16 +1016,18 @@ const CURSOR_HOOK_EVENTS = [
   ["beforeReadFile", "before-read-file.sh"],
 ];
 
+const CURSOR_GATE_EVENTS = new Set(["preToolUse", "beforeShellExecution", "beforeReadFile"]);
+
 const CURSOR_WEAR_BACKUP = "hooks.json.xray-before";
 
 const CLOUD_SAFE_CURSOR_HOOKS = {
   version: 1,
   hooks: {
-    preToolUse: [{ command: ".cursor/hooks/pre-tool-use.sh" }],
+    preToolUse: [{ command: ".cursor/hooks/pre-tool-use.sh", failClosed: true }],
     preCompact: [{ command: ".cursor/hooks/pre-compact.sh" }],
     afterFileEdit: [{ command: ".cursor/hooks/after-file-edit.sh" }],
-    beforeShellExecution: [{ command: ".cursor/hooks/before-shell-execution.sh" }],
-    beforeReadFile: [{ command: ".cursor/hooks/before-read-file.sh" }],
+    beforeShellExecution: [{ command: ".cursor/hooks/before-shell-execution.sh", failClosed: true }],
+    beforeReadFile: [{ command: ".cursor/hooks/before-read-file.sh", failClosed: true }],
   },
 };
 
@@ -1071,6 +1073,9 @@ function mergeCloudSafeCursorHooks(existing) {
       !Array.isArray(current) || !current.some((h) => isRelativeCursorHookCommand(h && h.command));
     if (!current || leftover || missingRelative) {
       next.hooks[name] = entries;
+    } else if (entries[0].failClosed) {
+      // Gate events fail closed: our relative entry gets failClosed even on an existing hooks.json (re-wear upgrades it).
+      next.hooks[name] = current.map((h) => (h && isRelativeCursorHookCommand(h.command) ? { ...h, failClosed: true } : h));
     }
   }
   return next;
@@ -1279,7 +1284,10 @@ function installedHookCommand(fromDir, packageRoot, scriptName) {
 function installedCursorHookEntries(fromDir, packageRoot) {
   const hooks = {};
   for (const [event, script] of CURSOR_HOOK_EVENTS) {
-    hooks[event] = [{ command: installedHookCommand(fromDir, packageRoot, script) }];
+    const entry = { command: installedHookCommand(fromDir, packageRoot, script) };
+    // Gate events fail closed: Cursor denies when the hook crashes or prints no JSON.
+    if (CURSOR_GATE_EVENTS.has(event)) entry.failClosed = true;
+    hooks[event] = [entry];
   }
   return hooks;
 }
@@ -1610,8 +1618,10 @@ function ownedDeletionEdits(tokens, elements) {
   return edits;
 }
 
-function renderEventEntry(command) {
-  return `{ "command": ${JSON.stringify(command)} }`;
+function renderEventEntry(command, failClosed) {
+  return failClosed
+    ? `{ "command": ${JSON.stringify(command)}, "failClosed": true }`
+    : `{ "command": ${JSON.stringify(command)} }`;
 }
 
 function editJsoncHooks(text, xrayByEvent, targetDir) {
@@ -1627,7 +1637,7 @@ function editJsoncHooks(text, xrayByEvent, targetDir) {
   const hooksPair = root.pairs.find((pair) => pair.key === "hooks");
   if (!hooksPair) {
     const inner = Object.entries(xrayByEvent)
-      .map(([event, entries]) => `"${event}": [${renderEventEntry(entries[0].command)}]`)
+      .map(([event, entries]) => `"${event}": [${renderEventEntry(entries[0].command, entries[0].failClosed)}]`)
       .join(", ");
     const needsComma = root.pairs.length > 0;
     edits.push({
@@ -1642,9 +1652,10 @@ function editJsoncHooks(text, xrayByEvent, targetDir) {
   const missing = [];
   for (const [event, entries] of Object.entries(xrayByEvent)) {
     const command = entries[0].command;
+    const failClosed = entries[0].failClosed === true;
     const pair = hooksObj.pairs.find((item) => item.key === event);
     if (!pair) {
-      missing.push([event, command]);
+      missing.push([event, command, failClosed]);
       continue;
     }
     if (tokens[pair.valIdx].type !== "[") throw new Error(`${event} is not an array`);
@@ -1666,7 +1677,7 @@ function editJsoncHooks(text, xrayByEvent, targetDir) {
       edits.push({
         start: tokens[pair.valEnd].start,
         end: tokens[pair.valEnd].start,
-        insert: `${elements.length > 0 ? ", " : ""}${renderEventEntry(command)}`,
+        insert: `${elements.length > 0 ? ", " : ""}${renderEventEntry(command, failClosed)}`,
       });
       continue;
     }
@@ -1678,13 +1689,17 @@ function editJsoncHooks(text, xrayByEvent, targetDir) {
         insert: JSON.stringify(command),
       });
     }
+    if (failClosed && !objectPairs(tokens, first.el.startIdx).pairs.some((p) => p.key === "failClosed")) {
+      // Re-wear upgrades an older entry: gate events fail closed.
+      edits.push({ start: first.cmd.token.end, end: first.cmd.token.end, insert: ', "failClosed": true' });
+    }
     if (owned.length > 1) {
       edits.push(...ownedDeletionEdits(tokens, owned.slice(1).map((item) => item.el)));
     }
   }
   if (missing.length > 0) {
     const rendered = missing
-      .map(([event, command]) => `"${event}": [${renderEventEntry(command)}]`)
+      .map(([event, command, failClosed]) => `"${event}": [${renderEventEntry(command, failClosed)}]`)
       .join(", ");
     edits.push({
       start: tokens[hooksObj.closeIdx].start,
@@ -1778,20 +1793,21 @@ function mergeInstalledCursorHooks(existing, xrayByEvent) {
       continue;
     }
     const command = shipped[0].command;
+    const extra = shipped[0].failClosed ? { failClosed: true } : {};
     let replaced = false;
     const next = [];
     for (const entry of current) {
       const cmd = entry && typeof entry === "object" ? entry.command : "";
       if (isXrayHookCommand(cmd)) {
         if (!replaced) {
-          next.push({ ...entry, command });
+          next.push({ ...entry, command, ...extra });
           replaced = true;
         }
         continue;
       }
       next.push(entry);
     }
-    if (!replaced) next.push({ command });
+    if (!replaced) next.push({ command, ...extra });
     hooks[name] = next;
   }
   const doc = {};

package/scripts/node/pack-tmp-suit-proof.mjs

@@ -39,17 +39,25 @@ export function foundryCliPath(millRoot) {
   return path.join(millRoot, "cli.js");
 }
 
-export function runFoundryCli(millRoot, consumerRoot, args) {
+/** Clean-room foundry env. The machine home is empty so a plugin on the real machine cannot fail the seat inspect. */
+export function proofFoundryEnv(consumerRoot, baseEnv = process.env) {
   const isolatedHome = path.join(consumerRoot, ".proof-home");
+  const machineHome = path.join(consumerRoot, ".proof-machine");
   fs.mkdirSync(isolatedHome, { recursive: true });
+  fs.mkdirSync(machineHome, { recursive: true });
+  return {
+    ...baseEnv,
+    FOUNDRY_ROOT: consumerRoot,
+    HOME: isolatedHome,
+    FOUNDRY_MACHINE_HOME: machineHome,
+  };
+}
+
+export function runFoundryCli(millRoot, consumerRoot, args) {
   return spawnSync(process.execPath, [foundryCliPath(millRoot), ...args], {
     cwd: consumerRoot,
     encoding: "utf8",
-    env: {
-      ...process.env,
-      FOUNDRY_ROOT: consumerRoot,
-      HOME: isolatedHome,
-    },
+    env: proofFoundryEnv(consumerRoot),
   });
 }
 

package/src/integrations/openclaw/plugin/xray-pre-tool/index.js

@@ -2,7 +2,7 @@ import { createRequire } from 'node:module';
 import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import { definePluginEntry } from 'openclaw/plugin-sdk/plugin-entry';
 
 const require = createRequire(import.meta.url);
@@ -39,7 +39,7 @@ export default definePluginEntry({
   register(api) {
     api.on(
       'before_tool_call',
-      (event, ctx) => {
+      async (event, ctx) => {
         try {
           const xrayRoot = resolveXrayRoot();
           if (!xrayRoot) {
@@ -61,6 +61,21 @@ export default definePluginEntry({
           if (!outcome.allow) {
             return { block: true, blockReason: outcome.reason || '0xRay constitution' };
           }
+          const spoken = `${event.toolName} ${JSON.stringify(event.params || {})}`.slice(0, 500);
+          const speakPath = [
+            join(xrayRoot, 'dist/integrations/hooks/pre-tool-speak.mjs'),
+            join(xrayRoot, 'src/integrations/hooks/pre-tool-speak.mjs'),
+          ].find((candidate) => existsSync(candidate));
+          if (!speakPath) return undefined;
+          const speak = await import(pathToFileURL(speakPath).href);
+          const lens = speak.lensDecision(projectRoot, event.toolName, spoken);
+          if (lens) {
+            return { block: true, blockReason: lens.reason };
+          }
+          const route = speak.repertoireRoute(spoken);
+          if (route?.hookSpecificOutput) {
+            return { block: false, hookSpecificOutput: route.hookSpecificOutput };
+          }
           return undefined;
         } catch (err) {
           return {

package/src/integrations/openclaw/plugin/xray-pre-tool/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xray-pre-tool",
-  "version": "4.0.42",
+  "version": "4.1.0",
   "private": true,
   "type": "module",
   "description": "0xRay constitution + temperament PreToolUse for OpenClaw",

package/vendor/@0xray/repertoire/README.md

@@ -2,7 +2,7 @@
 
 Factory memory organ for [0xRay](https://github.com/0xRayAI/xray): seed primitives, in-process memory routing, extra MCP (not an 8th `xray-*` server).
 
-**v0.2.9** · 0xRay **4.0** wear. Runtime does **not** depend on `0xray` (optional peer for suit-verify scripts).
+**v0.2.9** · 0xRay **4.1** wear. Runtime does **not** depend on `0xray` (optional peer for suit-verify scripts).
 
 ## Install
 

package/xray/agents_template.md

@@ -1,6 +1,6 @@
 # 0xRay AI Agents
 
-Quick reference for the 0xRay AI orchestration framework (**4.0** — 7 consumer MCP servers).
+Quick reference for the 0xRay suit (**4.1** — 7 consumer MCP servers). 0xRay is a three-subsystem autonomous engine. The suit is the wear.
 
 ## Available MCP Servers
 
@@ -28,7 +28,7 @@ All seven use `npx -y 0xray mcp <cmd>`:
 
 ## Governance
 
-xray operates under the three-subsystem model: Inference + External Governance (Dynamo Solar SSOT) + Autonomous Engine (thinDispatch 7-flow in MCP orchestrator). All actions are validated against the Universal Development Codex before execution.
+0xRay is a three-subsystem autonomous engine: Inference + External Governance (Dynamo Solar SSOT) + Autonomous Engine (thinDispatch 7-flow in MCP orchestrator). The suit is the wear. All actions are validated against the Universal Development Codex before execution.
 
 **Codex**: `.xray/codex.json` — **70 terms** across all agent interactions.
 

package/xray/features.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./features.schema.json",
-  "version": "4.0.42",
+  "version": "4.1.0",
   "description": "0xRay Framework - Unified Feature Configuration",
   "suit_temperament": {
     "profile": "auto",
@@ -54,16 +54,16 @@
       "auto_provision_worktree": false
     }
   },
-  "grok_postprocessor_light": true,
+  "grok_postprocessor_light": false,
   "inference_session_capture": {
     "enabled": true,
     "min_commits": 3,
     "lookback_commits": 20
   },
   "autonomous_reporting": {
-    "enabled": true,
+    "enabled": false,
     "interval_minutes": 60,
-    "auto_schedule": true,
+    "auto_schedule": false,
     "include_health_assessment": true,
     "include_agent_activities": true,
     "include_pipeline_operations": true,
@@ -174,7 +174,7 @@
     "every_n_todos_completed": 0
   },
   "inference": {
-    "description": "Self-improvement cycle that grades a new named session into repertoire",
+    "description": "The cycle runs from the CLI command inference:run and the session wake does not start it.",
     "enabled": true,
     "workflow_dir": ".xray/inference",
     "reports_dir": ".xray/reports",

package/docs-site/docs/plates/live-mesh.md

@@ -1,41 +0,0 @@
----
-title: Live mesh
-sidebar_label: Live mesh
-plate_type: pipeline
----
-
-# Live mesh
-
-Ping-pong eng events become one ordered JSON feed, then a mesh render. Markdown is never the source.
-
-```
-┌────────────────────────────────────────────────────────────┐
-│ INPUT LAYER                                                │
-│   ┌──────────────┐ ┌──────────┐ ┌─────────┐ ┌───────────┐ │
-│   │ GitHub REST  │ │ deploy   │ │ /health │ │ X ledger  │ │
-│   │ PR/issue     │ │ muse     │ │ probe   │ │ herald    │ │
-│   └──────┬───────┘ └────┬─────┘ └────┬────┘ └─────┬─────┘ │
-│          └──────────────┴────────────┴────────────┘        │
-└─────────────────────────────┬──────────────────────────────┘
-                              v
-┌─────────────────────────────┼──────────────────────────────┐
-│ PROCESSING LAYER            v                              │
-│   ┌────────────────────────────────────────────────────┐  │
-│   │ fetch_feed.py                                      │  │
-│   │ poll → dedupe on id → rewrite live-events.json     │  │
-│   │ --watch keeps the feed warm                        │  │
-│   └──────────────────────────┬─────────────────────────┘  │
-└──────────────────────────────┼────────────────────────────┘
-                               v
-┌──────────────────────────────┼────────────────────────────┐
-│ OUTPUT LAYER                 v                            │
-│   ┌──────────────────────┐  ┌──────────────────────────┐ │
-│   │ live-events.json     │  │ render_mesh.py           │ │
-│   │ (+ jsonl append)     │  │ mp4 / --follow           │ │
-│   └──────────────────────┘  └──────────────────────────┘ │
-└────────────────────────────────────────────────────────────┘
-```
-
-Paths live under `house/live-mesh/`. Schema is `schema.json`. The plate that belongs here is house.
-
-stamped · 0xray 4.0.42