0xray 4.0.42 → 4.1.1

package/scripts/foundry/release-gate.mjs

@@ -3,10 +3,12 @@
  * release-gate.mjs — Single release checkpoint.
  *
  * Modes:
- *   (default)     build + test + consumer smoke (fresh + upgrade merge)
+ *   (default)     build + test + docs + consumer smoke (fresh + upgrade merge)
  *   --verify-only git + reconcile + release docs + consumer smoke — after push, before publish
  *   --skip-smoke  skip consumer install smoke
- *   --skip-docs   skip release docs validation (not recommended for publish)
+ *   --prove-published  Gate D only: npm lists this version, the annotated tag points at HEAD,
+ *                      and the GitHub Release exists. This command does not publish.
+ *   --skip-docs   refused. Gate C runs on every gate.
  *
  * Usage:
  *   npx @0xray/foundry gate
@@ -21,7 +23,7 @@ import { isXrayExoRepo, millScript, readRootPackage, resolveMillRoot } from "./m
 const rootDir = resolveMillRoot();
 const verifyOnly = process.argv.includes("--verify-only");
 const skipSmoke = process.argv.includes("--skip-smoke");
-const skipDocs = process.argv.includes("--skip-docs");
+const provePublished = process.argv.includes("--prove-published");
 
 function step(label, cmd) {
   console.log(`\n${"─".repeat(60)}\n🔄 ${label}\n${"─".repeat(60)}\n`);
@@ -32,18 +34,114 @@ function docsCheckCmd() {
   return `${JSON.stringify(process.execPath)} ${JSON.stringify(millScript("validate-release-docs.mjs"))}`;
 }
 
+
+/** Gate C is the docs check. A ship gate that skips it is not a pass. */
+export function gateCRefusal(argv = process.argv) {
+  if (argv.includes("--skip-docs")) {
+    return "Gate C cannot be skipped. Remove --skip-docs. The docs check runs on every gate.";
+  }
+  return null;
+}
+
+/**
+ * Gate D facts. listed, tagAnnotated, and tagMatchesHead are booleans.
+ * releaseUrl is the GitHub Release page, or empty when that page is missing.
+ */
+export function provePublishedRelease(proof) {
+  const version = proof.version;
+  const errors = [];
+  if (proof.listed !== true) errors.push(`npm does not list ${version}`);
+  if (proof.tagAnnotated !== true) errors.push(`annotated tag v${version} is missing`);
+  if (proof.tagMatchesHead !== true) errors.push(`annotated tag v${version} does not point at HEAD`);
+  if (typeof proof.releaseUrl !== "string" || proof.releaseUrl.length === 0) {
+    errors.push(`GitHub Release v${version} is missing`);
+  }
+  return errors;
+}
+
+function gitOut(cmd) {
+  return execSync(cmd, { cwd: rootDir, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+}
+
+function originSlug() {
+  const url = gitOut("git remote get-url origin");
+  const match = url.match(/github\.com[:/]([^/]+)\/([^/.]+)(?:\.git)?$/);
+  if (!match) throw new Error(`origin is not a GitHub repo: ${url}`);
+  return { owner: match[1], repo: match[2] };
+}
+
+function collectPublishedProof() {
+  const pkg = readRootPackage(rootDir);
+  const version = pkg.version;
+  const name = pkg.name;
+  let listed = false;
+  try {
+    const view = gitOut(`npm view ${name}@${version} version`);
+    listed = view.split(/\s+/).includes(version);
+  } catch {
+    listed = false;
+  }
+  let tagAnnotated = false;
+  let tagMatchesHead = false;
+  try {
+    tagAnnotated = gitOut(`git cat-file -t v${version}`) === "tag";
+    const tagged = gitOut(`git rev-parse v${version}^{}`);
+    const head = gitOut("git rev-parse HEAD");
+    tagMatchesHead = tagAnnotated && tagged === head;
+  } catch {
+    tagAnnotated = false;
+    tagMatchesHead = false;
+  }
+  let releaseUrl = "";
+  try {
+    const { owner, repo } = originSlug();
+    const body = gitOut(
+      `curl -fsS -H "Accept: application/vnd.github+json" -H "User-Agent: 0xray-release-gate" https://api.github.com/repos/${owner}/${repo}/releases/tags/v${version}`,
+    );
+    const parsed = JSON.parse(body);
+    releaseUrl = typeof parsed.html_url === "string" ? parsed.html_url : "";
+  } catch {
+    releaseUrl = "";
+  }
+  return { version, name, listed, tagAnnotated, tagMatchesHead, releaseUrl };
+}
+
+function runProvePublished() {
+  const proof = collectPublishedProof();
+  const errors = provePublishedRelease(proof);
+  process.stdout.write(`\nGate D — ${proof.name}@${proof.version}\n`);
+  if (errors.length) {
+    for (const error of errors) process.stderr.write(`❌ ${error}\n`);
+    process.stderr.write("\n❌ GATE D FAILED — npm listing, annotated tag at HEAD, and GitHub Release are all required\n\n");
+    process.exit(1);
+  }
+  process.stdout.write(`✅ npm lists ${proof.version}\n`);
+  process.stdout.write(`✅ annotated tag v${proof.version} points at HEAD\n`);
+  process.stdout.write(`✅ GitHub Release ${proof.releaseUrl}\n`);
+  process.stdout.write("\n✅ GATE D PROVEN\n\n");
+}
+
 function runLightGate() {
   const pkg = readRootPackage(rootDir);
   if (verifyOnly) {
-    if (!skipDocs) step("1/1 Release docs (light)", docsCheckCmd());
+    step("1/1 Release docs (light)", docsCheckCmd());
     return;
   }
   if (pkg.scripts.build) step("1/3 Build", "npm run build");
   if (pkg.scripts.test) step("2/3 Tests", "npm test");
-  if (!skipDocs) step("3/3 Release docs (light)", docsCheckCmd());
+  step("3/3 Release docs (light)", docsCheckCmd());
 }
 
 function main() {
+  const refused = gateCRefusal();
+  if (refused) {
+    process.stderr.write(`\n❌ ${refused}\n\n`);
+    process.exit(1);
+  }
+  if (provePublished) {
+    runProvePublished();
+    return;
+  }
   const mode = verifyOnly ? "verify" : "full";
   console.log("\n╔════════════════════════════════════════════════════════╗");
   console.log(`║        🛡️  0xRay Release Gate (${mode})`.padEnd(57) + "║");
@@ -54,9 +152,7 @@ function main() {
       runLightGate();
     } else if (verifyOnly) {
       step("1/6 Git + reconcile", "node scripts/node/pre-publish-guard.js --verify-only");
-      if (!skipDocs) {
-        step("2/6 Release docs", docsCheckCmd());
-      }
+      step("2/6 Release docs", docsCheckCmd());
       step(
         "3/6 Plugin infrastructure",
         "node scripts/test/validate-plugins-e2e.cjs --structural-only",
@@ -75,9 +171,7 @@ function main() {
         `${JSON.stringify(process.execPath)} ${JSON.stringify(millScript("assert-packed-dist-cli.mjs"))}`,
       );
       step("3/8 Tests", "npm run test:comprehensive");
-      if (!skipDocs) {
-        step("4/8 Release docs", docsCheckCmd());
-      }
+      step("4/8 Release docs", docsCheckCmd());
       step(
         "5/8 Consumer hook verifiers",
         "npm run verify:pre-commit-diff && npm run verify:pre-push-diff && node scripts/mjs/verify-delegation-gate-core.mjs --host=grok && node scripts/mjs/verify-delegation-gate-core.mjs --host=hermes && node scripts/mjs/verify-delegation-gate-core.mjs --host=opencode && node scripts/mjs/verify-hermes-session-start.mjs && node scripts/mjs/verify-confer-core.mjs && npm run verify:user-aside && npm run build && node scripts/mjs/verify-pipeline-facets.mjs --package-only",
@@ -91,9 +185,11 @@ function main() {
       }
     }
 
-    console.log("\n╔════════════════════════════════════════════════════════╗");
-    console.log("║  ✅ RELEASE GATE PASSED                                ║");
-    console.log("╚════════════════════════════════════════════════════════╝\n");
+    process.stdout.write("\n╔════════════════════════════════════════════════════════╗\n");
+    process.stdout.write("║  ✅ GATE A–C LOCAL PASS                                ║\n");
+    process.stdout.write("║  Gate D is not proven by this command.                 ║\n");
+    process.stdout.write("╚════════════════════════════════════════════════════════╝\n");
+    process.stdout.write("Prove D after publish: npx @0xray/foundry gate --prove-published\n\n");
   } catch {
     console.error("\n❌ RELEASE GATE FAILED — do not tag or publish\n");
     process.exit(1);
@@ -105,4 +201,4 @@ const isMain =
 
 if (isMain) {
   main();
-}
+}

package/scripts/foundry/release.mjs

@@ -57,7 +57,7 @@ function run(cmd, label) {
     cwd: rootDir,
     stdio: "inherit",
     encoding: "utf-8",
-    env: { ...process.env, FOUNDRY_ROOT: rootDir },
+    env: { ...process.env, FOUNDRY_ROOT: rootDir, FOUNDRY_VIA_RELEASE: "1" },
   });
 }
 
@@ -191,6 +191,8 @@ async function main() {
       }
     }
     run(`git push origin v${version}`, "push tag");
+    say("Step 8: Gate D");
+    runMill("release-gate.mjs", ["--prove-published"], "gate D");
     return;
   }
 
@@ -281,6 +283,12 @@ async function main() {
     console.log(`  would: git tag -a v${newVersion}`);
   }
   run(`git push origin v${newVersion}`, "push tag");
+  say("Step 8: Gate D");
+  runMill("release-gate.mjs", ["--prove-published"], "gate D");
+  if (dryRun) {
+    say("Dry run did not prove Gate D.");
+    return;
+  }
 
   console.log("\n╔════════════════════════════════════════════════════════╗");
   console.log("║        ✅ Release Complete!                            ║");

package/scripts/foundry/validate-release-docs.mjs

@@ -410,8 +410,8 @@ function main() {
     } else {
       console.error('❌ Release docs validation FAILED:\n');
       for (const e of result.errors) console.error(`   • ${e}`);
-      console.error('\nFix docs then run: npm run version:sync');
-      console.error('Or: npx @0xray/foundry docs-check\n');
+      console.error('\nFix the docs in the branch. On this repo the stamper runs only from scripts/foundry/release.mjs, and that command publishes. A docs fix does not publish. Stop.');
+      console.error('Re-check with: npx @0xray/foundry docs-check\n');
     }
     process.exit(1);
   }

package/scripts/foundry/version-manager.mjs

@@ -574,9 +574,16 @@ function runReleaseDocsValidation() {
 
 function refuseBump(reason) {
   process.stderr.write(`${reason}\n`);
-  process.stderr.write('One bumper: npx @0xray/foundry reconcile [patch|minor|major] --apply\n');
-  process.stderr.write('Then stamp:  npx @0xray/foundry stamp\n');
-  process.stderr.write('Ship:        npx @0xray/foundry release [patch|minor|major]\n');
+  process.stderr.write('Ship: npx @0xray/foundry release [patch|minor|major] --i-mean-it\n');
+  process.exit(1);
+}
+
+function refuseOutsideRelease() {
+  if (!isXrayExoRepo(rootDir)) return;
+  if (process.env.FOUNDRY_VIA_RELEASE === '1') return;
+  process.stderr.write('This repo stamps only through scripts/foundry/release.mjs.\n');
+  process.stderr.write('Ship: node scripts/foundry/release.mjs patch --i-mean-it\n');
+  process.stderr.write('That command publishes. A docs fix does not. Stop.\n');
   process.exit(1);
 }
 
@@ -586,13 +593,14 @@ function main() {
   if (args.includes('--help') || args.includes('-h')) {
     process.stdout.write(`Current version: ${getCurrentVersion()}\n`);
     process.stdout.write('Usage: npx @0xray/foundry stamp\n');
-    process.stdout.write('Bump is refused. Reconcile advances the next cut, then this stamper runs.\n');
+    process.stdout.write('Bump is refused. On this repo the stamper runs only from scripts/foundry/release.mjs.\n');
     process.stdout.write('The stamper strips every present-tense patch pin from shipped guides and shipped OP-PROC.\n');
     process.stdout.write('It does not edit Station, NOTES, dest, or node_modules. It does not publish.\n');
     process.exit(0);
   }
 
   if (args.includes('--artifacts-only')) {
+    refuseOutsideRelease();
     updateReleaseArtifactsOnly('');
     return;
   }

package/scripts/mjs/verify-pipeline-facets.mjs

@@ -110,7 +110,7 @@ if (packageOnly) {
   }
 
   // P1 — autonomous reporting
-  if (features?.autonomous_reporting?.enabled === true) {
+  if (features?.autonomous_reporting?.enabled === false) {
     pass('autonomous_reporting.enabled');
   } else {
     fail('autonomous_reporting.enabled');

package/scripts/node/install-bridges.cjs

@@ -216,7 +216,15 @@ function syncBuiltinSkills(targetSkillsDir, packageRoot) {
   try {
     if (!fs.existsSync(targetSkillsDir)) fs.mkdirSync(targetSkillsDir, { recursive: true });
     for (const entry of fs.readdirSync(sourceDir, { withFileTypes: true })) {
-      if (!entry.isDirectory()) continue;
+      let linkedDir = false;
+      if (entry.isSymbolicLink()) {
+        try {
+          linkedDir = fs.statSync(path.join(sourceDir, entry.name)).isDirectory();
+        } catch {
+          linkedDir = false;
+        }
+      }
+      if (!entry.isDirectory() && !linkedDir) continue;
       const skillMd = path.join(sourceDir, entry.name, "SKILL.md");
       if (!fs.existsSync(skillMd)) continue;
       const destMd = path.join(targetSkillsDir, entry.name, "SKILL.md");
@@ -234,8 +242,45 @@ function syncBuiltinSkills(targetSkillsDir, packageRoot) {
   return copied;
 }
 
+function plantIncludesMill(targetDir, packageRoot) {
+  const { loadFactoryPlantKinds } = require("../foundry/mint-suit.cjs");
+  return loadFactoryPlantKinds(targetDir, packageRoot).includes("mill");
+}
+
+function copyRoleAgentFiles(packageRoot, opencodeDest) {
+  const dirs = [
+    path.join(packageRoot, "src", "opencode", "agents"),
+    path.join(packageRoot, ".opencode", "agents"),
+  ].filter((dir) => fs.existsSync(dir));
+  const destDir = path.join(opencodeDest, "agents");
+  for (const dir of dirs) {
+    let names;
+    try {
+      names = fs.readdirSync(dir);
+    } catch {
+      continue;
+    }
+    for (const name of names) {
+      if (!name.endsWith(".yml") && !name.endsWith(".yaml")) continue;
+      const src = path.join(dir, name);
+      let st;
+      try {
+        st = fs.statSync(src);
+      } catch {
+        continue;
+      }
+      if (!st.isFile()) continue;
+      const dest = path.join(destDir, name);
+      if (fs.existsSync(dest)) continue;
+      fs.mkdirSync(destDir, { recursive: true });
+      fs.copyFileSync(src, dest);
+    }
+  }
+}
+
 function syncCostumeSkills(targetSkillsDir, packageRoot, targetDir) {
-  if (targetDir && !wantsCostume(targetDir)) return 0;
+  // Catalog skills belong on the mill suit. A blip or sound seat keeps its plant.
+  if (targetDir && !plantIncludesMill(targetDir, packageRoot)) return 0;
   return syncBuiltinSkills(targetSkillsDir, packageRoot);
 }
 
@@ -448,7 +493,7 @@ function installOpencodeBridge(targetDir, packageRoot, log) {
   const opencodeSource = path.join(packageRoot, ".opencode");
   const opencodeDest = path.join(targetDir, ".opencode");
   const costume = wantsCostume(targetDir);
-
+  const millSuit = plantIncludesMill(targetDir, packageRoot);
   if (costume) {
     if (!fs.existsSync(opencodeSource)) {
       log("opencode-bridge", "skipped", "warn", { reason: ".opencode source missing" });
@@ -460,14 +505,18 @@ function installOpencodeBridge(targetDir, packageRoot, log) {
     } else {
       log("opencode-bridge", ".opencode exists — merging skills/plugin only", "info");
     }
-    copyOpencodePlugin(packageRoot, opencodeDest, log);
-    const copied = syncCostumeSkills(path.join(opencodeDest, "skills"), packageRoot, targetDir);
-    if (copied > 0) log("opencode-bridge", `skills synced (${copied})`, "info", { path: ".opencode/skills/" });
   } else {
-    log("opencode-bridge", "mill plant — plugin only, not costume dump", "info");
     fs.mkdirSync(opencodeDest, { recursive: true });
-    copyOpencodePlugin(packageRoot, opencodeDest, log);
+    if (millSuit) {
+      copyRoleAgentFiles(packageRoot, opencodeDest);
+      log("opencode-bridge", "mill suit — role files, not the costume tree", "info");
+    } else {
+      log("opencode-bridge", "plant seat — plugin only", "info");
+    }
   }
+  copyOpencodePlugin(packageRoot, opencodeDest, log);
+  const copied = syncCostumeSkills(path.join(opencodeDest, "skills"), packageRoot, targetDir);
+  if (copied > 0) log("opencode-bridge", `skills synced (${copied})`, "info", { path: ".opencode/skills/" });
 
   try {
     const count = wireOpencodeBridge(targetDir);
@@ -1016,16 +1065,18 @@ const CURSOR_HOOK_EVENTS = [
   ["beforeReadFile", "before-read-file.sh"],
 ];
 
+const CURSOR_GATE_EVENTS = new Set(["preToolUse", "beforeShellExecution", "beforeReadFile"]);
+
 const CURSOR_WEAR_BACKUP = "hooks.json.xray-before";
 
 const CLOUD_SAFE_CURSOR_HOOKS = {
   version: 1,
   hooks: {
-    preToolUse: [{ command: ".cursor/hooks/pre-tool-use.sh" }],
+    preToolUse: [{ command: ".cursor/hooks/pre-tool-use.sh", failClosed: true }],
     preCompact: [{ command: ".cursor/hooks/pre-compact.sh" }],
     afterFileEdit: [{ command: ".cursor/hooks/after-file-edit.sh" }],
-    beforeShellExecution: [{ command: ".cursor/hooks/before-shell-execution.sh" }],
-    beforeReadFile: [{ command: ".cursor/hooks/before-read-file.sh" }],
+    beforeShellExecution: [{ command: ".cursor/hooks/before-shell-execution.sh", failClosed: true }],
+    beforeReadFile: [{ command: ".cursor/hooks/before-read-file.sh", failClosed: true }],
   },
 };
 
@@ -1071,6 +1122,9 @@ function mergeCloudSafeCursorHooks(existing) {
       !Array.isArray(current) || !current.some((h) => isRelativeCursorHookCommand(h && h.command));
     if (!current || leftover || missingRelative) {
       next.hooks[name] = entries;
+    } else if (entries[0].failClosed) {
+      // Gate events fail closed: our relative entry gets failClosed even on an existing hooks.json (re-wear upgrades it).
+      next.hooks[name] = current.map((h) => (h && isRelativeCursorHookCommand(h.command) ? { ...h, failClosed: true } : h));
     }
   }
   return next;
@@ -1279,7 +1333,10 @@ function installedHookCommand(fromDir, packageRoot, scriptName) {
 function installedCursorHookEntries(fromDir, packageRoot) {
   const hooks = {};
   for (const [event, script] of CURSOR_HOOK_EVENTS) {
-    hooks[event] = [{ command: installedHookCommand(fromDir, packageRoot, script) }];
+    const entry = { command: installedHookCommand(fromDir, packageRoot, script) };
+    // Gate events fail closed: Cursor denies when the hook crashes or prints no JSON.
+    if (CURSOR_GATE_EVENTS.has(event)) entry.failClosed = true;
+    hooks[event] = [entry];
   }
   return hooks;
 }
@@ -1610,8 +1667,10 @@ function ownedDeletionEdits(tokens, elements) {
   return edits;
 }
 
-function renderEventEntry(command) {
-  return `{ "command": ${JSON.stringify(command)} }`;
+function renderEventEntry(command, failClosed) {
+  return failClosed
+    ? `{ "command": ${JSON.stringify(command)}, "failClosed": true }`
+    : `{ "command": ${JSON.stringify(command)} }`;
 }
 
 function editJsoncHooks(text, xrayByEvent, targetDir) {
@@ -1627,7 +1686,7 @@ function editJsoncHooks(text, xrayByEvent, targetDir) {
   const hooksPair = root.pairs.find((pair) => pair.key === "hooks");
   if (!hooksPair) {
     const inner = Object.entries(xrayByEvent)
-      .map(([event, entries]) => `"${event}": [${renderEventEntry(entries[0].command)}]`)
+      .map(([event, entries]) => `"${event}": [${renderEventEntry(entries[0].command, entries[0].failClosed)}]`)
       .join(", ");
     const needsComma = root.pairs.length > 0;
     edits.push({
@@ -1642,9 +1701,10 @@ function editJsoncHooks(text, xrayByEvent, targetDir) {
   const missing = [];
   for (const [event, entries] of Object.entries(xrayByEvent)) {
     const command = entries[0].command;
+    const failClosed = entries[0].failClosed === true;
     const pair = hooksObj.pairs.find((item) => item.key === event);
     if (!pair) {
-      missing.push([event, command]);
+      missing.push([event, command, failClosed]);
       continue;
     }
     if (tokens[pair.valIdx].type !== "[") throw new Error(`${event} is not an array`);
@@ -1666,7 +1726,7 @@ function editJsoncHooks(text, xrayByEvent, targetDir) {
       edits.push({
         start: tokens[pair.valEnd].start,
         end: tokens[pair.valEnd].start,
-        insert: `${elements.length > 0 ? ", " : ""}${renderEventEntry(command)}`,
+        insert: `${elements.length > 0 ? ", " : ""}${renderEventEntry(command, failClosed)}`,
       });
       continue;
     }
@@ -1678,13 +1738,17 @@ function editJsoncHooks(text, xrayByEvent, targetDir) {
         insert: JSON.stringify(command),
       });
     }
+    if (failClosed && !objectPairs(tokens, first.el.startIdx).pairs.some((p) => p.key === "failClosed")) {
+      // Re-wear upgrades an older entry: gate events fail closed.
+      edits.push({ start: first.cmd.token.end, end: first.cmd.token.end, insert: ', "failClosed": true' });
+    }
     if (owned.length > 1) {
       edits.push(...ownedDeletionEdits(tokens, owned.slice(1).map((item) => item.el)));
     }
   }
   if (missing.length > 0) {
     const rendered = missing
-      .map(([event, command]) => `"${event}": [${renderEventEntry(command)}]`)
+      .map(([event, command, failClosed]) => `"${event}": [${renderEventEntry(command, failClosed)}]`)
       .join(", ");
     edits.push({
       start: tokens[hooksObj.closeIdx].start,
@@ -1778,20 +1842,21 @@ function mergeInstalledCursorHooks(existing, xrayByEvent) {
       continue;
     }
     const command = shipped[0].command;
+    const extra = shipped[0].failClosed ? { failClosed: true } : {};
     let replaced = false;
     const next = [];
     for (const entry of current) {
       const cmd = entry && typeof entry === "object" ? entry.command : "";
       if (isXrayHookCommand(cmd)) {
         if (!replaced) {
-          next.push({ ...entry, command });
+          next.push({ ...entry, command, ...extra });
           replaced = true;
         }
         continue;
       }
       next.push(entry);
     }
-    if (!replaced) next.push({ command });
+    if (!replaced) next.push({ command, ...extra });
     hooks[name] = next;
   }
   const doc = {};
@@ -1931,9 +1996,11 @@ function syncSetupSkillsAndRootLinks(packageRoot, targetDir) {
 
 /** A byte-identical package skill is the old mirror. A different body still throws. */
 function wornSkillMatchesPackage(packageRoot, targetDir, name) {
-  const source = fs.existsSync(path.join(packageRoot, "src", "skills"))
-    ? path.join(packageRoot, "src", "skills")
-    : path.join(packageRoot, "dist", "skills");
+  const distSkills = path.join(packageRoot, "dist", "skills");
+  const srcSkills = path.join(packageRoot, "src", "skills");
+  const source = fs.existsSync(path.join(distSkills, name, "SKILL.md"))
+    ? distSkills
+    : srcSkills;
   const packaged = path.join(source, name, "SKILL.md");
   if (!fs.existsSync(packaged)) return false;
   const packagedBytes = fs.readFileSync(packaged);
@@ -1961,12 +2028,11 @@ function packageShipsConsumerSuit(packageRoot) {
 /**
  * Consumer wear files: AGENTS.md, .gitignore, repertoire link, .xray config,
  * bridges, mill plant (mill + inspect), and the scripts and dist links.
- * The role-skill mirror stays in the package.
+ * Catalog skills and role files stay worn. Costume does not strip them.
  * Does not install Cursor hooks or git hooks.
  * Existing user files follow the 4.0.28 guards inside those functions.
  */
 
-const ROLE_SKILL_KEEP = new Set(["mill", "inspect"]);
 const ROLE_SKILL_DIRS = [
   [".opencode", "skills"],
   [".grok", "plugins", "0xray", "skills"],
@@ -1974,26 +2040,6 @@ const ROLE_SKILL_DIRS = [
   [".openclaw", "skills"],
 ];
 
-function removeCopiedRoleSkills(packageRoot, targetDir) {
-  const source = fs.existsSync(path.join(packageRoot, "src", "skills"))
-    ? path.join(packageRoot, "src", "skills")
-    : path.join(packageRoot, "dist", "skills");
-  if (!fs.existsSync(source)) return;
-  for (const parts of ROLE_SKILL_DIRS) {
-    const dir = path.join(targetDir, ...parts);
-    if (!fs.existsSync(dir)) continue;
-    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-      if (!entry.isDirectory() || ROLE_SKILL_KEEP.has(entry.name)) continue;
-      const packaged = path.join(source, entry.name, "SKILL.md");
-      const worn = path.join(dir, entry.name, "SKILL.md");
-      if (!fs.existsSync(packaged) || !fs.existsSync(worn)) continue;
-      const same = fs.readFileSync(packaged).equals(fs.readFileSync(worn));
-      if (!same) continue;
-      fs.rmSync(path.join(dir, entry.name), { recursive: true, force: true });
-    }
-  }
-}
-
 function installConsumerProjectFiles(packageRoot, targetDir, log) {
   const write = typeof log === "function" ? log : () => {};
   if (!isConsumerInstall(packageRoot, targetDir) || !packageShipsConsumerSuit(packageRoot)) {
@@ -2012,7 +2058,6 @@ function installConsumerProjectFiles(packageRoot, targetDir, log) {
   installGrokBridge(targetDir, packageRoot, write);
   installHermesBridge(targetDir, packageRoot, write);
   installOpenclawBridge(targetDir, packageRoot, write);
-  removeCopiedRoleSkills(packageRoot, targetDir);
   try {
     mintConsumerSuit(packageRoot, targetDir, write);
   } catch (err) {

package/scripts/node/pack-tmp-suit-proof.mjs

@@ -39,17 +39,25 @@ export function foundryCliPath(millRoot) {
   return path.join(millRoot, "cli.js");
 }
 
-export function runFoundryCli(millRoot, consumerRoot, args) {
+/** Clean-room foundry env. The machine home is empty so a plugin on the real machine cannot fail the seat inspect. */
+export function proofFoundryEnv(consumerRoot, baseEnv = process.env) {
   const isolatedHome = path.join(consumerRoot, ".proof-home");
+  const machineHome = path.join(consumerRoot, ".proof-machine");
   fs.mkdirSync(isolatedHome, { recursive: true });
+  fs.mkdirSync(machineHome, { recursive: true });
+  return {
+    ...baseEnv,
+    FOUNDRY_ROOT: consumerRoot,
+    HOME: isolatedHome,
+    FOUNDRY_MACHINE_HOME: machineHome,
+  };
+}
+
+export function runFoundryCli(millRoot, consumerRoot, args) {
   return spawnSync(process.execPath, [foundryCliPath(millRoot), ...args], {
     cwd: consumerRoot,
     encoding: "utf8",
-    env: {
-      ...process.env,
-      FOUNDRY_ROOT: consumerRoot,
-      HOME: isolatedHome,
-    },
+    env: proofFoundryEnv(consumerRoot),
   });
 }
 
@@ -92,7 +100,25 @@ export function wornSkillNames(consumerRoot) {
   );
 }
 
-export function assertFastenedMillPlant(consumerRoot) {
+function catalogSkillNamesNear(millRoot) {
+  let dir = millRoot;
+  for (let i = 0; i < 4 && dir; i += 1) {
+    for (const rel of ["dist/skills", "src/skills"]) {
+      const skills = path.join(dir, rel);
+      if (!fs.existsSync(skills)) continue;
+      const names = fs.readdirSync(skills).filter((name) =>
+        fs.existsSync(path.join(skills, name, "SKILL.md")),
+      );
+      if (names.length > 0) return names;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return [];
+}
+
+export function assertFastenedMillPlant(consumerRoot, millRoot = consumerRoot) {
   const inventoryPath = path.join(consumerRoot, ".xray", "foundry-inventory.json");
   if (!fs.existsSync(inventoryPath)) {
     throw new Error("foundry-inventory.json missing — mill did not fasten");
@@ -118,8 +144,9 @@ export function assertFastenedMillPlant(consumerRoot) {
     }
   }
   const worn = wornSkillNames(consumerRoot);
+  const catalog = catalogSkillNamesNear(millRoot);
   const extras = worn.filter(
-    (name) => !MILL_PLANT_SKILLS.includes(name) && !FACTORY_SHOP_SKILLS.includes(name),
+    (name) => !MILL_PLANT_SKILLS.includes(name) && !FACTORY_SHOP_SKILLS.includes(name) && !catalog.includes(name),
   );
   if (extras.length > 0) {
     throw new Error(`costume dump extras before hangar plant: ${extras.join(",")}`);
@@ -137,7 +164,7 @@ export function proveSuitAfterInstall(consumerRoot, millRoot) {
   if (mint.status !== 0) {
     throw new Error(`foundry mint --skip-live failed:\n${mint.stdout}\n${mint.stderr}`);
   }
-  const inventory = assertFastenedMillPlant(consumerRoot);
+  const inventory = assertFastenedMillPlant(consumerRoot, millRoot);
   if (inventory.suit !== "fastened" && inventory.suit !== "overlay") {
     throw new Error(`expected fastened/overlay suit, got ${inventory.suit}`);
   }
@@ -172,7 +199,7 @@ export function proveSuitAfterInstall(consumerRoot, millRoot) {
   if (Array.isArray(plantVsWorn.extraSkills) && plantVsWorn.extraSkills.length > 0) {
     throw new Error(`inspect extraSkills after hangar plant: ${plantVsWorn.extraSkills.join(",")}`);
   }
-  const after = assertFastenedMillPlant(consumerRoot);
+  const after = assertFastenedMillPlant(consumerRoot, millRoot);
   if (after.costume === true) {
     throw new Error("costume flipped true after hangar plant");
   }