0xray 4.0.5 → 4.0.7

package/dist/CHANGELOG.md

@@ -29,6 +29,20 @@ The format is based on [Conventional Commits](https://www.conventionalcommits.or
 - Empty garment: mill plant (`mill` skill) is the hanger. Not 45/42 costume unless `foundry.json` `"costume": true`. Mill 0.1.5.
 - Mill plant fastens **inspect** (inspect AI work) plus `mill`. Not empty. Mill 0.1.6.
 - Nested mill **0.1.7**: inspect organ, four floors, passwd HOME, mill CI receipt. 4.0.5.
+- Nested mill **0.1.8**: isolated Hermes/OpenClaw, consumer tarball GET, CLI mint inspects. 4.0.6.
+- Nested mill **0.1.9**: inventory DNA for Groover 0xray-suit pack. 4.0.7.
+
+---
+
+## [4.0.7] - 2026-09-09
+
+Nested mill **0.1.9**. Inventory writes `dna` (keccak256 of canonical JSON without `mintedAt`). Inspect echoes dna + pack `0xray-suit`. Mill does not mint on chain. Not 5.0.0.
+
+---
+
+## [4.0.6] - 2026-09-09
+
+Nested mill **0.1.8**. Isolated HOME skips machine Hermes/OpenClaw. Inspect GETs public consumer `.tgz`. CLI `mint` runs inspect (chat is not done). Postinstall does not inspect. Not 5.0.0.
 
 ---
 

package/dist/cli/commands/hermes-install.js

@@ -1,6 +1,5 @@
 import fs from 'fs';
 import path from 'path';
-import { homedir } from 'os';
 import { createRequire } from 'module';
 import { frameworkLogger } from '../../core/framework-logger.js';
 import { syncBuiltinSkills } from './skill-install.js';
@@ -8,6 +7,7 @@ import { mintAfterWear } from './foundry-mint-wear.js';
 const __dirname = path.dirname(new URL(import.meta.url).pathname);
 const require = createRequire(import.meta.url);
 const packageRoot = path.join(__dirname, '..', '..', '..');
+const millSuit = require(path.join(packageRoot, 'scripts', 'foundry', 'mint-suit.cjs'));
 const wiring = require(path.join(packageRoot, 'scripts', 'node', 'bridge-mcp-wiring.cjs'));
 export function registerHermesCommands(hermesCmd) {
     hermesCmd
@@ -21,8 +21,10 @@ export function registerHermesCommands(hermesCmd) {
 }
 async function installForHermes(options = {}) {
     frameworkLogger.log('hermes-integration', 'install-start', 'info', { options });
-    const home = homedir();
-    const targetPluginDir = path.join(home, '.hermes/plugins/xray-hermes');
+    const isolated = millSuit.isIsolatedHome();
+    const targetPluginDir = isolated
+        ? path.join(process.cwd(), '.hermes/plugins/xray-hermes')
+        : path.join(millSuit.machineHome(), '.hermes/plugins/xray-hermes');
     const possibleSources = [
         path.join(__dirname, '..', '..', '..', 'dist/integrations/hermes-agent'),
         path.join(__dirname, '..', '..', '..', 'src/integrations/hermes-agent'),
@@ -65,10 +67,10 @@ async function installForHermes(options = {}) {
             frameworkLogger.log('hermes-integration', 'skills-synced', 'info', { count: skillsCopied });
         }
         wiring.copyHermesFindProjectRootHelper(packageRoot, targetPluginDir);
-        if (wiring.copyHermesHookRuntimes(packageRoot)) {
+        if (!isolated && wiring.copyHermesHookRuntimes(packageRoot)) {
             frameworkLogger.log('hermes-integration', 'hooks-copied', 'info', {});
         }
-        const wired = wiring.wireHermesBridge(targetDir);
+        const wired = isolated ? { count: 0 } : wiring.wireHermesBridge(targetDir);
         mintAfterWear(targetDir);
         console.log(`\x1b[32m✓ Wired Hermes mcp_servers (${wired.count} servers)\x1b[0m`);
         console.log(`\x1b[32m✓ Consumer root → ${targetDir}\x1b[0m`);

package/dist/cli/commands/openclaw-install.js

@@ -1,6 +1,5 @@
 import fs from 'fs';
 import path from 'path';
-import { homedir } from 'os';
 import { createRequire } from 'module';
 import { frameworkLogger } from '../../core/framework-logger.js';
 import { syncBuiltinSkills } from './skill-install.js';
@@ -9,6 +8,7 @@ import { OpenClawConfigLoader } from '../../integrations/openclaw/config.js';
 import { writeSuitSessionBoot } from '../../nucleus/suit-temperament.js';
 const __dirname = path.dirname(new URL(import.meta.url).pathname);
 const require = createRequire(import.meta.url);
+const millSuit = require(path.join(__dirname, '..', '..', '..', 'scripts', 'foundry', 'mint-suit.cjs'));
 const wiring = require(path.join(__dirname, '..', '..', '..', 'scripts', 'node', 'bridge-mcp-wiring.cjs'));
 export function registerOpenClawCommands(openclawCmd) {
     openclawCmd
@@ -40,14 +40,19 @@ async function installForOpenClaw(options = {}) {
             const relative = path.relative(process.cwd(), configPath);
             console.log(`\x1b[32m✓ Created OpenClaw config at ${relative}\x1b[0m`);
         }
-        const openclawSkillsDir = path.join(homedir(), '.openclaw', 'skills');
+        const isolated = millSuit.isIsolatedHome();
+        const openclawSkillsDir = isolated
+            ? path.join(targetDir, '.openclaw', 'skills')
+            : path.join(millSuit.machineHome(), '.openclaw', 'skills');
         const skillsCopied = syncBuiltinSkills(openclawSkillsDir);
         if (skillsCopied > 0) {
             console.log(`\x1b[32m✓ Synced ${skillsCopied} builtin skills to ~/.openclaw/skills/\x1b[0m`);
         }
         frameworkLogger.log('openclaw-integration', 'skills-synced', 'info', { count: skillsCopied });
         mintAfterWear(targetDir);
-        const wired = wiring.wireOpenClawBridge(targetDir);
+        const wired = isolated
+            ? { count: 0, path: configPath, method: 'skipped-isolated-home' }
+            : wiring.wireOpenClawBridge(targetDir);
         console.log(`\x1b[32m✓ Wired OpenClaw MCP servers (${wired.count} via ${wired.method}) → ${wired.path}\x1b[0m`);
         console.log(`\x1b[32m✓ Consumer root → ${targetDir}\x1b[0m`);
         try {
@@ -57,8 +62,8 @@ async function installForOpenClaw(options = {}) {
             /* session-boot is best-effort */
         }
         const packageRoot = path.resolve(__dirname, '..', '..', '..');
-        const hookInstalled = wiring.installOpenClawHostWear(packageRoot);
-        const cliBackend = wiring.maybeWriteOpenClawCliBackend();
+        const hookInstalled = isolated ? null : wiring.installOpenClawHostWear(packageRoot);
+        const cliBackend = isolated ? false : wiring.maybeWriteOpenClawCliBackend();
         frameworkLogger.log('openclaw-integration', 'cli-backend', 'info', { written: cliBackend });
         if (hookInstalled) {
             console.log(`\x1b[32m✓ OpenClaw PreToolUse hook → ${hookInstalled}\x1b[0m`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "0xray",
-  "version": "4.0.5",
+  "version": "4.0.7",
   "description": "Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw",
   "readme": "README.md",
   "license": "MIT",

package/scripts/foundry/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.1.9] - 2026-09-09
+
+Inventory writes `dna` (keccak256 of canonical JSON without `mintedAt`). Inspect receipt echoes `dna` + pack `0xray-suit` for Groover GRVR. Mill does not mint on chain. Not an 8th MCP. Not 5.0.
+
+## [0.1.8] - 2026-09-09
+
+Isolated HOME skips machine `~/.hermes` and `~/.openclaw` (passwd home, same gate as Grok). Inspect GETs a public consumer tarball (`@0xray/review-suit`). CLI `mint` runs inspect after overlay; postinstall does not. Not an 8th MCP. Not 5.0.
+
 ## [0.1.7] - 2026-09-04
 
 Inspect is mill flesh: `npx @0xray/foundry inspect` runs diff, plant vs worn (mint fails costume dump), mill receipt, CI, GET the `.tgz` (HTTP 200), isolated HOME vs passwd home. Four project skill floors created on fasten (OpenCode, Grok, Hermes, OpenClaw). CI report is `.xray/foundry-ci-report.json`. Not an 8th MCP. Not 5.0.

package/scripts/foundry/cli.mjs

@@ -26,7 +26,7 @@ const HELP =
   "\n" +
   "Mill, not exo. FOUNDRY_ROOT overrides cwd (the repo being milled).\n" +
   "release bumps/commits/pushes/publishes the milled cwd — pass --dry-run or --i-mean-it (or FOUNDRY_RELEASE=1).\n" +
-  "Mint fastens mill plant then overlays their plant (mill-fill JSON). PPE stays worn.\n" +
+  "Mint fastens mill plant then overlays their plant (mill-fill JSON), then runs inspect. PPE stays worn.\n" +
   "inspect runs the six mill checks (diff, plant vs worn, receipt, CI, live tarball GET, isolated HOME). Not an 8th MCP.\n" +
   "gate is build+test. docs-build is Docusaurus on the 0xray exo. ci reports GitHub Actions (no auto-push). hooks installs git pre/post hooks.\n";
 

package/scripts/foundry/inspect.mjs

@@ -119,6 +119,8 @@ function checkReceipt(root) {
     suit: inventory.suit,
     mill: inventory.mill,
     millPlant: millPlantSkills,
+    dna: typeof inventory.dna === "string" ? inventory.dna : null,
+    pack: "0xray-suit",
     detail: ok ? null : "millPlant.skills must include mill and inspect",
   };
 }
@@ -179,7 +181,7 @@ export async function checkLivePut(packages, fetchFn = fetch) {
   return results;
 }
 
-function packagesToProbe(root) {
+export function packagesToProbe(root) {
   const pkgs = [];
   const inventory = readJson(path.join(root, ".xray", "foundry-inventory.json"));
   if (inventory?.mill?.name && inventory?.mill?.version) {
@@ -193,6 +195,17 @@ function packagesToProbe(root) {
   if (self?.name === "0xray" && self?.version) {
     pkgs.push({ name: "0xray", version: self.version });
   }
+  if (
+    self &&
+    self.private !== true &&
+    inventory?.consumer?.name &&
+    inventory?.consumer?.version
+  ) {
+    pkgs.push({
+      name: inventory.consumer.name,
+      version: inventory.consumer.version,
+    });
+  }
   const seen = new Set();
   return pkgs.filter((p) => {
     const key = `${p.name}@${p.version}`;
@@ -262,10 +275,13 @@ export async function inspectSuit(root, opts = {}) {
   checks.push(checkIsolatedHome(env, machineHome));
 
   const failed = checks.filter((c) => c.ok === false);
+  const receipt = checks.find((c) => c.id === "receipt") || {};
   return {
     ok: failed.length === 0,
     failed: failed.map((c) => c.id),
     checks,
+    dna: receipt.dna || null,
+    pack: "0xray-suit",
   };
 }
 

package/scripts/foundry/mill-dna.cjs

@@ -0,0 +1,50 @@
+/**
+ * Canonical mill DNA for Groover GRVR. keccak256 of inventory without mintedAt/dna.
+ * Not a chain client. Not an 8th MCP.
+ */
+"use strict";
+
+const { keccak_256 } = require("./mill-keccak.cjs");
+
+function isPlainObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => canonicalJson(item)).join(",")}]`;
+  }
+  const keys = Object.keys(value).sort();
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+}
+
+function dnaPayload(inventory) {
+  if (!isPlainObject(inventory)) {
+    throw new Error("inventory object required for mill DNA");
+  }
+  const payload = { ...inventory };
+  delete payload.mintedAt;
+  delete payload.dna;
+  return payload;
+}
+
+function inventoryDna(inventory) {
+  const json = canonicalJson(dnaPayload(inventory));
+  const digest = keccak_256(Buffer.from(json, "utf8"));
+  return `0x${Buffer.from(digest).toString("hex")}`;
+}
+
+function attachInventoryDna(inventory) {
+  if (!isPlainObject(inventory)) return inventory;
+  const next = { ...inventory };
+  next.dna = inventoryDna(next);
+  return next;
+}
+
+module.exports = {
+  canonicalJson,
+  dnaPayload,
+  inventoryDna,
+  attachInventoryDna,
+};

package/scripts/foundry/mill-keccak.cjs

@@ -0,0 +1,306 @@
+/* vendored @noble/hashes keccak_256 — mill DNA. Not an 8th MCP. */
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// <stdin>
+var stdin_exports = {};
+__export(stdin_exports, {
+  keccak_256: () => keccak_256
+});
+module.exports = __toCommonJS(stdin_exports);
+
+// node_modules/@noble/hashes/esm/_u64.js
+var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+var _32n = /* @__PURE__ */ BigInt(32);
+function fromBig(n, le = false) {
+  if (le)
+    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
+  return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
+}
+function split(lst, le = false) {
+  const len = lst.length;
+  let Ah = new Uint32Array(len);
+  let Al = new Uint32Array(len);
+  for (let i = 0; i < len; i++) {
+    const { h, l } = fromBig(lst[i], le);
+    [Ah[i], Al[i]] = [h, l];
+  }
+  return [Ah, Al];
+}
+var rotlSH = (h, l, s) => h << s | l >>> 32 - s;
+var rotlSL = (h, l, s) => l << s | h >>> 32 - s;
+var rotlBH = (h, l, s) => l << s - 32 | h >>> 64 - s;
+var rotlBL = (h, l, s) => h << s - 32 | l >>> 64 - s;
+
+// node_modules/@noble/hashes/esm/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+}
+function anumber(n) {
+  if (!Number.isSafeInteger(n) || n < 0)
+    throw new Error("positive integer expected, got " + n);
+}
+function abytes(b, ...lengths) {
+  if (!isBytes(b))
+    throw new Error("Uint8Array expected");
+  if (lengths.length > 0 && !lengths.includes(b.length))
+    throw new Error("Uint8Array expected of length " + lengths + ", got length=" + b.length);
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput(out, instance) {
+  abytes(out);
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new Error("digestInto() expects output buffer of length at least " + min);
+  }
+}
+function u32(arr) {
+  return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
+function byteSwap(word) {
+  return word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
+}
+function byteSwap32(arr) {
+  for (let i = 0; i < arr.length; i++) {
+    arr[i] = byteSwap(arr[i]);
+  }
+  return arr;
+}
+var swap32IfBE = isLE ? (u) => u : byteSwap32;
+function utf8ToBytes(str) {
+  if (typeof str !== "string")
+    throw new Error("string expected");
+  return new Uint8Array(new TextEncoder().encode(str));
+}
+function toBytes(data) {
+  if (typeof data === "string")
+    data = utf8ToBytes(data);
+  abytes(data);
+  return data;
+}
+var Hash = class {
+};
+function createHasher(hashCons) {
+  const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
+  const tmp = hashCons();
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.create = () => hashCons();
+  return hashC;
+}
+
+// node_modules/@noble/hashes/esm/sha3.js
+var _0n = BigInt(0);
+var _1n = BigInt(1);
+var _2n = BigInt(2);
+var _7n = BigInt(7);
+var _256n = BigInt(256);
+var _0x71n = BigInt(113);
+var SHA3_PI = [];
+var SHA3_ROTL = [];
+var _SHA3_IOTA = [];
+for (let round = 0, R = _1n, x = 1, y = 0; round < 24; round++) {
+  [x, y] = [y, (2 * x + 3 * y) % 5];
+  SHA3_PI.push(2 * (5 * y + x));
+  SHA3_ROTL.push((round + 1) * (round + 2) / 2 % 64);
+  let t = _0n;
+  for (let j = 0; j < 7; j++) {
+    R = (R << _1n ^ (R >> _7n) * _0x71n) % _256n;
+    if (R & _2n)
+      t ^= _1n << (_1n << /* @__PURE__ */ BigInt(j)) - _1n;
+  }
+  _SHA3_IOTA.push(t);
+}
+var IOTAS = split(_SHA3_IOTA, true);
+var SHA3_IOTA_H = IOTAS[0];
+var SHA3_IOTA_L = IOTAS[1];
+var rotlH = (h, l, s) => s > 32 ? rotlBH(h, l, s) : rotlSH(h, l, s);
+var rotlL = (h, l, s) => s > 32 ? rotlBL(h, l, s) : rotlSL(h, l, s);
+function keccakP(s, rounds = 24) {
+  const B = new Uint32Array(5 * 2);
+  for (let round = 24 - rounds; round < 24; round++) {
+    for (let x = 0; x < 10; x++)
+      B[x] = s[x] ^ s[x + 10] ^ s[x + 20] ^ s[x + 30] ^ s[x + 40];
+    for (let x = 0; x < 10; x += 2) {
+      const idx1 = (x + 8) % 10;
+      const idx0 = (x + 2) % 10;
+      const B0 = B[idx0];
+      const B1 = B[idx0 + 1];
+      const Th = rotlH(B0, B1, 1) ^ B[idx1];
+      const Tl = rotlL(B0, B1, 1) ^ B[idx1 + 1];
+      for (let y = 0; y < 50; y += 10) {
+        s[x + y] ^= Th;
+        s[x + y + 1] ^= Tl;
+      }
+    }
+    let curH = s[2];
+    let curL = s[3];
+    for (let t = 0; t < 24; t++) {
+      const shift = SHA3_ROTL[t];
+      const Th = rotlH(curH, curL, shift);
+      const Tl = rotlL(curH, curL, shift);
+      const PI = SHA3_PI[t];
+      curH = s[PI];
+      curL = s[PI + 1];
+      s[PI] = Th;
+      s[PI + 1] = Tl;
+    }
+    for (let y = 0; y < 50; y += 10) {
+      for (let x = 0; x < 10; x++)
+        B[x] = s[y + x];
+      for (let x = 0; x < 10; x++)
+        s[y + x] ^= ~B[(x + 2) % 10] & B[(x + 4) % 10];
+    }
+    s[0] ^= SHA3_IOTA_H[round];
+    s[1] ^= SHA3_IOTA_L[round];
+  }
+  clean(B);
+}
+var Keccak = class _Keccak extends Hash {
+  // NOTE: we accept arguments in bytes instead of bits here.
+  constructor(blockLen, suffix, outputLen, enableXOF = false, rounds = 24) {
+    super();
+    this.pos = 0;
+    this.posOut = 0;
+    this.finished = false;
+    this.destroyed = false;
+    this.enableXOF = false;
+    this.blockLen = blockLen;
+    this.suffix = suffix;
+    this.outputLen = outputLen;
+    this.enableXOF = enableXOF;
+    this.rounds = rounds;
+    anumber(outputLen);
+    if (!(0 < blockLen && blockLen < 200))
+      throw new Error("only keccak-f1600 function is supported");
+    this.state = new Uint8Array(200);
+    this.state32 = u32(this.state);
+  }
+  clone() {
+    return this._cloneInto();
+  }
+  keccak() {
+    swap32IfBE(this.state32);
+    keccakP(this.state32, this.rounds);
+    swap32IfBE(this.state32);
+    this.posOut = 0;
+    this.pos = 0;
+  }
+  update(data) {
+    aexists(this);
+    data = toBytes(data);
+    abytes(data);
+    const { blockLen, state } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      for (let i = 0; i < take; i++)
+        state[this.pos++] ^= data[pos++];
+      if (this.pos === blockLen)
+        this.keccak();
+    }
+    return this;
+  }
+  finish() {
+    if (this.finished)
+      return;
+    this.finished = true;
+    const { state, suffix, pos, blockLen } = this;
+    state[pos] ^= suffix;
+    if ((suffix & 128) !== 0 && pos === blockLen - 1)
+      this.keccak();
+    state[blockLen - 1] ^= 128;
+    this.keccak();
+  }
+  writeInto(out) {
+    aexists(this, false);
+    abytes(out);
+    this.finish();
+    const bufferOut = this.state;
+    const { blockLen } = this;
+    for (let pos = 0, len = out.length; pos < len; ) {
+      if (this.posOut >= blockLen)
+        this.keccak();
+      const take = Math.min(blockLen - this.posOut, len - pos);
+      out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
+      this.posOut += take;
+      pos += take;
+    }
+    return out;
+  }
+  xofInto(out) {
+    if (!this.enableXOF)
+      throw new Error("XOF is not possible for this instance");
+    return this.writeInto(out);
+  }
+  xof(bytes) {
+    anumber(bytes);
+    return this.xofInto(new Uint8Array(bytes));
+  }
+  digestInto(out) {
+    aoutput(out, this);
+    if (this.finished)
+      throw new Error("digest() was already called");
+    this.writeInto(out);
+    this.destroy();
+    return out;
+  }
+  digest() {
+    return this.digestInto(new Uint8Array(this.outputLen));
+  }
+  destroy() {
+    this.destroyed = true;
+    clean(this.state);
+  }
+  _cloneInto(to) {
+    const { blockLen, suffix, outputLen, rounds, enableXOF } = this;
+    to || (to = new _Keccak(blockLen, suffix, outputLen, enableXOF, rounds));
+    to.state32.set(this.state32);
+    to.pos = this.pos;
+    to.posOut = this.posOut;
+    to.finished = this.finished;
+    to.rounds = rounds;
+    to.suffix = suffix;
+    to.outputLen = outputLen;
+    to.enableXOF = enableXOF;
+    to.destroyed = this.destroyed;
+    return to;
+  }
+};
+var gen = (suffix, blockLen, outputLen) => createHasher(() => new Keccak(blockLen, suffix, outputLen));
+var keccak_256 = /* @__PURE__ */ (() => gen(1, 136, 256 / 8))();
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  keccak_256
+});
+/*! Bundled license information:
+
+@noble/hashes/esm/utils.js:
+  (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
+*/

package/scripts/foundry/mint-suit.cjs

@@ -10,6 +10,8 @@ const fs = require("fs");
 const os = require("os");
 const path = require("path");
 
+const { attachInventoryDna, inventoryDna } = require("./mill-dna.cjs");
+
 const DEFAULT_PARAMS = {
   codex: "xray/codex.json",
   features: "xray/features.json",
@@ -436,20 +438,22 @@ function mintConsumerFromSsot(packageRoot, targetDir, log, tree) {
     },
     mintedAt: new Date().toISOString(),
   };
+  const withDna = attachInventoryDna(inventory);
   const xrayDir = path.join(targetDir, ".xray");
   if (!fs.existsSync(xrayDir)) fs.mkdirSync(xrayDir, { recursive: true });
   fs.writeFileSync(
     path.join(xrayDir, "foundry-inventory.json"),
-    `${JSON.stringify(inventory, null, 2)}\n`,
+    `${JSON.stringify(withDna, null, 2)}\n`,
   );
   if (log) {
     log("foundry-mint", "Minted foundry-inventory from consumer mill SSOT", "info", {
       consumer: consumer.name,
       version: consumer.version,
       suit,
+      dna: withDna.dna,
     });
   }
-  return inventory;
+  return withDna;
 }
 
 function mintConsumerSuit(millPackageRoot, targetDir, log) {
@@ -504,6 +508,8 @@ module.exports = {
   listProjectSkillDirs,
   mintConsumerFromSsot,
   mintConsumerSuit,
+  attachInventoryDna,
+  inventoryDna,
   isDogfood,
   readPackageIdentity,
   wornSkillNames,

package/scripts/foundry/mint.mjs

@@ -8,13 +8,15 @@ import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { millPackageDir, resolveMillRoot } from "./mill-root.mjs";
+import { inspectSuit } from "./inspect.mjs";
 
 const require = createRequire(import.meta.url);
 const { mintConsumerSuit } = require("./mint-suit.cjs");
 
-function main() {
+async function main() {
   const target = resolveMillRoot();
   const millRoot = millPackageDir();
+  const skipLive = process.argv.includes("--skip-live");
   let inventory;
   try {
     inventory = mintConsumerSuit(millRoot, target, (component, action, status) => {
@@ -29,6 +31,9 @@ function main() {
     process.exit(0);
   }
   process.stdout.write(`${JSON.stringify(inventory, null, 2)}\n`);
+  const report = await inspectSuit(target, { millRoot, skipLive });
+  process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+  if (!report.ok) process.exit(1);
 }
 
 const isMain =

package/scripts/foundry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0xray/foundry",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "private": false,
   "type": "module",
   "description": "0xRay mill: mint their suit params, stamp, gate, publish, CI report, git hooks. Not the worn exo.",

package/scripts/foundry/plant/agents/inspect.yml

@@ -1,5 +1,5 @@
 name: inspect
 skill: inspect
 description: "Inspect AI work: diffs, traces, mill receipts, CI. Fastened mill plant."
-version: "0.1.7"
+version: "0.1.9"
 mode: subagent

package/scripts/foundry/plant/agents/mill.yml

@@ -1,5 +1,5 @@
 name: mill
 skill: mill
 description: "Fasten their plant as the suit. Factory Repertoire. Inspect is the mill discipline."
-version: "0.1.7"
+version: "0.1.9"
 mode: subagent

package/scripts/foundry/plant/skills/inspect/SKILL.md

@@ -30,3 +30,5 @@ npx @0xray/foundry mint
 npx @0xray/foundry inspect
 npx @0xray/foundry ci --report
 ```
+
+CLI `mint` runs inspect after overlay (exit 1 if inspect fails). Postinstall mint does not; `--skip-live` skips the tarball GET. Chat is not a receipt.

package/scripts/node/bridge-mcp-wiring.cjs

@@ -230,12 +230,13 @@ function isIsolatedHome(env = process.env, machine = millSuit.machineHome()) {
 }
 
 function copyHermesHookRuntimes(packageRoot) {
+  if (millSuit.isIsolatedHome()) return false;
   const hooksSrc = [
     path.join(packageRoot, "dist", "integrations", "hooks"),
     path.join(packageRoot, "src", "integrations", "hooks"),
   ].find((p) => fs.existsSync(p));
   if (!hooksSrc) return false;
-  const hooksDst = path.join(os.homedir(), ".hermes", "plugins", "hooks");
+  const hooksDst = path.join(millSuit.machineHome(), ".hermes", "plugins", "hooks");
   fs.mkdirSync(hooksDst, { recursive: true });
   fs.cpSync(hooksSrc, hooksDst, { recursive: true, force: true });
   return true;
@@ -428,10 +429,11 @@ function resolveOpenClawPluginDir(packageRoot) {
 }
 
 function installOpenClawHostWear(packageRoot) {
+  if (millSuit.isIsolatedHome()) return null;
   const source = resolveOpenClawPreToolHookSource(packageRoot);
   if (!source) return null;
 
-  const hookDir = path.join(os.homedir(), ".openclaw", "hooks");
+  const hookDir = path.join(millSuit.machineHome(), ".openclaw", "hooks");
   fs.mkdirSync(hookDir, { recursive: true });
   const dest = path.join(hookDir, "xray-pre-tool.mjs");
   fs.copyFileSync(source, dest);

package/scripts/node/install-bridges.cjs

@@ -423,7 +423,16 @@ function installHermesBridge(targetDir, packageRoot, log) {
     return;
   }
 
-  const targetPluginDir = path.join(os.homedir(), ".hermes", "plugins", "xray-hermes");
+  const ephemeral = isEphemeralInstallRoot(targetDir);
+  const isolated = isIsolatedHome();
+  const machine = machineHome();
+  const targetPluginDir =
+    ephemeral || isolated
+      ? path.join(targetDir, ".hermes", "plugins", "xray-hermes")
+      : path.join(machine, ".hermes", "plugins", "xray-hermes");
+  if (isolated) {
+    log("hermes-bridge", "skip machine ~/.hermes plugin — isolated HOME", "info");
+  }
   fs.mkdirSync(targetPluginDir, { recursive: true });
   for (const entry of fs.readdirSync(sourceDir)) {
     const src = path.join(sourceDir, entry);
@@ -435,10 +444,15 @@ function installHermesBridge(targetDir, packageRoot, log) {
     }
   }
   copyHermesFindProjectRootHelper(packageRoot, targetPluginDir);
-  if (copyHermesHookRuntimes(packageRoot)) {
+  if (!ephemeral && !isolated && copyHermesHookRuntimes(packageRoot)) {
     log("hermes-bridge", "hook runtimes copied", "info", { path: "~/.hermes/plugins/hooks" });
   }
-  log("hermes-bridge", "plugin copied", "info", { path: "~/.hermes/plugins/xray-hermes" });
+  log(
+    "hermes-bridge",
+    "plugin copied",
+    "info",
+    { path: ephemeral || isolated ? path.relative(targetDir, targetPluginDir) : "~/.hermes/plugins/xray-hermes" },
+  );
 
   writePluginMcpJson(targetPluginDir, targetDir, log, "hermes-bridge");
 
@@ -453,11 +467,13 @@ function installHermesBridge(targetDir, packageRoot, log) {
     log("hermes-bridge", "skip machine consumer marker — ephemeral consumer", "info");
   }
 
-  try {
-    const result = wireHermesBridge(targetDir);
-    log("hermes-bridge", `mcp_servers wired (${result.count} servers)`, "info");
-  } catch (e) {
-    log("hermes-bridge", "mcp_servers wire failed", "warn", { error: e.message });
+  if (!ephemeral && !isolated) {
+    try {
+      const result = wireHermesBridge(targetDir);
+      log("hermes-bridge", `mcp_servers wired (${result.count} servers)`, "info");
+    } catch (e) {
+      log("hermes-bridge", "mcp_servers wire failed", "warn", { error: e.message });
+    }
   }
 }
 
@@ -494,26 +510,52 @@ function installOpenclawBridge(targetDir, packageRoot, log) {
     log("openclaw-bridge", "config created", "info", { path: ".xray/config/openclaw.json" });
   }
 
-  const copied = syncCostumeSkills(path.join(os.homedir(), ".openclaw", "skills"), packageRoot, targetDir);
-  if (copied > 0) log("openclaw-bridge", `skills synced (${copied})`, "info", { path: "~/.openclaw/skills/" });
+  const ephemeralOpenclaw = isEphemeralInstallRoot(targetDir);
+  const isolatedOpenclaw = isIsolatedHome();
+  if (!ephemeralOpenclaw && !isolatedOpenclaw) {
+    const copied = syncCostumeSkills(
+      path.join(machineHome(), ".openclaw", "skills"),
+      packageRoot,
+      targetDir,
+    );
+    if (copied > 0) {
+      log("openclaw-bridge", `skills synced (${copied})`, "info", { path: "~/.openclaw/skills/" });
+    }
+  } else {
+    log(
+      "openclaw-bridge",
+      isolatedOpenclaw
+        ? "skip machine ~/.openclaw skills — isolated HOME"
+        : "skip machine ~/.openclaw skills — ephemeral consumer",
+      "info",
+    );
+  }
 
-  try {
-    const result = wireOpenClawBridge(targetDir);
-    log("openclaw-bridge", `openclaw.json mcp wired (${result.count} servers)`, "info", {
-      method: result.method,
-    });
-  } catch (e) {
-    log("openclaw-bridge", "openclaw.json mcp wire failed", "warn", { error: e.message });
+  if (!ephemeralOpenclaw && !isolatedOpenclaw) {
+    try {
+      const result = wireOpenClawBridge(targetDir);
+      log("openclaw-bridge", `openclaw.json mcp wired (${result.count} servers)`, "info", {
+        method: result.method,
+      });
+    } catch (e) {
+      log("openclaw-bridge", "openclaw.json mcp wire failed", "warn", { error: e.message });
+    }
   }
 
-  if (!isEphemeralInstallRoot(targetDir)) {
+  if (!ephemeralOpenclaw && !isolatedOpenclaw) {
     const hook = installOpenClawHostWear(packageRoot);
     if (hook) log("openclaw-bridge", "PreToolUse hook installed", "info", { path: hook });
     if (maybeWriteOpenClawCliBackend()) {
       log("openclaw-bridge", "opencode-cli backend written", "info");
     }
   } else {
-    log("openclaw-bridge", "skip machine PreToolUse wear — ephemeral consumer", "info");
+    log(
+      "openclaw-bridge",
+      isolatedOpenclaw
+        ? "skip machine PreToolUse wear — isolated HOME"
+        : "skip machine PreToolUse wear — ephemeral consumer",
+      "info",
+    );
   }
 }