0xray 2.1.3 → 2.2.0

package/.opencode/codex.codex

@@ -1,5 +1,5 @@
 {
-  "version": "2.1.1",
+  "version": "2.1.3",
   "terms": [
      1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68
   ],

package/.opencode/commands/dependency-audit.md

@@ -69,7 +69,7 @@ Comprehensive dependency analysis and security audit for all project dependencie
   "vulnerabilities": [
     {
       "package": "lodash",
-      "version": "2.1.1",
+      "version": "2.1.3",
       "severity": "high",
       "cve": "CVE-2021-23337",
       "description": "Command injection vulnerability"
@@ -85,14 +85,14 @@ Security-focused format for CI/CD integration:
 
 ```json
 {
-  "version": "2.1.1",
+  "version": "2.1.3",
   "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
   "runs": [
     {
       "tool": {
         "driver": {
           "name": "Dependency Audit",
-          "version": "2.1.1"
+          "version": "2.1.3"
         }
       },
       "results": [...]

package/.opencode/enforcer-config.json

@@ -1,6 +1,6 @@
 {
   "framework": "xray 2.0",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "Codex-compliant framework configuration for Credible UI project",
   "thresholds": {
     "bundleSize": {
@@ -220,7 +220,7 @@
       }
     },
     "codex": {
-      "version": "2.1.1",
+      "version": "2.1.3",
       "terms": [
         1,
         2,

package/README.md

@@ -1,6 +1,6 @@
 # 0xRay — Self-Healing AI Governance OS
 
-**v2.1.3** — 42 agents · 46 skills · 41 MCP servers · 68 codex terms · ~2,900 tests
+**v2.1.3** — 42 agents · 46 skills · 16 MCPs servers · 5 codex terms · ~2,2282 tests
 
 [![Docs](https://img.shields.io/badge/docs-0xRayAI.github.io/xray-10b981?style=flat-square)](https://0xrayai.github.io/xray/)
 
@@ -62,7 +62,7 @@ AI coding assistants are powerful but unreliable. They hallucinate APIs, introdu
 ├─────────────────────────────────────────────────┤
 │           External Governance (Dynamo)           │
 │  Codex enforcement · Multi-agent review · SSOT  │
-│  41 MCP servers (governance + knowledge skills) deliberate proposals │
+│  16 MCPs servers (governance + knowledge skills) deliberate proposals │
 ├─────────────────────────────────────────────────┤
 │          Autonomous Engine (thinDispatch)        │
 │  Task routing · Multi-agent coordination        │
@@ -179,7 +179,7 @@ Every subsystem is configurable via `features.json` (located at `.opencode/xray/
 
 ```json
 {
-  "version": "2.1.1",
+  "version": "2.1.3",
   "token_optimization": {
     "enabled": true,
     "max_context_tokens": 20000,

package/dist/CHANGELOG.md

@@ -4,6 +4,49 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Conventional Commits](https://www.conventionalcommits.org/).
 
+## [2.2.0] - 2026-06-10
+
+### 🚀 Features
+- feat: add Codex terms 69-72 covering self-evolution constraints (proposal governance, metamorphosis threshold, safety controls, traceability) (codex.json)
+- feat: long-running governed agent session verification E2E (11 tests, self-evolution-e2e.test.ts)
+- feat: Plugin API documentation — SkillPlugin, MetamorphosisEngine, SelfProposalEngine interfaces (docs/api/plugin-api.md)
+- feat: SelfProposalEngine with unit + E2E tests (postprocessor/metamorphosis/SelfProposalEngine.ts)
+- feat: nucleus kernel facade — handleGovernRequest, governViaNucleus, pluginRegistry (src/nucleus/)
+- feat: CLI govern command — status, audit, proposals, MCP management, storyteller (src/cli/commands/govern.ts)
+- feat: consumer verification script (scripts/verify-consumer.sh)
+
+### ♻️ Refactoring
+- refactor: 12-review subtract pass across all subsystems — ~16k LOC removed (Core, Nucleus, Governance, MCP, Inference, Orchestration, Delegation, Processors, Postprocessor, Enforcement, Integrations, CLI, Supporting)
+- refactor: delete trace-context.ts, errors.ts, logging-config.ts (inlined into framework-logger)
+- refactor: delete applyDecisionMatrix dead PHI/TAU matrix from governance-core
+- refactor: delete testing-best-practices.server.ts (1,183 LOC unregistered MCP bloat), orchestrator.server.ts shim
+- refactor: delete 4 dead orchestrator/delegation files (universal-registry-bridge, universal-librarian-consultation, self-direction-activation, task-skill-router.d.ts)
+- refactor: delete RetryHandler.ts, ComprehensiveValidator.ts from postprocessor
+- refactor: delete test-auto-healing.ts, cross-language-bridge.ts
+- refactor: delete 5 CLI dead files (4 analytics commands, server.ts)
+- refactor: delete 19 dead source + 6 stale test files across analytics, infrastructure, performance, reporting, utils, validation, state
+- refactor: delete dead expertise barrel exports (getAgentsWithExpertiseDomain, getTopExpertsForDomain)
+- refactor: update Codex references from 68 to 72 terms across docs
+- refactor: clean dead test script references in package.json
+
+### 🐛 Bug Fixes
+- fix: repair syntax from STRRAY_ cleanup (setup.ts, hermes bridge) so tests and release guard pass (87f3613ad)
+- fix: E2E test references to applyDecisionMatrix updated to mergeVotes
+
+---
+
+## [2.1.4] - 2026-06-09
+
+### 🔄 Changes
+
+### 🐛 Bug Fixes
+- fix: repair syntax from STRRAY_ cleanup (setup.ts, hermes bridge) so tests and release guard pass (87f3613ad)
+
+### 🔎 Other Changes
+- chore(release): strip remaining legacy STRRAY_ env fallbacks & shims so prepublish guard passes for v2.1.3 (0038993fc)
+
+---
+
 ## [2.1.3] - 2026-06-09
 
 ### 🔄 Changes

package/dist/README.md

@@ -1,6 +1,6 @@
 # 0xRay — Self-Healing AI Governance OS
 
-**v2.1.3** — 42 agents · 46 skills · 41 MCP servers · 68 codex terms · ~2,900 tests
+**v2.1.3** — 42 agents · 46 skills · 16 MCPs servers · 5 codex terms · ~2,2282 tests
 
 [![Docs](https://img.shields.io/badge/docs-0xRayAI.github.io/xray-10b981?style=flat-square)](https://0xrayai.github.io/xray/)
 
@@ -62,7 +62,7 @@ AI coding assistants are powerful but unreliable. They hallucinate APIs, introdu
 ├─────────────────────────────────────────────────┤
 │           External Governance (Dynamo)           │
 │  Codex enforcement · Multi-agent review · SSOT  │
-│  41 MCP servers (governance + knowledge skills) deliberate proposals │
+│  16 MCPs servers (governance + knowledge skills) deliberate proposals │
 ├─────────────────────────────────────────────────┤
 │          Autonomous Engine (thinDispatch)        │
 │  Task routing · Multi-agent coordination        │
@@ -179,7 +179,7 @@ Every subsystem is configurable via `features.json` (located at `.opencode/xray/
 
 ```json
 {
-  "version": "2.1.1",
+  "version": "2.1.3",
   "token_optimization": {
     "enabled": true,
     "max_context_tokens": 20000,

package/dist/analytics/routing-refiner.js

@@ -36,7 +36,7 @@ class RoutingRefiner {
         const optimizations = this.suggestMappingOptimizations(promptAnalysis, performanceReport);
         const warnings = this.generateWarnings(newMappings, optimizations);
         return {
-            version: "2.1.1",
+            version: "2.1.3",
             generatedAt: new Date(),
             summary: {
                 newMappings: newMappings.length,

package/dist/cli/commands/govern.d.ts

@@ -0,0 +1,29 @@
+/**
+ * xray govern — the primary CLI command for the v3 nucleus
+ *
+ * Usage:
+ *   xray govern [options]
+ *
+ * All existing direct commands still work (backward compat with deprecation notice).
+ */
+interface GovernOptions {
+    status?: boolean;
+    audit?: boolean;
+    mcp?: string;
+    pluginInstall?: string;
+    proposals?: string;
+    skillInstall?: string;
+    skillRegistry?: string;
+    storyteller?: string;
+    mcpList?: boolean;
+    mcpStatus?: boolean;
+    mcpInstall?: string;
+    mcpRemove?: string;
+    publishAgent?: boolean;
+    archiveLogs?: boolean;
+    credibleInit?: string;
+    antigravityStatus?: boolean;
+    [key: string]: unknown;
+}
+export declare function governCommand(options: GovernOptions): Promise<void>;
+export {};

package/dist/cli/commands/govern.js

@@ -0,0 +1,152 @@
+/**
+ * xray govern — the primary CLI command for the v3 nucleus
+ *
+ * Usage:
+ *   xray govern [options]
+ *
+ * All existing direct commands still work (backward compat with deprecation notice).
+ */
+import { resolve, join } from 'path';
+import { readFileSync, existsSync } from 'fs';
+import { spawn } from 'child_process';
+export async function governCommand(options) {
+    if (options.status) {
+        const { statusCommand } = await import('./status.js');
+        await statusCommand();
+        return;
+    }
+    if (options.audit) {
+        const { securityAuditCommand } = await import('./security-audit.js');
+        await securityAuditCommand();
+        return;
+    }
+    if (options.mcp) {
+        const serverMap = {
+            governance: 'dist/mcps/governance.server.js',
+            skills: 'dist/mcps/knowledge-skills/skill-invocation.server.js',
+        };
+        const relPath = serverMap[options.mcp];
+        if (!relPath) {
+            console.error(`Unknown MCP server: ${options.mcp}. Use: governance, skills`);
+            process.exit(1);
+        }
+        const packageJsonPath = resolve(import.meta.url.replace(/^file:/, ''), '..', '..', 'package.json');
+        const pkg = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));
+        const packageRoot = resolve(packageJsonPath, '..', pkg.xray?.dist ? join('', pkg.xray.dist) : 'dist', '..');
+        const serverPath = resolve(join(packageRoot, relPath));
+        if (!existsSync(serverPath)) {
+            console.error(`MCP server not found at ${serverPath}. Is xray installed correctly?`);
+            process.exit(1);
+        }
+        const env = { ...process.env };
+        if (options.mcp === 'governance') {
+            env.XRAY_FORCE_MCP_GOVERNANCE = 'true';
+        }
+        const child = spawn(process.execPath, [serverPath], { stdio: 'inherit', env });
+        child.on('exit', (code) => process.exit(code ?? 0));
+        return;
+    }
+    if (options.pluginInstall) {
+        const { pluginInstallCommand } = await import('./plugin-commands.js');
+        await pluginInstallCommand(options.pluginInstall);
+        return;
+    }
+    if (options.proposals) {
+        const { handleGovernRequest } = await import('../../nucleus/index.js');
+        let proposals;
+        try {
+            proposals = JSON.parse(options.proposals);
+        }
+        catch {
+            console.error('Invalid JSON in --proposals. Expected a JSON string with a "proposals" array.');
+            console.error('Example: xray govern --proposals \'[{"type":"fix","title":"Test","description":"A test"}]\'');
+            process.exit(1);
+        }
+        const result = await handleGovernRequest(proposals);
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (options.skillInstall !== undefined) {
+        const { skillInstallCommand } = await import('./skill-install.js');
+        await skillInstallCommand(options.skillInstall || undefined);
+        return;
+    }
+    if (options.skillRegistry !== undefined) {
+        const { skillRegistryCommand } = await import('./skill-install.js');
+        await skillRegistryCommand(options.skillRegistry || undefined);
+        return;
+    }
+    if (options.storyteller) {
+        const { storytellerCommand } = await import('./storyteller.js');
+        await storytellerCommand(options.storyteller);
+        return;
+    }
+    if (options.mcpList) {
+        const { listMCPsCommand } = await import('./mcp-install.js');
+        listMCPsCommand();
+        return;
+    }
+    if (options.mcpStatus) {
+        const { showMCPStatusCommand } = await import('./mcp-install.js');
+        showMCPStatusCommand();
+        return;
+    }
+    if (options.mcpInstall) {
+        const { installMCPCommand } = await import('./mcp-install.js');
+        await installMCPCommand(options.mcpInstall);
+        return;
+    }
+    if (options.mcpRemove) {
+        const { removeMCPCommand } = await import('./mcp-install.js');
+        removeMCPCommand(options.mcpRemove);
+        return;
+    }
+    if (options.publishAgent) {
+        const { publishAgentCommand } = await import('./publish-agent.js');
+        await publishAgentCommand();
+        return;
+    }
+    if (options.archiveLogs) {
+        const { archiveLogFiles } = await import('./archive-logs.js');
+        const result = await archiveLogFiles(undefined, `govern-${Date.now()}`);
+        console.log(`\nResults:`);
+        console.log(`  Archived: ${result.archived} files`);
+        if (result.errors.length > 0) {
+            console.log(`  Errors: ${result.errors.length}`);
+            result.errors.forEach((e) => console.log(`    - ${e}`));
+            process.exit(1);
+        }
+        return;
+    }
+    if (options.credibleInit !== undefined) {
+        const { credibleInitCommand } = await import('./credible-init.js');
+        await credibleInitCommand();
+        return;
+    }
+    if (options.antigravityStatus) {
+        const { antigravityStatusCommand } = await import('./antigravity-status.js');
+        await antigravityStatusCommand();
+        return;
+    }
+    console.log('xray govern — the governance kernel\n');
+    console.log('Usage: xray govern [options]\n');
+    console.log('Options:');
+    console.log('  --status                   Show framework status');
+    console.log('  --audit                    Run security audit');
+    console.log('  --mcp <server>             Run an MCP server (governance, skills)');
+    console.log('  --plugin-install <name>    Install a plugin');
+    console.log('  --proposals <json>         Run governance on JSON proposals');
+    console.log('  --skill-install [source]   Install skills from registry');
+    console.log('  --skill-registry [action]   Manage skill registry sources');
+    console.log('  --storyteller <type>       Write a story (reflection, saga, journey, narrative)');
+    console.log('  --mcp-list                 List available MCP servers');
+    console.log('  --mcp-status               Show installed MCP servers');
+    console.log('  --mcp-install <name>       Install an MCP server');
+    console.log('  --mcp-remove <name>        Remove an MCP server');
+    console.log('  --publish-agent            Publish an agent to AgentStore');
+    console.log('  --archive-logs             Archive log files');
+    console.log('  --credible-init [name]     Initialize Credible Pod');
+    console.log('  --antigravity-status       Show installed skills status');
+    console.log('  -h, --help                 Show this help\n');
+    console.log('All existing commands still work: xray status, xray security-audit, etc.');
+}

package/dist/cli/index.js

@@ -364,60 +364,6 @@ program
         process.exit(1);
     }
 });
-// Analytics command - pattern analysis, insights, and consent management
-program
-    .command("analytics")
-    .description("xray Central Analytics - Pattern analysis, insights, and consent management\n" +
-    "  In v1.7.2+: Includes consent management with granular control\n" +
-    "  Use 'npx xray analytics enable' to opt-in to data sharing\n" +
-    "  Core classes: ConsentManager, AnonymizationEngine available programmatically")
-    .option("-l, --limit <number>", "Limit analysis to last N task completions")
-    .option("-o, --output <file>", "Save report to file")
-    .action(async (opts) => {
-    console.log("📊 xray Pattern Analytics");
-    console.log("==============================");
-    console.log("");
-    try {
-        // Dynamic import to avoid loading analytics module unless needed
-        const { SimplePatternAnalyzer } = await import("../analytics/simple-pattern-analyzer.js");
-        // Get default limit from features.json
-        const fs = await import("fs");
-        const path = await import("path");
-        let defaultLimit = 500;
-        try {
-            const featuresPath = path.join(process.cwd(), ".opencode", "plugins", "features.json"); // plain xray primary (min compat .xray/ handled in getConfigDir per Scope Rule)
-            if (fs.existsSync(featuresPath)) {
-                const features = JSON.parse(fs.readFileSync(featuresPath, "utf-8"));
-                defaultLimit = features.analytics?.default_limit || 500;
-            }
-        }
-        catch { /* use default */ }
-        const analyzer = new SimplePatternAnalyzer();
-        const limit = parseInt(opts.limit) || defaultLimit;
-        console.log(`Analyzing last ${limit} task completions...`);
-        console.log("");
-        const insights = await analyzer.analyze(limit);
-        const insightsLines = analyzer.generateInsights(insights);
-        // Print insights
-        insightsLines.forEach((line) => {
-            console.log(line);
-        });
-        // Save to file if requested
-        if (opts.output) {
-            const fs = await import("fs");
-            const report = await analyzer.generateReport();
-            fs.writeFileSync(opts.output, report);
-            console.log("");
-            console.log(`✅ Report saved to: ${opts.output}`);
-        }
-        console.log("");
-        console.log("💡 Run regularly to track agent performance and complexity accuracy");
-    }
-    catch (error) {
-        console.error("❌ Analytics failed:", error instanceof Error ? error.message : String(error));
-        process.exit(1);
-    }
-});
 program
     .command("doctor")
     .description("Diagnose framework issues (does not fix them)")
@@ -494,40 +440,6 @@ program
         process.exit(1);
     }
 });
-// Archive logs command - standalone, no framework boot required
-program
-    .command("archive-logs")
-    .description("Archive log files without framework boot (for git hooks)")
-    .option("--dry-run", "Show what would be archived without making changes")
-    .option("-v, --verbose", "Verbose output")
-    .action(async (opts) => {
-    console.log("📦 xray Log Archive");
-    console.log("========================");
-    if (opts.dryRun) {
-        console.log("(Dry run mode - no changes will be made)");
-    }
-    try {
-        // Import and run standalone archiver
-        const archiveModule = await import("./commands/archive-logs.js");
-        const result = await archiveModule.archiveLogFiles({
-            maxFileSizeMB: 10,
-            rotationIntervalHours: 24,
-            compressionEnabled: true,
-            maxArchives: 10,
-        }, `cli-${Date.now()}`);
-        console.log(`\n📊 Results:`);
-        console.log(`  Archived: ${result.archived} files`);
-        if (result.errors.length > 0) {
-            console.log(`  Errors: ${result.errors.length}`);
-            result.errors.forEach((e) => console.log(`    - ${e}`));
-            process.exit(1);
-        }
-    }
-    catch (error) {
-        console.error("Archive failed:", error);
-        process.exit(1);
-    }
-});
 // Inference improvement command
 program
     .command('inference:improve')
@@ -691,7 +603,7 @@ program
     const projectRoot = process.cwd();
     const inferenceDir = `${projectRoot}/docs/inference`;
     const stateDir = `${projectRoot}/.xray/inference`;
-    const stateFile = `${stateDir}/inference-cycle-state.json`;
+    const stateFile = `${stateDir}/inference-state.json`;
     if (!options.json) {
         console.log('xray Inference Cycle');
         console.log('====================');
@@ -765,35 +677,6 @@ program
         }
     }
 });
-// Publish agent command
-program
-    .command('publish-agent')
-    .description('Package and publish agents to AgentStore')
-    .option('-a, --agent <name>', 'Agent name to publish')
-    .option('-v, --version <version>', 'Version to publish (default: 1.0.0)')
-    .option('-d, --dry-run', 'Show what would be published without publishing')
-    .action(async () => {
-    const { publishAgentCommand } = await import('./commands/publish-agent.js');
-    await publishAgentCommand();
-});
-// Antigravity status command
-program
-    .command('antigravity status')
-    .description('Show status of all installed skills')
-    .action(async () => {
-    const { antigravityStatusCommand } = await import('./commands/antigravity-status.js');
-    await antigravityStatusCommand();
-});
-// Credible init command
-program
-    .command('credible init')
-    .description('Initialize Credible Pod infrastructure')
-    .option('-n, --name <name>', 'Pod name')
-    .option('-t, --template <template>', 'Pod template to use')
-    .action(async () => {
-    const { credibleInitCommand } = await import('./commands/credible-init.js');
-    await credibleInitCommand();
-});
 // Skill registry command
 program
     .command('skill:registry [action]')
@@ -816,51 +699,6 @@ program
     const { skillInstallCommand } = await import('./commands/skill-install.js');
     await skillInstallCommand(sourceArg, options);
 });
-// Storyteller command
-program
-    .command('storyteller [type]')
-    .description('Write reflections, sagas, journeys, or narratives')
-    .option('-t, --title <title>', 'Title for the story')
-    .option('-f, --framework <framework>', 'Storytelling framework (three_act_structure, hero_journey, spiral)')
-    .option('-o, --output <file>', 'Output file path')
-    .option('--dry-run', 'Show prompt without creating file')
-    .action(async (type, options) => {
-    const { storytellerCommand } = await import('./commands/storyteller.js');
-    await storytellerCommand(type, options);
-});
-// MCP install commands - support both hyphen and colon formats
-program
-    .command('mcp-list')
-    .alias('mcp:list')
-    .description('List available community MCP servers')
-    .action(async () => {
-    const { listMCPsCommand } = await import('./commands/mcp-install.js');
-    listMCPsCommand();
-});
-program
-    .command('mcp-status')
-    .alias('mcp:status')
-    .description('Show installed MCP servers')
-    .action(async () => {
-    const { showMCPStatusCommand } = await import('./commands/mcp-install.js');
-    showMCPStatusCommand();
-});
-program
-    .command('mcp-install <name>')
-    .alias('mcp:install')
-    .description('Install an MCP server from the registry')
-    .action(async (name) => {
-    const { installMCPCommand } = await import('./commands/mcp-install.js');
-    await installMCPCommand(name);
-});
-program
-    .command('mcp-remove <name>')
-    .alias('mcp:remove')
-    .description('Remove an installed MCP server')
-    .action(async (name) => {
-    const { removeMCPCommand } = await import('./commands/mcp-install.js');
-    removeMCPCommand(name);
-});
 // MCP server subprocess launchers (used by Grok plugin .mcp.json via npx)
 program
     .command('mcp')
@@ -905,51 +743,6 @@ registerOpenClawCommands(openclawCmd);
 const opencodeCmd = program.command('opencode').description('OpenCode integration commands');
 const { registerOpencodeCommands } = await import('./commands/opencode-install.js');
 registerOpencodeCommands(opencodeCmd);
-// Analytics enable command
-// Plugin subcommands
-const pluginCmd = program.command('plugin').description('Manage plugins');
-pluginCmd
-    .command('list')
-    .description('List installed plugins')
-    .action(async () => {
-    const { pluginListCommand } = await import('./commands/plugin-commands.js');
-    await pluginListCommand();
-});
-pluginCmd
-    .command('install <name>')
-    .description('Install a plugin')
-    .action(async (name) => {
-    const { pluginInstallCommand } = await import('./commands/plugin-commands.js');
-    await pluginInstallCommand(name);
-});
-pluginCmd
-    .command('enable <name>')
-    .description('Enable a plugin')
-    .action(async (name) => {
-    const { pluginEnableCommand } = await import('./commands/plugin-commands.js');
-    await pluginEnableCommand(name);
-});
-pluginCmd
-    .command('disable <name>')
-    .description('Disable a plugin')
-    .action(async (name) => {
-    const { pluginDisableCommand } = await import('./commands/plugin-commands.js');
-    await pluginDisableCommand(name);
-});
-pluginCmd
-    .command('status <name>')
-    .description('Show plugin details')
-    .action(async (name) => {
-    const { pluginStatusCommand } = await import('./commands/plugin-commands.js');
-    await pluginStatusCommand(name);
-});
-pluginCmd
-    .command('uninstall <name>')
-    .description('Uninstall a plugin')
-    .action(async (name) => {
-    const { pluginUninstallCommand } = await import('./commands/plugin-commands.js');
-    await pluginUninstallCommand(name);
-});
 // Security audit command
 program
     .command("security-audit")
@@ -958,6 +751,30 @@ program
     const { securityAuditCommand } = await import("./commands/security-audit.js");
     await securityAuditCommand();
 });
+// v3 nucleus: primary governance command
+program
+    .command("govern")
+    .description("Run the xray governance kernel")
+    .option("--status", "Show framework status")
+    .option("--audit", "Run security audit")
+    .option("--mcp <server>", "Run an MCP server subprocess (governance, skills)")
+    .option("--plugin-install <name>", "Install a plugin")
+    .option("--proposals <json>", "Run governance on JSON proposals")
+    .option("--skill-install [source]", "Install skills from registry")
+    .option("--skill-registry [action]", "Manage skill registry sources")
+    .option("--storyteller <type>", "Write a story (reflection|saga|journey|narrative)")
+    .option("--mcp-list", "List available MCP servers")
+    .option("--mcp-status", "Show installed MCP servers")
+    .option("--mcp-install <name>", "Install an MCP server")
+    .option("--mcp-remove <name>", "Remove an MCP server")
+    .option("--publish-agent", "Publish an agent to AgentStore")
+    .option("--archive-logs", "Archive log files")
+    .option("--credible-init [name]", "Initialize Credible Pod")
+    .option("--antigravity-status", "Show installed skills status")
+    .action(async (options) => {
+    const { governCommand } = await import("./commands/govern.js");
+    await governCommand(options);
+});
 // Add help text
 program.addHelpText("after", `
 
@@ -971,14 +788,11 @@ Examples:
     $ npx 0xray report        # Generate activity and health reports
     $ npx 0xray fix           # Automatically restore missing config files
     $ npx 0xray doctor        # Diagnose issues (does not fix them)
-    $ npx 0xray analytics     # Pattern analytics and insights
     $ npx 0xray inference:improve  # Run autonomous inference improvement
-    $ npx 0xray skill:install agency-agents  # Install 170+ agency agent skills
-    $ npx 0xray skill:install superpowers      # Install 14 agentic workflow skills
-    $ npx 0xray skill:install <github-url>     # Install from any repo
     $ npx 0xray security-audit --deep  # Run deep security audit
-    $ npx 0xray storyteller saga "v1.18.0 Journey"  # Write a saga
-    $ npx 0xray storyteller reflection "API Fix"     # Write a reflection
+    $ npx 0xray govern                  # Run the governance kernel
+    $ npx 0xray govern --status        # Show status (v3 nucleus)
+    $ npx 0xray govern --proposals '[{"type":"fix","title":"Test","description":"A test"}]'
 
 Quick Start:
    1. Install: npx 0xray install
@@ -986,8 +800,7 @@ Quick Start:
    3. Use agents: @security-auditor scan
    4. Generate reports: npx 0xray report
    5. Fix issues: npx 0xray fix
-   6. View analytics: npx 0xray analytics
-   7. Add skills: npx 0xray skill:install agency-agents
+   6. Add skills: npx 0xray skill:install agency-agents
 
 For more information, visit: https://github.com/0xRayAI/xray
 `);

package/dist/core/boot-orchestrator.js

@@ -717,7 +717,7 @@ export class BootOrchestrator {
         try {
             // Consumer runtime compat (XRAY_ env + .xray fallbacks)
             const xrayConfig = {
-                version: "2.1.1",
+                version: "2.1.3",
                 codex_enabled: true,
                 codex_version: "v2.1.1",
                 codex_terms: [

package/dist/core/features-config.js

@@ -286,7 +286,7 @@ export class FeaturesConfigLoader {
      */
     getDefaultConfig() {
         return {
-            version: "2.1.1",
+            version: "2.1.3",
             description: "0xRay Framework - Unified Feature Configuration",
             token_optimization: {
                 enabled: true,