0xray 2.1.4 → 2.2.1

package/.opencode/codex.codex

@@ -1,5 +1,5 @@
 {
-  "version": "2.1.3",
+  "version": "2.2.0",
   "terms": [
      1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68
   ],

package/.opencode/commands/dependency-audit.md

@@ -69,7 +69,7 @@ Comprehensive dependency analysis and security audit for all project dependencie
   "vulnerabilities": [
     {
       "package": "lodash",
-      "version": "2.1.3",
+      "version": "2.2.0",
       "severity": "high",
       "cve": "CVE-2021-23337",
       "description": "Command injection vulnerability"
@@ -85,14 +85,14 @@ Security-focused format for CI/CD integration:
 
 ```json
 {
-  "version": "2.1.3",
+  "version": "2.2.0",
   "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
   "runs": [
     {
       "tool": {
         "driver": {
           "name": "Dependency Audit",
-          "version": "2.1.3"
+          "version": "2.2.0"
         }
       },
       "results": [...]

package/.opencode/enforcer-config.json

@@ -1,6 +1,6 @@
 {
   "framework": "xray 2.0",
-  "version": "2.1.3",
+  "version": "2.2.0",
   "description": "Codex-compliant framework configuration for Credible UI project",
   "thresholds": {
     "bundleSize": {
@@ -220,7 +220,7 @@
       }
     },
     "codex": {
-      "version": "2.1.3",
+      "version": "2.2.0",
       "terms": [
         1,
         2,

package/.opencode/init.sh

@@ -70,7 +70,7 @@ echo -e "${PURPLE}//      ╚█████╔╝██╔╝ ██╗██
 echo -e "${PURPLE}//       ╚════╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═╝   ╚═╝           //${NC}" && sleep 0.1
 echo -e "${PURPLE}//                                                       //${NC}" && sleep 0.1
 echo -e "${PURPLE}//      ⚡ 0xRay: Self-Healing AI Governance OS          //${NC}" && sleep 0.1
-echo -e "${PURPLE}//      42 agents · 44 skills · 41 MCP servers           //${NC}" && sleep 0.1
+echo -e "${PURPLE}//      42 agents · 44 skills · 39 MCP servers           //${NC}" && sleep 0.1
 echo -e "${PURPLE}//═══════════════════════════════════════════════════════//${NC}" && sleep 0.2
 echo -e "${PURPLE}//              🚀 Initializing...                          //${NC}" && sleep 0.3
 echo -e "${PURPLE}//═══════════════════════════════════════════════════════//${NC}" && sleep 0.2

package/AGENTS.md

@@ -1,12 +1,12 @@
 # xray Agents
 
-Quick reference for xray AI orchestration framework (v16 MCPs-centric three-subsystem).
+Quick reference for xray AI orchestration framework (v15 MCPs-centric three-subsystem).
 
 ## What is xray?
 
 xray provides intelligent multi-agent orchestration with automatic delegation and Codex compliance validation under the pure v2 three-subsystem model (Inference + External Governance via Dynamo + Autonomous Engine via thinDispatch 7-flow in MCP orchestrator). Agents operate via `.opencode/agents/*.yml` YML surfaces and 3 dedicated MCP skill servers — no manual setup needed.
 
-## v16 MCPs-Centric Architecture
+## v15 MCPs-Centric Architecture
 
 The v2 release centers on **MCP (Model Context Protocol)** as the primary surface for agent skills. Three agent MCP servers handle governance deliberation:
 
@@ -84,14 +84,14 @@ The Autonomous Engine routes via complexity:
 
 xray enforces the Universal Development Codex (60 terms) via Dynamo governance. The codex lives in `.opencode/xray/codex.json`.
 
-Pure v16 MCPs. Clean. Complete.
+Pure v15 MCPs. Clean. Complete.
 
 ## Session: v2.1.2 Release Polish
 
 - Package: `0xray` (npm), `github.com/0xRayAI/xray`. Version `2.0.0`.
 - Renamed `strray-ai` → `0xray` across 60+ source files, CLI help text, grok plugin, hermes-agent bridge (Python + JS), docusaurus config.
 - **12 stale docs git-rm'd**: AGENTS-consumer.md, AGENTS-full.md, CHANGELOG-v1.15.x.md, 7 docs/ files.
-- **AGENTS.md + README.md**: Rewritten v16 MCPs-centric.
+- **AGENTS.md + README.md**: Rewritten v15 MCPs-centric.
 - **CLI help text**: `npx 0xray` — removed dead `dashboard` command, stale examples.
 - `.npmignore`: removed `src/` (conflicted with `files` field — was silently dropping published sources).
 - `.gitignore`: cleaned stale `.strray/` entries, `strray-ai-*.tgz` → `0xray-*.tgz`.
@@ -107,5 +107,5 @@ Pure v16 MCPs. Clean. Complete.
   - `status.ts` CLI command wired into `index.ts`
   - Orphaned files analyzed (not deleted): `security-audit.ts`, `src/security/` (11 files), `session-capture-processor.ts`, `activate-kernel-pipeline.ts`
 - **Hermes-agent bridge backward compat**: all JS/Python bridge files check for both `strray-ai` (old) and `0xray` (new). Default paths updated to `0xray`.
-  - **Test suite**: 162 files, 2282 tests (+ 44 skipped), 0 failures. Build passes clean.
-  - **OpenClaw e2e**: Phase 13 validates `logs/framework/activity.log` via agent tool event → hooks → frameworkLogger pipeline — 2282 tests, 0 failures.
+  - **Test suite**: 162 files, 2196 tests (+ 44 skipped), 0 failures. Build passes clean.
+  - **OpenClaw e2e**: Phase 13 validates `logs/framework/activity.log` via agent tool event → hooks → frameworkLogger pipeline — 2196 tests, 0 failures.

package/README.md

@@ -1,6 +1,6 @@
 # 0xRay — Self-Healing AI Governance OS
 
-**v2.1.3** — 42 agents · 46 skills · 16 MCPs servers · 5 codex terms · ~2,2282 tests
+**v2.1.3** — 42 agents · 46 skills · 15 MCPs servers · 9 codex terms · ~2,2196 tests
 
 [![Docs](https://img.shields.io/badge/docs-0xRayAI.github.io/xray-10b981?style=flat-square)](https://0xrayai.github.io/xray/)
 
@@ -62,7 +62,7 @@ AI coding assistants are powerful but unreliable. They hallucinate APIs, introdu
 ├─────────────────────────────────────────────────┤
 │           External Governance (Dynamo)           │
 │  Codex enforcement · Multi-agent review · SSOT  │
-│  16 MCPs servers (governance + knowledge skills) deliberate proposals │
+│  15 MCPs servers (governance + knowledge skills) deliberate proposals │
 ├─────────────────────────────────────────────────┤
 │          Autonomous Engine (thinDispatch)        │
 │  Task routing · Multi-agent coordination        │
@@ -179,7 +179,7 @@ Every subsystem is configurable via `features.json` (located at `.opencode/xray/
 
 ```json
 {
-  "version": "2.1.3",
+  "version": "2.2.0",
   "token_optimization": {
     "enabled": true,
     "max_context_tokens": 20000,
@@ -277,7 +277,7 @@ Install more skills anytime: `npx 0xray skill:install`
 
 ## Testing & Reliability
 
-0xRay is battle-tested with **~2,2282 tests** across every subsystem:
+0xRay is battle-tested with **~2,2196 tests** across every subsystem:
 
 | Suite | Tests | Status |
 |-------|-------|--------|

package/dist/AGENTS.md

@@ -1,12 +1,12 @@
 # xray Agents
 
-Quick reference for xray AI orchestration framework (v16 MCPs-centric three-subsystem).
+Quick reference for xray AI orchestration framework (v15 MCPs-centric three-subsystem).
 
 ## What is xray?
 
 xray provides intelligent multi-agent orchestration with automatic delegation and Codex compliance validation under the pure v2 three-subsystem model (Inference + External Governance via Dynamo + Autonomous Engine via thinDispatch 7-flow in MCP orchestrator). Agents operate via `.opencode/agents/*.yml` YML surfaces and 3 dedicated MCP skill servers — no manual setup needed.
 
-## v16 MCPs-Centric Architecture
+## v15 MCPs-Centric Architecture
 
 The v2 release centers on **MCP (Model Context Protocol)** as the primary surface for agent skills. Three agent MCP servers handle governance deliberation:
 
@@ -84,14 +84,14 @@ The Autonomous Engine routes via complexity:
 
 xray enforces the Universal Development Codex (60 terms) via Dynamo governance. The codex lives in `.opencode/xray/codex.json`.
 
-Pure v16 MCPs. Clean. Complete.
+Pure v15 MCPs. Clean. Complete.
 
 ## Session: v2.1.2 Release Polish
 
 - Package: `0xray` (npm), `github.com/0xRayAI/xray`. Version `2.0.0`.
 - Renamed `strray-ai` → `0xray` across 60+ source files, CLI help text, grok plugin, hermes-agent bridge (Python + JS), docusaurus config.
 - **12 stale docs git-rm'd**: AGENTS-consumer.md, AGENTS-full.md, CHANGELOG-v1.15.x.md, 7 docs/ files.
-- **AGENTS.md + README.md**: Rewritten v16 MCPs-centric.
+- **AGENTS.md + README.md**: Rewritten v15 MCPs-centric.
 - **CLI help text**: `npx 0xray` — removed dead `dashboard` command, stale examples.
 - `.npmignore`: removed `src/` (conflicted with `files` field — was silently dropping published sources).
 - `.gitignore`: cleaned stale `.strray/` entries, `strray-ai-*.tgz` → `0xray-*.tgz`.
@@ -107,5 +107,5 @@ Pure v16 MCPs. Clean. Complete.
   - `status.ts` CLI command wired into `index.ts`
   - Orphaned files analyzed (not deleted): `security-audit.ts`, `src/security/` (11 files), `session-capture-processor.ts`, `activate-kernel-pipeline.ts`
 - **Hermes-agent bridge backward compat**: all JS/Python bridge files check for both `strray-ai` (old) and `0xray` (new). Default paths updated to `0xray`.
-  - **Test suite**: 162 files, 2282 tests (+ 44 skipped), 0 failures. Build passes clean.
-  - **OpenClaw e2e**: Phase 13 validates `logs/framework/activity.log` via agent tool event → hooks → frameworkLogger pipeline — 2282 tests, 0 failures.
+  - **Test suite**: 162 files, 2196 tests (+ 44 skipped), 0 failures. Build passes clean.
+  - **OpenClaw e2e**: Phase 13 validates `logs/framework/activity.log` via agent tool event → hooks → frameworkLogger pipeline — 2196 tests, 0 failures.

package/dist/CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Conventional Commits](https://www.conventionalcommits.org/).
 
+## [2.2.1] - 2026-06-10
+
+### 🔄 Changes
+
+- Version bump
+
+---
+
+## [2.2.0] - 2026-06-10
+
+### 🚀 Features
+- feat: add Codex terms 69-72 covering self-evolution constraints (proposal governance, metamorphosis threshold, safety controls, traceability) (codex.json)
+- feat: long-running governed agent session verification E2E (11 tests, self-evolution-e2e.test.ts)
+- feat: Plugin API documentation — SkillPlugin, MetamorphosisEngine, SelfProposalEngine interfaces (docs/api/plugin-api.md)
+- feat: SelfProposalEngine with unit + E2E tests (postprocessor/metamorphosis/SelfProposalEngine.ts)
+- feat: nucleus kernel facade — handleGovernRequest, governViaNucleus, pluginRegistry (src/nucleus/)
+- feat: CLI govern command — status, audit, proposals, MCP management, storyteller (src/cli/commands/govern.ts)
+- feat: consumer verification script (scripts/verify-consumer.sh)
+
+### ♻️ Refactoring
+- refactor: 12-review subtract pass across all subsystems — ~16k LOC removed (Core, Nucleus, Governance, MCP, Inference, Orchestration, Delegation, Processors, Postprocessor, Enforcement, Integrations, CLI, Supporting)
+- refactor: delete trace-context.ts, errors.ts, logging-config.ts (inlined into framework-logger)
+- refactor: delete applyDecisionMatrix dead PHI/TAU matrix from governance-core
+- refactor: delete testing-best-practices.server.ts (1,183 LOC unregistered MCP bloat), orchestrator.server.ts shim
+- refactor: delete 4 dead orchestrator/delegation files (universal-registry-bridge, universal-librarian-consultation, self-direction-activation, task-skill-router.d.ts)
+- refactor: delete RetryHandler.ts, ComprehensiveValidator.ts from postprocessor
+- refactor: delete test-auto-healing.ts, cross-language-bridge.ts
+- refactor: delete 5 CLI dead files (4 analytics commands, server.ts)
+- refactor: delete 19 dead source + 6 stale test files across analytics, infrastructure, performance, reporting, utils, validation, state
+- refactor: delete dead expertise barrel exports (getAgentsWithExpertiseDomain, getTopExpertsForDomain)
+- refactor: update Codex references from 68 to 72 terms across docs
+- refactor: clean dead test script references in package.json
+
+### 🐛 Bug Fixes
+- fix: repair syntax from STRRAY_ cleanup (setup.ts, hermes bridge) so tests and release guard pass (87f3613ad)
+- fix: E2E test references to applyDecisionMatrix updated to mergeVotes
+
+---
+
 ## [2.1.4] - 2026-06-09
 
 ### 🔄 Changes

package/dist/README.md

@@ -1,6 +1,6 @@
 # 0xRay — Self-Healing AI Governance OS
 
-**v2.1.3** — 42 agents · 46 skills · 16 MCPs servers · 5 codex terms · ~2,2282 tests
+**v2.1.3** — 42 agents · 46 skills · 15 MCPs servers · 9 codex terms · ~2,2196 tests
 
 [![Docs](https://img.shields.io/badge/docs-0xRayAI.github.io/xray-10b981?style=flat-square)](https://0xrayai.github.io/xray/)
 
@@ -62,7 +62,7 @@ AI coding assistants are powerful but unreliable. They hallucinate APIs, introdu
 ├─────────────────────────────────────────────────┤
 │           External Governance (Dynamo)           │
 │  Codex enforcement · Multi-agent review · SSOT  │
-│  16 MCPs servers (governance + knowledge skills) deliberate proposals │
+│  15 MCPs servers (governance + knowledge skills) deliberate proposals │
 ├─────────────────────────────────────────────────┤
 │          Autonomous Engine (thinDispatch)        │
 │  Task routing · Multi-agent coordination        │
@@ -179,7 +179,7 @@ Every subsystem is configurable via `features.json` (located at `.opencode/xray/
 
 ```json
 {
-  "version": "2.1.3",
+  "version": "2.2.0",
   "token_optimization": {
     "enabled": true,
     "max_context_tokens": 20000,
@@ -277,7 +277,7 @@ Install more skills anytime: `npx 0xray skill:install`
 
 ## Testing & Reliability
 
-0xRay is battle-tested with **~2,2282 tests** across every subsystem:
+0xRay is battle-tested with **~2,2196 tests** across every subsystem:
 
 | Suite | Tests | Status |
 |-------|-------|--------|

package/dist/agents/code-reviewer.js

@@ -15,7 +15,7 @@ export const codeReviewer = {
 
 ## Framework Context
 - Universal Development Codex v1.2.0
-- Validate against all 5 codex terms
+- Validate against all 9 codex terms
 
 ## Rules (STRICT)
 - MAX 3 file reads, then review

package/dist/analytics/routing-refiner.js

@@ -36,7 +36,7 @@ class RoutingRefiner {
         const optimizations = this.suggestMappingOptimizations(promptAnalysis, performanceReport);
         const warnings = this.generateWarnings(newMappings, optimizations);
         return {
-            version: "2.1.3",
+            version: "2.2.0",
             generatedAt: new Date(),
             summary: {
                 newMappings: newMappings.length,

package/dist/cli/commands/govern.d.ts

@@ -0,0 +1,29 @@
+/**
+ * xray govern — the primary CLI command for the v3 nucleus
+ *
+ * Usage:
+ *   xray govern [options]
+ *
+ * All existing direct commands still work (backward compat with deprecation notice).
+ */
+interface GovernOptions {
+    status?: boolean;
+    audit?: boolean;
+    mcp?: string;
+    pluginInstall?: string;
+    proposals?: string;
+    skillInstall?: string;
+    skillRegistry?: string;
+    storyteller?: string;
+    mcpList?: boolean;
+    mcpStatus?: boolean;
+    mcpInstall?: string;
+    mcpRemove?: string;
+    publishAgent?: boolean;
+    archiveLogs?: boolean;
+    credibleInit?: string;
+    antigravityStatus?: boolean;
+    [key: string]: unknown;
+}
+export declare function governCommand(options: GovernOptions): Promise<void>;
+export {};

package/dist/cli/commands/govern.js

@@ -0,0 +1,152 @@
+/**
+ * xray govern — the primary CLI command for the v3 nucleus
+ *
+ * Usage:
+ *   xray govern [options]
+ *
+ * All existing direct commands still work (backward compat with deprecation notice).
+ */
+import { resolve, join } from 'path';
+import { readFileSync, existsSync } from 'fs';
+import { spawn } from 'child_process';
+export async function governCommand(options) {
+    if (options.status) {
+        const { statusCommand } = await import('./status.js');
+        await statusCommand();
+        return;
+    }
+    if (options.audit) {
+        const { securityAuditCommand } = await import('./security-audit.js');
+        await securityAuditCommand();
+        return;
+    }
+    if (options.mcp) {
+        const serverMap = {
+            governance: 'dist/mcps/governance.server.js',
+            skills: 'dist/mcps/knowledge-skills/skill-invocation.server.js',
+        };
+        const relPath = serverMap[options.mcp];
+        if (!relPath) {
+            console.error(`Unknown MCP server: ${options.mcp}. Use: governance, skills`);
+            process.exit(1);
+        }
+        const packageJsonPath = resolve(import.meta.url.replace(/^file:/, ''), '..', '..', 'package.json');
+        const pkg = JSON.parse(readFileSync(packageJsonPath, 'utf-8'));
+        const packageRoot = resolve(packageJsonPath, '..', pkg.xray?.dist ? join('', pkg.xray.dist) : 'dist', '..');
+        const serverPath = resolve(join(packageRoot, relPath));
+        if (!existsSync(serverPath)) {
+            console.error(`MCP server not found at ${serverPath}. Is xray installed correctly?`);
+            process.exit(1);
+        }
+        const env = { ...process.env };
+        if (options.mcp === 'governance') {
+            env.XRAY_FORCE_MCP_GOVERNANCE = 'true';
+        }
+        const child = spawn(process.execPath, [serverPath], { stdio: 'inherit', env });
+        child.on('exit', (code) => process.exit(code ?? 0));
+        return;
+    }
+    if (options.pluginInstall) {
+        const { pluginInstallCommand } = await import('./plugin-commands.js');
+        await pluginInstallCommand(options.pluginInstall);
+        return;
+    }
+    if (options.proposals) {
+        const { handleGovernRequest } = await import('../../nucleus/index.js');
+        let proposals;
+        try {
+            proposals = JSON.parse(options.proposals);
+        }
+        catch {
+            console.error('Invalid JSON in --proposals. Expected a JSON string with a "proposals" array.');
+            console.error('Example: xray govern --proposals \'[{"type":"fix","title":"Test","description":"A test"}]\'');
+            process.exit(1);
+        }
+        const result = await handleGovernRequest(proposals);
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (options.skillInstall !== undefined) {
+        const { skillInstallCommand } = await import('./skill-install.js');
+        await skillInstallCommand(options.skillInstall || undefined);
+        return;
+    }
+    if (options.skillRegistry !== undefined) {
+        const { skillRegistryCommand } = await import('./skill-install.js');
+        await skillRegistryCommand(options.skillRegistry || undefined);
+        return;
+    }
+    if (options.storyteller) {
+        const { storytellerCommand } = await import('./storyteller.js');
+        await storytellerCommand(options.storyteller);
+        return;
+    }
+    if (options.mcpList) {
+        const { listMCPsCommand } = await import('./mcp-install.js');
+        listMCPsCommand();
+        return;
+    }
+    if (options.mcpStatus) {
+        const { showMCPStatusCommand } = await import('./mcp-install.js');
+        showMCPStatusCommand();
+        return;
+    }
+    if (options.mcpInstall) {
+        const { installMCPCommand } = await import('./mcp-install.js');
+        await installMCPCommand(options.mcpInstall);
+        return;
+    }
+    if (options.mcpRemove) {
+        const { removeMCPCommand } = await import('./mcp-install.js');
+        removeMCPCommand(options.mcpRemove);
+        return;
+    }
+    if (options.publishAgent) {
+        const { publishAgentCommand } = await import('./publish-agent.js');
+        await publishAgentCommand();
+        return;
+    }
+    if (options.archiveLogs) {
+        const { archiveLogFiles } = await import('./archive-logs.js');
+        const result = await archiveLogFiles(undefined, `govern-${Date.now()}`);
+        console.log(`\nResults:`);
+        console.log(`  Archived: ${result.archived} files`);
+        if (result.errors.length > 0) {
+            console.log(`  Errors: ${result.errors.length}`);
+            result.errors.forEach((e) => console.log(`    - ${e}`));
+            process.exit(1);
+        }
+        return;
+    }
+    if (options.credibleInit !== undefined) {
+        const { credibleInitCommand } = await import('./credible-init.js');
+        await credibleInitCommand();
+        return;
+    }
+    if (options.antigravityStatus) {
+        const { antigravityStatusCommand } = await import('./antigravity-status.js');
+        await antigravityStatusCommand();
+        return;
+    }
+    console.log('xray govern — the governance kernel\n');
+    console.log('Usage: xray govern [options]\n');
+    console.log('Options:');
+    console.log('  --status                   Show framework status');
+    console.log('  --audit                    Run security audit');
+    console.log('  --mcp <server>             Run an MCP server (governance, skills)');
+    console.log('  --plugin-install <name>    Install a plugin');
+    console.log('  --proposals <json>         Run governance on JSON proposals');
+    console.log('  --skill-install [source]   Install skills from registry');
+    console.log('  --skill-registry [action]   Manage skill registry sources');
+    console.log('  --storyteller <type>       Write a story (reflection, saga, journey, narrative)');
+    console.log('  --mcp-list                 List available MCP servers');
+    console.log('  --mcp-status               Show installed MCP servers');
+    console.log('  --mcp-install <name>       Install an MCP server');
+    console.log('  --mcp-remove <name>        Remove an MCP server');
+    console.log('  --publish-agent            Publish an agent to AgentStore');
+    console.log('  --archive-logs             Archive log files');
+    console.log('  --credible-init [name]     Initialize Credible Pod');
+    console.log('  --antigravity-status       Show installed skills status');
+    console.log('  -h, --help                 Show this help\n');
+    console.log('All existing commands still work: xray status, xray security-audit, etc.');
+}