0xray 2.2.4 → 3.0.1

package/.opencode/codex.codex

@@ -1,5 +1,5 @@
 {
-  "version": "2.2.2",
+  "version": "3.0.0",
   "terms": [
      1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68
   ],

package/.opencode/commands/dependency-audit.md

@@ -69,7 +69,7 @@ Comprehensive dependency analysis and security audit for all project dependencie
   "vulnerabilities": [
     {
       "package": "lodash",
-      "version": "2.2.2",
+      "version": "3.0.0",
       "severity": "high",
       "cve": "CVE-2021-23337",
       "description": "Command injection vulnerability"
@@ -85,14 +85,14 @@ Security-focused format for CI/CD integration:
 
 ```json
 {
-  "version": "2.2.2",
+  "version": "3.0.0",
   "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
   "runs": [
     {
       "tool": {
         "driver": {
           "name": "Dependency Audit",
-          "version": "2.2.2"
+          "version": "3.0.0"
         }
       },
       "results": [...]

package/.opencode/enforcer-config.json

@@ -1,6 +1,6 @@
 {
   "framework": "xray 2.0",
-  "version": "2.2.2",
+  "version": "3.0.0",
   "description": "Codex-compliant framework configuration for Credible UI project",
   "thresholds": {
     "bundleSize": {
@@ -220,7 +220,7 @@
       }
     },
     "codex": {
-      "version": "2.2.2",
+      "version": "3.0.0",
       "terms": [
         1,
         2,

package/AGENTS.md

@@ -4,11 +4,11 @@ Quick reference for xray AI orchestration framework (v15 MCPs-centric three-subs
 
 ## What is xray?
 
-xray provides intelligent multi-agent orchestration with automatic delegation and Codex compliance validation under the pure v2 three-subsystem model (Inference + External Governance via Dynamo + Autonomous Engine via thinDispatch 7-flow in MCP orchestrator). Agents operate via `.opencode/agents/*.yml` YML surfaces and 3 dedicated MCP skill servers — no manual setup needed.
+xray provides intelligent multi-agent orchestration with automatic delegation and Codex compliance validation under the pure v3 three-subsystem model (Inference + External Governance via Dynamo + Autonomous Engine via thinDispatch 7-flow in MCP orchestrator). Agents operate via `src/opencode/agents/*.yml` YML surfaces and 3 dedicated MCP skill servers — no manual setup needed.
 
 ## v15 MCPs-Centric Architecture
 
-The v2 release centers on **MCP (Model Context Protocol)** as the primary surface for agent skills. Three agent MCP servers handle governance deliberation:
+The v3 release centers on **MCP (Model Context Protocol)** as the primary surface for agent skills. Three agent MCP servers handle governance deliberation:
 
 - `code-review` — Proposal quality, code analysis, best practices
 - `security-audit` — Vulnerability detection, threat modeling
@@ -18,7 +18,7 @@ These MCP servers integrate with the three-subsystem pipeline for governance-gat
 
 ## xray Three-Subsystem Operation
 
-xray operates under the pure three-subsystem model: Inference + External Governance (Dynamo Solar SSOT) + Autonomous Engine (thinDispatch 7-flow in MCP orchestrator). Agents are declared in `.opencode/agents/*.yml` YML surfaces with zero manual setup.
+xray operates under the pure three-subsystem model: Inference + External Governance (Dynamo Solar SSOT) + Autonomous Engine (thinDispatch 7-flow in MCP orchestrator). Agents are declared in `src/opencode/agents/*.yml` YML surfaces with zero manual setup.
 
 ### Core Tenets
 - YML declarations are the SSOT
@@ -39,7 +39,7 @@ xray operates under the pure three-subsystem model: Inference + External Governa
 | **Scripts** | `scripts/` or `scripts/bash/` | `scripts/bash/my-script.sh` |
 | **Test Files** | `src/__tests__/` | `src/__tests__/unit/my-test.test.ts` |
 | **Source Code** | `src/` | `src/my-module.ts` |
-| **Config** | `config/` or `.opencode/xray/` | `.opencode/xray/config.json` |
+| **Config** | `config/` or `xray/` | `xray/config.json` |
 
 **Never save to root** - Root directory is for essential files only:
 - `README.md`, `CHANGELOG.md`, `package.json`, `tsconfig.json`
@@ -82,7 +82,7 @@ The Autonomous Engine routes via complexity:
 
 ## Codex
 
-xray enforces the Universal Development Codex (60 terms) via Dynamo governance. The codex lives in `.opencode/xray/codex.json`.
+xray enforces the Universal Development Codex (68 terms) via Dynamo governance. The codex lives in `xray/codex.json`.
 
 Pure v15 MCPs. Clean. Complete.
 
@@ -107,5 +107,5 @@ Pure v15 MCPs. Clean. Complete.
   - `status.ts` CLI command wired into `index.ts`
   - Orphaned files analyzed (not deleted): `security-audit.ts`, `src/security/` (11 files), `session-capture-processor.ts`, `activate-kernel-pipeline.ts`
 - **Hermes-agent bridge backward compat**: all JS/Python bridge files check for both `strray-ai` (old) and `0xray` (new). Default paths updated to `0xray`.
-  - **Test suite**: 162 files, 2196 tests (+ 44 skipped), 0 failures. Build passes clean.
-  - **OpenClaw e2e**: Phase 13 validates `logs/framework/activity.log` via agent tool event → hooks → frameworkLogger pipeline — 2196 tests, 0 failures.
+  - **Test suite**: 162 files, 2290 tests (+ 44 skipped), 0 failures. Build passes clean.
+  - **OpenClaw e2e**: Phase 13 validates `logs/framework/activity.log` via agent tool event → hooks → frameworkLogger pipeline — 2290 tests, 0 failures.

package/README.md

@@ -1,6 +1,6 @@
 # 0xRay — Self-Healing AI Governance OS
 
-**v2.2.3** — 41 agents · 44 skills · 15 MCPs servers · 9 codex terms · 160 test files
+**v3.0.1** — 41 agents · 44 skills · 15 MCPs servers · 20 codex terms · 160 test files
 
 [![Docs](https://img.shields.io/badge/docs-0xRayAI.github.io/xray-10b981?style=flat-square)](https://0xrayai.github.io/xray/)
 
@@ -62,7 +62,7 @@ AI coding assistants are powerful but unreliable. They hallucinate APIs, introdu
 ├─────────────────────────────────────────────────┤
 │           External Governance (Dynamo)           │
 │  Codex enforcement · Multi-agent review · SSOT  │
-│  15 MCPs servers (governance + knowledge skills) deliberate proposals │
+│  15 MCPs servers deliberate proposals via 3-skill governance │
 ├─────────────────────────────────────────────────┤
 │          Autonomous Engine (thinDispatch)        │
 │  Task routing · Multi-agent coordination        │
@@ -88,7 +88,7 @@ Routes tasks to the right agents based on complexity (simple tasks go to a singl
 | Platform | Install Command | What It Does |
 |----------|----------------|--------------|
 | **OpenCode** | `npx 0xray opencode install` | Installs as native plugin, seeds YML agent surfaces, merges configuration |
-| **Grok CLI** | `npx 0xray grok install` | Registers plugin + full MCP surface (governance, skills, orchestrator, enforcer + knowledge skills) |
+| **Grok CLI** | `npx 0xray grok install` | Registers plugin + xray-skills MCP server (13 tools, 44 skills) |
 | **Hermes Agent** | `npx 0xray hermes install` | Copies bridge plugin to `~/.hermes/plugins/` |
 | **OpenClaw** | `npx 0xray openclaw install` | Creates integration config at `.xray/config/openclaw.json` |
 
@@ -127,6 +127,8 @@ Postinstall automatically registers MCP servers with Grok CLI when `grok` is ava
 
 | Command | Description |
 |---------|-------------|
+| `mcp skills` | Run the xray-skills MCP server (stdio, 13 tools) |
+| `mcp governance` | Run the xray-governance MCP server (stdio, advanced) |
 | `mcp:list` | Browse available community MCP servers |
 | `mcp:status` | Show installed MCP servers |
 | `mcp:install <name>` | Install an MCP server from the registry |
@@ -175,11 +177,11 @@ Postinstall automatically registers MCP servers with Grok CLI when `grok` is ava
 
 ### Feature Flags (`features.json`)
 
-Every subsystem is configurable via `features.json` (located at `.opencode/xray/features.json` or `xray/features.json` after installation):
+Every subsystem is configurable via `features.json` (located at `xray/features.json`):
 
 ```json
 {
-  "version": "2.2.2",
+  "version": "3.0.0",
   "token_optimization": {
     "enabled": true,
     "max_context_tokens": 20000,
@@ -198,13 +200,13 @@ Toggle any feature on/off with `enabled: true/false`. The framework reloads conf
 
 ### Governance Setup
 
-Governance is your quality gate. Configure it under `inference_governance` in `features.json`:
+Governance is your quality gate. Configure it under `inference_governance` in `features.json`. The hosted Railway endpoint is available at `https://governance-production-69c3.up.railway.app/mcp`:
 
 ```json
 {
   "inference_governance": {
     "enabled": true,
-    "endpoint_url": "https://your-governance-endpoint/governance",
+    "endpoint_url": "https://governance-production-69c3.up.railway.app/mcp",
     "request_timeout_ms": 10000,
     "min_confidence_threshold": 0.5,
     "decision_logic": {
@@ -222,9 +224,11 @@ The governance pipeline works in three stages:
 
 **Options:** `requireExternalDynamo`, `minConfidence`, `enableSolarAdjustment`, `timeoutMs`, `maxAbstentionThreshold`.
 
+> ⚠️ **Privacy Notice**: All proposals submitted to the governance endpoint are **public by default**. They are **not persisted on-chain** unless the `onChain: true` flag is set. 0xRay framework self-governance proposals (tagged `0xray`) save on-chain by default; project proposals do not. Set `onChain: false` or omit the field for non-public governance checks.
+
 ---
 
-## Included Agents (42)
+## Included Agents (41)
 
 0xRay ships with specialized agents for every engineering domain:
 
@@ -251,19 +255,52 @@ The governance pipeline works in three stages:
 | **Code Analyzer** | Code metrics, complexity analysis |
 | **Log Monitor** | Diagnostics, error pattern detection |
 
-Plus 22 domain-specialist subagents for full-stack, database, mobile, UI/UX, and more. All agents are declared declaratively in `.opencode/agents/*.yml` — add or customize without touching code.
+Plus 22 domain-specialist subagents for full-stack, database, mobile, UI/UX, and more. All agents are declared declaratively in `src/opencode/agents/*.yml` — add or customize without touching code.
 
 ---
 
-## Included MCP Servers (41)
+## MCP Servers
+
+0xRay ships two MCP servers. The primary user-facing one runs standalone with zero configuration:
+
+### xray-skills (public)
+13 tools for code review, security audit, API design, database design, testing strategy, and more. Runs via `npx`:
 
-Model Context Protocol servers provide the skill infrastructure:
+```json
+{
+  "mcpServers": {
+    "xray-skills": {
+      "command": "npx",
+      "args": ["-y", "0xray", "mcp", "skills"]
+    }
+  }
+}
+```
 
-**Governance & Review (5):** code-review, security-audit, researcher, enforcer-tools, governance
+- **13 tools**: skill-code-review, skill-security-audit, skill-api-design, skill-database-design, skill-project-analysis, skill-testing-strategy, skill-performance-optimization, skill-ui-ux-design, skill-devops-deployment, skill-documentation-generation, skill-storyteller, list-skills, invoke-skill
+- **44 knowledge skills** (SKILL.md) for chat-based development assistance
+- No external services, no API keys, no configuration needed
+
+### xray-governance (advanced)
+Orchestrates proposals through code-review + security-audit + researcher + external Dynamo SSOT. Requires additional setup.
+
+```json
+{
+  "mcpServers": {
+    "xray-governance": {
+      "command": "npx",
+      "args": ["-y", "0xray", "mcp", "governance"]
+    }
+  }
+}
+```
 
-**Core Framework (12):** architect-tools, boot-orchestrator, estimation, framework-compliance-audit, framework-help, lint, model-health-check, orchestrator, performance-analysis, processor-pipeline, state-manager, auto-format
+Or connect to the hosted Railway endpoint:
+`https://governance-production-69c3.up.railway.app/mcp`
 
-**Knowledge Skills (24):** api-design, architecture-patterns, bug-triage-specialist, code-analyzer, content-creator, database-design, devops-deployment, git-workflow, growth-strategist, log-monitor, mobile-development, multimodal-looker, performance-optimization, project-analysis, refactoring-strategies, security-scan, seo-consultant, session-management, skill-invocation, strategist, tech-writer, testing-best-practices, testing-strategy, ui-ux-design
+> **Marketplace**: 0xRay is listed on the [xAI Plugin Marketplace](https://github.com/xai-org/plugin-marketplace) (PR #23) — one-click install for Grok users.
+>
+> **Deploy your own**: see the [custom MCP server guide](https://0xrayai.github.io/xray/docs/mcp/deploy-custom) for stdio and Railway HTTP deployment patterns.
 
 ---
 
@@ -302,7 +339,7 @@ npx 0xray status
 npx 0xray skill:install
 
 # 3. Configure governance (optional)
-# Edit .opencode/xray/features.json
+# Edit xray/features.json
 
 # 4. View full agent documentation
 less AGENTS.md
@@ -319,7 +356,8 @@ npx 0xray health
 - **[CHANGELOG.md](CHANGELOG.md)** — Version history and release notes
 - **[docs/](docs/)** — Architecture docs, governance model, integration guides
 - **[Docs](https://0xrayai.github.io/xray/)** — Full documentation site
-- **[Dynamo Governance](https://dynamo.rippel.ai/vortex)** — Mint governance proposals for donations
+- **[Dynamo Governance](https://0xrayai.github.io/xray/docs/guides/self-hosting-dynamo)** — External governance service (self-host your own instance — see docs)
+- **[Deploy a Custom MCP Server](https://0xrayai.github.io/xray/docs/mcp/deploy-custom)** — Create, register, and deploy your own MCP server (stdio or Railway HTTP)
 - **[GitHub](https://github.com/0xRayAI/xray)** — Source code, issues, discussions
 - **[npm](https://www.npmjs.com/package/0xray)** — Package registry
 

package/dist/AGENTS.md

@@ -4,11 +4,11 @@ Quick reference for xray AI orchestration framework (v15 MCPs-centric three-subs
 
 ## What is xray?
 
-xray provides intelligent multi-agent orchestration with automatic delegation and Codex compliance validation under the pure v2 three-subsystem model (Inference + External Governance via Dynamo + Autonomous Engine via thinDispatch 7-flow in MCP orchestrator). Agents operate via `.opencode/agents/*.yml` YML surfaces and 3 dedicated MCP skill servers — no manual setup needed.
+xray provides intelligent multi-agent orchestration with automatic delegation and Codex compliance validation under the pure v3 three-subsystem model (Inference + External Governance via Dynamo + Autonomous Engine via thinDispatch 7-flow in MCP orchestrator). Agents operate via `src/opencode/agents/*.yml` YML surfaces and 3 dedicated MCP skill servers — no manual setup needed.
 
 ## v15 MCPs-Centric Architecture
 
-The v2 release centers on **MCP (Model Context Protocol)** as the primary surface for agent skills. Three agent MCP servers handle governance deliberation:
+The v3 release centers on **MCP (Model Context Protocol)** as the primary surface for agent skills. Three agent MCP servers handle governance deliberation:
 
 - `code-review` — Proposal quality, code analysis, best practices
 - `security-audit` — Vulnerability detection, threat modeling
@@ -18,7 +18,7 @@ These MCP servers integrate with the three-subsystem pipeline for governance-gat
 
 ## xray Three-Subsystem Operation
 
-xray operates under the pure three-subsystem model: Inference + External Governance (Dynamo Solar SSOT) + Autonomous Engine (thinDispatch 7-flow in MCP orchestrator). Agents are declared in `.opencode/agents/*.yml` YML surfaces with zero manual setup.
+xray operates under the pure three-subsystem model: Inference + External Governance (Dynamo Solar SSOT) + Autonomous Engine (thinDispatch 7-flow in MCP orchestrator). Agents are declared in `src/opencode/agents/*.yml` YML surfaces with zero manual setup.
 
 ### Core Tenets
 - YML declarations are the SSOT
@@ -39,7 +39,7 @@ xray operates under the pure three-subsystem model: Inference + External Governa
 | **Scripts** | `scripts/` or `scripts/bash/` | `scripts/bash/my-script.sh` |
 | **Test Files** | `src/__tests__/` | `src/__tests__/unit/my-test.test.ts` |
 | **Source Code** | `src/` | `src/my-module.ts` |
-| **Config** | `config/` or `.opencode/xray/` | `.opencode/xray/config.json` |
+| **Config** | `config/` or `xray/` | `xray/config.json` |
 
 **Never save to root** - Root directory is for essential files only:
 - `README.md`, `CHANGELOG.md`, `package.json`, `tsconfig.json`
@@ -82,7 +82,7 @@ The Autonomous Engine routes via complexity:
 
 ## Codex
 
-xray enforces the Universal Development Codex (60 terms) via Dynamo governance. The codex lives in `.opencode/xray/codex.json`.
+xray enforces the Universal Development Codex (68 terms) via Dynamo governance. The codex lives in `xray/codex.json`.
 
 Pure v15 MCPs. Clean. Complete.
 
@@ -107,5 +107,5 @@ Pure v15 MCPs. Clean. Complete.
   - `status.ts` CLI command wired into `index.ts`
   - Orphaned files analyzed (not deleted): `security-audit.ts`, `src/security/` (11 files), `session-capture-processor.ts`, `activate-kernel-pipeline.ts`
 - **Hermes-agent bridge backward compat**: all JS/Python bridge files check for both `strray-ai` (old) and `0xray` (new). Default paths updated to `0xray`.
-  - **Test suite**: 162 files, 2196 tests (+ 44 skipped), 0 failures. Build passes clean.
-  - **OpenClaw e2e**: Phase 13 validates `logs/framework/activity.log` via agent tool event → hooks → frameworkLogger pipeline — 2196 tests, 0 failures.
+  - **Test suite**: 162 files, 2290 tests (+ 44 skipped), 0 failures. Build passes clean.
+  - **OpenClaw e2e**: Phase 13 validates `logs/framework/activity.log` via agent tool event → hooks → frameworkLogger pipeline — 2290 tests, 0 failures.

package/dist/CHANGELOG.md

@@ -4,6 +4,153 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Conventional Commits](https://www.conventionalcommits.org/).
 
+## [3.0.1] - 2026-06-12
+
+### 🔄 Changes
+
+- Version bump
+
+---
+
+## [3.0.0] - 2026-06-12
+
+### 🧠 Governance Closure + Full System Integration
+
+v3.0 closes the governance loop: all enforcement flows through the shared gate, governance is enabled by default with external Dynamo, and source changes to the governance fabric are auto-detected and proposed for deliberation.
+
+### 🌟 Highlights
+
+- **Governance default-on**: `enabled: true` in both `DEFAULT_GOVERNANCE_CONFIG` and `xray/features.json`. Endpoint defaults to `https://mcp-production-80e2.up.railway.app/governance`. `GOVERNANCE_ENDPOINT` env var overrides all defaults. No manual opt-in required.
+- **E2E pipeline smoketest extended to 10 steps**: gate → escalation → CI → consumer → governance → nucleus → inference → SelfProposal → EscalationEngine → LightweightValidator. All 10 pass.
+- **Source-change governance detector**: `scripts/ci/source-change-governance-detector.mjs` watches codex.json, features.json, enforcement/nucleus/postprocessor/governance files. Auto-submits strategic proposals via `handleGovernRequest` with `requireExternalDynamo: true`. Wired in CI enforcement job.
+- **Consumer path hygiene audit**: All published scripts (`postinstall.cjs`, `setup.cjs`, `prepare-consumer.cjs`) now use robust consumer-aware path resolution. Nucleus exports map (`./nucleus/*`) verified via consumer plugin test.
+
+### 🏪 Marketplace & Polish
+
+- **Marketplace PR #23** submitted to `xai-org/plugin-marketplace` — 13 xray-skills tools, 44 skills, 2 MCP servers
+- **xray-skills MCP server**: 13 tools via `npx -y 0xray mcp skills` — standalone, zero config
+- **Railway governance HTTP MCP**: multi-client session support, JSON response mode, GET `/mcp` SSE endpoint
+- **`.mcp.json`**: xray-skills (public) + xray-governance (advanced) declared
+- **`.plugin/plugin.json`**: Marketplace manifest with correct tool/skill counts
+- **skills/ symlink** → `src/skills/` for marketplace scanner discovery
+
+### 🔧 Changes
+
+#### Governance & Enforcement (Phases 0-1)
+- **Retro governance ritual (Phase 0)**: 5 proposals submitted via `handleGovernRequest` covering enforcement gate canonical surface, per-pipeline CI scanners, nucleus/SelfProposal wiring, legacy purge, consumer hooks. All 5 approved.
+- **Governance lazy init**: `governance-service.ts` calls `initializeGovernanceIntegration()` in `govern()` if not initialized — handles inference cycle calls outside boot orchestrator lifecycle.
+- **Governance endpoint default-on**: `src/integrations/governance/types.ts` — `DEFAULT_GOVERNANCE_CONFIG.enabled → true`, `endpointUrl → Railway URL`. `xray/features.json` added `inference_governance` section.
+- **Source-change detector (Phase 1)**: `scripts/ci/source-change-governance-detector.mjs` — detects changes to 18+ governance-interest files, builds proposals from CATEGORY_MAP, requires external Dynamo. Wired in `ci.yml` enforcement job step.
+
+#### Docs Cascade (Phase 2)
+- `V3-ENFORCEMENT-PIPELINES.md` → v3.3.1+ (full enforcement cascade documented)
+- `PIPELINE_INVENTORY.md` → v3.3.1+ (new CI scanners, consumer hooks, coverage gate, governance detector)
+- `docs/index.md` → v3 stats (7 agents, 3 MCP servers, 29 validators, 2880 tests)
+
+#### Pipeline Exerciser (Phase 3)
+- `e2e-pipeline-smoke.mjs` extended from 4 to 10 steps covering all major pipelines (gate, escalation, CI, consumer, governance, nucleus/boot, inference, SelfProposal, EscalationEngine, LightweightValidator). All 10 pass.
+- EscalationEngine must load before LightweightValidator (ESM circular dep on frameworkLogger).
+
+#### Codex Closure (Phase 4)
+- `processorRoadmap` terms 7 (ErrorResolution), 74 (BootWiring), 75 (Coverage) → done
+- `validationCriteria`: 6/8 true (governance approval, metamorphosis threshold, consumer verification, no console.*, boot wiring, coverage gate)
+- `perPipelineValidationMatrix`: 15+ entries, `gapsRemaining` empty, `enforcementGaps` 2 remaining
+- Terms 73 (orphan pre-PR check), 78 (compat shim scanner) added with CI wiring
+
+#### Build & Consumer Hygiene (Phase 5)
+- `package.json` exports: added `./nucleus` and `./nucleus/*` for consumer plugin-registry access
+- `tsconfig.full.json`: excludes test files from compilation
+- `postinstall.cjs`, `setup.cjs`, `prepare-consumer.cjs`: consumer-aware path resolution (robust `node_modules` detection)
+- `verify-consumer.sh`: Phase 5b (29 validators + gate) + nucleus plugin-registry test both PASS
+- Full verification: 2880 unit tests pass, typecheck clean, 0 console.* in non-CLI source
+
+#### Compat & Scanners
+- `scripts/ci/compat-shim-scanner.mjs` (term 78): scans for legacy fallback patterns, compat exports, @deprecated. Wired as non-blocking CI step.
+- `scripts/ci/orphan-code-pre-pr-check.mjs` (term 73): git diff deletion scanner with 6-check protocol. Wired in CI.
+- `scripts/hooks/install-hooks.cjs`: consumer-aware pre-commit hook installer, wired via postinstall + setup.
+- `scripts/hooks/run-hook.js`: inline regex replaced with LightweightValidator + gate call (shared enforcement path).
+
+### 📊 Stats
+- **2880 tests pass**, typecheck clean
+- **29 validators** in registry, all mapped in `validatorTermMap`
+- **10/10 E2E pipeline steps** pass
+- **3/4 bridge E2Es** pass (hermes: pre-existing model variance in JSON output parsing)
+- **18 governance-interest files** tracked by source-change detector
+- **Consumer verification**: Phase 5 (plugin reg) + Phase 5b (29 validators + gate) both PASS
+
+## [3.3.0] - 2026-06-11
+
+### ✅ All Three Remaining Matrix Gaps Closed
+
+Resolved the final `gapsRemaining` entries — PostProcessor non-blocking, Inference non-blocking, and Coverage gate.
+
+- **PostProcessor escalation from gate**: `afterToolHook` in enforcement-gate.ts now filters pipeline validator violations by severity ("error"/"blocking") and passes them as `criticalViolations` in the PostProcessor context. `PostProcessor.executePostProcessorLoop` evaluates them through `EscalationEngine.evaluateEscalation`, triggering real escalation (manual-intervention/rollback/emergency) instead of logs-only.
+- **Inference 1/3/5 blocking**: `generateProposals` in inference-cycle.ts now filters out proposals with confidence ≤ 0.3 after NoOverEngineeringValidator (terms 1/3) and SingleResponsibilityValidator (term 5) adjustments. These proposals are logged as `proposal-blocked` via frameworkLogger. Non-severe violations still adjust confidence by 0.85x as before.
+- **Coverage gate (term 75)**: vitest.config.ts now has coverage thresholds (statements 60%, branches 50%, functions 55%, lines 60%). CI enforcement job runs `npx vitest run --coverage` as a blocking step. Fails CI if thresholds not met.
+
+### 🔧 Changes
+- `src/postprocessor/types.ts`: Added `criticalViolations` field to `PostProcessorContext`
+- `src/postprocessor/PostProcessor.ts`: Escalation engine invoked on gate-sourced critical violations
+- `src/integrations/enforcement-gate.ts`: Critical violations passed to PostProcessor loop context
+- `src/inference/inference-cycle.ts`: Proposals with confidence ≤ 0.3 filtered out after validator adjustments
+- `vitest.config.ts`: Coverage thresholds enabled (stmts 60, branches 50, funcs 55, lines 60)
+- `.github/workflows/ci.yml`: New coverage gate step in enforcement job
+- `.opencode/xray/codex.json`: 3.3.0 — all 3 gaps removed from `gapsRemaining` + `enforcementGaps`. New `coverage-gate` pipeline entry. Post-processor + inference-cycle entries updated to note blocking/escalation. `ci-gate` activeForTerms includes 75.
+
+## [3.2.1] - 2026-06-11
+
+### 🚦 Enforcement Pipeline Cascade
+
+Closing the "hooks or CI/CD" gap: all four TUI/CLI integrations (OpenCode, Hermes, Grok, OpenClaw) now exclusively route through `src/integrations/enforcement-gate.ts` (full 29-validator registry + v3 PostProcessor loop), and CI now calls the registry directly with no snippet-safe filter.
+
+- **P0-1**: Removed duplicate legacy ProcessorManager block from `xray-codex-injection.ts` (38 lines, ran afterToolHook alongside inline quality gate)
+- **P0-2**: Fixed Grok silent fail-open — catch block now returns `allow_with_error` with reason/resonance/error
+- **P1-1/P1-2**: Consolidated `loadStateManager` to prefer `xray*` globals with logged `strRay*` fallback; `bridge.mjs` renamed to `XrayStateManager` with `||` fallback
+- **P1-3/P1-4**: Removed dead types/interfaces/imports from `xray-codex-injection.ts`; shrunk legacy compat comment
+- **`scripts/ci/enforce-validators.mjs`**: Direct ValidatorRegistry invocation (29 validators, no snippet-safe filter, no dead `--terms` flag). Supports `--all`, explicit paths, `git diff HEAD` auto-detection
+- **CI enforcement job**: Replaced `bridge.mjs codex-check --focus "full" --terms "..."` (10 of 29 validators) with `enforce-validators.mjs --all`
+- **CI consumer step**: `npm pack` → `npm install` → registry load test (expects 29) + enforcement gate load test (beforeToolHook/afterToolHook) — runs on every PR
+- **`verify-consumer.sh` Phase 5b**: Full-registry + gate exercise from consumer tarball
+- **Codex**: v3.2.1 — 8 ci-lint terms partial→wired, new `ci-enforce-consumer` pipeline, `gapsRemaining` reduced by 2 entries
+
+### 🔧 Changes
+- `src/plugin/xray-codex-injection.ts`: beforeToolHook/afterToolHook sole post-tool path
+- `src/integrations/hermes-agent/bridge.mjs`: `XrayStateManager` with backward-compat fallback
+- `src/integrations/grok/hooks/pre-tool-use.ts`: `allow_with_error` on gate error
+- `src/integrations/enforcement-gate.ts`: `loadStateManager` prefers `xray*` globals
+- `scripts/ci/enforce-validators.mjs`: 109 lines — new
+- `.github/workflows/ci.yml`: Enforcement job reworked (registry + consumer steps)
+- `.opencode/xray/codex.json`: 3.2.1 — perPipelineValidationMatrix expanded, gaps reduced
+- `docs/reflections/enforcement-gate-pipeline-resolution.md`: Updated
+
+## [3.0.0] - 2026-06-10
+
+### 🚀 Major: Nucleus Architecture (v3)
+
+The callable core is now `src/nucleus/` — governance, orchestration, dispatch, and default plugins live here. MCP is the standard external surface; nucleus is the library beneath it.
+
+- **Phase 1 (Nucleus Primary)**: Governance call site audit (29 sites), MCP fallback chain removed from inference-cycle.ts (287 lines, 9 methods, 7 `XRAY_FORCE_MCP_GOVERNANCE` checks), opencode-cli-invoker.ts cleaned, boot-orchestrator.server.ts slimmed ~80%, `src/nucleus/orchestrator.ts` + `thin-dispatch.ts` created, 50 nucleus-primary tests
+- **Phase 2 (Plugin System)**: 24 knowledge-skill servers audited, pluginRegistry extended with listTools/registerServer/getToolPlugin/listSkillTools, `src/nucleus/default-plugins.ts` registers all 24 servers as plugins, MCP bypass paths deprecated, root MCP server audit
+- **Phase 3 (Self-Evolution)**: SelfProposalEngine auto-wired into PostProcessor as default metamorphosis engine, safe apply with backup/rollback, circuit breaker, `scripts/run-self-evolution.sh`
+- **Phase 4 (Legacy Cleanup)**: `XRAY_FORCE_MCP_GOVERNANCE` removed from CLI/govern/.mcp.json/grok-cli, MCP+in-process fallback removed from governance-service, legacy `.grok/plugins/strray-ai/` deleted, `STRRAY_HOME` removed
+
+### 🔧 Changes
+- `registerDefaultPlugins()` now called during NucleusOrchestrator boot sequence (plugin-registration step)
+- FrameworkLogger discipline enforced across all production paths
+- ~17,000 LOC net removed across subtract pass + v3 refactoring
+
+### ✅ Verification
+- 2846 tests passed (2890 total, 44 skipped), 163 test files — 0 failures
+- Consumer verification gate: 4/4 bridge E2Es (Hermes 46, OpenCode 34, OpenClaw 101, Grok 53+2 skipped)
+- npm pack → fresh consumer install → plugin dispatch → activity.log (728 entries)
+- tsc --noEmit clean
+
+### 🏷️ Package
+- Renamed: `strray-ai` → `0xray` across all source files, CLI, bridges, docs
+- Published to npm as `0xray@3.0.0`
+
+---
+
 ## [2.2.4] - 2026-06-10
 
 ### 🐛 Bug Fixes

package/dist/README.md

@@ -1,6 +1,6 @@
 # 0xRay — Self-Healing AI Governance OS
 
-**v2.2.3** — 41 agents · 44 skills · 15 MCPs servers · 9 codex terms · 160 test files
+**v3.0.1** — 41 agents · 44 skills · 15 MCPs servers · 20 codex terms · 160 test files
 
 [![Docs](https://img.shields.io/badge/docs-0xRayAI.github.io/xray-10b981?style=flat-square)](https://0xrayai.github.io/xray/)
 
@@ -62,7 +62,7 @@ AI coding assistants are powerful but unreliable. They hallucinate APIs, introdu
 ├─────────────────────────────────────────────────┤
 │           External Governance (Dynamo)           │
 │  Codex enforcement · Multi-agent review · SSOT  │
-│  15 MCPs servers (governance + knowledge skills) deliberate proposals │
+│  15 MCPs servers deliberate proposals via 3-skill governance │
 ├─────────────────────────────────────────────────┤
 │          Autonomous Engine (thinDispatch)        │
 │  Task routing · Multi-agent coordination        │
@@ -88,7 +88,7 @@ Routes tasks to the right agents based on complexity (simple tasks go to a singl
 | Platform | Install Command | What It Does |
 |----------|----------------|--------------|
 | **OpenCode** | `npx 0xray opencode install` | Installs as native plugin, seeds YML agent surfaces, merges configuration |
-| **Grok CLI** | `npx 0xray grok install` | Registers plugin + full MCP surface (governance, skills, orchestrator, enforcer + knowledge skills) |
+| **Grok CLI** | `npx 0xray grok install` | Registers plugin + xray-skills MCP server (13 tools, 44 skills) |
 | **Hermes Agent** | `npx 0xray hermes install` | Copies bridge plugin to `~/.hermes/plugins/` |
 | **OpenClaw** | `npx 0xray openclaw install` | Creates integration config at `.xray/config/openclaw.json` |
 
@@ -127,6 +127,8 @@ Postinstall automatically registers MCP servers with Grok CLI when `grok` is ava
 
 | Command | Description |
 |---------|-------------|
+| `mcp skills` | Run the xray-skills MCP server (stdio, 13 tools) |
+| `mcp governance` | Run the xray-governance MCP server (stdio, advanced) |
 | `mcp:list` | Browse available community MCP servers |
 | `mcp:status` | Show installed MCP servers |
 | `mcp:install <name>` | Install an MCP server from the registry |
@@ -175,11 +177,11 @@ Postinstall automatically registers MCP servers with Grok CLI when `grok` is ava
 
 ### Feature Flags (`features.json`)
 
-Every subsystem is configurable via `features.json` (located at `.opencode/xray/features.json` or `xray/features.json` after installation):
+Every subsystem is configurable via `features.json` (located at `xray/features.json`):
 
 ```json
 {
-  "version": "2.2.2",
+  "version": "3.0.0",
   "token_optimization": {
     "enabled": true,
     "max_context_tokens": 20000,
@@ -198,13 +200,13 @@ Toggle any feature on/off with `enabled: true/false`. The framework reloads conf
 
 ### Governance Setup
 
-Governance is your quality gate. Configure it under `inference_governance` in `features.json`:
+Governance is your quality gate. Configure it under `inference_governance` in `features.json`. The hosted Railway endpoint is available at `https://governance-production-69c3.up.railway.app/mcp`:
 
 ```json
 {
   "inference_governance": {
     "enabled": true,
-    "endpoint_url": "https://your-governance-endpoint/governance",
+    "endpoint_url": "https://governance-production-69c3.up.railway.app/mcp",
     "request_timeout_ms": 10000,
     "min_confidence_threshold": 0.5,
     "decision_logic": {
@@ -222,9 +224,11 @@ The governance pipeline works in three stages:
 
 **Options:** `requireExternalDynamo`, `minConfidence`, `enableSolarAdjustment`, `timeoutMs`, `maxAbstentionThreshold`.
 
+> ⚠️ **Privacy Notice**: All proposals submitted to the governance endpoint are **public by default**. They are **not persisted on-chain** unless the `onChain: true` flag is set. 0xRay framework self-governance proposals (tagged `0xray`) save on-chain by default; project proposals do not. Set `onChain: false` or omit the field for non-public governance checks.
+
 ---
 
-## Included Agents (42)
+## Included Agents (41)
 
 0xRay ships with specialized agents for every engineering domain:
 
@@ -251,19 +255,52 @@ The governance pipeline works in three stages:
 | **Code Analyzer** | Code metrics, complexity analysis |
 | **Log Monitor** | Diagnostics, error pattern detection |
 
-Plus 22 domain-specialist subagents for full-stack, database, mobile, UI/UX, and more. All agents are declared declaratively in `.opencode/agents/*.yml` — add or customize without touching code.
+Plus 22 domain-specialist subagents for full-stack, database, mobile, UI/UX, and more. All agents are declared declaratively in `src/opencode/agents/*.yml` — add or customize without touching code.
 
 ---
 
-## Included MCP Servers (41)
+## MCP Servers
+
+0xRay ships two MCP servers. The primary user-facing one runs standalone with zero configuration:
+
+### xray-skills (public)
+13 tools for code review, security audit, API design, database design, testing strategy, and more. Runs via `npx`:
 
-Model Context Protocol servers provide the skill infrastructure:
+```json
+{
+  "mcpServers": {
+    "xray-skills": {
+      "command": "npx",
+      "args": ["-y", "0xray", "mcp", "skills"]
+    }
+  }
+}
+```
 
-**Governance & Review (5):** code-review, security-audit, researcher, enforcer-tools, governance
+- **13 tools**: skill-code-review, skill-security-audit, skill-api-design, skill-database-design, skill-project-analysis, skill-testing-strategy, skill-performance-optimization, skill-ui-ux-design, skill-devops-deployment, skill-documentation-generation, skill-storyteller, list-skills, invoke-skill
+- **44 knowledge skills** (SKILL.md) for chat-based development assistance
+- No external services, no API keys, no configuration needed
+
+### xray-governance (advanced)
+Orchestrates proposals through code-review + security-audit + researcher + external Dynamo SSOT. Requires additional setup.
+
+```json
+{
+  "mcpServers": {
+    "xray-governance": {
+      "command": "npx",
+      "args": ["-y", "0xray", "mcp", "governance"]
+    }
+  }
+}
+```
 
-**Core Framework (12):** architect-tools, boot-orchestrator, estimation, framework-compliance-audit, framework-help, lint, model-health-check, orchestrator, performance-analysis, processor-pipeline, state-manager, auto-format
+Or connect to the hosted Railway endpoint:
+`https://governance-production-69c3.up.railway.app/mcp`
 
-**Knowledge Skills (24):** api-design, architecture-patterns, bug-triage-specialist, code-analyzer, content-creator, database-design, devops-deployment, git-workflow, growth-strategist, log-monitor, mobile-development, multimodal-looker, performance-optimization, project-analysis, refactoring-strategies, security-scan, seo-consultant, session-management, skill-invocation, strategist, tech-writer, testing-best-practices, testing-strategy, ui-ux-design
+> **Marketplace**: 0xRay is listed on the [xAI Plugin Marketplace](https://github.com/xai-org/plugin-marketplace) (PR #23) — one-click install for Grok users.
+>
+> **Deploy your own**: see the [custom MCP server guide](https://0xrayai.github.io/xray/docs/mcp/deploy-custom) for stdio and Railway HTTP deployment patterns.
 
 ---
 
@@ -302,7 +339,7 @@ npx 0xray status
 npx 0xray skill:install
 
 # 3. Configure governance (optional)
-# Edit .opencode/xray/features.json
+# Edit xray/features.json
 
 # 4. View full agent documentation
 less AGENTS.md
@@ -319,7 +356,8 @@ npx 0xray health
 - **[CHANGELOG.md](CHANGELOG.md)** — Version history and release notes
 - **[docs/](docs/)** — Architecture docs, governance model, integration guides
 - **[Docs](https://0xrayai.github.io/xray/)** — Full documentation site
-- **[Dynamo Governance](https://dynamo.rippel.ai/vortex)** — Mint governance proposals for donations
+- **[Dynamo Governance](https://0xrayai.github.io/xray/docs/guides/self-hosting-dynamo)** — External governance service (self-host your own instance — see docs)
+- **[Deploy a Custom MCP Server](https://0xrayai.github.io/xray/docs/mcp/deploy-custom)** — Create, register, and deploy your own MCP server (stdio or Railway HTTP)
 - **[GitHub](https://github.com/0xRayAI/xray)** — Source code, issues, discussions
 - **[npm](https://www.npmjs.com/package/0xray)** — Package registry
 

package/dist/agents/architect.js

@@ -54,3 +54,4 @@ Stop after giving your answer. Do not loop.`,
         },
     },
 };
+//# sourceMappingURL=architect.js.map

package/dist/agents/architect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"architect.js","sourceRoot":"","sources":["../../src/agents/architect.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,SAAS,GAAgB;IACpC,IAAI,EAAE,WAAW;IACjB,YAAY,EAAE;QACZ,cAAc;QACd,QAAQ;QACR,oBAAoB;QACpB,YAAY;QACZ,qBAAqB;KACtB;IACD,aAAa,EAAE,GAAG;IAClB,OAAO,EAAE,IAAI;IACb,WAAW,EACT,0DAA0D;IAC5D,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE;;;;;;;;;;;;;;4CAckC;IAC1C,WAAW,EAAE,GAAG;IAChB,KAAK,EAAE;QACL,OAAO,EAAE;YACP,MAAM;YACN,MAAM;YACN,OAAO;YACP,kBAAkB;YAClB,iBAAiB;YACjB,qBAAqB;YACrB,qBAAqB;YACrB,oDAAoD;YACpD,cAAc;YACd,mBAAmB;YACnB,sBAAsB;YACtB,gCAAgC;YAChC,wBAAwB;YACxB,wBAAwB;SACzB;KACF;IACD,UAAU,EAAE;QACV,IAAI,EAAE,OAAO;QACb,IAAI,EAAE;YACJ,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO;SACb;KACF;CACF,CAAC"}

package/dist/agents/backend-engineer.js

@@ -79,3 +79,4 @@ Use database-engineer skills for:
 
 Tone: Systematic, secure, performance-oriented.`,
 };
+//# sourceMappingURL=backend-engineer.js.map

package/dist/agents/backend-engineer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-engineer.js","sourceRoot":"","sources":["../../src/agents/backend-engineer.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAgB;IAC1C,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE,UAAU;IAChB,YAAY,EAAE;QACZ,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,qBAAqB;QACrB,oBAAoB;QACpB,gBAAgB;QAChB,cAAc;QACd,gBAAgB;KACjB;IACD,aAAa,EAAE,EAAE;IACjB,WAAW,EAAE,GAAG;IAChB,OAAO,EAAE,IAAI;IACb,WAAW,EACT,6HAA6H;IAE/H,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gDAwDsC;CAC/C,CAAC"}